anbaric-cloud-hosting 1.68.3 → 1.70.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric-cloud-hosting",
-  "version": "1.68.3",
+  "version": "1.70.0",
   "description": "Anbaric Cloud hosting service: Postgres-backed job persistence and queuing exposed over an HTTP API",
   "license": "MIT",
   "author": "chris@anbaric.ai",
@@ -18,18 +18,18 @@
     "@aws-sdk/client-s3": "^3.1110.0",
     "@aws-sdk/client-secrets-manager": "^3.700.0",
     "@aws-sdk/client-servicediscovery": "^3.1110.0",
-    "anbaric-data-store": "^1.68.3",
-    "anbaric-plugins": "^1.68.3",
-    "anbaric-tsapi": "^1.68.3",
-    "anbaric-web": "^1.68.3",
+    "anbaric-data-store": "^1.70.0",
+    "anbaric-plugins": "^1.70.0",
+    "anbaric-tsapi": "^1.70.0",
+    "anbaric-web": "^1.70.0",
     "esbuild": "^0.28.2",
     "pg": "^8.16.0"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",
     "@types/pg": "^8.15.0",
-    "anbaric-impl-cloud": "^1.68.3",
-    "anbaric-state-machine": "^1.68.3",
+    "anbaric-impl-cloud": "^1.70.0",
+    "anbaric-state-machine": "^1.70.0",
     "tsx": "^4.20.0",
     "typescript": "^7.0.2"
   },

package/src/app-management/BaseBuildLayer.ts

@@ -3,7 +3,7 @@ import {mkdir, readFile, rm, symlink, writeFile} from "node:fs/promises";
 import {join} from "node:path";
 import {adminPing} from "../app-admin/adminPing";
 import {DocGenerator} from "../docs/DocGenerator";
-import {AppSize, BuildLayer, DeploymentStatus, DeploymentSummary} from "./BuildLayer";
+import {AppSize, BuildLayer, DeploymentStatus, DeploymentSummary, DeployOptions} from "./BuildLayer";
 
 type Deployment = {
     appName : string,
@@ -14,6 +14,8 @@ type Deployment = {
     adminPort : number,
     consumerPort : number,
     log : Array<string>,
+    // Whether this deploy keeps the version it replaces up until it answers.
+    zeroDowntime : boolean,
     process? : ChildProcess,
     replaces? : Deployment,
     draining? : { inFlight : number, since : number },
@@ -47,7 +49,7 @@ abstract class BaseBuildLayer implements BuildLayer {
 
     constructor(protected appsDir : string, private consumerPortBase : number = 8800,
                 private probe : Probe = adminProbe,
-                private livenessTimeoutMs : number = LIVENESS_TIMEOUT_MS,
+                protected livenessTimeoutMs : number = LIVENESS_TIMEOUT_MS,
                 private drainTimeoutMs : number = DRAIN_TIMEOUT_MS,
                 private drainPollIntervalMs : number = DRAIN_POLL_INTERVAL_MS) {}
 
@@ -63,7 +65,7 @@ abstract class BaseBuildLayer implements BuildLayer {
 
     protected async rehydrate() : Promise<void> {}
 
-    deploy(appName : string, appPort : number, tarball : Buffer) : DeploymentSummary {
+    deploy(appName : string, appPort : number, tarball : Buffer, options : DeployOptions = {}) : DeploymentSummary {
         const existing = this.deployments.get(appName);
 
         const deployment : Deployment = {
@@ -76,6 +78,7 @@ abstract class BaseBuildLayer implements BuildLayer {
             adminPort: APP_ADMIN_PORT,
             consumerPort: existing?.consumerPort ?? this.consumerPortBase + this.nextAppIndex++,
             log: [],
+            zeroDowntime: options.zeroDowntime ?? false,
             replaces: existing,
         };
         this.deployments.set(appName, deployment);
@@ -247,24 +250,43 @@ abstract class BaseBuildLayer implements BuildLayer {
         const manifest = JSON.parse(await readFile(join(appDir, "package.json"), "utf8"));
         await this.linkWorkspacePackages(appDir, manifest);
 
