@formio/uag 1.13.2 → 2.0.0-rc.10

package/lib/index.d.ts

@@ -1,17 +1,114 @@
 import { Server, ServerModule } from '@formio/appserver';
+import type { LoadedModule, ModuleApi, ModuleRoute, ModuleRouteHandlers, ProjectInterface } from '@formio/appserver';
+import { Request, Response, Router } from 'express';
 import { UAGProjectInterface } from './UAGProjectInterface';
 import { UAGFormInterface } from './UAGFormInterface';
 import { UAGConfig } from './config';
-export type UAGModule = ServerModule & {
+import { UAGDatabase } from './database';
+import type { UAGModuleApi } from './modules';
+export type UAGModule = ServerModule<UAGModuleApi> & {
     config?: UAGConfig;
 };
+/**
+ * Agentic Formflow keeps its license state inside @formio/appserver-core, and
+ * modules are built on its module framework. The UAG loads it only through
+ * @formio/appserver, so the two always share one copy, which must be 2.26.4 or
+ * later. An older @formio/appserver, or an old lockfile, can still resolve an
+ * older one, which would fail in confusing ways; say what to do instead.
+ */
+export declare function assertSingleCore(version?: string): void;
+/**
+ * isolated-vm, which runs form logic, needs Node's startup snapshot off. Without
+ * it nothing fails at once: the process can crash later, in native code. So an
+ * embedding server that forgot the flag is stopped here, saying what to do.
+ */
+export declare function assertNodeSnapshotDisabled(execArgv?: string[], nodeOptions?: string): void;
 export declare class UAGServer extends Server {
+    config: UAGConfig;
+    /** The UAG's own database, once it may be used. */
+    database?: UAGDatabase;
+    /** The database between connecting and the license check. */
+    private pendingDatabase?;
+    /**
+     * Use a module, or a list of modules (each in turn). A module used twice (by
+     * its `name`) is used once. `config.tools` adds up across modules; an MCP
+     * tool or engine type that two modules define stops startup, naming both.
+     * A route's `rateLimit` is the default for its name, unless the operator set one.
+     */
+    use(module: any, source?: string): void;
+    /** MCP tools and engine types, which only one module may define. */
+    protected moduleClaims(definition: Record<string, any>): string[];
+    /**
+     * MCP tools add up across modules (lodash would merge them index by index),
+     * and a named module's tools get its API as `extra.module`. Its routes'
+     * `rateLimit`s become the defaults for their names.
+     */
+    protected mergeModuleConfig(config: any, module?: LoadedModule): void;
+    /** Route rate-limit defaults, for the names the operator left unset. */
+    private routeRateLimits;
     constructor(config?: UAGConfig);
+    /**
+     * Connect the UAG's own database before the project loads, and check it
+     * without writing: a database the UAG may not use stops startup. It is used
+     * (its collections created, its stores handed out) only once the license is
+     * known; see enableDatabase. Until then nothing writes to it.
+     */
+    protected connectDatabase(): Promise<void>;
+    /**
+     * Use the database once the project and its license are loaded: with a
+     * license that includes the UAG (or the project and the database both on
+     * development hosts), create its collections and hand out its stores;
+     * otherwise leave it untouched, close it, and say why.
+     */
+    protected enableDatabase(project: UAGProjectInterface): Promise<void>;
+    /**
+     * An Agent API request that failed before its handlers (a body that is not JSON,
+     * one over the size limit) is answered in the Agent API's error shape; every other
+     * route keeps Form.io's plain-text answer.
+     */
+    protected sendError(req: Request, res: Response, status: number, message: string, err?: any): void;
+    /** Whether a request is for a module's form route: its method, and a path ending in the route's. */
+    private isModuleRouteRequest;
+    /** Browsers reading Agent API responses need the request id too. */
+    get exposedHeaders(): string[];
+    /** The loaded UAG project, once the project router has been built. */
+    get uagProject(): UAGProjectInterface | undefined;
+    /**
+     * Mount `/agent/capabilities` ahead of the project routes. The project routes,
+     * and the admin passthrough after them, would otherwise answer for it and
+     * forward admin requests to the Form.io server. A form's agent operations are
+     * on the form's own routes.
+     */
+    protected extendRouter(router: Router): Promise<void>;
+    /**
+     * List the UAG's engines and MCP tools in the plugin registry, beside
+     * appserver-core's form actions. They keep loading their own way.
