Cargo.toml

[workspace]
resolver = "2"
members = [
    "crates/calm-core",
    "crates/calm-server",
    "crates/calm-cli",
]

[workspace.package]
# NOTE: bump this at the same time as (or just before) cutting a new `vX.Y.Z`
# git tag. `.github/workflows/release.yml` also `sed`-stamps this field from
# the tag inside the CI runner before building release binaries — but that
# stamp only affects the ephemeral build checkout, never gets committed back
# here. If this drifts behind the latest tag (as it did, stuck at 0.1.1
# through v0.1.2/v0.1.3/v0.1.4), `scripts/mcp-launcher.sh`'s Tier 2 falls
# back to building from source on every single run: it compares this file's
# version against the downloaded release binary's real `--version` output
# and treats any mismatch as a corrupted/wrong download, so a stale value
# here silently defeats the verified-download fast path for everyone.
version = "0.8.0"
edition = "2024"
license = "MIT"
rust-version = "1.85"

[workspace.dependencies]
# Core
rusqlite = { version = "0.34", features = ["bundled", "vtab"] }
tree-sitter = "0.24"
tree-sitter-python = "0.23"
tree-sitter-typescript = "0.23"
tree-sitter-javascript = "0.23"
tree-sitter-java = "0.23"
tree-sitter-rust = "0.23"
tree-sitter-go = "0.23"
# Tier-0.5 optional language grammars (accurate AST extraction, opt-in via feature flags).
# Note: optionality is declared in each crate's Cargo.toml, not here.
#
# Pinned to an EXACT version (`=x.y.z`), not a caret range, for these: a
# tree-sitter grammar crate's internal "language version" (ABI) can jump
# even between patch releases within the same caret-compatible range (this
# workspace's `tree-sitter` core is 0.24.7, supporting ABI 13-14) —
# tree-sitter-c-sharp 0.23.1 is ABI-compatible but 0.23.5 (still "^0.23") is
# already ABI 15 and fails `set_language` at runtime. That failure is
# swallowed silently by `parse_tree()`'s `.ok()?`, so a plain `cargo update`
# picking a newer compatible-looking patch can silently regress an entire
# language back to the much weaker Tier-0.5 shallow line-scan fallback (see
# indexer/parser.rs's `test_tier0_5_grammar_loads_*` tests, which catch this
# — do not loosen these pins without confirming those tests still pass).
tree-sitter-c = "=0.23.4"
tree-sitter-cpp = "=0.23.4"
tree-sitter-ruby = "=0.23.1"
tree-sitter-php = "=0.23.11"
tree-sitter-c-sharp = "=0.23.1"
tree-sitter-bash = "=0.23.3"
# tree-sitter-r 1.3.0 (r-lib/tree-sitter-r) targets tree-sitter core ^0.24.7
# via the modern tree-sitter-language shim (same pattern as the Tier-0
# grammars above) — verified ABI-compatible with this workspace's 0.24.7.
tree-sitter-r = "=1.3.0"
# kotlin/swift (2026-07-10 plan, docs/superskills/plans/2026-07-10-25-language-expansion.md):
# no tree-sitter-kotlin/tree-sitter-swift dependency had EVER been declared here
# before this — the old comment claiming "incompatible older tree-sitter API
# versions" described an absence, not a broken dependency. Both crates below
# depend on `tree-sitter` as a dev-dependency only (verified via crates.io
# dependency API 2026-07-10) and on the ABI-stable `tree-sitter-language`
# shim as their real dependency, same pattern as tree-sitter-r above.
tree-sitter-kotlin-ng = "=1.1.0"
# NOT the latest (0.7.3): confirmed by downloading and inspecting each
# version's vendored src/parser.c directly (`grep LANGUAGE_VERSION`) —
# tree-sitter-swift jumped from ABI 14 (<=0.7.0) to ABI 15 (>=0.7.1,
# 2025-06-23) when its grammar was regenerated with a newer tree-sitter-cli.
# ABI 15 exceeds this workspace's runtime (0.24.7, ABI 13-14 only) and fails
# `set_language()` — reproduced directly (not assumed) via a temporary
# AST-dump test. 0.7.0 is the newest version still on ABI 14; same Rust API
# shape (`LANGUAGE` const) as 0.7.3, confirmed by diffing bindings/rust/lib.rs.
tree-sitter-swift = "=0.7.0"
# Phase C (2026-07-11, docs/superskills/plans/2026-07-10-25-language-expansion.md):
# same ABI-cliff pattern as swift/csharp above, verified the same way (grep
# generated src/parser.c's LANGUAGE_VERSION at each GitHub release tag, not
# trusted from the version number alone). tree-sitter-scala 0.24.1 is ABI 14
# (compatible); 0.25.0 (2026-xx) regenerated with a newer tree-sitter-cli and
# jumped straight to ABI 15 (incompatible with this workspace's 0.24.7
# runtime). 0.24.1, not 0.24.0, is the newest ABI-14 release. Real dependency
# (crates.io dependency API, not assumed) is `tree-sitter-language ^0.1`
# (normal) — `tree-sitter` itself is only a dev-dependency there, so it
# doesn't propagate to us.
tree-sitter-scala = "=0.24.1"
# Phase C (2026-07-11): tree-sitter-dart has no git tags on its source repo
# (github.com/ast-grep/tree-sitter-dart) — verified ABI by downloading each
# published .crate tarball directly from static.crates.io and grepping the
# vendored src/parser.c. 0.0.4 is the newest ABI-14 release; 0.1.0/0.2.0 jumped
# to ABI 15. Unlike every other Tier-0.5 grammar in this file, 0.0.4's real
# dependency (checked its own Cargo.toml.orig, not crates.io's dependency API
# which only reports the LATEST version's shape) is a direct, unbounded
# `tree-sitter = ">=0.20.8"` — no tree-sitter-language shim, predates that
# pattern. Also uses the OLD binding API: a bare `tree_sitter_dart::language()
# -> Language` function, not the modern `LANGUAGE: LanguageFn` const + 
# `.into()` every other grammar here uses — see lang_constants.rs's ts_lang_dart.
tree-sitter-dart = "=0.0.4"
