wizards 0.2.1 → 0.2.3

package/apps/runtime/dist/routes/studio.js

@@ -25,8 +25,9 @@ import { seenApps } from "../mcp/seen.js";
 import { transcribeAudio } from "../media/transcribe.js";
 import { embeddingModel, hasTextModel, LOCAL_KEYS, localModelSettings, ModelUnavailableError, saveLocalModels, textModel, } from "../models.js";
 import { HTML_RESPONSE_CSP } from "../render/guard.js";
+import { mayBuild, projectWritable, requireWritable } from "../services/access.js";
 import { architectTurn } from "../services/architect.js";
-import { cloudCopy, publishToCloud } from "../services/cloud.js";
+import { checkForCloud, cloudLinked, cloudSpaces, cloudState, forgetCloud, publishAndSync, pushSharing, removeFromCloud, replaceCloudSpaces, syncToCloud, } from "../services/cloud.js";
 import { ServiceError } from "../services/errors.js";
 import { deleteFile, listFiles, readFile, writeFile } from "../services/files.js";
 import { exportWizard, importWizard, PACKAGE_EXTENSION, PACKAGE_MAX_BYTES, PACKAGE_MIME, } from "../services/package.js";
@@ -36,8 +37,9 @@ import { documentText, searchProject } from "../services/project-index.js";
 import { createProject, deleteProject, listProjects, maskedServers, ownedProject, projectLimit, projectPatchSchema, updateProject, } from "../services/projects.js";
 import { listRuns, startTestRun } from "../services/runs.js";
 import { draftWidgetPreview } from "../services/widgets.js";
-import { createWizard, deleteWizard, duplicateWizard, listWizards, ownedWizard, publishWizard, rotateShareLink, updateWizardSettings, wizardMessages, wizardState, writeDraft, } from "../services/wizards.js";
+import { createWizard, deleteWizard, duplicateWizard, listWizards, ownedWizard, rotateShareLink, updateWizardSettings, wizardMessages, wizardState, writableWizard, writeDraft, } from "../services/wizards.js";
 import { readSetting, writeSetting } from "../settings.js";
+import { codeOf } from "../tenants/control.js";
 import { applyUpdate, updateStatus } from "../update.js";
 import { byteRange } from "./delivery.js";
 /** The model sources a test call has worked on: the setup is done for those, not for the others. */
@@ -85,6 +87,8 @@ export const studio = new Hono()
                 name: linked.name,
                 email: linked.email,
                 credits: overview?.tenant.balanceCredits ?? null,
+                /** What of the credits ends on a date, the nearest first. */
+                expiring: overview?.tenant.expiring ?? [],
                 url: env.local.accountUrl,
                 cloudUrl: env.local.cloudUrl,
                 signedIn: Boolean(overview),
@@ -101,8 +105,11 @@ export const studio = new Hono()
         chatEngine: managed ? "models" : await chatEngine(await hasTextModel()),
         aiReady: (await hasTextModel()) || (!managed && (await subscriptionClients()).length > 0),
         mcpUrl: `${env.appUrl}/api/mcp`,
-        /** One project: the studio shows no project switcher. */
-        limits: { projects: await projectLimit() },
+        /**
+         * One project: the studio shows no project switcher. `build: false`: nothing is made or
+         * changed here; the studio shows what the person's local install synced.
+         */
+        limits: { projects: await projectLimit(), build: await mayBuild() },
     });
 })
     // A runtime that runs alone says when a newer release is out and can run the update itself.
@@ -118,6 +125,7 @@ export const studio = new Hono()
     // --- projects --------------------------------------------------------------
     .get("/projects", async (c) => {
     const projects = await listProjects(c.get("user").id);
+    const build = await mayBuild();
     return c.json(projects.map((p) => ({
         id: p.id,
         name: p.name,
@@ -125,6 +133,10 @@ export const studio = new Hono()
         facts: p.facts,
         mcpServers: maskedServers(p),
         wizardCount: p.wizardCount,
+        /** `local`: synced from a local install, where it is changed. */
+        origin: p.origin,
+        syncedAt: p.syncedAt?.toISOString() ?? null,
+        readOnly: p.origin === "local" || !build,
     })));
 })
     .post("/projects", async (c) => {
@@ -232,6 +244,7 @@ export const studio = new Hono()
     .post("/projects/:id/assist", async (c) => {
     const user = c.get("user");
     const project = await ownedProject(user.id, c.req.param("id"));
+    await requireWritable(project);
     const body = z
         .object({
         message: z.string().min(1).max(8000),
@@ -363,6 +376,8 @@ export const studio = new Hono()
     const project = await ownedProject(user.id, w.projectId);
     return c.json({
         ...(await wizardState(w)),
+        /** Shown and run here, changed elsewhere: a local install's wizard, or nothing is built here. */
+        readOnly: !(await projectWritable(project)),
         blank: messages.length === 0 && !w.starter,
         messages: messages.map((m) => ({
             id: m.id,
@@ -391,15 +406,28 @@ export const studio = new Hono()
