@plitzi/sdk-server 0.33.2 → 0.34.1

package/dist/core/services/action.js

@@ -1,20 +1,113 @@
-import { readRawBody } from "../requestParser.js";
-import { handleAction } from "../../modules/actions/handler.js";
+import { handleActionCall } from "../../modules/actions/transport/callHandler.js";
+import { handleActionCatalog } from "../../modules/actions/transport/catalogHandler.js";
+import { handleActionWebhook } from "../../modules/actions/transport/webhookHandler.js";
+import { handleActionCancel } from "../../modules/actions/transport/cancelHandler.js";
+import { clientIp, readRawBody } from "../requestParser.js";
+import { handleAction } from "../../modules/actions/connectorWrite.js";
 //#region src/core/services/action.ts
+var LINEAGE_HEADER = "x-plitzi-action-lineage";
+var safeParse = (body) => {
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
+	}
+};
 /**
-* Write endpoint for server-driven providers. RSC is read-only, so this is the only path a page has to mutate a
-* connected backend — and it answers POST on its own path alone, never falling through to SSR.
+* Who is asking, for the single-flight key and for cancellation ownership.
 *
-* Inert unless the consumer supplied the connector lookups: without them there is no manifest to authorize a
-* write against, and guessing would be the whole vulnerability.
+* A signed-in visitor is themselves; anyone else is their address. The address is a coarse identity — a shared
+* NAT makes two visitors look like one, which single-flight would read as a duplicate — so it is only ever used
+* for a `public` action, and the derived key also folds in the input: two people submitting different forms do
+* not collide.
+*/
+var callerIdOf = (ctx, req) => req.ctx.user ? `user:${req.ctx.user.id}` : `ip:${clientIp(ctx.raw, req)}`;
+var lineageOf = (req) => {
+	const raw = req.headers[LINEAGE_HEADER];
+	return (Array.isArray(raw) ? raw.join(",") : raw ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+};
+/**
+* The action endpoint: server-driven provider writes, and server actions.
+*
+* Two addressing modes on one path, because both are "the browser asks the server to change something, naming it
+* rather than addressing it". An element-addressed body reaches a connector's declared write; an action-addressed
+* one runs a stored flow. Each mode is inert unless its own half of the config is present, so a deployment that
+* configures neither has no endpoint at all — and guessing what an unconfigured one should do would be the whole
+* vulnerability.
 */
 var actionStage = async (ctx) => {
-	const { config, req } = ctx;
+	const { config, req, actions } = ctx;
 	const actionPath = config.action?.path ?? "/_action";
-	if (!config.action?.lookups || req.method !== "POST" || req.path !== actionPath) return false;
-	ctx.operation = "action";
+	const hasConnectors = !!config.connectors;
+	if (!hasConnectors && !actions) return false;
+	if (actions && req.method === "GET" && req.path === `${actionPath}/catalog`) {
+		ctx.operation = "action:catalog";
+		if (!req.ctx.user) {
+			ctx.res.setStatus(401);
+			ctx.res.send("");
+			return true;
+		}
+		handleActionCatalog({
+			res: ctx.res,
+			module: actions
+		});
+		return true;
+	}
+	if (actions && req.method === "POST" && req.path.startsWith(`${actionPath}/hook/`)) {
+		ctx.operation = "action:webhook";
+		req.body = await readRawBody(ctx.raw);
+		await handleActionWebhook({
+			req,
+			res: ctx.res,
+			config,
+			module: actions,
+			signal: ctx.signal,
+			actionId: req.path.slice(`${actionPath}/hook/`.length),
+			callerId: `ip:${clientIp(ctx.raw, req)}`,
+			lineage: lineageOf(req)
+		});
+		return true;
+	}
+	if (actions && req.method === "DELETE" && req.path.startsWith(`${actionPath}/run/`)) {
+		ctx.operation = "action:cancel";
+		await handleActionCancel({
+			res: ctx.res,
+			module: actions,
+			runId: req.path.slice(`${actionPath}/run/`.length),
+			callerId: callerIdOf(ctx, req)
+		});
+		return true;
+	}
+	if (req.method !== "POST" || req.path !== actionPath) return false;
 	req.body = await readRawBody(ctx.raw);
-	await handleAction(req, ctx.res, config, config.action.lookups);
+	const body = req.body ? safeParse(req.body) : void 0;
+	const addressesAction = body !== void 0 && typeof body === "object" && body !== null && "actionId" in body;
+	if (addressesAction && actions) {
+		ctx.operation = "action:run";
+		await handleActionCall({
