[package]
name = "swarm-secret-client"
version.workspace = true
edition.workspace = true

[dependencies]
# `read_with_startup_retry`'s backoff schedule.
backon.workspace = true
# `Shared`, so every caller refused while a secret re-read runs waits on that
# one read (`stored_secret`).
futures-util.workspace = true
# `Identity` is re-exported by vaultrs, but the identity is built here (from
# the `BAO_*` files) rather than by its env defaults, so the dependency is
# direct rather than incidental.
reqwest.workspace = true
# vaultrs's own endpoint machinery, for the one endpoint it does not
# implement — see `client::WriteAclPolicy`.
rustify.workspace = true
rustify_derive.workspace = true
# `install_crypto_provider`, which the store client (reqwest, via vaultrs)
# needs before its first TLS handshake.
rustls.workspace = true
serde.workspace = true
# `read_versioned` decodes the data half of the response vaultrs hands back as
# a `serde_json::Value`.
serde_json.workspace = true
strum.workspace = true
thiserror.workspace = true
# `stored_secret` spawns its re-reads and times them out.
tokio.workspace = true
tracing.workspace = true
vaultrs.workspace = true

[lints]
workspace = true

# `ring` as well, as every binary that links async-nats builds it: with one
# provider compiled in rustls picks it without an install, so the provider
# test would pass with `install_crypto_provider` doing nothing.
[dev-dependencies]
rustls = { workspace = true, features = ["ring"] }
# `test-util` for `#[tokio::test(start_paused = true)]`: the re-read backoff
# tests run on paused time.
tokio = { workspace = true, features = ["test-util"] }
# Capturing what a re-read logs, to check it names the client and never the
# secret.
tracing-subscriber.workspace = true