wizards 0.2.3 → 0.2.5

package/apps/runtime/dist/db/client.js

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from "node:async_hooks";
 import { mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -117,14 +118,34 @@ export async function withTenant(id, fn) {
     await openTenantDb(id);
     return inTenant(id, fn);
 }
+/** The transaction the current context writes in, while `inTransaction()` runs. */
+const transactions = new AsyncLocalStorage();
 /**
- * The current tenant's database, resolved from the context `inTenant()` set. Code that reads or
- * writes wizards, runs or files never names a tenant itself.
+ * Runs `fn` as one transaction of the current tenant's database: inside it, `db` is the
+ * transaction, so every write of the services called there stands or falls with the others.
+ * Already inside one, `fn` just joins it. Only this database takes part: the object store and
+ * the control database are written as before, so do those first or after.
+ */
+export async function inTransaction(fn) {
+    if (transactions.getStore()) {
+        return fn();
+    }
+    const id = currentTenant();
+    const target = ready.get(id);
+    if (!target) {
+        throw new Error(`Tenant database "${id}" is not open: enter it with withTenant().`);
+    }
+    return target.transaction((tx) => transactions.run(tx, fn));
+}
+/**
+ * The current tenant's database, resolved from the context `inTenant()` set — or the
+ * transaction `inTransaction()` opened there. Code that reads or writes wizards, runs or files
+ * never names a tenant itself.
  */
 export const db = new Proxy({}, {
     get(_target, prop) {
         const id = currentTenant();
-        const target = ready.get(id);
+        const target = transactions.getStore() ?? ready.get(id);
         if (!target) {
             throw new Error(`Tenant database "${id}" is not open: enter it with withTenant().`);
         }

package/apps/runtime/dist/index.js

@@ -68,6 +68,12 @@ async function purge() {
 }
 void purge().catch((err) => console.error("[retention]", err));
 setInterval(() => void purge().catch((err) => console.error("[retention]", err)), 3600_000).unref();
+// A runtime that runs alone sends again what did not arrive in its account's cloud.
+if (!managed) {
+    const { retryFailedSends } = await import("./services/cloud.js");
+    const retry = () => withTenant(LOCAL_TENANT, () => retryFailedSends("local")).catch((err) => console.error("[cloud] retry failed:", err));
+    setInterval(() => void retry(), 60_000).unref();
+}
 async function shutdown(code = 0) {
     clearRunning(env.dataDir);
     server.close();

package/apps/runtime/dist/routes/api.js

@@ -6,7 +6,7 @@ import { allowed } from "../limits.js";
 import { authenticate, principalOf } from "../mcp/auth.js";
 import { ServiceError } from "../services/errors.js";
 import { deleteFile, draftFiles, writeFile } from "../services/files.js";
-import { checkOnServer, checkSchema, listSyncedSpaces, patchSyncedWizard, removeSyncedSpace, removeSyncedWizard, syncSettingsSchema, syncWizard, syncWizardSchema, } from "../services/spaces.js";
+import { checkOnServer, checkSchema, listSyncedSpaces, patchSyncedWizard, removeSyncedSpace, removeSyncedWizard, rotateSyncedLink, syncSettingsSchema, syncWizard, syncWizardSchema, } from "../services/spaces.js";
 import { createWizard, ownedWizard, publishWizard, writeDraft } from "../services/wizards.js";
 import { codeOf, tenantStatus } from "../tenants/control.js";
 const importSchema = z.object({
@@ -82,7 +82,7 @@ export const apiRoutes = new Hono()
         return limited;
     }
     const body = syncWizardSchema.parse(await c.req.json());
-    return withTenant(who.tenantId, async () => c.json(await syncWizard(who.userId, c.req.param("spaceId"), c.req.param("wizardId"), body)));
+    return withTenant(who.tenantId, async () => c.json(await syncWizard(c.req.param("spaceId"), c.req.param("wizardId"), body)));
 })
     .patch("/spaces/:spaceId/wizards/:wizardId", async (c) => {
     const who = await caller(c, ["wizards:publish"]);
@@ -95,6 +95,17 @@ export const apiRoutes = new Hono()
     }
     const body = syncSettingsSchema.parse(await c.req.json());
     return withTenant(who.tenantId, async () => c.json(await patchSyncedWizard(c.req.param("spaceId"), c.req.param("wizardId"), body)));
+})
+    .post("/spaces/:spaceId/wizards/:wizardId/rotate-link", async (c) => {
+    const who = await caller(c, ["wizards:publish"]);
+    if (who instanceof Response) {
+        return who;
+    }
+    const limited = withinSyncLimit(c, who);
+    if (limited) {
+        return limited;
+    }
+    return withTenant(who.tenantId, async () => c.json(await rotateSyncedLink(who.userId, c.req.param("spaceId"), c.req.param("wizardId"))));
 })
     .delete("/spaces/:spaceId/wizards/:wizardId", async (c) => {
     const who = await caller(c, ["wizards:write"]);

