crossbind 2.0.0-beta.68 → 2.0.0-beta.72

package/src/actions/publishAndroid.js

@@ -1,102 +0,0 @@
-import fs from 'node:fs';
-import state from '../state/index.js';
-import { SIGNING } from './androidGradle.js';
-import {
-    androidAppId, androidVersion, appBuildNumber, appOutputOf, clearAppOutputs,
-} from './buildApp.js';
-import {
-    PLAY, highestVersionCode, keptSignIn, playCredentials, uploadBundle,
-} from './googlePlay.js';
-import { signInToPlay } from './playSetup.js';
-import { askAppId } from './appSetup.js';
-import { makeUploadKey, releaseSigningEnv } from './uploadKey.js';
-import { askLine, askYesNo, hasTerminal } from '../utils/ask.js';
-import loadSystemConfig from '../utils/systemConfig.js';
-import openUrl from '../utils/openUrl.js';
-
-const PLAY_CONSOLE = 'https://play.google.com/console';
-const NO_APP_ID = 'crossbind: Google Play knows an app by its package name, app.id, which crossbind.config.js does not set: set it, as com.example.myapp, before the first publish, as Play keeps it for good.';
-const NO_UPLOAD_KEY = `crossbind: Google Play takes bundles signed with your upload key: crossbind app upload-key makes one, or ${SIGNING.keystore}, ${SIGNING.alias} and ${SIGNING.password} name yours.`;
-const NO_CREDENTIALS = `crossbind: Google Play takes uploads from your Google account, which a publish on a terminal signs in to, or from a service account: set ${PLAY.serviceAccount} to its e-mail, with gcloud signed in, ${PLAY.key} to its JSON key, or ${PLAY.token} to an access token of it; app.md's Publishing says how to make one.`;
-const SIGN_IN = 'Google Play takes uploads from your Google account once crossbind is signed in to it. Sign in now, in your browser? [Y/n] ';
-const ANOTHER_ACCOUNT = 'Sign in with another Google account? [Y/n] ';
-
-// The highest versionCode Play has seen, and the credentials that saw it, once the user has done what Play asks for,
-// which only the user can do: in Play Console, which crossbind opens before it waits for Enter and checks again, or, for
-// a Google account without release rights, by signing in with another.
-async function highestWithPlayConsole(appId, credentials) {
-    let current = credentials;
-    for (;;) {
-        try {
-            return { highest: await highestVersionCode(appId, current), credentials: current };
-        } catch (error) {
-            console.log(error.message);
-            if (error.status === 403 && current.refreshToken) {
-                current = await signInToPlay(ANOTHER_ACCOUNT);
-                if (!current) throw error;
-            } else {
-                if ([403, 404].includes(error.status)) {
-                    console.log(`crossbind: opening ${PLAY_CONSOLE}.`);
-                    openUrl(PLAY_CONSOLE);
-                }
-                await askLine('Press Enter once that is done to check again, or Ctrl-C to stop. ');
-            }
-        }
-    }
-}
-
-// Builds an Android app with the next versionCode Google Play takes, signed with the upload key, and releases its bundle
-// on a track. All it needs is checked before the build, which takes minutes: on a terminal, what is missing is asked for
-// and set up; without one, as in CI, every missing piece is named at once.
