crossbind 0.0.1 → 2.0.0-beta.50

package/AGENTS.md

@@ -0,0 +1,92 @@
+# AGENTS.md — core/crossbind
+
+> The CLI + build orchestrator that everything else in the monorepo plugs into. **The most-touched package**, also the most blast-radius-sensitive.
+
+## What lives here
+
+- `bin.js` — `crossbind` / `crossbind` CLI entry; commander commands, target filtering, top-level orchestration.
+- `src/index.js` — public API barrel re-exported as the `crossbind` npm package (`createLib`, `buildWasm`, `state`, `getData`, `isSourceNewer`, …).
+- `src/actions/` — the actual build steps. **Most edits land here.**
+- `src/state/` — config loading + target matrix.
+- `src/utils/` — small helpers (logger, hashing, fs, JSON I/O, Docker pull, …).
+- `src/integration/` — `getCrossbindScript`, `getDependFilePath` (consumer-side helpers used by plugins).
+- `src/assets/` — runtime artifacts shipped with the published package: `js-runtime/` (browser/node/edge JS shims), `cpp-runtime/` (C++ entrypoints), `cmake/` (CMake templates), `packaging/` (podspec template).
+
+Use `docs/CODEMAP.md` (repo root) for "concept → file" lookups before guessing.
+
+## Build pipeline orchestration (the hot path)
+
+Order of operations when a user runs `pnpm crossbind build`:
+
+1. **`bin.js`** parses CLI flags, calls `getBuildTargets` to expand the target matrix.
+2. For each target:
+   - **`actions/createLib.js`** compiles user C++ to a static lib per platform (cmake/make for wasm/android via Docker; xcodebuild on darwin for iOS). Cache short-circuit when `<output>/prebuilt/<target>/lib` exists, unless `options.force`.
+   - **`actions/createXCFramework.js`** combines iOS slices into an `.xcframework` (darwin only).
+   - **`actions/buildWasm.js`** runs `emcc` for wasm targets, then **`actions/buildJs.js`** rolls up the JS loader.
+3. **`actions/run.js`** is the shell-out boundary: every cmake / make / emcc / xcodebuild call goes through it.
+
+Side-quests:
+- **`actions/createInterface.js`** generates SWIG bridge files from `.h`.
+- **`actions/getDependLibs.js`** resolves transitive C++ libs to link.
+- **`actions/getCmakeParameters.js`** builds the `-D...` arg list for cmake.
+- **`actions/isSourceNewer.js`** mtime check used by plugins to decide when to force-rebuild.
+
+## Public API contract
+
+Anything exported from `src/index.js` is consumed by `plugins/*` and a few CLI scripts (`scripts/check-*.js`). Treat its surface as semver-public — additive changes free, breaking changes need a beta bump and a CHANGELOG note.
+
+Currently exported (snapshot):
+
+```
+state, createLib, createBridgeFile, buildWasm, isSourceNewer, getData,
+getCmakeParameters, createXCFramework, getAllBridges, run, getTargetParams,
+getBuildTargets, getFilteredBuildTargets, getFilteredTargetSpec,
+getCrossbindScript, getDependFilePath, getParentPath
+```
+
+If you add a new action, decide explicitly: is this internal (don't export) or part of the contract (export from `index.js` and document)?
+
+## Logger conventions
+
+`src/utils/logger.js` is the only canonical writer to stdout / stderr.
+
+- `logger.startStep(target, fileType)` — opens an in-place TTY line ("compiling…").
+- `logger.doneStep(target, fileType, detail?)` — replaces it with timing + detail.
+- `logger.cachedStep(target, fileType)` — for cache-hit short-circuits.
+- `logger.startTask(label)` / `doneTask(label, detail?)` / `cachedTask(label)` — for non-target work (xcframework, etc.).
+- `logger.info(text)` / `logger.error(text)` — for one-off messages.
