Let a plugin carry its own package.json and npm dependencies #75

Merged

lilleman merged 6 commits from plugin-dependencies into main 2026-08-18 18:36:13 +02:00

Conversation 0 Commits 6 Files Changed 31

+242 -71

lilleman commented 2026-08-17 22:23:59 +02:00

Owner

Copy Link

Copy Source

A plugin folder may now hold its own package.json, lockfile and node_modules. Installing a plugin is still just getting its folder to /app/plugins/<id>; nothing about its dependencies touches the host's.

The author barrel ships as the @plainpages/plugin-api package, linked into /node_modules above every plugin scope, replacing the #plugin-api subpath import — a subpath import resolves against the nearest package.json, so it could not survive a plugin owning one. The link keeps it a single instance, which instanceof GuardError across a plugin boundary depends on.

Discovery refuses a plugin whose package.json omits "type": "module" (npm writes none, and the CommonJS default breaks a .js helper and re-parses every .ts), and no longer treats a stray plugins/node_modules as a plugin.

A plugin folder may now hold its own `package.json`, lockfile and `node_modules`. Installing a plugin is still just getting its folder to `/app/plugins/<id>`; nothing about its dependencies touches the host's. The author barrel ships as the `@plainpages/plugin-api` package, linked into `/node_modules` above every plugin scope, replacing the `#plugin-api` subpath import — a subpath import resolves against the nearest `package.json`, so it could not survive a plugin owning one. The link keeps it a single instance, which `instanceof GuardError` across a plugin boundary depends on. Discovery refuses a plugin whose `package.json` omits `"type": "module"` (npm writes none, and the CommonJS default breaks a .js helper and re-parses every .ts), and no longer treats a stray `plugins/node_modules` as a plugin.

lilleman added 1 commit 2026-08-17 22:24:00 +02:00

Let a plugin carry its own package.json and npm dependencies fee4fe632b

lilleman added 1 commit 2026-08-17 22:34:56 +02:00

Refuse a shadowing barrel copy, and record the packaging contract 616040fda6

lilleman added 1 commit 2026-08-17 22:50:28 +02:00

Fail loud on a null package.json and a stray plugins/package.json 77343e859a

lilleman added 1 commit 2026-08-18 07:49:50 +02:00

Follow symlinked plugin folders, and keep a plugin .npmrc out of the image 3f9787df48

lilleman added 1 commit 2026-08-18 08:14:20 +02:00

Refuse a node_modules at the plugins/ root, where it outranks the host's 7d1f7750d3

lilleman marked the pull request as ready for review 2026-08-18 08:17:27 +02:00

lilleman added 1 commit 2026-08-18 18:33:27 +02:00

Merge branch 'main' into plugin-dependencies f992cb6b2c

lilleman scheduled this pull request to auto merge when all checks succeed 2026-08-18 18:33:29 +02:00

lilleman merged commit f992cb6b2c into main 2026-08-18 18:36:13 +02:00

lilleman deleted branch plugin-dependencies 2026-08-18 18:36:13 +02:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

claes.eismar.se lilleman (Lilleman auf Larv) martin.siden renovate-bot

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: larvit/plainpages#75