Cargo.toml

[workspace]
members = ["crates/*", "xtask"]
resolver = "2"

[workspace.package]
version = "0.1.0"
edition = "2021"
rust-version = "1.88"
license = "MIT"
repository = "https://github.com/rustasea/framework"
authors = ["RustaSea Team"]

# Single source of truth for shared dependencies; crates opt in with `workspace = true`.
[profile.dev]
incremental = false

# Release profile for distributed binaries. `thin` LTO balances link time against
# size (faster than `fat`, still removes cross-crate dead code); `codegen-units = 1`
# lets the optimizer inline across the whole crate; `strip = "debuginfo"` drops
# debug sections to shrink the artifact. `panic = "abort"` is intentionally NOT set:
# `rustasea_http::panic::catch_panic_layer` (tower-http's `CatchPanicLayer`, wired
# into the app router by `rustasea-app`) converts handler panics into 5xx responses
# via `catch_unwind`, which abort-on-panic would disable.
[profile.release]
lto = "thin"
codegen-units = 1
strip = "debuginfo"

[workspace.dependencies]
# Async + HTTP (M0/M1)
tokio = { version = "1", features = ["fs", "io-util", "io-std", "macros", "net", "process", "rt", "rt-multi-thread", "signal", "sync", "time"] }
axum = "0.7"
tower = "0.5"
tower-http = { version = "0.6", features = ["cors", "trace"] }
# Config / serialization (M0)
serde = { version = "1", features = ["derive"] }
serde_json = "1"
uuid = { version = "1", features = ["v4", "v7", "serde"] }
chrono = { version = "0.4", features = ["serde"] }
thiserror = "1"
# Security (M3)
jsonwebtoken = { version = "10", default-features = false, features = ["rust_crypto"] }
argon2 = { version = "0.5", default-features = false, features = ["alloc", "password-hash", "rand", "simple", "std"] }
tower-sessions = { version = "0.15", default-features = false, features = ["memory-store"] }
# Validation (M3)
validator = { version = "0.19", features = ["derive"] }
# Signed URLs (AUTH-012) — HMAC-SHA256 signatures over a canonical payload.
# `hmac`/`sha2`/`hex` are already in the lock (via `jsonwebtoken`); `subtle`
# supplies the constant-time comparison used for signature checks.
hmac = "0.12"
sha2 = "0.10"
sha1 = "0.10"
hex = "0.4"
subtle = "2"
# Pusher HTTP API (ADOPT-022) — the request body is signed with an MD5 digest
# (`body_md5`) over the canonical JSON body, per the Pusher HTTP API spec.
# `md5` is a tiny pure-Rust implementation with no transitive deps.
md5 = "0.7"
# Two-factor authentication (AUTH-016) — TOTP uses HMAC-SHA1 (the RFC 6238 /
# authenticator-app default); the secret/recovery payloads are sealed with an
# authenticated cipher (ChaCha20-Poly1305) keyed from `app.key`.
chacha20poly1305 = "0.10"
# Passkeys / WebAuthn (AUTH-017) — `p256` verifies ES256 (ECDSA P-256)
# assertions; `ciborium` parses the CBOR attestation object / COSE public key;
# `base64` decodes the base64url ceremony fields. All three are already in the
# lock (`p256` via `jsonwebtoken`), so this adds no new upstream source.
p256 = { version = "0.13", default-features = false, features = ["ecdsa", "std"] }
ciborium = "0.2"
base64 = "0.22"
# Macros (M0)
syn = { version = "2", features = ["full"] }
quote = "1"
proc-macro2 = "1"
# Async workloads (M4)
async-trait = "0.1"
# Database (M2) — runtime API only (no compile-time `query!` macros: CI has no
# DATABASE_URL). Driver features are forwarded by `rustasea-orm`.
sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio-rustls", "json", "uuid", "chrono"] }
# Redis drivers (M4) — `deadpool-redis` 0.21 pairs with `redis` 0.31 and
# supports rustc 1.86; both are opt-in behind each crate's `redis` feature.
# `script` enables Lua (`redis/script`) for atomic cache lock release.
deadpool-redis = { version = "0.21", default-features = false, features = ["rt_tokio_1", "script"] }
redis = { version = "0.31", default-features = false, features = ["aio", "tokio-comp"] }
# DX / CLI / testing (M5)
clap = { version = "4", features = ["derive", "env", "wrap_help"] }
dialoguer = "0.11"
indicatif = "0.17"
console = "0.15"
strsim = "0.11"
comfy-table = "7"
# Readline backend for the interactive `tinker` REPL. Default features are
# disabled so the build pulls neither `radix_trie` (custom bindings) nor `home`
# (history directory discovery); the in-memory history is all `tinker` needs.
rustyline = { version = "18", default-features = false }
# Test infrastructure (M5)
testcontainers = "0.28"
dotenvy = "0.15"
rand = "0.8"
# Browser testing harness (ADOPT-029) — `fantoccini` drives a WebDriver
# (chromedriver/geckodriver) session. Its default `native-tls` feature pulls
# `openssl`; the workspace enables `rustls-tls` instead so the build links no
# system TLS. Declares MSRV 1.67, below the workspace `rust-version` (1.88).
fantoccini = { version = "0.22", default-features = false, features = ["rustls-tls"] }
# rustls provider pin for the browser harness. `fantoccini` (via hyper-rustls)
# enables rustls' `aws-lc-rs` while `testcontainers` (via bollard) enables
# `ring`; with both compiled in, rustls 0.23 cannot auto-select a process
# default and panics when the connector is built. The harness installs `ring`
# explicitly (`ensure_crypto_provider`). Only activated behind `browser`.
rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
# Fake data generation (ADOPT-012) — locale-aware faker facade over `fake`.
# `derive` keeps upstream `#[derive(Dummy)]` ergonomics available; `chrono` and
# `uuid` enable the `DateTimeBetween` / `UUIDv4` fakers the `Faker` facade
# delegates to (they reuse the `chrono` / `uuid` versions already in the lock).
# `fake` re-exports its `rand` 0.10 dependency as `fake::rand`, so no separate
# rand entry is needed for the deterministic ChaCha12Rng.
fake = { version = "5.1", features = ["derive", "chrono", "uuid"] }
# Slug transliteration (ADOPT-016) — pure Unicode→ASCII transliteration for
# `rustasea_orm::sluggable` (eloquent-sluggable parity). Already in the lock via
# `fake`, so this adds no new upstream source.
deunicode = "1"
# Async streams (M6)
futures-core = "0.3"
futures-util = { version = "0.3", default-features = false }
tokio-stream = { version = "0.1", features = ["sync"] }
# Logging / diagnostics (CFG-005) — Laravel-style channels mapped onto tracing.
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
tracing-appender = "0.2"
# Excel / CSV import-export (ADOPT-023) — `csv` streams delimited records with
# serde support (unconditional in the crate); `calamine` reads xlsx/xlsm
# workbooks and `rust_xlsxwriter` writes them, both behind the crate's opt-in
# `xlsx` feature. `calamine` 0.36 pulls `quick-xml` 0.41, clearing
# RUSTSEC-2026-0194/0195 (present in the 0.31 that `calamine` 0.26 pinned). All
# three declare a rustc MSRV at or below the workspace `rust-version` (1.88).
csv = "1.3"
calamine = "0.36"
rust_xlsxwriter = "0.79"
# Image manipulation (ADOPT-024) — `image` decodes/encodes the raster formats
# the transform pipeline supports. Default features are disabled and only the
# codecs the crate advertises are enabled (jpeg/png/webp/gif/bmp/tiff); this
# drops the `rayon` thread-pool and the avif/exr/etc. codec tree. Declares an
# MSRV at or below the workspace `rust-version` (1.88).
image = { version = "0.25", default-features = false, features = ["jpeg", "png", "webp", "gif", "bmp", "tiff"] }
# Platform crates consolidated by ADOPT-031. Every key below is the single
# source of truth for its version: members reference it with `workspace = true`,
# and `cargo xtask deps:check` fails when a member reintroduces an inline
# version for any of them.
http = "1"
# Only `toml` is read (`ConfigLoader` discovers `config/*.toml` only) and the
# loader never calls `Environment::convert_case`, so the format/convert-case
# default features are dropped.
config = { version = "0.14", default-features = false, features = ["toml"] }
toml = "0.8"
toml_edit = "0.22"
# `fs` is `object_store`'s sole default feature and backs the local disk driver;
# cloud backends stay opt-in per consumer (`rustasea-storage` forwards its
# `aws`/`gcp`/`azure` features to the matching `object_store` features).
object_store = { version = "0.14", default-features = false, features = ["fs"] }
# Driver pinned to bson 3 (`bson-3`) so a single BSON version is shared by the
# driver and `rustasea-mongo`; `compat-3-3-0` is the driver's own forward-
# compatibility compile check.
mongodb = { version = "3.9", default-features = false, features = ["compat-3-3-0", "bson-3", "rustls-tls", "dns-resolver"] }
bson = "3.1"
pgvector = { version = "0.4", default-features = false }
percent-encoding = "2"
# Shared HTTP client. `json` is the common baseline; consumers add their extra
# features additively (`rustasea-ai`: stream + rustls-tls, `rustasea-google`:
# rustls-tls) while keeping default features off.
reqwest = { version = "0.12", default-features = false, features = ["json"] }
askama = "0.16"
# Default features stay enabled: runtime templates use `extends`/`include`/
# `block`, which minijinja gates behind its `multi_template`/`macros`/`builtins`
# defaults. `loader` adds `path_loader`, which is not in the default set.
minijinja = { version = "2", features = ["loader"] }
lettre = { version = "0.11.23", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder"] }
# Shared Sentry SDK baseline: request transport, rustls, and the integrations
# both the HTTP request-context middleware and the logging layer wire.
# `rustasea-logging` adds `tracing` additively.
sentry = { version = "0.49", default-features = false, features = ["reqwest", "rustls", "backtrace", "panic", "contexts", "debug-images"] }
tempfile = "3"
chrono-tz = "0.10"
http-body-util = "0.1"
# Pure-Rust SSH client for the opt-in SFTP disk (ADOPT-025). `ring` (already in
# the lock via `rustls`) is the crypto backend and `rsa` keeps RSA host/private
# keys usable; `russh-sftp` speaks the subsystem over a caller-supplied stream.
russh = { version = "0.65", default-features = false, features = ["ring", "rsa"] }
russh-sftp = "2.4"