crossbind 2.0.0-beta.68 → 2.0.0-beta.72

package/src/bin.js

@@ -15,13 +15,13 @@ import buildWasiCommand from './actions/buildWasiCommand.js';
 import buildNode, { addonsInPackages, bundleNodeLoader, publishNodeData } from './actions/buildNode.js';
 import buildNativeCommand from './actions/buildNativeCommand.js';
 import buildApp, { appOutputPath, assertAppRunner, publishApp } from './actions/buildApp.js';
-import { UPDATER_KEY, newUpdaterKey } from './actions/appUpdate.js';
 import {
     makeUploadKey, releaseSigningEnv, showUploadKeyPassword, useUploadKey,
 } from './actions/uploadKey.js';
-import { publishAndroid } from './actions/publishAndroid.js';
-import { publishIos } from './actions/publishIos.js';
+import publish, { publishHelp, publishersOf } from './actions/publish.js';
 import { iosDeviceOption } from './actions/iosDevice.js';
+import addExtension from './actions/addExtension.js';
+import addExtensionCommands from './actions/extensionCommands.js';
 import buildExternal from './actions/buildExternal.js';
 import buildPackageTypes from './actions/buildTypes.js';
 import buildLib from './actions/buildLib.js';
@@ -44,7 +44,8 @@ import {
     RUNNER_PLATFORMS, RUNNER_ROLES, connectCommands, deleteRunner, deploySteps, initRunner, newRunnerToken, runnerHostPort, startRunner,
 } from './actions/runnerCommands.js';
 import { cargoHome } from './utils/runCargo.js';
-import { conanRoot } from './utils/runConan.js';
+import { containerRootOf, sourceRoot } from './utils/runPackageSource.js';
+import { importSchemesOf, sourceNamesOf } from './utils/packageSources.js';
 import { cleanDepsCache } from './utils/dependencyRebuild.js';
 import collectLicenseRows from './actions/licenses.js';
 import { formatNoticesMarkdown, formatCycloneDxSbom, validateSpdx } from './utils/licenseReport.js';
@@ -113,12 +114,18 @@ function declaredSbomPath(projectDir) {
 const APP_PLATFORMS = ['android', 'ios', 'linux', 'macos', 'windows'];
 
 function projectVite() {
+    let manifestPath;
     try {
-        const manifest = createRequire(`${state.config.paths.project}/package.json`).resolve('vite/package.json');
-        return path.join(path.dirname(manifest), JSON.parse(fs.readFileSync(manifest, 'utf8')).bin.vite);
+        manifestPath = createRequire(`${state.config.paths.project}/package.json`).resolve('vite/package.json');
     } catch {
         throw new Error("crossbind: crossbind app builds the app's page with the project's Vite, which the project does not have. Add vite and @crossbind/plugin-vite to it, as the desktop-app template has them.");
     }
+    // A workspace can map vite to a package of Vite's API alone.
+    const { name, version, bin } = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    if (!bin?.vite) {
+        throw new Error(`crossbind: crossbind app runs the vite command, and the project's vite resolves to ${name} ${version}, which has none. Have vite resolve to Vite itself for the project, with an override where its workspace maps vite to another package.`);
+    }
+    return path.join(path.dirname(manifestPath), bin.vite);
 }
 
 // The project's Vite, as `crossbind app dev`, `build` and `publish` run it, and its exit code once it ends. A signal sent
@@ -167,14 +174,6 @@ const commandApp = program.command('app').description('build the project as an a
         });
 });
 
