every-plugin 3.0.0-rc.0 → 3.0.0-rc.3

package/dist/runtime/services/plugin-loader.service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-loader.service.mjs","names":[],"sources":["../../../src/runtime/services/plugin-loader.service.ts"],"sourcesContent":["import type { InferSchemaInput, InferSchemaOutput } from \"@orpc/contract\";\nimport { Context, Effect, Exit, Layer, Scope } from \"effect\";\nimport type { z } from \"zod\";\nimport { PluginIdTag } from \"../../plugin\";\nimport type {\n  AnyPlugin,\n  AnyPluginConstructor,\n  InitializedPlugin,\n  LoadedPlugin,\n  PluginInstance,\n  PluginMetadata,\n  PluginRegistry,\n} from \"../../types\";\nimport { PluginRuntimeError, toPluginRuntimeError } from \"../errors\";\nimport { validate } from \"../validation\";\nimport { ModuleFederationService } from \"./module-federation.service\";\nimport { SecretsService } from \"./secrets.service\";\n\nexport class PluginRegistryTag extends Context.Service<PluginRegistryTag, PluginRegistry>()(\n  \"PluginRegistry\",\n) {}\n\nexport class PluginMapTag extends Context.Service<\n  PluginMapTag,\n  Record<string, AnyPluginConstructor>\n>()(\"PluginMap\") {}\n\nexport interface RegistryServiceShape {\n  get: (\n    pluginId: string,\n  ) => Effect.Effect<\n    { constructor: (new () => AnyPlugin) | null; metadata: PluginMetadata },\n    PluginRuntimeError\n  >;\n  getModule: (pluginId: string) => Effect.Effect<AnyPluginConstructor | null>;\n}\n\nexport class RegistryService extends Context.Service<RegistryService, RegistryServiceShape>()(\n  \"RegistryService\",\n) {}\n\nexport const RegistryServiceDefault = Layer.effect(\n  RegistryService,\n  Effect.gen(function* () {\n    const registry = yield* PluginRegistryTag;\n    const pluginMap = yield* PluginMapTag;\n\n    return {\n      get: (pluginId: string) =>\n        Effect.gen(function* () {\n          const entry = registry[pluginId];\n\n          if (!entry) {\n            return yield* new PluginRuntimeError({\n              pluginId,\n              operation: \"validate-plugin-id\",\n              cause: new Error(`Plugin ${pluginId} not found in registry`),\n            });\n          }\n\n          if (\"module\" in entry) {\n            return {\n              constructor: entry.module,\n              metadata: {\n                remoteUrl: entry.remote || \"\",\n                version: entry.version,\n                description: entry.description,\n              } as PluginMetadata,\n            };\n          }\n\n          return {\n            constructor: null,\n            metadata: {\n              remoteUrl: entry.remote,\n              version: entry.version,\n              description: entry.description,\n            } as PluginMetadata,\n          };\n        }),\n\n      getModule: (pluginId: string) => Effect.succeed(pluginMap[pluginId] || null),\n    };\n  }),\n);\n\nexport interface PluginLoaderServiceShape {\n  loadPlugin: (pluginId: string) => Effect.Effect<LoadedPlugin, PluginRuntimeError>;\n  instantiatePlugin: <T extends AnyPlugin>(\n    pluginId: string,\n    loadedPlugin: LoadedPlugin<T>,\n  ) => Effect.Effect<PluginInstance<T>, PluginRuntimeError>;\n  initializePlugin: <T extends AnyPlugin>(\n    pluginInstance: PluginInstance<T>,\n    config: {\n      variables: InferSchemaInput<T[\"configSchema\"][\"variables\"]>;\n      secrets: InferSchemaInput<T[\"configSchema\"][\"secrets\"]>;\n    },\n    plugins?: Record<string, unknown>,\n  ) => Effect.Effect<InitializedPlugin<T>, PluginRuntimeError>;\n}\n\nexport class PluginLoaderService extends Context.Service<\n  PluginLoaderService,\n  PluginLoaderServiceShape\n>()(\"PluginLoaderService\") {}\n\nexport const PluginLoaderServiceDefault = Layer.effect(\n  PluginLoaderService,\n  Effect.gen(function* () {\n    const moduleFederationService = yield* ModuleFederationService;\n    const secretsService = yield* SecretsService;\n    const registryService = yield* RegistryService;\n\n    const resolveUrl = (baseUrl: string, version?: string): string =>\n      version && version !== \"latest\" ? baseUrl.replace(\"@latest\", `@${version}`) : baseUrl;\n\n    return {\n      loadPlugin: (pluginId: string) =>\n        Effect.gen(function* () {\n          const entry = yield* registryService.get(pluginId);\n\n          if (entry.constructor) {\n            yield* Effect.logDebug(\"Loading plugin from direct module\", { pluginId });\n\n            return {\n              ctor: entry.constructor,\n              metadata: entry.metadata,\n            } satisfies LoadedPlugin;\n          }\n\n          const url = entry.metadata.remoteUrl;\n          if (!url) {\n            return yield* new PluginRuntimeError({\n              pluginId,\n              operation: \"load-plugin\",\n              cause: new Error(`Plugin ${pluginId} has no module or remote URL configured`),\n            });\n          }\n\n          const resolvedUrl = resolveUrl(url);\n\n          yield* moduleFederationService.registerRemote(pluginId, resolvedUrl).pipe(\n            Effect.tapError((error) =>\n              Effect.logError(`Plugin ${pluginId} failed during register-remote: ${String(error)}`),\n            ),\n            Effect.mapError((error) =>\n              toPluginRuntimeError(error, pluginId, undefined, \"register-remote\"),\n            ),\n          );\n\n          yield* Effect.logDebug(\"Loading plugin from remote\", { pluginId, url: resolvedUrl });\n\n          const ctor = yield* moduleFederationService\n            .loadRemoteConstructor(pluginId, resolvedUrl)\n            .pipe(\n              Effect.tapError((error) =>\n                Effect.logError(`Plugin ${pluginId} failed during load-remote: ${String(error)}`),\n              ),\n              Effect.mapError((error) =>\n                toPluginRuntimeError(error, pluginId, undefined, \"load-remote\"),\n              ),\n            );\n\n          return {\n            ctor,\n            metadata: entry.metadata,\n          } satisfies LoadedPlugin;\n        }),\n\n      instantiatePlugin: <T extends AnyPlugin>(pluginId: string, loadedPlugin: LoadedPlugin<T>) =>\n        Effect.gen(function* () {\n          const instance = yield* Effect.try(() => new loadedPlugin.ctor()).pipe(\n            Effect.tapError((error) =>\n              Effect.logError(`Plugin ${pluginId} failed during instantiate-plugin: ${error}`),\n            ),\n            Effect.mapError((error) =>\n              toPluginRuntimeError(error, pluginId, undefined, \"instantiate-plugin\"),\n            ),\n          );\n\n          (instance.id as string) = pluginId;\n\n          return {\n            plugin: instance,\n            metadata: loadedPlugin.metadata,\n          } satisfies PluginInstance<T>;\n        }),\n\n      initializePlugin: <T extends AnyPlugin>(\n        pluginInstance: PluginInstance<T>,\n        config: {\n          variables: InferSchemaInput<T[\"configSchema\"][\"variables\"]>;\n          secrets: InferSchemaInput<T[\"configSchema\"][\"secrets\"]>;\n        },\n        plugins?: Record<string, unknown>,\n      ) =>\n        Effect.gen(function* () {\n          const { plugin } = pluginInstance;\n\n          // Validate and hydrate config\n          const validatedVariables = yield* validate(\n            plugin.configSchema.variables as z.ZodSchema<\n              InferSchemaOutput<T[\"configSchema\"][\"variables\"]>\n            >,\n            config.variables,\n            plugin.id,\n            \"config\",\n          ).pipe(\n            Effect.mapError(\n              (validationError) =>\n                new PluginRuntimeError({\n                  pluginId: plugin.id,\n                  operation: \"validate-config\",\n                  cause: validationError.zodError,\n                }),\n            ),\n          );\n\n          // Validate secrets\n          const validatedSecrets = yield* validate(\n            plugin.configSchema.secrets as z.ZodSchema<\n              InferSchemaOutput<T[\"configSchema\"][\"secrets\"]>\n            >,\n            config.secrets,\n            plugin.id,\n            \"config\",\n          ).pipe(\n            Effect.mapError(\n              (validationError) =>\n                new PluginRuntimeError({\n                  pluginId: plugin.id,\n                  operation: \"validate-secrets\",\n                  cause: validationError.zodError,\n                }),\n            ),\n          );\n\n          // Hydrate secrets in variables\n          const hydratedConfig = yield* secretsService.hydrateSecrets({\n            variables: validatedVariables,\n            secrets: validatedSecrets,\n          });\n\n          const _variables = yield* validate(\n            plugin.configSchema.variables as z.ZodSchema<\n              InferSchemaOutput<T[\"configSchema\"][\"variables\"]>\n            >,\n            hydratedConfig.variables,\n            plugin.id,\n            \"config\",\n          ).pipe(\n            Effect.mapError(\n              (validationError) =>\n                new PluginRuntimeError({\n                  pluginId: plugin.id,\n                  operation: \"validate-hydrated-config\",\n                  cause: validationError.zodError,\n                }),\n            ),\n          );\n\n          // Create a long-lived scope for this plugin instance. Initialize\n          // returns a Layer which is built against this scope, so scoped\n          // resources (DB pools, caches) release on plugin shutdown.\n          const scope = yield* Scope.make();\n\n          // Build the plugin's Layer within the scope.\n          // On failure, close the scope immediately so scoped resources\n          // (DB pools, caches) are released — otherwise every failed\n          // initialization leaks until the process exits.