[workspace]
members = [
  "crates/corecrux-types",
  "crates/corecrux-secrets",
  "crates/corecrux-billing",
  "crates/corecrux-frame",
  "crates/corecrux-proto",
  "crates/corecrux-receipts",
  "crates/corecrux-segment",
  "crates/corecrux-storage",
  "crates/corecrux-projections",
  "crates/corecrux-index",
  "crates/corecrux-retrieval",
  "crates/corecrux-memory",
  "crates/corecrux-providers",
  "crates/corecrux-workspace-scan",
  "crates/crux-sync",
  "crates/crux-contrib",
  "crates/crux-integrations",
  "crates/crux-observe",
  "crates/crux-observe-api",
  "crates/crux-cost",
  "crates/vaultcrux-local",
  "crates/crux-config-wizard",
  "crates/crux-lens-features",
  "crates/crux-mcp",
  "crates/crux-session",
  "crates/crux-escrow",
  "crates/rcx-capability-token",
  "crates/rcx-revocation",
  "crates/crux-router",
  "crates/crux-enterprise-shim",
  "crates/corecruxd",
  "crates/corecruxctl",
  "crates/crux-claude-hooks",
  "crates/crux-integration-tests",
]
# The desktop shell crates (Tauri app + std-only lifecycle supervisor) live
# in-tree per OD-31 but are EXCLUDED from the daemon workspace: the app pulls the
# webkit2gtk/tauri stack that cannot build on the CI/self-hosted/WSL toolchains,
# and each shell crate carries its own [workspace] table. Built separately via
# .github/workflows/desktop-shell.yml.
exclude = ["shells/desktop/lifecycle", "shells/desktop/app"]
resolver = "2"

[workspace.package]
edition = "2021"
# Kept in lock-step with the release tag (v<MAJOR.MINOR.PATCH>). Bump via
# scripts/cut-release.sh; the version-sync CI gate (.github/workflows/version-sync.yml)
# fails any v* tag whose workspace version != the tag.
version = "0.5.65"
license = "Apache-2.0"
rust-version = "1.88.0"
# Apache-2.0 licensed but not (yet) published to crates.io: the workspace uses
# unversioned `{ path = "../x" }` deps, which a registry publish would reject.
# Marking the crates non-publishable also lets cargo-deny's `allow-wildcard-paths`
# exempt those path deps so `wildcards = "deny"` can be enforced against real
# (registry) wildcard requirements. (deny.toml C2)
publish = false

[workspace.dependencies]
anyhow = "1.0.97"
axum = "0.8.9"
base64 = "0.23.0"
blake3 = "1.8.5"
chacha20poly1305 = "0.11.0"
chrono = { version = "0.4.45", default-features = false }
ciborium = "0.2.2"
clap = "4.6.1"
crc32c = "0.6.8"
crc32fast = "1.4.2"
# `zeroize` is a default feature of ed25519-dalek; pinned explicitly so the
# SigningKey seed zeroize-on-drop guarantee (compaction-sync review F4) survives a
# future `default-features = false` on any consumer. Additive; no lock/version change.
data-encoding = "2.9.0"
ed25519-dalek = { version = "2.2.0", features = ["zeroize"] }
fs2 = "0.4.3"
hex = "0.4.3"
http-body-util = "0.1.3"
jsonwebtoken = { version = "11.0.0", default-features = false }
lz4_flex = "0.14.0"
p256 = { version = "0.14.0", default-features = false }
prometheus = { version = "0.13.4", default-features = false }
proptest = "1.6.0"
prost = "0.14.4"
rand = "0.10.1"
rcgen = "0.14.8"
regex = "1.11"
roxmltree = "=0.21.1"
rustix = { version = "1.1.4", features = ["fs"] }
serde = "1.0.218"
serde_json = "1.0.150"
serde_yaml = "0.9.34"
serial_test = "3"
sha2 = "0.11"
subtle = "2"
syn = "3.0.0"
proc-macro2 = "1.0"
tar = "0.4.44"
tempfile = "3.16.0"
thiserror = "2.0.12"
tokio = "1.52.3"
tokio-stream = "0.1.17"
# Client-only WebSocket for the relay dial (relay contract v1 §3). Pinned to
# 0.30 and default-features = false so rustls resolves with a SINGLE crypto
# provider (ring, no aws-lc-rs) — a dual-provider rustls has no default and
# ClientConfig::builder() then fails at RUNTIME, not at compile time.
tokio-tungstenite = { version = "0.30", default-features = false, features = ["connect", "handshake", "rustls-tls-webpki-roots"] }
toml = "1.1"
tonic = "0.14.6"
tower = "0.5"
tracing = "0.1.41"
tracing-subscriber = "0.3.19"
# corecrux-receipts remains on ureq 2.x; all ureq 3.x users inherit this entry.
ureq = { version = "3.3.0", default-features = false, features = ["rustls"] }
url = "2.5.7"
urlencoding = "2.1"
utoipa = "5"
uuid = "1.23.2"
# GF(256) Shamir for the 2-of-3 key escrow (`Gf256::split_bytes`). Default features
# off keeps the prime-field/elliptic-curve half of the crate out of the tree.
vsss-rs = { version = "6.0.1", default-features = false, features = ["std", "zeroize"] }
zeroize = { version = "1", features = ["derive"] }
x509-cert = { version = "0.3.0", default-features = false }
xxhash-rust = "0.8.12"
zip = { version = "9.0.5", default-features = false }
zstd = "0.14.3"

# ── Strictest lint configuration ────────────────────────────────────
# All clippy lint groups denied. Pedantic enabled. Specific overrides below.
# `unwrap_used` and `expect_used` are warn (not deny) because extracted
# monorepo code contains hundreds of legitimate uses; new crates override to deny.
[workspace.lints.rust]
unsafe_code = "forbid"
unused_imports = "deny"
unused_variables = "deny"
unused_mut = "deny"
unreachable_code = "deny"
unreachable_patterns = "deny"

[workspace.lints.clippy]
# ── Group-level enforcement ──
correctness = { level = "deny", priority = -1 }
suspicious = { level = "deny", priority = -1 }
style = { level = "warn", priority = -1 }
complexity = { level = "warn", priority = -1 }
perf = { level = "warn", priority = -1 }
pedantic = { level = "warn", priority = -1 }

# ── Deny: zero-tolerance lints ──
todo = "deny"
unimplemented = "deny"
dbg_macro = "deny"
wildcard_imports = "deny"
enum_glob_use = "deny"

# ── Warn: target for future cleanup (extracted code) ──
unwrap_used = "warn"
expect_used = "warn"
panic = "warn"
print_stdout = "warn"
print_stderr = "warn"
missing_docs_in_private_items = "allow"

# ── Allow: pedantic lints too noisy for extracted code ──
module_name_repetitions = "allow"
must_use_candidate = "allow"
missing_errors_doc = "allow"
missing_panics_doc = "allow"
return_self_not_must_use = "allow"
struct_excessive_bools = "allow"
too_many_lines = "allow"
cast_possible_truncation = "allow"
cast_sign_loss = "allow"
cast_precision_loss = "allow"
cast_possible_wrap = "allow"
cast_lossless = "allow"
similar_names = "allow"
items_after_statements = "allow"
single_match_else = "allow"
match_same_arms = "allow"
redundant_closure_for_method_calls = "allow"
unnested_or_patterns = "allow"
if_not_else = "allow"
manual_let_else = "allow"
needless_pass_by_value = "allow"
trivially_copy_pass_by_ref = "allow"
implicit_hasher = "allow"
doc_markdown = "allow"
used_underscore_binding = "allow"
unreadable_literal = "allow"
default_trait_access = "allow"
uninlined_format_args = "allow"
match_wildcard_for_single_variants = "allow"
option_if_let_else = "allow"
manual_string_new = "allow"
no_effect_underscore_binding = "allow"
ignored_unit_patterns = "allow"

# ── Build profiles ──────────────────────────────────────────────────
[profile.dev]
opt-level = 0

[profile.release]
opt-level = 3
lto = "thin"
codegen-units = 1
strip = "symbols"