wizards 0.2.2 → 0.2.4

package/apps/runtime/dist/app.js

@@ -4,6 +4,7 @@ import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
 import { HTTPException } from "hono/http-exception";
 import { ZodError } from "zod";
 import { authRoutes, principalOf } from "./auth/index.js";
@@ -114,6 +115,38 @@ app.get("/.well-known/oauth-protected-resource/*", async (c) => {
         bearer_methods_supported: ["header"],
     });
 });
+// The mobile app opens this runtime's wizard and result links (Universal Links, App Links).
+app.get("/.well-known/apple-app-site-association", (c) => {
+    if (!env.mobile.iosAppIds.length) {
+        return c.notFound();
+    }
+    const paths = [`${basePath}/w/*`, `${basePath}/s/*`];
+    return c.json({
+        applinks: {
+            details: [
+                {
+                    appIDs: env.mobile.iosAppIds,
+                    components: paths.map((path) => ({ "/": path })),
+                },
+            ],
+        },
+    });
+});
+app.get("/.well-known/assetlinks.json", (c) => {
+    if (!env.mobile.androidCertSha256.length) {
+        return c.notFound();
+    }
+    return c.json([
+        {
+            relation: ["delegate_permission/common.handle_all_urls"],
+            target: {
+                namespace: "android_app",
+                package_name: env.mobile.androidPackage,
+                sha256_cert_fingerprints: env.mobile.androidCertSha256,
+            },
+        },
+    ]);
+});
 /** Studio requests act as the signed-in person, inside that person's tenant. */
 app.use("/api/studio/*", async (c, next) => {
     const user = await principalOf(c);
@@ -130,6 +163,17 @@ const mcp = mcpHandler();
 app.on(["GET", "POST", "DELETE"], "/api/mcp", (c) => mcp(c.req.raw));
 // The tools of one model call, for the installed Claude Code while it answers that call.
 app.on(["GET", "POST", "DELETE"], "/api/mcp/bridge/:token", (c) => bridgeRequest(c.req.param("token"), c.req.raw));
+// What visitors send is read before anyone is known: a body is taken only up to a size. A page's
+// answers are text; an upload is a photo, a recording or a clip from a phone (routes/delivery.ts).
+const tooLarge = (max) => bodyLimit({
+    maxSize: max,
+    onError: (c) => c.json({ error: "Das ist zu groß.", code: "too_large" }, 413),
+});
+const answers = tooLarge(4 * 1024 * 1024);
+const upload = tooLarge(48 * 1024 * 1024);
+app.use("/api/public/*", answers);
+app.use("/api/shares/*", answers);
+app.use("/api/runs/*", (c, next) => /\/uploads$/.test(c.req.path) ? upload(c, next) : answers(c, next));
 app.route("/api/studio/wizards", wizardStream);
 app.route("/api/studio/marketplace", marketplaceStudio);
 app.route("/api/studio/plugins", pluginRoutes);

package/apps/runtime/dist/auth/account.js

@@ -16,7 +16,11 @@ const SCOPE = "openid profile email offline_access wizards:read wizards:write wi
 function redirectUri() {
     return `http://127.0.0.1:${env.port}/api/auth/callback`;
 }
-export async function startLink() {
+/**
+ * The address that links an account. `signup`: the person has none yet — the account's sign-up
+ * page takes the invitation code (`code` fills it in) and goes on to the same sign-in.
+ */
+export async function startLink(options = {}) {
     const d = await discovery(env.local.accountUrl);
     const verifier = randomBytes(32).toString("base64url");
     const state = { verifier, redirect: redirectUri(), exp: Date.now() + 15 * 60_000 };
@@ -31,7 +35,17 @@ export async function startLink() {
         code_challenge_method: "S256",
         state: seal(state),
     }).toString();
-    return url.toString();
+    if (!options.signup) {
+        return url.toString();
+    }
+    const signUp = new URL("/sign-up", env.local.accountUrl);
+    const code = options.code?.trim();
+    if (code) {
+        signUp.searchParams.set("code", code);
+    }
+    // The sign-up page goes on only to a path of its own origin.
+    signUp.searchParams.set("next", url.pathname + url.search);
+    return signUp.toString();
 }
 let cached = null;
 async function keep(tokens) {

