perf(sdk): load on-chain program clients and eth contracts lazily

[dylanjeffers]

Part of moving crypto code off the app's startup path.

Problem

createSdkWithServices eagerly constructed ClaimableTokensClient, RewardManagerClient, PaymentRouterClient and EthereumService. That statically pulled @audius/spl → @coral-xyz/anchor, buffer-layout, borsh and all 9 @audius/eth ABIs into the web entry chunk for every visitor, including signed-out ones.

Change

• Lazy stand-ins. LazyClaimableTokensClient, LazyRewardManagerClient, LazyPaymentRouterClient and LazyEthereumService implement each client's public interface. The compiler enforces this through implements PublicInterface<Client>.
  • The first method call dynamically imports and constructs the real client with the same config, then hands the call over.
  • Concurrent first calls share one load. A failed load isn't cached, so the next call retries.
  • Synchronous members are served without loading: RewardManagerClient.lookupTable and each eth contract's address come from config, and watchEvent returns its unwatch function synchronously.
• sideEffects field in packages/sdk/package.json. It lists only sdkBrowserDist.ts and dist/sdk.min.js. This was required: without it, the export * from './services' re-exports kept anchor in the bundle even with the stand-ins.
• Minor changeset. For the default services:
  • they're no longer instanceof their client classes (nothing in the monorepo checks this);
  • ethereum.<contract>.abi throws until that contract has been used (nothing in the monorepo reads it);
  • a bad config now fails on first use instead of when the SDK is created.

Apps that pass their own clients via config.services are unaffected. SolanaClient and the viem eth clients are unchanged.

Impact (web entry chunk)

5,762 → 5,489 kB minified (−273 kB), 1,567 → 1,510 kB gzip. anchor, @audius/spl, buffer-layout, @coral-xyz/borsh and the @audius/eth ABIs are no longer in the entry chunk.

Follow-ups

• solanaClient.connection is read synchronously in about 30 places across common and web, which keeps @solana/web3.js tied to the SDK. Next step: add an async getConnection(), then make SolanaClient lazy.
• SolanaAddress/PublicKeySchema validation uses new PublicKey(). A base58 32-byte check would do the same job without it.

Test plan

• SDK typecheck, full vitest suite (224 passed), npm run build
• New tests: nothing loads before the first call, concurrent first calls load once, errors propagate and the next call retries, sync members work before loading, the stand-in isn't mistaken for a promise
• Mobile typecheck
• Web smoke test: claim a reward, send a tip, buy a USDC track (exercises all three program clients)
• protocol-dashboard / staking flows if they consume the default ethereum service

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 1e5e238

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@audius/sdk	Minor
@audius/sdk-legacy	Patch
@audius/protocol-dashboard	Patch
@audius/sp-actions	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[socket-security]

Dependency limit exceeded — report not shown.

This pull request scan exceeded the 10,000-dependency limit applied to this scan, so the results are incomplete and may be inaccurate. To avoid reporting false positives, Socket has not posted a report.

Upgrade your plan to raise the dependency limit and get complete reports, or view the partial scan in the dashboard.

Socket is always free for open source. If this is a non-commercial open source project, contact us to request a free Team account.