module_layers.toml

# module_layers.toml -- Checkmk module layer architecture rules
#
# Defines which components may import from which other components.
# Enforced by astrein's module-layers checker.
#
# A component is a *module prefix*, not a directory: what lives below cmk.foobar
# belongs to component cmk.foobar, wherever on disk the file happens to sit. The
# deepest declared prefix wins, so cmk.foo.bar governs its subtree even though
# cmk.foo is declared too.
#
# Syntax:
#   "@group_name" in allows/excludes expands to the group defined in [groups]
#   Self-imports (component importing from itself) are always allowed implicitly.
#   "excludes" carves a subtree back out of what allows (and self-import) grants.
#
# Namespace packages: a cmk.* namespace may be populated by more than one Bazel
# package. The guest package's files are then judged by the host's rules, so the
# guest inherits the host's permissions and cannot reach its own package, while
# the host may reach into the guest just by virtue of sharing a name. Where that
# matters, give the guest subtree a component of its own listing what it really
# imports, and add it to the host's excludes unless a deliberate host -> guest
# edge exists. See cmk.checkengine.fetchers.telemetry_metrics.
#
# Not every shared namespace wants this. cmk.plugins is a plugin API contract
# rather than a build unit, and families there are split across free and nonfree
# packages by design.

# Top-level namespaces that are considered first party: imports of these are
# checked against the component rules below; everything else is ignored.
#
# "livestatus" is the deprecated alias of "cmk.livestatus_client" and is fully
# migrated: no component allows it anymore. Keeping it first party makes the
# checker reject any reintroduction; import cmk.livestatus_client instead.
first_party = ["cmk", "livestatus"]

[groups]
ccc = ["cmk.ccc"]

crash = ["cmk.crash", "cmk.crash_reporting"]

crypto = ["cmk.crypto"]

flags = ["cmk.flags"]

livestatus_client = ["cmk.livestatus_client"]

messaging = ["cmk.messaging"]

data_backend = ["cmk.data_backend"]

mkp_tool = ["cmk.mkp_tool"]

plugin_apis = [
  "cmk.agent_based.internal",
  "cmk.automations.internal",
  "cmk.agent_based.legacy",
  "cmk.agent_based.v1",
  "cmk.agent_based.v2",
  "cmk.agent_based.v3_unstable",
  "cmk.bakery.internal",
  "cmk.bakery.v1",
  "cmk.bakery.v2",
  "cmk.cli.internal",
  "cmk.dcd_connector_parameters.internal",
  "cmk.dcd_connectors.internal",
  "cmk.diagnostics.internal",
  "cmk.graphing.v1",
  "cmk.graphing.v2_unstable",
  "cmk.inventory_ui.v1",
  "cmk.licensing.internal",
  "cmk.password_store.v1",
  "cmk.post_rename_site.internal",
  "cmk.rulesets.internal",
  "cmk.rulesets.internal.form_specs",
  "cmk.rulesets.v1",
  "cmk.rulesets.v1.form_specs",
  "cmk.server_side_calls.internal",
  "cmk.server_side_calls.v1",
  "cmk.server_side_programs.v1",
  "cmk.update_config.internal",
]

relay_protocols = ["cmk.relay_protocols"]

telemetry = ["cmk.telemetry"]

trace = ["cmk.trace"]

werks = ["cmk.werks"]


[plugin_families]
# These are ready to be moved to a package. PLEASE DO NOT INTRODUCE NEW DEPENDENCIES!
clean = [
  "acme",
  "activemq",
  "alertmanager",
  "allnet_ip_sensoric",
  "appdynamics",
  "aws_deprecated",
  "aws_status",
  "azure",
  "azure_status",
  "bazel",
  "cisco",
  "cisco_meraki",
  "couchbase",
  "ddn_s2a",
  "fritzbox",
  "gerrit",
  "hivemanager",
  "hivemanager_ng",
  "hp_msa",
  "hpe_3par",
  "ibm_svc",
  "innovaphone",
  "jenkins",
  "jira",
  "mobileiron",
  "mqtt",
  "prometheus",
  "ruckus_spot",
  "salesforce",
  "siemens_plc",
  "smb",
  "storeonce",
  "storeonce4x",
  "tinkerforge",
  "zerto",
]
# Not yet clean:
# azure_v2 — Edition, HostAddress
# datadog — bypasses APIs to talk to the EC
# jolokia — import hack, resolve by migrating the bakery plugin
# otel
# vnx_quotas — TODO: make the authorized keys configurable?

# Plugin families that refuse to play by the rules.

[plugin_families.violations.aws_v2]
allows = [
  # optional import of the Ultimate-only services for the special agent rule
  "cmk.plugins.aws_v2_extended",
]

[plugin_families.violations.aws_v2_extended]
allows = [
  # reuse of the free aws_v2 plugin library (agent_based helpers)
  "cmk.plugins.aws_v2",
]

[plugin_families.violations.azure_v2_extended]
allows = [
  # reuse of the free azure_v2 plugin library (agent_based + rulesets helpers)
  "cmk.plugins.azure_v2",
  # StringAutocompleter for the otel_azure_metrics ruleset's metric-name field
  "cmk.gui.form_specs.unstable",
]


[plugin_families.violations.bakery]
# The "cmk" commands of the bakery (cli) drive the bakery backend and need the
# base configuration and the agent paths. The automations also return their
# result types and run against the engine's common state.
allows = [
  "@ccc",
  "cmk.automations.results",
  "cmk.bakery",
  "cmk.base.automations.states",
  "cmk.base.config",
  "cmk.discover_plugins",
  "cmk.utils.log.console",
  "cmk.utils.password_store",
  "cmk.utils.paths",
  "cmk.utils.render",
]


[plugin_families.violations.crash]
allows = ["cmk.crash"]

# The "cmk --notify" command and the automations drive the notification engine.
# The automations also run against the engine's states and return their result
# types.
[plugin_families.violations.notifications]
allows = [
  "@ccc",
  "@livestatus_client",
  "cmk.automations.backends.helper",
  "cmk.automations.results",
  "cmk.base.automations.states",
  "cmk.base.base_app",
  "cmk.base.config",
  "cmk.base.notify",
  "cmk.utils.http_proxy_config",
  "cmk.utils.log",
  "cmk.utils.paths",
  "cmk.utils.timeperiod",
]

[plugin_families.violations.diagnostics]
# The "cmk" command and the automations drive the dump engine in
# cmk.base.diagnostics; the automations set up the console logging it reports to.
allows = [
  "@livestatus_client",
  "cmk.ccc.debug",
  "cmk.ccc.hostaddress",
  "cmk.ccc.site",
  "cmk.ccc.store",
  "cmk.ccc.version_info",
  "cmk.base.config",
  "cmk.base.diagnostics",
  "cmk.ccc.exceptions",
  "cmk.ccc.i18n",
  "cmk.cli.engine",
  "cmk.diagnostics.automation_types",
  "cmk.diagnostics.engine",
  "cmk.utils.log",
  "cmk.utils.paths",
]

# These plugins are tightly coupled to Checkmk.
# We cannot expect them to not depend on the core product.
[plugin_families.violations.checkmk]
allows = [
  "@livestatus_client",
  "cmk.base",
  "cmk.bi",
  "cmk.ccc",
  "cmk.checkengine",
  "cmk.checkengine.fetchers",
  # The "cmk" commands (cli) drive the whole base: automations, man pages
  # (feature filter), plug-in discovery, profiling and tracing.
  "cmk.automations",
  "cmk.cli.engine",
  "cmk.discover_plugins",
  "cmk.inventory",
  "cmk.licensing.basics.finder",
  "cmk.piggyback",
  "cmk.profiling",
  "cmk.relay_fetcher_trigger",
  "cmk.trace",
  # The automations drive the whole base too: the core, the configuration
  # builder, the licensing handler and ad hoc checks on relays.
  "cmk.check_helper_protocol",
  "cmk.core_client",
  "cmk.licensing.handler",
  "cmk.monitoring_config.internal",
  "cmk.relay_protocols",
  # The agent_controller_connections core bakelet reads the site certificate.
  "cmk.crypto",
  # "cmk --handle-alerts" works on the event types of the alert handling.
  "cmk.events",
  "cmk.gui",
  "cmk.messaging",
  "cmk.ruleset_matcher",
  "cmk.server_side_calls_backend",
  "cmk.utils",
]

