@k2b/cloud 0.38.0 → 0.40.0

package/src/api/admin-lifecycle.ts

@@ -4,6 +4,7 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { createPagination, ErrorResponseSchema, MessageResponseSchema, PaginationQuerySchema, parsePagination } from "../contracts";
 import { type AuthContext, auth, jsonResponse, requiresAdmin, respond, v } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { accountLifecycle, lifecycleJobs } from "../services";
 
 const DeletedAccountSchema = z.object({
@@ -63,7 +64,9 @@ const TriggerJobResponseSchema = z.object({
   jobId: z.string(),
 });
 
+// Deleted-account and reminder reports list other accounts' personal data next to requester-controlled identity text.
 const app = new Hono<AuthContext>()
+  .use("*", noTransform())
   .use(auth.requireRole("admin"))
   .get(
     "/deleted-accounts",

package/src/api/admin-outgoing-mail.ts

@@ -14,6 +14,7 @@ import {
   MailStatusSchema,
 } from "../contracts/outgoing-mail";
 import { type AuthContext, auth, jsonResponse, requiresAdmin } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { audit } from "../services/audit";
 import { outgoingMailLog } from "../services/outgoing-mail/admin";
 import { MAIL_RETENTION_KEYS, readMailRetention } from "../services/outgoing-mail/retention";
@@ -96,6 +97,7 @@ const contentResponse = z.union([
 ]);
 export const createAdminOutgoingMailRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
   new Hono<AuthContext>()
+    .use("*", noTransform())
     .use("*", authenticate)
     .use("*", async (c, next) => {
       c.header("Cache-Control", "no-store");
@@ -131,8 +133,10 @@ export const createAdminOutgoingMailRoutes = (authenticate: MiddlewareHandler<Au
         const next = c.req.valid("json");
         const old = await readMailRetention();
         await sql.begin(async (tx) => {
-          await settings.set(MAIL_RETENTION_KEYS[0], next.contentDays, tx);
-          await settings.set(MAIL_RETENTION_KEYS[1], next.recordDays, tx);
+          // complete value from explicit admin input; nothing is merged over a read (#1303)
+          await settings.set(MAIL_RETENTION_KEYS[0], next.contentDays, tx, { replaceUnreadable: true });
+          // complete value from explicit admin input; nothing is merged over a read (#1303)
+          await settings.set(MAIL_RETENTION_KEYS[1], next.recordDays, tx, { replaceUnreadable: true });
           await audit.record(
             {
               ...context(c),

package/src/api/app-approval.ts

@@ -5,6 +5,8 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import {
   APP_APPROVAL_LIMITS,
+  AppDeviceChangeLookupSchema,
+  AppDeviceChangeReferenceSchema,
   AppDeviceMutationSchema,
   AppDeviceRequestSchema,
   AppLoginReferenceSchema,
@@ -15,7 +17,17 @@ import {
   AppPairingStartSchema,
 } from "../contracts/app-approval";
 import { type AuthContext, auth, rateLimit, v } from "../server";
-import { type AppApprovalActor, AppApprovalError, appApproval, type createAppApprovalService } from "../services/app-approval";
+import { noTransform } from "../server/middleware/no-transform";
+import { addressPrefix, clientIp, describeRequest } from "../server/request-context";
+import {
+  type AppApprovalActor,
+  AppApprovalError,
+  type AppTerminalLogins,
+  appApproval,
+  type createAppApprovalService,
+} from "../services/app-approval";
+import { type NewBrowserSignInNotifier, readBrowserCookie } from "../services/known-browsers";
+import { SessionAppDeviceInactiveError, SessionEpochChangedError } from "../services/session";
 import { appNameIn } from "../ssr/runtime";
 import { createDeviceActions } from "./app-approval-actions";
 
@@ -24,7 +36,12 @@ const DevicePageSchema = z.object({ after: z.string().uuid().optional() }).stric
 type Service = ReturnType<typeof createAppApprovalService>;
 
