flake.nix

{
  # Builds and checks for the Dassie rewrite
  # (spec/decisions/build-system.md). Plain `cargo` and `node --run` work
  # locally as well; this flake pins the toolchain for CI and makes the
  # releases (nix/release.nix).
  description = "Dassie: a multi-currency, peer-to-peer, Interledger-enabled payment network";

  # The project's cache on the Vorstand Nix cloud, which keeps each release's
  # desktop app (spec/areas/desktop.md#the-package), signed by a key that
  # signs Dassie's builds alone. Nix asks before it uses this, and only for
  # trusted users; the desktop app's docs say how others add it.
  nixConfig = {
    extra-substituters = [ "https://nix.vorstand.app/cache/dassie" ];
    extra-trusted-public-keys = [ "nix.vorstand.app-dassie-1:oUWp1VA+DI2VlKFSUt7Iyffry2enZ06fUGWVd7qHSBM=" ];
  };

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    rust-overlay = {
      url = "github:oxalica/rust-overlay";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    crane.url = "github:ipetkov/crane";
  };

  outputs =
    {
      self,
      nixpkgs,
      rust-overlay,
      crane,
    }:
    let
      inherit (nixpkgs) lib;
      systems = [
        "x86_64-linux"
        "aarch64-linux"
      ];

      # The wasm-bindgen CLI, as release binaries pinned by hash. Its version
      # must be the wasm-bindgen crate's in Cargo.lock: the CLI and the crate
      # speak one schema, and evaluation fails if they differ.
      wasmBindgenVersion = "0.2.129";
      wasmBindgenHashes = {
        x86_64-linux = "sha256-gtEruUDi1OcuDVYFOH/BuMoXkETgErYg8M5OdEDoMg4=";
        aarch64-linux = "sha256-LtQ1HDXdlEAwi7sCdn1H6ieO/oUaUkZTAPPJT1tsKoc=";
      };

      perSystem =
        system:
        let
          pkgs = import nixpkgs {
            inherit system;
            overlays = [ rust-overlay.overlays.default ];
          };

          # rust-toolchain.toml names only the channel; components and the
          # wasm target are added here, so that rustup never downloads them in
          # an offline build.
          toolchain = (pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml).override {
            extensions = [
              "clippy"
              "rustfmt"
            ];
            targets = [ "wasm32-unknown-unknown" ];
          };
          craneLib = (crane.mkLib pkgs).overrideToolchain (_: toolchain);

          lockedBindgen = lib.findFirst (p: p.name == "wasm-bindgen") null (
            lib.importTOML ./Cargo.lock
          ).package;
          wasm-bindgen =
            assert lib.assertMsg (lockedBindgen.version == wasmBindgenVersion)
              "wasm-bindgen: the CLI (flake.nix) is ${wasmBindgenVersion}, Cargo.lock has ${lockedBindgen.version}; they must match";
            pkgs.stdenvNoCC.mkDerivation {
              pname = "wasm-bindgen-cli";
              version = wasmBindgenVersion;
              src = pkgs.fetchurl {
                url =
                  let
                    arch = lib.head (lib.splitString "-" system);
                  in
                  "https://github.com/wasm-bindgen/wasm-bindgen/releases/download/${wasmBindgenVersion}/wasm-bindgen-${wasmBindgenVersion}-${arch}-unknown-linux-musl.tar.gz";
                hash = wasmBindgenHashes.${system};
              };
              installPhase = "install -Dm755 wasm-bindgen $out/bin/wasm-bindgen";
            };

          # The Rust workspace, with Cargo's configuration (the property
          # tests' fixed seed, and the bundled SQLite's build flags, which
          # the release builds with too), the golden vectors the tests read
          # (the rate feed's are in testdata/feed, a settlement hub's in
          # testdata/hub), the RPC contract dassie-node
          # generates its messages from, the test certificates two
          # in-process daemons peer with, minisign's signatures with the
          # release test key, and the release's resources: its key, the
          # systemd units and install.sh. Of the proof servers'
          # files only their xrpld configs, whose history a test holds
          # above the account's history bound, so that changing the rest
          # rebuilds nothing.
          src = lib.fileset.toSource {
            root = ./.;
            fileset = lib.fileset.unions [
              ./.cargo/config.toml
              ./Cargo.toml
              ./Cargo.lock
              ./clippy.toml
              ./crates
              ./proto
              (lib.fileset.difference ./resources ./resources/proof-server)
              ./resources/proof-server/xrpld-mainnet.cfg
              ./resources/proof-server/xrpld-testnet.cfg
              ./testdata/feed
              ./testdata/hub
              ./testdata/tls
              ./testdata/release
            ];
          };

