@plitzi/sdk-server 0.37.8 → 0.37.10

package/dist/core/http/stages/images.js

@@ -0,0 +1,47 @@
+import { serverLog } from "../../../helpers/serverLog.js";
+import { createImageProxy } from "../../../modules/images/imageProxy.js";
+import { loadSharpTransform } from "../../../modules/images/transform.js";
+import path from "node:path";
+import { IMAGE_PATH } from "@plitzi/sdk-shared/helpers/images";
+//#region src/core/http/stages/images.ts
+/** Where pictures are resized, when this server resizes them: published to the SDK, which builds every `srcset` on it. */
+var imagesPathOf = (config) => config.images && config.images.domains.length > 0 ? IMAGE_PATH : void 0;
+/** One proxy per configuration, made on the first request: `sharp` is looked for once, and said once when missing. */
+var proxies = /* @__PURE__ */ new WeakMap();
+var proxyFor = (images) => {
+	const known = proxies.get(images);
+	if (known) return known;
+	const made = loadSharpTransform().then((transform) => {
+		if (!transform) serverLog.warn("IMAGES", "sharp is not installed: pictures are passed through and kept, not resized (npm i sharp).");
+		return createImageProxy({
+			domains: images.domains,
+			cacheDir: path.resolve(images.cacheDir ?? ".plitzi/images"),
+			fetch: globalThis.fetch,
+			transform
+		});
+	});
+	proxies.set(images, made);
+	return made;
+};
+/** `/_plitzi/img?url=…&w=…` — a remote picture at one of the widths the SDK asks for. See `SSRImagesConfig`. */
+var imagesStage = async (ctx) => {
+	const { images } = ctx.config;
+	if (!images || imagesPathOf(ctx.config) === void 0 || ctx.req.path !== IMAGE_PATH) return false;
+	if (ctx.req.method !== "GET" && ctx.req.method !== "HEAD") {
+		ctx.res.setStatus(405);
+		ctx.res.setHeader("Allow", "GET, HEAD");
+		ctx.res.send("Method not allowed");
+		return true;
+	}
+	const answer = await (await proxyFor(images))({
+		url: ctx.req.query.url,
+		width: ctx.req.query.w,
+		accept: ctx.req.headers.accept ?? ""
+	});
+	ctx.res.setStatus(answer.status);
+	for (const [name, value] of Object.entries(answer.headers)) ctx.res.setHeader(name, value);
+	ctx.res.send(answer.body);
+	return true;
+};
+//#endregion
+export { imagesPathOf, imagesStage };

package/dist/core/http/stages/images.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/server/fleet/channel.js

@@ -1,5 +1,5 @@
+import { isRecord } from "@plitzi/sdk-shared/helpers/isRecord";
 //#region src/core/server/fleet/channel.ts
-var isRecord = (value) => typeof value === "object" && value !== null;
 /** The channel is shared with `node:cluster` and anything else the deployment sends: only these are ours. */
 var isFleetMessage = (value) => {
 	if (!isRecord(value)) return false;

package/dist/core/server/fleet/relay.js

@@ -1,5 +1,6 @@
 import { serverLog } from "../../../helpers/serverLog.js";
 import { broadcast, onBroadcast } from "./link.js";
+import { isRecord } from "@plitzi/sdk-shared/helpers/isRecord";
 //#region src/core/server/fleet/relay.ts
 /**
 * `server.cache` and `server.plugins` in a fleet, whose workers each keep their own: what one process is told, every
@@ -10,7 +11,6 @@ import { broadcast, onBroadcast } from "./link.js";
 * Code that runs in every process (a pub/sub subscription made where the server is created) is told N times; what
 * is relayed is safe to apply again, and cheap: it only drops entries from memory.
 */
-var isRecord = (value) => typeof value === "object" && value !== null;
 var PLUGIN_ACTIONS = [
 	"copy",
 	"compile",

