wizards 0.5.0 → 0.5.2

package/apps/runtime/dist/models.js

@@ -247,12 +247,12 @@ const MAKES = {
 function missingText(cfg, cls) {
     const bound = cfg.settings.bindings[cls];
     if (isCreditsRef(bound)) {
-        return bilingual("Dafür ist das Guthaben gewählt, aber kein Konto angemeldet.", "The credits are picked for this, but no account is signed in.");
+        return bilingual("Dafür sind Credits gewählt, aber du bist mit keinem Konto angemeldet.", "This is set to run on credits, but you’re not signed in to an account.");
     }
     const makes = MAKES[cls];
     const provider = bound ? providerInfo(providerOfRef(bound) ?? "") : null;
     if (provider) {
-        return bilingual(`Für ${makes.de} ist ${provider.name} gewählt, aber kein API Key hinterlegt.`, `${provider.name} is picked for ${makes.en}, but no API key is set.`);
+        return bilingual(`Für ${makes.de} ist ${provider.name} gewählt, aber kein API-Key hinterlegt.`, `${provider.name} is chosen for ${makes.en}, but no API key is set.`);
     }
     return bilingual(`Für ${makes.de} ist kein Modell eingerichtet.`, `No model is set up for ${makes.en}.`);
 }
@@ -274,7 +274,7 @@ async function creditAccess(cfg, chosen) {
     const token = await accountToken();
     if (!token) {
         if (chosen) {
-            throw new ModelUnavailableError(bilingual("Das Konto ist nicht mehr angemeldet. Bitte in den Einstellungen neu anmelden.", "The account is no longer signed in. Please sign in again in the settings."));
+            throw new ModelUnavailableError(bilingual("Das Konto ist nicht mehr angemeldet. Melde dich unter Einstellungen → Konto neu an.", "The account is no longer signed in. Sign in again under Settings → Account."));
         }
         return null;
     }
@@ -301,7 +301,7 @@ async function routeOf(cls) {
 function need(cfg, name) {
     const key = cfg.keys[name];
     if (!key) {
-        throw new ModelUnavailableError(bilingual(`Für ${providerInfo(name)?.name ?? name} ist kein API Key hinterlegt.`, `No API key is set for ${providerInfo(name)?.name ?? name}.`));
+        throw new ModelUnavailableError(bilingual(`Für ${providerInfo(name)?.name ?? name} ist kein API-Key hinterlegt.`, `No API key is set for ${providerInfo(name)?.name ?? name}.`));
     }
     return key;
 }
@@ -412,7 +412,7 @@ async function ownLanguageModel(cfg, ref, meta) {
                 };
             }
     }
-    throw new ModelUnavailableError(bilingual(`Für das Modell "${ref}" ist kein Zugang eingerichtet. Bitte in den Einstellungen einen API Key hinterlegen oder ein Konto anmelden.`, `There is no access set up for the model "${ref}". Please add an API key or sign in to an account in the settings.`));
+    throw new ModelUnavailableError(bilingual(`Das Modell „${ref}“ lässt sich noch nicht nutzen. Hinterleg unter Einstellungen → Modelle einen API-Key oder melde dich mit einem Konto an.`, `The model “${ref}” can’t be used yet. Add an API key under Settings → Models, or sign in to an account.`));
 }
 /**
  * The language model a text class runs on. A run watched from a device that offers the class
@@ -711,7 +711,7 @@ export function freeTierRefusal(err) {
 }
 /** What the person reads when Vercel's free tier leaves a model out, and how to fix it. */
 export function freeTierText(model) {
-    return bilingual(`Dein AI Gateway Key ist bei Vercel im kostenlosen Tarif, und der schließt ${model ? `„${model}“` : "dieses Modell"} aus. Abhilfe: bei Vercel Guthaben aufladen (${GATEWAY_TOP_UP}) oder unter Einstellungen → Modelle dafür einen anderen Weg wählen.`, `Your AI Gateway key is on Vercel's free tier, which leaves out ${model ? `“${model}”` : "this model"}. To fix it: top up at Vercel (${GATEWAY_TOP_UP}) or pick another way for it under Settings → Models.`);
+    return bilingual(`Dein AI-Gateway-Key nutzt bei Vercel die kostenlose Stufe, und die schließt ${model ? `„${model}“` : "dieses Modell"} aus. Lade bei Vercel Guthaben auf (${GATEWAY_TOP_UP}) oder wähle unter Einstellungen → Modelle ein anderes Modell.`, `Your AI Gateway key is on Vercel’s free tier, which doesn’t include ${model ? `“${model}”` : "this model"}. Top up at Vercel (${GATEWAY_TOP_UP}) or choose another model under Settings → Models.`);
 }
