Cargo.toml

[package]
name = "wfl"
version = "26.9.19"
edition = "2024"
# Minimum supported Rust version. Driven by the `sqlx` 0.9 dependency, which
# declares `rust-version = "1.94"`; the WFL sources themselves need less.
# Recorded here so `cargo` fails fast on older toolchains instead of deep in a
# build.
rust-version = "1.94"
description = "WFL (WebFirst Language) is a programming language designed to be readable and intuitive using natural language constructs."
license = "Apache-2.0"
authors = ["Logbie LLC <info@logbie.com>"]
default-run = "wfl"

[package.metadata.bundle]
name = "WFL"
identifier = "com.logbie.wfl"
icon = ["icons/wfl.png"]
version = "26.9.19"
copyright = "© 2025 Logbie LLC"
category = "Developer Tool"
short_description = "WebFirst Language Compiler and Runtime"
long_description = "WFL (WebFirst Language) is a programming language designed to be readable and intuitive using natural language constructs."
executable = "wfl"

[workspace]
members = [
    ".",
    "wfl-lsp"
]
# `fuzz/` is a standalone cargo-fuzz workspace (nightly + libFuzzer only); keep
# it out of the stable-toolchain root build/test.
exclude = [
    "fuzz"
]

[package.metadata.deb]
assets = [
    ["target/release/wfl", "usr/bin/", "755"],
    ["target/release/package/.wflcfg", "etc/wfl/wfl.cfg", "644"]
]
extended-description = """
WFL (WebFirst Language) is a programming language designed to be readable and intuitive
using natural language constructs. This package includes the WFL compiler and runtime.
"""
section = "devel"
priority = "optional"
maintainer-scripts = "debian/"
conf-files = ["/etc/wfl/wfl.cfg"]

[dependencies]
logos = "0.16.1"
rand = "0.10.2"
regex = "1.13.0"
log = "0.4.33"
rustyline = "18.0.1"
tokio = { version = "1.52.3", features = ["full"] }
process-wrap = { version = "10.0.0", default-features = false, features = ["tokio1", "job-object", "process-group", "kill-on-drop"] }
libc = "0.2.186"
reqwest = { version = "0.13.4", features = ["json", "stream"] }
encoding_rs = "0.8.35"
# sqlx 0.9 split the old `runtime-tokio-rustls` feature into a separate runtime
# and TLS backend; `tls-rustls` aliases the ring-backed rustls stack we used before.
sqlx = { version = "0.9.0", features = ["runtime-tokio", "tls-rustls", "sqlite", "mysql", "postgres", "chrono"] }
serde_json = "1.0.150"
# Backs the `parse_toml` / `stringify_toml` builtins, mirroring the serde_json-backed
# JSON surface. Ships TOML 1.0 support (and reads the 1.1 spec additions).
toml = "1.1.4"
# Keep Warp 0.3.x for its stable routing/filter API, but do not enable its legacy
# TLS adapter: that adapter pins rustls 0.22. WFL serves the same filters through
# Tokio-Rustls 0.26 below, preserving secured-listener behavior on rustls 0.23.
warp = "0.3.7"
tokio-rustls = { version = "0.26.4", default-features = false, features = ["ring", "tls12"] }
rustls-pemfile = "2"
uuid = { version = "1.23.5", features = ["v4"] }
bytes = "1.12.1"
futures-util = "0.3.32"
codespan-reporting = "0.13.1"
simplelog = "0.12.1"
chrono = "0.4.45"
tempfile = "3.27.0"
once_cell = "1.21.4"
time = { version = "0.3.53", features = ["formatting", "macros"] }
dhat = { version = "0.3.0", optional = true }
glob = "0.3.2"
# Cryptographic and security dependencies
zeroize = { version = "1.9", features = ["derive"] }
subtle = "2.5"
sha2 = "0.10"
hkdf = "0.12"
hmac = "0.12"
# Password hashing (RustCrypto PHC-format hashers share password-hash 0.5) plus bcrypt
argon2 = "0.5"
scrypt = { version = "0.11", features = ["simple"] }
pbkdf2 = { version = "0.12", features = ["simple"] }
bcrypt = "0.19"
# Authenticated encryption for the `seal`/`unseal` builtins. XChaCha20-Poly1305
# specifically: its 192-bit nonce is wide enough that the implementation can mint
# a fresh random nonce per seal without a counter, so callers never touch nonces
# and cannot reuse one. `zeroize` wipes the expanded key on drop.
chacha20poly1305 = { version = "0.11.0", features = ["zeroize"] }
# Force newer version to fix future incompatibility warning
num-bigint-dig = "0.8.6"
# Direct dep so the lib can expose `init_rustls_crypto_provider()` (called by
# every binary/embedder at startup). reqwest pulls aws-lc-rs and sqlx pulls ring
# into the same rustls 0.23, and rustls refuses to pick a default when both are
# present; installing one up front keeps any ambient-default TLS path from
# panicking. `ring` matches sqlx.
# Reject TLS 1.3 messages crossing a key-change record boundary (RUSTSEC-2026-0285).
rustls = { version = "0.23.45", default-features = false, features = ["ring", "std", "tls12"] }
hyper = "1"

[features]
dhat-heap = ["dhat"]    # if you are doing heap profiling
dhat-ad-hoc = ["dhat"]  # if you are doing ad hoc profiling

[dev-dependencies]
rcgen = "0.14"
criterion = "0.8"
tokio-tungstenite = "0.30"

[[bench]]
name = "parser_bench"
harness = false

[[bench]]
name = "lexer_bench"
harness = false

[profile.release]
debug = true
# Concurrency Phase 0 (PR-0a): pin unwinding so the runtime's catch_unwind-based
# request-handler fault isolation (Phase 1) stays sound. Enforced by the
# `#[cfg(panic = "abort")] compile_error!` in src/lib.rs.
panic = "unwind"

# Test-shrink: the suite's 143 top-level `tests/*.rs` files each statically
# link the whole compiler, and full debug info pushed `target/` to ~27 GB
# (25.1 GB of it test binaries) -- past a 30 GB environment's disk budget and
# fatal to the link step (`ld ... signal 7 [Bus error]`). `line-tables-only`
# keeps file/line info for panics and backtraces while dropping variable/type
# DWARF, so panic messages and backtraces still name file and line.
#
# This is deliberately scoped to `[profile.test]` only. Under `cargo test`
# the *entire* build graph -- the local library, the `wfl` binary, and every
# external dependency -- is built with the `test` profile, so this one setting
# captures the whole saving. `[profile.dev]` is intentionally left at full
# debug info so ordinary `cargo build` / `cargo run` binaries stay fully
# inspectable in a debugger.
[profile.test]
debug = "line-tables-only"