# =============================================================================
# RunAnywhere Commons - Dependency Versions
# =============================================================================
# This file is the SINGLE SOURCE OF TRUTH for all dependency versions.
# All scripts and CMake files should read from this file via:
#   - Shell scripts: source scripts/load-versions.sh
#   - CMake: include(LoadVersions)
#
# IMPORTANT: These versions MUST match runanywhere-core/VERSIONS
# The ONNX Runtime version used here must match what's in runanywhere-swift/Binaries/
#
# Format: KEY=VALUE (no spaces around =)
# Lines starting with # are comments
# =============================================================================

# Project version (read from VERSION file, but also defined here for scripts)
# Note: the cpp-desktop-v0.20.40 kit was published from this branch ahead of an
# SDK release, so main stays at 0.20.37. The next SDK release must go above
# 0.20.40, or its version will collide with that kit tag.
PROJECT_VERSION=0.20.37

# =============================================================================
# Platform Deployment Targets
# =============================================================================
# Apple deployment floors used by SwiftPM and every packaged XCFramework.
IOS_DEPLOYMENT_TARGET=17.5
MACOS_DEPLOYMENT_TARGET=14.5

# Android minimum SDK version
ANDROID_MIN_SDK=24

# =============================================================================
# Build Tools
# =============================================================================
# Xcode version for CI/CD builds
# (2026-07-11 build-toolchain bump): 26.5 -> 26.6. GitHub's macos-26
# image and the release host both provide this exact stable build.
XCODE_VERSION=26.6
XCODE_BUILD=17F113

# Android NDK (matches what scripts/build-android.sh and Kotlin SDK expect)
# (2026-05-19 build-toolchain bump): 27.0.12077973 -> 27.3.13750724.
# 27.3.13750724 is "r27d", the CURRENT LTS designation per
# https://developer.android.com/ndk/downloads ("Latest LTS Version (r27d)").
# Note: although NDK 28.x and 29.x are published on the SDK repo channel, only
# the r27 line carries the LTS label, so we hold on the latest r27 patch.
NDK_VERSION=27.3.13750724

# Android CMake version requested by the React Native Gradle packages. Install
# this through sdkmanager because Android Gradle Plugin resolves exact SDK CMake
# packages independently from the host CMake tool used by native CI jobs.
ANDROID_CMAKE_VERSION=3.30.5

# Emscripten SDK (used by bindings/web/wasm/scripts/build.sh)
# (2026-07-10 Web release bump): 5.0.6 -> 6.0.2. Keep the setup script and
# WASM archive provenance markers sourced from this canonical pin.
EMSCRIPTEN_VERSION=6.0.2

# Node (Web SDK + React Native SDK builds)
# (2026-05-19 build-toolchain bump): 20 -> 22 (LTS).
NODE_VERSION=24

# JDK (Kotlin SDK + Android builds)
JAVA_VERSION=17

# Flutter SDK version. Single source of truth for:
#   - .github/workflows/pr-build.yml (flutter-pubget job)
#   - .github/workflows/release.yml (validate_consumer_flutter job)
#   - bindings/flutter/.fvm/fvm_config.json (local FVM)
# Bump here, then run setup-toolchain with platform=flutter (or sdk-only).
# (2026-07-11 stable patch bump): 3.44.0 -> 3.44.6.
FLUTTER_VERSION=3.44.6
FLUTTER_GRADLE_VERSION=9.1.0
FLUTTER_AGP_VERSION=9.0.1
FLUTTER_KOTLIN_VERSION=2.3.20
FLUTTER_ANDROID_COMPILE_SDK=36
FLUTTER_ANDROID_TARGET_SDK=36
FLUTTER_NDK_VERSION=28.2.13676358

