@k2b/cloud 0.31.0 → 0.33.0

package/src/services/approvals/device.ts

@@ -0,0 +1,112 @@
+import {
+  APP_APPROVAL_LIMITS,
+  type AppActionSummary,
+  type AppActionView,
+  appActionDigest,
+  APP_ACTION_LIMITS as limits,
+} from "../../contracts/app-approval";
+import { CapabilityActionReviewSchema } from "../../contracts/capabilities";
+import { DEFAULT_LOCALE } from "../../server/locale";
+import type { PendingApprovalRow } from "./list";
+
+const plain = (value: string): string =>
+  value
+    .replace(/[\p{Cc}\p{Zl}\p{Zp}]/gu, " ")
+    .replace(/\p{Cf}/gu, "")
+    .replace(/\s+/gu, " ")
+    .trim();
+const cut = (value: string, limit: number): string => {
+  const points = Array.from(value);
+  if (limit < 1) return "";
+  return points.length > limit ? `${points.slice(0, limit - 1).join("")}…` : value;
+};
+
+/** A deterministic, plain-text snapshot; the digest binds the device's choice to everything it shows. */
+export const appActionView = async (
+  row: PendingApprovalRow,
+  options: { issuer: string; appName: (appId: string, locale: string) => string },
+): Promise<AppActionView> => {
+  let truncated = false;
+  const text = (value: string, limit: number) => {
+    const cleaned = plain(value);
+    const result = cut(cleaned, limit);
+    if (result !== cleaned) truncated = true;
+    return result;
+  };
+  const locale = row.runConfig?.kind === "compact" ? DEFAULT_LOCALE : (row.runConfig?.locale ?? DEFAULT_LOCALE);
+  const appName = plain(options.appName(row.appId, locale));
+  const app = { id: text(row.appId, limits.nameChars), name: text(appName, limits.nameChars) };
+  const requester = {
+    app: { id: text(row.requesterAppId, limits.nameChars), name: text(options.appName(row.requesterAppId, locale), limits.nameChars) },
+    // The snapshot, so renaming the chat does not change what the device signs.
+    title: text(row.requesterTitle ?? "", limits.titleChars) || null,
+  };
+  const lines = row.sentence.split(/\r?\n/).map(plain).filter(Boolean);
+  const first = lines[0] ?? plain(row.action);
+  const prefix = `${appName}: `;
+  const sentence = first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
+  const review = CapabilityActionReviewSchema.safeParse(row.details);
+  let message: string | null;
+  const details: AppActionView["details"] = [];
+  const detail = (label: string, value: string, format?: "date" | "date-time") => {
+    if (details.length >= limits.details) {
+      truncated = true;
+      return;
+    }
+    const cleanedLabel = text(label, limits.labelChars);
+    if (!cleanedLabel) return;
+    details.push({ label: cleanedLabel, value: text(value, limits.valueChars), ...(format ? { format } : {}) });
+  };
+  const messages: string[] = [];
+  const reviewLines = new Set<string>();
+  if (review.success) {
+    const cleaned = plain(review.data.message);
+    if (cleaned !== sentence) messages.push(cleaned);
+    reviewLines.add(cleaned);
+    for (const line of review.data.message.split(/\r?\n/)) reviewLines.add(plain(line));
+    for (const field of review.data.details ?? [])
+      detail(field.label, field.value, field.format === "date" || field.format === "date-time" ? field.format : undefined);
+  }
+  for (const line of lines.slice(1)) {
+    if (reviewLines.has(line)) continue;
+    const match = /^([^:]{1,40}):\s+(.+)$/.exec(line);
+    if (match) detail(match[1]!, match[2]!);
+    else messages.push(line);
+  }
+  message = text(messages.join(" "), limits.messageChars) || null;
+  const boundedSentence = text(sentence, limits.sentenceChars);
+  const view: AppActionView = {
+    actionId: row.id,
+    app,
+    requester,
+    assurance: row.assurance,
+    sentence: boundedSentence,
+    message,
+    details,
+    truncated,
+    argsDigest: row.argsDigest,
+    createdAt: row.createdAt.toISOString(),
+    expiresAt: row.expiresAt.toISOString(),
+    // Reserve the digest's bytes while bounding the final response.
+    digest: "A".repeat(43),
+  };
+  const bytes = () => new TextEncoder().encode(JSON.stringify(view)).length;
+  while (bytes() > APP_APPROVAL_LIMITS.bodyBytes) {
+    view.truncated = true;
+    if (view.details.length) view.details.pop();
+    else if (view.message) view.message = cut(view.message, Array.from(view.message).length - 1) || null;
+    else break;
+  }
+  view.digest = await appActionDigest(options.issuer, view);
+  return view;
+};
+
+export const appActionSummary = (view: AppActionView): AppActionSummary => ({
+  actionId: view.actionId,
+  app: view.app,
+  requester: view.requester,
+  assurance: view.assurance,
+  sentence: cut(view.sentence, limits.summaryChars),
+  createdAt: view.createdAt,
+  expiresAt: view.expiresAt,
+});

