crossbind 2.0.0-beta.63 → 2.0.0-beta.64

package/AGENTS.md

@@ -4,7 +4,8 @@
 
 ## What lives here
 
-- `src/bin.js` — `crossbind` CLI entry; commander commands, target filtering and top-level orchestration.
+- `src/cli.js` — `crossbind` CLI entry: `login`, `logout`, `usage`, `account`, `config` and `--version` run from `src/program.js` without loading a project (only `config list -t all|project` loads it); every other command goes to `src/bin.js`.
+- `src/bin.js` — the commands that need a project; commander commands, target filtering and top-level orchestration.
 - `src/index.js` — public API barrel re-exported as the `crossbind` npm package (`createLib`, `buildWasm`, `state`, `getData`, `isSourceNewer`, …).
 - `src/actions/` — the actual build steps. **Most edits land here.**
 - `src/state/` — config loading + target matrix.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "crossbind",
-    "version": "2.0.0-beta.63",
+    "version": "2.0.0-beta.64",
     "license": "MIT",
     "homepage": "https://crossbind.dev",
     "repository": "https://github.com/crossbind/crossbind.git",
@@ -10,7 +10,7 @@
         "node": ">=24"
     },
     "bin": {
-        "crossbind": "./src/bin.js"
+        "crossbind": "./src/cli.js"
     },
     "main": "src/index.js",
     "exports": {

package/src/actions/buildJs.js

@@ -5,7 +5,7 @@ import { nodeResolve } from '@rollup/plugin-node-resolve';
 import commonjs from '@rollup/plugin-commonjs';
 import virtual from '@rollup/plugin-virtual';
 import state from '../state/index.js';
-import getData from './getData.js';
+import getEnv from './getEnv.js';
 
 const SUPPRESSED_WARN_CODES = new Set([
     'MISSING_GLOBAL_NAME',
@@ -53,14 +53,7 @@ options.edge = options.browser;
 
 export default async function buildJS(target) {
     const entryJS = `${state.config.paths.cli}/assets/js-runtime/${target.runtimeEnv}.js`;
-    const rawEnv = getData('env', target);
-    const resolvedEnv = Object.fromEntries(
-        Object.entries(rawEnv).map(([key, value]) => [
-            key,
-            typeof value === 'function' ? value(state, target) : value,
-        ]),
-    );
-    const env = JSON.stringify(resolvedEnv);
+    const env = JSON.stringify(getEnv(target));
     const systemConfig = `export default {
         env: ${env},
         useWorker: !!globalThis.Worker,

package/src/actions/buildNode.js

@@ -8,6 +8,8 @@ import virtual from '@rollup/plugin-virtual';
 import run from './run.js';
 import getLinkInputs from './getLinkInputs.js';
 import getData from './getData.js';
+import getEnv from './getEnv.js';
+import resetCMakeCacheForSource from '../utils/resetCMakeCacheForSource.js';
 import { suppressNodeBuiltinWarnings } from './buildJs.js';
 import state from '../state/index.js';
 import logger from '../utils/logger.js';
@@ -52,11 +54,6 @@ function linkInputs(target) {
     return { libs, linkArgs, extraSources };
 }
 
-function envOf(target) {
-    return Object.fromEntries(Object.entries(getData('env', target))
-        .map(([key, value]) => [key, typeof value === 'function' ? value(state, target) : value]));
-}
-
 // A package publishes its addons in <package>-<platform>-<arch> by listing them as optional
 // dependencies, which is also how npm learns to install only the one for its machine.
 function listsAddonPackage(target) {
@@ -82,7 +79,7 @@ export function nodeLoaderConfig(target) {
     const addonPackage = addonPackagePattern(served);
     const loaded = addonPackage ? served.filter(listsAddonPackage) : served;
     return {
-        env: Object.fromEntries(loaded.map((t) => [`${t.platform}-${t.arch}`, envOf(t)])),
+        env: Object.fromEntries(loaded.map((t) => [`${t.platform}-${t.arch}`, getEnv(t)])),
         general: { name: state.config.general.name },
         paths: { addon: target.addonPattern, ...(addonPackage ? { addonPackage } : {}) },
     };
@@ -162,6 +159,7 @@ export default async function buildNode(target, options = {}) {
 
     const platformPrefix = `Node-${buildType}`;
     logger.startStep(target, 'addon');
+    resetCMakeCacheForSource(`${build}/${platformPrefix}/${target.path}`, `${napiRoot}/cpp`, target);
     run(null, [
         'cmake', `${napiRoot}/cpp`,
         `-DCMAKE_BUILD_TYPE=${buildType}`,

package/src/actions/buildWasiCommand.js

@@ -7,14 +7,18 @@ import logger from '../utils/logger.js';
 import { getContentHash, getFilesFingerprint } from '../utils/hash.js';
 import { buildLinkLibArgs } from '../utils/linkLayout.js';
 import { wasiCxxFlags, WASI_LINK_LIBS } from '../utils/wasiToolchain.js';
+import { stageWasiHttpLink, wasiHttpFiles } from '../utils/wasiHttp.js';
 
 // Links a platform:'wasi' target into one command module: main() is the entry, deps are DCE'd, data lands as a real dir for --dir preopens.
+// An http target links into a wasi:http/service component instead, whose entry is crossbind's handler export.
 export default async function buildWasiCommand(target, options = {}) {
     const isProd = target.buildType === 'release';
     const buildType = isProd ? 'Release' : 'Debug';
+    const isHttp = target.runtimeEnv === 'http';
+    const step = isHttp ? 'wasi http' : 'wasi command';
 
     if (state.config.export?.type === 'cargo') {
-        logger.info(`[${target.path}] wasi command skipped (cargo packages have no cargo wasi triple)`);
+        logger.info(`[${target.path}] ${step} skipped (cargo packages have no cargo wasi triple)`);
         return false;
     }
 
@@ -52,17 +56,17 @@ export default async function buildWasiCommand(target, options = {}) {
             return { lib, size: stat ? stat.size : null, mtimeMs: stat ? stat.mtimeMs : null };
         }),
         data: getData('data', target),
-        runtime: getFilesFingerprint([stubs]),
+        runtime: getFilesFingerprint([stubs, ...(isHttp ? wasiHttpFiles(state.config.paths.cli) : [])]),
     }));
     const linkChanged = !fs.existsSync(linkFingerprintFile)
         || fs.readFileSync(linkFingerprintFile, { encoding: 'utf8' }) !== linkFingerprint;
 
     if (!options.force && !linkChanged && fs.existsSync(`${state.config.paths.build}/${target.wasmName}`)) {
-        logger.cachedStep(target, 'wasi command');
+        logger.cachedStep(target, step);
         return false;
     }
 
-    logger.startStep(target, 'wasi command');
+    logger.startStep(target, step);
     const t0 = performance.now();
     // stubs.c lives outside the docker mount (paths.cli); stage it next to the artifact.
     const stagedStubs = `${state.config.paths.build}/crossbind-wasi-stubs.c`;
@@ -71,6 +75,7 @@ export default async function buildWasiCommand(target, options = {}) {
     run(null, [
         'wasi-clang++',
         stagedStubs,
+        ...(isHttp ? stageWasiHttpLink(state.config.paths.cli, `${state.config.paths.build}/crossbind-wasi-http`) : []),
         ...wasiCxxFlags(),
         ...(isProd ? ['-O3'] : ['-O0']),
         ...wasiFlags,
@@ -79,7 +84,7 @@ export default async function buildWasiCommand(target, options = {}) {
         '-o', `${state.config.paths.build}/${target.wasmName}`,
     ], null, target);
     const ms = Math.round(performance.now() - t0);
-    logger.doneStep(target, 'wasi command', ms < 1000 ? `${ms}ms` : `${(ms / 1000).toFixed(1)}s`);
+    logger.doneStep(target, step, ms < 1000 ? `${ms}ms` : `${(ms / 1000).toFixed(1)}s`);
 