package/apps/runtime/dist/auth/index.js

@@ -4,7 +4,7 @@ import { eq, lt } from "drizzle-orm";
 import { Hono } from "hono";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { nanoid } from "nanoid";
-import { control, controlDb } from "../db/client.js";
+import { control, controlDb, withTenant } from "../db/client.js";
 import { basePath, env } from "../env.js";
 import { discovery, managed, tokenRequest, verifyToken, } from "../manage.js";
 import { seal, unseal } from "../secrets/crypto.js";
@@ -24,6 +24,17 @@ let accessKey = managed
 export function localEntryUrl() {
     return accessKey ? `${env.appUrl}/api/local/enter?k=${accessKey}` : null;
 }
+/** Sends everything published here to the cloud of the account that was just linked. */
+async function firstSync() {
+    try {
+        // Loaded here: the services read the session this module makes.
+        const { syncAllToCloud } = await import("../services/cloud.js");
+        await withTenant(LOCAL_TENANT, () => syncAllToCloud(localUser().id));
+    }
+    catch (err) {
+        console.error("[cloud] first sync failed:", err);
+    }
+}
 const localUser = () => ({
     id: "local",
     tenantId: LOCAL_TENANT,
@@ -265,6 +276,8 @@ export const authRoutes = new Hono()
         }
         try {
             await finishLink(code, rawState);
+            // What is published here goes to the account's cloud, from now on and once for all there is.
+            void firstSync();
             return c.html(closePage("Angemeldet. Du kannst dieses Fenster schließen."));
         }
         catch (err) {

package/apps/runtime/dist/connectors/external.js

@@ -9,6 +9,7 @@ import { discoverImportableSources, discoverOAuthFacts, registryDiscover, regist
 import { resolveRegistrySource } from "../engenty/connections-external/registry-source.js";
 import { encryptToken } from "../engenty/shims/connections-sdk.js";
 import { env } from "../env.js";
+import { requireWritableProject } from "../services/access.js";
 import { ServiceError } from "../services/errors.js";
 import { BUILTIN_CONNECTORS, builtinConnector, missingSetup, usable } from "./builtin.js";
 /**
@@ -270,6 +271,7 @@ export async function resolveConnector(projectId, id) {
         : null;
 }
 export async function importConnector(userId, projectId, input) {
+    await requireWritableProject(projectId);
     if (await load(projectId, input.id)) {
         throw new ServiceError("invalid", `Connector "${input.id}" already exists in this project.`);
     }
@@ -311,6 +313,7 @@ export async function importConnector(userId, projectId, input) {
  * an MCP server is the service's own, curated set of actions.
  */
 export async function importFromRegistry(userId, projectId, input) {
+    await requireWritableProject(projectId);
     const service = await registryService(input.domain);
     const order = input.kind ? [input.kind] : ["mcp", "openapi"];
     const source = order
@@ -334,6 +337,7 @@ export async function importFromRegistry(userId, projectId, input) {
     });
 }
 export async function removeConnector(projectId, id) {
+    await requireWritableProject(projectId);
     await db.delete(schema.projectConnector).where(where(projectId, id));
 }
 /**
@@ -341,6 +345,7 @@ export async function removeConnector(projectId, id) {
  * tools to a signed-in account needs that account's token.
  */
 export async function refreshConnector(projectId, id, accessToken) {
+    await requireWritableProject(projectId);
     const record = await load(projectId, id);
     if (!record) {
         throw new ServiceError("not_found", "No such connector.");

package/apps/runtime/dist/db/client.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -117,14 +118,34 @@ export async function withTenant(id, fn) {
     await openTenantDb(id);
     return inTenant(id, fn);
 }
+/** The transaction the current context writes in, while `inTransaction()` runs. */
+const transactions = new AsyncLocalStorage();
 /**
- * The current tenant's database, resolved from the context `inTenant()` set. Code that reads or
- * writes wizards, runs or files never names a tenant itself.
+ * Runs `fn` as one transaction of the current tenant's database: inside it, `db` is the
+ * transaction, so every write of the services called there stands or falls with the others.
+ * Already inside one, `fn` just joins it. Only this database takes part: the object store and
+ * the control database are written as before, so do those first or after.
+ */
+export async function inTransaction(fn) {
+    if (transactions.getStore()) {
+        return fn();
+    }
+    const id = currentTenant();
+    const target = ready.get(id);
+    if (!target) {
+        throw new Error(`Tenant database "${id}" is not open: enter it with withTenant().`);
+    }
+    return target.transaction((tx) => transactions.run(tx, fn));
+}
+/**
+ * The current tenant's database, resolved from the context `inTenant()` set — or the
+ * transaction `inTransaction()` opened there. Code that reads or writes wizards, runs or files
+ * never names a tenant itself.
  */
 export const db = new Proxy({}, {
     get(_target, prop) {
         const id = currentTenant();
-        const target = ready.get(id);
+        const target = transactions.getStore() ?? ready.get(id);
         if (!target) {
             throw new Error(`Tenant database "${id}" is not open: enter it with withTenant().`);
         }