 /** This is a separate credential surface, never a user API-key or OAuth scope. */
-export const createAppApprovalRoutes = (service: Service = appApproval, actions = createDeviceActions) => {
+export const createAppApprovalRoutes = (
+  options: { notify: NewBrowserSignInNotifier },
+  service: Service = appApproval,
+  actions = createDeviceActions,
+  terminal?: AppTerminalLogins,
+) => {
   const actor = async (c: Parameters<typeof auth.session.getToken>[0]): Promise<AppApprovalActor> => {
     // The web session (or an explicit bearer session), never the mobile app's session: a phone
     // that pairs sign-in devices would hand out authority that outlives its removal.
@@ -36,6 +53,8 @@ export const createAppApprovalRoutes = (service: Service = appApproval, actions
     return { userId: session.user.id, sid: session.data.sid, admin: session.user.roles.includes("admin") };
   };
   return new Hono<AuthContext>()
+    .use("/device", noTransform())
+    .use("/device/*", noTransform())
     .onError((error, c) => {
       if (error instanceof AppApprovalError) return c.json({ code: error.code, message: error.code }, error.status);
       if (error instanceof HTTPException && error.status < 500) return c.json({ code: "INVALID_REQUEST" }, error.status);
@@ -89,7 +108,19 @@ export const createAppApprovalRoutes = (service: Service = appApproval, actions
     )
     .post("/manage/devices/update", v("json", AppDeviceMutationSchema), async (c) => {
       const input = c.req.valid("json");
-      await service.mutateDevice(await actor(c), input.deviceId, input.operation === "rename" ? input.name : undefined);
+      const result = await service.mutateDevice(
+        await actor(c),
+        input.deviceId,
+        input.operation === "rename" ? input.name : undefined,
+        input.operation === "revoke" ? input.endSessions : undefined,
+      );
+      return result ? c.json(result) : c.body(null, 204);
+    })
+    .post("/manage/device-changes/status", v("json", AppDeviceChangeLookupSchema), async (c) => {
+      return c.json(await service.findRemoval(await actor(c), c.req.valid("json")));
+    })
+    .post("/manage/device-changes/cancel", v("json", AppDeviceChangeReferenceSchema), async (c) => {
+      await service.cancelChange(await actor(c), c.req.valid("json").changeId);
       return c.body(null, 204);
     })
     .post(
@@ -111,6 +142,8 @@ export const createAppApprovalRoutes = (service: Service = appApproval, actions
           await service.deviceCommand(
             c.req.valid("json"),
             actions((appId, locale) => appNameIn(c, appId, locale, appId)),
+            terminal,
+            { address: clientIp(c) },
           ),
         ),
     )
@@ -120,7 +153,10 @@ export const createAppApprovalRoutes = (service: Service = appApproval, actions
       v("json", AppLoginStartSchema),
       async (c) => {
         const input = c.req.valid("json");
-        return c.json(await service.startLogin(input.identifier, input.category), 202);
+        const description = describeRequest(c);
+        const cookie = readBrowserCookie(c);
+        const prefix = addressPrefix(clientIp(c));
+        return c.json(await service.startLogin(input.identifier, input.category, { ...description, cookie, prefix }), 202);
       },
     )
     .post("/login/status", v("json", AppLoginReferenceSchema), async (c) => {
@@ -136,8 +172,20 @@ export const createAppApprovalRoutes = (service: Service = appApproval, actions
       v("json", AppLoginReferenceSchema),
       async (c) => {
         const input = c.req.valid("json");
-        const userId = await service.consumeLogin(input.requestId, input.browserSecret);
-        await auth.session.create(c, userId);
+        const { userId, authEpoch, deviceId, deviceName } = await service.consumeLogin(input.requestId, input.browserSecret);
+        try {
+          await auth.session.create(c, userId, {
+            method: "cloud_login",
+            device: deviceName,
+            notify: options.notify,
+            authEpoch,
+            appDeviceId: deviceId,
+          });
+        } catch (error) {
+          if (error instanceof SessionEpochChangedError || error instanceof SessionAppDeviceInactiveError)
+            throw new AppApprovalError("CONFLICT", 409);
+          throw error;
+        }
         return c.body(null, 204);
       },
     );

