every-plugin 3.0.0-rc.16 → 3.0.0-rc.17

package/dist/client.cjs

@@ -3,69 +3,21 @@ let _orpc_client = require("@orpc/client");
 let _orpc_client_fetch = require("@orpc/client/fetch");
 
 //#region src/client.ts
-const RATE_LIMIT_MAX_RETRIES = 3;
-const RATE_LIMIT_RETRY_CAP_MS = 2e3;
-const browserClients = /* @__PURE__ */ new Map();
-async function fetchWithRateLimitRetry(fetchUrl, options) {
-	let response = await fetch(fetchUrl, options);
-	for (let attempt = 1; attempt <= RATE_LIMIT_MAX_RETRIES && response.status === 429; attempt++) {
-		const retryAfterSeconds = Number(response.headers.get("retry-after"));
-		const delay = Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0 ? Math.min(retryAfterSeconds * 1e3, RATE_LIMIT_RETRY_CAP_MS) : 100 * attempt;
-		await new Promise((resolve) => setTimeout(resolve, delay));
-		response = await fetch(fetchUrl, options);
-	}
-	return response;
-}
-function mergeHeaders(base, overrides) {
-	const merged = new Headers(base);
-	new Headers(overrides).forEach((value, key) => {
-		merged.set(key, value);
-	});
-	return merged;
-}
-function createRpcLink(config, headers) {
-	return new _orpc_client_fetch.RPCLink({
-		origin: config.hostUrl,
-		url: config.path,
-		interceptors: [(0, _orpc_client.onError)((error) => {
-			if (typeof globalThis.window === "undefined") return;
-			if (error && typeof error === "object" && "message" in error) {
-				const message = String(error.message).toLowerCase();
-				if (message.includes("fetch") || message.includes("network") || message.includes("failed to fetch")) import("sonner").then(({ toast }) => {
-					const message = config.connectionError?.() ?? {
-						title: "Unable to connect to API",
-						description: "The API is currently unavailable. Please try again later."
-					};
-					toast.error(message.title, {
-						id: "api-connection-error",
-						description: message.description
-					});
-				}).catch(() => {});
-			}
-		})],
-		fetch(fetchUrl, options) {
-			return fetchWithRateLimitRetry(fetchUrl, {
-				...options,
-				credentials: "include",
-				headers: headers ? mergeHeaders(headers, options?.headers) : options?.headers
-			});
-		}
-	});
-}
-function buildRpcClient(config, headers) {
-	if (!config.hostUrl) throw new Error("Missing runtime host URL");
-	return (0, _orpc_client.createORPCClient)(createRpcLink(config, headers));
-}
-function createRpcClient(config, headers) {
-	if (typeof globalThis.window !== "undefined" && !headers) {
-		const key = `${config.hostUrl}${config.path}`;
-		const memoized = browserClients.get(key);
-		if (memoized) return memoized;
-		const client = buildRpcClient(config, headers);
-		browserClients.set(key, client);
-		return client;
-	}
-	return buildRpcClient(config, headers);
+/**
+* Bare typed oRPC client over the RPC protocol — a thin convenience over
+* `createORPCClient(new RPCLink({ origin, url }))`.
+*
+* Promise-native, so async/await callers call it directly and Effect callers
+* lift calls with `Effect.tryPromise` (owning timeout/retry/cache in their
+* service layer). Transport customization (headers, timeouts, retries, test
+* doubles) is RPCLink's native surface — construct the link yourself and pass
+* it to `createORPCClient` instead of growing config here.
+*/
+function createRpcClient(hostUrl, path = "/api/rpc") {
+	return (0, _orpc_client.createORPCClient)(new _orpc_client_fetch.RPCLink({
+		origin: hostUrl,
+		url: path
+	}));
 }
 
 //#endregion

package/dist/client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.cjs","names":["RPCLink","onError","createORPCClient"],"sources":["../src/client.ts"],"sourcesContent":["import { createORPCClient, onError } from \"@orpc/client\";\nimport { RPCLink } from \"@orpc/client/fetch\";\nimport type { ContractRouterClient, RouterContract } from \"@orpc/contract\";\n\nexport type RpcConnectionErrorCopy = () => { title: string; description: string };\n\nexport interface RpcClientConfig {\n  hostUrl: string;\n  path: `/${string}`;\n  connectionError?: RpcConnectionErrorCopy;\n}\n\nconst RATE_LIMIT_MAX_RETRIES = 3;\nconst RATE_LIMIT_RETRY_CAP_MS = 2_000;\nconst browserClients = new Map<string, unknown>();\ntype FetchInput = Parameters<typeof fetch>[0];\n\nasync function fetchWithRateLimitRetry(\n  fetchUrl: FetchInput,\n  options?: RequestInit,\n): Promise<Response> {\n  let response = await fetch(fetchUrl, options);\n  for (let attempt = 1; attempt <= RATE_LIMIT_MAX_RETRIES && response.status === 429; attempt++) {\n    const retryAfterSeconds = Number(response.headers.get(\"retry-after\"));\n    const delay =\n      Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0\n        ? Math.min(retryAfterSeconds * 1000, RATE_LIMIT_RETRY_CAP_MS)\n        : 100 * attempt;\n    await new Promise((resolve) => setTimeout(resolve, delay));\n    response = await fetch(fetchUrl, options);\n  }\n\n  return response;\n}\n\nfunction mergeHeaders(base: Headers, overrides?: RequestInit[\"headers\"]): Headers {\n  const merged = new Headers(base);\n  new Headers(overrides).forEach((value, key) => {\n    merged.set(key, value);\n  });\n  return merged;\n}\n\nfunction createRpcLink(config: RpcClientConfig, headers?: Headers) {\n  return new RPCLink({\n    origin: config.hostUrl,\n    url: config.path,\n    interceptors: [\n      onError((error: unknown) => {\n        const browserWindow = (globalThis as { window?: unknown }).window;\n        if (typeof browserWindow === \"undefined\") {\n          return;\n        }\n\n        if (error && typeof error === \"object\" && \"message\" in error) {\n          const message = String(error.message).toLowerCase();\n          if (\n            message.includes(\"fetch\") ||\n            message.includes(\"network\") ||\n            message.includes(\"failed to fetch\")\n          ) {\n            void import(\"sonner\")\n              .then(({ toast }) => {\n                const message = config.connectionError?.() ?? {\n                  title: \"Unable to connect to API\",\n                  description: \"The API is currently unavailable. Please try again later.\",\n                };\n                toast.error(message.title, {\n                  id: \"api-connection-error\",\n                  description: message.description,\n                });\n              })\n              .catch(() => {});\n          }\n        }\n      }),\n    ],\n    fetch(fetchUrl: FetchInput, options?: RequestInit) {\n      return fetchWithRateLimitRetry(fetchUrl, {\n        ...options,\n        credentials: \"include\",\n        headers: headers ? mergeHeaders(headers, options?.headers) : options?.headers,\n      });\n    },\n  });\n}\n\nfunction buildRpcClient<T extends RouterContract>(\n  config: RpcClientConfig,\n  headers?: Headers,\n): ContractRouterClient<T> {\n  if (!config.hostUrl) {\n    throw new Error(\"Missing runtime host URL\");\n  }\n\n  return createORPCClient(createRpcLink(config, headers)) as ContractRouterClient<T>;\n}\n\nexport function createRpcClient<T extends RouterContract = RouterContract>(\n  config: RpcClientConfig,\n  headers?: Headers,\n): ContractRouterClient<T> {\n  const browserWindow = (globalThis as { window?: unknown }).window;\n  if (typeof browserWindow !== \"undefined\" && !headers) {\n    const key = `${config.hostUrl}${config.path}`;\n    const memoized = browserClients.get(key);\n    if (memoized) {\n      return memoized as ContractRouterClient<T>;\n    }\n\n    const client = buildRpcClient<T>(config, headers);\n    browserClients.set(key, client);\n    return client;\n  }\n\n  return buildRpcClient<T>(config, headers);\n}\n"],"mappings":";;;;;AAYA,MAAM,yBAAyB;AAC/B,MAAM,0BAA0B;AAChC,MAAM,iCAAiB,IAAI,IAAqB;AAGhD,eAAe,wBACb,UACA,SACmB;CACnB,IAAI,WAAW,MAAM,MAAM,UAAU,OAAO;CAC5C,KAAK,IAAI,UAAU,GAAG,WAAW,0BAA0B,SAAS,WAAW,KAAK,WAAW;EAC7F,MAAM,oBAAoB,OAAO,SAAS,QAAQ,IAAI,aAAa,CAAC;EACpE,MAAM,QACJ,OAAO,SAAS,iBAAiB,KAAK,oBAAoB,IACtD,KAAK,IAAI,oBAAoB,KAAM,uBAAuB,IAC1D,MAAM;EACZ,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,KAAK,CAAC;EACzD,WAAW,MAAM,MAAM,UAAU,OAAO;CAC1C;CAEA,OAAO;AACT;AAEA,SAAS,aAAa,MAAe,WAA6C;CAChF,MAAM,SAAS,IAAI,QAAQ,IAAI;CAC/B,IAAI,QAAQ,SAAS,CAAC,CAAC,SAAS,OAAO,QAAQ;EAC7C,OAAO,IAAI,KAAK,KAAK;CACvB,CAAC;CACD,OAAO;AACT;AAEA,SAAS,cAAc,QAAyB,SAAmB;CACjE,OAAO,IAAIA,2BAAQ;EACjB,QAAQ,OAAO;EACf,KAAK,OAAO;EACZ,cAAc,KACZC,uBAAS,UAAmB;GAE1B,IAAI,OADmB,WAAoC,WAC9B,aAC3B;GAGF,IAAI,SAAS,OAAO,UAAU,YAAY,aAAa,OAAO;IAC5D,MAAM,UAAU,OAAO,MAAM,OAAO,CAAC,CAAC,YAAY;IAClD,IACE,QAAQ,SAAS,OAAO,KACxB,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,iBAAiB,GAElC,AAAK,OAAO,SAAS,CAClB,MAAM,EAAE,YAAY;KACnB,MAAM,UAAU,OAAO,kBAAkB,KAAK;MAC5C,OAAO;MACP,aAAa;KACf;KACA,MAAM,MAAM,QAAQ,OAAO;MACzB,IAAI;MACJ,aAAa,QAAQ;KACvB,CAAC;IACH,CAAC,CAAC,CACD,YAAY,CAAC,CAAC;GAErB;EACF,CAAC,CACH;EACA,MAAM,UAAsB,SAAuB;GACjD,OAAO,wBAAwB,UAAU;IACvC,GAAG;IACH,aAAa;IACb,SAAS,UAAU,aAAa,SAAS,SAAS,OAAO,IAAI,SAAS;GACxE,CAAC;EACH;CACF,CAAC;AACH;AAEA,SAAS,eACP,QACA,SACyB;CACzB,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,0BAA0B;CAG5C,WAAOC,+BAAiB,cAAc,QAAQ,OAAO,CAAC;AACxD;AAEA,SAAgB,gBACd,QACA,SACyB;CAEzB,IAAI,OADmB,WAAoC,WAC9B,eAAe,CAAC,SAAS;EACpD,MAAM,MAAM,GAAG,OAAO,UAAU,OAAO;EACvC,MAAM,WAAW,eAAe,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAGT,MAAM,SAAS,eAAkB,QAAQ,OAAO;EAChD,eAAe,IAAI,KAAK,MAAM;EAC9B,OAAO;CACT;CAEA,OAAO,eAAkB,QAAQ,OAAO;AAC1C"}
+{"version":3,"file":"client.cjs","names":["createORPCClient","RPCLink"],"sources":["../src/client.ts"],"sourcesContent":["import { createORPCClient } from \"@orpc/client\";\nimport { RPCLink } from \"@orpc/client/fetch\";\nimport type { ContractRouterClient, RouterContract } from \"@orpc/contract\";\n\n/**\n * Bare typed oRPC client over the RPC protocol — a thin convenience over\n * `createORPCClient(new RPCLink({ origin, url }))`.\n *\n * Promise-native, so async/await callers call it directly and Effect callers\n * lift calls with `Effect.tryPromise` (owning timeout/retry/cache in their\n * service layer). Transport customization (headers, timeouts, retries, test\n * doubles) is RPCLink's native surface — construct the link yourself and pass\n * it to `createORPCClient` instead of growing config here.\n */\nexport function createRpcClient<T extends RouterContract = RouterContract>(\n  hostUrl: string,\n  path: `/${string}` = \"/api/rpc\",\n): ContractRouterClient<T> {\n  return createORPCClient(new RPCLink({ origin: hostUrl, url: path })) as ContractRouterClient<T>;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,SAAgB,gBACd,SACA,OAAqB,YACI;CACzB,WAAOA,+BAAiB,IAAIC,2BAAQ;EAAE,QAAQ;EAAS,KAAK;CAAK,CAAC,CAAC;AACrE"}

