fix(compose): the compose manifest resolves through the pin's version directory (#826)

The boot SSR compose read manifest.gen.json from the mutable slot root
while the composition engine loaded pinned hashed bytes — the same
generation skew #826 fixed for plugin chunks, surfacing as
ComposeDigestMismatchError (the parity guard refusing to serve). Dir-based
pins now stamp a pin-resolved manifestUrl so the compose manifest reads
from the same frozen directory as the entry and chunks; legacy pins keep
the slot-root fixed name (their manifestIntegrity SRI check still guards
it).

Author: elliotBraem

host/src/services/ui-compose.ts

@@ -116,7 +116,7 @@ export function uiSources(config: RuntimeConfig): UiSource[] {
       manifestUrl:
         config.ui.source === "local"
           ? undefined
-          : `${config.ui.url.replace(/\/$/, "")}/${MANIFEST_FILENAME}`,
+          : (config.ui.manifestUrl ?? `${config.ui.url.replace(/\/$/, "")}/${MANIFEST_FILENAME}`),
       manifestIntegrity: config.ui.manifestIntegrity,
       browserManifestUrl: coreUrls.browserManifest,
       uiEntry: coreUrls.ui,
@@ -146,7 +146,11 @@ export function uiSources(config: RuntimeConfig): UiSource[] {
       localRoot: ui.localPath ? resolveLocalRoot(ui.localPath) : undefined,
       // Remote sources publish their manifest at a known URL; local remotes are
       // read straight from the workspace (src/manifest.gen.json) — no URL.
-      manifestUrl: ui.url ? `${ui.url.replace(/\/$/, "")}/${MANIFEST_FILENAME}` : undefined,
+      // Pinned remotes resolve it through the immutable version directory
+      // (#826); the slot-root fixed name is the legacy fallback.
+      manifestUrl: ui.url
+        ? (ui.manifestUrl ?? `${ui.url.replace(/\/$/, "")}/${MANIFEST_FILENAME}`)
+        : undefined,
       manifestIntegrity: ui.manifestIntegrity,
       browserManifestUrl: urls.browserManifest,
       uiEntry: urls.ui,

host/tests/integration/ui-compose.test.ts

@@ -228,6 +228,21 @@ describe("uiSources", () => {
     };
     expect(uiSources(config).map((source) => source.key)).toEqual(["ui"]);
   });
+
+  it("prefers the pin-resolved compose manifest URL over the slot-root fixed name (#826)", () => {
+    const config = configWithPlugin();
+    config.ui.manifestUrl =
+      "https://cdn.example.com/base-ui/versions/0123456789abcdef/manifest.gen.json";
+    config.plugins!.auth!.ui!.manifestUrl =
+      "https://cdn.example.com/auth-ui/versions/0123456789abcdef/manifest.gen.json";
+    const sources = uiSources(config);
+    expect(sources.find((source) => source.key === "ui")?.manifestUrl).toBe(
+      "https://cdn.example.com/base-ui/versions/0123456789abcdef/manifest.gen.json",
+    );
+    expect(sources.find((source) => source.key === "auth")?.manifestUrl).toBe(
+      "https://cdn.example.com/auth-ui/versions/0123456789abcdef/manifest.gen.json",
+    );
+  });
 });
 
 describe("composeUi", () => {

packages/everything-dev/src/services/deploy/version-manifest.ts

@@ -92,6 +92,8 @@ export function composeWorkspaceVersionManifest(input: {
  */
 
 export interface ResolvedRemoteVersion {
+  /** The remote's production base (slot root — unprefixed by the version dir). */
+  base: string;
   /** Absolute URL of the content-hashed container entry. */
   entryUrl: string;
   entryIntegrity: string;
@@ -137,6 +139,7 @@ function remoteVersionFromManifest(
   const fileBase =
     manifest.dir && !options?.ignoreDir ? `${trimmedBase}/${manifest.dir}` : trimmedBase;
   return {
+    base: trimmedBase,
     entryUrl: `${fileBase}/${manifest.entry}`,
     entryIntegrity: manifest.entryIntegrity,
     ...(manifest.dir ? { dir: manifest.dir } : {}),

packages/everything-dev/src/services/resolution/runtime.ts

@@ -404,6 +404,13 @@ async function deriveVersionManifestFields(
     ui.ssrEntryUrl = r.ssrEntryUrl;
     ui.ssrIntegrity = r.ssrIntegrity ?? ui.ssrIntegrity;
     ui.manifestIntegrity = r.files?.[MANIFEST_FILENAME] ?? ui.manifestIntegrity;
+    // The compose manifest rides the pin's immutable version directory (#826)
+    // — reading the fixed name at the mutable slot root re-introduces the
+    // generation skew the parity check exists to catch. Legacy pins (no dir)
+    // leave it unset: the compose falls back to the slot root.
+    if (r.dir) {
+      ui.manifestUrl = `${r.base.replace(/\/$/, "")}/${r.dir}/${MANIFEST_FILENAME}`;
+    }
     ui.sharedVersions = r.sharedVersions;
   };
 

