Cargo.toml

[package]
name = "serval"
version = "0.1.0"
edition = "2024"
rust-version = "1.96"
license = "MIT"
description = "High-performance snippet delivery and templating service over a pure content-addressed storage engine."

[lib]
name = "serval"
path = "src/lib.rs"

[[bin]]
name = "serval"
path = "src/main.rs"

[features]
# Integration tests require a live PostgreSQL (provided by CI / testcontainers).
# They are gated off by default so `cargo test` is green on machines without a DB.
integration = []
# In-process CPU sampling for the dedicated performance harness. The optional
# dependency is absent from normal builds and release artifacts.
profiling = ["dep:pprof"]

[dependencies]
# Web framework
axum = "0.8"
tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "signal", "sync", "time"] }
tower = "0.5"
tower-http = { version = "0.6", features = ["cors", "set-header", "trace"] }

# Serialization
serde = { version = "1", features = ["derive", "rc"] }
serde_json = "1"

# Database (runtime-checked queries; no build-time DATABASE_URL dependency)
sqlx = { version = "0.8", default-features = false, features = [
    "runtime-tokio-rustls",
    "postgres",
    "macros",
    "chrono",
] }

# In-memory delivery cache
moka = { version = "0.12", features = ["future"] }

# Configuration / environment
dotenvy = "0.15"

# Logging
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }

# Error handling
anyhow = "1"
thiserror = "2"

# Cryptography: one hash family — BLAKE3 — for both content addressing (the
# immutable CAS key, via the XOF) and the native-keyed route-id MAC, plus a
# constant-time comparator for the stateless verification barrier.
rand = "0.9"
base64 = "0.22"
blake3 = "1"
subtle = "2"

# Authentication (OAuth/JWT with JWKS).
# jsonwebtoken 10 made the crypto backend pluggable; select aws-lc-rs (the
# upstream default) to avoid pulling in the unpatched `rsa` crate that the
# pure-Rust `rust_crypto` backend would require (RUSTSEC-2023-0071).
jsonwebtoken = { version = "10", features = ["use_pem", "aws_lc_rs"] }
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }

# Tolerant query-string parsing for delivery template variables
form_urlencoded = "1"

# SIMD-accelerated fixed-delimiter search for the rendering hot path
memchr = "2"

# MIME resolution
mime_guess = "2"

# Fixed-capacity, inline (stack) string for the 64-char route id: no heap
# allocation, `Copy`, and a safe zero-cost `as_str()` — the id never touches the
# allocator on the delivery hot path, not even as a moka cache key.
arrayvec = "0.7"

# Zero-copy response bodies: Bytes::from_owner wraps Arc<str> without memcpy
bytes = "1"

# Embedded frontend (virtual file system)
rust-embed = { version = "8", features = ["mime-guess"] }

# Timestamps
chrono = { version = "0.4", features = ["serde"] }

# Command-line interface (serve + admin allowlist management)
clap = { version = "4", features = ["derive"] }

# Rootless, in-process CPU profiling for the opt-in performance harness only.
pprof = { version = "0.15", default-features = false, features = ["flamegraph"], optional = true }

[build-dependencies]
# build.rs orchestrates the frontend build before embedding frontend/dist/.

[dev-dependencies]
tokio = { version = "1", features = ["rt-multi-thread", "macros", "test-util"] }
testcontainers = "0.27"
testcontainers-modules = { version = "0.15", features = ["postgres"] }
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
divan = "0.1"

[[bench]]
name = "data_plane_hot_path"
harness = false

[profile.release]
opt-level = 3
lto = true
codegen-units = 1
strip = true

# Keep production-equivalent optimization while retaining enough DWARF and
# symbol information for actionable flamegraphs. Normal release builds never
# select this profile and remain stripped.
[profile.profiling]
inherits = "release"
debug = 1
strip = "none"