@k2b/cloud 0.37.0 → 0.39.0

package/src/browser/panel-slot.ts

@@ -0,0 +1,354 @@
+import { attachResizeSeparator, parkWorkspaceDetailDrawers } from "@k2b/ui";
+import { PANEL_MAX_WIDTH_REM, PANEL_MIN_WIDTH_REM, readPanelCookie, serializePanelCookie } from "../_internal/panel-cookie";
+import { platformMessages } from "../ssr/platform-messages";
+import { readShellData } from "../ssr/shell-data";
+import type { PanelRequest } from "./panel";
+import { isPanelCloseMessage, isPanelReadyMessage } from "./panel-messages";
+
+export const PANEL_READY_TIMEOUT_MS = 10_000;
+let installed: { dispose: () => void; request: (request: PanelRequest) => void } | undefined;
+
+export function handlePanelRequest(request: PanelRequest): void {
+  installed?.request(request);
+}
+
+/** Owns the slot's single iframe, independently persisted desktop and transient phone state. */
+export function installPanelSlot(): () => void {
+  if (installed) return installed.dispose;
+  const canvas = document.querySelector<HTMLElement>(".cloud-app-canvas");
+  const slot = document.getElementById("cloud-panel");
+  const body = slot?.querySelector<HTMLElement>(".cloud-panel__body");
+  const panel = readShellData()?.panel;
+  if (!canvas || !slot || !body || !panel?.providers.length) return () => {};
+  const t = platformMessages.resolve([document.documentElement.lang || "en"]).t;
+  // The mode uses the same px breakpoint as panel.css and the shell, read fresh, so CSS and the controller always
+  // agree; `phoneChange` only tells when to look again.
+  const isPhone = () => !window.matchMedia("(min-width: 768px)").matches;
+  const phoneChange = window.matchMedia("(max-width: 767.98px)");
+  const column = window.matchMedia("(min-width: 1024px)");
+  const attribute = () => (isPhone() ? "data-panel-sheet" : "data-panel");
+  const isOpen = () => canvas.getAttribute(attribute()) === "open";
+  const status = slot.querySelector<HTMLElement>("[data-cloud-panel-status]");
+  const separator = slot.querySelector<HTMLElement>(".cloud-panel__resize");
+  const tabs = [...slot.querySelectorAll<HTMLButtonElement>("[data-cloud-panel-provider]")];
+  const grow = slot.querySelector<HTMLButtonElement>("[data-cloud-panel-grow]");
+  let provider = panel.providers.find((item) => item.id === slot.dataset.provider) ?? panel.providers[0]!;
+  let frame = slot.querySelector<HTMLIFrameElement>("[data-cloud-panel-frame]");
+  let search: string | undefined;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let opener: HTMLElement | undefined;
+  const rem = () => parseFloat(getComputedStyle(document.documentElement).fontSize) || 16;
+  const storedWidth = parseFloat(canvas.style.getPropertyValue("--cloud-panel-width-set"));
+  let committedWidth = Number.isFinite(storedWidth) ? storedWidth : undefined;
+  let width = committedWidth ?? PANEL_MIN_WIDTH_REM;
+  const setWidth = (value: number) => {
+    width = value;
+    canvas.style.setProperty("--cloud-panel-width-set", `${value}rem`);
+    separator?.setAttribute("aria-valuenow", String(Math.round(value * 100) / 100));
+  };
+  const seedWidth = () => {
+    if (committedWidth !== undefined || !column.matches || !isOpen()) return;
+    const measured = slot.getBoundingClientRect().width / rem();
+    if (measured > 0) width = Math.min(PANEL_MAX_WIDTH_REM, Math.max(PANEL_MIN_WIDTH_REM, measured));
+    separator?.setAttribute("aria-valuenow", String(Math.round(width * 100) / 100));
+  };
+  // Another tab may have saved a newer width; opening or closing keeps it instead of writing back an old one.
+  const adoptStoredWidth = (apply: boolean) => {
+    const stored = readPanelCookie(
+      document.cookie,
+      panel.providers.map((item) => item.id),
+    ).widthRem;
+    if (stored === undefined) return;