     // Dep data lands as a real folder next to the artifact for --dir preopens.
     Object.entries(getData('data', target)).forEach(([key, value]) => {

package/src/actions/buildWasm.js

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'node:url';
 import run from './run.js';
 import getLinkInputs from './getLinkInputs.js';
 import getData from './getData.js';
+import getEnv from './getEnv.js';
 import buildJs from './buildJs.js';
 import triggerExtensions from './extensions.js';
 import state from '../state/index.js';
@@ -14,9 +15,10 @@ import { buildLinkLibArgs } from '../utils/linkLayout.js';
 import { guardBigIntArguments, guardEmbindArguments } from '../utils/embindArgumentGuards.js';
 import { separateCallArguments } from '../utils/embindCallArguments.js';
 import { queueJspiCalls } from '../utils/embindJspiQueue.js';
+import { releaseOwnedHandles } from '../utils/embindObjectLifetime.js';
 import { spawnPthreadsFromMainScript } from '../utils/pthreadMainScript.js';
 
-const GLUE_REWRITES = ['../utils/embindArgumentGuards.js', '../utils/embindCallArguments.js', '../utils/embindJspiQueue.js', '../utils/pthreadMainScript.js']
+const GLUE_REWRITES = ['../utils/embindArgumentGuards.js', '../utils/embindCallArguments.js', '../utils/embindJspiQueue.js', '../utils/embindObjectLifetime.js', '../utils/pthreadMainScript.js']
     .map((file) => fileURLToPath(new URL(file, import.meta.url)));
 
 // embind's bigint converter turns any Number into a BigInt, so 2^53+1 silently becomes 2^53.
@@ -64,6 +66,17 @@ function queueJspiEmbindCalls(target) {
     }
 }
 
+// Objects JavaScript owns outside a smart pointer were freed only by .delete() (utils/embindObjectLifetime.js);
+// each runtimeEnv links its own glue, so each one calls this after its link.
+function releaseOwnedObjects(target) {
+    const gluePath = `${state.config.paths.build}/${target.rawJsName}`;
+    const { text, missed } = releaseOwnedHandles(fs.readFileSync(gluePath, 'utf8'));
+    fs.writeFileSync(gluePath, text);
+    if (missed) {
+        logger.error('embind object lifetime rewrite missed (emscripten glue format changed?): returned values and constructed vectors are freed only by .delete()');
+    }
+}
+
 // A direct-mode mt init in a browser spawns its pthreads from "/undefined" (utils/pthreadMainScript.js).
 function pointPthreadSpawn(target) {
     const gluePath = `${state.config.paths.build}/${target.rawJsName}`;
@@ -173,6 +186,8 @@ export default async function buildWasm(target, options = {}) {
             return { lib, size: stat ? stat.size : null, mtimeMs: stat ? stat.mtimeMs : null };
         }),
         data: getData('data', target),
+        // The JS the link step writes carries the env.
+        env: getEnv(target),
         runtime: getFilesFingerprint(runtimeAssets),
         rustSources: getFilesFingerprint(rustSources),
     }));
@@ -233,6 +248,7 @@ export default async function buildWasm(target, options = {}) {
         guardArgumentConversions(target);
         separateEmbindCalls(target);
         queueJspiEmbindCalls(target);
+        releaseOwnedObjects(target);
         await buildJs(target);
         // fs.rmSync(`${state.config.paths.build}/${state.config.general.name}.js`);
         // fs.copyFileSync(`${state.config.paths.build}/${state.config.general.name}.browser.js`, `${state.config.paths.build}/${state.config.general.name}.js`);
@@ -257,12 +273,13 @@ export default async function buildWasm(target, options = {}) {
             // it any linked Rust package archive fails with undefined crossbind_* symbols.
             ...linkLibs, ...rustSources,
             '-s', 'WASM=1', '-s', 'MODULARIZE=1', '-s', 'DYNAMIC_EXECUTION=0',
-            '-s', 'RESERVED_FUNCTION_POINTERS=200', // '-s', 'FORCE_FILESYSTEM=1',
+            '-s', 'RESERVED_FUNCTION_POINTERS=200',
             '-s', 'ALLOW_MEMORY_GROWTH=1',
             // See the GROWABLE_ARRAYBUFFERS note in the browser block (Firefox/WebKit TextDecoder).
             '-s', 'GROWABLE_ARRAYBUFFERS=0',
+            '-s', 'FORCE_FILESYSTEM=1',
             '-s', 'ENVIRONMENT=web',
-            '-s', 'EXPORTED_RUNTIME_METHODS=["ENV", "getExceptionMessage"]',
+            '-s', 'EXPORTED_RUNTIME_METHODS=["FS", "ENV", "getExceptionMessage"]',
             '-fwasm-exceptions',
             '-sEXPORT_EXCEPTION_HANDLING_HELPERS',
             '-o', `${state.config.paths.build}/${target.rawJsName}`,
@@ -275,6 +292,7 @@ export default async function buildWasm(target, options = {}) {
         guardArgumentConversions(target);
         separateEmbindCalls(target);
         queueJspiEmbindCalls(target);
+        releaseOwnedObjects(target);
         await buildJs(target);
         logger.doneStep(target, 'js');
     }
@@ -292,6 +310,8 @@ export default async function buildWasm(target, options = {}) {
             // '-s', 'FETCH', '-sJSPI', '-pthread', '-sPTHREAD_POOL_SIZE=5',
             '-s', 'FORCE_FILESYSTEM=1',
             ...linkLibs, ...rustSources, `${state.config.paths.cli}/assets/cpp-runtime/node.cpp`,
+            // node.cpp answers fsync and fdatasync for host files.
+            '-Wl,--wrap=__wasi_fd_sync', '-Wl,--wrap=__syscall_fdatasync',
             '-s', 'WASM=1', '-s', 'MODULARIZE=1', '-s', 'DYNAMIC_EXECUTION=0',
             '-s', 'RESERVED_FUNCTION_POINTERS=200', // '-s', 'DISABLE_EXCEPTION_CATCHING=0', '-s', 'FORCE_FILESYSTEM=1',
             '-s', 'ALLOW_MEMORY_GROWTH=1',
@@ -311,6 +331,7 @@ export default async function buildWasm(target, options = {}) {
         guardArgumentConversions(target);
         separateEmbindCalls(target);
         queueJspiEmbindCalls(target);
+        releaseOwnedObjects(target);
         await buildJs(target);
         if (emccFlags.includes('FETCH')) {
             fs.appendFileSync(`${state.config.paths.build}/${target.jsName}`, 'var XMLHttpRequest = require(\'xhr2\');\n');

