refactor(cli-with-sentry): complete build system with compression

- Rename esbuild.cli-sentry.build.mjs to esbuild.config.mjs
- Add esbuild.index.config.mjs for index loader
- Add compress-cli.mjs for brotli compression
- Update build.mjs to include all build steps:
  - Build CLI bundle (outputs to build/cli.js)
  - Build index loader (outputs to dist/index.js)
  - Compress CLI (outputs to dist/cli.js.bz with SHA256)
  - Copy data/ from cli package
  - Copy logo images from repo root
- Use spawn from @socketsecurity/lib/spawn with WIN32 shell
- Change esbuild output from dist/cli.js to build/cli.js
- Achieves 87.2% compression (13.67MB → 1.75MB)
- Package validation now passes

Author: jdalton

…try/.config/esbuild.cli-sentry.build.mjs …i-with-sentry/.config/esbuild.config.mjspackages/cli-with-sentry/.config/esbuild.cli-sentry.build.mjs renamed to packages/cli-with-sentry/.config/esbuild.config.mjs packages/cli-with-sentry/.config/esbuild.cli-sentry.build.mjs renamed to packages/cli-with-sentry/.config/esbuild.config.mjs

@@ -19,7 +19,7 @@ const cliPath = path.join(__dirname, '..', '..', 'cli')
 const config = {
   ...baseConfig,
   entryPoints: [path.join(cliPath, 'src/cli-dispatch-with-sentry.mts')],
-  outfile: path.join(rootPath, 'dist/cli.js'),
+  outfile: path.join(rootPath, 'build/cli.js'),
 
   // Override define to enable Sentry build.
   define: {

packages/cli-with-sentry/.config/esbuild.index.config.mjs

@@ -0,0 +1,38 @@
+/**
+ * esbuild configuration for Socket CLI with Sentry index loader.
+ * Builds the brotli decompression loader that executes the compressed CLI.
+ */
+
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { build } from 'esbuild'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.resolve(__dirname, '..')
+const cliPath = path.resolve(__dirname, '../../cli')
+
+const config = {
+  banner: {
+    js: '#!/usr/bin/env node',
+  },
+  bundle: true,
+  entryPoints: [path.join(cliPath, 'src', 'index.mts')],
+  external: [],
+  format: 'cjs',
+  minify: true,
+  outfile: path.join(rootPath, 'dist', 'index.js'),
+  platform: 'node',
+  target: 'node18',
+  treeShaking: true,
+}
+
+// Run build if invoked directly.
+if (fileURLToPath(import.meta.url) === process.argv[1]) {
+  build(config).catch(error => {
+    console.error('Index loader build failed:', error)
+    process.exitCode = 1
+  })
+}
+
+export default config

packages/cli-with-sentry/scripts/build.mjs

@@ -5,55 +5,61 @@
  */
 
 import { promises as fs } from 'node:fs'
-import { spawn } from 'node:child_process'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+
+import { WIN32 } from '@socketsecurity/lib/constants/platform'
 import { logger } from '@socketsecurity/lib/logger'
+import { spawn } from '@socketsecurity/lib/spawn'
 import colors from 'yoctocolors-cjs'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const rootPath = path.join(__dirname, '..')
 const repoRoot = path.join(__dirname, '../../..')
 
-/**
- * Runs a command and returns a promise.
- */
-function runCommand(command, args, options = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
-      stdio: 'inherit',
-      ...options,
-    })
-
-    child.on('error', reject)
-    child.on('exit', code => {
-      if (code === 0) {
-        resolve()
-      } else {
-        reject(
-          new Error(`Command failed: ${command} ${args.join(' ')} (exit ${code})`),
-        )
-      }
-    })
-  })
-}
-
 async function main() {
   try {
-    const esbuildConfig = path.join(
-      rootPath,
-      '.config/esbuild.cli-sentry.build.mjs',
-    )
     const cliPath = path.join(rootPath, '..', 'cli')
 