# =============================================================================
# IDL Codegen Toolchain (single source of truth)
# =============================================================================
# Cross-language wire-compatibility depends on every generator emitting
# identical bytes from identical .proto files. These pins are consumed by:
#   - scripts/setup/setup-toolchain.sh    (installs the pinned versions)
#   - idl/codegen/generate_*.sh     (verifies the pinned versions at runtime)
#   - gradle/libs.versions.toml     (Wire runtime, mirrored by hand)
#   - .syncpackrc.json              (ts-proto if added to centralized npm pins)
#
# When bumping any of these, update ALL mirrors in the same commit and
# regenerate IDL bindings (idl/codegen/generate_all.sh) so idl-drift-check
# stays green.
# (2026-05-19 idl-codegen bump): 1.181.1 -> 2.11.8 (latest).
# Major bump: ts-proto 2.x switched to ES modules + dropped the `protobufjs`
# polyfill default. Generated TS still parses under tsc 5.9 strict.
TS_PROTO_VERSION=2.11.8
# WIRE_VERSION held within 5.x — 6.x reshuffles the Kotlin proto runtime
# package. Mirrored by hand in gradle/libs.versions.toml (already set to
# 5.5.1 there; this VERSIONS entry is the SoT mirror for setup-toolchain).
WIRE_VERSION=5.5.1
# SWIFT_PROTOBUF_VERSION stays at 1.38.0 (already latest stable as of
# 2026-05-19; release tag matches v1.38.0 on apple/swift-protobuf).
SWIFT_PROTOBUF_VERSION=1.38.0
# Python descriptor parsing used by the convenience generators. Keep within
# protobuf 6.x to match current CI installs while avoiding surprise 7.x drift.
PYTHON_PROTOBUF_VERSION=6.33
# (2026-05-19 idl-codegen bump): 22.0.0 -> 25.0.0 (latest stable on
# pub.dev). protoc_plugin 25.x emits Dart bindings that require the
# `protobuf` 6.x runtime — pubspec.yaml is bumped in lockstep. Requires
# Dart 3.0+ at codegen time (Flutter 3.44 bundles Dart 3.10).
PROTOC_GEN_DART_VERSION=25.0.0
# (2026-07-05 idl-codegen bump): 34 -> 35 (matches libprotobuf
# C++ pin 35.1 used by core/src/generated/proto/*.pb.cc).
# The C++ generator emits exact runtime patch guards, so keep this in lockstep
# with PROTOBUF_VERSION below and regenerate IDL bindings when it changes.
PROTOC_VERSION_MAJOR=35
# Exact protoc release that produced the committed bindings. NOT a new pin to
# chase — it records reality. protoc stamps its full major.minor.patch into the
# output of two generators, so a patch-level difference rewrites 144 committed
# files with no .proto change at all:
#   core/src/generated/proto/*.pb.h  ->  "// Protobuf C++ Version: 7.35.1"
#                                        "#if PROTOBUF_VERSION != 7035001"
#   bindings/proto-ts/src/*.ts       ->  "//   protoc               v7.35.1"
# idl/codegen/generate_all.sh fails closed when `protoc --version` disagrees,
# so a Homebrew/apt upgrade surfaces as one clear error instead of a 144-file
# phantom diff in the drift gate. Bumping this REQUIRES regenerating bindings.
PROTOC_VERSION=35.1

# CMake version installed in CI. Toolchain present on the build host.
# (2026-05-19 build-toolchain bump): 3.27 -> 4.3.2 (latest stable per cmake.org).
# This is the version present on the build host; MIN_CMAKE_VERSION (below) is
# the floor that each CMakeLists.txt advertises.
CMAKE_VERSION=4.3.2

# Minimum CMake version for the main native build graph and SDK bridge CMake
# entry points. Standalone Playground projects and the Flutter Android shim
# keep independent lower floors. Must be >= 3.24 because
# cmake/FetchONNXRuntime.cmake uses the DOWNLOAD_EXTRACT_TIMESTAMP keyword added
# in CMake 3.24. The opt-in windows-arm64-release-vs2026 preset separately
# requires a CMake build that provides that generator (upstream CMake 4.2+); it
# does not change this portable project floor. Bumping this drops support for
# older CMake hosts; CI/devs need this version+.
# NOTE: `cmake_minimum_required(VERSION ...)` must be the first command and
# cannot be parameterised by a CMake variable — keep the literal value in
# each CMakeLists.txt in sync with this when bumping.
# Bumped from 3.24 to 3.30; reverted to 3.24 because some CI Docker
# base images still ship cmake 3.27 and the bump caused configure failures.
MIN_CMAKE_VERSION=3.24

# =============================================================================
# ONNX Runtime
# =============================================================================
# iOS version MUST match:
#   1. What sherpa-onnx was built against
#   2. What's in runanywhere-swift/Binaries/onnxruntime.xcframework
# ONNX Runtime 1.29.0 was released on 2026-08-12, but its Apple pod archive is
# not published. 1.28.0 is the newest official static XCFramework available
# from download.onnxruntime.ai and is paired with Sherpa-ONNX 1.13.5 below.
ONNX_VERSION_IOS=1.28.0
ONNX_IOS_SHA256=b503cf5949ab718a1dff17d1643237ecc0fecf50ad86264572dcafddb140a327

