crossbind 2.0.0-beta.74 → 2.0.0-beta.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crossbind",
-  "version": "2.0.0-beta.74",
+  "version": "2.0.0-beta.75",
   "license": "MIT",
   "homepage": "https://crossbind.dev",
   "repository": {
@@ -38,7 +38,7 @@
     "vitest": "^5.0.1"
   },
   "dependencies": {
-    "@crossbind/extension-conan": "2.0.0-beta.74",
+    "@crossbind/extension-conan": "2.0.0-beta.75",
     "@rollup/plugin-commonjs": "^29.0.3",
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.3",
@@ -55,7 +55,7 @@
     "upath": "^3.0.8"
   },
   "optionalDependencies": {
-    "@crossbind/bridge-tools": "2.0.0-beta.74"
+    "@crossbind/bridge-tools": "2.0.0-beta.75"
   },
   "keywords": [
     "webassembly",

package/src/actions/buildWasm.js

@@ -15,9 +15,10 @@ import { guardBigIntArguments, guardEmbindArguments } from '../utils/embindArgum
 import { separateCallArguments } from '../utils/embindCallArguments.js';
 import { queueJspiCalls } from '../utils/embindJspiQueue.js';
 import { releaseOwnedHandles } from '../utils/embindObjectLifetime.js';
+import { keepPointerOwners } from '../utils/embindPointerOwners.js';
 import { spawnPthreadsFromMainScript } from '../utils/pthreadMainScript.js';
 
-const GLUE_REWRITES = ['../utils/embindArgumentGuards.js', '../utils/embindCallArguments.js', '../utils/embindJspiQueue.js', '../utils/embindObjectLifetime.js', '../utils/pthreadMainScript.js']
+const GLUE_REWRITES = ['../utils/embindArgumentGuards.js', '../utils/embindCallArguments.js', '../utils/embindJspiQueue.js', '../utils/embindObjectLifetime.js', '../utils/embindPointerOwners.js', '../utils/pthreadMainScript.js']
     .map((file) => fileURLToPath(new URL(file, import.meta.url)));
 
 // embind's bigint converter turns any Number into a BigInt, so 2^53+1 silently becomes 2^53.
@@ -76,6 +77,17 @@ function releaseOwnedObjects(target) {
     }
 }
 
+// A pointer a member hands out outlived the object it points into once JavaScript freed that object
+// (utils/embindPointerOwners.js); each runtimeEnv links its own glue, so each one calls this after its link.
+function keepPointerOwnersAlive(target) {
+    const gluePath = `${state.config.paths.build}/${target.rawJsName}`;
+    const { text, missed } = keepPointerOwners(fs.readFileSync(gluePath, 'utf8'));
+    fs.writeFileSync(gluePath, text);
+    if (missed) {
+        logger.error('embind pointer owner rewrite missed (emscripten glue format changed?): a pointer a method returns can outlive the object it points into');
+    }
+}
+
 // A direct-mode mt init in a browser spawns its pthreads from "/undefined" (utils/pthreadMainScript.js).
 function pointPthreadSpawn(target) {
     const gluePath = `${state.config.paths.build}/${target.rawJsName}`;
@@ -244,6 +256,7 @@ export default async function buildWasm(target, options = {}) {
         separateEmbindCalls(target);
         queueJspiEmbindCalls(target);
         releaseOwnedObjects(target);
+        keepPointerOwnersAlive(target);
         await buildJs(target);
         // fs.rmSync(`${state.config.paths.build}/${state.config.general.name}.js`);
         // fs.copyFileSync(`${state.config.paths.build}/${state.config.general.name}.browser.js`, `${state.config.paths.build}/${state.config.general.name}.js`);
@@ -286,6 +299,7 @@ export default async function buildWasm(target, options = {}) {
         separateEmbindCalls(target);
         queueJspiEmbindCalls(target);
         releaseOwnedObjects(target);
+        keepPointerOwnersAlive(target);
         await buildJs(target);
         logger.doneStep(target, 'js');
     }
@@ -323,6 +337,7 @@ export default async function buildWasm(target, options = {}) {
         separateEmbindCalls(target);
         queueJspiEmbindCalls(target);
         releaseOwnedObjects(target);
+        keepPointerOwnersAlive(target);
         await buildJs(target);
         if (emccFlags.includes('FETCH')) {
             fs.appendFileSync(`${state.config.paths.build}/${target.jsName}`, 'var XMLHttpRequest = require(\'xhr2\');\n');

package/src/actions/createInterface.js

@@ -12,6 +12,8 @@ import {
     interfaceExtras, bridgeExtras, hasPointerRuntime, withPointerRuntimeAnchor, withoutBridgeExtras, POINTER_RUNTIME_ANCHOR,
 } from '../utils/bridgeExtras.js';
 import resolveNativeImport from '../integration/resolveNativeImport.js';
+import getDependFilePath from '../integration/getDependFilePath.js';
+import { boundHeaderSpecifiers } from '../utils/boundHeaders.js';
 import { writeHeaderDts, writeSourceImportDts } from '../utils/cppDts.js';
 import { ALL_NAMES, findHeaderImportsIn } from '../utils/headerImports.js';
 import {
@@ -19,6 +21,7 @@ import {
     indexTypeDefinitions, inlineIncludes, interfaceIncludes, interfaceToRetryWithoutMacros, interfaceWithAllFunctions, parseMacroDump, referencedTypeHeaders,
     selectSwigMacros,
 } from '../utils/swigInterface.js';
+import { readSwigTree, typeClosure } from '../utils/typeClosure.js';
 import writeIfChanged from '../utils/writeIfChanged.js';
 import { withDirLockSync } from '../utils/dirLock.js';
 import { sourceImportOfHeader } from '../utils/packageSourceImport.js';
@@ -29,12 +32,18 @@ import {
 } from '../utils/bridgeTools.js';
 
 // Part of every interface hash, so interfaces cached by an older generator are rebuilt.
-const INTERFACE_FORMAT = 'swig-macros-4';
+const INTERFACE_FORMAT = 'swig-macros-5';
 // Part of every bridge hash: each bridge carries the SWIG fork's runtime and all bridges of a module must share it, so
 // bridges from a fork before field bindings and constants are rebuilt.
 const BRIDGE_FORMAT = 'swig-extras-2';
+// Part of the key of SWIG's parse of a header, which the bindings plan reads.
+const TREE_FORMAT = 'swig-xml-1';
 const predefinedMacros = new Map();
 const typeDefinitions = new Map();
+const swigTrees = new Map();
+const plans = new Map();
+const importedHeaderSets = new Map();
+const macroDumps = new Map();
 
 // Each process keeps the cache it loaded, so an interface or bridge another one has rebuilt since must not pass for
 // this one's: beside each file is the hash of what it was made from, blank while the file is written. A file without one
@@ -70,7 +79,11 @@ function bindHeader(headerOrModuleFilePath, target, { withDependencies = true, w
     // '@scope/pkg/native/x.h'), so its own directory must reach swig's include list.
     const sourceDir = upath.dirname(interfaceFilePath);
     const allNames = wholeHeaders.some((file) => upath.resolve(file) === interfaceFilePath);
+    const moduleRegex = new RegExp(`.(${state.config.ext.module.join('|')})$`);
+    const isModule = moduleRegex.test(interfaceFilePath);
     const names = bindingNames(interfaceFilePath, target, allNames);
+    const plan = isModule ? null : bindingPlan(target, wholeHeaders, interfaceFilePath, names);
+    names.classes = plan ? plan.classesOf(interfaceFilePath) : ALL_NAMES;
     if (withDependencies) warnUnimported(interfaceFilePath, names.functions);
     const interfaceFile = createInterfaceFile(interfaceFilePath, target, sourceDir, names);
     const { headerPath } = includeLocation(interfaceFilePath, target);
@@ -81,8 +94,8 @@ function bindHeader(headerOrModuleFilePath, target, { withDependencies = true, w
     const bridgeSourceHash = names.named.length ? `${sourceHash}\nnamed:${names.named.join(',')}` : sourceHash;
     const extras = { named: names.named, headerText: () => fs.readFileSync(swigView ? upath.join(swigView.dir, headerPath) : interfaceFilePath, 'utf8') };
     const bridgeFile = createBridgeFileFromInterfaceFile(interfaceFile, target, sourceDir, bridgeSourceHash, swigView, extras);
-    const moduleRegex = new RegExp(`.(${state.config.ext.module.join('|')})$`);
     if (bridgeFile) {
+        if (plan) warnUnboundClasses(bridgeFile, names.classes, plan);
         // Records which header this bridge came from, so directory-driven consumers
         // (getAllBridges) can prune bridges whose header no longer exists.
         writeIfChanged(`${bridgeFile}.source`, `${interfaceFilePath}\n`);
@@ -100,10 +113,10 @@ function bindHeader(headerOrModuleFilePath, target, { withDependencies = true, w
         }
         writeSourceImportDts(dtsOptions);
     }
-    if (bridgeFile && withDependencies && !moduleRegex.test(interfaceFilePath)) {
-        // A header's own bindings need the types its declarations use registered, which only their headers' bridges do.
-        // Such a bridge replaces the header's own, so a header bound whole keeps every constant here too.
-        const dependencyBridges = dependencyHeadersOf(interfaceFilePath, target).map((header) => {
+    if (bridgeFile && withDependencies && !isModule) {
+        // A header's own bindings need the types they use registered, which only their headers' bridges do. Such a bridge
+        // replaces the header's own, so a header bound whole keeps every constant here too.
+        const dependencyBridges = plan.dependenciesOf(interfaceFilePath).map((header) => {
             try {
                 return createBridgeFile(header, target, { withDependencies: false, wholeHeaders });
             } catch (e) {
@@ -145,10 +158,15 @@ function warnUnimported(header, functions) {
     console.warn(`crossbind: ${upath.basename(header)} binds none of its functions, since no source of the app imports a name from it. Import the functions you call by name, or the whole header with import * as.`);
 }
 
