# Shared crane wiring for the rust workspace: the cargo source
# filter, the once-built dependency artifacts, and the native build
# inputs every rust derivation (packages + checks) consumes.
# Imported per system from flake.nix.
{ pkgs, craneLib }:
let
  inherit (pkgs) lib;
in
rec {
  # Shared between buildDepsOnly + buildPackage + cargoClippy/cargoTest
  # so every derivation in the chain sees the same toolchain shape.
  # git: hive-c0re's `lifecycle::tests::setup_proposed_*` shell out to
  # `git init` + commit under `cargo test` in the sandbox.
  # sqlite: matrix-sdk's `sqlite` feature (`hive-matrix-mcp` workspace
  # member) — the matrix-sdk-sqlite + rusqlite stack links against
  # system libsqlite3 by default.
  # cmake: builds `aws-lc-sys` (BoringSSL) from source — pulled in by
  # the `rustls` (aws-lc-rs) crypto provider under the OTLP/reqwest
  # stack in `hive-metric`.
  nativeBuildInputs = [
    pkgs.git
    pkgs.sqlite
    pkgs.pkg-config
    pkgs.cmake
  ];

  # Narrowed source tree the rust derivations consume: everything
  # cargo cares about (Cargo.toml/Cargo.lock + *.rs/*.toml), selected
  # via `lib.fileset` rather than crane's `cleanCargoSource` filter —
  # filesets drop directories that contain no selected files, so
  # adding or renaming a non-rust directory (nix modules, docs, …)
  # does NOT bust this src hash (an empty dir under a plain source
  # filter would). All non-rust runtime assets — branding + the claude
  # prompt template + claude-settings.json — live in the separate
  # `hyperhive-assets` derivation and are loaded by the binaries at
  # runtime from `$HIVE_ASSETS_DIR`. Net effect: only `*.rs` /
  # `*.toml` / `Cargo.lock` edits rebuild the rust derivations.
  cleanSrc = lib.fileset.toSource {
    root = ../.;
    fileset = craneLib.fileset.commonCargoSources ../.;
  };

  # The workspace's dependency tree, built once and cached as its own
  # derivation so a workspace-only edit doesn't rebuild deps. Every
  # consumer passes the same `cleanSrc`, keeping the input hash
  # consistent across the chain.
  #
  # Two dep caches, one per audience, and the split is not premature:
  # crane's `buildDepsOnly` defaults `doCheck = true`, which adds
  # `--all-targets` to the check and a `cargo test --no-run`, so the cache
  # compiles every dev-dependency and test harness in the tree. The CHECKS
  # need exactly that. A DEPLOY never runs a test binary and never links
  # one, so on the deploy path that work is compiled and thrown away.
  #
  # They are separate rather than shared because they were never actually
  # shared: CI evaluates against hyperhive's own nixpkgs pin, while a host
  # overrides it (security patches cannot wait on a lock bump upstream),
  # so the two closures differ and neither substitutes for the other. One
  # cache per audience therefore costs nobody a second build — it just
  # stops the deploy paying for artifacts only CI consumes.
  #
  # ⚠️ `buildDepsOnly` builds from `mkDummySrc`, so both hashes key on
  # Cargo.toml/Cargo.lock rather than on `.rs` files: a code edit rebuilds
  # neither, a dependency or toolchain change rebuilds both.
  cargoArtifacts = craneLib.buildDepsOnly {
    src = cleanSrc;
    # Workspace Cargo.toml is virtual (no `[package].name`), so crane
    # can't auto-derive a name. Spell it out explicitly — keeps the
    # derivation name stable across crane bumps + silences the
    # placeholder warning. Same `pname` for the dep + check
    # derivations so they share a clean naming family.
    pname = "hyperhive-workspace";
    version = "0.1.0";
    inherit nativeBuildInputs;
  };

  # The deploy path's cache: same deps, no test targets. `doCheck = false`
  # drops crane's `--all-targets` and its `cargo test --no-run`, so
  # dev-dependencies and test harnesses are never compiled here.
  #
  # Only `packages` consume this. Anything that needs to *run* a test —
  # `checks.cargo-test` — or lint one — `checks.clippy --all-targets` —
  # takes `cargoArtifacts` above instead, and would rebuild what it needs
  # if it were pointed here by mistake.
  cargoArtifactsBinOnly = craneLib.buildDepsOnly {
    src = cleanSrc;
    # Distinct pname so the two are told apart in build logs and store
    # paths; a shared name would make the useful question ("which cache
    # is this rebuild?") unanswerable at a glance.
    pname = "hyperhive-workspace-bin";
    version = "0.1.0";
    doCheck = false;
    inherit nativeBuildInputs;
  };
}