crossbind 2.0.0-beta.60 → 2.0.0-beta.63

package/src/actions/createLib.js

@@ -12,6 +12,9 @@ import logger from '../utils/logger.js';
 import { WASI_EMULATION_LIBS, WASI_LINK_LIBS, wasiCFlags, wasiCxxFlags } from '../utils/wasiToolchain.js';
 import { getFilesFingerprint, getContentHash } from '../utils/hash.js';
 import { withDependencyBridges } from '../utils/dependencyBridges.js';
+import { targetArchiveFlags } from '../utils/archiveFlags.js';
+import { conanInputsOf } from '../utils/conanDependencies.js';
+import { nativeSourceStampChanged, writeNativeSourceStamp } from '../utils/nativeSourceStamp.js';
 
 const cpuCount = Math.max(1, os.cpus().length - 1);
 const sharedPlatforms = ['android'];
@@ -21,7 +24,7 @@ export default function createLib(target, fileType, options = {}) {
         throw new Error('invalid target or options');
     }
 
-    if (target.platform === 'ios' && process.platform !== 'darwin') {
+    if ((target.platform === 'ios' || target.platform === 'darwin') && process.platform !== 'darwin') {
         return;
     }
 
@@ -29,20 +32,31 @@ export default function createLib(target, fileType, options = {}) {
     const platformPrefix = `${fileType ? `${fileType}-` : ''}${buildType}`;
     const libdir = `${state.config.paths.build}/${platformPrefix}/prebuilt/${target.path}`;
     const buildPath = `${state.config.paths.build}/${platformPrefix}/${target.path}`;
+    const sourceDirs = options.buildSource ? state.config.paths.native : [];
+    const sourcesChanged = nativeSourceStampChanged(`${libdir}/lib`, sourceDirs);
+    // Automatically loaded cargo packages have no CMake dependency paths.
+    const depPaths = state.config.allDependencyPaths?.[target.path];
+    const sourceReplacements = state.config.build?.sourceReplaceList?.(target, depPaths) ?? [];
     // wasi configure tool links need the runtime stubs; compiled below, referenced from LIBS.
     const wasiStubObj = `${buildPath}/crossbind-wasi-stubs.o`;
 
     const nativeGlob = options.nativeGlob ? withDependencyBridges(options.nativeGlob) : undefined;
     // The lib dir is reused while the bridge list grows, so an early smaller nativeGlob build must not satisfy later sets: fingerprint the glob and miss on mismatch.
     const fingerprintFile = `${libdir}/crossbind-nativeglob.fingerprint`;
-    const fingerprint = nativeGlob ? getFilesFingerprint(nativeGlob) : null;
+    // options.inputs lists what the sources compile against (a binding runtime's headers), so a change there rebuilds too.
+    const fingerprint = nativeGlob ? getFilesFingerprint([...nativeGlob, ...(options.inputs ?? [])]) : null;
     const fingerprintChanged = fingerprint !== null
         && (!fs.existsSync(fingerprintFile) || fs.readFileSync(fingerprintFile, { encoding: 'utf8' }) !== fingerprint);
 
-    // Config emccFlags feed compile-time state too (CROSSBIND_JSPI below), so a flag change must miss this cache.
+    // Config emccFlags feed compile-time state too (CROSSBIND_JSPI below), so a flag change must miss this cache, and so
+    // does a compile option a dependency declares (Lerc's LERC_STATIC on Windows). Without one the hash stays as it was.
     const configEmccFlags = getData('binary', target)?.emccFlags || [];
+    const compileOptions = getData('cmake', target)?.compileOptions || [];
     const flagsFingerprintFile = `${libdir}/crossbind-emccflags.fingerprint`;
-    const flagsFingerprint = getContentHash(JSON.stringify(configEmccFlags));
+    const conanInputs = conanInputsOf(state.config);
+    const compileInputs = compileOptions.length ? { emccFlags: configEmccFlags, compileOptions } : configEmccFlags;
+    const flagsInputs = sourceReplacements.length ? { compileInputs, sourceReplacements } : compileInputs;
+    const flagsFingerprint = getContentHash(JSON.stringify(conanInputs ? [flagsInputs, conanInputs] : flagsInputs));
     const flagsChanged = !fs.existsSync(flagsFingerprintFile)
         || fs.readFileSync(flagsFingerprintFile, { encoding: 'utf8' }) !== flagsFingerprint;
 
@@ -64,7 +78,7 @@ export default function createLib(target, fileType, options = {}) {
         return changed;
     }
 
