wizards 0.5.0 → 0.5.2

package/apps/runtime/dist/routes/runs.js

@@ -38,11 +38,13 @@ import { sharedRun, shareImage, shareRun, shareView, unshareRun } from "../servi
 import { isIconFile, wizardAvatarSvg, wizardIcon } from "../services/wizard-icon.js";
 import { clearStore, deleteRows, listRows, listSecrets, readStoreFile, StoreError, saveRows, scopeOf, storeFiles, updateRow, } from "../store/index.js";
 import { tenantOfLink, tenantOfRun, tenantStatus, tokenOfCode, visitorOverLimit, } from "../tenants/control.js";
-import { byteRange, uploadLimit, wizardManifest } from "./delivery.js";
-import { requestLang } from "./lang.js";
+import { bareMime, byteRange, inlineSafe, uploadLimit, uploadMime, wizardManifest, } from "./delivery.js";
+import { inLang, notFoundAnswer, requestLang } from "./lang.js";
 const VISITOR_COOKIE = "wz_vid";
 /** Kept files a review shows inline. */
 const INLINE_TYPES = new Set(["application/pdf", "image/png", "image/jpeg", "image/webp"]);
+/** Assets whose bytes and type someone outside the wizard chose: uploads and collected files. */
+const FOREIGN_KINDS = new Set(["upload", "upload-image", "file"]);
 export function clientIp(c) {
     const fwd = c.req.header("x-forwarded-for")?.split(",")[0]?.trim();
     if (fwd) {
@@ -148,7 +150,7 @@ function tenantFrom(find) {
     return async (c, next) => {
         const tenant = await find(c);
         if (!tenant) {
-            return c.json({ error: "not found" }, 404);
+            return c.json(notFoundAnswer(c), 404);
         }
         if ((await tenantStatus(tenant)) === "suspended") {
             return refuse(c, { code: "wizardUnavailable" }, 403);
@@ -187,7 +189,7 @@ async function pageRunner(c, rest) {
         where: eq(schema.wizard.shareToken, c.req.param("token") ?? ""),
     });
     if (!w || w.publishedVersion === null) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const version = await db.query.wizardVersion.findFirst({
         where: and(eq(schema.wizardVersion.wizardId, w.id), eq(schema.wizardVersion.version, w.publishedVersion)),
@@ -195,19 +197,22 @@ async function pageRunner(c, rest) {
     const served = version
         ? await servePageRunner(w, version.definition, c.req.param("runner") ?? "", rest, c.req.raw)
         : null;
-    return served ?? c.json({ error: "not found" }, 404);
+    return served ?? c.json(notFoundAnswer(c), 404);
 }
 export const publicRoutes = new Hono()
     // A wizard's ID, typed into the mobile app: answers its share token.
     .get("/codes/:code", async (c) => {
     const ip = clientIp(c);
     if (codeLookupBlocked(ip)) {
-        return c.json({ error: "too many tries" }, 429);
+        return c.json({
+            error: inLang(c, "Zu viele Versuche. Warte kurz und versuch es noch einmal.", "Too many tries. Wait a moment and try again."),
+            code: "too_many_tries",
+        }, 429);
     }
     const found = await tokenOfCode(c.req.param("code"));
     if (!found || (await tenantStatus(found.tenantId)) === "suspended") {
         codeMissed(ip);
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     return c.json({ token: found.token, url: `${env.publicUrl}/w/${found.token}` });
 })
@@ -219,7 +224,7 @@ export const publicRoutes = new Hono()
         where: eq(schema.wizard.shareToken, c.req.param("token")),
     });
     if (!w || w.publishedVersion === null) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const version = await db.query.wizardVersion.findFirst({
         where: and(eq(schema.wizardVersion.wizardId, w.id), eq(schema.wizardVersion.version, w.publishedVersion)),
@@ -245,7 +250,7 @@ export const publicRoutes = new Hono()
         where: eq(schema.wizard.shareToken, c.req.param("token")),
     });
     if (!w || w.publishedVersion === null) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const reason = await wizardUnavailable(w);
     if (reason) {
@@ -372,7 +377,7 @@ export const runRoutes = new Hono()
     .get("/:id", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     return c.json(await viewOf(run));
 })
@@ -380,7 +385,7 @@ export const runRoutes = new Hono()
     const id = c.req.param("id");
     const first = await accessibleRun(c, id);
     if (!first) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     return streamSSE(c, async (stream) => {
         let pending = false;
@@ -432,7 +437,7 @@ export const runRoutes = new Hono()
     .post("/:id/device", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const offer = z
         .object({
@@ -451,7 +456,7 @@ export const runRoutes = new Hono()
     .post("/:id/device/:reqId", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const answer = z
         .object({ text: z.string().max(200_000).optional(), error: z.string().max(500).optional() })
@@ -461,7 +466,7 @@ export const runRoutes = new Hono()
