wizards 0.2.2 → 0.2.4

package/apps/runtime/dist/db/migrations/tenant/meta/_journal.json

@@ -36,6 +36,13 @@
       "when": 1791129806883,
       "tag": "0004_romantic_nocturne",
       "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "6",
+      "when": 1791230045311,
+      "tag": "0005_reflective_forgotten_one",
+      "breakpoints": true
     }
   ]
 }

package/apps/runtime/dist/db/schema.js

@@ -13,6 +13,12 @@ export const project = sqliteTable("project", {
         .$type()
         .notNull()
         .default([]),
+    /**
+     * `local`: the project of a local install, synced here when that install publishes. It keeps
+     * the ids it has there and is changed only by the next sync. Null: made on this runtime.
+     */
+    origin: text("origin", { enum: ["local"] }),
+    syncedAt: integer("synced_at", { mode: "timestamp_ms" }),
     createdAt: createdAt(),
     updatedAt: updatedAt(),
 }, (t) => [index("project_tenant").on(t.tenantId)]);

package/apps/runtime/dist/engine/asks.js

@@ -2,6 +2,7 @@ import { eq } from "drizzle-orm";
 import { nanoid } from "nanoid";
 import { db, schema } from "../db/client.js";
 import { signalChanged } from "./events.js";
+import { pushRun } from "./push.js";
 /** How long a step waits for the person before it goes on without them. */
 const ASK_TIMEOUT_MS = 15 * 60_000;
 /** Runs nobody watches (an MCP client drives them): a question there would wait for no one. */
@@ -32,6 +33,7 @@ export async function askPerson(runId, ask, signal) {
         waiting.set(runId, { ask: full, settle: finish });
     });
     await setAsk(runId, full);
+    void pushRun(runId, "asks");
     try {
         return await result;
     }

package/apps/runtime/dist/engine/push.js

@@ -0,0 +1,58 @@
+import { eq } from "drizzle-orm";
+import { control, controlDb, db, schema } from "../db/client.js";
+import { managed, pushToDevice } from "../manage.js";
+import { currentTenant } from "../tenants/tenant.js";
+const TEXT = {
+    en: {
+        done: "Your result is ready.",
+        failed: "The run stopped with an error.",
+        waiting: "The wizard waits for you.",
+        asks: "The wizard has a question for you.",
+    },
+    de: {
+        done: "Dein Ergebnis ist bereit.",
+        failed: "Der Durchlauf ist mit einem Fehler stehen geblieben.",
+        waiting: "Der Wizard wartet auf dich.",
+        asks: "Der Wizard hat eine Frage an dich.",
+    },
+};
+export const pushAvailable = () => managed;
+export async function setPushDevice(runId, device) {
+    await controlDb
+        .update(control.runIndex)
+        .set({ push: device })
+        .where(eq(control.runIndex.runId, runId));
+}
+/** Tells the run's device, if the app gave one; never fails the run. */
+export async function pushRun(runId, kind) {
+    if (!managed) {
+        return;
+    }
+    try {
+        const row = await controlDb.query.runIndex.findFirst({
+            where: eq(control.runIndex.runId, runId),
+        });
+        const device = row?.push;
+        if (!device) {
+            return;
+        }
+        const run = await db.query.run.findFirst({ where: eq(schema.run.id, runId) });
+        if (!run) {
+            return;
+        }
+        await pushToDevice({
+            tenantId: currentTenant(),
+            device: { token: device.token, platform: device.platform },
+            title: run.definition.title,
+            body: TEXT[device.lang][kind],
+            data: { runId, kind },
+        });
+        // An ended run has nothing more to say.
+        if (kind === "done" || kind === "failed") {
+            await setPushDevice(runId, null);
+        }
+    }
+    catch (err) {
+        console.error("[push]", err.message);
+    }
+}

