crossbind 2.0.0-beta.75 → 2.0.0-beta.77

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crossbind",
-  "version": "2.0.0-beta.75",
+  "version": "2.0.0-beta.77",
   "license": "MIT",
   "homepage": "https://crossbind.dev",
   "repository": {
@@ -38,7 +38,7 @@
     "vitest": "^5.0.1"
   },
   "dependencies": {
-    "@crossbind/extension-conan": "2.0.0-beta.75",
+    "@crossbind/extension-conan": "2.0.0-beta.76",
     "@rollup/plugin-commonjs": "^29.0.3",
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.3",
@@ -55,7 +55,7 @@
     "upath": "^3.0.8"
   },
   "optionalDependencies": {
-    "@crossbind/bridge-tools": "2.0.0-beta.75"
+    "@crossbind/bridge-tools": "2.0.0-beta.77"
   },
   "keywords": [
     "webassembly",

package/src/actions/androidGradle.js

@@ -119,9 +119,15 @@ export function packageAndroidRelease(project) {
     const key = machineUploadKey();
     const env = key ? { ...process.env, ...uploadKeyEnv(key) } : process.env;
     const signing = releaseSigning(env);
+    const workdir = inContainer(project);
     pullDockerImage(ROLE, PLATFORM);
-    docker(['run', '--rm', ...containerArgs(signing, isOnline(project)), '-w', inContainer(project), getDockerImage(ROLE, PLATFORM),
-        ...gradleOf(project), '--no-daemon', 'assembleRelease', ...(signing ? ['bundleRelease'] : [])], `packaging ${path.basename(project)}`, env);
+    removeOrphanedDevContainers();
+    try {
+        docker(['run', '--rm', ...containerArgs(signing, isOnline(project)), '-w', workdir, getDockerImage(ROLE, PLATFORM),
+            ...gradleOf(project), '--no-daemon', 'assembleRelease', ...(signing ? ['bundleRelease'] : [])], `packaging ${path.basename(project)}`, env);
+    } catch (error) {
+        throw withCacheHolders(error);
+    }
     const outputs = `${project}/app/build/outputs`;
     fs.copyFileSync(`${outputs}/apk/release/app-release.apk`, `${project}.apk`);
     fs.rmSync(`${project}.aab`, { force: true });
@@ -138,6 +144,42 @@ export function packageAndroidRelease(project) {
     }
 }
 
+// Every Android build on this machine shares Gradle's caches, which a development container's daemon holds until the
+// container goes: Gradle cannot hand them to another container. A development container carries the PID of the session it
+// serves, so that one a session left behind without its exit hooks, as a crash or a SIGKILL leaves, goes before the next
+// build instead of stopping it.
+const SESSION_LABEL = 'dev.crossbind.android-app.session';
+
+const isRunning = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    } catch (error) {
+        return error.code === 'EPERM';
+    }
+};
+
+function removeOrphanedDevContainers() {
+    const ps = spawnSync('docker', ['ps', '--all', '--filter', `label=${SESSION_LABEL}`, '--format', `{{.Names}} {{.Label "${SESSION_LABEL}"}}`], { encoding: 'utf8' });
+    if (ps.status !== 0) return;
+    for (const line of ps.stdout.split('\n')) {
+        const [name, pid] = line.trim().split(' ');
+        if (!name || !/^\d+$/.test(pid ?? '') || isRunning(Number(pid))) continue;
+        console.warn(`crossbind: removing ${name}, the Android development container of a session that has ended.`);
+        spawnSync('docker', ['rm', '--force', name], { stdio: 'ignore' });
+    }
+}
+
+// What holds Gradle's caches when a release cannot take them: the containers of development sessions that run, and those of
+// a crossbind before the label, which name no session.
+function withCacheHolders(error) {
+    if (!error.message.includes('Timeout waiting to lock')) return error;
+    const ps = spawnSync('docker', ['ps', '--filter', 'name=crossbind-android-app-', '--format', '{{.Names}}'], { encoding: 'utf8' });
+    const names = ps.status === 0 ? ps.stdout.split('\n').map((name) => name.trim()).filter(Boolean) : [];
+    if (names.length === 0) return error;
+    return new Error(`${error.message}\ncrossbind: Gradle's caches are held by ${names.join(', ')}, the container ${names.length > 1 ? 'each ' : ''}of a \`crossbind app dev\`: end that session, or run \`docker rm --force ${names.join(' ')}\` if none is running.`, { cause: error });
+}
+
 // During development one container per project, whose Gradle daemon stays warm from one build to the next; it goes with
 // the process, and comes anew when the project comes to need the network, or no longer does.
 let devContainer = null;
@@ -145,10 +187,11 @@ let devContainer = null;
 function startDevContainer(isNetworked) {
     const name = `crossbind-android-app-${getContentHash(state.config.paths.project).slice(0, 12)}`;
     pullDockerImage(ROLE, PLATFORM);
+    removeOrphanedDevContainers();
     // One a crashed session, or the project's need of the network before, left behind holds the name.
     spawnSync('docker', ['rm', '--force', name], { stdio: 'ignore' });
-    docker(['run', '--detach', '--rm', '--init', '--name', name, ...containerArgs(null, isNetworked), getDockerImage(ROLE, PLATFORM), 'sleep', 'infinity'],
-        'starting the development container');
+    docker(['run', '--detach', '--rm', '--init', '--name', name, '--label', `${SESSION_LABEL}=${process.pid}`, ...containerArgs(null, isNetworked),
+        getDockerImage(ROLE, PLATFORM), 'sleep', 'infinity'], 'starting the development container');
     if (!devContainer) {
         process.once('exit', () => spawnSync('docker', ['rm', '--force', name], { stdio: 'ignore' }));
         // A closed terminal ends the session through its exit hooks, as Ctrl-C does.

