feat(sdk)!: unify explicit extension and resource configuration

.github/actions/setup-rust-tools/action.yml

@@ -54,6 +54,11 @@ runs:
         cargo install ripgrep --version 15.1.0 --locked
         rg --version
 
+    - name: Prepare Linux apt sources
+      if: ${{ runner.os == 'Linux' && inputs.tools != '' }}
+      shell: bash
+      run: .github/scripts/prepare-linux-apt.sh
+
     - name: Install Cargo tools
       if: ${{ inputs.tools != '' }}
       uses: taiki-e/install-action@43aecc8d72668fbcfe75c31400bc4f890f1c5853

.github/scripts/prepare-linux-apt.sh

@@ -8,18 +8,18 @@ fi
 disabled_any=0
 for file in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
   [ -f "$file" ] || continue
-  if ! grep -q "packages.microsoft.com" "$file"; then
+  if ! grep -Eq 'packages[.]microsoft[.]com|dl[.]google[.]com/linux/chrome(-stable)?/deb' "$file"; then
     continue
   fi
 
   disabled_any=1
   if [ "$file" = "/etc/apt/sources.list" ]; then
-    sudo sed -i.bak '/packages\.microsoft\.com/s/^/# disabled by oliphaunt CI: /' "$file"
+    sudo sed -E -i.bak '/packages[.]microsoft[.]com|dl[.]google[.]com\/linux\/chrome(-stable)?\/deb/s/^/# disabled by oliphaunt CI: /' "$file"
   else
     sudo mv "$file" "$file.disabled"
   fi
 done
 
 if [ "$disabled_any" = "1" ]; then
-  echo "Disabled preinstalled packages.microsoft.com apt sources before apt-get update"
+  echo "Disabled unrelated preinstalled Microsoft and Chrome apt sources before apt-get update"
 fi

.github/scripts/resolve-planned-moon-execution.test.mjs

@@ -71,6 +71,7 @@ test('resolves a real multi-root job with downloaded dependencies', () => {
       }),
       OLIPHAUNT_MOON_TRANSFERRED_DEPS_JSON: JSON.stringify([
         'liboliphaunt-wasix:runtime-portable',
+        'liboliphaunt-wasix:runtime-aot',
         'release-tools:wasix-napi-runtime',
       ]),
     },

.github/scripts/setup-native-build-tools.test.sh

@@ -118,3 +118,23 @@ fi
 [ "$(cat "$tmp/sleep-calls.log")" = $'15\n30' ] || fail "bounded retry backoff mismatch"
 grep -Fq 'apt tool installation failed after 3 attempts' "$tmp/failure.err" ||
   fail "terminal apt diagnostic missing"
+
+# Runner-provided browser and Microsoft feeds must not block unrelated build
+# packages. Exercise the real source filter against an isolated apt layout.
+mkdir -p "$tmp/apt/sources.list.d" "$tmp/apt-bin"
+printf '%s\n' '#!/usr/bin/env bash' 'exec "$@"' >"$tmp/apt-bin/sudo"
+chmod 0555 "$tmp/apt-bin/sudo"
+printf '%s\n' \
+  'deb https://archive.ubuntu.com/ubuntu noble main' \
+  'deb https://dl.google.com/linux/chrome-stable/deb stable main' \
+  'deb https://packages.microsoft.com/repos/code stable main' >"$tmp/apt/sources.list"
+printf '%s\n' 'deb https://dl.google.com/linux/chrome/deb stable main' >"$tmp/apt/sources.list.d/chrome.list"
+printf '%s\n' 'Types: deb' 'URIs: https://dl.google.com/linux/chrome-stable/deb' 'Suites: stable' 'Components: main' >"$tmp/apt/sources.list.d/chrome.sources"
+printf '%s\n' 'deb https://archive.ubuntu.com/ubuntu noble-updates main' >"$tmp/apt/sources.list.d/ubuntu.list"
+sed "s|/etc/apt|$tmp/apt|g" "$root/.github/scripts/prepare-linux-apt.sh" >"$tmp/prepare-linux-apt.sh"
+PATH="$tmp/apt-bin:$tmp/bin:/usr/bin:/bin" bash "$tmp/prepare-linux-apt.sh"
+[ "$(grep -c '^deb ' "$tmp/apt/sources.list")" = "1" ] || fail "unrelated apt sources remain enabled"
+grep -q '^deb https://archive.ubuntu.com/' "$tmp/apt/sources.list" || fail "Ubuntu source was disabled"
+[ -f "$tmp/apt/sources.list.d/ubuntu.list" ] || fail "Ubuntu source file was disabled"
+[ -f "$tmp/apt/sources.list.d/chrome.list.disabled" ] || fail "Chrome list remains enabled"
+[ -f "$tmp/apt/sources.list.d/chrome.sources.disabled" ] || fail "Chrome deb822 source remains enabled"

