@engenty/wizards-runtime 0.0.0-stage → 0.7.5

package/apps/runtime/dist/auth/device.js

@@ -0,0 +1,112 @@
+import { env } from "../env.js";
+import { discovery, ManageError, tokenRequest } from "../manage.js";
+import { CLIENT, keep, SCOPE } from "./account.js";
+/**
+ * Signing in from a terminal (RFC 8628): the Manage-App hands out a code, the person types it
+ * on any browser at the account's /device page and allows it, and this process asks the token
+ * endpoint until they did. For `wizards setup` and `wizards account sign-in`; the studio keeps
+ * the browser flow of account.ts. Both end in the same keep(): the refresh token in the vault,
+ * the account in the settings, so the runtime picks it up wherever it runs.
+ *
+ *   POST <account>/api/auth/device/code      client_id, scope, resource → the codes
+ *   POST <token endpoint of the discovery>   grant_type device_code, every `interval` seconds,
+ *                                            until tokens come, or the code expired or was refused
+ */
+const GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/** Why a sign-in ended without an account; the message is for the person. */
+export class DeviceSignInError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+    }
+}
+/** Asks the Manage-App for a code to sign this install in with. */
+export async function requestDeviceCode() {
+    const base = env.local.accountUrl;
+    // The discovery names the endpoint when the Manage-App advertises it.
+    const d = (await discovery(base).catch(() => null));
+    const res = await fetch(d?.device_authorization_endpoint ?? `${base}/api/auth/device/code`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+            client_id: CLIENT.id,
+            scope: SCOPE,
+            resource: env.local.cloudUrl,
+        }),
+        signal: AbortSignal.timeout(15_000),
+    }).catch(() => null);
+    if (!res) {
+        throw new DeviceSignInError("unreachable", `${base} is not reachable right now.`);
+    }
+    const data = (await res.json().catch(() => ({})));
+    if (!(res.ok && data.device_code && data.user_code && data.verification_uri)) {
+        throw new DeviceSignInError("refused", data.error_description ||
+            (data.error
+                ? `The account refused the sign-in (${data.error}).`
+                : `The account did not hand out a code (${res.status}).`));
+    }
+    return {
+        deviceCode: data.device_code,
+        userCode: data.user_code,
+        verificationUri: data.verification_uri,
+        verificationUriComplete: data.verification_uri_complete ?? null,
+        expiresAt: Date.now() + (data.expires_in ?? 1800) * 1000,
+        interval: Math.max(1, data.interval ?? 5),
+    };
+}
+/** A pause that ends early when the signal aborts. */
+const pause = (ms, signal) => new Promise((done) => {
+    const timer = setTimeout(done, ms);
+    signal?.addEventListener("abort", () => {
+        clearTimeout(timer);
+        done();
+    }, { once: true });
+});
+/**
+ * Asks the token endpoint until the person allowed the code in the browser, and keeps the
+ * tokens as the browser flow does. `authorization_pending` asks again after `interval`;
+ * `slow_down` asks five seconds later each time (RFC 8628 §3.5); a network error is tried
+ * again a few times. `expired_token` and `access_denied` end it.
