@plitzi/sdk-server 0.38.4 → 0.38.6

package/dist/modules/functions/context.js

@@ -1,5 +1,7 @@
+import { prefixKv } from "../actions/runtime/namespaceKv.js";
 import { fetchOutbound } from "../../helpers/outboundGuard.js";
 import { countRate } from "../actions/runtime/rateLimit.js";
+import { pluginKvPrefix, pluginSigned } from "./scope.js";
 import { processTwigParam } from "@plitzi/sdk-shared/helpers/twigWrapper";
 //#region src/modules/functions/context.ts
 /**
@@ -26,7 +28,8 @@ var userOf = ({ id, username, email, verified, permissions, roles }) => ({
 * the same run budget `http.request` goes through), and — naming a credential — with its values written in where the
 * request says `{{credential.<key>}}`. The value is resolved here and never handed to the code.
 */
-var functionFetch = (ctx, hosts) => async (input, init = {}) => {
+var functionFetch = (ctx, hosts, scope) => async (input, init = {}) => {
+	if (init.credential && scope) throw new Error(`A plugin's functions name no credential of the space's ("${init.credential}")`);
 	const credential = init.credential ? await ctx.credential(init.credential) : void 0;
 	if (init.credential && !credential) throw new Error(`Credential "${init.credential}" is not available for this space`);
 	const render = (value) => credential ? String(processTwigParam(value, { credential })) : value;
@@ -63,26 +66,45 @@ var unavailable = (what) => () => Promise.reject(/* @__PURE__ */ new Error(`This
 var unsigned = () => Promise.reject(/* @__PURE__ */ new Error("This server signs nothing: its actions were given no signingSecret"));
 /**
 * What a space's code is handed, built from the run's own context: the one place a {@link FunctionContext} is made.
-* A self-hosted server hands it to the code directly; the platform answers the sandbox's calls with it.
+* A self-hosted server hands it to the code directly; the platform answers the sandbox's calls with it. With a `scope`,
+* it is a plugin's code, and gets the plugin's corner of the space (`./scope`).
 */
-var functionContextFor = (ctx, hosts) => ({
-	spaceId: ctx.spaceId,
-	environment: ctx.environment,
-	runId: ctx.runId,
-	trigger: ctx.trigger,
-	callerId: ctx.callerId,
-	...ctx.user ? { user: userOf(ctx.user) } : {},
-	kv: ctx.kv,
-	rateLimit: (bucket, limit) => countRate(ctx.kv, ctx.callerId, bucket, limit),
-	sign: ctx.sign ?? unsigned,
-	verify: ctx.verify ?? unsigned,
-	fetch: functionFetch(ctx, hosts),
-	publish: ctx.publish ?? unavailable("publish"),
-	grant: ctx.grant ?? unavailable("grant"),
-	revoke: ctx.revoke ?? unavailable("revoke"),
-	log: (...values) => ctx.log(lineOf(values)),
-	emit: ctx.emit,
-	signal: ctx.signal
-});
+var functionContextFor = (ctx, hosts, scope) => {
+	const shared = {
+		spaceId: ctx.spaceId,
+		environment: ctx.environment,
+		runId: ctx.runId,
+		trigger: ctx.trigger,
+		callerId: ctx.callerId,
+		...ctx.user ? { user: userOf(ctx.user) } : {},
+		fetch: functionFetch(ctx, hosts, scope),
+		log: (...values) => ctx.log(lineOf(values)),
+		emit: ctx.emit,
+		signal: ctx.signal
+	};
+	if (!scope) return {
+		...shared,
+		kv: ctx.kv,
+		rateLimit: (bucket, limit) => countRate(ctx.kv, ctx.callerId, bucket, limit),
+		sign: ctx.sign ?? unsigned,
+		verify: ctx.verify ?? unsigned,
+		publish: ctx.publish ?? unavailable("publish"),
+		grant: ctx.grant ?? unavailable("grant"),
+		revoke: ctx.revoke ?? unavailable("revoke")
+	};
+	const kv = prefixKv(ctx.kv, pluginKvPrefix(scope.plugin));
+	const { sign, verify } = ctx;
+	const noChannel = () => Promise.reject(/* @__PURE__ */ new Error("The functions of a plugin reach none of the realtime channels of its space"));
+	return {
+		...shared,
+		kv,
+		rateLimit: (bucket, limit) => countRate(kv, ctx.callerId, bucket, limit),
+		sign: sign ? (value) => sign(pluginSigned(scope.plugin, value)) : unsigned,
+		verify: verify ? (value, signature) => verify(pluginSigned(scope.plugin, value), signature) : unsigned,
+		publish: noChannel,
+		grant: noChannel,
+		revoke: noChannel
+	};
+};
 //#endregion
 export { functionContextFor, hostAllowed, lineOf };

