crossbind 2.0.0-beta.68 → 2.0.0-beta.72

package/src/utils/packageSources.js

@@ -0,0 +1,108 @@
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import {
+    broughtExtension, isJsonValue, ownPackages, stepFailure, withListed,
+} from './appExtensions.js';
+import { getContentHash } from './hash.js';
+import { PACKAGE_NAME, declarationOf, dependenciesOf } from './packageSourceImport.js';
+
+// crossbind's own folder, whose dependencies name the extensions it brings.
+const CORE_ROOT = path.join(import.meta.dirname, '..', '..');
+
+// The extension packages crossbind itself brings, which a project neither installs nor lists.
+export const packagesOfCrossbind = () => ownPackages(CORE_ROOT);
+
+let own = null;
+
+// crossbind's own package sources: those the extension packages among its dependencies give, which every project
+// has by having crossbind. Loaded once, as a source may keep what it asked its tool.
+function ownSources() {
+    if (!own) {
+        const load = createRequire(path.join(CORE_ROOT, 'package.json'));
+        own = packagesOfCrossbind()
+            .map((name) => broughtExtension(load, name, `update ${name} to match crossbind`))
+            .filter((extension) => extension.packageSource);
+    }
+    return own;
+}
+
+// A project's package sources: crossbind's own, then those crossbind.config.js lists. One listed under the name of
+// one of crossbind's takes its place.
+export const packageSourcesOf = (listed) => withListed(ownSources(), listed.filter((extension) => extension.packageSource));
+
+export { declarationOf, dependenciesOf };
+
+// The sources a project declares packages of.
+export const declaredSources = (config) => (config.packageSources ?? []).filter(({ name }) => Object.keys(dependenciesOf(config, name)).length > 0);
+
+export const sourceNamesOf = (config) => (config.packageSources ?? []).map(({ name }) => name);
+
+// What an import names a store by, as the node: and npm: schemes do: cargo's crates, and each source's packages.
+export const importSchemesOf = (config) => ['cargo', ...sourceNamesOf(config)];
+
+// What a project declares for a source, as the source's check takes it: a map of package names to what each asks
+// for, in plain JSON, as it is hashed, kept in manifests and handed back to the source.
+export function checkedDependencies({ name, packageSource }, raw) {
+    let dependencies;
+    try {
+        dependencies = packageSource.check(raw);
+    } catch (error) {
+        throw stepFailure(name, 'check', error);
+    }
+    const isMap = dependencies !== null && typeof dependencies === 'object' && !Array.isArray(dependencies) && isJsonValue(dependencies);
+    if (!isMap || !Object.keys(dependencies).every((pkg) => PACKAGE_NAME.test(pkg))) {
+        throw new Error(`crossbind: ${name}'s check gives no ${declarationOf(name)} crossbind can use: a JSON map of package names, of lower-case letters, digits and _ + . -, to what each asks for.`);
+    }
+    return dependencies;
+}
+
+// cargo's crates, each as Cargo.toml takes it: a version, or the table that would follow `<crate> =`. Text, where a
+// source's package may be an object: a number would lose a trailing zero, 0.10 becoming 0.1.
+function checkedCrates(crates = {}) {
+    if (crates === null || typeof crates !== 'object' || Array.isArray(crates)) {
+        throw new Error(`crossbind: ${declarationOf('cargo')} must be an object of crates, such as { uuid: '1' }.`);
+    }
+    const [crate] = Object.entries(crates).find(([, spec]) => typeof spec !== 'string') ?? [];
+    if (crate !== undefined) {
+        throw new Error(`crossbind: ${declarationOf('cargo')}.${crate} must be text as Cargo.toml takes it: a version such as '1', or a table such as '{ version = "1", features = ["v4"] }'.`);
+    }
+    return { ...crates };
+}
+
+// What a project declares under packages, by the name its imports open with: cargo's crates, which are the core's
+// own, and each source's packages. Another name stops the config: a misspelt one would be left unread. So does the
+// key cargo or a source once had of its own, with where its packages are declared now and the config that holds it:
+// a package crossbind builds from source loads as a project too, and its key is not the app's developer's to find.
+export function checkedPackages(sources, config, file = 'crossbind.config') {
+    const names = sources.map(({ name }) => name);
+    const moved = ['cargo', ...names].find((name) => config[`${name}Dependencies`] !== undefined);
+    if (moved) throw new Error(`crossbind: ${moved}Dependencies is now ${declarationOf(moved)}: write packages: { ${moved}: { … } } in ${file}.`);
+    const { packages = {} } = config;
+    if (packages === null || typeof packages !== 'object' || Array.isArray(packages)) {
+        throw new Error("crossbind: \"packages\" must be an object of each package source's packages, such as { conan: { zlib: '1.3.2' } }.");
+    }
+    const unknown = Object.keys(packages).find((name) => name !== 'cargo' && !names.includes(name));
+    if (unknown !== undefined) {
+        throw new Error(`crossbind: ${declarationOf(unknown)} names neither cargo nor a package source of this project, which has ${names.join(', ')}. List its extension in extensions, or fix the name.`);
+    }
+    const written = (name) => (Object.hasOwn(packages, name) ? packages[name] : undefined);
+    return {
+        cargo: checkedCrates(written('cargo')),
+        ...Object.fromEntries(sources.map((source) => [source.name, checkedDependencies(source, written(source.name))])),
+    };
+}
+
+// What staged packages were installed for; a change to the dependencies makes them stale.
+export const dependenciesKey = (dependencies) => getContentHash(JSON.stringify(dependencies));
+
+// What an app's headers and sources see of its sources' packages: the packages are staged after a header may
+// already be bound, and restaged in place when one moves to another version. Null without any.
+export function packageSourceInputsOf(config) {
+    const declared = declaredSources(config);
+    if (declared.length === 0) return null;
+    return declared.map(({ name }) => ({
+        source: name,
+        dependencies: dependenciesOf(config, name),
+        refs: config.allDependencies.filter(({ general }) => general.packageSource?.name === name).map(({ general }) => general.packageSource.package.ref),
+    }));
+}

