Cargo.toml

[workspace]
members = [
    "crates/args",
    "crates/async-dialog",
    "crates/lcache",
    "crates/rcache",
    "crates/check",
    "crates/checkouts",
    "crates/common",
    "crates/decode",
    "crates/diagnostics",
    "crates/github",
    "crates/graph",
    "crates/mctx",
    "crates/mfile",
    "crates/op",
    "crates/ot",
    "crates/orchestrator",
    "crates/paths",
    "crates/mip",
    "crates/minimal",
    "crates/minimald",
    "crates/minimald-rpc",
    "crates/minvmd",
    "crates/mlog",
    "crates/remote-client",
    "crates/remote-proto",
    "crates/sandbox2",
    "crates/sessions",
    "crates/stdlib",
    "crates/switch",
    "crates/version",
]
resolver = "3"

package.edition = "2024"
package.publish = false
package.license = "Apache-2.0"
# Minimum supported Rust version, verified by the nightly `msrv` job
# (`cargo hack check --rust-version`). Every crate inherits this via
# `rust-version.workspace = true`; bump here, in one place, when the floor moves.
# 1.95 is the dependency-driven floor (sysinfo 0.39 requires rustc 1.95); no
# resolved dependency requires newer. The build toolchain pin is 1.97.0.
package.rust-version = "1.95"
# Shared base version for the workspace. This is the fallback the `version` crate
# reports when no `v*` git tag is reachable; the real release version comes from
# `git describe` at build time. See crates/version/build.rs.
package.version = "0.5.0-rc1"

[profile.release]
strip = true
lto = true
codegen-units = 1

# Fast-compiling profile for the Stage-2 guest initramfs minimald. The release
# profile's full LTO + codegen-units=1 dominate the cross-compile time, and the
# initramfs binary doesn't need them (it just reaches READY + serves a session).
# Drops the cross-compile from ~13 min toward a few minutes.
[profile.initramfs]
inherits = "release"
opt-level = 1
lto = false
codegen-units = 16

[workspace.dependencies]
anyhow = "1.0"
arbitrary = "1"
async-compression = { version = "0.4", features = ["tokio", "zstd", "zstdmt"] }
async-tar = { version = "0.6", default-features = false, features = ["runtime-tokio"] }
base64 = "0.23"
blake3 = { version = "1", features = ["serde"] }
# WireGuard mesh peer (Unit 4, behind the `networking-wg` feature). Pure-Rust
# WireGuard avoids a Go/cgo toolchain dependency (spec Design Considerations).
boringtun = { version = "0.7", default-features = false }
bytes = "1.11" # keep in sync with reqwest
bzip2 = "0.6"
camino = { version = "1", features = ["serde1"] }
clap = { version = "4.6", features = ["derive", "env", "string"] }
clap_complete = { version = "4.6" }
codespan-reporting = { version = "0.13", features = ["serialization"] } # Keep in sync with nickel-lang-core
constcat = "0.6"
copy_dir = "0.1.3"
chrono = {version = "0.4", features = ["serde", "std"]}
dirs = "6"
fd-lock = "4"
either = { version = "1.16", default-features = false }
flate2 = "1.1"
futures = "0.3"
generational-arena = {version = "0.2", features = ["serde"] }
# The google-cloud-* / reqwest cluster resolves below its latest releases and
# cannot be raised yet: reqwest >= 0.13.2 pulls js-sys >= 0.3.85, which requires
# an exact `wasm-bindgen = "=0.2.108"`, while nickel-lang-core's `format` feature
# reaches topiary-core -> topiary-tree-sitter-facade, which pins an exact
# `wasm-bindgen = "=0.2.100"`. The two cannot unify, so `cargo update` leaves the
# whole cluster pinned. Revisit when topiary relaxes that pin (0.7.3 still has
# it; 0.6.2 moved to =0.2.103, but 0.7.x went back to =0.2.100).
google-cloud-gax = "1.13"
google-cloud-auth = "1.5"
google-cloud-storage = "1.7"
hakoniwa = { version = "1.7.2", features = ["cgroups", "rustslirp"] }
http-body = "1"
hex = "0.4"
indicatif = "0.18"
indoc = "^2.0"
inquire = { version = "0.9", default-features = false, features = ["crossterm", "fuzzy"] }
jaq-all = "0.2.0"
json-subscriber = "0.3"
libc = "0.2"
lzma-rs = "0.3"

