MODULE.bazel

module(
    name = "ducktape",
    version = "0.1.0",
)

bazel_dep(name = "platforms", version = "1.0.0")
bazel_dep(name = "bazel_skylib", version = "1.9.0")
bazel_dep(name = "rules_python", version = "1.9.0")
bazel_dep(name = "rules_python_gazelle_plugin", version = "1.9.0")
bazel_dep(name = "gazelle", version = "0.47.0", repo_name = "bazel_gazelle")
bazel_dep(name = "rules_go", version = "0.60.0", repo_name = "io_bazel_rules_go")
bazel_dep(name = "protobuf", version = "33.1")
bazel_dep(name = "rules_proto", version = "7.1.0")
bazel_dep(name = "rules_cc", version = "0.2.16")
bazel_dep(name = "or-tools", version = "9.15")
bazel_dep(name = "abseil-cpp", version = "20260107.1")
bazel_dep(name = "googletest", version = "1.17.0")
bazel_dep(name = "googleapis", version = "0.0.0-20260223-edfe7983")
bazel_dep(name = "googleapis-go", version = "1.0.0")
bazel_dep(name = "rules_shell", version = "0.6.1")  # Required by buildifier_prebuilt
bazel_dep(name = "buildifier_prebuilt", version = "8.5.1")
bazel_dep(name = "aspect_rules_lint", version = "2.3.0")
bazel_dep(name = "rules_multirun", version = "0.13.0")  # Required by format_multirun
bazel_dep(name = "rules_multitool", version = "1.11.1")
bazel_dep(name = "package_metadata", version = "0.0.6")  # Required by image_pins extension (oci_pull repos reference it)
bazel_dep(name = "ducktape_activitywatch", version = "0.1.0")
bazel_dep(name = "ducktape_haku", version = "0.1.0")
bazel_dep(name = "ducktape_manifold_mcp_server", version = "0.1.0")
bazel_dep(name = "ducktape_claude_web_env_environment_manager", version = "0.1.0")
bazel_dep(name = "rules_mypy", version = "0.40.0")
bazel_dep(name = "rules_conda", version = "0.3.2")

# aspect_rules_lint's lint actions create empty output files with `touch`, but
# some actions run with a narrow PATH. Use POSIX shell redirection instead.
single_version_override(
    module_name = "aspect_rules_lint",
    patch_strip = 1,
    patches = ["//patches:aspect_rules_lint_no_external_touch.patch"],
)

# Conda epoch versions (e.g. "1!164.3095") contain '!' which is invalid in Bazel
# repo names. Patch _package_repo_name to sanitize.
single_version_override(
    module_name = "rules_conda",
    patch_strip = 1,
    patches = ["//third_party/patches:rules_conda_sanitize_repo_name.patch"],
)

# or-tools@9.15 pulls pybind11_abseil for wrapper targets even when we only
# build the C++ CP-SAT backend. Its module creates a dev-only pip hub named
# "pypi", which collides with Ducktape's root pip hub during module extension
# resolution. Keep pybind11_abseil's apparent @pypi mapping inside that module,
# but give its generated hub a module-specific name.
single_version_override(
    module_name = "pybind11_abseil",
    patch_strip = 1,
    patches = ["//third_party/patches:pybind11_abseil_rename_pypi_hub.patch"],
)

# Fork with two fixes for CI disk exhaustion during mypy type-checking:
# 1. include_external option: allows mypy aspect to run on @pypi// deps, so they
#    get their own .mypy_cache outputs that downstream targets can symlink to
#    (upstream skips external deps, causing each internal target to re-cache them)
# 2. symlinks instead of shutil.copy(): mypy_runner.py uses symlinks when merging
#    upstream caches, reducing disk usage from O(n²) to O(n)
# TODO: Propose these changes upstream and switch back to BCR version if accepted
archive_override(
    module_name = "rules_mypy",
    sha256 = "938b128e28ddbf610ce09f3603d6797a8f023904908d16fb94748c193cda1122",
    strip_prefix = "rules_mypy-355ae265ccef0e5928a440f2f1a2a9796298ec62",
    urls = ["https://github.com/agentydragon/rules_mypy/archive/355ae265ccef0e5928a440f2f1a2a9796298ec62.tar.gz"],
)

# Terraform/OpenTofu validation (cluster/)
bazel_dep(name = "rules_tf", version = "0.0.10")

# Patch: check exit code of `tofu/terraform providers mirror` in the repo rule.
# Upstream silently ignores failures (stdout >/dev/null, return code unchecked),
# so a transient registry outage produces an incomplete mirror that Bazel caches,
# causing validate tests to fail with "provider not found in mirror".
# TODO: remove patches once https://github.com/yanndegat/rules_tf/pull/28 is merged
single_version_override(
    module_name = "rules_tf",
    patch_strip = 1,
    patches = [
        "//patches:rules_tf_check_tofu_mirror.patch",
        "//patches:rules_tf_check_terraform_mirror.patch",
        "//patches:rules_tf_exclude_dotterraform.patch",
    ],
)

# Workaround: gitlab.arm.com (hosting rules_diff, ape, toolchain_utils,
# download_utils) returns 503 errors, blocking all Bazel builds. rules_diff is
# a transitive dep of aspect_rules_lint that provides a hermetic diff binary via
# cosmopolitan libc. This local override replaces it with a shim that uses the
# system diff binary instead.
local_path_override(
    module_name = "rules_diff",
    path = "third_party/rules_diff",
)

local_path_override(
    module_name = "ducktape_activitywatch",
    path = "third_party/activitywatch",
)

local_path_override(
    module_name = "ducktape_haku",
    path = "haku/shared",
)

local_path_override(
    module_name = "ducktape_manifold_mcp_server",
    path = "third_party/manifold_mcp_server",
)

local_path_override(
    module_name = "ducktape_claude_web_env_environment_manager",
    path = "devinfra/claude/web_env/re/environment_manager/src",
)

tf = use_extension("@rules_tf//tf:extensions.bzl", "tf_repositories")
tf.download(
    # Pre-fetch provider plugins at Bazel fetch time so that tf_module validate
    # and lint targets work hermetically (no network needed at test time).
    # Each version must satisfy the constraints of ALL modules that use it.
    # When modules disagree (e.g., ~>3.0 vs ~>3.7.0), use the tighter range.
    mirror = {
        "authentik": "goauthentik/authentik:2026.2.0",
        "aws": "hashicorp/aws:5.100.0",
        # Intentionally omitted from the global provider mirror while
        # tf/gitops/haku-cloud-agent is parked: the OpenTofu registry still
        # advertises modus-agendi/anthropic-claude-managed-agents v1.1.0, but
        # its GitHub repo/release assets currently 404. Keeping it here makes
        # unrelated Terraform/image jobs fail while mirroring providers.
        "external": "hashicorp/external:2.3.5",
        "flux": "fluxcd/flux:1.7.6",
        "forgejo": "svalabs/forgejo:1.5.0",
        "github": "integrations/github:6.6.0",
        "grafana": "grafana/grafana:3.22.2",
        "harbor": "goharbor/harbor:3.11.3",
        "hcloud": "hetznercloud/hcloud:1.60.0",
        "headscale": "awlsring/headscale:0.5.0",
        "helm": "hashicorp/helm:3.1.1",
        "http": "hashicorp/http:3.6.0",
        "kubernetes": "hashicorp/kubernetes:2.38.0",
        "libvirt": "dmacvicar/libvirt:0.9.3",
        # CAUTION: low-user-count community provider that authenticates with the
        # LiteLLM master key (tf/gitops/litellm-keys). On every version bump,
        # manually review the source diff since the last pinned tag (focus:
        # request construction/egress and release workflow) BEFORE updating.
        # Do not auto-merge Renovate/update_deps bumps.
        "litellm": "ncecere/litellm:2.0.1",
        "local": "hashicorp/local:2.5.3",
        "null": "hashicorp/null:3.2.4",
        "ovh": "ovh/ovh:2.13.1",
        "proxmox": "bpg/proxmox:0.93.0",
        "random": "hashicorp/random:3.7.2",
        "sops": "carlpett/sops:1.4.1",
        "talos": "siderolabs/talos:0.10.1",
        "tls": "hashicorp/tls:4.1.0",
        "vault": "hashicorp/vault:5.7.0",
    },
    tfdoc_version = "0.19.0",
    tflint_version = "0.53.0",
    use_tofu = True,
    version = "1.11.2",  # OpenTofu version (latest as of 2025-12)
)
use_repo(tf, "tf_toolchains")

