wizards 0.2.28 → 0.2.30

package/apps/runtime/dist/auth/account.js

@@ -91,6 +91,14 @@ export async function accountToken() {
     if (cached && cached.expiresAt - Date.now() > 60_000) {
         return cached.token;
     }
+    // One refresh at a time: a refresh token is used once, a second caller would be refused.
+    refreshing ??= refreshAccount().finally(() => {
+        refreshing = null;
+    });
+    return refreshing;
+}
+let refreshing = null;
+async function refreshAccount() {
     const refresh = await vaultGet(REFRESH);
     if (!refresh) {
         return null;

package/apps/runtime/dist/auth/index.js

@@ -7,6 +7,7 @@ import { nanoid } from "nanoid";
 import { control, controlDb, withTenant } from "../db/client.js";
 import { basePath, env } from "../env.js";
 import { discovery, managed, tokenRequest, verifyToken, } from "../manage.js";
+import { refreshPro } from "../plugins/pro.js";
 import { seal, unseal } from "../secrets/crypto.js";
 import { LOCAL_TENANT } from "../tenants/tenant.js";
 import { finishLink } from "./account.js";
@@ -278,6 +279,8 @@ export const authRoutes = new Hono()
             await finishLink(code, rawState);
             // What is published here goes to the account's cloud, from now on and once for all there is.
             void firstSync();
+            // The Pro modules the account's plan includes.
+            void refreshPro();
             return c.html(closePage("Angemeldet. Du kannst dieses Fenster schließen."));
         }
         catch (err) {

package/apps/runtime/dist/authoring/guide.js

@@ -114,12 +114,18 @@ type Field = {
 //              {{field}} → asset://ID, used as <img src="asset://ID">.
 //   slot:      the person picks one appointment time, shown by day. Options are ISO 8601 date-times with their offset
 //              ("2026-10-12T09:00:00+02:00"), nearly always from optionsFrom; {{field}} is the chosen one, as offered.
-//              Booking: agent step "free" with tools ["appointments.availability"] outputs a table "slots" with a "start" column;
+//              Booking: agent step "free" with call { tool: "appointments.availability", input: { duration_minutes: 30, days: 14 } }
+//              and output { format: "json", fields: [{ id: "slots", kind: "table", columns: ["start","end","label"] }] };
 //              then a page { kind: "slot", optionsFrom: "steps.free.slots.start" }; then an agent step with appointments.book.
 
 type AgentStep = {
   type: "agent"
-  instructions: string          // the task, with {{templates}}
+  instructions: string          // the task, with {{templates}} ("" with call)
+  call?: { tool: "<plugin>.<tool>", input: { … } }
+                                // NO MODEL: one plugin tool called once with this input; its answer IS the json output
+                                //   (fields name the keys later steps read). Use it where a model would only fetch and copy
+                                //   data (free appointment times) — it answers in a second instead of half a minute.
+                                //   String inputs are templates; a filled-in whole number or true/false is passed as one.
   tools: ("web_search"|"web_fetch"|"browser"|"sandbox"|"image"|"http"|"pages")[]
   mcp?: string[]                // ids of the project's MCP servers this step may use
   connections?: string[]        // ids of wizard connections this step may read (mail → mail_search, mail_read, mail_save)

package/apps/runtime/dist/credits/estimate.js

@@ -37,6 +37,10 @@ function formula(step, catalog) {
 function stepFormula(step, catalog) {
     const cls = (c) => catalog.classes[c];
     if (step.type === "agent") {
+        // A call runs one tool and no model: nothing to pay for.
+        if (step.call) {
+            return 0;
+        }
         // A decision is one small call to the classifier class.
         if (isDecisionStep(step)) {
             return textCredits(cls("classifier"), TOKENS.decision);

package/apps/runtime/dist/engine/requirements.js

@@ -17,6 +17,10 @@ export function stepClasses(step) {
 function ownClasses(step) {
     switch (step.type) {
         case "agent": {
+            // A call runs one tool and no model.
+            if (step.call) {
+                return [];
+            }
             if (isDecisionStep(step)) {
                 return ["classifier"];
             }

package/apps/runtime/dist/engine/steps.js

@@ -11,7 +11,7 @@ import { markMedia } from "../media/marking.js";
 import { attachTools, costOf, isHarnessVendor, textModel } from "../models.js";
 import { knowledgeBlock } from "../services/knowledge.js";
 import { buildStepTools } from "../tools/index.js";
-import { spaceContextOf } from "../tools/plugin.js";
+import { callPluginTool, spaceContextOf } from "../tools/plugin.js";
 import { personUploads } from "../tools/store.js";
 import { runWidgetStep } from "../widgets/step.js";
 import { decide } from "./decide.js";
@@ -338,7 +338,48 @@ async function runAgentEach(step, ctx) {
         at: new Date().toISOString(),
     };
 }
+/**
+ * A call's input as the step's answers fill it: string values are templates; a filled-in whole
+ * number or true/false becomes one, an empty value is left out.
+ */
+function callInput(value, ctx) {
+    if (typeof value === "string") {
+        const text = renderTemplate(value, ctx.scope).trim();
+        if (!text) {
+            return undefined;
+        }
+        if (/^-?\d+(\.\d+)?$/.test(text)) {
+            return Number(text);
+        }
+        return text === "true" ? true : text === "false" ? false : text;
+    }
+    if (Array.isArray(value)) {
+        return value.map((v) => callInput(v, ctx)).filter((v) => v !== undefined);
+    }
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .map(([k, v]) => [k, callInput(v, ctx)])
+            .filter(([, v]) => v !== undefined));
+    }
+    return value;
+}
+/** A step's `call`: one plugin tool, no model; its answer is the step's json output as it is. */
+async function runCallStep(step, ctx) {
+    // What it is doing is the step's `working` line, shown as it starts, and what the tool says.
+    const answer = await callPluginTool(step.call.tool, callInput(step.call.input, ctx), ctx);
+    if (answer &&
+        typeof answer === "object" &&
+        "error" in answer &&
+        Object.keys(answer).length === 1) {
+        throw new StepError(String(answer.error));
+    }
+    const json = answer && typeof answer === "object" && !Array.isArray(answer) ? answer : { result: answer };
+    return { json, at: new Date().toISOString() };
+}
 export async function runAgentStep(step, ctx) {
+    if (step.call) {
+        return runCallStep({ ...step, call: step.call }, ctx);
+    }
     if (step.each) {
         return runAgentEach(step, ctx);
     }

package/apps/runtime/dist/env.js

@@ -222,6 +222,11 @@ export const env = {
         watch: !manageUrl && str("PLUGINS_WATCH", "1") === "1",
         /** Plugins' jobs (`server.every`) run. Off (`PLUGIN_JOBS=0`) where another process runs them. */
         jobs: str("PLUGIN_JOBS", "1") === "1",
+        /**
+         * Public keys (Ed25519, SPKI DER in base64) whose signature a Pro module may carry, besides
+         * the one this runtime ships with (plugins/pro-keys.ts). For testing packages signed elsewhere.
+         */
+        proKeys: list("PRO_MODULES_KEYS"),
     },
     limits: {
         visitorRunsPerHour: num("LIMIT_VISITOR_RUNS_PER_HOUR", 6),

package/apps/runtime/dist/index.js

@@ -8,6 +8,7 @@ import { managed } from "./manage.js";
 import { checkModelsAtStart, loadCatalog, loadLocalModels } from "./models.js";
 import { startJobs } from "./plugins/jobs.js";
 import { loadPlugins } from "./plugins/loader.js";
+import { loadEntitlement, startProChecks } from "./plugins/pro.js";
 import { closeBrowser } from "./render/chromium.js";
 import { clearRunning, writeRunning } from "./running.js";
 import { syncMarketplace } from "./services/marketplace.js";
@@ -16,6 +17,8 @@ import { purgeUnusedStores } from "./store/index.js";
 import { LOCAL_TENANT } from "./tenants/tenant.js";
 import { onRestart } from "./update.js";
 await migrateControlDb();
+// What the linked account's plan confirmed last: the Pro modules it includes load with the rest.
+await loadEntitlement();
 // Before any tenant database opens: each gets the plugins' own tables as it does.
 await loadPlugins();
 startJobs();
@@ -31,6 +34,7 @@ else {
     await loadLocalModels();
     void loadCatalog();
     void checkModelsAtStart().catch(() => undefined);
+    startProChecks();
 }
 // The marketplace's starters and the starred entries, kept for offline use; checked hourly.
 void syncMarketplace();

