@k2b/cloud 0.30.0 → 0.32.0

package/src/approvals/messages.ts

@@ -0,0 +1,95 @@
+import { i18n } from "@k2b/stdlib";
+
+export const approvalMessages = i18n.define({
+  baseLocale: "en",
+  messages: {
+    en: {
+      title: "Approvals",
+      open: ({ count }: { count: number }) => `${count.toLocaleString("en")} open`,
+      rejectAll: "Reject all",
+      rejectAllTitle: "Reject all open approvals?",
+      rejectAllBody: ({ count }: { count: number }) =>
+        `${count === 1 ? "The open Action does not run." : `None of the ${count.toLocaleString("en")} open Actions runs.`} Where Cloud asked, it continues with your rejection.`,
+      emptyTitle: "Nothing is waiting for you.",
+      emptyBody: "When an Action needs your approval, it appears here and in the chat it comes from.",
+      loading: "Loading approvals…",
+      loadFailed: "Approvals could not be loaded.",
+      retry: "Try again",
+      showMore: "Show more",
+      loadMoreFailed: "More approvals could not be loaded.",
+      elsewhere: ({ count }: { count: number }) => `More approvals in other apps (${count.toLocaleString("en")})`,
+      allApprovals: "All approvals",
+      fromChat: ({ title }: { title: string }) => `from chat “${title}”`,
+      fromUntitledChat: "from a chat",
+      asksEveryTime: "Asks every time",
+      expiresIn: ({ time }: { time: string }) => `Expires ${time}`,
+      details: "Details",
+      reject: "Reject",
+      approve: "Approve",
+      approveForChat: "Approve for this chat",
+      allowWebsiteForChat: "Allow this website in this chat",
+      alwaysApprove: "Always approve",
+      moreOptions: "More approval options",
+      decidedHere: "Just now, decided here",
+      notApplied: "Your decision was not applied",
+      approved: "Approved",
+      rejected: "Rejected",
+      decidedElsewhere: "Already decided elsewhere",
+      gone: "Expired or withdrawn",
+      decisionFailed: "The decision was not saved. Try again.",
+      openIn: ({ app }: { app: string }) => `Open in ${app}`,
+      editIn: ({ app }: { app: string }) => `Edit in ${app}`,
+      statusIn: ({ app }: { app: string }) => `Status in ${app}`,
+      preview: "Preview",
+      download: "Download",
+      exactlyThis: "This approval applies to exactly this Action. If it changes before it runs, Cloud asks again.",
+      approvalFor: ({ title }: { title: string }) => `Approval: ${title}`,
+      close: "Close",
+      waiting: ({ count }: { count: number }) => (count === 0 ? "nothing waiting" : `${count.toLocaleString("en")} waiting`),
+    },
+    de: {
+      title: "Freigaben",
+      open: ({ count }) => `${count.toLocaleString("de")} offen`,
+      rejectAll: "Alle ablehnen",
+      rejectAllTitle: "Alle offenen Freigaben ablehnen?",
+      rejectAllBody: ({ count }) =>
+        `${count === 1 ? "Die offene Aktion läuft nicht." : `Keine der ${count.toLocaleString("de")} offenen Aktionen läuft.`} Wo Cloud gefragt hat, geht es mit deiner Ablehnung weiter.`,
+      emptyTitle: "Nichts wartet auf dich.",
+      emptyBody: "Wenn eine Aktion deine Freigabe braucht, erscheint sie hier und im Chat, aus dem sie kommt.",
+      loading: "Freigaben werden geladen …",
+      loadFailed: "Die Freigaben konnten nicht geladen werden.",
+      retry: "Erneut versuchen",
+      showMore: "Mehr anzeigen",
+      loadMoreFailed: "Weitere Freigaben konnten nicht geladen werden.",
+      elsewhere: ({ count }) => `Weitere Freigaben in anderen Apps (${count.toLocaleString("de")})`,
+      allApprovals: "Alle Freigaben",
+      fromChat: ({ title }) => `aus Chat „${title}“`,
+      fromUntitledChat: "aus einem Chat",
+      asksEveryTime: "Fragt immer",
+      expiresIn: ({ time }) => `Läuft ab ${time}`,
+      details: "Details",
+      reject: "Ablehnen",
+      approve: "Freigeben",
+      approveForChat: "Für diesen Chat freigeben",
+      allowWebsiteForChat: "Diese Website in diesem Chat erlauben",
+      alwaysApprove: "Immer freigeben",
+      moreOptions: "Weitere Freigabeoptionen",
+      decidedHere: "Gerade eben, hier entschieden",
+      notApplied: "Deine Entscheidung wurde nicht übernommen",
+      approved: "Freigegeben",
+      rejected: "Abgelehnt",
+      decidedElsewhere: "Schon anderswo entschieden",
+      gone: "Abgelaufen oder zurückgezogen",
+      decisionFailed: "Die Entscheidung wurde nicht gespeichert. Versuche es erneut.",
+      openIn: ({ app }) => `In ${app} öffnen`,
+      editIn: ({ app }) => `In ${app} bearbeiten`,
+      statusIn: ({ app }) => `Status in ${app}`,
+      preview: "Vorschau",
+      download: "Herunterladen",
+      exactlyThis: "Diese Freigabe gilt genau für diese Aktion. Ändert sie sich, bevor sie läuft, fragt Cloud neu.",
+      approvalFor: ({ title }) => `Freigabe: ${title}`,
+      close: "Schließen",
+      waiting: ({ count }) => (count === 0 ? "nichts offen" : `${count.toLocaleString("de")} offen`),
+    },
+  },
+});

