kernal-api 0.1.21

[package]
name = "kernal-api"
version = "0.1.21"
build = "build.rs"
edition = "2021"
rust-version = "1.95.0"
description = "Async OS HAL, profiling, symbolization, and allocator instrumentation"
license = "BSD-3-Clause"
repository = "https://github.com/zackees/kernal-api"
homepage = "https://github.com/zackees/kernal-api"
readme = "README.md"
keywords = ["async", "profiling", "process", "hal", "diagnostics"]
categories = ["asynchronous", "development-tools::profiling", "os"]
# The published crate is source and nothing else, named file by file. An
# exclude list let `cargo package` sweep in whatever untracked file sat in
# the checkout: v0.1.14's crate was 1.28 GB of setup-soldr cache archives
# (`target.soldr-*.tar.zst`) and crates.io rejected it (413, 10 MiB cap).
# `ci/crate_release.py check` holds the package to this list and that cap.
include = [
    "/Cargo.toml",
    "/Cargo.lock",
    "/build.rs",
    "/README.md",
    "/LICENSE",
    "/NOTICE",
    # Generated by the release from the verified ConPTY sidecars; build.rs
    # renders its hashes into the crate.
    "/conpty-sidecar.sha256.toml",
    "/src/**",
    # `src` reaches into `tests/` (#[path] support modules, fixtures), and
    # the integration tests are source too.
    "/tests/**",
    # The `wasm-admission` example and the `kernal-api-wasm-tauri` binary.
    "/examples/wasm-admission.rs",
    "/examples/wasm-tauri-screenshot/runner.rs",
    "/examples/wasm-tauri-screenshot/status.rs",
]

[lib]
name = "kernal_api"
path = "src/lib.rs"

[[example]]
name = "wasm-admission"
required-features = ["wasm-sketch-host"]

[[bin]]
name = "kernal-symbolize"
path = "src/bin/kernal-symbolize.rs"
required-features = ["symbolize-worker"]

[[bin]]
name = "kernal-wasm-worker"
path = "src/bin/kernal-wasm-worker.rs"
required-features = ["wasm-sketch-worker"]

[[bin]]
name = "kernal-tauri-smoke"
path = "src/bin/kernal-tauri-smoke.rs"
required-features = ["tauri-webview-test-support"]

[[bin]]
name = "kernal-api-wasm-tauri"
path = "examples/wasm-tauri-screenshot/runner.rs"
required-features = ["wasm-sketch-worker", "tauri-webview"]