+			req,
+			res: ctx.res,
+			raw: ctx.rawRes,
+			config,
+			module: actions,
+			signal: ctx.signal,
+			callerId: callerIdOf(ctx, req),
+			lineage: lineageOf(req)
+		});
+		return true;
+	}
+	if (addressesAction || !hasConnectors) {
+		ctx.operation = "action";
+		ctx.res.setStatus(404);
+		ctx.res.setHeader("Content-Type", "application/json; charset=utf-8");
+		ctx.res.send(JSON.stringify({
+			error: "This server runs no actions",
+			reason: "not_found"
+		}));
+		return true;
+	}
+	ctx.operation = "action";
+	await handleAction(req, ctx.res, config, config.connectors);
 	return true;
 };
 //#endregion

package/dist/core/services/registry.js

@@ -2,6 +2,7 @@ import { actionStage } from "./action.js";
 import { rscStage } from "./rsc.js";
 import { notFoundStage, ssrStage } from "./ssr.js";
 import { authRoutesStages } from "../http/stages/authRoutes.js";
+import { fontAssetsStage } from "../http/stages/fontAssets.js";
 import { healthStage } from "../http/stages/health.js";
 import { middlewaresStage } from "../http/stages/middlewares.js";
 import { pluginAssetsStage } from "../http/stages/pluginAssets.js";
@@ -13,6 +14,7 @@ var buildPagePipeline = (services, extensions = {}) => {
 		publicDirStage,
 		wellKnownStage,
 		pluginAssetsStage,
+		fontAssetsStage,
 		...authRoutesStages,
 		configStaticStage,
 		sdkAssetsStage

package/dist/core/services/resolve.d.ts

@@ -2,3 +2,11 @@ import { ServerServices, SSRServerConfig } from '@plitzi/sdk-shared';
 export type ResolvedServices = Required<ServerServices>;
 export declare const resolveServices: (config: SSRServerConfig) => ResolvedServices;
 export declare const resolveRscEndpoint: (config: SSRServerConfig) => string | undefined;
+/**
+ * Where this server runs actions, or undefined when it runs none.
+ *
+ * Published to the client as `server.ssr.actionPath` for the same reason `rscPath` is: absence is how a page
+ * learns, once, that a `serverAction` step has nowhere to run — instead of every click discovering it through a
+ * 404. A static export or an embed with no server tier publishes nothing here.
+ */
+export declare const resolveActionEndpoint: (config: SSRServerConfig) => string | undefined;

package/dist/core/services/resolve.js

@@ -10,5 +10,16 @@ var resolveRscEndpoint = (config) => {
 	if (!resolveServices(config).rsc || !(config.rsc?.enabled ?? true) || !config.adapters.getRscData) return;
 	return config.rsc?.path ?? "/_rsc";
 };
+/**
+* Where this server runs actions, or undefined when it runs none.
+*
+* Published to the client as `server.ssr.actionPath` for the same reason `rscPath` is: absence is how a page
+* learns, once, that a `serverAction` step has nowhere to run — instead of every click discovering it through a
+* 404. A static export or an embed with no server tier publishes nothing here.
+*/
+var resolveActionEndpoint = (config) => {
+	if (!config.action?.lookups) return;
+	return config.action.path ?? "/_action";
+};
 //#endregion
-export { resolveRscEndpoint, resolveServices };
+export { resolveActionEndpoint, resolveRscEndpoint, resolveServices };

package/dist/core/staticFiles.js

@@ -16,8 +16,7 @@ var serveFile = (req, res, filePath, stat) => {
 	}
 	const content = fs.readFileSync(filePath);
 	res.setHeader("Content-Type", getMimeType(filePath));
-	res.setHeader("Content-Length", content.byteLength.toString());
-	res.send(content.toString("utf-8"));
+	res.send(content);
 	return true;
 };
 var serveStatic = (req, res, rootDir) => {

package/dist/handlers.d.ts

@@ -52,7 +52,13 @@
  * ```
  */
 export { createAuthRouteHandlers, mountAuthRoutes } from './core/handlers/authRouteHandlers';
+export { createSocialAuthRouteHandlers, mountSocialAuthRoutes } from './core/handlers/socialRouteHandlers';
+export { createOAuthRouteHandlers, mountOAuthRoutes, OAUTH_ROUTE_PATHS } from './core/handlers/oauthRouteHandlers';
 export { createAuthMiddleware } from './core/handlers/authMiddleware';
+export { createCsrfMiddleware } from './core/handlers/csrfMiddleware';
 export type { AuthRouteHandlersOptions } from './core/handlers/authRouteHandlers';
+export type { SocialRouteHandlersOptions } from './core/handlers/socialRouteHandlers';
+export type { OAuthResponse, OAuthRouteHandler, OAuthRouteHandlersOptions } from './core/handlers/oauthRouteHandlers';
 export type { AuthMiddlewareOptions } from './core/handlers/authMiddleware';
