@plitzi/sdk-server 0.37.2 → 0.37.4

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 export { createServer, resolveServices } from './core/createServer';
 export { closeOnSignals } from './core/server/closeOnSignals';
+export { loadFunctions, readFunctionsDir } from './modules/functions/load';
 export { registerHealthCheck, buildHealthPayload } from './core/health';
-export { consoleLogger, renderLogEvent } from './helpers/serverLog';
+export { consoleLogger, isLogged, logLevelOf, renderLogEvent, serverLog } from './helpers/serverLog';
 export type { HealthCheckApp, HealthIdentity } from './core/health';
 export { createCloudAdapters } from './adapters/cloudAdapters';
 export { createJsonAdapters } from './adapters/jsonAdapters';
@@ -9,6 +10,8 @@ export { createAuthAdapters } from './adapters/authAdapters';
 export { authoringPreview, createMemoryCache, createSpaceAdapters, fixedSpace, presentsCredential, refuse, verifiedDomain, wildcardSubdomain } from './adapters/space';
 export { createLocalFontStore, hostedPathsOf } from './core/fontStore';
 export { createMemoryDraftStore, takeDraftOverride } from './modules/ssr/preview';
+export { createMemoryPubSub } from './modules/realtime/memoryPubSub';
+export { createRedisPubSub } from './modules/realtime/redisPubSub';
 export { PREVIEW_TOKEN_PARAM } from './core/previewToken';
 export { resolveRscData } from './modules/rsc/resolveRscData';
 export { fetchConnectorRecords, rebaseMedia, writeConnectorRecord, createConnectorResolver } from './modules/connectors';
@@ -19,6 +22,8 @@ export type { AuthoringPreviewOptions, DeploymentRow, FrameAncestorsConfig, Spac
 export type { RscElementResolver, RscResolveContext, ResolveRscDataOptions } from './modules/rsc/resolveRscData';
 export type { ConnectorAuth, ConnectorCredential, ConnectorEndpoints, ConnectorFilter, ConnectorLookups, ConnectorManifest, ConnectorManifestDraft, ConnectorPageInfo, ConnectorPagination, ConnectorQuery, ConnectorReadEndpoint, ConnectorRecord, ConnectorResponseMapping, ConnectorResult, ProviderPagination } from './modules/connectors';
 export type { FontStore, StoredFont } from './core/fontStore';
+export type { PubSubAdapter, SSRRealtimeConfig } from '@plitzi/sdk-shared';
+export type { RedisPubSubClients } from './modules/realtime/redisPubSub';
 export type { ResolvedServices } from './core/createServer';
 export type { Closable, CloseOnSignalsOptions } from './core/server/closeOnSignals';
 export type { BaseContext, PipelineExtensions, SSRContext, Stage } from './core/http/types';

package/dist/index.js

@@ -1,4 +1,6 @@
+import { consoleLogger, isLogged, logLevelOf, renderLogEvent, serverLog } from "./helpers/serverLog.js";
 import { fetchConnectorRecords, rebaseMedia, writeConnectorRecord } from "./modules/connectors/engine.js";
+import { createMemoryPubSub } from "./modules/realtime/memoryPubSub.js";
 import { createConnectorResolver } from "./modules/connectors/resolver.js";
 import { resolveRscData } from "./modules/rsc/resolveRscData.js";
 import { PREVIEW_TOKEN_PARAM } from "./core/previewToken.js";
@@ -7,7 +9,7 @@ import { resolveServices } from "./core/services/resolve.js";
 import { buildHealthPayload, registerHealthCheck } from "./core/health.js";
 import { createServer } from "./core/createServer.js";
 import { closeOnSignals } from "./core/server/closeOnSignals.js";
-import { consoleLogger, renderLogEvent } from "./helpers/serverLog.js";
+import { loadFunctions, readFunctionsDir } from "./modules/functions/load.js";
 import { createCloudAdapters } from "./adapters/cloudAdapters.js";
 import { createJsonAdapters } from "./adapters/jsonAdapters.js";
 import { createAuthAdapters } from "./adapters/authAdapters.js";
@@ -15,4 +17,5 @@ import { createMemoryCache, refuse } from "./adapters/space/types.js";
 import { authoringPreview, fixedSpace, presentsCredential, verifiedDomain, wildcardSubdomain } from "./adapters/space/resolvers.js";
 import { createSpaceAdapters } from "./adapters/space/index.js";
 import { createLocalFontStore, hostedPathsOf } from "./core/fontStore.js";
-export { PREVIEW_TOKEN_PARAM, authoringPreview, buildHealthPayload, closeOnSignals, consoleLogger, createAuthAdapters, createCloudAdapters, createConnectorResolver, createJsonAdapters, createLocalFontStore, createMemoryCache, createMemoryDraftStore, createServer, createSpaceAdapters, fetchConnectorRecords, fixedSpace, hostedPathsOf, presentsCredential, rebaseMedia, refuse, registerHealthCheck, renderLogEvent, resolveRscData, resolveServices, takeDraftOverride, verifiedDomain, wildcardSubdomain, writeConnectorRecord };
+import { createRedisPubSub } from "./modules/realtime/redisPubSub.js";
+export { PREVIEW_TOKEN_PARAM, authoringPreview, buildHealthPayload, closeOnSignals, consoleLogger, createAuthAdapters, createCloudAdapters, createConnectorResolver, createJsonAdapters, createLocalFontStore, createMemoryCache, createMemoryDraftStore, createMemoryPubSub, createRedisPubSub, createServer, createSpaceAdapters, fetchConnectorRecords, fixedSpace, hostedPathsOf, isLogged, loadFunctions, logLevelOf, presentsCredential, readFunctionsDir, rebaseMedia, refuse, registerHealthCheck, renderLogEvent, resolveRscData, resolveServices, serverLog, takeDraftOverride, verifiedDomain, wildcardSubdomain, writeConnectorRecord };