-        // The version being replaced finishes its work first; the build above
-        // ran while it carried on, so the drain is the only pause it sees.
+        /* The version being replaced finishes its work first; the build above
+           ran while it carried on, so the drain is the only pause it sees. A
+           layer that can roll in place keeps it up past that, still serving,
+           until the new version has taken over. */
         if (deployment.replaces) {
             if (deployment.replaces.status === "running") await this.drain(deployment, deployment.replaces);
             if (!this.isCurrent(deployment)) return;
-            await this.stop(deployment.replaces);
+            if (! this.rollsInPlace(deployment)) await this.stop(deployment.replaces);
         }
 
         if (!this.isCurrent(deployment)) return;
         await this.start(deployment, appDir, manifest.main);
-        await this.awaitLive(deployment);
+        if (this.rollsInPlace(deployment)) {
+            await this.awaitRolled(deployment);
+        } else {
+            await this.awaitLive(deployment);
+        }
     }
 
     protected isCurrent(deployment : Deployment) : boolean {
         return this.deployments.get(deployment.appName) === deployment && deployment.status === "building";
     }
 
-    private async awaitLive(deployment : Deployment) : Promise<void> {
+    /* Whether this deploy replaces the old version without stopping it first.
+       Only a layer whose backend can run two versions of one app side by side
+       and swap between them says yes; the default cannot, and the option on
+       the deploy is then simply not honoured. */
+    protected rollsInPlace(_deployment : Deployment) : boolean {
+        return false;
+    }
+
+    // Waits for a roll-in-place to finish; a layer that rolls must say how.
+    protected async awaitRolled(deployment : Deployment) : Promise<void> {
+        await this.awaitLive(deployment);
+    }
+
+    protected async awaitLive(deployment : Deployment) : Promise<void> {
         const deadline = Date.now() + this.livenessTimeoutMs;
 
         while (Date.now() < deadline) {

package/src/app-management/BuildLayer.ts

@@ -27,6 +27,15 @@ type DeploymentSummary = {
     draining? : Draining,
 };
 
+/* How a deploy replaces the running version. By default the old version is
+   drained and stopped, then the new one started, so there is a gap. With
+   zeroDowntime the new version is brought up beside the old once the drain is
+   done and the old is let go only when the new answers - on a build layer that
+   can do that; one that cannot ignores it. */
+type DeployOptions = {
+    zeroDowntime? : boolean,
+};
+
 interface BuildLayer {
 
     /* Moves a running app onto a different size of instance. The app is rolled
@@ -35,7 +44,7 @@ interface BuildLayer {
     resize(appName : string, size : AppSize) : Promise<DeploymentSummary | undefined>;
 
     ensureHydrated() : Promise<void>;
-    deploy(appName : string, appPort : number, tarball : Buffer) : DeploymentSummary;
+    deploy(appName : string, appPort : number, tarball : Buffer, options? : DeployOptions) : DeploymentSummary;
     status(appName : string) : (DeploymentSummary & { log : Array<string> }) | undefined;
     list() : Array<DeploymentSummary>;
     ping(appName : string) : Promise<boolean>;
@@ -61,5 +70,5 @@ interface BuildLayer {
 
 }
 
-export type { BuildLayer, DeploymentStatus, DeploymentSummary, Draining, AppSize };
+export type { BuildLayer, DeploymentStatus, DeploymentSummary, Draining, AppSize, DeployOptions };
 export { APP_SIZES, isAppSize };

package/src/app-management/FargateBuildLayer.ts

@@ -35,6 +35,10 @@ type FargateBuildLayerOptions = {
     sqlDatabaseUrlSecretArn? : string,
     sqlSchema? : string,
     docGenerator? : DocGenerator,
+    /* Put on every task definition and service this layer makes, and from
+       there on every task, so the cost of a tenant's apps can be told apart
+       on the bill. Empty means untagged. */
+    tags? : Record<string, string>,
 };
 
 type AwsClients = {
@@ -55,6 +59,7 @@ const defaultClients = (region : string) : AwsClients => ({
 
 const BUILD_TIMEOUT_MS = 900_000;
 const FARGATE_LIVENESS_TIMEOUT_MS = 420_000;
+const ROLL_POLL_INTERVAL_MS = 5_000;
 