register_toolchains("@tf_toolchains//:all")

# Python OCI image layering (aspect_rules_py)
bazel_dep(name = "aspect_rules_py", version = "1.10.0")

# Container images (rules_oci)
bazel_dep(name = "rules_oci", version = "2.3.0")
bazel_dep(name = "rules_distroless", version = "0.8.0")
bazel_dep(name = "rules_pkg", version = "1.2.0")

oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")

# Docker Hub base images are pulled through mirror.gcr.io (Google's pull-through
# cache of Docker Hub) instead of docker.io directly: Docker Hub's anonymous
# per-IP pull-rate limit reliably 429s the shared CI runner during
# `bazel build //...`. mirror.gcr.io serves the same content-addressed digests
# with much higher anonymous limits and no credentials. gcr.io/ghcr.io images
# below are pulled directly (they don't rate-limit).

# Production base image for py_image_layer containers.
# aspect_rules_py's py_binary generates a bash launcher, so the base needs a
# shell. Debian slim provides bash + glibc + libstdc++ at ~30 MB compressed.
# The hermetic Python toolchain is bundled in the interpreter layer.
oci.pull(
    name = "debian_trixie_slim",
    digest = "sha256:4ffb3a1511099754cddc70eb1b12e50ffdb67619aa0ab6c13fcd800a78ef7c7a",
    image = "mirror.gcr.io/library/debian",
    platforms = ["linux/amd64"],
    tag = "trixie-slim",
)

# Test infrastructure: PostgreSQL for Testcontainers (match production version)
oci.pull(
    name = "postgres_18",
    digest = "sha256:a9abf4275f9e99bff8e6aed712b3b7dfec9cac1341bba01c1ffdfce9ff9fc34a",
    image = "mirror.gcr.io/library/postgres",
    platforms = ["linux/amd64"],
    tag = "18",
)

# Test infrastructure: Docker registry for e2e tests
oci.pull(
    name = "registry_2",
    digest = "sha256:a3d8aaa63ed8681a604f1dea0aa03f100d5895b6a58ace528858a7b332415373",
    image = "mirror.gcr.io/library/registry",
    platforms = ["linux/amd64"],
    tag = "2",
)

# Test infrastructure: Testcontainers Ryuk reaper (container cleanup)
oci.pull(
    name = "ryuk",
    digest = "sha256:bf3f74a47dee0acda89aba4b2fc9c7fdcf994a084db02a2d06566f07baae022e",
    image = "mirror.gcr.io/testcontainers/ryuk",
    platforms = ["linux/amd64"],
    tag = "0.8.1",
)

# Test infrastructure: Grocy for MCP e2e tests (match cluster/k8s/grocy/deployment.yaml)
oci.pull(
    name = "grocy",
    digest = "sha256:01036076182f2191e8ac42a3876548bfd3a139a2ada8705212e83806865c1f58",
    image = "mirror.gcr.io/linuxserver/grocy",
    platforms = ["linux/amd64"],
    tag = "v4.6.0-ls318",
)

# Distroless cc: minimal glibc + libstdc++ + ca-certificates, no shell.
# Debian 12 (Bookworm) ships glibc 2.36.
oci.pull(
    name = "distroless_cc_debian12",
    digest = "sha256:329e54034ce498f9c6b345044e8f530c6691f99e94a92446f68c0adf9baa8464",
    image = "gcr.io/distroless/cc-debian12",
    platforms = ["linux/amd64"],
    tag = "latest",
)

# InvenTree application base image — for layering in the rai_plugin wheel.
# To update: docker manifest inspect inventree/inventree:stable | jq -r '.manifests[] | select(.platform.architecture=="amd64") | .digest'
oci.pull(
    name = "inventree_stable",
    digest = "sha256:56adc4e50a7300daeb0ba5d6246f8c252b8bf2f43903e48808e097a2e730c9b1",
    image = "mirror.gcr.io/inventree/inventree",
    platforms = ["linux/amd64"],
    tag = "stable",
)

# Talos imager: builds reproducible Talos disk images from pinned boot assets.
# Uses v1.13.0-alpha.2+ which supports unprivileged builds (no loop devices) and
# deterministic output (SOURCE_DATE_EPOCH + DETERMINISTIC_SEED).
# v1.12.x requires --privileged and produces non-reproducible images.
oci.pull(
    name = "talos_imager",
    digest = "sha256:bc8bce35a1debae740a887be7a8a3e2907c243c29edca1d57b66720e96a73e24",
    image = "ghcr.io/siderolabs/imager",
    platforms = ["linux/amd64"],
    tag = "v1.13.0-alpha.2",
)

# Base image for container E2E tests. rules_distroless layers git + JDK on top.
oci.pull(
    name = "python_3_13_slim",
    digest = "sha256:739e7213785e88c0f702dcdc12c0973afcbd606dbf021a589cab77d6b00b579d",
    image = "mirror.gcr.io/library/python",
    platforms = ["linux/amd64"],
    tag = "3.13-slim",
)
oci.pull(
    name = "mitmproxy",
    digest = "sha256:e0deb0df7edf9f909053f274a067cd1cacb90f5c17d74459e1693179c0b98d8f",
    image = "mirror.gcr.io/mitmproxy/mitmproxy",
    platforms = ["linux/amd64"],
    tag = "11",
)

# Unprivileged nginx for the augur frontend image (static React bundle served
# behind oauth2-proxy + readOnlyRootFilesystem).
# To repin:
#   crane digest --platform linux/amd64 docker.io/nginxinc/nginx-unprivileged:1.27-alpine
oci.pull(
    name = "nginx_unprivileged",
    digest = "sha256:28d91bdce70ad09025ea901458fdd149259d8e05982ade79d4ef2c0d9470eb48",
    image = "mirror.gcr.io/nginxinc/nginx-unprivileged",
    platforms = ["linux/amd64"],
    tag = "1.27-alpine",
)

