> ## Documentation Index
> Fetch the complete documentation index at: https://docs.goldsky.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Packages

> Use npm packages such as viem inside Compose tasks, with bundling guidance and sandbox limitations.

## Overview

Compose apps are bundled with esbuild and run in secure, auditable sandboxes. The sandboxes disallow OS, filesystem, and direct networking activity.
To make external HTTP requests, use the provided [fetch](./context/fetch) function.

Because tasks are bundled with esbuild (not resolved by Deno), you can use any packages installed via npm, yarn, or pnpm. Native Node.js packages, or packages that rely on direct filesystem or network access, will not work inside the sandbox.

To use third-party packages:

1. Make sure your project has a `package.json` (run `npm init -y` if it doesn't).
2. Install packages with your preferred package manager (`npm install viem`, `yarn add viem`, etc.).
3. Import using bare specifiers in your task files (e.g. `import { keccak256 } from "viem"`).

<Note>
  Packages must be installed in `node_modules/`: esbuild resolves imports from there, not from Deno's module cache. Do **not** use Deno-style `npm:` prefixes (e.g. `"npm:viem"`) or URL imports like `https://deno.land/std@.../...` in task files; they won't resolve at bundle time.
</Note>

You can import libraries like viem for more customized functionality. If you use HTTP-enabled functions from viem, you'll need to specify a custom transport backed by the built-in [compose fetch](./context/fetch). The standard viem transports can't reach the network from inside the sandbox. Otherwise, you can use utility functions the same way you would in any TypeScript app.

## npm packages in dashboard deploys

Deploying from the dashboard (editing an app in the browser) supports a fixed allowlist of npm packages:

* `viem`
* `ethers`
* `gill`
* `@solana/web3.js`
* `@solana/spl-token`
* `@noble/hashes`
* `@noble/curves`
* `bs58`
* `zod`
* `bignumber.js`

Versions come from your app's `package.json`. Any package outside the allowlist fails with a `cli-only-package` error; deploy with the CLI instead, which bundles any sandbox-compatible package.

HTTP client packages such as `axios`, `node-fetch`, and `got` are deliberately left off the allowlist. All network access from a task must go through [`ctx.fetch`](./context/fetch), so they cannot reach the network from inside the sandbox either way.

## Example

```typescript theme={"dark"}
import { TaskContext } from "compose";

import {
  concat,
  keccak256,
  stringToHex,
  numberToHex,
} from "viem";

export async function main({ evm, env }: TaskContext) {
  const assetPair = "BTC-USD";
  const durationInSeconds = 3600;
  const startTimestamp = Math.floor(Date.now() / 1000);

  // use viem utilities to compute a deterministic id
  const resultId = keccak256(
    concat([
      stringToHex("CANDLE", { size: 32 }),
      stringToHex(assetPair, { size: 32 }),
      numberToHex(durationInSeconds, { size: 32 }),
      numberToHex(startTimestamp, { size: 32 }),
    ])
  );

  console.log(resultId);
}
```

## Next Steps

<CardGroup cols={2}>
  <Card title="Debugging" icon="code" href="./debugging">
    Debug and monitor your apps
  </Card>

  <Card title="Deploying your App" icon="file-code" href="./deploy-monitor">
    Learn about deploying your app to the cloud for production use cases.
  </Card>
</CardGroup>


## Related topics

- [Compose task triggers: cron, HTTP, and onchain](/compose/task-triggers.md)
- [Task to Task Execution (callTask)](/compose/context/call-task.md)
- [Environment variables (env)](/compose/context/env.md)
- [Solana Transactions with Gill](/compose/guides/solana-transactions.md)
- [Deploy a subgraph](/subgraphs/deploying-subgraphs.md)