crossbind 2.0.0-beta.69 → 2.0.0-beta.72

package/src/actions/xcodeProject.js

@@ -151,8 +151,9 @@ function objects(name, targetSettings, hasAssets, hasPrivacy, added) {
     };
 }
 
-// The asset catalog: the app's icon, from which Xcode makes every size, and the launch screen's color.
-function writeAssets(catalog, icon, background) {
+// The asset catalog: the app's icon, from which Xcode makes every size, and the launch screen's color, with the one of
+// the dark appearance where there is one.
+function writeAssets(catalog, icon, background, darkBackground) {
     const info = { author: 'xcode', version: 1 };
     const assetSet = (set, contents) => {
         fs.mkdirSync(`${catalog}/${set}`, { recursive: true });
@@ -163,9 +164,13 @@ function writeAssets(catalog, icon, background) {
         assetSet('AppIcon.appiconset', { images: [{ filename: 'icon.png', idiom: 'universal', platform: 'ios', size: '1024x1024' }] });
         fs.writeFileSync(`${catalog}/AppIcon.appiconset/icon.png`, icon);
     }
+    const colorOf = (rgb) => {
+        const [red, green, blue] = [1, 3, 5].map((at) => `0x${rgb.slice(at, at + 2).toUpperCase()}`);
+        return { 'color-space': 'srgb', components: { alpha: '1.000', red, green, blue } };
+    };
     if (background) {
-        const [red, green, blue] = [1, 3, 5].map((at) => `0x${background.slice(at, at + 2).toUpperCase()}`);
-        assetSet(`${LAUNCH_COLOR}.colorset`, { colors: [{ color: { 'color-space': 'srgb', components: { alpha: '1.000', red, green, blue } }, idiom: 'universal' }] });
+        const dark = darkBackground ? [{ appearances: [{ appearance: 'luminosity', value: 'dark' }], color: colorOf(darkBackground), idiom: 'universal' }] : [];
+        assetSet(`${LAUNCH_COLOR}.colorset`, { colors: [{ color: colorOf(background), idiom: 'universal' }, ...dark] });
     }
 }
 
@@ -176,7 +181,8 @@ function writeAssets(catalog, icon, background) {
 // where one of them asks for it.
 export default function writeXcodeProject(to, {
     parts, identity, label, version, build = version, icon = null, urlSchemes = [], fileTypes = [], links = [], activityTypes = [], shortcutItems = [],
-    background = null, usage = {}, encryption = null, multipleWindows = false, privacy = {}, entitlements = {}, plist = [], targets = [], appGroup = null,
+    background = null, darkBackground = null, usage = {}, encryption = null, multipleWindows = false, privacy = {}, entitlements = {}, plist = [], targets = [],
+    appGroup = null,
 }) {
     const { name } = state.config.general;
     if (parts.length === 0) throw new Error(`crossbind: no part of the iOS app ${name} is built, so there is no Xcode project to write.`);
@@ -206,7 +212,7 @@ export default function writeXcodeProject(to, {
 
     fs.writeFileSync(`${to}/main.m`, MAIN);
     fs.writeFileSync(`${to}/Info.plist`, info);
-    writeAssets(`${to}/Assets.xcassets`, icon, background);
+    writeAssets(`${to}/Assets.xcassets`, icon, background, darkBackground);
     const hasPrivacy = Object.keys(privacy).length > 0;
     if (hasPrivacy) fs.writeFileSync(`${to}/PrivacyInfo.xcprivacy`, privacyManifest(privacy));
     const hasEntitlements = Object.keys(signed).length > 0;

package/src/app/index.d.ts

@@ -24,6 +24,23 @@ export declare const app: {
     launchArgs(): Promise<Launch>;
 };
 
