crossbind 2.0.0-beta.64 → 2.0.0-beta.66

package/src/actions/createLib.js

@@ -11,6 +11,7 @@ import state from '../state/index.js';
 import logger from '../utils/logger.js';
 import { WASI_EMULATION_LIBS, WASI_LINK_LIBS, wasiCFlags, wasiCxxFlags } from '../utils/wasiToolchain.js';
 import { stageWasiHttpInclude, wasiHttpHeader } from '../utils/wasiHttp.js';
+import { appApiHeader, compilesAsApp, stageAppApiInclude } from '../utils/appApiHeader.js';
 import { getFilesFingerprint, getContentHash } from '../utils/hash.js';
 import { withDependencyBridges } from '../utils/dependencyBridges.js';
 import { targetArchiveFlags } from '../utils/archiveFlags.js';
@@ -63,7 +64,12 @@ export default function createLib(target, fileType, options = {}) {
     const httpHeader = target.platform === 'wasi' && !state.config.build.withBuildConfig
         ? getFilesFingerprint([wasiHttpHeader(state.config.paths.cli)])
         : null;
-    const flagsFingerprint = getContentHash(JSON.stringify(httpHeader ? [keyInputs, httpHeader] : keyInputs));
+    // An Android app links the project's archives from the build where React Native's shared library comes from.
+    const appArchives = target.platform === 'android' && target.runtimeEnv === 'app' ? 'archives' : null;
+    // An app's own code compiles against <crossbind/app.h>, with CROSSBIND_APP defined.
+    const appApi = compilesAsApp(target) ? getFilesFingerprint([appApiHeader()]) : null;
+    const extraKeys = [httpHeader, appArchives, appApi].filter(Boolean);
+    const flagsFingerprint = getContentHash(JSON.stringify(extraKeys.length ? [keyInputs, ...extraKeys] : keyInputs));
     const flagsChanged = !fs.existsSync(flagsFingerprintFile)
         || fs.readFileSync(flagsFingerprintFile, { encoding: 'utf8' }) !== flagsFingerprint;
 
@@ -149,10 +155,12 @@ export default function createLib(target, fileType, options = {}) {
             buildEnv.params.push('-e', e);
         });
     } else {
-        // The source of an http build includes <crossbind/http.h>.
-        const headerDirs = target.platform === 'wasi'
-            ? [...(options.headerDirs ?? []), stageWasiHttpInclude(state.config.paths.cli, `${buildPath}/crossbind-wasi-http`)]
-            : options.headerDirs;
+        // The source of an http build includes <crossbind/http.h>, and an app's own code <crossbind/app.h>.
+        const headerDirs = [
+            ...(options.headerDirs ?? []),
+            ...(target.platform === 'wasi' ? [stageWasiHttpInclude(state.config.paths.cli, `${buildPath}/crossbind-wasi-http`)] : []),
+            ...(compilesAsApp(target) ? [stageAppApiInclude(`${buildPath}/crossbind-app`)] : []),
+        ];
         buildParams = getCmakeParameters(target, { ...options, nativeGlob, headerDirs });
 
         triggerExtensions('createLib', 'setFlagWithoutBuildConfig', [buildEnv]);

package/src/actions/getCmakeParameters.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import state from '../state/index.js';
 import getData from './getData.js';
+import { compilesAsApp } from '../utils/appApiHeader.js';
 
 export default function getCmakeParameters(target, options = {}) {
     if (!options || typeof options !== 'object' || Array.isArray(options)) {
@@ -32,11 +33,14 @@ export default function getCmakeParameters(target, options = {}) {
         ...(options.headerDirs || []),
     ];
 
+    // React Native loads a library on Android as a shared one; an app's host links the project's archives into itself.
     const sharedPlatforms = ['android'];
-    const buildType = sharedPlatforms.includes(target.platform) ? 'SHARED' : 'STATIC';
+    const buildType = sharedPlatforms.includes(target.platform) && target.runtimeEnv !== 'app' ? 'SHARED' : 'STATIC';
     const otherBuildType = buildType === 'STATIC' ? 'SHARED' : 'STATIC';
 