packages/everything-dev/src/types.ts

@@ -151,6 +151,10 @@ const PluginRuntimeUiSchema = z.object({
    * manifest against it so a host resolving an older pin never silently
    * mixes newer manifest bytes into its composed tree */
   manifestIntegrity: z.string().optional(),
+  /** The compose manifest URL resolved through the pin's immutable version
+   * directory (#826) — absent for local slots and legacy pins, which read
+   * the fixed name at the slot root */
+  manifestUrl: z.string().optional(),
   /** Shared-singleton `name → version` the pinned build embedded (#546) —
    * the host's composition guard cross-compares it across UI sources before
    * loading, so a platform skew fails with a named error instead of the
@@ -456,6 +460,9 @@ export const RuntimeConfigSchema = z.object({
     /** SRI of the pinned compose manifest (manifest.gen.json) — verified by
      * the host compose on every fetch (see PluginRuntimeUiSchema) */
     manifestIntegrity: z.string().optional(),
+    /** The compose manifest URL resolved through the pin's immutable version
+     * directory (#826) — see PluginRuntimeUiSchema */
+    manifestUrl: z.string().optional(),
     /** Shared-singleton `name → version` the pinned build embedded (#546) —
      * see PluginRuntimeUiSchema; mirrors the runtime slot type */
     sharedVersions: z.record(z.string(), z.string()).optional(),

packages/everything-dev/tests/unit/version-manifest-deploy.test.ts

@@ -1,5 +1,9 @@
+import { createHash } from "node:crypto";
 import { describe, expect, it } from "vitest";
-import { composeWorkspaceVersionManifest } from "../../src/services/deploy/version-manifest";
+import {
+  composeWorkspaceVersionManifest,
+  resolveRemoteVersion,
+} from "../../src/services/deploy/version-manifest";
 
 const webReport = {
   entry: "remoteEntry.cf712c39e56dc37f.js",
@@ -148,3 +152,55 @@ describe("composeWorkspaceVersionManifest", () => {
     expect(same.version).toBe(manifest.version);
   });
 });
+
+describe("resolveRemoteVersion — version directory resolution (#826)", () => {
+  const base = "https://cdn.test/bundles/a.test/gw.test/ui/";
+  const manifestBody = JSON.stringify({
+    version: "8f3ac1d2feedbeef",
+    entry: "remoteEntry.83ba437f70018e7d.js",
+    entryIntegrity: "sha384-entry",
+    dir: "versions/0123456789abcdef",
+    files: { "manifest.gen.json": "sha384-compose" },
+  });
+  const digest = {
+    manifest: "versions/8f3ac1d2feedbeef.json",
+    integrity: `sha384-${createHash("sha384").update(manifestBody).digest("base64")}`,
+  };
+
+  it("resolves artifact coordinates through the version directory and exposes base + dir", async () => {
+    const fetchImpl = async (input: string | URL | Request): Promise<Response> => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      return url.endsWith("versions/8f3ac1d2feedbeef.json")
+        ? new Response(manifestBody, { status: 200 })
+        : new Response("not found", { status: 404 });
+    };
+    const resolved = await resolveRemoteVersion({ base, digest, fetchImpl });
+    expect(resolved.base).toBe(base.replace(/\/$/, ""));
+    expect(resolved.dir).toBe("versions/0123456789abcdef");
+    expect(resolved.entryUrl).toBe(
+      `${base}versions/0123456789abcdef/remoteEntry.83ba437f70018e7d.js`,
+    );
+  });
+
+  it("a legacy manifest (no dir) resolves against the slot root", async () => {
+    const legacy = JSON.stringify({
+      version: "8f3ac1d2feedbeef",
+      entry: "remoteEntry.83ba437f70018e7d.js",
+      entryIntegrity: "sha384-entry",
+      files: { "manifest.gen.json": "sha384-compose" },
+    });
+    const legacyDigest = {
+      manifest: "versions/8f3ac1d2feedbeef.json",
+      integrity: `sha384-${createHash("sha384").update(legacy).digest("base64")}`,
+    };
+    const fetchImpl = async (input: string | URL | Request): Promise<Response> => {
+      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+      return url.endsWith("versions/8f3ac1d2feedbeef.json")
+        ? new Response(legacy, { status: 200 })
+        : new Response("not found", { status: 404 });
+    };
+    const resolved = await resolveRemoteVersion({ base, digest: legacyDigest, fetchImpl });
+    expect(resolved.dir).toBeUndefined();
+    expect(resolved.entryUrl).toBe(`${base}remoteEntry.83ba437f70018e7d.js`);
+  });
+});