crossbind 2.0.0-beta.68 → 2.0.0-beta.69

package/src/actions/buildApp.js

@@ -1,7 +1,6 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { rollup } from 'rollup';
 import { nodeResolve } from '@rollup/plugin-node-resolve';
@@ -20,8 +19,8 @@ import writeXcodeProject, { HERMES_SLICES, IOS_SDKS } from './xcodeProject.js';
 import writeGradleProject, { ANDROID_ABIS } from './gradleProject.js';
 import { attachedDevice } from './androidDevice.js';
 import { packageAndroidRelease } from './androidGradle.js';
-import writeInstaller, { assertUnderBase } from './appInstaller.js';
-import writeUpdate from './appUpdate.js';
+import { compileSwift, swiftLinkArgs } from './appSwift.js';
+import { unpackPackages } from './linuxPackages.js';
 import { APPLE_SIGNING, appleSigning, notarizeApp } from './appleSigning.js';
 import { WINDOWS_SIGNING, signWindows, windowsSigning } from './windowsSigning.js';
 import state from '../state/index.js';
@@ -30,10 +29,15 @@ import findFiles from '../utils/findFiles.js';
 import { getContentHash, getFilesFingerprint } from '../utils/hash.js';
 import { xmlPlist } from '../utils/plist.js';
 import {
-    appBackgroundColor, appCategory, appCopyright, appDisplayName, appEncryption, appHeader, appId, appPermissions, appPrivacy, appUrlSchemes,
-    usageDescriptions,
+    androidAppId, appBackgroundColor, appCategory, appCopyright, appDisplayName, appEncryption, appFiles, appHeader, appId, appPermissions, appPrivacy,
+    appUrlSchemes, iosAppGroup, iosMultipleWindows, urlSchemeOwners, usageDescriptions,
 } from '../utils/appOptions.js';
+import { carriedFilesOf, copyCarriedFiles } from '../utils/appFiles.js';
+import { activityTypeOwners, fileTypeOwners, linkOwners, macDocumentTypes, shortcutItemOwners } from '../utils/appLaunches.js';
 import { unreasonedApis, unreasonedWarning } from '../utils/requiredReasonApis.js';
+import {
+    appExtensionsOf, extensionCmakeArgs, extensionPart, mergedEntitlements, mergedPlist, mergedPrivacy, registrationSource,
+} from '../utils/appExtensions.js';
 import { androidIcons, iosIcon, linuxIcon, macIcon, readAppIcon, windowsIcon } from '../utils/appIcon.js';
 import writeIfChanged from '../utils/writeIfChanged.js';
 import { writeNativeSourceStamp } from '../utils/nativeSourceStamp.js';
@@ -41,8 +45,10 @@ import resetCMakeCacheForSource from '../utils/resetCMakeCacheForSource.js';
 import resolveAppHostRoot, { resolveAppEmbindJsiRoot } from '../utils/resolveAppHost.js';
 import resolveHermes, { HERMES } from '../utils/hermes.js';
 import { getDockerImage, imageRoleFor } from '../utils/pullDockerImage.js';
+import { isUnderBase } from '../utils/replaceBasePathForDocker.js';
 import { chosenRunner } from '../utils/selectRunner.js';
 import { DARWIN_DEPLOYMENT_TARGET } from '../utils/darwinToolchain.js';
+import extensionsInApp from './extensionsInApp.js';
 
 const cpuCount = Math.max(1, os.cpus().length - 1);
 const BRIDGE = 'AppBridge';
@@ -50,6 +56,17 @@ const LINUX_MULTIARCH = { x64: 'x86_64-linux-gnu', arm64: 'aarch64-linux-gnu' };
 // Where the android-app, linux and windows images keep the Hermes of the release crossbind pins.
 const IMAGE_HERMES = `/opt/crossbind/hermes/${HERMES.version}`;
 
+// What the app's extensions add to an app of this platform.
+const extensionsOf = (platform) => extensionPart(extensionsInApp(platform, (message) => console.warn(`crossbind: ${message}.`)), platform);
+
+// The App Group an iOS app shares with the targets of its extensions' that ask for one, or none; app.ios.appGroup is
+// checked all the same.
+function appGroupOf(platform, extensions) {
+    if (platform !== 'ios') return null;
+    const group = iosAppGroup(state.config);
+    return extensions.targets.some(({ appGroup }) => appGroup) ? group : null;
+}
+
 // Where an app keeps its executable and its files: a macOS bundle, a Linux or Windows directory, or the app folder of an
 // iOS app's Xcode project or of an Android app's Gradle project, which link the executable themselves.
 export function appLayout(target) {
@@ -123,24 +140,12 @@ export function appTeam() {
     return team;
 }
 
-// An Android application id: dot-separated parts of letters, digits and underscores that each start with a letter.
-const ANDROID_APP_ID = /^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/;
-
-// An Android app's id: the project's app.id, else one made from the project's name.
-export function androidAppId() {
-    const id = state.config.app.id ?? `dev.crossbind.${state.config.general.name.replace(/[^A-Za-z0-9.]/g, '_')}`;
-    if (!ANDROID_APP_ID.test(id)) {
-        throw new Error(`crossbind: ${JSON.stringify(id)} (app.id, else made from the project's name) is no Android application id, which takes dot-separated parts of letters, digits and underscores that each start with a letter, as com.example.app does. Set app.id in crossbind.config.js.`);
-    }
-    return id;
-}
-
 // Apple takes dot-separated integers alone as an app's version.
 export const appVersion = () => (state.config.package?.version ?? '1.0.0').replace(/[-+].*$/, '');
 
 const BUILD_NUMBER = 'CROSSBIND_APP_BUILD_NUMBER';
 // Google Play takes no larger version code.
-const MAX_VERSION_CODE = 2100000000;
+export const MAX_VERSION_CODE = 2100000000;
 
 // The number CI or a publish gives a build, which iOS takes as its build and Android as its version code:
 // CROSSBIND_APP_BUILD_NUMBER, a whole number both stores take, else none.
@@ -204,11 +209,16 @@ async function bundle(input, file, plugins) {
     await build.close();
 }
 
-// A development build claims no scheme: the built app, of the same id, owns them, and a link it opens shows its own page.
+// A development build claims no scheme, no file type and no user activity: the built app, of the same id, owns them, and
+// a link it opens shows its own page.
 const urlSchemesOf = (target) => (target.buildType === 'release' ? appUrlSchemes(state.config) : []);
+const fileTypesOf = (target) => (target.buildType === 'release' ? fileTypeOwners(state.config) : []);
+const activityTypesOf = (target) => (target.buildType === 'release' ? activityTypeOwners(state.config).map(({ type }) => type) : []);
 
-const infoPlist = (name, version, hasIcon, urlSchemes) => xmlPlist({
+// The app's Info.plist, with the keys its extensions give.
+const infoPlist = (name, version, hasIcon, urlSchemes, fileTypes, activityTypes) => xmlPlist(mergedPlist({
     CFBundleDisplayName: appDisplayName(state.config),
+    ...(fileTypes.length > 0 ? { CFBundleDocumentTypes: macDocumentTypes(fileTypes) } : {}),
     CFBundleExecutable: name,
     // Contents/Resources/icon.icns.
     ...(hasIcon ? { CFBundleIconFile: 'icon' } : {}),
@@ -224,8 +234,12 @@ const infoPlist = (name, version, hasIcon, urlSchemes) => xmlPlist({
     NSHighResolutionCapable: true,
     // The app menu's About item shows it.
     ...(appCopyright(state.config) ? { NSHumanReadableCopyright: appCopyright(state.config) } : {}),
+    ...(activityTypes.length > 0 ? { NSUserActivityTypes: activityTypes } : {}),
     ...usageDescriptions(state.config, 'darwin'),
-});
+}, extensionsOf('darwin').plist));
+
+// The app's own files, as app.files lists them, by the project's folder.
+const ownFiles = () => ({ root: state.config.paths.project, paths: appFiles(state.config) });
 
 // The host's bytecode and the data the packages ship, beside the page's folder.
 function copyAppFiles(dir, hbc, target) {
@@ -234,6 +248,7 @@ function copyAppFiles(dir, hbc, target) {
     Object.entries(getData('data', target)).forEach(([source, dataName]) => {
         if (fs.existsSync(source)) fs.cpSync(source, `${dir}/data/${dataName}`, { recursive: true });
     });
+    copyCarriedFiles(dir, extensionsOf(target.platform).files, ownFiles());
 }
 
 // Everything but the page: the host and the app's files, its icon, and on macOS Hermes beside them. A Windows host
@@ -248,7 +263,7 @@ function assembleApp(target, { executable, hbc, hermes, icon }) {
     copyAppFiles(`${app}/${layout.resources}`, hbc, target);
     if (target.platform === 'linux' && icon) fs.writeFileSync(`${app}/${layout.resources}/icon.png`, linuxIcon(icon));
     if (target.platform !== 'darwin') return;
-    fs.writeFileSync(`${app}/Contents/Info.plist`, infoPlist(name, appVersion(), Boolean(icon), urlSchemesOf(target)));
+    fs.writeFileSync(`${app}/Contents/Info.plist`, infoPlist(name, appVersion(), Boolean(icon), urlSchemesOf(target), fileTypesOf(target), activityTypesOf(target)));
     if (icon) fs.writeFileSync(`${app}/Contents/Resources/icon.icns`, macIcon(icon));
     const framework = `${app}/Contents/Frameworks/hermesvm.framework`;
     fs.cpSync(`${hermes}/Library/Frameworks/macosx/hermesvm.framework`, framework, { recursive: true, verbatimSymlinks: true });
@@ -301,20 +316,10 @@ const appParts = (target) => state.targets
     .filter((t) => t.platform === target.platform && t.runtimeEnv === 'app' && t.buildType === target.buildType && currentApps.has(t.appName))
     .map((t) => ({ arch: t.arch, dir: `${state.config.paths.build}/${t.appName}` }));
 