-    const cmakeCompileOptions = [...new Set(getData('cmake', target)?.compileOptions || [])];
+    // An app's own code can tell it is one, to reach <crossbind/app.h>.
+    const appOptions = compilesAsApp(target) ? ['-DCROSSBIND_APP'] : [];
+    const cmakeCompileOptions = [...new Set([...(getData('cmake', target)?.compileOptions || []), ...appOptions])];
 
     params.push(...[
         `-DPROJECT_NAME=${options.name || state.config.general.name}`,

package/src/actions/getDependLibs.js

@@ -11,9 +11,15 @@ export default function getDependLibs(target) {
             const ignoreLibNames = getFilteredTargetSpec(d?.targetSpecs, target).map(s => s.ignoreLibName).flat();
             d.export.libName.forEach((fileName) => {
                 if (ignoreLibNames?.includes(fileName)) return;
-                let libPaths = findFiles(`${d.paths.output}/prebuilt/${target.path}/lib/lib${fileName}.a`, { cwd: d.paths.project });
+                // On Android a package ships the shared library React Native packages, which an app carries beside
+                // its host.
+                const extensions = target.platform === 'android' ? ['a', 'so'] : ['a'];
+                const libsIn = (targetPath) => extensions
+                    .map((extension) => findFiles(`${d.paths.output}/prebuilt/${targetPath}/lib/lib${fileName}.${extension}`, { cwd: d.paths.project }))
+                    .find((found) => found.length > 0) ?? [];
+                let libPaths = libsIn(target.path);
                 if (libPaths.length === 0) {
-                    libPaths = findFiles(`${d.paths.output}/prebuilt/${target.releasePath}/lib/lib${fileName}.a`, { cwd: d.paths.project });
+                    libPaths = libsIn(target.releasePath);
                 }
                 dependLibs.push(...libPaths);
             });

package/src/actions/getLinkInputs.js

@@ -3,20 +3,23 @@ import getDependLibs from './getDependLibs.js';
 import state from '../state/index.js';
 import buildAppRustCrates from '../utils/appRustCrates.js';
 
-// The archives of a final link (wasm, Node-API addon or native executable) and which of them must
+// The archives of a final link (wasm, Node-API addon, native executable or app host) and which of them must
 // survive whole. keepFlag spells "keep this symbol" for the target's linker; a native executable
-// binds nothing, so it links no bridge.
-export default function getLinkInputs(target, { keepFlag, withBridge = true }) {
+// binds nothing, so it links no bridge. An app host's bridges compile against another JSI, in an archive of their own.
+export default function getLinkInputs(target, { keepFlag, withBridge = true, bridge = 'Bridge' }) {
     const buildType = target.buildType === 'release' ? 'Release' : 'Debug';
     const { build, output, cache } = state.config.paths;
     const { name } = state.config.general;
 
     // buildLib's cache is keyed on paths.output/prebuilt; after a cache clean the
     // build-dir copy can be gone while the output artifact is still valid — link it then.
-    const sourceLibCandidates = [
-        `${build}/Source-${buildType}/${target.path}/lib${name}.a`,
-        `${output}/prebuilt/${target.path}/lib/lib${name}.a`,
+    // An Xcode build (iOS) leaves its archive in the install tree alone.
+    const builtLib = (prefix) => [
+        `${build}/${prefix}-${buildType}/${target.path}/lib${name}.a`,
+        `${build}/${prefix}-${buildType}/prebuilt/${target.path}/lib/lib${name}.a`,
     ];
+    const sourceLibCandidates = [...builtLib('Source'), `${output}/prebuilt/${target.path}/lib/lib${name}.a`];
+    const bridgeLibCandidates = builtLib(bridge);
     // App-local Rust surfaces (imported .rs files) arrive as ONE super staticlib; it is the
     // single fully-loaded Rust archive of the link (see the libstd rule below).
     const appRustLibs = buildAppRustCrates(target, cache, state.config.cargoDependencies ?? {});
@@ -24,7 +27,7 @@ export default function getLinkInputs(target, { keepFlag, withBridge = true }) {
         ...getDependLibs(target),
         ...appRustLibs,
         sourceLibCandidates.find((lib) => fs.existsSync(lib)) ?? sourceLibCandidates[0],
-        ...(withBridge ? [`${build}/Bridge-${buildType}/${target.path}/lib${name}.a`] : []),
+        ...(withBridge ? [bridgeLibCandidates.find((lib) => fs.existsSync(lib)) ?? bridgeLibCandidates[0]] : []),
     ];
 