     })
         .parse(await c.req.json());
     await updateWizardSettings(c.get("user").id, c.req.param("id"), patch);
+    // The copy in the cloud of a linked account is shared the same way.
+    if (patch.shareEnabled !== undefined || patch.dailyRunLimit !== undefined) {
+        await pushSharing(c.get("user").id, c.req.param("id"));
+    }
     return c.json({ ok: true });
+})
+    // The wizard's ID for the mobile app, beside its link.
+    .get("/wizards/:id/code", async (c) => {
+    const w = await ownedWizard(c.get("user").id, c.req.param("id"));
+    return c.json({ code: await codeOf(w.shareToken) });
 })
     .post("/wizards/:id/rotate-link", async (c) => c.json(await rotateShareLink(c.get("user").id, c.req.param("id"))))
     .post("/wizards/:id/duplicate", async (c) => c.json(await duplicateWizard(c.get("user").id, c.req.param("id"))))
     .delete("/wizards/:id", async (c) => {
+    if (!managed) {
+        await removeFromCloud(c.get("user").id, c.req.param("id"));
+    }
     await deleteWizard(c.get("user").id, c.req.param("id"));
     return c.json({ ok: true });
 })
-    .post("/wizards/:id/publish", async (c) => c.json(await publishWizard(c.get("user").id, c.req.param("id"))))
+    // With an account linked the published version also goes to its cloud: `cloud` says how that went.
+    .post("/wizards/:id/publish", async (c) => c.json(await publishAndSync(c.get("user").id, c.req.param("id"))))
     // What a run of the draft is expected to cost, per step and in total.
     .get("/wizards/:id/estimate", async (c) => {
     const w = await ownedWizard(c.get("user").id, c.req.param("id"));
@@ -413,13 +441,39 @@ export const studio = new Hono()
     // A runtime that runs alone: the wizard's copy in the cloud of the linked account.
     .get("/wizards/:id/cloud", async (c) => {
     const w = await ownedWizard(c.get("user").id, c.req.param("id"));
-    return c.json({ copy: managed ? null : await cloudCopy(w.id) });
+    const linked = await cloudLinked();
+    return c.json({ linked, ...(linked ? await cloudState(w.id) : { copy: null, error: null }) });
 })
+    // Sends the published version again: after a try that failed, or a change of the project.
     .post("/wizards/:id/cloud", async (c) => {
-    if (managed) {
+    if (!(await cloudLinked())) {
+        return c.notFound();
+    }
+    return c.json({
+        linked: true,
+        ...(await syncToCloud(c.get("user").id, c.req.param("id"))),
+    });
+})
+    // What the cloud would lack for the draft, before it is published.
+    .get("/wizards/:id/cloud/check", async (c) => {
+    if (!(await cloudLinked())) {
+        return c.notFound();
+    }
+    return c.json(await checkForCloud(c.get("user").id, c.req.param("id")));
+})
+    // The projects of local installs the account's cloud holds.
+    .get("/cloud/spaces", async (c) => {
+    if (!(await cloudLinked())) {
+        return c.notFound();
+    }
+    return c.json({ spaces: await cloudSpaces() });
+})
+    // Another install's project is in the way: it goes, and what is published here is sent.
+    .post("/cloud/replace", async (c) => {
+    if (!(await cloudLinked())) {
         return c.notFound();
     }
-    return c.json(await publishToCloud(c.get("user").id, c.req.param("id")));
+    return c.json(await replaceCloudSpaces(c.get("user").id));
 })
     .post("/wizards/:id/chat", async (c) => {
     const user = c.get("user");
@@ -427,7 +481,7 @@ export const studio = new Hono()
     const { message } = z
         .object({ message: z.string().min(1).max(8000) })
         .parse(await c.req.json());
-    await ownedWizard(user.id, wizardId);
+    await writableWizard(user.id, wizardId);
     if (!(await canSpend())) {
         throw new ServiceError("no_credits", "Dein Guthaben ist aufgebraucht.");
     }
@@ -711,12 +765,26 @@ export const studio = new Hono()
     await setChatEngine(engine);
     return c.json({ ok: true });
 })
-    .post("/account/link", async (c) => (managed ? c.notFound() : c.json({ url: await startLink() })))
+    // The address the system browser opens: the account's sign-in, or — for someone without an
+    // account — its sign-up page with the invitation code, which then goes on to the sign-in.
+    .post("/account/link", async (c) => {
+    if (managed) {
+        return c.notFound();
+    }
+    const input = z
+        .object({ signup: z.boolean().optional(), code: z.string().max(64).optional() })
+        .parse(await c.req.json().catch(() => ({})));
+    return c.json({ url: await startLink(input) });
+})
     .delete("/account", async (c) => {
     if (managed) {
         return c.notFound();
     }
     await unlink();
-    await saveLocalModels({ source: "own" });
+    await forgetCloud();
+    // Models that ran on the account's credits have nothing to run on now; another source stays.
+    if (localModelSettings().source === "account") {
+        await saveLocalModels({ source: "own" });
+    }
     return c.json({ ok: true });
 });

