feat(core): improve install size

[Everduin94]

Bundled tree-shaken valibot with package and moved to devDep. Removed config store in favor of hand-rolled alternative. Replaced json-c with a strip-json-comments equivalent. Should drop approx 2.78 MB of install size and down to 8 total dependencies from 21.

[Copilot]

Pull request overview

This PR reduces the published install footprint for the CLI by bundling valibot into the build output and replacing heavier runtime dependencies (configstore, jsonc-parser) with lightweight in-repo utilities for prompt caching and JSONC stripping.

Changes:

• Updated tsdown bundling config to bundle valibot and moved valibot to devDependencies.
• Replaced configstore with a local PromptCache backed by a JSON file under the user config directory.
• Replaced jsonc-parser with an in-repo stripJsonComments implementation (with comprehensive tests) and used it for config loading.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tsdown.config.ts	Configures bundling behavior to include valibot in build output.
src/utils/strip-json-comments.ts	Adds internal JSONC comment/trailing-comma stripping implementation.
src/utils/strip-json-comments.test.ts	Adds unit tests covering comment stripping + trailing comma behavior and project template parsing.
src/utils.ts	Switches config parsing to stripJsonComments + JSON.parse and updates cache typing to PromptCache.
src/prompts/runnable.ts	Replaces Configstore typing with PromptCache.
src/prompts/branch-runnable.ts	Replaces Configstore typing with PromptCache.
src/prompt-cache.ts	Introduces file-backed prompt cache replacement for configstore.
src/index.ts	Uses FilePromptCache when cache is enabled.
src/branch.ts	Uses FilePromptCache when cache is enabled.
package.json	Removes runtime deps, adds THIRD_PARTY_NOTICES.md to published files, moves valibot to dev deps.
package-lock.json	Updates lockfile to reflect dependency removals and valibot as dev-only.

Suppressed comments (2)

src/utils.ts:125

• On config parse failure, the code logs an error and calls process.exit(0). Exiting with status 0 typically signals success to shells/CI, which can hide misconfiguration. Use a non-zero exit code for invalid config.

    res = JSON.parse(stripJsonComments(jsonc, { trailingCommas: true }));
  } catch (err) {
    p.log.error(
      `Invalid JSON/JSONC config file at ${config_path}. Exiting.\n` + err,
    );

src/utils.ts:232

• The warning in this function hard-codes ~/.config, but the cache location can differ (e.g. when XDG_CONFIG_HOME is set, or on non-Unix platforms). Consider making the message location-agnostic or mentioning XDG_CONFIG_HOME as well to avoid misleading troubleshooting guidance.

export function set_value_cache(
  config_store: PromptCache,
  key: string,
  value: string,
): void {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🎉 This PR is included in version 1.26.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