feat(bootstrap): create shared bootstrap package for npm and smol builds

Create new @socketsecurity/bootstrap package with shared utilities:

Structure:
- src/bootstrap-npm.mts - npm wrapper bootstrap entry point
- src/bootstrap-smol.mts - smol binary bootstrap entry point
- src/shared/bootstrap-shared.mjs - shared download and execution logic

Build outputs:
- dist/bootstrap-npm.js - Standard Node.js with node:* requires
- dist/bootstrap-smol.js - Transformed for smol with internal/* requires

Features:
- downloadCli() - Downloads @socketsecurity/cli to ~/.socket/_dlx/
- executeCli() - Executes CLI with proper environment setup
- executeCompressedCli() - Handles brotli-compressed CLI execution
- findAndExecuteCli() - Main orchestration logic

Build system:
- esbuild configs for npm and smol variants
- smol transform plugin converts node:* to internal/* requires
- Both outputs ~1080 KB each

Dependencies added to catalog:
- semver: 7.6.3 (for version comparison)
- del-cli: 6.0.0 (for cleaning build artifacts)
- esbuild: 0.24.0 (for building bundles)

Cleanup:
- Removed old bootstrap files from packages/socket/src/
- Bootstrap logic now centralized in shared package

Author: jdalton

packages/bootstrap/.config/esbuild-plugin-smol-transform.mjs

@@ -0,0 +1,126 @@
+/**
+ * esbuild plugin to transform node:* requires to internal/* requires.
+ *
+ * This makes the bootstrap compatible with Node.js internal bootstrap context
+ * for smol builds.
+ */
+
+/**
+ * Create smol transformation plugin.
+ * @returns {import('esbuild').Plugin}
+ */
+export function smolTransformPlugin() {
+  return {
+    name: 'smol-transform',
+    setup(build) {
+      build.onEnd((result) => {
+        // Get the output files.
+        const outputs = result.outputFiles
+        if (!outputs || outputs.length === 0) {
+          return
+        }
+
+        // Transform each output file.
+        for (const output of outputs) {
+          let content = output.text
+
+          // Map core module requires to their internal bootstrap equivalents.
+          // Based on Module.builtinModules from Node.js v24.10.0.
+          // Format: [moduleName, bootstrapPath]
+          // Handles both 'node:x' and plain 'x' variants (except prefix-only modules).
+          const requireMappings = new Map([
+            // Core modules with internal equivalents.
+            ['child_process', 'internal/child_process'],
+            ['fs', 'fs'],
+            ['fs/promises', 'internal/fs/promises'],
+
+            // Stream internals.
+            ['stream', 'stream'],
+            ['stream/promises', 'internal/streams/promises'],
+            ['stream/web', 'internal/webstreams/readablestream'],
+
+            // Path variants.
+            ['path', 'path'],
+            ['path/posix', 'path'],
+            ['path/win32', 'path'],
+
+            // Core modules available at top level.
+            ['assert', 'assert'],
+            ['assert/strict', 'internal/assert/strict'],
+            ['async_hooks', 'async_hooks'],
+            ['buffer', 'buffer'],
+            ['cluster', 'cluster'],
+            ['console', 'console'],
+            ['constants', 'constants'],
+            ['crypto', 'crypto'],
+            ['dgram', 'dgram'],
+            ['diagnostics_channel', 'diagnostics_channel'],
+            ['dns', 'dns'],
+            ['dns/promises', 'dns/promises'],
+            ['domain', 'domain'],
+            ['events', 'events'],
+            ['http', 'http'],
+            ['http2', 'http2'],
+            ['https', 'https'],
+            ['inspector', 'inspector'],
+            ['inspector/promises', 'inspector/promises'],
+            ['module', 'module'],
+            ['net', 'net'],
+            ['os', 'os'],
+            ['perf_hooks', 'perf_hooks'],
+            ['process', 'process'],
+            ['punycode', 'punycode'],
+            ['querystring', 'querystring'],
+            ['readline', 'readline'],
+            ['readline/promises', 'readline/promises'],
+            ['repl', 'repl'],
+            ['string_decoder', 'string_decoder'],
+            ['sys', 'sys'],
+            ['timers', 'timers'],
+            ['timers/promises', 'timers/promises'],
+            ['tls', 'tls'],
+            ['trace_events', 'trace_events'],
+            ['tty', 'tty'],
+            ['url', 'url'],
+            ['util', 'util'],
+            ['util/types', 'internal/util/types'],
+            ['v8', 'v8'],
+            ['vm', 'vm'],
+            ['wasi', 'wasi'],
+            ['worker_threads', 'worker_threads'],
+            ['zlib', 'zlib'],
+          ])
+
+          // Prefix-only modules that have no unprefixed form.
+          // These ONLY support node:* syntax.
+          const prefixOnlyModules = new Set([
+            'node:sea',
+            'node:sqlite',
+            'node:test',
+            'node:test/reporters',
+          ])
+
+          // Replace require("node:X") and require("X") with correct bootstrap path.
+          for (const [moduleName, bootstrapPath] of requireMappings) {
+            // Handle node:x variant.
+            content = content.replace(
+              new RegExp(`require\\(["']node:${moduleName}["']\\)`, 'g'),
+              `require("${bootstrapPath}")`,
+            )
+            // Handle plain x variant (if different from bootstrap path).
+            // Skip if this is a prefix-only module.
+            if (moduleName !== bootstrapPath && !prefixOnlyModules.has(`node:${moduleName}`)) {
+              content = content.replace(
+                new RegExp(`require\\(["']${moduleName}["']\\)`, 'g'),
+                `require("${bootstrapPath}")`,
+              )
+            }
+          }
+
+          // Update the output content.
+          output.contents = Buffer.from(content, 'utf8')
+        }
+      })
+    },
+  }
+}