package/src/approvals/ui.ts

@@ -0,0 +1,8 @@
+/**
+ * The shared list of pending Action approvals. Every app mounts the same component for its own scope; Core serves the
+ * route behind it and decides through the platform's approval requests.
+ */
+
+export type { ApprovalsProps } from "./Approvals";
+export { default as Approvals } from "./Approvals";
+export { approvalNavCount, default as ApprovalsNavStatus } from "./ApprovalsNavStatus";

package/src/browser/CloudResourceSearch.tsx

@@ -824,7 +824,7 @@ export default function CloudResourceSearch(props: CloudResourceSearchProps) {
                 focusInput();
               }}
             >
-              ← {t().back}
+              <i class="ti ti-arrow-left" aria-hidden="true" /> {t().back}
             </Button>
             <div class="cloud-resource-search__preview-app">
               <i class={item().icon ?? item().appIcon} aria-hidden="true" />

package/src/browser/app-approval.ts

@@ -4,9 +4,12 @@ export { type AppVaultBlob, type AppVaultConfig, AppVaultError, type AppVaultMet
 
 import { z } from "zod";
 import {
+  APP_ACTION_LIMITS,
   APP_APPROVAL_LIMITS,
   APP_APPROVAL_PATH,
   APP_APPROVAL_PROTOCOL,
+  type AppActionView,
+  AppActionViewSchema,
   AppDeviceCommandSchema,
   AppDeviceProofSchema,
   type AppDevicePublicKey,
@@ -19,6 +22,7 @@ import {
   AppPairingResultSchema,
   type AppPendingLogin,
   AppPendingLoginSchema,
+  appActionDigest,
   appDeviceProofMessage,
   appPairingLink,
   appPairingProofMessage,
@@ -84,6 +88,8 @@ const InfoSchema = z.object({
   appOrigin: z.string(),
   algorithm: z.literal("ES256"),
   limits: z.object(Object.fromEntries(Object.entries(APP_APPROVAL_LIMITS).map(([key, value]) => [key, z.literal(value)]))),
+  /** Absent on Clouds that serve only the first version's commands. */
+  features: z.array(z.string().max(40)).max(16).optional(),
 });
 