# This hosts internal plugins. They can not be subjected to
# any common dependency restrictions.
[plugin_families.violations.agent_controller]
allows = [
  "@ccc",
  "cmk.gui.config",
  "cmk.gui.main_modules",
  "cmk.gui.watolib.automations",
  "cmk.gui.watolib.hosts_and_folders",
  "cmk.gui.watolib.rulesets",
  "cmk.utils.paths",
  "cmk.utils.redis",
  "cmk.ruleset_matcher",
]

[plugin_families.violations.generic_agent_options]
allows = [
  # The Agent Controller rule validates the certificates to embed.
  "cmk.crypto",
]

[plugin_families.violations.dcd]
allows = ["@ccc", "cmk.dcd", "cmk.gui.config"]

[plugin_families.violations.profiling]
allows = ["cmk.profiling.backend"]

[plugin_families.violations.inventory]
allows = ["cmk.ccc.hostaddress", "cmk.inventory"]

[plugin_families.violations.licensing]
allows = [
  # decoding of the rot47-obfuscated licensing usage reports
  "cmk.licensing.usage",
]

[plugin_families.violations.otel_collector]
allows = [
  "@ccc",
  "cmk.gui.config",
  "cmk.gui.site_config",
  "cmk.gui.watolib.audit_log",
  "cmk.gui.watolib.pending_changes",
  "cmk.otel_collector.gui",
]

[plugin_families.violations.custom_service]
allows = [
  # TelemetryMetricsCustomQuery FormSpec
  "cmk.data_backend.telemetry_metrics.gui",
  # the payload of the section the telemetry metrics fetcher writes
  "cmk.telemetry.custom_query_section",
  "cmk.telemetry.host_name_template_validation",
  "cmk.utils.macros",
]

[plugin_families.violations.datadog]
allows = [
  "cmk.ccc.store",
  # edition detection
  "cmk.ccc.version",
  "cmk.ec.syslog",
  "cmk.gui.mkeventd",
  "cmk.utils.http_proxy_config",
  # edition detection
  "cmk.utils.paths",
]

[plugin_families.violations.emailchecks]
allows = [
  # edition detection
  "cmk.ccc.version",
  "cmk.ec.syslog",
  # edition detection
  "cmk.utils.paths",
  # FIXME
  "cmk.utils.render",
]

[plugin_families.violations.gcp]
allows = ["cmk.plugins.gcp_extended"]

[plugin_families.violations.jolokia]
allows = ["cmk.utils.paths"]

[plugin_families.violations.logwatch]
allows = [
  "cmk.ccc.hostaddress",
  "cmk.ec.event",
  "cmk.ec.forwarder",
  "cmk.ec.syslog",
  "cmk.logwatch",
]

[plugin_families.violations.telemetry_metrics_connector]
allows = [
  "cmk.ccc",
  "cmk.dcd.daemon",
  "cmk.dcd.gui",
  "cmk.gui",
  "cmk.data_backend",
  "cmk.telemetry.gui",
  "cmk.telemetry.host_name_template",
  "cmk.telemetry.host_name_template_validation",
  "cmk.shared_typing.vue_formspec_components",
  "cmk.utils",
]

[plugin_families.violations.data_backend_telemetry_metrics_omd]
allows = ["cmk.data_backend"]

[plugin_families.violations.otel]
allows = [
  "cmk.discover_plugins",
  "cmk.gui.form_specs.unstable",
  "cmk.otel_collector",
  "cmk.shared_typing.vue_formspec_components",
  "cmk.utils.paths",
]

[plugin_families.violations.piggyback]
allows = [
  "cmk.ccc",
  "cmk.dcd.daemon",
  "cmk.dcd.gui",
  "cmk.gui",
  "cmk.piggyback",
  "cmk.rulesets",
  "cmk.utils",
]

[plugin_families.violations.robotmk]
allows = ["cmk.robotmk"]

[plugin_families.violations.sftp]
allows = ["cmk.utils.paths"]

[plugin_families.violations.vnx_quotas]
allows = ["cmk.utils.paths"]


[components."cmk.agent_based"]
allows = []

[components."cmk.ai_control_plane"]
allows = [
  "@ccc",
  "cmk.ai_control_plane.protocols",
  "cmk.fastapi",
  "cmk.password_store.v1",
  "cmk.schema_manager",
  "cmk.schema_migrations.ai_control_plane",
]

[components."cmk.ai_control_plane.protocols"]
allows = []

[components."cmk.ai_control_plane.conversation"]
allows = [
  "cmk.ai_control_plane.lib.paths",
  "cmk.ai_control_plane.protocols",
  "cmk.password_store.v1",
]

[components."cmk.agent_receiver"]
allows = ["@ccc", "@crypto", "@relay_protocols", "cmk.licensing.basics.options"]

[components."cmk.automations"]
allows = [
  "@ccc",
  "@plugin_apis",
  "@trace",
  "cmk.checkengine",
  "cmk.checkengine.helper_interface",
  "cmk.discover_plugins",
  "cmk.diagnostics.automation_types",
  "cmk.utils.check_utils",
  "cmk.utils.config_warnings",
  "cmk.utils.http_proxy_config",
  "cmk.utils.ip_lookup",
  "cmk.ruleset_matcher",
  "cmk.utils.log",
  "cmk.events",
  "cmk.utils.oauth2_connection",
  "cmk.utils.paths",
  "cmk.utils.servicename",
  "cmk.utils.unixsocket_http",
]

[components."cmk.astrein"]
allows = []

[components."cmk.bakery.base"]
allows = [
  "@ccc",
  "cmk.bakery",
  "cmk.bakery.base.cap",
  "cmk.bakery.shared",
  "cmk.base.api.bakery",
  "cmk.base.nonfree.plugins.bakery.bakery_api",
  "cmk.base.plugins.bakery.bakery_api",
  "cmk.crypto.certificate",
  "cmk.discover_plugins",
  "cmk.robotmk.bakery",
  "cmk.utils",
  "cmk.ruleset_matcher",
]

[components."cmk.bakery.internal"]
allows = ["cmk.bakery.v1", "cmk.bakery.v2"]

[components."cmk.bakery.shared"]
allows = ["@ccc", "@crypto", "@plugin_apis"]

[components."cmk.bakery.v1"]
allows = []

[components."cmk.bakery.v2"]
allows = ["cmk.bakery.v1"]

# deprecated alias for cmk.bakery.v2, removed in 3.1
[components."cmk.bakery.v2_unstable"]
allows = ["cmk.bakery.v2"]

# only allow itself, this is the future :-)
[components."cmk.bakery"]
allows = []

[components."cmk.backup"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@crypto",
  "cmk.gui.breadcrumb",
  "cmk.gui.config",
  "cmk.gui.exceptions",
  "cmk.gui.form_specs",
  "cmk.gui.forms",
  "cmk.gui.header",
  "cmk.gui.htmllib",
  "cmk.gui.http",
  "cmk.gui.i18n",
  "cmk.gui.key_mgmt",
  "cmk.gui.logged_in",
  "cmk.gui.main_menu",
  "cmk.gui.page_menu",
  "cmk.gui.pages",
  "cmk.gui.table",
  "cmk.gui.type_defs",
  "cmk.gui.utils",
  "cmk.gui.valuespec",
  "cmk.gui.wato",
  "cmk.gui.watolib",
  "cmk.rulesets.internal",
  "cmk.rulesets.v1",
  "cmk.utils",
]

[components."cmk.base.api.bakery"]
allows = ["@ccc", "cmk.bakery", "cmk.utils"]


[components."cmk.base.nonfree.cmc"]
allows = [
  "@ccc",
  "@plugin_apis",
  "@relay_protocols",
  "cmk.monitoring_config",
  "cmk.base.config",
  "cmk.base.configlib",
  "cmk.base.core",
  "cmk.base.nonfree",
  "cmk.checkengine",
  "cmk.core_client",
  "cmk.fetcher_encoder",
  "cmk.fetcher_helper",
  "cmk.checkengine.fetchers",
  "cmk.checkengine.helper_interface",
  "cmk.inventory",
  "cmk.licensing",
  "cmk.robotmk",
  "cmk.rrd",
  "cmk.checkengine.snmplib",
  "cmk.utils",
  "cmk.events",
  "cmk.ruleset_matcher",
]