# Phase C (2026-07-11): same ABI-cliff pattern as scala/dart above, verified
# the same way (downloaded each published .crate tarball, grepped
# src/parser.c). 0.2.0 is the newest ABI-14 release; 0.4.1/0.5.0 jumped to
# ABI 15. Real dependency (its own Cargo.toml, not crates.io's dependency
# API) is the modern `tree-sitter-language = "0.1.0"` shim, same pattern as
# kotlin-ng/scala.
tree-sitter-lua = "=0.2.0"
# Phase C (2026-07-11): unlike every other Tier-0.5 grammar pinned in this
# file, tree-sitter-elixir's LATEST published version (0.3.5) is already
# ABI 14 — no cliff to pin below. Still pinned EXACT per this file's policy
# (verified via downloaded .crate tarball + src/parser.c grep, not assumed).
# Real dependency is the modern `tree-sitter-language = "0.1.0"` shim.
tree-sitter-elixir = "=0.3.5"
# Phase C (2026-07-11): like elixir, the LATEST published version (0.23.1,
# unchanged since Nov 2024) is already ABI 14 — no cliff to pin below. Still
# pinned EXACT per this file's policy. Real dependency is the modern
# `tree-sitter-language = "0.1"` shim.
tree-sitter-haskell = "=0.23.1"
# Phase C (2026-07-11): same ABI-cliff pattern as scala/dart/lua above,
# verified the same way. This crate bundles 3 separate grammars (ocaml,
# ocaml_interface for .mli, ocaml_type) — the pinned ABI check was run
# against grammars/ocaml/src/parser.c specifically, the one this workspace
# actually uses (see lang_constants.rs's ts_lang_ocaml, LANGUAGE_OCAML).
# 0.24.2 is the newest ABI-14 release; 0.25.0 jumped to ABI 15. Real
# dependency is the modern `tree-sitter-language = "0.1"` shim.
tree-sitter-ocaml = "=0.24.2"
# Phase C (2026-07-11): like elixir/haskell, the latest published version
# (1.1.2, unchanged since Dec 2024) is already ABI 14 — no cliff to pin
# below. Real dependency is the modern `tree-sitter-language = "0.1"` shim.
tree-sitter-zig = "=1.1.2"
# Phase C (2026-07-11): same ABI-cliff pattern, verified the same way
# (downloaded each published .crate tarball, grepped src/parser.c). 0.25.9
# is the newest ABI-14 release; 0.25.10 jumped to ABI 15 (a within-0.25.x
# cliff, not just at a 0.26.0 minor bump — confirms the plan's warning that
# version-number heuristics alone aren't reliable). Real dependency is the
# modern `tree-sitter-language = "0.1"` shim.
tree-sitter-powershell = "=0.25.9"
# Phase C (2026-07-11, final language): only one version has ever been
# published (0.1.2) — verified ABI 14 directly (downloaded the .crate
# tarball, grepped src/parser.c), not trusted from the original planning
# session's memory note. Still pinned EXACT per this file's policy in case a
# future 0.1.3 jumps ABI. Real dependency is the modern
# `tree-sitter-language = "0.1"` shim. This is the crate that replaced Perl
# in the original 25-language list (Perl needed a tree-sitter runtime bump
# incompatible with tree-sitter-stack-graphs — see §1.4 of the plan doc).
tree-sitter-groovy = "=0.1.2"
# Stack Graphs (formal name resolution)
stack-graphs = "0.14"
tree-sitter-stack-graphs = "0.10"
tree-sitter-stack-graphs-python = "0.3"
# =0.23.2 pin (tree-sitter-typescript) comes from this crate's own Cargo.toml —
# already the exact version tree-sitter-typescript resolves to workspace-wide.
tree-sitter-stack-graphs-typescript = "0.4"
tree-sitter-stack-graphs-java = "0.5"
# JS gap (P1.1): stack-graphs itself is archived upstream (2025-09-09, no new
# fixes) — this is a stopgap while `ci` still leans on it at all, not a
# long-term bet; the real exit is scip-typescript (8-language plan P3.2).
tree-sitter-stack-graphs-javascript = "0.3"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
toml = "0.8"
regex = "1"
# SQL indexer (8-language plan P3.3) — the crates.io name for the
# `apache/datafusion-sqlparser-rs` project the plan names by its GitHub repo.
sqlparser = "0.62"
ignore = "0.4"
globset = "0.4"
thiserror = "2"
anyhow = "1"
tokio = { version = "1", features = ["full"] }
tokio-util = "0.7"
notify = "6.1"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
# rmcp 3.x = MCP 2026-07-28 spec support (docs/plans/2026-08-04-mcp-2026-07-28-upgrade-plan.md,
# Phase 1). Live-verified in a scratch spike (rmcp 3.1.0 + axum 0.8 + schemars 1 + the
# `transport-streamable-http-server` feature): `cargo tree -d` shows exactly one `rmcp` and one
# `axum` node (no OTEL-style split-core repeat of Dependabot PR #46). `transport-streamable-http-server`
# lives in crates/calm-server/Cargo.toml's `http` feature, same as before.
#
# `request-state` (Phase 2, added 2026-08-04): gates `rmcp::model::RequestStateCodec`, used to
# HMAC-seal the SEP-2322 MRTR `requestState` for the hub-edit human-veto gate
# (crates/calm-server/src/tools/edit.rs). Pulls in `hmac 0.13`/`sha2 0.11` as NEW transitive deps,
# distinct majors from this workspace's own `hmac 0.12`/`sha2 0.10` pins below -- unlike the
# OTEL two-cores bug this isn't a problem: `RequestStateCodec` is self-contained (key bytes in,
# sealed string out), CALM's code never constructs an `Hmac`/`Sha2` value itself, and neither
# crate carries global mutable state across versions the way `opentelemetry`'s SDK singleton does.
rmcp = { version = "3", features = ["server", "transport-io", "macros", "elicitation", "schemars", "request-state"] }
schemars = "1"
clap = { version = "4", features = ["derive"] }
rayon = "1"
# Plan 3 §3.5(d): HMAC integrity for `project_memory` — `hash_content`
# (indexer/pipeline.rs) is unkeyed FNV-1a, chosen for cheap non-adversarial
# cache invalidation, not a MAC; genuinely new deps needed here since
# neither a cryptographic hash nor a CSPRNG (memory-key generation) was
# already in this workspace's own Cargo.toml before now (checked
# Cargo.lock: sha2/hmac absent entirely; rand/getrandom present only as
# transitive deps of other crates, never depended on directly).
hmac = "0.12"
sha2 = "0.10"
rand = "0.9"

