@hyperfrontend/builder 0.1.0

package/bin/native/inject.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Inputs to {@link injectBlob}.
+ */
+export interface InjectBlobInputs {
+    /** Absolute path to the Node host binary to clone as the injection target. */
+    hostBinary: string;
+    /** Absolute path where the cloned + injected binary should land. */
+    outputBinary: string;
+    /** Absolute path to the SEA preparation blob produced by `node --experimental-sea-config`. */
+    blobPath: string;
+    /** Resource name for the injected SEA section. Defaults to Node's expected `NODE_SEA_BLOB`. */
+    resourceName?: string;
+    /** Mach-O segment name for macOS injection. Defaults to Node's expected `NODE_SEA`. */
+    machoSegmentName?: string;
+    /** SEA fuse string searched for in the binary. Defaults to Node's standard SEA fuse. */
+    sentinelFuse?: string;
+}
+/**
+ * Node's expected SEA resource name. Hardcoded by the runtime when looking up
+ * the embedded blob, so this value is required for the resulting binary to
+ * function as a single-executable application.
+ */
+export declare const NODE_SEA_RESOURCE_NAME = "NODE_SEA_BLOB";
+/**
+ * Node's expected Mach-O segment name for SEA blobs on macOS.
+ */
+export declare const NODE_SEA_MACHO_SEGMENT = "NODE_SEA";
+/**
+ * Sentinel fuse string Node's runtime flips from `0` → `1` to mark a SEA-injected binary.
+ *
+ * Built at runtime from two parts so the contiguous sentinel literal never appears
+ * in the bundled JS of a bin that imports this module: that JS is embedded in the
+ * SEA blob, and a contiguous copy there collides with the host binary's own sentinel,
+ * making postject reject the inject with "Multiple occurences of sentinel". Keep it
+ * split — do not inline into a single string literal.
+ */
+export declare const NODE_SEA_FUSE: string;
+/**
+ * Clones the Node host binary to `outputBinary` and injects the SEA preparation
+ * blob via [postject](https://www.npmjs.com/package/postject)'s programmatic API.
+ *
+ * The host binary itself is never modified — postject mutates the cloned copy
+ * at `outputBinary`. The injection uses Node's expected SEA resource name and
+ * fuse so the produced executable is recognized by Node's SEA runtime.
+ *
+ * Callers are responsible for adjusting code-signing afterwards (see
+ * {@link removeCodesign} for macOS).
+ *
+ * @param inputs - Host binary, target output path, and blob path.
+ *
+ * @example Producing a SEA binary on a Linux runner
+ * ```typescript
+ * await injectBlob({
+ *   hostBinary: process.execPath,
+ *   outputBinary: '/abs/dist/libs/builder/bin/hf-build.linux-x64',
+ *   blobPath: '/abs/dist/libs/builder/bin/hf-build.sea-prep.blob',
+ * })
+ * ```
+ */
+export declare const injectBlob: (inputs: InjectBlobInputs) => Promise<void>;
+//# sourceMappingURL=inject.d.ts.map

package/bin/native/inject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inject.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/builder/src/bin/native/inject.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAA;IAClB,oEAAoE;IACpE,YAAY,EAAE,MAAM,CAAA;IACpB,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAA;IAChB,+FAA+F;IAC/F,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,kBAAkB,CAAA;AAErD;;GAEG;AACH,eAAO,MAAM,sBAAsB,aAAa,CAAA;AAKhD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAA4C,CAAA;AAEtE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,UAAU,GAAU,QAAQ,gBAAgB,KAAG,OAAO,CAAC,IAAI,CAOvE,CAAA"}