package/src/services/approvals/index.ts

@@ -1,16 +1,18 @@
 import { type SQL, sql } from "bun";
 import { capabilityRequestHash } from "../../capabilities/claims";
+import { APPROVAL_ACP_CLIENT } from "../../contracts/approvals";
 import type { CapabilityActionReview } from "../../contracts/capabilities";
 import { isAppSessionActor } from "../../server/actor";
 import type { RequestActor, RequestCredentialKind } from "../../server/middleware/auth";
 import { audit } from "../audit";
 import { toPgTextArray } from "../postgres";
 
+export { countPending, listPending, presentPendingApproval } from "./list";
 export { migrateApprovals } from "./migrate";
 
 // Derived from chat's AI_ACTION_BUDGET_MS and Studio's one-day abandonment of pending calls.
 export const APPROVAL_MAX_WAIT_MS = 24 * 60 * 60_000;
-export type ApprovalDecisionChannel = "web_session" | "app_session" | "oauth" | "api_key" | "invocation";
+export type ApprovalDecisionChannel = "web_session" | "app_session" | "oauth" | "api_key" | "invocation" | "acp_bridge" | "cloud_login";
 export type ApprovalRequesterKind = "assistant_turn" | "studio_app";
 export type ApprovalStatus = "pending" | "approved" | "rejected" | "expired" | "cancelled" | "consumed";
 export type ApprovalAssurance = "standard" | "confirm";
@@ -25,12 +27,15 @@ export const approvalReviewDigest = (review: CapabilityActionReview | null | und
 export const approvalDecisionChannel = (input: {
   credentialKind?: RequestCredentialKind;
   actor?: RequestActor;
+  client?: string | null;
 }): ApprovalDecisionChannel =>
-  input.credentialKind === "session"
-    ? isAppSessionActor(input.actor)
-      ? "app_session"
-      : "web_session"
-    : (input.credentialKind ?? "invocation");
+  input.client === APPROVAL_ACP_CLIENT
+    ? "acp_bridge"
+    : input.credentialKind === "session"
+      ? isAppSessionActor(input.actor)
+        ? "app_session"
+        : "web_session"
+      : (input.credentialKind ?? "invocation");
 export const approvalScopeFromToolName = (name: string): { appId: string; action: string } => {
   const dot = name.indexOf(".");
   return dot < 0 ? { appId: "assistant", action: name } : { appId: name.slice(0, dot), action: name.slice(dot + 1) };
@@ -123,20 +128,29 @@ export const get = async (id: string, db?: SQL): Promise<ApprovalRequest | null>
 