package/dist/core/services/action.js

@@ -1,3 +1,4 @@
+import { connectorLookupsOf } from "../configSeam.js";
 import { handleActionCall } from "../../modules/actions/transport/callHandler.js";
 import { handleActionCatalog } from "../../modules/actions/transport/catalogHandler.js";
 import { handleActionWebhook } from "../../modules/actions/transport/webhookHandler.js";
@@ -38,8 +39,8 @@ var lineageOf = (req) => {
 var actionStage = async (ctx) => {
 	const { config, req, actions } = ctx;
 	const actionPath = config.action?.path ?? "/_action";
-	const hasConnectors = !!config.connectors;
-	if (!hasConnectors && !actions) return false;
+	const { connectors } = config;
+	if (!connectors && !actions) return false;
 	if (actions && req.method === "GET" && req.path === `${actionPath}/catalog`) {
 		ctx.operation = "action:catalog";
 		if (!req.ctx.user) {
@@ -104,7 +105,7 @@ var actionStage = async (ctx) => {
 		});
 		return true;
 	}
-	if (addressesAction || !hasConnectors) {
+	if (addressesAction || !connectors) {
 		ctx.operation = "action";
 		ctx.res.setStatus(404);
 		ctx.res.setHeader("Content-Type", "application/json; charset=utf-8");
@@ -115,7 +116,7 @@ var actionStage = async (ctx) => {
 		return true;
 	}
 	ctx.operation = "action";
-	await handleAction(req, ctx.res, config, config.connectors);
+	await handleAction(req, ctx.res, config, connectorLookupsOf(connectors));
 	return true;
 };
 //#endregion

package/dist/core/services/functionRoutes.d.ts

@@ -1,8 +1,8 @@
 import { SSRContext, Stage } from '../http/types';
 /**
- * The space's functions answering HTTP under `/api/`: a request there that a declared route answers is run
+ * The space's functions answering HTTP under `/fn/`: a request there that a declared route answers is run
  * by it — the deployment's own routes first, then the space's, in the sandbox — and anything else goes on to the page
- * server, which answers as it would have. `/api` is never a page: its slug is refused, so the path is the functions'.
+ * server, which answers as it would have. `/fn` is never a page: its slug is refused, so the path is the functions'.
  *
  * After the auth chain, so `ctx.user` is who the session says; the session itself never reaches the code.
  */

package/dist/core/services/functionRoutes.js

@@ -2,9 +2,9 @@ import { clientIp, readRawBytes, requestOrigin } from "../requestParser.js";
 import { FUNCTION_ROUTES_PREFIX } from "@plitzi/sdk-shared/actions";
 //#region src/core/services/functionRoutes.ts
 /**
-* The space's functions answering HTTP under `/api/`: a request there that a declared route answers is run
+* The space's functions answering HTTP under `/fn/`: a request there that a declared route answers is run
 * by it — the deployment's own routes first, then the space's, in the sandbox — and anything else goes on to the page
-* server, which answers as it would have. `/api` is never a page: its slug is refused, so the path is the functions'.
+* server, which answers as it would have. `/fn` is never a page: its slug is refused, so the path is the functions'.
 *
 * After the auth chain, so `ctx.user` is who the session says; the session itself never reaches the code.
 */

package/dist/core/services/registry.js

@@ -2,6 +2,7 @@ import { actionStage } from "./action.js";
 import { functionRoutesStage } from "./functionRoutes.js";
 import { realtimeStage } from "./realtime.js";
 import { rscStage } from "./rsc.js";
+import { imagesStage } from "../http/stages/images.js";
 import { notFoundStage, ssrStage } from "./ssr.js";
 import { authRoutesStages } from "../http/stages/authRoutes.js";
 import { fontAssetsStage } from "../http/stages/fontAssets.js";
@@ -17,6 +18,7 @@ var buildPagePipeline = (services, extensions = {}) => {
 		wellKnownStage,
 		pluginAssetsStage,
 		fontAssetsStage,
+		imagesStage,
 		...authRoutesStages,
 		configStaticStage,
 		sdkAssetsStage

package/dist/functions-api.d.ts

@@ -118,7 +118,7 @@ export declare type FunctionFetchInit = {
 };
 
 /**
- * An HTTP endpoint of the space, under `/api/`: a web-standard handler, the shape every edge runtime runs. The request
+ * An HTTP endpoint of the space, under `/fn/`: a web-standard handler, the shape every edge runtime runs. The request
  * carries no credentials — `ctx.user` says who is asking — and the response sets no cookies: the host's are the
  * platform's.
  */
@@ -136,8 +136,10 @@ export declare type FunctionsDefinition = {
         hosts?: string[];
     };
     tasks?: FunctionTask<never>[];
-    /** `'GET /board-assets/:board/:asset'` → a handler, served at `/api/board-assets/…`. */
+    /** `'GET /board-assets/:board/:asset'` → a handler, served at `/fn/board-assets/…`. */
     routes?: Record<string, FunctionRoute>;
+    /** More CPU or time than an invocation gets by default, for every task and route — a task may ask for its own. */
+    limits?: FunctionTimeLimits;
 };
 
