every-plugin 3.0.0-rc.14 → 3.0.0-rc.16

package/dist/ui/manifest/mount-registry.d.cts

@@ -1,58 +1,51 @@
 //#region src/ui/manifest/mount-registry.d.ts
 /**
- * Mount registry v2 — gates only, shape-free (ADR 0008 §3).
+ * Mount registry v2 — shape-free (ADR 0008 §3).
  *
- * A mount is a gate + a host-owned pathless layout position. It carries no
- * product semantics (no "dashboard", no shell, no chrome) — plugins bring
- * their own layouts and route freely inside their subtree. A mount is
- * declared by a ROOT-level pathless layout file whose `_`-prefixed segment
- * names the mount (`_public.tsx` → `public`); the generator derives it and
- * validates it against this registry; gates are attached HOST-side at
- * construction, so a plugin cannot ship a route that escapes its mount's
- * gate (plugins never construct route objects).
+ * A mount is a host-owned pathless layout position. It carries no product
+ * semantics (no "dashboard", no shell, no chrome) — plugins bring their own
+ * layouts and route freely inside their subtree. A mount is declared by a
+ * ROOT-level pathless layout file whose `_`-prefixed segment names the mount
+ * (`_public.tsx` → `public`); the generator derives it and validates it
+ * against this registry; guards are ordinary beforeLoads attached HOST-side
+ * at construction from ConstructInput.guards, so a plugin cannot ship a
+ * route that escapes its mount's guard (plugins never construct route
+ * objects).
  *
- * `org`/`team` are declared vocabulary (parameterized membership gates) but
+ * `org`/`team` are declared vocabulary (parameterized membership) but
  * unimplemented — construction rejects them until they land.
  */
 interface MountDef {
-  label: string;
-  gate: "none" | "session" | "admin" | "organization" | "team";
-  parameterized?: boolean;
+  /** The composing framework supplies this mount's guard via ConstructInput.guards. */
+  guarded: boolean;
   implemented: boolean;
 }
 declare const MOUNT_REGISTRY: {
-  public: {
-    label: string;
-    gate: "none";
-    implemented: true;
+  readonly public: {
+    readonly guarded: false;
+    readonly implemented: true;
   };
-  authenticated: {
-    label: string;
-    gate: "session";
-    implemented: true;
+  readonly authenticated: {
+    readonly guarded: true;
+    readonly implemented: true;
   };
-  admin: {
-    label: string;
-    gate: "admin";
-    implemented: true;
+  readonly admin: {
+    readonly guarded: true;
+    readonly implemented: true;
   };
-  org: {
-    label: string;
-    gate: "organization";
-    parameterized: true;
-    implemented: false;
+  readonly org: {
+    readonly guarded: true;
+    readonly implemented: false;
   };
-  team: {
-    label: string;
-    gate: "team";
-    parameterized: true;
-    implemented: false;
+  readonly team: {
+    readonly guarded: true;
+    readonly implemented: false;
   };
 };
 type MountId = Extract<keyof typeof MOUNT_REGISTRY, string>;
 declare const MOUNTS: MountId[];
 /** Bump when the registry shape changes — invalidates all compose digests. */
-declare const MOUNT_REGISTRY_VERSION = 5;
+declare const MOUNT_REGISTRY_VERSION = 6;
 /** Migration aliases: legacy `_`-segment names → canonical mounts. */
 declare const MOUNT_ALIASES: Record<string, MountId>;
 declare function resolveMountSegment(segment: string): MountId | undefined;

package/dist/ui/manifest/mount-registry.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-registry.d.cts","names":[],"sources":["../../../src/ui/manifest/mount-registry.ts"],"mappings":";;;;;;;;;;;;;;;;UAgBiB;EACf;EACA;EACA;EACA;;cAGW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQD,UAAU,qBAAqB;cAE9B,QAAwC;;cAGxC;;cAGA,eAAe,eAAe;iBAO3B,oBAAoB,kBAAkB"}
+{"version":3,"file":"mount-registry.d.cts","names":[],"sources":["../../../src/ui/manifest/mount-registry.ts"],"mappings":";;;;;;;;;;;;;;;;;UAiBiB;;EAEf;EACA;;cAGW;;aACD;aAAgB;;;aACT;aAAe;;;aACvB;aAAe;;;aACjB;aAAe;;;aACd;aAAe;;;KAGb,UAAU,qBAAqB;cAE9B,QAAwC;;cAGxC;;cAGA,eAAe,eAAe;iBAO3B,oBAAoB,kBAAkB"}