package/apps/runtime/dist/db/control-schema.js

@@ -17,11 +17,14 @@ export const tenant = sqliteTable("tenant", {
 export const link = sqliteTable("link", {
     token: text("token").primaryKey(),
     tenantId: text("tenant_id").notNull(),
-    /** `wizard` = a share link `/w/<token>`, `result` = a shared result `/s/<token>`, `logo` = a brand logo. */
-    kind: text("kind", { enum: ["wizard", "result", "logo"] }).notNull(),
+    /**
+     * `wizard` = a share link `/w/<token>`, `result` = a shared result `/s/<token>`, `logo` = a
+     * brand logo, `code` = a wizard's ID to type in (its `ref` is the wizard's share token).
+     */
+    kind: text("kind", { enum: ["wizard", "result", "logo", "code"] }).notNull(),
     ref: text("ref").notNull(),
     createdAt: createdAt(),
-}, (t) => [index("link_tenant").on(t.tenantId)]);
+}, (t) => [index("link_tenant").on(t.tenantId), index("link_ref").on(t.kind, t.ref)]);
 /**
  * One row per run: finds the run's tenant, counts a visitor's runs across all wizards, and
  * marks the runs that are working (resumed after a restart, counted against the tenant's limit).
@@ -32,6 +35,12 @@ export const runIndex = sqliteTable("run_index", {
     visitorId: text("visitor_id"),
     ipHash: text("ip_hash"),
     active: integer("active", { mode: "boolean" }).notNull().default(false),
+    /**
+     * The mobile app's device for push, set by the app for this run (`POST /api/runs/:id/notify`):
+     * `{ token, platform: "ios" | "android", lang }`. Told through the Manage-App when the run is
+     * done, failed or waits for the person.
+     */
+    push: text("push", { mode: "json" }).$type(),
     createdAt: createdAt(),
 }, (t) => [
     index("run_index_visitor").on(t.visitorId, t.createdAt),

package/apps/runtime/dist/db/migrations/control/0005_chilly_oracle.sql

@@ -0,0 +1 @@
+CREATE INDEX `link_ref` ON `link` (`kind`,`ref`);

package/apps/runtime/dist/db/migrations/control/0006_sleepy_mojo.sql

@@ -0,0 +1 @@
+ALTER TABLE `run_index` ADD `push` text;

package/apps/runtime/dist/db/migrations/control/meta/0005_snapshot.json

@@ -0,0 +1,358 @@
+{
+  "version": "6",
+  "dialect": "sqlite",
+  "id": "52cfe26f-c51b-49b6-abf7-21417f611007",
+  "prevId": "ded1f6e4-eee2-4ef4-99b7-171041cbe221",
+  "tables": {
+    "link": {
+      "name": "link",
+      "columns": {
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "ref": {
+          "name": "ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(unixepoch() * 1000)"
+        }
+      },
+      "indexes": {
+        "link_tenant": {
+          "name": "link_tenant",
+          "columns": [
+            "tenant_id"
+          ],
+          "isUnique": false
+        },
+        "link_ref": {
+          "name": "link_ref",
+          "columns": [
+            "kind",
+            "ref"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "marketplace_cache": {
+      "name": "marketplace_cache",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "hash": {
+          "name": "hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "entry": {
+          "name": "entry",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "fetched_at": {
+          "name": "fetched_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(unixepoch() * 1000)"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "run_index": {
+      "name": "run_index",
+      "columns": {
+        "run_id": {
+          "name": "run_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "visitor_id": {
+          "name": "visitor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "ip_hash": {
+          "name": "ip_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "active": {
+          "name": "active",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(unixepoch() * 1000)"
+        }
+      },
+      "indexes": {
+        "run_index_visitor": {
+          "name": "run_index_visitor",
+          "columns": [
+            "visitor_id",
+            "created_at"
+          ],
+          "isUnique": false
+        },
+        "run_index_ip": {
+          "name": "run_index_ip",
+          "columns": [
+            "ip_hash",
+            "created_at"
+          ],
+          "isUnique": false
+        },
+        "run_index_active": {
+          "name": "run_index_active",
+          "columns": [
+            "active",
+            "tenant_id"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "session": {
+      "name": "session",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "claims_expire_at": {
+          "name": "claims_expire_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(unixepoch() * 1000)"
+        }
+      },
+      "indexes": {
+        "session_expires": {
+          "name": "session_expires",
+          "columns": [
+            "expires_at"
+          ],
+          "isUnique": false
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "setting": {
+      "name": "setting",
+      "columns": {
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    },
+    "tenant": {
+      "name": "tenant",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true,
+          "autoincrement": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "'active'"
+        },
+        "db_url": {
+          "name": "db_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false,
+          "autoincrement": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "autoincrement": false,
+          "default": "(unixepoch() * 1000)"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "checkConstraints": {}
+    }
+  },
+  "views": {},
+  "enums": {},
+  "_meta": {
+    "schemas": {},
+    "tables": {},
+    "columns": {}
+  },
+  "internal": {
+    "indexes": {}
+  }
+}