# Stalwart mailserver — base for the haku-mailbox repack (server + stalwart-cli,
# //cluster/k8s/haku/mailbox/image). To repin:
#   crane digest --platform linux/amd64 docker.io/stalwartlabs/stalwart:<tag>
oci.pull(
    name = "stalwart",
    digest = "sha256:d928787a9089575245c7f1c8811e49ac301b0c2a6d86fdd3e84835b45794f7ef",
    image = "mirror.gcr.io/stalwartlabs/stalwart",
    platforms = ["linux/amd64"],
    tag = "v0.16.11",
)
use_repo(oci, "debian_trixie_slim", "debian_trixie_slim_linux_amd64", "distroless_cc_debian12", "distroless_cc_debian12_linux_amd64", "grocy", "grocy_linux_amd64", "inventree_stable", "inventree_stable_linux_amd64", "mitmproxy", "mitmproxy_linux_amd64", "nginx_unprivileged", "nginx_unprivileged_linux_amd64", "postgres_18", "postgres_18_linux_amd64", "python_3_13_slim", "python_3_13_slim_linux_amd64", "registry_2", "registry_2_linux_amd64", "ryuk", "ryuk_linux_amd64", "stalwart", "stalwart_linux_amd64", "talos_imager", "talos_imager_linux_amd64")

# Container image pins from devinfra/image_pins.json.
# - Generates @image_pins//:pins.bzl with NAME_IMAGE / NAME_DIGEST constants
# - Calls oci_pull for images with "platforms" (creates OCI repos for tests)
# CI workflows update the JSON via devinfra/update_image_pin.py.
image_pins = use_extension("//devinfra:image_pins.bzl", "image_pins")
image_pins.from_file(lockfile = "//devinfra:image_pins.json")
use_repo(image_pins, "excalidraw", "excalidraw_linux_amd64", "freecad_test", "freecad_test_linux_amd64", "image_pins")

# Hermetic deb packages for container images (rules_distroless).
# Replaces Dockerfile apt-get with lockfile-pinned deb extraction.
apt = use_extension("@rules_distroless//apt:extensions.bzl", "apt")

# E2E test container: git + JDK layered on python:3.13-slim base.
apt.install(
    name = "trixie_e2e",
    lock = "//devinfra/claude/claude_hook/container_e2e:trixie_e2e.lock.json",
    manifest = "//devinfra/claude/claude_hook/container_e2e:trixie_e2e.yaml",
)

# Firecracker VM pod: nftables on debian:trixie-slim.
apt.install(
    name = "trixie_fc_vm_pod",
    lock = "//devinfra/firecracker/vm_pod:trixie_fc_vm_pod.lock.json",
    manifest = "//devinfra/firecracker/vm_pod:trixie_fc_vm_pod.yaml",
)

# CPAP sync: nmcli (talks to host NetworkManager over dbus) + git (pushes to
# the cpap-data Forgejo repo) on debian:trixie-slim.
apt.install(
    name = "trixie_cpap_sync",
    lock = "//cpap:trixie_cpap_sync.lock.json",
    manifest = "//cpap:trixie_cpap_sync.yaml",
)

# JWT rotation image: git + ca-certificates on debian:trixie-slim for the
# authentik-jwt-rotation CronJob (Authentik client_credentials exchange + commit).
apt.install(
    name = "trixie_authentik_rotation",
    lock = "//cluster/rotators/authentik_jwt_rotation:trixie_authentik_rotation.lock.json",
    manifest = "//cluster/rotators/authentik_jwt_rotation:trixie_authentik_rotation.yaml",
)

# attic-jwt-rotation CronJob (kubectl exec into attic pod for atticadm + commit).
apt.install(
    name = "trixie_attic_rotation",
    lock = "//cluster/rotators/attic_jwt_rotation:trixie_attic_rotation.lock.json",
    manifest = "//cluster/rotators/attic_jwt_rotation:trixie_attic_rotation.yaml",
)

# gnome-shell + Xvfb + dbus on debian:trixie-slim for the aiquota
# extension golden-render tests.
apt.install(
    name = "gnome_shell_test",
    lock = "//gnome/test_image:apt.lock.json",
    manifest = "//gnome/test_image:apt.yaml",
)

# Budget exporter image: git + ca-certificates on debian:trixie-slim so the
# export_ledger CronJob can clone/commit/push the Beancount ledger repo.
apt.install(
    name = "trixie_budget_exporter",
    lock = "//finance/beancount_export:trixie_budget_exporter.lock.json",
    manifest = "//finance/beancount_export:trixie_budget_exporter.yaml",
)

# wayback cache service: libssl + CA bundle on debian:trixie-slim for the
# Rust runtime image.
apt.install(
    name = "trixie_wayback_cache",
    lock = "//loom/wayback/cache:trixie_wayback_cache.lock.json",
    manifest = "//loom/wayback/cache:trixie_wayback_cache.yaml",
)
use_repo(apt, "gnome_shell_test", "trixie_attic_rotation", "trixie_authentik_rotation", "trixie_budget_exporter", "trixie_cpap_sync", "trixie_e2e", "trixie_fc_vm_pod", "trixie_wayback_cache")

# JavaScript/TypeScript (Node.js frontends)
bazel_dep(name = "aspect_bazel_lib", version = "2.22.5")
bazel_dep(name = "aspect_rules_esbuild", version = "0.25.1")
bazel_dep(name = "aspect_rules_js", version = "2.9.2")
bazel_dep(name = "aspect_rules_ts", version = "3.8.7")
bazel_dep(name = "rules_nodejs", version = "6.7.3")

# Browser testing (provides hermetic Chromium for Puppeteer/Playwright tests)
bazel_dep(name = "rules_playwright", version = "0.5.3", dev_dependency = True)

playwright = use_extension("@rules_playwright//playwright:extensions.bzl", "playwright", dev_dependency = True)
playwright.repo(
    # Use Playwright 1.50.x for Chromium compatibility with Puppeteer 23.x
    playwright_version = "1.50.1",
)
use_repo(playwright, playwright_browsers = "playwright")

# Node.js toolchain
node = use_extension("@rules_nodejs//nodejs:extensions.bzl", "node")
node.toolchain(node_version = "22.11.0")  # LTS 'Jod'

# TypeScript toolchain for ts_project (//devinfra/js:ts_library.bzl). The bazel_dep alone
# yields nothing — @npm_typescript does not exist until this extension is used. Version follows
# the workspace's pinned typescript so the checker and the editor agree.
rules_ts_ext = use_extension("@aspect_rules_ts//ts:extensions.bzl", "ext")

# Exact, not `ts_version_from`: package.json pins the range `~5.8.3`, and rules_ts mirrors
# exact versions only. Keep in step with pnpm-lock.yaml's resolved typescript.
rules_ts_ext.deps(ts_version = "5.8.3")
use_repo(rules_ts_ext, "npm_typescript")

# Pin pnpm v9 to match the lockfile format (rules_js 2.9.2 defaults to pnpm v8
# which cannot read lockfileVersion 9 and triggers a non-hermetic regeneration).
pnpm = use_extension("@aspect_rules_js//npm:extensions.bzl", "pnpm")
pnpm.pnpm(
    pnpm_version = "9.15.9",
    pnpm_version_integrity = "sha512-aARhQYk8ZvrQHAeSMRKOmvuJ74fiaR1p5NQO7iKJiClf1GghgbrlW1hBjDolO95lpQXsfF+UA+zlzDzTfc8lMQ==",
)
use_repo(pnpm, "pnpm")