package/apps/runtime/dist/engine/runner.js

@@ -19,6 +19,7 @@ import { currentTenant } from "../tenants/tenant.js";
 import { askPerson, clearStaleAsk, unattended } from "./asks.js";
 import { emitEvent, recentEvents, signalChanged } from "./events.js";
 import { readPageInput } from "./input.js";
+import { pushRun } from "./push.js";
 import { blockingMessage, missingModels } from "./requirements.js";
 import { releaseResources, resourcesFor } from "./resources.js";
 import { runAutomaticStep } from "./steps.js";
@@ -115,6 +116,9 @@ async function updateRun(runId, patch) {
         await releaseRun(runId);
         // Plugins hear of it; the run does not wait for them.
         void runEnded(runId, patch.status);
+        if (patch.status !== "cancelled") {
+            void pushRun(runId, patch.status);
+        }
     }
     signalChanged(runId);
 }
@@ -281,6 +285,8 @@ async function drive(runId, signal) {
         }
         if (step.type === "page" || step.type === "review") {
             await updateRun(runId, { status: "waiting_input" });
+            // A step that ran is over and the next one is the person's: a phone in a pocket hears it.
+            void pushRun(runId, "waiting");
             return;
         }
         if (!(await canSpend())) {

package/apps/runtime/dist/env.js

@@ -192,6 +192,17 @@ export const env = {
         secretAccessKey: str("S3_SECRET_ACCESS_KEY"),
     },
     turnstile: { siteKey: str("TURNSTILE_SITE_KEY"), secret: str("TURNSTILE_SECRET_KEY") },
+    /**
+     * The mobile app (apps/mobile): a phone opens this runtime's `/w/` and `/s/` links in it.
+     * Served as /.well-known/apple-app-site-association and /.well-known/assetlinks.json.
+     */
+    mobile: {
+        /** `<team id>.<bundle id>` of the iOS apps; empty = no file. */
+        iosAppIds: list("MOBILE_IOS_APP_IDS"),
+        androidPackage: str("MOBILE_ANDROID_PACKAGE", "ai.engenty.wizards"),
+        /** SHA-256 fingerprints of the Android app's signing certificates; empty = no file. */
+        androidCertSha256: list("MOBILE_ANDROID_CERT_SHA256"),
+    },
     /** Plugins (docs/content/dev/plugins). Code in these folders runs with the runtime's own rights. */
     plugins: {
         /** Folders to look in, besides the `modules/` this runtime ships with. */
@@ -214,6 +225,8 @@ export const env = {
          * can set another number per tenant; the database holds any number either way.
          */
         projects: num("LIMIT_PROJECTS", 1),
+        /** Wizards a local install may keep on this runtime in its synced project. */
+        syncedWizards: num("LIMIT_SYNCED_WIZARDS", 50),
         /** End-user runs (no account) and their shared links are deleted after this many days. */
         resultTtlDays: num("RESULT_TTL_DAYS", 7),
         /** What a wizard keeps for a person (lists, files, accounts) goes when unused this long. */

package/apps/runtime/dist/index.js

@@ -68,6 +68,12 @@ async function purge() {
 }
 void purge().catch((err) => console.error("[retention]", err));
 setInterval(() => void purge().catch((err) => console.error("[retention]", err)), 3600_000).unref();
+// A runtime that runs alone sends again what did not arrive in its account's cloud.
+if (!managed) {
+    const { retryFailedSends } = await import("./services/cloud.js");
+    const retry = () => withTenant(LOCAL_TENANT, () => retryFailedSends("local")).catch((err) => console.error("[cloud] retry failed:", err));
+    setInterval(() => void retry(), 60_000).unref();
+}
 async function shutdown(code = 0) {
     clearRunning(env.dataDir);
     server.close();