+     */
+    protected listPlugins(): Promise<void>;
+    /** A form's own route segments, which module routes may not use: appserver's, and the agent operations. */
+    protected get reservedFormPaths(): string[];
+    /** Module routes may not take the names of the UAG's own rate-limited operations. */
+    protected get reservedRouteNames(): string[];
+    protected get hostName(): string;
+    protected get hostVersion(): string;
+    /** The module API: appserver's, with the UAG's license check, engines, converters and helpers. */
+    protected createModuleApi(module: LoadedModule): ModuleApi;
+    /** Module routes run behind what the agent operations run behind: the caller check, body limit, request id, rate limits and error shape. */
+    protected moduleRouteHandlers(project: ProjectInterface, route: ModuleRoute<any>, module: LoadedModule): ModuleRouteHandlers;
+    protected moduleErrorBody(req: Request, err: unknown): Record<string, any> & {
+        status: number;
+    };
     router(): Promise<any>;
 }
 export * from '@formio/appserver';
 export * from './config';
+export * from './agent';
 export * from './tools';
+export * from './documents';
+export * from './modules';
+export { sanitizeMarkdown } from './markdown';
+export { usePluginFiles, pluginFiles, pluginFilesIn, DEFAULT_PLUGINS_DIR } from './pluginFiles';
 export * from './router';
 export * from './template';
+export { sanitizeRichText, isRichText, RICH_TEXT_TAGS, RICH_TEXT_RULE } from './richText';
 export { UAGProjectInterface, UAGFormInterface };

package/lib/index.js

@@ -13,35 +13,372 @@ var __createBinding = (this && this.__createBinding) || (Object.create ? (functi
 var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UAGFormInterface = exports.UAGProjectInterface = exports.UAGServer = void 0;
+exports.UAGFormInterface = exports.UAGProjectInterface = exports.RICH_TEXT_RULE = exports.RICH_TEXT_TAGS = exports.isRichText = exports.sanitizeRichText = exports.DEFAULT_PLUGINS_DIR = exports.pluginFilesIn = exports.pluginFiles = exports.usePluginFiles = exports.sanitizeMarkdown = exports.UAGServer = void 0;
+exports.assertSingleCore = assertSingleCore;
+exports.assertNodeSnapshotDisabled = assertNodeSnapshotDisabled;
 const appserver_1 = require("@formio/appserver");
+const formflow_1 = require("./formflow");
+const path_1 = __importDefault(require("path"));
 const UAGProjectInterface_1 = require("./UAGProjectInterface");
 Object.defineProperty(exports, "UAGProjectInterface", { enumerable: true, get: function () { return UAGProjectInterface_1.UAGProjectInterface; } });
 const UAGFormInterface_1 = require("./UAGFormInterface");
 Object.defineProperty(exports, "UAGFormInterface", { enumerable: true, get: function () { return UAGFormInterface_1.UAGFormInterface; } });
 const lodash_1 = require("lodash");
+const engines_1 = require("./agent/engines");
+const router_1 = require("./agent/router");
+const errors_1 = require("./agent/errors");
+const database_1 = require("./database");
+const runs_1 = require("./runs");
+const actionLogs_1 = require("./actionLogs");
+const runner_1 = require("./runner");
+const runTask_1 = require("./actions/runTask");
+const version_1 = require("./version");
+const utils_1 = require("./tools/utils");
+const plugins_1 = require("./plugins");
+const plugins_2 = require("./documents/plugins");
+const uagJs_1 = require("./documents/uagJs");
+const modules_1 = require("./modules");
+const tools_1 = require("./agent/tools");
+/** Projects whose engines were loaded while the plugins were listed. */
+const enginesLoaded = new WeakSet();
+const debug = require('debug')('formio:uag');
+/**
+ * Agentic Formflow keeps its license state inside @formio/appserver-core, and
+ * modules are built on its module framework. The UAG loads it only through
+ * @formio/appserver, so the two always share one copy, which must be 2.26.4 or
+ * later. An older @formio/appserver, or an old lockfile, can still resolve an
+ * older one, which would fail in confusing ways; say what to do instead.
