@engenty/wizards-runtime 0.0.0-stage → 0.7.6

package/apps/runtime/dist/routes/api.js

@@ -0,0 +1,440 @@
+import { note } from "@engenty-wizards/shared/run";
+import { PACKAGE_MIME } from "@engenty-wizards/shared/wizard-package";
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { z } from "zod";
+import { balanceCredits } from "../credits/credits.js";
+import { withTenant } from "../db/client.js";
+import { env } from "../env.js";
+import { allowed } from "../limits.js";
+import { managed, tenantInfo } from "../manage.js";
+import { authenticate, principalOf } from "../mcp/auth.js";
+import { loadedPlugin, pluginIdsOf } from "../plugins/registry.js";
+import { asRole, mayBuild, mayCreate } from "../services/access.js";
+import { apiRun, apiRuns, apiSpaceDetails, apiSpaces, apiWizards } from "../services/api.js";
+import { ServiceError } from "../services/errors.js";
+import { deleteFile, draftFiles, writeFile } from "../services/files.js";
+import { asLang, searchMarketplace } from "../services/marketplace.js";
+import { exportWizard } from "../services/package.js";
+import { siteJob, siteSchema, startSiteJob } from "../services/site.js";
+import { checkOnServer, checkSchema, listSyncedSpaces, patchSyncedWizard, removeSyncedSpace, removeSyncedWizard, rotateSyncedLink, syncDataSchema, syncSettingsSchema, syncSpaceData, syncWizard, syncWizardSchema, } from "../services/spaces.js";
+import { createWizard, ownedWizard, publishWizard, writeDraft } from "../services/wizards.js";
+import { codeOf, tenantStatus } from "../tenants/control.js";
+import { notFoundAnswer, say } from "./lang.js";
+import { dispatchAs } from "./plugins.js";
+const importSchema = z.object({
+    /** An earlier import's wizard: it is updated instead of a new one being made. */
+    wizardId: z.string().optional(),
+    projectId: z.string().optional(),
+    definition: z.unknown(),
+    files: z
+        .array(z.object({ path: z.string(), mime: z.string().optional(), data: z.string() }))
+        .max(200)
+        .default([]),
+    publish: z.boolean().default(false),
+});
+/** Runs a call in the caller's tenant, as the caller's role. */
+const inTenantAs = (who, fn) => withTenant(who.tenantId, () => asRole(who.role, fn));
+const HOUR = 60 * 60 * 1000;
+/** Where the account of a managed runtime is looked after: plan, credits, keys. */
+const accountUrl = () => env.manage.url || null;
+/** Plugins of the plans above Free that a client offers when the tenant lacks them. */
+const PRO_PLUGINS = ["contacts", "appointments"];
+/** A wizard with its workspace: 25 MB of files as base64, and the definition. */
+const WIZARD_BYTES = 48 * 1024 * 1024;
+const tooLarge = bodyLimit({
+    maxSize: WIZARD_BYTES,
+    onError: (c) => c.json({ error: "The request is too large.", code: "too_large" }, 413),
+});
+/**
+ * The caller of an API call, signed in like an MCP client (access token or API key), with the
+ * scopes the call needs; or the answer that turns it away.
+ */
+async function caller(c, scopes) {
+    const authInfo = await authenticate(c.req.raw);
+    if (authInfo instanceof Response) {
+        return authInfo;
+    }
+    const who = principalOf(authInfo);
+    if (scopes.some((scope) => !who.scopes.includes(scope))) {
+        return c.json({ error: "This token isn’t allowed to do that.", code: "insufficient_scope" }, 403);
+    }
+    if ((await tenantStatus(who.tenantId)) === "suspended") {
+        return c.json({
+            error: say(c, "accountSuspended"),
+            code: "tenant_suspended",
+        }, 403);
+    }
+    return who;
+}
+/** A local install sends when it publishes: more than this an hour is not an install at work. */
+function withinSyncLimit(c, who) {
+    return allowed(`sync:${who.tenantId}`, 240, HOUR)
+        ? null
+        : c.json({
+            error: say(c, "tooManyTransfersTry"),
+            code: "rate_limited",
+        }, 429);
+}
+/**
+ * A plugin's routes for a client with a key or token (the WordPress plugin's Kontakte, Termine):
+ * the plugin's own `registerHttpRoute`s, as the key's person. Reading needs `wizards:read`,
+ * anything else `wizards:write`. A plugin the tenant's plan lacks answers `403 { code: "plugin" }`.
