@k2b/cloud 0.30.0 → 0.32.0

package/src/events/testing.ts

@@ -0,0 +1,88 @@
+import { CursorMismatchError, RetentionGapError, type TopicEvent } from "@k2b/sync";
+import type { LiveEnvelope, LiveTopic } from "./live-engine";
+
+/** Publishes an application's real outbox without starting its application. */
+export { startLiveOutbox } from "./live";
+export {
+  /** Creates the real delivery engine for application channel tests. */
+  createLiveEngine,
+  /** Platform bounds; restore any intervals shortened by a test. */
+  LIVE_LIMITS,
+  /** The delivery engine used by channel tests. */
+  type LiveEngine,
+  /** One application's update, access change, or resync hint. */
+  type LiveEnvelope,
+  /** The topic operations consumed by the delivery engine. */
+  type LiveTopic,
+} from "./live-engine";
+
+/** A memory topic with Sync cursor and retention rules, plus publish and trim controls. */
+export const createMemoryLiveTopic = () => {
+  const name = crypto.randomUUID().replaceAll("-", "");
+  let sequence = 0;
+  let first = 1;
+  const events: TopicEvent<LiveEnvelope>[] = [];
+  const wakes = new Set<() => void>();
+  const cursorAt = (seq: number) => `s6t.${name}.${seq}`;
+  const cursorSequence = (cursor: string) => {
+    const match = /^s6t\.([a-z0-9]+)\.(\d+)$/.exec(cursor);
+    if (!match || match[1] !== name) throw new CursorMismatchError("The cursor belongs to another topic");
+    return Number(match[2]);
+  };
+  const checkGap = (position: number) => {
+    if (position + 1 < first) throw new RetentionGapError(cursorAt(position + 1), cursorAt(first), cursorAt(first - 1));
+  };
+  return {
+    cursorAt,
+    cursorSequence,
+    head: async () => cursorAt(sequence),
+    publish: (data: LiveEnvelope) => {
+      events.push({
+        data,
+        eventId: String(++sequence),
+        cursor: cursorAt(sequence),
+        sequence,
+        tenantId: "default",
+        publishedAt: new Date(),
+      });
+      for (const wake of wakes) wake();
+    },
+    trim: (count: number) => {
+      events.splice(0, Math.max(0, count));
+      first = events[0]?.sequence ?? sequence + 1;
+    },
+    replay: (options: { after?: string; until?: string } = {}): AsyncIterable<TopicEvent<LiveEnvelope>> => {
+      const after = cursorSequence(options.after ?? cursorAt(0));
+      const until = options.until ? cursorSequence(options.until) : sequence;
+      checkGap(after);
+      const batch = events.filter((event) => event.sequence > after && event.sequence <= until);
+      return (async function* () {
+        yield* batch;
+      })();
+    },
+    follow: (options: { after?: string; signal?: AbortSignal } = {}): AsyncIterable<TopicEvent<LiveEnvelope>> => {
+      let position = cursorSequence(options.after ?? cursorAt(0));
+      return (async function* () {
+        while (!options.signal?.aborted) {
+          checkGap(position);
+          for (const event of events.filter((event) => event.sequence > position)) {
+            position = event.sequence;
+            yield event;
+          }
+          // Publication during a yielded batch must not be lost before we wait.
+          if (sequence > position) continue;
+          await new Promise<void>((resolve) => {
+            const wake = () => {
+              wakes.delete(wake);
+              options.signal?.removeEventListener("abort", wake);
+              resolve();
+            };
+            wakes.add(wake);
+            options.signal?.addEventListener("abort", wake, { once: true });
+            if (options.signal?.aborted) wake();
+          });
+        }
+      })();
+    },
+  } satisfies LiveTopic & { publish(data: LiveEnvelope): void; trim(count: number): void };
+};