-export async function publishAndroid({ track, status, viteArgs }, { runVite }) {
-    const isGuided = hasTerminal();
-    const missing = [];
-    let appId = state.config.app.id === undefined ? null : androidAppId();
-    if (!appId && isGuided) appId = await askAppId('Google Play', 'package name');
-    if (!appId) missing.push(NO_APP_ID);
-
-    let signing = await releaseSigningEnv();
-    if (!signing.isSigned && isGuided && await askYesNo('This machine has no upload key, which Google Play takes bundles signed with. Make one now? [Y/n] ')) {
-        await makeUploadKey();
-        state.config.system = loadSystemConfig();
-        signing = await releaseSigningEnv();
-    }
-    if (!signing.isSigned) missing.push(NO_UPLOAD_KEY);
-
-    let credentials = playCredentials(process.env, state.config.system) ?? await keptSignIn();
-    if (!credentials && isGuided) credentials = await signInToPlay(SIGN_IN);
-    if (!credentials) missing.push(NO_CREDENTIALS);
-    if (missing.length > 0) throw new Error(missing.join('\n'));
-    const version = state.config.package?.version ?? '1.0.0';
-    console.log(`crossbind: publishing ${appId} ${version} to Google Play's ${track} track.`);
-
-    let highest;
-    if (isGuided) ({ highest, credentials } = await highestWithPlayConsole(appId, credentials));
-    else highest = await highestVersionCode(appId, credentials);
-    const versionCode = appBuildNumber() ?? Math.max(androidVersion().code, highest + 1);
-    console.log(highest
-        ? `crossbind: Google Play has seen versionCode ${highest} at most, so this build is ${versionCode}.`
-        : `crossbind: Google Play has no build of ${appId} yet, so this build is ${versionCode}.`);
-
-    clearAppOutputs();
-    const exitCode = await runVite(['build', ...viteArgs], {
-        ...process.env, ...signing.env, CROSSBIND_APP_PLATFORM: 'android', CROSSBIND_APP_BUILD_NUMBER: String(versionCode),
-    });
-    if (exitCode !== 0) throw Object.assign(new Error(`crossbind: the build ended with exit code ${exitCode}, so nothing went to Google Play.`), { exitCode });
-    const project = appOutputOf('android');
-    const aab = `${project}.aab`;
-    if (!fs.existsSync(aab)) throw new Error(`crossbind: the build made no bundle at ${aab}, so nothing went to Google Play.`);
-    const symbols = fs.existsSync(`${project}-symbols.zip`) ? `${project}-symbols.zip` : null;
-
-    console.log(`crossbind: uploading the bundle${symbols ? ' and its native debug symbols' : ''} to Google Play.`);
-    const released = await uploadBundle(appId, credentials, { aab, symbols, track, status });
-    const app = `${appId} ${version} (versionCode ${released.versionCode})`;
-    if (released.status !== 'draft') {
-        console.log(`crossbind: ${app} is out on Google Play's ${track} track.`);
-        return;
-    }
-    console.log(`crossbind: ${app} is a draft on Google Play's ${track} track.`);
-    if (status !== 'draft') {
-        console.log("crossbind: Play takes drafts alone until an app's first release is out: roll it out once in Play Console, under Test and release, and later publishes go out by themselves.");
-    }
-}

package/src/actions/publishIos.js

@@ -1,146 +0,0 @@
-import state from '../state/index.js';
-import { appStoreKey } from './appleSigning.js';
-import {
-    appBuildNumber, appOutputOf, appTeam, appVersion, clearAppOutputs,
-} from './buildApp.js';
-import {
-    addHermesDsym, archiveIosApp, archivedBinary, archivedPrivacy, uploadIosArchive, xcodeTeams,
-} from './appStoreConnect.js';
-import {
-    askAppId, askEncryption, askIcon, askPrivacy,
-} from './appSetup.js';
-import { appEncryption, appId } from '../utils/appOptions.js';
-import { resolveHermesDsym } from '../utils/hermes.js';
-import { unreasonedImports } from '../utils/requiredReasonApis.js';
-import { askLine, askYesNo, hasTerminal } from '../utils/ask.js';
-import loadSystemConfig, { updateSystemConfig } from '../utils/systemConfig.js';
-import openUrl from '../utils/openUrl.js';
-
-const NO_APP_ID = 'crossbind: App Store Connect knows an app by its bundle id, app.id, which crossbind.config.js does not set: set it, as com.example.myapp, before the first publish, as Apple keeps it for good.';
-const NO_TEAM = "crossbind: App Store Connect takes uploads from an Apple Developer Program team, which neither app.team in crossbind.config.js nor this machine's XCODE_DEVELOPMENT_TEAM names: set either to its id, which developer.apple.com/account shows under Membership details.";
-const NO_ICON = 'crossbind: App Store Connect takes no iOS app without an icon: set app.icon in crossbind.config.js to a square PNG, at best 1024 × 1024.';
-const NO_ENCRYPTION = 'crossbind: app.encryption is not set, so App Store Connect asks whether this build uses encryption before TestFlight hands it out; set it in crossbind.config.js to answer for every build.';
-const TEAM_ID = /^[A-Z0-9]{10}$/;
-
-async function pickTeam(teams) {
-    if (teams.length === 1) {
-        const [{ id, name }] = teams;
-        return await askYesNo(`Upload as team ${id}, ${name}, which Xcode is signed in to? [Y/n] `) ? teams[0] : null;
-    }
-    console.log('Xcode is signed in to these teams:');
-    teams.forEach(({ id, name }, index) => console.log(`  ${index + 1}) ${id} ${name}`));
-    for (;;) {
-        const team = teams[Number((await askLine(`Which one uploads, 1 to ${teams.length}? `)).trim()) - 1];
-        if (team) return team;
-    }
-}
-
-// A team id the user types, or null once they have signed in to Xcode, for its teams to be read again.