-commandApp.command('updater-key')
-    .description("make the key pair that signs a desktop app's updates")
-    .action(() => {
-        const { publicKey, privateKey } = newUpdaterKey();
-        console.log(`crossbind: app.updater.publicKey in crossbind.config.js: ${publicKey}`);
-        console.log(`crossbind: ${UPDATER_KEY}, kept secret where the app is built: ${privateKey}`);
-    });
-
 commandApp.command('upload-key')
     .description("make this machine's upload key, which signs an Android app's bundle for Google Play")
     .option('--use <keystore>', 'make a key you have the upload key instead, once it opens with its password')
@@ -188,26 +187,26 @@ commandApp.command('upload-key')
     });
 
 commandApp.command('publish')
-    .description('build the app and send it to its store: an Android bundle to a Google Play track, an iOS app to App Store Connect for TestFlight')
-    .addOption(new Option('-p, --platform <platform>', "the store's platform (default: CROSSBIND_APP_PLATFORM)").choices(['android', 'ios']))
-    .option('--track <track>', 'the Google Play track the release goes on: internal, alpha, beta, production or one of your own', 'internal')
-    .option('--draft', 'leave the Google Play release a draft, which Play Console rolls out')
-    // Vite's own options, as --mode, go on to Vite.
+    .usage('[store] [options]')
+    .description("build the app and send it to a store, as its publisher does, one of crossbind's own or of an extension's")
+    .addOption(new Option('-p, --platform <platform>', "the app's platform: without a store, the one that goes first for it (default: CROSSBIND_APP_PLATFORM, else for a store of desktop apps this machine's)").choices(APP_PLATFORMS))
+    .addHelpText('after', () => publishHelp(publishersOf(state.config?.extensions ?? [])))
+    // The store's own options, and Vite's, as --mode, which go on to Vite.
     .allowUnknownOption()
     .allowExcessArguments()
-    .action(async ({ platform, track, draft }, command) => {
+    .action(async ({ platform }, command) => {
         assertAppProject();
-        const store = platform ?? process.env.CROSSBIND_APP_PLATFORM;
-        if (store === 'android') {
-            await publishAndroid({ track, status: draft ? 'draft' : 'completed', viteArgs: command.args }, { runVite });
-            return;
-        }
-        if (store !== 'ios') throw new Error('crossbind: crossbind app publish takes -p android or -p ios, the platform of the store it sends the app to.');
-        const playOptions = ['track', 'draft'].filter((option) => command.getOptionValueSource(option) === 'cli');
-        if (playOptions.length > 0) {
-            throw new Error(`crossbind: ${playOptions.map((option) => `--${option}`).join(' and ')} ${playOptions.length > 1 ? 'are' : 'is'} Google Play's; App Store Connect hands every iOS upload to TestFlight.`);
-        }
-        await publishIos({ viteArgs: command.args }, { runVite });
+        await publish(command.args, { platform, envPlatform: process.env.CROSSBIND_APP_PLATFORM, runVite });
+    });
+
+// crossbind app alone reads them, so that an extension's package that cannot be read stops no other command.
+if (process.argv[2] === 'app') addExtensionCommands(commandApp);
+
+program.command('add')
+    .description("install an app extension's package with the project's package manager and list it in crossbind.config.js's extensions")
+    .argument('<package>', "the package as a package manager takes it: its name, name@version or a path to it")
+    .action((spec) => {
+        addExtension(spec, { config: state.config });
     });
 
