fix(post-release): split CJS smoke into resolve (bridge-off) + require (default) to end engines-contract false failure

[sophiej-story]

Summary

Closes #135. The post-release "Smoke: CJS imports" gate failed for @piplabs/cdr-crypto and @piplabs/cdr-sdk with ERR_REQUIRE_ESM: require() of ES Module @noble/hashes/hkdf.js — a false failure. Two of our own gates disagreed:

• cdr-crypto pins @noble/hashes@2.0.1 (ESM-only), so the CJS build loads it via Node's require(esm) bridge —
• But the smoke step set NODE_OPTIONS=--no-experimental-require-module, disabling that bridge to protect "consumers on Node <20.19" — a runtime the engines field already excludes, and whose rationale expired when Node 20 hit EOL (April 2026).

The dual-publish itself is fine: on every runtime engines admits, plain require("@piplabs/cdr-sdk") works. Only the gate was wrong.

Fix (issue Option 1)

Split the single step into two correctly-configured phases, so the gate tests what real consumers hit while keeping the regression it was built for:

• Phase 1 — require.resolve(), bridge OFF. Keeps --no-experimental-require-module. Resolves the CJS entry without executing it, so it never touches the ESM-only transitive dep. Still fails loudly if a package loses its CJS entry (ships ESM-only with no exports.require).
• Phase 2 — require(), default Node options (bridge ON). Actually requires the package the way a consumer on a supported runtime does. The ESM-only transitive dep loads via the bridge.

Row output now prefixes failures with resolve: / require: so a red gate says which phase broke.

Test plan

• YAML parses; step-level NODE_OPTIONS env removed; cjs_smoke id + rows output preserved (summary section unchanged)
• Local reproduction against the published 0.2.2 tarballs (@piplabs/cdr-{contracts,crypto,sdk}):
• Dispatch post-release-integration.yml from this branch against version=0.2.2 — expect the CJS smoke green

Notes

• Fix is entirely in the workflow (the test harness), not the package — so it validates against the already-published 0.2.2; no republish required.
• The --no-experimental-require-module flag on Phase 1 is spec-per-issue but functionally vestigial: require.resolve() is unaffected by the bridge flag. Kept to document intent and match the issue's recommendation.
• The verify job's Node 20 pin (still >=20.19) remains correct — Phase 2 depends on the bridge being on by default, which that line provides.

[jinn-agent]

The two-phase split is logically sound. Phase 1 correctly scopes NODE_OPTIONS to the single command invocation (not the whole step), continue properly skips Phase 2 when Phase 1 fails, and the ROWS/FAILED labeling correctly distinguishes resolve: vs require: failures.

One minor gap: the Upload verify diagnostics on failure step (not changed here) lists smoke.cjs in its path: glob but not resolve.cjs. If Phase 1 causes the step to fail, the new helper script won't be included in the uploaded artifact, making post-failure debugging harder. Worth adding ${{ env.INSTALL_DIR }}/resolve.cjs to that artifact path in a follow-up.

No high-confidence correctness, security, or reliability issues found in the changed lines.

---

Review iteration 1 · Commit 6ac1082 · 2026-07-21T09:23:10Z

[wo-o]

No issues found — see summary comment.