Cargo.toml

[workspace]
resolver = "2"
# Virtual workspace (no root [package]) is load-bearing: it prevents
# release-please's `rust` strategy from sweeping every workspace member's
# [package].version to the releasing package's version. See
# release-please-action@v4 src/strategies/rust.ts buildUpdates() — when the
# same Cargo.toml is BOTH a workspace root AND a crate package, it reads
# workspace.members and writes its own newVersion into every member. We hit
# this on v2.26.0, v2.26.1, v2.26.2 (each required a manual revert commit
# restoring mbgl-sys to its 0.1.x train). Virtual workspace at root +
# subdirectory crates => each package strategy only touches its own
# Cargo.toml. Reference: geolith repo uses the same layout successfully.
members = ["crates/tileserver-rs", "crates/mbgl-sys"]

[workspace.package]
edition = "2024"
rust-version = "1.91"
repository = "https://github.com/vinayakkulkarni/tileserver-rs"

[workspace.dependencies]
# Internal crates
mbgl-sys = { path = "crates/mbgl-sys", version = "0.1.6" }

# Web framework
axum             = { version = "0.8.9", features = ["multipart"] }
tower-http       = { version = "0.7.0", features = ["fs", "cors", "compression-gzip", "compression-br", "trace", "set-header", "normalize-path"] }

# Async runtime
tokio            = { version = "1.52.3", features = ["full"] }
futures          = "0.3.32"

# Serialization
serde            = { version = "1.0.228", features = ["derive"] }
serde_json       = "1.0.150"
serde_yaml_ng    = "0.10.0"
toml             = "1.1.2"

# Pattern matching (used by CORS origin glob/regex support)
regex            = "1.12"

# Error handling
thiserror        = "2.0.18"
anyhow           = "1.0.102"

# CLI
clap             = { version = "4.6.1", features = ["derive", "env"] }

# Logging / tracing
tracing          = "0.1.44"
tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }

# Tile formats
pmtiles          = { version = "0.23.0", default-features = false, features = ["http-async", "mmap-async-tokio", "tilejson"] }

# Cloud object storage (optional)
object_store     = { version = "0.14", default-features = false, features = ["aws", "azure", "gcp"] }

# SFTP support (optional, `sftp` feature). russh 0.61 bundles SSH key parsing
# under `russh::keys` (the standalone russh-keys crate is deprecated/merged),
# so we only need russh + russh-sftp. `ring` crypto provider is preferred over
# `aws-lc-rs` for build-time predictability on Linux/macOS.
russh            = { version = "0.62", default-features = false, features = ["ring"] }
russh-sftp       = { version = "2.3", default-features = false }
geozero          = { version = "0.15.1", features = ["with-mvt", "with-geojson"] }
flate2           = "1.1.9"
brotli           = "8.0.4"
zstd             = "0.13.3"
prost            = "0.14.4"
geo-types        = "0.7.19"

# MLT support — unblocked May 8 2026 by cql2 0.5.6 (geo 0.31 → 0.33). 0.9.1
# renamed `TileLayer01` → `TileLayer`; transcode.rs callsites updated.
mlt-core         = { version = "0.12.1" }

# MBTiles / SQLite
#
# Linkage policy (LOAD-BEARING): rusqlite uses the system sqlite3 shared
# library, NOT the bundled static one. mbgl-sys statically embeds its own
# sqlite3 (for MapLibre Native's tile/style storage); if rusqlite were
# `bundled` too, both archives would export every sqlite3_* symbol and
# rust-lld errors with `duplicate symbol` on Linux GNU-ld. System sqlite is
# always present on macOS (/usr/lib/libsqlite3.dylib), Linux distros ship
# libsqlite3-dev in default repos, and CI/Docker installs it explicitly.
# Windows is handled separately via the `bundled-windows` feature.
rusqlite         = { version = "0.40.1", features = ["bundled-windows"] }

# HTTP client
reqwest          = { version = "0.13.4", default-features = false, features = ["rustls", "json"] }

# Cryptography / hashing
sha2             = "0.11.0"
# Constant-time primitives (already a transitive dep via `rsa`; declared
# explicitly here so `src/mcp/auth.rs` + `src/mcp/transport.rs` can use
# `ConstantTimeEq` for bearer/PKCE comparisons without a sneaky version
# drift between our direct use and rsa's transitive pin).
subtle           = "2.6"
uuid             = { version = "1.23.3", features = ["v4"] }

# Binary formats / data
bytes            = "1.12.0"
image            = { version = "0.25.10", default-features = false, features = ["png", "jpeg", "webp"] }
ndarray          = { version = "0.17.2", features = ["rayon"] }
exmex            = "0.21.0"

# Concurrency
arc-swap         = "1.9.1"
crossbeam-channel = "0.5"
async-trait      = "0.1.89"

# Utilities
dotenvy          = "0.15.7"
mime_guess       = "2.0.5"
shellexpand      = { version = "3.1.2", default-features = false, features = ["base-0"] }
url              = "2"
urlencoding      = "2.1.3"

