mops.toml

[dependencies]
core = "2.6.1"
# SHA-256 for the Stripe webhook signature — `Hmac.mo` imports `mo:sha2/Sha256`.
# ⚠️ Named because the alias contains DIGITS: an import scan whose pattern was
# `[A-Za-z]+` reported this dependency as unused, twice.
sha2 = "0.2.5"
# `Call.httpRequest` for the Stripe session outcall — `Main.mo` and `rails/Session.mo`
# import it. It attaches the exact `ic0.cost_http_request` price, which is why
# hand-attaching cycles is never the answer here.
ic = "4.2.0"
# ── vetKD sealing ────────────────────────────────────────────────────────
#
# BLS12-381 and the vetKD layer on it, so `Sealed.mo` can decrypt a secret that
# was encrypted to this canister's derived public key. They are path
# dependencies into the `vendor/icp-seeding-secrets-poc` submodule, pinned by its commit.
#
# ⚠️ **The `./` prefix is load-bearing.** Without it mops reads the string as a
# REGISTRY name and fails with `Package '...@vendor/icp-seeding-secrets-poc/...' not found`, which
# reads like a missing package rather than a malformed path. Measured.
#
# ⚠️ **EXPERIMENTAL, UNAUDITED.** `mo:ic-vetkeys` has no BLS12-381, and the one
# on mops (ICDevs' `bls12-381`) is not tested against `ic_bls12_381`'s vectors.
# What this code does and does not carry is `docs/DESIGN.md` §7.3: it DECRYPTS,
# and the encrypting is done client-side by `@icp-sdk/vetkeys`, so a bug here
# fails provisioning closed rather than weakening a ciphertext already on the
# wire. Delete both when `mo:ic-vetkeys` ships the curve.
ic-bls12-381 = "./vendor/icp-seeding-secrets-poc/motoko/bls12-381"
sealed-secrets-vetkeys = "./vendor/icp-seeding-secrets-poc/motoko/vetkeys"
# SHAKE256 and the field-tower hashing the two packages above need.
sha3 = "0.1.1"
# ⚠️ **Not imported by any file in this project, and NOT removable.** It arrives
# transitively via sha3, and with no floor mops resolves 0.8.2 — which predates
# moc 1.15's system-capability types and fails to type-check inside
# `ExperimentalCycles.mo` before any of our own code is reached. `mo:base` is
# deprecated and this is the one reason it appears here. Measured: removing the
# pin reproduces `M0096` in a dependency.
#
# ⚠️ **Same trap as the zero-use-but-load-bearing IMPORTS noted above, one layer up.**
# There the absence broke receiver resolution; here it breaks version resolution. Neither
# leaves a `Module.` reference to warn whoever is tidying, and this one is worse in that
# the failure surfaces inside a package nobody here wrote.
base = "0.14.5"

[toolchain]
moc = "1.16.0"
lintoko = "0.11.0"

[dev-dependencies]
test = "2.1.2"

[moc]
# -Werror with no allow-list. The project compiles warning-free, so every entry
# an allow-list would carry is a warning nobody has to think about again — and an
# unexplained allow-list recreates the problem the flag is meant to solve.
#
# The reason this exists: `Types.Owner` is a deliberate single-case variant (the
# §11.1.1 Base seam), and `Types.isOwnedBy` used to document that adding a case
# "makes this a compile error". It did not — a non-exhaustive match is M0145, a
# *warning*, and the build passed with five authz sites silently left to trap at
# runtime. On the webhook path that trap is a 5xx, which Stripe retries for ~3
# days, so a routine type extension would have presented as an outage.
#
# The -W list turns ON three style lints that are off by default. `-Werror` is
# NOT set here: `mops test` passes `--hide-warnings`, and moc refuses the two
# together ("--hide-warnings and -Werror together do not make sense"), which fails
# every test file. It is applied where it belongs instead — `mops check -- -Werror`
# in scripts/test-all.sh and in CI, the two places that gate a merge.
args = [ "-W=M0223,M0236,M0237" ]

[canisters.backend]
main = "src/backend/Main.mo"
# ⚠️ **Moved here from `icp.yaml` when the recipe went to v5.** The Motoko recipe now
# delegates to `mops build`, and its only configuration is metadata/shrink/compress — the
# main file and the Candid path live in this file. Keeping the committed `.did` named here
# preserves the §8 property: what `mops build` regenerates, what the frontend bindgens
# from, and what the deployed canister reports as `candid:service` are the same bytes.
candid = "src/backend/dist/backend.did"

# ⚠️ **The baseline is COMMITTED, and it must not be the build's own output.**
# `mops build` writes `src/backend/dist/backend.most`, which `.gitignore` excludes along
# with the rest of `dist/` — so pointing this at that path compares an artifact against a
# fresh regeneration of itself. Measured before configuring it: `mops check-stable
# src/backend/dist/backend.most backend` PASSED on the very `List` → `Set` change that
# this baseline rejects. A check that cannot fail.
#
# `deployed/backend.most` is promoted by `mops deployed` after a deliberate schema change
# and committed in the same PR. See AGENTS.md for the procedure and for why the gate
# aborts when it is missing rather than reporting a clean check.
[canisters.backend.check-stable]
path = "deployed/backend.most"

[build]
outputDir = "src/backend/dist"
args = [ "--release" ]