Distillation

["1f672800751cf37f6c317bb48c8c5fd5","f4573df796b651301ac689ea227b4f92"]

<observations> Date: June 9, 2026 * 🟡 (11:56) package.json: name="fossilize", version="0.8.0", author="Burak Yigit Kaya <ben@byk.im>", license=MIT, type=module, engines node>=18, Volta pin node=22.14.0 * 🟡 (11:56) package.json dependencies (11): @stricli/auto-complete ^1.1.0, @stricli/core ^1.1.0, binpunch ^1.0.0, esbuild ^0.25.0, macho-unsign ^2.0.6, p-limit ^6.2.0, portable-executable-signature ^2.0.6, postject ^1.0.0-alpha.6, tar-stream ^3.1.7, xz-decompress ^0.2.2, yauzl ^3.2.0 * 🟡 (11:56) package.json devDependencies (4): @types/node 22.x, @types/tar-stream ^3.1.3, @types/yauzl ^2.10.3, tsup ^6.7.0, typescript 5.6.x * 🟡 (11:56) package.json scripts: prebuild="tsc -p src/tsconfig.json", build="tsup", prepublishOnly="npm run build"; #postinstall (commented out) runs @stricli/auto-complete install * 🟡 (11:56) tsup config (in package.json): entry=[src/index.ts, src/bin/cli.ts, src/bin/bash-complete.ts], format=[esm], tsconfig=src/tsconfig.json, clean=true, splitting=true, minify=true, sourcemap=true, dts=true * 🟡 (11:56) package.json bin: fossilize→dist/bin/cli.js, __fossilize_bash_complete→dist/bin/bash-complete.js; files: [dist, import-meta-url.js, entitlements.plist] * 🟡 (11:56) AGENTS.md: package manager listed as npm (not pnpm/yarn); Node pinned via Volta 22.14.0; uses Craft for releases (publish_repo: self pattern) * 🟡 (11:56) AGENTS.md release flow: (1) maintainer triggers Release workflow with version auto or explicit, (2) Craft creates release/X.Y.Z branch + bumps package.json + generates CHANGELOG + opens publish issue, (3) CI runs build+test+artifacts jobs, (4) maintainer adds `accepted` label, (5) Publish workflow fires craft publish → npm (OIDC) + GitHub Release, (6) issue auto-closes * 🟡 (11:56) .craft.yml: minVersion=2.21.1, changelog.policy=auto, versioning.policy=auto, artifactProvider=github mapping "Build & Test"→npm-tarball, targets: npm (access=public, oidc=true) + github * 🟡 (11:56) src/tsconfig.json: lib=ES2022, module=preserve, target=ES2022, noEmit=true, rootDir=.., types=[node], resolveJsonModule=true, moduleResolution=bundler, strict=true, isolatedModules=true, verbatimModuleSyntax=true, noUncheckedIndexedAccess=true, noPropertyAccessFromIndexSignature=true, noImplicitOverride=true * 🟡 (11:56) src/impl.ts: main export is async function fossilize(flags: FossilizeOptions, entrypoint: string). Key constants: PACKAGE_JSON, SEA_CONFIG_JSON="sea-config.json", SEA_BLOB="sea.blob", NODE_SEA_FUSE="fce680ab2cc467b6e072b8b5df1996b2". Uses esbuild.build() for bundling (CJS format, minify, treeShaking), postject inject() for SEA injection, pLimit for concurrency * 🟡 (11:56) src/impl.ts: cross-compile logic — generates 2 blobs when cross-compiling: base blob (no code cache) for non-host platforms, codeCacheBlobPath (`${blobPath}.codecache`) with useCodeCache=true for host platform. Code cache saves ~15% startup time but is CPU-arch-specific * 🟡 (11:56) src/impl.ts: strip logic — runs `strip -x` for darwin, `strip --strip-unneeded` for linux BEFORE postject injection (postject corrupts ELF section-to-segment layout if stripped after). Non-fatal if cross-stripping fails * 🟡 (11:56) src/impl.ts: macOS signing uses rcodesign with env vars APPLE_TEAM_ID, APPLE_CERT_PATH, APPLE_CERT_PASSWORD, APPLE_API_KEY_PATH. Windows signing not supported (warns user). holePunch uses binpunch.processBinary() after SEA injection, before signing * 🟡 (11:56) src/impl.ts: FossilizeOptions interface fields: nodeVersion, platforms?, assets?, assetManifest?, outDir, outputName?, cacheDir, noCache?, noBundle, sign, hol