 /* What each size is on Fargate, in the units ECS wants. The memory is what
    the console describes as "2× the RAM"; the CPU is not advertised, only felt. */
@@ -65,6 +70,22 @@ const TASK_SIZES : Record<AppSize, { cpu : string, memory : string }> = {
 
 const sizeOfTask = (memory? : string) : AppSize => memory === TASK_SIZES.large.memory ? "large" : "small";
 
+/* What makes a roll zero-downtime: ECS only retires the old task once the
+   new one is healthy, and without a health check "healthy" means "started",
+   before the app inside is listening. This asks the app's admin port the
+   same `ping` the platform's own probe sends. Only a task with zero-downtime
+   deploys carries it, so nothing already running is touched. The start
+   period is Fargate's longest, for apps that build at boot. */
+const adminHealthCheck = (adminPort : number) => ({
+    command: ["CMD-SHELL", `node -e "const s=require('net').connect(${adminPort},'127.0.0.1');`
+        + `s.setTimeout(3000,()=>process.exit(1));s.on('connect',()=>s.write('ping\\n'));`
+        + `s.on('data',d=>process.exit(String(d).startsWith('ok')?0:1));s.on('error',()=>process.exit(1))"`],
+    interval: 10,
+    timeout: 5,
+    retries: 3,
+    startPeriod: 300,
+});
+
 class FargateBuildLayer extends BaseBuildLayer {
 
     private aws : AwsClients;
@@ -135,6 +156,50 @@ class FargateBuildLayer extends BaseBuildLayer {
         await this.upsertService(deployment, taskDefinition, registryArn);
     }
 
+    /* ECS can run the new task beside the old one and swap the service over
+       once the new one is up, which is what a zero-downtime deploy buys: the
+       old version, already drained, keeps answering until then. */
+    protected rollsInPlace(deployment : Deployment) : boolean {
+        return deployment.zeroDowntime && deployment.replaces !== undefined;
+    }
+
+    /* The roll is done when ECS says so, not when something answers on the
+       app's name: during the roll that name resolves to the old task as
+       readily as the new, so a probe would call the deploy live too soon.
+       ECS reports one deployment, completed, once the old task is gone. */
+    protected async awaitRolled(deployment : Deployment) : Promise<void> {
+        const deadline = Date.now() + this.livenessTimeoutMs;
+
+        while (Date.now() < deadline) {
+            if (deployment.status !== "building") return;
+            if (await this.rolled(deployment.appName)) {
+                deployment.status = "running";
+                this.log(deployment, "app is live: the service has rolled over to the new version");
+                return;
+            }
+            await new Promise(resolve => setTimeout(resolve, ROLL_POLL_INTERVAL_MS));
+        }
+
+        /* The old version is still serving - ECS keeps it until the new one
+           is healthy - so nothing is torn down; the deploy is reported as
+           failed and the app's log says why it never came up. */
+        deployment.status = "failed";
+        this.log(deployment, `the service did not roll over within ${this.livenessTimeoutMs / 1000}s; the previous version is still serving`);
+        for (const line of await this.diagnostics(deployment).catch(() => [])) this.log(deployment, `  ${line}`);
+    }
+
+    private async rolled(appName : string) : Promise<boolean> {
+        const {services} = await this.aws.ecs.send(new DescribeServicesCommand({
+            cluster: this.options.cluster,
+            services: [this.serviceNameFor(appName)],
+        }));
+        const deployments : Array<{ status? : string, rolloutState? : string, runningCount? : number }> = services?.[0]?.deployments ?? [];
+        const primary = deployments.find(each => each.status === "PRIMARY");
+
+        return deployments.length === 1 && primary !== undefined
+            && (primary.rolloutState === "COMPLETED" || (primary.rolloutState === undefined && (primary.runningCount ?? 0) > 0));
+    }
+
     protected async stop(deployment : Deployment) : Promise<void> {
         if (this.deployments.get(deployment.appName) !== deployment) return;
 
