crossbind 2.0.0-beta.60 → 2.0.0-beta.62

package/src/actions/createInterface.js

@@ -1,11 +1,13 @@
 
 import fs from 'node:fs';
+import { createRequire } from 'node:module';
 import upath from 'upath';
 import state, { saveCache } from '../state/index.js';
-import { getFileHash } from '../utils/hash.js';
+import { getContentHash, getFileHash } from '../utils/hash.js';
 import guardAsyncBindings from '../utils/bridgeAsyncGuard.js';
-import { writeHeaderDts, parseCppSurface } from '../utils/cppDts.js';
-import { injectFieldBindings } from '../utils/cppFieldBindings.js';
+import getDependFilePath from '../integration/getDependFilePath.js';
+import { writeHeaderDts } from '../utils/cppDts.js';
+import { ALL_NAMES, findHeaderImportsIn } from '../utils/headerImports.js';
 import {
     buildInterfaceContent, completingIncludes, findHeaderPrelude, findIgnoredDeclarations, indexTypeDefinitions, interfaceIncludes,
     interfaceToRetryWithoutMacros, parseMacroDump, referencedTypeHeaders, selectSwigMacros,
@@ -15,6 +17,9 @@ import run, { cxxPreprocessorFor } from './run.js';
 
 // Part of every interface hash, so interfaces cached by an older generator are rebuilt.
 const INTERFACE_FORMAT = 'swig-macros-1';
+// Part of every bridge hash: each bridge carries the SWIG fork's runtime and all bridges of a module must share it, so
+// bridges from a fork before field bindings and constants are rebuilt.
+const BRIDGE_FORMAT = 'swig-constants-1';
 const predefinedMacros = new Map();
 const typeDefinitions = new Map();
 
@@ -32,13 +37,6 @@ export default function createBridgeFile(headerOrModuleFilePath, target = state.
     const interfaceFile = createInterfaceFile(interfaceFilePath, target, sourceDir);
     const bridgeFile = createBridgeFileFromInterfaceFile(interfaceFile, target, sourceDir, getFileHash(interfaceFilePath));
     const moduleRegex = new RegExp(`.(${state.config.ext.module.join('|')})$`);
-    if (bridgeFile && !moduleRegex.test(interfaceFilePath)) {
-        // SWIG's -embind backend emits no member variables; inject .property lines for the
-        // header's public value fields. Idempotent, so the cached-bridge path is safe too.
-        const bridgeContent = fs.readFileSync(bridgeFile, 'utf8');
-        const injected = injectFieldBindings(bridgeContent, parseCppSurface(fs.readFileSync(interfaceFilePath, 'utf8'), () => {}));
-        if (injected !== bridgeContent) fs.writeFileSync(bridgeFile, injected);
-    }
     if (bridgeFile) {
         // Records which header this bridge came from, so directory-driven consumers
         // (getAllBridges) can prune bridges whose header no longer exists.
@@ -77,14 +75,21 @@ function createInterfaceFile(headerOrModuleFilePath, target, sourceDir) {
     const prelude = isModule ? [] : findHeaderPrelude(headerOrModuleFilePath, packages, headerPath);
     const ignored = isModule ? [] : findIgnoredDeclarations(headerOrModuleFilePath, packages, headerPath);
     const completing = includeRoot ? findCompletingIncludes(headerOrModuleFilePath, includeRoot, headerPath) : [];
-    // A prelude or ignored-declaration change in the owning package, or a completed class moving to another header, must
-    // regenerate the interface as well.
+    const filePathWithoutExt = headerOrModuleFilePath.match(/^(.*)\..+?$/)?.[1];
+    const interfaceFile = !isModule && filePathWithoutExt ? `${filePathWithoutExt}.i` : null;
+    const constants = isModule ? [] : importedNames(headerOrModuleFilePath, target);
+    // A prelude or ignored-declaration change in the owning package, a completed class moving to another header, an
+    // interface the package ships beside the header changing or going away, or another imported name must regenerate
+    // the interface as well.
     const fileHash = [
         INTERFACE_FORMAT, getFileHash(headerOrModuleFilePath), ...prelude,
         ...(ignored.length ? [`ignored:${ignored.join(',')}`] : []), ...(completing.length ? [`completing:${completing.join(',')}`] : []),
+        ...(interfaceFile && fs.existsSync(interfaceFile) ? [`shipped:${getFileHash(interfaceFile)}`] : []),
+        ...(constants.length ? [`constants:${constants === ALL_NAMES ? ALL_NAMES : constants.join(',')}`] : []),
     ].join('\n');
     const cachedInterface = state.cache.interfaces[headerOrModuleFilePath];
-    if (state.cache.hashes[headerOrModuleFilePath] === fileHash && cachedInterface && fs.existsSync(cachedInterface)) {
+    if (state.cache.hashes[headerOrModuleFilePath] === fileHash && cachedInterface && fs.existsSync(cachedInterface)
+        && !sharedInterface(headerOrModuleFilePath, cachedInterface)) {
         return cachedInterface;
     }
 
@@ -97,11 +102,7 @@ function createInterfaceFile(headerOrModuleFilePath, target, sourceDir) {
         return newPath;
     }
 
-    const temp = headerOrModuleFilePath.match(/^(.*)\..+?$/);
-    if (!temp || temp.length < 2) return null;
-
-    const filePathWithoutExt = temp[1];
-    const interfaceFile = `${filePathWithoutExt}.i`;
+    if (!filePathWithoutExt) return null;
 
     if (fs.existsSync(interfaceFile)) {
         const newPath = `${state.config.paths.build}/interface/${interfaceFile.split('/').at(-1)}`;
@@ -112,15 +113,16 @@ function createInterfaceFile(headerOrModuleFilePath, target, sourceDir) {
         return newPath;
     }
 
-    const fileName = filePathWithoutExt.split('/').at(-1);
+    const fileName = interfaceName(headerOrModuleFilePath, filePathWithoutExt.split('/').at(-1));
 
     const content = buildInterfaceContent({
         moduleName: fileName.toUpperCase(),
         headerPath,
         prelude,
         completing,
-        swigMacros: collectSwigMacros(headerOrModuleFilePath, interfaceIncludes(headerPath, prelude), fileName, target, sourceDir),
+        swigMacros: collectSwigMacros(headerOrModuleFilePath, interfaceIncludes(headerPath, prelude), fileName, target, sourceDir, constants),
         ignored,
+        constants,
     });
     const outputFilePath = `${state.config.paths.build}/interface/${fileName}.i`;
     fs.writeFileSync(outputFilePath, content);
@@ -132,6 +134,21 @@ function createInterfaceFile(headerOrModuleFilePath, target, sourceDir) {
     return outputFilePath;
 }
 
+const interfacePath = (name) => `${state.config.paths.build}/interface/${name}.i`;
+// Each platform build of a package ships its headers under dist/prebuilt/<target>/include: one header for the interface.
+const headerIdentity = (file) => file.match(/\/dist\/prebuilt\/[^/]+\/include\/(.+)$/)?.[1] ?? file;
+const sharedInterface = (headerFile, interfaceFile) => Object.entries(state.cache.interfaces)
+    .some(([other, file]) => headerIdentity(other) !== headerIdentity(headerFile) && file === interfaceFile);
+
+// An interface is named after its header's file name. A second header with that name (tiffio.h and tiffio.hxx, or one
+// name in two directories) takes its extension, then a hash of its path, so neither replaces the other's bridge.
+function interfaceName(headerFile, base) {
+    const candidates = [base, `${base}_${upath.extname(headerFile).slice(1)}`, `${base}_${getContentHash(headerFile).slice(0, 8)}`];
+    return candidates.find((name) => !sharedInterface(headerFile, interfacePath(name))) ?? candidates.at(-1);
+}
+
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
 // A header is included by its path under a project header directory or a dependency's include directory; one found only
 // through its own directory has no include root to search.
 function includeLocation(headerFile, target) {
@@ -139,7 +156,7 @@ function includeLocation(headerFile, target) {
     if (projectRoot) return { includeRoot: projectRoot, headerPath: headerFile.substr(projectRoot.length + 1) };
     const dependencyRoots = (state.config.dependencyParameters?.getCmakeDependsPathAndName(target).pathsOfCmakeDepends || [])
         .filter((d) => d.startsWith(state.config.paths.base));
-    const match = dependencyRoots.map((p) => headerFile.match(new RegExp(`^(${p}/.*?/include)/(.*?)$`, 'i'))).find(Boolean);
+    const match = dependencyRoots.map((p) => headerFile.match(new RegExp(`^(${escapeRegExp(p)}/.*?/include)/(.*?)$`, 'i'))).find(Boolean);
     return match ? { includeRoot: match[1], headerPath: match[2] } : { includeRoot: null, headerPath: headerFile.split('/').at(-1) };
 }
 
@@ -171,24 +188,70 @@ function dependencyHeadersOf(headerFile, target) {
         .map((header) => upath.join(includeRoot, header));
 }
 
+// The proxy module's own exports, never names of the header.
+const PROXY_NAMES = new Set(['initNative', 'AllSymbols']);
+const C_IDENTIFIER = /^[A-Za-z_]\w*$/;
+
+// A package header resolves under the target's prebuilt directory, and the bundler may resolve it for another target.
+const targetNeutral = (file) => file?.replace(/\/dist\/prebuilt\/[^/]+\/include\//, '/dist/prebuilt/*/include/');
+
+function realPath(file) {
+    if (!file) return null;
+    try {
+        return upath.normalize(fs.realpathSync(file));
+    } catch (e) {
+        return upath.resolve(file);
+    }
+}
+
+// A package that is not a crossbind dependency (the conformance kit) resolves the way the bundler finds it.
+function resolveHeaderImport(specifier, importer, target) {
+    if (specifier.startsWith('.')) return upath.resolve(upath.dirname(importer), specifier);
+    if (upath.isAbsolute(specifier)) return specifier;
+    try {
+        return getDependFilePath(specifier, target) ?? createRequire(importer).resolve(specifier);
+    } catch (e) {
+        return null;
+    }
+}
+
+// The names the app's own sources import from this header, or every name for `import * as`.
+function importedNames(headerFile, target) {
+    const projectDir = state.config.paths.project;
+    if (!projectDir || !fs.existsSync(projectDir)) return [];
+    const header = targetNeutral(realPath(headerFile));
+    const names = new Set();
+    for (const { importer, specifier, names: imported } of findHeaderImportsIn(projectDir, state.config.ext.header)) {
+        if (targetNeutral(realPath(resolveHeaderImport(specifier, importer, target))) !== header) continue;
+        if (imported === ALL_NAMES) return ALL_NAMES;
+        imported.filter((name) => C_IDENTIFIER.test(name) && !PROXY_NAMES.has(name)).forEach((name) => names.add(name));
+    }
+    return [...names].sort();
+}
+
 // A header that does not preprocess on its own, or a host without the image's compiler, keeps the plain interface.
-function collectSwigMacros(headerFile, includes, name, target, sourceDir) {
+function collectSwigMacros(headerFile, includes, name, target, sourceDir, constants) {
     const interfaceDir = `${state.config.paths.build}/interface`;
     try {
         if (!predefinedMacros.has(target.path)) {
             predefinedMacros.set(target.path, dumpMacros(`${interfaceDir}/predefined-${target.path}.macros.h`, [], [], target));
         }
-        const macros = dumpMacros(`${interfaceDir}/${name}.macros.h`, includes, swigIncludePath(target, sourceDir), target);
-        return selectSwigMacros({ headerText: fs.readFileSync(headerFile, 'utf8'), macros, predefined: predefinedMacros.get(target.path) });
+        const macros = dumpMacros(`${interfaceDir}/${name}.macros.h`, includes, swigIncludePath(target, sourceDir), target, [RELEASE_DEFINE]);
+        return selectSwigMacros({ headerText: fs.readFileSync(headerFile, 'utf8'), macros, predefined: predefinedMacros.get(target.path), constants });
     } catch (e) {
         console.warn(`crossbind: SWIG reads ${upath.basename(headerFile)} without the macros of its includes (${e.message})`);
         return [];
     }
 }
 
-function dumpMacros(outputFile, includes, includePath, target) {
+// Bridges compile in release with NDEBUG defined, so SWIG reads headers the same way: a declaration that exists only
+// without NDEBUG (sqlite3_mutex_held) would otherwise be bound and fail to compile. The predefined dump stays without
+// it, so NDEBUG counts as a macro SWIG needs rather than a compiler predefine.
+const RELEASE_DEFINE = '-DNDEBUG';
+
+function dumpMacros(outputFile, includes, includePath, target, defines = []) {
     run(cxxPreprocessorFor(target), [
-        '-x', 'c++', '-std=c++17', '-dM', '-E',
+        '-x', 'c++', '-std=c++17', '-dM', '-E', ...defines,
         ...includePath,
         ...includes.flatMap((header) => ['-include', header]),
         '-o', outputFile,
@@ -221,6 +284,16 @@ function applyAsyncGuard(bridgeFilePath) {
     }
 }
 
+// A build hides SWIG's output, so the SWIG fork writes each binding it skipped beside the bridge, under the path SWIG saw.
+function reportSkippedBindings(bridgeFilePath) {
+    const warningsFile = `${bridgeFilePath}.warnings`;
+    if (!fs.existsSync(warningsFile)) return;
+    fs.readFileSync(warningsFile, 'utf8').split('\n').filter(Boolean).forEach((line) => {
+        const [, file, lineNumber, message] = line.match(/^(.*):(\d+): (.*)$/) ?? [];
+        console.warn(`crossbind: ${file ? `${upath.basename(file)}:${lineNumber}: ${message}` : line}`);
+    });
+}
+
 // The interface text only names the header, so its hash alone kept a bridge across header edits: the
 // header's own hash is part of the key.
 function createBridgeFileFromInterfaceFile(interfaceFilePath, target, sourceDir = null, sourceHash = '') {
@@ -228,7 +301,7 @@ function createBridgeFileFromInterfaceFile(interfaceFilePath, target, sourceDir
         return null;
     }
 
