crossbind 2.0.0-beta.63 → 2.0.0-beta.65

package/src/actions/licenses.js

@@ -8,6 +8,11 @@ import familyManifestOf from '../utils/familyManifest.js';
 import { wasiToolchainIdentity } from '../utils/provenance.js';
 import { resolveWasiSdkPath } from '../utils/wasiToolchain.js';
 import resolveEmbindNapiRoot, { resolveEmbindJsiRoot } from '../utils/resolveEmbindNapi.js';
+import resolveAppHostRoot, { resolveAppEmbindJsiRoot } from '../utils/resolveAppHost.js';
+import {
+    HERMES, HERMES_ANDROID, HERMES_SOURCE, hermesUrl,
+} from '../utils/hermes.js';
+import { ANDROIDX_WEBKIT } from './gradleProject.js';
 import { shippedBundledLicense } from '../utils/bundledLicenses.js';
 import toolchainNoticesDir from '../utils/toolchainNotices.js';
 
@@ -103,7 +108,7 @@ function wasiToolchainRows() {
     ];
 }
 
-// The notices a build copied out of its toolchain image (buildNode does it for Windows addons).
+// The notices a build copied out of its toolchain image (a Windows addon's or app's does).
 function toolchainNoticeTexts(platform) {
     const build = state.config?.paths?.build;
     const dir = build ? path.join(build, toolchainNoticesDir(platform)) : null;
@@ -130,33 +135,32 @@ function addonToolchainRows(platform) {
     };
     const llvmText = 'license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT';
     if (platform === 'linux' || platform === 'linuxmusl') {
-        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the addon; ${llvmText}` }];
+        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the binary; ${llvmText}` }];
     }
     const mingwLicense = 'LicenseRef-MinGW-w64-runtime';
     return [
-        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the addon; ${llvmText}` },
+        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the binary; ${llvmText}` },
         {
             ...shared,
             name: 'mingw-w64-runtime',
             license: mingwLicense,
             licenseDeclared: mingwLicense,
             sourceUrl: 'https://github.com/mingw-w64/mingw-w64',
-            licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the addon; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
+            licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the binary; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
             licenseText: toolchainNoticeTexts('win32'),
         },
     ];
 }
 
-// A Node-API addon compiles in crossbind's runtime: embind-jsi, which adapts Emscripten's embind,
-// and node-api-jsi. The loader bundles the JavaScript half of the same runtime.
-function nodeRuntimeRows({ isAddon }) {
-    const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
-    const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
+const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
+const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
+
+// crossbind's runtime, which an addon and an app host compile in: embind-jsi, which adapts Emscripten's embind.
+function runtimeRows(jsiRoot, notes) {
     const shared = {
         nativeVersion: null, sha256: null, licenseSelected: null, isCopyleft: false,
     };
-    const jsiRoot = resolveEmbindJsiRoot();
-    const rows = [
+    return [
         {
             ...shared,
             name: 'crossbind',
@@ -165,7 +169,7 @@ function nodeRuntimeRows({ isAddon }) {
             license: 'MIT',
             licenseDeclared: 'MIT',
             sourceUrl: 'https://github.com/crossbind/crossbind',
-            licenseNotes: 'the embind-jsi and embind-napi runtime and the bindings crossbind generates',
+            licenseNotes: notes,
             licenseText: textOf(path.join(CROSSBIND_ROOT, 'LICENSE')),
         },
         {
@@ -180,10 +184,19 @@ function nodeRuntimeRows({ isAddon }) {
             licenseText: textOf(path.join(jsiRoot, 'LICENSE')),
         },
     ];
+}
+
+// A Node-API addon compiles in crossbind's runtime and node-api-jsi. The loader bundles the JavaScript half of the
+// same runtime.
+function nodeRuntimeRows({ isAddon }) {
+    const rows = runtimeRows(resolveEmbindJsiRoot(), 'the embind-jsi and embind-napi runtime and the bindings crossbind generates');
     if (!isAddon) return rows;
     const napiRoot = resolveEmbindNapiRoot();
     return [...rows, {
-        ...shared,
+        nativeVersion: null,
+        sha256: null,
+        licenseSelected: null,
+        isCopyleft: false,
         name: 'node-api-jsi',
         npmName: '@crossbind/core-embind-napi',
         version: versionOf(napiRoot),
@@ -195,6 +208,137 @@ function nodeRuntimeRows({ isAddon }) {
     }];
 }
 
+// What an app's host carries beside crossbind's runtime, pinned as the third_party READMEs of @crossbind/core-app-host
+// record: React Native's Hermes, JSI's jsi.cpp from the same release, webview/webview, and on Windows the WebView2 SDK's
+// headers.
+const WEBVIEW = { version: 'cbbdee44afff22867de9fd88a9fc8350d9bdd399', sha256: '10e972a2327b5681474f4aa4499e505eaa4ff659aa995380386f08fd6fc1b763' };
+const WEBVIEW2_SDK = { version: '1.0.4258.31', sha256: '56f7f4b8bf9aee4b8efefbbdd4f67d5f74ebd1b100ed0806da71bf76af481aa9' };
+const JSI_SHA256 = 'cb6274a22abc93ecc970066539815e716d3e47716e8f93a9971cf4eb5918ffc1';
+// The fbjni the Hermes release for Android depends on.
+const FBJNI_VERSION = '0.7.0';
+
+const HERMES_BUILDS = {
+    linux: {
+        sha256: HERMES_SOURCE.sha256,
+        sourceUrl: HERMES_SOURCE.url,
+        licenseNotes: "Hermes built from its release's source in the linux toolchain image, statically linked into the host",
+    },
+    win32: {
+        sha256: HERMES_SOURCE.sha256,
+        sourceUrl: HERMES_SOURCE.url,
+        licenseNotes: "Hermes built from its release's source in the windows toolchain image (llvm-mingw), statically linked into the host",
+    },
+    android: {
+        sha256: HERMES_ANDROID.sha256,
+        sourceUrl: HERMES_ANDROID.url,
+        licenseNotes: "React Native's Hermes for Android, whose libraries the app's Gradle build takes from Maven Central",
+    },
+};
+
+// What an Android app's Gradle build adds from Maven, and the C++ runtime the app carries beside its host.
+function androidAppRows() {
+    const shared = {
+        npmName: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
+    };
+    const apache = { ...shared, license: 'Apache-2.0', licenseDeclared: 'Apache-2.0' };
+    const llvmLicense = 'Apache-2.0 WITH LLVM-exception';
+    return [
+        {
+            ...apache,
+            name: 'fbjni',
+            version: FBJNI_VERSION,
+            nativeVersion: FBJNI_VERSION,
+            sourceUrl: 'https://github.com/facebookincubator/fbjni',
+            licenseNotes: 'libfbjni.so, which Hermes loads and Gradle takes with it; license text: https://github.com/facebookincubator/fbjni/blob/main/LICENSE',
+        },
+        {
+            ...apache,
+            name: 'androidx-webkit',
+            version: ANDROIDX_WEBKIT,
+            nativeVersion: ANDROIDX_WEBKIT,
+            sourceUrl: 'https://developer.android.com/jetpack/androidx/releases/webkit',
+            licenseNotes: "androidx.webkit, the WebView's message ports and start scripts, from Google's Maven repository; license text: https://www.apache.org/licenses/LICENSE-2.0.txt",
+        },
+        {
+            ...shared,
+            name: 'llvm-runtimes',
+            version: null,
+            nativeVersion: null,
+            license: llvmLicense,
+            licenseDeclared: llvmLicense,
+            sourceUrl: 'https://github.com/llvm/llvm-project',
+            licenseNotes: "libc++ of the android image's NDK, which the app carries as libc++_shared.so; license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT",
+        },
+    ];
+}
+
+// The WebView2 SDK headers a Windows host compiles against. webview/webview loads the WebView2 Runtime itself, without
+// the SDK's loader.
+function windowsAppRows(hostRoot) {
+    const license = 'BSD-3-Clause';
+    return [{
+        npmName: '@crossbind/core-app-host',
+        name: 'webview2-sdk',
+        version: WEBVIEW2_SDK.version,
+        nativeVersion: WEBVIEW2_SDK.version,
+        sha256: WEBVIEW2_SDK.sha256,
+        license,
+        licenseDeclared: license,
+        licenseSelected: null,
+        isCopyleft: false,