 /**
@@ -151,9 +153,28 @@ export declare type FunctionTask<T extends Record<string, unknown> = Record<stri
     title: string;
     description?: string;
     params: Record<keyof T, InteractionCallbackParam<T>>;
+    /**
+     * More CPU or time than an invocation gets by default — `{ cpuMs: 1000 }` for a task that reshapes a big feed — up to
+     * what the server allows. Over the functions' own `limits`, for this task.
+     */
+    limits?: FunctionTimeLimits;
     run: (params: T, ctx: FunctionContext) => unknown;
 };
 
+/**
+ * A space's own functions, as everything outside the runner sees them: the builder, the CLI, the MCP and the
+ * platform that stores them. The contract the code itself is written against is `@plitzi/sdk-server/functions`.
+ */
+/**
+ * What a task — or every task and route, declared once for all of them — asks to be given beyond an invocation's
+ * default: CPU time, awaits not counted, and wall time, from the moment it starts. Never more than the server allows;
+ * asking for more is a problem when the functions are saved.
+ */
+declare type FunctionTimeLimits = {
+    cpuMs?: number;
+    wallMs?: number;
+};
+
 /**
  * Who started the run, as a space's own code may know them: everything a function decides by — who, their roles and
  * permissions — and never their session. A token inside the sandbox is a token a function could send anywhere.

package/dist/functions.d.ts

@@ -6,7 +6,7 @@
 export { ActionRefusal, defineFunctions } from './modules/functions/contract';
 export type { FunctionContext, FunctionFetch, FunctionFetchInit, FunctionRoute, FunctionRouteContext, FunctionsDefinition, FunctionTask, FunctionUser } from './modules/functions/contract';
 export type { FunctionsConfig, FunctionUsageRecord } from './modules/functions/config';
-export { DEFAULT_FUNCTION_LIMITS } from './modules/functions/config';
+export { DEFAULT_FUNCTION_CEILINGS, DEFAULT_FUNCTION_LIMITS } from './modules/functions/config';
 /**
  * What the platform keeps of a space's functions, and what it hands a runner: the built bundle and what it declared
  * when it was saved (`prepareFunctions` on the actions module is the one way to make one).

package/dist/functions.js

@@ -1,5 +1,5 @@
 import { ActionRefusal } from "./modules/actions/runtime/errors.js";
-import { DEFAULT_FUNCTION_LIMITS } from "./modules/functions/config.js";
+import { DEFAULT_FUNCTION_CEILINGS, DEFAULT_FUNCTION_LIMITS } from "./modules/functions/config.js";
 import { defineFunctions } from "./modules/functions/contract.js";
 import { TRY_STEP, functionTryEntry } from "./modules/functions/tryEntry.js";
-export { ActionRefusal, DEFAULT_FUNCTION_LIMITS, TRY_STEP, defineFunctions, functionTryEntry };
+export { ActionRefusal, DEFAULT_FUNCTION_CEILINGS, DEFAULT_FUNCTION_LIMITS, TRY_STEP, defineFunctions, functionTryEntry };

package/dist/helpers/cache/keys.d.ts

@@ -1,3 +1,14 @@
+/** What a cache key reads off a request: where it is, and — from the resolved deployment — what the flags are at. */
+type CacheKeyRequest = {
+    hostname: string;
+    path: string;
+    search: string;
+    ctx?: {
+        spaceDeployment?: {
+            flagsVersion?: string;
+        };
+    };
+};
 /**
  * The key a rendered document is cached under.
  *
@@ -14,13 +25,17 @@
  * values, so a page drawn with one visitor's toolbar must not be served to the next. Keyed by its raw value — this
  * key does not know which keys a space declares, and a space that declares none has no such cookie to split on.
  *
+ * So are the feature flags a tester forced from the dev tools, on a page that authorizes debugging: drawn with them,
+ * the page is not everybody's, and a tester holding the cookie must never be handed a page drawn without it. Keyed
+ * by its raw value, like the kept state.
+ *
+ * So is what the space's flags are at (`flagsVersion` on the resolved deployment), for a deployment that changes them
+ * apart from its revisions: a flag turned in production must reach the next visitor, while the revision is the same.
+ *
  * Read from the request here rather than handed in, so a call site cannot key the page without it. Only those
  * cookies are read: keying the whole header would split the cache on every analytics cookie a visitor carries.
  */
-export declare const buildHtmlCacheKey: (accessToken: string | undefined, spaceId: number | string | null, environment: string, revision: number, req: {
-    hostname: string;
-    path: string;
-    search: string;
+export declare const buildHtmlCacheKey: (accessToken: string | undefined, spaceId: number | string | null, environment: string, revision: number, req: CacheKeyRequest & {
     headers: {
         cookie?: string;
         host?: string;
@@ -36,9 +51,7 @@ export declare const readHtmlCacheKey: (key: string) => {
     environment: string;
     hostname: string;
 };
-export declare const buildOfflineDataCacheKey: (spaceId: number, environment: string, revision: number) => string;
-export declare const buildRscCacheKey: (spaceId: number, environment: string, revision: number, userId: string | number | undefined, idsParam: string | undefined, req: {
-    hostname: string;
-    path: string;
-    search: string;
-}) => string;
+/** The space as read for a render: its revision, and what its flags are at when they change apart from it. */
+export declare const buildOfflineDataCacheKey: (spaceId: number, environment: string, revision: number, flagsVersion: string | undefined) => string;
+export declare const buildRscCacheKey: (spaceId: number, environment: string, revision: number, userId: string | number | undefined, idsParam: string | undefined, req: CacheKeyRequest) => string;
+export {};