-export type { AuthedRequest, JsonResponse, HttpRoute, RouteHandler, RouterLike } from './core/handlers/types';
+export type { CsrfMiddlewareOptions } from './core/handlers/csrfMiddleware';
+export type { AuthedRequest, HttpRoute, JsonResponse, RedirectResponse, RouteHandler, RouterLike, SocialRouteHandler } from './core/handlers/types';

package/dist/handlers.js

@@ -1,3 +1,6 @@
 import { createAuthRouteHandlers, mountAuthRoutes } from "./core/handlers/authRouteHandlers.js";
+import { createSocialAuthRouteHandlers, mountSocialAuthRoutes } from "./core/handlers/socialRouteHandlers.js";
+import { OAUTH_ROUTE_PATHS, createOAuthRouteHandlers, mountOAuthRoutes } from "./core/handlers/oauthRouteHandlers.js";
 import { createAuthMiddleware } from "./core/handlers/authMiddleware.js";
-export { createAuthMiddleware, createAuthRouteHandlers, mountAuthRoutes };
+import { createCsrfMiddleware } from "./core/handlers/csrfMiddleware.js";
+export { OAUTH_ROUTE_PATHS, createAuthMiddleware, createAuthRouteHandlers, createCsrfMiddleware, createOAuthRouteHandlers, createSocialAuthRouteHandlers, mountAuthRoutes, mountOAuthRoutes, mountSocialAuthRoutes };

package/dist/helpers/buildResponseHelpers.d.ts

@@ -9,5 +9,13 @@ export type RawResponse = {
     writeHead(statusCode: number, headers?: Record<string, string | number | readonly string[]>): unknown;
     write(chunk: string | Buffer): unknown;
     end(chunk?: string | Buffer): unknown;
+    /**
+     * Optional, because this type is the MINIMUM a host has to provide — node's own, http2's, or a fake in a test.
+     *
+     * They are how the dispatcher tells "the caller left" from "the answer was sent": a host that exposes neither
+     * simply never cancels early, which is the behaviour of every host that had no such notion to begin with.
+     */
+    once?(event: 'close', listener: () => void): unknown;
+    writableFinished?: boolean;
 };
 export declare const buildResponseHelpers: (raw: RawResponse, acceptEncoding?: string, compression?: ResolvedCompression) => SSRResponseHelpers;

package/dist/helpers/buildResponseHelpers.js

@@ -13,7 +13,15 @@ var buildResponseHelpers = (raw, acceptEncoding, compression = DEFAULT_COMPRESSI
 	*/
 	const transformable = () => !String(raw.getHeaders()["cache-control"]).includes("no-transform");
 	const writeSend = (body) => {
-		const compressed = transformable() ? compressBody(body, encoding, compression) : body;
+		/**
+		* A Buffer goes out untouched.
+		*
+		* It is the only way a binary reaches the wire — this response object had `send(body: string)` and every
+		* caller went through a UTF-8 round trip, which silently replaces every byte that is not valid UTF-8 and so
+		* corrupts any font, image or archive served through it. What a Buffer holds is also compressed already
+		* (woff2, png), so re-encoding it would cost CPU to make it bigger.
+		*/
+		const compressed = typeof body === "string" && transformable() ? compressBody(body, encoding, compression) : body;
 		if (compressed !== body) {
 			raw.setHeader("Content-Encoding", encoding);
 			raw.setHeader("Vary", "Accept-Encoding");

package/dist/helpers/buildServerInfo.d.ts

@@ -1,3 +1,8 @@
-import { OfflineDataLoader } from './offlineDataLoader';
-import { Server, SSRRequest, SSRServerConfig } from '@plitzi/sdk-shared';
-export declare const buildServerInfo: (req: SSRRequest, config: SSRServerConfig, loadOfflineData: OfflineDataLoader) => Promise<Partial<Server>>;
+import { Server, ServerSSR, SSRRequest, SSRServerConfig } from '@plitzi/sdk-shared';
+/**
+ * The endpoints, the session and the location this render happens at.
+ *
+ * Synchronous, and takes the RSC bootstrap already resolved rather than resolving it: the only async thing here was
+ * ever the `getRscData` call, so the caller starting that read is also what decides whether it happens at all.
+ */
+export declare const buildServerInfo: (req: SSRRequest, config: SSRServerConfig, ssr: ServerSSR) => Partial<Server>;

package/dist/helpers/buildServerInfo.js

@@ -1,4 +1,3 @@
-import { resolveRscEndpoint } from "../core/services/resolve.js";
 //#region src/helpers/buildServerInfo.ts
 var getEnvironment = (env = "production", server) => {
 	switch (env) {
@@ -29,16 +28,31 @@ var getEnvironment = (env = "production", server) => {
 		};
 	}
 };
-var buildServerInfo = async (req, config, loadOfflineData) => {
+/**
+* The endpoints, the session and the location this render happens at.
