feat: add local registry flow and desktop examples

.github/actions/setup-deno/action.yml

@@ -107,14 +107,8 @@ runs:
           --connect-timeout 20 \
           --output "$tmp/deno.zip" \
           "$url"
-        python3 - "$tmp/deno.zip" "$DENO_CACHE_DIR" <<'PY'
-        import sys
-        import zipfile
-
-        archive, output = sys.argv[1], sys.argv[2]
-        with zipfile.ZipFile(archive) as zip_file:
-            zip_file.extractall(output)
-        PY
+        mkdir -p "$DENO_CACHE_DIR"
+        unzip -oq "$tmp/deno.zip" -d "$DENO_CACHE_DIR"
         chmod +x "$DENO_BINARY"
         echo "$DENO_CACHE_DIR" >> "$GITHUB_PATH"
 

.github/scripts/download-build-artifacts.sh

@@ -58,55 +58,7 @@ artifact_present() {
 merge_checksum_manifest() {
   local existing="$1"
   local incoming="$2"
-  python3 - "$existing" "$incoming" <<'PY'
-from __future__ import annotations
-
-import sys
-import tempfile
-from pathlib import Path
-
-existing = Path(sys.argv[1])
-incoming = Path(sys.argv[2])
-entries: dict[str, str] = {}
-
-
-def read_manifest(path: Path) -> None:
-    with path.open("r", encoding="utf-8") as handle:
-        for line_number, line in enumerate(handle, 1):
-            stripped = line.strip()
-            if not stripped:
-                continue
-            parts = stripped.split(None, 1)
-            if len(parts) != 2:
-                raise SystemExit(f"{path}: invalid checksum line {line_number}: {line.rstrip()}")
-            digest, raw_name = parts[0], parts[1].strip()
-            if len(digest) != 64 or any(char not in "0123456789abcdef" for char in digest):
-                raise SystemExit(f"{path}: invalid checksum digest on line {line_number}: {digest}")
-            name = raw_name.removeprefix("./")
-            if not name or "/" in name:
-                raise SystemExit(f"{path}: invalid checksum asset name on line {line_number}: {raw_name}")
-            previous = entries.get(name)
-            if previous is not None and previous != digest:
-                raise SystemExit(
-                    f"{path}: conflicting checksum for {name}: {previous} vs {digest}"
-                )
-            entries[name] = digest
-
-
-read_manifest(existing)
-read_manifest(incoming)
-with tempfile.NamedTemporaryFile(
-    "w",
-    encoding="utf-8",
-    newline="\n",
-    dir=str(existing.parent),
-    delete=False,
-) as handle:
-    temp_path = Path(handle.name)
-    for name in sorted(entries):
-        handle.write(f"{entries[name]}  ./{name}\n")
-temp_path.replace(existing)
-PY
+  bun .github/scripts/merge-checksum-manifest.mjs "$existing" "$incoming"
 }
 
 merge_downloaded_artifact() {

.github/scripts/merge-checksum-manifest.mjs

@@ -0,0 +1,57 @@
+#!/usr/bin/env bun
+import { mkdtempSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+
+function fail(message) {
+  console.error(`merge-checksum-manifest.mjs: ${message}`);
+  process.exit(1);
+}
+
+function parseManifest(path, text, entries) {
+  for (const [index, line] of text.split(/\r?\n/).entries()) {
+    const lineNumber = index + 1;
+    const stripped = line.trim();
+    if (stripped.length === 0) {
+      continue;
+    }
+    const match = /^([0-9a-f]{64})\s+(.+)$/.exec(stripped);
+    if (match === null) {
+      fail(`${path}: invalid checksum line ${lineNumber}: ${line}`);
+    }
+    const digest = match[1];
+    const rawName = match[2].trim();
+    const name = rawName.startsWith('./') ? rawName.slice(2) : rawName;
+    if (name.length === 0 || name.includes('/')) {
+      fail(`${path}: invalid checksum asset name on line ${lineNumber}: ${rawName}`);
+    }
+    const previous = entries.get(name);
+    if (previous !== undefined && previous !== digest) {
+      fail(`${path}: conflicting checksum for ${name}: ${previous} vs ${digest}`);
+    }
+    entries.set(name, digest);
+  }
+}
+
+const [existing, incoming] = process.argv.slice(2);
+if (existing === undefined || incoming === undefined) {
+  fail('usage: merge-checksum-manifest.mjs <existing> <incoming>');
+}
+
+const entries = new Map();
+parseManifest(existing, await readFile(existing, 'utf8'), entries);
+parseManifest(incoming, await readFile(incoming, 'utf8'), entries);
+
+const merged = [...entries]
+  .sort(([left], [right]) => left.localeCompare(right))
+  .map(([name, digest]) => `${digest}  ./${name}\n`)
+  .join('');
+
+const tempDir = mkdtempSync(join(dirname(existing), '.oliphaunt-checksums-'));
+const tempPath = join(tempDir, 'checksums.sha256');
+try {
+  writeFileSync(tempPath, merged, { encoding: 'utf8' });
+  renameSync(tempPath, existing);
+} finally {
+  rmSync(tempDir, { force: true, recursive: true });
+}