package/src/actions/buildApp.js

@@ -10,7 +10,8 @@ import run from './run.js';
 import createLib from './createLib.js';
 import getData from './getData.js';
 import getEnv from './getEnv.js';
-import { copyWindowsNotices, filesUnder, linkInputs } from './buildNode.js';
+import { filesUnder, linkInputs } from './buildNode.js';
+import copyNativeNotices from './nativeNotices.js';
 import { suppressNodeBuiltinWarnings } from './buildJs.js';
 import { isNativeSourceNewerThan } from './isSourceNewer.js';
 import { createNativeBridges } from './nativeBridges.js';
@@ -180,7 +181,7 @@ async function hostInputs(target) {
     assertAppRunner(target);
     const inputs = [getDockerImage(imageRoleFor(target), target.platform === 'android' ? 'linux/amd64' : undefined)];
     if (target.platform === 'android') {
-        return { hermes: `${IMAGE_HERMES}/android`, cmakeArgs: ['-DANDROID_STL=c++_shared'], inputs };
+        return { hermes: `${IMAGE_HERMES}/android`, cmakeArgs: [], inputs };
     }
     if (target.platform === 'win32') {
         return { hermes: `${IMAGE_HERMES}/win32-${target.arch}`, cmakeArgs: ['-DCROSSBIND_WEBVIEW2_INCLUDE=/opt/crossbind/webview2/include'], inputs };
@@ -667,7 +668,7 @@ export default async function buildApp(target, { bridges = [], force = false } =
         ...cmakeArgs,
     ], platformPrefix, target);
     run(null, ['cmake', '--build', '.', '-j', String(cpuCount)], platformPrefix, target, { exclusive: true });
-    if (target.platform === 'win32') copyWindowsNotices(target);
+    copyNativeNotices(target);
 
     const systemConfig = `export default ${JSON.stringify({ env: getEnv(target) })};`;
     await bundle(`${appHostRoot}/js/host.js`, `${workDir}/host.js`, [

package/src/actions/buildNativeCommand.js

@@ -4,10 +4,12 @@ import { fileURLToPath } from 'node:url';
 import run from './run.js';
 import getLinkInputs from './getLinkInputs.js';
 import getData from './getData.js';
+import copyNativeNotices from './nativeNotices.js';
 import state from '../state/index.js';
 import logger from '../utils/logger.js';
 import { getContentHash, getFilesFingerprint } from '../utils/hash.js';
 import { buildLinkLibArgs } from '../utils/linkLayout.js';
+import resetCMakeCacheForSource from '../utils/resetCMakeCacheForSource.js';
 
 const cpuCount = Math.max(1, os.cpus().length - 1);
 const PROJECT_SOURCE = fileURLToPath(new URL('../assets/cmake/command', import.meta.url));
@@ -67,8 +69,10 @@ export default async function buildNativeCommand(target, options = {}) {
 
     const platformPrefix = `Native-${buildType}`;
     logger.startStep(target, 'native command');
+    const projectDir = stageProject(build);
+    resetCMakeCacheForSource(`${build}/${platformPrefix}/${target.path}`, projectDir, target);
     run(null, [
-        'cmake', stageProject(build),
+        'cmake', projectDir,
         `-DCMAKE_BUILD_TYPE=${buildType}`,
         `-DCROSSBIND_COMMAND_FILE=${target.commandName}`,
         `-DCROSSBIND_LINK_ARGS=${linkArgs.join(';')}`,
@@ -76,6 +80,7 @@ export default async function buildNativeCommand(target, options = {}) {
         `-DCROSSBIND_STATIC=${isStatic ? 'ON' : 'OFF'}`,
     ], platformPrefix, target);
     run(null, ['cmake', '--build', '.', '-j', String(cpuCount)], platformPrefix, target, { exclusive: true });
+    copyNativeNotices(target);
     fs.copyFileSync(`${build}/${platformPrefix}/${target.path}/${target.commandName}`, `${build}/${target.commandName}`);
     logger.doneStep(target, 'native command');
 

package/src/actions/buildNode.js

@@ -19,10 +19,9 @@ import resolveEmbindNapiRoot, { resolveEmbindJsiRoot } from '../utils/resolveEmb
 import scopedEmbind from '../utils/scopedEmbind.js';
 import resolveEmbindRustRoot from '../utils/resolveEmbindRust.js';
 import { rustStdLibsFor } from '../utils/cargoTarget.js';
-import toolchainNoticesDir from '../utils/toolchainNotices.js';
+import copyNativeNotices from './nativeNotices.js';
 
 const cpuCount = Math.max(1, os.cpus().length - 1);
-const WINDOWS_IMAGE_NOTICES = '/opt/licenses/llvm-mingw';
 
 // What a build's output, a package's own packages and a repository's history hold, which no build reads.
 const UNREAD_FOLDERS = ['.crossbind', 'node_modules', '.git'];
@@ -124,13 +123,6 @@ export function bundleNodeLoader(target) {
     return bundleLoader(target, resolveEmbindNapiRoot(), nodeLoaderConfig(target));
 }
 
-// The mingw-w64 runtime and winpthreads in a Windows addon or app ask for their notices in binary
-// distributions. The windows image carries them; a host toolchain may not.
-export function copyWindowsNotices(target) {
-    const notices = toolchainNoticesDir('win32');
-    run(null, ['sh', '-c', `if [ -d ${WINDOWS_IMAGE_NOTICES} ]; then mkdir -p ${notices} && cp ${WINDOWS_IMAGE_NOTICES}/* ${notices}/; fi`], null, target);
-}
-
 // Links one Node-API addon from the project's archives and bundles the loader that picks the
 // addon matching the running process.
 export default async function buildNode(target, options = {}) {
@@ -185,7 +177,7 @@ export default async function buildNode(target, options = {}) {
         `-DCROSSBIND_LINK_DEPENDS=${libs.join(';')}`,
     ], platformPrefix, target);
     run(null, ['cmake', '--build', '.', '-j', String(cpuCount)], platformPrefix, target, { exclusive: true });
-    if (target.platform === 'win32') copyWindowsNotices(target);
+    copyNativeNotices(target);
     fs.copyFileSync(`${build}/${platformPrefix}/${target.path}/${target.addonName}`, `${build}/${target.addonName}`);
     logger.doneStep(target, 'addon');
 

