fix(upload): vendor form-data so bundlers can ship it - #681

socket@latest (1.1.151/1.1.152) throws Cannot find module 'form-data' on every fresh install's first multipart upload and a customer's CI has been down for over a day. The break is in how this SDK reaches form-data, so the fix lands here.

Root cause. getFormData() used createRequire(...)('form-data') — a dynamic call no bundler can follow. socket-cli's rollup inlines the SDK into dist/vendor.js, so the bare specifier shipped with form-data neither bundled nor declared, and the first upload threw on any clean install. The 4.1.3 sibling chunk does not survive consumer bundling either: rollup inlines dist/index.js without carrying the chunk across, and both ./form-data.js and form-data resolve MODULE_NOT_FOUND from the built CLI (reproduced with createRequire against the real artifact).

Fix. Vendor form-data through src/external/ the way socket-lib handles its externals:

• src/external/form-data.js — static module.exports = require('form-data') shim, with a hand-authored structural .d.ts so published types never import a package consumers don't install.
• getFormData() requires the shim by static relative literal, and a scoped external() in the rolldown config emits that require verbatim into dist/index.js, so the deferred node:http eval that keeps SDK importers --build-snapshot-safe is preserved.
• A separate externals build emits self-contained dist/external/form-data.js (socket-lib's build-externals step, SDK-sized), which the verbatim require resolves at runtime — and which a consumer bundler resolves and inlines. Ships via files, never an exports subpath.
• The external() match is by resolved path under this repo's src/external/ only — never a blanket external/-segment test, which would also externalize the nested dist/external/* internals of the inlined @socketsecurity/lib and emit requires into a package consumers never install.
• @types/node is now explicit in both tsconfigs — it was previously loaded only through form-data's typings, which vanish with the old chunk entry; without it the whole program silently loses node globals (45 errors).

Verified end-to-end with socket-cli rebuilt against this SDK: zero form-data requires anywhere in the CLI dist (bytes inlined into vendor.js), the undeclared-runtime-require scan is back to the 1.1.147 baseline, and a dist-mode uploadManifestFiles against a live local server put a real 6,984-byte multipart body on the wire (verified for both the plain-install path and the bundled path).

Actions needed

• Review and merge, then cut an SDK release — the customer fix ships only when socket-cli v1.x picks up that release and publishes 1.1.153 (I can drive both once this lands).
• Customer workaround until then: pin socket@1.1.147.