     // By default only the Bridge archive is kept whole (see linkLayout.js) so the linker

package/src/actions/gradleProject.js

@@ -0,0 +1,171 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import state from '../state/index.js';
+import { ANDROID_API_LEVEL } from '../utils/androidToolchain.js';
+import { HERMES } from '../utils/hermes.js';
+import resolveAppHostRoot from '../utils/resolveAppHost.js';
+import { SIGNING } from './androidGradle.js';
+
+// The ABIs an Android app builds for: phones and Apple silicon's emulators, and the emulators of x86_64 machines.
+export const ANDROID_ABIS = ['arm64-v8a', 'x86_64'];
+// The Android release the app is compiled against and declares it was tested on.
+const TARGET_SDK = 36;
+export const ANDROIDX_WEBKIT = '1.17.1';
+
+const groovyString = (text) => `'${text.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+
+// The launcher shapes an adaptive icon: the app's icon in the middle of a white square.
+const ADAPTIVE_ICON = `<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+    <background android:drawable="@android:color/white" />
+    <foreground android:drawable="@mipmap/ic_launcher_foreground" />
+</adaptive-icon>
+`;
+
+const DAY_NIGHT = '@android:style/Theme.DeviceDefault.DayNight';
+// The activity's theme shows app.window.backgroundColor until the page paints, and the activity puts it behind the page,
+// whose WebView would be white; transparent, which the activity takes for none, without it.
+const backgroundValues = (color) => `<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="crossbind_background">${color ?? '#00000000'}</color>
+    <style name="CrossbindBackground" parent="${DAY_NIGHT}">
+        <item name="android:windowBackground">@color/crossbind_background</item>
+    </style>
+</resources>
+`;
+
+// The Android permissions behind each of app.permissions, after the one every app asks for; the activity asks its user
+// for them when the page first uses the device.
+const INTERNET = '    <uses-permission android:name="android.permission.INTERNET" />';
+const ANDROID_PERMISSIONS = {
+    camera: ['CAMERA'],
+    microphone: ['RECORD_AUDIO', 'MODIFY_AUDIO_SETTINGS'],
+    location: ['ACCESS_COARSE_LOCATION', 'ACCESS_FINE_LOCATION'],
+};
+const usesPermissions = (permissions) => permissions
+    .flatMap((name) => ANDROID_PERMISSIONS[name])
+    .map((permission) => `    <uses-permission android:name="android.permission.${permission}" />`);
+
+// The links of app.urlSchemes the activity opens, from a browser as well, before the end of the activity's element.
+const ACTIVITY_END = '        </activity>';
+const urlFilter = (schemes) => [
+    '            <intent-filter>',
+    '                <action android:name="android.intent.action.VIEW" />',
+    '                <category android:name="android.intent.category.DEFAULT" />',
+    '                <category android:name="android.intent.category.BROWSABLE" />',
+    ...schemes.map((scheme) => `                <data android:scheme="${scheme}" />`),
+    '            </intent-filter>',
+].join('\n');
+
+const buildGradle = ({ id, label, version, abis, icon, launchMode, theme }) => `// crossbind writes this project anew on every build: the module comes prebuilt in src/main/jniLibs/, and the app's
+// files are in src/main/assets/app/.
+plugins {
+    id 'com.android.application'
+}
+
+android {
+    namespace 'dev.crossbind.app'
+    compileSdk ${TARGET_SDK}
+
+    defaultConfig {
+        applicationId ${groovyString(id)}
+        // The module's libraries are built against this API level.
+        minSdk ${ANDROID_API_LEVEL}
+        targetSdk ${TARGET_SDK}
+        versionCode ${version.code}
+        versionName ${groovyString(version.name)}
+        manifestPlaceholders = [appName: ${groovyString(label)}, appIcon: ${groovyString(icon)}, launchMode: ${groovyString(launchMode)}, appTheme: ${groovyString(theme)}]
+        ndk {
+            abiFilters ${abis.map(groovyString).join(', ')}
+        }
+    }
+
+    // A release is signed with the upload key crossbind's environment names, else with the debug key.
+    signingConfigs {
+        release {
+            def keystore = System.getenv('${SIGNING.keystore}')
+            if (keystore) {
+                storeFile file(keystore)
+                storePassword System.getenv('${SIGNING.password}')