-    const bridgeHash = () => `${getFileHash(interfaceFilePath)}\n${sourceHash}`;
+    const bridgeHash = () => `${BRIDGE_FORMAT}\n${getFileHash(interfaceFilePath)}\n${sourceHash}`;
     const fileHash = bridgeHash();
     const cachedBridge = state.cache.bridges[interfaceFilePath];
     if (state.cache.hashes[interfaceFilePath] === fileHash && cachedBridge && fs.existsSync(cachedBridge)) {
@@ -264,6 +337,7 @@ function createBridgeFileFromInterfaceFile(interfaceFilePath, target, sourceDir
         }
     }
     applyAsyncGuard(bridgeFilePath);
+    reportSkippedBindings(bridgeFilePath);
 
     state.cache.bridges[interfaceFilePath] = bridgeFilePath;
     state.cache.hashes[interfaceFilePath] = bridgeHash();

package/src/actions/createLib.js

@@ -21,7 +21,7 @@ export default function createLib(target, fileType, options = {}) {
         throw new Error('invalid target or options');
     }
 
-    if (target.platform === 'ios' && process.platform !== 'darwin') {
+    if ((target.platform === 'ios' || target.platform === 'darwin') && process.platform !== 'darwin') {
         return;
     }
 
@@ -35,7 +35,8 @@ export default function createLib(target, fileType, options = {}) {
     const nativeGlob = options.nativeGlob ? withDependencyBridges(options.nativeGlob) : undefined;
     // The lib dir is reused while the bridge list grows, so an early smaller nativeGlob build must not satisfy later sets: fingerprint the glob and miss on mismatch.
     const fingerprintFile = `${libdir}/crossbind-nativeglob.fingerprint`;
-    const fingerprint = nativeGlob ? getFilesFingerprint(nativeGlob) : null;
+    // options.inputs lists what the sources compile against (a binding runtime's headers), so a change there rebuilds too.
+    const fingerprint = nativeGlob ? getFilesFingerprint([...nativeGlob, ...(options.inputs ?? [])]) : null;
     const fingerprintChanged = fingerprint !== null
         && (!fs.existsSync(fingerprintFile) || fs.readFileSync(fingerprintFile, { encoding: 'utf8' }) !== fingerprint);
 

package/src/actions/getAllBridges.js

@@ -13,7 +13,7 @@ export default function getAllBridges(log = console.log) {
         if (!fs.existsSync(sidecar)) return true;
         const source = fs.readFileSync(sidecar, 'utf8').trim();
         if (!source || fs.existsSync(source)) return true;
-        [bridge, `${bridge}.exports.json`, `${bridge}.deps`, sidecar].forEach((f) => fs.rmSync(f, { force: true }));
+        [bridge, `${bridge}.exports.json`, `${bridge}.deps`, `${bridge}.warnings`, sidecar].forEach((f) => fs.rmSync(f, { force: true }));
         log(`crossbind: pruned stale bridge '${path.basename(bridge)}' - its header is gone`);
         return false;
     });

package/src/actions/getLinkInputs.js

@@ -0,0 +1,63 @@
+import fs from 'node:fs';
+import getDependLibs from './getDependLibs.js';
+import state from '../state/index.js';
+import buildAppRustCrates from '../utils/appRustCrates.js';
+
+// The archives of a final link (wasm or Node-API addon) and which of them must survive whole.
+// keepFlag spells "keep this symbol" for the target's linker.
+export default function getLinkInputs(target, { keepFlag }) {
+    const buildType = target.buildType === 'release' ? 'Release' : 'Debug';
+    const { build, output, cache } = state.config.paths;
+    const { name } = state.config.general;
+
+    // buildLib's cache is keyed on paths.output/prebuilt; after a cache clean the
+    // build-dir copy can be gone while the output artifact is still valid — link it then.
+    const sourceLibCandidates = [
+        `${build}/Source-${buildType}/${target.path}/lib${name}.a`,
+        `${output}/prebuilt/${target.path}/lib/lib${name}.a`,
+    ];
+    // App-local Rust surfaces (imported .rs files) arrive as ONE super staticlib; it is the
+    // single fully-loaded Rust archive of the link (see the libstd rule below).
+    const appRustLibs = buildAppRustCrates(target, cache, state.config.cargoDependencies ?? {});
+    const libs = [
+        ...getDependLibs(target),
+        ...appRustLibs,
+        sourceLibCandidates.find((lib) => fs.existsSync(lib)) ?? sourceLibCandidates[0],
+        `${build}/Bridge-${buildType}/${target.path}/lib${name}.a`,
+    ];
+
+    // By default only the Bridge archive is kept whole (see linkLayout.js) so the linker
+    // dead-code-eliminates everything unreferenced. Two escape hatches, both
+    // `export.wholeArchive: true`: on the APP it restores the legacy layout (every archive
+    // wholesale); on a LIBRARY's own config it keeps that library's archives whole in every
+    // consumer link (for members that self-register from static initializers).
+    const wholeArchiveAll = state.config.export.wholeArchive === true;
+    const wholeArchiveNames = new Set();
+    // Rust libstd rule: every Rust staticlib bundles its own libstd, so at most ONE Rust archive
+    // may be fully loaded (the app super staticlib). Generated cargo bridges are linked lazily
+    // with their keep symbol pinned (keepFlag pulls just the registration object); manual-bindings
+    // crates have no keep symbol and fall back to whole-archive - safe only while they are the
+    // single loaded Rust archive.
+    const rustKeepFlags = [];
+    if (appRustLibs.length > 0) wholeArchiveNames.add('crossbind_app_super');
+    const depends = state.config.dependencyParameters.getCmakeDepends(target);
+    depends.forEach((dep) => {
+        if (dep.export.wholeArchive === true) {
+            (dep.export.libName || []).forEach((libName) => wholeArchiveNames.add(libName));
+        }
+        if (dep.export.type === 'cargo') {
+            const crateLibRs = `${dep.paths.project}/${dep.export.crate ?? 'crate'}/src/lib.rs`.replace('/./', '/');
+            const isManual = fs.existsSync(crateLibRs) && fs.readFileSync(crateLibRs, 'utf8').includes('bindings!');
+            (dep.export.libName || []).forEach((libName) => {
+                if (isManual) wholeArchiveNames.add(libName);
+                else rustKeepFlags.push(keepFlag(libName));
+            });
+        }
+    });
+
+    const hasRust = rustKeepFlags.length > 0 || appRustLibs.length > 0
+        || depends.some((dep) => dep.export.type === 'cargo');
+    return {
+        libs, appRustLibs, wholeArchiveAll, wholeArchiveNames, rustKeepFlags, hasRust,
+    };
+}

