build(deps): add nanotar 0.2.0 and bundle it in SEA bootstrap

- Add nanotar as devDependency (pinned to 0.2.0)
- Remove nanotar from esbuild external list to bundle it
- Remove @ts-expect-error comment for nanotar import
- Bootstrap output increases from 18.9kb to 21.3kb with nanotar bundled

Author: jdalton

package.json

@@ -76,6 +76,7 @@
     "magic-string": "0.30.19",
     "micromatch": "4.0.8",
     "mock-fs": "5.5.0",
+    "nanotar": "0.2.0",
     "nock": "14.0.10",
     "npm-package-arg": "13.0.0",
     "npm-run-all2": "8.0.4",
@@ -153,7 +154,8 @@
       "vite": "7.1.11",
       "xml2js": "0.6.2",
       "yaml": "2.8.1",
-      "yargs-parser": "21.1.1"
+      "yargs-parser": "21.1.1",
+      "@socketsecurity/lib": "link:../socket-lib"
     },
     "patchedDependencies": {
       "brace-expansion@2.0.2": "patches/brace-expansion@2.0.2.patch",

packages/cli/.config/esbuild.sea-bootstrap.build.mjs

@@ -37,8 +37,8 @@ const config = {
   target: 'node18',
   sourcemap: false,
   minify: false,
-  // Only externalize Node.js built-ins and nanotar (vendored at runtime).
-  external: ['node:*', 'nanotar'],
+  // Only externalize Node.js built-ins for the thin wrapper.
+  external: ['node:*'],
   alias: aliasEntries,
   logLevel: 'info',
   banner: {

packages/cli/src/stub/bootstrap.mts

@@ -16,7 +16,6 @@ import { createRequire } from 'node:module'
 import os from 'node:os'
 import path from 'node:path'
 
-// @ts-expect-error - nanotar module not available currently
 import { parseTarGzip } from 'nanotar'
 
 const require = createRequire(import.meta.url)