package/dist/helpers/cache/keys.js

@@ -1,17 +1,21 @@
 import { ssrPaintedCookieName } from "../paintedCookie.js";
 import { readCookie } from "../readCookie.js";
+import { flagsCookieName } from "@plitzi/sdk-shared/flags";
 import { debugCookieName } from "@plitzi/sdk-shared/devTools";
 import { themeFromCookies } from "@plitzi/sdk-shared/theme";
 //#region src/helpers/cache/keys.ts
+var flagsVersionOf = (req) => req.ctx?.spaceDeployment?.flagsVersion ?? "";
 /** The fields of an HTML key, in the order they are joined. */
 var HTML_KEY_FIELDS = [
 	"accessToken",
 	"spaceId",
 	"environment",
 	"revision",
+	"flags",
 	"theme",
 	"painted",
 	"debugHidden",
+	"forcedFlags",
 	"hostname",
 	"path",
 	"search"
@@ -32,6 +36,13 @@ var HTML_KEY_FIELDS = [
 * values, so a page drawn with one visitor's toolbar must not be served to the next. Keyed by its raw value — this
 * key does not know which keys a space declares, and a space that declares none has no such cookie to split on.
 *
+* So are the feature flags a tester forced from the dev tools, on a page that authorizes debugging: drawn with them,
+* the page is not everybody's, and a tester holding the cookie must never be handed a page drawn without it. Keyed
+* by its raw value, like the kept state.
+*
+* So is what the space's flags are at (`flagsVersion` on the resolved deployment), for a deployment that changes them
+* apart from its revisions: a flag turned in production must reach the next visitor, while the revision is the same.
+*
 * Read from the request here rather than handed in, so a call site cannot key the page without it. Only those
 * cookies are read: keying the whole header would split the cache on every analytics cookie a visitor carries.
 */
@@ -41,9 +52,11 @@ var buildHtmlCacheKey = (accessToken = "anonymous", spaceId, environment, revisi
 		spaceId: String(spaceId ?? 1),
 		environment,
 		revision: String(revision),
+		flags: flagsVersionOf(req),
 		theme: themeFromCookies(req.headers.cookie) ?? "",
 		painted: readCookie(req.headers.cookie, ssrPaintedCookieName(req.headers.host)) ?? "",
 		debugHidden: readCookie(req.headers.cookie, debugCookieName(req.headers.host)) === "false" ? "debug-off" : "",
+		forcedFlags: readCookie(req.headers.cookie, flagsCookieName(req.headers.host)) ?? "",
 		hostname: req.hostname,
 		path: req.path,
 		search: req.search
@@ -64,7 +77,8 @@ var readHtmlCacheKey = (key) => {
 		hostname: at("hostname")
 	};
 };
-var buildOfflineDataCacheKey = (spaceId, environment, revision) => `${spaceId}|${environment}|${revision}`;
-var buildRscCacheKey = (spaceId, environment, revision, userId, idsParam, req) => `${spaceId}\0${environment}\0${revision}\0${userId ?? "anon"}\0${idsParam ?? ""}\0${req.hostname}\0${req.path}\0${req.search}`;
+/** The space as read for a render: its revision, and what its flags are at when they change apart from it. */
+var buildOfflineDataCacheKey = (spaceId, environment, revision, flagsVersion) => `${spaceId}|${environment}|${revision}|${flagsVersion ?? ""}`;
+var buildRscCacheKey = (spaceId, environment, revision, userId, idsParam, req) => `${spaceId}\0${environment}\0${revision}\0${flagsVersionOf(req)}\0${userId ?? "anon"}\0${idsParam ?? ""}\0${req.hostname}\0${req.path}\0${req.search}`;
 //#endregion
 export { buildHtmlCacheKey, buildOfflineDataCacheKey, buildRscCacheKey, readHtmlCacheKey };