\n          const effectContext = yield* Effect.gen(function* () {\n            const layer = yield* plugin\n              .initialize({ variables: _variables, secrets: hydratedConfig.secrets }, plugins ?? {})\n              .pipe(\n                Effect.provideService(PluginIdTag, plugin.id),\n                Effect.provideService(Scope.Scope, scope),\n              );\n\n            return yield* Layer.buildWithScope(layer, scope).pipe(\n              Effect.provideService(PluginIdTag, plugin.id),\n              Effect.provideService(Scope.Scope, scope),\n              Effect.mapError((error) =>\n                toPluginRuntimeError(error, plugin.id, undefined, \"initialize-layer\"),\n              ),\n            );\n          }).pipe(\n            Effect.onExit((exit) =>\n              Exit.isSuccess(exit)\n                ? Effect.void\n                : Scope.close(scope, exit).pipe(\n                    Effect.catchCause((closeCause) =>\n                      Effect.logWarning(\n                        `Failed to close scope for plugin ${plugin.id} after initialize error`,\n                        closeCause,\n                      ),\n                    ),\n                  ),\n            ),\n            Effect.tapError((error) =>\n              Effect.logError(\n                `Plugin ${plugin.id} failed during initialize-plugin: ${String(error)}`,\n              ),\n            ),\n            Effect.mapError((error) =>\n              toPluginRuntimeError(error, plugin.id, undefined, \"initialize-plugin\"),\n            ),\n          );\n\n          return {\n            plugin,\n            metadata: pluginInstance.metadata,\n            config: { variables: _variables, secrets: hydratedConfig.secrets },\n            effectContext,\n            scope,\n          } satisfies InitializedPlugin<T>;\n        }),\n    };\n  }),\n);\n"],"mappings":";;;;;;;;AAkBA,IAAa,oBAAb,cAAuC,QAAQ,QAA2C,CAAC,CACzF,gBACF,CAAC,CAAC,CAAC;AAEH,IAAa,eAAb,cAAkC,QAAQ,QAGxC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAYlB,IAAa,kBAAb,cAAqC,QAAQ,QAA+C,CAAC,CAC3F,iBACF,CAAC,CAAC,CAAC;AAEH,MAAa,yBAAyB,MAAM,OAC1C,iBACA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO;CACxB,MAAM,YAAY,OAAO;CAEzB,OAAO;EACL,MAAM,aACJ,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,SAAS;GAEvB,IAAI,CAAC,OACH,OAAO,OAAO,IAAI,mBAAmB;IACnC;IACA,WAAW;IACX,uBAAO,IAAI,MAAM,UAAU,SAAS,uBAAuB;GAC7D,CAAC;GAGH,IAAI,YAAY,OACd,OAAO;IACL,aAAa,MAAM;IACnB,UAAU;KACR,WAAW,MAAM,UAAU;KAC3B,SAAS,MAAM;KACf,aAAa,MAAM;IACrB;GACF;GAGF,OAAO;IACL,aAAa;IACb,UAAU;KACR,WAAW,MAAM;KACjB,SAAS,MAAM;KACf,aAAa,MAAM;IACrB;GACF;EACF,CAAC;EAEH,YAAY,aAAqB,OAAO,QAAQ,UAAU,aAAa,IAAI;CAC7E;AACF,CAAC,CACH;AAkBA,IAAa,sBAAb,cAAyC,QAAQ,QAG/C,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAE5B,MAAa,6BAA6B,MAAM,OAC9C,qBACA,OAAO,IAAI,aAAa;CACtB,MAAM,0BAA0B,OAAO;CACvC,MAAM,iBAAiB,OAAO;CAC9B,MAAM,kBAAkB,OAAO;CAE/B,MAAM,cAAc,SAAiB,YACnC,WAAW,YAAY,WAAW,QAAQ,QAAQ,WAAW,IAAI,SAAS,IAAI;CAEhF,OAAO;EACL,aAAa,aACX,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,IAAI,QAAQ;GAEjD,IAAI,MAAM,aAAa;IACrB,OAAO,OAAO,SAAS,qCAAqC,EAAE,SAAS,CAAC;IAExE,OAAO;KACL,MAAM,MAAM;KACZ,UAAU,MAAM;IAClB;GACF;GAEA,MAAM,MAAM,MAAM,SAAS;GAC3B,IAAI,CAAC,KACH,OAAO,OAAO,IAAI,mBAAmB;IACnC;IACA,WAAW;IACX,uBAAO,IAAI,MAAM,UAAU,SAAS,wCAAwC;GAC9E,CAAC;GAGH,MAAM,cAAc,WAAW,GAAG;GAElC,OAAO,wBAAwB,eAAe,UAAU,WAAW,CAAC,CAAC,KACnE,OAAO,UAAU,UACf,OAAO,SAAS,UAAU,SAAS,kCAAkC,OAAO,KAAK,GAAG,CACtF,GACA,OAAO,UAAU,UACf,qBAAqB,OAAO,UAAU,QAAW,iBAAiB,CACpE,CACF;GAEA,OAAO,OAAO,SAAS,8BAA8B;IAAE;IAAU,KAAK;GAAY,CAAC;GAanF,OAAO;IACL,aAZkB,wBACjB,sBAAsB,UAAU,WAAW,CAAC,CAC5C,KACC,OAAO,UAAU,UACf,OAAO,SAAS,UAAU,SAAS,8BAA8B,OAAO,KAAK,GAAG,CAClF,GACA,OAAO,UAAU,UACf,qBAAqB,OAAO,UAAU,QAAW,aAAa,CAChE,CACF;IAIA,UAAU,MAAM;GAClB;EACF,CAAC;EAEH,oBAAyC,UAAkB,iBACzD,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,OAAO,UAAU,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC,KAChE,OAAO,UAAU,UACf,OAAO,SAAS,UAAU,SAAS,qCAAqC,OAAO,CACjF,GACA,OAAO,UAAU,UACf,qBAAqB,OAAO,UAAU,QAAW,oBAAoB,CACvE,CACF;GAEA,AAAC,SAAS,KAAgB;GAE1B,OAAO;IACL,QAAQ;IACR,UAAU,aAAa;GACzB;EACF,CAAC;EAEH,mBACE,gBACA,QAIA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,EAAE,WAAW;GAGnB,MAAM,qBAAqB,OAAO,SAChC,OAAO,aAAa,WAGpB,OAAO,WACP,OAAO,IACP,QACF,CAAC,CAAC,KACA,OAAO,UACJ,oBACC,IAAI,mBAAmB;IACrB,UAAU,OAAO;IACjB,WAAW;IACX,OAAO,gBAAgB;GACzB,CAAC,CACL,CACF;GAGA,MAAM,mBAAmB,OAAO,SAC9B,OAAO,aAAa,SAGpB,OAAO,SACP,OAAO,IACP,QACF,CAAC,CAAC,KACA,OAAO,UACJ,oBACC,IAAI,mBAAmB;IACrB,UAAU,OAAO;IACjB,WAAW;IACX,OAAO,gBAAgB;GACzB,CAAC,CACL,CACF;GAGA,MAAM,iBAAiB,OAAO,eAAe,eAAe;IAC1D,WAAW;IACX,SAAS;GACX,CAAC;GAED,MAAM,aAAa,OAAO,SACxB,OAAO,aAAa,WAGpB,eAAe,WACf,OAAO,IACP,QACF,CAAC,CAAC,KACA,OAAO,UACJ,oBACC,IAAI,mBAAmB;IACrB,UAAU,OAAO;IACjB,WAAW;IACX,OAAO,gBAAgB;GACzB,CAAC,CACL,CACF;GAKA,MAAM,QAAQ,OAAO,MAAM,KAAK;GAMhC,MAAM,gBAAgB,OAAO,OAAO,IAAI,aAAa;IACnD,MAAM,QAAQ,OAAO,OAClB,WAAW;KAAE,WAAW;KAAY,SAAS,eAAe;IAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CACrF,KACC,OAAO,eAAe,aAAa,OAAO,EAAE,GAC5C,OAAO,eAAe,MAAM,OAAO,KAAK,CAC1C;IAEF,OAAO,OAAO,MAAM,eAAe,OAAO,KAAK,CAAC,CAAC,KAC/C,OAAO,eAAe,aAAa,OAAO,EAAE,GAC5C,OAAO,eAAe,MAAM,OAAO,KAAK,GACxC,OAAO,UAAU,UACf,qBAAqB,OAAO,OAAO,IAAI,QAAW,kBAAkB,CACtE,CACF;GACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,KAAK,UAAU,IAAI,IACf,OAAO,OACP,MAAM,MAAM,OAAO,IAAI,CAAC,CAAC,KACvB,OAAO,YAAY,eACjB,OAAO,WACL,oCAAoC,OAAO,GAAG,0BAC9C,UACF,CACF,CACF,CACN,GACA,OAAO,UAAU,UACf,OAAO,SACL,UAAU,OAAO,GAAG,oCAAoC,OAAO,KAAK,GACtE,CACF,GACA,OAAO,UAAU,UACf,qBAAqB,OAAO,OAAO,IAAI,QAAW,mBAAmB,CACvE,CACF;GAEA,OAAO;IACL;IACA,UAAU,eAAe;IACzB,QAAQ;KAAE,WAAW;KAAY,SAAS,eAAe;IAAQ;IACjE;IACA;GACF;EACF,CAAC;CACL;AACF,CAAC,CACH"}
+{"version":3,"file":"plugin-loader.service.mjs","names":[],"sources":["../../../src/runtime/services/plugin-loader.service.ts"],"sourcesContent":["import type { InferSchemaInput, InferSchemaOutput } from \"@orpc/contract\";\nimport { Context, Effect, Exit, Layer, Scope } from \"effect\";\nimport type { z } from \"zod\";\nimport { PluginIdTag } from \"../../plugin\";\nimport type {\n  AnyPlugin,\n  AnyPluginConstructor,\n  InitializedPlugin,\n  LoadedPlugin,\n  PluginInstance,\n  PluginMetadata,\n  PluginRegistry,\n} from \"../../types\";\nimport type { PluginWarningInfo } from \"../errors\";\nimport { PluginRuntimeError, toPluginRuntimeError } from \"../errors\";\nimport { validate } from \"../validation\";\nimport { ModuleFederationService } from \"./module-federation.service\";\nimport { SecretsService } from \"./secrets.service\";\n\n/**\n * Evaluate a plugin's `warnings` function against the validated config.\n * Fail-safe: a throwing warnings function becomes a warning itself rather\n * than failing initialization. Strings are normalized to `PluginWarningInfo`\n * with the plugin's registry key.\n */\nconst collectPluginWarnings = (\n  plugin: AnyPlugin,\n  config: { variables: unknown; secrets: unknown },\n): PluginWarningInfo[] => {\n  const warningsFn = plugin.warnings;\n  if (!warningsFn) return [];\n  try {\n    const raw = warningsFn(config as never);\n    return raw.map((warning) =>\n      typeof warning === \"string\" ? { pluginKey: plugin.id, message: warning } : warning,\n    );\n  } catch (error) {\n    return [\n      {\n        pluginKey: plugin.id,\n        message: `Plugin warnings check failed: ${error instanceof Error ? error.message : String(error)}`,\n      },\n    ];\n  }\n};\n\nexport class PluginRegistryTag extends Context.Service<PluginRegistryTag, PluginRegistry>()(\n  \"PluginRegistry\",\n) {}\n\nexport class PluginMapTag extends Context.Service<\n  PluginMapTag,\n  Record<string, AnyPluginConstructor>\n>()(\"PluginMap\") {}\n\nexport interface RegistryServiceShape {\n  get: (\n    pluginId: string,\n  ) => Effect.Effect<\n    { constructor: (new () => AnyPlugin) | null; metadata: PluginMetadata },\n    PluginRuntimeError\n  >;\n  getModule: (pluginId: string) => Effect.Effect<AnyPluginConstructor | null>;\n}\n\nexport class RegistryService extends Context.Service<RegistryService, RegistryServiceShape>()(\n  \"RegistryService\",\n) {}\n\nexport const RegistryServiceDefault = Layer.effect(\n  RegistryService,\n  Effect.gen(function* () {\n    const registry = yield* PluginRegistryTag;\n    const pluginMap = yield* PluginMapTag;\n\n    return {\n      get: (pluginId: string) =>\n        Effect.gen(function* () {\n          const entry = registry[pluginId];\n\n          if (!entry) {\n            return yield* new PluginRuntimeError({\n              pluginId,\n              operation: \"validate-plugin-id\",\n              cause: new Error(`Plugin ${pluginId} not found in registry`),\n            });\n          }\n\n          if (\"module\" in entry) {\n            return {\n              constructor: entry.module,\n              metadata: {\n                remoteUrl: entry.remote || \"\",\n                version: entry.version,\n                description: entry.description,\n              } as PluginMetadata,\n            };\n          }\n\n          return {\n            constructor: null,\n            metadata: {\n              remoteUrl: entry.remote,\n              version: entry.version,\n              description: entry.description,\n            } as PluginMetadata,\n          };\n        }),\n\n      getModule: (pluginId: string) => Effect.succeed(pluginMap[pluginId] || null),\n    };\n  }),\n);\n\nexport interface PluginLoaderServiceShape {\n  loadPlugin: (pluginId: string) => Effect.Effect<LoadedPlugin, PluginRuntimeError>;\n  instantiatePlugin: <T extends AnyPlugin>(\n    pluginId: string,\n    loadedPlugin: LoadedPlugin<T>,\n  ) => Effect.Effect<PluginInstance<T>, PluginRuntimeError>;\n  initializePlugin: <T extends AnyPlugin>(\n    pluginInstance: PluginInstance<T>,\n    config: {\n      variables: InferSchemaInput<T[\"configSchema\"][\"variables\"]>;\n      secrets: InferSchemaInput<T[\"configSchema\"][\"secrets\"]>;\n    },\n    plugins?: Record<string, unknown>,\n  ) => Effect.Effect<InitializedPlugin<T>, PluginRuntimeError>;\n}\n\nexport class PluginLoaderService extends Context.Service<\n  PluginLoaderService,\n  PluginLoaderServiceShape\n>()(\"PluginLoaderService\") {}\n\nexport const PluginLoaderServiceDefault = Layer.effect(\n  PluginLoaderService,\n  Effect.gen(function* () {\n    const moduleFederationService = yield* ModuleFederationService;\n    const secretsService = yield* SecretsService;\n    const registryService = yield* RegistryService;\n\n    const resolveUrl = (baseUrl: string, version?: string): string =>\n      version && version !