package/src/server/index.ts

@@ -1,4 +1,5 @@
 export { buildMetadata } from "../_internal/build-metadata";
+export { loadPendingApprovals } from "../api/approvals-loader";
 export { expectUserBackedActor, getUserBackedActor, isAppSessionActor, userFromActor } from "./actor";
 export type { ApiErrorBody, ApiErrorResponse, ApiErrorStatus } from "./api";
 export { api, respond, respondMessage } from "./api";
@@ -39,6 +40,7 @@ export {
   validator,
 } from "./middleware";
 export { RateLimitError, type RateLimiter, type RateLimiterConfig, type RateLimitResult, ratelimit } from "./ratelimit";
+export { REQUEST_IDLE_TIMEOUT_MAX_SECONDS, REQUEST_IDLE_TIMEOUT_SECONDS, setRequestTimeout } from "./request-timeout";
 export type {
   AccessEntry,
   AccessPrincipalColumns,
@@ -94,3 +96,4 @@ export {
   updateAccess,
 } from "./services";
 export { getDateConfig, getTimeZone, TIMEZONE_COOKIE, time } from "./time";
+export { getWidgetRequest } from "./widget-request";

package/src/server/middleware/auth.ts

@@ -1,7 +1,15 @@
 import type { Context } from "hono";
 import { createMiddleware } from "hono/factory";
 import { measureServerPhase } from "../../_internal/server-timing";
-import type { MessageResponse, Role, RoleOrSpecial, User, UserProfile, UserProvider } from "../../contracts/shared";
+import {
+  AI_INFERENCE_SCOPE,
+  type MessageResponse,
+  type Role,
+  type RoleOrSpecial,
+  type User,
+  type UserProfile,
+  type UserProvider,
+} from "../../contracts/shared";
 import { isAccountExpired } from "../../services/account-model";
 import { isReservedWorkloadApiCredential } from "../../services/identity/workload-auth";
 import { oauthTokens } from "../../services/oauth-tokens";
@@ -161,6 +169,8 @@ const loadAuthenticatedActorUncached = async (
     // App workload keys enter only through Core's dedicated broker/authority
     // handlers, which authenticate their exact app binding directly.
     if (isReservedWorkloadApiCredential(authResult)) return { token: null, user: null, actor: null };
+    // Restrict by rejection: a forgotten route check makes a models-only key work nowhere, never grants full access.
+    if (authResult.credential.scopes.includes(AI_INFERENCE_SCOPE)) return { token: null, user: null, actor: null };
     if (authResult.delegatedUser && isAccountExpired(authResult.delegatedUser.accountExpires)) {
       return { token: null, user: null, actor: null };
     }

package/src/server/request-timeout.ts

@@ -0,0 +1,22 @@
+import type { Context } from "hono";
+
+/** Idle timeout of every Cloud app server and the gateway: Bun's default, kept explicit. */
+export const REQUEST_IDLE_TIMEOUT_SECONDS = 10;
+/**
+ * Longest a request may stay silent; the gateway waits this long for an app's response headers.
+ * Stays below Bun's 255-second limit with headroom for the gateway's coarse upstream timer.
+ */
+export const REQUEST_IDLE_TIMEOUT_MAX_SECONDS = 240;
+
+/**
+ * Restart this request's bounded idle timer while waiting to answer.
+ * Bun retains the raised timeout on the keep-alive socket after the response,
+ * so restore REQUEST_IDLE_TIMEOUT_SECONDS once the handler starts answering.
+ */
+export const setRequestTimeout = (c: Context, seconds: number): void => {
+  if (!Number.isInteger(seconds) || seconds < 1 || seconds > REQUEST_IDLE_TIMEOUT_MAX_SECONDS)
+    throw new RangeError(`Request idle timeout must be an integer between 1 and ${REQUEST_IDLE_TIMEOUT_MAX_SECONDS} seconds`);
+  const server: unknown = c.env;
+  if (typeof server === "object" && server !== null && "timeout" in server && typeof server.timeout === "function")
+    server.timeout(c.req.raw, seconds);
+};