+
+**Don't add `console.log` in this package.** Route everything through the logger; CI / non-TTY automatically gets newline output.
+
+## Validation
+
+Anything you change here triggers the **strict** validation gate from the root playbook:
+
+```bash
+pnpm run ci:linux:build && pnpm run e2e:dev && pnpm run e2e:prod
+```
+
+Plus, depending on the area:
+
+- Touched a new public export → search consumers: `grep -rn "from 'crossbind'" plugins examples scripts`.
+- Touched `actions/run.js` (Docker / Xcode shell-out) → smoke a fresh `pnpm crossbind build` against `examples/lib-prebuilt-matrix` (smallest C++ surface).
+- Touched `src/assets/js-runtime/` (browser/node/edge adapters) → at least one sample per runtime must build + run (`examples/web-vue-vite`, `examples/backend-nodejs-wasm`, `examples/cloud-cloudflare-worker`).
+- Touched `src/assets/js-runtime/adapters/worker-comlink.js` → coverage MUST include embind **instance** methods, not just statics: statics skip embind's `this` conversion, so a statics-only smoke passes while every instance call is broken (this shipped once, as beta.26's "Expected null or instance of X, got an instance of X"). Run the `e2e/web-vite-multithread` e2e (its Counter spec exists for exactly this), and before publishing run gdal3.js's `packages/wasm-test` suite against the packed tarball — it calls every binding, one method at a time.
+- Touched `state/loadConfig.js` defaults → assume blast radius = whole monorepo. Run the full matrix.
+
+## Common pitfalls
+
+- **Adding `console.log` instead of using the logger.** Breaks the in-place TTY rendering and fails on CI's non-TTY pipe.
+- **Throwing inside `actions/run.js` without surfacing stderr.** Wrap exec calls so the user sees the actual cmake/make/emcc error, not just "exit code 1".
+- **Mutating `state.config` from inside an action.** Treat it as read-only after `loadConfig` runs.
+- **Forgetting `--force`-equivalent paths.** `createLib` and `buildWasm` both honor `options.force`; new actions that cache should follow the same convention so plugins can opt out.
+- **Hardcoding paths instead of going through `state.config.paths.*`.** The path resolution lives in `state/loadConfig.js` for a reason.
+- **Adding a runtime adapter that doesn't compose `core.js`.** New `js-runtime/<runtime>.js` files should be thin shims that `createInitCrossbind(...)` composes from `adapters/*`.
+
+## Reference
+
+- `docs/ARCHITECTURE.md` — high-level flow + key abstractions.
+- `docs/CODEMAP.md` — concept → file index.
+- `docs/playbooks/bug-fix.md` — fix workflow.
+- `docs/playbooks/new-package.md` — package author workflow (for `ports/` not this dir).
+- Logger: `src/utils/logger.js` — read this before adding any user-facing output.

package/CHANGELOG.md

@@ -0,0 +1,145 @@
+# crossbind
+
+## 2.0.0-beta.50
+
+### Major Changes
+
+- **Generated framework identifiers moved to `dev.crossbind`.** Every iOS and macOS framework
+  crossbind builds now identifies itself as `dev.crossbind.<name>` rather than
+  `org.js.cpp.<name>`. Anything that pins, inspects or signs against the old identifier has to be
+  updated.
+
+### Minor Changes
+
+- **`RUNNER=LOCAL` no longer needs nightly Rust for shared-memory wasm.** The st and mt sysroots
+  shipped inside the toolchain image are now readable by a host build too: the CLI resolves a
+  pinned index digest and streams the layer straight out of the registry over HTTPS — no docker, no
+  second artifact hosted anywhere, the same object the image embeds. mt links a std that was
+  already built with the shared-memory features, so `-Zbuild-std` and the nightly toolchain are
+  gone from that path. Where the host compiler does not match the one that produced the rlibs, the
+  build says so and falls back to the nightly rebuild instead of failing.