+/** Where the app runs, as its host tells the page before the page's own scripts run; the same through the app's run. */
+export interface Device {
+    /** The platform the app is built for. */
+    readonly platform: 'macos' | 'windows' | 'linux' | 'ios' | 'android';
+    /** The arch the app's process runs as. */
+    readonly arch: 'arm64' | 'x64';
+    /** What the device is to its user as the app starts: a phone; a tablet, an iPad or an Android device whose screen's shorter side has 600dp; or a desktop, a computer, a Chromebook or a Mac that runs an iOS app. */
+    readonly formFactor: 'phone' | 'tablet' | 'desktop';
+    /** The system's name and version, as its maker numbers it: iOS or iPadOS 18.4, Android 15 with its API level, macOS 26.1, Windows 10.0.26100, or a Linux distribution's, as Ubuntu 24.04, else its kernel's release. */
+    readonly os: { readonly name: string; readonly version: string; readonly apiLevel?: number };
+    /** Whether the iOS Simulator or an Android emulator runs the app. */
+    readonly isVirtual: boolean;
+}
+
+/** Where the app runs, read at once, as the page starts; reading it outside an app throws. */
+export declare const device: Device;
+
 /** What windows.set() changes of an open window: sizes and places in logical pixels, a page's size without the frame, and x and y the frame's place from the top left of the main screen, given together. A limit of 0 takes it away. */
 export interface WindowChanges {
     title?: string;
@@ -57,6 +74,8 @@ export interface WindowOptions extends Omit<WindowChanges, 'center' | 'minWidth'
     backgroundColor?: string;
     /** false opens a window without a title bar and its buttons, which the page moves with data-crossbind-drag or windows.startDrag(). */
     frame?: boolean;
+    /** 'hidden' lays a macOS window's page under its title bar, whose buttons stay at its top left, as app.window.titleBar does; Windows and Linux keep their title bar and list it in ignored. */
+    titleBar?: 'visible' | 'hidden';
     /** The id of the window it stays above, and closes with. */
     parent?: number;
     /** With a parent: a sheet of the parent's on macOS, and on Windows and Linux a window the parent takes no input under until it closes. */

package/src/app/index.js

@@ -39,8 +39,9 @@ const WINDOW_SHARED = {
 };
 const WINDOW_SET = { ...WINDOW_SHARED, center: 'boolean' };
 const WINDOW_OPEN = {
-    ...WINDOW_SHARED, path: 'string', name: 'string', backgroundColor: 'string', frame: 'boolean', parent: 'number', modal: 'boolean',
+    ...WINDOW_SHARED, path: 'string', name: 'string', backgroundColor: 'string', frame: 'boolean', titleBar: 'string', parent: 'number', modal: 'boolean',
 };
+const TITLE_BARS = ['visible', 'hidden'];
 const MAX_WINDOW_SIZE = 16384;
 const MAX_WINDOW_PLACE = 1000000;
 // The size a window opens at without one.
@@ -70,6 +71,10 @@ function checkedWindow(name, options, kinds) {
         throw new TypeError(`crossbind: ${name}'s path ${JSON.stringify(path)} is no path of the app's own pages, as /settings.html is.`);
     }
     if (backgroundColor !== undefined && !COLOR.test(backgroundColor)) throw new TypeError(`crossbind: ${name}'s backgroundColor is no color of the form #rrggbb.`);
+    if (options.titleBar !== undefined && !TITLE_BARS.includes(options.titleBar)) throw new TypeError(`crossbind: ${name}'s titleBar is neither 'visible' nor 'hidden'.`);
+    if (options.frame === false && options.titleBar === 'hidden') {
+        throw new TypeError(`crossbind: ${name} hides the title bar of a window with a frame alone: drop titleBar, or frame: false.`);
+    }
     if (parent !== undefined && !isWindowId(parent)) throw new TypeError(`crossbind: ${name}'s parent is no window's id.`);
     if (options.modal && parent === undefined) throw new TypeError(`crossbind: ${name} opens a modal window above a parent: give it parent, the id of a window.`);
     if (name === 'windows.open') checkedLimits(options);
@@ -96,6 +101,25 @@ function windowOf(name, id) {
     return { id };
 }
 
