every-plugin 3.0.0-rc.5 → 3.0.0-rc.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/dist/build/rspack/chunk-completeness-plugin.cjs +19 -7
  2. package/dist/build/rspack/chunk-completeness-plugin.cjs.map +1 -1
  3. package/dist/build/rspack/chunk-completeness-plugin.mjs +19 -7
  4. package/dist/build/rspack/chunk-completeness-plugin.mjs.map +1 -1
  5. package/dist/runtime/mf-config.cjs +1 -1
  6. package/dist/runtime/mf-config.mjs +1 -1
  7. package/dist/version-manifest.cjs +13 -1
  8. package/dist/version-manifest.cjs.map +1 -1
  9. package/dist/version-manifest.d.cts +11 -1
  10. package/dist/version-manifest.d.cts.map +1 -1
  11. package/dist/version-manifest.d.mts +11 -1
  12. package/dist/version-manifest.d.mts.map +1 -1
  13. package/dist/version-manifest.mjs +13 -1
  14. package/dist/version-manifest.mjs.map +1 -1
  15. package/package.json +1 -1
  16. package/skills/plugin-client/SKILL.md +10 -4
  17. package/skills/plugin-testing/SKILL.md +1 -0
  18. package/src/build/rspack/chunk-completeness-plugin.ts +15 -6
  19. package/src/version-manifest.ts +18 -0
package/dist/build/rspack/chunk-completeness-plugin.cjs CHANGED
@@ -28,14 +28,26 @@ var ChunkCompletenessPlugin = class {
28
28
  const entry = require_build_artifact_names.findHashedEntry(names, this.entryBase) ?? names.find((n) => n === `${this.entryBase}.js`);
29
29
  if (!entry) return;
30
30
  const jsFiles = new Set(names.filter((n) => n.endsWith(".js")));
31
- const source = assets[entry].source().toString();
31
+ const entryAsset = assets[entry];
32
+ if (!entryAsset) return;
33
+ const source = entryAsset.source().toString();
32
34
  const special = /* @__PURE__ */ new Map();
33
- const u = source.match(/\.u\s*=\s*(\w+)=>([^,;]+)/);
34
- if (u) for (const m of u[2].matchAll(/(\d+)\s*===\s*\w+\s*\?\s*"([^"]+)"/g)) special.set(m[1], m[2]);
35
- for (const pa of source.matchAll(/Promise\.all\(\[([^\]]*)\]\)/g)) for (const m of pa[1].matchAll(/(?:__webpack_require__|\w+)\.e\((\d+)\)/g)) {
36
- const id = m[1];
37
- const file = special.has(id) ? `${special.get(id)}.js` : `${id}.js`;
38
- if (!jsFiles.has(file)) compilation.errors.push(/* @__PURE__ */ new Error(`[${this.name}] entry ${entry} eagerly loads chunk ${id} (${file}) but the compilation never emitted it — the built remote would fail at load time with "__webpack_modules__[r] is not a function".`));
35
+ const uExpression = source.match(/\.u\s*=\s*(\w+)=>([^,;]+)/)?.[2];
36
+ if (uExpression) for (const m of uExpression.matchAll(/(\d+)\s*===\s*\w+\s*\?\s*"([^"]+)"/g)) {
37
+ const chunkId = m[1];
38
+ const chunkName = m[2];
39
+ if (chunkId && chunkName) special.set(chunkId, chunkName);
40
+ }
41
+ for (const pa of source.matchAll(/Promise\.all\(\[([^\]]*)\]\)/g)) {
42
+ const eagerList = pa[1];
43
+ if (!eagerList) continue;
44
+ for (const m of eagerList.matchAll(/(?:__webpack_require__|\w+)\.e\((\d+)\)/g)) {
45
+ const id = m[1];
46
+ if (!id) continue;
47
+ const chunkName = special.get(id);
48
+ const file = chunkName ? `${chunkName}.js` : `${id}.js`;
49
+ if (!jsFiles.has(file)) compilation.errors.push(/* @__PURE__ */ new Error(`[${this.name}] entry ${entry} eagerly loads chunk ${id} (${file}) but the compilation never emitted it — the built remote would fail at load time with "__webpack_modules__[r] is not a function".`));
50
+ }
39
51
  }
40
52
  });
41
53
  });
package/dist/build/rspack/chunk-completeness-plugin.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"chunk-completeness-plugin.cjs","names":["findHashedEntry"],"sources":["../../../src/build/rspack/chunk-completeness-plugin.ts"],"sourcesContent":["import type { Compiler, RspackPluginInstance } from \"@rspack/core\";\nimport { findHashedEntry } from \"../artifact-names\";\n\n/**\n * Fails the build when a container entry's eager chunk references\n * (`Promise.all([__webpack_require__.e(N), …])` in get factories) point at\n * chunk files the compilation never emits. Rspack 2.x splitChunks re-ids the\n * final chunk graph while the federation get-factory codegen can keep\n * pre-split ids — the emitted entry then 404s its own chunks at load time and\n * the failure surfaces downstream as `__webpack_modules__[r] is not a\n * function`. SplitChunks is disabled in the composition for exactly this\n * reason; this gate catches any regression loudly at build time instead.\n */\nexport class ChunkCompletenessPlugin implements RspackPluginInstance {\n name = \"ChunkCompletenessPlugin\";\n\n constructor(private entryBase = \"remoteEntry\") {}\n\n apply(compiler: Compiler) {\n compiler.hooks.thisCompilation.tap(this.name, (compilation) => {\n const webpack = (compiler as Compiler & { webpack?: any }).webpack;\n const stage = webpack?.Compilation?.PROCESS_ASSETS_STAGE_ADDITIONS ?? 1000;\n\n compilation.hooks.processAssets.tap({ name: this.name, stage }, (assets) => {\n const names = Object.keys(assets);\n const entry =\n findHashedEntry(names, this.entryBase) ?? names.find((n) => n === `${this.entryBase}.js`);\n if (!entry) return;\n\n const jsFiles = new Set(names.filter((n) => n.endsWith(\".js\")));\n const source = assets[entry].source().toString();\n\n const special = new Map<string, string>();\n const u = source.match(/\\.u\\s*=\\s*(\\w+)=>([^,;]+)/);\n if (u) {\n for (const m of u[2].matchAll(/(\\d+)\\s*===\\s*\\w+\\s*\\?\\s*\"([^\"]+)\"/g)) {\n special.set(m[1], m[2]);\n }\n }\n\n for (const pa of source.matchAll(/Promise\\.all\\(\\[([^\\]]*)\\]\\)/g)) {\n for (const m of pa[1].matchAll(/(?:__webpack_require__|\\w+)\\.e\\((\\d+)\\)/g)) {\n const id = m[1];\n const file = special.has(id) ? `${special.get(id)}.js` : `${id}.js`;\n if (!jsFiles.has(file)) {\n compilation.errors.push(\n new Error(\n `[${this.name}] entry ${entry} eagerly loads chunk ${id} (${file}) but the compilation never emitted it — the built remote would fail at load time with \"__webpack_modules__[r] is not a function\".