package/dist/modules/functions/load.d.ts

@@ -1,15 +1,22 @@
 import { FunctionsSource } from './build';
 import { FunctionsDefinition } from './contract';
+/** Whether a module's default export has a definition's shape: what a server can register without surprises. */
+export declare const isFunctionsDefinition: (value: unknown) => value is FunctionsDefinition;
 /**
  * A `functions/` directory as a source — the files the platform's rule counts, by their path inside it: what a space's
  * functions are saved as, and what `loadFunctions` builds.
  */
 export declare const readFunctionsDir: (dir: string | URL) => Promise<FunctionsSource>;
 /**
- * A server's own functions from a directory — a project's `functions/`, the working copy `plitzi functions` keeps —
+ * A server's own functions from a directory — a project's `src/functions/`, the working copy `plitzi functions` keeps —
  * built exactly as the platform builds a space's (the same rules, one bundle) and loaded natively, for
  * `createServer({ functions: { native } })`. The same on `node src/main.ts` and on a compiled server: nothing here
  * depends on how the server itself runs. A directory with nothing in it is no functions; one that does not build, or
  * whose `index.ts` exports no definition, stops the server with where it is wrong.
  */
 export declare const loadFunctions: (dir: string | URL) => Promise<FunctionsDefinition[]>;
+/**
+ * The same, from the files themselves (`FunctionsSource`, by their path): what a packed plugin carries as
+ * `functions.source.json`, loaded by a server that runs the plugin as it was packed.
+ */
+export declare const loadFunctionsSource: (source: FunctionsSource) => Promise<FunctionsDefinition[]>;

package/dist/modules/functions/load.js

@@ -26,14 +26,18 @@ var isFunctionsDefinition = (value) => {
 */
 var readFunctionsDir = (dir) => readFunctionsSource(typeof dir === "string" ? dir : fileURLToPath(dir), nodeReader);
 /**
-* A server's own functions from a directory — a project's `functions/`, the working copy `plitzi functions` keeps —
+* A server's own functions from a directory — a project's `src/functions/`, the working copy `plitzi functions` keeps —
 * built exactly as the platform builds a space's (the same rules, one bundle) and loaded natively, for
 * `createServer({ functions: { native } })`. The same on `node src/main.ts` and on a compiled server: nothing here
 * depends on how the server itself runs. A directory with nothing in it is no functions; one that does not build, or
 * whose `index.ts` exports no definition, stops the server with where it is wrong.
 */
-var loadFunctions = async (dir) => {
-	const source = await readFunctionsDir(dir);
+var loadFunctions = async (dir) => loadFunctionsSource(await readFunctionsDir(dir));
+/**
+* The same, from the files themselves (`FunctionsSource`, by their path): what a packed plugin carries as
+* `functions.source.json`, loaded by a server that runs the plugin as it was packed.
+*/
+var loadFunctionsSource = async (source) => {
 	if (!Object.keys(source).length) return [];
 	const { code } = await buildFunctions(source);
 	const loaded = await import(`data:text/javascript;base64,${Buffer.from(code).toString("base64")}`);
@@ -42,4 +46,4 @@ var loadFunctions = async (dir) => {
 	return [definition];
 };
 //#endregion
-export { loadFunctions, readFunctionsDir };
+export { isFunctionsDefinition, loadFunctions, loadFunctionsSource, readFunctionsDir };

package/dist/modules/functions/manifest.d.ts

@@ -1,4 +1,5 @@
 import { FunctionLimits } from './protocol';
+import { FunctionScope } from './scope';
 import { FunctionsManifest } from '@plitzi/sdk-shared';
 export declare const ROUTE_METHODS: readonly ["GET", "POST", "PUT", "PATCH", "DELETE"];
 export type RouteMethod = (typeof ROUTE_METHODS)[number];
@@ -6,6 +7,8 @@ export type RouteKey = {
     method: RouteMethod;
     segments: string[];
 };
+/** Why a space's (or a deployment's) route is refused: `/fn/plugins/` is where plugins answer. */
+export declare const reservedRouteProblem: (route: string) => string;
 /**
  * A route key, `'<METHOD> /<path>'`: literal segments and `:params`, served under `/fn/`. Anything else — a query, a
  * wildcard, `..` — is not a key, so what a space may answer is only ever a path it spelled out.
@@ -23,4 +26,4 @@ export type ManifestReading = {
  * names a platform task always runs the platform's. `ceilings` is the most this deployment gives one invocation: what a
  * task may ask for.
  */
-export declare const readManifest: (value: unknown, reserved: ReadonlySet<string>, ceilings: FunctionLimits) => ManifestReading;
+export declare const readManifest: (value: unknown, reserved: ReadonlySet<string>, ceilings: FunctionLimits, scope?: FunctionScope) => ManifestReading;