package/apps/runtime/dist/routes/studio.js

@@ -27,7 +27,7 @@ import { embeddingModel, hasTextModel, LOCAL_KEYS, localModelSettings, ModelUnav
 import { HTML_RESPONSE_CSP } from "../render/guard.js";
 import { mayBuild, projectWritable, requireWritable } from "../services/access.js";
 import { architectTurn } from "../services/architect.js";
-import { checkForCloud, cloudLinked, cloudSpaces, cloudState, forgetCloud, publishAndSync, pushSharing, removeFromCloud, replaceCloudSpaces, syncToCloud, } from "../services/cloud.js";
+import { checkForCloud, cloudLinked, cloudSpaces, cloudState, forgetCloud, publishAndSync, pushSharing, removeFromCloud, replaceCloudSpaces, rotateInCloud, syncToCloud, } from "../services/cloud.js";
 import { ServiceError } from "../services/errors.js";
 import { deleteFile, listFiles, readFile, writeFile } from "../services/files.js";
 import { exportWizard, importWizard, PACKAGE_EXTENSION, PACKAGE_MAX_BYTES, PACKAGE_MIME, } from "../services/package.js";
@@ -340,7 +340,10 @@ export const studio = new Hono()
     .get("/projects/:id/wizards", async (c) => {
     const user = c.get("user");
     await ownedProject(user.id, c.req.param("id"));
-    return c.json(await listWizards(user.id, c.req.param("id")));
+    const wizards = await listWizards(user.id, c.req.param("id"));
+    // A local install with an account: where each wizard stands in its cloud, for the cards.
+    const linked = await cloudLinked();
+    return c.json(await Promise.all(wizards.map(async (w) => ({ ...w, cloud: linked ? await cloudState(w.id) : null }))));
 })
     .post("/wizards", async (c) => {
     const body = z
@@ -417,7 +420,12 @@ export const studio = new Hono()
     const w = await ownedWizard(c.get("user").id, c.req.param("id"));
     return c.json({ code: await codeOf(w.shareToken) });
 })
-    .post("/wizards/:id/rotate-link", async (c) => c.json(await rotateShareLink(c.get("user").id, c.req.param("id"))))
+    // A new link here, and for the copy in the cloud of a linked account: the old ones stop.
+    .post("/wizards/:id/rotate-link", async (c) => {
+    const rotated = await rotateShareLink(c.get("user").id, c.req.param("id"));
+    const cloud = managed ? null : await rotateInCloud(c.get("user").id, c.req.param("id"));
+    return c.json({ ...rotated, cloud });
+})
     .post("/wizards/:id/duplicate", async (c) => c.json(await duplicateWizard(c.get("user").id, c.req.param("id"))))
     .delete("/wizards/:id", async (c) => {
     if (!managed) {

