Cargo.toml

[workspace]
members = ["xtask", "proxy-env"]
exclude = ["vendor/op-alloy-network"]

[package]
name = "kao"
version = "0.2.2"
edition = "2024"
publish = false

[profile.release]
lto = true
strip = true
codegen-units = 1

[dependencies]
alloy = { version = "2.0.1", features = ["full", "signer-mnemonic", "signer-ledger", "signer-trezor"] }
# EIP-712 support, deliberately NOT via alloy's `eip712` meta-feature. That
# meta-feature weak-references the cloud signers (`alloy-signer-aws?/eip712`,
# -gcp, -turnkey), and cargo's version resolver locks weak-referenced optional
# deps even when no feature ever activates them (rust-lang/cargo#10801) — so
# turning it on dragged the entire AWS/GCP/Turnkey SDK trees (~50 crates that
# are never compiled) into Cargo.lock, where cargo-vet and cargo-deny audit
# them. Enabling the same per-crate features directly yields an identical
# build with none of the lockfile pollution:
#   - alloy-core/eip712 → dyn-abi's `DynSolType::CustomStruct` (typed-data
#     decode rendering) + sol-types' Eip712Domain serde impls — exactly what
#     the meta-feature forwarded.
#   - alloy-signer/eip712 → `Signer::sign_typed_data`, the default path used
#     by software keys and Trezor (which has no eip712 feature of its own).
#   - alloy-signer-local/eip712, alloy-signer-ledger/eip712 → the cfg-gated
#     native impls (Ledger's on-device domain-hash + struct-hash flow).
# Versions pin to the same builds alloy 2.0.1 already resolves to, so no new
# packages enter the tree. Drop these four (back to the meta-feature) if
# cargo#10801 is ever fixed.
alloy-core = { version = "1.5.7", features = ["eip712"] }
alloy-signer = { version = "2.0.1", features = ["eip712"] }
alloy-signer-local = { version = "2.0.1", features = ["eip712"] }
alloy-signer-ledger = { version = "2.0.1", features = ["eip712"] }
clear-signing = { git = "https://github.com/kaowallet/clear-signing", features = ["bundled-registry"] }
# rusb reaches us transitively via alloy-signer-ledger -> hidapi-rusb -> rusb.
# Its default build dynamically links the host's libusb, baking an absolute
# path (e.g. /opt/homebrew/opt/libusb/lib/libusb-1.0.0.dylib) into the binary —
# so a build made on a machine with Homebrew libusb crashes at launch on any
# clean Mac with "Library not loaded". We declare rusb here ONLY to flip on the
# `vendored` feature, which compiles libusb from source and links it statically;
# feature unification then applies it to the whole graph. Requires a C compiler
# at build time (CI runners have one). Version tracks what alloy already resolves.
rusb = { version = "0.9.4", features = ["vendored"] }
async-trait = "0.1"
# Helios's API is built against alloy 1.x; we need its BlockId type to call
# eth_getBalance against the verified light-client. alloy 1.x and 2.x share
# the same alloy-primitives version (1.5.7), so Address/U256/B256 cross the
# boundary unchanged — only block-id types need the v1 import.
alloy-eips = "1"
# Same alloy-1 boundary as `alloy-eips`: needed to construct the
# `TransactionRequest` Helios's `HeliosClient::call` accepts. Without
# this, clear-signing's `symbol()` / `decimals()` probes against ERC-20
# targets fall through the unverified raw provider — which means an
# attacker on the RPC could lie about a contract's symbol/decimals,
# and the user signs trusting cosmetic metadata. With it, those reads
# go through Helios's verified eth_call (re-executes locally against
# proof-verified state), matching the verification guarantee
# `get_code` and `get_storage_at` already provide.
alloy-rpc-types-eth = "1"
# Helios's OpStack network uses `OpTransactionRequest` (a wrapper around
# alloy-1's TransactionRequest with deposit-tx support) for its `call`
# input. Already in the dep graph as a transitive — pulling it direct
# so we can construct values.
op-alloy-rpc-types = "0.20"
argon2 = "0.5.3"
postcard = { version = "1.1", default-features = false, features = ["use-std"] }
# Isolated helper crate whose sole job is the one `unsafe std::env::set_var`
# call that installs a process-wide proxy (`ALL_PROXY`) at startup. Lives in
# its own crate so this crate can keep `#![forbid(unsafe_code)]`. See
# `src/main.rs` for the call site and `proxy-env/src/lib.rs` for the rationale.
proxy-env = { path = "proxy-env" }
chacha20poly1305 = "0.10.1"
dirs = "6"
# UTS-46 / ENSIP-15 normalization for ENS names. Rejects bidi controls,
# zero-width chars, mixed-script confusables, and other display-spoofing
# inputs that a naive ASCII-lowercase pass would accept.
ens-normalize-rs = "0.1.1"
# Bytecode introspection — extracts function selectors and arg-type lists
# from EVM bytecode without needing source. Used by clear-signing to
# narrow ambiguous 4byte matches by intersecting with what the contract
# actually implements, and to fall back to "selector + arg types only"
# when 4byte has no entry. MIT-licensed; uses alloy-dyn-abi internally.
evmole = "0.8"
futures = "0.3"
getrandom = "0.4.2"
# Pinned to commit on tag 0.11.1. Bump deliberately rather than tracking a branch.
helios-ethereum = { git = "https://github.com/a16z/helios", rev = "204c998a927348e1c000a664f08d5b37b1b0d924" }
# Same git rev as helios-ethereum: both crates ship from the a16z/helios
# workspace and share types (alloy versions, network presets, etc.). The
# OP-Stack client wraps Helios's verified L1 anchor with L2 fault-proof
# bootstrap; the wallet uses it for Base / Optimism balance reads.
#
# Pulls in two upstream-broken transitive deps that we work around via
# [patch.crates-io] below: yanked `core2 0.4.0` (libp2p chain) and
# coherence-conflicting `op-alloy-network 0.20.0`. See the patch entries
# for the full story.
helios-opstack = { git = "https://github.com/a16z/helios", rev = "204c998a927348e1c000a664f08d5b37b1b0d924" }
# `advanced` exposes the custom-widget API (Widget/Tree/Clipboard), used by
# `colored_address`'s hover-grey + click-to-copy widget in src/ui/kao_widgets.rs.
iced = { version = "0.14.0", features = ["tokio", "image", "qr_code", "svg", "advanced"] }
# Privacy Pools (0xbow) proving + wallet SDK, pure Rust. `wallet` = onchain +
# account (alloy 2.0.1 bindings + BIP-44 HD derivation + the flow/sync helpers);
# the default `bundled` feature embeds the ~19 MB Groth16 circuit artifacts so
# proving needs no wasm/node/circom at runtime. The crate pins & re-exports
# alloy 2.0.1 — import alloy through `privacy_pools::alloy` where boundary types
# (Address/U256/Provider) cross — and pulls arkworks 0.5 + circom-witnesscalc
# (new ark-*/witnesscalc crates need supply-chain exemptions).
privacy-pools = { git = "https://github.com/kaowallet/privacy-pools", features = ["wallet"] }
rand = "0.8"
redb = "4.1.0"
# Local EVM for transaction preflight. Pinned to the same version helios
# pulls in (cargo unifies them into one build of revm 29.0.1 instead of
# duplicating). The three `optional_*` features disable basefee / nonce /
# block-gas validation during simulation — preflight is advisory, so a tx
# whose nonce is one ahead of the on-chain account or whose max-fee
# happens to dip below the base-fee window should still simulate, not
# abort with a config error. Matches helios's own feature set verbatim
# (helios/Cargo.toml workspace dep, rev 204c998) so the unified build has
# the same EVM semantics inside Kao as Helios uses for its verified
# eth_call.
revm = { version = "29.0.1", default-features = false, features = [
    "std",
    "optional_block_gas_limit",
    "optional_eip3607",
    "optional_no_base_fee",
] }
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "socks"] }
# `http::Uri` is the exact parser reqwest/hyper-util use for the `ALL_PROXY`
# value, so we reuse it to validate a user's proxy address before storing it —
# rejecting anything that would make reqwest silently ignore the proxy and
# connect directly (see `settings::valid_proxy_address`). The same http 1.x
# reqwest already depends on, so nothing new enters the tree.
http = "1"
secrecy = "0.10.3"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
tokio = { version = "1", features = ["rt", "sync"] }
toml = "0.8"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
url = "2"
zeroize = { version = "1.8.2", features = ["derive"] }