`,\n ),\n );\n }\n }\n }\n });\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,IAAa,0BAAb,MAAqE;CAG/C;CAFpB,OAAO;CAEP,YAAY,AAAQ,YAAY,eAAe;EAA3B;CAA4B;CAEhD,MAAM,UAAoB;EACxB,SAAS,MAAM,gBAAgB,IAAI,KAAK,OAAO,gBAAgB;GAE7D,MAAM,QADW,SAA0C,SACpC,aAAa,kCAAkC;GAEtE,YAAY,MAAM,cAAc,IAAI;IAAE,MAAM,KAAK;IAAM;GAAM,IAAI,WAAW;IAC1E,MAAM,QAAQ,OAAO,KAAK,MAAM;IAChC,MAAM,QACJA,6CAAgB,OAAO,KAAK,SAAS,KAAK,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,UAAU,IAAI;IAC1F,IAAI,CAAC,OAAO;IAEZ,MAAM,UAAU,IAAI,IAAI,MAAM,QAAQ,MAAM,EAAE,SAAS,KAAK,CAAC,CAAC;IAC9D,MAAM,SAAS,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS;IAE/C,MAAM,0BAAU,IAAI,IAAoB;IACxC,MAAM,IAAI,OAAO,MAAM,2BAA2B;IAClD,IAAI,GACF,KAAK,MAAM,KAAK,EAAE,EAAE,CAAC,SAAS,qCAAqC,GACjE,QAAQ,IAAI,EAAE,IAAI,EAAE,EAAE;IAI1B,KAAK,MAAM,MAAM,OAAO,SAAS,+BAA+B,GAC9D,KAAK,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,0CAA0C,GAAG;KAC1E,MAAM,KAAK,EAAE;KACb,MAAM,OAAO,QAAQ,IAAI,EAAE,IAAI,GAAG,QAAQ,IAAI,EAAE,EAAE,OAAO,GAAG,GAAG;KAC/D,IAAI,CAAC,QAAQ,IAAI,IAAI,GACnB,YAAY,OAAO,qBACjB,IAAI,MACF,IAAI,KAAK,KAAK,UAAU,MAAM,uBAAuB,GAAG,IAAI,KAAK,mIACnE,CACF;IAEJ;GAEJ,CAAC;EACH,CAAC;CACH;AACF"}
1
+ {"version":3,"file":"chunk-completeness-plugin.cjs","names":["findHashedEntry"],"sources":["../../../src/build/rspack/chunk-completeness-plugin.ts"],"sourcesContent":["import type { Compiler, RspackPluginInstance } from \"@rspack/core\";\nimport { findHashedEntry } from \"../artifact-names\";\n\n/**\n * Fails the build when a container entry's eager chunk references\n * (`Promise.all([__webpack_require__.e(N), …])` in get factories) point at\n * chunk files the compilation never emits. Rspack 2.x splitChunks re-ids the\n * final chunk graph while the federation get-factory codegen can keep\n * pre-split ids — the emitted entry then 404s its own chunks at load time and\n * the failure surfaces downstream as `__webpack_modules__[r] is not a\n * function`. SplitChunks is disabled in the composition for exactly this\n * reason; this gate catches any regression loudly at build time instead.\n */\nexport class ChunkCompletenessPlugin implements RspackPluginInstance {\n name = \"ChunkCompletenessPlugin\";\n\n constructor(private entryBase = \"remoteEntry\") {}\n\n apply(compiler: Compiler) {\n compiler.hooks.thisCompilation.tap(this.name, (compilation) => {\n const webpack = (compiler as Compiler & { webpack?: any }).webpack;\n const stage = webpack?.Compilation?.PROCESS_ASSETS_STAGE_ADDITIONS ?? 1000;\n\n compilation.hooks.processAssets.tap({ name: this.name, stage }, (assets) => {\n const names = Object.keys(assets);\n const entry =\n findHashedEntry(names, this.entryBase) ?? names.find((n) => n === `${this.entryBase}.js`);\n if (!entry) return;\n\n const jsFiles = new Set(names.filter((n) => n.endsWith(\".js\")));\n const entryAsset = assets[entry];\n if (!entryAsset) return;\n const source = entryAsset.source().toString();\n\n const special = new Map<string, string>();\n const u = source.match(/\\.u\\s*=\\s*(\\w+)=>([^,;]+)/);\n const uExpression = u?.[2];\n if (uExpression) {\n for (const m of uExpression.matchAll(/(\\d+)\\s*===\\s*\\w+\\s*\\?\\s*\"([^\"]+)\"/g)) {\n const chunkId = m[1];\n const chunkName = m[2];\n if (chunkId && chunkName) special.set(chunkId, chunkName);\n }\n }\n\n for (const pa of source.matchAll(/Promise\\.all\\(\\[([^\\]]*)\\]\\)/g)) {\n const eagerList = pa[1];\n if (!eagerList) continue;\n for (const m of eagerList.matchAll(/(?:__webpack_require__|\\w+)\\.e\\((\\d+)\\)/g)) {\n const id = m[1];\n if (!id) continue;\n const chunkName = special.get(id);\n const file = chunkName ? `${chunkName}.js` : `${id}.js`;\n if (!jsFiles.has(file)) {\n compilation.errors.push(\n new Error(\n `[${this.name}] entry ${entry} eagerly loads chunk ${id} (${file}) but the compilation never emitted it — the built remote would fail at load time with \"__webpack_modules__[r] is not a function\".`,\n ),\n );\n }\n }\n }\n });\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,IAAa,0BAAb,MAAqE;CAG/C;CAFpB,OAAO;CAEP,YAAY,AAAQ,YAAY,eAAe;EAA3B;CAA4B;CAEhD,MAAM,UAAoB;EACxB,SAAS,MAAM,gBAAgB,IAAI,KAAK,OAAO,gBAAgB;GAE7D,MAAM,QADW,SAA0C,SACpC,aAAa,kCAAkC;GAEtE,YAAY,MAAM,cAAc,IAAI;IAAE,MAAM,KAAK;IAAM;GAAM,IAAI,WAAW;IAC1E,MAAM,QAAQ,OAAO,KAAK,MAAM;IAChC,MAAM,QACJA,6CAAgB,OAAO,KAAK,SAAS,KAAK,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,UAAU,IAAI;IAC1F,IAAI,CAAC,OAAO;IAEZ,MAAM,UAAU,IAAI,IAAI,MAAM,QAAQ,MAAM,EAAE,SAAS,KAAK,CAAC,CAAC;IAC9D,MAAM,aAAa,OAAO;IAC1B,IAAI,CAAC,YAAY;IACjB,MAAM,SAAS,WAAW,OAAO,CAAC,CAAC,SAAS;IAE5C,MAAM,0BAAU,IAAI,IAAoB;IAExC,MAAM,cADI,OAAO,MAAM,2BACH,CAAC,GAAG;IACxB,IAAI,aACF,KAAK,MAAM,KAAK,YAAY,SAAS,qCAAqC,GAAG;KAC3E,MAAM,UAAU,EAAE;KAClB,MAAM,YAAY,EAAE;KACpB,IAAI,WAAW,WAAW,QAAQ,IAAI,SAAS,SAAS;IAC1D;IAGF,KAAK,MAAM,MAAM,OAAO,SAAS,+BAA+B,GAAG;KACjE,MAAM,YAAY,GAAG;KACrB,IAAI,CAAC,WAAW;KAChB,KAAK,MAAM,KAAK,UAAU,SAAS,0CAA0C,GAAG;MAC9E,MAAM,KAAK,EAAE;MACb,IAAI,CAAC,IAAI;MACT,MAAM,YAAY,QAAQ,IAAI,EAAE;MAChC,MAAM,OAAO,YAAY,GAAG,UAAU,OAAO,GAAG,GAAG;MACnD,IAAI,CAAC,QAAQ,IAAI,IAAI,GACnB,YAAY,OAAO,qBACjB,IAAI,MACF,IAAI,KAAK,KAAK,UAAU,MAAM,uBAAuB,GAAG,IAAI,KAAK,mIACnE,CACF;KAEJ;IACF;GACF,CAAC;EACH,CAAC;CACH;AACF"}
package/dist/build/rspack/chunk-completeness-plugin.mjs CHANGED
@@ -28,14 +28,26 @@ var ChunkCompletenessPlugin = class {
28
28
  const entry = findHashedEntry(names, this.entryBase) ?? names.find((n) => n === `${this.entryBase}.js`);
29
29
  if (!entry) return;
30
30
  const jsFiles = new Set(names.filter((n) => n.endsWith(".js")));
31
- const source = assets[entry].source().toString();
31
+ const entryAsset = assets[entry];
32
+ if (!entryAsset) return;
33
+ const source = entryAsset.source().toString();
