@k2b/cloud 0.31.0 → 0.33.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -70,6 +70,7 @@
     "./ai/ui": "./src/ai/ui.tsx",
     "./account/ui": "./src/account/ui.ts",
     "./access/ui": "./src/access/ui.ts",
+    "./approvals/ui": "./src/approvals/ui.ts",
     "./ssr": "./src/ssr/index.ts",
     "./ssr/islands": "./src/ssr/islands/index.ts",
     "./ssr/WorkspaceNavigation.island": "./src/ssr/WorkspaceNavigation.island.tsx",
@@ -80,6 +81,7 @@
     "./contracts": "./src/contracts/index.ts",
     "./contracts/notifications": "./src/contracts/notification-types.ts",
     "./contracts/*": "./src/contracts/*",
+    "./events/testing": "./src/events/testing.ts",
     "./events": "./src/events/index.ts",
     "./workflows": "./src/workflows/index.ts",
     "./workflows/ai": "./src/workflows/ai/index.ts",
@@ -103,14 +105,14 @@
     "@simplewebauthn/server": "14.0.3",
     "@tabler/icons": "3.48.0",
     "@tailwindcss/typography": "0.5.20",
-    "@k2b/nessi": "0.17.0",
-    "@k2b/ssr": "0.15.0",
-    "@k2b/ui": "0.22.0",
-    "@k2b/stdlib": "0.28.0",
+    "@k2b/nessi": "0.18.0",
+    "@k2b/ssr": "0.15.1",
+    "@k2b/ui": "0.24.0",
+    "@k2b/stdlib": "0.29.0",
     "@k2b/sync": "7.0.0",
     "@nats-io/jetstream": "3.4.0",
     "@nats-io/transport-node": "3.4.0",
-    "@modelcontextprotocol/sdk": "1.30.1",
+    "@modelcontextprotocol/sdk": "1.32.1",
     "bun-plugin-tailwind": "0.1.2",
     "hono-openapi": "1.3.3",
     "jose": "6.2.12",

package/src/_internal/define-app.ts

@@ -54,6 +54,7 @@ import { matchedRouteTemplate, routeTemplate } from "../server/middleware/route-
 import { runtime as runtimeMiddleware } from "../server/middleware/runtime";
 import { preloadLayoutAnnouncements, settings as settingsMiddleware } from "../server/middleware/settings";
 import { validationErrorResponse } from "../server/middleware/validator";
+import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
 import { setWidgetRequest } from "../server/widget-request";
 import {
   capabilityInvocationOperation,
@@ -73,7 +74,7 @@ import { createSyncOpsRoutes } from "../services/sync-ops";
 import { capabilityMessages } from "../shared/capability-messages";
 import { normalizeLocale } from "../shared/locale";
 import { escapeHtml } from "../shared/markdown/shared";
-import { themeBootstrapScript } from "../shared/theme";
+import { type CloudThemePreference, readThemePreferenceFromCookieHeader, themeBootstrapScript } from "../shared/theme";
 import { appFaviconHref } from "./app-favicon";
 import { compileAppPresentation } from "./app-presentation";
 import { readBoundedJson } from "./bounded-json";
@@ -101,6 +102,7 @@ const v = Date.now();
 export type PageOptions = {
   title?: string;
   description?: string;
+  /** Fix public displays such as Pulse, Weather and Venue monitors to one theme; otherwise follow the person's preference. */
   theme?: "light" | "dark";
   /** Framework-resolved BCP 47 document language — always the canonical request locale, never a page override. */
   lang?: string;
@@ -108,7 +110,7 @@ export type PageOptions = {
   pwa?: { name: string };
 };
 
-type ResolvedPageOptions = PageOptions & { performanceRoute?: string };
+type ResolvedPageOptions = PageOptions & { performanceRoute?: string; themePreference?: CloudThemePreference };
 
 // ── Public types ────────────────────────────────────────────────────────────
 
@@ -304,6 +306,7 @@ export type StartResult = {
   hostname: "0.0.0.0";
   port: number;
   development: boolean;
+  idleTimeout: number;
   fetch: Hono["fetch"];
 };
 