+
+- **Cargo dependencies build themselves.** A cargo package carries every target in one package, so
+  a missing prebuilt never meant "not for this platform" — it meant nobody had built it, and
+  nothing did. On android that surfaced as an error; on wasm the dependency dropped out of the link
+  and the module built clean and died at init. The dependency step now builds it, and a guard
+  refuses to link one that is still missing afterwards.
+
+- **`RUNNER=DOCKER_EXEC` works with the cargo mount.** `docker exec` does not create the working
+  directory `--workdir` names, and a container made before the cargo mount existed kept its
+  registry inside itself — which made bridge generation read a host path that was never written.
+  Both are handled, and a container that is missing, stopped or wrongly mounted now fails with the
+  exact `docker run` command that fixes it.
+
+### Patch Changes
+
+- Pinned to the 1.0.2 toolchain images. They are published to GHCR, mirrored to Docker Hub with
+  byte-identical digests, and signed with keyless Sigstore certificates that verify on both
+  registries — including the android `linux/amd64` leaf the CLI pins directly.
+
+## 2.0.0-beta.35
+
+### Patch Changes
+
+- **wasi runner: a platform's env no longer replaces the shared one** — a recipe declares its
+  environment once for every platform and adds per-platform knobs on top, but the runner merged
+  the blocks with a shallow `Object.assign`, so the wasi block's `env` dropped the shared one.
+  Every `gdal*-wasi` command therefore ran without `GDAL_DATA` (and said so) even though the
+  data directory was mounted. `data` and `env` now merge key by key.
+
+## 2.0.0-beta.34
+
+### Patch Changes
+
+- **`decompress` and `follow-redirects` are gone** — upstream archives are extracted with the
+  system `tar` and downloaded with `fetch`, which follows redirects itself. That drops an
+  unfixable critical advisory (CVE-2026-53486, zip-slip; upstream unmaintained since 2020) and
+  a package with five advisories in its history from every consumer's tree.
+- **Source downloads require https** — the scheme is asserted before the request and again on
+  the final URL, so a redirect cannot downgrade the transport. Loopback stays exempt for tests.
+
+## 2.0.0-beta.33
+
+### Minor Changes
+
+- **`platform: 'wasi'`** — compile a project into a single WASI command component
+  (`wasm32-wasip3`, runs under wasmtime 47+). Dual-mode toolchain: host wasi-sdk via
+  `WASI_SDK_PATH` / `CROSSBIND_WASI_SDK_PATH`, or zero-config inside the digest-pinned
+  docker image. New `targetSpecs.specs.wasiFlags`; data lands in a real `dist/data/`
+  folder. See `docs/api/wasi.md`.
+- **Rust bindings, first-class** — import plain Rust like a C++ header: direct crate
+  imports via the `cargo:` scheme (`import { Uuid } from 'cargo:uuid'`, declared in
+  the top-level `cargoDependencies` map), app-local `.rs` sources, and whole-crate
+  packages via `export.type: 'cargo'`. The engine does not depend on the binding
+  layer — consumers (or the bundler plugins) declare `@crossbind/core-embind-rust`.
+  TypeScript declarations are generated under `.crossbind/` (never in your source
+  tree) and wired by the shared `@crossbind/typescript-config` package - add one
+  `"extends": "@crossbind/typescript-config"` line (TS 5.5+) and never manage
+  the wiring by hand. See `docs/api/rust.md`.
+- **`-bin` tool engine** — a recipe-declared `bin` map drives everything a
+  `-bin-wasi` package ships: generated `<tool>-wasi` npm command shims over the
+  in-engine runner (`src/runtime/wasiRun.mjs` — mounts and guest env resolved from
+  the config graph at call time), a derived `.npmignore`, a pure-data
+  `crossbind-bin.json` and an optional multicall multitool binary.