+ */
+function assertSingleCore(version = appserverCoreVersion()) {
+    const [major, minor, patch] = version.split('.').map((part) => parseInt(part, 10) || 0);
+    if (major < 2 || (major === 2 && (minor < 26 || (minor === 26 && patch < 4)))) {
+        throw new Error(`@formio/uag needs @formio/appserver-core 2.26.4 or later, through @formio/appserver; ${version} is installed. Upgrade @formio/appserver.`);
+    }
+}
+/** The version of the @formio/appserver-core that @formio/appserver loads. */
+function appserverCoreVersion() {
+    const appserver = path_1.default.dirname(require.resolve('@formio/appserver/package.json'));
+    return String(require(require.resolve('@formio/appserver-core/package.json', { paths: [appserver] })).version || '0.0.0');
+}
+/**
+ * isolated-vm, which runs form logic, needs Node's startup snapshot off. Without
+ * it nothing fails at once: the process can crash later, in native code. So an
+ * embedding server that forgot the flag is stopped here, saying what to do.
+ */
+function assertNodeSnapshotDisabled(execArgv = process.execArgv, nodeOptions = process.env.NODE_OPTIONS || '') {
+    if (execArgv.includes('--no-node-snapshot') || /(^|\s)--no-node-snapshot(\s|$)/.test(nodeOptions))
+        return;
+    throw new Error('@formio/uag needs Node started with --no-node-snapshot: isolated-vm, which runs form logic, can crash the process without it. ' +
+        'Start node with --no-node-snapshot, or set NODE_OPTIONS=--no-node-snapshot. The uag command and the formio/uag image do this for you.');
+}
+/** A host name a browser cannot reach: a container or service name, with no dot. */
+function internalHost(url) {
+    try {
+        const { hostname } = new URL(url);
+        return !!hostname && hostname !== 'localhost' && !hostname.includes('.') && !hostname.includes(':');
+    }
+    catch {
+        return false;
+    }
+}
+/** Warnings for settings that start fine and fail later, in ways far from their cause. */
+function warnAboutSettings(config, secretGiven) {
+    if (!secretGiven) {
+        console.warn('[formio-uag] JWT_SECRET is not set, so the UAG signs its tokens with a random secret that lasts only as long as this process: ' +
+            'every token stops working when it restarts, and other instances refuse it. Set JWT_SECRET, the same on every instance.');
+    }
+    const auth = config.auth || {};
+    if (auth.mcpOAuth && !auth.loginForm && internalHost(String(config.project || ''))) {
+        console.warn(`[formio-uag] MCP_OAUTH is on, but LOGIN_FORM is not set: the sign-in page loads ${String(config.project).replace(/\/+$/, '')}/user/login, ` +
+            'an address a person\'s browser cannot reach. Set LOGIN_FORM to the login form\'s public URL.');
+    }
+}
+/** The UAG's own database from the environment, when `MONGO` is set. */
+function databaseFromEnv(env = process.env) {
+    const url = (0, lodash_1.get)(env, 'MONGO', '').toString();
+    if (!url)
+        return undefined;
+    const retention = (0, lodash_1.get)(env, 'TASK_RUN_RETENTION_DAYS', '').toString();
+    return {
+        url,
+        name: (0, lodash_1.get)(env, 'UAG_DATABASE', '').toString() || 'uag',
+        config: (0, lodash_1.get)(env, 'MONGO_CONFIG', '').toString() || undefined,
+        ...(retention && { retentionDays: parseInt(retention, 10) })
+    };
+}
 class UAGServer extends appserver_1.Server {
+    /**
+     * Use a module, or a list of modules (each in turn). A module used twice (by
+     * its `name`) is used once. `config.tools` adds up across modules; an MCP
+     * tool or engine type that two modules define stops startup, naming both.
+     * A route's `rateLimit` is the default for its name, unless the operator set one.
+     */
+    use(module, source) {
+        module = appserver_1.Server.defaultExport(module);
+        if (module && typeof module === 'object' && !Array.isArray(module) && module.uag !== undefined) {
+            const label = source || (typeof module.name === 'string' && module.name) || 'a module';
+            throw new Error(`The module ${label} has a "uag" key, which UAG modules no longer use: move its keys (name, apiVersion, settings, routes, components, initialize) onto the module itself.`);
+        }
+        super.use(module, source);
+        if (typeof module?.name === 'string' && this.modules.get(module.name)?.definition === module)
+            this.routeRateLimits(module);
+    }
+    /** MCP tools and engine types, which only one module may define. */
+    moduleClaims(definition) {
+        return [
+            ...(definition.config?.tools || []).filter((tool) => tool?.name).map((tool) => `MCP tool "${tool.name}"`),
+            ...Object.keys(definition.config?.engineTypes || {}).map((name) => `engine type "${name}"`)
+        ];
+    }
+    /**
+     * MCP tools add up across modules (lodash would merge them index by index),
+     * and a named module's tools get its API as `extra.module`. Its routes'
+     * `rateLimit`s become the defaults for their names.
