@plitzi/sdk-server 0.37.8 → 0.37.10

package/dist/modules/actions/taskCatalog.d.ts

@@ -1,4 +1,4 @@
-import { ActionTaskRegistry, RegisteredTask } from './types';
+import { ActionTaskOrigin, ActionTaskRegistry, RegisteredTask } from './types';
 /**
  * A task as an editor renders it.
  *
@@ -18,6 +18,8 @@ export type ActionTaskDescriptor = {
     action: string;
     title: string;
     description?: string;
+    /** The deployment's step, or one of the space's own functions. */
+    origin: ActionTaskOrigin;
     /** Serializable params only — see above. */
     params: Record<string, unknown>;
 };

package/dist/modules/actions/taskCatalog.js

@@ -16,6 +16,7 @@ var describeTask = (task) => ({
 	action: task.action,
 	title: task.title,
 	description: task.description,
+	origin: task.origin,
 	params: jsonSafe(task.params)
 });
 /** The whole catalog, in the order the registry holds it. */

package/dist/modules/actions/tasks/registry.js

@@ -26,7 +26,8 @@ var createTaskRegistry = (functions = [], { db = false } = {}) => {
 	const tasks = /* @__PURE__ */ new Map();
 	(db ? [...builtinTasks, ...dbTasks] : builtinTasks).forEach((task) => tasks.set(taskName(task), {
 		...task,
-		name: taskName(task)
+		name: taskName(task),
+		origin: "deployment"
 	}));
 	nativeTasks(functions).forEach((task) => {
 		const problem = taskNameProblem(task);
@@ -35,7 +36,8 @@ var createTaskRegistry = (functions = [], { db = false } = {}) => {
 		if (tasks.has(name)) throw new Error(`[Actions] Task "${name}" is registered twice`);
 		tasks.set(name, {
 			...task,
-			name
+			name,
+			origin: "deployment"
 		});
 	});
 	return {

package/dist/modules/actions/transport/callHandler.js

@@ -1,6 +1,7 @@
 import { serverLog } from "../../../helpers/serverLog.js";
 import { triggerParams } from "../runtime/triggers.js";
 import { ActionRunError } from "../runtime/errors.js";
+import { forcedFlagsFor } from "../../../helpers/flagOverrides.js";
 import { precheckRun } from "../runtime/precheck.js";
 import onAbort from "../../../helpers/onAbort.js";
 import { openStream, wantsStream } from "./stream.js";
@@ -176,6 +177,12 @@ var handleActionCall = async (deps) => {
 	const readsRun = mayReadTrace(entryPoint, req.ctx.user);
 	const fullTrace = readsRun && (authoring === true || config.devMode === true);
 	const showsOutline = async () => readsRun && (fullTrace || await resolveDebugAuthorization(config, async () => (await config.adapters.getOfflineData(spaceId, environment, revision))?.schema.settings));
+	/**
+	* The flags a tester forced on the page this call came from, so the flow sees the feature the page was drawn with.
+	* Only for a page allowed to debug — the cookie is the visitor's own, and anywhere else it would let any of them
+	* switch a feature on for the server too. The authorization is asked only when there is a cookie to honour.
+	*/
+	const forcedFlags = await forcedFlagsFor(req, () => resolveDebugAuthorization(config, async () => (await config.adapters.getOfflineData(spaceId, environment, revision))?.schema.settings));
 	let outcome;
 	try {
 		const result = await module.runAction({
@@ -192,6 +199,7 @@ var handleActionCall = async (deps) => {
 				environment,
 				revision
 			},
+			...forcedFlags ? { forcedFlags } : {},
 			signal: run.controller.signal,
 			...stream ? {
 				emit: (chunk) => stream.send({

