Fix sdk root imports in file-secrets and keychain plugins

.changeset/fix-plugin-sdk-root-imports.md

@@ -0,0 +1,6 @@
+---
+"@executor-js/plugin-file-secrets": patch
+"@executor-js/plugin-keychain": patch
+---
+
+Import plugin-authoring symbols from `@executor-js/sdk/core` instead of the package root. The published root is the Promise surface and does not export `StorageError`, `definePlugin`, `PluginCtx`, or `Plugin`, so both packages failed to load when installed from npm.

packages/plugins/file-secrets/src/index.ts

@@ -9,7 +9,7 @@ import {
   ProviderKey,
   StorageError,
   type CredentialProvider,
-} from "@executor-js/sdk";
+} from "@executor-js/sdk/core";
 
 // ---------------------------------------------------------------------------
 // Auth file location

packages/plugins/file-secrets/src/promise.ts

@@ -1,4 +1,4 @@
-import { type Plugin } from "@executor-js/sdk";
+import { type Plugin } from "@executor-js/sdk/core";
 
 import {
   fileSecretsPlugin as fileSecretsPluginEffect,
@@ -9,7 +9,7 @@ import {
 export type { FileSecretsPluginConfig } from "./index";
 
 // Explicit return type so the emitted dist/promise.d.ts references
-// `import("@executor-js/sdk").Plugin` rather than the Promise-surface
+// `import("@executor-js/sdk/core").Plugin` rather than the Promise-surface
 // root specifier (which doesn't re-export Plugin).
 export const fileSecretsPlugin = (
   config?: FileSecretsPluginConfig,

packages/plugins/keychain/src/index.ts

@@ -1,6 +1,6 @@
 import { Effect } from "effect";
 
-import { definePlugin, type CredentialProvider, type PluginCtx } from "@executor-js/sdk";
+import { definePlugin, type CredentialProvider, type PluginCtx } from "@executor-js/sdk/core";
 
 import {
   deletePassword,

packages/plugins/keychain/src/promise.ts

@@ -1,4 +1,4 @@
-import { type Plugin } from "@executor-js/sdk";
+import { type Plugin } from "@executor-js/sdk/core";
 
 import {
   keychainPlugin as keychainPluginEffect,
@@ -9,7 +9,7 @@ import {
 export type { KeychainPluginConfig } from "./index";
 
 // Explicit return type so the emitted dist/promise.d.ts references
-// `import("@executor-js/sdk").Plugin` rather than the Promise-surface
+// `import("@executor-js/sdk/core").Plugin` rather than the Promise-surface
 // root specifier (which doesn't re-export Plugin).
 export const keychainPlugin = (
   config?: KeychainPluginConfig,

packages/plugins/keychain/src/provider.ts

@@ -5,7 +5,7 @@ import {
   ProviderKey,
   type CredentialProvider,
   type ProviderItemId,
-} from "@executor-js/sdk";
+} from "@executor-js/sdk/core";
 
 import type { KeychainError } from "./errors";
 import { getPassword, setPassword, deletePassword } from "./keyring";

scripts/smoke-test-packed.ts

@@ -78,6 +78,13 @@ type SmokeFailure = {
 
 const PRIVATE_PACKAGE_RE = /Cannot find package '(@executor-js\/[^']+)'/;
 
+// `import { X } from "@executor-js/sdk"` where the published entry doesn't
+// export `X` — the packed bundle references a symbol that only exists on a
+// different subpath (or in the dev-time workspace view). This is a bundle
+// bug, never a missing-peer environment issue, so it's a hard failure.
+const MISSING_EXPORT_RE =
+  /The requested module '([^']+)' does not provide an export named '([^']+)'/;
+
 const firstMeaningfulLine = (stderr: string): string => {
   const lines = stderr
     .split("\n")
@@ -182,6 +189,17 @@ const smokeTestPackage = async (
         console.log(`  FAIL ${spec} — references private '${offending}'`);
         continue;
       }
+      const missingExportMatch = stderr.match(MISSING_EXPORT_RE);
+      if (missingExportMatch) {
+        const [, module, symbol] = missingExportMatch;
+        failures.push({
+          pkg: pkg.name,
+          subpath,
+          reason: `published '${module}' does not export '${symbol}'`,
+        });
+        console.log(`  FAIL ${spec} — '${module}' does not export '${symbol}'`);
+        continue;
+      }
       const peerMatch =
         stderr.match(/Cannot find package '([^']+)'/) ??
         stderr.match(/Cannot find module '([^']+)'/);