[components."cmk.base.nonfree.ultimate.relay"]
allows = [
  "@ccc",
  "@relay_protocols",
  "cmk.base.active_check_result",
  "cmk.check_helper_protocol",
  "cmk.checkengine.specs",
  "cmk.checkengine.submitters",
  "cmk.base.config",
  "cmk.base.configlib",
  "cmk.base.core",
  "cmk.base.nonfree",
  "cmk.checkengine.plugins",
  "cmk.fetcher_encoder",
  "cmk.fetcher_helper",
  "cmk.checkengine.fetcher",
  "cmk.checkengine.fetcher_utils",
  "cmk.checkengine.fetchers",
  "cmk.checkengine.helper_interface",
  "cmk.inventory",
  "cmk.relay_fetcher_trigger",
  "cmk.rrd",
  "cmk.checkengine.snmplib",
  "cmk.utils",
  "cmk.ruleset_matcher",
]

[components."cmk.base.nonfree"]
allows = [
  "@ccc",
  "@livestatus_client",
  "@plugin_apis",
  "cmk.bakery.base",
  "cmk.base",
  "cmk.cli.engine",
  "cmk.check_helper_protocol",
  "cmk.checkengine",
  "cmk.events",
  "cmk.fetcher_encoder",
  "cmk.fetcher_helper",
  "cmk.checkengine.fetchers",
  "cmk.checkengine.helper_interface",
  "cmk.licensing.basics.options",
  "cmk.licensing.nonfree",
  "cmk.multi_tenancy.shared",
  "cmk.server_side_calls_backend",
  "cmk.checkengine.snmplib",
  "cmk.telemetry",
  "cmk.utils",
  "cmk.ruleset_matcher",
]

[components."cmk.base.config"]
allows = [
  "@ccc",
  "@plugin_apis",
  "@trace",
  "cmk.automations",
  "cmk.base.configlib",
  "cmk.base.parent_scan",
  "cmk.config",
  "cmk.base.snmp_plugin_store",
  "cmk.checkengine.sources",
  "cmk.checkengine",
  "cmk.discover_plugins",
  "cmk.ec",
  "cmk.events",
  "cmk.fetcher_helper",
  "cmk.checkengine.fetchers",
  "cmk.checkengine.helper_interface",
  "cmk.inventory",
  "cmk.piggyback",
  "cmk.rrd",
  "cmk.server_side_calls_backend",
  "cmk.checkengine.snmplib",
  "cmk.utils",
  "cmk.ruleset_matcher",
]

[components."cmk.base.plugins.bakery.bakery_api"]
allows = ["cmk.bakery", "cmk.base.api.bakery", "cmk.utils"]

[components."cmk.base"]
allows = [
  "cmk.cli.engine",
  "cmk.diagnostics.automation_types",
  "cmk.diagnostics.engine",
  "cmk.monitoring_config",
  "@ccc",
  "@livestatus_client",
  "@plugin_apis",
  "@relay_protocols",
  "@trace",
  "cmk.automations",
  "cmk.agent_based.prediction_backend",
  "cmk.check_helper_protocol",
  "cmk.checkengine",
  "cmk.core_client",
  "cmk.crash",
  "cmk.discover_plugins",
  "cmk.ec",
  "cmk.events",
  "cmk.fetcher_helper",
  "cmk.checkengine.fetchers",
  "cmk.checkengine.helper_interface",
  "cmk.inventory",
  "cmk.licensing",
  "cmk.logwatch",
  "cmk.piggyback",
  "cmk.product_usage",
  "cmk.profiling.backend",
  "cmk.relay_fetcher_trigger",
  "cmk.rrd",
  "cmk.server_side_calls_backend",
  "cmk.checkengine.snmplib",
  "cmk.utils",
  "cmk.ruleset_matcher",
]

[components."cmk.bi"]
allows = [
  "@ccc",
  "@livestatus_client",
  "cmk.fields",
  "cmk.ruleset_matcher",
  "cmk.utils",
]

[components."cmk.ccc"]
allows = ["@trace"]

[components."cmk.config"]
allows = []

[components."cmk.config_anonymizer"]
allows = [
  "@ccc",
  "@livestatus_client",
  "cmk.base.app",
  "cmk.base.config",
  "cmk.base.configlib.servicename",
  "cmk.checkengine",
  "cmk.config_anonymizer",
  "cmk.gui.config",
  "cmk.gui.form_specs",
  "cmk.gui.groups",
  "cmk.gui.log",
  "cmk.gui.main_modules",
  "cmk.gui.session",
  "cmk.gui.session_context",
  "cmk.gui.site_config",
  "cmk.gui.utils.host_relations",
  "cmk.gui.watolib.attributes",
  "cmk.gui.watolib.config_sync",
  "cmk.gui.watolib.groups_io",
  "cmk.gui.watolib.host_attributes",
  "cmk.gui.watolib.hosts_and_folders",
  "cmk.gui.watolib.rulesets",
  "cmk.gui.watolib.sites",
  "cmk.gui.watolib.tags",
  "cmk.gui.watolib.utils",
  "cmk.gui.wsgi.app",
  "cmk.ruleset_matcher",
  "cmk.utils.global_ident_type",
  "cmk.utils.host_storage",
  "cmk.utils.paths",
  "cmk.utils.redis.disable_redis",
]

[components."cmk.check_helper_protocol"]
allows = [
  "@ccc",
  "cmk.checkengine.fetcher_abc",
  "cmk.checkengine.fetchers",
  "cmk.checkengine.helper_interface",
  "cmk.checkengine.snmplib",
]

[components."cmk.checkengine.value_store"]
allows = ["@ccc", "cmk.utils"]

[components."cmk.checkengine"]
allows = [
  "@ccc",
  "@plugin_apis",
  "@trace",
  "cmk.crash",
  "cmk.discover_plugins",
  "cmk.checkengine.helper_interface",
  "cmk.inventory",
  "cmk.piggyback.backend",
  "cmk.checkengine.snmplib",
  "cmk.utils.auto_queue",
  "cmk.utils.check_utils",
  "cmk.utils.encoding",
  "cmk.utils.everythingtype",
  "cmk.ruleset_matcher",
  "cmk.utils.log",
  "cmk.utils.paths",
  "cmk.utils.servicename",
  "cmk.utils.timeperiod",
]

[components."cmk.checkengine.source_builder"]
allows = [
  "@ccc",
  "cmk.server_side_calls_backend",
  "cmk.checkengine",
  "cmk.ruleset_matcher",
  "cmk.utils.ip_lookup",
]

[components."cmk.checkengine.sources"]
allows = ["@ccc", "cmk.checkengine"]
# cmk-telemetry's guest subtree, see below.
excludes = ["cmk.checkengine.sources.telemetry_metrics"]

# Lives in non-free/packages/cmk-telemetry, see
# cmk.checkengine.fetchers.telemetry_metrics.
[components."cmk.checkengine.sources.telemetry_metrics"]
allows = [
  "@ccc",
  "cmk.checkengine.fetchers.telemetry_metrics",
  "cmk.checkengine.filecache",
  "cmk.checkengine.helper_interface",
  "cmk.checkengine.source_abc",
  # the metrics section specs are compiled here, during config generation, where the
  # plugins are loaded anyway; the fetcher must never discover them itself (CMK-38919)
  "cmk.telemetry.fetcher._python_plugins",
]

[components."cmk.core_client"]
allows = ["@ccc", "@trace"]

[components."cmk.crash"]
allows = ["@ccc"]

[components."cmk.crash_reporting"]
allows = [
  "cmk.ccc.log",
  "cmk.ccc.site",
  "cmk.ccc.store",
  "cmk.ccc.version",
  "cmk.crash",
]

[components."cmk.crypto"]
allows = ["@ccc"]

[components."cmk.dev_deploy"]
allows = []

[components."cmk.diskspace"]
allows = ["@ccc", "cmk.utils.paths"]

[components."cmk.events"]
allows = ["@ccc", "@livestatus_client", "cmk.ruleset_matcher"]

[components."cmk.fastapi"]
allows = []

[components."cmk.fetcher_encoder"]
allows = ["cmk.checkengine.helper_interface"]

[components."cmk.fetcher_helper"]
allows = [
  "@ccc",
  "@relay_protocols",
  "cmk.check_helper",
  "cmk.checkengine.agent_protocol",
  "cmk.check_helper_protocol",
  "cmk.crash",
  "cmk.checkengine.fetcher_abc",
  "cmk.checkengine.fetcher_utils",
  "cmk.checkengine.fetchers",
  "cmk.checkengine.filecache",
  "cmk.checkengine.helper_interface",
  "cmk.checkengine.subclass_discovery",
  "cmk.relay_fetcher_trigger",
  "cmk.relay_trigger_protocol",
  "cmk.checkengine.snmplib",
  "cmk.utils.caching",
  "cmk.utils.paths",
]