package/dist/client.d.cts

@@ -1,15 +1,16 @@
 import { ContractRouterClient, RouterContract } from "@orpc/contract";
 //#region src/client.d.ts
-type RpcConnectionErrorCopy = () => {
-  title: string;
-  description: string;
-};
-interface RpcClientConfig {
-  hostUrl: string;
-  path: `/${string}`;
-  connectionError?: RpcConnectionErrorCopy;
-}
-declare function createRpcClient<T extends RouterContract = RouterContract>(config: RpcClientConfig, headers?: Headers): ContractRouterClient<T>;
+/**
+ * Bare typed oRPC client over the RPC protocol — a thin convenience over
+ * `createORPCClient(new RPCLink({ origin, url }))`.
+ *
+ * Promise-native, so async/await callers call it directly and Effect callers
+ * lift calls with `Effect.tryPromise` (owning timeout/retry/cache in their
+ * service layer). Transport customization (headers, timeouts, retries, test
+ * doubles) is RPCLink's native surface — construct the link yourself and pass
+ * it to `createORPCClient` instead of growing config here.
+ */
+declare function createRpcClient<T extends RouterContract = RouterContract>(hostUrl: string, path?: `/${string}`): ContractRouterClient<T>;
 //#endregion
-export { RpcClientConfig, RpcConnectionErrorCopy, createRpcClient };
+export { createRpcClient };
 //# sourceMappingURL=client.d.cts.map

package/dist/client.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.cts","names":[],"sources":["../src/client.ts"],"mappings":";;KAIY;EAAiC;EAAe;;UAE3C;EACf;EACA;EACA,kBAAkB;;iBAyFJ,gBAAgB,UAAU,iBAAiB,gBACzD,QAAQ,iBACR,UAAU,UACT,qBAAqB"}
+{"version":3,"file":"client.d.cts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;;;iBAcgB,gBAAgB,UAAU,iBAAiB,gBACzD,iBACA,sBACC,qBAAqB"}

package/dist/client.d.mts

@@ -1,15 +1,16 @@
 import { ContractRouterClient, RouterContract } from "@orpc/contract";
 //#region src/client.d.ts
-type RpcConnectionErrorCopy = () => {
-  title: string;
-  description: string;
-};
-interface RpcClientConfig {
-  hostUrl: string;
-  path: `/${string}`;
-  connectionError?: RpcConnectionErrorCopy;
-}
-declare function createRpcClient<T extends RouterContract = RouterContract>(config: RpcClientConfig, headers?: Headers): ContractRouterClient<T>;
+/**
+ * Bare typed oRPC client over the RPC protocol — a thin convenience over
+ * `createORPCClient(new RPCLink({ origin, url }))`.
+ *
+ * Promise-native, so async/await callers call it directly and Effect callers
+ * lift calls with `Effect.tryPromise` (owning timeout/retry/cache in their
+ * service layer). Transport customization (headers, timeouts, retries, test
+ * doubles) is RPCLink's native surface — construct the link yourself and pass
+ * it to `createORPCClient` instead of growing config here.
+ */
+declare function createRpcClient<T extends RouterContract = RouterContract>(hostUrl: string, path?: `/${string}`): ContractRouterClient<T>;
 //#endregion
-export { RpcClientConfig, RpcConnectionErrorCopy, createRpcClient };
+export { createRpcClient };
 //# sourceMappingURL=client.d.mts.map

package/dist/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;KAIY;EAAiC;EAAe;;UAE3C;EACf;EACA;EACA,kBAAkB;;iBAyFJ,gBAAgB,UAAU,iBAAiB,gBACzD,QAAQ,iBACR,UAAU,UACT,qBAAqB"}
+{"version":3,"file":"client.d.mts","names":[],"sources":["../src/client.ts"],"mappings":";;;;;;;;;;;;iBAcgB,gBAAgB,UAAU,iBAAiB,gBACzD,iBACA,sBACC,qBAAqB"}

package/dist/client.mjs

@@ -1,70 +1,22 @@
-import { createORPCClient, onError } from "@orpc/client";
+import { createORPCClient } from "@orpc/client";
 import { RPCLink } from "@orpc/client/fetch";
 
 //#region src/client.ts
-const RATE_LIMIT_MAX_RETRIES = 3;
-const RATE_LIMIT_RETRY_CAP_MS = 2e3;
-const browserClients = /* @__PURE__ */ new Map();
-async function fetchWithRateLimitRetry(fetchUrl, options) {
-	let response = await fetch(fetchUrl, options);
-	for (let attempt = 1; attempt <= RATE_LIMIT_MAX_RETRIES && response.status === 429; attempt++) {
-		const retryAfterSeconds = Number(response.headers.get("retry-after"));
-		const delay = Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0 ? Math.min(retryAfterSeconds * 1e3, RATE_LIMIT_RETRY_CAP_MS) : 100 * attempt;
-		await new Promise((resolve) => setTimeout(resolve, delay));
-		response = await fetch(fetchUrl, options);
-	}
-	return response;
-}
-function mergeHeaders(base, overrides) {
-	const merged = new Headers(base);
-	new Headers(overrides).forEach((value, key) => {
-		merged.set(key, value);
-	});
-	return merged;
-}
-function createRpcLink(config, headers) {
-	return new RPCLink({
-		origin: config.hostUrl,
-		url: config.path,
-		interceptors: [onError((error) => {
-			if (typeof globalThis.window === "undefined") return;
-			if (error && typeof error === "object" && "message" in error) {
-				const message = String(error.message).toLowerCase();
-				if (message.includes("fetch") || message.includes("network") || message.includes("failed to fetch")) import("sonner").then(({ toast }) => {
-					const message = config.connectionError?.() ?? {
-						title: "Unable to connect to API",
-						description: "The API is currently unavailable. Please try again later."
-					};
-					toast.error(message.title, {
-						id: "api-connection-error",
-						description: message.description
-					});
-				}).catch(() => {});
-			}
-		})],
-		fetch(fetchUrl, options) {
-			return fetchWithRateLimitRetry(fetchUrl, {
-				...options,
-				credentials: "include",
-				headers: headers ? mergeHeaders(headers, options?.headers) : options?.headers
-			});
-		}
-	});
-}
-function buildRpcClient(config, headers) {
-	if (!config.hostUrl) throw new Error("Missing runtime host URL");
-	return createORPCClient(createRpcLink(config, headers));
-}
-function createRpcClient(config, headers) {
-	if (typeof globalThis.window !== "undefined" && !headers) {
-		const key = `${config.hostUrl}${config.path}`;
-		const memoized = browserClients.get(key);
-		if (memoized) return memoized;
-		const client = buildRpcClient(config, headers);
-		browserClients.set(key, client);
-		return client;
-	}
-	return buildRpcClient(config, headers);
+/**
+* Bare typed oRPC client over the RPC protocol — a thin convenience over
+* `createORPCClient(new RPCLink({ origin, url }))`.
+*
+* Promise-native, so async/await callers call it directly and Effect callers
+* lift calls with `Effect.tryPromise` (owning timeout/retry/cache in their
+* service layer). Transport customization (headers, timeouts, retries, test
+* doubles) is RPCLink's native surface — construct the link yourself and pass
+* it to `createORPCClient` instead of growing config here.
+*/
+function createRpcClient(hostUrl, path = "/api/rpc") {
+	return createORPCClient(new RPCLink({
+		origin: hostUrl,
+		url: path
+	}));
 }
 
