[package]
name = "cellos-core"
version = "0.7.3"
edition.workspace = true
rust-version.workspace = true
license.workspace = true
description = "CellOS domain types and ports — typed authority, formation DAG, CloudEvent envelopes, RBAC primitives. No I/O."
readme = "README.md"
repository.workspace = true
homepage.workspace = true
documentation = "https://docs.rs/cellos-core"
keywords = ["cellos", "authority", "cloudevents", "rbac", "sandboxing"]
categories = ["api-bindings", "cryptography", "config"]

[dependencies]
serde.workspace = true
serde_json.workspace = true
thiserror.workspace = true
uuid.workspace = true
chrono.workspace = true
async-trait.workspace = true
url.workspace = true
zeroize = { workspace = true, features = ["derive"] }
sha2 = "0.11"
tracing.workspace = true
# Red-team wave-2 T1: `zeroize` feature wipes `SigningKey` heap bytes on drop.
# Aligns cellos-core with cellos-cortex's already-correct posture (which
# pinned the feature under "C-F1"). Transitive consumers (supervisor event
# signing, host-telemetry sign_outbound, cortex ledger) all hold long-lived
# `SigningKey` instances; uniform zeroize on drop is the contract.
ed25519-dalek = { version = "2", features = ["zeroize"] }
base64 = { workspace = true }
# HIGH-B5 (red-team wave-1, deferred through wave-2): `observability::redacted_filter`
# ships behind the `tracing-layer` feature. Off by default — binaries that
# initialize the global subscriber opt in; pure library consumers (the
# "no I/O" contract above) get nothing new on their dep graph.
tracing-subscriber = { workspace = true, optional = true }

[features]
default = []
# Pulls in `tracing-subscriber` so `observability::redacted_filter` (the
# HIGH-B5 mitigation) compiles. Every cellos binary that calls
# `tracing_subscriber::fmt().init()` should enable this and wire the filter
# into the fmt layer.
tracing-layer = ["dep:tracing-subscriber"]

[dev-dependencies]
serde_json.workspace = true
proptest = "1"
tempfile = "3"
tracing-subscriber = { workspace = true }

[lints]
workspace = true
