mnfst 0.5.80 → 0.5.82

package/lib/manifest.data.js

@@ -12,7 +12,9 @@ async function ensureManifest() {
     try {
         const manifestUrl = (document.querySelector('link[rel="manifest"]')?.getAttribute('href')) || '/manifest.json';
         const response = await fetch(manifestUrl);
-        return await response.json();
+        const manifest = await response.json();
+        interpolateManifest(manifest);
+        return manifest;
     } catch (error) {
         console.error('[Manifest Data] Failed to load manifest:', error);
         return null;
@@ -36,6 +38,33 @@ function interpolateEnvVars(str) {
     });
 }
 
+// Recursively walk a manifest object and interpolate every string value in
+// place. Object keys are left untouched. Called once at manifest-load time so
+// downstream consumers (auth, data, appwrite) read already-resolved values.
+function interpolateManifest(obj) {
+    if (obj === null || typeof obj !== 'object') return obj;
+    if (Array.isArray(obj)) {
+        for (let i = 0; i < obj.length; i++) {
+            const v = obj[i];
+            if (typeof v === 'string') {
+                obj[i] = interpolateEnvVars(v);
+            } else if (v !== null && typeof v === 'object') {
+                interpolateManifest(v);
+            }
+        }
+        return obj;
+    }
+    for (const key of Object.keys(obj)) {
+        const v = obj[key];
+        if (typeof v === 'string') {
+            obj[key] = interpolateEnvVars(v);
+        } else if (v !== null && typeof v === 'object') {
+            interpolateManifest(v);
+        }
+    }
+    return obj;
+}
+
 // Helper to get nested value from object
 function getNestedValue(obj, path) {
     return path.split('.').reduce((current, key) => {
@@ -179,6 +208,7 @@ function getQueries(dataSource) {
 window.ManifestDataConfig = {
     ensureManifest,
     interpolateEnvVars,
+    interpolateManifest,
     getNestedValue,
     getDefaultLocale,
     parseContentPath,
@@ -1202,6 +1232,13 @@ window.ManifestDataStore = {
 
 /* Manifest Data Sources - File Loaders */
 
+// Key names that would walk into Object's prototype chain if used as nested-
+// path segments. Rejecting them in setNestedValue and deepMergeWithFallback
+// prevents a CSV row like `__proto__.polluted, true` (or a malicious JSON
+// locale file containing `{"__proto__": {...}}`) from polluting
+// Object.prototype and silently affecting every plain object on the page.
+const POLLUTING_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+
 // Dynamic js-yaml loader
 let jsyaml = null;
 let yamlLoadingPromise = null;
@@ -1336,6 +1373,7 @@ function deepMergeWithFallback(currentData, fallbackData) {
         !Array.isArray(currentData) && !Array.isArray(fallbackData)) {
         const merged = { ...fallbackData };
         for (const key in currentData) {
+            if (POLLUTING_KEYS.has(key)) continue;
             if (key.startsWith('_')) {
                 // Preserve metadata from current locale
                 merged[key] = currentData[key];
@@ -1363,6 +1401,9 @@ function deepMergeWithFallback(currentData, fallbackData) {
 // Numeric path segments (e.g. cards.0.title) create real arrays so x-for="card in $x....cards" works.
 function setNestedValue(obj, path, value) {
     const keys = path.split('.');
+    // Drop the whole row if any segment would walk into the prototype chain.
+    // `foo.constructor.prototype.polluted` is just as dangerous as `__proto__.polluted`.
+    if (keys.some(k => POLLUTING_KEYS.has(k))) return;
     let current = obj;
 