 export type ApprovalDecisionResult =
   | { ok: true; status: ApprovalStatus; replay: boolean }
-  | { ok: false; code: "EXPIRED" | "NOT_FOUND" }
+  | { ok: false; code: "EXPIRED" | "NOT_FOUND" | "REJECT_ONLY" }
   | { ok: false; code: "ALREADY_DECIDED"; status: ApprovalStatus };
 export const decide = async (
   id: string,
   decision: { approved: boolean },
-  actor: { userId: string; via: ApprovalDecisionChannel },
+  actor: { userId: string; via: ApprovalDecisionChannel; deviceId?: string },
   db?: SQL,
 ): Promise<ApprovalDecisionResult> => {
   const result = await transaction(db, async (tx): Promise<ApprovalDecisionResult> => {
+    // Lock the device before the request so revocation and the decision serialize.
+    if (actor.deviceId !== undefined) {
+      const [device] = await tx`SELECT 1 FROM auth.app_devices
+        WHERE id=${actor.deviceId}::uuid AND user_id=${actor.userId}::uuid AND revoked_at IS NULL FOR SHARE`;
+      if (!device) return { ok: false, code: "NOT_FOUND" };
+    }
     const [row] = await tx<ApprovalRequest[]>`SELECT ${columns()} FROM approvals.requests
       WHERE id=${id}::uuid AND approver_user_id=${actor.userId}::uuid FOR UPDATE`;
     if (!row) return { ok: false, code: "NOT_FOUND" };
+    const rejectOnly = decision.approved && row.assurance === "confirm" && actor.via === "acp_bridge";
     const status = decision.approved ? "approved" : "rejected";
-    const [won] = await tx<ApprovalRequest[]>`
+    const [won] = rejectOnly
+      ? []
+      : await tx<ApprovalRequest[]>`
       UPDATE approvals.requests SET status=${status}, decided_via=${actor.via}, decided_at=now()
       WHERE id=${id}::uuid AND approver_user_id=${actor.userId}::uuid AND status='pending' AND expires_at > now()
       RETURNING ${columns()}
@@ -153,6 +167,7 @@ export const decide = async (
             action: won.action,
             assurance: won.assurance,
             decidedVia: actor.via,
+            ...(actor.deviceId !== undefined ? { deviceId: actor.deviceId } : {}),
             requesterKind: won.requesterKind,
             requesterAppId: won.requesterAppId,
           },
@@ -162,8 +177,9 @@ export const decide = async (
       return { ok: true, status, replay: false };
     }
     if (row.status === "pending") {
-      await tx`UPDATE approvals.requests SET status='expired' WHERE id=${id}::uuid AND status='pending' AND expires_at <= now()`;
-      return { ok: false, code: "EXPIRED" };
+      const [expired] = await tx<{ id: string }[]>`UPDATE approvals.requests SET status='expired'
+        WHERE id=${id}::uuid AND status='pending' AND expires_at <= now() RETURNING id`;
+      return { ok: false, code: expired || !rejectOnly ? "EXPIRED" : "REJECT_ONLY" };
     }
     if (
       (decision.approved && (row.status === "approved" || row.status === "consumed")) ||