32
34
  const special = /* @__PURE__ */ new Map();
33
- const u = source.match(/\.u\s*=\s*(\w+)=>([^,;]+)/);
34
- if (u) for (const m of u[2].matchAll(/(\d+)\s*===\s*\w+\s*\?\s*"([^"]+)"/g)) special.set(m[1], m[2]);
35
- for (const pa of source.matchAll(/Promise\.all\(\[([^\]]*)\]\)/g)) for (const m of pa[1].matchAll(/(?:__webpack_require__|\w+)\.e\((\d+)\)/g)) {
36
- const id = m[1];
37
- const file = special.has(id) ? `${special.get(id)}.js` : `${id}.js`;
38
- if (!jsFiles.has(file)) compilation.errors.push(/* @__PURE__ */ new Error(`[${this.name}] entry ${entry} eagerly loads chunk ${id} (${file}) but the compilation never emitted it — the built remote would fail at load time with "__webpack_modules__[r] is not a function".`));
35
+ const uExpression = source.match(/\.u\s*=\s*(\w+)=>([^,;]+)/)?.[2];
36
+ if (uExpression) for (const m of uExpression.matchAll(/(\d+)\s*===\s*\w+\s*\?\s*"([^"]+)"/g)) {
37
+ const chunkId = m[1];
38
+ const chunkName = m[2];
39
+ if (chunkId && chunkName) special.set(chunkId, chunkName);
40
+ }
41
+ for (const pa of source.matchAll(/Promise\.all\(\[([^\]]*)\]\)/g)) {
42
+ const eagerList = pa[1];
43
+ if (!eagerList) continue;
44
+ for (const m of eagerList.matchAll(/(?:__webpack_require__|\w+)\.e\((\d+)\)/g)) {
45
+ const id = m[1];
46
+ if (!id) continue;
47
+ const chunkName = special.get(id);
48
+ const file = chunkName ? `${chunkName}.js` : `${id}.js`;
49
+ if (!jsFiles.has(file)) compilation.errors.push(/* @__PURE__ */ new Error(`[${this.name}] entry ${entry} eagerly loads chunk ${id} (${file}) but the compilation never emitted it — the built remote would fail at load time with "__webpack_modules__[r] is not a function".`));
50
+ }
39
51
  }
40
52
  });
41
53
  });
package/dist/build/rspack/chunk-completeness-plugin.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"chunk-completeness-plugin.mjs","names":[],"sources":["../../../src/build/rspack/chunk-completeness-plugin.ts"],"sourcesContent":["import type { Compiler, RspackPluginInstance } from \"@rspack/core\";\nimport { findHashedEntry } from \"../artifact-names\";\n\n/**\n * Fails the build when a container entry's eager chunk references\n * (`Promise.all([__webpack_require__.e(N), …])` in get factories) point at\n * chunk files the compilation never emits. Rspack 2.x splitChunks re-ids the\n * final chunk graph while the federation get-factory codegen can keep\n * pre-split ids — the emitted entry then 404s its own chunks at load time and\n * the failure surfaces downstream as `__webpack_modules__[r] is not a\n * function`. SplitChunks is disabled in the composition for exactly this\n * reason; this gate catches any regression loudly at build time instead.\n */\nexport class ChunkCompletenessPlugin implements RspackPluginInstance {\n name = \"ChunkCompletenessPlugin\";\n\n constructor(private entryBase = \"remoteEntry\") {}\n\n apply(compiler: Compiler) {\n compiler.hooks.thisCompilation.tap(this.name, (compilation) => {\n const webpack = (compiler as Compiler & { webpack?: any }).webpack;\n const stage = webpack?.Compilation?.PROCESS_ASSETS_STAGE_ADDITIONS ?? 1000;\n\n compilation.hooks.processAssets.tap({ name: this.name, stage }, (assets) => {\n const names = Object.keys(assets);\n const entry =\n findHashedEntry(names, this.entryBase) ?? names.find((n) => n === `${this.entryBase}.js`);\n if (!entry) return;\n\n const jsFiles = new Set(names.filter((n) => n.endsWith(\".js\")));\n const source = assets[entry].source().toString();\n\n const special = new Map<string, string>();\n const u = source.match(/\\.u\\s*=\\s*(\\w+)=>([^,;]+)/);\n if (u) {\n for (const m of u[2].matchAll(/(\\d+)\\s*===\\s*\\w+\\s*\\?\\s*\"([^\"]+)\"/g)) {\n special.set(m[1], m[2]);\n }\n }\n\n for (const pa of source.matchAll(/Promise\\.all\\(\\[([^\\]]*)\\]\\)/g)) {\n for (const m of pa[1].matchAll(/(?:__webpack_require__|\\w+)\\.e\\((\\d+)\\)/g)) {\n const id = m[1];\n const file = special.has(id) ? `${special.get(id)}.js` : `${id}.js`;\n if (!jsFiles.has(file)) {\n compilation.errors.push(\n new Error(\n `[${this.name}] entry ${entry} eagerly loads chunk ${id} (${file}) but the compilation never emitted it — the built remote would fail at load time with \"__webpack_modules__[r] is not a function\".`,\n ),\n );\n }\n }\n }\n });\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,IAAa,0BAAb,MAAqE;CAG/C;CAFpB,OAAO;CAEP,YAAY,AAAQ,YAAY,eAAe;EAA3B;CAA4B;CAEhD,MAAM,UAAoB;EACxB,SAAS,MAAM,gBAAgB,IAAI,KAAK,OAAO,gBAAgB;GAE7D,MAAM,QADW,SAA0C,SACpC,aAAa,kCAAkC;GAEtE,YAAY,MAAM,cAAc,IAAI;IAAE,MAAM,KAAK;IAAM;GAAM,IAAI,WAAW;IAC1E,MAAM,QAAQ,OAAO,KAAK,MAAM;IAChC,MAAM,QACJ,gBAAgB,OAAO,KAAK,SAAS,KAAK,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,UAAU,IAAI;IAC1F,IAAI,CAAC,OAAO;IAEZ,MAAM,UAAU,IAAI,IAAI,MAAM,QAAQ,MAAM,EAAE,SAAS,KAAK,CAAC,CAAC;IAC9D,MAAM,SAAS,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS;IAE/C,MAAM,0BAAU,IAAI,IAAoB;IACxC,MAAM,IAAI,OAAO,MAAM,2BAA2B;IAClD,IAAI,GACF,KAAK,MAAM,KAAK,EAAE,EAAE,CAAC,SAAS,qCAAqC,GACjE,QAAQ,IAAI,EAAE,IAAI,EAAE,EAAE;IAI1B,KAAK,MAAM,MAAM,OAAO,SAAS,+BAA+B,GAC9D,KAAK,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,0CAA0C,GAAG;KAC1E,MAAM,KAAK,EAAE;KACb,MAAM,OAAO,QAAQ,IAAI,EAAE,IAAI,GAAG,QAAQ,IAAI,EAAE,EAAE,OAAO,GAAG,GAAG;KAC/D,IAAI,CAAC,QAAQ,IAAI,IAAI,GACnB,YAAY,OAAO,qBACjB,IAAI,MACF,IAAI,KAAK,KAAK,UAAU,MAAM,uBAAuB,GAAG,IAAI,KAAK,mIACnE,CACF;IAEJ;GAEJ,CAAC;EACH,CAAC;CACH;AACF"}
1
