Cargo.toml

# Wyrd Cargo workspace.
#
# Coarse-to-fine crate structure (ADR-0016): start with foundation crates plus a
# combined `core`, and split as boundaries firm up. The dependency rule
# (ADR-0010): implementations and consumers depend on `traits`, never on each
# other's concretes; only the `server` binary wires concretes together.
[workspace]
resolver = "2"
members = [
    "crates/chunk-format",
    "crates/proto",
    "crates/traits",
    "crates/testkit",
    "crates/core",
    "crates/metadata-conformance",
    "crates/metadata-fault-conformance",
    "crates/metadata-redb",
    "crates/metadata-tikv",
    "crates/metadata-fdb",
    "crates/chunkstore-fs",
    "crates/chunkstore-grpc",
    "crates/coordination-conformance",
    "crates/coordination-mem",
    "crates/telemetry",
    "crates/coordination-etcd",
    "crates/custodian",
    "crates/gateway-core",
    "crates/gateway-s3",
    "crates/server",
    "crates/dst",
    "xtask",
]

[workspace.package]
version = "0.0.0"
edition = "2021"
rust-version = "1.96"
license = "Apache-2.0"
repository = "https://github.com/getwyrd/wyrd"
publish = false

[workspace.dependencies]
# Foundation crates, referenced by path so the workspace builds standalone.
wyrd-chunk-format = { path = "crates/chunk-format" }
wyrd-proto = { path = "crates/proto" }
wyrd-traits = { path = "crates/traits" }
wyrd-testkit = { path = "crates/testkit" }
wyrd-core = { path = "crates/core" }
wyrd-metadata-conformance = { path = "crates/metadata-conformance" }
wyrd-metadata-fault-conformance = { path = "crates/metadata-fault-conformance" }
wyrd-metadata-redb = { path = "crates/metadata-redb" }
wyrd-metadata-tikv = { path = "crates/metadata-tikv" }
wyrd-metadata-fdb = { path = "crates/metadata-fdb" }
wyrd-chunkstore-fs = { path = "crates/chunkstore-fs" }
wyrd-chunkstore-grpc = { path = "crates/chunkstore-grpc" }
wyrd-coordination-conformance = { path = "crates/coordination-conformance" }
wyrd-coordination-mem = { path = "crates/coordination-mem" }
# The shared backend-agnostic telemetry seam (observability floor, proposal 0010
# item 1) — extracted from custodian so no leaf crate anchors the export path.
wyrd-telemetry = { path = "crates/telemetry" }
wyrd-coordination-etcd = { path = "crates/coordination-etcd" }
wyrd-custodian = { path = "crates/custodian" }
# The shared gateway seam (ObjectGateway) and the S3 wire-surface crate it drives
# (issue #364, T5-a): the wire layer is its own crate, generic over the neutral seam,
# so it never calcifies inside the `server` composition root (ADR-0010).
wyrd-gateway-core = { path = "crates/gateway-core" }
wyrd-gateway-s3 = { path = "crates/gateway-s3" }

