@k2b/cloud 0.38.0 → 0.40.0

package/src/ai/types.ts

@@ -13,11 +13,32 @@ import type {
 import type { Usage } from "@k2b/nessi/ai";
 import type { z } from "zod";
 import type { CapabilitySentenceField } from "../_internal/capability-sentences";
-import type { CapabilityActionReview, CapabilityActionSentences, CloudResourceRef } from "../contracts/capabilities";
+import type { CapabilityActionReviewData, CapabilityActionSentences, CloudResourceRef } from "../contracts/capabilities";
 import type { RequestActor } from "../server";
+import type { AiActionCheck, AiStoredActionReview } from "./action-review";
 import type { AiLocalClient, AiLocalContext, AiLocalToolName } from "./local-tool-contracts";
 import type { AiTurnBlock } from "./protocol";
 
+/** Current reader-confirmed metadata for a recently sent resource. */
+export type AiRecentResource = {
+  ref: CloudResourceRef;
+  title: string;
+  icon?: string;
+  href?: string;
+  kind: string;
+  preview?: string;
+  appName: string;
+  count: number;
+};
+
+export type AiRecentSentResourceRef = {
+  ref: CloudResourceRef;
+  count: number;
+  lastSentAt: string;
+  /** Internal conversation UUID, only for authorized Studio reads. */
+  conversationId: string;
+};
+
 export const AI_MODEL_CAPABILITIES = ["streaming", "tools", "vision", "transcription"] as const;
 export type AiModelCapability = (typeof AI_MODEL_CAPABILITIES)[number];
 
@@ -298,12 +319,18 @@ export type AiStoredMessage = {
       sourceHref?: string;
     };
     scheduledTask?: {
+      reason?: import("./chat-task-reasons").ChatTaskReason;
+      /** The message text is only the reason sentence; the chat words the reason itself instead. */
+      reasonOnly?: true;
+      stop?: { cause: "paused" | "deleted"; done: string[] };
       taskId: string;
       occurrenceId: string;
       scheduledFor: string;
       trigger: "scheduled" | "manual";
     };
     toolPresentations?: Record<string, AiToolPresentation>;
+    toolReviews?: Record<string, AiStoredActionReview>;
+    toolChecks?: Record<string, AiActionCheck>;
     /** How the person decided an approval; `expired` when the turn ended while it still waited. */
     toolOutcomes?: Record<string, "rejected" | "approved" | "expired">;
     /** Requests a website approval let through, by tool call and then by `AiWebsiteReceipt.index`. */
@@ -424,7 +451,7 @@ export type AiPendingTurnAction =
       name: string;
       args: unknown;
       message?: string;
-      review?: CapabilityActionReview;
+      review?: CapabilityActionReviewData;
       allowAlways: boolean;
       /** Whether the approval can be remembered for this chat. */
       allowChat: boolean;
@@ -460,7 +487,7 @@ export type AiPendingTurnActionRecord = {
   name: string;
   args: unknown;
   message?: string;
-  review?: CapabilityActionReview;
+  review?: CapabilityActionReviewData;
   approvalScope: string;
   allowAlways: boolean;
   /** Whether the approval can be remembered for this chat; defaults to `allowAlways`. */
@@ -613,6 +640,11 @@ export type AiConversationFileSnapshot = {
 };
 
 export type AiBackgroundRunContext = {
+  scheduledFor?: string;
+  trigger?: "scheduled" | "manual";
+  timezone?: string;
+  stopDeliveredAt?: string;
+  needsApproval?: { action: string };
   taskId: string;
   occurrenceId: string;
   context: Array<{ seq: number; kind: "message" | "summary"; message: Message }>;
@@ -757,6 +789,7 @@ export type AiConversationService = {
     before?: string;
     limit?: number;
   }): Promise<{ resources: AiConversationResourceRef[]; nextCursor?: string }>;
+  listRecentSentResourceRefs(input: { ownerUserId: string }): Promise<AiRecentSentResourceRef[]>;
   listUserConversationResources(input: {
     ownerUserId: string;
     search?: string;
@@ -977,7 +1010,10 @@ export type AiConversationService = {
     seq: number;
   }): Promise<boolean>;
   /** Record an abort wish. The caller finalizes ownerless turns itself. */
-  requestTurnAbort(input: { conversationId: string; turnId: string; reason?: string }): Promise<AiTurnAbortRequest>;
+  requestTurnAbort(
+    input: { conversationId: string; turnId: string; reason?: string },
+    options?: { db: import("bun").SQL },
+  ): Promise<AiTurnAbortRequest>;
   completeTurn(input: {
     conversationId: string;
     turnId: string;

