@k2b/cloud 0.12.0 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -32,6 +32,7 @@
     "./browser/app-approval": "./src/browser/app-approval.ts",
     "./browser/live": "./src/browser/live-websocket.ts",
     "./browser/mermaid": "./src/browser/mermaid.ts",
+    "./browser/reload": "./src/browser/reload.ts",
     "./browser/notifications": "./src/browser/notifications.ts",
     "./browser/resource-clipboard": "./src/browser/resource-clipboard.ts",
     "./browser/commands": "./src/browser/commands.ts",
@@ -98,8 +99,8 @@
     "@tailwindcss/typography": "0.5.20",
     "@k2b/nessi": "0.12.1",
     "@k2b/ssr": "0.14.0",
-    "@k2b/ui": "0.5.1",
-    "@k2b/stdlib": "0.25.0",
+    "@k2b/ui": "0.6.1",
+    "@k2b/stdlib": "0.26.0",
     "@k2b/sync": "6.5.0",
     "@nats-io/transport-node": "3.4.0",
     "@modelcontextprotocol/sdk": "1.30.0",

package/src/access/PermissionEditor.tsx

@@ -3,6 +3,7 @@ import { IconButton, Placeholder, prompts, SelectChip, Tooltip, useLocale } from
 import { createSignal, For, Show } from "solid-js";
 import { CloudAvatar } from "../account/Avatar";
 import type { AccessEntry, PermissionLevel, Principal } from "../contracts/shared";
+import { groupDisplayName } from "../shared/account-display";
 import { accessMessages } from "./messages";
 import PrincipalPicker from "./PrincipalPicker";
 
@@ -112,8 +113,8 @@ const resolveEntryDisplay = (
   return defaults[permission] ?? defaults.none;
 };
 
-const getEntryDisplayName = (entry: AccessEntry, t: ReturnType<typeof accessMessages.resolve>["t"]): string => {
-  if (entry.displayName) return entry.displayName;
+const getEntryDisplayName = (entry: AccessEntry, t: ReturnType<typeof accessMessages.resolve>["t"], locale: string): string => {
+  if (entry.displayName) return entry.principal.type === "group" ? groupDisplayName(entry.displayName, locale) : entry.displayName;
   if (entry.principal.type === "authenticated") return t.allUsers;
   if (entry.principal.type === "public") return t.public;
   if (entry.principal.type === "user") return entry.principal.userId;
@@ -184,7 +185,7 @@ export default function PermissionEditor(props: PermissionEditorProps) {
 
   const revokeMut = mutation.create<string | null, AccessEntry>({
     mutation: async (entry) => {
-      const displayName = getEntryDisplayName(entry, t());
+      const displayName = getEntryDisplayName(entry, t(), locale());
       const confirmed = await prompts.confirm(t().removeAccessConfirm({ name: displayName }), {
         title: t().removeAccess,
         variant: "danger",
@@ -263,7 +264,7 @@ function AccessEntryRow(props: {
 }) {
   const locale = useLocale();
   const t = () => accessMessages.resolve([locale()]).t;
-  const displayName = () => getEntryDisplayName(props.entry, t());
+  const displayName = () => getEntryDisplayName(props.entry, t(), locale());
   const display = () => resolveEntryDisplay(props.entry.permission, props.allowed, t());
   const isInteractive = () =>
     props.canEdit && !props.disabled && !props.singlePicker && props.allowed.some((option) => option.level === props.entry.permission);

package/src/access/PrincipalPicker.tsx

@@ -1,5 +1,6 @@
 import { Combobox, type ComboboxOption, useLocale } from "@k2b/ui";
 import type { Principal } from "../contracts/shared";
+import { groupDisplayName } from "../shared/account-display";
 import { accessMessages } from "./messages";
 
 export const principalKey = (p: Principal) =>
@@ -66,7 +67,7 @@ export default function PrincipalPicker(props: {
         else if (e.kind === "group")
           entries.push({
             principal: { type: "group", groupId: e.group.id },
-            label: e.group.name,
+            label: groupDisplayName(e.group.name, locale()),
             icon: "ti ti-users-group",
             description: e.group.description ?? undefined,
           });

package/src/account/EntitySearch.tsx

@@ -1,7 +1,8 @@
 import { timed } from "@k2b/stdlib/solid";
-import { Button, ScrollArea, TextInput } from "@k2b/ui";
+import { Button, ScrollArea, TextInput, useLocale } from "@k2b/ui";
 import type { JSX } from "solid-js";
 import { createSignal, For, Show } from "solid-js";
+import { groupDisplayName } from "../shared/account-display";
 import { CloudAvatar } from "./Avatar";
 
 /**
@@ -108,6 +109,7 @@ type ApiServiceAccount = {
 };
 
 const EntitySearch = (props: EntitySearchProps) => {
+  const locale = useLocale();
   const [search, setSearch] = createSignal("");
   const [users, setUsers] = createSignal<ApiUser[]>([]);
   const [groups, setGroups] = createSignal<ApiGroup[]>([]);
@@ -270,7 +272,7 @@ const EntitySearch = (props: EntitySearchProps) => {
               {(group) => (
                 <ResultRow
                   icon="ti-users-group"
-                  title={group.name}
+                  title={groupDisplayName(group.name, locale())}
                   subtitle={group.description ?? undefined}
                   disabled={props.disabled}
                   onSelect={() =>
@@ -339,7 +341,7 @@ const ResultRow = (props: {
   disabled?: boolean;
   onSelect: () => void;
 }) => (
-  <Button onClick={props.onSelect} disabled={props.disabled} variant="ghost" class="w-full justify-start gap-3 text-left">
+  <Button onClick={props.onSelect} disabled={props.disabled} variant="ghost" align="start" class="w-full">
     <Show
       when={props.avatar}
       fallback={

package/src/ai/code-mode-skill.ts

@@ -4,7 +4,7 @@ import type { AiSkillTemplate } from "./skills";
 