@@ -409,17 +412,24 @@ export const defineApp = <
     // Every island instance already mounts inside its own error boundary; this
     // only gives the fallback Cloud's look and the reader's language.
     errorFallback: fileURLToPath(new URL("../ssr/IslandError.tsx", import.meta.url)),
-    template: ({ body, scripts, title, description, theme, lang, performanceRoute, pwa }) => {
-      const themeFixed = theme !== undefined;
+    template: ({ body, scripts, title, description, theme, themePreference, lang, performanceRoute, pwa }) => {
+      const fixed = theme !== undefined;
+      const resolved = theme ?? (themePreference === "light" || themePreference === "dark" ? themePreference : undefined);
       // App pages paint the canvas before any stylesheet and give it to the
       // status bar. No status-bar style: `black-translucent` lays a blur band
       // over the top edge on iOS 26.
-      const canvas = PWA_CANVAS_COLORS[theme ?? "light"];
+      const canvas = resolved ? PWA_CANVAS_COLORS[resolved] : undefined;
       const head = pwa
         ? {
-            html: ` style="background-color:${canvas}"`,
+            html: canvas ? ` style="background-color:${canvas}"` : "",
             viewport: "width=device-width, initial-scale=1, viewport-fit=cover",
-            app: `<meta name="theme-color" content="${canvas}">
+            app: `${
+              canvas
+                ? `<meta name="theme-color" content="${canvas}">`
+                : `<meta name="theme-color" media="(prefers-color-scheme: light)" content="${PWA_CANVAS_COLORS.light}">
+    <meta name="theme-color" media="(prefers-color-scheme: dark)" content="${PWA_CANVAS_COLORS.dark}">
+    <style data-cloud-canvas>html{background-color:${PWA_CANVAS_COLORS.light}}@media (prefers-color-scheme: dark){html{background-color:${PWA_CANVAS_COLORS.dark}}}</style>`
+            }
     <link rel="manifest" href="${PWA_MANIFEST_PATH}">
     <link rel="apple-touch-icon" href="/branding/apple-touch-icon.png">
     <meta name="apple-mobile-web-app-title" content="${escapeHtml(pwa.name)}">`,
@@ -440,7 +450,7 @@ export const defineApp = <
       // stylesheet declares a layer. Tailwind's `properties` layer resets
       // `--tw-*` in browsers without `@property` and must stay lowest.
       return `<!DOCTYPE html>
-<html lang="${normalizeLocale(lang)}" class="${theme ?? "light"}"${themeFixed ? " data-theme-fixed" : ""}${head.html}>
+<html lang="${normalizeLocale(lang)}" class="${resolved ?? "light"}"${fixed ? " data-theme-fixed" : ""}${head.html}>
   <head><meta charset="UTF-8"><meta name="viewport" content="${head.viewport}">
     <meta name="view-transition" content="same-origin">
     <title>${escapeHtml(title ?? "Cloud")}</title>
@@ -478,6 +488,7 @@ export const defineApp = <
   const ssr = Object.assign(
     createStatusPreservingSsrHandler<ResolvedPageOptions>(html, async (c) => {
       c.get("page").lang = getLocale(c);
+      c.get("page").themePreference = readThemePreferenceFromCookieHeader(c.req.header("Cookie"));
       const user = c.get("user");
       c.get("page").performanceRoute =
         user && c.get("settings")?.observability?.web_vitals?.enabled === true ? (matchedRouteTemplate(c) ?? undefined) : undefined;
@@ -972,7 +983,7 @@ export const defineApp = <
       process.on("SIGTERM", () => void shutdown().then(() => process.exit(0)));
       process.on("SIGINT", () => void shutdown().then(() => process.exit(0)));
 
-      return { hostname: "0.0.0.0", port, development: isDevelopment, fetch: server.fetch };
+      return { hostname: "0.0.0.0", port, development: isDevelopment, idleTimeout: REQUEST_IDLE_TIMEOUT_SECONDS, fetch: server.fetch };
     } catch (error) {
       await stopStartedResources();
       throw error;

package/src/_internal/page-responses.ts

@@ -5,6 +5,7 @@ import { PWA_AUTH_PATH, PWA_SCOPE } from "../contracts/pwa";
 import { getLocale } from "../server/locale";
 import { preloadLayoutAnnouncements } from "../server/middleware/settings";
 import { createLoginRedirectUrl } from "../shared/redirect";
+import { readThemePreferenceFromCookieHeader } from "../shared/theme";
 import type { PageOptions } from "./define-app";
 