+    committedWidth = stored;
+    if (apply && stored !== width) setWidth(stored);
+  };
+  const writeCookie = () => {
+    if (isPhone() || canvas.hasAttribute("data-panel-transient")) return;
+    document.cookie = serializePanelCookie(
+      { open: canvas.dataset.panel === "open", provider: provider.id, widthRem: committedWidth },
+      location.protocol === "https:",
+    );
+  };
+  const update = () => {
+    for (const button of document.querySelectorAll("[data-cloud-panel-toggle]")) button.setAttribute("aria-expanded", String(isOpen()));
+    for (const tab of tabs) {
+      const selected = tab.dataset.cloudPanelProvider === provider.id;
+      tab.setAttribute("aria-selected", String(selected));
+      tab.tabIndex = selected ? 0 : -1;
+    }
+    const description = slot.querySelector<HTMLElement>(".k2b-placeholder__description");
+    if (description) description.textContent = t.panelNotResponding({ label: provider.label });
+  };
+  const clearTimer = () => {
+    clearTimeout(timer);
+    timer = undefined;
+  };
+  const loading = () => {
+    clearTimer();
+    slot.dataset.state = "loading";
+    if (status) status.textContent = t.panelLoading({ label: provider.label });
+    timer = setTimeout(() => {
+      slot.dataset.state = "failed";
+      if (status) status.textContent = `${t.panelLoadFailed}. ${t.panelNotResponding({ label: provider.label })}`;
+    }, PANEL_READY_TIMEOUT_MS);
+  };
+  const markReady = () => {
+    clearTimer();
+    slot.dataset.state = "ready";
+    if (status) status.textContent = "";
+  };
+  const unload = () => {
+    clearTimer();
+    frame?.remove();
+    frame = null;
+    slot.dataset.state = "closed";
+    if (status) status.textContent = "";
+  };
+  const target = () => {
+    const url = new URL(provider.href, location.origin);
+    if (search !== undefined) url.search = search;
+    return url;
+  };
+  // The page the iframe shows now; a reader may have moved on inside the panel since it loaded.
+  const shownHref = () => {
+    try {
+      return frame?.contentWindow?.location.href;
+    } catch {
+      return undefined;
+    }
+  };
+  const load = (replace = false) => {
+    const url = target();
+    if (!replace && frame?.src === url.href) return;
+    frame?.remove();
+    // The server validates every provider path; the iframe still never leaves this origin.
+    if (url.origin !== location.origin) {
+      frame = null;
+      clearTimer();
+      slot.dataset.state = "failed";
+      return;
+    }
+    frame = document.createElement("iframe");
+    frame.className = "cloud-panel__frame";
+    frame.title = provider.label;
+    frame.dataset.cloudPanelFrame = provider.id;
+    frame.src = url.href;
+    loading();
+    body.append(frame);
+  };
+  let removeFallbackFocus = () => {};
+  const returnFocus = () => {
+    if (opener?.isConnected && opener.getClientRects().length && !opener.closest("[inert]")) {
+      opener.focus();
+      if (document.activeElement === opener) return;
+    }
+    const main = canvas.querySelector<HTMLElement>("[data-cloud-app-area] main.layout-content-main, main[data-cloud-app-area]");
+    if (!main) return;
+    removeFallbackFocus();
+    if (!main.hasAttribute("tabindex")) {
+      main.tabIndex = -1;
+      removeFallbackFocus = () => {
+        main.removeAttribute("tabindex");
+        main.removeEventListener("blur", removeFallbackFocus);
+      };
+      main.addEventListener("blur", removeFallbackFocus, { once: true });
+    }
+    main.focus();
+  };
+  const close = () => {
+    if (!isOpen()) return;
+    canvas.removeAttribute(attribute());
+    disposeResize();
+    disposeResize = attachResize();
+    unload();
+    adoptStoredWidth(false);
+    writeCookie();
