Cargo.toml

[package]
name = "zm-api"
# Pre-release: first Rust version, carrying the v3 lineage from ZoneMinder's API
# history. cargo-deb maps the `-alpha.1` suffix to a Debian `~alpha.1` so it
# sorts before the eventual 3.0.0. See packaging/rpm/zm-api.spec and
# packaging/arch/PKGBUILD for the rpm/Arch equivalents, and docs/deployment.md.
version = "3.0.0-alpha.1"
edition = "2021"
# sea-orm 2 and sqlx 0.9 need 1.94; EL9's rust-toolset (1.92) and Fedora 41
# (1.91, end of life) are below it, so the RPM builders use rustup.
rust-version = "1.94"
license = "AGPL-3.0-or-later"
description = "A modern REST API for ZoneMinder"
repository = "https://github.com/SteveGilvarry/zm-api"
# The crate ships two binaries (the server `zm-api` and the `fixture-doctor`
# maintenance tool), so plain `cargo run` is ambiguous without this — keep it
# defaulting to the server.
default-run = "zm-api"

# Features
[features]
default = ["onvif"]

# ONVIF client capabilities, gated per ONVIF Device Test Specification category
# (see docs/ONVIF_TASKS.md). `onvif-core` is the always-required SOAP transport
# + WS-Security foundation; every other onvif-* feature pulls it in.
onvif-core = []
onvif-device = ["onvif-core"]
onvif-media = ["onvif-core"]
onvif-ptz = ["onvif-core"]
onvif-events = ["onvif-core"]
# The discovery *service* layer queries Device + Media to inspect a candidate,
# so the feature composes them.
onvif-discovery = ["onvif-core", "onvif-device", "onvif-media"]

# ONVIF profile umbrellas (the capability set a deployment targets). media2,
# imaging, recording/replay and analytics are not yet implemented, so the T/G/M
# umbrellas currently map to the implemented subset.
onvif-profile-s = ["onvif-device", "onvif-media", "onvif-ptz", "onvif-events", "onvif-discovery"]
onvif-profile-t = ["onvif-profile-s"]
onvif-profile-g = ["onvif-device"]
onvif-profile-m = ["onvif-device", "onvif-events"]

# Convenience: everything currently implemented (the default).
onvif = ["onvif-profile-s"]

# Maintenance tool: scan for and clean up leaked `Test_run_*` integration-test
# fixture rows. See src/bin/fixture_doctor.rs.
[[bin]]
name = "fixture-doctor"
path = "src/bin/fixture_doctor.rs"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
anyhow = "1"
argon2 = "0.6"
async-trait = "0.1"
axum = { version = "0.8", features = ["ws"] }
axum-extra = { version = "0.12", features = ["typed-header"] }
axum-server = { version = "0.8", features = ["tls-rustls"] }
rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
rustls-pki-types = { version = "1", features = ["std"] }
tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12", "logging"] }
rustls-acme = { version = "0.15", features = ["axum", "tokio", "tower"] }
base64 = "0.23"
chacha20poly1305 = { version = "0.11", features = ["alloc"] }
bcrypt = "0.19"
chrono = "0.4"
# Resolve the host OS IANA timezone name for GET /system/locale (#33).
iana-time-zone = "0.1"
config = "0.15"
dotenvy = "0.15"
fake = { version = "5", features = ["derive", "uuid", "chrono"] }
futures = "0.3"
futures-util = "0.3"
# Not "full": that would pull phone-number (RUSTSEC-flagged quick-xml 0.38 via
# phonenumber) and credit-card, neither of which any validator here uses.
garde = { version = "0.23", features = [
    "derive",
    "serde",
    "email",
    "email-idna",
    "pattern",
    "unicode",
] }
itertools = "0.15"
jsonwebtoken = { version = "11", features = ["aws_lc_rs"] }
log = "0.4"
memmap2 = "0.9"
openssl = "0.10"
once_cell = "1"
rand = "0.10"
regex = "1"
reqwest = { version = "0.13", features = ["json"] }
rust_decimal = "1"
test-context = "0.5"
thiserror = "2"
tokio = { version = "1", features = ["full"] }
tokio-util = { version = "0.7", features = ["io", "compat"] }
tokio-tungstenite = "0.30"
tracing = { version = "0.1", features = ["attributes"] }
tracing-appender = "0.2"
tracing-bunyan-formatter = "0.3"
tracing-log = "0.2"
tracing-subscriber = { version = "0.3", features = ["registry", "env-filter"] }
sentry = "0.49"
# ONVIF SOAP client: XML envelope build/parse and WS-Security SHA-1 digest.
quick-xml = "0.42"
sha1 = "0.11"
serde = { version = "1", features = ["derive"] }
serde_json = "1"
sha2 = "0.11"
# HMAC-SHA256 for signed media URLs (src/util/media_url.rs).
hmac = "0.13"
strum = { version = "0.28", features = ["derive"] }
url = "2"
urlencoding = "2"
utoipa = { version = "6", features = ["axum_extras"] }
utoipa-swagger-ui = { version = "10", features = ["axum"] }
uuid = { version = "1", features = ["v4"] }
tower = "0.5"
tower-http = { version = "0.7", features = [
    "cors",
    "trace",
    "fs",
    "compression-gzip",
    "compression-br",
    "set-header",
] }
tower_governor = "0.8"

