crossbind 0.0.1 → 2.0.0-beta.51

package/src/actions/licenses.js

@@ -0,0 +1,156 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import state from '../state/index.js';
+import loadJs from '../utils/loadJs.js';
+import { isCopyleft } from '../utils/licenseReport.js';
+import familyManifestOf from '../utils/familyManifest.js';
+import { wasiToolchainIdentity } from '../utils/provenance.js';
+import { resolveWasiSdkPath } from '../utils/wasiToolchain.js';
+
+const LEGACY_LICENSE_FILES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING'];
+const WASI_LIBC_LICENSE = 'Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT';
+
+// License texts come from any extracted upstream source tree of the family (variants share the tarball).
+function findSourceDir(familyDir) {
+    const parent = path.dirname(familyDir);
+    for (const entry of fs.readdirSync(parent)) {
+        const src = path.join(parent, entry, '.crossbind', 'build', 'source');
+        if (fs.existsSync(src)) return src;
+    }
+    return null;
+}
+
+function readLicenseTexts(sourceDir, files) {
+    const texts = (files || []).map((file) => {
+        const filePath = sourceDir ? path.join(sourceDir, file) : null;
+        const body = filePath && fs.existsSync(filePath)
+            ? fs.readFileSync(filePath, 'utf8').trim()
+            : '(missing: build the package once to extract the upstream source)';
+        return `=== ${file} ===\n\n${body}`;
+    });
+    return texts.length > 0 ? texts.join('\n\n') : null;
+}
+
+// Vendored copies compiled into the artifact (recipe `bundled` map, keyed by platform)
+// become first-class notice/SBOM rows with texts from the family source tree.
+async function bundledRowsOf(node, platform) {
+    const recipe = await loadJs(node.paths.project, 'crossbind.build');
+    const entries = recipe?.bundled?.[platform];
+    if (!entries || entries.length === 0) return [];
+    const family = familyManifestOf(node);
+    const sourceDir = family ? findSourceDir(family.dir) : null;
+    return entries.map((entry) => ({
+        name: entry.name,
+        npmName: null,
+        version: null,
+        nativeVersion: entry.version || null,
+        license: entry.license,
+        licenseDeclared: entry.license,
+        licenseSelected: null,
+        licenseNotes: `${entry.notes ? `${entry.notes}; ` : ''}vendored inside ${node.general.name} ${node.package?.nativeVersion || ''}`.trim(),
+        sha256: null,
+        sourceUrl: null,
+        licenseText: readLicenseTexts(sourceDir, entry.files),
+        isCopyleft: isCopyleft(entry.license),
+    }));
+}
+
+// The wasi toolchain statically links its C/C++ runtime into every artifact; the
+// notice rows pin the identities from the actual sdk (or point at the docker digest).
+function wasiToolchainRows() {
+    const sdkPath = resolveWasiSdkPath(state.config.system);
+    const identity = sdkPath && fs.existsSync(`${sdkPath}/bin/clang`) ? wasiToolchainIdentity(sdkPath) : null;
+    const sdkLabel = identity?.version
+        ? `wasi-sdk ${identity.version}`
+        : 'the digest-pinned wasi-sdk docker image (see crossbind.provenance)';
+    const libcRef = identity?.['wasi-libc'] || 'main';
+    const llvmRef = identity?.llvm || 'main';
+    const shared = {
+        npmName: null, version: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
+    };
+    return [
+        {
+            ...shared,
+            name: 'wasi-libc',
+            nativeVersion: identity?.['wasi-libc'] || null,
+            license: WASI_LIBC_LICENSE,
+            licenseDeclared: WASI_LIBC_LICENSE,
+            sourceUrl: `https://github.com/WebAssembly/wasi-libc/tree/${libcRef}`,
+            licenseNotes: `C runtime statically linked by ${sdkLabel}; license texts: https://github.com/WebAssembly/wasi-libc/blob/${libcRef}/LICENSE-APACHE-LLVM , .../LICENSE-APACHE , .../LICENSE-MIT (musl and cloudlibc portions are documented there)`,
+        },
+        {
+            ...shared,
+            name: 'llvm-runtimes',
+            nativeVersion: identity?.['llvm-version'] || null,
+            license: 'Apache-2.0 WITH LLVM-exception',
+            licenseDeclared: 'Apache-2.0 WITH LLVM-exception',
+            sourceUrl: `https://github.com/llvm/llvm-project/tree/${llvmRef}`,
+            licenseNotes: `libc++, libc++abi, compiler-rt and libunwind statically linked by ${sdkLabel}; license text: https://github.com/llvm/llvm-project/blob/${llvmRef}/LICENSE.TXT`,
+        },
+    ];
+}
+
+async function buildRow(node) {
+    const recipe = await loadJs(node.paths.project, 'crossbind.build');
+    const manifest = node.package || null;
+    const nativeVersion = manifest?.nativeVersion || null;
+    let sourceUrl = null;
+    if (recipe?.getURL && nativeVersion) {
+        try {
+            sourceUrl = recipe.getURL(nativeVersion);
+        } catch (e) {
+            sourceUrl = null;
+        }
+    }
+    if (!sourceUrl) sourceUrl = manifest?.homepage || null;
+
+    const family = familyManifestOf(node);
+    const upstream = family?.manifest?.crossbind?.upstream?.license || null;
+    let license;
+    let licenseText;
+    if (upstream) {
+        license = upstream.selected || upstream.declared;
+        licenseText = readLicenseTexts(findSourceDir(family.dir), upstream.files);
+    } else {
+        license = manifest?.license || null;
+        const legacy = LEGACY_LICENSE_FILES
+            .map((name) => `${node.paths.project}/${name}`)
+            .find((file) => fs.existsSync(file));
+        licenseText = legacy ? fs.readFileSync(legacy, 'utf8') : null;
+    }
+
+    return {
+        name: node.general.name,
+        npmName: manifest?.name || null,
+        version: manifest?.version || null,
+        nativeVersion,
+        license,
+        licenseDeclared: upstream?.declared || null,
+        licenseSelected: upstream?.selected || null,
+        licenseNotes: upstream?.notes || null,
+        sha256: recipe?.sha256 || null,
+        sourceUrl,
+        licenseText,
+        isCopyleft: isCopyleft(license),
+    };
+}
+
+// platform (optional, e.g. 'wasi') additionally includes what that platform's
+// artifact statically links beyond the package graph: recipe-declared vendored
+// copies and the toolchain runtime.
+export default async function collectLicenseRows(platform = null) {
+    // The root package is a component too: leaf -wasi packages have no deps but ship their own upstream.
+    const nodes = [state.config, ...state.config.allDependencies]
+        .filter((node) => node?.general?.alias?.package && node.paths?.project);
+    const rows = [];
+    const seen = new Set();
+    for (const node of nodes) {
+        const key = node.general.alias.package;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        rows.push(await buildRow(node));
+        if (platform) rows.push(...await bundledRowsOf(node, platform));
+    }
+    if (platform === 'wasi') rows.push(...wasiToolchainRows());
+    return rows.sort((a, b) => a.name.localeCompare(b.name));
+}

package/src/actions/run.js

@@ -0,0 +1,307 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import pullDockerImage, { getDockerImage, getDockerContainerName, imageRoleFor } from '../utils/pullDockerImage.js';
+import getOsUserAndGroupId from '../utils/getOsUserAndGroupId.js';
+import replaceBasePathForDockerUtil from '../utils/replaceBasePathForDocker.js';
+import state from '../state/index.js';
+import { wasiCFlags, wasiCxxFlags, resolveWasiSdkPath, WASI_TARGET_TRIPLE } from '../utils/wasiToolchain.js';
+
+// Native builds can outrun Node's 1 MiB default pipe buffer; without a raised cap a successful build dies with ENOBUFS.