 //#endregion

package/dist/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import { createORPCClient, onError } from \"@orpc/client\";\nimport { RPCLink } from \"@orpc/client/fetch\";\nimport type { ContractRouterClient, RouterContract } from \"@orpc/contract\";\n\nexport type RpcConnectionErrorCopy = () => { title: string; description: string };\n\nexport interface RpcClientConfig {\n  hostUrl: string;\n  path: `/${string}`;\n  connectionError?: RpcConnectionErrorCopy;\n}\n\nconst RATE_LIMIT_MAX_RETRIES = 3;\nconst RATE_LIMIT_RETRY_CAP_MS = 2_000;\nconst browserClients = new Map<string, unknown>();\ntype FetchInput = Parameters<typeof fetch>[0];\n\nasync function fetchWithRateLimitRetry(\n  fetchUrl: FetchInput,\n  options?: RequestInit,\n): Promise<Response> {\n  let response = await fetch(fetchUrl, options);\n  for (let attempt = 1; attempt <= RATE_LIMIT_MAX_RETRIES && response.status === 429; attempt++) {\n    const retryAfterSeconds = Number(response.headers.get(\"retry-after\"));\n    const delay =\n      Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0\n        ? Math.min(retryAfterSeconds * 1000, RATE_LIMIT_RETRY_CAP_MS)\n        : 100 * attempt;\n    await new Promise((resolve) => setTimeout(resolve, delay));\n    response = await fetch(fetchUrl, options);\n  }\n\n  return response;\n}\n\nfunction mergeHeaders(base: Headers, overrides?: RequestInit[\"headers\"]): Headers {\n  const merged = new Headers(base);\n  new Headers(overrides).forEach((value, key) => {\n    merged.set(key, value);\n  });\n  return merged;\n}\n\nfunction createRpcLink(config: RpcClientConfig, headers?: Headers) {\n  return new RPCLink({\n    origin: config.hostUrl,\n    url: config.path,\n    interceptors: [\n      onError((error: unknown) => {\n        const browserWindow = (globalThis as { window?: unknown }).window;\n        if (typeof browserWindow === \"undefined\") {\n          return;\n        }\n\n        if (error && typeof error === \"object\" && \"message\" in error) {\n          const message = String(error.message).toLowerCase();\n          if (\n            message.includes(\"fetch\") ||\n            message.includes(\"network\") ||\n            message.includes(\"failed to fetch\")\n          ) {\n            void import(\"sonner\")\n              .then(({ toast }) => {\n                const message = config.connectionError?.() ?? {\n                  title: \"Unable to connect to API\",\n                  description: \"The API is currently unavailable. Please try again later.\",\n                };\n                toast.error(message.title, {\n                  id: \"api-connection-error\",\n                  description: message.description,\n                });\n              })\n              .catch(() => {});\n          }\n        }\n      }),\n    ],\n    fetch(fetchUrl: FetchInput, options?: RequestInit) {\n      return fetchWithRateLimitRetry(fetchUrl, {\n        ...options,\n        credentials: \"include\",\n        headers: headers ? mergeHeaders(headers, options?.headers) : options?.headers,\n      });\n    },\n  });\n}\n\nfunction buildRpcClient<T extends RouterContract>(\n  config: RpcClientConfig,\n  headers?: Headers,\n): ContractRouterClient<T> {\n  if (!config.hostUrl) {\n    throw new Error(\"Missing runtime host URL\");\n  }\n\n  return createORPCClient(createRpcLink(config, headers)) as ContractRouterClient<T>;\n}\n\nexport function createRpcClient<T extends RouterContract = RouterContract>(\n  config: RpcClientConfig,\n  headers?: Headers,\n): ContractRouterClient<T> {\n  const browserWindow = (globalThis as { window?: unknown }).window;\n  if (typeof browserWindow !== \"undefined\" && !headers) {\n    const key = `${config.hostUrl}${config.path}`;\n    const memoized = browserClients.get(key);\n    if (memoized) {\n      return memoized as ContractRouterClient<T>;\n    }\n\n    const client = buildRpcClient<T>(config, headers);\n    browserClients.set(key, client);\n    return client;\n  }\n\n  return buildRpcClient<T>(config, headers);\n}\n"],"mappings":";;;;AAYA,MAAM,yBAAyB;AAC/B,MAAM,0BAA0B;AAChC,MAAM,iCAAiB,IAAI,IAAqB;AAGhD,eAAe,wBACb,UACA,SACmB;CACnB,IAAI,WAAW,MAAM,MAAM,UAAU,OAAO;CAC5C,KAAK,IAAI,UAAU,GAAG,WAAW,0BAA0B,SAAS,WAAW,KAAK,WAAW;EAC7F,MAAM,oBAAoB,OAAO,SAAS,QAAQ,IAAI,aAAa,CAAC;EACpE,MAAM,QACJ,OAAO,SAAS,iBAAiB,KAAK,oBAAoB,IACtD,KAAK,IAAI,oBAAoB,KAAM,uBAAuB,IAC1D,MAAM;EACZ,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,KAAK,CAAC;EACzD,WAAW,MAAM,MAAM,UAAU,OAAO;CAC1C;CAEA,OAAO;AACT;AAEA,SAAS,aAAa,MAAe,WAA6C;CAChF,MAAM,SAAS,IAAI,QAAQ,IAAI;CAC/B,IAAI,QAAQ,SAAS,CAAC,CAAC,SAAS,OAAO,QAAQ;EAC7C,OAAO,IAAI,KAAK,KAAK;CACvB,CAAC;CACD,OAAO;AACT;AAEA,SAAS,cAAc,QAAyB,SAAmB;CACjE,OAAO,IAAI,QAAQ;EACjB,QAAQ,OAAO;EACf,KAAK,OAAO;EACZ,cAAc,CACZ,SAAS,UAAmB;GAE1B,IAAI,OADmB,WAAoC,WAC9B,aAC3B;GAGF,IAAI,SAAS,OAAO,UAAU,YAAY,aAAa,OAAO;IAC5D,MAAM,UAAU,OAAO,MAAM,OAAO,CAAC,CAAC,YAAY;IAClD,IACE,QAAQ,SAAS,OAAO,KACxB,QAAQ,SAAS,SAAS,KAC1B,QAAQ,SAAS,iBAAiB,GAElC,AAAK,OAAO,SAAS,CAClB,MAAM,EAAE,YAAY;KACnB,MAAM,UAAU,OAAO,kBAAkB,KAAK;MAC5C,OAAO;MACP,aAAa;KACf;KACA,MAAM,MAAM,QAAQ,OAAO;MACzB,IAAI;MACJ,aAAa,QAAQ;KACvB,CAAC;IACH,CAAC,CAAC,CACD,YAAY,CAAC,CAAC;GAErB;EACF,CAAC,CACH;EACA,MAAM,UAAsB,SAAuB;GACjD,OAAO,wBAAwB,UAAU;IACvC,GAAG;IACH,aAAa;IACb,SAAS,UAAU,aAAa,SAAS,SAAS,OAAO,IAAI,SAAS;GACxE,CAAC;EACH;CACF,CAAC;AACH;AAEA,SAAS,eACP,QACA,SACyB;CACzB,IAAI,CAAC,OAAO,SACV,MAAM,IAAI,MAAM,0BAA0B;CAG5C,OAAO,iBAAiB,cAAc,QAAQ,OAAO,CAAC;AACxD;AAEA,SAAgB,gBACd,QACA,SACyB;CAEzB,IAAI,OADmB,WAAoC,WAC9B,eAAe,CAAC,SAAS;EACpD,MAAM,MAAM,GAAG,OAAO,UAAU,OAAO;EACvC,MAAM,WAAW,eAAe,IAAI,GAAG;EACvC,IAAI,UACF,OAAO;EAGT,MAAM,SAAS,eAAkB,QAAQ,OAAO;EAChD,eAAe,IAAI,KAAK,MAAM;EAC9B,OAAO;CACT;CAEA,OAAO,eAAkB,QAAQ,OAAO;AAC1C"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../src/client.ts"],"sourcesContent":["import { createORPCClient } from \"@orpc/client\";\nimport { RPCLink } from \"@orpc/client/fetch\";\nimport type { ContractRouterClient, RouterContract } from \"@orpc/contract\";\n\n/**\n * Bare typed oRPC client over the RPC protocol — a thin convenience over\n * `createORPCClient(new RPCLink({ origin, url }))`.\n *\n * Promise-native, so async/await callers call it directly and Effect callers\n * lift calls with `Effect.tryPromise` (owning timeout/retry/cache in their\n * service layer). Transport customization (headers, timeouts, retries, test\n * doubles) is RPCLink's native surface — construct the link yourself and pass\n * it to `createORPCClient` instead of growing config here.\n */\nexport function createRpcClient<T extends RouterContract = RouterContract>(\n  hostUrl: string,\n  path: `/${string}` = \"/api/rpc\",\n): ContractRouterClient<T> {\n  return createORPCClient(new RPCLink({ origin: hostUrl, url: path })) as ContractRouterClient<T>;\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,SAAgB,gBACd,SACA,OAAqB,YACI;CACzB,OAAO,iBAAiB,IAAI,QAAQ;EAAE,QAAQ;EAAS,KAAK;CAAK,CAAC,CAAC;AACrE"}