package/src/actions/licenses.js

@@ -90,6 +90,39 @@ function wasiToolchainRows() {
     ];
 }
 
+// A Linux or Windows addon carries its C++ runtime; a Windows one also carries parts of the
+// mingw-w64 runtime and winpthreads, whose licenses ask for their notices in binary distributions.
+// A macOS addon uses the system's C++ runtime.
+function addonToolchainRows(platform) {
+    const shared = {
+        npmName: null, version: null, nativeVersion: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
+    };
+    const llvmLicense = 'Apache-2.0 WITH LLVM-exception';
+    const llvmRuntimes = {
+        ...shared,
+        name: 'llvm-runtimes',
+        license: llvmLicense,
+        licenseDeclared: llvmLicense,
+        sourceUrl: 'https://github.com/llvm/llvm-project',
+    };
+    const llvmText = 'license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT';
+    if (platform === 'linux') {
+        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the addon; ${llvmText}` }];
+    }
+    const mingwLicense = 'LicenseRef-MinGW-w64-runtime';
+    return [
+        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the addon; ${llvmText}` },
+        {
+            ...shared,
+            name: 'mingw-w64-runtime',
+            license: mingwLicense,
+            licenseDeclared: mingwLicense,
+            sourceUrl: 'https://github.com/mingw-w64/mingw-w64',
+            licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the addon; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
+        },
+    ];
+}
+
 async function buildRow(node) {
     const recipe = await loadJs(node.paths.project, 'crossbind.build');
     const manifest = node.package || null;
@@ -152,5 +185,6 @@ export default async function collectLicenseRows(platform = null) {
         if (platform) rows.push(...await bundledRowsOf(node, platform));
     }
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
+    if (platform === 'linux' || platform === 'win32') rows.push(...addonToolchainRows(platform));
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }

package/src/actions/run.js

@@ -6,6 +6,7 @@ import replaceBasePathForDockerUtil from '../utils/replaceBasePathForDocker.js';
 import { DOCKER_RUN_SECURITY_ARGS } from '../utils/dockerSecurity.js';
 import state from '../state/index.js';
 import { wasiCFlags, wasiCxxFlags, resolveWasiSdkPath, WASI_TARGET_TRIPLE } from '../utils/wasiToolchain.js';
+import { HOST_BUILT_PLATFORMS } from '../utils/targets.js';
 
 // Native builds can outrun Node's 1 MiB default pipe buffer; without a raised cap a successful build dies with ENOBUFS.
 const EXEC_MAX_BUFFER = 512 * 1024 * 1024;
@@ -64,6 +65,18 @@ const androidParamsX86_64 = [
 
 // Xcode 27 refuses deployment targets below 15.0; React Native's own floor is 15.1.
 const IOS_DEPLOYMENT_TARGET = '15.1';
+// Node 22, the oldest supported line, needs macOS 11.
+const DARWIN_DEPLOYMENT_TARGET = '11.0';
+const DARWIN_HOST_ARCH = process.arch === 'x64' ? 'x86_64' : 'arm64';
+const DARWIN_HOST_PACKAGE_PREFIXES = ['/opt/homebrew', '/usr/local', '/opt/local'];
+// Apple's own tools only, which find the SDK through xcrun. A GNU ar earlier on the PATH (Homebrew's
+// binutils) writes archives that Apple's linker rejects.
+const DARWIN_BUILD_PATH = '/usr/bin:/bin:/usr/sbin:/sbin';
+// The linux image's clang wrappers and CMake toolchain files, one per target triple.
+const LINUX_TOOLCHAIN = '/opt/crossbind/linux';
+// The windows image's llvm-mingw and its CMake toolchain files, one per target triple.
+const LLVM_MINGW = '/opt/llvm-mingw';
+const WINDOWS_TOOLCHAIN = '/opt/crossbind/windows';
 const IOS_HOST_FLAGS = `-arch arm64 -isysroot ${iosSdkPath} -fembed-bitcode`;
 const IOS_SIM_HOST_FLAGS = `-arch arm64 -isysroot ${iosSimSdkPath} -fembed-bitcode`;
 const IOS_IPHONE_PARAMS = ['-e', `CFLAGS="${IOS_HOST_FLAGS}"`, '-e', `CXXFLAGS="${IOS_HOST_FLAGS}"`, '-e', `LDFLAGS="${IOS_HOST_FLAGS}"`];
@@ -118,7 +131,7 @@ export default function run(program, params = [], platformPrefix = null, target
 
