crossbind 2.0.0-beta.73 → 2.0.0-beta.75

package/src/actions/licenses.js

@@ -113,6 +113,32 @@ function wasiToolchainRows() {
     ];
 }
 
+// A wasm module statically links Emscripten's runtime and system libraries (its musl-based libc among them) and LLVM's
+// C++ runtime from the same toolchain image.
+function wasmToolchainRows() {
+    const shared = {
+        npmName: null, version: null, nativeVersion: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
+    };
+    return [
+        {
+            ...shared,
+            name: 'emscripten',
+            license: 'MIT OR NCSA',
+            licenseDeclared: 'MIT OR NCSA',
+            sourceUrl: 'https://github.com/emscripten-core/emscripten',
+            licenseNotes: "Emscripten's runtime and system libraries, its musl-based libc among them, statically linked into the module; license text: https://github.com/emscripten-core/emscripten/blob/main/LICENSE",
+        },
+        {
+            ...shared,
+            name: 'llvm-runtimes',
+            license: 'Apache-2.0 WITH LLVM-exception',
+            licenseDeclared: 'Apache-2.0 WITH LLVM-exception',
+            sourceUrl: 'https://github.com/llvm/llvm-project',
+            licenseNotes: "libc++, libc++abi and compiler-rt of Emscripten's LLVM, statically linked into the module; license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT",
+        },
+    ];
+}
+
 // The notices a build copied out of its toolchain image (a Windows addon's or app's does).
 function toolchainNoticeTexts(platform) {
     const build = state.config?.paths?.build;
@@ -160,25 +186,31 @@ function addonToolchainRows(platform) {
 const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
 const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
 
+const RUNTIME_ROW = {
+    nativeVersion: null, sha256: null, licenseSelected: null, isCopyleft: false, isRuntime: true,
+};
+
+// crossbind's own code: what an addon and an app host compile in, or the JavaScript a wasm module's glue bundles.
+function crossbindRow(notes) {
+    return {
+        ...RUNTIME_ROW,
+        name: 'crossbind',
+        npmName: 'crossbind',
+        version: versionOf(CROSSBIND_ROOT),
+        license: 'MIT',
+        licenseDeclared: 'MIT',
+        sourceUrl: 'https://github.com/crossbind/crossbind',
+        licenseNotes: notes,
+        licenseText: textOf(path.join(CROSSBIND_ROOT, 'LICENSE')),
+    };
+}
+
 // crossbind's runtime, which an addon and an app host compile in: embind-jsi, which adapts Emscripten's embind.
 function runtimeRows(jsiRoot, notes) {
-    const shared = {
-        nativeVersion: null, sha256: null, licenseSelected: null, isCopyleft: false,
-    };
     return [
+        crossbindRow(notes),
         {
-            ...shared,
-            name: 'crossbind',
-            npmName: 'crossbind',
-            version: versionOf(CROSSBIND_ROOT),
-            license: 'MIT',
-            licenseDeclared: 'MIT',
-            sourceUrl: 'https://github.com/crossbind/crossbind',
-            licenseNotes: notes,
-            licenseText: textOf(path.join(CROSSBIND_ROOT, 'LICENSE')),
-        },
-        {
-            ...shared,
+            ...RUNTIME_ROW,
             name: 'emscripten-embind',
             npmName: '@crossbind/core-embind-jsi',
             version: versionOf(jsiRoot),
@@ -420,10 +452,13 @@ async function buildRow(node) {
             sourceUrl = null;
         }
     }
-    if (!sourceUrl) sourceUrl = manifest?.homepage || null;
-
     const family = familyManifestOf(node);
-    const upstream = family?.manifest?.crossbind?.upstream?.license || null;
+    // A project's own code is at its repository; its homepage is where its docs are.
+    if (!sourceUrl) sourceUrl = repositoryUrl(family?.manifest) || repositoryUrl(manifest) || manifest?.homepage || null;
+
+    // The upstream identity scanners match a component on: the project's own name, and its CPE where NVD has one.
+    const identity = family?.manifest?.crossbind?.upstream ?? null;
+    const upstream = identity?.license || null;
     let license;
     let licenseText;
     if (upstream) {
@@ -437,6 +472,12 @@ async function buildRow(node) {
         if (isComplete) licenseText = fromSource;
         else if (shipped) licenseText = `=== ${path.basename(shipped)} ===\n\n${fs.readFileSync(shipped, 'utf8').trim()}`;
         else licenseText = readLicenseTexts(upstream.files, () => null);
+    } else if (family && family.dir !== node.paths.project) {
+        // The package the alias names holds the code: a published binary's own license field is the expression of
+        // everything it links, which this row would otherwise repeat as its own.
+        license = family.manifest.license || manifest?.license || null;
+        const own = packageLicenseFile(family.dir) ?? packageLicenseFile(node.paths.project);
+        licenseText = own ? fs.readFileSync(own, 'utf8') : null;
     } else {
         license = manifest?.license || null;
         const legacy = packageLicenseFile(node.paths.project);
@@ -444,10 +485,11 @@ async function buildRow(node) {
     }
 