package/bin/native/platform-check.d.ts

@@ -0,0 +1,39 @@
+import type { SeaPlatform } from '../../models';
+/**
+ * Returns the target identifier for the current Node process in the form
+ * `<process.platform>-<process.arch>` (e.g., `linux-x64`).
+ *
+ * The string is shaped to match {@link SeaPlatform} but is returned as a plain
+ * string because callers commonly compare against arbitrary user-declared
+ * platform lists, which may legally include values not in the supported union.
+ *
+ * @returns `<platform>-<arch>` for the current process.
+ *
+ * @example Identifying the current target
+ * ```typescript
+ * const target = currentPlatformTarget() // 'linux-x64'
+ * ```
+ */
+export declare const currentPlatformTarget: () => string;
+/**
+ * Returns `true` when the current Node process matches one of the declared
+ * SEA target platforms — i.e., when `<process.platform>-<process.arch>` is
+ * present in `declaredPlatforms`.
+ *
+ * Builder uses this gate to skip native emission silently on runners that
+ * weren't asked to produce a binary for the current host. CI orchestrates the
+ * matrix so each declared platform is built on the matching runner.
+ *
+ * @param declaredPlatforms - Platforms declared on the bin's `sea` config.
+ * @returns Whether the current host matches any declared platform.
+ *
+ * @example Gating native emission to declared targets
+ * ```typescript
+ * if (!currentPlatformMatches(bin.sea?.platforms ?? [])) {
+ *   log.info(`skipping native build for ${bin.name} on ${currentPlatformTarget()}`)
+ *   return []
+ * }
+ * ```
+ */
+export declare const currentPlatformMatches: (declaredPlatforms: readonly SeaPlatform[]) => boolean;
+//# sourceMappingURL=platform-check.d.ts.map

package/bin/native/platform-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-check.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/builder/src/bin/native/platform-check.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE/C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,QAAO,MAA+C,CAAA;AAExF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,sBAAsB,GAAI,mBAAmB,SAAS,WAAW,EAAE,KAAG,OAIlF,CAAA"}

package/bin/native/sea-blob.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Inputs to {@link generateSeaBlob}.
+ */
+export interface GenerateSeaBlobInputs {
+    /** Absolute path to a SEA configuration JSON written to disk. */
+    seaConfigPath: string;
+    /** Absolute path the SEA configuration's `output` field points at; returned for caller convenience. */
+    outputBlobPath: string;
+    /** Override for the Node executable used to run the SEA-config command. Defaults to `process.execPath`. */
+    nodeExecutable?: string;
+}
+/**
+ * Outcome of a SEA blob generation attempt.
+ */
+export interface GenerateSeaBlobResult {
+    /** Absolute path of the emitted blob (echoes `inputs.outputBlobPath`). */
+    blobPath: string;
+    /** Exit status returned by the `node --experimental-sea-config` invocation. */
+    status: number;
+}
+/**
+ * Spawns `node --experimental-sea-config <seaConfigPath>` to produce the SEA
+ * preparation blob declared by the config's `output` field.
+ *
+ * Spawn errors and non-zero exit codes are surfaced as thrown `Error`s with the
+ * captured stderr included; this function does not retry.
+ *
+ * @param inputs - Resolved SEA config path + the blob path declared in that config.
+ * @returns The blob path (for chaining) and the spawn status.
+ *
+ * @example Generating the SEA prep blob
+ * ```typescript
+ * const result = generateSeaBlob({
+ *   seaConfigPath: '/abs/dist/libs/builder/bin/hf-build.sea-config.json',
+ *   outputBlobPath: '/abs/dist/libs/builder/bin/hf-build.sea-prep.blob',
+ * })
+ * ```
+ */
+export declare const generateSeaBlob: (inputs: GenerateSeaBlobInputs) => GenerateSeaBlobResult;
+//# sourceMappingURL=sea-blob.d.ts.map

package/bin/native/sea-blob.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sea-blob.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/builder/src/bin/native/sea-blob.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAA;IACrB,uGAAuG;IACvG,cAAc,EAAE,MAAM,CAAA;IACtB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAA;IAChB,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,eAAe,GAAI,QAAQ,qBAAqB,KAAG,qBAY/D,CAAA"}

