Cargo.toml

# Virtual workspace root for ES-Runtime (Layer A).
#
# Crate layout and dependency direction are fixed by ARCHITECTURE.md §2 / DECISIONS.md D11:
#
#   common → engine → providers → runtime → default-providers → runtime-cli
#
# Each crate may depend only on crates to its left. The `v8` crate appears *only*
# in `engine`; real I/O appears *only* in `default-providers`. Phase 1 introduces
# `common` and `engine`; the remaining crates are added in their own phases
# (SPEC.md §6) to keep merged code free of stubs.
[workspace]
resolver = "3"
members = [
    "crates/common",
    "crates/engine",
    "crates/providers",
    "crates/runtime",
    "crates/default-providers",
    "crates/runtime-cli",
]

# Shared package metadata. Individual crates inherit via `field.workspace = true`.
# Versioning starts at 0.1.0 (DECISIONS D24): semver from here, 0.x allows
# breaking changes but each is deliberate and changelogged; the public API
# (engine `Engine`/`Value`, `Runtime`, provider traits) and the `runtime:`
# standard-module namespace are the versioned contract.
[workspace.package]
version = "0.9.0"
edition = "2024"
rust-version = "1.95"
license = "Apache-2.0"
repository = "https://github.com/opentechf/ES-Runtime"
authors = ["Open Tech Foundation <https://opentechf.org> and its contributors"]

# Single source of truth for dependency versions. Pinned per DECISIONS.md D7
# (supply chain) / ARCHITECTURE.md §7; bumped deliberately, not floated.
[workspace.dependencies]
# Error model (DECISIONS.md D12).
thiserror = "2.0.18"
# Observability (ARCHITECTURE.md §8): structured spans, no println!.
tracing = "0.1.44"
tracing-subscriber = { version = "0.3.23", features = ["env-filter", "fmt"] }
# V8 bindings (DECISIONS.md D2). Confined to the `engine` crate.
v8 = "150.0.0"
# Async runtime + OS CSPRNG, used only by `default-providers` (DECISIONS.md D5).
tokio = "1.52.3"
getrandom = "0.4.2"
# WHATWG URL parsing, used by `runtime` for the URL family (DECISIONS.md D17).
url = "2.5.8"
# package.json parsing for node_modules resolution (DECISIONS.md D22). Confined
# to `default-providers`; already present transitively, so no new crate.
serde_json = "1.0.150"
# Cross-OS path canonicalization (DECISIONS.md D25): strips the Windows `\\?\`
# verbatim prefix that breaks file: URL conversion. Confined to
# `default-providers`; already present transitively, so no new crate.
dunce = "1.0.5"
# Async byte-stream trait for provider bodies (trait-only, tiny).
futures-core = "0.3.32"
# Runtime-agnostic mpsc channel (no tokio) — backs the streaming `fetch` request
# body: JS pushes chunks into a bounded sender, the transport drains the receiver
# as a `ByteStream`. Bounded capacity gives upload backpressure.
futures-channel = { version = "0.3.32", default-features = false, features = ["alloc"] }
# Vetted HTTP client for the default NetTransport (DECISIONS.md D20). rustls TLS
# only (no OpenSSL/native-tls). Confined to `default-providers`.
reqwest = { version = "0.13.4", default-features = false, features = ["rustls", "stream", "http2", "charset"] }
futures-util = { version = "0.3.32", default-features = false }
# Vetted HTTP/1.1 server for the default HttpServerProvider (runtime:http). The
# same hyper 1.x already in the tree via reqwest; hyper-util's tokio executor +
# http-body-util's Full body keep it minimal. All MIT. Confined to
# `default-providers`.
hyper = { version = "1.10.1", default-features = false, features = ["http1", "server"] }
hyper-util = { version = "0.1.20", default-features = false, features = ["tokio"] }
http-body-util = "0.1.3"
# TLS for `runtime:net` client sockets (`secureTransport: "on"`, DECISIONS D28).
# rustls via tokio-rustls with the `aws-lc-rs` provider (selected explicitly —
# both ring and aws-lc-rs are in the tree, so the process default is ambiguous);
# trust anchors from the bundled Mozilla set (webpki-roots, no platform I/O).
# Both already present transitively via reqwest. Confined to `default-providers`.
tokio-rustls = { version = "0.26.4", default-features = false, features = ["aws-lc-rs", "tls12"] }
webpki-roots = "1.0.7"
# RFC 6455 WebSocket framing for the `WebSocket` global (DECISIONS D29). TLS is
# done by us (tokio-rustls, above) and the established stream handed to
# `client_async`, so no TLS feature is pulled here. Confined to default-providers.
tokio-tungstenite = { version = "0.26.2", default-features = false, features = ["handshake"] }
# Dev-only: self-signed certs for the hermetic net-TLS test.
rcgen = "0.14"
bytes = "1.11.1"
# WebCrypto backend: the RustCrypto suite (DECISIONS.md D9). Used by `runtime`.
# Two version generations coexist intentionally: `aes-gcm` 0.10 (+ `aes` 0.8,
# `cbc`, `ctr`) sit on `cipher` 0.4, while the hashing/KDF crates (`sha2`,
# `hmac`, `hkdf`, `pbkdf2`) sit on `digest` 0.11 — `aes-gcm` 0.11 is still an
# rc, so we don't float onto it. `cbc`/`ctr` are pinned to the 0.1/0.9 line so
# they reuse the same `aes` 0.8 / `cipher` 0.4 that `aes-gcm` already pulls (no
# duplicate `aes`); `hkdf`/`pbkdf2` 0.13 reuse `hmac` 0.13 + `sha2`.
sha1 = "0.11.0"
sha2 = "0.11.0"
hmac = "0.13.0"
aes-gcm = "0.10.3"
aes = "0.8.4"
cbc = { version = "0.1.2", features = ["alloc"] }
ctr = "0.9.2"
hkdf = "0.13.0"
pbkdf2 = { version = "0.13.0", default-features = false, features = ["hmac"] }
# Elliptic curves for ECDSA/ECDH (SPEC §2.10). These sit on the older
# `elliptic-curve` 0.13 / `digest` 0.10 generation — the unifying
# `elliptic-curve` 0.14 is still pre-release — so they bring duplicate
# `digest` 0.10, `sha2` 0.10, and `hkdf` 0.12 into the tree (the `ecdsa`
# feature transitively enables the curves' bundled `sha2`-hash; `hkdf` 0.12 is
# a direct dep of `elliptic-curve` 0.13). These are warn-level duplicates that
# `deny.toml` permits (DECISIONS.md D9). We still compute the ECDSA prehash
# ourselves with our `sha2` 0.11 so arbitrary `algorithm.hash` works (the
# curves' built-in `DigestSigner` only covers one hash each), and we assemble
# JWK in JS, so the `jwk` feature stays off.
p256 = { version = "0.13.2", default-features = false, features = ["ecdsa", "ecdh", "pkcs8", "std"] }
p384 = { version = "0.13.1", default-features = false, features = ["ecdsa", "ecdh", "pkcs8", "std"] }
p521 = { version = "0.13.3", default-features = false, features = ["ecdsa", "ecdh", "pkcs8", "std"] }
# RSA (RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP). Same `digest` 0.10 generation as
# the EC crates above, so it reuses the already-present `sha2` 0.10 / `digest`
# 0.10 (adds only `sha1` 0.10 within that cluster). Its `sha1`/`sha2` features
# re-export those hashes (with OID) for DigestInfo prefixes.
rsa = { version = "0.9.10", default-features = false, features = ["std", "sha2"] }
# digest-0.10 SHA-1 *with OID*, only for RSA's DigestInfo prefix (`rsa`
# re-exports `sha2` but not `sha1`). Our primary SHA-1 stays `sha1` 0.11; this
# 0.10 line is already in the tree via `rsa`, so it adds no new version.
sha1_rsa = { package = "sha1", version = "0.10.6", features = ["oid"] }
# Glob matching + directory walking for runtime:fs `Glob` (DECISIONS D25):
# globset gives `**`/`{a,b}` semantics, walkdir the traversal we confine to the
# root jail. Both permissive (MIT / Unlicense). Used only by default-providers.
globset = "0.4.16"
walkdir = "2.5.0"
# Self-update for `esrun upgrade`: finds the latest GitHub release for the
# target, downloads + extracts it, and replaces the running binary in place
# (rustls TLS, no OpenSSL). Used only by runtime-cli.
self_update = { version = "0.42.0", default-features = false, features = [
    "rustls",
    "archive-tar",
    "archive-zip",
    "compression-flate2",
    "compression-zip-deflate",
] }

# Internal crates, referenced by path so the dependency graph is the boundary
# (DECISIONS.md D11).
es-runtime-common = { path = "crates/common", version = "0.9.0" }
es-runtime-engine = { path = "crates/engine", version = "0.9.0" }
es-runtime-providers = { path = "crates/providers", version = "0.9.0" }
es-runtime = { path = "crates/runtime", version = "0.9.0" }
es-runtime-default-providers = { path = "crates/default-providers", version = "0.9.0" }
# Debug info dominates `target/` disk on a V8-sized dependency graph (tens of
# GB). Keep it lean: our own crates keep line tables so panic backtraces still
# resolve to file:line; dependencies — the bulk, rarely stepped through — carry
# none. `build-override` is deliberately left untouched, so build scripts and
# the from-source V8 build are unaffected (no expensive rebuild).
[profile.dev]
debug = "line-tables-only"

[profile.dev.package."*"]
debug = false

[profile.dev.package.rsa]
opt-level = 3
debug = false

# Release tuning for the Rust-side hot paths (op marshaling, URL serialization,
# RustCrypto). V8 itself is a prebuilt static library, so this doesn't change
# engine performance — only our code. `panic = "abort"` is deliberately *not*
# set: panic containment at the V8 boundary relies on unwinding (D15).
[profile.release]
lto = "thin"
codegen-units = 1

[workspace.lints.rust]
unsafe_op_in_unsafe_fn = "forbid"      # DECISIONS.md D1
missing_docs = "warn"

[workspace.lints.clippy]
# CI runs `clippy -D warnings`; these raise specific hazards to the default
# (warn) level so they surface there. Pedantic groups are intentionally not
# enabled wholesale — they add noise without commensurate signal at this stage.
todo = "warn"
unimplemented = "warn"
dbg_macro = "warn"
print_stdout = "warn"                   # ARCHITECTURE.md §8: no println!
print_stderr = "warn"