Cargo.toml

[workspace]
resolver = "2"
members = ["sendra-core", "sendra-cli", "sendra-tui", "xtask"]

[workspace.package]
version = "0.1.0"
edition = "2021"
license = "MIT"
homepage = "https://github.com/sendra-lab/Sendra"

[workspace.dependencies]
serde = { version = "1", features = ["derive"] }
serde_json = "1"
dirs = "6"
tempfile = "3"
serde_yaml = "0.9"
jsonpath-rust = "1"
# `assertions.body_matches`. Already pulled in transitively by jsonpath-rust,
# so this adds no new dependency to the tree — see the note on
# `assertions::Assertions::body_matches`.
regex = "1"
serde_urlencoded = "0.7"
reqwest = { version = "0.12", default-features = false, features = [
  "rustls-tls",
  "http2",
  "gzip",
  "brotli",
  "deflate",
  "cookies",
] }
thiserror = "2"
# `auth.basic` base64-encodes `user:pass` into the `Authorization` header.
base64 = "0.22"
tokio = { version = "1", default-features = false }
clap = { version = "4", features = ["derive"] }
owo-colors = { version = "4", features = ["supports-colors"] }
# "no_module" is a sandboxing decision, not a size one: it removes Rhai's
# module system, and with it `import` and the filesystem-backed module
# resolver that is otherwise the default. See the note on `script::engine`.
rhai = { version = "1.26", features = ["no_module"] }
# Test-only: used to build gzip-compressed fixture bodies for the compression
# test in sendra-core. Already pulled in transitively by reqwest's "gzip"
# feature, so this adds no new dependency to the tree.
flate2 = "1"
# Test-only: verifies `--junit`'s hand-rolled XML actually parses under a
# real parser, not just under the eyes of whoever wrote the escaping. Small,
# pure-Rust, no transitive dependencies of its own — chosen over pulling in
# an XML writer for production use, since the report itself needs nothing
# more than string formatting and five characters of escaping.
roxmltree = "0.21"
# Test-only: generates a throwaway self-signed certificate so `--insecure`'s
# tests can run a real TLS handshake against an endpoint with no trusted CA
# behind it, rather than only unit-testing the `ClientBuilder` call. Pinned to
# the `rustls-pki-types` version already in the tree via reqwest's
# `rustls-tls` feature, so this adds a small pure-Rust crate rather than a
# second, incompatible copy of the certificate types.
rcgen = "0.13"
# Test-only, alongside `rcgen`: terminates the TLS handshake the self-signed
# cert above is used in. `default-features = false` + explicit `ring` matches
# the backend reqwest's own `rustls-tls` feature already resolves to in this
# workspace (see `Cargo.lock`) — picking the same backend rather than pulling
# in `aws-lc-rs`, a second TLS crypto implementation with its own build-time
# C/cmake requirement, just for a test.
rustls = { version = "0.23", default-features = false, features = [
  "ring",
  "std",
] }
# `hmac_sha256()`, registered into the script engine — the one HMAC algorithm
# it exposes. RustCrypto crates: the same org and API family `sha2` below
# comes from, widely depended on across the ecosystem (rustls, and most Rust
# crypto users, sit on one RustCrypto crate or another) and actively
# maintained.
hmac = "0.13"
# `hmac_sha256()`'s hash function. See the note on `hmac` above.
sha2 = "0.11"
# `uuid()`, registered into the script engine. The de facto standard Rust UUID
# crate — actively maintained, and its `v4` feature pulls in only `getrandom`
# (a thin, widely-used syscall wrapper for the OS's own CSPRNG), not a general
# `rand` dependency this workspace has no other use for.
uuid = { version = "1", features = ["v4"] }
# Generates the editor-tooling JSON Schemas under `schema/` from the actual
# request/collection/config types, behind sendra-core's `schema` feature — see
# the note on that feature and on the `xtask` crate for why this stays out of
# sendra-core's default dependency footprint.
schemars = "1"

# The profile that 'dist' will build with
[profile.dist]
inherits = "release"
lto = "thin"