wizards 0.1.9

package/apps/runtime/dist/render/convert.js

@@ -0,0 +1,161 @@
+import HTMLtoDOCX from "@turbodocx/html-to-docx";
+import ExcelJS from "exceljs";
+import { marked } from "marked";
+import TurndownService from "turndown";
+import { offlineContext } from "./chromium.js";
+const turndown = new TurndownService({ headingStyle: "atx", codeBlockStyle: "fenced" });
+export const MIME = {
+    png: "image/png",
+    mp4: "video/mp4",
+    mp3: "audio/mpeg",
+    pdf: "application/pdf",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    html: "text/html",
+    md: "text/markdown",
+    txt: "text/plain",
+    csv: "text/csv",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    json: "application/json",
+    zip: "application/zip",
+};
+/** A calm print stylesheet for documents written as Markdown. */
+export function markdownToHtml(markdown, title = "Document") {
+    const body = marked.parse(markdown, { async: false });
+    return `<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title>
+<style>
+  @page { size: A4; margin: 22mm 20mm; }
+  body { font-family: "Inter", "Helvetica Neue", Arial, sans-serif; color: #1d1a17; line-height: 1.55; font-size: 11pt; max-width: 760px; margin: 40px auto; padding: 0 24px; }
+  h1 { font-size: 22pt; line-height: 1.2; margin: 0 0 12pt; }
+  h2 { font-size: 14pt; margin: 22pt 0 6pt; }
+  h3 { font-size: 12pt; margin: 16pt 0 4pt; }
+  table { border-collapse: collapse; width: 100%; margin: 10pt 0; font-size: 10pt; }
+  th, td { border-bottom: 1px solid #e6e1da; padding: 6pt 8pt; text-align: left; vertical-align: top; }
+  th { font-weight: 600; background: #f7f4ef; }
+  a { color: #b4532a; }
+  blockquote { border-left: 3px solid #e6e1da; margin: 0; padding-left: 12pt; color: #5d564e; }
+  code { background: #f4f1ec; padding: 1px 4px; border-radius: 3px; }
+  @media print { body { margin: 0; padding: 0; max-width: none; } }
+</style></head><body>${body}</body></html>`;
+}
+export function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+export function htmlToMarkdown(html) {
+    const body = html.match(/<body[^>]*>([\s\S]*)<\/body>/i)?.[1] ?? html;
+    return turndown.turndown(body.replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<script[\s\S]*?<\/script>/gi, ""));
+}
+export async function htmlToPdf(html) {
+    const context = await offlineContext();
+    try {
+        const page = await context.newPage();
+        await page.setContent(html, { waitUntil: "networkidle", timeout: 30_000 });
+        return await page.pdf({ format: "A4", printBackground: true, preferCSSPageSize: true });
+    }
+    finally {
+        await context.close();
+    }
+}
+export async function htmlToPng(html, width = 1200, opts = {}) {
+    const context = await offlineContext({
+        viewport: { width, height: opts.height ?? 900 },
+        deviceScaleFactor: opts.scale ?? 2,
+    });
+    try {
+        const page = await context.newPage();
+        await page.setContent(html, { waitUntil: "networkidle", timeout: 30_000 });
+        return await page.screenshot({ fullPage: opts.fullPage ?? true, type: "png" });
+    }
+    finally {
+        await context.close();
+    }
+}
+export async function htmlToDocx(html) {
+    const cleaned = html.replace(/<script[\s\S]*?<\/script>/gi, "");
+    const out = await HTMLtoDOCX(cleaned, null, {
+        table: { row: { cantSplit: true } },
+        font: "Arial",
+    });
