Stop SDK chunks from importing private @executor-js/api

[RhysSullivan]

Summary

The published plugin bundles (@executor-js/plugin-mcp, -graphql, -openapi, etc.) carry import { InternalError } from "@executor-js/api" (and addGroup / capture) inside their SDK chunks. Because @executor-js/api is private: true and isn't on npm, plain Node ESM consumers fail with Cannot find package '@executor-js/api' on import("@executor-js/plugin-mcp/core") (same for graphql / openapi).

Reproduced in a fresh /tmp dir against the live npm package; the dist files now have zero @executor-js/api strings after this change.

Fix

• Move InternalError (a 10-line Schema.TaggedErrorClass for the wire-level 500) into @executor-js/sdk/core. @executor-js/api/observability.ts re-exports it for back-compat — server code is unaffected.
• Each plugin's src/api/group.ts imports InternalError from @executor-js/sdk/core instead of the private package.
• Each plugin's src/sdk/plugin.ts no longer reaches sideways into ../api/* and no longer sets the optional routes / handlers / extensionService fields. Those are layered on by a new HTTP-augmented variant on the /api subpath.
• Hosts opt into HTTP via import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api" (and graphqlHttpPlugin, openApiHttpPlugin, onepasswordHttpPlugin, googleDiscoveryHttpPlugin). Apps cloud / local / marketing updated.
• @executor-js/api demoted from dependencies to devDep + optional peerDep on plugin-onepassword and plugin-google-discovery, matching the other plugins.

Net result:

// SDK-only consumers (unchanged path; no longer pulls @executor-js/api)
import { mcpPlugin } from "@executor-js/plugin-mcp";

// Hosts wanting HTTP
import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api";

Breaking change

Any host code that read mcpPlugin(opts).routes / .handlers / .extensionService directly off the SDK factory's return value must switch to the *HttpPlugin factory from @executor-js/plugin-*/api. Every host in this repo was updated; out-of-tree callers that compose plugins by hand need the same import switch.

Changeset bumps the fixed group as minor (pre-1.0).

Test plan

• bun run typecheck — 33/33 pass
• bun run lint — 0 warnings, 0 errors
• bun run format:check — clean
• bun run test — only pre-existing failure (returns 401 for malformed bearer tokens in cloud/mcp-miniflare.e2e.node.test.ts) reproduces on main without these changes
• All 5 plugin dist/*.js files: zero @executor-js/api references after bun run build

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	c3ce5a0	Commit Preview URL Branch Preview URL	May 11 2026, 05:36 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	c3ce5a0	May 11 2026, 05:36 AM

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@755

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@755

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@755

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@755

@executor-js/storage-core

npm i https://pkg.pr.new/@executor-js/storage-core@755

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@755

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@755

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@755

@executor-js/plugin-google-discovery

npm i https://pkg.pr.new/@executor-js/plugin-google-discovery@755

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@755

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@755

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@755

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@755

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@755

executor

npm i https://pkg.pr.new/executor@755

commit: c3ce5a0