package/dist/modules/actions/types.d.ts

@@ -4,7 +4,7 @@ import { SpaceFunctions } from '../functions/protocol';
 import { KvChangeLifetime } from './runtime/kvChange';
 import { KvListEntry, KvListPut, KvListPutOptions, KvListRange } from './runtime/kvList';
 import { SpaceSigning } from './runtime/signing';
-import { ActionEmailConfig, ActionJobQueue, ActionEntry, ActionLimits, ActionRejectRecord, ActionRunRecord, ActionRunStatus, ActionRunStep, ActionTriggerType, ConnectorManifest, Environment, InteractionCallbackParam, InteractionNode, InteractionNodeStatus, SpaceRevision, SSRUser } from '@plitzi/sdk-shared';
+import { ActionEmailConfig, ActionJobQueue, ActionEntry, ActionLimits, ActionRejectRecord, ActionRunRecord, ActionRunStatus, ActionRunStep, ActionTriggerType, ConnectorManifest, Environment, InteractionCallbackParam, InteractionNode, InteractionNodeStatus, Schema, SpaceRevision, SSRServerConfig, SSRUser } from '@plitzi/sdk-shared';
 /** Resolved secret material, as the connector engine already models it. */
 export type ActionCredential = Record<string, string>;
 /**
@@ -120,6 +120,11 @@ export type ActionLookups = {
      * asked when a run names a task the deployment does not have, or a request a path under `/api/`.
      */
     getFunctions?: (spaceId: number, at?: SpaceRevision) => Promise<SpaceFunctions | undefined>;
+    /**
+     * The feature flags the space declares as of that revision, for a flow that reads `{{ flags.<name> }}`. Only asked
+     * for a run whose document names `flags` at all. Absent, such a flow sees no flags — and the server says so.
+     */
+    getFlags?: (spaceId: number, at?: SpaceRevision) => Promise<Schema['flags']>;
 };
 /**
  * The only door a task has to the outside world.
@@ -219,8 +224,14 @@ export type ActionTask<T extends Record<string, unknown> = Record<string, unknow
     run: (params: T, ctx: ActionTaskContext) => unknown;
 };
 /** A task with its addressable name resolved, as the registry stores and lists it. */
+/**
+ * Whose task it is: the deployment's — shipped with the server, or its own native functions — or the space's, from the
+ * functions it saved. The run treats both alike; an editor lists them apart, as the platform's steps and the space's own.
+ */
+export type ActionTaskOrigin = 'deployment' | 'space';
 export type RegisteredTask = ActionTask<Record<string, unknown>> & {
     name: string;
+    origin: ActionTaskOrigin;
 };
 export type ActionTaskRegistry = {
     get: (name: string) => RegisteredTask | undefined;
@@ -229,6 +240,8 @@ export type ActionTaskRegistry = {
 /** What a deployment hands to `createServer` under `actions`. Absent → the module is never constructed. */
 export type ActionsConfig = {
     lookups: ActionLookups;
+    /** The flags this deployment decides — the server's own `flags`, which a flow sees the way a page does. */
+    flags?: SSRServerConfig['flags'];
     /** Code of the server's own, and the sandbox for the spaces' — see `FunctionsConfig`. */
     functions?: FunctionsConfig;
     /** Ceilings a per-action document may tighten but never exceed. */
@@ -380,6 +393,12 @@ export type ActionRunRequest = {
      * miniature.
      */
     at?: SpaceRevision;
+    /**
+     * The flags a tester forced, for a run started from a page allowed to debug — the same `qa` layer the page was
+     * drawn with, so a forced feature is not on in the page and off in the flow behind it. Never what the SDK's own
+     * `flags` say: those are the browser's claim, and a flow does not take a claim as a fact.
+     */
+    forcedFlags?: Record<string, boolean>;
     emit?: (chunk: unknown) => void;
     /** Reports each step as it settles, for a caller watching the run happen. Absent for a plain request/response. */
     onNode?: (id: string, status: InteractionNodeStatus) => void;

package/dist/modules/connectors/engine.js

@@ -1,7 +1,7 @@
 import { fetchOutbound } from "../../helpers/outboundGuard.js";
 import { getByPath } from "./getByPath.js";
-import { processTwig } from "@plitzi/sdk-shared/helpers/twigWrapper";
 import { BODYLESS_METHODS, DEFAULT_READ_ENDPOINT, EMPTY_RESPONSE_METHODS } from "@plitzi/sdk-shared/connectors";
+import { processTwig } from "@plitzi/sdk-shared/helpers/twigWrapper";
 //#region src/modules/connectors/engine.ts
 var DEFAULT_LIMIT = 10;
 /** Only scalars can become a URL fragment, a header or a record key. Anything else is treated as absent. */

