84fc32449a
All checks were successful
jouleclaw public surface must stay documented / Public-surface audit (jouleclaw-rs) (push) Successful in 57s
Finishes the workspace-wide dependency refresh on stable 1.98.0. Most crates
took the newest release cleanly; the ones below could not, and the reason is
worth recording because "latest" is the wrong answer for several of them.
rand is pinned to 0.8, not 0.10. rand 0.10 dropped `rand::RngCore` and
`rand::rngs::OsRng`, but the real blocker is that it ships rand_core 0.10
while every signature crate here (ed25519-dalek 2.x, bls12_381, k256/p256)
is built on rand_core 0.6 -- so a 0.10 RNG is not even the right *type* to
hand to `SigningKey::generate`. rand 0.8 re-exports rand_core 0.6, which is
exactly what those crates want. rand_chacha follows it to 0.3 for the same
reason. The RNG generation is pinned by the crypto ecosystem, not by recency.
aes is pinned to 0.8 (cipher 0.4) in smart-byte-nostr and op-mobile-wallets:
aes 0.9 moved to cipher 0.5, which removed `BlockEncryptMut`,
`encrypt_padded_vec_mut` and `StreamCipherCoreWrapper::new` that this code
uses, and aes-gcm 0.10 pulls cipher 0.4 anyway -- so 0.9 also put two aes and
two cipher versions in the graph. op-3ds2 declared aes/cbc for an encrypted
deviceInfo block it never implemented; dropping those unused deps removes the
last cipher 0.5 edge, leaving a single aes and a single cipher.
reqwest 0.13 moved `RequestBuilder::query` and `::form` behind new features,
which `default-features = false` was silently excluding. Enabled per crate.
Source changes are the matching API drift:
- hmac's `new_from_slice` lives on `KeyInit`, not `Mac`
- secp256k1 0.31 takes the array by value in `from_byte_array`, and its own
re-exported `rand` is used for keygen so the two can never drift again
- smart-byte-mdl reads OS entropy from getrandom directly. It was reaching
for a rand RNG only to get 32 bytes, and going to the primitive genuinely
removes the CryptoRng skew with p256 0.14-rc that the comment there
described dodging -- and drops rand from that crate entirely.
Verified: all 20 workspaces in the monorepo compile with
`cargo check --workspace --all-targets` on 1.98.0, zero errors.
Co-Authored-By: Claude Opus 5 <[email protected]>
51 lines
2.2 KiB
TOML
51 lines
2.2 KiB
TOML
[package]
|
|
name = "op-tax"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
description = "OpenPay tax calculation: pluggable adapter surface (Avalara, Stripe Tax, CCH SureTax, Vertex, TaxJar) plus a native rate-table backend covering US sales tax, EU/UK/AU VAT, GST (CA/IN/SG/NZ), excise, reverse-charge, and exemption certificates. Economic-nexus monitoring and withholding hooks included."
|
|
|
|
[dependencies]
|
|
op-core = { path = "../op-core" }
|
|
|
|
# Async-first surface: every commercial backend (Avalara, Stripe Tax,
|
|
# CCH SureTax, Vertex, TaxJar) is a RESTful HTTPS API, and the native
|
|
# calculator is async-trait too so callers can swap freely. async-trait
|
|
# keeps the TaxCalculator trait dyn-compatible until the dyn-safe
|
|
# native variant lands cleanly post-1.95.
|
|
async-trait = "0.1"
|
|
|
|
# HTTP client for commercial backends. rustls-tls keeps the build
|
|
# OpenSSL-free; json bundles serde_json roundtrips. We omit blocking
|
|
# because every backend here is async-first.
|
|
# reqwest 0.13 moved RequestBuilder::form behind the "form" feature.
|
|
reqwest = { version = "0.13", default-features = false, features = ["rustls", "json", "form"] }
|
|
tokio = { workspace = true }
|
|
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
|
|
# CBOR for the on-disk rate-table snapshot. ciborium is the pure-Rust
|
|
# implementation already used by op-screening for its sanctions index.
|
|
ciborium = "0.2"
|
|
|
|
# Tax math must be exact. rust_decimal carries 28-29 significant digits
|
|
# of decimal precision — well beyond the 4-decimal places any real-world
|
|
# jurisdiction publishes — and supports the round-half-up rounding mode
|
|
# every tax authority specifies.
|
|
rust_decimal = { version = "1", features = ["serde"] }
|
|
|
|
# Calendar dates for transaction_date / certificate validity / nexus
|
|
# windows. Spec-mandated dependency.
|
|
chrono = { version = "0.4", default-features = false, features = ["std", "clock", "serde"] }
|
|
|
|
thiserror = { workspace = true }
|
|
tracing = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
# Async mock-server for adapter round-trip tests. Same version as op-bnpl.
|
|
wiremock = "0.6"
|
|
tokio = { workspace = true, features = ["rt", "macros", "test-util"] }
|
|
proptest = { workspace = true }
|