package/apps/runtime/dist/services/access.js

@@ -0,0 +1,62 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { and, eq } from "drizzle-orm";
+import { db, schema } from "../db/client.js";
+import { managed, tenantInfo } from "../manage.js";
+import { currentTenant } from "../tenants/tenant.js";
+import { ServiceError } from "./errors.js";
+/**
+ * Who may change what on this runtime. A project a local install synced (`origin: "local"`) is
+ * changed only by that install's next sync: here it is shown and run. And a tenant the
+ * Manage-App gives no building (`limits.build: false`) makes and changes nothing on this
+ * runtime. Every write of a project or a wizard asks here, whichever way it came in: studio,
+ * MCP client or API.
+ */
+const sync = new AsyncLocalStorage();
+/** Runs the writes of a sync: they are the one way a synced project changes. */
+export function asSync(fn) {
+    return sync.run(true, fn);
+}
+const syncing = () => sync.getStore() === true;
+/** Whether the tenant builds wizards on this runtime. A runtime that runs alone always does. */
+export async function mayBuild() {
+    if (!managed) {
+        return true;
+    }
+    const info = await tenantInfo(currentTenant()).catch(() => null);
+    // An older Manage-App does not say: then it builds. One that cannot be reached: nothing changes.
+    return info ? info.limits.build !== false : false;
+}
+export const READ_ONLY_PROJECT = "Dieses Projekt kommt aus einer lokalen Installation und wird dort geändert.";
+export const READ_ONLY_TENANT = "Hier wird nichts gebaut: Auf diesem Server laufen die Wizards, die deine lokale Installation veröffentlicht.";
+/** Refuses when the tenant builds nothing here. */
+export async function requireBuild() {
+    if (syncing() || (await mayBuild())) {
+        return;
+    }
+    throw new ServiceError("read_only", READ_ONLY_TENANT);
+}
+/** Refuses a change of a synced project, and any change by a tenant that builds nothing here. */
+export async function requireWritable(project) {
+    if (syncing()) {
+        return;
+    }
+    if (project.origin === "local") {
+        throw new ServiceError("read_only", READ_ONLY_PROJECT);
+    }
+    await requireBuild();
+}
+export async function requireWritableProject(projectId) {
+    if (syncing()) {
+        return;
+    }
+    const project = await db.query.project.findFirst({
+        where: and(eq(schema.project.id, projectId), eq(schema.project.tenantId, currentTenant())),
+        columns: { origin: true },
+    });
+    // A project that is not there is the caller's "not found", not ours.
+    await requireWritable(project ?? { origin: null });
+}
+/** Whether the person may change this project's wizards and settings here. */
+export async function projectWritable(project) {
+    return project.origin !== "local" && (await mayBuild());
+}

