Cargo.toml

[workspace]
resolver = "2"
members = ["crates/aauth-core", "crates/apd"]

[workspace.package]
version = "0.1.0"
edition = "2021"
license = "MIT OR Apache-2.0"
rust-version = "1.85"
repository = "https://example.invalid/agentprovider"

[workspace.dependencies]
serde = { version = "1", features = ["derive"] }
serde_json = "1"
ed25519-dalek = { version = "2", default-features = false, features = ["std", "fast", "zeroize"] }
sha2 = "0.10"
getrandom = "0.3"
tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "time", "sync", "signal", "io-util", "fs"] }
hyper = { version = "1", features = ["http1", "server", "client"] }
hyper-util = { version = "0.1", features = ["tokio"] }
http-body-util = "0.1"
rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
webpki-roots = "0.26"
# Already in the tree via rustls; referenced directly for federated enrollment
# (RS256/ES256 assertion verification and X.509 chain validation).
ring = "0.17"
rustls-webpki = { version = "0.103", default-features = false, features = ["ring", "std"] }
rustls-pki-types = "1"
# OpenTelemetry (metrics + traces) exported over OTLP/HTTP. This is the one
# heavyweight dependency the project takes on deliberately, for standards-based
# observability; the exporter uses reqwest with rustls to reuse our TLS posture.
opentelemetry = "0.32"
opentelemetry_sdk = { version = "0.32", features = ["rt-tokio", "trace", "metrics"] }
# Blocking reqwest client so the thread-based batch/periodic exporters need no
# ambient tokio runtime (an async client would panic under them).
opentelemetry-otlp = { version = "0.32", default-features = false, features = ["trace", "metrics", "http-proto", "reqwest-blocking-client", "reqwest-rustls"] }

[profile.release]
lto = "thin"
codegen-units = 1
panic = "abort"