     // wasi is host-run only with a locally configured wasi-sdk; otherwise docker carries it.
     const wasiHostSdk = target?.platform === 'wasi' ? resolveWasiSdkPath(state.config.system) : null;
-    if ((target?.platform !== 'ios' && !(target?.platform === 'wasi' && wasiHostSdk)) || program !== null) {
+    if ((!HOST_BUILT_PLATFORMS.includes(target?.platform) && !(target?.platform === 'wasi' && wasiHostSdk)) || program !== null) {
         // Google ships the linux NDK for x86_64 only, so the android index carries no arm64 leaf;
         // pull its amd64 leaf by ref or an arm64 host finds no matching manifest.
         pullDockerImage(imageRoleFor(target), target?.platform === 'android' ? 'linux/amd64' : undefined);
@@ -237,6 +250,71 @@ export default function run(program, params = [], platformPrefix = null, target
                     }
                 }
                 break;
+            case 'linux': {
+                [dProgram, ...dParams] = params;
+                const triple = target.arch === 'x64' ? 'x86_64-linux-gnu' : 'aarch64-linux-gnu';
+                const tool = (name) => `${LINUX_TOOLCHAIN}/bin/${triple}-${name}`;
+                // The image's own .pc files describe its libraries, not the sysroot's. Every archive
+                // ends up inside a loadable .node module, so -fPIC holds even where a project turns
+                // position-independent code off for static builds, as GDAL does.
+                platformParams = [
+                    '-e', `CC=${tool('clang')}`, '-e', `CXX=${tool('clang++')}`,
+                    '-e', `AR=${tool('ar')}`, '-e', `RANLIB=${tool('ranlib')}`,
+                    '-e', `NM=${tool('nm')}`, '-e', `STRIP=${tool('strip')}`,
+                    '-e', 'PKG_CONFIG_LIBDIR=',
+                    '-e', 'CFLAGS=-fPIC', '-e', 'CXXFLAGS=-fPIC',
+                ];
+                if (dProgram === 'cmake' && dParams[0] !== '--build' && dParams[0] !== '--install') {
+                    dParams = [...dParams, `-DCMAKE_TOOLCHAIN_FILE=${LINUX_TOOLCHAIN}/${triple}.cmake`];
+                }
+                break;
+            }
+            case 'win32': {
+                [dProgram, ...dParams] = params;
+                const triple = target.arch === 'x64' ? 'x86_64-w64-mingw32' : 'aarch64-w64-mingw32';
+                const tool = (name) => `${LLVM_MINGW}/bin/${triple}-${name}`;
+                platformParams = [
+                    '-e', `CC=${tool('clang')}`, '-e', `CXX=${tool('clang++')}`,
+                    '-e', `AR=${tool('ar')}`, '-e', `RANLIB=${tool('ranlib')}`,
+                    '-e', `NM=${tool('nm')}`, '-e', `STRIP=${tool('strip')}`,
+                    '-e', `RC=${tool('windres')}`, '-e', `WINDRES=${tool('windres')}`,
+                    '-e', 'PKG_CONFIG_LIBDIR=',
+                ];
+                if (dProgram === 'cmake' && dParams[0] !== '--build' && dParams[0] !== '--install') {
+                    dParams = [...dParams, `-DCMAKE_TOOLCHAIN_FILE=${WINDOWS_TOOLCHAIN}/${triple}.cmake`];
+                }
+                break;
+            }
+            case 'darwin': {
+                [dProgram, ...dParams] = params;
+                const appleArch = target.arch === 'x64' ? 'x86_64' : 'arm64';
+                // Homebrew and MacPorts packages exist on the build machine only: an archive compiled
+                // against one fails to link, or to load, anywhere else. The SDK's libraries stay visible.
+                platformParams = ['-e', 'PKG_CONFIG_LIBDIR='];
+                if (dProgram === 'cmake') {
+                    if (dParams[0] !== '--build' && dParams[0] !== '--install') {
+                        dParams = [
+                            ...dParams,
+                            `-DCMAKE_OSX_ARCHITECTURES=${appleArch}`,
+                            `-DCMAKE_OSX_DEPLOYMENT_TARGET=${DARWIN_DEPLOYMENT_TARGET}`,
+                            // Every archive ends up inside a loadable .node module.
+                            '-DCMAKE_POSITION_INDEPENDENT_CODE=ON',
+                            `-DCMAKE_IGNORE_PREFIX_PATH=${DARWIN_HOST_PACKAGE_PREFIXES.join(';')}`,
+                            // The other architecture's probes cannot run here, so CMake has to know it cross-compiles.
+                            ...(appleArch === DARWIN_HOST_ARCH ? [] : ['-DCMAKE_SYSTEM_NAME=Darwin', `-DCMAKE_SYSTEM_PROCESSOR=${appleArch}`]),
+                        ];
+                    }
+                } else {
+                    const flags = `-arch ${appleArch} -mmacosx-version-min=${DARWIN_DEPLOYMENT_TARGET}`;
+                    // A --host triple sends configure after prefixed compilers (aarch64-apple-darwin-cc) that
+                    // Xcode does not ship, and SQLite's autosetup has no fallback to the plain names.
+                    platformParams.push(
+                        '-e', 'CC=/usr/bin/clang', '-e', 'CXX=/usr/bin/clang++',
+                        '-e', `CFLAGS=${flags}`, '-e', `CXXFLAGS=${flags}`, '-e', `LDFLAGS=${flags}`,
+                    );
+                }
+                break;
+            }
             default:
         }
     }
@@ -244,7 +322,7 @@ export default function run(program, params = [], platformPrefix = null, target
     const env = {};
     let runner = 'DOCKER';
     if (
-        ((target?.platform === 'ios' || (target?.platform === 'wasi' && wasiHostSdk)) && program === null) ||
+        ((HOST_BUILT_PLATFORMS.includes(target?.platform) || (target?.platform === 'wasi' && wasiHostSdk)) && program === null) ||
         state.config.system.RUNNER === 'LOCAL'
     ) {
         runner = 'LOCAL';
@@ -291,6 +369,12 @@ export default function run(program, params = [], platformPrefix = null, target
     let fileExecParams;
     if (runner === 'LOCAL') {
         env.PATH = `/opt/homebrew/bin:${env.PATH}`;
+        // A package's *-config script on the PATH (nc-config, sfcgal-config, ...) would compile that
+        // package into the archives. cmake is the one host tool a darwin build takes from the PATH.
+        if (target?.platform === 'darwin') {
+            if (dProgram === 'cmake') dProgram = findExecutable('cmake', env.PATH) ?? dProgram;
+            env.PATH = DARWIN_BUILD_PATH;
+        }
 