package/src/utils/plist.js

@@ -5,6 +5,11 @@ const escapeXml = (text) => String(text).replace(/&/g, '&amp;').replace(/</g, '&
 
 function xmlLines(value, indent) {
     if (typeof value === 'boolean') return [`${indent}<${value}/>`];
+    if (typeof value === 'number') {
+        // An integer an integer element reads back the same, and any other number a real.
+        const type = Number.isSafeInteger(value) ? 'integer' : 'real';
+        return [`${indent}<${type}>${value}</${type}>`];
+    }
     const inner = indent + XML_INDENT;
     if (Array.isArray(value)) return [`${indent}<array>`, ...value.flatMap((item) => xmlLines(item, inner)), `${indent}</array>`];
     if (typeof value === 'object') {

package/src/utils/printableText.js

@@ -0,0 +1,5 @@
+// C0 and C1 controls, which carry terminal escape sequences.
+export const isControlCharacter = (char) => char < ' ' || (char >= '\u007f' && char <= '\u009f');
+
+// Text a recipe or a tool wrote, for a terminal or a message: its lines and tabs, without any other control character.
+export const printable = (text) => [...text].filter((char) => char === '\n' || char === '\t' || !isControlCharacter(char)).join('');

package/src/utils/resolveAppHost.js

@@ -19,3 +19,10 @@ export function resolveAppEmbindJsiRoot() {
     const req = createRequire(path.join(resolveAppHostRoot(), 'package.json'));
     return path.dirname(fs.realpathSync(req.resolve('@crossbind/core-embind-jsi/package.json')));
 }
+
+// crossbind/app as an app's page imports it, which the app host assembles with what crossbind's own extensions give the page.
+export function resolveAppPageApi() {
+    const file = path.join(resolveAppHostRoot(), 'js', 'app.js');
+    if (!fs.existsSync(file)) throw new Error(`crossbind: the app host at ${resolveAppHostRoot()} has no crossbind/app for an app's page: update ${PKG} to match crossbind.`);
+    return fs.realpathSync(file);
+}

