zenith-stack 0.1.0

[workspace]
resolver = "2"
members = [
    "crates/zenith-api",
    "crates/zenith-foundation",
    "crates/zenith-linux",
    "crates/zenith-ebpf",
    "crates/zenith-net",
    "crates/zenith-tls",
    "crates/zenith-http1",
    "crates/zenith-http2",
    "crates/zenith-http3",
    "crates/zenith-web",
    "crates/zenith-proxy",
    "crates/zenith-cache",
    "crates/zenith-waf",
    "crates/zenith-forward",
    "crates/zenith-runtime",
    "crates/zenith-capability",
    "crates/zenith-observability",
    "crates/zenith-testkit",
    "crates/zenith-fingerprint",
]

# ─────────────────────────────────────────────────────────────────────────────
# 顶层 facade crate：zenith
# ─────────────────────────────────────────────────────────────────────────────
# 作为统一入口点，按需 re-export 所有子 crate 的公共 API。
# 用户可通过 features 按需启用所需能力，避免拖入全部重依赖。
[package]
name = "zenith-stack"
version.workspace = true
edition.workspace = true
rust-version.workspace = true
license.workspace = true
repository.workspace = true
homepage.workspace = true
documentation.workspace = true
authors.workspace = true
description = "Zenith 全协议栈框架：AF_XDP + eBPF + TLS 1.3 + HTTP/1-2-3 + Web + Proxy + WAF，按需导入"
keywords = ["zenith", "framework", "network", "protocol", "af_xdp"]
categories = ["network-programming", "web-programming"]
readme = "README.md"

[lib]
name = "zenith_stack"
path = "src/lib.rs"

[[example]]
name = "hello_server"
required-features = ["web", "runtime"]

[[example]]
name = "full_feature_server"
required-features = ["web", "runtime", "proxy"]

[[example]]
name = "l4_test"
required-features = ["net", "forward"]

[[example]]
name = "l4_relay_test"
required-features = ["net", "forward"]

[[example]]
name = "auto_degrade_test"
required-features = ["core", "capability", "runtime"]

[[example]]
name = "fingerprint_block_test"
required-features = ["web", "tls", "runtime"]

[[example]]
name = "fingerprint_ext_test"
required-features = ["web", "tls", "runtime"]

[[example]]
name = "fingerprint_live_server"
required-features = ["web", "tls", "runtime"]

[[example]]
name = "fingerprint_h3_block_test"
required-features = ["web", "tls", "runtime"]

[dev-dependencies]
# 示例的 tracing 生产链路：fmt subscriber + RUST_LOG 环境过滤
tracing-subscriber = { version = "0.3", features = ["fmt", "env-filter"] }
# 示例 fingerprint_block_test 使用 rustls 作为真实 TLS 客户端
rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12", "ring"] }
# 示例的全局 tokio runtime 后台任务（sleep/interval）
tokio = { workspace = true, features = ["time"] }

[dependencies]
# 所有子 crate 均为可选，由 features 显式启用
zenith-api = { workspace = true, optional = true }
zenith-foundation = { workspace = true, optional = true }
zenith-linux = { workspace = true, optional = true }
zenith-ebpf = { workspace = true, optional = true }
# zenith-net：workspace 级已设 default-features = false，facade 的 net 特性不自动拖入 linux
zenith-net = { workspace = true, optional = true }
zenith-tls = { workspace = true, optional = true }
zenith-http1 = { workspace = true, optional = true }
zenith-http2 = { workspace = true, optional = true }
zenith-http3 = { workspace = true, optional = true }
zenith-web = { workspace = true, optional = true }
zenith-proxy = { workspace = true, optional = true }
zenith-cache = { workspace = true, optional = true }
zenith-waf = { workspace = true, optional = true }
zenith-forward = { workspace = true, optional = true }
zenith-runtime = { workspace = true, optional = true }
zenith-capability = { workspace = true, optional = true }
zenith-observability = { workspace = true, optional = true }
zenith-testkit = { workspace = true, optional = true }
zenith-fingerprint = { workspace = true, optional = true }

# audit（Rust 安全审计工具）仅 Linux 可用：netlink-sys 依赖 Linux libc 符号。
# optional = true：默认不编译，由 `audit` feature 显式启用（dep:audit）。
[target.'cfg(target_os = "linux")'.dependencies]
audit = { version = "0.7.3", optional = true }

[lints]
workspace = true

[features]
# 默认仅启用最小核心：api + core
default = ["api", "core"]