+// What the app's host tells the page of where the app runs, from before the page's own scripts on.
+function deviceOf(name) {
+    const device = globalThis.__crossbind_device;
+    if (device) return device[name];
+    if (globalThis.__crossbind_token) throw new Error(`crossbind: this app's host is older than crossbind/app; update @crossbind/core-app-host to read device.${name}`);
+    throw new Error(`crossbind: device.${name} works in an app alone, whose crossbind.config.js sets target.runtimeEnv: 'app'`);
+}
+
+// Where the app runs, the same through its run, which the page reads at once, as it starts: the platform and the arch
+// the app is built for, what the device is to its user, its system's name and version, and whether a simulator or an
+// emulator runs the app.
+export const device = Object.freeze({
+    get platform() { return deviceOf('platform'); },
+    get arch() { return deviceOf('arch'); },
+    get formFactor() { return deviceOf('formFactor'); },
+    get os() { return deviceOf('os'); },
+    get isVirtual() { return deviceOf('isVirtual'); },
+});
+
 export const app = {
     // The app's own folders, made when first asked for: { data, cache, logs }.
     paths: async () => call('app.paths', {}),

package/src/assets/node-import-hooks.mjs

@@ -5,7 +5,6 @@ import { registerHooks } from 'node:module';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-const SCHEME = /^(cargo|conan):/;
 const isBare = (specifier) => !/^(\.{1,2}\/|\/|[A-Za-z]:[\\/]|file:)/.test(specifier);
 
 function notBound(what, parentURL, cause) {
@@ -17,23 +16,25 @@ const exportOf = (name) => (typeof name === 'string' ? name : `${name.wire} as $
 const proxyOf = (entry, names) => `export { ${['initNative', 'AllSymbols', ...names.map(exportOf)].join(', ')} } from ${JSON.stringify(entry)};\n`;
 
 // Another hook may still serve it; Node's own resolver hands an unknown scheme on unresolved.
-function resolveUnbound(specifier, context, nextResolve) {
+function resolveUnbound(specifier, context, nextResolve, scheme) {
     let resolved;
     try {
         resolved = nextResolve(specifier, context);
     } catch (error) {
         throw notBound(specifier, context.parentURL, error);
     }
-    if (SCHEME.test(resolved.url)) throw notBound(specifier, context.parentURL);
+    if (scheme.test(resolved.url)) throw notBound(specifier, context.parentURL);
     return resolved;
 }
 
 // `natives` lists each bound file, relative to the entry, with the bare specifiers that name it and the names it
-// exports, a name the entry exports under another as { local, wire }.
-export default function registerNativeImports(entry, { extensions, natives }) {
+// exports, a name the entry exports under another as { local, wire }. `schemes` are those an import names a store
+// by: the two every build has, for a register file an older build wrote, which names none.
+export default function registerNativeImports(entry, { extensions, schemes = ['cargo', 'conan'], natives }) {
     const entryUrl = new URL(entry).href;
     const dir = path.dirname(fileURLToPath(entryUrl));
     const isNative = new RegExp(`\\.(${extensions.join('|')})$`);
+    const scheme = new RegExp(`^(${schemes.join('|')}):`);
     const byFile = new Map();
     const bySpecifier = new Map();
     natives.forEach(({ file, specifiers, names }) => {
@@ -46,7 +47,7 @@ export default function registerNativeImports(entry, { extensions, natives }) {
         resolve(specifier, context, nextResolve) {
             const url = bySpecifier.get(specifier);
             if (url) return { url, format: 'module', shortCircuit: true };
-            if (isBare(specifier) && (SCHEME.test(specifier) || isNative.test(specifier))) return resolveUnbound(specifier, context, nextResolve);
+            if (isBare(specifier) && (scheme.test(specifier) || isNative.test(specifier))) return resolveUnbound(specifier, context, nextResolve, scheme);
             return nextResolve(specifier, context);
         },
         load(url, context, nextLoad) {

package/src/bin.js

@@ -44,7 +44,8 @@ import {
     RUNNER_PLATFORMS, RUNNER_ROLES, connectCommands, deleteRunner, deploySteps, initRunner, newRunnerToken, runnerHostPort, startRunner,
 } from './actions/runnerCommands.js';
 import { cargoHome } from './utils/runCargo.js';
-import { conanRoot } from './utils/runConan.js';
+import { containerRootOf, sourceRoot } from './utils/runPackageSource.js';
+import { importSchemesOf, sourceNamesOf } from './utils/packageSources.js';
 import { cleanDepsCache } from './utils/dependencyRebuild.js';
 import collectLicenseRows from './actions/licenses.js';
 import { formatNoticesMarkdown, formatCycloneDxSbom, validateSpdx } from './utils/licenseReport.js';
@@ -113,12 +114,18 @@ function declaredSbomPath(projectDir) {
 const APP_PLATFORMS = ['android', 'ios', 'linux', 'macos', 'windows'];
 
 function projectVite() {
+    let manifestPath;
     try {
-        const manifest = createRequire(`${state.config.paths.project}/package.json`).resolve('vite/package.json');
-        return path.join(path.dirname(manifest), JSON.parse(fs.readFileSync(manifest, 'utf8')).bin.vite);
+        manifestPath = createRequire(`${state.config.paths.project}/package.json`).resolve('vite/package.json');
     } catch {
         throw new Error("crossbind: crossbind app builds the app's page with the project's Vite, which the project does not have. Add vite and @crossbind/plugin-vite to it, as the desktop-app template has them.");
     }
+    // A workspace can map vite to a package of Vite's API alone.
+    const { name, version, bin } = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    if (!bin?.vite) {
+        throw new Error(`crossbind: crossbind app runs the vite command, and the project's vite resolves to ${name} ${version}, which has none. Have vite resolve to Vite itself for the project, with an override where its workspace maps vite to another package.`);
+    }
+    return path.join(path.dirname(manifestPath), bin.vite);
 }
 
 // The project's Vite, as `crossbind app dev`, `build` and `publish` run it, and its exit code once it ends. A signal sent
@@ -310,17 +317,18 @@ imageArgument(commandDocker.command('create').description('create docker contain
     .action((image) => {
         // Google ships the linux NDK for x86_64 only, so an android or android-app container is always amd64.
         const platform = ['android', 'android-app'].includes(image) ? 'linux/amd64' : undefined;
+        const sources = sourceNamesOf(state.config);
         // Docker on Linux makes a missing mount source owned by root, which the user's builds cannot write.
-        [cargoHome(), conanRoot()].forEach((dir) => fs.mkdirSync(dir, { recursive: true }));
+        [cargoHome(), ...sources.map((name) => sourceRoot(name))].forEach((dir) => fs.mkdirSync(dir, { recursive: true }));
         dockerExec([
             'run', '-dit',
             ...(platform ? ['--platform', platform] : []),
             '--name', dockerContainerName(image),
             '-v', `${state.config.paths.base}:/tmp/crossbind/live`,
-            // Cargo's registry cache, shared with host builds and with every other project, and the
-            // Conan store and work directories every other container build uses.
+            // Cargo's registry cache, shared with host builds and with every other project, and each package
+            // source's store and work directories, which every other container build of it uses.
             '-v', `${cargoHome()}:/var/cache/crossbind/cargo`,
-            '-v', `${conanRoot()}:/var/cache/crossbind/conan`,
+            ...sources.flatMap((name) => ['-v', `${sourceRoot(name)}:${containerRootOf(name)}`]),
             getDockerImage(image, platform),
             'bash',
         ]);
@@ -527,7 +535,7 @@ async function createNodeAddons(targetParams) {
     if (headers.length && fs.existsSync(`${state.config.paths.output}/${loaderTarget.jsName}`)) {
         const entry = `${state.config.paths.output}/node/napi.mjs`;
         writeRuntimeEntry(entry, headers, ENTRY_RUNTIMES.node(loaderTarget.jsName));
-        if (imports.size) writeImportHooks(entry, headers, imports, nativeExtensions(state.config.ext));
+        if (imports.size) writeImportHooks(entry, headers, imports, nativeExtensions(state.config.ext), importSchemesOf(state.config));
         else removeImportHooks(entry);
     }
 }
@@ -603,7 +611,7 @@ async function createWasmJs(targetParams, wasmOptions = {}) {
     if (appHeaders.length && nodeTarget) {
         const entry = `${state.config.paths.output}/node/wasm.mjs`;
         writeRuntimeEntry(entry, appHeaders, ENTRY_RUNTIMES.node(nodeTarget.jsName));
-        if (imports.size) writeImportHooks(entry, appHeaders, imports, nativeExtensions(state.config.ext));
+        if (imports.size) writeImportHooks(entry, appHeaders, imports, nativeExtensions(state.config.ext), importSchemesOf(state.config));
         else removeImportHooks(entry);
     }
     if (headers.length && edgeTarget) {

