crossbind 2.0.0-beta.64 → 2.0.0-beta.65

package/src/actions/buildDependencies.js

@@ -83,12 +83,13 @@ async function buildMissingCargoDependencies(buildTargets, targetParams) {
     const bridgeTarget = buildTargets.some(isWasm) ? state.targets.find(isWasm) : undefined;
     const extraTarget = bridgeTarget && !buildTargets.some((target) => target.path === bridgeTarget.path) ? bridgeTarget : undefined;
     const targets = extraTarget ? [...buildTargets, extraTarget] : buildTargets;
-    // A prebuilt from another embind-rs counts as missing: linked, it carries stale glue or clashes with the others.
-    const fingerprint = getEmbindRsFingerprint();
+    // A prebuilt from another embind-rs, or for an image's target from another rustc, counts as missing: linked, it
+    // carries stale glue or clashes with the others.
     const prebuiltOf = (dep, target) => [target.path, target.releasePath]
         .map((targetPath) => `${dep.paths.output}/prebuilt/${targetPath}`)
         .find((dir) => fs.existsSync(dir)) ?? `${dep.paths.output}/prebuilt/${target.path}`;
-    const isBuilt = (dep, target) => dep.functions.isEnabled(target) && !isEmbindRsFingerprintStale(prebuiltOf(dep, target), fingerprint);
+    const isBuilt = (dep, target) => dep.functions.isEnabled(target)
+        && !isEmbindRsFingerprintStale(prebuiltOf(dep, target), getEmbindRsFingerprint(target));
     const missing = cargoDependencies.filter((dep) => targets.some((target) => !isBuilt(dep, target)));
 
     for (const dep of missing) {

package/src/actions/buildExternal.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import replace from 'replace';
-import downloadAndExtractFile from '../utils/downloadAndExtractFile.js';
+import downloadAndExtractFile, { sourcesOf } from '../utils/downloadAndExtractFile.js';
 import copyToDistSource from '../utils/copyToDistSource.js';
 import { getBuildTargets } from './target.js';
 import state from '../state/index.js';
@@ -14,8 +14,8 @@ export default async function buildExternal(targetParams, options = {}) {
         throw new Error(`crossbind: "${state.config.general?.name}" has a crossbind.build recipe but no "nativeVersion" in package.json — cannot build from source.`);
     }
 
-    const { getURL, sha256, replaceList, copyToSource, copyToDist } = state.config.build;
-    const isNewlyCreated = await downloadAndExtractFile(getURL(version), state.config.paths.build, sha256);
+    const { sha256, replaceList, copyToSource, copyToDist } = state.config.build;
+    const isNewlyCreated = await downloadAndExtractFile(sourcesOf(state.config.build, version), state.config.paths.build, sha256);
     const sourcePath = `${state.config.paths.build}/source`;
     if (isNewlyCreated && replaceList) {
         replaceList.forEach(({ regex, replacement, paths }) => {

package/src/actions/buildLib.js

@@ -54,7 +54,7 @@ export default function buildLib(targetParams, options = {}) {
                 fs.copyFileSync(modulePath, `${state.config.paths.output}/prebuilt/${target.path}/swig/${fileName}`);
             });
             writeSourceFingerprint(libdir, sourceFingerprint);
-            if (isCargo) writeEmbindRsFingerprint(libdir, getEmbindRsFingerprint());
+            if (isCargo) writeEmbindRsFingerprint(libdir, getEmbindRsFingerprint(target));
             isChanged = true;
         } else {
             logger.cachedStep(target, 'lib');

package/src/actions/buildNode.js

@@ -24,7 +24,7 @@ import toolchainNoticesDir from '../utils/toolchainNotices.js';
 const cpuCount = Math.max(1, os.cpus().length - 1);
 const WINDOWS_IMAGE_NOTICES = '/opt/licenses/llvm-mingw';
 
-function filesUnder(dirs) {
+export function filesUnder(dirs) {
     return dirs.flatMap((dir) => (fs.existsSync(dir)
         ? fs.readdirSync(dir, { recursive: true })
             .map((file) => `${dir}/${file}`)
@@ -32,18 +32,21 @@ function filesUnder(dirs) {
         : []));
 }
 