     return {
-        name: node.general.name,
+        name: identity?.name ?? node.general.name,
         npmName: manifest?.name || null,
         version: manifest?.version || null,
         nativeVersion,
+        cpe: identity?.cpe ? `cpe:2.3:a:${identity.cpe}:${nativeVersion ?? '*'}:*:*:*:*:*:*:*` : null,
         license,
         licenseDeclared: upstream?.declared || null,
         licenseSelected: upstream?.selected || null,
@@ -456,9 +498,21 @@ async function buildRow(node) {
         sourceUrl,
         licenseText,
         isCopyleft: isCopyleft(license),
+        isPort: Boolean(upstream),
+        shipsData: shipsData(node),
     };
 }
 
+export function repositoryUrl(manifest) {
+    const repository = typeof manifest?.repository === 'string' ? manifest.repository : manifest?.repository?.url;
+    return repository ? repository.replace(/^git\+/, '').replace(/\.git$/, '') : null;
+}
+
+// The data a dependency declares (GDAL's and PROJ's) travels with the package that ships the module or its loader.
+function shipsData(node) {
+    return (node.targetSpecs ?? []).some((entry) => entry?.specs?.data && Object.keys(entry.specs.data).length > 0);
+}
+
 // The facts of a package source's package come from its recipe, and its texts from the licenses/ its package ships.
 function sourcePackageRow(node) {
     const { name: source, package: pkg } = node.general.packageSource;
@@ -497,9 +551,22 @@ function assertSourcesStaged() {
     });
 }
 
+// The libraries whose recipes vendor copies for some platform, which only a listing for that platform includes.
+export async function vendoringLibraries() {
+    const names = [];
+    for (const node of [state.config, ...state.config.allDependencies]) {
+        if (!node?.paths?.project || node.general?.packageSource) continue;
+        const recipe = await loadJs(node.paths.project, 'crossbind.build');
+        const isVendoring = Object.values(recipe?.bundled ?? {}).some((entries) => entries?.length > 0);
+        if (isVendoring && !names.includes(node.general.name)) names.push(node.general.name);
+    }
+    return names;
+}
+
 // platform (optional, e.g. 'wasi') additionally includes what that platform's
 // artifact statically links beyond the package graph: recipe-declared vendored
-// copies and the toolchain runtime. runtimeEnv 'node' adds the crossbind runtime an
+// copies and the toolchain runtime, and for wasm crossbind's runtime, which the
+// module's glue bundles. runtimeEnv 'node' adds the crossbind runtime an
 // addon of that platform compiles in, or without a platform the one its loader bundles;
 // runtimeEnv 'app' adds what an app's host carries.
 export default async function collectLicenseRows(platform = null, { runtimeEnv = null } = {}) {
@@ -513,12 +580,16 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
     const nodes = [state.config, ...state.config.allDependencies]
         .filter((node, index) => node?.paths?.project
             && (node.general?.alias?.package || node.general?.packageSource || (index > 0 && node.package?.name && !node.package.private)));
+    // A project can depend on a library's packages for several platforms; the report names the one its platform links.
+    const target = platform ? state.targets?.find((t) => t.platform === platform) : null;
+    const serves = (node) => !target || node.functions?.isEnabled?.(target) !== false;
     const rows = [];
     const seen = new Set();
-    for (const node of nodes) {
-        const key = keyOf(node);
+    for (const listed of nodes) {
+        const key = keyOf(listed);
         if (seen.has(key)) continue;
         seen.add(key);
+        const node = nodes.find((other) => keyOf(other) === key && serves(other)) ?? listed;
         rows.push(node.general.packageSource ? sourcePackageRow(node) : await buildRow(node));
         // A package source's package folder is written from what its recipe produced: nothing there is run.
         if (platform && !node.general.packageSource) {
@@ -527,6 +598,7 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
         }
     }
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
+    if (platform === 'wasm') rows.push(...wasmToolchainRows(), crossbindRow("crossbind's JavaScript runtime, which the module's glue bundles"));
     if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
     if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
     if (runtimeEnv === 'app') {