# Phase 2 (docs/superskills/plans/2026-07-28-otel-http-dynamic-toolsets.md):
# optional OpenTelemetry span export, behind the `otel` feature (declared
# `optional = true` in crates/calm-cli/Cargo.toml's [dependencies], NOT
# here -- cargo rejects `optional` on a [workspace.dependencies] entry:
# "workspace dependencies cannot be optional", confirmed live 2026-07-28).
# Pinned to the aligned 0.32 line for opentelemetry/_sdk/-otlp +
# tracing-opentelemetry 0.33 -- re-verified 2026-07-28 against crates.io's
# sparse index dependency manifests (NOT just trusted from the design doc)
# to resolve to a SINGLE opentelemetry core. tracing-opentelemetry's own
# versioning is offset by one from the core: its 0.32.x line still requires
# `opentelemetry ^0.31` internally, while 0.33.0 is the first release that
# requires `opentelemetry ^0.32` / `opentelemetry-otlp ^0.32` /
# `opentelemetry_sdk ^0.32` -- pairing core-0.32 with tracing-opentelemetry-
# 0.32 (instead of 0.33) silently reintroduces two coexisting cores. This
# was the root cause of a Dependabot PR (#46) that bumped only
# `opentelemetry_sdk` to 0.32.1 and broke the build. Re-verify with
# `cargo tree -p opentelemetry` (expect exactly one resolved line) before
# ever bumping these.
opentelemetry = { version = "0.32" }
opentelemetry_sdk = { version = "0.32", features = ["rt-tokio"] }
# default-features = false + http-proto avoids opening a grpc-tonic
# transport at RUNTIME (this exporter POSTs spans over reqwest/HTTP) -- but
# tonic/tonic-prost still compile in as transitive deps of
# opentelemetry-proto regardless of this feature selection (its 0.32.0
# Cargo.toml doesn't gate them out of the dependency graph, only out of
# opentelemetry-otlp's own default feature set). This trims runtime
# behavior and enabled-by-default features, not full compile-time weight.
opentelemetry-otlp = { version = "0.32", default-features = false, features = ["http-proto", "reqwest-client"] }
tracing-opentelemetry = { version = "0.33" }