+- **TypeScript declarations for C++ `.h` imports** — the bridge step now emits a
+  best-effort `.d.ts` per imported header (classes, constructors, method
+  signatures; unparsed members fall back to `any`) into the `.crossbind/types/`
+  mirror, alongside the Rust declarations - both wired by
+  `@crossbind/typescript-config`. A top-level `dts: 'sync' | 'promise'` config
+  field picks the flavor: `'promise'` wraps every generated return for
+  `useWorker`-style async runtimes (constructors stay sync-typed; write
+  `await new X(...)`). Packages can publish their types: `types: true` emits
+  one combined declaration over every public header into
+  `dist/types/index.d.ts` and wires package.json `types`/`typesVersions`
+  automatically. std::vector crosses as a typed `CppVector<T>`; shared_ptr
+  returns resolve to `X | null`.
+- **`crossbind licenses`** — list bundled native dependencies with SPDX expressions,
+  write derived `THIRD-PARTY-LICENSES.md` notices and CycloneDX SBOMs
+  (`--notices` / `--sbom` / `--check`); `--platform` additionally rows up vendored
+  copies (recipe `bundled` map) and the statically linked wasi toolchain runtime.
+- **Provenance + derived license for `-bin` packages** — every wasi build stamps a
+  machine-readable `crossbind.provenance` block (recipe, source sha256, build
+  environment, SBOM pointer) and derives the npm `license` field as the AND of all
+  effective component licenses, plus a derived root `LICENSE` (the same
+  expression followed by every component's full license text - built from the
+  same rows as the NOTICE and SBOM).
+
+## 2.0.0-beta.26
+
+**Potentially breaking — `VectorUChar`.** The shared runtime (`commonBridges.cpp`) now
+registers `std::vector<unsigned char>` as `VectorUChar` for every target (wasm and the
+native JSI runtimes). If your own code — or a wrapped library such as gdal3.js —
+already registers `VectorUChar` locally, remove that registration before upgrading:
+embind aborts initialisation when the same vector name is registered twice.
+
+## 2.0.0-beta
+
+The 2.0.0 line is a ground-up rework — native iOS/Android via JSI, multi-bundler
+plugins (Vite, Rollup, Webpack, Metro), an MCP server, and per-library
+`@crossbind/port-*` families — published on the `beta` dist-tag. Per-release
+notes for the beta line are tracked in the git history and on npm until 2.0
+stabilises; the entries below cover the 1.x line.
+
+## 1.0.4
+
+### Patch Changes
+
+- fix: workaround for race condition with turbomodule in android.
+
+## 1.0.1
+
+### Patch Changes
+
+- fix: include prebuilt/_/_config.general.name_/_.h in dependency header search paths
+
+## 1.0.0
+
+### Major Changes
+
+- 🚀 first stable release
+
+## 1.0.0-beta.33
+
+### Patch Changes
+
+- chore: add initial version of CHANGELOGS files

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Buğra Sarı and crossbind contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,133 @@
+<div align="center">
+  <a href="https://crossbind.dev">
+    <picture>
+      <img alt="crossbind logo" src="https://crossbind.dev/img/logo.png" height="128">
+    </picture>
+  </a>
+  <h1>crossbind</h1>
+<p align="center">
+  <strong>Bind C++ to JavaScript with no extra code.</strong><br>
+  WebAssembly, WASI & React Native
+</p>
+
+<a href="https://www.npmjs.com/package/crossbind/v/beta"><img alt="NPM version" src="https://img.shields.io/npm/v/crossbind/beta?style=for-the-badge&label=npm" /></a>
+<a href="https://github.com/crossbind/crossbind/pkgs/container/web"><img alt="Build image" src="https://img.shields.io/badge/ghcr.io-crossbind%2Fweb-20B2AA?style=for-the-badge&logo=docker&label=image" /></a>