package/apps/runtime/dist/services/architect.js

@@ -7,7 +7,7 @@ import { managed } from "../manage.js";
 import { hasTextModel } from "../models.js";
 import { draftFiles, readFile } from "./files.js";
 import { ownedProject } from "./projects.js";
-import { addMessage, draftIssues, ownedWizard, wizardMessages } from "./wizards.js";
+import { addMessage, draftIssues, ownedWizard, wizardMessages, writableWizard } from "./wizards.js";
 /** The formats a model can look at; an SVG it reads as text. */
 const VISIBLE = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
 /** A picture larger than this would pass the model's limit once base64-encoded. */
@@ -31,7 +31,8 @@ async function attachedImages(userId, wizardId, message) {
 }
 /** One studio chat turn: the architect reads the draft, its workspace and the thread, and changes them with tools. */
 export async function architectTurn(userId, wizardId, message, io) {
-    const w = await ownedWizard(userId, wizardId);
+    // Asked before the first model call: a wizard that is not changed here costs nothing to refuse.
+    const w = await writableWizard(userId, wizardId);
     const history = await wizardMessages(w.id);
     const project = await ownedProject(userId, w.projectId);
     const images = await attachedImages(userId, w.id, message);

package/apps/runtime/dist/services/cloud.js

@@ -1,52 +1,254 @@
-import { accountToken } from "../auth/account.js";
+import { and, eq, isNotNull, like } from "drizzle-orm";
+import { accountToken, linkedAccount } from "../auth/account.js";
+import { control, controlDb, db, schema } from "../db/client.js";
 import { env } from "../env.js";
 import { getBlob } from "../files/blobs.js";
-import { readSetting, writeSetting } from "../settings.js";
+import { managed } from "../manage.js";
+import { deleteSetting, readSetting, writeSetting } from "../settings.js";
+import { currentTenant } from "../tenants/tenant.js";
+import { mainLogoId } from "./brand.js";
 import { ServiceError } from "./errors.js";
-import { draftFiles } from "./files.js";
-import { ownedWizard, requireClean } from "./wizards.js";
+import { projectFileContent, projectFiles } from "./project-files.js";
+import { ownedProject } from "./projects.js";
+import { ownedWizard, publishedVersion, publishWizard } from "./wizards.js";
 const key = (wizardId) => `cloud:${wizardId}`;
-/** Where a local wizard was published to the cloud, if it was. */
-export function cloudCopy(wizardId) {
-    return readSetting(key(wizardId));
+const EMPTY = { copy: null, error: null };
+/** Whether this runtime sends what it publishes: it runs alone and an account is linked. */
+export async function cloudLinked() {
+    return !managed && Boolean(await linkedAccount());
 }
-/**
- * Publishes a local wizard to the cloud runtime of the linked account: definition and workspace
- * go through the cloud's import API, which validates them like any other write. Publishing
- * again updates the same cloud wizard, so its link stays.
- */
-export async function publishToCloud(userId, wizardId) {
-    const w = await ownedWizard(userId, wizardId);
-    const { definition } = await requireClean(w);
+/** Where a local wizard stands in the cloud. */
+export async function cloudState(wizardId) {
+    return (await readSetting(key(wizardId))) ?? EMPTY;
+}
+async function call(method, path, body, timeoutMs = 30_000) {
     const token = await accountToken();
     if (!token) {
-        throw new ServiceError("refused", "Bitte zuerst in den Einstellungen ein Konto anmelden.");
-    }
-    const files = await Promise.all((await draftFiles(w.id)).map(async (f) => ({
-        path: f.path,
-        mime: f.mime,
-        data: (await getBlob(f.hash)).toString("base64"),
-    })));
-    const before = await cloudCopy(w.id);
-    const res = await fetch(`${env.local.cloudUrl}/api/v1/wizards/import`, {
-        method: "POST",
-        headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-        body: JSON.stringify({ wizardId: before?.wizardId, definition, files, publish: true }),
-        signal: AbortSignal.timeout(120_000),
+        throw new ServiceError("refused", "Das Konto ist nicht mehr angemeldet. Bitte neu anmelden.", {
+            reason: "signed_out",
+        });
+    }
+    const res = await fetch(`${env.local.cloudUrl}/api/v1${path}`, {
+        method,
+        headers: {
+            authorization: `Bearer ${token}`,
+            ...(body === undefined ? {} : { "content-type": "application/json" }),
+        },
+        body: body === undefined ? undefined : JSON.stringify(body),
+        signal: AbortSignal.timeout(timeoutMs),