# ── 单 crate 特性 ────────────────────────────────────────────────────────────
api = ["dep:zenith-api"]
core = ["dep:zenith-foundation"]
linux = ["dep:zenith-linux", "zenith-net?/linux"]
ebpf = ["dep:zenith-ebpf"]
# net 默认不启用 linux 数据面，纯协议解析场景可用
net = ["dep:zenith-net", "core"]
tls = ["dep:zenith-tls", "core"]
http1 = ["dep:zenith-http1", "net"]
http2 = ["dep:zenith-http2", "net"]
http3 = ["dep:zenith-http3", "net"]
web = ["dep:zenith-web", "core"]
proxy = ["dep:zenith-proxy", "core"]
cache = ["dep:zenith-cache", "core"]
waf = ["dep:zenith-waf", "core"]
# forward 在 Linux 下保持既有语义（splice 零拷贝中继），web-only 场景不受影响
forward = ["dep:zenith-forward", "core", "zenith-forward?/linux"]
# runtime 始终需要 linux 数据面（worker 模块依赖 zenith-linux）；
# 同时把 zenith-web 升级到 full（AF_XDP 桥接/runtime 治理闭环）
runtime = ["dep:zenith-runtime", "net", "linux", "ebpf", "zenith-web?/full"]
capability = ["dep:zenith-capability", "core"]
observability = ["dep:zenith-observability", "core"]
# audit：Rust 安全审计（cargo-audit netlink 链路），仅 Linux 可用，默认关闭。
# 启用方式：--features audit（底层依赖 dep:audit，仅 Linux target 生效）。
audit = ["dep:audit"]
testkit = ["dep:zenith-testkit", "full"]
fingerprint = ["dep:zenith-fingerprint"]

# ── 组合特性 ─────────────────────────────────────────────────────────────────
http = ["http1", "http2", "http3"]
# 完整生产协议栈（不含测试工具）：显式含 api，保证 default-features = false 下类型层完备
full-stack = [
    "api", "web", "http", "tls", "proxy", "cache", "waf", "forward",
    "runtime", "capability", "observability",
]
# 全部能力（含测试工具）
full = ["full-stack", "testkit"]

# ─────────────────────────────────────────────────────────────────────────────
# Workspace 级配置
# ─────────────────────────────────────────────────────────────────────────────

[workspace.package]
version = "0.1.0"
edition = "2024"
rust-version = "1.97.1"
license = "MIT OR Apache-2.0"
repository = "https://gitcode.com/Mosi45-git/Zenith"
homepage = "https://www.mosit.cn"
documentation = "https://docs.rs/zenith-stack"
authors = ["Zenith Developers <2098175794@qq.com>"]

# 严格 Lint 规则（全部针对 unsafe_code 和 debug 实现）
[workspace.lints.rust]
unsafe_code = "deny"
missing_debug_implementations = "warn"
missing_docs = "warn"

[workspace.lints.clippy]
all = "warn"
correctness = "deny"
suspicious = "deny"
perf = "deny"

[workspace.dependencies]
# Internal crates - version required for crates.io publishing
zenith-api = { path = "crates/zenith-api", version = "0.1.0" }
zenith-foundation = { path = "crates/zenith-foundation", version = "0.1.0" }
zenith-linux = { path = "crates/zenith-linux", version = "0.1.0" }
zenith-ebpf = { path = "crates/zenith-ebpf", version = "0.1.0" }
zenith-net = { path = "crates/zenith-net", default-features = false, version = "0.1.0" }
zenith-tls = { path = "crates/zenith-tls", version = "0.1.0" }
zenith-http1 = { path = "crates/zenith-http1", version = "0.1.0" }
zenith-http2 = { path = "crates/zenith-http2", version = "0.1.0" }
zenith-http3 = { path = "crates/zenith-http3", version = "0.1.0" }
# default-features = false：facade 的 `web` 特性引入最小 Web 框架（不含 AF_XDP/eBPF/
# 运行时治理），全量能力由 zenith-web 的 `full` 特性按需开启
zenith-web = { path = "crates/zenith-web", default-features = false, version = "0.1.0" }
zenith-proxy = { path = "crates/zenith-proxy", version = "0.1.0" }
zenith-cache = { path = "crates/zenith-cache", version = "0.1.0" }
zenith-waf = { path = "crates/zenith-waf", version = "0.1.0" }
# default-features = false：由消费方按需开启 `linux`（splice 中继拖入 zenith-linux/libbpf）。
# 与 zenith-net 同款策略，保证 facade 最小依赖路径真实可控
zenith-forward = { path = "crates/zenith-forward", default-features = false, version = "0.1.0" }
zenith-runtime = { path = "crates/zenith-runtime", version = "0.1.0" }
zenith-capability = { path = "crates/zenith-capability", version = "0.1.0" }
zenith-observability = { path = "crates/zenith-observability", version = "0.1.0" }
zenith-testkit = { path = "crates/zenith-testkit", version = "0.1.0" }
zenith-fingerprint = { path = "crates/zenith-fingerprint", version = "0.1.0" }

