@plitzi/sdk-server 0.38.6 → 0.38.7

package/dist/core/auth/session.js

@@ -42,6 +42,8 @@ var sessionCookieParams = (hostname, config = {}) => {
 		hintSuffix: config.hintSuffix ?? "_hint"
 	};
 };
+/** The readable companion cookie's name — the one a page is told to look for (`server.auth.sessionHintCookie`). */
+var sessionHintCookieName = (params) => `${params.name}${params.hintSuffix}`;
 /**
 * The value of the readable companion cookie: `<access expiry>.<refresh expiry>`, unix seconds, refresh optional.
 *
@@ -95,7 +97,7 @@ var writeSessionCookies = (req, res, session, config) => {
 	const now = nowInSeconds();
 	const cookies = [serializeCookie(params.name, session.token, session.expiresAt - now, params)];
 	if (session.refreshToken) cookies.push(serializeCookie(`${params.name}_refresh`, session.refreshToken, (session.refreshExpiresAt ?? session.expiresAt) - now, params, { path: params.refreshPath }));
-	cookies.push(serializeCookie(`${params.name}${params.hintSuffix}`, sessionHintValue(session.expiresAt, session.refreshExpiresAt), (session.refreshExpiresAt ?? session.expiresAt) - now, params, { httpOnly: false }));
+	cookies.push(serializeCookie(sessionHintCookieName(params), sessionHintValue(session.expiresAt, session.refreshExpiresAt), (session.refreshExpiresAt ?? session.expiresAt) - now, params, { httpOnly: false }));
 	appendCookies(res, cookies);
 };
 /** Ends the session in this browser. Every cookie the grant wrote is cleared, the readable one included. */
@@ -104,7 +106,7 @@ var clearSessionCookies = (req, res, config) => {
 	appendCookies(res, [
 		serializeCookie(params.name, "", 0, params),
 		serializeCookie(`${params.name}_refresh`, "", 0, params, { path: params.refreshPath }),
-		serializeCookie(`${params.name}${params.hintSuffix}`, "", 0, params, { httpOnly: false })
+		serializeCookie(sessionHintCookieName(params), "", 0, params, { httpOnly: false })
 	]);
 };
 /**
@@ -141,8 +143,7 @@ var readSessionToken = (req, config) => readCookie(req, sessionCookieParams(req.
 var readRefreshToken = (req, config) => readCookie(req, `${sessionCookieParams(req.hostname, config).name}_refresh`);
 /** What the readable companion cookie says about this browser's session, without presenting any credential. */
 var readSessionHint = (req, config) => {
-	const params = sessionCookieParams(req.hostname, config);
-	return parseSessionHint(readCookie(req, `${params.name}${params.hintSuffix}`));
+	return parseSessionHint(readCookie(req, sessionHintCookieName(sessionCookieParams(req.hostname, config))));
 };
 /**
 * Marks a browser as having just been sent to renew its session, so the page it comes back to is rendered rather
@@ -208,4 +209,4 @@ var createSessionCookies = (config) => ({
 	}
 });
 //#endregion
-export { appendCookies, clearFlowCookie, clearSessionCookies, createSessionCookies, isLocalHost, parseSessionHint, readFlowCookie, readRefreshToken, readRenewalGuard, readSessionHint, readSessionToken, registrableDomain, sessionCookieParams, sessionHintValue, sessionReturnTarget, writeFlowCookie, writeRenewalGuard, writeSessionCookies };
+export { appendCookies, clearFlowCookie, clearSessionCookies, createSessionCookies, isLocalHost, parseSessionHint, readFlowCookie, readRefreshToken, readRenewalGuard, readSessionHint, readSessionToken, registrableDomain, sessionCookieParams, sessionHintCookieName, sessionHintValue, sessionReturnTarget, writeFlowCookie, writeRenewalGuard, writeSessionCookies };

package/dist/core/createServer.js

@@ -1,4 +1,5 @@
 import { actionLookupsOf, connectorLookupsOf } from "./configSeam.js";
+import { dataDirLookup } from "../modules/actions/runtime/projectData.js";
 import { actionsModuleFor } from "../modules/actions/moduleFor.js";
 import { connectorRscData } from "../modules/rsc/connectorRscData.js";
 import { createAuthApiStage } from "./http/stages/authApi.js";
@@ -6,6 +7,25 @@ import { createRenewalEndpointStage, createSessionRenewalStage } from "./http/st
 import { resolveServices } from "./services/resolve.js";
 import { createPageServer } from "./server/pageServer.js";
 //#region src/core/createServer.ts
+/**
+* The space's data as one lookup, for every reader of it: the deployment's `action.lookups.getData`, or — given none —
+* the files of `dataDir`. A `/data/<file>` provider and a function's `ctx.data` then read the same files the same way,
+* instead of the folder through one path and the lookup through another.
+*/
+var withDataLookup = (config) => {
+	const lookups = config.action?.lookups;
+	if (!config.dataDir || !lookups || lookups.getData) return config;
+	return {
+		...config,
+		action: {
+			...config.action,
+			lookups: {
+				...lookups,
+				getData: dataDirLookup(config.dataDir)
+			}
+		}
+	};
+};
 /** The server this package makes: pages and RSC, mounting whatever the config enables, plus any stages a
 *  companion package contributes through `extensions`. The MCP endpoint, the widget proxy and draft-preview
 *  arrive that way from `@plitzi/sdk-mcp`, which a page-only deployment never installs.
@@ -39,7 +59,7 @@ var withConnectorRsc = (config) => {
 		connectors: config.connectors ? connectorLookupsOf(config.connectors) : void 0,
 		actions,
 		publicDir: config.publicDir,
-		dataDir: config.dataDir,
+		data: actions?.lookups.getData ?? (config.dataDir ? dataDirLookup(config.dataDir) : void 0),
 		elementTimeoutMs: config.rsc?.elementTimeoutMs
 	});
 	return resolved;
@@ -51,22 +71,23 @@ var withRenewal = (extensions, url) => ({
 });
 var createServer = ({ auth, sessionRenewal, ...config }, extensions) => {
 	if (!auth) {
-		const resolvedConfig = withConnectorRsc(config);
+		const resolvedConfig = withConnectorRsc(withDataLookup(config));
 		return createPageServer(resolvedConfig, resolveServices(resolvedConfig), withRenewal(extensions, sessionRenewal ? sessionRenewal.url : void 0));
 	}
 	const entries = Object.entries(config.adapters);
 	const supplied = Object.fromEntries(entries.filter(([, value]) => value !== void 0));
-	const resolved = withConnectorRsc({
+	const resolved = withConnectorRsc(withDataLookup({
 		loginPath: false,
 		logoutPath: false,
 		exchangePath: false,
 		...config,
 		authCookie: config.authCookie ?? auth.cookieConfig,
+		pageAuth: config.pageAuth ?? auth.pageAuth,
 		adapters: {
 			...auth.ssrAdapters,
 			...supplied
 		}
-	});
+	}));
 	const withAuthRoutes = {
 		...extensions,
 		preAuth: [

package/dist/core/http/stages/devReload.d.ts

@@ -4,8 +4,8 @@ import { PluginEntry } from '@plitzi/sdk-shared';
 export declare const DEV_RELOAD_PATH = "/__plitzi/reload";
 /**
  * The page reloading itself when the space it shows changed — the edit loop of a project that authors its space in
- * code, without restarting the server: `main.ts` re-authors in a process of its own and calls `reloadPages()`, and
- * every page open on this server loads again.
+ * code, without restarting the server: `serveProject` re-authors in a process of its own, swaps the documents and calls
+ * `reloadPages()`, and every page open on this server loads again.
  *
  * Only with `devReload` on: every open page keeps a connection for it, which a server that never calls `reloadPages`
  * — a published one, or a platform's — would pay for and get nothing from. The template listens only then too.

package/dist/core/http/stages/devReload.js

@@ -5,8 +5,8 @@ import { randomUUID } from "node:crypto";
 var DEV_RELOAD_PATH = "/__plitzi/reload";
 /**
 * The page reloading itself when the space it shows changed — the edit loop of a project that authors its space in
-* code, without restarting the server: `main.ts` re-authors in a process of its own and calls `reloadPages()`, and
-* every page open on this server loads again.
+* code, without restarting the server: `serveProject` re-authors in a process of its own, swaps the documents and calls
+* `reloadPages()`, and every page open on this server loads again.
 *
 * Only with `devReload` on: every open page keeps a connection for it, which a server that never calls `reloadPages`
 * — a published one, or a platform's — would pay for and get nothing from. The template listens only then too.