-function linkInputs(target) {
+// The addon's link, and an app host's, whose bridges come from an archive of their own.
+export function linkInputs(target, { bridge } = {}) {
+    const isMachO = ['darwin', 'ios'].includes(target.platform);
     const {
         libs, appRustLibs, wholeArchiveAll, wholeArchiveNames, rustKeepFlags, hasRust,
     } = getLinkInputs(target, {
         // The linker loads the archive member that defines a -u symbol; Mach-O prefixes C names with _.
-        keepFlag: (name) => `-Wl,-u,${target.platform === 'darwin' ? '_' : ''}crossbind_keep_${name}`,
+        keepFlag: (name) => `-Wl,-u,${isMachO ? '_' : ''}crossbind_keep_${name}`,
+        bridge,
     });
     // The app's Rust goes first: what a package's kept member needs from std and rustc's allocator shims is then
     // already the app's, and the package's own copies stay in its archive instead of defining them twice.
     const ordered = [...appRustLibs, ...libs.filter((lib) => !appRustLibs.includes(lib))];
     const linkArgs = [
-        ...buildLinkLibArgs(ordered, { wholeArchiveAll, wholeArchiveNames, forceLoad: target.platform === 'darwin' }),
+        ...buildLinkLibArgs(ordered, { wholeArchiveAll, wholeArchiveNames, forceLoad: isMachO }),
         ...rustKeepFlags,
         // The system libraries the archives need, declared by the packages that bring them in.
         ...(getData('binary', target)?.addonFlags ?? []),
@@ -116,6 +119,13 @@ export function bundleNodeLoader(target) {
     return bundleLoader(target, resolveEmbindNapiRoot(), nodeLoaderConfig(target));
 }
 
+// The mingw-w64 runtime and winpthreads in a Windows addon or app ask for their notices in binary
+// distributions. The windows image carries them; a host toolchain may not.
+export function copyWindowsNotices(target) {
+    const notices = toolchainNoticesDir('win32');
+    run(null, ['sh', '-c', `if [ -d ${WINDOWS_IMAGE_NOTICES} ]; then mkdir -p ${notices} && cp ${WINDOWS_IMAGE_NOTICES}/* ${notices}/; fi`], null, target);
+}
+
 // Links one Node-API addon from the project's archives and bundles the loader that picks the
 // addon matching the running process.
 export default async function buildNode(target, options = {}) {
@@ -170,12 +180,7 @@ export default async function buildNode(target, options = {}) {
         `-DCROSSBIND_LINK_DEPENDS=${libs.join(';')}`,
     ], platformPrefix, target);
     run(null, ['cmake', '--build', '.', '-j', String(cpuCount)], platformPrefix, target, { exclusive: true });
-    if (target.platform === 'win32') {
-        // The mingw-w64 runtime and winpthreads in the addon ask for their notices in binary
-        // distributions. The windows image carries them; a host toolchain may not.
-        const notices = toolchainNoticesDir('win32');
-        run(null, ['sh', '-c', `if [ -d ${WINDOWS_IMAGE_NOTICES} ]; then mkdir -p ${notices} && cp ${WINDOWS_IMAGE_NOTICES}/* ${notices}/; fi`], null, target);
-    }
+    if (target.platform === 'win32') copyWindowsNotices(target);
     fs.copyFileSync(`${build}/${platformPrefix}/${target.path}/${target.addonName}`, `${build}/${target.addonName}`);
     logger.doneStep(target, 'addon');
 

package/src/actions/createInterface.js

@@ -21,7 +21,6 @@ import {
 } from '../utils/swigInterface.js';
 import writeIfChanged from '../utils/writeIfChanged.js';
 import { withDirLockSync } from '../utils/dirLock.js';
-import { imageRoleFor } from '../utils/pullDockerImage.js';
 import { conanImportOfHeader } from '../utils/conanImport.js';
 import run, { cxxPreprocessorFor } from './run.js';
 import isSourceCmakePackage from '../utils/isSourceCmakePackage.js';
@@ -355,7 +354,7 @@ const RELEASE_DEFINE = '-DNDEBUG';
 // One bridge serves every desktop target, so SWIG and the macro table it reads come from the web image's em++,
 // which defines no operating system; an android bridge is read with the NDK it compiles with. The headers
 // still come from the target's own packages.
-const toolTargetFor = (target) => (imageRoleFor(target) === 'android' ? target : { ...target, platform: 'wasm' });
+const toolTargetFor = (target) => (target?.platform === 'android' ? target : { ...target, platform: 'wasm' });
 
 function dumpMacros(outputFile, includes, includePath, target, defines = []) {
     const tool = toolTargetFor(target);