[components."cmk.flags"]
allows = []

[components."cmk.gui.cmkcert"]
allows = [
  "@ccc",
  "@crypto",
  "@livestatus_client",
  "@messaging",
  "cmk.gui",
  "cmk.licensing",
  "cmk.utils",
]

[components."cmk.maps"]
allows = []

[components."cmk.maps.backend"]
allows = [
  "@ccc",
  "@livestatus_client",
  "@trace",
  "cmk.bi",
  "cmk.crash",
  "cmk.fastapi",
  "cmk.maps.shared",
  "cmk.utils",
]

# Pure shared domain layer (state/severity maps, row extractors, geo resolver,
# filter allow-list, perf parser, URL/colour/asset validators, map vocabulary,
# ticket protocol, config-var names). A top-level sibling of
# backend/gui/rest_api so none of them reach into another's package; it depends
# on nothing but stdlib (mirrors cmk.dcd.protocols / cmk.liveproxyd.shared).
[components."cmk.maps.shared"]
allows = ["@ccc", "cmk.utils"]

# GUI integration for Maps. Lives in the cmk-maps package but imports cmk.gui
# internals (there is no clean cmk.gui public API).
[components."cmk.maps.gui"]
allows = [
  "@ccc",
  "@livestatus_client",
  "@plugin_apis",
  "cmk.bi",
  "cmk.graphing_engine",
  "cmk.gui",
  "cmk.maps.shared",
  "cmk.shared_typing",
  "cmk.utils",
  "cmk.web.utils",
]

# REST API endpoints for Maps. Import cmk.gui (openapi framework) plus the
# feature's own gui/shared layers.
[components."cmk.maps.rest_api"]
allows = ["@ccc", "cmk.gui", "cmk.maps.shared", "cmk.maps.gui", "cmk.web.utils"]

# The feature's composition root: the GuiFeaturePlugin cmk.gui.main_modules
# discovers, so that cmk.gui does not have to import the feature. The only place
# that sees both halves of Maps, so that neither the GUI integration nor the
# REST endpoints have to import the other.
[components."cmk.maps.registration"]
allows = [
  "@ccc",
  "cmk.gui_plugins.internal",
  "cmk.maps.gui",
  "cmk.maps.rest_api",
]

[components."cmk.mcp"]
allows = ["@ccc", "@trace", "@crash"]

[components."cmk.mcp.gui"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "cmk.gui",
  "cmk.gui_plugins.internal",
  "cmk.rulesets",
  "cmk.utils",
]

[components."cmk.messaging"]
allows = ["@ccc"]

[components."cmk.message_broker_certs"]
allows = ["@ccc", "@messaging", "cmk.utils"]

[components."cmk.data_backend"]
allows = [
  "@ccc",
  "@plugin_apis",
  "cmk.discover_plugins",
  # schema_manager gates per-feature provisioning on the feature's license option
  "cmk.licensing.basics.options",
]

[components."cmk.data_backend.telemetry_metrics"]
allows = [
  "@ccc",
  "@data_backend",
  "@plugin_apis",
  "cmk.discover_plugins",
  # telemetry_metrics.license_usage provides a license usage counter plug-in
  "cmk.licensing.usage_counters",
]

[components."cmk.data_backend.telemetry_metrics.adapters"]
allows = [
  "@data_backend",
  "cmk.shared_typing.aggregation",
  "cmk.shared_typing.attribute_filter",
  "cmk.shared_typing.consolidation",
]

[components."cmk.telemetry"]
allows = [
  "@ccc",
  "@plugin_apis",
  "cmk.base.config",
  "cmk.discover_plugins",
  "cmk.checkengine.fetchers",
  "cmk.data_backend",
  "cmk.shared_typing.consolidation",
  "cmk.utils.paths",
]

[components."cmk.mkp"]
allows = [
  "@ccc",
  "@mkp_tool",
  "cmk.discover_plugins",
  "cmk.ec",
  "cmk.gui.search.index",
  "cmk.utils",
]

[components."cmk.mkp_tool"]
allows = []

[components."cmk.cmkpasswd"]
allows = ["@ccc", "@crypto", "cmk.gui", "cmk.utils"]

[components."cmk.ec"]
allows = [
  "@ccc",
  "@livestatus_client",
  "@mkp_tool",
  "cmk.crash",
  "cmk.events",
  "cmk.utils",
]

[components."cmk.checkengine.agent_protocol"]
allows = [
  "@crypto",
  "cmk.checkengine.fetcher_abc",
  "cmk.checkengine.helper_interface",
]

[components."cmk.checkengine.fetchers"]
allows = [
  "@ccc",
  "@crypto",
  "@plugin_apis",
  "@relay_protocols",
  "cmk.checkengine.agent_protocol",
  "cmk.checkengine.fetcher_abc",
  "cmk.checkengine.filecache",
  "cmk.checkengine.helper_interface",
  "cmk.checkengine.snmp_backend_builder",
  "cmk.checkengine.snmp_backends",
  "cmk.checkengine.snmplib",
]
# cmk-telemetry's guest subtree, see below. Excluded so that cmk-check-engine's
# own fetchers cannot reach into it.
excludes = ["cmk.checkengine.fetchers.telemetry_metrics"]

# Lives in non-free/packages/cmk-telemetry, not in cmk-check-engine: the fetcher
# runs in the fetcher process, so it is shaped like a fetcher, but everything it
# renders belongs to the telemetry layer.
[components."cmk.checkengine.fetchers.telemetry_metrics"]
allows = [
  "cmk.agent_based.v3_unstable",
  "cmk.checkengine.fetcher_abc",
  "cmk.checkengine.helper_interface",
  "cmk.telemetry.custom_query_rule_value",
  # imported lazily in _fetch_from_io, so that discovering the fetcher does not
  # pull in the Clickhouse-heavy section rendering
  "cmk.telemetry.fetcher.telemetry_metrics_sections",
]

[components."cmk.fields"]
allows = ["@ccc"]

[components."cmk.graphing"]
allows = []

[components."cmk.graphing_engine"]
allows = ["cmk.graphing.v1", "cmk.graphing.v2_unstable"]

[components."cmk.gui.main_modules"]
allows = [
  "@ccc",
  "cmk.discover_plugins",
  "cmk.gui",
  "cmk.gui_plugins.internal",
  "cmk.licensing.basics.options",
  "cmk.utils.paths",
]

[components."cmk.gui_plugins.internal"]
allows = [
  "@ccc",
  "cmk.gui.autocompleters",
  "cmk.gui.dashboard",
  "cmk.gui.graphing",
  "cmk.gui.main_menu_pages",
  "cmk.gui.openapi",
  "cmk.gui.pages",
  "cmk.gui.pagetypes",
  "cmk.gui.permissions",
  "cmk.gui.sidebar",
  "cmk.gui.visuals.filter",
  "cmk.gui.watolib",
  "cmk.licensing.basics.options",
]

[components."cmk.gui.openapi.spec.spec_generator"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "cmk.gui",
  "cmk.gui.community_registration",
  "cmk.gui.nonfree",
  "cmk.licensing.basics.options",
  "cmk.utils.jsontype",
  "cmk.utils.paths",
]

[components."cmk.gui.openapi.spec.editions"]
allows = [
  "@ccc",
  "cmk.dcd.gui",
  "cmk.gui",
  "cmk.gui.nonfree",
  "cmk.data_backend.gui",
  "cmk.data_backend.telemetry_metrics.gui",
  "cmk.maps.gui",
  "cmk.maps.rest_api",
  "cmk.otel_collector",
  "cmk.telemetry.gui",
]

# The RFC 6749 authorization-server endpoints, WATO client management, and
# the internal REST API endpoints that turn a GUI session into a user or a
# delegated access token. Deliberately narrower than a blanket "cmk.gui"
# self-allowance. cmk.gui.auth depends on cmk.gui.oauth.token only (the
# token_verification Bazel target) to verify OAuth bearer tokens, so the rest
# of this component may import cmk.gui.auth, but cmk.gui.oauth.token must never
# import anything that reaches back to cmk.gui.auth.
[components."cmk.gui.oauth"]
allows = [
  "@ccc",
  "cmk.gui.auth",
  "cmk.gui.breadcrumb",
  "cmk.gui.config",
  "cmk.gui.exceptions",
  "cmk.gui.header",
  "cmk.gui.htmllib",
  "cmk.gui.http",
  "cmk.gui.i18n",
  "cmk.gui.log",
  "cmk.gui.logged_in",
  "cmk.gui.main_menu",
  "cmk.gui.openapi",
  "cmk.gui.page_menu",
  "cmk.gui.pages",
  "cmk.gui.permissions",
  "cmk.gui.scopes",
  "cmk.gui.session_context",
  "cmk.gui.table",
  "cmk.gui.theme",
  "cmk.gui.type_defs",
  "cmk.gui.userdb",
  "cmk.gui.utils",
  "cmk.gui.verify_requirements",
  "cmk.gui.wato",
  "cmk.gui.watolib",
  "cmk.schema_manager",
  "cmk.utils.paths",
  "cmk.utils.redis",
  "cmk.utils.render",
  "cmk.utils.security_event",
  "cmk.web.utils",
]

