Cargo.toml

[workspace]
resolver = "3"
members = [
  "crates/auths",
  "crates/auths-core",
  "crates/auths-cli",
  "crates/auths-id",
  "crates/auths-index",
  "crates/auths-policy",
  "crates/auths-verifier",
  "crates/auths-telemetry",
  "crates/auths-crypto",
  "crates/auths-sdk",
  "crates/auths-infra-git",
  "crates/auths-infra-http",
  "crates/auths-infra-rekor",
  "crates/auths-storage",
  "crates/auths-transparency",
  "crates/auths-keri",
  "crates/auths-jwt",
  "crates/auths-mcp-server",
  "crates/auths-pairing-daemon",
  "crates/auths-pairing-protocol",
  "crates/auths-radicle",
  "crates/auths-scim",
  "crates/auths-utils",
  "crates/auths-oidc-port",
  "crates/xtask", "crates/auths-api",
]

[workspace.package]
version = "0.0.1-rc.12"
license = "Apache-2.0"
rust-version = "1.93"
repository = "https://github.com/auths-dev/auths"
homepage = "https://github.com/auths-dev/auths"

[workspace.dependencies]
tokio = { version = "1", features = ["full"] }
bs58 = "0.5.1"
base64 = "0.22.1"
thiserror = "2"
uuid = { version = "1", features = ["v4"] }
git2 = { version = "0.20.4", default-features = false, features = ["vendored-libgit2"] }
glob = "0.3"
parking_lot = "0.12"
schemars = "0.8"

# fn-128.T6: workspace-pinned `rand` so every crate resolves to the same
# version and the `rand::thread_rng` / `rand::random` clippy bans cannot be
# bypassed by version skew.
rand = "0.8"

# -------------------------------------------------------------------------
# fn-128.T9: EXACT-PINNED crypto crates.
#
# Minor-version bumps can change DER encoding, signature layout, AEAD
# overhead, or trait dispatch and silently invalidate existing signatures.
# `=x.y.z` ensures `cargo update` cannot drift.
#
# Bump procedure:
# 1. Edit the pin.
# 2. Run `cargo nextest run -p auths-crypto --test integration 'cases::kat::'`
#    under both default and `--features fips` builds. Outputs MUST match
#    byte-for-byte for deterministic KATs.
# 3. Update `docs/security/dependency-policy.md`.
# -------------------------------------------------------------------------
ring = "=0.17.14"
subtle = "=2.6.1"
zeroize = { version = "=1.8.2", features = ["serde", "derive"] }
sha2 = "=0.10.9"
hkdf = "=0.12.4"
hmac = "=0.12.1"
chacha20poly1305 = { version = "=0.10.1", features = ["std"] }
aes-gcm = { version = "=0.10.3", features = ["std"] }
# Exact pin: canonicalization changes silently break all existing attestation signatures.
json-canon = "=0.1.3"

auths-core = { path = "crates/auths-core" }
auths-keri = { path = "crates/auths-keri" }
auths-id = { path = "crates/auths-id" }
auths-verifier = { path = "crates/auths-verifier", default-features = false }
auths-policy = { path = "crates/auths-policy" }
auths-index = { path = "crates/auths-index" }
auths-telemetry = { path = "crates/auths-telemetry" }
auths-crypto = { path = "crates/auths-crypto", default-features = false }
auths-sdk = { path = "crates/auths-sdk" }
auths-infra-git = { path = "crates/auths-infra-git" }
auths-infra-http = { path = "crates/auths-infra-http" }
auths-jwt = { path = "crates/auths-jwt" }
auths-pairing-daemon = { path = "crates/auths-pairing-daemon" }
auths-pairing-protocol = { path = "crates/auths-pairing-protocol" }
auths-storage = { path = "crates/auths-storage" }
auths-transparency = { path = "crates/auths-transparency", default-features = false }
auths-utils = { path = "crates/auths-utils" }
insta = { version = "1", features = ["json"] }

# Compile crypto-heavy crates with optimizations even in dev/test builds.
# Without this, Argon2id key derivation (m=64 MiB, t=3) takes ~5-10s per
# call in unoptimized builds, causing E2E test timeouts on CI runners.

[profile.dev.package.argon2]
opt-level = 3
[profile.dev.package.chacha20poly1305]
opt-level = 3
[profile.dev.package.aes-gcm]
opt-level = 3
[profile.dev.package.ring]
opt-level = 3

[workspace.lints.clippy]
unwrap_used = "deny"
expect_used = "deny"
print_stdout = "deny"
print_stderr = "deny"
exit = "deny"
dbg_macro = "deny"
disallowed_methods = "deny"

[workspace.lints.rustdoc]
broken_intra_doc_links = "deny"

[profile.dev]
# Line-tables-only cuts target/ size by 50-70% and speeds linking.
# Still get file:line in backtraces; lose variable inspection in lldb.
debug = "line-tables-only"

[profile.dev.package."*"]
# Full debug info OFF for dependencies (we never step into them).
debug = false