== \"latest\" ? baseUrl.replace(\"@latest\", `@${version}`) : baseUrl;\n\n    return {\n      loadPlugin: (pluginId: string) =>\n        Effect.gen(function* () {\n          const entry = yield* registryService.get(pluginId);\n\n          if (entry.constructor) {\n            yield* Effect.logDebug(\"Loading plugin from direct module\", { pluginId });\n\n            return {\n              ctor: entry.constructor,\n              metadata: entry.metadata,\n            } satisfies LoadedPlugin;\n          }\n\n          const url = entry.metadata.remoteUrl;\n          if (!url) {\n            return yield* new PluginRuntimeError({\n              pluginId,\n              operation: \"load-plugin\",\n              cause: new Error(`Plugin ${pluginId} has no module or remote URL configured`),\n            });\n          }\n\n          const resolvedUrl = resolveUrl(url);\n\n          yield* moduleFederationService.registerRemote(pluginId, resolvedUrl).pipe(\n            Effect.tapError((error) =>\n              Effect.logError(`Plugin ${pluginId} failed during register-remote: ${String(error)}`),\n            ),\n            Effect.mapError((error) =>\n              toPluginRuntimeError(error, pluginId, undefined, \"register-remote\"),\n            ),\n          );\n\n          yield* Effect.logDebug(\"Loading plugin from remote\", { pluginId, url: resolvedUrl });\n\n          const ctor = yield* moduleFederationService\n            .loadRemoteConstructor(pluginId, resolvedUrl)\n            .pipe(\n              Effect.tapError((error) =>\n                Effect.logError(`Plugin ${pluginId} failed during load-remote: ${String(error)}`),\n              ),\n              Effect.mapError((error) =>\n                toPluginRuntimeError(error, pluginId, undefined, \"load-remote\"),\n              ),\n            );\n\n          return {\n            ctor,\n            metadata: entry.metadata,\n          } satisfies LoadedPlugin;\n        }),\n\n      instantiatePlugin: <T extends AnyPlugin>(pluginId: string, loadedPlugin: LoadedPlugin<T>) =>\n        Effect.gen(function* () {\n          const instance = yield* Effect.try(() => new loadedPlugin.ctor()).pipe(\n            Effect.tapError((error) =>\n              Effect.logError(`Plugin ${pluginId} failed during instantiate-plugin: ${error}`),\n            ),\n            Effect.mapError((error) =>\n              toPluginRuntimeError(error, pluginId, undefined, \"instantiate-plugin\"),\n            ),\n          );\n\n          (instance.id as string) = pluginId;\n\n          return {\n            plugin: instance,\n            metadata: loadedPlugin.metadata,\n          } satisfies PluginInstance<T>;\n        }),\n\n      initializePlugin: <T extends AnyPlugin>(\n        pluginInstance: PluginInstance<T>,\n        config: {\n          variables: InferSchemaInput<T[\"configSchema\"][\"variables\"]>;\n          secrets: InferSchemaInput<T[\"configSchema\"][\"secrets\"]>;\n        },\n        plugins?: Record<string, unknown>,\n      ) =>\n        Effect.gen(function* () {\n          const { plugin } = pluginInstance;\n\n          // Validate and hydrate config\n          const validatedVariables = yield* validate(\n            plugin.configSchema.variables as z.ZodSchema<\n              InferSchemaOutput<T[\"configSchema\"][\"variables\"]>\n            >,\n            config.variables,\n            plugin.id,\n            \"config\",\n          ).pipe(\n            Effect.mapError(\n              (validationError) =>\n                new PluginRuntimeError({\n                  pluginId: plugin.id,\n                  operation: \"validate-config\",\n                  cause: validationError.zodError,\n                }),\n            ),\n          );\n\n          // Validate secrets\n          const validatedSecrets = yield* validate(\n            plugin.configSchema.secrets as z.ZodSchema<\n              InferSchemaOutput<T[\"configSchema\"][\"secrets\"]>\n            >,\n            config.secrets,\n            plugin.id,\n            \"config\",\n          ).pipe(\n            Effect.mapError(\n              (validationError) =>\n                new PluginRuntimeError({\n                  pluginId: plugin.id,\n                  operation: \"validate-secrets\",\n                  cause: validationError.zodError,\n                }),\n            ),\n          );\n\n          // Hydrate secrets in variables\n          const hydratedConfig = yield* secretsService.hydrateSecrets({\n            variables: validatedVariables,\n            secrets: validatedSecrets,\n          });\n\n          const _variables = yield* validate(\n            plugin.configSchema.variables as z.ZodSchema<\n              InferSchemaOutput<T[\"configSchema\"][\"variables\"]>\n            >,\n            hydratedConfig.variables,\n            plugin.id,\n            \"config\",\n          ).pipe(\n            Effect.mapError(\n              (validationError) =>\n                new PluginRuntimeError({\n                  pluginId: plugin.id,\n                  operation: \"validate-hydrated-config\",\n                  cause: validationError.zodError,\n                }),\n            ),\n          );\n\n          // Create a long-lived scope for this plugin instance. Initialize\n          // returns a Layer which is built against this scope, so scoped\n          // resources (DB pools, caches) release on plugin shutdown.\n          const scope = yield* Scope.make();\n\n          // Build the plugin's Layer within the scope.\n          // On failure, close the scope immediately so scoped resources\n          // (DB pools, caches) are released — otherwise every failed\n          // initialization leaks until the process exits.\n          const effectContext = yield* Effect.gen(function* () {\n            const layer = yield* plugin\n              .initialize({ variables: _variables, secrets: hydratedConfig.secrets }, plugins ?? {})\n              .pipe(\n                Effect.provideService(PluginIdTag, plugin.id),\n                Effect.provideService(Scope.Scope, scope),\n              );\n\n            return yield* Layer.buildWithScope(layer, scope).pipe(\n              Effect.provideService(PluginIdTag, plugin.id),\n              Effect.provideService(Scope.Scope, scope),\n              Effect.mapError((error) =>\n                toPluginRuntimeError(error, plugin.id, undefined, \"initialize-layer\"),\n              ),\n            );\n          }).pipe(\n            Effect.onExit((exit) =>\n              Exit.isSuccess(exit)\n                ? Effect.void\n                : Scope.close(scope, exit).pipe(\n                    Effect.catchCause((closeCause) =>\n                      Effect.logWarning(\n                        `Failed to close scope for plugin ${plugin.id} after initialize error`,\n                        closeCause,\n                      ),\n                    ),\n                  ),\n            ),\n            Effect.tapError((error) =>\n              Effect.logError(\n                `Plugin ${plugin.id} failed during initialize-plugin: ${String(error)}`,\n              ),\n            ),\n            Effect.mapError((error) =>\n              toPluginRuntimeError(error, plugin.id, undefined, \"initialize-plugin\"),\n            ),\n          );\n\n          return {\n            plugin,\n            metadata: pluginInstance.metadata,\n            config: { variables: _variables, secrets: hydratedConfig.secrets },\n            effectContext,\n            scope,\n            warnings: collectPluginWarnings(plugin, {\n              variables: _variables,\n              secrets: hydratedConfig.secrets,\n            }),\n          } satisfies InitializedPlugin<T>;\n        }),\n    };\n  }),\n);\n"],"mappings":";;;;;;;;;;;;;;AAyBA,MAAM,yBACJ,QACA,WACwB;CACxB,MAAM,aAAa,OAAO;CAC1B,IAAI,CAAC,YAAY,OAAO,CAAC;CACzB,IAAI;EAEF,OADY,WAAW,MACd,CAAC,CAAC,KAAK,YACd,OAAO,YAAY,WAAW;GAAE,WAAW,OAAO;GAAI,SAAS;EAAQ,IAAI,OAC7E;CACF,SAAS,OAAO;EACd,OAAO,CACL;GACE,WAAW,OAAO;GAClB,SAAS,iCAAiC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACjG,CACF;CACF;AACF;AAEA,IAAa,oBAAb,cAAuC,QAAQ,QAA2C,CAAC,CACzF,gBACF,CAAC,CAAC,CAAC;AAEH,IAAa,eAAb,cAAkC,QAAQ,QAGxC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;AAYlB,IAAa,kBAAb,cAAqC,QAAQ,QAA+C,CAAC,CAC3F,iBACF,CAAC,CAAC,CAAC;AAEH,MAAa,yBAAyB,MAAM,OAC1C,iBACA,OAAO,IAAI,aAAa;CACtB,MAAM,WAAW,OAAO;CACxB,MAAM,YAAY,OAAO;CAEzB,OAAO;EACL,MAAM,aACJ,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,SAAS;GAEvB,IAAI,CAAC,OACH,OAAO,OAAO,IAAI,mBAAmB;IACnC;IACA,WAAW;IACX,uBAAO,IAAI,MAAM,UAAU,SAAS,uBAAuB;GAC7D,CAAC;GAGH,IAAI,YAAY,OACd,OAAO;IACL,aAAa,MAAM;IACnB,UAAU;KACR,WAAW,MAAM,UAAU;KAC3B,SAAS,MAAM;KACf,aAAa,MAAM;IACrB;GACF;GAGF,OAAO;IACL,aAAa;IACb,UAAU;KACR,WAAW,MAAM;KACjB,SAAS,MAAM;KACf,aAAa,MAAM;IACrB;GACF;EACF,CAAC;EAEH,YAAY,aAAqB,OAAO,QAAQ,UAAU,aAAa,IAAI;CAC7E;AACF,CAAC,CACH;AAkBA,IAAa,sBAAb,cAAyC,QAAQ,QAG/C,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;AAE5B,MAAa,6BAA6B,MAAM,OAC9C,qBACA,OAAO,IAAI,aAAa;CACtB,MAAM,0BAA0B,OAAO;CACvC,MAAM,iBAAiB,OAAO;CAC9B,MAAM,kBAAkB,OAAO;CAE/B,MAAM,cAAc,SAAiB,YACnC,WAAW,YAAY,WAAW,QAAQ,QAAQ,WAAW,IAAI,SAAS,IAAI;CAEhF,OAAO;EACL,aAAa,aACX,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,gBAAgB,IAAI,QAAQ;GAEjD,IAAI,MAAM,aAAa;IACrB,OAAO,OAAO,SAAS,qCAAqC,EAAE,SAAS,CAAC;IAExE,OAAO;KACL,MAAM,MAAM;KACZ,UAAU,MAAM;IAClB;GACF;GAEA,MAAM,MAAM,MAAM,SAAS;GAC3B,IAAI,CAAC,KACH,OAAO,OAAO,IAAI,mBAAmB;IACnC;IACA,WAAW;IACX,uBAAO,IAAI,MAAM,UAAU,SAAS,wCAAwC;GAC9E,CAAC;GAGH,MAAM,cAAc,WAAW,GAAG;GAElC,OAAO,wBAAwB,eAAe,UAAU,WAAW,CAAC,CAAC,KACnE,OAAO,UAAU,UACf,OAAO,SAAS,UAAU,SAAS,kCAAkC,OAAO,KAAK,GAAG,CACtF,GACA,OAAO,UAAU,UACf,qBAAqB,OAAO,UAAU,QAAW,iBAAiB,CACpE,CACF;GAEA,OAAO,OAAO,SAAS,8BAA8B;IAAE;IAAU,KAAK;GAAY,CAAC;GAanF,OAAO;IACL,aAZkB,wBACjB,sBAAsB,UAAU,WAAW,CAAC,CAC5C,KACC,OAAO,UAAU,UACf,OAAO,SAAS,UAAU,SAAS,8BAA8B,OAAO,KAAK,GAAG,CAClF,GACA,OAAO,UAAU,UACf,qBAAqB,OAAO,UAAU,QAAW,aAAa,CAChE,CACF;IAIA,UAAU,MAAM;GAClB;EACF,CAAC;EAEH,oBAAyC,UAAkB,iBACzD,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,OAAO,OAAO,UAAU,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC,KAChE,OAAO,UAAU,UACf,OAAO,SAAS,UAAU,SAAS,qCAAqC,OAAO,CACjF,GACA,OAAO,UAAU,UACf,qBAAqB,OAAO,UAAU,QAAW,oBAAoB,CACvE,CACF;GAEA,AAAC,SAAS,KAAgB;GAE1B,OAAO;IACL,QAAQ;IACR,UAAU,aAAa;GACzB;EACF,CAAC;EAEH,mBACE,gBACA,QAIA,YAEA,OAAO,IAAI,aAAa;GACtB,MAAM,EAAE,WAAW;GAGnB,MAAM,qBAAqB,OAAO,SAChC,OAAO,aAAa,WAGpB,OAAO,WACP,OAAO,IACP,QACF,CAAC,CAAC,KACA,OAAO,UACJ,oBACC,IAAI,mBAAmB;IACrB,UAAU,OAAO;IACjB,WAAW;IACX,OAAO,gBAAgB;GACzB,CAAC,CACL,CACF;GAGA,MAAM,mBAAmB,OAAO,SAC9B,OAAO,aAAa,SAGpB,OAAO,SACP,OAAO,IACP,QACF,CAAC,CAAC,KACA,OAAO,UACJ,oBACC,IAAI,mBAAmB;IACrB,UAAU,OAAO;IACjB,WAAW;IACX,OAAO,gBAAgB;GACzB,CAAC,CACL,CACF;GAGA,MAAM,iBAAiB,OAAO,eAAe,eAAe;IAC1D,WAAW;IACX,SAAS;GACX,CAAC;GAED,MAAM,aAAa,OAAO,SACxB,OAAO,aAAa,WAGpB,eAAe,WACf,OAAO,IACP,QACF,CAAC,CAAC,KACA,OAAO,UACJ,oBACC,IAAI,mBAAmB;IACrB,UAAU,OAAO;IACjB,WAAW;IACX,OAAO,gBAAgB;GACzB,CAAC,CACL,CACF;GAKA,MAAM,QAAQ,OAAO,MAAM,KAAK;GAMhC,MAAM,gBAAgB,OAAO,OAAO,IAAI,aAAa;IACnD,MAAM,QAAQ,OAAO,OAClB,WAAW;KAAE,WAAW;KAAY,SAAS,eAAe;IAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CACrF,KACC,OAAO,eAAe,aAAa,OAAO,EAAE,GAC5C,OAAO,eAAe,MAAM,OAAO,KAAK,CAC1C;IAEF,OAAO,OAAO,MAAM,eAAe,OAAO,KAAK,CAAC,CAAC,KAC/C,OAAO,eAAe,aAAa,OAAO,EAAE,GAC5C,OAAO,eAAe,MAAM,OAAO,KAAK,GACxC,OAAO,UAAU,UACf,qBAAqB,OAAO,OAAO,IAAI,QAAW,kBAAkB,CACtE,CACF;GACF,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,SACb,KAAK,UAAU,IAAI,IACf,OAAO,OACP,MAAM,MAAM,OAAO,IAAI,CAAC,CAAC,KACvB,OAAO,YAAY,eACjB,OAAO,WACL,oCAAoC,OAAO,GAAG,0BAC9C,UACF,CACF,CACF,CACN,GACA,OAAO,UAAU,UACf,OAAO,SACL,UAAU,OAAO,GAAG,oCAAoC,OAAO,KAAK,GACtE,CACF,GACA,OAAO,UAAU,UACf,qBAAqB,OAAO,OAAO,IAAI,QAAW,mBAAmB,CACvE,CACF;GAEA,OAAO;IACL;IACA,UAAU,eAAe;IACzB,QAAQ;KAAE,WAAW;KAAY,SAAS,eAAe;IAAQ;IACjE;IACA;IACA,UAAU,sBAAsB,QAAQ;KACtC,WAAW;KACX,SAAS,eAAe;IAC1B,CAAC;GACH;EACF,CAAC;CACL;AACF,CAAC,CACH"}