 /** What a key was answered for a model: refusals are asked again soon, as a top-up lifts them. */
 const gatewayProbes = new Map();
@@ -765,7 +765,7 @@ const CONVERSATION_MODEL = env.conversationModel || "gpt-realtime";
 export async function conversationAccess() {
     const cfg = await config();
     if (!cfg.keys.openai) {
-        throw new ModelUnavailableError(bilingual("Für Sprachgespräche ist kein OpenAI API Key hinterlegt (Einstellungen → Modelle).", "No OpenAI API key is set for voice conversations (Settings → Models)."));
+        throw new ModelUnavailableError(bilingual("Für Sprachgespräche ist kein OpenAI-API-Key hinterlegt (Einstellungen → Modelle).", "No OpenAI API key is set for voice conversations (Settings → Models)."));
     }
     return { apiKey: cfg.keys.openai, model: CONVERSATION_MODEL };
 }
@@ -802,11 +802,11 @@ export async function classProblem(cls) {
             const named = creditsModelOf((await config()).settings.bindings[cls]);
             if (named) {
                 return catalog?.models && !catalog.models.some((m) => m.id === named)
-                    ? bilingual("Dieses Modell gibt es beim Konto nicht.", "The account has no such model.")
+                    ? bilingual("Dieses Modell gibt es mit deinem Konto nicht.", "This model isn’t available with your account.")
                     : null;
             }
             return catalog?.classes && !catalog.classes[cls]
-                ? bilingual("Dafür ist beim Konto kein Modell eingerichtet.", "The account has no model set up for this.")
+                ? bilingual("Dafür ist bei deinem Konto kein Modell eingerichtet.", "Your account has no model set up for this.")
                 : null;
         }
         const client = harness(resolved.vendor);
@@ -833,7 +833,7 @@ export async function filmClient(cls) {
     const client = managed ? null : harness(cfg.settings.source);
     if (!client || !FILM_CLIENTS.has(client.id)) {
         return {
-            problem: bilingual("Filme macht Claude Code auf diesem Computer mit deinem Abo. Richte es unter „Modelle“ als KI-Abo ein.", "Films are made by Claude Code on this computer with your subscription. Set it up as an AI subscription under “Models”."),
+            problem: bilingual("Filme macht Claude Code auf diesem Computer mit deinem Abo. Richte es unter Einstellungen → Modelle als KI-Abo ein.", "Claude Code makes films on this computer, using your subscription. Set it up as an AI subscription under Settings → Models."),
         };
     }
     const status = await detectHarness(client.id);
@@ -920,7 +920,7 @@ async function appleProblem(cls) {
     }
     return (await hasFfmpeg())
         ? null
-        : bilingual("Aufnahmen aus Chrome oder Firefox (WebM, Ogg) schreibt dieser Mac erst mit ffmpeg auf; Safari und die App brauchen es nicht. ffmpeg installieren, z. B. mit „brew install ffmpeg“.", "Recordings from Chrome or Firefox (WebM, Ogg) need ffmpeg before this Mac can write them down; Safari and the app do not. Install ffmpeg, e.g. with “brew install ffmpeg”.");
+        : bilingual("Aufnahmen aus Chrome oder Firefox (WebM, Ogg) schreibt dieser Mac erst mit ffmpeg auf. Safari und die App brauchen es nicht. Installiere ffmpeg, z. B. mit „brew install ffmpeg“.", "This Mac needs ffmpeg to transcribe recordings from Chrome or Firefox (WebM, Ogg). Safari and the app don’t. Install ffmpeg, e.g. with “brew install ffmpeg”.");
 }
 /** At start the ways are asked once, so a model the key cannot reach shows before a run meets it. */
 export async function checkModelsAtStart() {
@@ -992,11 +992,11 @@ export async function checkKey(name, key, lang = "en") {
             ok: false,
             message: res.status === 401
                 ? de
-                    ? "Der Anbieter kennt diesen Key nicht."
-                    : "The provider does not know this key."
+                    ? "Der Anbieter kennt diesen API-Key nicht."
+                    : "The provider doesn’t recognise this key."
                 : de
-                    ? `Der Anbieter antwortet mit ${res.status}.`
-                    : `The provider answers with ${res.status}.`,
+                    ? `Der Anbieter antwortet mit Fehler ${res.status}.`
+                    : `The provider answered with error ${res.status}.`,
         };
     }
     catch {