 program.command('licenses')
@@ -318,17 +317,18 @@ imageArgument(commandDocker.command('create').description('create docker contain
     .action((image) => {
         // Google ships the linux NDK for x86_64 only, so an android or android-app container is always amd64.
         const platform = ['android', 'android-app'].includes(image) ? 'linux/amd64' : undefined;
+        const sources = sourceNamesOf(state.config);
         // Docker on Linux makes a missing mount source owned by root, which the user's builds cannot write.
-        [cargoHome(), conanRoot()].forEach((dir) => fs.mkdirSync(dir, { recursive: true }));
+        [cargoHome(), ...sources.map((name) => sourceRoot(name))].forEach((dir) => fs.mkdirSync(dir, { recursive: true }));
         dockerExec([
             'run', '-dit',
             ...(platform ? ['--platform', platform] : []),
             '--name', dockerContainerName(image),
             '-v', `${state.config.paths.base}:/tmp/crossbind/live`,
-            // Cargo's registry cache, shared with host builds and with every other project, and the
-            // Conan store and work directories every other container build uses.
+            // Cargo's registry cache, shared with host builds and with every other project, and each package
+            // source's store and work directories, which every other container build of it uses.
             '-v', `${cargoHome()}:/var/cache/crossbind/cargo`,
-            '-v', `${conanRoot()}:/var/cache/crossbind/conan`,
+            ...sources.flatMap((name) => ['-v', `${sourceRoot(name)}:${containerRootOf(name)}`]),
             getDockerImage(image, platform),
             'bash',
         ]);
@@ -535,7 +535,7 @@ async function createNodeAddons(targetParams) {
     if (headers.length && fs.existsSync(`${state.config.paths.output}/${loaderTarget.jsName}`)) {
         const entry = `${state.config.paths.output}/node/napi.mjs`;
         writeRuntimeEntry(entry, headers, ENTRY_RUNTIMES.node(loaderTarget.jsName));
-        if (imports.size) writeImportHooks(entry, headers, imports, nativeExtensions(state.config.ext));
+        if (imports.size) writeImportHooks(entry, headers, imports, nativeExtensions(state.config.ext), importSchemesOf(state.config));
         else removeImportHooks(entry);
     }
 }
@@ -611,7 +611,7 @@ async function createWasmJs(targetParams, wasmOptions = {}) {
     if (appHeaders.length && nodeTarget) {
         const entry = `${state.config.paths.output}/node/wasm.mjs`;
         writeRuntimeEntry(entry, appHeaders, ENTRY_RUNTIMES.node(nodeTarget.jsName));
-        if (imports.size) writeImportHooks(entry, appHeaders, imports, nativeExtensions(state.config.ext));
+        if (imports.size) writeImportHooks(entry, appHeaders, imports, nativeExtensions(state.config.ext), importSchemesOf(state.config));
         else removeImportHooks(entry);
     }
     if (headers.length && edgeTarget) {

package/src/index.js

@@ -4,9 +4,10 @@ export { default as createLib } from './actions/createLib.js';
 export { default as createBridgeFile } from './actions/createInterface.js';
 export { default as buildWasm } from './actions/buildWasm.js';
 export {
-    default as buildApp, buildProjectApp, publishApp, appLayout, appOutputName, appTargetParams,
+    default as buildApp, buildProjectApp, publishApp, appLayout, appOutputName, appPlatform, appTargetParams,
 } from './actions/buildApp.js';
-export { checkInstaller } from './actions/appInstaller.js';
+export { checkInstaller, shipApp } from './actions/appInstaller.js';
+export { resolveAppPageApi } from './utils/resolveAppHost.js';
 export { default as openInSimulator, buildForSimulator } from './actions/iosSimulator.js';
 export {
     default as openOnIosDevice, buildForIosDevice, connectedIosDevice, iosDeviceAddress, iosDevServer,
@@ -23,7 +24,7 @@ export { getTargetParams, getBuildTargets, getFilteredBuildTargets, getFilteredT
 export { default as getCrossbindScript, getRustJsScript } from './integration/getCrossbindScript.js';
 export { default as getDependFilePath } from './integration/getDependFilePath.js';
 export { default as buildDependencies, getDependenciesStamp } from './actions/buildDependencies.js';
-export { default as prepareConanDependencies } from './actions/prepareConanDependencies.js';
+export { default as preparePackageSources } from './actions/preparePackageSources.js';
 export { default as findFiles } from './utils/findFiles.js';
 export { getContentHash, getFileHash } from './utils/hash.js';
 export {

package/src/integration/getCrossbindScript.js

@@ -5,6 +5,7 @@ import loadJson from '../utils/loadJson.js';
 import state from '../state/index.js';
 import { parseSurface, createRustBridgeCrate, createCrateImportBridge } from '../utils/rustBridgeGen.js';
 import { parseCargoMarkerName } from '../utils/cargoImport.js';
+import { cratesOf } from '../utils/packageSourceImport.js';
 import { UNBOUND_MESSAGE } from '../assets/js-runtime/adapters/unboundMessage.js';
 
