Cargo.toml

[package]
name = "mapbox-cli"
version = "1.1.1"
edition = "2021"
description = "A command-line interface for Mapbox APIs, with commands generated at build time from OpenAPI specs."
repository = "https://github.com/mapbox/mapbox-cli"
# The file rather than an SPDX expression: LICENSE is Mapbox's own terms and
# not an OSI license, so there is no identifier that says what it grants.
license-file = "LICENSE"
# A rail against an accidental `cargo publish`, not a decision that it never
# could be reconsidered: crates.io is for crates anyone may use under an open
# license, and a publish cannot be taken back.
publish = false
# The oldest Rust this crate compiles on, measured rather than aspirational:
# `CredentialLock` in src/auth.rs calls `File::lock`/`unlock`, stabilised in
# 1.89, and 1.88 rejects the crate with five `use of unstable library feature
# file_lock` errors. Every other recent std call here lands below that floor
# (`Option::is_none_or` 1.82, `u64::is_multiple_of` 1.87), so `file_lock` is
# the whole constraint.
#
# Declaring it buys one thing: cargo refuses a too-old toolchain with a single
# line naming this number, rather than a page of E0658s pointing into std that
# read like a broken checkout. Distinct from the toolchain we build and
# release with, which is pinned separately and may be newer than this floor.
rust-version = "1.89"
# Records the `openapi-specs` commit for `mapbox generate-skills` to print in
# the header of every file it writes. Best-effort — see build.rs for why it
# can never fail the build.
build = "build.rs"

[[bin]]
name = "mapbox"
path = "src/main.rs"

# Rules the compiler can hold, rather than a reader. Each of these is an
# invariant this repo already had and only documented — the kind that survives
# until somebody writes the obvious thing at two in the morning.
[lints.rust]
# There is no `unsafe` in this crate outside a couple of `env::set_var` calls
# in tests and two Win32 calls in `src/detach.rs` (the reason is there), and
# there is no reason for more: nothing else here does FFI, manual memory
# management or lock-free anything. Denying it means adding some
# is a deliberate `#[allow]` with a reason next to it rather than a diff nobody
# looks twice at.
unsafe_code = "deny"

[lints.clippy]
# The output contract, made mechanical. This repo's rule is: don't reintroduce a
# `println!` for a result — stdout belongs to `output::emit`, which is the
# single place `--output` is honored and the single place a result is
# written. There are no violations today; this keeps it that way.
# `print_stderr` is deliberately *not* denied: warnings and progress go to
# stderr from a dozen places on purpose, several of them outside the output
# machinery by design (`tilesets_cli`, `http`'s timeout warning).
print_stdout = "deny"
# Debugging aids that should never reach a release. `dbg!` writes to stderr
# and would sail past the rule above.
dbg_macro = "deny"
todo = "deny"
unimplemented = "deny"

[dependencies]
clap = { version = "4", features = ["derive", "env", "string", "wrap_help"] }
# Already in the graph through clap's `wrap_help`. Used directly by the
# top-level help, which src/help_layout.rs renders itself and so has to wrap
# to the terminal itself.
terminal_size = "0.4"
# Typo tolerance for `mapbox commands search`. Already in the graph through
# clap's own "did you mean" suggestions; the same version.
strsim = "0.11"
# Renders `mapbox completion <shell>` from the same `Command` tree everything
# else here is built from. Kept to the default features on purpose: the
# dynamic-completion half is `unstable-dynamic`, and value completion is out
# of scope (see src/completion.rs).
clap_complete = "4"
serde = { version = "1", features = ["derive"] }
serde_yaml = "0.9"
serde_json = "1"
reqwest = { version = "0.12", default-features = false, features = [
    "json",
    "blocking",
    "multipart",
    "rustls-tls",
    "charset",
    "http2",
] }
anyhow = "1"
# `agent-skills` fetches one gzipped tarball from codeload and extracts the
# `skills/` prefix. Per-file fetching is the alternative and it is not one:
# 158 files against an unauthenticated 60-requests-an-hour API budget.
# Default features off on both: this reads entries itself rather than calling
# `Archive::unpack`, so `tar`'s xattr and file-time preservation are weight
# with no caller, and `miniz_oxide` is the pure-Rust inflate that keeps the
# graph free of a C zlib.
flate2 = { version = "1", default-features = false, features = ["rust_backend"] }
tar = { version = "0.4", default-features = false }
sha2 = "0.10"
base64 = "0.22"
rand = "0.10"
open = "5"
dirs = "5"
# VS Code's and Cursor's own config files are JSONC (comments, trailing
# commas), which `serde_json` alone refuses — `mcp.rs` reads them to check
# whether a server is already registered before ever writing to them, so a
# normal, commented file must not misread as corrupt. String-aware, so a
# `//` inside a URL value is never mistaken for a comment — both features
# are needed for `parse_to_serde_value`, which decodes straight into a
# `serde_json::Value`.
jsonc-parser = { version = "0.34.0", features = ["serde", "serde_json"] }
# Asks the terminal for its background color (OSC 11), so help can use the
# palette for a dark or a light one. It reads the answer off the terminal,
# which takes raw mode and a timed read — `unsafe` this crate does not
# have — and it sends a second query every terminal answers, so one without
# OSC 11 is known at once instead of after the timeout. Asked only by a run
# that shows help; see src/output/theme.rs.
terminal-colorsaurus = "1"
# Lets `workflow run` outlive a Ctrl-C, SIGTERM or SIGHUP long enough to remove its working
# directory, which a process killed by SIGINT never gets to do. Installing
# a signal handler takes `unsafe` this crate does not have. Installed by
# that command only; every other command keeps the default.
ctrlc = { version = "3", features = ["termination"] }

[target.'cfg(unix)'.dependencies]
# For `workflow run`: passing a SIGTERM on to the running step, which a
# terminal's Ctrl-C reaches by itself and a `kill` does not. Sending a signal
# takes `unsafe` this crate does not have. Already in the graph through
# `ctrlc`; the same version. `process` and `term` for telling a Ctrl-C at the
# terminal, which reached the step already, from a `kill`.
nix = { version = "0.31", default-features = false, features = ["process", "signal", "term"] }

[target.'cfg(windows)'.dependencies]
# For `src/detach.rs`: keeping the parent's standard handles out of a detached
# child. Already in the graph through tokio and others; the same version.
windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_System_Console"] }

[dev-dependencies]
# Integration tests build fake Mapbox tokens; same crate the CLI already uses.
base64 = "0.22"