package/src/actions/buildWasm.js

@@ -6,6 +6,7 @@ import getLinkInputs from './getLinkInputs.js';
 import getData from './getData.js';
 import getEnv from './getEnv.js';
 import buildJs from './buildJs.js';
+import copyWasmNotices, { hasWasmNotices } from './wasmNotices.js';
 import state from '../state/index.js';
 import resolveEmbindRustRoot from '../utils/resolveEmbindRust.js';
 import logger from '../utils/logger.js';
@@ -204,9 +205,12 @@ export default async function buildWasm(target, options = {}) {
         || fs.readFileSync(linkFingerprintFile, { encoding: 'utf8' }) !== linkFingerprint;
 
     if (!options.force && !linkChanged && fs.existsSync(`${state.config.paths.build}/${target.jsName}`) && fs.existsSync(`${state.config.paths.build}/${target.wasmName}`)) {
+        // A build made before crossbind kept the toolchain's notices has none.
+        if (!hasWasmNotices()) copyWasmNotices(target);
         logger.cachedStep(target, 'wasm+js');
         return false;
     }
+    copyWasmNotices(target);
 
     if (target.runtimeEnv === 'browser') {
         logger.startStep(target, 'wasm');

package/src/actions/createLib.js

@@ -19,6 +19,7 @@ import { targetArchiveFlags } from '../utils/archiveFlags.js';
 import { packageSourceInputsOf } from '../utils/packageSources.js';
 import { nativeSourceStampChanged, writeNativeSourceStamp } from '../utils/nativeSourceStamp.js';
 import resetCMakeCacheForSource from '../utils/resetCMakeCacheForSource.js';
+import { ANDROID_STL } from '../utils/androidToolchain.js';
 
 const cpuCount = Math.max(1, os.cpus().length - 1);
 const sharedPlatforms = ['android'];
@@ -72,7 +73,9 @@ export default function createLib(target, fileType, options = {}) {
     const appArchives = target.platform === 'android' && target.runtimeEnv === 'app' ? 'archives' : null;
     // An app's own code compiles against <crossbind/app.h>, with the options of an app.
     const appApi = compilesAsApp(target) ? [getFilesFingerprint([appApiHeader()]), ...appCompileOptions(target)] : null;
-    const extraKeys = [httpHeader, appArchives, appApi].filter(Boolean);
+    // An Android library built while it linked libc++ in links again against the shared runtime.
+    const androidRuntime = target.platform === 'android' ? ANDROID_STL : null;
+    const extraKeys = [httpHeader, appArchives, appApi, androidRuntime].filter(Boolean);
     const flagsFingerprint = getContentHash(JSON.stringify(extraKeys.length ? [keyInputs, ...extraKeys] : keyInputs));
     const flagsChanged = !fs.existsSync(flagsFingerprintFile)
         || fs.readFileSync(flagsFingerprintFile, { encoding: 'utf8' }) !== flagsFingerprint;

package/src/actions/licenses.js

@@ -19,7 +19,7 @@ import { ANDROIDX_WEBKIT } from './gradleProject.js';
 import { extensionPackage, extensionPart } from '../utils/appExtensions.js';
 import { declaredSources, declarationOf, dependenciesOf } from '../utils/packageSources.js';
 import { shippedBundledLicense } from '../utils/bundledLicenses.js';
-import toolchainNoticesDir from '../utils/toolchainNotices.js';
+import toolchainNoticesDir, { MINGW_NOTICE, NATIVE_NOTICES, WASM_NOTICES } from '../utils/toolchainNotices.js';
 
 const LEGACY_LICENSE_FILES = ['LICENSE', 'LICENSE.md', 'LICENSE.txt', 'COPYING'];
 const WASI_LIBC_LICENSE = 'Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT';
@@ -53,8 +53,8 @@ function readLicenseTexts(files, locate) {
 
 // Vendored copies compiled into the artifact (recipe `bundled` map, keyed by platform)
 // become first-class notice/SBOM rows with texts from the family source tree, or from the dist
-// of whichever package of the family shipped them.
-async function bundledRowsOf(node, platform, familyProjects) {
+// of whichever package of the family shipped them, and the source of the package they come in.
+async function bundledRowsOf(node, platform, familyProjects, sourceUrl) {
     const recipe = await loadJs(node.paths.project, 'crossbind.build');
     const entries = recipe?.bundled?.[platform];
     if (!entries || entries.length === 0) return [];
@@ -70,7 +70,7 @@ async function bundledRowsOf(node, platform, familyProjects) {
         licenseSelected: null,
         licenseNotes: `${entry.notes ? `${entry.notes}; ` : ''}vendored inside ${node.general.name} ${node.package?.nativeVersion || ''}`.trim(),
         sha256: null,
-        sourceUrl: null,
+        sourceUrl,
         licenseText: readLicenseTexts(entry.files, (file) => (sourceDir
             ? path.join(sourceDir, file)
             : shippedBundledLicense(familyProjects, entry.name, file))),
@@ -113,8 +113,34 @@ function wasiToolchainRows() {
     ];
 }
 