package/src/index.js

@@ -4,7 +4,7 @@ export { default as createLib } from './actions/createLib.js';
 export { default as createBridgeFile } from './actions/createInterface.js';
 export { default as buildWasm } from './actions/buildWasm.js';
 export {
-    default as buildApp, buildProjectApp, publishApp, appLayout, appOutputName, appTargetParams,
+    default as buildApp, buildProjectApp, publishApp, appLayout, appOutputName, appPlatform, appTargetParams,
 } from './actions/buildApp.js';
 export { checkInstaller, shipApp } from './actions/appInstaller.js';
 export { resolveAppPageApi } from './utils/resolveAppHost.js';
@@ -24,7 +24,7 @@ export { getTargetParams, getBuildTargets, getFilteredBuildTargets, getFilteredT
 export { default as getCrossbindScript, getRustJsScript } from './integration/getCrossbindScript.js';
 export { default as getDependFilePath } from './integration/getDependFilePath.js';
 export { default as buildDependencies, getDependenciesStamp } from './actions/buildDependencies.js';
-export { default as prepareConanDependencies } from './actions/prepareConanDependencies.js';
+export { default as preparePackageSources } from './actions/preparePackageSources.js';
 export { default as findFiles } from './utils/findFiles.js';
 export { getContentHash, getFileHash } from './utils/hash.js';
 export {

package/src/integration/getCrossbindScript.js

@@ -5,6 +5,7 @@ import loadJson from '../utils/loadJson.js';
 import state from '../state/index.js';
 import { parseSurface, createRustBridgeCrate, createCrateImportBridge } from '../utils/rustBridgeGen.js';
 import { parseCargoMarkerName } from '../utils/cargoImport.js';
+import { cratesOf } from '../utils/packageSourceImport.js';
 import { UNBOUND_MESSAGE } from '../assets/js-runtime/adapters/unboundMessage.js';
 
 // `base` is where the bundler serves the app from, as Vite's `base` names it; webpack's public path wins at run time.
@@ -62,7 +63,7 @@ export function getRustSymbols(rsFile) {
     // Marker under <cache>/rust-crates/: a direct crate import - the model comes from the
     // upstream crate's own source, and the bridge is synthesized against the cargo dependency.
     const { crateName, modulePath } = parseCargoMarkerName(path.basename(rsReal, '.rs'));
-    const cargoDeps = state.config.cargoDependencies ?? {};
+    const cargoDeps = cratesOf(state.config);
     if (Object.hasOwn(cargoDeps, crateName)
         && path.dirname(rsReal) === fs.realpathSync(path.join(state.config.paths.cache, 'rust-crates'))) {
         const { exports } = createCrateImportBridge({
@@ -92,7 +93,7 @@ export function getRustSymbols(rsFile) {
             projectPath: state.config.paths.project,
             dtsMode: state.config.dts,
             vectors,
-            cargoDependencies: state.config.cargoDependencies ?? {},
+            cargoDependencies: cratesOf(state.config),
             log: () => {},
         });
     }

package/src/integration/getDependFilePath.js

@@ -2,8 +2,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import state from '../state/index.js';
 import { parseCargoImport, writeCargoMarker } from '../utils/cargoImport.js';
-import { CONAN_PREFIX, resolveConanHeader } from '../utils/conanImport.js';
-import refreshConanDependencies from '../state/refreshConanDependencies.js';
+import { cratesOf, sourceOfImport, resolveSourceHeader } from '../utils/packageSourceImport.js';
+import refreshPackageSources from '../state/refreshPackageSources.js';
 
 const LAYOUT = { header: 'include', module: 'swig', source: '' };
 
