crossbind 2.0.0-beta.64 → 2.0.0-beta.65

package/src/utils/downloadAndExtractFile.js

@@ -14,19 +14,45 @@ const RETRYABLE_STATUS = new Set([408, 429]);
 const sleep = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); });
 const retryable = (error) => Object.assign(error, { retryable: true });
 
-export default async function downloadAndExtractFile(url, output, sha256, options = {}) {
-    const archive = path.basename(url);
+// A recipe names its source with getURL and may name mirrors that serve the same archive under the same pin.
+export function sourcesOf({ getURL, getMirrors }, version) {
+    return [getURL(version), ...(getMirrors?.(version) ?? [])];
+}
+
+// `urls` is one URL or a list of them: the first names the archive, the others are mirrors of it.
+export default async function downloadAndExtractFile(urls, output, sha256, options = {}) {
+    const sources = [urls].flat();
+    const archive = path.basename(sources[0]);
     if (fs.existsSync(`${output}/source`) && sourceCameFrom(output, archive)) {
         return false;
     }
+    sources.forEach((url) => assertHttps(url));
     fs.rmSync(`${output}/source`, { recursive: true, force: true });
-    const filePath = await downloadFile(url, output, options);
-    verifyIntegrity(filePath, url, sha256);
+    const { filePath, url } = await downloadFromAny(sources, output, sha256, { ...options, name: archive });
     extractArchive(filePath, url, output);
     fs.writeFileSync(`${output}/source.archive`, archive);
     return true;
 }
 
+// A source that cannot serve the archive, or serves bytes the pin does not match, hands over to the next one.
+async function downloadFromAny(sources, output, sha256, options) {
+    const failures = [];
+    for (const url of sources) {
+        try {
+            const filePath = await downloadFile(url, output, options);
+            verifyIntegrity(filePath, url, sha256);
+            return { filePath, url };
+        } catch (err) {
+            failures.push(err);
+        }
+    }
+    if (failures.length === 1) throw failures[0];
+    throw new Error(
+        `crossbind: no source of ${options.name} could be used:\n${failures.map((err) => `  - ${err.message}`).join('\n')}`,
+        { cause: failures.at(-1) },
+    );
+}
+
 // A cached source tree only counts when it came from the archive the recipe names now, or a
 // nativeVersion bump would keep compiling the old tree. Trees from before the marker are judged
 // by the archive that was downloaded next to them.
@@ -37,20 +63,22 @@ function sourceCameFrom(output, archive) {
 }
 
 // Extraction runs through the system tar (GNU tar and bsdtar both detect gzip/bzip2/xz, and
-// every platform the engine builds on ships one). Extracting into a scratch directory keeps
-// the archive from choosing where its files land, and gives the upstream root folder - which
-// recipes address as build/source - one place to be renamed from.
+// every platform the engine builds on ships one), and a zip archive, which GNU tar cannot read,
+// through unzip. Extracting into a scratch directory keeps the archive from choosing where its
+// files land, and gives the upstream root folder - which recipes address as build/source - one
+// place to be renamed from.
 function extractArchive(filePath, url, output) {
     const work = `${output}/.extract`;
     fs.rmSync(work, { recursive: true, force: true });
     mkdirSync(work, { recursive: true });
     try {
-        const tar = spawnSync('tar', ['-xf', filePath, '-C', work], { encoding: 'utf8' });
-        if (tar.error) {
-            throw new Error(`crossbind: cannot run tar to extract ${filePath}: ${tar.error.message}`);
+        const [tool, args] = /\.(zip|aar)$/.test(filePath) ? ['unzip', ['-q', filePath, '-d', work]] : ['tar', ['-xf', filePath, '-C', work]];
+        const extracted = spawnSync(tool, args, { encoding: 'utf8' });
+        if (extracted.error) {
+            throw new Error(`crossbind: cannot run ${tool} to extract ${filePath}: ${extracted.error.message}`);
         }
-        if (tar.status !== 0) {
-            throw new Error(`crossbind: extracting ${filePath} (from ${url}) failed: ${(tar.stderr || '').trim() || `tar exited ${tar.status}`}`);
+        if (extracted.status !== 0) {
+            throw new Error(`crossbind: extracting ${filePath} (from ${url}) failed: ${(extracted.stderr || '').trim() || `${tool} exited ${extracted.status}`}`);
         }
         const entries = fs.readdirSync(work, { withFileTypes: true });
         if (entries.length === 0) {
@@ -95,9 +123,9 @@ export function assertHttps(target, context = target) {
 
