@plitzi/sdk-server 0.37.2 → 0.37.4

package/dist/modules/actions/runtime/runAction.js

@@ -1,18 +1,19 @@
-import { ActionRunError } from "./errors.js";
+import { serverLog } from "../../../helpers/serverLog.js";
+import { ActionRefusal, ActionRunError } from "./errors.js";
 import { runCancelKey } from "./guards.js";
 import { createKvStore } from "./kvStore.js";
 import { resolveLimits } from "./limits.js";
 import { createMemoryKv } from "./memoryKv.js";
-import { namespaceKv } from "./namespaceKv.js";
 import { createEmailSender } from "./email.js";
 import { createRedactor, projectUser } from "./scope.js";
 import { precheckRun } from "./precheck.js";
+import { createSigning } from "./signing.js";
+import { createRunFetch, taskContextFor } from "./taskContext.js";
 import onAbort from "../../../helpers/onAbort.js";
 import { FAILURE_HANDLER_TASK } from "@plitzi/sdk-shared/actions";
 import { evaluateRuleGroup } from "@plitzi/sdk-shared/helpers/ruleEvaluator";
-import { hasValidToken, processTwig } from "@plitzi/sdk-shared/helpers/twigWrapper";
+import { resolveStepParam } from "@plitzi/sdk-shared/helpers/twigWrapper";
 //#region src/modules/actions/runtime/runAction.ts
-var MAX_TWIG_RESOLUTION_PASSES = 5;
 /** How often a run asks the shared store whether it has been cancelled. Once a second is far finer than the
 *  boundaries a flow actually has, and it keeps a long run to sixty reads a minute. */
 var CANCEL_POLL_MS = 1e3;
@@ -77,79 +78,19 @@ var createCancelWatch = (store, runId) => {
 /**
 * Resolves twig in a node's params against the flow scope.
 *
-* Multi-pass with a ceiling, exactly as the client engine does: a value can resolve to another template, and
-* without the ceiling a self-referencing pair spins forever. Unresolved tokens are left as-is and show up in the
-* trace, which is how an author sees that a step referenced something the flow never produced.
+* With `resolveStepParam`, the resolver the browser's flows use too, so a param means the same on both sides: any
+* template syntax is run, the expression's own type is kept, and a value that resolves to another template is read
+* again up to a ceiling. Unresolved tokens are left as-is and show up in the trace, which is how an author sees that
+* a step referenced something the flow never produced.
 */
 var resolveParams = (params, scope, raw) => {
 	if (raw) return params;
 	return Object.entries(params).reduce((acum, [key, param]) => {
-		let value = param;
-		let passes = MAX_TWIG_RESOLUTION_PASSES;
-		while (typeof value === "string" && hasValidToken(value) && passes > 0) {
-			value = processTwig(value, scope, false, true);
-			passes--;
-		}
-		acum[key] = value;
+		acum[key] = typeof param === "string" ? resolveStepParam(param, scope).value : param;
 		return acum;
 	}, {});
 };
 /**
-* Holds an answer to what the run is allowed to carry.
-*
-* Two checks rather than one, because a body arrives in two ways. `Content-Length` is refused before a byte is
-* read, which is the cheap half; a chunked answer that declares nothing is counted AS it streams and errored the
-* moment it goes over — so the ceiling holds for a backend that lies about its size or never states one.
-*
-* The cap is on one response and not on the run: it exists so that a single answer cannot be unbounded, which is
-* a different failure from a flow that makes many small calls (that is `maxRequests`).
-*/
-var capped = (response, maxBytes) => {
-	const declared = Number(response.headers.get("content-length") ?? "");
-	if (Number.isFinite(declared) && declared > maxBytes) throw new ActionRunError("over_capacity", `Response is larger than the ${maxBytes} byte budget`);
-	if (!response.body) return response;
-	let seen = 0;
-	const counted = response.body.pipeThrough(new TransformStream({ transform: (chunk, controller) => {
-		seen += chunk.byteLength;
-		if (seen > maxBytes) {
-			controller.error(new ActionRunError("over_capacity", `Response exceeded the ${maxBytes} byte budget`));
-			return;
-		}
-		controller.enqueue(chunk);
-	} }));
-	return new Response(counted, {
-		status: response.status,
-		statusText: response.statusText,
-		headers: response.headers
-	});
-};
-/**
-* Counts outbound calls, refuses past the budget, caps what one answer may carry back, and stamps the run's
-* lineage on every one of them.
-*