package/dist/index.d.cts

@@ -1,10 +1,10 @@
 import { remoteName } from "./identity.cjs";
-import { RpcClientConfig, RpcConnectionErrorCopy, createRpcClient } from "./client.cjs";
+import { createRpcClient } from "./client.cjs";
 import { ModuleFederationError, PluginLoadFailureInfo, PluginRuntimeError, PluginWarningInfo, ValidationError, classifyPluginFailure, defaultMissingSecretWarnings, extractFromFiberFailure, formatORPCError, toPluginRuntimeError, wrapORPCError } from "./runtime/errors.cjs";
 import { BAD_REQUEST, CONFLICT, CONNECTION_ERROR, FORBIDDEN, NOT_FOUND, PLUGIN_ERROR_STATUS_MAP, PluginErrors, RATE_LIMITED, SERVICE_UNAVAILABLE, TIMEOUT, UNAUTHORIZED } from "./errors.cjs";
 import { buildScoped, buildScopedContext } from "./effect-helpers.cjs";
 import { CreatePluginFn, CreatePluginWithPlugins, LoadedPluginWithBinding, Plugin, PluginConfigFor, PluginEnv, PluginIdTag, PluginInitializeInput, PluginWarningsFn, createPlugin, withPlugins } from "./plugin.cjs";
-import { AnyPlugin, EveryPlugin, InitializedPlugin, LoadedPlugin, ModuleClientEntry, ModuleEndpoint, ModuleSurface, ModuleTransport, PluginClientEntry, PluginClientType, PluginConfigInput, PluginContext, PluginContract, PluginEndpoint, PluginInstance, PluginMetadata, PluginRegistry, PluginRouterType, PluginRuntimeConfig, PluginSecrets, PluginServicesEntry, PluginSurface, PluginTransport, PluginVariables, RegisteredPlugins, SecretsConfig, UsePluginResult } from "./types.cjs";
+import { AnyPlugin, EveryPlugin, InferRegistryFromEntries, InitializedPlugin, LoadedPlugin, ModuleClientEntry, ModuleEndpoint, ModuleSurface, ModuleTransport, PluginClientEntry, PluginClientType, PluginConfigInput, PluginContext, PluginContract, PluginEndpoint, PluginInstance, PluginMetadata, PluginRegistry, PluginRegistryEntry, PluginRouterType, PluginRuntimeConfig, PluginSecrets, PluginServicesEntry, PluginSurface, PluginTransport, PluginVariables, RegisteredPlugins, SecretsConfig, UsePluginResult } from "./types.cjs";
 import { PluginRuntime, createPluginRuntime } from "./runtime/index.cjs";
 import "@orpc/openapi/extensions/route";
-export { type AnyPlugin, BAD_REQUEST, CONFLICT, CONNECTION_ERROR, CreatePluginFn, CreatePluginWithPlugins, type EveryPlugin, FORBIDDEN, type InitializedPlugin, type LoadedPlugin, LoadedPluginWithBinding, type ModuleClientEntry, type ModuleEndpoint, ModuleFederationError, type ModuleSurface, type ModuleTransport, NOT_FOUND, PLUGIN_ERROR_STATUS_MAP, Plugin, type PluginClientEntry, type PluginClientType, PluginConfigFor, type PluginConfigInput, type PluginContext, type PluginContract, type PluginEndpoint, PluginEnv, PluginErrors, PluginIdTag, PluginInitializeInput, type PluginInstance, type PluginLoadFailureInfo, type PluginMetadata, type PluginRegistry, type PluginRouterType, PluginRuntime, type PluginRuntimeConfig, PluginRuntimeError, type PluginSecrets, type PluginServicesEntry, type PluginSurface, type PluginTransport, type PluginVariables, type PluginWarningInfo, PluginWarningsFn, RATE_LIMITED, type RegisteredPlugins, RpcClientConfig, RpcConnectionErrorCopy, SERVICE_UNAVAILABLE, type SecretsConfig, TIMEOUT, UNAUTHORIZED, type UsePluginResult, ValidationError, buildScoped, buildScopedContext, classifyPluginFailure, createPlugin, createPluginRuntime, createRpcClient, defaultMissingSecretWarnings, extractFromFiberFailure, formatORPCError, remoteName as getNormalizedRemoteName, toPluginRuntimeError, withPlugins, wrapORPCError };
+export { type AnyPlugin, BAD_REQUEST, CONFLICT, CONNECTION_ERROR, CreatePluginFn, CreatePluginWithPlugins, type EveryPlugin, FORBIDDEN, type InferRegistryFromEntries, type InitializedPlugin, type LoadedPlugin, LoadedPluginWithBinding, type ModuleClientEntry, type ModuleEndpoint, ModuleFederationError, type ModuleSurface, type ModuleTransport, NOT_FOUND, PLUGIN_ERROR_STATUS_MAP, Plugin, type PluginClientEntry, type PluginClientType, PluginConfigFor, type PluginConfigInput, type PluginContext, type PluginContract, type PluginEndpoint, PluginEnv, PluginErrors, PluginIdTag, PluginInitializeInput, type PluginInstance, type PluginLoadFailureInfo, type PluginMetadata, type PluginRegistry, type PluginRegistryEntry, type PluginRouterType, PluginRuntime, type PluginRuntimeConfig, PluginRuntimeError, type PluginSecrets, type PluginServicesEntry, type PluginSurface, type PluginTransport, type PluginVariables, type PluginWarningInfo, PluginWarningsFn, RATE_LIMITED, type RegisteredPlugins, SERVICE_UNAVAILABLE, type SecretsConfig, TIMEOUT, UNAUTHORIZED, type UsePluginResult, ValidationError, buildScoped, buildScopedContext, classifyPluginFailure, createPlugin, createPluginRuntime, createRpcClient, defaultMissingSecretWarnings, extractFromFiberFailure, formatORPCError, remoteName as getNormalizedRemoteName, toPluginRuntimeError, withPlugins, wrapORPCError };

package/dist/index.d.mts

@@ -1,10 +1,10 @@
 import { remoteName } from "./identity.mjs";
-import { RpcClientConfig, RpcConnectionErrorCopy, createRpcClient } from "./client.mjs";
+import { createRpcClient } from "./client.mjs";
 import { ModuleFederationError, PluginLoadFailureInfo, PluginRuntimeError, PluginWarningInfo, ValidationError, classifyPluginFailure, defaultMissingSecretWarnings, extractFromFiberFailure, formatORPCError, toPluginRuntimeError, wrapORPCError } from "./runtime/errors.mjs";
 import { BAD_REQUEST, CONFLICT, CONNECTION_ERROR, FORBIDDEN, NOT_FOUND, PLUGIN_ERROR_STATUS_MAP, PluginErrors, RATE_LIMITED, SERVICE_UNAVAILABLE, TIMEOUT, UNAUTHORIZED } from "./errors.mjs";
 import { buildScoped, buildScopedContext } from "./effect-helpers.mjs";
 import { CreatePluginFn, CreatePluginWithPlugins, LoadedPluginWithBinding, Plugin, PluginConfigFor, PluginEnv, PluginIdTag, PluginInitializeInput, PluginWarningsFn, createPlugin, withPlugins } from "./plugin.mjs";
-import { AnyPlugin, EveryPlugin, InitializedPlugin, LoadedPlugin, ModuleClientEntry, ModuleEndpoint, ModuleSurface, ModuleTransport, PluginClientEntry, PluginClientType, PluginConfigInput, PluginContext, PluginContract, PluginEndpoint, PluginInstance, PluginMetadata, PluginRegistry, PluginRouterType, PluginRuntimeConfig, PluginSecrets, PluginServicesEntry, PluginSurface, PluginTransport, PluginVariables, RegisteredPlugins, SecretsConfig, UsePluginResult } from "./types.mjs";
+import { AnyPlugin, EveryPlugin, InferRegistryFromEntries, InitializedPlugin, LoadedPlugin, ModuleClientEntry, ModuleEndpoint, ModuleSurface, ModuleTransport, PluginClientEntry, PluginClientType, PluginConfigInput, PluginContext, PluginContract, PluginEndpoint, PluginInstance, PluginMetadata, PluginRegistry, PluginRegistryEntry, PluginRouterType, PluginRuntimeConfig, PluginSecrets, PluginServicesEntry, PluginSurface, PluginTransport, PluginVariables, RegisteredPlugins, SecretsConfig, UsePluginResult } from "./types.mjs";
 import { PluginRuntime, createPluginRuntime } from "./runtime/index.mjs";
 import "@orpc/openapi/extensions/route";
-export { type AnyPlugin, BAD_REQUEST, CONFLICT, CONNECTION_ERROR, CreatePluginFn, CreatePluginWithPlugins, type EveryPlugin, FORBIDDEN, type InitializedPlugin, type LoadedPlugin, LoadedPluginWithBinding, type ModuleClientEntry, type ModuleEndpoint, ModuleFederationError, type ModuleSurface, type ModuleTransport, NOT_FOUND, PLUGIN_ERROR_STATUS_MAP, Plugin, type PluginClientEntry, type PluginClientType, PluginConfigFor, type PluginConfigInput, type PluginContext, type PluginContract, type PluginEndpoint, PluginEnv, PluginErrors, PluginIdTag, PluginInitializeInput, type PluginInstance, type PluginLoadFailureInfo, type PluginMetadata, type PluginRegistry, type PluginRouterType, PluginRuntime, type PluginRuntimeConfig, PluginRuntimeError, type PluginSecrets, type PluginServicesEntry, type PluginSurface, type PluginTransport, type PluginVariables, type PluginWarningInfo, PluginWarningsFn, RATE_LIMITED, type RegisteredPlugins, RpcClientConfig, RpcConnectionErrorCopy, SERVICE_UNAVAILABLE, type SecretsConfig, TIMEOUT, UNAUTHORIZED, type UsePluginResult, ValidationError, buildScoped, buildScopedContext, classifyPluginFailure, createPlugin, createPluginRuntime, createRpcClient, defaultMissingSecretWarnings, extractFromFiberFailure, formatORPCError, remoteName as getNormalizedRemoteName, toPluginRuntimeError, withPlugins, wrapORPCError };
+export { type AnyPlugin, BAD_REQUEST, CONFLICT, CONNECTION_ERROR, CreatePluginFn, CreatePluginWithPlugins, type EveryPlugin, FORBIDDEN, type InferRegistryFromEntries, type InitializedPlugin, type LoadedPlugin, LoadedPluginWithBinding, type ModuleClientEntry, type ModuleEndpoint, ModuleFederationError, type ModuleSurface, type ModuleTransport, NOT_FOUND, PLUGIN_ERROR_STATUS_MAP, Plugin, type PluginClientEntry, type PluginClientType, PluginConfigFor, type PluginConfigInput, type PluginContext, type PluginContract, type PluginEndpoint, PluginEnv, PluginErrors, PluginIdTag, PluginInitializeInput, type PluginInstance, type PluginLoadFailureInfo, type PluginMetadata, type PluginRegistry, type PluginRegistryEntry, type PluginRouterType, PluginRuntime, type PluginRuntimeConfig, PluginRuntimeError, type PluginSecrets, type PluginServicesEntry, type PluginSurface, type PluginTransport, type PluginVariables, type PluginWarningInfo, PluginWarningsFn, RATE_LIMITED, type RegisteredPlugins, SERVICE_UNAVAILABLE, type SecretsConfig, TIMEOUT, UNAUTHORIZED, type UsePluginResult, ValidationError, buildScoped, buildScopedContext, classifyPluginFailure, createPlugin, createPluginRuntime, createRpcClient, defaultMissingSecretWarnings, extractFromFiberFailure, formatORPCError, remoteName as getNormalizedRemoteName, toPluginRuntimeError, withPlugins, wrapORPCError };

package/dist/runtime/mf-config.cjs

@@ -3,7 +3,7 @@ const require_shared_deps_spec = require("../shared-deps-spec.cjs");
 let node_fs = require("node:fs");
 
 //#region src/runtime/mf-config.ts
-const PLUGIN_VERSION = "3.0.0-rc.16";
+const PLUGIN_VERSION = "3.0.0-rc.17";
 const MF_CORE_SHARED_DEPS = require_shared_deps_spec.buildMfCoreSharedDependencies({ ownVersion: PLUGIN_VERSION });
 