+    if (out instanceof ArrayBuffer) {
+        return new Uint8Array(out);
+    }
+    if (typeof Blob !== "undefined" && out instanceof Blob) {
+        return new Uint8Array(await out.arrayBuffer());
+    }
+    return new Uint8Array(out);
+}
+/** The first array of objects inside a JSON value — the table a step produced. */
+export function firstTable(value) {
+    if (Array.isArray(value) && value.every((r) => r && typeof r === "object" && !Array.isArray(r))) {
+        return value;
+    }
+    if (value && typeof value === "object") {
+        for (const v of Object.values(value)) {
+            const t = firstTable(v);
+            if (t) {
+                return t;
+            }
+        }
+    }
+    return null;
+}
+function tableColumns(rows) {
+    return [...new Set(rows.flatMap((r) => Object.keys(r)))];
+}
+function cell(v) {
+    return v === null || v === undefined ? "" : typeof v === "object" ? JSON.stringify(v) : String(v);
+}
+export function tableToCsv(rows) {
+    const cols = tableColumns(rows);
+    const esc = (s) => (/[",\n;]/.test(s) ? `"${s.replace(/"/g, '""')}"` : s);
+    return [
+        cols.map(esc).join(","),
+        ...rows.map((r) => cols.map((c) => esc(cell(r[c]))).join(",")),
+    ].join("\n");
+}
+/** Every table of a step's JSON result, by its key; a bare array is the one table "Data". */
+export function allTables(value) {
+    const isTable = (v) => Array.isArray(v) &&
+        v.length > 0 &&
+        v.every((r) => r && typeof r === "object" && !Array.isArray(r));
+    if (isTable(value)) {
+        return [{ name: "Data", rows: value }];
+    }
+    if (!value || typeof value !== "object") {
+        return [];
+    }
+    return Object.entries(value).flatMap(([name, v]) => isTable(v)
+        ? [{ name, rows: v }]
+        : Array.isArray(v) && v.length && v.every((x) => typeof x !== "object")
+            ? [{ name, rows: v.map((x) => ({ [name]: x })) }]
+            : []);
+}
+/** A workbook with one sheet per table. `headers` renames columns (column id → label). */
+export async function tablesToXlsx(tables) {
+    const wb = new ExcelJS.Workbook();
+    for (const [index, table] of tables.entries()) {
+        const ws = wb.addWorksheet(table.name.replace(/[\\/*?:[\]]/g, " ").slice(0, 31) || `Sheet${index + 1}`);
+        const cols = table.headers ? Object.keys(table.headers) : tableColumns(table.rows);
+        ws.columns = cols.map((c) => {
+            const header = table.headers?.[c] ?? c;
+            return { header, key: c, width: Math.min(40, Math.max(12, header.length + 4)) };
+        });
+        for (const r of table.rows) {
+            ws.addRow(Object.fromEntries(cols.map((c) => [c, typeof r[c] === "number" ? r[c] : cell(r[c])])));
+        }
+        ws.getRow(1).font = { bold: true };
+    }
+    return new Uint8Array(await wb.xlsx.writeBuffer());
+}
+export function tableToXlsx(rows) {
+    return tablesToXlsx([{ name: "Data", rows }]);
+}
+export function jsonToMarkdown(value) {
+    const rows = firstTable(value);
+    if (rows?.length) {
+        const cols = tableColumns(rows);
+        const head = `| ${cols.join(" | ")} |\n| ${cols.map(() => "---").join(" | ")} |`;
+        const body = rows.map((r) => `| ${cols.map((c) => cell(r[c]).replace(/\|/g, "\\|")).join(" | ")} |`);
+        return [head, ...body].join("\n");
+    }
+    return `\`\`\`json\n${JSON.stringify(value, null, 2)}\n\`\`\``;
+}