package/src/services/approvals/list.ts

@@ -0,0 +1,120 @@
+import { sql } from "bun";
+import { AI_WEBSITE_APPROVAL_TOOL, aiTurnAllowsRememberedApprovals } from "../../ai/approvals";
+import type { AiTurnRunConfig } from "../../ai/types";
+import type { RuntimeAppMeta } from "../../contracts/app";
+import { APPROVALS_PAGE_SIZE, type ApprovalCounts, type PendingApproval } from "../../contracts/approvals";
+import { CapabilityActionReviewSchema } from "../../contracts/capabilities";
+import type { ApprovalAssurance } from ".";
+import { decodeApprovalCursor, encodeApprovalCursor } from "./cursor";
+
+export type PendingApprovalRow = {
+  id: string;
+  appId: string;
+  action: string;
+  argsDigest: string;
+  requesterAppId: string;
+  /** The chat title when Cloud asked; unlike `conversationTitle`, a later rename does not change it. */
+  requesterTitle: string | null;
+  assurance: ApprovalAssurance;
+  sentence: string;
+  details: unknown;
+  createdAt: Date;
+  expiresAt: Date;
+  cursorCreatedAt: string;
+  conversationShortId: string;
+  conversationTitle: string | null;
+  allowChat: boolean | null;
+  allowAlways: boolean;
+  rememberToolName: string | null;
+  toolName: string;
+  runConfig: AiTurnRunConfig | null;
+};
+
+// Start with this person's indexed pending rows; a Studio page alone cannot continue a chat.
+const openRequests = (approverUserId: string, id?: string) => sql`SELECT r.* FROM approvals.requests r
+  WHERE r.approver_user_id=${approverUserId}::uuid AND r.status='pending' AND r.expires_at > now()
+    AND (${id ?? null}::uuid IS NULL OR r.id=${id ?? null}::uuid)
+    AND EXISTS (SELECT 1 FROM ai.pending_actions p WHERE p.approval_id=r.id AND p.status='pending')`;
+const matches = (appId?: string, link?: string) => sql`
+  (${appId ?? null}::text IS NULL OR r.app_id=${appId ?? null} OR r.requester_app_id=${appId ?? null})
+  AND (${link ?? null}::text IS NULL OR COALESCE(r.details->'links' @> jsonb_build_array(jsonb_build_object('href', ${link ?? null}::text)),false))`;
+
+export const listPending = async (input: {
+  approverUserId: string;
+  id?: string;
+  appId?: string;
+  link?: string;
+  cursor?: string;
+  limit?: number;
+}): Promise<{ items: PendingApprovalRow[]; nextCursor: string | null; count: number; elsewhere: number }> => {
+  const limit = input.limit ?? APPROVALS_PAGE_SIZE;
+  if (!Number.isInteger(limit) || limit < 1 || limit > APPROVALS_PAGE_SIZE) throw new RangeError("Invalid approval page size.");
+  const cursor = input.cursor ? decodeApprovalCursor(input.cursor) : null;
+  if (input.cursor && !cursor) throw new RangeError("Invalid approval cursor.");
+  const [counts] = await sql<{ count: number; elsewhere: number }[]>`WITH open AS (${openRequests(input.approverUserId, input.id)})
+    SELECT count(*) FILTER (WHERE ${matches(input.appId, input.link)})::int AS count,
+      count(*) FILTER (WHERE NOT (${matches(input.appId, input.link)}))::int AS elsewhere FROM open r`;
+  const rows = await sql<PendingApprovalRow[]>`WITH open AS (${openRequests(input.approverUserId, input.id)})
+    SELECT r.id, r.app_id AS "appId", r.action, r.requester_app_id AS "requesterAppId", r.requester_title AS "requesterTitle", r.assurance, r.sentence, r.details, r.args_digest AS "argsDigest",
+      r.created_at AS "createdAt", r.expires_at AS "expiresAt",
+      to_char(r.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS "cursorCreatedAt",
+      question.short_id AS "conversationShortId", question.title AS "conversationTitle",
+      question.allow_chat AS "allowChat", question.allow_always AS "allowAlways",
+      question.remember_tool_name AS "rememberToolName", question.tool_name AS "toolName", question.run_config AS "runConfig"
+    FROM open r JOIN LATERAL (
+      SELECT c.short_id, c.title, p.allow_chat, p.allow_always, p.remember_tool_name, p.tool_name, t.run_config
+      FROM ai.pending_actions p JOIN ai.conversations c ON c.id=p.conversation_id JOIN ai.turns t ON t.id=p.turn_id
+      WHERE p.approval_id=r.id AND p.status='pending' ORDER BY p.created_at DESC, p.id DESC LIMIT 1
+    ) question ON true
+    WHERE ${matches(input.appId, input.link)}
+      AND (${cursor?.id ?? null}::uuid IS NULL OR (r.created_at,r.id) < (${cursor?.createdAt ?? null}::timestamptz,${cursor?.id ?? null}::uuid))
+    ORDER BY r.created_at DESC,r.id DESC LIMIT ${limit + 1}`;
+  const items = rows.slice(0, limit);
+  const last = items.at(-1);
+  return {
+    items,
+    nextCursor: rows.length > limit && last ? encodeApprovalCursor({ createdAt: last.cursorCreatedAt, id: last.id }) : null,
+    count: counts?.count ?? 0,
+    elsewhere: counts?.elsewhere ?? 0,
+  };
+};
+
+export const countPending = async (input: { approverUserId: string }): Promise<ApprovalCounts> => {
+  const [row] = await sql<ApprovalCounts[]>`WITH open AS MATERIALIZED (${openRequests(input.approverUserId)}),
+    app_requests AS (SELECT DISTINCT r.id AS request_id, app.id AS app_id FROM open r
+      CROSS JOIN LATERAL unnest(ARRAY[r.app_id,r.requester_app_id]) app(id)),
+    app_counts AS (SELECT app_id AS id,count(*)::int AS count FROM app_requests GROUP BY app_id)
+    SELECT (SELECT count(*)::int FROM open) AS total,
+      COALESCE((SELECT jsonb_object_agg(id,count) FROM app_counts),'{}'::jsonb) AS apps`;
+  return row ?? { total: 0, apps: {} };
+};
+
+export const presentPendingApproval = (
+  row: PendingApprovalRow,
+  apps: readonly Pick<RuntimeAppMeta, "id" | "name" | "icon">[],
+): PendingApproval => {
+  const app = apps.find((entry) => entry.id === row.appId);
+  const review = CapabilityActionReviewSchema.nullable().safeParse(row.details);
+  const remember = row.assurance === "standard" && aiTurnAllowsRememberedApprovals(row.runConfig);
+  return {
+    id: row.id,
+    app: { id: row.appId, name: app?.name ?? row.appId, icon: app?.icon ?? null },
+    action: row.action,
+    assurance: row.assurance,
+    sentence: row.sentence,
+    review: review.success ? review.data : null,
+    requester: {
+      kind: "chat",
+      appId: row.requesterAppId,
+      title: row.conversationTitle,
+      href: `/app/assistant?conversation=${encodeURIComponent(row.conversationShortId)}`,
+    },
+    remember: {
+      chat: remember && (row.allowChat ?? row.allowAlways),
+      always: remember && row.allowAlways,
+      website: (row.rememberToolName ?? row.toolName) === AI_WEBSITE_APPROVAL_TOOL,
+    },
+    createdAt: row.createdAt.toISOString(),
+    expiresAt: row.expiresAt.toISOString(),
+  };
+};