package/dist/env.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/env.js

@@ -0,0 +1,19 @@
+//#region src/env.ts
+/**
+* The project's `.env` in `process.env`, when there is one, before any module of it is evaluated — preloaded by the
+* one script Node's own `--env-file-if-exists=.env` cannot be given to: `start:dev`, run as
+* `node --import @plitzi/sdk-server/env --watch-path=… src/main.ts`.
+*
+* Node's watcher, given `--watch-path`, watches the folder an env file is in — the project's root — for any change at
+* all, and on macOS everything under it: the server writing `tmp/dev-server.json` restarted it, which wrote it again,
+* and it never stopped. Preloaded, the file is read by the watched process alone, as Node reads it: a variable the
+* environment already sets is kept. The project's other scripts, which watch nothing, keep Node's flag.
+*/
+var ENV_FILE = ".env";
+try {
+	process.loadEnvFile(ENV_FILE);
+} catch (error) {
+	if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) throw error;
+}
+//#endregion
+export {};

package/dist/env.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/functions-api.d.ts

@@ -94,6 +94,11 @@ export declare type FunctionContext = {
     grant: (topic: string, ttlSeconds?: number) => Promise<string>;
     /** Takes a grant back — or every grant for the topic, naming none. */
     revoke: (topic: string, grant?: string) => Promise<void>;
+    /**
+     * One file of the space's data — a project's `src/data/<file>` — parsed, as of the version the run belongs to: what
+     * a page must not carry, read here and answered only as far as it is shown. Read-only. `ctx.data('products.json')`.
+     */
+    data: (file: string) => Promise<unknown>;
     /** A line for whoever reads the run: the builder's Try, and the deployment's logs. */
     log: (...values: unknown[]) => void;
     /** Progress for a caller that asked for a stream — a no-op when nobody did. */

package/dist/helpers/buildServerInfo.js

@@ -1,4 +1,5 @@
 import { requestOrigin } from "../core/requestParser.js";
+import { sessionCookieParams, sessionHintCookieName } from "../core/auth/session.js";
 //#region src/helpers/buildServerInfo.ts
 var getEnvironment = (env = "production", server) => {
 	switch (env) {
@@ -40,6 +41,7 @@ var buildServerInfo = (req, config, ssr) => {
 	const origin = requestOrigin(req) || `${req.protocol}://${req.hostname}`;
 	const host = origin.slice(`${req.protocol}://`.length);
 	const user = req.ctx.user;
+	const { pageAuth } = config;
 	return getEnvironment(config.environment, {
 		basePath: "/",
 		requestUrl: req.url || "/",
@@ -73,6 +75,10 @@ var buildServerInfo = (req, config, ssr) => {
 			accessToken: user.token,
 			expiresAt: user.expiresAt
 		} : void 0,
+		auth: pageAuth ? {
+			...pageAuth,
+			sessionHintCookie: sessionHintCookieName(sessionCookieParams(req.hostname, config.authCookie))
+		} : void 0,
 		ssr
 	});
 };

package/dist/index.d.ts

@@ -17,7 +17,7 @@ export { PREVIEW_TOKEN_PARAM } from './core/previewToken';
 export { resolveRscData } from './modules/rsc/resolveRscData';
 export { fetchConnectorRecords, rebaseMedia, writeConnectorRecord, createConnectorResolver } from './modules/connectors';
 export type { CloudAdaptersConfig, CloudSpaceCache } from './adapters/cloudAdapters';
-export type { JsonAdaptersConfig } from './adapters/jsonAdapters';
+export type { JsonAdaptersConfig, OfflineDataSource } from './adapters/jsonAdapters';
 export type { AuthAdapters, AuthAdaptersConfig } from './adapters/authAdapters';
 export type { AuthoringPreviewOptions, DeploymentRow, FrameAncestorsConfig, SpaceAdapters, SpaceAdaptersConfig, SpaceCache, SpaceRefusal, SpaceResolution, SpaceResolver, WildcardSubdomainOptions } from './adapters/space';
 export type { RscElementResolver, RscResolveContext, ResolveRscDataOptions } from './modules/rsc/resolveRscData';

