Cargo.toml

[workspace]
members = ["crates/mds-core", "crates/mds-cli", "crates/mds-wasm", "crates/mds-napi", "crates/mds-python"]
resolver = "2"

[workspace.package]
version = "0.4.3"
edition = "2021"
rust-version = "1.88" # napi 3.12.2 sets rust-version = "1.88" in its published Cargo.toml
license = "MIT"
readme = "README.md"
repository = "https://github.com/dean0x/mdscript"
keywords = ["markdown", "template", "llm", "prompt", "compiler"]

[workspace.dependencies]
indexmap = "2.2"
serde = { version = "1", features = ["derive"] }
serde_yaml_ng = "0.10"
serde_json = "1"
miette = { version = "7" }
thiserror = "2"
clap = { version = "4", features = ["derive"] }
tempfile = "3"
wasm-bindgen = "0.2"
serde-wasm-bindgen = "0.6"
wasm-bindgen-test = "0.3"
js-sys = "0.3"
napi = { version = "3.12.2", default-features = false, features = ["napi3", "serde-json"] }
napi-derive = "3.6.3"
napi-build = "2.4.1"
# Python bindings (crates/mds-python). Pins are exact and soak-checked (2026-09-06):
# pyo3 0.29.0 patches two RustSec advisories disclosed 2026-06-11 — RUSTSEC-2026-0176
# (OOB read in PyList/PyTuple iterator nth/nth_back) and RUSTSEC-2026-0177 (missing
# Sync bound on PyCFunction::new_closure, a free-threading soundness gap this crate is
# directly exposed to via `gil_used = false` below). Both are fixed only in >=0.29.0.
# 0.29.2 is a patch on the already-fixed 0.29 line (both advisories remain fixed);
# published 2026-08-05 (32 days of soak at 2026-09-06), past the routine 30d window.
# It is the newest patch available — no 0.29.x above 0.29.2 exists. `abi3-py311` is
# ALWAYS on (not optional) so `cargo build/clippy/test --workspace` compile the cdylib
# against the stable ABI without linking libpython or needing a Python interpreter.
# `extension-module` is gated behind the crate's own default feature so it can be
# toggled off. pyo3 default features (incl. `macros`) are kept. pythonize's minor must
# track pyo3's (0.29 ↔ 0.29); no 0.29.x above 0.29.0 exists for pythonize — pin stays.
pyo3 = { version = "=0.29.2", features = ["abi3-py311"] }
pythonize = "=0.29.0"
# notify is CC0-1.0 (public-domain dedication). CC0 is permissive and non-contaminating
# with respect to the workspace MIT license. Explicitly accepted here.
# notify and ctrlc also introduce additional transitive license families (platform-specific):
#   - inotify 0.11.1 / inotify-sys 0.1.5 → ISC (Linux only)
#   - dispatch2 0.3.1 → Zlib OR Apache-2.0 OR MIT (macOS only, via ctrlc)
# ISC and Zlib are permissive and MIT-compatible; no copyleft or contamination risk.
# All three families are explicitly accepted here.
# A cargo-deny license allowlist (licenses.allow = ["MIT","Apache-2.0","CC0-1.0","ISC","Zlib"])
# would enforce this acceptance in CI (suggested follow-up, out of scope for this batch).
notify = "8"
ctrlc = "3.5"
# similar: pure-Rust diffing (mds-cli `fmt --diff`). Apache-2.0 (MIT-compatible, no
# copyleft). 3.2.0 released 2026-08-17 (20d soak at 2026-09-06) — within the one-off
# 14-day flush rule for this batch. rust-version = "1.85" in its published Cargo.toml,
# within the workspace MSRV (1.88). Only the default features ("std", "text") are used.
similar = "3.1"

# panic = "unwind" is required workspace-wide because mds-wasm and mds-napi use
# catch_unwind at the JS boundary to convert panics into structured JS errors.
# Cargo does not support per-package panic strategy overrides for workspace profiles.
# Note: "unwind" is already Rust's default for dev, so the dev setting is
# explicit documentation only.
[profile.dev]
panic = "unwind"

[profile.release]
lto = true
panic = "unwind" # required by mds-wasm catch_unwind; see comment above

[profile.release.package.mds-wasm]
opt-level = "z"
strip = true
codegen-units = 1

[profile.release.package.mds-napi]
opt-level = 3
strip = true
codegen-units = 1

[profile.release.package.mds-python]
opt-level = "z"
strip = true
codegen-units = 1