package/src/api/approvals-loader.ts

@@ -1,9 +1,12 @@
 import type { Context } from "hono";
 import { HTTPException } from "hono/http-exception";
+import { listCapabilities } from "../_internal/registry";
 import { resolveAiChatRequestContext } from "../ai/request-context";
 import type { ApprovalListQuery, ApprovalPage } from "../contracts/approvals";
+import { CapabilityActionCallReviewSchema, capabilityActionPolicy } from "../contracts/capabilities";
 import type { AuthContext } from "../server/middleware/auth";
 import { listPending, presentPendingApproval } from "../services/approvals/list";
+import { logger } from "../services/logging";
 import { getLocalizedRuntimeContext } from "../ssr/runtime";
 
 export const loadPendingApprovals = async <T extends AuthContext>(c: Context<T>, query: ApprovalListQuery): Promise<ApprovalPage> => {
@@ -11,5 +14,24 @@ export const loadPendingApprovals = async <T extends AuthContext>(c: Context<T>,
   if (ctx instanceof Response) throw new HTTPException(403, { res: ctx });
   const page = await listPending({ approverUserId: ctx.ownerUserId, appId: query.app, link: query.link, cursor: query.cursor });
   const apps = getLocalizedRuntimeContext(c).apps;
-  return { ...page, items: page.items.map((row) => presentPendingApproval(row, apps)) };
+  const needsPolicy = page.items.some((row) => {
+    if (row.storedReview && "sentence" in row.storedReview) return false;
+    const review = CapabilityActionCallReviewSchema.safeParse(row.details);
+    return review.success && !review.data.ask;
+  });
+  const capabilities = needsPolicy
+    ? await listCapabilities().catch((error: unknown) => {
+        logger("approvals").warn("Approval capability registry unavailable", {
+          error: error instanceof Error ? error.message : String(error),
+        });
+        return [];
+      })
+    : [];
+  return {
+    ...page,
+    items: page.items.map((row) => {
+      const manifest = capabilities.find((entry) => entry.appId === row.appId)?.manifest;
+      return presentPendingApproval(row, apps, manifest ? capabilityActionPolicy(manifest, row.action) : undefined);
+    }),
+  };
 };

package/src/api/approvals.ts

@@ -18,6 +18,7 @@ import { ErrorResponseSchema } from "../contracts/shared";
 import { rateLimit } from "../server";
 import { respond } from "../server/api";
 import { type AuthContext, auth } from "../server/middleware/auth";
+import { noTransform } from "../server/middleware/no-transform";
 import { jsonResponse, requiresAuth } from "../server/middleware/openapi";
 import { v } from "../server/middleware/validator";
 import { ok } from "../server/services";
@@ -26,6 +27,7 @@ import { decodeApprovalCursor } from "../services/approvals/cursor";
 import { loadPendingApprovals } from "./approvals-loader";
 
 export const approvalRoutes = new Hono<AuthContext>()
+  .use("*", noTransform())
   .use(rateLimit())
   .use(auth.requireRole("authenticated"))
   .get(
@@ -111,7 +113,7 @@ export const approvalRoutes = new Hono<AuthContext>()
             client: c.req.header(APPROVAL_CLIENT_HEADER),
           }),
         },
-        toolApprovalContext: ctx.toolApprovalContext,
+        toolApprovalContext: ctx.toolApprovalChangeContext,
         signedInSession: ctx.signedInSession,
       });
       if (!result.ok) return toAiActionFailureResponse(c, result);

package/src/api/auth.ts

@@ -76,7 +76,10 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         }
 
         // Issue through the configured migration gate (legacy opaque or JWT family).
-        const sessionToken = await auth.session.create(c, loginResult.userId);
+        const sessionToken = await auth.session.create(c, loginResult.userId, {
+          method: "password",
+          notify: notificationSender.sendNewBrowserSignIn,
+        });
 
         log.info("Login successful", { uid: loginResult.user.uid });
         return c.json({
@@ -119,7 +122,10 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
           return c.json({ message: result.error.message, code: result.error.code }, status as 400 | 401 | 403 | 404 | 409 | 500);
         }
 