 export type PageErrorOptions = {
@@ -21,7 +22,10 @@ export type PageErrorStatus = ClientErrorStatusCode | ServerErrorStatusCode;
 export const createPageResponses = (html: HtmlFn<PageOptions>) => {
   const error = async (c: Context, status: PageErrorStatus, options: PageErrorOptions = {}): Promise<Response> => {
     // Auth middleware may reject before ssr() initializes page metadata.
-    c.set("page", { lang: getLocale(c) });
+    c.set("page", {
+      lang: getLocale(c),
+      themePreference: readThemePreferenceFromCookieHeader(c.req.header("Cookie")),
+    });
     c.header("Cache-Control", "private, no-store");
     if (options.layout !== "pwa") await preloadLayoutAnnouncements(c);
     // Load JSX only after the application's SSR plugin has been installed.

package/src/ai/app-skills.ts

@@ -23,13 +23,7 @@ const freezeJson = (value: unknown): void => {
 
 export const validateAppSkillContent = (input: AiSkillContent): AppSkillDefinition => {
   try {
-    const fields = validateSkillContent(input);
-    fields.instructions = fields.instructions.replace(
-      /\]\((references\/[a-z0-9][a-z0-9._-]*\.md)\)/g,
-      (_, path: string) => `](/skills/${fields.name}/${path})`,
-    );
-    // Link expansion must respect the same instruction size limits.
-    const validated = validateSkillContent(fields);
+    const validated = validateSkillContent(input);
     const paths = new Set(validated.references.map((ref) => ref.path));
     for (const match of validated.instructions.matchAll(/references\/[^\s\])`"'<>]+\.md/g)) {
       const path = match[0];

package/src/ai/audio-tool.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { aiChatAccessSubject, resolveAssistantAudioModel } from "./assistant-models";
+import { aiMissingChatFileError } from "./file-error";
 import { aiProjectFilePathFromMount } from "./file-mount";
 import { aiFileStore, normalizeAiFilePath } from "./files-store";
 import { defineAiTool } from "./tools";
@@ -43,7 +44,7 @@ export const createCloudAiTranscribeAudioTool = (options: { resolveModel?: () =>
       projectPath !== null
         ? await ctx.projectFiles?.read(projectPath)
         : (snapshot ?? (await aiFileStore.read({ conversationId: ctx.conversationId, path })));
-    if (!stored) throw new Error(`No such audio file: ${path}`);
+    if (!stored) throw aiMissingChatFileError(path, projectPath === null && ctx.localToolsEnabled, `No such audio file: ${path}`);
     const result = await runAiTranscription({
       task: "transcribe-audio",
       file: new Blob([new Uint8Array(stored.bytes)]),

