Cargo.toml

[workspace]
resolver = "2"
members = [
    "crates/core",
    "crates/storage",
    "crates/nsm",
    "crates/server",
]

# Shared deps pinned at the workspace level so every crate uses the same
# versions. Bump in one place. New crate? Add `version.workspace = true`
# in its Cargo.toml.
[workspace.package]
edition = "2021"
rust-version = "1.92"
license = "MIT OR Apache-2.0"
publish = false

[workspace.dependencies]
# ── crypto: RustCrypto ecosystem ─────────────────────────────────────
k256             = { version = "0.13", features = ["ecdsa", "schnorr", "sha256"] }
ed25519-dalek    = { version = "2.1", features = ["rand_core", "zeroize"] }
sha2             = "0.10"
sha3             = "0.10"
hkdf             = "0.12"
hmac             = "0.12"
base64           = "0.22"
rand_core        = { version = "0.6", features = ["getrandom"] }
zeroize          = { version = "1.8", features = ["zeroize_derive"] }

# ── BIP-39 / BIP-32 / Solana ─────────────────────────────────────────
bip39            = { version = "2.1", default-features = false, features = ["std"] }
bip32            = { version = "0.5", features = ["secp256k1"] }
bs58             = "0.5"

# ── Solana (Option C: split crates, NOT the full solana-sdk) ────────
# solana-pubkey gives us the Pubkey type alone (~lightweight). For
# VersionedTransaction decoding/encoding we use solana-transaction +
# solana-message — the post-monorepo-split modular crates that pull
# orders-of-magnitude fewer transitive deps than `solana-sdk`.
solana-pubkey      = { version = "3", default-features = false, features = ["std", "bytemuck", "curve25519"] }
solana-instruction = { version = "3", default-features = false, features = ["std"] }
solana-message     = { version = "3", default-features = false, features = ["bincode"] }
solana-transaction = { version = "3", default-features = false, features = ["bincode", "verify"] }
solana-signature   = { version = "3", default-features = false, features = ["std"] }
solana-hash        = { version = "3", default-features = false, features = ["std"] }
bincode            = "1.3"

# ── Ethereum primitives (lightweight; avoid full ethers-rs / alloy) ──
alloy-primitives = { version = "0.8", features = ["serde"] }
alloy-sol-types  = "0.8"
rlp              = "0.5"

# ── Serialization ────────────────────────────────────────────────────
serde            = { version = "1", features = ["derive"] }
serde_json       = "1"
serde_bytes      = "0.11"
rmp-serde        = "1.3"  # msgpack for Hyperliquid action hashing
hex              = { version = "0.4", features = ["serde"] }

# ── Async / HTTP ─────────────────────────────────────────────────────
tokio            = { version = "1", features = ["full"] }
axum             = { version = "0.7", features = ["macros"] }
tower            = "0.5"
tower-http       = { version = "0.6", features = ["trace", "cors"] }
hyper            = { version = "1", features = ["full"] }
reqwest          = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }

# ── AWS SDK ──────────────────────────────────────────────────────────
aws-config       = { version = "1.5", features = ["behavior-version-latest"] }
aws-sdk-kms      = "1.46"
aws-sdk-s3       = "1.59"
aws-sdk-dynamodb = "1.49"
aws-credential-types     = { version = "1.2", features = ["hardcoded-credentials"] }
aws-smithy-runtime-api   = { version = "1", features = ["client", "http-1x"] }
aws-smithy-http-client   = { version = "1", features = ["default-client"] }
aws-smithy-types         = "1"

# ── Vsock + TLS for the in-enclave vsock-tunneled HTTP client ────────
tokio-vsock      = "0.7"
hyper-util       = { version = "0.1", features = ["client", "client-legacy", "http1", "http2", "tokio"] }
rustls           = { version = "0.23", default-features = false, features = ["std", "ring", "tls12"] }
tokio-rustls     = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
rustls-pki-types = "1.10"
webpki-roots     = "0.26"
tower-service    = "0.3"
http             = "1"
http-body-util   = "0.3"
bytes            = "1.8"
futures-util     = "0.3"
pin-project-lite = "0.2"

# ── Nitro Enclaves ───────────────────────────────────────────────────
# Official NSM API crate from AWS. Pulled from crates.io; the upstream
# repo is github.com/aws/aws-nitro-enclaves-nsm-api.
aws-nitro-enclaves-nsm-api = "0.5.1"

# ── KMS Decrypt-with-Recipient (CMS PKCS#7 EnvelopedData unwrap) ────
# KMS returns the plaintext wrapped in a CMS EnvelopedData blob, RSA-OAEP
# encrypting the CEK to the public key we embed in the attestation doc.
# We need: cms (ASN.1 parsing), rsa (OAEP decrypt), aes+cbc (content
# decrypt). All RustCrypto, all no_std-friendly.
cms             = { version = "0.2", default-features = false, features = ["std"] }
rsa             = { version = "0.9", features = ["sha2"] }
aes             = "0.8"
cbc             = { version = "0.1", features = ["std"] }
cipher          = "0.4"
# AES-256-GCM for per-user session blob encryption (DDB session store).
aes-gcm         = { version = "0.10", features = ["std"] }
pkcs8           = { version = "0.10", features = ["std"] }
spki            = { version = "0.7", features = ["std"] }
const-oid       = "0.9"
der             = { version = "0.7", features = ["std", "oid"] }

# ── Observability ────────────────────────────────────────────────────
tracing             = "0.1"
tracing-subscriber  = { version = "0.3", features = ["env-filter", "json"] }

# ── Error handling ───────────────────────────────────────────────────
thiserror = "1"
anyhow    = "1"

# ── Misc ─────────────────────────────────────────────────────────────
once_cell = "1.20"
async-trait = "0.1"

# ── Test deps ────────────────────────────────────────────────────────
proptest = "1.5"

# Reproducibility: trim debug info paths, deterministic output. Nix flake
# will set SOURCE_DATE_EPOCH + RUSTFLAGS for the production build; these
# profile settings are the in-repo baseline.
[profile.release]
opt-level     = 3
lto           = "fat"
codegen-units = 1
panic         = "abort"
strip         = "symbols"
overflow-checks = true