+const EXEC_MAX_BUFFER = 512 * 1024 * 1024;
+const CROSSCOMPILER_ARM64 = 'aarch64-linux-android33';
+const CROSSCOMPILER_x86_64 = 'x86_64-linux-android33';
+const ANDROID_NDK = '/opt/android-sdk/ndk/27.3.13750724';
+const t = `${ANDROID_NDK}/toolchains/llvm/prebuilt/linux-x86_64/bin`;
+const t2 = `${ANDROID_NDK}/toolchains/llvm/prebuilt/linux-x86_64`;
+
+const iOSDevPath = '/Applications/Xcode.app/Contents/Developer';
+const iosBinPath = `${iOSDevPath}/Toolchains/XcodeDefault.xctoolchain/usr/bin`;
+const iosSdkPath = `${iOSDevPath}/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk`;
+const iosSimSdkPath = `${iOSDevPath}/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator.sdk`;
+
+const androidParamsArm64 = [
+    '-e', `AR=${t}/llvm-ar`,
+    '-e', `AS=${t}/llvm-as`,
+    '-e', `CC=${t}/${CROSSCOMPILER_ARM64}-clang`,
+    '-e', `CXX=${t}/${CROSSCOMPILER_ARM64}-clang++`,
+    '-e', `LD=${t}/ld`,
+    '-e', `RANLIB=${t}/llvm-ranlib`,
+    '-e', `STRIP=${t}/llvm-strip`,
+    '-e', `NM=${t}/nm`,
+    '-e', `CFLAGS=--sysroot=${t2}/sysroot`,
+];
+
+const androidParamsX86_64 = [
+    '-e', `AR=${t}/llvm-ar`,
+    '-e', `AS=${t}/llvm-as`,
+    '-e', `CC=${t}/${CROSSCOMPILER_x86_64}-clang`,
+    '-e', `CXX=${t}/${CROSSCOMPILER_x86_64}-clang++`,
+    '-e', `LD=${t}/ld`,
+    '-e', `RANLIB=${t}/llvm-ranlib`,
+    '-e', `STRIP=${t}/llvm-strip`,
+    '-e', `NM=${t}/nm`,
+    '-e', `CFLAGS=--sysroot=${t2}/sysroot`,
+];
+
+const IOS_HOST_FLAGS = `-arch arm64 -isysroot ${iosSdkPath} -fembed-bitcode`;
+const IOS_SIM_HOST_FLAGS = `-arch arm64 -isysroot ${iosSimSdkPath} -fembed-bitcode`;
+const IOS_IPHONE_PARAMS = [
+    '-e', `CFLAGS="${IOS_HOST_FLAGS}"`,
+    '-e', `CXXFLAGS="${IOS_HOST_FLAGS}"`,
+    '-e', `LDFLAGS="${IOS_HOST_FLAGS}"`,
+];
+const IOS_SIM_PARAMS = [
+    '-e', `CFLAGS="${IOS_SIM_HOST_FLAGS}"`,
+    '-e', `CXXFLAGS="${IOS_SIM_HOST_FLAGS}"`,
+    '-e', `LDFLAGS="${IOS_SIM_HOST_FLAGS}"`,
+];
+const iosParams = [
+    '-e', `AR=${iosBinPath}/ar`,
+    '-e', `AS=${iosBinPath}/as`,
+    '-e', `CC=${iosBinPath}/clang`,
+    '-e', `CXX=${iosBinPath}/clang++`,
+    '-e', `CPP=${iosBinPath}/cpp`,
+    '-e', `LD=${iosBinPath}/ld`,
+    '-e', `RANLIB=${iosBinPath}/ranlib`,
+    '-e', `STRIP=${iosBinPath}/strip`,
+    '-e', `NM=${iosBinPath}/llvm-nm`,
+];
+
+/* const iosMetalParams = [
+    '-e', `AR=${iosBinPath}/metal-ar`,
+    '-e', `AS=${iosBinPath}/metal-as`,
+    '-e', `CC=${iosBinPath}/clang`,
+    '-e', `CXX=${iosBinPath}/clang++`,
+    '-e', `CPP=${iosBinPath}/cpp`,
+    '-e', `LD=${iosBinPath}/ld`,
+    '-e', `RANLIB=${iosBinPath}/metal-ranlib`,
+    '-e', `STRIP=${iosBinPath}/metal-strip`,
+    '-e', `NM=${iosBinPath}/metal-nm`,
+    '-e', `CFLAGS="${IOS_HOST_FLAGS}"`,
+    '-e', `CXXFLAGS="${IOS_HOST_FLAGS}"`,
+    '-e', `LDFLAGS="${IOS_HOST_FLAGS}"`,
+]; */
+
+export default function run(program, params = [], platformPrefix = null, target = null, dockerOptions = {}) {
+    const buildPath = platformPrefix ? `${state.config.paths.build}/${platformPrefix}/${target.path}` : state.config.paths.build;
+    if (!fs.existsSync(buildPath)) {
+        fs.mkdirSync(buildPath, { recursive: true });
+    }
+
+    // wasi is host-run only with a locally configured wasi-sdk; otherwise docker carries it.