 export const ASSISTANT_CODE_MODE_SKILL = {
   "key": "assistant:code-mode",
-  "version": 51,
+  "version": 52,
   "name": "assistant-code-mode",
   "description": "Inspect and transform unfamiliar data, analyze files, compare results across Cloud apps, or build and improve interactive and agent-only Apps in Assistant Studio. Use for quick code experiments, data analysis, file generation, resource SQL queries and combining discovered Cloud capabilities. For plain arithmetic or date offsets, answer directly or use calculate.",
   "instructions": "# Assistant code mode\n\nChoose the smallest useful result: one-off answer, exported file, or reusable\nStudio App. Apps may expose agent actions, a display-only dashboard, or both.\nPersistence is optional. One-off scripts stay in their chat and cannot be shared. Reuse an\nexisting Cloud feature when it fits. For a\nquick reading of an uploaded PDF or Office document, `read_file` can return\nMarkdown; use code for exact cells, calculations, original PDF text or positions.\n\n## Start from the contract\n\nLoad the needed `code_*` tools individually through `load_tools` and read their\ninput schemas. They are Assistant tools, not capabilities or functions inside\ncode. Discover other Cloud operations before using `capabilities.run`.\n\nRuntime namespaces are globals: no imports or package installation are needed.\nOnly relative imports of the resource's own source files are supported. There is\nno DOM or native network access. Before using a namespace, read its reference\nbelow for signatures, options and return values. Do not invent methods or infer\nan API from a familiar library. For discovered Cloud capabilities and external\nAPIs, obtain their actual contracts separately.\n\nInspect supplied data before joining, filtering or calculating: column names,\ntypes, units, date ranges and missing values. Ask only for decisions or inputs\nthat cannot be established from available evidence. For several real steps,\nkeep a short `todo_write` plan and update it as work changes; skip ceremony for a\nsmall experiment. A failed experiment should change the next hypothesis.\n\n## First file script\n\nPass exact current-chat manifest paths as `code_run.inputPaths`, and this entry\nas `code_run.code` for a small CSV:\n\n```js\nexport default async () => {\n  const [input] = await files.list();\n  if (!input) throw new Error(\"Select a CSV input.\");\n  const rows = await sheet.fromCsv(await files.read(input.name));\n  return { rows: rows.length, columns: Object.keys(rows[0] ?? {}), sample: rows.slice(0, 3) };\n};\n```\n\n`input.name` is the full path, such as `/sales.csv`; pass it unchanged to\n`files.read`, which returns a `File`. CSV rows are objects keyed by headers:\n`rows[0]` is already data. Do not drop it. For older Excel CSVs, use\n`sheet.fromCsv(file, {encoding:\"windows-1252\"})`. Inspect actual headings first.\nFor a tiny experiment without files, `export default () => ({answer:42})` suffices.\nEach run has fresh variables. No saved resource or UI is required.\n\n## Reference routing\n\nRead only the rows relevant to the task. Each link describes its own complete\nsupported surface; links within references add related workflows when needed.\n\n| Task / API | Read |\n| --- | --- |\n| Source entry, input/output files, pickers, CSV, IDs | [Runtime and files](/skills/assistant-code-mode/references/runtime.md) |\n| Inspect PDF pages, read PDF text/positions or XLSX/ODS cells, write ODS | [Documents](/skills/assistant-code-mode/references/documents.md) |\n| Generate a PDF, embed attachments, combine invoice HTML and XML | [PDF generation](/skills/assistant-code-mode/references/pdf.md) |\n| Exact amounts, taxes, allocation, localized money | [Money](/skills/assistant-code-mode/references/money.md) |\n| Export DATEV bookings or SEPA transfers | [DATEV and SEPA](/skills/assistant-code-mode/references/finance.md) |\n| Parse a CAMT bank report | [Bank reports](/skills/assistant-code-mode/references/camt.md) |\n| Calculate, create or read electronic invoices/XML/PDF attachments | [Electronic invoices](/skills/assistant-code-mode/references/einvoice.md) |\n| Controls, layouts and dialogs | [UI and dialogs](/skills/assistant-code-mode/references/ui.md), [Analytics UI](/skills/assistant-code-mode/references/analytics.md) |\n| Chart types, series and axes | [Charts](/skills/assistant-code-mode/references/charts.md) |\n| Long processing, progress, cancellation | [Background work](/skills/assistant-code-mode/references/work.md) |\n| Persist JSON or files locally/shared | [Storage](/skills/assistant-code-mode/references/storage.md) |\n| Copy files between stores; list and download Filesv2 beside Grids documents | [File transfers](/skills/assistant-code-mode/references/files.md) |\n| Resource SQL, schema, row CRUD, imports | [Database](/skills/assistant-code-mode/references/database.md) |\n| Generate text, classify data or extract structured fields | [AI calculations](/skills/assistant-code-mode/references/ai.md) |\n| Discovered Cloud queries/actions | [Capability calls](/skills/assistant-code-mode/references/capabilities.md) |\n| External HTTPS and personal secrets | [HTTP and secrets](/skills/assistant-code-mode/references/http.md) |\n| Call a published App action; declare handlers | [App actions](/skills/assistant-code-mode/references/app-actions.md) |\n| Reuse work across chats, create or edit an App | [Source workflow](/skills/assistant-code-mode/references/source-workflow.md) |\n| Publish, restore, copy | [Publishing](/skills/assistant-code-mode/references/publishing.md) |\n| Find recipients or change App/Skill sharing | [Access](/skills/assistant-code-mode/references/access.md) |\n| Inspect, export, clear server data, or delete an App | [Management](/skills/assistant-code-mode/references/management.md) |\n| Execute, inspect, interact, export, stop, diagnose errors | [Run and debug](/skills/assistant-code-mode/references/debugging.md) |\n| Unfamiliar inputs or cross-app investigation | [Investigation](/skills/assistant-code-mode/references/investigation.md) |\n| Complete app starters | [Examples](/skills/assistant-code-mode/references/examples.md) |\n\nFor a new app, read Source workflow and the closest complete example before\nwriting source, plus only the API references it uses. For analytical reports or\ndashboards, also load `assistant-data-analysis` for metrics and source validation.\n\n## Choose the delivery\n\nFor a one-off chart, calculator, or interactive analysis in this conversation,\nuse `code_run({code,inputPaths})`, test the controls, then\n`code_present({runId,title})`. Read [Chat visualizations](/skills/assistant-code-mode/references/chat.md).\nA successful run is visible to the agent only; present it before saying the\nuser can see it. No saved App or chat file is necessary.\n\nUse a Studio App when the user needs an independently accessible, reusable\napplication. Use `files.save`, `code_export`, and `present` when the requested\nresult is a file. These are separate delivery choices.\n\n## Verify and deliver\n\nRun the actual source (the saved revision for Apps) and test relevant controls with IDs returned by\n`code_run`/`code_interact`, including invalid inputs and picker fixtures. Creating,\ncompiling or saving source does not verify behavior. If `work.status` is\n`running`, wait with `code_inspect({runId,waitMs:30000})`; do not restart the job.\nInspect only when the returned snapshot needs more detail. Errors and\n`outputTruncated` are not successful complete results.\n\nFor a CSV, call `await files.save(sheet.toCsv(rows), \"result.csv\")` inside code;\nfor a spreadsheet, `await files.save(await sheet.toOds(sheets), \"result.ods\")`.\nThen call the **tool** `code_export` with the returned `runId` and captured file\nname, and `present` its returned chat path. `files.save` returns no path.\nReuse exported data via its path/version rather than retyping truncated output.\nReconcile row counts, exclusions and totals before reporting findings.\n\nOpen GUI apps with `code_open`. Saving or testing does\nnot replace a user's already-running app. Stop runs no longer needed that retain\nUI, jobs or output files. Never claim an unexecuted result is verified.\n\nAgent execution runs independently of the user's tab. Agent local storage is\ntemporary; shared storage, database writes and external actions are real, even\nin tests. Cancellation and source restore do not undo them. Apps select local\nfiles explicitly; they never gain implicit access to chat attachments. Use\n`code_secret` for credentials, never chat or app controls. Honor normal access\nand approval decisions; availability is not authorization for unrelated actions.",
@@ -56,7 +56,7 @@ export const ASSISTANT_CODE_MODE_SKILL = {
     },
     {
       "path": "references/einvoice.md",
-      "content": "# Electronic invoices\n\n`einvoice` is a global. These methods return Results: inspect `ok`, then use\n`data` or `error: {code,status,message,issues}`. Issue entries contain\n`{code,path,message,line?,column?}`; paths have zero-based row indices.\n\n| Call | Successful `data` |\n| --- | --- |\n| `einvoice.validate(input)` | `Invoice` |\n| `einvoice.calculate(lines)` | `InvoiceCalculation` |\n| `einvoice.serialize(invoice, {format: \"zugferd-2.5-en16931\"})` | `{format, xml: string, bytes: Uint8Array}` |\n| `einvoice.parseXml(xml, options?)` | `ParsedInvoice` |\n| `await einvoice.parsePdf(bytes, options?)` | `ParsedInvoice` |\n\nAll calls except `parsePdf` are synchronous. `parsePdf` takes a `Uint8Array`,\nfor example `new Uint8Array(await file.arrayBuffer())`. It reads embedded XML,\nnot scanned pages or arbitrary visual invoice layouts. For those, use the\n[local PDF text reader](documents.md) or the agent's document/vision tools.\n\nThe supported slice covers EUR CII EN16931 invoices, credit notes and self-billing,\ncategory S VAT, units C62/HUR/DAY/KGM. It does not support UBL, XRechnung,\ndiscounts, prepayments or exemptions. Readers preserve declared totals;\nparsing is not arithmetic verification. Validation is not XSD or Schematron\ncertification. No XSD validator is exposed.\n\n## Complete input and result shapes\n\nType descriptions only; no imports are needed. All fields are required unless\nmarked `?`; unknown fields are rejected.