package/src/services/approvals/migrate.ts

@@ -20,7 +20,7 @@ export const migrateApprovals = async (): Promise<void> => {
       args_digest TEXT NOT NULL,
       review_digest TEXT NOT NULL,
       status TEXT NOT NULL DEFAULT 'pending' CHECK (status IN ('pending','approved','rejected','expired','cancelled','consumed')),
-      decided_via TEXT CHECK (decided_via IS NULL OR decided_via IN ('web_session','app_session','oauth','api_key','invocation')),
+      decided_via TEXT CHECK (decided_via IS NULL OR decided_via IN ('web_session','app_session','oauth','api_key','invocation','acp_bridge','cloud_login')),
       decided_at TIMESTAMPTZ,
       consumed_at TIMESTAMPTZ,
       created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
@@ -28,6 +28,14 @@ export const migrateApprovals = async (): Promise<void> => {
       UNIQUE (requester_kind, requester_ref)
     )
   `.simple();
+  await sql`DO $$ BEGIN
+    IF EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid='approvals.requests'::regclass
+      AND conname='requests_decided_via_check' AND position('cloud_login' in pg_get_constraintdef(oid))=0) THEN
+      ALTER TABLE approvals.requests DROP CONSTRAINT requests_decided_via_check;
+      ALTER TABLE approvals.requests ADD CONSTRAINT requests_decided_via_check
+        CHECK (decided_via IS NULL OR decided_via IN ('web_session','app_session','oauth','api_key','invocation','acp_bridge','cloud_login'));
+    END IF;
+  END $$`.simple();
   await sql`CREATE INDEX IF NOT EXISTS approvals_requests_pending ON approvals.requests(approver_user_id, created_at) WHERE status='pending'`.simple();
   await sql`CREATE INDEX IF NOT EXISTS approvals_requests_expiry ON approvals.requests(expires_at)`.simple();
 };

package/src/services/identity/models-only-auth.ts

@@ -0,0 +1,25 @@
+import { AI_INFERENCE_SCOPE, type User } from "../../contracts/shared";
+import { isAccountExpired } from "../account-model";
+import { serviceAccountCredentials } from "../service-account-credentials";
+
+export const authenticateModelsOnlyCredential = async (
+  token: string | null | undefined,
+): Promise<{ user: User; credentialId: string } | null> => {
+  if (!token || !serviceAccountCredentials.isApiToken(token)) return null;
+  const authenticated = await serviceAccountCredentials.authenticateApiToken(token);
+  if (!authenticated) return null;
+  const { credential, serviceAccount, delegatedUser } = authenticated;
+  if (
+    credential.kind !== "api_token" ||
+    credential.status !== "active" ||
+    credential.serviceAccountId !== serviceAccount.id ||
+    serviceAccount.status !== "active" ||
+    serviceAccount.kind !== "user_delegated" ||
+    !delegatedUser ||
+    serviceAccount.delegatedUserId !== delegatedUser.id ||
+    !credential.scopes.includes(AI_INFERENCE_SCOPE) ||
+    isAccountExpired(delegatedUser.accountExpires)
+  )
+    return null;
+  return { user: delegatedUser, credentialId: credential.id };
+};

package/src/services/notifications/email-frame.ts

@@ -1,5 +1,5 @@
 import sanitizeHtml from "sanitize-html";
-import { sanitizeEmailHtml } from "../../shared/email-html";
+import { EMAIL_HTML_SANITIZE_OPTIONS } from "../../shared/email-html";
 import * as settings from "../settings";
 import { coreSettings } from "../settings/api";
 
@@ -8,16 +8,29 @@ const sanitizeContent = (content: string): string => sanitizeHtml(content, { all
 // sanitize-html decodes entities before escaping &, < and > again. Decode only
 // those escapes once, so literal entity text is not recursively interpreted.
 const htmlText = (html: string): string =>
-  sanitizeContent(html.replace(/<br\b[^>]*>|<\/(?:p|div|h[1-6]|li|tr|td|th|ul|ol|table)>/gi, " "))
+  sanitizeContent(html.replace(/<br\b[^>]*>|<\/(?:p|pre|blockquote|div|h[1-6]|li|tr|td|th|ul|ol|table)>/gi, " "))
     .replace(/&(amp|lt|gt);/g, (entity) => (entity === "&amp;" ? "&" : entity === "&lt;" ? "<" : ">"))
     .replace(/\s+/g, " ")
     .trim();
 
