feat: wire bundle versions to all toolchain repository rules

This commit completes the Option B (Full Integration) architecture for
toolchain version bundles:

Changes:
- Add get_version_for_tool() and log_bundle_usage() helpers to bundle.bzl
- Add 'bundle' attribute to all 8 toolchain repository rules:
  - wasm_toolchain_repository (wasm-tools, wac, wit-bindgen)
  - wasmtime_repository
  - wizer_toolchain_repository
  - wkg_toolchain_repository
  - tinygo_toolchain_repository
  - wasi_sdk_repository
  - cpp_component_toolchain_repository
  - jco_toolchain_repository
- Add unified wasm_component_bundle extension to wasm/extensions.bzl
  that configures all toolchains from a single bundle parameter

Architecture:
  MODULE.bazel
      │ wasm_component_bundle.configure(bundle = "stable-2025-12")
      ▼
  Module Extension (wasm/extensions.bzl)
      │ Pass bundle to each toolchain repo rule
      ▼
  Repository Rules (each toolchain)
      │ Read checksums/toolchain_bundles.json via Label path
      │ Extract version for this tool from bundle
      ▼
  Downloaded Tools (with compatible versions)

Each repository rule:
1. Accepts optional 'bundle' attribute
2. If bundle set, reads version from toolchain_bundles.json
3. Falls back to explicit version attribute if not in bundle
4. Logs bundle usage for debugging

This ensures all tools are downloaded with compatible, pre-validated
versions when using a bundle, eliminating version mismatch issues.

Part of #254: Toolchain Version Bundles for Guaranteed Compatibility

Author: avrabe

toolchains/bundle.bzl

@@ -198,6 +198,58 @@ def print_bundle_info(repository_ctx, bundle_name = None):
 
     return "\n".join(lines)
 
+def get_version_for_tool(repository_ctx, tool_name, bundle_name = None, fallback_version = None):
+    """Get version for a specific tool from bundle, with fallback support.
+
+    This is the main entry point for toolchain repository rules to get their version.
+
+    Args:
+        repository_ctx: Repository context for file operations.
+        tool_name: Name of the tool (e.g., "wasm-tools", "wasmtime").
+        bundle_name: Name of the bundle to use. If empty/None, uses default bundle.
+        fallback_version: Version to use if tool not found in bundle.
+
+    Returns:
+        Version string for the tool.
+    """
+    # If no bundle specified, try to use default
+    effective_bundle = bundle_name if bundle_name else None
+
+    version = get_bundle_tool_version(repository_ctx, effective_bundle, tool_name)
+
+    if version:
+        return version
+
+    # Tool not in bundle - use fallback or fail
+    if fallback_version:
+        return fallback_version
+
+    # No fallback - check if bundle exists but doesn't have this tool
+    bundle = get_bundle(repository_ctx, effective_bundle)
+    if bundle:
+        available_tools = list(bundle.get("tools", {}).keys())
+        fail("Tool '{}' not found in bundle '{}'. Available tools: {}".format(
+            tool_name,
+            effective_bundle or get_default_bundle_name(repository_ctx),
+            ", ".join(available_tools) if available_tools else "none",
+        ))
+
+    # No bundle found at all - fail with helpful message
+    fail("Could not determine version for tool '{}'. No bundle found and no fallback specified.".format(tool_name))
+
+def log_bundle_usage(repository_ctx, tool_name, version, bundle_name = None):
+    """Log which version is being used from which bundle (for debugging).
+
+    Args:
+        repository_ctx: Repository context for file operations.
+        tool_name: Name of the tool.
+        version: Version being used.
+        bundle_name: Bundle name (or None for default).
+    """
+    effective_bundle = bundle_name or get_default_bundle_name(repository_ctx)
+    # buildifier: disable=print
+    print("Bundle '{}': using {} version {}".format(effective_bundle, tool_name, version))
+
 # Public API
 bundle_api = struct(
     get_bundle = get_bundle,
@@ -207,6 +259,8 @@ bundle_api = struct(
     validate_bundle = validate_bundle,
     resolve_tool_versions = resolve_tool_versions,
     print_bundle_info = print_bundle_info,
+    get_version_for_tool = get_version_for_tool,
+    log_bundle_usage = log_bundle_usage,
 
