@formio/uag 2.0.0-rc.1 → 2.0.0-rc.10

package/lib/index.d.ts

@@ -1,32 +1,57 @@
 import { Server, ServerModule } from '@formio/appserver';
-import { Router } from 'express';
+import type { LoadedModule, ModuleApi, ModuleRoute, ModuleRouteHandlers, ProjectInterface } from '@formio/appserver';
+import { Request, Response, Router } from 'express';
 import { UAGProjectInterface } from './UAGProjectInterface';
 import { UAGFormInterface } from './UAGFormInterface';
 import { UAGConfig } from './config';
 import { UAGDatabase } from './database';
-export type UAGModule = ServerModule & {
+import type { UAGModuleApi } from './modules';
+export type UAGModule = ServerModule<UAGModuleApi> & {
     config?: UAGConfig;
 };
 /**
- * Agentic Formflow keeps its license state inside @formio/appserver-core, so the
- * UAG and @formio/appserver must load the same copy of it, at 2.24.1 or later.
- * A second copy (an older lockfile, or a package manager that nests it) would
- * otherwise fail in confusing ways; say what to do instead.
+ * Agentic Formflow keeps its license state inside @formio/appserver-core, and
+ * modules are built on its module framework. The UAG loads it only through
+ * @formio/appserver, so the two always share one copy, which must be 2.26.4 or
+ * later. An older @formio/appserver, or an old lockfile, can still resolve an
+ * older one, which would fail in confusing ways; say what to do instead.
  */
-export declare function assertSingleCore(core?: any, appserver?: any, version?: string): void;
+export declare function assertSingleCore(version?: string): void;
+/**
+ * isolated-vm, which runs form logic, needs Node's startup snapshot off. Without
+ * it nothing fails at once: the process can crash later, in native code. So an
+ * embedding server that forgot the flag is stopped here, saying what to do.
+ */
+export declare function assertNodeSnapshotDisabled(execArgv?: string[], nodeOptions?: string): void;
 export declare class UAGServer extends Server {
     config: UAGConfig;
     /** The UAG's own database, once it may be used. */
     database?: UAGDatabase;
     /** The database between connecting and the license check. */
     private pendingDatabase?;
+    /**
+     * Use a module, or a list of modules (each in turn). A module used twice (by
+     * its `name`) is used once. `config.tools` adds up across modules; an MCP
+     * tool or engine type that two modules define stops startup, naming both.
+     * A route's `rateLimit` is the default for its name, unless the operator set one.
+     */
+    use(module: any, source?: string): void;
+    /** MCP tools and engine types, which only one module may define. */
+    protected moduleClaims(definition: Record<string, any>): string[];
+    /**
+     * MCP tools add up across modules (lodash would merge them index by index),
+     * and a named module's tools get its API as `extra.module`. Its routes'
+     * `rateLimit`s become the defaults for their names.
+     */
+    protected mergeModuleConfig(config: any, module?: LoadedModule): void;
+    /** Route rate-limit defaults, for the names the operator left unset. */
+    private routeRateLimits;
     constructor(config?: UAGConfig);
     /**
      * Connect the UAG's own database before the project loads, and check it
      * without writing: a database the UAG may not use stops startup. It is used
      * (its collections created, its stores handed out) only once the license is
-     * known; see enableDatabase. Until then only the license check may write to
-     * it, to record a license server outage.
+     * known; see enableDatabase. Until then nothing writes to it.
      */
     protected connectDatabase(): Promise<void>;
     /**
@@ -36,6 +61,14 @@ export declare class UAGServer extends Server {
      * otherwise leave it untouched, close it, and say why.
      */
     protected enableDatabase(project: UAGProjectInterface): Promise<void>;
+    /**
+     * An Agent API request that failed before its handlers (a body that is not JSON,
+     * one over the size limit) is answered in the Agent API's error shape; every other
+     * route keeps Form.io's plain-text answer.
+     */
+    protected sendError(req: Request, res: Response, status: number, message: string, err?: any): void;
+    /** Whether a request is for a module's form route: its method, and a path ending in the route's. */
+    private isModuleRouteRequest;
     /** Browsers reading Agent API responses need the request id too. */
     get exposedHeaders(): string[];
     /** The loaded UAG project, once the project router has been built. */
@@ -47,12 +80,35 @@ export declare class UAGServer extends Server {
      * on the form's own routes.
      */
     protected extendRouter(router: Router): Promise<void>;
+    /**
+     * List the UAG's engines and MCP tools in the plugin registry, beside
+     * appserver-core's form actions. They keep loading their own way.
+     */
+    protected listPlugins(): Promise<void>;
+    /** A form's own route segments, which module routes may not use: appserver's, and the agent operations. */
+    protected get reservedFormPaths(): string[];
+    /** Module routes may not take the names of the UAG's own rate-limited operations. */
+    protected get reservedRouteNames(): string[];
+    protected get hostName(): string;
+    protected get hostVersion(): string;
+    /** The module API: appserver's, with the UAG's license check, engines, converters and helpers. */
+    protected createModuleApi(module: LoadedModule): ModuleApi;
+    /** Module routes run behind what the agent operations run behind: the caller check, body limit, request id, rate limits and error shape. */
+    protected moduleRouteHandlers(project: ProjectInterface, route: ModuleRoute<any>, module: LoadedModule): ModuleRouteHandlers;
+    protected moduleErrorBody(req: Request, err: unknown): Record<string, any> & {
+        status: number;
+    };
     router(): Promise<any>;
 }
 export * from '@formio/appserver';
 export * from './config';
 export * from './agent';
 export * from './tools';
+export * from './documents';
+export * from './modules';
+export { sanitizeMarkdown } from './markdown';
+export { usePluginFiles, pluginFiles, pluginFilesIn, DEFAULT_PLUGINS_DIR } from './pluginFiles';
 export * from './router';
 export * from './template';
+export { sanitizeRichText, isRichText, RICH_TEXT_TAGS, RICH_TEXT_RULE } from './richText';
 export { UAGProjectInterface, UAGFormInterface };

package/lib/index.js

@@ -13,11 +13,16 @@ var __createBinding = (this && this.__createBinding) || (Object.create ? (functi
 var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UAGFormInterface = exports.UAGProjectInterface = exports.UAGServer = void 0;
+exports.UAGFormInterface = exports.UAGProjectInterface = exports.RICH_TEXT_RULE = exports.RICH_TEXT_TAGS = exports.isRichText = exports.sanitizeRichText = exports.DEFAULT_PLUGINS_DIR = exports.pluginFilesIn = exports.pluginFiles = exports.usePluginFiles = exports.sanitizeMarkdown = exports.UAGServer = void 0;
 exports.assertSingleCore = assertSingleCore;
+exports.assertNodeSnapshotDisabled = assertNodeSnapshotDisabled;
 const appserver_1 = require("@formio/appserver");
 const formflow_1 = require("./formflow");
+const path_1 = __importDefault(require("path"));
 const UAGProjectInterface_1 = require("./UAGProjectInterface");
 Object.defineProperty(exports, "UAGProjectInterface", { enumerable: true, get: function () { return UAGProjectInterface_1.UAGProjectInterface; } });
 const UAGFormInterface_1 = require("./UAGFormInterface");
@@ -25,26 +30,71 @@ Object.defineProperty(exports, "UAGFormInterface", { enumerable: true, get: func
 const lodash_1 = require("lodash");
 const engines_1 = require("./agent/engines");
 const router_1 = require("./agent/router");
+const errors_1 = require("./agent/errors");
 const database_1 = require("./database");
 const runs_1 = require("./runs");
 const actionLogs_1 = require("./actionLogs");
 const runner_1 = require("./runner");
 const runTask_1 = require("./actions/runTask");
+const version_1 = require("./version");
+const utils_1 = require("./tools/utils");
+const plugins_1 = require("./plugins");
+const plugins_2 = require("./documents/plugins");
+const uagJs_1 = require("./documents/uagJs");
+const modules_1 = require("./modules");
+const tools_1 = require("./agent/tools");
+/** Projects whose engines were loaded while the plugins were listed. */
+const enginesLoaded = new WeakSet();
 const debug = require('debug')('formio:uag');
 /**
- * Agentic Formflow keeps its license state inside @formio/appserver-core, so the
- * UAG and @formio/appserver must load the same copy of it, at 2.24.1 or later.