     for (let i = 0; i < keys.length - 1; i++) {
@@ -11813,7 +11854,10 @@ async function initializeDataSourcesPlugin() {
                 const manifestData = manifest;
                 // Remove internal properties that shouldn't be exposed
                 const { data, appwrite, components, preloadedComponents, ...publicManifest } = manifestData;
-                updateStore('manifest', publicManifest);
+                // allowDuringInit: setIsInitializing(true) is active, so without this
+                // flag updateStore short-circuits and $x.manifest stays unpopulated.
+                window.ManifestDataStore.dataSourceCache.set(`manifest:${locale}`, publicManifest);
+                updateStore('manifest', publicManifest, { loading: false, error: null, ready: true, allowDuringInit: true });
 
                 const store = Alpine.store('data');
                 Alpine.store('data', {

package/lib/manifest.dialog.css

@@ -41,8 +41,8 @@
         min-height: 200px;
         max-height: 90vh;
         margin: auto;
-        color: var(--color-content-stark, oklch(16.6% 0.026 267));
-        background-color: var(--color-popover-surface, oklch(100% 0 0));
+        color: var(--color-content-stark, darkslategray);
+        background-color: var(--color-popover-surface, white);
         border: 0 none;
         border-radius: calc(var(--radius, 0.5rem) * 2);
         box-shadow: 0 20px 25px -5px rgb(0 0 0 / 0.1), 0 8px 10px -6px rgb(0 0 0 / 0.1);

package/lib/manifest.divider.css

@@ -12,7 +12,7 @@
         margin: var(--spacing-field-padding, 0.625rem) 0;
         white-space: nowrap;
         font-size: 0.875rem;
-        color: var(--color-content-neutral, oklch(48.26% 0.0365 255.09));
+        color: var(--color-content-neutral, gray);
 
         /* Lines before and after content */
         &:before,
@@ -22,7 +22,7 @@
             flex: 1;
             width: auto;
             height: 1px;
-            background-color: var(--color-line, oklch(48.3% 0.006422 17.4 / 0.15))
+            background-color: var(--color-line, color-mix(darkslategray 10%, transparent))
         }
 
         /* Space between lines and content */

package/lib/manifest.dropdown.css

@@ -45,7 +45,7 @@
         padding: 0.25rem;
         z-index: 50;
         list-style: none;
-        background: var(--color-popover-surface, oklch(100% 0 0));
+        background: var(--color-popover-surface, white);
         border: 0 none;
         border-radius: var(--radius, 0.5rem);
         box-shadow: rgba(15, 15, 15, 0.05) 0px 0px 0px 1px, rgba(15, 15, 15, 0.1) 0px 3px 6px, rgba(15, 15, 15, 0.2) 0px 9px 24px;
@@ -63,7 +63,7 @@
             padding-inline-start: 0.5rem;
             padding-inline-end: 0.5rem;
             font-weight: normal;
-            color: var(--color-content-stark, oklch(16.6% 0.026 267));
+            color: var(--color-content-stark, darkslategray);
             text-align: start;
             text-decoration: none;
             text-overflow: ellipsis;
@@ -75,14 +75,14 @@
             user-select: none;
 
             &:hover {
-                color: var(--color-field-inverse, oklch(16.6% 0.026 267));
+                color: var(--color-field-inverse, darkslategray);
                 text-decoration: inherit;
-                background-color: var(--color-field-surface, oklch(91.79% 0.0029 264.26));
+                background-color: var(--color-field-surface, color-mix(darkslategray 10%, transparent));
             }
 
             &:active {
-                color: var(--color-field-inverse, oklch(16.6% 0.026 267));
-                background-color: var(--color-field-surface, oklch(91.79% 0.0029 264.26));
+                color: var(--color-field-inverse, darkslategray);
+                background-color: var(--color-field-surface, color-mix(darkslategray 10%, transparent));
             }
 
             & span,
@@ -99,7 +99,7 @@
         /* Titles */
         & small {
             padding: 0.25rem 0.5rem;
-            color: var(--color-content-neutral, oklch(48.26% 0.0365 255.09));
+            color: var(--color-content-neutral, gray);
         }
 