     # Constants
     STATUS_STABLE = BUNDLE_STATUS_STABLE,

toolchains/cpp_component_toolchain.bzl

@@ -1,5 +1,6 @@
 """C/C++ WebAssembly component toolchain definitions for Preview2"""
 
+load("//toolchains:bundle.bzl", "get_version_for_tool", "log_bundle_usage")
 load("//toolchains:diagnostics.bzl", "format_diagnostic_error", "validate_system_tool")
 
 def _cpp_component_toolchain_impl(ctx):
@@ -98,7 +99,19 @@ def _cpp_component_toolchain_repository_impl(repository_ctx):
 
     strategy = repository_ctx.attr.strategy
     platform = _detect_host_platform(repository_ctx)
-    wasi_sdk_version = repository_ctx.attr.wasi_sdk_version
+    bundle_name = repository_ctx.attr.bundle
+
+    # Resolve version from bundle if specified, otherwise use explicit version
+    if bundle_name:
+        wasi_sdk_version = get_version_for_tool(
+            repository_ctx,
+            "wasi-sdk",
+            bundle_name = bundle_name,
+            fallback_version = repository_ctx.attr.wasi_sdk_version,
+        )
+        log_bundle_usage(repository_ctx, "wasi-sdk", wasi_sdk_version, bundle_name)
+    else:
+        wasi_sdk_version = repository_ctx.attr.wasi_sdk_version
 
     if strategy == "download":
         _setup_downloaded_cpp_tools(repository_ctx, platform, wasi_sdk_version)
@@ -345,13 +358,17 @@ alias(
 cpp_component_toolchain_repository = repository_rule(
     implementation = _cpp_component_toolchain_repository_impl,
     attrs = {
+        "bundle": attr.string(
+            doc = "Toolchain bundle name. If set, wasi_sdk_version is read from checksums/toolchain_bundles.json",
+            default = "",
+        ),
         "strategy": attr.string(
             doc = "Tool acquisition strategy: 'download' or 'build'",
             default = "download",
             values = ["download", "build"],
         ),
         "wasi_sdk_version": attr.string(
-            doc = "WASI SDK version to use",
+            doc = "WASI SDK version to use. Ignored if bundle is specified.",
             default = "27",
         ),
     },

toolchains/jco_toolchain.bzl

@@ -1,5 +1,6 @@
 """jco (JavaScript Component Tools) toolchain definitions"""
 
+load("//toolchains:bundle.bzl", "get_version_for_tool", "log_bundle_usage")
 load("//toolchains:diagnostics.bzl", "format_diagnostic_error", "validate_system_tool")
 load("//toolchains:tool_cache.bzl", "cache_tool", "retrieve_cached_tool", "validate_tool_functionality")
 load("//checksums:registry.bzl", "get_tool_info")
@@ -86,8 +87,27 @@ def _jco_toolchain_repository_impl(repository_ctx):
     """Create jco toolchain repository"""
 
     platform = _detect_host_platform(repository_ctx)
-    jco_version = repository_ctx.attr.version
-    node_version = repository_ctx.attr.node_version
+    bundle_name = repository_ctx.attr.bundle
+
+    # Resolve versions from bundle if specified, otherwise use explicit versions
+    if bundle_name:
+        jco_version = get_version_for_tool(
+            repository_ctx,
+            "jco",
+            bundle_name = bundle_name,
+            fallback_version = repository_ctx.attr.version,
+        )
+        node_version = get_version_for_tool(
+            repository_ctx,
+            "nodejs",
+            bundle_name = bundle_name,
+            fallback_version = repository_ctx.attr.node_version,
+        )
+        log_bundle_usage(repository_ctx, "jco", jco_version, bundle_name)
+        log_bundle_usage(repository_ctx, "nodejs", node_version, bundle_name)
+    else:
+        jco_version = repository_ctx.attr.version
+        node_version = repository_ctx.attr.node_version
 