 /** Call only after the user explicitly trusts the issuer from a pairing link.
@@ -215,6 +221,31 @@ const connect = async (options: {
         throw new AppApprovalClientError("INVALID_RESPONSE");
       return result;
     },
+    /** Whether this Cloud serves `inbox`, `action` and `act`. Older Clouds answer those commands with HTTP 400. */
+    actions: info.features?.includes("actions") === true,
+    /** Pending sign-ins and the newest open Action approvals in one call; use it instead of `pending` where `actions` is true. */
+    inbox: async (device: AppApprovalDevice, signal?: AbortSignal) => {
+      const result = await command(device, { operation: "inbox" }, signal);
+      if (!("actions" in result)) throw new AppApprovalClientError("INVALID_RESPONSE");
+      return result;
+    },
+    /** One open Action approval. The digest is recomputed here, so a view that does not match it is never returned. */
+    action: async (device: AppApprovalDevice, actionId: string, signal?: AbortSignal): Promise<AppActionView> => {
+      const result = await command(device, { operation: "action", actionId }, signal);
+      if (!("digest" in result) || result.actionId !== actionId || (await appActionDigest(issuer, result)) !== result.digest)
+        throw new AppApprovalClientError("INVALID_RESPONSE");
+      return result;
+    },
+    /** Signs the decision over the view's digest. Only call it on an explicit choice of the person. */
+    act: async (device: AppApprovalDevice, view: AppActionView, decision: "approve" | "deny", signal?: AbortSignal) => {
+      view = AppActionViewSchema.parse(view);
+      if (Date.parse(view.expiresAt) <= Date.now() || (await appActionDigest(issuer, view)) !== view.digest)
+        throw new AppApprovalClientError("INVALID_INPUT");
+      const result = await command(device, { operation: "act", actionId: view.actionId, digest: view.digest, decision }, signal);
+      if (!("state" in result) || result.state !== (decision === "approve" ? "approved" : "denied"))
+        throw new AppApprovalClientError("INVALID_RESPONSE");
+      return result;
+    },
     /** Reads the account this device signs in and the device's own record. Older Clouds answer HTTP 400. */
     account: async (device: AppApprovalDevice, signal?: AbortSignal) => {
       const result = await command(device, { operation: "account" }, signal);
@@ -243,4 +274,5 @@ export const appApproval = {
   createKey,
   connect,
   limits: APP_APPROVAL_LIMITS,
+  actionLimits: APP_ACTION_LIMITS,
 };

package/src/browser/choose-files.tsx

@@ -1,9 +1,10 @@
 import { showFileDialog } from "@k2b/stdlib/browser";
 import { dialogCore, panelDialogWorkspaceOptions } from "@k2b/ui";
 import { createSignal } from "solid-js";
-import { type ChooseFilesOptions, FileChooser, type FileProviderList } from "./FileChooser";
+import type { ChooseFilesOptions, FileProviderList } from "./FileChooser";
 import type { FileProviderCaller } from "./file-providers";
 import type { ProviderList } from "./provider-list";
+import { importOnDemand } from "./reload";
 
 /**
  * One page's file choosing over its provider list. `caller` carries the locale and, in tests, the transport.
@@ -39,18 +40,30 @@ export const createFileChoosing = (
       );
     };
     if (!known) load();
-    return dialogCore
-      .open<File[]>(
-        (close) => <FileChooser options={options} providers={providers} retryProviders={load} caller={caller} close={close} />,
-        {
-          ...panelDialogWorkspaceOptions,
-          panelClassName: `${panelDialogWorkspaceOptions.panelClassName} cloud-file-chooser-dialog`,
-          initialFocus: (dialog) => dialog.querySelector<HTMLElement>('[role="gridcell"][tabindex="0"]'),
-          signal: options.signal,
-          history: true,
-        },
-      )
-      .then((files) => files ?? []);
+    return (async () => {
+      let abort = () => {};
+      const chooser = await Promise.race([
+        importOnDemand(() => import("./FileChooser")),
+        new Promise<undefined>((resolve) => {
+          abort = () => resolve(undefined);
+          signal?.addEventListener("abort", abort, { once: true });
+          if (signal?.aborted) abort();
+        }),
+      ]).finally(() => signal?.removeEventListener("abort", abort));
+      if (!chooser) return [];
+      return dialogCore
+        .open<File[]>(
+          (close) => <chooser.FileChooser options={options} providers={providers} retryProviders={load} caller={caller} close={close} />,
+          {
+            ...panelDialogWorkspaceOptions,
+            panelClassName: `${panelDialogWorkspaceOptions.panelClassName} cloud-file-chooser-dialog`,
+            initialFocus: (dialog) => dialog.querySelector<HTMLElement>('[role="gridcell"][tabindex="0"]'),
+            signal: options.signal,
+            history: true,
+          },
+        )
+        .then((files) => files ?? []);
+    })();
   };
 
   return chooseFiles;