+    const wasiHostSdk = target?.platform === 'wasi' ? resolveWasiSdkPath(state.config.system) : null;
+    if ((target?.platform !== 'ios' && !(target?.platform === 'wasi' && wasiHostSdk)) || program !== null) {
+        // Google ships the linux NDK for x86_64 only, so the android index carries no arm64 leaf;
+        // pull its amd64 leaf by ref or an arm64 host finds no matching manifest.
+        pullDockerImage(imageRoleFor(target), target?.platform === 'android' ? 'linux/amd64' : undefined);
+    }
+
+    let dProgram = program;
+    let dParams = params;
+    let platformParams = [];
+    if (program === null) {
+        switch (target.platform) {
+            case 'wasm':
+                platformParams = ['-e', 'CXXFLAGS=-fwasm-exceptions', '-e', 'CFLAGS=-fwasm-exceptions'];
+                if (params[0].includes('configure')) dProgram = 'emconfigure';
+                else if (params[0] === 'make') dProgram = 'emmake';
+                else if (params[0] === 'cmake') dProgram = 'emcmake';
+                else if (params[0] === 'cc') dProgram = 'emcc';
+                break;
+            case 'wasi': {
+                const wasiSdk = wasiHostSdk || '/opt/wasi-sdk';
+                if (wasiHostSdk && !fs.existsSync(`${wasiHostSdk}/share/wasi-sysroot/lib/${WASI_TARGET_TRIPLE}`)) {
+                    throw new Error(`crossbind: the wasi-sdk at ${wasiHostSdk} has no ${WASI_TARGET_TRIPLE} sysroot. platform:'wasi' targets WASI 0.3 (p3) - upgrade to wasi-sdk >= 34.`);
+                }
+                [dProgram, ...dParams] = params;
+                platformParams = [
+                    '-e', `CC=${wasiSdk}/bin/clang`,
+                    '-e', `CXX=${wasiSdk}/bin/clang++`,
+                    '-e', `AR=${wasiSdk}/bin/ar`,
+                    '-e', `RANLIB=${wasiSdk}/bin/ranlib`,
+                    '-e', `NM=${wasiSdk}/bin/nm`,
+                    '-e', `CFLAGS=${wasiCFlags().join(' ')}`,
+                    '-e', `CXXFLAGS=${wasiCxxFlags().join(' ')}`,
+                ];
+                if (dProgram === 'cmake' && dParams[0] !== '--build' && dParams[0] !== '--install') {
+                    dParams = [
+                        ...dParams,
+                        `-DCMAKE_TOOLCHAIN_FILE=${wasiSdk}/share/cmake/wasi-sdk-p3.cmake`,
+                    ];
+                } else if (dProgram === 'wasi-clang++') {
+                    dProgram = `${wasiSdk}/bin/clang++`;
+                    platformParams = [];
+                } else if (dProgram === 'wasi-clang') {
+                    dProgram = `${wasiSdk}/bin/clang`;
+                    platformParams = [];
+                }
+                break;
+            }
+            case 'android':
+                [dProgram, ...dParams] = params;
+                platformParams = target.arch === 'x86_64' ? androidParamsX86_64 : androidParamsArm64;
+                if (dProgram === 'cmake') {
+                    dParams = [
+                        ...dParams,
+                        `-DCMAKE_TOOLCHAIN_FILE=${ANDROID_NDK}/build/cmake/android.toolchain.cmake`,
+                        `-DANDROID_ABI=${target.arch === 'x86_64' ? 'x86_64' : 'arm64-v8a'}`,
+                        '-DANDROID_PLATFORM=android-33',
+                        `-DANDROID_NDK=${ANDROID_NDK}`,
+                    ];
+                }
+                break;
+            case 'ios':
+                [dProgram, ...dParams] = params;
+                platformParams = [...iosParams, ...(target.arch === 'iphoneos' ? IOS_IPHONE_PARAMS : IOS_SIM_PARAMS)];
+                if (dProgram === 'cmake') {
+                    platformParams = [];
+                    if (dParams[0] !== '--build' && dParams[0] !== '--install') {
+                        dParams = [
+                            ...dParams,
+                            '-G', 'Xcode',
+                            '-DBUILD_SHARED_LIBS=OFF',
+                            '-DFRAMEWORK=TRUE',
+                            '-DCMAKE_OSX_DEPLOYMENT_TARGET=13.0',
+                            '-DCMAKE_SYSTEM_NAME=iOS',
+                            `-DMACOSX_FRAMEWORK_IDENTIFIER=dev.crossbind.${state.config.general.name}`,
+                            `-DCMAKE_XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER=dev.crossbind.${state.config.general.name}`,
+                            `-DCMAKE_OSX_SYSROOT='${target.arch === 'iphoneos' ? iosSdkPath : iosSimSdkPath}'`,
+                            '-DCMAKE_OSX_ARCHITECTURES=arm64',
+                            '-DCMAKE_SYSTEM_PROCESSOR=arm64',
+                            `-DCMAKE_C_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
+                            `-DCMAKE_CXX_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
