From 9b833a084ce327b44a36d5978f03011a397f92d4 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 6 Sep 2026 05:50:56 +0000 Subject: [PATCH] fix(core): PHASE2_IMPLEMENTATION.md imports from the root barrel, not an undeclared subpath MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `packages/core/PHASE2_IMPLEMENTATION.md` sections 4 and 5 told readers to write `import { … } from '@objectstack/core/security'`. `packages/core/package.json` declares exactly two `exports` entries, `.` and `./logger`, with no `./security` and no wildcard, so that specifier resolves for no consumer of the published package. Measured live at this head: ERR_PACKAGE_PATH_NOT_EXPORTED - Package subpath './security' is not defined by "exports" in packages/core/package.json with `@objectstack/core/logger` resolving on the same command as the control. Both classes are real and both are exported from the ROOT barrel, reached by `export * from './security/index.js'` in `packages/core/src/index.ts`. So the symbols exist and only the path is wrong. Both lines now name `@objectstack/core`. Verified against the built root entry that the repaired specifier is true: `PluginPermissionManager` and `PluginSandboxRuntime` are both declared in `dist/index.d.ts` and both load from `dist/index.cjs`, with the retired `PluginSecurityScanner` absent as the negative control and `PluginHealthMonitor` present as the positive one. No contract change: `packages/core/package.json` is untouched. Adding a `./security` entry would widen the published surface on no evidence of demand and remains the maintainer's call. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ --- packages/core/PHASE2_IMPLEMENTATION.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/core/PHASE2_IMPLEMENTATION.md b/packages/core/PHASE2_IMPLEMENTATION.md index d1456cfd76..9f4fb1b897 100644 --- a/packages/core/PHASE2_IMPLEMENTATION.md +++ b/packages/core/PHASE2_IMPLEMENTATION.md @@ -158,7 +158,7 @@ The Permission Manager enforces fine-grained access control for plugins. **Usage:** ```typescript -import { PluginPermissionManager } from '@objectstack/core/security'; +import { PluginPermissionManager } from '@objectstack/core'; const permManager = new PluginPermissionManager(logger); @@ -216,7 +216,7 @@ The Sandbox Runtime provides isolated execution environments with resource limit **Usage:** ```typescript -import { PluginSandboxRuntime } from '@objectstack/core/security'; +import { PluginSandboxRuntime } from '@objectstack/core'; const sandbox = new PluginSandboxRuntime(logger);