\n\n```ts\ntype Party = {\n  name: string; vatId: string;\n  address: {line1: string; city: string; postalCode: string; countryCode: string};\n};\ntype InvoiceLine = {\n  id: string; name: string; description?: string;\n  quantity: string; unitPrice: string; unitCode: \"C62\" | \"HUR\" | \"DAY\" | \"KGM\";\n  taxRate: string; netAmount?: string;\n};\ntype InvoiceTotals = {\n  netAmount: string; taxAmount: string; grossAmount: string; dueAmount: string;\n  taxGroups: {taxRate: string; netAmount: string; taxAmount: string}[];\n};\ntype Invoice = {\n  kind: \"invoice\" | \"creditNote\" | \"selfBilling\";\n  number: string; invoiceDate: string; serviceDate: string; dueDate: string;\n  currency: \"EUR\"; seller: Party; buyer: Party; buyerReference: string;\n  notes?: string[];\n  precedingInvoice?: {number: string; invoiceDate: string};\n  payment: {iban: string; accountName: string};\n  lines: InvoiceLine[]; totals?: InvoiceTotals;\n};\ntype InvoiceCalculation = InvoiceTotals & {\n  lines: (InvoiceLine & {netAmount: string})[];\n};\ntype ParsedInvoice = {\n  format: \"zugferd-2.5-en16931\"; profile: string; xml: string;\n  invoice: Invoice; filename?: string;\n};\ntype ParseOptions = {maxCharacters?: number; maxElements?: number; maxDepth?: number};\ntype PdfOptions = ParseOptions & {maxPdfBytes?: number};\n```\n\nXML options default to 10 Mi UTF-16 code units, 100,000 elements, depth 64.\nPDF input defaults to 25 MiB. Overrides must be positive safe integers.\nA parser result's business fields are under **`data.invoice`**. Calculated\namounts are directly under **`data.netAmount`**, etc., with no `data.totals` wrapper.\n\n- Dates are real `YYYY-MM-DD` dates; `dueDate` cannot precede `invoiceDate`.\n  Credit notes require `precedingInvoice`, whose date cannot be later than the\n  credit note; other kinds cannot supply it. Credit-note amounts stay unsigned.\n- Lines: 1–1000, unique IDs. Quantities are positive, prices nonnegative,\n  VAT rates greater than 0 and at most 100. Decimal strings allow up to four\n  fractional digits and no leading zeros. Totals/net amounts require exactly\n  two fractional digits; do not convert through JavaScript Number.\n- Country codes: two uppercase letters. `payment.iban` must be valid.\n  Required text is nonblank valid XML text. Limits: number/reference/line ID/VAT ID\n  100; names/address line/accountName 200; city 100; postalCode 20;\n  line description and each note 4000; at most 100 notes.\n- `calculate` rounds each line half up to cents, then VAT per rate. It recalculates\n  line `netAmount`; `serialize` also rejects supplied line/totals values that\n  disagree. Render these calculated amounts in HTML instead of another arithmetic path.\n\n## Minimal supported invoice\n\nUse real business data and an app-owned invoice number. This illustrative\nfixture demonstrates the required fields; it is not a document to issue.\n\n```js\nconst invoice = {\n  kind: \"invoice\",\n  number: \"EXAMPLE-42\",\n  invoiceDate: \"2026-09-15\",\n  serviceDate: \"2026-09-15\",\n  dueDate: \"2026-09-30\",\n  currency: \"EUR\",\n  seller: {\n    name: \"Example Seller\", vatId: \"DE123456789\",\n    address: { line1: \"Street 1\", city: \"Ulm\", postalCode: \"89073\", countryCode: \"DE\" },\n  },\n  buyer: {\n    name: \"Example Buyer\", vatId: \"DE987654321\",\n    address: { line1: \"Street 2\", city: \"Berlin\", postalCode: \"10115\", countryCode: \"DE\" },\n  },\n  buyerReference: \"ORDER-42\",\n  payment: { iban: \"DE89370400440532013000\", accountName: \"Example Seller\" },\n  lines: [{ id: \"1\", name: \"Service\", quantity: \"2.0000\", unitPrice: \"50.0000\", unitCode: \"HUR\", taxRate: \"19.00\" }],\n};\nconst result = einvoice.serialize(invoice, { format: \"zugferd-2.5-en16931\" });\nif (!result.ok) throw new Error(JSON.stringify(result.error));\nawait files.save(new Blob([result.data.bytes], { type: \"application/xml\" }), \"invoice.xml\");\n```\n\nNever infer a missing VAT identifier, account or business reference merely to\nsatisfy input validation.\n\nFor an invoice PDF, pass `serialized.data.xml` to\n[`pdf.facturX`](pdf.md) with profile `\"EN 16931\"` and matching HTML.\nNumbering, business mapping, issuance and persistence belong to the app.\n"
+      "content": "# Electronic invoices\n\n`einvoice` is a global. These methods return Results: inspect `ok`, then use\n`data` or `error: {code,status,message,issues}`. Issue entries contain\n`{code,path,message,line?,column?}`; paths have zero-based row indices.\n\n| Call | Successful `data` |\n| --- | --- |\n| `einvoice.validate(input)` | `Invoice` |\n| `einvoice.calculate(lines)` | `InvoiceCalculation` |\n| `einvoice.serialize(invoice, {format: \"zugferd-2.5-en16931\"})` | `{format, xml: string, bytes: Uint8Array}` |\n| `einvoice.parseXml(xml, options?)` | `ParsedInvoice` |\n| `await einvoice.parsePdf(bytes, options?)` | `ParsedInvoice` |\n| `einvoice.parseXml(xml, {mode: \"incoming\"})` | `ParsedIncomingInvoice` |\n| `await einvoice.parsePdf(bytes, {mode: \"incoming\"})` | `ParsedIncomingInvoice` |\n\nAll calls except `parsePdf` are synchronous. `parsePdf` takes a `Uint8Array`,\nfor example `new Uint8Array(await file.arrayBuffer())`. It reads embedded XML,\nnot scanned pages or arbitrary visual invoice layouts. For those, use the\n[local PDF text reader](documents.md) or the agent's document/vision tools.\n\nThe supported slice covers EUR CII EN16931 invoices, credit notes and self-billing,\nVAT categories S/Z/E/AE/K/G/O, units C62/HUR/DAY/KGM. Generation does not\nsupport UBL, XRechnung, discounts or prepayments. Readers preserve declared totals;\nparsing is not arithmetic verification. Validation is not XSD or Schematron\ncertification. No XSD validator is exposed.\n\n## Complete input and result shapes\n\nType descriptions only; no imports are needed. All fields are required unless\nmarked `?`; unknown fields are rejected.\n\n```ts\ntype Party = {\n  name: string; id?: string; vatId: string; // \"\" when the party has no VAT ID\n  address: {line1: string; city: string; postalCode: string; countryCode: string};\n};\ntype Tax = {\n  taxCategory?: \"S\" | \"Z\" | \"E\" | \"AE\" | \"K\" | \"G\" | \"O\"; // default \"S\"\n  taxRate: string; taxExemptionReason?: string; taxExemptionReasonCode?: string;\n};\ntype InvoiceLine = Tax & {\n  id: string; name: string; description?: string;\n  quantity: string; unitPrice: string; unitCode: \"C62\" | \"HUR\" | \"DAY\" | \"KGM\";\n  netAmount?: string;\n};\ntype InvoiceTotals = {\n  netAmount: string; taxAmount: string; grossAmount: string; dueAmount: string;\n  taxGroups: (Tax & {netAmount: string; taxAmount: string})[];\n};\ntype Invoice = {\n  kind: \"invoice\" | \"creditNote\" | \"selfBilling\";\n  number: string; invoiceDate: string; serviceDate: string; dueDate: string;\n  currency: \"EUR\"; seller: Party & {taxRegistrationId?: string}; buyer: Party;\n  deliverToCountryCode?: string; buyerReference: string;\n  notes?: string[];\n  precedingInvoice?: {number: string; invoiceDate: string};\n  payment: {iban: string; accountName: string};\n  lines: InvoiceLine[]; totals?: InvoiceTotals;\n};\ntype InvoiceCalculation = InvoiceTotals & {\n  lines: (InvoiceLine & {netAmount: string})[];\n};\ntype ParsedInvoice = {\n  format: \"zugferd-2.5-en16931\"; profile: string; xml: string;\n  invoice: Invoice; filename?: string;\n};\ntype ParseOptions = {maxCharacters?: number; maxElements?: number; maxDepth?: number};\ntype PdfOptions = ParseOptions & {maxPdfBytes?: number};\n```\n\nXML options default to 10 Mi UTF-16 code units, 100,000 elements, depth 64.\nPDF input defaults to 25 MiB. Overrides must be positive safe integers.\nA parser result's business fields are under **`data.invoice`**. Calculated\namounts are directly under **`data.netAmount`**, etc., with no `data.totals` wrapper.\n\n- Dates are real `YYYY-MM-DD` dates; `dueDate` cannot precede `invoiceDate`.\n  Credit notes require `precedingInvoice`, whose date cannot be later than the\n  credit note; other kinds cannot supply it. Credit-note amounts stay unsigned.\n- Lines: 1–1000, unique IDs. Quantities are positive, prices nonnegative,\n  VAT rates at most 100. Decimal strings allow up to four\n  fractional digits and no leading zeros. Totals/net amounts require exactly\n  two fractional digits; do not convert through JavaScript Number.\n- Country codes: two uppercase letters. `payment.iban` must be valid.\n  Required text is nonblank valid XML text. Limits: number/reference/line ID/VAT ID\n  100; names/address line/accountName 200; city 100; postalCode 20;\n  line description and each note 4000; at most 100 notes.\n- Category S needs a positive rate; every other category uses `taxRate: \"0\"`\n  and zero tax. E/AE/K/G/O need `taxExemptionReason` or a VATEX\n  `taxExemptionReasonCode`; S/Z forbid both. O cannot be mixed with other\n  categories and requires `vatId: \"\"` for both parties. A seller without a VAT\n  ID needs `seller.id` and, outside O, `seller.taxRegistrationId`. AE/K need a\n  buyer VAT ID, K/G a seller VAT ID, and K `deliverToCountryCode`.\n- `calculate` rounds each line half up to cents, then VAT per category and rate. It recalculates\n  line `netAmount`; `serialize` also rejects supplied line/totals values that\n  disagree. Render these calculated amounts in HTML instead of another arithmetic path.\n\n## Minimal supported invoice\n\nUse real business data and an app-owned invoice number. This illustrative\nfixture demonstrates the required fields; it is not a document to issue.\n\n```js\nconst invoice = {\n  kind: \"invoice\",\n  number: \"EXAMPLE-42\",\n  invoiceDate: \"2026-09-15\",\n  serviceDate: \"2026-09-15\",\n  dueDate: \"2026-09-30\",\n  currency: \"EUR\",\n  seller: {\n    name: \"Example Seller\", vatId: \"DE123456789\",\n    address: { line1: \"Street 1\", city: \"Ulm\", postalCode: \"89073\", countryCode: \"DE\" },\n  },\n  buyer: {\n    name: \"Example Buyer\", vatId: \"DE987654321\",\n    address: { line1: \"Street 2\", city: \"Berlin\", postalCode: \"10115\", countryCode: \"DE\" },\n  },\n  buyerReference: \"ORDER-42\",\n  payment: { iban: \"DE89370400440532013000\", accountName: \"Example Seller\" },\n  lines: [{ id: \"1\", name: \"Service\", quantity: \"2.0000\", unitPrice: \"50.0000\", unitCode: \"HUR\", taxRate: \"19.00\" }],\n};\nconst result = einvoice.serialize(invoice, { format: \"zugferd-2.5-en16931\" });\nif (!result.ok) throw new Error(JSON.stringify(result.error));\nawait files.save(new Blob([result.data.bytes], { type: \"application/xml\" }), \"invoice.xml\");\n```\n\nNever infer a missing VAT identifier, tax category, exemption reason, account\nor business reference merely to satisfy input validation.\n\n## Reading received invoices\n\n`{mode: \"incoming\"}` (plus the same limits) reads a broader separate model:\nalso XRechnung 3.0/2.3 CII, other currencies, discounts, prepayments, all\npayment means and optional references. `data` is\n`{format: \"cii-en16931\", profile, xml, invoice, unmapped, filename?}`.\nAmounts are declared strings, never recalculated; O lines have no `taxRate`.\n`unmapped` lists supplementary XML elements and attributes with their paths; review it before\naccounting. Do not pass this `invoice` to `validate` or `serialize`.\n\nFor an invoice PDF, pass `serialized.data.xml` to\n[`pdf.facturX`](pdf.md) with profile `\"EN 16931\"` and matching HTML.\nNumbering, business mapping, issuance and persistence belong to the app.\n"
     },
     {
       "path": "references/examples.md",