+                            '-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY=\'iPhone Developer\'',
+                            `-DCMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM=${state.config.system.XCODE_DEVELOPMENT_TEAM}`,
+                        ];
+                    }
+                } else if (dProgram === 'ios-cmake') {
+                    dProgram = 'cmake';
+                    platformParams = [];
+                    if (dParams[0] !== '--build' && dParams[0] !== '--install') {
+                        dParams = [
+                            ...dParams,
+                            `-DCMAKE_TOOLCHAIN_FILE='${state.config.paths.cli}/assets/cmake/ios.toolchain.cmake'`,
+                            `-DPLATFORM=${target.arch === 'iphoneos' ? 'OS64' : 'SIMULATORARM64'}`,
+                            '-DARCHS=arm64',
+                            '-DENABLE_BITCODE=TRUE',
+                            '-DBUILD_SHARED_LIBS=OFF',
+                            '-DFRAMEWORK=TRUE',
+                            '-DCMAKE_OSX_DEPLOYMENT_TARGET=13.0',
+                            '-DCMAKE_SYSTEM_NAME=iOS',
+                            `-DMACOSX_FRAMEWORK_IDENTIFIER=dev.crossbind.${state.config.general.name}`,
+                            `-DCMAKE_XCODE_ATTRIBUTE_PRODUCT_BUNDLE_IDENTIFIER=dev.crossbind.${state.config.general.name}`,
+                            `-DCMAKE_OSX_SYSROOT='${target.arch === 'iphoneos' ? iosSdkPath : iosSimSdkPath}'`,
+                            '-DCMAKE_OSX_ARCHITECTURES=arm64',
+                            '-DCMAKE_SYSTEM_PROCESSOR=arm64',
+                            `-DCMAKE_C_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
+                            `-DCMAKE_CXX_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
+                            '-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY=\'iPhone Developer\'',
+                            `-DCMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM=${state.config.system.XCODE_DEVELOPMENT_TEAM}`,
+                        ];
+                    }
+                }
+                break;
+            default:
+        }
+    }
+
+    const env = {};
+    let runner = 'DOCKER';
+    if (((target?.platform === 'ios' || (target?.platform === 'wasi' && wasiHostSdk)) && program === null) || state.config.system.RUNNER === 'LOCAL') {
+        runner = 'LOCAL';
+    }
+
+    if (runner === 'LOCAL') {
+        const allowedEnv = [
+            '^PWD$', '^SHELL$', '^LC_CTYPE$', '^PATH$', '^HOME$', '^TMPDIR$', '^USER$',
+            '^PODS_*', '^CONFIGURATION_BUILD_DIR$', '^UNLOCALIZED_RESOURCES_FOLDER_PATH$',
+        ];
+        Object.entries(process.env).forEach(([key, value]) => {
+            if (allowedEnv.some((e) => key.match(e))) {
+                env[key] = value;
+            }
+        });
+    }
+
+    const pParams = [...platformParams, ...(dockerOptions.params || [])];
+    for (let i = 0; i < pParams.length; i += 2) {
+        if (pParams[i] === '-e') {
+            const [key, ...rest] = pParams[i + 1].split('=');
+            const value = rest.join('=');
+            if (['CFLAGS', 'CXXFLAGS', 'CPPFLAGS', 'LDFLAGS'].includes(key)) {
+                let v = value;
+                if (v.startsWith('\'') || v.startsWith('"')) {
+                    v = v.substring(1, v.length - 1);
+                }
+                if (env[key]) env[key] += ` ${v}`;
+                else env[key] = v;
+            } else {
+                env[key] = value;
+            }
+        }
+    }
+
+    let fileExecParams;
+    if (runner === 'LOCAL') {
+        env.PATH = `/opt/homebrew/bin:${env.PATH}`;
+
+        const options = {
+            cwd: dockerOptions.workdir || buildPath,
+            stdio: dockerOptions.console ? 'inherit' : ['ignore', 'pipe', 'pipe'],
+            env,
+            maxBuffer: EXEC_MAX_BUFFER,
+        };
+        fileExecParams = [dProgram, dParams, options];
+    } else if (runner === 'DOCKER') {
+        const dockerEnv = [];
+        Object.entries(env).forEach(([key, value]) => {
+            dockerEnv.push('-e', `${key}=${value}`);
+        });
+        const options = { cwd: buildPath, stdio: dockerOptions.console ? 'inherit' : ['ignore', 'pipe', 'pipe'], maxBuffer: EXEC_MAX_BUFFER };
+
+        let runnerParams;
+        let imageOrContainer;
+        const role = imageRoleFor(target);
+        if (state.config.system.RUNNER === 'DOCKER_RUN') {
+            imageOrContainer = getDockerImage(role);
+            runnerParams = ['run', '--rm', '-v', `${state.config.paths.base}:/tmp/crossbind/live`];
+            if (target?.platform === 'android') {
+                // Google ships the linux NDK for x86_64 only; use the amd64 leaf ref (classic store holds one platform per digest).
