[workspace]
resolver = "2"
members = [
    "crates/shared",
    "crates/executor-core",
    "crates/orchestrator-core",
    "crates/manager-core",
    "crates/picloud",
    "crates/picloud-manager",
    "crates/picloud-orchestrator",
    "crates/picloud-executor",
    "crates/picloud-cli",
]

[workspace.package]
version = "1.1.9"
edition = "2021"
rust-version = "1.92"
license = "MIT OR Apache-2.0"
authors = ["PiCloud contributors"]
repository = "https://github.com/fhamm/picloud"

[workspace.dependencies]
# Internal crates
picloud-shared = { path = "crates/shared" }
picloud-executor-core = { path = "crates/executor-core" }
picloud-orchestrator-core = { path = "crates/orchestrator-core" }
picloud-manager-core = { path = "crates/manager-core" }

# Async + HTTP
tokio = { version = "1.40", features = ["full"] }
# Wraps a broadcast::Receiver into a Stream for the SSE endpoint (v1.1.6).
tokio-stream = { version = "0.1", features = ["sync"] }
axum = "0.8"
tower = "0.5"
tower-http = { version = "0.6", features = ["trace", "cors"] }
hyper = "1"

# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"

# Errors + logging
thiserror = "1"
anyhow = "1"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }

# IDs + time
uuid = { version = "1", features = ["v4", "serde"] }
chrono = { version = "0.4", features = ["serde"] }
# Cron schedule parsing (v1.1.4 cron triggers) + IANA timezone resolution.
chrono-tz = "0.9"
cron = "0.12"

# Async traits + bounded-concurrency stream utilities (queue dispatcher
# uses `for_each_concurrent`).
async-trait = "0.1"
futures = "0.3"

# Rhai scripting. Pinned exactly (`=1.24`) because the `internals`
# feature surface is not semver-stable — future bumps must be deliberate.
rhai = { version = "=1.24", features = ["sync", "serde"] }

# Postgres (manager-core only — others stay DB-free)
sqlx = { version = "0.8", features = ["runtime-tokio-rustls", "postgres", "uuid", "chrono", "json", "macros", "migrate"] }

# Config
figment = { version = "0.10", features = ["toml", "env"] }

# HTTP client (for RemoteExecutorClient later)
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }

# URL parsing (for match-preview admin endpoint)
url = "2"
urlencoding = "2"

# Auth (admin users + sessions + API keys)
argon2 = "0.5"
rand = { version = "0.8", features = ["getrandom"] }
sha2 = "0.10"
# HMAC-SHA256 for realtime subscriber tokens (v1.1.6).
hmac = "0.12"
base64 = "0.22"
data-encoding = "2.6"
# AES-256-GCM at-rest encryption for per-app secrets + the realtime
# signing key (v1.1.7). Audited, pure-Rust RustCrypto AEAD.
aes-gcm = { version = "0.10", features = ["aes", "alloc"] }

# Outbound SMTP email (v1.1.7). Async transport over the Tokio runtime
# with rustls TLS; built messages for text + multipart-alternative.
lettre = { version = "0.11", default-features = false, features = ["smtp-transport", "tokio1-rustls-tls", "builder", "hostname"] }

# Stdlib utility crates (v1.1.0 stdlib PR — registered into the
# Rhai engine as the regex::/random::/etc. namespaces)
regex = "1"
hex = "0.4"
percent-encoding = "2"

# LRU caches (v1.1.3 — top-level script AST cache in orchestrator-core +
# per-module compiled-module cache in executor-core).
lru = "0.12"

[workspace.lints.rust]
unsafe_code = "forbid"

[workspace.lints.clippy]
all = { level = "warn", priority = -1 }
pedantic = { level = "warn", priority = -1 }
module_name_repetitions = "allow"
missing_errors_doc = "allow"
missing_panics_doc = "allow"
doc_markdown = "allow"
# API ergonomics: we deliberately take values by ownership for owned
# inputs (e.g. ExecRequest) and accept Rhai's Box<EvalAltResult> as-is.
needless_pass_by_value = "allow"
boxed_local = "allow"

[profile.release]
lto = "thin"
codegen-units = 1
strip = "symbols"

[profile.dev]
debug = 1