package/dist/kernel.d.ts

@@ -16,8 +16,9 @@ export { healthStage } from './core/http/stages/health';
 export { configStaticStage, publicDirStage, wellKnownStage } from './core/http/stages/static';
 export { buildHealthPayload, registerHealthCheck } from './core/health';
 export { clientIp, parseRequest, readRawBody, requestOrigin } from './core/requestParser';
-export { consoleLogger, renderLogEvent } from './helpers/serverLog';
+export { consoleLogger, isLogged, logLevelOf, renderLogEvent, serverLog } from './helpers/serverLog';
 export { PREVIEW_TOKEN_PARAM } from './core/previewToken';
+export { assertOutboundAllowed, isBlockedHost } from './helpers/outboundGuard';
 export type { HttpServerParts } from './core/server/baseServer';
 export type { BuildContext } from './core/http/dispatcher';
 export type { HealthCheckApp, HealthIdentity } from './core/health';

package/dist/kernel.js

@@ -1,3 +1,5 @@
+import { consoleLogger, isLogged, logLevelOf, renderLogEvent, serverLog } from "./helpers/serverLog.js";
+import { assertOutboundAllowed, isBlockedHost } from "./helpers/outboundGuard.js";
 import { clientIp, parseRequest, readRawBody, requestOrigin } from "./core/requestParser.js";
 import { createHttpServer } from "./core/server/baseServer.js";
 import { PREVIEW_TOKEN_PARAM } from "./core/previewToken.js";
@@ -5,5 +7,4 @@ import { makeHandler } from "./core/http/dispatcher.js";
 import { buildHealthPayload, registerHealthCheck } from "./core/health.js";
 import { healthStage } from "./core/http/stages/health.js";
 import { configStaticStage, publicDirStage, wellKnownStage } from "./core/http/stages/static.js";
-import { consoleLogger, renderLogEvent } from "./helpers/serverLog.js";
-export { PREVIEW_TOKEN_PARAM, buildHealthPayload, clientIp, configStaticStage, consoleLogger, createHttpServer, healthStage, makeHandler, parseRequest, publicDirStage, readRawBody, registerHealthCheck, renderLogEvent, requestOrigin, wellKnownStage };
+export { PREVIEW_TOKEN_PARAM, assertOutboundAllowed, buildHealthPayload, clientIp, configStaticStage, consoleLogger, createHttpServer, healthStage, isBlockedHost, isLogged, logLevelOf, makeHandler, parseRequest, publicDirStage, readRawBody, registerHealthCheck, renderLogEvent, requestOrigin, serverLog, wellKnownStage };

package/dist/modules/actions/connectorWrite.js

@@ -1,3 +1,4 @@
+import { serverLog } from "../../helpers/serverLog.js";
 import { writeConnectorRecord } from "../connectors/engine.js";
 //#region src/modules/actions/connectorWrite.ts
 var parseBody = (body) => {
@@ -72,7 +73,7 @@ var handleAction = async (req, res, config, lookups) => {
 		res.setHeader("Cache-Control", "no-store");
 		res.send(JSON.stringify({ record: record ?? null }));
 	} catch (err) {
-		console.error("[Action] connector write failed:", err);
+		serverLog.error("Action", "connector write failed", err);
 		fail(res, 502, "Connector write failed");
 	}
 };