package/apps/runtime/dist/render/downloads.js

@@ -0,0 +1,277 @@
+import { formatsFor, widgetSize } from "@engenty-wizards/shared/definition";
+import { listAsMarkdown } from "@engenty-wizards/shared/store";
+import { and, eq } from "drizzle-orm";
+import { zipSync } from "fflate";
+import { db, schema } from "../db/client.js";
+import { extFor, inlineAssetRefs, loadAsset, loadAssetText, saveAsset } from "../files/storage.js";
+import { widgetMp4, widgetPdf, widgetPng } from "../widgets/render.js";
+import { allTables, firstTable, htmlToDocx, htmlToMarkdown, htmlToPdf, htmlToPng, jsonToMarkdown, MIME, markdownToHtml, tablesToXlsx, tableToCsv, } from "./convert.js";
+import { guardHtml } from "./guard.js";
+export function slug(s) {
+    return (s
+        .toLowerCase()
+        .normalize("NFKD")
+        .replace(/[̀-ͯ]/g, "")
+        .replace(/ß/g, "ss")
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-|-$/g, "")
+        .slice(0, 60) || "result");
+}
+/**
+ * Renders of an asset (PDF, PNG, MP4 …) are kept next to it: a shared link opened a hundred
+ * times renders once. A regenerated output is a new asset, so its renders start fresh.
+ */
+async function cachedRender(source, format, produce) {
+    const name = `${source.id}.${format}`;
+    const hit = await db.query.asset.findFirst({
+        where: and(eq(schema.asset.kind, "render"), eq(schema.asset.name, name)),
+    });
+    if (hit) {
+        const found = await loadAsset(hit.id);
+        if (found) {
+            return new Uint8Array(found.data);
+        }
+    }
+    const data = await produce();
+    if (data) {
+        const row = await db.query.asset.findFirst({ where: eq(schema.asset.id, source.id) });
+        await saveAsset({
+            runId: row?.runId ?? null,
+            stepId: row?.stepId ?? null,
+            kind: "render",
+            mime: MIME[format],
+            name,
+            data,
+        });
+    }
+    return data;
+}
+/** The HTML a step produced, ready to show or save: images inlined, network and frames locked. */
+export async function stepHtml(output) {
+    const asset = output.assets?.find((a) => a.mime === "text/html");
+    if (!asset) {
+        return null;
+    }
+    return guardHtml(await inlineAssetRefs(await loadAssetText(asset.id)));
+}
+/** One step's output in one format. Conversions happen on demand. */
+export async function renderDownload(step, output, format, baseName) {
+    if (!formatsFor(step).includes(format)) {
+        return null;
+    }
+    const name = slug(baseName);
+    const file = (ext) => `${name}.${ext}`;
+    if (step.type === "widget" && step.video) {
+        // A film was rendered when its step ran: the video and its poster are the files.
+        const asset = output.assets?.find((a) => a.kind === (format === "mp4" ? "video" : "poster"));
+        const found = asset ? await loadAsset(asset.id) : null;
+        return found
+            ? { data: new Uint8Array(found.data), mime: found.row.mime, filename: file(format) }
+            : null;
+    }
+    if (step.type === "widget") {
+        const source = output.assets?.find((a) => a.mime === "text/html");
+        if (format === "json") {
+            return {
+                data: JSON.stringify(output.json ?? {}, null, 2),
+                mime: MIME.json,
+                filename: file("json"),
+            };
+        }
+        if (!source) {
+            return null;
+        }
+        const html = await loadAssetText(source.id);
+        const size = widgetSize(step);
+        const data = format === "html"
+            ? html
+            : await cachedRender(source, format, async () => {
+                switch (format) {
+                    case "png":
+                        return widgetPng(html, size);
+                    case "pdf":
+                        return widgetPdf(html, size);
+                    case "mp4":
+                        return output.widget?.duration ? widgetMp4(html, size) : null;
+                    default:
+                        return null;
+                }
+            });
+        return data ? { data, mime: MIME[format], filename: file(format) } : null;
+    }
+    if (step.type === "generate") {
+        const asset = output.assets?.[0];
+        if (!asset) {
+            return null;
+        }
+        if (format === "zip") {
+            const zip = await zipAssets(output.assets ?? []);
+            return zip ? { data: zip, mime: MIME.zip, filename: file("zip") } : null;
+        }
+        if (step.asset === "image" || step.asset === "video" || step.asset === "voice") {
+            const found = await loadAsset(asset.id);
+            return found
+                ? {
+                    data: new Uint8Array(found.data),
+                    mime: found.row.mime,
+                    filename: file(extFor(found.row.mime)),
+                }
+                : null;
+        }
+        const html = await inlineAssetRefs(await loadAssetText(asset.id));
+        const render = (produce) => cachedRender(asset, format, produce);
+        switch (format) {
+            case "html":
+                return { data: guardHtml(html), mime: MIME.html, filename: file("html") };
+            case "pdf":
+                return { data: await render(() => htmlToPdf(html)), mime: MIME.pdf, filename: file("pdf") };
+            case "png":
+                return { data: await render(() => htmlToPng(html)), mime: MIME.png, filename: file("png") };
+            case "docx":
+                return {
+                    data: await render(() => htmlToDocx(html)),
+                    mime: MIME.docx,
+                    filename: file("docx"),
