crossbind 2.0.0-beta.68 → 2.0.0-beta.72

package/src/actions/getLinkInputs.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import getDependLibs from './getDependLibs.js';
 import state from '../state/index.js';
 import buildAppRustCrates from '../utils/appRustCrates.js';
+import { cratesOf } from '../utils/packageSourceImport.js';
 
 // The archives of a final link (wasm, Node-API addon, native executable or app host) and which of them must
 // survive whole. keepFlag spells "keep this symbol" for the target's linker; a native executable
@@ -22,7 +23,7 @@ export default function getLinkInputs(target, { keepFlag, withBridge = true, bri
     const bridgeLibCandidates = builtLib(bridge);
     // App-local Rust surfaces (imported .rs files) arrive as ONE super staticlib; it is the
     // single fully-loaded Rust archive of the link (see the libstd rule below).
-    const appRustLibs = buildAppRustCrates(target, cache, state.config.cargoDependencies ?? {});
+    const appRustLibs = buildAppRustCrates(target, cache, cratesOf(state.config));
     const libs = [
         ...getDependLibs(target),
         ...appRustLibs,

package/src/actions/gradleProject.js

@@ -5,6 +5,8 @@ import { ANDROID_API_LEVEL } from '../utils/androidToolchain.js';
 import { HERMES } from '../utils/hermes.js';
 import resolveAppHostRoot from '../utils/resolveAppHost.js';
 import { SIGNING } from './androidGradle.js';
+import { appLinkParts } from '../utils/appLaunches.js';
+import { mergedVerification } from './mavenVerification.js';
 
 // The ABIs an Android app builds for: phones and Apple silicon's emulators, and the emulators of x86_64 machines.
 export const ANDROID_ABIS = ['arm64-v8a', 'x86_64'];
@@ -34,6 +36,21 @@ const backgroundValues = (color) => `<?xml version="1.0" encoding="utf-8"?>
 </resources>
 `;
 
+// The color while the system is dark, where app.window.backgroundColor gives one, which Android takes in place of the other.
+const darkBackgroundValues = (color) => `<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <color name="crossbind_background">${color}</color>
+</resources>
+`;
+
+// The devices of app.permissions, which alone the page may ask for, whatever an extension's Java asks Android for.
+const permissionValues = (permissions) => `<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string-array name="crossbind_permissions">${permissions.map((name) => `\n        <item>${name}</item>`).join('')}
+    </string-array>
+</resources>
+`;
+
 // The Android permissions behind each of app.permissions, after the one every app asks for; the activity asks its user
 // for them when the page first uses the device.
 const INTERNET = '    <uses-permission android:name="android.permission.INTERNET" />';
@@ -42,22 +59,138 @@ const ANDROID_PERMISSIONS = {
     microphone: ['RECORD_AUDIO', 'MODIFY_AUDIO_SETTINGS'],
     location: ['ACCESS_COARSE_LOCATION', 'ACCESS_FINE_LOCATION'],
 };
-const usesPermissions = (permissions) => permissions
-    .flatMap((name) => ANDROID_PERMISSIONS[name])
-    .map((permission) => `    <uses-permission android:name="android.permission.${permission}" />`);
+// The permissions the app asks for beside INTERNET, each once: app.permissions' and its extensions'.
+const usesPermissions = (permissions, extensionPermissions) => [...new Set([
+    ...permissions.flatMap((name) => ANDROID_PERMISSIONS[name]).map((permission) => `android.permission.${permission}`),
+    ...extensionPermissions,
+])].filter((permission) => permission !== 'android.permission.INTERNET')
+    .map((permission) => `    <uses-permission android:name="${permission}" />`);
 
