@plannotator/ui 0.38.0 does not install into a consumer: config/settings.ts
imports @plannotator/core/token-hover (#1462), but that PR added the export
to core without bumping it, so 0.38.0 pins core 0.25.1, which never
published the subpath. Every host reaches it through configure -> config ->
settings, so typecheck and build fail on the first import.
core 0.25.2 publishes ./token-hover plus the other changes core accumulated
since 0.25.1 (the rotated guide-viewer-manifest pin, the config-types hover
fields). ui 0.38.1 is 0.38.0 pinning core 0.25.2, and aligns
@codemirror/state to ^6.7.2 beside @codemirror/view ^6.43.10 so a consumer
cannot resolve two state copies.
The package smoke passed on 0.38.0 because its external consumer installs
core from the LOCAL tarball (pnpm override), so an export that exists in
source but not on the registry is invisible to it, and its consumer entry
never imported the configure/config path. It now (1) collects every
@plannotator/core/<subpath> the UI source imports and asserts each is an
export of the core source manifest, (2) when the pinned core version is
already on the registry, asserts each is exported by THAT published core
and that the core source exports match it exactly (otherwise: bump core and
publish it first), printing a publish-core-first reminder when the pinned
version is not published yet, and (3) compiles @plannotator/ui/configure
and @plannotator/ui/config in the external consumer's vite build and tsc.
With the pins set back to 0.38.0's, the smoke now fails naming token-hover.
HANDOFF and README: current pair 0.38.1 on 0.25.2; do not consume 0.38.0.
Opt-in bridgeScriptUrl on HtmlViewer so multi-chunk hosts can serve the 185 KB bridge as a hashed asset instead of an inlined string; the inline bridge stays the default and Plannotator's own builds, the Pi and OpenCode copies, and the live-app proxy are unchanged apart from a protocolVersion field on the bridge's ready message. The parent checks the version (one warning naming both versions; on the URL path a dismissible banner plus onBridgeUnavailable while the old bridge keeps working), arms a ready timeout on the URL path only, and resolves the URL against the parent document before it reaches the frame so a page's own base href cannot redirect the load. A prepack-generated bridge-script.asset.js (byte-for-byte the inline string) and a bridge-script.lite.ts alias target ship in the tarball. CSP and CORP requirements for hosts are documented.
AI-assisted (Claude) under maintainer direction.
Michael Ramos