wizards 0.2.29 → 0.2.30

package/apps/runtime/dist/auth/account.js

@@ -91,6 +91,14 @@ export async function accountToken() {
     if (cached && cached.expiresAt - Date.now() > 60_000) {
         return cached.token;
     }
+    // One refresh at a time: a refresh token is used once, a second caller would be refused.
+    refreshing ??= refreshAccount().finally(() => {
+        refreshing = null;
+    });
+    return refreshing;
+}
+let refreshing = null;
+async function refreshAccount() {
     const refresh = await vaultGet(REFRESH);
     if (!refresh) {
         return null;

package/apps/runtime/dist/auth/index.js

@@ -7,6 +7,7 @@ import { nanoid } from "nanoid";
 import { control, controlDb, withTenant } from "../db/client.js";
 import { basePath, env } from "../env.js";
 import { discovery, managed, tokenRequest, verifyToken, } from "../manage.js";
+import { refreshPro } from "../plugins/pro.js";
 import { seal, unseal } from "../secrets/crypto.js";
 import { LOCAL_TENANT } from "../tenants/tenant.js";
 import { finishLink } from "./account.js";
@@ -278,6 +279,8 @@ export const authRoutes = new Hono()
             await finishLink(code, rawState);
             // What is published here goes to the account's cloud, from now on and once for all there is.
             void firstSync();
+            // The Pro modules the account's plan includes.
+            void refreshPro();
             return c.html(closePage("Angemeldet. Du kannst dieses Fenster schließen."));
         }
         catch (err) {

package/apps/runtime/dist/env.js

@@ -222,6 +222,11 @@ export const env = {
         watch: !manageUrl && str("PLUGINS_WATCH", "1") === "1",
         /** Plugins' jobs (`server.every`) run. Off (`PLUGIN_JOBS=0`) where another process runs them. */
         jobs: str("PLUGIN_JOBS", "1") === "1",
+        /**
+         * Public keys (Ed25519, SPKI DER in base64) whose signature a Pro module may carry, besides
+         * the one this runtime ships with (plugins/pro-keys.ts). For testing packages signed elsewhere.
+         */
+        proKeys: list("PRO_MODULES_KEYS"),
     },
     limits: {
         visitorRunsPerHour: num("LIMIT_VISITOR_RUNS_PER_HOUR", 6),

package/apps/runtime/dist/index.js

@@ -8,6 +8,7 @@ import { managed } from "./manage.js";
 import { checkModelsAtStart, loadCatalog, loadLocalModels } from "./models.js";
 import { startJobs } from "./plugins/jobs.js";
 import { loadPlugins } from "./plugins/loader.js";
+import { loadEntitlement, startProChecks } from "./plugins/pro.js";
 import { closeBrowser } from "./render/chromium.js";
 import { clearRunning, writeRunning } from "./running.js";
 import { syncMarketplace } from "./services/marketplace.js";
@@ -16,6 +17,8 @@ import { purgeUnusedStores } from "./store/index.js";
 import { LOCAL_TENANT } from "./tenants/tenant.js";
 import { onRestart } from "./update.js";
 await migrateControlDb();
+// What the linked account's plan confirmed last: the Pro modules it includes load with the rest.
+await loadEntitlement();
 // Before any tenant database opens: each gets the plugins' own tables as it does.
 await loadPlugins();
 startJobs();
@@ -31,6 +34,7 @@ else {
     await loadLocalModels();
     void loadCatalog();
     void checkModelsAtStart().catch(() => undefined);
+    startProChecks();
 }
 // The marketplace's starters and the starred entries, kept for offline use; checked hourly.
 void syncMarketplace();

package/apps/runtime/dist/manage.js

@@ -47,6 +47,11 @@ function toClaims(payload) {
  * `audiences` are the resources this caller accepts; null skips the audience check.
  */
 export async function verifyToken(token, audiences, base = env.manage.url) {
+    const payload = await verifySigned(token, audiences, base);
+    return payload ? toClaims(payload) : null;
+}
+/** Any token the Manage-App at `base` signed (its JWKS, its issuer); null when it is not one. */
+export async function verifySigned(token, audiences, base = env.manage.url) {
     try {
         const d = await discovery(base);
         let keys = keySets.get(d.jwks_uri);
@@ -58,7 +63,7 @@ export async function verifyToken(token, audiences, base = env.manage.url) {
             issuer: d.issuer,
             ...(audiences ? { audience: audiences } : {}),
         });
-        return toClaims(payload);
+        return payload;
     }
     catch {
         return null;