package/src/api/accounts-entities.ts

@@ -41,6 +41,7 @@ const QuerySchema = z
     parent_group_id: z.uuid().optional(),
     managed_by_user_id: z.uuid().optional(),
     recursive: z.enum(["true", "false"]).optional(),
+    include_personal: z.enum(["true", "false"]).optional(),
   })
   .refine(
     (value) => {
@@ -98,7 +99,7 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
       tags: ["Accounts"],
       summary: "List mixed users and groups",
       description:
-        "List visible users and groups with SQL-backed filtering and pagination. Guest accounts see only themselves and their effective groups; relation filters require a full user account.",
+        "List visible users and groups with SQL-backed filtering and pagination. Guest accounts see only themselves and their effective groups; relation filters require a full user account. Personal Linux groups (a user's private primary group, flagged with `personalOwner`) are left out unless `include_personal=true`; exact `group_ids` lookups and relation filters always return them.",
       ...requiresAuth,
       responses: {
         200: jsonResponse(EntitiesListResponseSchema, "Paginated mixed entity list"),
@@ -159,6 +160,7 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
         parentGroupId: query.parent_group_id,
         managedByUserId: query.managed_by_user_id,
         recursive: query.recursive === "true",
+        includePersonal: query.include_personal === "true",
       });
 
       return respond(c, {

package/src/api/app-approval.ts

@@ -113,7 +113,10 @@ export const createAppApprovalRoutes = (service: Service = appApproval) => {
     )
     .post("/login/status", v("json", AppLoginReferenceSchema), async (c) => {
       const input = c.req.valid("json");
-      return c.json(await service.browserStatus(input.requestId, input.browserSecret));
+      // Hold a pending request for one poll interval: the browser learns a decision at once,
+      // keeps its request cadence, and stays below Bun's 10-second idle timeout.
+      const hold = { ms: APP_APPROVAL_LIMITS.pollSeconds * 1000, signal: c.req.raw.signal };
+      return c.json(await service.browserStatus(input.requestId, input.browserSecret, hold));
     })
     .post(
       "/login/complete",

package/src/browser/app-approval.ts

@@ -215,6 +215,12 @@ const connect = async (options: {
         throw new AppApprovalClientError("INVALID_RESPONSE");
       return result;
     },
+    /** Hands this device's push token to the Cloud. Older Clouds answer HTTP 400. */
+    push: async (device: AppApprovalDevice, token: string, signal?: AbortSignal) => {
+      const result = await command(device, { operation: "push", token }, signal);
+      if (!("state" in result) || result.state !== "updated") throw new AppApprovalClientError("INVALID_RESPONSE");
+      return result;
+    },
     revoke: async (device: AppApprovalDevice, signal?: AbortSignal) => {
       const result = await command(device, { operation: "revoke" }, signal);
       if (!("state" in result) || result.state !== "revoked") throw new AppApprovalClientError("INVALID_RESPONSE");

package/src/browser/reload.ts

@@ -0,0 +1,34 @@
+/**
+ * Default window in which a second automatic reload for the same key is
+ * suppressed. A page load, hydration, and the first live subscription finish
+ * within a few seconds, so a condition that fails again right after a reload
+ * lands well inside it; a genuinely new change minutes later still reloads.
+ */
+export const AUTOMATIC_RELOAD_WINDOW_MS = 30_000;
+
+const storageKey = (key: string) => `cloud.reload.${key}`;
+
+/**
+ * Reloads the page for an automatic reason (a live event, a failed live
+ * subscription, a changed view) at most once per `key` and window in this tab.
+ *
+ * Returns `false` without reloading when the same key already reloaded within
+ * the window, or when `sessionStorage` is unavailable and a repeat therefore
+ * cannot be ruled out. The caller then keeps the page usable and offers a
+ * user-initiated reload instead. Reloads after an explicit user action do not
+ * need this guard.
+ */
+export const reloadOnce = (key: string, options: { windowMs?: number } = {}): boolean => {
+  const windowMs = options.windowMs ?? AUTOMATIC_RELOAD_WINDOW_MS;
+  const now = Date.now();
+  try {
+    const storage = window.sessionStorage;
+    const last = Number(storage.getItem(storageKey(key)));
+    if (last > 0 && now >= last && now - last < windowMs) return false;
+    storage.setItem(storageKey(key), String(now));
+  } catch {
+    return false;
+  }
+  window.location.reload();
+  return true;
+};