-async function typedTeam() {
-    console.log("crossbind: Xcode is signed in to no such team, as a free personal team is none. Sign in to Xcode, under Settings › Accounts, with your membership's Apple Account, or type the team's id, which developer.apple.com/account shows under Membership details.");
-    for (;;) {
-        const id = (await askLine('Team id, or Enter once Xcode is signed in: ')).trim().toUpperCase();
-        if (!id) return null;
-        if (TEAM_ID.test(id)) return id;
-        console.log('That is no team id, which is ten letters and digits.');
-    }
-}
-
-// The team the user picks of those Xcode is signed in to, or types, which this machine keeps as XCODE_DEVELOPMENT_TEAM.
-async function askTeam() {
-    console.log('crossbind: App Store Connect takes uploads from an Apple Developer Program team, which neither app.team nor XCODE_DEVELOPMENT_TEAM names.');
-    let id = null;
-    while (!id) {
-        const teams = xcodeTeams();
-        if (teams.length > 0) {
-            const team = await pickTeam(teams);
-            if (!team) throw new Error(NO_TEAM);
-            ({ id } = team);
-        } else {
-            id = await typedTeam();
-        }
-    }
-    updateSystemConfig({ XCODE_DEVELOPMENT_TEAM: id });
-    state.config.system = loadSystemConfig();
-    if (appTeam() !== id) throw new Error(`crossbind: ~/.crossbind.json did not take XCODE_DEVELOPMENT_TEAM: set app.team: '${id}' in crossbind.config.js.`);
-    console.log(`crossbind: ~/.crossbind.json keeps ${id} as XCODE_DEVELOPMENT_TEAM.`);
-}
-
-// A step that failed for what only the user can mend, in Xcode or on Apple's sites, runs again once they press Enter,
-// after crossbind opened the page that mends it where it knows one. Any other failure, or one without a terminal, stops
-// the publish.
-async function untilDone(isGuided, step) {
-    for (;;) {
-        try {
-            return step();
-        } catch (error) {
-            if (!isGuided || !error.isMendable) throw error;
-            console.log(error.message);
-            if (error.page) {
-                console.log(`crossbind: opening ${error.page}.`);
-                openUrl(error.page);
-            }
-            await askLine('Press Enter once that is done to try again, or Ctrl-C to stop. ');
-            console.log('crossbind: trying again, which can take a few minutes.');
-        }
-    }
-}
-
-async function buildIosApp(viteArgs, runVite) {
-    clearAppOutputs();
-    const exitCode = await runVite(['build', ...viteArgs], { ...process.env, CROSSBIND_APP_PLATFORM: 'ios' });
-    if (exitCode !== 0) throw Object.assign(new Error(`crossbind: the build ended with exit code ${exitCode}, so nothing went to App Store Connect.`), { exitCode });
-    return appOutputOf('ios');
-}
-
-const unreasonedError = (unreasoned) => new Error(`crossbind: App Store Connect refuses an iOS app that calls required reason API without Apple's reasons for it (ITMS-91053), and this app calls ${unreasoned.map(({ category, symbols }) => `${category} (${symbols.join(', ')})`).join(' and ')} with no reason in its privacy manifest. Give app.privacy Apple's reasons, as { fileTimestamp: ['C617.1'] }; Apple's "Describing use of required reason API" says what each covers. Nothing went to App Store Connect.`);
-
-// Builds an iOS app, archives it and uploads it to App Store Connect, whose TestFlight hands it out. All it needs is
-// checked before the build, which takes minutes: on a terminal, what is missing is asked for and set up; without one,
-// as in CI, every missing piece is named at once. The archived app then shows what required reason API it calls.