# WebRTC native implementation
webrtc = "0.21"
# Sans-I/O protocol core under webrtc 0.21: media samples, track and codec
# types. Keep it on the same minor as webrtc so the types unify.
rtc = "0.21"

# RTSP client for stream sources
retina = "0.4"

# Media parsing
bytes = "1"

# Dashboard/stats
dashmap = "6"

# FFmpeg bindings for H.264 → JPEG snapshot decoding, and the in-process
# libavcodec/libavformat encode+mux path for the motion-synopsis mp4 renderer.
ffmpeg-next = "9"

# Image compositing for the motion-synopsis renderer: decode the pre-rendered
# cutout/plate JPEGs, alpha-composite them over the plate, encode the still.
# Decode/encode of stills only — all video work stays in ffmpeg-next.
image = { version = "0.25", default-features = false, features = ["jpeg", "png"] }

# Unix signal handling and filesystem utilities
nix = { version = "0.31", features = ["signal", "fs", "hostname", "user", "net"] }
ipnet = "2.12"

# Low-level libc bindings for PR_SET_PDEATHSIG
libc = "0.2"
async_zip = { version = "0.0.17", features = ["tokio", "deflate", "chrono"] }

[dependencies.sea-orm]
version = "2"
features = ["sqlx-mysql", "sqlx-postgres", "runtime-tokio-rustls", "mock"]

[dependencies.sea-orm-migration]
version = "2"
features = ["runtime-tokio-rustls", "sqlx-postgres","sqlx-mysql"]

[dependencies.sqlx]
version = "0.9"
features = ["mysql", "postgres"]

[build-dependencies]
pkg-config = "0.3"

[dev-dependencies]
# HTTP server testing helpers for Axum
axum-test = { version = "21", features = ["typed-routing"] }
# Parameterized tests
# Snapshot testing for JSON/OpenAPI
insta = { version = "1", features = ["json"] }
# JSON diffing in assertions (crate name uses hyphens)
assert-json-diff = "2"
tower = "0.5"
# Temporary directories for tests
tempfile = "3"
# Validates integration-test responses against the OpenAPI document (#237)
jsonschema = { version = "0.60", default-features = false }

# jemalloc as the process-wide allocator. The server is a long-running,
# allocation-bursty media workload; glibc malloc retains freed buffers in its
# arenas rather than returning them to the OS, so RSS sits at its high-water
# mark. jemalloc returns pages aggressively, keeping RSS near the live set.
# Gated off MSVC, where jemalloc is unavailable. Wired up in src/lib.rs.
[target.'cfg(not(target_env = "msvc"))'.dependencies]
tikv-jemallocator = "0.7"

# Query jemalloc's runtime stats to assert the global allocator is wired up
# (see tests/jemalloc.rs).
[target.'cfg(not(target_env = "msvc"))'.dev-dependencies]
tikv-jemalloc-ctl = { version = "0.7", features = ["stats"] }

[package.metadata.deb]
maintainer = "Steve Gilvarry <SteveGilvarry@users.noreply.github.com>"
# openssl: JWT key generation in the post-install script. passwd: useradd and
# groupadd. procps: pgrep, used by zm-api-takeover.
depends = "$auto, openssl, passwd, procps"
section = "net"
priority = "optional"
maintainer-scripts = "packaging/debian"
assets = [
  ["target/release/zm-api", "usr/bin/zm-api", "755"],
  # Migration/upgrade tool. Built as `migrator` (the cargo bin name the parity
  # scripts use) but installed under the zm-api- prefix: `migrator` is far too
  # generic a name for /usr/bin.
  ["target/release/migrator", "usr/bin/zm-api-db", "755"],
  ["packaging/zm-api-takeover.sh", "usr/bin/zm-api-takeover", "755"],
  ["packaging/setup-instance.sh", "usr/share/zm-api/setup-instance.sh", "755"],
  ["packaging/man/zm-api.8", "usr/share/man/man8/zm-api.8", "644"],
  ["packaging/man/zm-api-takeover.8", "usr/share/man/man8/zm-api-takeover.8", "644"],
  ["packaging/man/zm-api-db.8", "usr/share/man/man8/zm-api-db.8", "644"],
  ["packaging/man/zm-api.env.5", "usr/share/man/man5/zm-api.env.5", "644"],
  ["settings/base.toml", "etc/zm-api/base.toml", "644"],
  ["settings/prod.toml", "etc/zm-api/prod.toml", "644"],
  ["packaging/systemd/zm-api.env", "etc/zm-api/zm-api.env", "644"],
  ["packaging/systemd/zm-api.service", "lib/systemd/system/zm-api.service", "644"],
  # NOTE: do not ship `static/` wholesale — it holds the dev JWT keys
  # (static/key/*.pem). Packaged installs generate their own keys in
  # /var/lib/zm-api/keys. If real web assets are added later, ship a scoped
  # glob such as ["static/images/**/*", "usr/share/zm-api/static/images/", "644"].
]
conf-files = [
  "/etc/zm-api/base.toml",
  "/etc/zm-api/prod.toml",
  "/etc/zm-api/zm-api.env",
]

# Full DWARF debug info roughly triples link time and the linker's peak memory
# across ~60 test binaries. Line tables alone still give file/line numbers in
# panics and backtraces; the variable/type info dropped here is rarely used
# outside an attached debugger.
[profile.dev]
debug = "line-tables-only"

[profile.test]
debug = "line-tables-only"