package/apps/runtime/dist/limits.js

@@ -55,3 +55,24 @@ export async function verifyTurnstile(token, ip) {
         return false;
     }
 }
+/** Times per key, kept in this process; old ones drop out as the key is asked. */
+const seen = new Map();
+/** Counts one more try for `key`; false once `max` tries fell within the last `windowMs`. */
+export function allowed(key, max, windowMs) {
+    const now = Date.now();
+    const recent = (seen.get(key) ?? []).filter((t) => now - t < windowMs);
+    if (recent.length >= max) {
+        seen.set(key, recent);
+        return false;
+    }
+    recent.push(now);
+    seen.set(key, recent);
+    if (seen.size > 50_000) {
+        for (const [k, times] of seen) {
+            if (!times.some((t) => now - t < windowMs)) {
+                seen.delete(k);
+            }
+        }
+    }
+    return true;
+}

package/apps/runtime/dist/manage.js

@@ -107,9 +107,18 @@ export async function tenantInfo(id, fresh = false) {
     if (!fresh && hit && Date.now() - hit.at < 60_000) {
         return hit.value;
     }
-    const value = await call("GET", `/v1/tenants/${encodeURIComponent(id)}`);
-    tenants.set(id, { at: Date.now(), value });
-    return value;
+    try {
+        const value = await call("GET", `/v1/tenants/${encodeURIComponent(id)}`);
+        tenants.set(id, { at: Date.now(), value });
+        return value;
+    }
+    catch (err) {
+        // The Manage-App is out of reach for a moment: what it said within the hour still counts.
+        if (hit && !(err instanceof ManageError) && Date.now() - hit.at < 3600_000) {
+            return hit.value;
+        }
+        throw err;
+    }
 }
 export function forgetTenant(id) {
     tenants.delete(id);
@@ -129,6 +138,10 @@ export function runUsage(tenantId, runId) {
 export function bookUsage(input) {
     return call("POST", "/v1/usage", input);
 }
+/** A push to the mobile app on one device; the Manage-App holds the APNs and FCM keys. */
+export function pushToDevice(input) {
+    return call("POST", "/v1/push", input);
+}
 /** Code or refresh token → tokens. A confidential client sends its secret, a public one only its id. */
 export async function tokenRequest(params, client, base = env.manage.url) {
     const d = await discovery(base);

package/apps/runtime/dist/mcp/tools.js

@@ -4,13 +4,14 @@ import { wizardOpSchema } from "../authoring/ops.js";
 import { importFromRegistry, listConnectors, searchRegistry } from "../connectors/external.js";
 import { RunConflict } from "../engine/runner.js";
 import { pluginToolsOf } from "../plugins/registry.js";
+import { publishAndSync, pushSharing } from "../services/cloud.js";
 import { ServiceError } from "../services/errors.js";
 import { deleteFile, listFiles, readFileText, writeFile } from "../services/files.js";
 import { marketplaceWizard, searchMarketplace } from "../services/marketplace.js";
 import { defaultProject, listProjects, ownedProject } from "../services/projects.js";
 import { answerRunAsk, answerRunPage, controlRun, reviewRun, runReport, startRun, startTestRun, testRunReport, } from "../services/runs.js";
 import { checkDraftWidget } from "../services/widgets.js";
-import { createWizard, editWizard, listWizards, ownedWizard, parseDraft, publishWizard, shareUrl, studioUrl, updateWizardSettings, wizardState, writeDraft, } from "../services/wizards.js";
+import { createWizard, editWizard, listWizards, ownedWizard, parseDraft, shareUrl, studioUrl, updateWizardSettings, wizardState, writeDraft, } from "../services/wizards.js";
 import { FLOW_VIEW_KEY, flowAppMeta, flowView } from "./flow-app.js";
 const definition = z
     .record(z.string(), z.unknown())
@@ -280,7 +281,7 @@ Returns the new revision and the issues.`,
         title: "Publish wizard",
         description: "Publish the draft as a new version behind the share link. Refused while the draft has issues. Only when the admin asked for it.",
         input: z.object({ wizardId: z.string() }),
-    }, async ({ wizardId }) => publishWizard(who.userId, wizardId));
+    }, async ({ wizardId }) => publishAndSync(who.userId, wizardId));
     tool("set_sharing", "wizards:publish", {
         title: "Set sharing",
         description: "Turn the share link on or off, or change how many runs it allows per day.",
@@ -294,6 +295,7 @@ Returns the new revision and the issues.`,
             shareEnabled: enabled,
             dailyRunLimit,
         });
+        await pushSharing(who.userId, wizardId);
         return {
             shareEnabled: w.shareEnabled,
             dailyRunLimit: w.dailyRunLimit,