+        sourceUrl: `https://api.nuget.org/v3-flatcontainer/microsoft.web.webview2/${WEBVIEW2_SDK.version}/microsoft.web.webview2.${WEBVIEW2_SDK.version}.nupkg`,
+        licenseNotes: "the WebView2 SDK's headers from the windows toolchain image, whose interface IDs the host compiles in",
+        licenseText: textOf(path.join(hostRoot, 'third_party', 'webview2', 'LICENSE')),
+    }];
+}
+
+function appRuntimeRows(platform) {
+    const hostRoot = resolveAppHostRoot();
+    const hermesLicense = textOf(path.join(hostRoot, 'third_party', 'jsi', 'LICENSE'));
+    const mit = {
+        npmName: '@crossbind/core-app-host', license: 'MIT', licenseDeclared: 'MIT', licenseSelected: null, isCopyleft: false,
+    };
+    const hermes = HERMES_BUILDS[platform] ?? {
+        sha256: HERMES.sha256,
+        sourceUrl: hermesUrl(HERMES.version),
+        licenseNotes: "React Native's Hermes for Apple platforms, which the app carries as hermesvm.framework",
+    };
+    return [
+        ...runtimeRows(resolveAppEmbindJsiRoot(), 'the embind-jsi runtime, the app host and the bindings crossbind generates'),
+        {
+            ...mit,
+            ...hermes,
+            name: 'hermes',
+            version: HERMES.version,
+            nativeVersion: HERMES.version,
+            licenseText: hermesLicense,
+        },
+        {
+            ...mit,
+            name: 'jsi',
+            version: HERMES.version,
+            nativeVersion: HERMES.version,
+            sha256: JSI_SHA256,
+            sourceUrl: 'https://github.com/facebook/hermes',
+            licenseNotes: "JSI's jsi.cpp from the same Hermes release, compiled into the host",
+            licenseText: hermesLicense,
+        },
+        ...(platform === 'android' ? androidAppRows() : []),
+        ...(platform === 'win32' ? windowsAppRows(hostRoot) : []),
+        // A mobile app makes its window with UIKit or an Android activity, without webview/webview.
+        ...(['ios', 'android'].includes(platform) ? [] : [{
+            ...mit,
+            name: 'webview',
+            version: WEBVIEW.version,
+            nativeVersion: WEBVIEW.version,
+            sha256: WEBVIEW.sha256,
+            sourceUrl: 'https://github.com/webview/webview',
+            licenseNotes: 'webview/webview, with the local patch @crossbind/core-app-host lists',
+            licenseText: textOf(path.join(hostRoot, 'third_party', 'webview', 'LICENSE')),
+        }]),
+    ];
+}
+
 async function buildRow(node) {
     const recipe = await loadJs(node.paths.project, 'crossbind.build');
     const manifest = node.package || null;
@@ -284,7 +428,8 @@ function assertConanStaged() {
 // platform (optional, e.g. 'wasi') additionally includes what that platform's
 // artifact statically links beyond the package graph: recipe-declared vendored
 // copies and the toolchain runtime. runtimeEnv 'node' adds the crossbind runtime an
-// addon of that platform compiles in, or without a platform the one its loader bundles.
+// addon of that platform compiles in, or without a platform the one its loader bundles;
+// runtimeEnv 'app' adds what an app's host carries.
 export default async function collectLicenseRows(platform = null, { runtimeEnv = null } = {}) {
     assertConanStaged();
     // The root package is a component too when it is a port: leaf -wasi packages have no deps but ship
@@ -310,5 +455,6 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
     if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
     if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
+    if (runtimeEnv === 'app') rows.push(...appRuntimeRows(platform));
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }

package/src/actions/nativeBridges.js

@@ -0,0 +1,35 @@
+import createBridgeFile from './createInterface.js';
+import { createImportedBridges, findAppNativeImports } from './createImportedBridges.js';
+import getDependFilePath from '../integration/getDependFilePath.js';
+import state from '../state/index.js';
+import findFiles from '../utils/findFiles.js';
+import {
+    boundHeaderSpecifiers, bridgeTargets, nodeBridgeTarget, resolveBoundHeaders,
+} from '../utils/boundHeaders.js';
+
+// The project's own headers, each with its bridge.
+export function createBridges(target) {
+    let headers = [];
+    state.config.paths.header.forEach((headerPath) => {
+        headers.push(findFiles('**/*.h', { cwd: headerPath }));
+    });
+    headers = headers.filter((path) => !!path.toString()).flat();
+
+    return headers.map((header) => ({ file: header, bridge: createBridgeFile(header, target) }));
+}
+
+// The dependency headers the config binds whole, each read where one of the targets' packages ships it.
+export function createBoundBridges(targets) {
+    const headers = resolveBoundHeaders(boundHeaderSpecifiers(state.config), bridgeTargets(targets, state.targets), getDependFilePath);
+    const wholeHeaders = headers.map((header) => header.file);
+    return headers.map((header) => ({ ...header, bridge: createBridgeFile(header.file, header.target, { wholeHeaders }) }));
+}
+
+// What a native binary binds, an addon or an app host: the project's headers, the dependency headers the config binds
+// whole, and the ones the app's sources import.
+export function createNativeBridges(targets) {
+    const boundHeaders = createBoundBridges(targets);
+    const ownHeaders = [...createBridges(nodeBridgeTarget(targets)), ...boundHeaders];
+    const imports = findAppNativeImports(bridgeTargets(targets, state.targets));
+    return { headers: [...ownHeaders, ...createImportedBridges(ownHeaders, imports)], imports };
+}

package/src/actions/run.js

@@ -22,7 +22,7 @@ import {
 } from '../utils/darwinToolchain.js';
 
 // Native builds can outrun Node's 1 MiB default pipe buffer; without a raised cap a successful build dies with ENOBUFS.
-const EXEC_MAX_BUFFER = 512 * 1024 * 1024;
+export const EXEC_MAX_BUFFER = 512 * 1024 * 1024;
 // Containers share the memory of Docker's VM, and one compile at full -j can take most of a desktop VM
 // (GDAL's bindings peak at 7.5 of 7.7 GiB), so the exclusive steps of parallel builds take turns.
 const DOCKER_COMPILE_LOCK = path.join(os.homedir(), '.crossbind', 'docker-compile.lock');
@@ -124,7 +124,7 @@ const iosParams = [
 
 // The C++ compiler of the image that runs SWIG for the target, so its -dM macro table matches that parse.
 export function cxxPreprocessorFor(target) {
-    if (imageRoleFor(target) !== 'android') return 'em++';
+    if (target?.platform !== 'android') return 'em++';
     return `${t}/${target.arch === 'x86_64' ? CROSSCOMPILER_x86_64 : CROSSCOMPILER_ARM64}-clang++`;
 }
 
@@ -196,7 +196,7 @@ export default function run(program, params = [], platformPrefix = null, target
             case 'android':
                 [dProgram, ...dParams] = params;
                 platformParams = target.arch === 'x86_64' ? androidParamsX86_64 : androidParamsArm64;
-                if (dProgram === 'cmake') {
+                if (dProgram === 'cmake' && dParams[0] !== '--build' && dParams[0] !== '--install') {
                     dParams = [
                         ...dParams,
                         `-DCMAKE_TOOLCHAIN_FILE=${ANDROID_NDK}/build/cmake/android.toolchain.cmake`,

package/src/actions/runnerCommands.js

@@ -40,6 +40,7 @@ const BOOT_SCRIPT = [
 const VERSION = JSON.parse(fs.readFileSync(new URL('../../package.json', import.meta.url), 'utf8')).version;
 