+ {"version":3,"file":"chunk-completeness-plugin.mjs","names":[],"sources":["../../../src/build/rspack/chunk-completeness-plugin.ts"],"sourcesContent":["import type { Compiler, RspackPluginInstance } from \"@rspack/core\";\nimport { findHashedEntry } from \"../artifact-names\";\n\n/**\n * Fails the build when a container entry's eager chunk references\n * (`Promise.all([__webpack_require__.e(N), …])` in get factories) point at\n * chunk files the compilation never emits. Rspack 2.x splitChunks re-ids the\n * final chunk graph while the federation get-factory codegen can keep\n * pre-split ids — the emitted entry then 404s its own chunks at load time and\n * the failure surfaces downstream as `__webpack_modules__[r] is not a\n * function`. SplitChunks is disabled in the composition for exactly this\n * reason; this gate catches any regression loudly at build time instead.\n */\nexport class ChunkCompletenessPlugin implements RspackPluginInstance {\n name = \"ChunkCompletenessPlugin\";\n\n constructor(private entryBase = \"remoteEntry\") {}\n\n apply(compiler: Compiler) {\n compiler.hooks.thisCompilation.tap(this.name, (compilation) => {\n const webpack = (compiler as Compiler & { webpack?: any }).webpack;\n const stage = webpack?.Compilation?.PROCESS_ASSETS_STAGE_ADDITIONS ?? 1000;\n\n compilation.hooks.processAssets.tap({ name: this.name, stage }, (assets) => {\n const names = Object.keys(assets);\n const entry =\n findHashedEntry(names, this.entryBase) ?? names.find((n) => n === `${this.entryBase}.js`);\n if (!entry) return;\n\n const jsFiles = new Set(names.filter((n) => n.endsWith(\".js\")));\n const entryAsset = assets[entry];\n if (!entryAsset) return;\n const source = entryAsset.source().toString();\n\n const special = new Map<string, string>();\n const u = source.match(/\\.u\\s*=\\s*(\\w+)=>([^,;]+)/);\n const uExpression = u?.[2];\n if (uExpression) {\n for (const m of uExpression.matchAll(/(\\d+)\\s*===\\s*\\w+\\s*\\?\\s*\"([^\"]+)\"/g)) {\n const chunkId = m[1];\n const chunkName = m[2];\n if (chunkId && chunkName) special.set(chunkId, chunkName);\n }\n }\n\n for (const pa of source.matchAll(/Promise\\.all\\(\\[([^\\]]*)\\]\\)/g)) {\n const eagerList = pa[1];\n if (!eagerList) continue;\n for (const m of eagerList.matchAll(/(?:__webpack_require__|\\w+)\\.e\\((\\d+)\\)/g)) {\n const id = m[1];\n if (!id) continue;\n const chunkName = special.get(id);\n const file = chunkName ? `${chunkName}.js` : `${id}.js`;\n if (!jsFiles.has(file)) {\n compilation.errors.push(\n new Error(\n `[${this.name}] entry ${entry} eagerly loads chunk ${id} (${file}) but the compilation never emitted it — the built remote would fail at load time with \"__webpack_modules__[r] is not a function\".`,\n ),\n );\n }\n }\n }\n });\n });\n }\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,IAAa,0BAAb,MAAqE;CAG/C;CAFpB,OAAO;CAEP,YAAY,AAAQ,YAAY,eAAe;EAA3B;CAA4B;CAEhD,MAAM,UAAoB;EACxB,SAAS,MAAM,gBAAgB,IAAI,KAAK,OAAO,gBAAgB;GAE7D,MAAM,QADW,SAA0C,SACpC,aAAa,kCAAkC;GAEtE,YAAY,MAAM,cAAc,IAAI;IAAE,MAAM,KAAK;IAAM;GAAM,IAAI,WAAW;IAC1E,MAAM,QAAQ,OAAO,KAAK,MAAM;IAChC,MAAM,QACJ,gBAAgB,OAAO,KAAK,SAAS,KAAK,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,UAAU,IAAI;IAC1F,IAAI,CAAC,OAAO;IAEZ,MAAM,UAAU,IAAI,IAAI,MAAM,QAAQ,MAAM,EAAE,SAAS,KAAK,CAAC,CAAC;IAC9D,MAAM,aAAa,OAAO;IAC1B,IAAI,CAAC,YAAY;IACjB,MAAM,SAAS,WAAW,OAAO,CAAC,CAAC,SAAS;IAE5C,MAAM,0BAAU,IAAI,IAAoB;IAExC,MAAM,cADI,OAAO,MAAM,2BACH,CAAC,GAAG;IACxB,IAAI,aACF,KAAK,MAAM,KAAK,YAAY,SAAS,qCAAqC,GAAG;KAC3E,MAAM,UAAU,EAAE;KAClB,MAAM,YAAY,EAAE;KACpB,IAAI,WAAW,WAAW,QAAQ,IAAI,SAAS,SAAS;IAC1D;IAGF,KAAK,MAAM,MAAM,OAAO,SAAS,+BAA+B,GAAG;KACjE,MAAM,YAAY,GAAG;KACrB,IAAI,CAAC,WAAW;KAChB,KAAK,MAAM,KAAK,UAAU,SAAS,0CAA0C,GAAG;MAC9E,MAAM,KAAK,EAAE;MACb,IAAI,CAAC,IAAI;MACT,MAAM,YAAY,QAAQ,IAAI,EAAE;MAChC,MAAM,OAAO,YAAY,GAAG,UAAU,OAAO,GAAG,GAAG;MACnD,IAAI,CAAC,QAAQ,IAAI,IAAI,GACnB,YAAY,OAAO,qBACjB,IAAI,MACF,IAAI,KAAK,KAAK,UAAU,MAAM,uBAAuB,GAAG,IAAI,KAAK,mIACnE,CACF;KAEJ;IACF;GACF,CAAC;EACH,CAAC;CACH;AACF"}
package/dist/runtime/mf-config.cjs CHANGED
@@ -3,7 +3,7 @@ const require_shared_deps_spec = require('../shared-deps-spec.cjs');
3
3
  let node_fs = require("node:fs");
4
4
 
5
5
  //#region src/runtime/mf-config.ts
6
- const PLUGIN_VERSION = "3.0.0-rc.5";
6
+ const PLUGIN_VERSION = "3.0.0-rc.7";
7
7
  const MF_CORE_SHARED_DEPS = require_shared_deps_spec.buildMfCoreSharedDependencies({ ownVersion: PLUGIN_VERSION });
8
8
 
9
9
  //#endregion
package/dist/runtime/mf-config.mjs CHANGED
@@ -2,7 +2,7 @@ import { buildMfCoreSharedDependencies } from "../shared-deps-spec.mjs";
2
2
  import { readFileSync } from "node:fs";
3
3
 
4
4
  //#region src/runtime/mf-config.ts
5
- const PLUGIN_VERSION = "3.0.0-rc.5";
5
+ const PLUGIN_VERSION = "3.0.0-rc.7";
6
6
  const MF_CORE_SHARED_DEPS = buildMfCoreSharedDependencies({ ownVersion: PLUGIN_VERSION });
7
7
 
8
8
  //#endregion
package/dist/version-manifest.cjs CHANGED
@@ -36,7 +36,19 @@ const WorkspaceVersionManifestSchema = zod.z.object({
36
36
  * it and skip re-uploading unchanged files; readers that predate the field
37
37
  * ignore it (zod strips unknown keys). Participates in the version hash.
38
38
  */
39
- files: zod.z.record(zod.z.string(), SRI).optional()
39
+ files: zod.z.record(zod.z.string(), SRI).optional(),
40
+ /**
41
+ * Source archive of the workspace subtree (object path → served-object SRI)
42
+ * published beside the dists when the runtime opts in via
43
+ * `publish.sourcePublish` — lets `bos import` dereference a published
44
+ * config slot to the exact source bytes that build came from, with no
45
+ * GitHub dependency. Readers that predate the field ignore it (zod strips
46
+ * unknown keys). Participates in the version hash.
47
+ */
48
+ source: zod.z.object({
49
+ file: zod.z.string().min(1),
50
+ integrity: SRI
51
+ }).optional()
40
52
  });
41
53
  /**
42
54
  * Compose the manifest with its `version` derived from the canonical content