-export async function publishIos({ viteArgs }, { runVite }) {
-    if (process.platform !== 'darwin') throw new Error('crossbind: iOS apps build and go to App Store Connect on macOS, with Xcode.');
-    const isGuided = hasTerminal();
-    const key = appStoreKey();
-    const missing = [];
-    if (state.config.app.id === undefined) {
-        if (isGuided) await askAppId('App Store Connect', 'bundle id');
-        else missing.push(NO_APP_ID);
-    }
-    if (!appTeam()) {
-        if (isGuided) await askTeam();
-        else missing.push(NO_TEAM);
-    }
-    if (state.config.app.icon === undefined) {
-        if (isGuided) await askIcon();
-        else missing.push(NO_ICON);
-    }
-    if (missing.length > 0) throw new Error(missing.join('\n'));
-    if (appEncryption(state.config) === null) {
-        if (isGuided) await askEncryption();
-        else console.warn(NO_ENCRYPTION);
-    }
-    const hermesDsym = await resolveHermesDsym();
-
-    const facts = { id: appId(state.config), team: appTeam() };
-    console.log(`crossbind: publishing ${facts.id} ${appVersion()} to App Store Connect for team ${facts.team}; building the app first.`);
-    let archive;
-    for (;;) {
-        const project = await buildIosApp(viteArgs, runVite);
-        console.log('crossbind: archiving the app, which takes a few minutes.');
-        archive = await untilDone(isGuided, () => archiveIosApp(project, { facts }));
-        const unreasoned = unreasonedImports(archivedBinary(archive), archivedPrivacy(archive));
-        if (unreasoned.length === 0) break;
-        if (!isGuided) throw unreasonedError(unreasoned);
-        await askPrivacy(unreasoned);
-        console.log('crossbind: building the app again, with those reasons in its privacy manifest.');
-    }
-    addHermesDsym(archive, hermesDsym);
-    console.log(`crossbind: uploading the app to App Store Connect for team ${facts.team} with ${key ? `the API key ${key.keyId}` : "Xcode's account"}, which signs it.`);
-    const build = appBuildNumber();
-    await untilDone(isGuided, () => uploadIosArchive(archive, {
-        team: facts.team, key, isBuildManaged: build === null, facts,
-    }));
-    const app = build === null ? `${facts.id} ${appVersion()}, numbered by Xcode after the builds App Store Connect has of it,` : `${facts.id} ${appVersion()} (build ${build})`;
-    console.log(`crossbind: ${app} is on App Store Connect. TestFlight hands it out once Apple has processed it, usually within 5 to 30 minutes, and Apple mails when it has.`);
-}

package/src/state/refreshConanDependencies.js

@@ -1,17 +0,0 @@
-import attachConanDependencies from './attachConanDependencies.js';
-import { conanStageDir } from '../utils/conanImport.js';
-import { conanManifestsStamp } from '../utils/conanStage.js';
-
-const attachedFrom = new WeakMap();
-
-// Attaches what a build staged since this config last attached: a process that loaded state before
-// the build, such as a Metro server, would otherwise bind headers without the packages. Says whether
-// it attached again.