package/src/server/services/access.ts

@@ -438,12 +438,13 @@ const uuidArrayWithNulls = (values: readonly (string | null)[]): string => `{${v
  * channel's `authorize`.
  */
 export const getEffectivePermissions = async (params: {
-  accessIds: string[];
+  /** Grant IDs, or a subquery selecting one uuid column from the resource's junction table. */
+  accessIds: string[] | SQLQuery;
   subjects: readonly AccessSubject[];
 }): Promise<PermissionLevel[]> => {
   const { accessIds, subjects } = params;
   if (subjects.length === 0) return [];
-  if (accessIds.length === 0) return subjects.map(() => "none");
+  if (Array.isArray(accessIds) && accessIds.length === 0) return subjects.map(() => "none");
   const userIds = subjects.map((subject) => (subject.type === "user" ? subject.userId : null));
   const serviceAccountIds = subjects.map((subject) => (subject.type === "service_account" ? subject.serviceAccountId : null));
   // The tiers of buildAccessPrincipalTierConditions, evaluated per row of `s`; every subject here is authenticated.
@@ -451,7 +452,7 @@ export const getEffectivePermissions = async (params: {
     SELECT s.position::int AS position, (
       SELECT a.permission
       FROM auth.access a
-      WHERE a.id = ANY(${toPgUuidArray(accessIds)}::uuid[])
+      WHERE ${Array.isArray(accessIds) ? sql`a.id = ANY(${toPgUuidArray(accessIds)}::uuid[])` : sql`a.id IN (${accessIds})`}
         AND (
           a.service_account_id = s.service_account_id
           OR a.user_id = s.user_id

package/src/server/widget-request.ts

@@ -0,0 +1,27 @@
+import type { Context } from "hono";
+import { type DashboardWidgetSize, fitWidgetSize, resolveWidgetSizes, type WidgetRequest } from "../contracts/widgets";
+
+/** The query parameter Core uses to ask a widget handler for one size. */
+export const WIDGET_SIZE_PARAM = "size";
+
+const requests = new WeakMap<Request, WidgetRequest>();
+
+/**
+ * Records what the dashboard asked a declared widget for, already fitted to the declaration. Only the framework's
+ * internal widget route calls this, before it runs the handler.
+ */
+export const setWidgetRequest = (
+  c: Context,
+  declaration: { sizes?: readonly DashboardWidgetSize[]; defaultSize?: DashboardWidgetSize },
+): WidgetRequest => {
+  const request = { size: fitWidgetSize(c.req.query(WIDGET_SIZE_PARAM), resolveWidgetSizes(declaration)) };
+  requests.set(c.req.raw, request);
+  return request;
+};
+
+/**
+ * What the dashboard asks this widget handler for. `size` is always one of the sizes the widget declares; return the
+ * content that fits it, for example only the one number in `small`. Outside a dashboard invocation, such as a request
+ * to the handler's own public route, the request is `large`, the height every widget had before sizes existed.
+ */
+export const getWidgetRequest = (c: Context): WidgetRequest => requests.get(c.req.raw) ?? { size: "large" };