 // fetch follows redirects itself, which release downloads rely on (github and the osgeo
 // mirrors both bounce), so the download needs no redirect library of its own.
-export async function downloadFile(url, folder, { retryDelaysMs = RETRY_DELAYS_MS } = {}) {
+export async function downloadFile(url, folder, { retryDelaysMs = RETRY_DELAYS_MS, name = path.basename(url) } = {}) {
     mkdirSync(folder, { recursive: true });
-    const dest = `${folder}/${path.basename(url)}`;
+    const dest = `${folder}/${name}`;
     if (fs.existsSync(dest)) return dest;
 
     assertHttps(url);

package/src/utils/embindRsFingerprint.js

@@ -1,18 +1,25 @@
 import fs from 'node:fs';
+import { createRequire } from 'node:module';
 import path from 'node:path';
 import { getContentHash, getFileHash } from './hash.js';
 import { collectRustSources } from './inputStamp.js';
 import resolveEmbindRustRoot from './resolveEmbindRust.js';
+import { HOST_BUILT_PLATFORMS } from './targets.js';
+
+const { toolchains } = createRequire(import.meta.url)('../assets/toolchain-digests.json');
 
 // Every cargo staticlib bundles the embind-rs it was built from. An archive from another one links stale glue, and next
 // to an archive built after it every embind_rs symbol is defined twice, so a prebuilt records the one it came from.
 export const EMBIND_RS_FINGERPRINT_FILE = 'crossbind-embind-rs.fingerprint';
 
-// Paths count relative to the crate, so an archive built from the same embind-rs elsewhere matches.
-export function getEmbindRsFingerprint() {
+// Paths count relative to the crate, so an archive built from the same embind-rs elsewhere matches. An archive an image
+// built carries that image's Rust std too, whose second copy from another rustc lld refuses, so the image's rustc
+// counts as well; Apple's linker takes the mix, and the host's own rustc builds those.
+export function getEmbindRsFingerprint(target) {
     const crate = `${resolveEmbindRustRoot()}/crate`;
     const files = [...collectRustSources([crate]), `${crate}/Cargo.toml`];
-    return getContentHash(files.map((file) => `${path.relative(crate, file)}:${getFileHash(file)}`).sort().join('\n'));
+    const embindRs = getContentHash(files.map((file) => `${path.relative(crate, file)}:${getFileHash(file)}`).sort().join('\n'));
+    return !target || HOST_BUILT_PLATFORMS.includes(target.platform) ? embindRs : getContentHash(`${embindRs}\nrustc ${toolchains.rust}`);
 }
 