package/apps/runtime/dist/plugins/loader.js

@@ -10,12 +10,14 @@ import { pluginConnections } from "../connectors/plugin-connections.js";
 import { db, onTenantOpen } from "../db/client.js";
 import { parseDocument } from "../documents/parse.js";
 import { env } from "../env.js";
+import { managed } from "../manage.js";
 import { ModelUnavailableError, textModel } from "../models.js";
 import { putIndexEntry, removeIndexEntries } from "../services/project-index.js";
 import { originData } from "../services/space-origin.js";
 import { safeFetch } from "../tools/net-guard.js";
 import { discoverPlugins } from "./discovery.js";
 import { migrateOpenTenants, migratePlugins } from "./migrations.js";
+import { proModulesDir, proSources } from "./pro-state.js";
 import { publicUrlOf } from "./public.js";
 import { announceChange, compileRoute, dropPlugin, emptyRecord, loadedPlugin, loadedPlugins, setPlugin, } from "./registry.js";
 /**
@@ -231,11 +233,16 @@ export function pluginProblems() {
 }
 function discover() {
     const result = discoverPlugins(pluginDirs());
-    problems = result.problems;
+    // Pro modules come last and only while the plan has them (pro-state.ts).
+    const pro = managed ? null : discoverPlugins([proModulesDir()]);
+    const allowed = pro
+        ? proSources(pro.found, new Set(result.found.map((s) => s.id)))
+        : { load: [], problems: [] };
+    problems = [...result.problems, ...(pro?.problems ?? []), ...allowed.problems];
     for (const problem of problems) {
         console.error(`[plugins] ${problem.path}: ${problem.message}`);
     }
-    return result.found;
+    return [...result.found, ...allowed.load];
 }
 /** One load at a time: the watcher and a person may ask for a reload at the same moment. */
 let queue = Promise.resolve();

package/apps/runtime/dist/plugins/pro-keys.js

@@ -0,0 +1,34 @@
+import { createPublicKey, verify } from "node:crypto";
+import { env } from "../env.js";
+/**
+ * The keys a Pro module's package must be signed with (docs/content/dev/plugins/pro-modules).
+ * Only the public halves are here; the private one signs in the build of the closed plugins and
+ * is kept nowhere else. A new key is added beside the old one, which goes a release later.
+ */
+const SHIPPED = ["MCowBQYDK2VwAyEAqVQAptgVhkBtobNObBDHAZzKFdted0nH0I+LWAHGER8="];
+let keys = null;
+function trusted() {
+    keys ??= [...SHIPPED, ...env.plugins.proKeys].map((der) => createPublicKey({ key: Buffer.from(der, "base64"), format: "der", type: "spki" }));
+    return keys;
+}
+/** What the signature covers; the packer of the closed plugins writes the same text. */
+const message = (p) => `engenty-module:v1\n${p.id}\n${p.version}\n${p.runtime}\n${p.sha256}`;
+/** Whether one of the trusted keys signed this package for this release. */
+export function signedByUs(p) {
+    let signature;
+    try {
+        signature = Buffer.from(p.signature, "base64");
+    }
+    catch {
+        return false;
+    }
+    const data = Buffer.from(message(p));
+    return trusted().some((key) => {
+        try {
+            return verify(null, data, key, signature);
+        }
+        catch {
+            return false;
+        }
+    });
+}