# allow everything, don't get in the way of migrations.
[components."cmk.gui.plugins.legacy_bakery_rulesets"]
allows = ["cmk"]

[components."cmk.gui.plugins"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@livestatus_client",
  "@plugin_apis",
  "cmk.bi",
  "cmk.checkengine",
  "cmk.gui",
  "cmk.inventory",
  "cmk.utils.dateutils",
  "cmk.utils.mrpe_config",
  "cmk.utils.paths",
  "cmk.utils.render",
  "cmk.ruleset_matcher",
]

[components."cmk.gui.nonfree.pro.plugins"]
allows = [
  "@ccc",
  "@plugin_apis",
  "cmk.dcd.gui",
  "cmk.gui",
  "cmk.utils.mrpe_config",
  "cmk.utils.nonfree.pro",
  "cmk.utils.paths",
  "cmk.utils.render",
  "cmk.ruleset_matcher",
]

[components."cmk.gui.nonfree.ultimate.plugins"]
allows = ["@plugin_apis", "cmk.gui"]

[components."cmk.gui.nonfree.pro"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@crypto",
  "@flags",
  "@livestatus_client",
  "@mkp_tool",
  "@plugin_apis",
  "cmk.ai_control_plane.protocols",
  "cmk.backup",
  "cmk.bakery.shared",
  "cmk.data_backend.gui",
  "cmk.dcd.gui",
  "cmk.discover_plugins",
  "cmk.fields",
  "cmk.graphing_engine",
  "cmk.gui",
  "cmk.gui_plugins.internal",
  "cmk.inventory",
  "cmk.licensing",
  "cmk.liveproxyd.gui",
  "cmk.product_usage",
  "cmk.robotmk.gui",
  "cmk.shared_typing",
  "cmk.utils.automation_config",
  "cmk.utils.caching",
  "cmk.utils.certs",
  "cmk.utils.config_warnings",
  "cmk.utils.dateutils",
  "cmk.utils.global_ident_type",
  "cmk.utils.http_proxy_config",
  "cmk.utils.jsontype",
  "cmk.utils.keypair_store",
  "cmk.utils.local_secrets",
  "cmk.utils.log",
  "cmk.utils.macros",
  "cmk.utils.mail",
  "cmk.utils.misc",
  "cmk.utils.nonfree.pro",
  "cmk.utils.password_store",
  "cmk.utils.paths",
  "cmk.utils.redis",
  "cmk.utils.render",
  "cmk.ruleset_matcher",
  "cmk.utils.schedule",
  "cmk.utils.security_event",
  "cmk.utils.servicename",
  "cmk.utils.statename",
  "cmk.utils.timeperiod",
  "cmk.utils.typing_helpers",
  "cmk.utils.visuals",
]
excludes = ["cmk.gui.nonfree.pro.plugins", "cmk.gui.plugins"]

[components."cmk.gui.nonfree.ultimate"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@crypto",
  "@livestatus_client",
  "@data_backend",
  "@plugin_apis",
  "@relay_protocols",
  "cmk.backup",
  "cmk.checkengine",
  "cmk.dcd.gui",
  "cmk.dcd.protocols",
  "cmk.fields",
  "cmk.graphing_engine",
  "cmk.gui",
  "cmk.gui_plugins.internal",
  "cmk.licensing",
  "cmk.liveproxyd.gui",
  "cmk.data_backend.telemetry_metrics.adapters",
  "cmk.data_backend.gui",
  "cmk.data_backend.telemetry_metrics.gui",
  "cmk.telemetry.gui",
  "cmk.telemetry.host_name_template_validation",
  "cmk.otel_collector",
  "cmk.robotmk.gui",
  "cmk.shared_typing",
  "cmk.utils.agent_registration",
  "cmk.utils.automation_config",
  "cmk.utils.certs",
  "cmk.utils.config_warnings",
  "cmk.utils.global_ident_type",
  "cmk.ruleset_matcher",
  "cmk.utils.macros",
  "cmk.utils.nonfree.pro",
  "cmk.utils.password_store",
  "cmk.utils.paths",
  "cmk.utils.render",
  "cmk.utils.servicename",
]
excludes = ["cmk.gui.nonfree.pro.plugins", "cmk.gui.plugins"]

[components."cmk.gui.nonfree.ultimatemt"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@livestatus_client",
  "@plugin_apis",
  "@crypto",
  "@messaging",
  "cmk.backup",
  "cmk.bi",
  "cmk.dcd.gui",
  "cmk.ec.export",
  "cmk.gui",
  "cmk.gui_plugins.internal",
  "cmk.inventory",
  "cmk.licensing",
  "cmk.liveproxyd.gui",
  "cmk.livestatus_client",
  "cmk.multi_tenancy.shared",
  "cmk.data_backend.gui",
  "cmk.data_backend.telemetry_metrics.gui",
  "cmk.otel_collector.gui",
  "cmk.telemetry.gui",
  "cmk.piggyback",
  "cmk.robotmk.gui",
  "cmk.ruleset_matcher",
  "cmk.utils.automation_config",
  "cmk.utils.certs",
  "cmk.utils.nonfree.pro",
  "cmk.utils.password_store",
  "cmk.utils.paths",
  "cmk.utils.redis",
]
excludes = ["cmk.gui.nonfree.pro.plugins", "cmk.gui.plugins"]

[components."cmk.gui.nonfree.cloud"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@crypto",
  "@plugin_apis",
  "@trace",
  "cmk.cloud",
  "cmk.dcd.gui",
  "cmk.fields",
  "cmk.gui",
  "cmk.gui_plugins.internal",
  "cmk.licensing",
  "cmk.liveproxyd.gui",
  "cmk.data_backend.telemetry_metrics.gui",
  "cmk.otel_collector.gui",
  "cmk.telemetry.gui",
  "cmk.shared_typing",
  "cmk.utils.agent_registration",
  "cmk.utils.config_warnings",
  "cmk.utils.global_ident_type",
  "cmk.utils.local_secrets",
  "cmk.utils.log",
  "cmk.utils.nonfree.pro",
  "cmk.utils.paths",
  "cmk.utils.redis",
  "cmk.utils.security_event",
]
excludes = ["cmk.gui.nonfree.pro.plugins", "cmk.gui.plugins"]