package/dist/modules/actions/runtime/projectData.d.ts

@@ -0,0 +1,18 @@
+import { ActionLookups, SpaceRevision } from '../types';
+/** How a server reaches a space's data: its files' text by path (`products.json`), as of a revision. */
+export type ProjectDataLookup = NonNullable<ActionLookups['getData']>;
+/**
+ * A data folder as the lookup a deployment would otherwise write — what a self-hosted server derives from `dataDir`, so
+ * a `/data/<file>` provider and a function's `ctx.data` read the folder one way. A folder has no revisions: every
+ * revision is what is on disk now. A file is read again only once it changed, so a page asking per render costs the
+ * folder's listing and nothing more.
+ */
+export declare const dataDirLookup: (dataDir: string) => ProjectDataLookup;
+/**
+ * `ctx.data` for one run: one file of the space's data, as of the run's revision, parsed.
+ *
+ * The lookup is asked once per run, whatever the code reads and however often — every read of one run sees the same
+ * version of the data — and each read is parsed afresh, so code that changes what it was handed changes nothing the
+ * next read gets.
+ */
+export declare const projectDataReader: (getData: ProjectDataLookup | undefined, spaceId: number, at: SpaceRevision | undefined) => ((file: string) => Promise<unknown>);

package/dist/modules/actions/runtime/projectData.js

@@ -0,0 +1,69 @@
+import { readFile, readdir, stat } from "node:fs/promises";
+import path from "node:path";
+//#region src/modules/actions/runtime/projectData.ts
+/** What a project keeps in its data folder: JSON, the only files `plitzi push` sends as the space's data. */
+var DATA_EXTENSION = ".json";
+/**
+* A data folder as the lookup a deployment would otherwise write — what a self-hosted server derives from `dataDir`, so
+* a `/data/<file>` provider and a function's `ctx.data` read the folder one way. A folder has no revisions: every
+* revision is what is on disk now. A file is read again only once it changed, so a page asking per render costs the
+* folder's listing and nothing more.
+*/
+var dataDirLookup = (dataDir) => {
+	const root = path.resolve(dataDir);
+	const kept = /* @__PURE__ */ new Map();
+	return async () => {
+		let names;
+		try {
+			names = await readdir(root, { recursive: true });
+		} catch {
+			return;
+		}
+		const read = await Promise.all(names.filter((name) => name.endsWith(DATA_EXTENSION)).map(async (name) => {
+			const file = path.join(root, name);
+			const key = name.split(path.sep).join("/");
+			try {
+				const { mtimeMs, size } = await stat(file);
+				const known = kept.get(key);
+				const text = known && known.mtimeMs === mtimeMs && known.size === size ? known.text : await readFile(file, "utf8");
+				kept.set(key, {
+					mtimeMs,
+					size,
+					text
+				});
+				return [key, text];
+			} catch {
+				kept.delete(key);
+				return;
+			}
+		}));
+		const files = Object.fromEntries(read.filter((entry) => entry !== void 0));
+		kept.forEach((_entry, key) => {
+			if (!(key in files)) kept.delete(key);
+		});
+		return files;
+	};
+};
+/**
+* `ctx.data` for one run: one file of the space's data, as of the run's revision, parsed.
+*
+* The lookup is asked once per run, whatever the code reads and however often — every read of one run sees the same
+* version of the data — and each read is parsed afresh, so code that changes what it was handed changes nothing the
+* next read gets.
+*/
+var projectDataReader = (getData, spaceId, at) => {
+	let files;
+	return async (file) => {
+		if (!getData) throw new Error("This server keeps no data for its spaces: ctx.data reads what a deployment answers with action.lookups.getData, or the files of dataDir");
+		files ??= getData(spaceId, at);
+		const text = (await files)?.[file];
+		if (text === void 0) throw new Error(`"${file}" is not a file of this space's data — ctx.data takes its path under src/data/`);
+		try {
+			return JSON.parse(text);
+		} catch {
+			throw new Error(`"${file}" of this space's data is not JSON`);
+		}
+	};
+};
+//#endregion
+export { dataDirLookup, projectDataReader };

