@plitzi/sdk-server 0.37.2 → 0.37.4

package/dist/modules/runtime/runner.js

@@ -0,0 +1,38 @@
+import { ActionRefusal } from "../actions/runtime/errors.js";
+import { changeKv } from "../actions/runtime/kvChange.js";
+import { requestFromWire, responseOf, wireResponseFrom, wireResponseOf } from "../functions/capabilities.js";
+import { FunctionFailure } from "../functions/protocol.js";
+import { createFunctionsDriver, describeFunctions } from "../functions/driver.js";
+//#region src/modules/runtime/runner.ts
+/** A refusal, however it was made: the platform's class, or a bundle's own copy of it — known by its name. */
+var isRefusal = (error) => error instanceof Error && error.name === "ActionRefusal";
+/**
+* A runtime's functions as a runner: the same protocol as the sandbox's, answered by code loaded in this process. The
+* driver is the sandbox's own (`createFunctionsDriver`), so a task behaves the same in both — its `ctx` is calls to the
+* platform, `ctx.kv.change` the same loop, a refusal the same answer. What it does not share is the isolate: there are
+* no limits here but the platform's clock, since this process is the space's alone.
+*
+* The bundle a request names is not asked for: the code is the one this runtime was started with.
+*/
+var createRuntimeRunner = (definition = {}) => ({
+	describe: () => Promise.resolve(describeFunctions(definition)),
+	invoke: async ({ invocation, answer, signal }) => {
+		const driver = createFunctionsDriver({
+			call: answer,
+			signal,
+			responseOf: (wire) => responseOf(wireResponseFrom(wire)),
+			requestOf: requestFromWire,
+			wireOfResponse: async (response) => response instanceof Response ? wireResponseOf(response) : void 0,
+			changeKv,
+			refusal: (message) => new ActionRefusal(message)
+		});
+		try {
+			return await driver.invoke(definition, invocation);
+		} catch (error) {
+			if (isRefusal(error)) throw new FunctionFailure("refused", error.message);
+			throw error;
+		}
+	}
+});
+//#endregion
+export { createRuntimeRunner };

package/dist/modules/runtime/runtime.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/runtime/stages.d.ts

@@ -0,0 +1,50 @@
+import { SpaceRuntime, SpaceRuntimeContext, SpaceRuntimeEndpoint } from './contract';
+import { SSRContext, Stage } from '../../core/http/types';
+import { FunctionsDefinition } from '../functions/contract';
+/** A runtime's endpoints answered in this process — self-hosting — exactly as the platform forwards them to its own. */
+export declare const runtimeEndpointsStage: (endpoints: Record<string, SpaceRuntimeEndpoint>) => Stage<SSRContext>;
+/** A runtime on a server of its own: what `createServer` is handed of it, and how to stop it. */
+export type ServedRuntime = {
+    /** Its tasks and routes, for `functions.native`. */
+    native: FunctionsDefinition[];
+    /** Its endpoints, for `preAuth` — they gate themselves, as the platform's forwarding does. */
+    stage: Stage<SSRContext>;
+    close: () => Promise<void>;
+};
+/**
+ * A space runtime served by a self-hosted server instead of the platform: started here, its functions loaded natively
+ * and its endpoints answered by a stage — the same module the platform runs as a runtime of the space.
+ */
+export declare const serveRuntime: (runtime: SpaceRuntime, context: SpaceRuntimeContext) => Promise<ServedRuntime>;
+/** Where a space's runtime is, for the page server to forward its endpoints to. */
+export type RuntimeTarget = {
+    /** Its base URL — `http://10.0.4.7:8791`. */
+    url: string;
+    /** What it is presented, as `Authorization: Bearer <secret>`. */
+    secret: string;
+    /** The paths it answers — what it described when it started. */
+    endpoints: readonly string[];
+};
+export type RuntimeProxyConfig = {
+    /** The runtime serving a space and environment — or none, for a space the platform serves alone. */
+    lookup: (space: {
+        spaceId: number;
+        environment: string;
+    }) => Promise<RuntimeTarget | undefined>;
+    /**
+     * Told each time a request is forwarded to a space's runtime — not for every request of the space, most of which are
+     * its pages: what counts as a runtime being used, for a deployment that stops the ones nobody uses.
+     */
+    onForward?: (space: {
+        spaceId: number;
+        environment: string;
+        endpoint: string;
+    }) => void;
+};
+/**
+ * The page server forwarding a space's endpoints to its runtime: the request as it came, streamed both ways — an agent's
+ * event stream included — without the visitor's cookies or `Authorization`, and with who asked in `X-Forwarded-*`.
+ *
+ * A data stage: after the auth chain, so the space is known, and before the space's `/api/` routes and its pages.
+ */
+export declare const createRuntimeProxyStage: ({ lookup, onForward }: RuntimeProxyConfig) => Stage<SSRContext>;