package/dist/modules/actions/index.d.ts

@@ -1,10 +1,35 @@
 import { ActionJobs } from './jobs';
 import { RunGuards } from './runtime/guards';
 import { ActionRunner } from './runtime/runAction';
-import { ActionKvStore, ActionsConfig, ActionTaskRegistry, ResolvedActionLimits } from './types';
+import { ActionKvStore, ActionsConfig, ActionTaskRegistry, ResolvedActionLimits, SpaceRevision } from './types';
+import { FunctionsSource } from '../functions/build';
+import { ManifestReading } from '../functions/manifest';
+import { RouteHandler, RouteVisit } from '../functions/routes';
+import { PreparedFunctions } from '../functions/space';
 import { ActionDocument } from '@plitzi/sdk-shared';
 export type ActionsModule = ActionRunner & {
+    /** The deployment's own tasks: shipped, and its native functions. */
     registry: ActionTaskRegistry;
+    /**
+     * What a space's actions can use as of that revision: the deployment's tasks and the space's own functions — what
+     * its catalog offers, what a check checks against and what its runs run.
+     */
+    registryFor: (spaceId: number, at?: SpaceRevision) => Promise<ActionTaskRegistry>;
+    /**
+     * A space's functions source, built, read and checked — ready to store, or the problems to show where they are. The
+     * one way a space's functions become storable; refused when this server has no runner.
+     */
+    prepareFunctions: (source: FunctionsSource) => Promise<PreparedFunctions>;
+    /**
+     * What a space's code declares, read by every rule a saved space's functions meet — for code that is not built here:
+     * a space runtime's, described by the runtime itself when it starts. The manifest, and the problems that refuse it.
+     */
+    readManifest: (declared: unknown) => ManifestReading;
+    /**
+     * The function that answers `method path` under `/api/` for this visit — the deployment's own routes, then the space's
+     * — or none, and the page server answers as it would have.
+     */
+    routeFor: (visit: RouteVisit, method: string, path: string) => Promise<RouteHandler | undefined>;
     guards: RunGuards;
     /** The key/value store, namespaced to one space — the same one the `kv` tasks write through, so a rate limit the
      *  transport keeps and a counter a flow keeps cannot end up in different places. */
@@ -20,16 +45,10 @@ export type ActionsModule = ActionRunner & {
      */
     jobs?: ActionJobs;
 };
-/**
- * The module's whole public surface: build it once from the deployment's config, then run actions through it.
- *
- * Constructed rather than imported piecemeal so the task registry is validated ONCE, at boot, and so the guards
- * are a single set for the process — two instances would each think they were the only run in flight, which is
- * the same as having no single-flight at all. Nothing outside this folder needs to know how a run is assembled.
- */
-export declare const createActionsModule: (config: ActionsConfig) => ActionsModule;
-export { ActionRunError } from './runtime/errors';
+export declare const createActionsModule: (given: ActionsConfig) => ActionsModule;
+export { ActionRefusal, ActionRunError } from './runtime/errors';
 export { precheckRun } from './runtime/precheck';
+export { spaceKvPatterns } from './runtime/namespaceKv';
 export { checkAction } from './runtime/check';
 export { DEFAULT_LIMITS, resolveLimits } from './runtime/limits';
 export { createRunGuards, deriveRunKey } from './runtime/guards';