package/apps/runtime/dist/plugins/claims.js

@@ -0,0 +1,56 @@
+import { and, eq } from "drizzle-orm";
+import { control, controlDb } from "../db/client.js";
+import { currentTenant } from "../tenants/tenant.js";
+import { publicRefOf } from "./public.js";
+/**
+ * `server.claims`: keys a plugin holds across the runtime's tenants, each for one tenant at a
+ * time (control `plugin_claim`). A key is the plugin's own; another plugin's of the same name is
+ * another key.
+ */
+const MAX_KEY = 200;
+function checked(key) {
+    if (!key || key.length > MAX_KEY) {
+        throw Object.assign(new Error(`A key is 1 to ${MAX_KEY} characters.`), {
+            status: 400,
+            code: "invalid",
+        });
+    }
+    return key;
+}
+export function claimsApiFor(plugin) {
+    const where = (key) => and(eq(control.pluginClaim.plugin, plugin), eq(control.pluginClaim.key, checked(key)));
+    const holderOf = async (key) => (await controlDb.query.pluginClaim.findFirst({ where: where(key) }))?.tenantId ?? null;
+    return {
+        async take(key) {
+            const tenantId = currentTenant();
+            await controlDb
+                .insert(control.pluginClaim)
+                .values({ plugin, key: checked(key), tenantId, updatedAt: new Date() })
+                .onConflictDoNothing();
+            return (await holderOf(key)) === tenantId;
+        },
+        async put(key) {
+            const tenantId = currentTenant();
+            const updatedAt = new Date();
+            await controlDb
+                .insert(control.pluginClaim)
+                .values({ plugin, key: checked(key), tenantId, updatedAt })
+                .onConflictDoUpdate({
+                target: [control.pluginClaim.plugin, control.pluginClaim.key],
+                set: { tenantId, updatedAt },
+            });
+        },
+        async drop(key) {
+            await controlDb
+                .delete(control.pluginClaim)
+                .where(and(where(key), eq(control.pluginClaim.tenantId, currentTenant())));
+        },
+        async holder(key) {
+            const tenantId = await holderOf(key);
+            return tenantId ? publicRefOf(plugin, tenantId) : null;
+        },
+        async mine(key) {
+            return (await holderOf(key)) === currentTenant();
+        },
+    };
+}

package/apps/runtime/dist/plugins/loader.js

@@ -21,6 +21,7 @@ import { putIndexEntry, removeIndexEntries } from "../services/project-index.js"
 import { originData } from "../services/space-origin.js";
 import { safeFetch } from "../tools/net-guard.js";
 import { channelsApi } from "./channels.js";
+import { claimsApiFor } from "./claims.js";
 import { discoverPlugins } from "./discovery.js";
 import { migrateOpenTenants, migratePlugins } from "./migrations.js";
 import { proModulesDir, proSources } from "./pro-state.js";
@@ -166,6 +167,7 @@ function apiFor(record) {
             },
             sharedUrl: (path) => sharedUrlOf(source.id, path),
             channels: channelsApi,
+            claims: claimsApiFor(source.id),
             runs: runsApiFor(source.id),
             speech: {
                 async conversation() {

package/apps/runtime/dist/plugins/public.js

@@ -22,9 +22,8 @@ export async function publicUrlOf(plugin, path) {
 export function sharedUrlOf(plugin, path) {
     return `${env.publicUrl}/api/public/plugins/${plugin}/${SHARED}${rest(path)}`;
 }
-/** The ref of the current tenant's public address for a plugin, made the first time. */
-export async function publicRefOf(plugin) {
-    const tenantId = currentTenant();
+/** The ref of a tenant's public address for a plugin (the current tenant's by default), made the first time. */
+export async function publicRefOf(plugin, tenantId = currentTenant()) {
     const where = and(eq(control.pluginAddress.tenantId, tenantId), eq(control.pluginAddress.plugin, plugin));
     let row = await controlDb.query.pluginAddress.findFirst({ where });
     if (!row) {

