Native CPU capture: monorepo, plugin bridge, and privacy contracts

.github/workflows/android-runtime.yml

@@ -0,0 +1,37 @@
+name: Android runtime
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - "platforms/android/**"
+      - "core/image-processing/**"
+      - "tool/ci/build-android-runtime.sh"
+      - "tool/ci/dump-android-runtime-api.py"
+      - "tool/ci/verify-android-runtime-api.sh"
+      - ".github/workflows/android-runtime.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  aar:
+    name: Build and publish local AAR
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+      - name: Set up Android SDK
+        uses: android-actions/setup-android@v3
+      - name: Install NDK and CMake
+        run: |
+          yes | sdkmanager --install "ndk;28.2.13676358" "cmake;3.22.1" "platforms;android-36" "build-tools;35.0.0"
+      - name: Build runtime, tests, local Maven, sample
+        run: bash tool/ci/build-android-runtime.sh
+      - name: Verify public API dump
+        run: bash tool/ci/verify-android-runtime-api.sh

.github/workflows/flutter-adapter.yml

@@ -0,0 +1,39 @@
+name: Flutter adapter
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  pigeon:
+    name: Verify Pigeon outputs
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+      - name: Install Dart dependencies
+        run: flutter pub get
+      - name: Verify generated native capture bridges
+        run: bash tool/ci/verify-native-capture-pigeon.sh
+
+  pub-dry-run:
+    name: pub publish dry-run
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Set up Flutter
+        uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+      - name: Install Dart dependencies
+        run: dart pub get
+      - name: Dry-run pub publish
+        run: bash tool/ci/pub-dry-run.sh

.github/workflows/image-core.yml

@@ -0,0 +1,44 @@
+name: Image core
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  push:
+    paths:
+      - "core/image-processing/**"
+      - "tool/ci/run-image-core-tests.sh"
+      - ".github/workflows/image-core.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Unit tests with ASan/UBSan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Configure, build, test
+        run: bash tool/ci/run-image-core-tests.sh
+
+  fuzz:
+    name: Short libFuzzer run
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install clang
+        run: sudo apt-get update && sudo apt-get install -y clang libclang-rt-dev
+      - name: Build fuzzers
+        run: |
+          cmake -S core/image-processing -B build/image-core-fuzz \
+            -DCMAKE_BUILD_TYPE=Debug \
+            -DCMAKE_C_COMPILER=clang \
+            -DCMAKE_CXX_COMPILER=clang++ \
+            -DTB_IMAGE_CORE_FUZZ=ON
+          cmake --build build/image-core-fuzz
+      - name: Fuzz masks
+        run: ./build/image-core-fuzz/tb_mask_fuzz -max_total_time=20 -timeout=5
+      - name: Fuzz metadata
+        run: ./build/image-core-fuzz/tb_metadata_fuzz -max_total_time=20 -timeout=5

.github/workflows/version-bump-check.yml

@@ -9,68 +9,41 @@ permissions:
 
 jobs:
   check-tugboat-version:
-    name: Require tugboat version bump
+    name: Require path-aware version policy
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
-      - name: Compare package version to base
+      - name: Compare versions to base
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          PACKAGE_PUBSPEC: packages/tugboat/pubspec.yaml
-        run: |
-          set -euo pipefail
-
-          extract_version() {
-            local file="$1"
-            if [[ ! -f "$file" ]]; then
-              echo ""
-              return
-            fi
-            grep -E '^version:' "$file" | head -1 | sed -E 's/^version:[[:space:]]*//' | tr -d '"' | tr -d "'" | tr -d '[:space:]'
-          }
-
-          if [[ ! -f "$PACKAGE_PUBSPEC" ]]; then
-            echo "::error::$PACKAGE_PUBSPEC is missing on this branch"
-            exit 1
-          fi
-
-          head_version="$(extract_version "$PACKAGE_PUBSPEC")"
-          if [[ -z "$head_version" ]]; then
-            echo "::error::Could not read version from $PACKAGE_PUBSPEC"
-            exit 1
-          fi
-
-          base_file="$(mktemp)"
-          if ! git show "${BASE_SHA}:${PACKAGE_PUBSPEC}" >"$base_file" 2>/dev/null; then
-            echo "Base branch has no $PACKAGE_PUBSPEC; treating as new package (ok)."
-            echo "PR version: $head_version"
-            exit 0
-          fi
+        run: bash tool/ci/check-version-policy.sh
 
