crossbind 2.0.0-beta.62 → 2.0.0-beta.64

package/src/actions/createLib.js

@@ -10,8 +10,13 @@ import triggerExtensions from './extensions.js';
 import state from '../state/index.js';
 import logger from '../utils/logger.js';
 import { WASI_EMULATION_LIBS, WASI_LINK_LIBS, wasiCFlags, wasiCxxFlags } from '../utils/wasiToolchain.js';
+import { stageWasiHttpInclude, wasiHttpHeader } from '../utils/wasiHttp.js';
 import { getFilesFingerprint, getContentHash } from '../utils/hash.js';
 import { withDependencyBridges } from '../utils/dependencyBridges.js';
+import { targetArchiveFlags } from '../utils/archiveFlags.js';
+import { conanInputsOf } from '../utils/conanDependencies.js';
+import { nativeSourceStampChanged, writeNativeSourceStamp } from '../utils/nativeSourceStamp.js';
+import resetCMakeCacheForSource from '../utils/resetCMakeCacheForSource.js';
 
 const cpuCount = Math.max(1, os.cpus().length - 1);
 const sharedPlatforms = ['android'];
@@ -29,6 +34,11 @@ export default function createLib(target, fileType, options = {}) {
     const platformPrefix = `${fileType ? `${fileType}-` : ''}${buildType}`;
     const libdir = `${state.config.paths.build}/${platformPrefix}/prebuilt/${target.path}`;
     const buildPath = `${state.config.paths.build}/${platformPrefix}/${target.path}`;
+    const sourceDirs = options.buildSource ? state.config.paths.native : [];
+    const sourcesChanged = nativeSourceStampChanged(`${libdir}/lib`, sourceDirs);
+    // Automatically loaded cargo packages have no CMake dependency paths.
+    const depPaths = state.config.allDependencyPaths?.[target.path];
+    const sourceReplacements = state.config.build?.sourceReplaceList?.(target, depPaths) ?? [];
     // wasi configure tool links need the runtime stubs; compiled below, referenced from LIBS.
     const wasiStubObj = `${buildPath}/crossbind-wasi-stubs.o`;
 
@@ -40,10 +50,20 @@ export default function createLib(target, fileType, options = {}) {
     const fingerprintChanged = fingerprint !== null
         && (!fs.existsSync(fingerprintFile) || fs.readFileSync(fingerprintFile, { encoding: 'utf8' }) !== fingerprint);
 
-    // Config emccFlags feed compile-time state too (CROSSBIND_JSPI below), so a flag change must miss this cache.
+    // Config emccFlags feed compile-time state too (CROSSBIND_JSPI below), so a flag change must miss this cache, and so
+    // does a compile option a dependency declares (Lerc's LERC_STATIC on Windows). Without one the hash stays as it was.
     const configEmccFlags = getData('binary', target)?.emccFlags || [];
+    const compileOptions = getData('cmake', target)?.compileOptions || [];
     const flagsFingerprintFile = `${libdir}/crossbind-emccflags.fingerprint`;
-    const flagsFingerprint = getContentHash(JSON.stringify(configEmccFlags));
+    const conanInputs = conanInputsOf(state.config);
+    const compileInputs = compileOptions.length ? { emccFlags: configEmccFlags, compileOptions } : configEmccFlags;
+    const flagsInputs = sourceReplacements.length ? { compileInputs, sourceReplacements } : compileInputs;
+    const keyInputs = conanInputs ? [flagsInputs, conanInputs] : flagsInputs;
+    // An app's wasi source compiles against <crossbind/http.h>, so a new one misses this cache too.
+    const httpHeader = target.platform === 'wasi' && !state.config.build.withBuildConfig
+        ? getFilesFingerprint([wasiHttpHeader(state.config.paths.cli)])
+        : null;
+    const flagsFingerprint = getContentHash(JSON.stringify(httpHeader ? [keyInputs, httpHeader] : keyInputs));
     const flagsChanged = !fs.existsSync(flagsFingerprintFile)
         || fs.readFileSync(flagsFingerprintFile, { encoding: 'utf8' }) !== flagsFingerprint;
 
@@ -65,7 +85,7 @@ export default function createLib(target, fileType, options = {}) {
         return changed;
     }
 
