[workspace]

members = [

"crates/tirith-core",

"crates/tirith",

"crates/tirith-test-support",

"tools/sign-license",

"tools/license-server",

]

resolver = "2"

[workspace.package]

version = "0.4.0"

edition = "2021"

license = "AGPL-3.0-only"

rust-version = "1.83"

[workspace.dependencies]

tirith-core = { version = "0.4.0", path = "crates/tirith-core" }

tirith-test-support = { path = "crates/tirith-test-support" }

clap = { version = "4", features = ["derive"] }

url = "2"

regex = "1"

regex-syntax = "0.8"

percent-encoding = "2"

serde = { version = "1", features = ["derive"] }

serde_json = "1"

serde_yaml = "0.9"

# Exact lock-compatible line; preserves the workspace Rust 1.83 floor while

# allowing setup to edit Grok TOML without discarding unrelated formatting.

toml_edit = "=0.22.27"

once_cell = "1"

base64 = "0.22"

etcetera = "0.8"

chrono = { version = "0.4", features = ["serde"] }

sha2 = "0.10"

fs2 = "0.4"

unicode-normalization = "0.1"

unicode-script = "0.5"

unicode-width = "0.2"

is-terminal = "0.4"

thiserror = "2"

clap_complete = "4"

clap_mangen = "0.2"

uuid = { version = "1", features = ["v4"] }

# Pin home <0.5.12 — v0.5.12 requires edition 2024 (Rust 1.85+), breaks MSRV 1.83

home = ">=0.5, <0.5.12"

# Pin time <0.3.38 — v0.3.38+ requires time-core >=0.1.3 which needs Rust 1.85+,

# and v0.3.46+ needs time-core 0.1.8 (Rust 1.88). Advisory RUSTSEC-2026-0009

# is ignored in deny.toml (tirith never parses user-controlled RFC 2822 dates).

time = ">=0.3, <0.3.38"

# Pin base64ct <1.8 — v1.8+ uses edition 2024 (Rust 1.85+), breaks MSRV 1.83.

# Transitive dep via ed25519-dalek → ed25519 → pkcs8 → spki → base64ct.

base64ct = ">=1, <1.8"

# Pin idna_adapter <1.2.2 — v1.2.2 uses edition 2024 (Rust 1.85+), breaks MSRV 1.83.

# Reached transitively via url → idna, and via the new jsonschema dep (PR-0 spike)

# which floats idna_adapter to ^1.2 and would otherwise pull 1.2.2 on a fresh

# resolve. v1.2.1 is the last MSRV-1.83-clean line and is what Cargo.lock pins.

# Like the time / base64ct pins above, idna_adapter is transitive-only: this entry

# documents the bound and the lockfile is the actual enforcer — do not

# `cargo update` it past 1.2.1 while MSRV is 1.83.

idna_adapter = ">=1, <1.2.2"

libc = "0.2"

walkdir = "2"

csv = "1"

tokio = { version = "1", features = ["rt", "net", "io-util", "signal", "macros"] }

lopdf = "0.34"

owo-colors = "4"

ed25519-dalek = { version = "2", default-features = false, features = ["std", "rand_core"] }

# arboard 3.x — cross-platform clipboard (X11/Wayland/macOS NSPasteboard/Windows).

# Used by `tirith clipboard {copy,scan,daemon}` (M7 ch3). Returns

# `Err` gracefully on headless Linux (no X/Wayland), which the CLI maps

# to a "no clipboard backend" envelope rather than a panic.

arboard = { version = "3", default-features = false }

# tiny_http 0.12 — a SYNCHRONOUS (blocking, thread-per-accept) HTTP/1.1 server.

# Used ONLY by the CLI `tirith dashboard serve` loopback path (M13 ch3); not by

# tirith-core. Chosen because it needs no async runtime — the serve loop is a

# plain blocking accept loop, which keeps the dependency surface tiny

# (ascii / chunked_transfer / httpdate, all MSRV-clean). It is never bound to

# anything but 127.0.0.1.

tiny_http = "0.12"

[profile.release]

lto = "thin"

strip = true