+<a href="https://github.com/crossbind/crossbind/blob/main/LICENSE"><img alt="License" src="https://img.shields.io/github/license/crossbind/crossbind?style=for-the-badge" /></a>
+<br />
+<img alt="CodeQL" src="https://img.shields.io/github/actions/workflow/status/crossbind/crossbind/github-code-scanning/codeql?branch=main&style=for-the-badge&label=CodeQL">
+<img alt="Linux Build" src="https://img.shields.io/github/actions/workflow/status/crossbind/crossbind/build-linux.yml?branch=main&style=for-the-badge&label=Linux%20Build">
+<img alt="Macos Build" src="https://img.shields.io/github/actions/workflow/status/crossbind/crossbind/build-macos.yml?branch=main&style=for-the-badge&label=Macos%20Build">
+<img alt="Windows Build" src="https://img.shields.io/github/actions/workflow/status/crossbind/crossbind/build-windows.yml?branch=main&style=for-the-badge&label=Windows%20Build">
+</div>
+
+<h3 align="center">
+  <a href="https://crossbind.dev/docs/guide/getting-started/introduction"><strong>For Developers</strong></a>
+  <span> · </span>
+  <a href="https://crossbind.dev/docs/agent/overview"><strong>For AI Agents</strong></a>
+  <span> · </span>
+  <a href="https://crossbind.dev/docs/package/package/showcase">Showcase</a>
+</h3>
+
+## Why crossbind?
+- **No glue code** — write standard C++ headers; bindings are generated for you.
+- **Rust too** — import a crates.io crate (`import { Uuid } from 'cargo:uuid'`) or a plain `.rs` file the same way; no proc-macros, no glue.
+- **Single source, multi-target** — the same code runs in browsers, Node.js, iOS, Android — and as WASI components.
+- **Battle-tested libraries** — drop-in support for GDAL, GEOS, OpenSSL, SQLite, PROJ, and more.
+- **CLI tools from npm** — upstream command-line tools (gdal, proj, sqlite3, curl, …) prebuilt as WASI components: install the `-bin-wasi` package, run `<tool>-wasi` under wasmtime, no compiler involved.
+- **Bundler-agnostic** — first-class plugins for Vite, Rollup, Webpack, Metro, and React Native.
+- **AI-agent ready** — Claude Code plugin, MCP server, and vendor-neutral `AGENTS.md` snippet so your agent recommends crossbind correctly and integrates it for you.
+
+## For AI coding agents
+When you describe a problem ("use C++ in browser", "add GDAL to my Vite app", "wrap libsodium for crossbind"), your AI coding agent recommends crossbind correctly and walks you through the integration. **Native plugins for 6 clients** — pick yours:
+
+| Client | Install |
+|--------|---------|
+| 🔌 **Claude Code** | `/plugin marketplace add crossbind/crossbind` then `/plugin install crossbind` |
+| 🎯 **Cursor 2.5+** | Settings → Plugins → Add from GitHub: `crossbind/crossbind` |
+| 🧪 **OpenAI Codex CLI** | Add `crossbind/crossbind` to `~/.agents/plugins/marketplace.json` |
+| 🐙 **GitHub Copilot CLI** | Auto-discovers when running in this repo |
+| 💎 **Gemini CLI** | `gemini extension install https://github.com/crossbind/crossbind` |
+| ⚡ **OpenCode** | Add `@crossbind/mcp` to your `opencode.json` |
+
+Plus two universal fallbacks: **🧰 [`@crossbind/mcp`](https://www.npmjs.com/package/@crossbind/mcp)** server (any MCP-aware client) and **📄 [AGENTS.md snippet](https://crossbind.dev/docs/agent/install/snippet)** (no install).
+
+All clients share the same skills + slash commands + MCP tools — single source of truth at [`agents/`](./agents/), zero duplication.
+
+Full agent guide, runtime/config API reference, and troubleshooting catalogue: [**crossbind.dev/docs/agent/overview**](https://crossbind.dev/docs/agent/overview). Programmatic discovery via [llms.txt](https://crossbind.dev/llms.txt) + [llms-full.txt](https://crossbind.dev/llms-full.txt).