package/src/browser/command-shortcuts.ts

@@ -31,12 +31,21 @@ export const shortcutLabel = (shortcut: string): string => {
   if (!combination) return "";
   const mac = isMac();
   const names = { ctrl: mac ? "⌃" : "Ctrl", alt: mac ? "⌥" : "Alt", shift: mac ? "⇧" : "Shift", meta: mac ? "⌘" : "Meta" };
-  return [...modifiers.filter((key) => combination[key]).map((key) => names[key]), combination.key.toUpperCase()].join(mac ? "" : "+");
+  const arrows: Record<string, string> = { arrowup: "↑", arrowdown: "↓", arrowleft: "←", arrowright: "→" };
+  const key = arrows[combination.key] ?? combination.key.toUpperCase();
+  return [...modifiers.filter((name) => combination[name]).map((name) => names[name]), key].join(mac ? "" : "+");
 };
 
-/** One owner in the Cloud layout; app islands only publish commands. */
+const ARROWS = new Set(["arrowup", "arrowdown", "arrowleft", "arrowright"]);
+
+/**
+ * One owner in the Cloud layout; app islands only publish commands. A command
+ * on an arrow key comes last: the focused element sees the key first, and a
+ * widget that moves with arrow keys, such as a tree that reorders on Alt+↑ or
+ * an open list, keeps it by handling it.
+ */
 export const attachCommandShortcuts = (run: (command: ContextAwareCommand) => void): (() => void) => {
-  const listener = (event: KeyboardEvent) => {
+  const listener = (event: KeyboardEvent, arrows: boolean) => {
     if (event.defaultPrevented || event.repeat || event.isComposing || (!isMac() && event.getModifierState("AltGraph"))) return;
     const target = event.target;
     const editing =
@@ -47,7 +56,7 @@ export const attachCommandShortcuts = (run: (command: ContextAwareCommand) => vo
       if (!command.shortcut) return false;
       if (command.id !== "cloud.search" && dialogOpen) return false;
       const combo = parse(command.shortcut);
-      if (!combo || (editing && !combo.ctrl && !combo.meta)) return false;
+      if (!combo || ARROWS.has(combo.key) !== arrows || (editing && !combo.ctrl && !combo.meta)) return false;
       // Shift+/ reports '?' on common keyboard layouts.
       const key = event.key === "?" && combo.key === "/" ? "/" : event.key.toLowerCase();
       const physicalLetter =
@@ -69,8 +78,14 @@ export const attachCommandShortcuts = (run: (command: ContextAwareCommand) => vo
     run(matches[0]!);
   };
   // Registered app combinations must win over editor bindings such as Mod+Shift+K.
-  window.addEventListener("keydown", listener, true);
-  return () => window.removeEventListener("keydown", listener, true);
+  const first = (event: KeyboardEvent) => listener(event, false);
+  const last = (event: KeyboardEvent) => listener(event, true);
+  window.addEventListener("keydown", first, true);
+  window.addEventListener("keydown", last);
+  return () => {
+    window.removeEventListener("keydown", first, true);
+    window.removeEventListener("keydown", last);
+  };
 };
 
 export { COMMANDS_CHANGED };

package/src/browser/commands.ts

@@ -1,12 +1,12 @@
 import { toast } from "@k2b/ui";
-import { resolveCommand } from "../capabilities/client";
-import { type CommandOptions, CommandOptionsSchema, clearCommand, readCommand } from "../contracts/commands";
+import type { CommandOptions } from "../contracts/commands";
 import {
   type ContextAwareCommand,
   collectContextAwareCommands,
   requestCommandHandling,
   requestContextCommandExecution,
 } from "./command-bridge";
+import { importOnDemand } from "./reload";
 import { resourceSearchMessages } from "./resource-search-messages";
 import { requestGlobalSearch } from "./search-bridge";
 
@@ -16,17 +16,26 @@ export { registerCommandHandler, registerContextAwareCommand } from "./command-b
 
