build: Fully switch over to ESM

Now we can run with ESM at build and test time and transpile into
commonjs for electron. This greatly simplifies testing, since we treat
everything as ESM during build with esbuild anyways. Now the test
environment and the build scripts match the apparent (but not the actual
for the main, preload, and inject modules) runtime environment.

Caveats:

- We may use top-level async expressions in tests and script, but not in
  code that gets transpiled into commonjs or scripts that get imported
  by vite. The limitation w.r.t. commonjs seems fundamental.
- Jest only experimentally supports ESM and there are some limitations
  with mocking. Most limitations (except the lack of automatic mocks)
  can be worked around by async importing code that uses mocks.
- There are packages marked as modules (so that node reads any scripts
  in them as ESM) that nevertheless get transpiled into commonjs
  modules. However, these should be clearly marked by using a .cjs
  extension as their bundle. The worst offender is the root package,
  which has a .cjs as its main entry point that gets read by electron,
  but is in fact marked as a module. This doesn't seem to bother electron
  at all. The service-inject package is an IIFE with a .js extension,
  but it outputs a fully self-contained bundle, so the choice of module
  format should be irrelevant.

1 files changed, 69 insertions, 0 deletions

diff --git a/.electron-builder.config.cjs b/.electron-builder.config.cjs
new file mode 100644
index 0000000..5238c69
--- /dev/null
+++ b/.electron-builder.config.cjs
@@ -0,0 +1,69 @@
+// @ts-check
+
+const { Arch } = require('electron-builder');
+const { flipFuses, FuseV1Options, FuseVersion } = require('@electron/fuses');
+const { join } = require('path');
+
+/**
+ * @type {import('electron-builder').Configuration}
+ * @see https://www.electron.build/configuration/configuration
+ */
+const config = {
+  directories: {
+    output: 'dist',
+    buildResources: 'buildResources',
+  },
+  files: [
+    'packages/main/dist/**',
+    'packages/preload/dist/**',
+    'packages/renderer/dist/**',
+    'packages/service-inject/dist/**',
+    'packages/service-preload/dist/**',
+    // Do not ship with source maps.
+    '!**/*.map',
+  ],
+  afterPack(context) {
+    return burnFuses(context);
+  },
+};
+
+/**
+ * Hardens the shipped electron binary by burning some electron fuses.
+ *
+ * Enabled chromium cookie encryption and disables options that could be
+ * used to execute arbitrary code in the main process to circumvent cookie encryption:
+ * - Running the application as a plain node process is disabled.
+ * - Setting options through the `NODE_OPTIONS` environment variable is disabled.
+ * - Attaching a debugger through the `--inspect` family of options is disabled.
+ * - Embedded ASAR integrity validation is enabled.
+ * - Will onload load the application from the ASAR archive.
+ *
+ * @param {import('electron-builder').AfterPackContext} context The `electron-builder` context.
+ * @return {Promise<void>} The promise to flip the fuses.
+ * @see https://github.com/electron/fuses
+ */
+async function burnFuses(context) {
+  /** @type {string} */
+  const ext = {
+    darwin: '.app',
+    win32: '.exe',
+  }[context.electronPlatformName] || '';
+  const electronBinaryPath = join(
+    context.appOutDir,
+    `${context.packager.appInfo.productFilename}${ext}`
+  );
+  /** @type {import('@electron/fuses').FuseConfig<boolean>} */
+  const fuseConfig = {
+    version: FuseVersion.V1,
+    resetAdHocDarwinSignature: context.electronPlatformName === 'darwin' && context.arch === Arch.arm64,
+    [FuseV1Options.RunAsNode]: false,
+    [FuseV1Options.EnableCookieEncryption]: true,
+    [FuseV1Options.EnableNodeOptionsEnvironmentVariable]: false,
+    [FuseV1Options.EnableNodeCliInspectArguments]: false,
+    [FuseV1Options.EnableEmbeddedAsarIntegrityValidation]: true,
+    [FuseV1Options.OnlyLoadAppFromAsar]: true,
+  };
+  return flipFuses(electronBinaryPath, fuseConfig);
+}
+
+module.exports = config;