Cargo.toml

[package]
name = "webcodex"
version = "0.2.0"
license = "Apache-2.0"
edition = "2021"

[dependencies]
salvo = { version = "0.93", features = ["oapi", "cors", "affix-state", "websocket", "timeout"] }
tokio = { version = "1", features = ["full"] }
tokio-tungstenite = { version = "0.29", features = ["connect", "rustls-tls-webpki-roots"] }
futures-util = "0.3"
rusqlite = { version = "0.32", features = ["bundled"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
serde_urlencoded = "0.7"
uuid = { version = "1", features = ["v4"] }
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
chrono = { version = "0.4", features = ["serde"] }
anyhow = "1"
toml = "0.8"
base64 = "0.22"
reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
url = "2"
sha2 = "0.10"
# Custom QUIC agent transport. Quinn reuses the
# rustls 0.23 + aws-lc-rs provider already present transitively (via
# tokio-tungstenite / salvo). `rustls-pemfile` loads PEM cert/key on the
# server. Versions are pinned to the 0.11 / 0.23 / 2.x lines already
# resolved in Cargo.lock to avoid introducing a second rustls major.
quinn = "0.11"
rustls = "0.23"
rustls-pemfile = "2"
# Mozilla root store for the agent's QUIC client cert verification. Reuses the
# 0.26 line already pulled transitively by tokio-tungstenite's
# `rustls-tls-webpki-roots` feature, so it does not add a new major version.
webpki-roots = "0.26"

# Unix process-group reap for synchronous local commands (`run_command_sync`).
# A direct `kill(-pgid, SIGKILL)` reliably reaps background grandchildren that
# inherit the stdout/stderr pipes — otherwise `wait_with_output` blocks on pipe
# EOF forever — without spawning a `kill` process on every local command.
# Already present transitively; pinned to the resolved 0.2 line.
[target.'cfg(unix)'.dependencies]
libc = "0.2"

# Release binaries ship via the npm wrapper; optimize for size without
# changing runtime behavior (panic unwinding stays enabled).
[profile.release]
strip = "symbols"
lto = "thin"
codegen-units = 1

[dev-dependencies]
tempfile = "3"
urlencoding = "2"
salvo = { version = "0.93", features = ["test"] }
# Self-signed cert generation for QUIC integration tests. Uses the `ring`
# provider that is already in the dependency tree (via quinn-proto), so it
# does not pull a new crypto backend.
rcgen = "0.13"