package/src/contracts/app-approval.ts

@@ -53,6 +53,8 @@ export const AppDeviceMutationSchema = z.discriminatedUnion("operation", [
 export const AppDeviceCommandSchema = z.discriminatedUnion("operation", [
   z.object({ operation: z.literal("pending") }).strict(),
   z.object({ operation: z.literal("revoke") }).strict(),
+  /** Stores the authenticator's opaque push token for sign-in wake-ups on this device. */
+  z.object({ operation: z.literal("push"), token: z.string().regex(/^[A-Za-z0-9_-]{43}$/) }).strict(),
   z
     .object({
       operation: z.literal("decide"),
@@ -91,6 +93,7 @@ export const appDeviceProofMessage = (proof: AppDeviceProof): string => {
     proof.expiresAt,
     c.operation,
     ...(c.operation === "decide" ? [c.requestId, c.challenge, c.comparison, c.decision] : []),
+    ...(c.operation === "push" ? [c.token] : []),
   ]);
 };
 export const appPairingProofMessage = (issuer: string, claim: Omit<z.infer<typeof AppPairingClaimSchema>, "signature">): string =>
@@ -182,7 +185,7 @@ export const AppDeviceResponseSchema = z.union([
       pollAfterSeconds: z.number().positive(),
     })
     .strict(),
-  z.object({ state: z.enum(["approved", "denied", "revoked"]) }).strict(),
+  z.object({ state: z.enum(["approved", "denied", "revoked", "updated"]) }).strict(),
 ]);
 export const AppLoginStartResultSchema = z
   .object({ requestId: Id, browserSecret: Secret, comparison: Comparison, expiresAt: DateTime, pollAfterSeconds: z.number().positive() })

package/src/contracts/shared.ts

@@ -85,12 +85,22 @@ export type LocalUser = z.infer<typeof LocalUserSchema>;
 export const UserSchema = z.discriminatedUnion("provider", [IpaUserSchema, LocalUserSchema]);
 export type User = z.infer<typeof UserSchema>;
 
+/** The user whose personal Linux group (user private group) this is. */
+export const PersonalGroupOwnerSchema = z.object({
+  id: z.uuid(),
+  uid: z.string(),
+  displayName: z.string(),
+});
+export type PersonalGroupOwner = z.infer<typeof PersonalGroupOwnerSchema>;
+
 export const BaseGroupSchema = z.object({
   id: z.uuid(),
   provider: UserProviderSchema,
   name: z.string(),
   description: z.string().nullable(),
   gidnumber: z.number().nullable(),
+  /** Set when the group is a user's personal Linux group; `null` for ordinary groups. */
+  personalOwner: PersonalGroupOwnerSchema.nullable(),
 });
 export type BaseGroup = z.infer<typeof BaseGroupSchema>;
 

package/src/services/accounts/app.ts

@@ -909,7 +909,7 @@ export const accountsAppService = {
   group: {
     list: async (config: {
       pagination?: PageParams;
-      filter?: { search?: string };
+      filter?: { search?: string; includePersonal?: boolean };
       scope?: { userId?: string; ids?: string[]; provider?: UserProvider; mode?: "all" | "member" | "managed" };
     }): Promise<Paginated<BaseGroup>> => {
       const { page, perPage } = paginate(config.pagination);
@@ -921,6 +921,7 @@ export const accountsAppService = {
         scope: config.scope?.mode,
         ids: config.scope?.ids,
         provider: config.scope?.provider,
+        includePersonal: config.filter?.includePersonal,
       });
 
       return {
@@ -1202,6 +1203,7 @@ export const accountsAppService = {
       parentGroupId?: string;
       managedByUserId?: string;
       recursive?: boolean;
+      includePersonal?: boolean;
     }): Promise<Paginated<EntityListItem>> => {
       const canSearchDirectory = config.actor.roles.includes("user");
       const usesRelationFilter = Boolean(
@@ -1232,6 +1234,7 @@ export const accountsAppService = {
         parentGroupId: config.parentGroupId,
         managedByUserId: config.managedByUserId,
         recursive: config.recursive,
+        includePersonal: config.includePersonal,
         page,
         perPage,
       });

package/src/services/accounts/base-group.ts

@@ -1,11 +1,40 @@
+import { sql } from "bun";
 import type { BaseGroup, UserProvider } from "../../contracts/shared";
 
 type DbRow = Record<string, unknown>;
 
+/**
+ * Joins the owner of a personal Linux group (the group stored as a user's
+ * `auth.user_posix.primary_group_id`) onto `auth.groups g` as
+ * `personal_owner_id`, `personal_owner_uid`, and `personal_owner_display_name`.
+ * A function, so importing this module never binds Bun's default `sql` handle.
+ */
+export const personalOwnerJoin = () => sql`
+  LEFT JOIN LATERAL (
+    SELECT
+      owner.id AS personal_owner_id,
+      owner.uid AS personal_owner_uid,
+      COALESCE(NULLIF(owner.display_name, ''), NULLIF(owner.mail, ''), owner.uid) AS personal_owner_display_name
+    FROM auth.user_posix owner_posix
+    JOIN auth.users owner ON owner.id = owner_posix.user_id
+    WHERE owner_posix.primary_group_id = g.id
+    ORDER BY owner.id
+    LIMIT 1
+  ) personal_owner ON TRUE
+`;
+
 export const buildBaseGroup = (row: DbRow): BaseGroup => ({
   id: row.id as string,
   provider: row.provider as UserProvider,
   name: row.name as string,
   description: (row.description as string | null | undefined) ?? null,
   gidnumber: (row.gid_number as number | null | undefined) ?? null,
+  personalOwner:
+    typeof row.personal_owner_id === "string"
+      ? {
+          id: row.personal_owner_id,
+          uid: String(row.personal_owner_uid),
+          displayName: String(row.personal_owner_display_name),
+        }
+      : null,
 });

package/src/services/accounts/entities.ts

@@ -2,7 +2,7 @@ import { sql } from "bun";
 import type { EntityKind, EntityListItem, UserProfile, UserProvider } from "../../contracts/shared";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { escapeLikePattern, toPgTextArray, toPgUuidArray } from "../postgres";
-import { buildBaseGroup } from "./base-group";
+import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { buildBaseUser } from "./base-user";
 import { buildManagedGroupScopeCondition, recursiveGroupIdsSubquery } from "./group-sql";
 
@@ -26,6 +26,11 @@ export type EntityListParams = {
   parentGroupId?: string;
   managedByUserId?: string;
   recursive?: boolean;
+  /**
+   * Personal Linux groups are left out of directory browsing and search by
+   * default. Exact `groupIds` lookups and relation filters always return them.
+   */
+  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 };
@@ -415,6 +420,11 @@ export const list = async (
   const groupsAdmin = (await getFreeIpaConfig()).groupsAdmin;
   const groupsAdminLiteral = toPgTextArray(groupsAdmin);
   const spec = buildQuerySpec(params);
+  const includePersonal =
+    params.includePersonal === true ||
+    params.groupIds !== undefined ||
+    Boolean(params.memberOfGroupId || params.managerOfGroupId || params.parentGroupId || params.managedByUserId);
+  const personalCondition = includePersonal ? sql`TRUE` : sql`(kind <> 'group' OR personal_owner_id IS NULL)`;
   const visibilityCondition =
     params.visibility.type === "directory"
       ? sql`TRUE`
@@ -465,6 +475,7 @@ export const list = async (
     AND ${excludeGroupCondition}
     AND ${excludeServiceAccountCondition}
     AND ${userMemberOfGroupCondition}
+    AND ${personalCondition}
     AND (
       ${pattern}::text IS NULL
       OR (
@@ -529,6 +540,9 @@ export const list = async (
           NULL::text AS resource_id,
           NULL::uuid AS created_by,
           NULL::timestamptz AS created_at,
+          NULL::uuid AS personal_owner_id,
+          NULL::text AS personal_owner_uid,
+          NULL::text AS personal_owner_display_name,
           LOWER(COALESCE(NULLIF(u.display_name, ''), NULLIF(u.mail, ''), u.uid)) AS sort_label
         ${spec.userFrom}
         WHERE ${spec.userWhere}
@@ -558,8 +572,12 @@ export const list = async (
           NULL::text AS resource_id,
           NULL::uuid AS created_by,
           NULL::timestamptz AS created_at,
+          personal_owner.personal_owner_id,
+          personal_owner.personal_owner_uid,
+          personal_owner.personal_owner_display_name,
           LOWER(g.name) AS sort_label
         ${spec.groupFrom}
+        ${personalOwnerJoin()}
         WHERE ${spec.groupWhere}
       ),
       service_account_rows AS (
@@ -590,6 +608,9 @@ export const list = async (
           sa.resource_id,
           sa.created_by,
           sa.created_at,
+          NULL::uuid AS personal_owner_id,
+          NULL::text AS personal_owner_uid,
+          NULL::text AS personal_owner_display_name,
           LOWER(sa.name) AS sort_label
         FROM auth.service_accounts sa
       ),