     .post("/:id/pages/:stepId", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const { values } = z
         .object({ values: z.record(z.string(), z.unknown()) })
@@ -477,7 +482,7 @@ export const runRoutes = new Hono()
     .post("/:id/reviews/:stepId", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const action = z
         .discriminatedUnion("type", [
@@ -501,7 +506,7 @@ export const runRoutes = new Hono()
     .post("/:id/back", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     try {
         await goBack(run.id);
@@ -514,7 +519,7 @@ export const runRoutes = new Hono()
     .post("/:id/retry", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     try {
         await retry(run.id);
@@ -527,7 +532,7 @@ export const runRoutes = new Hono()
     .post("/:id/cancel", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     await cancel(run.id);
     return c.json({ ok: true });
@@ -536,7 +541,7 @@ export const runRoutes = new Hono()
     .post("/:id/talk", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     if (run.status === "done" || run.status === "cancelled" || run.status === "failed") {
         return refuse(c, { code: "runOver" }, 409);
@@ -563,7 +568,7 @@ export const runRoutes = new Hono()
     .post("/:id/transcribe", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     if (run.status === "done" || run.status === "cancelled" || run.status === "failed") {
         return refuse(c, { code: "runOver" }, 409);
@@ -597,12 +602,14 @@ export const runRoutes = new Hono()
     .post("/:id/uploads", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const form = await c.req.formData();
     const file = form.get("file");
-    // A recorder names its type with codecs ("audio/webm;codecs=opus"); the bare type is kept.
-    const mime = file instanceof File ? file.type.split(";")[0].trim().toLowerCase() : "";
+    // A recorder names its type with codecs ("audio/webm;codecs=opus"); the bare type is kept,
+    // and only when it is one a wizard takes. The browser's word is the sender's: anything else
+    // is kept as plain bytes, so it can never come back as a page on this origin.
+    const mime = uploadMime(file instanceof File ? file.type : "");
     const limit = uploadLimit(mime);
     if (!(file instanceof File) || file.size > limit) {
         return refuse(c, { code: "fileTooLarge", params: { mb: Math.round(limit / 1_000_000) } }, 400);
@@ -610,7 +617,7 @@ export const runRoutes = new Hono()
     const ref = await saveAsset({
         runId: run.id,
         kind: mime.startsWith("image/") ? "upload-image" : "upload",
-        mime: mime || "application/octet-stream",
+        mime,
         name: file.name.slice(0, 120),
         data: new Uint8Array(await file.arrayBuffer()),
     });
@@ -620,7 +627,7 @@ export const runRoutes = new Hono()
     .post("/:id/geocode", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const { lat, lng, language } = z
         .object({
@@ -649,7 +656,7 @@ export const runRoutes = new Hono()
     .post("/:id/ask/:askId", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const answer = z
         .discriminatedUnion("type", [
@@ -673,7 +680,7 @@ export const runRoutes = new Hono()
     const resources = run?.status === "running" ? liveResources(run.id) : null;
     if (!resources?.openPage()) {
         // The run may work in another process: its runner answers.
-        return (run && (await fromOwner(c, run.id))) || c.json({ error: "not found" }, 404);
+        return (run && (await fromOwner(c, run.id))) || c.json(notFoundAnswer(c), 404);
     }
     return c.json({ seat: resources.seatHolder() });
 })
@@ -831,7 +838,7 @@ export const runRoutes = new Hono()
     const run = await accessibleRun(c, c.req.param("id"));
     const connection = run?.definition.connections?.find((x) => x.id === c.req.param("connectionId"));
     if (!run || !connection) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     try {
         const url = await startOAuth(scopeOf(run), await projectIdOf(run), run.id, connection, c.req.param("connectorId"), requestLang(c));
@@ -848,7 +855,7 @@ export const runRoutes = new Hono()
     const run = await accessibleRun(c, c.req.param("id"));
     const connection = run?.definition.connections?.find((x) => x.id === c.req.param("connectionId"));
     if (!run || !connection) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const { values } = z
         .object({ values: z.record(z.string(), z.string().max(500)) })
@@ -868,7 +875,7 @@ export const runRoutes = new Hono()
     .delete("/:id/connections/:connectionId", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     await disconnect(scopeOf(run), c.req.param("connectionId"));
     signalChanged(run.id);
@@ -880,7 +887,7 @@ export const runRoutes = new Hono()
     // A shared list is every run's: the person never sees it.