-* The budget stops a loop from turning one run into a hundred requests. The lineage header is what makes the
-* OTHER loop detectable: an action whose HTTP step reaches its own space's webhook arrives carrying the chain
-* that led there, and the run it would start refuses itself. It names the space's own actions to a backend that
-* space configured, which is the cost of catching a cycle nothing else can see.
-*
-* Every ceiling lives HERE rather than in each task, because this is the only door a task has to the outside
-* world — a task that had to remember to count its own bytes is a task that will forget.
-*/
-var createRunFetch = (base, signal, limits, lineage) => {
-	let issued = 0;
-	return async (input, init) => {
-		issued += 1;
-		if (issued > limits.maxRequests) throw new ActionRunError("over_capacity", `Action exceeded its ${limits.maxRequests} outbound request budget`);
-		const headers = new Headers(init?.headers);
-		headers.set("X-Plitzi-Action-Lineage", lineage.join(","));
-		return capped(await base(input, {
-			...init,
-			headers,
-			signal: init?.signal ?? signal
-		}), limits.maxResponseBytes);
-	};
-};
-/**
 * Fills in what the node left out, from the task's own catalog entry.
 *
 * A task declares its params with a `defaultValue`, and a document written before a param existed simply has no
@@ -192,7 +133,7 @@ var failureHandlerOf = (nodes, trigger) => {
 	}
 };
 /** A step as a debugger may see it: what it was and how it ended, and nothing it was given or returned. */
-var stepOf = (node, { status, phase, startTime, endTime, error }) => ({
+var stepOf = (node, { status, phase, startTime, endTime, error, logs = [] }) => ({
 	id: node.id,
 	title: node.title || node.action,
 	action: node.action,
@@ -200,8 +141,12 @@ var stepOf = (node, { status, phase, startTime, endTime, error }) => ({
 	phase,
 	startTime,
 	endTime,
-	...error === void 0 ? {} : { error }
+	...error === void 0 ? {} : { error },
+	...logs.length ? { logs } : {}
 });
+/** What one step may log: enough to debug with, bounded so a loop that logs cannot fill a run's record. */
+var MAX_LOG_LINES = 100;
+var MAX_LOG_LINE = 1e3;
 var withDefaults = (task, params) => Object.entries(task.params).reduce((acum, [key, param]) => {
 	if (acum[key] === void 0 || acum[key] === "") acum[key] = param.defaultValue ?? "";
 	return acum;
@@ -234,18 +179,19 @@ var runNode = async (node, scope, registry, buildContext) => {
 * input contract — lives HERE rather than in a transport, because a deployment mounting its own trigger calls this
 * directly. A check in the endpoint would be a check a custom trigger silently skips.
 */
-var createActionRunner = (config, registry, baseFetch = fetch) => {
+var createActionRunner = (config, registryFor, baseFetch = fetch) => {
 	const kv = createKvStore(config.kv ?? createMemoryKv());
 	const emailSender = createEmailSender({
 		...config.email,
 		kv
 	});
+	const signing = config.signingSecret ? createSigning(config.signingSecret) : void 0;
 	/** Never allowed to fail a run: a logging outage must not take an action down, the same rule metering follows. */
 	const record = async (entry) => {
 		try {
 			await config.onRun?.(entry);
 		} catch (error) {
-			console.error("[Actions] run record failed:", error);
+			serverLog.error("Actions", "run record failed", error);
 		}
 	};
 	const runAction = async (request) => {
@@ -257,13 +203,13 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 			user: request.user,
 			lineage: request.lineage
 		});
+		const registry = await registryFor(request);
 		const limits = resolveLimits(config.limits, document.limits);
 		const redactor = createRedactor();
 		const redact = redactor.redact;
 		const controller = new AbortController();
 		const deadline = createDeadline(request.emit ? limits.streamTimeoutMs : limits.timeoutMs, controller);
 		const releaseOuter = onAbort(request.signal, () => controller.abort());
-		const scopedKv = namespaceKv(kv, request.spaceId);
 		const lineage = [...request.lineage ?? [], entry.id];
 		/**
 		* What a step runs with, for one abort signal and one outbound budget.
@@ -271,44 +217,12 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 		* Two of them per run at most: the flow's, and — only when it failed — the undo's, which must still be able to
 		* reach the outside world after the flow's signal was aborted or its request budget spent.
 		*/
-		const contextFor = (signal, runFetch) => (scope) => ({