     # Always use download strategy with hermetic Node.js + jco
     _setup_downloaded_jco_tools(repository_ctx, platform, jco_version, node_version)
@@ -360,12 +380,16 @@ alias(
 jco_toolchain_repository = repository_rule(
     implementation = _jco_toolchain_repository_impl,
     attrs = {
+        "bundle": attr.string(
+            doc = "Toolchain bundle name. If set, versions are read from checksums/toolchain_bundles.json",
+            default = "",
+        ),
         "version": attr.string(
-            doc = "jco version to use",
+            doc = "jco version to use. Ignored if bundle is specified.",
             default = "1.4.0",
         ),
         "node_version": attr.string(
-            doc = "Node.js version to use for download strategy",
+            doc = "Node.js version to use for download strategy. Ignored if bundle is specified.",
             default = "18.19.0",
         ),
     },

toolchains/tinygo_toolchain.bzl

@@ -10,6 +10,11 @@ Architecture:
 - wasm-tools for component transformation
 """
 
+load("//toolchains:bundle.bzl", "get_version_for_tool", "log_bundle_usage")
+
+_TINYGO_TOOLCHAIN_DOC = """
+"""
+
 def _detect_host_platform(repository_ctx):
     """Detect the host platform for tool downloads"""
     os_name = repository_ctx.os.name.lower()
@@ -267,7 +272,19 @@ def _tinygo_toolchain_repository_impl(repository_ctx):
     """Implementation of TinyGo toolchain repository rule"""
 
     platform = _detect_host_platform(repository_ctx)
-    tinygo_version = repository_ctx.attr.tinygo_version
+    bundle_name = repository_ctx.attr.bundle
+
+    # Resolve version from bundle if specified, otherwise use explicit version
+    if bundle_name:
+        tinygo_version = get_version_for_tool(
+            repository_ctx,
+            "tinygo",
+            bundle_name = bundle_name,
+            fallback_version = repository_ctx.attr.tinygo_version,
+        )
+        log_bundle_usage(repository_ctx, "tinygo", tinygo_version, bundle_name)
+    else:
+        tinygo_version = repository_ctx.attr.tinygo_version
 
     print("Setting up TinyGo toolchain v{} for {}".format(tinygo_version, platform))
 
@@ -387,8 +404,12 @@ toolchain(
 tinygo_toolchain_repository = repository_rule(
     implementation = _tinygo_toolchain_repository_impl,
     attrs = {
+        "bundle": attr.string(
+            doc = "Toolchain bundle name. If set, version is read from checksums/toolchain_bundles.json",
+            default = "",
+        ),
         "tinygo_version": attr.string(
-            doc = "TinyGo version to download and use",
+            doc = "TinyGo version to download and use. Ignored if bundle is specified.",
             default = "0.39.0",
         ),
     },

toolchains/wasi_sdk_toolchain.bzl

@@ -1,6 +1,7 @@
 """WASI SDK toolchain definitions"""
 
 load("//checksums:registry.bzl", "get_tool_info")
+load("//toolchains:bundle.bzl", "get_version_for_tool", "log_bundle_usage")
 
 def _get_wasi_sdk_platform_info(platform, version):
     """Get platform info and checksum for WASI SDK from centralized registry"""
@@ -121,7 +122,20 @@ def _wasi_sdk_repository_impl(repository_ctx):
 def _setup_downloaded_wasi_sdk(repository_ctx):
     """Download WASI SDK from GitHub releases"""
 
-    version = repository_ctx.attr.version
+    bundle_name = repository_ctx.attr.bundle
+
+    # Resolve version from bundle if specified, otherwise use explicit version
+    if bundle_name:
+        version = get_version_for_tool(
+            repository_ctx,
+            "wasi-sdk",
+            bundle_name = bundle_name,
+            fallback_version = repository_ctx.attr.version,
+        )
+        log_bundle_usage(repository_ctx, "wasi-sdk", version, bundle_name)
+    else:
+        version = repository_ctx.attr.version
+
     platform = _detect_host_platform(repository_ctx)
 
     # Download WASI SDK
@@ -423,13 +437,17 @@ wasm_cc_toolchain_config = rule(
 wasi_sdk_repository = repository_rule(
     implementation = _wasi_sdk_repository_impl,
     attrs = {
+        "bundle": attr.string(
+            doc = "Toolchain bundle name. If set, version is read from checksums/toolchain_bundles.json",
+            default = "",
+        ),
         "strategy": attr.string(
             doc = "Strategy: 'download'",
             default = "download",
             values = ["download"],
         ),
         "version": attr.string(
-            doc = "WASI SDK version",
+            doc = "WASI SDK version. Ignored if bundle is specified.",
             default = "27",
         ),
         "url": attr.string(