+// The frame has no stylesheet, so a `pre` would keep the client default `white-space: pre` and push long
+// lines past the frame. The sender's own style comes last and still wins.
+const frameHtmlOptions = {
+  ...EMAIL_HTML_SANITIZE_OPTIONS,
+  transformTags: {
+    ...EMAIL_HTML_SANITIZE_OPTIONS.transformTags,
+    pre: (tagName, attribs) => ({
+      tagName,
+      attribs: { ...attribs, style: `white-space:pre-wrap;overflow-wrap:break-word;${attribs.style ?? ""}` },
+    }),
+  },
+} satisfies sanitizeHtml.IOptions;
+
 export const prepareNotificationEmail = async (opts: { content?: string; rawHtml?: string }): Promise<{ html: string; text: string }> => {
   const rawAppUrl = await settings.get<string>("app.url");
   const appUrl = rawAppUrl.startsWith("http") ? rawAppUrl : `https://${rawAppUrl}`;
   const appName = await settings.get<string>("app.name");
-  const body = opts.rawHtml ? sanitizeEmailHtml(opts.rawHtml) : opts.content ? `<p>${sanitizeContent(opts.content)}</p>` : "";
+  const body = opts.rawHtml ? sanitizeHtml(opts.rawHtml, frameHtmlOptions) : opts.content ? `<p>${sanitizeContent(opts.content)}</p>` : "";
   return { html: await buildHtml(appUrl, appName, body), text: opts.content ? sanitizeContent(opts.content) : htmlText(body) };
 };
 

package/src/services/outbox.ts

@@ -14,9 +14,10 @@ import { logger } from "./logging";
  * the dispatcher publishes keys concurrently and the rows of one key in order,
  * then completes the batch in one statement. A batch starts no publish after
  * its claim has ended, because the next claim takes its rows. A row that never
- * failed is due at once. Claims stay proportional to the batch with an index on
- * the `where` columns and `sequence`, and one on the `where` columns and
- * `orderBy` limited to `claimed_until IS NOT NULL OR attempts > 0`.
+ * failed is due at once. Claims stay proportional to the batch, whatever the
+ * table's statistics say, with an index on the `where` columns and `sequence`,
+ * and one on the `where` columns and `orderBy` limited to
+ * `claimed_until IS NOT NULL OR attempts > 0`.
  *
  * Required columns: `id uuid`, `attempts int`, `next_attempt_at timestamptz`,
  * `claimed_until timestamptz`, `last_error text`, and the `orderBy` and
@@ -97,13 +98,20 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
       const cap = Math.min(Math.max(limit, 1), batchSize);
       // Claims take turns: a concurrent claim would skip this one's locked rows and take later rows of the same keys.
       // A claim that outlives its claim period is worthless, so neither a slow statement nor a vanished client holds the turn longer.
+      // Without sequential and bitmap scans, statistics of an empty or claimed outbox cannot make a claim scan and sort
+      // the whole backlog instead of walking the sequence index up to the batch. A disabled scan still counts as very
+      // expensive, which would compile every claim (JIT, ~0.4 s), so JIT stays off.
       await tx`
         SELECT set_config('statement_timeout', ${String(claimMs)}, true),
                set_config('idle_in_transaction_session_timeout', ${String(claimMs)}, true),
+               set_config('enable_seqscan', 'off', true),
+               set_config('enable_bitmapscan', 'off', true),
+               set_config('jit', 'off', true),
                pg_advisory_xact_lock(hashtextextended(${claimLock}, 0))
       `;
       // The busy probe runs per candidate (OFFSET 0 keeps the planner from turning it into a join, which
-      // stale statistics can make quadratic), against an index of claimed and retried rows per key.
+      // stale statistics can make quadratic), against an index of claimed and retried rows per key. The update looks
+      // its rows up by id for the same reason: as a join, it scanned the whole table per claim.
       return tx<Row[]>`
         WITH candidates AS MATERIALIZED (
           SELECT current.id
@@ -125,8 +133,7 @@ export const createPgOutbox = <Row extends OutboxRow>(config: PgOutboxConfig<Row
         ), claimed AS (
           UPDATE ${table} outbox
           SET claimed_until = now() + (${claimMs} * interval '1 millisecond')
-          FROM candidates
-          WHERE outbox.id = candidates.id
+          WHERE outbox.id = ANY(ARRAY(SELECT id FROM candidates))
           RETURNING outbox.*
         )
         SELECT * FROM claimed ORDER BY ${sequence}