# Workspace-level npm packages (pnpm workspace)
# All JS/TS projects share a single lockfile and node_modules
npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm")
npm.npm_translate_lock(
    name = "npm_ducktape",
    # Generate bin entries for dev tools from workspace root
    bins = {
        "eslint": ["eslint=./bin/eslint.js"],
        "json-schema-to-typescript": ["json2ts=./dist/src/cli.js"],
        "prettier": ["prettier=./bin/prettier.cjs"],
        "svelte-check": ["svelte-check=./bin/svelte-check"],
        "@sveltejs/kit": ["svelte-kit=./svelte-kit.js"],
        "vite": ["vite=./bin/vite.js"],
        "storybook": ["storybook=./index.cjs"],
        "http-server": ["http-server=./bin/http-server"],
    },
    # Track package.json and workspace files for auto-update
    data = [
        "//:airlock/frontend/package.json",
        "//:package.json",
        "//:pnpm-workspace.yaml",
        "//:props/frontend/package.json",
        "//:util/testing/frontend_visual/package.json",
        "//:x/agent_server/web/package.json",
        "//:x/rspcache/admin_ui/package.json",
        "//:x/study_casino/frontend/package.json",
    ],
    # Disable postinstall for packages that download binaries during lifecycle hooks.
    # These fail in Bazel's sandboxed builds (network blocked, RBE).
    lifecycle_hooks_exclude = [
        # Tries to download native bindings from npm registry. Safe to skip since
        # @storybook/test-runner (the only consumer via jest-resolve) isn't executed
        # during bazel build - only used for manual testing.
        "unrs-resolver",
        # Postinstall downloads Chromium (~280MB) which fails in sandboxed builds.
        # .puppeteerrc.cjs (skipDownload: true) isn't visible inside the lifecycle
        # hook sandbox. Browsers are provided hermetically via rules_playwright
        # (@playwright_browsers//:chromium-headless-shell) and CHROMIUM_HEADLESS_SHELL.
        "puppeteer",
    ],
    npmrc = "//:.npmrc",
    # Root pnpm-lock.yaml with workspace packages
    pnpm_lock = "//:pnpm-lock.yaml",
    # Hoist ESLint plugins for runtime discovery
    public_hoist_packages = {
        "@eslint/js": [""],
        "@typescript-eslint/eslint-plugin": [""],
        "@typescript-eslint/parser": [""],
        "eslint-plugin-svelte": [""],
        "eslint-plugin-import-x": [""],
        "eslint-plugin-react": [""],
        "eslint-plugin-react-hooks": [""],
        "svelte-eslint-parser": [""],
        "globals@16.5.0": [""],
    },
    # Auto-regenerate pnpm-lock.yaml when package.json changes
    update_pnpm_lock = True,
    use_pnpm = "@pnpm//:package/bin/pnpm.cjs",
)
use_repo(npm, "npm_ducktape")

# Custom multitool lockfile with newer ruff (0.15.8 vs 0.8.3 in aspect_rules_lint)
multitool = use_extension("@rules_multitool//multitool:extension.bzl", "multitool")
multitool.hub(lockfile = "//devinfra:lockfile.json")
use_repo(multitool, "multitool")

python = use_extension("@rules_python//python/extensions:python.bzl", "python")
python.toolchain(
    is_default = True,
    python_version = "3.13",
)

# rules_conda v0.3.2 hardcodes Python 3.11 for its internal tools (py-rattler, pyyaml).
python.toolchain(
    python_version = "3.11",
)

pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")

# Proxy env for pip downloads is injected via .bazelrc --action_env by the
# session-start hook on Claude Code web. No hardcoded proxy here - this file
# should work both on local dev machines and on CC web.

pip.parse(
    hub_name = "pypi",
    python_version = "3.13",
    requirements_lock = "//:requirements_bazel.txt",
)

# Separate pip hub for homeassistant - requires Python 3.13.2+
# Using "3.13" for Bazel toolchain (actual runtime is 3.13.x)
pip.parse(
    hub_name = "pypi_homeassistant",
    python_version = "3.13",
    requirements_lock = "//homeassistant:requirements.txt",
)

# Separate pip hub for the Tana LiteLLM proxy appliance. LiteLLM's proxy extra
# pins package versions that conflict with unrelated repo-wide Python deps, so
# keep the production proxy image in its own resolver universe.
pip.parse(
    hub_name = "pypi_tana_litellm_proxy",
    python_version = "3.13",
    requirements_lock = "//tana/litellm_proxy:requirements.txt",
)
use_repo(pip, "pypi", "pypi_homeassistant", "pypi_tana_litellm_proxy")

# Type stubs for mypy - extracts types-* and *-stubs packages from requirements
# and provides them to the mypy aspect for per-target stub inclusion.
types = use_extension("@rules_mypy//mypy:types.bzl", "types")
types.requirements(
    name = "pip_types",
    # Exclusions prevent rules_mypy from generating requirement("X") mappings
    # for type stubs whose runtime package isn't in the pip hub (or has a
    # different name). Without exclusion, Bazel fails at analysis time with
    # "no such package '@@rules_python++pip+pypi//X'".
    #
    # Cleaned-up stubs (no longer need exclusion):
    # - sqlalchemy-stubs, types-sqlalchemy: removed from pyproject.toml
    #   (SQLAlchemy 2.0+ provides types via sqlalchemy[mypy])
    # - types-jinja2: removed from pyproject.toml (jinja2 ships py.typed)
    # - types-toml: removed from pyproject.toml (we use tomllib, not toml)
    # - types-paramiko, types-pytz: runtime deps added to pyproject.toml
    #   so their stubs resolve correctly
    #
    # TODO: Upstream fix in rules_mypy to gracefully skip stubs whose
    # runtime package isn't in the pip hub, instead of failing at load time.
    # That would eliminate the need for this exclusion list entirely.
    exclude_requirements = [
        # freecad-stubs provides FreeCAD/Part/Sketcher modules but there's
        # no "freecad" runtime pip package — FreeCAD comes from conda.
        "freecad-stubs",
        # types-psycopg2 maps to requirement("psycopg2") but we use
        # psycopg2-binary (different pip package name). Can't be fixed
        # by adding a dep — psycopg2 and psycopg2-binary conflict.
        "types-psycopg2",
    ],
    pip_requirements = "@pypi//:requirements.bzl",
    requirements_txt = "//:requirements_bazel.txt",
)
use_repo(types, "pip_types")

# uv toolchain for requirements locking
uv = use_extension("@rules_python//python/uv:uv.bzl", "uv")
uv.configure(version = "0.9.30")

# BuildBuddy platform definitions — our //:rbe_linux_x64 inherits from these
# since our RBE worker image is based on BuildBuddy's rbe-ubuntu24-04.
bazel_dep(name = "toolchains_buildbuddy", version = "0.0.4")

buildbuddy = use_extension("@toolchains_buildbuddy//:extensions.bzl", "buildbuddy")
buildbuddy.platform(buildbuddy_container_image = "UBUNTU24_04_IMAGE")
buildbuddy.gcc_toolchain(gcc_major_version = "13")
use_repo(buildbuddy, "buildbuddy_toolchain")

