crossbind 2.0.0-beta.74 → 2.0.0-beta.76

package/src/actions/licenses.js

@@ -19,7 +19,7 @@ import { ANDROIDX_WEBKIT } from './gradleProject.js';
 import { extensionPackage, extensionPart } from '../utils/appExtensions.js';
 import { declaredSources, declarationOf, dependenciesOf } from '../utils/packageSources.js';
 import { shippedBundledLicense } from '../utils/bundledLicenses.js';
-import toolchainNoticesDir from '../utils/toolchainNotices.js';
+import toolchainNoticesDir, { MINGW_NOTICE, NATIVE_NOTICES, WASM_NOTICES } from '../utils/toolchainNotices.js';
 
 const LEGACY_LICENSE_FILES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING'];
 const WASI_LIBC_LICENSE = 'Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT';
@@ -53,8 +53,8 @@ function readLicenseTexts(files, locate) {
 
 // Vendored copies compiled into the artifact (recipe `bundled` map, keyed by platform)
 // become first-class notice/SBOM rows with texts from the family source tree, or from the dist
-// of whichever package of the family shipped them.
-async function bundledRowsOf(node, platform, familyProjects) {
+// of whichever package of the family shipped them, and the source of the package they come in.
+async function bundledRowsOf(node, platform, familyProjects, sourceUrl) {
     const recipe = await loadJs(node.paths.project, 'crossbind.build');
     const entries = recipe?.bundled?.[platform];
     if (!entries || entries.length === 0) return [];
@@ -70,7 +70,7 @@ async function bundledRowsOf(node, platform, familyProjects) {
         licenseSelected: null,
         licenseNotes: `${entry.notes ? `${entry.notes}; ` : ''}vendored inside ${node.general.name} ${node.package?.nativeVersion || ''}`.trim(),
         sha256: null,
-        sourceUrl: null,
+        sourceUrl,
         licenseText: readLicenseTexts(entry.files, (file) => (sourceDir
             ? path.join(sourceDir, file)
             : shippedBundledLicense(familyProjects, entry.name, file))),
@@ -113,8 +113,34 @@ function wasiToolchainRows() {
     ];
 }
 
+// What a build copied out of its toolchain image (actions/wasmNotices.js, actions/nativeNotices.js): a file's text, or a
+// license file's under its name.
+function toolchainNotice(platform, file) {
+    const build = state.config?.paths?.build;
+    const notice = build ? path.join(build, toolchainNoticesDir(platform), file) : null;
+    return notice && fs.existsSync(notice) ? fs.readFileSync(notice, 'utf8').trim() : null;
+}
+
+function toolchainNoticeText(platform, file) {
+    const text = toolchainNotice(platform, file);
+    return text ? `=== ${file} ===\n\n${text}` : null;
+}
+
+const clangVersionOf = (text) => text?.match(/clang version (\S+)/)?.[1] ?? null;
+
+// libc++ spells 19.1.7 as 190107.
+function libcxxVersionOf(text) {
+    const number = Number(text?.match(/_LIBCPP_VERSION\s+(\d+)/)?.[1]);
+    return number ? `${Math.floor(number / 10000)}.${Math.floor(number / 100) % 100}.${number % 100}` : null;
+}
+
+function mingwVersionOf(text) {
+    const part = (name) => text?.match(new RegExp(`__MINGW64_VERSION_${name}\\s+(\\d+)`))?.[1];
+    return part('MAJOR') ? [part('MAJOR'), part('MINOR') ?? 0, part('BUGFIX') ?? 0].join('.') : null;
+}
+
 // A wasm module statically links Emscripten's runtime and system libraries (its musl-based libc among them) and LLVM's
-// C++ runtime from the same toolchain image.
+// C++ runtime from the same toolchain image, whose texts and versions the build copied out of it.
 function wasmToolchainRows() {
     const shared = {
         npmName: null, version: null, nativeVersion: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
@@ -123,35 +149,39 @@ function wasmToolchainRows() {
         {
             ...shared,
             name: 'emscripten',
+            nativeVersion: toolchainNotice('wasm', WASM_NOTICES.emscriptenVersion)?.replaceAll('"', '') || null,
             license: 'MIT OR NCSA',
             licenseDeclared: 'MIT OR NCSA',
             sourceUrl: 'https://github.com/emscripten-core/emscripten',
             licenseNotes: "Emscripten's runtime and system libraries, its musl-based libc among them, statically linked into the module; license text: https://github.com/emscripten-core/emscripten/blob/main/LICENSE",
+            licenseText: toolchainNoticeText('wasm', WASM_NOTICES.emscriptenText),
         },
         {
             ...shared,
             name: 'llvm-runtimes',
             license: 'Apache-2.0 WITH LLVM-exception',
             licenseDeclared: 'Apache-2.0 WITH LLVM-exception',
+            nativeVersion: clangVersionOf(toolchainNotice('wasm', WASM_NOTICES.llvmVersion)),
             sourceUrl: 'https://github.com/llvm/llvm-project',
             licenseNotes: "libc++, libc++abi and compiler-rt of Emscripten's LLVM, statically linked into the module; license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT",
+            licenseText: toolchainNoticeText('wasm', WASM_NOTICES.llvmText),
         },
     ];
 }
 