-          base_version="$(extract_version "$base_file")"
-          rm -f "$base_file"
-
-          if [[ -z "$base_version" ]]; then
-            echo "::error::Could not read version from base $PACKAGE_PUBSPEC"
-            exit 1
-          fi
-
-          echo "Base version: $base_version"
-          echo "PR version:   $head_version"
-
-          if [[ "$head_version" == "$base_version" ]]; then
-            echo "::error::packages/tugboat version must be bumped before merge (still $base_version)."
-            exit 1
-          fi
+  license:
+    name: AGPL-3.0-only license
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Check license files
+        run: bash tool/ci/check-license.sh
 
-          higher="$(printf '%s\n%s\n' "$base_version" "$head_version" | sort -V | tail -n 1)"
-          if [[ "$higher" != "$head_version" ]]; then
-            echo "::error::PR version ($head_version) must be greater than base ($base_version)."
-            exit 1
-          fi
+  android-api:
+    name: Android runtime API surface
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Diff public API dump
+        run: bash tool/ci/verify-android-runtime-api.sh
 
-          echo "Version bump detected: $base_version -> $head_version"
+  swift-api:
+    name: Swift API surface
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Diff public API dump
+        run: bash tool/ci/verify-swift-api.sh

.gitignore

@@ -7,3 +7,17 @@ coverage/
 build/
 **/build/
 **/.flutter-plugins-dependencies
+.local-maven/
+platforms/android/local.properties
+**/.gradle/
+**/.gradle/**
+.cxx/
+**/.cxx/
+**/.cxx/**
+.build/
+**/.build/
+.swiftpm/
+**/.swiftpm/
+crash-*
+leak-*
+timeout-*

Package.swift

@@ -0,0 +1,58 @@
+// swift-tools-version: 5.9
+import PackageDescription
+
+let package = Package(
+  name: "TugboatCaptureRuntime",
+  platforms: [
+    .iOS(.v15),
+  ],
+  products: [
+    .library(
+      name: "TugboatCaptureRuntime",
+      targets: ["TugboatCaptureRuntime"]
+    ),
+  ],
+  targets: [
+    .target(
+      name: "TugboatImageCore",
+      path: "core/image-processing",
+      exclude: [
+        "CMakeLists.txt",
+        "README.md",
+        "tests",
+        "fuzz",
+      ],
+      sources: ["src/tb_image_core.cpp"],
+      publicHeadersPath: "include",
+      cxxSettings: [
+        .headerSearchPath("include"),
+      ],
+      linkerSettings: [
+        .linkedLibrary("c++"),
+      ]
+    ),
+    .target(
+      name: "TugboatImageCoreBridge",
+      dependencies: ["TugboatImageCore"],
+      path: "platforms/apple/Sources/TugboatImageCoreBridge",
+      publicHeadersPath: ".",
+      cxxSettings: [
+        .headerSearchPath("../../../../core/image-processing/include"),
+      ],
+      linkerSettings: [
+        .linkedLibrary("c++"),
+      ]
+    ),
+    .target(
+      name: "TugboatCaptureRuntime",
+      dependencies: ["TugboatImageCoreBridge"],
+      path: "platforms/apple/Sources/TugboatCaptureRuntime"
+    ),
+    .testTarget(
+      name: "TugboatCaptureRuntimeTests",
+      dependencies: ["TugboatCaptureRuntime"],
+      path: "platforms/apple/Tests/TugboatCaptureRuntimeTests"
+    ),
+  ],
+  cxxLanguageStandard: .cxx17
+)