Cargo.toml

[package]
name = "okx-outcomes-cli"
description = "Interactive CLI and TUI for OKX Outcomes"
keywords = ["okx", "predictions", "prediction-market", "cli", "tui"]
categories = ["command-line-utilities", "finance"]
version = "1.1.0"
edition = "2021"
license = "MIT"
authors = ["OKX Outcomes Contributors"]
rust-version = "1.91"
repository = "https://github.com/okx/outcomes-cli"
homepage = "https://github.com/okx/outcomes-cli"

[[bin]]
name = "okx-outcomes"
path = "src/main.rs"

[lints.rust]
warnings = "deny"

[lints.clippy]
all = "deny"
unwrap_used = "deny"
expect_used = "deny"

[dependencies]
# The SDK is always linked (REST + signing); only its `websocket` feature is
# gated, via the CLI `websocket` feature below. Tracking the public SDK's
# `main` branch (github.com/okx/outcomes-sdk).
okx-outcomes-sdk = { git = "https://github.com/okx/outcomes-sdk.git", branch = "main", features = ["signing"] }

tokio = { version = "1.0", default-features = false, features = ["time", "rt", "rt-multi-thread", "sync", "macros"] }
# Direct dep so `lib::set_http_client(client: reqwest::Client)` can name the
# type; features match the SDK's so cargo unifies to a single reqwest build.
reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "json"] }
crossterm = "0.29.0"
# WS-only deps: compiled only when the `websocket` feature is enabled.
ratatui = { version = "0.30", default-features = false, features = ["crossterm"], optional = true }
unicode-width = { version = "0.2", optional = true }
futures-util = "0.3.31"
serde = { version = "1.0", default-features = false, features = ["derive"] }
serde_json = { version = "1.0", default-features = false, features = ["std"] }
k256 = { version = "0.13.4", default-features = false, features = ["ecdsa"] }
# Random EIP-712 signing key generation for the `setup` wizard.
# Same alloy stack the SDK uses internally for `signer_address` — no new
# transitive deps (already present in Cargo.lock via the SDK's `signing` feat).
alloy-signer-local = { version = "2", default-features = false }
chrono = { version = "0.4", default-features = false, features = ["serde", "clock"] }
dirs = "6"
thiserror = "2.0.17"
# Parse the shared OKX config (`~/.okx/config.toml`, written by the
# agent-trade-kit CLI) for the HMAC API-key fallback in `require_auth`.
# `toml_edit` is already in the lock transitively; `parse`-only keeps it minimal.
toml_edit = { version = "0.25", default-features = false, features = ["parse"] }

# Credential storage: OS keyring (macOS Keychain / Windows Credential Manager /
# Linux libsecret) with AES-256-GCM + scrypt encrypted file fallback.
anyhow = "1"
keyring = { version = "3", features = ["apple-native", "windows-native", "linux-native"] }
aes-gcm = "0.10"
scrypt = { version = "0.11", default-features = false, features = ["std"] }
zeroize = "1.8"
rand = "0.8"
hex = "0.4"

# QR code generation for the setup address-binding deeplink (SVG only — no
# `image` crate pulled in).
qrcode = { version = "0.14", default-features = false, features = ["svg"] }

# SHA-256: the self-installer's checksum verifier and the OKX HMAC signature
# used by the API-key fallback in `account_query` (always compiled).
sha2 = { version = "0.10.9" }
# OKX `OK-ACCESS-SIGN` HMAC-SHA256 for the account-uid API-key fallback
# (`account_query`). Both already in the lockfile transitively via the SDK.
hmac = "0.12"
base64 = "0.22"

# Platform IPC for reading the okx-auth access token (see auth_token), plus
# hostname lookup for the encrypted-file keyring's machine identity.
[target.'cfg(unix)'.dependencies]
libc = "0.2"

[target.'cfg(windows)'.dependencies]
windows-sys = { version = "0.59", features = [
    "Win32_Foundation",
    "Win32_Security",
    "Win32_Storage_FileSystem",
    "Win32_System_IO",
    "Win32_System_Pipes",
] }
# openssl-sys reaches us transitively through reqwest / tokio-tungstenite's
# native-tls backend, which only links OpenSSL on Linux (Windows uses schannel,
# macOS uses Security.framework). Force the vendored build so OpenSSL is
# compiled from source and statically linked — otherwise cross-compiling
# aarch64-unknown-linux-gnu via `cross` fails with no system libssl in the
# container. Linux-only target so the other platforms don't pull OpenSSL in.
[target.'cfg(target_os = "linux")'.dependencies]
openssl = { version = "0.10", features = ["vendored"] }

[dev-dependencies]
tempfile = "3"

[features]
default = ["websocket", "auth-installer"]
# WebSocket CLI surface: the `ws` subcommands + the ratatui trading terminal.
# Build without it via `cargo build --no-default-features` to drop ratatui,
# unicode-width, and the SDK's websocket stack from the binary.
websocket = ["okx-outcomes-sdk/websocket", "dep:ratatui", "dep:unicode-width"]
# Self-installer/upgrader for the okx-auth token broker (network + checksum).
# On by default; pulls in the SHA-256 verifier and the CDN download path.
# Disable for sandboxed builds that must not self-install (e.g.
# `cargo build --no-default-features --features websocket`); the OKX_AUTH_BIN
# location override stays available regardless.
auth-installer = []
# End-to-end self-test runner (`okx-outcomes selftest`). NOT in default — the
# public release binary should not ship an order-placing self-runner. Needs the
# tokio subprocess + io-util APIs and the `ws` surface it exercises.
selftest = ["websocket", "tokio/process", "tokio/io-util"]

[profile.release]
strip = true
lto = "thin"
codegen-units = 1
panic = "abort"