-// The notices a build copied out of its toolchain image (a Windows addon's or app's does).
-function toolchainNoticeTexts(platform) {
+// The notices of one runtime a build copied out of its toolchain image, each under its file's name.
+function toolchainNoticeTexts(platform, pattern) {
     const build = state.config?.paths?.build;
     const dir = build ? path.join(build, toolchainNoticesDir(platform)) : null;
     if (!dir || !fs.existsSync(dir)) return null;
-    const texts = fs.readdirSync(dir).sort()
+    const texts = fs.readdirSync(dir).filter((file) => pattern.test(file)).sort()
         .map((file) => `=== ${file} ===\n\n${fs.readFileSync(path.join(dir, file), 'utf8').trim()}`);
     return texts.length > 0 ? texts.join('\n\n') : null;
 }
 
 // A Linux or Windows addon carries its C++ runtime; a Windows one also carries parts of the
 // mingw-w64 runtime and winpthreads, whose licenses ask for their notices in binary distributions.
-// A macOS addon uses the system's C++ runtime.
+// A macOS addon uses the system's C++ runtime. Their texts and versions are what the link copied out of its image.
 function addonToolchainRows(platform) {
     const shared = {
         npmName: null, version: null, nativeVersion: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
@@ -163,22 +193,32 @@ function addonToolchainRows(platform) {
         license: llvmLicense,
         licenseDeclared: llvmLicense,
         sourceUrl: 'https://github.com/llvm/llvm-project',
+        licenseText: toolchainNoticeText(platform, NATIVE_NOTICES.llvmText),
     };
     const llvmText = 'license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT';
     if (platform === 'linux' || platform === 'linuxmusl') {
-        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the binary; ${llvmText}` }];
+        return [{
+            ...llvmRuntimes,
+            nativeVersion: libcxxVersionOf(toolchainNotice(platform, NATIVE_NOTICES.libcxxVersion)),
+            licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the binary; ${llvmText}`,
+        }];
     }
     const mingwLicense = 'LicenseRef-MinGW-w64-runtime';
     return [
-        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the binary; ${llvmText}` },
+        {
+            ...llvmRuntimes,
+            nativeVersion: clangVersionOf(toolchainNotice('win32', NATIVE_NOTICES.clangVersion)),
+            licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the binary; ${llvmText}`,
+        },
         {
             ...shared,
             name: 'mingw-w64-runtime',
+            nativeVersion: mingwVersionOf(toolchainNotice('win32', NATIVE_NOTICES.mingwVersion)),
             license: mingwLicense,
             licenseDeclared: mingwLicense,
             sourceUrl: 'https://github.com/mingw-w64/mingw-w64',
             licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the binary; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
-            licenseText: toolchainNoticeTexts('win32'),
+            licenseText: toolchainNoticeTexts('win32', MINGW_NOTICE),
         },
     ];
 }
@@ -272,13 +312,15 @@ const HERMES_BUILDS = {
     },
 };
 
