Reduce the public BUILD API surface

flutter/defs.bzl

@@ -1,19 +1,18 @@
 """The supported BUILD-file API for Flutter Consumer Modules.
 
 Consumer BUILD files load this one entrypoint rather than the implementation
-under ``//flutter/private``. The public names below are the complete contract
-exercised by the consumer API fixture; implementation files can move without
-another consumer migration.
+under ``//flutter/private``. Every name here is either written by hand in a
+Consumer Module or named by a BUILD file these rules generate; nothing is
+exported merely because it exists. Rules composed by the macros below --
+``dart_kernel``, ``flutter_android_libs``, ``jni_lib_jar``,
+``strip_native_libs`` -- and the ``ABIS`` table stay private, so their
+attributes remain free to change without a consumer migration.
 """
 
-load("//flutter/private:abis.bzl", _ABIS = "ABIS")
 load(
     "//flutter/private:android.bzl",
     _android_native_lib_jar = "android_native_lib_jar",
     _flutter_android_binary = "flutter_android_binary",
-    _flutter_android_libs = "flutter_android_libs",
-    _jni_lib_jar = "jni_lib_jar",
-    _strip_native_libs = "strip_native_libs",
 )
 load(
     "//flutter/private:embedding.bzl",
@@ -27,7 +26,6 @@ load(
 )
 load(
     "//flutter/private:rules.bzl",
-    _dart_kernel = "dart_kernel",
     _flutter_aot_library = "flutter_aot_library",
     _flutter_app = "flutter_app",
     _flutter_assets = "flutter_assets",
@@ -37,19 +35,21 @@ load(
 
 # Explicit assignments make the curated names exports of this module. Merely
 # importing names with load() does not re-export them to downstream BUILD files.
-ABIS = _ABIS
-android_native_lib_jar = _android_native_lib_jar
-dart_kernel = _dart_kernel
-flutter_android_binary = _flutter_android_binary
-flutter_android_libs = _flutter_android_libs
-flutter_aot_library = _flutter_aot_library
+#
+# Written by hand in a Consumer Module.
 flutter_app = _flutter_app
-flutter_assets = _flutter_assets
+flutter_android_binary = _flutter_android_binary
 flutter_embedding_library = _flutter_embedding_library
 flutter_native_contribution = _flutter_native_contribution
+
+# Named by the BUILD files the plugin extension generates, so they are loaded
+# across a repository boundary and have to resolve from this entrypoint.
+android_native_lib_jar = _android_native_lib_jar
 flutter_native_libs = _flutter_native_libs
+
+# The Dart half on its own, for an app whose Dart layout `flutter_app` refuses.
 flutter_pubspec = _flutter_pubspec
-jni_lib_jar = _jni_lib_jar
+flutter_aot_library = _flutter_aot_library
+flutter_assets = _flutter_assets
 pub_path_deps_check = _pub_path_deps_check
 pub_plugins_check = _pub_plugins_check
-strip_native_libs = _strip_native_libs

flutter/private/BUILD.bazel

@@ -1,24 +1,79 @@
 """Implementation of the Flutter rules.
 
-Nothing here is supported API. Consumer Modules load //flutter:defs.bzl and
-//flutter:extensions.bzl; these files are exported only because generated
-repositories and the ruleset's own CI guards name them by label.
+Nothing here is supported API: Consumer Modules load //flutter:defs.bzl and
+//flutter:extensions.bzl, and every `.bzl` beside this file declares
+`visibility(["//flutter"])` so Bazel rejects any other load, in this repository
+or a consumer's. Two mechanical exceptions need a label, and only those:
+
+  * The Python helpers are attribute defaults of rules defined here. Bazel
+    resolves an implicit dependency against the package of the `.bzl` that
+    defines the rule, so `//flutter:__subpackages__` is enough even though the
+    rules are instantiated in another module's packages.
+  * The five `.bzl` files //tools/ci:key_portability_check reads as `srcs`.
+    That guard parses their source for action-key portability contracts, which
+    requires a label, not a load.
+
+`repo.bzl` carries no `visibility()` declaration: tests/consumer's
+`android/config.MODULE.bazel` uses its module extension directly, which is that
+fixture's only coverage of the explicit embedding debug and release labels.
 """
 
-package(default_visibility = ["//visibility:public"])
-
-exports_files([
-    "check_path_deps.py",
-    "check_native_assets.py",
-    "inject_version.py",
-    "merge_native_assets.py",
-    "read_pubspec.py",
-    "repo.bzl",
-    "rules.bzl",
-    "android.bzl",
-    "plugins.bzl",
-    "ndk.bzl",
-])
+load("//tools/ci:assertions.bzl", "expect_equal", "expect_label_equal")
+load(":abis.bzl", "ABIS")
+
+package(default_visibility = ["//visibility:private"])
+
+exports_files(
+    [
+        "check_path_deps.py",
+        "check_native_assets.py",
+        "inject_version.py",
+        "merge_native_assets.py",
+        "read_pubspec.py",
+    ],
+    visibility = ["//flutter:__subpackages__"],
+)
+
+exports_files(
+    [
+        "android.bzl",
+        "ndk.bzl",
+        "plugins.bzl",
+        "repo.bzl",
+        "rules.bzl",
+    ],
+    visibility = ["//tools/ci:__pkg__"],
+)
+
+# The ABI table is implementation, so these assertions live beside it rather
+# than in the Consumer Module fixture: a wrong snapshot flag or CPU constraint
+# mislabels a platform, and nothing else in the build would notice.
+expect_equal(
+    ABIS["armeabi-v7a"].snapshot_flags,
+    [
+        "--no-sim-use-hardfp",
+        "--no-use-integer-division",
+    ],
+    "armeabi-v7a snapshot_flags",
+)
+
+expect_label_equal(
+    ABIS["arm64-v8a"].cpu_constraint,
+    "@platforms//cpu:arm64",
+    "arm64-v8a cpu_constraint",
+)
+
+expect_label_equal(
+    ABIS["x86_64"].cpu_constraint,
+    "@platforms//cpu:x86_64",
+    "x86_64 cpu_constraint",
+)
+
+expect_label_equal(
+    ABIS["armeabi-v7a"].cpu_constraint,
+    "@platforms//cpu:armv7",
+    "armeabi-v7a cpu_constraint",
+)
 
