fix(esm): make dist/esm runtime-importable under Node strict ESM

[0xjorgen]

Summary

build:esm emits dist/esm/ with "type":"module", but tsc preserves source import specifiers as written. Under Node's strict ESM resolver this produces three classes of unloadable output, plus a transitive viem dep-tree gap that's been latent in the lockfile.

Downstream evidence: when across-protocol/dapp #326 hoisted Amplitude tracking into the SSR-rendered __root.tsx, the dapp's local Vite dev server started returning HTTPError 500 on every request because Vite SSR walks into @across-protocol/sdk@4.3.154's built BlockUtils.js via Node's strict ESM. Bisected to a specific dapp commit but the underlying cause is in this package.

The three SDK-source failure modes

1. Extension-less relative imports: BlockUtils.js ships import { ... } from "../../utils/NetworkUtils". Node strict ESM:

   ERR_MODULE_NOT_FOUND
   Cannot find module '.../@across-protocol/sdk/dist/esm/src/utils/NetworkUtils'
   imported from .../BlockUtils.js
   

2. Named imports from CJS-only deps: import { clamp, sortedIndexBy } from "lodash" —

   The requested module 'lodash' is a CommonJS module, which may not support
   all module.exports as named exports.
   

   Hits lodash (7 files) and @coral-xyz/anchor (1 file). Type-only named imports (import { Idl } from "...") are fine because TS strips them.
3. require.main === module CLI guards: 2 source files use this idiomatic CJS entry-point check. Under ESM, require is undefined and any file containing the literal crashes on load.

Fix

Concern	Change
(1) extension-less relative imports	New scripts/add-esm-extensions.mjs post-build rewriter that walks dist/esm/**/*.js and adds .js / /index.js to every relative import / export / dynamic import() specifier. Pure Node, no new deps. Wired into build:esm after tsc. Source stays idiomatic TS.
(1) extension-less bare deep imports	Source-level .js / /index.js suffixes on 9 imports into packages that expose deep paths without an exports map (@across-protocol/contracts/dist/..., @eth-optimism/sdk/dist/..., ethers/lib/utils, arweave/node/lib/...). The post-build script only touches relative paths — bare deep imports must be fixed at source.
(2) CJS-named imports	Default-import + destructure in 8 files (7 lodash, 1 @coral-xyz/anchor).
(3) require.main guards	Wrap with typeof require !== "undefined" in addressAggregator/index.ts and arch/evm/utils/wait.ts. CJS behavior unchanged; ESM stops crashing.
Regression detection	New scripts/esm-node-ssr-smoke-test.cjs + yarn test:esm-smoke. Asserts 16 representative dist/esm entry points can be import()-ed under Node ESM. Add new entries when downstream consumers report fresh chains. Easy CI hook.

The lockfile follow-up (separate commit)

Surfaced while triaging the above: viem@2.47.10's own package.json declares @noble/hashes@1.8.0, but our yarn.lock has it resolved to 1.4.0 under viem/node_modules/. The 1.4.0 build lacks the anumber named export that the co-installed @noble/curves@1.9.1 imports at module top level — so any consumer loading a viem code path under Node ESM gets Named export 'anumber' not found.

Forcing **/@noble/hashes to ^1.8.0 via resolutions makes yarn drop the nested install. All consumers share the top-level 1.8.0 and viem→curves→hashes resolves cleanly.

Verification

Before:

$ yarn build:esm && yarn test:esm-smoke
FAIL  dist/esm/src/index.js
        ERR_MODULE_NOT_FOUND  Cannot find module '.../NetworkUtils'
FAIL  dist/esm/src/arch/evm/BlockUtils.js
        ERR_MODULE_NOT_FOUND  Cannot find module '.../NetworkUtils'
... 13 more failures ...

After:

$ yarn build:esm && yarn test:esm-smoke
OK    dist/esm/src/index.js
OK    dist/esm/src/addressAggregator/index.js
OK    dist/esm/src/arch/evm/BlockUtils.js
OK    dist/esm/src/arch/svm/BlockUtils.js
OK    dist/esm/src/arch/svm/SpokeUtils.js
OK    dist/esm/src/arch/svm/eventsClient.js
OK    dist/esm/src/clients/HubPoolClient.js
OK    dist/esm/src/clients/mocks/MockEvents.js
OK    dist/esm/src/clients/mocks/MockSpokePoolClient.js
OK    dist/esm/src/clients/mocks/MockSvmCpiEventsClient.js
OK    dist/esm/src/contracts/index.js
OK    dist/esm/src/merkleDistributor/model/index.js
OK    dist/esm/src/priceClient/index.js
OK    dist/esm/src/providers/cachedProvider.js
OK    dist/esm/src/providers/utils.js
OK    dist/esm/src/typechain.js

All 16 entry points imported cleanly.

yarn build:cjs still produces a working CJS bundle (sanity-loaded BlockUtils.js from dist/cjs). yarn build:types clean. yarn lint-check clean.

What this does NOT change

• No source API changes; same exported surface from every module touched.
• No version bump (release-time concern).
• CJS consumers unaffected — build:cjs doesn't run the post-build script, and source-level changes (default-import-and-destructure, bare-import .js suffix, require.main guard) are all CJS-safe.
• The post-build rewriter only touches relative paths. Bare-package deep imports must be authored with .js in source — enforceable later with a lint rule if desired.

Follow-ups (not in this PR)

• Wire test:esm-smoke into CI so this can't silently regress.
• An eslint rule banning extension-less bare-package deep imports would close the door on the one source pattern this PR can't auto-enforce.
• Once released, across-protocol/dapp can drop the lazy-mount workaround opened in across-protocol/dapp #344 and depend on this fix directly.

🤖 Generated with Claude Code

[0xjorgen]

Superseded by #1452 — same branch, opened from across-protocol/sdk:jorgen/sdk-esm-node-importable instead of the fork so the existing [push]-triggered CI workflows run. (The new pr.yml in this branch also runs on cross-fork PRs going forward, but the cleaner long-term path is in-repo branches.)