-// What an Android app's Gradle build adds from Maven, and the C++ runtime the app carries beside its host.
-function androidAppRows() {
+// What an Android app's Gradle build adds from Maven, and the C++ runtime the app carries beside its host: each a file
+// of its own in the app, with its text from @crossbind/core-app-host, and the libc++ with the version of the NDK's clang.
+function androidAppRows(hostRoot) {
     const shared = {
-        npmName: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
+        npmName: null, sha256: null, licenseSelected: null, isCopyleft: false,
     };
     const apache = { ...shared, license: 'Apache-2.0', licenseDeclared: 'Apache-2.0' };
     const llvmLicense = 'Apache-2.0 WITH LLVM-exception';
+    const textIn = (dir, file) => textOf(path.join(hostRoot, 'third_party', dir, file));
     return [
         {
             ...apache,
@@ -287,6 +329,7 @@ function androidAppRows() {
             nativeVersion: FBJNI_VERSION,
             sourceUrl: 'https://github.com/facebookincubator/fbjni',
             licenseNotes: 'libfbjni.so, which Hermes loads and Gradle takes with it; license text: https://github.com/facebookincubator/fbjni/blob/main/LICENSE',
+            licenseText: textIn('fbjni', 'LICENSE'),
         },
         {
             ...apache,
@@ -295,16 +338,18 @@ function androidAppRows() {
             nativeVersion: ANDROIDX_WEBKIT,
             sourceUrl: 'https://developer.android.com/jetpack/androidx/releases/webkit',
             licenseNotes: "androidx.webkit, the WebView's message ports and start scripts, from Google's Maven repository; license text: https://www.apache.org/licenses/LICENSE-2.0.txt",
+            licenseText: textIn('androidx-webkit', 'LICENSE'),
         },
         {
             ...shared,
             name: 'llvm-runtimes',
             version: null,
-            nativeVersion: null,
+            nativeVersion: clangVersionOf(toolchainNotice('android', NATIVE_NOTICES.clangVersion)),
             license: llvmLicense,
             licenseDeclared: llvmLicense,
             sourceUrl: 'https://github.com/llvm/llvm-project',
             licenseNotes: "libc++ of the android image's NDK, which the app carries as libc++_shared.so; license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT",
+            licenseText: textIn('libcxx', 'LICENSE.TXT'),
         },
     ];
 }
@@ -424,7 +469,7 @@ function appRuntimeRows(platform) {
             licenseNotes: "JSI's jsi.cpp from the same Hermes release, compiled into the host",
             licenseText: hermesLicense,
         },
-        ...(platform === 'android' ? androidAppRows() : []),
+        ...(platform === 'android' ? androidAppRows(hostRoot) : []),
         ...(platform === 'win32' ? windowsAppRows(hostRoot) : []),
         // A mobile app makes its window with UIKit or an Android activity, without webview/webview.
         ...(['ios', 'android'].includes(platform) ? [] : [{
@@ -590,11 +635,12 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
         if (seen.has(key)) continue;
         seen.add(key);
         const node = nodes.find((other) => keyOf(other) === key && serves(other)) ?? listed;
-        rows.push(node.general.packageSource ? sourcePackageRow(node) : await buildRow(node));
+        const row = node.general.packageSource ? sourcePackageRow(node) : await buildRow(node);
+        rows.push(row);
         // A package source's package folder is written from what its recipe produced: nothing there is run.
         if (platform && !node.general.packageSource) {
             const familyProjects = nodes.filter((other) => keyOf(other) === key).map((other) => other.paths.project);
-            rows.push(...await bundledRowsOf(node, platform, familyProjects));
+            rows.push(...await bundledRowsOf(node, platform, familyProjects, row.sourceUrl));
         }
     }
     if (platform === 'wasi') rows.push(...wasiToolchainRows());

package/src/actions/nativeNotices.js

@@ -0,0 +1,43 @@
+import run from './run.js';
+import toolchainNoticesDir, { NATIVE_NOTICES } from '../utils/toolchainNotices.js';
+import { linuxTriple } from '../utils/linuxToolchain.js';
+import { ANDROID_NDK } from '../utils/androidToolchain.js';
+
+const MINGW_NOTICES = '/opt/licenses/llvm-mingw';
+const MINGW_CLANG = '/opt/llvm-mingw/bin/clang';
+// The x64 and arm64 targets share one mingw-w64 build.
+const MINGW_VERSION_HEADER = '/opt/llvm-mingw/x86_64-w64-mingw32/include/_mingw_mac.h';
+const LIBCXX_LICENSE = '/opt/licenses/linux-sysroot/libcxx-LICENSE.TXT';
+const NDK_CLANG = `${ANDROID_NDK}/toolchains/llvm/prebuilt/linux-x86_64/bin/clang`;
+
+const ifFile = (file, command) => `if [ -f ${file} ]; then ${command}; fi`;
+const clangVersion = (clang, dir) => `if [ -x ${clang} ]; then ${clang} --version > ${dir}/${NATIVE_NOTICES.clangVersion}; fi`;
+
+// What each image keeps of the runtimes it links into a binary: their license texts and what tells their versions. An
+// Android app's libc++ has its text from @crossbind/core-app-host, as the NDK keeps it only among the toolchain's.
+const SCRIPTS = {
+    win32: (dir) => [
+        `if [ -d ${MINGW_NOTICES} ]; then cp ${MINGW_NOTICES}/COPYING* ${dir}/; fi`,
+        ifFile(`${MINGW_NOTICES}/LICENSE.TXT`, `cp ${MINGW_NOTICES}/LICENSE.TXT ${dir}/${NATIVE_NOTICES.llvmText}`),
+        clangVersion(MINGW_CLANG, dir),
+        ifFile(MINGW_VERSION_HEADER, `grep '#define __MINGW64_VERSION_' ${MINGW_VERSION_HEADER} > ${dir}/${NATIVE_NOTICES.mingwVersion}`),
+    ],
+    linux: (dir, target) => {
+        const config = `/opt/crossbind/sysroots/${linuxTriple(target)}/usr/include/c++/v1/__config`;
+        return [
+            ifFile(LIBCXX_LICENSE, `cp ${LIBCXX_LICENSE} ${dir}/${NATIVE_NOTICES.llvmText}`),
+            ifFile(config, `grep '#  *define _LIBCPP_VERSION ' ${config} > ${dir}/${NATIVE_NOTICES.libcxxVersion}`),
+        ];
+    },
+    android: (dir) => [clangVersion(NDK_CLANG, dir)],
+};
+SCRIPTS.linuxmusl = SCRIPTS.linux;
+
+// Copies them beside the build after a link in the target's image, where crossbind licenses reads them. A host
+// toolchain keeps none of these files, and its build goes on without them.
+export default function copyNativeNotices(target) {
+    const script = SCRIPTS[target.platform];
+    if (!script) return;
+    const dir = toolchainNoticesDir(target.platform);
+    run('sh', ['-c', [`mkdir -p ${dir}`, ...script(dir, target)].join('; ')], null, target);
+}

