feat(cli): add custom ONNX Runtime build package following yoga pattern

Creates packages/onnxruntime with:
- Build script to compile ONNX Runtime from source with Emscripten
- WASM_ASYNC_COMPILATION=0 flag for synchronous instantiation
- Graceful placeholder generation when WASM not built
- Same pattern as yoga-layout for consistency

Updates extract-onnx-runtime.mjs to:
- Read from custom onnxruntime package build output
- Embed WASM as base64 like yoga-sync.mjs
- Generate synchronous onnx-sync.mjs with embedded WASM
- Fall back to placeholder if WASM not available

This enables truly synchronous ONNX Runtime loading with embedded
WASM binary, eliminating async fetch and matching yoga-layout approach.

Cleanup: Remove outdated docs from builder packages.

Author: jdalton

packages/cli/scripts/extract-onnx-runtime.mjs

@@ -1,12 +1,12 @@
 /**
- * Extract onnxruntime-web and create onnx-sync.mjs
- * This runs during build to create a wrapper around onnxruntime-web
- * for use in the MiniLM semantic inference engine.
+ * Extract ONNX Runtime WASM and create onnx-sync.mjs
+ * This runs during build to extract the ONNX Runtime WASM binary from
+ * our custom build and generate a synchronous loader wrapper.
  *
  * Idempotent: Skips regeneration if source hasn't changed (supports CI caching).
  */
 
-import { writeFileSync } from 'node:fs'
+import { existsSync, readFileSync, writeFileSync } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -21,43 +21,108 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const rootPath = path.join(__dirname, '..')
 const outputPath = path.join(rootPath, 'build/onnx-sync.mjs')
 
-// Get onnxruntime-web package.json path for version tracking.
-const onnxPackageJsonPath = path.join(
-  rootPath,
-  'node_modules/onnxruntime-web/package.json',
-)
+// Source files from custom onnxruntime package.
+const onnxPackageRoot = path.join(rootPath, '../onnxruntime')
+const onnxWasmFile = path.join(onnxPackageRoot, 'build/wasm/ort-wasm-simd-threaded.wasm')
+const onnxJsFile = path.join(onnxPackageRoot, 'build/wasm/ort-wasm-simd-threaded.js')
 
-// Check if extraction needed (hash-based caching).
+// Check if extraction needed (hash both files).
 if (
   !(await shouldExtract({
-    sourcePaths: onnxPackageJsonPath,
+    sourcePaths: [onnxWasmFile, onnxJsFile],
     outputPath,
     validateOutput: content =>
-      content.includes('onnxruntime-web') &&
-      content.includes('InferenceSession'),
+      content.includes('onnxruntime') &&
+      content.includes('InferenceSession') &&
+      content.includes('WebAssembly'),
   }))
 ) {
   process.exit(0)
 }
 
+// Check if ONNX Runtime WASM files exist.
+if (!existsSync(onnxWasmFile) || !existsSync(onnxJsFile)) {
+  // Graceful fallback: Generate placeholder for CI builds without WASM.
+  logger.warn('ONNX Runtime WASM not built yet, generating placeholder')
+
+  const placeholderContent = `/**
+ * Synchronous ONNX Runtime with embedded WASM binary (Placeholder).
+ *
+ * This file is AUTO-GENERATED by scripts/extract-onnx-runtime.mjs
+ * DO NOT EDIT MANUALLY - changes will be overwritten on next build.
+ *
+ * NOTE: This is a placeholder build. Run 'pnpm build' in ../onnxruntime first.
+ */
+
+// Placeholder ONNX Runtime export with minimal API.
+const ort = {
+  InferenceSession: {
+    create() {
+      throw new Error('ONNX Runtime not built - run pnpm build in packages/onnxruntime')
+    }
+  },
+  Tensor: class Tensor {}
+}
+
+export const InferenceSession = ort.InferenceSession
+export const Tensor = ort.Tensor
+
+export default ort
+`
+
+  ensureOutputDir(outputPath)
+  writeFileSync(outputPath, placeholderContent, 'utf-8')
+  logger.log(`✓ Generated placeholder ${outputPath}`)
+  process.exit(0)
+}
+
+// Read WASM binary and convert to base64.
+const wasmBinary = readFileSync(onnxWasmFile)
+const base64Data = wasmBinary.toString('base64')
+
+// Read our custom Emscripten loader (generated by our build).
+const onnxJsContent = readFileSync(onnxJsFile, 'utf-8')
+
 // Compute source hash for cache validation.
-const sourceHashComment = await generateHashComment(onnxPackageJsonPath)
+const sourceHashComment = await generateHashComment([onnxWasmFile, onnxJsFile])
 