package/dist/runtime/services/shared-identity.cjs

@@ -6,7 +6,7 @@ function manifestUrl(remoteUrl) {
 	return remoteUrl.endsWith("/") ? `${remoteUrl}mf-manifest.json` : `${remoteUrl}/mf-manifest.json`;
 }
 function normalizeBaseUrl(remoteUrl) {
-	return (remoteUrl.split("#")[0] ?? remoteUrl).replace(/\/(mf-manifest\.json|remoteEntry\.js)$/i, "");
+	return (remoteUrl.split("#")[0] ?? remoteUrl).replace(/\/(mf-manifest\.json|remoteEntry(?:\.[^/]+)?\.js)$/i, "");
 }
 function compareSharedIdentity(remoteShared, expectedVersions) {
 	const mismatches = [];

package/dist/runtime/services/shared-identity.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"shared-identity.cjs","names":["isEffectCriticalSharedDep"],"sources":["../../../src/runtime/services/shared-identity.ts"],"sourcesContent":["import { isEffectCriticalSharedDep } from \"../../shared-deps-spec\";\n\ninterface IdentityManifest {\n  metaData?: { pluginVersion?: string; name?: string };\n  shared?: Array<{ name: string; version?: string }>;\n}\n\nexport interface SharedIdentityMismatch {\n  name: string;\n  expected: string;\n  actual: string | null;\n}\n\nconst MANIFEST_TIMEOUT_MS = 15_000;\n\nfunction manifestUrl(remoteUrl: string): string {\n  return remoteUrl.endsWith(\"/\") ? `${remoteUrl}mf-manifest.json` : `${remoteUrl}/mf-manifest.json`;\n}\n\nfunction normalizeBaseUrl(remoteUrl: string): string {\n  const withoutHash = remoteUrl.split(\"#\")[0] ?? remoteUrl;\n  return withoutHash.replace(/\\/(mf-manifest\\.json|remoteEntry\\.js)$/i, \"\");\n}\n\nexport function compareSharedIdentity(\n  remoteShared: Array<{ name: string; version?: string }> | undefined,\n  expectedVersions: Map<string, string>,\n): SharedIdentityMismatch[] {\n  const mismatches: SharedIdentityMismatch[] = [];\n  const remoteByName = new Map((remoteShared ?? []).map((s) => [s.name, s]));\n\n  for (const [name, expected] of expectedVersions.entries()) {\n    if (!isEffectCriticalSharedDep(name)) continue;\n    const remoteEntry = remoteByName.get(name);\n    if (!remoteEntry) continue;\n    if (remoteEntry.version && remoteEntry.version !== expected) {\n      mismatches.push({ name, expected, actual: remoteEntry.version });\n    }\n  }\n\n  return mismatches;\n}\n\nexport function describeSharedIdentityMismatch(\n  pluginId: string,\n  mismatches: SharedIdentityMismatch[],\n  hostExpectation: string,\n): string {\n  const lines = mismatches.map(\n    (m) =>\n      `  ${m.name}: expected ${m.expected} (from ${hostExpectation}), got ${m.actual ?? \"missing\"}`,\n  );\n  return (\n    `[SharedIdentity] Refusing to load plugin \"${pluginId}\": shared dependency version skew.\\n` +\n    `${lines.join(\"\\n\")}\\n` +\n    `Run \"bos mf check\" for the full report. Fix: rebuild and redeploy the host and this plugin together (single release train, e.g. \"bos publish --deploy --packages local\").`\n  );\n}\n\nexport async function fetchRemoteIdentityManifest(\n  remoteUrl: string,\n): Promise<IdentityManifest | null> {\n  const base = normalizeBaseUrl(remoteUrl);\n  const url = manifestUrl(base);\n  const res = await fetch(url, { signal: AbortSignal.timeout(MANIFEST_TIMEOUT_MS) });\n  if (!res.ok) return null;\n  return (await res.json()) as IdentityManifest;\n}\n"],"mappings":";;;AAaA,MAAM,sBAAsB;AAE5B,SAAS,YAAY,WAA2B;CAC9C,OAAO,UAAU,SAAS,GAAG,IAAI,GAAG,UAAU,oBAAoB,GAAG,UAAU;AACjF;AAEA,SAAS,iBAAiB,WAA2B;CAEnD,QADoB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,UAC7B,CAAC,QAAQ,2CAA2C,EAAE;AAC1E;AAEA,SAAgB,sBACd,cACA,kBAC0B;CAC1B,MAAM,aAAuC,CAAC;CAC9C,MAAM,eAAe,IAAI,KAAK,gBAAgB,CAAC,EAAC,CAAE,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;CAEzE,KAAK,MAAM,CAAC,MAAM,aAAa,iBAAiB,QAAQ,GAAG;EACzD,IAAI,CAACA,mDAA0B,IAAI,GAAG;EACtC,MAAM,cAAc,aAAa,IAAI,IAAI;EACzC,IAAI,CAAC,aAAa;EAClB,IAAI,YAAY,WAAW,YAAY,YAAY,UACjD,WAAW,KAAK;GAAE;GAAM;GAAU,QAAQ,YAAY;EAAQ,CAAC;CAEnE;CAEA,OAAO;AACT;AAEA,SAAgB,+BACd,UACA,YACA,iBACQ;CAKR,OACE,6CAA6C,SAAS,sCAL1C,WAAW,KACtB,MACC,KAAK,EAAE,KAAK,aAAa,EAAE,SAAS,SAAS,gBAAgB,SAAS,EAAE,UAAU,WAI7E,CAAC,CAAC,KAAK,IAAI,EAAE;AAGxB;AAEA,eAAsB,4BACpB,WACkC;CAElC,MAAM,MAAM,YADC,iBAAiB,SACH,CAAC;CAC5B,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,mBAAmB,EAAE,CAAC;CACjF,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,OAAQ,MAAM,IAAI,KAAK;AACzB"}
+{"version":3,"file":"shared-identity.cjs","names":["isEffectCriticalSharedDep"],"sources":["../../../src/runtime/services/shared-identity.ts"],"sourcesContent":["import { isEffectCriticalSharedDep } from \"../../shared-deps-spec\";\n\ninterface IdentityManifest {\n  metaData?: { pluginVersion?: string; name?: string };\n  shared?: Array<{ name: string; version?: string }>;\n}\n\nexport interface SharedIdentityMismatch {\n  name: string;\n  expected: string;\n  actual: string | null;\n}\n\nconst MANIFEST_TIMEOUT_MS = 15_000;\n\nfunction manifestUrl(remoteUrl: string): string {\n  return remoteUrl.endsWith(\"/\") ? `${remoteUrl}mf-manifest.json` : `${remoteUrl}/mf-manifest.json`;\n}\n\nfunction normalizeBaseUrl(remoteUrl: string): string {\n  const withoutHash = remoteUrl.split(\"#\")[0] ?? remoteUrl;\n  return withoutHash.replace(/\\/(mf-manifest\\.json|remoteEntry(?:\\.[^/]+)?\\.js)$/i, \"\");\n}\n\nexport function compareSharedIdentity(\n  remoteShared: Array<{ name: string; version?: string }> | undefined,\n  expectedVersions: Map<string, string>,\n): SharedIdentityMismatch[] {\n  const mismatches: SharedIdentityMismatch[] = [];\n  const remoteByName = new Map((remoteShared ?? []).map((s) => [s.name, s]));\n\n  for (const [name, expected] of expectedVersions.entries()) {\n    if (!isEffectCriticalSharedDep(name)) continue;\n    const remoteEntry = remoteByName.get(name);\n    if (!remoteEntry) continue;\n    if (remoteEntry.version && remoteEntry.version !== expected) {\n      mismatches.push({ name, expected, actual: remoteEntry.version });\n    }\n  }\n\n  return mismatches;\n}\n\nexport function describeSharedIdentityMismatch(\n  pluginId: string,\n  mismatches: SharedIdentityMismatch[],\n  hostExpectation: string,\n): string {\n  const lines = mismatches.map(\n    (m) =>\n      `  ${m.name}: expected ${m.expected} (from ${hostExpectation}), got ${m.actual ?? \"missing\"}`,\n  );\n  return (\n    `[SharedIdentity] Refusing to load plugin \"${pluginId}\": shared dependency version skew.\\n` +\n    `${lines.join(\"\\n\")}\\n` +\n    `Run \"bos mf check\" for the full report. Fix: rebuild and redeploy the host and this plugin together (single release train, e.g. \"bos publish --deploy --packages local\").`\n  );\n}\n\nexport async function fetchRemoteIdentityManifest(\n  remoteUrl: string,\n): Promise<IdentityManifest | null> {\n  const base = normalizeBaseUrl(remoteUrl);\n  const url = manifestUrl(base);\n  const res = await fetch(url, { signal: AbortSignal.timeout(MANIFEST_TIMEOUT_MS) });\n  if (!res.ok) return null;\n  return (await res.json()) as IdentityManifest;\n}\n"],"mappings":";;;AAaA,MAAM,sBAAsB;AAE5B,SAAS,YAAY,WAA2B;CAC9C,OAAO,UAAU,SAAS,GAAG,IAAI,GAAG,UAAU,oBAAoB,GAAG,UAAU;AACjF;AAEA,SAAS,iBAAiB,WAA2B;CAEnD,QADoB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,UAC7B,CAAC,QAAQ,uDAAuD,EAAE;AACtF;AAEA,SAAgB,sBACd,cACA,kBAC0B;CAC1B,MAAM,aAAuC,CAAC;CAC9C,MAAM,eAAe,IAAI,KAAK,gBAAgB,CAAC,EAAC,CAAE,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;CAEzE,KAAK,MAAM,CAAC,MAAM,aAAa,iBAAiB,QAAQ,GAAG;EACzD,IAAI,CAACA,mDAA0B,IAAI,GAAG;EACtC,MAAM,cAAc,aAAa,IAAI,IAAI;EACzC,IAAI,CAAC,aAAa;EAClB,IAAI,YAAY,WAAW,YAAY,YAAY,UACjD,WAAW,KAAK;GAAE;GAAM;GAAU,QAAQ,YAAY;EAAQ,CAAC;CAEnE;CAEA,OAAO;AACT;AAEA,SAAgB,+BACd,UACA,YACA,iBACQ;CAKR,OACE,6CAA6C,SAAS,sCAL1C,WAAW,KACtB,MACC,KAAK,EAAE,KAAK,aAAa,EAAE,SAAS,SAAS,gBAAgB,SAAS,EAAE,UAAU,WAI7E,CAAC,CAAC,KAAK,IAAI,EAAE;AAGxB;AAEA,eAAsB,4BACpB,WACkC;CAElC,MAAM,MAAM,YADC,iBAAiB,SACH,CAAC;CAC5B,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,mBAAmB,EAAE,CAAC;CACjF,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,OAAQ,MAAM,IAAI,KAAK;AACzB"}

