Cargo.toml

[workspace]
resolver = "3"
members = ["crates/*"]

[workspace.package]
version = "0.0.0"
edition = "2024"
rust-version = "1.97"
license = "MIT"
repository = "https://github.com/NyxFoundation/verity"
authors = ["Nyx Foundation"]

# Lints are defined once here and inherited by every crate via `[lints] workspace = true`.
# `unsafe_code` is denied workspace-wide; per docs/src/reference/architecture.md the only crate allowed to opt back
# in is `verity-consensus-sys` (the FFI boundary), which will override this locally when it lands.
[workspace.lints.rust]
unsafe_code = "deny"

[workspace.lints.clippy]
all = { level = "warn", priority = -1 }
# Exhaustiveness policy: matches must not hide variants. `manual_let_else` folds the
# `if let ... else { return }` shape into `let-else`; `match_wildcard_for_single_variants`
# flags a `_` arm that silently absorbs exactly one remaining variant, which would also
# absorb any variant leanSpec adds later. Plain `if` on booleans is untouched by both.
manual_let_else = "warn"
match_wildcard_for_single_variants = "warn"

# Every external dependency is declared once here and inherited by members with
# `workspace = true`, so a version appears in exactly one place in the tree.
[workspace.dependencies]

# --- Post-quantum signatures ---------------------------------------------------------------
# XMSS sign / verify per validator.
#
# `branch`, not `rev`, and that is forced rather than chosen. leanVM depends on leanSig by branch
# (`devnet4`). Cargo keys a git package by URL *and* reference, so `?branch=devnet4` and
# `?rev=<sha>` are two distinct packages even when both resolve to the same commit: the graph ends
# up with two copies of leanSig and every type crossing the leanSig/leanVM boundary stops matching.
# `[patch]` cannot merge them either — cargo rejects a patch resolving to the same source. Matching
# leanVM's reference exactly is the only way to keep one leanSig in the graph.
#
# What a rev here would have bought is bought instead by Cargo.lock, which pins
# `15cbdd43ec8525aa43fea2f42cafc5ed366084ae` and is committed; CI builds `--locked`, so a moved
# branch head cannot reach a build without showing up as a lockfile diff in review. This is the
# same arrangement Plonky3 already uses below, for the same reason: the pin lives wherever cargo
# will actually honour it.
#
# Bumping leanSig means bumping leanVM's rev in the same change, then re-running
# `cargo update leansig --precise <sha>` — the two revs are only safe in matched pairs.
#
# `version` is redundant for resolution — the reference already determines the code — but a git
# dependency without one is a wildcard requirement, which `deny.toml` bans.
#
# Pinning leanSig is necessary but NOT sufficient. leanSig itself depends on Plonky3 with neither
# rev nor branch, so a fresh resolve floats it to that repository's HEAD, which no longer compiles
# against leanSig. Plonky3 is therefore pinned in Cargo.lock (`cargo update p3-field --precise`) —
# it cannot be pinned here, because cargo drops a `[patch]` whose version cannot satisfy Plonky3's
# own intra-workspace requirements. A bare `cargo update` refloats it and breaks the build; see
# CLAUDE.md for the full trap.
leansig = { git = "https://github.com/leanEthereum/leanSig", branch = "devnet4", version = "0.1.0" }

# Aggregation and aggregate-proof verification. leanVM (renamed upstream from `leanMultisig`)
# is a workspace, and Verity depends on two of its members:
#
# - `leansig_wrapper` fixes the concrete XMSS instantiation — V=46, TARGET_SUM=200, BASE=8,
#   LOG_LIFETIME=32 — which is exactly leanSpec's `PROD_CONFIG`. Taking the parameters from here
#   rather than re-instantiating leanSig ourselves is what guarantees that a signature Verity
#   verifies is a signature leanVM can aggregate: one source of truth for the scheme, not two.
# - `rec_aggregation` is the aggregation and proof-verification surface itself.
#
# The rev is pinned for the same reason leanSig's is, plus one specific to this pair: leanVM
# depends on leanSig by *branch* (`devnet4`), so the rev below is what decides which leanSig
# commit ends up in the graph alongside our own pin. `e2592df` is the leanVM commit whose
# Cargo.lock resolves leanSig to `15cbdd43...` — the same commit pinned above. Bumping one of
# these two revs without re-checking the other splits leanSig into two copies in the graph, and
# every type crossing the boundary stops matching.
backend = { git = "https://github.com/leanEthereum/leanVM", rev = "e2592df4e30fdddbbf8ae26a333116c68cec7026", version = "0.1.0" }
leansig_wrapper = { git = "https://github.com/leanEthereum/leanVM", rev = "e2592df4e30fdddbbf8ae26a333116c68cec7026", version = "0.1.0" }
rec_aggregation = { git = "https://github.com/leanEthereum/leanVM", rev = "e2592df4e30fdddbbf8ae26a333116c68cec7026", version = "0.1.0" }

# --- SSZ -----------------------------------------------------------------------------------
# lambdaclass' implementation. NyxFoundation/leanSSZ (proven in Lean, C ABI PoC complete) is the
# future Lean-adoption candidate and is deliberately not adopted yet.
#
# Note leansig depends on `ethereum_ssz` internally, so two SSZ implementations coexist
# transitively. Harmless, but conversions at the signature boundary are explicit, not free.
libssz = "0.2.2"
libssz-derive = "0.2.2"
libssz-merkle = "0.2.2"
libssz-types = "0.2.2"

# --- Networking ----------------------------------------------------------------------------
# Upstream rust-libp2p, unforked. `default-features = false` keeps the transport set to what the
# lean network actually uses: QUIC for transport, gossipsub for broadcast, request-response for
# the ReqResp protocols. `macros` is the `NetworkBehaviour` derive; `identify` and `ping` are the
# baseline peer-management protocols.
libp2p = { version = "0.56", default-features = false, features = [
    "quic",
    "gossipsub",
    "request-response",
    "identify",
    "ping",
    "macros",
    "tokio",
    "noise",
    "yamux",
    "secp256k1",
] }

# The async runtime for the I/O Edge. Only `verity-p2p` consumes it today; the feature set is
# what the network service actually uses — `rt` to spawn the swarm task, `sync` for the
# command/event channels, `macros` for `select!`, `time` for request timeouts — plus
# `rt-multi-thread` so integration tests can drive two nodes on one runtime.
# Required to implement `libp2p::request_response::Codec`, whose trait definition uses
# `#[async_trait]` — this is upstream's shape, not a choice made here.
async-trait = "0.1"
tokio = { version = "1", default-features = false, features = [
    "rt",
    "rt-multi-thread",
    "sync",
    "macros",
    "time",
] }
futures = "0.3"

# Snappy, in both of its formats. leanSpec uses the raw block format for gossip payloads and
# the CRC-framed format for req/resp chunks; `snap` exposes both (`raw`, `read`/`write`).
snap = "1.1"

# --- Storage -------------------------------------------------------------------------------
# See docs/src/reference/architecture.md "Storage engine and retention" for why an LSM engine and not a B-tree one.
#
# `default-features = false` drops snappy, zstd, zlib, and bzip2. `verity-db` writes exactly two
# compression settings — LZ4 for every table, and none for `block_proofs`, whose values are
# high-entropy cryptographic blobs that compress to nothing. The other codecs would be four more
# C libraries built into every image to support a setting nothing may select. Adding one back is a
# change here and in `column.rs` together, which is the point.
#
# `bindgen-runtime` is in rocksdb's default set, so it has to be named again here or dropping the
# defaults drops it too. It is not optional in practice: `librocksdb-sys` generates its FFI
# bindings with bindgen on every build, and with neither `bindgen-runtime` nor `bindgen-static`
# selected the build resolves bindgen's own defaults instead of the mode this manifest chose.
# Runtime, not static: it loads the host's `libclang` dynamically, which is what CI images and
# distribution `libclang-dev` packages provide. A build host therefore needs libclang available —
# on a machine where the library is installed only under a versioned name (`libclang-19.so.1`),
# point `LIBCLANG_PATH` at a directory holding a `libclang.so` symlink to it.
rocksdb = { version = "0.24", default-features = false, features = [
    "lz4",
    "bindgen-runtime",
] }

# --- Hashing -------------------------------------------------------------------------------
# Not the SSZ hasher — that is `libssz-merkle`, and nothing may route a consensus root around
# it. This is for `verity-db`'s stored-type manifest digest, which hashes a description of the
# schema rather than any consensus value.
sha2 = "0.10"

# --- Workspace members ---------------------------------------------------------------------
# Declared here so a member's path appears in one place, like every external dependency.
#
# `version` is redundant for a path dependency inside the workspace, but omitting it leaves a
# wildcard requirement, which `deny.toml` bans for the same reason it bans one on a git
# dependency: nothing in the manifest then states what the dependent was built against.
verity-types = { path = "crates/verity-types", version = "0.0.0" }
verity-chain = { path = "crates/verity-chain", version = "0.0.0" }
verity-crypto = { path = "crates/verity-crypto", version = "0.0.0" }
verity-db = { path = "crates/verity-db", version = "0.0.0" }
verity-p2p = { path = "crates/verity-p2p", version = "0.0.0" }

# --- Test-only -----------------------------------------------------------------------------
# Scoped to SSZ round-trip properties in `verity-types`. This is a deliberate, narrow exception
# to the kickoff decision that no verification harness ships on day one: a codec is one of the
# few places where the property is writable directly, and leanSpec's fixtures only ever supply
# the shapes the spec happened to generate. The graduated harness of docs/design/model-check.md — bolero,
# Kani, loom — is still introduced later, per its tool-to-zone mapping.
proptest = "1.9"

# Scratch directories for the key-loader tests. Already in the lockfile transitively, so this
# only promotes it to a direct dependency.
tempfile = "3.27"
serde = { version = "1.0", features = ["derive"] }

# YAML, for lean-quickstart's key manifest. A maintained fork of `serde_yaml`, which was
# archived and now carries an unmaintained advisory that `deny.toml` refuses.
serde_norway = "0.9.42"
serde_json = "1.0"

# Dependencies are optimized even in dev and test builds; workspace members are not.
#
# This is not a build-time preference. leanVM is a proving system written to be compiled with
# optimizations: unoptimized, its recursion blows an 8 MB test thread's stack before it
# finishes a single aggregation, so the aggregate-proof tests do not merely run slowly, they
# abort. Optimizing only the `*` set keeps Verity's own crates debuggable, which is where a
# backtrace is actually worth having.
[profile.dev.package."*"]
opt-level = 3