 // `base` is where the bundler serves the app from, as Vite's `base` names it; webpack's public path wins at run time.
@@ -62,7 +63,7 @@ export function getRustSymbols(rsFile) {
     // Marker under <cache>/rust-crates/: a direct crate import - the model comes from the
     // upstream crate's own source, and the bridge is synthesized against the cargo dependency.
     const { crateName, modulePath } = parseCargoMarkerName(path.basename(rsReal, '.rs'));
-    const cargoDeps = state.config.cargoDependencies ?? {};
+    const cargoDeps = cratesOf(state.config);
     if (Object.hasOwn(cargoDeps, crateName)
         && path.dirname(rsReal) === fs.realpathSync(path.join(state.config.paths.cache, 'rust-crates'))) {
         const { exports } = createCrateImportBridge({
@@ -92,7 +93,7 @@ export function getRustSymbols(rsFile) {
             projectPath: state.config.paths.project,
             dtsMode: state.config.dts,
             vectors,
-            cargoDependencies: state.config.cargoDependencies ?? {},
+            cargoDependencies: cratesOf(state.config),
             log: () => {},
         });
     }

package/src/integration/getDependFilePath.js

@@ -2,8 +2,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import state from '../state/index.js';
 import { parseCargoImport, writeCargoMarker } from '../utils/cargoImport.js';
-import { CONAN_PREFIX, resolveConanHeader } from '../utils/conanImport.js';
-import refreshConanDependencies from '../state/refreshConanDependencies.js';
+import { cratesOf, sourceOfImport, resolveSourceHeader } from '../utils/packageSourceImport.js';
+import refreshPackageSources from '../state/refreshPackageSources.js';
 
 const LAYOUT = { header: 'include', module: 'swig', source: '' };
 
@@ -85,20 +85,20 @@ export default function getDependFilePath(source, target) {
     // an undeclared crate is a hard, actionable error instead of a silent npm fallthrough.
     if (source.startsWith('cargo:')) {
         const cargoImport = parseCargoImport(source);
-        const cargoDeps = state.config.cargoDependencies ?? {};
-        if (!Object.hasOwn(cargoDeps, cargoImport.crateName)) {
-            throw new Error(`crossbind: '${source}' is not declared - add '${cargoImport.crateName}' to cargoDependencies in crossbind.config.`);
+        if (!Object.hasOwn(cratesOf(state.config), cargoImport.crateName)) {
+            throw new Error(`crossbind: '${source}' is not declared - add '${cargoImport.crateName}' to packages.cargo in crossbind.config.`);
         }
         const marker = writeCargoMarker(state.config.paths.cache, cargoImport);
         existsCache.set(marker, true);
         return marker;
     }
 
-    // `conan:<package>/<header>` names a header of a declared Conan package, staged per target like a
-    // port's prebuilt; from there the header takes the same path as any other.
-    if (source.startsWith(CONAN_PREFIX)) {
-        refreshConanDependencies(state.config);
-        return resolveConanHeader(state.config, source, target ?? state.targets.find((t) => t.platform === 'wasm'));
+    // `<source>:<package>/<header>`, as conan:zlib/zlib.h, names a header of a declared package of a package
+    // source, staged per target like a port's prebuilt; from there the header takes the same path as any other.
+    const packageSource = sourceOfImport(state.config, source);
+    if (packageSource) {
+        refreshPackageSources(state.config);
+        return resolveSourceHeader(state.config, packageSource.name, source, target ?? state.targets.find((t) => t.platform === 'wasm'));
     }
 
     const matches = getMatchingPackages(source);

package/src/program.js

@@ -6,7 +6,7 @@ import {
 } from './actions/cloudCommands.js';
 import { cloudUrl } from './utils/cloudAccount.js';
 import flattenConfigForTable from './utils/flattenConfigForTable.js';
-import loadSystemConfig, { systemConfigPath } from './utils/systemConfig.js';
+import loadSystemConfig, { extensionSettingsOf, systemConfigPath } from './utils/systemConfig.js';
 import systemKeys from './utils/systemKeys.js';
 import writeJson from './utils/writeJson.js';
 