     const def = run?.definition.lists?.find((l) => l.id === c.req.param("list") && !l.shared);
     if (!run || !def) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const { cells } = z
         .object({ cells: z.record(z.string(), z.unknown()) })
@@ -899,14 +906,14 @@ export const runRoutes = new Hono()
     // A shared list is every run's: the person never sees it.
     const def = run?.definition.lists?.find((l) => l.id === c.req.param("list") && !l.shared);
     if (!run || !def) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const { cells } = z
         .object({ cells: z.record(z.string(), z.unknown()) })
         .parse(await c.req.json());
     try {
         if (!(await updateRow(scopeOf(run), def, c.req.param("rowId"), cells))) {
-            return c.json({ error: "not found" }, 404);
+            return c.json(notFoundAnswer(c), 404);
         }
     }
     catch (err) {
@@ -920,7 +927,7 @@ export const runRoutes = new Hono()
     // A shared list is every run's: the person never sees it.
     const def = run?.definition.lists?.find((l) => l.id === c.req.param("list") && !l.shared);
     if (!run || !def) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     await deleteRows(scopeOf(run), def, [c.req.param("rowId")]);
     signalChanged(run.id);
@@ -944,7 +951,7 @@ export const runRoutes = new Hono()
     .get("/:id/store", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const scope = scopeOf(run);
     const lists = await Promise.all((run.definition.lists ?? [])
@@ -989,7 +996,7 @@ export const runRoutes = new Hono()
     .delete("/:id/store", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     await clearStore(scopeOf(run));
     signalChanged(run.id);
@@ -999,7 +1006,7 @@ export const runRoutes = new Hono()
     .post("/:id/notify", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     const body = z
         .object({
@@ -1014,7 +1021,7 @@ export const runRoutes = new Hono()
     .delete("/:id/notify", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     await setPushDevice(run.id, null);
     return c.json({ ok: true });
@@ -1022,7 +1029,7 @@ export const runRoutes = new Hono()
     .post("/:id/share", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     try {
         return c.json(await shareRun(run));
@@ -1037,7 +1044,7 @@ export const runRoutes = new Hono()
     .delete("/:id/share", async (c) => {
     const run = await accessibleRun(c, c.req.param("id"));
     if (!run) {
-        return c.json({ error: "not found" }, 404);
+        return c.json(notFoundAnswer(c), 404);
     }
     await unshareRun(run);
     return c.json({ ok: true });
@@ -1108,22 +1115,25 @@ async function serveAsset(c, run, assetId) {
     if (!found || found.row.runId !== run.id) {
         return c.notFound();
     }
+    // The stored type is sent only as a bare `type/subtype`: "text/html,x" reads as HTML to a browser.
+    const mime = bareMime(found.row.mime) ?? "application/octet-stream";
+    // What a person or a plugin uploaded, and files a step collected from mail and the web.
+    const foreign = FOREIGN_KINDS.has(found.row.kind);
     const headers = {
-        "content-type": found.row.mime,
+        "content-type": mime,
         "cache-control": "private, max-age=3600",
         "x-content-type-options": "nosniff",
+        // Nothing opened on its own runs scripts with this origin (an SVG, an XML document, a page).
+        // A PDF is left to the browser's own viewer, which a sandbox would keep from starting.
+        ...(mime === "application/pdf" ? {} : { "content-security-policy": "sandbox" }),
     };
-    // Files a step collected come from mail and the web: they are downloads, never pages of ours.
-    if (found.row.kind === "file") {
+    // Foreign files are downloads, never pages of ours: only photos, sound, film and PDFs show in place.
+    if (foreign && !inlineSafe(mime)) {
         headers["content-disposition"] =
             `attachment; filename="${found.row.name.replace(/["\\\r\n]/g, "")}"`;
     }
-    // An SVG or XML document opened on its own could run scripts with this origin.