package/apps/runtime/dist/services/cloud.js

@@ -54,9 +54,23 @@ function refusal(answer, fallback) {
             : fallback;
     return new ServiceError("refused", message, {
         reason: answer.status === 401 ? "signed_out" : typeof reason === "string" ? reason : "refused",
+        status: answer.status,
         ...(Array.isArray(rest.spaces) ? { spaces: rest.spaces } : {}),
     });
 }
+/** A try is made again by itself when the cloud, not what was sent, was the trouble. */
+function worthAnotherTry(err) {
+    if (!(err instanceof ServiceError)) {
+        return true;
+    }
+    const status = typeof err.data.status === "number" ? err.data.status : 0;
+    return err.data.reason === "unreachable" || status >= 500 || status === 429;
+}
+/** A minute, then twice as long each time, up to an hour. */
+function nextTry(tries, from) {
+    const minutes = Math.min(60, 2 ** (tries - 1));
+    return new Date(from.getTime() + minutes * 60_000).toISOString();
+}
 /** The project as the cloud keeps it: its name, what it says about itself, its logo. */
 async function spaceOf(userId, projectId) {
     const project = await ownedProject(userId, projectId);
@@ -125,12 +139,16 @@ export async function syncToCloud(userId, wizardId) {
         return state;
     }
     catch (err) {
+        const now = new Date();
+        const tries = (before.error?.tries ?? 0) + 1;
         const failed = {
             copy: before.copy,
             error: {
                 message: err instanceof ServiceError ? err.message : "Das Senden hat nicht geklappt.",
                 reason: err instanceof ServiceError ? err.data.reason : undefined,
-                at: new Date().toISOString(),
+                at: now.toISOString(),
+                tries,
+                again: worthAnotherTry(err) ? nextTry(tries, now) : null,
             },
         };
         await writeSetting(key(w.id), failed);
@@ -164,6 +182,30 @@ export async function pushSharing(userId, wizardId) {
         dailyRunLimit: w.dailyRunLimit,
     }).catch((err) => console.error("[cloud] sharing not sent:", err.message));
 }
+/**
+ * A new link was made here: the copy in the cloud gets a new one too, and its old one stops
+ * answering. Null where no account is linked; the state as it was where the cloud has no copy.
+ */
+export async function rotateInCloud(userId, wizardId) {
+    if (!(await cloudLinked())) {
+        return null;
+    }
+    const state = await cloudState(wizardId);
+    if (!state.copy) {
+        return state;
+    }
+    const w = await ownedWizard(userId, wizardId);
+    const answer = await call("POST", `/spaces/${w.projectId}/wizards/${w.id}/rotate-link`);
+    if (!answer.ok || !answer.body.shareUrl) {
+        throw refusal(answer, "Der Link in der Cloud ließ sich nicht erneuern.");
+    }
+    const next = {
+        ...state,
+        copy: { ...state.copy, shareUrl: answer.body.shareUrl, code: answer.body.code },
+    };
+    await writeSetting(key(w.id), next);
+    return next;
+}
 /** A wizard is about to be deleted here: its copy in the cloud goes too. */
 export async function removeFromCloud(userId, wizardId) {
     const state = await cloudState(wizardId);
@@ -177,6 +219,37 @@ export async function removeFromCloud(userId, wizardId) {
     }
     await call("DELETE", `/spaces/${w.projectId}/wizards/${w.id}`).catch((err) => console.error("[cloud] copy not removed:", err.message));
 }
+/**
+ * Sends again what did not arrive and is due for another try. Called every minute by the
+ * runtime that runs alone; a wizard that is gone meanwhile is forgotten.
+ */
+export async function retryFailedSends(userId) {
+    if (!(await cloudLinked())) {
+        return;
+    }
+    const now = new Date().toISOString();
+    const rows = await controlDb
+        .select({ key: control.setting.key, value: control.setting.value })
+        .from(control.setting)
+        .where(like(control.setting.key, "cloud:%"));
+    for (const row of rows) {
+        const state = row.value;
+        if (!state.error?.again || state.error.again > now) {
+            continue;
+        }
+        const wizardId = row.key.slice("cloud:".length);
+        const w = await ownedWizard(userId, wizardId).catch(() => null);
+        if (!w?.publishedVersion) {
+            await deleteSetting(row.key);
+            continue;
+        }
+        const sent = await syncToCloud(userId, wizardId);
+        // Something the person has to see to (signed out, no room) holds for every wizard.
+        if (sent.error && !sent.error.again) {
+            break;
+        }
+    }
+}
 /** The account was unlinked: what this runtime kept of its cloud belongs to no account now. */
 export async function forgetCloud() {
     await controlDb.delete(control.setting).where(like(control.setting.key, "cloud:%"));
@@ -189,12 +262,20 @@ export async function syncAllToCloud(userId) {
         .where(and(eq(schema.wizard.tenantId, currentTenant()), isNotNull(schema.wizard.publishedVersion)));
     let sent = 0;
     let failed = 0;
-    for (const { id } of wizards) {
+    for (const [i, { id }] of wizards.entries()) {
         const state = await syncToCloud(userId, id);
         if (state.error) {
             failed++;
-            // A refusal that holds for every wizard (no room, signed out) is not asked again.
+            // A refusal that holds for every wizard (no room, signed out) is not asked again; a cloud
+            // out of reach neither, but the rest is then tried again later, with this one.
             if (state.error.reason && state.error.reason !== "refused") {
+                for (const rest of wizards.slice(i + 1)) {
+                    failed++;
+                    await writeSetting(key(rest.id), {
+                        copy: (await cloudState(rest.id)).copy,
+                        error: state.error,
+                    });
+                }
                 break;
             }
         }

