From 807b86661f20b0d50c074dd0030820ab3e8ff335 Mon Sep 17 00:00:00 2001
From: Joyee Cheung <joyeec9h3@gmail.com>
Date: Mon, 13 Mar 2023 22:45:42 +0100
Subject: [PATCH] src: use JSON configuration and blob content for SEA

---
 doc/api/cli.md                                |  12 ++
 doc/api/single-executable-applications.md     |  91 +++++---
 ...g-single-executable-application-support.md |   2 +-
 node.gyp                                      |   2 +
 src/json_parser.cc                            |  80 +++++++
 src/json_parser.h                             |  39 ++++
 src/node.cc                                   |   5 +
 src/node_errors.cc                            |  28 ++-
 src/node_errors.h                             |  16 ++
 src/node_options.cc                           |   5 +
 src/node_options.h                            |   1 +
 src/node_sea.cc                               |  92 +++++++-
 src/node_sea.h                                |   3 +-
 .../test-single-executable-application.js     |  28 ++-
 ...st-single-executable-blob-config-errors.js | 204 ++++++++++++++++++
 .../test-single-executable-blob-config.js     |  50 +++++
 16 files changed, 613 insertions(+), 45 deletions(-)
 create mode 100644 src/json_parser.cc
 create mode 100644 src/json_parser.h
 create mode 100644 test/parallel/test-single-executable-blob-config-errors.js
 create mode 100644 test/parallel/test-single-executable-blob-config.js

diff --git a/doc/api/cli.md b/doc/api/cli.md
index cda8232ac91d9f..0b0e643e5d71d7 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -588,6 +588,16 @@ added: v16.6.0
 
 Use this flag to disable top-level await in REPL.
 
+### `--experimental-sea-config`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Use this flag to generate a blob that can be injected in to the Node.js
+binary to produce a [single executable application][]. See the documentation
+about [this configuration][`--experimental-sea-config`] for details.
+
 ### `--experimental-shadow-realm`
 
 <!-- YAML
@@ -2550,6 +2560,7 @@ done
 [`--cpu-prof-dir`]: #--cpu-prof-dir
 [`--diagnostic-dir`]: #--diagnostic-dirdirectory
 [`--experimental-wasm-modules`]: #--experimental-wasm-modules
+[`--experimental-sea-config`]: single-executable-applications.md#generating-single-executable-preparation-blobs
 [`--heap-prof-dir`]: #--heap-prof-dir
 [`--import`]: #--importmodule
 [`--openssl-config`]: #--openssl-configfile
@@ -2587,6 +2598,7 @@ done
 [scavenge garbage collector]: https://v8.dev/blog/orinoco-parallel-scavenger
 [security warning]: #warning-binding-inspector-to-a-public-ipport-combination-is-insecure
 [semi-space]: https://www.memorymanagement.org/glossary/s.html#semi.space
+[single executable applications]: single-executable-applications.md
 [test reporters]: test.md#test-reporters
 [timezone IDs]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 [tracking issue for user-land snapshots]: https://github.com/nodejs/node/issues/44014
diff --git a/doc/api/single-executable-applications.md b/doc/api/single-executable-applications.md
index 1af2d4dbdd7a7f..ac50f99d2039fe 100644
--- a/doc/api/single-executable-applications.md
+++ b/doc/api/single-executable-applications.md
@@ -10,15 +10,17 @@ This feature allows the distribution of a Node.js application conveniently to a
 system that does not have Node.js installed.
 
 Node.js supports the creation of [single executable applications][] by allowing
-the injection of a JavaScript file into the `node` binary. During start up, the
-program checks if anything has been injected. If the script is found, it
-executes its contents. Otherwise Node.js operates as it normally does.
+the injection of a blob prepared by Node.js, which can contain a bundled script,
+into the `node` binary. During start up, the program checks if anything has been
+injected. If the blob is found, it executes the script in the blob. Otherwise
+Node.js operates as it normally does.
 
-The single executable application feature only supports running a single
-embedded [CommonJS][] file.
+The single executable application feature currently only supports running a
+single embedded script using the [CommonJS][] module system.
 
-A bundled JavaScript file can be turned into a single executable application
-with any tool which can inject resources into the `node` binary.
+Users can create a single executable application from their bundled script
+with the `node` binary itself and any tool which can inject resources into the
+binary.
 