package/apps/runtime/dist/plugins/runs.js

@@ -11,6 +11,7 @@ import { saveAsset } from "../files/storage.js";
 import { wizardUnavailable } from "../limits.js";
 import { transcribeAudio } from "../media/transcribe.js";
 import { errorText, ModelUnavailableError } from "../model-errors.js";
+import { uploadMime } from "../routes/delivery.js";
 import { runTicket } from "../secrets/signing.js";
 import { notFound, ServiceError } from "../services/errors.js";
 import { runnerSettingsOf, runnersOf } from "../services/runners.js";
@@ -51,7 +52,7 @@ export function runsApiFor(pluginId) {
             }
             const visitorId = visitorOf(input.person);
             if (await visitorOverLimit(visitorId, null)) {
-                throw new ServiceError("refused", "This person started many runs lately. Try again in an hour.");
+                throw new ServiceError("refused", noteText({ code: "tooManyRuns" }, wizardLang(version.definition)));
             }
             const runId = await createRun({
                 wizardId: w.id,
@@ -66,7 +67,9 @@ export function runsApiFor(pluginId) {
                     throw new ServiceError("refused", errorText(err, wizardLang(version.definition)));
                 }
                 if (err instanceof NoCreditsError) {
-                    throw new ServiceError("no_credits", "The wizard's credits are used up.");
+                    throw new ServiceError("no_credits", wizardLang(version.definition) === "de"
+                        ? "Dieser Wizard hat gerade kein Guthaben mehr. Versuch es später noch einmal."
+                        : "This wizard has run out of credits for now. Try again later.");
                 }
                 throw err;
             });
@@ -126,9 +129,9 @@ export function runsApiFor(pluginId) {
             await reviewStep(runId, stepId, action).catch(refusedInput);
         },
         async answerAsk(runId, askId, answer) {
-            await pluginRun(runId);
+            const run = await pluginRun(runId);
             if (!(await answerAsk(runId, askId, answer === "allow" ? { type: "done" } : { type: "skip" }))) {
-                throw new ServiceError("refused", "This question is no longer open.");
+                throw new ServiceError("refused", noteText({ code: "askClosed" }, wizardLang(run.definition)));
             }
         },
         async control(runId, action) {
@@ -173,10 +176,12 @@ export function runsApiFor(pluginId) {
         },
         async upload(runId, file) {
             await pluginRun(runId);
+            // The type comes from the channel's sender: kept only when it is one a wizard takes.
+            const mime = uploadMime(file.mime);
             const asset = await saveAsset({
                 runId,
-                kind: file.mime.startsWith("image/") ? "image" : "file",
-                mime: file.mime,
+                kind: mime.startsWith("image/") ? "image" : "file",
+                mime,
                 name: file.name,
                 data: file.data instanceof Uint8Array ? file.data : new Uint8Array(file.data),
             });
@@ -185,11 +190,11 @@ export function runsApiFor(pluginId) {
         async transcribe(runId, file) {
             const run = await pluginRun(runId);
             if (run.status === "done" || run.status === "cancelled" || run.status === "failed") {
-                throw new ServiceError("refused", "The run is over.");
+                throw new ServiceError("refused", noteText({ code: "runOver" }, wizardLang(run.definition)));
             }
             const bytes = file.data instanceof Uint8Array ? file.data : new Uint8Array(file.data);
             if (!bytes.length || bytes.length > 10_000_000) {
-                throw new ServiceError("invalid", "A recording of up to 10 MB.");
+                throw new ServiceError("invalid", noteText({ code: "recordingTooLarge" }, wizardLang(run.definition)));
             }
             const { text } = await transcribeAudio({
                 bytes,