@@ -19,7 +19,9 @@ export const handleFatal = (e) => {
         console.error(e);
     } else {
         let message = e?.message || String(e);
-        if (e?.cause?.message) message += `\n  caused by: ${e.cause.message.split('\n')[0]}`;
+        // A cause the message tells already, as an extension's failed step does, is told once.
+        const cause = e?.cause?.message?.split('\n')[0];
+        if (cause && !message.includes(cause)) message += `\n  caused by: ${cause}`;
         console.error(message);
     }
     // Writes to a pipe are asynchronous, so exiting at once would cut what is still queued, such as the failed
@@ -111,12 +113,30 @@ function listSystemKeys() {
     console.table(systemKeys);
 }
 
+// An extension's own setting, as its name and the setting's name it: demo-store.TOKEN.
+function extensionSetting(text) {
+    const [, extension, key] = /^([a-z][a-z0-9-]*)\.([A-Za-z][A-Za-z0-9_]*)$/.exec(text) ?? [];
+    return extension ? { extension, key: key.toUpperCase() } : null;
+}
+
+// crossbind's settings, and each extension's own by its name and the setting's.
+function shownSettings(system) {
+    const { extensions = {}, ...settings } = system;
+    const owned = Object.keys(extensions).flatMap((name) => Object.entries(extensionSettingsOf(system, name)).map(([key, value]) => [`${name}.${key}`, value]));
+    return { ...settings, ...Object.fromEntries(owned) };
+}
+
 async function getSystemConfig(systemKey) {
     if (!systemKey) {
         await listSystemConfig('system');
         return;
     }
     const system = loadSystemConfig();
+    const own = extensionSetting(systemKey);
+    if (own) {
+        console.table({ [`${own.extension}.${own.key}`]: { value: extensionSettingsOf(system, own.extension)[own.key] ?? 'undefined' } });
+        return;
+    }
     const key = systemKey.toUpperCase();
     const output = {};
     if (key in system) {
@@ -143,6 +163,15 @@ function setSystemConfig(key, value) {
 }
 
 function deleteSystemConfig(key) {
+    const own = extensionSetting(key);
+    if (own) {
+        const system = loadSystemConfig();
+        const { [own.key]: deleted, ...kept } = extensionSettingsOf(system, own.extension);
+        if (deleted === undefined) throw new Error(`Configuration ${own.extension}.${own.key} is not set.`);
+        const { [own.extension]: emptied, ...others } = system.extensions;
+        writeJson(systemConfigPath(), { ...system, extensions: Object.keys(kept).length > 0 ? { ...others, [own.extension]: kept } : others });
+        return;
+    }
     if (!systemKeys[key]) {
         throw new Error(`Configuration ${key} is not available. Please choose from the following available configurations: ${Object.keys(systemKeys).join(', ')}`);
     }
@@ -157,7 +186,7 @@ async function listSystemConfig(type) {
         : (await import('./state/index.js')).default.config;
     if (type === 'all' || type === 'system') {
         console.log('System Configuration');
-        console.table(systemConfig);
+        console.table(shownSettings(systemConfig));
     }
 
     if (type === 'all') {

package/src/state/{attachConanDependencies.js → attachPackageSources.js}

@@ -1,8 +1,8 @@
 import { getFilledConfig, flattenDependencies } from './loadConfig.js';
 import calculateDependencyParameters from './calculateDependencyParameters.js';
-import { conanStageDir, conanPackageDir } from '../utils/conanImport.js';
-import { conanDependenciesKey } from '../utils/conanDependencies.js';
-import { readConanManifest, conanTargetName } from '../utils/conanStage.js';
+import { sourceStageDir, sourcePackageDir } from '../utils/packageSourceImport.js';
+import { declaredSources, dependenciesKey, dependenciesOf } from '../utils/packageSources.js';
+import { readSourceManifest, sourceTargetName } from '../utils/packageSourceStage.js';
 import { TARGETS, targetPathOf } from '../utils/targets.js';
 