+*
+* Synchronous, and takes the RSC bootstrap already resolved rather than resolving it: the only async thing here was
+* ever the `getRscData` call, so the caller starting that read is also what decides whether it happens at all.
+*/
+var buildServerInfo = (req, config, ssr) => {
 	const accessToken = req.query["access-token"];
 	const origin = `${req.protocol}://${req.hostname}`;
 	const user = req.ctx.user;
-	const { environment = "main", spaceId, revision = 0 } = req.ctx.spaceDeployment ?? {};
 	return getEnvironment(config.environment, {
 		basePath: "/",
 		requestUrl: req.url || "/",
 		origin,
+		/**
+		* Complete enough to be the same object a browser hands the SDK, `origin` included.
+		*
+		* It used to carry the hostname and the path only, which reads as a location right up until something needs to
+		* name THIS page from the server: a sign-in link that sends somebody back where they were had nothing to build
+		* an absolute URL out of, so a space had to name its own address in a per-environment variable instead.
+		*/
 		location: {
+			origin,
+			protocol: `${req.protocol}:`,
+			host: req.hostname,
 			hostname: req.hostname,
 			pathname: req.path || "/",
 			search: req.search
@@ -57,17 +71,7 @@ var buildServerInfo = async (req, config, loadOfflineData) => {
 			accessToken: user.token,
 			expiresAt: user.expiresAt
 		} : void 0,
-		ssr: {
-			rscPath: resolveRscEndpoint(config),
-			rscData: await config.adapters.getRscData?.({
-				req,
-				spaceId,
-				environment,
-				revision,
-				user,
-				loadOfflineData
-			})
-		}
+		ssr
 	});
 };
 //#endregion

package/dist/helpers/cache/keys.d.ts

@@ -1,7 +1,20 @@
+/**
+ * The key a rendered document is cached under.
+ *
+ * The visitor's theme is part of it because it is part of the DOCUMENT: `prepareRender` reads the `theme` cookie and
+ * writes it onto `<html>` and into the props the SDK hydrates with. Keyed without it, the first visitor's choice was
+ * served to everybody behind them — a dark page for a visitor who chose light, then corrected on hydration.
+ *
+ * Read from the request here rather than handed in, so a call site cannot key the page without it. Only the theme
+ * cookie is read: keying the whole header would split the cache on every analytics cookie a visitor carries.
+ */
 export declare const buildHtmlCacheKey: (accessToken: string | undefined, spaceId: number | string | null, environment: string, revision: number, req: {
     hostname: string;
     path: string;
     search: string;
+    headers: {
+        cookie?: string;
+    };
 }) => string;
 export declare const buildOfflineDataCacheKey: (spaceId: number, environment: string, revision: number) => string;
 export declare const buildRscCacheKey: (spaceId: number, environment: string, revision: number, userId: string | number | undefined, idsParam: string | undefined, req: {

package/dist/helpers/cache/keys.js

@@ -1,5 +1,16 @@
+import { themeFromCookies } from "@plitzi/sdk-shared/theme";
 //#region src/helpers/cache/keys.ts
-var buildHtmlCacheKey = (accessToken = "anonymous", spaceId, environment, revision, req) => `${accessToken}\0${spaceId ?? 1}\0${environment}\0${revision}\0${req.hostname}\0${req.path}\0${req.search}`;
+/**
+* The key a rendered document is cached under.
+*
+* The visitor's theme is part of it because it is part of the DOCUMENT: `prepareRender` reads the `theme` cookie and
+* writes it onto `<html>` and into the props the SDK hydrates with. Keyed without it, the first visitor's choice was
+* served to everybody behind them — a dark page for a visitor who chose light, then corrected on hydration.
+*
+* Read from the request here rather than handed in, so a call site cannot key the page without it. Only the theme
+* cookie is read: keying the whole header would split the cache on every analytics cookie a visitor carries.
+*/
+var buildHtmlCacheKey = (accessToken = "anonymous", spaceId, environment, revision, req) => `${accessToken}\0${spaceId ?? 1}\0${environment}\0${revision}\0${themeFromCookies(req.headers.cookie) ?? ""}\0${req.hostname}\0${req.path}\0${req.search}`;
 var buildOfflineDataCacheKey = (spaceId, environment, revision) => `${spaceId}|${environment}|${revision}`;
 var buildRscCacheKey = (spaceId, environment, revision, userId, idsParam, req) => `${spaceId}\0${environment}\0${revision}\0${userId ?? "anon"}\0${idsParam ?? ""}\0${req.hostname}\0${req.path}\0${req.search}`;
 //#endregion

package/dist/helpers/onAbort.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Subscribes to a signal, and covers the case every hand-rolled subscription misses: one that is ALREADY aborted.
+ *
+ * `addEventListener('abort', …)` on a signal that has already fired never calls back — the event is long gone — so
+ * a listener attached after any `await` is a cancellation silently dropped. That window is not theoretical: an
+ * action is READ before its run begins, and a page that gave up during that read left the run to carry on holding
+ * a slot and a connection for nobody.