package/src/actions/createImportedBridges.js

@@ -34,6 +34,13 @@ function resolveImport(specifier, importer, targets) {
     return null;
 }
 
+// Whether a binary binds what the app's own sources import. A Node binary does: its module hooks resolve those
+// imports. A browser binary only with --bind-imports: without a bundler a page cannot resolve a header import
+// unless it maps the specifiers itself, as the playground's sandbox does. Nothing on an edge runtime resolves one.
+export function bindsAppImports(target, { bindImports = false } = {}) {
+    return target.runtimeEnv === 'node' || (bindImports && target.runtimeEnv === 'browser');
+}
+
 // The native files the app's own sources import, by real path, each under the first target whose packages ship it
 // and with the bare specifiers that name it, which Node cannot resolve on its own.
 export function findAppNativeImports(targets) {

package/src/actions/createInterface.js

@@ -27,10 +27,10 @@ import run, { cxxPreprocessorFor } from './run.js';
 import isSourceCmakePackage from '../utils/isSourceCmakePackage.js';
 
 // Part of every interface hash, so interfaces cached by an older generator are rebuilt.
-const INTERFACE_FORMAT = 'swig-macros-3';
+const INTERFACE_FORMAT = 'swig-macros-4';
 // Part of every bridge hash: each bridge carries the SWIG fork's runtime and all bridges of a module must share it, so
 // bridges from a fork before field bindings and constants are rebuilt.
-const BRIDGE_FORMAT = 'swig-extras-1';
+const BRIDGE_FORMAT = 'swig-extras-2';
 const predefinedMacros = new Map();
 const typeDefinitions = new Map();
 
