# cargo deny configuration for settled-reach-server.
# Enforces license allowlist, RUSTSEC advisory checks, and duplicate detection.
# Run: cargo deny check (from server/)

# econ-sim is an internal path dependency with no license declaration.
# Excluding it skips only econ-sim itself — its dependencies are still checked
# because they are shared with settled-reach-server's own dep tree.
[graph]
exclude = ["econ-sim"]

[advisories]
version = 2

[licenses]
version = 2
allow = [
    "MIT",
    "Apache-2.0",
    # Needed for wasip2/wit-bindgen (WASM support crates via bevy_tasks).
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "ISC",
    "Unlicense",
    "Zlib",
    "CC0-1.0",
    # Required by unicode-ident: "(MIT OR Apache-2.0) AND Unicode-3.0".
    "Unicode-3.0",
    # Required by ryu: "Apache-2.0 OR BSL-1.0".
    "BSL-1.0",
]
# settled-reach-server has publish = false and carries no license declaration.
[licenses.private]
ignore = true

[bans]
multiple-versions = "warn"

[sources]
unknown-registry = "warn"
unknown-git = "warn"