-    if (!options.force && !fingerprintChanged && !flagsChanged && fs.existsSync(`${libdir}/lib`)) {
+    if (!options.force && !sourcesChanged && !fingerprintChanged && !flagsChanged && fs.existsSync(`${libdir}/lib`)) {
         logger.cachedStep(target, fileType);
         return false;
     }
@@ -79,7 +99,6 @@ export default function createLib(target, fileType, options = {}) {
 
     const buildEnv = { params: [] };
     let buildParams;
-    const depPaths = state.config.allDependencyPaths[target.path];
     if (state.config.build.withBuildConfig) {
         const { getBuildParams, getExtraLibs } = state.config.build;
         buildEnv.console = true;
@@ -106,31 +125,20 @@ export default function createLib(target, fileType, options = {}) {
         const extraLibs = getExtraLibs ? getExtraLibs(target) : [];
 
         triggerExtensions('createLib', 'setFlagWithBuildConfig', [buildEnv, cFlags, ldFlags]);
-        if (target.runtime === 'mt') {
-            cFlags.push('-pthread');
-            ldFlags.push('-pthread');
-        }
-
-        if (target.platform === 'wasm') {
-            cFlags.push('-msimd128');
-            ldFlags.push('-msimd128');
-        }
+        const archiveFlags = targetArchiveFlags(target);
+        cFlags.push(...archiveFlags);
+        ldFlags.push(...archiveFlags);
 
         if (isJspiTarget) {
             cFlags.push('-DCROSSBIND_JSPI');
         }
 
-        if (target.platform === 'wasm' && target.arch === 'wasm64') {
-            cFlags.push('-sMEMORY64=1');
-            ldFlags.push('-sMEMORY64=1');
-        }
-
         buildEnv.params.push('-e', `CFLAGS=${cFlags.join(' ')}`);
         buildEnv.params.push('-e', `CXXFLAGS=${cFlags.join(' ')}`);
         buildEnv.params.push('-e', `LDFLAGS=${ldFlags.join(' ')} ${extraLibs.join(' ')}`);
         // Emulation archives must land in LIBS (after the objects), not LDFLAGS.
         const wasiStubLib = state.config.build?.buildType === 'configure' ? `${wasiStubObj} ` : '';
-        const wasiLibs = target.platform === 'wasi' ? ` ${wasiStubLib}${WASI_EMULATION_LIBS.join(' ')}` : '';
+        const wasiLibs = target.platform === 'wasi' ? ` ${wasiStubLib}${WASI_EMULATION_LIBS.join(' ')} -Wl,--wrap=lseek` : '';
         buildEnv.params.push('-e', `LIBS=${dependLibs} ${extraLibs.join(' ')}${wasiLibs}`);
 
         let configBuildEnv = state.config.build.env;
@@ -141,26 +149,19 @@ export default function createLib(target, fileType, options = {}) {
             buildEnv.params.push('-e', e);
         });
     } else {
-        buildParams = getCmakeParameters(target, { ...options, nativeGlob });
+        // The source of an http build includes <crossbind/http.h>.
+        const headerDirs = target.platform === 'wasi'
+            ? [...(options.headerDirs ?? []), stageWasiHttpInclude(state.config.paths.cli, `${buildPath}/crossbind-wasi-http`)]
+            : options.headerDirs;
+        buildParams = getCmakeParameters(target, { ...options, nativeGlob, headerDirs });
 
         triggerExtensions('createLib', 'setFlagWithoutBuildConfig', [buildEnv]);
 
-        if (target.runtime === 'mt') {
-            buildEnv.params.push('-e', `CFLAGS=-pthread`);
-            buildEnv.params.push('-e', `CXXFLAGS=-pthread`);
-            buildEnv.params.push('-e', `LDFLAGS=-pthread`);
-        }
-
-        if (target.platform === 'wasm') {
-            buildEnv.params.push('-e', `CFLAGS=-msimd128`);
-            buildEnv.params.push('-e', `CXXFLAGS=-msimd128`);
-            buildEnv.params.push('-e', `LDFLAGS=-msimd128`);
-        }
-
-        if (target.platform === 'wasm' && target.arch === 'wasm64') {
-            buildEnv.params.push('-e', `CFLAGS=-sMEMORY64=1`);
-            buildEnv.params.push('-e', `CXXFLAGS=-sMEMORY64=1`);
-            buildEnv.params.push('-e', `LDFLAGS=-sMEMORY64=1`);
+        const archiveFlags = targetArchiveFlags(target).join(' ');
+        if (archiveFlags) {
+            buildEnv.params.push('-e', `CFLAGS=${archiveFlags}`);
+            buildEnv.params.push('-e', `CXXFLAGS=${archiveFlags}`);
+            buildEnv.params.push('-e', `LDFLAGS=${archiveFlags}`);
         }
 
         if (isJspiTarget) {
@@ -171,7 +172,17 @@ export default function createLib(target, fileType, options = {}) {
 
