refactor(build): use plugin pattern for local package aliases

Replaced built-in alias option with custom esbuild plugin to provide
consistent alias resolution across all Socket repos. While the built-in
alias works fine with bundle: true, the plugin approach:

- Provides identical implementation across socket-lib, socket-sdk-js,
  and socket-packageurl-js
- Uses unified regexp pattern (/|$) to handle both exact and subpath imports
- Maintains same functionality while improving cross-repo consistency

This standardization simplifies maintenance and documentation across
the Socket monorepo ecosystem.

Author: jdalton

.config/esbuild.config.mjs

@@ -13,6 +13,35 @@ const rootPath = path.join(__dirname, '..')
 const srcPath = path.join(rootPath, 'src')
 const distPath = path.join(rootPath, 'dist')
 
+/**
+ * Plugin to handle local package aliases.
+ * Provides consistent alias resolution across all Socket repos.
+ */
+function createAliasPlugin() {
+  const aliases = getLocalPackageAliases(rootPath)
+
+  // Only create plugin if we have local aliases
+  if (Object.keys(aliases).length === 0) {
+    return null
+  }
+
+  return {
+    name: 'local-package-aliases',
+    setup(build) {
+      // Intercept imports for aliased packages
+      for (const [packageName, aliasPath] of Object.entries(aliases)) {
+        // Match both exact package name and subpath imports
+        build.onResolve({ filter: new RegExp(`^${packageName}(/|$)`) }, args => {
+          // Handle subpath imports like '@socketsecurity/lib/spinner'
+          const subpath = args.path.slice(packageName.length + 1)
+          const resolvedPath = subpath ? path.join(aliasPath, subpath) : aliasPath
+          return { path: resolvedPath, external: true }
+        })
+      }
+    },
+  }
+}
+
 // Build configuration for CommonJS output
 export const buildConfig = {
   entryPoints: [`${srcPath}/index.ts`],
@@ -32,8 +61,8 @@ export const buildConfig = {
   // Preserve module structure for better tree-shaking
   splitting: false,
 
-  // Alias local packages when available (dev mode).
-  alias: getLocalPackageAliases(rootPath),
+  // Use plugin for local package aliases (consistent across all Socket repos)
+  plugins: [createAliasPlugin()].filter(Boolean),
 
   // External dependencies
   external: [