+ */
+async function pluginCall(c) {
+    const who = await caller(c, [c.req.method === "GET" ? "wizards:read" : "wizards:write"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const id = c.req.param("id") ?? "";
+    if (!(await pluginIdsOf(who.tenantId)).has(id)) {
+        return loadedPlugin(id) || PRO_PLUGINS.includes(id)
+            ? c.json({
+                error: say(c, "pluginNotPartPlan"),
+                code: "plugin",
+                plugin: id,
+            }, 403)
+            : c.json(notFoundAnswer(c), 404);
+    }
+    return inTenantAs(who, () => dispatchAs(c, {
+        id: who.userId,
+        tenantId: who.tenantId,
+        role: who.role,
+        name: who.name ?? "",
+        email: who.email ?? "",
+    }));
+}
+const runsQuery = z.object({
+    space: z.string().optional(),
+    wizard: z.string().optional(),
+    status: z.enum(["done", "open", "all"]).optional(),
+    q: z.string().max(200).optional(),
+    days: z.coerce.number().int().min(1).max(3650).optional(),
+    page: z.coerce.number().int().min(1).max(10_000).optional(),
+});
+/**
+ * The runtime's API for other programs. `/spaces/…` is how a local install's project comes
+ * here: the wizards it publishes, under the ids they have there (docs/manage-contract.md).
+ * `POST /wizards/import` takes a whole wizard as a new one of a tenant that builds here.
+ */
+export const apiRoutes = new Hono()
+    // Who the key or token acts for, and what the account has: plan, plugins, spaces, credits.
+    .get("/me", async (c) => {
+    const who = await caller(c, []);
+    if (who instanceof Response) {
+        return who;
+    }
+    const info = managed ? await tenantInfo(who.tenantId).catch(() => null) : null;
+    return inTenantAs(who, async () => {
+        const plugins = [...(await pluginIdsOf(who.tenantId))].sort();
+        const account = accountUrl();
+        return c.json({
+            user: { id: who.userId, name: who.name ?? "", email: who.email ?? "", role: who.role },
+            tenant: {
+                id: who.tenantId,
+                name: info?.name ?? "",
+                plan: info?.plan ?? null,
+                credits: await balanceCredits(),
+            },
+            /** Makes and changes wizards and spaces here; Free builds in the local app. */
+            build: await mayBuild(),
+            create: await mayCreate(),
+            plugins,
+            /** What a plan above this one would add. */
+            missing: PRO_PLUGINS.filter((id) => !plugins.includes(id)),
+            spaces: await apiSpaces(who.userId),
+            scopes: who.scopes,
+            client: who.client,
+            urls: {
+                app: env.appUrl,
+                embed: `${env.publicUrl}/embed.js`,
+                studio: `${env.appUrl}/studio`,
+                newWizard: `${env.appUrl}/studio/new`,
+                space: `${env.appUrl}/studio/space`,
+                account: account,
+                billing: account ? `${account}/billing` : null,
+                upgrade: account ? `${account}/billing?upgrade=pro` : null,
+            },
+        });
+    });
+})
+    // The wizards of the caller's spaces: published ones with their link and ID, drafts without.
+    .get("/wizards", async (c) => {
+    const who = await caller(c, ["wizards:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return inTenantAs(who, async () => c.json({ wizards: await apiWizards(who.userId, c.req.query("space")) }));
+})
+    // The published wizard as a `.wizard` package: what a WordPress site runs on its own; with
+    // `knowledge=1` the project's pages come along as files (up to the snapshot's cap).
