[kevwilliams]

Summary

The compute plugin shipped its own copy of every library it shares with the portal, so the browser downloaded and parsed each one on every load even though the portal's copy always wins.

Production builds now take those libraries from the portal, cutting the plugin from 80 to 46 script files and from 770KB to 622KB gzipped.

The build also uploads source maps to the portal's Sentry project, so plugin errors show readable frames, with the token passed as a build secret that never lands in the image or its cache.

This ports the parts of #481 that are still missing, since that PR predates the minified build and the move to pnpm.

Notes for reviewers

Nobody has confirmed that the org's Sentry token is shared with this repository. Without it the upload is skipped and the build still succeeds.

Test plan

• Typecheck, unit tests and builds with and without a Sentry token pass, and a failed upload does not fail the build
• Workloads pages, the home column and the instance shell window work inside the portal in a test environment
• The first publish run shows the source map upload succeeded

Fixes #612

[ecv]

Approve.

Production builds stop bundling local copies of react, react-dom, react-router, react-query and the datum-ui subpaths and take them from the portal, and the build uploads source maps to the portal's Sentry project. CI is green, including the consumer plugin image build.

• The token is passed only as a BuildKit secret to the one consumer-plugin job (secrets: inherit is removed so it never reaches publish-docker's build-arg path, which persists in the exported cache), mounted with required=false for a single RUN, and the repo currently has no SENTRY_AUTH_TOKEN secret, so the upload is skipped and the build succeeds until one is added.
• The portal's federation-host.ts shares every key this plugin marks import: false (react, react-dom, react-router, react-query and the nine datum-ui subpaths), so the plugin resolves at runtime today. react/jsx-runtime keeps its local fallback.
• The upload does not make the maps private. build.sourcemap: true still emits .map files plus sourceMappingURL comments into the image, which the portal serves, as before. The portal itself uses hidden.

Follow-ups:

• Version coupling is now harder: with import: false there is no local fallback, so if the portal stops sharing a datum-ui subpath or bumps a major past the plugin's requiredVersion, the plugin pages fail to load instead of degrading. Add a plugin-side check against the portal's shared list, or release plugin and portal changes in order (portal exports first).
• Set build.sourcemap: 'hidden' or sourcemaps.filesToDeleteAfterUpload on the Sentry plugin once a token exists, so the maps live only in Sentry. Consider a Sentry release so frames are not tied to debug IDs alone.
• Standalone vite preview of a production build no longer works without the host.
• Once a token exists, vite.config.ts sets no Sentry errorHandler, so a Sentry outage or a bad token fails the build and blocks the image publish. Add an errorHandler that logs and continues if publishing should not depend on Sentry.
• BuildKit leaves secret values out of the cache key, so a cached tokenless pnpm build step can be reused after the token is added and silently skip the upload. Bust that step's cache once when the secret first lands.