[package]
name = "pom"
version = "0.4.2"
edition = "2024"
license = "LicenseRef-PolyForm-Noncommercial-1.0.0"

[lib]
name = "pom"
path = "src/lib.rs"

[[bin]]
name = "pom"
path = "src/main.rs"

[dependencies]
# MCP protocol
rmcp = { version = "2.2", features = ["server", "transport-io"] }

# CLI
clap = { version = "4", features = ["derive"] }

# Async runtime
tokio = { version = "1", features = ["rt-multi-thread", "macros", "io-std", "io-util", "process", "signal"] }

# HTTP client. `rustls-no-provider` keeps aws-lc-rs out of the tree; the process
# installs the ring provider (main.rs). Each client is handed a webpki-roots
# rustls config via use_preconfigured_tls (see crate::tls), so every outbound
# probe trusts the same Mozilla root set the TLS-expiry check uses.
reqwest = { version = "0.13", default-features = false, features = ["json", "rustls-no-provider"] }

# HTTP server (API in serve mode)
axum = { version = "0.8", default-features = false, features = ["json", "tokio", "http1", "query"] }

# Database
sqlx = { version = "0.9", features = ["runtime-tokio", "sqlite"] }

# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"
schemars = "1.2"

# Shared operator status contract (GET /status.json for the release viewer)
ops-status = { path = "../shared/ops-status" }

# Config
toml = "1.1"

# Constant-time comparison
subtle = "2"

# Errors
thiserror = "2"

# Time
chrono = { version = "0.4", features = ["serde"] }

# Paths
dirs = "6"

# Identity
uuid = { version = "1", features = ["v4"] }
hostname = "0.4"

# DNS resolution
hickory-resolver = "0.26"

# TLS certificate checking. Pure-Rust ring provider only, no aws-lc-rs (keeps the
# C/asm build dep and the aws-lc-sys advisory surface off every native build host).
x509-parser = "0.18"
rustls = { version = "0.23", default-features = false, features = ["std", "tls12", "logging", "ring"] }
tokio-rustls = { version = "0.26", default-features = false, features = ["logging", "tls12", "ring"] }
rustls-pki-types = "1"
webpki-roots = "1"

# Logging
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }

# Graceful shutdown
tokio-util = { version = "0.7", features = ["rt"] }
rustls-platform-verifier = "0.7.0"

[dev-dependencies]
tower = { version = "0.5", features = ["util"] }
http-body-util = "0.1"
rcgen = "0.14.7"

[lints.rust]
unused = "warn"
unreachable_pub = "warn"

[lints.clippy]
pedantic = { level = "warn", priority = -1 }
# Allow-list tuned from a measured breakdown across server/multithreaded/pter
# (2026-07-22). These are the high-churn / low-signal pedantic lints; everything
# else in `pedantic` stays a warning. Keep this block identical across repos.
module_name_repetitions = "allow"
# Doc lints. No docs-completeness push is underway.
missing_errors_doc = "allow"
missing_panics_doc = "allow"
doc_markdown = "allow"
# Numeric casts. Endemic and mostly intentional in size and byte math.
cast_possible_truncation = "allow"
cast_sign_loss = "allow"
cast_precision_loss = "allow"
cast_possible_wrap = "allow"
cast_lossless = "allow"
# Subjective structure and style nags. High churn, low signal.
must_use_candidate = "allow"
too_many_lines = "allow"
struct_excessive_bools = "allow"
similar_names = "allow"
items_after_statements = "allow"
single_match_else = "allow"
# Frequent false-positives in TUI and router-heavy code.
match_same_arms = "allow"
unnecessary_wraps = "allow"
type_complexity = "allow"