package/dist/modules/functions/capabilities.js

@@ -1,3 +1,4 @@
+import { isRecord } from "@plitzi/sdk-shared/helpers/isRecord";
 //#region src/modules/functions/capabilities.ts
 var TEXTUAL = /^(text\/|application\/([\w.+-]*\+)?(json|xml|javascript|x-www-form-urlencoded))/i;
 /** A body as the wire carries it: as text when its type says it is text, base64 otherwise. */
@@ -42,7 +43,6 @@ var numberArg = (value, what) => {
 	return value;
 };
 var optionalNumber = (value, what) => value === void 0 || value === null ? void 0 : numberArg(value, what);
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var headerPairsOf = (value) => Array.isArray(value) ? value.flatMap((pair) => Array.isArray(pair) && typeof pair[0] === "string" && typeof pair[1] === "string" ? [[pair[0], pair[1]]] : []) : [];
 var wireBodyFrom = (value) => {
 	const body = isRecord(value) ? value : void 0;

package/dist/modules/functions/config.d.ts

@@ -1,5 +1,6 @@
 import { FunctionsDefinition } from './contract';
 import { FunctionLimits, FunctionRunner, FunctionUsage } from './protocol';
+import { FunctionTimeLimits } from '@plitzi/sdk-shared';
 /** One invocation of a space's task, as metering sees it. */
 export type FunctionUsageRecord = {
     spaceId: number;
@@ -19,7 +20,11 @@ export type FunctionsConfig = {
      * functions here — their tasks are not offered and none of their code runs.
      */
     runner?: FunctionRunner;
-    /** The most one invocation may spend on this deployment. A space's plan may ask for less, never more. */
+    /**
+     * The most one invocation may spend on this deployment ({@link DEFAULT_FUNCTION_CEILINGS} for each unset): what a
+     * task may ask for in CPU and time, and what every invocation gets of the rest. A space's plan may allow less, never
+     * more.
+     */
     limits?: Partial<FunctionLimits>;
     /**
      * Asked before each invocation: why this space may not run code right now — its account spent its CPU for the minute,
@@ -29,6 +34,17 @@ export type FunctionsConfig = {
     /** Told what each invocation spent, however it ended: what `admit` budgets by, and what a deployment meters. */
     onUsage?: (record: FunctionUsageRecord) => void;
 };
+/** What an invocation gets unless its task asks for more CPU or time. */
 export declare const DEFAULT_FUNCTION_LIMITS: FunctionLimits;
-/** What one invocation of a space may spend: its own limits, never above the deployment's. */
-export declare const functionLimitsFor: (ceilings?: Partial<FunctionLimits>, space?: Partial<FunctionLimits>) => FunctionLimits;
+/**
+ * The most a deployment lets one invocation have, unless it says otherwise: two seconds of CPU and half a minute of
+ * time for a task that asks; the rest as every invocation gets it.
+ */
+export declare const DEFAULT_FUNCTION_CEILINGS: FunctionLimits;
+/** A deployment's ceilings, each unset one the default's. */
+export declare const functionCeilings: (ceilings?: Partial<FunctionLimits>) => FunctionLimits;
+/**
+ * What one invocation of a space may spend: the CPU and time its task asked for — the default's when it asked for none
+ * — and the rest as the deployment gives it; never above the space's plan, nor above the deployment's ceilings.
+ */
+export declare const functionLimitsFor: (ceilings?: Partial<FunctionLimits>, space?: Partial<FunctionLimits>, asked?: FunctionTimeLimits) => FunctionLimits;

package/dist/modules/functions/config.js

@@ -1,24 +1,40 @@
+import { DEFAULT_FUNCTION_TIME_LIMITS } from "@plitzi/sdk-shared/actions";
 //#region src/modules/functions/config.ts
+/** What an invocation gets unless its task asks for more CPU or time. */
 var DEFAULT_FUNCTION_LIMITS = {
-	cpuMs: 100,
-	wallMs: 1e4,
+	...DEFAULT_FUNCTION_TIME_LIMITS,
 	memoryMb: 64,
 	outputBytes: 1e6,
 	calls: 100
 };
-/** What one invocation of a space may spend: its own limits, never above the deployment's. */
-var functionLimitsFor = (ceilings = {}, space = {}) => {
-	const ceiling = {
-		...DEFAULT_FUNCTION_LIMITS,
-		...ceilings
-	};
+/**
+* The most a deployment lets one invocation have, unless it says otherwise: two seconds of CPU and half a minute of
+* time for a task that asks; the rest as every invocation gets it.
+*/
+var DEFAULT_FUNCTION_CEILINGS = {
+	...DEFAULT_FUNCTION_LIMITS,
+	cpuMs: 2e3,
+	wallMs: 3e4
+};
+/** A deployment's ceilings, each unset one the default's. */
+var functionCeilings = (ceilings = {}) => ({
+	...DEFAULT_FUNCTION_CEILINGS,
+	...ceilings
+});
+/**
+* What one invocation of a space may spend: the CPU and time its task asked for — the default's when it asked for none
+* — and the rest as the deployment gives it; never above the space's plan, nor above the deployment's ceilings.
+*/
+var functionLimitsFor = (ceilings = {}, space = {}, asked = {}) => {
+	const ceiling = functionCeilings(ceilings);
+	const capOf = (key) => Math.min(space[key] ?? ceiling[key], ceiling[key]);
 	return {
-		cpuMs: Math.min(space.cpuMs ?? ceiling.cpuMs, ceiling.cpuMs),
-		wallMs: Math.min(space.wallMs ?? ceiling.wallMs, ceiling.wallMs),
-		memoryMb: Math.min(space.memoryMb ?? ceiling.memoryMb, ceiling.memoryMb),
-		outputBytes: Math.min(space.outputBytes ?? ceiling.outputBytes, ceiling.outputBytes),
-		calls: Math.min(space.calls ?? ceiling.calls, ceiling.calls)
+		cpuMs: Math.min(asked.cpuMs ?? DEFAULT_FUNCTION_LIMITS.cpuMs, capOf("cpuMs")),
+		wallMs: Math.min(asked.wallMs ?? DEFAULT_FUNCTION_LIMITS.wallMs, capOf("wallMs")),
+		memoryMb: capOf("memoryMb"),
+		outputBytes: capOf("outputBytes"),
+		calls: capOf("calls")
 	};
 };
 //#endregion
-export { DEFAULT_FUNCTION_LIMITS, functionLimitsFor };
+export { DEFAULT_FUNCTION_CEILINGS, DEFAULT_FUNCTION_LIMITS, functionCeilings, functionLimitsFor };

package/dist/modules/functions/contract.d.ts

@@ -1,6 +1,6 @@
 import { RateCount, RateLimit } from '../actions/runtime/rateLimit';
 import { ActionKvStore } from '../actions/types';
-import { Environment, InteractionCallbackParam } from '@plitzi/sdk-shared';
+import { Environment, FunctionTimeLimits, InteractionCallbackParam } from '@plitzi/sdk-shared';
 /**
  * Who started the run, as a space's own code may know them: everything a function decides by — who, their roles and
  * permissions — and never their session. A token inside the sandbox is a token a function could send anywhere.
@@ -85,6 +85,11 @@ export type FunctionTask<T extends Record<string, unknown> = Record<string, unkn
     title: string;
     description?: string;
     params: Record<keyof T, InteractionCallbackParam<T>>;
+    /**
+     * More CPU or time than an invocation gets by default — `{ cpuMs: 1000 }` for a task that reshapes a big feed — up to
+     * what the server allows. Over the functions' own `limits`, for this task.
+     */
+    limits?: FunctionTimeLimits;
     run: (params: T, ctx: FunctionContext) => unknown;
 };
 /** What a route's handler gets besides the request: the context, and the `:params` its key named, by name. */
@@ -92,7 +97,7 @@ export type FunctionRouteContext = FunctionContext & {
     params: Record<string, string>;
 };
 /**
- * An HTTP endpoint of the space, under `/api/`: a web-standard handler, the shape every edge runtime runs. The request
+ * An HTTP endpoint of the space, under `/fn/`: a web-standard handler, the shape every edge runtime runs. The request
  * carries no credentials — `ctx.user` says who is asking — and the response sets no cookies: the host's are the
  * platform's.
  */
@@ -104,8 +109,10 @@ export type FunctionsDefinition = {
         hosts?: string[];
     };
     tasks?: FunctionTask<never>[];
-    /** `'GET /board-assets/:board/:asset'` → a handler, served at `/api/board-assets/…`. */
+    /** `'GET /board-assets/:board/:asset'` → a handler, served at `/fn/board-assets/…`. */
     routes?: Record<string, FunctionRoute>;
+    /** More CPU or time than an invocation gets by default, for every task and route — a task may ask for its own. */
+    limits?: FunctionTimeLimits;
 };
 /**
  * What a function throws to refuse, with a reason written for whoever asked — a wrong password, a board that is

package/dist/modules/functions/driver.js

@@ -14,9 +14,11 @@ var describeFunctions = (definition) => {
 			action: task.action,
 			title: task.title,
 			description: task.description,
-			params: task.params
+			params: task.params,
+			limits: task.limits
 		} : {}),
-		routes: isRecord(found.routes) ? Object.keys(found.routes) : []
+		routes: isRecord(found.routes) ? Object.keys(found.routes) : [],
+		limits: found.limits
 	};
 };
 /**

package/dist/modules/functions/load.js

@@ -1,7 +1,8 @@
 import { buildFunctions } from "./build.js";
 import { readFunctionsSource } from "@plitzi/sdk-shared/actions";
-import { fileURLToPath } from "node:url";
+import { isRecord } from "@plitzi/sdk-shared/helpers/isRecord";
 import { readFile, readdir } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
 //#region src/modules/functions/load.ts
 var nodeReader = {
 	list: async (dir) => (await readdir(dir, { withFileTypes: true })).map((entry) => ({
@@ -10,7 +11,6 @@ var nodeReader = {
 	})),
 	read: (file) => readFile(file, "utf8")
 };
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** Whether a module's default export has a definition's shape: what a server can register without surprises. */
 var isFunctionsDefinition = (value) => {
 	if (!isRecord(value)) return false;

package/dist/modules/functions/manifest.d.ts

@@ -1,3 +1,4 @@
+import { FunctionLimits } from './protocol';
 import { FunctionsManifest } from '@plitzi/sdk-shared';
 export declare const ROUTE_METHODS: readonly ["GET", "POST", "PUT", "PATCH", "DELETE"];
 export type RouteMethod = (typeof ROUTE_METHODS)[number];
@@ -6,7 +7,7 @@ export type RouteKey = {
     segments: string[];
 };
 /**
- * A route key, `'<METHOD> /<path>'`: literal segments and `:params`, served under `/api/`. Anything else — a query, a
+ * A route key, `'<METHOD> /<path>'`: literal segments and `:params`, served under `/fn/`. Anything else — a query, a
  * wildcard, `..` — is not a key, so what a space may answer is only ever a path it spelled out.
  */
 export declare const parseRouteKey: (key: string) => RouteKey | undefined;
@@ -19,6 +20,7 @@ export type ManifestReading = {
  * afterwards, because what is stored is only ever what passed it.
  *
  * `reserved` is every namespace this deployment's own tasks use: a space's task may take none of them, so a step that
- * names a platform task always runs the platform's.
+ * names a platform task always runs the platform's. `ceilings` is the most this deployment gives one invocation: what a
+ * task may ask for.
  */
-export declare const readManifest: (value: unknown, reserved: ReadonlySet<string>) => ManifestReading;
+export declare const readManifest: (value: unknown, reserved: ReadonlySet<string>, ceilings: FunctionLimits) => ManifestReading;

