[package]
name = "custom-pages"
version = "0.1.0"
edition = "2024"
# MIT rather than PolyForm. The threat model asks whether someone could collect
# rent with just this crate and contribute nothing; an HTML/CSS sanitizer is not
# a service anyone can run, and someone who takes it still has to build a
# product around it. The perimeter is the MNW server, which stays PolyForm.
license = "MIT"
# Internal shared crate, consumed by path inside this repo and never published.
# `publish = false` is what makes that a cargo-enforced fact rather than a
# convention: without it an accidental `cargo publish` is one command away.
publish = false

[dependencies]
# The HTML allowlist. Version-matched to the server, which is the only consumer;
# they resolve to one copy through the path dep either way.
ammonia = "4"
# The CSS parser/printer the scoping pass is built on. `default-features = false`
# keeps the bundler, source maps and the JS/Node glue out: this crate parses a
# stylesheet and prints it back, and nothing else.
# Pinned exactly, not floated. This is a pre-1.0 alpha whose `CssRule` enum is
# matched exhaustively here on purpose (a new at-rule must be a compile error
# and then a deliberate allow-or-block decision, never a silent pass-through),
# so a patch bump is a breaking change for this crate. alpha.72 adds
# `PositionTry` and does exactly that.
lightningcss = { version = "=1.0.0-alpha.71", default-features = false, features = ["visitor"] }
url = "2.5.8"
# Two warn-level lines in the CSS pass, where a cap is hit. The crate emits no
# other diagnostics and takes no subscriber: the consumer owns that.
tracing = "0.1"

[dev-dependencies]
proptest = "1"

[lints.rust]
unused = "warn"
unreachable_pub = "warn"

[lints.clippy]
pedantic = { level = "warn", priority = -1 }
# Allow-list tuned from a measured breakdown across server/multithreaded/pter
# (2026-07-22). These are the high-churn / low-signal pedantic lints; everything
# else in `pedantic` stays a warning. Keep this block identical across repos.
module_name_repetitions = "allow"
# Doc lints. No docs-completeness push is underway.
missing_errors_doc = "allow"
missing_panics_doc = "allow"
doc_markdown = "allow"
# Numeric casts. Endemic and mostly intentional in size and byte math.
cast_possible_truncation = "allow"
cast_sign_loss = "allow"
cast_precision_loss = "allow"
cast_possible_wrap = "allow"
cast_lossless = "allow"
# Subjective structure and style nags. High churn, low signal.
must_use_candidate = "allow"
too_many_lines = "allow"
struct_excessive_bools = "allow"
similar_names = "allow"
items_after_statements = "allow"
single_match_else = "allow"
# Frequent false-positives in TUI and router-heavy code.
match_same_arms = "allow"
unnecessary_wraps = "allow"
type_complexity = "allow"