     }).catch(() => null);
     if (!res) {
-        throw new ServiceError("refused", "Die Cloud ist gerade nicht erreichbar.");
+        throw new ServiceError("refused", "Die Cloud ist gerade nicht erreichbar.", {
+            reason: "unreachable",
+        });
+    }
+    const parsed = (await res.json().catch(() => ({})));
+    return { ok: res.ok, status: res.status, body: parsed };
+}
+function refusal(answer, fallback) {
+    const { error, reason, ...rest } = answer.body;
+    const message = answer.status === 401
+        ? "Das Konto ist nicht mehr angemeldet. Bitte neu anmelden."
+        : typeof error === "string" && error
+            ? error
+            : fallback;
+    return new ServiceError("refused", message, {
+        reason: answer.status === 401 ? "signed_out" : typeof reason === "string" ? reason : "refused",
+        ...(Array.isArray(rest.spaces) ? { spaces: rest.spaces } : {}),
+    });
+}
+/** The project as the cloud keeps it: its name, what it says about itself, its logo. */
+async function spaceOf(userId, projectId) {
+    const project = await ownedProject(userId, projectId);
+    const logoId = await mainLogoId(project.id);
+    const logo = logoId ? await projectFileContent(project.id, logoId).catch(() => null) : null;
+    return {
+        name: project.name,
+        brand: {
+            name: project.brand.name,
+            about: project.brand.about,
+            colors: project.brand.colors,
+        },
+        facts: project.facts,
+        logo: logo
+            ? {
+                name: logo.row.name,
+                mime: logo.row.mime,
+                description: logo.row.description,
+                data: Buffer.from(logo.data).toString("base64"),
+            }
+            : null,
+    };
+}
+/**
+ * Sends a wizard's published version to the cloud: the same wizard again updates its copy
+ * there, whose link stays. What came back is kept; a try that failed is kept as such beside
+ * the copy from before.
+ */
+export async function syncToCloud(userId, wizardId) {
+    const w = await ownedWizard(userId, wizardId);
+    const version = await publishedVersion(w);
+    if (!version) {
+        throw new ServiceError("refused", "Bitte den Wizard zuerst veröffentlichen.");
+    }
+    const before = await cloudState(w.id);
+    try {
+        const files = await Promise.all(version.files.map(async (f) => ({
+            path: f.path,
+            mime: f.mime,
+            data: (await getBlob(f.hash)).toString("base64"),
+        })));
+        const answer = await call("PUT", `/spaces/${w.projectId}/wizards/${w.id}`, {
+            space: await spaceOf(userId, w.projectId),
+            version: version.version,
+            definition: version.definition,
+            files,
+            shareEnabled: w.shareEnabled,
+            dailyRunLimit: w.dailyRunLimit,
+        }, 120_000);
+        if (!answer.ok || !answer.body.shareUrl) {
+            throw refusal(answer, "Die Cloud hat den Wizard nicht angenommen.");
+        }
+        const state = {
+            copy: {
+                shareUrl: answer.body.shareUrl,
+                code: answer.body.code,
+                version: version.version,
+                publishedVersion: answer.body.publishedVersion,
+                runnable: answer.body.runnable,
+                problems: answer.body.problems ?? [],
+                syncedAt: new Date().toISOString(),
+            },
+            error: null,
+        };
+        await writeSetting(key(w.id), state);
+        return state;
+    }
+    catch (err) {
+        const failed = {
+            copy: before.copy,
+            error: {
+                message: err instanceof ServiceError ? err.message : "Das Senden hat nicht geklappt.",
+                reason: err instanceof ServiceError ? err.data.reason : undefined,
+                at: new Date().toISOString(),
+            },
+        };
+        await writeSetting(key(w.id), failed);
+        if (!(err instanceof ServiceError)) {
+            console.error("[cloud] sync failed:", err);
+        }
+        return failed;
+    }
+}
+/**
+ * Publishes here and, with an account linked, sends the version on. The cloud never holds the
+ * publishing up or back: what it answered comes along as `cloud`.
+ */
+export async function publishAndSync(userId, wizardId) {
+    const published = await publishWizard(userId, wizardId);
+    const cloud = (await cloudLinked()) ? await syncToCloud(userId, wizardId) : null;
+    return { ...published, cloud };
+}
+/** How a wizard is shared changed here: the copy in the cloud follows. */