         /* Horizontal rules (offset to ignore menu padding) */
@@ -109,7 +109,7 @@
             margin-inline-start: calc(0.25rem * -1);
             margin-top: 0.25rem;
             margin-bottom: 0.25rem;
-            background-color: var(--color-line, oklch(48.3% 0.006422 17.4 / 0.15));
+            background-color: var(--color-line, color-mix(darkslategray 10%, transparent));
         }
 
         /* Labels */
@@ -146,7 +146,7 @@
 
     /* Dark theme */
     :where(.dark menu[popover]) :where(li, a, button, label):hover {
-        background-color: var(--color-field-surface-hover, oklch(89.24% 0.0024 12.48));
+        background-color: var(--color-field-surface-hover, color-mix(darkslategray 15%, transparent));
     }
 
     /* Nested menu alignment */

package/lib/manifest.form.css

@@ -47,7 +47,7 @@
     :where(form):not(.unstyle) {
         display: flex;
         flex-direction: column;
-        gap: calc(var(--spacing) * 4);
+        gap: calc(var(--spacing, 0.25rem) * 4);
         width: 100%
     }
 
@@ -55,25 +55,25 @@
     :where(fieldset):not(.unstyle) {
         display: flex;
         flex-direction: column;
-        gap: 0.375ch calc(var(--spacing) * 2);
+        gap: 0.375ch calc(var(--spacing, 0.25rem) * 2);
         width: 100%;
 
         &:has([type=radio], [type=checkbox]) {
-            gap: calc(var(--spacing) * 2);
+            gap: calc(var(--spacing, 0.25rem) * 2);
         }
     }
 
     :where(fieldset:has(legend)):not(.unstyle) {
         padding: 1ch 1.5ch 1.5ch 1.5ch;
         border-radius: var(--radius, 0.5rem);
-        border-color: var(--color-line, oklch(48.3% 0.006422 17.4 / 0.15));
+        border-color: var(--color-line, color-mix(darkslategray 10%, transparent));
         border-style: solid;
         border-width: 1px;
 
         & :where(legend) {
             padding: 0 1.5ch;
             font-size: 0.875rem;
-            color: var(--color-content-subtle, oklch(67.4% 0.0318 251.27));
+            color: var(--color-content-subtle, darkgray);
         }
     }
 
@@ -97,7 +97,7 @@
         flex-direction: column;
         gap: 0.2ch;
         width: 100%;
-        text-indent: calc(var(--radius) / 2);
+        text-indent: calc(var(--radius, 0.5rem) / 2);
         cursor: pointer;
 
         /* Prevent text indentation of bare label text nodes from being inherited */
@@ -107,7 +107,7 @@
 
         /* Indent label text in spans */
         :where(span:first-of-type) {
-            padding-inline-start: calc(var(--radius) / 2)
+            padding-inline-start: calc(var(--radius, 0.5rem) / 2)
         }
 
         :where(button, [role=button], [type=button], [type=submit], select, input:not([role=button], [type=checkbox], [type=radio], [type=file], [type=search]), textarea) {
@@ -136,13 +136,13 @@
 
         /* Size buttons and inputs */
         & :where(.label, button, input:not([type=checkbox], [type=radio]), select, textarea) {
-            width: calc(var(--spacing-field-height) * 8);
+            width: calc(var(--spacing-field-height, 2.25rem) * 8);
             max-width: 50%;
         }
 
         /* Focus state for .label wrapper for search and file inputs */
         & .label:focus-within {
-            box-shadow: 0 0 0 2px color-mix(in oklch, var(--color-content-stark) 35%, transparent)
+            box-shadow: 0 0 0 2px color-mix(in oklch, var(--color-content-stark, darkslategray) 35%, transparent)
         }
 
         /* Align textarea label to top */
@@ -150,7 +150,7 @@
             align-items: start;
 
