fastapi>=0.115,<1.0
uvicorn[standard]>=0.30,<1.0

# Phase 2b optional dependency.
# Uncomment the next line (and set POLICY_JWT_VERIFY=true + POLICY_JWT_PUBLIC_KEY)
# to enable real RS256 JWT verification. Without it, the service decodes
# bearer tokens WITHOUT verifying the signature and surfaces
# warnings: ['auth_not_verified'] on every such response.
# PyJWT>=2.8,<3.0