Use tsdown to build CLI binaries

.changeset/cli-tsdown-sea.md

@@ -0,0 +1,5 @@
+---
+"@neaps/cli": patch
+---
+
+Migrate SEA (Single Executable Application) build from a custom esbuild script to tsdown's built-in `exe` option. Removes the `esbuild` dev dependency.

.github/workflows/build-binaries.yml

@@ -71,6 +71,14 @@ jobs:
       - name: Build SEA binary
         run: npm run build:sea --workspace=packages/cli
 
+      - name: Smoke test binary
+        shell: bash
+        run: |
+          EXT=${{ matrix.target == 'win-x64' && '".exe"' || '""' }}
+          BIN="packages/cli/dist/neaps${EXT}"
+          "$BIN" --version
+          "$BIN" --help
+
       - name: Verify reproducible build
         shell: bash
         run: |

package.json

@@ -25,7 +25,7 @@
     "make-fetch-happen": "^15.0.3",
     "npm-run-all": "^4.1.5",
     "prettier": "^3.7.4",
-    "tsdown": "^0.20.1",
+    "tsdown": "^0.21.0",
     "typescript": "^5.3.3",
     "typescript-eslint": "^8.56.0",
     "vitest": "^4.0.15"

packages/cli/package.json

@@ -34,7 +34,7 @@
   ],
   "scripts": {
     "build": "tsdown",
-    "build:sea": "node scripts/build-sea.ts",
+    "build:sea": "tsdown --config tsdown.sea.config.ts",
     "prepack": "npm run build",
     "test": "vitest"
   },
@@ -48,7 +48,6 @@
   },
   "devDependencies": {
     "@types/node": "^25.0.2",
-    "esbuild": "^0.27.3",
     "nock": "^14.0.11"
   }
 }

packages/cli/tsdown.sea.config.ts

@@ -0,0 +1,39 @@
+import { execFileSync } from "node:child_process";
+import { resolve } from "node:path";
+import { defineConfig } from "tsdown";
+
+export default defineConfig({
+  entry: ["./src/index.ts"],
+  platform: "node",
+  // CJS format has significantly faster startup than ESM in SEA binaries
+  // (synchronous require vs async module graph loading).
+  format: "cjs",
+  minify: true,
+  deps: {
+    // SEA needs everything bundled — override the default behavior that
+    // externalizes packages listed in package.json dependencies.
+    alwaysBundle: () => true,
+  },
+  exe: {
+    fileName: "neaps",
+    seaConfig: {
+      disableExperimentalSEAWarning: true,
+    },
+  },
+  onSuccess: (config) => {
+    // Re-sign with the stable identifier for reproducible builds.
+    // tsdown performs an initial ad-hoc sign (defaulting to the binary
+    // name as the identifier); this overwrites it with the canonical one.
+    if (process.platform === "darwin") {
+      const outputPath = resolve(config.outDir, "neaps");
+      execFileSync("codesign", [
+        "--sign",
+        "-",
+        "--identifier",
+        "io.openwaters.neaps",
+        "--force",
+        outputPath,
+      ]);
+    }
+  },
+});