+                pullDockerImage(role, 'linux/amd64');
+                imageOrContainer = getDockerImage(role, 'linux/amd64');
+                runnerParams.push('--platform', 'linux/amd64');
+            }
+        } else if (state.config.system.RUNNER === 'DOCKER_EXEC') {
+            imageOrContainer = getDockerContainerName(state.config.paths.base, role);
+            runnerParams = ['exec'];
+        } else {
+            throw new Error(`The runner ${state.config.system.RUNNER} is invalid.`);
+        }
+
+        const args = [
+            ...runnerParams,
+            '--user', getOsUserAndGroupId(),
+            '--workdir', replaceBasePathForDocker(dockerOptions.workdir || buildPath),
+            ...replaceBasePathForDocker(dockerEnv),
+            // '-e', replaceBasePathForDocker(`CCACHE_DIR=${state.config.paths.build}/ccache`),
+            imageOrContainer,
+            replaceBasePathForDocker(dProgram),
+            ...replaceBasePathForDocker(dParams),
+        ];
+        fileExecParams = ['docker', args, options];
+    } else {
+        throw new Error(`The runner ${state.config.system.RUNNER} or command is invalid.`);
+    }
+
+    try {
+        execFileSync(...fileExecParams);
+    } catch (e) {
+        if (e?.stdout?.length) console.log(e.stdout.toString());
+        if (e?.stderr?.length) console.error(e.stderr.toString());
+        throw new Error(`crossbind: command failed${dProgram ? ` (${dProgram})` : ''} with exit code ${e?.status ?? 'unknown'}`, { cause: e });
+    }
+}
+
+function replaceBasePathForDocker(data) {
+    return replaceBasePathForDockerUtil(data, state.config.paths.base);
+}

package/src/actions/target.js

@@ -0,0 +1,54 @@
+import state from '../state/index.js';
+import { filterTargetSpecs } from '../utils/targets.js';
+
+const platforms = [...new Set(state.targets.map(target => target.platform).filter(t => t))];
+const archs = [...new Set(state.targets.map(target => target.arch).filter(t => t))];
+const runtimes = [...new Set(state.targets.map(target => target.runtime).filter(t => t))];
+const buildTypes = [...new Set(state.targets.map(target => target.buildType).filter(t => t))];
+const runtimeEnvs = [...new Set(state.targets.map(target => target.runtimeEnv).filter(t => t))];
+
+export function getTargetParams(givenTargetParams = {}, noParamCheck = false) {
+    const { platform, arch, runtime, buildType, runtimeEnv } = givenTargetParams;
+    if (!noParamCheck && (
+        (state.config.target.platform && platform && !platform.includes(state.config.target.platform))
+        || (state.config.target.arch && arch && !arch.includes(state.config.target.arch))
+        || (state.config.target.runtime && runtime && !runtime.includes(state.config.target.runtime))
+        || (state.config.target.buildType && buildType && !buildType.includes(state.config.target.buildType))
+        || (state.config.target.runtimeEnv && runtimeEnv && !runtimeEnv.includes(state.config.target.runtimeEnv))
+    )) {
+        throw new Error('Invalid target parameters');
+    }
+    return {
+        platform: state.config.target.platform ? [state.config.target.platform] : platform || platforms,