package/dist/modules/runtime/stages.js

@@ -0,0 +1,117 @@
+import { clientIp, requestOrigin } from "../../core/requestParser.js";
+import { endpointFor, endpointProblem } from "./contract.js";
+import { webRequestOf, writeWebResponse } from "../../core/http/webExchange.js";
+import { PLATFORM_HEADERS } from "./host.js";
+import http from "node:http";
+import https from "node:https";
+//#region src/modules/runtime/stages.ts
+var originOf = (ctx) => requestOrigin(ctx.req) || `${ctx.req.protocol}://${ctx.req.hostname}`;
+/** A runtime's endpoints answered in this process — self-hosting — exactly as the platform forwards them to its own. */
+var runtimeEndpointsStage = (endpoints) => {
+	const paths = Object.keys(endpoints);
+	const problems = paths.flatMap((path) => endpointProblem(path) ?? []);
+	if (problems.length > 0) throw new Error(problems.join("; "));
+	return async (ctx) => {
+		const endpoint = endpointFor(paths, ctx.req.path);
+		const answer = endpoint ? endpoints[endpoint] : void 0;
+		if (!endpoint || !answer) return false;
+		ctx.operation = `endpoint ${endpoint}`;
+		const request = await webRequestOf(ctx.raw, `${originOf(ctx)}${ctx.raw.url ?? ctx.req.path}`, PLATFORM_HEADERS);
+		await writeWebResponse(ctx.rawRes, await answer(request), ctx.signal);
+		return true;
+	};
+};
+/**
+* A space runtime served by a self-hosted server instead of the platform: started here, its functions loaded natively
+* and its endpoints answered by a stage — the same module the platform runs as a runtime of the space.
+*/
+var serveRuntime = async (runtime, context) => {
+	const parts = await runtime.start(context);
+	return {
+		native: parts.functions ? [parts.functions] : [],
+		stage: runtimeEndpointsStage(parts.endpoints ?? {}),
+		close: async () => {
+			await parts.close?.();
+		}
+	};
+};
+var HOP_BY_HOP = [
+	"connection",
+	"keep-alive",
+	"transfer-encoding",
+	"upgrade"
+];
+/** The query parameter a platform credential rides in (`credentials.ts`): never forwarded either. */
+var PLATFORM_QUERY_CREDENTIAL = "access-token";
+/** Never forwarded to a runtime: one hop's, and the platform's — the visitor's session is not the runtime's to hold. */
+var NOT_FORWARDED = /* @__PURE__ */ new Set([
+	...HOP_BY_HOP,
+	...PLATFORM_HEADERS,
+	"host"
+]);
+/** Never answered from one: the host's cookies are the platform's, as a function route's are. */
+var NOT_ANSWERED = /* @__PURE__ */ new Set([...HOP_BY_HOP, "set-cookie"]);
+/**
+* The page server forwarding a space's endpoints to its runtime: the request as it came, streamed both ways — an agent's
+* event stream included — without the visitor's cookies or `Authorization`, and with who asked in `X-Forwarded-*`.
+*
+* A data stage: after the auth chain, so the space is known, and before the space's `/api/` routes and its pages.
+*/
+var createRuntimeProxyStage = ({ lookup, onForward }) => async (ctx) => {
+	const { spaceId, environment = "main" } = ctx.req.ctx.spaceDeployment ?? {};
+	if (typeof spaceId !== "number") return false;
+	const target = await lookup({
+		spaceId,
+		environment
+	});
+	const endpoint = target ? endpointFor(target.endpoints, ctx.req.path) : void 0;
+	if (!target || !endpoint) return false;
+	ctx.operation = `runtime ${endpoint}`;
+	onForward?.({
+		spaceId,
+		environment,
+		endpoint
+	});
+	const headers = {};
+	Object.entries(ctx.raw.headers).forEach(([name, value]) => {
+		if (!name.startsWith(":") && !NOT_FORWARDED.has(name) && value !== void 0) headers[name] = value;
+	});
+	headers.authorization = `Bearer ${target.secret}`;
+	headers["x-forwarded-host"] = ctx.req.hostname;
+	headers["x-forwarded-proto"] = ctx.req.protocol;
+	headers["x-forwarded-for"] = clientIp(ctx.raw, ctx.req);
+	const url = new URL(ctx.raw.url ?? ctx.req.path, target.url);
+	url.searchParams.delete(PLATFORM_QUERY_CREDENTIAL);
+	await new Promise((resolve) => {
+		const upstream = (url.protocol === "https:" ? https : http).request(url, {
+			method: ctx.raw.method,
+			headers
+		});
+		const unreachable = () => {
+			if (!ctx.rawRes.headersSent) {
+				ctx.rawRes.writeHead(502, { "content-type": "application/json" });
+				ctx.rawRes.end(JSON.stringify({ error: "This space’s runtime is not answering" }));
+			} else ctx.rawRes.end();
+			resolve();
+		};
+		ctx.signal.addEventListener("abort", () => upstream.destroy(), { once: true });
+		upstream.on("error", unreachable);
+		upstream.on("response", (answer) => {
+			const answered = {};
+			Object.entries(answer.headers).forEach(([name, value]) => {
+				if (!NOT_ANSWERED.has(name) && value !== void 0) answered[name] = value;
+			});
+			ctx.rawRes.writeHead(answer.statusCode ?? 502, answered);
+			answer.on("data", (chunk) => ctx.rawRes.write(chunk));
+			answer.on("end", () => {
+				ctx.rawRes.end();
+				resolve();
+			});
+			answer.on("error", unreachable);
+		});
+		ctx.raw.pipe(upstream);
+	});
+	return true;
+};
+//#endregion
+export { createRuntimeProxyStage, runtimeEndpointsStage, serveRuntime };