-function createInterfaceFile(headerOrModuleFilePath, target, sourceDir, { constants, functions, named = [] }) {
+// `tree` writes the interface SWIG's parse for the bindings plan reads, beside the bridge's own and cached apart from it.
+function createInterfaceFile(headerOrModuleFilePath, target, sourceDir, {
+    constants, functions, classes = ALL_NAMES, named = [],
+}, { tree = false } = {}) {
     if (!headerOrModuleFilePath) {
         return null;
     }
+    const cacheKey = tree ? `${headerOrModuleFilePath}#tree` : headerOrModuleFilePath;
+    const outputName = (name) => (tree ? name.replace(/\.i$/, '.tree.i') : name);
     const moduleRegex = new RegExp(`.(${state.config.ext.module.join('|')})$`);
     const isModule = moduleRegex.test(headerOrModuleFilePath);
     const { includeRoot, headerPath } = isModule ? {} : includeLocation(headerOrModuleFilePath, target);
@@ -170,28 +188,30 @@ function createInterfaceFile(headerOrModuleFilePath, target, sourceDir, { consta
         ...(interfaceFile && fs.existsSync(interfaceFile) ? [`shipped:${getFileHash(interfaceFile)}`] : []),
         ...(constants.length ? [`constants:${constants === ALL_NAMES ? ALL_NAMES : constants.join(',')}`] : []),
         ...(functions === ALL_NAMES ? [] : [`functions:${functions.join(',')}`]),
+        ...(classes === ALL_NAMES ? [] : [`classes:${classes.join(',')}`]),
         ...(named.length ? [`named:${named.join(',')}`] : []),
+        ...(tree ? ['tree'] : []),
         ...packageInputsHash(),
     ].join('\n');
-    const cachedInterface = state.cache.interfaces[headerOrModuleFilePath];
-    if (state.cache.hashes[headerOrModuleFilePath] === fileHash && cachedInterface && fs.existsSync(cachedInterface)
-        && isMadeFrom(cachedInterface, fileHash) && !sharedInterface(headerOrModuleFilePath, cachedInterface)) {
+    const cachedInterface = state.cache.interfaces[cacheKey];
+    if (state.cache.hashes[cacheKey] === fileHash && cachedInterface && fs.existsSync(cachedInterface)
+        && isMadeFrom(cachedInterface, fileHash) && !sharedInterface(cacheKey, cachedInterface)) {
         return cachedInterface;
     }
 
     if (isModule) {
-        const newPath = `${state.config.paths.build}/interface/${headerOrModuleFilePath.split('/').pop()}`;
-        return recordInterface(headerOrModuleFilePath, newPath, fileHash, () => fs.copyFileSync(headerOrModuleFilePath, newPath));
+        const newPath = outputName(`${state.config.paths.build}/interface/${headerOrModuleFilePath.split('/').pop()}`);
+        return recordInterface(cacheKey, newPath, fileHash, () => fs.copyFileSync(headerOrModuleFilePath, newPath));
     }
 
     if (!filePathWithoutExt) return null;
 
     if (fs.existsSync(interfaceFile)) {
-        const newPath = `${state.config.paths.build}/interface/${interfaceFile.split('/').at(-1)}`;
-        return recordInterface(headerOrModuleFilePath, newPath, fileHash, () => fs.copyFileSync(interfaceFile, newPath));
+        const newPath = outputName(`${state.config.paths.build}/interface/${interfaceFile.split('/').at(-1)}`);
+        return recordInterface(cacheKey, newPath, fileHash, () => fs.copyFileSync(interfaceFile, newPath));
     }
 
-    const fileName = interfaceName(headerOrModuleFilePath, filePathWithoutExt.split('/').at(-1));
+    const fileName = interfaceName(headerOrModuleFilePath, filePathWithoutExt.split('/').at(-1), (name) => outputName(interfacePath(name)), cacheKey);
 
     const macros = collectSwigMacros(headerOrModuleFilePath, interfaceIncludes(headerPath, prelude), fileName, target, sourceDir, constants);
     const extras = interfaceExtras(named, macros.table, fs.readFileSync(headerOrModuleFilePath, 'utf8'));
@@ -205,10 +225,11 @@ function createInterfaceFile(headerOrModuleFilePath, target, sourceDir, { consta
         constants,
         preamble,
         functions: functions === ALL_NAMES ? ALL_NAMES : [...functions, ...extras.functions],
+        classes,
         extras: extras.lines,
     });
-    const outputFilePath = `${state.config.paths.build}/interface/${fileName}.i`;
-    return recordInterface(headerOrModuleFilePath, outputFilePath, fileHash, () => fs.writeFileSync(outputFilePath, content));
+    const outputFilePath = outputName(`${state.config.paths.build}/interface/${fileName}.i`);
+    return recordInterface(cacheKey, outputFilePath, fileHash, () => fs.writeFileSync(outputFilePath, content));
 }
 
 // The key is blank while the file is written, so a process that dies in between leaves no file passing for another hash.
@@ -230,9 +251,10 @@ const sharedInterface = (headerFile, interfaceFile) => Object.entries(state.cach
 
 // An interface is named after its header's file name. A second header with that name (tiffio.h and tiffio.hxx, or one
 // name in two directories) takes its extension, then a hash of its path, so neither replaces the other's bridge.
-function interfaceName(headerFile, base) {
+// SWIG's parse for the bindings plan names its interface the same way, checked against the other parses'.
+function interfaceName(headerFile, base, pathOf = interfacePath, identity = headerFile) {
     const candidates = [base, `${base}_${upath.extname(headerFile).slice(1)}`, `${base}_${getContentHash(headerFile).slice(0, 8)}`];
-    return candidates.find((name) => !sharedInterface(headerFile, interfacePath(name))) ?? candidates.at(-1);
+    return candidates.find((name) => !sharedInterface(identity, pathOf(name))) ?? candidates.at(-1);
 }
 
 const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -263,14 +285,31 @@ function definitionsUnder(includeRoot) {
         files.forEach(({ path, text }) => {
             if (!nearest.has(text) || depth(path) < depth(nearest.get(text))) nearest.set(text, path);
         });
+        const originals = files.filter(({ path, text }) => nearest.get(text) === path);
         typeDefinitions.set(includeRoot, {
-            definitions: indexTypeDefinitions(files.filter(({ path, text }) => nearest.get(text) === path)),
+            definitions: indexTypeDefinitions(originals),
+            aliases: indexAliases(originals),
             copyOf: new Map(files.map(({ path, text }) => [path, nearest.get(text)])),
         });
     }
     return typeDefinitions.get(includeRoot);
 }
 
+// The names plain typedefs and alias declarations give (typedef T Name; typedef R (*Name)(...); using Name = T;), each
+// mapped to the first header giving it, so the bindings plan follows a type through the header that names it.
+const ALIAS = /\btypedef\b[^;{}]*?(?:\(\s*\*\s*([A-Za-z_]\w*)\s*\)[^;{}]*|\b([A-Za-z_]\w*)\s*(?:\[[^\]]*\]\s*)*);|\busing\s+([A-Za-z_]\w*)\s*=/g;
+
+function indexAliases(files) {
+    const aliases = new Map();
+    for (const { path, text } of files) {
+        for (const [, pointer, plain, using] of text.matchAll(ALIAS)) {
+            const name = pointer ?? plain ?? using;
+            if (name && !aliases.has(name)) aliases.set(name, path);
+        }
+    }
+    return aliases;
+}
+
 function lookupContext(includeRoot, headerPath, headerText) {
     const { definitions, copyOf } = definitionsUnder(includeRoot);
     return { headerText, headerPath: copyOf.get(headerPath) ?? headerPath, definitions };
@@ -290,6 +329,187 @@ function dependencyHeadersOf(headerFile, target) {
         .map((header) => upath.join(includeRoot, header));
 }
 
+// The header under a header's include root that defines a type, or names one with a typedef or alias, for the plan.
+function definingHeaderOf(headerFile, name, target) {
+    const { includeRoot } = includeLocation(headerFile, target);
+    if (!includeRoot) return null;
+    const { definitions, aliases } = definitionsUnder(includeRoot);
+    const found = definitions.get(name) ?? aliases.get(name) ?? aliases.get(name.split('::').at(-1));
+    return found ? upath.join(includeRoot, found) : null;
+}
+
+// SWIG's own parse of a header, which the bindings plan reads (see typeClosure.js): an interface with every function and
+// class of the header, written beside the bridge's own, through SWIG's XML module, made again when what it reads changes.
+function swigTreeOf(headerFile, target) {
+    const file = upath.resolve(headerFile);
+    const sourceDir = upath.dirname(file);
+    const { headerPath } = includeLocation(file, target);
+    const inlined = findSwigInlineIncludes(file, [state.config, ...state.config.allDependencies], headerPath);
+    const swigView = inlined.length ? writeSwigView(file, headerPath, inlined) : null;
+    const interfaceFile = createInterfaceFile(file, target, sourceDir, { constants: [], functions: ALL_NAMES, named: [] }, { tree: true });
+    if (!interfaceFile) return null;
+    const treeFile = interfaceFile.replace(/\.i$/, '.xml');
+    const treeHash = getContentHash([
+        TREE_FORMAT, getFileHash(interfaceFile), getFileHash(file), ...(swigView ? [`view:${swigView.hash}`] : []),
+    ].join('\n'));
+    // A parse that failed is kept too, so the plans of one process ask SWIG once for it.
+    const key = `${treeFile}\n${treeHash}`;
+    if (!swigTrees.has(key)) {
+        try {
+            if (!fs.existsSync(treeFile) || !fs.existsSync(keyOf(treeFile)) || fs.readFileSync(keyOf(treeFile), 'utf8') !== treeHash) {
+                fs.writeFileSync(keyOf(treeFile), '');
+                withMacroRetry(interfaceFile, () => runSwigFor([
+                    '-c++', '-xml', '-cpperraswarn', '-o', treeFile,
+                    ...(swigView ? [`-I${swigView.dir}`] : []),
+                    ...swigIncludePath(target, sourceDir),
+                    interfaceFile,
+                ], target));
+                fs.writeFileSync(keyOf(treeFile), treeHash);
+            }
+            swigTrees.set(key, readSwigTree(fs.readFileSync(treeFile, 'utf8')));
+        } catch (e) {
+            swigTrees.set(key, e);
+        }
+    }
+    const tree = swigTrees.get(key);
+    if (tree instanceof Error) throw tree;
+    return tree;
+}
+
+// A header by what it is under every path the build or a bundler reaches it through.
+const headerKey = (file) => targetNeutral(realPath(file));
+
+// Each header the app's sources import, with the names its bindings start from: ALL_NAMES for one bound whole. Every
+// header a build binds asks, so the answer is kept until the app's imports change, or where a header counts as a
+// dependency's does (a dependency built after the process loaded).
+function importedHeaders(target) {
+    const projectDir = state.config.paths.project;
+    if (!projectDir || !fs.existsSync(projectDir)) return new Map();
+    const imports = findHeaderImportsIn(projectDir, state.config.ext.header);
+    const dependencyRoots = state.config.dependencyParameters?.getCmakeDependsPathAndName(target).pathsOfCmakeDepends ?? [];
+    const key = JSON.stringify([target.path, imports, state.config.paths.header, dependencyRoots]);
+    if (!importedHeaderSets.has(key)) importedHeaderSets.set(key, resolveImportedHeaders(imports, target));
+    return new Map(importedHeaderSets.get(key));
+}
+
+function resolveImportedHeaders(imports, target) {
+    const headers = new Map();
+    for (const { importer, specifier } of imports) {
+        const resolved = resolveNativeImport(specifier, importer, target);
+        if (!resolved || !fs.existsSync(resolved) || headers.has(headerKey(resolved))) continue;
+        const file = upath.resolve(resolved);
+        const names = bindingNames(file, target, false);
+        headers.set(headerKey(file), { file, start: names.functions === ALL_NAMES ? ALL_NAMES : names.constants });
+    }
+    return headers;
+}
+
+// Which classes each bridge registers, and which other bridges each header needs: the closures of what the app takes
+// from every header it binds (see typeClosure.js). One bridge per header registers a class for every header using it,
+// so its classes are the union of those closures. A header SWIG cannot parse keeps the dependencies found in its text,
+// whose bridges bind every class, as all headers did before.
+function bindingPlan(target, wholeHeaders, header, names) {
+    const headers = importedHeaders(target);
+    [...configBoundHeaders(target), ...wholeHeaders].forEach((file) => headers.set(headerKey(file), { file: upath.resolve(file), start: ALL_NAMES }));
+    // A header no source imports from reaches nothing, so it leaves the plan as it is.
+    const start = names.functions === ALL_NAMES ? ALL_NAMES : names.constants;
+    if (!headers.has(headerKey(header)) && (start === ALL_NAMES || start.length)) headers.set(headerKey(header), { file: header, start });
+    const key = JSON.stringify([target.path, ...[...headers].sort(([a], [b]) => (a < b ? -1 : 1)).map(([file, entry]) => [file, entry.start])]);
+    // A dev server binds again after an edit, which can move what a header's names reach.
+    const cached = plans.get(key);
+    if (cached?.stamps.every(([file, stamp]) => fileStamp(file) === stamp)) return cached.plan;
+    const made = makePlan(headers, target);
+    plans.set(key, made);
+    return made.plan;
+}
+
+const fileStamp = (file) => {
+    try {
+        const { mtimeMs, size } = fs.statSync(file);
+        return `${mtimeMs}:${size}`;
+    } catch (e) {
+        return 'missing';
+    }
+};
+
+// The dependency headers the config binds whole (export.bindings.headers) that this target's packages ship, which every
+// caller binding a header has to see alike.
+function configBoundHeaders(target) {
+    return boundHeaderSpecifiers(state.config).map((specifier) => {
+        try {
+            return getDependFilePath(specifier, target);
+        } catch (e) {
+            return null;
+        }
+    }).filter((file) => file && fs.existsSync(file));
+}
+
+function makePlan(headers, target) {
+    const closures = new Map();
+    const parsedNot = new Set();
+    const read = new Set();
+    for (const [key, { file, start }] of headers) {
+        try {
+            const reached = typeClosure(file, start, {
+                treeOf: (header) => {
+                    read.add(header);
+                    return swigTreeOf(header, target);
+                },
+                definingHeader: (name) => definingHeaderOf(file, name, target),
+            });
+            closures.set(key, [...reached].map(([name, { kind, header, bound }]) => ({ name, kind, header, bound, key: headerKey(header) })));
+        } catch (e) {
+            console.warn(`crossbind: SWIG cannot parse ${upath.basename(file)} for the classes its bindings need (${e.message}); the headers its types come from bind every class`);
+            closures.set(key, null);
+            dependencyHeadersOf(file, target).forEach((dependency) => parsedNot.add(headerKey(dependency)));
+        }
+    }
+    const plan = {
+        classesOf(file) {
+            const key = headerKey(file);
+            if (headers.get(key)?.start === ALL_NAMES || closures.get(key) === null || parsedNot.has(key)) return ALL_NAMES;
+            const classes = new Set();
+            for (const closure of closures.values()) {
+                closure?.forEach((type) => {
+                    if (type.kind === 'class' && type.key === key) classes.add(type.name);
+                });
+            }
+            return [...classes].sort();
+        },
+        dependenciesOf(file) {
+            const key = headerKey(file);
+            const closure = closures.get(key);
+            if (closure === null) return dependencyHeadersOf(file, target);
+            const dependencies = new Map();
+            closure?.forEach((type) => {
+                if (type.key !== key && !dependencies.has(type.key)) dependencies.set(type.key, type.header);
+            });
+            return [...dependencies.values()];
+        },
+        // The name SWIG binds a class under, which a C struct takes from its typedef.
+        boundName(name) {
+            for (const closure of closures.values()) {
+                const type = closure?.find((reached) => reached.name === name && reached.bound);
+                if (type) return type.bound;
+            }
+            return name.split('::').at(-1);
+        },
+    };
+    // The headers the plan read, each as it was, so a later edit of one makes the plan again.
+    return { plan, stamps: [...read].map((file) => [file, fileStamp(file)]) };
+}
+
+// A class the plan asks for that SWIG left out of the bridge fails each binding that passes or returns it, when called.
+function warnUnboundClasses(bridgeFile, classes, plan) {
+    const exportsFile = `${bridgeFile}.exports.json`;
+    if (classes === ALL_NAMES || !classes.length || !fs.existsSync(exportsFile)) return;
+    const exported = new Set(JSON.parse(fs.readFileSync(exportsFile, 'utf8')));
+    const missing = classes.filter((name) => !exported.has(plan.boundName(name)));
+    if (missing.length) {
+        console.warn(`crossbind: ${upath.basename(bridgeFile)} does not bind ${missing.join(', ')}, which the names the app imports use; a call passing or returning one fails`);
+    }
+}
+
 // The proxy module's own exports, never names of the header.
 const PROXY_NAMES = new Set(['initNative', 'AllSymbols']);
 const C_IDENTIFIER = /^[A-Za-z_]\w*$/;
@@ -342,7 +562,11 @@ function collectSwigMacros(headerFile, includes, name, target, sourceDir, consta
         if (!predefinedMacros.has(target.path)) {
             predefinedMacros.set(target.path, dumpMacros(`${interfaceDir}/predefined-${target.path}.macros.h`, [], [], target));
         }
-        const macros = dumpMacros(`${interfaceDir}/${name}.macros.h`, includes, swigIncludePath(target, sourceDir), target, [RELEASE_DEFINE]);
+        // The bridge's interface and SWIG's parse for the bindings plan read the same header with the same includes.
+        const includePath = swigIncludePath(target, sourceDir);
+        const dumpKey = JSON.stringify([name, includes, includePath, target.path, getFileHash(headerFile)]);
+        if (!macroDumps.has(dumpKey)) macroDumps.set(dumpKey, dumpMacros(`${interfaceDir}/${name}.macros.h`, includes, includePath, target, [RELEASE_DEFINE]));
+        const macros = macroDumps.get(dumpKey);
         return {
             lines: selectSwigMacros({ headerText: fs.readFileSync(headerFile, 'utf8'), macros, predefined: predefinedMacros.get(target.path), constants }),
             table: macros,
@@ -447,6 +671,26 @@ function addBridgeExtras(bridgeFilePath, interfaceFilePath, named, headerText, s
     fs.writeFileSync(warningsFile, [...readWarnings().filter((line) => !extras.answered.has(line)), ...extras.notes].map((line) => `${line}\n`).join(''));
 }
 
+// Known macros can expose declarations SWIG cannot parse and used to skip; without them it parses as before.
+function withMacroRetry(interfaceFilePath, swig) {
+    try {
+        swig();
+    } catch (e) {
+        const content = fs.readFileSync(interfaceFilePath, 'utf8');
+        const plain = interfaceToRetryWithoutMacros(content, e);
+        if (!plain) throw e;
+        console.warn(`crossbind: SWIG cannot parse ${upath.basename(interfaceFilePath)} with the macros of its includes; generating it without them`);
+        fs.writeFileSync(interfaceFilePath, plain);
+        try {
+            swig();
+        } catch (retryError) {
+            // The cached interface keeps its macros, so the next build tries them again.
+            fs.writeFileSync(interfaceFilePath, content);
+            throw retryError;
+        }
+    }
+}
+
 // SWIG looks in its working directory and the interface's before its include path, and neither holds the header, so
 // it reads this copy, put first on that path: the includes its package lists are inlined there, while the compiler
 // still includes the real header.
@@ -488,23 +732,7 @@ function createBridgeFileFromInterfaceFile(interfaceFilePath, target, sourceDir
         ...swigIncludePath(target, sourceDir),
         interfaceFilePath,
     ], target);
-    try {
-        swig();
-    } catch (e) {
-        // Known macros can expose declarations SWIG cannot parse and used to skip; without them it parses as before.
-        const content = fs.readFileSync(interfaceFilePath, 'utf8');
-        const plain = interfaceToRetryWithoutMacros(content, e);
-        if (!plain) throw e;
-        console.warn(`crossbind: SWIG cannot parse ${upath.basename(interfaceFilePath)} with the macros of its includes; generating it without them`);
-        fs.writeFileSync(interfaceFilePath, plain);
-        try {
-            swig();
-        } catch (retryError) {
-            // The cached interface keeps its macros, so the next build tries them again.
-            fs.writeFileSync(interfaceFilePath, content);
-            throw retryError;
-        }
-    }
+    withMacroRetry(interfaceFilePath, swig);
     applyAsyncGuard(bridgeFilePath);
     if (extras.named.length) addBridgeExtras(bridgeFilePath, interfaceFilePath, extras.named, extras.headerText(), swig);
     reportSkippedBindings(bridgeFilePath);

package/src/actions/getCmakeParameters.js

@@ -61,7 +61,6 @@ export default function getCmakeParameters(target, options = {}) {
         `-DBUILD_TYPE=${buildType}`,
         `-DBUILD_${otherBuildType}_LIBS=OFF`,
         `-DCOMPILE_OPTIONS=${cmakeCompileOptions.join(';')}`,
-        // '-DCMAKE_CXX_COMPILER_LAUNCHER=ccache',
         ...(options.buildSource !== false ? ['-DBUILD_SOURCE=TRUE'] : []),
     ]);
 

package/src/actions/run.js

@@ -26,6 +26,31 @@ export const EXEC_MAX_BUFFER = 512 * 1024 * 1024;
 // Containers share the memory of Docker's VM, and one compile at full -j can take most of a desktop VM
 // (GDAL's bindings peak at 7.5 of 7.7 GiB), so the exclusive steps of parallel builds take turns.
 const DOCKER_COMPILE_LOCK = path.join(os.homedir(), '.crossbind', 'docker-compile.lock');
+// With CROSSBIND_SCCACHE set, C and C++ compiles go through sccache, which its SCCACHE_* variables configure, by CMake's
+// launchers. A wasm build compiles without it: sccache 0.19 recognizes neither em++ nor emscripten's clang, which has
+// no default target, and cannot cache the -Xclang flags emcc passes that clang.
+const SCCACHE_LAUNCHERS = ['CMAKE_C_COMPILER_LAUNCHER', 'CMAKE_CXX_COMPILER_LAUNCHER'];
+// sccache's key leaves out the target llvm-mingw's compilers take from their own names, so an x64 and an arm64 compile of
+// one source would share it; the buster, which sccache hashes into every key, names the target.
+const SCCACHE_BUSTER = 'SCCACHE_C_CUSTOM_CACHE_BUSTER';
+const sccacheBuster = (target) => [process.env[SCCACHE_BUSTER], target?.platform, target?.arch].filter(Boolean).join('-');
+const SCCACHE_SETTING =/^(SCCACHE_\w+|AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN)$/;
+const SCCACHE_IN_IMAGE = 'command -v sccache >/dev/null || { echo "crossbind: CROSSBIND_SCCACHE needs toolchain images that carry sccache, '
+    + 'image family 1.0.21 or later." >&2; exit 1; }; ';
+// A docker run's sccache server ends with its container, so the command stops it first, which waits for the cache writes
+// it holds; a DOCKER_EXEC container's server serves the commands after it.
+const SCCACHE_IN_CONTAINER = {
+    DOCKER_RUN: `${SCCACHE_IN_IMAGE}"$0" "$@"; status=$?; sccache --stop-server >/dev/null 2>&1; exit $status`,
+    DOCKER_EXEC: `${SCCACHE_IN_IMAGE}exec "$0" "$@"`,
+};
+const isSccacheOn = () => /^(1|true)$/i.test(process.env.CROSSBIND_SCCACHE ?? '');
+const sccacheSettings = () => Object.keys(process.env).filter((key) => SCCACHE_SETTING.test(key)).sort();
+// Where a container finds a local sccache directory: a docker run mounts it here, a long-lived container sees the project.
+const SCCACHE_CONTAINER_DIR = '/tmp/crossbind/sccache';
+const isInside = (parent, child) => {
+    const relative = path.relative(parent, child);
+    return !relative.startsWith('..') && !path.isAbsolute(relative);
+};
 const envParams = (env) => Object.entries(env).flatMap(([variable, value]) => ['-e', `${variable}=${value}`]);
 const CROSSCOMPILER_ARM64 = `aarch64-linux-android${ANDROID_API_LEVEL}`;
 const CROSSCOMPILER_x86_64 = `x86_64-linux-android${ANDROID_API_LEVEL}`;
@@ -139,6 +164,15 @@ export default function run(program, params = [], platformPrefix = null, target
         ? { runner: 'LOCAL' }
         : runnerFor(role, state.config.system);
     const isDocker = runner === 'DOCKER_RUN' || runner === 'DOCKER_EXEC';
+    const isSccache = isSccacheOn() && target?.platform !== 'wasm';
+    if (isSccache && runner === 'REMOTE') {
+        throw new Error('crossbind: CROSSBIND_SCCACHE works with the DOCKER_RUN, DOCKER_EXEC and LOCAL runners; a remote runner would need your '
+            + 'cache\'s keys. Unset it for a remote build.');
+    }
+    const sccacheDir = isSccache && isDocker ? process.env.SCCACHE_DIR : undefined;
+    if (sccacheDir && runner === 'DOCKER_EXEC' && !isInside(state.config.paths.base, sccacheDir)) {
+        throw new Error(`crossbind: a DOCKER_EXEC container reaches the project alone, so SCCACHE_DIR (${sccacheDir}) must sit inside ${state.config.paths.base}.`);
+    }
     const wasiHostSdk = target?.platform === 'wasi' ? resolveWasiSdkPath(state.config.system) : null;
     if (isDocker) {
         // Google ships the linux NDK for x86_64 only, so the android index carries no arm64 leaf;
@@ -212,10 +246,10 @@ export default function run(program, params = [], platformPrefix = null, target
                 if (dProgram === 'cmake') {
                     platformParams = [];
                     if (dParams[0] !== '--build' && dParams[0] !== '--install') {
+                        // CMake's own iOS platform with Makefiles: the Xcode generator spent 40-55 s configuring even a
+                        // small project. Not the app host's toolchain file, whose searches find the Mac's own packages.
                         dParams = [
                             ...dParams,
-                            '-G',
-                            'Xcode',
                             '-DBUILD_SHARED_LIBS=OFF',
                             '-DFRAMEWORK=TRUE',
                             `-DCMAKE_OSX_DEPLOYMENT_TARGET=${IOS_DEPLOYMENT_TARGET}`,
@@ -227,6 +261,11 @@ export default function run(program, params = [], platformPrefix = null, target
                             '-DCMAKE_SYSTEM_PROCESSOR=arm64',
                             `-DCMAKE_C_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
                             `-DCMAKE_CXX_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
+                            // The objects carry bitcode as before; a link, as of a configure check or a recipe's tests,
+                            // takes none, since Xcode's linker reads -fembed-bitcode-marker's mode as a file.
+                            '-DCMAKE_EXE_LINKER_FLAGS=-fembed-bitcode=off',
+                            '-DCMAKE_SHARED_LINKER_FLAGS=-fembed-bitcode=off',
+                            '-DCMAKE_MODULE_LINKER_FLAGS=-fembed-bitcode=off',
                             "-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY='iPhone Developer'",
                             `-DCMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM=${state.config.system.XCODE_DEVELOPMENT_TEAM}`,
                         ];
@@ -355,6 +394,18 @@ export default function run(program, params = [], platformPrefix = null, target
     const containerOptions = { cwd: buildPath, stdio: dockerOptions.console ? 'inherit' : ['ignore', 'pipe', 'pipe'], maxBuffer: EXEC_MAX_BUFFER };
     let fileExecParams;
     if (runner === 'LOCAL') {
+        if (isSccache) {
+            // By its full path: a macOS build narrows the PATH below.
+            const sccache = findExecutable('sccache', process.env.PATH ?? '');
+            if (!sccache) throw new Error('crossbind: CROSSBIND_SCCACHE needs sccache on the PATH: install it with `brew install sccache`, or unset CROSSBIND_SCCACHE.');
+            SCCACHE_LAUNCHERS.forEach((key) => {
+                env[key] = sccache;
+            });
+            sccacheSettings().forEach((key) => {
+                env[key] = process.env[key];
+            });
+            env[SCCACHE_BUSTER] = sccacheBuster(target);
+        }
         env.PATH = `/opt/homebrew/bin:${env.PATH}`;
         // A package's *-config script on the PATH (nc-config, sfcgal-config, ...) would compile that
         // package into the archives. cmake is the one host tool a darwin build takes from the PATH.
@@ -392,6 +443,11 @@ export default function run(program, params = [], platformPrefix = null, target
         if (runner === 'DOCKER_RUN') {
             imageOrContainer = getDockerImage(role);
             runnerParams = ['run', '--rm', ...DOCKER_RUN_SECURITY_ARGS, '-v', `${state.config.paths.base}:/tmp/crossbind/live`];
+            if (sccacheDir) {
+                // Made here, as docker would make a missing one owned by root.
+                fs.mkdirSync(sccacheDir, { recursive: true });
+                runnerParams.push('-v', `${sccacheDir}:${SCCACHE_CONTAINER_DIR}`);
+            }
             if (target?.platform === 'android') {
                 // Google ships the linux NDK for x86_64 only; use the amd64 leaf ref (classic store holds one platform per digest).
                 pullDockerImage(role, 'linux/amd64');
@@ -403,6 +459,16 @@ export default function run(program, params = [], platformPrefix = null, target
             runnerParams = ['exec'];
         }
 
+        // The settings go by name, docker taking their values from its own environment, so no key sits in the arguments.
+        const insideDir = sccacheDir && (runner === 'DOCKER_RUN' ? SCCACHE_CONTAINER_DIR : replaceBasePathForDocker(sccacheDir));
+        const sccache = isSccache ? [
+            ...SCCACHE_LAUNCHERS.flatMap((key) => ['-e', `${key}=sccache`]),
+            ...sccacheSettings().filter((key) => !(sccacheDir && key === 'SCCACHE_DIR') && key !== SCCACHE_BUSTER).flatMap((key) => ['-e', key]),
+            '-e',
+            `${SCCACHE_BUSTER}=${sccacheBuster(target)}`,
+            ...(sccacheDir ? ['-e', `SCCACHE_DIR=${insideDir}`] : []),
+        ] : [];
+        const command = isSccache ? ['sh', '-c', SCCACHE_IN_CONTAINER[runner], dProgram, ...dParams] : [dProgram, ...dParams];
         const args = [
             ...runnerParams,
             '--user',
@@ -410,10 +476,9 @@ export default function run(program, params = [], platformPrefix = null, target
             '--workdir',
             replaceBasePathForDocker(dockerOptions.workdir || buildPath),
             ...replaceBasePathForDocker(dockerEnv),
-            // '-e', replaceBasePathForDocker(`CCACHE_DIR=${state.config.paths.build}/ccache`),
+            ...sccache,
             imageOrContainer,
-            replaceBasePathForDocker(dProgram),
-            ...replaceBasePathForDocker(dParams),
+            ...replaceBasePathForDocker(command),
         ];
         fileExecParams = ['docker', args, options];
     }

package/src/assets/js-runtime/adapters/worker-comlink.js

@@ -45,8 +45,19 @@ const ownsObject = (obj) => {
 // frees nothing.
 const moduleObjects = new WeakSet();
 
+// A pointer a member handed out holds a clone of the handle of the object it points into
+// (utils/embindPointerOwners.js), which goes once no handle shares the pointer's count.
+const releaseOwner = (obj) => {
+    const count = obj?.$$?.count;
+    if (!count?.owner || count.value > (obj.isDeleted() ? 0 : 1)) return;
+    const { owner } = count;
+    count.owner = undefined;
+    if (!owner.isDeleted()) owner.delete();
+};
+
 const freeIfOwned = (obj) => {
     if (ownsObject(obj) && !moduleObjects.has(obj) && !obj.isDeleted()) obj.delete();
+    releaseOwner(obj);
 };
 
 // The worker side of a handle the main thread no longer reaches: its id goes, and the object with the last id.

package/src/assets/toolchain-digests.json

@@ -1,55 +1,55 @@
 {
-    "version": "1.0.20",
+    "version": "1.0.21",
     "registry": "ghcr.io/crossbind",
     "toolchains": {
         "rust": "1.99.1"
     },
     "images": {
         "rust-sysroot": {
-            "index": "sha256:3f62871ccbebbdca53b798fa1b21173bee848ada7744f5108df66a290d3cca78",
+            "index": "sha256:de0e2969f74bb458d134f796d04f60ab2b2342ddc4f7d336a2ac945973c628a0",
             "platforms": {
-                "linux/arm64": "sha256:ec7c2bba3add2385099b71520c5d68540e8dba691f57a42c0e9143ea5b8981df",
-                "linux/amd64": "sha256:dfad6e04d3168f5e7375aba271d0e615cc6658793527503ce3070efbd4ac5f91"
+                "linux/amd64": "sha256:2b4b338f185a44dfffd28eece9a79eedf7cef27fdd613ac4428bded4b394e773",
+                "linux/arm64": "sha256:8f0f72be0386b0a823db7520e23b1eb424da9daf64a364dffa983738d0b07035"
             }
         },
         "base": {
-            "index": "sha256:a5c7ea17f3e13c13d3c9f53307cce95d037bbb6b58b08034cfa2cb8112a63407",
+            "index": "sha256:8894f7f3deb8e3980cf138fea3552e3375d6250d08aba5b3828909bf55d796fc",
             "platforms": {
-                "linux/amd64": "sha256:a0934c868ccd5a09de14d193ae33b091ecfddf3c13548595e918c0b053e41dd6",
-                "linux/arm64": "sha256:14d4bcea7537972052cd6cee314a5c08f1cd68eebd3a7461ff7ca594994c49eb"
+                "linux/arm64": "sha256:9e8c9c6495d4c0e743c2a9b471b3e76fe8117507b44e7eb469009cd241473262",
+                "linux/amd64": "sha256:4a8305251eb48835bc13c9640303f6e9dfdb14be8ccb28d57ed808175d4dc8e9"
             }
         },
         "web": {
-            "index": "sha256:00a19f61fa46315175be11f20cea051311c218ab6e99bd1bca70236415a69af9",
+            "index": "sha256:5497576cba5a945249f9ff76f8cc40b43b0a26c1d0ce9dd7874ed842550b96c2",
             "platforms": {
-                "linux/arm64": "sha256:6e75223e8c696d93f5ab57e286425b4b94c4b1dcb3cf291e63c2820636dfa2a6",
-                "linux/amd64": "sha256:fe4e84f435838a35f2d60774be0050c39f2ecf1b8ed6cca23530b8c32f5c6211"
+                "linux/arm64": "sha256:a661e57cd9a748b8053a3b315474b5e42f39eb691ef2834f9b57dc2f0cb3db17",
+                "linux/amd64": "sha256:82d2163287aba2d77af0db0517ee4a96e69e34e2d54d45b4ef6f39151a466494"
             }
         },
         "android": {
-            "index": "sha256:df5bf439ab81afbe28a166dcd3c0ec281aea11d4265b1fc24225cc686f643ce1",
+            "index": "sha256:f54939cf8d648db75178d9a8cb1456453459b03d46fca7f2fa483b979677aa00",
             "platforms": {
-                "linux/amd64": "sha256:d2f5460a998aa1695b04d0d1bc231af4d77dd78931ca0f2b02adec51a61f0c02"
+                "linux/amd64": "sha256:1030809494407742bd71675d1c8d2967b08a42285ccb47ddf81fa52e8d41c2c6"
             }
         },
         "android-app": {
-            "index": "sha256:d72766f41a7d0343fdf36a425a9c5e0ea7dda8ac6f3b2697fe49d79a21e5018b",
+            "index": "sha256:9be66dedaaf5f36e5795d080eaa43a523b79246c014719783c15e522d6d6f6c4",
             "platforms": {
-                "linux/amd64": "sha256:8e62eea8685cd28276dfdd28b34aa75b3a0a677b40a93ea3f28f7f3ef1565425"
+                "linux/amd64": "sha256:1f7963b928513a1892c39e706515a0929abd4b6f72946c2943d476be2741725e"
             }
         },
         "linux": {
-            "index": "sha256:a4828cf2821cc2313f5ddf5bc761073c90616fbef09daa8b8d93e7fa3050497a",
+            "index": "sha256:4cdbe97aef06a84f82bf1f6e2f5badc354638c4f15364033ff1059247caa28ed",
             "platforms": {
-                "linux/arm64": "sha256:501a878b581295d3946945dfa9bc98a0aa3de5d4c6bc006c7224756cccbf1e35",
-                "linux/amd64": "sha256:ee5a4f7ee23fdda7e50d4130d783a76d7c44d079ae34b4a326565510eea761dc"
+                "linux/arm64": "sha256:b074c80b96455cfa8cfc1349bc1b77ce3286bff36d095831416c4e1111c69cf0",
+                "linux/amd64": "sha256:ca2194dd604dadfdb73f0bbe3b2e5a65ab6330bae6f9b8079b1c8ca9c9e2a11a"
             }
         },
         "windows": {
-            "index": "sha256:13fc02ab67d1465cbe75715d7de6a87c5319477eba2c0459c914bb5b698df766",
+            "index": "sha256:89dea8be3a1415c87854c2bccfb2cee95ec1d2f775b1b4db6260882d01d02a46",
             "platforms": {
-                "linux/amd64": "sha256:78883c59167af69c5b9433ef6cdfa35aab3833501bb85d830d95f24079a6c8d0",
-                "linux/arm64": "sha256:f27f09f8e661261c770976580d9861d4ce290eb1ac3030e6198f3c0a4987bd8a"
+                "linux/amd64": "sha256:454b9c339628d033d43f64422a12be9445193f167183fbeca71b4ae8af128673",
+                "linux/arm64": "sha256:9d823e18683cedfcc94ff6fb3c637c74929b4ee5601f72b3b87a4cedc7cd2d9e"
             }
         }
     }

package/src/utils/bridgeRuntimeFixes.js

@@ -1,3 +1,25 @@
+// A const char* followed by an integer may be a byte span, with embedded NULs or no terminator.
+// Preserve its address; JavaScript can read exactly the reported length with readBuffer. The argument keeps its const for
+// callbackArgument, which takes it by reference: a callback's const std::vector<std::string> & binds to no other.
+const CALLBACK_ARGUMENT_AT = `template<size_t I, typename Tuple> auto callbackArgumentAt(Tuple values) {
+  using Arg = std::remove_reference_t<decltype(std::get<I>(values))>;
+  using A = std::remove_cv_t<Arg>;
+  if constexpr (std::is_same_v<A, const char *> && I + 1 < std::tuple_size_v<Tuple>) {
+    using Next = std::remove_cv_t<std::remove_reference_t<decltype(std::get<I + 1>(values))>>;
+    if constexpr (std::is_integral_v<Next>) return toHandle(std::get<I>(values));
+    else return callbackArgument<Arg>(std::get<I>(values));
+  } else return callbackArgument<Arg>(std::get<I>(values));
+}`;
+// The form a bridge cached before the argument kept its const still holds.
+const CALLBACK_ARGUMENT_AT_WITHOUT_CONST = `template<size_t I, typename Tuple> auto callbackArgumentAt(Tuple values) {
+  using A = std::remove_cv_t<std::remove_reference_t<decltype(std::get<I>(values))>>;
+  if constexpr (std::is_same_v<A, const char *> && I + 1 < std::tuple_size_v<Tuple>) {
+    using Next = std::remove_cv_t<std::remove_reference_t<decltype(std::get<I + 1>(values))>>;
+    if constexpr (std::is_integral_v<Next>) return toHandle(std::get<I>(values));
+    else return callbackArgument<A>(std::get<I>(values));
+  } else return callbackArgument<A>(std::get<I>(values));
+}`;
+
 // Adapt the runtime emitted by the pinned SWIG fork. Kept in the generator so cache rebuilds
 // produce the same runtime in every bridge, including builds on a remote runner.
 export default function fixBridgeRuntime(text) {
@@ -22,16 +44,7 @@ template<typename T> constexpr bool isPassedByAddress =`);
     }
     if (!text.includes('auto callbackArgumentAt(')) {
         text = '#include <tuple>\n' + text;
-        text = text.replace('#ifndef __EMSCRIPTEN__\nstruct RuntimeCallbacks {', `// A const char* followed by an integer may be a byte span, with embedded NULs or no terminator.
-// Preserve its address; JavaScript can read exactly the reported length with readBuffer.
-template<size_t I, typename Tuple> auto callbackArgumentAt(Tuple values) {
-  using A = std::remove_cv_t<std::remove_reference_t<decltype(std::get<I>(values))>>;
-  if constexpr (std::is_same_v<A, const char *> && I + 1 < std::tuple_size_v<Tuple>) {
-    using Next = std::remove_cv_t<std::remove_reference_t<decltype(std::get<I + 1>(values))>>;
-    if constexpr (std::is_integral_v<Next>) return toHandle(std::get<I>(values));
-    else return callbackArgument<A>(std::get<I>(values));
-  } else return callbackArgument<A>(std::get<I>(values));
-}
+        text = text.replace('#ifndef __EMSCRIPTEN__\nstruct RuntimeCallbacks {', `${CALLBACK_ARGUMENT_AT}
 #ifndef __EMSCRIPTEN__
 struct RuntimeCallbacks {`);
         text = text.replaceAll('template<typename R, typename... A> R invokeCallback(size_t slot, A... args) {',
@@ -44,5 +57,5 @@ struct RuntimeCallbacks {`);
 }
 template<typename F> struct Callback {`);
     }
-    return text;
+    return text.replace(CALLBACK_ARGUMENT_AT_WITHOUT_CONST, CALLBACK_ARGUMENT_AT);
 }