package/dist/runtime/services/shared-identity.mjs

@@ -6,7 +6,7 @@ function manifestUrl(remoteUrl) {
 	return remoteUrl.endsWith("/") ? `${remoteUrl}mf-manifest.json` : `${remoteUrl}/mf-manifest.json`;
 }
 function normalizeBaseUrl(remoteUrl) {
-	return (remoteUrl.split("#")[0] ?? remoteUrl).replace(/\/(mf-manifest\.json|remoteEntry\.js)$/i, "");
+	return (remoteUrl.split("#")[0] ?? remoteUrl).replace(/\/(mf-manifest\.json|remoteEntry(?:\.[^/]+)?\.js)$/i, "");
 }
 function compareSharedIdentity(remoteShared, expectedVersions) {
 	const mismatches = [];

package/dist/runtime/services/shared-identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"shared-identity.mjs","names":[],"sources":["../../../src/runtime/services/shared-identity.ts"],"sourcesContent":["import { isEffectCriticalSharedDep } from \"../../shared-deps-spec\";\n\ninterface IdentityManifest {\n  metaData?: { pluginVersion?: string; name?: string };\n  shared?: Array<{ name: string; version?: string }>;\n}\n\nexport interface SharedIdentityMismatch {\n  name: string;\n  expected: string;\n  actual: string | null;\n}\n\nconst MANIFEST_TIMEOUT_MS = 15_000;\n\nfunction manifestUrl(remoteUrl: string): string {\n  return remoteUrl.endsWith(\"/\") ? `${remoteUrl}mf-manifest.json` : `${remoteUrl}/mf-manifest.json`;\n}\n\nfunction normalizeBaseUrl(remoteUrl: string): string {\n  const withoutHash = remoteUrl.split(\"#\")[0] ?? remoteUrl;\n  return withoutHash.replace(/\\/(mf-manifest\\.json|remoteEntry\\.js)$/i, \"\");\n}\n\nexport function compareSharedIdentity(\n  remoteShared: Array<{ name: string; version?: string }> | undefined,\n  expectedVersions: Map<string, string>,\n): SharedIdentityMismatch[] {\n  const mismatches: SharedIdentityMismatch[] = [];\n  const remoteByName = new Map((remoteShared ?? []).map((s) => [s.name, s]));\n\n  for (const [name, expected] of expectedVersions.entries()) {\n    if (!isEffectCriticalSharedDep(name)) continue;\n    const remoteEntry = remoteByName.get(name);\n    if (!remoteEntry) continue;\n    if (remoteEntry.version && remoteEntry.version !== expected) {\n      mismatches.push({ name, expected, actual: remoteEntry.version });\n    }\n  }\n\n  return mismatches;\n}\n\nexport function describeSharedIdentityMismatch(\n  pluginId: string,\n  mismatches: SharedIdentityMismatch[],\n  hostExpectation: string,\n): string {\n  const lines = mismatches.map(\n    (m) =>\n      `  ${m.name}: expected ${m.expected} (from ${hostExpectation}), got ${m.actual ?? \"missing\"}`,\n  );\n  return (\n    `[SharedIdentity] Refusing to load plugin \"${pluginId}\": shared dependency version skew.\\n` +\n    `${lines.join(\"\\n\")}\\n` +\n    `Run \"bos mf check\" for the full report. Fix: rebuild and redeploy the host and this plugin together (single release train, e.g. \"bos publish --deploy --packages local\").`\n  );\n}\n\nexport async function fetchRemoteIdentityManifest(\n  remoteUrl: string,\n): Promise<IdentityManifest | null> {\n  const base = normalizeBaseUrl(remoteUrl);\n  const url = manifestUrl(base);\n  const res = await fetch(url, { signal: AbortSignal.timeout(MANIFEST_TIMEOUT_MS) });\n  if (!res.ok) return null;\n  return (await res.json()) as IdentityManifest;\n}\n"],"mappings":";;;AAaA,MAAM,sBAAsB;AAE5B,SAAS,YAAY,WAA2B;CAC9C,OAAO,UAAU,SAAS,GAAG,IAAI,GAAG,UAAU,oBAAoB,GAAG,UAAU;AACjF;AAEA,SAAS,iBAAiB,WAA2B;CAEnD,QADoB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,UAC7B,CAAC,QAAQ,2CAA2C,EAAE;AAC1E;AAEA,SAAgB,sBACd,cACA,kBAC0B;CAC1B,MAAM,aAAuC,CAAC;CAC9C,MAAM,eAAe,IAAI,KAAK,gBAAgB,CAAC,EAAC,CAAE,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;CAEzE,KAAK,MAAM,CAAC,MAAM,aAAa,iBAAiB,QAAQ,GAAG;EACzD,IAAI,CAAC,0BAA0B,IAAI,GAAG;EACtC,MAAM,cAAc,aAAa,IAAI,IAAI;EACzC,IAAI,CAAC,aAAa;EAClB,IAAI,YAAY,WAAW,YAAY,YAAY,UACjD,WAAW,KAAK;GAAE;GAAM;GAAU,QAAQ,YAAY;EAAQ,CAAC;CAEnE;CAEA,OAAO;AACT;AAEA,SAAgB,+BACd,UACA,YACA,iBACQ;CAKR,OACE,6CAA6C,SAAS,sCAL1C,WAAW,KACtB,MACC,KAAK,EAAE,KAAK,aAAa,EAAE,SAAS,SAAS,gBAAgB,SAAS,EAAE,UAAU,WAI7E,CAAC,CAAC,KAAK,IAAI,EAAE;AAGxB;AAEA,eAAsB,4BACpB,WACkC;CAElC,MAAM,MAAM,YADC,iBAAiB,SACH,CAAC;CAC5B,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,mBAAmB,EAAE,CAAC;CACjF,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,OAAQ,MAAM,IAAI,KAAK;AACzB"}
+{"version":3,"file":"shared-identity.mjs","names":[],"sources":["../../../src/runtime/services/shared-identity.ts"],"sourcesContent":["import { isEffectCriticalSharedDep } from \"../../shared-deps-spec\";\n\ninterface IdentityManifest {\n  metaData?: { pluginVersion?: string; name?: string };\n  shared?: Array<{ name: string; version?: string }>;\n}\n\nexport interface SharedIdentityMismatch {\n  name: string;\n  expected: string;\n  actual: string | null;\n}\n\nconst MANIFEST_TIMEOUT_MS = 15_000;\n\nfunction manifestUrl(remoteUrl: string): string {\n  return remoteUrl.endsWith(\"/\") ? `${remoteUrl}mf-manifest.json` : `${remoteUrl}/mf-manifest.json`;\n}\n\nfunction normalizeBaseUrl(remoteUrl: string): string {\n  const withoutHash = remoteUrl.split(\"#\")[0] ?? remoteUrl;\n  return withoutHash.replace(/\\/(mf-manifest\\.json|remoteEntry(?:\\.[^/]+)?\\.js)$/i, \"\");\n}\n\nexport function compareSharedIdentity(\n  remoteShared: Array<{ name: string; version?: string }> | undefined,\n  expectedVersions: Map<string, string>,\n): SharedIdentityMismatch[] {\n  const mismatches: SharedIdentityMismatch[] = [];\n  const remoteByName = new Map((remoteShared ?? []).map((s) => [s.name, s]));\n\n  for (const [name, expected] of expectedVersions.entries()) {\n    if (!isEffectCriticalSharedDep(name)) continue;\n    const remoteEntry = remoteByName.get(name);\n    if (!remoteEntry) continue;\n    if (remoteEntry.version && remoteEntry.version !== expected) {\n      mismatches.push({ name, expected, actual: remoteEntry.version });\n    }\n  }\n\n  return mismatches;\n}\n\nexport function describeSharedIdentityMismatch(\n  pluginId: string,\n  mismatches: SharedIdentityMismatch[],\n  hostExpectation: string,\n): string {\n  const lines = mismatches.map(\n    (m) =>\n      `  ${m.name}: expected ${m.expected} (from ${hostExpectation}), got ${m.actual ?? \"missing\"}`,\n  );\n  return (\n    `[SharedIdentity] Refusing to load plugin \"${pluginId}\": shared dependency version skew.\\n` +\n    `${lines.join(\"\\n\")}\\n` +\n    `Run \"bos mf check\" for the full report. Fix: rebuild and redeploy the host and this plugin together (single release train, e.g. \"bos publish --deploy --packages local\").`\n  );\n}\n\nexport async function fetchRemoteIdentityManifest(\n  remoteUrl: string,\n): Promise<IdentityManifest | null> {\n  const base = normalizeBaseUrl(remoteUrl);\n  const url = manifestUrl(base);\n  const res = await fetch(url, { signal: AbortSignal.timeout(MANIFEST_TIMEOUT_MS) });\n  if (!res.ok) return null;\n  return (await res.json()) as IdentityManifest;\n}\n"],"mappings":";;;AAaA,MAAM,sBAAsB;AAE5B,SAAS,YAAY,WAA2B;CAC9C,OAAO,UAAU,SAAS,GAAG,IAAI,GAAG,UAAU,oBAAoB,GAAG,UAAU;AACjF;AAEA,SAAS,iBAAiB,WAA2B;CAEnD,QADoB,UAAU,MAAM,GAAG,CAAC,CAAC,MAAM,UAC7B,CAAC,QAAQ,uDAAuD,EAAE;AACtF;AAEA,SAAgB,sBACd,cACA,kBAC0B;CAC1B,MAAM,aAAuC,CAAC;CAC9C,MAAM,eAAe,IAAI,KAAK,gBAAgB,CAAC,EAAC,CAAE,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;CAEzE,KAAK,MAAM,CAAC,MAAM,aAAa,iBAAiB,QAAQ,GAAG;EACzD,IAAI,CAAC,0BAA0B,IAAI,GAAG;EACtC,MAAM,cAAc,aAAa,IAAI,IAAI;EACzC,IAAI,CAAC,aAAa;EAClB,IAAI,YAAY,WAAW,YAAY,YAAY,UACjD,WAAW,KAAK;GAAE;GAAM;GAAU,QAAQ,YAAY;EAAQ,CAAC;CAEnE;CAEA,OAAO;AACT;AAEA,SAAgB,+BACd,UACA,YACA,iBACQ;CAKR,OACE,6CAA6C,SAAS,sCAL1C,WAAW,KACtB,MACC,KAAK,EAAE,KAAK,aAAa,EAAE,SAAS,SAAS,gBAAgB,SAAS,EAAE,UAAU,WAI7E,CAAC,CAAC,KAAK,IAAI,EAAE;AAGxB;AAEA,eAAsB,4BACpB,WACkC;CAElC,MAAM,MAAM,YADC,iBAAiB,SACH,CAAC;CAC5B,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,mBAAmB,EAAE,CAAC;CACjF,IAAI,CAAC,IAAI,IAAI,OAAO;CACpB,OAAQ,MAAM,IAAI,KAAK;AACzB"}