package/dist/ui/manifest/mount-registry.d.mts

@@ -1,58 +1,51 @@
 //#region src/ui/manifest/mount-registry.d.ts
 /**
- * Mount registry v2 — gates only, shape-free (ADR 0008 §3).
+ * Mount registry v2 — shape-free (ADR 0008 §3).
  *
- * A mount is a gate + a host-owned pathless layout position. It carries no
- * product semantics (no "dashboard", no shell, no chrome) — plugins bring
- * their own layouts and route freely inside their subtree. A mount is
- * declared by a ROOT-level pathless layout file whose `_`-prefixed segment
- * names the mount (`_public.tsx` → `public`); the generator derives it and
- * validates it against this registry; gates are attached HOST-side at
- * construction, so a plugin cannot ship a route that escapes its mount's
- * gate (plugins never construct route objects).
+ * A mount is a host-owned pathless layout position. It carries no product
+ * semantics (no "dashboard", no shell, no chrome) — plugins bring their own
+ * layouts and route freely inside their subtree. A mount is declared by a
+ * ROOT-level pathless layout file whose `_`-prefixed segment names the mount
+ * (`_public.tsx` → `public`); the generator derives it and validates it
+ * against this registry; guards are ordinary beforeLoads attached HOST-side
+ * at construction from ConstructInput.guards, so a plugin cannot ship a
+ * route that escapes its mount's guard (plugins never construct route
+ * objects).
  *
- * `org`/`team` are declared vocabulary (parameterized membership gates) but
+ * `org`/`team` are declared vocabulary (parameterized membership) but
  * unimplemented — construction rejects them until they land.
  */
 interface MountDef {
-  label: string;
-  gate: "none" | "session" | "admin" | "organization" | "team";
-  parameterized?: boolean;
+  /** The composing framework supplies this mount's guard via ConstructInput.guards. */
+  guarded: boolean;
   implemented: boolean;
 }
 declare const MOUNT_REGISTRY: {
-  public: {
-    label: string;
-    gate: "none";
-    implemented: true;
+  readonly public: {
+    readonly guarded: false;
+    readonly implemented: true;
   };
-  authenticated: {
-    label: string;
-    gate: "session";
-    implemented: true;
+  readonly authenticated: {
+    readonly guarded: true;
+    readonly implemented: true;
   };
-  admin: {
-    label: string;
-    gate: "admin";
-    implemented: true;
+  readonly admin: {
+    readonly guarded: true;
+    readonly implemented: true;
   };
-  org: {
-    label: string;
-    gate: "organization";
-    parameterized: true;
-    implemented: false;
+  readonly org: {
+    readonly guarded: true;
+    readonly implemented: false;
   };
-  team: {
-    label: string;
-    gate: "team";
-    parameterized: true;
-    implemented: false;
+  readonly team: {
+    readonly guarded: true;
+    readonly implemented: false;
   };
 };
 type MountId = Extract<keyof typeof MOUNT_REGISTRY, string>;
 declare const MOUNTS: MountId[];
 /** Bump when the registry shape changes — invalidates all compose digests. */
-declare const MOUNT_REGISTRY_VERSION = 5;
+declare const MOUNT_REGISTRY_VERSION = 6;
 /** Migration aliases: legacy `_`-segment names → canonical mounts. */
 declare const MOUNT_ALIASES: Record<string, MountId>;
 declare function resolveMountSegment(segment: string): MountId | undefined;

package/dist/ui/manifest/mount-registry.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"mount-registry.d.mts","names":[],"sources":["../../../src/ui/manifest/mount-registry.ts"],"mappings":";;;;;;;;;;;;;;;;UAgBiB;EACf;EACA;EACA;EACA;;cAGW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAQD,UAAU,qBAAqB;cAE9B,QAAwC;;cAGxC;;cAGA,eAAe,eAAe;iBAO3B,oBAAoB,kBAAkB"}
+{"version":3,"file":"mount-registry.d.mts","names":[],"sources":["../../../src/ui/manifest/mount-registry.ts"],"mappings":";;;;;;;;;;;;;;;;;UAiBiB;;EAEf;EACA;;cAGW;;aACD;aAAgB;;;aACT;aAAe;;;aACvB;aAAe;;;aACjB;aAAe;;;aACd;aAAe;;;KAGb,UAAU,qBAAqB;cAE9B,QAAwC;;cAGxC;;cAGA,eAAe,eAAe;iBAO3B,oBAAoB,kBAAkB"}