+ */
+export async function waitForDeviceSignIn(code, options = {}) {
+    const wait = options.wait ?? pause;
+    const { signal } = options;
+    let interval = code.interval;
+    let failures = 0;
+    for (;;) {
+        await wait(interval * 1000, signal);
+        if (signal?.aborted) {
+            throw new DeviceSignInError("skipped", "Skipped the sign-in.");
+        }
+        if (Date.now() >= code.expiresAt) {
+            throw new DeviceSignInError("expired", "The code has expired. Start the sign-in again.");
+        }
+        try {
+            const tokens = await tokenRequest({ grant_type: GRANT, device_code: code.deviceCode, resource: env.local.cloudUrl }, CLIENT, env.local.accountUrl);
+            return await keep(tokens);
+        }
+        catch (err) {
+            if (!(err instanceof ManageError)) {
+                if (++failures >= 5) {
+                    throw new DeviceSignInError("unreachable", `${env.local.accountUrl} stopped answering. Start the sign-in again.`);
+                }
+                continue;
+            }
+            failures = 0;
+            switch (err.code) {
+                case "authorization_pending":
+                    continue;
+                case "slow_down":
+                    interval += 5;
+                    continue;
+                case "expired_token":
+                    throw new DeviceSignInError("expired", "The code has expired. Start the sign-in again.");
+                case "access_denied":
+                    throw new DeviceSignInError("denied", "The sign-in was refused in the browser.");
+                default:
+                    throw new DeviceSignInError("refused", `The account refused the sign-in (${err.code}).`);
+            }
+        }
+    }
+}

package/apps/runtime/dist/auth/index.js

@@ -0,0 +1,358 @@
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { userInfo } from "node:os";
+import { eq, lt } from "drizzle-orm";
+import { Hono } from "hono";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+import { nanoid } from "nanoid";
+import { control, controlDb, withTenant } from "../db/client.js";
+import { basePath, env } from "../env.js";
+import { discovery, managed, tokenRequest, verifyToken, } from "../manage.js";
+import { refreshPro } from "../plugins/pro.js";
+import { seal, unseal } from "../secrets/crypto.js";
+import { LOCAL_TENANT } from "../tenants/tenant.js";
+import { finishLink } from "./account.js";
+import { localTicketExpiry } from "./local-ticket.js";
+const secure = env.appUrl.startsWith("https");
+// --- a runtime that runs alone ------------------------------------------------
+// One person, one tenant. The studio answers only with a cookie that is set by opening the
+// one-time link once: a web page in the same browser cannot reach it.
+const LOCAL_COOKIE = "wz_local";
+const localCookieValue = createHmac("sha256", env.authSecret).update("local-studio").digest("hex");
+let accessKey = managed
+    ? null
+    : env.local.accessKey || randomBytes(24).toString("hex");
+/** The link that lets the person in; printed at start, opened by the desktop app. */
+export function localEntryUrl() {
+    return accessKey ? `${env.appUrl}/api/local/enter?k=${accessKey}` : null;
+}
+/** Sends everything published here to the cloud of the account that was just linked. */
+async function firstSync() {
+    try {
+        // Loaded here: the services read the session this module makes.
+        const { syncAllToCloud } = await import("../services/cloud.js");
+        await withTenant(LOCAL_TENANT, () => syncAllToCloud(localUser().id));
+    }
+    catch (err) {
+        console.error("[cloud] first sync failed:", err);
+    }
+}
+const localUser = () => ({
+    id: "local",
+    tenantId: LOCAL_TENANT,
+    role: "owner",
+    name: userInfo().username || "Admin",
+    email: "",
+});
+function sameValue(a, b) {
+    const x = Buffer.from(a);
+    const y = Buffer.from(b);
+    return x.length === y.length && timingSafeEqual(x, y);
+}
+function setLocalCookie(c) {
+    setCookie(c, LOCAL_COOKIE, localCookieValue, {
+        httpOnly: true,
+        sameSite: "Strict",
+        secure,
+        path: cookiePath,
+        maxAge: 60 * 60 * 24 * 365,
+    });
+}
+// --- signed in at the Manage-App ------------------------------------------------
+const SESSION_COOKIE = "wz_session";
+/** How much of a wish goes along to the account's sign-in page. */
+const WISH_MAX = 600;
+const STATE_COOKIE = "wz_oauth";
+const SESSION_DAYS = 30;
+const SCOPE = "openid profile email offline_access wizards:read wizards:write wizards:publish runs:test";
+// The desktop app shows a server in its window but signs in through the system browser
+// (Google refuses embedded views). The finished session travels back as a one-time code in an
+// `engenty-wizards://` link; it only counts in the window that asked for it, which holds the
+// matching cookie — so a link sent by some web page signs nobody in.