+                };
+            case "md":
+                return { data: htmlToMarkdown(html), mime: MIME.md, filename: file("md") };
+            default:
+                return null;
+        }
+    }
+    if (step.type === "agent") {
+        if (format === "zip") {
+            const zip = await zipAssets(output.assets?.filter((a) => a.kind === "file") ?? []);
+            return zip ? { data: zip, mime: MIME.zip, filename: file("zip") } : null;
+        }
+        const text = output.text ?? "";
+        if (step.output.format === "json") {
+            const rows = firstTable(output.json);
+            const tables = allTables(output.json);
+            switch (format) {
+                case "json":
+                    return {
+                        data: JSON.stringify(output.json, null, 2),
+                        mime: MIME.json,
+                        filename: file("json"),
+                    };
+                case "csv":
+                    return rows ? { data: tableToCsv(rows), mime: MIME.csv, filename: file("csv") } : null;
+                case "xlsx":
+                    return tables.length
+                        ? { data: await tablesToXlsx(tables), mime: MIME.xlsx, filename: file("xlsx") }
+                        : null;
+                case "md":
+                    return { data: jsonAsMarkdown(output.json), mime: MIME.md, filename: file("md") };
+                default:
+                    return null;
+            }
+        }
+        switch (format) {
+            case "md":
+                return { data: text, mime: MIME.md, filename: file("md") };
+            case "txt":
+                return { data: text, mime: MIME.txt, filename: file("txt") };
+            case "html":
+                return { data: markdownToHtml(text, baseName), mime: MIME.html, filename: file("html") };
+            case "pdf":
+                return {
+                    data: await htmlToPdf(markdownToHtml(text, baseName)),
+                    mime: MIME.pdf,
+                    filename: file("pdf"),
+                };
+            case "docx":
+                return {
+                    data: await htmlToDocx(markdownToHtml(text, baseName)),
+                    mime: MIME.docx,
+                    filename: file("docx"),
+                };
+            default:
+                return null;
+        }
+    }
+    return null;
+}
+/** A structured result as readable Markdown: text fields as paragraphs, tables as tables. */
+/** The files a step collected, as one archive. Two files of the same name both stay. */
+async function zipAssets(assets) {
+    const entries = {};
+    for (const asset of assets) {
+        const found = await loadAsset(asset.id);
+        if (!found) {
+            continue;
+        }
+        let name = asset.name;
+        for (let n = 2; name in entries; n++) {
+            name = asset.name.replace(/(\.[^.]+)?$/, (ext) => `-${n}${ext}`);
+        }
+        entries[name] = new Uint8Array(found.data);
+    }
+    return Object.keys(entries).length ? zipSync(entries, { level: 6 }) : null;
+}
+/**
+ * A stored list in one format. Column labels head the spreadsheet; ids stay the JSON keys.
+ * `files` reads a kept file by its path — a zip holds the files the rows name, and the list.
+ */
+export async function listDownload(def, rows, format, baseName, files) {
+    const name = slug(baseName);
+    if (format === "zip") {
+        const column = def.check?.file;
+        if (!column || !files) {
+            return null;
+        }
+        const entries = {};
+        for (const row of rows) {
+            const path = String(row.cells[column] ?? "").trim();
+            const data = path && !(path in entries) ? await files(path) : null;
+            if (data) {
+                entries[path] = data;
+            }
+        }
+        const sheet = await listDownload(def, rows, "xlsx", baseName);
+        if (sheet) {
+            entries[sheet.filename] = sheet.data;
+        }
+        return { data: zipSync(entries, { level: 6 }), mime: MIME.zip, filename: `${name}.zip` };
+    }
+    const cells = rows.map((r) => r.cells);
+    const headers = Object.fromEntries(def.columns.map((c) => [c.id, c.name]));
+    const labelled = cells.map((row) => Object.fromEntries(def.columns.map((c) => [c.name, row[c.id] ?? null])));
+    switch (format) {
+        case "xlsx":
+            return {
+                data: await tablesToXlsx([{ name: def.title, rows: cells, headers }]),
+                mime: MIME.xlsx,
+                filename: `${name}.xlsx`,
+            };
+        case "csv":
+            return { data: tableToCsv(labelled), mime: MIME.csv, filename: `${name}.csv` };
+        case "json":
+            return { data: JSON.stringify(cells, null, 2), mime: MIME.json, filename: `${name}.json` };
+        case "md":
+            return {
+                data: `# ${def.title}\n\n${listAsMarkdown(def, rows, 5000)}`,
+                mime: MIME.md,
+                filename: `${name}.md`,
+            };
+        default:
+            return null;
+    }
+}
+export function jsonAsMarkdown(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return jsonToMarkdown(value);
+    }
+    return Object.entries(value)
+        .map(([key, v]) => {
+        const heading = `### ${key}`;
+        if (typeof v === "string" || typeof v === "number") {
+            return `${heading}\n${v}`;
+        }
+        if (Array.isArray(v) && v.every((x) => typeof x !== "object")) {
+            return `${heading}\n${v.map((x) => `- ${x}`).join("\n")}`;
+        }
+        return `${heading}\n${jsonToMarkdown(v)}`;
+    })
+        .join("\n\n");
+}

