flake.nix

{
  description = "Plumbing — typed composition algebra for agent networks";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
  };

  outputs = { self, nixpkgs }:
    let
      systems = [ "aarch64-darwin" "x86_64-darwin" "x86_64-linux" "aarch64-linux" ];
      version = "1.2-RC1";

      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f {
        pkgs = import nixpkgs { inherit system; };
      });

      mkZmqEio = ocamlPackages: ocamlPackages.callPackage ./nix/zmq-eio.nix {};

      mkPythonTestEnv = pkgs: pkgs.python3.withPackages (ps: [
        ps.build
        ps.setuptools
        ps.wheel
        ps.pytest
        ps."pytest-asyncio"
      ]);

      makePlumbingPackage = { ocamlPackages, pkgs, buildPkgs ? pkgs }:
        let zmq-eio = mkZmqEio ocamlPackages; in
        ocamlPackages.buildDunePackage {
          pname = "plumbing";
          inherit version;
          src = self;
          duneVersion = "3";

          nativeBuildInputs = [ buildPkgs.git buildPkgs.pandoc ocamlPackages.menhir ]
            ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [ pkgs.darwin.sigtool ];

          buildInputs = with ocamlPackages; [
            menhirLib
            menhirSdk
            yojson
            eio_main
            cohttp-eio
            tls-eio
            ca-certs
            uutf
            dune-site
            dune-build-info
            zmq
            zmq-eio
          ];

          checkInputs = with ocamlPackages; [ alcotest ];
          # Tests disabled in sandbox: agent control tests need macOS
          # Keychain (ca-certs) and spawn real subprocesses.
          # Run tests via `dune test` in the dev shell instead.
          doCheck = false;
        };

      # Linux-only: static build and Docker image
      linuxPkgs = import nixpkgs { system = "x86_64-linux"; };

    in {
      packages = forAllSystems ({ pkgs }: {
        default = makePlumbingPackage {
          inherit (pkgs) ocamlPackages;
          inherit pkgs;
        };
      }) // {
        # Static Linux binary (musl) — build on x86_64-linux only
        x86_64-linux = (forAllSystems ({ pkgs }: {
          default = makePlumbingPackage {
            inherit (pkgs) ocamlPackages;
            inherit pkgs;
          };
        })).x86_64-linux // {
          static = makePlumbingPackage {
            ocamlPackages = linuxPkgs.pkgsMusl.ocamlPackages;
            pkgs = linuxPkgs.pkgsMusl;
            buildPkgs = linuxPkgs;
          };
        };
      };

      # Docker distribution image.
      dockerImages.plumbing =
        let
          staticPkg = makePlumbingPackage {
            ocamlPackages = linuxPkgs.pkgsMusl.ocamlPackages;
            pkgs = linuxPkgs.pkgsMusl;
            buildPkgs = linuxPkgs;
          };
          # Exclude internal tooling (plumb-desugar, peg) from distribution
          collected = linuxPkgs.runCommand "plumbing-dist" {} ''
            mkdir -p $out/bin $out/share/plumbing
            for bin in ${staticPkg}/bin/*; do
              name=$(basename "$bin")
              case "$name" in
                plumb-desugar|peg) ;;
                *) cp "$bin" $out/bin/ ;;
              esac
            done
            cp -r ${staticPkg}/share/plumbing/* $out/share/plumbing/
          '';
        in linuxPkgs.dockerTools.buildLayeredImage {
          name = "ghcr.io/quantumsoftwarelab/plumbing";
          tag = version;
          contents = [ collected linuxPkgs.cacert ];
          config = {
            Env = [
              "PLUMB_PATH=/share/plumbing/stdlib"
              "PLUMB_RESOURCES=/share/plumbing/resources"
              "SSL_CERT_FILE=${linuxPkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
            ];
          };
        };

      devShells = forAllSystems ({ pkgs }: {
        default = let
          zmq-eio = mkZmqEio pkgs.ocamlPackages;
          pythonTestEnv = mkPythonTestEnv pkgs;
        in
        pkgs.mkShell {
          packages = with pkgs; [
            # OCaml toolchain
            ocaml
            dune_3
            ocamlPackages.findlib
            ocamlPackages.ocaml-lsp
            ocamlPackages.menhir
            ocamlPackages.menhirLib
            ocamlPackages.menhirSdk
            # Libraries
            ocamlPackages.yojson
            ocamlPackages.eio_main
            ocamlPackages.cohttp-eio
            ocamlPackages.tls-eio
            ocamlPackages.ca-certs
            ocamlPackages.dune-site
            ocamlPackages.dune-build-info
            ocamlPackages.zmq
            zmq-eio
            # Testing
            ocamlPackages.alcotest
            pythonTestEnv
            pkgs.coq
            pkgs.coreutils
            pkgs.diffutils
            pkgs.gnumake
            pkgs.git
            # Documentation
            pandoc
          ];
        };
        proof = pkgs.mkShell {
          packages = [
            pkgs.coq
            pkgs.coreutils
            pkgs.diffutils
            pkgs.gnumake
            pkgs.git
          ];
        };
        tla = pkgs.mkShell {
          packages = [
            pkgs.tlaplus
            pkgs.tlaps
            pkgs.z3
            pkgs.gnumake
            pkgs.git
          ];
        };
      });
    };
}