 //#endregion

package/dist/runtime/mf-config.mjs

@@ -2,7 +2,7 @@ import { buildMfCoreSharedDependencies } from "../shared-deps-spec.mjs";
 import { readFileSync } from "node:fs";
 
 //#region src/runtime/mf-config.ts
-const PLUGIN_VERSION = "3.0.0-rc.16";
+const PLUGIN_VERSION = "3.0.0-rc.17";
 const MF_CORE_SHARED_DEPS = buildMfCoreSharedDependencies({ ownVersion: PLUGIN_VERSION });
 
 //#endregion

package/dist/version-manifest.cjs

@@ -14,6 +14,18 @@ let node_crypto = require("node:crypto");
 const SRI = zod.z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);
 /** Slot-relative directory holding one deploy's immutable file copies (#826). */
 const VERSION_DIR_PATTERN = /^versions\/[0-9a-f]{16}$/;
+/** The attribution block stored in the manifest's `signature` field. The
+* verifying key rides along so a verifier can distinguish "wrong signature"
+* from "signed by a key the config never registered" — both are
+* `SignatureInvalid`, but the reasons name different compromises. */
+const ManifestSignatureSchema = zod.z.object({
+	algorithm: zod.z.literal("ed25519"),
+	/** NEAR-format verifying key (`ed25519:<base58>`) — must equal the
+	* config's `publish.verification.publicKey`. */
+	publicKey: zod.z.string().min(1),
+	/** base64 ed25519 signature over the canonical payload bytes. */
+	value: zod.z.string().min(1)
+});
 const WorkspaceVersionManifestSchema = zod.z.object({
 	version: zod.z.string().regex(/^[0-9a-f]{16}$/),
 	builtAt: zod.z.string().optional(),
@@ -61,8 +73,38 @@ const WorkspaceVersionManifestSchema = zod.z.object({
 	source: zod.z.object({
 		file: zod.z.string().min(1),
 		integrity: SRI
-	}).optional()
+	}).optional(),
+	/**
+	* Attribution (ADR 0046 ticket 05): the deploy train's ed25519 signature
+	* over `signaturePayloadOf(this document)` — SRI attests WHAT the bytes
+	* are, the signature attests WHO published them, with the verifying key
+	* anchored in the on-chain config (`publish.verification`). Absent on
+	* rollouts with attribution off; readers that predate the field ignore it
+	* (zod strips unknown keys). Excluded from the version-id derivation —
+	* like `builtAt`, it is not a coordinate of the build.
+	*/
+	signature: ManifestSignatureSchema.optional()
 });
+/** Canonical key-sorted JSON serialization — the same form the version-id
+* derivation hashes (undefined-valued entries dropped). Exported so the
+* signature payload and the version id can never disagree about what
+* "canonical" means. */
+function stableStringify(value) {
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).sort().join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+/**
+* The bytes a manifest signature attests: the document minus its reserved
+* `signature` field, canonically serialized (key-sorted — the version-id
+* rule). The signer signs this before the field exists; the verifier
+* re-derives it from the parsed document, so the stored document's
+* whitespace never matters.
+*/
+function signaturePayloadOf(manifest) {
+	const { signature: _signature, ...payload } = manifest;
+	return stableStringify(payload);
+}
 /**
 * Compose the manifest with its `version` derived from the canonical content
 * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —
@@ -88,15 +130,13 @@ function composeVersionManifest(input) {
 function versionDirPath(files) {
 	return `versions/${(0, node_crypto.createHash)("sha256").update(stableStringify(files)).digest("hex").slice(0, 16)}`;
 }
-function stableStringify(value) {
-	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).sort().join(",")}}`;
-	return JSON.stringify(value) ?? "null";
-}
 
 //#endregion
+exports.ManifestSignatureSchema = ManifestSignatureSchema;
 exports.VERSION_DIR_PATTERN = VERSION_DIR_PATTERN;
 exports.WorkspaceVersionManifestSchema = WorkspaceVersionManifestSchema;
 exports.composeVersionManifest = composeVersionManifest;
+exports.signaturePayloadOf = signaturePayloadOf;
+exports.stableStringify = stableStringify;
 exports.versionDirPath = versionDirPath;
 //# sourceMappingURL=version-manifest.cjs.map

package/dist/version-manifest.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.cjs","names":["z","createHash"],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\n/** Slot-relative directory holding one deploy's immutable file copies (#826). */\nexport const VERSION_DIR_PATTERN = /^versions\\/[0-9a-f]{16}$/;\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  /**\n   * Slot-relative directory (`versions/<dirId>`) holding this deploy's\n   * byte-immutable copies of every dist file (#826). When present, all\n   * artifact coordinates below resolve against `<slotBase>/<dir>/` — so a\n   * pinned child's entry fetches its expose chunk and chunks from the same\n   * frozen directory instead of the mutable slot root. Absent on legacy\n   * manifests: coordinates resolve against the slot root exactly as before.\n   * Derived from the `files` map (see `versionDirPath`), so it participates\n   * in the version hash without circularity.\n   */\n  dir: z.string().regex(VERSION_DIR_PATTERN).optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n  /**\n   * Source archive of the workspace subtree (object path → served-object SRI)\n   * published beside the dists when the runtime opts in via\n   * `publish.sourcePublish` — lets `bos import` dereference a published\n   * config slot to the exact source bytes that build came from, with no\n   * GitHub dependency. Readers that predate the field ignore it (zod strips\n   * unknown keys). Participates in the version hash.\n   */\n  source: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  dir?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n  source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\n/**\n * The content-addressed directory name for one dist's file set (#826): a\n * 16-hex hash over the canonical files map. Identical bytes → identical\n * directory → re-deploying unchanged content is a server-side no-op, and a\n * published pin's directory can never be rewritten by a later deploy\n * (the upload service refuses conflicting writes under `versions/`).\n */\nexport function versionDirPath(files: Record<string, string>): string {\n  const id = createHash(\"sha256\").update(stableStringify(files)).digest(\"hex\").slice(0, 16);\n  return `versions/${id}`;\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,MAAMA,MAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;;AAGvD,MAAa,sBAAsB;AAEnC,MAAa,iCAAiCA,MAAE,OAAO;CACrD,SAASA,MAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAASA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQA,MAAE,OAAO,CAAC,CAAC,SAAS;;;;;;;;;;;CAW5B,KAAKA,MAAE,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,SAAS;CACpD,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAKA,MACF,OAAO;EACN,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiBA,MACd,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAGA,MAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAOA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQA,MACL,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;;;;;AA8BD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,cAAUC,wBAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;;;;;;;;AASA,SAAgB,eAAe,OAAuC;CAEpE,OAAO,gBADIA,wBAAW,QAAQ,CAAC,CAAC,OAAO,gBAAgB,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAClE;AACtB;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
+{"version":3,"file":"version-manifest.cjs","names":["z","createHash"],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\n/** Slot-relative directory holding one deploy's immutable file copies (#826). */\nexport const VERSION_DIR_PATTERN = /^versions\\/[0-9a-f]{16}$/;\n\n/** The attribution block stored in the manifest's `signature` field. The\n * verifying key rides along so a verifier can distinguish \"wrong signature\"\n * from \"signed by a key the config never registered\" — both are\n * `SignatureInvalid`, but the reasons name different compromises. */\nexport const ManifestSignatureSchema = z.object({\n  algorithm: z.literal(\"ed25519\"),\n  /** NEAR-format verifying key (`ed25519:<base58>`) — must equal the\n   * config's `publish.verification.publicKey`. */\n  publicKey: z.string().min(1),\n  /** base64 ed25519 signature over the canonical payload bytes. */\n  value: z.string().min(1),\n});\nexport type ManifestSignature = z.infer<typeof ManifestSignatureSchema>;\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  /**\n   * Slot-relative directory (`versions/<dirId>`) holding this deploy's\n   * byte-immutable copies of every dist file (#826). When present, all\n   * artifact coordinates below resolve against `<slotBase>/<dir>/` — so a\n   * pinned child's entry fetches its expose chunk and chunks from the same\n   * frozen directory instead of the mutable slot root. Absent on legacy\n   * manifests: coordinates resolve against the slot root exactly as before.\n   * Derived from the `files` map (see `versionDirPath`), so it participates\n   * in the version hash without circularity.\n   */\n  dir: z.string().regex(VERSION_DIR_PATTERN).optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n  /**\n   * Source archive of the workspace subtree (object path → served-object SRI)\n   * published beside the dists when the runtime opts in via\n   * `publish.sourcePublish` — lets `bos import` dereference a published\n   * config slot to the exact source bytes that build came from, with no\n   * GitHub dependency. Readers that predate the field ignore it (zod strips\n   * unknown keys). Participates in the version hash.\n   */\n  source: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /**\n   * Attribution (ADR 0046 ticket 05): the deploy train's ed25519 signature\n   * over `signaturePayloadOf(this document)` — SRI attests WHAT the bytes\n   * are, the signature attests WHO published them, with the verifying key\n   * anchored in the on-chain config (`publish.verification`). Absent on\n   * rollouts with attribution off; readers that predate the field ignore it\n   * (zod strips unknown keys). Excluded from the version-id derivation —\n   * like `builtAt`, it is not a coordinate of the build.\n   */\n  signature: ManifestSignatureSchema.optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** Canonical key-sorted JSON serialization — the same form the version-id\n * derivation hashes (undefined-valued entries dropped). Exported so the\n * signature payload and the version id can never disagree about what\n * \"canonical\" means. */\nexport function stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n\n/**\n * The bytes a manifest signature attests: the document minus its reserved\n * `signature` field, canonically serialized (key-sorted — the version-id\n * rule). The signer signs this before the field exists; the verifier\n * re-derives it from the parsed document, so the stored document's\n * whitespace never matters.\n */\nexport function signaturePayloadOf(manifest: WorkspaceVersionManifest): string {\n  const { signature: _signature, ...payload } = manifest;\n  return stableStringify(payload);\n}\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  dir?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n  source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\n/**\n * The content-addressed directory name for one dist's file set (#826): a\n * 16-hex hash over the canonical files map. Identical bytes → identical\n * directory → re-deploying unchanged content is a server-side no-op, and a\n * published pin's directory can never be rewritten by a later deploy\n * (the upload service refuses conflicting writes under `versions/`).\n */\nexport function versionDirPath(files: Record<string, string>): string {\n  const id = createHash(\"sha256\").update(stableStringify(files)).digest(\"hex\").slice(0, 16);\n  return `versions/${id}`;\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,MAAMA,MAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;;AAGvD,MAAa,sBAAsB;;;;;AAMnC,MAAa,0BAA0BA,MAAE,OAAO;CAC9C,WAAWA,MAAE,QAAQ,SAAS;;;CAG9B,WAAWA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAE3B,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAGD,MAAa,iCAAiCA,MAAE,OAAO;CACrD,SAASA,MAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAASA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQA,MAAE,OAAO,CAAC,CAAC,SAAS;;;;;;;;;;;CAW5B,KAAKA,MAAE,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,SAAS;CACpD,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAKA,MACF,OAAO;EACN,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiBA,MACd,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAGA,MAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAOA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQA,MACL,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;;;;;;;;;CAUZ,WAAW,wBAAwB,SAAS;AAC9C,CAAC;;;;;AAOD,SAAgB,gBAAgB,OAAwB;CACtD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC;;;;;;;;AASA,SAAgB,mBAAmB,UAA4C;CAC7E,MAAM,EAAE,WAAW,YAAY,GAAG,YAAY;CAC9C,OAAO,gBAAgB,OAAO;AAChC;;;;;;;;AA6BA,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,cAAUC,wBAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;;;;;;;;AASA,SAAgB,eAAe,OAAuC;CAEpE,OAAO,gBADIA,wBAAW,QAAQ,CAAC,CAAC,OAAO,gBAAgB,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAClE;AACtB"}

