Cargo.toml

[workspace]
resolver = "3"

[package]
name = "zed-cli"
version = "0.3.1"
edition = "2024"
description = "zed: the universal package manager backed by the VCS hosts you already use"
license = "MIT"
repository = "https://github.com/zed-pkg/zed-cli"

[[bin]]
name = "zed"
path = "src/main.rs"

[[bin]]
name = "zed-gitops"
path = "src/bin/zed-gitops.rs"

[[bin]]
name = "zed-binary"
path = "src/bin/zed-binary.rs"

[[bin]]
name = "zed-git-install"
path = "src/bin/zed-git-install.rs"

[[bin]]
name = "zed-hex-pm"
path = "src/bin/zed-hex.rs"

[lib]
name = "zed_cli"
path = "src/lib.rs"

[dependencies]
# One exact contract, behavior, and transport stack is shared with every Rust
# SDK consumer. zed-cli keeps only CLI-only publication/binary/fallback edges.
zed-interfaces = { git = "https://github.com/zed-pkg/zed-interfaces.git", rev = "0c2ffa7be791a44c8aa2a69ab4b1ea87aab4729c" }
zed-lib = { git = "https://github.com/zed-pkg/zed-lib-core.git", rev = "4509f19e1d3242226f28f842f550085864582380" }
# Unified graph admission: the merged client, direct interfaces crate,
# and direct behavior crate all resolve through one immutable Rust type authority.
zed-client = { git = "https://github.com/zed-pkg/zed-clients.git", rev = "6a046b0a5e262c0c6a23851b810d7fe7eda251c4" }
# Includes the Windows ERROR_LOCK_VIOLATION contention normalization certified by DEN-3167.
zed-lock = { git = "https://github.com/zed-pkg/zed-lock.git", rev = "1db0da00d30fcf2e0762f50eedb1f88458020b52" }
anyhow = "1"
clap = { version = "4.5", features = ["derive", "env"] }
clap_complete = "4.5"
dirs = "5"
# Publisher metadata signing. Pinned to the audited 2.x line; `rand_core` is
# the RNG trait ed25519-dalek itself depends on, taken directly so key
# generation does not pull a second RNG stack in behind it.
ed25519-dalek = { version = "2.1", default-features = false, features = ["std", "fast", "zeroize", "rand_core"] }
rand_core = { version = "0.6", features = ["getrandom"] }
flate2 = "1"
globset = "0.4"
hex = "0.4"
# Self-update must use the current hardened shared updater: SHA-256 is required
# by default, --no-verify is disabled unless a product opts in explicitly, and
# archive extraction is bounded and rejects unsafe entries.
ores-clis-core = { git = "https://github.com/ORESoftware/ores-clis-core.git", rev = "611312407dfe2e0c40d5e21fa660f22b52d60c8c" }
reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "multipart", "rustls-tls"] }
rpassword = "7"
semver = { version = "1", features = ["serde"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
sha2 = "0.10"
tar = "0.4"
tempfile = "3"
toml = "1"
uuid = { version = "1", features = ["serde", "v4"] }
walkdir = "2"
fs2 = "0.4.3"
flags2env = { git = "https://github.com/flags-2-env/flags-2-env.git", rev = "2946224fb3a1bd84c0e39146b24f5f1ca8d69862" }
zip = { version = "8.6.0", default-features = false, features = ["deflate"] }

# --- functional programming conformance -------------------------------------
# Safety, correctness, and visibility lints remain active in normal builds.
# Retained compatibility/future-facing code may be unused in a given build,
# so those narrow categories are quiet by default and can be promoted back to
# hard errors with `cargo strict-unused`.

[lints.rust]
unsafe_code = "warn"
unused_must_use = "deny"
unreachable_pub = "warn"
dead_code = "allow"
unused_imports = "allow"
unused_variables = "allow"
unused_mut = "allow"
unused_assignments = "allow"

[lints.clippy]
# typed errors: panicking is not error handling
unwrap_used = "warn"
expect_used = "warn"
panic = "warn"
todo = "warn"
unimplemented = "warn"
indexing_slicing = "warn"
# illegal states excluded by types
wildcard_enum_match_arm = "warn"
match_wildcard_for_single_variants = "warn"
# immutable values and pure transformations
mut_mut = "warn"
needless_pass_by_ref_mut = "warn"
# composition
too_many_lines = "warn"
cognitive_complexity = "warn"
module_name_repetitions = "allow"
# explicit inputs and outputs
must_use_candidate = "warn"
return_self_not_must_use = "warn"