-// A Linux or Windows app also ships as one archive, next to its directory: a Windows one as a zip, made in the windows
-// image.
-function archiveApp(app, target) {
-    if (target.platform === 'win32') {
-        assertUnderBase(app, target);
-        fs.rmSync(`${app}.zip`, { force: true });
-        run(null, ['zip', '-q', '-r', '-X', `${path.basename(app)}.zip`, path.basename(app)], null, target, { workdir: path.dirname(app) });
-        return;
-    }
-    const result = spawnSync('tar', ['-czf', `${app}.tar.gz`, '-C', path.dirname(app), path.basename(app)], {
-        encoding: 'utf8',
-        env: { ...process.env, COPYFILE_DISABLE: '1' },
-    });
-    if (result.status !== 0) throw new Error(`crossbind: cannot archive ${app}: ${result.stderr || result.error?.message}`);
+// The container that signs a Windows app sees the project's base alone.
+function assertUnderBase(app, target) {
+    if (isUnderBase(app, state.config.paths.base)) return;
+    throw new Error(`crossbind: the Windows app ${app} is outside ${state.config.paths.base}, the project's base and all the ${imageRoleFor(target)} container sees. Build the app into a directory under it.`);
 }
 
 const ENTITLEMENTS = {
@@ -329,10 +334,12 @@ const ENTITLEMENTS = {
 function signApp(app, target, signing) {
     const sign = signing ? ['--sign', signing.identity, '--options', 'runtime', '--timestamp'] : ['--sign', '-', '--timestamp=none'];
     run(null, ['codesign', '--force', ...sign, `${app}/Contents/Frameworks/hermesvm.framework`], null, target);
-    // The hardened runtime keeps the app from the devices of app.permissions unless its signature claims them.
-    const claims = Object.keys(appPermissions(state.config)).map((name) => ENTITLEMENTS[name]);
-    const entitlements = claims.length > 0 ? `${state.config.paths.build}/${path.basename(app)}.entitlements` : null;
-    if (entitlements) fs.writeFileSync(entitlements, xmlPlist(Object.fromEntries(claims.map((claim) => [claim, true]))));
+    // The hardened runtime keeps the app from the devices of app.permissions unless its signature claims them, beside what
+    // its extensions claim.
+    const devices = Object.fromEntries(Object.keys(appPermissions(state.config)).map((name) => [ENTITLEMENTS[name], true]));
+    const claims = mergedEntitlements([['app.permissions', devices], ...extensionsOf('darwin').entitlements]);
+    const entitlements = Object.keys(claims).length > 0 ? `${state.config.paths.build}/${path.basename(app)}.entitlements` : null;
+    if (entitlements) fs.writeFileSync(entitlements, xmlPlist(claims));
     run(null, ['codesign', '--force', ...sign, ...(entitlements ? ['--entitlements', entitlements] : []), app], null, target);
 }
 
@@ -363,22 +370,52 @@ function warnUnreasonedApis(project, privacy) {
     if (warning) console.warn(warning);
 }
 
-// Where publishApp last put this project's iOS and Android apps, for `crossbind app publish`, which runs Vite and so
-// cannot know the outDir it builds into.
+// Where publishApp last put this project's apps, for `crossbind app publish`, which runs Vite and so cannot know the
+// outDir it builds into: an iOS or Android app's project, and each arch's desktop app under its platform's name on the
+// command line.
 const appOutputsFile = () => `${state.config.paths.build}/app-outputs.json`;
 const readAppOutputs = () => (fs.existsSync(appOutputsFile()) ? JSON.parse(fs.readFileSync(appOutputsFile(), 'utf8')) : {});
+// What each desktop app's installers wrote beside it, as builds recorded them.
+const shippedFiles = () => new Set(Object.values(readAppOutputs()).filter(Array.isArray).flat()
+    .flatMap(({ installers = [] }) => installers.flatMap(({ files }) => files)));
+// The command line's names of the desktop platforms.
+export const DESKTOP_PLATFORMS = { darwin: 'macos', linux: 'linux', win32: 'windows' };
+
+// Forgets what the builds wrote, as a publish's own build writes it anew, but for the installers' files, which a folder the
+// bundler kept holds still, for the page to leave out.
+export function clearAppOutputs() {
+    const earlier = [...shippedFiles()];
+    if (earlier.length > 0) fs.writeFileSync(appOutputsFile(), JSON.stringify({ earlier: [{ installers: [{ files: earlier }] }] }));
+    else fs.rmSync(appOutputsFile(), { force: true });
+}
 
-export const clearAppOutputs = () => fs.rmSync(appOutputsFile(), { force: true });
-
+// What a publisher's upload gets of the app the build wrote for a platform: a desktop platform's apps, one for each arch.
 export function appOutputOf(platform) {
     const output = readAppOutputs()[platform];
     if (!output) throw new Error(`crossbind: the build wrote no ${platform} app, so there is nothing to publish.`);
-    return output;
+    return Object.values(DESKTOP_PLATFORMS).includes(platform) ? { apps: output } : output;
 }
 