package/src/services/app-approval.ts

@@ -3,8 +3,11 @@ import { lazySync } from "../_internal/process-sync";
 import { env } from "../config/env";
 import { type AccountCategory, accountCategory } from "../contracts/account-categories";
 import {
+  APP_APPROVAL_FEATURES,
   APP_APPROVAL_PATH,
   APP_APPROVAL_PROTOCOL,
+  type AppActionSummary,
+  type AppActionView,
   type AppDevicePublicKey,
   AppDevicePublicKeySchema,
   type AppDeviceRequest,
@@ -147,8 +150,28 @@ export type AppLoginDecisionHints = {
   /** Settles on the first hint for this request, or when `signal` aborts. */
   wait(requestId: string, signal: AbortSignal): Promise<void>;
 };
+/** Open Action approvals of a device's account, as the device shows and decides them. */
+export type AppDeviceActions = {
+  inbox(input: { userId: string; issuer: string }): Promise<{ actions: AppActionSummary[]; moreActions: number }>;
+  view(input: { userId: string; issuer: string; actionId: string }): Promise<AppActionView | null>;
+  /** True when this decision applied; false when the request is gone, decided, expired, or its view changed. */
+  decide(input: {
+    userId: string;
+    deviceId: string;
+    issuer: string;
+    actionId: string;
+    digest: string;
+    approved: boolean;
+  }): Promise<boolean>;
+};
+// Bundle Action wake-ups for 30 seconds while the previously woken request is still open.
+// Cloud Login gives Actions a separate 30-per-token budget in five minutes, preserving the full sign-in budget.
+const ACTION_WAKE_SECONDS = 30;
 /** Best-effort sign-in wake-ups through the trusted authenticator; returns the HTTP status. */
-export type AppLoginPushSender = (appOrigin: string, body: { token: string; cloudOrigin: string; requestRef: string }) => Promise<number>;
+export type AppLoginPushSender = (
+  appOrigin: string,
+  body: { token: string; cloudOrigin: string; requestRef: string; kind?: "action" },
+) => Promise<number>;
 export const fetchPushSender: AppLoginPushSender = async (appOrigin, body) => {
   const response = await fetch(`${appOrigin}/push/notify`, {
     method: "POST",
@@ -265,6 +288,36 @@ export const createAppApprovalService = (
   return {
     config,
     cleanup,
+    wakeForAction: async (approvalId: string): Promise<void> => {
+      try {
+        const cfg = await config(false);
+        if (!cfg.enabled || !cfg.appOrigin) return;
+        const rows = await db<{ push_token: string; user_id: string }[]>`
+          UPDATE auth.app_devices d SET action_wake_at=now(), action_wake_ref=${approvalId}::uuid
+          WHERE d.id IN (
+            SELECT device.id FROM auth.app_devices device JOIN approvals.requests r ON r.approver_user_id=device.user_id
+            WHERE r.id=${approvalId}::uuid AND r.status='pending' AND r.expires_at > now()
+              AND EXISTS (SELECT 1 FROM ai.pending_actions p JOIN ai.turns t ON t.id=p.turn_id
+                WHERE p.approval_id=r.id AND p.status='pending' AND t.run_config->>'signedInSession' IS NULL)
+              AND device.issuer=${cfg.issuer} AND device.revoked_at IS NULL AND device.push_token IS NOT NULL
+              AND device.actions_at IS NOT NULL
+            LIMIT ${limits.devicesPerAccount}
+          ) AND (d.action_wake_at IS NULL OR d.action_wake_at <= now() - ${ACTION_WAKE_SECONDS} * interval '1 second'
+            OR NOT EXISTS (SELECT 1 FROM approvals.requests w
+              WHERE w.id=d.action_wake_ref AND w.status='pending' AND w.expires_at > now()))
+          RETURNING d.push_token,d.user_id`;
+        const tokens = new Map(rows.map((row) => [row.push_token, row.user_id]));
+        await Promise.all(
+          Array.from(tokens, async ([token, userId]) => {
+            const status = await push(cfg.appOrigin, { token, cloudOrigin: cfg.issuer, requestRef: approvalId, kind: "action" });
+            if (status === 410)
+              await db`UPDATE auth.app_devices SET push_token=NULL WHERE issuer=${cfg.issuer} AND user_id=${userId}::uuid AND push_token=${token}`;
+          }),
+        );
+      } catch (error) {
+        log.warn("App action push wake-up failed", { error: error instanceof Error ? error.name : "UnknownError" });
+      }
+    },
     maintain: async (notify: (notice: AppDeviceEnrollmentNotice) => Promise<unknown>, signal?: AbortSignal) => {
       await cleanup();
       const rows = await db<(DeviceRow & { has_email: boolean })[]>`
@@ -289,6 +342,7 @@ export const createAppApprovalService = (
         api: cfg.issuer + APP_APPROVAL_PATH,
