MODULE.bazel

module(name = "codex")

bazel_dep(name = "bazel_lib", version = "3.2.2")
bazel_dep(name = "bazel_skylib", version = "1.9.0")
bazel_dep(name = "platforms", version = "1.0.0")

# Expose rules_rs's existing dependency for the openssl-sys replacement's SBOM.
bazel_dep(name = "package_metadata", version = "0.0.7")

# Expose the public protobuf rules already used transitively by rules_rs.
bazel_dep(name = "protobuf", version = "34.0.bcr.1", repo_name = "com_google_protobuf")

# Backport protobuf#31266 (849e1cbf91af): MSVC also needs the ARM64 SEH workaround.
single_version_override(
    module_name = "protobuf",
    patch_strip = 1,
    patches = ["//patches:protobuf_windows_arm64_seh.patch"],
)

bazel_dep(name = "llvm", version = "0.8.11")
bazel_dep(name = "windows_support", version = "0.2.0")
bazel_dep(name = "with_cfg.bzl", version = "0.12.0")

# Merged target-scoped C++ standard-library opt-outs for V8's private libc++.
# https://github.com/hermeticbuild/hermetic-llvm/pull/903
# Includes explicit MSVC CRT startup-library selection for dependency-provided main.
# https://github.com/hermeticbuild/hermetic-llvm/pull/914
archive_override(
    module_name = "llvm",
    integrity = "sha256-KTjljFEA8dmXkOoVz6Wv3yqkMfqrbS5iDv/ef4GYsu0=",
    patch_strip = 1,
    patches = ["//patches:llvm_mingw_import_warnings.patch"],
    strip_prefix = "hermetic-llvm-d27493f0386c9d4d28f7b12630cb91b0cdfd20f1",
    urls = ["https://github.com/hermeticbuild/hermetic-llvm/archive/d27493f0386c9d4d28f7b12630cb91b0cdfd20f1.tar.gz"],
)

# Preserve case-only SDK aliases when native Windows repository setup feeds
# case-sensitive remote executors.
single_version_override(
    module_name = "windows_support",
    patch_strip = 1,
    patches = [
        "//patches:windows-support-remote-case-aliases.patch",
        "//patches:windows-support-native-tools.patch",
    ],
    version = "0.2.0",
)

# MSVC repository materialization fails closed until a user who has accepted
# Microsoft's Visual Studio terms explicitly supplies
# --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1. Do not configure that
# acceptance globally: Linux, macOS, and Windows GNU do not require it.
msvc_runtime = use_extension("@windows_support//windows:extensions.bzl", "msvc_runtime")
msvc_runtime.configure(
    architectures = [
        "x64",
        "arm64",
    ],
    msvc_version = "14.50.35717",
    visual_studio_installer_manifest_integrity = "sha256-qOhU+p8/uurCfXME4pfxZg1xN0ATid61fPeYPzPBb+8=",
    visual_studio_installer_manifest_url = "https://download.visualstudio.microsoft.com/download/pr/fdc37f6e-59f6-4054-838a-b476eeaa6ec3/1d82370739911457e0a2f6be15d8b5f569531b352b2eabb961429eea1e99e356/VisualStudio.vsman",
)
use_repo(msvc_runtime, "msvc_runtime")

windows_sdk = use_extension("@windows_support//windows:extensions.bzl", "windows_sdk")
windows_sdk.configure(
    architectures = [
        "x64",
        "arm64",
    ],
    transformations = {
        "base/c/Include/10.0.26100.0/shared/driverspecs.h": "base/c/Include/10.0.26100.0/shared/DriverSpecs.h",
        "base/c/Include/10.0.26100.0/shared/specstrings.h": "base/c/Include/10.0.26100.0/shared/SpecStrings.h",
        "base/c/Include/10.0.26100.0/um/ole2.h": "base/c/Include/10.0.26100.0/um/Ole2.h",
        "base/c/Include/10.0.26100.0/um/olectl.h": "base/c/Include/10.0.26100.0/um/OleCtl.h",
        "**/*.h": "lowercase",
        "**/*.lib": "lowercase",
        "**/*.Lib": "lowercase",
    },
    windows_sdk_integrity = {
        "Microsoft.Windows.SDK.CPP": "sha256-/0VWYL7gcadEcVqWZWZvopwHaBV509gVlZqe7FpVZCQ=",
        "Microsoft.Windows.SDK.CPP.x64": "sha256-rWzpD/lAEGmdKVSLPCseUsieuBFD4hmRVdmlw4ABtSs=",
        "Microsoft.Windows.SDK.CPP.arm64": "sha256-A7wMA9Q5zvhQdLvNQl+dXTptO0Z5Z6zSHaO6bf7q+mc=",
    },
    windows_sdk_version = "10.0.26100.7705",
)
use_repo(windows_sdk, "windows_sdk")

