chore(build): rename configs, remove dead code, fix runtime bugs

[jdalton]

Summary

Config renames (consistent naming scheme):

• esbuild.cli.build.mjs → esbuild.cli.mjs
• esbuild.index.config.mjs → esbuild.index.mjs
• esbuild.config.mjs → esbuild.build.mjs
• esbuild-shared.mjs → esbuild-utils.mjs

Dead code removed:

• esbuild-plugin-dead-code-elimination.mjs (unused plugin)
• scripts/esbuild.config.mjs (broken orphan importing non-existent file)
• socketPackages={} + resolvePackageSubpath + resolve-socket-packages plugin (~50 lines never executed)
• Template esbuild.build.mjs files (never called by any build script)
• INLINED_LEGACY_BUILD constant (no references)
• build:sea:internal:bootstrap, publish:sea, e2e:smol scripts (all referenced missing files)
• treeShaking: true and external: [] (redundant esbuild defaults)

Refactored:

• createBuildRunner → runBuild (static imports, no IIFE, rethrows on failure for Promise.allSettled)
• esbuild.build.mjs runs builds in-process via runBuild instead of spawning subprocesses
• Extracted resolveSocketLibExternal() and resolveConstant() helpers (deduped repeated blocks)

Runtime bugs fixed:

• runBuild() now rethrows so Promise.allSettled rejection detection works correctly
• download-assets.mjs: allSettled handles both rejected promises and ok: false fulfilled results
• esbuild.cli.mjs: plugin order fixed — unicodeTransformPlugin runs before envVarReplacementPlugin
• build.mjs watch mode: error message uses watchResult?.code ?? 1 fallback
• test-wrapper.mjs: spawn() result used with .on() (Promise, not ChildProcess)
• validateBundle(): mixed false|array return type fixed
• verify-package.mjs: undefined fn ref, logger scope, forbidden fs.access(), unnecessary process import
• wasm.mjs, patches.mjs: logger out of scope
• validate-bundle.mjs: console.error → logger
• package.json: e2e:sea indentation fixed

CI: Updated GitHub Actions install action pins in ci.yml, provenance.yml, weekly-update.yml

Consistency: Promise.all → Promise.allSettled for parallel tasks, utf8 → utf-8, console.* → logger, stale JSDoc removed

Test plan

• pnpm run build completes without errors
• pnpm run build --force rebuilds cleanly
• SEA binary builds successfully
• CI passes

---

Note

Medium Risk
Touches the CLI build/publish pipeline (esbuild orchestration, template builds, and CI install action pins), so regressions could break packaging even though changes are mostly renames, dead-code removal, and error-handling fixes.

Overview
Streamlines the CLI build system by renaming/standardizing esbuild config entrypoints and replacing the old subprocess-based orchestrator with an in-process esbuild.build.mjs runner that calls the new runBuild() utility.

Removes unused/broken build code (the dead-code-elimination esbuild plugin export/implementation, legacy esbuild scripts/configs, unused env constants, and several stale package.json scripts) and updates package-builder templates to reference the renamed configs.

Hardens build/runtime scripts with more reliable spawning and parallel execution (Promise.allSettled, null spawn checks, consistent utf-8 reads, logger usage), and updates docs/CI workflows to match (including a new pin for the shared SocketDev/socket-registry install action).

^{Written by Cursor Bugbot for commit 51d1285. Configure here.}

[jdalton]

@cursor review

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Rejected promises silently ignored after allSettled migration
  • Added r.status === 'rejected' to the failed filter and proper error message handling for rejected results, matching the pattern already used in download-assets.mjs.

Or push these changes by commenting:

@cursor push 4dccb8034b

Preview (4dccb8034b)

diff --git a/scripts/download-iocraft-binaries.mjs b/scripts/download-iocraft-binaries.mjs
--- a/scripts/download-iocraft-binaries.mjs
+++ b/scripts/download-iocraft-binaries.mjs
@@ -159,12 +159,14 @@
   )
 
   const failed = settled.filter(
-    r => r.status === 'fulfilled' && !r.value.ok,
+    r => r.status === 'rejected' || (r.status === 'fulfilled' && !r.value.ok),
   )
   if (failed.length > 0) {
     logger.error(`\n${failed.length} platform(s) failed:`)
     for (const r of failed) {
-      logger.error(`  - ${r.value.target}`)
+      logger.error(
+        `  - ${r.status === 'rejected' ? r.reason?.message ?? r.reason : r.value.target}`,
+      )
     }
     return false
   }

_{You can send follow-ups to this agent here.}

Comment @cursor review or bugbot run to trigger another review on this PR

[cursor]

Rejected promises silently ignored after allSettled migration

High Severity

The failed filter only checks r.status === 'fulfilled' && !r.value.ok, completely ignoring r.status === 'rejected' results. If downloadIocraftBinary throws an uncaught error, Promise.allSettled captures it as a rejected entry, but this filter skips it. The function then incorrectly reports "All N platform(s) downloaded successfully" and returns true. The same Promise.all→Promise.allSettled migration in download-assets.mjs correctly includes r.status === 'rejected' in its filter, making this an inconsistency.