 /** Opens locally only when a mounted owner explicitly accepts; otherwise follows the app's URL. */
 export const openCommand = async (command: string, input: unknown = {}, options: CommandOptions = {}): Promise<void> => {
-  const parsedOptions = CommandOptionsSchema.parse(options);
+  const modules = await importOnDemand(() => Promise.all([import("../contracts/commands"), import("../capabilities/client")]));
+  if (!modules) return;
+  const [contracts, capabilities] = modules;
+  const parsedOptions = contracts.CommandOptionsSchema.parse(options);
   const handled = requestCommandHandling({ command, input, options: parsedOptions });
   if (handled) return handled;
-  const result = await resolveCommand(command, input, parsedOptions);
+  const result = await capabilities.resolveCommand(command, input, parsedOptions);
   if (!result.ok) throw new Error(result.error.message);
   window.location.assign(result.data.href);
 };
 
 /** Call after this page's handlers have mounted. Each entry is consumed, including invalid links. */
 export const consumeCommandLink = async (): Promise<void> => {
+  const command = new URL(window.location.href).searchParams.get("command");
+  if (!command) return;
+  const contracts = await importOnDemand(() => import("../contracts/commands"));
+  if (!contracts) return;
   const url = new URL(window.location.href);
+  if (url.searchParams.get("command") !== command) return;
+  const { clearCommand, readCommand } = contracts;
   const messages = resourceSearchMessages.resolve([document.documentElement.lang]).t;
   let target: ReturnType<typeof readCommand>;
   try {

package/src/browser/file-provider-error.ts

@@ -0,0 +1,11 @@
+/** A provider failure the chooser explains; `status` 0 means the browser is offline. */
+export class FileProviderError extends Error {
+  constructor(
+    readonly code: string,
+    message: string,
+    readonly status: number,
+  ) {
+    super(message);
+    this.name = "FileProviderError";
+  }
+}

package/src/browser/file-providers.ts

@@ -15,6 +15,9 @@ import {
   fileProviderIssues,
 } from "../contracts/file-provider";
 import { LOCALE_HEADER } from "../shared/locale";
+import { FileProviderError } from "./file-provider-error";
+
+export { FileProviderError } from "./file-provider-error";
 
 /** One live application whose catalog manifest offers files, reduced to what choosing a file needs. */
 export type FileProviderSource = {
@@ -31,18 +34,6 @@ export type FileProviderSource = {
 
 export type FileProviderCaller = Pick<CapabilityHttpOptions, "fetch" | "baseUrl"> & { locale: string };
 
-/** A provider failure the chooser explains; `status` 0 means the browser is offline. */
-export class FileProviderError extends Error {
-  constructor(
-    readonly code: string,
-    message: string,
-    readonly status: number,
-  ) {
-    super(message);
-    this.name = "FileProviderError";
-  }
-}
-
 /** The page size the chooser asks for; the contract allows 1 to 100. */
 export const FILE_PROVIDER_PAGE_SIZE = 50;
 /** At most this many provider reads run at the same time. */

package/src/browser/files.tsx

@@ -1,5 +1,4 @@
 import { createFileChoosing } from "./choose-files";
-import { loadFileProviders } from "./file-providers";
 import { createProviderList } from "./provider-list";
 import { createFileSaving } from "./save-files";
 
@@ -7,7 +6,7 @@ export type { ChooseFilesOptions } from "./FileChooser";
 export { SAVE_FILES_ICON, type SavedFile, type SaveFileSource, type SaveFilesOptions } from "./save-files";
 
 const pageLocale = () => (typeof document === "undefined" ? "en" : document.documentElement.lang || "en");
-const providers = createProviderList(() => loadFileProviders({ locale: pageLocale() }));
+const providers = createProviderList(async () => (await import("./file-providers")).loadFileProviders({ locale: pageLocale() }));
 const saving = createFileSaving(providers);
 
 /**

package/src/browser/live-connection.ts

@@ -1,4 +1,4 @@
-import { type LiveServerMessage, LiveServerMessageSchema } from "../events/live-protocol";
+import { type LiveServerMessage, parseLiveServerMessage } from "../events/live-server-message";
 import { createLiveWebSocket, type LiveWebSocket } from "./live-websocket";
 
 export type LiveSubscriptionHandlers<T> = {
@@ -41,8 +41,7 @@ const shared = new Map<string, Shared>();
 
 const parseMessage = (raw: string): LiveServerMessage | null => {
   try {
-    const parsed = LiveServerMessageSchema.safeParse(JSON.parse(raw));
-    return parsed.success ? parsed.data : null;
+    return parseLiveServerMessage(JSON.parse(raw));
   } catch {
     return null;
   }

package/src/browser/provider-list.ts

@@ -1,5 +1,6 @@
 import { createSignal } from "solid-js";
-import { FileProviderError, type FileProviderSource } from "./file-providers";
+import { FileProviderError } from "./file-provider-error";
+import type { FileProviderSource } from "./file-providers";
 