[components."cmk.gui"]
allows = [
  "cmk.diagnostics.automation_types",
  "cmk.diagnostics.engine",
  "@ccc",
  "@crypto",
  "@flags",
  "@livestatus_client",
  "@messaging",
  "@mkp_tool",
  "@plugin_apis",
  "@trace",
  "@werks",
  "cmk.agent_based.prediction_backend",
  "cmk.automations",
  "cmk.bi",
  "cmk.checkengine",
  "cmk.crash",
  "cmk.crash_reporting",
  "cmk.discover_plugins",
  "cmk.diskspace",
  "cmk.events.notification_result",
  "cmk.fields",
  "cmk.graphing_engine",
  "cmk.gui_plugins.internal",
  "cmk.inventory",
  "cmk.inventory_ui",
  "cmk.licensing",
  "cmk.piggyback",
  "cmk.product_usage",
  "cmk.profiling.backend",
  "cmk.profiling.gui",
  "cmk.server_side_calls_backend",
  "cmk.shared_typing",
  "cmk.backup",
  "cmk.utils.agent_registration",
  "cmk.utils.auto_queue",
  "cmk.utils.automation_config",
  "cmk.utils.certs",
  "cmk.utils.check_utils",
  "cmk.utils.config_warnings",
  "cmk.utils.dateutils",
  "cmk.utils.encoding",
  "cmk.utils.encryption",
  "cmk.utils.everythingtype",
  "cmk.utils.global_ident_type",
  "cmk.utils.host_storage",
  "cmk.utils.html",
  "cmk.utils.http_proxy_config",
  "cmk.utils.ip_lookup",
  "cmk.utils.jsontype",
  "cmk.utils.keypair_store",
  "cmk.ruleset_matcher",
  "cmk.utils.local_secrets",
  "cmk.utils.log",
  "cmk.utils.macros",
  "cmk.utils.mail",
  "cmk.utils.man_pages",
  "cmk.utils.misc",
  "cmk.utils.ms_teams_constants",
  "cmk.events",
  "cmk.utils.oauth2_connection",
  "cmk.utils.object_diff",
  "cmk.utils.password_store",
  "cmk.utils.paths",
  "cmk.utils.plugin_loader",
  "cmk.utils.prediction",
  "cmk.utils.redis",
  "cmk.utils.render",
  "cmk.utils.schedule",
  "cmk.utils.security_event",
  "cmk.utils.servicename",
  "cmk.utils.statename",
  "cmk.utils.timeperiod",
  "cmk.utils.translations",
  "cmk.utils.unixsocket_http",
  "cmk.utils.visuals",
  "cmk.web.htmllib",
  "cmk.web.context",
  "cmk.web.exceptions",
  "cmk.web.page_container",
  "cmk.web.pages",
  "cmk.web.utils",
  "cmk.werks.site",
]
excludes = [
  "cmk.gui.nonfree.pro",
  "cmk.gui.nonfree.pro.plugins",
  "cmk.gui.nonfree.ultimate",
  "cmk.gui.nonfree.ultimatemt",
  "cmk.gui.plugins",
]

# should become a package
[components."cmk.checkengine.helper_interface"]
allows = ["@ccc", "cmk.crash"]

[components."cmk.checkengine.snmp_backends.inline"]
allows = [
  "@ccc",
  "cmk.checkengine.fetcher",
  "cmk.checkengine.snmp_backends",
  "cmk.checkengine.snmplib",
]

[components."cmk.inventory"]
allows = ["@ccc"]

[components."cmk.dcd_connector_parameters"]
allows = ["cmk.rulesets"]

[components."cmk.dcd_connectors"]
allows = []

[components."cmk.inventory_ui"]
allows = []

[components."cmk.logwatch"]
allows = ["@plugin_apis"]

[components."cmk.notification_plugins"]
allows = ["@ccc", "cmk.events", "cmk.utils", "cmk.web.utils.escaping"]

[components."cmk.piggyback.hub.cli"]
allows = ["@ccc", "cmk.crash", "cmk.piggyback", "cmk.utils"]

[components."cmk.piggyback.cli"]
allows = ["@livestatus_client", "cmk.piggyback", "cmk.utils"]

[components."cmk.piggyback"]
allows = ["@ccc", "@messaging"]

[components."cmk.password_store"]
allows = []

[components."cmk.plugins"]
allows = ["@plugin_apis"]

[components."cmk.plugins.data_backend"]
allows = ["@plugin_apis", "@data_backend"]

[components."cmk.profiling.backend"]
allows = ["cmk.ccc.store", "cmk.shared_typing.profiling_flamegraph"]

[components."cmk.profiling.gui"]
allows = [
  "cmk.web.utils",
  "cmk.gui",
  "cmk.profiling.backend",
  "cmk.shared_typing.profiling_flamegraph",
  "cmk.utils.paths",
]

[components."cmk.product_usage.cli"]
allows = ["@ccc", "cmk.base", "cmk.product_usage", "cmk.utils.paths"]

[components."cmk.product_usage"]
# NOTE: this is a dependency of both 'gui' and 'base',
# so it must not depend on either of them.
allows = [
  "@livestatus_client",
  "cmk.ccc.log",
  "cmk.ccc.store",
  "cmk.ccc.version_info",
  "cmk.utils.http_proxy_config",
]

[components."cmk.ruleset_matcher"]
allows = ["@ccc", "@trace"]

[components."cmk.rulesets"]
allows = []

[components."cmk.schema_manager"]
allows = ["cmk.discover_plugins"]

[components."cmk.schema_migrations"]
allows = ["cmk.schema_manager"]

[components."cmk.server_side_calls"]
allows = []

[components."cmk.server_side_calls_backend"]
allows = ["@ccc", "@plugin_apis", "cmk.discover_plugins", "cmk.utils"]

[components."cmk.server_side_programs"]
allows = []

[components."cmk.special_agents"]
allows = [
  "@ccc",
  "@plugin_apis",
  "cmk.crash",
  "cmk.utils.password_store",
  "cmk.utils.paths",
]

[components."cmk.diagnostics.automation_types"]
allows = ["@plugin_apis"]

[components."cmk.diagnostics.engine"]
allows = ["@plugin_apis", "cmk.discover_plugins"]

[components."cmk.cli.engine"]
# The engine assembles and runs the "cmk" command line. It hands each command the
# site root and nothing else, so it needs nothing from cmk.base.
allows = [
  "@ccc",
  "@plugin_apis",
  "@trace",
  "cmk.crash",
  "cmk.discover_plugins",
  "cmk.profiling.backend",
  "cmk.utils",
]

[components."cmk.automations.internal"]
allows = []

[components."cmk.cli.internal"]
allows = []

[components."cmk.diagnostics.internal"]
allows = []

[components."cmk.licensing.internal"]
allows = []

[components."cmk.monitoring_config.internal"]
allows = [
  "@ccc",
  "@plugin_apis",
  "cmk.base.config",
  "cmk.base.configlib",
  "cmk.checkengine",
  "cmk.checkengine.fetchers",
  "cmk.licensing",
  "cmk.ruleset_matcher",
  "cmk.utils",
]

[components."cmk.checkengine.snmp_backends"]
allows = ["@ccc", "cmk.checkengine.snmplib"]

[components."cmk.checkengine.snmplib"]
allows = ["@ccc", "cmk.agent_based.v1"]

[components."cmk.update_config.nonfree.cloud"]
allows = [
  "@ccc",
  "@messaging",
  "@mkp_tool",
  "@plugin_apis",
  "@trace",
  "@werks",
  "cmk.backup",
  "cmk.base",
  "cmk.checkengine",
  "cmk.crash",
  "cmk.dcd.gui",
  "cmk.dcd.protocols",
  "cmk.discover_plugins",
  "cmk.diskspace.config",
  "cmk.checkengine.fetchers",
  "cmk.gui",
  "cmk.licensing",
  "cmk.message_broker_certs",
  "cmk.data_backend.gui",
  "cmk.data_backend.telemetry_metrics.gui",
  "cmk.otel_collector",
  "cmk.robotmk",
  "cmk.telemetry.host_name_template",
  "cmk.utils",
  "cmk.update_config",
  "cmk.validate_config",
]

[components."cmk.update_config.nonfree.pro"]
allows = [
  "@ccc",
  "@data_backend",
  "cmk.dcd.gui",
  "cmk.graphing_engine",
  "cmk.gui",
  "cmk.licensing",
  "cmk.update_config",
  "cmk.utils",
]

[components."cmk.update_config.nonfree.ultimate"]
allows = [
  "@ccc",
  "@messaging",
  "@data_backend",
  "@mkp_tool",
  "@plugin_apis",
  "@trace",
  "@werks",
  "cmk.base",
  "cmk.checkengine",
  "cmk.dcd.gui",
  "cmk.discover_plugins",
  "cmk.diskspace.config",
  "cmk.checkengine.fetchers",
  "cmk.gui",
  "cmk.message_broker_certs",
  "cmk.data_backend.gui",
  "cmk.data_backend.telemetry_metrics.gui",
  "cmk.otel_collector",
  "cmk.robotmk",
  "cmk.ruleset_matcher",
  "cmk.telemetry.host_name_template",
  "cmk.update_config",
  "cmk.utils",
  "cmk.validate_config",
]

[components."cmk.update_config.plugins.actions.create_customer_host_label"] # lives in cmk-multi-tenancy
allows = [
  "@ccc",
  "cmk.multi_tenancy.shared",
  "cmk.update_config",
  "cmk.ruleset_matcher",
  "cmk.utils.paths",
]

[components."cmk.update_config.plugins.actions.selfbootstrap_customers_mk"] # lives in cmk-multi-tenancy
allows = [
  "@ccc",
  "cmk.multi_tenancy.shared",
  "cmk.update_config",
  "cmk.utils.paths",
]

[components."cmk.update_config.internal"]
allows = []