package/dist/version-manifest.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"version-manifest.cjs","names":["z","createHash"],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n version: z.string().regex(/^[0-9a-f]{16}$/),\n builtAt: z.string().optional(),\n gitSha: z.string().optional(),\n entry: z.string().min(1),\n entryIntegrity: SRI,\n ssr: z\n .object({\n entry: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n browserManifest: z\n .object({\n file: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n /** extra assets (css, icons) — logical name → served-object SRI */\n assets: z.record(z.string(), SRI).optional(),\n /** shared-dependency versions this build was built against */\n shared: z.record(z.string(), z.string()).optional(),\n /**\n * Full per-file digest map of the dist (object path → served-object SRI).\n * Written by `every-plugin`-based deploys so the next deploy can diff against\n * it and skip re-uploading unchanged files; readers that predate the field\n * ignore it (zod strips unknown keys). Participates in the version hash.\n */\n files: z.record(z.string(), SRI).optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\nexport interface VersionManifestInput {\n /** Omit: a per-build timestamp makes the same version id map to different\n * manifest bytes per machine, breaking the pin's SRI against the image's\n * staged copy and the CDN's immutability for republished versions. */\n builtAt?: string;\n gitSha?: string;\n entry: string;\n entryIntegrity: string;\n ssr?: { entry: string; integrity: string };\n browserManifest?: { file: string; integrity: string };\n assets?: Record<string, string>;\n shared?: Record<string, string>;\n files?: Record<string, string>;\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n const { builtAt: _builtAt, ...hashedInputs } = input;\n const version = createHash(\"sha256\")\n .update(stableStringify(hashedInputs))\n .digest(\"hex\")\n .slice(0, 16);\n return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n if (value && typeof value === \"object\") {\n return `{${Object.entries(value)\n .filter(([, v]) => v !== undefined)\n .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n .sort()\n .join(\",\")}}`;\n }\n return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,MAAMA,MAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiCA,MAAE,OAAO;CACrD,SAASA,MAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAASA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAKA,MACF,OAAO;EACN,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiBA,MACd,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAGA,MAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAOA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;AAC5C,CAAC;;;;;;;;AAyBD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,cAAUC,wBAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
1
+ {"version":3,"file":"version-manifest.cjs","names":["z","createHash"],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n version: z.string().regex(/^[0-9a-f]{16}$/),\n builtAt: z.string().optional(),\n gitSha: z.string().optional(),\n entry: z.string().min(1),\n entryIntegrity: SRI,\n ssr: z\n .object({\n entry: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n browserManifest: z\n .object({\n file: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n /** extra assets (css, icons) — logical name → served-object SRI */\n assets: z.record(z.string(), SRI).optional(),\n /** shared-dependency versions this build was built against */\n shared: z.record(z.string(), z.string()).optional(),\n /**\n * Full per-file digest map of the dist (object path → served-object SRI).\n * Written by `every-plugin`-based deploys so the next deploy can diff against\n * it and skip re-uploading unchanged files; readers that predate the field\n * ignore it (zod strips unknown keys). Participates in the version hash.\n */\n files: z.record(z.string(), SRI).optional(),\n /**\n * Source archive of the workspace subtree (object path → served-object SRI)\n * published beside the dists when the runtime opts in via\n * `publish.sourcePublish` — lets `bos import` dereference a published\n * config slot to the exact source bytes that build came from, with no\n * GitHub dependency. Readers that predate the field ignore it (zod strips\n * unknown keys). Participates in the version hash.\n */\n source: z\n .object({\n file: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n /** Omit: a per-build timestamp makes the same version id map to different\n * manifest bytes per machine, breaking the pin's SRI against the image's\n * staged copy and the CDN's immutability for republished versions. */\n builtAt?: string;\n gitSha?: string;\n entry: string;\n entryIntegrity: string;\n ssr?: { entry: string; integrity: string };\n browserManifest?: { file: string; integrity: string };\n assets?: Record<string, string>;\n shared?: Record<string, string>;\n files?: Record<string, string>;\n source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n const { builtAt: _builtAt, ...hashedInputs } = input;\n const version = createHash(\"sha256\")\n .update(stableStringify(hashedInputs))\n .digest(\"hex\")\n .slice(0, 16);\n return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n if (value && typeof value === \"object\") {\n return `{${Object.entries(value)\n .filter(([, v]) => v !== undefined)\n .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n .sort()\n .join(\",\")}}`;\n }\n return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;;AAYA,MAAM,MAAMA,MAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiCA,MAAE,OAAO;CACrD,SAASA,MAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAASA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQA,MAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAKA,MACF,OAAO;EACN,OAAOA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiBA,MACd,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQA,MAAE,OAAOA,MAAE,OAAO,GAAGA,MAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAOA,MAAE,OAAOA,MAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQA,MACL,OAAO;EACN,MAAMA,MAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;;;;;AA6BD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,cAAUC,wBAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