package/dist/modules/functions/manifest.js

@@ -1,5 +1,7 @@
+import { pluginTaskProblem } from "./scope.js";
 import { taskName, taskNameProblem } from "../actions/tasks/registry.js";
 import { isRecord } from "@plitzi/sdk-shared/helpers/isRecord";
+import { PLUGIN_ROUTES_SEGMENT } from "@plitzi/sdk-shared/actions/functions";
 //#region src/modules/functions/manifest.ts
 var ROUTE_METHODS = [
 	"GET",
@@ -10,6 +12,8 @@ var ROUTE_METHODS = [
 ];
 var SEGMENT = /^(:[a-zA-Z][a-zA-Z0-9]*|[A-Za-z0-9._~-]+)$/;
 var isRouteMethod = (method) => ROUTE_METHODS.some((known) => known === method);
+/** Why a space's (or a deployment's) route is refused: `/fn/plugins/` is where plugins answer. */
+var reservedRouteProblem = (route) => `Route "${route}" is under /plugins/, where the plugins' routes answer (/fn/plugins/<type>/…)`;
 /**
 * A route key, `'<METHOD> /<path>'`: literal segments and `:params`, served under `/fn/`. Anything else — a query, a
 * wildcard, `..` — is not a key, so what a space may answer is only ever a path it spelled out.
@@ -117,7 +121,7 @@ var limitsOf = (value, where, ceilings, problems) => {
 * names a platform task always runs the platform's. `ceilings` is the most this deployment gives one invocation: what a
 * task may ask for.
 */
-var readManifest = (value, reserved, ceilings) => {
+var readManifest = (value, reserved, ceilings, scope) => {
 	const problems = [];
 	const raw = isRecord(value) ? value : {};
 	const hosts = Array.isArray(raw.hosts) ? raw.hosts.filter((host) => typeof host === "string") : [];
@@ -140,6 +144,10 @@ var readManifest = (value, reserved, ceilings) => {
 			problems.push(nameProblem);
 			return;
 		}
+		if (scope && namespace !== scope.plugin) {
+			problems.push(pluginTaskProblem(scope.plugin, namespace, action));
+			return;
+		}
 		const name = taskName({
 			namespace,
 			action
@@ -175,6 +183,10 @@ var readManifest = (value, reserved, ceilings) => {
 			problems.push(`Route "${route}" is not "<GET|POST|PUT|PATCH|DELETE> /<path>" of literal segments and :params`);
 			return;
 		}
+		if (!scope && key.segments[0] === PLUGIN_ROUTES_SEGMENT) {
+			problems.push(reservedRouteProblem(route));
+			return;
+		}
 		const shape = `${key.method} /${key.segments.map((segment) => segment.startsWith(":") ? ":" : segment).join("/")}`;
 		if (routed.has(shape)) problems.push(`Route "${route}" answers the same requests as another one`);
 		routed.add(shape);
@@ -191,4 +203,4 @@ var readManifest = (value, reserved, ceilings) => {
 	};
 };
 //#endregion
-export { ROUTE_METHODS, parseRouteKey, readManifest };
+export { ROUTE_METHODS, parseRouteKey, readManifest, reservedRouteProblem };

package/dist/modules/functions/native.d.ts

@@ -1,8 +1,9 @@
 import { FunctionsDefinition } from './contract';
+import { FunctionScope } from './scope';
 import { ActionTask } from '../actions/types';
 /**
  * A server's own functions, loaded as they are: trusted code the deployment ships — a self-hosted server's, or a
  * platform's own — run in the process with the run's context narrowed to what a function may see. The same code a
  * space runs in the sandbox, loaded without one.
  */
-export declare const nativeTasks: (definitions?: readonly FunctionsDefinition[]) => ActionTask<Record<string, unknown>>[];
+export declare const nativeTasks: (definitions?: readonly FunctionsDefinition[], scope?: FunctionScope) => ActionTask<Record<string, unknown>>[];