+                keyAlias System.getenv('${SIGNING.alias}')
+                keyPassword System.getenv('${SIGNING.keyPassword}') ?: System.getenv('${SIGNING.password}')
+            }
+        }
+    }
+
+    buildTypes {
+        release {
+            signingConfig System.getenv('${SIGNING.keystore}') ? signingConfigs.release : signingConfigs.debug
+        }
+    }
+
+    // Release builds skip lint's vital checks, whose tools crossbind's android-app image leaves out: the module's code is
+    // crossbind's own.
+    lint {
+        checkReleaseBuilds false
+    }
+
+    packaging {
+        jniLibs {
+            // Hermes brings fbjni, and with it an older libc++_shared.so; the module's is the NDK's it was built with.
+            pickFirsts += ['**/libc++_shared.so']
+            // The libraries come stripped, and stripping them again would take an NDK of the plugin's own.
+            keepDebugSymbols += ['**/*.so']
+        }
+    }
+
+    // The page keeps all its files, an _app directory or a .well-known one among them, which Android leaves out by default.
+    androidResources {
+        ignoreAssetsPattern = '!.svn:!.git:!.ds_store:!*.scc:!CVS:!thumbs.db:!picasa.ini:!*~'
+    }
+
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
+    }
+}
+
+dependencies {
+    // Hermes' release build in every variant: it is the one the host links against.
+    implementation('com.facebook.hermes:hermes-android:${HERMES.version}') {
+        attributes {
+            attribute(com.android.build.api.attributes.BuildTypeAttr.ATTRIBUTE, objects.named(com.android.build.api.attributes.BuildTypeAttr, 'release'))
+        }
+    }
+    implementation 'androidx.webkit:webkit:${ANDROIDX_WEBKIT}'
+}
+`;
+
+// An Android app as a Gradle project, written anew from the parts its ABI targets built: each brings its libraries,
+// the first also the app's files. Gradle adds Hermes and androidx.webkit from Maven, and makes the APK or the bundle.
+// The icons given are the files of the app's launcher icon under res/; without them it has the system's.
+export default function writeGradleProject(to, { parts, id, label, version, icons = null, urlSchemes = [], background = null, permissions = [] }) {
+    const { name } = state.config.general;
+    if (parts.length === 0) throw new Error(`crossbind: no part of the Android app ${name} is built, so there is no Gradle project to write.`);
+    fs.rmSync(to, { recursive: true, force: true });
+    fs.cpSync(path.join(resolveAppHostRoot(), 'android'), to, { recursive: true });
+    const main = path.join(to, 'app', 'src', 'main');
+    const manifest = path.join(main, 'AndroidManifest.xml');
+    const text = fs.readFileSync(manifest, 'utf8');
+    if (!text.includes(ACTIVITY_END) || !text.includes(INTERNET)) {
+        throw new Error(`crossbind: ${manifest}, from the app host, has no activity or permissions to give app.urlSchemes and app.permissions: update @crossbind/core-app-host to match crossbind.`);
+    }
+    fs.writeFileSync(manifest, text
+        .replace(INTERNET, [INTERNET, ...usesPermissions(permissions)].join('\n'))
+        .replace(ACTIVITY_END, urlSchemes.length > 0 ? `${urlFilter(urlSchemes)}\n${ACTIVITY_END}` : ACTIVITY_END));
+    parts.forEach(({ arch, dir }) => fs.cpSync(path.join(dir, 'lib'), path.join(main, 'jniLibs', arch), { recursive: true }));
+    fs.cpSync(path.join(parts[0].dir, 'app'), path.join(main, 'assets', 'app'), { recursive: true });
+    if (icons) {
+        Object.entries({ ...icons, 'mipmap-anydpi/ic_launcher.xml': ADAPTIVE_ICON }).forEach(([file, content]) => {
+            fs.mkdirSync(path.dirname(path.join(main, 'res', file)), { recursive: true });
+            fs.writeFileSync(path.join(main, 'res', file), content);
+        });
+    }
+    fs.mkdirSync(path.join(main, 'res', 'values'), { recursive: true });
+    fs.writeFileSync(path.join(main, 'res', 'values', 'background.xml'), backgroundValues(background));
+    fs.writeFileSync(path.join(to, 'app', 'build.gradle'), buildGradle({
+        id, label, version, abis: parts.map(({ arch }) => arch), icon: icons ? '@mipmap/ic_launcher' : '@android:drawable/sym_def_app_icon',
+        launchMode: urlSchemes.length > 0 ? 'singleTask' : 'standard', theme: background ? '@style/CrossbindBackground' : DAY_NIGHT,
+    }));
+    return to;
+}