+    .get("/wizards/:id/package", async (c) => {
+    const who = await caller(c, ["wizards:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return inTenantAs(who, async () => {
+        const found = await exportWizard(who.userId, c.req.param("id"), {
+            published: true,
+            knowledge: c.req.query("knowledge") === "1",
+        });
+        if (!found) {
+            return c.json({
+                error: say(c, "wizardNotPublishedYet"),
+                code: "not_found",
+            }, 404);
+        }
+        return new Response(new Uint8Array(found.zip), {
+            headers: {
+                "content-type": PACKAGE_MIME,
+                "content-disposition": `attachment; filename="${found.name}"`,
+                "cache-control": "no-store",
+            },
+        });
+    });
+})
+    // A new wizard from a template, published at once: what a website starts with.
+    .post("/wizards", async (c) => {
+    const who = await caller(c, ["wizards:write", "wizards:publish"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const body = z
+        .object({
+        starterId: z.string().min(1).max(200),
+        spaceId: z.string().optional(),
+        lang: z.string().max(10).optional(),
+        publish: z.boolean().default(true),
+    })
+        .parse(await c.req.json());
+    return inTenantAs(who, async () => {
+        const writer = { source: "mcp", client: who.client };
+        const created = await createWizard(who.userId, { projectId: body.spaceId, starterId: body.starterId, lang: body.lang }, writer);
+        let published = false;
+        if (body.publish && !created.issues.length) {
+            published = await publishWizard(who.userId, created.id).then(() => true, () => false);
+        }
+        const wizard = (await apiWizards(who.userId)).find((w) => w.id === created.id);
+        return c.json({ wizard, published, issues: created.issues });
+    });
+})
+    // What a new wizard can start from: the plugins' starters first, then the marketplace's.
+    .get("/templates", async (c) => {
+    const who = await caller(c, ["wizards:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const q = c.req.query("q")?.trim() ?? "";
+    return inTenantAs(who, async () => {
+        const { entries } = await searchMarketplace({
+            q,
+            lang: asLang(c.req.query("lang")),
+            limit: 40,
+        });
+        return c.json({
+            templates: entries
+                .filter((e) => e.usable && (q || e.starter))
+                .map((e) => ({
+                id: e.id,
+                title: e.title,
+                pitch: e.pitch,
+                avatar: e.avatar,
+                language: e.language,
+                useCases: e.useCases,
+                formats: e.formats,
+                plan: e.plan ?? "free",
+                plugin: e.plugin ?? null,
+                /** Plugins the tenant lacks: a wizard made from it would not run. */
+                needs: e.needs ?? [],
+                credits: e.credits,
+            })),
+        });
+    });
+})
+    // What visitors left: the live runs of the caller's wizards, by pages of 50.
+    .get("/runs", async (c) => {
+    const who = await caller(c, ["runs:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const query = runsQuery.parse(c.req.query());
+    return inTenantAs(who, async () => c.json(await apiRuns(who.userId, {
+        spaceId: query.space,
+        wizardId: query.wizard,
+        status: query.status,
+        q: query.q,
+        days: query.days,
+        page: query.page,
+    })));
+})
+    .get("/runs/:id", async (c) => {
+    const who = await caller(c, ["runs:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return inTenantAs(who, async () => c.json(await apiRun(who.userId, c.req.param("id"))));
+})
+    // The space's own details: title, about, colours, facts, logo, how much Knowledge it holds.
+    .get("/space", async (c) => {
+    const who = await caller(c, ["wizards:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return inTenantAs(who, async () => c.json(await apiSpaceDetails(who.userId, c.req.query("space"))));
+})
+    // A website reads itself into the space (services/site.ts); answers with the job to ask after.