# External dependencies - 核心库
thiserror = "1"

# eBPF / AF_XDP 相关 - 统一使用 libbpf-rs（内核官方绑定，性能最优）
libbpf-rs = "0.24"
libbpf-sys = "1.4"
libc = "0.2"

# 异步运行时
tokio = { version = "1", features = ["full"] }

# io_uring 异步 IO（Linux 5.1+，splice/sendfile SQE 需 5.15+）
io-uring = "0.7"

# 无锁数据结构 - 用于 TaskOffloadChannel 和高并发场景
crossbeam = "0.8"

# 零拷贝字节缓冲区 - 用于 IO 路径池化，避免堆分配
bytes = "1"

# TLS（rustls + ring 为唯一密码学后端，AGENT §13 禁止自研原语）
# default-features = false：彻底排除 aws-lc-rs；仅启用 ring provider。
# tls12 保留以支撑 TlsConfig min/max_version 的 TLS1.2+1.3 协商实现。
rustls = { version = "0.23", default-features = false, features = ["std", "logging", "tls12", "ring"] }

# QUIC 客户端（H3 上游）：quinn-proto 协议层（socket 无关，配合阻塞 UdpSocket
# 同步驱动，不引入 tokio 异步运行时）。版本 >= 0.11.15 以规避 RUSTSEC-2021-0035 /
# 2023-0063 / 2024-0373 / 2026-0037 / 2026-0185（均为 quinn-proto DoS，已修补）。
quinn-proto = ">=0.11.15"

# 极致性能：高性能哈希（FxHash）用于小键（u32/u64/&str），比 SipHash 快 ~5x
rustc-hash = "1.1"
# 极致性能：栈上小向量（SmallVec<[T; N]>），N 小元素避免堆分配
smallvec = "1.13"

# 密码学
ring = "0.17"
# 私钥材料清零（Drop 时自动 zeroize，防止内存残留）
zeroize = "1"
md-5 = "0.10"
# SHA-256（JA4 指纹哈希与 zenith-ebpf 构建期校验共用；指纹为识别用途非认证用途）
sha2 = "0.10"

# 序列化与配置
serde = { version = "1", features = ["derive"] }
toml = "0.8"

# 随机数
rand = "0.8"

# 日志与指标
tracing = "0.1"

# 测试依赖
pretty_assertions = "1"
proptest = "1"
tokio-test = "0.1"

# ─────────────────────────────────────────────────────────────────────────────
# 极致性能 Release Profile（全链路最高性能最低消耗）
# ─────────────────────────────────────────────────────────────────────────────
[profile.release]
# 最高优化等级：启用所有优化（含向量化、内联、死代码消除）
opt-level = 3
# 全量 LTO：跨 crate 跨模块内联，消除抽象开销（代价：编译时间增长，运行性能最优）
lto = "fat"
# 单一 codegen-unit：最大化内联与优化空间（默认 16 会切断跨单元优化）
codegen-units = 1
# panic = abort：省去 unwind 表与 landing pad，减小二进制、降低分支开销
# （Fail-Closed 语义已由 Result/Option 与 std::process::abort() 兜底，无需 unwind）
panic = "abort"
# 剥离符号信息：减小二进制体积、降低 i-cache 压力
strip = "symbols"
# 增量编译关闭：release 下确保全量优化生效（增量会保留未优化目标码）
incremental = false

# bench profile 继承 release 的极致优化
# 注：Cargo 强制 bench 使用 unwind 以便测试框架捕获 panic，故不设置 panic = "abort"。
[profile.bench]
opt-level = 3
lto = "fat"
codegen-units = 1
strip = "symbols"
incremental = false

# release-debug：需要符号表调试时使用（保留符号，其余同 release）
[profile.release-debug]
inherits = "release"
strip = "none"
debug = true