+// What a build copied out of its toolchain image (actions/wasmNotices.js, actions/nativeNotices.js): a file's text, or a
+// license file's under its name.
+function toolchainNotice(platform, file) {
+    const build = state.config?.paths?.build;
+    const notice = build ? path.join(build, toolchainNoticesDir(platform), file) : null;
+    return notice && fs.existsSync(notice) ? fs.readFileSync(notice, 'utf8').trim() : null;
+}
+
+function toolchainNoticeText(platform, file) {
+    const text = toolchainNotice(platform, file);
+    return text ? `=== ${file} ===\n\n${text}` : null;
+}
+
+const clangVersionOf = (text) => text?.match(/clang version (\S+)/)?.[1] ?? null;
+
+// libc++ spells 19.1.7 as 190107.
+function libcxxVersionOf(text) {
+    const number = Number(text?.match(/_LIBCPP_VERSION\s+(\d+)/)?.[1]);
+    return number ? `${Math.floor(number / 10000)}.${Math.floor(number / 100) % 100}.${number % 100}` : null;
+}
+
+function mingwVersionOf(text) {
+    const part = (name) => text?.match(new RegExp(`__MINGW64_VERSION_${name}\\s+(\\d+)`))?.[1];
+    return part('MAJOR') ? [part('MAJOR'), part('MINOR') ?? 0, part('BUGFIX') ?? 0].join('.') : null;
+}
+
 // A wasm module statically links Emscripten's runtime and system libraries (its musl-based libc among them) and LLVM's
-// C++ runtime from the same toolchain image.
+// C++ runtime from the same toolchain image, whose texts and versions the build copied out of it.
 function wasmToolchainRows() {
     const shared = {
         npmName: null, version: null, nativeVersion: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
@@ -123,35 +149,39 @@ function wasmToolchainRows() {
         {
             ...shared,
             name: 'emscripten',
+            nativeVersion: toolchainNotice('wasm', WASM_NOTICES.emscriptenVersion)?.replaceAll('"', '') || null,
             license: 'MIT OR NCSA',
             licenseDeclared: 'MIT OR NCSA',
             sourceUrl: 'https://github.com/emscripten-core/emscripten',
             licenseNotes: "Emscripten's runtime and system libraries, its musl-based libc among them, statically linked into the module; license text: https://github.com/emscripten-core/emscripten/blob/main/LICENSE",
+            licenseText: toolchainNoticeText('wasm', WASM_NOTICES.emscriptenText),
         },
         {
             ...shared,
             name: 'llvm-runtimes',
             license: 'Apache-2.0 WITH LLVM-exception',
             licenseDeclared: 'Apache-2.0 WITH LLVM-exception',
+            nativeVersion: clangVersionOf(toolchainNotice('wasm', WASM_NOTICES.llvmVersion)),
             sourceUrl: 'https://github.com/llvm/llvm-project',
             licenseNotes: "libc++, libc++abi and compiler-rt of Emscripten's LLVM, statically linked into the module; license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT",
+            licenseText: toolchainNoticeText('wasm', WASM_NOTICES.llvmText),
         },
     ];
 }
 
-// The notices a build copied out of its toolchain image (a Windows addon's or app's does).
-function toolchainNoticeTexts(platform) {
+// The notices of one runtime a build copied out of its toolchain image, each under its file's name.
+function toolchainNoticeTexts(platform, pattern) {
     const build = state.config?.paths?.build;
     const dir = build ? path.join(build, toolchainNoticesDir(platform)) : null;
     if (!dir || !fs.existsSync(dir)) return null;
-    const texts = fs.readdirSync(dir).sort()
+    const texts = fs.readdirSync(dir).filter((file) => pattern.test(file)).sort()
         .map((file) => `=== ${file} ===\n\n${fs.readFileSync(path.join(dir, file), 'utf8').trim()}`);
     return texts.length > 0 ? texts.join('\n\n') : null;
 }
 
-// A Linux or Windows addon carries its C++ runtime; a Windows one also carries parts of the
+// A Linux or Windows addon, app or executable carries its C++ runtime; a Windows one also carries parts of the
 // mingw-w64 runtime and winpthreads, whose licenses ask for their notices in binary distributions.
-// A macOS addon uses the system's C++ runtime.
+// A macOS binary uses the system's C++ runtime. Their texts and versions are what the link copied out of its image.
 function addonToolchainRows(platform) {
     const shared = {
         npmName: null, version: null, nativeVersion: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
@@ -163,26 +193,69 @@ function addonToolchainRows(platform) {
         license: llvmLicense,
         licenseDeclared: llvmLicense,
         sourceUrl: 'https://github.com/llvm/llvm-project',
+        licenseText: toolchainNoticeText(platform, NATIVE_NOTICES.llvmText),
     };
     const llvmText = 'license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT';
     if (platform === 'linux' || platform === 'linuxmusl') {
-        return [{ ...llvmRuntimes, licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the binary; ${llvmText}` }];
+        return [{
+            ...llvmRuntimes,
+            nativeVersion: libcxxVersionOf(toolchainNotice(platform, NATIVE_NOTICES.libcxxVersion)),
+            licenseNotes: `libc++ and libc++abi of the linux toolchain image, statically linked into the binary; ${llvmText}`,
+        }];
     }
     const mingwLicense = 'LicenseRef-MinGW-w64-runtime';
     return [
-        { ...llvmRuntimes, licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the binary; ${llvmText}` },
+        {
+            ...llvmRuntimes,
+            nativeVersion: clangVersionOf(toolchainNotice('win32', NATIVE_NOTICES.clangVersion)),
+            licenseNotes: `libc++, libc++abi, libunwind and compiler-rt of the windows toolchain image (llvm-mingw), statically linked into the binary; ${llvmText}`,
+        },
         {
             ...shared,
             name: 'mingw-w64-runtime',
+            nativeVersion: mingwVersionOf(toolchainNotice('win32', NATIVE_NOTICES.mingwVersion)),
             license: mingwLicense,
             licenseDeclared: mingwLicense,
             sourceUrl: 'https://github.com/mingw-w64/mingw-w64',
             licenseNotes: 'the mingw-w64 startup code and winpthreads, statically linked into the binary; a binary distribution includes their notices: https://github.com/mingw-w64/mingw-w64/blob/master/COPYING.MinGW-w64-runtime/COPYING.MinGW-w64-runtime.txt and https://github.com/mingw-w64/mingw-w64/blob/master/mingw-w64-libraries/winpthreads/COPYING (the windows image carries both in /opt/licenses/llvm-mingw)',
-            licenseText: toolchainNoticeTexts('win32'),
+            licenseText: toolchainNoticeTexts('win32', MINGW_NOTICE),
+            isNoticeRequired: true,
         },
     ];
 }
 