package/dist/ui/manifest/mount-registry.mjs

@@ -1,36 +1,29 @@
 //#region src/ui/manifest/mount-registry.ts
 const MOUNT_REGISTRY = {
 	public: {
-		label: "public",
-		gate: "none",
+		guarded: false,
 		implemented: true
 	},
 	authenticated: {
-		label: "authenticated",
-		gate: "session",
+		guarded: true,
 		implemented: true
 	},
 	admin: {
-		label: "admin",
-		gate: "admin",
+		guarded: true,
 		implemented: true
 	},
 	org: {
-		label: "org",
-		gate: "organization",
-		parameterized: true,
+		guarded: true,
 		implemented: false
 	},
 	team: {
-		label: "team",
-		gate: "team",
-		parameterized: true,
+		guarded: true,
 		implemented: false
 	}
 };
 const MOUNTS = Object.keys(MOUNT_REGISTRY);
 /** Bump when the registry shape changes — invalidates all compose digests. */
-const MOUNT_REGISTRY_VERSION = 5;
+const MOUNT_REGISTRY_VERSION = 6;
 /** Migration aliases: legacy `_`-segment names → canonical mounts. */
 const MOUNT_ALIASES = {
 	auth: "authenticated",

package/dist/ui/manifest/mount-registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mount-registry.mjs","names":[],"sources":["../../../src/ui/manifest/mount-registry.ts"],"sourcesContent":["/**\n * Mount registry v2 — gates only, shape-free (ADR 0008 §3).\n *\n * A mount is a gate + a host-owned pathless layout position. It carries no\n * product semantics (no \"dashboard\", no shell, no chrome) — plugins bring\n * their own layouts and route freely inside their subtree. A mount is\n * declared by a ROOT-level pathless layout file whose `_`-prefixed segment\n * names the mount (`_public.tsx` → `public`); the generator derives it and\n * validates it against this registry; gates are attached HOST-side at\n * construction, so a plugin cannot ship a route that escapes its mount's\n * gate (plugins never construct route objects).\n *\n * `org`/`team` are declared vocabulary (parameterized membership gates) but\n * unimplemented — construction rejects them until they land.\n */\n\nexport interface MountDef {\n  label: string;\n  gate: \"none\" | \"session\" | \"admin\" | \"organization\" | \"team\";\n  parameterized?: boolean;\n  implemented: boolean;\n}\n\nexport const MOUNT_REGISTRY = {\n  public: { label: \"public\", gate: \"none\", implemented: true },\n  authenticated: { label: \"authenticated\", gate: \"session\", implemented: true },\n  admin: { label: \"admin\", gate: \"admin\", implemented: true },\n  org: { label: \"org\", gate: \"organization\", parameterized: true, implemented: false },\n  team: { label: \"team\", gate: \"team\", parameterized: true, implemented: false },\n} satisfies Record<string, MountDef>;\n\nexport type MountId = Extract<keyof typeof MOUNT_REGISTRY, string>;\n\nexport const MOUNTS = Object.keys(MOUNT_REGISTRY) as MountId[];\n\n/** Bump when the registry shape changes — invalidates all compose digests. */\nexport const MOUNT_REGISTRY_VERSION = 5;\n\n/** Migration aliases: legacy `_`-segment names → canonical mounts. */\nexport const MOUNT_ALIASES: Record<string, MountId> = {\n  auth: \"authenticated\",\n  authed: \"authenticated\",\n  dashboard: \"authenticated\",\n  organization: \"org\",\n};\n\nexport function resolveMountSegment(segment: string): MountId | undefined {\n  if (segment in MOUNT_REGISTRY) return segment as MountId;\n  return MOUNT_ALIASES[segment];\n}\n"],"mappings":";AAuBA,MAAa,iBAAiB;CAC5B,QAAQ;EAAE,OAAO;EAAU,MAAM;EAAQ,aAAa;CAAK;CAC3D,eAAe;EAAE,OAAO;EAAiB,MAAM;EAAW,aAAa;CAAK;CAC5E,OAAO;EAAE,OAAO;EAAS,MAAM;EAAS,aAAa;CAAK;CAC1D,KAAK;EAAE,OAAO;EAAO,MAAM;EAAgB,eAAe;EAAM,aAAa;CAAM;CACnF,MAAM;EAAE,OAAO;EAAQ,MAAM;EAAQ,eAAe;EAAM,aAAa;CAAM;AAC/E;AAIA,MAAa,SAAS,OAAO,KAAK,cAAc;;AAGhD,MAAa,yBAAyB;;AAGtC,MAAa,gBAAyC;CACpD,MAAM;CACN,QAAQ;CACR,WAAW;CACX,cAAc;AAChB;AAEA,SAAgB,oBAAoB,SAAsC;CACxE,IAAI,WAAW,gBAAgB,OAAO;CACtC,OAAO,cAAc;AACvB"}
+{"version":3,"file":"mount-registry.mjs","names":[],"sources":["../../../src/ui/manifest/mount-registry.ts"],"sourcesContent":["/**\n * Mount registry v2 — shape-free (ADR 0008 §3).\n *\n * A mount is a host-owned pathless layout position. It carries no product\n * semantics (no \"dashboard\", no shell, no chrome) — plugins bring their own\n * layouts and route freely inside their subtree. A mount is declared by a\n * ROOT-level pathless layout file whose `_`-prefixed segment names the mount\n * (`_public.tsx` → `public`); the generator derives it and validates it\n * against this registry; guards are ordinary beforeLoads attached HOST-side\n * at construction from ConstructInput.guards, so a plugin cannot ship a\n * route that escapes its mount's guard (plugins never construct route\n * objects).\n *\n * `org`/`team` are declared vocabulary (parameterized membership) but\n * unimplemented — construction rejects them until they land.\n */\n\nexport interface MountDef {\n  /** The composing framework supplies this mount's guard via ConstructInput.guards. */\n  guarded: boolean;\n  implemented: boolean;\n}\n\nexport const MOUNT_REGISTRY = {\n  public: { guarded: false, implemented: true },\n  authenticated: { guarded: true, implemented: true },\n  admin: { guarded: true, implemented: true },\n  org: { guarded: true, implemented: false },\n  team: { guarded: true, implemented: false },\n} as const satisfies Record<string, MountDef>;\n\nexport type MountId = Extract<keyof typeof MOUNT_REGISTRY, string>;\n\nexport const MOUNTS = Object.keys(MOUNT_REGISTRY) as MountId[];\n\n/** Bump when the registry shape changes — invalidates all compose digests. */\nexport const MOUNT_REGISTRY_VERSION = 6;\n\n/** Migration aliases: legacy `_`-segment names → canonical mounts. */\nexport const MOUNT_ALIASES: Record<string, MountId> = {\n  auth: \"authenticated\",\n  authed: \"authenticated\",\n  dashboard: \"authenticated\",\n  organization: \"org\",\n};\n\nexport function resolveMountSegment(segment: string): MountId | undefined {\n  if (segment in MOUNT_REGISTRY) return segment as MountId;\n  return MOUNT_ALIASES[segment];\n}\n"],"mappings":";AAuBA,MAAa,iBAAiB;CAC5B,QAAQ;EAAE,SAAS;EAAO,aAAa;CAAK;CAC5C,eAAe;EAAE,SAAS;EAAM,aAAa;CAAK;CAClD,OAAO;EAAE,SAAS;EAAM,aAAa;CAAK;CAC1C,KAAK;EAAE,SAAS;EAAM,aAAa;CAAM;CACzC,MAAM;EAAE,SAAS;EAAM,aAAa;CAAM;AAC5C;AAIA,MAAa,SAAS,OAAO,KAAK,cAAc;;AAGhD,MAAa,yBAAyB;;AAGtC,MAAa,gBAAyC;CACpD,MAAM;CACN,QAAQ;CACR,WAAW;CACX,cAAc;AAChB;AAEA,SAAgB,oBAAoB,SAAsC;CACxE,IAAI,WAAW,gBAAgB,OAAO;CACtC,OAAO,cAAc;AACvB"}

