@ethisyscore/vite-plugin 1.110.0 → 1.112.0

package/dist/index.d.cts

@@ -399,12 +399,20 @@ declare function parsePlatformReactPages(manifestPath: string, options?: ParsePl
  */
 declare const PLATFORM_REACT_EXTERNALS: readonly string[];
 /**
- * Bundled deps that MUST resolve to a single copy. When a bundled dep (e.g.
- * `@tanstack/react-query`) is imported by BOTH the plugin's own hooks and the
- * SDK foundation (aliased cross-repo to a sibling `dist`), the bundler otherwise
- * resolves two copies — one per repo's `node_modules`. Two module instances =
- * two React contexts, so a provider in one is invisible to a consumer in the
- * other (the classic "No QueryClient set"). Pin them to one copy.
+ * Bundled deps that MUST resolve to a single copy. When a bundled dep is
+ * imported by BOTH the plugin's own hooks and the SDK foundation (aliased
+ * cross-repo to a sibling `dist`), the bundler otherwise resolves two copies —
+ * one per repo's `node_modules`. Two module instances = two React contexts, so
+ * a provider in one is invisible to a consumer in the other (the classic
+ * "No QueryClient set"). Pin them to one copy.
+ *
+ * `@tanstack/react-query` was the worked example of that failure and used to
+ * head this list. It is now a host external instead, which is strictly stronger:
+ * an external is never resolved into the bundle from any `node_modules` at all,
+ * so the two-copies-in-one-bundle case dedupe existed to prevent cannot arise.
+ * The entry would be inert, not protective — Vite's `resolve.dedupe` only steers
+ * resolution of specifiers that are actually being bundled. Keeping it would
+ * read as though it were still load-bearing.
  */
 declare const PLATFORM_REACT_DEDUPE: readonly string[];
 /** A `resolve.alias` entry (string or regex find), as Vite accepts. */

package/dist/index.d.ts

@@ -399,12 +399,20 @@ declare function parsePlatformReactPages(manifestPath: string, options?: ParsePl
  */
 declare const PLATFORM_REACT_EXTERNALS: readonly string[];
 /**
- * Bundled deps that MUST resolve to a single copy. When a bundled dep (e.g.
- * `@tanstack/react-query`) is imported by BOTH the plugin's own hooks and the
- * SDK foundation (aliased cross-repo to a sibling `dist`), the bundler otherwise
- * resolves two copies — one per repo's `node_modules`. Two module instances =
- * two React contexts, so a provider in one is invisible to a consumer in the
- * other (the classic "No QueryClient set"). Pin them to one copy.
+ * Bundled deps that MUST resolve to a single copy. When a bundled dep is
+ * imported by BOTH the plugin's own hooks and the SDK foundation (aliased
+ * cross-repo to a sibling `dist`), the bundler otherwise resolves two copies —
+ * one per repo's `node_modules`. Two module instances = two React contexts, so
+ * a provider in one is invisible to a consumer in the other (the classic
+ * "No QueryClient set"). Pin them to one copy.
+ *
+ * `@tanstack/react-query` was the worked example of that failure and used to
+ * head this list. It is now a host external instead, which is strictly stronger:
+ * an external is never resolved into the bundle from any `node_modules` at all,
+ * so the two-copies-in-one-bundle case dedupe existed to prevent cannot arise.
+ * The entry would be inert, not protective — Vite's `resolve.dedupe` only steers
+ * resolution of specifiers that are actually being bundled. Keeping it would
+ * read as though it were still load-bearing.
  */
 declare const PLATFORM_REACT_DEDUPE: readonly string[];
 /** A `resolve.alias` entry (string or regex find), as Vite accepts. */

package/dist/index.js

@@ -938,10 +938,42 @@ var PLATFORM_REACT_EXTERNALS = [
   "date-fns",
   "@ethisyscore/components-react",
   "@ethisyscore/extension-runtime",
-  "@ethisyscore/extension-runtime/plugin"
+  "@ethisyscore/extension-runtime/plugin",
+  // Externalised, not bundled, and not merely to save weight: bundling it gave
+  // every page its OWN `QueryClient`, so a mutation on the detail page
+  // invalidated a cache the list page could not see and a deleted row survived
+  // until a browser reload. One host-realm module instance is one cache across
+  // every plugin surface.
+  //
+  // Requires a host whose `hostModuleRegistry` serves this specifier: an external
+  // the deployed host does NOT register is an unresolvable bare import, and the
+  // bundle fails to load before any plugin code runs. That is the whole reason
+  // the host ships first and plugins rebuild last. The SDK's fallback (see
+  // `useSurfaceQueryClient` in plugin-ui) covers the softer case — module served,
+  // no client in scope — and cannot cover this one.
+  //
+  // THE SECOND GATE, and it binds each plugin rather than the estate: one cache
+  // means one KEY SPACE, so two owners using the same key now read each other's
+  // entry. Measured across the estate before this change: `["currencies"]` is
+  // used verbatim by coreconnect-web, bf-hr and bf-legal, from a copied
+  // `useCurrencies.ts` — three owners, one key, previously harmless only because
+  // each bundle had a cache of its own.
+  //
+  // A plugin therefore joins the shared cache the moment it is REBUILT on this
+  // SDK, and must have owner-namespaced its keys first. That ordering is the
+  // enforcement point and it is per plugin: a plugin not yet rebuilt still has
+  // its own cache and is unaffected, so this can be rolled out one plugin at a
+  // time rather than estate-wide.
+  //
+  // The ORGANISATION axis needs nothing here, and that was checked rather than
+  // assumed: coreconnect-web's AuthContext calls `queryClient.clear()` on logout
+  // AND on a live org switch between two non-null tenants, then bumps the
+  // authority epoch to force a remount. Plugins sharing that client inherit both.
+  // Sharing is in fact stricter than the status quo, where a plugin's private
+  // cache is unreachable by the host's teardown.
+  "@tanstack/react-query"
 ];
 var PLATFORM_REACT_DEDUPE = [
-  "@tanstack/react-query",
   "react",
   "react-dom",
   "@ethisyscore/extension-runtime"