+const DESKTOP_COOKIE = "wz_desktop";
+const usedHandoffs = new Set();
+/** Tickets of the local one-time link that were opened, until they run out. */
+const usedTickets = new Map();
+const sessions = new Map();
+const client = () => ({ id: env.manage.clientId, secret: env.manage.clientSecret || undefined });
+/** Cookies and redirects stay under the path the app is served at. */
+const cookiePath = basePath || "/";
+/** Where a sign-in and the local link lead: the studio. */
+const home = `${basePath}/studio/`;
+const callbackUrl = () => `${env.appUrl}/api/auth/callback`;
+function safeReturn(path) {
+    return path?.startsWith("/") && !path.startsWith("//") ? path : home;
+}
+function setSessionCookie(c, id) {
+    setCookie(c, SESSION_COOKIE, id, {
+        httpOnly: true,
+        sameSite: "Lax",
+        secure,
+        path: cookiePath,
+        maxAge: SESSION_DAYS * 24 * 3600,
+    });
+}
+async function claimsOf(tokens) {
+    const claims = await verifyToken(tokens.access_token, [env.appUrl]);
+    if (!claims) {
+        throw new Error("The Manage-App's token did not verify.");
+    }
+    return claims;
+}
+/** Renews tenant and role from the Manage-App once the access token they came from has run out. */
+async function renew(row) {
+    const refresh = row.refreshToken ? unseal(row.refreshToken) : null;
+    if (!refresh) {
+        return null;
+    }
+    try {
+        const tokens = await tokenRequest({ grant_type: "refresh_token", refresh_token: refresh, resource: env.appUrl }, client());
+        const claims = await claimsOf(tokens);
+        const next = {
+            ...row,
+            tenantId: claims.tenantId,
+            role: claims.role,
+            name: claims.name || row.name,
+            email: claims.email || row.email,
+            refreshToken: tokens.refresh_token ? seal(tokens.refresh_token) : row.refreshToken,
+            claimsExpireAt: new Date(claims.expiresAt),
+        };
+        await controlDb.update(control.session).set(next).where(eq(control.session.id, row.id));
+        return next;
+    }
+    catch {
+        return null;
+    }
+}
+async function sessionPrincipal(id) {
+    const hit = sessions.get(id);
+    let row = hit && Date.now() - hit.at < 60_000
+        ? hit.row
+        : await controlDb.query.session.findFirst({ where: eq(control.session.id, id) });
+    if (!row || row.expiresAt.getTime() < Date.now()) {
+        sessions.delete(id);
+        return null;
+    }
+    if (row.claimsExpireAt.getTime() < Date.now()) {
+        const renewed = await renew(row);
+        if (!renewed) {
+            await controlDb.delete(control.session).where(eq(control.session.id, id));
+            sessions.delete(id);
+            return null;
+        }
+        row = renewed;
+    }
+    sessions.set(id, { at: Date.now(), row });
+    return {
+        id: row.userId,
+        tenantId: row.tenantId,
+        role: row.role,
+        name: row.name,
+        email: row.email,
+        image: row.image,
+    };
+}
+/** Sessions that ran out go once an hour, with the retention job. */
+export async function purgeSessions() {
+    await controlDb.delete(control.session).where(lt(control.session.expiresAt, new Date()));
+}
+// --- both ------------------------------------------------------------------------
+export async function principalOf(c) {
+    if (!managed) {
+        const cookie = getCookie(c, LOCAL_COOKIE);
+        return cookie && sameValue(cookie, localCookieValue) ? localUser() : null;
+    }
+    const id = getCookie(c, SESSION_COOKIE);
+    return id ? sessionPrincipal(id) : null;
+}
+const closePage = (message) => `<!doctype html><meta charset="utf-8"><title>engenty wizards</title>
+<body style="font:16px system-ui;display:grid;place-items:center;height:100vh;margin:0;color:#333">
+<p>${message}</p>`;
+export const authRoutes = new Hono()
+    // Local: the one-time link. The key works once per start; a ticket (`wizards open`,
+    // the desktop app entering a runtime that already runs) once within its minute.
+    .get("/local/enter", (c) => {
+    const given = c.req.query("k") ?? "";
+    const ticket = c.req.query("t") ?? "";
+    const now = Date.now();
+    for (const [used, expires] of usedTickets) {
+        if (expires <= now) {
+            usedTickets.delete(used);
+        }
+    }
+    const expires = !managed && ticket && !usedTickets.has(ticket)
+        ? localTicketExpiry(env.authSecret, ticket, now)
+        : null;
+    if (expires) {
+        usedTickets.set(ticket, expires);
+    }
+    else if (managed || !accessKey || !sameValue(given, accessKey)) {
+        return c.text("This link is no longer valid. Run wizards open to get a new one.", 403);
+    }
+    else {
+        accessKey = null;
+    }
+    setLocalCookie(c);
+    return c.redirect(home);
+})
+    // Local development only: the "Dev-Login" button.