-        const sessionToken = await auth.session.create(c, result.data.user.id);
+        const sessionToken = await auth.session.create(c, result.data.user.id, {
+          method: "passkey",
+          notify: notificationSender.sendNewBrowserSignIn,
+        });
         log.info("Passkey login successful", { uid: result.data.user.uid });
         return c.json({ session_token: sessionToken, user: result.data.user });
       },
@@ -177,7 +183,10 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
           return jsonError(c, changeResult.message, changeResult.status === 401 ? 401 : 400);
         }
 
-        const sessionToken = await auth.session.create(c, changeResult.userId);
+        const sessionToken = await auth.session.create(c, changeResult.userId, {
+          method: "expired_password",
+          notify: notificationSender.sendNewBrowserSignIn,
+        });
 
         log.info("Password changed via expired flow", { uid: username });
         return c.json({ session_token: sessionToken, user: changeResult.user });
@@ -228,7 +237,11 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         }
 
         // Create session (no IPA session for email-only users)
-        const sessionToken = await auth.session.create(c, verifyResult.userId);
+        const sessionToken = await auth.session.create(c, verifyResult.userId, {
+          method: "email_code",
+          // An account created by this sign-in has nobody else to warn.
+          notify: verifyResult.createdGuest ? null : notificationSender.sendNewBrowserSignIn,
+        });
 
         if (verifyResult.createdGuest) {
           log.info("Guest user created", {
@@ -288,7 +301,10 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
           return jsonError(c, result.message, status);
         }
 
-        const sessionToken = await auth.session.create(c, result.userId);
+        const sessionToken = await auth.session.create(c, result.userId, {
+          method: "password_reset",
+          notify: notificationSender.sendNewBrowserSignIn,
+        });
         log.info("Password reset completed", { uid: result.user.uid });
         return c.json({ user: result.user, session_token: sessionToken });
       },
@@ -359,7 +375,10 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         const user = await accounts.users.get({ uid: "admin" });
         if (!user) return jsonError(c, "Failed to resolve admin user.", 500);
 
-        const sessionToken = await auth.session.create(c, user.id);
+        const sessionToken = await auth.session.create(c, user.id, {
+          method: "admin_token",
+          notify: notificationSender.sendNewBrowserSignIn,
+        });
         log.info("Admin login successful");
         return c.json({ session_token: sessionToken, user });
       },

package/src/api/capabilities.ts

@@ -3,6 +3,11 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { resolveCapabilityManifestPresentation } from "../_internal/capabilities";
+import {
+  capabilityActionReceiptIssues,
+  capabilityActionReviewIssues,
+  capabilityQueryChecksActionOutcome,
+} from "../_internal/capability-reviews";
 import { getCapability, listApps } from "../_internal/registry";
 import { resolveCommandLink } from "../capabilities/command-link";
 import {
@@ -25,12 +30,13 @@ import {
   CAPABILITY_MAX_RESULT_BYTES,
   CAPABILITY_ORIGIN_HEADER,
   CAPABILITY_PROTOCOL_VERSION,
-  CapabilityActionReviewSchema,
+  CapabilityActionReviewDataSchema,
   type CapabilityCatalog,
   CapabilityCatalogSchema,
   CapabilityErrorSchema,
   CapabilityIdempotencyKeySchema,
   type CapabilityOrigin,
+  capabilityActionPolicy,
   capabilityResultJsonSchema,
 } from "../contracts/capabilities";
 import { CapabilityStreamSchema } from "../contracts/capability-streams";
@@ -48,6 +54,7 @@ import {
   requiresAuth,
   v,
 } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { logger, settings } from "../services";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { capabilityInvocationOperation } from "../services/identity/invocation-operations";
@@ -60,7 +67,7 @@ import { capabilityMessages } from "../shared/capability-messages";
 import { dispatchCapabilityStream, sealCapabilityStream } from "./capability-streams";
 
