Cargo.toml

[workspace]
resolver = "2"
members = [
    "crates/crypto",
    "crates/wallet-core",
    "crates/evm-core",
    "crates/chain",
    "crates/store",
    "crates/webhooks",
    "crates/email",
    "crates/ingest",
    "crates/api",
    "crates/resilience",
    "crates/chain",
    "bin/server",
    "bin/migrate-keys",
    "bin/backfill-operation-index",
]

[workspace.package]
version = "0.1.0"
edition = "2021"
rust-version = "1.84"
license = "MIT"
repository = "https://github.com/octo/octo"
authors = ["octo contributors"]

# Shared, version-pinned dependencies (locked in Step 1 of the plan).
# Crates opt in with `foo = { workspace = true }`.
[workspace.dependencies]
# --- Stellar / crypto ---
stellar-strkey = "0.0.16"
stellar-base = "0.7.0"
slip10_ed25519 = "0.1.3"
tiny-bip39 = "2.0.0"
ed25519-dalek = "2.2.0"
aes-gcm = "0.10.3"
# --- EVM / secp256k1 (see docs/architecture.md ADR: narrow primitives over alloy, MSRV 1.84.1) ---
k256 = "0.13"
sha3 = "0.10"
zeroize = { version = "1.8.2", features = ["derive"] }
hmac = "0.12.1"
hkdf = "0.12.4"
sha2 = "0.10.9"
hex = "0.4.3"
base64 = "0.22"
argon2 = "0.5"
# --- EVM / secp256k1 ---
# k256 gives us constant-time scalar/point arithmetic and ECDSA (incl. recoverable signing +
# low-s normalisation) for BIP-32 derivation and transaction signing. sha3 gives Keccak-256 for
# EIP-55 addressing. subtle gives explicit constant-time comparisons for secret scalars. See the
# ADR in docs/architecture.md for why this is preferred over alloy-primitives / coins-bip32.
k256 = { version = "0.13", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
sha3 = "0.10"
subtle = "2.6"
# Test-only: decodes the official BIP-32 spec's base58check xprv test vectors in
# crates/evm-core/src/derive.rs so the expected bytes come from the spec text, not transcription.
bs58 = { version = "0.5", features = ["check"] }
# Note: the MSRV-aware resolver (.cargo/config.toml: incompatible-rust-versions = "fallback")
# keeps the whole tree on Rust-1.84-compatible versions, so no manual transitive pins are needed.
# --- EVM / JSON-RPC ---
# ethnum::U256 is the quantity type for crates/evm-rpc's JSON-RPC hex fields (block numbers,
# balances, gas, nonces, ...) — never u64/f64, which silently truncate/lose-precision on-chain
# values above 2^64. It was already present transitively (a proptest dependency) and is a single
# small, permissively-licensed crate, in keeping with "don't pull in a full EVM SDK for this".
ethnum = "1.5"
# Lets crates/evm-rpc enforce a hard response-body size cap while streaming a JSON-RPC reply, so a
# malicious/compromised RPC endpoint returning a multi-GB body can't OOM the worker.
futures-util = "0.3"

# --- async runtime / web ---
tokio = { version = "1", features = ["full"] }
axum = "0.7"
tower = "0.5"
tower-http = { version = "0.6", features = ["trace", "cors", "limit"] }
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream"] }

# --- persistence ---
sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "tls-rustls", "postgres", "macros", "uuid", "chrono", "json", "migrate", "bigdecimal"] }
# Arbitrary-precision unsigned integer (U256) for on-chain amounts. See crates/chain/src/amount.rs
# for why `primitive-types` was chosen over `alloy-primitives`/`ruint`.
primitive-types = { version = "0.13", default-features = false, features = ["std", "serde"] }
# Matches the version sqlx's `bigdecimal` feature pulls in, so there's one copy in the tree.
bigdecimal = { version = "0.4", features = ["serde"] }

# --- serde / utility ---
serde = { version = "1", features = ["derive"] }
serde_json = "1"
toml = "0.8"
uuid = { version = "1", features = ["v4", "serde"] }
chrono = { version = "0.4", features = ["serde"] }
thiserror = "1"
anyhow = "1"
async-trait = "0.1"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
rand = "0.8"
proptest = "1"

# --- internal crates ---
octo-crypto = { path = "crates/crypto" }
octo-wallet-core = { path = "crates/wallet-core" }
octo-evm-core = { path = "crates/evm-core" }
octo-chain = { path = "crates/chain" }
octo-store = { path = "crates/store" }
octo-webhooks = { path = "crates/webhooks" }
octo-email = { path = "crates/email" }
octo-ingest = { path = "crates/ingest" }
octo-api = { path = "crates/api" }
octo-resilience = { path = "crates/resilience" }
octo-chain = { path = "crates/chain" }

[profile.release]
lto = "thin"
codegen-units = 1
strip = true