 /** The catalog refuses the caller, such as a visitor of a public page or a session that has just expired. */
 const refused = (error: unknown) => error instanceof FileProviderError && (error.status === 401 || error.status === 403);

package/src/browser/save-files.tsx

@@ -1,10 +1,11 @@
 import { dialogCore, IconButton, type IconButtonProps, panelDialogWorkspaceOptions, toast, useLocale } from "@k2b/ui";
 import { createSignal, type JSX, splitProps } from "solid-js";
 import type { FileProviderList } from "./FileChooser";
-import { FileSaver, type SavedFile } from "./FileSaver";
+import type { SavedFile } from "./FileSaver";
 import { fileChooserMessages } from "./file-chooser-messages";
 import type { FileProviderCaller, SaveFileSource } from "./file-providers";
 import type { ProviderList } from "./provider-list";
+import { importOnDemand } from "./reload";
 
 export type { SavedFile } from "./FileSaver";
 export type { SaveFileSource } from "./file-providers";
@@ -40,9 +41,19 @@ export const createFileSaving = (
     if (!known) load();
     const saved: SavedFile[] = [];
     const running = new Set<Promise<void>>();
+    let abort = () => {};
+    const saver = await Promise.race([
+      importOnDemand(() => import("./FileSaver")),
+      new Promise<undefined>((resolve) => {
+        abort = () => resolve(undefined);
+        options.signal?.addEventListener("abort", abort, { once: true });
+        if (options.signal?.aborted) abort();
+      }),
+    ]).finally(() => options.signal?.removeEventListener("abort", abort));
+    if (!saver) return [];
     await dialogCore.open<void>(
       (close) => (
-        <FileSaver
+        <saver.FileSaver
           files={files}
           providers={providers}
           retryProviders={load}

package/src/browser/spotlight-position.ts

@@ -1,4 +1,4 @@
-import type { DialogRender } from "@k2b/ui";
+import { type DialogRender, suppressTextSelection } from "@k2b/ui";
 
 export type SpotlightPosition = { x: number; y: number };
 const STORAGE_KEY = "cloud.spotlight.position.v1";
@@ -42,6 +42,7 @@ export const attachSpotlightPosition = (
     origin: SpotlightPosition;
     previous: SpotlightPosition | null;
     handle: HTMLElement;
+    releaseTextSelection: () => void;
   } | null = null;
 
   const home = document.createElement("div");
@@ -108,6 +109,7 @@ export const attachSpotlightPosition = (
     if (!drag) return;
     const handle = drag.handle;
     const id = drag.id;
+    drag.releaseTextSelection();
     drag = null;
     if (handle.hasPointerCapture(id)) handle.releasePointerCapture(id);
     delete host.dataset.dragging;
@@ -132,6 +134,7 @@ export const attachSpotlightPosition = (
       origin: { x: rect.x, y: rect.y },
       previous: position,
       handle,
+      releaseTextSelection: suppressTextSelection(event.pointerId),
     };
     handle.setPointerCapture(event.pointerId);
   };

package/src/browser/widgets.ts

@@ -1,23 +1,25 @@
-import type { WidgetStreamLine } from "../contracts/widgets";
+import type { DashboardWidgetSize, WidgetStreamLine } from "../contracts/widgets";
 import { LOCALE_HEADER } from "../shared/locale";
 import { NDJSON_CONTENT_TYPE, readNdjsonLines } from "./ndjson";
 
-export type { WidgetResponse, WidgetStreamLine, WidgetStreamStatus } from "../contracts/widgets";
+export type { DashboardWidgetSize, WidgetResponse, WidgetStreamLine, WidgetStreamStatus } from "../contracts/widgets";
 