+    update();
+    returnFocus();
+  };
+  const open = (id: string, nextSearch?: string) => {
+    const next = panel.providers.find((item) => item.id === id);
+    if (!next) return;
+    parkWorkspaceDetailDrawers(document);
+    const active = document.activeElement;
+    if (active instanceof HTMLElement && active !== document.body && !slot.contains(active)) opener = active;
+    provider = next;
+    search = typeof nextSearch === "string" && nextSearch.length <= 2048 ? nextSearch : undefined;
+    canvas.setAttribute(attribute(), "open");
+    slot.dataset.provider = provider.id;
+    adoptStoredWidth(true);
+    seedWidth();
+    // A requested search is a destination: it replaces a page reached inside the panel.
+    const shown = shownHref();
+    load(search !== undefined && shown !== undefined && shown !== "about:blank" && shown !== target().href);
+    writeCookie();
+    update();
+    frame?.focus();
+  };
+  const request = (request: PanelRequest) => {
+    if (request.action === "open") open(request.provider, request.search);
+    else if (request.action === "close" || isOpen()) close();
+    else open(provider.id, search);
+  };
+  const message = (event: MessageEvent<unknown>) => {
+    if (!frame || event.source !== frame.contentWindow || event.origin !== location.origin) return;
+    if (isPanelReadyMessage(event.data, provider.id)) markReady();
+    else if (isPanelCloseMessage(event.data)) close();
+  };
+  const click = (event: MouseEvent) => {
+    if (!(event.target instanceof Element)) return;
+    if (event.target.closest("[data-cloud-panel-close]")) close();
+    else if (event.target.closest("[data-cloud-panel-retry]") && isOpen()) {
+      load(true);
+      frame?.focus();
+    } else if (event.target.closest("[data-cloud-panel-grow]") && isPhone()) {
+      const full = slot.dataset.panelSize !== "full";
+      if (full) slot.dataset.panelSize = "full";
+      else delete slot.dataset.panelSize;
+      grow?.setAttribute("aria-label", full ? t.shrinkPanel : t.enlargePanel);
+    } else {
+      const tab = event.target.closest<HTMLElement>("[data-cloud-panel-provider]");
+      if (tab?.dataset.cloudPanelProvider) open(tab.dataset.cloudPanelProvider);
+    }
+  };
+  const key = (event: KeyboardEvent) => {
+    if (event.defaultPrevented || event.isComposing || event.altKey || event.ctrlKey || event.metaKey || event.shiftKey) return;
+    if (!(event.target instanceof Element) || !slot.contains(event.target)) return;
+    if (event.key === "Escape") {
+      event.preventDefault();
+      close();
+      return;
+    }
+    const index = tabs.findIndex((tab) => tab === event.target);
+    if (index < 0) return;
+    let next: number;
+    if (event.key === "ArrowRight") next = (index + 1) % tabs.length;
+    else if (event.key === "ArrowLeft") next = (index + tabs.length - 1) % tabs.length;
+    else if (event.key === "Home") next = 0;
+    else if (event.key === "End") next = tabs.length - 1;
+    else return; // Buttons activate with native Enter/Space clicks.
+    event.preventDefault();
+    for (const [index, tab] of tabs.entries()) tab.tabIndex = index === next ? 0 : -1;
+    tabs[next]?.focus();
+  };
+  const modeChange = () => {
+    disposeResize();
+    if (isOpen()) {
+      seedWidth();
+      load();
+    } else unload();
+    disposeResize = attachResize();
+    update();
+  };
+  const closeSheet = () => {
+    const wasOpen = canvas.dataset.panelSheet === "open";
+    canvas.removeAttribute("data-panel-sheet");
+    if (wasOpen && isPhone()) {
+      unload();
+      update();
+    }
+  };
+  const pageShow = (event: PageTransitionEvent) => {
+    if (event.persisted) closeSheet();
+  };
+  const entryChange = (event: NavigationCurrentEntryChangeEvent) => {