 // What a recipe declares for its consumers, per staged target since it declares other things on another
@@ -32,25 +32,29 @@ function targetSpecsOf(name, targets) {
 // staged for it, so a name it lacks drops out there.
 const libsOf = (name, targets) => [...new Set(Object.values(targets).flat().filter((entry) => entry.name === name).flatMap((entry) => entry.libs))];
 
-export function conanDependencyConfigs(manifest, stageDir) {
+export function sourceDependencyConfigs(source, manifest, stageDir) {
     return manifest.packages.map((pkg) => ({
-        general: { name: conanTargetName(pkg.name), conan: pkg },
+        general: { name: sourceTargetName(source, pkg.name), packageSource: { name: source, package: pkg } },
         export: { type: 'cmake', libName: libsOf(pkg.name, manifest.targets) },
-        paths: { project: conanPackageDir(stageDir, pkg.name), output: `${conanPackageDir(stageDir, pkg.name)}/dist` },
+        paths: { project: sourcePackageDir(stageDir, pkg.name), output: `${sourcePackageDir(stageDir, pkg.name)}/dist` },
         targetSpecs: targetSpecsOf(pkg.name, manifest.targets),
     }));
 }
 
-// The staged Conan packages join the config as dependencies, so header resolution, the link, the
-// cmake graph and the license rows see them like any port. Only packages staged for the current
-// conanDependencies join; reading the manifest runs nothing, so state can do it while it loads.
-export default function attachConanDependencies(config) {
-    const isDeclared = Object.keys(config.conanDependencies ?? {}).length > 0;
-    if (!isDeclared && !config.dependencies?.some((d) => d.general.conan)) return;
-    const stageDir = conanStageDir(config.paths.cache);
-    const manifest = isDeclared ? readConanManifest(stageDir, conanDependenciesKey(config.conanDependencies)) : null;
-    const conan = manifest ? conanDependencyConfigs(manifest, stageDir).map((d) => getFilledConfig(d, { isDepend: true })) : [];
-    config.dependencies = [...config.dependencies.filter((d) => !d.general.conan), ...conan];
+function stagedDependencies(config, source) {
+    const stageDir = sourceStageDir(config.paths.cache, source);
+    const manifest = readSourceManifest(source, stageDir, dependenciesKey(dependenciesOf(config, source)));
+    return manifest ? sourceDependencyConfigs(source, manifest, stageDir).map((d) => getFilledConfig(d, { isDepend: true })) : [];
+}
+
+// The staged packages of each source join the config as dependencies, so header resolution, the link, the
+// cmake graph and the license rows see them like any port. Only packages staged for what the config declares
+// now join; reading a manifest runs nothing, so state can do it while it loads.
+export default function attachPackageSources(config) {
+    const declared = declaredSources(config);
+    if (declared.length === 0 && !config.dependencies?.some((d) => d.general.packageSource)) return;
+    const staged = declared.flatMap(({ name }) => stagedDependencies(config, name));
+    config.dependencies = [...config.dependencies.filter((d) => !d.general.packageSource), ...staged];
     config.allDependencies = flattenDependencies(config.dependencies);
     config.dependencyParameters = calculateDependencyParameters(config);
 }

package/src/state/index.js

@@ -5,9 +5,11 @@ import {
     TARGETS, targetPathOf, nodeAddonNamesOf, nativeCommandNamesOf, wasiNamesOf, appNamesOf,
 } from '../utils/targets.js';
 import { findCargoModuleImportsIn, writeCargoMarker } from '../utils/cargoImport.js';
+import { cratesOf } from '../utils/packageSourceImport.js';
 import { exportWasiSdkPath } from '../utils/wasiToolchain.js';
 import loadConfig, { assertBinarySelection } from './loadConfig.js';
-import refreshConanDependencies from './refreshConanDependencies.js';
+import { configChangesOf } from '../utils/configChanges.js';
+import refreshPackageSources from './refreshPackageSources.js';
 
 const cacheDir = `${process.cwd()}/.crossbind`;
 