 /**
  * Asks Core for dashboard widgets and hands over each one as soon as it answers: `start` names the widgets, one
  * `widget` line follows per widget in the order they finish, then `done`. `keys` (`<appId>/<widgetId>`) limits the
- * request, for example to retry one widget; without it Core asks every declared widget. Aborting `signal` stops every
- * widget Core still waits for. Rejects when the request fails or the stream breaks off.
+ * request, for example to retry one widget; without it Core asks every declared widget. `sizes` names the size to ask
+ * a widget for; a widget without one, or with a size it does not offer, answers in its default size. Aborting `signal`
+ * stops every widget Core still waits for. Rejects when the request fails or the stream breaks off.
  */
 export const streamWidgets = async (options: {
   keys?: readonly string[];
+  sizes?: Readonly<Record<string, DashboardWidgetSize>>;
   signal: AbortSignal;
   locale: string;
   onLine: (line: WidgetStreamLine) => void;
 }): Promise<void> => {
   const query = new URLSearchParams();
-  for (const key of options.keys ?? []) query.append("widget", key);
+  for (const key of options.keys ?? []) query.append("widget", options.sizes?.[key] ? `${key}@${options.sizes[key]}` : key);
   const search = query.toString();
   const response = await fetch(`/api/widgets/v1${search ? `?${search}` : ""}`, {
     signal: options.signal,

package/src/capabilities/executions.ts

@@ -1,5 +1,6 @@
 import { sql } from "bun";
 import type { CapabilityOrigin } from "../contracts/capabilities";
+import { pruneApprovalRequests } from "../services/approvals";
 import { logger } from "../services/logging";
 import { CAPABILITY_CLAIM_RETENTION_HOURS, pruneCapabilityIdempotencyClaims } from "./claims";
 
@@ -280,6 +281,8 @@ export const startCapabilityExecutionMaintenance = (): (() => void) => {
     try {
       const removed = await pruneCapabilityExecutions(new Date(Date.now() - CAPABILITY_EXECUTION_RETENTION_DAYS * 86_400_000));
       if (removed > 0) log.info("Pruned expired capability executions", { removed });
+      const requests = await pruneApprovalRequests(new Date(Date.now() - CAPABILITY_EXECUTION_RETENTION_DAYS * 86_400_000));
+      if (requests > 0) log.info("Pruned expired approval requests", { removed: requests });
       const claims = await pruneCapabilityIdempotencyClaims(new Date(Date.now() - CAPABILITY_CLAIM_RETENTION_HOURS * 3_600_000));
       if (claims > 0) log.info("Pruned expired capability idempotency claims", { removed: claims });
     } catch (error) {

package/src/cli/account.ts

@@ -1,4 +1,5 @@
 import { readFile } from "node:fs/promises";
+import { isModelsOnlyApiKey } from "../contracts/shared";
 import { arg, type CliInputFlagValue, type CloudCliContext, command, confirmFlag, defineCliCommands, flag, readCliInput } from "./index";
 
 type User = {
@@ -31,6 +32,7 @@ type User = {
 };
 
 type ApiKey = {
+  scopes: string[];
   id: string;
   name: string;
   status: "active" | "revoked";
@@ -121,6 +123,7 @@ const apiKeyRows = (keys: ApiKey[]) =>
     id: key.id,
     name: key.name,
     prefix: key.tokenPrefix,
+    access: isModelsOnlyApiKey(key) ? "models" : "full",
     expires: key.expiresAt ?? "never",
     lastUsed: key.lastUsedAt ?? "never",
     created: key.createdAt,
@@ -283,6 +286,7 @@ export default defineCliCommands({
         printJsonOrTable(ctx, result, apiKeyRows(result.items), [
           { key: "name" },
           { key: "prefix" },
+          { key: "access" },
           { key: "expires" },
           { key: "lastUsed" },
           { key: "id" },
@@ -294,15 +298,30 @@ export default defineCliCommands({
       args: { name: arg.required({ valueLabel: "name", description: "API key name" }) },
       flags: {
         expires: flag.string({ description: "ISO timestamp or duration like 90d" }),
+        access: flag.enum(["full", "models"], { default: "full", description: "Full access or models-only inference access" }),
       },
       run: async ({ ctx, args, flags }) => {
         const result = await readApi<{ credential: ApiKey; token: string }>(
           ctx,
           "/api-keys",
-          jsonRequest("POST", { name: args.name, expiresAt: parseExpiry(flags.expires) }),
+          jsonRequest("POST", { name: args.name, expiresAt: parseExpiry(flags.expires), access: flags.access }),
         );
+        const modelsOnly = isModelsOnlyApiKey(result.credential);
+        if (flags.access === "models" && !modelsOnly) {
+          try {
+            await readApi<{ message: string }>(ctx, `/api-keys/${encodeURIComponent(result.credential.id)}`, jsonRequest("DELETE"));
+          } catch {
+            throw new Error(
+              `The key was created with full access and could not be revoked automatically. Run: cld account api-keys revoke ${result.credential.id} --yes`,
+            );
+          }
+          throw new Error("This Cloud does not support models-only API keys. The full-access key it created was revoked.");
+        }
         if (ctx.options.output === "json") ctx.json(result);
-        else ctx.print(`Token: ${result.token}\nPrefix: ${result.credential.tokenPrefix}\nStore this token now. It cannot be shown again.`);
+        else {
+          ctx.print(`Token: ${result.token}\nPrefix: ${result.credential.tokenPrefix}\nStore this token now. It cannot be shown again.`);
+          if (modelsOnly) ctx.print("This key works only with the OpenAI-compatible API at /api/ai/openai/v1 on this Cloud.");
+        }
       },
     }),
     command("api-keys revoke", {