-    if (/svg|xml/.test(found.row.mime)) {
-        headers["content-security-policy"] = "sandbox";
-    }
     // Generated HTML runs its scripts in an opaque origin and can reach nothing.
-    if (found.row.mime === "text/html") {
+    if (mime === "text/html" && !foreign) {
         const html = await stepHtml({
             assets: [{ id: assetId, kind: found.row.kind, mime: found.row.mime, name: "" }],
             at: "",
@@ -1132,7 +1142,7 @@ async function serveAsset(c, run, assetId) {
         headers["content-security-policy"] = HTML_RESPONSE_CSP;
         return c.body(new TextEncoder().encode(html ?? ""), 200, headers);
     }
-    if (/^(audio|video)\//.test(found.row.mime)) {
+    if (/^(audio|video)\//.test(mime)) {
         headers["accept-ranges"] = "bytes";
         const size = found.data.byteLength;
         const range = byteRange(c.req.header("range"), size);

package/apps/runtime/dist/routes/studio.js

@@ -281,7 +281,10 @@ export const studio = new Hono()
     // The team as the Manage-App keeps it: its people, who is invited, the places the plan gives.
     .get("/team", async (c) => {
     if (!managed) {
-        return c.json({ error: "not_managed" }, 404);
+        return c.json({
+            error: inLang(c, "Das gibt es nur in der Cloud.", "This is only available in the cloud."),
+            code: "not_managed",
+        }, 404);
     }
     const user = c.get("user");
     const [info, team] = await Promise.all([
@@ -300,11 +303,17 @@ export const studio = new Hono()
     // A runtime that runs alone says when a newer release is out and can run the update itself;
     // `?fresh=1` asks GitHub now instead of within the hour.
     .get("/update", async (c) => managed
-    ? c.json({ error: "not_local" }, 404)
+    ? c.json({
+        error: inLang(c, "Das gibt es nur auf deinem Computer.", "This is only available on your computer."),
+        code: "not_local",
+    }, 404)
     : c.json(await updateStatus(c.req.query("fresh") === "1")))
     .post("/update", async (c) => {
     if (managed) {
-        return c.json({ error: "not_local" }, 404);
+        return c.json({
+            error: inLang(c, "Das gibt es nur auf deinem Computer.", "This is only available on your computer."),
+            code: "not_local",
+        }, 404);
     }
     applyUpdate();
     return c.json(await updateStatus());
@@ -333,7 +342,7 @@ export const studio = new Hono()
     .post("/assistant/speak", async (c) => {
     const { text } = z.object({ text: z.string().min(1).max(4000) }).parse(await c.req.json());
     if ((await classWays()).speech.kind === "none") {
-        throw new ServiceError("refused", bilingual("Hier spricht kein Sprachmodell.", "No language model speaks here."));
+        throw new ServiceError("refused", bilingual("Hier ist kein Sprachmodell eingerichtet.", "No language model is set up here."));
     }
     if (!(await canSpend())) {
         throw new ServiceError("no_credits", bilingual("Dein Guthaben ist aufgebraucht.", "Your credits are used up."));
@@ -472,8 +481,8 @@ export const studio = new Hono()
                 message: err instanceof ServiceError || err instanceof ModelUnavailableError
                     ? errorText(err, body.lang)
                     : body.lang === "de"
-                        ? "Da ist etwas schiefgelaufen. Bitte noch einmal versuchen."
-                        : "Something went wrong. Please try again.",
+                        ? "Da ist etwas schiefgelaufen. Versuch es noch einmal."