package/apps/runtime/dist/services/files.js

@@ -1,5 +1,5 @@
 import { cleanPath, isTextMime, mimeForPath, WORKSPACE_LIMITS, } from "@engenty-wizards/shared/workspace";
-import { and, asc, eq } from "drizzle-orm";
+import { and, asc, eq, inArray } from "drizzle-orm";
 import { db, schema } from "../db/client.js";
 import { getBlob, putBlob } from "../files/blobs.js";
 import { emitDraftChanged, filesChanged } from "./draft-events.js";
@@ -76,6 +76,55 @@ export async function writeFile(userId, wizardId, rawPath, content, mime) {
     emitDraftChanged(filesChanged(w, path));
     return file;
 }
+/**
+ * Keeps the bytes of files that are about to become a wizard's workspace, checked against the
+ * workspace limits, and says how their rows look — without touching the wizard yet. Bytes that
+ * nothing comes to refer to take no harm.
+ */
+export async function keepFiles(files) {
+    if (files.length > WORKSPACE_LIMITS.files) {
+        throw new ServiceError("invalid", `A workspace holds up to ${WORKSPACE_LIMITS.files} files.`);
+    }
+    let total = 0;
+    const kept = [];
+    for (const file of files) {
+        const path = requirePath(file.path);
+        if (file.data.byteLength > WORKSPACE_LIMITS.fileBytes) {
+            throw new ServiceError("invalid", `${path} is larger than 5 MB.`);
+        }
+        total += file.data.byteLength;
+        if (total > WORKSPACE_LIMITS.totalBytes) {
+            throw new ServiceError("invalid", "The workspace would be larger than 25 MB.");
+        }
+        kept.push({
+            path,
+            hash: await putBlob(file.data),
+            mime: file.mime && file.mime !== "application/octet-stream" ? file.mime : mimeForPath(path),
+            size: file.data.byteLength,
+        });
+    }
+    return kept;
+}
+/** Makes a wizard's workspace exactly `files` (kept with keepFiles): rows only, no bytes. */
+export async function replaceFiles(wizardId, files) {
+    const paths = files.map((f) => f.path);
+    const before = await draftFiles(wizardId);
+    const gone = before.filter((f) => !paths.includes(f.path)).map((f) => f.path);
+    if (gone.length) {
+        await db
+            .delete(schema.wizardFile)
+            .where(and(eq(schema.wizardFile.wizardId, wizardId), inArray(schema.wizardFile.path, gone)));
+    }
+    for (const file of files) {
+        await db
+            .insert(schema.wizardFile)
+            .values({ wizardId, ...file })
+            .onConflictDoUpdate({
+            target: [schema.wizardFile.wizardId, schema.wizardFile.path],
+            set: { hash: file.hash, mime: file.mime, size: file.size, updatedAt: new Date() },
+        });
+    }
+}
 export async function deleteFile(userId, wizardId, rawPath) {
     const w = await writableWizard(userId, wizardId);
     const path = requirePath(rawPath);