package/bin/native/sea-config.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Inputs to {@link generateSeaConfig}.
+ */
+export interface SeaConfigInputs {
+    /** Absolute path to the bundled CJS entry the SEA blob will execute. */
+    mainPath: string;
+    /** Absolute path where the SEA blob should be emitted by `node --experimental-sea-config`. */
+    outputPath: string;
+}
+/**
+ * Shape of the JSON document consumed by `node --experimental-sea-config`.
+ *
+ * Mirrors the [Node SEA configuration schema]
+ * (https://nodejs.org/api/single-executable-applications.html). Builder always
+ * sets `disableExperimentalSEAWarning` so the produced binary doesn't print
+ * the warning banner on every invocation.
+ */
+export interface SeaConfigDocument {
+    /** Absolute path to the script the SEA bundle will execute. */
+    main: string;
+    /** Absolute path to the blob that `node --experimental-sea-config` will write. */
+    output: string;
+    /** Suppresses the runtime "this is an experimental feature" warning. Always `true`. */
+    disableExperimentalSEAWarning: true;
+}
+/**
+ * Builds the JSON document consumed by `node --experimental-sea-config <path>`.
+ *
+ * Builder always emits `disableExperimentalSEAWarning: true` to silence the
+ * runtime warning banner on every native binary invocation — published bins
+ * are expected to behave like first-class executables.
+ *
+ * @param inputs - Resolved absolute paths for the SEA `main` script and `output` blob.
+ * @returns SEA config document ready to be JSON-serialized to disk.
+ *
+ * @example Generating a SEA config for a bin
+ * ```typescript
+ * const config = generateSeaConfig({
+ *   mainPath: '/abs/dist/libs/builder/bin/hf-build.cjs.js',
+ *   outputPath: '/abs/dist/libs/builder/bin/hf-build.sea-prep.blob',
+ * })
+ * ```
+ */
+export declare const generateSeaConfig: (inputs: SeaConfigInputs) => SeaConfigDocument;
+//# sourceMappingURL=sea-config.d.ts.map

package/bin/native/sea-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sea-config.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/builder/src/bin/native/sea-config.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB,8FAA8F;IAC9F,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAA;IACd,uFAAuF;IACvF,6BAA6B,EAAE,IAAI,CAAA;CACpC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,eAAe,KAAG,iBAI1D,CAAA"}

package/bin/native/worker/index.cjs.js

@@ -0,0 +1,88 @@
+'use strict';
+
+const node_fs = require('node:fs');
+const node_path = require('node:path');
+const index_cjs_js = require('../../../_dependencies/postject/index.cjs.js');
+
+const BYTES_PER_MB = 1024 * 1024;
+const ensureDir = (path) => {
+    node_fs.mkdirSync(path, { recursive: true });
+};
+const safeStatSize = (filePath) => {
+    /* istanbul ignore next -- @preserve defensive: postject always produces the declared output file */
+    try {
+        return node_fs.statSync(filePath).size;
+    }
+    catch {
+        return 0;
+    }
+};
+/**
+ * Runs the postject inject for `job` in the current process and writes the
+ * resulting report to `job.reportPath`.
+ *
+ * Call this to drive the worker logic without spawning a new Node process. The
+ * inject normally runs in a forked child because `postject.inject` loads the
+ * entire ~121 MB host binary into a Node `Buffer` and rewrites it with the
+ * embedded blob — a single ~138 MB allocation that needs to be reclaimed on
+ * process exit rather than retained in the parent's RSS.
+ *
+ * @param job - Descriptor describing the inject invocation.
+ * @returns The on-disk report data the worker would have persisted.
+ *
+ * @example Driving the worker logic in-process for a fixture
+ * ```typescript
+ * const report = await runInjectWorkerJob({
+ *   hostBinary: '/opt/node',
+ *   outputBinary: '/tmp/out',
+ *   blobPath: '/tmp/sea.blob',
+ *   resourceName: 'NODE_SEA_BLOB',
+ *   machoSegmentName: 'NODE_SEA',
+ *   sentinelFuse: 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2',
+ *   reportPath: '/tmp/report.json',
+ * })
+ * ```
+ */
+const runInjectWorkerJob = async (job) => {
+    const startedAt = Date.now();
+    ensureDir(node_path.dirname(job.outputBinary));
+    ensureDir(node_path.dirname(job.reportPath));
+    node_fs.copyFileSync(job.hostBinary, job.outputBinary);
+    const blob = node_fs.readFileSync(job.blobPath);
+    await index_cjs_js.inject(job.outputBinary, job.resourceName, blob, {
+        machoSegmentName: job.machoSegmentName,
+        sentinelFuse: job.sentinelFuse,
+    });
+    const memory = process.memoryUsage();
+    const report = {
+        outputSize: safeStatSize(job.outputBinary),
+        endHeapMB: memory.heapUsed / BYTES_PER_MB,
+        endRssMB: memory.rss / BYTES_PER_MB,
+        durationMs: Date.now() - startedAt,
+    };
+    node_fs.writeFileSync(job.reportPath, JSON.stringify(report));
+    return report;
+};
+
+const isMainModule = () => {
+    if (typeof require !== 'undefined' && typeof module !== 'undefined' && require.main === module) {
+        return true;
+    }
+    const argv1 = process.argv[1] ?? '';
+    return argv1.endsWith('index.cjs.js') || argv1.endsWith('index.esm.js') || argv1.endsWith('index.ts') || argv1.endsWith('index.js');
+};
+if (isMainModule()) {
+    const raw = process.argv[2];
+    if (!raw) {
+        process.stderr.write('inject worker: missing job spec on argv\n');
+        process.exit(2);
+    }
+    const job = JSON.parse(raw);
+    runInjectWorkerJob(job).then(() => process.exit(0), (error) => {
+        const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
+        process.stderr.write(`inject worker for ${job.outputBinary} failed: ${message}\n`);
+        process.exit(1);
+    });
+}
+
+exports.runInjectWorkerJob = runInjectWorkerJob;