+    if (event.navigationType === "push") closeSheet();
+  };
+  let dragWidth = width;
+  let dragStoredWidth = committedWidth;
+  let dragInlineWidth = "";
+  const restoreDragWidth = () => {
+    width = dragWidth;
+    committedWidth = dragStoredWidth;
+    if (dragInlineWidth) canvas.style.setProperty("--cloud-panel-width-set", dragInlineWidth);
+    else canvas.style.removeProperty("--cloud-panel-width-set");
+    separator?.setAttribute("aria-valuenow", String(Math.round(width * 100) / 100));
+  };
+  let endingDrag = false;
+  seedWidth();
+  const attachResize = () =>
+    separator && column.matches
+      ? attachResizeSeparator(separator, {
+          min: PANEL_MIN_WIDTH_REM,
+          max: PANEL_MAX_WIDTH_REM,
+          value: () => width,
+          get unit() {
+            return rem();
+          },
+          step: 1,
+          largeStep: 4,
+          grow: "start",
+          collapseBelow: 16,
+          onResize: (value) => {
+            if (endingDrag) {
+              endingDrag = false;
+              restoreDragWidth();
+            } else setWidth(value);
+          },
+          onResizeEnd: (value) => {
+            endingDrag = false;
+            committedWidth = value;
+            writeCookie();
+          },
+          onCollapseIntent: (armed) => {
+            if (armed) slot.dataset.closing = "true";
+            else delete slot.dataset.closing;
+          },
+          onCollapse: () => {
+            endingDrag = false;
+            restoreDragWidth();
+            close();
+          },
+          onDragChange: (dragging) => {
+            if (dragging) {
+              dragWidth = width;
+              dragStoredWidth = committedWidth;
+              dragInlineWidth = canvas.style.getPropertyValue("--cloud-panel-width-set");
+              slot.dataset.resizing = "true";
+            } else {
+              delete slot.dataset.resizing;
+              endingDrag = true;
+            }
+          },
+        })
+      : () => {};
+  let disposeResize = attachResize();
+  window.addEventListener("message", message);
+  window.addEventListener("keydown", key);
+  slot.addEventListener("click", click);
+  phoneChange.addEventListener("change", modeChange);
+  column.addEventListener("change", modeChange);
+  window.addEventListener("pageshow", pageShow);
+  window.addEventListener("popstate", closeSheet);
+  window.navigation?.addEventListener("currententrychange", entryChange);
+  window.addEventListener("resize", seedWidth);
+  // An SSR iframe can have posted its one-shot ready before this lazy module
+  // arrived. Its runtime also marks its own same-origin document, so read that
+  // once the listener is in place instead of loading the provider again.
+  if (isOpen() && frame) {
+    if (frame.contentDocument?.documentElement.dataset.cloudPanelReady === provider.id) markReady();
+    else loading();
+  } else if (isOpen()) load();
+  else unload();
+  update();
+  let disposed = false;
+  const dispose = () => {
+    if (disposed) return;
+    disposed = true;
+    clearTimer();
+    disposeResize();
+    removeFallbackFocus();
+    window.removeEventListener("message", message);
+    window.removeEventListener("keydown", key);
+    slot.removeEventListener("click", click);
+    phoneChange.removeEventListener("change", modeChange);
+    column.removeEventListener("change", modeChange);
+    window.removeEventListener("pageshow", pageShow);
+    window.removeEventListener("popstate", closeSheet);
+    window.navigation?.removeEventListener("currententrychange", entryChange);
+    window.removeEventListener("resize", seedWidth);
+    installed = undefined;
+  };
+  installed = { dispose, request };
+  return dispose;
+}