+        arch: state.config.target.arch ? [state.config.target.arch] : arch || archs,
+        runtime: state.config.target.runtime ? [state.config.target.runtime] : runtime || runtimes,
+        buildType: state.config.target.buildType ? [state.config.target.buildType] : buildType || buildTypes,
+        runtimeEnv: state.config.target.runtimeEnv ? [state.config.target.runtimeEnv] : runtimeEnv || runtimeEnvs,
+    };
+}
+
+export function getBuildTargets(targetParams) {
+    const { platform, arch, runtime, buildType, runtimeEnv } = targetParams;
+    return state.targets.filter(t => (
+        (!t.platform || platform.includes(t.platform))
+        && (!t.arch || arch.includes(t.arch))
+        && (!t.runtime || runtime.includes(t.runtime))
+        && (!t.buildType || buildType.includes(t.buildType))
+        && (!t.runtimeEnv || runtimeEnv.includes(t.runtimeEnv))
+    ));
+}
+
+export function getFilteredBuildTargets(targetParams, targetFilter) {
+    const buildTargets = getBuildTargets(targetParams);
+    return buildTargets.filter(t => (
+        (!targetFilter.platform || t.platform === targetFilter.platform)
+        && (!targetFilter.arch || t.arch === targetFilter.arch)
+        && (!targetFilter.runtime || t.runtime === targetFilter.runtime)
+        && (!targetFilter.buildType || t.buildType === targetFilter.buildType)
+        && (!targetFilter.runtimeEnv || t.runtimeEnv === targetFilter.runtimeEnv)
+    ));
+}
+
+export function getFilteredTargetSpec(targetSpecs, target) {
+    return filterTargetSpecs(targetSpecs, target);
+}

package/src/assets/cmake/CMakeLists.txt

@@ -0,0 +1,61 @@
+cmake_minimum_required(VERSION 3.28)
+set(CMAKE_CXX_STANDARD 17)
+project("${PROJECT_NAME}")
+
+option(BUILD_BRIDGE "Build Bridge" OFF)
+option(BUILD_SOURCE "Build Source" OFF)
+
+foreach(depend IN ZIP_LISTS DEPENDS_CMAKE_PATHS DEPENDS_CMAKE_NAMES)
+    # Source-cmake packages are linked (and their PUBLIC includes propagated) by this exact
+    # name below, so their CMakeLists must create the target as CROSSBIND_LIB_NAME.
+    set(CROSSBIND_LIB_NAME "${depend_1}")
+    add_subdirectory("${depend_0}" "${CMAKE_CURRENT_BINARY_DIR}/dependencies/${depend_1}")
+endforeach()
+
+if (BUILD_SOURCE)
+    file(GLOB_RECURSE BUILD_SRC_FILES ${NATIVE_GLOB})
+endif(BUILD_SOURCE)
+
+if (BUILD_BRIDGE)
+    file(GLOB BRIDGE_SRC_FILES "${BRIDGE_DIR}/*.i.cpp;${EXTERNAL_BRIDGE_GLOB}")
+endif(BUILD_BRIDGE)
+
+file(GLOB_RECURSE EXTERNAL_SRC_FILES ${EXTERNAL_NATIVE_GLOB})
+
+set(SRC_FILES "${BUILD_SRC_FILES}" "${BRIDGE_SRC_FILES}" "${EXTERNAL_SRC_FILES}")
+add_library("${PROJECT_NAME}" "${BUILD_TYPE}" ${SRC_FILES})
+
+set(EXTRA_LINK_LIBRARIES "")
+if(ANDROID)
+    set(EXTRA_LINK_LIBRARIES "log")
+endif()
+
+if (NOT ${COMPILE_OPTIONS} STREQUAL "")
+    target_compile_options("${PROJECT_NAME}" PUBLIC "${COMPILE_OPTIONS}")
+endif()
+
+if (NOT ${CMAKE_SYSTEM_NAME} STREQUAL "")
+    target_link_libraries("${PROJECT_NAME}" "${DEPENDS_CMAKE_NAMES}" "${EXTRA_LINK_LIBRARIES}")
+endif()
+
+file(GLOB_RECURSE HEADER_FILES ${HEADER_GLOB})