package/dist/modules/ssr/Component.d.ts

@@ -13,6 +13,8 @@ export type ComponentProps = {
     overQuota?: boolean;
     /** The theme this document was rendered with, from the visitor's cookie. See `prepareRender`. */
     theme?: Theme;
+    /** The kept state the first paint depends on (`settings.paintedState`), from the visitor's cookie. */
+    state?: Record<string, unknown>;
 };
-declare const Component: ({ server, renderMode, previewMode, offlineData, environment, plugins, ssrResult, sdkDevToolsStylePath, debugMode, overQuota, theme }: ComponentProps) => import('react').JSX.Element;
+declare const Component: ({ server, renderMode, previewMode, offlineData, environment, plugins, ssrResult, sdkDevToolsStylePath, debugMode, overQuota, theme, state }: ComponentProps) => import('react').JSX.Element;
 export default Component;

package/dist/modules/ssr/Component.js

@@ -1,7 +1,7 @@
 import PlitziSdk from "@plitzi/plitzi-sdk";
 import { jsx } from "react/jsx-runtime";
 //#region src/modules/ssr/Component.tsx
-var Component = ({ server, renderMode = "raw", previewMode = true, offlineData, environment = "main", plugins, ssrResult, sdkDevToolsStylePath, debugMode = false, overQuota, theme }) => {
+var Component = ({ server, renderMode = "raw", previewMode = true, offlineData, environment = "main", plugins, ssrResult, sdkDevToolsStylePath, debugMode = false, overQuota, theme, state }) => {
 	const serverWithResult = {
 		...server,
 		ssr: {
@@ -20,6 +20,7 @@ var Component = ({ server, renderMode = "raw", previewMode = true, offlineData,
 		debugMode,
 		...overQuota === void 0 ? {} : { overQuota },
 		...theme === void 0 ? {} : { theme },
+		...state === void 0 ? {} : { state },
 		children: plugins && Object.keys(plugins).map((key) => /* @__PURE__ */ jsx(PlitziSdk.Plugin, {
 			renderType: key,
 			component: plugins[key].component,

package/dist/modules/ssr/handler.js

@@ -46,7 +46,7 @@ var renderSSR = async (req, res, config, renderFn, pluginManager, caches) => {
 			res.setHeader("X-Cache", "HIT");
 			if (devMode) res.setHeader("Server-Timing", "html;desc=\"cache-hit\";dur=0");
 			await meterPage(req, config, spaceId, environment, revision, true);
-			res.send(cached);
+			res.send(cached.html, { compressed: cached.compressed });
 			return;
 		}
 	}
@@ -63,7 +63,15 @@ var renderSSR = async (req, res, config, renderFn, pluginManager, caches) => {
 		metrics.log(`${req.method} ${req.path}`);
 	}
 	if (applySSRResult(res, result)) return;
-	if (htmlCache && cacheKey && body !== void 0 && cacheable) htmlCache.set(cacheKey, body);
+	if (htmlCache && cacheKey && body !== void 0 && cacheable) {
+		const page = {
+			html: body,
+			compressed: {}
+		};
+		htmlCache.set(cacheKey, page);
+		res.send(body, { compressed: page.compressed });
+		return;
+	}
 	res.send(body ?? "");
 };
 //#endregion