package/src/actions/createLib.js

@@ -63,7 +63,10 @@ export default function createLib(target, fileType, options = {}) {
     const httpHeader = target.platform === 'wasi' && !state.config.build.withBuildConfig
         ? getFilesFingerprint([wasiHttpHeader(state.config.paths.cli)])
         : null;
-    const flagsFingerprint = getContentHash(JSON.stringify(httpHeader ? [keyInputs, httpHeader] : keyInputs));
+    // An Android app links the project's archives from the build where React Native's shared library comes from.
+    const appArchives = target.platform === 'android' && target.runtimeEnv === 'app' ? 'archives' : null;
+    const extraKeys = [httpHeader, appArchives].filter(Boolean);
+    const flagsFingerprint = getContentHash(JSON.stringify(extraKeys.length ? [keyInputs, ...extraKeys] : keyInputs));
     const flagsChanged = !fs.existsSync(flagsFingerprintFile)
         || fs.readFileSync(flagsFingerprintFile, { encoding: 'utf8' }) !== flagsFingerprint;
 

package/src/actions/getCmakeParameters.js

@@ -32,8 +32,9 @@ export default function getCmakeParameters(target, options = {}) {
         ...(options.headerDirs || []),
     ];
 
+    // React Native loads a library on Android as a shared one; an app's host links the project's archives into itself.
     const sharedPlatforms = ['android'];
-    const buildType = sharedPlatforms.includes(target.platform) ? 'SHARED' : 'STATIC';
+    const buildType = sharedPlatforms.includes(target.platform) && target.runtimeEnv !== 'app' ? 'SHARED' : 'STATIC';
     const otherBuildType = buildType === 'STATIC' ? 'SHARED' : 'STATIC';
 
     const cmakeCompileOptions = [...new Set(getData('cmake', target)?.compileOptions || [])];

package/src/actions/getDependLibs.js

@@ -11,9 +11,15 @@ export default function getDependLibs(target) {
             const ignoreLibNames = getFilteredTargetSpec(d?.targetSpecs, target).map(s => s.ignoreLibName).flat();
             d.export.libName.forEach((fileName) => {
                 if (ignoreLibNames?.includes(fileName)) return;
-                let libPaths = findFiles(`${d.paths.output}/prebuilt/${target.path}/lib/lib${fileName}.a`, { cwd: d.paths.project });
+                // On Android a package ships the shared library React Native packages, which an app carries beside
+                // its host.
+                const extensions = target.platform === 'android' ? ['a', 'so'] : ['a'];
+                const libsIn = (targetPath) => extensions
+                    .map((extension) => findFiles(`${d.paths.output}/prebuilt/${targetPath}/lib/lib${fileName}.${extension}`, { cwd: d.paths.project }))
+                    .find((found) => found.length > 0) ?? [];
+                let libPaths = libsIn(target.path);
                 if (libPaths.length === 0) {
-                    libPaths = findFiles(`${d.paths.output}/prebuilt/${target.releasePath}/lib/lib${fileName}.a`, { cwd: d.paths.project });
+                    libPaths = libsIn(target.releasePath);
                 }
                 dependLibs.push(...libPaths);
             });

package/src/actions/getLinkInputs.js

@@ -3,20 +3,23 @@ import getDependLibs from './getDependLibs.js';
 import state from '../state/index.js';
 import buildAppRustCrates from '../utils/appRustCrates.js';
 
-// The archives of a final link (wasm, Node-API addon or native executable) and which of them must
+// The archives of a final link (wasm, Node-API addon, native executable or app host) and which of them must
 // survive whole. keepFlag spells "keep this symbol" for the target's linker; a native executable
-// binds nothing, so it links no bridge.
-export default function getLinkInputs(target, { keepFlag, withBridge = true }) {
+// binds nothing, so it links no bridge. An app host's bridges compile against another JSI, in an archive of their own.
+export default function getLinkInputs(target, { keepFlag, withBridge = true, bridge = 'Bridge' }) {
     const buildType = target.buildType === 'release' ? 'Release' : 'Debug';
     const { build, output, cache } = state.config.paths;
     const { name } = state.config.general;
 