package/dist/version-manifest.cjs

@@ -12,10 +12,23 @@ let node_crypto = require("node:crypto");
 * stops growing with artifact kinds and old versions stay fully servable.
 */
 const SRI = zod.z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);
+/** Slot-relative directory holding one deploy's immutable file copies (#826). */
+const VERSION_DIR_PATTERN = /^versions\/[0-9a-f]{16}$/;
 const WorkspaceVersionManifestSchema = zod.z.object({
 	version: zod.z.string().regex(/^[0-9a-f]{16}$/),
 	builtAt: zod.z.string().optional(),
 	gitSha: zod.z.string().optional(),
+	/**
+	* Slot-relative directory (`versions/<dirId>`) holding this deploy's
+	* byte-immutable copies of every dist file (#826). When present, all
+	* artifact coordinates below resolve against `<slotBase>/<dir>/` — so a
+	* pinned child's entry fetches its expose chunk and chunks from the same
+	* frozen directory instead of the mutable slot root. Absent on legacy
+	* manifests: coordinates resolve against the slot root exactly as before.
+	* Derived from the `files` map (see `versionDirPath`), so it participates
+	* in the version hash without circularity.
+	*/
+	dir: zod.z.string().regex(VERSION_DIR_PATTERN).optional(),
 	entry: zod.z.string().min(1),
 	entryIntegrity: SRI,
 	ssr: zod.z.object({
@@ -65,6 +78,16 @@ function composeVersionManifest(input) {
 		version
 	});
 }
+/**
+* The content-addressed directory name for one dist's file set (#826): a
+* 16-hex hash over the canonical files map. Identical bytes → identical
+* directory → re-deploying unchanged content is a server-side no-op, and a
+* published pin's directory can never be rewritten by a later deploy
+* (the upload service refuses conflicting writes under `versions/`).
+*/
+function versionDirPath(files) {
+	return `versions/${(0, node_crypto.createHash)("sha256").update(stableStringify(files)).digest("hex").slice(0, 16)}`;
+}
 function stableStringify(value) {
 	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
 	if (value && typeof value === "object") return `{${Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).sort().join(",")}}`;
@@ -72,6 +95,8 @@ function stableStringify(value) {
 }
 