+ *
+ * Returns the unsubscribe, so a caller that outlives the signal does not leak a listener onto it.
+ */
+export declare const onAbort: (signal: AbortSignal | undefined, stop: () => void) => (() => void);
+export default onAbort;

package/dist/helpers/onAbort.js

@@ -0,0 +1,22 @@
+//#region src/helpers/onAbort.ts
+/**
+* Subscribes to a signal, and covers the case every hand-rolled subscription misses: one that is ALREADY aborted.
+*
+* `addEventListener('abort', …)` on a signal that has already fired never calls back — the event is long gone — so
+* a listener attached after any `await` is a cancellation silently dropped. That window is not theoretical: an
+* action is READ before its run begins, and a page that gave up during that read left the run to carry on holding
+* a slot and a connection for nobody.
+*
+* Returns the unsubscribe, so a caller that outlives the signal does not leak a listener onto it.
+*/
+var onAbort = (signal, stop) => {
+	if (!signal) return () => {};
+	if (signal.aborted) {
+		stop();
+		return () => {};
+	}
+	signal.addEventListener("abort", stop, { once: true });
+	return () => signal.removeEventListener("abort", stop);
+};
+//#endregion
+export { onAbort as default, onAbort };

package/dist/helpers/onAbort.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/outboundGuard.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Where a customer-authored request may go.
+ *
+ * Two things reach the outside world on somebody else's say-so: the `http.request` task, whose URL is typed into
+ * a flow, and the connector engine, whose `baseUrl` is typed into a manifest. Both run inside the cluster, from a
+ * trusted network position, which is what turns "fetch this URL for me" into a way to read the instance's cloud
+ * credentials at `169.254.169.254` or talk to Redis on `localhost`. One rule, in one place, for both of them.
+ */
+/** Literal forms an authored URL can hold, and the ones this refuses outright. */
+export declare const isBlockedHost: (hostname: string) => boolean;
+export type HostLookup = (hostname: string) => Promise<{
+    address: string;
+}[]>;
+/**
+ * Checks the URL an authored document asked for, including what its hostname RESOLVES to.
+ *
+ * The literal check alone was never enough and said so: `http://metadata.example.com/` is a public-looking name
+ * whose A record can be `169.254.169.254`, and nothing about the string gives that away. So the name is resolved
+ * and every address it answers is judged — a name that resolves to a private address is refused whatever it is
+ * spelled like.
+ *
+ * A name that does not resolve is ALLOWED through: there is nothing to judge, and the request is about to fail on
+ * its own with a better error than this could give. What remains open is DNS rebinding — an attacker's own server
+ * answering a public address here and a private one when the socket is opened a moment later — which is closed
+ * only by resolving and connecting to the same address, and that belongs in the transport rather than here.
+ */
+export declare const assertOutboundAllowed: (url: URL, lookup?: HostLookup) => Promise<void>;

package/dist/helpers/outboundGuard.js

@@ -0,0 +1,49 @@
+import { lookup } from "node:dns/promises";
+//#region src/helpers/outboundGuard.ts
+/**
+* Where a customer-authored request may go.
+*
+* Two things reach the outside world on somebody else's say-so: the `http.request` task, whose URL is typed into
+* a flow, and the connector engine, whose `baseUrl` is typed into a manifest. Both run inside the cluster, from a
+* trusted network position, which is what turns "fetch this URL for me" into a way to read the instance's cloud
+* credentials at `169.254.169.254` or talk to Redis on `localhost`. One rule, in one place, for both of them.
+*/
+/** Literal forms an authored URL can hold, and the ones this refuses outright. */
+var isBlockedHost = (hostname) => {
+	const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+	if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".internal") || host === "::1") return true;
+	const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+	if (!ipv4) return /^f[cd]/.test(host) || host.startsWith("fe8") || host.startsWith("fe9") || /^fe[ab]/.test(host);
+	const [a = 0, b = 0] = ipv4.slice(1).map((part) => Number.parseInt(part, 10));
+	return a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+};
+var resolveAll = (hostname) => lookup(hostname, {
+	all: true,
+	verbatim: true
+});
+/**
+* Checks the URL an authored document asked for, including what its hostname RESOLVES to.
+*
+* The literal check alone was never enough and said so: `http://metadata.example.com/` is a public-looking name
+* whose A record can be `169.254.169.254`, and nothing about the string gives that away. So the name is resolved
+* and every address it answers is judged — a name that resolves to a private address is refused whatever it is
+* spelled like.
+*
+* A name that does not resolve is ALLOWED through: there is nothing to judge, and the request is about to fail on
+* its own with a better error than this could give. What remains open is DNS rebinding — an attacker's own server
+* answering a public address here and a private one when the socket is opened a moment later — which is closed
+* only by resolving and connecting to the same address, and that belongs in the transport rather than here.