     // buildLib's cache is keyed on paths.output/prebuilt; after a cache clean the
     // build-dir copy can be gone while the output artifact is still valid — link it then.
-    const sourceLibCandidates = [
-        `${build}/Source-${buildType}/${target.path}/lib${name}.a`,
-        `${output}/prebuilt/${target.path}/lib/lib${name}.a`,
+    // An Xcode build (iOS) leaves its archive in the install tree alone.
+    const builtLib = (prefix) => [
+        `${build}/${prefix}-${buildType}/${target.path}/lib${name}.a`,
+        `${build}/${prefix}-${buildType}/prebuilt/${target.path}/lib/lib${name}.a`,
     ];
+    const sourceLibCandidates = [...builtLib('Source'), `${output}/prebuilt/${target.path}/lib/lib${name}.a`];
+    const bridgeLibCandidates = builtLib(bridge);
     // App-local Rust surfaces (imported .rs files) arrive as ONE super staticlib; it is the
     // single fully-loaded Rust archive of the link (see the libstd rule below).
     const appRustLibs = buildAppRustCrates(target, cache, state.config.cargoDependencies ?? {});
@@ -24,7 +27,7 @@ export default function getLinkInputs(target, { keepFlag, withBridge = true }) {
         ...getDependLibs(target),
         ...appRustLibs,
         sourceLibCandidates.find((lib) => fs.existsSync(lib)) ?? sourceLibCandidates[0],
-        ...(withBridge ? [`${build}/Bridge-${buildType}/${target.path}/lib${name}.a`] : []),
+        ...(withBridge ? [bridgeLibCandidates.find((lib) => fs.existsSync(lib)) ?? bridgeLibCandidates[0]] : []),
     ];
 
     // By default only the Bridge archive is kept whole (see linkLayout.js) so the linker

package/src/actions/gradleProject.js

@@ -0,0 +1,110 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import state from '../state/index.js';
+import { ANDROID_API_LEVEL } from '../utils/androidToolchain.js';
+import { HERMES } from '../utils/hermes.js';
+import resolveAppHostRoot from '../utils/resolveAppHost.js';
+import { SIGNING } from './androidGradle.js';
+
+// The ABIs an Android app builds for: phones and Apple silicon's emulators, and the emulators of x86_64 machines.
+export const ANDROID_ABIS = ['arm64-v8a', 'x86_64'];
+// The Android release the app is compiled against and declares it was tested on.
+const TARGET_SDK = 36;
+export const ANDROIDX_WEBKIT = '1.17.1';
+
+const groovyString = (text) => `'${text.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+
+const buildGradle = ({ id, label, version, abis }) => `// crossbind writes this project anew on every build: the module comes prebuilt in src/main/jniLibs/, and the app's
+// files are in src/main/assets/app/.
+plugins {
+    id 'com.android.application'
+}
+
+android {
+    namespace 'dev.crossbind.app'
+    compileSdk ${TARGET_SDK}
+
+    defaultConfig {
+        applicationId ${groovyString(id)}
+        // The module's libraries are built against this API level.
+        minSdk ${ANDROID_API_LEVEL}
+        targetSdk ${TARGET_SDK}
+        versionCode ${version.code}
+        versionName ${groovyString(version.name)}
+        manifestPlaceholders = [appName: ${groovyString(label)}]
+        ndk {
+            abiFilters ${abis.map(groovyString).join(', ')}
+        }
+    }
+
+    // A release is signed with the upload key crossbind's environment names, else with the debug key.
+    signingConfigs {
+        release {
+            def keystore = System.getenv('${SIGNING.keystore}')
+            if (keystore) {
+                storeFile file(keystore)
+                storePassword System.getenv('${SIGNING.password}')
+                keyAlias System.getenv('${SIGNING.alias}')
+                keyPassword System.getenv('${SIGNING.keyPassword}') ?: System.getenv('${SIGNING.password}')
+            }
+        }
+    }
+
+    buildTypes {
+        release {
+            signingConfig System.getenv('${SIGNING.keystore}') ? signingConfigs.release : signingConfigs.debug
+        }
+    }
+
+    // Release builds skip lint's vital checks, whose tools crossbind's android-app image leaves out: the module's code is
+    // crossbind's own.
+    lint {
+        checkReleaseBuilds false
+    }
+
+    packaging {
+        jniLibs {
+            // Hermes brings fbjni, and with it an older libc++_shared.so; the module's is the NDK's it was built with.
+            pickFirsts += ['**/libc++_shared.so']
+            // The libraries come stripped, and stripping them again would take an NDK of the plugin's own.
+            keepDebugSymbols += ['**/*.so']
+        }
+    }
+
+    // The page keeps all its files, an _app directory or a .well-known one among them, which Android leaves out by default.
+    androidResources {
+        ignoreAssetsPattern = '!.svn:!.git:!.ds_store:!*.scc:!CVS:!thumbs.db:!picasa.ini:!*~'
+    }
+
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
+    }
+}
+
+dependencies {
+    // Hermes' release build in every variant: it is the one the host links against.
+    implementation('com.facebook.hermes:hermes-android:${HERMES.version}') {
+        attributes {
+            attribute(com.android.build.api.attributes.BuildTypeAttr.ATTRIBUTE, objects.named(com.android.build.api.attributes.BuildTypeAttr, 'release'))
+        }
+    }
+    implementation 'androidx.webkit:webkit:${ANDROIDX_WEBKIT}'
+}
+`;
+
+// An Android app as a Gradle project, written anew from the parts its ABI targets built: each brings its libraries,
+// the first also the app's files. Gradle adds Hermes and androidx.webkit from Maven, and makes the APK or the bundle.
+export default function writeGradleProject(to, { parts, id, version }) {
+    const { name } = state.config.general;
+    if (parts.length === 0) throw new Error(`crossbind: no part of the Android app ${name} is built, so there is no Gradle project to write.`);
+    fs.rmSync(to, { recursive: true, force: true });
+    fs.cpSync(path.join(resolveAppHostRoot(), 'android'), to, { recursive: true });
+    const main = path.join(to, 'app', 'src', 'main');
+    parts.forEach(({ arch, dir }) => fs.cpSync(path.join(dir, 'lib'), path.join(main, 'jniLibs', arch), { recursive: true }));
+    fs.cpSync(path.join(parts[0].dir, 'app'), path.join(main, 'assets', 'app'), { recursive: true });
+    fs.writeFileSync(path.join(to, 'app', 'build.gradle'), buildGradle({
+        id, label: name, version, abis: parts.map(({ arch }) => arch),
+    }));
+    return to;
+}