# Tracked as a git rev, not the crates.io release: crates.io lags master by a
# long way (0.18.0 is the newest published, and master has moved well past it).
# Bump the rev to pick up upstream fixes; revisit crates.io only once its
# releases catch up. Current rev is master @ 2026-07-26.
nickel-lang-core = { git = "https://github.com/nickel-lang/nickel.git", rev = "0d306feb13ff38b154a3beb8dccaaa59cdd18ee8", default-features = false, features = ["format"] }

opentelemetry-semantic-conventions = "0.32"
# `socket` + `time`: the guest's vsock timekeep listener binds an AF_VSOCK
# datagram socket and steps CLOCK_REALTIME from the host's updates.
nix = { version = "0.31", features = ["fs", "socket", "time", "user"] }
nutype = { version = "0.7", features = ["serde"] }
object = { version = "0.39", default-features = false, features = ["archive", "elf", "read_core", "std"] }
oci-spec = "0.10"
path-absolutize = "4.0"
rand = "0.10"
# rand_core 0.6 (not 0.10) to match boringtun/x25519-dalek's RNG traits for
# WireGuard keypair generation (`networking-wg`).
rand_core = { version = "0.6", features = ["getrandom"] }
rayon = "1.12"
rcgen = { version = "0.14", default-features = false, features = ["crypto", "pem", "ring"] }
regex = "1" # keep in sync with nickel-lang-core
rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std"] }
tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "logging"] }
reqwest = { version = "0.13", features = ["stream"], default-features = false } # keep in sync with google-cloud-gax
rustc-hash = "2.1.2"
serde = { version = "1.0", features = ["derive", "rc"] } # Keep within the same minor version as nickel-lang-core
prost = "0.14"
prost-build = "0.14"
prost-types = "0.14"
resolv-conf = "0.7"
russh = { version = "0.62", default-features = false, features = ["aws-lc-rs", "flate2"] }
russh-sftp = "2.1"
serde_json = { version = "1.0" }
serial_test = "4"
sha2 = "0.11"
shlex = "2.0"
size = "0.5"
smallvec = {version = "1.15", features = ["serde"]}
sysinfo = { version = "0.39", default-features = false, features = ["system"] }
tar = "0.4"
tempfile = "3.27"
tokio = { version = "1.52", features = ["full"] }
tokio-stream = "0.1"
tokio-vsock = "0.7"
tokio-util = "0.7"
toml = "1.1"
toml_edit = "0.25"
tonic = "0.14.6"
tonic-prost = "0.14.6"
tonic-prost-build = "0.14.6"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
tracing-appender = "0.2"
thiserror = "2"
url = "2" # keep in sync with reqwest
uuid = { version = "1.23", features = ["v4", "v7", "serde"] }
vt100-ctt = { version = "0.17", default-features = false }
zeroize = "1.9"
zstd = "0.13"

moka = { version = "0.12", default-features = false, features = ["sync"] }
globset = "0.4"
walkdir = "2.5"

petgraph = "0.8"

# Our crates. These are path deps in a `publish = false` workspace, so no
# `version` requirement is needed (or used) — cargo resolves them by path. Adding
# one would just be a pin to keep in sync with each crate's own version.
args = { path = "crates/args" }
async-dialog = { path = "crates/async-dialog" }
graph = { path = "crates/graph" }
lcache = { path = "crates/lcache" }
rcache = { path = "crates/rcache" }
check = { path = "crates/check" }
checkouts = { path = "crates/checkouts" }
common = { path = "crates/common" }
decode = { path = "crates/decode" }
diagnostics = { path = "crates/diagnostics" }
github = { path = "crates/github" }
mctx = { path = "crates/mctx" }
minimald-rpc = { path = "crates/minimald-rpc" }
mlog = { path = "crates/mlog" }
mfile = { path = "crates/mfile" }
op = { path = "crates/op" }
ot = { path = "crates/ot" }
orchestrator = { path = "crates/orchestrator" }
paths = { path = "crates/paths" }
remote-proto = { path = "crates/remote-proto" }
remote-client = { path = "crates/remote-client" }
sandbox2 = { path = "crates/sandbox2" }
sessions = { path = "crates/sessions" }
switch = { path = "crates/switch" }
version = { path = "crates/version" }

stdlib = { path = "crates/stdlib" }