package/src/api/accounts-entities.ts

@@ -14,6 +14,7 @@ import {
   UserProviderSchema,
 } from "../contracts";
 import { type AuthContext, auth, expectUserBackedActor, jsonResponse, requiresAuth, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { accountsAppService as accountsService } from "../services";
 
 const EntitiesListResponseSchema = z.object({
@@ -91,7 +92,7 @@ type AccountsEntitiesRouteDependencies = {
 };
 
 export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRouteDependencies = {}) =>
-  new Hono<AuthContext>().get(
+  new Hono<AuthContext>().use("/entities/*", noTransform()).get(
     "/entities",
     dependencies.authenticate ?? auth.requireRole("authenticated"),
     dependencies.requireUser ?? auth.requireUser(),

package/src/api/admin-ai-projects.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { AiProjectLastAdminError, aiProjects } from "../ai/projects";
 import { AuthenticatedPrincipalSchema } from "../contracts/shared";
 import { type AuthContext, auth, err, fail, ok, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 
 const ListProjectsSchema = z
   .object({
@@ -20,6 +21,7 @@ const lastAdminConflict = (c: Parameters<typeof respond>[0], error: AiProjectLas
 
 export const createAdminAiProjectsRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
   new Hono<AuthContext>()
+    .use("*", noTransform())
     .use("*", authenticate)
     .get("/", v("query", ListProjectsSchema), async (c) => {
       const query = c.req.valid("query");

package/src/api/admin-ai-skills.ts

@@ -4,6 +4,7 @@ import { aiAppSkills } from "../ai/app-skill-store";
 import { AiSkillInputError, AiSkillLastAdminError, AiSkillRevisionConflictError, aiSkills } from "../ai/skills";
 import { AuthenticatedPrincipalSchema } from "../contracts/shared";
 import { type AuthContext, auth, err, fail, ok, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 
 const ListSkillsSchema = z
   .object({
@@ -32,6 +33,7 @@ const installAppSkill = async (c: Parameters<typeof respond>[0], install: () =>
 
 export const createAdminAiSkillsRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
   new Hono<AuthContext>()
+    .use("*", noTransform())
     .use("*", authenticate)
     .get("/", v("query", ListSkillsSchema), async (c) => {
       const query = c.req.valid("query");

package/src/api/admin-ai-usage.ts

@@ -3,6 +3,7 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { aiUsage } from "../ai/usage";
 import { type AuthContext, auth, err, fail, ok, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { AiUsageQuerySchema } from "../shared/ai-usage";
 
 export const createAdminAiUsageRoutes = (
@@ -10,6 +11,7 @@ export const createAdminAiUsageRoutes = (
   service: typeof aiUsage = aiUsage,
 ) =>
   new Hono<AuthContext>()
+    .use("*", noTransform())
     .use("*", authenticate)
     .get(
       "/report",

package/src/api/admin-core-settings.ts

@@ -46,9 +46,10 @@ const BulkSaveSchema = z.union([
     .object({
       updates: z.record(z.string(), z.unknown()).optional().default({}),
       resets: z.array(z.string()).optional().default([]),
+      replaceUnreadable: z.array(z.string()).optional().default([]),
     })
     .strict(),
-  z.record(z.string(), z.unknown()).transform((updates) => ({ updates, resets: [] as string[] })),
+  z.record(z.string(), z.unknown()).transform((updates) => ({ updates, resets: [] as string[], replaceUnreadable: [] as string[] })),
 ]);
 const LEGAL_DOCUMENTS = [
   { kind: "terms", path: "/legal/terms" },
@@ -58,6 +59,13 @@ const LEGAL_DOCUMENTS = [
 
 type FieldErrors = Record<string, string>;
 