     logger.startStep(target, fileType);
     const t0 = performance.now();
-    const cmakeDir = state.config.build.withBuildConfig ? `${state.config.paths.build}/source` : state.config.paths.cmakeDir;
+    let cmakeDir = state.config.build.withBuildConfig ? `${state.config.paths.build}/source` : state.config.paths.cmakeDir;
+    if (state.config.build?.buildType !== 'configure' && sourceReplacements.length) {
+        // Patches belong to a target's copy: a platform-specific change must not alter another target's inputs.
+        const patchedSource = `${buildPath}/crossbind-source`;
+        fs.mkdirSync(buildPath, { recursive: true });
+        fs.cpSync(cmakeDir, patchedSource, { recursive: true, preserveTimestamps: true });
+        sourceReplacements.forEach(({ regex, replacement, paths }) => {
+            replace({ regex, replacement, paths: paths.map((p) => `${patchedSource}/${p}`), recursive: false, silent: true });
+        });
+        cmakeDir = patchedSource;
+    }
 
     if (state.config.build?.beforeRun) {
         const dataList = state.config.build?.beforeRun(cmakeDir);
@@ -191,11 +202,24 @@ export default function createLib(target, fileType, options = {}) {
         ], platformPrefix, target, { console: buildEnv.console });
     };
 
-    if (!options.bypassCmake) {
+    // A configure build's make install runs coreutils install, whose chmod on a file it has just written
+    // Docker Desktop's file sharing now and then refuses; the wrapper finishes it by path. Staged like stubs.c.
+    const stageInstall = () => {
+        const staged = `${buildPath}/crossbind-install.sh`;
+        fs.mkdirSync(buildPath, { recursive: true });
+        fs.copyFileSync(`${state.config.paths.cli}/assets/configure/install.sh`, staged);
+        fs.chmodSync(staged, 0o755);
+        return staged;
+    };
+
+    if (!options.bypassCmake || sourcesChanged) {
         if (state.config.build?.buildType === 'configure') {
-            fs.cpSync(cmakeDir, buildPath, { recursive: true });
-            if (state.config.build?.sourceReplaceList) {
-                state.config.build.sourceReplaceList(target, depPaths)?.forEach(({ regex, replacement, paths }) => {
+            // make compares times, so the tree starts afresh with the extracted times: no source then looks newer
+            // than what it generates, and no object of an earlier build looks newer than its source.
+            fs.rmSync(buildPath, { recursive: true, force: true });
+            fs.cpSync(cmakeDir, buildPath, { recursive: true, preserveTimestamps: true });
+            if (sourceReplacements.length) {
+                sourceReplacements.forEach(({ regex, replacement, paths }) => {
                     replace({
                         regex, replacement, paths: paths.map((p) => `${buildPath}/${p}`), recursive: false, silent: true,
                     });
@@ -216,6 +240,7 @@ export default function createLib(target, fileType, options = {}) {
                 stageWasiStubs();
                 buildParams.push(`-DCMAKE_EXE_LINKER_FLAGS=${[...wasiCxxFlags(), wasiStubObj, ...WASI_LINK_LIBS].join(' ')}`);
             }
+            resetCMakeCacheForSource(buildPath, cmakeDir, target);
             run(null, [
                 target.platform === 'ios' && state.config.build?.useIOSCMake ? 'ios-cmake' : 'cmake', cmakeDir,
                 `-DCMAKE_BUILD_TYPE=${buildType}`,
@@ -232,8 +257,10 @@ export default function createLib(target, fileType, options = {}) {
         // Some upstream makefiles race when one -j invocation carries multiple goals (openssl's
         // install builds apps twice); recipes can split phases via build.makePhases.
         const makePhases = state.config.build?.makePhases || [['install']];
+        // A make command-line variable beats the Makefile's own INSTALL, autosetup's (sqlite3) included.
+        const installParams = state.config.build?.buildType === 'configure' ? [`INSTALL=${stageInstall()}`] : [];
         makePhases.forEach((phase) => {
-            run(null, ['make', `-j${cpuCount}`, ...phase], platformPrefix, target, { console: buildEnv.console });
+            run(null, ['make', `-j${cpuCount}`, ...installParams, ...phase], platformPrefix, target, { console: buildEnv.console, exclusive: true });
         });
     }
     const t2 = performance.now();
@@ -247,6 +274,7 @@ export default function createLib(target, fileType, options = {}) {
         fs.writeFileSync(fingerprintFile, fingerprint);
     }
     fs.writeFileSync(flagsFingerprintFile, flagsFingerprint);
+    writeNativeSourceStamp(`${libdir}/lib`, sourceDirs);
     // Callers can force the final link when a lib actually rebuilt.
     return true;
 }