-// The links of app.urlSchemes the activity opens, from a browser as well, before the end of the activity's element.
+// What an extension's own manifest adds to the app's: the elements of its manifest, and those of its application, which
+// go inside the app's, whose attributes are the app's alone. The app's manifest declares the android and tools prefixes.
+const APPLICATION_END = '    </application>';
+const PREFIXES = ['android', 'tools'];
+
+// A manifest's text without its comments, removed until none is left, as removing one may join others into one.
+function withoutComments(text) {
+    let current = text;
+    let previous;
+    do {
+        previous = current;
+        current = current.replace(/<!--[\s\S]*?-->/g, '');
+    } while (current !== previous);
+    return current;
+}
+
+function manifestParts(name, file) {
+    const text = withoutComments(fs.readFileSync(file, 'utf8').replace(/<\?xml[\s\S]*?\?>/, ''));
+    const root = /^\s*<manifest\b([^>]*)>([\s\S]*)<\/manifest>\s*$/.exec(text);
+    if (!root) throw new Error(`crossbind: the extension ${name}'s manifest ${file} is no <manifest> of elements, as an AndroidManifest.xml is.`);
+    const other = [...root[1].matchAll(/xmlns:([\w-]+)/g)].map(([, prefix]) => prefix).find((prefix) => !PREFIXES.includes(prefix));
+    if (other) throw new Error(`crossbind: the extension ${name}'s manifest ${file} declares the prefix ${other}, which the app's has not: it takes android and tools.`);
+    const attribute = [...root[1].matchAll(/([\w:.-]+)\s*=/g)].map(([, key]) => key).find((key) => !key.startsWith('xmlns'));
+    if (attribute) throw new Error(`crossbind: the extension ${name}'s manifest ${file} gives its <manifest> ${attribute}, which is the app's own.`);
+    // The permissions it asks for are those its permissions list, which the app asks for once each.
+    if (/<uses-permission[\s/>]/.test(root[2])) {
+        throw new Error(`crossbind: the extension ${name}'s manifest ${file} asks for a permission with <uses-permission>, which its app.android.permissions lists, as the app asks for each once.`);
+    }
+    const applications = [...root[2].matchAll(/<application\b([^>]*?)(?:\/>|>([\s\S]*?)<\/application>)/g)];
+    if (applications.length > 1) throw new Error(`crossbind: the extension ${name}'s manifest ${file} holds ${applications.length} <application> elements, of which it takes one.`);
+    const [application] = applications;
+    if (application && application[1].trim() !== '') {
+        throw new Error(`crossbind: the extension ${name}'s manifest ${file} gives its <application> attributes, which are the app's own: it holds what the extension adds to the app's alone.`);
+    }
+    return { manifest: application ? root[2].replace(application[0], '') : root[2], application: application?.[2] ?? '' };
+}
+
+// An extension's elements, as the app's manifest holds them, at the indentation of their place there.
+function indented(text, indent) {
+    const lines = text.split('\n').filter((line, index, all) => line.trim() !== '' || (index > all.findIndex((one) => one.trim() !== '')
+        && index < all.findLastIndex((one) => one.trim() !== '')));
+    const margin = Math.min(...lines.filter((line) => line.trim() !== '').map((line) => /^[ \t]*/.exec(line)[0].length));
+    return lines.map((line) => (line.trim() === '' ? '' : `${indent}${line.slice(margin).trimEnd()}`)).join('\n');
+}
+
+// What the activity opens, from a browser or a file manager as well, before the end of the activity's element.
 const ACTIVITY_END = '        </activity>';
-const urlFilter = (schemes) => [
-    '            <intent-filter>',
+const viewFilter = (data, isVerified = false) => [
+    `            <intent-filter${isVerified ? ' android:autoVerify="true"' : ''}>`,
     '                <action android:name="android.intent.action.VIEW" />',
     '                <category android:name="android.intent.category.DEFAULT" />',
     '                <category android:name="android.intent.category.BROWSABLE" />',
-    ...schemes.map((scheme) => `                <data android:scheme="${scheme}" />`),
+    ...data.map((attributes) => `                <data ${attributes} />`),
     '            </intent-filter>',
 ].join('\n');
+// The links of the app's schemes.
+const urlFilter = (schemes) => viewFilter(schemes.map((scheme) => `android:scheme="${scheme}"`));
+// The files of the app's types, which other apps hand it as content: addresses alone, as a file: one would have the app
+// read its own: by their MIME types, as Android matches what a content provider gives, else by their names' extensions,
+// which a provider's path shows or not; .*\\. takes one dot, and Android's pattern a single match.
+const fileFilters = (fileTypes) => fileTypes.map(({ extensions, mimeTypes }) => viewFilter(['android:scheme="content"', ...(mimeTypes.length > 0
+    ? mimeTypes.map((mime) => `android:mimeType="${mime}"`)
+    : ['android:host="*"', 'android:mimeType="*/*"', ...extensions.flatMap((ending) => [`android:pathPattern=".*\\\\.${ending}"`, `android:pathPattern=".*\\\\..*\\\\.${ending}"`])])]));
+// The https links of app.links, which Android verifies against each site's assetlinks.json.
+const linkFilters = (links) => links.map((link) => {
+    const { host, path: prefix } = appLinkParts(link);
+    return viewFilter(['android:scheme="https"', `android:host="${host}"`, ...(prefix ? [`android:pathPrefix="${prefix}"`] : [])], true);
+});
+
+// The app's quick actions, Android's static shortcuts of its icon, which shows the app's icon beside each, or the
+// launcher's own without one: Android empties a static shortcut's task first, so a tap starts the host's trampoline,
+// which hands it to the activity that runs, with its page. Each label is a resource, as Android takes none other.
+const SHORTCUTS_META = '            <meta-data android:name="android.app.shortcuts" android:resource="@xml/shortcuts" />';
+const shortcutsXml = (items, id, icon) => `<?xml version="1.0" encoding="utf-8"?>
+<shortcuts xmlns:android="http://schemas.android.com/apk/res/android">
+${items.map(({ type }, index) => [
+        `    <shortcut android:shortcutId="${type}"${icon ? ` android:icon="${icon}"` : ''} android:shortcutShortLabel="@string/crossbind_shortcut_${index}">`,
+        `        <intent android:action="dev.crossbind.app.SHORTCUT" android:targetPackage="${id}" android:targetClass="dev.crossbind.app.CrossbindShortcutActivity">`,
+        // Android reads an extra's value of digits, or true or false, as a number or a boolean: after a prefix, each is text.
+        `            <extra android:name="dev.crossbind.app.shortcut" android:value="type:${type}" />`,
+        '        </intent>',
+        '    </shortcut>',
+    ].join('\n')).join('\n')}
+</shortcuts>
+`;
+// Text as a string resource holds it as it is: XML's escapes, and a backslash before what aapt reads otherwise, a quote,
+// an apostrophe, a backslash and an @ or a ? that starts it after any space; formatted="false" keeps a % as it is.
+const androidText = (text) => text.replace(/[\\'"]/g, '\\$&').replace(/^(\s*)([@?])/, '$1\\$2').replace(/&/g, '&amp;').replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+const shortcutLabels = (items) => `<?xml version="1.0" encoding="utf-8"?>
+<resources>
+${items.map(({ title }, index) => `    <string name="crossbind_shortcut_${index}" formatted="false">${androidText(title)}</string>`).join('\n')}
+</resources>
+`;
+
+// The class of each extension's Java, which the activity calls by the extension's name, in the extensions' order.
+const extensionsJava = (java) => `// crossbind writes this file from the app's extensions: the class of each one's Java, under its name, and the holder of
+// each of the host's roles it holds.
+package dev.crossbind.app;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.Map;
 
