Cargo.toml

[workspace]
members = [".", "crates/sbom-tools-ffi"]
exclude = ["dagger/rust-sdk"]

[package]
name = "sbom-tools"
version = "0.2.0"
edition = "2024"
rust-version = "1.88"
description = "Semantic SBOM diff and analysis tool"
license = "MIT"
readme = "README.md"
repository = "https://github.com/sbom-tool/sbom-tools"
keywords = ["sbom", "cyclonedx", "spdx", "diff", "security"]
categories = ["command-line-utilities", "development-tools", "security"]
# Keep multi-MB test fixtures out of the published crate (only used by ignored,
# locally-run integration tests). Wildcards match the large generated SBOM.
exclude = [
    "tests/fixtures/cyclonedx/sbom-cyclone-dx-json-*.json",
]

[lib]
name = "sbom_tools"
crate-type = ["rlib"]

# The binary drives the interactive TUI and parses arguments, so it needs both
# heavy feature sets. Building with `--no-default-features` (e.g. for the FFI or
# fuzz consumers) skips the bin target instead of failing to compile it.
[[bin]]
name = "sbom-tools"
path = "src/main.rs"
required-features = ["cli", "tui"]

[dependencies]
# Signal Handling (watch mode, reached only through the `cli` feature)
ctrlc = { version = "3.5", optional = true }

# SBOM Parsing
spdx = "0.13"

# Fuzzy Matching
strsim = "0.11"
semver = { version = "1.0", features = ["serde"] }
regex = "1.10"

# Serialization
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
serde_yaml_ng = "0.10"
quick-xml = { version = "0.41", features = ["serialize"] }

# TUI (ratatui ecosystem) — gated behind the `tui` feature
ratatui = { version = "0.30", features = ["crossterm"], optional = true }
crossterm = { version = "0.29", optional = true }

# CLI argument parsing. `clap` stays non-optional because `config`, `reports`,
# and `serialization` derive `ValueEnum`/`Subcommand` on public types that are
# part of the library API even without the `cli` feature. The shell-completion
# and man-page generators are binary-only, so they are gated behind `cli`.
clap = { version = "4.6", features = ["derive", "env"] }
clap_complete = { version = "4.6", optional = true }
clap_mangen = { version = "0.3", optional = true }

# HTTP Client for enrichment
reqwest = { version = "0.13", features = ["blocking", "json", "rustls"], default-features = false, optional = true }
# gzip decompression for the FIRST EPSS bulk dataset (served as .csv.gz)
flate2 = { version = "1.0", optional = true }
sha2 = "0.11"

# Utilities
chrono = { version = "0.4.44", features = ["serde"] }
uuid = { version = "1", features = ["v4", "serde"] }
rayon = "1.12"
thiserror = "2.0"
anyhow = "1.0"
tracing = "0.1"
tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
indexmap = { version = "2.14", features = ["serde"] }
xxhash-rust = { version = "0.8", features = ["xxh3"] }
dirs = "6.0.0"
unicode-width = "0.2"
schemars = "1.2"

[features]
default = ["enrichment", "cli", "tui"]
enrichment = ["dep:reqwest", "dep:flate2"]
# Interactive terminal UI (ratatui + crossterm). ~60K LOC of render/event code.
tui = ["dep:ratatui", "dep:crossterm"]
# Command handlers + binary support. The `cli` module calls into `crate::tui`,
# and `watch` calls into `crate::cli`, so `cli` pulls in `tui`. `clap_complete`/
# `clap_mangen` (shell completions, man page) and `ctrlc` (watch signal handling)
# are only ever reached through `cli`.
cli = ["tui", "dep:clap_complete", "dep:clap_mangen", "dep:ctrlc"]
ffi = []

[dev-dependencies]
criterion = "0.8"
httpmock = "0.8"
insta = { version = "1.43", features = ["filters"] }
proptest = "1.11"
tempfile = "3.27"

[[bench]]
name = "diff_benchmark"
harness = false

[[bench]]
name = "large_sbom"
harness = false

[[bench]]
name = "hot_paths"
harness = false

[[test]]
name = "ffi_bindings"
required-features = ["ffi"]

[[test]]
name = "ffi_schema_snapshots"
required-features = ["ffi"]

[[test]]
name = "conformance_ffi"
required-features = ["ffi"]

[[test]]
name = "ffi_regression"
required-features = ["ffi"]

[package.metadata.binstall]
pkg-url = "{ repo }/releases/download/v{ version }/{ name }-{ target }.{ archive-format }"
bin-dir = "{ bin }{ binary-ext }"
pkg-fmt = "tgz"

[package.metadata.binstall.overrides.x86_64-pc-windows-msvc]
pkg-fmt = "zip"

[profile.release]
lto = true
codegen-units = 1