-export default function refreshConanDependencies(config) {
-    if (Object.keys(config.conanDependencies ?? {}).length === 0) return false;
-    const stamp = conanManifestsStamp(conanStageDir(config.paths.cache));
-    if (attachedFrom.get(config) === stamp) return false;
-    attachedFrom.set(config, stamp);
-    attachConanDependencies(config);
-    return true;
-}

package/src/utils/conanDependencies.js

@@ -1,66 +0,0 @@
-import { CONAN_NAME } from './conanImport.js';
-import { getContentHash } from './hash.js';
-
-// A plain version or a Conan range; a user, channel or recipe revision belongs in conan.lock instead.
-export const CONAN_VERSION = /^[A-Za-z0-9_][A-Za-z0-9_.+-]*$/;
-const VERSION_RANGE = /^\[[^\]\n]+\]$/;
-const OPTION_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const OPTION_VALUE_TYPES = ['string', 'number', 'boolean'];
-
-export function normalizeConanDependencies(raw) {
-    if (raw === undefined) return {};
-    if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
-        throw new Error('crossbind: "conanDependencies" must be an object such as { zlib: \'1.3.1\' }.');
-    }
-    return Object.fromEntries(Object.entries(raw).map(([name, spec]) => [name, normalizeSpec(name, spec)]));
-}
-
-function normalizeSpec(name, spec) {
-    if (!CONAN_NAME.test(name)) {
-        throw new Error(`crossbind: conanDependencies key '${name}' is not a Conan package name (lower-case letters, digits and _ + . -).`);
-    }
-    const { version, options = {} } = typeof spec === 'string' ? { version: spec } : (spec ?? {});
-    if (typeof version !== 'string' || !(CONAN_VERSION.test(version) || VERSION_RANGE.test(version))) {
-        throw new Error(`crossbind: conanDependencies.${name} needs a version such as '1.3.1' or a range such as '[>=1.3 <2]' (got ${JSON.stringify(version)}).`);
-    }
-    if (options === null || typeof options !== 'object' || Array.isArray(options)) {
-        throw new Error(`crossbind: conanDependencies.${name}.options must be an object such as { enable_fts5: true }.`);
-    }
-    Object.entries(options).forEach(([key, value]) => {
-        if (key === 'shared') {
-            throw new Error(`crossbind: conanDependencies.${name}.options.shared - crossbind links Conan packages statically into the module and sets shared=False itself.`);
-        }
-        if (!OPTION_NAME.test(key)) {
-            throw new Error(`crossbind: conanDependencies.${name}.options - '${key}' is not an option name.`);
-        }
-        if (!OPTION_VALUE_TYPES.includes(typeof value)) {
-            throw new Error(`crossbind: conanDependencies.${name}.options.${key} must be a string, number or boolean.`);
-        }
-    });
-    return { version, options: { ...options } };
-}
-
-// What staged packages were installed for; a change to conanDependencies makes them stale.
-export const conanDependenciesKey = (dependencies) => getContentHash(JSON.stringify(dependencies));
-
-// What an app's headers and sources see of its Conan packages: the packages are staged after a header
-// may already be bound, and restaged in place when one moves to another version. Null without any.
-export function conanInputsOf(config) {
-    if (Object.keys(config.conanDependencies ?? {}).length === 0) return null;
-    return {
-        dependencies: config.conanDependencies,
-        refs: config.allDependencies.filter((d) => d.general.conan).map((d) => d.general.conan.ref),
-    };
-}
-
-export const conanRequires = (dependencies) => Object.entries(dependencies).map(([name, { version }]) => `${name}/${version}`);
-
-function optionValue(value) {
-    if (value === true) return 'True';
-    if (value === false) return 'False';
-    return String(value);
-}
-
-export const conanOptionArgs = (dependencies) => Object.entries(dependencies).flatMap(([name, { options }]) => (
-    Object.entries(options).flatMap(([key, value]) => ['-o:h', `${name}/*:${key}=${optionValue(value)}`])
-));

package/src/utils/conanImport.js

@@ -1,58 +0,0 @@
-import fs from 'node:fs';
-
-export const CONAN_PREFIX = 'conan:';
-// Conan 2 refuses upper-case package names.