@@ -192,6 +257,7 @@ class FargateBuildLayer extends BaseBuildLayer {
         const registered = await this.aws.ecs.send(new RegisterTaskDefinitionCommand({
             family: this.serviceNameFor(deployment.appName),
             requiresCompatibilities: ["FARGATE"],
+            ...this.taggedWith(),
             networkMode: "awsvpc",
             ...TASK_SIZES[deployment.size],
             executionRoleArn: this.options.appExecutionRoleArn,
@@ -203,6 +269,7 @@ class FargateBuildLayer extends BaseBuildLayer {
                 // The most Fargate allows between SIGTERM and SIGKILL, so an
                 // app signalled with steps still in hand gets to finish them.
                 stopTimeout: 120,
+                ...(deployment.zeroDowntime ? { healthCheck: adminHealthCheck(deployment.adminPort) } : {}),
                 portMappings: [
                     { containerPort: deployment.appPort, protocol: "tcp" },
                     { containerPort: deployment.adminPort, protocol: "tcp" },
@@ -280,6 +347,7 @@ class FargateBuildLayer extends BaseBuildLayer {
                 taskDefinition,
                 desiredCount: 1,
                 forceNewDeployment: true,
+                ...this.propagatingTags(),
             }));
             return;
         }
@@ -291,6 +359,8 @@ class FargateBuildLayer extends BaseBuildLayer {
             taskDefinition,
             desiredCount: 1,
             launchType: "FARGATE",
+            ...this.taggedWith(),
+            ...this.propagatingTags(),
             networkConfiguration: {
                 awsvpcConfiguration: {
                     subnets: this.options.subnets,
@@ -358,6 +428,7 @@ class FargateBuildLayer extends BaseBuildLayer {
             appPort,
             appHost: this.appHostFor(appName),
             size: sizeOfTask(taskDefinition.memory),
+            zeroDowntime: false,
             adminPort: port("ANBARIC_ADMIN_PORT", 8791),
             consumerPort: port("ANBARIC_CONSUMER_PORT", 0),
             log: [],
@@ -368,6 +439,16 @@ class FargateBuildLayer extends BaseBuildLayer {
         return `anbaric-app-${appName}`;
     }
 
+    private taggedWith() : { tags? : Array<{ key : string, value : string }> } {
+        const entries = Object.entries(this.options.tags ?? {});
+        return entries.length === 0 ? {} : { tags: entries.map(([key, value]) => ({ key, value })) };
+    }
+
+    // The task definition's tags become each task's, which is where the cost is.
+    private propagatingTags() : { propagateTags? : "TASK_DEFINITION" } {
+        return Object.keys(this.options.tags ?? {}).length === 0 ? {} : { propagateTags: "TASK_DEFINITION" };
+    }
+
     private buildKeyFor(appName : string) : string {
         return `builds/${appName}.tar.gz`;
     }

package/src/data-store/AppSettingsStore.ts

@@ -0,0 +1,30 @@
+/* What a builder has chosen for an app beyond its code: the things set in
+   the console that a redeploy must not forget. Kept by the platform rather
+   than inferred from the running infrastructure, so changing one never
+   restarts anything. */
+type AppSettings = {
+    appName : string,
+    /* A deploy brings the new version up beside the old and only then lets
+       the old go, instead of stopping the old first. Priced, and off unless
+       the builder turns it on. */
+    zeroDowntime : boolean,
+};
+
+const DEFAULT_SETTINGS : Omit<AppSettings, "appName"> = { zeroDowntime: false };
+
+interface AppSettingsStore {
+
+    // The defaults for an app nobody has configured.
+    get(appName : string) : Promise<AppSettings>;
+
+    set(appName : string, settings : Partial<Omit<AppSettings, "appName">>) : Promise<AppSettings>;
+
+    list() : Promise<Array<AppSettings>>;
+
+    // Forgotten with the app, so a later app of the same name starts afresh.
+    remove(appName : string) : Promise<void>;
+
+}
+
+export type { AppSettings, AppSettingsStore };
+export { DEFAULT_SETTINGS };