-			runId,
-			spaceId: request.spaceId,
-			environment: request.environment,
-			trigger: request.trigger,
-			user: request.user,
-			callerId: request.callerId,
-			signal,
-			scope,
-			/**
-			* The secret a STEP asked for, resolved inside that step and never in the flow scope.
-			*
-			* There is no allow-list to check it against, deliberately: an action is authored by someone who may edit
-			* every action in the space, so a list they can edit is not a boundary — it only ever told the redactor what
-			* to look for, and the redactor now learns from what was actually resolved. What IS a boundary is that a
-			* credential reaches only the params of the step that named it, which is `renderTaskParams`' whole job.
-			*/
-			credential: async (identifier) => {
-				const credential = await config.lookups.getCredential?.(request.spaceId, identifier);
-				if (credential) redactor.add(credential);
-				return credential;
-			},
-			connector: async (connectorId) => {
-				const manifest = await config.lookups.getConnector?.(request.spaceId, connectorId, request.at);
-				if (!manifest) return;
-				const credential = manifest.credential ? await config.lookups.getCredential?.(request.spaceId, manifest.credential) : void 0;
-				if (credential) redactor.add(credential);
-				return {
-					manifest,
-					credential
-				};
-			},
-			fetch: runFetch,
-			kv: scopedKv,
-			dbDrivers: config.dbDrivers ?? [],
+		const contextFor = (signal, runFetch) => taskContextFor(config, {
+			kv,
 			email: emailSender,
-			emit: (chunk) => request.emit?.(redact(chunk))
-		});
+			redactor,
+			signing
+		}, request, signal, runFetch);
 		const buildContext = contextFor(controller.signal, createRunFetch(baseFetch, controller.signal, limits, lineage));
 		const trace = [];
 		const steps = [];
@@ -365,8 +279,15 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 		const runStep = async (node, phase, build) => {
 			const startTime = Date.now();
 			const late = () => phase === "flow" && flowSettled;
+			const logs = [];
+			const log = (line) => {
+				if (logs.length < MAX_LOG_LINES) logs.push(redact(line.length > MAX_LOG_LINE ? `${line.slice(0, MAX_LOG_LINE)}…` : line));
+			};
 			try {
-				const outcome = await runNode(node, scope, registry, build);
+				const outcome = await runNode(node, scope, registry, (stepScope) => ({
+					...build(stepScope),
+					log
+				}));
 				if (late()) return outcome;
 				const endTime = Date.now();
 				trace.push({
@@ -381,7 +302,8 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 					status: outcome.status,
 					phase,
 					startTime,
-					endTime
+					endTime,
+					logs
 				}));
 				request.onNode?.(node.id, outcome.status);
 				scope[node.id] = outcome.result;
@@ -403,7 +325,8 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 					phase,
 					startTime,
 					endTime,
-					error: message
+					error: message,
+					logs
 				}));
 				request.onNode?.(node.id, "failed");
 				throw error;
@@ -495,6 +418,8 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 		};
 		/** Set when the run ends in a way the CALLER has to hear as a status code rather than as a result. */
 		let fatal;
+		/** Set when a step refused with a reason written for the caller — the one failure a result may say the why of. */
+		let refusal;
 		try {
 			await Promise.race([runFlow(), deadline.promise]);
 		} catch (error) {
@@ -523,6 +448,7 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 				});
 			} else {
 				failure = error instanceof Error ? error.message : String(error);
+				if (error instanceof ActionRefusal) refusal = redact(error.message);
 				trace.push({
 					node: errorNode("error"),
 					status: "failed",
@@ -584,10 +510,20 @@ var createActionRunner = (config, registry, baseFetch = fetch) => {
 			status,
 			output: redact(output),
 			trace: [...trace],
-			steps: [...steps]
+			steps: [...steps],
+			...refusal === void 0 ? {} : { error: refusal }
 		};
 	};
-	return { runAction };
+	const taskContext = (contextRequest, signal, lineage) => taskContextFor(config, {
+		kv,
+		email: emailSender,
+		redactor: createRedactor(),
+		signing
+	}, contextRequest, signal, createRunFetch(baseFetch, signal, resolveLimits(config.limits, void 0), lineage))({});
+	return {
+		runAction,
+		taskContext
+	};
 };
 //#endregion
 export { createActionRunner };

package/dist/modules/actions/runtime/runLogger.d.ts

@@ -11,6 +11,9 @@ import { ActionRejectRecord, ActionRunRecord, ServerLogger } from '@plitzi/sdk-s
  * deployment that wants run HISTORY rather than run logs keeps its own `onRun` and writes rows; the two compose,
  * since `onRun` is one function.
  *
+ * Held to the server's `logLevel` like everything else on the stream: a run that completed is `info`, one that did not
+ * is `error`.
+ *
  * Never throws: the runner treats the record as best-effort, and a logging outage must not take an action down.
  */
 export declare const createRunLogger: (logger: ServerLogger) => (record: ActionRunRecord) => void;
@@ -25,6 +28,8 @@ export declare const createRunLogger: (logger: ServerLogger) => (record: ActionR
  * It carries no body, no signature and no header — what went wrong is `reason`, and `detail` is the server's own
  * words about it.
  *
+ * A refusal is a `warn`: the caller was turned away, the server did not fail.
+ *
  * Never throws, for the same reason the run logger does not: the caller was refused either way, and a sink's
  * problem must not become the response's.
  */

package/dist/modules/actions/runtime/runLogger.js

@@ -1,3 +1,4 @@
+import { serverLog } from "../../../helpers/serverLog.js";
 //#region src/modules/actions/runtime/runLogger.ts
 /**
 * `onRun`, wired into the log stream the server already reports through.
@@ -11,11 +12,14 @@
 * deployment that wants run HISTORY rather than run logs keeps its own `onRun` and writes rows; the two compose,
 * since `onRun` is one function.
 *
+* Held to the server's `logLevel` like everything else on the stream: a run that completed is `info`, one that did not
+* is `error`.
+*
 * Never throws: the runner treats the record as best-effort, and a logging outage must not take an action down.
 */
 var createRunLogger = (logger) => (record) => {
 	try {
-		logger({
+		serverLog.emit(logger, {
 			kind: "run",
 			name: record.actionId,
 			spaceId: record.spaceId,
@@ -42,12 +46,14 @@ var createRunLogger = (logger) => (record) => {
 * It carries no body, no signature and no header — what went wrong is `reason`, and `detail` is the server's own
 * words about it.
 *
+* A refusal is a `warn`: the caller was turned away, the server did not fail.
+*
 * Never throws, for the same reason the run logger does not: the caller was refused either way, and a sink's
 * problem must not become the response's.
 */
 var createRejectLogger = (logger) => (record) => {
 	try {
-		logger({
+		serverLog.emit(logger, {
 			kind: "reject",
 			name: record.actionId,
 			spaceId: record.spaceId,

package/dist/modules/actions/runtime/signing.d.ts

@@ -0,0 +1,20 @@
+/** A space's signatures: made with a key of its own that the server keeps, which its code never holds. */
+export type SpaceSigning = {
+    /** HMAC-SHA-256 of `value` with the space's key, base64url. */
+    sign: (value: string) => Promise<string>;
+    /** Whether `signature` is what `sign` answers for `value` — compared in constant time. */
+    verify: (value: string, signature: string) => Promise<boolean>;
+};
+/** A signing secret is what every link and key a space hands out stands on: as long as a 256-bit key written out. */
+export declare const MIN_SIGNING_SECRET_LENGTH = 32;
+/**
+ * Signing for every space, from the one secret the deployment holds (`signingSecret`).
+ *
+ * Each space and environment signs with a key derived from it, never with the secret itself: what one space signed
+ * another cannot vouch for, nor production for what a preview signed. Every replica derives the same keys from the
+ * same secret, so a signature made on one is verified on any.
+ */
+export declare const createSigning: (secret: string) => ({ spaceId, environment }: {
+    spaceId: number;
+    environment: string;
+}) => SpaceSigning;

package/dist/modules/actions/runtime/signing.js

@@ -0,0 +1,25 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+* Signing for every space, from the one secret the deployment holds (`signingSecret`).
+*
+* Each space and environment signs with a key derived from it, never with the secret itself: what one space signed
+* another cannot vouch for, nor production for what a preview signed. Every replica derives the same keys from the
+* same secret, so a signature made on one is verified on any.
+*/
+var createSigning = (secret) => {
+	if (secret.length < 32) throw new Error(`The actions' signingSecret is at least ${String(32)} characters`);
+	return ({ spaceId, environment }) => {
+		const key = createHmac("sha256", secret).update(`space-signing:${String(spaceId)}:${environment}`).digest();
+		const signatureOf = (value) => createHmac("sha256", key).update(value).digest("base64url");
+		return {
+			sign: (value) => Promise.resolve(signatureOf(value)),
+			verify: (value, signature) => {
+				const expected = Buffer.from(signatureOf(value));
+				const given = Buffer.from(signature);
+				return Promise.resolve(given.length === expected.length && timingSafeEqual(given, expected));
+			}
+		};
+	};
+};
+//#endregion
+export { createSigning };

package/dist/modules/actions/runtime/signing.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/actions/runtime/taskContext.d.ts