+const unreadableSettingMessage = (locale: string): string =>
+  locale.startsWith("de")
+    ? "Der gespeicherte Wert kann von dieser Anwendung nicht gelesen werden. Ersetze ihn ausdrücklich oder nutze den Standardwert."
+    : "The stored value cannot be read by this application. Replace it explicitly or use the default.";
+const settingsNotSavedMessage = (locale: string): string =>
+  locale.startsWith("de") ? "Die Einstellungen wurden nicht gespeichert." : "The settings were not saved.";
+
 const isKnownSetting = (key: string): boolean => SETTINGS_MAP.has(key);
 
 const AI_PROFILES_KEY = "ai.model_profiles_json";
@@ -335,168 +343,211 @@ const app = new Hono<AuthContext>()
     if (result.ok) return c.json({ ok: true });
     return c.json({ message: result.error, kind: result.kind }, result.status);
   })
-  .put("/", auth.requireRole("admin"), v("json", BulkSaveSchema), async (c) => {
-    const { updates, resets } = c.req.valid("json");
-    const updateKeys = Object.keys(updates);
-    const keys = [...updateKeys, ...resets];
+  .put(
+    "/",
+    auth.requireRole("admin"),
+    describeRoute({
+      tags: ["Administration"],
+      summary: "Save platform settings",
+      ...requiresAdmin,
+      responses: {
+        204: { description: "Settings saved" },
+        400: jsonResponse(z.object({ message: z.string(), errors: z.record(z.string(), z.string()).optional() }), "Invalid settings"),
+        409: jsonResponse(
+          z.object({ message: z.string(), errors: z.record(z.string(), z.string()), code: z.literal("setting_unreadable").optional() }),
+          "Stored setting unreadable or model access conflict",
+        ),
+      },
+    }),
+    v("json", BulkSaveSchema),
+    async (c) => {
+      const { updates, resets, replaceUnreadable } = c.req.valid("json");
+      const replace = new Set(replaceUnreadable);
+      const updateKeys = Object.keys(updates);
+      const keys = [...updateKeys, ...resets];
 
-    if (keys.length === 0) {
-      return c.body(null, 204);
-    }
+      if (keys.length === 0 && replace.size === 0) {
+        return c.body(null, 204);
+      }
 
-    const ownership: FieldErrors = {};
-    for (const key of keys) {
-      if (!isKnownSetting(key)) {
-        ownership[key] = `Unknown setting "${key}"`;
+      const ownership: FieldErrors = {};
+      for (const key of keys) {
+        if (!isKnownSetting(key)) {
+          ownership[key] = `Unknown setting "${key}"`;
+        }
       }
-    }
-    for (const key of resets) {
-      if (key in updates) {
-        ownership[key] = `Setting "${key}" cannot be updated and reset in the same save`;
+      for (const key of replace) {
+        if (!Object.hasOwn(updates, key)) ownership[key] = `Setting "${key}" must be included in updates to replace its unreadable value`;
+      }
+      for (const key of resets) {
+        if (key in updates) {
+          ownership[key] = `Setting "${key}" cannot be updated and reset in the same save`;
+        }
+      }
+      if (Object.keys(ownership).length > 0) {
+        return c.json({ message: "Invalid keys", errors: ownership }, 400);
       }
-    }
-    if (Object.keys(ownership).length > 0) {
-      return c.json({ message: "Invalid keys", errors: ownership }, 400);
-    }
 