package/src/actions/pageLicenses.js

@@ -0,0 +1,89 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import state from '../state/index.js';
+import collectLicenseRows, { repositoryUrl } from './licenses.js';
+
+const FILE = 'crossbind-licenses.json';
+// crossbind/licenses, from whichever copy of crossbind the page has.
+const HELPER = /[\\/]crossbind[\\/]src[\\/]licenses[\\/]index\.js$/;
+const TEXT_FILE = /^(licen[cs]e|copying|notice|ofl)([._-].*)?$/i;
+
+// What a bundle holds: its chunks' modules, and the files its assets came from, as the font a stylesheet's url() takes.
+function bundledFiles(bundle, root) {
+    return Object.values(bundle)
+        .flatMap((output) => (output.type === 'chunk'
+            ? output.moduleIds
+            : (output.originalFileNames ?? []).map((name) => path.resolve(root, name))))
+        .map((id) => id.split('?')[0]);
+}
+
+function manifestIn(dir, manifests) {
+    const file = path.join(dir, 'package.json');
+    if (!manifests.has(file)) {
+        try {
+            manifests.set(file, fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : null);
+        } catch (error) {
+            throw new Error(`crossbind: ${file} holds no JSON: ${error.message}`, { cause: error });
+        }
+    }
+    return manifests.get(file);
+}
+
+// The package a file is in: the nearest folder up from it whose package.json names one, as a package's subfolder can
+// hold one that names none.
+function packageOf(file, manifests) {
+    if (!path.isAbsolute(file)) return null;
+    for (let dir = path.dirname(path.resolve(file)); dir !== path.dirname(dir); dir = path.dirname(dir)) {
+        const manifest = manifestIn(dir, manifests);
+        if (manifest?.name) return { dir, manifest };
+    }
+    return null;
+}
+
+function npmEntry({ dir, manifest }) {
+    const texts = fs.readdirSync(dir, { withFileTypes: true })
+        .filter((entry) => entry.isFile() && TEXT_FILE.test(entry.name))
+        .map((entry) => entry.name)
+        .sort()
+        .map((file) => `=== ${file} ===\n\n${fs.readFileSync(path.join(dir, file), 'utf8').trim()}`);
+    return {
+        name: manifest.name,
+        version: manifest.version ?? null,
+        license: typeof manifest.license === 'string' ? manifest.license : manifest.license?.type ?? null,
+        source: repositoryUrl(manifest) ?? manifest.homepage ?? null,
+        text: texts.length > 0 ? texts.join('\n\n') : null,
+    };
+}
+
+// The npm packages the page carries, but for the project's own code: its package and private ones.
+function npmEntriesOf(files) {
+    const manifests = new Map();
+    const project = path.resolve(state.config.paths.project);
+    const packages = new Map(files
+        .map((file) => packageOf(file, manifests))
+        .filter((found) => found && found.dir !== project && !found.manifest.private)
+        .map((found) => [found.dir, found]));
+    return [...packages.values()].map(npmEntry);
+}
+
+const nativeEntry = (row) => ({
+    name: row.name,
+    version: row.nativeVersion ?? row.version ?? null,
+    license: row.license ?? null,
+    source: row.sourceUrl ?? null,
+    text: row.licenseText ?? null,
+});
+
+// The list a page reads with crossbind/licenses, which its build writes beside it if it does: what the module links and
+// an app carries, as `crossbind licenses` lists them, and the npm packages the page's bundle holds, each once. bundle is
+// what Rollup or Vite hands generateBundle, root what its assets' original file names are relative to.
+export default async function pageLicensesAsset(bundle, { root, platform, runtimeEnv = null }) {
+    const files = bundledFiles(bundle, root);
+    if (!files.some((file) => HELPER.test(file))) return null;
+    const native = (await collectLicenseRows(platform, { runtimeEnv })).map(nativeEntry);
+    const listed = new Set();
+    const entries = [...native, ...npmEntriesOf(files)]
+        .filter(({ name, version }) => !listed.has(`${name}@${version}`) && listed.add(`${name}@${version}`))
+        .sort((a, b) => a.name.localeCompare(b.name));
+    return { fileName: FILE, source: JSON.stringify(entries) };
+}

