@spotlightjs/spotlight 2.4.2 → 2.6.0

package/bin/build.js

@@ -0,0 +1,144 @@
+#!/usr/bin/env node
+import { execFile as execFileCb } from 'node:child_process';
+import { createWriteStream } from 'node:fs';
+import { copyFile, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Readable } from 'node:stream';
+import { finished } from 'node:stream/promises';
+import { promisify } from 'node:util';
+
+import { unsign } from 'macho-unsign';
+import { signatureSet } from 'portable-executable-signature';
+import { inject } from 'postject';
+
+const execFile = promisify(execFileCb);
+
+const DIST_DIR = './dist';
+const ASSETS_DIR = join(DIST_DIR, 'overlay');
+const MANIFEST_NAME = 'manifest.json';
+const MANIFEST_PATH = join(ASSETS_DIR, MANIFEST_NAME);
+const ENTRY_POINT_NAME = 'src/index.html';
+const SEA_CONFIG_PATH = join(DIST_DIR, 'sea-config.json');
+const SPOTLIGHT_BLOB_PATH = join(DIST_DIR, 'spotlight.blob');
+const NODE_VERSION = '22.11.0';
+const PLATFORMS = (process.env.BUILD_PLATFORMS || `${process.platform}-${process.arch}`).split(',').map(p => p.trim());
+const manifest = JSON.parse(await readFile(MANIFEST_PATH));
+const seaConfig = {
+  main: join(DIST_DIR, 'spotlight.cjs'),
+  output: SPOTLIGHT_BLOB_PATH,
+  disableExperimentalSEAWarning: true,
+  useSnapshot: false,
+  useCodeCache: false, // We do cross-compiling so disable this
+  assets: {
+    [MANIFEST_NAME]: MANIFEST_PATH,
+    [ENTRY_POINT_NAME]: join(ASSETS_DIR, ENTRY_POINT_NAME),
+    ...Object.fromEntries(Object.values(manifest).map(entry => [entry.file, join(ASSETS_DIR, entry.file)])),
+  },
+};
+
+async function run(cmd, ...args) {
+  let output;
+  try {
+    output = await execFile(cmd, args, { encoding: 'utf8' });
+  } catch (err) {
+    console.error(`Failed to \`run ${cmd} ${args.join(' ')}\``);
+    console.error(err.stdout);
+    console.error(err.stderr);
+    process.exit(err.code);
+  }
+  if (output.stdout.trim()) {
+    console.log(output.stdout);
+  } else {
+    console.log(`> ${[cmd, ...args].join(' ')}`);
+  }
+  return output.stdout;
+}
+
+async function getNodeBinary(platform, targetPath = DIST_DIR) {
+  const suffix = platform.startsWith('win') ? 'zip' : 'tar.xz';
+  const remoteArchiveName = `node-v${NODE_VERSION}-${platform}.${suffix}`;
+  const url = `https://nodejs.org/dist/v${NODE_VERSION}/${remoteArchiveName}`;
+  const resp = await fetch(url);
+  if (!resp.ok) throw new Error(`Failed to fetch ${url}`);
+  const tmpDir = await mkdtemp(join(tmpdir(), remoteArchiveName));
+  const stream = createWriteStream(join(tmpDir, remoteArchiveName));
+  await finished(Readable.fromWeb(resp.body).pipe(stream));
+  let sourceFile;
+  let targetFile;
+  if (platform.startsWith('win')) {
+    await run('unzip', '-qq', stream.path, '-d', tmpDir);
+    sourceFile = join(tmpDir, `node-v${NODE_VERSION}-${platform}`, 'node.exe');
+    targetFile = join(targetPath, `spotlight-${platform}.exe`);
+    const data = await readFile(sourceFile);
+    const unsigned = signatureSet(data, null);
+    await writeFile(targetFile, Buffer.from(unsigned));
+    console.log('Signature removed from Win PE binary', targetFile);
+  } else {
+    await run('tar', '-xf', stream.path, '-C', tmpDir);
+    sourceFile = join(tmpDir, `node-v${NODE_VERSION}-${platform}`, 'bin', 'node');
+    targetFile = join(targetPath, `spotlight-${platform}`);
+  }
+
+  if (platform.startsWith('darwin')) {
+    const unsigned = unsign(await readFile(sourceFile));
+    await writeFile(targetFile, Buffer.from(unsigned));
+    console.log('Signature removed from macOS binary', targetFile);
+  } else {
+    await copyFile(sourceFile, targetFile);
+  }
+
+  await rm(tmpDir, { recursive: true });
+  return targetFile;
+}
+
+await writeFile(SEA_CONFIG_PATH, JSON.stringify(seaConfig));
+await run(process.execPath, '--experimental-sea-config', SEA_CONFIG_PATH);
+await Promise.all(
+  PLATFORMS.map(async platform => {
+    const nodeBinary = await getNodeBinary(platform);
+    console.log('Injecting spotlight blob into node executable...');
+    await inject(nodeBinary, 'NODE_SEA_BLOB', await readFile(SPOTLIGHT_BLOB_PATH), {
+      sentinelFuse: 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2',
+      machoSegmentName: platform.startsWith('darwin') ? 'NODE_SEA' : undefined,
+    });
+    console.log('Created executable', nodeBinary);
+    await run('chmod', '+x', nodeBinary);
+    if (platform.startsWith('darwin')) {
+      const { APPLE_TEAM_ID, APPLE_CERT_PATH, APPLE_CERT_PASSWORD, APPLE_API_KEY_PATH } = process.env;
+      if (!APPLE_TEAM_ID || !APPLE_CERT_PATH || !APPLE_CERT_PASSWORD) {
+        console.warn(
+          "Missing required environment variables for macOS signing, you won't be able to use this binary until you sign it yourself.",
+        );
+        console.info({ APPLE_TEAM_ID, APPLE_CERT_PATH, APPLE_CERT_PASSWORD });
+        return;
+      }
+      console.log(`Signing ${nodeBinary}...`);
+      await run(
+        'rcodesign',
+        'sign',
+        '--team-name',
+        APPLE_TEAM_ID,
+        '--p12-file',
+        APPLE_CERT_PATH,
+        '--p12-password',
+        APPLE_CERT_PASSWORD,
+        '--for-notarization',
+        '-e',
+        join(import.meta.dirname, 'entitlements.plist'),
+        nodeBinary,
+      );
+      if (!APPLE_API_KEY_PATH) {
+        console.warn(
+          "Missing required environment variable for macOS notarization, you won't be able to notarize this binary which will annoy people trying to run it.",
+        );
+        console.info({ APPLE_API_KEY_PATH });
+        return;
+      }
+      const zipFile = `${nodeBinary}.zip`;
+      await run('zip', zipFile, nodeBinary);
+      await run('rcodesign', 'notary-submit', '--api-key-file', APPLE_API_KEY_PATH, '--wait', zipFile);
+      await rm(zipFile);
+    }
+  }),
+);

package/bin/entitlements.plist

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<!-- This file should be the same as https://github.com/nodejs/node/blob/main/tools/osx-entitlements.plist -->
+<plist version="1.0">
+<dict>
+    <key>com.apple.security.cs.allow-jit</key>
+    <true/>
+    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+    <true/>
+    <key>com.apple.security.cs.disable-executable-page-protection</key>
+    <true/>
+    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
+    <true/>
+    <key>com.apple.security.cs.disable-library-validation</key>
+    <true/>
+    <key>com.apple.security.get-task-allow</key>
+    <true/>
+</dict>
+</plist>

package/bin/run.js

@@ -1,6 +1,79 @@
 #!/usr/bin/env node
-const { setupSidecar } = await import('../dist/sidecar.js');
+import { setupSidecar } from '@spotlightjs/sidecar';
+import { inflateRawSync } from 'node:zlib';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import * as sea from 'node:sea';
+import { fileURLToPath } from 'node:url';
+
+if (process.stdout.isTTY) {
+  const data = Uint8Array.from(
+    inflateRawSync(
+      Buffer.from(
+        'bY7LCgMxFEK9L5MwDDSL9P//1DJMKGXowoUcUaFZOk8dU2Op9+qZVkYQoFsaEqA6PZxxma1AoMG+TiONTgcfAd741YxxVf8gCzCgWcYB7OSj9sjW7t2/eKxKAxkIYv8NqL3FpVY25CmjrBSuDw==',
+        'base64',
+      ),
+    ),
+  );
+  const E = '\x1b[';
+  const C = `${E}38;5;`;
+  const M_COL = `${C}96m`;
+  const F_COL = `${C}61m`;
+  const BOLD = `${E}1m`;
+  const RESET = `${E}0m`;
+  const NL = `${RESET}\n`;
+  let factor = 0.22;
+  let c = 0;
+  let col = 0;
+  let line = 0;
+  let lim = 26;
+  let r = 0;
+  for (let p of data) {
+    if (p === 255) {
+      process.stdout.write(NL);
+      c = col = 0;
+      if (line++ === 5) {
+        factor = factor / -3;
+      }
+      lim = Math.round(lim * (1 + factor));
+      r = Math.round(Math.random() * 18);
+    } else {
+      while (p-- >= 0) {
+        if (col < lim - 1) {
+          process.stdout.write(M_COL);
+        } else if (col === lim - 1) {
+          process.stdout.write(F_COL);
+        } else if (col === lim + r) {
+          process.stdout.write(`${RESET}${BOLD}`);
+        }
+        process.stdout.write(c ? (col >= 35 ? '#' : 's') : ' ');
+        col++;
+      }
+      c = !c;
+    }
+  }
+  process.stdout.write(NL);
+}
+
+const readAsset = sea.isSea()
+  ? name => Buffer.from(sea.getRawAsset(name))
+  : (() => {
+      const ASSET_DIR = join(fileURLToPath(import.meta.url), '../../dist/overlay/');
+
+      return name => readFileSync(join(ASSET_DIR, name));
+    })();
+
 const port = process.argv.length >= 3 ? Number(process.argv[2]) : undefined;
-import { join } from 'path';
-import { fileURLToPath } from 'url';
-setupSidecar({ port, basePath: join(fileURLToPath(import.meta.url), '../../dist/overlay/') });
+const MANIFEST_NAME = 'manifest.json';
+const ENTRY_POINT_NAME = 'src/index.html';
+const basePath = process.cwd();
+const filesToServe = Object.create(null);
+
+    // Following the guide here: https://vite.dev/guide/backend-integration.html
+const manifest = JSON.parse(readAsset(MANIFEST_NAME));
+filesToServe[ENTRY_POINT_NAME] = readAsset(ENTRY_POINT_NAME);
+const entries = Object.values(manifest);
+for (const entry of entries) {
+  filesToServe[entry.file] = readAsset(entry.file);
+}
+setupSidecar({ port, basePath, filesToServe });