 const runnerName = (role) => `crossbind-runner-${role}`;
+const localRunnerName = (role) => `crossbind-local-runner-${role}`;
 const runnerFiles = () => fs.readdirSync(RUNNER_SOURCE).filter((file) => file.endsWith('.js'));
 // Google ships the linux NDK for x86_64 only, so an android runner is always amd64.
 const platformOf = (role) => (role === 'android' ? 'linux/amd64' : undefined);
@@ -62,7 +63,7 @@ function assertRole(role) {
 export function runnerStartArgs({ role, port, host }) {
     const platform = platformOf(role);
     return [
-        'run', '-d', '--name', runnerName(role), '--restart', 'unless-stopped',
+        'run', '-d', '--name', localRunnerName(role), '--restart', 'unless-stopped',
         ...(platform ? ['--platform', platform] : []),
         ...DOCKER_RUN_SECURITY_ARGS,
         '-p', `${host}:${port}:${RUNNER_PORT}`,
@@ -89,13 +90,24 @@ export function startRunner({ role = 'web', port = runnerHostPort(role), host =
     });
     // A token taken from the environment is shown by its variable, so the line printed for it puts no secret in a log.
     return {
-        name: runnerName(role), url: `http://${host}:${port}`, token: secret, displayToken: fromEnvironment ? '$CROSSBIND_RUNNER_TOKEN' : secret,
+        name: localRunnerName(role), url: `http://${host}:${port}`, token: secret, displayToken: fromEnvironment ? '$CROSSBIND_RUNNER_TOKEN' : secret,
     };
 }
 
-export function stopRunner({ role = 'web' } = {}) {
+// A container that is not there is already deleted: docker reports one on stderr even with -f, and some engines exit 1.
+function removeContainer(name) {
+    try {
+        execFileSync('docker', ['rm', '-f', name], { stdio: ['ignore', 'inherit', 'pipe'] });
+    } catch (error) {
+        if (!/no such container/i.test(String(error.stderr))) throw error;
+    }
+}
+
+export function deleteRunner({ role = 'web' } = {}) {
     assertRole(role);
-    execFileSync('docker', ['rm', '-f', runnerName(role)], { stdio: 'inherit' });
+    removeContainer(localRunnerName(role));
+    // An older crossbind started its local runner under the name the deployed runners take.
+    removeContainer(runnerName(role));
 }
 
 function dockerfile(role) {

package/src/actions/target.js

@@ -28,7 +28,8 @@ export function getTargetParams(givenTargetParams = {}, noParamCheck = false) {
 }
 
 export function getBuildTargets(targetParams) {
-    const { platform, arch, runtime, buildType, runtimeEnv } = targetParams;
+    // A lookup that names no runtime environment finds the targets that have none: the archives' alone.
+    const { platform, arch, runtime, buildType, runtimeEnv = [] } = targetParams;
     return state.targets.filter(t => (
         (!t.platform || platform.includes(t.platform))
         && (!t.arch || arch.includes(t.arch))

package/src/actions/writeRuntimeEntry.js

@@ -36,13 +36,10 @@ export default function writeRuntimeEntry(entry, headers, runtime) {
 
 const IMPORT_HOOKS = new URL('../assets/node-import-hooks.mjs', import.meta.url);
 
-// The module `node --import` loads ahead of the app, so the app imports the bound headers themselves: each
-// header by its real path, with the bare specifiers that name it (imports, from findAppNativeImports) and its
-// names, each with the entry's name for it where the two differ.
-export function writeImportHooks(entry, headers, imports, extensions) {
-    // Node runs the register file from its real path, so the files it names are relative to that.
-    const dir = upath.normalize(fs.realpathSync(upath.dirname(entry)));
-    const natives = headers.map((header) => {
+// Each bound header and Rust import by its real path relative to dir, with the bare specifiers that name it (imports,
+// from findAppNativeImports) and its names, each with the module's name for it where the two differ.
+function nativesOf(headers, imports, dir) {
+    return headers.map((header) => {
         const file = upath.normalize(fs.realpathSync(header.file));
         return {
             file: upath.relative(dir, file),
@@ -50,6 +47,13 @@ export function writeImportHooks(entry, headers, imports, extensions) {
             names: uniqueBindings(namesOf(header)).map(({ local, wire }) => (local === wire ? local : { local, wire })),
         };
     });
+}
+
+// The module `node --import` loads ahead of the app, so the app imports the bound headers themselves.
+export function writeImportHooks(entry, headers, imports, extensions) {
+    // Node runs the register file from its real path, so the files it names are relative to that.
+    const dir = upath.normalize(fs.realpathSync(upath.dirname(entry)));
+    const natives = nativesOf(headers, imports, dir);
     writeIfChanged(`${dir}/hooks.mjs`, fs.readFileSync(IMPORT_HOOKS, 'utf8'));
     writeIfChanged(entry.replace(/\.mjs$/, '.register.mjs'), [
         '// Generated by crossbind - do not edit.',
@@ -60,6 +64,13 @@ export function writeImportHooks(entry, headers, imports, extensions) {
     ].join('\n'));
 }
 