# Phase 3 (same plan): optional Streamable-HTTP transport, behind the
# `http` feature (crates/calm-server/Cargo.toml: rmcp/transport-streamable-
# http-server). axum is NOT an rmcp dependency -- StreamableHttpService only
# implements tower_service::Service, the caller brings its own HTTP server
# -- and wasn't already in this workspace's tree (checked Cargo.lock:
# absent before this). Live-verified 2026-07-28 in a scratch probe: axum
# 0.8 + rmcp 2.2.0 (transport-streamable-http-server) resolve and build
# clean together (both on http 1.x / tower-service 0.3.x).
axum = "0.8"
# Same `http` feature as axum above -- already present transitively in
# Cargo.lock (pulled in by axum/hyper's own stack) at this exact version, so
# declaring it directly adds no new supply-chain surface. `limit` is the
# only feature enabled: `ConcurrencyLimitLayer`, used for basic HTTP-
# transport DoS hardening (docs/http-transport.md already documents this
# transport has no built-in protection -- see serve_http's doc comment for
# what this closes and what it deliberately doesn't).
tower = { version = "0.5", default-features = false, features = ["limit"] }

# Internal
calm-core = { path = "crates/calm-core" }
calm-server = { path = "crates/calm-server" }

[profile.release]
lto = true
codegen-units = 1
strip = true