package/src/utils/embindPointerOwners.js

@@ -0,0 +1,42 @@
+// A pointer a member function or property hands out can point into the object it was called on, as a getter of a
+// member behind a unique_ptr does, or name that object, as a fluent call does. JavaScript frees the object once
+// nothing reaches its handle (utils/embindObjectLifetime.js), and the pointer then reads freed memory. The handle of
+// such a pointer holds a clone of the object's handle, on the count the pointer's clones share, so the object goes
+// with the last of them. Only a raw pointer, a NativePointer and an emscripten::val can borrow: a copy and a smart
+// pointer hold what they point at. Static methods and free functions have no object to hold.
+
+const HELPERS = 'function crossbindMayBorrow(type){if(!type)return false;if(type.name==="emscripten::val")return true;'
+    + 'var cls=type.registeredClass;return!!cls&&!type.isReference&&(!type.isSmartPointer||cls.name==="NativePointer")}'
+    + 'function crossbindKeepOwner(value,owner){var $$=value&&value.$$;var held=owner&&owner.$$;'
+    + 'if(!$$||!$$.count||$$.count.owner||!held||!held.ptr||held.preservePointerOnDelete||$$.count===held.count)return value;'
+    + 'if($$.smartPtr?$$.ptrType.registeredClass.name==="NativePointer":!$$.count.owned)$$.count.owner=owner.clone();return value}'
+    + 'function crossbindKeepsOwner(fn,type){if(!crossbindMayBorrow(type))return fn;'
+    + 'var kept=function(...args){var owner=this;var value=fn.apply(owner,args);'
+    + 'return value instanceof Promise?value.then(resolved=>crossbindKeepOwner(resolved,owner)):crossbindKeepOwner(value,owner)};'
+    + 'Object.defineProperty(kept,"name",{value:fn.name});return kept}';
+
+// The release glue spells each on one line, the debug glue with spaces and quoted property names. A release glue
+// names embind's registrations by the minified keys of the wasm imports, so a glue that registers class methods is
+// known by the pure virtual check of the method registration, and one that registers properties by the getter's
+// `this` check.
+const CRAFT = /function craftInvokerFunction\s*\(/;
+const MEMBER = /(var memberFunction\s*=\s*)(craftInvokerFunction\(\s*humanName,\s*argTypes,\s*classType,\s*rawInvoker,\s*context(?:,\s*isAsync)?\s*\))(\s*;)/g;
+const GETTER = /return (getterReturnType(?:\.fromWireType|\[['"]fromWireType['"]\])\(\s*getter\(\s*getterContext,\s*ptr\s*\)\s*\))/g;
+const METHODS = /pureVirtualFunctions\.push\(\s*methodName\s*\)/;
+const PROPERTIES = /humanName\s*\+\s*['"] getter['"]/;
+
+const count = (text, pattern) => text.match(pattern)?.length ?? 0;
+
+// Returns the rewritten glue and whether it binds class methods or properties this rewrite does not recognise.
+export function keepPointerOwners(glue) {
+    const hasMethods = METHODS.test(glue);
+    const hasProperties = PROPERTIES.test(glue);
+    if (!hasMethods && !hasProperties) return { text: glue, missed: false };
+    const recognised = CRAFT.test(glue) && (!hasMethods || count(glue, MEMBER) === 1) && (!hasProperties || count(glue, GETTER) === 1);
+    if (!recognised) return { text: glue, missed: true };
+    const text = glue
+        .replace(CRAFT, (craft) => `${HELPERS}${craft}`)
+        .replace(MEMBER, (_, assign, call, end) => `${assign}crossbindKeepsOwner(${call},argTypes[0])${end}`)
+        .replace(GETTER, (_, read) => `return crossbindKeepOwner(${read},this)`);
+    return { text, missed: false };
+}

package/src/utils/swigInterface.js

@@ -65,7 +65,7 @@ export function interfaceIncludes(headerPath, prelude = []) {
 // wraps just the imported header. The ignored declarations follow the macros, so the retry without macros keeps them.
 export function buildInterfaceContent({
     moduleName, headerPath, prelude = [], completing = [], swigMacros = [], ignored = [], constants = [], preamble = [], functions = ALL_NAMES,
-    extras = [],
+    classes = ALL_NAMES, extras = [],
 }) {
     const includes = [...new Set([...interfaceIncludes(headerPath, prelude), ...completing])]
         .map((header) => `#include "${header}"`)
@@ -89,7 +89,7 @@ ${extraBlock}%{
 ${includes}
 %}
 
-${everyConstant ? '' : constantRequests(constants)}${functionRequests(functions)}%feature("shared_ptr");
+${everyConstant ? '' : constantRequests(constants)}${functionRequests(functions)}${classRequests(classes)}%feature("shared_ptr");
 %feature("polymorphic_shared_ptr");
 
 ${macros}${ignores}${preambleBlock}${everyConstant ? constantRequests(constants) : ''}%include "${headerPath}"
@@ -104,17 +104,32 @@ function constantRequests(constants) {
     return constants.length ? `${constants.map((name) => `%feature("embind:constant") ${name};`).join('\n')}\n\n` : '';
 }
 
-// SWIG ignores every global function, then wraps the listed names again: class members, enums and constants stay. The
-// package's own ignores come after, since SWIG applies the later of two renames of a name.
+// SWIG ignores every global function, then wraps the listed names again: class members, enums and constants stay. A
+// function declared through a function typedef (OpenSSL's `OSSL_provider_init_fn OSSL_provider_init;`) reads as a
+// variable, so global variables are ignored too, as rule 10 binds a mutable one only when imported. The package's own
+// ignores come after, since SWIG applies the later of two renames of a name.
 function functionRequests(functions) {
     if (functions === ALL_NAMES) return '';
     const names = [...new Set(functions)].sort();
-    return `%rename($ignore, %$isfunction, %$isglobal) "";\n${names.map((name) => `%rename("%s") ${name};\n`).join('')}\n`;
+    return `%rename($ignore, %$isfunction, %$isglobal) "";\n%rename($ignore, %$isvariable, %$isglobal) "";\n${names.map((name) => `%rename("%s") ${name};\n`).join('')}\n`;
 }
 
-// Editor declarations need the whole header even when the compiled bridge selects functions by import.
+// SWIG ignores every class, then wraps the classes the app's imports reach (see typeClosure.js) again. A class outside
+// any namespace is wrapped as a class only, so a C function sharing its name (struct stat and stat()) stays out; SWIG
+// matches a namespace's class by its full name only without that condition.
+function classRequests(classes) {
+    if (classes === ALL_NAMES) return '';
+    const lines = [...new Set(classes)].sort()
+        .map((name) => (name.includes('::') ? `%rename("%s") ${name};\n` : `%rename("%s", %$isclass) ${name};\n`));
+    return `%rename($ignore, %$isclass) "";\n${lines.join('')}\n`;
+}
+
+// Editor declarations and SWIG's parse for the bindings plan need the whole header even when the compiled bridge
+// selects functions and classes by import.
 export function interfaceWithAllFunctions(content) {
-    return content.replace(/%rename\(\$ignore, %\$isfunction, %\$isglobal\) "";\n(?:%rename\("%s"\) [A-Za-z_]\w*;\n)*\n/g, '');
+    return content
+        .replace(/%rename\(\$ignore, %\$isfunction, %\$isglobal\) "";\n(?:%rename\(\$ignore, %\$isvariable, %\$isglobal\) "";\n)?(?:%rename\("%s"\) [A-Za-z_]\w*;\n)*\n/g, '')
+        .replace(/%rename\(\$ignore, %\$isclass\) "";\n(?:%rename\("%s"(?:, %\$isclass)?\) [A-Za-z_][\w:]*;\n)*\n/g, '');
 }
 