package/apps/runtime/dist/render/guard.js

@@ -0,0 +1,25 @@
+/**
+ * Every generated HTML document (documents, dashboards, widgets) gets this before anyone sees
+ * it: scripts may run, but the page can load nothing and send nothing — everything it shows is
+ * inlined. Links open in a new tab instead of inside the preview frame.
+ */
+export const HTML_CSP = "default-src 'none'; script-src 'unsafe-inline' 'unsafe-eval'; style-src 'unsafe-inline'; img-src data: blob:; media-src data: blob:; font-src data:; connect-src data: blob:; worker-src blob:";
+/** The response header for a generated document opened on its own: an opaque origin, scripts allowed. */
+export const HTML_RESPONSE_CSP = `sandbox allow-scripts allow-popups allow-popups-to-escape-sandbox; ${HTML_CSP}`;
+/**
+ * `media`: one more origin images, video and audio may come from — a film's page gets this
+ * run's clips from the renderer that way; they are too large to inline.
+ */
+export function guardHtml(html, media) {
+    const csp = media
+        ? HTML_CSP.replace("img-src", `img-src ${media}`).replace("media-src", `media-src ${media}`)
+        : HTML_CSP;
+    const head = `<meta http-equiv="Content-Security-Policy" content="${csp}"><base target="_blank">`;
+    if (/<head[^>]*>/i.test(html)) {
+        return html.replace(/<head[^>]*>/i, (m) => `${m}${head}`);
+    }
+    if (/<html[^>]*>/i.test(html)) {
+        return html.replace(/<html[^>]*>/i, (m) => `${m}<head>${head}</head>`);
+    }
+    return `<!doctype html><html><head>${head}</head><body>${html}</body></html>`;
+}