package/src/browser/panel.ts

@@ -0,0 +1,28 @@
+export type PanelRequest = { action: "open"; provider: string; search?: string; accepted: boolean } | { action: "close" | "toggle" };
+
+declare global {
+  interface WindowEventMap {
+    "cloud.panel.request": CustomEvent<PanelRequest>;
+  }
+}
+
+/** Opens a visible provider. False leaves navigation with the caller when this page has no matching slot. */
+export function openPanel(provider: string, options?: { search?: string }): boolean {
+  const detail: PanelRequest = {
+    action: "open",
+    provider,
+    search: typeof options?.search === "string" && options.search.length <= 2048 ? options.search : undefined,
+    accepted: false,
+  };
+  window.dispatchEvent(new CustomEvent("cloud.panel.request", { detail }));
+  return detail.accepted;
+}
+
+/** Closes the panel when it is open. */
+export function closePanel(): void {
+  if (window.parent !== window && document.querySelector("[data-cloud-panel-page]")) {
+    window.parent.postMessage({ type: "cloud.panel.close" }, location.origin);
+    return;
+  }
+  window.dispatchEvent(new CustomEvent<PanelRequest>("cloud.panel.request", { detail: { action: "close" } }));
+}

package/src/browser/provider-folder.tsx

@@ -1,7 +1,8 @@
 import { timed } from "@k2b/stdlib/solid";
 import { announce, Button, IconButton, Placeholder, TextInput } from "@k2b/ui";
 import { batch, createMemo, createSignal, For, type JSX, Match, onCleanup, Show, Switch } from "solid-js";
-import type { FileProviderEntry } from "../contracts/file-provider";
+import { CloudResourceRefSchema } from "../contracts/capabilities";
+import { FILE_PROVIDER_CONTEXT_MAX_REFS, type FileProviderContext, type FileProviderEntry } from "../contracts/file-provider";
 import type { fileChooserMessages } from "./file-chooser-messages";
 import { type FileProviderCaller, FileProviderError, type FileProviderSource, listProviderFolder } from "./file-providers";
 
@@ -18,7 +19,12 @@ const EMPTY_PAGES_FOLLOWED = 5;
  * and its load state. `settled` runs after a folder has loaded or the source list is back, so the dialog can move
  * focus to its first row.
  */
-export const createProviderFolder = (props: { caller: () => FileProviderCaller; t: () => Messages; settled: () => void }) => {
+export const createProviderFolder = (props: {
+  caller: () => FileProviderCaller;
+  t: () => Messages;
+  settled: () => void;
+  context?: FileProviderContext | ((signal: AbortSignal) => Promise<FileProviderContext>);
+}) => {
   const [location, setLocation] = createSignal<FolderLocation>(null);
   const [filter, setFilter] = createSignal("");
   const [query, setQuery] = createSignal("");
@@ -27,6 +33,26 @@ export const createProviderFolder = (props: { caller: () => FileProviderCaller;
   const [writable, setWritable] = createSignal(false);
   const [status, setStatus] = createSignal<"loading" | "ready" | "more" | "error">("ready");
   const [error, setError] = createSignal<FileProviderError | null>(null);
+  const [contextual, setContextual] = createSignal(false);
+  let resolvedContext: FileProviderContext | undefined;
+  const contextFor = async (signal: AbortSignal): Promise<FileProviderContext> => {
+    if (resolvedContext) return resolvedContext;
+    const raw = typeof props.context === "function" ? await props.context(signal) : props.context;
+    signal.throwIfAborted();
+    const refs: FileProviderContext["refs"] = [];
+    const seen = new Set<string>();
+    for (const value of raw?.refs ?? []) {
+      const parsed = CloudResourceRefSchema.safeParse(value);
+      if (!parsed.success) continue;
+      const key = JSON.stringify([parsed.data.type, parsed.data.id]);
+      if (seen.has(key)) continue;
+      seen.add(key);
+      refs.push(parsed.data);
+      if (refs.length === FILE_PROVIDER_CONTEXT_MAX_REFS) break;
+    }
+    resolvedContext = { refs };
+    return resolvedContext;
+  };
   let request: AbortController | undefined;
   onCleanup(() => request?.abort());
 