+     */
+    mergeModuleConfig(config, module) {
+        const { tools, ...rest } = config;
+        super.mergeModuleConfig(rest, module);
+        if (Array.isArray(tools) && tools.length) {
+            if (module)
+                for (const tool of tools)
+                    (0, tools_1.setToolModule)(tool, this.modules.apiFor(module));
+            this.config.tools = [...(this.config.tools || []), ...tools];
+        }
+    }
+    /** Route rate-limit defaults, for the names the operator left unset. */
+    routeRateLimits(module) {
+        for (const route of Object.values(module?.routes?.form || {})) {
+            const name = route?.name || module.name;
+            if (!route?.rateLimit || (0, lodash_1.get)(this.config, ['agentApi', 'rateLimits', 'caller', name]))
+                continue;
+            (0, lodash_1.set)(this.config, ['agentApi', 'rateLimits', 'caller', name], route.rateLimit);
+        }
+    }
     constructor(config) {
+        assertNodeSnapshotDisabled();
+        assertSingleCore();
+        const configuredDb = !!config?.db;
+        // Read before the server fills in a random one.
+        const secretGiven = !!(config?.auth?.secret || (0, lodash_1.get)(process.env, 'JWT_SECRET', '').toString());
+        const uagLicense = (0, lodash_1.get)(process.env, 'UAG_LICENSE', '').toString();
+        if (uagLicense) {
+            console.warn('[formio-uag] UAG_LICENSE is deprecated. Put a Form.io license that includes the UAG in LICENSE_KEY instead; UAG_LICENSE keeps working until UAG 3.0.');
+        }
         super((0, lodash_1.defaultsDeep)(config || {}, {
             baseUrl: (0, lodash_1.get)(process.env, 'BASE_URL', '').toString(),
-            license: (0, lodash_1.get)(process.env, 'UAG_LICENSE', '').toString(),
+            // Deprecated: core also reads LICENSE_KEY, the Form.io license, and a
+            // feature is on when either key grants it.
+            license: uagLicense,
+            licenseName: 'UAG_LICENSE',
+            // The license server counts each UAG environment as a "uagServer", and the
+            // UAG runs on the "uag" feature: a key the license server accepts as a
+            // uagServer, or one whose terms carry the "uag" option.
+            licenseType: 'uagServer',
+            licenseFeature: 'uag',
             // A project that is still starting up (a Form.io server in the same compose
             // file, for example) is retried with backoff before the load is given up on.
             retries: parseInt((0, lodash_1.get)(process.env, 'PROJECT_RETRIES', 5).toString(), 10),
             retryDelay: parseInt((0, lodash_1.get)(process.env, 'PROJECT_RETRY_DELAY', 5000).toString(), 10),
             submissionProxy: true,
             processAsClient: true,
-            auth: { pkce: true }
+            // GET /status names the UAG's version beside the Form.io packages it runs on.
+            status: { '@formio/uag': version_1.UAG_VERSION },
+            // Bodies are parsed before authentication, so keep them to what Form.io accepts.
+            maxBodySize: (0, lodash_1.get)(process.env, 'MAX_BODY_SIZE', '16mb').toString(),
+            auth: { pkce: true, mcpOAuth: (0, lodash_1.get)(process.env, 'MCP_OAUTH', '').toString() === 'true' },
+            database: databaseFromEnv(),
+            // Modules an operator turns off, such as one an image includes.
+            modules: { disabled: (0, lodash_1.get)(process.env, 'MODULES_DISABLED', '').toString().split(',').map((name) => name.trim()).filter(Boolean) }
         }));
+        // The server's own MCP tools and engine types: a module may not define them again.
+        for (const tool of (this.config.tools || []))
+            if (tool?.name)
+                this.modules.claim(`MCP tool "${tool.name}"`, "the server's configuration");
+        for (const name of Object.keys(this.config.engineTypes || {}))
+            this.modules.claim(`engine type "${name}"`, "the server's configuration");
+        // MONGO is the UAG's own database, not a database for the appserver to keep
+        // submissions in: Form.io stores those.