packages/bootstrap/.config/esbuild.npm.config.mjs

@@ -0,0 +1,37 @@
+/**
+ * esbuild configuration for npm bootstrap.
+ * Standard Node.js modules (node:* requires).
+ */
+
+import { build } from 'esbuild'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.resolve(__dirname, '..')
+
+const config = {
+  banner: {
+    js: '#!/usr/bin/env node',
+  },
+  bundle: true,
+  entryPoints: [path.join(rootPath, 'src', 'bootstrap-npm.mts')],
+  external: [],
+  format: 'cjs',
+  metafile: true,
+  minify: true,
+  outfile: path.join(rootPath, 'dist', 'bootstrap-npm.js'),
+  platform: 'node',
+  target: 'node18',
+  treeShaking: true,
+}
+
+// Run build if invoked directly.
+if (fileURLToPath(import.meta.url) === process.argv[1]) {
+  build(config).catch(error => {
+    console.error('npm bootstrap build failed:', error)
+    process.exitCode = 1
+  })
+}
+
+export default config

packages/bootstrap/.config/esbuild.smol.config.mjs

@@ -0,0 +1,41 @@
+/**
+ * esbuild configuration for smol bootstrap.
+ * Transforms node:* requires to internal/* for Node.js internal bootstrap context.
+ */
+
+import { build } from 'esbuild'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { smolTransformPlugin } from './esbuild-plugin-smol-transform.mjs'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.resolve(__dirname, '..')
+
+const config = {
+  banner: {
+    js: '#!/usr/bin/env node',
+  },
+  bundle: true,
+  entryPoints: [path.join(rootPath, 'src', 'bootstrap-smol.mts')],
+  external: [],
+  format: 'cjs',
+  metafile: true,
+  minify: true,
+  outfile: path.join(rootPath, 'dist', 'bootstrap-smol.js'),
+  platform: 'node',
+  plugins: [smolTransformPlugin()],
+  target: 'node24',
+  treeShaking: true,
+  write: false, // Plugin needs to transform output.
+}
+
+// Run build if invoked directly.
+if (fileURLToPath(import.meta.url) === process.argv[1]) {
+  build(config).catch(error => {
+    console.error('smol bootstrap build failed:', error)
+    process.exitCode = 1
+  })
+}
+
+export default config