package/src/actions/run.js

@@ -26,6 +26,31 @@ export const EXEC_MAX_BUFFER = 512 * 1024 * 1024;
 // Containers share the memory of Docker's VM, and one compile at full -j can take most of a desktop VM
 // (GDAL's bindings peak at 7.5 of 7.7 GiB), so the exclusive steps of parallel builds take turns.
 const DOCKER_COMPILE_LOCK = path.join(os.homedir(), '.crossbind', 'docker-compile.lock');
+// With CROSSBIND_SCCACHE set, C and C++ compiles go through sccache, which its SCCACHE_* variables configure, by CMake's
+// launchers. A wasm build compiles without it: sccache 0.19 recognizes neither em++ nor emscripten's clang, which has
+// no default target, and cannot cache the -Xclang flags emcc passes that clang.
+const SCCACHE_LAUNCHERS = ['CMAKE_C_COMPILER_LAUNCHER', 'CMAKE_CXX_COMPILER_LAUNCHER'];
+// sccache's key leaves out the target llvm-mingw's compilers take from their own names, so an x64 and an arm64 compile of
+// one source would share it; the buster, which sccache hashes into every key, names the target.
+const SCCACHE_BUSTER = 'SCCACHE_C_CUSTOM_CACHE_BUSTER';
+const sccacheBuster = (target) => [process.env[SCCACHE_BUSTER], target?.platform, target?.arch].filter(Boolean).join('-');
+const SCCACHE_SETTING =/^(SCCACHE_\w+|AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN)$/;
+const SCCACHE_IN_IMAGE = 'command -v sccache >/dev/null || { echo "crossbind: CROSSBIND_SCCACHE needs toolchain images that carry sccache, '
+    + 'image family 1.0.21 or later." >&2; exit 1; }; ';
+// A docker run's sccache server ends with its container, so the command stops it first, which waits for the cache writes
+// it holds; a DOCKER_EXEC container's server serves the commands after it.
+const SCCACHE_IN_CONTAINER = {
+    DOCKER_RUN: `${SCCACHE_IN_IMAGE}"$0" "$@"; status=$?; sccache --stop-server >/dev/null 2>&1; exit $status`,
+    DOCKER_EXEC: `${SCCACHE_IN_IMAGE}exec "$0" "$@"`,
+};
+const isSccacheOn = () => /^(1|true)$/i.test(process.env.CROSSBIND_SCCACHE ?? '');
+const sccacheSettings = () => Object.keys(process.env).filter((key) => SCCACHE_SETTING.test(key)).sort();
+// Where a container finds a local sccache directory: a docker run mounts it here, a long-lived container sees the project.
+const SCCACHE_CONTAINER_DIR = '/tmp/crossbind/sccache';
+const isInside = (parent, child) => {
+    const relative = path.relative(parent, child);
+    return !relative.startsWith('..') && !path.isAbsolute(relative);
+};
 const envParams = (env) => Object.entries(env).flatMap(([variable, value]) => ['-e', `${variable}=${value}`]);
 const CROSSCOMPILER_ARM64 = `aarch64-linux-android${ANDROID_API_LEVEL}`;
 const CROSSCOMPILER_x86_64 = `x86_64-linux-android${ANDROID_API_LEVEL}`;
@@ -139,6 +164,15 @@ export default function run(program, params = [], platformPrefix = null, target
         ? { runner: 'LOCAL' }
         : runnerFor(role, state.config.system);
     const isDocker = runner === 'DOCKER_RUN' || runner === 'DOCKER_EXEC';
+    const isSccache = isSccacheOn() && target?.platform !== 'wasm';
+    if (isSccache && runner === 'REMOTE') {
+        throw new Error('crossbind: CROSSBIND_SCCACHE works with the DOCKER_RUN, DOCKER_EXEC and LOCAL runners; a remote runner would need your '
+            + 'cache\'s keys. Unset it for a remote build.');
+    }
+    const sccacheDir = isSccache && isDocker ? process.env.SCCACHE_DIR : undefined;
+    if (sccacheDir && runner === 'DOCKER_EXEC' && !isInside(state.config.paths.base, sccacheDir)) {
+        throw new Error(`crossbind: a DOCKER_EXEC container reaches the project alone, so SCCACHE_DIR (${sccacheDir}) must sit inside ${state.config.paths.base}.`);
+    }
     const wasiHostSdk = target?.platform === 'wasi' ? resolveWasiSdkPath(state.config.system) : null;
     if (isDocker) {
         // Google ships the linux NDK for x86_64 only, so the android index carries no arm64 leaf;
@@ -212,10 +246,10 @@ export default function run(program, params = [], platformPrefix = null, target
                 if (dProgram === 'cmake') {
                     platformParams = [];
                     if (dParams[0] !== '--build' && dParams[0] !== '--install') {
+                        // CMake's own iOS platform with Makefiles: the Xcode generator spent 40-55 s configuring even a
+                        // small project. Not the app host's toolchain file, whose searches find the Mac's own packages.
                         dParams = [
                             ...dParams,
-                            '-G',
-                            'Xcode',
                             '-DBUILD_SHARED_LIBS=OFF',
                             '-DFRAMEWORK=TRUE',
                             `-DCMAKE_OSX_DEPLOYMENT_TARGET=${IOS_DEPLOYMENT_TARGET}`,
@@ -227,6 +261,11 @@ export default function run(program, params = [], platformPrefix = null, target
                             '-DCMAKE_SYSTEM_PROCESSOR=arm64',
                             `-DCMAKE_C_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
                             `-DCMAKE_CXX_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
+                            // The objects carry bitcode as before; a link, as of a configure check or a recipe's tests,
+                            // takes none, since Xcode's linker reads -fembed-bitcode-marker's mode as a file.
+                            '-DCMAKE_EXE_LINKER_FLAGS=-fembed-bitcode=off',
+                            '-DCMAKE_SHARED_LINKER_FLAGS=-fembed-bitcode=off',
+                            '-DCMAKE_MODULE_LINKER_FLAGS=-fembed-bitcode=off',
                             "-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY='iPhone Developer'",
                             `-DCMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM=${state.config.system.XCODE_DEVELOPMENT_TEAM}`,
                         ];
@@ -355,6 +394,18 @@ export default function run(program, params = [], platformPrefix = null, target
     const containerOptions = { cwd: buildPath, stdio: dockerOptions.console ? 'inherit' : ['ignore', 'pipe', 'pipe'], maxBuffer: EXEC_MAX_BUFFER };
     let fileExecParams;
     if (runner === 'LOCAL') {
+        if (isSccache) {
+            // By its full path: a macOS build narrows the PATH below.
+            const sccache = findExecutable('sccache', process.env.PATH ?? '');
+            if (!sccache) throw new Error('crossbind: CROSSBIND_SCCACHE needs sccache on the PATH: install it with `brew install sccache`, or unset CROSSBIND_SCCACHE.');
+            SCCACHE_LAUNCHERS.forEach((key) => {
+                env[key] = sccache;
+            });
+            sccacheSettings().forEach((key) => {
+                env[key] = process.env[key];
+            });
+            env[SCCACHE_BUSTER] = sccacheBuster(target);
+        }
         env.PATH = `/opt/homebrew/bin:${env.PATH}`;
         // A package's *-config script on the PATH (nc-config, sfcgal-config, ...) would compile that
         // package into the archives. cmake is the one host tool a darwin build takes from the PATH.
@@ -392,6 +443,11 @@ export default function run(program, params = [], platformPrefix = null, target
         if (runner === 'DOCKER_RUN') {
             imageOrContainer = getDockerImage(role);
             runnerParams = ['run', '--rm', ...DOCKER_RUN_SECURITY_ARGS, '-v', `${state.config.paths.base}:/tmp/crossbind/live`];
+            if (sccacheDir) {
+                // Made here, as docker would make a missing one owned by root.
+                fs.mkdirSync(sccacheDir, { recursive: true });
+                runnerParams.push('-v', `${sccacheDir}:${SCCACHE_CONTAINER_DIR}`);
+            }
             if (target?.platform === 'android') {
                 // Google ships the linux NDK for x86_64 only; use the amd64 leaf ref (classic store holds one platform per digest).
                 pullDockerImage(role, 'linux/amd64');
@@ -403,6 +459,16 @@ export default function run(program, params = [], platformPrefix = null, target
             runnerParams = ['exec'];
         }
 
+        // The settings go by name, docker taking their values from its own environment, so no key sits in the arguments.
+        const insideDir = sccacheDir && (runner === 'DOCKER_RUN' ? SCCACHE_CONTAINER_DIR : replaceBasePathForDocker(sccacheDir));
+        const sccache = isSccache ? [
+            ...SCCACHE_LAUNCHERS.flatMap((key) => ['-e', `${key}=sccache`]),
+            ...sccacheSettings().filter((key) => !(sccacheDir && key === 'SCCACHE_DIR') && key !== SCCACHE_BUSTER).flatMap((key) => ['-e', key]),
+            '-e',
+            `${SCCACHE_BUSTER}=${sccacheBuster(target)}`,
+            ...(sccacheDir ? ['-e', `SCCACHE_DIR=${insideDir}`] : []),
+        ] : [];
+        const command = isSccache ? ['sh', '-c', SCCACHE_IN_CONTAINER[runner], dProgram, ...dParams] : [dProgram, ...dParams];
         const args = [
             ...runnerParams,
             '--user',
@@ -410,10 +476,9 @@ export default function run(program, params = [], platformPrefix = null, target
             '--workdir',
             replaceBasePathForDocker(dockerOptions.workdir || buildPath),
             ...replaceBasePathForDocker(dockerEnv),
-            // '-e', replaceBasePathForDocker(`CCACHE_DIR=${state.config.paths.build}/ccache`),
+            ...sccache,
             imageOrContainer,
-            replaceBasePathForDocker(dProgram),
-            ...replaceBasePathForDocker(dParams),
+            ...replaceBasePathForDocker(command),
         ];
         fileExecParams = ['docker', args, options];
     }

package/src/assets/js-runtime/adapters/worker-comlink.js

@@ -45,8 +45,19 @@ const ownsObject = (obj) => {
 // frees nothing.
 const moduleObjects = new WeakSet();
 