         appOrigin: cfg.appOrigin,
         algorithm: "ES256",
+        features: [...APP_APPROVAL_FEATURES],
         limits,
       };
     },
@@ -478,7 +532,7 @@ export const createAppApprovalService = (
       if (owner) void wake(cfg, owner, id);
       return { requestId: id, browserSecret, comparison: code, expiresAt: iso(expiresAt), pollAfterSeconds: limits.pollSeconds };
     },
-    deviceCommand: async (request: AppDeviceRequest) => {
+    deviceCommand: async (request: AppDeviceRequest, actions: AppDeviceActions) => {
       const cfg = await config();
       const { proof, signature } = request;
       const now = Math.floor(Date.now() / 1000);
@@ -521,23 +575,27 @@ export const createAppApprovalService = (
           await record(tx, "device.revoke", device.user_id, device.id);
           return { state: "revoked" as const };
         }
-        if (command.operation === "pending") {
+        if (command.operation === "action" || command.operation === "act")
+          return { operation: command.operation, userId: device.user_id, deviceId: device.id };
+        if (command.operation === "pending" || command.operation === "inbox") {
           const user = await eligible(tx, device.user_id);
           const rows = await tx<
             LoginRow[]
           >`SELECT * FROM auth.app_logins WHERE issuer=${cfg.issuer} AND user_id=${device.user_id}::uuid AND state='pending' AND expires_at>now() AND auth_epoch=${user.auth_epoch} AND category=${accountCategory(user)} ORDER BY created_at LIMIT ${limits.pendingPerAccount}`;
-          return {
-            requests: rows.map(
-              (row): AppPendingLogin => ({
-                requestId: row.id,
-                challenge: row.challenge,
-                comparison: row.comparison,
-                createdAt: iso(row.created_at),
-                expiresAt: iso(row.expires_at),
-              }),
-            ),
-            pollAfterSeconds: limits.pollSeconds,
-          };
+          const requests = rows.map(
+            (row): AppPendingLogin => ({
+              requestId: row.id,
+              challenge: row.challenge,
+              comparison: row.comparison,
+              createdAt: iso(row.created_at),
+              expiresAt: iso(row.expires_at),
+            }),
+          );
+          if (command.operation === "inbox") {
+            await tx`UPDATE auth.app_devices SET actions_at=now() WHERE id=${device.id}::uuid`;
+            return { operation: "inbox" as const, userId: device.user_id, logins: requests };
+          }
+          return { requests, pollAfterSeconds: limits.pollSeconds };
         }
         const [row] = await tx<
           LoginRow[]
@@ -558,6 +616,36 @@ export const createAppApprovalService = (
         await record(tx, `login.${command.decision}`, device.user_id, device.id, { requestId: row.id });
         return { state };
       });
+      if (outcome.operation !== undefined) {
+        const command = proof.command;
+        const input = { userId: outcome.userId, issuer: cfg.issuer };
+        if (outcome.operation === "inbox") {
+          const inbox = { logins: outcome.logins, ...(await actions.inbox(input)), pollAfterSeconds: limits.pollSeconds };
+          // Multibyte summaries share the unchanged response budget with pending sign-ins.
+          while (inbox.actions.length && new TextEncoder().encode(JSON.stringify(inbox)).length > limits.bodyBytes) {
+            inbox.actions.pop();
+            inbox.moreActions++;
+          }
+          return inbox;
+        }
+        if (command.operation === "action") {
+          const view = await actions.view({ ...input, actionId: command.actionId });
+          return view ?? reject("CONFLICT", 409);
+        }
+        if (command.operation === "act") {
+          const approved = command.decision === "approve";
+          const applied = await actions.decide({
+            ...input,
+            deviceId: outcome.deviceId,
+            actionId: command.actionId,
+            digest: command.digest,
+            approved,
+          });
+          if (!applied) return reject("CONFLICT", 409);
+          return { state: approved ? ("approved" as const) : ("denied" as const) };
+        }
+        return reject("INVALID_REQUEST", 400);
+      }
       // Only after commit: the waiting browser re-reads Postgres, so a hint never grants anything.
       if (proof.command.operation === "decide") hints.publish(proof.command.requestId);
       return outcome;

