[drietsch]

What

Adopts the plugin-SDK module door (plugin-sdk ADR 326, paged-media/plugin-sdk#11) for both engine wasm files, feature-detected so it runs unchanged on the currently published SDK (0.2.45+ peer) and today's editor.

• src/module-door.ts: inline probe hostedWasm(host, name) — supports("modules@1") + host.modules.resolve; every failure → null (load bin/). Not imported from plugin-sdk because resolveWasm exists only from 0.2.51 and would be a missing export on older editors.
• data engine (bootEngine → initEngineGlue): wasm-bindgen init({ module_or_path: fetch(url, { integrity }) }) with the host's copy; any failure → init() on the glue's own bin/data_js_bg.wasm.
• DuckDB (bootDuckDB({ resolveWasm, onFallback })): the engine wasm URL comes from the host. It is pre-fetched once with its integrity (preflightHostedWasm) — a 404 / CORS refusal / digest mismatch falls back to bin/ (DuckDB's worker hangs on a missing module rather than rejecting; found by the browser lane), and a good pre-fetch warms the HTTP cache the worker's own fetch reads (module host serves immutable). A failed hosted instantiate retries once from bin/ with a fresh worker. The worker script and JS API stay in bin/, same-origin — the D-05 comment is rewritten honestly: no cross-origin Worker, no CDN/third-party; the first-party module host is allowed for the wasm fetch; SRI cannot reach DuckDB's own fetch (the pre-fetch verifies the same immutable URL). Extensions still load from bin/duckdb-ext/.
• session.ts passes wasmResolver(host) and logs fallbacks via host.log.warn.
• publish.yml: paged-plugin integrity stamps sha384 into the published manifest (after package-hash --stamp, before the build that inlines manifest.json — never committed), and paged-plugin modules-upload hosts the wasm at modules.paged.media/@paged-media/data/<version>/bin/… after npm publish (skips cleanly without CLOUDFLARE_API_TOKEN). Both via npx @paged-media/plugin-cli@0.1.6 → needs plugin-sdk#11 merged + published first.
• Version 0.1.0-canary.14 (canary.13 is on main/npm); docs (CLAUDE.md, architecture.md, status.md).

Tests

• src/__tests__/module-door.test.ts (10): probe on old/unwired/refusing/throwing hosts, glue init with integrity / URL-only / fallback / no door, DuckDB pre-fetch pass + 404 + integrity failure.
• Browser lane (test/duckdb-browser.spec.ts, real Chromium): a second cross-origin server stands in for the module host (brotli Content-Encoding, application/wasm, CORS *; CSP connect-src lists it as the editor's does). DuckDB instantiates from it while the worker comes from bin/; a missing host module falls back to bin/; the data engine loads from it with its sha384 and a wrong digest is refused.
• REQUIRE_REAL_ENGINE=1 REQUIRE_REAL_DUCKDB=1 REQUIRE_REAL_CORE=1 REQUIRE_REAL_BROWSER=1 vitest run: 58 files / 387 passed, 2 skipped. pnpm typecheck && pnpm test green; contract-import lint clean; package-hash --check ok (new version).
• New CLI against this bundle: validate ok; integrity stamps 4/4 and validates; modules-upload --dry-run names the 4 keys.

Release order

plugin-sdk#11 (plugin-cli 0.1.6 must be on npm before this publish runs) → this → editor pins.

🤖 Generated with Claude Code