# Abseil picks a MinGW pthread TLS path that does not match our hermetic
# windows-gnullvm toolchain; force it onto the portable C++11 thread-local path.
single_version_override(
    module_name = "abseil-cpp",
    patch_strip = 1,
    patches = [
        "//patches:abseil_windows_gnullvm_thread_identity.patch",
    ],
)

register_toolchains("@llvm//toolchain:all")

osx = use_extension("@llvm//extensions:osx.bzl", "osx")
osx.from_archive(
    sha256 = "5f044578cd78a3a9b9c965a42d56bad609ee5d252e1d4e6aa7c42fc3f35fee7b",
    strip_prefix = "Payload/Library/Developer/CommandLineTools/SDKs/MacOSX26.5.sdk",
    type = "pkg",
    urls = [
        "https://swcdn.apple.com/content/downloads/09/08/047-91568-A_Y1CFZWQCD4/4xekpyz43i26dbp4enxfro8eb1q7wiujh5/CLTools_macOSNMOS_SDK.pkg",
    ],
)
osx.frameworks(names = [
    "ApplicationServices",
    "AppKit",
    "ColorSync",
    "CoreFoundation",
    "CoreGraphics",
    "CoreImage",
    "CoreMedia",
    "CoreMIDI",
    "CoreServices",
    "CoreText",
    "CoreVideo",
    "DiskArbitration",
    "AudioToolbox",
    "AVFoundation",
    "AVFAudio",
    "AVRouting",
    "CFNetwork",
    "Cocoa",
    "CoreData",
    "PrintCore",
    "Symbols",
    "FontServices",
    "AudioUnit",
    "CoreAudio",
    "CoreAudioTypes",
    "Foundation",
    "ImageIO",
    "IOSurface",
    "IOKit",
    "Kernel",
    "LocalAuthentication",
    "Metal",
    "MetalKit",
    "OpenGL",
    "OSLog",
    "QuartzCore",
    "ScreenCaptureKit",
    "Security",
    "SystemConfiguration",
    "UniformTypeIdentifiers",
    "VideoToolbox",
])
osx.libraries(names = [
    "libproc",
    "libsandbox",
])
use_repo(osx, "macos_sdk")

# Needed to disable xcode...
bazel_dep(name = "apple_support", version = "2.1.0")
bazel_dep(name = "rules_cc", version = "0.2.25")
bazel_dep(name = "rules_platform", version = "0.1.0")
bazel_dep(name = "rules_pkg", version = "1.0.1")
bazel_dep(name = "aws-lc", version = "5.1.0.bcr.3")
bazel_dep(name = "rules_rs", version = "0.0.96")
bazel_dep(name = "rules_foreign_cc", version = "0.15.1")
single_version_override(
    module_name = "rules_foreign_cc",
    patch_strip = 1,
    patches = [
        "//patches:rules_foreign_cc_make_cppflags.patch",
        "//patches:rules_foreign_cc_make_xcompile.patch",
        "//patches:rules_foreign_cc_make_msvc_stdint.patch",
    ],
    version = "0.15.1",
)

bazel_dep(name = "rules_python", version = "2.4.2")

voice_python = use_extension("@rules_python//python/extensions:python.bzl", "python")
voice_python.defaults(python_version = "3.11")
voice_python.toolchain(python_version = "3.12")
use_repo(voice_python, "python_3_12")

pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
pip.parse(
    download_only = True,
    hub_name = "schema_python",
    python_version = "3.12",
    target_platforms = [
        "linux_aarch64",
        "linux_x86_64",
        "osx_aarch64",
        "osx_x86_64",
        "windows_aarch64",
        "windows_x86_64",
    ],
    uv_lock = "//sdk/python:uv.lock",
)
use_repo(pip, "schema_python")

# Use the existing pinned Make build for foreign_cc consumers, including the
# native voice pkg-config bootstrap, instead of a PATH-provided Make.
register_toolchains("@rules_foreign_cc//toolchains:built_make_toolchain")

foreign_cc_tools = use_extension("@rules_foreign_cc//foreign_cc:extensions.bzl", "tools")
use_repo(foreign_cc_tools, "cmake-3.31.8-windows-x86_64", "ninja_1.13.0_win", "pkgconfig_src")

register_toolchains("//third_party/voice:windows_ninja_toolchain")

archive_override(
    module_name = "rules_rs",
    integrity = "sha256-b8sUj9EvM72+so/q4uRH91ed7QwOO8EoGbdL8NyBjE4=",
    patch_strip = 1,
    patches = [
        "//patches:rules_rs_bindgen_v0_0_4.patch",
        "//patches:rules_rs_build_script_deps_annotation.patch",
        "//patches:rules_rs_rust_debug_modes.patch",
        "//patches:rules_rs_workspace_package_version.patch",
    ],
    strip_prefix = "rules_rs-7a05511772a8a85db5382ff7536bf2f1e6a8dde3",
    urls = ["https://github.com/hermeticbuild/rules_rs/archive/7a05511772a8a85db5382ff7536bf2f1e6a8dde3.tar.gz"],
)