.github/workflows/ci.yml

@@ -1405,7 +1405,6 @@ jobs:
         shell: bash
         env:
           OLIPHAUNT_ARTIFACT_CRATE_REQUIRE_PAYLOAD: "1"
-          OLIPHAUNT_ICU_DATA_DIR: ${{ github.workspace }}/target/oliphaunt-wasix/wasix-build/work/icu-wasix/share/icu
           OLIPHAUNT_WASM_GENERATED_AOT_DIR: ${{ github.workspace }}/target/oliphaunt-wasix/aot
           OLIPHAUNT_WASIX_EXTENSION_ARTIFACT_ROOT: ${{ github.workspace }}/target/extension-artifacts
           OLIPHAUNT_WASIX_GENERATED_ASSETS_DIR: ${{ github.workspace }}/target/oliphaunt-wasix/assets
@@ -1471,6 +1470,7 @@ jobs:
     needs:
       - affected
       - liboliphaunt-native-ios-abi
+      - mobile-extension-packages
     if: ${{ contains(fromJson(needs.affected.outputs.jobs), 'swift-sdk-package') }}
     runs-on: macos-26
     timeout-minutes: 90
@@ -1494,10 +1494,16 @@ jobs:
           name: liboliphaunt-native-abi-compatible-release-assets-ios-datum64
           path: target/liboliphaunt/abi-compatible-release-assets/ios-datum64
 
+      - name: Download mobile extension package artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: oliphaunt-mobile-extension-package-artifacts
+          path: target/mobile-extension-artifacts
+
       - name: Build Swift SDK package artifacts
         env:
           OLIPHAUNT_SWIFT_RELEASE_ASSET_DIR: ${{ github.workspace }}/target/liboliphaunt/abi-compatible-release-assets/ios-datum64
-          OLIPHAUNT_MOON_TRANSFERRED_DEPS_JSON: '["liboliphaunt-native:finalize-runtime-ios-abi"]'
+          OLIPHAUNT_MOON_TRANSFERRED_DEPS_JSON: '["liboliphaunt-native:finalize-runtime-ios-abi", "extension-packages:package-mobile"]'
         run: OLIPHAUNT_CI_JOB_TARGETS_JSON='${{ needs.affected.outputs.job_targets }}' .github/scripts/run-planned-moon-job.sh swift-sdk-package
 
       - name: Upload Swift SDK package artifacts
@@ -1690,9 +1696,23 @@ jobs:
           name: oliphaunt-wasix-napi-npm-package-linux-x64-gnu
           path: target/oliphaunt-wasix-napi/npm-packages
 
+      - name: Download same-run Linux x64 WASIX tool AOT inputs
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          name: liboliphaunt-wasix-runtime-aot-linux-x64-gnu
+          path: target/oliphaunt-wasix/sdk-aot-download
+
+      - name: Restore verified Linux x64 tool AOT layout
+        run: |
+          artifact_dir=target/oliphaunt-wasix/sdk-aot-download
+          test "$(tr -d '\r\n' < "$artifact_dir/target-triple.txt")" = x86_64-unknown-linux-gnu
+          destination=target/oliphaunt-wasix/aot/x86_64-unknown-linux-gnu
+          mkdir -p "$destination"
+          cp -R "$artifact_dir/files/." "$destination/"
+
       - name: Build, test, and package the WASIX TypeScript SDK
         env:
-          OLIPHAUNT_MOON_TRANSFERRED_DEPS_JSON: '["liboliphaunt-wasix:runtime-portable", "release-tools:wasix-napi-runtime"]'
+          OLIPHAUNT_MOON_TRANSFERRED_DEPS_JSON: '["liboliphaunt-wasix:runtime-portable", "liboliphaunt-wasix:runtime-aot", "release-tools:wasix-napi-runtime"]'
         run: OLIPHAUNT_CI_JOB_TARGETS_JSON='${{ needs.affected.outputs.job_targets }}' .github/scripts/run-planned-moon-job.sh wasix-ts-sdk-package
 