package/src/actions/getData.js

@@ -3,7 +3,10 @@ import state from '../state/index.js';
 import { getFilteredTargetSpec, getBuildTargets } from './target.js';
 
 function getRecursiveData(obj, config, dependency, field, target) {
-    const entryArray = getFilteredTargetSpec(dependency?.targetSpecs, target).map(s => s[field]);
+    // An app may list a port's wasm, Android and iOS packages together. One with no prebuilt for the target
+    // drops out of the link, and its data stays out with it.
+    const skipsTarget = field === 'data' && dependency !== config && dependency.functions?.isEnabled && !dependency.functions.isEnabled(target);
+    const entryArray = skipsTarget ? [] : getFilteredTargetSpec(dependency?.targetSpecs, target).map(s => s[field]);
     const entries = Object.assign({}, ...entryArray);
     Object.entries(entries).forEach(([dKey, value]) => {
         if (field === 'data') {
@@ -27,7 +30,8 @@ function getRecursiveData(obj, config, dependency, field, target) {
                 obj[dKey] = [...(obj[dKey] || []), ...value];
             } else if (typeof value === 'object') {
                 obj[dKey] = { ...(obj[dKey] || {}), ...value };
-            } else {
+            } else if (!Object.hasOwn(obj, dKey)) {
+                // The app comes before its dependencies and a package before its own, so the nearest value stays.
                 obj[dKey] = value;
             }
         }

package/src/actions/getEnv.js

@@ -0,0 +1,7 @@
+import state from '../state/index.js';
+import getData from './getData.js';
+
+export default function getEnv(target) {
+    return Object.fromEntries(Object.entries(getData('env', target))
+        .map(([key, value]) => [key, typeof value === 'function' ? value(state, target) : value]));
+}

package/src/actions/getLinkInputs.js

@@ -3,9 +3,10 @@ import getDependLibs from './getDependLibs.js';
 import state from '../state/index.js';
 import buildAppRustCrates from '../utils/appRustCrates.js';
 
-// The archives of a final link (wasm or Node-API addon) and which of them must survive whole.
-// keepFlag spells "keep this symbol" for the target's linker.
-export default function getLinkInputs(target, { keepFlag }) {
+// The archives of a final link (wasm, Node-API addon or native executable) and which of them must
+// survive whole. keepFlag spells "keep this symbol" for the target's linker; a native executable
+// binds nothing, so it links no bridge.
+export default function getLinkInputs(target, { keepFlag, withBridge = true }) {
     const buildType = target.buildType === 'release' ? 'Release' : 'Debug';
     const { build, output, cache } = state.config.paths;
     const { name } = state.config.general;
@@ -23,7 +24,7 @@ export default function getLinkInputs(target, { keepFlag }) {
         ...getDependLibs(target),
         ...appRustLibs,
         sourceLibCandidates.find((lib) => fs.existsSync(lib)) ?? sourceLibCandidates[0],
-        `${build}/Bridge-${buildType}/${target.path}/lib${name}.a`,
+        ...(withBridge ? [`${build}/Bridge-${buildType}/${target.path}/lib${name}.a`] : []),
     ];
 
     // By default only the Bridge archive is kept whole (see linkLayout.js) so the linker
@@ -38,8 +39,14 @@ export default function getLinkInputs(target, { keepFlag }) {
     // with their keep symbol pinned (keepFlag pulls just the registration object); manual-bindings
     // crates have no keep symbol and fall back to whole-archive - safe only while they are the
     // single loaded Rust archive.
+    // A COFF link cannot load the super whole either: two crates in it may import one DLL through raw-dylib (std
+    // and getrandom both take ProcessPrng from bcryptprimitives.dll), and lld fails on the repeated import tables.
+    // There it links like a package bridge, through its keep symbol.
     const rustKeepFlags = [];
-    if (appRustLibs.length > 0) wholeArchiveNames.add('crossbind_app_super');
+    if (appRustLibs.length > 0) {
+        if (target.platform === 'win32') rustKeepFlags.push(keepFlag('crossbind_app_super'));
+        else wholeArchiveNames.add('crossbind_app_super');
+    }
     const depends = state.config.dependencyParameters.getCmakeDepends(target);
     depends.forEach((dep) => {
         if (dep.export.wholeArchive === true) {

package/src/actions/isSourceNewer.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import p from 'node:path';
 import state from '../state/index.js';
+import { nativeSourceStampChanged } from '../utils/nativeSourceStamp.js';
 
