Cargo.toml

[workspace]
members = [
  "libtonode-tests",
  "pepper-sync",
  "zingo-cli",
  "zingo-memo",
  "zingo-net-diag",
  "zingo-price",
  "zingo-status",
  "zingolib",
  "zingo-netutils",
  "zingo-netutils/webpki-verifier-shim",
  "zingo-netutils/nym-proxy-ffi",
  "zingo-ffi/lib",
  "zingo-ffi/uniffi-bindgen",
]
# zingo-netutils, its verifier shim, and the proxy crate are members since
# PR #3037. The nym-sdk stack once needed `crypto-common ^0.2` while
# zcash_primitives 0.29 and 0.30 pinned `=0.2.0-rc.1`, which kept netutils in
# a workspace of its own with a second lockfile (zingo-adrs zingolib/0011,
# amended 2026-10-21). The 0.31 cohort resolves to a 0.2 release, so one
# lockfile now holds both stacks. Members consume netutils with `nym` off;
# only the proxy crate turns it on, and ci-pr.yaml's nym feature job builds
# the two with every feature.
resolver = "2"

[workspace.dependencies]
### Workspace
pepper-sync = { version = "0.7.0", path = "pepper-sync" }
zingo-memo = { version = "0.3.0", path = "zingo-memo" }
zingo-net-diag = { version = "0.1.0", path = "zingo-net-diag" }
# default-features = false: the fetch machinery (socks5-fetch) is opt-in;
# zingolib re-enables it only under its `nym` feature (the mixnet-only
# price rule). The crate's own default keeps the fetch for standalone
# builds and tests.
zingo-price = { version = "0.3.0", path = "zingo-price", default-features = false }
zingo-status = { version = "0.3.0", path = "zingo-status" }
zingolib = { version = "8.0.0", path = "zingolib" }

### Tests and Integration Tests
portpicker = "0.1"
# dev's dependency audit dropped this as unused, which held on dev alone: its
# only consumer there was the retired darkside-tests crate. zingolib's Ironwood
# migration proptests consume it, so the merge restores it.
proptest = "1.6.0"
tempfile = "3"
quote = "1"
syn = { version = "2", features = ["full"] }
zingo_test_vectors = "0.0.1"

### Documentation
indoc = "2"
simple-mermaid = "0.2.0"

### Logging
log = "0.4"
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }

### Zingo-common
zingo-netutils = { version = "7.0.0", path = "zingo-netutils", features = [
  "globally-public-transparent",
] }
zingo-nym-proxy-ffi = { version = "0.1.0", path = "zingo-netutils/nym-proxy-ffi" }
zingo_common_components = "0.4.0"
tokio-stream = "0.1"

### Zcash
incrementalmerkletree = "0.9.0"
orchard = "0.16.0"
sapling-crypto = "0.9.0"
shardtree = "0.8.0"
zcash_address = "=0.14.0"
zcash_client_backend = { version = "=0.25.0", features = [
  "orchard",
  "transparent-inputs",
] }
zcash_encoding = "0.5.0"
zcash_keys = { version = "=0.17.0", features = [
  "transparent-inputs",
  "sapling",
  "orchard",
] }
zcash_note_encryption = "0.5.1"
# non-standard-fees: exposes `fees::fixed`, used to pin the exact planned fee
# on Ironwood migration transactions.
zcash_primitives = { version = "=0.31.0", features = [
  "non-standard-fees",
] }
zcash_proofs = "=0.31.0"
zcash_protocol = "=0.11.0" # public API (TODO: remove from public API)
zcash_transparent = "=0.11.0"

### Blockchain Protocol
bip0039 = { version = "0.14", features = ["rand"] }
bip32 = { version = "0.6.0", default-features = false }
zip32 = "0.3.0"

### Cryptographic
blake2b_simd = "1"
jubjub = "0.11.1"
secrecy = "0.8"
subtle = "2.6.1"
bech32 = "0.11.0"
bs58 = "0.5"

# Parallel processing
crossbeam-channel = "0.5"
rayon = "1"

# Encoding
byteorder = "1"
hex = "0.4"
json = "0.12"
serde = "1"
serde_json = "1"

### Network
http = "1"
# aws-lc-rs is the workspace's sole rustls CryptoProvider (ring is excised);
# prefer-post-quantum leads outbound handshakes with the X25519MLKEM768
# hybrid group. Runtime installation is first-install-wins via
# zingo_netutils::crypto::ensure_default_crypto_provider, so downstream
# embedders that install their own provider first keep it.
tonic = { version = "0.14", features = ["tls-webpki-roots", "tls-aws-lc"] }
prost = "0.14"

### Async
futures = "0.3"
tokio = "1"

### Error interface
thiserror = "2"

### Binding Layer (zingo-adrs zingolib/0054)
uniffi = "0.32.2"
android_logger = "0.11"
lazy_static = "1.4.0"
once_cell = "1"

### Internal data
append-only-vec = "0.1.7"
nonempty = "0.11.0"
rustyline = "18.0.0"
shellwords = "1"

### OS hooks
chrono = "0.4"
clap = { version = "4.6.5", features = ["derive"] }
dirs = "6"
memuse = "0.2"
rand = "0.10"

# zingo-netutils and child crates
rustls = { version = "0.23.40", features = ["prefer-post-quantum"] }
tokio-rustls = { version = "0.26", default-features = false, features = [
  "aws_lc_rs",
  "logging",
  "tls12",
] }
lightwallet-protocol = "0.4.0"
hyper-rustls = { version = "0.27", default-features = false, features = [
  "aws-lc-rs",
  "http1",
  "tls12",
  "logging",
  "native-tokio",
] }
hyper-util = "0.1.20"
hyper = "1"
rustls-pemfile = "2"
reqwest = { version = "0.12.15", default-features = false }
http-body-util = "0.1.3"
x509-parser = "0.18"

[profile.test]
opt-level = 3

# The one profile of the Binding Layer: the wallet library on both
# platforms, the proxy library on Android, and the iOS archive that carries
# both crates under the wallet crate's `zingo-nym-proxy-ffi` feature. The
# nym stack beneath the proxy therefore compiles with the same size
# optimization and overflow checks on both platforms. Ruled 2026-10-22:
# the proxy once kept a plain release profile of its own, inherited from
# the standalone zingo-netutils workspace and never measured, and the
# one-archive iOS build left the two platforms running the proxy under two
# profiles, so the profile the wallet ships under is the profile for all.
# The panic strategy is unwind: a panic inside a tokio task of the proxy
# ends that task and leaves the process running, where an abort runtime
# ended the app (issue #2926). The workbench test `panic_strategy` holds
# the profile to it.
[profile.mobile]
inherits = "release"
debug = 1
lto = "thin"
codegen-units = 1
overflow-checks = true
panic = "unwind"
opt-level = "z"

# zingo-adrs zingolib/0021: the nym stack's TLS verifies against the
# compiled-in Mozilla bundle instead of rustls-platform-verifier's OS trust
# store, keeping verification byte-identical on every platform and the
# workspace free of hand-written unsafe. The stand-in lives under the
# upstream crate's name. Cargo honours a [patch] table only in the root
# manifest of the workspace being built, so the table moved here with the
# crate.
[patch.crates-io]
rustls-platform-verifier = { path = "zingo-netutils/webpki-verifier-shim" }