package/src/actions/run.js

@@ -13,7 +13,7 @@ import state from '../state/index.js';
 import { wasiCFlags, wasiCxxFlags, resolveWasiSdkPath, WASI_TARGET_TRIPLE } from '../utils/wasiToolchain.js';
 import { HOST_BUILT_PLATFORMS } from '../utils/targets.js';
 import { WASM_EXCEPTION_FLAGS } from '../utils/archiveFlags.js';
-import { ANDROID_NDK, ANDROID_API_LEVEL } from '../utils/androidToolchain.js';
+import { ANDROID_NDK, ANDROID_API_LEVEL, ANDROID_STL } from '../utils/androidToolchain.js';
 import { IOS_DEVELOPER_DIR, IOS_DEPLOYMENT_TARGET, XCODE_TOOLCHAIN_BIN } from '../utils/iosToolchain.js';
 import { LINUX_ARCHIVE_FLAGS, linuxBuildEnv, linuxToolchainFile } from '../utils/linuxToolchain.js';
 import { windowsBuildEnv, windowsToolchainFile } from '../utils/windowsToolchain.js';
@@ -26,6 +26,31 @@ export const EXEC_MAX_BUFFER = 512 * 1024 * 1024;
 // Containers share the memory of Docker's VM, and one compile at full -j can take most of a desktop VM
 // (GDAL's bindings peak at 7.5 of 7.7 GiB), so the exclusive steps of parallel builds take turns.
 const DOCKER_COMPILE_LOCK = path.join(os.homedir(), '.crossbind', 'docker-compile.lock');
+// With CROSSBIND_SCCACHE set, C and C++ compiles go through sccache, which its SCCACHE_* variables configure, by CMake's
+// launchers. A wasm build compiles without it: sccache 0.19 recognizes neither em++ nor emscripten's clang, which has
+// no default target, and cannot cache the -Xclang flags emcc passes that clang.
+const SCCACHE_LAUNCHERS = ['CMAKE_C_COMPILER_LAUNCHER', 'CMAKE_CXX_COMPILER_LAUNCHER'];
+// sccache's key leaves out the target llvm-mingw's compilers take from their own names, so an x64 and an arm64 compile of
+// one source would share it; the buster, which sccache hashes into every key, names the target.
+const SCCACHE_BUSTER = 'SCCACHE_C_CUSTOM_CACHE_BUSTER';
+const sccacheBuster = (target) => [process.env[SCCACHE_BUSTER], target?.platform, target?.arch].filter(Boolean).join('-');
+const SCCACHE_SETTING =/^(SCCACHE_\w+|AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN)$/;
+const SCCACHE_IN_IMAGE = 'command -v sccache >/dev/null || { echo "crossbind: CROSSBIND_SCCACHE needs toolchain images that carry sccache, '
+    + 'image family 1.0.21 or later." >&2; exit 1; }; ';
+// A docker run's sccache server ends with its container, so the command stops it first, which waits for the cache writes
+// it holds; a DOCKER_EXEC container's server serves the commands after it.
+const SCCACHE_IN_CONTAINER = {
+    DOCKER_RUN: `${SCCACHE_IN_IMAGE}"$0" "$@"; status=$?; sccache --stop-server >/dev/null 2>&1; exit $status`,
+    DOCKER_EXEC: `${SCCACHE_IN_IMAGE}exec "$0" "$@"`,
+};
+const isSccacheOn = () => /^(1|true)$/i.test(process.env.CROSSBIND_SCCACHE ?? '');
+const sccacheSettings = () => Object.keys(process.env).filter((key) => SCCACHE_SETTING.test(key)).sort();
+// Where a container finds a local sccache directory: a docker run mounts it here, a long-lived container sees the project.
+const SCCACHE_CONTAINER_DIR = '/tmp/crossbind/sccache';
+const isInside = (parent, child) => {
+    const relative = path.relative(parent, child);
+    return !relative.startsWith('..') && !path.isAbsolute(relative);
+};
 const envParams = (env) => Object.entries(env).flatMap(([variable, value]) => ['-e', `${variable}=${value}`]);
 const CROSSCOMPILER_ARM64 = `aarch64-linux-android${ANDROID_API_LEVEL}`;
 const CROSSCOMPILER_x86_64 = `x86_64-linux-android${ANDROID_API_LEVEL}`;
@@ -139,6 +164,15 @@ export default function run(program, params = [], platformPrefix = null, target
         ? { runner: 'LOCAL' }
         : runnerFor(role, state.config.system);
     const isDocker = runner === 'DOCKER_RUN' || runner === 'DOCKER_EXEC';
+    const isSccache = isSccacheOn() && target?.platform !== 'wasm';
+    if (isSccache && runner === 'REMOTE') {
+        throw new Error('crossbind: CROSSBIND_SCCACHE works with the DOCKER_RUN, DOCKER_EXEC and LOCAL runners; a remote runner would need your '
+            + 'cache\'s keys. Unset it for a remote build.');
+    }
+    const sccacheDir = isSccache && isDocker ? process.env.SCCACHE_DIR : undefined;
+    if (sccacheDir && runner === 'DOCKER_EXEC' && !isInside(state.config.paths.base, sccacheDir)) {
+        throw new Error(`crossbind: a DOCKER_EXEC container reaches the project alone, so SCCACHE_DIR (${sccacheDir}) must sit inside ${state.config.paths.base}.`);
+    }
     const wasiHostSdk = target?.platform === 'wasi' ? resolveWasiSdkPath(state.config.system) : null;
     if (isDocker) {
         // Google ships the linux NDK for x86_64 only, so the android index carries no arm64 leaf;
