Cargo.toml

[workspace]
resolver = "2"
members = [
  "crates/springtale-core",
  "crates/springtale-crypto",
  "crates/springtale-transport",
  "crates/springtale-connector",
  "crates/springtale-scheduler",
  "crates/springtale-store",
  "crates/springtale-ai",
  "crates/springtale-mcp",
  # Cooperation primitives (game-informed multi-agent coordination)
  "crates/springtale-cooperation",
  # Phase 1b
  "crates/springtale-bot",
  # Phase 2a
  "crates/springtale-sentinel",
  # Shared runtime
  "crates/springtale-runtime",
  # Phase 1a connectors
  "connectors/connector-kick",
  "connectors/connector-presearch",
  "connectors/connector-bluesky",
  "connectors/connector-github",
  "connectors/connector-filesystem",
  "connectors/connector-shell",
  "connectors/connector-http",
  # Phase 1b connectors
  "connectors/connector-telegram",
  # Phase 2a connectors
  "connectors/connector-nostr",
  "connectors/connector-irc",
  "connectors/connector-discord",
  "connectors/connector-slack",
  "connectors/connector-signal",
  "connectors/connector-browser",
  # connector-matrix: DEFERRED — matrix-sdk 0.16 requires rusqlite 0.37 which
  # has CVE-2025-70873 (heap info disclosure). Our store uses rusqlite 0.39
  # (patched). Downgrading would expose activist/survivor data to heap leaks.
  # Waiting for matrix-sdk to update to rusqlite 0.39+.
  # Apps
  "apps/springtaled",
  "apps/springtale-cli",
]
exclude = [
  # Tauri desktop app has its own dependency tree (tauri 2.x crates).
  # Excluded from workspace to avoid version conflicts.
  "tauri/apps/desktop/src-tauri",
  # WASM connector SDK targets wasm32-unknown-unknown — different target
  # than the workspace. Excluded to avoid cross-compilation conflicts.
  "sdk/connector-sdk",
  "sdk/examples/connector-hello-wasm",
]

[workspace.package]
edition = "2024"
license = "MIT"
repository = "https://github.com/ScopeCreep-zip/Springtale"

[workspace.dependencies]

# ── Async Runtime ──────────────────────────────────────────────────────────────
tokio            = { version = "1",    features = ["full"] }
arc-swap         = "1"
tokio-util       = { version = "0.7",  features = ["codec"] }
tokio-stream     = { version = "0.1", features = ["sync"] }
async-trait      = "0.1"

# ── Observability ──────────────────────────────────────────────────────────────
tracing          = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }

# ── Error Handling ─────────────────────────────────────────────────────────────
anyhow           = "1"
thiserror        = "2"

# ── Serialization ──────────────────────────────────────────────────────────────
serde            = { version = "1", features = ["derive"] }
serde_json       = "1"
toml             = "0.8"
serde_yaml       = "0.9"
schemars         = { version = "1", features = ["derive", "uuid1", "chrono04"] }

# ── Validation ─────────────────────────────────────────────────────────────────
garde            = { version = "0.22", features = ["derive", "full"] }

# ── Filesystem Sandbox ─────────────────────────────────────────────────────────
cap-std          = "3"

# ── Security / Secrets ─────────────────────────────────────────────────────────
secrecy          = { version = "0.10", features = ["serde"] }
zeroize          = { version = "1",    features = ["derive"] }
memsec           = { version = "0.7",  features = ["use_os"] }
libc             = "0.2"

# ── Cryptography ───────────────────────────────────────────────────────────────
ed25519-dalek    = { version = "2",    features = ["rand_core", "serde"] }
chacha20poly1305 = { version = "0.10", features = ["rand_core", "getrandom"] }
argon2           = "0.5"
# SECURITY: default-features=false prevents `log` feature from being pulled in.
# RUSTSEC-2026-0097 unsoundness requires `log` feature — without it, the UB
# code path is absent from the binary. Cannot upgrade to 0.9 until RustCrypto
# ships stable releases with rand_core 0.9 (ed25519-dalek 3.x, chacha20poly1305 0.11.x).
rand             = { version = "0.8",  default-features = false, features = ["std", "std_rng", "getrandom"] }
sha2             = "0.10"
hmac             = "0.12"
subtle           = "2"