package/dist/modules/actions/index.js

@@ -2,15 +2,19 @@ import "./jobs/memoryQueue.js";
 import "./jobs/scheduler.js";
 import "./runtime/errors.js";
 import "./jobs/worker.js";
+import { fleetStore } from "../../core/server/fleet/link.js";
 import { createActionJobs } from "./jobs/index.js";
 import { createRunGuards } from "./runtime/guards.js";
 import { createKvStore } from "./runtime/kvStore.js";
 import { resolveLimits } from "./runtime/limits.js";
-import { createMemoryKv } from "./runtime/memoryKv.js";
-import { namespaceKv } from "./runtime/namespaceKv.js";
+import { KV_METHODS, createMemoryKv } from "./runtime/memoryKv.js";
+import { namespaceKv, spaceKvPatterns } from "./runtime/namespaceKv.js";
 import "./runtime/precheck.js";
 import { createActionRunner } from "./runtime/runAction.js";
 import { createTaskRegistry } from "./tasks/registry.js";
+import { readManifest } from "../functions/manifest.js";
+import { createRoutes } from "../functions/routes.js";
+import { createSpaceRegistries, prepareFunctions } from "../functions/space.js";
 import "./runtime/check.js";
 import "./runtime/runLogger.js";
 import "./taskCatalog.js";
@@ -27,9 +31,32 @@ import { handleActionCancel } from "./transport/cancelHandler.js";
 * are a single set for the process — two instances would each think they were the only run in flight, which is
 * the same as having no single-flight at all. Nothing outside this folder needs to know how a run is assembled.
 */
-var createActionsModule = (config) => {
-	const registry = createTaskRegistry(config.tasks, { db: (config.dbDrivers?.length ?? 0) > 0 });
-	const { runAction } = createActionRunner(config, registry, config.fetchImpl);
+/**
+* The workers of one server are one replica, so with no `kv` configured they share the primary's: a flow's counter,
+* a webhook's rate limit, a run's single-flight key, a cancel and a replayed answer then mean the same whichever
+* worker the request lands on — the path a deployment with its own shared store already takes. One process keeps
+* its own map.
+*/
+var withFleetKv = (config) => {
+	if (config.kv) return config;
+	return {
+		...config,
+		kv: fleetStore("actions.kv", KV_METHODS) ?? createMemoryKv()
+	};
+};
+var createActionsModule = (given) => {
+	const config = withFleetKv(given);
+	const registry = createTaskRegistry(config.functions?.native, { db: (config.dbDrivers?.length ?? 0) > 0 });
+	const spaceRegistries = createSpaceRegistries(registry, config.functions);
+	const reserved = new Set(registry.list().map((task) => task.namespace));
+	const registryFor = async (spaceId, at) => spaceRegistries.registryFor(await config.lookups.getFunctions?.(spaceId, at));
+	const registryForRun = (request) => Object.values(request.entry.document.nodes).every((node) => node.type !== "task" || !node.action || registry.get(node.action)) ? registry : registryFor(request.spaceId, request.at);
+	const { runAction, taskContext } = createActionRunner(config, registryForRun, config.fetchImpl);
+	const routes = createRoutes({
+		config: config.functions ?? {},
+		...config.lookups.getFunctions ? { getFunctions: config.lookups.getFunctions } : {},
+		taskContext
+	});
 	/**
 	* Single-flight over the store the deployment already gave the `kv` tasks — its own Redis, table or whatever it
 	* runs — because per process it is not a guarantee: the same double-click behind a load balancer lands on two
@@ -41,6 +68,16 @@ var createActionsModule = (config) => {
 	const module = {
 		runAction,
 		registry,
+		registryFor,
+		routeFor: routes.routeFor,
+		prepareFunctions: (source) => {
+			const runner = config.functions?.runner;
+			return runner ? prepareFunctions(source, runner, reserved) : Promise.resolve({
+				ok: false,
+				problems: [{ message: "This server runs no space functions" }]
+			});
+		},
+		readManifest: (declared) => readManifest(declared, reserved),
 		guards,
 		kv: (spaceId) => namespaceKv(kv, spaceId),
 		limitsFor
@@ -49,4 +86,4 @@ var createActionsModule = (config) => {
 	return module;
 };
 //#endregion
-export { createActionsModule, handleActionCall, handleActionCancel, handleActionCatalog, handleActionWebhook };
+export { createActionsModule, handleActionCall, handleActionCancel, handleActionCatalog, handleActionWebhook, spaceKvPatterns };

package/dist/modules/actions/jobs/failureStreak.d.ts

@@ -0,0 +1,17 @@
+/** How long a pass may keep failing before it is reported as the error it has become. */
+export declare const FAILURE_STREAK_ESCALATION_MS = 60000;
+export type FailureStreak = {
+    failed: (error: unknown) => void;
+    succeeded: () => void;
+};
+/**
+ * How a pass that runs again by itself reports failing: a schedule sweep, a claim, a heartbeat.
+ *
+ * A store that drops its connections for a moment — a failover, a driver resetting its pool because the host stalled
+ * — fails one pass, and the next, seconds later, works. Nothing is lost: every pass is safe to repeat. Reported as an
+ * error with a stack, each of those read as an incident, and the ones that are an incident read the same.
+ *
+ * So the first failure of a streak is a warning with its reason; a streak still going after `escalateAfterMs` is the
+ * error, with the whole cause, once; and the pass that ends a streak that got that far says so.
+ */
+export declare const createFailureStreak: (scope: string, what: string, escalateAfterMs?: number, now?: () => number) => FailureStreak;

package/dist/modules/actions/jobs/failureStreak.js

@@ -0,0 +1,47 @@
+import { serverLog } from "../../../helpers/serverLog.js";
+//#region src/modules/actions/jobs/failureStreak.ts
+/** How long a pass may keep failing before it is reported as the error it has become. */
+var FAILURE_STREAK_ESCALATION_MS = 6e4;
+var reasonOf = (error) => error instanceof Error ? error.message : String(error);
+/**
+* How a pass that runs again by itself reports failing: a schedule sweep, a claim, a heartbeat.
+*
+* A store that drops its connections for a moment — a failover, a driver resetting its pool because the host stalled
+* — fails one pass, and the next, seconds later, works. Nothing is lost: every pass is safe to repeat. Reported as an
+* error with a stack, each of those read as an incident, and the ones that are an incident read the same.
+*
+* So the first failure of a streak is a warning with its reason; a streak still going after `escalateAfterMs` is the
+* error, with the whole cause, once; and the pass that ends a streak that got that far says so.
+*/
+var createFailureStreak = (scope, what, escalateAfterMs = FAILURE_STREAK_ESCALATION_MS, now = Date.now) => {
+	let since;
+	let failures = 0;
+	let escalated = false;
+	return {
+		failed: (error) => {
+			failures += 1;
+			if (since === void 0) {
+				since = now();
+				serverLog.warn(scope, `${what} failed, trying again`, reasonOf(error));
+				return;
+			}
+			const elapsed = now() - since;
+			if (!escalated && elapsed >= escalateAfterMs) {
+				escalated = true;
+				serverLog.error(scope, `${what} has been failing for ${String(Math.round(elapsed / 1e3))}s`, error);
+			}
+		},
+		succeeded: () => {
+			if (since === void 0) return;
+			if (escalated) {
+				const seconds = Math.round((now() - since) / 1e3);
+				serverLog.info(scope, `${what} is working again, after ${String(failures)} failures over ${String(seconds)}s`);
+			}
+			since = void 0;
+			failures = 0;
+			escalated = false;
+		}
+	};
+};
+//#endregion
+export { FAILURE_STREAK_ESCALATION_MS, createFailureStreak };