+                        : "Something went wrong. Try again.",
             });
         }
         endRun(runId);
@@ -483,7 +492,7 @@ export const studio = new Hono()
 })
     // --- projects --------------------------------------------------------------
     .get("/projects", async (c) => {
-    const projects = await listProjects(c.get("user").id);
+    const projects = await listProjects(c.get("user").id, requestLang(c));
     const build = await mayBuild();
     return c.json(projects.map((p) => ({
         id: p.id,
@@ -521,7 +530,7 @@ export const studio = new Hono()
     const kind = z.enum(PROJECT_FILE_KINDS).parse(c.req.query("kind"));
     const file = (await c.req.formData()).get("file");
     if (!(file instanceof File)) {
-        throw new ServiceError("invalid", bilingual("Bitte eine Datei wählen.", "Please choose a file."));
+        throw new ServiceError("invalid", bilingual("Wähl eine Datei.", "Choose a file."));
     }
     const row = await addProjectFile(project.id, {
         kind,
@@ -554,7 +563,7 @@ export const studio = new Hono()
     await ownedProject(c.get("user").id, c.req.param("id"));
     const { url } = z.object({ url: z.string().min(1).max(2000) }).parse(await c.req.json());
     const colors = await scanColors(url).catch(() => {
-        throw new ServiceError("invalid", bilingual("Die Seite ist nicht erreichbar.", "The page cannot be reached."));
+        throw new ServiceError("invalid", bilingual("Die Seite ist nicht erreichbar.", "The page can’t be reached."));
     });
     return c.json({ colors });
 })
@@ -588,7 +597,7 @@ export const studio = new Hono()
     await ownedProject(c.get("user").id, c.req.param("id"));
     const { url } = z.object({ url: z.string().min(1).max(2000) }).parse(await c.req.json());
     const fonts = await scanFonts(url).catch(() => {
-        throw new ServiceError("invalid", bilingual("Die Seite ist nicht erreichbar.", "The page cannot be reached."));
+        throw new ServiceError("invalid", bilingual("Die Seite ist nicht erreichbar.", "The page can’t be reached."));
     });
     return c.json({ fonts });
 })
@@ -830,7 +839,7 @@ export const studio = new Hono()
                     ? { fileId: id }
                     : null;
     if (!ref || key[1] !== ":") {
-        throw new ServiceError("invalid", "Unbekannter Eintrag.");
+        throw new ServiceError("invalid", bilingual("Unbekannter Eintrag.", "Unknown entry."));
     }
     const { values } = z
         .object({ values: z.array(z.union([z.string().max(300), z.number(), z.boolean()])).max(50) })
@@ -944,7 +953,7 @@ export const studio = new Hono()
     .post("/projects/:id/wizards/import", async (c) => {
     const file = (await c.req.formData()).get("file");
     if (!(file instanceof File) || !file.size || file.size > PACKAGE_MAX_BYTES) {
-        throw new ServiceError("invalid", bilingual(`Bitte ein Wizard-Paket (${PACKAGE_EXTENSION}) bis 30 MB.`, `Please a wizard package (${PACKAGE_EXTENSION}) of up to 30 MB.`));
+        throw new ServiceError("invalid", bilingual(`Wähl eine Wizard-Datei (${PACKAGE_EXTENSION}) bis 30 MB.`, `Choose a wizard file (${PACKAGE_EXTENSION}) of 30 MB or less.`));
     }
     return c.json(await importWizard(c.get("user").id, c.req.param("id"), new Uint8Array(await file.arrayBuffer()), file.name, requestLang(c)));
 })
@@ -1137,7 +1146,7 @@ export const studio = new Hono()
                 data: JSON.stringify({
                     message: err instanceof ServiceError
                         ? errorText(err, requestLang(c))
-                        : inLang(c, "Da ist etwas schiefgelaufen. Bitte noch einmal versuchen.", "Something went wrong. Please try again."),
+                        : inLang(c, "Da ist etwas schiefgelaufen. Versuch es noch einmal.", "Something went wrong. Try again."),
                 }),
             });
         }
@@ -1147,7 +1156,7 @@ export const studio = new Hono()
     .post("/transcribe", async (c) => {
     const file = (await c.req.formData()).get("file");
     if (!(file instanceof File) || !file.size || file.size > 10_000_000) {
-        throw new ServiceError("invalid", bilingual("Bitte eine Aufnahme bis 10 MB.", "Please a recording of up to 10 MB."));
+        throw new ServiceError("invalid", bilingual("Die Aufnahme darf höchstens 10 MB groß sein.", "The recording can be 10 MB at most."));
     }
     if (!(await canSpend())) {
         throw new ServiceError("no_credits", bilingual("Dein Guthaben ist aufgebraucht.", "Your credits are used up."));
@@ -1221,7 +1230,7 @@ export const studio = new Hono()
     const { connect } = z.object({ connect: z.boolean() }).parse(await c.req.json());
     const [done] = await connectApps(layout(), [c.req.param("id")], !connect);
     if (!done) {
-        return c.json({ error: "Unknown app" }, 404);
+        return c.json({ error: inLang(c, "Diese App gibt es nicht.", "Unknown app."), code: "not_found" }, 404);
     }
     // Not done is an answer too: the app's file is no plain JSON, here is what to paste.