-function recordAppOutput(platform, to) {
+const madeFile = (file) => (fs.existsSync(file) ? file : null);
+
+// What a publisher's upload takes of an app: an iOS app's project, an Android app's with its APK, bundle and native
+// debug symbols where the build made them, and each arch's desktop app with its installers.
+export function recordAppOutput(target, to, { installers = [] } = {}) {
+    const outputs = readAppOutputs();
+    const app = path.resolve(to);
+    const desktop = DESKTOP_PLATFORMS[target.platform];
+    const mobile = target.platform === 'android'
+        ? { project: app, apk: madeFile(`${app}.apk`), bundle: madeFile(`${app}.aab`), symbols: madeFile(`${app}-symbols.zip`) }
+        : { project: app };
+    const recorded = desktop
+        ? { [desktop]: [...(outputs[desktop] ?? []).filter((entry) => entry.app !== app), {
+            app,
+            arch: target.arch,
+            installers: installers.map(({ name, files }) => ({ name, files: files.map((file) => path.resolve(file)) })),
+        }] }
+        : { [target.platform]: mobile };
     fs.mkdirSync(state.config.paths.build, { recursive: true });
-    fs.writeFileSync(appOutputsFile(), `${JSON.stringify({ ...readAppOutputs(), [platform]: path.resolve(to) }, null, 4)}\n`);
+    fs.writeFileSync(appOutputsFile(), `${JSON.stringify({ ...outputs, ...recorded }, null, 4)}\n`);
 }
 
 // Where a build without a bundler puts an app: under its own name, or for iOS and Android as the project of its build
@@ -396,19 +433,34 @@ export function publishApp(target, { to = appOutputPath(target), page = null } =
     if (target.platform === 'ios') {
         const parts = appParts(target).map(({ arch, dir }) => ({ sdk: arch, dir }));
         const icon = readAppIcon(state.config);
-        const privacy = appPrivacy(state.config);
+        const ownPrivacy = appPrivacy(state.config);
         const build = appBuildNumber();
-        writeXcodeProject(to, {
+        // The app's own options are checked first, then what its extensions add.
+        const options = {
             parts, identity: { id: appId(state.config), team: appTeam() }, label: appDisplayName(state.config), version: appVersion(),
             build: build === null ? appVersion() : String(build), icon: icon && iosIcon(icon), urlSchemes: appUrlSchemes(state.config),
-            background: appBackgroundColor(state.config), usage: usageDescriptions(state.config, 'ios'), encryption: appEncryption(state.config), privacy,
+            fileTypes: fileTypeOwners(state.config), links: linkOwners(state.config).map(({ link }) => link),
+            activityTypes: activityTypeOwners(state.config).map(({ type }) => type), shortcutItems: shortcutItemOwners(state.config),
+            background: appBackgroundColor(state.config), usage: usageDescriptions(state.config, 'ios'), encryption: appEncryption(state.config),
+            multipleWindows: iosMultipleWindows(state.config),
+        };
+        const extensions = extensionsOf('ios');
+        const privacy = mergedPrivacy(ownPrivacy, extensions.privacy);
+        writeXcodeProject(to, {
+            ...options, privacy, entitlements: mergedEntitlements(extensions.entitlements), plist: extensions.plist, targets: extensions.targets,
+            appGroup: appGroupOf('ios', extensions),
         });
         if (target.buildType === 'release') warnUnreasonedApis(to, privacy);
     } else if (target.platform === 'android') {
         const icon = readAppIcon(state.config);
-        writeGradleProject(to, {
-            parts: appParts(target), id: androidAppId(), label: appDisplayName(state.config), version: androidVersion(), icons: icon && androidIcons(icon),
+        const options = {
+            parts: appParts(target), id: androidAppId(state.config), label: appDisplayName(state.config), version: androidVersion(), icons: icon && androidIcons(icon),
             urlSchemes: appUrlSchemes(state.config), background: appBackgroundColor(state.config), permissions: Object.keys(appPermissions(state.config)),
+            fileTypes: fileTypeOwners(state.config), links: linkOwners(state.config).map(({ link }) => link), shortcutItems: shortcutItemOwners(state.config),
+        };
+        const extensions = extensionsOf('android');
+        writeGradleProject(to, {
+            ...options, java: extensions.java, extensionPermissions: extensions.permissions, manifests: extensions.manifests, resources: extensions.resources, maven: extensions.maven,
         });
     } else if (path.resolve(to) !== path.resolve(built)) {
         fs.rmSync(to, { recursive: true, force: true });
@@ -416,11 +468,14 @@ export function publishApp(target, { to = appOutputPath(target), page = null } =
     }
     if (page) {
         // The app may land inside the page's own directory, which it then leaves out, with every app built there and what
-        // packages it.
-        const apps = new Set([path.basename(to), ...state.targets.filter((t) => t.runtimeEnv === 'app')
-            .flatMap((t) => [appOutputName(t), `${state.config.general.name}-${t.platform}-${t.arch}`])]);
-        const isApp = (entry) => entry.endsWith('.app') || apps.has(entry.replace(/\.dmg$/, '.app'))
-            || apps.has(entry.replace(/(\.tar\.gz|\.app\.zip|\.zip|\.apk|\.aab|\.deb|-setup\.exe|\.update\.json)$/, ''));
+        // packages it: what is named after a target of the app, and every installer's files as a build recorded them, which
+        // a folder the bundler left as it was holds still.
+        const apps = state.targets.filter((t) => t.runtimeEnv === 'app')
+            .flatMap((t) => [appOutputName(t), `${state.config.general.name}-${t.platform}-${t.arch}`]).filter((name) => !name.endsWith('.app'));
+        const shipped = shippedFiles();
+        const isApp = (entry) => entry === path.basename(to) || entry.endsWith('.app')
+            || apps.some((app) => entry === app || entry.startsWith(`${app}.`) || entry.startsWith(`${app}-`))
+            || shipped.has(path.resolve(page, entry));
         fs.readdirSync(page).filter((entry) => !isApp(entry)).forEach((entry) => {
             fs.cpSync(`${page}/${entry}`, `${to}/${appLayout(target).resources}/page/${entry}`, { recursive: true });
         });
@@ -432,17 +487,8 @@ export function publishApp(target, { to = appOutputPath(target), page = null } =
     } else if (target.platform === 'android' && target.buildType === 'release') {
         packageAndroidRelease(to);
     }
-    if (['ios', 'android'].includes(target.platform)) {
-        recordAppOutput(target.platform, to);
-    } else if (target.platform !== 'darwin') {
-        if (target.platform === 'win32') signWindowsApp(to, target, page);
-        archiveApp(to, target);
-    }
-    // A desktop app with its page ships with what installs it, and with an updater's key with its update too.
-    if (page && ['darwin', 'linux', 'win32'].includes(target.platform)) {
-        writeInstaller(to, target);
-        writeUpdate(to, target);
-    }
+    if (['ios', 'android'].includes(target.platform)) recordAppOutput(target, to);
+    else if (target.platform === 'win32') signWindowsApp(to, target, page);
     return to;
 }
 