package/src/actions/iosSimulator.js

@@ -0,0 +1,63 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { EXEC_MAX_BUFFER } from './run.js';
+import state from '../state/index.js';
+import logger from '../utils/logger.js';
+
+let hasToldNoWindow = false;
+
+function tool(program, args) {
+    const result = spawnSync(program, args, { encoding: 'utf8', maxBuffer: EXEC_MAX_BUFFER });
+    if (result.status !== 0) {
+        throw new Error(`crossbind: ${program} ${args.join(' ')} failed: ${`${result.stdout ?? ''}${result.stderr ?? ''}`.trim() || result.error?.message}`);
+    }
+    return result.stdout;
+}
+
+// Newer iOS first: 27.0 before 18.5.
+function byNewerIos(a, b) {
+    const index = a.version.findIndex((part, i) => part !== b.version[i]);
+    return index === -1 ? 0 : (b.version[index] ?? 0) - a.version[index];
+}
+
+// The Simulator an app opens in: one already booted, or else an iPhone of the newest iOS, booted for it.
+function simulator() {
+    const { devices } = JSON.parse(tool('xcrun', ['simctl', 'list', 'devices', 'available', '--json']));
+    const all = Object.entries(devices)
+        .filter(([runtime]) => runtime.includes('.SimRuntime.iOS-'))
+        .flatMap(([runtime, list]) => list.map((device) => ({ ...device, version: runtime.split('.SimRuntime.iOS-')[1].split('-').map(Number) })));
+    const booted = all.find((device) => device.state === 'Booted');
+    if (booted) return booted.udid;
+    const [newest] = all.filter((device) => device.name.startsWith('iPhone')).sort(byNewerIos);
+    if (!newest) throw new Error('crossbind: no iPhone Simulator is installed. Add the iOS platform in Xcode, under Settings > Components.');
+    tool('xcrun', ['simctl', 'boot', newest.udid]);
+    tool('xcrun', ['simctl', 'bootstatus', newest.udid, '-b']);
+    return newest.udid;
+}
+
+// Builds an iOS app's Xcode project for the Simulator, and returns the app.
+export function buildForSimulator(project, configuration = 'Release') {
+    const { name } = state.config.general;
+    const products = `${state.config.paths.build}/xcode`;
+    tool('xcodebuild', ['-project', `${project}/${name}.xcodeproj`, '-configuration', configuration, '-sdk', 'iphonesimulator',
+        `SYMROOT=${products}`, '-quiet', 'build']);
+    return `${products}/${configuration}-iphonesimulator/${name}.app`;
+}
+
+// Opens a Simulator build of an iOS app, with `env` in its environment. The process returned carries the app's output
+// and ends with the app; close() ends the app.
+export default function openInSimulator(app, { env = {}, show = false, stdio = 'pipe' } = {}) {
+    const device = simulator();
+    // Simulator.app only shows the device, which runs the app without it as well.
+    if (show && spawnSync('open', ['-b', 'com.apple.iphonesimulator']).status !== 0 && !hasToldNoWindow) {
+        hasToldNoWindow = true;
+        logger.info('crossbind: Simulator.app is not installed, so the Simulator shows no window; the app runs in it all the same.');
+    }
+    tool('xcrun', ['simctl', 'install', device, app]);
+    const bundleId = tool('plutil', ['-extract', 'CFBundleIdentifier', 'raw', '-o', '-', `${app}/Info.plist`]).trim();
+    const childEnv = { ...process.env };
+    Object.entries(env).forEach(([key, value]) => {
+        childEnv[`SIMCTL_CHILD_${key}`] = value;
+    });
+    const child = spawn('xcrun', ['simctl', 'launch', '--console-pty', '--terminate-running-process', device, bundleId], { env: childEnv, stdio });
+    return { child, close: () => spawnSync('xcrun', ['simctl', 'terminate', device, bundleId]) };
+}

