Rspack Build API

The /rspack entry point is build-time code for Node.js. Import it from Rsbuild or Rslib configuration and package assembly scripts, never from a target runtime module.

Compile a Target

tapLib returns an Rslib configuration for one independently compiled target. pluginTap provides the equivalent Rsbuild plugin behavior. Both accept the descriptor path, target, output root, and Module Federation settings.

import { defineConfig } from '@rslib/core';
import { tapLib } from '@theaiplatform/miniapp-sdk/rspack';

const desktop = tapLib({
  manifest: './manifest.tap.json',
  packageTarget: 'desktop',
  packageOutputRoot: '.tap-build/desktop',
  federation: {
    name: 'example_desktop',
    filename: 'remoteEntry.mjs',
    manifest: true,
    library: { type: 'module' },
    dts: false,
    exposes: { './ui/desktop': './src/surface.ts' },
  },
});

export default defineConfig({ lib: [desktop] });

TapPackageTarget is the supported target union: desktop, mobile, QuickJS, worker, Node.js, and workflow host. Compile each declared target into a separate staging root.

Package-runtime mcp.server contributions use a dedicated ./mcp/<server-contribution-id> expose. The build rejects a package-wide ./tap/mcp alias or any other expose that does not match the exact server contribution ID. Stdio and Streamable HTTP MCP servers are host-declarative; they do not add a Federation expose or a package-side registration call. The desktop host reconstructs an immutable desired registration from verified installations and swaps complete generations atomically. For a QuickJS package-runtime server, the expose's named mcpServer export may define descriptor-declared tools through defineMcpServer; the host validates the exact live catalog before making it privately discoverable to an authorized specialist and revalidates its access lease immediately before invocation. This tools-only ABI supports API version 1 and pure QuickJS functions: any declared MCP authorization action or runtime effect fails package activation, and MCP execution receives no miniapp host-action context. Human-approved exact consumer selections are persisted with audit metadata, and package consumer classes are re-derived from verified descriptors while the complete installation graph is projected. Package tools never enter the global tool registry or user MCP store. This MVP does not activate stdio/HTTP servers, prompts, resources, resource templates, or MCP Apps; schema/build acceptance for those declarations is not runtime support. The live consumer path is limited to selected specialists. An operator grants one from Settings → Miniapps → Installed → package details using its canonical slug, such as chloe, rather than a versioned manifest ID. Chat, workflow, miniapp, and platform-service consumer classes remain non-live. Mobile and other non-desktop hosts currently fail package activation closed for any nonempty MCP projection instead of silently omitting those declarations.

Assemble the Package

assembleTapPackage accepts TapPackageAssemblyOptions: the source descriptor, final output directory, and exact map of TapPackageTarget values to staging directories.

import { assembleTapPackage } from '@theaiplatform/miniapp-sdk/rspack';

await assembleTapPackage({
  manifest: './manifest.tap.json',
  output: './dist',
  targets: { desktop: './.tap-build/desktop' },
});

Assembly validates the descriptor and target graphs, computes integrity metadata and the content digest, and swaps the complete output into place. Missing, extra, overlapping, or incompatible targets fail the operation without publishing a partial package.

Scan Portability

assertPortableTapPackageArtifacts accepts TapPackageArtifactPortabilityOptions. It scans the assembled output for machine-local references and can receive additional absolute checkout roots that must never appear in artifacts.

import { assertPortableTapPackageArtifacts } from '@theaiplatform/miniapp-sdk/rspack';

await assertPortableTapPackageArtifacts({
  output: './dist',
  forbiddenRoots: [process.cwd()],
});

Run the scan after assembly and before publication. Do not mutate the assembled directory afterward; any byte change invalidates its computed identity.

Public Export Contract

ExportPurposeInputs and resultLifecycle and errorsWorking example
TapPackageTargetEnumerates independently compiled package targets.Supplies a desktop, mobile, QuickJS, worker, Node.js, or workflow-host target.Type only; an unsupported target fails configuration or assembly.Compile a target
TapPackageAssemblyOptionsSelects descriptor, output, and exact target roots for assembly.assembleTapPackage consumes the options and resolves with no value.Type only; missing, extra, or overlapping target roots reject.Assemble the package
TapPackageArtifactPortabilityOptionsConfigures an emitted-artifact portability scan.Selects output and optional forbidden absolute roots.Type only; invalid roots or nonportable bytes make the scan reject.Scan portability
assertPortableTapPackageArtifactsRejects machine-local references in assembled artifacts.Accepts portability options and returns a promise of void.Run after assembly and before publication; any finding rejects.Scan portability
assembleTapPackageBuilds one immutable descriptor-backed package from target roots.Accepts assembly options and returns a promise of void.It swaps output transactionally; validation failure preserves the prior complete output.Assemble the package
pluginTapAdds descriptor and Federation package behavior to Rsbuild.Accepts build options and returns an RsbuildPlugin.It validates during build and fails when required package artifacts are missing.Compile a target
tapLibProduces an Rslib target configuration with package behavior installed.Accepts build options and returns a LibConfig.Use once per target build; configuration and artifact failures stop the build.Compile a target