rules_rust = use_extension("@rules_rs//rs:rules_rust.bzl", "rules_rust")
rules_rust.patch(
    patches = [
        # Opt-in release profile compatibility for native Cargo build scripts.
        "//patches:rules_rust_release_build_script_profile.patch",
        # Refreshed upstream PR #92; forwarding comes from merged #102.
        "//patches:rules_rust_declared_msvc_linker.patch",
        # Spill wrapper arguments to a params file to avoid Windows command-line limits.
        "//patches:rules_rust_process_wrapper_param_file.patch",
        "//patches:rules_rust_windows_execroot_separators.patch",
        "//patches:rules_rust_compiler_thp.patch",
    ],
    strip = 1,
)
use_repo(rules_rust, "rules_rust")

# argument-comment-lint uses rustc_private and needs nightly rustc-dev
# components. Keep that rules_rust-reexported toolchain separate from the
# default rules_rs toolchains below, which do not expose dev_components.
nightly_rust = use_extension(
    "@rules_rs//rs:rules_rust_reexported_extensions.bzl",
    "rust",
)
nightly_rust.toolchain(
    dev_components = True,
    edition = "2024",
    versions = ["nightly/2026-08-20"],
)

# Keep the reexported extension's default Windows set constrained to MSVC so
# it cannot also match the gnullvm host platform.
nightly_rust.repository_set(
    name = "rust_windows_x86_64",
    dev_components = True,
    edition = "2024",
    exec_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:msvc",
    ],
    exec_triple = "x86_64-pc-windows-msvc",
    target_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:msvc",
    ],
    target_triple = "x86_64-pc-windows-msvc",
    versions = ["nightly/2026-08-20"],
)

# Also let that MSVC-exec set target gnullvm for existing cross lanes.
nightly_rust.repository_set(
    name = "rust_windows_x86_64",
    target_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:gnullvm",
        "@llvm//constraints/windows/crt:msvcrt",
    ],
    target_triple = "x86_64-pc-windows-gnullvm",
)

# Give Windows lint a native gnullvm exec set so proc-macros link against the
# same ABI as hermetic LLVM and BCR AWS-LC.
nightly_rust.repository_set(
    name = "rust_windows_x86_64_gnullvm",
    dev_components = True,
    edition = "2024",
    exec_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:gnullvm",
        "@llvm//constraints/windows/crt:msvcrt",
    ],
    exec_triple = "x86_64-pc-windows-gnullvm",
    target_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:gnullvm",
        "@llvm//constraints/windows/crt:msvcrt",
    ],
    target_triple = "x86_64-pc-windows-gnullvm",
    versions = ["nightly/2026-08-20"],
)
use_repo(nightly_rust, "rust_toolchains")

# Match Cargo's MSVC static CRT policy for target and host dependencies. V8's
# allocator shim must not also import the dynamic UCRT. Selecting by target
# triple applies to cross builds without affecting Windows GNU, Linux or macOS.
MSVC_RUSTC_FLAGS = {
    "aarch64-pc-windows-msvc": ["-Ctarget-feature=+crt-static"],
    "x86_64-pc-windows-msvc": ["-Ctarget-feature=+crt-static"],
}

toolchains = use_extension("@rules_rs//rs/toolchains:module_extension.bzl", "toolchains")
toolchains.toolchain(
    edition = "2024",
    extra_exec_rustc_flags = MSVC_RUSTC_FLAGS,
    extra_rustc_flags = MSVC_RUSTC_FLAGS,
    version = "1.95.0",
)
use_repo(toolchains, "default_rust_toolchains")

register_toolchains("@default_rust_toolchains//...")

register_toolchains("@rust_toolchains//:all")

rules_rust_bindgen = use_extension(
    "@rules_rs//rs:rules_rust_bindgen.bzl",
    "rules_rust_bindgen",
)
use_repo(rules_rust_bindgen, "rules_rust_bindgen")

register_toolchains("@rules_rust_bindgen//:all")

# Generate Rust protobuf/gRPC libraries against the workspace's prost/tonic
# versions instead of the versions bundled with rules_rs's default toolchain.
register_toolchains("//bazel/toolchains/prost:toolchain")

crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
crate.from_cargo(
    cargo_lock = "//codex-rs:Cargo.lock",
    cargo_toml = "//codex-rs:Cargo.toml",
    platform_triples = [
        "aarch64-unknown-linux-gnu",
        "aarch64-unknown-linux-musl",
        "aarch64-apple-darwin",
        # Keep both Windows ABIs in the generated Cargo metadata: the V8
        # experiment still consumes release assets that only exist under the
        # MSVC names while targeting the GNU toolchain.
        "aarch64-pc-windows-msvc",
        "aarch64-pc-windows-gnullvm",
        "x86_64-unknown-linux-gnu",
        "x86_64-unknown-linux-musl",
        "x86_64-apple-darwin",
        "x86_64-pc-windows-msvc",
        "x86_64-pc-windows-gnullvm",
    ],
)
crate.from_cargo(
    name = "argument_comment_lint_crates",
    cargo_lock = "//tools/argument-comment-lint:Cargo.lock",
    cargo_toml = "//tools/argument-comment-lint:Cargo.toml",
    platform_triples = [
        "aarch64-unknown-linux-gnu",
        "aarch64-unknown-linux-musl",
        "aarch64-apple-darwin",
        "aarch64-pc-windows-msvc",
        "aarch64-pc-windows-gnullvm",
        "x86_64-unknown-linux-gnu",
        "x86_64-unknown-linux-musl",
        "x86_64-apple-darwin",
        "x86_64-pc-windows-msvc",
        "x86_64-pc-windows-gnullvm",
    ],
)

bazel_dep(name = "zstd", version = "1.5.7.bcr.2")

crate.annotation(
    # Debug builds must also embed assets instead of reading the worker's source tree.
    crate = "rust-embed",
    crate_features = ["debug-embed"],
)
crate.annotation(
    # Keep Windows proxy authentication aligned with codex-rs/.cargo/config.toml.
    build_script_env = {"CFLAGS": "-DCURL_ENABLE_NTLM"},
    crate = "curl-sys",
)
crate.annotation(
    # Daemon tests repeatedly hash large CLI binaries, even in fastbuild mode.
    # Optimize the native backends as well as the Rust implementation.
    build_script_env = {"OPT_LEVEL": "3"},
    crate = "blake3",
    rustc_flags = ["-Copt-level=3"],
)
crate.annotation_select(
    # Avoid native x86 assembly tools unavailable when cross-compiling Windows.
    crate = "blake3",
    crate_features = ["pure"],
    triples = [
        "x86_64-pc-windows-gnullvm",
        "x86_64-pc-windows-msvc",
    ],
)

# Backport notify-rs/notify@a9c51183: wake idle Windows watchers on events and control requests.
crate.annotation(
    crate = "notify",
    patch_args = ["-p1"],
    patches = ["//patches:notify_windows_idle.patch"],
    version = "8.2.0",
)

# Match the CodeModeHost response-compression benchmark's zstd level.
crate.annotation(
    crate = "tonic",
    patch_args = ["-p1"],
    patches = ["//patches:tonic-zstd-level1.patch"],
    version = "0.14.3",
)
crate.annotation(
    crate = "zstd-sys",
    gen_build_script = "off",
    deps = ["@zstd"],
)
crate.annotation(
    crate = "ring",
    patch_args = ["-p1"],
    patches = [
        "//patches:ring_windows_msvc_include_dirs.patch",
    ],
)
crate.annotation(
    additive_build_file = "@rules_rs//3rd_party/aws-lc-sys:additive.BUILD.bazel",
    crate = "aws-lc-sys",
    extra_aliased_targets = {"aws_lc_sys_build_info": "aws_lc_sys_build_info"},
    gen_build_script = "off",
    repositories = ["crates"],
    rustc_flags = ["--cfg=use_bindgen_pregenerated"],
    deps = ["@crates//:aws_lc_sys_build_info"],
)
crate.annotation(
    crate = "aws-lc-rs",
    gen_build_script = "off",
    repositories = ["crates"],
)
crate.annotation(
    # The build script only validates embedded source/version metadata.
    crate = "rustc_apfloat",
    gen_build_script = "off",
)

inject_repo(crate, "aws-lc")

inject_repo(crate, "zstd")

use_repo(crate, "argument_comment_lint_crates")

bazel_dep(name = "bzip2", version = "1.0.8.bcr.3")
single_version_override(
    module_name = "bzip2",
    patch_strip = 1,
    patches = [
        "//patches:bzip2_windows_stack_args.patch",
    ],
)

crate.annotation(
    crate = "bzip2-sys",
    gen_build_script = "off",
    deps = ["@bzip2//:bz2"],
)

inject_repo(crate, "bzip2")

bazel_dep(name = "zlib", version = "1.3.1.bcr.8")

crate.annotation(
    crate = "libz-sys",
    gen_build_script = "on",
)

inject_repo(crate, "zlib")

bazel_dep(name = "xz", version = "5.4.5.bcr.8")
single_version_override(
    module_name = "xz",
    patch_strip = 1,
    patches = [
        "//patches:xz_windows_stack_args.patch",
    ],
)

crate.annotation(
    crate = "lzma-sys",
    gen_build_script = "off",
    deps = ["@xz//:lzma"],
)

bazel_dep(name = "openssl", version = "3.5.4.bcr.0")

inject_repo(crate, "xz")

inject_repo(crate, "openssl")

crate.annotation(
    crate = "runfiles",
    workspace_cargo_toml = "rust/runfiles/Cargo.toml",
)

# MXC's resource compiler lookup needs an explicit path for Windows GNU targets.
crate.annotation(
    build_script_deps = [
        "@crates//:cc-1.2.55",
        "@crates//:winresource-0.1.34",
    ],
    build_script_env = {
        "RC_PATH": "$(execpath @llvm//tools:llvm-rc)",
    },
    build_script_tools = [
        "@llvm//tools:clang",
        "@llvm//tools:llvm-rc",
    ],
    crate = "mxc-sdk",
    patch_args = ["-p1"],
    patches = ["//patches:mxc-sdk_utf8_resources.patch"],
    workspace_cargo_toml = "src/Cargo.toml",
)

http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

# Cargo keeps vendored OpenSSL for musl; Bazel already supplies its own OpenSSL.
# Replace this crate's generated build, not Cargo's feature resolution.
http_archive(
    name = "openssl_sys_bazel",
    build_file = "//third_party/openssl:openssl_sys.BUILD.bazel",
    sha256 = "19c413d6ec9ebaf5e1c829d355cb3e9f783778d700f135be0921d52fce3c60ae",
    strip_prefix = "openssl-sys-0.9.118",
    type = "tar.gz",
    urls = ["https://static.crates.io/crates/openssl-sys/openssl-sys-0.9.118.crate"],
)

override_repo(
    crate,
    **{"crates__openssl-sys-0.9.118": "openssl_sys_bazel"}
)

codex_release_archive = use_repo_rule("//bazel/extensions:codex_release_archive.bzl", "codex_release_archive")

codex_release_archive(
    name = "codex_release_latest_stable",
    release = "latest",
)

codex_release_archive(
    name = "codex_release_historical_stable",
    release = "historical",
)

http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")

new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")

include("//bazel/modules:wine.MODULE.bazel")

# Run V8's Windows snapshot generator natively or with the executor's Wine.
bazel_dep(name = "rules_wine", version = "0.1.3")

wine = use_extension("@rules_wine//wine/extension:wine.bzl", "wine")
use_repo(wine, "wine_toolchains")

register_toolchains("@wine_toolchains//:all")

voice_sources = use_extension("//third_party/voice:extensions.bzl", "voice_sources")
use_repo(
    voice_sources,
    "voice_archive_glib",
    "voice_archive_gst_plugins_base",
    "voice_archive_gst_plugins_good",
    "voice_archive_gstreamer",
    "voice_archive_libffi",
    "voice_archive_meson",
    "voice_archive_ninja",
    "voice_archive_opus",
    "voice_archive_pcre2",
    "voice_archive_proxy_libintl",
    "voice_archive_zlib",
    "voice_glib",
    "voice_gst_plugins_base",
    "voice_gst_plugins_good",
    "voice_gstreamer",
    "voice_libffi",
    "voice_meson",
    "voice_ninja",
    "voice_opus",
    "voice_pcre2",
    "voice_proxy_libintl",
    "voice_zlib",
)

new_local_repository(
    name = "v8_targets",
    build_file = "//third_party/v8:BUILD.bazel",
    path = "third_party/v8",
)

crate.annotation(
    build_script_data = [
        "@v8_targets//:rusty_v8_archive_for_target",
        "@v8_targets//:rusty_v8_binding_for_target",
    ],
    build_script_env = {
        "RUSTY_V8_ARCHIVE": "$(execpath @v8_targets//:rusty_v8_archive_for_target)",
        "RUSTY_V8_SRC_BINDING_PATH": "$(execpath @v8_targets//:rusty_v8_binding_for_target)",
    },
    crate = "v8",
    gen_build_script = "on",
    patch_args = ["-p1"],
    patches = [
        "//patches:rusty_v8_prebuilt_out_dir.patch",
    ],
)
crate.annotation_select(
    # Keep the Rust feature aligned with the sandbox archive/binding pairs.
    crate = "v8",
    crate_features = ["v8_enable_sandbox"],
    triples = [
        "aarch64-apple-darwin",
        "aarch64-pc-windows-gnullvm",
        "aarch64-pc-windows-msvc",
        "aarch64-unknown-linux-gnu",
        "aarch64-unknown-linux-musl",
        "x86_64-apple-darwin",
        "x86_64-pc-windows-gnullvm",
        "x86_64-pc-windows-msvc",
        "x86_64-unknown-linux-gnu",
        "x86_64-unknown-linux-musl",
    ],
)

inject_repo(crate, "v8_targets")

llvm = use_extension("@llvm//extensions:llvm.bzl", "llvm")
use_repo(llvm, "llvm-project")