@@ -457,14 +503,32 @@ export default async function buildApp(target, { bridges = [], force = false } =
         logger.info(`[${target.path}] app skipped (cargo package - staticlib only)`);
         return false;
     }
-    // Where the page opens files, a desktop host's title and window, a Windows one's version, and the app's icon: a bad
-    // app section stops the build before anything compiles.
-    const header = appHeader(state.config, target.platform);
+    // A desktop host's title and window, a Windows one's version, the app's icon and its extensions with their options, as
+    // where the page opens files: a bad app section stops the build before anything compiles.
     const icon = readAppIcon(state.config);
+    const extensions = extensionsOf(target.platform);
+    const header = appHeader(state.config, target.platform, appGroupOf(target.platform, extensions));
+    const carried = carriedFilesOf(extensions.files, ownFiles());
+    const carriedPaths = new Set(carried);
+    // Whether the extension that owns a launch has native code, or for the app's own one that holds the role.
+    const hasNative = (extension, role) => extensions.native.some(({ name, roles }) => (extension === null ? roles.includes(role) : name === extension));
+    // A desktop's system hands an app no https link: its owners there are those with native code, whose onOpenUrl a
+    // phone's code may share.
+    const isPhone = ['ios', 'android'].includes(target.platform);
+    const links = linkOwners(state.config).filter(({ extension }) => isPhone || hasNative(extension, 'links'));
+    // Another system continues no user activity: its owners there are those with native code, whose onUserActivity
+    // Apple's code may share.
+    const isApple = ['darwin', 'ios'].includes(target.platform);
+    const activities = activityTypeOwners(state.config).filter(({ extension }) => isApple || hasNative(extension, 'activities'));
+    // A desktop has no quick actions either.
+    const shortcuts = shortcutItemOwners(state.config).filter(({ extension }) => isPhone || hasNative(extension, 'shortcuts'));
+    const registration = registrationSource(extensions.native, urlSchemeOwners(state.config), fileTypeOwners(state.config), links, activities, shortcuts);
 
     const buildType = target.buildType === 'release' ? 'Release' : 'Debug';
     const { build } = state.config.paths;
     const appHostRoot = resolveAppHostRoot();
+    appExtensionsOf(state.config.extensions).filter(({ replaces }) => replaces)
+        .forEach(({ name, root, replaces }) => logger.info(`[${target.path}] the extension ${name} of ${root} takes the host's ${replaces.join(', ')}`));
     const jsiRoot = resolveAppEmbindJsiRoot();
     const { hermes, cmakeArgs, inputs } = await hostInputs(target);
 
@@ -480,6 +544,9 @@ export default async function buildApp(target, { bridges = [], force = false } =
     });
     const { libs, linkArgs, extraSources } = linkInputs(target, { bridge: BRIDGE });
     const sharedLibs = libs.filter((lib) => lib.endsWith('.so'));
+    // The extensions' sources compile with the host, which links what they need: a framework on macOS, a library elsewhere.
+    // An iOS host is a static library, whose frameworks the app's Xcode project links.
+    const hostLinkArgs = [...linkArgs, ...(target.platform === 'darwin' ? extensions.frameworks.map((framework) => `-framework ${framework}`) : extensions.libraries)];
 
     const fingerprintFile = `${build}/${target.appName}.fingerprint`;
     const fingerprint = getContentHash(JSON.stringify({
@@ -488,7 +555,8 @@ export default async function buildApp(target, { bridges = [], force = false } =
         // A desktop app carries its icon; an iOS or Android one gets it as its project is written.
         icon: ['ios', 'android'].includes(target.platform) ? null : icon?.hash ?? null,
         // A macOS app's bundle takes its id, name and version from it.
-        infoPlist: target.platform === 'darwin' ? infoPlist(state.config.general.name, appVersion(), Boolean(icon), urlSchemesOf(target)) : null,
+        infoPlist: target.platform === 'darwin'
+            ? infoPlist(state.config.general.name, appVersion(), Boolean(icon), urlSchemesOf(target), fileTypesOf(target), activityTypesOf(target)) : null,
         hermes: HERMES.version,
         inputs,
         linkArgs,
@@ -498,12 +566,25 @@ export default async function buildApp(target, { bridges = [], force = false } =
         }),
         env: getEnv(target),
         data: getData('data', target),
+        // What the app carries, by its size and time, as a large model would take long to read at each build.
+        carried: carried.map((file) => {
+            const stat = fs.statSync(file);
+            return { file, size: stat.size, mtimeMs: stat.mtimeMs };
+        }),
         version: state.config.package?.version,
         runtime: getFilesFingerprint(filesUnder([
             `${appHostRoot}/cpp`, `${appHostRoot}/js`, `${appHostRoot}/third_party`, `${jsiRoot}/cpp/src`, `${jsiRoot}/js`,
             `${state.config.paths.cli}/assets/js-runtime/adapters`,
         ])),
         extraSources: getFilesFingerprint(extraSources),
+        // An iOS app's frameworks reach its Xcode project through what the host's build writes.
+        extensions: {
+            registration,
+            files: getFilesFingerprint(filesUnder(extensions.roots).filter((file) => !carriedPaths.has(path.resolve(file)))),
+            compiled: extensions.compiled,
+            link: hostLinkArgs.slice(linkArgs.length),
+            frameworks: extensions.frameworks,
+        },
     }));
     const isChanged = !fs.existsSync(fingerprintFile) || fs.readFileSync(fingerprintFile, { encoding: 'utf8' }) !== fingerprint;
     if (!force && !isChanged && fs.existsSync(`${build}/${target.appName}`) && fs.existsSync(`${build}/${target.appJsName}`)) {
@@ -521,11 +602,25 @@ export default async function buildApp(target, { bridges = [], force = false } =
     resetCMakeCacheForSource(workDir, `${appHostRoot}/cpp`, target);
     // The host includes it from its build directory; written only when it changed, it recompiles nothing otherwise.
     writeIfChanged(`${workDir}/crossbind_app.h`, header);
+    writeIfChanged(`${workDir}/extensions.cpp`, registration);
     // A Windows host's executable carries the app's icon, which its resource script takes from beside the header.
     if (target.platform === 'win32') {
         if (icon) writeIfChanged(`${workDir}/icon.ico`, windowsIcon(icon));
         else fs.rmSync(`${workDir}/icon.ico`, { force: true });
     }
+    // An Apple app's Swift, which CMake's Makefiles take none of: each extension's compiles first, its header joins the
+    // extension's includes, and its library the host's link, or an iOS app's Xcode project's.
+    const swift = ['darwin', 'ios'].includes(target.platform) ? compileSwift(target, extensions.compiled, workDir, buildType === 'Release') : [];
+    const swiftLink = swiftLinkArgs(target, swift.map(({ library }) => library));
+    // A Linux app's extensions' packages beside crossbind's sysroot, each extension's in a sysroot of its own, whose
+    // headers its sources include and whose libraries the host links against.
+    const sysroots = target.platform === 'linux' ? await unpackPackages(target, extensions.compiled, {
+        cache: `${build}/linux-packages`, workDir, unpack: (deb, root) => run(null, ['dpkg-deb', '-x', deb, root], platformPrefix, target),
+    }) : [];
+    const compiled = extensions.compiled.map((part) => ({
+        ...part, includes: [...part.includes, ...[...swift, ...sysroots].filter(({ name: owner }) => owner === part.name).flatMap(({ includes }) => includes)],
+    }));
+    const ownLink = target.platform === 'darwin' ? swiftLink : sysroots.flatMap(({ libDir }) => [`-L${libDir}`, `-Wl,-rpath-link,${libDir}`]);
     run(null, [
         // An iOS host builds with crossbind's iOS toolchain file rather than as an Xcode project of its own.
         target.platform === 'ios' ? 'ios-cmake' : 'cmake', `${appHostRoot}/cpp`,
@@ -534,7 +629,9 @@ export default async function buildApp(target, { bridges = [], force = false } =
         `-DCROSSBIND_JSI_ROOT=${jsiRoot}`,
         `-DCROSSBIND_HERMES=${hermes}`,
         `-DCROSSBIND_EXTRA_SOURCES=${extraSources.join(';')}`,
-        `-DCROSSBIND_LINK_ARGS=${linkArgs.join(';')}`,
+        `-DCROSSBIND_EXTENSION_REGISTRATION=${workDir}/extensions.cpp`,
+        ...extensionCmakeArgs(compiled),
+        `-DCROSSBIND_LINK_ARGS=${[...hostLinkArgs, ...ownLink].join(';')}`,
         `-DCROSSBIND_LINK_DEPENDS=${libs.join(';')}`,
         // An Android release ships the packages' shared libraries stripped as well, and keeps them as they come.
         ...(target.platform === 'android' ? [`-DCROSSBIND_SHARED_LIBS=${sharedLibs.join(';')}`] : []),
@@ -552,7 +649,8 @@ export default async function buildApp(target, { bridges = [], force = false } =
         platformPrefix, target);
     await bundle(`${appHostRoot}/js/page.js`, `${build}/${target.appJsName}`, []);
     if (target.platform === 'ios') {
-        assembleIosPart(target, { library: `${workDir}/lib${name}.a`, linkArgs, hbc: `${workDir}/host.hbc`, hermes });
+        const frameworks = extensions.frameworks.flatMap((framework) => ['-framework', framework]);
+        assembleIosPart(target, { library: `${workDir}/lib${name}.a`, linkArgs: [...linkArgs, ...frameworks, ...swiftLink], hbc: `${workDir}/host.hbc`, hermes });
     } else if (target.platform === 'android') {
         assembleAndroidPart(target, { libDir: workDir, sharedLibs, hbc: `${workDir}/host.hbc` });
     } else {

