Cargo.toml

# Deckard — virtual Cargo workspace.
#
# The root carries NO `[package]`; every crate lives under `crates/`:
#   - deckard-app      the GPUI desktop app (binary `deckard`)
#   - deckard-core     the headless engine (Ethereum provider, balances, keystore)
#   - deckard-contract the frozen wire contract (Intent / Decision / Policy / RPC)
#   - deckard-signerd  the process-isolated signer daemon (owns the key; UDS server)
#   - deckard-wallet-client shared key-less client primitives for local interfaces
#   - deckard-mcp      the key-less agent surface (one binary: CLI + `--mcp` stdio server)
#   - deckard-browser-bridge the key-less dapp/browser interface
#
# `cargo run` from the repo root still launches the app via `default-members`.
[workspace]
resolver = "2"
members = [
    "crates/deckard-app",
    "crates/deckard-core",
    "crates/deckard-contract",
    "crates/deckard-signerd",
    "crates/deckard-wallet-client",
    "crates/deckard-mcp",
    "crates/deckard-browser-bridge",
]
default-members = ["crates/deckard-app"]

# Lint policy lives in the manifest (not just CI flags) so rust-analyzer and `cargo check` surface
# the exact same rules CI enforces. Every member opts in via `[lints] workspace = true`.
# Rationale + the deliberately-rejected lints: docs/AGENTIC-ENGINEERING.md §1.
[workspace.lints.rust]
unused_must_use = "deny" # an ignored Result from a fallible crypto/IO call is a silent bug
unsafe_code = "deny"     # deny (not forbid): leaves a reviewed escape hatch if objc2 ever needs raw unsafe

[workspace.lints.clippy]
all = { level = "warn", priority = -1 } # priority = -1 is required on a lint *group*
todo = "deny"                           # a stray todo!() left on a code path panics in production
dbg_macro = "deny"                      # debug noise — and dbg!(seed) is a key leak

[workspace.dependencies]
# Single-sourced versions shared across crates. deckard-contract pins to these;
# the app and core may layer extra features on top (e.g. alloy-primitives `serde`).
alloy-primitives = "1.6.0"
serde = { version = "1", features = ["derive"] }

# Profiles are only honoured at the workspace root, so they live here (not in the
# app crate). These shrink the release binary: strip symbols, thin-LTO, one codegen unit.
[profile.release]
strip = true
lto = "thin"
codegen-units = 1

# Mirror Helios's + Kohaku/Railgun's workspace patches. `[patch]` only resolves at the
# workspace ROOT and does NOT inherit through a git dependency, so every patched git-dep
# (helios-ethereum behind `verified-reads`; the ZK `railgun` tree behind deckard-core's
# `shield` feature) needs its patches here or those crates fail to build.
#   - ethereum_hashing: Helios consensus crates (verified-reads).
#   - ruint + ark-circom: MANDATORY for the Railgun ZK tree (merkle tree / circom-compat) —
#     copied from the proven shield spike. With `shield` off these resolve but pull nothing
#     extra into the build.
[patch.crates-io]
ethereum_hashing = { git = "https://github.com/ncitron/ethereum_hashing", rev = "7ee70944ed4fabe301551da8c447e4f4ae5e6c35" }
ruint = { git = "https://github.com/Robert-MacWha/ruint" }
ark-circom = { git = "https://github.com/Robert-MacWha/circom-compat", branch = "release/0.6.0" }

# Redirect Kohaku's own `eip-1193-provider` to a native-only fork (vendor/) that DROPS the
# wasm32-only `js` feature. Upstream's `js` default pins `wasm-bindgen = "=0.2.108"`, which
# collides head-on with the GPUI app's `web-sys`→`wasm-bindgen = "=0.2.122"` exact pin — two
# exact pins can't coexist in one workspace. Deckard never builds wasm32, so the fork removes
# `js` (and only `js`); the native API railgun uses is byte-identical. See
# vendor/eip-1193-provider/Cargo.toml for the full rationale. This is what lets the heavy
# `railgun` shield tree live in the app workspace behind the default-on `shield` feature.
[patch."https://github.com/ethereum/kohaku"]
eip-1193-provider = { path = "vendor/eip-1193-provider" }