@@ -203,6 +237,7 @@ export default function run(program, params = [], platformPrefix = null, target
                         `-DANDROID_ABI=${target.arch === 'x86_64' ? 'x86_64' : 'arm64-v8a'}`,
                         `-DANDROID_PLATFORM=android-${ANDROID_API_LEVEL}`,
                         `-DANDROID_NDK=${ANDROID_NDK}`,
+                        `-DANDROID_STL=${ANDROID_STL}`,
                     ];
                 }
                 break;
@@ -212,10 +247,10 @@ export default function run(program, params = [], platformPrefix = null, target
                 if (dProgram === 'cmake') {
                     platformParams = [];
                     if (dParams[0] !== '--build' && dParams[0] !== '--install') {
+                        // CMake's own iOS platform with Makefiles: the Xcode generator spent 40-55 s configuring even a
+                        // small project. Not the app host's toolchain file, whose searches find the Mac's own packages.
                         dParams = [
                             ...dParams,
-                            '-G',
-                            'Xcode',
                             '-DBUILD_SHARED_LIBS=OFF',
                             '-DFRAMEWORK=TRUE',
                             `-DCMAKE_OSX_DEPLOYMENT_TARGET=${IOS_DEPLOYMENT_TARGET}`,
@@ -227,6 +262,11 @@ export default function run(program, params = [], platformPrefix = null, target
                             '-DCMAKE_SYSTEM_PROCESSOR=arm64',
                             `-DCMAKE_C_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
                             `-DCMAKE_CXX_FLAGS=${target.arch === 'iphoneos' ? '-fembed-bitcode' : '-fembed-bitcode-marker'}`,
+                            // The objects carry bitcode as before; a link, as of a configure check or a recipe's tests,
+                            // takes none, since Xcode's linker reads -fembed-bitcode-marker's mode as a file.
+                            '-DCMAKE_EXE_LINKER_FLAGS=-fembed-bitcode=off',
+                            '-DCMAKE_SHARED_LINKER_FLAGS=-fembed-bitcode=off',
+                            '-DCMAKE_MODULE_LINKER_FLAGS=-fembed-bitcode=off',
                             "-DCMAKE_XCODE_ATTRIBUTE_CODE_SIGN_IDENTITY='iPhone Developer'",
                             `-DCMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM=${state.config.system.XCODE_DEVELOPMENT_TEAM}`,
                         ];
@@ -355,6 +395,18 @@ export default function run(program, params = [], platformPrefix = null, target
     const containerOptions = { cwd: buildPath, stdio: dockerOptions.console ? 'inherit' : ['ignore', 'pipe', 'pipe'], maxBuffer: EXEC_MAX_BUFFER };
     let fileExecParams;
     if (runner === 'LOCAL') {
+        if (isSccache) {
+            // By its full path: a macOS build narrows the PATH below.
+            const sccache = findExecutable('sccache', process.env.PATH ?? '');
+            if (!sccache) throw new Error('crossbind: CROSSBIND_SCCACHE needs sccache on the PATH: install it with `brew install sccache`, or unset CROSSBIND_SCCACHE.');
+            SCCACHE_LAUNCHERS.forEach((key) => {
+                env[key] = sccache;
+            });
+            sccacheSettings().forEach((key) => {
+                env[key] = process.env[key];
+            });
+            env[SCCACHE_BUSTER] = sccacheBuster(target);
+        }
         env.PATH = `/opt/homebrew/bin:${env.PATH}`;
         // A package's *-config script on the PATH (nc-config, sfcgal-config, ...) would compile that
         // package into the archives. cmake is the one host tool a darwin build takes from the PATH.
@@ -392,6 +444,11 @@ export default function run(program, params = [], platformPrefix = null, target
         if (runner === 'DOCKER_RUN') {
             imageOrContainer = getDockerImage(role);
             runnerParams = ['run', '--rm', ...DOCKER_RUN_SECURITY_ARGS, '-v', `${state.config.paths.base}:/tmp/crossbind/live`];
+            if (sccacheDir) {
+                // Made here, as docker would make a missing one owned by root.
+                fs.mkdirSync(sccacheDir, { recursive: true });
+                runnerParams.push('-v', `${sccacheDir}:${SCCACHE_CONTAINER_DIR}`);
+            }
             if (target?.platform === 'android') {
                 // Google ships the linux NDK for x86_64 only; use the amd64 leaf ref (classic store holds one platform per digest).
                 pullDockerImage(role, 'linux/amd64');
@@ -403,6 +460,16 @@ export default function run(program, params = [], platformPrefix = null, target
             runnerParams = ['exec'];
         }
 