+*/
+var assertOutboundAllowed = async (url, lookup = resolveAll) => {
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error(`Request protocol "${url.protocol}" is not allowed`);
+	if (isBlockedHost(url.hostname)) throw new Error("Request host is not allowed");
+	let addresses;
+	try {
+		addresses = await lookup(url.hostname.replace(/^\[|\]$/g, ""));
+	} catch {
+		return;
+	}
+	if (addresses.some(({ address }) => isBlockedHost(address))) throw new Error("Request host is not allowed");
+};
+//#endregion
+export { assertOutboundAllowed, isBlockedHost };

package/dist/helpers/outboundGuard.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/helpers/serverLog.d.ts

@@ -1,9 +1,12 @@
 import { ServerLogEvent, ServerLogger } from '@plitzi/sdk-shared';
 /** One line for any {@link ServerLogEvent}: an HTTP request reads as an access-log line
  *  (`[SSR] 203.0.113.7 GET /pricing 200 12ms ok`), the MCP events as what happened inside one
- *  (`[MCP] tools/call plitzi_apply {operations:[3]} 41ms ok`). Rendering is a pure format — the dispatcher
- *  already stripped query values, collected no headers, cookies or tokens and summarised tool args by shape;
- *  the client IP it does carry is personal data, so a sink that persists these lines must say so. */
+ *  (`[MCP] tools/call plitzi_apply {operations:[3]} 41ms ok`), a server action as what its flow did
+ *  (`[Action] shipping-quote via call space=1 completed 12ms ok`) and a refused one as what turned it away
+ *  (`[Action] checkout via webhook space=1 REFUSED invalid_signature`). Rendering is a pure format — the dispatcher
+ *  already stripped query values, collected no headers, cookies or tokens, summarised tool args by shape and
+ *  reduced a run to its steps; the client IP it does carry is personal data, so a sink that persists these lines
+ *  must say so. */
 export declare const renderLogEvent: (event: ServerLogEvent) => string;
 /** A drop-in `SSRServerConfig.logger` for consumers that just want the log on the console. Consumers with their
  *  own logging stack should pass their own sink instead and read the structured event. */

package/dist/helpers/serverLog.js

@@ -11,16 +11,33 @@ var renderTool = (event) => {
 	return `[MCP] tools/call ${event.name}${args} ${Math.round(event.durationMs)}ms ${outcomeOf(event)}`;
 };
 var renderResource = (event) => `[MCP] resources/read ${event.name} ${Math.round(event.durationMs)}ms ${outcomeOf(event)}`;
+/** The steps go on the line only when the run ended badly. On a run that worked they are noise on every single
+*  call; on one that did not they are the answer — which step stopped, and what the ones before it did. */
+var renderRun = (event) => {
+	const steps = event.ok || event.steps.length === 0 ? "" : ` [${event.steps.join(" → ")}]`;
+	return `[Action] ${event.name} via ${event.trigger} space=${event.spaceId} ${event.status} ${Math.round(event.durationMs)}ms ${outcomeOf(event)}${steps}`;
+};
+/** A refusal reads as what refused it: `[Action] checkout via webhook space=1 REFUSED invalid_signature`. The
+*  reason is the whole point of the line — "401" is what the request log already said. */
+var renderReject = (event) => {
+	const caller = event.callerId ? ` from ${event.callerId}` : "";
+	return `[Action] ${event.name} via ${event.trigger} space=${event.spaceId} REFUSED ${event.reason}${caller} ${outcomeOf(event)}`;
+};
 /** One line for any {@link ServerLogEvent}: an HTTP request reads as an access-log line
 *  (`[SSR] 203.0.113.7 GET /pricing 200 12ms ok`), the MCP events as what happened inside one
-*  (`[MCP] tools/call plitzi_apply {operations:[3]} 41ms ok`). Rendering is a pure format — the dispatcher
-*  already stripped query values, collected no headers, cookies or tokens and summarised tool args by shape;
-*  the client IP it does carry is personal data, so a sink that persists these lines must say so. */
+*  (`[MCP] tools/call plitzi_apply {operations:[3]} 41ms ok`), a server action as what its flow did
+*  (`[Action] shipping-quote via call space=1 completed 12ms ok`) and a refused one as what turned it away
+*  (`[Action] checkout via webhook space=1 REFUSED invalid_signature`). Rendering is a pure format — the dispatcher
+*  already stripped query values, collected no headers, cookies or tokens, summarised tool args by shape and
+*  reduced a run to its steps; the client IP it does carry is personal data, so a sink that persists these lines
+*  must say so. */
 var renderLogEvent = (event) => {
 	switch (event.kind) {
 		case "request": return renderRequest(event);
 		case "tool": return renderTool(event);
 		case "resource": return renderResource(event);
+		case "run": return renderRun(event);
+		case "reject": return renderReject(event);
 	}
 };
 /** A drop-in `SSRServerConfig.logger` for consumers that just want the log on the console. Consumers with their