# BuildBuddy CC toolchain — uses GCC pre-installed in the RBE container.
# exec_compatible_with @bazel_tools//tools/cpp:gcc constrains it to //:rbe_linux_x64.
# Local actions use the auto-detected system GCC.
register_toolchains("@buildbuddy_toolchain//:ubuntu_cc_toolchain")

# Rust rules
bazel_dep(name = "rules_rust", version = "0.70.0")
bazel_dep(name = "rules_rust_prost", version = "0.70.0")

# — rust toolchains —
rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
rust.toolchain(
    edition = "2024",
    versions = ["1.88.0"],
)
use_repo(rust, "rust_toolchains")

register_toolchains("@rust_toolchains//:all")

# ─ Rust crates (crate_universe) ─────────────────────────────────────────────
# Keep this extension visible to downstream modules. Ducktape BUILD files use
# apparent labels such as `@crates//:anyhow`, and those labels are resolved in
# Ducktape's own repository mapping when another workspace consumes Ducktape via
# `bazel_dep` + `archive_override`. A downstream workspace's root `@crates`
# repository cannot satisfy those labels.
#
# Do not attach Ducktape's `Cargo.Bazel.lock` here. rules_rust's rendered-lock
# checksum is not portable across root-module and dependency-module path
# contexts, which makes downstream consumers fail analysis even though
# `Cargo.lock` is pinned. Let crate_universe render from the Cargo lock instead.
crate = use_extension(
    "@rules_rust//crate_universe:extensions.bzl",
    "crate",
)

# If your workspace has Cargo.toml at the root:
crate.from_cargo(
    name = "crates",  # this becomes the repo name
    cargo_lockfile = "//:Cargo.lock",
    manifests = ["//:Cargo.toml"],
)

# expose the generated repo (↑ name="crates")
use_repo(crate, "crates")

# Haskell + Hakyll (rules_haskell, stackage snapshot, xml-conduit override, GHC
# toolchain) is scoped to the //website nested module. See website/MODULE.bazel
# and website/README.md. Keeping it out of the root module means the root
# workspace doesn't need to fetch @rules_haskell and build GHC on every
# `bazel query //...`.

# ─ External binaries via http_archive ────────────────────────────────────────
http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")

# ca-certificates deb feeding //third_party/debian_slim:cacerts — the single repo-level
# source of a generated /etc/ssl/certs/ca-certificates.crt bundle for distroless images
# (rules_distroless apt unpacks the deb but never runs update-ca-certificates, so its
# :flat layer has no usable bundle). The bundle is a release-independent PEM file, so one
# deb (the newest, from trixie) serves both bookworm- and trixie-based images. See that
# BUILD file and STYLE.md § "System CA certificates in distroless images".
http_archive(
    name = "ca_certificates_deb",
    build_file_content = 'exports_files(["data.tar.xz"])',
    sha256 = "ef590f89563aa4b46c8260d49d1cea0fc1b181d19e8df3782694706adf05c184",
    type = "deb",
    urls = ["https://snapshot.debian.org/archive/debian/20260301T000000Z/pool/main/c/ca-certificates/ca-certificates_20250419_all.deb"],
)

# tiktoken o200k_base encoding (used by gpt-4o) — bundled for offline/RBE testing.
# Cache key = sha1("https://openaipublic.blob.core.windows.net/encodings/o200k_base.tiktoken")
http_file(
    name = "tiktoken_o200k_base",
    downloaded_file_path = "fb374d419588a4632f3f557e76b4b70aebbca790",
    sha256 = "446a9538cb6c348e3516120d7c08b09f57c36495e2acfffe59a5bf8b0cfb1a2d",
    urls = ["https://openaipublic.blob.core.windows.net/encodings/o200k_base.tiktoken"],
)

# openai/codex source — consumed via overlaid BUILD files by the execpolicy audit
# tool (//x/codex_execpolicy_audit). Pinned to a specific commit; the overlay patch
# adds BUILD.bazel to the two crates we need (shell-command, utils/absolute-path) and
# drops the schemars/ts-rs derives from absolute-path. Bump commit + re-roll patch +
# update sha256 together.
http_archive(
    name = "codex",
    patch_strip = 1,
    patches = ["//x/codex_execpolicy_audit:codex_bazel_overlay.patch"],
    sha256 = "6e84a59661aab07686061da4e8f37b9bb828ac3ecf2ea5e69ee482fcc72fed13",
    strip_prefix = "codex-9e552e9d15ba52bed7077d5357f3e18e330f8f38",
    urls = ["https://github.com/openai/codex/archive/9e552e9d15ba52bed7077d5357f3e18e330f8f38.tar.gz"],
)

# Grocy OpenAPI 3.1 spec — fetched verbatim from the upstream repo so
# `//grocy_mcp:server` can drive `FastMCP.from_openapi` without
# vendoring the 100 KB JSON in-tree. Refresh by bumping the tag and
# updating the sha256.
http_file(
    name = "grocy_openapi_spec",
    downloaded_file_path = "grocy.openapi.json",
    sha256 = "04280473b40b031a30c335f7991c959e51c6f42e91689b2d526886f997b368c7",
    urls = ["https://raw.githubusercontent.com/grocy/grocy/v4.6.0/grocy.openapi.json"],
)

# Gmail's and Google Calendar's official multicolor product icon SVGs — Google's own versioned
# gstatic-hosted assets, the same ones Google itself serves for these apps' icons. haku-console's
# tool-call preview widgets embed them (as build-time-generated data URIs; see
# haku/console/frontend/BUILD.bazel) to mark a link that opens in that app. Versioned URL, so
# content is expected stable; bump the version path + sha256 if Google revises the mark.
http_file(
    name = "gmail_icon_svg",
    downloaded_file_path = "gmail.svg",
    sha256 = "4a255e631f5e08a0426ec385148d216eb5fe42c82ffa8097b7e44622c6862a6e",
    urls = ["https://fonts.gstatic.com/s/i/productlogos/gmail_2020q4/v11/192px.svg"],
)

http_file(
    name = "google_calendar_icon_svg",
    downloaded_file_path = "calendar.svg",
    sha256 = "26e9daec33d3a5859160c465c5e43d3bddef0c994efb1a4643135686eaf1c0cc",
    urls = ["https://fonts.gstatic.com/s/i/productlogos/calendar_2020q4/v11/192px.svg"],
)

# FreeCAD 1.2.dev from conda.
# Lockfile generated with pixi (not bazel run lockfile.update — rules_conda's
# lock_environments target has a Python version conflict with our 3.13 toolchain).
# Root-only: downstream modules such as Gaffer consume Ducktape's debundler and
# must not evaluate this Conda environment extension.
conda = use_extension(
    "@rules_conda//conda:extensions.bzl",
    "conda",
    dev_dependency = True,
)
conda.environment(
    name = "freecad_conda",
    environment = "default",
    lockfile = "//skills/freecad/conda:pixi.lock",
)
use_repo(conda, "freecad_conda")

# neka-nat/freecad-mcp addon — XML-RPC server for interactive FreeCAD driving.
# Loaded via FreeCAD's -M flag. Used by skills/freecad interactive mode + tests.
_FREECAD_MCP_COMMIT = "c1548b56ddbab8942ce069d25f097c491a013c16"

http_archive(
    name = "freecad_mcp",
    build_file_content = """
filegroup(
    name = "addon",
    srcs = glob(["addon/FreeCADMCP/**/*.py"]),
    visibility = ["//visibility:public"],
)
""",
    sha256 = "8530d7177f333a1e66e256d2dfba8ff3990dafe4155e70a571c95e41680cf7cc",
    strip_prefix = "freecad-mcp-" + _FREECAD_MCP_COMMIT,
    urls = ["https://github.com/neka-nat/freecad-mcp/archive/" + _FREECAD_MCP_COMMIT + ".tar.gz"],
)

# gitstatusd - Git status daemon for wt tests
# Build target: //third_party/gitstatusd
http_archive(
    name = "gitstatusd",
    build_file_content = 'exports_files(["gitstatusd-linux-x86_64"])',
    sha256 = "9633816e7832109e530c9e2532b11a1edae08136d63aa7e40246c0339b7db304",
    urls = ["https://github.com/romkatv/gitstatus/releases/download/v1.5.4/gitstatusd-linux-x86_64.tar.gz"],
)

# sops - Mozilla SOPS binary for age/KMS secret encryption/decryption.
# Used by the authentik-jwt-rotation CronJob image.
http_file(
    name = "sops_linux_amd64",
    downloaded_file_path = "sops",
    executable = True,
    sha256 = "5488e32bc471de7982ad895dd054bbab3ab91c417a118426134551e9626e4e85",
    urls = ["https://github.com/getsops/sops/releases/download/v3.9.4/sops-v3.9.4.linux.amd64"],
)

# stalwart-cli — Stalwart's management CLI, layered onto the server image for
# the haku-mailbox provisioning bootstrap. Upstream ships it only as a
# distroless image (bare binary, no shell to copy it out of in an
# initContainer) and as release tarballs; the server image carries no CLI.
# Build target: //cluster/k8s/haku/mailbox/image
http_archive(
    name = "stalwart_cli",
    build_file_content = 'exports_files(["stalwart-cli"])',
    sha256 = "d1713cd4e00908af02d372d1a9e44e9df69182ab5caf8481557f0eb1b22ea5f5",
    strip_prefix = "stalwart-cli-x86_64-unknown-linux-musl",
    urls = ["https://github.com/stalwartlabs/cli/releases/download/v1.0.10/stalwart-cli-x86_64-unknown-linux-musl.tar.xz"],
)

# Capability-free server binary overlaid onto the Stalwart OCI base. The
# upstream image sets cap_net_bind_service on its binary; restricted pods that
# drop all capabilities cannot exec that file even though this deployment uses
# only unprivileged ports.
http_archive(
    name = "stalwart_server",
    build_file_content = 'exports_files(["stalwart"])',
    sha256 = "2ef28f93bff0fa22eae7c5e7bd7c234eb958cb46393a7542fda45486b889a7bf",
    urls = ["https://github.com/stalwartlabs/stalwart/releases/download/v0.16.11/stalwart-x86_64-unknown-linux-musl.tar.gz"],
)

# Adoptium Temurin JDK 21 — provides keytool and cacerts for claude tests.
# Build target: //third_party/jdk
http_archive(
    name = "adoptium_jdk21",
    build_file_content = """\
exports_files([
    "bin/keytool",
    "lib/security/cacerts",
])
""",
    sha256 = "a2650fba422283fbed20d936ce5d2a52906a5414ec17b2f7676dddb87201dbae",
    strip_prefix = "jdk-21.0.6+7",
    urls = ["https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.6%2B7/OpenJDK21U-jdk_x64_linux_hotspot_21.0.6_7.tar.gz"],
)

# kubectl v1.32.3 — packaged into cluster maintenance images.
http_file(
    name = "kubectl_linux_amd64",
    downloaded_file_path = "kubectl",
    executable = True,
    sha256 = "ab209d0c5134b61486a0486585604a616a5bb2fc07df46d304b3c95817b2d79f",
    urls = ["https://dl.k8s.io/release/v1.32.3/bin/linux/amd64/kubectl"],
)

# Bazelisk v1.25.0 linux-amd64 — used by container E2E test to provide
# bazelisk on PATH inside the test container (mirrors what Nix provides in prod).
http_file(
    name = "bazelisk_linux_amd64",
    downloaded_file_path = "bazelisk",
    executable = True,
    sha256 = "fd8fdff418a1758887520fa42da7e6ae39aefc788cf5e7f7bb8db6934d279fc4",
    urls = ["https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-amd64"],
)

# Docker CLI (static binaries) + `docker compose` v2 plugin for the loom/gym
# eval driver image. Inspect-AI's docker sandbox provider shells out to the
# `docker` CLI and the `docker compose` plugin, neither of which Debian packages
# as a v2 plugin (docker.io ships only the CLI/daemon; there is no
# docker-compose-v2 in Debian main). Fetch the upstream static builds instead.
# The tarball also bundles dockerd/containerd/runc; only `docker` is used here
# (the eval talks to a remote daemon via $DOCKER_HOST), and //loom/gym packages
# just the CLI into the image layer.
http_archive(
    name = "docker_cli_static",
    build_file_content = 'exports_files(["docker/docker"])',
    sha256 = "34eea64e9c3435f5af1b760827a56a561cd67fc2d6e9cd1813b8bb1e3ff7930b",
    urls = ["https://download.docker.com/linux/static/stable/x86_64/docker-29.5.3.tgz"],
)

# docker compose v2 plugin binary — installed at the cli-plugins path so
# `docker compose ...` resolves it.
http_file(
    name = "docker_compose_plugin",
    downloaded_file_path = "docker-compose",
    executable = True,
    sha256 = "bd5835ccbbf06a42dcb5294c65e34a4634b34447afb9ed6fc7adf18a000e0f99",
    urls = ["https://github.com/docker/compose/releases/download/v2.40.0/docker-compose-linux-x86_64"],
)

# Bazel 8.6.0 linux-amd64 — prepopulates Bazelisk's cache in the claude-hook
# container E2E image so the nested `bazelisk build //:hello` does not fetch
# from releases.bazel.build at test runtime.
http_file(
    name = "bazel_8_6_0_linux_amd64",
    downloaded_file_path = "bazel",
    executable = True,
    sha256 = "9860da9c9386bbc023feed8f43af3105d338727d77b644fa6aeca45a4a11957c",
    urls = ["https://releases.bazel.build/8.6.0/release/bazel-8.6.0-linux-x86_64"],
)

# Firecracker v1.12.1 — microVM VMM binary for Firecracker dev VMs on wyrm2.
# The tarball contains the firecracker binary + jailer + tools. We extract
# just the firecracker binary in devinfra/firecracker/BUILD.bazel.
http_archive(
    name = "firecracker_release",
    build_file_content = 'exports_files(["release-v1.12.1-x86_64/firecracker-v1.12.1-x86_64"])',
    sha256 = "0a75e67ef6e4c540a2cf248b06822b0be9820cbba9fe19f9e0321200fe76ff6b",
    urls = ["https://github.com/firecracker-microvm/firecracker/releases/download/v1.12.1/firecracker-v1.12.1-x86_64.tgz"],
)

# Node.js v22.11.0 LTS linux-x64 — provides the hermetic Node runtime used by
# development tooling and JavaScript tests.
http_archive(
    name = "nodejs_linux_amd64",
    build_file_content = 'exports_files(["bin/node"], visibility = ["//visibility:public"])\n',
    sha256 = "4f862bab52039835efbe613b532238b6e4dde98d139a34e6923193e073438b13",
    strip_prefix = "node-v22.11.0-linux-x64",
    urls = ["https://nodejs.org/dist/v22.11.0/node-v22.11.0-linux-x64.tar.gz"],
)

# Crane binary for OCI image push/pull in agent containers and tests.
# Downloaded directly instead of re-exporting from rules_oci's internal
# oci_crane_linux_amd64 repo, which isn't visible to the main module in bzlmod.
http_archive(
    name = "crane",
    build_file_content = 'exports_files(["crane"], visibility = ["//visibility:public"])\n',
    sha256 = "cdf4d426d965d9a8ba613d7ebf3addf93101aa2e853a3f08fbfdaed2823918f3",
    urls = ["https://github.com/google/go-containerregistry/releases/download/v0.18.0/go-containerregistry_Linux_x86_64.tar.gz"],
)

# ─ Specimen code archives (remote-VCS specimens) ─────────────────────────────
# These specimens reference external Git repos rather than bundled code/ dirs.
# Code is fetched at build time and exposed as filegroups for create_code_tar.
http_archive(
    name = "specimen_crush_code",
    build_file_content = 'filegroup(name = "all_files", srcs = glob(["**"]), visibility = ["//visibility:public"])\n',
    sha256 = "06f94a6f0c121b365bb84eb0b845df3c9f50261562d224d478582d25e21c0acb",
    strip_prefix = "crush-a2a1ffa00943aa373f688ac05b667083ac3230b1",
    urls = ["https://github.com/agentydragon/crush/archive/a2a1ffa00943aa373f688ac05b667083ac3230b1.tar.gz"],
)

http_archive(
    name = "specimen_ducktape_2025_09_03_code",
    build_file_content = 'filegroup(name = "all_files", srcs = glob(["**"]), visibility = ["//visibility:public"])\n',
    sha256 = "b12ba5b8f553f3c90860e926af8527a531e49590395da23ec42a9e8fc01aa900",
    strip_prefix = "ducktape-4ad33013af27e159863bed92ffcfdb55b388e46c",
    urls = ["https://github.com/agentydragon/ducktape/archive/4ad33013af27e159863bed92ffcfdb55b388e46c.tar.gz"],
)

# ─ Go toolchain and dependencies ─────────────────────────────────────────────
# Go toolchain and external module dependencies.

# ─ Go toolchain ──────────────────────────────────────────────────────────
# Root-only: downstream modules such as Gaffer consume Ducktape's debundler and
# must not evaluate Go toolchain/dependency extension tags for RE-only tools.
go_sdk = use_extension(
    "@io_bazel_rules_go//go:extensions.bzl",
    "go_sdk",
    dev_dependency = True,
)
go_sdk.download(version = "1.26.4")
go_sdk.nogo(nogo = "//devinfra/lint:nogo")

# ─ Go dependencies ───────────────────────────────────────────────────────
# Primary source: //third_party:go.mod (first-party Go code).
# Extra manual go_deps.module() entries below cover BUILD-file-only Go tools.
go_deps = use_extension(
    "@bazel_gazelle//:extensions.bzl",
    "go_deps",
    dev_dependency = True,
)
go_deps.from_file(go_mod = "//third_party:go.mod")

# Patch garble's decodeBuildIDHash to pad short hashes (<15 bytes) instead
# of panicking. Bazel-built Go binaries embed "redacted" (6 decoded bytes)
# in their build ID ELF note, which is shorter than garble's expected 15.
# This affects even -seed=random builds: garble reads its own build ID in
# toolexecCmd regardless of the seed source.
go_deps.module_override(
    patch_strip = 1,
    patches = ["//skills/reverse_engineer/examples:garble_hash_fix.patch"],
    path = "mvdan.cc/garble",
)

# ─ redress + GoReSym (reverse engineering tools) ─────────────────────────────
go_deps.module(
    path = "github.com/TcM1911/r2g2",
    sum = "h1:v+MaRN0sAGZsVP3+CC8WlL1psWZfAQwL5oTzSeF0K0s=",
    version = "v0.3.2",
)
go_deps.module(
    path = "github.com/blacktop/go-dwarf",
    sum = "h1:OjmzfSgg/qAKckn2tWFebcgKgJ7HOqCj7bS+CiE1lrY=",
    version = "v1.0.14",
)
go_deps.module(
    path = "github.com/blacktop/go-macho",
    sum = "h1:KpC13blu4m1LVUv3WPU3a73u1xNFapDeA4UJp/J0aG4=",
    version = "v1.1.271",
)
go_deps.module(
    path = "github.com/cheynewallace/tabby",
    sum = "h1:JvUR8waht4Y0S3JF17G6Vhyt+FRhnqVCkk8l4YrOU54=",
    version = "v1.1.1",
)
go_deps.module(
    path = "github.com/elliotchance/orderedmap",
    sum = "h1:wZtfeEONCbx6in1CZyE6bELEt/vFayMvsxqI5SgsR+A=",
    version = "v1.4.0",
)
go_deps.module(
    path = "github.com/goretk/gore",
    sum = "h1:ADlDhsNmAm3ve9Q5dClyUuHUPD7VnwPe1njSDvrENTk=",
    version = "v0.13.27",
)
go_deps.module(
    path = "github.com/goretk/redress",
    sum = "h1:JQA8moNOocmdrhdxRdhORE0pGTI8P0O1vZYJy9bqOuk=",
    version = "v1.2.64",
)
go_deps.module(
    path = "github.com/mandiant/GoReSym",
    sum = "h1:rhIAoxKH+GTDXilQ2BWpfQ4zE97hVq6cv53wDSqtZlw=",
    version = "v1.7.1",
)
go_deps.module(
    path = "golang.org/x/arch",
    sum = "h1:jZ6dpec5haP/fUv1kLCbuJy6dnRrfX6iVK08lZBFpk4=",
    version = "v0.26.0",
)
go_deps.module(
    path = "golang.org/x/net",
    sum = "h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=",
    version = "v0.53.0",
)
go_deps.module(
    path = "golang.org/x/text",
    sum = "h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=",
    version = "v0.33.0",
)
go_deps.module(
    path = "github.com/google/uuid",
    sum = "h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=",
    version = "v1.6.0",
)
go_deps.module(
    path = "go.opentelemetry.io/otel",
    sum = "h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=",
    version = "v1.42.0",
)
go_deps.module(
    path = "go.opentelemetry.io/otel/metric",
    sum = "h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=",
    version = "v1.42.0",
)
go_deps.module(
    path = "go.opentelemetry.io/otel/sdk",
    sum = "h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=",
    version = "v1.42.0",
)
go_deps.module(
    path = "go.opentelemetry.io/otel/trace",
    sum = "h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=",
    version = "v1.42.0",
)
go_deps.module(
    path = "google.golang.org/genproto/googleapis/api",
    sum = "h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=",
    version = "v0.0.0-20251202230838-ff82c1b0f217",
)
go_deps.module(
    path = "google.golang.org/genproto/googleapis/rpc",
    sum = "h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=",
    version = "v0.0.0-20251202230838-ff82c1b0f217",
)
go_deps.module(
    path = "google.golang.org/grpc",
    sum = "h1:6/+EFlxsMyoSbHbBoEDx94n/Ycx/bi0IhJ5Qh7b7LaA=",
    version = "v1.79.0",
)
go_deps.module(
    path = "google.golang.org/protobuf",
    sum = "h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=",
    version = "v1.36.11",
)