package/dist/modules/ssr/loadPluginComponents.js

@@ -1,3 +1,4 @@
+import { serverLog } from "../../helpers/serverLog.js";
 import { pathToFileURL } from "node:url";
 //#region src/modules/ssr/loadPluginComponents.ts
 /** Module-level cache: the bundle's stamped identity → loaded React component. */
@@ -56,7 +57,7 @@ var loadPluginComponents = async (entries, inlineComponents) => {
 			component = mod.default ?? mod;
 			componentCache.set(cacheKey, component);
 		} catch (err) {
-			console.warn(`[SSR] Plugin "${e.keyName}" cannot be imported server-side, falling back to client rendering:`, err.message);
+			serverLog.warn("SSR", `Plugin "${e.keyName}" cannot be imported server-side, falling back to client rendering`, err);
 			failedImports.add(filePath);
 			return;
 		}

package/dist/modules/ssr/prepareRender.js

@@ -1,5 +1,7 @@
 import { authorizesDebugging } from "../../helpers/debugAuthorization.js";
+import { realtimeModuleFor } from "../realtime/index.js";
 import { matchRscPage } from "../rsc/matchRscPage.js";
+import { ssrPaintedCookieName } from "../../helpers/paintedCookie.js";
 import { readCookie } from "../../helpers/readCookie.js";
 import { buildOfflineDataCacheKey } from "../../helpers/cache/keys.js";
 import { loadPluginComponents } from "./loadPluginComponents.js";
@@ -7,18 +9,30 @@ import "../../core/previewToken.js";
 import { resolveActionEndpoint, resolveRscEndpoint } from "../../core/services/resolve.js";
 import { createOfflineDataLoader } from "../../helpers/offlineDataLoader.js";
 import { registerExternalPlugins } from "./registerExternalPlugins.js";
+import { reportMissingPlugins } from "./reportMissingPlugins.js";
 import { resolvePageSeo } from "./resolvePageSeo.js";
 import { sdkAssetVersion } from "../../core/sdkAssets.js";
 import { buildServerInfo } from "../../helpers/buildServerInfo.js";
-import { escapeJson } from "../../helpers/escapeJson.js";
+import { hydrationPayload } from "../../helpers/hydrationPayload.js";
 import { resolveDebugMode } from "../../helpers/resolveDebugMode.js";
 import { hasServerElements } from "@plitzi/sdk-shared/schema/serverElements";
 import { debugCookieName } from "@plitzi/sdk-shared/devTools";
 import { themeFromCookies } from "@plitzi/sdk-shared/theme";
+import { paintedKeys, paintedStateFor } from "@plitzi/sdk-shared/state/paintedState";
 import { fontUrlResolver, fontsToHead } from "@plitzi/sdk-shared/style";
 //#region src/modules/ssr/prepareRender.tsx
 /** Last resort only: used for a page that declares no SEO title and a deployment that supplies none either. */
 var DEFAULT_TITLE = "Plitzi App";
+/**
+* The theme a space declares a first visit starts in, when it declares one other than `system`.
+*
+* `Partial`, because a style document written before themes existed has no `theme` at all, and a published space
+* is rendered from whatever document it was published with.
+*/
+var declaredTheme = (style) => {
+	const declared = style?.theme?.default;
+	return declared && declared !== "system" ? declared : void 0;
+};
 var prepareRender = async (req, config, spaceId, environment, revision, pluginManager, offlineDataCache, metrics, offlineDataOverride) => {
 	const m = (name, fn) => metrics ? metrics.measure(name, fn) : Promise.resolve(fn());
 	const offlineCacheKey = environment !== "main" ? buildOfflineDataCacheKey(spaceId, environment, revision) : void 0;
@@ -44,7 +58,9 @@ var prepareRender = async (req, config, spaceId, environment, revision, pluginMa
 	const server = buildServerInfo(req, config, {
 		rscPath,
 		rscData,
-		actionPath: resolveActionEndpoint(config)
+		actionPath: resolveActionEndpoint(config),
+		realtimePath: realtimeModuleFor(config)?.path,
+		realtimeTransport: realtimeModuleFor(config)?.transport
 	});
 	if (offlineDataOverride === void 0 && !cachedOfflineStr && offlineCacheKey && offlineData !== void 0) offlineDataCache?.set(offlineCacheKey, JSON.stringify(offlineData));
 	const version = config.assetVersion ?? sdkAssetVersion();
@@ -92,22 +108,33 @@ var prepareRender = async (req, config, spaceId, environment, revision, pluginMa