          # The desktop app's libraries (crates/dassie-desktop): GTK and
          # WebKitGTK for its window, libsoup for WebKit's network, and the
          # tray icon's AppIndicator. Every build of the whole workspace
          # compiles their -sys crates, so they are in `common`.
          desktop = import ./nix/desktop-libs.nix { inherit pkgs; };

          # The workspace crate by crate, with its checks (nix/rust).
          rust = import ./nix/rust {
            inherit pkgs toolchain craneLib;
            wallet = release.packages.wallet or null;
          };

          # What the flake's own crane builds share: the workspace, and the
          # ci profile (Cargo.toml) rather than crane's default, release,
          # whose fat LTO and one codegen unit take minutes to link. The
          # release builds use release (nix/release.nix), the desktop app
          # its own settings (nix/desktop.nix).
          common = {
            inherit src;
            pname = "dassie";
            version = "0.1.0";
            strictDeps = true;
            cargoExtraArgs = "--locked";
            CARGO_PROFILE = "ci";
            inherit (desktop) nativeBuildInputs buildInputs;
          };
          cargoArtifacts = craneLib.buildDepsOnly common;

          # The workspace as Cargo reads it, without its code: every
          # manifest as it is, the lockfile and Cargo's configuration, and
          # crane's dummy for each target. A derivation that needs Cargo to
          # read the workspace but builds few of its crates, or none, starts
          # from it, so that an edit to the others leaves it as it was.
          manifests = lib.fileset.unions [
            ./.cargo/config.toml
            ./Cargo.toml
            ./Cargo.lock
            ./clippy.toml
            (lib.fileset.fileFilter (file: file.name == "Cargo.toml") ./crates)
          ];
          skeleton = pkgs.runCommand "dassie-skeleton" { } ''
            cp -r --no-preserve=mode ${
              craneLib.mkDummySrc {
                src = lib.fileset.toSource {
                  root = ./.;
                  fileset = manifests;
                };
              }
            } $out
            cp -r --no-preserve=mode ${
              lib.fileset.toSource {
                root = ./.;
                fileset = manifests;
              }
            }/. $out/
          '';

          # What the WASM modules build from: dassie-wasm and the crates it
          # is built on, without their tests, in the skeleton. An edit to a
          # crate the modules don't use leaves them as they were, and with
          # them the wallet, the site and every TypeScript check, which are
          # built on them.
          wasmCrates = map (crate: crate.key) (
            builtins.genericClosure {
              startSet = [ { key = "dassie-wasm"; } ];
              operator =
                { key }:
                lib.mapAttrsToList (_: dep: { key = lib.removePrefix "../" dep.path; }) (
                  lib.filterAttrs (_: dep: dep ? path && dep.path != ".") (
                    (lib.importTOML ./crates/${key}/Cargo.toml).dependencies or { }
                  )
                );
            }
          );
          wasmSrc =
            let
              crates = lib.fileset.toSource {
                root = ./.;
                fileset = lib.fileset.unions (
                  map (
                    crate:
                    lib.fileset.difference ./crates/${crate} (
                      lib.fileset.unions (
                        map (dir: lib.fileset.maybeMissing ./crates/${crate}/${dir}) [
                          "tests"
                          "benches"
                          "examples"
                        ]
                      )
                    )
                  ) wasmCrates
                );
              };
            in
            pkgs.runCommand "dassie-wasm-src" { } ''
              cp -r --no-preserve=mode ${skeleton} $out
              for crate in ${lib.concatStringsSep " " wasmCrates}; do
                rm -r $out/crates/$crate
                cp -r --no-preserve=mode ${crates}/crates/$crate $out/crates/$crate
              done
            '';
          # wasmSrc is built, so crane is told where the dependencies are,
          # rather than reading its lockfile at evaluation.
          cargoVendorDir = craneLib.vendorCargoDeps { cargoLock = ./Cargo.lock; };
          wasmArtifacts = craneLib.buildDepsOnly (
            common
            // {
              pname = "dassie-wasm";
              # The profile wasm-modules builds with, so that it reuses
              # these dependencies rather than building them again.
              CARGO_PROFILE = "wasm";
              CARGO_BUILD_TARGET = "wasm32-unknown-unknown";
              cargoExtraArgs = "--locked --features identity,stream -p dassie-wasm";
              doCheck = false;
            }
          );