# ─ osmmcp (OpenStreetMap MCP server: geocoding via Nominatim, routing via OSRM) ──
# Pinned to a post-v0.1.2 commit on main — the tagged v0.1.2 release predates the
# --enable-http/--http-only Streamable HTTP transport this deployment relies on.
# Entries below cover osmmcp's own direct/transitive deps not already pulled in
# elsewhere (mcp-go, Prometheus client, mgrs, golang-lru, cast, uritemplate, x/sync,
# x/time) — versions/sums taken from its committed go.sum.
go_deps.module(
    path = "github.com/NERVsystems/osmmcp",
    sum = "h1:nGGteURDWi0B2er017luOuprQL9NbLjdoeUJHiu6yTI=",
    version = "v0.1.3-0.20260225010045-97050a10dbf1",
)
go_deps.module(
    path = "github.com/mark3labs/mcp-go",
    sum = "h1:M0oqK412OHBKut9JwXSsj4KanSmEKpzoW8TcxoPOkAU=",
    version = "v0.40.0",
)
go_deps.module(
    path = "github.com/hashicorp/golang-lru/v2",
    sum = "h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=",
    version = "v2.0.7",
)
go_deps.module(
    path = "github.com/spf13/cast",
    sum = "h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=",
    version = "v1.7.1",
)
go_deps.module(
    path = "github.com/yosida95/uritemplate/v3",
    sum = "h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=",
    version = "v3.0.2",
)
go_deps.module(
    path = "github.com/akhenakh/mgrs",
    sum = "h1:T9kKRxxcpX7sJ3cd/IWOv1yQ7g+Iucjqvxzd3AjmHwY=",
    version = "v0.0.0-20250412181015-7c7a2a77f494",
)
go_deps.module(
    path = "golang.org/x/sync",
    sum = "h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=",
    version = "v0.16.0",
)
go_deps.module(
    path = "golang.org/x/time",
    sum = "h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=",
    version = "v0.11.0",
)
go_deps.module(
    path = "github.com/prometheus/client_golang",
    sum = "h1:rb93p9lokFEsctTys46VnV1kLCDpVZ0a/Y92Vm0Zc6Q=",
    version = "v1.22.0",
)
go_deps.module(
    path = "github.com/prometheus/client_model",
    sum = "h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=",
    version = "v0.6.1",
)
go_deps.module(
    path = "github.com/prometheus/common",
    sum = "h1:xasJaQlnWAeyHdUBeGjXmutelfJHWMRr+Fg4QszZ2Io=",
    version = "v0.62.0",
)
go_deps.module(
    path = "github.com/prometheus/procfs",
    sum = "h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=",
    version = "v0.15.1",
)
go_deps.module(
    path = "github.com/beorn7/perks",
    sum = "h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=",
    version = "v1.0.1",
)
go_deps.module(
    path = "github.com/cespare/xxhash/v2",
    sum = "h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=",
    version = "v2.3.0",
)
go_deps.module(
    path = "github.com/munnerz/goautoneg",
    sum = "h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=",
    version = "v0.0.0-20191010083416-a7dc8b61c822",
)
go_deps.module(
    path = "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
    sum = "h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=",
    version = "v1.37.0",
)
go_deps.module(
    path = "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
    sum = "h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=",
    version = "v1.37.0",
)
go_deps.module(
    path = "go.opentelemetry.io/proto/otlp",
    sum = "h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=",
    version = "v1.7.0",
)
go_deps.module(
    path = "go.opentelemetry.io/auto/sdk",
    sum = "h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=",
    version = "v1.1.0",
)

# ─ Repos exported for Bazel BUILD files ──────────────────────────────────
# Includes directly-used repos AND transitive deps of manual go_deps.module()
# entries (gazelle needs them visible for resolution).
#
# `bazel mod tidy` will try to drop `cc_mvdan_garble` and `com_github_go_git_go_git_v5`
# because gazelle reports them as indirect (they're `// indirect` in
# third_party/go.mod since no Go file under the module imports them — they're
# referenced only from BUILD files: skills/reverse_engineer/examples and
# devinfra/buildbuddy_cli respectively). Keep them here; do not re-run
# `bazel mod tidy` without restoring them.
use_repo(
    go_deps,
    "cc_mvdan_garble",
    "com_github_akhenakh_mgrs",
    "com_github_beorn7_perks",
    "com_github_blacktop_go_dwarf",
    "com_github_blacktop_go_macho",
    "com_github_cespare_xxhash_v2",
    "com_github_cheynewallace_tabby",
    "com_github_docker_docker",
    "com_github_dustin_go_humanize",
    "com_github_elliotchance_orderedmap",
    "com_github_firebase_genkit_go",
    "com_github_fsouza_go_dockerclient",
    "com_github_go_git_go_git_v5",
    "com_github_google_uuid",
    "com_github_goretk_gore",
    "com_github_goretk_redress",
    "com_github_hashicorp_golang_lru_v2",
    "com_github_inconshreveable_mousetrap",
    "com_github_mandiant_goresym",
    "com_github_mark3labs_mcp_go",
    "com_github_munnerz_goautoneg",
    "com_github_nervsystems_osmmcp",
    "com_github_prometheus_client_golang",
    "com_github_prometheus_client_model",
    "com_github_prometheus_common",
    "com_github_prometheus_procfs",
    "com_github_spf13_cast",
    "com_github_spf13_cobra",
    "com_github_spf13_pflag",
    "com_github_tcm1911_r2g2",
    "com_github_yosida95_uritemplate_v3",
    "io_opentelemetry_go_auto_sdk",
    "io_opentelemetry_go_otel",
    "io_opentelemetry_go_otel_exporters_otlp_otlptrace",
    "io_opentelemetry_go_otel_exporters_otlp_otlptrace_otlptracegrpc",
    "io_opentelemetry_go_otel_metric",
    "io_opentelemetry_go_otel_sdk",
    "io_opentelemetry_go_otel_trace",
    "io_opentelemetry_go_proto_otlp",
    "org_golang_google_genproto_googleapis_api",
    "org_golang_google_genproto_googleapis_rpc",
    "org_golang_google_grpc",
    "org_golang_google_protobuf",
    "org_golang_x_arch",
    "org_golang_x_net",
    "org_golang_x_sync",
    "org_golang_x_text",
    "org_golang_x_time",
)

# ─ BuildBuddy proto definitions (for bbapi CLI) ──────────────────────────────
buildbuddy_protos = use_extension("//third_party/buildbuddy:buildbuddy_protos.bzl", "buildbuddy_protos")
use_repo(buildbuddy_protos, "buildbuddy_protos")