-    if (!options.force && !fingerprintChanged && !flagsChanged && fs.existsSync(`${libdir}/lib`)) {
+    if (!options.force && !sourcesChanged && !fingerprintChanged && !flagsChanged && fs.existsSync(`${libdir}/lib`)) {
         logger.cachedStep(target, fileType);
         return false;
     }
@@ -78,7 +92,6 @@ export default function createLib(target, fileType, options = {}) {
 
     const buildEnv = { params: [] };
     let buildParams;
-    const depPaths = state.config.allDependencyPaths[target.path];
     if (state.config.build.withBuildConfig) {
         const { getBuildParams, getExtraLibs } = state.config.build;
         buildEnv.console = true;
@@ -105,31 +118,20 @@ export default function createLib(target, fileType, options = {}) {
         const extraLibs = getExtraLibs ? getExtraLibs(target) : [];
 
         triggerExtensions('createLib', 'setFlagWithBuildConfig', [buildEnv, cFlags, ldFlags]);
-        if (target.runtime === 'mt') {
-            cFlags.push('-pthread');
-            ldFlags.push('-pthread');
-        }
-
-        if (target.platform === 'wasm') {
-            cFlags.push('-msimd128');
-            ldFlags.push('-msimd128');
-        }
+        const archiveFlags = targetArchiveFlags(target);
+        cFlags.push(...archiveFlags);
+        ldFlags.push(...archiveFlags);
 
         if (isJspiTarget) {
             cFlags.push('-DCROSSBIND_JSPI');
         }
 
-        if (target.platform === 'wasm' && target.arch === 'wasm64') {
-            cFlags.push('-sMEMORY64=1');
-            ldFlags.push('-sMEMORY64=1');
-        }
-
         buildEnv.params.push('-e', `CFLAGS=${cFlags.join(' ')}`);
         buildEnv.params.push('-e', `CXXFLAGS=${cFlags.join(' ')}`);
         buildEnv.params.push('-e', `LDFLAGS=${ldFlags.join(' ')} ${extraLibs.join(' ')}`);
         // Emulation archives must land in LIBS (after the objects), not LDFLAGS.
         const wasiStubLib = state.config.build?.buildType === 'configure' ? `${wasiStubObj} ` : '';
-        const wasiLibs = target.platform === 'wasi' ? ` ${wasiStubLib}${WASI_EMULATION_LIBS.join(' ')}` : '';
+        const wasiLibs = target.platform === 'wasi' ? ` ${wasiStubLib}${WASI_EMULATION_LIBS.join(' ')} -Wl,--wrap=lseek` : '';
         buildEnv.params.push('-e', `LIBS=${dependLibs} ${extraLibs.join(' ')}${wasiLibs}`);
 
         let configBuildEnv = state.config.build.env;
@@ -144,22 +146,11 @@ export default function createLib(target, fileType, options = {}) {
 
         triggerExtensions('createLib', 'setFlagWithoutBuildConfig', [buildEnv]);
 
-        if (target.runtime === 'mt') {
-            buildEnv.params.push('-e', `CFLAGS=-pthread`);
-            buildEnv.params.push('-e', `CXXFLAGS=-pthread`);
-            buildEnv.params.push('-e', `LDFLAGS=-pthread`);
-        }
-
-        if (target.platform === 'wasm') {
-            buildEnv.params.push('-e', `CFLAGS=-msimd128`);
-            buildEnv.params.push('-e', `CXXFLAGS=-msimd128`);
-            buildEnv.params.push('-e', `LDFLAGS=-msimd128`);
-        }
-
-        if (target.platform === 'wasm' && target.arch === 'wasm64') {
-            buildEnv.params.push('-e', `CFLAGS=-sMEMORY64=1`);
-            buildEnv.params.push('-e', `CXXFLAGS=-sMEMORY64=1`);
-            buildEnv.params.push('-e', `LDFLAGS=-sMEMORY64=1`);
+        const archiveFlags = targetArchiveFlags(target).join(' ');
+        if (archiveFlags) {
+            buildEnv.params.push('-e', `CFLAGS=${archiveFlags}`);
+            buildEnv.params.push('-e', `CXXFLAGS=${archiveFlags}`);
+            buildEnv.params.push('-e', `LDFLAGS=${archiveFlags}`);
         }
 
         if (isJspiTarget) {
@@ -170,7 +161,17 @@ export default function createLib(target, fileType, options = {}) {
 
     logger.startStep(target, fileType);
     const t0 = performance.now();
-    const cmakeDir = state.config.build.withBuildConfig ? `${state.config.paths.build}/source` : state.config.paths.cmakeDir;
+    let cmakeDir = state.config.build.withBuildConfig ? `${state.config.paths.build}/source` : state.config.paths.cmakeDir;
+    if (state.config.build?.buildType !== 'configure' && sourceReplacements.length) {
+        // Patches belong to a target's copy: a platform-specific change must not alter another target's inputs.
+        const patchedSource = `${buildPath}/crossbind-source`;
+        fs.mkdirSync(buildPath, { recursive: true });
+        fs.cpSync(cmakeDir, patchedSource, { recursive: true, preserveTimestamps: true });
+        sourceReplacements.forEach(({ regex, replacement, paths }) => {
+            replace({ regex, replacement, paths: paths.map((p) => `${patchedSource}/${p}`), recursive: false, silent: true });
+        });
+        cmakeDir = patchedSource;
+    }
 
     if (state.config.build?.beforeRun) {
         const dataList = state.config.build?.beforeRun(cmakeDir);
@@ -190,11 +191,24 @@ export default function createLib(target, fileType, options = {}) {
         ], platformPrefix, target, { console: buildEnv.console });
     };
 
-    if (!options.bypassCmake) {
+    // A configure build's make install runs coreutils install, whose chmod on a file it has just written
+    // Docker Desktop's file sharing now and then refuses; the wrapper finishes it by path. Staged like stubs.c.
+    const stageInstall = () => {
+        const staged = `${buildPath}/crossbind-install.sh`;
+        fs.mkdirSync(buildPath, { recursive: true });
+        fs.copyFileSync(`${state.config.paths.cli}/assets/configure/install.sh`, staged);
+        fs.chmodSync(staged, 0o755);
+        return staged;
+    };
+
+    if (!options.bypassCmake || sourcesChanged) {
         if (state.config.build?.buildType === 'configure') {
-            fs.cpSync(cmakeDir, buildPath, { recursive: true });
-            if (state.config.build?.sourceReplaceList) {
-                state.config.build.sourceReplaceList(target, depPaths)?.forEach(({ regex, replacement, paths }) => {
+            // make compares times, so the tree starts afresh with the extracted times: no source then looks newer
+            // than what it generates, and no object of an earlier build looks newer than its source.
+            fs.rmSync(buildPath, { recursive: true, force: true });
+            fs.cpSync(cmakeDir, buildPath, { recursive: true, preserveTimestamps: true });
+            if (sourceReplacements.length) {
+                sourceReplacements.forEach(({ regex, replacement, paths }) => {
                     replace({
                         regex, replacement, paths: paths.map((p) => `${buildPath}/${p}`), recursive: false, silent: true,
                     });
@@ -231,8 +245,10 @@ export default function createLib(target, fileType, options = {}) {
         // Some upstream makefiles race when one -j invocation carries multiple goals (openssl's
         // install builds apps twice); recipes can split phases via build.makePhases.
         const makePhases = state.config.build?.makePhases || [['install']];
+        // A make command-line variable beats the Makefile's own INSTALL, autosetup's (sqlite3) included.
+        const installParams = state.config.build?.buildType === 'configure' ? [`INSTALL=${stageInstall()}`] : [];
         makePhases.forEach((phase) => {
-            run(null, ['make', `-j${cpuCount}`, ...phase], platformPrefix, target, { console: buildEnv.console });
+            run(null, ['make', `-j${cpuCount}`, ...installParams, ...phase], platformPrefix, target, { console: buildEnv.console, exclusive: true });
         });
     }
     const t2 = performance.now();
@@ -246,6 +262,7 @@ export default function createLib(target, fileType, options = {}) {
         fs.writeFileSync(fingerprintFile, fingerprint);
     }
     fs.writeFileSync(flagsFingerprintFile, flagsFingerprint);
+    writeNativeSourceStamp(`${libdir}/lib`, sourceDirs);
     // Callers can force the final link when a lib actually rebuilt.
     return true;
 }

package/src/actions/getAllBridges.js

@@ -13,7 +13,7 @@ export default function getAllBridges(log = console.log) {
         if (!fs.existsSync(sidecar)) return true;
         const source = fs.readFileSync(sidecar, 'utf8').trim();
         if (!source || fs.existsSync(source)) return true;
-        [bridge, `${bridge}.exports.json`, `${bridge}.deps`, sidecar].forEach((f) => fs.rmSync(f, { force: true }));
+        [bridge, `${bridge}.exports.json`, `${bridge}.deps`, `${bridge}.warnings`, sidecar].forEach((f) => fs.rmSync(f, { force: true }));
         log(`crossbind: pruned stale bridge '${path.basename(bridge)}' - its header is gone`);
         return false;
     });

package/src/actions/getData.js

@@ -3,7 +3,10 @@ import state from '../state/index.js';
 import { getFilteredTargetSpec, getBuildTargets } from './target.js';
 
 function getRecursiveData(obj, config, dependency, field, target) {
-    const entryArray = getFilteredTargetSpec(dependency?.targetSpecs, target).map(s => s[field]);
+    // An app may list a port's wasm, Android and iOS packages together. One with no prebuilt for the target
+    // drops out of the link, and its data stays out with it.
+    const skipsTarget = field === 'data' && dependency !== config && dependency.functions?.isEnabled && !dependency.functions.isEnabled(target);
+    const entryArray = skipsTarget ? [] : getFilteredTargetSpec(dependency?.targetSpecs, target).map(s => s[field]);
     const entries = Object.assign({}, ...entryArray);
     Object.entries(entries).forEach(([dKey, value]) => {
         if (field === 'data') {

package/src/actions/getLinkInputs.js

@@ -0,0 +1,70 @@
+import fs from 'node:fs';
+import getDependLibs from './getDependLibs.js';
+import state from '../state/index.js';
+import buildAppRustCrates from '../utils/appRustCrates.js';
+
+// The archives of a final link (wasm, Node-API addon or native executable) and which of them must
+// survive whole. keepFlag spells "keep this symbol" for the target's linker; a native executable
+// binds nothing, so it links no bridge.
+export default function getLinkInputs(target, { keepFlag, withBridge = true }) {
+    const buildType = target.buildType === 'release' ? 'Release' : 'Debug';
+    const { build, output, cache } = state.config.paths;
+    const { name } = state.config.general;
+
+    // buildLib's cache is keyed on paths.output/prebuilt; after a cache clean the
+    // build-dir copy can be gone while the output artifact is still valid — link it then.
+    const sourceLibCandidates = [
+        `${build}/Source-${buildType}/${target.path}/lib${name}.a`,
+        `${output}/prebuilt/${target.path}/lib/lib${name}.a`,
+    ];
+    // App-local Rust surfaces (imported .rs files) arrive as ONE super staticlib; it is the
+    // single fully-loaded Rust archive of the link (see the libstd rule below).
+    const appRustLibs = buildAppRustCrates(target, cache, state.config.cargoDependencies ?? {});
+    const libs = [
+        ...getDependLibs(target),
+        ...appRustLibs,
+        sourceLibCandidates.find((lib) => fs.existsSync(lib)) ?? sourceLibCandidates[0],
+        ...(withBridge ? [`${build}/Bridge-${buildType}/${target.path}/lib${name}.a`] : []),
+    ];
+
+    // By default only the Bridge archive is kept whole (see linkLayout.js) so the linker
+    // dead-code-eliminates everything unreferenced. Two escape hatches, both
+    // `export.wholeArchive: true`: on the APP it restores the legacy layout (every archive
+    // wholesale); on a LIBRARY's own config it keeps that library's archives whole in every
+    // consumer link (for members that self-register from static initializers).
+    const wholeArchiveAll = state.config.export.wholeArchive === true;
+    const wholeArchiveNames = new Set();
+    // Rust libstd rule: every Rust staticlib bundles its own libstd, so at most ONE Rust archive
+    // may be fully loaded (the app super staticlib). Generated cargo bridges are linked lazily
+    // with their keep symbol pinned (keepFlag pulls just the registration object); manual-bindings
+    // crates have no keep symbol and fall back to whole-archive - safe only while they are the
+    // single loaded Rust archive.
+    // A COFF link cannot load the super whole either: two crates in it may import one DLL through raw-dylib (std
+    // and getrandom both take ProcessPrng from bcryptprimitives.dll), and lld fails on the repeated import tables.
+    // There it links like a package bridge, through its keep symbol.
+    const rustKeepFlags = [];
+    if (appRustLibs.length > 0) {
+        if (target.platform === 'win32') rustKeepFlags.push(keepFlag('crossbind_app_super'));
+        else wholeArchiveNames.add('crossbind_app_super');
+    }
+    const depends = state.config.dependencyParameters.getCmakeDepends(target);
+    depends.forEach((dep) => {
+        if (dep.export.wholeArchive === true) {
+            (dep.export.libName || []).forEach((libName) => wholeArchiveNames.add(libName));
+        }
+        if (dep.export.type === 'cargo') {
+            const crateLibRs = `${dep.paths.project}/${dep.export.crate ?? 'crate'}/src/lib.rs`.replace('/./', '/');
+            const isManual = fs.existsSync(crateLibRs) && fs.readFileSync(crateLibRs, 'utf8').includes('bindings!');
+            (dep.export.libName || []).forEach((libName) => {
+                if (isManual) wholeArchiveNames.add(libName);
+                else rustKeepFlags.push(keepFlag(libName));
+            });
+        }
+    });
+
+    const hasRust = rustKeepFlags.length > 0 || appRustLibs.length > 0
+        || depends.some((dep) => dep.export.type === 'cargo');
+    return {
+        libs, appRustLibs, wholeArchiveAll, wholeArchiveNames, rustKeepFlags, hasRust,
+    };
+}

package/src/actions/isSourceNewer.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import p from 'node:path';
 import state from '../state/index.js';
+import { nativeSourceStampChanged } from '../utils/nativeSourceStamp.js';
 
 function newestMtimeInDir(dir) {
     let newest = 0;
@@ -22,6 +23,7 @@ function newestMtimeInDir(dir) {
 // (bundler plugins: the built js) or a directory (CLI lib cache: the staged prebuilt dir).
 export function isNativeSourceNewerThan(artifactPath) {
     if (!fs.existsSync(artifactPath)) return false;
+    if (nativeSourceStampChanged(artifactPath, state.config.paths.native)) return true;
     const stat = fs.statSync(artifactPath);
     const artifactMtime = stat.isDirectory() ? newestMtimeInDir(artifactPath) : stat.mtimeMs;
     for (const dir of state.config.paths.native) {

package/src/actions/licenses.js

@@ -1,14 +1,24 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import state from '../state/index.js';
 import loadJs from '../utils/loadJs.js';
 import { isCopyleft } from '../utils/licenseReport.js';
 import familyManifestOf from '../utils/familyManifest.js';
 import { wasiToolchainIdentity } from '../utils/provenance.js';
 import { resolveWasiSdkPath } from '../utils/wasiToolchain.js';
+import resolveEmbindNapiRoot, { resolveEmbindJsiRoot } from '../utils/resolveEmbindNapi.js';
+import { shippedBundledLicense } from '../utils/bundledLicenses.js';
+import toolchainNoticesDir from '../utils/toolchainNotices.js';
 
 const LEGACY_LICENSE_FILES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING'];
 const WASI_LIBC_LICENSE = 'Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT';
+const CROSSBIND_ROOT = fileURLToPath(new URL('../..', import.meta.url));
+const MISSING_TEXT = '(missing: build the package once to extract the upstream source)';
+
+function packageLicenseFile(dir) {
+    return LEGACY_LICENSE_FILES.map((name) => path.join(dir, name)).find((file) => fs.existsSync(file));
+}
 
 // License texts come from any extracted upstream source tree of the family (variants share the tarball).
 function findSourceDir(familyDir) {
@@ -20,20 +30,21 @@ function findSourceDir(familyDir) {
     return null;
 }
 
-function readLicenseTexts(sourceDir, files) {
+function readLicenseTexts(files, locate) {
     const texts = (files || []).map((file) => {
-        const filePath = sourceDir ? path.join(sourceDir, file) : null;
+        const filePath = locate(file);
         const body = filePath && fs.existsSync(filePath)
             ? fs.readFileSync(filePath, 'utf8').trim()
-            : '(missing: build the package once to extract the upstream source)';
+            : MISSING_TEXT;
         return `=== ${file} ===\n\n${body}`;
     });
     return texts.length > 0 ? texts.join('\n\n') : null;
 }
 
 // Vendored copies compiled into the artifact (recipe `bundled` map, keyed by platform)
-// become first-class notice/SBOM rows with texts from the family source tree.
-async function bundledRowsOf(node, platform) {
+// become first-class notice/SBOM rows with texts from the family source tree, or from the dist
+// of whichever package of the family shipped them.
+async function bundledRowsOf(node, platform, familyProjects) {
     const recipe = await loadJs(node.paths.project, 'crossbind.build');
     const entries = recipe?.bundled?.[platform];
     if (!entries || entries.length === 0) return [];
@@ -50,7 +61,9 @@ async function bundledRowsOf(node, platform) {
         licenseNotes: `${entry.notes ? `${entry.notes}; ` : ''}vendored inside ${node.general.name} ${node.package?.nativeVersion || ''}`.trim(),
         sha256: null,
         sourceUrl: null,
-        licenseText: readLicenseTexts(sourceDir, entry.files),
+        licenseText: readLicenseTexts(entry.files, (file) => (sourceDir
+            ? path.join(sourceDir, file)
+            : shippedBundledLicense(familyProjects, entry.name, file))),
         isCopyleft: isCopyleft(entry.license),
     }));
 }
@@ -90,6 +103,98 @@ function wasiToolchainRows() {
     ];
 }
 
+// The notices a build copied out of its toolchain image (buildNode does it for Windows addons).
+function toolchainNoticeTexts(platform) {
+    const build = state.config?.paths?.build;
+    const dir = build ? path.join(build, toolchainNoticesDir(platform)) : null;
+    if (!dir || !fs.existsSync(dir)) return null;
+    const texts = fs.readdirSync(dir).sort()
+        .map((file) => `=== ${file} ===\n\n${fs.readFileSync(path.join(dir, file), 'utf8').trim()}`);
+    return texts.length > 0 ? texts.join('\n\n') : null;
+}
+
+// A Linux or Windows addon carries its C++ runtime; a Windows one also carries parts of the
+// mingw-w64 runtime and winpthreads, whose licenses ask for their notices in binary distributions.
+// A macOS addon uses the system's C++ runtime.
+function addonToolchainRows(platform) {
+    const shared = {
+        npmName: null, version: null, nativeVersion: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
+    };
+    const llvmLicense = 'Apache-2.0 WITH LLVM-exception';
+    const llvmRuntimes = {
+        ...shared,
+        name: 'llvm-runtimes',
+        license: llvmLicense,
+        licenseDeclared: llvmLicense,
+        sourceUrl: 'https://github.com/llvm/llvm-project',
+    };
+    const llvmText = 'license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT';
+    if (platform === 'linux' || platform === 'linuxmusl') {
+        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the addon; ${llvmText}` }];
+    }
+    const mingwLicense = 'LicenseRef-MinGW-w64-runtime';
+    return [
+        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the addon; ${llvmText}` },
+        {
+            ...shared,
+            name: 'mingw-w64-runtime',
+            license: mingwLicense,
+            licenseDeclared: mingwLicense,
+            sourceUrl: 'https://github.com/mingw-w64/mingw-w64',
+            licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the addon; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
+            licenseText: toolchainNoticeTexts('win32'),
+        },
+    ];
+}
+
+// A Node-API addon compiles in crossbind's runtime: embind-jsi, which adapts Emscripten's embind,
+// and node-api-jsi. The loader bundles the JavaScript half of the same runtime.
+function nodeRuntimeRows({ isAddon }) {
+    const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
+    const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
+    const shared = {
+        nativeVersion: null, sha256: null, licenseSelected: null, isCopyleft: false,
+    };
+    const jsiRoot = resolveEmbindJsiRoot();
+    const rows = [
+        {
+            ...shared,
+            name: 'crossbind',
+            npmName: 'crossbind',
+            version: versionOf(CROSSBIND_ROOT),
+            license: 'MIT',
+            licenseDeclared: 'MIT',
+            sourceUrl: 'https://github.com/crossbind/crossbind',
+            licenseNotes: 'the embind-jsi and embind-napi runtime and the bindings crossbind generates',
+            licenseText: textOf(path.join(CROSSBIND_ROOT, 'LICENSE')),
+        },
+        {
+            ...shared,
+            name: 'emscripten-embind',
+            npmName: '@crossbind/core-embind-jsi',
+            version: versionOf(jsiRoot),
+            license: 'MIT OR NCSA',
+            licenseDeclared: 'MIT OR NCSA',
+            sourceUrl: 'https://github.com/emscripten-core/emscripten',
+            licenseNotes: "Emscripten's embind, adapted by @crossbind/core-embind-jsi",
+            licenseText: textOf(path.join(jsiRoot, 'LICENSE')),
+        },
+    ];
+    if (!isAddon) return rows;
+    const napiRoot = resolveEmbindNapiRoot();
+    return [...rows, {
+        ...shared,
+        name: 'node-api-jsi',
+        npmName: '@crossbind/core-embind-napi',
+        version: versionOf(napiRoot),
+        license: 'MIT',
+        licenseDeclared: 'MIT',
+        sourceUrl: 'https://github.com/microsoft/node-api-jsi',
+        licenseNotes: 'JSI over Node-API, with the local patches @crossbind/core-embind-napi lists',
+        licenseText: textOf(path.join(napiRoot, 'third_party', 'node-api-jsi', 'LICENSE')),
+    }];
+}
+
 async function buildRow(node) {
     const recipe = await loadJs(node.paths.project, 'crossbind.build');
     const manifest = node.package || null;
@@ -110,12 +215,18 @@ async function buildRow(node) {
     let licenseText;
     if (upstream) {
         license = upstream.selected || upstream.declared;
-        licenseText = readLicenseTexts(findSourceDir(family.dir), upstream.files);
+        const sourceDir = findSourceDir(family.dir);
+        const fromSource = sourceDir ? readLicenseTexts(upstream.files, (file) => path.join(sourceDir, file)) : null;
+        const isComplete = Boolean(fromSource) && !fromSource.includes(MISSING_TEXT);
+        // An installed package has no extracted source, and some upstreams name no license file; the package
+        // ships the upstream text as its LICENSE either way.
+        const shipped = isComplete ? null : packageLicenseFile(node.paths.project);
+        if (isComplete) licenseText = fromSource;
+        else if (shipped) licenseText = `=== ${path.basename(shipped)} ===\n\n${fs.readFileSync(shipped, 'utf8').trim()}`;
+        else licenseText = readLicenseTexts(upstream.files, () => null);
     } else {
         license = manifest?.license || null;
-        const legacy = LEGACY_LICENSE_FILES
-            .map((name) => `${node.paths.project}/${name}`)
-            .find((file) => fs.existsSync(file));
+        const legacy = packageLicenseFile(node.paths.project);
         licenseText = legacy ? fs.readFileSync(legacy, 'utf8') : null;
     }
 