@@ -0,0 +1,33 @@
+import { createEmailSender } from './email';
+import { createRedactor } from './scope';
+import { createSigning } from './signing';
+import { ActionKvStore, ActionRunRequest, ActionsConfig, ActionTaskContext, ResolvedActionLimits } from '../types';
+/**
+ * Counts outbound calls, refuses past the budget, caps what one answer may carry back, and stamps the run's
+ * lineage on every one of them.
+ *
+ * The budget stops a loop from turning one run into a hundred requests. The lineage header is what makes the
+ * OTHER loop detectable: an action whose HTTP step reaches its own space's webhook arrives carrying the chain
+ * that led there, and the run it would start refuses itself. It names the space's own actions to a backend that
+ * space configured, which is the cost of catching a cycle nothing else can see.
+ *
+ * Every ceiling lives HERE rather than in each task, because this is the only door a task has to the outside
+ * world — a task that had to remember to count its own bytes is a task that will forget.
+ */
+export declare const createRunFetch: (base: typeof fetch, signal: AbortSignal, limits: ResolvedActionLimits, lineage: string[]) => typeof fetch;
+/** What a task's context is made of that outlives one run: the server's stores and the run's redactor. */
+export type TaskContextDeps = {
+    kv: ActionKvStore;
+    email: ReturnType<typeof createEmailSender>;
+    redactor: ReturnType<typeof createRedactor>;
+    /** Absent when the deployment gave no `signingSecret`: its spaces then sign nothing. */
+    signing?: ReturnType<typeof createSigning>;
+};
+/** Who and what the context is for — a run's request, or anything shaped like one (a function's route). */
+export type TaskContextRequest = Pick<ActionRunRequest, 'runId' | 'spaceId' | 'environment' | 'trigger' | 'user' | 'callerId' | 'at' | 'emit'>;
+/**
+ * What a task runs with — the one place it is made, for a step of a run and for a function answering a route alike:
+ * every secret it resolves registered with the redactor, the space's `kv` namespace, the run's outbound budget, the
+ * space's channels. Everything but `log`, which is the STEP's: each step keeps what it logged.
+ */
+export declare const taskContextFor: (config: ActionsConfig, { kv, email, redactor, signing }: TaskContextDeps, request: TaskContextRequest, signal: AbortSignal, runFetch: typeof fetch) => (scope: Record<string, unknown>) => Omit<ActionTaskContext, "log">;

