Publish prebuilt Windows binaries so consumers don't need the MSVC Spectre-mitigated libs

Summary

Installing @vscode/deviceid on Windows compiles the native addon from source, which requires the MSVC v143 – VS 2022 C++ x64/x86 Spectre-mitigated libs component. Consumers without that component installed hit:

error MSB8040: Spectre-mitigated libraries are required for this project.
Install them from the Visual Studio installer (Individual components tab)
for any toolsets and architectures being used.

This was previously reported in #19, which was closed after the reporter installed the VS component locally. That resolved it for that one machine, but the underlying cause is unchanged and it continues to affect consumers.

Root cause

The published tarball contains binding.gyp and src/windows.cc but no compiled binary. The CI npm run build step is only tsc, so nothing builds the addon before npm pack.

Because the tarball has a binding.gyp and package.json defines no install/preinstall script, npm falls back to its default behavior and runs node-gyp rebuild on every consumer's machine. That invokes MSVC, and binding.gyp sets:

"msvs_configuration_attributes": {
  "SpectreMitigation": "Spectre"
}

which passes /Qspectre and requires the Spectre-mitigated CRT libs (not installed by default with the C++ workload).

Proposal

Ship prebuilt binaries so consumers never invoke MSVC. The Spectre requirement then applies only to the CI build agent, where it belongs — the mitigation is retained, not weakened.

Two factors make this straightforward here:

• Only Windows needs a binary. The macOS/Linux/FreeBSD paths in src/storage.ts are pure JS (fs), no native code.
• The addon is Node-API (napi_* / NAPI_MODULE), which is ABI-stable across Node versions — so one binary per architecture covers all Node versions, rather than one per Node ABI.

Concretely, using prebuildify + node-gyp-build:

1. Add "install": "node-gyp-build" — this suppresses npm's default auto-rebuild and resolves a prebuilt binary, falling back to a source build only if no prebuild matches.
2. Replace the hardcoded loader in src/storage.ts:

   require("../build/Release/windows.node")
   

   with require("node-gyp-build")(packageRoot).
3. Run prebuildify --napi --strip in the Windows CI job for x64 and arm64 before npm pack, so prebuilds/ ships in the tarball.

Note that both steps are required: shipping a binary alone is not sufficient, because npm will still auto-run node-gyp rebuild as long as binding.gyp is present and no install script is defined.

Impact

• Consumers stop needing the Spectre-mitigated libs (and Python/MSVC toolchain) to install the package.
• Install becomes faster and more reliable
• Source-build fallback is preserved for unsupported architectures.

Happy to put up a PR for this if the approach looks reasonable.

Start with package.json, src/storage.ts, binding.gyp, and the Windows CI job; review how the current build and native addon loading work. Check the prebuildify and node-gyp-build integration for x64 and arm64. Done means the packed tarball includes the prebuilt binaries, installation does not invoke MSVC on supported Windows systems, and source-build fallback remains available.