             :where(data) {
-                padding-top: calc(var(--spacing))
+                padding-top: calc(var(--spacing, 0.25rem))
             }
         }
     }

package/lib/manifest.input.css

@@ -5,8 +5,8 @@
     :where(input:not([type=range], [type=color]), textarea, label:has([type=search], [type=file]), .label:has([type=search], [type=file])):not(.unstyle) {
         width: 100%;
         max-width: 100%;
-        color: var(--color-field-inverse, oklch(16.6% 0.026 267));
-        background-color: var(--color-field-surface, oklch(91.79% 0.0029 264.26));
+        color: var(--color-field-inverse, darkslategray);
+        background-color: var(--color-field-surface, color-mix(darkslategray 10%, transparent));
         border-width: 0;
         border-style: solid;
         border-color: transparent;
@@ -16,23 +16,23 @@
         appearance: none;
 
         &:hover {
-            background-color: var(--color-field-surface-hover, oklch(89.24% 0.0024 12.48))
+            background-color: var(--color-field-surface-hover, color-mix(darkslategray 15%, transparent))
         }
 
         &:active {
-            background-color: var(--color-field-surface-hover, oklch(89.24% 0.0024 12.48))
+            background-color: var(--color-field-surface-hover, color-mix(darkslategray 15%, transparent))
         }
 
         &:focus-visible {
-            background-color: var(--color-field-surface, oklch(91.79% 0.0029 264.26))
+            background-color: var(--color-field-surface, color-mix(darkslategray 10%, transparent))
         }
 
         &::placeholder {
-            color: color-mix(in oklch, var(--color-field-inverse, oklch(16.6% 0.026 267)) 65%, transparent)
+            color: color-mix(in oklch, var(--color-field-inverse, darkslategray) 65%, transparent)
         }
 
         &::selection {
-            background-color: color-mix(in oklch, var(--color-field-surface, oklch(91.79% 0.0029 264.26)) 80%, var(--color-field-inverse, oklch(16.6% 0.026 267)))
+            background-color: color-mix(in oklch, var(--color-field-surface, color-mix(darkslategray 10%, transparent)) 80%, var(--color-field-inverse, darkslategray))
         }
 
         &[type=file] {
@@ -91,7 +91,7 @@
     /* Additional styles for label with file input */
     :where(label, .label):has([type=file]):not(.unstyle) {
         justify-content: center;
-        gap: var(--spacing, 0.5rem);
+        gap: var(--spacing, 0.25rem);
         height: var(--spacing-field-height, 2.25rem);
         cursor: pointer
     }
@@ -108,7 +108,7 @@
             width: var(--spacing-field-height, 2.25rem);
             height: 100%;
             margin-inline-end: 0;
-            color: var(--color-content-subtle, oklch(67.4% 0.0318 251.27))
+            color: var(--color-content-subtle, darkgray)
         }
     }
 