[dev-dependencies]
tempfile = "3"
# `http` (used in `safe::service` tests to synthesize `reqwest::Response`s via
# reqwest's `From<http::Response<T>>`) is a regular dependency now — see the
# `[dependencies]` entry.

# Workarounds for two upstream-broken transitive deps pulled in by
# helios-opstack. Drop both entries the moment the upstreams ship fixes
# (see each entry for the exact "drop when" condition).
[patch.crates-io]
# helios-opstack -> libp2p 0.51.3 -> multiaddr 0.17 -> multihash 0.17 ->
# core2 ^0.4.0 (yanked from crates.io). The unmodified upstream source of
# 0.4.0 still lives at this commit on bbqsrc/core2, so we point cargo
# straight at it to bypass the yank check. Pure source pin — no behavior
# change.
# Drop when: libp2p (or anything upstream of multihash) drops the core2
# dependency, or republishes a non-yanked 0.4.x.
core2 = { git = "https://github.com/bbqsrc/core2", rev = "545e84bcb0f235b12e21351e0c69767958efe2a7" }
# helios-opstack -> op-alloy-network 0.20.0 carries an explicit
# `impl NetworkWallet<Optimism> for EthereumWallet` that overlaps with
# alloy-network 1.x's blanket `impl<N: Network> NetworkWallet<N> for
# EthereumWallet`. Rust's coherence rule rejects the overlap (E0119) once
# both crates are linked into the same binary. We vendor a fork of the
# crate with the explicit impl deleted — see vendor/op-alloy-network/.
# Drop when: op-alloy-rs ships a release without the explicit impl AND
# helios-opstack's pinned rev consumes that release.
op-alloy-network = { path = "vendor/op-alloy-network" }

[package.metadata.packager]
product-name = "Kao Wallet"
identifier = "com.kaowallet.kao"
description = "Cute+Secure desktop wallet for Ethereum"
icons = ["assets/icons/icon.png", "assets/icons/icon.ico", "assets/icons/icon.icns"]

[[package.metadata.packager.binaries]]
path = "kao"
main = true

[package.metadata.packager.nsis]
installMode = "both"

[package.metadata.packager.deb]
section = "utils"

[package.metadata.packager.appimage]

[package.metadata.packager.pacman]

[package.metadata.packager.dmg]