vector-core 0.7.1

[package]
name = "vector-core"
version = "0.7.1"
edition = "2021"
description = "Core library for Vector — the single source of truth for all Vector clients, SDKs, and interfaces."
license = "MIT"
repository = "https://github.com/VectorPrivacy/Vector"
homepage = "https://vectorapp.io"
documentation = "https://docs.rs/vector-core"
readme = "README.md"
keywords = ["nostr", "messaging", "encryption", "vector"]
categories = ["network-programming", "cryptography", "asynchronous"]

[dependencies]
# Nostr Protocol. Declared as crates.io versions so the crate is publishable; the
# workspace `[patch.crates-io]` redirects the shared `nostr` to the zeroize fork for
# in-workspace builds (so the app keeps secret-key zeroization), while published
# crates resolve to stock nostr.
# NIP features live on `nostr` now: 0.45 dropped `all-nips` and every `nipXX`
# feature from nostr-sdk, and the sdk enables only std/rand/os-rng on `nostr`.
# Cargo unifies these across the workspace, so this is the one place they're set.

# EXACT-pinned (=) across the whole nostr family: a caret range lets a fresh
# consumer resolve a MIXED set, and these crates share types across their
# boundaries, so a mismatched sibling fails to compile. Bump all four together
# or not at all.
nostr = { version = "=0.45.1", features = ["nip04", "nip06", "nip44", "nip46", "nip59", "rand", "os-rng"] }
nostr-sdk = "=0.45.1"
nostr-blossom = "=0.45.0"
nostr-connect = "=0.45.1"
# Blossom blob hashing. Must track nostr-blossom's own bitcoin_hashes major, or
# the Sha256Hash we hand it is a different type. `hex` is explicit because it
# gates Display/FromStr on the hash: the `std` default only forwards to it
# (`hex?/std`), so relying on a sibling's feature union would be a silent trap.
bitcoin_hashes = { version = "1.2", default-features = false, features = ["std", "hex"] }
bip39 = { version = "2.2.2", features = ["rand"] }

# Database
rusqlite = { version = "0.37", features = ["bundled"] }

# Async
tokio = { version = "1.49.0", features = ["sync", "time", "net", "io-util", "rt-multi-thread", "macros"] }
futures-util = "0.3.31"
# Boxed, Send futures for the Community Transport trait so impls work in spawned tasks.
async-trait = "0.1"

# Serialization
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"

# Crypto
aes = "0.8.4"
aes-gcm = "0.10.3"
chacha20poly1305 = "0.10.1"
argon2 = "0.5.3"
sha2 = "0.10.9"
# HKDF-SHA256 for the Community protocol's frozen key-derivation convention
# (GROUP_PROTOCOL.md §14). Audited RustCrypto crate rather than a hand-rolled
# construction, since the derivation is wire-immutable.
hkdf = "0.12"
# NIP-44 v2 per-message key disclosure (CORD-04 §7 Pins): the nostr crate keeps
# its message-key expansion private, so the construction is reproduced over the
# same audited RustCrypto primitives and round-tripped against nostr's own
# encrypt in tests. Both crates are already in the tree transitively.
hmac = "0.12"
chacha20 = "0.9"
zeroize = { version = "1.8", features = ["derive"] }

# HTTP
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "stream", "charset", "socks"] }
url = "2.5.7"

# Image metadata
fast-thumbhash = "0.2"

# Utils
rand = "0.8"
base64-simd = "0.8"
image = { version = "0.25.9", default-features = false, features = ["png", "jpeg", "gif", "webp"] }

# TLS
rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }

# Tor (Arti) — stock crates.io. Now that Vector is on rusqlite 0.37+ we share
# libsqlite3-sys with Arti's tor-dirmgr directly, so the rusqlite-0.32 fork is gone.
arti-client = { version = "0.41", default-features = false, features = ["tokio", "rustls", "experimental-api", "bridge-client", "pt-client"], optional = true }
tor-rtcompat = { version = "0.41", default-features = false, features = ["tokio", "rustls"], optional = true }
# For circuit introspection (the "Advanced" panel showing live hops).
tor-circmgr = { version = "0.41", default-features = false, optional = true }
tor-dirmgr = { version = "0.41", default-features = false, optional = true }
tor-linkspec = { version = "0.41", default-features = false, optional = true }
tor-guardmgr = { version = "0.41", default-features = false, features = ["bridge-client", "pt-client"], optional = true }
# tokio_util::compat bridges arti's futures::io::AsyncRead to tokio::io::AsyncRead so
# we can splice Arti's DataStream into a tokio TcpStream for the SOCKS5 bridge.
tokio-util = { version = "0.7", features = ["compat"], optional = true }

# Platform
libc = "0.2"

[features]
default = []
# Enables embedded Tor (Arti) — bootstraps Arti, runs a localhost SOCKS5 listener
# bridging into the Tor network. Consumers (HTTP / Nostr) opt into the proxy via
# `tor::proxy_url()` returning `Some(socks5://127.0.0.1:<port>)` when active.
tor = ["dep:arti-client", "dep:tor-rtcompat", "dep:tokio-util", "dep:tor-circmgr", "dep:tor-dirmgr", "dep:tor-linkspec", "dep:tor-guardmgr"]

[dev-dependencies]
tempfile = "3"
# `test-util` (test-only — NOT in the production tokio features) enables tokio's virtual clock
# (`start_paused`) so timing-based tests (e.g. the inbox-relays debounce window) resolve
# deterministically instead of depending on wall-clock margins under parallel CPU load.
tokio = { version = "1.49.0", features = ["test-util"] }