[package]
name = "krafka"
version = "0.8.0"
edition = "2024"
rust-version = "1.88"
authors = ["hupe1980"]
description = "A pure Rust, async-native Apache Kafka client"
license = "MIT"
repository = "https://github.com/hupe1980/krafka"
documentation = "https://docs.rs/krafka"
readme = "README.md"
keywords = ["kafka", "async", "streaming", "messaging"]
categories = ["network-programming", "asynchronous"]

[dependencies]
# Async runtime
tokio = { version = "1.26", features = ["rt-multi-thread", "net", "io-util", "time", "sync", "macros"] }
tokio-util = { version = "0.7", default-features = false, features = ["time"] }

# Zero-copy buffers
bytes = "1"

# Error handling
thiserror = "2"

# Stream trait for async iteration
futures-core = "0.3"

# Logging and tracing
tracing = "0.1"

# Compression (`flate2` is always compiled; the remaining codecs are individually feature-gated)
flate2 = "1"                                          # unconditional: used for record-batch gzip and Glue ZLIB
snap = { version = "1", optional = true }             # snappy
lz4_flex = { version = "0.11", optional = true }      # lz4
zstd = { version = "0.13", optional = true }          # zstd (requires C toolchain via zstd-sys)

# CRC32 for protocol
crc32c = "0.6"

# Random number generation
rand = "0.9"

# Synchronization (non-poisoning RwLock)
parking_lot = "0.12"

# TCP keepalive configuration
socket2 = "0.5"

# Date/time parsing for AWS SigV4 clock-skew extraction from broker errors.
time = { version = "0.3", default-features = false, features = ["std", "parsing", "macros"] }

# Cryptography for SASL/SCRAM
sha2 = "0.10"
hmac = "0.12"
pbkdf2 = { version = "0.12", default-features = false, features = ["hmac"] }
base64 = "0.22"
zeroize = { version = "1.8", features = ["derive"] }
subtle = "2"

# TLS/SSL support
tokio-rustls = "0.26"
rustls = { version = "0.23", default-features = false, features = ["std", "tls12", "ring"] }
rustls-pemfile = "2"
webpki-roots = "0.26"
rustls-native-certs = { version = "0.8", optional = true }

# AWS SDK for MSK IAM authentication (optional)
# Note: The aws-config crate adds ~2-3 MB to binary size (release build).
# For smaller binaries, use AwsMskIamCredentials::from_env() which
# works without the aws-msk feature (manual credential loading).
aws-config = { version = "1", optional = true }
aws-credential-types = { version = "1", optional = true }
aws-sdk-glue = { version = "1", optional = true }
arc-swap = "1.9.0"

# SOCKS5 proxy support (optional)
tokio-socks = { version = "0.5", optional = true }

# Schema Registry HTTP client (optional)
reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"], optional = true }
serde = { version = "1", features = ["derive"], optional = true }
serde_json = { version = "1", optional = true }

[features]
default = ["compression"]
# Enable pure-Rust compression codecs.
compression = ["gzip", "snappy", "lz4"]
# Enable all compression codecs, including zstd.
compression-all = ["compression", "zstd"]
# Enable gzip record-batch compression/decompression codepaths.
# NOTE: `flate2` is always compiled (required for Glue ZLIB); this feature
# gates the gzip *codec selection* at runtime, not the dependency itself.
gzip = []
# Enable Snappy compression.
snappy = ["dep:snap"]
# Enable LZ4 compression.
lz4 = ["dep:lz4_flex"]
# Enable Zstd compression (requires C toolchain via zstd-sys).
zstd = ["dep:zstd"]
# Enable AWS MSK IAM authentication with full SDK credential chain support.
# This adds the AWS SDK for automatic credential discovery (EC2, ECS, EKS, SSO).
# Binary size impact: +2-3 MB (release build).
# If binary size is critical, use manual credential loading with AwsMskIamCredentials::from_env()
# which works without this feature.
aws-msk = ["dep:aws-config", "dep:aws-credential-types"]
# Enable the built-in Confluent Schema Registry HTTP client.
# The core schema_registry module (wire format, trait, caching) is always available.
schema-registry = ["dep:reqwest", "dep:serde", "dep:serde_json"]
# Enable the AWS Glue Schema Registry SDK client.
# The core glue module (wire format, trait, caching) is always available.
# This feature adds the aws-sdk-glue dependency for direct Glue API calls.
aws-glue-schema-registry = ["dep:aws-sdk-glue", "dep:aws-config"]
# Allow disabling TLS certificate verification (MITM risk!).
# Only enable for local development or testing with self-signed certificates.
# Requires calling `TlsConfig::insecure()`.
danger-insecure-tls = []
# Enable loading platform-native root certificates for TLS client verification.
# When enabled, `TlsConfig::with_native_roots()` can use the OS trust store.
native-tls-roots = ["dep:rustls-native-certs"]
# Enable cutting-edge protocol versions that target unreleased Kafka builds.
# Includes Fetch v17-v18, ApiVersions v5, InitProducerId v6, and Share Groups.
unstable-protocol = []
# Enable KIP-714 client telemetry APIs (GetTelemetrySubscriptions, PushTelemetry).
telemetry = []
# Enable SOCKS5 proxy support for connecting to brokers through a proxy.
# Useful for VPN/bastion host setups where brokers are not directly reachable.
socks5 = ["dep:tokio-socks"]

[dev-dependencies]
tokio-test = "0.4"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
criterion = { version = "0.5", features = ["async_tokio"] }
rstest = "0.25"
testcontainers = "0.27"

[[bench]]
name = "producer"
harness = false

[[bench]]
name = "consumer"
harness = false

[[bench]]
name = "protocol"
harness = false

[package.metadata.docs.rs]
all-features = true
rustdoc-args = ["--cfg", "docsrs"]

[lints.rust]
unsafe_code = "deny"
missing_docs = "warn"
unexpected_cfgs = { level = "warn", check-cfg = ['cfg(docsrs)'] }
rust_2018_idioms = { level = "warn", priority = -1 }

[lints.clippy]
unwrap_used = "warn"
expect_used = "warn"
panic = "warn"
undocumented_unsafe_blocks = "warn"

[profile.release]
lto = true
codegen-units = 1