@@ -188,7 +188,7 @@ function createInterfaceFile(headerOrModuleFilePath, target, sourceDir, { consta
     const fileName = interfaceName(headerOrModuleFilePath, filePathWithoutExt.split('/').at(-1));
 
     const macros = collectSwigMacros(headerOrModuleFilePath, interfaceIncludes(headerPath, prelude), fileName, target, sourceDir, constants);
-    const extras = interfaceExtras(named, macros.table);
+    const extras = interfaceExtras(named, macros.table, fs.readFileSync(headerOrModuleFilePath, 'utf8'));
     const content = buildInterfaceContent({
         moduleName: fileName.toUpperCase(),
         headerPath,

package/src/actions/createLib.js

@@ -10,11 +10,13 @@ import triggerExtensions from './extensions.js';
 import state from '../state/index.js';
 import logger from '../utils/logger.js';
 import { WASI_EMULATION_LIBS, WASI_LINK_LIBS, wasiCFlags, wasiCxxFlags } from '../utils/wasiToolchain.js';
+import { stageWasiHttpInclude, wasiHttpHeader } from '../utils/wasiHttp.js';
 import { getFilesFingerprint, getContentHash } from '../utils/hash.js';
 import { withDependencyBridges } from '../utils/dependencyBridges.js';
 import { targetArchiveFlags } from '../utils/archiveFlags.js';
 import { conanInputsOf } from '../utils/conanDependencies.js';
 import { nativeSourceStampChanged, writeNativeSourceStamp } from '../utils/nativeSourceStamp.js';
+import resetCMakeCacheForSource from '../utils/resetCMakeCacheForSource.js';
 
 const cpuCount = Math.max(1, os.cpus().length - 1);
 const sharedPlatforms = ['android'];
@@ -56,7 +58,12 @@ export default function createLib(target, fileType, options = {}) {
     const conanInputs = conanInputsOf(state.config);
     const compileInputs = compileOptions.length ? { emccFlags: configEmccFlags, compileOptions } : configEmccFlags;
     const flagsInputs = sourceReplacements.length ? { compileInputs, sourceReplacements } : compileInputs;
-    const flagsFingerprint = getContentHash(JSON.stringify(conanInputs ? [flagsInputs, conanInputs] : flagsInputs));
+    const keyInputs = conanInputs ? [flagsInputs, conanInputs] : flagsInputs;
+    // An app's wasi source compiles against <crossbind/http.h>, so a new one misses this cache too.
+    const httpHeader = target.platform === 'wasi' && !state.config.build.withBuildConfig
+        ? getFilesFingerprint([wasiHttpHeader(state.config.paths.cli)])
+        : null;
+    const flagsFingerprint = getContentHash(JSON.stringify(httpHeader ? [keyInputs, httpHeader] : keyInputs));
     const flagsChanged = !fs.existsSync(flagsFingerprintFile)
         || fs.readFileSync(flagsFingerprintFile, { encoding: 'utf8' }) !== flagsFingerprint;
 
@@ -142,7 +149,11 @@ export default function createLib(target, fileType, options = {}) {
             buildEnv.params.push('-e', e);
         });
     } else {
-        buildParams = getCmakeParameters(target, { ...options, nativeGlob });
+        // The source of an http build includes <crossbind/http.h>.
+        const headerDirs = target.platform === 'wasi'
+            ? [...(options.headerDirs ?? []), stageWasiHttpInclude(state.config.paths.cli, `${buildPath}/crossbind-wasi-http`)]
+            : options.headerDirs;
+        buildParams = getCmakeParameters(target, { ...options, nativeGlob, headerDirs });
 
         triggerExtensions('createLib', 'setFlagWithoutBuildConfig', [buildEnv]);
 