+        if (!configuredDb && this.module.db) {
+            delete this.module.db;
+            delete this.config.db;
+        }
+        warnAboutSettings(this.config, secretGiven);
         this.use({
             ProjectInterface: UAGProjectInterface_1.UAGProjectInterface,
-            FormInterface: UAGFormInterface_1.UAGFormInterface
+            FormInterface: UAGFormInterface_1.UAGFormInterface,
+            actions: { agentRunTask: runTask_1.RunTaskAction },
+            hooks: (0, runTask_1.runTaskHooks)()
         });
     }
+    /**
+     * Connect the UAG's own database before the project loads, and check it
+     * without writing: a database the UAG may not use stops startup. It is used
+     * (its collections created, its stores handed out) only once the license is
+     * known; see enableDatabase. Until then nothing writes to it.
+     */
+    async connectDatabase() {
+        const options = this.config.database;
+        if (!options?.url) {
+            console.log('[formio-uag] No database (MONGO): runs after the save are kept in memory, and remote MCP sign-in (MCP_OAUTH) is unavailable.');
+            return;
+        }
+        if (this.database || this.pendingDatabase)
+            return;
+        const database = await database_1.UAGDatabase.connect(options);
+        try {
+            await database.inspect();
+        }
+        catch (err) {
+            await database.close().catch(() => { });
+            throw err;
+        }
+        this.pendingDatabase = database;
+    }
+    /**
+     * Use the database once the project and its license are loaded: with a
+     * license that includes the UAG (or the project and the database both on
+     * development hosts), create its collections and hand out its stores;
+     * otherwise leave it untouched, close it, and say why.
+     */
+    async enableDatabase(project) {
+        const database = this.pendingDatabase;
+        this.pendingDatabase = undefined;
+        if (database) {
+            let refusal = '';
+            let grant;
+            try {
+                grant = await (0, formflow_1.useDatabase)(project, {
+                    url: this.config.database.url,
+                    authCodes: database.authCodeStore(),
+                    taskRuns: { collection: database.taskRuns, ids: runs_1.OBJECT_IDS, project: String(project.project?._id || '') }
+                });
+            }
+            catch (err) {
+                refusal = err?.message || String(err);
+            }
+            if (!grant) {
+                console.warn(`[formio-uag] The database (MONGO) is not used: ${refusal} Runs after the save are kept in memory, and remote MCP sign-in (MCP_OAUTH) is off.`);
+                await database.close().catch(() => { });
+            }
+            else {
+                await database.bootstrap();
+                this.database = database;
+                (0, lodash_1.set)(this.config, 'auth.authCodeStore', grant.authCodeStore);
+                if (grant.taskRuns)
+                    (0, runner_1.taskRunner)(project).useStore(grant.taskRuns);
+                console.log(`[formio-uag] Using the database "${database.name}": runs are recorded, and runs that act with an agent role survive a restart.` +
+                    (this.config.auth?.mcpOAuth ? ' Remote MCP sign-in (MCP_OAUTH) is on.' : ''));
+            }
+        }
+        if (this.config.auth?.mcpOAuth && !this.database) {
+            console.warn('[formio-uag] MCP_OAUTH is set, but remote MCP sign-in is off: it needs the UAG\'s database (MONGO), and a license that includes the UAG to use it.');
+        }
+    }
+    /**
+     * An Agent API request that failed before its handlers (a body that is not JSON,
+     * one over the size limit) is answered in the Agent API's error shape; every other
+     * route keeps Form.io's plain-text answer.
+     */
+    sendError(req, res, status, message, err) {
+        if (!(0, errors_1.isAgentApiRequest)(req) && !this.isModuleRouteRequest(req))
+            return super.sendError(req, res, status, message, err);
+        const error = err?.type === 'entity.parse.failed' ? 'The request body is not valid JSON.' : message;
+        // Written past any shaping wrapper, which may not have run for this request.