# ── Identifiers ────────────────────────────────────────────────────────────────
uuid             = { version = "1",    features = ["v4", "serde"] }

# ── HTTP Server ────────────────────────────────────────────────────────────────
axum             = { version = "0.8",  features = ["macros", "multipart"] }
axum-server      = { version = "0.8",  features = ["tls-rustls"] }
tower            = { version = "0.5", features = ["limit", "buffer"] }
tower-http       = { version = "0.6",  features = ["cors", "fs", "set-header", "trace", "auth", "limit", "timeout"] }
rust-embed       = { version = "8", features = ["interpolate-folder-path"] }

# ── HTTP Client ────────────────────────────────────────────────────────────────
reqwest          = { version = "0.13", default-features = false, features = ["json", "multipart", "rustls", "stream"] }

# ── Database (local-first) ─────────────────────────────────────────────────────
rusqlite         = { version = "0.39", features = ["bundled", "vtab"] }

# ── Database (server mode, optional) ──────────────────────────────────────────
sqlx             = { version = "0.8",  features = ["postgres", "uuid", "chrono", "json", "migrate", "runtime-tokio"] }

# ── WASM Sandbox ───────────────────────────────────────────────────────────────
wasmtime         = { version = "43",   features = ["cranelift", "component-model", "parallel-compilation"] }
wasmtime-wasi    = { version = "43",   features = ["p2"] }
wat              = "1"

# ── MCP Protocol ───────────────────────────────────────────────────────────────
rmcp             = { version = "1",    features = ["server", "transport-io", "macros"] }
jsonschema       = { version = "0.45", default-features = false }

# ── Filesystem Watching ────────────────────────────────────────────────────────
notify           = { version = "8",    features = ["macos_fsevent"] }
notify-debouncer-full = { version = "0.7", features = ["macos_fsevent"] }

# ── Scheduling ─────────────────────────────────────────────────────────────────
cron             = "0.13"
chrono           = { version = "0.4",  features = ["serde"] }

# ── CLI ────────────────────────────────────────────────────────────────────────
clap             = { version = "4",    features = ["derive", "env"] }
indicatif        = "0.17"
tabled           = "0.17"
rpassword        = "5"

# ── Futures ─────────────────────────────────────────────────────────────────────
futures-core      = "0.3"
futures-util      = { version = "0.3", features = ["sink"] }
async-stream      = "0.3"

# ── Regex ──────────────────────────────────────────────────────────────────────
regex            = "1"

# ── TLS ────────────────────────────────────────────────────────────────────────
rustls           = { version = "0.23", default-features = false, features = ["ring", "std"] }
tokio-rustls     = "0.26"
rustls-pemfile   = "2"
rustls-pki-types = "1"

# ── Config ─────────────────────────────────────────────────────────────────────
figment          = { version = "0.10", features = ["toml", "env"] }

# ── Compile-time Registration ─────────────────────────────────────────────────
inventory        = "0.3"

# ── Graph / Rate Limiting ──────────────────────────────────────────────────────
petgraph         = "0.7"
governor         = { version = "0.8", features = ["std"] }
crossbeam-deque  = "0.8"

# ── Cooperation (Phase M) ─────────────────────────────────────────────────────
dyn-clone        = "1"          # DynClone supertrait for Box<dyn DynamicRole>
chitchat         = "0.10"       # §8 scuttlebutt gossip for awareness
foca             = "1.0"        # §8 SWIM liveness detection

# ── Concurrency ────────────────────────────────────────────────────────────────
dashmap          = "6"

# ── Encoding ───────────────────────────────────────────────────────────────────
hex              = "0.4"
base64           = "0.22"
bytes            = "1"

# ── RSA (Kick webhook verification) ──────────────────────────────────────────
rsa              = { version = "0.9", features = ["sha2"] }

