castrum 0.9.3 → 0.9.6

package/Cargo.toml

@@ -0,0 +1,155 @@
+[package]
+name = "castrum"
+# Keep in sync with package.json "version" (single source of truth: the npm package).
+version = "0.9.6"
+edition = "2021"
+# Keep in sync with package.json "license" (cargo-deny rejects a crate with no
+# license expression).
+license = "MIT"
+
+[lib]
+name = "castrum"
+crate-type = ["cdylib", "rlib"]
+path = "rust/lib.rs"
+
+# Native-only benchmark binary: times the pure-Rust cores (crc32, hashing,
+# hex/base64/url, validators, packed parsers, gzip/brotli, ...) with NO JS / FFI
+# boundary, so bench/ffi-margin.ts can compare them against the same ops called
+# through bun:ffi and pinpoint exactly where the crossing cost is. Diagnostic
+# only — never shipped; NOT part of the addon surface.
+[[bin]]
+name = "native-bench"
+path = "rust/src/bin/native-bench.rs"
+required-features = ["native-bench"]
+
+[dependencies]
+napi = { version = "3", features = ["napi10", "serde-json"] }
+napi-derive = "3"
+
+serde = { version = "1", features = ["derive"] }
+# preserve_order: IndexMap for serde_json::Value objects -> faster DOM build + O(1)
+# object lookups during jsonschema validation (BTreeMap default is O(log n)).
+# Key order becomes insertion order; correctness checks are order-insensitive.
+serde_json = { version = "1", features = ["preserve_order"] }
+# sort_keys: sonic's owned `Value` object backs mutable objects with
+# AHashMap (non-deterministic iteration order) unless `sort_keys` is enabled,
+# which swaps the owned map to BTreeMap → DETERMINISTIC sorted serialization.
+# Determinism is a hard wire-format requirement: JWT sign (iat/exp injection)
+# and the RFC 6902 patch engine must emit byte-identical output across the
+# FFI/napi/scalar/bulk transports. Parsed (unmutated) values keep the shared
+# Vec representation (insertion order) — only mutation switches to the map.
+sonic-rs = { version = "0.5", features = ["sort_keys"] }
+
+# default-features=false: drop resolve-http + tls-aws-lc-rs which pull in
+# reqwest -> hyper/h2/tokio/rustls (large binary, attack surface). Format
+# validators (email etc.) are built-in and NOT feature-gated in 0.48.
+jsonschema = { version = "0.49", default-features = false, features = ["resolve-file"] }
+aws-lc-rs = "1"
+# NOTE: base64 0.23 enables SIMD (SSE/AVX) by default via the `simd-unsafe`
+# feature (part of `default`); no explicit feature is needed.
+base64 = "0.23"
+crc32fast = "1"
+httparse = "1"
+mime_guess = "2"
+phf = { version = "0.14", features = ["macros"] }
+getrandom = "0.4"
+memchr = "2"
+simdutf8 = "0.1"
+email_address = "0.2"
+fast_chemail = { version = "0.9", optional = true }
+# Replicate jsonschema 0.48.5's format:"email" hostname validation (punycode
+# A-labels + RFC 5892 PVALID/contextual rules) on the zero-DOM fast path. Same
+# crates/versions the jsonschema crate uses, so the fast path stays byte-parity.
+idna = "1"
+unicode-general-category = "1"
+rayon = "1"
+# mimalloc is set as the Rust #[global_allocator] (see rust/lib.rs). We DELIBERATELY
+# do NOT enable the "override" feature: it interposes libc malloc/free at the
+# process level, which is an embedding hazard when this cdylib is dlopen'd into
+# Bun (which itself embeds mimalloc -> symbol clashes). The Rust-level global
+# allocator keeps most of the allocation win without replacing the host malloc.
+mimalloc = { version = "0.1", features = ["local_dynamic_tls"] }
+core_affinity = "0.8"
+
+parking_lot = "0.12"
+xxhash-rust = { version = "0.8", features = ["xxh3"] }
+ipnet = "2"
+# 0.18.2+ carries the RUSTSEC-2026-0253 fix (0.16.x is affected); keep this
+# requirement at or above the fixed release so `cargo deny` / OSV stay green.
+lru = "0.18.2"
+# Zero-cost hashing for fast_schema object-key lookups (default SipHash is slow
+# on short keys). Already a transitive dep, so no new download.
+rustc-hash = "2"
+# fast_schema extended-keyword parity: fancy-regex is the SAME regex engine the
+# jsonschema crate uses for `pattern`/`patternProperties` (ECMA-262 semantics incl.
+# lookahead/backrefs); fraction::BigFraction is the SAME exact-rational type used
+# for `multipleOf` divisibility. Both are already transitive deps, so no new
+# downloads — but they become direct deps so fast_schema can use them.
+fancy-regex = "0.19"
+fraction = "0.15"
+# Exact cross-type number equality for enum/const/uniqueItems (same semantics
+# jsonschema uses via jsonschema-value's cmp::equal). Already transitive.
+num-cmp = "0.1"
+
+# Backend-framework feature additions (Phase A/B/C)
+# argon2id password hashing (password-hash/rand features are default-on).
+argon2 = "0.5"
+# bcrypt password hashing (pure-Rust, Blowfish-based).
+bcrypt = "0.16"
+# PBKDF2-HMAC-SHA256 (RustCrypto) — pure-Rust KDF.
+pbkdf2 = "0.12"
+# sha2 is consumed ONLY by pbkdf2 (digest 0.10). Do NOT bump to 0.11: that
+# moves `Sha256` to digest 0.11 while pbkdf2 0.12 still requires digest 0.10,
+# so `pbkdf2_hmac::<Sha256>` stops compiling (E0277 CoreProxy). Revisit only
+# together with a pbkdf2 release that depends on digest 0.11.
+sha2 = "0.10"
+# HTML templating (fast, safe, no eval).
+minijinja = "2"
+# gzip via the memory-safe zlib-rs backend (pure Rust, no C).
+flate2 = { version = "1", default-features = false, features = ["zlib-rs"] }
+# brotli compression (pure Rust port).
+brotli = "8"
+
+[build-dependencies]
+napi-build = "2"
+
+[dev-dependencies]
+# Property-based testing for the security-sensitive wire parsers (fuzz-style
+# with automatic shrinking) — complements the deterministic xorshift corpus in
+# rust/test_support.rs. Runs under `cargo test`; not part of the shipped addon.
+proptest = "1"
+
+[features]
+default = ["fast-email"]
+fast-email = ["dep:fast_chemail"]
+# Diagnostic-only gate for the `native-bench` binary (see the [[bin]] below):
+# without this feature the bin is not a default target, so `napi build` — and
+# therefore every shipped cross-compiled artifact — never links it. The napi
+# cross toolchains cannot resolve the aws-lc-sys C symbols an executable needs
+# (`undefined reference to __isoc23_sscanf`), while a cdylib tolerates them.
+# Run it with: cargo run --release --features native-bench --bin native-bench
+native-bench = []
+
+# Codify the CI clippy gate (`cargo clippy --all-targets -- -D warnings`) so a
+# bare local `cargo clippy` fails on the same lints — no flag drift between
+# laptop and CI. Clippy-only lints: normal `cargo build`/`test` are unaffected.
+[lints.clippy]
+all = "deny"
+
+[profile.release]
+opt-level = 3
+lto = "fat"
+codegen-units = 1
+strip = "symbols"
+debug = 0
+incremental = false
+# Safety: this is an embedded cdylib loaded into the Bun process. panic = "unwind"
+# (the default) lets napi's catch_unwind convert Rust panics into JS exceptions
+# instead of aborting the host process. overflow-checks = true catches integer
+# overflow in release; the cost is negligible relative to the safety gain.
+overflow-checks = true
+debug-assertions = false
+
+[profile.release.package."*"]
+opt-level = 3
+codegen-units = 1