-    // Strip AI provider keys before anything is validated or written, so the
-    // value that gets checked is the value that gets stored.
-    const aiSplit = AI_PROFILES_KEY in updates ? splitAiProfileCredentials(updates[AI_PROFILES_KEY]) : null;
-    if (AI_PROFILES_KEY in updates && !aiSplit) {
-      // Unsplittable means the keys could not be separated out, and storing the
-      // value as posted would put them back in a setting the browser reads.
-      return c.json({ message: "Invalid values", errors: { [AI_PROFILES_KEY]: "Model profiles must be a JSON array" } }, 400);
-    }
-    let accessChanges: AiModelAccessChange[] = [];
-    if (aiSplit) {
-      try {
-        aiSplit.profilesJson = prepareAiModelProfileImages(aiSplit.profilesJson);
-      } catch (error) {
-        if (error instanceof ImageMetadataError)
-          return c.json({ message: error.message, code: error.code, errors: { [AI_PROFILES_KEY]: error.message } }, 422);
-        throw error;
+      const states = await settings.readStates(updateKeys);
+      const unreadable: FieldErrors = {};
+      for (const key of updateKeys) {
+        if (states.get(key)?.stored === "unreadable" && !replace.has(key)) unreadable[key] = unreadableSettingMessage(getLocale(c));
       }
-      try {
-        const split = splitAiModelAccess(aiSplit.profilesJson);
-        aiSplit.profilesJson = split.profilesJson;
-        accessChanges = split.changes;
-      } catch {
-        return c.json(
-          {
-            message: "Invalid model permissions",
-            errors: { [AI_PROFILES_KEY]: "Invalid Assistant model permissions. Reload the settings and try again." },
-          },
-          400,
-        );
+      if (Object.keys(unreadable).length > 0) {
+        return c.json({ message: settingsNotSavedMessage(getLocale(c)), errors: unreadable, code: "setting_unreadable" }, 409);
       }
-    }
-    const finalValues: Record<string, unknown> = aiSplit ? { ...updates, [AI_PROFILES_KEY]: aiSplit.profilesJson } : updates;
 
-    // Validate everything up front. settings.set validates as it writes, so a
-    // single bad field used to leave the earlier keys already saved — with the
-    // AI profiles among them, whose save also prunes credentials.
-    const invalid: FieldErrors = {};
-    const validatedValues: Record<string, unknown> = {};
-    for (const [key, value] of Object.entries(finalValues)) {
-      const def = SETTINGS_MAP.get(key);
-      if (!def) continue;
-      const validated = validateSettingValue(def, value);
-      if (validated.ok) validatedValues[key] = validated.value;
-      else invalid[key] = validated.error;
-      if (key === "freeipa.ca_cert") {
-        const certificate = validateFreeIpaCaCert(value);
-        if (!certificate.ok) invalid[key] = certificate.error;
+      // Strip AI provider keys before anything is validated or written, so the
+      // value that gets checked is the value that gets stored.
+      const aiSplit = AI_PROFILES_KEY in updates ? splitAiProfileCredentials(updates[AI_PROFILES_KEY]) : null;
+      if (AI_PROFILES_KEY in updates && !aiSplit) {
+        // Unsplittable means the keys could not be separated out, and storing the
+        // value as posted would put them back in a setting the browser reads.
+        return c.json({ message: "Invalid values", errors: { [AI_PROFILES_KEY]: "Model profiles must be a JSON array" } }, 400);
       }
-      if (INTEGER_FREEIPA_SETTINGS.has(key) && (typeof value !== "number" || !Number.isInteger(value))) {
-        invalid[key] = "Value must be a whole number";
+      let accessChanges: AiModelAccessChange[] = [];
+      if (aiSplit) {
+        try {
+          aiSplit.profilesJson = prepareAiModelProfileImages(aiSplit.profilesJson);
+        } catch (error) {
+          if (error instanceof ImageMetadataError)
+            return c.json({ message: error.message, code: error.code, errors: { [AI_PROFILES_KEY]: error.message } }, 422);
+          throw error;
+        }
+        try {
+          const split = splitAiModelAccess(aiSplit.profilesJson);
+          aiSplit.profilesJson = split.profilesJson;
+          accessChanges = split.changes;
+        } catch {
+          return c.json(
+            {
+              message: "Invalid model permissions",
+              errors: { [AI_PROFILES_KEY]: "Invalid Assistant model permissions. Reload the settings and try again." },
+            },
+            400,
+          );
+        }
       }
-    }
-    if (Object.keys(invalid).length > 0) {
-      return c.json({ message: "Invalid values", errors: invalid }, 400);
-    }
+      const finalValues: Record<string, unknown> = aiSplit ? { ...updates, [AI_PROFILES_KEY]: aiSplit.profilesJson } : updates;
 
