Cargo.toml

[workspace]
members = [
    "crates/nexum-cli",
    "crates/nexum-runtime",
    "crates/nexum-sdk",
    "crates/nexum-sdk-test",
    "crates/shepherd-backtest",
    "crates/shepherd-cow-host",
    "crates/shepherd-sdk",
    "crates/shepherd-sdk-test",
    "modules/ethflow-watcher",
    "modules/example",
    "modules/examples/balance-tracker",
    "modules/examples/http-probe",
    "modules/examples/price-alert",
    "modules/examples/stop-loss",
    "modules/fixtures/clock-reader",
    "modules/fixtures/flaky-bomb",
    "modules/fixtures/fuel-bomb",
    "modules/fixtures/memory-bomb",
    "modules/fixtures/panic-bomb",
    "modules/twap-monitor",
    "tools/load-gen",
    "tools/orderbook-mock",
]
resolver = "2"

[workspace.package]
edition = "2024"
license = "AGPL-3.0"
repository = "https://github.com/nullislabs/shepherd"

# Shared dependency table. Every external dependency is hoisted here.
# Core workspace crates (the engine, SDK, tooling) inherit with
# `dep.workspace = true` and may add features per call site via
# `dep = { workspace = true, features = ["extra"] }`. Standalone guest
# modules under `modules/` do NOT inherit external deps from here: a
# real module author has no access to this table, so they express-declare
# their own external deps and inherit only local crates via `path`.
# Version drift across the core crates (the failure mode that prompted
# hoisting, e.g. cowprotocol on `1.0.0-alpha` vs `1.0.0-alpha.3`) is now
# impossible by construction.
[workspace.dependencies]
# Error + async plumbing.
anyhow = "1"
thiserror = "2"
tokio = { version = "1", features = ["full"] }
futures = "0.3"

# Serde + config.
serde = { version = "1", features = ["derive"] }
serde_json = { version = "1", default-features = false, features = ["alloc"] }

# Observability.
tracing = "0.1"
# `tracing-core` alone (no subscriber registry) backs the guest-side
# tracing facade in `nexum-sdk`: a wasm module links only the event
# dispatch, not the host-oriented fmt/registry machinery.
tracing-core = { version = "0.1", default-features = false, features = ["std"] }
tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt", "env-filter", "ansi", "json"] }

# `strum::IntoStaticStr` on every error / event enum gives a free
# snake_case `&'static str` for every variant, which feeds directly
# into `metrics::counter!(..., "error_kind" => name)` and
# `tracing::warn!(error_kind = name, ...)` recordings without an
# ad-hoc `match err { ... => "connect" ... }` ladder per call site.
strum = { version = "0.28", default-features = false, features = ["derive"] }

# `auto_impl::auto_impl(&, Arc, Box)` forwarding impls for traits
# held through smart pointers. Available workspace-wide so any future
# `Arc<dyn Trait>` boundary can opt in without touching root manifest.
auto_impl = "1"

# `derive_more` newtype boilerplate (`Deref`, `From`, `Display`, ...).
# `default-features = false, features = ["full"]` keeps the proc-macro
# surface predictable; per-derive opt-in via the standard `#[derive(...)]`
# syntax. Available workspace-wide; not pulled in by default.
derive_more = { version = "2", default-features = false, features = ["full"] }

# CLI parser. Used by every binary crate (engine, load-gen,
# orderbook-mock, shepherd-backtest) via the derive macro.
clap = { version = "4", features = ["derive"] }

# alloy stack. Engine uses the full provider/transport surface;
# guest-facing crates use `alloy-primitives` + `alloy-sol-types` for
# typed protocol values. Pinned together so a single workspace bump
# moves every consumer at once.
alloy-primitives = { version = "1.6", default-features = false, features = ["std", "serde"] }
alloy-sol-types = { version = "1.6", default-features = false, features = ["std"] }
alloy-provider = { version = "2.1", default-features = false, features = ["ws", "ipc", "pubsub", "reqwest"] }
alloy-rpc-types-eth = { version = "2.1", default-features = false, features = ["std"] }
alloy-transport-ws = { version = "2.1", default-features = false }
# Typed EIP-155 chain ids for config keys, provider/orderbook pools, and
# the chain seam. Already in the graph via alloy-provider; named here so
# the engine can key maps and signatures on `Chain` instead of a bare u64.
alloy-chains = { version = "0.2", default-features = false, features = ["std", "serde"] }