 const log = logger("capabilities");
-const QUERY_TIMEOUT_MS = 15_000;
+export const QUERY_TIMEOUT_MS = 15_000;
 const ACTION_TIMEOUT_MS = 30_000;
 const DEFAULT_CATALOG_LIMIT = 10;
 const MAX_CATALOG_LIMIT = 25;
@@ -238,6 +245,8 @@ export type CapabilityDispatchParams = {
   authority?: RequestAuthority;
   mandate?: MandatedCapabilityAuthority;
   callingAppId?: string;
+  /** Internal observation only: called immediately before attempting the app request. */
+  onUpstreamAttempt?: () => void;
   dependencies?: CapabilityDispatchDependencies;
 };
 
@@ -381,6 +390,7 @@ const runCapabilityDispatch = async (
                     actionApproval: mandate.actionApproval ?? "none",
                     input: params.input,
                     capabilityApproval: "approval" in operation ? (operation.approval ?? "always") : "always",
+                    capabilityPolicy: capabilityActionPolicy(entry.manifest, params.capabilityId),
                     requestId,
                   },
                   async (mandateAuthority) => {
@@ -547,6 +557,7 @@ const runCapabilityDispatch = async (
 
   let response: Response;
   try {
+    params.onUpstreamAttempt?.();
     response = await fetchUpstream(
       `${entry.endpoint}/${params.kind}/${encodeURIComponent(params.capabilityId)}${params.review ? "/review" : ""}`,
       {
@@ -608,18 +619,39 @@ const runCapabilityDispatch = async (
     return settle(invalid, "uncertain");
   }
 
+  const reviewContext = {
+    policy: capabilityActionPolicy(entry.manifest, params.capabilityId),
+    approval: "approval" in operation ? operation.approval : undefined,
+    queries: entry.manifest.queries,
+    validateQueryInput: (query: (typeof entry.manifest.queries)[number], input: Record<string, unknown>) =>
+      schemaValidator(`${query.schemaHash}:input`, query.inputSchema)?.safeParse(input).success === true,
+    ...(entry.presentation ? { locales: [entry.presentation.baseLocale, ...Object.keys(entry.presentation.translations)] } : {}),
+  };
   const resultValidator = params.review
-    ? CapabilityActionReviewSchema
+    ? CapabilityActionReviewDataSchema
     : schemaValidator(`${operation.schemaHash}:result`, capabilityResultJsonSchema(operation.dataSchema));
   const parsedResult = resultValidator?.safeParse(upstreamBody.data);
-  const parsedReview = params.review ? CapabilityActionReviewSchema.safeParse(upstreamBody.data) : null;
-  // A rememberable Action may leave out its scope for arguments that should ask every time; any other Action has none.
-  const reviewApprovalScopeIsValid =
-    !params.review ||
-    !parsedReview?.success ||
-    ("approval" in operation && operation.approval === "rememberable") ||
-    parsedReview.data.approvalScope === undefined;
-  if (!resultValidator || !parsedResult?.success || !reviewApprovalScopeIsValid) {
+  const field = (value: unknown, key: string): unknown =>
+    value !== null && typeof value === "object" ? Object.getOwnPropertyDescriptor(value, key)?.value : undefined;
+  const receipt = field(upstreamBody.data, "receipt");
+  const links = field(upstreamBody.data, "links");
+  const reviewIssues = params.review
+    ? capabilityActionReviewIssues(upstreamBody.data, reviewContext)
+    : receipt === undefined
+      ? []
+      : params.kind === "queries"
+        ? ["Queries cannot return a receipt"]
+        : capabilityActionReceiptIssues(receipt, links);
+  const nestedReceipt = field(field(upstreamBody.data, "data"), "receipt");
+  if (
+    !params.review &&
+    params.kind === "queries" &&
+    nestedReceipt !== undefined &&
+    !("idempotency" in operation) &&
+    capabilityQueryChecksActionOutcome(operation)
+  )
+    reviewIssues.push(...capabilityActionReceiptIssues(nestedReceipt, links));
+  if (!resultValidator || !parsedResult?.success || reviewIssues.length > 0) {
     if (actionWithoutRetrySafety) return settle(outcomeUnknown(), "uncertain");
     const invalid = errorResponse("INVALID_APP_RESPONSE", messages.outsideResultSchema({ appId: params.appId }), 502);
     return settle(invalid, "uncertain");
@@ -741,6 +773,7 @@ export const createCapabilityRoutes = (dependencies: CapabilityRouteDependencies
     (c.req.param("kind") === "actions" ? requireWriteScope : requireReadScope)(c, next);
 
