perf(package): cut published package size

[christso]

Summary

Published AllAgents is now a minified, self-contained Node CLI. Installation no longer downloads a second copy of bundled runtime dependencies, while package budgets and isolated artifact smoke tests guard the result.

This is the foundation layer of a two-PR stack. #501 builds the expanded client registry on this packaging change.

Package impact

Metric	Before	After	Reduction
Bundled JavaScript	3,024,312 bytes	1,515,014 bytes	49.9%
Unpacked npm package	3,037,699 bytes	1,629,556 bytes	46.4%
Compressed tarball	594,761 bytes	449,184 bytes	24.5%
Installed runtime dependencies	13 direct dependencies	0	100%

Design decisions

• Bun performs full production minification and bundles production packages into dist/index.js.
• Runtime packages remain available for development but publish as devDependencies, so npm does not install duplicate code.
• The build metafile generates THIRD_PARTY_NOTICES.txt from the package instances that actually enter the bundle, including nested duplicate versions.
• Package size checks enforce JavaScript, unpacked, and compressed budgets.
• Publish creates one checked tarball and sends that exact file to npm publish; retries that find an existing version do not repack.

Validation

bun run build
bun run typecheck
bun run lint
bun test
bun run test:e2e
bun run package:check
bun run package:smoke

Observed results:

• 2,027 unit tests passed; 7 skipped; 0 failed.
• 208 E2E tests passed; 4 skipped; 0 failed.
• package:smoke installed the packed tarball in an isolated directory, installed no runtime dependencies, and traversed 54 structured-help command nodes under Node.
• Final budgets: 1,515,014-byte JavaScript bundle, 1,629,556-byte unpacked package, and 449,184-byte tarball.

New concepts

Metafile-derived license notices

A bundler metafile records the concrete source files included in an artifact. Walking those inputs to their nearest package roots identifies the exact package name, version, and license that shipped, rather than guessing from top-level dependencies. This matters when two versions of one package are bundled through different dependency paths. It is not useful for packages that publish their dependency tree instead of bundling it.

Post-Deploy Monitoring & Validation

• In the Publish workflow, confirm package:check and package:smoke pass before the npm publish step.
• After release, install the published version into an empty directory and confirm node_modules/allagents/package.json has no runtime dependencies and allagents --help --json succeeds.
• Compare the published tarball metrics with the enforced 1,650,000-byte JavaScript, 1,800,000-byte unpacked, and 525,000-byte compressed limits.
• Roll back by reverting this PR and publishing the next patch through the GitHub Actions Publish workflow; never publish directly from a workstation.

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	226a9fb
Status:	✅  Deploy successful!
Preview URL:	https://8b459ae4.allagents.pages.dev
Branch Preview URL:	https://perf-package-size.allagents.pages.dev

View logs