@@ -48,12 +74,15 @@ export const createProviderFolder = (props: { caller: () => FileProviderCaller;
     setStatus(more ? "more" : "loading");
     setError(null);
     try {
+      const context = current.provider.context === true && props.context !== undefined ? await contextFor(pending.signal) : undefined;
+      if (pending.signal.aborted) return;
+      setContextual(context !== undefined);
       let cursor = more ? (next() ?? undefined) : undefined;
       let followed = 0;
       for (;;) {
         const page = await listProviderFolder(
           current.provider,
-          { parent: current.trail.at(-1)?.id, query: query() || undefined, cursor },
+          { parent: current.trail.at(-1)?.id, query: query() || undefined, cursor, context },
           props.caller(),
           pending.signal,
         );
@@ -103,6 +132,7 @@ export const createProviderFolder = (props: { caller: () => FileProviderCaller;
       setFilter("");
       setQuery("");
       setLocation(target);
+      setContextual(false);
       setItems([]);
       setNext(null);
       setWritable(false);
@@ -138,6 +168,7 @@ export const createProviderFolder = (props: { caller: () => FileProviderCaller;
 
   return {
     location,
+    contextual,
     filter,
     query,
     items,
@@ -236,7 +267,12 @@ export function FolderToolbar(props: { folder: ProviderFolder; t: () => Messages
  * One folder in the dialog body: loading, the error with Try again or Up, the empty folder, no matches, or `children`
  * with Load more below while the folder continues.
  */
-export function FolderContents(props: { folder: ProviderFolder; t: () => Messages; children: JSX.Element }): JSX.Element {
+export function FolderContents(props: {
+  folder: ProviderFolder;
+  t: () => Messages;
+  noMatchingFiles?: string;
+  children: JSX.Element;
+}): JSX.Element {
   const folder = props.folder;
   return (
     <Switch>
@@ -268,7 +304,24 @@ export function FolderContents(props: { folder: ProviderFolder; t: () => Message
       <Match when={folder.items().length === 0 && !folder.next()}>
         <Show
           when={folder.query()}
-          fallback={<Placeholder variant="panel" class="cloud-file-chooser__state" icon="ti ti-folder" title={props.t().emptyFolder} />}
+          fallback={
+            <Show
+              when={folder.contextual() && folder.location()?.trail.length === 1}
+              fallback={<Placeholder variant="panel" class="cloud-file-chooser__state" icon="ti ti-folder" title={props.t().emptyFolder} />}
+            >
+              <Placeholder
+                variant="panel"
+                class="cloud-file-chooser__state"
+                icon="ti ti-file-search"
+                title={props.noMatchingFiles ?? props.t().noMatchingFiles}
+                action={
+                  <Button size="sm" variant="secondary" onClick={() => folder.navigate(null)}>
+                    {props.t().otherSource}
+                  </Button>
+                }
+              />
+            </Show>
+          }
         >
           <Placeholder
             variant="panel"

package/src/browser/resource-picker.tsx

@@ -6,10 +6,14 @@ import { resourceSearchDialogOptions } from "./resource-search-dialog";
 import { resourceSearchMessages } from "./resource-search-messages";
 