package/src/ai/browser.ts

@@ -17,29 +17,104 @@ export {
   type CloudAiChartColumn,
   type CloudAiChartRow,
   type CloudAiChartTable,
+  chartDrawingIssue,
+  cloudAiChartLegend,
+  cloudAiChartMarkKey,
+  cloudAiChartMarks,
+  cloudAiChartReferenceMark,
+  cloudAiChartRenderOptions,
+  cloudAiChartRows,
   cloudAiChartTable,
+  cloudAiChartXValueFormat,
+  cloudAiNumberFormatters,
 } from "./chart-block";
 export { parseAiSse } from "./client/transport";
 export {
   CLOUD_AI_CHART_MAX_SERIES,
   CLOUD_AI_CHART_MAX_VALUES,
+  CLOUD_AI_GROUP_MAX_CHARTS,
   CLOUD_AI_TEXT_EDITOR_MAX_CHARS,
+  CLOUD_AI_VIEW_MAX_MARKS,
   CloudAiCardInputSchema,
+  type CloudAiChartInput,
   CloudAiChartInputSchema,
+  type CloudAiDateFormat,
+  type CloudAiFormat,
   CloudAiLocalBashInputSchema,
+  type CloudAiNumberFormat,
   CloudAiSurveyInputSchema,
+  CloudAiSurveyOutputSchema,
   CloudAiTextEditorInputSchema,
+  CloudAiTextEditorOutputSchema,
+  cloudAiAppChartSchema,
+  cloudAiChartSchema,
+  cloudAiFormatSchema,
+  cloudAiNumberFormatSchema,
   parseCloudAiChartInput,
 } from "./default-tool-contracts";
 export { guessAiMediaType } from "./file-media-type";
+export { AI_PROJECT_FILE_MOUNT, AI_SKILL_FILE_MOUNT } from "./file-mount";
 export { AI_IMAGE_INPUT_MAX_BYTES, AI_TURN_ATTACHMENT_MAX_ITEMS, AI_TURN_IMAGE_MAX_TOTAL_BYTES } from "./limits";
 export {
+  AI_LOCAL_BATCH_MAX_ITEMS,
+  AI_LOCAL_INSTRUCTIONS_MAX_BYTES,
+  AI_LOCAL_LIST_MAX_LIMIT,
+  AI_LOCAL_READ_MAX_BYTES,
+  AI_LOCAL_SELECTED_SKILLS_MAX_ITEMS,
+  AI_LOCAL_SKILL_FILES_MAX_ITEMS,
+  AI_LOCAL_SKILLS_MAX_ITEMS,
+  AI_LOCAL_TOOL_NAMES,
+  AI_LOCAL_WRITE_MAX_BYTES,
+  type AiLocalClient,
+  AiLocalClientSchema,
+  type AiLocalContext,
+  AiLocalContextSchema,
+  type AiLocalToolName,
+  type CloudAiLoadLocalSkillInput,
+  CloudAiLoadLocalSkillInputSchema,
+  type CloudAiLoadLocalSkillOutput,
+  CloudAiLoadLocalSkillOutputSchema,
+  type CloudAiLocalDownloadInput,
+  CloudAiLocalDownloadInputSchema,
+  type CloudAiLocalDownloadOutput,
+  CloudAiLocalDownloadOutputSchema,
+  type CloudAiLocalListInput,
+  CloudAiLocalListInputSchema,
+  type CloudAiLocalListOutput,
+  CloudAiLocalListOutputSchema,
+  type CloudAiLocalMoveInput,
+  CloudAiLocalMoveInputSchema,
+  type CloudAiLocalMoveOutput,
+  CloudAiLocalMoveOutputSchema,
+  type CloudAiLocalReadInput,
+  CloudAiLocalReadInputSchema,
+  type CloudAiLocalReadOutput,
+  CloudAiLocalReadOutputSchema,
+  type CloudAiLocalUploadInput,
+  CloudAiLocalUploadInputSchema,
+  type CloudAiLocalUploadOutput,
+  CloudAiLocalUploadOutputSchema,
+  type CloudAiLocalWriteInput,
+  CloudAiLocalWriteInputSchema,
+  type CloudAiLocalWriteOutput,
+  CloudAiLocalWriteOutputSchema,
+} from "./local-tool-contracts";
+export {
+  AI_SKILL_DESCRIPTION_MAX_CHARS,
+  AI_SKILL_EXTRA_FRONTMATTER_MAX_CHARS,
+  AI_SKILL_INSTRUCTIONS_MAX_CHARS,
+  AI_SKILL_NAME_MAX_CHARS,
+  AI_SKILL_REFERENCE_MAX_CHARS,
   AI_SKILL_REFERENCE_MAX_ITEMS,
+  AI_SKILL_REFERENCE_PATH_PATTERN,
   AI_SKILL_REFERENCES_MAX_CHARS,
   type AiSkillDocument,
   type AiSkillReferenceInput,
+  isAiSkillManualOnly,
+  mountAiSkillInstructionLinks,
   parseAiSkillMarkdown,
   serializeAiSkillMarkdown,
+  splitAiSkillMarkdown,
   validateAiSkillReferences,
 } from "./skill-format";
 export { isAiImageMediaType } from "./types";
@@ -112,3 +187,37 @@ export const launchAssistant = async (input: LaunchAssistantInput): Promise<Assi
     href: `/app/assistant?conversation=${encodeURIComponent(conversation.id)}`,
   };
 };
+
+export {
+  CLOUD_AI_STATS_MAX_ITEMS,
+  CLOUD_AI_TABLE_MAX_COLUMNS,
+  CLOUD_AI_TABLE_MAX_ROWS,
+  CLOUD_AI_VIEW_DIRECTORY,
+  CLOUD_AI_VIEW_MAX_BYTES,
+  CLOUD_AI_VIEW_SUFFIX,
+  type CloudAiChartView,
+  type CloudAiDetailsView,
+  type CloudAiExplorerRequest,
+  type CloudAiExplorerView,
+  type CloudAiGroupView,
+  type CloudAiStatsView,
+  type CloudAiTableView,
+  type CloudAiView,
+  type CloudAiViewReference,
+  type CloudAiViewSummary,
+  CloudAiViewSummarySchema,
+  type CloudAiViewTable,
+  checkCloudAiView,
+  cloudAiDetailsRows,
+  cloudAiExplorerControls,
+  cloudAiExplorerState,
+  cloudAiStatsTiles,
+  cloudAiTableTsv,
+  cloudAiViewSummary,
+  cloudAiViewTable,
+  isAiViewFile,
+  isAiViewPath,
+  parseCloudAiChartToolView,
+  parseCloudAiView,
+  sortCloudAiViewRows,
+} from "./view-block";