          # The WASM modules and their bindings, as scripts/build-wasm.ts
          # makes them: web/, which browsers, scripts and tests all load.
          wasm-modules = craneLib.mkCargoDerivation (
            common
            // {
              src = wasmSrc;
              inherit cargoVendorDir;
              pname = "wasm-modules";
              cargoArtifacts = wasmArtifacts;
              nativeBuildInputs = [ wasm-bindgen ];
              # Each of dassie-wasm's features is a module of its own; each
              # build writes the same file, so it is bound before the next.
              buildPhaseCargoCommand = ''
                for feature in identity stream; do
                  cargo rustc --locked -p dassie-wasm --lib --crate-type cdylib \
                    --target wasm32-unknown-unknown --profile wasm --features $feature
                  wasm-bindgen --target web --out-dir wasm-out/web --out-name dassie_$feature \
                    target/wasm32-unknown-unknown/wasm/dassie_wasm.wasm
                done
              '';
              doInstallCargoArtifacts = false;
              installPhaseCommand = ''
                mkdir -p $out
                cp -r wasm-out/web $out/web
              '';
            }
          );

          # `dassie-release verify`, with which the release workflow checks
          # what it signed.
          release-tool = craneLib.buildPackage (
            common
            // {
              pname = "dassie-release";
              inherit cargoArtifacts;
              cargoExtraArgs = "--locked -p dassie-release --features tool";
              doCheck = false;
            }
          );

          # The release builds (nix/release.nix), made on x86_64-linux only.
          release = lib.optionalAttrs (system == "x86_64-linux") (
            import ./nix/release.nix {
              inherit
                lib
                pkgs
                nixpkgs
                rust-overlay
                crane
                src
                wasm-modules
                ;
            }
          );

          # The desktop app (nix/desktop.nix), with the wallet built in, on
          # x86_64-linux, where the wallet is built: `nix run .#desktop`.
          # The package builds in release; its check, below, wraps the app
          # nix/rust built for the checks.
          desktopIn =
            binary:
            import ./nix/desktop.nix {
              inherit
                lib
                pkgs
                craneLib
                src
                binary
                ;
              inherit (release.packages) wallet;
            };
          desktop-app = lib.optionalAttrs (system == "x86_64-linux") {
            desktop = desktopIn null;
          };
          desktop-check = lib.optionalAttrs (system == "x86_64-linux") {
            desktop = desktopIn rust.desktop;
          };

          # The TypeScript side's checks (nix/ts.nix), on x86_64-linux too,
          # where the wallet they test is built.
          ts = lib.optionalAttrs (system == "x86_64-linux") (
            import ./nix/ts.nix {
              inherit
                lib
                pkgs
                craneLib
                common
                toolchain
                wasm-modules
                ;
              inherit (release.packages) wallet;
              e2e = rust.e2eBinaries;
            }
          );
        in
        {
          packages = {
            inherit wasm-modules wasm-bindgen release-tool;
            # After a change to Cargo.lock, a manifest or a crate's targets:
            # `nix run .#cargo-nix` writes nix/rust/Cargo.nix again.
            cargo-nix = rust.generate;
          }
          # `nix build` alone makes the static `dassie` with the wallet
          # built in, where the release builds are made.
          // lib.optionalAttrs (release ? packages) { default = release.packages.dassie-x64; }
          // (release.packages or { })
          // (ts.packages or { })
          // desktop-app;