package/src/utils/runPackageSource.js

@@ -0,0 +1,251 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import getOsUserAndGroupId from './getOsUserAndGroupId.js';
+import makeTreeWritable from './makeTreeWritable.js';
+import pullDockerImage, { getDockerImage, getDockerContainerName, imageRoleFor } from './pullDockerImage.js';
+import { DOCKER_RUN_SECURITY_ARGS } from './dockerSecurity.js';
+import assertExecContainer from './execContainer.js';
+import { IOS_DEVELOPER_DIR, XCODE_TOOLCHAIN_BIN } from './iosToolchain.js';
+import { DARWIN_CC, DARWIN_TOOLS_BIN } from './darwinToolchain.js';
+import { HOST_BUILT_PLATFORMS } from './targets.js';
+import { remoteExecParams } from './remoteRunner.js';
+import { runnerFor } from './selectRunner.js';
+
+// Every run of a package source's tool goes through here. The config is passed in instead of read from
+// state, because state attaches the staged packages while it is still being built.
+//
+// The tool runs recipes, which are code, and can write wherever the tool keeps its settings and plugins.
+// So every run gets a fresh work directory, deleted with the run, for whatever of the tool must not
+// outlive it; only the package store does. On the host the environment is rebuilt from an allowlist, so
+// the tool's own variables, a stray CC or a remote's credentials never reach it.
+const ALLOWED_ENV = [
+    /^PATH$/,
+    /^HOME$/,
+    /^USER$/,
+    /^LOGNAME$/,
+    /^SHELL$/,
+    /^TERM$/,
+    /^TMPDIR$/,
+    /^TEMP$/,
+    /^TMP$/,
+    /^LANG$/,
+    /^LC_[A-Z_]+$/,
+    /^(HTTP|HTTPS|ALL|NO)_PROXY$/i,
+    /^SSL_CERT_(FILE|DIR)$/,
+    /^REQUESTS_CA_BUNDLE$/,
+    // A host Emscripten under RUNNER=LOCAL.
+    /^EMSDK(_NODE|_PYTHON)?$/,
+    /^EM_(CONFIG|CACHE)$/,
+    /^SYSTEMROOT$/i,
+    /^WINDIR$/i,
+    /^USERPROFILE$/i,
+    /^PROGRAMDATA$/i,
+];
+
+// What a tool can build on the host: wasm with a host Emscripten, iOS and macOS with Xcode.
+const HOST_PLATFORMS = ['wasm', 'ios', 'darwin'];
+const APPLE_PLATFORM_NAMES = { ios: 'iOS', darwin: 'macOS' };
+// Where a container sees sourceRoot(): an exec container mounts all of it here, a run container only
+// the store and its own work directory, at the same places.
+export const containerRootOf = (name) => `/var/cache/crossbind/${name}`;
+// A recipe's build log is the whole compiler output of a library.
+const MAX_BUFFER = 256 * 1024 * 1024;
+const SPAWN_OPTIONS = { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf8', maxBuffer: MAX_BUFFER };
+
+export function sourceRunner(config, target) {
+    const { runner } = runnerFor(imageRoleFor(target), config.system);
+    // Xcode runs on the Mac alone, so iOS and macOS packages build there whatever runner the rest use.
+    return HOST_BUILT_PLATFORMS.includes(target?.platform) ? 'LOCAL' : runner;
+}
+
+// Machine-wide like the cargo cache: built packages are reused by every project, and `pnpm run clear`
+// in one project must not throw them away. Containers write to the store and a tool runs the recipes
+// it keeps there, so a tool on the host never shares a store with them.
+export function sourceRoot(name, runner = 'DOCKER_RUN') {
+    return path.join(os.homedir(), '.crossbind', runner === 'LOCAL' ? `${name}-local` : name);
+}
+
+// A directory under a source's root, with the store beside it. toolPath and storePath name a file of
+// each as the tool sees it.
+function workAt(name, runner, relative) {
+    const root = sourceRoot(name, runner);
+    const viewOf = (base) => (...segments) => (runner === 'LOCAL'
+        ? path.join(root, base, ...segments)
+        : [containerRootOf(name), base, ...segments].join('/'));
+    const toolPath = viewOf(relative);
+    return {
+        name, runner, root, store: path.join(root, 'store'), dir: path.join(root, relative), toolDir: toolPath(), toolPath, storePath: viewOf('store'),
+    };
+}
+
+// The directory one run reads its inputs from and writes its outputs to.
+export function createSourceWork(name, runner) {
+    const root = sourceRoot(name, runner);
