@engenty/wizards-runtime 0.0.0-stage → 0.7.5

package/apps/runtime/dist/routes/marketplace.js

@@ -0,0 +1,43 @@
+import { CAPABILITY_IDS, INDUSTRY_IDS, ITEM_FORMAT_IDS, MARKETPLACE_PLAN_IDS, USE_CASE_IDS, } from "@engenty-wizards/shared/marketplace";
+import { Hono } from "hono";
+import { z } from "zod";
+import { asLang, marketplaceDetail, searchMarketplace, searchMarketplaceAsGuest, starEntry, } from "../services/marketplace.js";
+import { notFoundAnswer } from "./lang.js";
+const searchSchema = z.object({
+    q: z.string().trim().max(200).default(""),
+    lang: z.string().optional(),
+    useCase: z.enum(USE_CASE_IDS).optional(),
+    industry: z.enum(INDUSTRY_IDS).optional(),
+    format: z.enum(ITEM_FORMAT_IDS).optional(),
+    capability: z.enum(CAPABILITY_IDS).optional(),
+    plan: z.enum(MARKETPLACE_PLAN_IDS).optional(),
+    starred: z
+        .enum(["1", "0"])
+        .optional()
+        .transform((v) => v === "1"),
+    limit: z.coerce.number().int().min(1).max(100).default(60),
+    offset: z.coerce.number().int().min(0).default(0),
+});
+/** The marketplace for someone signed in: the search on "new", an entry, and the stars. */
+export const marketplaceStudio = new Hono()
+    .get("/", async (c) => {
+    const { lang, ...search } = searchSchema.parse(c.req.query());
+    return c.json(await searchMarketplace({ ...search, lang: asLang(lang) }));
+})
+    .get("/:id", async (c) => {
+    const detail = await marketplaceDetail(c.req.param("id"), asLang(c.req.query("lang")));
+    return detail ? c.json(detail) : c.json(notFoundAnswer(c), 404);
+})
+    .put("/:id/star", async (c) => {
+    await starEntry(c.get("user").tenantId, c.req.param("id"), true);
+    return c.json({ ok: true });
+})
+    .delete("/:id/star", async (c) => {
+    await starEntry(c.get("user").tenantId, c.req.param("id"), false);
+    return c.json({ ok: true });
+});
+/** The gallery for someone not signed in (the studio's start page for guests): only the search. */
+export const marketplaceGuest = new Hono().get("/", async (c) => {
+    const { lang, starred: _starred, ...search } = searchSchema.parse(c.req.query());
+    return c.json(await searchMarketplaceAsGuest({ ...search, lang: asLang(lang) }));
+});

package/apps/runtime/dist/routes/plugin-public.js

@@ -0,0 +1,113 @@
+import { Hono } from "hono";
+import { withTenant } from "../db/client.js";
+import { SHARED, tenantOfAddress } from "../plugins/public.js";
+import { loadedPlugin, pluginIdsOf } from "../plugins/registry.js";
+import { tenantStatus } from "../tenants/control.js";
+import { notFoundAnswer } from "./lang.js";
+import { answerOf } from "./plugins.js";
+/**
+ * Plugins' public routes (`server.registerPublicRoute`), below `/api/public/plugins/<id>/<ref>`.
+ * Nobody is signed in: the ref names the tenant, and the plugin checks a secret of its own.
+ * Shared routes (`server.registerSharedRoute`) are below `/api/public/plugins/<id>/shared`, for
+ * every tenant; their handler enters a tenant by the ref the call carries.
+ */
+const notFound = (c) => c.json(notFoundAnswer(c), 404);
+/** What a handler threw, as the answer: its status and code, or a 500. */
+function failed(c, id, what, err) {
+    const answer = answerOf(err);
+    if (answer) {
+        return c.json(answer.body, answer.status);
+    }
+    console.error(`[plugin ${id}] ${what}:`, err);
+    return c.json({ error: "The plugin failed.", code: "plugin_failed" }, 500);
+}
+/** The tenant of a ref, when it is active and has the plugin. */
+async function tenantWithPlugin(id, ref) {
+    const tenantId = await tenantOfAddress(id, ref);
+    if (!tenantId || (await tenantStatus(tenantId)) !== "active") {
+        return null;
+    }
+    return (await pluginIdsOf(tenantId)).has(id) ? tenantId : null;
+}
+async function shared(c) {
+    const id = c.req.param("id") ?? "";
+    const plugin = loadedPlugin(id);
+    if (!plugin) {
+        return notFound(c);
+    }
+    const url = new URL(c.req.url);
+    const marker = `/plugins/${id}/${SHARED}`;
+    const path = url.pathname.slice(url.pathname.indexOf(marker) + marker.length);
+    for (const { route, pattern, params } of plugin.sharedRoutes) {
+        const match = route.method === c.req.method ? pattern.exec(path) : null;
+        if (!match) {
+            continue;
+        }
+        const request = {
+            request: c.req.raw,
+            path: path || "/",
+            params: Object.fromEntries(params.map((name, i) => [name, decodeURIComponent(match[i + 1])])),
+            query: url.searchParams,
+            async inTenant(ref, work) {
+                const tenantId = await tenantWithPlugin(id, ref);
+                if (!tenantId) {
+                    throw Object.assign(new Error("No tenant has this address."), {
+                        status: 404,
+                        code: "not_found",
+                    });
+                }
+                return withTenant(tenantId, async () => await work());
+            },
+        };
+        try {
+            const result = await route.handler(request);
+            return result instanceof Response ? result : c.json(result ?? null);
+        }
+        catch (err) {
+            return failed(c, id, `shared ${route.method} ${path}`, err);
+        }
+    }
+    return notFound(c);
+}
+async function dispatch(c) {
+    const id = c.req.param("id") ?? "";
+    const ref = c.req.param("ref") ?? "";
+    const tenantId = await tenantWithPlugin(id, ref);
+    const plugin = tenantId ? loadedPlugin(id) : undefined;
+    if (!tenantId || !plugin) {
+        return notFound(c);
+    }
+    const url = new URL(c.req.url);
+    const marker = `/plugins/${id}/${ref}`;
+    const path = url.pathname.slice(url.pathname.indexOf(marker) + marker.length);
+    for (const { route, pattern, params } of plugin.publicRoutes) {
+        const match = route.method === c.req.method ? pattern.exec(path) : null;
+        if (!match) {
+            continue;
+        }
+        const request = {
+            request: c.req.raw,
+            path: path || "/",
+            params: Object.fromEntries(params.map((name, i) => [name, decodeURIComponent(match[i + 1])])),
+            query: url.searchParams,
+            tenantId,
+            json: async () => {
+                const text = await c.req.text();
+                return (text ? JSON.parse(text) : {});
+            },
+        };
+        try {
+            const result = await withTenant(tenantId, () => route.handler(request));
+            return result instanceof Response ? result : c.json(result ?? null);
+        }
+        catch (err) {
+            return failed(c, id, `public ${route.method} ${path}`, err);
+        }
+    }
+    return notFound(c);
+}
+export const publicPluginRoutes = new Hono()
+    .all(`/:id/${SHARED}`, shared)
+    .all(`/:id/${SHARED}/*`, shared)
+    .all("/:id/:ref", dispatch)
+    .all("/:id/:ref/*", dispatch);