+// A pointer a member handed out holds a clone of the handle of the object it points into
+// (utils/embindPointerOwners.js), which goes once no handle shares the pointer's count.
+const releaseOwner = (obj) => {
+    const count = obj?.$$?.count;
+    if (!count?.owner || count.value > (obj.isDeleted() ? 0 : 1)) return;
+    const { owner } = count;
+    count.owner = undefined;
+    if (!owner.isDeleted()) owner.delete();
+};
+
 const freeIfOwned = (obj) => {
     if (ownsObject(obj) && !moduleObjects.has(obj) && !obj.isDeleted()) obj.delete();
+    releaseOwner(obj);
 };
 
 // The worker side of a handle the main thread no longer reaches: its id goes, and the object with the last id.

package/src/assets/toolchain-digests.json

@@ -1,55 +1,55 @@
 {
-    "version": "1.0.20",
+    "version": "1.0.21",
     "registry": "ghcr.io/crossbind",
     "toolchains": {
         "rust": "1.99.1"
     },
     "images": {
         "rust-sysroot": {
-            "index": "sha256:3f62871ccbebbdca53b798fa1b21173bee848ada7744f5108df66a290d3cca78",
+            "index": "sha256:de0e2969f74bb458d134f796d04f60ab2b2342ddc4f7d336a2ac945973c628a0",
             "platforms": {
-                "linux/arm64": "sha256:ec7c2bba3add2385099b71520c5d68540e8dba691f57a42c0e9143ea5b8981df",
-                "linux/amd64": "sha256:dfad6e04d3168f5e7375aba271d0e615cc6658793527503ce3070efbd4ac5f91"
+                "linux/amd64": "sha256:2b4b338f185a44dfffd28eece9a79eedf7cef27fdd613ac4428bded4b394e773",
+                "linux/arm64": "sha256:8f0f72be0386b0a823db7520e23b1eb424da9daf64a364dffa983738d0b07035"
             }
         },
         "base": {
-            "index": "sha256:a5c7ea17f3e13c13d3c9f53307cce95d037bbb6b58b08034cfa2cb8112a63407",
+            "index": "sha256:8894f7f3deb8e3980cf138fea3552e3375d6250d08aba5b3828909bf55d796fc",
             "platforms": {
-                "linux/amd64": "sha256:a0934c868ccd5a09de14d193ae33b091ecfddf3c13548595e918c0b053e41dd6",
-                "linux/arm64": "sha256:14d4bcea7537972052cd6cee314a5c08f1cd68eebd3a7461ff7ca594994c49eb"
+                "linux/arm64": "sha256:9e8c9c6495d4c0e743c2a9b471b3e76fe8117507b44e7eb469009cd241473262",
+                "linux/amd64": "sha256:4a8305251eb48835bc13c9640303f6e9dfdb14be8ccb28d57ed808175d4dc8e9"
             }
         },
         "web": {
-            "index": "sha256:00a19f61fa46315175be11f20cea051311c218ab6e99bd1bca70236415a69af9",
+            "index": "sha256:5497576cba5a945249f9ff76f8cc40b43b0a26c1d0ce9dd7874ed842550b96c2",
             "platforms": {
-                "linux/arm64": "sha256:6e75223e8c696d93f5ab57e286425b4b94c4b1dcb3cf291e63c2820636dfa2a6",
-                "linux/amd64": "sha256:fe4e84f435838a35f2d60774be0050c39f2ecf1b8ed6cca23530b8c32f5c6211"
+                "linux/arm64": "sha256:a661e57cd9a748b8053a3b315474b5e42f39eb691ef2834f9b57dc2f0cb3db17",
+                "linux/amd64": "sha256:82d2163287aba2d77af0db0517ee4a96e69e34e2d54d45b4ef6f39151a466494"
             }
         },
         "android": {
-            "index": "sha256:df5bf439ab81afbe28a166dcd3c0ec281aea11d4265b1fc24225cc686f643ce1",
+            "index": "sha256:f54939cf8d648db75178d9a8cb1456453459b03d46fca7f2fa483b979677aa00",
             "platforms": {
-                "linux/amd64": "sha256:d2f5460a998aa1695b04d0d1bc231af4d77dd78931ca0f2b02adec51a61f0c02"
+                "linux/amd64": "sha256:1030809494407742bd71675d1c8d2967b08a42285ccb47ddf81fa52e8d41c2c6"
             }
         },
         "android-app": {
-            "index": "sha256:d72766f41a7d0343fdf36a425a9c5e0ea7dda8ac6f3b2697fe49d79a21e5018b",
+            "index": "sha256:9be66dedaaf5f36e5795d080eaa43a523b79246c014719783c15e522d6d6f6c4",
             "platforms": {
-                "linux/amd64": "sha256:8e62eea8685cd28276dfdd28b34aa75b3a0a677b40a93ea3f28f7f3ef1565425"
+                "linux/amd64": "sha256:1f7963b928513a1892c39e706515a0929abd4b6f72946c2943d476be2741725e"
             }
         },
         "linux": {
-            "index": "sha256:a4828cf2821cc2313f5ddf5bc761073c90616fbef09daa8b8d93e7fa3050497a",
+            "index": "sha256:4cdbe97aef06a84f82bf1f6e2f5badc354638c4f15364033ff1059247caa28ed",
             "platforms": {
-                "linux/arm64": "sha256:501a878b581295d3946945dfa9bc98a0aa3de5d4c6bc006c7224756cccbf1e35",
-                "linux/amd64": "sha256:ee5a4f7ee23fdda7e50d4130d783a76d7c44d079ae34b4a326565510eea761dc"
+                "linux/arm64": "sha256:b074c80b96455cfa8cfc1349bc1b77ce3286bff36d095831416c4e1111c69cf0",
+                "linux/amd64": "sha256:ca2194dd604dadfdb73f0bbe3b2e5a65ab6330bae6f9b8079b1c8ca9c9e2a11a"
             }
         },
         "windows": {
-            "index": "sha256:13fc02ab67d1465cbe75715d7de6a87c5319477eba2c0459c914bb5b698df766",
+            "index": "sha256:89dea8be3a1415c87854c2bccfb2cee95ec1d2f775b1b4db6260882d01d02a46",
             "platforms": {
-                "linux/amd64": "sha256:78883c59167af69c5b9433ef6cdfa35aab3833501bb85d830d95f24079a6c8d0",
-                "linux/arm64": "sha256:f27f09f8e661261c770976580d9861d4ce290eb1ac3030e6198f3c0a4987bd8a"
+                "linux/amd64": "sha256:454b9c339628d033d43f64422a12be9445193f167183fbeca71b4ae8af128673",
+                "linux/arm64": "sha256:9d823e18683cedfcc94ff6fb3c637c74929b4ee5601f72b3b87a4cedc7cd2d9e"
             }
         }
     }