package/dist/types.d.cts

@@ -1,3 +1,4 @@
+import { PluginWarningInfo } from "./runtime/errors.cjs";
 import { Plugin } from "./plugin.cjs";
 import { ContractedRouter, RouterClient } from "@orpc/server";
 import { Context, Scope } from "effect";
@@ -181,6 +182,8 @@ interface InitializedPlugin<T extends AnyPlugin = AnyPlugin> {
    */
   readonly effectContext: Context.Context<any>;
   readonly scope: Scope.Closeable;
+  /** Non-fatal config warnings collected during initialization (empty when none). */
+  readonly warnings: PluginWarningInfo[];
 }
 /**
  * Helper type to detect type errors when looking up RegisteredPlugins

package/dist/types.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.cts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;;;;;;;;;;;UAuBiB;;;;KAKL,YAAY,OAAO,mBAAmB,WAAW,WAAW;;;;KAK5D;UACF;EACR;IACE,UAAU;IACV,WAAW;IACX,SAAS;IACT,SAAS;;;;;;KAOD;EACN,QAAQ;EAAsB;EAAiB;EAAkB;;EACjE;EAAgB;EAAkB;;;;;KAK5B,kBAAkB,KAAK;EAAY,cAAc;IAAM;;;;KAKvD,yBAAyB,UAAU,eAAe,2BAC3D,WAAW,IAAI,EAAE;EAAa,cAAc;IACzC,IACA,gBAAgB,oBACd,kBAAkB;;;;KAOd,eAAe,KAAK;EAC9B;IAAW,gBAAgB,UAAU;;IAEnC;;;;KAMQ,gBAAgB,KAAK;EAAY;IAAW,iBAAiB,UAAU;;IAC/E;;;;KAMQ,cAAc,KAAK;EAAY;IAAW,eAAe,UAAU;;IAC3E;;;;KAMQ,cAAc,KAAK;EAC7B;IAAW,eAAe,UAAU;;IAElC;;;;;KAOQ,iBAAiB,KAAK,iBAAiB,eAAe;;;;KAKtD,iBAAiB,KAAK,aAAa,iBAAiB;;;;;;KAOpD,oBAAoB;EAC9B,SAAS,UAAU,mBAAmB,OAAO,iBAAiB;EAC9D,QAAQ,iBAAiB;;;;;;;KAQf,iBAAiB,gBAAgB,GAAG,IAAI,qBAAqB,EAAE;EACzE,eAAe;IAEb;EACE,gBAAgB,UAAU;EAC1B,iBAAiB,UAAU;EAC3B,eAAe,UAAU;EACzB,eAAe,wBAAwB;IAEvC,OAAO,GAAG,GAAG,GAAG;;;;KAOV,mBAAmB,KAC7B,cAAc,WAAW,YAAY,iBAAiB,cAAc;;;;KAK1D,kBAAkB;EAC5B,WAAW,iBAAiB,gBAAgB;EAC5C,SAAS,iBAAiB,cAAc;;;;;KAM9B;WACD;WACA;WACA;;;;;KAMC,iBAAiB,eAAe;;;;;UAM3B;GACd;;;;;UAMc,aAAa,UAAU,YAAY;WACzC,gBAAgB;WAChB,UAAU;;;;;UAMJ,eAAe,UAAU,YAAY;WAC3C,QAAQ;WACR,UAAU;;;;;UAMJ,kBAAkB,UAAU,YAAY;WAC9C,QAAQ;WACR,UAAU;WACV;IACP,WAAW,kBAAkB;IAC7B,SAAS,kBAAkB;;;;;;;WAOpB,eAAe,QAAQ;WACvB,OAAO,MAAM;;;;;KAMnB,oBAAoB,gBAAgB,GAAG,IAAI,qBAAqB,EAAE;EACrE,eAAe;IAEb;EACE,UAAU;EACV,WAAW;EACX,SAAS;EACT,SAAS;wBAGI,4IACF;;;;;;KAOL,gBAAgB,gBAAgB,GAAG,IAAI,qBACjD,oBAAoB,GAAG;WAER,eAAe,UAAU,mBAAmB,EAAE,QAAQ,iBAAiB,EAAE;WACzE,QAAQ,iBAAiB,EAAE;WAC3B,UAAU;WACV,aAAa,kBAAkB,iBAAiB,GAAG;IAE9D,oBAAoB,GAAG;;;;;;;KAQxB,WAAW,KAAK;EAAY,uBAAuB;IAAM,IAAI;;;;kBAKjD;;;;;;;;;;;;;;;;;;OAkBH,MACV,kBACA,SAAS,qBACP,gBAAgB,WAAW,UAAU,gBAAgB,GAAG,WAAW;;;;;UAMxD,oBACf,UAAU,eAAe,uBAAuB,eAAe;EAE/D,UAAU;EACV,UAAU"}
+{"version":3,"file":"types.d.cts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;;;;;;;;;;;;UAwBiB;;;;KAKL,YAAY,OAAO,mBAAmB,WAAW,WAAW;;;;KAK5D;UACF;EACR;IACE,UAAU;IACV,WAAW;IACX,SAAS;IACT,SAAS;;;;;;KAOD;EACN,QAAQ;EAAsB;EAAiB;EAAkB;;EACjE;EAAgB;EAAkB;;;;;KAK5B,kBAAkB,KAAK;EAAY,cAAc;IAAM;;;;KAKvD,yBAAyB,UAAU,eAAe,2BAC3D,WAAW,IAAI,EAAE;EAAa,cAAc;IACzC,IACA,gBAAgB,oBACd,kBAAkB;;;;KAOd,eAAe,KAAK;EAC9B;IAAW,gBAAgB,UAAU;;IAEnC;;;;KAMQ,gBAAgB,KAAK;EAAY;IAAW,iBAAiB,UAAU;;IAC/E;;;;KAMQ,cAAc,KAAK;EAAY;IAAW,eAAe,UAAU;;IAC3E;;;;KAMQ,cAAc,KAAK;EAC7B;IAAW,eAAe,UAAU;;IAElC;;;;;KAOQ,iBAAiB,KAAK,iBAAiB,eAAe;;;;KAKtD,iBAAiB,KAAK,aAAa,iBAAiB;;;;;;KAOpD,oBAAoB;EAC9B,SAAS,UAAU,mBAAmB,OAAO,iBAAiB;EAC9D,QAAQ,iBAAiB;;;;;;;KAQf,iBAAiB,gBAAgB,GAAG,IAAI,qBAAqB,EAAE;EACzE,eAAe;IAEb;EACE,gBAAgB,UAAU;EAC1B,iBAAiB,UAAU;EAC3B,eAAe,UAAU;EACzB,eAAe,wBAAwB;IAEvC,OAAO,GAAG,GAAG,GAAG;;;;KAOV,mBAAmB,KAC7B,cAAc,WAAW,YAAY,iBAAiB,cAAc;;;;KAK1D,kBAAkB;EAC5B,WAAW,iBAAiB,gBAAgB;EAC5C,SAAS,iBAAiB,cAAc;;;;;KAM9B;WACD;WACA;WACA;;;;;KAMC,iBAAiB,eAAe;;;;;UAM3B;GACd;;;;;UAMc,aAAa,UAAU,YAAY;WACzC,gBAAgB;WAChB,UAAU;;;;;UAMJ,eAAe,UAAU,YAAY;WAC3C,QAAQ;WACR,UAAU;;;;;UAMJ,kBAAkB,UAAU,YAAY;WAC9C,QAAQ;WACR,UAAU;WACV;IACP,WAAW,kBAAkB;IAC7B,SAAS,kBAAkB;;;;;;;WAOpB,eAAe,QAAQ;WACvB,OAAO,MAAM;;WAEb,UAAU;;;;;KAMhB,oBAAoB,gBAAgB,GAAG,IAAI,qBAAqB,EAAE;EACrE,eAAe;IAEb;EACE,UAAU;EACV,WAAW;EACX,SAAS;EACT,SAAS;wBAGI,4IACF;;;;;;KAOL,gBAAgB,gBAAgB,GAAG,IAAI,qBACjD,oBAAoB,GAAG;WAER,eAAe,UAAU,mBAAmB,EAAE,QAAQ,iBAAiB,EAAE;WACzE,QAAQ,iBAAiB,EAAE;WAC3B,UAAU;WACV,aAAa,kBAAkB,iBAAiB,GAAG;IAE9D,oBAAoB,GAAG;;;;;;;KAQxB,WAAW,KAAK;EAAY,uBAAuB;IAAM,IAAI;;;;kBAKjD;;;;;;;;;;;;;;;;;;OAkBH,MACV,kBACA,SAAS,qBACP,gBAAgB,WAAW,UAAU,gBAAgB,GAAG,WAAW;;;;;UAMxD,oBACf,UAAU,eAAe,uBAAuB,eAAe;EAE/D,UAAU;EACV,UAAU"}