-    let aiPlan: AiSettingsMutationPlan;
-    try {
-      aiPlan = await prepareAiSettingsMutation(validatedValues, resets, aiSplit, getLocale(c));
-    } catch (error) {
-      console.error("[settings] failed to validate the prospective AI configuration", error);
-      return c.json({ message: "Failed to validate AI settings" }, 500);
-    }
-    if (Object.keys(aiPlan.errors).length > 0) {
-      return c.json({ message: aiSettingsNotSavedMessage(getLocale(c)), errors: aiPlan.errors, issues: aiPlan.issues ?? [] }, 400);
-    }
+      // Validate everything up front. settings.set validates as it writes, so a
+      // single bad field used to leave the earlier keys already saved — with the
+      // AI profiles among them, whose save also prunes credentials.
+      const invalid: FieldErrors = {};
+      const validatedValues: Record<string, unknown> = {};
+      for (const [key, value] of Object.entries(finalValues)) {
+        const def = SETTINGS_MAP.get(key);
+        if (!def) continue;
+        const validated = validateSettingValue(def, value);
+        if (validated.ok) validatedValues[key] = validated.value;
+        else invalid[key] = validated.error;
+        if (key === "freeipa.ca_cert") {
+          const certificate = validateFreeIpaCaCert(value);
+          if (!certificate.ok) invalid[key] = certificate.error;
+        }
+        if (INTEGER_FREEIPA_SETTINGS.has(key) && (typeof value !== "number" || !Number.isInteger(value))) {
+          invalid[key] = "Value must be a whole number";
+        }
+      }
+      if (Object.keys(invalid).length > 0) {
+        return c.json({ message: "Invalid values", errors: invalid }, 400);
+      }
 