package/apps/runtime/dist/plugins/pro-state.js

@@ -0,0 +1,83 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { packageVersion } from "../cli/home.js";
+import { env } from "../env.js";
+import { managed } from "../manage.js";
+/**
+ * Which Pro modules may load (docs/content/dev/plugins/pro-modules). A Pro module is a closed
+ * plugin the linked account's plan includes, installed by pro.ts into a folder of its own. It
+ * loads while the entitlement the account's Manage-App signed lists it and has not ended, and
+ * only in the release it was built for. Kept apart from pro.ts, so the loader needs no network.
+ */
+/** Where Pro modules are installed: apart from the person's own plugins, not watched. */
+export const proModulesDir = () => join(env.dataDir, "pro-modules");
+/** Written beside an installed module: what was installed, for which release. */
+export const INSTALLED_FILE = ".engenty-module.json";
+export const ENTITLEMENT_SETTING = "pro.entitlement";
+let entitlement = null;
+export function currentEntitlement() {
+    return entitlement;
+}
+export function setEntitlement(value) {
+    entitlement = value;
+}
+/** `0.2.26` → `v0.2.26`: the release this runtime is. */
+export const runtimeTag = () => `v${packageVersion()}`;
+export function installedModule(root) {
+    try {
+        return JSON.parse(readFileSync(join(root, INSTALLED_FILE), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function heldBack(source) {
+    if (managed) {
+        return "managed";
+    }
+    const installed = installedModule(source.root);
+    if (!installed || installed.id !== source.id) {
+        return "not_installed";
+    }
+    if (installed.runtime !== runtimeTag()) {
+        return "release";
+    }
+    if (!(entitlement && entitlement.expiresAt > Date.now())) {
+        return "unconfirmed";
+    }
+    if (!entitlement.modules.includes(source.id)) {
+        return "plan";
+    }
+    return null;
+}
+let held = new Map();
+/** The Pro modules that were found and did not load, with the reason, as of the last look. */
+export function heldBackModules() {
+    return held;
+}
+/**
+ * The Pro modules of a look at the folders that may load, marked as such. A Pro module never
+ * takes the id of a plugin found elsewhere.
+ */
+export function proSources(found, taken) {
+    const load = [];
+    const problems = [];
+    held = new Map();
+    for (const source of found) {
+        if (taken.has(source.id)) {
+            problems.push({
+                path: source.root,
+                message: `Plugin "${source.id}" is already loaded from another folder.`,
+            });
+            continue;
+        }
+        const reason = heldBack(source);
+        if (reason) {
+            held.set(source.id, reason);
+        }
+        else {
+            load.push({ ...source, pro: true });
+        }
+    }
+    return { load, problems };
+}

package/apps/runtime/dist/plugins/pro.js

@@ -0,0 +1,316 @@
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { unzipSync } from "fflate";
+import { accountToken, linkedAccount } from "../auth/account.js";
+import { env } from "../env.js";
+import { managed, verifySigned } from "../manage.js";
+import { deleteSetting, readSetting, writeSetting } from "../settings.js";
+import { MANIFEST_FILE } from "./discovery.js";
+import { findNewPlugins, reloadPlugin } from "./loader.js";
+import { signedByUs } from "./pro-keys.js";
+import { currentEntitlement, ENTITLEMENT_SETTING, heldBackModules, INSTALLED_FILE, installedModule, proModulesDir, runtimeTag, setEntitlement, } from "./pro-state.js";
+import { loadedPlugin } from "./registry.js";
+/*
+ * Pro modules on a runtime that runs alone (docs/content/dev/plugins/pro-modules): the closed
+ * plugins the linked account's plan includes, fetched from its Manage-App.
+ *
+ *   GET /v1/modules?runtime=<release>              what is built for this release, the plan's
+ *                                                  part of it, and the signed entitlement
+ *   GET /v1/modules/:id/package?runtime=<release>  one module's zip
+ *
+ * A package is taken only when its SHA-256 and the signature over id, version, release and that
+ * hash check out against a key this runtime carries (pro-keys.ts): neither the Manage-App nor
+ * the way there can hand over code of their own.
+ */
+/** The audience of an entitlement, as the Manage-App signs it. */
+const AUDIENCE = "urn:engenty:wizards:modules";
+/** Larger packages are refused before they are read. */
+const MAX_PACKAGE = 30 * 1024 * 1024;
+/** What a package may hold, besides its manifest. */
+const PARTS = ["dist/", "migrations/"];
+const base = () => `${env.local.accountUrl}/v1/modules`;
+/** Something the person can mend or retry; the message is for them. */
+export class ProModuleError extends Error {
+    status;
+    code;
+    constructor(message, status = 400, code = "pro_module") {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+let listing = null;
+let lastError = null;
+// --- the entitlement -------------------------------------------------------------------
+/**
+ * At start, before the plugins load: what the last check said, while it lasts and belongs to the
+ * account that is linked now.
+ */
+export async function loadEntitlement() {
+    if (managed) {
+        return;
+    }
+    const [stored, account] = await Promise.all([
+        readSetting(ENTITLEMENT_SETTING),
+        linkedAccount(),
+    ]);
+    setEntitlement(stored && account && stored.tenantId === account.tenantId ? stored : null);
+}
+async function keep(value) {
+    setEntitlement(value);
+    if (value) {
+        await writeSetting(ENTITLEMENT_SETTING, value);
+    }
+    else {
+        await deleteSetting(ENTITLEMENT_SETTING);
+    }
+}
+/** Loads and unloads Pro modules after the entitlement changed. */
+async function apply(before) {
+    const after = currentEntitlement();
+    const same = before?.modules.join() === after?.modules.join() &&
+        (before?.expiresAt ?? 0) > Date.now() === (after?.expiresAt ?? 0) > Date.now();
+    if (!same) {
+        await findNewPlugins();
+    }
+}
+async function call(path, token) {
+    const url = new URL(`${base()}${path}`);
+    url.searchParams.set("runtime", runtimeTag());
+    const res = await fetch(url, {
+        headers: { authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(60_000),
+    }).catch(() => null);
+    if (!res) {
+        throw new ProModuleError("Dein engenty-Konto ist gerade nicht erreichbar.", 502, "offline");
+    }
+    return res;
+}
+/**
+ * Asks the account what its plan includes now, keeps the signed answer and fetches what an
+ * installed module needs (a new release, a new build). Unreachable: what was confirmed lasts
+ * until it ends.
+ */
+export async function refreshPro() {
+    if (managed) {
+        return;
+    }
+    const before = currentEntitlement();
+    const account = await linkedAccount();
+    if (!account) {
+        listing = null;
+        lastError = null;
+        await keep(null);
+        await apply(before);
+        return;
+    }
+    try {
+        const token = await accountToken();
+        if (!token) {
+            throw new ProModuleError("Dein engenty-Konto ist gerade nicht erreichbar.", 502, "offline");
+        }
+        const res = await call("", token);
+        if (res.status === 401) {
+            throw new ProModuleError("Das engenty-Konto nimmt diese Anmeldung nicht mehr an.", 403);
+        }
+        if (!res.ok) {
+            throw new ProModuleError(`Das Konto antwortet nicht wie erwartet (${res.status}).`, 502);
+        }
+        const answer = (await res.json());
+        const claims = await verifySigned(answer.entitlement?.token ?? "", [AUDIENCE], env.local.accountUrl);
+        if (!claims || claims.sub !== account.tenantId || !Array.isArray(claims.modules)) {
+            throw new ProModuleError("Die Bestätigung des Pakets ließ sich nicht prüfen.", 502);
+        }
+        listing = answer;
+        lastError = null;
+        await keep({
+            tenantId: account.tenantId,
+            modules: claims.modules.map(String),
+            plan: answer.plan ?? null,
+            expiresAt: (claims.exp ?? 0) * 1000,
+            checkedAt: Date.now(),
+        });
+        await apply(before);
+        await updateInstalled();
+    }
+    catch (err) {
+        lastError = err.message;
+        console.error("[pro modules]", lastError);
+    }
+}
+let timer = null;
+/** Checks at start, then once a day while the runtime runs; a check that failed, within the hour. */
+export function startProChecks() {
+    if (managed || timer) {
+        return;
+    }
+    void refreshPro();
+    timer = setInterval(() => {
+        const checkedAt = currentEntitlement()?.checkedAt ?? 0;
+        if (lastError || Date.now() - checkedAt > 23 * 3600_000) {
+            void refreshPro();
+        }
+    }, 3600_000);
+    timer.unref();
+}
+// --- installing ------------------------------------------------------------------------
+async function installedIds() {
+    const entries = await readdir(proModulesDir(), { withFileTypes: true }).catch(() => []);
+    return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
+}
+/** Installed modules built for another release or from another build are fetched anew. */
+async function updateInstalled() {
+    for (const id of await installedIds()) {
+        const entry = listing?.modules.find((m) => m.id === id);
+        const installed = installedModule(join(proModulesDir(), id));
+        if (entry?.included && installed?.sha256 !== entry.sha256) {
+            await installPro(id).catch((err) => console.error(`[pro modules] ${id}: update failed:`, err.message));
+        }
+    }
+}
+/** The files of a zip, refusing any that would land outside the module's folder. */
+function filesOf(zip) {
+    let files;
+    try {
+        files = unzipSync(zip);
+    }
+    catch {
+        throw new ProModuleError("Das Paket ist beschädigt.", 502);
+    }
+    const out = {};
+    for (const [name, data] of Object.entries(files)) {
+        if (name.endsWith("/")) {
+            continue;
+        }
+        const parts = name.split("/");
+        const safe = parts.every((p) => p && p !== "." && p !== ".." && !p.includes("\\"));
+        const allowed = name === MANIFEST_FILE || PARTS.some((part) => name.startsWith(part));
+        if (!(safe && allowed)) {
+            throw new ProModuleError(`Das Paket enthält eine unerlaubte Datei: ${name}`, 502);
+        }
+        out[name] = data;
+    }
+    return out;
+}
+/** Fetches one module of the plan, checks it and puts it in place; then it loads. */
+export async function installPro(id) {
+    if (managed) {
+        throw new ProModuleError("Hier nicht verfügbar.", 404, "not_found");
+    }
+    const token = await accountToken();
+    if (!token) {
+        throw new ProModuleError("Verbinde zuerst dein engenty-Konto (Einstellungen → Konto).", 409);
+    }
+    if (!listing) {
+        await refreshPro();
+    }
+    const entry = listing?.modules.find((m) => m.id === id);
+    if (!entry) {
+        throw new ProModuleError(`Für ${runtimeTag()} gibt es dieses Modul nicht.`, 404, "not_found");
+    }
+    if (!entry.included) {
+        throw new ProModuleError("Dieses Modul ist nicht Teil deines Pakets.", 403, "plan");
+    }
+    const res = await call(`/${encodeURIComponent(id)}/package`, token);
+    if (!res.ok) {
+        throw new ProModuleError(`Das Modul ließ sich nicht laden (${res.status}).`, 502);
+    }
+    if (Number(res.headers.get("content-length") ?? 0) > MAX_PACKAGE) {
+        throw new ProModuleError("Das Paket ist zu groß.", 502);
+    }
+    const zip = new Uint8Array(await res.arrayBuffer());
+    const sha256 = createHash("sha256").update(zip).digest("hex");
+    const genuine = sha256 === entry.sha256 &&
+        signedByUs({
+            id,
+            version: entry.version,
+            runtime: runtimeTag(),
+            sha256,
+            signature: entry.signature,
+        });
+    if (zip.length > MAX_PACKAGE || !genuine) {
+        throw new ProModuleError("Das Paket ist nicht von engenty signiert und wurde verworfen.", 502);
+    }
+    const files = filesOf(zip);
+    const manifest = JSON.parse(new TextDecoder().decode(files[MANIFEST_FILE] ?? new Uint8Array()));
+    if (manifest?.id !== id) {
+        throw new ProModuleError("Das Paket passt nicht zu diesem Modul.", 502);
+    }
+    const dir = proModulesDir();
+    const target = join(dir, id);
+    const fresh = join(dir, `.new-${id}-${randomBytes(4).toString("hex")}`);
+    const old = join(dir, `.old-${id}-${randomBytes(4).toString("hex")}`);
+    await mkdir(fresh, { recursive: true });
+    try {
+        for (const [path, data] of Object.entries(files)) {
+            await mkdir(dirname(join(fresh, path)), { recursive: true });
+            await writeFile(join(fresh, path), data);
+        }
+        const installed = {
+            id,
+            version: entry.version,
+            runtime: runtimeTag(),
+            sha256,
+            installedAt: new Date().toISOString(),
+        };
+        await writeFile(join(fresh, INSTALLED_FILE), `${JSON.stringify(installed, null, 2)}\n`);
+        if (existsSync(target)) {
+            await rename(target, old);
+        }
+        await rename(fresh, target);
+    }
+    finally {
+        await rm(fresh, { recursive: true, force: true });
+        await rm(old, { recursive: true, force: true });
+    }
+    await reloadPlugin(id);
+}
+/** Removes an installed module; its tables and what is in them stay. */
+export async function removePro(id) {
+    if (managed || !(await installedIds()).includes(id)) {
+        throw new ProModuleError("Dieses Modul ist nicht installiert.", 404, "not_found");
+    }
+    await rm(join(proModulesDir(), id), { recursive: true, force: true });
+    await findNewPlugins();
+}
+export async function proState() {
+    const entitlement = currentEntitlement();
+    const account = await linkedAccount();
+    const ids = new Set([...(listing?.modules.map((m) => m.id) ?? []), ...(await installedIds())]);
+    const modules = [...ids].sort().map((id) => {
+        const entry = listing?.modules.find((m) => m.id === id);
+        const installed = installedModule(join(proModulesDir(), id));
+        const plugin = loadedPlugin(id);
+        return {
+            id,
+            name: entry?.name ?? plugin?.source.manifest.name ?? id,
+            version: entry?.version ?? installed?.version ?? "",
+            description: entry?.description ?? plugin?.source.manifest.description ?? "",
+            size: entry?.size ?? null,
+            included: entitlement?.modules.includes(id) ?? false,
+            installed: installed ? { version: installed.version, runtime: installed.runtime } : null,
+            loaded: Boolean(plugin?.source.pro),
+            heldBack: heldBackModules().get(id) ?? null,
+            update: Boolean(entry?.included && installed && installed.sha256 !== entry.sha256),
+        };
+    });
+    return {
+        linked: Boolean(account),
+        /** Where the plans are: `<accountUrl>/billing`. */
+        accountUrl: env.local.accountUrl,
+        runtime: runtimeTag(),
+        plan: entitlement?.plan ?? listing?.plan ?? null,
+        expiresAt: entitlement ? new Date(entitlement.expiresAt).toISOString() : null,
+        checkedAt: entitlement ? new Date(entitlement.checkedAt).toISOString() : null,
+        error: lastError,
+        modules,
+    };
+}
+/** For tests: forget what the account said. */
+export function resetProForTests() {
+    listing = null;
+    lastError = null;
+    setEntitlement(null);
+}