package/dist/types.d.mts

@@ -1,3 +1,4 @@
+import { PluginWarningInfo } from "./runtime/errors.mjs";
 import { Plugin } from "./plugin.mjs";
 import { Context, Scope } from "effect";
 import { ContractedRouter, RouterClient } from "@orpc/server";
@@ -181,6 +182,8 @@ interface InitializedPlugin<T extends AnyPlugin = AnyPlugin> {
    */
   readonly effectContext: Context.Context<any>;
   readonly scope: Scope.Closeable;
+  /** Non-fatal config warnings collected during initialization (empty when none). */
+  readonly warnings: PluginWarningInfo[];
 }
 /**
  * Helper type to detect type errors when looking up RegisteredPlugins

package/dist/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;;;;;;;;;;;UAuBiB;;;;KAKL,YAAY,OAAO,mBAAmB,WAAW,WAAW;;;;KAK5D;UACF;EACR;IACE,UAAU;IACV,WAAW;IACX,SAAS;IACT,SAAS;;;;;;KAOD;EACN,QAAQ;EAAsB;EAAiB;EAAkB;;EACjE;EAAgB;EAAkB;;;;;KAK5B,kBAAkB,KAAK;EAAY,cAAc;IAAM;;;;KAKvD,yBAAyB,UAAU,eAAe,2BAC3D,WAAW,IAAI,EAAE;EAAa,cAAc;IACzC,IACA,gBAAgB,oBACd,kBAAkB;;;;KAOd,eAAe,KAAK;EAC9B;IAAW,gBAAgB,UAAU;;IAEnC;;;;KAMQ,gBAAgB,KAAK;EAAY;IAAW,iBAAiB,UAAU;;IAC/E;;;;KAMQ,cAAc,KAAK;EAAY;IAAW,eAAe,UAAU;;IAC3E;;;;KAMQ,cAAc,KAAK;EAC7B;IAAW,eAAe,UAAU;;IAElC;;;;;KAOQ,iBAAiB,KAAK,iBAAiB,eAAe;;;;KAKtD,iBAAiB,KAAK,aAAa,iBAAiB;;;;;;KAOpD,oBAAoB;EAC9B,SAAS,UAAU,mBAAmB,OAAO,iBAAiB;EAC9D,QAAQ,iBAAiB;;;;;;;KAQf,iBAAiB,gBAAgB,GAAG,IAAI,qBAAqB,EAAE;EACzE,eAAe;IAEb;EACE,gBAAgB,UAAU;EAC1B,iBAAiB,UAAU;EAC3B,eAAe,UAAU;EACzB,eAAe,wBAAwB;IAEvC,OAAO,GAAG,GAAG,GAAG;;;;KAOV,mBAAmB,KAC7B,cAAc,WAAW,YAAY,iBAAiB,cAAc;;;;KAK1D,kBAAkB;EAC5B,WAAW,iBAAiB,gBAAgB;EAC5C,SAAS,iBAAiB,cAAc;;;;;KAM9B;WACD;WACA;WACA;;;;;KAMC,iBAAiB,eAAe;;;;;UAM3B;GACd;;;;;UAMc,aAAa,UAAU,YAAY;WACzC,gBAAgB;WAChB,UAAU;;;;;UAMJ,eAAe,UAAU,YAAY;WAC3C,QAAQ;WACR,UAAU;;;;;UAMJ,kBAAkB,UAAU,YAAY;WAC9C,QAAQ;WACR,UAAU;WACV;IACP,WAAW,kBAAkB;IAC7B,SAAS,kBAAkB;;;;;;;WAOpB,eAAe,QAAQ;WACvB,OAAO,MAAM;;;;;KAMnB,oBAAoB,gBAAgB,GAAG,IAAI,qBAAqB,EAAE;EACrE,eAAe;IAEb;EACE,UAAU;EACV,WAAW;EACX,SAAS;EACT,SAAS;wBAGI,4IACF;;;;;;KAOL,gBAAgB,gBAAgB,GAAG,IAAI,qBACjD,oBAAoB,GAAG;WAER,eAAe,UAAU,mBAAmB,EAAE,QAAQ,iBAAiB,EAAE;WACzE,QAAQ,iBAAiB,EAAE;WAC3B,UAAU;WACV,aAAa,kBAAkB,iBAAiB,GAAG;IAE9D,oBAAoB,GAAG;;;;;;;KAQxB,WAAW,KAAK;EAAY,uBAAuB;IAAM,IAAI;;;;kBAKjD;;;;;;;;;;;;;;;;;;OAkBH,MACV,kBACA,SAAS,qBACP,gBAAgB,WAAW,UAAU,gBAAgB,GAAG,WAAW;;;;;UAMxD,oBACf,UAAU,eAAe,uBAAuB,eAAe;EAE/D,UAAU;EACV,UAAU"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../src/types.ts"],"mappings":";;;;;;;;;;;;;;;;;;UAwBiB;;;;KAKL,YAAY,OAAO,mBAAmB,WAAW,WAAW;;;;KAK5D;UACF;EACR;IACE,UAAU;IACV,WAAW;IACX,SAAS;IACT,SAAS;;;;;;KAOD;EACN,QAAQ;EAAsB;EAAiB;EAAkB;;EACjE;EAAgB;EAAkB;;;;;KAK5B,kBAAkB,KAAK;EAAY,cAAc;IAAM;;;;KAKvD,yBAAyB,UAAU,eAAe,2BAC3D,WAAW,IAAI,EAAE;EAAa,cAAc;IACzC,IACA,gBAAgB,oBACd,kBAAkB;;;;KAOd,eAAe,KAAK;EAC9B;IAAW,gBAAgB,UAAU;;IAEnC;;;;KAMQ,gBAAgB,KAAK;EAAY;IAAW,iBAAiB,UAAU;;IAC/E;;;;KAMQ,cAAc,KAAK;EAAY;IAAW,eAAe,UAAU;;IAC3E;;;;KAMQ,cAAc,KAAK;EAC7B;IAAW,eAAe,UAAU;;IAElC;;;;;KAOQ,iBAAiB,KAAK,iBAAiB,eAAe;;;;KAKtD,iBAAiB,KAAK,aAAa,iBAAiB;;;;;;KAOpD,oBAAoB;EAC9B,SAAS,UAAU,mBAAmB,OAAO,iBAAiB;EAC9D,QAAQ,iBAAiB;;;;;;;KAQf,iBAAiB,gBAAgB,GAAG,IAAI,qBAAqB,EAAE;EACzE,eAAe;IAEb;EACE,gBAAgB,UAAU;EAC1B,iBAAiB,UAAU;EAC3B,eAAe,UAAU;EACzB,eAAe,wBAAwB;IAEvC,OAAO,GAAG,GAAG,GAAG;;;;KAOV,mBAAmB,KAC7B,cAAc,WAAW,YAAY,iBAAiB,cAAc;;;;KAK1D,kBAAkB;EAC5B,WAAW,iBAAiB,gBAAgB;EAC5C,SAAS,iBAAiB,cAAc;;;;;KAM9B;WACD;WACA;WACA;;;;;KAMC,iBAAiB,eAAe;;;;;UAM3B;GACd;;;;;UAMc,aAAa,UAAU,YAAY;WACzC,gBAAgB;WAChB,UAAU;;;;;UAMJ,eAAe,UAAU,YAAY;WAC3C,QAAQ;WACR,UAAU;;;;;UAMJ,kBAAkB,UAAU,YAAY;WAC9C,QAAQ;WACR,UAAU;WACV;IACP,WAAW,kBAAkB;IAC7B,SAAS,kBAAkB;;;;;;;WAOpB,eAAe,QAAQ;WACvB,OAAO,MAAM;;WAEb,UAAU;;;;;KAMhB,oBAAoB,gBAAgB,GAAG,IAAI,qBAAqB,EAAE;EACrE,eAAe;IAEb;EACE,UAAU;EACV,WAAW;EACX,SAAS;EACT,SAAS;wBAGI,4IACF;;;;;;KAOL,gBAAgB,gBAAgB,GAAG,IAAI,qBACjD,oBAAoB,GAAG;WAER,eAAe,UAAU,mBAAmB,EAAE,QAAQ,iBAAiB,EAAE;WACzE,QAAQ,iBAAiB,EAAE;WAC3B,UAAU;WACV,aAAa,kBAAkB,iBAAiB,GAAG;IAE9D,oBAAoB,GAAG;;;;;;;KAQxB,WAAW,KAAK;EAAY,uBAAuB;IAAM,IAAI;;;;kBAKjD;;;;;;;;;;;;;;;;;;OAkBH,MACV,kBACA,SAAS,qBACP,gBAAgB,WAAW,UAAU,gBAAgB,GAAG,WAAW;;;;;UAMxD,oBACf,UAAU,eAAe,uBAAuB,eAAe;EAE/D,UAAU;EACV,UAAU"}

package/dist/version-manifest.cjs

@@ -46,7 +46,7 @@ const WorkspaceVersionManifestSchema = zod.z.object({
 * coordinate → a new version (and a new file).
 */
 function composeVersionManifest(input) {
-	const { builtAt, ...hashedInputs } = input;
+	const { builtAt: _builtAt, ...hashedInputs } = input;
 	const version = (0, node_crypto.createHash)("sha256").update(stableStringify(hashedInputs)).digest("hex").slice(0, 16);
 	return WorkspaceVersionManifestSchema.parse({
 		...input,

package/dist/version-manifest.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.cjs","names":["z","createHash"],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,MAAMA,MAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiCA,MAAE,OAAO;CACrD,SAASA,MAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAASA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAKA,MACF,OAAO;EACN,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiBA,MACd,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAGA,MAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAOA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;AAC5C,CAAC;;;;;;;;AAyBD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,GAAG,iBAAiB;CACrC,MAAM,cAAUC,wBAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
+{"version":3,"file":"version-manifest.cjs","names":["z","createHash"],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,MAAMA,MAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiCA,MAAE,OAAO;CACrD,SAASA,MAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAASA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAKA,MACF,OAAO;EACN,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiBA,MACd,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAGA,MAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAOA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;AAC5C,CAAC;;;;;;;;AAyBD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,cAAUC,wBAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}