toolchains/wasm_toolchain.bzl

@@ -1,6 +1,7 @@
 """WebAssembly toolchain definitions with enhanced tool management"""
 
 load("//checksums:registry.bzl", "get_tool_info", "validate_tool_compatibility")
+load("//toolchains:bundle.bzl", "get_version_for_tool", "log_bundle_usage")
 load("//toolchains:diagnostics.bzl", "create_retry_wrapper", "format_diagnostic_error", "log_diagnostic_info", "validate_system_tool")
 load("//toolchains:monitoring.bzl", "add_build_telemetry", "create_health_check")
 load("//toolchains:tool_cache.bzl", "cache_tool", "clean_expired_cache", "retrieve_cached_tool", "validate_tool_functionality")
@@ -125,7 +126,19 @@ def _wasm_toolchain_repository_impl(repository_ctx):
 
     strategy = repository_ctx.attr.strategy
     platform = _detect_host_platform(repository_ctx)
-    version = repository_ctx.attr.version
+    bundle_name = repository_ctx.attr.bundle
+
+    # Resolve version from bundle or use explicit version attribute
+    if bundle_name:
+        version = get_version_for_tool(
+            repository_ctx,
+            "wasm-tools",
+            bundle_name = bundle_name,
+            fallback_version = repository_ctx.attr.version,
+        )
+        log_bundle_usage(repository_ctx, "wasm-tools", version, bundle_name)
+    else:
+        version = repository_ctx.attr.version
 
     # Log diagnostic information
     log_diagnostic_info(repository_ctx, "wasm-tools", platform, version, strategy)
@@ -498,7 +511,19 @@ def _download_wasm_tools(repository_ctx):
 def _download_wac(repository_ctx):
     """Download wac only"""
     platform = _detect_host_platform(repository_ctx)
-    wac_version = get_tool_version("wac")  # From tool_versions.bzl
+    bundle_name = repository_ctx.attr.bundle
+
+    # Get version from bundle if specified, otherwise from tool_versions.bzl
+    if bundle_name:
+        wac_version = get_version_for_tool(
+            repository_ctx,
+            "wac",
+            bundle_name = bundle_name,
+            fallback_version = get_tool_version("wac"),
+        )
+        log_bundle_usage(repository_ctx, "wac", wac_version, bundle_name)
+    else:
+        wac_version = get_tool_version("wac")  # From tool_versions.bzl
 
     # Get checksum and platform info from tool_versions.bzl
     tool_info = get_tool_info("wac", wac_version, platform)
@@ -520,7 +545,19 @@ def _download_wac(repository_ctx):
 def _download_wit_bindgen(repository_ctx):
     """Download wit-bindgen only"""
     platform = _detect_host_platform(repository_ctx)
-    wit_bindgen_version = get_tool_version("wit-bindgen")  # From tool_versions.bzl
+    bundle_name = repository_ctx.attr.bundle
+
+    # Get version from bundle if specified, otherwise from tool_versions.bzl
+    if bundle_name:
+        wit_bindgen_version = get_version_for_tool(
+            repository_ctx,
+            "wit-bindgen",
+            bundle_name = bundle_name,
+            fallback_version = get_tool_version("wit-bindgen"),
+        )
+        log_bundle_usage(repository_ctx, "wit-bindgen", wit_bindgen_version, bundle_name)
+    else:
+        wit_bindgen_version = get_tool_version("wit-bindgen")  # From tool_versions.bzl
 
     # Get checksum and platform info from tool_versions.bzl
     tool_info = get_tool_info("wit-bindgen", wit_bindgen_version, platform)
@@ -724,13 +761,17 @@ toolchain(
 wasm_toolchain_repository = repository_rule(
     implementation = _wasm_toolchain_repository_impl,
     attrs = {
+        "bundle": attr.string(
+            doc = "Toolchain bundle name from checksums/toolchain_bundles.json (e.g., 'stable-2025-12', 'minimal'). If set, version is read from bundle.",
+            default = "",
+        ),
         "strategy": attr.string(
             doc = "Tool acquisition strategy: 'download' only (other strategies removed in dependency management cleanup)",
             default = "download",
             values = ["download"],
         ),
         "version": attr.string(
-            doc = "Version to use (for download/build strategies)",
+            doc = "Version to use (for download/build strategies). Ignored if bundle is specified.",
             default = "1.235.0",
         ),
         "git_commit": attr.string(