# The workspace spans the Rust services under services/, and the libraries
# they share under crates/. One binary today; M5 adds the proxy. Crate names
# are prefixed (headquarters-*) so a binary's name is unambiguous outside this
# repo.
[workspace]
resolver = "3"
members = ["services/api", "crates/mms"]

[workspace.package]
version = "0.1.0"
edition = "2024"
publish = false

[workspace.dependencies]
axum = "0.8"
tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "signal"] }
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tower = { version = "0.5", features = ["util"] }

# ATProto. 0.x and churning, so pinned exactly and confined to the atproto
# module (plan/complete/sign-in.md). jose-jwk is the key type atrium-oauth uses but does not
# re-export; it must stay on the version atrium-oauth pins.
#
# atrium-oauth's default `default-client` feature means reqwest with
# native-tls, which means a system OpenSSL. Off, and the atproto module
# supplies its own reqwest client on rustls instead; atrium-xrpc is the
# HttpClient trait that shim implements.
atrium-oauth = { version = "=0.1.7", default-features = false }
atrium-identity = { version = "=0.1.9", features = ["doh-handle-resolver"] }
atrium-api = { version = "=0.25.8", default-features = false }
atrium-common = "=0.1.4"
atrium-xrpc = "=0.12.4"
jose-jwk = { version = "=0.1.2", default-features = false, features = ["p256"] }
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "gzip"] }

# bundled: the build compiles its own libsqlite3, so the rust:1 image needs
# no system package.
rusqlite = { version = "0.40", features = ["bundled"] }

tower-http = { version = "0.6", features = ["cors"] }
axum-extra = { version = "0.10", features = ["cookie"] }
# The same cookie crate axum-extra uses; direct only for time::Duration on
# Max-Age.
cookie = "0.18"

# Decoding and re-encoding a camo PNG. Pure Rust, no system library.
png = "0.18"
# The other half of decoding an avatar. A PDS hands back whatever the account
# uploaded, and what a Bluesky client uploads is JPEG, so a card drawn from
# PNG alone would have a hole in it for most accounts. image-rs's decoder,
# pure Rust like the rest of this, and decode-only.
jpeg-decoder = { version = "0.3", default-features = false }
# Glyph outlines for the social card the API draws. Pure Rust, no system
# fonts and no C: the faces it rasterises are the two in
# services/api/assets/fonts, vendored beside their licences.
ab_glyph = "0.2"

hmac = "0.12"
sha2 = "0.10"
base64 = "0.22"
rand = "0.8"

serde = { version = "1", features = ["derive"] }
serde_json = "1"

# Raw-splice reverse proxy to match tasks.
hyper = { version = "1", features = ["client", "http1"] }
hyper-util = { version = "0.1", features = ["tokio"] }

# Match launching. rustls-based like everything else; confined to the
# matches module the way atrium is confined to atproto.
aws-config = { version = "1", default-features = false, features = ["behavior-version-latest", "rustls", "rt-tokio"] }
aws-sdk-s3 = { version = "1", default-features = false, features = ["rustls", "rt-tokio"] }
aws-sdk-ecs = { version = "1", default-features = false, features = ["rustls", "rt-tokio"] }
uuid = { version = "1", features = ["v4"] }

tempfile = "3"
http-body-util = "0.1"