package/dist/modules/functions/manifest.js

@@ -1,4 +1,5 @@
 import { taskName, taskNameProblem } from "../actions/tasks/registry.js";
+import { isRecord } from "@plitzi/sdk-shared/helpers/isRecord";
 //#region src/modules/functions/manifest.ts
 var ROUTE_METHODS = [
 	"GET",
@@ -10,7 +11,7 @@ var ROUTE_METHODS = [
 var SEGMENT = /^(:[a-zA-Z][a-zA-Z0-9]*|[A-Za-z0-9._~-]+)$/;
 var isRouteMethod = (method) => ROUTE_METHODS.some((known) => known === method);
 /**
-* A route key, `'<METHOD> /<path>'`: literal segments and `:params`, served under `/api/`. Anything else — a query, a
+* A route key, `'<METHOD> /<path>'`: literal segments and `:params`, served under `/fn/`. Anything else — a query, a
 * wildcard, `..` — is not a key, so what a space may answer is only ever a path it spelled out.
 */
 var parseRouteKey = (key) => {
@@ -24,7 +25,6 @@ var parseRouteKey = (key) => {
 	};
 };
 var HOST = /^(\*\.)?([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/;
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var stringOf = (value) => typeof value === "string" ? value : void 0;
 var optionsOf = (value) => Array.isArray(value) ? value.flatMap((option) => {
 	const label = isRecord(option) ? stringOf(option.label) : void 0;
@@ -83,14 +83,41 @@ var paramOf = (value) => {
 		default: return `has a type the builder cannot draw ("${String(value.type)}"): text, textarea, codemirror-text, codemirror-json, boolean, elements or select`;
 	}
 };
+/** What each asked limit is, in words a problem is written in. */
+var LIMIT_WORDS = {
+	cpuMs: "of CPU",
+	wallMs: "to finish"
+};
+/**
+* What `where` asks for beyond the default, read: whole milliseconds above nothing — and never more than `ceilings`, which
+* is said rather than quietly cut down, so the author knows what the code will get.
+*/
+var limitsOf = (value, where, ceilings, problems) => {
+	if (value === void 0) return;
+	if (!isRecord(value)) {
+		problems.push(`${where}: limits is not an object like { cpuMs: 1000, wallMs: 20000 }`);
+		return;
+	}
+	const limits = {};
+	["cpuMs", "wallMs"].forEach((key) => {
+		const asked = value[key];
+		if (asked === void 0) return;
+		if (typeof asked !== "number" || !Number.isInteger(asked) || asked <= 0) problems.push(`${where}: limits.${key} is not a whole number of milliseconds above 0`);
+		else if (asked > ceilings[key]) problems.push(`${where}: asks for ${String(asked)} ms ${LIMIT_WORDS[key]}, and this server allows at most ${String(ceilings[key])} ms`);
+		else limits[key] = asked;
+	});
+	Object.keys(value).filter((key) => key !== "cpuMs" && key !== "wallMs").forEach((key) => problems.push(`${where}: limits.${key} is not a limit a function asks for (cpuMs, wallMs)`));
+	return Object.keys(limits).length ? limits : void 0;
+};
 /**
 * Reads what a bundle said it declares, and every rule it must meet — the one validator, at save and nowhere else
 * afterwards, because what is stored is only ever what passed it.
 *
 * `reserved` is every namespace this deployment's own tasks use: a space's task may take none of them, so a step that
-* names a platform task always runs the platform's.
+* names a platform task always runs the platform's. `ceilings` is the most this deployment gives one invocation: what a
+* task may ask for.
 */
-var readManifest = (value, reserved) => {
+var readManifest = (value, reserved, ceilings) => {
 	const problems = [];
 	const raw = isRecord(value) ? value : {};
 	const hosts = Array.isArray(raw.hosts) ? raw.hosts.filter((host) => typeof host === "string") : [];
@@ -130,12 +157,14 @@ var readManifest = (value, reserved) => {
 			else params[key] = read;
 		});
 		const description = stringOf(task.description);
+		const limits = limitsOf(task.limits, where, ceilings, problems);
 		tasks.push({
 			namespace,
 			action,
 			title,
 			...description ? { description } : {},
-			params
+			params,
+			...limits ? { limits } : {}
 		});
 	});
 	const routes = Array.isArray(raw.routes) ? raw.routes.filter((route) => typeof route === "string") : [];
@@ -150,11 +179,13 @@ var readManifest = (value, reserved) => {
 		if (routed.has(shape)) problems.push(`Route "${route}" answers the same requests as another one`);
 		routed.add(shape);
 	});
+	const limits = limitsOf(raw.limits, "The functions", ceilings, problems);
 	return {
 		manifest: {
 			hosts,
 			tasks,
-			routes
+			routes,
+			...limits ? { limits } : {}
 		},
 		problems
 	};

package/dist/modules/functions/routes.d.ts

@@ -31,6 +31,6 @@ export type RouteSources = {
  * each run with the same context a task of theirs gets, `trigger: 'route'`.
  */
 export declare const createRoutes: ({ config, getFunctions, taskContext }: RouteSources) => {
-    /** The route that answers `method path` (the path after `/api`), for this visit — or none. */
+    /** The route that answers `method path` (the path after `/fn`), for this visit — or none. */
     routeFor: (visit: RouteVisit, method: string, path: string) => Promise<RouteHandler | undefined>;
 };

package/dist/modules/functions/routes.js

@@ -1,9 +1,9 @@
 import { serverLog } from "../../helpers/serverLog.js";
 import { ActionRefusal } from "../actions/runtime/errors.js";
 import { functionContextFor } from "./context.js";
+import { functionLimitsFor } from "./config.js";
 import { parseRouteKey } from "./manifest.js";
 import { answerCall, readCall, responseOf, wireRequestOf, wireResponseFrom } from "./capabilities.js";
-import { functionLimitsFor } from "./config.js";
 import { FunctionFailure } from "./protocol.js";
 import { randomUUID } from "node:crypto";
 //#region src/modules/functions/routes.ts
@@ -151,7 +151,7 @@ var createRoutes = ({ config, getFunctions, taskContext }) => {
 								...fnCtx.user ? { user: fnCtx.user } : {}
 							}
 						},
-						limits: functionLimitsFor(config.limits, functions.limits),
+						limits: functionLimitsFor(config.limits, functions.limits, functions.manifest.limits),
 						answer: (call) => answerCall(fnCtx, readCall(call)),
 						signal: visit.signal,
 						onUsage: (usage) => {
@@ -174,7 +174,7 @@ var createRoutes = ({ config, getFunctions, taskContext }) => {
 		};
 	};
 	return { 
-	/** The route that answers `method path` (the path after `/api`), for this visit — or none. */
+	/** The route that answers `method path` (the path after `/fn`), for this visit — or none. */
 routeFor: async (visit, method, path) => nativeRoute(visit, method, path) ?? await spaceRoute(visit, method, path) };
 };
 //#endregion

package/dist/modules/functions/runner/messages.js

@@ -1,3 +1,4 @@
+import { isRecord } from "@plitzi/sdk-shared/helpers/isRecord";
 //#region src/modules/functions/runner/messages.ts
 var ENVIRONMENTS = {
 	production: true,
@@ -6,7 +7,6 @@ var ENVIRONMENTS = {
 	main: true
 };
 var isEnvironment = (value) => typeof value === "string" && Object.hasOwn(ENVIRONMENTS, value);
-var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var parse = (data) => {
 	try {
 		const value = JSON.parse(data);

package/dist/modules/functions/space.d.ts

@@ -2,12 +2,13 @@ import { FunctionsSource } from './build';
 import { FunctionsConfig } from './config';
 import { FunctionsBundle, FunctionLimits, FunctionRunner, SpaceFunctions } from './protocol';
 import { ActionTask, ActionTaskRegistry } from '../actions/types';
-import { FunctionsManifest, FunctionsProblem } from '@plitzi/sdk-shared';
+import { FunctionsManifest, FunctionsProblem, FunctionTimeLimits } from '@plitzi/sdk-shared';
 /**
  * A space's tasks as the registry holds them — each run by the runner, answering the code's calls with the run's own
- * {@link FunctionContext}: the same one native functions get, built by the same function.
+ * {@link FunctionContext}: the same one native functions get, built by the same function. Each is given what
+ * `limitsFor` answers for what it asked: its own limits, over its functions'.
  */
-export declare const spaceTasks: (functions: SpaceFunctions, runner: FunctionRunner, limits: FunctionLimits, { admit, onUsage }?: Pick<FunctionsConfig, "admit" | "onUsage">) => ActionTask<Record<string, unknown>>[];
+export declare const spaceTasks: (functions: SpaceFunctions, runner: FunctionRunner, limitsFor: (asked: FunctionTimeLimits) => FunctionLimits, { admit, onUsage }?: Pick<FunctionsConfig, "admit" | "onUsage">) => ActionTask<Record<string, unknown>>[];
 export type SpaceRegistries = {
     /** The tasks one run of that space can use: the deployment's, and its own functions' when it has any. */
     registryFor: (functions: SpaceFunctions | undefined) => ActionTaskRegistry;
@@ -35,6 +36,7 @@ export type PreparedFunctions = {
 };
 /**
  * A space's source made ready to save: built, read by the runner, and checked — the only way a space's functions are
- * stored, so what is stored always passed every rule. `reserved` is every namespace the deployment's own tasks use.
+ * stored, so what is stored always passed every rule. `reserved` is every namespace the deployment's own tasks use;
+ * `ceilings`, the most it gives one invocation — what a task may ask for.
  */
-export declare const prepareFunctions: (source: FunctionsSource, runner: FunctionRunner, reserved: ReadonlySet<string>) => Promise<PreparedFunctions>;
+export declare const prepareFunctions: (source: FunctionsSource, runner: FunctionRunner, reserved: ReadonlySet<string>, ceilings: FunctionLimits) => Promise<PreparedFunctions>;

package/dist/modules/functions/space.js

@@ -1,9 +1,9 @@
 import { ActionRefusal } from "../actions/runtime/errors.js";
 import { functionContextFor } from "./context.js";
 import { taskName } from "../actions/tasks/registry.js";
+import { functionLimitsFor } from "./config.js";
 import { readManifest } from "./manifest.js";
 import { answerCall, readCall } from "./capabilities.js";
-import { functionLimitsFor } from "./config.js";
 import { FunctionFailure } from "./protocol.js";
 import { FunctionsBuildError, buildFunctions } from "./build.js";
 import { createHash } from "node:crypto";
@@ -18,10 +18,15 @@ var invocationContextOf = ({ spaceId, environment, runId, trigger, callerId, use
 });
 /**
 * A space's tasks as the registry holds them — each run by the runner, answering the code's calls with the run's own
-* {@link FunctionContext}: the same one native functions get, built by the same function.
+* {@link FunctionContext}: the same one native functions get, built by the same function. Each is given what
+* `limitsFor` answers for what it asked: its own limits, over its functions'.
 */
-var spaceTasks = (functions, runner, limits, { admit, onUsage } = {}) => functions.manifest.tasks.map((task) => {
+var spaceTasks = (functions, runner, limitsFor, { admit, onUsage } = {}) => functions.manifest.tasks.map((task) => {
 	const name = taskName(task);
+	const limits = limitsFor({
+		...functions.manifest.limits,
+		...task.limits
+	});
 	return {
 		namespace: task.namespace,
 		action: task.action,
@@ -73,7 +78,8 @@ var composeRegistry = (base, tasks) => {
 		const name = taskName(task);
 		if (!base.get(name)) own.set(name, {
 			...task,
-			name
+			name,
+			origin: "space"
 		});
 	});
 	return {
@@ -91,11 +97,11 @@ var createSpaceRegistries = (base, config = {}) => {
 	return { registryFor: (functions) => {
 		const runner = functions?.runner ?? config.runner;
 		if (!functions || !runner) return base;
-		const limits = functionLimitsFor(config.limits, functions.limits);
-		const key = `${functions.bundle.id}:${JSON.stringify(limits)}`;
+		const key = `${functions.bundle.id}:${JSON.stringify(functions.limits ?? {})}`;
 		const found = cache.get(key);
 		if (found) return found;
-		const registry = composeRegistry(base, spaceTasks(functions, runner, limits, config));
+		const limitsFor = (asked) => functionLimitsFor(config.limits, functions.limits, asked);
+		const registry = composeRegistry(base, spaceTasks(functions, runner, limitsFor, config));
 		cache.set(key, registry);
 		if (cache.size > REGISTRY_CACHE) {
 			const oldest = cache.keys().next().value;
@@ -114,9 +120,10 @@ var functionsInHand = ({ bundle, manifest }) => ({
 });
 /**
 * A space's source made ready to save: built, read by the runner, and checked — the only way a space's functions are
-* stored, so what is stored always passed every rule. `reserved` is every namespace the deployment's own tasks use.
+* stored, so what is stored always passed every rule. `reserved` is every namespace the deployment's own tasks use;
+* `ceilings`, the most it gives one invocation — what a task may ask for.
 */
-var prepareFunctions = async (source, runner, reserved) => {
+var prepareFunctions = async (source, runner, reserved, ceilings) => {
 	let code;
 	try {
 		({code} = await buildFunctions(source));
@@ -143,7 +150,7 @@ var prepareFunctions = async (source, runner, reserved) => {
 			}]
 		};
 	}
-	const { manifest, problems } = readManifest(declared, reserved);
+	const { manifest, problems } = readManifest(declared, reserved, ceilings);
 	return problems.length ? {
 		ok: false,
 		problems: problems.map((message) => ({

package/dist/modules/images/allowlist.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Whether a host is one a picture may come from: named exactly (`images.example.com`), or under a wildcard
+ * (`*.example.com` — its subdomains, not `example.com` itself, which is named on its own when it is meant).
+ */
+export declare const isAllowedImageHost: (domains: readonly string[], hostname: string) => boolean;

package/dist/modules/images/allowlist.js

@@ -0,0 +1,18 @@
+//#region src/modules/images/allowlist.ts
+/**
+* Whether a host is one a picture may come from: named exactly (`images.example.com`), or under a wildcard
+* (`*.example.com` — its subdomains, not `example.com` itself, which is named on its own when it is meant).
+*/
+var isAllowedImageHost = (domains, hostname) => {
+	const host = hostname.toLowerCase().replace(/\.$/, "");
+	return domains.some((entry) => {
+		const domain = entry.toLowerCase().trim();
+		if (domain.startsWith("*.")) {
+			const parent = domain.slice(2);
+			return host.endsWith(`.${parent}`);
+		}
+		return host === domain;
+	});
+};
+//#endregion
+export { isAllowedImageHost };