.github/scripts/resolve-release-please-pr.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env bun
+
+function candidateObjectsFromEnv(name) {
+  const raw = process.env[name]?.trim();
+  if (!raw) {
+    return [];
+  }
+  let value;
+  try {
+    value = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  if (Array.isArray(value)) {
+    return value.filter((item) => item !== null && typeof item === 'object');
+  }
+  if (value !== null && typeof value === 'object') {
+    return [value];
+  }
+  return [];
+}
+
+function pullRequestNumber(item) {
+  const value = item.number ?? item.pullRequestNumber;
+  if (typeof value === 'number' && Number.isInteger(value) && value > 0) {
+    return String(value);
+  }
+  if (typeof value === 'string' && value.trim().length > 0) {
+    return value.trim();
+  }
+  return undefined;
+}
+
+const candidates = [
+  ...candidateObjectsFromEnv('RELEASE_PLEASE_PR'),
+  ...candidateObjectsFromEnv('RELEASE_PLEASE_PRS'),
+];
+
+for (const item of candidates) {
+  const number = pullRequestNumber(item);
+  if (number !== undefined) {
+    console.log(number);
+    process.exit(0);
+  }
+}

.github/workflows/ci.yml

@@ -125,7 +125,7 @@ jobs:
           WASM_TARGET: ${{ github.event_name == 'workflow_dispatch' && inputs.wasm_target || 'all' }}
           NATIVE_TARGET: ${{ github.event_name == 'workflow_dispatch' && inputs.native_target || 'all' }}
           MOBILE_TARGET: ${{ github.event_name == 'workflow_dispatch' && inputs.mobile_target || 'all' }}
-        run: python3 .github/scripts/plan-affected.py
+        run: python3 tools/graph/ci_plan.py
 
       - name: Plan check and test jobs
         id: target-matrices
@@ -484,6 +484,7 @@ jobs:
       - affected
       - extension-artifacts-native
       - extension-artifacts-wasix
+      - liboliphaunt-wasix-aot
     if: ${{ contains(fromJson(needs.affected.outputs.jobs), 'extension-packages') }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -517,6 +518,13 @@ jobs:
           path: target/extensions/wasix/release-assets
           merge-multiple: true
 
+      - name: Download WASIX exact-extension AOT artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        with:
+          pattern: liboliphaunt-wasix-extension-aot-*
+          path: target/extensions/wasix/aot-artifacts
+          merge-multiple: true
+
       - name: Build exact-extension product packages
         env:
           OLIPHAUNT_EXTENSION_PACKAGE_PRODUCTS: ${{ needs.affected.outputs.extension_package_products_csv }}
@@ -1441,6 +1449,13 @@ jobs:
             target/oliphaunt-wasix/aot-upload/**
           if-no-files-found: error
 
+      - name: Upload target extension AOT artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        with:
+          name: liboliphaunt-wasix-extension-aot-${{ matrix.target_id }}
+          path: target/extensions/wasix/aot-artifacts
+          if-no-files-found: error
+
   liboliphaunt-wasix-release-assets:
     name: Builds / liboliphaunt-wasix-release-assets
     needs: