crossbind 2.0.0-beta.62 → 2.0.0-beta.64

package/src/utils/cargoTarget.js

@@ -1,6 +1,6 @@
-// Maps a crossbind build target to the cargo target triple. Rust is built on the host (the rust
-// toolchain is host-installed), so the host must have the matching linker/SDK: Xcode for apple,
-// a sourced emsdk for wasm, an NDK for android.
+// Maps a crossbind build target to the cargo target triple. Apple targets build on the host with
+// Xcode; every other platform builds in the toolchain image that links it, which carries the
+// target's std.
 export function cargoTripleFor(target) {
     switch (target.platform) {
         case 'wasm':
@@ -11,7 +11,25 @@ export function cargoTripleFor(target) {
             return target.arch === 'x86_64' ? 'x86_64-linux-android' : 'aarch64-linux-android';
         case 'darwin':
             return target.arch === 'x64' ? 'x86_64-apple-darwin' : 'aarch64-apple-darwin';
+        case 'linux':
+            return target.arch === 'x64' ? 'x86_64-unknown-linux-gnu' : 'aarch64-unknown-linux-gnu';
+        case 'linuxmusl':
+            return target.arch === 'x64' ? 'x86_64-unknown-linux-musl' : 'aarch64-unknown-linux-musl';
+        case 'win32':
+            return target.arch === 'x64' ? 'x86_64-pc-windows-gnullvm' : 'aarch64-pc-windows-gnullvm';
         default:
             return null; // wasi (no rust wasip3 target yet) and anything else: unsupported
     }
 }
+
+// What `rustc --print native-static-libs` asks a Linux or Windows link to add for a Rust staticlib.
+// The other platforms' toolchains link these by themselves.
+const RUST_STD_LIBS = {
+    linux: ['-lgcc_s', '-lutil', '-lrt', '-lpthread', '-lm', '-ldl'],
+    linuxmusl: ['-lgcc_s'],
+    win32: ['-lkernel32', '-lntdll', '-luserenv', '-lws2_32', '-ldbghelp', '-lunwind'],
+};
+
+export function rustStdLibsFor(target) {
+    return RUST_STD_LIBS[target.platform] ?? [];
+}

package/src/utils/cloudAccount.js

@@ -0,0 +1,55 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import systemKeys from './systemKeys.js';
+
+// Where crossbind cloud is, and this machine's sign-in to it (`crossbind login`), kept per cloud address.
+
+export const DEFAULT_CLOUD_URL = systemKeys.CLOUD_URL.default;
+export const CREDENTIALS_FILE = path.join(os.homedir(), '.crossbind', 'credentials.json');
+const URL_VARIABLE = 'CROSSBIND_CLOUD_URL';
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+
+export function cloudUrl(system, env = process.env) {
+    const from = env[URL_VARIABLE] ? `$${URL_VARIABLE}` : 'CLOUD_URL in ~/.crossbind.json';
+    const url = env[URL_VARIABLE] || system?.CLOUD_URL || DEFAULT_CLOUD_URL;
+    const parsed = URL.parse(url);
+    if (!['https:', 'http:'].includes(parsed?.protocol)) throw new Error(`crossbind: ${from} is ${JSON.stringify(url)}, not an https address.`);
+    // The token travels with every call: plain http only to this machine.
+    if (parsed.protocol === 'http:' && !LOOPBACK_HOSTS.has(parsed.hostname)) {
+        throw new Error(`crossbind: ${from} is plain http to another machine; crossbind cloud needs https.`);
+    }
+    if (parsed.username || parsed.password || parsed.pathname !== '/' || parsed.search || parsed.hash) {
+        throw new Error(`crossbind: ${from} is ${JSON.stringify(url)}; give the cloud's origin alone, such as ${DEFAULT_CLOUD_URL}.`);
+    }
+    return parsed.origin;
+}
+
+export function readCredentials(file = CREDENTIALS_FILE) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    } catch (error) {
+        if (error.code === 'ENOENT') return {};
+        throw new Error(`crossbind: ${file} cannot be read (${error.message}); delete it and run crossbind login again.`, { cause: error });
+    }
+}
+
+// Readable by this user only, written as a new file under a name nobody can plant anything at, then renamed into
+// place.
+export function writeCredentials(entries, file = CREDENTIALS_FILE) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = `${file}.${crypto.randomBytes(8).toString('hex')}.tmp`;
+    try {
+        fs.writeFileSync(temporary, `${JSON.stringify(entries, null, 4)}\n`, { mode: 0o600, flag: 'wx' });
+        fs.renameSync(temporary, file);
+    } catch (error) {
+        fs.rmSync(temporary, { force: true });
+        throw error;
+    }
+}
+
+export function cloudCredentials(url, file = CREDENTIALS_FILE) {
+    const entries = readCredentials(file);
+    return Object.hasOwn(entries, url) ? entries[url] : null;
+}

package/src/utils/conanDependencies.js

@@ -0,0 +1,66 @@
+import { CONAN_NAME } from './conanImport.js';
+import { getContentHash } from './hash.js';
+
+// A plain version or a Conan range; a user, channel or recipe revision belongs in conan.lock instead.
+export const CONAN_VERSION = /^[A-Za-z0-9_][A-Za-z0-9_.+-]*$/;
+const VERSION_RANGE = /^\[[^\]\n]+\]$/;
+const OPTION_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const OPTION_VALUE_TYPES = ['string', 'number', 'boolean'];
+
+export function normalizeConanDependencies(raw) {
+    if (raw === undefined) return {};
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new Error('crossbind: "conanDependencies" must be an object such as { zlib: \'1.3.1\' }.');
+    }
+    return Object.fromEntries(Object.entries(raw).map(([name, spec]) => [name, normalizeSpec(name, spec)]));
+}
+
+function normalizeSpec(name, spec) {
+    if (!CONAN_NAME.test(name)) {
+        throw new Error(`crossbind: conanDependencies key '${name}' is not a Conan package name (lower-case letters, digits and _ + . -).`);
+    }
+    const { version, options = {} } = typeof spec === 'string' ? { version: spec } : (spec ?? {});
+    if (typeof version !== 'string' || !(CONAN_VERSION.test(version) || VERSION_RANGE.test(version))) {
+        throw new Error(`crossbind: conanDependencies.${name} needs a version such as '1.3.1' or a range such as '[>=1.3 <2]' (got ${JSON.stringify(version)}).`);
+    }
+    if (options === null || typeof options !== 'object' || Array.isArray(options)) {
+        throw new Error(`crossbind: conanDependencies.${name}.options must be an object such as { enable_fts5: true }.`);
+    }
+    Object.entries(options).forEach(([key, value]) => {
+        if (key === 'shared') {
+            throw new Error(`crossbind: conanDependencies.${name}.options.shared - crossbind links Conan packages statically into the module and sets shared=False itself.`);
+        }
+        if (!OPTION_NAME.test(key)) {
+            throw new Error(`crossbind: conanDependencies.${name}.options - '${key}' is not an option name.`);
+        }
+        if (!OPTION_VALUE_TYPES.includes(typeof value)) {
+            throw new Error(`crossbind: conanDependencies.${name}.options.${key} must be a string, number or boolean.`);
+        }
+    });
+    return { version, options: { ...options } };
+}
+
+// What staged packages were installed for; a change to conanDependencies makes them stale.
+export const conanDependenciesKey = (dependencies) => getContentHash(JSON.stringify(dependencies));
+
+// What an app's headers and sources see of its Conan packages: the packages are staged after a header
+// may already be bound, and restaged in place when one moves to another version. Null without any.
+export function conanInputsOf(config) {
+    if (Object.keys(config.conanDependencies ?? {}).length === 0) return null;
+    return {
+        dependencies: config.conanDependencies,
+        refs: config.allDependencies.filter((d) => d.general.conan).map((d) => d.general.conan.ref),
+    };
+}
+
+export const conanRequires = (dependencies) => Object.entries(dependencies).map(([name, { version }]) => `${name}/${version}`);
+
+function optionValue(value) {
+    if (value === true) return 'True';
+    if (value === false) return 'False';
+    return String(value);
+}
+
+export const conanOptionArgs = (dependencies) => Object.entries(dependencies).flatMap(([name, { options }]) => (
+    Object.entries(options).flatMap(([key, value]) => ['-o:h', `${name}/*:${key}=${optionValue(value)}`])
+));

package/src/utils/conanImport.js

@@ -0,0 +1,58 @@
+import fs from 'node:fs';
+
+export const CONAN_PREFIX = 'conan:';
+// Conan 2 refuses upper-case package names.
+export const CONAN_NAME = /^[a-z0-9_][a-z0-9_+.-]*$/;
+// No leading dot, so neither '.' nor '..' can climb out of the include directory.
+const HEADER_SEGMENT = /^[A-Za-z0-9_+-][A-Za-z0-9_.+-]*$/;
+
+export const conanStageDir = (cacheDir) => `${cacheDir}/conan`;
+// Apart from the stage's own files, so no package name can land on one of them.
+export const conanPackageDir = (stageDir, name) => `${stageDir}/packages/${name}`;
+
+export function parseConanImport(source, headerExtensions) {
+    const [name, ...headerPath] = source.slice(CONAN_PREFIX.length).split('/');
+    if (!CONAN_NAME.test(name)) {
+        throw new Error(`crossbind: '${source}' - '${name}' is not a Conan package name; write conan:<package>/<header>, such as conan:zlib/zlib.h.`);
+    }
+    if (headerPath.length === 0) {
+        throw new Error(`crossbind: '${source}' names no header - import one of the package's headers as conan:${name}/<header>.`);
+    }
+    const bad = headerPath.find((segment) => !HEADER_SEGMENT.test(segment));
+    if (bad !== undefined) {
+        throw new Error(`crossbind: '${source}' - '${bad}' is not a header path segment.`);
+    }
+    const header = headerPath.join('/');
+    const extension = header.includes('.') ? header.split('.').at(-1) : '';
+    if (!headerExtensions.includes(extension)) {
+        throw new Error(`crossbind: '${source}' - a conan: import names a header (${headerExtensions.map((e) => `.${e}`).join(', ')}).`);
+    }
+    return { name, header };
+}
+
+// The inverse of resolveConanHeader, for the editor types of a staged header.
+export function conanImportOfHeader(file, cacheDir) {
+    const prefix = conanPackageDir(conanStageDir(cacheDir), '');
+    if (!file.startsWith(prefix)) return null;
+    const match = file.slice(prefix.length).match(/^([^/]+)\/dist\/prebuilt\/[^/]+\/include\/(.+)$/);
+    // Both end up in the module name of the generated types.
+    if (!match || !CONAN_NAME.test(match[1]) || !match[2].split('/').every((segment) => HEADER_SEGMENT.test(segment))) return null;
+    return { name: match[1], header: match[2] };
+}
+
+// Only declared packages are importable, as with cargo:; a package pulled in by another links but stays hidden.
+export function resolveConanHeader(config, source, target) {
+    const { name, header } = parseConanImport(source, config.ext.header);
+    if (!Object.hasOwn(config.conanDependencies ?? {}, name)) {
+        throw new Error(`crossbind: '${source}' is not declared - add '${name}' to conanDependencies in crossbind.config.`);
+    }
+    const dependency = config.allDependencies.find((d) => d.general.conan?.name === name);
+    if (!dependency) {
+        throw new Error(`crossbind: '${source}' - ${name} is declared in conanDependencies but not installed; crossbind installs Conan packages when a build starts.`);
+    }
+    const tried = [...new Set([target.releasePath, target.path].filter(Boolean))]
+        .map((targetPath) => `${dependency.paths.output}/prebuilt/${targetPath}/include/${header}`);
+    const found = tried.find((file) => fs.existsSync(file));
+    if (found) return found;
+    throw new Error(`crossbind: '${source}' - ${name} has no ${header}. Tried:\n${tried.map((file) => `  - ${file}`).join('\n')}`);
+}

package/src/utils/conanInstall.js

@@ -0,0 +1,154 @@
+import fs from 'node:fs';
+import upath from 'upath';
+import withDirLock from './dirLock.js';
+import logger from './logger.js';
+import loadJson from './loadJson.js';
+import writeIfChanged from './writeIfChanged.js';
+import { getContentHash } from './hash.js';
+import { getDockerImage, imageRoleFor } from './pullDockerImage.js';
+import runConan, {
+    clearConanWork, conanRoot, conanRunner, createConanWork, localToolchainIdentity, removeConanWork, toHostPath,
+} from './runConan.js';
+import { hostProfile, settingsUser, BUILD_PROFILE } from './conanProfile.js';
+import { conanRequires, conanOptionArgs, conanDependenciesKey } from './conanDependencies.js';
+import {
+    conanPackagesOf, stageConanPackage, writeConanManifest, readConanManifest, isControlCharacter,
+} from './conanStage.js';
+import { conanStageDir } from './conanImport.js';
+
+// Bumped when the stage changes shape, so a stage an older crossbind made is made again.
+const CONAN_STAGE_FORMAT = 4;
+// Enough of a failed build's log to reach the error conan ends it with.
+const LOG_TAIL_LINES = 60;
+
+const lockFileOf = (config) => upath.join(config.paths.project, 'conan.lock');
+const stampFileOf = (stageDir, target) => upath.join(stageDir, 'stamps', `${target.path}.json`);
+const logFileOf = (stageDir, target) => upath.join(stageDir, 'logs', `${target.path}.log`);
+const printable = (text) => [...text].filter((char) => char === '\n' || char === '\t' || !isControlCharacter(char)).join('');
+
+// What a staged target was made from. The toolchain is the image, or the host's compiler and conan where
+// conan runs on the host (RUNNER=LOCAL, and iOS always): the profile asks that compiler for its version,
+// so a new one is a new package id and must restage.
+function stampKey(config, target) {
+    const lock = lockFileOf(config);
+    return getContentHash(JSON.stringify({
+        format: CONAN_STAGE_FORMAT,
+        dependencies: config.conanDependencies,
+        host: hostProfile(target),
+        build: BUILD_PROFILE,
+        toolchain: conanRunner(config, target) === 'LOCAL' ? localToolchainIdentity(target) : getDockerImage(imageRoleFor(target)),
+        lock: fs.existsSync(lock) ? fs.readFileSync(lock, 'utf8') : null,
+    }));
+}
+
+// The target's manifest names the dependencies it was staged for.
+const isStaged = (config, stageDir, target) => loadJson(stampFileOf(stageDir, target))?.key === stampKey(config, target)
+    && readConanManifest(stageDir, conanDependenciesKey(config.conanDependencies), target.path) !== null;
+
+function conanFailure(target, result, logFile) {
+    if (result.error && result.error.code !== 'ENOBUFS') {
+        return new Error(`crossbind: could not run conan for ${target.path} (${result.error.message}).`);
+    }
+    let ending = `failed (exit code ${result.status})`;
+    if (result.error) ending = 'was stopped: it printed more than crossbind reads';
+    else if (result.signal) ending = `was stopped by ${result.signal}`;
+    const tail = printable(`${result.stderr ?? ''}`).trim().split('\n').slice(-LOG_TAIL_LINES).join('\n');
+    return new Error(`crossbind: conan install for ${target.path} ${ending}. Its whole log is in ${logFile}.\n${tail}`);
+}
+
+// The parsed file, or null. The parse error is left out: it quotes the text, which recipes can write.
+function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    } catch {
+        return null;
+    }
+}
+
+// The lockfile comes back from where the recipes ran, so only a lockfile goes into the project.
+function lockfileText(file) {
+    const lock = readJson(file);
+    if (typeof lock?.version !== 'string') {
+        throw new Error('crossbind: conan wrote no lockfile crossbind can read, so conan.lock is left as it was.');
+    }
+    return `${JSON.stringify(lock, null, 4)}\n`;
+}
+
+function installTarget(config, stageDir, target) {
+    const dependencies = config.conanDependencies;
+    const lock = lockFileOf(config);
+    const hasLock = fs.existsSync(lock);
+    const stampFile = stampFileOf(stageDir, target);
+    const logFile = logFileOf(stageDir, target);
+    // A restage that stops halfway must not pass for a finished one.
+    fs.rmSync(stampFile, { force: true });
+    const work = createConanWork(conanRunner(config, target));
+    const label = `conan ${target.path}`;
+    logger.startTask(label);
+    try {
+        fs.writeFileSync(upath.join(work.dir, 'host.profile'), hostProfile(target));
+        fs.writeFileSync(upath.join(work.dir, 'build.profile'), BUILD_PROFILE);
+        const settings = settingsUser(target);
+        if (settings) fs.writeFileSync(upath.join(work.dir, 'home', 'settings_user.yml'), settings);
+        if (hasLock) fs.copyFileSync(lock, upath.join(work.dir, 'input.lock'));
+        const result = runConan([
+            'install',
+            ...conanRequires(dependencies).flatMap((reference) => ['--requires', reference]),
+            ...conanOptionArgs(dependencies),
+            '-pr:h', work.conanPath('host.profile'),
+            '-pr:b', work.conanPath('build.profile'),
+            '--output-folder', work.conanPath('output'),
+            '--build=missing',
+            '--format=json',
+            // A file, since a build tool writing to stdout would end up inside the JSON.
+            '--out-file', work.conanPath('graph.json'),
+            // Unless told which lockfile to use, conan takes any conan.lock in its working directory.
+            ...(hasLock ? ['--lockfile', work.conanPath('input.lock'), '--lockfile-partial'] : ['--lockfile=']),
+            '--lockfile-out', work.conanPath('resolution.lock'),
+        ], { config, target, work });
+        writeIfChanged(logFile, `${result.stderr ?? ''}`);
+        if (result.error || result.status !== 0) throw conanFailure(target, result, logFile);
+
+        const graph = readJson(upath.join(work.dir, 'graph.json'))?.graph;
+        if (!graph) throw new Error(`crossbind: conan install wrote no graph crossbind can read. Its log is in ${logFile}.`);
+        const packages = conanPackagesOf(graph);
+        const distCmake = fs.readFileSync(upath.join(config.paths.cli, 'assets', 'cmake', 'dist.cmake'), 'utf8');
+        packages.forEach((pkg) => stageConanPackage(pkg, {
+            stageDir, targetPath: target.path, toHost: (reported) => toHostPath(reported, work), store: work.store, distCmake,
+        }));
+        writeConanManifest(stageDir, target.path, {
+            key: conanDependenciesKey(dependencies),
+            packages: packages.map(({
+                packageFolder, includedirs, libdirs, ...entry
+            }) => entry),
+        });
+        writeIfChanged(lock, lockfileText(upath.join(work.dir, 'resolution.lock')));
+        writeIfChanged(stampFile, `${JSON.stringify({ key: stampKey(config, target) })}\n`);
+        logger.doneTask(label, packages.map((pkg) => `${pkg.name} ${pkg.version}`).join(', '));
+    } finally {
+        // Not over the error that ended the run; the next install clears what is left.
+        try {
+            removeConanWork(work);
+        } catch (e) {
+            logger.info(`crossbind: could not remove ${work.dir} (${e.message}).`);
+        }
+    }
+}
+
+// Installs the declared Conan packages for every target not staged from the same inputs yet, and
+// says whether it staged any, so the caller attaches the new manifest.
+export default async function installConanPackages(config, targets) {
+    if (Object.keys(config.conanDependencies ?? {}).length === 0) return false;
+    const stageDir = conanStageDir(config.paths.cache);
+    const pending = targets.filter((target) => !isStaged(config, stageDir, target));
+    if (pending.length === 0) return false;
+    for (const runner of new Set(pending.map((target) => conanRunner(config, target)))) {
+        // A conan store takes one writer at a time, and every project on the machine shares it.
+        await withDirLock(`${conanRoot(runner)}-install.lock`, async () => {
+            clearConanWork(runner);
+            pending.filter((target) => conanRunner(config, target) === runner && !isStaged(config, stageDir, target))
+                .forEach((target) => installTarget(config, stageDir, target));
+        });
+    }
+    return true;
+}

package/src/utils/conanProfile.js

@@ -0,0 +1,203 @@
+import { WASM_EXCEPTION_FLAGS, targetArchiveFlags } from './archiveFlags.js';
+import { ANDROID_NDK, ANDROID_API_LEVEL } from './androidToolchain.js';
+import { IOS_DEPLOYMENT_TARGET } from './iosToolchain.js';
+import {
+    LINUX_ARCHIVE_FLAGS, linuxBuildEnv, linuxTool, linuxToolchainFile, linuxTriple,
+} from './linuxToolchain.js';
+import {
+    DARWIN_CC, DARWIN_CXX, DARWIN_DEPLOYMENT_TARGET, DARWIN_HOST_PACKAGE_PREFIXES,
+} from './darwinToolchain.js';
+import {
+    windowsBuildEnv, windowsTool, windowsToolchainFile, windowsTriple,
+} from './windowsToolchain.js';
+
+// The app's own sources compile as C++20 (assets/cmake/CMakeLists.txt), so C++ packages do too.
+const CPP_STANDARD = '20';
+// The flags change the ABI without changing a setting, and glibc and musl builds share every setting,
+// so these have to change the package id. A conf the profile leaves unset adds nothing to it.
+const PACKAGE_ID_CONFS = ['tools.build:cflags', 'tools.build:cxxflags', 'tools.build:exelinkflags', 'tools.build:sharedlinkflags', 'user.crossbind:libc'];
+
+// Conan renders profiles as Jinja templates: these read the toolchain of whatever runs Conan, the image
+// or the host (under RUNNER=LOCAL, and for iOS and macOS).
+const EMCC_VERSION = "{{ subprocess.check_output(['emcc', '-dumpversion'], text=True).strip() }}";
+const EMSCRIPTEN_TOOLCHAIN = "{{ subprocess.check_output(['em-config', 'EMSCRIPTEN_ROOT'], text=True).strip() }}/cmake/Modules/Platform/Emscripten.cmake";
+const clangMajorVersion = (clang) => `{{ subprocess.check_output(['${clang}', '-dumpversion'], text=True).split('.')[0] }}`;
+const NDK_CLANG_VERSION = clangMajorVersion(`${ANDROID_NDK}/toolchains/llvm/prebuilt/linux-x86_64/bin/clang`);
+const XCODE_CLANG_VERSION = "{{ subprocess.check_output(['xcrun', 'clang', '-dumpversion'], text=True).split('.')[0] }}";
+const CMAKE_VERSION = "{{ subprocess.check_output(['cmake', '--version'], text=True).split()[2] }}";
+
+const ANDROID_ARCHS = { 'arm64-v8a': 'armv8', x86_64: 'x86_64' };
+// Node's names for the desktop arches, in Conan's spelling.
+const NODE_ARCHS = { x64: 'x86_64', arm64: 'armv8' };
+const LINUX_LIBCS = { linux: 'glibc', linuxmusl: 'musl' };
+const envLines = (env) => Object.entries(env).map(([variable, value]) => `${variable}=${value}`);
+
+// The image's clang wrappers through its CMake toolchain file for the triple, as a port archive for an
+// addon is built. The image runs no musl program, so a musl build is a cross build even on a machine of
+// the same arch, which Conan would take for a native one; configure is told the triple itself.
+const LINUX = {
+    settings: (target) => [
+        'os=Linux',
+        `arch=${NODE_ARCHS[target.arch]}`,
+        'compiler=clang',
+        `compiler.version=${clangMajorVersion(linuxTool(target, 'clang'))}`,
+        'compiler.libcxx=libc++',
+        `compiler.cppstd=${CPP_STANDARD}`,
+    ],
+    conf: (target) => [
+        `tools.build:compiler_executables={'c': '${linuxTool(target, 'clang')}', 'cpp': '${linuxTool(target, 'clang++')}'}`,
+        `tools.cmake.cmaketoolchain:user_toolchain=["${linuxToolchainFile(target)}"]`,
+        `tools.gnu:host_triplet=${linuxTriple(target)}`,
+        ...(target.platform === 'linuxmusl' ? ['tools.build.cross_building:cross_build=True'] : []),
+        `user.crossbind:libc=${LINUX_LIBCS[target.platform]}`,
+    ],
+    buildenv: (target) => envLines(linuxBuildEnv(target)),
+    flags: LINUX_ARCHIVE_FLAGS,
+};
+
+// What differs per platform; the rest of the host profile is shared.
+const PLATFORMS = {
+    wasm: {
+        settings: (target) => [
+            'os=Emscripten',
+            `arch=${target.arch === 'wasm64' ? 'wasm64' : 'wasm'}`,
+            'compiler=emcc',
+            `compiler.version=${EMCC_VERSION}`,
+            'compiler.libcxx=libc++',
+            `compiler.cppstd=${CPP_STANDARD}`,
+            ...(target.runtime === 'mt' ? ['compiler.threads=posix'] : []),
+        ],
+        conf: () => [
+            "tools.build:compiler_executables={'c': 'emcc', 'cpp': 'em++'}",
+            `tools.cmake.cmaketoolchain:user_toolchain=["${EMSCRIPTEN_TOOLCHAIN}"]`,
+        ],
+        buildenv: () => ['CC=emcc', 'CXX=em++', 'AR=emar', 'NM=emnm', 'RANLIB=emranlib', 'STRIP=emstrip'],
+        flags: WASM_EXCEPTION_FLAGS,
+    },
+    // The image's NDK through its own CMake toolchain and default STL, as a port archive is built.
+    android: {
+        settings: (target) => [
+            'os=Android',
+            `os.api_level=${ANDROID_API_LEVEL}`,
+            `arch=${ANDROID_ARCHS[target.arch]}`,
+            'compiler=clang',
+            `compiler.version=${NDK_CLANG_VERSION}`,
+            'compiler.libcxx=c++_static',
+            `compiler.cppstd=${CPP_STANDARD}`,
+        ],
+        conf: () => [`tools.android:ndk_path=${ANDROID_NDK}`],
+        buildenv: () => [],
+        flags: [],
+    },
+    // Xcode's clang for the target's SDK, arm64 only like every crossbind iOS slice. No bitcode flag:
+    // Xcode 27 ld takes the "marker" of -fembed-bitcode-marker for a file when CMake links its check.
+    ios: {
+        settings: (target) => [
+            'os=iOS',
+            `os.version=${IOS_DEPLOYMENT_TARGET}`,
+            `os.sdk=${target.arch}`,
+            'arch=armv8',
+            'compiler=apple-clang',
+            `compiler.version=${XCODE_CLANG_VERSION}`,
+            'compiler.libcxx=libc++',
+            `compiler.cppstd=${CPP_STANDARD}`,
+        ],
+        conf: () => [],
+        buildenv: () => [],
+        flags: [],
+    },
+    linux: LINUX,
+    linuxmusl: LINUX,
+    // The clang xcode-select picks, for the macOS the addons support, as a port archive for a macOS addon
+    // is built; the machine's own packages stay out of reach.
+    darwin: {
+        settings: (target) => [
+            'os=Macos',
+            `os.version=${DARWIN_DEPLOYMENT_TARGET}`,
+            `arch=${NODE_ARCHS[target.arch]}`,
+            'compiler=apple-clang',
+            `compiler.version=${clangMajorVersion(DARWIN_CC)}`,
+            'compiler.libcxx=libc++',
+            `compiler.cppstd=${CPP_STANDARD}`,
+        ],
+        conf: () => [
+            `tools.build:compiler_executables={'c': '${DARWIN_CC}', 'cpp': '${DARWIN_CXX}'}`,
+            `tools.cmake.cmaketoolchain:extra_variables={'CMAKE_IGNORE_PREFIX_PATH': '${DARWIN_HOST_PACKAGE_PREFIXES.join(';')}'}`,
+        ],
+        buildenv: () => ['PKG_CONFIG_LIBDIR='],
+        flags: [],
+    },
+    // The windows image's llvm-mingw through its CMake toolchain file for the triple, as a port archive for
+    // an addon is built. No compiler.runtime: that would make it a clang standing in for MSVC.
+    win32: {
+        settings: (target) => [
+            'os=Windows',
+            `arch=${NODE_ARCHS[target.arch]}`,
+            'compiler=clang',
+            `compiler.version=${clangMajorVersion(windowsTool(target, 'clang'))}`,
+            'compiler.libcxx=libc++',
+            `compiler.cppstd=${CPP_STANDARD}`,
+        ],
+        conf: (target) => [
+            `tools.build:compiler_executables={'c': '${windowsTool(target, 'clang')}', 'cpp': '${windowsTool(target, 'clang++')}', 'rc': '${windowsTool(target, 'windres')}'}`,
+            `tools.cmake.cmaketoolchain:user_toolchain=["${windowsToolchainFile(target)}"]`,
+            `tools.gnu:host_triplet=${windowsTriple(target)}`,
+        ],
+        buildenv: (target) => envLines(windowsBuildEnv(target)),
+        flags: [],
+    },
+};
+
+export const BUILD_PROFILE = [
+    '{% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}',
+    '[settings]',
+    'os={{ detect_api.detect_os() }}',
+    'arch={{ detect_api.detect_arch() }}',
+    'build_type=Release',
+    'compiler={{ compiler }}',
+    'compiler.version={{ detect_api.default_compiler_version(compiler, version) }}',
+    'compiler.cppstd={{ detect_api.default_cppstd(compiler, version) }}',
+    'compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}',
+    '',
+].join('\n');
+
+const list = (values) => JSON.stringify(values);
+
+// Conan checks compiler.version against the versions its own release lists, and a compiler newer than the
+// Conan release lists none for it: Xcode's on the host, or an image's after a toolchain bump. Added to the
+// run's home, this lets any version of the profile's clang through.
+export function settingsUser(target) {
+    const compiler = PLATFORMS[target.platform]?.settings(target).find((setting) => setting.startsWith('compiler='))?.slice('compiler='.length);
+    return ['clang', 'apple-clang'].includes(compiler) ? `compiler:\n  ${compiler}:\n    version: ["ANY"]\n` : null;
+}
+
+export function hostProfile(target) {
+    const platform = PLATFORMS[target.platform];
+    if (!platform) {
+        const names = Object.keys(PLATFORMS);
+        throw new Error(`crossbind: conan: imports build for ${names.slice(0, -1).join(', ')} and ${names.at(-1)} so far; ${target.platform} is not supported yet, so its build cannot use conanDependencies.`);
+    }
+    const flags = list([...platform.flags, ...targetArchiveFlags(target)]);
+    const buildenv = platform.buildenv(target);
+    return [
+        '[settings]',
+        ...platform.settings(target),
+        'build_type=Release',
+        '',
+        '[options]',
+        '*:shared=False',
+        '',
+        '[conf]',
+        ...platform.conf(target),
+        `tools.build:cflags=${flags}`,
+        `tools.build:cxxflags=${flags}`,
+        `tools.build:exelinkflags=${flags}`,
+        `tools.build:sharedlinkflags=${flags}`,
+        `tools.info.package_id:confs=${list(PACKAGE_ID_CONFS)}`,
+        '',
+        ...(buildenv.length > 0 ? ['[buildenv]', ...buildenv, ''] : []),
+        '[platform_tool_requires]',
+        `cmake/${CMAKE_VERSION}`,
+        '',
+    ].join('\n');
+}