package/dist/modules/actions/jobs/failureStreak.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/actions/jobs/index.d.ts

@@ -20,7 +20,8 @@ export type ActionJobs = {
  *
  * With no `queue` supplied this is one process's memory, which is right for a single replica and wrong the moment
  * there are two. That is a sentence rather than a silent behaviour because the failure is invisible: everything
- * works, and the nightly email goes out once per replica.
+ * works, and the nightly email goes out once per replica. The workers of one server are one replica: they share
+ * the primary's queue, and only one of them runs the scheduler and the jobs (`runsFleetJobs`).
  */
 export declare const createActionJobs: (config: ActionJobsConfig, module: ActionsModule, lookups: ActionLookups) => ActionJobs;
 export { createMemoryJobQueue } from './memoryQueue';

package/dist/modules/actions/jobs/index.js

@@ -1,7 +1,8 @@
-import { createMemoryJobQueue } from "./memoryQueue.js";
+import { JOB_QUEUE_METHODS, createMemoryJobQueue } from "./memoryQueue.js";
 import { DEFAULT_MAX_ATTEMPTS, scheduleFor, scheduleJobId, schedulesFor } from "./schedules.js";
 import { createScheduler } from "./scheduler.js";
 import { createJobWorker } from "./worker.js";
+import { fleetStore } from "../../../core/server/fleet/link.js";
 //#region src/modules/actions/jobs/index.ts
 /**
 * The scheduling half of actions: a producer, a consumer and the store they meet in.
@@ -13,10 +14,11 @@ import { createJobWorker } from "./worker.js";
 *
 * With no `queue` supplied this is one process's memory, which is right for a single replica and wrong the moment
 * there are two. That is a sentence rather than a silent behaviour because the failure is invisible: everything
-* works, and the nightly email goes out once per replica.
+* works, and the nightly email goes out once per replica. The workers of one server are one replica: they share
+* the primary's queue, and only one of them runs the scheduler and the jobs (`runsFleetJobs`).
 */
 var createActionJobs = (config, module, lookups) => {
-	const queue = config.queue ?? createMemoryJobQueue();
+	const queue = config.queue ?? fleetStore("actions.jobs", JOB_QUEUE_METHODS) ?? createMemoryJobQueue();
 	const { produce = true, workers = 4 } = config;
 	const scheduler = createScheduler({
 		queue,

package/dist/modules/actions/jobs/memoryQueue.d.ts

@@ -1,3 +1,4 @@
+import { StoreMethods } from '../../../core/server/fleet/channel';
 import { ActionJobQueue } from '@plitzi/sdk-shared';
 export type MemoryJobQueueOptions = {
     /**
@@ -16,6 +17,8 @@ export type MemoryJobQueueOptions = {
      */
     clock?: () => number;
 };
+/** Every method of the queue, for the copy a server's workers share (see `fleet/stores.ts`). */
+export declare const JOB_QUEUE_METHODS: StoreMethods<ActionJobQueue>;
 /**
  * The default queue: one process's Maps.
  *

package/dist/modules/actions/jobs/memoryQueue.js

@@ -5,6 +5,22 @@ var TERMINAL = /* @__PURE__ */ new Set([
 	"dead",
 	"cancelled"
 ]);
+/** Every method of the queue, for the copy a server's workers share (see `fleet/stores.ts`). */
+var JOB_QUEUE_METHODS = {
+	now: true,
+	enqueue: true,
+	claim: true,
+	heartbeat: true,
+	settle: true,
+	dueSchedules: true,
+	advanceSchedule: true,
+	putSchedules: true,
+	listJobs: true,
+	getJob: true,
+	listSchedules: true,
+	requeue: true,
+	cancel: true
+};
 /**
 * The default queue: one process's Maps.
 *
@@ -175,4 +191,4 @@ var createMemoryJobQueue = ({ retainFinished = 500, clock = Date.now } = {}) =>
 	};
 };
 //#endregion
-export { createMemoryJobQueue };
+export { JOB_QUEUE_METHODS, createMemoryJobQueue };