+// A static musl executable carries musl's libc, whose MIT license asks every copy for its notice. Its text and version
+// are what the link copied out of its image; an addon and a library leave the C library to what runs them.
+function muslRow() {
+    return {
+        npmName: null,
+        version: null,
+        sha256: null,
+        licenseSelected: null,
+        isCopyleft: false,
+        name: 'musl',
+        license: 'MIT',
+        licenseDeclared: 'MIT',
+        sourceUrl: 'https://git.musl-libc.org/cgit/musl',
+        nativeVersion: toolchainNotice('linuxmusl', NATIVE_NOTICES.muslVersion),
+        licenseText: toolchainNoticeText('linuxmusl', NATIVE_NOTICES.muslText),
+        licenseNotes: 'the musl libc of the linux toolchain image, statically linked into the executable',
+        isNoticeRequired: true,
+    };
+}
+
+const BINARY_KINDS = { node: 'addon', app: 'app', native: 'executable' };
+
+// The runtimes a binary carries without the notice their licenses ask its distribution for, which its link copies out of
+// the image. A list of no binary (no runtimeEnv), such as a static library's, leaves those notices to the binary's own.
+export function missingNotices(rows, { platform, runtimeEnv }) {
+    const kind = BINARY_KINDS[runtimeEnv];
+    if (!kind) return [];
+    return rows
+        .filter((row) => row.isNoticeRequired && !row.licenseText)
+        .map((row) => `x ${row.name}: its license asks a distribution of the ${platform} ${kind} for its notices, and the list has none; build the ${platform} ${kind}, whose link copies them out of its toolchain image`);
+}
+
 const versionOf = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'package.json'), 'utf8')).version;
 const textOf = (file) => fs.readFileSync(file, 'utf8').trim();
 
@@ -272,13 +345,15 @@ const HERMES_BUILDS = {
     },
 };
 
-// What an Android app's Gradle build adds from Maven, and the C++ runtime the app carries beside its host.
-function androidAppRows() {
+// What an Android app's Gradle build adds from Maven, and the C++ runtime the app carries beside its host: each a file
+// of its own in the app, with its text from @crossbind/core-app-host, and the libc++ with the version of the NDK's clang.
+function androidAppRows(hostRoot) {
     const shared = {
-        npmName: null, sha256: null, licenseSelected: null, licenseText: null, isCopyleft: false,
+        npmName: null, sha256: null, licenseSelected: null, isCopyleft: false,
     };
     const apache = { ...shared, license: 'Apache-2.0', licenseDeclared: 'Apache-2.0' };
     const llvmLicense = 'Apache-2.0 WITH LLVM-exception';
+    const textIn = (dir, file) => textOf(path.join(hostRoot, 'third_party', dir, file));
     return [
         {
             ...apache,
@@ -287,6 +362,7 @@ function androidAppRows() {
             nativeVersion: FBJNI_VERSION,
             sourceUrl: 'https://github.com/facebookincubator/fbjni',
             licenseNotes: 'libfbjni.so, which Hermes loads and Gradle takes with it; license text: https://github.com/facebookincubator/fbjni/blob/main/LICENSE',
+            licenseText: textIn('fbjni', 'LICENSE'),
         },
         {
             ...apache,
@@ -295,16 +371,18 @@ function androidAppRows() {
             nativeVersion: ANDROIDX_WEBKIT,
             sourceUrl: 'https://developer.android.com/jetpack/androidx/releases/webkit',
             licenseNotes: "androidx.webkit, the WebView's message ports and start scripts, from Google's Maven repository; license text: https://www.apache.org/licenses/LICENSE-2.0.txt",
+            licenseText: textIn('androidx-webkit', 'LICENSE'),
         },
         {
             ...shared,
             name: 'llvm-runtimes',
             version: null,
-            nativeVersion: null,
+            nativeVersion: clangVersionOf(toolchainNotice('android', NATIVE_NOTICES.clangVersion)),
             license: llvmLicense,
             licenseDeclared: llvmLicense,
             sourceUrl: 'https://github.com/llvm/llvm-project',
             licenseNotes: "libc++ of the android image's NDK, which the app carries as libc++_shared.so; license text: https://github.com/llvm/llvm-project/blob/main/LICENSE.TXT",
+            licenseText: textIn('libcxx', 'LICENSE.TXT'),
         },
     ];
 }
@@ -424,7 +502,7 @@ function appRuntimeRows(platform) {
             licenseNotes: "JSI's jsi.cpp from the same Hermes release, compiled into the host",
             licenseText: hermesLicense,
         },
-        ...(platform === 'android' ? androidAppRows() : []),
+        ...(platform === 'android' ? androidAppRows(hostRoot) : []),
         ...(platform === 'win32' ? windowsAppRows(hostRoot) : []),
         // A mobile app makes its window with UIKit or an Android activity, without webview/webview.
         ...(['ios', 'android'].includes(platform) ? [] : [{
@@ -568,7 +646,8 @@ export async function vendoringLibraries() {
 // copies and the toolchain runtime, and for wasm crossbind's runtime, which the
 // module's glue bundles. runtimeEnv 'node' adds the crossbind runtime an
 // addon of that platform compiles in, or without a platform the one its loader bundles;
-// runtimeEnv 'app' adds what an app's host carries.
+// runtimeEnv 'app' adds what an app's host carries; runtimeEnv 'native' adds the C library
+// a static musl executable links.
 export default async function collectLicenseRows(platform = null, { runtimeEnv = null } = {}) {
     assertSourcesStaged();
     // The root package is a component too when it is a port: leaf -wasi packages have no deps but ship
@@ -590,16 +669,18 @@ export default async function collectLicenseRows(platform = null, { runtimeEnv =
         if (seen.has(key)) continue;
         seen.add(key);
         const node = nodes.find((other) => keyOf(other) === key && serves(other)) ?? listed;
-        rows.push(node.general.packageSource ? sourcePackageRow(node) : await buildRow(node));
+        const row = node.general.packageSource ? sourcePackageRow(node) : await buildRow(node);
+        rows.push(row);
         // A package source's package folder is written from what its recipe produced: nothing there is run.
         if (platform && !node.general.packageSource) {
             const familyProjects = nodes.filter((other) => keyOf(other) === key).map((other) => other.paths.project);
-            rows.push(...await bundledRowsOf(node, platform, familyProjects));
+            rows.push(...await bundledRowsOf(node, platform, familyProjects, row.sourceUrl));
         }
     }
     if (platform === 'wasi') rows.push(...wasiToolchainRows());
     if (platform === 'wasm') rows.push(...wasmToolchainRows(), crossbindRow("crossbind's JavaScript runtime, which the module's glue bundles"));
     if (['linux', 'linuxmusl', 'win32'].includes(platform)) rows.push(...addonToolchainRows(platform));
+    if (platform === 'linuxmusl' && runtimeEnv === 'native') rows.push(muslRow());
     if (runtimeEnv === 'node') rows.push(...nodeRuntimeRows({ isAddon: platform !== null }));
     if (runtimeEnv === 'app') {
         rows.push(...appRuntimeRows(platform));