 # Excluded from wildcard checks because resolving it requires @androidsdk.
 alias(

flutter/private/abis.bzl

@@ -15,6 +15,8 @@ there is no `gen_snapshot` to pair with an x86 library however many a package
 publishes.
 """
 
+visibility(["//flutter"])
+
 MODES = ["release", "debug"]
 
 # Modes that require gen_snapshot.

flutter/private/android.bzl

@@ -44,6 +44,14 @@ load(":bundle.bzl", "ASSETS", "CLASSES", "FlutterBundleContributionInfo", "NATIV
 load(":embedding.bzl", "flutter_embedding_deps")
 load(":pubspec.bzl", "FlutterPubspecInfo")
 
+# `//flutter` holds the public facades. `//` is the repository root package,
+# which asserts `flutter_assets_dir` there because the root is the one package
+# with no path separator and the helper is deliberately not public API.
+visibility([
+    "//",
+    "//flutter",
+])
+
 _MODE_DEBUG = Label("//flutter:mode_debug")
 _MODE_RELEASE = Label("//flutter:mode_release")
 

flutter/private/archive.bzl

@@ -5,6 +5,8 @@ Uses Bazel's declared `zipper`, which fixes metadata and follows argv order.
 `StripNativeLibs` preserves input order because it discovers entries at execution.
 """
 
+visibility(["//flutter"])
+
 ZIPPER_ATTRS = {
     "_zipper": attr.label(
         default = Label("@bazel_tools//tools/zip:zipper"),

flutter/private/bundle.bzl

@@ -22,6 +22,8 @@ Two things this deliberately does not do:
     that assembles plus a rule that checks.
 """
 
+visibility(["//flutter"])
+
 # Where a contribution's files land -- named for the destination, not for the
 # contribution, so a platform putting two in the same place says so.
 #

flutter/private/embedding.bzl

@@ -23,6 +23,8 @@ load("@rules_java//java:defs.bzl", "java_import")
 load(":abis.bzl", "embedding_repo")
 load(":maven.bzl", "maven_label")
 
+visibility(["//flutter"])
+
 _MODE_DEBUG = Label("//flutter:mode_debug")
 _MODE_RELEASE = Label("//flutter:mode_release")
 

flutter/private/maven.bzl

@@ -5,6 +5,8 @@ generates for it, and both feed the same artifact list, so the mangling and the
 version comparison live in one place rather than being reimplemented per caller.
 """
 
+visibility(["//flutter"])
+
 def maven_label(coordinate, repo):
     """`group:artifact[:version]` -> the target rules_jvm_external generates."""
     parts = coordinate.split(":")

flutter/private/ndk.bzl

@@ -8,6 +8,8 @@ fetched and fails with an actionable diagnostic if no NDK is present.
 
 load("@rules_android_ndk//:rules.bzl", "android_ndk_repository")
 
+visibility(["//flutter"])
+
 _MIN_NDK_MAJOR = 28
 
 _CMAKE_STUB_BUILD = """# Generated by //flutter:extensions.bzl -- do not edit.

flutter/private/plugins.bzl

@@ -15,6 +15,8 @@ load(":abis.bzl", "MIN_SDK", "check_abis", "plugin_repo_target")
 load(":embedding.bzl", "FLUTTER_EMBEDDING_ARTIFACTS")
 load(":maven.bzl", "highest_versions", "maven_label")
 
+visibility(["//flutter"])
+
 # Plugin reason codes. Ungated plugins build from source.
 #
 #   external_native_build  CMake/ndk-build configuration.

flutter/private/pubspec.bzl

@@ -15,6 +15,8 @@ invalidate the kernel -- Bazel keys an action on the content of its inputs, and
 the package-name file is unchanged.
 """
 
+visibility(["//flutter"])
+
 FlutterPubspecInfo = provider(
     doc = "Facts read out of an app's pubspec.yaml.",
     fields = {

flutter/private/recipe.bzl

@@ -42,6 +42,8 @@ library.
 
 load(":archive.bzl", "ZIPPER_ATTRS", "deterministic_jar")
 
+visibility(["//flutter"])
+
 # `dart_kernel`'s `target_os` names, not a second vocabulary. The list grows
 # with the platform table; macOS is absent until there is something to build for
 # it, and is named separately rather than folded into an `apple` -- flutter_tools

flutter/private/rules.bzl

@@ -28,6 +28,8 @@ load("@bazel_skylib//rules:common_settings.bzl", "BuildSettingInfo")
 load(":abis.bzl", "ABIS", "aot_gen_snapshot", "aot_target_compatible_with", "check_abis")
 load(":pubspec.bzl", "FlutterPubspecInfo", "flutter_pubspec")
 
+visibility(["//flutter"])
+
 # Release actions may be shared through a remote cache.
 #
 # no-sandbox:     package_config.json reaches into ~/.pub-cache, which is not a