package/apps/runtime/dist/manage.js

@@ -47,6 +47,11 @@ function toClaims(payload) {
  * `audiences` are the resources this caller accepts; null skips the audience check.
  */
 export async function verifyToken(token, audiences, base = env.manage.url) {
+    const payload = await verifySigned(token, audiences, base);
+    return payload ? toClaims(payload) : null;
+}
+/** Any token the Manage-App at `base` signed (its JWKS, its issuer); null when it is not one. */
+export async function verifySigned(token, audiences, base = env.manage.url) {
     try {
         const d = await discovery(base);
         let keys = keySets.get(d.jwks_uri);
@@ -58,7 +63,7 @@ export async function verifyToken(token, audiences, base = env.manage.url) {
             issuer: d.issuer,
             ...(audiences ? { audience: audiences } : {}),
         });
-        return toClaims(payload);
+        return payload;
     }
     catch {
         return null;

package/apps/runtime/dist/plugins/loader.js

@@ -10,12 +10,14 @@ import { pluginConnections } from "../connectors/plugin-connections.js";
 import { db, onTenantOpen } from "../db/client.js";
 import { parseDocument } from "../documents/parse.js";
 import { env } from "../env.js";
+import { managed } from "../manage.js";
 import { ModelUnavailableError, textModel } from "../models.js";
 import { putIndexEntry, removeIndexEntries } from "../services/project-index.js";
 import { originData } from "../services/space-origin.js";
 import { safeFetch } from "../tools/net-guard.js";
 import { discoverPlugins } from "./discovery.js";
 import { migrateOpenTenants, migratePlugins } from "./migrations.js";
+import { proModulesDir, proSources } from "./pro-state.js";
 import { publicUrlOf } from "./public.js";
 import { announceChange, compileRoute, dropPlugin, emptyRecord, loadedPlugin, loadedPlugins, setPlugin, } from "./registry.js";
 /**
@@ -231,11 +233,16 @@ export function pluginProblems() {
 }
 function discover() {
     const result = discoverPlugins(pluginDirs());
-    problems = result.problems;
+    // Pro modules come last and only while the plan has them (pro-state.ts).
+    const pro = managed ? null : discoverPlugins([proModulesDir()]);
+    const allowed = pro
+        ? proSources(pro.found, new Set(result.found.map((s) => s.id)))
+        : { load: [], problems: [] };
+    problems = [...result.problems, ...(pro?.problems ?? []), ...allowed.problems];
     for (const problem of problems) {
         console.error(`[plugins] ${problem.path}: ${problem.message}`);
     }
-    return result.found;
+    return [...result.found, ...allowed.load];
 }
 /** One load at a time: the watcher and a person may ask for a reload at the same moment. */
 let queue = Promise.resolve();