# Embedded frontend (optional)
rust-embed       = { version = "8.11.0", features = ["axum"] }

# OpenAPI / Scalar API Reference
utoipa           = { version = "5.5.0", features = ["axum_extras"] }
scalar_api_reference = { version = "0.2", features = ["axum"] }

# OpenTelemetry — full 0.32 family. The `tracing-opentelemetry` line below pulls the
# fix from tokio-rs/tracing-opentelemetry#258 (merged 2026-05-15, NOT yet
# released on crates.io) via `[patch.crates-io]` at the bottom of this
# file. Drop the patch override the moment `tracing-opentelemetry > 0.32.1`
# publishes on crates.io with `opentelemetry ^0.32` deps.
# The `opentelemetry` group in `.github/dependabot.yml` bumps these crates
# atomically — never solo-bump.
opentelemetry    = "0.32.0"
opentelemetry_sdk = { version = "0.32.1", features = ["rt-tokio"] }
opentelemetry-otlp = { version = "0.32.0", features = ["grpc-tonic", "metrics", "logs"] }
opentelemetry-semantic-conventions = "0.32.0"
tracing-opentelemetry = "0.33.0"
# Official `opentelemetry-prometheus` crate, un-deprecated and re-released
# on 2026-05-08 by open-telemetry/opentelemetry-rust under OTel 0.32 family.
# Replaces the community fork `opentelemetry-prometheus-text-exporter` we
# carried while the official crate was deprecated (Sep 2025 → May 2026).
# Pairs with the `prometheus = "0.14"` crate's `Registry` + `TextEncoder`
# for the `/metrics` scrape endpoint — see `crates/tileserver-rs/src/metrics/server.rs`.
opentelemetry-prometheus = "0.32.0"
prometheus       = "0.14.0"

# Raster / GDAL (optional)
gdal             = { version = "0.19.0", features = ["bindgen"] }
stac             = { version = "0.17.1", default-features = false }

# PostgreSQL (optional)
deadpool-postgres = "0.14.1"
tokio-postgres   = { version = "0.7.18", features = ["with-serde_json-1"] }
postgres-types   = { version = "0.2.14", features = ["derive"] }
semver           = "1.0.28"
moka             = { version = "0.12.15", features = ["future"] }

# OGC API (optional, used with postgres)
ogcapi-types     = { version = "0.3.0", features = ["features", "common"] }
geojson          = "1.0.0"
cql2             = "0.5.6"

# GeoParquet (optional)
parquet          = { version = "59", default-features = false, features = ["arrow", "zstd", "snap", "lz4", "async"] }
arrow-array      = "59"
arrow-schema     = "59"
arrow-cast       = "59"
# geo 0.33 unblocked May 8 2026 by cql2 0.5.6 (which finally shipped a
# .crate with geo = "0.33.0" — earlier 0.5.4 / 0.5.5 release tags carried
# stale snapshots that still pinned geo ^0.31; see developmentseed/cql2-rs#199).
# Our own code has zero `use geo::…` imports — the workspace dep only
# exists for the (unfinished) `geoparquet` feature and to satisfy
# `mlt-core`'s transitive constraint.
geo              = "0.33"

# DuckDB (optional)
duckdb           = { version = "1.10504.0", features = ["bundled"] }

# FFI
libc             = "0.2"
cc               = "1.2"
cmake            = "0.1"
pkg-config       = "0.3"

# Prebuilt download (build-dependencies for mbgl-sys prebuilt feature)
ureq             = { version = "3", default-features = false, features = ["rustls"] }
tar              = "0.4"

# Dev / test dependencies
tower            = { version = "0.5.3", features = ["util"] }
axum-test        = "21.0.0"
tempfile         = "3.27.0"
insta            = { version = "1.48.0", features = ["json"] }
criterion        = { version = "0.8.2", features = ["html_reports"] }

[workspace.lints.clippy]
correctness = { level = "deny", priority = -1 }
suspicious  = "warn"
style       = "warn"
complexity  = "warn"
perf        = "warn"
undocumented_unsafe_blocks = "warn"

[workspace.lints.rust]

[profile.release]
opt-level = 3
lto = "fat"
codegen-units = 1
panic = "abort"
strip = true

[profile.bench]
inherits = "release"
debug = true
strip = false

[profile.dev.package."*"]
opt-level = 3

# Point gdal + gdal-sys at AlexanderWillner/gdal#fix/gdal-3.13-compat
# (georust/gdal PR #714). GDAL 3.13 renamed `GDT_Byte` to `GDT_UInt8` in the
# C enum and added `bOperateInBufType` to `GDALRasterIOExtraArg`; the gdal
# 0.19.0 crate predates that change and fails to compile against a Homebrew
# libgdal 3.13 install. Drop this patch block once a gdal release (>0.19.0)
# lands containing PR #714. Tracking issue: georust/gdal#715.
[patch.crates-io]
gdal     = { git = "https://github.com/AlexanderWillner/gdal.git", rev = "968cf34a3101ef0aa6e418e779752fa282bc3269" }
gdal-sys = { git = "https://github.com/AlexanderWillner/gdal.git", rev = "968cf34a3101ef0aa6e418e779752fa282bc3269" }