package/apps/runtime/dist/services/profile.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { linkedAccount } from "../auth/account.js";
 import { managed } from "../manage.js";
 import { readSetting, writeSetting } from "../settings.js";
 export const profileSchema = z.object({
@@ -8,16 +9,30 @@ export const profileSchema = z.object({
     phone: z.string().trim().max(40),
 });
 const key = (user) => `profile:${user.tenantId}:${user.id}`;
+/** The account whose name and e-mail the profile shows; null where the person sets them here. */
+async function accountOf(user) {
+    if (managed) {
+        return { name: user.name, email: user.email };
+    }
+    const linked = await linkedAccount();
+    return linked ? { name: linked.name, email: linked.email } : null;
+}
 export async function userProfile(user) {
     const stored = (await readSetting(key(user))) ?? {};
+    const account = await accountOf(user);
     return {
-        name: (managed ? "" : stored.name) || user.name,
+        name: account?.name || stored.name || user.name,
         about: stored.about ?? "",
-        email: (managed ? "" : stored.email) || user.email,
+        email: account ? account.email : stored.email || user.email,
         phone: stored.phone ?? "",
     };
 }
 export async function saveProfile(user, profile) {
-    await writeSetting(key(user), profile);
+    // Name and e-mail an account gives stay the person's own underneath: they come back unlinked.
+    const stored = (await readSetting(key(user))) ?? {};
+    const own = (await accountOf(user))
+        ? { ...profile, name: stored.name ?? "", email: stored.email ?? "" }
+        : profile;
+    await writeSetting(key(user), own);
     return userProfile(user);
 }