package/src/actions/iosSimulator.js

@@ -0,0 +1,63 @@
+import { spawn, spawnSync } from 'node:child_process';
+import { EXEC_MAX_BUFFER } from './run.js';
+import state from '../state/index.js';
+import logger from '../utils/logger.js';
+
+let hasToldNoWindow = false;
+
+function tool(program, args) {
+    const result = spawnSync(program, args, { encoding: 'utf8', maxBuffer: EXEC_MAX_BUFFER });
+    if (result.status !== 0) {
+        throw new Error(`crossbind: ${program} ${args.join(' ')} failed: ${`${result.stdout ?? ''}${result.stderr ?? ''}`.trim() || result.error?.message}`);
+    }
+    return result.stdout;
+}
+
+// Newer iOS first: 27.0 before 18.5.
+function byNewerIos(a, b) {
+    const index = a.version.findIndex((part, i) => part !== b.version[i]);
+    return index === -1 ? 0 : (b.version[index] ?? 0) - a.version[index];
+}
+
+// The Simulator an app opens in: one already booted, or else an iPhone of the newest iOS, booted for it.
+function simulator() {
+    const { devices } = JSON.parse(tool('xcrun', ['simctl', 'list', 'devices', 'available', '--json']));
+    const all = Object.entries(devices)
+        .filter(([runtime]) => runtime.includes('.SimRuntime.iOS-'))
+        .flatMap(([runtime, list]) => list.map((device) => ({ ...device, version: runtime.split('.SimRuntime.iOS-')[1].split('-').map(Number) })));
+    const booted = all.find((device) => device.state === 'Booted');
+    if (booted) return booted.udid;
+    const [newest] = all.filter((device) => device.name.startsWith('iPhone')).sort(byNewerIos);
+    if (!newest) throw new Error('crossbind: no iPhone Simulator is installed. Add the iOS platform in Xcode, under Settings > Components.');
+    tool('xcrun', ['simctl', 'boot', newest.udid]);
+    tool('xcrun', ['simctl', 'bootstatus', newest.udid, '-b']);
+    return newest.udid;
+}
+
+// Builds an iOS app's Xcode project for the Simulator, and returns the app.
+export function buildForSimulator(project, configuration = 'Release') {
+    const { name } = state.config.general;
+    const products = `${state.config.paths.build}/xcode`;
+    tool('xcodebuild', ['-project', `${project}/${name}.xcodeproj`, '-configuration', configuration, '-sdk', 'iphonesimulator',
+        `SYMROOT=${products}`, '-quiet', 'build']);
+    return `${products}/${configuration}-iphonesimulator/${name}.app`;
+}
+
+// Opens a Simulator build of an iOS app, with `env` in its environment. The process returned carries the app's output
+// and ends with the app; close() ends the app.
+export default function openInSimulator(app, { env = {}, show = false, stdio = 'pipe' } = {}) {
+    const device = simulator();
+    // Simulator.app only shows the device, which runs the app without it as well.
+    if (show && spawnSync('open', ['-b', 'com.apple.iphonesimulator']).status !== 0 && !hasToldNoWindow) {
+        hasToldNoWindow = true;
+        logger.info('crossbind: Simulator.app is not installed, so the Simulator shows no window; the app runs in it all the same.');
+    }
+    tool('xcrun', ['simctl', 'install', device, app]);
+    const bundleId = tool('plutil', ['-extract', 'CFBundleIdentifier', 'raw', '-o', '-', `${app}/Info.plist`]).trim();
+    const childEnv = { ...process.env };
+    Object.entries(env).forEach(([key, value]) => {
+        childEnv[`SIMCTL_CHILD_${key}`] = value;
+    });
+    const child = spawn('xcrun', ['simctl', 'launch', '--console-pty', '--terminate-running-process', device, bundleId], { env: childEnv, stdio });
+    return { child, close: () => spawnSync('xcrun', ['simctl', 'terminate', device, bundleId]) };
+}

package/src/actions/licenses.js

@@ -8,6 +8,11 @@ import familyManifestOf from '../utils/familyManifest.js';
 import { wasiToolchainIdentity } from '../utils/provenance.js';
 import { resolveWasiSdkPath } from '../utils/wasiToolchain.js';
 import resolveEmbindNapiRoot, { resolveEmbindJsiRoot } from '../utils/resolveEmbindNapi.js';
+import resolveAppHostRoot, { resolveAppEmbindJsiRoot } from '../utils/resolveAppHost.js';
+import {
+    HERMES, HERMES_ANDROID, HERMES_SOURCE, hermesUrl,
+} from '../utils/hermes.js';
+import { ANDROIDX_WEBKIT } from './gradleProject.js';
 import { shippedBundledLicense } from '../utils/bundledLicenses.js';
 import toolchainNoticesDir from '../utils/toolchainNotices.js';
 