@@ -85,20 +85,20 @@ export default function getDependFilePath(source, target) {
     // an undeclared crate is a hard, actionable error instead of a silent npm fallthrough.
     if (source.startsWith('cargo:')) {
         const cargoImport = parseCargoImport(source);
-        const cargoDeps = state.config.cargoDependencies ?? {};
-        if (!Object.hasOwn(cargoDeps, cargoImport.crateName)) {
-            throw new Error(`crossbind: '${source}' is not declared - add '${cargoImport.crateName}' to cargoDependencies in crossbind.config.`);
+        if (!Object.hasOwn(cratesOf(state.config), cargoImport.crateName)) {
+            throw new Error(`crossbind: '${source}' is not declared - add '${cargoImport.crateName}' to packages.cargo in crossbind.config.`);
         }
         const marker = writeCargoMarker(state.config.paths.cache, cargoImport);
         existsCache.set(marker, true);
         return marker;
     }
 
-    // `conan:<package>/<header>` names a header of a declared Conan package, staged per target like a
-    // port's prebuilt; from there the header takes the same path as any other.
-    if (source.startsWith(CONAN_PREFIX)) {
-        refreshConanDependencies(state.config);
-        return resolveConanHeader(state.config, source, target ?? state.targets.find((t) => t.platform === 'wasm'));
+    // `<source>:<package>/<header>`, as conan:zlib/zlib.h, names a header of a declared package of a package
+    // source, staged per target like a port's prebuilt; from there the header takes the same path as any other.
+    const packageSource = sourceOfImport(state.config, source);
+    if (packageSource) {
+        refreshPackageSources(state.config);
+        return resolveSourceHeader(state.config, packageSource.name, source, target ?? state.targets.find((t) => t.platform === 'wasm'));
     }
 
     const matches = getMatchingPackages(source);

package/src/state/{attachConanDependencies.js → attachPackageSources.js}

@@ -1,8 +1,8 @@
 import { getFilledConfig, flattenDependencies } from './loadConfig.js';
 import calculateDependencyParameters from './calculateDependencyParameters.js';
-import { conanStageDir, conanPackageDir } from '../utils/conanImport.js';
-import { conanDependenciesKey } from '../utils/conanDependencies.js';
-import { readConanManifest, conanTargetName } from '../utils/conanStage.js';
+import { sourceStageDir, sourcePackageDir } from '../utils/packageSourceImport.js';
+import { declaredSources, dependenciesKey, dependenciesOf } from '../utils/packageSources.js';
+import { readSourceManifest, sourceTargetName } from '../utils/packageSourceStage.js';
 import { TARGETS, targetPathOf } from '../utils/targets.js';
 
 // What a recipe declares for its consumers, per staged target since it declares other things on another
@@ -32,25 +32,29 @@ function targetSpecsOf(name, targets) {
 // staged for it, so a name it lacks drops out there.
 const libsOf = (name, targets) => [...new Set(Object.values(targets).flat().filter((entry) => entry.name === name).flatMap((entry) => entry.libs))];
 
-export function conanDependencyConfigs(manifest, stageDir) {
+export function sourceDependencyConfigs(source, manifest, stageDir) {
     return manifest.packages.map((pkg) => ({
-        general: { name: conanTargetName(pkg.name), conan: pkg },
+        general: { name: sourceTargetName(source, pkg.name), packageSource: { name: source, package: pkg } },
         export: { type: 'cmake', libName: libsOf(pkg.name, manifest.targets) },
-        paths: { project: conanPackageDir(stageDir, pkg.name), output: `${conanPackageDir(stageDir, pkg.name)}/dist` },
+        paths: { project: sourcePackageDir(stageDir, pkg.name), output: `${sourcePackageDir(stageDir, pkg.name)}/dist` },
         targetSpecs: targetSpecsOf(pkg.name, manifest.targets),
     }));
 }
 