     return c.json(done.outcome);
@@ -1241,7 +1250,10 @@ export const studio = new Hono()
     .get("/models", async (c) => c.json(await modelSettings(requestLang(c))))
     .put("/models", async (c) => {
     if (!mayChangeModels(c.get("user"))) {
-        return c.json({ error: "Only an admin of the team changes its models." }, 403);
+        return c.json({
+            error: inLang(c, "Nur Admins des Teams ändern seine Modelle.", "Only team admins can change its models."),
+            code: "forbidden",
+        }, 403);
     }
     const input = modelsInput.parse(await c.req.json());
     // In the cloud nothing runs on a machine's client or local model.
@@ -1249,7 +1261,10 @@ export const studio = new Hono()
         (input.source ||
             input.ollamaUrl ||
             Object.values(input.bindings ?? {}).some((ref) => ref && !cloudBinding(ref)))) {
-        return c.json({ error: "Not available in the cloud." }, 400);
+        return c.json({
+            error: inLang(c, "Das gibt es nicht in der Cloud.", "This isn’t available in the cloud."),
+            code: "not_local",
+        }, 400);
     }
     // Own keys and bindings to a provider's model are a feature of the team's plan.
     if (managed) {
@@ -1258,7 +1273,7 @@ export const studio = new Hono()
             Object.values(input.bindings ?? {}).some((ref) => ref && !isCreditsRef(ref));
         if (own && info && !feature("ownKeys", info.features)) {
             return c.json({
-                error: inLang(c, `Eigene API Keys gibt es nicht im Paket ${info.plan?.name ?? "des Teams"}.`, `Own API keys are not part of the ${info.plan?.name ?? "team's"} plan.`),
+                error: inLang(c, `Eigene API-Keys gibt es nicht im Paket ${info.plan?.name ?? "des Teams"}.`, `Your own API keys aren’t part of the ${info.plan?.name ?? "team’s"} plan.`),
                 code: "plan",
             }, 403);
         }
@@ -1274,7 +1289,10 @@ export const studio = new Hono()
         .parse(await c.req.json().catch(() => ({})));
     const value = key?.trim() || (await storedKey(provider));
     if (!value) {
-        return c.json({ ok: false, message: "Kein API Key hinterlegt." });
+        return c.json({
+            ok: false,
+            message: inLang(c, "Kein API-Key hinterlegt.", "No API key is set."),
+        });
     }
     return c.json(await checkKey(provider, value, requestLang(c)));
 })
@@ -1282,7 +1300,10 @@ export const studio = new Hono()
     // clip comes back to look at, a voice note comes back as text. Paid like any call.
     .post("/models/test", async (c) => {
     if (!mayChangeModels(c.get("user"))) {
-        return c.json({ error: "Only an admin of the team tests its models." }, 403);
+        return c.json({
+            error: inLang(c, "Nur Admins des Teams testen seine Modelle.", "Only team admins can test its models."),
+            code: "forbidden",
+        }, 403);
     }
     const { cls, lang } = z
         .object({ cls: z.enum(MODEL_CLASSES), lang: z.enum(["de", "en"]).default("en") })
@@ -1439,7 +1460,10 @@ export const studio = new Hono()
     // --- the first visit of a cloud studio: who the team is, its website, first documents -----
     .put("/team", async (c) => {
     if (!managed) {
-        return c.json({ error: "not_managed" }, 404);
+        return c.json({
+            error: inLang(c, "Das gibt es nur in der Cloud.", "This is only available in the cloud."),
+            code: "not_managed",
+        }, 404);
     }
     await requireAdmin();
     const { name } = z.object({ name: z.string().trim().min(1).max(80) }).parse(await c.req.json());
@@ -1448,7 +1472,10 @@ export const studio = new Hono()
 })
     .post("/onboarding/done", async (c) => {
     if (!managed) {
-        return c.json({ error: "not_managed" }, 404);
+        return c.json({
+            error: inLang(c, "Das gibt es nur in der Cloud.", "This is only available in the cloud."),
+            code: "not_managed",
+        }, 404);
     }
     await finishOnboarding(c.get("user").tenantId);
     return c.json({ ok: true });
@@ -1462,7 +1489,10 @@ export const studio = new Hono()
     // The install command and the first steps, mailed to the signed-in person by the Manage-App.