package/lib/manifest.integrity.json

@@ -0,0 +1,26 @@
+{
+  "manifest.appwrite.auth.js": "sha384-to37ssZJXGeOS6+rf2VI47ox2mEqgsi5oQ1E5vv8XU/lDspbDFE1KHEMm8TxBhxW",
+  "manifest.appwrite.data.js": "sha384-00ulLT+GAIuPHA/rRT9p98vYlsyDzkyKXtg86BDQ6FGQa5vVVN+W6kuforniBAsz",
+  "manifest.appwrite.presence.js": "sha384-uxRpx9/Jj0kGtklH5QmUlAzD3zdSvFRfK6bcJQqxl+Bsf5tOo4zgwqJTQgtZoHQP",
+  "manifest.code.js": "sha384-7u03iKpTAimcMkf82glkELWzwDWRmlB9iYOC9tJ40gPH1QwyzdtFWA3OaSScJsFM",
+  "manifest.color.js": "sha384-Z9G/lzt0vVMxjz4wkPuGG1X9mmQAJR15aOoGX3ephf7r2wnlUWet5GLgkUMtT4vt",
+  "manifest.colorpicker.js": "sha384-0EVn+Ha06h7FIvOxc6WjZYnKYXzi+zba08yKvczSEGTRkWRxyKN2TFrZHI1SDCXu",
+  "manifest.colors.js": "sha384-u8iD6kapVj4OjeCILxBkYQKgXtDQ7LdEodILkQuknzPMwzSMBmDHN25UuzxepHby",
+  "manifest.components.js": "sha384-3dCTD5EwCZTiX+1obYtDNM3WWwPh2JDQUQQsdRUUK3gs6FXjse1ShkKaT/2jsNaI",
+  "manifest.data.js": "sha384-+wfMPBlMsmLJ7EJWGJMTKGAhLaLCyOVX+Nq+ps3Lly58QC9Dp3XRHK5yangII0yq",
+  "manifest.dropdowns.js": "sha384-WMrFoSpKfJuo81dyrwhVrDO8rq+rDwh2x8x4nH01BY5ZHkvjE+/SaT2gWCI0zOn+",
+  "manifest.icons.js": "sha384-uOkboYrovjCpl22eey3Jaxpey+pOnot5NDnRRumcRxiR7IOVaRh1i20gYnWXR5dW",
+  "manifest.localization.js": "sha384-eKdBIMEAwsugPP2p2fuPzQUkU44f1+Y0JgukMJ1KXLQY1/AYvpcGsEiritVDElsN",
+  "manifest.markdown.js": "sha384-5dpYLup1j/JLmoVvE1Qn47rwYwtU6kH2PvuiNzU1nqa0LMRWZhdnKhKO7I3I0cyI",
+  "manifest.resize.js": "sha384-Ak5gf44ERfh9pOSAD1qZzJSysslpwBCkevIlz7R3dszTUyzUKGKGF4pn5arOtgG0",
+  "manifest.router.js": "sha384-n6xmIfWnYzd/0kkVTFuHhFzHuxiDgZ1Lg1W0yB6/w3Myw5pQ6PgE6SJBHfVsO7/D",
+  "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
+  "manifest.svg.js": "sha384-nc+3spSGNS2l+82maL/OFz2iOGUhLZ0kqeooj28CEcdElM4OZa34e0tbnokZHVI6",
+  "manifest.tabs.js": "sha384-v6Ti0zHfdLhkFHbTMg0FH6uMrThuBvZrL2PQgVBeeXhDjuN7x4MtoNWogPbAQTaD",
+  "manifest.tailwind.js": "sha384-aHLvl2oSuUgy06VaBqhhByn5wWxqvnqxw6KCwehakKUS00F/s/Nb62umeASS6Y4P",
+  "manifest.toasts.js": "sha384-ytd5rDbax/Ou9z23uedFXPZbxDPsk2E/pxCTq4WLvfv+os1qTI6kELp0kPp07g24",
+  "manifest.tooltips.js": "sha384-Hhip5ZN66xhDw3m0XBrKLKLpcVRz3Z9RszPKqo6xvFF0mrUgQBVZ+mZjZsXgOOjS",
+  "manifest.url.parameters.js": "sha384-FIufiClqDx1rJpU/QUc9z/D43qClQ6Qm8rBahipbJl9BDHUvhrOsUDegmTWW7Tuf",
+  "manifest.utilities.js": "sha384-Q98oZClq/iRKFmuwHolisLgEitsTZiEPHxUW29liKlnL1Gx+YGq8MMivYbDlGDD6",
+  "manifest.js": "sha384-M0y6toAEVWcozOx0D6eVdOiYOgF4f3nJyNmvfvh+/sr8gcMiugytOIC9FZ22NC8H"
+}

package/lib/manifest.js

@@ -175,6 +175,41 @@
 	const DEFAULT_VERSION = 'latest';
 	const ALPINE_CDN_URL = 'https://cdn.jsdelivr.net/npm/alpinejs@3/dist/cdn.min.js';
 