package/apps/runtime/dist/plugins/pro-keys.js

@@ -0,0 +1,34 @@
+import { createPublicKey, verify } from "node:crypto";
+import { env } from "../env.js";
+/**
+ * The keys a Pro module's package must be signed with (docs/content/dev/plugins/pro-modules).
+ * Only the public halves are here; the private one signs in the build of the closed plugins and
+ * is kept nowhere else. A new key is added beside the old one, which goes a release later.
+ */
+const SHIPPED = ["MCowBQYDK2VwAyEAqVQAptgVhkBtobNObBDHAZzKFdted0nH0I+LWAHGER8="];
+let keys = null;
+function trusted() {
+    keys ??= [...SHIPPED, ...env.plugins.proKeys].map((der) => createPublicKey({ key: Buffer.from(der, "base64"), format: "der", type: "spki" }));
+    return keys;
+}
+/** What the signature covers; the packer of the closed plugins writes the same text. */
+const message = (p) => `engenty-module:v1\n${p.id}\n${p.version}\n${p.runtime}\n${p.sha256}`;
+/** Whether one of the trusted keys signed this package for this release. */
+export function signedByUs(p) {
+    let signature;
+    try {
+        signature = Buffer.from(p.signature, "base64");
+    }
+    catch {
+        return false;
+    }
+    const data = Buffer.from(message(p));
+    return trusted().some((key) => {
+        try {
+            return verify(null, data, key, signature);
+        }
+        catch {
+            return false;
+        }
+    });
+}

package/apps/runtime/dist/plugins/pro-state.js

@@ -0,0 +1,83 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { packageVersion } from "../cli/home.js";
+import { env } from "../env.js";
+import { managed } from "../manage.js";
+/**
+ * Which Pro modules may load (docs/content/dev/plugins/pro-modules). A Pro module is a closed
+ * plugin the linked account's plan includes, installed by pro.ts into a folder of its own. It
+ * loads while the entitlement the account's Manage-App signed lists it and has not ended, and
+ * only in the release it was built for. Kept apart from pro.ts, so the loader needs no network.
+ */
+/** Where Pro modules are installed: apart from the person's own plugins, not watched. */
+export const proModulesDir = () => join(env.dataDir, "pro-modules");
+/** Written beside an installed module: what was installed, for which release. */
+export const INSTALLED_FILE = ".engenty-module.json";
+export const ENTITLEMENT_SETTING = "pro.entitlement";
+let entitlement = null;
+export function currentEntitlement() {
+    return entitlement;
+}
+export function setEntitlement(value) {
+    entitlement = value;
+}
+/** `0.2.26` → `v0.2.26`: the release this runtime is. */
+export const runtimeTag = () => `v${packageVersion()}`;
+export function installedModule(root) {
+    try {
+        return JSON.parse(readFileSync(join(root, INSTALLED_FILE), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function heldBack(source) {
+    if (managed) {
+        return "managed";
+    }
+    const installed = installedModule(source.root);
+    if (!installed || installed.id !== source.id) {
+        return "not_installed";
+    }
+    if (installed.runtime !== runtimeTag()) {
+        return "release";
+    }
+    if (!(entitlement && entitlement.expiresAt > Date.now())) {
+        return "unconfirmed";
+    }
+    if (!entitlement.modules.includes(source.id)) {
+        return "plan";
+    }
+    return null;
+}
+let held = new Map();
+/** The Pro modules that were found and did not load, with the reason, as of the last look. */
+export function heldBackModules() {
+    return held;
+}
+/**
+ * The Pro modules of a look at the folders that may load, marked as such. A Pro module never
+ * takes the id of a plugin found elsewhere.
+ */
+export function proSources(found, taken) {
+    const load = [];
+    const problems = [];
+    held = new Map();
+    for (const source of found) {
+        if (taken.has(source.id)) {
+            problems.push({
+                path: source.root,
+                message: `Plugin "${source.id}" is already loaded from another folder.`,
+            });
+            continue;
+        }
+        const reason = heldBack(source);
+        if (reason) {
+            held.set(source.id, reason);
+        }
+        else {
+            load.push({ ...source, pro: true });
+        }
+    }
+    return { load, problems };
+}

package/apps/runtime/dist/plugins/pro.js

@@ -0,0 +1,316 @@
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { unzipSync } from "fflate";
+import { accountToken, linkedAccount } from "../auth/account.js";
+import { env } from "../env.js";
+import { managed, verifySigned } from "../manage.js";
+import { deleteSetting, readSetting, writeSetting } from "../settings.js";
+import { MANIFEST_FILE } from "./discovery.js";
+import { findNewPlugins, reloadPlugin } from "./loader.js";
+import { signedByUs } from "./pro-keys.js";
+import { currentEntitlement, ENTITLEMENT_SETTING, heldBackModules, INSTALLED_FILE, installedModule, proModulesDir, runtimeTag, setEntitlement, } from "./pro-state.js";
+import { loadedPlugin } from "./registry.js";
+/*
+ * Pro modules on a runtime that runs alone (docs/content/dev/plugins/pro-modules): the closed
+ * plugins the linked account's plan includes, fetched from its Manage-App.
+ *
+ *   GET /v1/modules?runtime=<release>              what is built for this release, the plan's
+ *                                                  part of it, and the signed entitlement
+ *   GET /v1/modules/:id/package?runtime=<release>  one module's zip
+ *
+ * A package is taken only when its SHA-256 and the signature over id, version, release and that
+ * hash check out against a key this runtime carries (pro-keys.ts): neither the Manage-App nor
+ * the way there can hand over code of their own.
+ */
+/** The audience of an entitlement, as the Manage-App signs it. */
+const AUDIENCE = "urn:engenty:wizards:modules";
+/** Larger packages are refused before they are read. */
+const MAX_PACKAGE = 30 * 1024 * 1024;
+/** What a package may hold, besides its manifest. */
+const PARTS = ["dist/", "migrations/"];
+const base = () => `${env.local.accountUrl}/v1/modules`;
+/** Something the person can mend or retry; the message is for them. */
+export class ProModuleError extends Error {
+    status;
+    code;
+    constructor(message, status = 400, code = "pro_module") {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+let listing = null;
+let lastError = null;
+// --- the entitlement -------------------------------------------------------------------
+/**
+ * At start, before the plugins load: what the last check said, while it lasts and belongs to the
+ * account that is linked now.
+ */
+export async function loadEntitlement() {
+    if (managed) {
+        return;
+    }
+    const [stored, account] = await Promise.all([
+        readSetting(ENTITLEMENT_SETTING),
+        linkedAccount(),
+    ]);
+    setEntitlement(stored && account && stored.tenantId === account.tenantId ? stored : null);
+}
+async function keep(value) {
+    setEntitlement(value);
+    if (value) {
+        await writeSetting(ENTITLEMENT_SETTING, value);
+    }
+    else {
+        await deleteSetting(ENTITLEMENT_SETTING);
+    }
+}
+/** Loads and unloads Pro modules after the entitlement changed. */
+async function apply(before) {
+    const after = currentEntitlement();
+    const same = before?.modules.join() === after?.modules.join() &&
+        (before?.expiresAt ?? 0) > Date.now() === (after?.expiresAt ?? 0) > Date.now();
+    if (!same) {
+        await findNewPlugins();
+    }
+}
+async function call(path, token) {
+    const url = new URL(`${base()}${path}`);
+    url.searchParams.set("runtime", runtimeTag());
+    const res = await fetch(url, {
+        headers: { authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(60_000),
+    }).catch(() => null);
+    if (!res) {
+        throw new ProModuleError("Dein engenty-Konto ist gerade nicht erreichbar.", 502, "offline");
+    }
+    return res;
+}
+/**
+ * Asks the account what its plan includes now, keeps the signed answer and fetches what an
+ * installed module needs (a new release, a new build). Unreachable: what was confirmed lasts
+ * until it ends.
+ */
+export async function refreshPro() {
+    if (managed) {
+        return;
+    }
+    const before = currentEntitlement();
+    const account = await linkedAccount();
+    if (!account) {
+        listing = null;
+        lastError = null;
+        await keep(null);
+        await apply(before);
+        return;
+    }
+    try {
+        const token = await accountToken();
+        if (!token) {