       - name: Upload WASIX TypeScript SDK package artifacts
@@ -2547,6 +2567,14 @@ jobs:
             exit 1
           fi
           closure="$(dirname "$1")"
+          set --
+          while IFS= read -r archive; do
+            [ -n "$archive" ] && set -- "$@" "$archive"
+          done < <(find target/liboliphaunt/android-runtime-assets -type f -name 'liboliphaunt-*-icu-seed-android-datum64.tar.gz' | LC_ALL=C sort)
+          [ "$#" -eq 1 ] || { echo "Expected one optional android-datum64 ICU seed" >&2; exit 1; }
+          mkdir -p "$closure/cluster-seed-icu"
+          tar -xzf "$1" -C "$closure/cluster-seed-icu"
+
           # JavaScript template interpolation belongs inside the single-quoted Bun program.
           # shellcheck disable=SC2016
           tools/dev/bun.sh -e '
@@ -2555,6 +2583,11 @@ jobs:
             const { target } = validateNativeRuntimeCarrier(root, { icuData });
             if (target !== "android-datum64") throw new Error(`expected android-datum64, got ${target}`);
           ' "$closure" "target/liboliphaunt-mobile-host/$OLIPHAUNT_NATIVE_TARGET/icu/share/icu"
+          # Assemble the optional npm ICU package inputs from these same-run bytes.
+          tools/release/package-liboliphaunt-icu-data.sh \
+            "target/liboliphaunt-mobile-host/$OLIPHAUNT_NATIVE_TARGET/icu/share/icu" \
+            target/liboliphaunt/release-assets
+          cp "$1" target/liboliphaunt/release-assets/
           echo "OLIPHAUNT_EXPO_ANDROID_SEED_CLOSURE_DIR=$GITHUB_WORKSPACE/$closure" >> "$GITHUB_ENV"
 
       - name: Download Kotlin SDK package artifacts
@@ -2698,6 +2731,14 @@ jobs:
             exit 1
           fi
           closure="$(dirname "$1")"
+          set --
+          while IFS= read -r archive; do
+            [ -n "$archive" ] && set -- "$@" "$archive"
+          done < <(find target/liboliphaunt/release-assets -type f -name 'liboliphaunt-*-icu-seed-ios-datum64.tar.gz' | LC_ALL=C sort)
+          [ "$#" -eq 1 ] || { echo "Expected one optional ios-datum64 ICU seed" >&2; exit 1; }
+          mkdir -p "$closure/cluster-seed-icu"
+          tar -xzf "$1" -C "$closure/cluster-seed-icu"
+
           # JavaScript template interpolation belongs inside the single-quoted Bun program.
           # shellcheck disable=SC2016
           tools/dev/bun.sh -e '

.github/workflows/release.yml

@@ -1016,8 +1016,8 @@ jobs:
 
       - name: Prove the exact SwiftPM source tag is remotely collision-free
         id: preflight_swift_source_tag
-        if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && contains(fromJson(steps.release_plan.outputs.products_json), 'oliphaunt-swift') }}
-        timeout-minutes: 2
+        if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' }}
+        timeout-minutes: 10
         run: |
           tools/dev/bun.sh tools/release/preflight-swiftpm-source-tag.mjs \
             --publication-lock "$PUBLICATION_LOCK_PATH" \
@@ -1220,6 +1220,25 @@ jobs:
             target/liboliphaunt/release-assets/*.sha256
             target/extension-artifacts/liboliphaunt-native/oliphaunt-extension-contrib-pg18/release-assets/*
 
+      - name: Create standalone SwiftPM package token
+        id: swift_package_token
+        if: ${{ steps.preflight_swift_source_tag.outputs.repositories != '' && inputs.operation == 'publish' }}
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        with:
+          client-id: ${{ secrets.RELEASE_TAG_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_TAG_APP_PRIVATE_KEY }}
+          owner: f0rr0
+          repositories: ${{ steps.preflight_swift_source_tag.outputs.repositories }}
+          permission-contents: write
+
+      - name: Publish exact standalone SwiftPM package tags
+        if: ${{ steps.preflight_swift_source_tag.outputs.repositories != '' && inputs.operation == 'publish' }}
+        timeout-minutes: 45
+        env:
+          GH_TOKEN: ${{ steps.swift_package_token.outputs.token }}
+          PRODUCTS_JSON: ${{ steps.release_plan.outputs.products_json }}
+        run: tools/dev/bun.sh tools/release/release-publish.mjs publish --step swift-package-source-tag --products-json "$PRODUCTS_JSON" --head-ref "$RELEASE_HEAD_SHA" --publication-lock "$PUBLICATION_LOCK_PATH"
+
       - name: Create fresh SwiftPM tag token
         id: swift_tag_token
         if: ${{ steps.release_plan.outputs.has_release_changes == 'true' && inputs.operation == 'publish' && contains(fromJson(steps.release_plan.outputs.products_json), 'oliphaunt-swift') }}

