feat: enhanced SEA mode with walker integration and VFS

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false # prevent test to stop if one fails
       matrix:
-        node-version: [20.x, 22.x, 24.x]
+        node-version: [22.x, 24.x]
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:
@@ -23,7 +23,7 @@ jobs:
 
       - run: yarn install
 
-      - if: matrix['node-version'] == '20.x' && matrix['os'] == 'ubuntu-latest'
+      - if: matrix['node-version'] == '22.x' && matrix['os'] == 'ubuntu-latest'
         run: yarn lint
       - run: yarn build
   test_host:
@@ -36,11 +36,6 @@ jobs:
     with:
       npm_command: test:22
 
-  test_20:
-    uses: ./.github/workflows/test.yml
-    with:
-      npm_command: test:20
-
   test_24:
     uses: ./.github/workflows/test.yml
     with:

.github/workflows/test.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       fail-fast: false # prevent test to stop if one fails
       matrix:
-        node-version: [20.x, 22.x, 24.x]
+        node-version: [22.x, 24.x]
         os: [ubuntu-latest, windows-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     steps:

.github/workflows/update-dep.yml

@@ -24,10 +24,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Use Node.js 20
+      - name: Use Node.js 22
         uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: 22.x
           cache: 'yarn'
 
       - name: Update dependency

.gitignore

@@ -19,4 +19,5 @@ examples/express/node_modules
 
 # Editors
 yarn-error.log
-tsconfig.tsbuildinfo
+tsconfig.tsbuildinfo
+prelude/sea-bootstrap.bundle.js

README.md

@@ -47,7 +47,7 @@ After installing it, run `pkg --help` without arguments to see list of options:
     --no-native-build    skip native addons build
     --no-dict            comma-separated list of packages names to ignore dictionaries. Use --no-dict * to disable all dictionaries
     -C, --compress       [default=None] compression algorithm = Brotli or GZip
-    --sea                (Experimental) compile give file using node's SEA feature. Requires node v20.0.0 or higher and only single file is supported
+    --sea                (Experimental) compile using node's SEA feature. With package.json input and node >= 22, uses enhanced mode with full dependency walking and VFS
 
   Examples:
 
@@ -58,7 +58,7 @@ After installing it, run `pkg --help` without arguments to see list of options:
   – Makes executable for particular target machine
     $ pkg -t node22-win-arm64 index.js
   – Makes executables for target machines of your choice
-    $ pkg -t node20-linux,node22-linux,node22-win index.js
+    $ pkg -t node22-linux,node24-linux,node24-win index.js
   – Bakes '--expose-gc' and '--max-heap-size=34' into executable
     $ pkg --options "expose-gc,max-heap-size=34" index.js
   – Consider packageA and packageB to be public
@@ -87,9 +87,9 @@ The entrypoint of your project is a mandatory CLI argument. It may be:
 `pkg` can generate executables for several target machines at a
 time. You can specify a comma-separated list of targets via `--targets`
 option. A canonical target consists of 3 elements, separated by
-dashes, for example `node20-macos-x64` or `node22-linux-arm64`:
+dashes, for example `node22-macos-x64` or `node24-linux-arm64`:
 
-- **nodeRange** node20, node22, node24 or latest
+- **nodeRange** node22, node24 or latest
 - **platform** alpine, linux, linuxstatic, win, macos, (freebsd)
 - **arch** x64, arm64, (armv6, armv7)
 

eslint.config.js

@@ -15,6 +15,7 @@ module.exports = [
       'test/test-51-esm-import-meta/esm-module/test-import-meta-basic.js',
       'lib/log.js', // ESM re-export file
       'test/test-50-extensions/test-y-esnext.js', // ESM test file
+      'prelude/sea-bootstrap.bundle.js', // Generated by esbuild
     ],
   },
 
@@ -96,6 +97,14 @@ module.exports = [
     files: ['prelude/**/*'],
     rules: {
       strict: 'off',
+      'no-unused-vars': [
+        'error',
+        {
+          argsIgnorePattern: '^_',
+          varsIgnorePattern: '^_',
+          caughtErrorsIgnorePattern: '^_',
+        },
+      ],
     },
   },
 

lib/index.ts

@@ -1,5 +1,5 @@
 import assert from 'assert';
-import { existsSync, readFileSync, writeFileSync, copyFileSync } from 'fs';
+import { existsSync, readFileSync, copyFileSync } from 'fs';
 import { mkdir, readFile, rm, stat } from 'fs/promises';
 import minimist from 'minimist';
 import { need, system } from '@yao-pkg/pkg-fetch';
@@ -16,9 +16,9 @@ import { shutdown } from './fabricator';
 import walk, { Marker, WalkerParams } from './walker';
 import { Target, NodeTarget, SymLinks } from './types';
 import { CompressType } from './compress_type';
-import { patchMachOExecutable, signMachOExecutable } from './mach-o';
+import { signMachOExecutable } from './mach-o';
 import pkgOptions from './options';
-import sea from './sea';
+import sea, { seaEnhanced, signMacOSIfNeeded } from './sea';
 
 const { version } = JSON.parse(
   readFileSync(path.join(__dirname, '../package.json'), 'utf-8'),
@@ -28,6 +28,23 @@ function isConfiguration(file: string) {
   return isPackageJson(file) || file.endsWith('.config.json');
 }
 
+function buildMarker(
+  configJson: Record<string, unknown> | undefined,
+  config: string,
+  inputJson: Record<string, unknown> | undefined,
+  input: string,
+): Marker {
+  const marker: Marker = configJson
+    ? { config: configJson, base: path.dirname(config), configPath: config }
+    : {
+        config: inputJson || {},
+        base: path.dirname(input),
+        configPath: input,
+      };
+  marker.toplevel = true;
+  return marker;
+}
+
 // http://www.openwall.com/lists/musl/2012/12/08/4
 
 const {
@@ -529,10 +546,41 @@ export async function exec(argv2: string[]) {
   }
 
   if (argv.sea) {
-    await sea(inputFin, {
-      targets,
-      signature: argv.signature,
-    });
+    const minTargetMajor = Math.min(
+      ...targets.map((t) => {
+        const v = parseInt(t.nodeRange.replace('node', ''), 10);
+        // Treat unparseable ranges (e.g. "latest") as current host major
+        return Number.isNaN(v) ? parseInt(process.version.slice(1), 10) : v;
+      }),
+    );
+
+    if ((inputJson || configJson) && minTargetMajor < 22) {
+      throw wasReported(
+        'Enhanced SEA mode requires Node >= 22 targets. ' +
+          `Minimum target version resolved to Node ${minTargetMajor}.`,
+      );
+    }
+
+    if (inputJson || configJson) {
+      // Enhanced SEA mode — use walker pipeline
+      const marker = buildMarker(configJson, config, inputJson, input);
+
+      pkgOptions.set(configJson?.pkg ?? inputJson?.pkg);
+
+      await seaEnhanced(inputFin, {
+        targets,
+        signature: argv.signature,
+        marker,
+        params: { seaMode: true },
+        addition: isConfiguration(input) ? input : undefined,
+      });
+    } else {
+      // Simple SEA mode — plain .js file without package.json
+      await sea(inputFin, {
+        targets,
+        signature: argv.signature,
+      });
+    }
     return;
   }
 
@@ -596,23 +644,8 @@ export async function exec(argv2: string[]) {
 
   let marker: Marker;
 
-  if (configJson) {
-    pkgOptions.set(configJson?.pkg);
-    marker = {
-      config: configJson,
-      base: path.dirname(config),
-      configPath: config,
-    };
-  } else {
-    pkgOptions.set(inputJson?.pkg);
-    marker = {
-      config: inputJson || {}, // not `inputBin` because only `input`
-      base: path.dirname(input), // is the place for `inputJson`
-      configPath: input,
-    };
-  }
-
-  marker.toplevel = true;
+  pkgOptions.set(configJson?.pkg ?? inputJson?.pkg);
+  marker = buildMarker(configJson, config, inputJson, input);
 
   // public
 
@@ -684,30 +717,7 @@ export async function exec(argv2: string[]) {
     });
 
     if (target.platform !== 'win' && target.output) {
-      if (argv.signature && target.platform === 'macos') {
-        // patch executable to allow code signing
-        const buf = patchMachOExecutable(readFileSync(target.output));
-        writeFileSync(target.output, buf);
-
-        try {
-          // sign executable ad-hoc to workaround the new mandatory signing requirement
-          // users can always replace the signature if necessary
-          signMachOExecutable(target.output);
-        } catch {
-          if (target.arch === 'arm64') {
-            log.warn('Unable to sign the macOS executable', [
-              'Due to the mandatory code signing requirement, before the',
-              'executable is distributed to end users, it must be signed.',
-              'Otherwise, it will be immediately killed by kernel on launch.',
-              'An ad-hoc signature is sufficient.',
-              'To do that, run pkg on a Mac, or transfer the executable to a Mac',
-              'and run "codesign --sign - <executable>", or (if you use Linux)',
-              'install "ldid" utility to PATH and then run pkg again',
-            ]);
-          }
-        }
-      }
-
+      await signMacOSIfNeeded(target.output, target, argv.signature);
       await plusx(target.output);
     }
   }

lib/packer.ts

@@ -25,6 +25,11 @@ const bootstrapText = readFileSync(
 
 const commonText = readFileSync(require.resolve('./common'), 'utf8');
 
+const sharedText = readFileSync(
+  require.resolve('../prelude/bootstrap-shared.js'),
+  'utf8',
+);
+
 const diagnosticText = readFileSync(
   require.resolve('../prelude/diagnostic.js'),
   'utf8',
@@ -169,10 +174,11 @@ export default function packer({
     }
   }
   const prelude =
-    `return (function (REQUIRE_COMMON, VIRTUAL_FILESYSTEM, DEFAULT_ENTRYPOINT, SYMLINKS, DICT, DOCOMPRESS) {
+    `return (function (REQUIRE_COMMON, REQUIRE_SHARED, VIRTUAL_FILESYSTEM, DEFAULT_ENTRYPOINT, SYMLINKS, DICT, DOCOMPRESS) {
         ${bootstrapText}${
           log.debugMode ? diagnosticText : ''
         }\n})(function (exports) {\n${commonText}\n},\n` +
+    `(function () { var module = { exports: {} };\n${sharedText}\nreturn module.exports; })(),\n` +
     `%VIRTUAL_FILESYSTEM%` +
     `\n,\n` +
     `%DEFAULT_ENTRYPOINT%` +