+    .post("/dev/login", (c) => {
+    if (managed || !env.devLogin) {
+        return c.notFound();
+    }
+    setLocalCookie(c);
+    return c.json({ ok: true });
+})
+    // The desktop app's window asks for a sign-in that will run in the system browser.
+    .post("/auth/desktop/start", (c) => {
+    if (!managed) {
+        return c.notFound();
+    }
+    const desktop = randomBytes(24).toString("base64url");
+    setCookie(c, DESKTOP_COOKIE, desktop, {
+        httpOnly: true,
+        sameSite: "Lax",
+        secure,
+        path: `${basePath}/api/auth`,
+        maxAge: 900,
+    });
+    const ticket = seal({ desktop, exp: Date.now() + 15 * 60_000 });
+    return c.json({ url: `${env.appUrl}/api/auth/login?desktop=${encodeURIComponent(ticket)}` });
+})
+    .get("/auth/handoff", async (c) => {
+    const code = c.req.query("code") ?? "";
+    const handoff = unseal(code);
+    const desktop = getCookie(c, DESKTOP_COOKIE);
+    deleteCookie(c, DESKTOP_COOKIE, { path: `${basePath}/api/auth` });
+    if (!managed ||
+        !handoff ||
+        handoff.exp < Date.now() ||
+        !desktop ||
+        !sameValue(desktop, handoff.desktop) ||
+        usedHandoffs.has(handoff.sid)) {
+        return c.redirect(`${home}?signin=failed`);
+    }
+    usedHandoffs.add(handoff.sid);
+    setSessionCookie(c, handoff.sid);
+    return c.redirect(home);
+})
+    .get("/auth/login", async (c) => {
+    if (!managed) {
+        return c.notFound();
+    }
+    const d = await discovery();
+    const verifier = randomBytes(32).toString("base64url");
+    const ticket = unseal(c.req.query("desktop") ?? "");
+    const state = {
+        verifier,
+        nonce: nanoid(16),
+        returnTo: safeReturn(c.req.query("return")),
+        exp: Date.now() + 15 * 60_000,
+        ...(ticket && ticket.exp > Date.now() ? { desktop: ticket.desktop } : {}),
+    };
+    setCookie(c, STATE_COOKIE, seal(state), {
+        httpOnly: true,
+        sameSite: "Lax",
+        secure,
+        path: `${basePath}/api/auth`,
+        maxAge: 900,
+    });
+    const url = new URL(d.authorization_endpoint);
+    url.search = new URLSearchParams({
+        response_type: "code",
+        client_id: env.manage.clientId,
+        redirect_uri: callbackUrl(),
+        scope: SCOPE,
+        resource: env.appUrl,
+        code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+        code_challenge_method: "S256",
+        state: state.nonce,
+    }).toString();
+    // What the person wants built (the studio's start page): the account's sign-in page shows it.
+    const wish = (c.req.query("wish") ?? "").trim().slice(0, WISH_MAX);
+    if (wish) {
+        url.searchParams.set("wish", wish);
+    }
+    return c.redirect(url.toString());
+})
+    .get("/auth/callback", async (c) => {
+    const code = c.req.query("code");
+    const rawState = c.req.query("state") ?? "";
+    if (!managed) {
+        // The linked account of a runtime that runs alone: the system browser lands here.
+        if (!code) {
+            return c.html(closePage("Sign-in cancelled. You can close this window."), 400);
+        }
+        try {
+            await finishLink(code, rawState);
+            // What is published here goes to the account's cloud, from now on and once for all there is.
+            void firstSync();
+            // The Pro modules the account's plan includes.