package/src/actions/buildNode.js

@@ -24,11 +24,16 @@ import toolchainNoticesDir from '../utils/toolchainNotices.js';
 const cpuCount = Math.max(1, os.cpus().length - 1);
 const WINDOWS_IMAGE_NOTICES = '/opt/licenses/llvm-mingw';
 
+// What a build's output, a package's own packages and a repository's history hold, which no build reads.
+const UNREAD_FOLDERS = ['.crossbind', 'node_modules', '.git'];
+
+// The files under these folders a build reads, a link that leads nowhere left out.
 export function filesUnder(dirs) {
     return dirs.flatMap((dir) => (fs.existsSync(dir)
         ? fs.readdirSync(dir, { recursive: true })
+            .filter((file) => !file.split(/[\\/]/).some((part) => UNREAD_FOLDERS.includes(part)))
             .map((file) => `${dir}/${file}`)
-            .filter((file) => fs.statSync(file).isFile())
+            .filter((file) => fs.statSync(file, { throwIfNoEntry: false })?.isFile())
         : []));
 }
 

package/src/actions/buildWasm.js

@@ -6,7 +6,6 @@ import getLinkInputs from './getLinkInputs.js';
 import getData from './getData.js';
 import getEnv from './getEnv.js';
 import buildJs from './buildJs.js';
-import triggerExtensions from './extensions.js';
 import state from '../state/index.js';
 import resolveEmbindRustRoot from '../utils/resolveEmbindRust.js';
 import logger from '../utils/logger.js';
@@ -128,8 +127,6 @@ export default async function buildWasm(target, options = {}) {
         if (!isProd && !/-s\s*STACK_OVERFLOW_CHECK=/.test(set)) emccFlags.push('-sSTACK_OVERFLOW_CHECK=1');
     }
 
-    triggerExtensions('buildWasm', 'beforeBuild', [emccFlags]);
-
     if (target.runtime === 'mt' && !emccFlags.includes('-pthread')) {
         emccFlags.push('-pthread');
         emccFlags.push('-sPTHREAD_POOL_SIZE=Math.min(navigator.hardwareConcurrency || 1, 2)');
@@ -203,8 +200,6 @@ export default async function buildWasm(target, options = {}) {
         logger.startStep(target, 'wasm');
         const t0 = performance.now();
 
-        triggerExtensions('buildWasm', 'beforeBuildBrowser', [emccFlags]);
-
         const data = Object.entries(getData('data', target)).map(([key, value]) => ['--preload-file', `${key.replaceAll('@', '@@')}@/crossbind/${value}`]).flat();
         run('em++', [
             '-lembind',
@@ -260,8 +255,6 @@ export default async function buildWasm(target, options = {}) {
         logger.startStep(target, 'wasm');
         const t0 = performance.now();
 
-        triggerExtensions('buildWasm', 'beforeBuildEdge', [emccFlags]);
-
         const data = Object.entries(getData('data', target)).map(([key, value]) => ['--preload-file', `${key.replaceAll('@', '@@')}@/crossbind/${value}`]).flat();
         run('em++', [
             '-lembind',
@@ -300,8 +293,6 @@ export default async function buildWasm(target, options = {}) {
     if (target.runtimeEnv === 'node') {
         logger.startStep(target, 'wasm');
 
-        triggerExtensions('buildWasm', 'beforeBuildNodeJS', [emccFlags]);
-
         run('em++', [
             '-lembind',
             // The config's emccFlags follow the default level, so its -Oz or -Os wins (the last -O does).

package/src/actions/createInterface.js

@@ -24,6 +24,9 @@ import { withDirLockSync } from '../utils/dirLock.js';
 import { conanImportOfHeader } from '../utils/conanImport.js';
 import run, { cxxPreprocessorFor } from './run.js';
 import isSourceCmakePackage from '../utils/isSourceCmakePackage.js';
+import {
+    loadBridgeTools, runPreprocessor, runSwig, usesBridgeTools,
+} from '../utils/bridgeTools.js';
 
 // Part of every interface hash, so interfaces cached by an older generator are rebuilt.
 const INTERFACE_FORMAT = 'swig-macros-4';
@@ -54,6 +57,8 @@ function bindHeader(headerOrModuleFilePath, target, { withDependencies = true, w
     // dependency built since.
     refreshConanDependencies(state.config);
     refreshBuiltDependencies(state.config);
+    // Without bridge-tools on a Mac the macro step would fail quietly, and its interface would be kept without macros.
+    if (usesBridgeTools(target)) loadBridgeTools();
     const interfaceFilePath = upath.resolve(headerOrModuleFilePath);
     if (!fs.existsSync(`${state.config.paths.build}/interface`)) {
         fs.mkdirSync(`${state.config.paths.build}/interface`, { recursive: true });
@@ -353,21 +358,25 @@ const RELEASE_DEFINE = '-DNDEBUG';
 