-const buildGradle = ({ id, label, version, abis, icon, launchMode, theme }) => `// crossbind writes this project anew on every build: the module comes prebuilt in src/main/jniLibs/, and the app's
+final class Extensions {
+    // In the order of the app's extensions, in which each hears what the activity does.
+    static final Map<String, Extension> ALL;
+    // By the role, as page-dialogs, whose requests the activity hands its holder's Java.
+    static final Map<String, Extension> ROLES;
+
+    static {
+        Map<String, Extension> all = new LinkedHashMap<>();${java.map(({ name, className }) => `
+        all.put(${JSON.stringify(name)}, new ${className}());`).join('')}
+        ALL = Collections.unmodifiableMap(all);
+        Map<String, Extension> roles = new HashMap<>();${java.flatMap(({ name, roles = [] }) => roles.map((role) => `
+        roles.put(${JSON.stringify(role)}, all.get(${JSON.stringify(name)}));`)).join('')}
+        ROLES = Collections.unmodifiableMap(roles);
+    }
+
+    private Extensions() {}
+}
+`;
+
+const buildGradle = ({ id, label, version, abis, icon, launchMode, theme, libraries = [] }) => `// crossbind writes this project anew on every build: the module comes prebuilt in src/main/jniLibs/, and the app's
 // files are in src/main/assets/app/.
 plugins {
     id 'com.android.application'
@@ -133,26 +266,62 @@ dependencies {
         }
     }
     implementation 'androidx.webkit:webkit:${ANDROIDX_WEBKIT}'
-}
+${libraries.map((library) => `    implementation '${library}'\n`).join('')}}
 `;
 