[features]
default = []
# Temporary private candidate selection for #13; not a supported second runtime.
wasm-component-hash-experiment = ["dep:wit-bindgen"]
wasm-component-compiler-experiment = [
  "wasm-component-hash-experiment",
  "wit-bindgen?/async",
  "wasmtime?/component-model",
  "wasmtime?/component-model-async",
]
# Canonical resource-independent launch contract. This stays opt-in: ordinary
# inherited process operations remain the useful default HAL and do not select
# scheduler/broker serialization or control code.
independent-spawn = ["running-process/independent-spawn"]
# Bounded OS entropy, independent of crash/profiling facilities.
secure-random = ["dep:getrandom"]
# Synchronous, bounded SQLite mechanics.  Applications retain schema, SQL,
# migrations, and scheduling policy; run this facade on a kernel blocking worker.
sqlite = ["dep:rusqlite", "dep:tempfile"]
text-similarity = ["dep:strsim"]
command-arguments = ["dep:shell-words"]
command-schema = ["dep:clap"]
# Owned, bounded application-error context without a third-party error carrier.
error-context = []
config-toml = ["dep:toml"]
json = ["dep:serde", "dep:serde_json"]
source-cpp = ["dep:tree-sitter", "dep:tree-sitter-cpp"]
terminal-style = []
# Native terminal capture and key decoding without PTY process spawning.
terminal-input = []
# Advisory locking and modification-time setting are implemented natively
# per host (see `src/platform_linux/fs.rs`, `src/platform_macos/fs.rs`,
# `src/platform_win/fs.rs`) rather than through a wrapper crate, matching the
# rest of this feature. Reflink copy, parallel directory walking, and glob
# matching genuinely need a maintained backend -- there is no std equivalent,
# and the on-disk correctness cost of a hand-rolled reflink ioctl is high --
# so those three stay private dependencies behind this facade.
fs = ["dep:dirs", "dep:globset", "dep:jwalk", "dep:reflink-copy", "dep:tempfile"]
# Filesystem-change-notification primitive: watcher construction and event
# classification only, not debouncing, ignore-lists, or cache-invalidation
# policy. Linux and macOS privately adapt the exact-pinned `notify` release;
# Windows never depends on `notify` at all -- it privately implements
# `ReadDirectoryChangesW` watching with two fixes upstream `notify` 7.0.0
# does not have. See `src/platform_win/fs_watch.rs` for the rationale.
fs-watch = ["dep:notify"]
ipc = ["dep:dirs", "dep:interprocess"]
ipc-async = ["ipc", "interprocess/tokio", "tokio/net"]
session-relay = ["ipc-async"]
# Direct-daemon identity is opt-in.  It keeps the frozen running-process v1
# probe/sidecar/mux implementation private while applications keep ownership
# of endpoint selection and payload protocols.
daemon-identity = ["running-process/backend-identity"]
# Frozen v1 frame envelope only. This stays independent from daemon identity,
# broker IPC, hashes, and runtimes so applications can retain their endpoint
# and payload policy while using the shared wire codec.
daemon-frame-v1 = ["running-process/frame-v1-codec"]
# Frozen v1 daemon registration records and owner-private persistence. This
# deliberately excludes endpoint/client policy, daemon runtime, and identity.
daemon-registration = ["running-process/daemon-registration"]
# Frozen v2 service-definition registration only. This is deliberately
# separate from v1 records and pulls no broker client, identity, IPC, or
# runtime policy into applications that dual-write during the v1-to-v2 rollout.
daemon-registration-v2 = ["running-process/daemon-registration-v2"]
# Facade-owned broker client adapter: backend connect plus owned route, refusal,
# and error classification. The broker implementation stays in running-process;
# its `client` feature is heavy (clap, interprocess, anyhow, toml), so this is
# opt-in and outside `full`.
broker-client = ["running-process/client"]
pty = ["dep:portable-pty", "terminal-input"]
event-stream = ["dep:futures-core", "dep:tokio-stream", "tokio-stream/sync"]
http-server = ["dep:hyper", "hyper/server", "hyper/http1", "dep:hyper-util", "dep:http-body-util", "dep:bytes", "dep:futures-core"]
# HTTP/1 WebSocket upgrading remains part of the owned server surface: callers
# exchange facade messages and never name Hyper or a WebSocket implementation.
websocket = ["http-server", "dep:futures-util", "dep:tokio-tungstenite"]
# Build-script helper: Windows executable resources (icon, version info,
# Common-Controls v6 manifest) for an application's own `build.rs`, taken as a
# second, same-name `kernal-api` build-dependency with only this feature.
# Cargo keeps `[dependencies]` features out of that build-dependency, but a
# `kernal-api/feature` entry in the application's own feature table reaches it,
# and Cargo rejects renaming one package twice; see src/build_resources.rs.
build-resources = ["dep:embed-resource"]