   return new Hono<AuthContext>()
+    .use("/capabilities/v1/*", noTransform())
     .use("/capabilities/v1/*", dependencies.authenticate ?? auth.requireRole("authenticated"))
     .use("/capabilities/v1/*", rejectReservedWorkloadCredential)
     .post(

package/src/api/capability-streams.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
+import { capabilityActionReceiptIssues } from "../_internal/capability-reviews";
 import { getCapability } from "../_internal/registry";
 import { recordCapabilityExecution } from "../capabilities/executions";
 import { exactStream } from "../capabilities/stream-body";
@@ -245,6 +246,17 @@ export async function dispatchCapabilityStream(
         await record(502, "STREAM_FAILED");
         return denied(502, "STREAM_FAILED");
       }
+      // The same receipt rules as an ordinary Action result, so a stream completion cannot skip them.
+      if (
+        nested &&
+        typeof nested === "object" &&
+        "receipt" in nested &&
+        nested.receipt !== undefined &&
+        (grant.kind !== "actions" || capabilityActionReceiptIssues(nested.receipt, "links" in nested ? nested.links : undefined).length > 0)
+      ) {
+        await record(502, "STREAM_FAILED");
+        return denied(502, "STREAM_FAILED");
+      }
     }
     if (!response.ok) {
       const error = CapabilityErrorSchema.safeParse(receipt.data);

package/src/api/help.ts

@@ -1,10 +1,9 @@
-import { keyboardPlatform } from "@k2b/ui";
 import { Hono, type MiddlewareHandler } from "hono";
-import { helpAgentMarkdown } from "../_internal/help-catalog";
 import { type AuthContext, auth, getLocale } from "../server";
+import { buildHelpDocumentPayload } from "../server/help-payload";
 import { createHelpReader, type HelpReaderFactory } from "../services/help";
-import { type HelpDocumentPayload, type HelpSearchPayload, parseHelpReference } from "../shared/help";
-import { renderHelpMarkdown } from "../shared/markdown";
+import type { HelpSearchPayload } from "../shared/help";
+import type { renderHelpMarkdown } from "../shared/markdown";
 import { helpApiMessages } from "./help-messages";
 
 export type HelpRouteDependencies = {
@@ -36,30 +35,7 @@ export const createHelpRoutes = (dependencies: HelpRouteDependencies = {}) => {
       const { t } = helpApiMessages.resolve([locale]);
       const document = await reader(locale, c.get("actor")).read({ appId: c.req.param("appId"), documentId: c.req.param("documentId") });
       if (!document) return c.json({ code: "HELP_NOT_FOUND", message: t.notFound }, 404);
-      const links = (reference: { appId?: string; documentId: string }) =>
-        document.links[`${reference.appId ?? document.appId}/${reference.documentId}`];
-      const resolve = (reference: string) => {
-        const ref = parseHelpReference(reference);
-        return ref ? links(ref) : undefined;
-      };
-      const payload: HelpDocumentPayload = {
-        locale: document.locale,
-        id: document.documentId,
-        title: document.title,
-        markdown: helpAgentMarkdown(document),
-        kind: document.kind,
-        needs: document.needs,
-        next: document.next ? resolve(document.next) : undefined,
-        related: document.related.flatMap((reference) => {
-          const target = resolve(reference);
-          return target ? [target] : [];
-        }),
-        html: (dependencies.renderMarkdown ?? renderHelpMarkdown)(document.markdown, {
-          locale: document.locale,
-          platform: keyboardPlatform(c.req.header("User-Agent") ?? ""),
-          links,
-        }),
-      };
+      const payload = buildHelpDocumentPayload(document, c.req.header("User-Agent") ?? "", dependencies.renderMarkdown);
       return c.json(payload);
     });
 };

