Frontend extensions: serve plugin web/ as ES modules + import map composition + SRI

[tayebmokni]

Summary

Serve plugin frontend ES modules under the host import map. Each plugins web/ directory is served at /_plugins/{slug}/{version}/... with cache-forever headers. Core admin/site responses include an import map containing entries for @host/sdk, host-provided react, and @plugin/{slug} for each active plugin. SRI hashes are included in script tags.

Design reference

• docs/02-plugin-system.md §7.1, §7.6

Acceptance criteria

• HTTP handler: GET /_plugins/{slug}/{version}/{path...} serves files from the activated plugins web/ directory; Cache-Control: public, max-age=31536000, immutable
• Path traversal protection (no .. or absolute paths)
• Per-plugin assets served from web/assets/ with appropriate Content-Type sniffing
• @host/sdk served at /_host/sdk-{version}.js; bundled separately, content-hashed in URL
• React + ReactDOM served at /_host/react-{version}.js and /_host/react-dom-{version}.js (single host copy used by all plugins per §7.2)
• Core admin/site renderer injects <script type="importmap"> with entries for @host/sdk, react, react-dom, and @plugin/{slug} for each active plugin
• Each plugin script tag carries integrity="sha384-..." SRI hash computed at install
• Frontend SDK loader code: await import(p.entry) for each host.activePlugins, then host.boot()
• On a public site page render, the import map only includes plugins the page actually uses (computed from block tree per §7.5)
• Tests: import map composed correctly per active plugin set; SRI hash matches served file; cache headers correct; path traversal rejected

Dependencies

#45 (lifecycle)

Complexity

M

[tayebmokni]

Closing — shipped in the final-wave PR (#487-#492). Auto-close only fires for first ref.