-export const CONAN_NAME = /^[a-z0-9_][a-z0-9_+.-]*$/;
-// No leading dot, so neither '.' nor '..' can climb out of the include directory.
-const HEADER_SEGMENT = /^[A-Za-z0-9_+-][A-Za-z0-9_.+-]*$/;
-
-export const conanStageDir = (cacheDir) => `${cacheDir}/conan`;
-// Apart from the stage's own files, so no package name can land on one of them.
-export const conanPackageDir = (stageDir, name) => `${stageDir}/packages/${name}`;
-
-export function parseConanImport(source, headerExtensions) {
-    const [name, ...headerPath] = source.slice(CONAN_PREFIX.length).split('/');
-    if (!CONAN_NAME.test(name)) {
-        throw new Error(`crossbind: '${source}' - '${name}' is not a Conan package name; write conan:<package>/<header>, such as conan:zlib/zlib.h.`);
-    }
-    if (headerPath.length === 0) {
-        throw new Error(`crossbind: '${source}' names no header - import one of the package's headers as conan:${name}/<header>.`);
-    }
-    const bad = headerPath.find((segment) => !HEADER_SEGMENT.test(segment));
-    if (bad !== undefined) {
-        throw new Error(`crossbind: '${source}' - '${bad}' is not a header path segment.`);
-    }
-    const header = headerPath.join('/');
-    const extension = header.includes('.') ? header.split('.').at(-1) : '';
-    if (!headerExtensions.includes(extension)) {
-        throw new Error(`crossbind: '${source}' - a conan: import names a header (${headerExtensions.map((e) => `.${e}`).join(', ')}).`);
-    }
-    return { name, header };
-}
-
-// The inverse of resolveConanHeader, for the editor types of a staged header.
-export function conanImportOfHeader(file, cacheDir) {
-    const prefix = conanPackageDir(conanStageDir(cacheDir), '');
-    if (!file.startsWith(prefix)) return null;
-    const match = file.slice(prefix.length).match(/^([^/]+)\/dist\/prebuilt\/[^/]+\/include\/(.+)$/);
-    // Both end up in the module name of the generated types.
-    if (!match || !CONAN_NAME.test(match[1]) || !match[2].split('/').every((segment) => HEADER_SEGMENT.test(segment))) return null;
-    return { name: match[1], header: match[2] };
-}
-
-// Only declared packages are importable, as with cargo:; a package pulled in by another links but stays hidden.
-export function resolveConanHeader(config, source, target) {
-    const { name, header } = parseConanImport(source, config.ext.header);
-    if (!Object.hasOwn(config.conanDependencies ?? {}, name)) {
-        throw new Error(`crossbind: '${source}' is not declared - add '${name}' to conanDependencies in crossbind.config.`);
-    }
-    const dependency = config.allDependencies.find((d) => d.general.conan?.name === name);
-    if (!dependency) {
-        throw new Error(`crossbind: '${source}' - ${name} is declared in conanDependencies but not installed; crossbind installs Conan packages when a build starts.`);
-    }
-    const tried = [...new Set([target.releasePath, target.path].filter(Boolean))]
-        .map((targetPath) => `${dependency.paths.output}/prebuilt/${targetPath}/include/${header}`);
-    const found = tried.find((file) => fs.existsSync(file));
-    if (found) return found;
-    throw new Error(`crossbind: '${source}' - ${name} has no ${header}. Tried:\n${tried.map((file) => `  - ${file}`).join('\n')}`);
-}

package/src/utils/conanInstall.js

@@ -1,154 +0,0 @@
-import fs from 'node:fs';
-import upath from 'upath';
-import withDirLock from './dirLock.js';
-import logger from './logger.js';
-import loadJson from './loadJson.js';
-import writeIfChanged from './writeIfChanged.js';
-import { getContentHash } from './hash.js';
-import { getDockerImage, imageRoleFor } from './pullDockerImage.js';
-import runConan, {
-    clearConanWork, conanRoot, conanRunner, createConanWork, localToolchainIdentity, removeConanWork, toHostPath,
-} from './runConan.js';
-import { hostProfile, settingsUser, BUILD_PROFILE } from './conanProfile.js';
-import { conanRequires, conanOptionArgs, conanDependenciesKey } from './conanDependencies.js';
-import {
-    conanPackagesOf, stageConanPackage, writeConanManifest, readConanManifest, isControlCharacter,
-} from './conanStage.js';
-import { conanStageDir } from './conanImport.js';
-
-// Bumped when the stage changes shape, so a stage an older crossbind made is made again.