+            void refreshPro();
+            return c.html(closePage("Signed in. You can close this window."));
+        }
+        catch (err) {
+            console.error("[account]", err);
+            return c.html(closePage("The sign-in didn’t work. Try again."), 400);
+        }
+    }
+    const state = unseal(getCookie(c, STATE_COOKIE) ?? "");
+    deleteCookie(c, STATE_COOKIE, { path: `${basePath}/api/auth` });
+    if (!code || !state || state.exp < Date.now() || state.nonce !== rawState) {
+        return c.redirect(`${home}?signin=failed`);
+    }
+    try {
+        const tokens = await tokenRequest({
+            grant_type: "authorization_code",
+            code,
+            redirect_uri: callbackUrl(),
+            code_verifier: state.verifier,
+            resource: env.appUrl,
+        }, client());
+        const claims = await claimsOf(tokens);
+        const id = randomBytes(32).toString("base64url");
+        await controlDb.insert(control.session).values({
+            id,
+            userId: claims.userId,
+            tenantId: claims.tenantId,
+            role: claims.role,
+            name: claims.name || claims.email,
+            email: claims.email,
+            refreshToken: tokens.refresh_token ? seal(tokens.refresh_token) : null,
+            claimsExpireAt: new Date(claims.expiresAt),
+            expiresAt: new Date(Date.now() + SESSION_DAYS * 24 * 3600_000),
+        });
+        if (state.desktop) {
+            // The session belongs to the app's window, not to this browser.
+            const code = seal({
+                sid: id,
+                desktop: state.desktop,
+                exp: Date.now() + 2 * 60_000,
+            });
+            const link = `engenty-wizards://signin?code=${encodeURIComponent(code)}`;
+            return c.html(`${closePage("Signed in. Go back to engenty wizards now.")}
+<script>location.href = ${JSON.stringify(link)};</script>`);
+        }
+        setSessionCookie(c, id);
+        return c.redirect(state.returnTo);
+    }
+    catch (err) {
+        console.error("[sign-in]", err);
+        return c.redirect(`${home}?signin=failed`);
+    }
+})
+    .post("/auth/sign-out", async (c) => {
+    const id = getCookie(c, SESSION_COOKIE);
+    if (id) {
+        await controlDb.delete(control.session).where(eq(control.session.id, id));
+        sessions.delete(id);
+    }
+    deleteCookie(c, SESSION_COOKIE, { path: cookiePath });
+    deleteCookie(c, LOCAL_COOKIE, { path: cookiePath });
+    if (!managed) {
+        return c.json({ ok: true });
+    }
+    // The person signs out of the account too (the Manage-App's `/api/sign-out`, a form the page
+    // sends there): still signed in there, the sign-in page would sign them in again at once.
+    const d = await discovery().catch(() => null);
+    return c.json({ ok: true, account: d ? new URL("/api/sign-out", d.issuer).toString() : null });
+});

package/apps/runtime/dist/auth/keys.js

@@ -0,0 +1,55 @@
+import { createHash, randomBytes } from "node:crypto";
+import { nanoid } from "nanoid";
+import { readSetting, writeSetting } from "../settings.js";
+/**
+ * API keys of a runtime that runs alone: the person's own MCP client (Claude Code, Cursor,
+ * Codex) and scripts sign in with them. Only the hash is kept. A runtime of a Manage-App has
+ * none of its own — keys are issued and checked there.
+ */
+export const API_KEY_PREFIX = "wz_";
+const hashOf = (key) => createHash("sha256").update(key).digest("hex");
+/** A key that lives only as long as this process: the studio chat's own client signs in with it. */
+let internal = null;
+export function internalKey() {
+    internal ??= `${API_KEY_PREFIX}${randomBytes(24).toString("base64url")}`;
+    return internal;
+}
+const INTERNAL_CLIENT = "Claude (Abo)";
+async function all() {
+    return (await readSetting("apiKeys")) ?? [];
+}
+export async function listLocalKeys() {
+    return (await all()).map(({ hash: _hash, ...rest }) => rest);
+}
+export async function createLocalKey(name) {
+    const key = `${API_KEY_PREFIX}${randomBytes(24).toString("base64url")}`;
+    const row = {
+        id: nanoid(12),
+        name,
+        start: key.slice(0, 8),
+        hash: hashOf(key),
+        createdAt: new Date().toISOString(),
+        lastRequest: null,
+    };
+    await writeSetting("apiKeys", [...(await all()), row]);
+    return { id: row.id, name, key };
+}
+export async function deleteLocalKey(id) {
+    await writeSetting("apiKeys", (await all()).filter((k) => k.id !== id));
+}
+export async function verifyLocalKey(key) {
+    if (internal && key === internal) {
+        return { id: "internal", name: INTERNAL_CLIENT };
+    }
+    const keys = await all();
+    const found = keys.find((k) => k.hash === hashOf(key));
+    if (!found) {
+        return null;
+    }
+    // One write a minute is enough to show the key is in use.