-    const fieldErrors: FieldErrors = {};
-    try {
-      // Every settings and AI credential write runs on the transaction's own
-      // connection, so a failure rolls the whole save back.
-      await sql.begin(async (tx) => {
-        for (const [key, value] of Object.entries(validatedValues)) {
-          try {
-            await settings.set(key, value, tx);
-          } catch (error) {
-            fieldErrors[key] = `Failed to update ${key}`;
-            throw error;
+      let aiPlan: AiSettingsMutationPlan;
+      try {
+        aiPlan = await prepareAiSettingsMutation(validatedValues, resets, aiSplit, getLocale(c));
+      } catch (error) {
+        console.error("[settings] failed to validate the prospective AI configuration", error);
+        return c.json({ message: "Failed to validate AI settings" }, 500);
+      }
+      if (Object.keys(aiPlan.errors).length > 0) {
+        return c.json({ message: aiSettingsNotSavedMessage(getLocale(c)), errors: aiPlan.errors, issues: aiPlan.issues ?? [] }, 400);
+      }
+
+      const fieldErrors: FieldErrors = {};
+      try {
+        // Every settings and AI credential write runs on the transaction's own
+        // connection, so a failure rolls the whole save back.
+        await sql.begin(async (tx) => {
+          for (const [key, value] of Object.entries(validatedValues)) {
+            try {
+              await settings.set(key, value, tx, { replaceUnreadable: replace.has(key) });
+            } catch (error) {
+              fieldErrors[key] = `Failed to update ${key}`;
+              throw error;
+            }
           }
-        }
-        for (const key of resets) {
-          try {
-            await settings.remove(key, tx);
-          } catch (error) {
-            fieldErrors[key] = `Failed to reset ${key}`;
-            throw error;
+          for (const key of resets) {
+            try {
+              await settings.remove(key, tx);
+            } catch (error) {
+              fieldErrors[key] = `Failed to reset ${key}`;
+              throw error;
+            }
           }
-        }
-        const categoryKeys = keys.filter((key) => key.startsWith("user.category."));
-        if (categoryKeys.length > 0)
-          await audit.record(
-            {
-              action: "accounts.categories.configure",
-              outcome: "allowed",
-              actor: { userId: c.get("user").id },
-              target: { type: "settings", id: "user.category" },
-              metadata: {
-                keys: categoryKeys,
-                updates: Object.fromEntries(categoryKeys.filter((key) => key in validatedValues).map((key) => [key, validatedValues[key]])),
-                resets: resets.filter((key) => categoryKeys.includes(key)),
+          const categoryKeys = keys.filter((key) => key.startsWith("user.category."));
+          if (categoryKeys.length > 0)
+            await audit.record(
+              {
+                action: "accounts.categories.configure",
+                outcome: "allowed",
+                actor: { userId: c.get("user").id },
+                target: { type: "settings", id: "user.category" },
+                metadata: {
+                  keys: categoryKeys,
+                  updates: Object.fromEntries(
+                    categoryKeys.filter((key) => key in validatedValues).map((key) => [key, validatedValues[key]]),
+                  ),
+                  resets: resets.filter((key) => categoryKeys.includes(key)),
+                },
               },
+              tx,
+            );
+          if (aiSplit && aiPlan.keepCredentialProfileIds) {
+            await storeAiCredentials(aiSplit, aiPlan.keepCredentialProfileIds, tx);
+          } else if (aiPlan.keepCredentialProfileIds) {
+            await pruneAiCredentials(aiPlan.keepCredentialProfileIds, tx);
+          }
+          if (aiPlan.headerPlan) await storeAiRequestHeaderPlan(aiPlan.headerPlan, tx);
+          if (aiPlan.modelProfileIds) {
+            await aiModelAccess.syncProfiles(aiPlan.modelProfileIds, accessChanges, tx);
+          }
+        });
+      } catch (error) {
+        if (error instanceof settings.SettingUnreadableError) {
+          return c.json(
+            {
+              message: settingsNotSavedMessage(getLocale(c)),
+              errors: { [error.key]: unreadableSettingMessage(getLocale(c)) },
+              code: "setting_unreadable",
             },
-            tx,
+            409,
           );
-        if (aiSplit && aiPlan.keepCredentialProfileIds) {
-          await storeAiCredentials(aiSplit, aiPlan.keepCredentialProfileIds, tx);
-        } else if (aiPlan.keepCredentialProfileIds) {
-          await pruneAiCredentials(aiPlan.keepCredentialProfileIds, tx);
         }
-        if (aiPlan.headerPlan) await storeAiRequestHeaderPlan(aiPlan.headerPlan, tx);
-        if (aiPlan.modelProfileIds) {
-          await aiModelAccess.syncProfiles(aiPlan.modelProfileIds, accessChanges, tx);
+        if (error instanceof ImageMetadataError) return c.json({ message: error.message, code: error.code, errors: fieldErrors }, 422);
+        if (error instanceof AiModelAccessConflict || error instanceof AiModelAccessInvalid) {
+          return c.json(
+            { message: error.message, errors: { [AI_PROFILES_KEY]: error.message } },
+            error instanceof AiModelAccessConflict ? 409 : 400,
+          );
         }
-      });
-    } catch (error) {
-      if (error instanceof ImageMetadataError) return c.json({ message: error.message, code: error.code, errors: fieldErrors }, 422);
-      if (error instanceof AiModelAccessConflict || error instanceof AiModelAccessInvalid) {
+        console.error("[settings] failed to commit settings update", error);
         return c.json(
-          { message: error.message, errors: { [AI_PROFILES_KEY]: error.message } },
-          error instanceof AiModelAccessConflict ? 409 : 400,
+          {
+            message: "Save failed",
+            errors: Object.keys(fieldErrors).length > 0 ? fieldErrors : { _form: "The settings could not be saved." },
+          },
+          500,
         );
       }
-      console.error("[settings] failed to commit settings update", error);
-      return c.json(
-        {
-          message: "Save failed",
-          errors: Object.keys(fieldErrors).length > 0 ? fieldErrors : { _form: "The settings could not be saved." },
-        },
-        500,
-      );
-    }
 
-    // Only now: dropping the cache before the commit would let another
-    // container miss, read the pre-commit row and cache it for the full TTL.
-    await invalidateCommittedSettings(keys);
+      // Only now: dropping the cache before the commit would let another
+      // container miss, read the pre-commit row and cache it for the full TTL.
+      await invalidateCommittedSettings(keys);
 