package/src/ai/capabilities.ts

@@ -84,12 +84,13 @@ export type AiRememberableCapabilityApprovals = ReadonlyMap<string, string>;
 
 /**
  * Why `load_tools` could not make a requested name callable:
+ * - `skill`: the name is an Assistant Skill; load_skill loads it, not load_tools;
  * - `unknown`: no tool has this exact name;
  * - `not_offered_in_turn`: the tool exists, but this turn's client or task does not provide it;
  * - `not_allowed`: the conversation's fixed tool scope or task grants exclude it;
  * - `app_offline`: the app operation is not in the live registry now.
  */
-export const AI_TOOL_UNAVAILABLE_REASONS = ["unknown", "not_offered_in_turn", "not_allowed", "app_offline"] as const;
+export const AI_TOOL_UNAVAILABLE_REASONS = ["unknown", "skill", "not_offered_in_turn", "not_allowed", "app_offline"] as const;
 export type AiToolUnavailableReason = (typeof AI_TOOL_UNAVAILABLE_REASONS)[number];
 
 const DEFAULT_SEARCH_LIMIT = 10;
@@ -585,7 +586,7 @@ export const createAiToolMetaTools = (input: {
   const load = defineAiTool({
     name: "load_tools",
     description:
-      "Load stable capability ids such as mail.conversation.list, or exact built-in names returned by search_tools, as ordinary tools for the next model turn. Skills may name capability ids directly, so load them without searching first. Call each loaded tool by the `call` name returned for it. `unavailable` gives a reason per name: unknown means no tool has this exact name, so look it up once with search_tools instead of guessing; not_offered_in_turn means this client or task does not provide the tool; not_allowed means this chat's fixed tool scope or task grants exclude it; app_offline means its app is not reachable now. For the last three, do not search or load the name again in this turn.",
+      "Load stable capability ids such as mail.conversation.list, or exact built-in names returned by search_tools, as ordinary tools for the next model turn. Skills may name capability ids directly, so load them without searching first. Call each loaded tool by the `call` name returned for it. `unavailable` gives a reason per name: unknown means no tool has this exact name, so look it up once with search_tools instead of guessing; not_offered_in_turn means this client or task does not provide the tool; not_allowed means this chat's fixed tool scope or task grants exclude it; app_offline means its app is not reachable now; skill means the name is an Assistant Skill: call load_skill with it instead. For not_offered_in_turn, not_allowed and app_offline, do not search or load the name again in this turn.",
     inputSchema: z.object({ names: z.array(z.string().trim().min(1)).min(1).max(25) }).strict(),
     outputSchema: z
       .object({
@@ -749,6 +750,8 @@ export const createAiToolResolver =
     mandatePolicy?: MandatePolicyV1 | null;
     /** Built-in tools that exist but that this turn does not offer, such as client tools its client did not declare or tools outside `allowedTools`. */
     unofferedTools?: readonly string[];
+    /** Assistant Skills this turn can load with load_skill. */
+    skillNames?: readonly string[];
     runtimeContext?: Omit<AiToolPreparationContext, "actor" | "conversationId">;
     store: Pick<AiConversationService, "getLoadedTools" | "loadTools">;
     listRegistry?: () => Promise<CapabilityRegistryEntry[]>;
@@ -823,6 +826,7 @@ export const createAiToolResolver =
     );
     // App operation IDs always contain a dot; built-in names never do.
     const unavailableReason = (requested: string): AiToolUnavailableReason => {
+      if (input.skillNames?.includes(requested)) return "skill";
       const name = loadedByProviderName.get(requested) ?? requested;
       if (mandateExcluded.has(name)) return "not_allowed";
       if (allowed && outOfScope.has(name) && !allowed.has(name)) return "not_allowed";