 // An Android app as a Gradle project, written anew from the parts its ABI targets built: each brings its libraries,
-// the first also the app's files. Gradle adds Hermes and androidx.webkit from Maven, and makes the APK or the bundle.
-// The icons given are the files of the app's launcher icon under res/; without them it has the system's.
-export default function writeGradleProject(to, { parts, id, label, version, icons = null, urlSchemes = [], background = null, permissions = [] }) {
+// the first also the app's files. Gradle adds Hermes, androidx.webkit and its extensions' libraries from Maven, and makes
+// the APK or the bundle.
+// The icons given are the files of the app's launcher icon under res/; without them it has the system's. Each of java
+// is an extension's folder of Java sources, by package, which the app's sources take beside the activity, and the
+// class in it the activity calls.
+export default function writeGradleProject(to, {
+    parts, id, label, version, icons = null, urlSchemes = [], fileTypes = [], links = [], shortcutItems = [], background = null, darkBackground = null,
+    permissions = [], java = [], extensionPermissions = [], manifests = [], resources = [], maven = [],
+}) {
     const { name } = state.config.general;
     if (parts.length === 0) throw new Error(`crossbind: no part of the Android app ${name} is built, so there is no Gradle project to write.`);
+    // What the extensions add is read before the project goes, which a manifest crossbind refuses then leaves as it was.
+    const added = manifests.map(({ name: extension, file }) => manifestParts(extension, file));
+    // An app whose extensions ask Maven for libraries checks every file Gradle resolves, which it then resolves online.
+    const verification = maven.length > 0 ? mergedVerification(
+        fs.readFileSync(path.join(resolveAppHostRoot(), 'android-verification-metadata.xml'), 'utf8'),
+        maven.map(({ name: extension, verification: file }) => ({ name: extension, xml: fs.readFileSync(file, 'utf8') })),
+    ) : null;
     fs.rmSync(to, { recursive: true, force: true });
     fs.cpSync(path.join(resolveAppHostRoot(), 'android'), to, { recursive: true });
+    if (verification) fs.writeFileSync(path.join(to, 'gradle', 'verification-metadata.xml'), verification);
     const main = path.join(to, 'app', 'src', 'main');
     const manifest = path.join(main, 'AndroidManifest.xml');
     const text = fs.readFileSync(manifest, 'utf8');
-    if (!text.includes(ACTIVITY_END) || !text.includes(INTERNET)) {
+    if (!text.includes(ACTIVITY_END) || !text.includes(INTERNET) || !text.includes(APPLICATION_END)) {
         throw new Error(`crossbind: ${manifest}, from the app host, has no activity or permissions to give app.urlSchemes and app.permissions: update @crossbind/core-app-host to match crossbind.`);
     }
+    const own = (key, indent) => added.map((part) => part[key]).filter((part) => part.trim() !== '').map((part) => indented(part, indent));
+    // A replacer, as the extensions' text may hold what a replacement string reads as a pattern, as $&.
     fs.writeFileSync(manifest, text
-        .replace(INTERNET, [INTERNET, ...usesPermissions(permissions)].join('\n'))
-        .replace(ACTIVITY_END, urlSchemes.length > 0 ? `${urlFilter(urlSchemes)}\n${ACTIVITY_END}` : ACTIVITY_END));
+        .replace(INTERNET, () => [INTERNET, ...usesPermissions(permissions, extensionPermissions), ...own('manifest', '    ')].join('\n'))
+        .replace(ACTIVITY_END, () => [
+            ...(urlSchemes.length > 0 ? [urlFilter(urlSchemes)] : []), ...fileFilters(fileTypes), ...linkFilters(links),
+            ...(shortcutItems.length > 0 ? [SHORTCUTS_META] : []), ACTIVITY_END,
+        ].join('\n'))
+        .replace(APPLICATION_END, () => [...own('application', '        '), APPLICATION_END].join('\n')));
+    fs.writeFileSync(path.join(main, 'java', 'dev', 'crossbind', 'app', 'Extensions.java'), extensionsJava(java));
+    // The Java and Kotlin sources of an extension's folder alone, which may hold its manifest and resources as well: the
+    // Android Gradle plugin compiles Kotlin beside the Java.
+    java.forEach(({ name: extension, dir }) => {
+        const sources = path.join(main, 'java');
+        const files = fs.readdirSync(dir, { recursive: true }).filter((file) => /\.(java|kt)$/.test(file) && fs.statSync(path.join(dir, file), { throwIfNoEntry: false })?.isFile());
+        files.forEach((file) => {
+            if (fs.existsSync(path.join(sources, file))) {
+                throw new Error(`crossbind: the extension ${extension} has ${file} in its Java, which the app's Gradle project has already.`);
+            }
+        });
+        files.forEach((file) => {
+            fs.mkdirSync(path.dirname(path.join(sources, file)), { recursive: true });
+            fs.copyFileSync(path.join(dir, file), path.join(sources, file));
+        });
+    });
     parts.forEach(({ arch, dir }) => fs.cpSync(path.join(dir, 'lib'), path.join(main, 'jniLibs', arch), { recursive: true }));
     // A release keeps its libraries as linked beside the stripped ones it ships, for Google Play's crash reports.
     parts.filter(({ dir }) => fs.existsSync(path.join(dir, 'symbols')))
@@ -166,9 +335,31 @@ export default function writeGradleProject(to, { parts, id, label, version, icon
     }
     fs.mkdirSync(path.join(main, 'res', 'values'), { recursive: true });
     fs.writeFileSync(path.join(main, 'res', 'values', 'background.xml'), backgroundValues(background));
+    if (background && darkBackground) {
+        fs.mkdirSync(path.join(main, 'res', 'values-night'), { recursive: true });
+        fs.writeFileSync(path.join(main, 'res', 'values-night', 'background.xml'), darkBackgroundValues(darkBackground));
+    }
+    fs.writeFileSync(path.join(main, 'res', 'values', 'permissions.xml'), permissionValues(permissions));
+    if (shortcutItems.length > 0) {
+        fs.mkdirSync(path.join(main, 'res', 'xml'), { recursive: true });
+        fs.writeFileSync(path.join(main, 'res', 'xml', 'shortcuts.xml'), shortcutsXml(shortcutItems, id, icons ? '@mipmap/ic_launcher' : null));
+        fs.writeFileSync(path.join(main, 'res', 'values', 'shortcuts.xml'), shortcutLabels(shortcutItems));
+    }
+    // An extension's resources join the app's, of which they replace none.
+    resources.forEach(({ name: extension, dir }) => {
+        fs.readdirSync(dir, { recursive: true }).forEach((file) => {
+            const into = path.join(main, 'res', file);
+            if (fs.existsSync(into) && !fs.statSync(into).isDirectory()) {
+                throw new Error(`crossbind: the extension ${extension} has ${file} in its resources, which the app's Gradle project has already.`);
+            }
+        });
+        fs.cpSync(dir, path.join(main, 'res'), { recursive: true });
+    });
     fs.writeFileSync(path.join(to, 'app', 'build.gradle'), buildGradle({
         id, label, version, abis: parts.map(({ arch }) => arch), icon: icons ? '@mipmap/ic_launcher' : '@android:drawable/sym_def_app_icon',
-        launchMode: urlSchemes.length > 0 ? 'singleTask' : 'standard', theme: background ? '@style/CrossbindBackground' : DAY_NIGHT,
+        launchMode: urlSchemes.length + fileTypes.length + links.length + shortcutItems.length > 0 ? 'singleTask' : 'standard',
+        theme: background ? '@style/CrossbindBackground' : DAY_NIGHT,
+        libraries: [...new Set(maven.flatMap(({ coordinates }) => coordinates))],
     }));
     return to;
 }