package/apps/runtime/dist/routes/api.js

@@ -0,0 +1,74 @@
+import { Hono } from "hono";
+import { z } from "zod";
+import { withTenant } from "../db/client.js";
+import { authenticate, principalOf } from "../mcp/auth.js";
+import { ServiceError } from "../services/errors.js";
+import { deleteFile, draftFiles, writeFile } from "../services/files.js";
+import { createWizard, ownedWizard, publishWizard, writeDraft } from "../services/wizards.js";
+import { tenantStatus } from "../tenants/control.js";
+const importSchema = z.object({
+    /** An earlier import's wizard: it is updated instead of a new one being made. */
+    wizardId: z.string().optional(),
+    projectId: z.string().optional(),
+    definition: z.unknown(),
+    files: z
+        .array(z.object({ path: z.string(), mime: z.string().optional(), data: z.string() }))
+        .max(200)
+        .default([]),
+    publish: z.boolean().default(false),
+});
+/**
+ * The runtime's API for other programs, signed in like an MCP client (access token or API key).
+ * `POST /wizards/import` takes a whole wizard — definition and workspace — validated like any
+ * other write: this is how a desktop app publishes to the cloud.
+ */
+export const apiRoutes = new Hono().post("/wizards/import", async (c) => {
+    const authInfo = await authenticate(c.req.raw);
+    if (authInfo instanceof Response) {
+        return authInfo;
+    }
+    const who = principalOf(authInfo);
+    const body = importSchema.parse(await c.req.json());
+    if (!who.scopes.includes("wizards:write") ||
+        (body.publish && !who.scopes.includes("wizards:publish"))) {
+        return c.json({ error: "This token may not do that.", code: "insufficient_scope" }, 403);
+    }
+    if ((await tenantStatus(who.tenantId)) === "suspended") {
+        return c.json({ error: "tenant_suspended" }, 403);
+    }
+    return withTenant(who.tenantId, async () => {
+        const writer = { source: "mcp", client: who.client };
+        let wizardId = body.wizardId;
+        if (wizardId) {
+            const existing = await ownedWizard(who.userId, wizardId).catch(() => null);
+            wizardId = existing?.id;
+        }
+        if (!wizardId) {
+            // The workspace must be there before the definition is checked against it.
+            const created = await createWizard(who.userId, { projectId: body.projectId }, writer);
+            wizardId = created.id;
+        }
+        const incoming = new Set(body.files.map((f) => f.path));
+        for (const old of await draftFiles(wizardId)) {
+            if (!incoming.has(old.path)) {
+                await deleteFile(who.userId, wizardId, old.path);
+            }
+        }
+        for (const file of body.files) {
+            await writeFile(who.userId, wizardId, file.path, Buffer.from(file.data, "base64"), file.mime);
+        }
+        const current = await ownedWizard(who.userId, wizardId);
+        const written = await writeDraft(who.userId, wizardId, { definition: body.definition, baseRevision: current.revision }, writer);
+        if (!body.publish) {
+            return c.json({ wizardId, revision: written.revision, issues: written.issues });
+        }
+        if (written.issues.length) {
+            throw new ServiceError("has_issues", "Der Wizard hat noch Fehler.", {
+                issues: written.issues,
+                wizardId,
+            });
+        }
+        const published = await publishWizard(who.userId, wizardId);
+        return c.json({ wizardId, revision: written.revision, issues: [], ...published });
+    });
+});

package/apps/runtime/dist/routes/delivery.js

@@ -0,0 +1,52 @@
+import { basePath } from "../env.js";
+/** Uploads stay small; a clip from the phone's camera is the one thing that needs more room. */
+export function uploadLimit(mime) {
+    return mime.startsWith("video/") ? 40_000_000 : 15_000_000;
+}
+export function wizardManifest(token, title, description) {
+    const start = `${basePath}/w/${token}`;
+    return {
+        id: start,
+        name: title,
+        short_name: title.length > 14 ? `${title.slice(0, 13).trimEnd()}…` : title,
+        description,
+        start_url: start,
+        scope: `${basePath}/`,
+        display: "standalone",
+        background_color: "#faf8f5",
+        theme_color: "#faf8f5",
+        icons: [
+            {
+                src: `${basePath}/studio/icons/icon-192.png`,
+                sizes: "192x192",
+                type: "image/png",
+                purpose: "any",
+            },
+            {
+                src: `${basePath}/studio/icons/icon-512.png`,
+                sizes: "512x512",
+                type: "image/png",
+                purpose: "any",
+            },
+            {
+                src: `${basePath}/studio/icons/icon-maskable-512.png`,
+                sizes: "512x512",
+                type: "image/png",
+                purpose: "maskable",
+            },
+        ],
+    };
+}
+/**
+ * One byte range of a file, as phones ask for audio and video: Safari plays a clip only from a
+ * server that answers ranges. `null` = no (usable) range asked, send it whole.
+ */
+export function byteRange(header, size) {
+    const m = header?.match(/^bytes=(\d*)-(\d*)$/);
+    if (!m || (!m[1] && !m[2]) || size === 0) {
+        return null;
+    }
+    const start = m[1] ? Number(m[1]) : Math.max(0, size - Number(m[2]));
+    const end = m[1] && m[2] ? Math.min(Number(m[2]), size - 1) : size - 1;
+    return start > end || start >= size ? "unsatisfiable" : { start, end };
+}