-// The staged Conan packages join the config as dependencies, so header resolution, the link, the
-// cmake graph and the license rows see them like any port. Only packages staged for the current
-// conanDependencies join; reading the manifest runs nothing, so state can do it while it loads.
-export default function attachConanDependencies(config) {
-    const isDeclared = Object.keys(config.conanDependencies ?? {}).length > 0;
-    if (!isDeclared && !config.dependencies?.some((d) => d.general.conan)) return;
-    const stageDir = conanStageDir(config.paths.cache);
-    const manifest = isDeclared ? readConanManifest(stageDir, conanDependenciesKey(config.conanDependencies)) : null;
-    const conan = manifest ? conanDependencyConfigs(manifest, stageDir).map((d) => getFilledConfig(d, { isDepend: true })) : [];
-    config.dependencies = [...config.dependencies.filter((d) => !d.general.conan), ...conan];
+function stagedDependencies(config, source) {
+    const stageDir = sourceStageDir(config.paths.cache, source);
+    const manifest = readSourceManifest(source, stageDir, dependenciesKey(dependenciesOf(config, source)));
+    return manifest ? sourceDependencyConfigs(source, manifest, stageDir).map((d) => getFilledConfig(d, { isDepend: true })) : [];
+}
+
+// The staged packages of each source join the config as dependencies, so header resolution, the link, the
+// cmake graph and the license rows see them like any port. Only packages staged for what the config declares
+// now join; reading a manifest runs nothing, so state can do it while it loads.
+export default function attachPackageSources(config) {
+    const declared = declaredSources(config);
+    if (declared.length === 0 && !config.dependencies?.some((d) => d.general.packageSource)) return;
+    const staged = declared.flatMap(({ name }) => stagedDependencies(config, name));
+    config.dependencies = [...config.dependencies.filter((d) => !d.general.packageSource), ...staged];
     config.allDependencies = flattenDependencies(config.dependencies);
     config.dependencyParameters = calculateDependencyParameters(config);
 }

package/src/state/index.js

@@ -5,10 +5,11 @@ import {
     TARGETS, targetPathOf, nodeAddonNamesOf, nativeCommandNamesOf, wasiNamesOf, appNamesOf,
 } from '../utils/targets.js';
 import { findCargoModuleImportsIn, writeCargoMarker } from '../utils/cargoImport.js';
+import { cratesOf } from '../utils/packageSourceImport.js';
 import { exportWasiSdkPath } from '../utils/wasiToolchain.js';
 import loadConfig, { assertBinarySelection } from './loadConfig.js';
 import { configChangesOf } from '../utils/configChanges.js';
-import refreshConanDependencies from './refreshConanDependencies.js';
+import refreshPackageSources from './refreshPackageSources.js';
 
 const cacheDir = `${process.cwd()}/.crossbind`;
 
@@ -28,7 +29,7 @@ async function initProcessState() {
     state.cache = loadCacheState();
     state.config = await loadConfig(undefined, undefined, { changes: configChangesOf() });
     assertBinarySelection(state.config);
-    refreshConanDependencies(state.config);
+    refreshPackageSources(state.config);
     exportWasiSdkPath(state.config.system);
     // Same idea for the docker image overrides: pullDockerImage.js resolves them from the
     // environment alone, so it stays free of a state import (and of the cycle that would create).
@@ -74,7 +75,7 @@ async function initProcessState() {
     // Cargo-crate import markers must exist BEFORE any bundler starts: metro resolves against
     // its startup file map, so a marker first created mid-resolution is invisible to that very
     // build. Bare crates come from the config, module imports from the app's own sources.
-    const cargoDeps = state.config.cargoDependencies ?? {};
+    const cargoDeps = cratesOf(state.config);
     const crateNames = Object.keys(cargoDeps);
     const moduleImports = crateNames.length && state.config.paths.project
         ? findCargoModuleImportsIn(state.config.paths.project).filter((i) => Object.hasOwn(cargoDeps, i.crateName))
@@ -98,8 +99,8 @@ export function setAllDependecyPaths() {
         state.config.allDependencyPaths[target.path] = { cmake: {} };
         state.config.allDependencies.forEach((d) => {
             state.config.allDependencyPaths[target.path].cmake[d.general.name] = `${d.paths.output}/prebuilt`;
-            // A Conan recipe can name a library on another platform only (libpng is png16 on Windows).
-            const libNames = d.general.conan
+            // A package source's recipe can name a library on another platform only (libpng is png16 on Windows).
+            const libNames = d.general.packageSource
                 ? d.export.libName.filter((name) => [target.path, target.releasePath]
                     .some((targetPath) => fs.existsSync(`${d.paths.output}/prebuilt/${targetPath}/lib/lib${name}.a`)))
                 : d.export.libName;