-const CONAN_STAGE_FORMAT = 4;
-// Enough of a failed build's log to reach the error conan ends it with.
-const LOG_TAIL_LINES = 60;
-
-const lockFileOf = (config) => upath.join(config.paths.project, 'conan.lock');
-const stampFileOf = (stageDir, target) => upath.join(stageDir, 'stamps', `${target.path}.json`);
-const logFileOf = (stageDir, target) => upath.join(stageDir, 'logs', `${target.path}.log`);
-const printable = (text) => [...text].filter((char) => char === '\n' || char === '\t' || !isControlCharacter(char)).join('');
-
-// What a staged target was made from. The toolchain is the image, or the host's compiler and conan where
-// conan runs on the host (RUNNER=LOCAL, and iOS always): the profile asks that compiler for its version,
-// so a new one is a new package id and must restage.
-function stampKey(config, target) {
-    const lock = lockFileOf(config);
-    return getContentHash(JSON.stringify({
-        format: CONAN_STAGE_FORMAT,
-        dependencies: config.conanDependencies,
-        host: hostProfile(target),
-        build: BUILD_PROFILE,
-        toolchain: conanRunner(config, target) === 'LOCAL' ? localToolchainIdentity(target) : getDockerImage(imageRoleFor(target)),
-        lock: fs.existsSync(lock) ? fs.readFileSync(lock, 'utf8') : null,
-    }));
-}
-
-// The target's manifest names the dependencies it was staged for.
-const isStaged = (config, stageDir, target) => loadJson(stampFileOf(stageDir, target))?.key === stampKey(config, target)
-    && readConanManifest(stageDir, conanDependenciesKey(config.conanDependencies), target.path) !== null;
-
-function conanFailure(target, result, logFile) {
-    if (result.error && result.error.code !== 'ENOBUFS') {
-        return new Error(`crossbind: could not run conan for ${target.path} (${result.error.message}).`);
-    }
-    let ending = `failed (exit code ${result.status})`;
-    if (result.error) ending = 'was stopped: it printed more than crossbind reads';
-    else if (result.signal) ending = `was stopped by ${result.signal}`;
-    const tail = printable(`${result.stderr ?? ''}`).trim().split('\n').slice(-LOG_TAIL_LINES).join('\n');
-    return new Error(`crossbind: conan install for ${target.path} ${ending}. Its whole log is in ${logFile}.\n${tail}`);
-}
-
-// The parsed file, or null. The parse error is left out: it quotes the text, which recipes can write.
-function readJson(file) {
-    try {
-        return JSON.parse(fs.readFileSync(file, 'utf8'));
-    } catch {
-        return null;
-    }
-}
-
-// The lockfile comes back from where the recipes ran, so only a lockfile goes into the project.
-function lockfileText(file) {
-    const lock = readJson(file);
-    if (typeof lock?.version !== 'string') {
-        throw new Error('crossbind: conan wrote no lockfile crossbind can read, so conan.lock is left as it was.');
-    }
-    return `${JSON.stringify(lock, null, 4)}\n`;
-}
-
-function installTarget(config, stageDir, target) {
-    const dependencies = config.conanDependencies;
-    const lock = lockFileOf(config);
-    const hasLock = fs.existsSync(lock);
-    const stampFile = stampFileOf(stageDir, target);
-    const logFile = logFileOf(stageDir, target);
-    // A restage that stops halfway must not pass for a finished one.