package/src/data-store/InMemoryAppSettingsStore.ts

@@ -0,0 +1,27 @@
+import {AppSettings, AppSettingsStore, DEFAULT_SETTINGS} from "./AppSettingsStore";
+
+class InMemoryAppSettingsStore implements AppSettingsStore {
+
+    private settings = new Map<string, AppSettings>();
+
+    async get(appName : string) : Promise<AppSettings> {
+        return { ...(this.settings.get(appName) ?? { appName, ...DEFAULT_SETTINGS }) };
+    }
+
+    async set(appName : string, settings : Partial<Omit<AppSettings, "appName">>) : Promise<AppSettings> {
+        const updated = { ...(await this.get(appName)), ...settings, appName };
+        this.settings.set(appName, updated);
+        return { ...updated };
+    }
+
+    async list() : Promise<Array<AppSettings>> {
+        return [...this.settings.values()].map(settings => ({ ...settings }));
+    }
+
+    async remove(appName : string) : Promise<void> {
+        this.settings.delete(appName);
+    }
+
+}
+
+export { InMemoryAppSettingsStore };

package/src/data-store/InMemorySkillStore.ts

@@ -0,0 +1,31 @@
+import {Skill, SkillDraft, SkillStore} from "./SkillStore";
+
+class InMemorySkillStore implements SkillStore {
+
+    private skills = new Map<string, Skill>();
+
+    async list() : Promise<Array<Skill>> {
+        return [...this.skills.values()]
+            .sort((left, right) => left.id.localeCompare(right.id))
+            .map(skill => ({ ...skill }));
+    }
+
+    async get(id : string) : Promise<Skill | undefined> {
+        const skill = this.skills.get(id);
+        return skill && { ...skill };
+    }
+
+    async save(draft : SkillDraft) : Promise<Skill> {
+        const now = new Date();
+        const saved : Skill = { ...draft, createdAt: this.skills.get(draft.id)?.createdAt ?? now, updatedAt: now };
+        this.skills.set(draft.id, saved);
+        return { ...saved };
+    }
+
+    async remove(id : string) : Promise<boolean> {
+        return this.skills.delete(id);
+    }
+
+}
+
+export { InMemorySkillStore };

package/src/data-store/PlatformMigrations.ts

@@ -262,6 +262,31 @@ const PLATFORM_MIGRATIONS : Array<Migration> = [
         "CREATE INDEX IF NOT EXISTS audit_records_at ON anbaric_system.audit_records (at)",
     ),
 
+    /* What a builder has set for an app in the console, kept apart from the
+       app's running infrastructure so that changing a setting never restarts
+       it. An app with no row has the defaults. */
+    statements("007-app-settings",
+        `CREATE TABLE IF NOT EXISTS app_settings (
+            app_name      TEXT PRIMARY KEY,
+            zero_downtime BOOLEAN NOT NULL DEFAULT false,
+            updated_at    TIMESTAMPTZ NOT NULL DEFAULT now()
+        )`,
+    ),
+
+    /* Guidance the tenant's builders write for the agents that work on it:
+       usage hints say when to reach for a skill, the body says what to do.
+       A platform table rather than workflow data, since apps never see it. */
+    statements("008-skills",
+        `CREATE TABLE IF NOT EXISTS anbaric_system.skills (
+            id          TEXT PRIMARY KEY,
+            title       TEXT NOT NULL,
+            usage_hints TEXT NOT NULL,
+            body        TEXT NOT NULL,
+            created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+            updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+        )`,
+    ),
+
 ];
 