 export type CloudResourcePickerItem = SearchItem;
+/** Narrows the search on the server to one app and, optionally, one of its search tags; shown as the removable chip. */
+export type CloudResourcePickerScope = { appId: string; tag?: string; label: string; icon?: string };
 export type CloudResourcePickerOptions = {
   title?: string;
   placeholder?: string;
   initialAppId?: string;
+  scope?: CloudResourcePickerScope;
+  query?: string;
   excludeRefs?: readonly CloudResourceRef[];
   requireReader?: boolean;
   resourceType?: string;
@@ -20,8 +24,19 @@ export const openCloudResourcePicker = (options: CloudResourcePickerOptions = {}
   const t = resourceSearchMessages.resolve([locale]).t;
   return dialogCore.open<CloudResourcePickerItem>(
     (close) => (
-      <CloudResourceSearch {...options} title={options.title ?? t.chooseResource} selectionMode onSelect={close} onClose={() => close()} />
+      <CloudResourceSearch
+        {...options}
+        request={options.scope !== undefined || options.query !== undefined ? { scope: options.scope, query: options.query } : undefined}
+        title={options.title ?? t.chooseResource}
+        selectionMode
+        onSelect={close}
+        onClose={() => close()}
+      />
     ),
-    resourceSearchDialogOptions(options.title ?? t.chooseResource),
+    // A phone shows the picker as a full-screen sheet; global search keeps its floating card.
+    {
+      ...resourceSearchDialogOptions(options.title ?? t.chooseResource),
+      panelClassName: "cloud-search-dialog cloud-search-dialog--picker",
+    },
   );
 };

package/src/cli/admin/workflows.ts

@@ -55,6 +55,7 @@ export type WorkflowRunDetailRow = WorkflowRunRow & {
   effectsUsed: Record<string, number>;
   effectBudget: Record<string, number>;
   eventData: Record<string, unknown> | null;
+  eventPayloadExpired: boolean;
   steps: WorkflowStepRow[];
   children: Record<RunState, number>;
 };

package/src/config/env.ts

@@ -91,6 +91,20 @@ const registry = defineEnv({
     doc: "Core only: temporary first-administrator or recovery login token; remove it after normal administrator sign-in works.",
   },
 
+  // Outbound network
+  OUTGOING_MAIL_ALLOWED_TARGETS: {
+    schema: envList,
+    default: [],
+    scope: "runtime",
+    doc: "Comma-separated host names, IP addresses and CIDR ranges on internal networks allowed for outgoing mail SMTP and bounce IMAP connections; unset allows only public targets, an explicit value replaces this default, and invalid entries including `/0` stop the owning process at startup.",
+  },
+  GEO_ALLOWED_TARGETS: {
+    schema: envList,
+    default: ["geo"],
+    scope: "runtime",
+    doc: "Comma-separated host names, IP addresses and CIDR ranges on internal networks allowed for Geo requests; unset allows public targets and `geo`, an explicit value replaces this default, and invalid entries including `/0` stop the owning process at startup.",
+  },
+
   // Identity and OAuth
   CLOUD_IDENTITY_KEY_ENCRYPTION_KEY: {
     schema: z.string(),

package/src/contracts/app-approval.ts

@@ -30,7 +30,10 @@ export const APP_ACTION_LIMITS = {
   valueChars: 300,
 } as const;
 /** Commands a Cloud serves beyond the first version, announced in `/info` as `features`. */
-export const APP_APPROVAL_FEATURES = ["actions"] as const;
+export const APP_APPROVAL_FEATURES = ["actions", "terminal-logins"] as const;
+
+export const APP_APPROVAL_ACCEPT = ["terminal-logins"] as const;
+export type AppApprovalAccept = (typeof APP_APPROVAL_ACCEPT)[number];
 
