requirements.in

# The one version constraint written by hand rather than resolved. DuckDB
# extensions are ABI-locked to the exact DuckDB version, so this can only move
# to a release that duckdb-extension-spatial has also published on PyPI -
# .claude/hooks/session-start.sh reads this pin back out of the compiled
# requirements.txt to seed the sandbox's spatial extension offline. A
# Dependabot PR bumping it is only safe once the matching extension build
# exists; check PyPI before merging one.
duckdb==1.5.5
requests
rasterio
numpy
pillow
pmtiles
shapely
# Not here on purpose: tifffile and imagecodecs. README.md's corrupted-quad
# note cites them as the second, independent decoder that confirmed the three
# bad USGS quads - that was a one-off investigation, not something any shipped
# script imports. Install them ad hoc to redo that check; they cost ~84MB in
# every build job the rest of the time. pdfplumber (with pdfminer.six and
# pypdfium2 behind it, ~18MB) went the same way, and affine came out because
# nothing imports it and rasterio pulls it in regardless.

# Explicit rather than transitive: export_trails.py reprojects to EPSG:5070
# to simplify in real metres. rasterio happens to pull pyproj in locally,
# which is exactly why this was missing - it worked here and failed in CI.
pyproj
boto3

# export_conditions.py alone, and the only reason this pipeline talks to
# Postgres at all (features/CONDITIONS_DELIVERY.md). Raw psycopg rather than
# SQLAlchemy on purpose: the job is two SELECTs against a schema the backend
# owns, and pulling an ORM in here would create a second place that believes
# it knows the shape of those tables.
psycopg[binary]

# check_deployment.py alone, to read .github/expected-origins.yml (#431).
# YAML rather than JSON for that file specifically because the reasoning
# behind each origin is the valuable half - which origin serves whom, and what
# breaks when it is dropped - and JSON cannot carry a comment. The same
# argument .github/expected-settings.yml is already written on.
PyYAML

# Not here either, and recorded like tifffile above rather than left to be
# rediscovered: pypdf, which fetch_club_pdfs.py imports lazily to extract
# text from the PDFs the maintaining clubs publish (#669). Install it ad hoc
# to run that fetch (`pip install pypdf` - pure Python, ~2MB; NOT the
# pdfplumber stack removed above, whose 18MB bought column geometry the club
# PDFs' text layers turn out not to carry - lib/club_pdfs.py holds the
# measurement). It stays out of the pins because no workflow runs the fetch
# yet - the club_pdf kind is review-only until a club answers its licence ask
# - and because pinning it here means recompiling both lockfiles, which the
# current uv resolves with different environment markers than the checked-in
# files (numpy/rasterio silently move on Python 3.12+). The day a workflow
# needs this fetch, move pypdf up beside PyYAML and recompile both files
# deliberately, upgrades reviewed as upgrades.