# CoW Protocol bindings. Pinned to one version across the workspace
# (was `1.0.0-alpha` in engine vs `1.0.0-alpha.3` in SDK before
# hoisting). The engine takes `http-client` for `OrderBookApi`;
# guest-side consumers (SDK, strategies) express their own
# `default-features = false` builds for the `cdylib` wasm target.
cowprotocol = { version = "0.1.0", default-features = false, features = ["http-client"] }

# HTTP transport for `cow_api::request` REST passthrough and the
# orderbook-mock test surface.
reqwest = { version = "0.13", default-features = false, features = ["json", "rustls"] }
# Typed HTTP method/request/response for the CoW passthrough and the
# engine's wasi:http gate. Single `http` version in the graph via reqwest,
# so `reqwest::Method` is `http::Method`.
http = "1"
# Body trait + combinators (already in the graph via wasmtime-wasi-http)
# for the engine's response-body cap on the wasi:http gate.
http-body = "1"
http-body-util = "0.1"
bytes = "1"

# `wit-bindgen` is consumed by every guest module crate (example +
# every strategy + every fixture). Hoisted so a single bump moves
# them in lock-step.
wit-bindgen = { version = "0.58", default-features = false, features = ["macros", "realloc"] }

# Guest-side wasi:http client behind the SDK's `http::fetch` helper.
# Binds wasi 0.2.x through the `wasip2` crate, matching the wasi:http
# WIT the engine's wasmtime hosts. `default-features = false` drops
# the serde-json body helpers the SDK does not expose.
# Licence: Apache-2.0 WITH LLVM-exception.
wstd = { version = "0.6", default-features = false }

# WASM Component Model runtime (engine host).
wasmtime = { version = "46", features = ["component-model"] }
wasmtime-wasi = "46"
# Host implementation of wasi:http; default features keep the hyper +
# rustls outgoing backend (`default-send-request`) the engine fronts
# with its per-module allowlist gate.
wasmtime-wasi-http = "46"

# Manifest parsing.
toml = "1"

# Metrics facade + Prometheus exporter (engine `/metrics` listener).
metrics = "0.24"
metrics-exporter-prometheus = { version = "0.18", default-features = false, features = ["http-listener"] }

# alloy JSON-RPC client + transport (engine chain backend).
alloy-rpc-client = { version = "2.1", default-features = false }
alloy-transport = { version = "2.1", default-features = false }

# Embedded key-value store (engine local-store backend).
redb = "4"

# Misc engine host deps.
url = "2"

# HTTP server for the orderbook mock.
axum = "0.8"

# Randomness for tooling.
rand = "0.10"

# Hex codec for the backtest harness.
hex = "0.4"

# Dev/test helpers.
tempfile = "3"
wiremock = "0.6"
proptest = "1"
tower = "0.5"

# Workspace-standard lint set. New crates inherit via
# `[lints] workspace = true` in their package manifest. `unsafe_code`
# cannot be denied workspace-wide because every wit-bindgen guest
# module emits an `unsafe extern "C"` shim; modules carrying that
# macro keep the default-warn allowance, and unsafe in non-binding
# code still trips review by convention.
[workspace.lints.rust]
unsafe_op_in_unsafe_fn = "warn"

[workspace.lints.clippy]
# Deny the easy footguns. Each crate carries its own narrower
# `#![deny(...)]` where the cost of a violation is high (e.g. the
# binary entrypoints carry `unused_crate_dependencies` warn).
dbg_macro = "deny"
todo = "deny"

[profile.dev]
panic = "abort"

[profile.release]
panic = "abort"