package/dist/modules/actions/jobs/scheduler.d.ts

@@ -16,6 +16,8 @@ export type SchedulerOptions = {
     reconcileMs?: number;
     /** The spaces to reconcile, for a server that serves a known few. `listScheduledSpaces` wins over it. */
     spaces?: number[];
+    /** Every failed pass, in place of the default report — a warning, then an error once a pass has kept failing for a
+     *  minute (see `createFailureStreak`). */
     onError?: (error: unknown) => void;
 };
 export type SweepResult = {

package/dist/modules/actions/jobs/scheduler.js

@@ -1,3 +1,5 @@
+import { serverLog } from "../../../helpers/serverLog.js";
+import { createFailureStreak } from "./failureStreak.js";
 import { scheduleJobId, schedulesFor } from "./schedules.js";
 import { cronFiresBetween, cronNextFire } from "@plitzi/sdk-shared/actions";
 //#region src/modules/actions/jobs/scheduler.ts
@@ -25,7 +27,7 @@ var PARK_MS = 2108160 * MINUTE_MS;
 * first occurrence after now, recording how many went by. A digest missed for a day sends once and says it missed
 * 23 — rather than sending 23 times, which is how a scheduler that "catches up" turns an outage into an incident.
 */
-var createScheduler = ({ queue, lookups, environment = "main", pollMs = 15e3, batch = 200, maxAttempts = 3, reconcileMs = 15 * MINUTE_MS, spaces, onError = (error) => console.error("[Actions] schedule sweep failed:", error) }) => {
+var createScheduler = ({ queue, lookups, environment = "main", pollMs = 15e3, batch = 200, maxAttempts = 3, reconcileMs = 15 * MINUTE_MS, spaces, onError }) => {
 	let timer;
 	let reconcileTimer;
 	let running = false;
@@ -86,14 +88,17 @@ var createScheduler = ({ queue, lookups, environment = "main", pollMs = 15e3, ba
 	const reconcileAll = async () => {
 		for (const spaceId of await scheduledSpaces()) await reconcile(spaceId);
 	};
+	const sweepFailures = createFailureStreak("Actions", "schedule sweep");
+	const reconcileFailures = createFailureStreak("Actions", "schedule reconcile");
 	/** One pass at a time per replica: a sweep that outlives its interval must not have a second one land on top. */
-	const guarded = async (pass) => {
+	const guarded = async (pass, failures) => {
 		if (running) return;
 		running = true;
 		try {
 			await pass();
+			failures.succeeded();
 		} catch (error) {
-			onError(error);
+			(onError ?? failures.failed)(error);
 		} finally {
 			running = false;
 		}
@@ -103,14 +108,14 @@ var createScheduler = ({ queue, lookups, environment = "main", pollMs = 15e3, ba
 		reconcile,
 		start: () => {
 			if (timer) return;
-			timer = setInterval(() => void guarded(sweep), pollMs + Math.floor(Math.random() * 1e3));
+			timer = setInterval(() => void guarded(sweep, sweepFailures), pollMs + Math.floor(Math.random() * 1e3));
 			timer.unref();
 			if (!lookups.listScheduledSpaces && !spaces?.length) {
-				console.warn("[Actions] schedules are running but nothing says which spaces to watch. Name them as `action.jobs.spaces`, or answer `action.lookups.listScheduledSpaces`.");
+				serverLog.warn("Actions", "schedules are running but nothing says which spaces to watch. Name them as `action.jobs.spaces`, or answer `action.lookups.listScheduledSpaces`.");
 				return;
 			}
-			guarded(reconcileAll);
-			reconcileTimer = setInterval(() => void guarded(reconcileAll), reconcileMs);
+			guarded(reconcileAll, reconcileFailures);
+			reconcileTimer = setInterval(() => void guarded(reconcileAll, reconcileFailures), reconcileMs);
 			reconcileTimer.unref();
 		},
 		stop: () => {

package/dist/modules/actions/jobs/worker.d.ts

@@ -35,6 +35,8 @@ export type JobWorkerOptions = {
     };
     /** Names this replica in the job history, so a bad one is identifiable. Defaults to the process and a random id. */
     workerId?: string;
+    /** Every failure, in place of the default report. By default a claim or a heartbeat that fails is a warning, and an
+     *  error once it has kept failing for a minute (see `createFailureStreak`); anything else is an error at once. */
     onError?: (error: unknown) => void;
 };
 export type JobWorker = {
@@ -59,4 +61,4 @@ export type JobWorker = {
     stop: () => Promise<void>;
     inFlight: () => number;
 };
-export declare const createJobWorker: ({ queue, lookups, module, workers, pollMs, leaseMs, backoff, workerId, onError }: JobWorkerOptions) => JobWorker;
+export declare const createJobWorker: ({ queue, lookups, module, workers, pollMs, leaseMs, backoff, workerId, onError: customOnError }: JobWorkerOptions) => JobWorker;