package/apps/runtime/dist/services/spaces.js

@@ -4,7 +4,7 @@ import { WORKSPACE_LIMITS } from "@engenty-wizards/shared/workspace";
 import { and, count, eq, inArray, sql } from "drizzle-orm";
 import { nanoid } from "nanoid";
 import { z } from "zod";
-import { db, schema } from "../db/client.js";
+import { db, inTransaction, schema } from "../db/client.js";
 import { missingModels, unavoidableSteps } from "../engine/requirements.js";
 import { env } from "../env.js";
 import { codeOf, putLink } from "../tenants/control.js";
@@ -12,10 +12,10 @@ import { currentTenant } from "../tenants/tenant.js";
 import { asSync, mayBuild } from "./access.js";
 import { emitDraftChanged } from "./draft-events.js";
 import { notFound, ServiceError } from "./errors.js";
-import { draftFiles, writeFile } from "./files.js";
+import { keepFiles, replaceFiles } from "./files.js";
 import { addProjectFile, projectFiles, removeProjectFile } from "./project-files.js";
 import { brandColorSchema, projectFactSchema, projectLimit, removeProject, } from "./projects.js";
-import { deleteWizard, draftIssues, parseDraft, shareUrl } from "./wizards.js";
+import { deleteWizard, draftIssues, parseDraft, rotateShareLink, shareUrl } from "./wizards.js";
 /**
  * A local install's project on this runtime (docs/manage-contract.md, "Spaces of a local
  * install"). The install sends a wizard when it publishes it: the published version and its
@@ -164,7 +164,10 @@ async function requireWizardRoom(spaceId) {
     }
 }
 const hashOf = (data) => createHash("sha256").update(data).digest("hex");
-/** The project's logo follows the install's: kept when it is the same picture, else replaced. */
+/**
+ * The project's logo follows the install's: kept when it is the same picture, else replaced —
+ * the new one is stored before the old one goes, so a store that fails leaves the old one.
+ */
 async function syncLogo(projectId, logo) {
     const here = await projectFiles(projectId, "logo");
     const data = logo ? Buffer.from(logo.data, "base64") : null;
@@ -172,9 +175,6 @@ async function syncLogo(projectId, logo) {
     if (mark && here.length === 1 && here[0].source === mark) {
         return;
     }
-    for (const old of here) {
-        await removeProjectFile(projectId, old.id);
-    }
     if (logo && data && mark) {
         await addProjectFile(projectId, {
             kind: "logo",
@@ -186,8 +186,11 @@ async function syncLogo(projectId, logo) {
             source: mark,
         });
     }
+    for (const old of here) {
+        await removeProjectFile(projectId, old.id);
+    }
 }
-/** Makes or updates the synced project: its name, what it says about itself, its logo. */
+/** Makes or updates the synced project: its name and what it says about itself (the logo: syncLogo). */
 async function syncSpace(spaceId, space) {
     const existing = await syncedProject(spaceId);
     if (existing && existing.origin !== "local") {
@@ -215,7 +218,6 @@ async function syncSpace(spaceId, space) {
             ...values,
         });
     }
-    await syncLogo(spaceId, space.logo);
     const project = await syncedProject(spaceId);
     if (!project) {
         throw notFound();
@@ -225,86 +227,84 @@ async function syncSpace(spaceId, space) {
 /**
  * Takes a wizard a local install published: the project it is in, the wizard under its id, its
  * workspace, and the version — published here when a run of it can finish. Sending the same
- * wizard again updates the copy; its link stays.
+ * wizard again updates the copy; its link stays. The files' bytes are kept first; then the
+ * project, the wizard, its workspace and the version are written in one transaction, so an
+ * install whose sending broke off finds nothing half done and sends again.
  */
-export async function syncWizard(userId, rawSpaceId, rawWizardId, input) {
+export async function syncWizard(rawSpaceId, rawWizardId, input) {
     const spaceId = syncedId.parse(rawSpaceId);
     const wizardId = syncedId.parse(rawWizardId);
-    const paths = input.files.map((f) => f.path);
     // The shape is checked before anything is written; a wrong one leaves nothing behind.
-    const { draft } = parseDraft(input.definition, paths);
+    const { draft } = parseDraft(input.definition, input.files.map((f) => f.path));
     return asSync(async () => {
-        const project = await syncSpace(spaceId, input.space);
-        const existing = await db.query.wizard.findFirst({
-            where: and(eq(schema.wizard.id, wizardId), eq(schema.wizard.tenantId, currentTenant())),