+    fs.mkdirSync(path.join(root, 'store'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'work'), { recursive: true });
+    return workAt(name, runner, `work/${path.basename(fs.mkdtempSync(path.join(root, 'work', 'run-')))}`);
+}
+
+// Where a source asks the tool of the host what it is, outside any run. Only named where an image says what runs:
+// nothing is asked there, and a build that finds every target staged touches nothing of the home.
+export function createSourceProbe(name, runner) {
+    if (runner === 'LOCAL') fs.mkdirSync(path.join(sourceRoot(name, runner), 'probe'), { recursive: true });
+    return workAt(name, runner, 'probe');
+}
+
+function removeTree(dir) {
+    if (!fs.existsSync(dir)) return;
+    makeTreeWritable(dir);
+    fs.rmSync(dir, { recursive: true, force: true });
+}
+
+export const removeSourceWork = (work) => removeTree(work.dir);
+
+// What runs that were killed left behind. Only while holding the install lock: no run is going then.
+export const clearSourceWork = (name, runner) => removeTree(path.join(sourceRoot(name, runner), 'work'));
+
+// A tool reports paths as it sees them. In a container that is through the mounts, which all sit under
+// the container's root, so mapping the prefix back is exact; a path anywhere else is none crossbind gave it.
+export function toHostPath(reported, work) {
+    if (work.runner === 'LOCAL') return path.resolve(reported);
+    const containerRoot = containerRootOf(work.name);
+    const clean = path.posix.normalize(reported);
+    // A backslash is a separator again once the path is joined on a Windows host.
+    if (reported.includes('\\') || !clean.startsWith(`${containerRoot}/`)) {
+        throw new Error(`crossbind: ${work.name} reported ${JSON.stringify(reported)}, outside the directories crossbind mounts for it.`);
+    }
+    return path.join(work.root, clean.slice(containerRoot.length + 1));
+}
+
+function allowedEnv() {
+    return Object.fromEntries(Object.entries(process.env).filter(([key]) => ALLOWED_ENV.some((allowed) => allowed.test(key))));
+}
+
+// The Xcode every crossbind iOS archive builds with, whichever one xcode-select points at.
+const iosEnv = () => ({ ...allowedEnv(), DEVELOPER_DIR: IOS_DEVELOPER_DIR });
+
+// A GNU ar or nm ahead of Apple's on a Mac's PATH (Homebrew's binutils) writes archives Apple's linker
+// cannot read, and recipes, the build tools they build and Meson all take these tools by name. So the
+// run gets links to Xcode's first on its PATH; for macOS to the ones xcode-select picks, as the macOS
+// ports are built with.
+const APPLE_TOOLS = {
+    ar: 'ar', as: 'as', nm: 'llvm-nm', ranlib: 'ranlib', strip: 'strip',
+};
+const appleToolOf = (target, name) => (target.platform === 'darwin'
+    ? path.join(DARWIN_TOOLS_BIN, name)
+    : path.join(XCODE_TOOLCHAIN_BIN, APPLE_TOOLS[name]));
+
+function withAppleTools(work, env, target) {
+    if (process.platform !== 'darwin') return env;
+    const dir = path.join(work.dir, 'apple-tools');
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir);
+        Object.keys(APPLE_TOOLS).forEach((name) => fs.symlinkSync(appleToolOf(target, name), path.join(dir, name)));
+    }
+    return { ...env, PATH: [dir, env.PATH].filter(Boolean).join(path.delimiter) };
+}
+
+const toolVersions = new Map();
+// The first line a tool prints for --version, asked once.
+function toolVersion(command, env = allowedEnv()) {
+    const key = command.join(' ');
+    if (!toolVersions.has(key)) {
+        const [program, ...args] = command;
+        const result = spawnSync(program, [...args, '--version'], { encoding: 'utf8', env });
+        toolVersions.set(key, `${result.stdout ?? ''}`.split('\n')[0].trim());
+    }
+    return toolVersions.get(key);
+}
+
+// The compiler a tool on the host builds with; for a container the image digest says the same.
+export function localCompilerIdentity(target) {
+    if (target?.platform === 'ios') return toolVersion(['xcrun', 'clang'], iosEnv());
+    if (target?.platform === 'darwin') return toolVersion([DARWIN_CC]);
+    return toolVersion(['emcc']);
+}
+