 export function isEmbindRsFingerprintStale(prebuiltDir, fingerprint) {

package/src/utils/hermes.js

@@ -0,0 +1,40 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import withDirLock from './dirLock.js';
+import downloadAndExtractFile from './downloadAndExtractFile.js';
+
+// The Hermes React Native publishes on Maven Central for Apple platforms: the macOS framework, the iOS xcframework,
+// hermesc and the headers. A new version also moves third_party/jsi of @crossbind/core-app-host to its tag, and the
+// Hermes of crossbind's android-app, linux and windows images.
+export const HERMES = {
+    version: '250829098.0.17',
+    sha256: '2967ee51b41bd433b3027dda875e96194354e2b4d715f9f186fd0c04ccef309d',
+    license: 'MIT',
+};
+
+export const hermesUrl = (version) => `https://repo1.maven.org/maven2/com/facebook/hermes/hermes-ios/${version}/hermes-ios-${version}-hermes-ios-release.tar.gz`;
+
+export const hermesDir = () => path.join(os.homedir(), '.crossbind', 'hermes', HERMES.version);
+
+// The release's destroot, downloaded once and checked against the pinned sha256.
+export default async function resolveHermes() {
+    const dir = hermesDir();
+    fs.mkdirSync(path.dirname(dir), { recursive: true });
+    await withDirLock(`${dir}.lock`, () => downloadAndExtractFile(hermesUrl(HERMES.version), dir, HERMES.sha256));
+    return `${dir}/source/destroot`;
+}
+
+// Linux and Windows have no published Hermes, so crossbind's linux and windows images build the release's source, with
+// their static libc++: JSI hands std types across, and the host and the project's archives build there too.
+export const HERMES_SOURCE = {
+    url: `https://github.com/facebook/hermes/archive/refs/tags/hermes-v${HERMES.version}.tar.gz`,
+    sha256: '37e91915c67ce0c457f69b2de00fcaf28fcf755ab7de6e4f33f1d6ee9efcffed',
+};
+
+// Android's Hermes is React Native's AAR, which an app's Gradle build takes for the libraries it packages, and which
+// crossbind's android-app image holds, with its headers and hermesc, for the app's host.
+export const HERMES_ANDROID = {
+    url: `https://repo1.maven.org/maven2/com/facebook/hermes/hermes-android/${HERMES.version}/hermes-android-${HERMES.version}-release.aar`,
+    sha256: '6fb440b29aadb5925bed1109338da61623c54c3508020bb2cecebcaaa80e53b8',
+};

package/src/utils/plist.js

@@ -0,0 +1,42 @@
+// Property lists as Apple's tools read them: XML for an Info.plist, the older text form for an Xcode project.
+
+const XML_INDENT = '    ';
+const escapeXml = (text) => String(text).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+
+function xmlLines(value, indent) {
+    if (typeof value === 'boolean') return [`${indent}<${value}/>`];
+    const inner = indent + XML_INDENT;
+    if (Array.isArray(value)) return [`${indent}<array>`, ...value.flatMap((item) => xmlLines(item, inner)), `${indent}</array>`];
+    if (typeof value === 'object') {
+        const entries = Object.entries(value);
+        if (entries.length === 0) return [`${indent}<dict/>`];
+        return [
+            `${indent}<dict>`,
+            ...entries.flatMap(([key, item]) => [`${inner}<key>${escapeXml(key)}</key>`, ...xmlLines(item, inner)]),
+            `${indent}</dict>`,
+        ];
+    }
+    return [`${indent}<string>${escapeXml(value)}</string>`];
+}
+
+export function xmlPlist(dict) {
+    return '<?xml version="1.0" encoding="UTF-8"?>\n'
+        + '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n'
+        + `<plist version="1.0">\n${xmlLines(dict, '').join('\n')}\n</plist>\n`;
+}
+
+// Every value of the text form is a string, quoted here whatever it holds.
+const quote = (text) => `"${String(text).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+
+function textValue(value, indent) {
+    const inner = `${indent}\t`;
+    if (Array.isArray(value)) return `(\n${value.map((item) => `${inner}${textValue(item, inner)},\n`).join('')}${indent})`;
+    if (typeof value === 'object') {
+        return `{\n${Object.entries(value).map(([key, item]) => `${inner}${quote(key)} = ${textValue(item, inner)};\n`).join('')}${indent}}`;
+    }
+    return quote(value);
+}
+
+export function textPlist(root) {
+    return `// !$*UTF8*$!\n${textValue(root, '')}\n`;
+}