package/src/api/index.ts

@@ -26,6 +26,7 @@ import adminAiQuotaRoutes from "./admin-ai-quotas";
 import adminAiSkillsRoutes from "./admin-ai-skills";
 import adminAiUsageRoutes from "./admin-ai-usage";
 import adminCoreSettingsRoutes from "./admin-core-settings";
+import adminGeoIpRoutes from "./admin-geoip";
 import adminIdentityRoutes from "./admin-identity";
 import adminLifecycleRoutes from "./admin-lifecycle";
 import adminLinuxIdentityRoutes from "./admin-linux-identities";
@@ -56,6 +57,7 @@ export { createPwaPhoneRoutes } from "./pwa-phone";
  * the typed shape for the client.
  */
 export type CoreApiOptions = {
+  terminalLogins?: import("../services/app-approval").AppTerminalLogins;
   notifications: import("../services/auth-flows/notification-sender").AuthNotificationSender;
 };
 
@@ -68,7 +70,10 @@ const buildCoreApi = (options: CoreApiOptions) => {
   const widgetRoutes = createWidgetRoutes();
   return new Hono()
     .use(prettyJSON())
-    .route("/auth/app-approval/v1", createAppApprovalRoutes())
+    .route(
+      "/auth/app-approval/v1",
+      createAppApprovalRoutes({ notify: options.notifications.sendNewBrowserSignIn }, undefined, undefined, options.terminalLogins),
+    )
     .route("/auth/pwa/v1", createPwaRoutes())
     .route("/auth", createAuthRoutes(options.notifications))
     .route("/me", meRoutes)
@@ -85,6 +90,7 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/admin/core/settings", adminCoreSettingsRoutes)
     .route("/admin/core/rail", adminRailRoutes)
     .route("/admin/core/linux-identities", adminLinuxIdentityRoutes)
+    .route("/admin/core/geoip", adminGeoIpRoutes)
     .route("/admin/identity", adminIdentityRoutes)
     .route("/admin/sync", createSyncOpsProxyRoutes())
     .route("/admin/lifecycle", adminLifecycleRoutes)

package/src/api/lasting-access-messages.ts

@@ -0,0 +1,17 @@
+import { i18n } from "@k2b/stdlib";
+
+export const lastingAccessApiMessages = i18n.define({
+  baseLocale: "en",
+  messages: {
+    en: {
+      browserSignInRequired: "Create API keys and passkeys in the browser.",
+      reauthenticate: "Sign in again to confirm it is you.",
+      forbidden: "This account cannot create new access.",
+    },
+    de: {
+      browserSignInRequired: "API-Schlüssel und Passkeys legst du im Browser an.",
+      reauthenticate: "Melde dich erneut an, um zu bestätigen, dass du es bist.",
+      forbidden: "Dieses Konto kann keinen neuen Zugang anlegen.",
+    },
+  },
+});

package/src/api/mcp.ts

@@ -42,6 +42,7 @@ import {
 } from "../contracts/capabilities";
 import type { AppRegistryEntry, CapabilityRegistryEntry } from "../contracts/registry";
 import { type AuthContext, auth, type RequestAuthority, rateLimit, rejectReservedWorkloadCredential, resolveLocale } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { createHelpReader, type HelpArticle, type HelpMetadata, type HelpReader, type HelpReaderFactory } from "../services/help";
 import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
 import { logger } from "../services/logging";
@@ -750,6 +751,8 @@ export const createMcpProtectedResourceRoutes = (dependencies: Pick<McpRouteDepe
 /** One authenticated, stateless MCP endpoint projected from live capabilities. */
 export const createMcpRoutes = (dependencies: McpRouteDependencies = {}) =>
   new Hono<AuthContext>()
+    .use("/mcp/v1", noTransform())
+    .use("/mcp/v1/*", noTransform())
     .use("/mcp/v1", validateMcpOrigin(dependencies.getAppUrl ?? defaultAppUrl))
     .use("/mcp/v1", dependencies.authenticate ?? mcpAuthentication(dependencies.getAppUrl ?? defaultAppUrl))
     .use("/mcp/v1", rejectReservedWorkloadCredential)