- * A second copy (an older lockfile, or a package manager that nests it) would
- * otherwise fail in confusing ways; say what to do instead.
+ * Agentic Formflow keeps its license state inside @formio/appserver-core, and
+ * modules are built on its module framework. The UAG loads it only through
+ * @formio/appserver, so the two always share one copy, which must be 2.26.4 or
+ * later. An older @formio/appserver, or an old lockfile, can still resolve an
+ * older one, which would fail in confusing ways; say what to do instead.
  */
-function assertSingleCore(core = require('@formio/appserver-core'), appserver = require('@formio/appserver'), version = String(require('@formio/appserver-core/package.json').version || '0.0.0')) {
+function assertSingleCore(version = appserverCoreVersion()) {
     const [major, minor, patch] = version.split('.').map((part) => parseInt(part, 10) || 0);
-    if (major < 2 || (major === 2 && (minor < 24 || (minor === 24 && patch < 1)))) {
-        throw new Error(`@formio/uag needs @formio/appserver-core 2.24.1 or later; ${version} is installed.`);
+    if (major < 2 || (major === 2 && (minor < 26 || (minor === 26 && patch < 4)))) {
+        throw new Error(`@formio/uag needs @formio/appserver-core 2.26.4 or later, through @formio/appserver; ${version} is installed. Upgrade @formio/appserver.`);
+    }
+}
+/** The version of the @formio/appserver-core that @formio/appserver loads. */
+function appserverCoreVersion() {
+    const appserver = path_1.default.dirname(require.resolve('@formio/appserver/package.json'));
+    return String(require(require.resolve('@formio/appserver-core/package.json', { paths: [appserver] })).version || '0.0.0');
+}
+/**
+ * isolated-vm, which runs form logic, needs Node's startup snapshot off. Without
+ * it nothing fails at once: the process can crash later, in native code. So an
+ * embedding server that forgot the flag is stopped here, saying what to do.
+ */
+function assertNodeSnapshotDisabled(execArgv = process.execArgv, nodeOptions = process.env.NODE_OPTIONS || '') {
+    if (execArgv.includes('--no-node-snapshot') || /(^|\s)--no-node-snapshot(\s|$)/.test(nodeOptions))
+        return;
+    throw new Error('@formio/uag needs Node started with --no-node-snapshot: isolated-vm, which runs form logic, can crash the process without it. ' +
+        'Start node with --no-node-snapshot, or set NODE_OPTIONS=--no-node-snapshot. The uag command and the formio/uag image do this for you.');
+}
+/** A host name a browser cannot reach: a container or service name, with no dot. */
+function internalHost(url) {
+    try {
+        const { hostname } = new URL(url);
+        return !!hostname && hostname !== 'localhost' && !hostname.includes('.') && !hostname.includes(':');
+    }
+    catch {
+        return false;
+    }
+}
+/** Warnings for settings that start fine and fail later, in ways far from their cause. */
+function warnAboutSettings(config, secretGiven) {
+    if (!secretGiven) {
+        console.warn('[formio-uag] JWT_SECRET is not set, so the UAG signs its tokens with a random secret that lasts only as long as this process: ' +
+            'every token stops working when it restarts, and other instances refuse it. Set JWT_SECRET, the same on every instance.');
     }
-    if (appserver.Formflow !== core.Formflow || appserver.ProjectInterface !== core.ProjectInterface) {
-        throw new Error('Two copies of @formio/appserver-core are installed: one for @formio/uag and an older one for @formio/appserver. ' +
-            'Upgrade @formio/appserver to 2.24.1 or later and deduplicate (for example `yarn dedupe @formio/appserver-core`).');
+    const auth = config.auth || {};
+    if (auth.mcpOAuth && !auth.loginForm && internalHost(String(config.project || ''))) {
+        console.warn(`[formio-uag] MCP_OAUTH is on, but LOGIN_FORM is not set: the sign-in page loads ${String(config.project).replace(/\/+$/, '')}/user/login, ` +
+            'an address a person\'s browser cannot reach. Set LOGIN_FORM to the login form\'s public URL.');
     }
 }
 /** The UAG's own database from the environment, when `MONGO` is set. */
@@ -61,9 +111,59 @@ function databaseFromEnv(env = process.env) {
     };
 }
 class UAGServer extends appserver_1.Server {
+    /**
+     * Use a module, or a list of modules (each in turn). A module used twice (by
+     * its `name`) is used once. `config.tools` adds up across modules; an MCP
+     * tool or engine type that two modules define stops startup, naming both.
+     * A route's `rateLimit` is the default for its name, unless the operator set one.
+     */
+    use(module, source) {
+        module = appserver_1.Server.defaultExport(module);
+        if (module && typeof module === 'object' && !Array.isArray(module) && module.uag !== undefined) {
+            const label = source || (typeof module.name === 'string' && module.name) || 'a module';
+            throw new Error(`The module ${label} has a "uag" key, which UAG modules no longer use: move its keys (name, apiVersion, settings, routes, components, initialize) onto the module itself.`);
+        }
+        super.use(module, source);
+        if (typeof module?.name === 'string' && this.modules.get(module.name)?.definition === module)
+            this.routeRateLimits(module);
+    }
+    /** MCP tools and engine types, which only one module may define. */
+    moduleClaims(definition) {
+        return [
+            ...(definition.config?.tools || []).filter((tool) => tool?.name).map((tool) => `MCP tool "${tool.name}"`),
+            ...Object.keys(definition.config?.engineTypes || {}).map((name) => `engine type "${name}"`)
+        ];
+    }
+    /**
+     * MCP tools add up across modules (lodash would merge them index by index),
+     * and a named module's tools get its API as `extra.module`. Its routes'
+     * `rateLimit`s become the defaults for their names.
+     */
+    mergeModuleConfig(config, module) {
+        const { tools, ...rest } = config;
+        super.mergeModuleConfig(rest, module);
+        if (Array.isArray(tools) && tools.length) {
+            if (module)
+                for (const tool of tools)
+                    (0, tools_1.setToolModule)(tool, this.modules.apiFor(module));
+            this.config.tools = [...(this.config.tools || []), ...tools];
+        }
+    }
+    /** Route rate-limit defaults, for the names the operator left unset. */
+    routeRateLimits(module) {
+        for (const route of Object.values(module?.routes?.form || {})) {
+            const name = route?.name || module.name;
+            if (!route?.rateLimit || (0, lodash_1.get)(this.config, ['agentApi', 'rateLimits', 'caller', name]))
+                continue;
+            (0, lodash_1.set)(this.config, ['agentApi', 'rateLimits', 'caller', name], route.rateLimit);
+        }
+    }
     constructor(config) {
+        assertNodeSnapshotDisabled();
         assertSingleCore();
         const configuredDb = !!config?.db;
+        // Read before the server fills in a random one.
+        const secretGiven = !!(config?.auth?.secret || (0, lodash_1.get)(process.env, 'JWT_SECRET', '').toString());
         const uagLicense = (0, lodash_1.get)(process.env, 'UAG_LICENSE', '').toString();
         if (uagLicense) {
             console.warn('[formio-uag] UAG_LICENSE is deprecated. Put a Form.io license that includes the UAG in LICENSE_KEY instead; UAG_LICENSE keeps working until UAG 3.0.');
@@ -85,15 +185,28 @@ class UAGServer extends appserver_1.Server {
             retryDelay: parseInt((0, lodash_1.get)(process.env, 'PROJECT_RETRY_DELAY', 5000).toString(), 10),
             submissionProxy: true,
             processAsClient: true,
+            // GET /status names the UAG's version beside the Form.io packages it runs on.
+            status: { '@formio/uag': version_1.UAG_VERSION },
+            // Bodies are parsed before authentication, so keep them to what Form.io accepts.
+            maxBodySize: (0, lodash_1.get)(process.env, 'MAX_BODY_SIZE', '16mb').toString(),
             auth: { pkce: true, mcpOAuth: (0, lodash_1.get)(process.env, 'MCP_OAUTH', '').toString() === 'true' },
-            database: databaseFromEnv()
+            database: databaseFromEnv(),
+            // Modules an operator turns off, such as one an image includes.
+            modules: { disabled: (0, lodash_1.get)(process.env, 'MODULES_DISABLED', '').toString().split(',').map((name) => name.trim()).filter(Boolean) }
         }));
+        // The server's own MCP tools and engine types: a module may not define them again.
+        for (const tool of (this.config.tools || []))
+            if (tool?.name)
+                this.modules.claim(`MCP tool "${tool.name}"`, "the server's configuration");
+        for (const name of Object.keys(this.config.engineTypes || {}))
+            this.modules.claim(`engine type "${name}"`, "the server's configuration");
         // MONGO is the UAG's own database, not a database for the appserver to keep
         // submissions in: Form.io stores those.
         if (!configuredDb && this.module.db) {
             delete this.module.db;
             delete this.config.db;
         }
+        warnAboutSettings(this.config, secretGiven);
         this.use({
             ProjectInterface: UAGProjectInterface_1.UAGProjectInterface,
             FormInterface: UAGFormInterface_1.UAGFormInterface,
@@ -105,14 +218,12 @@ class UAGServer extends appserver_1.Server {
      * Connect the UAG's own database before the project loads, and check it
      * without writing: a database the UAG may not use stops startup. It is used
      * (its collections created, its stores handed out) only once the license is
-     * known; see enableDatabase. Until then only the license check may write to
-     * it, to record a license server outage.
+     * known; see enableDatabase. Until then nothing writes to it.
      */
     async connectDatabase() {
         const options = this.config.database;
         if (!options?.url) {
-            console.log('[formio-uag] No database (MONGO): runs after the save are kept in memory, remote MCP sign-in (MCP_OAUTH) is unavailable, ' +
-                'and the licensed features turn off at once, with no grace period, whenever the license server cannot be reached.');
+            console.log('[formio-uag] No database (MONGO): runs after the save are kept in memory, and remote MCP sign-in (MCP_OAUTH) is unavailable.');
             return;
         }
         if (this.database || this.pendingDatabase)
@@ -126,7 +237,6 @@ class UAGServer extends appserver_1.Server {
             throw err;
         }
         this.pendingDatabase = database;
-        this.config.licenseGrace = database.licenseGrace();
     }
     /**
      * Use the database once the project and its license are loaded: with a
@@ -139,22 +249,27 @@ class UAGServer extends appserver_1.Server {
         this.pendingDatabase = undefined;
         if (database) {
             let refusal = '';
+            let grant;
             try {
-                project.requireDatabaseLicense(this.config.database.url);
+                grant = await (0, formflow_1.useDatabase)(project, {
+                    url: this.config.database.url,
+                    authCodes: database.authCodeStore(),
+                    taskRuns: { collection: database.taskRuns, ids: runs_1.OBJECT_IDS, project: String(project.project?._id || '') }
+                });
             }
             catch (err) {
                 refusal = err?.message || String(err);
             }
-            if (refusal) {
+            if (!grant) {
                 console.warn(`[formio-uag] The database (MONGO) is not used: ${refusal} Runs after the save are kept in memory, and remote MCP sign-in (MCP_OAUTH) is off.`);
-                this.config.licenseGrace = undefined;
                 await database.close().catch(() => { });
             }
             else {
                 await database.bootstrap();
                 this.database = database;
-                (0, lodash_1.set)(this.config, 'auth.authCodeStore', database.authCodeStore());
-                (0, runner_1.taskRunner)(project).useStore(new runs_1.TaskRunStore(database.taskRuns, String(project.project?._id || '')));
+                (0, lodash_1.set)(this.config, 'auth.authCodeStore', grant.authCodeStore);
+                if (grant.taskRuns)
+                    (0, runner_1.taskRunner)(project).useStore(grant.taskRuns);
                 console.log(`[formio-uag] Using the database "${database.name}": runs are recorded, and runs that act with an agent role survive a restart.` +
                     (this.config.auth?.mcpOAuth ? ' Remote MCP sign-in (MCP_OAUTH) is on.' : ''));
             }
@@ -163,6 +278,26 @@ class UAGServer extends appserver_1.Server {
             console.warn('[formio-uag] MCP_OAUTH is set, but remote MCP sign-in is off: it needs the UAG\'s database (MONGO), and a license that includes the UAG to use it.');
         }
     }
+    /**
+     * An Agent API request that failed before its handlers (a body that is not JSON,
+     * one over the size limit) is answered in the Agent API's error shape; every other
+     * route keeps Form.io's plain-text answer.