package/src/actions/iosDevice.js

@@ -3,7 +3,7 @@ import os from 'node:os';
 import { spawn, spawnSync } from 'node:child_process';
 import { EXEC_MAX_BUFFER } from './run.js';
 import { appTeam } from './buildApp.js';
-import { xcodebuild, xcodeTeams } from './appStoreConnect.js';
+import { xcodebuild, xcodeTeams } from './xcodebuild.js';
 import state from '../state/index.js';
 import { appId } from '../utils/appOptions.js';
 
@@ -171,7 +171,7 @@ export function buildForIosDevice(project, device) {
     xcodebuild(`the build for ${device.name}`, [
         '-project', `${project}/${name}.xcodeproj`, '-scheme', name, '-configuration', 'Debug', '-sdk', 'iphoneos', '-destination', `id=${device.udid}`,
         '-allowProvisioningUpdates', '-allowProvisioningDeviceRegistration', `SYMROOT=${products}`, 'build',
-    ], `${products}/device.log`, { team, id: appId(state.config) });
+    ], { log: `${products}/device.log`, facts: { team, id: appId(state.config) } });
     return `${products}/Debug-iphoneos/${name}.app`;
 }
 

package/src/actions/iosSimulator.js

@@ -43,8 +43,8 @@ export function buildForSimulator(project, configuration = 'Release') {
     return `${products}/${configuration}-iphonesimulator/${name}.app`;
 }
 
-// Opens a Simulator build of an iOS app, with `env` in its environment. The process returned carries the app's output
-// and ends with the app; close() ends the app.
+// Opens a Simulator build of an iOS app, with `env` in its environment, in the Simulator of the device returned. The
+// process returned carries the app's output and ends with the app; close() ends the app.
 export default function openInSimulator(app, { env = {}, show = false, stdio = 'pipe' } = {}) {
     const device = simulator();
     // Simulator.app only shows the device, which runs the app without it as well.
@@ -59,5 +59,5 @@ export default function openInSimulator(app, { env = {}, show = false, stdio = '
         childEnv[`SIMCTL_CHILD_${key}`] = value;
     });
     const child = spawn('xcrun', ['simctl', 'launch', '--console-pty', '--terminate-running-process', device, bundleId], { env: childEnv, stdio });
-    return { child, close: () => spawnSync('xcrun', ['simctl', 'terminate', device, bundleId]) };
+    return { child, device, close: () => spawnSync('xcrun', ['simctl', 'terminate', device, bundleId]) };
 }

package/src/actions/licenses.js

@@ -12,7 +12,12 @@ import resolveAppHostRoot, { resolveAppEmbindJsiRoot } from '../utils/resolveApp
 import {
     HERMES, HERMES_ANDROID, HERMES_SOURCE, hermesUrl,
 } from '../utils/hermes.js';
+import { installersFor } from './appInstaller.js';
+import { DESKTOP_PLATFORMS } from './buildApp.js';
+import extensionsInApp from './extensionsInApp.js';
 import { ANDROIDX_WEBKIT } from './gradleProject.js';
+import { extensionPackage, extensionPart } from '../utils/appExtensions.js';
+import { declaredSources, declarationOf, dependenciesOf } from '../utils/packageSources.js';
 import { shippedBundledLicense } from '../utils/bundledLicenses.js';
 import toolchainNoticesDir from '../utils/toolchainNotices.js';
 