# Android ONNX Runtime ships inside the pinned Sherpa-ONNX Android archive.
# The fork workflow builds that archive against this exact upstream source
# commit and validates the runtime before publishing it.
ONNX_VERSION_ANDROID=1.28.0
ONNX_COMMIT_ANDROID=da9b5e364c465de65c49d91e696cd6485270757f

# macOS release packaging needs a static archive. 1.28.0 is the newest
# published macOS static build; 1.29.0 currently ships only Microsoft's shared
# package. Keep this digest pinned to the exact csukuangfj build consumed by
# core/scripts/macos/download-sherpa-onnx.sh.
ONNX_VERSION_MACOS=1.28.0
ONNX_MACOS_STATIC_SHA256=e1b924acecf0cd42d1931e712bda1bc5fa0d111735dce265ea1bfdb024305318
# The third-party static archive omits this generated public header even
# though its own onnxruntime_c_api.h includes it. Fetch the missing file from
# the exact matching upstream tag and verify it before compiling Sherpa.
ONNX_MACOS_ERROR_CODE_HEADER_SHA256=5ce3b054e798eced8d14f5b86e98692fd33470463f96194ce0700a2d53dd8721

# Linux uses the same ORT ABI baseline as every other runtime target. Sherpa's
# fork-owned release below is built against this exact version.
ONNX_VERSION_LINUX=1.28.0

# Windows uses the same ORT ABI baseline as Linux, Apple, Android, and Web.
ONNX_VERSION_WINDOWS=1.28.0

# Web/WASM source builds use the common ORT 1.28.0 baseline too. 1.29.0 is not
# usable here because no matching static WASM/Apple release set is published.
ONNX_VERSION_WEB=1.28.0
ONNX_COMMIT_WEB=da9b5e364c465de65c49d91e696cd6485270757f

# =============================================================================
# Sherpa-ONNX (via runanywhere-core)
# =============================================================================
# iOS uses the static XCFramework published on upstream's rolling
# `xcframework` release. The downloader normalizes its framework-bundle layout
# back to the raw static-archive layout consumed by the CMake packager.
SHERPA_ONNX_VERSION_IOS=1.13.5
SHERPA_ONNX_IOS_SHA256=79214d00e275c864f0c4f7f9d1c252f8b621b185ceb54c13a43906da6f913080

# Android version (v1.12.20+ has 16KB alignment for Play Store)
# The downloader invalidates its cache whenever the repository, version,
# source/header commit, runtime commit, patch hash, or archive digest changes.
SHERPA_ONNX_VERSION_ANDROID=1.13.5-rac.4
# Android consumes the canonical-first RunAnywhere fork release. It retains
# the existing Whisper confidence behavior on upstream Sherpa 1.13.5, builds
# all four ABIs with NDK r27d against ORT 1.28.0, proves 16 KiB alignment, and
# rejects host build paths before publishing.
SHERPA_ONNX_REPO_ANDROID=RunanywhereAI/sherpa-onnx
SHERPA_ONNX_COMMIT_ANDROID=12f7112dc8f8161bdb611b31837bd47d70e4603f
SHERPA_ONNX_ANDROID_SHA256=f7e774d99f03bf51f11ee0b9c155f2737b98c5f299b0575c18821285a338edd5
# The fork commit is one behavior-only patch over this signed upstream commit.
# The SHA-256 is for the exact three-file git diff, not the release archive.
SHERPA_ONNX_UPSTREAM_COMMIT_ANDROID=3dc7c569f31ca2cd4a20ed6f7db780327e6714c5
SHERPA_ONNX_PATCH_SHA256_ANDROID=1348660905c79512a571fb11d5fb436485b8cb3e44de5fc3453dcc8ec8e0fcf7
# Public C/C++ headers are unchanged by the patch; fetch them from the signed
# upstream source commit instead of the fork's mutable release tag.
SHERPA_ONNX_HEADER_REPO_ANDROID=k2-fsa/sherpa-onnx
SHERPA_ONNX_HEADER_COMMIT_ANDROID=3dc7c569f31ca2cd4a20ed6f7db780327e6714c5

# Sherpa 1.13.5 contains the corrected NeMo streaming-transducer decode path
# required by Nemotron 3.5 Streaming ASR. The macOS builder links it against
# the exact ORT 1.28.0 static archive pinned above.
SHERPA_ONNX_VERSION_MACOS=1.13.5
SHERPA_ONNX_COMMIT_MACOS=3dc7c569f31ca2cd4a20ed6f7db780327e6714c5