package/src/services/accounts/groups.ts

@@ -5,7 +5,7 @@ import { getServiceIpaSession } from "../ipa/service-account";
 import { toPgUuidArray } from "../postgres";
 import { providers } from "../providers";
 import type { AccountsActor } from "./authz";
-import { buildBaseGroup } from "./base-group";
+import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 import { buildManagedGroupScopeCondition, buildMemberGroupScopeCondition } from "./group-sql";
 import * as localGroups from "./local-groups";
 import { posix } from "./posix";
@@ -16,9 +16,10 @@ type GroupListScope = "all" | "member" | "managed";
 
 const getGroup = async (id: string): Promise<BaseGroup | null> => {
   const [row] = await sql<DbRow[]>`
-    SELECT id, provider, name, description, gid_number
-    FROM auth.groups
-    WHERE id = ${id}::uuid
+    SELECT g.id, g.provider, g.name, g.description, g.gid_number, personal_owner.*
+    FROM auth.groups g
+    ${personalOwnerJoin()}
+    WHERE g.id = ${id}::uuid
   `;
   if (!row) return null;
   return buildBaseGroup(row);
@@ -30,6 +31,8 @@ const listCanonical = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
+  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
+  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }): Promise<{
@@ -45,6 +48,7 @@ const listCanonical = async (params: {
   const scope = params.scope ?? (params.userId ? "member" : "all");
   const scopeUserId = params.userId ?? "00000000-0000-0000-0000-000000000000";
   const idsCondition = ids.length === 0 ? sql`TRUE` : sql`g.id = ANY(${toPgUuidArray(ids)}::uuid[])`;
+  const includePersonal = params.includePersonal === true || params.ids !== undefined;
 
   if (params.ids && params.ids.length === 0) {
     return {
@@ -60,10 +64,12 @@ const listCanonical = async (params: {
   }
 
   const rows = await sql<DbRow[]>`
-    SELECT g.id, g.provider, g.name, g.description, g.gid_number, COUNT(*) OVER() AS total
+    SELECT g.id, g.provider, g.name, g.description, g.gid_number, personal_owner.*, COUNT(*) OVER() AS total
     FROM auth.groups g
+    ${personalOwnerJoin()}
     WHERE (${params.provider ?? null}::text IS NULL OR g.provider = ${params.provider ?? null})
       AND ${idsCondition}
+      AND (${includePersonal} = true OR personal_owner.personal_owner_id IS NULL)
       AND (
         ${scope === "all"} = true
         OR ${params.userId ?? null}::uuid IS NULL
@@ -99,6 +105,8 @@ export const list = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
+  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
+  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }) => {

package/src/services/accounts/identities.ts

@@ -16,7 +16,8 @@ export type AccountIdentityUser = {
   profile: UserProfile;
   posix: { uidNumber: number; primaryGidNumber: number } | null;
 };
-export type AccountIdentityGroup = { id: string; provider: UserProvider; name: string; gidNumber: number | null };
+/** `personal` marks a user's personal Linux group (their stored primary group). */
+export type AccountIdentityGroup = { id: string; provider: UserProvider; name: string; gidNumber: number | null; personal: boolean };
 export type AccountIdentityPage<T> = { items: T[]; nextCursor: string | null };
 export type AccountIdentityAvailability = { localLinuxEnabled: boolean; freeipaEnabled: boolean };
 type InventoryFilter = { provider: UserProvider; after?: string; id?: string; name?: string };
@@ -119,8 +120,10 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
     return current;
   };
   const groupRows = async (filter: SQLQuery) => {
-    const rows = await db<{ id: string; provider: UserProvider; name: string; gid_number: number | null }[]>`
-      SELECT g.id, g.provider, g.name, g.gid_number FROM auth.groups g
+    const rows = await db<{ id: string; provider: UserProvider; name: string; gid_number: number | null; personal: boolean }[]>`
+      SELECT g.id, g.provider, g.name, g.gid_number,
+        EXISTS(SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id) AS personal
+      FROM auth.groups g
       WHERE ${filter} ORDER BY g.id LIMIT ${PAGE_SIZE + 1}
     `;
     return rows.map(
@@ -129,6 +132,7 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
         provider: row.provider,
         name: row.name,
         gidNumber: positiveId(row.gid_number) ? row.gid_number : null,
+        personal: row.personal,
       }),
     );
   };

package/src/services/accounts/local-groups.ts

@@ -1,6 +1,7 @@
 import { sql } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
 import { escapeLikePattern, isUniqueViolation } from "../postgres";
+import { buildBaseGroup, personalOwnerJoin } from "./base-group";
 
 type DbRow = Record<string, unknown>;
 
@@ -18,6 +19,7 @@ const toBaseGroup = (row: LocalGroupRow): BaseGroup => ({
   name: row.name,
   description: row.description,
   gidnumber: row.gidNumber,
+  personalOwner: null,
 });
 
 const getLocalGroupById = async (id: string): Promise<LocalGroupRow | null> => {
@@ -73,8 +75,13 @@ const wouldCreateLocalGroupCycle = async (params: { parentGroupId: string; child
 };
 
 export const get = async (params: { id: string }): Promise<BaseGroup | null> => {
-  const row = await getLocalGroupById(params.id);
-  return row ? toBaseGroup(row) : null;
+  const [row] = await sql<DbRow[]>`
+    SELECT g.id, g.provider, g.name, g.description, g.gid_number, personal_owner.*
+    FROM auth.groups g
+    ${personalOwnerJoin()}
+    WHERE g.id = ${params.id}::uuid AND g.provider = 'local'
+  `;
+  return row ? buildBaseGroup(row) : null;
 };
 
 export const create = async (params: { name: string; description?: string }, db: typeof sql = sql): Promise<MutationResult<BaseGroup>> => {
@@ -119,8 +126,9 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
   `;
   const total = Number(countRow?.count ?? 0);
   const rows = await sql<DbRow[]>`
-    SELECT id, provider, name, description, gid_number
+    SELECT g.id, g.provider, g.name, g.description, g.gid_number, personal_owner.*
     FROM auth.groups g
+    ${personalOwnerJoin()}
     WHERE g.provider = 'local'
       AND (${pattern}::text IS NULL OR LOWER(g.name) LIKE ${pattern} ESCAPE '\\' OR LOWER(g.description) LIKE ${pattern} ESCAPE '\\')
     ORDER BY g.name
@@ -128,15 +136,7 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
   `;
 
   return {
-    groups: rows.map((row) =>
-      toBaseGroup({
-        id: row.id as string,
-        provider: row.provider as "local",
-        name: row.name as string,
-        description: row.description as string | null,
-        gidNumber: row.gid_number as number | null,
-      }),
-    ),
+    groups: rows.map(buildBaseGroup),
     total,
     pagination: {
       page,

package/src/services/app-approval.ts

@@ -1,5 +1,6 @@
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { type SQL, sql } from "bun";
+import { lazySync } from "../_internal/process-sync";
 import { env } from "../config/env";
 import { type AccountCategory, accountCategory } from "../contracts/account-categories";
 import {
@@ -17,6 +18,7 @@ import {
 import { publicCloudOrigin } from "../shared/app-url";
 import { isAccountCategoryAllowed } from "./account-category-policy";
 import { audit } from "./audit";
+import { logger } from "./logging";
 import { CORE_SETTINGS } from "./settings/core-settings";
 import { decryptValue } from "./settings/crypto";
 