crate.annotation(
    additive_build_file = "//third_party/sqlite:libsqlite3_sys.BUILD.bazel",
    crate = "libsqlite3-sys",
    extra_aliased_targets = {
        "libsqlite3_sys_bindings": "sqlite3/bindgen_bundled_version.rs",
        "libsqlite3_sys_headers": "sqlite3_headers",
        "libsqlite3_sys_source": "sqlite3/sqlite3.c",
    },
    gen_build_script = "off",
    repositories = ["crates"],
    version = "0.39.1",
    deps = ["//third_party/sqlite:libsqlite3_sys_build_info"],
)
crate.annotation(
    # Provide the hermetic SDK path so the build script doesn't try to invoke an unhermetic `xcrun --show-sdk-path`.
    build_script_data = [
        "@macos_sdk//sysroot",
    ],
    build_script_env = {
        "BINDGEN_EXTRA_CLANG_ARGS": "-Xclang -internal-isystem -Xclang $(location @llvm//:builtin_resource_dir)/include",
        "COREAUDIO_SDK_PATH": "$(location @macos_sdk//sysroot)",
        "LIBCLANG_PATH": "$(location @llvm-project//clang:libclang_interface_output)",
    },
    build_script_tools = [
        "@llvm-project//clang:libclang_interface_output",
        "@llvm//:builtin_resource_dir",
    ],
    crate = "coreaudio-sys",
    gen_build_script = "on",
)

inject_repo(crate, "llvm", "llvm-project", "macos_sdk")

# The bundled Opus encoder uses CMake; supply executable tools and their data,
# rather than relying on a build worker's PATH. Versions are pinned by the module.
crate.annotation(
    build_script_data = ["//third_party/voice:opus-toolchain.cmake"],
    build_script_env = {
        "CMAKE": "$${pwd}/$(CMAKE)",
        "CMAKE_GENERATOR": "Ninja",
        "CMAKE_TOOLCHAIN_FILE": "$(execpath @@//third_party/voice:opus-toolchain.cmake)",
        "CODEX_VOICE_NINJA": "$${pwd}/$(NINJA)",
    },
    build_script_toolchains = [
        "@rules_foreign_cc//toolchains:current_cmake_toolchain",
        "@rules_foreign_cc//toolchains:current_ninja_toolchain",
    ],
    build_script_tools = [
        "@rules_foreign_cc//toolchains:current_cmake_toolchain",
        "@rules_foreign_cc//toolchains:current_ninja_toolchain",
    ],
    crate = "opusic-sys",
    patch_args = ["-p1"],
    patches = [
        "//patches:opusic_sys_install_headers.patch",
        # Presuming NEON must include its implementations without requiring RTCD.
        "//patches:opusic-sys_presume_neon.patch",
    ],
)

# The musl CLI's allocator needs declared native tools and consistent header flags.
crate.annotation(
    build_script_env = {
        "JEMALLOC_SYS_WITH_MALLOC_CONF": "narenas_ratio:0.25",
        "MAKE": "$${pwd}/$(MAKE)",
        "NM": "$${pwd}/$(execpath @llvm//tools:llvm-nm)",
        "RANLIB": "$${pwd}/$(execpath @llvm//tools:llvm-ranlib)",
    },
    build_script_toolchains = ["@rules_foreign_cc//toolchains:current_make_toolchain"],
    build_script_tools = [
        "@llvm//tools:llvm-nm",
        "@llvm//tools:llvm-ranlib",
        "@rules_foreign_cc//toolchains:current_make_toolchain",
    ],
    crate = "tikv-jemalloc-sys",
    patch_args = ["-p1"],
    patches = [
        "//patches:tikv-jemalloc-sys_make_env.patch",
        "//patches:tikv-jemalloc-sys_dependency_flags.patch",
    ],
)

inject_repo(crate, "rules_foreign_cc")

crate.annotation(
    # Provide the hermetic SDK path so the build script doesn't try to invoke an unavailable `xcrun --show-sdk-path`.
    build_script_data = [
        "@macos_sdk//sysroot",
    ],
    build_script_env = {
        "WEBRTC_SYS_DARWIN_SDK_PATH": "$(location @macos_sdk//sysroot)",
        "WEBRTC_SYS_LINK_OUT_DIR": "1",
    },
    crate = "webrtc-sys",
    gen_build_script = "on",
    patch_args = ["-p1"],
    patches = [
        "//patches:webrtc-sys_hermetic_darwin_sysroot.patch",
    ],
)

# Fix readme inclusions
crate.annotation(
    crate = "windows-link",
    patch_args = ["-p1"],
    patches = [
        "//patches:windows-link.patch",
    ],
)

bazel_dep(name = "alsa_lib", version = "1.2.9.bcr.4")

crate.annotation(
    crate = "alsa-sys",
    gen_build_script = "off",
    deps = ["@alsa_lib"],
)

inject_repo(crate, "alsa_lib")

# Keep upstream pkg-config version probes, but link only the prepared runtime.
# system-deps applies these path/flag overrides after a successful version probe.
[
    crate.annotation(
        build_script_data = [
            "//third_party/voice:native_link",
            "//third_party/voice:native_sdk",
        ],
        build_script_env = {
            "PKG_CONFIG": "$(execpath @@//third_party/voice:pkg_config)",
            "PKG_CONFIG_LIBDIR": "$(execpath @@//third_party/voice:native_sdk)/lib/pkgconfig",
            "PKG_CONFIG_PATH": "",
        } | {
            "SYSTEM_DEPS_" + key + "_SEARCH_NATIVE": "$(execpath @@//third_party/voice:native_link)/.."
            for key in keys
        } | {
            # GStreamer's .pc files add an absolute rpath; CcInfo supplies the
            # relative Bazel runpath instead. Library/version checks still run.
            "SYSTEM_DEPS_" + key + "_LDFLAGS": ""
            for key in keys
            if key.startswith("GSTREAMER_")
        },
        build_script_tools = ["//third_party/voice:pkg_config"],
        crate = name,
        gen_build_script = "on",
        version = version,
        deps = ["//third_party/voice:native_link"],
    )
    for name, version, keys in [
        (
            "glib-sys",
            "0.22.8",
            [
                "GLIB_2_0",
                "GOBJECT_2_0",
            ],
        ),
        (
            "gobject-sys",
            "0.22.6",
            ["GOBJECT_2_0"],
        ),
        (
            "gio-sys",
            "0.22.8",
            ["GIO_2_0"],
        ),
        (
            "gstreamer-sys",
            "0.25.2",
            ["GSTREAMER_1_0"],
        ),
        (
            "gstreamer-base-sys",
            "0.25.3",
            ["GSTREAMER_BASE_1_0"],
        ),
        (
            "gstreamer-app-sys",
            "0.25.0",
            ["GSTREAMER_APP_1_0"],
        ),
        (
            "gstreamer-audio-sys",
            "0.25.3",
            ["GSTREAMER_AUDIO_1_0"],
        ),
        (
            "glib-sys",
            "0.22.9",
            [
                "GLIB_2_0",
                "GOBJECT_2_0",
            ],
        ),
        (
            "gobject-sys",
            "0.22.9",
            ["GOBJECT_2_0"],
        ),
        (
            "gio-sys",
            "0.22.9",
            ["GIO_2_0"],
        ),
    ]
]

bazel_dep(name = "rules_license", version = "1.0.0")

engine_repository = use_repo_rule("//third_party/v8:engine_repository.bzl", "engine_repository")

engine_repository(
    name = "v8",
    integrity = "sha256-aNN5G427qQbP/5o+NXONgXR8ZvS6mjf6mfAI6jtxyzI=",
    patch_strip = 3,
    patches = [
        "//patches:v8_source_portability.patch",
        "//patches:v8_array_sort_elements_kind.patch",
        "//third_party/v8:v8_defs.patch",
        "//third_party/v8:v8_windows_snapshot_wine.patch",
    ],
    strip_prefix = "v8-15.2.124.1",
    urls = ["https://github.com/v8/v8/archive/refs/tags/15.2.124.1.tar.gz"],
)

# All V8 inputs are owned here, including the pinned Python generator inputs.
pip.parse(
    extra_pip_args = ["--require-hashes"],
    hub_name = "v8_python_deps",
    python_version = "3.11",
    requirements_lock = "@v8//:bazel/requirements.txt",
    simpleapi_skip = [
        "jinja2",
        "markupsafe",
    ],
)
use_repo(pip, "v8_python_deps")

v8_dependencies = use_extension("//third_party/v8:dependencies.bzl", "dependencies")
use_repo(
    v8_dependencies,
    "v8_abseil",
    "v8_dragonbox",
    "v8_fast_float",
    "v8_fp16",
    "v8_highway",
    "v8_icu",
    "v8_simdutf",
)

http_archive(
    name = "v8_crate_152_2_0",
    build_file = "//third_party/v8:v8_crate.BUILD.bazel",
    sha256 = "b0b188d1f1d851abd78337818a28a15e84f143b082ce966976e9206617684373",
    strip_prefix = "rusty_v8-90a65f887a0c0f048f3784afbcb320b373c8a2e0",
    type = "tar.gz",
    urls = ["https://github.com/openai-oss-forks/rusty_v8/archive/90a65f887a0c0f048f3784afbcb320b373c8a2e0.tar.gz"],
)

git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")

git_repository(
    name = "rusty_v8_libcxx",
    build_file = "//third_party/v8:libcxx.BUILD.bazel",
    commit = "b16984ce99c702355a5b2b4c52574e82cec41fb9",
    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
)

git_repository(
    name = "rusty_v8_libcxxabi",
    build_file = "//third_party/v8:libcxxabi.BUILD.bazel",
    commit = "8f11bb1d4438d0239d0dfc1bd9456a9f31629dda",
    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
)

git_repository(
    name = "rusty_v8_llvm_libc",
    build_file = "//third_party/v8:llvm_libc.BUILD.bazel",
    commit = "75ae50cd48c8a9d70f552ccff040029968778da9",
    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
)

http_file(
    name = "rusty_v8_152_2_0_aarch64_apple_darwin_archive",
    downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.a.gz",
    sha256 = "feab9ae0384bebaa99c1d000654462c9d42123d587185c7876aaeef7d76ff749",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/librusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.a.gz",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_aarch64_apple_darwin_binding",
    downloaded_file_path = "src_binding_ptrcomp_sandbox_release_aarch64-apple-darwin.rs",
    sha256 = "b9d5652ebca515eb2bf4c2ee4a6551b2567117b5aa720f430d2032616dd7e3b5",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/src_binding_ptrcomp_sandbox_release_aarch64-apple-darwin.rs",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_aarch64_pc_windows_msvc_archive",
    downloaded_file_path = "rusty_v8_ptrcomp_sandbox_release_aarch64-pc-windows-msvc.lib.gz",
    sha256 = "daf327876f7753a94b3b05d6d64776258def3ae67503ac75db9c35c6deaa28a5",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/rusty_v8_ptrcomp_sandbox_release_aarch64-pc-windows-msvc.lib.gz",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_aarch64_pc_windows_msvc_binding",
    downloaded_file_path = "src_binding_ptrcomp_sandbox_release_aarch64-pc-windows-msvc.rs",
    sha256 = "572ed16ff09bb7944f4b35c659ff62dcd3faf43a0351e3f94f011e01b2f92a62",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/src_binding_ptrcomp_sandbox_release_aarch64-pc-windows-msvc.rs",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_aarch64_unknown_linux_gnu_archive",
    downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.a.gz",
    sha256 = "1054464a623006cdf5e25ae20877002bf3edb9a2c2f3e64f44a8714742b15e87",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.a.gz",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_aarch64_unknown_linux_gnu_binding",
    downloaded_file_path = "src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.rs",
    sha256 = "3e4d5fecdbe0f98a6017e69d7ca82519a77fb032c5eb5e4cdbecdd3e2ec519d5",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-gnu.rs",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_aarch64_unknown_linux_musl_archive",
    downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.a.gz",
    sha256 = "1a60f36a3dd8778802e6980668c4d65a3c7305d85a5d2debf466d9aa0daadd75",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/librusty_v8_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.a.gz",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_aarch64_unknown_linux_musl_binding",
    downloaded_file_path = "src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.rs",
    sha256 = "3e4d5fecdbe0f98a6017e69d7ca82519a77fb032c5eb5e4cdbecdd3e2ec519d5",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/src_binding_ptrcomp_sandbox_release_aarch64-unknown-linux-musl.rs",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_x86_64_apple_darwin_archive",
    downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_x86_64-apple-darwin.a.gz",
    sha256 = "bfe19d9b633b61d99780ece89690427fef4b985c6b4196536eaf94571166fc24",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/librusty_v8_ptrcomp_sandbox_release_x86_64-apple-darwin.a.gz",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_x86_64_apple_darwin_binding",
    downloaded_file_path = "src_binding_ptrcomp_sandbox_release_x86_64-apple-darwin.rs",
    sha256 = "b9d5652ebca515eb2bf4c2ee4a6551b2567117b5aa720f430d2032616dd7e3b5",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/src_binding_ptrcomp_sandbox_release_x86_64-apple-darwin.rs",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_x86_64_pc_windows_msvc_archive",
    downloaded_file_path = "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.lib.gz",
    sha256 = "cd829415695b30ad61b306b23a381e11276f14bb0b46815ac5ed8b96711d002d",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.lib.gz",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_x86_64_pc_windows_msvc_binding",
    downloaded_file_path = "src_binding_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.rs",
    sha256 = "572ed16ff09bb7944f4b35c659ff62dcd3faf43a0351e3f94f011e01b2f92a62",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/src_binding_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.rs",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_x86_64_unknown_linux_gnu_archive",
    downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.a.gz",
    sha256 = "b3b490f2aa809eda7f6ac727f851fb00ce8355be72827577cfaac28c7137dbcd",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.a.gz",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_x86_64_unknown_linux_gnu_binding",
    downloaded_file_path = "src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.rs",
    sha256 = "3e4d5fecdbe0f98a6017e69d7ca82519a77fb032c5eb5e4cdbecdd3e2ec519d5",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-gnu.rs",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_x86_64_unknown_linux_musl_archive",
    downloaded_file_path = "librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.a.gz",
    sha256 = "2f2679773a12576dc6b89b0f7d70e8190e5aea8a57f8f6364efaffdd1497d0e7",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/librusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.a.gz",
    ],
)

http_file(
    name = "rusty_v8_152_2_0_x86_64_unknown_linux_musl_binding",
    downloaded_file_path = "src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs",
    sha256 = "3e4d5fecdbe0f98a6017e69d7ca82519a77fb032c5eb5e4cdbecdd3e2ec519d5",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v152.2.0/src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs",
    ],
)

use_repo(crate, "crates")

bazel_dep(name = "libcap", version = "2.27.bcr.1")

rbe_platform_repository = use_repo_rule("//:rbe.bzl", "rbe_platform_repository")

rbe_platform_repository(
    name = "rbe_platform",
)