# Window-icon and stock-icon mechanics for the host console or a child. This
# is GUI hosting: on Linux it decodes PNG and speaks the X11 client protocol,
# so it is gated like every peer capability rather than sitting in the
# `default = []` process/host HAL. macOS and Windows need no extra backend,
# but the feature name is host-independent so a client enables one capability
# rather than one host.
#
# This does not yet remove `png`/`x11rb` from the default *graph*:
# `running-process-platform-internal` 4.10.12 declares both as non-optional
# `cfg(target_os = "linux")` dependencies and `running-process` is mandatory
# here, so they resolve regardless. What this gates is the code and public
# surface this crate owns; the graph reduction follows when the substrate
# gates its own copy.
window-icon = ["dep:png", "dep:x11rb"]
# Untrusted external web content is an explicit, heavyweight native capability.
# The private implementation uses tauri-runtime-wry directly because Tauri's
# high-level WebviewWindowBuilder installs an IPC bridge even for an external
# URL.  Keep the exact Tauri release in the resolved feature graph while the
# runtime supplies the canonical event loop, while Wry's builder is attached
# directly to its plain native window without an IPC handler.
tauri-webview = [
  "dep:tauri",
  "dep:tauri-runtime",
  "dep:tauri-runtime-wry",
  "dep:tauri-utils",
  "dep:url",
  "dep:wry",
  "dep:webkit2gtk",
  "dep:gtk",
  "dep:gio",
  "dep:cairo-rs",
  "dep:webview2-com",
  "dep:windows",
  "dep:windows-core",
  "dep:block2",
  "dep:objc2-app-kit",
  "dep:objc2-foundation",
  "dep:objc2-core-foundation",
  "dep:objc2-core-graphics",
  "dep:objc2-image-io",
  "dep:objc2-web-kit",
]
# Private acceptance-only observation for the process-main-thread smoke
# executable. It exposes semantic counts only, never a Tauri/Wry/native type.
tauri-webview-test-support = ["tauri-webview", "dep:png"]
hash-sha256 = ["dep:sha2"]
archive = ["dep:zip", "dep:tar", "dep:zstd", "dep:flate2"]
# Test-only native authentication and guest-header experiment.
archive-auth-test-support = ["archive", "dep:openssl", "dep:tempfile"]
http-client = ["dep:reqwest", "dep:bytes", "dep:hyper"]
conpty-sidecar = [
  "pty",
  "dep:dirs",
  "hash-sha256",
  "dep:tar",
  "dep:ureq",
  "dep:zstd",
]
snapshot = ["dep:framehop", "dep:object"]
profile = [
  "snapshot",
  "dep:flate2",
  "dep:prost",
  "dep:serde",
  "dep:serde_json",
]
allocator = ["dep:mimalloc-pprof"]
crash = ["snapshot", "dep:crash-handler", "dep:getrandom"]
tokio-console = [
  "profile",
  "dep:console-api",
  "dep:console-subscriber",
  "dep:prost-types",
  "dep:tokio-stream",
  "dep:tonic",
  "dep:tracing",
  "dep:tracing-subscriber",
  "tokio/net",
  "tokio/time",
]
symbolize = [
  "dep:prost",
]
# Post-link debug-symbol splitting (#78): given a linked binary, produce a
# stripped binary plus a complete, matched symbol file and report the mechanism
# used. Separate from `symbolize-worker` because it is a packaging-time
# operation that reads object files rather than a parser shipped in the worker;
# it needs `object` only to read identities and section presence, and it asks
# the worker -- not an in-process parser -- to prove the pair resolves.
symbolize-split = [
  "symbolize",
  "dep:object",
]
symbolize-worker = [
  "symbolize",
  "dep:addr2line",
  "dep:lzma-rs",
  "dep:object",
  "dep:pdb",
  "dep:pdb-addr2line",
  "hash-sha256",
  "dep:tempfile",
  "dep:url",
  "dep:ureq",
]
# The sketch host is intentionally isolated from ordinary async/process users.
# It uses core Wasm plus Cranelift; WASI, the Component Model, pooling, Winch,
# and a second executor remain out of this first admission-only slice.
wasm-sketch-host = ["dep:wasmtime", "dep:wasmparser", "fs"]
# Private one-request worker protocol; the executable/supervisor follows in
# phase B. Keeping this separate preserves default-feature isolation.
wasm-sketch-worker = ["wasm-sketch-host", "dep:tempfile", "dep:cap-std"]
# Deliberately test-only: permits the private worker supervisor to publish an
# exact native identity to an externally controlled containment harness.
wasm-sketch-worker-test-support = ["wasm-sketch-worker"]
full = [
  "allocator",
  "conpty-sidecar",
  "crash",
  "fs",
  "fs-watch",
  "ipc-async",
  "profile",
  "session-relay",
  "symbolize",
  "symbolize-split",
  "tokio-console",
  "window-icon",
]