# Linux and Windows consume fork-owned artifacts built from upstream 1.13.5
# against ORT 1.28.0. The release workflow builds all three artifacts before
# publishing, and the downloaders verify both archive checksums and embedded
# provenance before making them available to CMake.
SHERPA_ONNX_REPO_DESKTOP=RunanywhereAI/sherpa-onnx
SHERPA_ONNX_RELEASE_TAG_DESKTOP=v1.13.5-rac-desktop.5
SHERPA_ONNX_COMMIT_DESKTOP=0fedaeff7f06463f5e036e5737d4ac52b7b575fd
SHERPA_ONNX_VERSION_LINUX=1.13.5
SHERPA_ONNX_LINUX_X64_SHA256=b2d51f8c9afae542751d46c820d57aeba27caa165bf7359dd5013604b7879cc1
SHERPA_ONNX_LINUX_AARCH64_SHA256=2324f7d939d66b006a76e8c2db6a2dfb49eb8c1ade39f2ce64b566813bc458da
SHERPA_ONNX_VERSION_WINDOWS=1.13.5
SHERPA_ONNX_WINDOWS_X64_SHA256=5d97fc2b9a340d7f2271bd296cd0db1550b224bbe6c1e4264651278cbe7dc596

# Web/WASM matched set with ONNX_VERSION_WEB. Do not reuse Android/iOS
# prebuilts for this target; the Web vendor scripts validate provenance.
SHERPA_ONNX_VERSION_WEB=1.13.5
SHERPA_ONNX_COMMIT_WEB=3dc7c569f31ca2cd4a20ed6f7db780327e6714c5

# =============================================================================
# llama.cpp (LLM inference)
# =============================================================================
# (2026-08-16 runtime/model bump): RunAnywhere's direct fork of canonical
# ggml-org/llama.cpp at b10453 plus the following narrow compatibility patches:
# DeepGrove Maple architecture/ternary-expert support. Q1_0 Bonsai remains
# supported by canonical upstream, and Ternary-Bonsai uses Prism's canonical
# Q2_0_g64 artifacts instead of its older conflicting 128-value Q2_0 encoding.
# Maple is CPU-only until its ternary expert mul_mm_id kernels exist on GPU;
# the engine enforces that after reading general.architecture from the GGUF.
# See the fork's RUNANYWHERE.md before rebasing.
LLAMACPP_VERSION=runanywhere-b10453.8
# Repository the llama.cpp FetchContent clones. Consumed by
# engines/llamacpp/CMakeLists.txt via LoadVersions (RAC_LLAMACPP_GIT_REPOSITORY).
LLAMACPP_GIT_REPOSITORY=https://github.com/RunanywhereAI/llama.cpp.git

# =============================================================================
# nlohmann/json
# =============================================================================
NLOHMANN_JSON_VERSION=3.12.0

# =============================================================================
# USearch (vector search engine used by the RAG pipeline)
# =============================================================================
USEARCH_VERSION=v2.25.2

# =============================================================================
# cpp-httplib (header-only HTTP server — RAC_BUILD_SERVER only)
# =============================================================================
CPPHTTPLIB_VERSION=v0.45.0

# =============================================================================
# zlib (bundled for Android/Emscripten where the platform SDK lacks it)
# =============================================================================
ZLIB_VERSION=v1.3.2

# =============================================================================
# bzip2 (bundled for Android/Emscripten — sourceware tarball, NOT a `v` prefix)
# =============================================================================
BZIP2_VERSION=1.0.8

# =============================================================================
# Protobuf (libprotobuf runtime + matching libprotobuf-lite/abseil)
# =============================================================================
# Must match what the checked-in generated headers under
# core/src/generated/proto/ were emitted by (Protobuf C++
# 7.35.1 → upstream tag v35.1). Bumping requires regenerating those headers.
PROTOBUF_VERSION=35.1

# Protobuf 35.1 is built and distributed by the supported Homebrew toolchain
# against this Abseil release. Pre-fetch the exact same source for the private
# static protobuf runtime so generated-header consumers and packaged symbols
# share one Abseil inline namespace without linking host dylibs.
ABSEIL_VERSION=20260107.1

# =============================================================================
# GoogleTest (test framework for commons + RAG unit tests)
# =============================================================================
GOOGLETEST_VERSION=v1.17.0

# =============================================================================
# libarchive (archive extraction - ZIP, TAR.GZ, TAR.BZ2, TAR.XZ)
# =============================================================================
LIBARCHIVE_VERSION=3.8.7