package/apps/runtime/dist/render/chromium.js

@@ -4,7 +4,8 @@ import { assertPublicUrl } from "../tools/net-guard.js";
 /**
  * One Chromium for the whole server: the engenty-browser container over CDP when
  * `BROWSER_CDP_URL` is set, else a local headless Chrome. Every user of it opens
- * its own context, so runs never share cookies or storage.
+ * its own context, so runs never share cookies or storage. Service workers are blocked: their
+ * requests would not pass a context's route guard.
  */
 let browserPromise = null;
 async function connect() {
@@ -31,8 +32,17 @@ export function getBrowser() {
 }
 export async function newContext(options = {}) {
     const browser = await getBrowser();
-    return browser.newContext({ viewport: { width: 1280, height: 900 }, ...options });
+    return browser.newContext({
+        viewport: { width: 1280, height: 900 },
+        serviceWorkers: "block",
+        ...options,
+    });
 }
+/**
+ * Verdicts are kept only briefly: a name's addresses can change, and a page that rebinds its own
+ * name to a private address must not ride on an old "public".
+ */
+const HOST_CHECK_TTL_MS = 30_000;
 const hostChecks = new Map();
 function publicHost(url) {
     let host;
@@ -42,25 +52,28 @@ function publicHost(url) {
     catch {
         return Promise.resolve(false);
     }
-    let check = hostChecks.get(host);
-    if (!check) {
-        check = assertPublicUrl(url).then(() => true, () => false);
-        hostChecks.set(host, check);
-        if (hostChecks.size > 2000) {
-            hostChecks.clear();
-        }
+    const now = Date.now();
+    const cached = hostChecks.get(host);
+    if (cached && now - cached.at < HOST_CHECK_TTL_MS) {
+        return cached.check;
+    }
+    const check = assertPublicUrl(url).then(() => true, () => false);
+    hostChecks.set(host, { at: now, check });
+    if (hostChecks.size > 2000) {
+        hostChecks.clear();
     }
     return check;
 }
 /**
  * A context for browsing the web on a person's behalf: every request, whoever started it (the
- * agent, a redirect, the person clicking), may only reach public hosts.
+ * agent, a redirect, the person clicking), may only reach public hosts over http(s). Pages may
+ * still use their own data: and blob: URLs; every other scheme (file:, ftp:, ...) is refused.
  */
 export async function webContext(options = {}) {
     const context = await newContext({ acceptDownloads: true, ...options });
     await context.route("**/*", async (route) => {
         const url = route.request().url();
-        if (!/^https?:/i.test(url) || (await publicHost(url))) {
+        if (/^(data|blob):/i.test(url) || (/^https?:/i.test(url) && (await publicHost(url)))) {
             await route.continue();
         }
         else {

package/apps/runtime/dist/routes/api.js

@@ -20,7 +20,7 @@ import { siteJob, siteSchema, startSiteJob } from "../services/site.js";
 import { checkOnServer, checkSchema, listSyncedSpaces, patchSyncedWizard, removeSyncedSpace, removeSyncedWizard, rotateSyncedLink, syncDataSchema, syncSettingsSchema, syncSpaceData, syncWizard, syncWizardSchema, } from "../services/spaces.js";
 import { createWizard, ownedWizard, publishWizard, writeDraft } from "../services/wizards.js";
 import { codeOf, tenantStatus } from "../tenants/control.js";
-import { inLang } from "./lang.js";
+import { inLang, notFoundAnswer } from "./lang.js";
 import { dispatchAs } from "./plugins.js";
 const importSchema = z.object({
     /** An earlier import's wizard: it is updated instead of a new one being made. */
@@ -44,7 +44,7 @@ const PRO_PLUGINS = ["contacts", "appointments"];
 const WIZARD_BYTES = 48 * 1024 * 1024;
 const tooLarge = bodyLimit({
     maxSize: WIZARD_BYTES,
-    onError: (c) => c.json({ error: "Request body too large.", code: "too_large" }, 413),
+    onError: (c) => c.json({ error: "The request is too large.", code: "too_large" }, 413),
 });
 /**
  * The caller of an API call, signed in like an MCP client (access token or API key), with the
@@ -57,10 +57,13 @@ async function caller(c, scopes) {
     }
     const who = principalOf(authInfo);
     if (scopes.some((scope) => !who.scopes.includes(scope))) {
-        return c.json({ error: "This token may not do that.", code: "insufficient_scope" }, 403);
+        return c.json({ error: "This token isn’t allowed to do that.", code: "insufficient_scope" }, 403);
     }
     if ((await tenantStatus(who.tenantId)) === "suspended") {
-        return c.json({ error: "tenant_suspended" }, 403);
+        return c.json({
+            error: inLang(c, "Dieses Konto ist gesperrt.", "This account is suspended."),
+            code: "tenant_suspended",
+        }, 403);
     }
     return who;
 }
@@ -69,7 +72,7 @@ function withinSyncLimit(c, who) {
     return allowed(`sync:${who.tenantId}`, 240, HOUR)
         ? null
         : c.json({
-            error: inLang(c, "Zu viele Übertragungen. Bitte später noch einmal.", "Too many transfers. Please try again later."),
+            error: inLang(c, "Zu viele Übertragungen. Versuch es später noch einmal.", "Too many transfers. Try again later."),
             code: "rate_limited",
         }, 429);
 }
@@ -91,7 +94,7 @@ async function pluginCall(c) {
                 code: "plugin",
                 plugin: id,
             }, 403)
-            : c.json({ error: "not found", code: "not_found" }, 404);
+            : c.json(notFoundAnswer(c), 404);
     }
     return inTenantAs(who, () => dispatchAs(c, {
         id: who.userId,
@@ -287,7 +290,7 @@ export const apiRoutes = new Hono()
     }
     if (!allowed(`site:${who.tenantId}`, 20, HOUR)) {
         return c.json({
-            error: inLang(c, "Zu oft hintereinander. Bitte später noch einmal.", "Too often in a row. Please try again later."),
+            error: inLang(c, "Zu oft hintereinander. Versuch es später noch einmal.", "Too many times in a row. Try again later."),
             code: "rate_limited",
         }, 429);
     }
@@ -389,10 +392,13 @@ export const apiRoutes = new Hono()
     const body = importSchema.parse(await c.req.json());
     if (!who.scopes.includes("wizards:write") ||
         (body.publish && !who.scopes.includes("wizards:publish"))) {
-        return c.json({ error: "This token may not do that.", code: "insufficient_scope" }, 403);
+        return c.json({ error: "This token isn’t allowed to do that.", code: "insufficient_scope" }, 403);
     }
     if ((await tenantStatus(who.tenantId)) === "suspended") {
-        return c.json({ error: "tenant_suspended" }, 403);
+        return c.json({
+            error: inLang(c, "Dieses Konto ist gesperrt.", "This account is suspended."),
+            code: "tenant_suspended",
+        }, 403);
     }
     return inTenantAs(who, async () => {
         const writer = { source: "mcp", client: who.client };

package/apps/runtime/dist/routes/debug.js

@@ -15,7 +15,7 @@ export const localDebugRoutes = new Hono()
     .use(async (c, next) => {
     const ticket = c.req.header(LOCAL_MCP_HEADER) ?? "";
     if (managed || !localTicketExpiry(env.authSecret, ticket, Date.now(), "local-debug")) {
-        return c.json({ error: "unauthorized" }, 401);
+        return c.json({ error: "This ticket isn’t valid.", code: "unauthorized" }, 401);
     }
     await next();
 })

package/apps/runtime/dist/routes/delivery.js

@@ -3,6 +3,52 @@ import { basePath } from "../env.js";
 export function uploadLimit(mime) {
     return mime.startsWith("video/") ? 40_000_000 : 15_000_000;
 }
+/** `type/subtype` and nothing else: no commas, spaces or quotes a browser could read another type from. */
+const MIME = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/;
+/** The bare type of a declared one ("audio/webm;codecs=opus" → "audio/webm"), or null if it is not one. */
+export function bareMime(declared) {
+    const mime = declared.split(";")[0].trim().toLowerCase();
+    return MIME.test(mime) ? mime : null;
+}
+/** What a person hands a wizard besides photos, recordings and clips: documents and tables. */
+const DOCUMENT_TYPES = new Set([
+    "application/pdf",
+    "application/msword",
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    "application/vnd.ms-excel",
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    "application/vnd.ms-powerpoint",
+    "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+    "application/vnd.oasis.opendocument.text",
+    "application/vnd.oasis.opendocument.spreadsheet",
+    "application/vnd.oasis.opendocument.presentation",
+    "application/rtf",
+    "application/json",
+    "application/zip",
+    "message/rfc822",
+    "text/plain",
+    "text/csv",
+    "text/tab-separated-values",
+    "text/markdown",
+    "text/calendar",
+    "text/vcard",
+]);
+/**
+ * The type an upload is kept as: the browser's word for it, when it is a picture, a recording, a
+ * clip or a document. Anything else (an HTML page, a script) is kept as plain bytes; reading it
+ * goes by its name (documents/parse.ts).
+ */
+export function uploadMime(declared) {
+    const mime = bareMime(declared);
+    return mime && (/^(image|audio|video)\//.test(mime) || DOCUMENT_TYPES.has(mime))
+        ? mime
+        : "application/octet-stream";
+}
+/** What a browser shows in place without running anything of the file's: photos, sound, film, PDFs. */
+export function inlineSafe(mime) {
+    return ((/^(image|audio|video)\//.test(mime) && !mime.startsWith("image/svg")) ||
+        mime === "application/pdf");
+}
 /** `version`: the published one, so a new engenty or name reaches icons a phone has kept. */
 export function wizardManifest(token, title, description, version = 0) {
     const start = `${basePath}/w/${token}`;

package/apps/runtime/dist/routes/lang.js

@@ -11,3 +11,10 @@ export function requestLang(c) {
 export function inLang(c, de, en) {
     return requestLang(c) === "de" ? de : en;
 }
+/** A 404 the person may read: a sentence in their language, the machine code beside it. */
+export function notFoundAnswer(c) {
+    return {
+        error: inLang(c, "Das gibt es nicht oder nicht mehr.", "This doesn’t exist or was deleted."),
+        code: "not_found",
+    };
+}

package/apps/runtime/dist/routes/marketplace.js

@@ -2,6 +2,7 @@ import { CAPABILITY_IDS, INDUSTRY_IDS, ITEM_FORMAT_IDS, MARKETPLACE_PLAN_IDS, US
 import { Hono } from "hono";
 import { z } from "zod";
 import { asLang, marketplaceDetail, searchMarketplace, starEntry, } from "../services/marketplace.js";
+import { notFoundAnswer } from "./lang.js";
 const searchSchema = z.object({
     q: z.string().trim().max(200).default(""),
     lang: z.string().optional(),
@@ -25,7 +26,7 @@ export const marketplaceStudio = new Hono()
 })
     .get("/:id", async (c) => {
     const detail = await marketplaceDetail(c.req.param("id"), asLang(c.req.query("lang")));
-    return detail ? c.json(detail) : c.json({ error: "not found" }, 404);
+    return detail ? c.json(detail) : c.json(notFoundAnswer(c), 404);
 })
     .put("/:id/star", async (c) => {
     await starEntry(c.get("user").tenantId, c.req.param("id"), true);

package/apps/runtime/dist/routes/plugin-public.js

@@ -3,6 +3,7 @@ import { withTenant } from "../db/client.js";
 import { SHARED, tenantOfAddress } from "../plugins/public.js";
 import { loadedPlugin, pluginIdsOf } from "../plugins/registry.js";
 import { tenantStatus } from "../tenants/control.js";
+import { notFoundAnswer } from "./lang.js";
 import { answerOf } from "./plugins.js";
 /**
  * Plugins' public routes (`server.registerPublicRoute`), below `/api/public/plugins/<id>/<ref>`.
@@ -10,7 +11,7 @@ import { answerOf } from "./plugins.js";
  * Shared routes (`server.registerSharedRoute`) are below `/api/public/plugins/<id>/shared`, for
  * every tenant; their handler enters a tenant by the ref the call carries.
  */
-const notFound = (c) => c.json({ error: "not found", code: "not_found" }, 404);
+const notFound = (c) => c.json(notFoundAnswer(c), 404);
 /** What a handler threw, as the answer: its status and code, or a 500. */
 function failed(c, id, what, err) {
     const answer = answerOf(err);