+        res.status(status).type('application/json').end(JSON.stringify((0, errors_1.errorBody)((0, errors_1.requestIdOf)(req, res), status, { error })));
+    }
+    /** Whether a request is for a module's form route: its method, and a path ending in the route's. */
+    isModuleRouteRequest(req) {
+        const path = String(req.path || '').toLowerCase().replace(/\/+$/, '');
+        return this.modules.list.some((module) => Object.keys(module.definition.routes?.form || {}).some((key) => {
+            const [method, route] = key.split(' ');
+            return req.method === method && path.endsWith(String(route).toLowerCase().replace(/\/+$/, ''));
+        }));
+    }
+    /** Browsers reading Agent API responses need the request id too. */
+    get exposedHeaders() {
+        return [...super.exposedHeaders, 'X-Request-Id'];
+    }
+    /** The loaded UAG project, once the project router has been built. */
+    get uagProject() {
+        return Object.values(this.projectRouter?.projects || {})[0];
+    }
+    /**
+     * Mount `/agent/capabilities` ahead of the project routes. The project routes,
+     * and the admin passthrough after them, would otherwise answer for it and
+     * forward admin requests to the Form.io server. A form's agent operations are
+     * on the form's own routes.
+     */
+    async extendRouter(router) {
+        // A bare function in config.tools (the unreleased factory form) stops startup.
+        (0, utils_1.assertToolEntries)(this.config.tools);
+        await super.extendRouter(router);
+        // @formio/uag-js, the portal script and stylesheet: public, ahead of the project routes.
+        router.use((0, uagJs_1.uagJsRouter)(() => this.plugins, () => this.modules.components()));
+        const uagProject = this.uagProject;
+        if (uagProject) {
+            // First: the Agent API's request id and one error shape, for every refusal after it.
+            router.use((0, errors_1.agentErrorShape)());
+            router.use(uagProject.agentRouter());
+            // An agent operation of a form the project does not have is answered here, not passed to Form.io.
+            router.use((0, router_1.agentNotFound)(uagProject));
+            // Action Logs in a connected portal stage, with the UAG's run records.
+            router.use((0, actionLogs_1.ActionLogRouter)(uagProject));
+        }
+    }
+    /**
+     * List the UAG's engines and MCP tools in the plugin registry, beside
+     * appserver-core's form actions. They keep loading their own way.
+     */
+    async listPlugins() {
+        await super.listPlugins();
+        // Converters: the converter type and the built-in converters, for task file inputs, read_document and modules.
+        (0, plugins_2.registerDocuments)(this.plugins);
+        const project = this.uagProject;
+        if (project instanceof UAGProjectInterface_1.UAGProjectInterface)
+            project.plugins = this.plugins;
+        if (project instanceof UAGProjectInterface_1.UAGProjectInterface) {
+            // Decide which engines are on before serving anything, so a misconfigured
+            // engine stops startup with its name in the error instead of failing the
+            // first request.
+            project.engines = await (0, engines_1.loadUAGEngines)(project.config || {}, process.env);
+            enginesLoaded.add(project);
+            (0, plugins_1.listEngines)(this.plugins, project);
+            await (0, plugins_1.listTools)(this.plugins, project);
+        }
+    }
+    /** A form's own route segments, which module routes may not use: appserver's, and the agent operations. */
+    get reservedFormPaths() {
+        return [...super.reservedFormPaths, 'agent'];
+    }
+    /** Module routes may not take the names of the UAG's own rate-limited operations. */
+    get reservedRouteNames() {
+        return modules_1.UAG_OPERATIONS;
+    }
+    get hostName() {
+        return 'uag';
+    }
+    get hostVersion() {
+        return version_1.UAG_VERSION;
+    }
+    /** The module API: appserver's, with the UAG's license check, engines, converters and helpers. */
+    createModuleApi(module) {
+        return (0, modules_1.uagModuleApi)(super.createModuleApi(module), (0, modules_1.serverDeps)(() => this.uagProject));
+    }
+    /** Module routes run behind what the agent operations run behind: the caller check, body limit, request id, rate limits and error shape. */
+    moduleRouteHandlers(project, route, module) {
+        return (0, modules_1.uagRouteHandlers)(project, route.name);
+    }
+    moduleErrorBody(req, err) {
+        return (0, modules_1.uagErrorBody)(req, err);
+    }
     async router() {
+        await this.connectDatabase();
         const router = await super.router();
-        const uagProject = Object.values(this.projectRouter?.projects || {})[0];
+        const uagProject = this.uagProject;
         // Without a project there are no forms to expose, so there is nothing to
         // serve. Say why: this used to throw "Cannot read properties of undefined
         // (reading 'uagRouter')", which told the operator nothing about the
@@ -49,16 +386,53 @@ class UAGServer extends appserver_1.Server {
         if (!uagProject) {
             throw new Error('No Form.io project could be loaded, so the UAG has nothing to serve. Check that PROJECT ' +
                 'points at a reachable Form.io deployment, and that it is paired with the right ' +
-                'credential — ADMIN_KEY for an Open Source server, or PROJECT_KEY plus UAG_LICENSE for ' +
-                'an Enterprise project. Earlier log lines report why the project load failed.');
+                'credential — ADMIN_KEY for an Open Source server, PROJECT_KEY for a project on Form.io\'s ' +
+                'hosted service, or PROJECT_KEY plus a license (LICENSE_KEY) for a self-hosted Enterprise project. ' +
+                'Earlier log lines report why the project load failed.');
+        }
+        // A database of the UAG's own needs the license, on every edition.