# Shared third-party dependencies, version-pinned once here.
async-trait = "0.1"
# The HTTP framework hosting the gateway's S3 wire surface (issue #364,
# m4-first-deployment-blueprint §5 "Primary integration surface"). Already in the
# graph transitively via `tonic` (built on axum/hyper), so this promotes an existing,
# `cargo deny`-vetted crate to a direct dependency rather than adding a new one to the
# licence surface. Minimal features: a router + `axum::serve` + streaming bodies over
# HTTP/1 (no default multipart/ws/etc.).
axum = { version = "0.8", default-features = false, features = ["http1", "tokio"] }
bytes = "1"
# EC micro-benchmarks (M1.7). Lean: no plotters/rayon HTML stack — the console
# numbers are what CI tracks, and fewer transitive deps keeps the license
# surface small (ADR-0003).
criterion = { version = "0.8", default-features = false, features = ["cargo_bench_support"] }
crc32c = "0.6"
# Runtime-agnostic future combinators (try_join_all) for the parallel write
# fan-out / any-k read (M2.4/M2.5). `alloc`-only: single-task concurrency that
# polls the n fragment futures cooperatively — deterministic under madsim, no
# task spawning, no runtime tie-in (ADR-0009).
futures-util = { version = "0.3", default-features = false, features = ["alloc"] }
# RustCrypto HMAC-SHA256 — the SigV4 signing/verification MAC on the gateway's
# fail-closed auth boundary (issue #364). A vetted, maintained implementation replacing
# the earlier hand-rolled one (carry-forward T5-a); `MIT OR Apache-2.0` (already on the
# deny.toml allowlist), pure-Rust, no build script. **Coupled to `sha2` through the shared
# `digest` core** — hmac 0.13 and sha2 0.11 both move it to digest 0.11, so the two must be
# bumped TOGETHER or the graph carries two `digest` majors and the HMAC trait bounds stop
# resolving. That coupling is why Dependabot groups them (#542) and why #541 landed the
# bump and the API migration as one change. Adopted through the ADR-0003 §2 three-test
# dependency audit (see build-notes).
hmac = "0.13"
madsim = "0.2"
# Codegen counterpart, used by `proto`'s build.rs only when `CARGO_CFG_MADSIM`
# is set; it emits the simulated client/server stubs into `OUT_DIR/sim/`.
madsim-tonic-build = "0.6.0"
pollster = "1.0"
prost = "0.14"
# The distributed (production) metadata backend's client (ADR-0008, proposal 0007
# M4.1). Pinned here; consumed ONLY by `wyrd-metadata-tikv` behind its OFF-by-default
# `tikv` feature, so the default `cargo xtask ci` on a laptop/worktree with no TiKV
# never compiles or audits this tree and stays green. `tikv-client` is **pre-1.0**
# (draft 0015 names the maturity / supply-chain risk with an evaluation gate); the
# `0.4` line is the current release. Introducing it into the shipped graph — the
# ADR-0003 three-test audit + `deny.toml` allowlist call — is a **NEEDS-HUMAN** at
# sign-off (INTEGRATION §4; research issue #260 tracks the pin + API-shape confirmation).
tikv-client = "0.4"
foundationdb = { version = "0.11", default-features = false, features = ["fdb-7_3"] }
# The production L5 Coordination backend's client (ADR-0006, proposal 0015
# §"Deployment prerequisite", #365). Pinned here; consumed ONLY by
# `wyrd-coordination-etcd` behind its OFF-by-default `etcd` feature, so the default
# `cargo xtask ci` never compiles or audits this tree and stays green. The `0.14`
# line regenerates the etcd protobufs at build time (it needs a system `protoc`),
# which is why the feature is off by default and the real-etcd run is a dedicated
# `xtask etcd-conformance` job. Introducing it into the shipped graph — the ADR-0003
# three-test audit + `deny.toml` allowlist call, plus the TLS/auth posture — is a
# **NEEDS-HUMAN** at sign-off (INTEGRATION §4). Under `--cfg madsim` the store instead
# uses `madsim-etcd-client` (specified inline in the crate), which needs no protoc.
etcd-client = "0.14"
protox = "0.9"
rand = "0.10"
rand_chacha = "0.10"
redb = "4"
reed-solomon-simd = "3"
# Well-formed-XML DOM parser for the S3 gateway's DeleteObjects request body (issue #509).
# The whole XML-1.0 grammar — single root, matched/nested tags, unique attribute names, valid
# char/entity refs, no raw `<`/`&` in attribute values, comment/PI/CDATA grammar — is validated
# by construction, and DTDs are rejected by default (no XXE / billion-laughs), so the gateway
# writes NO hand-rolled well-formedness pass on that destructive path. Adopted through the
# ADR-0003 §2 three-test dependency audit (see #509 build-notes): `MIT OR Apache-2.0` (already
# on the deny.toml allowlist), `#![forbid(unsafe_code)]`, widely used + fuzzed. Its only
# transitive dependency is `memchr`, already vendored in Cargo.lock — no new license surface.
roxmltree = "0.21"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
# RustCrypto SHA-256 — the SigV4 payload hash + canonical-request digest, and the
# streaming PUT body hash (issue #364). Vetted maintained crate replacing the earlier
# hand-rolled SHA-256 on the auth boundary (carry-forward T5-a); `MIT OR Apache-2.0`
# (already allowed), pure-Rust, no build script. **Coupled to `hmac` above** through the
# shared `digest` 0.11 core — bump the pair together, never one alone (#541, #542).
sha2 = "0.11"
tempfile = "3"
# Async runtime, used only to *host* a tonic server (the gRPC stack is built on
# tokio/hyper, already in the tree via tonic). Wyrd's own async surface stays
# runtime-agnostic (async-trait over abstract seams, ADR-0009); tokio is a
# test/binary host detail — the `d-server` subcommand (M2.3) and the in-process
# round-trip test (M2.2) need a real reactor. Pinned once here, kept minimal.
tokio = { version = "1", features = [
    "macros",
    "rt-multi-thread",
    "net",
    "time",
    "signal",
    "sync",
] }
tokio-stream = { version = "0.1", features = ["net"] }
# gRPC transport for the networked storage path (M2, proposal 0004). Default
# features only — no `tls` (the dev/DST profiles run plaintext; mTLS is a later
# composition seam, ADR-0005). Version matrix, settled against crates.io and kept
# current: tonic 0.14 <-> tonic-prost-build 0.14 <-> protox 0.9 <-> prost 0.14,
# and madsim-tonic 0.6.0+0.14 (added in M2.6) tracks tonic 0.14 — so the
# deterministic-simulation DST runs the *real* wire code, no in-sim fake (ADR-0009).
tonic = "0.14"
# The standard gRPC health-checking protocol (`grpc.health.v1`, proposal 0010
# §"Scope boundary" item 7, issue #576): the d-server role's liveness/readiness probe
# surface, reusing the standard proto rather than a bespoke service ("no bespoke
# service" — 0010 §Crate touch-points), so any supervisor speaking `grpc.health.v1`
# works. Version-matched to `tonic` (both `0.14`; `tonic-health` 0.14.6 depends on
# `tonic` `0.14`). New dependency: ADR-0003 three-test audit + `deny.toml` allowlist
# review is a NEEDS-HUMAN at sign-off (INTEGRATION §4).
tonic-health = "0.14"
# Tower middleware for the d-server's admission control (issue #205, architecture
# §8.9 fail-closed-under-pressure). `tonic` already pulls `tower` transitively; we
# depend on it directly to apply a SERVER-WIDE (shared-semaphore) concurrency bound
# plus load-shedding via `Server::layer`, so an overload sheds a retryable status
# instead of exhausting runtime threads. Only the two middleware modules we use:
# `limit` (GlobalConcurrencyLimitLayer) and `load-shed` (LoadShedLayer).
tower = { version = "0.5", default-features = false, features = ["limit", "load-shed"] }
# `http-body` names `Frame`/`SizeHint` for the health surface's permit-holding
# response body (issue #576): a permit counted for a `Health/Watch` stream's whole
# lifetime, which tower's concurrency limit does not do. Already in the graph via tonic.
http-body = "1"
# tonic 0.14 split the prost codec into its own runtime crate; the generated
# service stubs reference `tonic_prost::ProstCodec`.
tonic-prost = "0.14"
tonic-prost-build = "0.14"
# --- Durability-plane telemetry (M3.3, proposal 0005 §"The durability plane";
# ADR-0011 telemetry-from-first-commit, ADR-0012 backend-agnostic OpenTelemetry) ---
# The custodian emits durability telemetry through `tracing` bridged to OpenTelemetry,
# exporting over BOTH a Prometheus-scrapeable registry AND OTLP push — no backend is
# hardcoded (ADR-0012). New dependencies: they require the ADR-0003 cargo-deny
# three-test audit + `deny.toml` allowlist review at sign-off (a NEEDS-HUMAN).
tracing = "0.1"
# `env-filter` (the `--log-level` / `RUST_LOG` directive parser) and `json` (the
# machine-readable line format a collector ingests) are the two surfaces the operational
# log subscriber is built from (proposal 0010 items 1 + 3, #527) — both are OFF in
# tracing-subscriber's default feature set, so they are named here.
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
tracing-opentelemetry = "0.33"
opentelemetry = "0.32"
opentelemetry_sdk = "0.32"
opentelemetry-prometheus = "0.32"
opentelemetry-otlp = { version = "0.32", default-features = false, features = [
    "metrics",
    "grpc-tonic",
] }
prometheus = "0.14"