+    .post("/space/site", tooLarge, async (c) => {
+    const who = await caller(c, ["wizards:write"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    if (!allowed(`site:${who.tenantId}`, 20, HOUR)) {
+        return c.json({
+            error: say(c, "tooManyTimesRow"),
+            code: "rate_limited",
+        }, 429);
+    }
+    const body = siteSchema.parse(await c.req.json());
+    return inTenantAs(who, async () => c.json(await startSiteJob(who, body)));
+})
+    .get("/space/site/:job", async (c) => {
+    const who = await caller(c, ["wizards:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return inTenantAs(who, () => c.json(siteJob(c.req.param("job"))));
+})
+    .all("/plugins/:id", pluginCall)
+    .all("/plugins/:id/*", pluginCall)
+    .get("/spaces", async (c) => {
+    const who = await caller(c, ["wizards:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return inTenantAs(who, async () => c.json({ spaces: await listSyncedSpaces() }));
+})
+    .post("/spaces/check", async (c) => {
+    const who = await caller(c, ["wizards:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const body = checkSchema.parse(await c.req.json());
+    return inTenantAs(who, async () => c.json({ problems: await checkOnServer(body) }));
+})
+    .put("/spaces/:spaceId/wizards/:wizardId", tooLarge, async (c) => {
+    const who = await caller(c, ["wizards:write", "wizards:publish"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const limited = withinSyncLimit(c, who);
+    if (limited) {
+        return limited;
+    }
+    const body = syncWizardSchema.parse(await c.req.json());
+    return inTenantAs(who, async () => c.json(await syncWizard(c.req.param("spaceId"), c.req.param("wizardId"), body)));
+})
+    // The space's own tables and pages, sent with a wizard when they changed.
+    .put("/spaces/:spaceId/data", tooLarge, async (c) => {
+    const who = await caller(c, ["wizards:write"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const limited = withinSyncLimit(c, who);
+    if (limited) {
+        return limited;
+    }
+    const body = syncDataSchema.parse(await c.req.json());
+    return inTenantAs(who, async () => c.json(await syncSpaceData(c.req.param("spaceId"), body)));
+})
+    .patch("/spaces/:spaceId/wizards/:wizardId", async (c) => {
+    const who = await caller(c, ["wizards:publish"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const limited = withinSyncLimit(c, who);
+    if (limited) {
+        return limited;
+    }
+    const body = syncSettingsSchema.parse(await c.req.json());
+    return inTenantAs(who, async () => c.json(await patchSyncedWizard(c.req.param("spaceId"), c.req.param("wizardId"), body)));
+})
+    .post("/spaces/:spaceId/wizards/:wizardId/rotate-link", async (c) => {
+    const who = await caller(c, ["wizards:publish"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const limited = withinSyncLimit(c, who);
+    if (limited) {
+        return limited;
+    }
+    return inTenantAs(who, async () => c.json(await rotateSyncedLink(who.userId, c.req.param("spaceId"), c.req.param("wizardId"))));
+})
+    .delete("/spaces/:spaceId/wizards/:wizardId", async (c) => {
+    const who = await caller(c, ["wizards:write"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return inTenantAs(who, async () => c.json(await removeSyncedWizard(who.userId, c.req.param("spaceId"), c.req.param("wizardId"))));
+})
+    .delete("/spaces/:spaceId", async (c) => {
+    const who = await caller(c, ["wizards:write"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return inTenantAs(who, async () => c.json(await removeSyncedSpace(c.req.param("spaceId"))));
+})
+    .post("/wizards/import", tooLarge, async (c) => {
+    const authInfo = await authenticate(c.req.raw);
+    if (authInfo instanceof Response) {
+        return authInfo;
+    }
+    const who = principalOf(authInfo);
+    const body = importSchema.parse(await c.req.json());
+    if (!who.scopes.includes("wizards:write") ||
+        (body.publish && !who.scopes.includes("wizards:publish"))) {
+        return c.json({ error: "This token isn’t allowed to do that.", code: "insufficient_scope" }, 403);
+    }
+    if ((await tenantStatus(who.tenantId)) === "suspended") {
+        return c.json({
+            error: say(c, "accountSuspended"),
+            code: "tenant_suspended",
+        }, 403);
+    }
+    return inTenantAs(who, async () => {
+        const writer = { source: "mcp", client: who.client };
+        let wizardId = body.wizardId;
+        if (wizardId) {
+            const existing = await ownedWizard(who.userId, wizardId).catch(() => null);
+            wizardId = existing?.id;
+        }
+        if (!wizardId) {
+            // The workspace must be there before the definition is checked against it.