+    if (!found.lastRequest || Date.now() - Date.parse(found.lastRequest) > 60_000) {
+        found.lastRequest = new Date().toISOString();
+        await writeSetting("apiKeys", keys);
+    }
+    return { id: found.id, name: found.name };
+}

package/apps/runtime/dist/auth/local-ticket.js

@@ -0,0 +1,26 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * A second way through the one-time link: a ticket signed with the data folder's secret, good
+ * for a minute. Who can read that secret can already make the studio's cookie, so a ticket opens
+ * nothing new — it lets the command line and the desktop app enter a runtime that already runs.
+ */
+const TTL_MS = 60_000;
+/** The header `wizards mcp` signs its requests with, and the one naming its client. */
+export const LOCAL_MCP_HEADER = "x-engenty-local";
+export const LOCAL_CLIENT_HEADER = "x-engenty-client";
+const sign = (secret, expires, purpose) => createHmac("sha256", secret).update(`${purpose}.${expires}`).digest("hex");
+export function mintLocalTicket(secret, now = Date.now(), purpose = "local-enter") {
+    const expires = now + TTL_MS;
+    return `${expires}.${sign(secret, expires, purpose)}`;
+}
+/** When a ticket runs out, or null when it is not one of ours or already ran out. */
+export function localTicketExpiry(secret, ticket, now = Date.now(), purpose = "local-enter") {
+    const [head, signature] = ticket.split(".");
+    const expires = Number(head);
+    if (!signature || !Number.isSafeInteger(expires) || expires <= now || expires > now + TTL_MS) {
+        return null;
+    }
+    const given = Buffer.from(signature);
+    const expected = Buffer.from(sign(secret, expires, purpose));
+    return given.length === expected.length && timingSafeEqual(given, expected) ? expires : null;
+}

package/apps/runtime/dist/authoring/example.js

@@ -0,0 +1,74 @@
+/**
+ * The wizard the authoring guide shows as an example of the schema: a post with an image. It is
+ * the guide's own, not a marketplace entry, so the guide never depends on the marketplace.
+ */
+export const EXAMPLE_WIZARD = {
+    version: 1,
+    title: "X post with an image",
+    description: "Turns a topic into a finished post with an image.",
+    avatar: "flame",
+    lang: "en",
+    intro: "Tell me briefly what it is about – I write the post and draw the image for it.",
+    steps: [
+        {
+            id: "about",
+            type: "page",
+            title: "What is it about?",
+            fields: [
+                {
+                    id: "topic",
+                    label: "Topic or occasion",
+                    kind: "textarea",
+                    required: true,
+                    placeholder: "e.g. We open our new studio in Vienna on Friday",
+                },
+                {
+                    id: "tone",
+                    label: "Tone",
+                    kind: "select",
+                    options: ["Casual", "Professional", "Funny", "Inspiring"],
+                    default: "Casual",
+                },
+                { id: "link", label: "Link (optional)", kind: "url" },
+            ],
+        },
+        {
+            id: "post",
+            type: "agent",
+            title: "Write the post",
+            working: "Writing the post …",
+            instructions: "Write a post for X (Twitter) on the topic: {{topic}}. Tone: {{tone}}. At most 270 characters including the link, and at most two hashtags. If a link is given ({{link}}), put it at the end. A strong first sentence. Output only the post.",
+            tools: [],
+            output: { format: "text" },
+            model: "standard",
+        },
+        {
+            id: "visual",
+            type: "generate",
+            title: "Draw the image",
+            working: "Drawing the image …",
+            asset: "image",
+            prompt: "A striking image to go with this post: {{steps.post}}. Topic: {{topic}}. No text in the image.",
+            options: { aspectRatio: "16:9", style: "modern editorial, clean, high contrast" },
+        },
+        {
+            id: "check",
+            type: "review",
+            title: "Does this work?",
+            description: "You can change the text directly or ask for a new variant.",
+            show: ["post", "visual"],
+            edit: true,
+            regenerate: true,
+        },
+        {
+            id: "done",
+            type: "result",
+            title: "Ready to post",
+            message: "Copy the text and download the image.",
+            deliverables: [
+                { from: "post", label: "Post", formats: ["txt", "md"] },
+                { from: "visual", label: "Image", formats: ["png"] },
+            ],
+        },
+    ],
+};