package/src/actions/licenses.js

@@ -8,6 +8,11 @@ import familyManifestOf from '../utils/familyManifest.js';
 import { wasiToolchainIdentity } from '../utils/provenance.js';
 import { resolveWasiSdkPath } from '../utils/wasiToolchain.js';
 import resolveEmbindNapiRoot, { resolveEmbindJsiRoot } from '../utils/resolveEmbindNapi.js';
+import resolveAppHostRoot, { resolveAppEmbindJsiRoot } from '../utils/resolveAppHost.js';
+import {
+    HERMES, HERMES_ANDROID, HERMES_SOURCE, hermesUrl,
+} from '../utils/hermes.js';
+import { ANDROIDX_WEBKIT } from './gradleProject.js';
 import { shippedBundledLicense } from '../utils/bundledLicenses.js';
 import toolchainNoticesDir from '../utils/toolchainNotices.js';
 
@@ -103,7 +108,7 @@ function wasiToolchainRows() {
     ];
 }
 
-// The notices a build copied out of its toolchain image (buildNode does it for Windows addons).
+// The notices a build copied out of its toolchain image (a Windows addon's or app's does).
 function toolchainNoticeTexts(platform) {
     const build = state.config?.paths?.build;
     const dir = build ? path.join(build, toolchainNoticesDir(platform)) : null;
@@ -130,33 +135,32 @@ function addonToolchainRows(platform) {
     };
     const llvmText = 'license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT';
     if (platform === 'linux' || platform === 'linuxmusl') {
-        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the addon; ${llvmText}` }];
+        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the binary; ${llvmText}` }];
     }
     const mingwLicense = 'LicenseRef-MinGW-w64-runtime';
     return [
-        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the addon; ${llvmText}` },
+        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the binary; ${llvmText}` },
         {
             ...shared,
             name: 'mingw-w64-runtime',
             license: mingwLicense,
             licenseDeclared: mingwLicense,
             sourceUrl: 'https://github.com/mingw-w64/mingw-w64',
-            licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the addon; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
+            licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the binary; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
             licenseText: toolchainNoticeTexts('win32'),
         },
     ];
 }
 
