Status: experimental. Ports of JavaScript Solid Server's bundled features onto the #206 plugin loader (createServer({ plugins }), JSS ≥ 0.0.215) — each living outside the JSS tree, using only what a real third-party plugin gets.

Inside src/, the bundled features cheat: they import internals, share closures with server.js, and reach around WAC. Out here a port can only use the public surface — activate(api) plus the documented imports — so:

• every port is an honest test of the plugin api,
• every wall a port hits is a seam discovery, written up in NOTES.md before it becomes an upstream issue,
• and core stays untouched: these are parallel implementations, not migrations. Nothing here removes or changes anything in JSS.

This is the plugin-zero method (#582 → #584 → #588 → #589) applied to JSS's own feature set.

AGENT.md is the comprehensive guide for adding plugins — the api, the five reusable patterns, the gaps and their workarounds, a copy-this-plugin map, and the footguns. NEXT.md is the handoff for whoever (LLM or human) continues the work: current state, the next wave, the per-plugin loop, and the backlog. Read those, then NOTES.md (findings) and ISSUES.md (backlog triage).

A plugin directory may import:

1. javascript-solid-server/auth.js (getAgent) — the documented contract,
2. whatever the activate(api) surface provides,
3. its own npm dependencies.

Never javascript-solid-server/src/.... If a port can't be written without internals, that gap is the finding — document it in the port's README and NOTES.md, ship the closest honest approximation.

Ports of bundled features (does the public api reproduce core?):

New features built straight onto the api (from the plugin-tagged issue backlog):

Plus one directory that is a scenario, not a plugin: federation-demo/ — two JSS instances federating over loopback (webfinger discovery, a cross-origin Follow, plugin-signed delivery); run node federation-demo/demo.js for the narrated version.

527 tests, all green (npm test), including compose.test.js — all thirty-five plugins on one server from pure config, pods + WAC intact beside them. Findings consolidated in NOTES.md; the full plugin-tagged backlog triaged in ISSUES.md; the build guide is AGENT.md; the maintainer-facing summary — what to add to the api next, ranked, with evidence — is REPORT.md; where this sits in the ecosystem and the realistic play is STRATEGY.md; the four-axis security review and its outcomes is SECURITY.md.

<name>/plugin.js   the port          <name>/test.js   real-JSS tests   <name>/README.md   findings
compose.test.js    ONE server, every plugin           serve.js         demo composition
helpers.js         test harness (boot JSS from npm)    NOTES.md         consolidated findings

Each directory: plugin.js (exports activate(api)), test.js (boots a real JSS from npm), README.md (usage + findings for that port).

npm install
npm test          # every port's tests + the all-plugins composition
npm run serve     # one server: pods + every plugin

AGPL-3.0-only, same as JSS — several ports adapt JSS source.