Cargo.toml

[workspace]
resolver = "3"
members = [
    "crates/litewire",
    "crates/litewire-backend",
    "crates/litewire-translate",
    "crates/litewire-session",
    "crates/litewire-mysql",
    "crates/litewire-postgres",
    "crates/litewire-tds",
    "crates/litewire-hrana",
    "crates/litewire-turso",
]

[workspace.package]
version = "0.2.0"
edition = "2024"
rust-version = "1.88"
license = "MIT"

[workspace.dependencies]
# Internal crates
litewire-backend = { path = "crates/litewire-backend" }
litewire-translate = { path = "crates/litewire-translate" }
litewire-session = { path = "crates/litewire-session" }
litewire-mysql = { path = "crates/litewire-mysql" }
litewire-postgres = { path = "crates/litewire-postgres" }
litewire-tds = { path = "crates/litewire-tds" }
litewire-hrana = { path = "crates/litewire-hrana" }
litewire-turso = { path = "crates/litewire-turso" }

# Async runtime
tokio = { version = "1", features = ["full"] }

# Wire protocol.
#
# SECURITY: opensrv-mysql's `tls` feature is load-bearing for authentication,
# not just for TLS (issue #32). Upstream calls `authenticate()` conditionally
# on `handshake.username.is_some()`, and its parser yields `None` on the
# pre-TLS CLIENT_SSL branch. With `tls` on, `init_after_ssl` re-reads and
# re-parses the handshake so that branch always produces a username; with
# `tls` off, the re-parse is compiled out and a CLIENT_SSL-flagged handshake
# skips authentication entirely. The handler fails closed structurally either
# way (a connection with no successful `authenticate()` holds no backend --
# see litewire-mysql/src/handler.rs), but the feature must never be dropped
# silently: it is declared explicitly here so `default-features = false`
# cannot shed it, and litewire-mysql/src/lib.rs carries a compile-time fence
# that breaks the build if the feature disappears.
opensrv-mysql = { version = "0.7", features = ["tls"] }
pgwire = "0.28"

# SQL parsing. `visitor` provides the derived AST walkers
# (`visit_expressions_mut`) used by the MySQL LIKE-escape rewrite.
sqlparser = { version = "0.57", features = ["serde", "visitor"] }

# Backends. `column_decltype` exposes `Statement::columns()`, which we need
# to fill in `Column.decltype` on empty result sets (an unexecuted prepared
# SELECT). Without it, wire-frontend type inference has to LIMIT-0 probe.
# `functions` registers the `regexp` scalar that SQLite's `X REGEXP Y`
# operator resolves to -- SQLite parses the operator but ships no
# implementation of it.
rusqlite = { version = "0.32", features = ["bundled", "column_decltype", "functions"] }
# Turso Database — the ground-up Rust rewrite of SQLite
# (github.com/tursodatabase/turso). Pinned exactly: the engine is Beta and
# API/behavior move between releases. 0.7.2 is the latest stable release on
# the 0.7 line (July 2026); 0.8.x is pre-release only and deliberately not
# taken. Bump deliberately, never via `cargo update`.
#
# 0.7.0 -> 0.7.2 picks up tursodatabase/turso#7855 ("close vtab cursors
# before transaction finalization", merged 2026-07-16, first released in
# 0.7.2): a vdbe fix for pragma-backed table-valued functions where a vtab
# cursor left open across transaction finalization could misbehave. 0.7.0
# predates it.
turso = { version = "=0.7.2", default-features = false }

# HTTP (Hrana)
axum = "0.8"
serde = { version = "1", features = ["derive"] }
serde_json = "1"

# Error handling
thiserror = "2"
anyhow = "1"

# Logging
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }

# CLI
clap = { version = "4", features = ["derive"] }

# Misc
async-trait = "0.1"
# OS entropy for the per-connection `mysql_native_password` challenge. Chosen
# over `rand` deliberately: this is the whole requirement, and `getrandom` is a
# thin syscall shim with no generator state or distribution machinery to pull
# in. litewire ships no other crypto — credential verification is the
# embedder's job (see `litewire_backend::auth`).
getrandom = "0.3"
# Regex engine behind the `regexp` SQLite function (see
# `litewire_backend::rusqlite_backend`). The same crate Turso's built-in
# `regexp` uses, so pattern semantics agree across both backends.
regex = "1"
# SHA-1 is not a choice — `mysql_native_password` is defined in terms of it.
# Used only to verify a client's challenge response (see
# `litewire_mysql::native_password`), never to hash anything at rest.
sha1 = "0.10"
bytes = "1"
base64 = "0.22"
futures = "0.3"
parking_lot = "0.12"
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json", "http2"] }
mysql_async = { version = "0.37", default-features = false, features = ["rustls-tls"] }
tokio-postgres = { version = "0.7", default-features = false, features = ["runtime"] }
tiberius = { version = "0.12", default-features = false, features = ["rustls"] }
tokio-util = { version = "0.7", features = ["compat"] }