package/dist/modules/functions/native.js

@@ -5,8 +5,8 @@ import { functionContextFor } from "./context.js";
 * platform's own — run in the process with the run's context narrowed to what a function may see. The same code a
 * space runs in the sandbox, loaded without one.
 */
-var nativeTasks = (definitions = []) => definitions.flatMap((definition) => (definition.tasks ?? []).map((task) => {
-	const contextFor = (ctx) => functionContextFor(ctx, definition.allow?.hosts ?? []);
+var nativeTasks = (definitions = [], scope) => definitions.flatMap((definition) => (definition.tasks ?? []).map((task) => {
+	const contextFor = (ctx) => functionContextFor(ctx, definition.allow?.hosts ?? [], scope);
 	const { run, params } = task;
 	return {
 		namespace: task.namespace,

package/dist/modules/functions/plugins.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/functions/routes.d.ts

@@ -1,4 +1,5 @@
 import { FunctionsConfig } from './config';
+import { FunctionsDefinition } from './contract';
 import { SpaceFunctions } from './protocol';
 import { TaskContextSource } from '../actions/runtime/runAction';
 import { Environment, SpaceRevision, SSRUser } from '@plitzi/sdk-shared';
@@ -23,14 +24,18 @@ export declare const matchRoute: (keys: readonly string[], method: string, path:
 } | undefined;
 export type RouteSources = {
     config: FunctionsConfig;
+    /** The plugins' server halves this server ships, as they are now — a development server replaces them as they change. */
+    plugins?: () => ReadonlyMap<string, FunctionsDefinition>;
     getFunctions?: (spaceId: number, at?: SpaceRevision) => Promise<SpaceFunctions | undefined>;
+    getPluginFunctions?: (spaceId: number, at?: SpaceRevision) => Promise<Record<string, SpaceFunctions> | undefined>;
     taskContext: TaskContextSource;
 };
 /**
- * The route a request reaches, if one does: the deployment's own (its native functions') first, then the space's —
- * each run with the same context a task of theirs gets, `trigger: 'route'`.
+ * The route a request reaches, if one does: under `/plugins/<type>/`, that plugin's — this server's own, then the one
+ * the space's plugin brought; anywhere else, the deployment's own (its native functions') first, then the space's. Each
+ * runs with the same context a task of theirs gets, `trigger: 'route'` — a plugin's with a plugin's narrower one.
  */
-export declare const createRoutes: ({ config, getFunctions, taskContext }: RouteSources) => {
+export declare const createRoutes: ({ config, plugins, getFunctions, getPluginFunctions, taskContext }: RouteSources) => {
     /** The route that answers `method path` (the path after `/fn`), for this visit — or none. */
     routeFor: (visit: RouteVisit, method: string, path: string) => Promise<RouteHandler | undefined>;
 };