package/dist/version-manifest.d.cts CHANGED
@@ -17,8 +17,14 @@ declare const WorkspaceVersionManifestSchema: z.ZodObject<{
17
17
  assets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
18
18
  shared: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
19
19
  files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
20
+ source: z.ZodOptional<z.ZodObject<{
21
+ file: z.ZodString;
22
+ integrity: z.ZodString;
23
+ }, z.core.$strip>>;
20
24
  }, z.core.$strip>;
21
25
  type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;
26
+ /** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */
27
+ type SourceRef = NonNullable<WorkspaceVersionManifest["source"]>;
22
28
  interface VersionManifestInput {
23
29
  /** Omit: a per-build timestamp makes the same version id map to different
24
30
  * manifest bytes per machine, breaking the pin's SRI against the image's
@@ -38,6 +44,10 @@ interface VersionManifestInput {
38
44
  assets?: Record<string, string>;
39
45
  shared?: Record<string, string>;
40
46
  files?: Record<string, string>;
47
+ source?: {
48
+ file: string;
49
+ integrity: string;
50
+ };
41
51
  }
42
52
  /**
43
53
  * Compose the manifest with its `version` derived from the canonical content
@@ -48,5 +58,5 @@ interface VersionManifestInput {
48
58
  */
49
59
  declare function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest;
50
60
  //#endregion
51
- export { VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest };
61
+ export { SourceRef, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest };
52
62
  //# sourceMappingURL=version-manifest.d.cts.map
package/dist/version-manifest.d.cts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"version-manifest.d.cts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;cAca,gCAA8B,EAAA;;;;;;;;;;;;;;;;;GA6BzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;UAErC;;;;EAIf;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;;;;;;;;;iBAUM,uBAAuB,OAAO,uBAAuB"}
1
+ {"version":3,"file":"version-manifest.d.cts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;cAca,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;GA2CzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;KAG1C,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB"}
package/dist/version-manifest.d.mts CHANGED
@@ -17,8 +17,14 @@ declare const WorkspaceVersionManifestSchema: z.ZodObject<{
17
17
  assets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
18
18
  shared: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
19
19
  files: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
20
+ source: z.ZodOptional<z.ZodObject<{
21
+ file: z.ZodString;
22
+ integrity: z.ZodString;
23
+ }, z.core.$strip>>;
20
24
  }, z.core.$strip>;
21
25
  type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;
26
+ /** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */
27
+ type SourceRef = NonNullable<WorkspaceVersionManifest["source"]>;
22
28
  interface VersionManifestInput {
23
29
  /** Omit: a per-build timestamp makes the same version id map to different
24
30
  * manifest bytes per machine, breaking the pin's SRI against the image's
@@ -38,6 +44,10 @@ interface VersionManifestInput {
38
44
  assets?: Record<string, string>;
39
45
  shared?: Record<string, string>;
40
46
  files?: Record<string, string>;
47
+ source?: {
48
+ file: string;
49
+ integrity: string;
50
+ };
41
51
  }
42
52
  /**
43
53
  * Compose the manifest with its `version` derived from the canonical content
@@ -48,5 +58,5 @@ interface VersionManifestInput {
48
58
  */
49
59
  declare function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest;
50
60
  //#endregion
51
- export { VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest };
61
+ export { SourceRef, VersionManifestInput, WorkspaceVersionManifest, WorkspaceVersionManifestSchema, composeVersionManifest };
52
62
  //# sourceMappingURL=version-manifest.d.mts.map
package/dist/version-manifest.d.mts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"version-manifest.d.mts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;cAca,gCAA8B,EAAA;;;;;;;;;;;;;;;;;GA6BzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;UAErC;;;;EAIf;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;;;;;;;;;iBAUM,uBAAuB,OAAO,uBAAuB"}
1
+ {"version":3,"file":"version-manifest.d.mts","names":[],"sources":["../src/version-manifest.ts"],"mappings":";;cAca,gCAA8B,EAAA;;;;;;;;;;;;;;;;;;;;;GA2CzC,EAAA,KAAA;KACU,2BAA2B,EAAE,aAAa;;KAG1C,YAAY,YAAY;UAEnB;;;;EAIf;EACA;EACA;EACA;EACA;IAAQ;IAAe;;EACvB;IAAoB;IAAc;;EAClC,SAAS;EACT,SAAS;EACT,QAAQ;EACR;IAAW;IAAc;;;;;;;;;;iBAUX,uBAAuB,OAAO,uBAAuB"}
package/dist/version-manifest.mjs CHANGED
@@ -35,7 +35,19 @@ const WorkspaceVersionManifestSchema = z.object({
35
35
  * it and skip re-uploading unchanged files; readers that predate the field
36
36
  * ignore it (zod strips unknown keys). Participates in the version hash.
37
37
  */
38
- files: z.record(z.string(), SRI).optional()
38
+ files: z.record(z.string(), SRI).optional(),
39
+ /**
40
+ * Source archive of the workspace subtree (object path → served-object SRI)
41
+ * published beside the dists when the runtime opts in via
42
+ * `publish.sourcePublish` — lets `bos import` dereference a published
43
+ * config slot to the exact source bytes that build came from, with no
44
+ * GitHub dependency. Readers that predate the field ignore it (zod strips
45
+ * unknown keys). Participates in the version hash.