@@ -208,13 +213,12 @@ function nodeRuntimeRows({ isAddon }) {
     }];
 }
 
-// What an app's host carries beside crossbind's runtime, pinned as the third_party READMEs of @crossbind/core-app-host
+// What an app's host carries beside crossbind's runtime, pinned as the READMEs beside them in @crossbind/core-app-host
 // record: React Native's Hermes, JSI's jsi.cpp from the same release, webview/webview, and on Windows the WebView2 SDK's
 // headers.
 const WEBVIEW = { version: 'cbbdee44afff22867de9fd88a9fc8350d9bdd399', sha256: '10e972a2327b5681474f4aa4499e505eaa4ff659aa995380386f08fd6fc1b763' };
 const WEBVIEW2_SDK = { version: '1.0.4258.31', sha256: '56f7f4b8bf9aee4b8efefbbdd4f67d5f74ebd1b100ed0806da71bf76af481aa9' };
 const JSI_SHA256 = 'cb6274a22abc93ecc970066539815e716d3e47716e8f93a9971cf4eb5918ffc1';
-const MONOCYPHER = { version: '4.0.3', sha256: '8cc9bc341a66249016db9bd70e9142d8d0aef9945973744b1ac05dbc55d8ee66' };
 // The fbjni the Hermes release for Android depends on.
 const FBJNI_VERSION = '0.7.0';
 
@@ -273,8 +277,8 @@ function androidAppRows() {
     ];
 }
 
-// The WebView2 SDK headers a Windows host compiles against, and the NSIS its setup program carries. webview/webview
-// loads the WebView2 Runtime itself, without the SDK's loader.
+// The WebView2 SDK headers a Windows host compiles against. webview/webview loads the WebView2 Runtime itself, without the
+// SDK's loader.
 function windowsAppRows(hostRoot) {
     const license = 'BSD-3-Clause';
     return [{
@@ -290,22 +294,73 @@ function windowsAppRows(hostRoot) {
         sourceUrl: `https://api.nuget.org/v3-flatcontainer/microsoft.web.webview2/${WEBVIEW2_SDK.version}/microsoft.web.webview2.${WEBVIEW2_SDK.version}.nupkg`,
         licenseNotes: "the WebView2 SDK's headers from the windows toolchain image, whose interface IDs the host compiles in",
         licenseText: textOf(path.join(hostRoot, 'third_party', 'webview2', 'LICENSE')),
-    }, {
-        npmName: '@crossbind/core-app-host',
-        name: 'nsis',
-        version: '3.11',
-        nativeVersion: '3.11',
-        sha256: null,
-        license: 'Zlib AND MIT',
-        licenseDeclared: 'Zlib AND MIT',
-        licenseSelected: null,
-        isCopyleft: false,
-        sourceUrl: 'https://sources.debian.org/src/nsis/3.11-1/',
-        licenseNotes: "the installer stub and plugins the app's setup program carries, from Debian's nsis in the windows toolchain image: zlib/libpng, but for the System plugin's Call.S, MIT",
-        licenseText: textOf(path.join(hostRoot, 'third_party', 'nsis', 'LICENSE')),
     }];
 }
 