package/src/actions/nativeNotices.js

@@ -0,0 +1,53 @@
+import run from './run.js';
+import toolchainNoticesDir, { NATIVE_NOTICES } from '../utils/toolchainNotices.js';
+import { linuxTriple } from '../utils/linuxToolchain.js';
+import { ANDROID_NDK } from '../utils/androidToolchain.js';
+
+const MINGW_NOTICES = '/opt/licenses/llvm-mingw';
+const MINGW_CLANG = '/opt/llvm-mingw/bin/clang';
+// The x64 and arm64 targets share one mingw-w64 build.
+const MINGW_VERSION_HEADER = '/opt/llvm-mingw/x86_64-w64-mingw32/include/_mingw_mac.h';
+const LIBCXX_LICENSE = '/opt/licenses/linux-sysroot/libcxx-LICENSE.TXT';
+const MUSL_LICENSE = '/opt/licenses/linux-sysroot/musl/musl-COPYRIGHT';
+const NDK_CLANG = `${ANDROID_NDK}/toolchains/llvm/prebuilt/linux-x86_64/bin/clang`;
+
+const ifFile = (file, command) => `if [ -f ${file} ]; then ${command}; fi`;
+const clangVersion = (clang, dir) => `if [ -x ${clang} ]; then ${clang} --version > ${dir}/${NATIVE_NOTICES.clangVersion}; fi`;
+
+// What each image keeps of the runtimes it links into a binary: their license texts and what tells their versions. An
+// Android app's libc++ has its text from @crossbind/core-app-host, as the NDK keeps it only among the toolchain's.
+const SCRIPTS = {
+    win32: (dir) => [
+        `if [ -d ${MINGW_NOTICES} ]; then cp ${MINGW_NOTICES}/COPYING* ${dir}/; fi`,
+        ifFile(`${MINGW_NOTICES}/LICENSE.TXT`, `cp ${MINGW_NOTICES}/LICENSE.TXT ${dir}/${NATIVE_NOTICES.llvmText}`),
+        clangVersion(MINGW_CLANG, dir),
+        ifFile(MINGW_VERSION_HEADER, `grep '#define __MINGW64_VERSION_' ${MINGW_VERSION_HEADER} > ${dir}/${NATIVE_NOTICES.mingwVersion}`),
+    ],
+    linux: (dir, target) => {
+        const config = `/opt/crossbind/sysroots/${linuxTriple(target)}/usr/include/c++/v1/__config`;
+        return [
+            ifFile(LIBCXX_LICENSE, `cp ${LIBCXX_LICENSE} ${dir}/${NATIVE_NOTICES.llvmText}`),
+            ifFile(config, `grep '#  *define _LIBCPP_VERSION ' ${config} > ${dir}/${NATIVE_NOTICES.libcxxVersion}`),
+        ];
+    },
+    android: (dir) => [clangVersion(NDK_CLANG, dir)],
+};
+// A static musl executable also carries musl's libc, whose notice every musl link keeps. musl records its version only
+// in libc, as the one string of version.lo.
+SCRIPTS.linuxmusl = (dir, target) => {
+    const libc = `/opt/crossbind/sysroots/${linuxTriple(target)}/usr/lib/libc.a`;
+    return [
+        ...SCRIPTS.linux(dir, target),
+        ifFile(MUSL_LICENSE, `cp ${MUSL_LICENSE} ${dir}/${NATIVE_NOTICES.muslText}`),
+        ifFile(libc, `ar p ${libc} version.lo | tr -cs '[:print:]' '\\n' | grep -x -E '[0-9]+\\.[0-9]+\\.[0-9]+' > ${dir}/${NATIVE_NOTICES.muslVersion}`),
+    ];
+};
+
+// Copies them beside the build after a link in the target's image, where crossbind licenses reads them. A host
+// toolchain keeps none of these files, and its build goes on without them.
+export default function copyNativeNotices(target) {
+    const script = SCRIPTS[target.platform];
+    if (!script) return;
+    const dir = toolchainNoticesDir(target.platform);
+    run('sh', ['-c', [`mkdir -p ${dir}`, ...script(dir, target)].join('; ')], null, target);
+}

package/src/actions/run.js

@@ -13,7 +13,7 @@ import state from '../state/index.js';
 import { wasiCFlags, wasiCxxFlags, resolveWasiSdkPath, WASI_TARGET_TRIPLE } from '../utils/wasiToolchain.js';
 import { HOST_BUILT_PLATFORMS } from '../utils/targets.js';
 import { WASM_EXCEPTION_FLAGS } from '../utils/archiveFlags.js';
-import { ANDROID_NDK, ANDROID_API_LEVEL } from '../utils/androidToolchain.js';
+import { ANDROID_NDK, ANDROID_API_LEVEL, ANDROID_STL } from '../utils/androidToolchain.js';
 import { IOS_DEVELOPER_DIR, IOS_DEPLOYMENT_TARGET, XCODE_TOOLCHAIN_BIN } from '../utils/iosToolchain.js';
 import { LINUX_ARCHIVE_FLAGS, linuxBuildEnv, linuxToolchainFile } from '../utils/linuxToolchain.js';
 import { windowsBuildEnv, windowsToolchainFile } from '../utils/windowsToolchain.js';
@@ -237,6 +237,7 @@ export default function run(program, params = [], platformPrefix = null, target
                         `-DANDROID_ABI=${target.arch === 'x86_64' ? 'x86_64' : 'arm64-v8a'}`,
                         `-DANDROID_PLATFORM=android-${ANDROID_API_LEVEL}`,
                         `-DANDROID_NDK=${ANDROID_NDK}`,
+                        `-DANDROID_STL=${ANDROID_STL}`,
                     ];
                 }
                 break;