+            const created = await createWizard(who.userId, { projectId: body.projectId }, writer);
+            wizardId = created.id;
+        }
+        const incoming = new Set(body.files.map((f) => f.path));
+        for (const old of await draftFiles(wizardId)) {
+            if (!incoming.has(old.path)) {
+                await deleteFile(who.userId, wizardId, old.path);
+            }
+        }
+        for (const file of body.files) {
+            await writeFile(who.userId, wizardId, file.path, Buffer.from(file.data, "base64"), file.mime);
+        }
+        const current = await ownedWizard(who.userId, wizardId);
+        const written = await writeDraft(who.userId, wizardId, { definition: body.definition, baseRevision: current.revision }, writer);
+        if (!body.publish) {
+            return c.json({ wizardId, revision: written.revision, issues: written.issues });
+        }
+        if (written.issues.length) {
+            throw new ServiceError("has_issues", note("wizardStillErrors"), {
+                issues: written.issues,
+                wizardId,
+            });
+        }
+        const published = await publishWizard(who.userId, wizardId);
+        // The ID the mobile app takes.
+        const code = await codeOf(current.shareToken);
+        return c.json({ wizardId, revision: written.revision, issues: [], ...published, code });
+    });
+});

package/apps/runtime/dist/routes/debug.js

@@ -0,0 +1,42 @@
+import { Hono } from "hono";
+import { z } from "zod";
+import { LOCAL_MCP_HEADER, localTicketExpiry } from "../auth/local-ticket.js";
+import { logs, ReportError, sendReport, status } from "../debug.js";
+import { env } from "../env.js";
+import { tailQuery } from "../log.js";
+import { managed } from "../manage.js";
+/**
+ * A runtime that runs alone answers its own command line here (`wizards logs`, `wizards
+ * report`): each request signed with the data folder's secret, as `wizards mcp` signs its own.
+ * Nothing of this is reached from another machine; the account hears from an install only when
+ * the person sends a report.
+ */
+export const localDebugRoutes = new Hono()
+    .use(async (c, next) => {
+    const ticket = c.req.header(LOCAL_MCP_HEADER) ?? "";
+    if (managed || !localTicketExpiry(env.authSecret, ticket, Date.now(), "local-debug")) {
+        return c.json({ error: "This ticket isn’t valid.", code: "unauthorized" }, 401);
+    }
+    await next();
+})
+    .get("/status", async (c) => c.json(await status()))
+    .get("/logs", (c) => c.json(logs(tailQuery((key) => c.req.query(key)))))
+    .post("/report", async (c) => {
+    try {
+        return c.json(await sendReport());
+    }
+    catch (err) {
+        if (err instanceof ReportError) {
+            return c.json({ error: err.message, code: err.code }, err.code === "no_account" ? 409 : 502);
+        }
+        throw err;
+    }
+});
+/** What a page reports about itself: an error it met, with where it stood. */
+export const browserReport = z.object({
+    level: z.enum(["error", "warn"]).default("error"),
+    message: z.string().min(1).max(2000),
+    stack: z.string().max(4000).optional(),
+    url: z.string().max(500).optional(),
+    agent: z.string().max(300).optional(),
+});

package/apps/runtime/dist/routes/delivery.js

@@ -0,0 +1,90 @@
+import { basePath } from "../env.js";
+/** Uploads stay small; a clip from the phone's camera is the one thing that needs more room. */
+export function uploadLimit(mime) {
+    return mime.startsWith("video/") ? 40_000_000 : 15_000_000;
+}
+/** `type/subtype` and nothing else: no commas, spaces or quotes a browser could read another type from. */
+const MIME = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/;
+/** The bare type of a declared one ("audio/webm;codecs=opus" → "audio/webm"), or null if it is not one. */
+export function bareMime(declared) {
+    const mime = declared.split(";")[0].trim().toLowerCase();
+    return MIME.test(mime) ? mime : null;
+}
+/** What a person hands a wizard besides photos, recordings and clips: documents and tables. */
+const DOCUMENT_TYPES = new Set([
+    "application/pdf",
+    "application/msword",
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    "application/vnd.ms-excel",
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    "application/vnd.ms-powerpoint",
+    "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+    "application/vnd.oasis.opendocument.text",
+    "application/vnd.oasis.opendocument.spreadsheet",
+    "application/vnd.oasis.opendocument.presentation",
+    "application/rtf",
+    "application/json",
+    "application/zip",
+    "message/rfc822",
+    "text/plain",
+    "text/csv",
+    "text/tab-separated-values",
+    "text/markdown",
+    "text/calendar",
+    "text/vcard",
+]);
+/**
+ * The type an upload is kept as: the browser's word for it, when it is a picture, a recording, a
+ * clip or a document. Anything else (an HTML page, a script) is kept as plain bytes; reading it
+ * goes by its name (documents/parse.ts).