+// Beside a browser binary built with --bind-imports: what a page that resolves the app's imports itself (the
+// playground) maps them with, each file relative to the project.
+export function writeImportManifest(file, headers, imports, projectDir) {
+    const natives = nativesOf(headers, imports, upath.normalize(fs.realpathSync(projectDir)));
+    writeIfChanged(file, `${JSON.stringify({ natives }, null, 4)}\n`);
+}
+
 // Once the sources import nothing native, no start loads hooks an earlier build left; hooks.mjs stays while the other
 // binary's hooks still import it.
 export function removeImportHooks(entry) {

package/src/actions/xcodeProject.js

@@ -0,0 +1,152 @@
+import fs from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import state from '../state/index.js';
+import { IOS_DEPLOYMENT_TARGET } from '../utils/iosToolchain.js';
+import { textPlist, xmlPlist } from '../utils/plist.js';
+
+// The SDKs an iOS app builds for, one target each, and the slice of Hermes' release each takes.
+export const IOS_SDKS = ['iphoneos', 'iphonesimulator'];
+export const HERMES_SLICES = { iphoneos: 'ios-arm64', iphonesimulator: 'ios-arm64_x86_64-simulator' };
+// What the host's own code needs from the system: Xcode adds it only for the sources it compiles itself.
+const SYSTEM_LIBS = ['-framework', 'UIKit', '-framework', 'WebKit', '-framework', 'CoreGraphics', '-lc++'];
+
+const MAIN = `// crossbind writes this project anew on every build: the app comes prebuilt in lib/, and its files are in app/.
+int crossbind_app_main(int argc, char *argv[]);
+
+int main(int argc, char *argv[]) { return crossbind_app_main(argc, argv); }
+`;
+
+const OBJECT_NAMES = ['project', 'mainGroup', 'products', 'target', 'product', 'main', 'info', 'app', 'hermes', 'mainBuild',
+    'appBuild', 'hermesLink', 'hermesEmbed', 'sources', 'frameworks', 'resources', 'embed', 'projectDebug', 'projectRelease',
+    'targetDebug', 'targetRelease', 'projectConfigs', 'targetConfigs'];
+// Xcode names its objects by 24 hex digits. Fixed ones leave the project unchanged while what it holds is.
+const ID = Object.fromEntries(OBJECT_NAMES.map((name, index) => [name, `CB${(index + 1).toString(16).toUpperCase().padStart(22, '0')}`]));
+
+const PROJECT_SETTINGS = {
+    SDKROOT: 'iphoneos',
+    SUPPORTED_PLATFORMS: 'iphoneos iphonesimulator',
+    IPHONEOS_DEPLOYMENT_TARGET: IOS_DEPLOYMENT_TARGET,
+    TARGETED_DEVICE_FAMILY: '1,2',
+    // crossbind's iOS archives are arm64 alone, for devices and the Simulator alike.
+    ARCHS: 'arm64',
+    ALWAYS_SEARCH_USER_PATHS: 'NO',
+    CLANG_ENABLE_OBJC_ARC: 'YES',
+    DEAD_CODE_STRIPPING: 'YES',
+};
+
+const ORIENTATIONS = ['UIInterfaceOrientationPortrait', 'UIInterfaceOrientationLandscapeLeft', 'UIInterfaceOrientationLandscapeRight'];
+
+const infoPlist = (name) => xmlPlist({
+    CFBundleDevelopmentRegion: 'en',
+    CFBundleDisplayName: name,
+    CFBundleExecutable: '$(EXECUTABLE_NAME)',
+    CFBundleIdentifier: '$(PRODUCT_BUNDLE_IDENTIFIER)',
+    CFBundleInfoDictionaryVersion: '6.0',
+    CFBundleName: '$(PRODUCT_NAME)',
+    CFBundlePackageType: 'APPL',
+    CFBundleShortVersionString: '$(MARKETING_VERSION)',
+    CFBundleVersion: '$(CURRENT_PROJECT_VERSION)',
+    LSRequiresIPhoneOS: true,
+    UIApplicationSceneManifest: { UIApplicationSupportsMultipleScenes: false },
+    UILaunchScreen: {},
+    UISupportedInterfaceOrientations: ORIENTATIONS,
+    'UISupportedInterfaceOrientations~ipad': [...ORIENTATIONS, 'UIInterfaceOrientationPortraitUpsideDown'],
+});
+
+function objects(name, targetSettings) {
+    const file = (path, type) => ({ isa: 'PBXFileReference', lastKnownFileType: type, path, sourceTree: '<group>' });
+    const phase = (isa, files, extra = {}) => ({ isa, buildActionMask: 2147483647, files, runOnlyForDeploymentPostprocessing: 0, ...extra });
+    const configuration = (configurationName, buildSettings) => ({ isa: 'XCBuildConfiguration', buildSettings, name: configurationName });
+    const configurations = (debug, release) => ({
+        isa: 'XCConfigurationList', buildConfigurations: [debug, release], defaultConfigurationIsVisible: 0, defaultConfigurationName: 'Release',
+    });
+    return {
+        [ID.main]: file('main.m', 'sourcecode.c.objc'),
+        [ID.info]: file('Info.plist', 'text.plist.xml'),
+        [ID.app]: file('app', 'folder'),
+        [ID.hermes]: file('Frameworks/hermesvm.xcframework', 'wrapper.xcframework'),
+        [ID.product]: {
+            isa: 'PBXFileReference', explicitFileType: 'wrapper.application', includeInIndex: 0, path: `${name}.app`, sourceTree: 'BUILT_PRODUCTS_DIR',
+        },