package/dist/version-manifest.d.cts

@@ -2,6 +2,16 @@ import { z } from "zod";
 //#region src/version-manifest.d.ts
 /** Slot-relative directory holding one deploy's immutable file copies (#826). */
 declare const VERSION_DIR_PATTERN: RegExp;
+/** The attribution block stored in the manifest's `signature` field. The
+ * verifying key rides along so a verifier can distinguish "wrong signature"
+ * from "signed by a key the config never registered" — both are
+ * `SignatureInvalid`, but the reasons name different compromises. */
+declare const ManifestSignatureSchema: z.ZodObject<{
+  algorithm: z.ZodLiteral<"ed25519">;
+  publicKey: z.ZodString;
+  value: z.ZodString;
+}, z.core.$strip>;
+type ManifestSignature = z.infer<typeof ManifestSignatureSchema>;
 declare const WorkspaceVersionManifestSchema: z.ZodObject<{
   version: z.ZodString;
   builtAt: z.ZodOptional<z.ZodString>;
@@ -24,8 +34,26 @@ declare const WorkspaceVersionManifestSchema: z.ZodObject<{
     file: z.ZodString;
     integrity: z.ZodString;
   }, z.core.$strip>>;
+  signature: z.ZodOptional<z.ZodObject<{
+    algorithm: z.ZodLiteral<"ed25519">;
+    publicKey: z.ZodString;
+    value: z.ZodString;
+  }, z.core.$strip>>;
 }, z.core.$strip>;
 type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;
+/** Canonical key-sorted JSON serialization — the same form the version-id
+ * derivation hashes (undefined-valued entries dropped). Exported so the
+ * signature payload and the version id can never disagree about what
+ * "canonical" means. */
+declare function stableStringify(value: unknown): string;
+/**
+ * The bytes a manifest signature attests: the document minus its reserved
+ * `signature` field, canonically serialized (key-sorted — the version-id
+ * rule). The signer signs this before the field exists; the verifier
+ * re-derives it from the parsed document, so the stored document's
+ * whitespace never matters.
+ */
+declare function signaturePayloadOf(manifest: WorkspaceVersionManifest): string;
 /** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */
 type SourceRef = NonNullable<WorkspaceVersionManifest["source"]>;
 interface VersionManifestInput {
@@ -70,5 +98,5 @@ declare function composeVersionManifest(input: VersionManifestInput): WorkspaceV
  */
 declare function versionDirPath(files: Record<string, string>): string;
 //#endregion
-export { SourceRef, VERSION_DIR_PATTERN, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest, versionDirPath };
+export { ManifestSignature, ManifestSignatureSchema, SourceRef, VERSION_DIR_PATTERN, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest, signaturePayloadOf, stableStringify, versionDirPath };
 //# sourceMappingURL=version-manifest.d.cts.map

package/dist/version-manifest.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.d.cts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;;cAea,qBAAmB;cAEnB,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;;GAsDzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;KAG1C,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB;;;;;;;;iBAgBrD,eAAe,OAAO"}
+{"version":3,"file":"version-manifest.d.cts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;;cAea,qBAAmB;;;;;cAMnB,yBAAuB,EAAA;;;;GAOlC,EAAA,KAAA;KACU,oBAAoB,EAAE,aAAa;cAElC,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;;;;iBAMtC,gBAAgB;;;;;;;;iBAmBhB,mBAAmB,UAAU;;KAMjC,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB;;;;;;;;iBAgBrD,eAAe,OAAO"}

package/dist/version-manifest.d.mts

@@ -2,6 +2,16 @@ import { z } from "zod";
 //#region src/version-manifest.d.ts
 /** Slot-relative directory holding one deploy's immutable file copies (#826). */
 declare const VERSION_DIR_PATTERN: RegExp;
+/** The attribution block stored in the manifest's `signature` field. The
+ * verifying key rides along so a verifier can distinguish "wrong signature"
+ * from "signed by a key the config never registered" — both are
+ * `SignatureInvalid`, but the reasons name different compromises. */
+declare const ManifestSignatureSchema: z.ZodObject<{
+  algorithm: z.ZodLiteral<"ed25519">;
+  publicKey: z.ZodString;
+  value: z.ZodString;
+}, z.core.$strip>;
+type ManifestSignature = z.infer<typeof ManifestSignatureSchema>;
 declare const WorkspaceVersionManifestSchema: z.ZodObject<{
   version: z.ZodString;
   builtAt: z.ZodOptional<z.ZodString>;
@@ -24,8 +34,26 @@ declare const WorkspaceVersionManifestSchema: z.ZodObject<{
     file: z.ZodString;
     integrity: z.ZodString;
   }, z.core.$strip>>;
+  signature: z.ZodOptional<z.ZodObject<{
+    algorithm: z.ZodLiteral<"ed25519">;
+    publicKey: z.ZodString;
+    value: z.ZodString;
+  }, z.core.$strip>>;
 }, z.core.$strip>;
 type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;
+/** Canonical key-sorted JSON serialization — the same form the version-id
+ * derivation hashes (undefined-valued entries dropped). Exported so the
+ * signature payload and the version id can never disagree about what
+ * "canonical" means. */
+declare function stableStringify(value: unknown): string;
+/**
+ * The bytes a manifest signature attests: the document minus its reserved
+ * `signature` field, canonically serialized (key-sorted — the version-id
+ * rule). The signer signs this before the field exists; the verifier
+ * re-derives it from the parsed document, so the stored document's
+ * whitespace never matters.
+ */
+declare function signaturePayloadOf(manifest: WorkspaceVersionManifest): string;
 /** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */
 type SourceRef = NonNullable<WorkspaceVersionManifest["source"]>;
 interface VersionManifestInput {
@@ -70,5 +98,5 @@ declare function composeVersionManifest(input: VersionManifestInput): WorkspaceV
  */
 declare function versionDirPath(files: Record<string, string>): string;
 //#endregion
-export { SourceRef, VERSION_DIR_PATTERN, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest, versionDirPath };
+export { ManifestSignature, ManifestSignatureSchema, SourceRef, VERSION_DIR_PATTERN, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest, signaturePayloadOf, stableStringify, versionDirPath };
 //# sourceMappingURL=version-manifest.d.mts.map

package/dist/version-manifest.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.d.mts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;;cAea,qBAAmB;cAEnB,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;;GAsDzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;KAG1C,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB;;;;;;;;iBAgBrD,eAAe,OAAO"}
+{"version":3,"file":"version-manifest.d.mts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;;cAea,qBAAmB;;;;;cAMnB,yBAAuB,EAAA;;;;GAOlC,EAAA,KAAA;KACU,oBAAoB,EAAE,aAAa;cAElC,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;;;;iBAMtC,gBAAgB;;;;;;;;iBAmBhB,mBAAmB,UAAU;;KAMjC,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB;;;;;;;;iBAgBrD,eAAe,OAAO"}

package/dist/version-manifest.mjs

@@ -13,6 +13,18 @@ import { createHash } from "node:crypto";
 const SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);
 /** Slot-relative directory holding one deploy's immutable file copies (#826). */
 const VERSION_DIR_PATTERN = /^versions\/[0-9a-f]{16}$/;
+/** The attribution block stored in the manifest's `signature` field. The
+* verifying key rides along so a verifier can distinguish "wrong signature"
+* from "signed by a key the config never registered" — both are
+* `SignatureInvalid`, but the reasons name different compromises. */
+const ManifestSignatureSchema = z.object({
+	algorithm: z.literal("ed25519"),
+	/** NEAR-format verifying key (`ed25519:<base58>`) — must equal the
+	* config's `publish.verification.publicKey`. */
+	publicKey: z.string().min(1),
+	/** base64 ed25519 signature over the canonical payload bytes. */
+	value: z.string().min(1)
+});
 const WorkspaceVersionManifestSchema = z.object({
 	version: z.string().regex(/^[0-9a-f]{16}$/),
 	builtAt: z.string().optional(),
@@ -60,8 +72,38 @@ const WorkspaceVersionManifestSchema = z.object({
 	source: z.object({
 		file: z.string().min(1),
 		integrity: SRI
-	}).optional()
+	}).optional(),
+	/**
+	* Attribution (ADR 0046 ticket 05): the deploy train's ed25519 signature
+	* over `signaturePayloadOf(this document)` — SRI attests WHAT the bytes
+	* are, the signature attests WHO published them, with the verifying key
+	* anchored in the on-chain config (`publish.verification`). Absent on
+	* rollouts with attribution off; readers that predate the field ignore it
+	* (zod strips unknown keys). Excluded from the version-id derivation —
+	* like `builtAt`, it is not a coordinate of the build.
+	*/
+	signature: ManifestSignatureSchema.optional()
 });
+/** Canonical key-sorted JSON serialization — the same form the version-id
+* derivation hashes (undefined-valued entries dropped). Exported so the
+* signature payload and the version id can never disagree about what
+* "canonical" means. */
+function stableStringify(value) {
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (value && typeof value === "object") return `{${Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).sort().join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+/**
+* The bytes a manifest signature attests: the document minus its reserved
+* `signature` field, canonically serialized (key-sorted — the version-id
+* rule). The signer signs this before the field exists; the verifier
+* re-derives it from the parsed document, so the stored document's
+* whitespace never matters.
+*/
+function signaturePayloadOf(manifest) {
+	const { signature: _signature, ...payload } = manifest;
+	return stableStringify(payload);
+}
 /**
 * Compose the manifest with its `version` derived from the canonical content
 * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —
@@ -87,12 +129,7 @@ function composeVersionManifest(input) {
 function versionDirPath(files) {
 	return `versions/${createHash("sha256").update(stableStringify(files)).digest("hex").slice(0, 16)}`;
 }
-function stableStringify(value) {
-	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	if (value && typeof value === "object") return `{${Object.entries(value).filter(([, v]) => v !== void 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).sort().join(",")}}`;
-	return JSON.stringify(value) ?? "null";
-}
 
