From 607a1df203eebbb8cd03eae53f6734d0af7c824e Mon Sep 17 00:00:00 2001
From: Rhys Sullivan <39114868+RhysSullivan@users.noreply.github.com>
Date: Fri, 28 Aug 2026 23:43:44 -0700
Subject: [PATCH] Import plugin-authoring symbols from sdk/core in file-secrets
 and keychain

---
 .changeset/fix-plugin-sdk-root-imports.md    |  6 ++++++
 packages/plugins/file-secrets/src/index.ts   |  2 +-
 packages/plugins/file-secrets/src/promise.ts |  4 ++--
 packages/plugins/keychain/src/index.ts       |  2 +-
 packages/plugins/keychain/src/promise.ts     |  4 ++--
 packages/plugins/keychain/src/provider.ts    |  2 +-
 scripts/smoke-test-packed.ts                 | 18 ++++++++++++++++++
 7 files changed, 31 insertions(+), 7 deletions(-)
 create mode 100644 .changeset/fix-plugin-sdk-root-imports.md

diff --git a/.changeset/fix-plugin-sdk-root-imports.md b/.changeset/fix-plugin-sdk-root-imports.md
new file mode 100644
index 0000000000..5128923b7b
--- /dev/null
+++ b/.changeset/fix-plugin-sdk-root-imports.md
@@ -0,0 +1,6 @@
+---
+"@executor-js/plugin-file-secrets": patch
+"@executor-js/plugin-keychain": patch
+---
+
+Import plugin-authoring symbols from `@executor-js/sdk/core` instead of the package root. The published root is the Promise surface and does not export `StorageError`, `definePlugin`, `PluginCtx`, or `Plugin`, so both packages failed to load when installed from npm.
diff --git a/packages/plugins/file-secrets/src/index.ts b/packages/plugins/file-secrets/src/index.ts
index 7b3015286d..e1f2242c78 100644
--- a/packages/plugins/file-secrets/src/index.ts
+++ b/packages/plugins/file-secrets/src/index.ts
@@ -9,7 +9,7 @@ import {
   ProviderKey,
   StorageError,
   type CredentialProvider,
-} from "@executor-js/sdk";
+} from "@executor-js/sdk/core";
 
 // ---------------------------------------------------------------------------
 // Auth file location
diff --git a/packages/plugins/file-secrets/src/promise.ts b/packages/plugins/file-secrets/src/promise.ts
index b51a595868..e40ae99f8e 100644
--- a/packages/plugins/file-secrets/src/promise.ts
+++ b/packages/plugins/file-secrets/src/promise.ts
@@ -1,4 +1,4 @@
-import { type Plugin } from "@executor-js/sdk";
+import { type Plugin } from "@executor-js/sdk/core";
 
 import {
   fileSecretsPlugin as fileSecretsPluginEffect,
@@ -9,7 +9,7 @@ import {
 export type { FileSecretsPluginConfig } from "./index";
 
 // Explicit return type so the emitted dist/promise.d.ts references
-// `import("@executor-js/sdk").Plugin` rather than the Promise-surface
+// `import("@executor-js/sdk/core").Plugin` rather than the Promise-surface
 // root specifier (which doesn't re-export Plugin).
 export const fileSecretsPlugin = (
   config?: FileSecretsPluginConfig,
diff --git a/packages/plugins/keychain/src/index.ts b/packages/plugins/keychain/src/index.ts
index f75cb695be..d5a7312f9a 100644
--- a/packages/plugins/keychain/src/index.ts
+++ b/packages/plugins/keychain/src/index.ts
@@ -1,6 +1,6 @@
 import { Effect } from "effect";
 
-import { definePlugin, type CredentialProvider, type PluginCtx } from "@executor-js/sdk";
+import { definePlugin, type CredentialProvider, type PluginCtx } from "@executor-js/sdk/core";
 
 import {
   deletePassword,
diff --git a/packages/plugins/keychain/src/promise.ts b/packages/plugins/keychain/src/promise.ts
index d9032e371f..935386d6a0 100644
--- a/packages/plugins/keychain/src/promise.ts
+++ b/packages/plugins/keychain/src/promise.ts
@@ -1,4 +1,4 @@
-import { type Plugin } from "@executor-js/sdk";
+import { type Plugin } from "@executor-js/sdk/core";
 
 import {
   keychainPlugin as keychainPluginEffect,
@@ -9,7 +9,7 @@ import {
 export type { KeychainPluginConfig } from "./index";
 
 // Explicit return type so the emitted dist/promise.d.ts references
-// `import("@executor-js/sdk").Plugin` rather than the Promise-surface
+// `import("@executor-js/sdk/core").Plugin` rather than the Promise-surface
 // root specifier (which doesn't re-export Plugin).
 export const keychainPlugin = (
   config?: KeychainPluginConfig,
diff --git a/packages/plugins/keychain/src/provider.ts b/packages/plugins/keychain/src/provider.ts
index e72de55e38..723e9c2a14 100644
--- a/packages/plugins/keychain/src/provider.ts
+++ b/packages/plugins/keychain/src/provider.ts
@@ -5,7 +5,7 @@ import {
   ProviderKey,
   type CredentialProvider,
   type ProviderItemId,
-} from "@executor-js/sdk";
+} from "@executor-js/sdk/core";
 
 import type { KeychainError } from "./errors";
 import { getPassword, setPassword, deletePassword } from "./keyring";
diff --git a/scripts/smoke-test-packed.ts b/scripts/smoke-test-packed.ts
index 4b87c603ec..4273e2c4e3 100644
--- a/scripts/smoke-test-packed.ts
+++ b/scripts/smoke-test-packed.ts
@@ -78,6 +78,13 @@ type SmokeFailure = {
 
 const PRIVATE_PACKAGE_RE = /Cannot find package '(@executor-js\/[^']+)'/;
 
+// `import { X } from "@executor-js/sdk"` where the published entry doesn't
+// export `X` — the packed bundle references a symbol that only exists on a
+// different subpath (or in the dev-time workspace view). This is a bundle
+// bug, never a missing-peer environment issue, so it's a hard failure.
+const MISSING_EXPORT_RE =
+  /The requested module '([^']+)' does not provide an export named '([^']+)'/;
+
 const firstMeaningfulLine = (stderr: string): string => {
   const lines = stderr
     .split("\n")
@@ -182,6 +189,17 @@ const smokeTestPackage = async (
         console.log(`  FAIL ${spec} — references private '${offending}'`);
         continue;
       }
+      const missingExportMatch = stderr.match(MISSING_EXPORT_RE);
+      if (missingExportMatch) {
+        const [, module, symbol] = missingExportMatch;
+        failures.push({
+          pkg: pkg.name,
+          subpath,
+          reason: `published '${module}' does not export '${symbol}'`,
+        });
+        console.log(`  FAIL ${spec} — '${module}' does not export '${symbol}'`);
+        continue;
+      }
       const peerMatch =
         stderr.match(/Cannot find package '([^']+)'/) ??
         stderr.match(/Cannot find module '([^']+)'/);