@@ -229,6 +240,7 @@ export default function createLib(target, fileType, options = {}) {
                 stageWasiStubs();
                 buildParams.push(`-DCMAKE_EXE_LINKER_FLAGS=${[...wasiCxxFlags(), wasiStubObj, ...WASI_LINK_LIBS].join(' ')}`);
             }
+            resetCMakeCacheForSource(buildPath, cmakeDir, target);
             run(null, [
                 target.platform === 'ios' && state.config.build?.useIOSCMake ? 'ios-cmake' : 'cmake', cmakeDir,
                 `-DCMAKE_BUILD_TYPE=${buildType}`,

package/src/actions/getData.js

@@ -30,7 +30,8 @@ function getRecursiveData(obj, config, dependency, field, target) {
                 obj[dKey] = [...(obj[dKey] || []), ...value];
             } else if (typeof value === 'object') {
                 obj[dKey] = { ...(obj[dKey] || {}), ...value };
-            } else {
+            } else if (!Object.hasOwn(obj, dKey)) {
+                // The app comes before its dependencies and a package before its own, so the nearest value stays.
                 obj[dKey] = value;
             }
         }

package/src/actions/getEnv.js

@@ -0,0 +1,7 @@
+import state from '../state/index.js';
+import getData from './getData.js';
+
+export default function getEnv(target) {
+    return Object.fromEntries(Object.entries(getData('env', target))
+        .map(([key, value]) => [key, typeof value === 'function' ? value(state, target) : value]));
+}

package/src/actions/runnerCommands.js

@@ -40,6 +40,7 @@ const BOOT_SCRIPT = [
 const VERSION = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;
 
 const runnerName = (role) => `crossbind-runner-${role}`;
+const localRunnerName = (role) => `crossbind-local-runner-${role}`;
 const runnerFiles = () => fs.readdirSync(RUNNER_SOURCE).filter((file) => file.endsWith('.js'));
 // Google ships the linux NDK for x86_64 only, so an android runner is always amd64.
 const platformOf = (role) => (role === 'android' ? 'linux/amd64' : undefined);
@@ -62,7 +63,7 @@ function assertRole(role) {
 export function runnerStartArgs({ role, port, host }) {
     const platform = platformOf(role);
     return [
-        'run', '-d', '--name', runnerName(role), '--restart', 'unless-stopped',
+        'run', '-d', '--name', localRunnerName(role), '--restart', 'unless-stopped',
         ...(platform ? ['--platform', platform] : []),
         ...DOCKER_RUN_SECURITY_ARGS,
         '-p', `${host}:${port}:${RUNNER_PORT}`,
@@ -89,13 +90,24 @@ export function startRunner({ role = 'web', port = runnerHostPort(role), host =
     });
     // A token taken from the environment is shown by its variable, so the line printed for it puts no secret in a log.
     return {
-        name: runnerName(role), url: `http://${host}:${port}`, token: secret, displayToken: fromEnvironment ? '$CROSSBIND_RUNNER_TOKEN' : secret,
+        name: localRunnerName(role), url: `http://${host}:${port}`, token: secret, displayToken: fromEnvironment ? '$CROSSBIND_RUNNER_TOKEN' : secret,
     };
 }
 
-export function stopRunner({ role = 'web' } = {}) {
+// A container that is not there is already deleted: docker reports one on stderr even with -f, and some engines exit 1.
+function removeContainer(name) {
+    try {
+        execFileSync('docker', ['rm', '-f', name], { stdio: ['ignore', 'inherit', 'pipe'] });
+    } catch (error) {
+        if (!/no such container/i.test(String(error.stderr))) throw error;
+    }
+}
+
+export function deleteRunner({ role = 'web' } = {}) {
     assertRole(role);
-    execFileSync('docker', ['rm', '-f', runnerName(role)], { stdio: 'inherit' });
+    removeContainer(localRunnerName(role));
+    // An older crossbind started its local runner under the name the deployed runners take.
+    removeContainer(runnerName(role));
 }
 
 function dockerfile(role) {

package/src/actions/writeRuntimeEntry.js

@@ -36,13 +36,10 @@ export default function writeRuntimeEntry(entry, headers, runtime) {
 
 const IMPORT_HOOKS = new URL('../assets/node-import-hooks.mjs', import.meta.url);
 