package/apps/runtime/dist/routes/api.js

@@ -1,11 +1,14 @@
 import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
 import { z } from "zod";
 import { withTenant } from "../db/client.js";
+import { allowed } from "../limits.js";
 import { authenticate, principalOf } from "../mcp/auth.js";
 import { ServiceError } from "../services/errors.js";
 import { deleteFile, draftFiles, writeFile } from "../services/files.js";
+import { checkOnServer, checkSchema, listSyncedSpaces, patchSyncedWizard, removeSyncedSpace, removeSyncedWizard, syncSettingsSchema, syncWizard, syncWizardSchema, } from "../services/spaces.js";
 import { createWizard, ownedWizard, publishWizard, writeDraft } from "../services/wizards.js";
-import { tenantStatus } from "../tenants/control.js";
+import { codeOf, tenantStatus } from "../tenants/control.js";
 const importSchema = z.object({
     /** An earlier import's wizard: it is updated instead of a new one being made. */
     wizardId: z.string().optional(),
@@ -17,12 +20,97 @@ const importSchema = z.object({
         .default([]),
     publish: z.boolean().default(false),
 });
+const HOUR = 60 * 60 * 1000;
+/** A wizard with its workspace: 25 MB of files as base64, and the definition. */
+const WIZARD_BYTES = 48 * 1024 * 1024;
+const tooLarge = bodyLimit({
+    maxSize: WIZARD_BYTES,
+    onError: (c) => c.json({ error: "Request body too large.", code: "too_large" }, 413),
+});
 /**
- * The runtime's API for other programs, signed in like an MCP client (access token or API key).
- * `POST /wizards/import` takes a whole wizard — definition and workspace — validated like any
- * other write: this is how a desktop app publishes to the cloud.
+ * The caller of an API call, signed in like an MCP client (access token or API key), with the
+ * scopes the call needs; or the answer that turns it away.
  */
-export const apiRoutes = new Hono().post("/wizards/import", async (c) => {
+async function caller(c, scopes) {
+    const authInfo = await authenticate(c.req.raw);
+    if (authInfo instanceof Response) {
+        return authInfo;
+    }
+    const who = principalOf(authInfo);
+    if (scopes.some((scope) => !who.scopes.includes(scope))) {
+        return c.json({ error: "This token may not do that.", code: "insufficient_scope" }, 403);
+    }
+    if ((await tenantStatus(who.tenantId)) === "suspended") {
+        return c.json({ error: "tenant_suspended" }, 403);
+    }
+    return who;
+}
+/** A local install sends when it publishes: more than this an hour is not an install at work. */
+function withinSyncLimit(c, who) {
+    return allowed(`sync:${who.tenantId}`, 240, HOUR)
+        ? null
+        : c.json({ error: "Zu viele Übertragungen. Bitte später noch einmal.", code: "rate_limited" }, 429);
+}
+/**
+ * The runtime's API for other programs. `/spaces/…` is how a local install's project comes