46
+ */
47
+ source: z.object({
48
+ file: z.string().min(1),
49
+ integrity: SRI
50
+ }).optional()
39
51
  });
40
52
  /**
41
53
  * Compose the manifest with its `version` derived from the canonical content
package/dist/version-manifest.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"version-manifest.mjs","names":[],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n version: z.string().regex(/^[0-9a-f]{16}$/),\n builtAt: z.string().optional(),\n gitSha: z.string().optional(),\n entry: z.string().min(1),\n entryIntegrity: SRI,\n ssr: z\n .object({\n entry: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n browserManifest: z\n .object({\n file: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n /** extra assets (css, icons) — logical name → served-object SRI */\n assets: z.record(z.string(), SRI).optional(),\n /** shared-dependency versions this build was built against */\n shared: z.record(z.string(), z.string()).optional(),\n /**\n * Full per-file digest map of the dist (object path → served-object SRI).\n * Written by `every-plugin`-based deploys so the next deploy can diff against\n * it and skip re-uploading unchanged files; readers that predate the field\n * ignore it (zod strips unknown keys). Participates in the version hash.\n */\n files: z.record(z.string(), SRI).optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\nexport interface VersionManifestInput {\n /** Omit: a per-build timestamp makes the same version id map to different\n * manifest bytes per machine, breaking the pin's SRI against the image's\n * staged copy and the CDN's immutability for republished versions. */\n builtAt?: string;\n gitSha?: string;\n entry: string;\n entryIntegrity: string;\n ssr?: { entry: string; integrity: string };\n browserManifest?: { file: string; integrity: string };\n assets?: Record<string, string>;\n shared?: Record<string, string>;\n files?: Record<string, string>;\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n const { builtAt: _builtAt, ...hashedInputs } = input;\n const version = createHash(\"sha256\")\n .update(stableStringify(hashedInputs))\n .digest(\"hex\")\n .slice(0, 16);\n return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n if (value && typeof value === \"object\") {\n return `{${Object.entries(value)\n .filter(([, v]) => v !== undefined)\n .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n .sort()\n .join(\",\")}}`;\n }\n return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiC,EAAE,OAAO;CACrD,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAK,EACF,OAAO;EACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiB,EACd,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;AAC5C,CAAC;;;;;;;;AAyBD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,UAAU,WAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
1
+ {"version":3,"file":"version-manifest.mjs","names":[],"sources":["../src/version-manifest.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { z } from \"zod\";\n\n/**\n * WorkspaceVersionManifest — the immutable per-deploy document at\n * `bundles/<account>/<gateway>/<workspace>/versions/<version>.json`\n * (ADR 0020, as amended; atomic-deploys MAP decision 1). The published\n * config's slot pins this document via its `pin` (`manifest` + the\n * manifest's own SRI); every artifact coordinate lives here, so the config\n * stops growing with artifact kinds and old versions stay fully servable.\n */\n\nconst SRI = z.string().regex(/^sha384-[A-Za-z0-9+/=]+$/);\n\nexport const WorkspaceVersionManifestSchema = z.object({\n version: z.string().regex(/^[0-9a-f]{16}$/),\n builtAt: z.string().optional(),\n gitSha: z.string().optional(),\n entry: z.string().min(1),\n entryIntegrity: SRI,\n ssr: z\n .object({\n entry: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n browserManifest: z\n .object({\n file: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n /** extra assets (css, icons) — logical name → served-object SRI */\n assets: z.record(z.string(), SRI).optional(),\n /** shared-dependency versions this build was built against */\n shared: z.record(z.string(), z.string()).optional(),\n /**\n * Full per-file digest map of the dist (object path → served-object SRI).\n * Written by `every-plugin`-based deploys so the next deploy can diff against\n * it and skip re-uploading unchanged files; readers that predate the field\n * ignore it (zod strips unknown keys). Participates in the version hash.\n */\n files: z.record(z.string(), SRI).optional(),\n /**\n * Source archive of the workspace subtree (object path → served-object SRI)\n * published beside the dists when the runtime opts in via\n * `publish.sourcePublish` — lets `bos import` dereference a published\n * config slot to the exact source bytes that build came from, with no\n * GitHub dependency. Readers that predate the field ignore it (zod strips\n * unknown keys). Participates in the version hash.\n */\n source: z\n .object({\n file: z.string().min(1),\n integrity: SRI,\n })\n .optional(),\n});\nexport type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;\n\n/** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */\nexport type SourceRef = NonNullable<WorkspaceVersionManifest[\"source\"]>;\n\nexport interface VersionManifestInput {\n /** Omit: a per-build timestamp makes the same version id map to different\n * manifest bytes per machine, breaking the pin's SRI against the image's\n * staged copy and the CDN's immutability for republished versions. */\n builtAt?: string;\n gitSha?: string;\n entry: string;\n entryIntegrity: string;\n ssr?: { entry: string; integrity: string };\n browserManifest?: { file: string; integrity: string };\n assets?: Record<string, string>;\n shared?: Record<string, string>;\n files?: Record<string, string>;\n source?: { file: string; integrity: string };\n}\n\n/**\n * Compose the manifest with its `version` derived from the canonical content\n * of the artifact coordinates alone (key-sorted, `builtAt` excluded) —\n * identical bytes → identical version id regardless of when they were built,\n * so republishing unchanged content is a pointer no-op. Any changed\n * coordinate → a new version (and a new file).\n */\nexport function composeVersionManifest(input: VersionManifestInput): WorkspaceVersionManifest {\n const { builtAt: _builtAt, ...hashedInputs } = input;\n const version = createHash(\"sha256\")\n .update(stableStringify(hashedInputs))\n .digest(\"hex\")\n .slice(0, 16);\n return WorkspaceVersionManifestSchema.parse({ ...input, version });\n}\n\nfunction stableStringify(value: unknown): string {\n if (Array.isArray(value)) return `[${value.map(stableStringify).join(\",\")}]`;\n if (value && typeof value === \"object\") {\n return `{${Object.entries(value)\n .filter(([, v]) => v !== undefined)\n .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`)\n .sort()\n .join(\",\")}}`;\n }\n return JSON.stringify(value) ?? \"null\";\n}\n"],"mappings":";;;;;;;;;;;;AAYA,MAAM,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,0BAA0B;AAEvD,MAAa,iCAAiC,EAAE,OAAO;CACrD,SAAS,EAAE,OAAO,CAAC,CAAC,MAAM,gBAAgB;CAC1C,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACvB,gBAAgB;CAChB,KAAK,EACF,OAAO;EACN,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACvB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;CACZ,iBAAiB,EACd,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;;CAEZ,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;CAE3C,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS;;;;;;;CAOlD,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC,SAAS;;;;;;;;;CAS1C,QAAQ,EACL,OAAO;EACN,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EACtB,WAAW;CACb,CAAC,CAAC,CACD,SAAS;AACd,CAAC;;;;;;;;AA6BD,SAAgB,uBAAuB,OAAuD;CAC5F,MAAM,EAAE,SAAS,UAAU,GAAG,iBAAiB;CAC/C,MAAM,UAAU,WAAW,QAAQ,CAAC,CACjC,OAAO,gBAAgB,YAAY,CAAC,CAAC,CACrC,OAAO,KAAK,CAAC,CACb,MAAM,GAAG,EAAE;CACd,OAAO,+BAA+B,MAAM;EAAE,GAAG;EAAO;CAAQ,CAAC;AACnE;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,IAAI,MAAM,IAAI,eAAe,CAAC,CAAC,KAAK,GAAG,EAAE;CAC1E,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,IAAI,OAAO,QAAQ,KAAK,CAAC,CAC7B,QAAQ,GAAG,OAAO,MAAM,MAAS,CAAC,CAClC,KAAK,CAAC,GAAG,OAAO,GAAG,KAAK,UAAU,CAAC,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAC7D,KAAK,CAAC,CACN,KAAK,GAAG,EAAE;CAEf,OAAO,KAAK,UAAU,KAAK,KAAK;AAClC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "every-plugin",
3
- "version": "3.0.0-rc.5",
3
+ "version": "3.0.0-rc.7",
4
4
  "type": "module",
5
5
  "publishConfig": {
6
6
  "access": "public"
package/skills/plugin-client/SKILL.md CHANGED
@@ -60,7 +60,8 @@ import { RPCLink } from "@orpc/client/fetch";
60
60
  const HOST = "https://dev.everything.dev";
61
61
 
62
62
  const link = new RPCLink({
63
- url: `${HOST}/api/rpc`,
63
+ origin: HOST,
64
+ url: "/api/rpc",
64
65
  fetch: globalThis.fetch,
65
66
  headers: {
66
67
  "x-api-key": process.env.EVERYTHING_DEV_API_KEY!,
@@ -70,6 +71,8 @@ const link = new RPCLink({
70
71
  const client = createORPCClient(link);
71
72
  ```
72
73
 
74
+ `RPCLink` takes `origin` plus a relative `url` — its `url` option is typed as `StandardUrl` (`/${string}`), so a concatenated absolute URL like `url: \`${HOST}/api/rpc\`` fails typechecking at the link boundary.