+export async function pushSharing(userId, wizardId) {
+    if (!(await cloudLinked())) {
+        return;
+    }
+    const state = await cloudState(wizardId);
+    if (!state.copy) {
+        return;
+    }
+    const w = await ownedWizard(userId, wizardId);
+    await call("PATCH", `/spaces/${w.projectId}/wizards/${w.id}`, {
+        shareEnabled: w.shareEnabled,
+        dailyRunLimit: w.dailyRunLimit,
+    }).catch((err) => console.error("[cloud] sharing not sent:", err.message));
+}
+/** A wizard is about to be deleted here: its copy in the cloud goes too. */
+export async function removeFromCloud(userId, wizardId) {
+    const state = await cloudState(wizardId);
+    if (!state.copy && !state.error) {
+        return;
+    }
+    const w = await ownedWizard(userId, wizardId).catch(() => null);
+    await deleteSetting(key(wizardId));
+    if (!w || !state.copy || !(await cloudLinked())) {
+        return;
+    }
+    await call("DELETE", `/spaces/${w.projectId}/wizards/${w.id}`).catch((err) => console.error("[cloud] copy not removed:", err.message));
+}
+/** The account was unlinked: what this runtime kept of its cloud belongs to no account now. */
+export async function forgetCloud() {
+    await controlDb.delete(control.setting).where(like(control.setting.key, "cloud:%"));
+}
+/** Sends every published wizard: once after an account was linked. */
+export async function syncAllToCloud(userId) {
+    const wizards = await db
+        .select({ id: schema.wizard.id })
+        .from(schema.wizard)
+        .where(and(eq(schema.wizard.tenantId, currentTenant()), isNotNull(schema.wizard.publishedVersion)));
+    let sent = 0;
+    let failed = 0;
+    for (const { id } of wizards) {
+        const state = await syncToCloud(userId, id);
+        if (state.error) {
+            failed++;
+            // A refusal that holds for every wizard (no room, signed out) is not asked again.
+            if (state.error.reason && state.error.reason !== "refused") {
+                break;
+            }
+        }
+        else {
+            sent++;
+        }
     }
-    const body = (await res.json().catch(() => ({})));
-    if (!res.ok || !body.wizardId || !body.shareUrl) {
-        throw new ServiceError(body.issues?.length ? "has_issues" : "refused", body.error ?? "Veröffentlichen in der Cloud hat nicht geklappt.", body.issues?.length ? { issues: body.issues } : {});
+    return { sent, failed };
+}
+/** What the cloud would lack for the draft, asked before it is published. */
+export async function checkForCloud(userId, wizardId) {
+    const w = await ownedWizard(userId, wizardId);
+    const files = await db
+        .select({ path: schema.wizardFile.path })
+        .from(schema.wizardFile)
+        .where(eq(schema.wizardFile.wizardId, w.id));
+    const answer = await call("POST", "/spaces/check", {
+        definition: w.draft,
+        files: files.map((f) => f.path),
+    });
+    if (!answer.ok) {
+        throw refusal(answer, "Die Cloud hat nicht geantwortet.");
     }
-    const copy = {
-        wizardId: body.wizardId,
-        shareUrl: body.shareUrl,
-        version: body.version ?? 1,
-        publishedAt: new Date().toISOString(),
+    const documents = await projectFiles(w.projectId, "document");
+    return {
+        problems: answer.body.problems ?? [],
+        documents: documents.length > 0 && w.draft.steps.some((s) => s.type === "agent"),
     };
-    await writeSetting(key(w.id), copy);
-    return copy;
+}
+/** The projects the account's cloud holds of local installs: this one's, or another machine's. */
+export async function cloudSpaces() {
+    const answer = await call("GET", "/spaces");
+    if (!answer.ok) {
+        throw refusal(answer, "Die Cloud hat nicht geantwortet.");
+    }
+    return answer.body.spaces ?? [];
+}
+/**
+ * Makes room for this install's project: the projects of other installs go from the cloud, with
+ * their links, then everything published here is sent. For the person who moved to a new
+ * machine or installed anew.
+ */
+export async function replaceCloudSpaces(userId) {
+    const mine = new Set((await db
+        .select({ id: schema.project.id })
+        .from(schema.project)
+        .where(eq(schema.project.tenantId, currentTenant()))).map((p) => p.id));
+    for (const space of await cloudSpaces()) {
+        if (!mine.has(space.id)) {
+            const answer = await call("DELETE", `/spaces/${space.id}`);
+            if (!answer.ok) {
+                throw refusal(answer, "Das Projekt in der Cloud ließ sich nicht entfernen.");
+            }
+        }
+    }
+    return syncAllToCloud(userId);
 }