+ * here: the wizards it publishes, under the ids they have there (docs/manage-contract.md).
+ * `POST /wizards/import` takes a whole wizard as a new one of a tenant that builds here.
+ */
+export const apiRoutes = new Hono()
+    .get("/spaces", async (c) => {
+    const who = await caller(c, ["wizards:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return withTenant(who.tenantId, async () => c.json({ spaces: await listSyncedSpaces() }));
+})
+    .post("/spaces/check", async (c) => {
+    const who = await caller(c, ["wizards:read"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const body = checkSchema.parse(await c.req.json());
+    return withTenant(who.tenantId, async () => c.json({ problems: await checkOnServer(body) }));
+})
+    .put("/spaces/:spaceId/wizards/:wizardId", tooLarge, async (c) => {
+    const who = await caller(c, ["wizards:write", "wizards:publish"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const limited = withinSyncLimit(c, who);
+    if (limited) {
+        return limited;
+    }
+    const body = syncWizardSchema.parse(await c.req.json());
+    return withTenant(who.tenantId, async () => c.json(await syncWizard(c.req.param("spaceId"), c.req.param("wizardId"), body)));
+})
+    .patch("/spaces/:spaceId/wizards/:wizardId", async (c) => {
+    const who = await caller(c, ["wizards:publish"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const limited = withinSyncLimit(c, who);
+    if (limited) {
+        return limited;
+    }
+    const body = syncSettingsSchema.parse(await c.req.json());
+    return withTenant(who.tenantId, async () => c.json(await patchSyncedWizard(c.req.param("spaceId"), c.req.param("wizardId"), body)));
+})
+    .delete("/spaces/:spaceId/wizards/:wizardId", async (c) => {
+    const who = await caller(c, ["wizards:write"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return withTenant(who.tenantId, async () => c.json(await removeSyncedWizard(who.userId, c.req.param("spaceId"), c.req.param("wizardId"))));
+})
+    .delete("/spaces/:spaceId", async (c) => {
+    const who = await caller(c, ["wizards:write"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    return withTenant(who.tenantId, async () => c.json(await removeSyncedSpace(c.req.param("spaceId"))));
+})
+    .post("/wizards/import", tooLarge, async (c) => {
     const authInfo = await authenticate(c.req.raw);
     if (authInfo instanceof Response) {
         return authInfo;
@@ -69,6 +157,8 @@ export const apiRoutes = new Hono().post("/wizards/import", async (c) => {
             });
         }
         const published = await publishWizard(who.userId, wizardId);
-        return c.json({ wizardId, revision: written.revision, issues: [], ...published });
+        // The ID the mobile app takes.
+        const code = await codeOf(current.shareToken);
+        return c.json({ wizardId, revision: written.revision, issues: [], ...published, code });
     });
 });