+        [ID.mainBuild]: { isa: 'PBXBuildFile', fileRef: ID.main },
+        [ID.appBuild]: { isa: 'PBXBuildFile', fileRef: ID.app },
+        [ID.hermesLink]: { isa: 'PBXBuildFile', fileRef: ID.hermes },
+        [ID.hermesEmbed]: { isa: 'PBXBuildFile', fileRef: ID.hermes, settings: { ATTRIBUTES: ['CodeSignOnCopy', 'RemoveHeadersOnCopy'] } },
+        [ID.sources]: phase('PBXSourcesBuildPhase', [ID.mainBuild]),
+        [ID.frameworks]: phase('PBXFrameworksBuildPhase', [ID.hermesLink]),
+        [ID.resources]: phase('PBXResourcesBuildPhase', [ID.appBuild]),
+        [ID.embed]: phase('PBXCopyFilesBuildPhase', [ID.hermesEmbed], { dstPath: '', dstSubfolderSpec: 10, name: 'Embed Frameworks' }),
+        [ID.mainGroup]: { isa: 'PBXGroup', children: [ID.main, ID.info, ID.app, ID.hermes, ID.products], sourceTree: '<group>' },
+        [ID.products]: { isa: 'PBXGroup', children: [ID.product], name: 'Products', sourceTree: '<group>' },
+        [ID.target]: {
+            isa: 'PBXNativeTarget',
+            buildConfigurationList: ID.targetConfigs,
+            buildPhases: [ID.sources, ID.frameworks, ID.resources, ID.embed],
+            buildRules: [],
+            dependencies: [],
+            name,
+            productName: name,
+            productReference: ID.product,
+            productType: 'com.apple.product-type.application',
+        },
+        [ID.project]: {
+            isa: 'PBXProject',
+            buildConfigurationList: ID.projectConfigs,
+            compatibilityVersion: 'Xcode 14.0',
+            developmentRegion: 'en',
+            hasScannedForEncodings: 0,
+            knownRegions: ['en', 'Base'],
+            mainGroup: ID.mainGroup,
+            productRefGroup: ID.products,
+            projectDirPath: '',
+            projectRoot: '',
+            targets: [ID.target],
+        },
+        [ID.projectDebug]: configuration('Debug', PROJECT_SETTINGS),
+        [ID.projectRelease]: configuration('Release', PROJECT_SETTINGS),
+        [ID.targetDebug]: configuration('Debug', targetSettings),
+        [ID.targetRelease]: configuration('Release', targetSettings),
+        [ID.projectConfigs]: configurations(ID.projectDebug, ID.projectRelease),
+        [ID.targetConfigs]: configurations(ID.targetDebug, ID.targetRelease),
+    };
+}
+
+// An iOS app as an Xcode project, written anew from the parts its SDK targets built: each brings its archives and
+// their link line, and its slice of Hermes; the first also the app's files. Xcode signs the app and runs it, in the
+// Simulator or on a device.
+export default function writeXcodeProject(to, { parts, identity, version }) {
+    const { name } = state.config.general;
+    if (parts.length === 0) throw new Error(`crossbind: no part of the iOS app ${name} is built, so there is no Xcode project to write.`);
+    fs.rmSync(to, { recursive: true, force: true });
+    fs.mkdirSync(`${to}/${name}.xcodeproj`, { recursive: true });
+    const linkFlags = {};
+    parts.forEach(({ sdk, dir }) => {
+        fs.cpSync(`${dir}/lib`, `${to}/lib/${sdk}`, { recursive: true });
+        // The quotes keep a project path with spaces in one argument.
+        const args = JSON.parse(fs.readFileSync(`${dir}/link.json`, 'utf8'))
+            .map((arg) => arg.replace(/\{lib\}\/(.+)$/, `"$(PROJECT_DIR)/lib/${sdk}/$1"`));
+        linkFlags[`OTHER_LDFLAGS[sdk=${sdk}*]`] = [...args, ...SYSTEM_LIBS];
+    });
+    fs.cpSync(`${parts[0].dir}/app`, `${to}/app`, { recursive: true });
+    const frameworks = parts.flatMap(({ dir }) => ['-framework', `${dir}/hermesvm.framework`]);
+    const result = spawnSync('xcodebuild', ['-create-xcframework', ...frameworks, '-output', `${to}/Frameworks/hermesvm.xcframework`], { encoding: 'utf8' });
+    if (result.status !== 0) throw new Error(`crossbind: cannot make Hermes' xcframework for ${to}: ${result.stderr || result.error?.message}`);
+
+    fs.writeFileSync(`${to}/main.m`, MAIN);
+    fs.writeFileSync(`${to}/Info.plist`, infoPlist(name));
+    const targetSettings = {
+        PRODUCT_NAME: name,
+        PRODUCT_BUNDLE_IDENTIFIER: identity.id,
+        DEVELOPMENT_TEAM: identity.team,
+        CODE_SIGN_STYLE: 'Automatic',
+        INFOPLIST_FILE: 'Info.plist',
+        MARKETING_VERSION: version,
+        CURRENT_PROJECT_VERSION: version,
+        LD_RUNPATH_SEARCH_PATHS: ['$(inherited)', '@executable_path/Frameworks'],
+        ...linkFlags,
+    };
+    fs.writeFileSync(`${to}/${name}.xcodeproj/project.pbxproj`, textPlist({
+        archiveVersion: 1, classes: {}, objectVersion: 56, objects: objects(name, targetSettings), rootObject: ID.project,
+    }));
+    return to;
+}