 //#endregion
-export { VERSION_DIR_PATTERN, WorkspaceVersionManifestSchema, composeVersionManifest, versionDirPath };
+export { ManifestSignatureSchema, VERSION_DIR_PATTERN, WorkspaceVersionManifestSchema, composeVersionManifest, signaturePayloadOf, stableStringify, versionDirPath };
 //# sourceMappingURL=version-manifest.mjs.map

package/dist/version-manifest.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"version-manifest.mjs","names":[],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\n/** Slot-relative directory holding one deploy's immutable file copies (#826). */\nexport const VERSION_DIR_PATTERN = /^versions\\/[0-9a-f]{16}$/;\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  /**\n   * Slot-relative directory (`versions/<dirId>`) holding this deploy's\n   * byte-immutable copies of every dist file (#826). When present, all\n   * artifact coordinates below resolve against `<slotBase>/<dir>/` — so a\n   * pinned child's entry fetches its expose chunk and chunks from the same\n   * frozen directory instead of the mutable slot root. Absent on legacy\n   * manifests: coordinates resolve against the slot root exactly as before.\n   * Derived from the `files` map (see `versionDirPath`), so it participates\n   * in the version hash without circularity.\n   */\n  dir: z.string().regex(VERSION_DIR_PATTERN).optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n  /**\n   * Source archive of the workspace subtree (object path → served-object SRI)\n   * published beside the dists when the runtime opts in via\n   * `publish.sourcePublish` — lets `bos import` dereference a published\n   * config slot to the exact source bytes that build came from, with no\n   * GitHub dependency. Readers that predate the field ignore it (zod strips\n   * unknown keys). Participates in the version hash.\n   */\n  source: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  dir?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n  source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\n/**\n * The content-addressed directory name for one dist's file set (#826): a\n * 16-hex hash over the canonical files map. Identical bytes → identical\n * directory → re-deploying unchanged content is a server-side no-op, and a\n * published pin's directory can never be rewritten by a later deploy\n * (the upload service refuses conflicting writes under `versions/`).\n */\nexport function versionDirPath(files: Record<string, string>): string {\n  const id = createHash(\"sha256\").update(stableStringify(files)).digest(\"hex\").slice(0, 16);\n  return `versions/${id}`;\n}\n\nfunction stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;;AAGvD,MAAa,sBAAsB;AAEnC,MAAa,iCAAiC,EAAE,OAAO;CACrD,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;;;;;;;;;;;CAW5B,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,SAAS;CACpD,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAK,EACF,OAAO;EACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiB,EACd,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQ,EACL,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;;;;;AA8BD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,UAAU,WAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;;;;;;;;AASA,SAAgB,eAAe,OAAuC;CAEpE,OAAO,YADI,WAAW,QAAQ,CAAC,CAAC,OAAO,gBAAgB,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAClE;AACtB;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
+{"version":3,"file":"version-manifest.mjs","names":[],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\n/** Slot-relative directory holding one deploy's immutable file copies (#826). */\nexport const VERSION_DIR_PATTERN = /^versions\\/[0-9a-f]{16}$/;\n\n/** The attribution block stored in the manifest's `signature` field. The\n * verifying key rides along so a verifier can distinguish \"wrong signature\"\n * from \"signed by a key the config never registered\" — both are\n * `SignatureInvalid`, but the reasons name different compromises. */\nexport const ManifestSignatureSchema = z.object({\n  algorithm: z.literal(\"ed25519\"),\n  /** NEAR-format verifying key (`ed25519:<base58>`) — must equal the\n   * config's `publish.verification.publicKey`. */\n  publicKey: z.string().min(1),\n  /** base64 ed25519 signature over the canonical payload bytes. */\n  value: z.string().min(1),\n});\nexport type ManifestSignature = z.infer<typeof ManifestSignatureSchema>;\n\nexport const WorkspaceVersionManifestSchema = z.object({\n  version: z.string().regex(/^[0-9a-f]{16}$/),\n  builtAt: z.string().optional(),\n  gitSha: z.string().optional(),\n  /**\n   * Slot-relative directory (`versions/<dirId>`) holding this deploy's\n   * byte-immutable copies of every dist file (#826). When present, all\n   * artifact coordinates below resolve against `<slotBase>/<dir>/` — so a\n   * pinned child's entry fetches its expose chunk and chunks from the same\n   * frozen directory instead of the mutable slot root. Absent on legacy\n   * manifests: coordinates resolve against the slot root exactly as before.\n   * Derived from the `files` map (see `versionDirPath`), so it participates\n   * in the version hash without circularity.\n   */\n  dir: z.string().regex(VERSION_DIR_PATTERN).optional(),\n  entry: z.string().min(1),\n  entryIntegrity: SRI,\n  ssr: z\n    .object({\n      entry: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  browserManifest: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /** extra assets (css, icons) — logical name → served-object SRI */\n  assets: z.record(z.string(), SRI).optional(),\n  /** shared-dependency versions this build was built against */\n  shared: z.record(z.string(), z.string()).optional(),\n  /**\n   * Full per-file digest map of the dist (object path → served-object SRI).\n   * Written by `every-plugin`-based deploys so the next deploy can diff against\n   * it and skip re-uploading unchanged files; readers that predate the field\n   * ignore it (zod strips unknown keys). Participates in the version hash.\n   */\n  files: z.record(z.string(), SRI).optional(),\n  /**\n   * Source archive of the workspace subtree (object path → served-object SRI)\n   * published beside the dists when the runtime opts in via\n   * `publish.sourcePublish` — lets `bos import` dereference a published\n   * config slot to the exact source bytes that build came from, with no\n   * GitHub dependency. Readers that predate the field ignore it (zod strips\n   * unknown keys). Participates in the version hash.\n   */\n  source: z\n    .object({\n      file: z.string().min(1),\n      integrity: SRI,\n    })\n    .optional(),\n  /**\n   * Attribution (ADR 0046 ticket 05): the deploy train's ed25519 signature\n   * over `signaturePayloadOf(this document)` — SRI attests WHAT the bytes\n   * are, the signature attests WHO published them, with the verifying key\n   * anchored in the on-chain config (`publish.verification`). Absent on\n   * rollouts with attribution off; readers that predate the field ignore it\n   * (zod strips unknown keys). Excluded from the version-id derivation —\n   * like `builtAt`, it is not a coordinate of the build.\n   */\n  signature: ManifestSignatureSchema.optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** Canonical key-sorted JSON serialization — the same form the version-id\n * derivation hashes (undefined-valued entries dropped). Exported so the\n * signature payload and the version id can never disagree about what\n * \"canonical\" means. */\nexport function stableStringify(value: unknown): string {\n  if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n  if (value && typeof value === \"object\") {\n    return `{${Object.entries(value)\n      .filter(([, v]) => v !== undefined)\n      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n      .sort()\n      .join(\",\")}}`;\n  }\n  return JSON.stringify(value) ?? \"null\";\n}\n\n/**\n * The bytes a manifest signature attests: the document minus its reserved\n * `signature` field, canonically serialized (key-sorted — the version-id\n * rule). The signer signs this before the field exists; the verifier\n * re-derives it from the parsed document, so the stored document's\n * whitespace never matters.\n */\nexport function signaturePayloadOf(manifest: WorkspaceVersionManifest): string {\n  const { signature: _signature, ...payload } = manifest;\n  return stableStringify(payload);\n}\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n  /** Omit: a per-build timestamp makes the same version id map to different\n   * manifest bytes per machine, breaking the pin's SRI against the image's\n   * staged copy and the CDN's immutability for republished versions. */\n  builtAt?: string;\n  gitSha?: string;\n  dir?: string;\n  entry: string;\n  entryIntegrity: string;\n  ssr?: { entry: string; integrity: string };\n  browserManifest?: { file: string; integrity: string };\n  assets?: Record<string, string>;\n  shared?: Record<string, string>;\n  files?: Record<string, string>;\n  source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n  const { builtAt: _builtAt, ...hashedInputs } = input;\n  const version = createHash(\"sha256\")\n    .update(stableStringify(hashedInputs))\n    .digest(\"hex\")\n    .slice(0, 16);\n  return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\n/**\n * The content-addressed directory name for one dist's file set (#826): a\n * 16-hex hash over the canonical files map. Identical bytes → identical\n * directory → re-deploying unchanged content is a server-side no-op, and a\n * published pin's directory can never be rewritten by a later deploy\n * (the upload service refuses conflicting writes under `versions/`).\n */\nexport function versionDirPath(files: Record<string, string>): string {\n  const id = createHash(\"sha256\").update(stableStringify(files)).digest(\"hex\").slice(0, 16);\n  return `versions/${id}`;\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;;AAGvD,MAAa,sBAAsB;;;;;AAMnC,MAAa,0BAA0B,EAAE,OAAO;CAC9C,WAAW,EAAE,QAAQ,SAAS;;;CAG9B,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;;CAE3B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAGD,MAAa,iCAAiC,EAAE,OAAO;CACrD,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;;;;;;;;;;;CAW5B,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,SAAS;CACpD,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAK,EACF,OAAO;EACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiB,EACd,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQ,EACL,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;;;;;;;;;CAUZ,WAAW,wBAAwB,SAAS;AAC9C,CAAC;;;;;AAOD,SAAgB,gBAAgB,OAAwB;CACtD,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC;;;;;;;;AASA,SAAgB,mBAAmB,UAA4C;CAC7E,MAAM,EAAE,WAAW,YAAY,GAAG,YAAY;CAC9C,OAAO,gBAAgB,OAAO;AAChC;;;;;;;;AA6BA,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,UAAU,WAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;;;;;;;;AASA,SAAgB,eAAe,OAAuC;CAEpE,OAAO,YADI,WAAW,QAAQ,CAAC,CAAC,OAAO,gBAAgB,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAClE;AACtB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "every-plugin",
-  "version": "3.0.0-rc.16",
+  "version": "3.0.0-rc.17",
   "type": "module",
   "publishConfig": {
     "access": "public"

package/skills/plugin-client/SKILL.md

@@ -470,6 +470,6 @@ See the `extends-config` skill for deep merge semantics, per-environment extends
 | 401 `UNAUTHORIZED` "API key required" with `data: { authType: "apiKey", hint: "Provide a valid API key via x-api-key header" }` | the route is `requireApiKey(...)`-protected and your key was absent — usually `Authorization: Bearer` was used instead | switch to the `x-api-key` header |
 | 403 `FORBIDDEN` "API key lacks permission: <resource>:<action>" with `data: { requiredPermissions, keyPermissions }` | the key's `permissions` map does not cover every required resource/action — partial matches are rejected | re-create (server-side) or update the key with the needed permissions |
 | 403 `FORBIDDEN` "Requires role: ..." / "Requires organization role: ..." | session role gate | sign in with an account holding the role; a key cannot satisfy these |
-| 403 `FORBIDDEN` "Organization requires platform-admin approval" | the org's `status` is not `"active"` | stop — needs platform-admin approval, no client-side fix |
+| 403 `FORBIDDEN` "Organization requires platform-admin approval" | a downstream app still runs its own approval middleware (this platform ships none) | app-level policy — surface the org's approval state to the user |
 | `authClient.apiKey.list` / `update` return only `prefix` and metadata | expected — the full secret is returned once at `create` | create a new key; the old secret is unrecoverable |
 | Browser request blocked by CORS despite a valid key | session cookies not sent (`credentials: "include"` missing) or origin not allowed by `CORS_ORIGIN` | add `credentials: "include"` to the fetch wrapper, or fix `CORS_ORIGIN` |

package/src/client.ts

@@ -1,117 +1,20 @@
-import { createORPCClient, onError } from "@orpc/client";
+import { createORPCClient } from "@orpc/client";
 import { RPCLink } from "@orpc/client/fetch";
 import type { ContractRouterClient, RouterContract } from "@orpc/contract";
 
-export type RpcConnectionErrorCopy = () => { title: string; description: string };
-
-export interface RpcClientConfig {
-  hostUrl: string;
-  path: `/${string}`;
-  connectionError?: RpcConnectionErrorCopy;
-}
-
-const RATE_LIMIT_MAX_RETRIES = 3;
-const RATE_LIMIT_RETRY_CAP_MS = 2_000;
-const browserClients = new Map<string, unknown>();
-type FetchInput = Parameters<typeof fetch>[0];
-
-async function fetchWithRateLimitRetry(
-  fetchUrl: FetchInput,
-  options?: RequestInit,
-): Promise<Response> {
-  let response = await fetch(fetchUrl, options);
-  for (let attempt = 1; attempt <= RATE_LIMIT_MAX_RETRIES && response.status === 429; attempt++) {
-    const retryAfterSeconds = Number(response.headers.get("retry-after"));
-    const delay =
-      Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
-        ? Math.min(retryAfterSeconds * 1000, RATE_LIMIT_RETRY_CAP_MS)
-        : 100 * attempt;
-    await new Promise((resolve) => setTimeout(resolve, delay));
-    response = await fetch(fetchUrl, options);
-  }
-
-  return response;
-}
-
-function mergeHeaders(base: Headers, overrides?: RequestInit["headers"]): Headers {
-  const merged = new Headers(base);
-  new Headers(overrides).forEach((value, key) => {
-    merged.set(key, value);
-  });
-  return merged;
-}
-
-function createRpcLink(config: RpcClientConfig, headers?: Headers) {
-  return new RPCLink({
-    origin: config.hostUrl,
-    url: config.path,
-    interceptors: [
-      onError((error: unknown) => {
-        const browserWindow = (globalThis as { window?: unknown }).window;
-        if (typeof browserWindow === "undefined") {
-          return;
-        }
-
-        if (error && typeof error === "object" && "message" in error) {
-          const message = String(error.message).toLowerCase();
-          if (
-            message.includes("fetch") ||
-            message.includes("network") ||
-            message.includes("failed to fetch")
-          ) {
-            void import("sonner")
-              .then(({ toast }) => {
-                const message = config.connectionError?.() ?? {
-                  title: "Unable to connect to API",
-                  description: "The API is currently unavailable. Please try again later.",
-                };
-                toast.error(message.title, {
-                  id: "api-connection-error",
-                  description: message.description,
-                });
-              })
-              .catch(() => {});
-          }
-        }
-      }),
-    ],
-    fetch(fetchUrl: FetchInput, options?: RequestInit) {
-      return fetchWithRateLimitRetry(fetchUrl, {
-        ...options,
-        credentials: "include",
-        headers: headers ? mergeHeaders(headers, options?.headers) : options?.headers,
-      });
-    },
-  });
-}
-
-function buildRpcClient<T extends RouterContract>(
-  config: RpcClientConfig,
-  headers?: Headers,
-): ContractRouterClient<T> {
-  if (!config.hostUrl) {
-    throw new Error("Missing runtime host URL");
-  }
-
-  return createORPCClient(createRpcLink(config, headers)) as ContractRouterClient<T>;
-}
-
+/**
+ * Bare typed oRPC client over the RPC protocol — a thin convenience over
+ * `createORPCClient(new RPCLink({ origin, url }))`.
+ *
+ * Promise-native, so async/await callers call it directly and Effect callers
+ * lift calls with `Effect.tryPromise` (owning timeout/retry/cache in their
+ * service layer). Transport customization (headers, timeouts, retries, test
+ * doubles) is RPCLink's native surface — construct the link yourself and pass
+ * it to `createORPCClient` instead of growing config here.
+ */
 export function createRpcClient<T extends RouterContract = RouterContract>(
-  config: RpcClientConfig,
-  headers?: Headers,
+  hostUrl: string,
+  path: `/${string}` = "/api/rpc",
 ): ContractRouterClient<T> {
-  const browserWindow = (globalThis as { window?: unknown }).window;
-  if (typeof browserWindow !== "undefined" && !headers) {
-    const key = `${config.hostUrl}${config.path}`;
-    const memoized = browserClients.get(key);
-    if (memoized) {
-      return memoized as ContractRouterClient<T>;
-    }
-
-    const client = buildRpcClient<T>(config, headers);
-    browserClients.set(key, client);
-    return client;
-  }
-
-  return buildRpcClient<T>(config, headers);
+  return createORPCClient(new RPCLink({ origin: hostUrl, url: path })) as ContractRouterClient<T>;
 }

package/src/index.ts

@@ -12,6 +12,7 @@ export { getNormalizedRemoteName } from "./runtime/services/normalize";
 export type {
   AnyPlugin,
   EveryPlugin,
+  InferRegistryFromEntries,
   InitializedPlugin,
   LoadedPlugin,
   ModuleClientEntry,
@@ -27,6 +28,7 @@ export type {
   PluginInstance,
   PluginMetadata,
   PluginRegistry,
+  PluginRegistryEntry,
   PluginRouterType,
   PluginRuntimeConfig,
   PluginSecrets,

package/src/version-manifest.ts

@@ -15,6 +15,20 @@ const SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);
 /** Slot-relative directory holding one deploy's immutable file copies (#826). */
 export const VERSION_DIR_PATTERN = /^versions\/[0-9a-f]{16}$/;
 
+/** The attribution block stored in the manifest's `signature` field. The
+ * verifying key rides along so a verifier can distinguish "wrong signature"
+ * from "signed by a key the config never registered" — both are
+ * `SignatureInvalid`, but the reasons name different compromises. */
+export const ManifestSignatureSchema = z.object({
+  algorithm: z.literal("ed25519"),
+  /** NEAR-format verifying key (`ed25519:<base58>`) — must equal the
+   * config's `publish.verification.publicKey`. */
+  publicKey: z.string().min(1),
+  /** base64 ed25519 signature over the canonical payload bytes. */
+  value: z.string().min(1),
+});
+export type ManifestSignature = z.infer<typeof ManifestSignatureSchema>;
+
 export const WorkspaceVersionManifestSchema = z.object({
   version: z.string().regex(/^[0-9a-f]{16}$/),
   builtAt: z.string().optional(),
@@ -69,9 +83,47 @@ export const WorkspaceVersionManifestSchema = z.object({
       integrity: SRI,
     })
     .optional(),
+  /**
+   * Attribution (ADR 0046 ticket 05): the deploy train's ed25519 signature
+   * over `signaturePayloadOf(this document)` — SRI attests WHAT the bytes
+   * are, the signature attests WHO published them, with the verifying key
+   * anchored in the on-chain config (`publish.verification`). Absent on
+   * rollouts with attribution off; readers that predate the field ignore it
+   * (zod strips unknown keys). Excluded from the version-id derivation —
+   * like `builtAt`, it is not a coordinate of the build.
+   */
+  signature: ManifestSignatureSchema.optional(),
 });
 export type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;
 
+/** Canonical key-sorted JSON serialization — the same form the version-id
+ * derivation hashes (undefined-valued entries dropped). Exported so the
+ * signature payload and the version id can never disagree about what
+ * "canonical" means. */
+export function stableStringify(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value)
+      .filter(([, v]) => v !== undefined)
+      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)
+      .sort()
+      .join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+
+/**
+ * The bytes a manifest signature attests: the document minus its reserved
+ * `signature` field, canonically serialized (key-sorted — the version-id
+ * rule). The signer signs this before the field exists; the verifier
+ * re-derives it from the parsed document, so the stored document's
+ * whitespace never matters.
+ */
+export function signaturePayloadOf(manifest: WorkspaceVersionManifest): string {
+  const { signature: _signature, ...payload } = manifest;
+  return stableStringify(payload);
+}
+
 /** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */
 export type SourceRef = NonNullable<WorkspaceVersionManifest["source"]>;
 
@@ -119,15 +171,3 @@ export function versionDirPath(files: Record<string, string>): string {
   const id = createHash("sha256").update(stableStringify(files)).digest("hex").slice(0, 16);
   return `versions/${id}`;
 }
-
-function stableStringify(value: unknown): string {
-  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-  if (value && typeof value === "object") {
-    return `{${Object.entries(value)
-      .filter(([, v]) => v !== undefined)
-      .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)
-      .sort()
-      .join(",")}}`;
-  }
-  return JSON.stringify(value) ?? "null";
-}