package/apps/runtime/dist/routes/plugins.js

@@ -5,6 +5,7 @@ import { managed } from "../manage.js";
 import { pluginProblems, reloadPlugin, rescanPlugins } from "../plugins/loader.js";
 import { installPro, proState, refreshPro, removePro } from "../plugins/pro.js";
 import { loadedPlugin, onPluginChange, pluginAsset, pluginIdsOf, pluginsOf, } from "../plugins/registry.js";
+import { notFoundAnswer } from "./lang.js";
 const admin = (user) => user.role === "owner" || user.role === "admin";
 /** Plugins change while the app runs only where it runs alone: a reload would hit every tenant. */
 const canReload = (user) => !managed && admin(user);
@@ -49,7 +50,7 @@ export async function dispatchAs(c, user) {
     const id = c.req.param("id") ?? "";
     const plugin = (await pluginIdsOf(user.tenantId)).has(id) ? loadedPlugin(id) : undefined;
     if (!plugin) {
-        return c.json({ error: "not found", code: "not_found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const url = new URL(c.req.url);
     const path = url.pathname.slice(url.pathname.indexOf(`/plugins/${id}`) + `/plugins/${id}`.length);
@@ -59,7 +60,7 @@ export async function dispatchAs(c, user) {
             continue;
         }
         if (route.role === "admin" && !admin(user)) {
-            return c.json({ error: "forbidden", code: "forbidden" }, 403);
+            return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
         }
         const request = {
             request: c.req.raw,
@@ -91,7 +92,7 @@ export async function dispatchAs(c, user) {
             return c.json({ error: "The plugin failed.", code: "plugin_failed" }, 500);
         }
     }
-    return c.json({ error: "not found", code: "not_found" }, 404);
+    return c.json(notFoundAnswer(c), 404);
 }
 const dispatch = (c) => dispatchAs(c, c.get("user"));
 const TYPES = {
@@ -117,7 +118,7 @@ export const pluginRoutes = new Hono()
     const plugin = (await pluginIdsOf(user.tenantId)).has(id) ? loadedPlugin(id) : undefined;
     const asset = plugin && kind ? pluginAsset(plugin, kind.kind) : null;
     if (!asset || !kind) {
-        return c.json({ error: "not found", code: "not_found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     return c.body(new Uint8Array(await readFile(asset.file)), 200, {
         "content-type": kind.type,
@@ -127,7 +128,7 @@ export const pluginRoutes = new Hono()
     // Says when a plugin loaded again, so an open studio takes the new one without a page load.
     .get("/-/events", (c) => {
     if (managed) {
-        return c.json({ error: "not found", code: "not_found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     return streamSSE(c, async (stream) => {
         let closed = false;
@@ -149,37 +150,35 @@ export const pluginRoutes = new Hono()
 })
     .post("/-/reload", async (c) => {
     if (!canReload(c.get("user"))) {
-        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
     }
     await rescanPlugins();
     return c.json({ plugins: (await pluginsOf(c.get("user").tenantId)).map(view) });
 })
     .post("/-/reload/:id", async (c) => {
     if (!canReload(c.get("user"))) {
-        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
     }
     const plugin = await reloadPlugin(c.req.param("id"));
-    return plugin
-        ? c.json({ plugin: view(plugin) })
-        : c.json({ error: "not found", code: "not_found" }, 404);
+    return plugin ? c.json({ plugin: view(plugin) }) : c.json(notFoundAnswer(c), 404);
 })
     // Pro modules: the closed plugins the linked account's plan includes (plugins/pro.ts).
     .get("/-/pro", async (c) => {
     if (!canReload(c.get("user"))) {
-        return c.json({ error: "not found", code: "not_found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     return c.json(await proState());
 })
     .post("/-/pro/refresh", async (c) => {
     if (!canReload(c.get("user"))) {
-        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
     }
     await refreshPro();
     return c.json(await proState());
 })
     .post("/-/pro/:id", async (c) => {
     if (!canReload(c.get("user"))) {
-        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
     }
     try {
         await installPro(c.req.param("id"));
@@ -195,7 +194,7 @@ export const pluginRoutes = new Hono()
 })
     .delete("/-/pro/:id", async (c) => {
     if (!canReload(c.get("user"))) {
-        return c.json({ error: "forbidden", code: "forbidden" }, 403);
+        return c.json({ error: "This isn’t allowed here.", code: "forbidden" }, 403);
     }
     try {
         await removePro(c.req.param("id"));