+            throw new ProModuleError("Dein engenty-Konto ist gerade nicht erreichbar.", 502, "offline");
+        }
+        const res = await call("", token);
+        if (res.status === 401) {
+            throw new ProModuleError("Das engenty-Konto nimmt diese Anmeldung nicht mehr an.", 403);
+        }
+        if (!res.ok) {
+            throw new ProModuleError(`Das Konto antwortet nicht wie erwartet (${res.status}).`, 502);
+        }
+        const answer = (await res.json());
+        const claims = await verifySigned(answer.entitlement?.token ?? "", [AUDIENCE], env.local.accountUrl);
+        if (!claims || claims.sub !== account.tenantId || !Array.isArray(claims.modules)) {
+            throw new ProModuleError("Die Bestätigung des Pakets ließ sich nicht prüfen.", 502);
+        }
+        listing = answer;
+        lastError = null;
+        await keep({
+            tenantId: account.tenantId,
+            modules: claims.modules.map(String),
+            plan: answer.plan ?? null,
+            expiresAt: (claims.exp ?? 0) * 1000,
+            checkedAt: Date.now(),
+        });
+        await apply(before);
+        await updateInstalled();
+    }
+    catch (err) {
+        lastError = err.message;
+        console.error("[pro modules]", lastError);
+    }
+}
+let timer = null;
+/** Checks at start, then once a day while the runtime runs; a check that failed, within the hour. */
+export function startProChecks() {
+    if (managed || timer) {
+        return;
+    }
+    void refreshPro();
+    timer = setInterval(() => {
+        const checkedAt = currentEntitlement()?.checkedAt ?? 0;
+        if (lastError || Date.now() - checkedAt > 23 * 3600_000) {
+            void refreshPro();
+        }
+    }, 3600_000);
+    timer.unref();
+}
+// --- installing ------------------------------------------------------------------------
+async function installedIds() {
+    const entries = await readdir(proModulesDir(), { withFileTypes: true }).catch(() => []);
+    return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
+}
+/** Installed modules built for another release or from another build are fetched anew. */
+async function updateInstalled() {
+    for (const id of await installedIds()) {
+        const entry = listing?.modules.find((m) => m.id === id);
+        const installed = installedModule(join(proModulesDir(), id));
+        if (entry?.included && installed?.sha256 !== entry.sha256) {
+            await installPro(id).catch((err) => console.error(`[pro modules] ${id}: update failed:`, err.message));
+        }
+    }
+}
+/** The files of a zip, refusing any that would land outside the module's folder. */
+function filesOf(zip) {
+    let files;
+    try {
+        files = unzipSync(zip);
+    }
+    catch {
+        throw new ProModuleError("Das Paket ist beschädigt.", 502);
+    }
+    const out = {};
+    for (const [name, data] of Object.entries(files)) {
+        if (name.endsWith("/")) {
+            continue;
+        }
+        const parts = name.split("/");
+        const safe = parts.every((p) => p && p !== "." && p !== ".." && !p.includes("\\"));
+        const allowed = name === MANIFEST_FILE || PARTS.some((part) => name.startsWith(part));
+        if (!(safe && allowed)) {
+            throw new ProModuleError(`Das Paket enthält eine unerlaubte Datei: ${name}`, 502);
+        }
+        out[name] = data;
+    }
+    return out;
+}
+/** Fetches one module of the plan, checks it and puts it in place; then it loads. */
+export async function installPro(id) {
+    if (managed) {
+        throw new ProModuleError("Hier nicht verfügbar.", 404, "not_found");
+    }
+    const token = await accountToken();
+    if (!token) {
+        throw new ProModuleError("Verbinde zuerst dein engenty-Konto (Einstellungen → Konto).", 409);
+    }
+    if (!listing) {
+        await refreshPro();
+    }
+    const entry = listing?.modules.find((m) => m.id === id);
+    if (!entry) {
+        throw new ProModuleError(`Für ${runtimeTag()} gibt es dieses Modul nicht.`, 404, "not_found");
+    }
+    if (!entry.included) {
+        throw new ProModuleError("Dieses Modul ist nicht Teil deines Pakets.", 403, "plan");
+    }
+    const res = await call(`/${encodeURIComponent(id)}/package`, token);
+    if (!res.ok) {
