Plugin SDK: preserve secret input runtime build

scripts/check-plugin-sdk-exports.mjs

@@ -10,7 +10,7 @@
 
 import { readFileSync, existsSync } from "node:fs";
 import { resolve, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { pluginSdkSubpaths } from "./lib/plugin-sdk-entries.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -42,6 +42,16 @@ const exportedNames = exportMatch[1]
 const exportSet = new Set(exportedNames);
 
 const requiredRuntimeShimEntries = ["compat.js", "root-alias.cjs"];
+const requiredSubpathExports = {
+  "secret-input-runtime": [
+    "coerceSecretRef",
+    "hasConfiguredSecretInput",
+    "isSecretRef",
+    "normalizeResolvedSecretInputString",
+    "normalizeSecretInputString",
+    "resolveSecretInputString",
+  ],
+};
 
 // The root plugin-sdk entry intentionally stays tiny. Keep this list aligned
 // with src/plugin-sdk/index.ts runtime exports.
@@ -81,6 +91,28 @@ for (const entry of requiredRuntimeShimEntries) {
   }
 }
 
+for (const [entry, names] of Object.entries(requiredSubpathExports)) {
+  const jsPath = resolve(__dirname, "..", "dist", "plugin-sdk", `${entry}.js`);
+  if (!existsSync(jsPath)) {
+    continue;
+  }
+  let runtime;
+  try {
+    runtime = await import(pathToFileURL(jsPath).href);
+  } catch (err) {
+    console.error(`BROKEN SUBPATH JS: dist/plugin-sdk/${entry}.js`);
+    console.error(err instanceof Error ? err.message : String(err));
+    missing += 1;
+    continue;
+  }
+  for (const name of names) {
+    if (typeof runtime[name] !== "function") {
+      console.error(`MISSING SUBPATH EXPORT: dist/plugin-sdk/${entry}.js#${name}`);
+      missing += 1;
+    }
+  }
+}
+
 if (missing > 0) {
   console.error(
     `\nERROR: ${missing} required plugin-sdk artifact(s) missing (named exports or subpath files).`,

scripts/write-plugin-sdk-entry-dts.ts

@@ -3,14 +3,6 @@ import path from "node:path";
 import { pluginSdkEntrypoints } from "./lib/plugin-sdk-entries.mjs";
 
 const RUNTIME_SHIMS: Partial<Record<string, string>> = {
-  "secret-input-runtime": [
-    "export {",
-    "  hasConfiguredSecretInput,",
-    "  normalizeResolvedSecretInputString,",
-    "  normalizeSecretInputString,",
-    '} from "./config-runtime.js";',
-    "",
-  ].join("\n"),
   "webhook-path": [
     "/** Normalize webhook paths into the canonical registry form used by route lookup. */",
     "export function normalizeWebhookPath(raw) {",
@@ -45,17 +37,6 @@ const RUNTIME_SHIMS: Partial<Record<string, string>> = {
   ].join("\n"),
 };
 
-const TYPE_SHIMS: Partial<Record<string, string>> = {
-  "secret-input-runtime": [
-    "export {",
-    "  hasConfiguredSecretInput,",
-    "  normalizeResolvedSecretInputString,",
-    "  normalizeSecretInputString,",
-    '} from "./config-runtime.js";',
-    "",
-  ].join("\n"),
-};
-
 // `tsc` emits declarations under `dist/plugin-sdk/src/plugin-sdk/*` because the source lives
 // at `src/plugin-sdk/*` and `rootDir` is `.` (repo root, to support cross-src/extensions refs).
 //
@@ -64,11 +45,7 @@ const TYPE_SHIMS: Partial<Record<string, string>> = {
 for (const entry of pluginSdkEntrypoints) {
   const typeOut = path.join(process.cwd(), `dist/plugin-sdk/${entry}.d.ts`);
   fs.mkdirSync(path.dirname(typeOut), { recursive: true });
-  fs.writeFileSync(
-    typeOut,
-    TYPE_SHIMS[entry] ?? `export * from "./src/plugin-sdk/${entry}.js";\n`,
-    "utf8",
-  );
+  fs.writeFileSync(typeOut, `export * from "./src/plugin-sdk/${entry}.js";\n`, "utf8");
 
   const packageTypeOut = path.join(
     process.cwd(),