-// Generate onnx-sync.mjs as a simple re-export of onnxruntime-web.
+logger.log(
+  `✓ Extracted ${wasmBinary.length} bytes of WASM data from custom onnxruntime`,
+)
+
+// Generate onnx-sync.mjs using OUR custom loader with OUR custom WASM.
 const onnxSyncContent = `/**
- * ONNX Runtime wrapper for MiniLM inference.
+ * Synchronous ONNX Runtime with embedded WASM binary.
  *
  * This file is AUTO-GENERATED by scripts/extract-onnx-runtime.mjs
  * DO NOT EDIT MANUALLY - changes will be overwritten on next build.
  *
- * Re-exports onnxruntime-web for use in MiniLM embedding pipeline.
+ * Uses custom-built ONNX Runtime with Emscripten loader.
+ * Built with WASM_ASYNC_COMPILATION=0 for synchronous instantiation.
  *
  * ${sourceHashComment}
  */
 
-import ort from 'onnxruntime-web'
-import { logger } from '@socketsecurity/lib/logger'
-import colors from 'yoctocolors-cjs'
+// Inlined base64 WASM from custom onnxruntime (extracted at build time).
+const base64Wasm = '${base64Data}'
+
+// Decode base64 to Uint8Array.
+const wasmBinary = Uint8Array.from(atob(base64Wasm), c => c.charCodeAt(0))
+
+// Inlined Emscripten loader from custom onnxruntime build.
+${onnxJsContent}
+
+// Synchronously initialize ONNX Runtime with embedded WASM.
+const ort = ortWasmThreaded({
+  wasmBinary,
+  instantiateWasm(imports, successCallback) {
+    // Synchronously instantiate WASM module.
+    const module = new WebAssembly.Module(wasmBinary)
+    const instance = new WebAssembly.Instance(module, imports)
+    successCallback(instance, module)
+    return instance.exports
+  }
+})
 
 export const InferenceSession = ort.InferenceSession
 export const Tensor = ort.Tensor

packages/minilm-builder/docs/README.md

@@ -0,0 +1,48 @@
+# @socketsecurity/onnxruntime
+
+Custom ONNX Runtime WASM build optimized for Socket CLI.
+
+## Overview
+
+This package builds ONNX Runtime from source with Emscripten, optimized for:
+- **Synchronous WASM instantiation** (`WASM_ASYNC_COMPILATION=0`)
+- **Minimal size** (aggressive optimization flags)
+- **Fast startup** (embedded WASM, no network fetch)
+
+## Building
+
+```bash
+# Normal build with checkpoints
+pnpm run build
+
+# Force rebuild (ignore checkpoints)
+pnpm run build:force
+
+# Clean build artifacts
+pnpm run clean
+```
+
+## Requirements
+
+- **Emscripten SDK** (emsdk)
+- **CMake** (3.13+)
+- **Git**
+
+Install Emscripten: https://emscripten.org/docs/getting_started/downloads.html
+
+## Output
+
+Built artifacts are exported to `build/wasm/`:
+- `ort-wasm-simd-threaded.wasm` - ONNX Runtime WebAssembly module
+- `ort-wasm-simd-threaded.js` - Emscripten JavaScript glue code
+
+## Integration
+
+The CLI's `extract-onnx-runtime.mjs` script:
+1. Reads these built WASM artifacts
+2. Embeds WASM as base64
+3. Generates `build/onnx-sync.mjs` for synchronous loading
+
+## Version
+
+Based on ONNX Runtime v1.20.0 (or latest stable).

packages/node-sea-builder/docs/README.md

@@ -0,0 +1,20 @@
+{
+  "name": "@socketsecurity/onnxruntime",
+  "version": "1.0.0",
+  "description": "Custom ONNX Runtime WASM build optimized for Socket CLI",
+  "type": "module",
+  "private": true,
+  "exports": {
+    "./build/wasm/ort-wasm-simd-threaded.js": "./build/wasm/ort-wasm-simd-threaded.js",
+    "./build/wasm/ort-wasm-simd-threaded.wasm": "./build/wasm/ort-wasm-simd-threaded.wasm"
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "build:force": "node scripts/build.mjs --force",
+    "clean": "node scripts/clean.mjs"
+  },
+  "dependencies": {
+    "@socketsecurity/build-infra": "workspace:*",
+    "@socketsecurity/lib": "catalog:"
+  }
+}