 export { PLATFORM_MIGRATIONS };

package/src/data-store/PostgresAppSettingsStore.ts

@@ -0,0 +1,40 @@
+import {Pool} from "pg";
+import {AppSettings, AppSettingsStore, DEFAULT_SETTINGS} from "./AppSettingsStore";
+
+const rowToSettings = (row : any) : AppSettings => ({
+    appName: row.app_name,
+    zeroDowntime: row.zero_downtime,
+});
+
+class PostgresAppSettingsStore implements AppSettingsStore {
+
+    constructor(private pool : Pool) {}
+
+    async get(appName : string) : Promise<AppSettings> {
+        const result = await this.pool.query(
+            "SELECT app_name, zero_downtime FROM app_settings WHERE app_name = $1", [appName]);
+        return result.rows[0] ? rowToSettings(result.rows[0]) : { appName, ...DEFAULT_SETTINGS };
+    }
+
+    async set(appName : string, settings : Partial<Omit<AppSettings, "appName">>) : Promise<AppSettings> {
+        const merged = { ...(await this.get(appName)), ...settings };
+        const result = await this.pool.query(
+            `INSERT INTO app_settings (app_name, zero_downtime) VALUES ($1, $2)
+             ON CONFLICT (app_name) DO UPDATE SET zero_downtime = EXCLUDED.zero_downtime, updated_at = now()
+             RETURNING app_name, zero_downtime`,
+            [appName, merged.zeroDowntime]);
+        return rowToSettings(result.rows[0]);
+    }
+
+    async list() : Promise<Array<AppSettings>> {
+        const result = await this.pool.query("SELECT app_name, zero_downtime FROM app_settings ORDER BY app_name");
+        return result.rows.map(rowToSettings);
+    }
+
+    async remove(appName : string) : Promise<void> {
+        await this.pool.query("DELETE FROM app_settings WHERE app_name = $1", [appName]);
+    }
+
+}
+
+export { PostgresAppSettingsStore };

package/src/data-store/PostgresSkillStore.ts

@@ -0,0 +1,47 @@
+import {Pool} from "pg";
+import {Skill, SkillDraft, SkillStore} from "./SkillStore";
+
+const COLUMNS = "id, title, usage_hints, body, created_at, updated_at";
+
+const rowToSkill = (row : any) : Skill => ({
+    id: row.id,
+    title: row.title,
+    usageHints: row.usage_hints,
+    body: row.body,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+});
+
+class PostgresSkillStore implements SkillStore {
+
+    constructor(private pool : Pool) {}
+
+    async list() : Promise<Array<Skill>> {
+        const result = await this.pool.query(`SELECT ${COLUMNS} FROM anbaric_system.skills ORDER BY id`);
+        return result.rows.map(rowToSkill);
+    }
+
+    async get(id : string) : Promise<Skill | undefined> {
+        const result = await this.pool.query(`SELECT ${COLUMNS} FROM anbaric_system.skills WHERE id = $1`, [id]);
+        return result.rows[0] && rowToSkill(result.rows[0]);
+    }
+
+    async save(draft : SkillDraft) : Promise<Skill> {
+        const result = await this.pool.query(
+            `INSERT INTO anbaric_system.skills (id, title, usage_hints, body)
+             VALUES ($1, $2, $3, $4)
+             ON CONFLICT (id) DO UPDATE
+                 SET title = EXCLUDED.title, usage_hints = EXCLUDED.usage_hints, body = EXCLUDED.body, updated_at = now()
+             RETURNING ${COLUMNS}`,
+            [draft.id, draft.title, draft.usageHints, draft.body]);
+        return rowToSkill(result.rows[0]);
+    }
+
+    async remove(id : string) : Promise<boolean> {
+        const result = await this.pool.query("DELETE FROM anbaric_system.skills WHERE id = $1", [id]);
+        return (result.rowCount ?? 0) > 0;
+    }
+
+}
+
+export { PostgresSkillStore };