package/dist/modules/actions/jobs/worker.js

@@ -1,3 +1,5 @@
+import { serverLog } from "../../../helpers/serverLog.js";
+import { createFailureStreak } from "./failureStreak.js";
 import { ActionRunError } from "../runtime/errors.js";
 import { randomUUID } from "node:crypto";
 //#region src/modules/actions/jobs/worker.ts
@@ -31,7 +33,10 @@ var GIVE_UP = /* @__PURE__ */ new Set([
 	"forbidden",
 	"recursion"
 ]);
-var createJobWorker = ({ queue, lookups, module, workers = 4, pollMs = 1e3, leaseMs = 3e4, backoff = {}, workerId = `${process.pid}-${randomUUID().slice(0, 8)}`, onError = (error) => console.error("[Actions] job worker failed:", error) }) => {
+var createJobWorker = ({ queue, lookups, module, workers = 4, pollMs = 1e3, leaseMs = 3e4, backoff = {}, workerId = `${process.pid}-${randomUUID().slice(0, 8)}`, onError: customOnError }) => {
+	const onError = customOnError ?? ((error) => serverLog.error("Actions", "job worker failed", error));
+	const claimFailures = createFailureStreak("Actions", "job claim");
+	const heartbeatFailures = createFailureStreak("Actions", "job heartbeat");
 	const { baseMs = 3e4, maxMs = 9e5 } = backoff;
 	const active = /* @__PURE__ */ new Map();
 	/** Every job this worker started, until it has settled — what `stop()` waits for. */
@@ -223,7 +228,7 @@ var createJobWorker = ({ queue, lookups, module, workers = 4, pollMs = 1e3, leas
 	/** One pass at a time, and the one under way is kept so `stop()` can wait for the claim it may be making. */
 	const guarded = async () => {
 		if (pass) return;
-		pass = poll().then(() => void 0).catch(onError).finally(() => {
+		pass = poll().then(() => claimFailures.succeeded()).catch(customOnError ?? claimFailures.failed).finally(() => {
 			pass = void 0;
 		});
 		await pass;
@@ -236,7 +241,7 @@ var createJobWorker = ({ queue, lookups, module, workers = 4, pollMs = 1e3, leas
 			if (timer || workers <= 0) return;
 			timer = setInterval(() => void guarded(), pollMs);
 			timer.unref();
-			heart = setInterval(() => void beat().catch(onError), Math.max(1e3, Math.floor(leaseMs / 3)));
+			heart = setInterval(() => void beat().then(() => heartbeatFailures.succeeded()).catch(customOnError ?? heartbeatFailures.failed), Math.max(1e3, Math.floor(leaseMs / 3)));
 			heart.unref();
 		},
 		stop: async () => {
@@ -244,7 +249,7 @@ var createJobWorker = ({ queue, lookups, module, workers = 4, pollMs = 1e3, leas
 			clearInterval(timer);
 			timer = void 0;
 			await pass;
-			if (inFlight.size > 0) console.info(`[Actions] waiting for ${inFlight.size} running job(s) to finish before stopping`);
+			if (inFlight.size > 0) serverLog.info("Actions", `waiting for ${inFlight.size} running job(s) to finish before stopping`);
 			/**
 			* Drained rather than abandoned: a deploy finishes the jobs it started instead of leaving them to be retried.
 			*

package/dist/modules/actions/moduleFor.js

@@ -1,4 +1,5 @@
 import { createActionsModule } from "./index.js";
+import { realtimeModuleFor } from "../realtime/index.js";
 //#region src/modules/actions/moduleFor.ts
 /**
 * The one actions module for a server, whoever asks first.
@@ -19,16 +20,18 @@ var actionsModuleFor = (config) => {
 	if (existing) return existing;
 	const module = createActionsModule({
 		lookups,
-		tasks: config.action?.tasks,
+		functions: config.functions,
 		limits: config.action?.limits,
 		concurrency: config.action?.concurrency,
 		kv: config.action?.kv,
 		jobs: config.action?.jobs,
 		rateLimit: config.action?.rateLimit,
 		idempotency: config.action?.idempotency,
+		signingSecret: config.action?.signingSecret,
 		dbDrivers: config.action?.dbDrivers,
 		email: config.action?.email,
-		onRun: config.action?.onRun
+		onRun: config.action?.onRun,
+		realtime: realtimeModuleFor(config)
 	});
 	modules.set(config, module);
 	return module;