 // One bridge serves every desktop target, so SWIG and the macro table it reads come from the web image's em++,
 // which defines no operating system; an android bridge is read with the NDK it compiles with. The headers
-// still come from the target's own packages.
+// still come from the target's own packages. On a Mac, bridge-tools makes the same bridge, in the build directory the
+// image's tools run in.
 const toolTargetFor = (target) => (target?.platform === 'android' ? target : { ...target, platform: 'wasm' });
 
 function dumpMacros(outputFile, includes, includePath, target, defines = []) {
-    const tool = toolTargetFor(target);
-    run(cxxPreprocessorFor(tool), [
+    const args = [
         '-x', 'c++', '-std=c++17', '-dM', '-E', ...defines,
         ...includePath,
         ...includes.flatMap((header) => ['-include', header]),
         '-o', outputFile,
         '/dev/null',
-    ], null, tool);
+    ];
+    if (usesBridgeTools(target)) runPreprocessor(args, state.config.paths.build);
+    else run(cxxPreprocessorFor(toolTargetFor(target)), args, null, toolTargetFor(target));
     return parseMacroDump(fs.readFileSync(outputFile, 'utf8'));
 }
 
+const runSwigFor = (args, target) => (usesBridgeTools(target) ? runSwig(args, state.config.paths.build) : run('swig', args, null, toolTargetFor(target)));
+
 function swigIncludePath(target, sourceDir) {
     const allHeaders = state.config.dependencyParameters.headerPathWithDepends.split(';');
     const includePath = [
@@ -468,7 +477,7 @@ function createBridgeFileFromInterfaceFile(interfaceFilePath, target, sourceDir
     const bridgeFilePath = `${state.config.paths.build}/bridge/${interfaceFilePath.split('/').at(-1)}.cpp`;
     fs.writeFileSync(keyOf(bridgeFilePath), '');
     // #error lines guard branches SWIG evaluates without the compiler's predefined macros, so they only warn.
-    const swig = () => run('swig', [
+    const swig = () => runSwigFor([
         '-c++',
         '-embind',
         '-cpperraswarn',
@@ -476,7 +485,7 @@ function createBridgeFileFromInterfaceFile(interfaceFilePath, target, sourceDir
         ...(swigView ? [`-I${swigView.dir}`] : []),
         ...swigIncludePath(target, sourceDir),
         interfaceFilePath,
-    ], null, toolTargetFor(target));
+    ], target);
     try {
         swig();
     } catch (e) {
@@ -517,8 +526,8 @@ function createConanDeclarations(interfaceFile, target, sourceDir, sourceHash, s
     const hash = getContentHash([BRIDGE_FORMAT, getFileHash(file), sourceHash, swigView?.hash ?? ''].join('\n'));
     if (!fs.existsSync(`${bridge}.exports.json`) || !fs.existsSync(keyOf(bridge)) || fs.readFileSync(keyOf(bridge), 'utf8') !== hash) {
         fs.writeFileSync(keyOf(bridge), '');
-        run('swig', ['-c++', '-embind', '-cpperraswarn', '-o', bridge,
-            ...(swigView ? [`-I${swigView.dir}`] : []), ...swigIncludePath(target, sourceDir), file], null, toolTargetFor(target));
+        runSwigFor(['-c++', '-embind', '-cpperraswarn', '-o', bridge,
+            ...(swigView ? [`-I${swigView.dir}`] : []), ...swigIncludePath(target, sourceDir), file], target);
         fs.writeFileSync(keyOf(bridge), hash);
     }
     return `${bridge}.exports.json`;

package/src/actions/createLib.js

@@ -6,7 +6,6 @@ import run from './run.js';
 import buildCargo from './buildCargo.js';
 import { cargoTripleFor } from '../utils/cargoTarget.js';
 import getCmakeParameters from './getCmakeParameters.js';
-import triggerExtensions from './extensions.js';
 import state from '../state/index.js';
 import logger from '../utils/logger.js';
 import { WASI_EMULATION_LIBS, WASI_LINK_LIBS, wasiCFlags, wasiCxxFlags } from '../utils/wasiToolchain.js';
@@ -132,7 +131,6 @@ export default function createLib(target, fileType, options = {}) {
 
         const extraLibs = getExtraLibs ? getExtraLibs(target) : [];
 
-        triggerExtensions('createLib', 'setFlagWithBuildConfig', [buildEnv, cFlags, ldFlags]);
         const archiveFlags = targetArchiveFlags(target);
         cFlags.push(...archiveFlags);
         ldFlags.push(...archiveFlags);
@@ -165,8 +163,6 @@ export default function createLib(target, fileType, options = {}) {
         ];
         buildParams = getCmakeParameters(target, { ...options, nativeGlob, headerDirs });
 
-        triggerExtensions('createLib', 'setFlagWithoutBuildConfig', [buildEnv]);
-
         const archiveFlags = targetArchiveFlags(target).join(' ');
         if (archiveFlags) {
             buildEnv.params.push('-e', `CFLAGS=${archiveFlags}`);