[package]
name = "wshm-core"
version = "0.33.1"
edition = "2021"
description = "Core library for wshm"
license = "Apache-2.0"

[[bin]]
name = "wshm"
path = "src/main.rs"

[features]
default = []

# Object storage providers for `wshm_core::storage` (export sinks and page
# publishing). The local-directory provider is always available; each cloud
# provider pulls its `object_store` backend only when enabled.
storage-s3 = ["object_store/aws"]
storage-gcs = ["object_store/gcp"]
storage-azure = ["object_store/azure"]
storage-all = ["storage-s3", "storage-gcs", "storage-azure"]

# Export sinks (cloud storage). Kept as aliases of the storage-* features so
# existing `--features export-s3` builds keep working.
export-s3 = ["storage-s3"]
export-gcs = ["storage-gcs"]
export-azure = ["storage-azure"]

# Export sinks (databases)
# Note: PostgreSQL backend and SQLite→Postgres migration are wshm-pro
# features and intentionally absent from OSS.
export-elastic = ["dep:elasticsearch"]
export-opensearch = ["dep:opensearch"]
export-mongodb = ["dep:mongodb"]
export-mysql = ["dep:mysql_async"]

# Vault providers
vault-hashicorp = ["dep:vaultrs"]
vault-aws = ["dep:aws-sdk-secretsmanager", "dep:aws-config"]
vault-gcp = ["dep:google-cloud-secretmanager-v1"]

# Convenience bundles
export-all = [
    "export-s3", "export-gcs", "export-azure",
    "export-elastic", "export-opensearch", "export-mongodb",
    "export-mysql",
]
vault-all = ["vault-hashicorp", "vault-aws", "vault-gcp"]

[dependencies]
clap = { version = "4", features = ["derive", "env"] }
octocrab = "0.44"
# Used with octocrab's low-level `_get_with_headers` to fetch a PR diff
# through the authenticated api.github.com endpoint instead of the public
# github.com/*.diff URL — see fetch_pr_diff_raw. Versions match what
# octocrab 0.44 itself resolves to (Cargo.lock already carries both
# transitively; these just make them directly nameable in our code).
http = "1"
http-body-util = "0.1"
# Pinned to the exact version octocrab 0.44 depends on — its `.app()`
# builder takes a `jsonwebtoken::EncodingKey` by value, so a mismatched
# major/minor version would fail to type-check even though both compile.
jsonwebtoken = "9.3"
rusqlite = { version = "0.32", features = ["bundled"] }
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
toml = "0.8"
tokio = { version = "1", features = ["full"] }
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
git2 = "0.19"
chrono = { version = "0.4", features = ["serde"] }
anyhow = "1"
encoding_rs = "0.8"
dirs = "6.0.0"
getrandom = "0.2"
ureq = { version = "2", features = ["json"] }
hostname = "0.4"
base64 = "0.22"
regex = "1.12.3"
axum = "0.8"
hmac = "0.12"
sha2 = "0.10"
hex = "0.4"
tower = "0.5"
tower-http = { version = "0.6", features = ["trace"] }
flate2 = "1"
tar = "0.4"
zip = { version = "9", default-features = false, features = ["deflate"] }
async-trait = "0.1.92"
is-terminal = "0.4"
zeroize = "1"
axum-server = { version = "0.7", features = ["tls-rustls"] }
rustls = { version = "0.23", features = ["ring"] }
# Local accounts: password hashing + secure random generation.
argon2 = "0.5"
rand = "0.8"
# Encrypted secret vault (AES-256-GCM with master key from WSHM_MASTER_KEY).
aes-gcm = "0.10"

# Object storage (wshm_core::storage). Only the local filesystem backend is
# built by default; cloud backends are enabled by the storage-* features.
object_store = { version = "0.14", default-features = false, features = ["fs"] }

# Optional: Vault - AWS shared config loader (used by vault-aws)
aws-config = { version = "1", optional = true, default-features = false, features = ["default-https-client", "rt-tokio", "credentials-process", "sso"] }

# Optional: Export - Databases
elasticsearch = { version = "9.1.0-alpha.1", optional = true }
opensearch = { version = "2", optional = true }
mongodb = { version = "3", optional = true }
mysql_async = { version = "0.36", optional = true }

# Optional: Vault
vaultrs = { version = "0.7", optional = true }
aws-sdk-secretsmanager = { version = "1", optional = true, default-features = false, features = ["default-https-client", "rt-tokio"] }
google-cloud-secretmanager-v1 = { version = "1", optional = true }
mime_guess = "2"
rust-embed = "8"
urlencoding = "2.1.3"
# NFKC folding of lookalike characters before injection detection (#235).
unicode-normalization = "0.1.25"
futures = "0.3.32"
ratatui = "0.29"
crossterm = "0.28"

# libgit2's HTTPS transport pulls openssl-sys, which needs a system OpenSSL.
# Two cases lack one: musl/Alpine (no system lib), and cross-compiling the
# x86_64 macOS slice on an arm64 runner (no x86_64 OpenSSL on the host). Build
# the vendored copy from source there — glibc-Linux/Windows and the native
# arm64 macOS build keep using their platform lib.
[target.'cfg(any(target_env = "musl", target_os = "macos"))'.dependencies]
openssl = { version = "0.10", features = ["vendored"] }