package/dist/index.d.ts

@@ -2,15 +2,21 @@ export { createServer, resolveServices } from './core/createServer';
 export { registerHealthCheck, buildHealthPayload } from './core/health';
 export { consoleLogger, renderLogEvent } from './helpers/serverLog';
 export type { HealthCheckApp, HealthIdentity } from './core/health';
+export { createCloudAdapters } from './adapters/cloudAdapters';
 export { createJsonAdapters } from './adapters/jsonAdapters';
 export { createAuthAdapters } from './adapters/authAdapters';
+export { authoringPreview, createMemoryCache, createSpaceAdapters, fixedSpace, presentsCredential, refuse, verifiedDomain, wildcardSubdomain } from './adapters/space';
+export { createLocalFontStore, hostedPathsOf } from './core/fontStore';
 export { createMemoryDraftStore, takeDraftOverride } from './modules/ssr/preview';
 export { PREVIEW_TOKEN_PARAM } from './core/previewToken';
 export { resolveRscData } from './modules/rsc/resolveRscData';
 export { fetchConnectorRecords, rebaseMedia, writeConnectorRecord, createConnectorResolver } from './modules/connectors';
+export type { CloudAdaptersConfig, CloudSpaceCache } from './adapters/cloudAdapters';
 export type { JsonAdaptersConfig } from './adapters/jsonAdapters';
 export type { AuthAdapters, AuthAdaptersConfig } from './adapters/authAdapters';
+export type { AuthoringPreviewOptions, DeploymentRow, FrameAncestorsConfig, SpaceAdapters, SpaceAdaptersConfig, SpaceCache, SpaceRefusal, SpaceResolution, SpaceResolver, WildcardSubdomainOptions } from './adapters/space';
 export type { RscElementResolver, RscResolveContext, ResolveRscDataOptions } from './modules/rsc/resolveRscData';
 export type { ConnectorAuth, ConnectorCredential, ConnectorEndpoints, ConnectorFilter, ConnectorLookups, ConnectorManifest, ConnectorManifestDraft, ConnectorPageInfo, ConnectorPagination, ConnectorQuery, ConnectorReadEndpoint, ConnectorRecord, ConnectorResponseMapping, ConnectorResult, ProviderPagination } from './modules/connectors';
+export type { FontStore, StoredFont } from './core/fontStore';
 export type { ResolvedServices } from './core/createServer';
 export type { BaseContext, PipelineExtensions, SSRContext, Stage } from './core/http/types';

package/dist/index.js

@@ -1,12 +1,17 @@
+import { fetchConnectorRecords, rebaseMedia, writeConnectorRecord } from "./modules/connectors/engine.js";
+import { createConnectorResolver } from "./modules/connectors/resolver.js";
+import { resolveRscData } from "./modules/rsc/resolveRscData.js";
 import { PREVIEW_TOKEN_PARAM } from "./core/previewToken.js";
 import { createMemoryDraftStore, takeDraftOverride } from "./modules/ssr/preview.js";
-import { fetchConnectorRecords, rebaseMedia, writeConnectorRecord } from "./modules/connectors/engine.js";
 import { resolveServices } from "./core/services/resolve.js";
 import { buildHealthPayload, registerHealthCheck } from "./core/health.js";
 import { createServer } from "./core/createServer.js";
 import { consoleLogger, renderLogEvent } from "./helpers/serverLog.js";
+import { createCloudAdapters } from "./adapters/cloudAdapters.js";
 import { createJsonAdapters } from "./adapters/jsonAdapters.js";
 import { createAuthAdapters } from "./adapters/authAdapters.js";
-import { resolveRscData } from "./modules/rsc/resolveRscData.js";
-import { createConnectorResolver } from "./modules/connectors/resolver.js";
-export { PREVIEW_TOKEN_PARAM, buildHealthPayload, consoleLogger, createAuthAdapters, createConnectorResolver, createJsonAdapters, createMemoryDraftStore, createServer, fetchConnectorRecords, rebaseMedia, registerHealthCheck, renderLogEvent, resolveRscData, resolveServices, takeDraftOverride, writeConnectorRecord };
+import { createMemoryCache, refuse } from "./adapters/space/types.js";
+import { authoringPreview, fixedSpace, presentsCredential, verifiedDomain, wildcardSubdomain } from "./adapters/space/resolvers.js";
+import { createSpaceAdapters } from "./adapters/space/index.js";
+import { createLocalFontStore, hostedPathsOf } from "./core/fontStore.js";
+export { PREVIEW_TOKEN_PARAM, authoringPreview, buildHealthPayload, consoleLogger, createAuthAdapters, createCloudAdapters, createConnectorResolver, createJsonAdapters, createLocalFontStore, createMemoryCache, createMemoryDraftStore, createServer, createSpaceAdapters, fetchConnectorRecords, fixedSpace, hostedPathsOf, presentsCredential, rebaseMedia, refuse, registerHealthCheck, renderLogEvent, resolveRscData, resolveServices, takeDraftOverride, verifiedDomain, wildcardSubdomain, writeConnectorRecord };

package/dist/kernel.d.ts

@@ -5,37 +5,20 @@
  *  from there would load that whole graph. This entry's closure is the dispatcher, the transports and the base
  *  stages: no React, no template, no plugin manager.