-        });
-        if (existing && existing.projectId !== spaceId) {
-            throw new ServiceError("refused", "Ein Wizard mit dieser Kennung gehört hier woanders hin.", {
-                reason: "id_taken",
+        const files = await keepFiles(input.files.map((f) => ({ path: f.path, mime: f.mime, data: Buffer.from(f.data, "base64") })));
+        const taken = await inTransaction(async () => {
+            const project = await syncSpace(spaceId, input.space);
+            const existing = await db.query.wizard.findFirst({
+                where: and(eq(schema.wizard.id, wizardId), eq(schema.wizard.tenantId, currentTenant())),
             });
-        }
-        const settings = {
-            title: draft.title,
-            draft,
-            shareEnabled: input.shareEnabled,
-            ...(input.dailyRunLimit ? { dailyRunLimit: input.dailyRunLimit } : {}),
-        };
-        if (!existing) {
-            await requireWizardRoom(spaceId);
-        }
-        let shareToken = existing?.shareToken;
-        if (existing) {
-            await db
-                .update(schema.wizard)
-                .set({ ...settings, revision: sql `${schema.wizard.revision} + 1`, updatedAt: new Date() })
-                .where(eq(schema.wizard.id, wizardId));
-        }
-        else {
-            // The link is made here: a token an install brought could be one another tenant holds.
-            shareToken = nanoid(14);
-            await db.insert(schema.wizard).values({
-                id: wizardId,
-                projectId: spaceId,
-                tenantId: currentTenant(),
-                shareToken,
-                dailyRunLimit: env.limits.defaultDailyRuns,
-                ...settings,
-            });
-            await putLink(shareToken, "wizard", wizardId);
-        }
-        // The workspace becomes what was sent: files that are gone there go here.
-        const before = await draftFiles(wizardId);
-        const gone = before.filter((f) => !paths.includes(f.path)).map((f) => f.path);
-        if (gone.length) {
-            await db
-                .delete(schema.wizardFile)
-                .where(and(eq(schema.wizardFile.wizardId, wizardId), inArray(schema.wizardFile.path, gone)));
-        }
-        for (const file of input.files) {
-            await writeFile(userId, wizardId, file.path, Buffer.from(file.data, "base64"), file.mime);
-        }
-        const row = await db.query.wizard.findFirst({ where: eq(schema.wizard.id, wizardId) });
-        if (!row) {
-            throw notFound();
-        }
-        const problems = await serverProblems(draft, await draftIssues(row), project.mcpServers.map((s) => s.id));
-        const runnable = !problems.some((p) => p.blocking);
-        let publishedVersion = row.publishedVersion;
-        if (runnable) {
-            const files = await draftFiles(wizardId);
-            await db
-                .insert(schema.wizardVersion)
-                .values({ id: nanoid(12), wizardId, version: input.version, definition: draft, files })
-                .onConflictDoUpdate({
-                target: [schema.wizardVersion.wizardId, schema.wizardVersion.version],
-                set: { definition: draft, files },
-            });
-            await db
-                .update(schema.wizard)
-                .set({ publishedVersion: input.version })
-                .where(eq(schema.wizard.id, wizardId));
-            publishedVersion = input.version;
-        }
+            if (existing && existing.projectId !== spaceId) {
+                throw new ServiceError("refused", "Ein Wizard mit dieser Kennung gehört hier woanders hin.", {
+                    reason: "id_taken",
+                });
+            }
+            const settings = {
+                title: draft.title,
+                draft,
+                shareEnabled: input.shareEnabled,
+                ...(input.dailyRunLimit ? { dailyRunLimit: input.dailyRunLimit } : {}),
+            };
+            if (!existing) {
+                await requireWizardRoom(spaceId);
+            }
+            if (existing) {
+                await db
+                    .update(schema.wizard)
+                    .set({ ...settings, revision: sql `${schema.wizard.revision} + 1`, updatedAt: new Date() })
+                    .where(eq(schema.wizard.id, wizardId));
+            }
+            else {
+                await db.insert(schema.wizard).values({
+                    id: wizardId,
