fix: npm run build fails on Windows since 0.12.3 (#32735)

Since 0.12.3 every frontend build first verifies the prebuilt encryption module, and on Windows that check failed before the build started, because it mishandled Windows paths and Git's default Windows line endings changed the source files it hashes. The check now gives the same result on Windows, Linux and macOS, including in existing Windows clones, so npm run build works on Windows again. The stored source fingerprint changes because the check script is one of the files it covers. Past the check, the build ran out of memory under Node's default limit, so it now runs with a 12 GB limit, the same value the Docker CI build uses.

Fixes #32656

package.json

@@ -10,7 +10,7 @@
 		"prebuild:watch": "npm run crypto:verify",
 		"dev": "npm run pyodide:fetch && vite dev --host",
 		"dev:5050": "npm run pyodide:fetch && vite dev --port 5050",
-		"build": "npm run pyodide:fetch && vite build",
+		"build": "npm run pyodide:fetch && node --max-old-space-size=12288 node_modules/vite/bin/vite.js build",
 		"build:watch": "npm run pyodide:fetch && vite build --watch",
 		"preview": "vite preview",
 		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",

scripts/encryption/artifact.mjs

@@ -1,8 +1,9 @@
 // Normal builds only read committed files. No Rust or network required.
 import { createHash } from 'node:crypto';
 import { readFileSync, readdirSync, writeFileSync } from 'node:fs';
-import { join, relative } from 'node:path';
-const root = new URL('../../', import.meta.url).pathname;
+import { join, posix } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const root = fileURLToPath(new URL('../../', import.meta.url));
 const source = 'crypto/encryption';
 const artifact = 'src/lib/encryption/vendor';
 const hash = (data) => createHash('sha256').update(data).digest('hex');
@@ -10,7 +11,7 @@ function files(dir) {
 	return readdirSync(join(root, dir), { withFileTypes: true })
 		.flatMap((e) => {
 			if (e.name === 'target' || e.name.startsWith('.')) return [];
-			const path = join(dir, e.name);
+			const path = posix.join(dir, e.name);
 			return e.isDirectory() ? files(path) : [path];
 		})
 		.sort();
@@ -21,7 +22,9 @@ const inputs = [
 	'scripts/encryption/artifact.mjs'
 ].sort();
 const sourceFingerprint = hash(
-	inputs.map((p) => `${p}\0${hash(readFileSync(join(root, p)))}`).join('\n')
+	inputs
+		.map((p) => `${p}\0${hash(readFileSync(join(root, p), 'utf8').replaceAll('\r\n', '\n'))}`)
+		.join('\n')
 );
 const manifestPath = join(root, artifact, 'manifest.json');
 if (process.argv.includes('--write')) {
@@ -31,7 +34,7 @@ if (process.argv.includes('--write')) {
 	const checksums = Object.fromEntries(
 		files(artifact)
 			.filter((p) => !p.endsWith('/manifest.json'))
-			.map((p) => [relative(artifact, p), hash(readFileSync(join(root, p)))])
+			.map((p) => [posix.relative(artifact, p), hash(readFileSync(join(root, p)))])
 	);
 	writeFileSync(
 		manifestPath,
@@ -59,7 +62,7 @@ if (process.argv.includes('--write')) {
 		throw Error('Encryption source changed: rebuild and review the artifact.');
 	const actual = files(artifact)
 		.filter((p) => !p.endsWith('/manifest.json'))
-		.map((p) => relative(artifact, p))
+		.map((p) => posix.relative(artifact, p))
 		.sort();
 	if (JSON.stringify(actual) !== JSON.stringify(Object.keys(manifest.checksums).sort()))
 		throw Error('Unexpected crypto artifact files');

src/lib/encryption/vendor/manifest.json

@@ -1,6 +1,6 @@
 {
   "format": 1,
-  "sourceFingerprint": "60cb75c89a0fb81f3cbe6722422f5ca3f39de3bf157d0bc62e53b36488da99d7",
+  "sourceFingerprint": "35f3a2fef83c5a91672abc5338064324eff04bc27efee93a49c8d0a7fcd8334a",
   "sourceRevision": "613eac51c5c9cc67065998282af16e8016d5a2cb",
   "toolchain": "1.95.0",
   "wasmBindgen": "0.2.126",