package/src/actions/wasmNotices.js

@@ -0,0 +1,32 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import run from './run.js';
+import state from '../state/index.js';
+import toolchainNoticesDir, { WASM_NOTICES } from '../utils/toolchainNotices.js';
+import { getDockerImage, imageRoleFor } from '../utils/pullDockerImage.js';
+
+const IMAGE_LICENSES = '/opt/licenses';
+const EMSDK_UPSTREAM = '/emsdk/upstream';
+
+const imageFile = () => path.join(state.config.paths.build, toolchainNoticesDir('wasm'), WASM_NOTICES.image);
+
+export const hasWasmNotices = () => fs.existsSync(imageFile());
+
+// A wasm module links Emscripten's libraries and LLVM's C++ runtime. The web image keeps their license texts, and its emsdk
+// their versions: a link copies them beside the build once for each image, and crossbind licenses lists them from there.
+export default function copyWasmNotices(target) {
+    const image = getDockerImage(imageRoleFor(target));
+    if (hasWasmNotices() && fs.readFileSync(imageFile(), 'utf8') === image) return;
+    const notices = toolchainNoticesDir('wasm');
+    const copy = (from, file) => `if [ -f ${from} ]; then cp ${from} ${notices}/${file}; fi`;
+    // run(null, …) on wasm wraps a configure or a make in emscripten's own: sh is named.
+    run('sh', ['-c', [
+        `mkdir -p ${notices}`,
+        copy(`${IMAGE_LICENSES}/emscripten-LICENSE`, WASM_NOTICES.emscriptenText),
+        copy(`${IMAGE_LICENSES}/llvm-LICENSE.TXT`, WASM_NOTICES.llvmText),
+        copy(`${EMSDK_UPSTREAM}/emscripten/emscripten-version.txt`, WASM_NOTICES.emscriptenVersion),
+        `if [ -x ${EMSDK_UPSTREAM}/bin/clang ]; then ${EMSDK_UPSTREAM}/bin/clang --version > ${notices}/${WASM_NOTICES.llvmVersion}; fi`,
+    ].join('; ')], null, target);
+    fs.mkdirSync(path.dirname(imageFile()), { recursive: true });
+    fs.writeFileSync(imageFile(), image);
+}

package/src/app/index.js

@@ -10,7 +10,7 @@ function hostOf(member, name) {
     if (host) return host;
     if (!globalThis.__crossbind_token && !globalThis.Crossbind?.app) throw new Error(`crossbind: ${name} works in an app alone, which crossbind app builds`);
     if (globalThis.Crossbind) throw new Error(`crossbind: this app's host is older than crossbind/app; update @crossbind/core-app-host to call ${name}`);
-    throw new Error(`crossbind: ${name} works once the page has called initNative()`);
+    throw new Error(`crossbind: ${name} works once the page's initNative() has resolved`);
 }
 
 const call = (name, options) => hostOf('app', name)(name, options);

package/src/bin.js

@@ -48,7 +48,7 @@ import { cargoHome } from './utils/runCargo.js';
 import { containerRootOf, sourceRoot } from './utils/runPackageSource.js';
 import { importSchemesOf, sourceNamesOf } from './utils/packageSources.js';
 import { cleanDepsCache } from './utils/dependencyRebuild.js';
-import collectLicenseRows, { vendoringLibraries } from './actions/licenses.js';
+import collectLicenseRows, { missingNotices, vendoringLibraries } from './actions/licenses.js';
 import { formatNoticesMarkdown, formatCycloneDxSbom, validateSpdx } from './utils/licenseReport.js';
 import { SBOM_FILE, nodePackageMeta, shippedRows, writeNodePackageLicense } from './utils/packageLicense.js';
 import findFiles from './utils/findFiles.js';
@@ -225,9 +225,9 @@ program.command('licenses')
     .description('list bundled native dependencies with SPDX license, versions and source URL')
     .option('--notices [file]', 'write a THIRD-PARTY-NOTICES markdown file (default: THIRD-PARTY-NOTICES.md)')
     .option('--sbom [file]', 'write a CycloneDX SBOM json file (default: sbom.cdx.json)')
-    .option('--check', 'exit non-zero when a license field is missing or not valid SPDX')
+    .option('--check', 'exit non-zero when a license field is missing or not valid SPDX, and with -e when the binary lacks a notice the license of a runtime it carries asks for')
     .option('--platform <platform>', "also list what this platform's artifact statically links beyond the package graph (vendored copies, toolchain runtime)")
-    .addOption(new Option('-e, --runtime-env <runtimeEnv>', "also list the crossbind runtime an addon of --platform compiles in (without --platform the one its loader bundles), or what an app's host carries").choices(['node', 'app']))
+    .addOption(new Option('-e, --runtime-env <runtimeEnv>', "also list the crossbind runtime an addon of --platform compiles in (without --platform the one its loader bundles), what an app's host carries, or the C library a static musl executable links").choices(['node', 'app', 'native']))
     .option('--json [file]', 'write the rows, license texts included, as JSON (default: licenses.json)')
     .option('--package', "write this Node-API package's LICENSE, sbom.cdx.json and package.json license field (with -e node)")
     .action(async (options) => {
@@ -280,7 +280,9 @@ program.command('licenses')
                 .map((row) => ({ row, result: validateSpdx(row.license) }))
                 .filter(({ result }) => !result.isValid);
             invalid.forEach(({ row, result }) => console.error(`x ${row.name} (${row.npmName}): ${result.error}`));
-            if (invalid.length > 0) process.exit(1);
+            const unnoticed = missingNotices(rows, { platform: options.platform, runtimeEnv: options.runtimeEnv });
+            unnoticed.forEach((problem) => console.error(problem));
+            if (invalid.length > 0 || unnoticed.length > 0) process.exit(1);
             console.log('✓ all license fields are valid SPDX');
         }
     });

package/src/integration/getDependFilePath.js

@@ -4,6 +4,7 @@ import state from '../state/index.js';
 import { parseCargoImport, writeCargoMarker } from '../utils/cargoImport.js';
 import { cratesOf, sourceOfImport, resolveSourceHeader } from '../utils/packageSourceImport.js';
 import refreshPackageSources from '../state/refreshPackageSources.js';
+import isSourceCmakePackage from '../utils/isSourceCmakePackage.js';
 
 const LAYOUT = { header: 'include', module: 'swig', source: '' };
 