# =============================================================================
# RAC Commons Version (for remote builds/CI)
# =============================================================================
RAC_COMMONS_VERSION=0.1.1

# =============================================================================
# neurun — the PRIVATE repo that builds and publishes both accelerator engines
# =============================================================================
# One neurun release carries both engines' payloads. Pinned by tag + SHA-256 the
# same way sherpa-onnx is; no engine source enters this repo.
#
# The repo is shared, but each engine keeps its OWN release tag: a release can be
# cut for one lane only (see that repo's `lanes` input), so a tag may carry just
# one engine's assets.
#
# NEURT_RAC_ABI_VERSION must equal RAC_PLUGIN_API_VERSION in
# core/include/rac/plugin/rac_plugin_entry.h. The downloader enforces it against
# each archive's receipt.
#
# QHEXRT_*_RECEIPT is the payload's own build-receipt digest, which is also its
# directory name, so the downloader can prove the extracted tree is the payload
# that was pinned rather than trusting the archive's claim about itself.
#
# QAIRT is read for HEADERS ONLY when QHexRT is built, and its runtime is dlopen'd
# on device; the neurun engine payload still carries no Qualcomm binary. The
# runtime itself is pinned separately below and fetched from the PRIVATE neurun
# repo with NEURUN_TOKEN, exactly like the engine payloads.
#
# To bump: cut a neurun release, then paste the pin block from its release notes.
# Never compute these locally — a local build's bytes are never the published ones.
NEURUN_REPO=RunanywhereAI/neurun

NEURT_RELEASE_TAG=v0.20.40
NEURT_RAC_ABI_VERSION=14
NEURT_MACOS_ARM64_SHA256=b73414d5d80955b5447639bdde06c3bd638e4e7077dc18928a5781861f637b65
NEURT_IOS_ARM64_SHA256=536a5567b546726a0230b0447ce3c41b9e78fa504fdc6e17368750413910a0b4
NEURT_IOS_ARM64_SIMULATOR_SHA256=4050e9b6fd8a1c670ddecfa3aeb4b4d8c8b951b1f5cd39bcf6f995c1d42f4c58

QHEXRT_RELEASE_TAG=v0.20.31
QHEXRT_ARM64_V8A_SHA256=1c49bfa5dd6546a34b63f79f6be90ff26a04da40832d3c0dbfe4ed35aef3fcd6
QHEXRT_ARM64_V8A_RECEIPT=5e815d3a8f6c1d7dbefde9012f023c9f6edeaee18cbc910830c80c8ba4dcd147
QHEXRT_WIN_ARM64_SHA256=531c8cf79a9e46c797074be9b7b32f3c38a92396a4c0a77c898537bfa7c65468
QHEXRT_WIN_ARM64_RECEIPT=67aef6df8f549b84fcca541fe6d963cf87b246bcb2a75a362707ca530c76a5cd

# The QAIRT/QNN runtime redistributables the QHexRT engine dlopens at run time.
# A SEPARATE axis from the engine pins above: the QAIRT SDK version and the SDK
# release version move independently, so these carry their own tag and are not
# bumped by a neurun release.
#
# PRIVATE assets on the neurun repo, fetched with NEURUN_TOKEN — the same
# mechanism as NEURT_*/QHEXRT_* above, so a build that can reach one reaches all
# three. A hosted runner with the token builds a routable Hexagon engine without a
# licensed QAIRT install; without the token it gets the non-routable shell, which
# is the intended public/fork outcome. Produced by
# scripts/build/publish-qairt-runtime.sh from a licensed install (that step still
# needs a human with the SDK) and fetched by scripts/build/download-qairt-runtime.sh.
#
# scripts/validation/gates/check_qairt_pairing.sh asserts this runtime is the same
# QAIRT the pinned engine was built against — two independent pins CAN drift, and a
# hash-verified but wrong-version runtime crashes on a real Hexagon device.
QAIRT_RUNTIME_VERSION=2.47.0.260601
QAIRT_RUNTIME_RELEASE_TAG=qairt-runtime-v2.47.0.260601
QAIRT_RUNTIME_ARM64_V8A_SHA256=b851e3d3f8b7888ce747f1ef05e0b41d5dab60f9b2490fe384649461cecd0800
QAIRT_RUNTIME_WIN_ARM64_SHA256=76499d3bb11196e42f5801e1d3c240f0fd120938b75820992f93101a33db8aa8