+const APP_PLATFORMS = ['darwin', 'ios', 'android', 'linux', 'win32'];
+
+// The extensions an app of this platform has, of any platform's without one: crossbind's own that bring it code, and those
+// crossbind.config.js lists.
+function extensionsIn(platform) {
+    if (!platform) return [...new Map(APP_PLATFORMS.flatMap((one) => extensionsIn(one)).map((extension) => [extension.name, extension])).values()];
+    const listed = (state.config.extensions ?? []).map(({ name }) => name);
+    const hasCode = (extension) => {
+        const { native, java } = extensionPart([extension], platform);
+        return native.length > 0 || java.length > 0;
+    };
+    return extensionsInApp(platform).filter((extension) => listed.includes(extension.name) || hasCode(extension));
+}
+
+// A row of the code of others an extension carries, by what its licenses list says of it.
+const carriedRow = (entry, root, notes) => ({
+    npmName: null,
+    name: entry.name,
+    version: null,
+    nativeVersion: entry.version,
+    sha256: entry.sha256 ?? null,
+    license: entry.license,
+    licenseDeclared: entry.license,
+    licenseSelected: null,
+    isCopyleft: isCopyleft(entry.license),
+    sourceUrl: entry.source ?? null,
+    licenseNotes: entry.notes ?? notes,
+    licenseText: textOf(path.join(root, entry.file)),
+});
+
+// What the installers of a desktop app carry into what they make.
+const installerRows = (platform) => (DESKTOP_PLATFORMS[platform] ? installersFor({ platform }) : [])
+    .flatMap(({ name, root, installer }) => (installer.licenses ?? []).map((entry) => carriedRow(entry, root, `carried by what the installer ${name} makes`)));
+
+// What an app's extensions bring into it: each extension package's own code, and the code of others each carries, as its
+// app.licenses lists it. An extension in the project's own folders is the project's code, as the app is.
+function extensionRows(platform) {
+    return extensionsIn(platform).flatMap((extension) => {
+        const own = extensionPackage(extension.root, state.config.paths.base);
+        const owner = own?.manifest.name ?? null;
+        const license = own?.manifest.license ?? null;
+        const shipped = own && packageLicenseFile(own.dir);
+        const packageRows = own && !own.manifest.private ? [{
+            npmName: owner,
+            name: owner,
+            version: own.manifest.version ?? null,
+            nativeVersion: null,
+            license,
+            licenseDeclared: license,
+            licenseSelected: null,
+            isCopyleft: Boolean(license) && isCopyleft(license),
+            sourceUrl: own.manifest.homepage ?? null,
+            licenseNotes: `the app extension ${extension.name}, which the app's host compiles in`,
+            licenseText: shipped ? textOf(shipped) : null,
+        }] : [];
+        const carried = (extension.app.licenses ?? []).map((entry) => carriedRow(
+            entry,
+            extension.root,
+            `carried by the app extension ${extension.name}${owner ? ` of ${owner}` : ''}, which the app's host compiles in`,
+        ));
+        return [...packageRows, ...carried];
+    });
+}
+
 function appRuntimeRows(platform) {
     const hostRoot = resolveAppHostRoot();
     const hermesLicense = textOf(path.join(hostRoot, 'third_party', 'jsi', 'LICENSE'));
@@ -347,24 +402,9 @@ function appRuntimeRows(platform) {
             nativeVersion: WEBVIEW.version,
             sha256: WEBVIEW.sha256,
             sourceUrl: 'https://github.com/webview/webview',
-            licenseNotes: 'webview/webview, with the local patch @crossbind/core-app-host lists',
+            licenseNotes: 'webview/webview, with the local patches @crossbind/core-app-host lists',
             licenseText: textOf(path.join(hostRoot, 'third_party', 'webview', 'LICENSE')),
         }]),
-        // A desktop host checks its updates with Monocypher, which the linker leaves out of one without app.updater.
-        ...(['ios', 'android'].includes(platform) || state.config.app?.updater === undefined ? [] : [{
-            npmName: '@crossbind/core-app-host',
-            name: 'monocypher',
-            version: MONOCYPHER.version,
-            nativeVersion: MONOCYPHER.version,
-            sha256: MONOCYPHER.sha256,
-            license: 'BSD-2-Clause OR CC0-1.0',
-            licenseDeclared: 'BSD-2-Clause OR CC0-1.0',
-            licenseSelected: null,
-            isCopyleft: false,
-            sourceUrl: `https://monocypher.org/download/monocypher-${MONOCYPHER.version}.tar.gz`,
-            licenseNotes: "Monocypher's Ed25519 and SHA-512, compiled into the host, which check the app's updates",
-            licenseText: textOf(path.join(hostRoot, 'third_party', 'monocypher', 'LICENCE.md')),
-        }]),
     ];
 }
 
@@ -419,9 +459,9 @@ async function buildRow(node) {
     };
 }
 
-// A Conan package's facts come from its recipe, and its texts from the licenses/ its package ships.
-function conanRow(node) {
-    const { conan } = node.general;
+// The facts of a package source's package come from its recipe, and its texts from the licenses/ its package ships.
+function sourcePackageRow(node) {
+    const { name: source, package: pkg } = node.general.packageSource;
     const licenseDir = `${node.paths.project}/licenses`;
     const files = fs.existsSync(licenseDir)
         ? fs.readdirSync(licenseDir, { recursive: true, withFileTypes: true }).filter((entry) => entry.isFile())
@@ -429,29 +469,32 @@ function conanRow(node) {
     const texts = files.map((entry) => path.join(entry.parentPath, entry.name)).sort()
         .map((file) => `=== ${path.relative(licenseDir, file)} ===\n\n${fs.readFileSync(file, 'utf8').trim()}`);
     return {
-        name: conan.name,
+        name: pkg.name,
         npmName: null,
         version: null,
-        nativeVersion: conan.version,
-        license: conan.license,
+        nativeVersion: pkg.version,
+        license: pkg.license,
         licenseDeclared: null,
         licenseSelected: null,
-        licenseNotes: `built from the ConanCenter recipe ${conan.ref}`,
-        sha256: conan.source?.sha256 ?? null,
-        sourceUrl: conan.source?.url ?? conan.homepage ?? null,
+        licenseNotes: `built from the ${source} package ${pkg.ref}`,
+        sha256: pkg.source?.sha256 ?? null,
+        sourceUrl: pkg.source?.url ?? pkg.homepage ?? null,
         licenseText: texts.length > 0 ? texts.join('\n\n') : null,
-        isCopyleft: isCopyleft(conan.license),
-        purl: `pkg:conan/${conan.name}@${conan.version}`,
+        isCopyleft: isCopyleft(pkg.license),
+        purl: `pkg:${source}/${pkg.name}@${pkg.version}`,
     };
 }
 