@@ -103,7 +108,7 @@ function wasiToolchainRows() {
     ];
 }
 
-// The notices a build copied out of its toolchain image (buildNode does it for Windows addons).
+// The notices a build copied out of its toolchain image (a Windows addon's or app's does).
 function toolchainNoticeTexts(platform) {
     const build = state.config?.paths?.build;
     const dir = build ? path.join(build, toolchainNoticesDir(platform)) : null;
@@ -130,33 +135,32 @@ function addonToolchainRows(platform) {
     };
     const llvmText = 'license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT';
     if (platform === 'linux' || platform === 'linuxmusl') {
-        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the addon; ${llvmText}` }];
+        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the binary; ${llvmText}` }];
     }
     const mingwLicense = 'LicenseRef-MinGW-w64-runtime';
     return [
-        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the addon; ${llvmText}` },
+        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the binary; ${llvmText}` },
         {
             ...shared,
             name: 'mingw-w64-runtime',
             license: mingwLicense,
             licenseDeclared: mingwLicense,
             sourceUrl: 'https://github.com/mingw-w64/mingw-w64',
-            licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the addon; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
+            licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the binary; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
             licenseText: toolchainNoticeTexts('win32'),
         },
     ];
 }
 
-// A Node-API addon compiles in crossbind's runtime: embind-jsi, which adapts Emscripten's embind,
-// and node-api-jsi. The loader bundles the JavaScript half of the same runtime.
-function nodeRuntimeRows({ isAddon }) {
-    const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
-    const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
+const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
+const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
+
+// crossbind's runtime, which an addon and an app host compile in: embind-jsi, which adapts Emscripten's embind.
+function runtimeRows(jsiRoot, notes) {
     const shared = {
         nativeVersion: null, sha256: null, licenseSelected: null, isCopyleft: false,
     };
-    const jsiRoot = resolveEmbindJsiRoot();
-    const rows = [
+    return [
         {
             ...shared,
             name: 'crossbind',
@@ -165,7 +169,7 @@ function nodeRuntimeRows({ isAddon }) {
             license: 'MIT',
             licenseDeclared: 'MIT',
             sourceUrl: 'https://github.com/crossbind/crossbind',
-            licenseNotes: 'the embind-jsi and embind-napi runtime and the bindings crossbind generates',
+            licenseNotes: notes,
             licenseText: textOf(path.join(CROSSBIND_ROOT, 'LICENSE')),
         },
         {
@@ -180,10 +184,19 @@ function nodeRuntimeRows({ isAddon }) {
             licenseText: textOf(path.join(jsiRoot, 'LICENSE')),
         },
     ];
+}
+
+// A Node-API addon compiles in crossbind's runtime and node-api-jsi. The loader bundles the JavaScript half of the
+// same runtime.
+function nodeRuntimeRows({ isAddon }) {
+    const rows = runtimeRows(resolveEmbindJsiRoot(), 'the embind-jsi and embind-napi runtime and the bindings crossbind generates');
     if (!isAddon) return rows;
     const napiRoot = resolveEmbindNapiRoot();
     return [...rows, {
-        ...shared,
+        nativeVersion: null,
+        sha256: null,
+        licenseSelected: null,
+        isCopyleft: false,
         name: 'node-api-jsi',
         npmName: '@crossbind/core-embind-napi',
         version: versionOf(napiRoot),
@@ -195,6 +208,166 @@ function nodeRuntimeRows({ isAddon }) {
     }];
 }
 
