Cargo.toml

[package]
name = "stackpit"
version = "0.4.13"
edition = "2021"
rust-version = "1.94"
description = "Lightweight, self-hosted error tracking and event monitoring"
authors = ["Franz Geffke <mail@gofranz.com>"]
# src/commercial/ is governed by LICENSE-COMMERCIAL (LicenseRef-Stackpit-Commercial-1.0);
# its wire-format decode/verify comes from the MIT `signetlib` crate, and
# src/commercial/ itself holds only the entitlement policy (feature gating,
# grace/expiry, store, admin UI).
license = "MIT"
repository = "https://github.com/franzos/stackpit"
homepage = "https://github.com/franzos/stackpit"
keywords = ["error-tracking", "monitoring", "observability", "self-hosted", "sentry"]
categories = ["web-programming", "development-tools"]
readme = "README.md"

[features]
default = ["sqlite"]
sqlite = ["sqlx/sqlite"]
postgres = ["sqlx/postgres"]
integration-tests = []

[workspace]
members = ["stackpit-auth"]
exclude = ["fuzz"]

[lib]
name = "stackpit"
path = "src/lib.rs"

[[bin]]
name = "stackpit"
path = "src/main.rs"

[dependencies]
stackpit-auth = { path = "stackpit-auth", version = "0.1.0", features = ["axum"] }
anyhow = "1"
async-trait = "0.1"
form_urlencoded = "1"
askama = "0.16"
axum = { version = "0.8", features = ["multipart"] }
chrono = { version = "0.4", features = ["serde"] }
clap = { version = "4", features = ["derive"] }
memchr = "2"
# MCP transport + tool model. `auth` and the client/reqwest features stay off:
# rmcp's OAuth is client-side only and its reqwest is 0.13 against our 0.12.
rmcp = { version = "3.1", default-features = false, features = [
    "server",
    "transport-streamable-http-server",
    "tower",
] }
sqlx = { version = "0.9", features = ["runtime-tokio", "chrono", "migrate", "macros"], default-features = false }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
tokio = { version = "1", features = ["full"] }
tokio-util = "0.7"
toml = "1"
tower-http = { version = "0.7", features = ["compression-br", "compression-gzip", "cors", "decompression-gzip", "decompression-zstd", "limit", "normalize-path", "timeout"] }
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
uuid = { version = "1", features = ["v4", "serde"] }
zstd = "0.13"
dashmap = "6"
ipnet = "2"
lru = "0.18"
parking_lot = "0.12"
arc-swap = "1"
# Commercial license verification (src/commercial/): the OPLB/CBOR/Ed25519
# wire-format decode + signature check lives in the MIT `signetlib` crate.
# src/commercial/ keeps only the entitlement policy (feature gating,
# grace/expiry, store, admin UI). Verify-only; the private key never ships.
# ed25519-dalek stays to build the VerifyingKey from the baked-in pubkey.
signetlib = "0.1"
ed25519-dalek = "2"
simple_hll = "0.0.4"
reqwest ={ version = "0.12", features = ["json", "rustls-tls"], default-features = false }
polymail = { version = "0.1.6", default-features = false, features = [
    "config",
    "lettermint-reqwest-012",
    "postmark",
    "sendgrid",
    "smtp",
] }
aes-gcm = "0.11"
base64 = "0.23"
email_address = "0.2"
# OS-backed entropy for handles / nonces / CSRF tokens: every secret comes
# straight from the OS RNG, never a userspace PRNG.
getrandom = "0.4"
hmac = "0.13"
sha1 = "0.11"
sha2 = "0.11"
hex = "0.4"
subtle = "2"
secrecy = { version = "0.10", features = ["serde"] }
zeroize = "1"
sourcemap = "9"
zip = { version = "9", default-features = false, features = ["deflate"] }
# OAuth/OIDC relying party: discovery, JWKS, auth-code + PKCE, ID-token and
# logout-token validation, end-session and revocation. The post-callback
# session is the BFF token vault in the `oidc_grants` table (see src/oidc/).
oidc-relying-party = "0.1"
url = "2"
# already in the tree via url/askama/axum, so making it direct adds no audit surface.
percent-encoding = "2"
# i18n: Fluent loader (embeds locales/*.ftl at compile time), language
# identifiers, and negotiation.
fluent-templates = "0.15"
unic-langid = { version = "0.9", features = ["macros"] }
# Pinned to 0.13: 0.14 moved to unic-langid 0.10, whose LanguageIdentifier is a
# different type from the one fluent-templates (unic-langid 0.9) hands us.
fluent-langneg = "0.13"
metrics = "0.24"
metrics-exporter-prometheus = { version = "0.18", default-features = false }

[dev-dependencies]
# loopback http only — no TLS feature needed.
reqwest = { version = "0.12", default-features = false, features = ["cookies"] }
# test-util drives the retry sleeps in the delivery-queue tests without waiting.
tokio = { version = "1", features = ["macros", "rt-multi-thread", "test-util"] }
# reuse the real cookie-hash instead of reimplementing it in the auth test.
stackpit-auth = { path = "stackpit-auth" }
oidc-relying-party = { version = "0.1", features = ["test-support"] }
# same crate axum's Form uses, for round-tripping form structs in unit tests.
serde_urlencoded = "0.7"
# HTML render snapshots (pre-i18n-retrofit baseline).
insta = "1"
# .ftl parsing for the i18n parity test.
fluent-syntax = "0.12"
tower = { version = "0.5", features = ["util"] }
futures = "0.3"

[package.metadata.generate-rpm]
assets = [
    { source = "target/release/stackpit", dest = "/usr/bin/stackpit", mode = "755" },
]

[package.metadata.deb]
maintainer = "Franz Geffke <mail@gofranz.com>"
section = "web"
assets = [
    ["target/release/stackpit", "usr/bin/", "755"],
]

[profile.release]
opt-level = 3
lto = "fat"
codegen-units = 1
strip = "symbols"

# Gated so a bare `cargo test` (CI) skips it; run via `make test-integration`.
[[test]]
name = "integration"
path = "tests/integration.rs"
required-features = ["integration-tests"]

# Reaches crate internals (test-only helpers exposed under `integration-tests`).
[[test]]
name = "ingestion"
path = "tests/ingestion.rs"
required-features = ["integration-tests"]