package/src/services/approvals/cursor.ts

@@ -0,0 +1,15 @@
+import { z } from "zod";
+
+const CursorSchema = z.object({ createdAt: z.iso.datetime(), id: z.uuid() }).strict();
+type ApprovalCursor = z.infer<typeof CursorSchema>;
+
+export const encodeApprovalCursor = (cursor: ApprovalCursor): string => Buffer.from(JSON.stringify(cursor)).toString("base64url");
+export const decodeApprovalCursor = (cursor: string): ApprovalCursor | null => {
+  try {
+    if (!/^[A-Za-z0-9_-]{1,200}$/.test(cursor)) return null;
+    const parsed = CursorSchema.safeParse(JSON.parse(Buffer.from(cursor, "base64url").toString()));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+};

package/src/services/approvals/device.ts

@@ -0,0 +1,112 @@
+import {
+  APP_APPROVAL_LIMITS,
+  type AppActionSummary,
+  type AppActionView,
+  appActionDigest,
+  APP_ACTION_LIMITS as limits,
+} from "../../contracts/app-approval";
+import { CapabilityActionReviewSchema } from "../../contracts/capabilities";
+import { DEFAULT_LOCALE } from "../../server/locale";
+import type { PendingApprovalRow } from "./list";
+
+const plain = (value: string): string =>
+  value
+    .replace(/[\p{Cc}\p{Zl}\p{Zp}]/gu, " ")
+    .replace(/\p{Cf}/gu, "")
+    .replace(/\s+/gu, " ")
+    .trim();
+const cut = (value: string, limit: number): string => {
+  const points = Array.from(value);
+  if (limit < 1) return "";
+  return points.length > limit ? `${points.slice(0, limit - 1).join("")}…` : value;
+};
+
+/** A deterministic, plain-text snapshot; the digest binds the device's choice to everything it shows. */
+export const appActionView = async (
+  row: PendingApprovalRow,
+  options: { issuer: string; appName: (appId: string, locale: string) => string },
+): Promise<AppActionView> => {
+  let truncated = false;
+  const text = (value: string, limit: number) => {
+    const cleaned = plain(value);
+    const result = cut(cleaned, limit);
+    if (result !== cleaned) truncated = true;
+    return result;
+  };
+  const locale = row.runConfig?.kind === "compact" ? DEFAULT_LOCALE : (row.runConfig?.locale ?? DEFAULT_LOCALE);
+  const appName = plain(options.appName(row.appId, locale));
+  const app = { id: text(row.appId, limits.nameChars), name: text(appName, limits.nameChars) };
+  const requester = {
+    app: { id: text(row.requesterAppId, limits.nameChars), name: text(options.appName(row.requesterAppId, locale), limits.nameChars) },
+    // The snapshot, so renaming the chat does not change what the device signs.
+    title: text(row.requesterTitle ?? "", limits.titleChars) || null,
+  };
+  const lines = row.sentence.split(/\r?\n/).map(plain).filter(Boolean);
+  const first = lines[0] ?? plain(row.action);
+  const prefix = `${appName}: `;
+  const sentence = first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
+  const review = CapabilityActionReviewSchema.safeParse(row.details);
+  let message: string | null;
+  const details: AppActionView["details"] = [];
+  const detail = (label: string, value: string, format?: "date" | "date-time") => {
+    if (details.length >= limits.details) {
+      truncated = true;
+      return;
+    }
+    const cleanedLabel = text(label, limits.labelChars);
+    if (!cleanedLabel) return;
+    details.push({ label: cleanedLabel, value: text(value, limits.valueChars), ...(format ? { format } : {}) });
+  };
+  const messages: string[] = [];
+  const reviewLines = new Set<string>();
+  if (review.success) {
+    const cleaned = plain(review.data.message);
+    if (cleaned !== sentence) messages.push(cleaned);
+    reviewLines.add(cleaned);
+    for (const line of review.data.message.split(/\r?\n/)) reviewLines.add(plain(line));
+    for (const field of review.data.details ?? [])
+      detail(field.label, field.value, field.format === "date" || field.format === "date-time" ? field.format : undefined);
+  }
+  for (const line of lines.slice(1)) {
+    if (reviewLines.has(line)) continue;
+    const match = /^([^:]{1,40}):\s+(.+)$/.exec(line);
+    if (match) detail(match[1]!, match[2]!);
+    else messages.push(line);
+  }
+  message = text(messages.join(" "), limits.messageChars) || null;
+  const boundedSentence = text(sentence, limits.sentenceChars);
+  const view: AppActionView = {
+    actionId: row.id,
+    app,
+    requester,
+    assurance: row.assurance,
+    sentence: boundedSentence,
+    message,
+    details,
+    truncated,
+    argsDigest: row.argsDigest,
+    createdAt: row.createdAt.toISOString(),
+    expiresAt: row.expiresAt.toISOString(),
+    // Reserve the digest's bytes while bounding the final response.
+    digest: "A".repeat(43),
+  };
+  const bytes = () => new TextEncoder().encode(JSON.stringify(view)).length;
+  while (bytes() > APP_APPROVAL_LIMITS.bodyBytes) {
+    view.truncated = true;
+    if (view.details.length) view.details.pop();
+    else if (view.message) view.message = cut(view.message, Array.from(view.message).length - 1) || null;
+    else break;
+  }
+  view.digest = await appActionDigest(options.issuer, view);
+  return view;
+};
+
+export const appActionSummary = (view: AppActionView): AppActionSummary => ({
+  actionId: view.actionId,
+  app: view.app,
+  requester: view.requester,
+  assurance: view.assurance,
+  sentence: cut(view.sentence, limits.summaryChars),
+  createdAt: view.createdAt,
+  expiresAt: view.expiresAt,
+});