-    // Run esbuild config directly.
-    await runCommand('node', [esbuildConfig], {
+    // Build CLI bundle.
+    logger.log(`${colors.blue('ℹ')} Building CLI bundle...`)
+    let result = await spawn('node', ['.config/esbuild.config.mjs'], {
+      shell: WIN32,
+      stdio: 'inherit',
       cwd: rootPath,
       env: {
         ...process.env,
         INLINED_SOCKET_CLI_SENTRY_BUILD: '1',
       },
     })
+    if (result.code !== 0) {
+      throw new Error(`CLI bundle build failed with exit code ${result.code}`)
+    }
+    logger.log(`${colors.green('✓')} Built CLI bundle`)
+
+    // Build index loader.
+    logger.log(`${colors.blue('ℹ')} Building index loader...`)
+    result = await spawn('node', ['.config/esbuild.index.config.mjs'], {
+      shell: WIN32,
+      stdio: 'inherit',
+      cwd: rootPath,
+    })
+    if (result.code !== 0) {
+      throw new Error(`Index loader build failed with exit code ${result.code}`)
+    }
+    logger.log(`${colors.green('✓')} Built index loader`)
+
+    // Compress CLI.
+    logger.log(`${colors.blue('ℹ')} Compressing CLI...`)
+    result = await spawn('node', ['scripts/compress-cli.mjs'], {
+      shell: WIN32,
+      stdio: 'inherit',
+      cwd: rootPath,
+    })
+    if (result.code !== 0) {
+      throw new Error(`CLI compression failed with exit code ${result.code}`)
+    }
+    logger.log(`${colors.green('✓')} Compressed CLI`)
 
     // Copy data directory from packages/cli.
     logger.log(`${colors.blue('ℹ')} Copying data/ from packages/cli...`)

packages/cli-with-sentry/scripts/compress-cli.mjs

@@ -0,0 +1,60 @@
+/**
+ * @fileoverview Compress build/cli.js with brotli to dist/cli.js.bz.
+ *
+ * This script compresses the CLI bundle to reduce npm package size
+ * from ~13MB to ~1.7MB (87% reduction).
+ *
+ * The compressed file is decompressed at runtime by dist/index.js.
+ */
+
+import crypto from 'node:crypto'
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { brotliCompressSync } from 'node:zlib'
+
+import { logger } from '@socketsecurity/lib/logger'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.join(__dirname, '..')
+const buildPath = path.join(rootPath, 'build')
+const distPath = path.join(rootPath, 'dist')
+
+const cliPath = path.join(buildPath, 'cli.js')
+const cliBzPath = path.join(distPath, 'cli.js.bz')
+
+logger.log('')
+logger.step('Compressing CLI with brotli...')
+
+// Ensure dist/ directory exists.
+mkdirSync(distPath, { recursive: true })
+
+// Read the uncompressed CLI from build/.
+const cliCode = readFileSync(cliPath)
+const originalSize = cliCode.length
+
+// Compress with brotli (max quality for best compression).
+const compressed = brotliCompressSync(cliCode, {
+  params: {
+    [0]: 11, // BROTLI_PARAM_QUALITY: 11 (max quality).
+  },
+})
+const compressedSize = compressed.length
+
+// Write compressed file to dist/.
+writeFileSync(cliBzPath, compressed)
+
+const compressionRatio = ((1 - compressedSize / originalSize) * 100).toFixed(1)
+logger.success(
+  `Compressed: ${(originalSize / 1024 / 1024).toFixed(2)} MB → ${(compressedSize / 1024 / 1024).toFixed(2)} MB (${compressionRatio}% reduction)`,
+)
+
+// Generate SHA256 checksum for integrity validation.
+const sha256 = crypto.createHash('sha256').update(compressed).digest('hex')
+const checksumPath = path.join(distPath, 'cli.js.bz.sha256')
+writeFileSync(checksumPath, `${sha256}  cli.js.bz\n`)
+
+logger.success(`SHA256: ${sha256}`)
+logger.log(`Checksum written to: ${path.relative(rootPath, checksumPath)}`)
+
+logger.log('')