1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
[]
= "offline-protocol"
= true
= true
= true
= true
# AGPL-3.0-only requires the license text to accompany the program, and a
# published crate ships on its own. Rather than `license-file = "../../LICENSE"`
# (which makes cargo warn that `license` and `license-file` are redundant on
# every invocation), each publishable crate carries its own byte-identical
# LICENSE copy; cargo packages every git-tracked file under the crate root, so
# it lands in the .crate archive. scripts/check-license-consistency.sh asserts
# the copies never drift.
= true
= true
= "Main protocol engine for the Offline Protocol SDK"
[]
= true
[]
= ["data", "telemetry-pipe", "file-store"]
# Replicated documents. Gates the engine dependency and the store, never the
# configuration section, the storage categories, or the events: those are
# inert without the engine and gating them would fork the config surface and
# the events guard test for no binary saving.
= ["dep:offline-protocol-data"]
# The telemetry pipe: classification, the durable batch queue, and the HTTPS
# uploader that ships accepted events to the ingest. Gates the only network
# egress, the only background thread and the only TLS stack in the workspace,
# so a build that wants none of those (a bench, a bare embedder) opts out with
# `default-features = false`. Default on for the same reason `data` is: the
# mobile bindings ship one FFI artifact, and a feature-gated UDL method would
# be a runtime checksum mismatch rather than a build error.
= ["dep:ureq", "dep:rustls", "dep:offline-protocol-telemetry-wire"]
# Test seams: a capturing stand-in for the telemetry pipe's HTTPS client, so
# a test in another crate can see every upload without a network. Enabled by
# dev-dependencies only; a shipped binary never carries it.
= []
# The built-in file stores (`offline_protocol::file_store`): protocol state in
# the bindings' shared file format, and MLS material sealed under an
# operator-supplied store key. For a host with a filesystem and no platform
# keystore. Default on, like `data`, so the FFI entry that exposes them cannot
# become a checksum mismatch; a mobile build that never calls them opts out
# with `default-features = false` and drops the HKDF, HMAC and lock code.
= ["dep:hkdf", "dep:hmac", "dep:rustix"]
[]
= { = true }
= { = true }
= { = true }
= { = true }
# The sealed layer: the envelope codec this crate's send and receive paths
# encode with, and the canonical signing-payload construction the control
# plane signs and verifies over. Shared with a leaf node rather than
# restated here; see ADR 0022.
= { = true }
= { = true }
= { = true }
# Optional: the replicated-document layer. Default on, because the mobile
# bindings ship one FFI artifact and a feature-gated UDL object would be a
# runtime checksum mismatch rather than a build error. Native consumers that
# only want messaging opt out with `default-features = false` and pay none of
# the engine's bytes.
= { = true, = true }
# Optional: the telemetry pipe's wire types and its HTTPS client. `ureq` with
# exactly `rustls-no-provider` is rustls and no optional extra (no gzip, no
# SOCKS, no charset) and no bundled root set: the uploader trusts only the
# roots that can issue the ingest's certificate (`ingest-roots.pem`), never the
# device's store and never the whole Mozilla set, so a compromise of any other
# authority cannot reach it. `rustls` with ring is the crypto provider the
# uploader names; it is the same rustls ureq links, so it adds no crate. It
# must stay on the rustls series ureq uses (0.23): the provider crosses into
# ureq through `unversioned_rustls_crypto_provider`, and two series would be
# two crates whose types do not match, a build error at that call.
# HTTP CONNECT proxy support is part of ureq's core rather than a feature: the
# uploader can use an HTTP CONNECT proxy selected through the environment, read
# when telemetry is enabled, and TLS still runs end to end to the ingest,
# validated against the pinned roots. The uploader names that proxy source,
# the redirect limit, the root store and the crypto provider in its agent
# configuration rather than inheriting ureq's defaults; see docs/telemetry.md.
= { = true, = true }
= { = "3.4", = false, = ["rustls-no-provider"], = true }
= { = "0.23", = false, = ["ring", "std"], = true }
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
= { = true }
# The Nostr author key is hex on the wire and hex in the discovery record, so
# the comparison that binds the two never crosses an encoding.
= { = true }
= "0.10"
= { = true }
= { = true }
= { = true }
# The built-in sealed file store for MLS material derives its sealing and
# naming keys from the operator's store key (HKDF) and names its files with a
# keyed digest (HMAC), so a stolen directory does not confirm which peers and
# groups it holds. Both are already in the graph through the transport crate.
= { = true, = true }
= { = true, = true }
# The built-in file stores hold an exclusive `flock` on their directory for
# their lifetime, so a second store over it is refused rather than diverging
# the MLS state. Already in the graph (and in the notices) through tempfile;
# std's `File::try_lock` needs Rust 1.89, above the 1.87 MSRV. Windows uses
# std's open with read-only sharing instead and needs nothing.
[]
= { = "1", = false, = ["fs", "std"], = true }
[]
# The example drives the document API, which the `data` feature gates. Declared
# so that a `--no-default-features` build skips it instead of failing to
# compile a target that cannot exist in that configuration.
[[]]
= "replicated_notes"
= ["data", "file-store"]