[dependencies]
# Portable decoding is opt-in for native screenshot proofs and window icons.
png = { version = "=0.17.16", optional = true }
reqwest = { version = "=0.12.28", default-features = false, features = ["default-tls"], optional = true }
rusqlite = { version = "=0.40.2", default-features = false, features = ["bundled", "backup"], optional = true }
# Constrain reqwest's private parser for published consumers, not just this
# repository's lockfile. Its metadata bounds are audited in docs/http-client.md.
hyper = { version = "=1.11.0", default-features = false, optional = true }
hyper-util = { version = "=0.1.20", default-features = false, features = ["tokio"], optional = true }
http-body-util = { version = "=0.1.5", optional = true }
bytes = { version = "=1.12.1", optional = true }
console-api = { version = "=0.9.0", optional = true }
console-subscriber = { version = "=0.5.0", optional = true }
crash-handler = { version = "=0.7.0", optional = true }
# Resource-compiler driver for `build-resources`; runs in the application's
# build script and picks rc.exe/llvm-rc from that script's environment.
embed-resource = { version = "=3.0.11", optional = true }
dirs = { version = "=6.0.0", optional = true }
flate2 = { version = "=1.1.9", optional = true }
framehop = { version = "=0.13.3", optional = true }
futures-core = { version = "=0.3.34", optional = true }
futures-util = { version = "=0.3.34", default-features = false, features = ["sink"], optional = true }
getrandom = { version = "=0.4.3", optional = true }
strsim = { version = "=0.11.1", optional = true }
toml = { version = "=0.8.23", optional = true }
shell-words = { version = "=1.1.1", optional = true }
clap = { version = "=4.6.0", features = ["std", "string"], optional = true }
tree-sitter = { version = "=0.26.11", optional = true }
tree-sitter-cpp = { version = "=0.23.4", optional = true }
globset = { version = "=0.4.18", optional = true }
interprocess = { version = "=2.4.3", optional = true }
jwalk = { version = "=0.8.1", optional = true }
mimalloc-pprof = { version = "=0.9.4", optional = true }
portable-pty = { version = "=0.9.0", optional = true }
prost = { version = "=0.14.4", optional = true }
prost-types = { version = "=0.14.4", optional = true }
# Exact-pinned per the issue tracking this facade: reflink semantics are
# filesystem-specific and this crate's correctness (and zccache's) depends on
# the exact set of supported hosts/filesystems this release covers.
reflink-copy = { version = "=0.1.30", optional = true }
serde = { version = "=1.0.229", features = ["derive"], optional = true }
serde_json = { version = "=1.0.151", optional = true, features = ["raw_value"] }
sha2 = { version = "=0.10.9", optional = true }
tar = { version = "=0.4.46", default-features = false, optional = true }
zip = { version = "=2.4.2", optional = true }
openssl = { version = "=0.10.81", features = ["vendored"], optional = true }
tempfile = { version = "=3.27.0", optional = true }
cap-std = { version = "=4.0.3", optional = true }
thiserror = "=2.0.20"
tokio-stream = { version = "=0.1.19", optional = true }
tokio-tungstenite = { version = "=0.28.0", default-features = false, features = ["handshake"], optional = true }
tonic = { version = "=0.14.6", default-features = false, features = [
  "codegen",
  "transport",
], optional = true }
tracing = { version = "=0.1.44", optional = true }
tracing-subscriber = { version = "=0.3.23", optional = true }
ureq = { version = "=2.12.1", default-features = false, features = ["tls"], optional = true }
url = { version = "=2.5.8", optional = true }
wasmtime = { version = "=45.0.0", default-features = false, features = [
  "async",
  "cranelift",
  "runtime",
  "threads",
], optional = true }
wasmparser = { version = "=0.248.0", default-features = false, optional = true }
zstd = { version = "=0.13.3", default-features = false, optional = true }