package/apps/runtime/dist/routes/plugins.js

@@ -0,0 +1,212 @@
+import { readFile } from "node:fs/promises";
+import { Hono } from "hono";
+import { streamSSE } from "hono/streaming";
+import { managed } from "../manage.js";
+import { pluginProblems, reloadPlugin, rescanPlugins } from "../plugins/loader.js";
+import { installPro, proState, refreshPro, removePro } from "../plugins/pro.js";
+import { loadedPlugin, onPluginChange, pluginAsset, pluginIdsOf, pluginsOf, } from "../plugins/registry.js";
+import { notFoundAnswer } from "./lang.js";
+const admin = (user) => user.role === "owner" || user.role === "admin";
+/** Plugins change while the app runs only where it runs alone: a reload would hit every tenant. */
+const canReload = (user) => !managed && admin(user);
+function view(plugin) {
+    const script = pluginAsset(plugin, "studio");
+    const styles = pluginAsset(plugin, "styles");
+    const { id, name, version, description } = plugin.source.manifest;
+    const address = (file, rev) => `/api/studio/plugins/-/assets/${id}/${file}?rev=${rev}`;
+    return {
+        id,
+        name,
+        version,
+        description: description ?? "",
+        generation: plugin.generation,
+        /** Installed from the linked account's plan (Settings → Plugins → Pro modules). */
+        pro: Boolean(plugin.source.pro),
+        /** Why the server half did not load; the plugin then adds nothing on the server. */
+        error: plugin.error,
+        script: script ? address("client.js", script.rev) : null,
+        styles: styles ? address("client.css", styles.rev) : null,
+        tools: [...plugin.tools.values()].map((tool) => ({
+            id: `${id}.${tool.name}`,
+            title: tool.title ?? tool.name,
+        })),
+    };
+}
+/** A thrown error that says how to answer: `{ status, code }`, as the runtime's own errors do. */
+export function answerOf(err) {
+    const e = err;
+    return typeof e?.status === "number" &&
+        e.status >= 400 &&
+        e.status < 600 &&
+        typeof e.code === "string"
+        ? { status: e.status, body: { error: String(e.message ?? e.code), code: e.code } }
+        : null;
+}
+/**
+ * Calls the plugin route the request names, as `user`: a signed-in person of the studio, or the
+ * person behind an API key or token (`/api/v1/plugins/…`).
+ */
+export async function dispatchAs(c, user) {
+    const id = c.req.param("id") ?? "";
+    const plugin = (await pluginIdsOf(user.tenantId)).has(id) ? loadedPlugin(id) : undefined;
+    if (!plugin) {
+        return c.json(notFoundAnswer(c), 404);
+    }
+    const url = new URL(c.req.url);
+    const path = url.pathname.slice(url.pathname.indexOf(`/plugins/${id}`) + `/plugins/${id}`.length);
+    for (const { route, pattern, params } of plugin.routes) {
+        const match = route.method === c.req.method ? pattern.exec(path) : null;
+        if (!match) {
+            continue;
+        }
+        if (route.role === "admin" && !admin(user)) {
+            return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
+        }
+        const request = {
+            request: c.req.raw,
+            path: path || "/",
+            params: Object.fromEntries(params.map((name, i) => [name, decodeURIComponent(match[i + 1])])),
+            query: url.searchParams,
+            user: {
+                id: user.id,
+                tenantId: user.tenantId,
+                role: user.role,
+                name: user.name,
+                email: user.email,
+            },
+            json: async () => {
+                const text = await c.req.text();
+                return (text ? JSON.parse(text) : {});
+            },
+        };
+        try {
+            const result = await route.handler(request);
+            return result instanceof Response ? result : c.json(result ?? null);
+        }
+        catch (err) {
+            const answer = answerOf(err);
+            if (answer) {
+                return c.json(answer.body, answer.status);
+            }
