feat: add prebuilt native asset infrastructure

.github/workflows/build-prebuilt-assets.yml

@@ -0,0 +1,58 @@
+name: build-prebuilt-assets
+
+on:
+  workflow_dispatch:
+
+env:
+  PUB_ENVIRONMENT: bot.github
+
+jobs:
+  build:
+    name: ${{ matrix.target }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: linux-x64
+            os: ubuntu-latest
+            configure_args: ''
+          - target: macos-arm64
+            os: macos-14
+            configure_args: ''
+          - target: macos-x64
+            os: macos-13
+            configure_args: ''
+          - target: windows-x64
+            os: windows-latest
+            configure_args: '-A x64'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: ilammy/setup-nasm@v1
+        if: runner.os == 'Windows'
+
+      - name: Build prebuilt asset
+        shell: pwsh
+        run: |
+          $install = Join-Path $env:GITHUB_WORKSPACE "prebuilt/${{ matrix.target }}"
+          $configureArgs = @(
+            '-S', 'src',
+            '-B', 'build/prebuilt',
+            '-DCMAKE_BUILD_TYPE=Release',
+            "-DCMAKE_INSTALL_PREFIX=$install"
+          )
+          if ('${{ matrix.configure_args }}' -ne '') {
+            $configureArgs += '${{ matrix.configure_args }}'.Split(' ')
+          }
+          cmake @configureArgs
+          cmake --build build/prebuilt --config Release --target install
+
+      - name: Upload prebuilt asset
+        uses: actions/upload-artifact@v4
+        with:
+          name: webcrypto-${{ matrix.target }}
+          path: prebuilt/${{ matrix.target }}/*
+          if-no-files-found: error

hook/build.dart

@@ -19,6 +19,8 @@ import 'package:hooks/hooks.dart';
 import 'package:native_toolchain_cmake/native_toolchain_cmake.dart';
 
 const _assetName = 'webcrypto.dart';
+const _libraryName = 'webcrypto';
+const _forceSourceBuildDefine = 'force_source_build';
 
 Future<void> main(List<String> args) async {
   await build(args, (input, output) async {
@@ -33,14 +35,32 @@ Future<void> main(List<String> args) async {
     final packageRoot = input.packageRoot;
     final installDir = input.outputDirectory.resolve('install/');
     final sourceDir = packageRoot.resolve('src/');
+    final prebuiltAsset = _prebuiltAsset(input);
+
+    if (!_forceSourceBuild(input) && prebuiltAsset.existsSync()) {
+      stdout.writeln(
+        'webcrypto: using prebuilt native asset for '
+        '${_targetName(input)}.',
+      );
+      output.assets.code.add(
+        CodeAsset(
+          package: input.packageName,
+          name: _assetName,
+          linkMode: DynamicLoadingBundled(),
+          file: prebuiltAsset.uri,
+        ),
+      );
+      output.dependencies.add(prebuiltAsset.uri);
+      return;
+    }
 
     stdout.writeln(
       'webcrypto: building native asset for '
-      '${input.config.code.targetOS}-${input.config.code.targetArchitecture}.',
+      '${_targetName(input)}.',
     );
 
     final builder = CMakeBuilder.create(
-      name: 'webcrypto',
+      name: _libraryName,
       sourceDir: sourceDir,
       defines: {
         'CMAKE_BUILD_TYPE': 'Release',
@@ -69,6 +89,31 @@ Future<void> main(List<String> args) async {
   });
 }
 
+bool _forceSourceBuild(BuildInput input) {
+  final value = input.userDefines[_forceSourceBuildDefine];
+  return value == true || value == 'true';
+}
+
+File _prebuiltAsset(BuildInput input) {
+  final targetOS = input.config.code.targetOS;
+  final libraryFileName = targetOS.dylibFileName(_libraryName);
+  return File.fromUri(
+    input.packageRoot.resolve(
+      'prebuilt/${_targetName(input)}/$libraryFileName',
+    ),
+  );
+}
+
+String _targetName(BuildInput input) {
+  final code = input.config.code;
+  final os = code.targetOS;
+  final arch = code.targetArchitecture;
+  if (os == OS.iOS) {
+    return '${os.name}-${code.iOS.targetSdk.type}-${arch.name}';
+  }
+  return '${os.name}-${arch.name}';
+}
+
 final _buildDependencyExtensions = {
   '.S',
   '.asm',

prebuilt/README.md

@@ -0,0 +1,59 @@
+# Prebuilt Native Assets
+
+This directory is reserved for trusted prebuilt `webcrypto` native libraries.
+
+The build hook looks for a target-specific dynamic library before falling back
+to a local CMake source build.
+
+## Layout
+
+Each target gets one directory:
+
+```text
+prebuilt/
+  linux-x64/
+    libwebcrypto.so
+  macos-arm64/
+    libwebcrypto.dylib
+  macos-x64/
+    libwebcrypto.dylib
+  windows-x64/
+    webcrypto.dll
+```
+
+iOS uses the SDK name to avoid mixing device and simulator artifacts:
+
+```text
+prebuilt/
+  ios-iphoneos-arm64/
+    libwebcrypto.dylib
+  ios-iphonesimulator-arm64/
+    libwebcrypto.dylib
+```
+
+Android uses the target architecture name:
+
+```text
+prebuilt/
+  android-arm64/
+    libwebcrypto.so
+  android-x64/
+    libwebcrypto.so
+```
+
+## Source-Build Override
+
+Consumers and CI can force a source build even when a matching prebuilt exists:
+
+```yaml
+hooks:
+  user_defines:
+    webcrypto:
+      force_source_build: true
+```
+
+## Policy
+
+Do not accept arbitrary binary blobs from contributor PRs. Prebuilt libraries
+should be generated by trusted project automation or another reviewable release
+process.