@@ -135,22 +246,69 @@ async function buildRow(node) {
     };
 }
 
+// A Conan package's facts come from its recipe, and its texts from the licenses/ its package ships.
+function conanRow(node) {
+    const { conan } = node.general;
+    const licenseDir = `${node.paths.project}/licenses`;
+    const files = fs.existsSync(licenseDir)
+        ? fs.readdirSync(licenseDir, { recursive: true, withFileTypes: true }).filter((entry) => entry.isFile())
+        : [];
+    const texts = files.map((entry) => path.join(entry.parentPath, entry.name)).sort()
+        .map((file) => `=== ${path.relative(licenseDir, file)} ===\n\n${fs.readFileSync(file, 'utf8').trim()}`);
+    return {
+        name: conan.name,
+        npmName: null,
+        version: null,
+        nativeVersion: conan.version,
+        license: conan.license,
+        licenseDeclared: null,
+        licenseSelected: null,
+        licenseNotes: `built from the ConanCenter recipe ${conan.ref}`,
+        sha256: conan.source?.sha256 ?? null,
+        sourceUrl: conan.source?.url ?? conan.homepage ?? null,
+        licenseText: texts.length > 0 ? texts.join('\n\n') : null,
+        isCopyleft: isCopyleft(conan.license),
+        purl: `pkg:conan/${conan.name}@${conan.version}`,
+    };
+}
+
+// Conan packages join the graph from the stage a build makes; without it they would be left out unseen.
+function assertConanStaged() {
+    const attached = new Set(state.config.allDependencies.filter((d) => d.general.conan).map((d) => d.general.conan.name));
+    const missing = Object.keys(state.config.conanDependencies ?? {}).filter((name) => !attached.has(name));
+    if (missing.length > 0) {
+        throw new Error(`crossbind: the Conan packages ${missing.join(', ')} are not installed for the current conanDependencies, so their rows would be missing. Build the project first.`);
+    }
+}
+
 // platform (optional, e.g. 'wasi') additionally includes what that platform's
 // artifact statically links beyond the package graph: recipe-declared vendored
-// copies and the toolchain runtime.
-export default async function collectLicenseRows(platform = null) {
-    // The root package is a component too: leaf -wasi packages have no deps but ship their own upstream.
+// copies and the toolchain runtime. runtimeEnv 'node' adds the crossbind runtime an
+// addon of that platform compiles in, or without a platform the one its loader bundles.
+export default async function collectLicenseRows(platform = null, { runtimeEnv = null } = {}) {
+    assertConanStaged();
+    // The root package is a component too when it is a port: leaf -wasi packages have no deps but ship
+    // their own upstream. A dependency that is no port, such as a library a project publishes, is one by
+    // its package name; a private package is the project's own code, like the app.
+    const keyOf = (node) => (node.general.conan ? `conan:${node.general.conan.name}` : node.general.alias?.package ?? node.package?.name);
     const nodes = [state.config, ...state.config.allDependencies]
-        .filter((node) => node?.general?.alias?.package && node.paths?.project);
+        .filter((node, index) => node?.paths?.project
+            && (node.general?.alias?.package || node.general?.conan || (index > 0 && node.package?.name && !node.package.private)));
     const rows = [];
     const seen = new Set();
     for (const node of nodes) {
-        const key = node.general.alias.package;
+        const key = keyOf(node);
         if (seen.has(key)) continue;
         seen.add(key);
-        rows.push(await buildRow(node));
-        if (platform) rows.push(...await bundledRowsOf(node, platform));
+        rows.push(node.general.conan ? conanRow(node) : await buildRow(node));
+        // A Conan package's folder is written from what its recipe produced: nothing there is run.
+        if (platform && !node.general.conan) {
+            const familyProjects = nodes.filter((other) => keyOf(other) === key).map((other) => other.paths.project);
+            rows.push(...await bundledRowsOf(node, platform, familyProjects));
+        }
     }
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
+    if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
+    if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }

package/src/actions/prepareConanDependencies.js

@@ -0,0 +1,51 @@
+import fs from 'node:fs';
+import state, { setAllDependecyPaths } from '../state/index.js';
+import refreshConanDependencies from '../state/refreshConanDependencies.js';
+import installConanPackages from '../utils/conanInstall.js';
+import { releaseTargetOf, HOST_BUILT_PLATFORMS } from '../utils/targets.js';
+import createXCFramework from './createXCFramework.js';
+
+const mtimeOf = (file) => fs.statSync(file, { throwIfNoEntry: false })?.mtimeMs ?? -Infinity;
+// iOS and macOS build on a Mac alone: elsewhere the build leaves them out, and so does the staging.
+const isBuiltHere = (target) => process.platform === 'darwin' || !HOST_BUILT_PLATFORMS.includes(target.platform);
+
+// iOS headers and archives come out of an xcframework per library with a slice per SDK (state/index.js).
+// One older than an archive it wraps was made before the package was staged again.
+function makeConanXCFrameworks(iosTargets) {
+    const archiveOf = (dependency, target, name) => `${dependency.paths.output}/prebuilt/${target.path}/lib/lib${name}.a`;
+    const isFresh = (dependency, name) => mtimeOf(`${dependency.paths.project}/${name}.xcframework/Info.plist`)
+        >= Math.max(...iosTargets.map((target) => mtimeOf(archiveOf(dependency, target, name))));
+    state.config.allDependencies.filter((dependency) => dependency.general.conan).forEach((dependency) => {
+        // A library its recipe names on another platform only has no slice here.
+        const libName = dependency.export.libName.filter((name) => iosTargets.every((target) => fs.existsSync(archiveOf(dependency, target, name))));
+        if (libName.every((name) => isFresh(dependency, name))) return;
+        createXCFramework({
+            paths: { project: dependency.paths.project, output: dependency.paths.output },
+            export: { libName },
+            targetParams: {
+                platform: ['ios'], arch: iosTargets.map((target) => target.arch), runtime: ['mt'], buildType: ['release'],
+            },
+        });
+    });
+}
+
+// Conan packages are staged before any header is read: SWIG parses headers that include theirs, and an
+// interface made without its includes stays that way until the header itself changes. Release trees
+// only - a debug build links them like any prebuilt.
+export default async function prepareConanDependencies(targets) {
+    if (Object.keys(state.config.conanDependencies ?? {}).length === 0) return;
+    // createBridgeFile reads every header for the first wasm target unless it is told otherwise, as it
+    // is by Metro, which builds the React Native bridges for the platform's own target, and by a Node
+    // build, which reads them for one of its own (nodeBridgeTarget).
+    const bridgeTarget = targets.some((target) => target.platform === 'wasm') && state.targets.find((target) => target.platform === 'wasm');
+    // One xcframework holds both SDKs, so an iOS build stages both.
+    const iosTargets = targets.some((target) => target.platform === 'ios') ? state.targets.filter((target) => target.platform === 'ios') : [];
+    const releaseTargets = [...new Map([...targets, bridgeTarget, ...iosTargets].filter(Boolean).map((target) => [
+        target.releasePath, releaseTargetOf(target),
+    ])).values()].filter(isBuiltHere);
+    await installConanPackages(state.config, releaseTargets);
+    // Also when another process did the staging: this one may have loaded before the manifests existed.
+    refreshConanDependencies(state.config);
+    setAllDependecyPaths();
+    if (iosTargets.length > 0) makeConanXCFrameworks(releaseTargets.filter((target) => target.platform === 'ios'));
+}