+            console.error(`[plugin ${id}] ${route.method} ${path}:`, err);
+            return c.json({ error: "The plugin failed.", code: "plugin_failed" }, 500);
+        }
+    }
+    return c.json(notFoundAnswer(c), 404);
+}
+const dispatch = (c) => dispatchAs(c, c.get("user"));
+const TYPES = {
+    "client.js": { kind: "studio", type: "text/javascript; charset=utf-8" },
+    "client.css": { kind: "styles", type: "text/css; charset=utf-8" },
+};
+export const pluginRoutes = new Hono()
+    .get("/", async (c) => {
+    const user = c.get("user");
+    return c.json({
+        plugins: (await pluginsOf(user.tenantId)).map(view),
+        canReload: canReload(user),
+        /** What looked like a plugin and is none; for the person who installs them. */
+        problems: canReload(user) ? pluginProblems() : [],
+    });
+})
+    // The built studio half. The address carries the file's revision, so it may be kept for good.
+    .get("/-/assets/:id/:file", async (c) => {
+    const user = c.get("user");
+    const file = c.req.param("file");
+    const kind = Object.hasOwn(TYPES, file) ? TYPES[file] : undefined;
+    const id = c.req.param("id");
+    const plugin = (await pluginIdsOf(user.tenantId)).has(id) ? loadedPlugin(id) : undefined;
+    const asset = plugin && kind ? pluginAsset(plugin, kind.kind) : null;
+    if (!asset || !kind) {
+        return c.json(notFoundAnswer(c), 404);
+    }
+    return c.body(new Uint8Array(await readFile(asset.file)), 200, {
+        "content-type": kind.type,
+        "cache-control": c.req.query("rev") === asset.rev ? "private, max-age=31536000, immutable" : "no-cache",
+    });
+})
+    // Says when a plugin loaded again, so an open studio takes the new one without a page load.
+    .get("/-/events", (c) => {
+    if (managed) {
+        return c.json(notFoundAnswer(c), 404);
+    }
+    return streamSSE(c, async (stream) => {
+        let closed = false;
+        const stop = onPluginChange((change) => {
+            void stream.writeSSE({ event: "change", data: JSON.stringify(change) });
+        });
+        stream.onAbort(() => {
+            closed = true;
+            stop();
+        });
+        await stream.writeSSE({ event: "ready", data: "{}" });
+        while (!closed) {
+            await stream.sleep(20_000);
+            if (!closed) {
+                await stream.writeSSE({ event: "ping", data: "{}" });
+            }
+        }
+    });
+})
+    .post("/-/reload", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
+    }
+    await rescanPlugins();
+    return c.json({ plugins: (await pluginsOf(c.get("user").tenantId)).map(view) });
+})
+    .post("/-/reload/:id", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
+    }
+    const plugin = await reloadPlugin(c.req.param("id"));
+    return plugin ? c.json({ plugin: view(plugin) }) : c.json(notFoundAnswer(c), 404);
+})
+    // Pro modules: the closed plugins the linked account's plan includes (plugins/pro.ts).
+    .get("/-/pro", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json(notFoundAnswer(c), 404);
+    }
+    return c.json(await proState());
+})
+    .post("/-/pro/refresh", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
+    }
+    await refreshPro();
+    return c.json(await proState());
+})
+    .post("/-/pro/:id", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
+    }
+    try {
+        await installPro(c.req.param("id"));
+    }
+    catch (err) {
+        const answer = answerOf(err);
+        if (answer) {
+            return c.json(answer.body, answer.status);
+        }
+        throw err;
+    }
+    return c.json(await proState());
+})
+    .delete("/-/pro/:id", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
+    }
+    try {
+        await removePro(c.req.param("id"));
+    }
+    catch (err) {
+        const answer = answerOf(err);
+        if (answer) {
+            return c.json(answer.body, answer.status);
+        }
+        throw err;
+    }
+    return c.json(await proState());
+})
+    .all("/:id", dispatch)
+    .all("/:id/*", dispatch);