package/src/cli/commands.ts

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
 import type { CloudCliContext, CloudCliFlagValue, CloudCliModule } from "./index";
+import { isCloudCliAlias, isCloudCliShortcuts } from "./plugin";
 
 type FlagKind = "string" | "boolean" | "int" | "enum" | "stringList" | "input";
 type ArgKind = "required" | "optional" | "rest";
@@ -155,6 +156,8 @@ type CommandNode = {
 type CliCommandsConfig = {
   name: string;
   summary: string;
+  alias?: string;
+  shortcuts?: Readonly<Record<string, string>>;
   requiresCloud?: boolean;
   groupSummaries?: Readonly<Record<string, string>>;
   commands: readonly CliCommandDefinition[];
@@ -241,10 +244,27 @@ export const readCliInput = async (input: CliInputFlagValue, options: ReadCliInp
 
 export const defineCliCommands = (config: CliCommandsConfig): CloudCliModule => {
   const root = buildCommandTree(config.commands, config.groupSummaries);
+  if (config.alias !== undefined && !isCloudCliAlias(config.alias, config.name)) {
+    throw new Error("CLI alias must be a lowercase kebab-case name different from the module name");
+  }
+  let shortcuts: Record<string, string> | undefined;
+  if (config.shortcuts !== undefined) {
+    if (!isCloudCliShortcuts(config.shortcuts, config.name, config.alias)) {
+      throw new Error("CLI shortcuts require unique kebab-case names and non-empty command paths without flags");
+    }
+    shortcuts = {};
+    for (const [name, target] of Object.entries(config.shortcuts)) {
+      const segments = target.trim().split(/\s+/);
+      if (!findNode(root, segments)?.command) throw new Error(`Unknown CLI shortcut command path: ${target}`);
+      shortcuts[name] = segments.join(" ");
+    }
+  }
 
   return {
     name: config.name,
     summary: config.summary,
+    ...(config.alias !== undefined ? { alias: config.alias } : {}),
+    ...(shortcuts !== undefined ? { shortcuts } : {}),
     requiresCloud: config.requiresCloud,
     requiresCloudFor: (args) => {
       const helpRequest = normalizeHelpRequest(args, {});
@@ -597,8 +617,10 @@ const renderFlagUsage = (key: string, spec: CliFlagSpec): string => {
 
 const renderFlagDescription = (spec: CliFlagSpec): string => {
   const parts = [spec.description];
-  if ("default" in spec && spec.default !== undefined)
-    parts.push(`Default: ${Array.isArray(spec.default) ? spec.default.join(",") : spec.default}.`);
+  const hasDefault = "default" in spec && spec.default !== undefined;
+  if ("required" in spec && spec.required && !hasDefault) parts.push("Required.");
+  if (hasDefault) parts.push(`Default: ${Array.isArray(spec.default) ? spec.default.join(",") : spec.default}.`);
   if (spec.kind === "enum") parts.push(`Values: ${spec.values.join(", ")}.`);
+  if (parts.length > 1 && parts[0] && !/[.!?:]$/.test(parts[0])) parts[0] += ".";
   return parts.filter(Boolean).join(" ");
 };