package/src/utils/pullDockerImage.js

@@ -8,7 +8,11 @@ const table = createRequire(import.meta.url)('../assets/toolchain-digests.json')
 const REGISTRY = table.registry;
 const IMAGE_VERSION = table.version;
 const OVERRIDE_KEYS = {
-    web: 'CROSSBIND_IMAGE_WEB', android: 'CROSSBIND_IMAGE_ANDROID', linux: 'CROSSBIND_IMAGE_LINUX', windows: 'CROSSBIND_IMAGE_WINDOWS',
+    web: 'CROSSBIND_IMAGE_WEB',
+    android: 'CROSSBIND_IMAGE_ANDROID',
+    'android-app': 'CROSSBIND_IMAGE_ANDROID_APP',
+    linux: 'CROSSBIND_IMAGE_LINUX',
+    windows: 'CROSSBIND_IMAGE_WINDOWS',
 };
 const IMAGES = Object.fromEntries(
     Object.keys(OVERRIDE_KEYS).map((role) => [
@@ -21,9 +25,11 @@ const IMAGES = Object.fromEntries(
 );
 
 // Which image a target compiles in: wasm and wasi share the web image, linux and linuxmusl the linux
-// image, ios and darwin never reach docker.
+// image, ios and darwin never reach docker. An Android app builds in android-app, the android image with
+// what packages the app.
 export function imageRoleFor(target) {
-    if (target?.platform === 'android' || target?.platform === 'linux') return target.platform;
+    if (target?.platform === 'android') return target.runtimeEnv === 'app' ? 'android-app' : 'android';
+    if (target?.platform === 'linux') return 'linux';
     if (target?.platform === 'linuxmusl') return 'linux';
     if (target?.platform === 'win32') return 'windows';
     return 'web';

package/src/utils/replaceBasePathForDocker.js

@@ -1,5 +1,13 @@
+import path from 'node:path';
+
 export const DOCKER_BASE = '/tmp/crossbind/live';
 
+// Whether a container, which sees the project's base alone, sees dir.
+export function isUnderBase(dir, basePath) {
+    const relative = path.relative(basePath, path.resolve(dir));
+    return !/^\.\.(?:[\\/]|$)/.test(relative) && !path.isAbsolute(relative);
+}
+
 export default function replaceBasePathForDocker(data, basePath) {
     if (typeof data === 'string' || data instanceof String) {
         return data.replaceAll(basePath, DOCKER_BASE);

package/src/utils/resolveAppHost.js

@@ -0,0 +1,21 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import createCompanionResolver from './resolveCompanionPackage.js';
+
+const PKG = '@crossbind/core-app-host';
+
+const resolveAppHostRoot = createCompanionResolver({
+    pkg: PKG,
+    siblingDir: 'app-host',
+    siblingMarker: 'cpp/src/main.cpp',
+    missingMessage: `crossbind: apps need ${PKG} - add it to your devDependencies.`,
+});
+
+export default resolveAppHostRoot;
+
+// The embind runtime ships in @crossbind/core-embind-jsi, a dependency of the app host package.
+export function resolveAppEmbindJsiRoot() {
+    const req = createRequire(path.join(resolveAppHostRoot(), 'package.json'));
+    return path.dirname(fs.realpathSync(req.resolve('@crossbind/core-embind-jsi/package.json')));
+}

package/src/utils/selectRunner.js

@@ -7,7 +7,7 @@ const SYSTEM_CONFIG = '~/.crossbind.json';
 const SHARED = { key: 'REMOTE_URL', url: 'CROSSBIND_REMOTE_URL', token: 'CROSSBIND_TOKEN' };
 
 export const remoteVariables = (role) => {
-    const suffix = `_${role.toUpperCase()}`;
+    const suffix = `_${role.toUpperCase().replaceAll('-', '_')}`;
     return { key: `${SHARED.key}${suffix}`, url: `${SHARED.url}${suffix}`, token: `${SHARED.token}${suffix}` };
 };
 