package/src/api/me-panel-consent.ts

@@ -0,0 +1,71 @@
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { CapabilityAppIdSchema } from "../contracts/capabilities";
+import { panelProviderNeedsConsent } from "../contracts/panel-context-plain";
+import { type AuthContext, jsonResponse, requiresAuth, v } from "../server";
+import { PanelConsentCancelled, panelContextConsent } from "../services/panel-context-consent";
+import { getRuntimeContext } from "../ssr/runtime";
+
+const AnswerSchema = z.object({ allowed: z.boolean(), revision: z.number().int().min(0).max(2_147_483_647) }).strict();
+const AnswersSchema = z.object({ answers: z.record(CapabilityAppIdSchema, AnswerSchema) }).strict();
+const ProviderSchema = z.object({ provider: CapabilityAppIdSchema }).strict();
+const SavedSchema = ProviderSchema.extend(AnswerSchema.shape).strict();
+
+/** Mounted below /me's session and user guards. The live request registry owns provider membership. */
+export const createMePanelConsentRoutes = (service = panelContextConsent) => {
+  const providers = (c: Parameters<typeof getRuntimeContext>[0]) =>
+    getRuntimeContext(c)
+      .apps.filter((app) => app.panel && panelProviderNeedsConsent(app.id))
+      .map((app) => app.id);
+  return new Hono<AuthContext>()
+    .use("*", async (c, next) => {
+      c.header("Cache-Control", "no-store");
+      if (!c.get("user")) return c.json({ message: "Authentication required" }, 401);
+      await next();
+    })
+    .get(
+      "/panel-consent",
+      describeRoute({
+        tags: ["Me"],
+        summary: "Read personal panel context answers",
+        ...requiresAuth,
+        responses: { 200: jsonResponse(AnswersSchema, "Answers for registered panel providers") },
+      }),
+      async (c) => c.json({ answers: await service.list(c.get("user").id, providers(c)) }),
+    )
+    .put(
+      "/panel-consent/:provider",
+      describeRoute({
+        tags: ["Me"],
+        summary: "Save a personal panel context answer",
+        ...requiresAuth,
+        responses: {
+          200: jsonResponse(SavedSchema, "Saved answer"),
+          404: { description: "Panel provider not found" },
+          409: { description: "Answer changed since it was read" },
+        },
+      }),
+      // The answer and revision fit within 256 bytes, including ordinary JSON whitespace.
+      bodyLimit({ maxSize: 256 }),
+      v("param", ProviderSchema),
+      v("json", AnswerSchema),
+      async (c) => {
+        const { provider } = c.req.valid("param");
+        if (!providers(c).includes(provider)) return c.json({ code: "PANEL_PROVIDER_NOT_FOUND", message: "Panel provider not found" }, 404);
+        const { allowed, revision } = c.req.valid("json");
+        let saved: Awaited<ReturnType<typeof service.set>>;
+        try {
+          saved = await service.set(c.get("user").id, provider, allowed, revision, c.req.raw.signal);
+        } catch (error) {
+          // The browser stopped waiting; the save was rolled back and nobody reads this answer.
+          if (error instanceof PanelConsentCancelled) return c.json({ code: "CANCELLED", message: "Request cancelled" }, 503);
+          throw error;
+        }
+        return saved
+          ? c.json({ provider, ...saved })
+          : c.json({ code: "CONFLICT", message: "Panel consent changed. Read the current answer before saving again." }, 409);
+      },
+    );
+};