@@ -118,7 +119,10 @@ export default function getDependFilePath(source, target) {
         // Skip packages that don't produce artifacts for this target — multiple
         // packages may share the same alias (one per platform), so this filters
         // out the wrong-platform matches without needing explicit metadata.
-        if (!existsCached(prebuiltRoot)) continue;
+        if (!existsCached(prebuiltRoot)) {
+            tried.push(prebuiltRoot);
+            continue;
+        }
 
         const baseDir = subdir ? `${prebuiltRoot}/${subdir}` : prebuiltRoot;
         for (const candidate of getFolderCandidates(pkg, alias)) {
@@ -131,6 +135,9 @@ export default function getDependFilePath(source, target) {
     }
 
     const matchNames = matches.map((m) => m.pkg.package.name).join(', ');
+    if (matches.every(({ pkg }) => pkg.export?.type === 'source' || isSourceCmakePackage(pkg))) {
+        throw new Error(`crossbind: ${matchNames} ships its sources, so "${source}" is for C++: include it in the app's native code and call that from JavaScript.`);
+    }
     throw new Error(
         `Could not resolve "${source}" in package(s) [${matchNames}] for target "${target.path}". Tried:\n`
         + tried.map((t) => `  - ${t}`).join('\n'),

package/src/state/loadConfig.js

@@ -179,7 +179,7 @@ export function getFilledConfig(config, options = { isDepend: false }) {
 
     if (!newConfig?.general?.name) {
         if (!newConfig.package) {
-            throw new Error(`crossbind: no package.json found in ${newConfig.paths.project}. Run crossbind from your project root, or scaffold a project with \`npm create crossbind\`.`);
+            throw new Error(`crossbind: no package.json found in ${newConfig.paths.project}. Run crossbind from your project root, or scaffold a project with \`npm create crossbind@beta\`.`);
         }
         newConfig.general.name = fixPackageName(newConfig.package.name) || 'crossbindsample';
     }

package/src/utils/androidToolchain.js

@@ -2,3 +2,7 @@
 // and Conan packages link into the same library, so they move together.
 export const ANDROID_NDK = '/opt/android-sdk/ndk/current';
 export const ANDROID_API_LEVEL = 33;
+// The C++ runtime every Android library links. The NDK's default links libc++ into each library, which then exports it:
+// an app of several would run as many runtimes, and Android compares type_info by address. One libc++_shared.so, which
+// the app ships, serves them all.
+export const ANDROID_STL = 'c++_shared';

package/src/utils/sourceFingerprint.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import { getContentHash } from './hash.js';
 import { recipePatchesFingerprint } from './recipePatches.js';
+import { ANDROID_STL } from './androidToolchain.js';
 
 // The prebuilt-lib cache in buildLib is existence-only, so a nativeVersion or recipe-sha256 bump
 // would otherwise be served from the previous build - shipping the old upstream under the new
@@ -10,8 +11,10 @@ export const SOURCE_FINGERPRINT_FILE = 'crossbind-source.fingerprint';
 export function getSourceFingerprint(config, target) {
     const nativeVersion = config?.package?.nativeVersion || null;
     const sha256 = config?.build?.sha256 || null;
+    // An Android library built while it linked libc++ in builds again against the shared runtime, of local sources too.
+    const androidRuntime = target?.platform === 'android' ? ANDROID_STL : null;
     // Local-source packages pin neither; buildLib checks their native source inventory instead.
-    if (!nativeVersion && !sha256) return null;
+    if (!nativeVersion && !sha256 && !androidRuntime) return null;
     const sourceReplacements = target ? config?.build?.sourceReplaceList?.(target, config.allDependencyPaths?.[target.path] ?? {}) : undefined;
     const patches = recipePatchesFingerprint(config?.build?.patches);
     return getContentHash(JSON.stringify({
@@ -19,6 +22,7 @@ export function getSourceFingerprint(config, target) {
         sha256,
         ...(sourceReplacements?.length ? { sourceReplacements } : {}),
         ...(patches ? { patches } : {}),
+        ...(androidRuntime ? { androidRuntime } : {}),
     }));
 }
 

package/src/utils/toolchainNotices.js

@@ -3,3 +3,25 @@
 export default function toolchainNoticesDir(platform) {
     return `toolchain-licenses/${platform}`;
 }
+
+// What a wasm build copies there (actions/wasmNotices.js).
+export const WASM_NOTICES = {
+    emscriptenText: 'emscripten-LICENSE',
+    llvmText: 'llvm-LICENSE.TXT',
+    emscriptenVersion: 'emscripten-version.txt',
+    llvmVersion: 'clang-version.txt',
+    image: 'image.txt',
+};
+
+// What a Linux, Windows or Android link copies there (actions/nativeNotices.js), beside a Windows image's mingw-w64
+// notices, which keep their names.
+export const NATIVE_NOTICES = {
+    llvmText: 'llvm-LICENSE.TXT',
+    clangVersion: 'clang-version.txt',
+    libcxxVersion: 'libcxx-version.txt',
+    mingwVersion: 'mingw-w64-version.txt',
+    muslText: 'musl-COPYRIGHT',
+    muslVersion: 'musl-version.txt',
+};
+
+export const MINGW_NOTICE = /^COPYING/;