-// A Node-API addon compiles in crossbind's runtime: embind-jsi, which adapts Emscripten's embind,
-// and node-api-jsi. The loader bundles the JavaScript half of the same runtime.
-function nodeRuntimeRows({ isAddon }) {
-    const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
-    const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
+const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
+const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
+
+// crossbind's runtime, which an addon and an app host compile in: embind-jsi, which adapts Emscripten's embind.
+function runtimeRows(jsiRoot, notes) {
     const shared = {
         nativeVersion: null, sha256: null, licenseSelected: null, isCopyleft: false,
     };
-    const jsiRoot = resolveEmbindJsiRoot();
-    const rows = [
+    return [
         {
             ...shared,
             name: 'crossbind',
@@ -165,7 +169,7 @@ function nodeRuntimeRows({ isAddon }) {
             license: 'MIT',
             licenseDeclared: 'MIT',
             sourceUrl: 'https://github.com/crossbind/crossbind',
-            licenseNotes: 'the embind-jsi and embind-napi runtime and the bindings crossbind generates',
+            licenseNotes: notes,
             licenseText: textOf(path.join(CROSSBIND_ROOT, 'LICENSE')),
         },
         {
@@ -180,10 +184,19 @@ function nodeRuntimeRows({ isAddon }) {
             licenseText: textOf(path.join(jsiRoot, 'LICENSE')),
         },
     ];
+}
+
+// A Node-API addon compiles in crossbind's runtime and node-api-jsi. The loader bundles the JavaScript half of the
+// same runtime.
+function nodeRuntimeRows({ isAddon }) {
+    const rows = runtimeRows(resolveEmbindJsiRoot(), 'the embind-jsi and embind-napi runtime and the bindings crossbind generates');
     if (!isAddon) return rows;
     const napiRoot = resolveEmbindNapiRoot();
     return [...rows, {
-        ...shared,
+        nativeVersion: null,
+        sha256: null,
+        licenseSelected: null,
+        isCopyleft: false,
         name: 'node-api-jsi',
         npmName: '@crossbind/core-embind-napi',
         version: versionOf(napiRoot),
@@ -195,6 +208,137 @@ function nodeRuntimeRows({ isAddon }) {
     }];
 }
 