 	* `{{ theme.resolved }}` or gate a rule on the scheme, and a client that started at `system` while the server
 	* rendered `dark` would hydrate different markup and throw away the tree.
 	*
-	* Absent — a first visit — is not a problem to solve: nothing is stamped, `system` is what the provider starts
-	* at, and the stylesheet's media queries answer, which is exactly right.
+	* Absent — a first visit — the space's own default applies (`style.theme.default`), painted by the server like a
+	* choice would be. A default of `system` stamps nothing and the stylesheet's media queries answer, which is exactly
+	* right for a space that did not pick.
+	*/
+	const theme = themeFromCookies(req.headers.cookie) ?? declaredTheme(offlineData?.style);
+	/**
+	* The kept state the first paint depends on, from the cookie the SDK writes the space's `settings.paintedState` to.
+	*
+	* The theme's reasoning, for the space's own state: web storage is the browser's alone, so what a visitor chose — the
+	* tool a toolbar shows, their name in an avatar — would reach the page only after hydration, and be swapped in over
+	* the defaults the server drew. Read here, the server draws with it, and the page starts from the same values: it
+	* travels as the SDK's `state`, the starting `runtime.state`, in the render and in the payload alike, or the client
+	* would hydrate other markup. Only the keys the space declares, and only with `keepState` on.
 	*/
-	const theme = themeFromCookies(req.headers.cookie);
-	const offlineDataStr = escapeJson(JSON.stringify({
-		offlineData,
+	const paintedState = schema?.settings.keepState ? paintedStateFor(req.headers.cookie, ssrPaintedCookieName(req.headers.host), paintedKeys(schema.settings)) : void 0;
+	const offlineDataStr = hydrationPayload(offlineData, {
 		offlineMode: true,
 		environment,
 		renderMode: "raw",
 		server,
 		sdkDevToolsStylePath,
 		...theme ? { theme } : {},
+		...paintedState ? { state: paintedState } : {},
 		...clientAnalytics ? { analytics: clientAnalytics } : {},
 		...overQuota ? { overQuota } : {},
 		...actionRuns ? { actionRuns } : {}
-	}));
+	});
 	const pluginNames = req.ctx.spaceDeployment?.pluginNames ?? [];
 	const pluginSources = req.ctx.spaceDeployment?.pluginSources;
 	const pluginBaseNames = new Set(pluginNames.map((n) => n.replace(/@[^@]*$/, "")));
@@ -116,7 +143,7 @@ var prepareRender = async (req, config, spaceId, environment, revision, pluginMa
 		const key = pluginManager.ensure(pluginName, pluginSource);
 		if (!pluginBaseNames.has(pluginName)) dynamicNames.push(key);
 	}
-	const externalNamesFiltered = (config.autoLoadSchemaPlugins !== false ? await m("extPlugins", () => registerExternalPlugins(pluginManager, offlineData)) : []).filter((k) => !pluginBaseNames.has(k.replace(/@[^@]*$/, "")));
+	const externalNamesFiltered = (config.autoLoadSchemaPlugins !== false ? await m("extPlugins", () => registerExternalPlugins(pluginManager, offlineData, { allowPrivateHosts: config.allowPrivatePluginHosts === true })) : []).filter((k) => !pluginBaseNames.has(k.replace(/@[^@]*$/, "")));
 	const allPluginNames = [
 		...pluginNames,
 		...dynamicNames,
@@ -124,6 +151,7 @@ var prepareRender = async (req, config, spaceId, environment, revision, pluginMa
 	];
 	const entries = allPluginNames.length > 0 ? await pluginManager.getEntries(allPluginNames) : [];
 	const pluginComponents = await m("plugins", () => loadPluginComponents(entries, pluginManager.getComponents()));
+	reportMissingPlugins(spaceId, schema, /* @__PURE__ */ new Set([...Object.keys(pluginComponents), ...entries.map((entry) => entry.keyName)]));
 	const templatePlugins = (entries.length > 0 ? entries : req.ctx.spaceDeployment?.templateProps?.plugins)?.map((entry) => ({
 		...entry,
 		ssr: entry.keyName in pluginComponents
@@ -138,7 +166,8 @@ var prepareRender = async (req, config, spaceId, environment, revision, pluginMa
 			debugMode: debugRendered,
 			sdkDevToolsStylePath,
 			overQuota,
-			theme
+			theme,
+			...paintedState ? { state: paintedState } : {}
 		},
 		entries,
 		templateParams: {