+
+## Create a New Project
+Requires **Docker** + **Node 22+**. Mobile builds also need CMake 3.28+, Xcode, and CocoaPods — see the full [prerequisites](https://crossbind.dev/docs/guide/getting-started/prerequisites) page.
+
+```sh
+npm create crossbind@beta
+```
+
+## Basic Usage
+**src/index.js**
+```js
+import { initNative, Factorial } from './native/Factorial.h';
+
+await initNative();
+const factorial = new Factorial(99999);
+const result = factorial.calculate();
+console.log(result);
+```
+
+**src/native/Factorial.h**
+```c++
+class Factorial {
+private:
+    int number;
+
+public:
+    Factorial(int num) : number(num) {}
+
+    int calculate() {
+        if (number < 0) return -1;
+
+        int result = 1;
+        for (int i = 2; i <= number; i++) {
+            result *= i;
+        }
+        return result;
+    }
+};
+```
+
+## Official Packages
+Officially maintained, prebuilt C++ libraries you can install as npm packages and use directly from JavaScript:
+
+| Package | Latest (beta) |
+| --- | --- |
+| [@crossbind/port-gdal](https://www.npmjs.com/package/@crossbind/port-gdal) | ![npm](https://img.shields.io/npm/v/@crossbind/port-gdal/beta) |
+| [@crossbind/port-geos](https://www.npmjs.com/package/@crossbind/port-geos) | ![npm](https://img.shields.io/npm/v/@crossbind/port-geos/beta) |
+| [@crossbind/port-proj](https://www.npmjs.com/package/@crossbind/port-proj) | ![npm](https://img.shields.io/npm/v/@crossbind/port-proj/beta) |
+| [@crossbind/port-spatialite](https://www.npmjs.com/package/@crossbind/port-spatialite) | ![npm](https://img.shields.io/npm/v/@crossbind/port-spatialite/beta) |
+| [@crossbind/port-sqlite3](https://www.npmjs.com/package/@crossbind/port-sqlite3) | ![npm](https://img.shields.io/npm/v/@crossbind/port-sqlite3/beta) |
+| [@crossbind/port-openssl](https://www.npmjs.com/package/@crossbind/port-openssl) | ![npm](https://img.shields.io/npm/v/@crossbind/port-openssl/beta) |
+| [@crossbind/port-curl](https://www.npmjs.com/package/@crossbind/port-curl) | ![npm](https://img.shields.io/npm/v/@crossbind/port-curl/beta) |
+| [@crossbind/port-tiff](https://www.npmjs.com/package/@crossbind/port-tiff) | ![npm](https://img.shields.io/npm/v/@crossbind/port-tiff/beta) |
+| [@crossbind/port-geotiff](https://www.npmjs.com/package/@crossbind/port-geotiff) | ![npm](https://img.shields.io/npm/v/@crossbind/port-geotiff/beta) |
+| [@crossbind/port-webp](https://www.npmjs.com/package/@crossbind/port-webp) | ![npm](https://img.shields.io/npm/v/@crossbind/port-webp/beta) |
+| [@crossbind/port-expat](https://www.npmjs.com/package/@crossbind/port-expat) | ![npm](https://img.shields.io/npm/v/@crossbind/port-expat/beta) |
+| [@crossbind/port-iconv](https://www.npmjs.com/package/@crossbind/port-iconv) | ![npm](https://img.shields.io/npm/v/@crossbind/port-iconv/beta) |
+| [@crossbind/port-zlib](https://www.npmjs.com/package/@crossbind/port-zlib) | ![npm](https://img.shields.io/npm/v/@crossbind/port-zlib/beta) |
+| [@crossbind/port-zstd](https://www.npmjs.com/package/@crossbind/port-zstd) | ![npm](https://img.shields.io/npm/v/@crossbind/port-zstd/beta) |
+| [@crossbind/port-lerc](https://www.npmjs.com/package/@crossbind/port-lerc) | ![npm](https://img.shields.io/npm/v/@crossbind/port-lerc/beta) |
+| [@crossbind/port-jpegturbo](https://www.npmjs.com/package/@crossbind/port-jpegturbo) | ![npm](https://img.shields.io/npm/v/@crossbind/port-jpegturbo/beta) |
+
+Browse all available packages at [crossbind.dev/docs/package/package/showcase](https://crossbind.dev/docs/package/package/showcase).