+// What a tool on the host cannot build: the targets an image's toolchain builds, and Xcode's off a Mac.
+export function assertRunsOnHost(name, target) {
+    if (!HOST_PLATFORMS.includes(target.platform)) {
+        throw new Error(`crossbind: ${name} packages for ${target.platform} build in the ${imageRoleFor(target)} image, which RUNNER=LOCAL does not use.`);
+    }
+    if (HOST_BUILT_PLATFORMS.includes(target.platform) && process.platform !== 'darwin') {
+        throw new Error(`crossbind: ${name} packages for ${APPLE_PLATFORM_NAMES[target.platform]} build with Xcode, on a Mac.`);
+    }
+}
+
+// Of a store, a remote runner sends back the folders its source says never change once written, and nothing else.
+export function assertRunsRemotely({ name, packageSource }) {
+    if (packageSource.storeUnits.length > 0) return;
+    throw new Error(`crossbind: ${name} names no storeUnits, so a remote runner would send none of its packages back: name the folders of its store that never change once written, as 'p/*/p', or build with another RUNNER.`);
+}
+
+// A tool of the host asked what it is, in a source's probe directory: no target's tools are on its PATH.
+export function runProbe([program, ...args], { work, env = {} }) {
+    return spawnSync(program, args, { ...SPAWN_OPTIONS, cwd: work.dir, env: { ...allowedEnv(), ...env } });
+}
+
+export default function runPackageSource(command, {
+    source, config, target, work, env = {},
+}) {
+    const [program, ...args] = command;
+    const role = imageRoleFor(target);
+    if (work.runner === 'LOCAL') {
+        const hostEnv = target.platform === 'ios' ? iosEnv() : allowedEnv();
+        return spawnSync(program, args, { ...SPAWN_OPTIONS, cwd: work.dir, env: withAppleTools(work, { ...hostEnv, ...env }, target) });
+    }
+
+    // Google ships the linux NDK for x86_64 only.
+    const platform = target.platform === 'android' ? 'linux/amd64' : undefined;
+    if (work.runner === 'REMOTE') {
+        return spawnSync(...remoteExecParams({
+            remote: runnerFor(role, config.system).remote,
+            role,
+            image: getDockerImage(role, platform),
+            mounts: [
+                // Of the store, only the folders the source names come back: they never change once written.
+                { host: work.store, container: work.storePath(), inputRoots: [], outputRoots: source.packageSource.storeUnits },
+                { host: work.dir, container: work.toolDir, inputRoots: ['.'], outputRoots: ['.'] },
+            ],
+            cwd: work.toolDir,
+            argv: command,
+            env,
+        }, SPAWN_OPTIONS));
+    }
+
+    const containerRoot = containerRootOf(source.name);
+    const envArgs = Object.entries(env).flatMap(([key, value]) => ['-e', `${key}=${value}`]);
+    let runnerArgs;
+    if (work.runner === 'DOCKER_EXEC') {
+        const name = getDockerContainerName(config.paths.base, role);
+        assertExecContainer({
+            name,
+            mounts: [[containerRoot, work.root]],
+            workdir: work.toolDir,
+            hint: `Recreate it with \`crossbind docker stop ${role}\`, \`crossbind docker delete ${role}\` and \`crossbind docker create ${role}\`, which mount ${work.root} at ${containerRoot}.`,
+            mountNote: `It predates the ${source.name} mount.`,
+        });
+        runnerArgs = ['exec', ...envArgs, '--user', getOsUserAndGroupId(), '--workdir', work.toolDir, name];
+    } else {
+        pullDockerImage(role, platform);
+        runnerArgs = [
+            'run',
+            '--rm',
+            ...(platform ? ['--platform', platform] : []),
+            ...DOCKER_RUN_SECURITY_ARGS,
+            '-v',
+            `${work.store}:${work.storePath()}`,
+            '-v',
+            `${work.dir}:${work.toolDir}`,
+            ...envArgs,
+            '--user',
+            getOsUserAndGroupId(),
+            '--workdir',
+            work.toolDir,
+            getDockerImage(role, platform),
+        ];
+    }
+    return spawnSync('docker', [...runnerArgs, ...command], SPAWN_OPTIONS);
+}

