Cargo.toml

[workspace]
resolver = "2"
members = [
  "crates/springtale-core",
  "crates/springtale-crypto",
  "crates/springtale-transport",
  "crates/springtale-connector",
  "crates/springtale-scheduler",
  "crates/springtale-store",
  "crates/springtale-ai",
  "crates/springtale-mcp",
  # Cooperation primitives (game-informed multi-agent coordination)
  "crates/springtale-cooperation",
  # G3 — WIT world definition for embedding Springtale in WASM Component
  # Model hosts (Bevy, Unity, wasmCloud, custom). Ships the .wit artifact.
  "crates/springtale-wit",
  # G3 — pyo3 Python bindings. cdylib + rlib; maturin wraps the cdylib
  # into a Python wheel for distribution alongside the Rust crates.
  "crates/springtale-py",
  # Phase 1b
  "crates/springtale-bot",
  # Phase 2a
  "crates/springtale-sentinel",
  # Shared runtime
  "crates/springtale-runtime",
  # Phase 1a connectors
  "connectors/connector-kick",
  "connectors/connector-presearch",
  "connectors/connector-bluesky",
  "connectors/connector-github",
  "connectors/connector-filesystem",
  "connectors/connector-shell",
  "connectors/connector-http",
  "connectors/connector-opencode",
  # Phase 1b connectors
  "connectors/connector-telegram",
  # Phase 2a connectors
  "connectors/connector-nostr",
  "connectors/connector-irc",
  "connectors/connector-discord",
  "connectors/connector-slack",
  "connectors/connector-signal",
  "connectors/connector-browser",
  # connector-matrix: DEFERRED — upstream matrix-sdk-sqlite (v0.18.0 main)
  # still declares rusqlite = "0.37.0" which carries CVE-2025-70873 (heap
  # info disclosure). Our store crate is pinned to rusqlite 0.39 (patched);
  # downgrading would expose activist/survivor data to the heap leak.
  # Accountable tracking: `vex/connector-matrix-rusqlite-cve-2025-70873.json`
  # (v2, last reviewed 2026-06-02, next_review 2026-09-01). The src/ tree
  # is preserved so it compiles when upstream lands a rusqlite >= 0.39 bump.
  # Apps
  "apps/springtaled",
  "apps/springtale-cli",
]
exclude = [
  # Tauri desktop app has its own dependency tree (tauri 2.x crates).
  # Excluded from workspace to avoid version conflicts.
  "tauri/apps/desktop/src-tauri",
  # WASM connector SDK targets wasm32-unknown-unknown — different target
  # than the workspace. Excluded to avoid cross-compilation conflicts.
  "sdk/connector-sdk",
  "sdk/examples/connector-hello-wasm",
]

[workspace.package]
edition = "2024"
license = "MIT"
repository = "https://github.com/ScopeCreep-zip/Springtale"

[workspace.dependencies]

# ── Async Runtime ──────────────────────────────────────────────────────────────
tokio            = { version = "1",    features = ["full"] }
arc-swap         = "1"
tokio-util       = { version = "0.7",  features = ["codec"] }
tokio-stream     = { version = "0.1", features = ["sync"] }
async-trait      = "0.1"

# ── Observability ──────────────────────────────────────────────────────────────
tracing          = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }

# ── Error Handling ─────────────────────────────────────────────────────────────
anyhow           = "1"
thiserror        = "2"

# ── Serialization ──────────────────────────────────────────────────────────────
serde            = { version = "1", features = ["derive"] }
serde_json       = "1"
toml             = "0.8"
serde_yaml       = "0.9"
schemars         = { version = "1", features = ["derive", "uuid1", "chrono04"] }
# tauri-specta type generation. The runtime side derives `Type` so the
# desktop bindings.ts is generated from Rust truth. Pin tracks the rc
# series both `tauri-specta` and `specta-typescript` consume (the rc
# pin is the production pattern per Spacedrive / specta-rs examples).
specta           = { version = "=2.0.0-rc.25", features = ["derive", "serde_json", "uuid", "chrono"] }

# ── Validation ─────────────────────────────────────────────────────────────────
garde            = { version = "0.22", features = ["derive", "full"] }

# ── Filesystem Sandbox ─────────────────────────────────────────────────────────
cap-std          = "3"

# ── Security / Secrets ─────────────────────────────────────────────────────────
secrecy          = { version = "0.10", features = ["serde"] }
zeroize          = { version = "1",    features = ["derive"] }
memsec           = { version = "0.7",  features = ["use_os"] }
libc             = "0.2"

# ── Cryptography ───────────────────────────────────────────────────────────────
ed25519-dalek    = { version = "2",    features = ["rand_core", "serde"] }
chacha20poly1305 = { version = "0.10", features = ["rand_core", "getrandom"] }
argon2           = "0.5"
# SECURITY: default-features=false prevents `log` feature from being pulled in.
# RUSTSEC-2026-0097 unsoundness requires `log` feature — without it, the UB
# code path is absent from the binary. Cannot upgrade to 0.9 until RustCrypto
# ships stable releases with rand_core 0.9 (ed25519-dalek 3.x, chacha20poly1305 0.11.x).
rand             = { version = "0.8",  default-features = false, features = ["std", "std_rng", "getrandom"] }
sha2             = "0.10"
hmac             = "0.12"
subtle           = "2"

# ── Identifiers ────────────────────────────────────────────────────────────────
uuid             = { version = "1",    features = ["v4", "serde"] }
# ULID for ExecutionId — lexicographically sortable per `started_at`, no UUIDv4
# entropy waste in execution-log indices. `ulid::Ulid` serializes as Crockford
# base32 (26 chars) so it stays cheap in SQLite TEXT columns.
ulid             = { version = "1",    features = ["serde"] }

# ── HTTP Server ────────────────────────────────────────────────────────────────
axum             = { version = "0.8",  features = ["macros", "multipart"] }
axum-server      = { version = "0.8",  features = ["tls-rustls"] }
tower            = { version = "0.5", features = ["limit", "buffer"] }
tower-http       = { version = "0.6",  features = ["cors", "fs", "set-header", "trace", "auth", "limit", "timeout"] }
rust-embed       = { version = "8", features = ["interpolate-folder-path"] }

# ── HTTP Client ────────────────────────────────────────────────────────────────
reqwest          = { version = "0.13", default-features = false, features = ["json", "multipart", "rustls", "stream"] }

# ── Database (local-first) ─────────────────────────────────────────────────────
rusqlite         = { version = "0.39", features = ["bundled", "vtab"] }

# ── Database (server mode, optional) ──────────────────────────────────────────
sqlx             = { version = "0.8",  features = ["postgres", "uuid", "chrono", "json", "migrate", "runtime-tokio"] }

# ── WASM Sandbox ───────────────────────────────────────────────────────────────
wasmtime         = { version = "44",   features = ["cranelift", "component-model", "parallel-compilation"] }
wasmtime-wasi    = { version = "44",   features = ["p2"] }
wat              = "1"

# ── MCP Protocol ───────────────────────────────────────────────────────────────
# >=1.4 floors out CVE-2026-42559 (GHSA-89vp-x53w-74fx, fixed in 1.4.0).
rmcp             = { version = "1.4",  features = ["server", "transport-io", "macros"] }
jsonschema       = { version = "0.45", default-features = false }

# ── Filesystem Watching ────────────────────────────────────────────────────────
notify           = { version = "8",    features = ["macos_fsevent"] }
notify-debouncer-full = { version = "0.7", features = ["macos_fsevent"] }

# ── Scheduling ─────────────────────────────────────────────────────────────────
cron             = "0.13"
chrono           = { version = "0.4",  features = ["serde"] }

# ── Extraction Ladder (Phase A) ────────────────────────────────────────────────
# Powers the `Action::Extract` step in modular recipes: Readability for
# main-content extraction, scraper for CSS selectors over rendered HTML,
# serde_json_path (RFC 9535) for JSONPath over API JSON, feed-rs for unified
# RSS/Atom/JSON Feed, icalendar + rrule for VEVENT + RRULE expansion.
dom_smoothie     = "0.17"
scraper          = "0.27"
serde_json_path  = "0.7"
feed-rs          = "2.3"
icalendar        = { version = "0.17", features = ["chrono-tz"] }
rrule            = "0.14"
# HTML sanitizer (used by extraction::diff for page-change hashing).
# Already pulled in transitively by feed-rs `sanitize` feature; pinned at
# workspace level so the extraction module can call it directly.
ammonia          = "4"
# blake3 — dedupe key hashing + page-change content fingerprinting.
blake3           = "1"
# similar — LCS diff for the page-change-watcher recipe in Phase A
# (changedetection.io-style word/line diff output).
similar          = "2"

# ── Cross-language bindings (G3 / `COOPERATION_IMPLEMENTATION_PLAN.md §15`) ──
# `ts-rs` derives `TS` on cross-boundary Rust types and exports them as
# TypeScript declarations. Used to eliminate hand-maintained TS types
# in `tauri/packages/types/`. The `chrono-impl` feature maps
# `DateTime<Utc>` → `string` (ISO-8601) to match the existing TS shape.
ts-rs            = { version = "11",   features = ["chrono-impl", "uuid-impl", "no-serde-warnings"] }
# `pyo3` builds the Python C-API extension module for `springtale-py`.
# `extension-module` lets us link against the host Python without
# embedding a particular interpreter; `abi3-py39` produces a single .so
# that works on Python 3.9+.
# >=0.29 floors out RUSTSEC-2026-0176 (OOB read in PyList/PyTuple iterators,
# fixed in 0.29.0).
pyo3             = { version = "0.29", features = ["extension-module", "abi3-py39", "chrono", "uuid"] }

# ── CLI ────────────────────────────────────────────────────────────────────────
clap             = { version = "4",    features = ["derive", "env"] }
indicatif        = "0.17"
tabled           = "0.17"
rpassword        = "5"

# ── Futures ─────────────────────────────────────────────────────────────────────
futures-core      = "0.3"
futures-util      = { version = "0.3", features = ["sink"] }
async-stream      = "0.3"

# ── Regex ──────────────────────────────────────────────────────────────────────
regex            = "1"

# ── TLS ────────────────────────────────────────────────────────────────────────
rustls           = { version = "0.23", default-features = false, features = ["ring", "std"] }
tokio-rustls     = "0.26"
rustls-pemfile   = "2"
rustls-pki-types = "1"
# Hybrid post-quantum KEX (X25519MLKEM768) for TLS 1.3, per NIST IR 8547
# (X25519 deprecated 2030, disallowed 2035). Wires into rustls' provider
# via `rustls-post-quantum::provider()`. Activate at every `ClientConfig`
# builder site in `springtale-transport` and connector clients.
rustls-post-quantum = "0.2"
ring             = "0.17"

# ── Config ─────────────────────────────────────────────────────────────────────
figment          = { version = "0.10", features = ["toml", "env"] }

# ── Compile-time Registration ─────────────────────────────────────────────────
inventory        = "0.3"

# ── Graph / Rate Limiting ──────────────────────────────────────────────────────
petgraph         = "0.8"
governor         = { version = "0.10", features = ["std"] }
crossbeam-deque  = "0.8"

# ── Cooperation (Phase M) ─────────────────────────────────────────────────────
dyn-clone        = "1"          # DynClone supertrait for Box<dyn DynamicRole>
chitchat         = "0.10"       # §8 scuttlebutt gossip for awareness
foca             = { version = "1.0", default-features = false, features = ["std", "tracing", "bincode-codec"] }  # §8 SWIM liveness
bincode          = "2"          # foca 1.0's BincodeCodec wire format (matches foca's internal dep)

# ── Concurrency ────────────────────────────────────────────────────────────────
dashmap          = "6.1"

# ── Encoding ───────────────────────────────────────────────────────────────────
hex              = "0.4"
base64           = "0.22"
bytes            = "1"

# ── Testing ────────────────────────────────────────────────────────────────────
tempfile         = "3"
criterion        = { version = "0.5", features = ["html_reports", "async_tokio"] }
proptest         = "1"

# ── Internal Crates ────────────────────────────────────────────────────────────
# Each declaration carries `version = "0.1.0"` alongside `path` so cargo-deny's
# `wildcards = "deny"` doesn't flag the workspace `*`-resolution. The path
# wins at build time; the version is what crates.io would see if these were
# ever published.
springtale-core       = { path = "crates/springtale-core", version = "0.1.0" }
springtale-crypto     = { path = "crates/springtale-crypto", version = "0.1.0" }
springtale-transport  = { path = "crates/springtale-transport", version = "0.1.0" }
springtale-connector  = { path = "crates/springtale-connector", version = "0.1.0" }
springtale-scheduler  = { path = "crates/springtale-scheduler", version = "0.1.0" }
springtale-store      = { path = "crates/springtale-store", version = "0.1.0" }
springtale-ai         = { path = "crates/springtale-ai", version = "0.1.0" }
springtale-cooperation = { path = "crates/springtale-cooperation", version = "0.1.0" }
springtale-bot        = { path = "crates/springtale-bot", version = "0.1.0" }
springtale-mcp        = { path = "crates/springtale-mcp", version = "0.1.0" }
springtale-sentinel   = { path = "crates/springtale-sentinel", version = "0.1.0" }
springtale-runtime    = { path = "crates/springtale-runtime", version = "0.1.0" }
connector-kick        = { path = "connectors/connector-kick", version = "0.1.0" }
connector-presearch   = { path = "connectors/connector-presearch", version = "0.1.0" }
connector-bluesky     = { path = "connectors/connector-bluesky", version = "0.1.0" }
connector-github      = { path = "connectors/connector-github", version = "0.1.0" }
connector-filesystem  = { path = "connectors/connector-filesystem", version = "0.1.0" }
connector-shell       = { path = "connectors/connector-shell", version = "0.1.0" }
connector-http        = { path = "connectors/connector-http", version = "0.1.0" }
connector-opencode    = { path = "connectors/connector-opencode", version = "0.1.0" }
connector-telegram    = { path = "connectors/connector-telegram", version = "0.1.0" }
connector-nostr       = { path = "connectors/connector-nostr", version = "0.1.0" }
connector-irc         = { path = "connectors/connector-irc", version = "0.1.0" }
connector-discord     = { path = "connectors/connector-discord", version = "0.1.0" }
connector-slack       = { path = "connectors/connector-slack", version = "0.1.0" }
connector-signal      = { path = "connectors/connector-signal", version = "0.1.0" }
connector-browser     = { path = "connectors/connector-browser", version = "0.1.0" }

# ── Nostr Protocol ─────────────────────────────────────────────────────────────
nostr-sdk            = { version = "0.44", features = ["nip44", "nip59"] }

# ── IRC Protocol ───────────────────────────────────────────────────────────────
# Privacy: ctcp feature DISABLED to suppress all CTCP replies (VERSION, TIME, PING).
# This prevents bot fingerprinting — empty VERSION is MORE identifiable than no response.
irc                  = { version = "1.1", default-features = false, features = ["tls-rust", "toml_config"] }

# ── Discord Protocol ──────────────────────────────────────────────────────────
# Privacy: no MESSAGE_CONTENT intent by default. Slash commands preferred.
twilight-gateway     = { version = "0.17", default-features = false, features = ["rustls-webpki-roots", "zstd"] }
twilight-http        = { version = "0.17", default-features = false, features = ["rustls-webpki-roots"] }
twilight-model       = "0.17"

# ── Slack Protocol (Socket Mode) ──────────────────────────────────────────────
# Socket Mode uses WebSocket — no public HTTP endpoint needed (local-first friendly).
tokio-tungstenite    = { version = "0.26", default-features = false, features = ["connect", "rustls-tls-webpki-roots"] }

# ── Browser Automation ────────────────────────────────────────────────────────
# No TLS dependency — connects to pre-installed Chrome via DevTools Protocol.
# Domain allow-list enforced per connector capability model.
chromiumoxide        = { version = "0.9", default-features = false }
# Stealth: implemented inline in `connector-browser::client` via
# `evaluate_on_new_document`. The `chromiumoxide_stealth` crate
# (v0.1.1, latest) reads its JS evasion sources from `src/evasions/`
# at runtime via `fs::read_to_string(...).unwrap()` — unusable as a
# library dep. Our inline patches cover the high-signal evasions
# (`navigator.webdriver`, plugins, languages); per
# `feedback_no_ban_risk` Springtale doesn't market anti-bot bypass
# as a feature, so the minimal set suffices for *incidental*
# detection avoidance on sites with reflexive headless blocks.

# ── SQLite Encryption at Rest ─────────────────────────────────────────────────
# Patch libsqlite3-sys to use SQLite3MultipleCiphers (sqlite3mc) amalgamation.
# Provides full-database ChaCha20-Poly1305 encryption with no OpenSSL dependency.
# Same approach as Signal (SQLCipher) but with pure-C crypto (no external libs).
# https://github.com/utelle/SQLite3MultipleCiphers
# ── Release Profile ────────────────────────────────────────────────────────────
# overflow-checks: prevent silent integer wrapping in release builds.
# Critical for fuel metering, size limits, and event query bounds —
# silent overflow is exploitable in resource accounting.
#
# Other settings target deterministic binaries:
#   codegen-units=1 — single codegen unit improves reproducibility.
#   lto="fat" — full link-time optimization shrinks binary + removes
#     dead code that might otherwise leak through audit trails.
#   panic="abort" — never unwind across the FFI boundary; faster too.
#   strip="symbols" — no debug strings in production binaries.
#   incremental=false — incremental compilation injects per-machine
#     state (timing salt, path-dependent metadata) that breaks
#     bit-for-bit reproducibility across runners. The release
#     workflow's `repro-check` job rebuilds on a clean runner and
#     diffs the SHA-256, so this MUST stay off (Phase-7 audit
#     Finding G, reproducible-build attestation).
[profile.release]
overflow-checks = true
codegen-units = 1
lto = "fat"
panic = "abort"
strip = "symbols"
incremental = false

# Bench profile mirrors release so benchmarks measure realistic codegen.
[profile.bench]
overflow-checks = true
codegen-units = 1
lto = "fat"

[patch.crates-io]
libsqlite3-sys = { path = "crates/libsqlite3-sys-mc" }

# ── TLS / Crypto Bans (compile-time enforcement) ──────────────────────────────
# Springtale uses rustls + RustCrypto exclusively. Any transitive dependency
# that tries to pull OpenSSL or native-tls gets a compile-error stub instead
# of the real crate. Belt-and-suspenders complement to `deny.toml` [bans].
# Trace offenders with `cargo tree -i <crate>`.
native-tls = { path = "vendor/native-tls-stub" }
openssl    = { path = "vendor/openssl-stub" }
openssl-sys = { path = "vendor/openssl-sys-stub" }