+// What an app's host carries beside crossbind's runtime, pinned as the third_party READMEs of @crossbind/core-app-host
+// record: React Native's Hermes, JSI's jsi.cpp from the same release, webview/webview, and on Windows the WebView2 SDK's
+// headers.
+const WEBVIEW = { version: 'cbbdee44afff22867de9fd88a9fc8350d9bdd399', sha256: '10e972a2327b5681474f4aa4499e505eaa4ff659aa995380386f08fd6fc1b763' };
+const WEBVIEW2_SDK = { version: '1.0.4258.31', sha256: '56f7f4b8bf9aee4b8efefbbdd4f67d5f74ebd1b100ed0806da71bf76af481aa9' };
+const JSI_SHA256 = 'cb6274a22abc93ecc970066539815e716d3e47716e8f93a9971cf4eb5918ffc1';
+// The fbjni the Hermes release for Android depends on.
+const FBJNI_VERSION = '0.7.0';
+
+const HERMES_BUILDS = {
+    linux: {
+        sha256: HERMES_SOURCE.sha256,
+        sourceUrl: HERMES_SOURCE.url,
+        licenseNotes: "Hermes built from its release's source in the linux toolchain image, statically linked into the host",
+    },
+    win32: {
+        sha256: HERMES_SOURCE.sha256,
+        sourceUrl: HERMES_SOURCE.url,
+        licenseNotes: "Hermes built from its release's source in the windows toolchain image (llvm-mingw), statically linked into the host",
+    },
+    android: {
+        sha256: HERMES_ANDROID.sha256,
+        sourceUrl: HERMES_ANDROID.url,
+        licenseNotes: "React Native's Hermes for Android, whose libraries the app's Gradle build takes from Maven Central",
+    },
+};
+
+// What an Android app's Gradle build adds from Maven, and the C++ runtime the app carries beside its host.
+function androidAppRows() {
+    const shared = {
+        npmName: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
+    };
+    const apache = { ...shared, license: 'Apache-2.0', licenseDeclared: 'Apache-2.0' };
+    const llvmLicense = 'Apache-2.0 WITH LLVM-exception';
+    return [
+        {
+            ...apache,
+            name: 'fbjni',
+            version: FBJNI_VERSION,
+            nativeVersion: FBJNI_VERSION,
+            sourceUrl: 'https://github.com/facebookincubator/fbjni',
+            licenseNotes: 'libfbjni.so, which Hermes loads and Gradle takes with it; license text: https://github.com/facebookincubator/fbjni/blob/main/LICENSE',
+        },
+        {
+            ...apache,
+            name: 'androidx-webkit',
+            version: ANDROIDX_WEBKIT,
+            nativeVersion: ANDROIDX_WEBKIT,
+            sourceUrl: 'https://developer.android.com/jetpack/androidx/releases/webkit',
+            licenseNotes: "androidx.webkit, the WebView's message ports and start scripts, from Google's Maven repository; license text: https://www.apache.org/licenses/LICENSE-2.0.txt",
+        },
+        {
+            ...shared,
+            name: 'llvm-runtimes',
+            version: null,
+            nativeVersion: null,
+            license: llvmLicense,
+            licenseDeclared: llvmLicense,
+            sourceUrl: 'https://github.com/llvm/llvm-project',
+            licenseNotes: "libc++ of the android image's NDK, which the app carries as libc++_shared.so; license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT",
+        },
+    ];
+}
+
+// The WebView2 SDK headers a Windows host compiles against. webview/webview loads the WebView2 Runtime itself, without
+// the SDK's loader.
+function windowsAppRows(hostRoot) {
+    const license = 'BSD-3-Clause';
+    return [{
+        npmName: '@crossbind/core-app-host',
+        name: 'webview2-sdk',
+        version: WEBVIEW2_SDK.version,
+        nativeVersion: WEBVIEW2_SDK.version,
+        sha256: WEBVIEW2_SDK.sha256,
+        license,
+        licenseDeclared: license,
+        licenseSelected: null,
+        isCopyleft: false,
+        sourceUrl: `https://api.nuget.org/v3-flatcontainer/microsoft.web.webview2/${WEBVIEW2_SDK.version}/microsoft.web.webview2.${WEBVIEW2_SDK.version}.nupkg`,
+        licenseNotes: "the WebView2 SDK's headers from the windows toolchain image, whose interface IDs the host compiles in",
+        licenseText: textOf(path.join(hostRoot, 'third_party', 'webview2', 'LICENSE')),
+    }];
+}
+
+function appRuntimeRows(platform) {
+    const hostRoot = resolveAppHostRoot();
+    const hermesLicense = textOf(path.join(hostRoot, 'third_party', 'jsi', 'LICENSE'));
+    const mit = {
+        npmName: '@crossbind/core-app-host', license: 'MIT', licenseDeclared: 'MIT', licenseSelected: null, isCopyleft: false,
+    };
+    const hermes = HERMES_BUILDS[platform] ?? {
+        sha256: HERMES.sha256,
+        sourceUrl: hermesUrl(HERMES.version),
+        licenseNotes: "React Native's Hermes for Apple platforms, which the app carries as hermesvm.framework",
+    };
+    return [
+        ...runtimeRows(resolveAppEmbindJsiRoot(), 'the embind-jsi runtime, the app host and the bindings crossbind generates'),
+        {
+            ...mit,
+            ...hermes,
+            name: 'hermes',
+            version: HERMES.version,
+            nativeVersion: HERMES.version,
+            licenseText: hermesLicense,
+        },
+        {
+            ...mit,
+            name: 'jsi',
+            version: HERMES.version,
+            nativeVersion: HERMES.version,
+            sha256: JSI_SHA256,
+            sourceUrl: 'https://github.com/facebook/hermes',
+            licenseNotes: "JSI's jsi.cpp from the same Hermes release, compiled into the host",
+            licenseText: hermesLicense,
+        },
+        ...(platform === 'android' ? androidAppRows() : []),
+        ...(platform === 'win32' ? windowsAppRows(hostRoot) : []),
+        // A mobile app makes its window with UIKit or an Android activity, without webview/webview.
+        ...(['ios', 'android'].includes(platform) ? [] : [{
+            ...mit,
+            name: 'webview',
+            version: WEBVIEW.version,
+            nativeVersion: WEBVIEW.version,
+            sha256: WEBVIEW.sha256,
+            sourceUrl: 'https://github.com/webview/webview',
+            licenseNotes: 'webview/webview, with the local patch @crossbind/core-app-host lists',
+            licenseText: textOf(path.join(hostRoot, 'third_party', 'webview', 'LICENSE')),
+        }]),
+    ];
+}
+
 async function buildRow(node) {
     const recipe = await loadJs(node.paths.project, 'crossbind.build');
     const manifest = node.package || null;
@@ -284,7 +428,8 @@ function assertConanStaged() {
 // platform (optional, e.g. 'wasi') additionally includes what that platform's
 // artifact statically links beyond the package graph: recipe-declared vendored
 // copies and the toolchain runtime. runtimeEnv 'node' adds the crossbind runtime an
-// addon of that platform compiles in, or without a platform the one its loader bundles.
+// addon of that platform compiles in, or without a platform the one its loader bundles;
+// runtimeEnv 'app' adds what an app's host carries.
 export default async function collectLicenseRows(platform = null, { runtimeEnv = null } = {}) {
     assertConanStaged();
     // The root package is a component too when it is a port: leaf -wasi packages have no deps but ship
@@ -310,5 +455,6 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
     if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
     if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
+    if (runtimeEnv === 'app') rows.push(...appRuntimeRows(platform));
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }