@tsconfigdotjson/vibe-os 0.0.0-stage → 0.2.0-rc.1

package/server/acme.ts

@@ -0,0 +1,182 @@
+// Let's Encrypt via HTTP-01.
+//
+// We already own port 80, which is exactly what the HTTP-01 challenge needs, so
+// there is no separate listener and nothing to coordinate: the challenge
+// responder is just another route on the plain-HTTP server, checked before the
+// redirect-to-HTTPS rule.
+
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { writeAtomic } from "./fsx.ts";
+import { describeError, log } from "./log.ts";
+
+const CHALLENGE_PREFIX = "/.well-known/acme-challenge/";
+/** Renew this far ahead of expiry. Let's Encrypt certs last 90 days. */
+const RENEW_BEFORE_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * How often to re-check expiry once running.
+ *
+ * The renewal logic below only ever ran at startup, and the documented
+ * deployment is a systemd unit with `Restart=on-failure` plus a compose file
+ * with `restart: unless-stopped` — neither of which restarts a *healthy*
+ * process. A box left alone therefore served an expired certificate on day 90.
+ * Twice a day is far more often than a 30-day window needs, and costs one
+ * `readCertificateInfo` per tick when there is nothing to do.
+ */
+const RENEW_CHECK_MS = 12 * 60 * 60 * 1000;
+
+export interface TlsMaterial {
+  key: string;
+  cert: string;
+}
+
+export interface AcmeOptions {
+  domain: string;
+  email?: string;
+  staging: boolean;
+  stateDir: string;
+}
+
+export class Acme {
+  private challenges = new Map<string, string>();
+  private readonly dir: string;
+
+  constructor(private readonly options: AcmeOptions) {
+    this.dir = path.join(options.stateDir, "tls");
+  }
+
+  /** Serves the HTTP-01 challenge. Must run before any HTTPS redirect. */
+  handleChallenge(url: URL): Response | null {
+    if (!url.pathname.startsWith(CHALLENGE_PREFIX)) return null;
+    const token = url.pathname.slice(CHALLENGE_PREFIX.length);
+    const value = this.challenges.get(token);
+    if (!value)
+      return new Response("not found\n", {
+        status: 404,
+        headers: { "content-type": "text/plain" },
+      });
+    return new Response(value, {
+      status: 200,
+      headers: { "content-type": "application/octet-stream" },
+    });
+  }
+
+  private paths() {
+    return {
+      key: path.join(this.dir, `${this.options.domain}.key`),
+      cert: path.join(this.dir, `${this.options.domain}.crt`),
+      account: path.join(this.dir, "account.key"),
+    };
+  }
+
+  private async loadExisting(): Promise<TlsMaterial | null> {
+    const { key, cert } = this.paths();
+    try {
+      const [keyPem, certPem] = await Promise.all([
+        readFile(key, "utf8"),
+        readFile(cert, "utf8"),
+      ]);
+      const acme = await import("acme-client");
+      const info = acme.crypto.readCertificateInfo(certPem);
+      const remaining = info.notAfter.getTime() - Date.now();
+      if (remaining > RENEW_BEFORE_MS) {
+        log.ok(
+          `reusing TLS certificate for ${this.options.domain} (expires ${info.notAfter.toISOString().slice(0, 10)})`,
+        );
+        return { key: keyPem, cert: certPem };
+      }
+      log.info(
+        `TLS certificate for ${this.options.domain} expires soon — renewing`,
+      );
+      return null;
+    } catch (err) {
+      // ENOENT is the ordinary "no certificate yet" path. Anything else — a
+      // permission problem, a truncated file, a corrupt PEM — must not silently
+      // become a reissue: that burns Let's Encrypt's duplicate-certificate rate
+      // limit, and under a restart loop it burns it fast.
+      if ((err as NodeJS.ErrnoException)?.code !== "ENOENT") throw err;
+      return null;
+    }
+  }
+
+  /** Returns usable key/cert material, ordering a new certificate if needed. */
+  async obtain(): Promise<TlsMaterial> {
+    await mkdir(this.dir, { recursive: true, mode: 0o700 });
+
+    const existing = await this.loadExisting();
+    if (existing) return existing;
+
+    const acme = await import("acme-client");
+    const { key: keyPath, cert: certPath, account: accountPath } = this.paths();
+
+    // Same reasoning as loadExisting, but the stakes are higher: overwriting
+    // this key discards the Let's Encrypt registration itself.
+    let accountKey: Buffer;
+    try {
+      accountKey = await readFile(accountPath);
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException)?.code !== "ENOENT") throw err;
+      accountKey = await acme.crypto.createPrivateKey();
+      await writeFile(accountPath, accountKey, { mode: 0o600 });
+    }
+
+    const client = new acme.Client({
+      directoryUrl: this.options.staging
+        ? acme.directory.letsencrypt.staging
+        : acme.directory.letsencrypt.production,
+      accountKey,
+    });
+
+    log.info(`requesting a TLS certificate for ${this.options.domain}…`);
+    const [privateKey, csr] = await acme.crypto.createCsr({
+      commonName: this.options.domain,
+    });
+
+    const cert = await client.auto({
+      csr,
+      email: this.options.email,
+      termsOfServiceAgreed: true,
+      challengePriority: ["http-01"],
+      challengeCreateFn: async (_authz, challenge, keyAuthorization) => {
+        if (challenge.type !== "http-01") return;
+        this.challenges.set(challenge.token, keyAuthorization);
+      },
+      challengeRemoveFn: async (_authz, challenge) => {
+        this.challenges.delete(challenge.token);
+      },
+    });
+
+    const keyPem = privateKey.toString();
+    const certPem = cert.toString();
+    await writeAtomic(keyPath, keyPem, 0o600);
+    await writeAtomic(certPath, certPem, 0o644);
+    log.ok(`TLS certificate issued for ${this.options.domain}`);
+
+    return { key: keyPem, cert: certPem };
+  }
+
+  /**
+   * Re-checks expiry on a timer and hands back fresh material when it rolls.
+   *
+   * Returns a stop function. The caller owns swapping the running HTTPS server
+   * over; this only decides when there is something to swap to.
+   */
+  watch(onRenewed: (material: TlsMaterial) => void): () => void {
+    const timer = setInterval(() => {
+      void (async () => {
+        try {
+          if (await this.loadExisting()) return; // still good
+          onRenewed(await this.obtain());
+        } catch (err) {
+          // A failed renewal must not take the process down: the current
+          // certificate is still being served and there are 30 days of runway.
+          log.warn(`TLS renewal check failed: ${describeError(err)}`);
+        }
+      })();
+    }, RENEW_CHECK_MS);
+    // Do not hold the event loop open just for this.
+    timer.unref?.();
+    return () => clearInterval(timer);
+  }
+}

package/server/api.ts

@@ -0,0 +1,515 @@
+import os from "node:os";
+import pkg from "../package.json" with { type: "json" };
+import type { ClientConfig } from "../shared/wire.ts";
+import {
+  attachInfo,
+  killSession,
+  publicHost,
+  reapStaleHandoffs,
+  setHandoff,
+} from "./attach.ts";
+import type { Config } from "./config.ts";
+import type { Db } from "./db.ts";
+import { ID_PATTERN } from "./db.ts";
+import { discoverClaude, discoverCursor, discoverHermes } from "./harness.ts";
+import {
+  badId,
+  IMMUTABLE_CACHE_CONTROL,
+  json,
+  methodNotAllowed,
+  readJson,
+} from "./http.ts";
+import { describeError, log } from "./log.ts";
+import {
+  discoverMcp,
+  discoverMcpWithDefs,
+  type McpScan,
+  syncMcpMirrors,
+} from "./mcp.ts";
+import {
+  createProfile,
+  deleteProfile,
+  getProfile,
+  listProfiles,
+  PALETTE,
+  updateProfile,
+} from "./profiles.ts";
+import {
+  createWorkspace,
+  getWorkspace,
+  listProjects,
+  listWorkspaces,
+  reconcileWorkspaces,
+  removeWorkspace,
+  scanProjects,
+  touchWorkspace,
+} from "./projects.ts";
+import { windowCommand } from "./session.ts";
+import type { SshCa } from "./ssh-ca.ts";
+import { fingerprint, MAX_PUBKEY_BYTES } from "./ssh-ca.ts";
+import {
+  type DesktopPrefs,
+  MAX_WALLPAPER_BYTES,
+  type WallpaperStore,
+} from "./wallpapers.ts";
+import {
+  createWindow,
+  deleteWindow,
+  getWindow,
+  listWindows,
+  sessionNameFor,
+  updateWindow,
+} from "./windows.ts";
+
+/**
+ * Where to look for MCP servers, for one project or for all of them.
+ *
+ * A worktree is a copy of the repo, so its `.mcp.json` is the project's and is
+ * read once from the root. Local-scope servers are the opposite — they are
+ * keyed by the exact directory `claude mcp add` ran in, so every worktree is
+ * its own place to look.
+ */
+function mcpScan(db: Db, projectId?: string): McpScan {
+  const roots: string[] = [];
+  const dirs: string[] = [];
+  for (const project of listProjects(db)) {
+    if (projectId !== undefined && project.id !== projectId) continue;
+    roots.push(project.path);
+    dirs.push(
+      project.path,
+      ...listWorkspaces(db, project.id).map((w) => w.path),
+    );
+  }
+  return { roots, dirs };
+}
+
+/**
+ * Brings the generated per-server files back in step with the box.
+ *
+ * Always over every project, never just the one being asked about: the sync
+ * deletes files that no longer have a server behind them, and a partial view
+ * would read another project's servers as gone.
+ */
+/**
+ * Re-scans every project and rewrites the mirror files.
+ *
+ * Returns nothing: both call sites discarded the list, which made the discovery
+ * work look reusable when it was not.
+ */
+async function refreshMcpMirrors(db: Db, stateDir: string): Promise<void> {
+  await syncMcpMirrors(
+    stateDir,
+    await discoverMcpWithDefs(stateDir, mcpScan(db)),
+  );
+}
+
+export interface ApiDeps {
+  config: Config;
+  ca: SshCa;
+  hostKey: string | null;
+  wallpapers: WallpaperStore;
+  db: Db;
+}
+
+export function createApi(deps: ApiDeps) {
+  const { ca, config, db, hostKey, wallpapers } = deps;
+
+  return async function handleApi(
+    req: Request,
+    url: URL,
+  ): Promise<Response | null> {
+    const p = url.pathname;
+    if (!p.startsWith("/api/")) return null;
+
+    if (p === "/api/health") return json({ ok: true });
+
+    // What the installed Claude CLI accepts, so the editor can offer it as
+    // dropdowns rather than asking people to remember flag spellings.
+    if (p === "/api/harness/claude" && req.method === "GET") {
+      return json(await discoverClaude());
+    }
+
+    // The same question for Hermes, which answers a narrower version of it:
+    // configured providers, its own defaults, and where its browser tools land.
+    if (p === "/api/harness/hermes" && req.method === "GET") {
+      return json(await discoverHermes());
+    }
+
+    // And for Cursor: the account's model list, and whether anyone is logged in.
+    if (p === "/api/harness/cursor" && req.method === "GET") {
+      return json(await discoverCursor());
+    }
+
+    if (p === "/api/config" && req.method === "GET") {
+      const body: ClientConfig = {
+        version: pkg.version,
+        hostname: os.hostname(),
+        user: config.user,
+        workspaceRoot: config.workspace,
+        sessions: config.sessions,
+        authRequired: config.token !== null,
+        endpoint: { name: "local", url: "./websocket" },
+        hostKey,
+        hostKeyFingerprint: hostKey ? fingerprint(hostKey) : null,
+        certificateEndpoint: "/api/ssh/certificate",
+        maxWallpaperBytes: MAX_WALLPAPER_BYTES,
+        themeColor: config.themeColor,
+        palette: PALETTE,
+      };
+      return json(body);
+    }
+
+    // ── projects ─────────────────────────────────────────────────────────────
+    if (p === "/api/projects" && req.method === "GET") {
+      // Reads the table only. Finding repos means walking the disk, which is
+      // far too expensive to do on a poll — that is what the refresh button
+      // (POST /api/projects/scan) is for, plus one scan at startup.
+      return json(listProjects(db));
+    }
+
+    if (p === "/api/projects/scan" && req.method === "POST") {
+      await scanProjects(db, config);
+      await reconcileWorkspaces(db, config);
+      return json(listProjects(db));
+    }
+
+    // The MCP servers a profile in this project could be given. Read from the
+    // box's own config rather than a list of our own, so `claude mcp add` is
+    // all it takes for one to appear here.
+    const mcpMatch = /^\/api\/projects\/([^/]+)\/mcp$/.exec(p);
+    if (mcpMatch && req.method === "GET") {
+      const projectId = decodeURIComponent(mcpMatch[1]);
+      if (!ID_PATTERN.test(projectId)) return badId("project");
+      // Writes the files as a side effect of listing them, so that anything
+      // offered in the editor is something a launch can actually point at.
+      await refreshMcpMirrors(db, config.stateDir);
+      return json(await discoverMcp(config.stateDir, mcpScan(db, projectId)));
+    }
+
+    const workspacesMatch = /^\/api\/projects\/([^/]+)\/workspaces$/.exec(p);
+    if (workspacesMatch) {
+      const projectId = decodeURIComponent(workspacesMatch[1]);
+      if (!ID_PATTERN.test(projectId)) return badId("project");
+
+      if (req.method === "GET") return json(listWorkspaces(db, projectId));
+
+      if (req.method === "POST") {
+        try {
+          const body = await readJson<{ name?: string }>(req);
+          const created = await createWorkspace(
+            db,
+            config.workspace,
+            projectId,
+            body.name,
+          );
+          return json(created, 201);
+        } catch (err) {
+          const message = describeError(err);
+          log.warn(`workspace creation failed: ${message}`);
+          return json({ error: message }, 400);
+        }
+      }
+      return methodNotAllowed();
+    }
+
+    // ── profiles ─────────────────────────────────────────────────────────────
+    const profilesMatch = /^\/api\/projects\/([^/]+)\/profiles$/.exec(p);
+    if (profilesMatch) {
+      const projectId = decodeURIComponent(profilesMatch[1]);
+      if (!ID_PATTERN.test(projectId)) return badId("project");
+
+      if (req.method === "GET") return json(listProfiles(db, projectId));
+
+      if (req.method === "POST") {
+        try {
+          const body = await readJson<Record<string, unknown>>(req);
+          return json(createProfile(db, projectId, body), 201);
+        } catch (err) {
+          return json({ error: describeError(err) }, 400);
+        }
+      }
+      return methodNotAllowed();
+    }
+
+    const profileMatch = /^\/api\/profiles\/([^/]+)$/.exec(p);
+    if (profileMatch) {
+      const id = decodeURIComponent(profileMatch[1]);
+      if (!ID_PATTERN.test(id)) return badId("profile");
+
+      if (req.method === "PATCH") {
+        try {
+          const body = await readJson<Record<string, unknown>>(req);
+          const updated = updateProfile(db, id, body);
+          return updated
+            ? json(updated)
+            : json({ error: "unknown profile" }, 404);
+        } catch (err) {
+          return json({ error: describeError(err) }, 400);
+        }
+      }
+
+      if (req.method === "DELETE") {
+        // Windows opened as this profile keep running and become plain
+        // terminals; ending live sessions is what the close button is for.
+        return deleteProfile(db, id)
+          ? json({ ok: true })
+          : json({ error: "unknown profile" }, 404);
+      }
+      return methodNotAllowed();
+    }
+
+    const workspaceMatch = /^\/api\/workspaces\/([^/]+)$/.exec(p);
+    if (workspaceMatch) {
+      const id = decodeURIComponent(workspaceMatch[1]);
+      if (!ID_PATTERN.test(id)) return badId("workspace");
+
+      if (req.method === "DELETE") {
+        // Every window here has a live session; removing the worktree
+        // without ending them leaves shells sitting in a deleted directory.
+        for (const win of listWindows(db, id)) {
+          const target = sessionNameFor(db, win.id);
+          if (target && config.sessions)
+            await killSession(config, target.session).catch(() => {});
+        }
+        try {
+          await removeWorkspace(db, config, id);
+          return json({ ok: true });
+        } catch (err) {
+          return json({ error: describeError(err) }, 400);
+        }
+      }
+
+      if (req.method === "POST") {
+        touchWorkspace(db, id);
+        return json({ ok: true });
+      }
+      return methodNotAllowed();
+    }
+
+    // ── windows ──────────────────────────────────────────────────────────────
+    const windowsMatch = /^\/api\/workspaces\/([^/]+)\/windows$/.exec(p);
+    if (windowsMatch) {
+      const workspaceId = decodeURIComponent(windowsMatch[1]);
+      if (!ID_PATTERN.test(workspaceId)) return badId("workspace");
+      const workspace = getWorkspace(db, workspaceId);
+      if (!workspace) return json({ error: "unknown workspace" }, 404);
+
+      if (req.method === "GET") {
+        // Cheap unless something is actually handed off, and it is what makes
+        // closing an ssh session give the window back on its own.
+        await reapStaleHandoffs(db, config).catch((err: unknown) => {
+          log.warn(`could not check handoffs: ${describeError(err)}`);
+        });
+        return json(listWindows(db, workspaceId));
+      }
+      if (req.method === "POST") {
+        const body = await readJson<{ profileId?: unknown }>(req);
+        let profileId: string | null = null;
+        if (typeof body.profileId === "string" && body.profileId !== "") {
+          const profile = getProfile(db, body.profileId);
+          // A profile belongs to a project, so it may only open windows in that
+          // project's workspaces — otherwise one project's flags and prompt
+          // could be launched inside another project's worktree.
+          if (!profile || profile.projectId !== workspace.projectId) {
+            return json({ error: "unknown profile for this workspace" }, 400);
+          }
+          profileId = profile.id;
+        }
+        return json(createWindow(db, workspaceId, profileId), 201);
+      }
+      return methodNotAllowed();
+    }
+
+    // How to reach this window from a real terminal. Read-only: it composes
+    // strings a person can copy, and never runs anything itself.
+    const attachMatch = /^\/api\/windows\/([^/]+)\/attach$/.exec(p);
+    if (attachMatch && req.method === "GET") {
+      const id = decodeURIComponent(attachMatch[1]);
+      if (!ID_PATTERN.test(id)) return badId("window");
+      if (!config.sessions)
+        return json(
+          { error: "this server runs plain login shells (--no-sessions)" },
+          409,
+        );
+      const info = attachInfo(db, config, id, publicHost(req, url));
+      return info ? json(info) : json({ error: "unknown window" }, 404);
+    }
+
+    // Hands the window's terminal to an ssh client, or takes it back — which
+    // detaches whoever is attached, so there is never a second client.
+    const handoffMatch = /^\/api\/windows\/([^/]+)\/handoff$/.exec(p);
+    if (handoffMatch && req.method === "POST") {
+      const id = decodeURIComponent(handoffMatch[1]);
+      if (!ID_PATTERN.test(id)) return badId("window");
+      const body = await readJson<{ mode?: unknown }>(req);
+      if (body.mode !== "ssh" && body.mode !== null)
+        return json({ error: 'mode must be "ssh" or null' }, 400);
+      if (body.mode === "ssh" && !config.sessions) {
+        return json(
+          { error: "this server runs plain login shells (--no-sessions)" },
+          409,
+        );
+      }
+      const ok = await setHandoff(db, config, id, body.mode);
+      if (!ok) return json({ error: "unknown window" }, 404);
+      return json(getWindow(db, id) ?? { ok: true });
+    }
+
+    const windowMatch = /^\/api\/windows\/([^/]+)$/.exec(p);
+    if (windowMatch) {
+      const id = decodeURIComponent(windowMatch[1]);
+      if (!ID_PATTERN.test(id)) return badId("window");
+
+      if (req.method === "PATCH") {
+        const body = await readJson<Record<string, unknown>>(req);
+        const updated = updateWindow(db, id, body);
+        return updated ? json(updated) : json({ error: "unknown window" }, 404);
+      }
+
+      if (req.method === "DELETE") {
+        // Closing a window is an explicit "I am done with this", so the session
+        // goes too. Window indices are reused and `new-session -A` attaches, so
+        // leaving it alive would silently resurrect it in the next window.
+        const target = sessionNameFor(db, id);
+        if (target && config.sessions) {
+          await killSession(config, target.session)
+            .then(() => log.info(`ended session ${target.session}`))
+            .catch(() => {});
+        }
+        return deleteWindow(db, id)
+          ? json({ ok: true })
+          : json({ error: "unknown window" }, 404);
+      }
+      return methodNotAllowed();
+    }
+
+    // ── certificates ─────────────────────────────────────────────────────────
+    if (p === "/api/ssh/certificate") {
+      if (req.method !== "POST") return methodNotAllowed();
+
+      const windowId = url.searchParams.get("window") ?? "";
+      if (!ID_PATTERN.test(windowId)) return badId("window");
+
+      const target = sessionNameFor(db, windowId);
+      if (!target) return json({ error: "unknown window" }, 404);
+
+      if (Number(req.headers.get("content-length") ?? 0) > MAX_PUBKEY_BYTES) {
+        return json({ error: "public key too large" }, 413);
+      }
+
+      try {
+        const publicKey = await req.text();
+        if (publicKey.length > MAX_PUBKEY_BYTES)
+          throw new Error("public key too large");
+
+        // Read from the window row, never from the request: the browser asks
+        // for a window, and the server decides what that window runs.
+        const profile = target.profileId
+          ? getProfile(db, target.profileId)
+          : undefined;
+
+        // A profile's `--mcp-config` paths are only as good as the files behind
+        // them, and those are regenerated from the box's config. Doing it here
+        // means a server edited with `claude mcp add` takes effect on the next
+        // window rather than whenever the editor was last opened.
+        if (profile?.harness === "claude") {
+          await refreshMcpMirrors(db, config.stateDir).catch((err: unknown) => {
+            log.warn(`could not refresh mcp configs: ${describeError(err)}`);
+          });
+        }
+
+        const forceCommand = windowCommand(
+          target.session,
+          target.cwd,
+          config,
+          profile,
+        );
+        const cert = await ca.signUserCert({
+          publicKey,
+          principal: config.user,
+          identity: `vibe-os/${target.session}`,
+          forceCommand,
+          ttlSeconds: config.certTtlSeconds,
+        });
+
+        log.info(
+          `issued certificate for ${target.session} in ${target.cwd}${profile ? ` as ${profile.name}` : ""}`,
+        );
+
+        // sshterm compares this header for exact equality against "text/plain";
+        // a "; charset=utf-8" suffix makes it reject the certificate.
+        return new Response(cert, {
+          status: 200,
+          headers: {
+            "content-type": "text/plain",
+            "cache-control": "no-store",
+          },
+        });
+      } catch (err) {
+        const message = describeError(err);
+        log.warn(`certificate request rejected: ${message}`);
+        return json({ error: message }, 400);
+      }
+    }
+
+    // ── desktop preferences ──────────────────────────────────────────────────
+    if (p === "/api/desktop") {
+      if (req.method === "GET") return json(await wallpapers.prefs());
+      if (req.method === "PUT") {
+        try {
+          const body = (await req.json()) as DesktopPrefs;
+          return json(await wallpapers.setPrefs(body));
+        } catch (err) {
+          return json({ error: describeError(err) }, 400);
+        }
+      }
+      return methodNotAllowed();
+    }
+
+    // ── wallpapers ───────────────────────────────────────────────────────────
+    if (p === "/api/wallpapers") {
+      if (req.method === "GET") return json(await wallpapers.list());
+      if (req.method === "POST") {
+        if (
+          Number(req.headers.get("content-length") ?? 0) > MAX_WALLPAPER_BYTES
+        ) {
+          return json({ error: "image too large" }, 413);
+        }
+        try {
+          const name = url.searchParams.get("name") ?? "wallpaper";
+          const bytes = new Uint8Array(await req.arrayBuffer());
+          return json(await wallpapers.save(bytes, name), 201);
+        } catch (err) {
+          return json({ error: describeError(err) }, 400);
+        }
+      }
+      return methodNotAllowed();
+    }
+
+    if (p.startsWith("/api/wallpapers/")) {
+      const id = p.slice("/api/wallpapers/".length);
+      if (req.method === "GET") {
+        const found = await wallpapers.read(id);
+        if (!found) return json({ error: "not found" }, 404);
+        return new Response(found.file, {
+          headers: {
+            "content-type": found.mime,
+            "cache-control": IMMUTABLE_CACHE_CONTROL,
+            // Defence in depth: even if a hostile file slipped past the magic
+            // byte check, the browser must not be talked into running it.
+            "content-security-policy": "default-src 'none'; sandbox",
+            "x-content-type-options": "nosniff",
+          },
+        });
+      }
+      if (req.method === "DELETE") {
+        return (await wallpapers.remove(id))
+          ? json({ ok: true })
+          : json({ error: "not found" }, 404);
+      }
+      return methodNotAllowed();
+    }
+
+    return json({ error: "not found" }, 404);
+  };
+}