Distillation

🔴 (11:46) User stated goal: wants a single-executable Node.js application

🔴 (11:46) User asked "I need fossilize?" — questioning whether fossilize is necessary for their use case

🔴 (11:46) User stated: wants to include a bundler; both esbuild and rollup have native components (this is a blocker for fossilize being a SEA itself, and relevant to user's own build)

🟡 (11:46) [tool-failure] Apple Developer notarization docs page failed to load (requires JavaScript); webfetch returned non-2xx status ×2 during research session

🟡 (11:46) fossilize npm package (v0.9.0, MIT, published 2 days before June 9 2026, author: byk, 11 dependencies, 0 dependents, 16 versions, ~1,054 weekly downloads) details:

• Creates self-contained Node SEA binaries for all Node.js-supported platforms
• Bundles app + dependencies into single CJS file using esbuild, then wraps with Node SEA
• Supports embedding assets: file-by-file, from directory, or via Vite manifest
• sign: false is default; sign: true uses rcodesign (from apple-platform-rs) for macOS signing via env vars: APPLE_TEAM_ID, APPLE_CERT_PATH, APPLE_CERT_PASSWORD, APPLE_API_KEY_PATH
• Programmatic API: fossilize({ nodeVersion, platforms, outDir, cacheDir, noBundle, sign, holePunch, concurrencyLimit }, entrypoint)
• Supported platforms arg: e.g. ["darwin-arm64", "linux-x64", "win-x64"]
• Env vars: FOSSILIZE_SIGN, FOSSILIZE_NODE_VERSION, FOSSILIZE_CACHE_DIR, FOSSILIZE_PLATFORMS (comma-separated), FOSSILIZE_CONCURRENCY_LIMIT
• fossilize is NOT itself a SEA due to 2 blockers: (1) esbuild and rollup have native components (WASM possible but not yet done); (2) postject gets confused injecting itself
• Repo: github.com/BYK/fossilize (not nicolo-ribaudo as originally referenced)

🟡 (11:46) Node.js SEA (Single Executable Applications) details from Node.js v26.3.0 docs:

• Added in v19.7.0/v18.16.0; Stability 1.1 (Active development)
• --build-sea flag added in v25.5.0 (handles blob generation + injection internally)
• Build process: (1) create sea-config.json with main, output, optional fields; (2) run node --build-sea sea-config.json; (3) on macOS sign with codesign --sign - <binary>
• Config fields: main, mainFormat (commonjs|module, default commonjs), executable (optional), output, disableExperimentalSEAWarning (default false), useSnapshot (default false), useCodeCache (default false), execArgv (array), execArgvExtension (none|env|cli, default env), assets (key-path dict)
• Cross-platform SEA: must set useCodeCache: false and useSnapshot: false
• macOS: blob injected as section NODE_SEA_BLOB in NODE_SEA Mach-O segment; Linux: ELF note; Windows: PE resource
• Fuse string: NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2 (last char flipped to 1 after injection)
• Manual injection tool: postject (npx postject); macOS requires --macho-segment-name NODE_SEA
• node:sea API: sea.isSea(), sea.getAsset(key[, encoding]), sea.getAssetAsBlob(key[, options]), sea.getRawAsset(key) (no-copy), sea.getAssetKeys() (added v24.8.0/v22.20.0)
• import() does NOT work when useCodeCache: true
• "mainFormat": "module" cannot be used with "useSnapshot": true
• In injected script: __filename, module.filename, process.execPath all equal the executable path; __dirname = directory of executable
• Native addons: bundle as assets, write to tmpdir, load via process.dlopen()
• Known caveat: Linux arm64 Docker container postject produces ELF with incorrect hash table → crashes on process.dlopen()