+target_include_directories("${PROJECT_NAME}" PUBLIC "${HEADER_DIR}")
+
+install(TARGETS "${PROJECT_NAME}" DESTINATION "lib")
+if(NOT "${HEADER_FILES}" STREQUAL "")
+    target_sources("${PROJECT_NAME}"
+        PUBLIC FILE_SET HEADERS
+        BASE_DIRS "${HEADER_DIR}"
+        FILES "${HEADER_FILES}")
+    install(TARGETS "${PROJECT_NAME}" FILE_SET HEADERS DESTINATION "include")
+endif()
+
+if (BUILD_SOURCE)
+
+endif(BUILD_SOURCE)
+unset(BUILD_SOURCE CACHE)
+
+if (BUILD_BRIDGE)
+    install(TARGETS "${PROJECT_NAME}")
+endif(BUILD_BRIDGE)
+unset(BUILD_BRIDGE CACHE)

package/src/assets/cmake/dist.cmake

@@ -0,0 +1,57 @@
+set(MY_LIST "___PROJECT_HOST___")
+LIST(FIND MY_LIST "${PROJECT_TARGET_HOST}" PACKAGE_HOST_INDEX)
+if(PACKAGE_HOST_INDEX EQUAL -1)
+    set(PROJECT_TARGET_HOST "${PROJECT_TARGET_HOST_RELEASE}")
+endif()
+LIST(FIND MY_LIST "${PROJECT_TARGET_HOST}" PACKAGE_HOST_INDEX)
+
+if(NOT PACKAGE_HOST_INDEX EQUAL -1)
+    cmake_minimum_required(VERSION 3.28)
+    set(CMAKE_CXX_STANDARD 11)
+    set(PROJECT_NAME "___PROJECT_NAME___")
+    set(PROJECT_LIBS "___PROJECT_LIBS___")
+    project("${PROJECT_NAME}")
+
+    if (APPLE AND CMAKE_SYSTEM_NAME STREQUAL "iOS")
+        set(PACKAGE_DIR "${PROJECT_SOURCE_DIR}/../..")
+    else()
+        set(PACKAGE_DIR "${PROJECT_SOURCE_DIR}/${PROJECT_TARGET_HOST}/lib")
+    endif()
+
+    set(PROJECT_LIBS_DIR)
+    foreach(L IN LISTS PROJECT_LIBS)
+        SET(FOUND_LIB "FOUND_LIB-NOTFOUND")
+        find_library(FOUND_LIB
+            NAMES "${L}"
+            PATHS "${PACKAGE_DIR}"
+            NO_CACHE
+            NO_DEFAULT_PATH
+            NO_CMAKE_FIND_ROOT_PATH
+            REQUIRED
+        )
+        LIST(APPEND PROJECT_LIBS_DIR ${FOUND_LIB})
+    endforeach()
+
+    add_library("${PROJECT_NAME}" INTERFACE)
+    # Cargo producers register through an init-array constructor nothing references. KEEP pins the
+    # generated keep symbol (--undefined) so only the registration object is pulled - never the
+    # whole archive, because each Rust staticlib bundles libstd and fully loading two of them
+    # duplicates thousands of std symbols. FORCE (manual-bindings crates, no keep symbol) falls
+    # back to whole-archive - safe only as the app's single loaded Rust archive. (Apple consumers
+    # get the equivalent flags from the generated podspec instead.)
+    set(PROJECT_RUST_LINK "___PROJECT_WHOLE_ARCHIVE___")
+    if(PROJECT_RUST_LINK STREQUAL "KEEP" AND NOT APPLE)
+        target_link_libraries("${PROJECT_NAME}" INTERFACE "${PROJECT_LIBS_DIR}")
+        foreach(L IN LISTS PROJECT_LIBS)
+            target_link_options("${PROJECT_NAME}" INTERFACE "-Wl,--undefined=crossbind_keep_${L}")
+        endforeach()
+    elseif(PROJECT_RUST_LINK STREQUAL "FORCE" AND NOT APPLE)
+        target_link_libraries("${PROJECT_NAME}" INTERFACE "$<LINK_LIBRARY:WHOLE_ARCHIVE,${PROJECT_LIBS_DIR}>")
+    else()
+        target_link_libraries("${PROJECT_NAME}" INTERFACE "${PROJECT_LIBS_DIR}")
+    endif()
+
+    if(NOT APPLE)
+        target_include_directories("${PROJECT_NAME}" INTERFACE "${PROJECT_SOURCE_DIR}/${PROJECT_TARGET_HOST}/include")
+    endif()
+endif()