-    fs.rmSync(stampFile, { force: true });
-    const work = createConanWork(conanRunner(config, target));
-    const label = `conan ${target.path}`;
-    logger.startTask(label);
-    try {
-        fs.writeFileSync(upath.join(work.dir, 'host.profile'), hostProfile(target));
-        fs.writeFileSync(upath.join(work.dir, 'build.profile'), BUILD_PROFILE);
-        const settings = settingsUser(target);
-        if (settings) fs.writeFileSync(upath.join(work.dir, 'home', 'settings_user.yml'), settings);
-        if (hasLock) fs.copyFileSync(lock, upath.join(work.dir, 'input.lock'));
-        const result = runConan([
-            'install',
-            ...conanRequires(dependencies).flatMap((reference) => ['--requires', reference]),
-            ...conanOptionArgs(dependencies),
-            '-pr:h', work.conanPath('host.profile'),
-            '-pr:b', work.conanPath('build.profile'),
-            '--output-folder', work.conanPath('output'),
-            '--build=missing',
-            '--format=json',
-            // A file, since a build tool writing to stdout would end up inside the JSON.
-            '--out-file', work.conanPath('graph.json'),
-            // Unless told which lockfile to use, conan takes any conan.lock in its working directory.
-            ...(hasLock ? ['--lockfile', work.conanPath('input.lock'), '--lockfile-partial'] : ['--lockfile=']),
-            '--lockfile-out', work.conanPath('resolution.lock'),
-        ], { config, target, work });
-        writeIfChanged(logFile, `${result.stderr ?? ''}`);
-        if (result.error || result.status !== 0) throw conanFailure(target, result, logFile);
-
-        const graph = readJson(upath.join(work.dir, 'graph.json'))?.graph;
-        if (!graph) throw new Error(`crossbind: conan install wrote no graph crossbind can read. Its log is in ${logFile}.`);
-        const packages = conanPackagesOf(graph);
-        const distCmake = fs.readFileSync(upath.join(config.paths.cli, 'assets', 'cmake', 'dist.cmake'), 'utf8');
-        packages.forEach((pkg) => stageConanPackage(pkg, {
-            stageDir, targetPath: target.path, toHost: (reported) => toHostPath(reported, work), store: work.store, distCmake,
-        }));
-        writeConanManifest(stageDir, target.path, {
-            key: conanDependenciesKey(dependencies),
-            packages: packages.map(({
-                packageFolder, includedirs, libdirs, ...entry
-            }) => entry),
-        });
-        writeIfChanged(lock, lockfileText(upath.join(work.dir, 'resolution.lock')));
-        writeIfChanged(stampFile, `${JSON.stringify({ key: stampKey(config, target) })}\n`);
-        logger.doneTask(label, packages.map((pkg) => `${pkg.name} ${pkg.version}`).join(', '));
-    } finally {
-        // Not over the error that ended the run; the next install clears what is left.
-        try {
-            removeConanWork(work);
-        } catch (e) {
-            logger.info(`crossbind: could not remove ${work.dir} (${e.message}).`);
-        }
-    }
-}
-
-// Installs the declared Conan packages for every target not staged from the same inputs yet, and
-// says whether it staged any, so the caller attaches the new manifest.
-export default async function installConanPackages(config, targets) {
-    if (Object.keys(config.conanDependencies ?? {}).length === 0) return false;
-    const stageDir = conanStageDir(config.paths.cache);
-    const pending = targets.filter((target) => !isStaged(config, stageDir, target));
-    if (pending.length === 0) return false;
-    for (const runner of new Set(pending.map((target) => conanRunner(config, target)))) {
-        // A conan store takes one writer at a time, and every project on the machine shares it.
-        await withDirLock(`${conanRoot(runner)}-install.lock`, async () => {
-            clearConanWork(runner);
-            pending.filter((target) => conanRunner(config, target) === runner && !isStaged(config, stageDir, target))
-                .forEach((target) => installTarget(config, stageDir, target));
-        });
-    }
-    return true;
-}