[components."cmk.update_config"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@livestatus_client",
  "@messaging",
  "@mkp_tool",
  "@plugin_apis",
  "@trace",
  "@werks",
  "cmk.agent_based.prediction_backend",
  "cmk.backup",
  "cmk.base",
  "cmk.checkengine",
  "cmk.config",
  "cmk.checkengine.fetchers",
  "cmk.crash",
  "cmk.dcd.gui",
  "cmk.dcd.protocols",
  "cmk.discover_plugins",
  "cmk.diskspace.config",
  "cmk.gui",
  "cmk.inventory",
  "cmk.licensing",
  "cmk.maps.gui",
  "cmk.maps.rest_api",
  "cmk.maps.shared",
  "cmk.message_broker_certs",
  "cmk.data_backend.gui",
  "cmk.data_backend.telemetry_metrics.gui",
  "cmk.otel_collector",
  "cmk.plugins",
  "cmk.robotmk",
  "cmk.ruleset_matcher",
  "cmk.schema_manager",
  "cmk.utils",
  "cmk.validate_config",
  "cmk.werks.site",
]

[components."cmk.validate_config"]
allows = [
  "@ccc",
  "cmk.base",
  "cmk.checkengine",
  "cmk.gui",
  "cmk.ruleset_matcher",
  "cmk.utils",
]

[components."cmk.validate_plugins"]
allows = [
  "@ccc",
  "@plugin_apis",
  "cmk.discover_plugins",
  "cmk.utils.paths",
  "cmk.ruleset_matcher",
]

[components."cmk.livestatus_client"]
allows = ["@ccc", "@trace"]

[components."cmk.mknotifyd"]
allows = ["@ccc", "cmk.crash", "cmk.events"]

[components."cmk.data_backend.gui"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@livestatus_client",
  "@data_backend",
  "@plugin_apis",
  "cmk.fields",
  "cmk.gui",
  "cmk.gui_plugins.internal",
  "cmk.licensing",
  "cmk.shared_typing",
  "cmk.utils",
]

[components."cmk.data_backend.telemetry_metrics.gui"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@livestatus_client",
  "@data_backend",
  "@plugin_apis",
  "cmk.fields",
  "cmk.gui",
  "cmk.gui_plugins.internal",
  "cmk.licensing",
  "cmk.shared_typing",
  "cmk.utils",
]

[components."cmk.dcd.daemon"]
allows = [
  "@ccc",
  "@plugin_apis",
  "cmk.crash",
  "cmk.dcd.protocols",
  "cmk.discover_plugins",
  "cmk.otel_collector",
  "cmk.piggyback",
  "cmk.utils",
]

[components."cmk.liveproxyd.shared"]
allows = []

[components."cmk.liveproxyd.daemon"]
allows = [
  "@ccc",
  "@livestatus_client",
  "@trace",
  "cmk.crash",
  "cmk.inventory",
  "cmk.liveproxyd.shared",
  "cmk.utils",
]

[components."cmk.liveproxyd.gui"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@livestatus_client",
  "@plugin_apis",
  "cmk.gui",
  "cmk.liveproxyd.shared",
  "cmk.utils",
]

[components."cmk.robotmk"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@livestatus_client",
  "@plugin_apis",
  # I don't think we have any idea of how to fix this.
  "cmk.bakery.base",
  "cmk.bakery.shared",
  "cmk.base.plugins.bakery",
  "cmk.checkengine",
  "cmk.gui",
  "cmk.licensing",
  "cmk.licensing.nonfree",
  "cmk.shared_typing",
  "cmk.utils",
  "cmk.ruleset_matcher",
]

# The query client reads the synthetic monitoring database through the data backend.
[components."cmk.robotmk.telemetry"]
allows = ["cmk.data_backend"]

[components."cmk.otel_collector"]
allows = ["@ccc"]

[components."cmk.otel_collector.gui"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "cmk.cloud",
  "cmk.gui",
  "cmk.livestatus_client",
  "cmk.data_backend",
  "cmk.otel_collector",
  "cmk.rulesets",
  "cmk.utils",
]

[components."cmk.relay"]
allows = [
  "@ccc",
  "@crypto",
  "@relay_protocols",
  "cmk.check_helper_protocol",
  "cmk.crash",
  "cmk.password_store",
  "cmk.relay_trigger_protocol",
]

[components."cmk.relay_protocols"]
allows = []

[components."cmk.relay_fetcher_trigger"]
allows = [
  "@ccc",
  "@relay_protocols",
  "cmk.check_helper_protocol",
  "cmk.fetcher_encoder",
  "cmk.checkengine.fetcher_abc",
  "cmk.checkengine.fetcher_utils",
  "cmk.checkengine.fetchers",
  "cmk.checkengine.helper_interface",
  "cmk.relay_trigger_protocol",
  "cmk.checkengine.snmplib",
]

[components."cmk.reviewmk"]
allows = []

[components."cmk.testlib.ai_control_plane"]
allows = [
  "@ccc",
  "cmk.ai_control_plane",
  "cmk.password_store.v1",
  "cmk.schema_migrations.ai_control_plane",
]

[components."cmk.testlib.ai_control_plane.fake_provider"]
allows = []

[components."cmk.testlib.ai_control_plane.scripted_model"]
allows = []

[components."cmk.testlib.agent_receiver"]
allows = ["@crypto", "@relay_protocols", "cmk.agent_receiver"]

[components."cmk.testlib.mcp"]
allows = ["cmk.mcp"]

[components."cmk.testlib.notification_plugins"]
allows = []

[components."cmk.testlib.data_backend"]
allows = ["@ccc", "@crypto", "cmk.data_backend"]

[components."cmk.testlib.otel_collector"]
allows = ["cmk.otel_collector"]

[components."cmk.testlib.relay"]
allows = [
  "@ccc",
  "@crypto",
  "@relay_protocols",
  "cmk.check_helper_protocol",
  "cmk.crash",
  "cmk.relay",
]

[components."cmk.testlib.schema_manager"]
allows = ["cmk.schema_manager"]

[components."cmk.rrd"]
allows = ["@ccc", "cmk.crash", "cmk.utils"]

[components."cmk.post_rename_site"]
allows = ["@ccc", "@plugin_apis", "cmk.discover_plugins", "cmk.utils"]

[components."cmk.post_rename_site.internal"]
allows = []

[components."cmk.trace"]
allows = []

[components."cmk.utils.agent_registration"]
allows = ["cmk.ccc.hostaddress"]

[components."cmk.utils.auto_queue"]
allows = ["cmk.ccc.hostaddress"]

[components."cmk.utils.automation_config"]
allows = ["cmk.ccc.site"]

[components."cmk.utils.caching"]
allows = []

[components."cmk.utils.caching_redis"]
allows = ["cmk.utils.caching", "cmk.utils.redis"]

[components."cmk.utils.certs"]
allows = [
  "@crypto",
  "cmk.ccc.site",
  "cmk.ccc.user",
  "cmk.utils.log",
  "cmk.utils.security_event",
]

[components."cmk.utils.check_utils"]
allows = []

[components."cmk.utils.config_warnings"]
allows = ["cmk.ccc.tty", "cmk.utils.log"]

[components."cmk.utils.crypto"]
allows = []

[components."cmk.utils.dateutils"]
allows = ["cmk.ccc.i18n"]

[components."cmk.utils.encoding"]
allows = []

[components."cmk.utils.encryption"]
allows = ["@crypto", "cmk.ccc.exceptions"]

[components."cmk.utils.everythingtype"]
allows = []

[components."cmk.utils.global_ident_type"]
allows = []

[components."cmk.utils.host_storage"]
allows = ["cmk.ccc.hostaddress", "cmk.ccc.store", "cmk.ruleset_matcher"]

[components."cmk.utils.html"]
allows = []

[components."cmk.utils.http_proxy_config"]
allows = ["cmk.utils.password_store"]

[components."cmk.utils.ip_lookup"]
allows = [
  "cmk.ccc.debug",
  "cmk.ccc.exceptions",
  "cmk.ccc.hostaddress",
  "cmk.ccc.store",
  "cmk.utils.caching",
  "cmk.utils.log",
  "cmk.utils.paths",
]

[components."cmk.utils.jsontype"]
allows = []

[components."cmk.utils.keypair_store"]
allows = ["@crypto", "cmk.ccc.store", "cmk.ccc.user"]