 function newestMtimeInDir(dir) {
     let newest = 0;
@@ -22,6 +23,7 @@ function newestMtimeInDir(dir) {
 // (bundler plugins: the built js) or a directory (CLI lib cache: the staged prebuilt dir).
 export function isNativeSourceNewerThan(artifactPath) {
     if (!fs.existsSync(artifactPath)) return false;
+    if (nativeSourceStampChanged(artifactPath, state.config.paths.native)) return true;
     const stat = fs.statSync(artifactPath);
     const artifactMtime = stat.isDirectory() ? newestMtimeInDir(artifactPath) : stat.mtimeMs;
     for (const dir of state.config.paths.native) {

package/src/actions/licenses.js

@@ -1,14 +1,24 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import state from '../state/index.js';
 import loadJs from '../utils/loadJs.js';
 import { isCopyleft } from '../utils/licenseReport.js';
 import familyManifestOf from '../utils/familyManifest.js';
 import { wasiToolchainIdentity } from '../utils/provenance.js';
 import { resolveWasiSdkPath } from '../utils/wasiToolchain.js';
+import resolveEmbindNapiRoot, { resolveEmbindJsiRoot } from '../utils/resolveEmbindNapi.js';
+import { shippedBundledLicense } from '../utils/bundledLicenses.js';
+import toolchainNoticesDir from '../utils/toolchainNotices.js';
 
 const LEGACY_LICENSE_FILES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING'];
 const WASI_LIBC_LICENSE = 'Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT';
+const CROSSBIND_ROOT = fileURLToPath(new URL('../..', import.meta.url));
+const MISSING_TEXT = '(missing: build the package once to extract the upstream source)';
+
+function packageLicenseFile(dir) {
+    return LEGACY_LICENSE_FILES.map((name) => path.join(dir, name)).find((file) => fs.existsSync(file));
+}
 
 // License texts come from any extracted upstream source tree of the family (variants share the tarball).
 function findSourceDir(familyDir) {
@@ -20,20 +30,21 @@ function findSourceDir(familyDir) {
     return null;
 }
 
-function readLicenseTexts(sourceDir, files) {
+function readLicenseTexts(files, locate) {
     const texts = (files || []).map((file) => {
-        const filePath = sourceDir ? path.join(sourceDir, file) : null;
+        const filePath = locate(file);
         const body = filePath && fs.existsSync(filePath)
             ? fs.readFileSync(filePath, 'utf8').trim()
-            : '(missing: build the package once to extract the upstream source)';
+            : MISSING_TEXT;
         return `=== ${file} ===\n\n${body}`;
     });
     return texts.length > 0 ? texts.join('\n\n') : null;
 }
 
 // Vendored copies compiled into the artifact (recipe `bundled` map, keyed by platform)
-// become first-class notice/SBOM rows with texts from the family source tree.
-async function bundledRowsOf(node, platform) {
+// become first-class notice/SBOM rows with texts from the family source tree, or from the dist
+// of whichever package of the family shipped them.
+async function bundledRowsOf(node, platform, familyProjects) {
     const recipe = await loadJs(node.paths.project, 'crossbind.build');
     const entries = recipe?.bundled?.[platform];
     if (!entries || entries.length === 0) return [];
@@ -50,7 +61,9 @@ async function bundledRowsOf(node, platform) {
         licenseNotes: `${entry.notes ? `${entry.notes}; ` : ''}vendored inside ${node.general.name} ${node.package?.nativeVersion || ''}`.trim(),
         sha256: null,
         sourceUrl: null,
-        licenseText: readLicenseTexts(sourceDir, entry.files),
+        licenseText: readLicenseTexts(entry.files, (file) => (sourceDir
+            ? path.join(sourceDir, file)
+            : shippedBundledLicense(familyProjects, entry.name, file))),
         isCopyleft: isCopyleft(entry.license),
     }));
 }
@@ -90,6 +103,16 @@ function wasiToolchainRows() {
     ];
 }
 