+     */
+    sendError(req, res, status, message, err) {
+        if (!(0, errors_1.isAgentApiRequest)(req) && !this.isModuleRouteRequest(req))
+            return super.sendError(req, res, status, message, err);
+        const error = err?.type === 'entity.parse.failed' ? 'The request body is not valid JSON.' : message;
+        // Written past any shaping wrapper, which may not have run for this request.
+        res.status(status).type('application/json').end(JSON.stringify((0, errors_1.errorBody)((0, errors_1.requestIdOf)(req, res), status, { error })));
+    }
+    /** Whether a request is for a module's form route: its method, and a path ending in the route's. */
+    isModuleRouteRequest(req) {
+        const path = String(req.path || '').toLowerCase().replace(/\/+$/, '');
+        return this.modules.list.some((module) => Object.keys(module.definition.routes?.form || {}).some((key) => {
+            const [method, route] = key.split(' ');
+            return req.method === method && path.endsWith(String(route).toLowerCase().replace(/\/+$/, ''));
+        }));
+    }
     /** Browsers reading Agent API responses need the request id too. */
     get exposedHeaders() {
         return [...super.exposedHeaders, 'X-Request-Id'];
@@ -178,9 +313,15 @@ class UAGServer extends appserver_1.Server {
      * on the form's own routes.
      */
     async extendRouter(router) {
+        // A bare function in config.tools (the unreleased factory form) stops startup.
+        (0, utils_1.assertToolEntries)(this.config.tools);
         await super.extendRouter(router);
+        // @formio/uag-js, the portal script and stylesheet: public, ahead of the project routes.
+        router.use((0, uagJs_1.uagJsRouter)(() => this.plugins, () => this.modules.components()));
         const uagProject = this.uagProject;
         if (uagProject) {
+            // First: the Agent API's request id and one error shape, for every refusal after it.
+            router.use((0, errors_1.agentErrorShape)());
             router.use(uagProject.agentRouter());
             // An agent operation of a form the project does not have is answered here, not passed to Form.io.
             router.use((0, router_1.agentNotFound)(uagProject));
@@ -188,6 +329,52 @@ class UAGServer extends appserver_1.Server {
             router.use((0, actionLogs_1.ActionLogRouter)(uagProject));
         }
     }
+    /**
+     * List the UAG's engines and MCP tools in the plugin registry, beside
+     * appserver-core's form actions. They keep loading their own way.
+     */
+    async listPlugins() {
+        await super.listPlugins();
+        // Converters: the converter type and the built-in converters, for task file inputs, read_document and modules.
+        (0, plugins_2.registerDocuments)(this.plugins);
+        const project = this.uagProject;
+        if (project instanceof UAGProjectInterface_1.UAGProjectInterface)
+            project.plugins = this.plugins;
+        if (project instanceof UAGProjectInterface_1.UAGProjectInterface) {
+            // Decide which engines are on before serving anything, so a misconfigured
+            // engine stops startup with its name in the error instead of failing the
+            // first request.