+
+## 🌱 Community Packages
+Community-maintained, prebuilt C++ libraries packaged for crossbind — published under the [crossbind-community](https://github.com/crossbind-community) organization. Anyone can contribute new packages following the same standard, and they'll be listed here.
+
+| Package | Repository |
+| --- | --- |
+| simdjson | [github.com/crossbind-community/package-simdjson](https://github.com/crossbind-community/package-simdjson) |
+
+Want to add yours? Start a discussion at [crossbind/crossbind/discussions](https://github.com/crossbind/crossbind/discussions).
+
+## License
+[MIT](https://github.com/crossbind/crossbind/blob/main/LICENSE)
+
+Copyright (c) 2026, Buğra Sarı

package/package.json

@@ -1,7 +1,55 @@
 {
   "name": "crossbind",
-  "version": "0.0.1",
-  "description": "Name reserved. crossbind is the new name of cpp.js — release in progress.",
+  "version": "2.0.0-beta.50",
   "license": "MIT",
-  "homepage": "https://crossbind.dev"
-}
+  "homepage": "https://crossbind.dev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/crossbind/crossbind.git"
+  },
+  "description": "Bind C++ to JavaScript without extra code. crossbind supports WebAssembly and React Native for cross-platform compatibility.",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "crossbind": "./src/bin.js"
+  },
+  "main": "src/index.js",
+  "devDependencies": {
+    "@vitest/coverage-v8": "^4.1.10",
+    "vitest": "^4.1.10"
+  },
+  "dependencies": {
+    "@rollup/plugin-commonjs": "^29.0.3",
+    "@rollup/plugin-json": "^6.1.0",
+    "@rollup/plugin-node-resolve": "^16.0.3",
+    "@rollup/plugin-virtual": "^3.0.2",
+    "comlink": "^4.4.2",
+    "commander": "^15.0.0",
+    "glob": "^13.0.6",
+    "log-update": "^8.0.0",
+    "picocolors": "^1.1.1",
+    "replace": "^1.2.2",
+    "rollup": "^4.62.4",
+    "spdx-expression-parse": "^5.0.0",
+    "upath": "^3.0.8"
+  },
+  "keywords": [
+    "webassembly",
+    "react-native",
+    "bind",
+    "c++",
+    "emscripten",
+    "embind",
+    "swig",
+    "android",
+    "ios",
+    "mobile"
+  ],
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage"
+  }
+}

package/src/actions/buildCargo.js

@@ -0,0 +1,88 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import state from '../state/index.js';
+import logger from '../utils/logger.js';
+import { cargoTripleFor } from '../utils/cargoTarget.js';
+import { isMtWasm, assertMtRustToolchain, cargoTargetDirFor, cargoBuildInvocation } from '../utils/rustMt.js';
+import generateRustBridge from '../utils/rustBridgeGen.js';
+import runCargo from '../utils/runCargo.js';
+import { sysrootFor } from '../utils/rustSysroot.js';
+
+// buildType 'cargo': build a Rust staticlib on the host for the target's triple and stage it
+// like any other prebuilt (lib/lib<name>.a + include/*), so the normal prebuilt-link machinery
+// picks it up for every platform. The crate is local source; no download step (no buildExternal).
