[jthorupp]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Related bundle-size and ESM work: #1877, #1972, and #1885.

Describe the solution you've provided

Build @launchdarkly/akamai-edgeworker-sdk-common with tsup to publish both ESM and CommonJS JavaScript and declarations. Add conditional exports and sideEffects: false so ESM consumers, including the Akamai EdgeKV SDK's Rollup build, can analyze named imports instead of traversing CommonJS re-export wrappers. Retain the existing CommonJS dist/index.js entry and package type. No new runtime dependencies.

Add a build-specific TypeScript configuration using bundler resolution, and update clean to remove all generated outputs. Source maps retain mappings without embedding source contents, matching the server-common build pattern.

Make CryptoJS subpath imports explicitly include .js and access Akamai's crypto export through a namespace import. These compatibility fixes preserve the shared package's previously passing Node ESM import check without changing how random values are obtained on Akamai. Add a unit test verifying that random identifier generation uses the mocked Akamai crypto.getRandomValues export.

Rebuilding the Akamai EdgeKV SDK with the same locally installed dependencies before and after the change produced the following sizes. After sizes include the follow-up ESM compatibility fixes:

Artifact	Before (bytes)	After (bytes)	Reduction
ESM raw	212,462	198,488	13,974 (6.6%)
ESM gzip (level 9)	60,452	57,327	3,125 (5.2%)
CJS raw	212,074	199,891	12,183 (5.7%)
CJS gzip (level 9)	60,225	57,703	2,522 (4.2%)

Downstream EdgeWorker measurements

A downstream Akamai EdgeWorker application was rebuilt using the locally built SDK packages in place of published SDK version 1.4.51. Application source and bundler settings were unchanged: tsup, ESM output, ES2022 target, minification and tree shaking enabled.

Worker artifact	Published SDK (bytes)	Local SDK build (bytes)	Reduction
JavaScript bundle, raw	230,018	200,102	29,916 (13.0%)
JavaScript bundle, gzip (Node default compression)	67,996	59,535	8,461 (12.4%)
Deployment archive	68,427	59,954	8,473 (12.4%)

The published-SDK rebuild reproduced the baseline bundle byte-for-byte, and a repeat build with the local SDK produced the same JavaScript size. Archive sizes varied by a few bytes with metadata. These are measurements from one downstream application, not a guarantee of savings for every consumer. Initialization CPU time and Akamai runtime performance were not measured.

Describe alternatives you've considered

The Akamai EdgeKV SDK already minifies with Terser. Changing its public entry point or replacing SDK functionality in the worker would be broader changes; this experiment retains its existing bundled output and uses ESM at the shared-package boundary. Publishing ESM does not guarantee unused client methods can be removed, because functionality reachable through init still needs to be retained.

Additional context

Validation performed locally on Node v24.22.1:

• yarn workspaces foreach -pR --topological-dev --from '@launchdarkly/akamai-server-edgekv-sdk' run build — passed.
• yarn workspace @launchdarkly/akamai-edgeworker-sdk-common test — passed: 9 suites, 45 tests, including the new Akamai crypto regression test.
• yarn workspace @launchdarkly/akamai-server-edgekv-sdk test — passed: 2 suites, 9 tests.
• yarn workspace @launchdarkly/akamai-edgeworker-sdk-common lint — passed with existing test warnings.
• yarn workspace @launchdarkly/akamai-edgeworker-sdk-common format:check — passed.
• yarn workspace @launchdarkly/akamai-server-edgekv-sdk lint — passed with an existing unused catch-variable warning.
• yarn workspace @launchdarkly/akamai-server-edgekv-sdk format:check — passed.
• git diff --check — passed.
• Packed-package compatibility: invoked the repository's scripts/package-config-tests/suites/types.js, runtime.js, and attw.js through a session-local helper against six relevant packed packages (Akamai shared and EdgeKV, common, server-common, Node server, and eventsource), installed into isolated consumer projects. All 144 TypeScript cases, 42 runtime/import/bundling cases, and 28 declaration-analysis cases matched their checked-in baselines. This includes TypeScript 5.0.4, 5.9.3, and 6.0.3. Baselines include known failures; matching the baseline does not mean every case passes. No baselines were changed. This was a targeted subset, not the full repository-wide package-config matrix.
• Downstream application build and existing unit tests — passed. Those tests mock the LaunchDarkly client and do not establish real flag-evaluation equivalence.
• Generated downstream bundles passed JavaScript syntax checks and loaded in a Node VM with mocked Akamai built-ins for a basic request smoke test.

CommonJS and ESM imports of the packed shared Akamai package now match the passing runtime baseline, and all conditional export targets exist. The EdgeKV Rollup build successfully consumes the new ESM entry. No Akamai runtime deployment or full supported-platform matrix was exercised. The PR's package-config workflow requires maintainer approval before it can run on this fork.

---

Note

Overview
Replaces tsc with tsup so @launchdarkly/akamai-edgeworker-sdk-common ships ESM and CJS (dist/index.mjs / dist/index.js) plus conditional exports, module, and sideEffects: false so ESM consumers can tree-shake instead of pulling the whole CommonJS surface.

Adds tsconfig.build.json (bundler resolution) and tsup.config.ts (dual format, DTS, source maps without embedded sources). Clean now wipes dist entirely.

Crypto compatibility for the new bundle: CryptoJS imports use explicit .js subpaths, and Akamai’s runtime crypto is read via a namespace import as AkamaiCrypto.crypto.getRandomValues (same random-ID behavior). A Jest mock + unit test locks that path.

^{Reviewed by Cursor Bugbot for commit 0e971c8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jthorupp]

A few items to verify before merging:

• Approve and run the full PR CI, especially the published-package compatibility matrix. The targeted local checks matched the existing baselines, but do not replace the full matrix.
• Confirm whether deep imports into this package are supported. Adding the root exports map restricts previously accessible subpaths; if consumers rely on them, we should preserve the supported paths or handle this as a compatibility change.
• Verify the built SDK in the Akamai runtime, covering initialization, EdgeKV reads, flag evaluation (including rollouts and segments), and flushing when events are enabled. The local tests and mocked downstream smoke test do not establish real Akamai runtime equivalence.

The measured bundle-size reduction looks useful; these checks are about confirming packaging and runtime compatibility before landing it.

[joker23]

Thanks @jthorupp for the contribution! I just have a few minor comments.

[joker23]

Thanks again @jthorupp - your fix should be live in the next release batch