75
+
73
76
  ### URL Structure
74
77
 
75
78
  oRPC's RPC protocol encodes the procedure path in the URL segment after the RPC base:
@@ -114,7 +117,8 @@ Two credential mechanisms:
114
117
 
115
118
  ```ts
116
119
  const link = new RPCLink({
117
- url: `${HOST}/api/rpc`,
120
+ origin: HOST,
121
+ url: "/api/rpc",
118
122
  fetch: globalThis.fetch,
119
123
  headers: { "x-api-key": "edk_xxxxxxxxxxxxxxx" },
120
124
  });
@@ -124,7 +128,8 @@ const link = new RPCLink({
124
128
 
125
129
  ```ts
126
130
  const link = new RPCLink({
127
- url: `${HOST}/api/rpc`,
131
+ origin: HOST,
132
+ url: "/api/rpc",
128
133
  fetch: (url, options) => fetch(url, { ...options, credentials: "include" }),
129
134
  });
130
135
  ```
@@ -268,7 +273,8 @@ Pass the key in the `x-api-key` header:
268
273
 
269
274
  ```ts
270
275
  const link = new RPCLink({
271
- url: `${HOST}/api/rpc`,
276
+ origin: HOST,
277
+ url: "/api/rpc",
272
278
  fetch: globalThis.fetch,
273
279
  headers: { "x-api-key": "edk_xxxxxxxxxxxxxxx" },
274
280
  });
package/skills/plugin-testing/SKILL.md CHANGED
@@ -225,6 +225,7 @@ export default defineConfig({
225
225
  - Forgetting `vite-tsconfig-paths` plugin — package subpath imports like `every-plugin/errors` won't resolve
226
226
  - Omitting the `registry` object when calling `createPluginRuntime(...)` — the runtime requires explicit plugin entries
227
227
  - Testing only happy paths — always test error channels (Effect failures, ORPCError throws)
228
+ - Asserting errors by message from a client call — oRPC v2 does not transport undefined-error messages, so message-based assertions are brittle. Match on `error.code` instead: `await expect(client.getById({ id: "x" })).rejects.toMatchObject({ code: "NOT_FOUND" })`.
228
229
 
229
230
  ## The tasks you will actually be given
230
231
 
package/src/build/rspack/chunk-completeness-plugin.ts CHANGED
@@ -28,20 +28,29 @@ export class ChunkCompletenessPlugin implements RspackPluginInstance {
28
28
  if (!entry) return;
29
29
 
30
30
  const jsFiles = new Set(names.filter((n) => n.endsWith(".js")));
31
- const source = assets[entry].source().toString();
31
+ const entryAsset = assets[entry];
32
+ if (!entryAsset) return;
33
+ const source = entryAsset.source().toString();
32
34
 
33
35
  const special = new Map<string, string>();
34
36
  const u = source.match(/\.u\s*=\s*(\w+)=>([^,;]+)/);
35
- if (u) {
36
- for (const m of u[2].matchAll(/(\d+)\s*===\s*\w+\s*\?\s*"([^"]+)"/g)) {
37
- special.set(m[1], m[2]);
37
+ const uExpression = u?.[2];
38
+ if (uExpression) {
39
+ for (const m of uExpression.matchAll(/(\d+)\s*===\s*\w+\s*\?\s*"([^"]+)"/g)) {
40
+ const chunkId = m[1];
41
+ const chunkName = m[2];
42
+ if (chunkId && chunkName) special.set(chunkId, chunkName);
38
43
  }
39
44
  }
40
45
 
41
46
  for (const pa of source.matchAll(/Promise\.all\(\[([^\]]*)\]\)/g)) {
42
- for (const m of pa[1].matchAll(/(?:__webpack_require__|\w+)\.e\((\d+)\)/g)) {
47
+ const eagerList = pa[1];
48
+ if (!eagerList) continue;
49
+ for (const m of eagerList.matchAll(/(?:__webpack_require__|\w+)\.e\((\d+)\)/g)) {
43
50
  const id = m[1];
44
- const file = special.has(id) ? `${special.get(id)}.js` : `${id}.js`;
51
+ if (!id) continue;
52
+ const chunkName = special.get(id);
53
+ const file = chunkName ? `${chunkName}.js` : `${id}.js`;
45
54
  if (!jsFiles.has(file)) {
46
55
  compilation.errors.push(
47
56
  new Error(
package/src/version-manifest.ts CHANGED
@@ -41,9 +41,26 @@ export const WorkspaceVersionManifestSchema = z.object({
41
41
  * ignore it (zod strips unknown keys). Participates in the version hash.
42
42
  */
43
43
  files: z.record(z.string(), SRI).optional(),
44
+ /**
45
+ * Source archive of the workspace subtree (object path → served-object SRI)
46
+ * published beside the dists when the runtime opts in via
47
+ * `publish.sourcePublish` — lets `bos import` dereference a published
48
+ * config slot to the exact source bytes that build came from, with no
49
+ * GitHub dependency. Readers that predate the field ignore it (zod strips
50
+ * unknown keys). Participates in the version hash.
51
+ */
52
+ source: z
53
+ .object({
54
+ file: z.string().min(1),
55
+ integrity: SRI,
56
+ })
57
+ .optional(),
44
58
  });
45
59
  export type WorkspaceVersionManifest = z.infer<typeof WorkspaceVersionManifestSchema>;
46
60
 
61
+ /** A published-artifact coordinate: object path within the bundle namespace + its served SRI. */
62
+ export type SourceRef = NonNullable<WorkspaceVersionManifest["source"]>;
63
+
47
64
  export interface VersionManifestInput {
48
65
  /** Omit: a per-build timestamp makes the same version id map to different
49
66
  * manifest bytes per machine, breaking the pin's SRI against the image's
@@ -57,6 +74,7 @@ export interface VersionManifestInput {
57
74
  assets?: Record<string, string>;
58
75
  shared?: Record<string, string>;
59
76
  files?: Record<string, string>;
77
+ source?: { file: string; integrity: string };
60
78
  }
61
79
 
62
80
  /**