-
feat(ts): drop CommonJS support (#3494)
发布于
2026-06-19 18:22:17 +00:00 This PR moves the TypeScript SDK support floor to the latest Node.js 22
release and uses that as the point where we stop carrying custom
CommonJS compatibility machinery. The e2e runtime coverage now exercises
the latest Node 22, Node 24, and Node 25 lines, so the SDK is tested
against the minimum supported version and the newer runtimes users are
likely to adopt next.Because the SDK packages are still on
0.x, the accompanying changeset
usesminorbumps while calling out that this is a breaking change
inside the existing 0.x line.It also moves pnpm under mise on this Node 22 layer. That belongs here,
not in #3493, because the pinnedpnpm@10.28.2requires Node.js
>=22.13. Removing Corepack is intentional: Node.js documents that
Corepack is no longer distributed starting with Node.js v25, so relying
oncorepack enablewould keep a toolchain dependency that is already
on the way out of the Node distribution.What changed
- Pins the local/toolchain Node.js floor to
22.22.3inmise.toml,
mise.lock,toolchain-versions.json, and rootdevEngines. - Pins pnpm in
mise.tomlas"npm:pnpm" = "10.28.2"and makes mise
the single source of truth for the pnpm version. Removes the root
packageManager/devEngines.packageManagerCorepack pin entirely
(rather than keeping a second copy of the version that could drift) and
removes stalepackageManagermetadata from real TS packages/examples
and generators. - Sets
dangerouslyDisablePackageManagerCheck: trueinturbo.jsoncso
Turbo discovers pnpm frompnpm-lock.yamlinstead of requiring a
packageManagerfield. Without this, Turbo fails workspace resolution
(Could not resolve workspaces -> Missing 'packageManager' field),
which is the only reason the field would otherwise need to stay. - Replaces
corepack enablein the shared setup action with
mise-managed pnpm. The E2E Docker images install bun + pnpm directly
frommise.toml/mise.lock(with
dangerouslyDisablePackageManagerCheck-style separation: Node/Deno stay
on the base image as the test matrix axis and are disabled via
MISE_DISABLE_TOOLSso mise does not shadow them; the tool binaries are
symlinked into/usr/local/bin). NoBUN_VERSION/PNPM_VERSIONbuild
args are threaded from the host anymore, and bun+pnpm now carry
mise.lockchecksum verification. - Extends the install-time toolchain check to validate pnpm against mise
alongside Bun. - Sets the Node E2E matrix and install fallback checks to
22.22.3,
24.16.0, and25.9.0. - Makes TS package builds ESM-only:
tsdownnow emits.mjs/.d.mts
only and uses the ATTWesm-onlyprofile. - Removes explicit
require/.cjs/.d.ctspackage export paths
and internal import mappings from the public TS SDK packages. - Marks public TS SDK packages as
type: modulewhere they were missing
it. - Replaces the remaining runtime
require('pusher-js')with dynamic ESM
import. - Deletes the legacy CJS example.
- Reintroduces
node/cjs-basicas a modern Noderequire(esm)interop
E2E: it verifiesrequire('@composio/core')works through Node's native
ESM loader on Node 22, 24, and 25 while resolving todist/index.mjs,
not a.cjsartifact. - Removes
.cjs/.ctshandling from example validation and CLI
project-language detection. - Updates provider scaffolding so newly generated providers are
ESM-only. - Adds a minor changeset warning that CommonJS callers can only rely on
Node's nativerequire(esm)interop and that custom CommonJS
compatibility machinery is gone.
Bundled behavior changes
Two changes here are technically independent of the CommonJS removal but
ride along because they touch the same files and ship in the same
release cut. Calling them out explicitly so they are not missed in
review:PusherUtilsrealtime channel auth (@composio/core). Replacing
the runtimerequire('pusher-js')with a dynamic ESMimport()was
done alongside conformingchannelAuthorizationto pusher-js's typed
customHandler(params, callback)contract. The previous(authOptions) => Promiseshape did not match pusher-js's actual calling convention —
it readendpoint/headers/paramsoff an argument that pusher-js
never passes — so this also fixes that latent mismatch. New unit tests
(ts/packages/core/test/utils/pusher.test.ts) cover the auth request
shape (endpoint,x-api-keyheader, JSONsocket_id/channel_name
body) and the success / invalid-JSON / network-failure callback paths.- CLI meta-tool slug list (
@composio/cli). Drops
COMPOSIO_UPSERT_RECIPEandCOMPOSIO_GET_RECIPEfrom
META_TOOL_SLUG_LISTintools-executor.ts;@composio/client
alpha.74 removed those slugs from theSessionExecuteMetaParams['slug']
union. The list is declaredsatisfies ReadonlyArray<SessionExecuteMetaParams['slug']>, so this is enforced at
compile time (pnpm typecheck) — keeping the stale slugs would be a
type error — and needs no separate runtime test.
Verification
- Verified latest Node 22/24/25 releases from the official Node dist
index:22.22.3,24.16.0,25.9.0
(https://nodejs.org/dist/index.json). - Verified Node docs state Corepack is no longer distributed starting
with Node.js v25:
https://nodejs.org/download/release/v22.22.3/docs/api/corepack.html mise exec -- pnpm --version->10.28.2mise exec -- pnpm install --frozen-lockfilemise exec -- bun run ts/scripts/pre-install/check-toolchain.tsmise exec -- pnpm --filter @e2e-tests/utils typecheckmise exec -- pnpm --filter @e2e-tests/node-cjs-basic typecheckmise exec -- pnpm --filter @e2e-tests/node-cjs-basic test:e2e:nodemise exec -- pnpm --filter @e2e-tests/node-esm-basic typecheckmise exec -- pnpm --filter @composio/cli typecheckmise exec -- pnpm --filter @composio/cli test -- --runInBandmise exec -- pnpm --filter @composio/core typecheckmise exec -- pnpm --filter @composio/core exec vitest run test/utils/pusher.test.tsmise exec -- pnpm run build:packagesmise exec -- turbo run build --dry-runresolves all workspace
packages with no rootpackageManagerfield (pnpm discovered from
pnpm-lock.yaml).mise exec -- pnpm --filter @composio/cli exec vitest run test/src/services/project-environment-detector.test.tsmise exec -- pnpm exec prettier --check ...docker build -f ts/e2e-tests/_utils/Dockerfile.node --build-arg NODE_VERSION=24.16.0 -t composio-e2e-node:misecheck .(also
Dockerfile.denowithDENO_VERSION=2.6.7 NODE_MAJOR=22) — both build
green; runtime resolves Node/Deno from the base image and pnpm 10.28.2 /
bun 1.3.10 from mise.docker manifest inspect node:24.16.0-slimdocker manifest inspect node:25.9.0-slimbash -n ts/scripts/create-provider.sh && git diff --checkruby -e "require 'yaml'; YAML.load_file('.github/workflows/ts.test-e2e.yml')"- Tracked example validation in a clean temporary tree:
Validated 21 example packages.
下载附件
- Pins the local/toolchain Node.js floor to