package/apps/runtime/dist/routes/runs.js

@@ -12,6 +12,7 @@ import { ConnectError, connectionViews, connectWithCredentials, disconnect, fini
 import { db, schema, withTenant } from "../db/client.js";
 import { answerAsk, pendingAsk } from "../engine/asks.js";
 import { signalChanged, subscribe } from "../engine/events.js";
+import { pushAvailable, setPushDevice } from "../engine/push.js";
 import { liveResources } from "../engine/resources.js";
 import { cancel, createRun, goBack, NoCreditsError, projectIdOf, RunConflict, RunInputError, retry, reviewStep, runView, submitPage, } from "../engine/runner.js";
 import { basePath, env } from "../env.js";
@@ -26,7 +27,7 @@ import { brandView } from "../services/brand.js";
 import { ServiceError } from "../services/errors.js";
 import { sharedRun, shareImage, shareRun, shareView, unshareRun } from "../services/shares.js";
 import { clearStore, deleteRows, listRows, listSecrets, readStoreFile, StoreError, saveRows, scopeOf, storeFiles, updateRow, } from "../store/index.js";
-import { tenantOfLink, tenantOfRun, tenantStatus, visitorOverLimit } from "../tenants/control.js";
+import { tenantOfLink, tenantOfRun, tenantStatus, tokenOfCode, visitorOverLimit, } from "../tenants/control.js";
 import { byteRange, uploadLimit, wizardManifest } from "./delivery.js";
 const VISITOR_COOKIE = "wz_vid";
 /** Kept files a review shows inline. */
@@ -43,8 +44,15 @@ function clientIp(c) {
         return null;
     }
 }
+/**
+ * The mobile app's own requests (a run's view, downloads) name the visitor in a header: iOS
+ * merges a Cookie header the app sets with its own cookie store (`wz_vid=a,wz_vid=a`). The header
+ * comes first; a browser never sends it across sites without the runtime's say (CORS), so it is
+ * as good as the cookie.
+ */
+const VISITOR_HEADER = "x-wizards-visitor";
 function visitorId(c, create, embedded = false) {
-    let vid = getCookie(c, VISITOR_COOKIE) ?? null;
+    let vid = c.req.header(VISITOR_HEADER) || getCookie(c, VISITOR_COOKIE) || null;
     if (!vid && create) {
         vid = nanoid(24);
         const secure = env.appUrl.startsWith("https");
@@ -120,7 +128,41 @@ const wizardLink = tenantFrom((c) => tenantOfLink(c.req.param("token") ?? "", "w
 const resultLink = tenantFrom((c) => tenantOfLink(c.req.param("token") ?? "", "result"));
 const logoLink = tenantFrom((c) => tenantOfLink(c.req.param("id") ?? "", "logo"));
 const runTenant = tenantFrom((c) => tenantOfRun(c.req.param("id") ?? ""));
+/** Wrong guesses at a wizard's ID, per address and hour: 32^8 IDs stay out of reach. */
+const codeMisses = new Map();
+const CODE_MISSES_PER_HOUR = 30;
+function codeLookupBlocked(ip) {
+    const key = hashIp(ip) ?? "unknown";
+    const entry = codeMisses.get(key);
+    if (entry && Date.now() - entry.since > 3600_000) {
+        codeMisses.delete(key);
+        return false;
+    }
+    return (entry?.n ?? 0) >= CODE_MISSES_PER_HOUR;
+}
+function codeMissed(ip) {
+    const key = hashIp(ip) ?? "unknown";
+    const entry = codeMisses.get(key) ?? { n: 0, since: Date.now() };
+    entry.n += 1;
+    codeMisses.set(key, entry);
+    if (codeMisses.size > 10_000) {
+        codeMisses.delete(codeMisses.keys().next().value);
+    }
+}
 export const publicRoutes = new Hono()
+    // A wizard's ID, typed into the mobile app: answers its share token.
+    .get("/codes/:code", async (c) => {
+    const ip = clientIp(c);
+    if (codeLookupBlocked(ip)) {
+        return c.json({ error: "too many tries" }, 429);
+    }
+    const found = await tokenOfCode(c.req.param("code"));
+    if (!found || (await tenantStatus(found.tenantId)) === "suspended") {
+        codeMissed(ip);
+        return c.json({ error: "not found" }, 404);
+    }
+    return c.json({ token: found.token, url: `${env.appUrl}/w/${found.token}` });
+})
     .use("/wizards/:token", wizardLink)
     .use("/wizards/:token/*", wizardLink)
     .use("/logos/:id", logoLink)
@@ -636,6 +678,30 @@ export const runRoutes = new Hono()
     await clearStore(scopeOf(run));
     signalChanged(run.id);
     return c.json({ ok: true });
+})
+    // The mobile app's device for this run: told when it is done, failed or waits for the person.
+    .post("/:id/notify", async (c) => {
+    const run = await accessibleRun(c, c.req.param("id"));
+    if (!run) {
+        return c.json({ error: "not found" }, 404);
+    }
+    const body = z
+        .object({
+        token: z.string().min(8).max(512),
+        platform: z.enum(["ios", "android"]),
+        lang: z.enum(["en", "de"]).default("en"),
+    })
+        .parse(await c.req.json());
+    await setPushDevice(run.id, body);
+    return c.json({ push: pushAvailable() });
+})
+    .delete("/:id/notify", async (c) => {
+    const run = await accessibleRun(c, c.req.param("id"));
+    if (!run) {
+        return c.json({ error: "not found" }, 404);
+    }
+    await setPushDevice(run.id, null);
+    return c.json({ ok: true });
 })
     .post("/:id/share", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));