package/bin/native/worker/index.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Serializable inject-worker job descriptor: the contract between
+ * {@link dispatchInjectWorker} and the forked child. Every field must round-trip
+ * through `JSON.stringify` / `JSON.parse` — no functions, no class instances.
+ */
+interface InjectWorkerJob {
+    /** Absolute path to the Node host binary the worker clones as the injection target. */
+    hostBinary: string;
+    /** Absolute path the cloned + injected binary lands at. */
+    outputBinary: string;
+    /** Absolute path to the SEA preparation blob produced by `node --experimental-sea-config`. */
+    blobPath: string;
+    /** SEA resource name for the embedded blob (always `NODE_SEA_BLOB` at runtime). */
+    resourceName: string;
+    /** Mach-O segment name used by macOS injection (always `NODE_SEA` at runtime). */
+    machoSegmentName: string;
+    /** Sentinel fuse string postject scans for in the host binary. Constructed in-parent to avoid collision. */
+    sentinelFuse: string;
+    /** Absolute path the worker writes its JSON report to. */
+    reportPath: string;
+}
+/**
+ * Memory + size summary written to `reportPath` when the worker exits cleanly.
+ *
+ * Captured from the worker process — the parent never observes the ~138 MB
+ * postject buffer because the entire load lives and dies in the child.
+ */
+interface InjectWorkerReport {
+    /** On-disk size of `outputBinary` after injection, in bytes. */
+    outputSize: number;
+    /** Worker `process.memoryUsage().heapUsed` in MB at end of inject. */
+    endHeapMB: number;
+    /** Worker `process.memoryUsage().rss` in MB at end of inject. */
+    endRssMB: number;
+    /** Worker wall-clock duration in ms. */
+    durationMs: number;
+}
+
+/**
+ * Runs the postject inject for `job` in the current process and writes the
+ * resulting report to `job.reportPath`.
+ *
+ * Call this to drive the worker logic without spawning a new Node process. The
+ * inject normally runs in a forked child because `postject.inject` loads the
+ * entire ~121 MB host binary into a Node `Buffer` and rewrites it with the
+ * embedded blob — a single ~138 MB allocation that needs to be reclaimed on
+ * process exit rather than retained in the parent's RSS.
+ *
+ * @param job - Descriptor describing the inject invocation.
+ * @returns The on-disk report data the worker would have persisted.
+ *
+ * @example Driving the worker logic in-process for a fixture
+ * ```typescript
+ * const report = await runInjectWorkerJob({
+ *   hostBinary: '/opt/node',
+ *   outputBinary: '/tmp/out',
+ *   blobPath: '/tmp/sea.blob',
+ *   resourceName: 'NODE_SEA_BLOB',
+ *   machoSegmentName: 'NODE_SEA',
+ *   sentinelFuse: 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2',
+ *   reportPath: '/tmp/report.json',
+ * })
+ * ```
+ */
+declare const runInjectWorkerJob: (job: InjectWorkerJob) => Promise<InjectWorkerReport>;
+
+export { runInjectWorkerJob };
+export type { InjectWorkerJob, InjectWorkerReport };

package/bin/native/worker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/builder/src/bin/native/worker/index.ts"],"names":[],"mappings":"AAWA,YAAY,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA"}

package/bin/native/worker/index.esm.js

@@ -0,0 +1,86 @@
+import { copyFileSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { inject } from '../../../_dependencies/postject/index.esm.js';
+
+const BYTES_PER_MB = 1024 * 1024;
+const ensureDir = (path) => {
+    mkdirSync(path, { recursive: true });
+};
+const safeStatSize = (filePath) => {
+    /* istanbul ignore next -- @preserve defensive: postject always produces the declared output file */
+    try {
+        return statSync(filePath).size;
+    }
+    catch {
+        return 0;
+    }
+};
+/**
+ * Runs the postject inject for `job` in the current process and writes the
+ * resulting report to `job.reportPath`.
+ *
+ * Call this to drive the worker logic without spawning a new Node process. The
+ * inject normally runs in a forked child because `postject.inject` loads the
+ * entire ~121 MB host binary into a Node `Buffer` and rewrites it with the
+ * embedded blob — a single ~138 MB allocation that needs to be reclaimed on
+ * process exit rather than retained in the parent's RSS.
+ *
+ * @param job - Descriptor describing the inject invocation.
+ * @returns The on-disk report data the worker would have persisted.
+ *
+ * @example Driving the worker logic in-process for a fixture
+ * ```typescript
+ * const report = await runInjectWorkerJob({
+ *   hostBinary: '/opt/node',
+ *   outputBinary: '/tmp/out',
+ *   blobPath: '/tmp/sea.blob',
+ *   resourceName: 'NODE_SEA_BLOB',
+ *   machoSegmentName: 'NODE_SEA',
+ *   sentinelFuse: 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2',
+ *   reportPath: '/tmp/report.json',
+ * })
+ * ```
+ */
+const runInjectWorkerJob = async (job) => {
+    const startedAt = Date.now();
+    ensureDir(dirname(job.outputBinary));
+    ensureDir(dirname(job.reportPath));
+    copyFileSync(job.hostBinary, job.outputBinary);
+    const blob = readFileSync(job.blobPath);
+    await inject(job.outputBinary, job.resourceName, blob, {
+        machoSegmentName: job.machoSegmentName,
+        sentinelFuse: job.sentinelFuse,
+    });
+    const memory = process.memoryUsage();
+    const report = {
+        outputSize: safeStatSize(job.outputBinary),
+        endHeapMB: memory.heapUsed / BYTES_PER_MB,
+        endRssMB: memory.rss / BYTES_PER_MB,
+        durationMs: Date.now() - startedAt,
+    };
+    writeFileSync(job.reportPath, JSON.stringify(report));
+    return report;
+};
+
+const isMainModule = () => {
+    if (typeof require !== 'undefined' && typeof module !== 'undefined' && require.main === module) {
+        return true;
+    }
+    const argv1 = process.argv[1] ?? '';
+    return argv1.endsWith('index.cjs.js') || argv1.endsWith('index.esm.js') || argv1.endsWith('index.ts') || argv1.endsWith('index.js');
+};
+if (isMainModule()) {
+    const raw = process.argv[2];
+    if (!raw) {
+        process.stderr.write('inject worker: missing job spec on argv\n');
+        process.exit(2);
+    }
+    const job = JSON.parse(raw);
+    runInjectWorkerJob(job).then(() => process.exit(0), (error) => {
+        const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
+        process.stderr.write(`inject worker for ${job.outputBinary} failed: ${message}\n`);
+        process.exit(1);
+    });
+}
+
+export { runInjectWorkerJob };

package/bin/native/worker/job-runner.d.ts

@@ -0,0 +1,29 @@
+import type { InjectWorkerJob, InjectWorkerReport } from './types';
+/**
+ * Runs the postject inject for `job` in the current process and writes the
+ * resulting report to `job.reportPath`.
+ *
+ * Call this to drive the worker logic without spawning a new Node process. The
+ * inject normally runs in a forked child because `postject.inject` loads the
+ * entire ~121 MB host binary into a Node `Buffer` and rewrites it with the
+ * embedded blob — a single ~138 MB allocation that needs to be reclaimed on
+ * process exit rather than retained in the parent's RSS.
+ *
+ * @param job - Descriptor describing the inject invocation.
+ * @returns The on-disk report data the worker would have persisted.
+ *
+ * @example Driving the worker logic in-process for a fixture
+ * ```typescript
+ * const report = await runInjectWorkerJob({
+ *   hostBinary: '/opt/node',
+ *   outputBinary: '/tmp/out',
+ *   blobPath: '/tmp/sea.blob',
+ *   resourceName: 'NODE_SEA_BLOB',
+ *   machoSegmentName: 'NODE_SEA',
+ *   sentinelFuse: 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2',
+ *   reportPath: '/tmp/report.json',
+ * })
+ * ```
+ */
+export declare const runInjectWorkerJob: (job: InjectWorkerJob) => Promise<InjectWorkerReport>;
+//# sourceMappingURL=job-runner.d.ts.map

package/bin/native/worker/job-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-runner.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/builder/src/bin/native/worker/job-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAoBlE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,kBAAkB,GAAU,KAAK,eAAe,KAAG,OAAO,CAAC,kBAAkB,CAmBzF,CAAA"}

package/bin/native/worker/types.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Serializable inject-worker job descriptor: the contract between
+ * {@link dispatchInjectWorker} and the forked child. Every field must round-trip
+ * through `JSON.stringify` / `JSON.parse` — no functions, no class instances.
+ */
+export interface InjectWorkerJob {
+    /** Absolute path to the Node host binary the worker clones as the injection target. */
+    hostBinary: string;
+    /** Absolute path the cloned + injected binary lands at. */
+    outputBinary: string;
+    /** Absolute path to the SEA preparation blob produced by `node --experimental-sea-config`. */
+    blobPath: string;
+    /** SEA resource name for the embedded blob (always `NODE_SEA_BLOB` at runtime). */
+    resourceName: string;
+    /** Mach-O segment name used by macOS injection (always `NODE_SEA` at runtime). */
+    machoSegmentName: string;
+    /** Sentinel fuse string postject scans for in the host binary. Constructed in-parent to avoid collision. */
+    sentinelFuse: string;
+    /** Absolute path the worker writes its JSON report to. */
+    reportPath: string;
+}
+/**
+ * Memory + size summary written to `reportPath` when the worker exits cleanly.
+ *
+ * Captured from the worker process — the parent never observes the ~138 MB
+ * postject buffer because the entire load lives and dies in the child.
+ */
+export interface InjectWorkerReport {
+    /** On-disk size of `outputBinary` after injection, in bytes. */
+    outputSize: number;
+    /** Worker `process.memoryUsage().heapUsed` in MB at end of inject. */
+    endHeapMB: number;
+    /** Worker `process.memoryUsage().rss` in MB at end of inject. */
+    endRssMB: number;
+    /** Worker wall-clock duration in ms. */
+    durationMs: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/bin/native/worker/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../../../../../libs/builder/src/bin/native/worker/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,UAAU,EAAE,MAAM,CAAA;IAClB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAA;IACpB,8FAA8F;IAC9F,QAAQ,EAAE,MAAM,CAAA;IAChB,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAA;IACpB,kFAAkF;IAClF,gBAAgB,EAAE,MAAM,CAAA;IACxB,4GAA4G;IAC5G,YAAY,EAAE,MAAM,CAAA;IACpB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAA;IAChB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAA;CACnB"}

package/bin/run-bin-phase.d.ts

@@ -0,0 +1,24 @@
+import type { BinConfig, BinOutput, BuildContext } from '../models';
+/**
+ * Runs the bin phase: builds every declared JS bin, then emits a Node SEA native
+ * binary for any bin that opts in via `bin.sea`. Returns the flattened list of
+ * every output produced.
+ *
+ * A bin that declares a `sea` block must also produce a CJS output (`format: 'cjs'`
+ * or include `'cjs'` in the list); the CJS artifact becomes the SEA `main` script,
+ * and a bin without one throws. Native emission is skipped silently with an info
+ * log when the current host doesn't match any declared platform — CI orchestrates
+ * the matrix so each declared platform is built on the matching runner.
+ *
+ * @param ctx - Resolved build context.
+ * @param bins - Bin declarations to synthesize. Pass an empty array (or omit
+ * `config.bin` from the facade) to skip the phase entirely.
+ * @returns Flattened list of all bin outputs produced during the phase.
+ *
+ * @example Running the bin phase from a custom orchestrator
+ * ```typescript
+ * const binOutputs = await runBinPhase(context, config.bin ?? [])
+ * ```
+ */
+export declare const runBinPhase: (ctx: BuildContext, bins: BinConfig[]) => Promise<BinOutput[]>;
+//# sourceMappingURL=run-bin-phase.d.ts.map

package/bin/run-bin-phase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-bin-phase.d.ts","sourceRoot":"","sources":["../../../../../../../libs/builder/src/bin/run-bin-phase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAWnE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,WAAW,GAAU,KAAK,YAAY,EAAE,MAAM,SAAS,EAAE,KAAG,OAAO,CAAC,SAAS,EAAE,CAe3F,CAAA"}

package/bin/script/bootstrap-footer.d.ts

@@ -0,0 +1,41 @@
+import type { BinScriptFormat } from '../../models';
+/**
+ * Inputs to {@link defaultBootstrap}.
+ */
+export interface DefaultBootstrapOptions {
+    /** Runner export name to invoke. Use `'default'` to target the file's default export. */
+    runner: string;
+    /** Output format the bootstrap will be appended to. */
+    format: BinScriptFormat;
+}
+/**
+ * Builds the standard bootstrap footer appended to a JS bin's bundle output.
+ *
+ * The footer wires the resolved runner export to `process.argv` / `process.cwd()` /
+ * `process.stderr` / `process.stdout`, maps the returned exit code to `process.exit`,
+ * and surfaces unexpected rejections by writing to stderr and exiting `1`.
+ *
+ * When `runner === 'default'`, the runner reference is resolved differently per format:
+ * - CJS uses `module.exports.default`, available as a top-level reference inside the
+ *   compiled CommonJS bundle.
+ * - ESM uses `(await import(import.meta.url)).default`, which re-imports the bundle's
+ *   own module record to retrieve the default export. ESM top-level `await` is required.
+ *
+ * Otherwise the supplied named runner is referenced directly, which works for both
+ * formats because Rollup preserves the local function name at the file scope.
+ *
+ * @param options - Runner name + target format.
+ * @returns Bootstrap snippet suitable for `output.footer`.
+ *
+ * @example Default-export runner for an ESM bin
+ * ```typescript
+ * const footer = defaultBootstrap({ runner: 'default', format: 'esm' })
+ * ```
+ *
+ * @example Named runner shared between CJS and ESM outputs
+ * ```typescript
+ * const footer = defaultBootstrap({ runner: 'runCz', format: 'cjs' })
+ * ```
+ */
+export declare const defaultBootstrap: (options: DefaultBootstrapOptions) => string;
+//# sourceMappingURL=bootstrap-footer.d.ts.map

package/bin/script/bootstrap-footer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-footer.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/builder/src/bin/script/bootstrap-footer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAEnD;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,MAAM,EAAE,eAAe,CAAA;CACxB;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,uBAAuB,KAAG,MAWnE,CAAA"}

package/bin/script/build-bin.d.ts

@@ -0,0 +1,36 @@
+import type { BinConfig, BinOutput, BuildContext } from '../../models';
+/**
+ * Builds the JS outputs for a single bin declaration.
+ *
+ * For each declared format (CJS / ESM), forks a rollup worker that bundles
+ * `src/bin/<name>.ts`, prepends the `#!/usr/bin/env node` shebang, appends the
+ * resolved bootstrap footer (per-bin override or `defaultBootstrap`), writes
+ * the output to `<outputPath>/bin/<name>.<ext>`, and chmods it to `0o755` so
+ * the npm bin symlink is invokable. The worker isolates the heavy bin bundle
+ * (rollup + plugins + transitive deps loaded into the child) from the parent
+ * process.
+ *
+ * Output naming follows the convention:
+ * - ESM: `<name>.mjs`
+ * - CJS only: `<name>.js`
+ * - CJS alongside ESM: `<name>.cjs.js`
+ *
+ * Workspace dependencies are always inlined into bin bundles — bins are intended
+ * to ship as self-contained executable scripts.
+ *
+ * @param bin - Bin declaration including name, format(s), optional runner override, and bootstrap override.
+ * @param ctx - Resolved build context.
+ * @returns One `BinOutput` per emitted JS artifact.
+ *
+ * @example Building a CJS-only bin
+ * ```typescript
+ * const outputs = await buildJsBin({ name: 'cz', format: 'cjs', runner: 'runCz' }, context)
+ * ```
+ *
+ * @example Building dual CJS + ESM outputs
+ * ```typescript
+ * const outputs = await buildJsBin({ name: 'hf-build', format: ['cjs', 'esm'] }, context)
+ * ```
+ */
+export declare const buildJsBin: (bin: BinConfig, ctx: BuildContext) => Promise<BinOutput[]>;
+//# sourceMappingURL=build-bin.d.ts.map

package/bin/script/build-bin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-bin.d.ts","sourceRoot":"","sources":["../../../../../../../../libs/builder/src/bin/script/build-bin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAoBtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,UAAU,GAAU,KAAK,SAAS,EAAE,KAAK,YAAY,KAAG,OAAO,CAAC,SAAS,EAAE,CAkBvF,CAAA"}