  *
- *  A server built on it supplies its own pipeline; `@plitzi/sdk-mcp` is the in-tree example. */
+ *  A server built on it supplies its own pipeline; `@plitzi/sdk-mcp` is the in-tree example.
+ *
+ *  Auth is **not** here — it is `@plitzi/sdk-server/auth`. The two shared this entry for a while and the name
+ *  described neither: a deployment wiring up sessions loaded the dispatcher to get them, and a server that wants
+ *  the dispatcher and no auth at all had to name the entry that carried both. */
 export { createHttpServer } from './core/server/baseServer';
 export { makeHandler } from './core/http/dispatcher';
 export { healthStage } from './core/http/stages/health';
 export { configStaticStage, publicDirStage, wellKnownStage } from './core/http/stages/static';
 export { buildHealthPayload, registerHealthCheck } from './core/health';
 export { clientIp, parseRequest, readRawBody, requestOrigin } from './core/requestParser';
-export { clearFlowCookie, clearSessionCookies, createSessionCookies, isLocalHost, readFlowCookie, readRefreshToken, readSessionToken, sessionCookieParams, sessionHintValue, writeFlowCookie, writeSessionCookies } from './core/auth/session';
-export { SCOPES, authFailureMessage, createTokens, userIdOf } from './core/auth/tokens';
-export { createCarriers, presentedOrigin } from './core/auth/credentials';
-export { ANY_DOMAIN, corsOrigins, domainAllowed, frameAncestors, hostnameOf, normalizeDomain } from './core/auth/domains';
-export { createIdentity } from './core/auth/identity';
-export { checkPermission, checkSpaceAccess, createAuthorizer, requirementFor } from './core/auth/authorize';
-export { createAuth } from './core/auth/createAuth';
-export { createAuthApi } from './core/auth/api';
-export { applySessionOutcome, authPolicyRules, authRoutes } from './core/auth/routes';
-export { createSpaceTokenApi } from './core/auth/spaceTokens';
-export { BUILT_IN_PROVIDERS, OAuthFailure, createSocialAuth, requestProfileJson } from './core/auth/oauth';
 export { consoleLogger, renderLogEvent } from './helpers/serverLog';
 export { PREVIEW_TOKEN_PARAM } from './core/previewToken';
 export type { HttpServerParts } from './core/server/baseServer';
 export type { BuildContext } from './core/http/dispatcher';
 export type { HealthCheckApp, HealthIdentity } from './core/health';
 export type { BaseContext, PipelineExtensions, SSRContext, Stage } from './core/http/types';
-export type { CookieCarrier, CookieSink, SessionCookieParams, SessionCookies } from './core/auth/session';
-export type { CredentialCarrier } from './core/auth/credentials';
-export type { Actor, ActorResult, Grant, GrantOptions, GrantResult, Identity, IdentityAdapters, IdentityConfig, SpaceMembership, StoredSpaceToken } from './core/auth/identity';
-export type { AuthPolicy, AuthorizeResult, Authorizer, MembershipFacts, PathMatcher, PermissionCheck, Requirement, SpaceAccessCheck } from './core/auth/authorize';
-export type { AuthRequest, AuthRoute } from './core/auth/routes';
-export type { Auth, AuthConfig } from './core/auth/createAuth';
-export type { CompletedFlow, OAuthFailureReason, OAuthProfile, OAuthProvider, OAuthProviderConfig, SocialAuth, SocialAuthAdapters, SocialAuthConfig, StartedFlow } from './core/auth/oauth';
-export type { AccountAccess, AccountAdapters, AccountRecord, AuthApi, AuthApiConfig, AuthOutcome } from './core/auth/api';
-export type { SpaceTokenAdapters, SpaceTokenApi, SpaceTokenContext, SpaceTokenOutcome, SpaceTokenRecord, SpaceTokenSummary } from './core/auth/spaceTokens';
-export type { AuthFailure, RefreshTokenPayload, SpaceScope, SpaceTokenOptions, SpaceTokenPayload, TokenConfig, TokenScope, Tokens, UserTokenPayload, VerifyResult, WidgetTokenPayload } from './core/auth/tokens';