 Here are the steps for creating a single executable application using one such
 tool, [postject][]:
@@ -28,12 +30,23 @@ tool, [postject][]:
    $ echo 'console.log(`Hello, ${process.argv[2]}!`);' > hello.js
    ```
 
-2. Create a copy of the `node` executable and name it according to your needs:
+2. Create a configuration file building a blob that can be injected into the
+   single executable application:
+   ```console
+   $ echo '{ "main": "hello.js", "output": "sea-prep.blob" }' > sea-config.json
+   ```
+
+3. Generate the blob to be injected:
+   ```console
+   $ node --experimental-sea-config sea-config.json
+   ```
+
+4. Create a copy of the `node` executable and name it according to your needs:
    ```console
    $ cp $(command -v node) hello
    ```
 
-3. Remove the signature of the binary:
+5. Remove the signature of the binary:
 
    * On macOS:
 
@@ -50,35 +63,35 @@ tool, [postject][]:
    $ signtool remove /s hello
    ```
 
-4. Inject the JavaScript file into the copied binary by running `postject` with
+6. Inject the blob into the copied binary by running `postject` with
    the following options:
 
    * `hello` - The name of the copy of the `node` executable created in step 2.
-   * `NODE_JS_CODE` - The name of the resource / note / section in the binary
-     where the contents of the JavaScript file will be stored.
-   * `hello.js` - The name of the JavaScript file created in step 1.
-   * `--sentinel-fuse NODE_JS_FUSE_fce680ab2cc467b6e072b8b5df1996b2` - The
+   * `NODE_SEA_BLOB` - The name of the resource / note / section in the binary
+     where the contents of the blob will be stored.
+   * `hello.js` - The name of the blob created in step 1.
+   * `--sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2` - The
      [fuse][] used by the Node.js project to detect if a file has been injected.
-   * `--macho-segment-name NODE_JS` (only needed on macOS) - The name of the
-     segment in the binary where the contents of the JavaScript file will be
+   * `--macho-segment-name NODE_SEA` (only needed on macOS) - The name of the
+     segment in the binary where the contents of the blob will be
      stored.
 
    To summarize, here is the required command for each platform:
 
    * On systems other than macOS:
      ```console
-     $ npx postject hello NODE_JS_CODE hello.js \
-         --sentinel-fuse NODE_JS_FUSE_fce680ab2cc467b6e072b8b5df1996b2
+     $ npx postject hello NODE_SEA_BLOB hello.js \
+         --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2
      ```
 
    * On macOS:
      ```console
-     $ npx postject hello NODE_JS_CODE hello.js \
-         --sentinel-fuse NODE_JS_FUSE_fce680ab2cc467b6e072b8b5df1996b2 \
-         --macho-segment-name NODE_JS
+     $ npx postject hello NODE_SEA_BLOB hello.js \
+         --sentinel-fuse NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2 \
+         --macho-segment-name NODE_SEA
      ```
 
-5. Sign the binary:
+7. Sign the binary:
 
    * On macOS:
 
@@ -95,12 +108,33 @@ tool, [postject][]:
    $ signtool sign /fd SHA256 hello
    ```
 
-6. Run the binary:
+8. Run the binary:
    ```console
    $ ./hello world
    Hello, world!
    ```
 
+## Generating single executable preparation blobs
+
+Single executable preparation blobs that are injected into the application can
+be generated using the `--experimental-sea-config` flag of the Node.js binary
+that will be used to build the single executable. It takes a path to a
+configuration file in JSON format. If the path passed to it isn't absolute,
+Node.js will use the path relative to the current working directory.
+
+The configuration currently reads the following top-level fields:
+
+```json
+{
+  "main": "/path/to/bundled/script.js",
+  "output": "/path/to/write/the/generated/blob.blob"
+}
+```
+
+If the paths are not absolute, Node.js will use the path relative to the
+current working directory. The version of the Node.js binary used to produce
+the blob must be the same as the one to which the blob will be injected.
+
 ## Notes
 
 ### `require(id)` in the injected module is not file based
@@ -135,15 +169,16 @@ of [`process.execPath`][].
 ### Single executable application creation process
 
 A tool aiming to create a single executable Node.js application must
-inject the contents of a JavaScript file into:
+inject the contents of the blob prepared with `--experimental-sea-config"`
+into:
 
-* a resource named `NODE_JS_CODE` if the `node` binary is a [PE][] file
-* a section named `NODE_JS_CODE` in the `NODE_JS` segment if the `node` binary
+* a resource named `NODE_SEA_BLOB` if the `node` binary is a [PE][] file
+* a section named `NODE_SEA_BLOB` in the `NODE_SEA` segment if the `node` binary
   is a [Mach-O][] file
-* a note named `NODE_JS_CODE` if the `node` binary is an [ELF][] file
+* a note named `NODE_SEA_BLOB` if the `node` binary is an [ELF][] file
 
 Search the binary for the
-`NODE_JS_FUSE_fce680ab2cc467b6e072b8b5df1996b2:0` [fuse][] string and flip the
+`NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2:0` [fuse][] string and flip the
 last character to `1` to indicate that a resource has been injected.
 
 ### Platform support
diff --git a/doc/contributing/maintaining-single-executable-application-support.md b/doc/contributing/maintaining-single-executable-application-support.md
index 51cafb5ae6fb4b..4f2bbdf6e6bc5b 100644
--- a/doc/contributing/maintaining-single-executable-application-support.md
+++ b/doc/contributing/maintaining-single-executable-application-support.md
@@ -66,7 +66,7 @@ To disable single executable application support, build Node.js with the
 ## Implementation
 
 When built with single executable application support, the Node.js process uses
-[`postject-api.h`][] to check if the `NODE_JS_CODE` section exists in the
+[`postject-api.h`][] to check if the `NODE_SEA_BLOB` section exists in the
 binary. If it is found, it passes the buffer to
 [`single_executable_application.js`][], which executes the contents of the
 embedded script.
diff --git a/node.gyp b/node.gyp
index 394fba572959fe..6dbe53d0bf3b91 100644
--- a/node.gyp
+++ b/node.gyp
@@ -82,6 +82,8 @@
       'src/js_stream.cc',
       'src/json_utils.cc',
       'src/js_udp_wrap.cc',
+      'src/json_parser.h',
+      'src/json_parser.cc',
       'src/module_wrap.cc',
       'src/node.cc',
       'src/node_api.cc',
diff --git a/src/json_parser.cc b/src/json_parser.cc
new file mode 100644
index 00000000000000..4778ea2960361a
--- /dev/null
+++ b/src/json_parser.cc
@@ -0,0 +1,80 @@
+#include "json_parser.h"
+#include "node_errors.h"
+#include "node_v8_platform-inl.h"
+#include "util-inl.h"
+
+namespace node {
+using v8::ArrayBuffer;
+using v8::Context;
+using v8::Isolate;
+using v8::Local;
+using v8::Object;
+using v8::String;
+using v8::Value;
+
+static Isolate* NewIsolate(v8::ArrayBuffer::Allocator* allocator) {
+  Isolate* isolate = Isolate::Allocate();
+  CHECK_NOT_NULL(isolate);
+  per_process::v8_platform.Platform()->RegisterIsolate(isolate,
+                                                       uv_default_loop());
+  Isolate::CreateParams params;
+  params.array_buffer_allocator = allocator;
+  Isolate::Initialize(isolate, params);
+  return isolate;
+}
+
+void JSONParser::FreeIsolate(Isolate* isolate) {
+  per_process::v8_platform.Platform()->UnregisterIsolate(isolate);
+  isolate->Dispose();
+}
+
+JSONParser::JSONParser()
+    : allocator_(ArrayBuffer::Allocator::NewDefaultAllocator()),
+      isolate_(NewIsolate(allocator_.get())),
+      handle_scope_(isolate_.get()),
+      context_(isolate_.get(), Context::New(isolate_.get())),
+      context_scope_(context_.Get(isolate_.get())) {}
+
+bool JSONParser::Parse(const std::string& content) {
+  DCHECK(!parsed_);
+
+  Isolate* isolate = isolate_.get();
+  Local<Context> context = context_.Get(isolate);
+
+  // It's not a real script, so don't print the source line.
+  errors::PrinterTryCatch bootstrapCatch(
+      isolate, errors::PrinterTryCatch::kDontPrintSourceLine);
+  Local<Value> json_string_value;
+  Local<Value> result_value;
+  if (!ToV8Value(context, content).ToLocal(&json_string_value) ||
+      !json_string_value->IsString() ||
+      !v8::JSON::Parse(context, json_string_value.As<String>())
+           .ToLocal(&result_value) ||
+      !result_value->IsObject()) {
+    return false;
+  }
+  content_.Reset(isolate, result_value.As<Object>());
+  parsed_ = true;
+  return true;
+}
+
+std::optional<std::string> JSONParser::GetTopLevelField(
+    const std::string& field) {
+  Isolate* isolate = isolate_.get();
+  Local<Context> context = context_.Get(isolate);
+  Local<Object> content_object = content_.Get(isolate);
+  Local<Value> value;
+  // It's not a real script, so don't print the source line.
+  errors::PrinterTryCatch bootstrapCatch(
+      isolate, errors::PrinterTryCatch::kDontPrintSourceLine);
+  if (!content_object
+           ->Get(context, OneByteString(isolate, field.c_str(), field.length()))
+           .ToLocal(&value) ||
+      !value->IsString()) {
+    return {};
+  }
+  Utf8Value utf8_value(isolate, value);
+  return utf8_value.ToString();
+}
+
+}  // namespace node
diff --git a/src/json_parser.h b/src/json_parser.h
new file mode 100644
index 00000000000000..41fe77929882c9
--- /dev/null
+++ b/src/json_parser.h
@@ -0,0 +1,39 @@
+#ifndef SRC_JSON_PARSER_H_
+#define SRC_JSON_PARSER_H_
+
+#if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#include <memory>
+#include <optional>
+#include <string>
+#include "util.h"
+#include "v8.h"
+
+namespace node {
+// This is intended to be used to get some top-level fields out of a JSON
+// without having to spin up a full Node.js environment that unnecessarily
+// complicates things.
+class JSONParser {
+ public:
+  JSONParser();
+  ~JSONParser() {}
+  bool Parse(const std::string& content);
+  std::optional<std::string> GetTopLevelField(const std::string& field);
+
+ private:
+  // We might want a lighter-weight JSON parser for this use case. But for now
+  // using V8 is good enough.
+  static void FreeIsolate(v8::Isolate* isolate);
+  std::unique_ptr<v8::ArrayBuffer::Allocator> allocator_;
+  DeleteFnPtr<v8::Isolate, FreeIsolate> isolate_;
+  v8::HandleScope handle_scope_;
+  v8::Global<v8::Context> context_;
+  v8::Context::Scope context_scope_;
+  v8::Global<v8::Object> content_;
+  bool parsed_ = false;
+};
+}  // namespace node
+
+#endif  // defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
+
+#endif  // SRC_JSON_PARSER_H_
diff --git a/src/node.cc b/src/node.cc
index 7ceeab375829b7..66b7ef5ec53557 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -1239,6 +1239,11 @@ static ExitCode StartInternal(int argc, char** argv) {
 
   uv_loop_configure(uv_default_loop(), UV_METRICS_IDLE_TIME);
 
+  std::string sea_config = per_process::cli_options->experimental_sea_config;
+  if (!sea_config.empty()) {
+    return sea::BuildSingleExecutableBlob(sea_config);
+  }
+
   // --build-snapshot indicates that we are in snapshot building mode.
   if (per_process::cli_options->per_isolate->build_snapshot) {
     if (result->args().size() < 2) {
diff --git a/src/node_errors.cc b/src/node_errors.cc
index bc6348bbb41f76..303586d90cf9f8 100644
--- a/src/node_errors.cc
+++ b/src/node_errors.cc
@@ -246,14 +246,19 @@ void PrintStackTrace(Isolate* isolate, Local<StackTrace> stack) {
 std::string FormatCaughtException(Isolate* isolate,
                                   Local<Context> context,
                                   Local<Value> err,
-                                  Local<Message> message) {
+                                  Local<Message> message,
+                                  bool add_source_line = true) {
+  std::string result;
   node::Utf8Value reason(isolate,
                          err->ToDetailString(context)
                              .FromMaybe(Local<String>()));
-  bool added_exception_line = false;
-  std::string source =
-      GetErrorSource(isolate, context, message, &added_exception_line);
-  std::string result = source + '\n' + reason.ToString() + '\n';
+  if (add_source_line) {
+    bool added_exception_line = false;
+    std::string source =
+        GetErrorSource(isolate, context, message, &added_exception_line);
+    result = source + '\n';
+  }
+  result += reason.ToString() + '\n';
 
   Local<v8::StackTrace> stack = message->GetStackTrace();
   if (!stack.IsEmpty()) result += FormatStackTrace(isolate, stack);
@@ -1209,6 +1214,19 @@ void TriggerUncaughtException(Isolate* isolate, const v8::TryCatch& try_catch) {
                            false /* from_promise */);
 }
 
+PrinterTryCatch::~PrinterTryCatch() {
+  if (!HasCaught()) {
+    return;
+  }
+  std::string str =
+      FormatCaughtException(isolate_,
+                            isolate_->GetCurrentContext(),
+                            Exception(),
+                            Message(),
+                            print_source_line_ == kPrintSourceLine);
+  PrintToStderrAndFlush(str);
+}
+
 }  // namespace errors
 
 }  // namespace node
diff --git a/src/node_errors.h b/src/node_errors.h
index 2bfb6128d9c984..4edb1c20b389ad 100644
--- a/src/node_errors.h
+++ b/src/node_errors.h
@@ -275,6 +275,22 @@ void PerIsolateMessageListener(v8::Local<v8::Message> message,
 
 void DecorateErrorStack(Environment* env,
                         const errors::TryCatchScope& try_catch);
+
+class PrinterTryCatch : public v8::TryCatch {
+ public:
+  enum PrintSourceLine { kPrintSourceLine, kDontPrintSourceLine };
+  explicit PrinterTryCatch(v8::Isolate* isolate,
+                           PrintSourceLine print_source_line)
+      : v8::TryCatch(isolate),
+        isolate_(isolate),
+        print_source_line_(print_source_line) {}
+  ~PrinterTryCatch();
+
+ private:
+  v8::Isolate* isolate_;
+  PrintSourceLine print_source_line_;
+};
+
 }  // namespace errors
 
 v8::ModifyCodeGenerationFromStringsResult ModifyCodeGenerationFromStrings(
diff --git a/src/node_options.cc b/src/node_options.cc
index 2a9d4deafa5dd9..477fae5347d99c 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -988,6 +988,11 @@ PerProcessOptionsParser::PerProcessOptionsParser(
             kAllowedInEnvvar);
   Implies("--node-memory-debug", "--debug-arraybuffer-allocations");
   Implies("--node-memory-debug", "--verify-base-objects");
+
+  AddOption("--experimental-sea-config",
+            "Generate a blob that can be embedded into the single executable "
+            "application",
+            &PerProcessOptions::experimental_sea_config);
 }
 
 inline std::string RemoveBrackets(const std::string& host) {
diff --git a/src/node_options.h b/src/node_options.h
index 543ff419db82df..846b42d8dac46f 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -264,6 +264,7 @@ class PerProcessOptions : public Options {
   bool print_help = false;
   bool print_v8_help = false;
   bool print_version = false;
+  std::string experimental_sea_config;
 
 #ifdef NODE_HAVE_I18N_SUPPORT
   std::string icu_data_dir;
diff --git a/src/node_sea.cc b/src/node_sea.cc
index 838ddcb0ff5528..64a6dffff9e319 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -1,6 +1,7 @@
 #include "node_sea.h"
 
 #include "env-inl.h"
+#include "json_parser.h"
 #include "node_external_reference.h"
 #include "node_internals.h"
 #include "node_union_bytes.h"
@@ -10,7 +11,7 @@
 // used by the postject_has_resource() function to efficiently detect if a
 // resource has been injected. See
 // https://github.com/nodejs/postject/blob/35343439cac8c488f2596d7c4c1dddfec1fddcae/postject-api.h#L42-L45.
-#define POSTJECT_SENTINEL_FUSE "NODE_JS_FUSE_fce680ab2cc467b6e072b8b5df1996b2"
+#define POSTJECT_SENTINEL_FUSE "NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2"
 #include "postject-api.h"
 #undef POSTJECT_SENTINEL_FUSE
 
@@ -21,15 +22,28 @@
 
 #if !defined(DISABLE_SINGLE_EXECUTABLE_APPLICATION)
 
+using node::ExitCode;
+using node::Utf8Value;
+using v8::ArrayBuffer;
 using v8::Context;
 using v8::FunctionCallbackInfo;
+using v8::Global;
+using v8::HandleScope;
+using v8::Isolate;
+using v8::Just;
 using v8::Local;
+using v8::Maybe;
+using v8::Nothing;
 using v8::Object;
+using v8::String;
+using v8::TryCatch;
 using v8::Value;
 
 namespace node {
 namespace sea {
 
+static const uint32_t kMagic = 0x143da20;
+
 std::string_view FindSingleExecutableCode() {
   CHECK(IsSingleExecutable());
   static const std::string_view sea_code = []() -> std::string_view {
@@ -37,14 +51,17 @@ std::string_view FindSingleExecutableCode() {
 #ifdef __APPLE__
     postject_options options;
     postject_options_init(&options);
-    options.macho_segment_name = "NODE_JS";
+    options.macho_segment_name = "NODE_SEA";
     const char* code = static_cast<const char*>(
-        postject_find_resource("NODE_JS_CODE", &size, &options));
+        postject_find_resource("NODE_SEA_BLOB", &size, &options));
 #else
     const char* code = static_cast<const char*>(
-        postject_find_resource("NODE_JS_CODE", &size, nullptr));
+        postject_find_resource("NODE_SEA_BLOB", &size, nullptr));
 #endif
-    return {code, size};
+    uint32_t first_word = reinterpret_cast<const uint32_t*>(code)[0];
+    CHECK_EQ(first_word, kMagic);
+    // TODO(joyeecheung): do more checks here e.g. matching the versions.
+    return {code + sizeof(first_word), size - sizeof(first_word)};
   }();
   return sea_code;
 }
@@ -73,6 +90,71 @@ std::tuple<int, char**> FixupArgsForSEA(int argc, char** argv) {
   return {argc, argv};
 }
 
+ExitCode BuildSingleExecutableBlob(const std::string& config_path) {
+  std::string config;
+  int r = ReadFileSync(&config, config_path.c_str());
+  if (r != 0) {
+    fprintf(stderr,
+            "Cannot read single executable configuration from %s\n",
+            config_path.c_str());
+    return ExitCode::kGenericUserError;
+  }
+
+  std::string main_path;
+  std::string output_path;
+  {
+    JSONParser parser;
+    if (!parser.Parse(config)) {
+      fprintf(stderr, "Cannot parse JSON from %s\n", config_path.c_str());
+      return ExitCode::kGenericUserError;
+    }
+
+    main_path = parser.GetTopLevelField("main").value_or(std::string());
+    if (main_path.empty()) {
+      fprintf(stderr,
+              "\"main\" field of %s is not a string\n",
+              config_path.c_str());
+      return ExitCode::kGenericUserError;
+    }
+
+    output_path = parser.GetTopLevelField("output").value_or(std::string());
+    if (output_path.empty()) {
+      fprintf(stderr,
+              "\"output\" field of %s is not a string\n",
+              config_path.c_str());
+      return ExitCode::kGenericUserError;
+    }
+  }
+
+  std::string main_script;
+  // TODO(joyeecheung): unify the file utils.
+  r = ReadFileSync(&main_script, main_path.c_str());
+  if (r != 0) {
+    fprintf(stderr, "Cannot read main script %s\n", main_path.c_str());
+    return ExitCode::kGenericUserError;
+  }
+
+  std::vector<char> sink;
+  // TODO(joyeecheung): reuse the SnapshotSerializerDeserializer for this.
+  sink.reserve(sizeof(kMagic) + main_script.size());
+  const char* pos = reinterpret_cast<const char*>(&kMagic);
+  sink.insert(sink.end(), pos, pos + sizeof(kMagic));
+  sink.insert(
+      sink.end(), main_script.data(), main_script.data() + main_script.size());
+
+  uv_buf_t buf = uv_buf_init(sink.data(), sink.size());
+  r = WriteFileSync(output_path.c_str(), buf);
+  if (r != 0) {
+    fprintf(stderr, "Cannot write output to %s\n", output_path.c_str());
+    return ExitCode::kGenericUserError;
+  }
+
+  fprintf(stderr,
+          "Wrote single executable preparation blob to %s\n",
+          output_path.c_str());
+  return ExitCode::kNoFailure;
+}
+
 void Initialize(Local<Object> target,
                 Local<Value> unused,
                 Local<Context> context,
diff --git a/src/node_sea.h b/src/node_sea.h
index aa0f20204743c0..b171595dd7ed61 100644
--- a/src/node_sea.h
+++ b/src/node_sea.h
@@ -7,6 +7,7 @@
 
 #include <string_view>
 #include <tuple>
+#include "node_exit_code.h"
 
 namespace node {
 namespace sea {
@@ -14,7 +15,7 @@ namespace sea {
 bool IsSingleExecutable();
 std::string_view FindSingleExecutableCode();
 std::tuple<int, char**> FixupArgsForSEA(int argc, char** argv);
-
+node::ExitCode BuildSingleExecutableBlob(const std::string& config_path);
 }  // namespace sea
 }  // namespace node
 
diff --git a/test/parallel/test-single-executable-application.js b/test/parallel/test-single-executable-application.js
index 9ceb61883e1664..823f02bbf4cdc9 100644
--- a/test/parallel/test-single-executable-application.js
+++ b/test/parallel/test-single-executable-application.js
@@ -5,10 +5,11 @@ const common = require('../common');
 
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
-const { copyFileSync, readFileSync, writeFileSync } = require('fs');
+const { copyFileSync, readFileSync, writeFileSync, existsSync } = require('fs');
 const { execFileSync } = require('child_process');
 const { join } = require('path');
 const { strictEqual } = require('assert');
+const assert = require('assert');
 
 if (!process.config.variables.single_executable_application)
   common.skip('Single Executable Application support has been disabled.');
@@ -51,6 +52,8 @@ if (process.platform === 'linux') {
 
 const inputFile = fixtures.path('sea.js');
 const requirableFile = join(tmpdir.path, 'requirable.js');
+const configFile = join(tmpdir.path, 'sea-config.json');
+const seaPrepBlob = join(tmpdir.path, 'sea-prep.blob');
 const outputFile = join(tmpdir.path, process.platform === 'win32' ? 'sea.exe' : 'sea');
 
 tmpdir.refresh();
@@ -61,15 +64,30 @@ module.exports = {
 };
 `);
 
+writeFileSync(configFile, `
+{
+  "main": "sea.js",
+  "output": "sea-prep.blob"
+}
+`);
+
+// Copy input to working directory
+copyFileSync(inputFile, join(tmpdir.path, 'sea.js'));
+execFileSync(process.execPath, ['--experimental-sea-config', 'sea-config.json'], {
+  cwd: tmpdir.path
+});
+
+assert(existsSync(seaPrepBlob));
+
 copyFileSync(process.execPath, outputFile);
 const postjectFile = fixtures.path('postject-copy', 'node_modules', 'postject', 'dist', 'cli.js');
 execFileSync(process.execPath, [
   postjectFile,
   outputFile,
-  'NODE_JS_CODE',
-  inputFile,
-  '--sentinel-fuse', 'NODE_JS_FUSE_fce680ab2cc467b6e072b8b5df1996b2',
-  ...process.platform === 'darwin' ? [ '--macho-segment-name', 'NODE_JS' ] : [],
+  'NODE_SEA_BLOB',
+  seaPrepBlob,
+  '--sentinel-fuse', 'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2',
+  ...process.platform === 'darwin' ? [ '--macho-segment-name', 'NODE_SEA' ] : [],
 ]);
 
 if (process.platform === 'darwin') {
diff --git a/test/parallel/test-single-executable-blob-config-errors.js b/test/parallel/test-single-executable-blob-config-errors.js
new file mode 100644
index 00000000000000..832383540187a6
--- /dev/null
+++ b/test/parallel/test-single-executable-blob-config-errors.js
@@ -0,0 +1,204 @@
+// This tests invalid options for --experimental-sea-config.
+
+'use strict';
+
+require('../common');
+const tmpdir = require('../common/tmpdir');
+const { writeFileSync, mkdirSync } = require('fs');
+const { spawnSync } = require('child_process');
+const assert = require('assert');
+const { join } = require('path');
+
+{
+  tmpdir.refresh();
+  const config = 'non-existent-relative.json';
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert.match(
+    stderr,
+    /Cannot read single executable configuration from non-existent-relative\.json/
+  );
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'non-existent-absolute.json');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert(
+    stderr.includes(
+      `Cannot read single executable configuration from ${config}`
+    )
+  );
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'invalid.json');
+  writeFileSync(config, '\n{\n"main"', 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert.match(stderr, /SyntaxError: Expected ':' after property name/);
+  assert(
+    stderr.includes(
+      `Cannot parse JSON from ${config}`
+    )
+  );
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'empty.json');
+  writeFileSync(config, '{}', 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert(
+    stderr.includes(
+      `"main" field of ${config} is not a string`
+    )
+  );
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'no-main.json');
+  writeFileSync(config, '{"output": "test.blob"}', 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert(
+    stderr.includes(
+      `"main" field of ${config} is not a string`
+    )
+  );
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'no-output.json');
+  writeFileSync(config, '{"main": "bundle.js"}', 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert(
+    stderr.includes(
+      `"output" field of ${config} is not a string`
+    )
+  );
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'nonexistent-main-relative.json');
+  writeFileSync(config, '{"main": "bundle.js", "output": "sea.blob"}', 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert.match(stderr, /Cannot read main script bundle\.js/);
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'nonexistent-main-absolute.json');
+  const main = join(tmpdir.path, 'bundle.js');
+  const configJson = JSON.stringify({
+    main,
+    output: 'sea.blob'
+  });
+  writeFileSync(config, configJson, 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert(
+    stderr.includes(
+      `Cannot read main script ${main}`
+    )
+  );
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'output-is-dir-absolute.json');
+  const main = join(tmpdir.path, 'bundle.js');
+  const output = join(tmpdir.path, 'output-dir');
+  mkdirSync(output);
+  writeFileSync(main, 'console.log("hello")', 'utf-8');
+  const configJson = JSON.stringify({
+    main,
+    output,
+  });
+  writeFileSync(config, configJson, 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert(
+    stderr.includes(
+      `Cannot write output to ${output}`
+    )
+  );
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'output-is-dir-relative.json');
+  const main = join(tmpdir.path, 'bundle.js');
+  const output = join(tmpdir.path, 'output-dir');
+  mkdirSync(output);
+  writeFileSync(main, 'console.log("hello")', 'utf-8');
+  const configJson = JSON.stringify({
+    main,
+    output: 'output-dir'
+  });
+  writeFileSync(config, configJson, 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+
+  const stderr = child.stderr.toString();
+  assert.strictEqual(child.status, 1);
+  assert.match(stderr, /Cannot write output to output-dir/);
+}
diff --git a/test/parallel/test-single-executable-blob-config.js b/test/parallel/test-single-executable-blob-config.js
new file mode 100644
index 00000000000000..919026e97aeae7
--- /dev/null
+++ b/test/parallel/test-single-executable-blob-config.js
@@ -0,0 +1,50 @@
+// This tests valid options for --experimental-sea-config.
+'use strict';
+
+require('../common');
+const tmpdir = require('../common/tmpdir');
+const { writeFileSync, existsSync } = require('fs');
+const { spawnSync } = require('child_process');
+const assert = require('assert');
+const { join } = require('path');
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'absolute.json');
+  const main = join(tmpdir.path, 'bundle.js');
+  const output = join(tmpdir.path, 'output.blob');
+  writeFileSync(main, 'console.log("hello")', 'utf-8');
+  const configJson = JSON.stringify({
+    main,
+    output,
+  });
+  writeFileSync(config, configJson, 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+  assert.strictEqual(child.status, 0);
+  assert(existsSync(output));
+}
+
+{
+  tmpdir.refresh();
+  const config = join(tmpdir.path, 'relative.json');
+  const main = join(tmpdir.path, 'bundle.js');
+  const output = join(tmpdir.path, 'output.blob');
+  writeFileSync(main, 'console.log("hello")', 'utf-8');
+  const configJson = JSON.stringify({
+    main: 'bundle.js',
+    output: 'output.blob'
+  });
+  writeFileSync(config, configJson, 'utf8');
+  const child = spawnSync(
+    process.execPath,
+    ['--experimental-sea-config', config], {
+      cwd: tmpdir.path,
+    });
+
+  assert.strictEqual(child.status, 0);
+  assert(existsSync(output));
+}