+        // The settings go by name, docker taking their values from its own environment, so no key sits in the arguments.
+        const insideDir = sccacheDir && (runner === 'DOCKER_RUN' ? SCCACHE_CONTAINER_DIR : replaceBasePathForDocker(sccacheDir));
+        const sccache = isSccache ? [
+            ...SCCACHE_LAUNCHERS.flatMap((key) => ['-e', `${key}=sccache`]),
+            ...sccacheSettings().filter((key) => !(sccacheDir && key === 'SCCACHE_DIR') && key !== SCCACHE_BUSTER).flatMap((key) => ['-e', key]),
+            '-e',
+            `${SCCACHE_BUSTER}=${sccacheBuster(target)}`,
+            ...(sccacheDir ? ['-e', `SCCACHE_DIR=${insideDir}`] : []),
+        ] : [];
+        const command = isSccache ? ['sh', '-c', SCCACHE_IN_CONTAINER[runner], dProgram, ...dParams] : [dProgram, ...dParams];
         const args = [
             ...runnerParams,
             '--user',
@@ -410,10 +477,9 @@ export default function run(program, params = [], platformPrefix = null, target
             '--workdir',
             replaceBasePathForDocker(dockerOptions.workdir || buildPath),
             ...replaceBasePathForDocker(dockerEnv),
-            // '-e', replaceBasePathForDocker(`CCACHE_DIR=${state.config.paths.build}/ccache`),
+            ...sccache,
             imageOrContainer,
-            replaceBasePathForDocker(dProgram),
-            ...replaceBasePathForDocker(dParams),
+            ...replaceBasePathForDocker(command),
         ];
         fileExecParams = ['docker', args, options];
     }

package/src/actions/wasmNotices.js

@@ -0,0 +1,32 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import run from './run.js';
+import state from '../state/index.js';
+import toolchainNoticesDir, { WASM_NOTICES } from '../utils/toolchainNotices.js';
+import { getDockerImage, imageRoleFor } from '../utils/pullDockerImage.js';
+
+const IMAGE_LICENSES = '/opt/licenses';
+const EMSDK_UPSTREAM = '/emsdk/upstream';
+
+const imageFile = () => path.join(state.config.paths.build, toolchainNoticesDir('wasm'), WASM_NOTICES.image);
+
+export const hasWasmNotices = () => fs.existsSync(imageFile());
+
+// A wasm module links Emscripten's libraries and LLVM's C++ runtime. The web image keeps their license texts, and its emsdk
+// their versions: a link copies them beside the build once for each image, and crossbind licenses lists them from there.
+export default function copyWasmNotices(target) {
+    const image = getDockerImage(imageRoleFor(target));
+    if (hasWasmNotices() && fs.readFileSync(imageFile(), 'utf8') === image) return;
+    const notices = toolchainNoticesDir('wasm');
+    const copy = (from, file) => `if [ -f ${from} ]; then cp ${from} ${notices}/${file}; fi`;
+    // run(null, …) on wasm wraps a configure or a make in emscripten's own: sh is named.
+    run('sh', ['-c', [
+        `mkdir -p ${notices}`,
+        copy(`${IMAGE_LICENSES}/emscripten-LICENSE`, WASM_NOTICES.emscriptenText),
+        copy(`${IMAGE_LICENSES}/llvm-LICENSE.TXT`, WASM_NOTICES.llvmText),
+        copy(`${EMSDK_UPSTREAM}/emscripten/emscripten-version.txt`, WASM_NOTICES.emscriptenVersion),
+        `if [ -x ${EMSDK_UPSTREAM}/bin/clang ]; then ${EMSDK_UPSTREAM}/bin/clang --version > ${notices}/${WASM_NOTICES.llvmVersion}; fi`,
+    ].join('; ')], null, target);
+    fs.mkdirSync(path.dirname(imageFile()), { recursive: true });
+    fs.writeFileSync(imageFile(), image);
+}

package/src/app/index.js

@@ -10,7 +10,7 @@ function hostOf(member, name) {
     if (host) return host;
     if (!globalThis.__crossbind_token && !globalThis.Crossbind?.app) throw new Error(`crossbind: ${name} works in an app alone, which crossbind app builds`);
     if (globalThis.Crossbind) throw new Error(`crossbind: this app's host is older than crossbind/app; update @crossbind/core-app-host to call ${name}`);
-    throw new Error(`crossbind: ${name} works once the page has called initNative()`);
+    throw new Error(`crossbind: ${name} works once the page's initNative() has resolved`);
 }
 
 const call = (name, options) => hostOf('app', name)(name, options);

package/src/assets/js-runtime/adapters/worker-comlink.js

@@ -45,8 +45,19 @@ const ownsObject = (obj) => {
 // frees nothing.
 const moduleObjects = new WeakSet();
 