package/dist/modules/ssr/preview.d.ts

@@ -1,7 +1,10 @@
+import { StoreMethods } from '../../core/server/fleet/channel';
 import { DraftStore, OfflineDataRaw, SSRRequest, SSRServerConfig } from '@plitzi/sdk-shared';
 /** The READ side of draft-preview: a render resolving a stashed draft from its token. The write side — applying
  *  unsaved operations and rendering the result — lives in `@plitzi/sdk-mcp`, which is what knows how to interpret an
  *  operation; a page-only deployment keeps this much and never loads that. */
+/** Every method of the store, for the copy a server's workers share (see `fleet/stores.ts`). */
+export declare const DRAFT_STORE_METHODS: StoreMethods<DraftStore>;
 /** In-memory draft store — the default when the consumer injects none. Fine for a single replica; a multi-replica
  *  deployment must inject a shared store so a preview URL resolves on any replica. */
 export declare const createMemoryDraftStore: () => DraftStore;

package/dist/modules/ssr/preview.js

@@ -3,16 +3,23 @@ import { PREVIEW_COOKIE, readDraftToken } from "../../core/previewToken.js";
 /** The READ side of draft-preview: a render resolving a stashed draft from its token. The write side — applying
 *  unsaved operations and rendering the result — lives in `@plitzi/sdk-mcp`, which is what knows how to interpret an
 *  operation; a page-only deployment keeps this much and never loads that. */
+/** Every method of the store, for the copy a server's workers share (see `fleet/stores.ts`). */
+var DRAFT_STORE_METHODS = {
+	put: true,
+	take: true,
+	drop: true
+};
 /** In-memory draft store — the default when the consumer injects none. Fine for a single replica; a multi-replica
 *  deployment must inject a shared store so a preview URL resolves on any replica. */
 var createMemoryDraftStore = () => {
 	const store = /* @__PURE__ */ new Map();
 	return {
-		put(token, data, { ttlMs, reusable = false }) {
+		put(token, data, { ttlMs, reusable = false, spaceId }) {
 			store.set(token, {
 				data,
 				expiresAt: Date.now() + ttlMs,
-				reusable
+				reusable,
+				spaceId
 			});
 		},
 		take(token) {
@@ -21,7 +28,8 @@ var createMemoryDraftStore = () => {
 			if (!hit.reusable || hit.expiresAt <= Date.now()) store.delete(token);
 			return hit.expiresAt > Date.now() ? {
 				data: hit.data,
-				reusable: hit.reusable
+				reusable: hit.reusable,
+				spaceId: hit.spaceId
 			} : void 0;
 		},
 		drop(token) {
@@ -39,10 +47,12 @@ var takeDraftOverride = async (req, config) => {
 	const token = readDraftToken(req);
 	if (!token || !config.draftStore) return;
 	const entry = await config.draftStore.take(token);
-	return entry ? {
-		...entry,
+	if (!entry || entry.spaceId !== req.ctx.spaceDeployment?.spaceId) return;
+	return {
+		data: entry.data,
+		reusable: entry.reusable,
 		token
-	} : void 0;
+	};
 };
 /** The `Set-Cookie` that carries a draft session through the rest of the visit. */
 var draftSessionCookie = (req, token, ttlMs) => [
@@ -54,4 +64,4 @@ var draftSessionCookie = (req, token, ttlMs) => [
 	...req.protocol === "https" ? ["Secure"] : []
 ].join("; ");
 //#endregion
-export { createMemoryDraftStore, draftSessionCookie, takeDraftOverride };
+export { DRAFT_STORE_METHODS, createMemoryDraftStore, draftSessionCookie, takeDraftOverride };

package/dist/modules/ssr/redirect.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/ssr/registerExternalPlugins.d.ts

@@ -1,7 +1,12 @@
 import { PluginManager } from '../../plugins/manager';
 import { OfflineDataRaw } from '@plitzi/sdk-shared';
+/** Where a plugin may be read from: anywhere public, and — on a development machine only — a private address too. */
+type ManifestReach = {
+    allowPrivateHosts: boolean;
+};
 /**
  * Reads plugins listed in offlineData.plugins, fetches their manifests, downloads and caches
  * JS/CSS via the PluginManager, and returns the effective plugin keys to pass to getEntries().
  */
-export declare const registerExternalPlugins: (pluginManager: PluginManager, offlineData: OfflineDataRaw | undefined) => Promise<string[]>;
+export declare const registerExternalPlugins: (pluginManager: PluginManager, offlineData: OfflineDataRaw | undefined, reach?: ManifestReach) => Promise<string[]>;
+export {};