package/dist/version-manifest.mjs

@@ -45,7 +45,7 @@ const WorkspaceVersionManifestSchema = z.object({
 * coordinate → a new version (and a new file).
 */
 function composeVersionManifest(input) {
-	const { builtAt, ...hashedInputs } = input;
+	const { builtAt: _builtAt, ...hashedInputs } = input;
 	const version = createHash("sha256").update(stableStringify(hashedInputs)).digest("hex").slice(0, 16);
 	return WorkspaceVersionManifestSchema.parse({
 		...input,

package/dist/version-manifest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.mjs","names":[],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiC,EAAE,OAAO;CACrD,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAK,EACF,OAAO;EACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiB,EACd,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;AAC5C,CAAC;;;;;;;;AAyBD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,GAAG,iBAAiB;CACrC,MAAM,UAAU,WAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
+{"version":3,"file":"version-manifest.mjs","names":[],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiC,EAAE,OAAO;CACrD,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAK,EACF,OAAO;EACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiB,EACd,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;AAC5C,CAAC;;;;;;;;AAyBD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,UAAU,WAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "every-plugin",
-  "version": "3.0.0-rc.0",
+  "version": "3.0.0-rc.3",
   "type": "module",
   "publishConfig": {
     "access": "public"

package/src/errors.ts

@@ -125,9 +125,10 @@ export const PLUGIN_ERROR_STATUS_MAP: Record<string, number> = {
   CONNECTION_ERROR: 502,
 } as const;
 
-export type { PluginLoadFailureInfo } from "./runtime/errors";
+export type { PluginLoadFailureInfo, PluginWarningInfo } from "./runtime/errors";
 export {
   classifyPluginFailure,
+  defaultMissingSecretWarnings,
   extractFromFiberFailure,
   formatORPCError,
   ModuleFederationError,

package/src/plugin.ts

@@ -5,6 +5,7 @@ import type { ContractedRouter, Implementer } from "@orpc/server";
 import { implement } from "@orpc/server";
 import type { Scope } from "effect";
 import { Context, Effect, Layer } from "effect";
+import type { PluginWarningInfo } from "./runtime/errors";
 import { type PluginRuntimeError, toPluginRuntimeError } from "./runtime/errors";
 
 type ContextOutput<T> = T extends AnySchema ? InferSchemaOutput<T> : Record<string, never>;
@@ -19,11 +20,20 @@ export type PluginConfigFor<
   context: TRequestContext;
 };
 
-type PluginInitializeInput<V extends AnySchema, S extends AnySchema> = {
+export type PluginInitializeInput<V extends AnySchema, S extends AnySchema> = {
   variables: InferSchemaOutput<V>;
   secrets: InferSchemaOutput<S>;
 };
 
+/**
+ * A plugin's own config-derived warnings, evaluated once with the validated
+ * config after initialization. Declaring `warnings` opts the plugin out of
+ * the loader's default missing-secret warning — these messages replace it.
+ */
+export type PluginWarningsFn<V extends AnySchema, S extends AnySchema> = (
+  config: PluginInitializeInput<V, S>,
+) => PluginWarningInfo[] | string[];
+
 export class PluginIdTag extends Context.Service<PluginIdTag, string>()("PluginId") {}
 
 /**
@@ -50,6 +60,13 @@ type PluginDefinition<
    * module statically.
    */
   servicesTag?: Context.Key<any, any>;
+  /**
+   * Optional warnings function evaluated once with the validated config after
+   * initialization. Returns structured non-fatal warnings (e.g. an optional
+   * secret was not set, so the feature depending on it is disabled).
+   * Declaring it opts out of the loader's default missing-secret warning.
+   */
+  warnings?: PluginWarningsFn<V, S>;
   /**
    * Initialize the plugin by returning an Effect `Layer`.
    *
@@ -107,6 +124,7 @@ export interface Plugin<
   readonly contract: TContract;
   readonly configSchema: PluginConfigFor<TVariables, TSecrets, TRequestContext>;
   readonly servicesTag?: Context.Key<any, any>;
+  readonly warnings?: PluginWarningsFn<TVariables, TSecrets>;
 
   initialize(
     config: PluginInitializeInput<TVariables, TSecrets>,
@@ -156,6 +174,7 @@ export const createPlugin: CreatePluginFn = function createPlugin<
     readonly contract = config.contract;
     readonly configSchema = configSchema;
     readonly servicesTag = config.servicesTag;
+    readonly warnings = config.warnings;
 
     initialize(
       pluginConfig: PluginInitializeInput<V, S>,

package/src/runtime/errors.ts

@@ -282,6 +282,50 @@ export interface PluginLoadFailureInfo {
   dbUrlMasked?: string;
 }
 
+/**
+ * Structured, serializable warning surfaced alongside plugin failures in
+ * health endpoints and dashboards. Warnings are non-fatal: the plugin loaded
+ * and initialized successfully, but runs with reduced functionality (e.g. an
+ * optional secret was not set, so the feature depending on it is disabled).
+ */
+export interface PluginWarningInfo {
+  /** loader-side key (host entry key, dev plugin id) */
+  pluginKey: string;
+  message: string;
+  hint?: string;
+}
+
+/**
+ * The loader's default warning policy for declared-but-unset secrets: a
+ * successfully initialized plugin whose declared secret names resolved to
+ * nothing (missing or empty in the environment) gets one consolidated
+ * warning. `*_DATABASE_URL` keys are excluded — they have the shared-API-DB
+ * fallback, and a genuinely-missing DB URL fails initialization (a `failure`,
+ * not a warning). A plugin that declares its own `warnings` function opts out
+ * of this default.
+ */
+export const defaultMissingSecretWarnings = (
+  pluginKey: string,
+  declaredKeys: readonly string[],
+  resolvedKeys: readonly string[],
+): PluginWarningInfo[] => {
+  const resolved = new Set(resolvedKeys);
+  const missing = declaredKeys.filter(
+    (key) => !resolved.has(key) && !key.endsWith("_DATABASE_URL"),
+  );
+  if (missing.length === 0) return [];
+  return [
+    {
+      pluginKey,
+      message:
+        missing.length === 1
+          ? `Declared secret ${missing[0]} is not set — features depending on it are disabled`
+          : `${missing.length} declared secrets are not set: ${missing.join(", ")} — features depending on them are disabled`,
+      hint: "Set the secret(s) in your environment (.env in development); see the plugin's config schema for what each enables",
+    },
+  ];
+};
+
 const NETWORK_RETRYABLE_PATTERNS = ["ETIMEDOUT", "ECONNRESET", "timeout", "503", "429"] as const;
 const NETWORK_DEAD_PATTERNS = ["ECONNREFUSED", "ENOTFOUND", "EHOSTUNREACH"] as const;
 const RETRYABLE_ORPC_CODES = new Set([

package/src/runtime/services/module-federation.service.ts

@@ -111,13 +111,10 @@ const resolveRemoteSelfName = (pluginId: string, url: string) =>
     const memo = remoteSelfNames.get(memoKey);
     if (memo) return memo;
 
-    let selfName: string | null = null;
-    try {
-      const manifest = yield* Effect.promise(() => fetchRemoteIdentityManifest(url));
-      selfName = manifest?.metaData?.name?.trim() || null;
-    } catch {
-      selfName = null;
-    }
+    const manifest = yield* Effect.tryPromise(() => fetchRemoteIdentityManifest(url)).pipe(
+      Effect.orElseSucceed(() => null),
+    );
+    const selfName = manifest?.metaData?.name?.trim() || null;
 
     const resolved = selfName ?? getNormalizedRemoteName(pluginId);
     remoteSelfNames.set(memoKey, resolved);

package/src/runtime/services/plugin-loader.service.ts

@@ -11,11 +11,39 @@ import type {
   PluginMetadata,
   PluginRegistry,
 } from "../../types";
+import type { PluginWarningInfo } from "../errors";
 import { PluginRuntimeError, toPluginRuntimeError } from "../errors";
 import { validate } from "../validation";
 import { ModuleFederationService } from "./module-federation.service";
 import { SecretsService } from "./secrets.service";
 
+/**
+ * Evaluate a plugin's `warnings` function against the validated config.
+ * Fail-safe: a throwing warnings function becomes a warning itself rather
+ * than failing initialization. Strings are normalized to `PluginWarningInfo`
+ * with the plugin's registry key.
+ */
+const collectPluginWarnings = (
+  plugin: AnyPlugin,
+  config: { variables: unknown; secrets: unknown },
+): PluginWarningInfo[] => {
+  const warningsFn = plugin.warnings;
+  if (!warningsFn) return [];
+  try {
+    const raw = warningsFn(config as never);
+    return raw.map((warning) =>
+      typeof warning === "string" ? { pluginKey: plugin.id, message: warning } : warning,
+    );
+  } catch (error) {
+    return [
+      {
+        pluginKey: plugin.id,
+        message: `Plugin warnings check failed: ${error instanceof Error ? error.message : String(error)}`,
+      },
+    ];
+  }
+};
+
 export class PluginRegistryTag extends Context.Service<PluginRegistryTag, PluginRegistry>()(
   "PluginRegistry",
 ) {}
@@ -313,6 +341,10 @@ export const PluginLoaderServiceDefault = Layer.effect(
             config: { variables: _variables, secrets: hydratedConfig.secrets },
             effectContext,
             scope,
+            warnings: collectPluginWarnings(plugin, {
+              variables: _variables,
+              secrets: hydratedConfig.secrets,
+            }),
           } satisfies InitializedPlugin<T>;
         }),
     };

package/src/runtime/services/shared-identity.ts

@@ -19,7 +19,7 @@ function manifestUrl(remoteUrl: string): string {
 
 function normalizeBaseUrl(remoteUrl: string): string {
   const withoutHash = remoteUrl.split("#")[0] ?? remoteUrl;
-  return withoutHash.replace(/\/(mf-manifest\.json|remoteEntry\.js)$/i, "");
+  return withoutHash.replace(/\/(mf-manifest\.json|remoteEntry(?:\.[^/]+)?\.js)$/i, "");
 }
 
 export function compareSharedIdentity(

package/src/types.ts

@@ -7,6 +7,7 @@ import type {
 import type { ContractedRouter, RouterClient } from "@orpc/server";
 import type { Context, Scope } from "effect";
 import type { Plugin } from "./plugin";
+import type { PluginWarningInfo } from "./runtime/errors";
 
 /**
  * Registry bindings interface - populated via module augmentation
@@ -204,6 +205,8 @@ export interface InitializedPlugin<T extends AnyPlugin = AnyPlugin> {
    */
   readonly effectContext: Context.Context<any>;
   readonly scope: Scope.Closeable;
+  /** Non-fatal config warnings collected during initialization (empty when none). */
+  readonly warnings: PluginWarningInfo[];
 }
 
 /**

package/src/version-manifest.ts

@@ -67,7 +67,7 @@ export interface VersionManifestInput {
  * coordinate → a new version (and a new file).
  */
 export function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {
-  const { builtAt, ...hashedInputs } = input;
+  const { builtAt: _builtAt, ...hashedInputs } = input;
   const version = createHash("sha256")
     .update(stableStringify(hashedInputs))
     .digest("hex")