package/src/services/service-account-credentials.ts

@@ -1,7 +1,7 @@
 import { createHash, timingSafeEqual } from "node:crypto";
 import { crypto, err, fail, ok, type PageParams, type Paginated, type Result } from "@k2b/stdlib";
 import { type SQL, sql } from "bun";
-import type { User } from "../contracts/shared";
+import { AI_INFERENCE_SCOPE, type User } from "../contracts/shared";
 import { accounts } from "./accounts";
 import { audit } from "./audit";
 import { isUniqueViolation, toPgTextArray } from "./postgres";
@@ -199,12 +199,16 @@ const generateTokenParts = (): { tokenPrefix: string; secret: string; token: str
 };
 
 // API token secrets carry 256 bits of entropy, so a fast digest is sufficient and avoids password-KDF cost per request.
-const hashApiTokenSecret = (secret: string): string => `sha256:${createHash("sha256").update(secret).digest("hex")}`;
+// Domain-separate models-only keys so older platforms fail verification instead of granting full authority.
+const hashApiTokenSecret = (secret: string, scopes: readonly string[]): string =>
+  `sha256:${createHash("sha256")
+    .update(scopes.includes(AI_INFERENCE_SCOPE) ? `${AI_INFERENCE_SCOPE}:${secret}` : secret)
+    .digest("hex")}`;
 
-const verifyApiTokenSecret = async (secret: string, storedHash: string): Promise<boolean> => {
+const verifyApiTokenSecret = async (secret: string, storedHash: string, scopes: readonly string[]): Promise<boolean> => {
   const match = storedHash.match(SECRET_HASH_PATTERN);
   if (match) {
-    const actual = Buffer.from(hashApiTokenSecret(secret).slice("sha256:".length), "hex");
+    const actual = Buffer.from(hashApiTokenSecret(secret, scopes).slice("sha256:".length), "hex");
     const expected = Buffer.from(match[1]!, "hex");
     return timingSafeEqual(actual, expected);
   }
@@ -338,7 +342,7 @@ const insertApiToken = async (
   }
 
   const parts = await generateUniqueTokenParts();
-  const secretHash = hashApiTokenSecret(parts.secret);
+  const secretHash = hashApiTokenSecret(parts.secret, params.scopes ?? []);
 
   try {
     const [row] = await db<DbCredentialRow[]>`
@@ -371,16 +375,20 @@ const insertApiToken = async (
   }
 };
 
-export const createApiToken = (params: {
+export const createApiToken = async (params: {
   serviceAccountId: string;
   name: string;
   createdBy?: string | null;
   expiresAt?: string | null;
   scopes?: string[];
-}): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => insertApiToken(sql, params);
+}): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
+  if (params.scopes?.includes(AI_INFERENCE_SCOPE)) return fail(err.badInput("ai:inference is reserved for models-only personal API keys"));
+  return insertApiToken(sql, params);
+};
 
 export const createUserApiToken = async (params: {
   user: User;
+  access?: "full" | "models";
   name: string;
   expiresAt?: string | null;
 }): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
@@ -396,6 +404,7 @@ export const createUserApiToken = async (params: {
       name: params.name,
       expiresAt: params.expiresAt,
       createdBy: params.user.id,
+      scopes: params.access === "models" ? [AI_INFERENCE_SCOPE] : [],
     });
 