package/dist/modules/ssr/registerExternalPlugins.js

@@ -1,3 +1,6 @@
+import { serverLog } from "../../helpers/serverLog.js";
+import { fetchOutbound } from "../../helpers/outboundGuard.js";
+import { writeFileAtomic } from "../../helpers/atomicFile.js";
 import crypto from "node:crypto";
 import path from "node:path";
 import fs from "node:fs/promises";
@@ -22,17 +25,17 @@ var readDiskEntry = async (dir, resource) => {
 var writeDiskEntry = async (dir, resource, entry) => {
 	try {
 		await fs.mkdir(dir, { recursive: true });
-		await fs.writeFile(cacheFilePath(dir, resource), JSON.stringify(entry), "utf-8");
+		await writeFileAtomic(cacheFilePath(dir, resource), JSON.stringify(entry));
 	} catch (err) {
-		console.warn(`[SSR] Failed to persist plugin manifest cache for ${resource}:`, err);
+		serverLog.warn("SSR", `Failed to persist plugin manifest cache for ${resource}`, err);
 	}
 };
-var fetchAndStore = async (dir, resource) => {
+var fetchAndStore = async (dir, resource, reach) => {
 	try {
 		const url = `${resource}/plugin-manifest.json`;
-		const res = await fetch(url);
+		const res = reach.allowPrivateHosts ? await fetch(url) : await fetchOutbound(fetch, new URL(url));
 		if (!res.ok) {
-			console.warn(`[SSR] Failed to fetch plugin manifest from ${url}: HTTP ${res.status}`);
+			serverLog.warn("SSR", `Failed to fetch plugin manifest from ${url}: HTTP ${res.status}`);
 			return null;
 		}
 		const manifest = await res.json();
@@ -44,24 +47,24 @@ var fetchAndStore = async (dir, resource) => {
 		await writeDiskEntry(dir, resource, entry);
 		return manifest;
 	} catch (err) {
-		console.warn(`[SSR] Error fetching plugin manifest from ${resource}:`, err);
+		serverLog.warn("SSR", `Error fetching plugin manifest from ${resource}`, err);
 		return null;
 	}
 };
-var revalidate = (dir, resource) => {
+var revalidate = (dir, resource, reach) => {
 	if (refreshing.has(resource)) return;
 	refreshing.add(resource);
-	fetchAndStore(dir, resource).finally(() => refreshing.delete(resource));
+	fetchAndStore(dir, resource, reach).finally(() => refreshing.delete(resource));
 };
-var fetchManifest = async (pluginManager, resource) => {
+var fetchManifest = async (pluginManager, resource, reach) => {
 	const dir = manifestCacheDir(pluginManager);
 	const cached = manifestCache.get(resource) ?? await readDiskEntry(dir, resource) ?? void 0;
 	if (cached) {
 		manifestCache.set(resource, cached);
-		if (cached.expiresAt <= Date.now()) revalidate(dir, resource);
+		if (cached.expiresAt <= Date.now()) revalidate(dir, resource, reach);
 		return cached.manifest;
 	}
-	return fetchAndStore(dir, resource);
+	return fetchAndStore(dir, resource, reach);
 };
 var resolveAssetUrl = (resource, asset) => {
 	if (asset.url) return asset.url;
@@ -74,13 +77,13 @@ var findAsset = (manifest, type, resource) => {
 	return main ? resolveAssetUrl(resource, main) ?? void 0 : void 0;
 };
 var isAbsoluteUrl = (url) => url.startsWith("http://") || url.startsWith("https://");
-var registerPlugin = async (pluginManager, plugin) => {
+var registerPlugin = async (pluginManager, plugin, reach) => {
 	if (!plugin.resource || !isAbsoluteUrl(plugin.resource)) return null;
-	const manifest = await fetchManifest(pluginManager, plugin.resource);
+	const manifest = await fetchManifest(pluginManager, plugin.resource, reach);
 	if (!manifest) return null;
 	const jsUrl = findAsset(manifest, "script", plugin.resource);
 	if (!jsUrl) {
-		console.warn(`[SSR] Plugin "${plugin.type}" has no JS asset in manifest, skipping`);
+		serverLog.warn("SSR", `Plugin "${plugin.type}" has no JS asset in manifest, skipping`);
 		return null;
 	}
 	const source = {
@@ -95,10 +98,10 @@ var registerPlugin = async (pluginManager, plugin) => {
 * Reads plugins listed in offlineData.plugins, fetches their manifests, downloads and caches
 * JS/CSS via the PluginManager, and returns the effective plugin keys to pass to getEntries().
 */
-var registerExternalPlugins = async (pluginManager, offlineData) => {
+var registerExternalPlugins = async (pluginManager, offlineData, reach = { allowPrivateHosts: false }) => {
 	const plugins = offlineData?.plugins;
 	if (!plugins || plugins.length === 0) return [];
-	return (await Promise.all(plugins.map((p) => registerPlugin(pluginManager, p)))).filter((k) => k !== null);
+	return (await Promise.all(plugins.map((p) => registerPlugin(pluginManager, p, reach)))).filter((k) => k !== null);
 };
 //#endregion
 export { registerExternalPlugins };

package/dist/modules/ssr/registerExternalPlugins.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/ssr/reportMissingPlugins.d.ts