packages/bootstrap/dist/bootstrap-npm.js

@@ -0,0 +1,21 @@
+{
+  "name": "@socketsecurity/bootstrap",
+  "version": "1.0.0",
+  "description": "Shared bootstrap for Socket CLI npm wrapper and smol binary",
+  "private": true,
+  "type": "module",
+  "exports": {
+    "./bootstrap-npm.js": "./dist/bootstrap-npm.js",
+    "./bootstrap-smol.js": "./dist/bootstrap-smol.js"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "clean": "del-cli dist"
+  },
+  "devDependencies": {
+    "@socketsecurity/lib": "catalog:",
+    "del-cli": "catalog:",
+    "esbuild": "catalog:",
+    "semver": "catalog:"
+  }
+}

packages/bootstrap/dist/bootstrap-smol.js

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+/**
+ * Build script for Socket bootstrap package.
+ *
+ * Builds two versions:
+ * 1. bootstrap-npm.js - Standard version for npm wrapper
+ * 2. bootstrap-smol.js - Transformed version for smol binary
+ */
+
+import { mkdirSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { build } from 'esbuild'
+
+import npmConfig from '../.config/esbuild.npm.config.mjs'
+import smolConfig from '../.config/esbuild.smol.config.mjs'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const packageRoot = path.resolve(__dirname, '..')
+
+console.log('Building Socket bootstrap with esbuild...\\n')
+
+try {
+  // Create dist directory.
+  mkdirSync(path.join(packageRoot, 'dist'), { recursive: true })
+
+  // Build npm version.
+  console.log('→ Building npm bootstrap...')
+  const npmResult = await build(npmConfig)
+
+  console.log(`✓ ${npmConfig.outfile}`)
+
+  if (npmResult.metafile) {
+    const outputSize = Object.values(npmResult.metafile.outputs)[0]?.bytes
+    if (outputSize) {
+      console.log(`  Size: ${(outputSize / 1024).toFixed(2)} KB`)
+    }
+  }
+
+  // Build smol version.
+  console.log('\\n→ Building smol bootstrap...')
+  const smolResult = await build(smolConfig)
+
+  // Write the transformed output (build had write: false).
+  if (smolResult.outputFiles && smolResult.outputFiles.length > 0) {
+    for (const output of smolResult.outputFiles) {
+      writeFileSync(output.path, output.contents)
+    }
+  }
+
+  console.log(`✓ ${smolConfig.outfile}`)
+
+  if (smolResult.metafile) {
+    const outputSize = Object.values(smolResult.metafile.outputs)[0]?.bytes
+    if (outputSize) {
+      console.log(`  Size: ${(outputSize / 1024).toFixed(2)} KB`)
+    }
+  }
+
+  console.log('\\n✓ Build completed successfully')
+} catch (error) {
+  console.error('\\n✗ Build failed:', error)
+  process.exit(1)
+}

packages/bootstrap/package.json

@@ -0,0 +1,19 @@
+/**
+ * Bootstrap for Socket CLI npm wrapper.
+ *
+ * This runs when users execute `npx socket` or `npm install -g socket`.
+ * It downloads @socketsecurity/cli from npm and executes it.
+ */
+
+import { findAndExecuteCli, getArgs } from './shared/bootstrap-shared.mjs'
+
+async function main() {
+  const args = getArgs()
+  await findAndExecuteCli(args)
+}
+
+// Run the bootstrap.
+main().catch((e) => {
+  process.stderr.write(`❌ Bootstrap error: ${e instanceof Error ? e.message : String(e)}\n`)
+  process.exit(1)
+})

packages/bootstrap/scripts/build.mjs

@@ -0,0 +1,21 @@
+/**
+ * Bootstrap for Socket CLI smol binary.
+ *
+ * This runs inside the smol Node.js binary via internal bootstrap.
+ * Uses Node.js internal/* requires (transformed by esbuild plugin).
+ *
+ * The smol binary loads this at startup via lib/internal/process/pre_execution.js.
+ */
+
+import { findAndExecuteCli, getArgs } from './shared/bootstrap-shared.mjs'
+
+async function main() {
+  const args = getArgs()
+  await findAndExecuteCli(args)
+}
+
+// Run the bootstrap.
+main().catch((e) => {
+  process.stderr.write(`❌ Bootstrap error: ${e instanceof Error ? e.message : String(e)}\n`)
+  process.exit(1)
+})