package/src/state/loadConfig.js

@@ -12,7 +12,7 @@ import getCMakeListsFilePath from '../utils/getCMakeListsFilePath.js';
 import calculateDependencyParameters from './calculateDependencyParameters.js';
 import logger from '../utils/logger.js';
 import { RUNTIME_ENVS } from '../utils/targets.js';
-import { normalizeConanDependencies } from '../utils/conanDependencies.js';
+import { checkedPackages, packageSourcesOf } from '../utils/packageSources.js';
 import isSourceCmakePackage from '../utils/isSourceCmakePackage.js';
 import { listedExtension } from '../utils/appExtensions.js';
 import { mergePatch } from '../utils/configChanges.js';
@@ -44,7 +44,9 @@ export default async function loadConfig(configDir = process.cwd(), configName =
     const overrides = await loadJs(configDir, 'crossbind.overrides');
     const exclude = resolveExcludedNames(overrides);
     const seen = new Set();
-    const output = getFilledConfig(config, { isDepend: false, exclude, seen, replaces: overrides });
+    const output = getFilledConfig(config, {
+        isDepend: false, exclude, seen, replaces: overrides, file: `${configDir}/${configName}`,
+    });
     output.excludedDependencies = exclude;
 
     const build = await loadJs(configDir, 'crossbind.build');
@@ -126,8 +128,6 @@ export function getFilledConfig(config, options = { isDepend: false }) {
     const newConfig = {
         general: config.general || {},
         dependencies,
-        cargoDependencies: config.cargoDependencies || {},
-        conanDependencies: normalizeConanDependencies(config.conanDependencies),
         // 'sync' types the direct surface; 'promise' wraps every generated method return
         // for useWorker-style runtimes (constructors stay sync-typed: await new X()).
         dts: config.dts || 'sync',
@@ -214,6 +214,12 @@ export function getFilledConfig(config, options = { isDepend: false }) {
     const twice = newConfig.extensions.find(({ name }, i) => newConfig.extensions.findIndex((other) => other.name === name) !== i);
     if (twice) throw new Error(`crossbind: "extensions" lists two extensions named ${twice.name}.`);
 
+    // What the project declares under packages: cargo's crates, and each package source's packages, as packages.conan,
+    // as the source's own check takes them. A package installs nothing for the project that depends on it, so a
+    // dependency's own declarations are not read.
+    newConfig.packageSources = packageSourcesOf(newConfig.extensions);
+    newConfig.packages = checkedPackages(newConfig.packageSources, options.isDepend ? {} : config, options.file);
+
     if (newConfig.target.runtime !== 'mt' && newConfig.allDependencies.some((d) => d?.target?.runtime === 'mt')) {
         newConfig.target.runtime = 'mt';
     }

package/src/state/refreshPackageSources.js

@@ -0,0 +1,19 @@
+import attachPackageSources from './attachPackageSources.js';
+import { sourceStageDir } from '../utils/packageSourceImport.js';
+import { declaredSources } from '../utils/packageSources.js';
+import { sourceManifestsStamp } from '../utils/packageSourceStage.js';
+
+const attachedFrom = new WeakMap();
+
+// Attaches what a build staged since this config last attached: a process that loaded state before
+// the build, such as a Metro server, would otherwise bind headers without the packages. Says whether
+// it attached again.
+export default function refreshPackageSources(config) {
+    const declared = declaredSources(config);
+    if (declared.length === 0) return false;
+    const stamp = declared.map(({ name }) => `${name}:${sourceManifestsStamp(sourceStageDir(config.paths.cache, name))}`).join('\n');
+    if (attachedFrom.get(config) === stamp) return false;
+    attachedFrom.set(config, stamp);
+    attachPackageSources(config);
+    return true;
+}