@@ -25,9 +27,9 @@ await initProcessState();
 
 async function initProcessState() {
     state.cache = loadCacheState();
-    state.config = await loadConfig();
+    state.config = await loadConfig(undefined, undefined, { changes: configChangesOf() });
     assertBinarySelection(state.config);
-    refreshConanDependencies(state.config);
+    refreshPackageSources(state.config);
     exportWasiSdkPath(state.config.system);
     // Same idea for the docker image overrides: pullDockerImage.js resolves them from the
     // environment alone, so it stays free of a state import (and of the cycle that would create).
@@ -73,7 +75,7 @@ async function initProcessState() {
     // Cargo-crate import markers must exist BEFORE any bundler starts: metro resolves against
     // its startup file map, so a marker first created mid-resolution is invisible to that very
     // build. Bare crates come from the config, module imports from the app's own sources.
-    const cargoDeps = state.config.cargoDependencies ?? {};
+    const cargoDeps = cratesOf(state.config);
     const crateNames = Object.keys(cargoDeps);
     const moduleImports = crateNames.length && state.config.paths.project
         ? findCargoModuleImportsIn(state.config.paths.project).filter((i) => Object.hasOwn(cargoDeps, i.crateName))
@@ -97,8 +99,8 @@ export function setAllDependecyPaths() {
         state.config.allDependencyPaths[target.path] = { cmake: {} };
         state.config.allDependencies.forEach((d) => {
             state.config.allDependencyPaths[target.path].cmake[d.general.name] = `${d.paths.output}/prebuilt`;
-            // A Conan recipe can name a library on another platform only (libpng is png16 on Windows).
-            const libNames = d.general.conan
+            // A package source's recipe can name a library on another platform only (libpng is png16 on Windows).
+            const libNames = d.general.packageSource
                 ? d.export.libName.filter((name) => [target.path, target.releasePath]
                     .some((targetPath) => fs.existsSync(`${d.paths.output}/prebuilt/${targetPath}/lib/lib${name}.a`)))
                 : d.export.libName;

package/src/state/loadConfig.js

@@ -12,8 +12,10 @@ import getCMakeListsFilePath from '../utils/getCMakeListsFilePath.js';
 import calculateDependencyParameters from './calculateDependencyParameters.js';
 import logger from '../utils/logger.js';
 import { RUNTIME_ENVS } from '../utils/targets.js';
-import { normalizeConanDependencies } from '../utils/conanDependencies.js';
+import { checkedPackages, packageSourcesOf } from '../utils/packageSources.js';
 import isSourceCmakePackage from '../utils/isSourceCmakePackage.js';
+import { listedExtension } from '../utils/appExtensions.js';
+import { mergePatch } from '../utils/configChanges.js';
 // import getCmakeParameters from './getCmakeParameters.js';
 
 // For the project being built only: dependency builds load published configs that may still set
@@ -28,15 +30,23 @@ export function assertBinarySelection(config) {
     }
 }
 
-export default async function loadConfig(configDir = process.cwd(), configName = 'crossbind.config') {
-    const config = await loadJs(configDir, configName) || {};
+// The export each loaded config was filled from, as crossbind read it, which an extension's api shows.
+const exports = new WeakMap();
+export const exportOf = (config) => exports.get(config) ?? null;
+
+// The project's config, with the changes a publisher makes for its build, as a JSON merge patch of the export.
+export default async function loadConfig(configDir = process.cwd(), configName = 'crossbind.config', { changes = null } = {}) {
+    const exported = await loadJs(configDir, configName) || {};
+    const config = changes ? mergePatch(exported, changes) : exported;
     if (config.excludedDependencies?.length) {
         logger.info('crossbind: `excludedDependencies` in crossbind.config.js is no longer read — declare exclusions in crossbind.overrides.js as { <name>: { exclude: true } }.');
     }
     const overrides = await loadJs(configDir, 'crossbind.overrides');
     const exclude = resolveExcludedNames(overrides);
     const seen = new Set();
-    const output = getFilledConfig(config, { isDepend: false, exclude, seen, replaces: overrides });
+    const output = getFilledConfig(config, {
+        isDepend: false, exclude, seen, replaces: overrides, file: `${configDir}/${configName}`,
+    });
     output.excludedDependencies = exclude;
 
