Update tsdown to 0.21.0 and refactor build script for SEA binary

Author: bkeepers

.changeset/cli-tsdown-sea.md

@@ -0,0 +1,5 @@
+---
+"@neaps/cli": patch
+---
+
+Migrate SEA (Single Executable Application) build from a custom esbuild script to tsdown's built-in `exe` option. Removes the `esbuild` dev dependency.

package.json

@@ -25,7 +25,7 @@
     "make-fetch-happen": "^15.0.3",
     "npm-run-all": "^4.1.5",
     "prettier": "^3.7.4",
-    "tsdown": "^0.20.1",
+    "tsdown": "^0.21.0",
     "typescript": "^5.3.3",
     "typescript-eslint": "^8.56.0",
     "vitest": "^4.0.15"

packages/cli/package.json

@@ -34,7 +34,7 @@
   ],
   "scripts": {
     "build": "tsdown",
-    "build:sea": "node scripts/build-sea.ts",
+    "build:sea": "tsdown --config tsdown.sea.config.ts",
     "prepack": "npm run build",
     "test": "vitest"
   },
@@ -48,7 +48,6 @@
   },
   "devDependencies": {
     "@types/node": "^25.0.2",
-    "esbuild": "^0.27.3",
     "nock": "^14.0.11"
   }
 }

packages/cli/scripts/build-sea.ts

@@ -0,0 +1,30 @@
+import { execFileSync } from "node:child_process";
+import { resolve } from "node:path";
+import { defineConfig } from "tsdown";
+
+export default defineConfig({
+  entry: ["./src/index.ts"],
+  platform: "node",
+  exe: {
+    fileName: "neaps",
+    seaConfig: {
+      disableExperimentalSEAWarning: true,
+    },
+  },
+  onSuccess: (config) => {
+    // Re-sign with the stable identifier for reproducible builds.
+    // tsdown performs an initial ad-hoc sign (defaulting to the binary
+    // name as the identifier); this overwrites it with the canonical one.
+    if (process.platform === "darwin") {
+      const outputPath = resolve(config.outDir, "neaps");
+      execFileSync("codesign", [
+        "--sign",
+        "-",
+        "--identifier",
+        "io.openwaters.neaps",
+        "--force",
+        outputPath,
+      ]);
+    }
+  },
+});