package/apps/runtime/dist/routes/plugins.js

@@ -3,6 +3,7 @@ import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { managed } from "../manage.js";
 import { pluginProblems, reloadPlugin, rescanPlugins } from "../plugins/loader.js";
+import { installPro, proState, refreshPro, removePro } from "../plugins/pro.js";
 import { loadedPlugin, onPluginChange, pluginAsset, pluginIdsOf, pluginsOf, } from "../plugins/registry.js";
 const admin = (user) => user.role === "owner" || user.role === "admin";
 /** Plugins change while the app runs only where it runs alone: a reload would hit every tenant. */
@@ -18,6 +19,8 @@ function view(plugin) {
         version,
         description: description ?? "",
         generation: plugin.generation,
+        /** Installed from the linked account's plan (Settings → Plugins → Pro modules). */
+        pro: Boolean(plugin.source.pro),
         /** Why the server half did not load; the plugin then adds nothing on the server. */
         error: plugin.error,
         script: script ? address("client.js", script.rev) : null,
@@ -155,6 +158,52 @@ export const pluginRoutes = new Hono()
     return plugin
         ? c.json({ plugin: view(plugin) })
         : c.json({ error: "not found", code: "not_found" }, 404);
+})
+    // Pro modules: the closed plugins the linked account's plan includes (plugins/pro.ts).
+    .get("/-/pro", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "not found", code: "not_found" }, 404);
+    }
+    return c.json(await proState());
+})
+    .post("/-/pro/refresh", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+    }
+    await refreshPro();
+    return c.json(await proState());
+})
+    .post("/-/pro/:id", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+    }
+    try {
+        await installPro(c.req.param("id"));
+    }
+    catch (err) {
+        const answer = answerOf(err);
+        if (answer) {
+            return c.json(answer.body, answer.status);
+        }
+        throw err;
+    }
+    return c.json(await proState());
+})
+    .delete("/-/pro/:id", async (c) => {
+    if (!canReload(c.get("user"))) {
+        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+    }
+    try {
+        await removePro(c.req.param("id"));
+    }
+    catch (err) {
+        const answer = answerOf(err);
+        if (answer) {
+            return c.json(answer.body, answer.status);
+        }
+        throw err;
+    }
+    return c.json(await proState());
 })
     .all("/:id", dispatch)
     .all("/:id/*", dispatch);

package/apps/runtime/dist/routes/studio.js

@@ -27,6 +27,7 @@ import { seenApps } from "../mcp/seen.js";
 import { generateImageMedia, generateSpeechMedia, generateVideoMedia } from "../media/generate.js";
 import { transcribeAudio } from "../media/transcribe.js";
 import { checkKey, classProblem, embeddingModel, hasTextModel, LOCAL_KEYS, localModelSettings, ModelUnavailableError, modelSettings, saveLocalModels, saveModels, storedKey, textModel, } from "../models.js";
+import { refreshPro } from "../plugins/pro.js";
 import { HTML_RESPONSE_CSP } from "../render/guard.js";
 import { isAdminRole, mayBuild, mayCreate, projectWritable, requireWritable, } from "../services/access.js";
 import { architectTurn } from "../services/architect.js";
@@ -1214,6 +1215,8 @@ export const studio = new Hono()
     }
     await unlink();
     await forgetCloud();
+    // Pro modules went with the account's plan; installed ones stay on disk.
+    await refreshPro();
     // Models that ran on the account's credits have nothing to run on now; another source stays.
     if (localModelSettings().source === "account") {
         await saveLocalModels({ source: "own" });