package/src/utils/systemKeys.js

@@ -48,6 +48,10 @@ const systemKeys = {
         description: 'Image reference used for android builds instead of the pinned one. A reference without the release digest disables the reproducibility guarantee. The CROSSBIND_IMAGE_ANDROID environment variable overrides it.',
         default: '',
     },
+    DOCKER_IMAGE_ANDROID_APP: {
+        description: 'Image reference used for Android apps instead of the pinned one. A reference without the release digest disables the reproducibility guarantee. The CROSSBIND_IMAGE_ANDROID_APP environment variable overrides it.',
+        default: '',
+    },
     DOCKER_IMAGE_LINUX: {
         description: 'Image reference used for linux (Node.js addon) builds instead of the pinned one. A reference without the release digest disables the reproducibility guarantee. The CROSSBIND_IMAGE_LINUX environment variable overrides it.',
         default: '',

package/src/utils/targets.js

@@ -148,12 +148,17 @@ const BASE_TARGETS = [
     },
 ];
 
-// A native executable links the same archives as the Node-API addon of its platform and arch.
+// A native executable links the same archives as the Node-API addon of its platform and arch, and so does an app's
+// host on macOS, glibc Linux and Windows. An iOS or Android app links the archives React Native does, one target per
+// SDK or ABI.
 export const TARGETS = [
     ...BASE_TARGETS,
     ...BASE_TARGETS
         .filter((target) => target.runtimeEnv === 'node' && target.platform !== 'wasm')
         .map((target) => ({ ...target, runtimeEnv: 'native' })),
+    ...BASE_TARGETS
+        .filter((target) => (target.runtimeEnv === 'node' && ['darwin', 'linux', 'win32'].includes(target.platform)) || ['ios', 'android'].includes(target.platform))
+        .map((target) => ({ ...target, runtimeEnv: 'app' })),
 ];
 
 // Built only when named with -p: a plain `crossbind build` keeps producing what it did before
@@ -163,8 +168,8 @@ export const OPT_IN_PLATFORMS = ['darwin', 'linux', 'linuxmusl', 'win32'];
 // Built on the host itself: Apple's linker and SDKs exist in no toolchain image.
 export const HOST_BUILT_PLATFORMS = ['ios', 'darwin'];
 
-// The runtime environment names the binary a build makes; android and ios have none, since
-// React Native links them.
+// The runtime environment names the binary a build makes; on android and ios React Native links
+// the archives, and the app is the one binary.
 export const runtimeEnvsOf = (platform) => [
     ...new Set(TARGETS.filter((target) => target.platform === platform && target.runtimeEnv).map((target) => target.runtimeEnv)),
 ];
@@ -203,6 +208,17 @@ export const wasiNamesOf = (target, projectName) => ({
     wasmName: `${projectName}-${targetPathOf(target)}${target.runtimeEnv === 'http' ? '.http' : ''}.wasm`,
 });
 
+// One app per platform, arch and build type, and one page runtime per build type for all of them. A macOS app is a
+// bundle; a Linux app a directory; an iOS or Android one what its SDK or ABI brings to the app's Xcode or Gradle
+// project.
+export function appNamesOf(target, projectName) {
+    const suffix = target.buildType === 'debug' ? '.debug' : '';
+    return {
+        appName: `${projectName}.${target.platform}-${target.arch}${suffix}${target.platform === 'darwin' ? '.app' : ''}`,
+        appJsName: `${projectName}.app${suffix}.js`,
+    };
+}
+
 // One executable per platform, arch and build type, named like the addons it replaces.
 export function nativeCommandNamesOf(target, projectName) {
     const suffix = target.buildType === 'debug' ? '.debug' : '';

package/vitest.config.js

@@ -1,6 +1,11 @@
+import { fileURLToPath } from 'node:url';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
+    // The app host package's scripts import crossbind's runtime modules the way buildApp bundles them.
+    resolve: {
+        alias: [{ find: /^crossbind\/runtime\//, replacement: fileURLToPath(new URL('./src/assets/js-runtime/', import.meta.url)) }],
+    },
     // loadJs/loadConfig dynamically import config files written to os.tmpdir()
     // during tests. Vite 6 tightened server.fs.allow and rejects those out-of-root
     // paths ("Does the file exist?"); relax the fs check for the test runner.