Use native-tls for reqwest on watchOS so arm64_32 builds

Cargo.toml

@@ -46,7 +46,7 @@ smbcloud-gresiq-sdk = "0.4.7"
 # The ACP crates (ed-mcp, ed-acp, ed-acp-tui, ed-acp-testkit) use these; ed-agent does not.
 agent-client-protocol = "2.2"
 rmcp = { version = "3.5", default-features = false }
-reqwest = { version = "0.13", default-features = false, features = ["rustls", "json", "stream"] }
+reqwest = { version = "0.13", default-features = false, features = ["json", "stream"] }
 ratatui = { version = "0.30.2", default-features = false, features = ["crossterm", "layout-cache", "unstable-rendered-line-info"] }
 crossterm = { version = "0.29", features = ["event-stream"] }
 tokio-util = "0.7"

crates/ed-acp/Cargo.toml

@@ -24,7 +24,6 @@ async-trait.workspace = true
 tokio = { workspace = true, features = ["full"] }
 tokio-util.workspace = true
 futures.workspace = true
-reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 anyhow.workspace = true
@@ -34,6 +33,16 @@ uuid.workspace = true
 directories.workspace = true
 base64.workspace = true
 
+# reqwest 0.13's `rustls` feature is the aws-lc provider, whose C code doesn't build for
+# arm64_32 (`aws-lc-sys` takes it for a 64-bit limb target), and `ring` asserts 64-bit
+# pointers on aarch64. watchOS uses `native-tls`, which is Security.framework and needs no
+# rustls provider at all.
+[target.'cfg(not(target_os = "watchos"))'.dependencies]
+reqwest = { workspace = true, features = ["rustls"] }
+
+[target.'cfg(target_os = "watchos")'.dependencies]
+reqwest = { workspace = true, features = ["native-tls"] }
+
 [dev-dependencies]
 tokio = { version = "1", features = ["full"] }
 # Turn the `local` feature on for this crate's own tests.

crates/ed-mcp/Cargo.toml

@@ -16,14 +16,22 @@ agent-client-protocol = { workspace = true, optional = true }
 ed-agent = { workspace = true, optional = true }
 async-trait = { workspace = true, optional = true }
 http = "1"
-rmcp = { workspace = true, features = ["client", "transport-streamable-http-client-reqwest", "reqwest"] }
+rmcp = { workspace = true, features = ["client", "transport-streamable-http-client-reqwest"] }
 tokio = { workspace = true, features = ["sync", "time", "process", "macros", "io-std", "io-util", "rt"] }
 tokio-util.workspace = true
 futures.workspace = true
 serde_json.workspace = true
 anyhow.workspace = true
 tracing.workspace = true
 
+# rmcp's `reqwest` feature turns on reqwest's aws-lc provider, which doesn't build for
+# arm64_32; watchOS takes `reqwest-native-tls` (Security.framework) instead.
+[target.'cfg(not(target_os = "watchos"))'.dependencies]
+rmcp = { workspace = true, features = ["reqwest"] }
+
+[target.'cfg(target_os = "watchos")'.dependencies]
+rmcp = { workspace = true, features = ["reqwest-native-tls"] }
+
 # Spawning an MCP server as a child process needs `exec`, which Apple hides on tvOS and
 # watchOS (`libc` has no `execv` there, so `nix` under `process-wrap` doesn't compile). The
 # stdio transport is everywhere else.

crates/ed-onde-account/Cargo.toml

@@ -12,11 +12,20 @@ repository.workspace = true
 homepage.workspace = true
 
 [dependencies]
-reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
 
+# reqwest 0.13's `rustls` feature is the aws-lc provider, whose C code doesn't build for
+# arm64_32 (`aws-lc-sys` takes it for a 64-bit limb target), and `ring` asserts 64-bit
+# pointers on aarch64. watchOS uses `native-tls`, which is Security.framework and needs no
+# rustls provider at all.
+[target.'cfg(not(target_os = "watchos"))'.dependencies]
+reqwest = { workspace = true, features = ["rustls"] }
+
+[target.'cfg(target_os = "watchos")'.dependencies]
+reqwest = { workspace = true, features = ["native-tls"] }
+
 [dev-dependencies]
 axum = "0.8"
 tokio = { workspace = true, features = ["macros", "net", "rt-multi-thread"] }