# CON-007: Minimal Dependencies

> **Authoritative requirement:** [CON-007](../NORMATIVE.md#CON-007)
> **Verification:** [VERIFICATION.md](../VERIFICATION.md)
> **Tracking:** [TRACKING.yaml](../TRACKING.yaml)
> **Spec reference:** [SPEC.md](../../../../resources/SPEC.md) — Section 4.3

---

## Summary

The `dig-constants` crate MUST maintain a minimal dependency footprint, limited to `chia-consensus`, `chia-protocol`, `chia-bls`, and `hex-literal`. No additional crates beyond these four are permitted as direct dependencies. In particular, `dig-constants` must NOT depend on `dig-clvm` (which would create a circular dependency), and must NOT depend on `tokio` or any async runtime (constants are synchronous, compile-time values).

This constraint exists for two reasons. First, `dig-constants` is designed to be a lightweight import for any DIG ecosystem crate (CON-001). Every additional dependency increases compile time and binary size for all consumers. Second, the crate defines compile-time constants — there is no runtime behavior that would require I/O, networking, async execution, or complex data structures beyond what the Chia ecosystem crates provide.

The four allowed dependencies serve specific purposes: `chia-consensus` provides the `ConsensusConstants` type that `NetworkConstants` wraps; `chia-protocol` provides the `Bytes32` type used for genesis challenges and AGG_SIG data; `chia-bls` provides BLS types that may be needed for signature-related constants; and `hex-literal` provides the `hex!()` macro for readable hexadecimal byte array literals in `const` contexts.

---

## Specification

### Allowed Dependencies

```toml
# dig-constants/Cargo.toml

[dependencies]
chia-consensus = { version = "..." }    # ConsensusConstants type
chia-protocol = { version = "..." }      # Bytes32, wire format types
chia-bls = { version = "..." }           # BLS types (G1Element, G2Element)
hex-literal = { version = "..." }        # hex!() macro for const byte arrays
```

### Forbidden Dependencies

```toml
# NONE of these may appear in [dependencies]:

# Circular dependency — would make dig-constants depend on CLVM engine
dig-clvm = { ... }           # FORBIDDEN

# Async runtimes — constants are compile-time, no async needed
tokio = { ... }              # FORBIDDEN
async-std = { ... }          # FORBIDDEN

# Storage — constants don't touch disk
rusqlite = { ... }           # FORBIDDEN
sled = { ... }               # FORBIDDEN
rocksdb = { ... }            # FORBIDDEN

# Networking — constants don't make network calls
reqwest = { ... }            # FORBIDDEN
hyper = { ... }              # FORBIDDEN

# Serialization frameworks — Streamable comes from chia-protocol
serde = { ... }              # FORBIDDEN (unless already transitive)
serde_json = { ... }         # FORBIDDEN

# Heavy crypto — BLS comes from chia-bls
ring = { ... }               # FORBIDDEN
openssl = { ... }            # FORBIDDEN
```

### Dependency Tree Audit

```bash
# To verify minimal dependencies:
cd dig-constants
cargo tree --depth 1

# Expected output (approximately):
# dig-constants v0.1.0
# ├── chia-bls v...
# ├── chia-consensus v...
# ├── chia-protocol v...
# └── hex-literal v...

# Transitive dependencies are acceptable (e.g., chia-consensus
# pulls in clvmr internally), but direct dependencies must be
# limited to the four allowed crates.
```

### No Circular Dependencies

```
# This dependency graph is correct:
dig-constants → chia-consensus
dig-constants → chia-protocol
dig-constants → chia-bls
dig-constants → hex-literal
dig-clvm → dig-constants  (one-way dependency)

# This would be WRONG (circular):
dig-constants → dig-clvm → dig-constants  # FORBIDDEN
```

### No Async

```rust
// dig-constants does NOT use any async features:

// WRONG:
async fn get_constants() -> NetworkConstants { ... }

// CORRECT:
pub const DIG_MAINNET: NetworkConstants = NetworkConstants::new(...);
// Everything is const or pure synchronous.
```

### Dev Dependencies

Dev dependencies (for testing) have more flexibility:

```toml
[dev-dependencies]
# These are acceptable for tests:
sha2 = { version = "..." }      # For verifying AGG_SIG derivation
```

### Build Dependencies

```toml
[build-dependencies]
# No build dependencies needed.
# All constants are defined inline.
```

---

## Acceptance Criteria

- [ ] `dig-constants` Cargo.toml `[dependencies]` contains only `chia-consensus`, `chia-protocol`, `chia-bls`, and `hex-literal`.
- [ ] `dig-clvm` does NOT appear in `dig-constants` dependencies (no circular dependency).
- [ ] `tokio` and other async runtimes do NOT appear in `dig-constants` dependencies.
- [ ] `cargo tree --depth 1` for `dig-constants` shows only the four allowed direct dependencies.
- [ ] The crate compiles without any I/O, storage, or networking capabilities.

---

## Implementation Notes

- **Primary file:** `dig-constants/Cargo.toml` (dependency declarations).
- **Transitive dependencies:** `chia-consensus` itself has many transitive dependencies (including `clvmr`, `sha2`, etc.). These are acceptable — the constraint is on DIRECT dependencies only. `dig-constants` consumers who also depend on `chia-consensus` share these transitive deps.
- **Feature flags:** If `chia-consensus`, `chia-protocol`, or `chia-bls` have optional features, `dig-constants` should enable only the minimum features needed. For example, `py-bindings` features should be disabled.
- **Version pinning:** The versions of `chia-consensus`, `chia-protocol`, and `chia-bls` should be aligned with what `dig-clvm` uses to avoid duplicate types. Cargo workspace `[workspace.dependencies]` is the recommended approach.
- **hex-literal is zero-cost:** `hex-literal` is a proc-macro crate that expands at compile time. It adds zero runtime overhead and zero binary size — it is purely a convenience for writing `hex!("...")` instead of manual byte arrays.
- **serde consideration:** If `chia-protocol::Bytes32` requires `serde` for Streamable, it will appear as a transitive dependency of `chia-protocol`. This is acceptable. The prohibition is on DIRECT `serde` dependency in `dig-constants`.
- **CI enforcement:** Consider adding a CI check that audits `dig-constants/Cargo.toml` for unauthorized dependencies. This can be a simple grep in the CI pipeline.

---

## Verification

### Test Plan

| Test | Type | Description | Expected Result |
|------|------|-------------|-----------------|
| Direct deps only 4 | Build test | `cargo tree --depth 1` in dig-constants | Only 4 direct deps |
| No dig-clvm dep | Build test | `cargo tree` \| grep dig-clvm | Not found |
| No tokio dep | Build test | `cargo tree` \| grep tokio | Not found in direct deps |
| Compiles alone | Build test | `cd dig-constants && cargo build` | Success with minimal deps |
| No I/O imports | Code review | Search for std::fs, std::net, tokio in src/ | None found |
| Feature flags minimal | Cargo.toml review | Check feature flags on each dependency | Only necessary features |

---

## Source Citations

- **SPEC.md Section 4.3**: "chia-consensus, chia-protocol, chia-bls, hex-literal only. No dig-clvm dependency (avoid circular). No tokio/async."
- **SPEC.md Section 4.3**: Dependency constraint rationale — lightweight import for ecosystem crates.
- **Cargo reference:** Workspace dependencies for version alignment.

---

## References

- [CON-001](CON-001.md) — Separate dig-constants crate (lightweight import motivation)
- [CON-002](CON-002.md) — NetworkConstants type (uses chia-consensus types)
- [CON-005](CON-005.md) — AGG_SIG derivation (may use sha2 from chia-consensus transitive deps)
- [VAL-015](../../validation/specs/VAL-015.md) — No full UTXO set (same minimal-dependency philosophy)