package/dist/modules/actions/runtime/errors.d.ts

@@ -14,3 +14,15 @@ export declare class ActionRunError extends Error {
     steps?: ActionRunStep[];
     constructor(reason: ActionErrorReason, message: string);
 }
+/**
+ * A step refusing to go on, with a reason written for whoever called — a password too easy to guess, a board that is
+ * read-only, a quota reached.
+ *
+ * What any other step throws stays in the run's record and never reaches the caller: an error can carry a query, a
+ * URL, a credential's name, and a page is shown to anybody. This one says, by its type, that its message was written
+ * to be read. A run that ends on it answers `status: 'failed'` with the message as `error`, which a page's flow reads
+ * as `{{ step.error }}` — the same place a refusal before the run began puts its own.
+ */
+export declare class ActionRefusal extends Error {
+    constructor(message: string);
+}

package/dist/modules/actions/runtime/errors.js

@@ -18,5 +18,20 @@ var ActionRunError = class extends Error {
 		this.reason = reason;
 	}
 };
+/**
+* A step refusing to go on, with a reason written for whoever called — a password too easy to guess, a board that is
+* read-only, a quota reached.
+*
+* What any other step throws stays in the run's record and never reaches the caller: an error can carry a query, a
+* URL, a credential's name, and a page is shown to anybody. This one says, by its type, that its message was written
+* to be read. A run that ends on it answers `status: 'failed'` with the message as `error`, which a page's flow reads
+* as `{{ step.error }}` — the same place a refusal before the run began puts its own.
+*/
+var ActionRefusal = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ActionRefusal";
+	}
+};
 //#endregion
-export { ActionRunError };
+export { ActionRefusal, ActionRunError };

package/dist/modules/actions/runtime/kvChange.d.ts

@@ -0,0 +1,27 @@
+/** What a change needs of a store: read a key, and write it only if it still holds what was read. */
+export type KvChangeStore<V> = {
+    get: (key: string) => Promise<V | undefined>;
+    swap: (key: string, expected: V | undefined, next: V, ttlSeconds?: number) => Promise<boolean>;
+};
+/**
+ * The lifetime a change writes with: a number of seconds, one worked out from the value written, or none.
+ */
+export type KvChangeLifetime<T> = number | ((next: T) => number | undefined);
+export type KvChangeOptions<T> = {
+    lifetime?: KvChangeLifetime<T> | undefined;
+    /**
+     * The error a change that kept losing ends with — an `ActionRefusal` where there is one to make: being too busy is
+     * something to tell whoever asked, not a fault. Handed in because this function may import nothing.
+     */
+    refusal: (message: string) => Error;
+};
+/**
+ * Reads `key`, hands its value to `change`, and writes back what that answers — unless somebody wrote in between, and
+ * then it reads again and asks again. `change` answering `undefined` writes nothing. Answers what was written, or
+ * `undefined` when nothing was. Losing every time ends in `refusal`, whose message names no key: it is for a visitor.
+ *
+ * The one read-change-write there is: `ctx.kv.change`, a list's writes, and the sandbox's `ctx.kv.change` too — its
+ * guest is handed THIS function's source (`isolate.ts`), so it must stay self-contained: no import, nothing of this
+ * module's, only what the guest's globals also have (`setTimeout`, `Math`).
+ */
+export declare const changeKv: <V, T extends V>(store: KvChangeStore<V>, key: string, change: (current: V | undefined) => T | undefined | Promise<T | undefined>, { lifetime, refusal }: KvChangeOptions<T>) => Promise<T | undefined>;

package/dist/modules/actions/runtime/kvChange.js

@@ -0,0 +1,23 @@
+//#region src/modules/actions/runtime/kvChange.ts
+/**
+* Reads `key`, hands its value to `change`, and writes back what that answers — unless somebody wrote in between, and
+* then it reads again and asks again. `change` answering `undefined` writes nothing. Answers what was written, or
+* `undefined` when nothing was. Losing every time ends in `refusal`, whose message names no key: it is for a visitor.
+*
+* The one read-change-write there is: `ctx.kv.change`, a list's writes, and the sandbox's `ctx.kv.change` too — its
+* guest is handed THIS function's source (`isolate.ts`), so it must stay self-contained: no import, nothing of this
+* module's, only what the guest's globals also have (`setTimeout`, `Math`).
+*/
+var changeKv = async (store, key, change, { lifetime, refusal }) => {
+	const attempts = 25;
+	for (let attempt = 0; attempt < attempts; attempt += 1) {
+		const current = await store.get(key);
+		const next = await change(current);
+		if (next === void 0) return;
+		if (await store.swap(key, current, next, typeof lifetime === "function" ? lifetime(next) : lifetime)) return next;
+		await new Promise((resolve) => setTimeout(resolve, Math.random() * Math.min(5 + attempt * 5, 50)));
+	}
+	throw refusal("Many people are changing this at once — try again in a moment");
+};
+//#endregion
+export { changeKv };