package/dist/modules/actions/runtime/taskContext.d.ts

@@ -36,4 +36,4 @@ export type TaskContextRequest = Pick<ActionRunRequest, 'runId' | 'spaceId' | 'e
  * every secret it resolves registered with the redactor, the space's `kv` namespace, the run's outbound budget, the
  * space's channels. Everything but `log`, which is the STEP's: each step keeps what it logged.
  */
-export declare const taskContextFor: (config: ActionsConfig, { kv, email, redactor, signing }: TaskContextDeps, request: TaskContextRequest, signal: AbortSignal, runFetch: typeof fetch) => (scope: Record<string, unknown>) => Omit<ActionTaskContext, "log">;
+export declare const taskContextFor: (config: ActionsConfig, { kv, email, redactor, signing }: TaskContextDeps, request: TaskContextRequest, signal: AbortSignal, runFetch: typeof fetch) => ((scope: Record<string, unknown>) => Omit<ActionTaskContext, "log">);

package/dist/modules/actions/runtime/taskContext.js

@@ -1,5 +1,6 @@
 import { ActionRunError } from "./errors.js";
 import { namespaceKv } from "./namespaceKv.js";
+import { projectDataReader } from "./projectData.js";
 //#region src/modules/actions/runtime/taskContext.ts
 /**
 * Holds an answer to what the run is allowed to carry.
@@ -65,9 +66,10 @@ var createRunFetch = (base, signal, limits, lineage, onBudgetSpent) => {
 * every secret it resolves registered with the redactor, the space's `kv` namespace, the run's outbound budget, the
 * space's channels. Everything but `log`, which is the STEP's: each step keeps what it logged.
 */
-var taskContextFor = (config, { kv, email, redactor, signing }, request, signal, runFetch) => (scope) => {
+var taskContextFor = (config, { kv, email, redactor, signing }, request, signal, runFetch) => {
 	const { realtime } = config;
-	return {
+	const readData = projectDataReader(config.lookups.getData, request.spaceId, request.at);
+	return (scope) => ({
 		runId: request.runId,
 		spaceId: request.spaceId,
 		environment: request.environment,
@@ -104,6 +106,7 @@ var taskContextFor = (config, { kv, email, redactor, signing }, request, signal,
 		dbDrivers: config.dbDrivers ?? [],
 		email,
 		emit: (chunk) => request.emit?.(redactor.redact(chunk)),
+		data: readData,
 		...signing?.({
 			spaceId: request.spaceId,
 			environment: request.environment
@@ -122,7 +125,7 @@ var taskContextFor = (config, { kv, email, redactor, signing }, request, signal,
 				environment: request.environment
 			}, topic, grant)
 		} : {}
-	};
+	});
 };
 //#endregion
 export { createRunFetch, taskContextFor };

package/dist/modules/actions/types.d.ts

@@ -129,7 +129,8 @@ export type ActionLookups = {
     getPluginFunctions?: (spaceId: number, at?: SpaceRevision) => Promise<Record<string, SpaceFunctions> | undefined>;
     /**
      * The space's own data as of that revision: its files' text by path (`products.json`), for a provider resolved on the
-     * server whose `query` is `/data/<file>` — the platform's `dataDir`. Absent, such a provider reads nothing here.
+     * server whose `query` is `/data/<file>` and for a function's `ctx.data` — the platform's `dataDir`, and what a
+     * self-hosted server derives from its own when it is given none. Absent, neither reads anything here.
      */
     getData?: (spaceId: number, at?: SpaceRevision) => Promise<Record<string, string> | undefined>;
     /**
@@ -198,6 +199,11 @@ export type ActionTaskContext = {
     /** Signs with the space's own key (`ActionsConfig.signingSecret`) — `undefined` when the deployment gave none. */
     sign?: SpaceSigning['sign'];
     verify?: SpaceSigning['verify'];
+    /**
+     * One file of the space's data (`products.json`), parsed, as of the run's revision — read-only, and refused when
+     * the deployment keeps no data (`lookups.getData`, or `dataDir`). One lookup per run, whichever step reads it.
+     */
+    data: (file: string) => Promise<unknown>;
 };
 /** How the actions module reaches the server's realtime channels. Set by `createServer`, never by a deployment. */
 export type ActionRealtime = {

package/dist/modules/functions/build.js

@@ -37,6 +37,15 @@ var loaderOf = (file) => {
 	if (file.endsWith(".json")) return "json";
 	return file.endsWith(".ts") ? "ts" : "js";
 };
+/** Where a project keeps its data, seen from its functions: `src/data/` beside `src/functions/`. */
+var DATA_FROM_FUNCTIONS = "../data/";
+/**
+* Why an import that climbs out of `functions/` is refused, and what to do instead — the space's data is the one thing
+* outside it code reaches for, and it is read at run time (`ctx.data`), as of the run's version, not built in.
+*/
+var outsideFunctions = (specifier, wanted) => {
+	return `"${specifier}" is outside functions/: functions import only files under functions/ — read the space's data with ctx.data('${wanted.startsWith(DATA_FROM_FUNCTIONS) ? wanted.slice(8) : "<file>"}')`;
+};
 /** Resolves every import against the space's own files, and the contract; nothing on the disk is ever read. */
 var sourcePlugin = (files) => ({
 	name: "plitzi-functions-source",
@@ -49,6 +58,7 @@ var sourcePlugin = (files) => ({
 			if (args.kind !== "entry-point" && !args.path.startsWith(".")) return { errors: [{ text: `"${args.path}" cannot be imported: functions import their own files and ${CONTRACT_SPECIFIER}, nothing else` }] };
 			const base = args.kind === "entry-point" ? "." : path.posix.dirname(args.importer);
 			const wanted = normalize(path.posix.join(base, args.path));
+			if (wanted === ".." || wanted.startsWith("../")) return { errors: [{ text: outsideFunctions(args.path, wanted) }] };
 			const found = [
 				wanted,
 				`${wanted}.ts`,

package/dist/modules/functions/capabilities.js

@@ -191,6 +191,10 @@ var readCall = (value) => {
 			value: stringArg(call.value, "A value"),
 			signature: stringArg(call.signature, "A signature")
 		};
+		case "data": return {
+			op: "data",
+			file: stringArg(call.file, "A file")
+		};
 		case "log": return {
 			op: "log",
 			values: Array.isArray(call.values) ? call.values : []
@@ -216,6 +220,7 @@ var answerCall = async (ctx, call) => {
 		case "rateLimit": return ctx.rateLimit(call.bucket, call.limit);
 		case "sign": return ctx.sign(call.value);
 		case "verify": return ctx.verify(call.value, call.signature);
+		case "data": return ctx.data(call.file);
 		case "log":
 			ctx.log(...call.values);
 			return;

package/dist/modules/functions/context.js

@@ -65,6 +65,12 @@ var lineOf = (values) => values.map((value) => {
 var unavailable = (what) => () => Promise.reject(/* @__PURE__ */ new Error(`This server has no realtime channels (${what})`));
 var unsigned = () => Promise.reject(/* @__PURE__ */ new Error("This server signs nothing: its actions were given no signingSecret"));
 /**
+* A plugin reads none of its space's data. The space keeps there what its pages must not carry, and a plugin was trusted
+* to draw, not with what the space keeps — the same line as its credentials: handed the data, its `fetch` could send
+* it to any host the plugin declared.
+*/
+var noData = (file) => Promise.reject(/* @__PURE__ */ new Error(`The functions of a plugin read none of the data of its space ("${file}")`));
+/**
 * What a space's code is handed, built from the run's own context: the one place a {@link FunctionContext} is made.
 * A self-hosted server hands it to the code directly; the platform answers the sandbox's calls with it. With a `scope`,
 * it is a plugin's code, and gets the plugin's corner of the space (`./scope`).
@@ -90,7 +96,8 @@ var functionContextFor = (ctx, hosts, scope) => {
 		verify: ctx.verify ?? unsigned,
 		publish: ctx.publish ?? unavailable("publish"),
 		grant: ctx.grant ?? unavailable("grant"),
-		revoke: ctx.revoke ?? unavailable("revoke")
+		revoke: ctx.revoke ?? unavailable("revoke"),
+		data: ctx.data
 	};
 	const kv = prefixKv(ctx.kv, pluginKvPrefix(scope.plugin));
 	const { sign, verify } = ctx;
@@ -103,7 +110,8 @@ var functionContextFor = (ctx, hosts, scope) => {
 		verify: verify ? (value, signature) => verify(pluginSigned(scope.plugin, value), signature) : unsigned,
 		publish: noChannel,
 		grant: noChannel,
-		revoke: noChannel
+		revoke: noChannel,
+		data: noData
 	};
 };
 //#endregion

package/dist/modules/functions/contract.d.ts

@@ -67,6 +67,11 @@ export type FunctionContext = {
     grant: (topic: string, ttlSeconds?: number) => Promise<string>;
     /** Takes a grant back — or every grant for the topic, naming none. */
     revoke: (topic: string, grant?: string) => Promise<void>;
+    /**
+     * One file of the space's data — a project's `src/data/<file>` — parsed, as of the version the run belongs to: what
+     * a page must not carry, read here and answered only as far as it is shown. Read-only. `ctx.data('products.json')`.
+     */
+    data: (file: string) => Promise<unknown>;
     /** A line for whoever reads the run: the builder's Try, and the deployment's logs. */
     log: (...values: unknown[]) => void;
     /** Progress for a caller that asked for a stream — a no-op when nobody did. */

package/dist/modules/functions/driver.js

@@ -113,6 +113,10 @@ var createFunctionsDriver = (environment) => {
 				value,
 				signature
 			}),
+			data: (file) => call({
+				op: "data",
+				file
+			}),
 			log,
 			emit: (chunk) => {
 				call({

package/dist/modules/functions/local.d.ts

@@ -7,6 +7,8 @@ export type LocalFunctionsOptions = {
     credentials?: Record<string, Record<string, string>>;
     /** As the platform's: a plan's limits, for code that must fit them there. */
     limits?: Partial<FunctionLimits>;
+    /** The project's data folder (`src/data/`), what `ctx.data` reads — as the project's server reads it. */
+    dataDir?: string;
     fetchImpl?: typeof fetch;
 };
 export type LocalFunctions = {
@@ -26,4 +28,4 @@ export type LocalFunctions = {
  * isolates and limits, `ctx` over the same actions module — so what works here works there. `kv` lives as long as this
  * does. What `plitzi functions dev` is made of; needs `isolated-vm` and `core-js` installed, as any runner does.
  */
-export declare const createLocalFunctions: ({ credentials, limits, fetchImpl }?: LocalFunctionsOptions) => LocalFunctions;
+export declare const createLocalFunctions: ({ credentials, limits, dataDir, fetchImpl }?: LocalFunctionsOptions) => LocalFunctions;

package/dist/modules/functions/local.js

@@ -1,3 +1,4 @@
+import { dataDirLookup } from "../actions/runtime/projectData.js";
 import { functionsInHand } from "./space.js";
 import { createActionsModule } from "../actions/index.js";
 import { functionTryEntry } from "./tryEntry.js";
@@ -19,14 +20,15 @@ var LOCAL_USER = {
 * isolates and limits, `ctx` over the same actions module — so what works here works there. `kv` lives as long as this
 * does. What `plitzi functions dev` is made of; needs `isolated-vm` and `core-js` installed, as any runner does.
 */
-var createLocalFunctions = ({ credentials = {}, limits, fetchImpl } = {}) => {
+var createLocalFunctions = ({ credentials = {}, limits, dataDir, fetchImpl } = {}) => {
 	const runner = createIsolateRunner({ concurrency: 1 });
 	let loaded;
 	const module = createActionsModule({
 		lookups: {
 			getAction: () => Promise.resolve(void 0),
 			getCredential: (_spaceId, identifier) => Promise.resolve(Object.hasOwn(credentials, identifier) ? credentials[identifier] : void 0),
-			getFunctions: () => Promise.resolve(loaded)
+			getFunctions: () => Promise.resolve(loaded),
+			...dataDir ? { getData: dataDirLookup(dataDir) } : {}
 		},
 		functions: {
 			runner,

package/dist/modules/functions/protocol.d.ts

@@ -104,6 +104,9 @@ export type FunctionCall = {
     op: 'verify';
     value: string;
     signature: string;
+} | {
+    op: 'data';
+    file: string;
 }
 /** Each value as the guest could send it: JSON, with what JSON cannot say already said as text. */
  | {

package/dist/modules/functions/scope.d.ts

@@ -4,7 +4,7 @@
  *
  * The space trusted the plugin to draw something, not with what it keeps — so a plugin's functions are handed a narrower
  * `ctx`: their own corner of the space's `kv` and rate limits, signatures that only verify as theirs, the hosts they
- * declared, and none of the space's credentials or realtime channels.
+ * declared, and none of the space's credentials, realtime channels or data.
  */
 export type FunctionScope = {
     plugin: string;

package/dist/modules/images/imageProxy.js

@@ -2,8 +2,8 @@ import { fetchOutbound } from "../../helpers/outboundGuard.js";
 import { writeFileAtomic } from "../../helpers/atomicFile.js";
 import { isAllowedImageHost } from "./allowlist.js";
 import { createHash } from "node:crypto";
-import path from "node:path";
 import fs from "node:fs/promises";
+import path from "node:path";
 import { IMAGE_WIDTHS, isImageWidth } from "@plitzi/sdk-shared/helpers/images";
 //#region src/modules/images/imageProxy.ts
 /** The formats a picture may arrive in, as the file extension it is kept under. SVG is not one: served from this

package/dist/modules/mysql/accounts.js

@@ -170,11 +170,7 @@ var createAccountStore = (db, t) => {
 			const row = await findBy("email", email);
 			return row ? toRecord(row) : void 0;
 		},
-		/**
-		* `refreshExpiresAt` comes off the ROW. A store that keeps it inside a session object and forgets to lift it out
-		* has every renewal refused as expired — which does not fail at login, it fails a day later, silently, when the
-		* access token ages out and the session that looked fine simply ends.
-		*/
+		/** `refreshExpiresAt` comes off the ROW: it is the deadline renewal honours, over the token's own expiry. */
 		findByRefreshToken: async (token) => {
 			const row = await selectOne(db, `SELECT ${ACCOUNT_COLUMNS}, s.refresh_expires_at, UNIX_TIMESTAMP(s.created_at) AS session_started_at
            FROM ${t.session} s

package/dist/modules/project/plugins.d.ts

@@ -0,0 +1,31 @@
+import { FunctionsDefinition } from '../functions/contract';
+import { PluginSource, SSRServer } from '@plitzi/sdk-shared';
+/**
+ * A project's plugins, as its server registers them: every folder of `src/plugins` built from its source, and every
+ * plugin of `vendor/plugins` run as it was built — each with its server half, when it has one.
+ */
+export type ProjectPlugins = {
+    /** How each is built, by the name a space's `custom({ renderType })` renders it by. */
+    sources: Record<string, PluginSource>;
+    /**
+     * Which of them the space renders with — the deployment's `pluginNames`. Registering a plugin is not turning it on:
+     * a server can host many spaces, and nothing hands it this list on its own. Changed in place while developing, as
+     * folders come and go, so the deployment holding it renders with them.
+     */
+    names: string[];
+    /** Their server halves, by plugin name: `functions.plugins`. */
+    functions: Record<string, FunctionsDefinition>;
+    /** The names that are folders of `src/plugins`: the only ones a folder coming or going turns on or off. */
+    fromFolders: Set<string>;
+};
+/** Every plugin of the project at `root`, as its server registers them at boot. */
+export declare const projectPlugins: (root: string) => Promise<ProjectPlugins>;
+/**
+ * A plugin edited while developing is built again by the server, and the open pages swap it where it is drawn — the
+ * rest of the page, its state included, stays as it was (`devReload`). Its server half (`functions/`) is loaded again
+ * here, in place. A plugin ADDED — a new folder with an `index.ts`, what `plitzi add plugin` writes — is registered
+ * here, and the pages load again to render it; one removed is turned off. A folder the server cannot build, or whose
+ * server half has no entry, is said in the terminal as the layout check says it at boot — once, until it changes — and
+ * the server goes on. Answers what stops watching.
+ */
+export declare const watchProjectPlugins: (root: string, server: SSRServer, plugins: ProjectPlugins) => (() => void);