package/src/utils/rustBridgeGen.js

@@ -267,7 +267,7 @@ export function createRustBridgeCrate({ rsFile, cacheDir, projectPath, vectors =
         '',
         '[dependencies]',
         `embind-rs = { path = "${relPath(dir, resolveEmbindRsDir())}" }`,
-        // The app config's top-level cargoDependencies, so an app-local surface can use
+        // The app config's packages.cargo, so an app-local surface can use
         // upstream crates directly (values: a version string, or a verbatim `{ ... }` spec).
         ...Object.entries(cargoDependencies).map(([name, spec]) => (
             String(spec).trim().startsWith('{') ? `${name} = ${spec}` : `${name} = "${spec}"`
@@ -295,7 +295,7 @@ export function createRustBridgeCrate({ rsFile, cacheDir, projectPath, vectors =
     return { bridgeDir: dir, crateName: `${stem}_crossbind_app`, model };
 }
 
-// Direct CRATE import (`import { X } from 'cargo:uuid'` with top-level `cargoDependencies`
+// Direct CRATE import (`import { X } from 'cargo:uuid'` with `packages.cargo`
 // declaring `uuid`, or `cargo:<crate>/<module>` for one public module): no surface file and no
 // package - the bridge is generated from the upstream crate's OWN multi-file source. cargo
 // metadata (which fetches on first run) locates the source and the resolved feature set; the
@@ -608,7 +608,7 @@ function findModule(lib, modulePath, enabled, srcDir) {
             : undefined;
         file = decl && modFile(file, name);
         if (!file) {
-            throw new Error(`crossbind: rust bridge: module '${where}' not found in ${srcDir} - a module behind a cargo feature needs that feature in cargoDependencies, and inline mod { } blocks are not read`);
+            throw new Error(`crossbind: rust bridge: module '${where}' not found in ${srcDir} - a module behind a cargo feature needs that feature in packages.cargo, and inline mod { } blocks are not read`);
         }
         if (!decl.isPub) throw new Error(`crossbind: rust bridge: module '${where}' in ${srcDir} is private to the crate`);
     }

package/src/utils/systemConfig.js

@@ -13,7 +13,20 @@ export default function loadSystemConfig() {
     return { ...system, ...Object.fromEntries(defaults) };
 }
 
-// Sets keys of ~/.crossbind.json, as `crossbind config set` does, keeping the others.
-export function updateSystemConfig(values) {
-    writeJson(systemConfigPath(), { ...loadSystemConfig(), ...values });
+const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+// The settings of an extension's own, which ~/.crossbind.json keeps apart from crossbind's, under extensions by the
+// extension's name.
+export function extensionSettingsOf(system, name) {
+    const own = system.extensions === undefined ? {} : isObject(system.extensions) && (system.extensions[name] ?? {});
+    if (!isObject(own)) throw new Error(`crossbind: ${systemConfigPath()} keeps the settings of the extension ${name} as no object of them, under extensions: fix it.`);
+    return own;
+}
+
+// Sets keys of ~/.crossbind.json, as `crossbind config set` does, keeping the others, and with { name, values } settings
+// of that extension's own.
+export function updateSystemConfig(values, extension = null) {
+    const system = loadSystemConfig();
+    const own = extension && { extensions: { ...system.extensions, [extension.name]: { ...extensionSettingsOf(system, extension.name), ...extension.values } } };
+    writeJson(systemConfigPath(), { ...system, ...values, ...own });
 }

package/src/utils/targetToolchain.js

@@ -0,0 +1,77 @@
+import { WASM_EXCEPTION_FLAGS, targetArchiveFlags } from './archiveFlags.js';
+import { ANDROID_NDK, ANDROID_API_LEVEL } from './androidToolchain.js';
+import { IOS_DEPLOYMENT_TARGET } from './iosToolchain.js';
+import {
+    LINUX_ARCHIVE_FLAGS, linuxBuildEnv, linuxTool, linuxToolchainFile, linuxTriple,
+} from './linuxToolchain.js';
+import {
+    DARWIN_CC, DARWIN_CXX, DARWIN_DEPLOYMENT_TARGET, DARWIN_HOST_PACKAGE_PREFIXES,
+} from './darwinToolchain.js';
+import {
+    windowsBuildEnv, windowsTool, windowsToolchainFile, windowsTriple,
+} from './windowsToolchain.js';
+
+// What crossbind builds a target's own archives with, as plain data: a package source builds its packages to match,
+// since they link into the same module.
+const CPP_STANDARD = '20';
+const NDK_BIN = `${ANDROID_NDK}/toolchains/llvm/prebuilt/linux-x86_64/bin`;
+const LINUX_LIBCS = { linux: 'glibc', linuxmusl: 'musl' };
+
+const linux = (target) => ({
+    flags: LINUX_ARCHIVE_FLAGS,
+    compilers: { c: linuxTool(target, 'clang'), cpp: linuxTool(target, 'clang++') },
+    env: linuxBuildEnv(target),
+    cmakeToolchainFile: linuxToolchainFile(target),
+    triple: linuxTriple(target),
+    libc: LINUX_LIBCS[target.platform],
+});
+
+const PLATFORMS = {
+    wasm: () => ({
+        flags: WASM_EXCEPTION_FLAGS,
+        compilers: { c: 'emcc', cpp: 'em++' },
+        env: {
+            CC: 'emcc', CXX: 'em++', AR: 'emar', NM: 'emnm', RANLIB: 'emranlib', STRIP: 'emstrip',
+        },
+    }),
+    android: () => ({
+        compilers: { c: `${NDK_BIN}/clang`, cpp: `${NDK_BIN}/clang++` },
+        ndk: ANDROID_NDK,
+        apiLevel: ANDROID_API_LEVEL,
+    }),
+    // No compilers: Xcode's own build it, which xcrun finds for the SDK the arch names.
+    ios: () => ({ deploymentTarget: IOS_DEPLOYMENT_TARGET }),
+    linux,
+    linuxmusl: linux,
+    darwin: () => ({
+        compilers: { c: DARWIN_CC, cpp: DARWIN_CXX },
+        env: { PKG_CONFIG_LIBDIR: '' },
+        deploymentTarget: DARWIN_DEPLOYMENT_TARGET,
+        ignoredPrefixes: [...DARWIN_HOST_PACKAGE_PREFIXES],
+    }),
+    win32: (target) => ({
+        compilers: {
+            c: windowsTool(target, 'clang'), cpp: windowsTool(target, 'clang++'), rc: windowsTool(target, 'windres'),
+        },
+        env: windowsBuildEnv(target),
+        cmakeToolchainFile: windowsToolchainFile(target),
+        triple: windowsTriple(target),
+    }),
+};
+
+export const TOOLCHAIN_PLATFORMS = Object.keys(PLATFORMS);
+
+// Null for a platform package sources build nothing for yet.
+export function targetToolchain(target) {
+    const own = PLATFORMS[target.platform]?.(target);
+    if (!own) return null;
+    return {
+        platform: target.platform,
+        arch: target.arch,
+        runtime: target.runtime,
+        cppStandard: CPP_STANDARD,
+        env: {},
+        ...own,
+        flags: [...(own.flags ?? []), ...targetArchiveFlags(target)],
+    };
+}