     .post("/install-mail", async (c) => {
     if (!managed) {
-        return c.json({ error: "not_managed" }, 404);
+        return c.json({
+            error: inLang(c, "Das gibt es nur in der Cloud.", "This is only available in the cloud."),
+            code: "not_managed",
+        }, 404);
     }
     const { lang } = z
         .object({ lang: z.enum(["de", "en"]).default("en") })

package/apps/runtime/dist/services/access.js

@@ -31,7 +31,7 @@ export function currentRole() {
     return actor.getStore() ?? "owner";
 }
 export const isAdminRole = (role) => role === "owner" || role === "admin";
-export const MEMBERS_EDIT_ONLY = bilingual("Das dürfen nur Admins des Teams. Als Mitglied bearbeitest du die Wizards, die es gibt.", "Only the team's admins may do that. As a member you edit the wizards that are there.");
+export const MEMBERS_EDIT_ONLY = bilingual("Das dürfen nur Admins des Teams. Als Mitglied bearbeitest du die Wizards, die es schon gibt.", "Only team admins can do that. As a member, you can edit the wizards that already exist.");
 /** Refuses a member: making and deleting is for the owner and the admins of the team. */
 export async function requireAdmin() {
     if (syncing() || !managed || isAdminRole(currentRole())) {
@@ -52,8 +52,8 @@ export async function mayBuild() {
     // An older Manage-App does not say: then it builds. One that cannot be reached: nothing changes.
     return info ? info.limits.build !== false : false;
 }
-export const READ_ONLY_PROJECT = bilingual("Dieses Projekt kommt aus einer lokalen Installation und wird dort geändert.", "This project comes from a local install and is changed there.");
-export const READ_ONLY_TENANT = bilingual("Hier wird nichts gebaut: Auf diesem Server laufen die Wizards, die deine lokale Installation veröffentlicht.", "Nothing is built here: this server runs the wizards your local install publishes.");
+export const READ_ONLY_PROJECT = bilingual("Diesen Space bearbeitest du in engenty wizards auf deinem Computer, nicht hier.", "You edit this space in engenty wizards on your computer, not here.");
+export const READ_ONLY_TENANT = bilingual("Hier laufen die Wizards, die du in engenty wizards auf deinem Computer veröffentlichst. Gebaut und bearbeitet wird dort.", "Wizards run here once you publish them in engenty wizards on your computer. You build and edit them there.");
 /** Refuses when the tenant builds nothing here. */
 export async function requireBuild() {
     if (syncing() || (await mayBuild())) {

package/apps/runtime/dist/services/assistant-chats.js

@@ -253,7 +253,7 @@ export async function readChat(user, chatId) {
         where: and(mine(user), eq(schema.assistantChat.id, chatId)),
     });
     if (!chat) {
-        throw new ServiceError("not_found", bilingual("Diesen Chat gibt es nicht.", "There is no such chat."));
+        throw new ServiceError("not_found", bilingual("Diesen Chat gibt es nicht.", "This chat doesn’t exist."));
     }
     return {
         id: chat.id,

package/apps/runtime/dist/services/brand.js

@@ -66,14 +66,14 @@ export async function describeGradient(brand, text, current) {
         answer = result.output;
     }
     catch {
-        throw new ServiceError("invalid", bilingual("Daraus ließ sich kein Verlauf machen. Beschreib ihn bitte anders.", "No gradient could be made from that. Please describe it differently."));
+        throw new ServiceError("invalid", bilingual("Daraus ließ sich kein Verlauf machen. Beschreib ihn anders.", "Couldn’t make a gradient from that. Try describing it differently."));
     }
     const stops = answer.stops
         .filter((s) => HEX.test(s.color))
         .slice(0, 12)
         .map((s) => ({ color: s.color.toLowerCase(), at: Math.min(100, Math.max(0, s.at)) }));
     if (stops.length < 2) {
-        throw new ServiceError("invalid", bilingual("Daraus ließ sich kein Verlauf machen. Beschreib ihn bitte anders.", "No gradient could be made from that. Please describe it differently."));
+        throw new ServiceError("invalid", bilingual("Daraus ließ sich kein Verlauf machen. Beschreib ihn anders.", "Couldn’t make a gradient from that. Try describing it differently."));
     }
     return {
         name: answer.name.trim().slice(0, 80),