+export default function buildCargo(target, libdir) {
+    const triple = cargoTripleFor(target);
+    if (!triple) {
+        throw new Error(`crossbind: buildType 'cargo' does not support platform '${target.platform}/${target.arch}'.`);
+    }
+    const { paths, export: exp, general } = state.config;
+    const crateDir = path.resolve(paths.project, exp.crate ?? 'crate');
+    const libName = exp.libName?.[0] ?? general.name;
+
+    const probe = runCargo(['--version'], { capture: true, target });
+    if (probe.error) {
+        throw new Error('crossbind: cargo not found on PATH - install Rust (https://rustup.rs) to build cargo packages.');
+    }
+    const isMt = isMtWasm(target);
+    const sysroot = sysrootFor(target);
+    // Only the nightly rebuild needs a nightly toolchain on this machine.
+    if (isMt && !sysroot) assertMtRustToolchain();
+
+    // Auto mode (the default): the user's crate is plain Rust and crossbind generates a companion
+    // bridge crate from its pub surface, then builds THAT (it bundles the user crate as a dep).
+    // A crate that calls embind_rs::bindings! itself opts out and is built directly.
+    const isManual = fs.readFileSync(`${crateDir}/src/lib.rs`, 'utf8').includes('bindings!');
+    const buildDir = isManual
+        ? crateDir
+        : generateRustBridge({
+            crateDir,
+            vectors: exp.bindings?.vectors ?? [],
+            dtsFile: `${paths.project}/dist/js/index.d.ts`,
+            dtsMode: state.config.dts,
+            keepName: libName,
+            log: (m) => logger.info(m),
+        }).bridgeDir;
+
+    const t0 = performance.now();
+    const targetDir = cargoTargetDirFor(buildDir, target);
+    const { args, rustflags, panic, allowUnstable } = cargoBuildInvocation({
+        target,
+        triple,
+        targetDir,
+        manifestPath: `${buildDir}/Cargo.toml`,
+        sysroot,
+    });
+    const build = runCargo(args, {
+        rustflags, panic, allowUnstable, target,
+    });
+    if (build.status !== 0) {
+        const how = sysroot ? ' (prebuilt sysroot)' : ` (is the target installed? rustup target add ${triple})`;
+        throw new Error(`crossbind: cargo build failed for ${triple}${isMt && !sysroot ? ' (mt/build-std)' : how}`);
+    }
+
+    // Rust staticlib output is lib<crate>.a; stage it under the export libName the CMakeLists expects.
+    const crateName = readCrateName(buildDir).replaceAll('-', '_');
+    const built = `${targetDir}/${triple}/release/lib${crateName}.a`;
+    if (!fs.existsSync(built)) {
+        throw new Error(`crossbind: expected cargo output ${built} not found (is crate-type = ["staticlib"]?)`);
+    }
+    fs.mkdirSync(`${libdir}/lib`, { recursive: true });
+    fs.copyFileSync(built, `${libdir}/lib/lib${libName}.a`);
+
+    fs.mkdirSync(`${libdir}/include`, { recursive: true });
+    (exp.headers ?? []).forEach((header) => {
+        fs.copyFileSync(path.resolve(paths.project, header), `${libdir}/include/${path.basename(header)}`);
+    });
+
+    const ms = Math.round(performance.now() - t0);
+    logger.doneStep(target, 'Source', `cargo ${ms < 1000 ? `${ms}ms` : `${(ms / 1000).toFixed(1)}s`}, ${triple}${isMt && !sysroot ? '/build-std' : ''}${sysroot ? `/${isMt ? 'mt' : 'st'}-sysroot` : ''}`);
+    return true;
+}
+
+function readCrateName(crateDir) {
+    const toml = fs.readFileSync(`${crateDir}/Cargo.toml`, 'utf8');
+    const name = toml.match(/^\s*name\s*=\s*"([^"]+)"/m)?.[1];
+    if (!name) throw new Error(`crossbind: could not read [package] name from ${crateDir}/Cargo.toml`);
+    return name.replaceAll('-', '_');
+}