clippy.toml

disallowed-methods = [
    { path = "chrono::Utc::now", reason = "use wacore::time::now_utc() to respect the pluggable TimeProvider (WASM + deterministic tests)" },
    { path = "chrono::Local::now", reason = "use wacore::time::now_utc() to respect the pluggable TimeProvider and avoid direct system-clock access", allow-invalid = true },
    { path = "std::time::SystemTime::now", reason = "use wacore::time::now_millis() / now_utc()" },
    { path = "std::time::Instant::now", reason = "use wacore::time::Instant::now()" },
    # buffa's Message codec methods are generic over the buffer type, so every
    # calling crate stamps its own copy of the full encode/decode tree (LTO
    # cannot merge them). Route waproto types through the pinned wrappers in
    # waproto::codec — add one there if missing. Crate-local protos (their sole
    # instantiation site) and tests carry a scoped allow instead.
    { path = "buffa::message::Message::encode_to_vec", reason = "use waproto::codec::*_to_vec (pinned single instantiation; direct calls duplicate the encode tree per crate)" },
    { path = "buffa::message::Message::encode", reason = "use waproto::codec::*_encode_into (pinned single instantiation; direct calls duplicate the encode tree per crate)" },
    { path = "buffa::message::Message::write_to", reason = "use waproto::codec::*_write_to (pinned single instantiation; direct calls duplicate the encode tree per crate)" },
    { path = "buffa::message::Message::decode_from_slice", reason = "use waproto::codec::*_decode (pinned single instantiation; direct calls duplicate the decode tree per crate)" },
    { path = "buffa::message::Message::merge_from_slice", reason = "use waproto::codec::*_merge (pinned single instantiation; direct calls duplicate the decode tree per crate)" },
    { path = "buffa::message::Message::merge_to_limit", reason = "use a waproto::codec pinned wrapper (direct calls duplicate the decode tree per crate)" },
    { path = "buffa::message::Message::decode", reason = "use a waproto::codec pinned wrapper (direct calls duplicate the decode tree per crate)" },
    { path = "buffa::message::Message::decode_length_delimited", reason = "use a waproto::codec pinned wrapper (direct calls duplicate the decode tree per crate)" },
    { path = "buffa::message::Message::encode_length_delimited", reason = "use a waproto::codec pinned wrapper (direct calls duplicate the encode tree per crate)" },
    { path = "buffa::message::Message::encode_to_bytes", reason = "use a waproto::codec pinned wrapper (direct calls duplicate the encode tree per crate)" },
    # A browser API never gets a view into wasm memory. The web front end is
    # built with `--shared-memory`, so every Rust slice is backed by a
    # SharedArrayBuffer, and these methods take their buffer as a *view* over
    # whatever they are handed. Their specifications refuse a shared one --
    # "The provided ArrayBufferView value must not be shared" -- so the call
    # throws at run time and compiles perfectly. It has cost this repository
    # three separate outages (the socket, the call relay, and the peer's
    # audio), each invisible because the thrower discards the error, so the
    # spelling itself is banned. Copy into a JS-owned array first
    # (`js_sys::Uint8Array::from(&data[..])` / `Float32Array::from`) and use
    # the `*_with_*_array` binding beside each of these.
    { path = "web_sys::AudioBuffer::copy_to_channel", reason = "shared view: copy first and use copy_to_channel_with_f32_array" },
    { path = "web_sys::AudioBuffer::copy_to_channel_with_start_in_channel", reason = "shared view: copy first and use copy_to_channel_with_f32_array_and_start_in_channel" },
    { path = "web_sys::AudioBuffer::copy_from_channel", reason = "shared view: use copy_from_channel_with_f32_array, or get_channel_data, which copies JS-to-wasm and is safe" },
    { path = "web_sys::AudioBuffer::copy_from_channel_with_start_in_channel", reason = "shared view: use copy_from_channel_with_f32_array_and_start_in_channel" },
    { path = "web_sys::RtcDataChannel::send_with_u8_array", reason = "shared view: copy with js_sys::Uint8Array::from and use send_with_array_buffer" },
    { path = "web_sys::WebSocket::send_with_u8_array", reason = "shared view: copy with js_sys::Uint8Array::from and use send_with_array_buffer" },
    # A wait is armed in one place. These are the spelling of a hand-rolled
    # browser timer, and the tree carried *three* copies of one -- the session's
    # `exec`, the plugin host's `sched`, and the window's `clock`, two of them
    # byte-identical -- because the rule that said to share one named a module
    # only some of them could depend on. `oxidezap-platform` is now the seam and
    # sits below everything, so the rule is obeyable; this is what keeps a
    # fourth copy from being written. Use `oxidezap_platform::{sleep,
    # try_sleep, with_timeout}`.
    #
    # The exception is a fire-and-forget callback that nothing awaits, which is
    # not a wait at all: `gui/src/platform/download.rs` revokes an object URL a
    # minute after handing it over, and carries a scoped allow saying so.
    { path = "web_sys::Window::set_timeout_with_callback_and_timeout_and_arguments_0", reason = "a wait is armed in one place: use oxidezap_platform::{sleep, try_sleep, with_timeout}" },
    { path = "web_sys::WorkerGlobalScope::set_timeout_with_callback_and_timeout_and_arguments_0", reason = "a wait is armed in one place: use oxidezap_platform::{sleep, try_sleep, with_timeout}" },
]

# 64-bit atomic *types*: 32-bit targets (Xtensa/ESP32) have no native AtomicU64/
# AtomicI64, so they are absent from std/core there. portable_atomic provides a
# transparent fallback. Host-only test/bench counters carry an inline allow.
disallowed-types = [
    { path = "std::sync::atomic::AtomicU64", reason = "use portable_atomic::AtomicU64 (no native 64-bit atomics on 32-bit targets like Xtensa/ESP32)" },
    { path = "std::sync::atomic::AtomicI64", reason = "use portable_atomic::AtomicI64 (no native 64-bit atomics on 32-bit targets like Xtensa/ESP32)" },
]

# The print lints (`print_stdout`/`print_stderr`) are denied in
# `[workspace.lints.clippy]`: diagnostics belong in `log`. Test bodies use
# prints as inspection output under `--nocapture`, which is legitimate.
allow-print-in-tests = true