refactor(build): replace rollup with esbuild for SEA bootstrap

- Replace rollup.cli-sea.config.mjs with esbuild.sea-bootstrap.build.mjs
- Remove all rollup dependencies and plugins from package.json
- Update build:sea:internal:bootstrap script to use esbuild
- Update test to reference new esbuild config
- Update comments to reference esbuild define instead of rollup replace
- External nanotar module (vendored at runtime)

Author: jdalton

package.json

@@ -26,12 +26,6 @@
     "@pnpm/lockfile.detect-dep-types": "1001.0.13",
     "@pnpm/lockfile.fs": "1001.1.17",
     "@pnpm/logger": "1001.0.0",
-    "@rollup/plugin-babel": "6.0.4",
-    "@rollup/plugin-commonjs": "28.0.6",
-    "@rollup/plugin-json": "6.1.0",
-    "@rollup/plugin-node-resolve": "16.0.1",
-    "@rollup/plugin-replace": "6.0.2",
-    "@rollup/pluginutils": "5.3.0",
     "@socketregistry/hyrious__bun.lockb": "1.0.19",
     "@socketregistry/indent-string": "1.0.14",
     "@socketregistry/is-interactive": "1.0.6",
@@ -92,8 +86,6 @@
     "react-reconciler": "0.33.0",
     "registry-auth-token": "5.1.0",
     "registry-url": "7.2.0",
-    "rollup": "4.50.1",
-    "rollup-plugin-visualizer": "^6.0.5",
     "semver": "7.7.2",
     "ssri": "12.0.0",
     "synp": "1.9.14",
@@ -124,7 +116,6 @@
     "overrides": {
       "@octokit/graphql": "9.0.1",
       "@octokit/request-error": "7.0.0",
-      "@rollup/plugin-commonjs": "28.0.6",
       "aggregate-error": "npm:@socketregistry/aggregate-error@^1.0.15",
       "ansi-regex": "6.1.0",
       "brace-expansion": "2.0.2",
@@ -148,7 +139,6 @@
       "npm-package-arg": "13.0.0",
       "packageurl-js": "npm:@socketregistry/packageurl-js@^1.3.0",
       "path-parse": "npm:@socketregistry/path-parse@^1.0.8",
-      "rollup": "4.52.5",
       "safe-buffer": "npm:@socketregistry/safe-buffer@^1.0.9",
       "safer-buffer": "npm:@socketregistry/safer-buffer@^1.0.10",
       "semver": "7.7.2",
@@ -166,7 +156,6 @@
       "yargs-parser": "21.1.1"
     },
     "patchedDependencies": {
-      "@rollup/plugin-commonjs@28.0.6": "patches/@rollup__plugin-commonjs@28.0.6.patch",
       "brace-expansion@2.0.2": "patches/brace-expansion@2.0.2.patch",
       "graceful-fs@4.2.11": "patches/graceful-fs@4.2.11.patch",
       "lodash@4.17.21": "patches/lodash@4.17.21.patch",

packages/cli/.config/esbuild.sea-bootstrap.build.mjs

@@ -0,0 +1,64 @@
+/**
+ * esbuild configuration for building SEA bootstrap thin wrapper.
+ * Compiles TypeScript bootstrap to CommonJS for Node.js SEA compatibility.
+ */
+
+import { build } from 'esbuild'
+import { existsSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { getLocalPackageAliases } from '../scripts/utils/get-local-package-aliases.mjs'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootDir = path.join(__dirname, '..')
+
+const inputFile = process.env['SEA_BOOTSTRAP'] || path.join(rootDir, 'src/stub/bootstrap.mts')
+const outputFile = process.env['SEA_OUTPUT'] || path.join(rootDir, 'dist/sea/bootstrap.cjs')
+
+const isWatch = process.argv.includes('--watch')
+
+// Get local package aliases for development.
+const aliases = getLocalPackageAliases(rootDir)
+
+// Create alias mapping for esbuild.
+const aliasEntries = {}
+for (const [pkg, distPath] of Object.entries(aliases)) {
+  // For each package, create an alias that points to the dist folder.
+  aliasEntries[pkg] = distPath
+}
+
+const config = {
+  entryPoints: [inputFile],
+  outfile: outputFile,
+  bundle: true,
+  format: 'cjs',
+  platform: 'node',
+  target: 'node18',
+  sourcemap: false,
+  minify: false,
+  // Only externalize Node.js built-ins and nanotar (vendored at runtime).
+  external: ['node:*', 'nanotar'],
+  alias: aliasEntries,
+  logLevel: 'info',
+  banner: {
+    js: `// SEA Bootstrap - esbuild generated\n`,
+  },
+}
+
+try {
+  if (isWatch) {
+    const context = await build({
+      ...config,
+      logLevel: 'info',
+    })
+    await context.watch()
+    console.log('Watching for changes...')
+  } else {
+    await build(config)
+    console.log(`✓ SEA bootstrap built: ${outputFile}`)
+  }
+} catch (error) {
+  console.error('Build failed:', error)
+  process.exit(1)
+}

packages/cli/.config/rollup.cli-sea.config.mjs

@@ -32,7 +32,7 @@
   },
   "scripts": {
     "build": "node --import=./scripts/load.mjs scripts/build.mjs",
-    "build:sea:internal:bootstrap": "rollup -c .config/rollup.cli-sea.config.mjs",
+    "build:sea:internal:bootstrap": "node .config/esbuild.sea-bootstrap.build.mjs",
     "build:js": "node scripts/extract-yoga-wasm.mjs && node .config/esbuild.cli.build.mjs",
     "build:watch": "node scripts/extract-yoga-wasm.mjs && node .config/esbuild.cli.build.mjs --watch",
     "dev": "pnpm run build:watch",

packages/cli/package.json

@@ -74,7 +74,7 @@ export {
 }
 
 // Getter functions for build metadata.
-// Use direct process.env access (not env imports) so rollup replace plugin can inline values.
+// Use direct process.env access (not env imports) so esbuild define can inline values.
 export function getCliVersion(): string | undefined {
   return process.env['INLINED_SOCKET_CLI_VERSION']
 }
@@ -164,7 +164,7 @@ const ENV = {
   CI: env['CI'],
   GITHUB_REPOSITORY: env['GITHUB_REPOSITORY'],
   SOCKET_CLI_ORG_SLUG: env['SOCKET_CLI_ORG_SLUG'],
-  // Build metadata (inlined by rollup replace plugin).
+  // Build metadata (inlined by esbuild define).
   INLINED_SOCKET_CLI_CDXGEN_VERSION:
     process.env['INLINED_SOCKET_CLI_CDXGEN_VERSION'],
   INLINED_SOCKET_CLI_COANA_TECH_CLI_VERSION:

packages/cli/src/constants/env.mts

@@ -12,7 +12,7 @@ describe('SEA build validation', () => {
     const bootstrapPath = path.join(
       process.cwd(),
       'src',
-      'sea',
+      'stub',
       'bootstrap.mts',
     )
     expect(existsSync(bootstrapPath)).toBe(true)
@@ -22,7 +22,7 @@ describe('SEA build validation', () => {
     const configPath = path.join(
       process.cwd(),
       '.config',
-      'rollup.cli-sea.config.mjs',
+      'esbuild.sea-bootstrap.build.mjs',
     )
     expect(existsSync(configPath)).toBe(true)
   })