@@ -136,6 +138,46 @@ type LoginRow = {
 };
 export type AppApprovalActor = { userId: string; sid: string; admin: boolean };
 export type AppDeviceEnrollmentNotice = { deviceId: string; userId: string; name: string; assisted: boolean };
+/** Best-effort wake-ups for browsers waiting on a login decision. Postgres stays authoritative. */
+export type AppLoginDecisionHints = {
+  /** Call after the decision commits. Must not throw or delay the caller. */
+  publish(requestId: string): void;
+  /** Settles on the first hint for this request, or when `signal` aborts. */
+  wait(requestId: string, signal: AbortSignal): Promise<void>;
+};
+/** Best-effort sign-in wake-ups through the trusted authenticator; returns the HTTP status. */
+export type AppLoginPushSender = (appOrigin: string, body: { token: string; cloudOrigin: string; requestRef: string }) => Promise<number>;
+export const fetchPushSender: AppLoginPushSender = async (appOrigin, body) => {
+  const response = await fetch(`${appOrigin}/push/notify`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    redirect: "error",
+    signal: AbortSignal.timeout(5_000),
+  });
+  await response.body?.cancel();
+  return response.status;
+};
+const log = logger("app-approval");
+const decisionTopic = lazySync((sync) =>
+  sync.topic<null>({
+    id: "cloud:app-login-decisions",
+    owner: "cloud",
+    retention: { maxAgeMs: 120_000, maxBytes: 1_048_576 },
+    maxPayloadBytes: 2000,
+  }),
+);
+/** Core NATS broadcast reaches the waiting browser on any replica. */
+export const syncLoginDecisionHints: AppLoginDecisionHints = {
+  publish: (requestId) => {
+    void Promise.resolve()
+      .then(() => decisionTopic().publish({ tenantId: requestId, data: null }))
+      .catch((error) => log.warn("App login decision hint failed", { error: String(error) }));
+  },
+  wait: async (requestId, signal) => {
+    for await (const _event of decisionTopic().live({ tenantId: requestId, signal })) return;
+  },
+};
 const view = (row: DeviceRow): AppDeviceView => ({
   id: row.id,
   name: row.name,
@@ -163,6 +205,8 @@ const verify = async (key: AppDevicePublicKey, message: string, signature: strin
 export const createAppApprovalService = (
   db: SQL = sql,
   configuration = (requireEnabled = true) => readAppApprovalConfig(db, requireEnabled),
+  hints: AppLoginDecisionHints = syncLoginDecisionHints,
+  push: AppLoginPushSender = fetchPushSender,
 ) => {
   const config = async (requireEnabled = true) => {
     const value = await configuration(requireEnabled);
@@ -215,6 +259,24 @@ export const createAppApprovalService = (
     return device;
   };
 
+  /** Runs after the login commit and never delays or fails it. The body names only
+   * this Cloud and the request id; a 410 means the phone's subscription is gone. */
+  const wake = async (cfg: AppApprovalConfig, userId: string, requestId: string) => {
+    try {
+      const rows = await db<{ push_token: string }[]>`SELECT DISTINCT push_token FROM auth.app_devices
+        WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND revoked_at IS NULL AND push_token IS NOT NULL LIMIT ${limits.devicesPerAccount}`;
+      await Promise.all(
+        rows.map(async ({ push_token: token }) => {
+          const status = await push(cfg.appOrigin, { token, cloudOrigin: cfg.issuer, requestRef: requestId });
+          if (status === 410)
+            await db`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
+        }),
+      );
+    } catch (error) {
+      log.warn("App login push wake-up failed", { error: error instanceof Error ? error.name : "UnknownError" });
+    }
+  };
+
   return {
     config,
     cleanup,
@@ -369,6 +431,7 @@ export const createAppApprovalService = (
         challenge = secret(),
         code = comparison(),
         expiresAt = future(limits.loginSeconds);
+      let owner: string | undefined;
       await db.begin(async (tx) => {
         const candidates = await tx<
           AccountRow[]
@@ -392,7 +455,10 @@ export const createAppApprovalService = (
         // public shape and a decoy pending transaction; no account enumeration.
         await tx`INSERT INTO auth.app_logins(id,issuer,user_id,auth_epoch,category,browser_hash,challenge,comparison,expires_at)
           VALUES (${id}::uuid,${cfg.issuer},${candidate?.id ?? null}::uuid,${candidate?.auth_epoch ?? null},${category},${hash(browserSecret)},${challenge},${code},${expiresAt})`;
+        owner = candidate?.id;
       });
+      // Not awaited: decoy and real requests answer alike, and push is only a wake-up.
+      if (owner) void wake(cfg, owner, id);
       return { requestId: id, browserSecret, comparison: code, expiresAt: iso(expiresAt), pollAfterSeconds: limits.pollSeconds };
     },
     deviceCommand: async (request: AppDeviceRequest) => {
@@ -409,7 +475,7 @@ export const createAppApprovalService = (
       )
         return reject("FORBIDDEN", 403);
       await cleanup();
-      return db.begin(async (tx) => {
+      const outcome = await db.begin(async (tx) => {
         const device = await activeDevice(tx, proof.deviceId, cfg.issuer);
         if (!(await verify(AppDevicePublicKeySchema.parse(device.public_key), appDeviceProofMessage(proof), signature)))
           return reject("FORBIDDEN", 403);
@@ -418,6 +484,10 @@ export const createAppApprovalService = (
         if (!used.length) return reject("CONFLICT", 409);
         await tx`UPDATE auth.app_devices SET last_used_at=now() WHERE id=${device.id}::uuid`;
         const command = proof.command;
+        if (command.operation === "push") {
+          await tx`UPDATE auth.app_devices SET push_token=${command.token} WHERE id=${device.id}::uuid`;
+          return { state: "updated" as const };
+        }
         if (command.operation === "revoke") {
           await tx`UPDATE auth.app_devices SET revoked_at=now() WHERE id=${device.id}::uuid`;
           await record(tx, "device.revoke", device.user_id, device.id);
@@ -460,12 +530,39 @@ export const createAppApprovalService = (
         await record(tx, `login.${command.decision}`, device.user_id, device.id, { requestId: row.id });
         return { state };
       });
+      // Only after commit: the waiting browser re-reads Postgres, so a hint never grants anything.
+      if (proof.command.operation === "decide") hints.publish(proof.command.requestId);
+      return outcome;
     },
-    browserStatus: async (id: string, token: string) => {
+    /** With `hold`, a pending request is answered on its decision, its expiry, or after `hold.ms`, whichever comes first. */
+    browserStatus: async (id: string, token: string, hold?: { ms: number; signal?: AbortSignal }) => {
       const cfg = await config();
-      const [row] = await db<LoginRow[]>`SELECT * FROM auth.app_logins WHERE id=${id}::uuid AND issuer=${cfg.issuer}`;
-      if (!row || !matches(token, row.browser_hash)) return reject("UNAVAILABLE", 404);
-      return { state: new Date(row.expires_at).getTime() <= Date.now() ? "expired" : row.state, pollAfterSeconds: limits.pollSeconds };
+      const read = async () => {
+        const [row] = await db<LoginRow[]>`SELECT * FROM auth.app_logins WHERE id=${id}::uuid AND issuer=${cfg.issuer}`;
+        if (!row || !matches(token, row.browser_hash)) return reject("UNAVAILABLE", 404);
+        const expiresIn = new Date(row.expires_at).getTime() - Date.now();
+        return { state: expiresIn <= 0 ? "expired" : row.state, expiresIn };
+      };
+      const result = (state: string) => ({ state, pollAfterSeconds: limits.pollSeconds });
+      if (!hold) return result((await read()).state);
+      // Listen before the first read so a decision committed in between still wakes this request.
+      const waiting = new AbortController();
+      const ended = new Promise((resolve) => waiting.signal.addEventListener("abort", resolve, { once: true }));
+      const stop = () => waiting.abort();
+      hold.signal?.addEventListener("abort", stop, { once: true });
+      if (hold.signal?.aborted) stop();
+      const hint = hints.wait(id, waiting.signal).catch(() => {});
+      try {
+        const first = await read();
+        if (first.state !== "pending") return result(first.state);
+        const timer = setTimeout(stop, Math.min(hold.ms, first.expiresIn));
+        await Promise.race([hint, ended]);
+        clearTimeout(timer);
+        return result((await read()).state);
+      } finally {
+        hold.signal?.removeEventListener("abort", stop);
+        stop();
+      }
     },
     consumeLogin: async (id: string, token: string) => {
       const cfg = await config();

package/src/services/ipa/groups.ts

@@ -22,6 +22,7 @@ const toBaseGroup = (row: IpaGroupRow): BaseGroup => ({
   name: row.name,
   description: row.description,
   gidnumber: row.gidNumber,
+  personalOwner: null,
 });
 