+        throw new ProModuleError(`Das Modul ließ sich nicht laden (${res.status}).`, 502);
+    }
+    if (Number(res.headers.get("content-length") ?? 0) > MAX_PACKAGE) {
+        throw new ProModuleError("Das Paket ist zu groß.", 502);
+    }
+    const zip = new Uint8Array(await res.arrayBuffer());
+    const sha256 = createHash("sha256").update(zip).digest("hex");
+    const genuine = sha256 === entry.sha256 &&
+        signedByUs({
+            id,
+            version: entry.version,
+            runtime: runtimeTag(),
+            sha256,
+            signature: entry.signature,
+        });
+    if (zip.length > MAX_PACKAGE || !genuine) {
+        throw new ProModuleError("Das Paket ist nicht von engenty signiert und wurde verworfen.", 502);
+    }
+    const files = filesOf(zip);
+    const manifest = JSON.parse(new TextDecoder().decode(files[MANIFEST_FILE] ?? new Uint8Array()));
+    if (manifest?.id !== id) {
+        throw new ProModuleError("Das Paket passt nicht zu diesem Modul.", 502);
+    }
+    const dir = proModulesDir();
+    const target = join(dir, id);
+    const fresh = join(dir, `.new-${id}-${randomBytes(4).toString("hex")}`);
+    const old = join(dir, `.old-${id}-${randomBytes(4).toString("hex")}`);
+    await mkdir(fresh, { recursive: true });
+    try {
+        for (const [path, data] of Object.entries(files)) {
+            await mkdir(dirname(join(fresh, path)), { recursive: true });
+            await writeFile(join(fresh, path), data);
+        }
+        const installed = {
+            id,
+            version: entry.version,
+            runtime: runtimeTag(),
+            sha256,
+            installedAt: new Date().toISOString(),
+        };
+        await writeFile(join(fresh, INSTALLED_FILE), `${JSON.stringify(installed, null, 2)}\n`);
+        if (existsSync(target)) {
+            await rename(target, old);
+        }
+        await rename(fresh, target);
+    }
+    finally {
+        await rm(fresh, { recursive: true, force: true });
+        await rm(old, { recursive: true, force: true });
+    }
+    await reloadPlugin(id);
+}
+/** Removes an installed module; its tables and what is in them stay. */
+export async function removePro(id) {
+    if (managed || !(await installedIds()).includes(id)) {
+        throw new ProModuleError("Dieses Modul ist nicht installiert.", 404, "not_found");
+    }
+    await rm(join(proModulesDir(), id), { recursive: true, force: true });
+    await findNewPlugins();
+}
+export async function proState() {
+    const entitlement = currentEntitlement();
+    const account = await linkedAccount();
+    const ids = new Set([...(listing?.modules.map((m) => m.id) ?? []), ...(await installedIds())]);
+    const modules = [...ids].sort().map((id) => {
+        const entry = listing?.modules.find((m) => m.id === id);
+        const installed = installedModule(join(proModulesDir(), id));
+        const plugin = loadedPlugin(id);
+        return {
+            id,
+            name: entry?.name ?? plugin?.source.manifest.name ?? id,
+            version: entry?.version ?? installed?.version ?? "",
+            description: entry?.description ?? plugin?.source.manifest.description ?? "",
+            size: entry?.size ?? null,
+            included: entitlement?.modules.includes(id) ?? false,
+            installed: installed ? { version: installed.version, runtime: installed.runtime } : null,
+            loaded: Boolean(plugin?.source.pro),
+            heldBack: heldBackModules().get(id) ?? null,
+            update: Boolean(entry?.included && installed && installed.sha256 !== entry.sha256),
+        };
+    });
+    return {
+        linked: Boolean(account),
+        /** Where the plans are: `<accountUrl>/billing`. */
+        accountUrl: env.local.accountUrl,
+        runtime: runtimeTag(),
+        plan: entitlement?.plan ?? listing?.plan ?? null,
+        expiresAt: entitlement ? new Date(entitlement.expiresAt).toISOString() : null,
+        checkedAt: entitlement ? new Date(entitlement.checkedAt).toISOString() : null,
+        error: lastError,
+        modules,
+    };
+}
+/** For tests: forget what the account said. */
+export function resetProForTests() {
+    listing = null;
+    lastError = null;
+    setEntitlement(null);
+}