     const build = await loadJs(configDir, 'crossbind.build');
@@ -85,6 +95,7 @@ export default async function loadConfig(configDir = process.cwd(), configName =
     output.paths.systemConfig = systemConfigPath();
     output.system = loadSystemConfig();
 
+    exports.set(output, config);
     return output;
 }
 
@@ -117,8 +128,6 @@ export function getFilledConfig(config, options = { isDepend: false }) {
     const newConfig = {
         general: config.general || {},
         dependencies,
-        cargoDependencies: config.cargoDependencies || {},
-        conanDependencies: normalizeConanDependencies(config.conanDependencies),
         // 'sync' types the direct surface; 'promise' wraps every generated method return
         // for useWorker-style runtimes (constructors stay sync-typed: await new X()).
         dts: config.dts || 'sync',
@@ -135,6 +144,7 @@ export function getFilledConfig(config, options = { isDepend: false }) {
         target: config.target || {},
         // An app's identity: its bundle id, on iOS the Apple team that signs it, the name it shows and its desktop window.
         app: config.app || {},
+        // What an app's host builds in beside its own extensions.
         extensions: config.extensions || [],
         package: null,
         functions: config.functions || {},
@@ -199,9 +209,16 @@ export function getFilledConfig(config, options = { isDepend: false }) {
 
     newConfig.allDependencies = flattenDependencies(newConfig.dependencies);
 
-    newConfig.extensions?.forEach(e => {
-        e?.loadConfig?.after(newConfig);
-    });
+    if (!Array.isArray(newConfig.extensions)) throw new Error('crossbind: "extensions" must be a list of extensions, as their packages\' crossbind.extension.js gives them.');
+    newConfig.extensions = newConfig.extensions.map((extension, i) => listedExtension(extension, `extensions[${i}]`, newConfig.paths.base));
+    const twice = newConfig.extensions.find(({ name }, i) => newConfig.extensions.findIndex((other) => other.name === name) !== i);
+    if (twice) throw new Error(`crossbind: "extensions" lists two extensions named ${twice.name}.`);
+
+    // What the project declares under packages: cargo's crates, and each package source's packages, as packages.conan,
+    // as the source's own check takes them. A package installs nothing for the project that depends on it, so a
+    // dependency's own declarations are not read.
+    newConfig.packageSources = packageSourcesOf(newConfig.extensions);
+    newConfig.packages = checkedPackages(newConfig.packageSources, options.isDepend ? {} : config, options.file);
 
     if (newConfig.target.runtime !== 'mt' && newConfig.allDependencies.some((d) => d?.target?.runtime === 'mt')) {
         newConfig.target.runtime = 'mt';

package/src/state/refreshPackageSources.js

@@ -0,0 +1,19 @@
+import attachPackageSources from './attachPackageSources.js';
+import { sourceStageDir } from '../utils/packageSourceImport.js';
+import { declaredSources } from '../utils/packageSources.js';
+import { sourceManifestsStamp } from '../utils/packageSourceStage.js';
+
+const attachedFrom = new WeakMap();
+
+// Attaches what a build staged since this config last attached: a process that loaded state before
+// the build, such as a Metro server, would otherwise bind headers without the packages. Says whether
+// it attached again.
+export default function refreshPackageSources(config) {
+    const declared = declaredSources(config);
+    if (declared.length === 0) return false;
+    const stamp = declared.map(({ name }) => `${name}:${sourceManifestsStamp(sourceStageDir(config.paths.cache, name))}`).join('\n');
+    if (attachedFrom.get(config) === stamp) return false;
+    attachedFrom.set(config, stamp);
+    attachPackageSources(config);
+    return true;
+}