package/vitest.config.js

@@ -52,7 +52,12 @@ export default defineConfig({
             // exercised a machine without that image already cached, and android builds shipped
             // broken to every Apple Silicon user. Which command line these actions build IS the
             // behaviour, so the layer is measured.
-            include: ['src/utils/**/*.js', 'src/state/**/*.js', 'src/assets/**/*.js', 'src/actions/**/*.js'],
+            // crossbind's own extensions' build-side code, which left src/ as packages of their own, is measured with it.
+            include: [
+                'src/utils/**/*.js', 'src/state/**/*.js', 'src/assets/**/*.js', 'src/actions/**/*.js',
+                '../../extensions/*/crossbind.extension.js', '../../extensions/*/src/**/*.js', '../../core/store-kit/*.js',
+            ],
+            allowExternal: true,
             all: true,
             // A floor with a one-point band, not a ratchet. Coverage is not identical across
             // environments - resolveEmbindRust walks the real node_modules layout, so which of its

package/src/actions/appSetup.js

@@ -1,116 +0,0 @@
-import state from '../state/index.js';
-import { askLine, askYesNo } from '../utils/ask.js';
-import { entry, writeAppOption } from '../utils/configWriter.js';
-import { PRIVACY_CATEGORIES } from '../utils/appOptions.js';
-import { readAppIcon } from '../utils/appIcon.js';
-
-// What only the project can answer, which `crossbind app publish` asks on a terminal and writes into crossbind.config.js
-// once the user says yes.
-
-// An id both stores take: dot-separated parts of letters and digits, each starting with a letter, as Apple's take no
-// underscore and Google's no hyphen.
-const STORE_APP_ID = /^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)+$/;
-
-const REASONS_PAGE = 'https://developer.apple.com/documentation/bundleresources/describing-use-of-required-reason-api';
-// Apple's reasons an app may give, in short; that page has their rules. 0A2A.1 and C56D.1 are for third-party SDKs alone.
-const REASONS = {
-    'DDA9.1': 'to show file timestamps to the user; they stay on the device',
-    'C617.1': "for the timestamps, size or other metadata of files in the app's container, app group container or CloudKit container",
-    '3B52.1': 'for those of files or folders the user granted access to, as with a document picker',
-    '35F9.1': 'to measure the time between events in the app, or for timers; only that time may leave the device',
-    '8FFB.1': "to turn the times of the app's events into absolute timestamps, which may leave the device; the boot time may not",
-    '3D61.1': 'in an optional bug report the user chooses to send, which shows it prominently',
-    '85F4.1': 'to show disk space to the user; it stays on the device',
-    'E174.1': 'to check for space before writing files, or to delete files when space runs low, in a way the user notices; it stays on the device',
-    '7D9E.1': 'in an optional bug report the user chooses to send, which shows it prominently',
-    'B728.1': 'in a health research app, to tell participants that low disk space hampers the research',
-    '3EC4.1': 'in a custom keyboard app, to find the keyboards active on the device',
-    '54BD.1': 'to show the right interface for the active keyboard in text fields, in a way the user notices; it stays on the device',
-    'CA92.1': 'for information only the app itself reads and writes',
-    '1C8F.1': "for information only the apps and extensions of the app's App Group read and write",
-    'AC6B.1': 'for the managed app configuration MDM sets, or the feedback MDM reads',
-};
-
-// Writes app.<key> into crossbind.config.js once the user says yes, and into this run's config. One the config sets
-// already is the user's to change.
-async function writeAppAnswer(key, value) {
-    const text = entry(key, value);
-    if (state.config.app[key] !== undefined) throw new Error(`crossbind: set app.${text} in crossbind.config.js in place of the app.${key} there, and publish again.`);