+// A pointer a member handed out holds a clone of the handle of the object it points into
+// (utils/embindPointerOwners.js), which goes once no handle shares the pointer's count.
+const releaseOwner = (obj) => {
+    const count = obj?.$$?.count;
+    if (!count?.owner || count.value > (obj.isDeleted() ? 0 : 1)) return;
+    const { owner } = count;
+    count.owner = undefined;
+    if (!owner.isDeleted()) owner.delete();
+};
+
 const freeIfOwned = (obj) => {
     if (ownsObject(obj) && !moduleObjects.has(obj) && !obj.isDeleted()) obj.delete();
+    releaseOwner(obj);
 };
 
 // The worker side of a handle the main thread no longer reaches: its id goes, and the object with the last id.

package/src/assets/toolchain-digests.json

@@ -1,55 +1,55 @@
 {
-    "version": "1.0.20",
+    "version": "1.0.21",
     "registry": "ghcr.io/crossbind",
     "toolchains": {
         "rust": "1.99.1"
     },
     "images": {
         "rust-sysroot": {
-            "index": "sha256:3f62871ccbebbdca53b798fa1b21173bee848ada7744f5108df66a290d3cca78",
+            "index": "sha256:de0e2969f74bb458d134f796d04f60ab2b2342ddc4f7d336a2ac945973c628a0",
             "platforms": {
-                "linux/arm64": "sha256:ec7c2bba3add2385099b71520c5d68540e8dba691f57a42c0e9143ea5b8981df",
-                "linux/amd64": "sha256:dfad6e04d3168f5e7375aba271d0e615cc6658793527503ce3070efbd4ac5f91"
+                "linux/amd64": "sha256:2b4b338f185a44dfffd28eece9a79eedf7cef27fdd613ac4428bded4b394e773",
+                "linux/arm64": "sha256:8f0f72be0386b0a823db7520e23b1eb424da9daf64a364dffa983738d0b07035"
             }
         },
         "base": {
-            "index": "sha256:a5c7ea17f3e13c13d3c9f53307cce95d037bbb6b58b08034cfa2cb8112a63407",
+            "index": "sha256:8894f7f3deb8e3980cf138fea3552e3375d6250d08aba5b3828909bf55d796fc",
             "platforms": {
-                "linux/amd64": "sha256:a0934c868ccd5a09de14d193ae33b091ecfddf3c13548595e918c0b053e41dd6",
-                "linux/arm64": "sha256:14d4bcea7537972052cd6cee314a5c08f1cd68eebd3a7461ff7ca594994c49eb"
+                "linux/arm64": "sha256:9e8c9c6495d4c0e743c2a9b471b3e76fe8117507b44e7eb469009cd241473262",
+                "linux/amd64": "sha256:4a8305251eb48835bc13c9640303f6e9dfdb14be8ccb28d57ed808175d4dc8e9"
             }
         },
         "web": {
-            "index": "sha256:00a19f61fa46315175be11f20cea051311c218ab6e99bd1bca70236415a69af9",
+            "index": "sha256:5497576cba5a945249f9ff76f8cc40b43b0a26c1d0ce9dd7874ed842550b96c2",
             "platforms": {
-                "linux/arm64": "sha256:6e75223e8c696d93f5ab57e286425b4b94c4b1dcb3cf291e63c2820636dfa2a6",
-                "linux/amd64": "sha256:fe4e84f435838a35f2d60774be0050c39f2ecf1b8ed6cca23530b8c32f5c6211"
+                "linux/arm64": "sha256:a661e57cd9a748b8053a3b315474b5e42f39eb691ef2834f9b57dc2f0cb3db17",
+                "linux/amd64": "sha256:82d2163287aba2d77af0db0517ee4a96e69e34e2d54d45b4ef6f39151a466494"
             }
         },
         "android": {
-            "index": "sha256:df5bf439ab81afbe28a166dcd3c0ec281aea11d4265b1fc24225cc686f643ce1",
+            "index": "sha256:f54939cf8d648db75178d9a8cb1456453459b03d46fca7f2fa483b979677aa00",
             "platforms": {
-                "linux/amd64": "sha256:d2f5460a998aa1695b04d0d1bc231af4d77dd78931ca0f2b02adec51a61f0c02"
+                "linux/amd64": "sha256:1030809494407742bd71675d1c8d2967b08a42285ccb47ddf81fa52e8d41c2c6"
             }
         },
         "android-app": {
-            "index": "sha256:d72766f41a7d0343fdf36a425a9c5e0ea7dda8ac6f3b2697fe49d79a21e5018b",
+            "index": "sha256:9be66dedaaf5f36e5795d080eaa43a523b79246c014719783c15e522d6d6f6c4",
             "platforms": {
-                "linux/amd64": "sha256:8e62eea8685cd28276dfdd28b34aa75b3a0a677b40a93ea3f28f7f3ef1565425"
+                "linux/amd64": "sha256:1f7963b928513a1892c39e706515a0929abd4b6f72946c2943d476be2741725e"
             }
         },
         "linux": {
-            "index": "sha256:a4828cf2821cc2313f5ddf5bc761073c90616fbef09daa8b8d93e7fa3050497a",
+            "index": "sha256:4cdbe97aef06a84f82bf1f6e2f5badc354638c4f15364033ff1059247caa28ed",
             "platforms": {
-                "linux/arm64": "sha256:501a878b581295d3946945dfa9bc98a0aa3de5d4c6bc006c7224756cccbf1e35",
-                "linux/amd64": "sha256:ee5a4f7ee23fdda7e50d4130d783a76d7c44d079ae34b4a326565510eea761dc"
+                "linux/arm64": "sha256:b074c80b96455cfa8cfc1349bc1b77ce3286bff36d095831416c4e1111c69cf0",
+                "linux/amd64": "sha256:ca2194dd604dadfdb73f0bbe3b2e5a65ab6330bae6f9b8079b1c8ca9c9e2a11a"
             }
         },
         "windows": {
-            "index": "sha256:13fc02ab67d1465cbe75715d7de6a87c5319477eba2c0459c914bb5b698df766",
+            "index": "sha256:89dea8be3a1415c87854c2bccfb2cee95ec1d2f775b1b4db6260882d01d02a46",
             "platforms": {
-                "linux/amd64": "sha256:78883c59167af69c5b9433ef6cdfa35aab3833501bb85d830d95f24079a6c8d0",
-                "linux/arm64": "sha256:f27f09f8e661261c770976580d9861d4ce290eb1ac3030e6198f3c0a4987bd8a"
+                "linux/amd64": "sha256:454b9c339628d033d43f64422a12be9445193f167183fbeca71b4ae8af128673",
+                "linux/arm64": "sha256:9d823e18683cedfcc94ff6fb3c637c74929b4ee5601f72b3b87a4cedc7cd2d9e"
             }
         }
     }