     return audit.recordResult({
@@ -404,6 +413,7 @@ export const createUserApiToken = async (params: {
       target: { type: "service_account_credential", id: result.ok ? result.data.credential.id : null, label: params.name },
       metadata: {
         serviceAccountId: serviceAccountResult.data.id,
+        access: params.access ?? "full",
         kind: "api_token",
         expiresAt: params.expiresAt ?? null,
       },
@@ -420,6 +430,7 @@ export const createResourceApiToken = async (params: {
   expiresAt?: string | null;
   scopes?: string[];
 }): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
+  if (params.scopes?.includes(AI_INFERENCE_SCOPE)) return fail(err.badInput("ai:inference is reserved for models-only personal API keys"));
   const serviceAccount = await serviceAccounts.get({ id: params.serviceAccountId });
   if (!serviceAccount || serviceAccount.kind !== "resource_bound") return fail(err.notFound("Resource service account"));
   if (serviceAccount.status !== "active") return fail(err.badInput("Resource service account is disabled"));
@@ -460,6 +471,7 @@ export const createStandaloneApiToken = async (params: {
   expiresAt?: string | null;
   scopes?: string[];
 }): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
+  if (params.scopes?.includes(AI_INFERENCE_SCOPE)) return fail(err.badInput("ai:inference is reserved for models-only personal API keys"));
   const serviceAccount = await serviceAccounts.get({ id: params.serviceAccountId });
   if (!serviceAccount || !isStandaloneServiceAccountKind(serviceAccount.kind)) return fail(err.notFound("Service account"));
   if (serviceAccount.status !== "active") return fail(err.badInput("Service account is disabled"));
@@ -780,7 +792,7 @@ const recordSuccessfulAuthentication = async (params: {
   serviceAccount: ServiceAccount;
   delegatedUser: User | null;
 }): Promise<void> => {
-  const upgradedSecretHash = SECRET_HASH_PATTERN.test(params.row.secret_hash) ? null : hashApiTokenSecret(params.secret);
+  const upgradedSecretHash = SECRET_HASH_PATTERN.test(params.row.secret_hash) ? null : hashApiTokenSecret(params.secret, params.row.scopes);
   if (!upgradedSecretHash && !params.row.activity_due) return;
 
   if (upgradedSecretHash) {
@@ -836,10 +848,10 @@ const recordSuccessfulAuthentication = async (params: {
 const pendingSecretVerifications = new Map<string, Promise<boolean>>();
 
 const verifyApiTokenSecretOnce = async (secret: string, row: DbCredentialWithSecretRow): Promise<boolean> => {
-  const key = `${row.id}:${row.secret_hash}:${hashApiTokenSecret(secret)}`;
+  const key = `${row.id}:${row.secret_hash}:${hashApiTokenSecret(secret, row.scopes)}`;
   let pending = pendingSecretVerifications.get(key);
   if (!pending) {
-    pending = verifyApiTokenSecret(secret, row.secret_hash);
+    pending = verifyApiTokenSecret(secret, row.secret_hash, row.scopes);
     pendingSecretVerifications.set(key, pending);
   }
   try {

package/src/services/settings/core-settings.ts

@@ -296,6 +296,13 @@ export const CORE_SETTINGS = {
     placeholder: "Keep answers concise. The current user is {{ user.displayName }} and today is {{ today }}.",
     templateVars: ["user.displayName", "user.uid", "user.mail", "appId", "now", "today", "time"],
   },
+  "ai.local_client_instructions": {
+    kind: "text",
+    label: "Instructions for local clients",
+    default: "",
+    description:
+      "Added to turns from local clients such as cld after the organization instructions. Leave empty to use the built-in text, which improves with each release.",
+  },
   "ai.compaction_instructions": {
     kind: "text",
     label: "Additional Compaction Instructions",
@@ -328,6 +335,26 @@ export const CORE_SETTINGS = {
     description: "Firecrawl API key used by Cloud AI web_search and web_extract tools.",
     placeholder: "fc-...",
   },
+  "ai.openai_api_enabled": {
+    kind: "boolean",
+    label: "OpenAI-compatible API",
+    default: false,
+    description:
+      "Let people create API keys with the access “AI models only” and call the Assistant models they may use. Checked on every request: turning this off stops existing keys too. Models without reference prices have no usage limit; only the rate limit and the concurrent request limit protect them.",
+  },
+  // Default 4: one process runs at most 8 chat turns at once (AI_TURN_WORKER_CONCURRENCY in ai/runtime.ts), and this
+  // synchronous API bypasses that queue, so one person may hold at most half of it. Typical clients need 1-2 (one
+  // request after another plus a connection test); 4 leaves room for a second client without letting a script in a
+  // loop crowd out everyone else. Operators with more provider capacity raise it.
+  "ai.openai_api_max_concurrent_requests": {
+    kind: "number",
+    label: "OpenAI API concurrent requests per person",
+    integer: true,
+    min: 1,
+    max: 64,
+    default: 4,
+    description: "Maximum simultaneous OpenAI-compatible API requests per person across all Cloud instances.",
+  },
   // ── PDF rendering ─────────────────────────────────────────────────────
   "gotenberg.url": {
     kind: "url",