 const Id = z.string().uuid();
 const Secret = z.string().regex(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/);
@@ -77,7 +80,17 @@ export const AppDeviceCommandSchema = z.discriminatedUnion("operation", [
   /** Stores the authenticator's opaque push token for sign-in wake-ups on this device. */
   z.object({ operation: z.literal("push"), token: z.string().regex(/^[A-Za-z0-9_-]{43}$/) }).strict(),
   /** Pending sign-ins and the newest open Action approvals of the signing device's account in one call. */
-  z.object({ operation: z.literal("inbox") }).strict(),
+  z
+    .object({
+      operation: z.literal("inbox"),
+      accept: z
+        .array(z.enum(APP_APPROVAL_ACCEPT))
+        .min(1)
+        .max(8)
+        .refine((values) => new Set(values).size === values.length)
+        .optional(),
+    })
+    .strict(),
   /** One open Action approval as the device shows it, with the digest the device recomputes before it decides. */
   z.object({ operation: z.literal("action"), actionId: Id }).strict(),
   /** Decides an Action approval. `digest` binds the decision to exactly the view the person saw. */
@@ -121,6 +134,7 @@ export const appDeviceProofMessage = (proof: AppDeviceProof): string => {
     c.operation,
     ...(c.operation === "decide" ? [c.requestId, c.challenge, c.comparison, c.decision] : []),
     ...(c.operation === "push" ? [c.token] : []),
+    ...(c.operation === "inbox" && c.accept !== undefined ? [c.accept] : []),
     ...(c.operation === "action" ? [c.actionId] : []),
     ...(c.operation === "act" ? [c.actionId, c.digest, c.decision] : []),
   ]);
@@ -151,8 +165,40 @@ export const AppDeviceViewSchema = z
     assisted: z.boolean(),
   })
   .strict();
+/** Plain text on one line: no control, format or bidirectional characters, so an app cannot fake Cloud's own frame. */
+const PlainText = (max: number) =>
+  z
+    .string()
+    .refine((value) => Array.from(value).length <= max, `Must contain at most ${max} code points`)
+    .regex(/^[^\p{Cc}\p{Cf}\p{Zl}\p{Zp}]*$/u);
+export const AppTerminalLoginSchema = z
+  .object({
+    client: z
+      .object({
+        // Bound encoded bytes including escapes, so five complete consent rows fit the response budget.
+        id: PlainText(256)
+          .min(1)
+          .refine((value) => new TextEncoder().encode(JSON.stringify(value)).length <= 258),
+        name: PlainText(APP_ACTION_LIMITS.nameChars).min(1),
+      })
+      .strict(),
+    scopes: z
+      .array(z.string().regex(/^[a-z][a-z0-9_:.-]{0,39}$/))
+      .min(1)
+      .max(16),
+    lifetimeSeconds: z.number().int().positive(),
+  })
+  .strict();
+export type AppTerminalLogin = z.infer<typeof AppTerminalLoginSchema>;
 export const AppPendingLoginSchema = z
-  .object({ requestId: Id, challenge: Secret, comparison: Comparison, createdAt: DateTime, expiresAt: DateTime })
+  .object({
+    requestId: Id,
+    challenge: Secret,
+    comparison: Comparison,
+    createdAt: DateTime,
+    expiresAt: DateTime,
+    terminal: AppTerminalLoginSchema.optional(),
+  })
   .strict();
 export const AppPairingPayloadSchema = z
   .object({ protocol: z.literal(APP_APPROVAL_PROTOCOL), issuer: z.string().url(), pairingId: Id, secret: Secret, expiresAt: DateTime })
@@ -215,12 +261,6 @@ export const AppDeviceAccountSchema = z
   })
   .strict();
 export type AppDeviceAccount = z.infer<typeof AppDeviceAccountSchema>;
-/** Plain text on one line: no control, format or bidirectional characters, so an app cannot fake Cloud's own frame. */
-const PlainText = (max: number) =>
-  z
-    .string()
-    .refine((value) => Array.from(value).length <= max, `Must contain at most ${max} code points`)
-    .regex(/^[^\p{Cc}\p{Cf}\p{Zl}\p{Zp}]*$/u);
 const ActionApp = z
   .object({ id: PlainText(APP_ACTION_LIMITS.nameChars).min(1), name: PlainText(APP_ACTION_LIMITS.nameChars).min(1) })
   .strict();