package/src/integration/getDependFilePath.js

@@ -4,6 +4,7 @@ import state from '../state/index.js';
 import { parseCargoImport, writeCargoMarker } from '../utils/cargoImport.js';
 import { cratesOf, sourceOfImport, resolveSourceHeader } from '../utils/packageSourceImport.js';
 import refreshPackageSources from '../state/refreshPackageSources.js';
+import isSourceCmakePackage from '../utils/isSourceCmakePackage.js';
 
 const LAYOUT = { header: 'include', module: 'swig', source: '' };
 
@@ -118,7 +119,10 @@ export default function getDependFilePath(source, target) {
         // Skip packages that don't produce artifacts for this target — multiple
         // packages may share the same alias (one per platform), so this filters
         // out the wrong-platform matches without needing explicit metadata.
-        if (!existsCached(prebuiltRoot)) continue;
+        if (!existsCached(prebuiltRoot)) {
+            tried.push(prebuiltRoot);
+            continue;
+        }
 
         const baseDir = subdir ? `${prebuiltRoot}/${subdir}` : prebuiltRoot;
         for (const candidate of getFolderCandidates(pkg, alias)) {
@@ -131,6 +135,9 @@ export default function getDependFilePath(source, target) {
     }
 
     const matchNames = matches.map((m) => m.pkg.package.name).join(', ');
+    if (matches.every(({ pkg }) => pkg.export?.type === 'source' || isSourceCmakePackage(pkg))) {
+        throw new Error(`crossbind: ${matchNames} ships its sources, so "${source}" is for C++: include it in the app's native code and call that from JavaScript.`);
+    }
     throw new Error(
         `Could not resolve "${source}" in package(s) [${matchNames}] for target "${target.path}". Tried:\n`
         + tried.map((t) => `  - ${t}`).join('\n'),

package/src/state/loadConfig.js

@@ -179,7 +179,7 @@ export function getFilledConfig(config, options = { isDepend: false }) {
 
     if (!newConfig?.general?.name) {
         if (!newConfig.package) {
-            throw new Error(`crossbind: no package.json found in ${newConfig.paths.project}. Run crossbind from your project root, or scaffold a project with \`npm create crossbind\`.`);
+            throw new Error(`crossbind: no package.json found in ${newConfig.paths.project}. Run crossbind from your project root, or scaffold a project with \`npm create crossbind@beta\`.`);
         }
         newConfig.general.name = fixPackageName(newConfig.package.name) || 'crossbindsample';
     }

package/src/utils/androidToolchain.js

@@ -2,3 +2,7 @@
 // and Conan packages link into the same library, so they move together.
 export const ANDROID_NDK = '/opt/android-sdk/ndk/current';
 export const ANDROID_API_LEVEL = 33;
+// The C++ runtime every Android library links. The NDK's default links libc++ into each library, which then exports it:
+// an app of several would run as many runtimes, and Android compares type_info by address. One libc++_shared.so, which
+// the app ships, serves them all.
+export const ANDROID_STL = 'c++_shared';