package/apps/runtime/dist/routes/internal.js

@@ -0,0 +1,49 @@
+import { timingSafeEqual } from "node:crypto";
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+import { Hono } from "hono";
+import { z } from "zod";
+import { closeTenantDb, tenantDb } from "../db/client.js";
+import { env } from "../env.js";
+import { removeTenantObjects } from "../files/objects.js";
+import { forgetTenant, managed } from "../manage.js";
+import { forgetTenantRows, setTenantStatus } from "../tenants/control.js";
+function fromManage(header) {
+    const given = Buffer.from(header?.replace(/^Bearer\s+/i, "") ?? "");
+    const expected = Buffer.from(env.manage.serviceKey);
+    return (managed &&
+        expected.length > 0 &&
+        given.length === expected.length &&
+        timingSafeEqual(given, expected));
+}
+/**
+ * What the Manage-App tells this runtime about a tenant: suspend, resume, delete. Deleting
+ * removes the tenant's files and everything the control database knows; the tenant's database
+ * itself is deleted by whoever created it (the Manage-App, or here when it is a file).
+ */
+export const internalRoutes = new Hono().post("/tenants/:id", async (c) => {
+    if (!fromManage(c.req.header("authorization"))) {
+        return c.json({ error: "unauthorized" }, 401);
+    }
+    const id = c.req.param("id");
+    if (!/^[A-Za-z0-9_-]{1,64}$/.test(id)) {
+        return c.json({ error: "bad tenant id" }, 400);
+    }
+    const { action } = z
+        .object({ action: z.enum(["suspend", "resume", "delete"]) })
+        .parse(await c.req.json());
+    forgetTenant(id);
+    if (action === "delete") {
+        closeTenantDb(id);
+        await removeTenantObjects(id);
+        await forgetTenantRows(id);
+        for (const suffix of ["", "-wal", "-shm"]) {
+            await rm(join(env.dataDir, "tenants", `${id}.db${suffix}`), { force: true });
+        }
+        return c.json({ ok: true });
+    }
+    // The tenant row exists once its database was opened here.
+    await tenantDb(id);
+    await setTenantStatus(id, action === "suspend" ? "suspended" : "active");
+    return c.json({ ok: true });
+});

package/apps/runtime/dist/routes/marketplace.js

@@ -0,0 +1,36 @@
+import { CAPABILITY_IDS, INDUSTRY_IDS, ITEM_FORMAT_IDS, USE_CASE_IDS, } from "@engenty-wizards/shared/marketplace";
+import { Hono } from "hono";
+import { z } from "zod";
+import { asLang, marketplaceDetail, searchMarketplace, starEntry, } from "../services/marketplace.js";
+const searchSchema = z.object({
+    q: z.string().trim().max(200).default(""),
+    lang: z.string().optional(),
+    useCase: z.enum(USE_CASE_IDS).optional(),
+    industry: z.enum(INDUSTRY_IDS).optional(),
+    format: z.enum(ITEM_FORMAT_IDS).optional(),
+    capability: z.enum(CAPABILITY_IDS).optional(),
+    starred: z
+        .enum(["1", "0"])
+        .optional()
+        .transform((v) => v === "1"),
+    limit: z.coerce.number().int().min(1).max(100).default(60),
+    offset: z.coerce.number().int().min(0).default(0),
+});
+/** The marketplace for someone signed in: the search on "new", an entry, and the stars. */
+export const marketplaceStudio = new Hono()
+    .get("/", async (c) => {
+    const { lang, ...search } = searchSchema.parse(c.req.query());
+    return c.json(await searchMarketplace({ ...search, lang: asLang(lang) }));
+})
+    .get("/:id", async (c) => {
+    const detail = await marketplaceDetail(c.req.param("id"), asLang(c.req.query("lang")));
+    return detail ? c.json(detail) : c.json({ error: "not found" }, 404);
+})
+    .put("/:id/star", async (c) => {
+    await starEntry(c.get("user").tenantId, c.req.param("id"), true);
+    return c.json({ ok: true });
+})
+    .delete("/:id/star", async (c) => {
+    await starEntry(c.get("user").tenantId, c.req.param("id"), false);
+    return c.json({ ok: true });
+});