 //#endregion
+exports.VERSION_DIR_PATTERN = VERSION_DIR_PATTERN;
 exports.WorkspaceVersionManifestSchema = WorkspaceVersionManifestSchema;
 exports.composeVersionManifest = composeVersionManifest;
+exports.versionDirPath = versionDirPath;
 //# sourceMappingURL=version-manifest.cjs.map

package/dist/version-manifest.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.cjs","names":["z","createHash"],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n  /**\n   * Source archive of the workspace subtree (object path → served-object SRI)\n   * published beside the dists when the runtime opts in via\n   * `publish.sourcePublish` — lets `bos import` dereference a published\n   * config slot to the exact source bytes that build came from, with no\n   * GitHub dependency. Readers that predate the field ignore it (zod strips\n   * unknown keys). Participates in the version hash.\n   */\n  source: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n  source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,MAAMA,MAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiCA,MAAE,OAAO;CACrD,SAASA,MAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAASA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAKA,MACF,OAAO;EACN,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiBA,MACd,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAGA,MAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAOA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQA,MACL,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;;;;;AA6BD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,cAAUC,wBAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
+{"version":3,"file":"version-manifest.cjs","names":["z","createHash"],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\n/** Slot-relative directory holding one deploy's immutable file copies (#826). */\nexport const VERSION_DIR_PATTERN = /^versions\\/[0-9a-f]{16}$/;\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  /**\n   * Slot-relative directory (`versions/<dirId>`) holding this deploy's\n   * byte-immutable copies of every dist file (#826). When present, all\n   * artifact coordinates below resolve against `<slotBase>/<dir>/` — so a\n   * pinned child's entry fetches its expose chunk and chunks from the same\n   * frozen directory instead of the mutable slot root. Absent on legacy\n   * manifests: coordinates resolve against the slot root exactly as before.\n   * Derived from the `files` map (see `versionDirPath`), so it participates\n   * in the version hash without circularity.\n   */\n  dir: z.string().regex(VERSION_DIR_PATTERN).optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n  /**\n   * Source archive of the workspace subtree (object path → served-object SRI)\n   * published beside the dists when the runtime opts in via\n   * `publish.sourcePublish` — lets `bos import` dereference a published\n   * config slot to the exact source bytes that build came from, with no\n   * GitHub dependency. Readers that predate the field ignore it (zod strips\n   * unknown keys). Participates in the version hash.\n   */\n  source: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  dir?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n  source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\n/**\n * The content-addressed directory name for one dist's file set (#826): a\n * 16-hex hash over the canonical files map. Identical bytes → identical\n * directory → re-deploying unchanged content is a server-side no-op, and a\n * published pin's directory can never be rewritten by a later deploy\n * (the upload service refuses conflicting writes under `versions/`).\n */\nexport function versionDirPath(files: Record<string, string>): string {\n  const id = createHash(\"sha256\").update(stableStringify(files)).digest(\"hex\").slice(0, 16);\n  return `versions/${id}`;\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,MAAMA,MAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;;AAGvD,MAAa,sBAAsB;AAEnC,MAAa,iCAAiCA,MAAE,OAAO;CACrD,SAASA,MAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAASA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQA,MAAE,OAAO,CAAC,CAAC,SAAS;;;;;;;;;;;CAW5B,KAAKA,MAAE,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,SAAS;CACpD,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAKA,MACF,OAAO;EACN,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiBA,MACd,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAGA,MAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAOA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQA,MACL,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;;;;;AA8BD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,cAAUC,wBAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;;;;;;;;AASA,SAAgB,eAAe,OAAuC;CAEpE,OAAO,gBADIA,wBAAW,QAAQ,CAAC,CAAC,OAAO,gBAAgB,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAClE;AACtB;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}

package/dist/version-manifest.d.cts

@@ -1,9 +1,12 @@
 import { z } from "zod";
 //#region src/version-manifest.d.ts
+/** Slot-relative directory holding one deploy's immutable file copies (#826). */
+declare const VERSION_DIR_PATTERN: RegExp;
 declare const WorkspaceVersionManifestSchema: z.ZodObject<{
   version: z.ZodString;
   builtAt: z.ZodOptional<z.ZodString>;
   gitSha: z.ZodOptional<z.ZodString>;
+  dir: z.ZodOptional<z.ZodString>;
   entry: z.ZodString;
   entryIntegrity: z.ZodString;
   ssr: z.ZodOptional<z.ZodObject<{
@@ -31,6 +34,7 @@ interface VersionManifestInput {
    * staged copy and the CDN's immutability for republished versions. */
   builtAt?: string;
   gitSha?: string;
+  dir?: string;
   entry: string;
   entryIntegrity: string;
   ssr?: {
@@ -57,6 +61,14 @@ interface VersionManifestInput {
  * coordinate → a new version (and a new file).
  */
 declare function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest;
+/**
+ * The content-addressed directory name for one dist's file set (#826): a
+ * 16-hex hash over the canonical files map. Identical bytes → identical
+ * directory → re-deploying unchanged content is a server-side no-op, and a
+ * published pin's directory can never be rewritten by a later deploy
+ * (the upload service refuses conflicting writes under `versions/`).
+ */
+declare function versionDirPath(files: Record<string, string>): string;
 //#endregion
-export { SourceRef, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest };
+export { SourceRef, VERSION_DIR_PATTERN, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest, versionDirPath };
 //# sourceMappingURL=version-manifest.d.cts.map