package/src/data-store/SkillStore.ts

@@ -0,0 +1,38 @@
+/* A skill is guidance a tenant writes for the agents that build on it: when to
+   reach for it (the usage hints, which an agent reads before deciding) and
+   what to do (the body, which it reads once it has decided). Kept by the
+   platform, managed from the console, and never handed to deployed apps. */
+type Skill = {
+    id : string,
+    title : string,
+    usageHints : string,
+    body : string,
+    createdAt : Date,
+    updatedAt : Date,
+};
+
+type SkillDraft = Omit<Skill, "createdAt" | "updatedAt">;
+
+/* The id ends up as the tail of a tool name an agent sees, after a fixed
+   prefix, and tool names are capped at 64 characters: hence the shape and
+   the length. */
+const SKILL_ID_SHAPE = /^[a-z0-9][a-z0-9-]{0,49}$/;
+
+const isSkillId = (value : unknown) : value is string =>
+    typeof value === "string" && SKILL_ID_SHAPE.test(value);
+
+interface SkillStore {
+
+    list() : Promise<Array<Skill>>;
+
+    get(id : string) : Promise<Skill | undefined>;
+
+    // Creates or replaces the skill with that id.
+    save(draft : SkillDraft) : Promise<Skill>;
+
+    remove(id : string) : Promise<boolean>;
+
+}
+
+export type { Skill, SkillDraft, SkillStore };
+export { SKILL_ID_SHAPE, isSkillId };

package/src/hosting/HostingServer.ts

@@ -13,6 +13,9 @@ import {MyAppsHandler} from "./handlers/MyAppsHandler";
 import {MembersHandler} from "./handlers/auth/MembersHandler";
 import {BillingHandler} from "./handlers/BillingHandler";
 import {CentralBilling} from "../billing/CentralBilling";
+import {AppSettingsStore} from "../data-store/AppSettingsStore";
+import {SkillStore} from "../data-store/SkillStore";
+import {SkillsHandler} from "./handlers/SkillsHandler";
 import {Subdomains} from "../subdomains/Subdomains";
 import {AuditsHandler} from "./handlers/AuditsHandler";
 import {AuthorizeCliHandler} from "./handlers/auth/AuthorizeCliHandler";
@@ -81,7 +84,9 @@ class HostingServer {
                 promptManagerFor? : (appId : string) => PromptManager,
                 fileStorageFor? : (appId : string) => FileStorage,
                 subdomains? : Subdomains,
-                billing? : CentralBilling) {
+                billing? : CentralBilling,
+                appSettings? : AppSettingsStore,
+                skills? : SkillStore) {
         const pages = new PagesHandler();
         const ping = new PingHandler(tenant);
         const jobs = new JobsHandler(persistence);
@@ -117,6 +122,8 @@ class HostingServer {
         if (memberships) publicRouter.registerApi("invitations", new InvitationsHandler(memberships, entitlements));
         if (memberships) publicRouter.registerApi("members", new MembersHandler(memberships, entitlements));
         if (billing) publicRouter.registerApi("billing", new BillingHandler(billing));
+        // People and their agents only: a deployed app has no business reading skills.
+        if (skills) publicRouter.registerApi("skills", new SkillsHandler(skills));
         const prompts = promptManagerFor && new PromptsHandler(promptManagerFor);
         if (prompts) publicRouter.registerApi("prompts", prompts);
         if (cliAuthorizer) {
@@ -130,7 +137,7 @@ class HostingServer {
             buildLayer.consumerUrlsFor = appName =>
                 [...new Set(registry.list().filter(consumer => consumer.appId === appName).map(consumer => consumer.url))];
             buildLayer.appRemoved = appName => void subdomains?.release(appName);
-            publicRouter.registerApi("apps", new AppsHandler(buildLayer, tenant, subdomains));
+            publicRouter.registerApi("apps", new AppsHandler(buildLayer, tenant, subdomains, appSettings));
             publicRouter.register("app", appProxy);
 
             // The directory a person who is not a builder sees instead of the