package/src/bin.js

@@ -48,9 +48,9 @@ import { cargoHome } from './utils/runCargo.js';
 import { containerRootOf, sourceRoot } from './utils/runPackageSource.js';
 import { importSchemesOf, sourceNamesOf } from './utils/packageSources.js';
 import { cleanDepsCache } from './utils/dependencyRebuild.js';
-import collectLicenseRows from './actions/licenses.js';
+import collectLicenseRows, { vendoringLibraries } from './actions/licenses.js';
 import { formatNoticesMarkdown, formatCycloneDxSbom, validateSpdx } from './utils/licenseReport.js';
-import { SBOM_FILE, nodePackageMeta, writeNodePackageLicense } from './utils/packageLicense.js';
+import { SBOM_FILE, nodePackageMeta, shippedRows, writeNodePackageLicense } from './utils/packageLicense.js';
 import findFiles from './utils/findFiles.js';
 
 const platforms = [...new Set(state.targets.map(target => target.platform).filter(t => t))];
@@ -240,11 +240,17 @@ program.command('licenses')
         });
         const copyleftRows = rows.filter((row) => row.isCopyleft);
         if (copyleftRows.length > 0) {
-            console.log(`\n! ${copyleftRows.length} copyleft-licensed ${copyleftRows.length === 1 ? 'dependency' : 'dependencies'} (${copyleftRows.map((row) => row.name).join(', ')}) — see docs/playbooks/licensing-lgpl.md`);
+            console.log(`\n! ${copyleftRows.length} copyleft-licensed ${copyleftRows.length === 1 ? 'dependency' : 'dependencies'} (${copyleftRows.map((row) => row.name).join(', ')}) — see https://github.com/crossbind/crossbind/blob/main/docs/playbooks/licensing-lgpl.md`);
+        }
+        if ((options.notices || options.sbom) && !options.platform) {
+            const vendoring = await vendoringLibraries();
+            if (vendoring.length > 0) {
+                console.warn(`crossbind: ${vendoring.join(', ')} vendor${vendoring.length === 1 ? 's' : ''} copies of other libraries per platform; pass --platform <platform> so the notices and SBOM list them.`);
+            }
         }
         if (options.notices) {
             const file = typeof options.notices === 'string' ? options.notices : `${state.config.paths.project}/THIRD-PARTY-NOTICES.md`;
-            fs.writeFileSync(file, formatNoticesMarkdown(rows));
+            fs.writeFileSync(file, formatNoticesMarkdown(rows, nodePackageMeta(state.config)));
             logger.info(`crossbind: wrote ${file}`);
         }
         if (options.sbom) {
@@ -265,7 +271,8 @@ program.command('licenses')
             logger.info(`crossbind: wrote ${file}`);
         }
         if (options.package) {
-            const expression = writeNodePackageLicense(state.config.paths.project, { ...nodePackageMeta(state.config), rows });
+            const meta = nodePackageMeta(state.config);
+            const expression = writeNodePackageLicense(state.config.paths.project, { ...meta, rows: shippedRows(rows, meta) });
             logger.info(`crossbind: wrote LICENSE and ${SBOM_FILE} (${expression})`);
         }
         if (options.check) {

package/src/index.js

@@ -9,6 +9,7 @@ export {
 export { checkInstaller, shipApp } from './actions/appInstaller.js';
 export { findAppPageApi, resolveAppPageApi } from './utils/resolveAppHost.js';
 export { default as isAppBuild } from './utils/appBuild.js';
+export { default as pageLicensesAsset } from './actions/pageLicenses.js';
 export { default as openInSimulator, buildForSimulator } from './actions/iosSimulator.js';
 export {
     default as openOnIosDevice, buildForIosDevice, connectedIosDevice, iosDeviceAddress, iosDevServer,

package/src/licenses/index.d.ts

@@ -0,0 +1,16 @@
+/** A component a page or the app it runs in carries: a library the native module links, a part of an app's host or crossbind's runtime, or an npm package in the page's bundle. */
+export interface License {
+    /** The name its project gives it. */
+    name: string;
+    /** The version of the code the page or app carries. */
+    version: string | null;
+    /** An SPDX expression. */
+    license: string | null;
+    /** Where its code is. */
+    source: string | null;
+    /** Its license texts as it carries them, each under its file's name. */
+    text: string | null;
+}
+
+/** The components the page and its app carry, by name, from the crossbind-licenses.json a build with crossbind's Vite or Rollup plugin writes beside the page. Rejects on a dev server, which has none. */
+export function licenses(): Promise<License[]>;

package/src/licenses/index.js

@@ -0,0 +1,15 @@
+// The licenses of what a page and the app it runs in carry, from the crossbind-licenses.json a build of the page with
+// crossbind's Vite or Rollup plugin writes beside it.
+const FILE = 'crossbind-licenses.json';
+
+export async function licenses() {
+    // Vite gives the base it serves the page from; elsewhere the file is beside the page.
+    const url = new URL(`${import.meta.env?.BASE_URL ?? './'}${FILE}`, document.baseURI);
+    const response = await fetch(url);
+    // A dev server answers a file it lacks with the page.
+    const list = response.ok ? await response.json().catch(() => null) : null;
+    if (!Array.isArray(list)) {
+        throw new Error(`crossbind: ${url} holds no license list. A build of the page with crossbind's Vite or Rollup plugin writes it; the dev server has none.`);
+    }
+    return list;
+}

package/src/state/loadConfig.js

@@ -146,6 +146,8 @@ export function getFilledConfig(config, options = { isDepend: false }) {
         app: config.app || {},
         // What an app's host builds in beside its own extensions.
         extensions: config.extensions || [],
+        // The license files crossbind licenses writes: sourceTag is the git tag a published package's source is at.
+        licenses: config.licenses || {},
         package: null,
         functions: config.functions || {},
     };
@@ -153,6 +155,9 @@ export function getFilledConfig(config, options = { isDepend: false }) {
     if (!['sync', 'promise'].includes(newConfig.dts)) {
         throw new Error(`crossbind: "dts" must be 'sync' or 'promise' (got '${newConfig.dts}').`);
     }
+    if (newConfig.licenses.sourceTag !== undefined && typeof newConfig.licenses.sourceTag !== 'string') {
+        throw new Error(`crossbind: "licenses.sourceTag" must be a string such as 'v{version}' (got '${newConfig.licenses.sourceTag}').`);
+    }
     if (typeof newConfig.types !== 'boolean') {
         throw new Error(`crossbind: "types" must be true or false (got '${newConfig.types}').`);
     }