-    if (!await askYesNo(`Write app.${text} into crossbind.config.js? [Y/n] `)) throw new Error(`crossbind: set app.${text} in crossbind.config.js to publish.`);
-    if (!writeAppOption(state.config.paths.project, key, value)) {
-        throw new Error(`crossbind: crossbind.config.js is no config crossbind can write app.${key} into safely: set app.${text} in it yourself.`);
-    }
-    state.config.app = { ...state.config.app, [key]: value };
-}
-
-// Asks for the app's id, which the store keeps for good, under the name the store gives it.
-export async function askAppId(store, term) {
-    console.log(`crossbind: ${store} knows an app by its ${term}, app.id, and keeps it for good.`);
-    for (;;) {
-        const id = (await askLine(`The ${term}, as com.example.myapp: `)).trim();
-        if (STORE_APP_ID.test(id)) {
-            await writeAppAnswer('id', id);
-            return id;
-        }
-        console.log(`That is no ${term} both stores take, which is dot-separated parts of letters and digits, each starting with a letter.`);
-    }
-}
-
-function iconProblem(icon) {
-    try {
-        readAppIcon({ ...state.config, app: { ...state.config.app, icon } });
-        return null;
-    } catch (error) {
-        return error.message;
-    }
-}
-
-// Asks for the app's icon, without which App Store Connect takes no iOS app.
-export async function askIcon() {
-    console.log('crossbind: App Store Connect takes no iOS app without an icon, app.icon: a square PNG, at best 1024 × 1024.');
-    for (;;) {
-        const icon = (await askLine("Its path, from the project's folder: ")).trim();
-        const problem = iconProblem(icon);
-        if (!problem) {
-            await writeAppAnswer('icon', icon);
-            return;
-        }
-        console.log(problem);
-    }
-}
-
-// Asks whether the app's encryption is iOS's own alone, which App Store Connect otherwise asks for every build. The answer
-// is a legal statement, so there is no default.
-export async function askEncryption() {
-    console.log('crossbind: App Store Connect asks for every build whether the app uses encryption that export rules do not exempt, until app.encryption answers it.');
-    for (;;) {
-        const answer = (await askLine('Does the app use only the encryption iOS provides, as HTTPS through iOS, or none at all? [y/n] ')).trim();
-        if (/^[yn]/i.test(answer)) {
-            await writeAppAnswer('encryption', /^n/i.test(answer));
-            return;
-        }
-        console.log('Answer y or n.');
-    }
-}
-
-async function askReasons(reasons) {
-    for (;;) {
-        const picks = (await askLine('Which apply, as 1 or 1,2? ')).split(',').map((pick) => pick.trim()).filter(Boolean);
-        const chosen = picks.map((pick) => reasons[Number(pick) - 1]);
-        if (chosen.length > 0 && chosen.every(Boolean)) return [...new Set(chosen)];
-        console.log(`Name one or more of 1 to ${reasons.length}, separated by commas.`);
-    }
-}
-
-// Asks for Apple's reasons for each category of required reason API the app calls with none in app.privacy.
-export async function askPrivacy(unreasoned) {
-    console.log(`crossbind: App Store Connect refuses an iOS app that calls required reason API without Apple's reasons for it (ITMS-91053), which app.privacy gives; ${REASONS_PAGE} has the rules of each.`);
-    const privacy = { ...state.config.app.privacy };
-    for (const { category, symbols } of unreasoned) {
-        const reasons = PRIVACY_CATEGORIES[category].reasons.filter((reason) => Object.hasOwn(REASONS, reason));
-        console.log(`The app calls ${category} API (${symbols.join(', ')}). Apple's reasons for it:`);
-        reasons.forEach((reason, index) => console.log(`  ${index + 1}) ${reason} ${REASONS[reason]}`));
-        privacy[category] = await askReasons(reasons);
-    }
-    await writeAppAnswer('privacy', privacy);
-}