package/README.md

@@ -34,6 +34,12 @@ bun install
 bun run build        # compile the Rust addon (release)
 ```
 
+> **Cross-platform install**: prebuilt addons ship for linux (x64/arm64,
+> glibc + musl), macOS (x64/arm64), and Windows (x64 msvc) — built by CI on
+> every push/PR and published on a `v*` tag. When no prebuilt matches your
+> platform, the package `postinstall` hook compiles the addon from source in
+> your `node_modules` (`cargo build --release`, needs a Rust toolchain).
+
 ### 2. Start a server
 
 ```ts
@@ -181,17 +187,19 @@ For coverage floors, the typecheck/test configs, and the full test matrix, see
 ## Publishing
 
 The package ships **all platform addons in a single tarball**. Push a `v*` tag
-and CI builds + publishes every platform to npm; or use `bun run publish:manual`
+and CI builds + publishes every platform to npm; or use `bun run release:manual`
 for a quick single-platform release:
 
 ```bash
-bun run publish:manual -- --increment minor  # bump + tag + build + publish
-bun run publish:manual:dry                   # print the plan, change nothing
+bun run release minor          # bump + verify + commit + tag (CI publishes)
+bun run release:manual         # same, but also builds + publishes locally
+bun run release:dry            # print the plan, change nothing
 ```
 
-Run `bun run check:version` before tagging (it verifies `package.json`,
-`Cargo.toml`, and `CHANGELOG.md` agree). See [`docs/REPO_MAP.md`](./docs/REPO_MAP.md)
-§6 for the full flow.
+`bun run release` uses the shared canonical flow (`scripts/release.ts` +
+`.release.json`), syncing `package.json`, `Cargo.toml`, `Cargo.lock`, and
+`CHANGELOG.md`. Run `bun run check:version` before tagging (it verifies they
+agree). See [`docs/REPO_MAP.md`](./docs/REPO_MAP.md) §6 for the full flow.
 
 ## Documentation
 

package/build.rs

@@ -0,0 +1,5 @@
+extern crate napi_build;
+
+fn main() {
+    napi_build::setup();
+}