 const getIpaGroupById = async (id: string): Promise<IpaGroupRow | null> => {
@@ -142,6 +143,7 @@ export const list = async (params: {
       name: row.name as string,
       description: row.description as string | null,
       gidnumber: row.gid_number as number | null,
+      personalOwner: null,
     })),
     total,
     pagination: { page, perPage, totalPages, hasNext: page < totalPages },
@@ -377,6 +379,7 @@ export const add = async (params: {
       name: row.name as string,
       description: row.description as string | null,
       gidnumber: row.gid_number as number | null,
+      personalOwner: null,
     },
   };
 };

package/src/services/ipa/search.ts

@@ -147,6 +147,7 @@ export const search = async (query: string, options: SearchOptions): Promise<{ u
       name: row.name,
       description: row.description ?? null,
       gidnumber: row.gid_number ?? null,
+      personalOwner: null,
     }));
   }
 

package/src/services/webauthn.ts

@@ -21,7 +21,7 @@ import { coreSettings } from "./settings/api";
 const CHALLENGE_TTL_SECONDS = 300;
 const REGISTRATION_CHALLENGE_PREFIX = "webauthn:registration:";
 const AUTHENTICATION_CHALLENGE_PREFIX = "webauthn:authentication:";
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{12}$/i;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const log = logger("auth:webauthn");
 
 type DbPasskeyRow = {

package/src/shared/account-display.ts

@@ -13,3 +13,17 @@ export const getAccountTypeLabel = (user: Pick<AccountLike, "profile">): string
 export const getManagementLabel = (user: Pick<AccountLike, "provider">): string => (user.provider === "ipa" ? "FreeIPA" : "Local");
 
 export const getSupplementalRoleLabel = (role: SupplementalRole): string => (role === "group-manager" ? "Group Manager" : "Admin");
+
+const isGerman = (locale: string | null | undefined): boolean => locale?.toLowerCase().split(/[-_]/)[0] === "de";
+
+/**
+ * Display form of a group name for people. In German, the first letter of each
+ * word separated by whitespace or a hyphen is capitalised (`buchhaltung` →
+ * `Buchhaltung`); other locales get the name unchanged. Use it only for rendered
+ * text: stored names, identifiers, URLs, search input, and API or JSON output
+ * keep the original name.
+ */
+export const groupDisplayName = (name: string, locale: string | null | undefined): string =>
+  isGerman(locale)
+    ? name.replace(/(^|[\s-])(\p{L})/gu, (_, separator: string, letter: string) => separator + letter.toLocaleUpperCase("de"))
+    : name;

package/src/shared/markdown/extensions/info-blocks.ts

@@ -11,6 +11,10 @@
  * `:::warning Before deleting`.
  *
  * Supported types: note, info, success, warning, danger
+ *
+ * `notices: "minimal"` renders only the tone colour: no icon and no automatic
+ * label. The type name stays available to screen readers, and an explicit
+ * title is still shown.
  */
 
 import { NOTICE_CARD_CLASSES, NOTICE_CARD_ICONS, type NoticeTone } from "@k2b/ui";
@@ -50,7 +54,9 @@ const renderInlineContent = (content: string): string => {
     .replace(/\n/g, "<br>");
 };
 
-export function infoBlocksExtension(): MarkedExtension {
+export type NoticeStyle = "card" | "minimal";
+
+export function infoBlocksExtension(notices: NoticeStyle = "card"): MarkedExtension {
   return {
     extensions: [
       {
@@ -78,9 +84,14 @@ export function infoBlocksExtension(): MarkedExtension {
           const blockType = token.blockType as BlockType;
           const config = blockConfig[blockType];
           const content = escapeHtml(token.content as string);
-          const title = escapeHtml((token.title as string | undefined) ?? config.label);
           const renderedContent = renderInlineContent(content);
 
+          if (notices === "minimal") {
+            const title = token.title ? `<p class="${NOTICE_CARD_CLASSES.title}">${escapeHtml(token.title as string)}</p>` : "";
+            return `<aside class="${NOTICE_CARD_CLASSES.root}" data-tone="${config.tone}" role="note"><span class="sr-only">${config.label}: </span>${title}<div class="${NOTICE_CARD_CLASSES.body}">${renderedContent}</div></aside>`;
+          }
+
+          const title = escapeHtml((token.title as string | undefined) ?? config.label);
           return `<aside class="${NOTICE_CARD_CLASSES.root}" data-tone="${config.tone}">
   <div class="${NOTICE_CARD_CLASSES.inner}">
     <i class="${NOTICE_CARD_ICONS[config.tone]} ${NOTICE_CARD_CLASSES.icon}" aria-hidden="true"></i>

package/src/shared/markdown/index.ts

@@ -11,7 +11,7 @@ import { markdownClient } from "./client";
 import { codeExtension } from "./extensions/code";
 import { guidedHelpExtension } from "./extensions/guided-help";
 import { imagesExtension } from "./extensions/images";
-import { infoBlocksExtension } from "./extensions/info-blocks";
+import { infoBlocksExtension, type NoticeStyle } from "./extensions/info-blocks";
 import { katexExtension } from "./extensions/katex";
 import { linksExtension } from "./extensions/links";
 import { markExtension } from "./extensions/mark";
@@ -22,7 +22,7 @@ import { taskListExtension } from "./extensions/task-list";
 // Create a configured marked instance
 type MarkdownProfile = "content" | "help";
 
-const createMarked = (profile: MarkdownProfile = "content") => {
+const createMarked = (profile: MarkdownProfile = "content", notices: NoticeStyle = "card") => {
   const marked = new Marked();
 
   marked.use({
@@ -32,7 +32,7 @@ const createMarked = (profile: MarkdownProfile = "content") => {
 
   // Apply extensions in order
   // Note: katexExtension must come before codeExtension to handle ```math blocks
-  marked.use(infoBlocksExtension());
+  marked.use(infoBlocksExtension(notices));
   marked.use(taskListExtension());
   marked.use(tablesExtension());
   marked.use(linksExtension({ internalTarget: profile === "help" ? "_self" : "_blank" }));
@@ -48,8 +48,16 @@ const createMarked = (profile: MarkdownProfile = "content") => {
 };
 
 const marked = createMarked();
+const minimalNoticeMarked = createMarked("content", "minimal");
 const helpMarked = createMarked("help");
 
+export type MarkdownRenderOptions = {
+  /** `"minimal"` shows notices as tone colour only; the type name stays for screen readers. */
+  notices?: NoticeStyle;
+};
+
+const markedFor = (options: MarkdownRenderOptions): Marked => (options.notices === "minimal" ? minimalNoticeMarked : marked);
+
 const sanitizeRenderedHtml = (html: string): string =>
   sanitizeHtml(html, {
     allowedTags: [
@@ -91,6 +99,7 @@ const sanitizeRenderedHtml = (html: string): string =>
       "*": ["aria-hidden", "aria-label", "class", "data-help-icon", "data-tone", "id", "title"],
       a: ["href", "name", "rel", "target", "title"],
       annotation: ["encoding"],
+      aside: [{ name: "role", multiple: false, values: ["note"] }],
       code: ["class"],
       div: ["class", "data-block-name", "style"],
       img: ["alt", "class", "height", "loading", "src", "title", "width", "style"],
@@ -146,10 +155,10 @@ const sanitizeRenderedHtml = (html: string): string =>
  * @see MarkdownView component for displaying the rendered HTML
  * @see initMarkdownEnhancements for client-side Mermaid support
  */
-export function renderMarkdown(content: string): string {
+export function renderMarkdown(content: string, options: MarkdownRenderOptions = {}): string {
   if (!content || typeof content !== "string") return "";
 
-  const html = marked.parse(content);
+  const html = markedFor(options).parse(content);
   if (typeof html !== "string") return "";
 
   return sanitizeRenderedHtml(html);
@@ -158,10 +167,10 @@ export function renderMarkdown(content: string): string {
 /**
  * Render markdown to HTML synchronously.
  */
-export function renderMarkdownSync(content: string): string {
+export function renderMarkdownSync(content: string, options: MarkdownRenderOptions = {}): string {
   if (!content || typeof content !== "string") return "";
 
-  const html = marked.parse(content);
+  const html = markedFor(options).parse(content);
   if (typeof html !== "string") return "";
 
   return sanitizeRenderedHtml(html);