[package]
name = "livekit-api"
version = "0.5.2"
license.workspace = true
description = "Rust Server SDK for LiveKit"
edition.workspace = true
repository.workspace = true
readme = "README.md"

[features]
# By default ws TLS is not enabled
default = ["services-tokio", "access-token", "webhooks"]

signal-client-tokio = [
    "dep:tokio-tungstenite",
    "dep:tokio",
    "dep:futures-util",
    "dep:reqwest",
    "dep:livekit-runtime",
    "livekit-runtime/tokio",
    "dep:base64",
    "dep:flate2",
    "dep:bytes"
]

signal-client-async = [
    "__signal-client-async-compatible",
    "livekit-runtime/async"
]

signal-client-dispatcher = [
    "__signal-client-async-compatible",
    "livekit-runtime/dispatcher"
]

__signal-client-async-compatible = [
    "dep:async-tungstenite",
    "dep:tokio", # For macros and sync
    "dep:futures-util",
    "dep:isahc",
    "dep:livekit-runtime",
    "dep:base64",
    "dep:flate2",
    "dep:bytes"
]


services-tokio = ["dep:reqwest"]
services-async = ["dep:isahc"]
access-token = ["dep:jsonwebtoken", "dep:hmac", "dep:signature"]
webhooks = ["access-token", "dep:serde_json", "dep:base64"]

# TLS Configuration
# -----------------
# These features control TLS behavior for WebSocket and HTTP connections.
# Note: These features only change the behavior of tokio-tungstenite and reqwest.
# They don't change the behavior of libwebrtc/webrtc-sys.
#
# IMPORTANT FOR CONTAINER DEPLOYMENTS:
# When using `rustls-tls-native-roots`, the SDK relies on the operating system's
# CA certificate store. In container environments using slim/minimal base images,
# this store may be empty, causing TLS errors like "invalid peer certificate: UnknownIssuer".
#
# Solutions:
#   1. Install CA certificates in your Dockerfile:
#      - Debian/Ubuntu: RUN apt-get update && apt-get install -y ca-certificates
#      - Alpine: RUN apk add --no-cache ca-certificates
#
#   2. Use `rustls-tls-webpki-roots` instead, which bundles Mozilla's root
#      certificates and doesn't require system CA certificates. This is the
#      recommended option for containerized deployments. The drawback is that
#      the embedded certificates can expire, requiring a fresh build to update them.

# Uses the platform's native TLS implementation (OpenSSL on Linux, Secure Transport on macOS, SChannel on Windows)
native-tls = [
    "tokio-tungstenite?/native-tls",
    "async-tungstenite?/async-native-tls",
    "reqwest?/native-tls"
]
# Same as native-tls but compiles OpenSSL from source (useful for cross-compilation)
native-tls-vendored = [
    "tokio-tungstenite?/native-tls-vendored",
    "reqwest?/native-tls-vendored",
]
# Uses rustls with the operating system's CA certificate store.
# Requires ca-certificates to be installed in container environments.
rustls-tls-native-roots = [
    "tokio-tungstenite?/rustls-tls-native-roots",
    "reqwest?/rustls-tls-native-roots",
    "tokio-tungstenite?/__rustls-tls",
    "dep:tokio-rustls",
    "dep:rustls-native-certs"
]
# Uses rustls with Mozilla's bundled root certificates.
# RECOMMENDED for container deployments - no system CA certificates required.
rustls-tls-webpki-roots = [
    "tokio-tungstenite?/rustls-tls-webpki-roots",
    "reqwest?/rustls-tls-webpki-roots",
]
__rustls-tls = ["tokio-tungstenite?/__rustls-tls", "reqwest?/__rustls"]

[dependencies]
livekit-protocol = { workspace = true }
thiserror = { workspace = true }
serde = { workspace = true, features = ["derive"] }
sha2 = "0.10"
url = "2.3"
log = { workspace = true }
parking_lot = { workspace = true }
prost = "0.12"
pbjson-types = "0.6"

# webhooks
serde_json = { workspace = true, optional = true }
base64 = { version = "0.21", optional = true, features = ["std"] }

# access_token: HS256 only, via the in-crate HMAC CryptoProvider (jwt_provider.rs).
# Dropping jsonwebtoken's rust_crypto bundle avoids linking RSA/EC/EdDSA.
jsonwebtoken = { version = "10", default-features = false, optional = true }
hmac = { version = "0.12", optional = true }
signature = { version = "2", optional = true }

# signal_client
livekit-runtime = { workspace = true, optional = true}
tokio-tungstenite = { version = "0.29", features = ["url"], optional = true }
async-tungstenite = { version = "0.29", features = [ "async-std-runtime", "async-native-tls", "url"], optional = true }
tokio = { workspace = true, default-features = false, features = ["sync", "macros", "signal", "io-util", "net"], optional = true }
tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"], optional = true }
rustls-native-certs = { version = "0.8", optional = true }
futures-util = { workspace = true, default-features = false, features = [ "sink" ], optional = true }
bytes = { workspace = true, optional = true }

# This dependency must be kept in sync with reqwest's version
http = "1.1"
reqwest = { version = "0.12", default-features = false, features = [ "json" ], optional = true }
isahc = { version = "1.7.2", default-features = false, features = [ "json", "text-decoding" ], optional = true }

flate2 = { version = "1", optional = true }
scopeguard = "1.2.0"
rand = { workspace = true }
os_info = "3.14.0"
device-info = { workspace = true }

[dev-dependencies]
tokio = { workspace = true, features = ["rt", "rt-multi-thread", "net", "time", "macros", "io-util"] }