          checks = {
            cargo-fmt = craneLib.cargoFmt {
              inherit src;
              inherit (common) pname version;
            };
            # The dependencies' licenses and sources, and wildcard
            # requirements, by deny.toml: crane's default checks, which
            # need no network. The advisories change without a change
            # here, so they run in their own workflow (advisories.yml).
            # deny.toml joins the source of this check alone, so that a
            # change to it builds nothing else again.
            cargo-deny = craneLib.cargoDeny {
              src = lib.fileset.toSource {
                root = ./.;
                fileset = lib.fileset.unions [
                  (lib.fileset.fromSource src)
                  ./deny.toml
                ];
              };
              inherit (common) pname version;
            };
            inherit wasm-modules;
            # The WASM crates' lints, as `cargo clippy` checks them: without
            # codegen, so nothing is compiled twice. The modules themselves
            # are rustc's: they ship, in the wallet and on dassie.land, and
            # clippy-driver compiles other code (it skips MIR's
            # optimizations).
            cargo-clippy-wasm = craneLib.cargoClippy (
              common
              // {
                src = wasmSrc;
                inherit cargoVendorDir;
                cargoArtifacts = wasmArtifacts;
                CARGO_PROFILE = "wasm";
                CARGO_BUILD_TARGET = "wasm32-unknown-unknown";
                cargoExtraArgs = "--locked --features identity,stream -p dassie-wasm";
                cargoClippyExtraArgs = "-- -D warnings";
              }
            );
          }
          # Each crate's tests, its lints with them, crate by crate
          # (nix/rust): an edit builds the crates it reaches again, and runs
          # their tests alone.
          // rust.checks
          // (release.checks or { })
          // (ts.checks or { })
          # The packaged app: the desktop app nix/rust built for its tests,
          # wrapped, which they do not show (nix/desktop.nix).
          // desktop-check;

          # The simulation campaign's VMs (scripts/sim-campaign.ts): CI's
          # toolchain, and Node for the supervisor, without the rest of the
          # default shell for every VM to download.
          devShells.campaign = pkgs.mkShell {
            packages = [
              toolchain
              pkgs.nodejs_26
            ];
          };

          devShells.default = pkgs.mkShell {
            packages = [
              toolchain
              wasm-bindgen
              # The TypeScript side: Node strips the types, pnpm installs the
              # workspace (pnpm-lock.yaml). pnpm 11, as pnpm_11: nixpkgs'
              # pnpm is 12, an experimental rewrite in Rust that can't
              # install from a read-only store. The same two regenerate the
              # golden vectors (testdata/original): the original names pnpm
              # 9, which pnpm 11 fetches and hands the install to, and
              # wants Node 22, but its Vitest makes the same vectors with 26.
              pkgs.nodejs_26
              pkgs.pnpm_11
              # The browser tests (CHROME_BIN).
              pkgs.chromium
              # The end-to-end tests (tests/e2e): Let's Encrypt's test ACME
              # server, and systemd's socket activation without systemd.
              pkgs.pebble
              pkgs.systemd
              # The dev environment's and the scenarios' certificates
              # (apps/dev).
              pkgs.mkcert
              # Signing releases (scripts/release.ts).
              pkgs.minisign
            ]
            # The desktop app (crates/dassie-desktop).
            ++ desktop.nativeBuildInputs
            ++ desktop.buildInputs;
            CHROME_BIN = lib.getExe pkgs.chromium;
            # Node keeps what it compiles between runs, which starts the
            # tests, scripts and the dev environment faster. It does only
            # with a directory to keep it in: the user's cache.
            shellHook = ''
              export NODE_COMPILE_CACHE="''${XDG_CACHE_HOME:-$HOME/.cache}/node-compile-cache"
            '';
          };
        };
    in
    {
      packages = lib.genAttrs systems (system: (perSystem system).packages);
      checks = lib.genAttrs systems (system: (perSystem system).checks);
      devShells = lib.genAttrs systems (system: (perSystem system).devShells);
    };
}