package/src/assets/cpp-runtime/node.cpp

@@ -2,9 +2,26 @@
 #include <emscripten/wasmfs.h>
 #include <limits.h>
 #include <unistd.h>
+#include <wasi/api.h>
+
+static backend_t hostBackend;
 
 backend_t wasmfs_create_root_dir(void) {
-  return wasmfs_create_node_backend("/");
+  hostBackend = wasmfs_create_node_backend("/");
+  return hostBackend;
+}
+
+// Emscripten's Node backend traps on flush, which fsync and fdatasync call. A host file's writes have already
+// reached the operating system, so both succeed there, as with NODERAWFS. buildWasm links these with --wrap.
+extern "C" __wasi_errno_t __real___wasi_fd_sync(__wasi_fd_t fd);
+extern "C" int __real___syscall_fdatasync(int fd);
+
+extern "C" __wasi_errno_t __wrap___wasi_fd_sync(__wasi_fd_t fd) {
+  return wasmfs_get_backend_by_fd(fd) == hostBackend ? __WASI_ERRNO_SUCCESS : __real___wasi_fd_sync(fd);
+}
+
+extern "C" int __wrap___syscall_fdatasync(int fd) {
+  return wasmfs_get_backend_by_fd(fd) == hostBackend ? 0 : __real___syscall_fdatasync(fd);
 }
 
 void wasmfs_before_preload(void) {