+// What an app's host carries beside crossbind's runtime, pinned as the third_party READMEs of @crossbind/core-app-host
+// record: React Native's Hermes, JSI's jsi.cpp from the same release, webview/webview, and on Windows the WebView2 SDK's
+// headers.
+const WEBVIEW = { version: 'cbbdee44afff22867de9fd88a9fc8350d9bdd399', sha256: '10e972a2327b5681474f4aa4499e505eaa4ff659aa995380386f08fd6fc1b763' };
+const WEBVIEW2_SDK = { version: '1.0.4258.31', sha256: '56f7f4b8bf9aee4b8efefbbdd4f67d5f74ebd1b100ed0806da71bf76af481aa9' };
+const JSI_SHA256 = 'cb6274a22abc93ecc970066539815e716d3e47716e8f93a9971cf4eb5918ffc1';
+const MONOCYPHER = { version: '4.0.3', sha256: '8cc9bc341a66249016db9bd70e9142d8d0aef9945973744b1ac05dbc55d8ee66' };
+// The fbjni the Hermes release for Android depends on.
+const FBJNI_VERSION = '0.7.0';
+
+const HERMES_BUILDS = {
+    linux: {
+        sha256: HERMES_SOURCE.sha256,
+        sourceUrl: HERMES_SOURCE.url,
+        licenseNotes: "Hermes built from its release's source in the linux toolchain image, statically linked into the host",
+    },
+    win32: {
+        sha256: HERMES_SOURCE.sha256,
+        sourceUrl: HERMES_SOURCE.url,
+        licenseNotes: "Hermes built from its release's source in the windows toolchain image (llvm-mingw), statically linked into the host",
+    },
+    android: {
+        sha256: HERMES_ANDROID.sha256,
+        sourceUrl: HERMES_ANDROID.url,
+        licenseNotes: "React Native's Hermes for Android, whose libraries the app's Gradle build takes from Maven Central",
+    },
+};
+
+// What an Android app's Gradle build adds from Maven, and the C++ runtime the app carries beside its host.
+function androidAppRows() {
+    const shared = {
+        npmName: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
+    };
+    const apache = { ...shared, license: 'Apache-2.0', licenseDeclared: 'Apache-2.0' };
+    const llvmLicense = 'Apache-2.0 WITH LLVM-exception';
+    return [
+        {
+            ...apache,
+            name: 'fbjni',
+            version: FBJNI_VERSION,
+            nativeVersion: FBJNI_VERSION,
+            sourceUrl: 'https://github.com/facebookincubator/fbjni',
+            licenseNotes: 'libfbjni.so, which Hermes loads and Gradle takes with it; license text: https://github.com/facebookincubator/fbjni/blob/main/LICENSE',
+        },
+        {
+            ...apache,
+            name: 'androidx-webkit',
+            version: ANDROIDX_WEBKIT,
+            nativeVersion: ANDROIDX_WEBKIT,
+            sourceUrl: 'https://developer.android.com/jetpack/androidx/releases/webkit',
+            licenseNotes: "androidx.webkit, the WebView's message ports and start scripts, from Google's Maven repository; license text: https://www.apache.org/licenses/LICENSE-2.0.txt",
+        },
+        {
+            ...shared,
+            name: 'llvm-runtimes',
+            version: null,
+            nativeVersion: null,
+            license: llvmLicense,
+            licenseDeclared: llvmLicense,
+            sourceUrl: 'https://github.com/llvm/llvm-project',
+            licenseNotes: "libc++ of the android image's NDK, which the app carries as libc++_shared.so; license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT",
+        },
+    ];
+}
+
+// The WebView2 SDK headers a Windows host compiles against, and the NSIS its setup program carries. webview/webview
+// loads the WebView2 Runtime itself, without the SDK's loader.
+function windowsAppRows(hostRoot) {
+    const license = 'BSD-3-Clause';
+    return [{
+        npmName: '@crossbind/core-app-host',
+        name: 'webview2-sdk',
+        version: WEBVIEW2_SDK.version,
+        nativeVersion: WEBVIEW2_SDK.version,
+        sha256: WEBVIEW2_SDK.sha256,
+        license,
+        licenseDeclared: license,
+        licenseSelected: null,
+        isCopyleft: false,
+        sourceUrl: `https://api.nuget.org/v3-flatcontainer/microsoft.web.webview2/${WEBVIEW2_SDK.version}/microsoft.web.webview2.${WEBVIEW2_SDK.version}.nupkg`,
+        licenseNotes: "the WebView2 SDK's headers from the windows toolchain image, whose interface IDs the host compiles in",
+        licenseText: textOf(path.join(hostRoot, 'third_party', 'webview2', 'LICENSE')),
+    }, {
+        npmName: '@crossbind/core-app-host',
+        name: 'nsis',
+        version: '3.11',
+        nativeVersion: '3.11',
+        sha256: null,
+        license: 'Zlib AND MIT',
+        licenseDeclared: 'Zlib AND MIT',
+        licenseSelected: null,
+        isCopyleft: false,
+        sourceUrl: 'https://sources.debian.org/src/nsis/3.11-1/',