package/apps/runtime/dist/services/errors.js

@@ -5,6 +5,7 @@ const STATUS = {
     revision_conflict: 409,
     no_credits: 402,
     refused: 400,
+    read_only: 403,
 };
 export class ServiceError extends Error {
     code;

package/apps/runtime/dist/services/files.js

@@ -4,7 +4,7 @@ import { db, schema } from "../db/client.js";
 import { getBlob, putBlob } from "../files/blobs.js";
 import { emitDraftChanged, filesChanged } from "./draft-events.js";
 import { notFound, ServiceError } from "./errors.js";
-import { ownedWizard } from "./wizards.js";
+import { ownedWizard, writableWizard } from "./wizards.js";
 /** The draft's workspace, sorted by path — the same shape publishing and runs snapshot. */
 export async function draftFiles(wizardId) {
     const rows = await db.query.wizardFile.findMany({
@@ -44,7 +44,7 @@ export async function readFileText(userId, wizardId, rawPath) {
     return { path: file.path, mime: file.mime, size: file.size, text: data.toString("utf8") };
 }
 export async function writeFile(userId, wizardId, rawPath, content, mime) {
-    const w = await ownedWizard(userId, wizardId);
+    const w = await writableWizard(userId, wizardId);
     const path = requirePath(rawPath);
     const data = typeof content === "string" ? Buffer.from(content, "utf8") : Buffer.from(content);
     if (data.byteLength > WORKSPACE_LIMITS.fileBytes) {
@@ -77,7 +77,7 @@ export async function writeFile(userId, wizardId, rawPath, content, mime) {
     return file;
 }
 export async function deleteFile(userId, wizardId, rawPath) {
-    const w = await ownedWizard(userId, wizardId);
+    const w = await writableWizard(userId, wizardId);
     const path = requirePath(rawPath);
     const gone = await db
         .delete(schema.wizardFile)

package/apps/runtime/dist/services/project-files.js

@@ -6,6 +6,7 @@ import { documentMime, UnreadableDocument } from "../documents/parse.js";
 import { loadAsset, removeAsset, saveAsset } from "../files/storage.js";
 import { textModel } from "../models.js";
 import { dropLinks, putLink } from "../tenants/control.js";
+import { requireWritableProject } from "./access.js";
 import { notFound, ServiceError } from "./errors.js";
 import { dropIndex, indexDocument } from "./project-index.js";
 /** Reading a file takes seconds to a few minutes; a row still `pending` after this was cut off. */
@@ -64,6 +65,7 @@ function accepts(kind, mime) {
     return true;
 }
 export async function addProjectFile(projectId, input) {
+    await requireWritableProject(projectId);
     const mime = documentMime(input.name, input.mime) || "application/octet-stream";
     if (!accepts(input.kind, mime)) {
         throw new ServiceError("invalid", input.kind === "logo"
@@ -208,6 +210,7 @@ async function prepare(row) {
     });
 }
 export async function reindexProjectFile(projectId, fileId) {
+    await requireWritableProject(projectId);
     const row = await projectFile(projectId, fileId);
     if (row.kind !== "document") {
         throw new ServiceError("invalid", "Nur Dokumente stehen im Index.");
@@ -221,6 +224,7 @@ export async function reindexProjectFile(projectId, fileId) {
     return pending;
 }
 export async function updateProjectFile(projectId, fileId, patch) {
+    await requireWritableProject(projectId);
     const row = await projectFile(projectId, fileId);
     const [updated] = await db
         .update(schema.projectFile)
@@ -236,6 +240,7 @@ export async function updateProjectFile(projectId, fileId, patch) {
 }
 /** Puts the files of one kind into the order of `ids`; the first logo is the one end users see. */
 export async function orderProjectFiles(projectId, kind, ids) {
+    await requireWritableProject(projectId);
     const rows = await projectFiles(projectId, kind);
     const order = [...ids.filter((id) => rows.some((r) => r.id === id))];
     for (const r of rows) {
@@ -256,6 +261,7 @@ async function removeRow(row) {
     }
 }
 export async function removeProjectFile(projectId, fileId) {
+    await requireWritableProject(projectId);
     await removeRow(await projectFile(projectId, fileId));
 }
 /** Before a project goes: its files leave the object store and the public links. */