# ── Testing ────────────────────────────────────────────────────────────────────
tempfile         = "3"

# ── Internal Crates ────────────────────────────────────────────────────────────
springtale-core       = { path = "crates/springtale-core" }
springtale-crypto     = { path = "crates/springtale-crypto" }
springtale-transport  = { path = "crates/springtale-transport" }
springtale-connector  = { path = "crates/springtale-connector" }
springtale-scheduler  = { path = "crates/springtale-scheduler" }
springtale-store      = { path = "crates/springtale-store" }
springtale-ai         = { path = "crates/springtale-ai" }
springtale-cooperation = { path = "crates/springtale-cooperation" }
springtale-bot        = { path = "crates/springtale-bot" }
springtale-mcp        = { path = "crates/springtale-mcp" }
springtale-sentinel   = { path = "crates/springtale-sentinel" }
springtale-runtime    = { path = "crates/springtale-runtime" }
connector-kick        = { path = "connectors/connector-kick" }
connector-presearch   = { path = "connectors/connector-presearch" }
connector-bluesky     = { path = "connectors/connector-bluesky" }
connector-github      = { path = "connectors/connector-github" }
connector-filesystem  = { path = "connectors/connector-filesystem" }
connector-shell       = { path = "connectors/connector-shell" }
connector-http        = { path = "connectors/connector-http" }
connector-telegram    = { path = "connectors/connector-telegram" }
connector-nostr       = { path = "connectors/connector-nostr" }
connector-irc         = { path = "connectors/connector-irc" }
connector-discord     = { path = "connectors/connector-discord" }
connector-slack       = { path = "connectors/connector-slack" }
connector-signal      = { path = "connectors/connector-signal" }
connector-browser     = { path = "connectors/connector-browser" }

# ── Nostr Protocol ─────────────────────────────────────────────────────────────
nostr-sdk            = { version = "0.44", features = ["nip44", "nip59"] }

# ── IRC Protocol ───────────────────────────────────────────────────────────────
# Privacy: ctcp feature DISABLED to suppress all CTCP replies (VERSION, TIME, PING).
# This prevents bot fingerprinting — empty VERSION is MORE identifiable than no response.
irc                  = { version = "1.1", default-features = false, features = ["tls-rust", "toml_config"] }

# ── Discord Protocol ──────────────────────────────────────────────────────────
# Privacy: no MESSAGE_CONTENT intent by default. Slash commands preferred.
twilight-gateway     = { version = "0.17", default-features = false, features = ["rustls-webpki-roots", "zstd"] }
twilight-http        = { version = "0.17", default-features = false, features = ["rustls-webpki-roots"] }
twilight-model       = "0.17"

# ── Slack Protocol (Socket Mode) ──────────────────────────────────────────────
# Socket Mode uses WebSocket — no public HTTP endpoint needed (local-first friendly).
tokio-tungstenite    = { version = "0.26", default-features = false, features = ["connect", "rustls-tls-webpki-roots"] }

# ── Browser Automation ────────────────────────────────────────────────────────
# No TLS dependency — connects to pre-installed Chrome via DevTools Protocol.
# Domain allow-list enforced per connector capability model.
chromiumoxide        = { version = "0.9", default-features = false }

# ── SQLite Encryption at Rest ─────────────────────────────────────────────────
# Patch libsqlite3-sys to use SQLite3MultipleCiphers (sqlite3mc) amalgamation.
# Provides full-database ChaCha20-Poly1305 encryption with no OpenSSL dependency.
# Same approach as Signal (SQLCipher) but with pure-C crypto (no external libs).
# https://github.com/utelle/SQLite3MultipleCiphers
# ── Release Profile ────────────────────────────────────────────────────────────
# overflow-checks: prevent silent integer wrapping in release builds.
# Critical for fuel metering, size limits, and event query bounds —
# silent overflow is exploitable in resource accounting.
[profile.release]
overflow-checks = true

[patch.crates-io]
libsqlite3-sys = { path = "crates/libsqlite3-sys-mc" }