+	// SRI integrity map: { 'manifest.foo.min.js': 'sha384-...', ... }
+	// Inlined by build.mjs's emitIntegrityMap() step. Empty in source so the
+	// unbuilt loader works in dev (where files are served from the local
+	// project, same-origin, no SRI needed). Built artifact in lib/ carries
+	// the populated map. Looked up by the filename suffix of every script URL
+	// addScript() injects — when the file is in the map, the matching
+	// integrity + crossorigin attributes are set, and the browser refuses to
+	// execute the script if the bytes don't match (defends against CDN
+	// poisoning / npm hijack).
+	const INTEGRITY = {
+  "manifest.appwrite.auth.js": "sha384-to37ssZJXGeOS6+rf2VI47ox2mEqgsi5oQ1E5vv8XU/lDspbDFE1KHEMm8TxBhxW",
+  "manifest.appwrite.data.js": "sha384-00ulLT+GAIuPHA/rRT9p98vYlsyDzkyKXtg86BDQ6FGQa5vVVN+W6kuforniBAsz",
+  "manifest.appwrite.presence.js": "sha384-uxRpx9/Jj0kGtklH5QmUlAzD3zdSvFRfK6bcJQqxl+Bsf5tOo4zgwqJTQgtZoHQP",
+  "manifest.code.js": "sha384-7u03iKpTAimcMkf82glkELWzwDWRmlB9iYOC9tJ40gPH1QwyzdtFWA3OaSScJsFM",
+  "manifest.color.js": "sha384-Z9G/lzt0vVMxjz4wkPuGG1X9mmQAJR15aOoGX3ephf7r2wnlUWet5GLgkUMtT4vt",
+  "manifest.colorpicker.js": "sha384-0EVn+Ha06h7FIvOxc6WjZYnKYXzi+zba08yKvczSEGTRkWRxyKN2TFrZHI1SDCXu",
+  "manifest.colors.js": "sha384-u8iD6kapVj4OjeCILxBkYQKgXtDQ7LdEodILkQuknzPMwzSMBmDHN25UuzxepHby",
+  "manifest.components.js": "sha384-3dCTD5EwCZTiX+1obYtDNM3WWwPh2JDQUQQsdRUUK3gs6FXjse1ShkKaT/2jsNaI",
+  "manifest.data.js": "sha384-+wfMPBlMsmLJ7EJWGJMTKGAhLaLCyOVX+Nq+ps3Lly58QC9Dp3XRHK5yangII0yq",
+  "manifest.dropdowns.js": "sha384-WMrFoSpKfJuo81dyrwhVrDO8rq+rDwh2x8x4nH01BY5ZHkvjE+/SaT2gWCI0zOn+",
+  "manifest.icons.js": "sha384-uOkboYrovjCpl22eey3Jaxpey+pOnot5NDnRRumcRxiR7IOVaRh1i20gYnWXR5dW",
+  "manifest.localization.js": "sha384-eKdBIMEAwsugPP2p2fuPzQUkU44f1+Y0JgukMJ1KXLQY1/AYvpcGsEiritVDElsN",
+  "manifest.markdown.js": "sha384-5dpYLup1j/JLmoVvE1Qn47rwYwtU6kH2PvuiNzU1nqa0LMRWZhdnKhKO7I3I0cyI",
+  "manifest.resize.js": "sha384-Ak5gf44ERfh9pOSAD1qZzJSysslpwBCkevIlz7R3dszTUyzUKGKGF4pn5arOtgG0",
+  "manifest.router.js": "sha384-n6xmIfWnYzd/0kkVTFuHhFzHuxiDgZ1Lg1W0yB6/w3Myw5pQ6PgE6SJBHfVsO7/D",
+  "manifest.slides.js": "sha384-3uRTkyK9XPLmnxI2+igZlpi4EyPlU/7IHj5j3BZJJ2KN455vXyk99fiXV3feO/XY",
+  "manifest.svg.js": "sha384-nc+3spSGNS2l+82maL/OFz2iOGUhLZ0kqeooj28CEcdElM4OZa34e0tbnokZHVI6",
+  "manifest.tabs.js": "sha384-v6Ti0zHfdLhkFHbTMg0FH6uMrThuBvZrL2PQgVBeeXhDjuN7x4MtoNWogPbAQTaD",
+  "manifest.tailwind.js": "sha384-aHLvl2oSuUgy06VaBqhhByn5wWxqvnqxw6KCwehakKUS00F/s/Nb62umeASS6Y4P",
+  "manifest.toasts.js": "sha384-ytd5rDbax/Ou9z23uedFXPZbxDPsk2E/pxCTq4WLvfv+os1qTI6kELp0kPp07g24",
+  "manifest.tooltips.js": "sha384-Hhip5ZN66xhDw3m0XBrKLKLpcVRz3Z9RszPKqo6xvFF0mrUgQBVZ+mZjZsXgOOjS",
+  "manifest.url.parameters.js": "sha384-FIufiClqDx1rJpU/QUc9z/D43qClQ6Qm8rBahipbJl9BDHUvhrOsUDegmTWW7Tuf",
+  "manifest.utilities.js": "sha384-Q98oZClq/iRKFmuwHolisLgEitsTZiEPHxUW29liKlnL1Gx+YGq8MMivYbDlGDD6"
+};
+
 	// Get base URL for a given version
 	function getBaseUrl(version = DEFAULT_VERSION) {
 		return `https://cdn.jsdelivr.net/npm/mnfst@${version}/lib`;
@@ -199,9 +234,7 @@
 		'slides',
 		'resize',
 		'colorpicker',
-		'url-parameters',
-		'virtual',
-		'export'
+		'url-parameters'
 	];
 
