Update Build & Packages

[radumojic]

Issue/Feature

Reproduce

Issue exists on version 2. of sdk-dapp.

Root cause

Fix

Additional changes

Contains breaking changes

• No
• Yes

Updated CHANGELOG

• No
• Yes

Testing

• User testing
• Unit tests

[gemini-code-assist]

Code Review

This pull request updates the build system and dependencies, refactoring esbuild.js to build ESM and CJS targets dynamically, updating package versions, and introducing new TypeScript configuration files. Feedback on these changes highlights several issues: a critical bug in esbuild.js where fs.cpSync will nest build outputs rather than merging them; an invalid allowBuilds configuration in pnpm-workspace.yaml; a potential runtime TypeError in trackTransactions.ts if the selector returns a nullish value; and the use of Node.js-specific Buffer in browser-facing code (calculateFeeLimit.ts and refreshNativeAuthTokenLogin.ts), which should be replaced with the standard TextEncoder API.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

There is a critical bug here when copying build outputs. In Node.js, if the destination directory (out) already exists, fs.cpSync(src, dest, { recursive: true }) will copy the source directory into the destination directory rather than merging its contents.

During the first iteration (ESM), out does not exist, so the contents of out-esm are copied directly to out. However, during the second iteration (CJS), out already exists, so out-cjs is copied inside out, resulting in out/out-cjs/... instead of merging into out/. This will break the CommonJS build output structure.

To fix this, we should create the out directory and copy the contents of target.outdir individually.

      fs.mkdirSync('out', { recursive: true });
      for (const file of fs.readdirSync(target.outdir)) {
        fs.cpSync(`${target.outdir}/${file}`, `out/${file}`, { recursive: true });
      }
      fs.rmSync(target.outdir, { recursive: true, force: true });

[gemini-code-assist]

allowBuilds is not a valid configuration option in pnpm-workspace.yaml. In pnpm, workspace configurations are strictly limited to defining workspace packages and catalogs.

To control lifecycle scripts and built dependencies in pnpm (v9+), you should use the pnpm.onlyBuiltDependencies field in the root package.json or configure only-built-dependencies in .npmrc. Since you want to disallow these builds, you can simply omit them from onlyBuiltDependencies in package.json or explicitly set "onlyBuiltDependencies": [] to block all built dependencies.

[gemini-code-assist]

If pendingTransactionsSessionsSelector returns undefined or null (e.g., if the store state is not fully initialized or if the slice is empty), calling Object.keys on it will throw a runtime TypeError.

Let's use defensive programming by adding a nullish coalescing operator fallback to an empty object.

Suggested change

	Object.keys(pendingTransactionsSessionsSelector(store.getState()))
	.length > 0;
	Object.keys(pendingTransactionsSessionsSelector(store.getState()) ?? {})
	.length > 0;

[gemini-code-assist]

Instead of using Node.js-specific Buffer (which requires polyfills in browser environments and can lead to runtime ReferenceError if not properly bundled), we can use the standard, built-in TextEncoder API.

new TextEncoder().encode() is supported in all modern browsers and Node.js, and directly returns a Uint8Array without needing any extra wrapping.

Suggested change

	data: new Uint8Array(Buffer.from(data.trim())),
	data: new TextEncoder().encode(data.trim()),

[gemini-code-assist]

Instead of using Node.js-specific Buffer (which requires polyfills in browser environments and can lead to runtime ReferenceError if not properly bundled), we can use the standard, built-in TextEncoder API.

new TextEncoder().encode() is supported in all modern browsers and Node.js, and directly returns a Uint8Array without needing any extra wrapping.

Suggested change

	data: new Uint8Array(Buffer.from(`${address}${loginToken}`))
	data: new TextEncoder().encode(`${address}${loginToken}`)