[target.'cfg(unix)'.dependencies]
libc = "=0.2.189"

[target.'cfg(target_family = "wasm")'.dependencies]
wit-bindgen = { version = "=0.58.0", default-features = false, features = ["macros", "realloc", "std"], optional = true }

# The guest uses the generated kernel ABI, not a native runtime or OS substrate.
# These remain mandatory (not feature-optional) for every native consumer.
[target.'cfg(not(target_family = "wasm"))'.dependencies]
# Exact first-party pre-1.0 pin. Most substrate APIs remain private behind
# facade-owned semantic types. The opt-in `independent-spawn` feature is the
# narrowly scoped exception: its live handles and options cross this boundary
# unchanged, so callers and the substrate share type identity.
running-process = { version = "=4.10.14", default-features = false, features = ["kernel-substrate"] }
# `rayon` backs native parallel memory-mapped hashing; its global pool is lazy.
# Keep native SIMD enabled: Soldr supplies the clang/SDK needed by BLAKE3's
# ARM64 NEON C backend, including Linux-hosted Windows ARM64 cross-checks.
blake3 = { version = "=1.8.7", features = ["rayon"] }
memmap2 = "=0.9.11"
sysinfo = "=0.30.13"
tokio = { version = "=1.53.1", default-features = false, features = [
  "fs", "io-util", "macros", "net", "process", "rt", "rt-multi-thread",
  "signal", "sync", "time",
] }

[target.'cfg(any(target_os = "linux", target_os = "macos"))'.dependencies]
object = { version = "=0.36.7", default-features = false, features = ["read", "std"], optional = true }
# Linux and macOS carry no divergence from the published release -- the fork
# zccache and soldr vendored exists only for the Windows fixes this crate
# implements privately in `src/platform_win/fs_watch.rs` -- so this depends
# on the exact upstream `notify` release directly. Default features are kept
# so macOS retains its `macos_fsevent` backend.
notify = { version = "=7.0.0", optional = true }

# A webview is a native desktop facility. Keeping these declarations target
# scoped ensures enabling its feature for a Wasm guest never resolves a web
# runtime for that guest target.
[target.'cfg(any(target_os = "linux", target_os = "macos", target_os = "windows"))'.dependencies]
tauri = { version = "=2.11.5", default-features = false, optional = true }
tauri-runtime = { version = "=2.11.3", optional = true }
tauri-runtime-wry = { version = "=2.11.4", default-features = false, optional = true }
tauri-utils = { version = "=2.9.3", optional = true }
# 0.57 makes the no-handler Windows/macOS IPC bridge conditional. Published
# Tauri runtime still uses private Wry 0.55 for its event-loop integration;
# only this direct Wry creates the facade's isolated external webviews.
wry = { version = "=0.57.0", default-features = false, features = ["os-webview"], optional = true }

[target.'cfg(target_os = "linux")'.dependencies]
gio = { version = "=0.18.4", optional = true }
cairo-rs = { version = "=0.18.5", features = ["png"], optional = true }
addr2line = { version = "=0.24.2", default-features = false, features = ["std", "loader"], optional = true }
lzma-rs = { version = "=0.3.0", optional = true }
x11rb = { version = "=0.13.2", optional = true }
# These are the exact GTK/WebKitGTK bindings linked privately by the pinned
# Wry/Tauri runtime. The facade uses them only for WebKitGTK host setup and
# permission signals; neither crate crosses the public webview boundary.
gtk = { version = "=0.18.2", optional = true }
webkit2gtk = { version = "=2.0.2", features = ["v2_40"], optional = true }

[target.'cfg(target_os = "macos")'.dependencies]
block2 = { version = "=0.6.2", optional = true }
objc2-app-kit = { version = "=0.3.2", optional = true, default-features = false, features = ["std", "NSImage", "NSImageRep", "NSGraphicsContext", "NSView", "NSWindow", "objc2-core-graphics"] }
objc2-foundation = { version = "=0.3.2", optional = true, default-features = false, features = ["std", "NSError"] }
objc2-core-foundation = { version = "=0.3.2", optional = true, default-features = false, features = ["std", "CFString"] }
objc2-core-graphics = { version = "=0.3.2", optional = true, default-features = false, features = ["std", "CGDataConsumer", "CGImage"] }
objc2-image-io = { version = "=0.3.2", optional = true, default-features = false, features = ["std", "CGImageDestination", "objc2-core-graphics"] }
objc2-web-kit = { version = "=0.3.2", optional = true, default-features = false, features = ["std", "WKWebView", "WKSnapshotConfiguration", "block2"] }
addr2line = { version = "=0.24.2", default-features = false, features = ["std", "loader"], optional = true }
lzma-rs = { version = "=0.3.0", optional = true }
mach2 = "=0.4.3"