 	// Appwrite integration plugins (opt-in only, never auto-loaded)
@@ -211,10 +244,16 @@
 		'appwrite-presence'
 	];
 
-	// Plugin dependencies: plugins that require other plugins to be loaded first
+	// Plugin dependencies: plugins that require other plugins to be loaded first.
+	// All Appwrite plugins depend on `data` for env-var interpolation at
+	// manifest-load time (window.ManifestDataConfig.interpolateManifest); auth
+	// and presence also share the data plugin's manifest-fetch plumbing.
+	// Localization reads data-source URLs that may carry ${VAR} references.
 	const PLUGIN_DEPENDENCIES = {
+		'appwrite-auth': ['data'],
 		'appwrite-data': ['data'],
-		'appwrite-presence': ['data']
+		'appwrite-presence': ['data'],
+		'localization': ['data']
 	};
 
 	// Derive default plugin list from manifest (only load data/localization/components when manifest needs them)
@@ -315,6 +354,15 @@
 			const script = document.createElement('script');
 			script.src = url;
 			script.async = false; // Ensure scripts execute in order
+			// Apply SRI when the file is in the inlined integrity map. The map
+			// keys files by basename, so it works whether the URL points at
+			// jsDelivr or a user-configured pluginBase mirror — as long as the
+			// served bytes match what this loader version was built against.
+			const fileName = url.split('/').pop().split('?')[0];
+			if (INTEGRITY[fileName]) {
+				script.integrity = INTEGRITY[fileName];
+				script.crossOrigin = 'anonymous';
+			}
 			script.onload = () => resolve();
 			script.onerror = () => reject(new Error(`Failed to load ${pluginName} from ${url}`));
 			document.head.appendChild(script);
@@ -522,6 +570,13 @@
 				manifest = await manifestPromise;
 			}
 			if (manifest && typeof window !== 'undefined') {
+				// Resolve ${VAR} env-var references once, at the canonical load
+				// point, so downstream plugins (auth, data, appwrite) read
+				// already-interpolated values instead of each handling env-var
+				// substitution themselves.
+				if (window.ManifestDataConfig?.interpolateManifest) {
+					window.ManifestDataConfig.interpolateManifest(manifest);
+				}
 				window.__manifestLoaded = manifest;
 				if (window.ManifestComponentsRegistry) {
 					window.ManifestComponentsRegistry.manifest = manifest;