+            project.engines = await (0, engines_1.loadUAGEngines)(project.config || {}, process.env);
+            enginesLoaded.add(project);
+            (0, plugins_1.listEngines)(this.plugins, project);
+            await (0, plugins_1.listTools)(this.plugins, project);
+        }
+    }
+    /** A form's own route segments, which module routes may not use: appserver's, and the agent operations. */
+    get reservedFormPaths() {
+        return [...super.reservedFormPaths, 'agent'];
+    }
+    /** Module routes may not take the names of the UAG's own rate-limited operations. */
+    get reservedRouteNames() {
+        return modules_1.UAG_OPERATIONS;
+    }
+    get hostName() {
+        return 'uag';
+    }
+    get hostVersion() {
+        return version_1.UAG_VERSION;
+    }
+    /** The module API: appserver's, with the UAG's license check, engines, converters and helpers. */
+    createModuleApi(module) {
+        return (0, modules_1.uagModuleApi)(super.createModuleApi(module), (0, modules_1.serverDeps)(() => this.uagProject));
+    }
+    /** Module routes run behind what the agent operations run behind: the caller check, body limit, request id, rate limits and error shape. */
+    moduleRouteHandlers(project, route, module) {
+        return (0, modules_1.uagRouteHandlers)(project, route.name);
+    }
+    moduleErrorBody(req, err) {
+        return (0, modules_1.uagErrorBody)(req, err);
+    }
     async router() {
         await this.connectDatabase();
         const router = await super.router();
@@ -205,10 +392,11 @@ class UAGServer extends appserver_1.Server {
         }
         // A database of the UAG's own needs the license, on every edition.
         await this.enableDatabase(uagProject);
-        // Decide which engines are on before serving anything, so a misconfigured
-        // engine stops startup with its name in the error instead of failing the
-        // first request.
-        uagProject.engines = await (0, engines_1.loadUAGEngines)(uagProject.config || {}, process.env);
+        // The engines are loaded while the plugins are listed (listPlugins); a
+        // project interface that is not the UAG's own loads them here.
+        if (!enginesLoaded.has(uagProject)) {
+            uagProject.engines = await (0, engines_1.loadUAGEngines)(uagProject.config || {}, process.env);
+        }
         // Say which edition this is, and whether Agentic Formflow will run, so an
         // operator knows before the first request is refused.
         // A failure here only loses the message; it never stops the UAG starting.
@@ -232,5 +420,19 @@ __exportStar(require("@formio/appserver"), exports);
 __exportStar(require("./config"), exports);
 __exportStar(require("./agent"), exports);
 __exportStar(require("./tools"), exports);
+__exportStar(require("./documents"), exports);
+__exportStar(require("./modules"), exports);
+var markdown_1 = require("./markdown");
+Object.defineProperty(exports, "sanitizeMarkdown", { enumerable: true, get: function () { return markdown_1.sanitizeMarkdown; } });
+var pluginFiles_1 = require("./pluginFiles");
+Object.defineProperty(exports, "usePluginFiles", { enumerable: true, get: function () { return pluginFiles_1.usePluginFiles; } });
+Object.defineProperty(exports, "pluginFiles", { enumerable: true, get: function () { return pluginFiles_1.pluginFiles; } });
+Object.defineProperty(exports, "pluginFilesIn", { enumerable: true, get: function () { return pluginFiles_1.pluginFilesIn; } });
+Object.defineProperty(exports, "DEFAULT_PLUGINS_DIR", { enumerable: true, get: function () { return pluginFiles_1.DEFAULT_PLUGINS_DIR; } });
 __exportStar(require("./router"), exports);
 __exportStar(require("./template"), exports);
+var richText_1 = require("./richText");
+Object.defineProperty(exports, "sanitizeRichText", { enumerable: true, get: function () { return richText_1.sanitizeRichText; } });
+Object.defineProperty(exports, "isRichText", { enumerable: true, get: function () { return richText_1.isRichText; } });
+Object.defineProperty(exports, "RICH_TEXT_TAGS", { enumerable: true, get: function () { return richText_1.RICH_TEXT_TAGS; } });
+Object.defineProperty(exports, "RICH_TEXT_RULE", { enumerable: true, get: function () { return richText_1.RICH_TEXT_RULE; } });

package/lib/markdown.d.ts

@@ -0,0 +1 @@
+export declare function sanitizeMarkdown(markdown: string): string;