+                    projectId: spaceId,
+                    tenantId: currentTenant(),
+                    // The link is made here: a token an install brought could be one another tenant holds.
+                    shareToken: nanoid(14),
+                    dailyRunLimit: env.limits.defaultDailyRuns,
+                    ...settings,
+                });
+            }
+            // The workspace becomes what was sent: files that are gone there go here.
+            await replaceFiles(wizardId, files);
+            const row = await db.query.wizard.findFirst({ where: eq(schema.wizard.id, wizardId) });
+            if (!row) {
+                throw notFound();
+            }
+            const problems = await serverProblems(draft, await draftIssues(row), project.mcpServers.map((s) => s.id));
+            const runnable = !problems.some((p) => p.blocking);
+            let publishedVersion = row.publishedVersion;
+            if (runnable) {
+                await db
+                    .insert(schema.wizardVersion)
+                    .values({ id: nanoid(12), wizardId, version: input.version, definition: draft, files })
+                    .onConflictDoUpdate({
+                    target: [schema.wizardVersion.wizardId, schema.wizardVersion.version],
+                    set: { definition: draft, files },
+                });
+                await db
+                    .update(schema.wizard)
+                    .set({ publishedVersion: input.version })
+                    .where(eq(schema.wizard.id, wizardId));
+                publishedVersion = input.version;
+            }
+            // Last, since it reaches the object store: a store that fails takes everything back.
+            await syncLogo(spaceId, input.space.logo);
+            return { row, problems, runnable, publishedVersion };
+        });
+        const { row, problems, runnable, publishedVersion } = taken;
+        // The public link lives in the control database, outside the transaction: set on every
+        // sync, so one that failed to get there once is there after the next.
+        await putLink(row.shareToken, "wizard", wizardId);
         emitDraftChanged({
             wizardId,
             kind: "draft",
@@ -316,8 +316,8 @@ export async function syncWizard(userId, rawSpaceId, rawWizardId, input) {
         });
         return {
             wizardId,
-            shareUrl: shareUrl(shareToken ?? row.shareToken),
-            code: await codeOf(shareToken ?? row.shareToken),
+            shareUrl: shareUrl(row.shareToken),
+            code: await codeOf(row.shareToken),
             shareEnabled: row.shareEnabled,
             publishedVersion,
             runnable,
@@ -348,6 +348,12 @@ export async function patchSyncedWizard(spaceId, wizardId, patch) {
         .where(eq(schema.wizard.id, w.id));
     return { ok: true };
 }
+/** The install made a new link for a wizard: its copy here gets one too, the old one stops. */
+export async function rotateSyncedLink(userId, spaceId, wizardId) {
+    const w = await syncedWizard(spaceId, wizardId);
+    const { shareToken } = await asSync(() => rotateShareLink(userId, w.id));
+    return { shareUrl: shareUrl(shareToken), code: await codeOf(shareToken) };
+}
 /** The install deleted a wizard: its copy here goes, with its link and its runs. */
 export async function removeSyncedWizard(userId, spaceId, wizardId) {
     const w = await syncedWizard(spaceId, wizardId);

package/apps/runtime/dist/update.js

@@ -4,8 +4,8 @@ import { join } from "node:path";
 import { installedByScript, isCheckout, layout, packageRoot, packageVersion } from "./cli/home.js";
 const RELEASES_URL = process.env.ENGENTY_WIZARDS_RELEASES_URL?.trim() ||
     "https://api.github.com/repos/engenty/engenty-wizards/releases/latest";
-const FOUND_FOR_MS = 6 * 60 * 60_000;
-const MISSED_FOR_MS = 60 * 60_000;
+/** How long an answer from GitHub holds, found or not, before the runtime asks again. */
+const CHECK_EVERY_MS = 60 * 60_000;
 /**
  * The exit code with which the runtime asks the command that started it for a restart: after an
  * update, that command starts the new version (cli/start.ts).
@@ -47,7 +47,7 @@ async function newestRelease() {
         return { latest: null, url: null };
     }
     const age = cached ? Date.now() - cached.at : Number.POSITIVE_INFINITY;
-    if (cached && age < (cached.latest ? FOUND_FOR_MS : MISSED_FOR_MS)) {
+    if (cached && age < CHECK_EVERY_MS) {
         return cached;
     }
     let found = { latest: null, url: null };