[components."cmk.licensing.nonfree"]
allows = [
  "@crypto",
  "@flags",
  "@livestatus_client",
  "cmk.ccc.exceptions",
  "cmk.ccc.i18n",
  "cmk.ccc.site",
  "cmk.ccc.store",
  "cmk.ccc.version",
  # ARGL
  "cmk.cloud.config",
  "cmk.licensing",
  "cmk.shared_typing.trial_mode_selection_request",
  "cmk.utils.mail",
  "cmk.utils.password_store",
  "cmk.utils.paths",
]

[components."cmk.licensing"]
allows = [
  "@crypto",
  "@livestatus_client",
  "cmk.ccc.log",
  "cmk.ccc.site",
  "cmk.ccc.store",
  "cmk.ccc.version",
  "cmk.ccc.version_info",
  # discovery of feature-provided license usage counter plug-ins
  "cmk.discover_plugins",
  "cmk.licensing.internal",
  # TYPE_CHECKING only, in license_distribution_registry
  "cmk.utils.automation_config",
]

[components."cmk.utils.local_secrets"]
allows = ["@crypto", "cmk.ccc.store", "cmk.ccc.user", "cmk.utils.paths"]

[components."cmk.utils.log"]
allows = ["cmk.ccc.log", "cmk.ccc.tty", "cmk.utils.jsontype", "cmk.utils.paths"]

[components."cmk.utils.macros"]
allows = []

[components."cmk.utils.mail"]
allows = ["cmk.ccc.store", "cmk.ccc.version", "cmk.utils.paths"]

[components."cmk.utils.man_pages"]
allows = ["cmk.ccc.debug", "cmk.ccc.exceptions", "cmk.ccc.i18n", "cmk.ccc.tty"]

[components."cmk.utils.misc"]
allows = []

[components."cmk.utils.mrpe_config"]
allows = []

[components."cmk.utils.ms_teams_constants"]
allows = []

[components."cmk.utils.msi_engine"]
allows = ["cmk.ccc.version", "cmk.utils.msi_patch"]

[components."cmk.utils.msi_patch"]
allows = []

[components."cmk.cloud.config"]
allows = ["@crypto"]

[components."cmk.dcd.protocols"]
allows = ["@ccc", "cmk.utils"]

[components."cmk.dcd.gui"]
allows = [
  "cmk.web.utils",
  "@ccc",
  "@livestatus_client",
  "@plugin_apis",
  "cmk.dcd.protocols",
  "cmk.discover_plugins",
  "cmk.fields",
  "cmk.gui",
  "cmk.plugins.piggyback",
  "cmk.shared_typing",
  "cmk.utils",
]

[components."cmk.multi_tenancy.shared.customer"]
allows = ["cmk.ccc.store"]

[components."cmk.utils.oauth2_connection"]
allows = ["cmk.ccc.site"]

[components."cmk.utils.object_diff"]
allows = ["cmk.ccc.i18n"]

[components."cmk.utils.password_store"]
allows = [
  "cmk.ccc.config_path",
  "cmk.ccc.exceptions",
  "cmk.ccc.store",
  "cmk.password_store",
  "cmk.utils.global_ident_type",
  "cmk.utils.paths",
]

[components."cmk.utils.paths"]
allows = []

[components."cmk.utils.plugin_loader"]
allows = []

[components."cmk.utils.prediction"]
allows = [
  "@livestatus_client",
  "cmk.agent_based",
  "cmk.ccc.hostaddress",
  "cmk.utils.log",
  "cmk.utils.misc",
  "cmk.utils.paths",
  "cmk.utils.servicename",
]

[components."cmk.utils.redis"]
allows = ["cmk.ccc.exceptions", "cmk.utils.paths"]

[components."cmk.utils.render"]
allows = ["cmk.ccc.i18n"]

[components."cmk.utils.schedule"]
allows = []

[components."cmk.utils.security_event"]
allows = ["cmk.utils.jsontype", "cmk.utils.paths"]

[components."cmk.utils.servicename"]
allows = []

[components."cmk.utils.statename"]
allows = ["cmk.ccc.i18n"]

[components."cmk.utils.timeperiod"]
allows = ["cmk.ccc.i18n", "cmk.utils.dateutils"]

[components."cmk.utils.typing_helpers"]
allows = []

[components."cmk.utils.unixsocket_http"]
allows = []

[components."cmk.utils.visuals"]
allows = ["cmk.utils.paths"]

[components."cmk.utils.werks"]
allows = [
  "@werks",
  "cmk.ccc.store",
  "cmk.ccc.version",
  "cmk.utils.mail",
  "cmk.utils.paths",
]

[components."cmk.telemetry.gui"]
allows = [
  "cmk.web.utils",
  "@livestatus_client",
  "@plugin_apis",
  "cmk.ccc.exceptions",
  "cmk.ccc.hostaddress",
  "cmk.ccc.regex",
  "cmk.ccc.site",
  "cmk.ccc.version",
  "cmk.dcd.gui",
  "cmk.fields",
  "cmk.gui",
  "cmk.gui.nonfree.pro.graphing.openapi.models.attribute_filter",
  "cmk.data_backend.gui",
  "cmk.data_backend.telemetry_metrics",
  "cmk.otel_collector.gui",
  "cmk.ruleset_matcher.matcher",
  "cmk.shared_typing.aggregation",
  "cmk.shared_typing.attribute_filter",
  "cmk.shared_typing.consolidation",
  "cmk.shared_typing.mode_create_otel_conf",
  "cmk.shared_typing.mode_custom_services",
  "cmk.shared_typing.vue_formspec_components",
  "cmk.telemetry.custom_query_rule_value",
  "cmk.telemetry.host_name_template",
  "cmk.telemetry.host_name_template_resolution",
  "cmk.telemetry.host_name_template_validation",
  "cmk.utils.global_ident_type",
  "cmk.utils.paths",
]

[components."cmk.web"]
allows = ["@ccc", "cmk.shared_typing", "cmk.utils.security_event"]

[components."cmk.werk_ids_server"]
allows = ["cmk.ccc.log"]

[components."cmk.werks"]
allows = ["@ccc", "cmk.utils.paths"]
excludes = ["cmk.werks.web"]

[components."cmk.werks.web"]
allows = [
  "@ccc",
  "cmk.discover_plugins",
  "cmk.utils.man_pages",
  "cmk.web",
  "cmk.werks",
]

[components."omdlib"]
allows = [
  "@ccc",
  "@crypto",
  "@flags",
  "cmk.crash",
  "cmk.schema_manager",
  "cmk.utils",
]

[components."cmk.relay_trigger_protocol"]
allows = [
  "@ccc",
  "cmk.check_helper_protocol",
  "cmk.checkengine.helper_interface",
  "cmk.checkengine.snmplib",
]


[file_components]
"omd/packages/appliance/webconf_snapin.py" = "cmk.gui"
"omd/non-free/packages/cmk-dcd/cmk-dcd.py" = "cmk.dcd.daemon"
"omd/non-free/packages/cmk-dcd/dcd.py" = "cmk.dcd.daemon"
"omd/non-free/packages/cmk-liveproxyd/liveproxyd.py" = "cmk.liveproxyd.daemon"
"omd/packages/maintenance/diskspace.py" = "cmk.diskspace"


# Files that depend on more than one component, yet we do not want to
# add all those dependencies to one of those components.

[file_dependencies."buildscripts/scripts/build_cmk_container.py"]
allows = ["@ccc"]

[file_dependencies."buildscripts/scripts/assert_build_artifacts.py"]
allows = ["@ccc"]

[file_dependencies."buildscripts/scripts/publish_cloud_images.py"]
allows = ["@ccc"]

[file_dependencies."buildscripts/scripts/unpublish_container_image.py"]
allows = ["@ccc"]

[file_dependencies."buildscripts/scripts/lib/registry.py"]
allows = ["@ccc"]

[file_dependencies."buildscripts/scripts/tests/test_assert_build_artifacts.py"]
allows = ["@ccc"]

[file_dependencies."buildscripts/scripts/tests/test_publish_cloud_images.py"]
allows = ["@ccc"]

[file_dependencies."omd/packages/check_mk/post-create/01_create-sample-config.py"]
allows = ["@ccc", "cmk.gui", "cmk.utils.log", "cmk.utils.paths"]

[file_dependencies."omd/packages/check_mk/post-create/03_cmk-schema-manager.py"]
allows = ["cmk.schema_manager"]

[file_dependencies."omd/packages/Python/sitecustomize.py"]
allows = ["cmk.licensing.basics"]

[file_dependencies."omd/non-free/packages/licensing/cmk-license-email-notification.py"]
allows = ["cmk.licensing.nonfree", "cmk.utils"]