+ */
+export function uploadMime(declared) {
+    const mime = bareMime(declared);
+    return mime && (/^(image|audio|video)\//.test(mime) || DOCUMENT_TYPES.has(mime))
+        ? mime
+        : "application/octet-stream";
+}
+/** What a browser shows in place without running anything of the file's: photos, sound, film, PDFs. */
+export function inlineSafe(mime) {
+    return ((/^(image|audio|video)\//.test(mime) && !mime.startsWith("image/svg")) ||
+        mime === "application/pdf");
+}
+/** `version`: the published one, so a new engenty or name reaches icons a phone has kept. */
+export function wizardManifest(token, title, description, version = 0) {
+    const start = `${basePath}/w/${token}`;
+    const icon = (file) => `${basePath}/api/public/wizards/${token}/icons/${file}?v=${version}`;
+    return {
+        id: start,
+        name: title,
+        short_name: title.length > 14 ? `${title.slice(0, 13).trimEnd()}…` : title,
+        description,
+        start_url: start,
+        scope: `${basePath}/`,
+        display: "standalone",
+        background_color: "#faf8f5",
+        theme_color: "#faf8f5",
+        icons: [
+            { src: icon("icon-192.png"), sizes: "192x192", type: "image/png", purpose: "any" },
+            { src: icon("icon-512.png"), sizes: "512x512", type: "image/png", purpose: "any" },
+            {
+                src: icon("icon-maskable-512.png"),
+                sizes: "512x512",
+                type: "image/png",
+                purpose: "maskable",
+            },
+        ],
+    };
+}
+/**
+ * One byte range of a file, as phones ask for audio and video: Safari plays a clip only from a
+ * server that answers ranges. `null` = no (usable) range asked, send it whole.
+ */
+export function byteRange(header, size) {
+    const m = header?.match(/^bytes=(\d*)-(\d*)$/);
+    if (!m || (!m[1] && !m[2]) || size === 0) {
+        return null;
+    }
+    const start = m[1] ? Number(m[1]) : Math.max(0, size - Number(m[2]));
+    const end = m[1] && m[2] ? Math.min(Number(m[2]), size - 1) : size - 1;
+    return start > end || start >= size ? "unsatisfiable" : { start, end };
+}

package/apps/runtime/dist/routes/internal.js

@@ -0,0 +1,81 @@
+import { timingSafeEqual } from "node:crypto";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+import { Hono } from "hono";
+import { z } from "zod";
+import { closeTenantDb, tenantDb } from "../db/client.js";
+import { logs, runDetail, status, tenantModels } from "../debug.js";
+import { env } from "../env.js";
+import { declaredFeatures } from "../features.js";
+import { removeTenantObjects } from "../files/objects.js";
+import { tailQuery } from "../log.js";
+import { forgetTenant, managed } from "../manage.js";
+import { loadedPlugins } from "../plugins/registry.js";
+import { forgetTenantRows, setTenantStatus } from "../tenants/control.js";
+function fromManage(header) {
+    const given = Buffer.from(header?.replace(/^Bearer\s+/i, "") ?? "");
+    const expected = Buffer.from(env.manage.serviceKey);
+    return (managed &&
+        expected.length > 0 &&
+        given.length === expected.length &&
+        timingSafeEqual(given, expected));
+}
+/**
+ * What the Manage-App tells this runtime about a tenant: suspend, resume, delete. Deleting
+ * removes the tenant's files and everything the control database knows; the tenant's database
+ * itself is deleted by whoever created it (the Manage-App, or here when it is a file).