-// The module `node --import` loads ahead of the app, so the app imports the bound headers themselves: each
-// header by its real path, with the bare specifiers that name it (imports, from findAppNativeImports) and its
-// names, each with the entry's name for it where the two differ.
-export function writeImportHooks(entry, headers, imports, extensions) {
-    // Node runs the register file from its real path, so the files it names are relative to that.
-    const dir = upath.normalize(fs.realpathSync(upath.dirname(entry)));
-    const natives = headers.map((header) => {
+// Each bound header and Rust import by its real path relative to dir, with the bare specifiers that name it (imports,
+// from findAppNativeImports) and its names, each with the module's name for it where the two differ.
+function nativesOf(headers, imports, dir) {
+    return headers.map((header) => {
         const file = upath.normalize(fs.realpathSync(header.file));
         return {
             file: upath.relative(dir, file),
@@ -50,6 +47,13 @@ export function writeImportHooks(entry, headers, imports, extensions) {
             names: uniqueBindings(namesOf(header)).map(({ local, wire }) => (local === wire ? local : { local, wire })),
         };
     });
+}
+
+// The module `node --import` loads ahead of the app, so the app imports the bound headers themselves.
+export function writeImportHooks(entry, headers, imports, extensions) {
+    // Node runs the register file from its real path, so the files it names are relative to that.
+    const dir = upath.normalize(fs.realpathSync(upath.dirname(entry)));
+    const natives = nativesOf(headers, imports, dir);
     writeIfChanged(`${dir}/hooks.mjs`, fs.readFileSync(IMPORT_HOOKS, 'utf8'));
     writeIfChanged(entry.replace(/\.mjs$/, '.register.mjs'), [
         '// Generated by crossbind - do not edit.',
@@ -60,6 +64,13 @@ export function writeImportHooks(entry, headers, imports, extensions) {
     ].join('\n'));
 }
 
+// Beside a browser binary built with --bind-imports: what a page that resolves the app's imports itself (the
+// playground) maps them with, each file relative to the project.
+export function writeImportManifest(file, headers, imports, projectDir) {
+    const natives = nativesOf(headers, imports, upath.normalize(fs.realpathSync(projectDir)));
+    writeIfChanged(file, `${JSON.stringify({ natives }, null, 4)}\n`);
+}
+
 // Once the sources import nothing native, no start loads hooks an earlier build left; hooks.mjs stays while the other
 // binary's hooks still import it.
 export function removeImportHooks(entry) {

package/src/assets/cpp-runtime/node.cpp

@@ -2,9 +2,26 @@
 #include <emscripten/wasmfs.h>
 #include <limits.h>
 #include <unistd.h>
+#include <wasi/api.h>
+
+static backend_t hostBackend;
 
 backend_t wasmfs_create_root_dir(void) {
-  return wasmfs_create_node_backend("/");
+  hostBackend = wasmfs_create_node_backend("/");
+  return hostBackend;
+}
+
+// Emscripten's Node backend traps on flush, which fsync and fdatasync call. A host file's writes have already
+// reached the operating system, so both succeed there, as with NODERAWFS. buildWasm links these with --wrap.
+extern "C" __wasi_errno_t __real___wasi_fd_sync(__wasi_fd_t fd);
+extern "C" int __real___syscall_fdatasync(int fd);
+
+extern "C" __wasi_errno_t __wrap___wasi_fd_sync(__wasi_fd_t fd) {
+  return wasmfs_get_backend_by_fd(fd) == hostBackend ? __WASI_ERRNO_SUCCESS : __real___wasi_fd_sync(fd);
+}
+
+extern "C" int __wrap___syscall_fdatasync(int fd) {
+  return wasmfs_get_backend_by_fd(fd) == hostBackend ? 0 : __real___syscall_fdatasync(fd);
 }
 
 void wasmfs_before_preload(void) {

package/src/assets/js-runtime/adapters/worker-comlink.js

@@ -24,12 +24,44 @@ let nextEmbindId = 1;
 const HANDLES = '__crossbindHandles';
 let remoteModule = null;
 
+// How many ids name each object, as a raw pointer handed out twice is one object.
+const holders = new WeakMap();
+
 function registerEmbindObject(obj) {
     const id = nextEmbindId++;
     embindRegistry.set(id, obj);
+    holders.set(obj, (holders.get(obj) ?? 0) + 1);
     return id;
 }
 
+// What JavaScript owns: an object behind a smart pointer, or a copy embind made of a returned value or an object
+// JavaScript constructed, which utils/embindObjectLifetime.js marks. A raw pointer stays its library's.
+const ownsObject = (obj) => {
+    const $$ = obj?.$$;
+    return Boolean($$ && ($$.smartPtr || $$.count?.owned));
+};
+
+const freeIfOwned = (obj) => {
+    if (ownsObject(obj) && !obj.isDeleted()) obj.delete();
+};
+
+// The worker side of a handle the main thread no longer reaches: its id goes, and the object with the last id.
+const RELEASE = '__crossbindRelease';
+
+function releaseEmbindObjects(ids) {
+    for (const id of ids) {
+        const obj = embindRegistry.get(id);
+        if (!embindRegistry.delete(id)) continue;
+        const left = holders.get(obj) - 1;
+        if (left > 0) {
+            holders.set(obj, left);
+        } else {
+            holders.delete(obj);
+            freeIfOwned(obj);
+        }
+    }
+}
+
 // Comlink answers every member with a remote one: JSON.stringify and String() called toJSON and Symbol.toPrimitive
 // on the worker's object, which has neither, and a member below the module is thenable. A handle answers them as a
 // direct-mode object does.
@@ -39,11 +71,27 @@ const LOCAL_MEMBERS = {
     [Symbol.toPrimitive]: (hint) => (hint === 'number' ? NaN : '[object Object]'),
 };
 
+// The main thread side: once a handle is collected, the worker lets go of its object, the ids collected in one task
+// in one message.
+const collected = [];
+
+function releaseLater(id) {
+    collected.push(id);
+    if (collected.length > 1) return;
+    setTimeout(() => {
+        const ids = collected.splice(0);
+        Promise.resolve(remoteModule?.[RELEASE](ids)).catch(() => {});
+    }, 0);
+}
+
+const handleWatcher = typeof FinalizationRegistry === 'function' ? new FinalizationRegistry(releaseLater) : null;
+
 function handleFor(id) {
     const handle = new Proxy(remoteModule[HANDLES][id], {
         get: (target, prop) => (Object.hasOwn(LOCAL_MEMBERS, prop) ? LOCAL_MEMBERS[prop] : target[prop]),
     });
     embindProxyIds.set(handle, id);
+    handleWatcher?.register(handle, id);
     return handle;
 }
 
@@ -126,6 +174,8 @@ Comlink.transferHandlers.set('embindVector', {
                 ? { __comlinkProxy: true, __embindId: registerEmbindObject(elem) }
                 : elem;
         }
+        // The main thread gets the array alone, so nothing can reach a vector the call handed over any more.
+        freeIfOwned(unwrapCoercionProxy(obj));
         return [elements, []];
     },
     deserialize(elements) {
@@ -246,6 +296,7 @@ export function moduleRoot(m) {
         value: new Proxy({}, { get: (_, id) => embindRegistry.get(Number(id)) }),
         configurable: true,
     });
+    Object.defineProperty(m, RELEASE, { value: releaseEmbindObjects, configurable: true });
     return wrapWithVectorCoercion(m);
 }
 

package/src/assets/js-runtime/core.js

@@ -74,12 +74,13 @@ function buildLocateFile(config, adapter) {
 }
 
 // WASMFS's FS.writeFile writes at the end of a file that exists (emsdk 6.0.9 js_api.cpp), where the classic FS
-// replaces it; opening the file for writing empties it first.
+// replaces it; opening the file for writing empties it first, unless the flags ask to append.
 function replaceOnWriteFile(FS) {
     const { writeFile } = FS;
-    FS.writeFile = (path, data) => {
-        FS.close(FS.open(path, 'w'));
-        return writeFile(path, data);
+    FS.writeFile = (path, data, opts) => {
+        const appends = typeof opts?.flags === 'string' && opts.flags.startsWith('a');
+        if (!appends) FS.close(FS.open(path, 'w', opts?.mode));
+        return writeFile(path, data, opts);
     };
 }