package/dist/modules/actions/runtime/taskContext.js

@@ -0,0 +1,124 @@
+import { ActionRunError } from "./errors.js";
+import { namespaceKv } from "./namespaceKv.js";
+//#region src/modules/actions/runtime/taskContext.ts
+/**
+* Holds an answer to what the run is allowed to carry.
+*
+* Two checks rather than one, because a body arrives in two ways. `Content-Length` is refused before a byte is
+* read, which is the cheap half; a chunked answer that declares nothing is counted AS it streams and errored the
+* moment it goes over — so the ceiling holds for a backend that lies about its size or never states one.
+*
+* The cap is on one response and not on the run: it exists so that a single answer cannot be unbounded, which is
+* a different failure from a flow that makes many small calls (that is `maxRequests`).
+*/
+var capped = (response, maxBytes) => {
+	const declared = Number(response.headers.get("content-length") ?? "");
+	if (Number.isFinite(declared) && declared > maxBytes) throw new ActionRunError("over_capacity", `Response is larger than the ${maxBytes} byte budget`);
+	if (!response.body) return response;
+	let seen = 0;
+	const counted = response.body.pipeThrough(new TransformStream({ transform: (chunk, controller) => {
+		seen += chunk.byteLength;
+		if (seen > maxBytes) {
+			controller.error(new ActionRunError("over_capacity", `Response exceeded the ${maxBytes} byte budget`));
+			return;
+		}
+		controller.enqueue(chunk);
+	} }));
+	return new Response(counted, {
+		status: response.status,
+		statusText: response.statusText,
+		headers: response.headers
+	});
+};
+/**
+* Counts outbound calls, refuses past the budget, caps what one answer may carry back, and stamps the run's
+* lineage on every one of them.
+*
+* The budget stops a loop from turning one run into a hundred requests. The lineage header is what makes the
+* OTHER loop detectable: an action whose HTTP step reaches its own space's webhook arrives carrying the chain
+* that led there, and the run it would start refuses itself. It names the space's own actions to a backend that
+* space configured, which is the cost of catching a cycle nothing else can see.
+*
+* Every ceiling lives HERE rather than in each task, because this is the only door a task has to the outside
+* world — a task that had to remember to count its own bytes is a task that will forget.
+*/
+var createRunFetch = (base, signal, limits, lineage) => {
+	let issued = 0;
+	return async (input, init) => {
+		issued += 1;
+		if (issued > limits.maxRequests) throw new ActionRunError("over_capacity", `Action exceeded its ${limits.maxRequests} outbound request budget`);
+		const headers = new Headers(init?.headers);
+		headers.set("X-Plitzi-Action-Lineage", lineage.join(","));
+		return capped(await base(input, {
+			...init,
+			headers,
+			signal: init?.signal ?? signal
+		}), limits.maxResponseBytes);
+	};
+};
+/**
+* What a task runs with — the one place it is made, for a step of a run and for a function answering a route alike:
+* every secret it resolves registered with the redactor, the space's `kv` namespace, the run's outbound budget, the
+* space's channels. Everything but `log`, which is the STEP's: each step keeps what it logged.
+*/
+var taskContextFor = (config, { kv, email, redactor, signing }, request, signal, runFetch) => (scope) => {
+	const { realtime } = config;
+	return {
+		runId: request.runId,
+		spaceId: request.spaceId,
+		environment: request.environment,
+		trigger: request.trigger,
+		user: request.user,
+		callerId: request.callerId,
+		signal,
+		scope,
+		/**
+		* The secret a STEP asked for, resolved inside that step and never in the flow scope.
+		*
+		* There is no allow-list to check it against, deliberately: an action is authored by someone who may edit
+		* every action in the space, so a list they can edit is not a boundary — it only ever told the redactor what
+		* to look for, and the redactor now learns from what was actually resolved. What IS a boundary is that a
+		* credential reaches only the params of the step that named it, which is `renderTaskParams`' whole job.
+		*/
+		credential: async (identifier) => {
+			const credential = await config.lookups.getCredential?.(request.spaceId, identifier);
+			if (credential) redactor.add(credential);
+			return credential;
+		},
+		connector: async (connectorId) => {
+			const manifest = await config.lookups.getConnector?.(request.spaceId, connectorId, request.at);
+			if (!manifest) return;
+			const credential = manifest.credential ? await config.lookups.getCredential?.(request.spaceId, manifest.credential) : void 0;
+			if (credential) redactor.add(credential);
+			return {
+				manifest,
+				credential
+			};
+		},
+		fetch: runFetch,
+		kv: namespaceKv(kv, request.spaceId),
+		dbDrivers: config.dbDrivers ?? [],
+		email,
+		emit: (chunk) => request.emit?.(redactor.redact(chunk)),
+		...signing?.({
+			spaceId: request.spaceId,
+			environment: request.environment
+		}),
+		...realtime ? {
+			publish: (topic, type, data) => realtime.publish({
+				spaceId: request.spaceId,
+				environment: request.environment
+			}, topic, type, data),
+			grant: (topic, ttlSeconds) => realtime.grant({
+				spaceId: request.spaceId,
+				environment: request.environment
+			}, topic, ttlSeconds),
+			revoke: (topic, grant) => realtime.revoke({
+				spaceId: request.spaceId,
+				environment: request.environment
+			}, topic, grant)
+		} : {}
+	};
+};
+//#endregion
+export { createRunFetch, taskContextFor };

package/dist/modules/actions/tasks/builtins.js

@@ -4,6 +4,8 @@ import { emailTasks } from "./email.js";
 import { flowTasks, streamTasks } from "./flow.js";
 import { httpTasks } from "./http.js";
 import { kvTasks } from "./kv.js";
+import { listTasks } from "./list.js";
+import { realtimeTasks } from "./realtime.js";
 import { transformTasks } from "./transform.js";
 //#region src/modules/actions/tasks/builtins.ts
 /**
@@ -21,8 +23,10 @@ var builtinTasks = [
 	...connectorTasks,
 	...authTasks,
 	...kvTasks,
+	...listTasks,
 	...emailTasks,
-	...streamTasks
+	...streamTasks,
+	...realtimeTasks
 ];
 //#endregion
 export { builtinTasks };