Cargo.toml

[workspace]
resolver = "2"
members = [
    "crates/runtime",
    "crates/rpc",
    "crates/node",
    # Operator CLI: the `ubi` binary (node|genesis|keys). Thin sugar over the node's UBI2_* env config —
    # it sets env vars from flags/presets and calls `ubi2_node::run()` in-process (zero consensus risk).
    "crates/cli",
    "crates/oracle",
    "crates/network",
    # ZK-Passport PoH verifier (spec 06 / ADR-0005). Deterministic Groth16/BN254, isolated from runtime.
    "crates/zkpoh",
    # Browser light-node WASM wrapper (spec 07 / ADR-0006). The ONLY crate that pulls `wasm-bindgen`;
    # a thin bytes/JSON API over the UNTOUCHED, dependency-free `crates/runtime`.
    "crates/runtime-wasm",
    # Shared block re-execution kernel (spec 07 §2.3 / ADR-0006 Decision 3). The SINGLE ordered-op apply
    # path used by BOTH the full node (crates/rpc) and the WASM light client (crates/runtime-wasm) — no
    # async/networking, wasm32-compilable, so there is no logic fork between the two followers.
    "crates/exec",
]

[workspace.package]
version = "0.0.0"
edition = "2021"
license = "MIT"
authors = ["Democracy Earth Foundation"]
repository = "https://github.com/democracyearth/ubi2"

# Shared dependencies for the M1 devnet: async runtime, JSON-RPC transport (HTTP + WS), and the
# alloy stack for EIP-155 legacy tx RLP decode + secp256k1 signer recovery.
[workspace.dependencies]
tokio = { version = "1", features = ["rt-multi-thread", "macros", "time", "sync", "signal"] }
jsonrpsee = { version = "0.24", features = ["server", "macros"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
anyhow = "1"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
alloy-primitives = { version = "0.8", features = ["k256"] }
alloy-consensus = { version = "0.8", features = ["k256"] }
alloy-eips = "0.8"
alloy-rlp = "0.3"
# M2: ABI encode/decode for the StreamHub calldata (`openStream`/`stopStream`) and the ERC-721 view
# returns. `sol!` derives the 4-byte selectors and `SolCall::abi_decode`/`abi_encode` handle the wire
# layout, so we never hand-roll ABI offsets (spec §"RPC surface", D4).
alloy-sol-types = "0.8"
# M2: base64 for the fully on-chain `tokenURI` data-URI (JSON document + inline SVG image), per D4.
base64 = "0.22"
# Force the `display` feature on derive_more 1.x: alloy-eip7702 0.4.2 (pulled transitively by
# alloy-eips) uses derive_more::Display but doesn't enable the feature itself, so without this the
# build fails under feature unification. Harmless otherwise.
derive_more = { version = "1", features = ["display", "from"] }
# Browser access: the wallet/explorer runs at localhost:3000 and fetches the RPC at 127.0.0.1:8545
# (a cross-origin request), so the server must answer CORS preflights. `tower-http`'s CorsLayer is
# wired into jsonrpsee via `set_http_middleware`. tower 0.4 matches jsonrpsee 0.24's tower.
tower = "0.4"
tower-http = { version = "0.6", features = ["cors"] }
# hyper 1.x: the RPC `serve` uses jsonrpsee's manual accept loop to capture the peer SocketAddr (for the
# localhost-only admin RPC). We name `hyper::body::Incoming` for the request type; jsonrpsee 0.24 already
# pulls hyper 1.x + hyper-util, so this adds no new transitive weight.
hyper = "1"
# M3 (ai-engineer / crates/oracle): the live Claude-backed `HumanityOracle`. `reqwest` (rustls, no
# OpenSSL dep) is the HTTP client for the Anthropic Messages API; the oracle's live path is gated on
# `ANTHROPIC_API_KEY` and is NEVER exercised in tests/CI (I5 — tests replay recorded fixtures). `serde`
# / `serde_json` (already shared above) model the structured-output request/response. `reqwest` carries
# `serde_json` itself but we only `--features json` on the blocking client so no async runtime is pulled
# into the otherwise-sync oracle.
reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
# M5 (crates/network ONLY): the libp2p P2P stack — Noise/TCP/Yamux transport, gossipsub on the two
# ubi2 topics, request-response for block-range sync, and mDNS for the local devnet. Heavyweight tree,
# FULLY ISOLATED in crates/network (ADR-0004 Decision 1); crates/runtime never sees it (asserted by a
# build-level test). `tokio` provides the executor; `futures` the StreamExt the swarm loop polls.
libp2p = { version = "0.56", features = ["tokio", "tcp", "noise", "yamux", "gossipsub", "request-response", "mdns", "ping", "macros", "ed25519", "secp256k1"] }
futures = "0.3"