cli/Cargo.toml

[package]
name = "hanzo-cli"
version = "8.5.699"
edition = "2021"
authors = ["Hanzo AI"]
description = "Unified CLI for Hanzo AI development tools"
license = "MIT"
repository = "https://github.com/hanzoai/cli"

[[bin]]
name = "hanzo"
path = "src/main.rs"

# genspec pulls the cloud command surface forward: it reads cloud's live route
# table over the wire and the authored master (YAML) from a hanzoai/openapi
# checkout. Both are MAINTAINER inputs — the shipped `hanzo` parses no YAML,
# fetches no spec and links no cloud code — so its parser is compiled only when
# the seam is run.
[[bin]]
name = "genspec"
path = "src/bin/genspec.rs"
required-features = ["maintainer"]

# driftgate is the GATE, not a generator: it reads the committed spec, the live
# route table and — where neither can answer — the running host, and it reads the
# built `hanzo` to ask what a person can actually reach. No YAML, no authored
# master, so CI runs it with nothing but a checkout, a build and the network.
[[bin]]
name = "driftgate"
path = "src/bin/driftgate.rs"
required-features = ["maintainer"]

# genproduct rewrites the committed command tree from the committed spec. It was
# auto-discovered from src/bin/ and so installed into every user PATH — where a
# bare  (it parses no arguments) rewrote generated.rs inside the
# reader own cargo registry cache. It is a maintainer tool; it is gated like one.
[[bin]]
name = "genproduct"
path = "src/bin/genproduct.rs"
required-features = ["maintainer"]

# ONE gate for the three maintainer tools. A user installs the hanzo binary;
# genspec, driftgate and genproduct are how that binary's command tree is MADE,
# and a reader has no use for them. genproduct in particular parses no arguments,
# so a bare invocation rewrote generated.rs inside the caller's own registry cache.
[features]
maintainer = ["dep:serde_norway"]

# The two library crates the CLI is BUILT ON, each in its own crate so another
# consumer shares the exact same wire via a pinned git dependency — one source of
# truth, several consumers. `client` is the platform client itself: the act grant,
# the held outcome and the typed refusal live there, not in this binary.
[workspace]
members = ["crates/event", "crates/client"]

[dependencies]
hanzo-event = { path = "crates/event", version = "0.1.0" }
hanzo-client = { path = "crates/client", version = "0.1.0" }
clap = { version = "4.5", features = ["derive", "env"] }
tokio = { version = "1.36", features = ["full"] }
anyhow = "1.0"
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
serde_norway = { version = "0.9", optional = true }        # genspec only — reads hanzoai/openapi's YAML master
toml = "0.8"
dirs = "5.0"
colored = "2.1"
dialoguer = "0.11"
reqwest = { version = "0.12", default-features = false, features = ["json", "gzip", "rustls-tls", "http2", "charset"] }
which = "6.0"
flate2 = "1.1"                                             # vm bootstrap: gunzip the release tarball
tar = "0.4"                                                # vm bootstrap: extract hanzo-vm from it
libc = "0.2"                                               # SIGTERM/liveness for the local cloud host daemon
vm-measure = "2.0.3"                                       # `hanzo up`: the boot measurement the vm reports, and the workload half we extend
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
tempfile = "3.10"
chrono = { version = "0.4", features = ["serde"] }
ratatui = "0.29"
crossterm = "0.28"

# Cloud auth (HIP-0111 OIDC PKCE S256).
sha2 = "0.10"                                              # PKCE S256 challenge
base64 = "0.22"                                            # base64url (no pad)
rand = "0.8"                                               # OsRng for PKCE verifier + state + local wallet entropy
# A scannable link, so signing a headless box in is a phone camera rather than
# 40 characters typed by hand. Terminal half-blocks, no image, no C.
qr2term = "0.3"
webbrowser = "1"                                           # open the IAM authorize URL

# Local / imported wallets — HD derivation + EVM address. Cloud-custody (KMS/MPC)
# wallets need NONE of this; these are only for offline `wallet create --local`
# and `wallet import`. Pure-Rust RustCrypto; secrets live in `iam::token`'s store.
bip39 = { package = "tiny-bip39", version = "1" }             # BIP-39 mnemonic (all word counts) -> seed
bip32 = "0.5"                                             # secp256k1 BIP-32 HD derivation from a seed
k256 = "0.13"                                             # secp256k1 (matches bip32) — public key -> EVM address
sha3 = "0.10"                                             # Keccak-256 for EVM address

[dev-dependencies]
assert_cmd = "2.0"
predicates = "3.1"
libc = "0.2"