+        await this.enableDatabase(uagProject);
+        // The engines are loaded while the plugins are listed (listPlugins); a
+        // project interface that is not the UAG's own loads them here.
+        if (!enginesLoaded.has(uagProject)) {
+            uagProject.engines = await (0, engines_1.loadUAGEngines)(uagProject.config || {}, process.env);
+        }
+        // Say which edition this is, and whether Agentic Formflow will run, so an
+        // operator knows before the first request is refused.
+        // A failure here only loses the message; it never stops the UAG starting.
+        try {
+            const formflowState = await (0, formflow_1.formflow)(uagProject).state();
+            // A project on Form.io's hosted service runs under Form.io's license.
+            const hosted = formflowState.reason === 'hosted' ? ', on Form.io\'s hosted service (no license needed)' : '';
+            const reason = formflowState.licensedBy ? `licensed by ${formflowState.licensedBy}` : formflowState.reason;
+            console.log(`[formio-uag] ${formflowState.edition === 'enterprise' ? 'Enterprise' : 'Open Source'} edition${hosted}. Agentic Formflow ` +
+                (formflowState.allowed ? `is enabled (${reason}).` : 'requires a license (LICENSE_KEY) that includes the UAG, or a project on Form.io\'s hosted service; MCP and conversation forms are unaffected.'));
+        }
+        catch (err) {
+            debug(`Could not report the edition: ${err?.message || err}`);
         }
-        router.use(uagProject.uagRouter());
+        router.use(uagProject.uagRouter(false));
         return router;
     }
 }
 exports.UAGServer = UAGServer;
 __exportStar(require("@formio/appserver"), exports);
 __exportStar(require("./config"), exports);
+__exportStar(require("./agent"), exports);
 __exportStar(require("./tools"), exports);
+__exportStar(require("./documents"), exports);
+__exportStar(require("./modules"), exports);
+var markdown_1 = require("./markdown");
+Object.defineProperty(exports, "sanitizeMarkdown", { enumerable: true, get: function () { return markdown_1.sanitizeMarkdown; } });
+var pluginFiles_1 = require("./pluginFiles");
+Object.defineProperty(exports, "usePluginFiles", { enumerable: true, get: function () { return pluginFiles_1.usePluginFiles; } });
+Object.defineProperty(exports, "pluginFiles", { enumerable: true, get: function () { return pluginFiles_1.pluginFiles; } });
+Object.defineProperty(exports, "pluginFilesIn", { enumerable: true, get: function () { return pluginFiles_1.pluginFilesIn; } });
+Object.defineProperty(exports, "DEFAULT_PLUGINS_DIR", { enumerable: true, get: function () { return pluginFiles_1.DEFAULT_PLUGINS_DIR; } });
 __exportStar(require("./router"), exports);
 __exportStar(require("./template"), exports);
+var richText_1 = require("./richText");
+Object.defineProperty(exports, "sanitizeRichText", { enumerable: true, get: function () { return richText_1.sanitizeRichText; } });
+Object.defineProperty(exports, "isRichText", { enumerable: true, get: function () { return richText_1.isRichText; } });
+Object.defineProperty(exports, "RICH_TEXT_TAGS", { enumerable: true, get: function () { return richText_1.RICH_TEXT_TAGS; } });
+Object.defineProperty(exports, "RICH_TEXT_RULE", { enumerable: true, get: function () { return richText_1.RICH_TEXT_RULE; } });

package/lib/markdown.d.ts

@@ -0,0 +1 @@
+export declare function sanitizeMarkdown(markdown: string): string;