+// The notices a build copied out of its toolchain image (buildNode does it for Windows addons).
+function toolchainNoticeTexts(platform) {
+    const build = state.config?.paths?.build;
+    const dir = build ? path.join(build, toolchainNoticesDir(platform)) : null;
+    if (!dir || !fs.existsSync(dir)) return null;
+    const texts = fs.readdirSync(dir).sort()
+        .map((file) => `=== ${file} ===\n\n${fs.readFileSync(path.join(dir, file), 'utf8').trim()}`);
+    return texts.length > 0 ? texts.join('\n\n') : null;
+}
+
 // A Linux or Windows addon carries its C++ runtime; a Windows one also carries parts of the
 // mingw-w64 runtime and winpthreads, whose licenses ask for their notices in binary distributions.
 // A macOS addon uses the system's C++ runtime.
@@ -106,7 +129,7 @@ function addonToolchainRows(platform) {
         sourceUrl: 'https://github.com/llvm/llvm-project',
     };
     const llvmText = 'license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT';
-    if (platform === 'linux') {
+    if (platform === 'linux' || platform === 'linuxmusl') {
         return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the addon; ${llvmText}` }];
     }
     const mingwLicense = 'LicenseRef-MinGW-w64-runtime';
@@ -119,8 +142,57 @@ function addonToolchainRows(platform) {
             licenseDeclared: mingwLicense,
             sourceUrl: 'https://github.com/mingw-w64/mingw-w64',
             licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the addon; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
+            licenseText: toolchainNoticeTexts('win32'),
+        },
+    ];
+}
+
+// A Node-API addon compiles in crossbind's runtime: embind-jsi, which adapts Emscripten's embind,
+// and node-api-jsi. The loader bundles the JavaScript half of the same runtime.
+function nodeRuntimeRows({ isAddon }) {
+    const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
+    const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
+    const shared = {
+        nativeVersion: null, sha256: null, licenseSelected: null, isCopyleft: false,
+    };
+    const jsiRoot = resolveEmbindJsiRoot();
+    const rows = [
+        {
+            ...shared,
+            name: 'crossbind',
+            npmName: 'crossbind',
+            version: versionOf(CROSSBIND_ROOT),
+            license: 'MIT',
+            licenseDeclared: 'MIT',
+            sourceUrl: 'https://github.com/crossbind/crossbind',
+            licenseNotes: 'the embind-jsi and embind-napi runtime and the bindings crossbind generates',
+            licenseText: textOf(path.join(CROSSBIND_ROOT, 'LICENSE')),
+        },
+        {
+            ...shared,
+            name: 'emscripten-embind',
+            npmName: '@crossbind/core-embind-jsi',
+            version: versionOf(jsiRoot),
+            license: 'MIT OR NCSA',
+            licenseDeclared: 'MIT OR NCSA',
+            sourceUrl: 'https://github.com/emscripten-core/emscripten',
+            licenseNotes: "Emscripten's embind, adapted by @crossbind/core-embind-jsi",
+            licenseText: textOf(path.join(jsiRoot, 'LICENSE')),
         },
     ];
+    if (!isAddon) return rows;
+    const napiRoot = resolveEmbindNapiRoot();
+    return [...rows, {
+        ...shared,
+        name: 'node-api-jsi',
+        npmName: '@crossbind/core-embind-napi',
+        version: versionOf(napiRoot),
+        license: 'MIT',
+        licenseDeclared: 'MIT',
+        sourceUrl: 'https://github.com/microsoft/node-api-jsi',
+        licenseNotes: 'JSI over Node-API, with the local patches @crossbind/core-embind-napi lists',
+        licenseText: textOf(path.join(napiRoot, 'third_party', 'node-api-jsi', 'LICENSE')),
+    }];
 }
 
 async function buildRow(node) {
@@ -143,12 +215,18 @@ async function buildRow(node) {
     let licenseText;
     if (upstream) {
         license = upstream.selected || upstream.declared;
-        licenseText = readLicenseTexts(findSourceDir(family.dir), upstream.files);
+        const sourceDir = findSourceDir(family.dir);
+        const fromSource = sourceDir ? readLicenseTexts(upstream.files, (file) => path.join(sourceDir, file)) : null;
+        const isComplete = Boolean(fromSource) && !fromSource.includes(MISSING_TEXT);
+        // An installed package has no extracted source, and some upstreams name no license file; the package
+        // ships the upstream text as its LICENSE either way.
+        const shipped = isComplete ? null : packageLicenseFile(node.paths.project);
+        if (isComplete) licenseText = fromSource;
+        else if (shipped) licenseText = `=== ${path.basename(shipped)} ===\n\n${fs.readFileSync(shipped, 'utf8').trim()}`;
+        else licenseText = readLicenseTexts(upstream.files, () => null);
     } else {
         license = manifest?.license || null;
-        const legacy = LEGACY_LICENSE_FILES
-            .map((name) => `${node.paths.project}/${name}`)
-            .find((file) => fs.existsSync(file));
+        const legacy = packageLicenseFile(node.paths.project);
         licenseText = legacy ? fs.readFileSync(legacy, 'utf8') : null;
     }
 
