fix(build): bundle @socketsecurity/lib instead of marking external

Remove @socketsecurity/lib from external array and update alias plugin
to skip externalizing it. This reduces consumer dependencies.

Author: jdalton

.config/esbuild.config.mjs

@@ -12,9 +12,158 @@ const rootPath = path.join(__dirname, '..')
 const srcPath = path.join(rootPath, 'src')
 const distPath = path.join(rootPath, 'dist')
 
+/**
+ * Plugin to shorten module paths in bundled output with conflict detection.
+ * Uses @babel/parser and magic-string for precise AST-based modifications.
+ */
+function createPathShorteningPlugin() {
+  return {
+    name: 'shorten-module-paths',
+    setup(build) {
+      build.onEnd(async result => {
+        if (!result.outputFiles && result.metafile) {
+          // Dynamic imports to avoid adding to production dependencies
+          const fs = await import('node:fs/promises')
+          const { parse } = await import('@babel/parser')
+          const MagicString = (await import('magic-string')).default
+
+          const outputs = Object.keys(result.metafile.outputs).filter(f =>
+            f.endsWith('.js') || f.endsWith('.mjs'),
+          )
+
+          for (const outputPath of outputs) {
+            const content = await fs.readFile(outputPath, 'utf8')
+            const magicString = new MagicString(content)
+
+            // Track module paths and their shortened versions
+            const pathMap = new Map()
+            const conflictDetector = new Map()
+
+            function shortenPath(longPath) {
+              if (pathMap.has(longPath)) {
+                return pathMap.get(longPath)
+              }
+
+              let shortPath = longPath
+
+              // Handle pnpm scoped packages
+              const scopedPnpmMatch = longPath.match(
+                /node_modules\/\.pnpm\/@([^+/]+)\+([^@/]+)@[^/]+\/node_modules\/(@[^/]+\/[^/]+)\/(.+)/,
+              )
+              if (scopedPnpmMatch) {
+                const [, _scope, _pkg, packageName, subpath] = scopedPnpmMatch
+                shortPath = `${packageName}/${subpath}`
+              } else {
+                // Handle pnpm non-scoped packages
+                const pnpmMatch = longPath.match(
+                  /node_modules\/\.pnpm\/([^@/]+)@[^/]+\/node_modules\/([^/]+)\/(.+)/,
+                )
+                if (pnpmMatch) {
+                  const [, _pkgName, packageName, subpath] = pnpmMatch
+                  shortPath = `${packageName}/${subpath}`
+                }
+              }
+
+              // Detect conflicts
+              if (conflictDetector.has(shortPath)) {
+                const existingPath = conflictDetector.get(shortPath)
+                if (existingPath !== longPath) {
+                  console.warn(
+                    `⚠ Path conflict detected:\n  "${shortPath}"\n  Maps to: "${existingPath}"\n  Also from: "${longPath}"\n  Keeping original paths to avoid conflict.`,
+                  )
+                  shortPath = longPath
+                }
+              } else {
+                conflictDetector.set(shortPath, longPath)
+              }
+
+              pathMap.set(longPath, shortPath)
+              return shortPath
+            }
+
+            // Parse AST to find all string literals containing module paths
+            try {
+              const ast = parse(content, {
+                sourceType: 'module',
+                plugins: [],
+              })
+
+              // Walk through all comments
+              for (const comment of ast.comments || []) {
+                if (
+                  comment.type === 'CommentLine' &&
+                  comment.value.includes('node_modules')
+                ) {
+                  const originalPath = comment.value.trim()
+                  const shortPath = shortenPath(originalPath)
+
+                  if (shortPath !== originalPath) {
+                    magicString.overwrite(
+                      comment.start,
+                      comment.end,
+                      `// ${shortPath}`,
+                    )
+                  }
+                }
+              }
+
+              // Walk through all string literals
+              function walk(node) {
+                if (!node || typeof node !== 'object') {
+                  return
+                }
+
+                if (
+                  node.type === 'StringLiteral' &&
+                  node.value &&
+                  node.value.includes('node_modules')
+                ) {
+                  const originalPath = node.value
+                  const shortPath = shortenPath(originalPath)
+
+                  if (shortPath !== originalPath) {
+                    magicString.overwrite(
+                      node.start + 1,
+                      node.end - 1,
+                      shortPath,
+                    )
+                  }
+                }
+
+                for (const key of Object.keys(node)) {
+                  if (key === 'start' || key === 'end' || key === 'loc') {
+                    continue
+                  }
+                  const value = node[key]
+                  if (Array.isArray(value)) {
+                    for (const item of value) {
+                      walk(item)
+                    }
+                  } else {
+                    walk(value)
+                  }
+                }
+              }
+
+              walk(ast.program)
+              await fs.writeFile(outputPath, magicString.toString(), 'utf8')
+            } catch (error) {
+              console.error(
+                `Failed to shorten paths in ${outputPath}:`,
+                error.message,
+              )
+            }
+          }
+        }
+      })
+    },
+  }
+}
+
 /**
  * Plugin to handle local package aliases.
  * Provides consistent alias resolution across all Socket repos.
+ * Note: Does not externalize @socketsecurity/lib - that should be bundled.
  */
 function createAliasPlugin() {
   const aliases = getLocalPackageAliases(rootPath)
@@ -27,8 +176,13 @@ function createAliasPlugin() {
   return {
     name: 'local-package-aliases',
     setup(build) {
-      // Intercept imports for aliased packages.
+      // Intercept imports for aliased packages (except @socketsecurity/lib which should be bundled)
       for (const [packageName, _aliasPath] of Object.entries(aliases)) {
+        // Skip @socketsecurity/lib - it should be bundled, not externalized
+        if (packageName === '@socketsecurity/lib') {
+          continue
+        }
+
         // Match both exact package name and subpath imports.
         build.onResolve(
           { filter: new RegExp(`^${packageName}(/|$)`) },
@@ -47,6 +201,7 @@ function createAliasPlugin() {
 export const buildConfig = {
   entryPoints: [`${srcPath}/index.ts`, `${srcPath}/testing.ts`],
   outdir: distPath,
+  outbase: srcPath,
   bundle: true,
   format: 'esm',
   // Target Node.js environment (not browser).
@@ -62,16 +217,14 @@ export const buildConfig = {
   outExtension: { '.js': '.mjs' },
 
   // Use plugin for local package aliases (consistent across all Socket repos)
-  plugins: [createAliasPlugin()].filter(Boolean),
+  plugins: [createPathShorteningPlugin(), createAliasPlugin()].filter(Boolean),
 
   // External dependencies.
   // With platform: 'node', esbuild automatically externalizes all Node.js
   // built-ins. The explicit external array with builtinModules is redundant
   // (but doesn't hurt as extra safety).
-  external: [
-    // External dependencies that shouldn't be bundled.
-    '@socketsecurity/lib',
-  ],
+  // Note: @socketsecurity/lib is bundled (not external) to reduce consumer dependencies
+  external: [],
 
   // Banner for generated code
   banner: {