# Lint policy — the SINGLE SOURCE OF TRUTH for the lint gate (ADR-0016: the rule
# lives in one place, not duplicated across CI YAML and a clippy CLI flag). Each
# crate opts in with `[lints]\nworkspace = true`; `cargo build`, `cargo clippy`,
# and a contributor's editor (rust-analyzer) all read the same levels from here.
# This replaces the old `cargo clippy -- -D warnings` flag in xtask.
[workspace.lints.rust]
# Warnings are errors — faithful migration of the old `-D warnings` behavior.
# NOTE: this is stricter than the old clippy-only `-D warnings` flag: it now
# applies to every compile, including the `--cfg madsim` DST build (ADR-0009).
# `madsim` is set via RUSTFLAGS, not a Cargo feature, so it must be declared as a
# known cfg below — otherwise `unexpected_cfgs` fires (now as an error) on the
# `#[cfg(madsim)]` gates in the DST tier.
warnings = "deny"
unexpected_cfgs = { level = "warn", check-cfg = ['cfg(madsim)'] }

[workspace.lints.clippy]
# The default clippy gate (correctness, suspicious, style, complexity, perf).
# Equivalent to what `-D warnings` enforced for clippy lints — the codebase
# already passes this, so it is a codification, not a tightening.
all = "deny"

# --- Correctness ratchet (intentionally NOT enabled yet) ---------------------
# These restriction lints are high-value for infrastructure code — they flag
# panics and silent integer overflow in shipping paths, where a wrong offset is
# a data-corruption bug. They are left commented because they also fire in test
# code (which `unwrap`s freely) and would turn the gate red until a cleanup pass.
# Promote them to "deny" CRATE-BY-CRATE (move this block into a specific crate's
# `[lints.clippy]`, with `#![cfg_attr(test, allow(...))]` for its test modules)
# as each crate is hardened — that ratchet is itself a good DST-backed task.
#
# unwrap_used            = "deny"   # no silent `.unwrap()` in shipping code
# expect_used            = "deny"
# indexing_slicing       = "deny"   # `a[i]` can panic — prefer `.get(i)`
# arithmetic_side_effects = "deny"  # catch integer overflow on the format/EC paths
# panic                  = "deny"

[workspace.lints.rustdoc]
# Keep the API docs (and the architecture doc's code links) honest.
broken_intra_doc_links = "deny"