@@ -0,0 +1,9 @@
+import { Schema } from '@plitzi/sdk-shared';
+/**
+ * The plugin types a space renders that this server has nothing for — neither a component in the render nor a bundle
+ * for the browser. Each prints "Custom Component … Not Found" where the plugin should be, and nothing else anywhere
+ * says why, so it is said here: once per space and type, at `error`, because a visitor is looking at the placeholder.
+ *
+ * A `custom` element carrying its own `scriptUrl` loads itself in the browser and is not this server's to supply.
+ */
+export declare const reportMissingPlugins: (spaceId: number, schema: Schema | undefined, available: ReadonlySet<string>) => void;

package/dist/modules/ssr/reportMissingPlugins.js

@@ -0,0 +1,24 @@
+import { serverLog } from "../../helpers/serverLog.js";
+//#region src/modules/ssr/reportMissingPlugins.ts
+var reported = /* @__PURE__ */ new Set();
+/**
+* The plugin types a space renders that this server has nothing for — neither a component in the render nor a bundle
+* for the browser. Each prints "Custom Component … Not Found" where the plugin should be, and nothing else anywhere
+* says why, so it is said here: once per space and type, at `error`, because a visitor is looking at the placeholder.
+*
+* A `custom` element carrying its own `scriptUrl` loads itself in the browser and is not this server's to supply.
+*/
+var reportMissingPlugins = (spaceId, schema, available) => {
+	if (!schema || !serverLog.enabled("error")) return;
+	for (const element of Object.values(schema.flat)) {
+		const { renderType, isPlugin, scriptUrl } = element.attributes;
+		const loadsItself = isPlugin === true && typeof scriptUrl === "string" && scriptUrl !== "";
+		if (element.definition.type !== "custom" || typeof renderType !== "string" || renderType === "" || loadsItself) continue;
+		const key = `${spaceId}:${renderType}`;
+		if (available.has(renderType) || reported.has(key)) continue;
+		reported.add(key);
+		serverLog.error("SSR", `Space ${String(spaceId)} renders the plugin "${renderType}" (element "${element.id}"), and this server has none by that name, so the page shows "Custom Component ${renderType} Not Found". Register it in \`plugins\` and name it in the deployment's \`pluginNames\`.`);
+	}
+};
+//#endregion
+export { reportMissingPlugins };

package/dist/modules/ssr/reportMissingPlugins.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/ssr/streamBody.d.ts

@@ -1,5 +1,5 @@
-import { TtlCache } from '../../helpers/cache';
+import { CachedPage, TtlCache } from '../../helpers/cache';
 import { RequestMetrics } from '../../helpers/metrics';
 import { PluginManager } from '../../plugins/manager';
 import { Environment, OfflineDataRaw, SSRPageServerConfig, SSRRequest, SSRResponseHelpers, SSRTemplateFn } from '@plitzi/sdk-shared';
-export declare const streamBody: (req: SSRRequest, res: SSRResponseHelpers, config: SSRPageServerConfig, spaceId: number, environment: Environment, revision: number, renderFn: SSRTemplateFn, pluginManager: PluginManager, offlineDataCache?: TtlCache<string>, htmlCache?: TtlCache<string>, cacheKey?: string, metrics?: RequestMetrics, offlineDataOverride?: OfflineDataRaw) => Promise<void>;
+export declare const streamBody: (req: SSRRequest, res: SSRResponseHelpers, config: SSRPageServerConfig, spaceId: number, environment: Environment, revision: number, renderFn: SSRTemplateFn, pluginManager: PluginManager, offlineDataCache?: TtlCache<string>, htmlCache?: TtlCache<CachedPage>, cacheKey?: string, metrics?: RequestMetrics, offlineDataOverride?: OfflineDataRaw) => Promise<void>;

package/dist/modules/ssr/streamBody.js

@@ -30,7 +30,10 @@ var streamBody = async (req, res, config, spaceId, environment, revision, render
 				const tailBuf = Buffer.from(tail, "utf-8");
 				res.write(tailBuf);
 				res.end();
-				if (chunks && cacheKey && htmlCache) htmlCache.set(cacheKey, head + Buffer.concat(chunks).toString("utf-8") + tail);
+				if (chunks && cacheKey && htmlCache) htmlCache.set(cacheKey, {
+					html: head + Buffer.concat(chunks).toString("utf-8") + tail,
+					compressed: {}
+				});
 				resolve();
 				cb();
 			}