+ */
+export const internalRoutes = new Hono()
+    .use(async (c, next) => {
+    if (!fromManage(c.req.header("authorization"))) {
+        return c.json({ error: "unauthorized" }, 401);
+    }
+    await next();
+})
+    // --- a look from afar (docs/plans/remote-debug.md): read-only, never a key -------------
+    .get("/debug/status", async (c) => c.json(await status()))
+    .get("/debug/logs", (c) => c.json(logs(tailQuery((key) => c.req.query(key)))))
+    .get("/debug/runs/:id", async (c) => {
+    const found = await runDetail(c.req.param("id"));
+    return found ? c.json(found) : c.json({ error: "not found" }, 404);
+})
+    .get("/debug/tenants/:id/models", async (c) => {
+    const found = await tenantModels(c.req.param("id"));
+    return found ? c.json(found) : c.json({ error: "not found" }, 404);
+})
+    // The plugins this runtime carries: the Manage-App offers them when a plan's modules are picked.
+    .get("/plugins", (c) => {
+    return c.json({
+        plugins: loadedPlugins().map((p) => ({
+            id: p.source.id,
+            name: p.source.manifest.name ?? p.source.id,
+            description: p.source.manifest.description ?? "",
+            version: p.source.manifest.version ?? null,
+        })),
+        /** Every feature switch this runtime knows: the core's and its plugins' (under their ids). */
+        features: declaredFeatures(),
+    });
+})
+    .post("/tenants/:id", async (c) => {
+    const id = c.req.param("id");
+    if (!/^[A-Za-z0-9_-]{1,64}$/.test(id)) {
+        return c.json({ error: "bad tenant id" }, 400);
+    }
+    const { action } = z
+        .object({ action: z.enum(["suspend", "resume", "delete"]) })
+        .parse(await c.req.json());
+    forgetTenant(id);
+    if (action === "delete") {
+        closeTenantDb(id);
+        await removeTenantObjects(id);
+        await forgetTenantRows(id);
+        for (const suffix of ["", "-wal", "-shm"]) {
+            await rm(join(env.dataDir, "tenants", `${id}.db${suffix}`), { force: true });
+        }
+        return c.json({ ok: true });
+    }
+    // The tenant row exists once its database was opened here.
+    await tenantDb(id);
+    await setTenantStatus(id, action === "suspend" ? "suspended" : "active");
+    return c.json({ ok: true });
+});

package/apps/runtime/dist/routes/lang.js

@@ -0,0 +1,25 @@
+import { localLang } from "@engenty-wizards/shared/definition";
+import { serverText } from "../texts.js";
+/**
+ * The language a visitor's request asks for, as the studio starts in it (`localLang`): the
+ * first of the browser's languages engenty speaks other than English, else English. The
+ * browser's `Accept-Language` names them in its order; the server has no time zone to go by.
+ */
+export function requestLang(c) {
+    const asked = (c.req.header("accept-language") ?? "")
+        .split(",")
+        .map((part) => part.split(";")[0]?.trim() ?? "")
+        .filter(Boolean);
+    return localLang(asked) ?? "en";
+}
+/** A line of the server's table the person reads, in the language their request asks for. */
+export function say(c, key, params) {
+    return serverText(requestLang(c), key, params);
+}
+/** A 404 the person may read: a sentence in their language, the machine code beside it. */
+export function notFoundAnswer(c) {
+    return {
+        error: say(c, "notFound"),
+        code: "not_found",
+    };
+}