package/dist/helpers/flagOverrides.d.ts

@@ -0,0 +1,27 @@
+import { Environment, FlagOverrides, SSRServerConfig } from '@plitzi/sdk-shared';
+/** The deployment's own layer for one space: `config.flags`, asked per space when it is a function. */
+export declare const serverFlagsFor: (config: Pick<SSRServerConfig, "flags">, space: {
+    spaceId: number;
+    environment: Environment;
+}) => Record<string, boolean> | undefined;
+/**
+ * The flags a tester forced from the dev tools, for a request allowed to debug — undefined for everybody else, and for
+ * a tester who forced nothing. Authorization is asked only when there is a cookie to honour, because answering it can
+ * mean reading the space.
+ */
+export declare const forcedFlagsFor: (req: {
+    headers: {
+        cookie?: string;
+        host?: string;
+    };
+}, authorized: boolean | (() => Promise<boolean>)) => Promise<Record<string, boolean> | undefined>;
+/** Both layers this server answers for, for one request. */
+export declare const requestFlagOverrides: (config: Pick<SSRServerConfig, "flags">, req: {
+    headers: {
+        cookie?: string;
+        host?: string;
+    };
+}, space: {
+    spaceId: number;
+    environment: Environment;
+}, authorized: boolean | (() => Promise<boolean>)) => Promise<FlagOverrides>;

package/dist/helpers/flagOverrides.js

@@ -0,0 +1,25 @@
+import { forcedFlagsFromCookies } from "@plitzi/sdk-shared/flags";
+//#region src/helpers/flagOverrides.ts
+/** The deployment's own layer for one space: `config.flags`, asked per space when it is a function. */
+var serverFlagsFor = (config, space) => typeof config.flags === "function" ? config.flags(space) : config.flags;
+/**
+* The flags a tester forced from the dev tools, for a request allowed to debug — undefined for everybody else, and for
+* a tester who forced nothing. Authorization is asked only when there is a cookie to honour, because answering it can
+* mean reading the space.
+*/
+var forcedFlagsFor = async (req, authorized) => {
+	const forced = forcedFlagsFromCookies(req.headers.cookie, req.headers.host);
+	if (Object.keys(forced).length === 0) return;
+	return (typeof authorized === "boolean" ? authorized : await authorized()) ? forced : void 0;
+};
+/** Both layers this server answers for, for one request. */
+var requestFlagOverrides = async (config, req, space, authorized) => {
+	const server = serverFlagsFor(config, space);
+	const qa = await forcedFlagsFor(req, authorized);
+	return {
+		...server ? { server } : {},
+		...qa ? { qa } : {}
+	};
+};
+//#endregion
+export { forcedFlagsFor, requestFlagOverrides, serverFlagsFor };

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { createServer, resolveServices } from './core/createServer';
 export { closeOnSignals } from './core/server/closeOnSignals';
 export { loadFunctions, readFunctionsDir } from './modules/functions/load';
+export { freePort } from './core/freePort';
 export { registerHealthCheck, buildHealthPayload } from './core/health';
 export { consoleLogger, isLogged, logLevelOf, renderLogEvent, serverLog } from './helpers/serverLog';
 export type { HealthCheckApp, HealthIdentity } from './core/health';

package/dist/index.js

@@ -10,6 +10,7 @@ import { buildHealthPayload, registerHealthCheck } from "./core/health.js";
 import { createServer } from "./core/createServer.js";
 import { closeOnSignals } from "./core/server/closeOnSignals.js";
 import { loadFunctions, readFunctionsDir } from "./modules/functions/load.js";
+import { freePort } from "./core/freePort.js";
 import { createCloudAdapters } from "./adapters/cloudAdapters.js";
 import { createJsonAdapters } from "./adapters/jsonAdapters.js";
 import { createAuthAdapters } from "./adapters/authAdapters.js";
@@ -18,4 +19,4 @@ import { authoringPreview, fixedSpace, presentsCredential, verifiedDomain, wildc
 import { createSpaceAdapters } from "./adapters/space/index.js";
 import { createLocalFontStore, hostedPathsOf } from "./core/fontStore.js";
 import { createRedisPubSub } from "./modules/realtime/redisPubSub.js";
-export { PREVIEW_TOKEN_PARAM, authoringPreview, buildHealthPayload, closeOnSignals, consoleLogger, createAuthAdapters, createCloudAdapters, createConnectorResolver, createJsonAdapters, createLocalFontStore, createMemoryCache, createMemoryDraftStore, createMemoryPubSub, createRedisPubSub, createServer, createSpaceAdapters, fetchConnectorRecords, fixedSpace, hostedPathsOf, isLogged, loadFunctions, logLevelOf, presentsCredential, readFunctionsDir, rebaseMedia, refuse, registerHealthCheck, renderLogEvent, resolveRscData, resolveServices, serverLog, takeDraftOverride, verifiedDomain, wildcardSubdomain, writeConnectorRecord };
+export { PREVIEW_TOKEN_PARAM, authoringPreview, buildHealthPayload, closeOnSignals, consoleLogger, createAuthAdapters, createCloudAdapters, createConnectorResolver, createJsonAdapters, createLocalFontStore, createMemoryCache, createMemoryDraftStore, createMemoryPubSub, createRedisPubSub, createServer, createSpaceAdapters, fetchConnectorRecords, fixedSpace, freePort, hostedPathsOf, isLogged, loadFunctions, logLevelOf, presentsCredential, readFunctionsDir, rebaseMedia, refuse, registerHealthCheck, renderLogEvent, resolveRscData, resolveServices, serverLog, takeDraftOverride, verifiedDomain, wildcardSubdomain, writeConnectorRecord };

package/dist/modules/actions/index.d.ts

@@ -66,4 +66,4 @@ export type { ActionJobs, JobWorker, JobWorkerOptions, Scheduler, SchedulerOptio
 export type { ActiveRun, RunGuards } from './runtime/guards';
 export type { ActionTaskDescriptor } from './taskCatalog';
 export type { TaskRegistryOptions } from './tasks/registry';
-export type { ActionCredential, ActionDbDriver, ActionEmailConfig, ActionEmailDelivery, ActionEmailMessage, ActionEmailTransport, ActionJobsConfig, ActionKvStore, ActionLookups, ActionRejectRecord, ActionRunRecord, ActionRunRequest, ActionRunResult, ActionsConfig, ActionTask, ActionTaskContext, ActionTaskRegistry, RegisteredTask, ResolvedConnector } from './types';
+export type { ActionCredential, ActionDbDriver, ActionEmailConfig, ActionEmailDelivery, ActionEmailMessage, ActionEmailTransport, ActionJobsConfig, ActionKvStore, ActionLookups, ActionRejectRecord, ActionRunRecord, ActionRunRequest, ActionRunResult, ActionsConfig, ActionTask, ActionTaskContext, ActionTaskOrigin, ActionTaskRegistry, RegisteredTask, ResolvedConnector } from './types';

package/dist/modules/actions/index.js

@@ -12,6 +12,7 @@ import { namespaceKv, spaceKvPatterns } from "./runtime/namespaceKv.js";
 import "./runtime/precheck.js";
 import { createActionRunner } from "./runtime/runAction.js";
 import { createTaskRegistry } from "./tasks/registry.js";
+import { functionCeilings } from "../functions/config.js";
 import { readManifest } from "../functions/manifest.js";
 import { createRoutes } from "../functions/routes.js";
 import { createSpaceRegistries, prepareFunctions } from "../functions/space.js";
@@ -72,12 +73,12 @@ var createActionsModule = (given) => {
 		routeFor: routes.routeFor,
 		prepareFunctions: (source) => {
 			const runner = config.functions?.runner;
-			return runner ? prepareFunctions(source, runner, reserved) : Promise.resolve({
+			return runner ? prepareFunctions(source, runner, reserved, functionCeilings(config.functions?.limits)) : Promise.resolve({
 				ok: false,
 				problems: [{ message: "This server runs no space functions" }]
 			});
 		},
-		readManifest: (declared) => readManifest(declared, reserved),
+		readManifest: (declared) => readManifest(declared, reserved, functionCeilings(config.functions?.limits)),
 		guards,
 		kv: (spaceId) => namespaceKv(kv, spaceId),
 		limitsFor

package/dist/modules/actions/moduleFor.js

@@ -1,3 +1,4 @@
+import { actionLookupsOf, dbDriversOf, functionsConfigOf } from "../../core/configSeam.js";
 import { createActionsModule } from "./index.js";
 import { realtimeModuleFor } from "../realtime/index.js";
 //#region src/modules/actions/moduleFor.ts
@@ -19,8 +20,9 @@ var actionsModuleFor = (config) => {
 	const existing = modules.get(config);
 	if (existing) return existing;
 	const module = createActionsModule({
-		lookups,
-		functions: config.functions,
+		lookups: actionLookupsOf(lookups),
+		flags: config.flags,
+		functions: functionsConfigOf(config.functions),
 		limits: config.action?.limits,
 		concurrency: config.action?.concurrency,
 		kv: config.action?.kv,
@@ -28,7 +30,7 @@ var actionsModuleFor = (config) => {
 		rateLimit: config.action?.rateLimit,
 		idempotency: config.action?.idempotency,
 		signingSecret: config.action?.signingSecret,
-		dbDrivers: config.action?.dbDrivers,
+		dbDrivers: dbDriversOf(config.action?.dbDrivers),
 		email: config.action?.email,
 		onRun: config.action?.onRun,
 		realtime: realtimeModuleFor(config)

package/dist/modules/actions/runtime/flags.d.ts

@@ -0,0 +1,16 @@
+import { ActionRunRequest, ActionsConfig } from '../types';
+/**
+ * Whether a flow names `flags` anywhere — a template, a `when` rule's field. Only those are worth a lookup: most flows
+ * read no flag, and asking for the space's flags on every run of every one of them would be a read per click.
+ *
+ * Over the serialized document, so a template in any step's params counts without knowing every step's shape. A word
+ * `flags` that is not the source costs one lookup that was not needed, never a flow without its flags. Kept per
+ * document, which the lookups hand out once per version.
+ */
+export declare const readsFlags: (document: object) => boolean;
+/**
+ * The space's flags as this run sees them: what the space declares at the run's revision, matched against the run's
+ * environment and visitor, then the server's own layer and a tester's forced one — the same order a page resolves
+ * them in. A run has no URL, so a rule on the host or the route does not match here.
+ */
+export declare const flagsForRun: (config: Pick<ActionsConfig, "lookups" | "flags">, request: Pick<ActionRunRequest, "entry" | "spaceId" | "environment" | "at" | "user" | "forcedFlags">) => Promise<Record<string, boolean>>;

package/dist/modules/actions/runtime/flags.js

@@ -0,0 +1,49 @@
+import { serverLog } from "../../../helpers/serverLog.js";
+import { serverFlagsFor } from "../../../helpers/flagOverrides.js";
+import { flagUserFromSSR, flagValues, resolveFlags, undeclaredFlagOverrides } from "@plitzi/sdk-shared/flags";
+//#region src/modules/actions/runtime/flags.ts
+var reading = /* @__PURE__ */ new WeakMap();
+/**
+* Whether a flow names `flags` anywhere — a template, a `when` rule's field. Only those are worth a lookup: most flows
+* read no flag, and asking for the space's flags on every run of every one of them would be a read per click.
+*
+* Over the serialized document, so a template in any step's params counts without knowing every step's shape. A word
+* `flags` that is not the source costs one lookup that was not needed, never a flow without its flags. Kept per
+* document, which the lookups hand out once per version.
+*/
+var readsFlags = (document) => {
+	const known = reading.get(document);
+	if (known !== void 0) return known;
+	const reads = /\bflags\b/.test(JSON.stringify(document));
+	reading.set(document, reads);
+	return reads;
+};
+/**
+* The space's flags as this run sees them: what the space declares at the run's revision, matched against the run's
+* environment and visitor, then the server's own layer and a tester's forced one — the same order a page resolves
+* them in. A run has no URL, so a rule on the host or the route does not match here.
+*/
+var flagsForRun = async (config, request) => {
+	if (!readsFlags(request.entry.document)) return {};
+	const { getFlags } = config.lookups;
+	if (!getFlags) {
+		serverLog.warn("Actions", `Action "${request.entry.id}" reads flags, but this deployment's action lookups have no getFlags: it sees none.`);
+		return {};
+	}
+	const declared = await getFlags(request.spaceId, request.at);
+	const { spaceId, environment, user } = request;
+	const overrides = {
+		server: serverFlagsFor(config, {
+			spaceId,
+			environment
+		}),
+		qa: request.forcedFlags
+	};
+	undeclaredFlagOverrides(declared, { server: overrides.server }).forEach(({ name }) => serverLog.warn("Actions", `The server sets the flag "${name}", which space ${spaceId} does not declare.`));
+	return flagValues(resolveFlags(declared, {
+		environment,
+		user: flagUserFromSSR(user)
+	}, overrides));
+};
+//#endregion
+export { flagsForRun, readsFlags };

package/dist/modules/actions/runtime/flags.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/actions/runtime/kvList.js

@@ -1,3 +1,4 @@
+import { isRecord } from "@plitzi/sdk-shared/helpers/isRecord";
 //#region src/modules/actions/runtime/kvList.ts
 /**
 * The most a list holds. A list is one value of the store, read and written whole, so it is for what a page shows at
@@ -11,7 +12,6 @@ var MAX_LIST_ENTRIES = 500;
 var MAX_LIST_BYTES = 128e3;
 var ID = /^[A-Za-z0-9:_.@-]{1,128}$/;
 var listIdProblem = (id) => typeof id === "string" && ID.test(id) ? void 0 : "A list entry’s id is 1-128 of A-Z a-z 0-9 : _ . @ -";
-var isRecord = (value) => typeof value === "object" && value !== null;
 var isEntry = (value) => isRecord(value) && typeof value.id === "string" && typeof value.score === "number";
 /** The entries a stored list holds — none for a key that holds nothing, or something that is not a list. */
 var parseList = (raw) => {

package/dist/modules/actions/runtime/renderResolver.js

@@ -72,6 +72,7 @@ var createActionResolver = (lookups, module) => {
 			values
 		]);
 		const callerId = user ? `user:${user.id}` : "render";
+		let ownRunId;
 		const startRun = async () => {
 			/**
 			* A key of its own per render, so two visitors are never each other's duplicate.
@@ -90,6 +91,7 @@ var createActionResolver = (lookups, module) => {
 				kind: "render",
 				ttlMs: module.limitsFor(entry.document).timeoutMs
 			});
+			ownRunId = run.runId;
 			/**
 			* The render giving up ends the run, not just the wait for it.
 			*
@@ -157,13 +159,35 @@ var createActionResolver = (lookups, module) => {
 				await module.guards.end(run);
 			}
 		};
+		let told = false;
 		const record = (summary) => {
-			(req.ctx.actionRuns ??= []).push({
-				...summary,
-				elementId: element.id
-			});
+			if (!told) {
+				told = true;
+				(req.ctx.actionRuns ??= []).push({
+					...summary,
+					elementId: element.id
+				});
+			}
 		};
 		/**
+		* The page stopped waiting — the section's budget ran out — and is answered without it: said NOW, while the page
+		* still has the request's runs to send. The run itself ends a moment later, aborted, when the page has gone; told
+		* then, a debugger would never hear of the one run it needed to — the slow one.
+		*/
+		const askedAt = Date.now();
+		const stopWaiting = onAbort(signal, () => {
+			record({
+				actionId: entry.id,
+				runId: ownRunId ?? `render:${randomUUID()}`,
+				trigger: "render",
+				status: "aborted",
+				startedAt: askedAt,
+				endedAt: Date.now(),
+				steps: [],
+				error: "Still running when the page stopped waiting for it: it took longer than a section is given"
+			});
+		});
+		/**
 		* Everyone asking the same question at once gets one run, and its answer.
 		*
 		* Not an optimisation — it is what makes a page survive being read. Without it, a thousand visitors of one URL
@@ -177,6 +201,8 @@ var createActionResolver = (lookups, module) => {
 		} catch (error) {
 			if (error instanceof RenderRunFailure) record(error.summary);
 			throw error;
+		} finally {
+			stopWaiting();
 		}
 	};
 };

package/dist/modules/actions/runtime/runAction.js

@@ -5,6 +5,7 @@ import { createKvStore } from "./kvStore.js";
 import { resolveLimits } from "./limits.js";
 import { createMemoryKv } from "./memoryKv.js";
 import { createEmailSender } from "./email.js";
+import { flagsForRun } from "./flags.js";
 import { createRedactor, projectUser } from "./scope.js";
 import { precheckRun } from "./precheck.js";
 import { createSigning } from "./signing.js";
@@ -240,6 +241,7 @@ var createActionRunner = (config, registryFor, baseFetch = fetch) => {
 		const scope = {
 			input: values,
 			user: projectUser(request.user),
+			flags: await flagsForRun(config, request),
 			spaceId: request.spaceId,
 			environment: request.environment,
 			trigger: request.trigger,