package/dist/version-manifest.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.d.cts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;cAca,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;GA2CzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;KAG1C,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB"}
+{"version":3,"file":"version-manifest.d.cts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;;cAea,qBAAmB;cAEnB,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;;GAsDzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;KAG1C,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB;;;;;;;;iBAgBrD,eAAe,OAAO"}

package/dist/version-manifest.d.mts

@@ -1,9 +1,12 @@
 import { z } from "zod";
 //#region src/version-manifest.d.ts
+/** Slot-relative directory holding one deploy's immutable file copies (#826). */
+declare const VERSION_DIR_PATTERN: RegExp;
 declare const WorkspaceVersionManifestSchema: z.ZodObject<{
   version: z.ZodString;
   builtAt: z.ZodOptional<z.ZodString>;
   gitSha: z.ZodOptional<z.ZodString>;
+  dir: z.ZodOptional<z.ZodString>;
   entry: z.ZodString;
   entryIntegrity: z.ZodString;
   ssr: z.ZodOptional<z.ZodObject<{
@@ -31,6 +34,7 @@ interface VersionManifestInput {
    * staged copy and the CDN's immutability for republished versions. */
   builtAt?: string;
   gitSha?: string;
+  dir?: string;
   entry: string;
   entryIntegrity: string;
   ssr?: {
@@ -57,6 +61,14 @@ interface VersionManifestInput {
  * coordinate → a new version (and a new file).
  */
 declare function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest;
+/**
+ * The content-addressed directory name for one dist's file set (#826): a
+ * 16-hex hash over the canonical files map. Identical bytes → identical
+ * directory → re-deploying unchanged content is a server-side no-op, and a
+ * published pin's directory can never be rewritten by a later deploy
+ * (the upload service refuses conflicting writes under `versions/`).
+ */
+declare function versionDirPath(files: Record<string, string>): string;
 //#endregion
-export { SourceRef, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest };
+export { SourceRef, VERSION_DIR_PATTERN, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest, versionDirPath };
 //# sourceMappingURL=version-manifest.d.mts.map

package/dist/version-manifest.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.d.mts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;cAca,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;GA2CzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;KAG1C,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB"}
+{"version":3,"file":"version-manifest.d.mts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;;cAea,qBAAmB;cAEnB,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;;GAsDzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;KAG1C,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB;;;;;;;;iBAgBrD,eAAe,OAAO"}

package/dist/version-manifest.mjs

@@ -11,10 +11,23 @@ import { createHash } from "node:crypto";
 * stops growing with artifact kinds and old versions stay fully servable.
 */
 const SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);
+/** Slot-relative directory holding one deploy's immutable file copies (#826). */
+const VERSION_DIR_PATTERN = /^versions\/[0-9a-f]{16}$/;
 const WorkspaceVersionManifestSchema = z.object({
 	version: z.string().regex(/^[0-9a-f]{16}$/),
 	builtAt: z.string().optional(),
 	gitSha: z.string().optional(),
+	/**
+	* Slot-relative directory (`versions/<dirId>`) holding this deploy's
+	* byte-immutable copies of every dist file (#826). When present, all
+	* artifact coordinates below resolve against `<slotBase>/<dir>/` — so a
+	* pinned child's entry fetches its expose chunk and chunks from the same
+	* frozen directory instead of the mutable slot root. Absent on legacy
+	* manifests: coordinates resolve against the slot root exactly as before.
+	* Derived from the `files` map (see `versionDirPath`), so it participates
+	* in the version hash without circularity.
+	*/
+	dir: z.string().regex(VERSION_DIR_PATTERN).optional(),
 	entry: z.string().min(1),
 	entryIntegrity: SRI,
 	ssr: z.object({
@@ -64,6 +77,16 @@ function composeVersionManifest(input) {
 		version
 	});
 }
+/**
+* The content-addressed directory name for one dist's file set (#826): a
+* 16-hex hash over the canonical files map. Identical bytes → identical
+* directory → re-deploying unchanged content is a server-side no-op, and a
+* published pin's directory can never be rewritten by a later deploy
+* (the upload service refuses conflicting writes under `versions/`).
+*/
+function versionDirPath(files) {
+	return `versions/${createHash("sha256").update(stableStringify(files)).digest("hex").slice(0, 16)}`;
+}
 function stableStringify(value) {
 	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
 	if (value && typeof value === "object") return `{${Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).sort().join(",")}}`;
@@ -71,5 +94,5 @@ function stableStringify(value) {
 }
 
 //#endregion
-export { WorkspaceVersionManifestSchema, composeVersionManifest };
+export { VERSION_DIR_PATTERN, WorkspaceVersionManifestSchema, composeVersionManifest, versionDirPath };
 //# sourceMappingURL=version-manifest.mjs.map

package/dist/version-manifest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.mjs","names":[],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n  /**\n   * Source archive of the workspace subtree (object path → served-object SRI)\n   * published beside the dists when the runtime opts in via\n   * `publish.sourcePublish` — lets `bos import` dereference a published\n   * config slot to the exact source bytes that build came from, with no\n   * GitHub dependency. Readers that predate the field ignore it (zod strips\n   * unknown keys). Participates in the version hash.\n   */\n  source: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n  source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiC,EAAE,OAAO;CACrD,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAK,EACF,OAAO;EACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiB,EACd,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQ,EACL,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;;;;;AA6BD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,UAAU,WAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
+{"version":3,"file":"version-manifest.mjs","names":[],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\n/** Slot-relative directory holding one deploy's immutable file copies (#826). */\nexport const VERSION_DIR_PATTERN = /^versions\\/[0-9a-f]{16}$/;\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  /**\n   * Slot-relative directory (`versions/<dirId>`) holding this deploy's\n   * byte-immutable copies of every dist file (#826). When present, all\n   * artifact coordinates below resolve against `<slotBase>/<dir>/` — so a\n   * pinned child's entry fetches its expose chunk and chunks from the same\n   * frozen directory instead of the mutable slot root. Absent on legacy\n   * manifests: coordinates resolve against the slot root exactly as before.\n   * Derived from the `files` map (see `versionDirPath`), so it participates\n   * in the version hash without circularity.\n   */\n  dir: z.string().regex(VERSION_DIR_PATTERN).optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n  /**\n   * Source archive of the workspace subtree (object path → served-object SRI)\n   * published beside the dists when the runtime opts in via\n   * `publish.sourcePublish` — lets `bos import` dereference a published\n   * config slot to the exact source bytes that build came from, with no\n   * GitHub dependency. Readers that predate the field ignore it (zod strips\n   * unknown keys). Participates in the version hash.\n   */\n  source: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  dir?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n  source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\n/**\n * The content-addressed directory name for one dist's file set (#826): a\n * 16-hex hash over the canonical files map. Identical bytes → identical\n * directory → re-deploying unchanged content is a server-side no-op, and a\n * published pin's directory can never be rewritten by a later deploy\n * (the upload service refuses conflicting writes under `versions/`).\n */\nexport function versionDirPath(files: Record<string, string>): string {\n  const id = createHash(\"sha256\").update(stableStringify(files)).digest(\"hex\").slice(0, 16);\n  return `versions/${id}`;\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;;AAGvD,MAAa,sBAAsB;AAEnC,MAAa,iCAAiC,EAAE,OAAO;CACrD,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;;;;;;;;;;;CAW5B,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,SAAS;CACpD,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAK,EACF,OAAO;EACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiB,EACd,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQ,EACL,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;;;;;AA8BD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,UAAU,WAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;;;;;;;;AASA,SAAgB,eAAe,OAAuC;CAEpE,OAAO,YADI,WAAW,QAAQ,CAAC,CAAC,OAAO,gBAAgB,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAClE;AACtB;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "every-plugin",
-  "version": "3.0.0-rc.14",
+  "version": "3.0.0-rc.16",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -194,50 +194,50 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "@orpc/contract": "2.0.0-beta.35",
-    "@orpc/server": "2.0.0-beta.35",
-    "@orpc/tanstack-query": "2.0.0-beta.35",
-    "@orpc/zod": "2.0.0-beta.35",
+    "@orpc/contract": "2.0.0-beta.45",
+    "@orpc/server": "2.0.0-beta.45",
+    "@orpc/tanstack-query": "2.0.0-beta.45",
+    "@orpc/zod": "2.0.0-beta.45",
     "@proj-airi/unplugin-drizzle-orm-migrations": "*",
     "@rspack/core": "2.2.8",
-    "@tanstack/react-router": "1.170.32",
-    "@tanstack/router-generator": "1.167.33",
-    "effect": "4.0.0-rc.117",
-    "react": "19.2.9",
+    "@tanstack/react-router": "1.170.46",
+    "@tanstack/router-generator": "1.167.46",
+    "effect": "4.0.0-rc.118",
+    "react": "19.3.1",
     "typescript": "^7.0.2",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
-    "@effect/vitest": "4.0.0-rc.117",
+    "@effect/vitest": "4.0.0-rc.118",
     "@orpc/client": "2.0.0-beta.35",
     "@orpc/openapi": "2.0.0-beta.35",
     "@rspack/cli": "2.2.6",
-    "@tanstack/intent": "^0.3.5",
+    "@tanstack/intent": "^0.5.6",
     "@types/node": "^25.1.0",
-    "@types/react": "^19.2.7",
-    "@types/react-dom": "^19.2.3",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
     "@vitest/ui": "4.1.5",
     "tsdown": "^0.22.0",
     "vite-tsconfig-paths": "^6.0.5",
     "vitest": "^4.1.8"
   },
   "dependencies": {
-    "@module-federation/enhanced": "^2.9.0",
-    "@module-federation/node": "^2.7.50",
-    "@module-federation/rsbuild-plugin": "^2.9.0",
-    "@module-federation/runtime-core": "^2.9.0",
-    "@module-federation/runtime-tools": "^2.9.0",
-    "@orpc/client": "2.0.0-beta.35",
-    "@orpc/contract": "2.0.0-beta.35",
-    "@orpc/experimental-effect": "2.0.0-beta.35",
-    "@orpc/openapi": "2.0.0-beta.35",
-    "@orpc/publisher": "2.0.0-beta.35",
-    "@orpc/server": "2.0.0-beta.35",
-    "@orpc/tanstack-query": "2.0.0-beta.35",
+    "@module-federation/enhanced": "^2.9.2",
+    "@module-federation/node": "^2.7.52",
+    "@module-federation/rsbuild-plugin": "^2.9.2",
+    "@module-federation/runtime-core": "^2.9.2",
+    "@module-federation/runtime-tools": "^2.9.2",
+    "@orpc/client": "2.0.0-beta.45",
+    "@orpc/contract": "2.0.0-beta.45",
+    "@orpc/experimental-effect": "2.0.0-beta.45",
+    "@orpc/openapi": "2.0.0-beta.45",
+    "@orpc/publisher": "2.0.0-beta.45",
+    "@orpc/server": "2.0.0-beta.45",
+    "@orpc/tanstack-query": "2.0.0-beta.45",
     "@rsbuild/core": "2.2.8",
     "@rsbuild/plugin-react": "2.1.0",
-    "@tanstack/router-generator": "1.167.33",
-    "@tanstack/router-plugin": "1.168.35",
+    "@tanstack/router-generator": "1.167.46",
+    "@tanstack/router-plugin": "1.168.48",
     "sirv": "3.0.2",
     "sonner": ">=2.0.0"
   },

package/skills/plugin-client/SKILL.md

@@ -416,7 +416,7 @@ A child project inherits the parent's host, API, auth, and plugins via the `exte
 
 ```json
 {
-  "extends": "bos://dev.everything.near/dev.everything.dev",
+  "extends": "bos://dev.everything.near/everything.dev",
   "account": "myapp.near",
   "domain": "myapp.everything.dev"
 }
@@ -433,7 +433,7 @@ This inherits:
 
 ```bash
 bos init myapp.everything.dev \
-  --extends dev.everything.near/dev.everything.dev \
+  --extends dev.everything.near/everything.dev \
   --overrides ui,plugins \
   --plugins apps,template
 ```

package/src/build/artifact-names.ts

@@ -34,13 +34,16 @@ export function uiEntryFilename(input: { isBuild: boolean; server?: boolean }):
 const HASH_SEGMENT_PATTERN = /\.[a-f0-9]{8,}\./;
 
 /**
- * Serving classification for bundle objects: anything whose name carries a
- * content-hash segment (including hashed entrypoints like
- * `remoteEntry.8f3a….js`) is immutable by construction; fixed-name
- * entrypoints and non-hashed files a redeploy replaces in place must
- * revalidate.
+ * Serving classification for bundle objects: anything under a version
+ * directory (`versions/<dirId>/…`, #826) or a `versions/<id>.json` manifest
+ * is immutable by construction — the directory name is content-addressed and
+ * the upload service refuses conflicting writes under `versions/`; likewise
+ * any name carrying a content-hash segment (including hashed entrypoints
+ * like `remoteEntry.8f3a….js`). Fixed-name entrypoints and non-hashed files
+ * a redeploy replaces in place must revalidate.
  */
 export function isImmutableBundlePath(name: string): boolean {
+  if (name === "versions" || name.startsWith("versions/")) return true;
   const base = name.split("/").pop() ?? name;
   return HASH_SEGMENT_PATTERN.test(base);
 }