# License policy for everything Lumbridge ships.
#
# Graduating the GPUI shell out of `spikes/` moved several hundred packages from
# a spike's dependency tree into the product's. `spikes/README.md` called GPUI's
# license closure "a hard gate" and the scorecard scored it `pending`; this is
# where that gate is enforced rather than described.
#
#   cargo install cargo-deny && cargo deny check licenses
[graph]
all-features = true

[licenses]
# Permissive, plus two weak-copyleft licenses that are file-level and do not
# reach Lumbridge's own sources.
allow = [
    "Apache-2.0",
    "Apache-2.0 WITH LLVM-exception",
    "BSD-2-Clause",
    "BSD-3-Clause",
    "BSL-1.0",
    "CC0-1.0",
    "ISC",
    "MIT",
    "MIT-0",
    "MPL-2.0",
    "Unicode-3.0",
    "Unlicense",
    "Zlib",

    # Reviewed additions, each reached by exactly one path:
    #
    # CDLA-Permissive-2.0 is webpki-roots, which is Mozilla's CA root store —
    # data, not code, under a permissive data licence with no copyleft and no
    # attribution requirement on downstream distribution. It arrives through
    # ureq, which the Claude usage endpoint needs (decision 0016).
    "CDLA-Permissive-2.0",
    # NCSA is libfuzzer-sys, a permissive BSD/MIT-style licence. It reaches the
    # graph only as rav1e -> ravif -> image -> gpui and only under
    # `all-features`; no shipped build links it. Allowed rather than excluded so
    # the audit stays strict everywhere else.
    "NCSA",
]
# A dependency whose license cannot be determined is not a licensing question to
# settle later; it is a blocker now.
unused-allowed-license = "allow"
confidence-threshold = 0.9

[bans]
multiple-versions = "allow"

[advisories]
yanked = "deny"

[sources]
unknown-registry = "deny"
unknown-git = "deny"
allow-registry = ["https://github.com/rust-lang/crates.io-index"]