-    return c.body(null, 204);
-  })
+      return c.body(null, 204);
+    },
+  )
   .delete("/:key{.+}", auth.requireRole("admin"), async (c) => {
     const key = c.req.param("key");
     if (!isKnownSetting(key)) {

package/src/api/admin-geoip.ts

@@ -0,0 +1,80 @@
+import { Hono, type MiddlewareHandler } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { GEOIP_MAX_DATABASE_BYTES, GEOIP_MAX_REQUEST_BYTES } from "../contracts/geoip";
+import { type AuthContext, auth, v } from "../server";
+import { REQUEST_IDLE_TIMEOUT_MAX_SECONDS, REQUEST_IDLE_TIMEOUT_SECONDS, setRequestTimeout } from "../server/request-timeout";
+import { GeoIpError, geoip } from "../services/geoip";
+
+export const createAdminGeoIpRoutes = (
+  authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin"),
+  service: typeof geoip = geoip,
+) =>
+  new Hono<AuthContext>()
+    .use(authenticate)
+    .onError((error, c) => {
+      if (error instanceof GeoIpError)
+        return c.json(
+          {
+            code: error.code,
+            ...(error.code === "geoip_too_large" ? { maxDatabaseBytes: GEOIP_MAX_DATABASE_BYTES } : {}),
+            ...(error.code === "geoip_request_too_large" ? { maxRequestBytes: GEOIP_MAX_REQUEST_BYTES } : {}),
+          },
+          error.status,
+        );
+      if (c.req.raw.signal.aborted) return new Response(null, { status: 499 });
+      throw error;
+    })
+    .get(
+      "/",
+      describeRoute({ tags: ["Sign-in locations"], summary: "Show active sign-in location databases and upload limits" }),
+      auth.requireOAuthScope("read", "admin"),
+      async (c) => c.json(await service.status(c.get("user"))),
+    )
+    .put(
+      "/",
+      describeRoute({
+        tags: ["Sign-in locations"],
+        summary: "Replace a City or ASN database with a raw or gzip MMDB upload",
+        requestBody: {
+          required: true,
+          content: {
+            "application/octet-stream": { schema: { type: "string", format: "binary" } },
+            "application/gzip": { schema: { type: "string", format: "binary" } },
+          },
+        },
+      }),
+      auth.requireOAuthScope("write", "admin"),
+      async (c) => {
+        setRequestTimeout(c, REQUEST_IDLE_TIMEOUT_MAX_SECONDS);
+        try {
+          const length = c.req.header("Content-Length");
+          return c.json(
+            await service.upload(
+              c.get("user"),
+              c.req.raw.body ??
+                new ReadableStream({
+                  start(controller) {
+                    controller.close();
+                  },
+                }),
+              {
+                contentLength: length === undefined ? undefined : Number(length),
+                signal: c.req.raw.signal,
+              },
+            ),
+          );
+        } finally {
+          setRequestTimeout(c, REQUEST_IDLE_TIMEOUT_SECONDS);
+        }
+      },
+    )
+    .delete(
+      "/:kind",
+      describeRoute({ tags: ["Sign-in locations"], summary: "Reset one sign-in database to the bundled snapshot" }),
+      auth.requireOAuthScope("write", "admin"),
+      v("param", z.object({ kind: z.enum(["city", "asn"]) })),
+      async (c) => c.json(await service.reset(c.get("user"), c.req.valid("param").kind)),
+    );
+
+export default createAdminGeoIpRoutes();

package/src/api/admin-identity.ts

@@ -7,6 +7,7 @@ import { listApps } from "../_internal/registry";
 import { CapabilityAppIdSchema } from "../contracts/capabilities";
 import { AI_INFERENCE_SCOPE } from "../contracts/shared";
 import { type AuthContext, auth, err, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { audit } from "../services/audit";
 import { getIdentitySigningKeyStatus, identityMetrics, revokeIdentitySigningKey, rewrapIdentitySigningKeys } from "../services/identity";
 import { WORKLOAD_SCOPES } from "../services/identity/workload-auth";
@@ -110,6 +111,8 @@ export const createAdminIdentityRoutes = (
   service: IdentityAdminDependencies = dependencies,
 ) =>
   new Hono<AuthContext>()
+    // Mandate lists hold every user's grant inputs, which users write at will and which can carry private text.
+    .use("*", noTransform())
     .use(authenticate)
     .use("*", async (c, next) => {
       c.header("Cache-Control", "no-store");