package/dist/modules/functions/routes.js

@@ -1,11 +1,13 @@
 import { serverLog } from "../../helpers/serverLog.js";
 import { ActionRefusal } from "../actions/runtime/errors.js";
+import { pluginOfPath } from "./scope.js";
 import { functionContextFor } from "./context.js";
 import { functionLimitsFor } from "./config.js";
-import { parseRouteKey } from "./manifest.js";
+import { parseRouteKey, reservedRouteProblem } from "./manifest.js";
 import { answerCall, readCall, responseOf, wireRequestOf, wireResponseFrom } from "./capabilities.js";
 import { FunctionFailure } from "./protocol.js";
 import { randomUUID } from "node:crypto";
+import { PLUGIN_ROUTES_SEGMENT } from "@plitzi/sdk-shared/actions/functions";
 //#region src/modules/functions/routes.ts
 /** A route key's params from a path it answers, or nothing when it does not answer it. */
 var matchKey = (key, method, path) => {
@@ -72,17 +74,22 @@ var failed = (visit, key, error) => {
 	const stopped = error instanceof FunctionFailure && error.reason !== "error";
 	return Response.json({ error: stopped ? "This route ran out of what it may spend" : "This route failed" }, { status: stopped ? 503 : 500 });
 };
+/** A definition's routes, as a table this process answers from. */
+var routesOf = (definition) => Object.entries(definition.routes ?? {}).map(([key, handler]) => ({
+	key,
+	handler,
+	hosts: definition.allow?.hosts ?? []
+}));
 /**
-* The route a request reaches, if one does: the deployment's own (its native functions') first, then the space's —
-* each run with the same context a task of theirs gets, `trigger: 'route'`.
+* The route a request reaches, if one does: under `/plugins/<type>/`, that plugin's — this server's own, then the one
+* the space's plugin brought; anywhere else, the deployment's own (its native functions') first, then the space's. Each
+* runs with the same context a task of theirs gets, `trigger: 'route'` — a plugin's with a plugin's narrower one.
 */
-var createRoutes = ({ config, getFunctions, taskContext }) => {
-	const native = (config.native ?? []).flatMap((definition) => Object.entries(definition.routes ?? {}).map(([key, handler]) => ({
-		key,
-		handler,
-		hosts: definition.allow?.hosts ?? []
-	})));
-	const contextOf = (visit, key, hosts) => {
+var createRoutes = ({ config, plugins = () => new Map(Object.entries(config.plugins ?? {})), getFunctions, getPluginFunctions, taskContext }) => {
+	const native = (config.native ?? []).flatMap(routesOf);
+	const reserved = native.find((route) => parseRouteKey(route.key)?.segments[0] === PLUGIN_ROUTES_SEGMENT);
+	if (reserved) throw new Error(`[Functions] ${reservedRouteProblem(reserved.key)}`);
+	const contextOf = (visit, key, hosts, scope) => {
 		const ctx = taskContext({
 			runId: randomUUID(),
 			spaceId: visit.spaceId,
@@ -98,21 +105,22 @@ var createRoutes = ({ config, getFunctions, taskContext }) => {
 				log: (line) => {
 					serverLog.info("Functions", `route ${key} of space ${String(visit.spaceId)}: ${line}`);
 				}
-			}, hosts),
+			}, hosts, scope),
 			trigger: "route"
 		};
 	};
-	const nativeRoute = (visit, method, path) => {
-		const match = matchRoute(native.map((route) => route.key), method, path);
-		const route = match ? native.find((entry) => entry.key === match.key) : void 0;
+	/** A route of code this process loaded: the deployment's own, or the server half of a plugin it ships. */
+	const loadedRoute = (routes, visit, method, path, scope) => {
+		const match = matchRoute(routes.map((route) => route.key), method, path);
+		const route = match ? routes.find((entry) => entry.key === match.key) : void 0;
 		if (!match || !route) return;
-		const handler = route.handler;
+		const { handler } = route;
 		return {
 			key: match.key,
 			handle: async (request) => {
 				try {
 					return withoutCookies(await handler(withoutCredentials(request), {
-						...contextOf(visit, match.key, route.hosts),
+						...contextOf(visit, match.key, route.hosts, scope),
 						params: match.params
 					}));
 				} catch (error) {
@@ -121,17 +129,18 @@ var createRoutes = ({ config, getFunctions, taskContext }) => {
 			}
 		};
 	};
-	const spaceRoute = async (visit, method, path) => {
-		const functions = await getFunctions?.(visit.spaceId, visit.at);
+	/** A route of code the runner runs: the space's own, or the server half of a plugin it uses. */
+	const runnerRoute = (functions, visit, method, path, scope) => {
 		const runner = functions?.runner ?? config.runner;
 		const match = functions ? matchRoute(functions.manifest.routes, method, path) : void 0;
 		if (!runner || !functions || !match) return;
+		const usageName = scope ? `plugin ${scope.plugin} route ${match.key}` : `route ${match.key}`;
 		return {
 			key: match.key,
 			handle: async (request) => {
 				const refusal = await config.admit?.(visit.spaceId);
 				if (refusal) return Response.json({ error: refusal }, { status: 429 });
-				const fnCtx = contextOf(visit, match.key, functions.manifest.hosts);
+				const fnCtx = contextOf(visit, match.key, functions.manifest.hosts, scope);
 				let ok = false;
 				let spent;
 				try {
@@ -165,7 +174,7 @@ var createRoutes = ({ config, getFunctions, taskContext }) => {
 				} finally {
 					if (spent) config.onUsage?.({
 						spaceId: visit.spaceId,
-						task: `route ${match.key}`,
+						task: usageName,
 						ok,
 						usage: spent
 					});
@@ -173,9 +182,20 @@ var createRoutes = ({ config, getFunctions, taskContext }) => {
 			}
 		};
 	};
+	const pluginRoute = async (visit, method, { plugin, path }) => {
+		const scope = { plugin };
+		const own = plugins().get(plugin);
+		if (own) return loadedRoute(routesOf(own), visit, method, path, scope);
+		const brought = (await getPluginFunctions?.(visit.spaceId, visit.at))?.[plugin];
+		return runnerRoute(brought, visit, method, path, scope);
+	};
 	return { 
 	/** The route that answers `method path` (the path after `/fn`), for this visit — or none. */
-routeFor: async (visit, method, path) => nativeRoute(visit, method, path) ?? await spaceRoute(visit, method, path) };
+routeFor: async (visit, method, path) => {
+		const addressed = pluginOfPath(path);
+		if (addressed) return pluginRoute(visit, method, addressed);
+		return loadedRoute(native, visit, method, path) ?? runnerRoute(await getFunctions?.(visit.spaceId, visit.at), visit, method, path);
+	} };
 };
 //#endregion
 export { createRoutes, matchRoute };

package/dist/modules/functions/scope.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Whose code a function is when it is not the space's: a plugin's server half, which a plugin brings with it and a space
+ * only chose to use.
+ *
+ * The space trusted the plugin to draw something, not with what it keeps — so a plugin's functions are handed a narrower
+ * `ctx`: their own corner of the space's `kv` and rate limits, signatures that only verify as theirs, the hosts they
+ * declared, and none of the space's credentials or realtime channels.
+ */
+export type FunctionScope = {
+    plugin: string;
+};
+/** Where a plugin's routes answer, under `/fn`: `/fn/plugins/<type>/…`. */
+export declare const PLUGIN_ROUTES = "/plugins/";
+/** A plugin's keys inside its space's `kv`: nothing of the space's, or of another plugin's, is reachable from it. */
+export declare const pluginKvPrefix: (plugin: string) => string;
+/**
+ * What a plugin signs is signed as ITS: the value is bound to the plugin before the space's key sees it, so a plugin
+ * cannot mint a value the space's own code — or another plugin — would accept as its own.
+ */
+export declare const pluginSigned: (plugin: string, value: string) => string;
+/**
+ * The plugin a route path addresses — `/plugins/board/layout` is `board`, with `/layout` left for its own routes — or
+ * nothing for a path that is not a plugin's.
+ */
+export declare const pluginOfPath: (path: string) => {
+    plugin: string;
+    path: string;
+} | undefined;
+/** Why a plugin's task is refused: it is named after something else. */
+export declare const pluginTaskProblem: (plugin: string, namespace: string, action: string) => string;

package/dist/modules/functions/scope.js

@@ -0,0 +1,28 @@
+import { PLUGIN_ROUTES_SEGMENT } from "@plitzi/sdk-shared/actions/functions";
+//#region src/modules/functions/scope.ts
+/** Where a plugin's routes answer, under `/fn`: `/fn/plugins/<type>/…`. */
+var PLUGIN_ROUTES = `/${PLUGIN_ROUTES_SEGMENT}/`;
+/** A plugin's keys inside its space's `kv`: nothing of the space's, or of another plugin's, is reachable from it. */
+var pluginKvPrefix = (plugin) => `plugin:${plugin}:`;
+/**
+* What a plugin signs is signed as ITS: the value is bound to the plugin before the space's key sees it, so a plugin
+* cannot mint a value the space's own code — or another plugin — would accept as its own.
+*/
+var pluginSigned = (plugin, value) => `plugin:${plugin}\n${value}`;
+/**
+* The plugin a route path addresses — `/plugins/board/layout` is `board`, with `/layout` left for its own routes — or
+* nothing for a path that is not a plugin's.
+*/
+var pluginOfPath = (path) => {
+	const trimmed = `/${path.replace(/^\/+/, "")}`;
+	if (!trimmed.startsWith(PLUGIN_ROUTES)) return;
+	const [plugin = "", ...rest] = trimmed.slice(PLUGIN_ROUTES.length).split("/");
+	return plugin ? {
+		plugin,
+		path: `/${rest.join("/")}`
+	} : void 0;
+};
+/** Why a plugin's task is refused: it is named after something else. */
+var pluginTaskProblem = (plugin, namespace, action) => `Task "${namespace}.${action}" of plugin "${plugin}": a plugin's tasks are named after it — namespace "${plugin}"`;
+//#endregion
+export { PLUGIN_ROUTES, pluginKvPrefix, pluginOfPath, pluginSigned, pluginTaskProblem };

package/dist/modules/functions/space.d.ts

@@ -1,6 +1,7 @@
 import { FunctionsSource } from './build';
 import { FunctionsConfig } from './config';
 import { FunctionsBundle, FunctionLimits, FunctionRunner, SpaceFunctions } from './protocol';
+import { FunctionScope } from './scope';
 import { ActionTask, ActionTaskRegistry } from '../actions/types';
 import { FunctionsManifest, FunctionsProblem, FunctionTimeLimits } from '@plitzi/sdk-shared';
 /**
@@ -8,10 +9,13 @@ import { FunctionsManifest, FunctionsProblem, FunctionTimeLimits } from '@plitzi
  * {@link FunctionContext}: the same one native functions get, built by the same function. Each is given what
  * `limitsFor` answers for what it asked: its own limits, over its functions'.
  */
-export declare const spaceTasks: (functions: SpaceFunctions, runner: FunctionRunner, limitsFor: (asked: FunctionTimeLimits) => FunctionLimits, { admit, onUsage }?: Pick<FunctionsConfig, "admit" | "onUsage">) => ActionTask<Record<string, unknown>>[];
+export declare const spaceTasks: (functions: SpaceFunctions, runner: FunctionRunner, limitsFor: (asked: FunctionTimeLimits) => FunctionLimits, { admit, onUsage }?: Pick<FunctionsConfig, "admit" | "onUsage">, scope?: FunctionScope) => ActionTask<Record<string, unknown>>[];
 export type SpaceRegistries = {
-    /** The tasks one run of that space can use: the deployment's, and its own functions' when it has any. */
-    registryFor: (functions: SpaceFunctions | undefined) => ActionTaskRegistry;
+    /**
+     * The tasks one run of that space can use: the deployment's, its own functions' when it has any, and those of the
+     * plugins it uses that bring a server half (by plugin type).
+     */
+    registryFor: (functions: SpaceFunctions | undefined, plugins?: Readonly<Record<string, SpaceFunctions>>) => ActionTaskRegistry;
 };
 /**
  * Registries per space bundle, built once per bundle and limits — a space's functions change when they are saved, and
@@ -37,6 +41,7 @@ export type PreparedFunctions = {
 /**
  * A space's source made ready to save: built, read by the runner, and checked — the only way a space's functions are
  * stored, so what is stored always passed every rule. `reserved` is every namespace the deployment's own tasks use;
- * `ceilings`, the most it gives one invocation — what a task may ask for.
+ * `ceilings`, the most it gives one invocation — what a task may ask for; `scope`, a plugin's server half rather than a
+ * space's (its tasks named after it, its routes its own).
  */
-export declare const prepareFunctions: (source: FunctionsSource, runner: FunctionRunner, reserved: ReadonlySet<string>, ceilings: FunctionLimits) => Promise<PreparedFunctions>;
+export declare const prepareFunctions: (source: FunctionsSource, runner: FunctionRunner, reserved: ReadonlySet<string>, ceilings: FunctionLimits, scope?: FunctionScope) => Promise<PreparedFunctions>;

package/dist/modules/functions/space.js

@@ -21,7 +21,7 @@ var invocationContextOf = ({ spaceId, environment, runId, trigger, callerId, use
 * {@link FunctionContext}: the same one native functions get, built by the same function. Each is given what
 * `limitsFor` answers for what it asked: its own limits, over its functions'.
 */
-var spaceTasks = (functions, runner, limitsFor, { admit, onUsage } = {}) => functions.manifest.tasks.map((task) => {
+var spaceTasks = (functions, runner, limitsFor, { admit, onUsage } = {}, scope) => functions.manifest.tasks.map((task) => {
 	const name = taskName(task);
 	const limits = limitsFor({
 		...functions.manifest.limits,
@@ -36,7 +36,7 @@ var spaceTasks = (functions, runner, limitsFor, { admit, onUsage } = {}) => func
 		run: async (params, ctx) => {
 			const refusal = await admit?.(ctx.spaceId);
 			if (refusal) throw new Error(refusal);
-			const fnCtx = functionContextFor(ctx, functions.manifest.hosts);
+			const fnCtx = functionContextFor(ctx, functions.manifest.hosts, scope);
 			let ok = false;
 			let spent;
 			try {
@@ -71,15 +71,18 @@ var spaceTasks = (functions, runner, limitsFor, { admit, onUsage } = {}) => func
 		}
 	};
 });
-/** The deployment's tasks and a space's, one registry: a space's never answers a name the deployment's already does. */
+/**
+* The deployment's tasks, a space's and its plugins', one registry: neither ever answers a name the deployment's already
+* does, and a plugin's are named after it (`<type>.<action>`), so they meet nobody else's.
+*/
 var composeRegistry = (base, tasks) => {
 	const own = /* @__PURE__ */ new Map();
-	tasks.forEach((task) => {
+	tasks.forEach(({ task, origin }) => {
 		const name = taskName(task);
-		if (!base.get(name)) own.set(name, {
+		if (!base.get(name) && !own.has(name)) own.set(name, {
 			...task,
 			name,
-			origin: "space"
+			origin
 		});
 	});
 	return {
@@ -94,14 +97,32 @@ var REGISTRY_CACHE = 500;
 */
 var createSpaceRegistries = (base, config = {}) => {
 	const cache = /* @__PURE__ */ new Map();
-	return { registryFor: (functions) => {
-		const runner = functions?.runner ?? config.runner;
-		if (!functions || !runner) return base;
-		const key = `${functions.bundle.id}:${JSON.stringify(functions.limits ?? {})}`;
+	return { registryFor: (functions, plugins = {}) => {
+		const runnable = [...functions ? [{
+			functions,
+			scope: void 0
+		}] : [], ...Object.entries(plugins).map(([plugin, own]) => ({
+			functions: own,
+			scope: { plugin }
+		}))].flatMap(({ functions: found, scope }) => {
+			const runner = found.runner ?? config.runner;
+			return runner ? [{
+				functions: found,
+				runner,
+				scope
+			}] : [];
+		});
+		if (runnable.length === 0) return base;
+		const key = runnable.map(({ functions: found, scope }) => `${scope?.plugin ?? ""}:${found.bundle.id}:${JSON.stringify(found.limits ?? {})}`).join("|");
 		const found = cache.get(key);
 		if (found) return found;
-		const limitsFor = (asked) => functionLimitsFor(config.limits, functions.limits, asked);
-		const registry = composeRegistry(base, spaceTasks(functions, runner, limitsFor, config));
+		const registry = composeRegistry(base, runnable.flatMap(({ functions: own, runner, scope }) => {
+			const limitsFor = (asked) => functionLimitsFor(config.limits, own.limits, asked);
+			return spaceTasks(own, runner, limitsFor, config, scope).map((task) => ({
+				task,
+				origin: scope ? "plugin" : "space"
+			}));
+		}));
 		cache.set(key, registry);
 		if (cache.size > REGISTRY_CACHE) {
 			const oldest = cache.keys().next().value;
@@ -121,9 +142,10 @@ var functionsInHand = ({ bundle, manifest }) => ({
 /**
 * A space's source made ready to save: built, read by the runner, and checked — the only way a space's functions are
 * stored, so what is stored always passed every rule. `reserved` is every namespace the deployment's own tasks use;
-* `ceilings`, the most it gives one invocation — what a task may ask for.
+* `ceilings`, the most it gives one invocation — what a task may ask for; `scope`, a plugin's server half rather than a
+* space's (its tasks named after it, its routes its own).
 */
-var prepareFunctions = async (source, runner, reserved, ceilings) => {
+var prepareFunctions = async (source, runner, reserved, ceilings, scope) => {
 	let code;
 	try {
 		({code} = await buildFunctions(source));
@@ -150,7 +172,7 @@ var prepareFunctions = async (source, runner, reserved, ceilings) => {
 			}]
 		};
 	}
-	const { manifest, problems } = readManifest(declared, reserved, ceilings);
+	const { manifest, problems } = readManifest(declared, reserved, ceilings, scope);
 	return problems.length ? {
 		ok: false,
 		problems: problems.map((message) => ({

package/dist/modules/rsc/connectorRscData.d.ts

@@ -17,7 +17,7 @@ import { SSRAdapters } from '@plitzi/sdk-shared';
  *
  * A deployment that resolves server elements some other way still supplies its own `getRscData`, and that one wins.
  */
-export declare const connectorRscData: ({ connectors, actions, publicDir, elementTimeoutMs }: {
+export declare const connectorRscData: ({ connectors, actions, publicDir, dataDir, elementTimeoutMs }: {
     connectors?: ConnectorLookups;
     actions?: {
         lookups: ActionLookups;
@@ -25,6 +25,8 @@ export declare const connectorRscData: ({ connectors, actions, publicDir, elemen
     };
     /** Where the server's static files are: a provider whose `query` is one of them is read from disk. */
     publicDir?: string;
+    /** The project's own data, never served: a provider whose `query` is `/data/<file>` is read from it. */
+    dataDir?: string;
     /** The deployment's per-element ceiling, when it set one. `resolveRscData` decides the default. */
     elementTimeoutMs?: number;
 }) => NonNullable<SSRAdapters["getRscData"]>;