[target.'cfg(windows)'.dependencies]
webview2-com = { version = "=0.39.1", optional = true }
windows = { version = "=0.62.2", optional = true, features = ["Win32_System_Com", "Win32_Foundation"] }
windows-core = { version = "=0.62.2", optional = true }
libc = "=0.2.189"
object = { version = "=0.36.7", default-features = false, features = ["read", "std"], optional = true }
pdb = { version = "=0.8.0", optional = true }
pdb-addr2line = { version = "=0.12.1", optional = true }
widestring = "=1.2.1"
winapi = { version = "=0.3.9", features = [
  "consoleapi",
  "errhandlingapi",
  "fileapi",
  "handleapi",
  "ioapiset",
  "jobapi2",
  "memoryapi",
  "minwindef",
  "namedpipeapi",
  "processenv",
  "processthreadsapi",
  "psapi",
  "securitybaseapi",
  "synchapi",
  "tlhelp32",
  "winbase",
  "wincon",
  "wincontypes",
  "windef",
  "winerror",
  "winnt",
  "winuser",
] }
windows-sys = { version = "=0.61.2", features = [
  "Wdk_System_Threading",
  "Win32_Foundation",
  "Win32_Security",
  "Win32_Security_Authorization",
  "Win32_Storage_FileSystem",
  "Win32_System_Console",
  "Win32_System_Diagnostics_Debug",
  "Win32_System_Environment",
  "Win32_System_IO",
  "Win32_System_Ioctl",
  "Win32_System_JobObjects",
  "Win32_System_Kernel",
  "Win32_System_LibraryLoader",
  "Win32_System_Memory",
  "Win32_System_Pipes",
  "Win32_System_Registry",
  "Win32_System_SystemInformation",
  "Win32_System_Threading",
] }

[dev-dependencies]
native-tls = "=0.2.18"
tempfile = "=3.27.0"
tokio = { version = "=1.53.1", features = ["macros", "rt-multi-thread", "test-util", "time"] }

[build-dependencies]
toml = "=0.8.23"

[package.metadata.docs.rs]
# `full` deliberately excludes the four daemon slices (enforced by
# `tests/facade_policy.rs`), so documenting only `full` renders none of them.
# They are the frozen-wire surfaces client migrations depend on, and a reader
# who cannot see them concludes the facade does not own them yet. List them
# here explicitly; this is a documentation set, not a supported bundle.
features = [
  "full",
  "independent-spawn",
  "config-toml",
  "json",
  "source-cpp",
  "daemon-identity",
  "daemon-frame-v1",
  "daemon-registration",
  "daemon-registration-v2",
  "broker-client",
  "build-resources",
]
rustdoc-args = ["--cfg", "docsrs"]
targets = [
  "aarch64-apple-darwin",
  "aarch64-pc-windows-msvc",
  "aarch64-unknown-linux-gnu",
  "x86_64-apple-darwin",
  "x86_64-pc-windows-msvc",
  "x86_64-unknown-linux-gnu",
]

[lints]
workspace = true

[workspace]
exclude = ["src/wasm/generated/v1/guest"]

# Every warning is an error, in every build of every package here: CI, local
# builds, tests and clippy alike. Dependents pulling this crate from a
# registry are unaffected; Cargo caps lints for registry dependencies.
[workspace.lints.rust]
warnings = "deny"

[workspace.metadata.dylint]
libraries = [{ path = "dylints/*" }]

# This public facade intentionally centralizes code that previously lived in
# several crates. Keep the local dev/test unit single-codegen so Soldr's
# exclusive amalgamation admission also bounds rustc's internal parallelism.
# First-party client workspaces mirror these package overrides at their roots;
# dependency profile settings are otherwise ignored by Cargo.
[profile.dev]
codegen-units = 1

[profile.test]
codegen-units = 1