@@ -168,23 +246,69 @@ async function buildRow(node) {
     };
 }
 
+// A Conan package's facts come from its recipe, and its texts from the licenses/ its package ships.
+function conanRow(node) {
+    const { conan } = node.general;
+    const licenseDir = `${node.paths.project}/licenses`;
+    const files = fs.existsSync(licenseDir)
+        ? fs.readdirSync(licenseDir, { recursive: true, withFileTypes: true }).filter((entry) => entry.isFile())
+        : [];
+    const texts = files.map((entry) => path.join(entry.parentPath, entry.name)).sort()
+        .map((file) => `=== ${path.relative(licenseDir, file)} ===\n\n${fs.readFileSync(file, 'utf8').trim()}`);
+    return {
+        name: conan.name,
+        npmName: null,
+        version: null,
+        nativeVersion: conan.version,
+        license: conan.license,
+        licenseDeclared: null,
+        licenseSelected: null,
+        licenseNotes: `built from the ConanCenter recipe ${conan.ref}`,
+        sha256: conan.source?.sha256 ?? null,
+        sourceUrl: conan.source?.url ?? conan.homepage ?? null,
+        licenseText: texts.length > 0 ? texts.join('\n\n') : null,
+        isCopyleft: isCopyleft(conan.license),
+        purl: `pkg:conan/${conan.name}@${conan.version}`,
+    };
+}
+
+// Conan packages join the graph from the stage a build makes; without it they would be left out unseen.
+function assertConanStaged() {
+    const attached = new Set(state.config.allDependencies.filter((d) => d.general.conan).map((d) => d.general.conan.name));
+    const missing = Object.keys(state.config.conanDependencies ?? {}).filter((name) => !attached.has(name));
+    if (missing.length > 0) {
+        throw new Error(`crossbind: the Conan packages ${missing.join(', ')} are not installed for the current conanDependencies, so their rows would be missing. Build the project first.`);
+    }
+}
+
 // platform (optional, e.g. 'wasi') additionally includes what that platform's
 // artifact statically links beyond the package graph: recipe-declared vendored
-// copies and the toolchain runtime.
-export default async function collectLicenseRows(platform = null) {
-    // The root package is a component too: leaf -wasi packages have no deps but ship their own upstream.
+// copies and the toolchain runtime. runtimeEnv 'node' adds the crossbind runtime an
+// addon of that platform compiles in, or without a platform the one its loader bundles.
+export default async function collectLicenseRows(platform = null, { runtimeEnv = null } = {}) {
+    assertConanStaged();
+    // The root package is a component too when it is a port: leaf -wasi packages have no deps but ship
+    // their own upstream. A dependency that is no port, such as a library a project publishes, is one by
+    // its package name; a private package is the project's own code, like the app.
+    const keyOf = (node) => (node.general.conan ? `conan:${node.general.conan.name}` : node.general.alias?.package ?? node.package?.name);
     const nodes = [state.config, ...state.config.allDependencies]
-        .filter((node) => node?.general?.alias?.package && node.paths?.project);
+        .filter((node, index) => node?.paths?.project
+            && (node.general?.alias?.package || node.general?.conan || (index > 0 && node.package?.name && !node.package.private)));
     const rows = [];
     const seen = new Set();
     for (const node of nodes) {
-        const key = node.general.alias.package;
+        const key = keyOf(node);
         if (seen.has(key)) continue;
         seen.add(key);
-        rows.push(await buildRow(node));
-        if (platform) rows.push(...await bundledRowsOf(node, platform));
+        rows.push(node.general.conan ? conanRow(node) : await buildRow(node));
+        // A Conan package's folder is written from what its recipe produced: nothing there is run.
+        if (platform && !node.general.conan) {
+            const familyProjects = nodes.filter((other) => keyOf(other) === key).map((other) => other.paths.project);
+            rows.push(...await bundledRowsOf(node, platform, familyProjects));
+        }
     }
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
-    if (platform === 'linux' || platform === 'win32') rows.push(...addonToolchainRows(platform));
+    if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
+    if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }

package/src/actions/prepareConanDependencies.js

@@ -0,0 +1,51 @@
+import fs from 'node:fs';
+import state, { setAllDependecyPaths } from '../state/index.js';
+import refreshConanDependencies from '../state/refreshConanDependencies.js';
+import installConanPackages from '../utils/conanInstall.js';
+import { releaseTargetOf, HOST_BUILT_PLATFORMS } from '../utils/targets.js';
+import createXCFramework from './createXCFramework.js';
+
+const mtimeOf = (file) => fs.statSync(file, { throwIfNoEntry: false })?.mtimeMs ?? -Infinity;
+// iOS and macOS build on a Mac alone: elsewhere the build leaves them out, and so does the staging.
+const isBuiltHere = (target) => process.platform === 'darwin' || !HOST_BUILT_PLATFORMS.includes(target.platform);
+
+// iOS headers and archives come out of an xcframework per library with a slice per SDK (state/index.js).
+// One older than an archive it wraps was made before the package was staged again.
+function makeConanXCFrameworks(iosTargets) {
+    const archiveOf = (dependency, target, name) => `${dependency.paths.output}/prebuilt/${target.path}/lib/lib${name}.a`;
+    const isFresh = (dependency, name) => mtimeOf(`${dependency.paths.project}/${name}.xcframework/Info.plist`)
+        >= Math.max(...iosTargets.map((target) => mtimeOf(archiveOf(dependency, target, name))));
+    state.config.allDependencies.filter((dependency) => dependency.general.conan).forEach((dependency) => {
+        // A library its recipe names on another platform only has no slice here.
+        const libName = dependency.export.libName.filter((name) => iosTargets.every((target) => fs.existsSync(archiveOf(dependency, target, name))));
+        if (libName.every((name) => isFresh(dependency, name))) return;
+        createXCFramework({
+            paths: { project: dependency.paths.project, output: dependency.paths.output },
+            export: { libName },
+            targetParams: {
+                platform: ['ios'], arch: iosTargets.map((target) => target.arch), runtime: ['mt'], buildType: ['release'],
+            },
+        });
+    });
+}
+
+// Conan packages are staged before any header is read: SWIG parses headers that include theirs, and an
+// interface made without its includes stays that way until the header itself changes. Release trees
+// only - a debug build links them like any prebuilt.
+export default async function prepareConanDependencies(targets) {
+    if (Object.keys(state.config.conanDependencies ?? {}).length === 0) return;
+    // createBridgeFile reads every header for the first wasm target unless it is told otherwise, as it
+    // is by Metro, which builds the React Native bridges for the platform's own target, and by a Node
+    // build, which reads them for one of its own (nodeBridgeTarget).
+    const bridgeTarget = targets.some((target) => target.platform === 'wasm') && state.targets.find((target) => target.platform === 'wasm');
+    // One xcframework holds both SDKs, so an iOS build stages both.
+    const iosTargets = targets.some((target) => target.platform === 'ios') ? state.targets.filter((target) => target.platform === 'ios') : [];
+    const releaseTargets = [...new Map([...targets, bridgeTarget, ...iosTargets].filter(Boolean).map((target) => [
+        target.releasePath, releaseTargetOf(target),
+    ])).values()].filter(isBuiltHere);
+    await installConanPackages(state.config, releaseTargets);
+    // Also when another process did the staging: this one may have loaded before the manifests existed.
+    refreshConanDependencies(state.config);
+    setAllDependecyPaths();
+    if (iosTargets.length > 0) makeConanXCFrameworks(releaseTargets.filter((target) => target.platform === 'ios'));
+}

package/src/actions/publishBinary.js

@@ -0,0 +1,32 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import state from '../state/index.js';
+import replaceFile from '../utils/replaceFile.js';
+
+// paths.output defaults to paths.build, where a built command and its data already are; copying them onto
+// themselves would delete them first.
+const outputIsBuild = () => path.resolve(state.config.paths.output) === path.resolve(state.config.paths.build);
+
+export function publishNativeCommand(target) {
+    if (outputIsBuild()) return;
+    fs.mkdirSync(state.config.paths.output, { recursive: true });
+    replaceFile(`${state.config.paths.build}/${target.commandName}`, `${state.config.paths.output}/${target.commandName}`);
+}
+
+export function publishNodeAddon(target) {
+    if (outputIsBuild()) return;
+    fs.mkdirSync(state.config.paths.output, { recursive: true });
+    replaceFile(`${state.config.paths.build}/${target.addonName}`, `${state.config.paths.output}/${target.addonName}`);
+    fs.copyFileSync(`${state.config.paths.build}/${target.jsName}`, `${state.config.paths.output}/${target.jsName}`);
+}
+
+export function publishWasiCommand(target) {
+    if (outputIsBuild()) return;
+    fs.copyFileSync(`${state.config.paths.build}/${target.wasmName}`, `${state.config.paths.output}/${target.wasmName}`);
+    // Copied (not renamed) so a later fingerprint cache-hit still has the
+    // build-dir tree to serve from.
+    if (fs.existsSync(`${state.config.paths.build}/data`)) {
+        fs.rmSync(`${state.config.paths.output}/data`, { recursive: true, force: true });
+        fs.cpSync(`${state.config.paths.build}/data`, `${state.config.paths.output}/data`, { recursive: true });
+    }
+}