inmake DOCS
Docs / Server / Notes & versioning

Notes & versioning

Limitations, bundling and how the package is versioned.

Notes & limitations#

  • Hook delivery is BEST-EFFORT — there is no retry. The backend sends one POST with a 10 s timeout; any failure (non-2xx, network, timeout) is logged and dropped. No backoff, no re-queue, no dead-letter — a rejected push is lost permanently. So hooks are the fast path and the TTL is the correctness backstop, not the other way round: a deploy mid-flight, a key rotation or a clock skew costs you one push, and only renderTtlMs / dataTtlMs get that page back. Don't set them to Infinity.
  • Signature verification is opt-in. Pass privateKey (a string, or a (locale, collection) => key resolver — the per-hook secret your store holds) to enforce access-seed. Without it, pushes are accepted unverified. A replay window bounds verified seeds: WebSite defaults hookMaxAgeMs to 5 min; a standalone HookReceiver is unbounded unless you pass maxAgeMs. The backend signs every push bound to its document ({locale}/{collection}/{id}), so set acceptUnbound: false to close the capture-a-seed-forge-another-document hole — but only against a backend that is actually rolled; against an older one it rejects everything.
  • Backend deletes arrive as tombstones. A delete pushes the bare {id} with an x-drop-deleted: true header; the receiver evicts the key (and fires onReceive, so dependent rendered HTML drops too) and returns {ok: true, deleted: true}. The repository still self-heals independently: a remote / preferRemote read that core answers as missing deletes the stale cache key.
  • RenderCache stores SSR HTML under the same keys; use the receiver's onReceive(ctx) to delete the matching HTML key on a data push.

All live testing is against the Demo project only (target: 'instore', xx_YY locales) — never PROD.

Bundling & vendoring#

npm run bundle builds the monorepo chain (core-lib → sdk-js → this package) and esbuilds a single-file CJS bundle at dist/drop_core_server.js (express external). Nothing consumes that bundle vendored any more: the admin App Hosting server stopped running this package on 2026-09-04 (its vendor:server-sdk script and server/vendor/drop_core_server.cjs were deleted) — the admin SPA bundles the package's source through its Vite alias for the Studio renderer, and the tenant fleet consumes lib/ through the file: chain. Full build-order / vendoring runbook: the repo-root docs/sdk-development.md. The root service.js / service.d.ts shim (drop-core-server/service) ships next to lib/ (files) and in the vendor starter; it needs the sibling drop-core-service-host package (file:../service-host, built before this one).

Versioning#

Any behaviour change bumps the minor version, breaking changes bump the major (see version in package.json). Downstream workspaces diff this instead of diffing the built lib/.