         const options = {
             cwd: dockerOptions.workdir || buildPath,
@@ -351,6 +435,17 @@ export default function run(program, params = [], platformPrefix = null, target
     }
 }
 
+function findExecutable(name, searchPath) {
+    return searchPath.split(':').map((dir) => `${dir}/${name}`).find((file) => {
+        try {
+            fs.accessSync(file, fs.constants.X_OK);
+            return true;
+        } catch {
+            return false;
+        }
+    });
+}
+
 function replaceBasePathForDocker(data) {
     return replaceBasePathForDockerUtil(data, state.config.paths.base);
 }

package/src/assets/cmake/CMakeLists.txt

@@ -30,7 +30,7 @@ if(ANDROID)
     set(EXTRA_LINK_LIBRARIES "log")
 endif()
 
-if (NOT ${COMPILE_OPTIONS} STREQUAL "")
+if (NOT "${COMPILE_OPTIONS}" STREQUAL "")
     target_compile_options("${PROJECT_NAME}" PUBLIC "${COMPILE_OPTIONS}")
 endif()
 

package/src/assets/cmake/dist.cmake

@@ -51,7 +51,7 @@ if(NOT PACKAGE_HOST_INDEX EQUAL -1)
         target_link_libraries("${PROJECT_NAME}" INTERFACE "${PROJECT_LIBS_DIR}")
     endif()
 
-    if(NOT APPLE)
+    if(NOT (APPLE AND CMAKE_SYSTEM_NAME STREQUAL "iOS"))
         target_include_directories("${PROJECT_NAME}" INTERFACE "${PROJECT_SOURCE_DIR}/${PROJECT_TARGET_HOST}/include")
     endif()
 endif()

package/src/assets/js-runtime/adapters/worker-comlink.js

@@ -210,9 +210,13 @@ Comlink.transferHandlers.set('embindObject', {
             && typeof obj.isDeleted === 'function';
     },
     serialize(obj) {
-        const id = registerEmbindObject(obj);
+        // An object a property returns comes wrapped by its owner's coercion proxy. Registering and exposing
+        // the raw object, as the proxy handler does, keeps objects read from it one wrapper deep, which an
+        // argument's unwrapping undoes.
+        const raw = unwrapCoercionProxy(obj);
+        const id = registerEmbindObject(raw);
         const { port1, port2 } = new MessageChannel();
-        Comlink.expose(wrapWithVectorCoercion(obj), port1);
+        Comlink.expose(wrapWithVectorCoercion(raw), port1);
         return [{ __embindId: id, port: port2 }, [port2]];
     },
     deserialize(data) {

package/src/assets/toolchain-digests.json

@@ -1,35 +1,49 @@
 {
-    "version": "1.0.6",
+    "version": "1.0.8",
     "registry": "ghcr.io/crossbind",
     "toolchains": {
         "rust": "1.98.1"
     },
     "images": {
         "rust-sysroot": {
-            "index": "sha256:b82285c6c74f0f2f21bd4f3d07af8a005b16b9e8faaecbe672f6e9b139616eb7",
+            "index": "sha256:d816d27f1f3b110aed92f7f81cb8eb99f58ba95cafc96a797c46f30536549a45",
             "platforms": {
-                "linux/arm64": "sha256:50f2bc41d084157bb2d63caa8a91486ea15d3aff248e0d84013a20c7b8cf0c57",
-                "linux/amd64": "sha256:65c63d0b3df31406c514a6ed9dbb5ba0940b27c94e2e89b3ceafedaee339bca8"
+                "linux/arm64": "sha256:217f908b3e1c883bed8cd4db65aae48044481e88126c09c3ce9bf754288d8720",
+                "linux/amd64": "sha256:15719494b51ea8ee6f3a71556b2c04f37828e632bc46d2c3fb7121a1afb37303"
             }
         },
         "base": {
-            "index": "sha256:3a742a779a68e0180ca43232b9e28047e469462c575f1cdef8a3af3ba984263b",
+            "index": "sha256:051aa70184d29e95d5192cc60cc42523b42fab72291efbf13f71006482f063c0",
             "platforms": {
-                "linux/amd64": "sha256:ff2a42fe5cdff75a9ce89fde340dbde5655f639de2e1288baeb61f2e82d1d095",
-                "linux/arm64": "sha256:2571179e6597369544a887da197e280ad9d15075719c04113cc2fd243358f56d"
+                "linux/arm64": "sha256:cdf189ad4ae220698088fda54c4a5005a207542bba8ab2c01fe58fc008586df8",
+                "linux/amd64": "sha256:f501545972e2a253b19f1900946cfe39ce5dea74600d885cae47db3f320b506b"
             }
         },
         "web": {
-            "index": "sha256:cd9065909b8e4aea584fbe6f6e0215773feaed97ab46e5ce265a487171f87757",
+            "index": "sha256:89e0ea288d42d9f24671e43b3e59dc6b9913e389b68e51d8f0e314e81d111bf3",
             "platforms": {
-                "linux/arm64": "sha256:224665ea653e6ff6e483fc24b226fa68bf45173a2598439665d827780cbe5534",
-                "linux/amd64": "sha256:862b197c13dbdf163d480d35e8b17f96b23b447701cb8e79f0252773d7a48a42"
+                "linux/amd64": "sha256:40fe9f7573ee5a696c68043b12486e4562e0b2a87f74ef21a9b11c08454aff75",
+                "linux/arm64": "sha256:7172f994c262600dcd1334806eee9b44e873ac42fe286bf8b0983491586d1225"
             }
         },
         "android": {
-            "index": "sha256:0d0b56a76cff5b16f52eba3a4d2b17bc888fb2ca502bfd0ae029bf837c6c354d",
+            "index": "sha256:ef6dc5ed724e7ea977a1f644793967a5ad7ff62b9a6bb6f2971d4a2a9e8f5a4b",
             "platforms": {
-                "linux/amd64": "sha256:77fb9007369c5c8003024aade231642afb798664f82aada1a8ac26b931a15fbf"
+                "linux/amd64": "sha256:d6843be98e4bc56a21e39b2670d081f60d27b45c149c0ee132d2c45bde337ec8"
+            }
+        },
+        "linux": {
+            "index": "sha256:e8b6e6afd1af9f3a84eee739bd25ce6abb8416c5af87a175b780cd18d871513d",
+            "platforms": {
+                "linux/amd64": "sha256:39fe90d1cb2fbb411823bc396d463e298020b5a93b9a5244f27644c5c0b87b2a",
+                "linux/arm64": "sha256:9cd9550a39010bf7f00bf08d8505a22f85e31155bf63c8a46597852dc72ef4cc"
+            }
+        },
+        "windows": {
+            "index": "sha256:c90a7c495e8becc6154b20fc6226362813938413bb3af626d0d0982cceaf32c5",
+            "platforms": {
+                "linux/amd64": "sha256:1fbc5c59e09253cfe86bb54fa76f0c1c6b1c1e942e4059725658340f64708e59",
+                "linux/arm64": "sha256:229389bbabe838124cbb572b91b42ae0e3fdcd6020462203fdbbcf5864c4a234"
             }
         }
     }