Cargo.toml

@@ -2,10 +2,12 @@
 members = [
   "src/bindings/wasix-rust/crates/oliphaunt-wasix",
   "src/sdks/rust/crates/oliphaunt-build",
+  "src/sdks/rust/crates/oliphaunt-resources",
   "src/sdks/rust",
   "src/runtimes/liboliphaunt/native/crates/tools",
   "src/runtimes/broker",
   "src/runtimes/liboliphaunt/icu",
+  "src/runtimes/liboliphaunt/wasix/crates/icu",
   "src/runtimes/liboliphaunt/wasix/crates/assets",
   "src/runtimes/liboliphaunt/wasix/crates/tools",
   "src/runtimes/liboliphaunt/wasix/crates/aot/aarch64-apple-darwin",

benchmarks/wasix/node-pglite-memory-v2.json

@@ -10,7 +10,7 @@
         "schema": "oliphaunt-wasix-napi-host-v1",
         "product": "oliphaunt-wasix-napi",
         "binary": "oliphaunt_wasix_napi.node",
-        "addonAbiVersion": 1,
+        "addonAbiVersion": 2,
         "nodeApiVersion": 8,
         "profiles": [
           "standard",

coverage/baseline.toml

@@ -39,6 +39,13 @@ evidence = "oliphaunt-rust broker tests plus src/shared/fixtures/protocol/query-
 owner = "@oliphaunt/core"
 expires = "before-0.2.0"
 
+[[products.oliphaunt-rust.waivers]]
+path = "src/sdks/rust/src/extensions.rs"
+reason = "generated const descriptors contain no executable lines for LLVM instrumentation"
+evidence = "extensions:lint validates the generated model; sdk_extensions tests validate descriptor selection"
+owner = "@oliphaunt/core"
+expires = "before-0.2.0"
+
 [[products.oliphaunt-rust.waivers]]
 path = "src/sdks/rust/src/lib.rs"
 reason = "crate root is a re-export surface with no durable executable behavior to line-cover"
@@ -76,6 +83,13 @@ exclude_globs = [
 ]
 per_file_line_warning = 50.0
 
+[[products.oliphaunt-swift.waivers]]
+path = "src/sdks/swift/Sources/Oliphaunt/OliphauntExtensions.swift"
+reason = "generated static descriptor and dependency tables have no Swift coverage instrumentation"
+evidence = "extensions:lint validates generated metadata; explicit resource selection tests cover dependency closure"
+owner = "@oliphaunt/core"
+expires = "before-0.2.0"
+
 [[products.oliphaunt-swift.waivers]]
 path = "src/sdks/swift/Sources/Oliphaunt/OliphauntNativeDirect.swift"
 reason = "native direct FFI shell is validated by runtime smoke/XCTest paths rather than pure Swift line coverage"
@@ -143,7 +157,6 @@ exclude_globs = [
   "src/sdks/js/src/__tests__/**",
   "src/sdks/js/src/**/*.d.ts",
   "src/sdks/js/src/**/types.ts",
-  "src/sdks/js/src/protocol.ts",
   "src/sdks/js/src/query.ts",
   "src/sdks/js/lib/**",
   "src/sdks/js/node_modules/**",
@@ -178,13 +191,6 @@ evidence = "native-bindings tests, package checks, and TypeScript native smoke"
 owner = "@oliphaunt/core"
 expires = "before-0.2.0"
 
-[[products.oliphaunt-js.waivers]]
-path = "src/sdks/js/src/native/tar.ts"
-reason = "tar extraction helpers are covered through asset resolver tests and release artifact checks"
-evidence = "asset-resolver.test.ts and release artifact validation"
-owner = "@oliphaunt/core"
-expires = "before-0.2.0"
-
 [[products.oliphaunt-js.waivers]]
 path = "src/sdks/js/src/runtime/broker.ts"
 reason = "broker helper lifecycle requires Rust helper/runtime artifacts and belongs in smoke/regression evidence"
@@ -229,7 +235,6 @@ source_globs = [
 exclude_globs = [
   "src/sdks/react-native/src/__tests__/**",
   "src/sdks/react-native/src/generated/**",
-  "src/sdks/react-native/src/protocol.ts",
   "src/sdks/react-native/src/query.ts",
   "src/sdks/react-native/lib/**",
   "src/sdks/react-native/node_modules/**",