 export function withoutSwigMacros(content) {

package/src/utils/typeClosure.js

@@ -0,0 +1,170 @@
+import { ALL_NAMES } from './headerImports.js';
+
+// SWIG's own parse of a header (swig -xml), read for the classes a bridge has to register. embind registers each class
+// once, in the bridge of the header defining it, and a binding naming a class no bridge registers fails only when it is
+// called. So a header binds the classes its imported names reach: through their signatures, the bases of those classes
+// and the signatures of their public members, in this header and in the headers defining them.
+
+// SWIG leaves `>` unescaped inside attribute values (std::vector<(T)>), so a tag ends only outside a quoted value.
+const TAG = /<(\/?)([A-Za-z_][\w-]*)((?:\s+[\w:-]+="[^"]*")*)\s*(\/?)>/g;
+const ATTRIBUTE = /([\w:-]+)="([^"]*)"/g;
+const NAME = /[A-Za-z_]\w*(?:::[A-Za-z_]\w*)*/g;
+const ENTITIES = { lt: '<', gt: '>', amp: '&', quot: '"', apos: "'" };
+// SWIG's type strings spell pointers, references, qualifiers, functions and arrays as p. r. z. q(...). f(...). a(...).
+const NOT_TYPES = new Set([
+    'p', 'r', 'z', 'q', 'f', 'a', 'const', 'volatile', 'struct', 'class', 'union', 'enum', 'typename',
+    'unsigned', 'signed', 'char', 'short', 'int', 'long', 'float', 'double', 'void', 'bool', 'wchar_t', 'size_t',
+]);
+const EMPTY_TREE = { types: new Map(), values: new Map(), enumerators: new Map() };
+
+const decode = (text) => text.replace(/&(lt|gt|amp|quot|apos);/g, (entity, name) => ENTITIES[name]);
+
+function parse(xml) {
+    const root = { tag: 'root', attributes: {}, children: [] };
+    const open = [root];
+    for (const [, closing, tag, rest, selfClosing] of xml.matchAll(TAG)) {
+        if (closing) {
+            open.pop();
+            continue;
+        }
+        const attributes = Object.fromEntries([...rest.matchAll(ATTRIBUTE)].map(([, key, value]) => [key, decode(value)]));
+        const node = { tag, attributes, children: [] };
+        open.at(-1).children.push(node);
+        if (!selfClosing) open.push(node);
+    }
+    return root;
+}
+
+// A node's own attributes are the <attribute> elements of its first <attributelist>.
+const listOf = (node) => node.children.find((child) => child.tag === 'attributelist')?.children ?? [];
+const attributesOf = (node) => Object.fromEntries(listOf(node).filter((child) => child.tag === 'attribute')
+    .map((child) => [child.attributes.name, child.attributes.value]));
+const basesOf = (node) => listOf(node).filter((child) => child.tag === 'baselist')
+    .flatMap((list) => list.children.filter((child) => child.tag === 'base').map((base) => base.attributes.name));
+const parametersOf = (node) => listOf(node).filter((child) => child.tag === 'parmlist')
+    .flatMap((list) => list.children.filter((child) => child.tag === 'parm').map((parm) => attributesOf(parm).type ?? ''));
+
+// What a header declares: its classes, enums and typedefs by qualified name, each with the type strings it uses, its free
+// functions and variables by name, and the enum of each enumerator. SWIG binds no nested class and no member a class
+// keeps private, so neither reaches anything.
+export function readSwigTree(xml) {
+    const types = new Map();
+    const values = new Map();
+    const enumerators = new Map();
+    // C names a struct and its typedef alike (`typedef struct PJ_INFO PJ_INFO;` ahead of `struct PJ_INFO {...}`), and the
+    // name stands for the struct.
+    const declare = (name, entry) => {
+        if (!types.has(name) || (types.get(name).kind === 'typedef' && entry.kind !== 'typedef')) types.set(name, entry);
+    };
+    const visit = (node, namespace, owner) => {
+        // %$isclass leaves class templates alone, so the selection does too.
+        if (node.tag === 'template') return;
+        const own = node.tag === 'root' ? {} : attributesOf(node);
+        const isPublic = own.access !== 'private' && own.access !== 'protected';
+        // SWIG spells a class or enum by its full name; a typedef inside a namespace or class may be spelled without it.
+        const qualified = (name) => (name.includes('::') || !namespace.length ? name : [...namespace, name].join('::'));
+        if (node.tag === 'namespace') {
+            node.children.forEach((child) => visit(child, own.name ? [...namespace, own.name] : namespace, null));
+        } else if (node.tag === 'class') {
+            if (!own.name || !isPublic || own.nested === '1') return;
+            const name = qualified(own.name);
+            // The name SWIG binds it under: a C struct's typedef name (X509V3_CONF_METHOD for X509V3_CONF_METHOD_st).
+            const bound = own.sym_name ?? own['sym:name'] ?? own.tdname ?? name.split('::').at(-1);
+            const entry = { kind: 'class', scope: name.split('::'), bases: basesOf(node), uses: [], bound };
+            declare(name, entry);
+            node.children.forEach((child) => visit(child, namespace, entry));
+        } else if (node.tag === 'enum') {
+            if (!own.name || !isPublic) return;
+            const name = owner && !own.name.includes('::') ? [...owner.scope, own.name].join('::') : qualified(own.name);
+            declare(name, { kind: 'enum', scope: name.split('::'), bases: [], uses: [] });
+            node.children.filter((child) => child.tag === 'enumitem').forEach((item) => {
+                const enumerator = attributesOf(item).name;
+                if (enumerator && !enumerators.has(enumerator)) enumerators.set(enumerator, name);
+            });
+        } else if (node.tag === 'cdecl') {
+            if (!own.name || !isPublic || own.storage === 'friend') return;
+            const uses = [own.type ?? '', own.decl ?? '', ...parametersOf(node)];
+            if (own.storage === 'typedef') {
+                const name = owner ? [...owner.scope, own.name].join('::') : qualified(own.name);
+                declare(name, { kind: 'typedef', scope: name.split('::'), bases: [], uses });
+            } else if (owner) {
+                owner.uses.push(...uses);
+            } else {
+                // An import of an overloaded name binds every overload.
+                values.set(own.name, [...(values.get(own.name) ?? []), ...uses]);
+            }
+        } else if (node.tag === 'constructor') {
+            if (owner && isPublic) owner.uses.push(own.decl ?? '', ...parametersOf(node));
+        } else {
+            node.children.forEach((child) => visit(child, namespace, owner));
+        }
+    };
+    visit(parse(xml), [], null);
+    return { types, values, enumerators };
+}
+
+// The classes and enums `names` reach from `header`, by qualified name, each with its kind and the header defining it.
+// `treeOf` reads a header's parse; a name no header read so far declares is looked up through `definingHeader`, whose
+// header is read in turn. ALL_NAMES starts from everything the header declares, as a header bound whole does.
+export function typeClosure(header, names, { treeOf, definingHeader }) {
+    const trees = new Map();
+    const read = (file) => {
+        if (!trees.has(file)) trees.set(file, treeOf(file) ?? EMPTY_TREE);
+        return trees.get(file);
+    };
+    const root = read(header);
+    const lookedUp = new Set();
+    const inTrees = (candidates, wanted) => {
+        for (const candidate of candidates) {
+            for (const [file, tree] of trees) {
+                const entry = tree.types.get(candidate);
+                if (entry && wanted(entry)) return { name: candidate, file, entry };
+            }
+        }
+        return null;
+    };
+    const isClassOrEnum = (entry) => entry.kind !== 'typedef';
+    // A class or enum wins over a typedef of the same name, even one another header declares first (a forward header's
+    // `typedef struct Foo Foo;`), so a header that may define the name is read before a typedef stands for it.
+    const find = (candidates) => {
+        const found = inTrees(candidates, isClassOrEnum);
+        if (found) return found;
+        for (const candidate of candidates) {
+            if (lookedUp.has(candidate)) continue;
+            lookedUp.add(candidate);
+            const file = definingHeader(candidate);
+            if (file && !trees.has(file)) read(file);
+        }
+        return inTrees(candidates, isClassOrEnum) ?? inTrees(candidates, () => true);
+    };
+    const queue = [];
+    const reach = (text, scope) => {
+        for (const [name] of text.matchAll(NAME)) {
+            if (!NOT_TYPES.has(name)) queue.push({ name, scope });
+        }
+    };
+    const start = names === ALL_NAMES ? [...root.values.keys(), ...root.types.keys()] : names;
+    for (const name of start) {
+        if (root.values.has(name)) root.values.get(name).forEach((use) => reach(use, []));
+        else queue.push({ name: root.enumerators.get(name) ?? name, scope: [] });
+    }
+    const reached = new Map();
+    const visited = new Set();
+    while (queue.length) {
+        const { name, scope } = queue.pop();
+        // As in C++ lookup, a name used inside a class or namespace is tried there first.
+        const candidates = [...scope.map((_, depth) => [...scope.slice(0, scope.length - depth), name].join('::')), name];
+        const found = find(candidates);
+        if (!found || visited.has(found.name)) continue;
+        visited.add(found.name);
+        const { entry } = found;
+        if (entry.kind === 'class') reached.set(found.name, { kind: entry.kind, header: found.file, bound: entry.bound });
+        else if (entry.kind === 'enum') reached.set(found.name, { kind: entry.kind, header: found.file });
+        const enclosing = entry.scope.slice(0, -1);
+        // SWIG binds an enum declared in a class only with that class.
+        if (entry.kind === 'enum' && enclosing.length) queue.push({ name: enclosing.join('::'), scope: [] });
+        entry.bases.forEach((base) => queue.push({ name: base, scope: enclosing }));
+        entry.uses.forEach((use) => reach(use, entry.kind === 'class' ? entry.scope : enclosing));
+    }
+    return reached;
+}