-// Conan packages join the graph from the stage a build makes; without it they would be left out unseen.
-function assertConanStaged() {
-    const attached = new Set(state.config.allDependencies.filter((d) => d.general.conan).map((d) => d.general.conan.name));
-    const missing = Object.keys(state.config.conanDependencies ?? {}).filter((name) => !attached.has(name));
-    if (missing.length > 0) {
-        throw new Error(`crossbind: the Conan packages ${missing.join(', ')} are not installed for the current conanDependencies, so their rows would be missing. Build the project first.`);
-    }
+// The packages of package sources join the graph from the stage a build makes; without it they would be left out unseen.
+function assertSourcesStaged() {
+    declaredSources(state.config).forEach(({ name }) => {
+        const attached = new Set(state.config.allDependencies.filter((d) => d.general.packageSource?.name === name)
+            .map((d) => d.general.packageSource.package.name));
+        const missing = Object.keys(dependenciesOf(state.config, name)).filter((pkg) => !attached.has(pkg));
+        if (missing.length > 0) {
+            throw new Error(`crossbind: the ${name} packages ${missing.join(', ')} are not installed for the current ${declarationOf(name)}, so their rows would be missing. Build the project first.`);
+        }
+    });
 }
 
 // platform (optional, e.g. 'wasi') additionally includes what that platform's
@@ -460,23 +503,25 @@ function assertConanStaged() {
 // addon of that platform compiles in, or without a platform the one its loader bundles;
 // runtimeEnv 'app' adds what an app's host carries.
 export default async function collectLicenseRows(platform = null, { runtimeEnv = null } = {}) {
-    assertConanStaged();
+    assertSourcesStaged();
     // The root package is a component too when it is a port: leaf -wasi packages have no deps but ship
     // their own upstream. A dependency that is no port, such as a library a project publishes, is one by
     // its package name; a private package is the project's own code, like the app.
-    const keyOf = (node) => (node.general.conan ? `conan:${node.general.conan.name}` : node.general.alias?.package ?? node.package?.name);
+    const keyOf = ({ general, package: manifest }) => (general.packageSource
+        ? `${general.packageSource.name}:${general.packageSource.package.name}`
+        : general.alias?.package ?? manifest?.name);
     const nodes = [state.config, ...state.config.allDependencies]
         .filter((node, index) => node?.paths?.project
-            && (node.general?.alias?.package || node.general?.conan || (index > 0 && node.package?.name && !node.package.private)));
+            && (node.general?.alias?.package || node.general?.packageSource || (index > 0 && node.package?.name && !node.package.private)));
     const rows = [];
     const seen = new Set();
     for (const node of nodes) {
         const key = keyOf(node);
         if (seen.has(key)) continue;
         seen.add(key);
-        rows.push(node.general.conan ? conanRow(node) : await buildRow(node));
-        // A Conan package's folder is written from what its recipe produced: nothing there is run.
-        if (platform && !node.general.conan) {
+        rows.push(node.general.packageSource ? sourcePackageRow(node) : await buildRow(node));
+        // A package source's package folder is written from what its recipe produced: nothing there is run.
+        if (platform && !node.general.packageSource) {
             const familyProjects = nodes.filter((other) => keyOf(other) === key).map((other) => other.paths.project);
             rows.push(...await bundledRowsOf(node, platform, familyProjects));
         }
@@ -484,6 +529,16 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
     if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
     if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
-    if (runtimeEnv === 'app') rows.push(...appRuntimeRows(platform));
+    if (runtimeEnv === 'app') {
+        rows.push(...appRuntimeRows(platform));
+        // A library two extensions carry, or one the app has already, is listed once for each version the app ships.
+        const versionOf = (row) => `${row.name}@${row.nativeVersion ?? row.version}`;
+        const listed = new Set(rows.map(versionOf));
+        for (const row of [...extensionRows(platform), ...installerRows(platform)]) {
+            if (listed.has(versionOf(row))) continue;
+            listed.add(versionOf(row));
+            rows.push(row);
+        }
+    }
     return rows.sort((a, b) => a.name.localeCompare(b.name));
 }