+        licenseNotes: "the installer stub and plugins the app's setup program carries, from Debian's nsis in the windows toolchain image: zlib/libpng, but for the System plugin's Call.S, MIT",
+        licenseText: textOf(path.join(hostRoot, 'third_party', 'nsis', 'LICENSE')),
+    }];
+}
+
+function appRuntimeRows(platform) {
+    const hostRoot = resolveAppHostRoot();
+    const hermesLicense = textOf(path.join(hostRoot, 'third_party', 'jsi', 'LICENSE'));
+    const mit = {
+        npmName: '@crossbind/core-app-host', license: 'MIT', licenseDeclared: 'MIT', licenseSelected: null, isCopyleft: false,
+    };
+    const hermes = HERMES_BUILDS[platform] ?? {
+        sha256: HERMES.sha256,
+        sourceUrl: hermesUrl(HERMES.version),
+        licenseNotes: "React Native's Hermes for Apple platforms, which the app carries as hermesvm.framework",
+    };
+    return [
+        ...runtimeRows(resolveAppEmbindJsiRoot(), 'the embind-jsi runtime, the app host and the bindings crossbind generates'),
+        {
+            ...mit,
+            ...hermes,
+            name: 'hermes',
+            version: HERMES.version,
+            nativeVersion: HERMES.version,
+            licenseText: hermesLicense,
+        },
+        {
+            ...mit,
+            name: 'jsi',
+            version: HERMES.version,
+            nativeVersion: HERMES.version,
+            sha256: JSI_SHA256,
+            sourceUrl: 'https://github.com/facebook/hermes',
+            licenseNotes: "JSI's jsi.cpp from the same Hermes release, compiled into the host",
+            licenseText: hermesLicense,
+        },
+        ...(platform === 'android' ? androidAppRows() : []),
+        ...(platform === 'win32' ? windowsAppRows(hostRoot) : []),
+        // A mobile app makes its window with UIKit or an Android activity, without webview/webview.
+        ...(['ios', 'android'].includes(platform) ? [] : [{
+            ...mit,
+            name: 'webview',
+            version: WEBVIEW.version,
+            nativeVersion: WEBVIEW.version,
+            sha256: WEBVIEW.sha256,
+            sourceUrl: 'https://github.com/webview/webview',
+            licenseNotes: 'webview/webview, with the local patch @crossbind/core-app-host lists',
+            licenseText: textOf(path.join(hostRoot, 'third_party', 'webview', 'LICENSE')),
+        }]),
+        // A desktop host checks its updates with Monocypher, which the linker leaves out of one without app.updater.
+        ...(['ios', 'android'].includes(platform) || state.config.app?.updater === undefined ? [] : [{
+            npmName: '@crossbind/core-app-host',
+            name: 'monocypher',
+            version: MONOCYPHER.version,
+            nativeVersion: MONOCYPHER.version,
+            sha256: MONOCYPHER.sha256,
+            license: 'BSD-2-Clause OR CC0-1.0',
+            licenseDeclared: 'BSD-2-Clause OR CC0-1.0',
+            licenseSelected: null,
+            isCopyleft: false,
+            sourceUrl: `https://monocypher.org/download/monocypher-${MONOCYPHER.version}.tar.gz`,
+            licenseNotes: "Monocypher's Ed25519 and SHA-512, compiled into the host, which check the app's updates",
+            licenseText: textOf(path.join(hostRoot, 'third_party', 'monocypher', 'LICENCE.md')),
+        }]),
+    ];
+}
+
 async function buildRow(node) {
     const recipe = await loadJs(node.paths.project, 'crossbind.build');
     const manifest = node.package || null;
@@ -284,7 +457,8 @@ function assertConanStaged() {
 // platform (optional, e.g. 'wasi') additionally includes what that platform's
 // artifact statically links beyond the package graph: recipe-declared vendored
 // copies and the toolchain runtime. runtimeEnv 'node' adds the crossbind runtime an
-// addon of that platform compiles in, or without a platform the one its loader bundles.
+// addon of that platform compiles in, or without a platform the one its loader bundles;
+// runtimeEnv 'app' adds what an app's host carries.
 export default async function collectLicenseRows(platform = null, { runtimeEnv = null } = {}) {
     assertConanStaged();
     // The root package is a component too when it is a port: leaf -wasi packages have no deps but ship
@@ -310,5 +484,6 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
     if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
     if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
+    if (runtimeEnv === 'app') rows.push(...appRuntimeRows(platform));
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }