@k2b/cloud 0.38.0 → 0.40.0

package/src/services/approvals/device.ts

@@ -1,3 +1,4 @@
+import { capabilityReviewView } from "../../_internal/capability-reviews";
 import {
   APP_APPROVAL_LIMITS,
   type AppActionSummary,
@@ -5,7 +6,7 @@ import {
   appActionDigest,
   APP_ACTION_LIMITS as limits,
 } from "../../contracts/app-approval";
-import { CapabilityActionReviewSchema } from "../../contracts/capabilities";
+import { CapabilityActionReviewDataSchema } from "../../contracts/capabilities";
 import { DEFAULT_LOCALE } from "../../server/locale";
 import type { PendingApprovalRow } from "./list";
 
@@ -21,6 +22,8 @@ const cut = (value: string, limit: number): string => {
   return points.length > limit ? `${points.slice(0, limit - 1).join("")}…` : value;
 };
 
+export const appApprovalText = (value: string, limit: number): string => cut(plain(value), limit);
+
 /** A deterministic, plain-text snapshot; the digest binds the device's choice to everything it shows. */
 export const appActionView = async (
   row: PendingApprovalRow,
@@ -45,7 +48,7 @@ export const appActionView = async (
   const first = lines[0] ?? plain(row.action);
   const prefix = `${appName}: `;
   const sentence = first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
-  const review = CapabilityActionReviewSchema.safeParse(row.details);
+  const review = CapabilityActionReviewDataSchema.safeParse(row.details);
   let message: string | null;
   const details: AppActionView["details"] = [];
   const detail = (label: string, value: string, format?: "date" | "date-time") => {
@@ -60,11 +63,12 @@ export const appActionView = async (
   const messages: string[] = [];
   const reviewLines = new Set<string>();
   if (review.success) {
-    const cleaned = plain(review.data.message);
+    const view = capabilityReviewView(review.data, { timeZone: "UTC" });
+    const cleaned = plain(view.message);
     if (cleaned !== sentence) messages.push(cleaned);
     reviewLines.add(cleaned);
-    for (const line of review.data.message.split(/\r?\n/)) reviewLines.add(plain(line));
-    for (const field of review.data.details ?? [])
+    for (const line of view.message.split(/\r?\n/)) reviewLines.add(plain(line));
+    for (const field of view.details ?? [])
       detail(field.label, field.value, field.format === "date" || field.format === "date-time" ? field.format : undefined);
   }
   for (const line of lines.slice(1)) {

package/src/services/approvals/index.ts

@@ -1,7 +1,7 @@
 import { type SQL, sql } from "bun";
 import { capabilityRequestHash } from "../../capabilities/claims";
 import { APPROVAL_ACP_CLIENT } from "../../contracts/approvals";
-import type { CapabilityActionReview } from "../../contracts/capabilities";
+import type { CapabilityActionReviewData } from "../../contracts/capabilities";
 import { isAppSessionActor } from "../../server/actor";
 import type { RequestActor, RequestCredentialKind } from "../../server/middleware/auth";
 import { audit } from "../audit";
@@ -23,7 +23,8 @@ export type ApprovalAssurance = "standard" | "confirm";
  */
 export const approvalAssurance = (rememberable: boolean): ApprovalAssurance => (rememberable ? "standard" : "confirm");
 export const approvalArgsDigest = (input: unknown): string => capabilityRequestHash(input);
-export const approvalReviewDigest = (review: CapabilityActionReview | null | undefined): string => capabilityRequestHash(review ?? null);
+export const approvalReviewDigest = (review: CapabilityActionReviewData | null | undefined): string =>
+  capabilityRequestHash(review ?? null);
 export const approvalDecisionChannel = (input: {
   credentialKind?: RequestCredentialKind;
   actor?: RequestActor;
@@ -50,7 +51,7 @@ export type ApprovalRequestInput = {
   approverUserId: string;
   assurance: ApprovalAssurance;
   sentence: string;
-  review?: CapabilityActionReview | null;
+  review?: CapabilityActionReviewData | null;
   input: unknown;
   expiresInMs: number;
 };
@@ -67,7 +68,7 @@ export type ApprovalRequest = {
   approverUserId: string;
   assurance: ApprovalAssurance;
   sentence: string;
-  details: CapabilityActionReview | null;
+  details: CapabilityActionReviewData | null;
   argsDigest: string;
   reviewDigest: string;
   status: ApprovalStatus;
@@ -211,7 +212,7 @@ export type ApprovalConsumeResult =
   | { ok: false; code: "NOT_FOUND" | "NOT_APPROVED" | "ALREADY_CONSUMED" | "INPUT_CHANGED" | "REVIEW_CHANGED" | "REVOKED" };
 export const consume = async (
   id: string,
-  input: { input: unknown; review: CapabilityActionReview | null; requester: { kind: ApprovalRequesterKind; ref: string } },
+  input: { input: unknown; review: CapabilityActionReviewData | null; requester: { kind: ApprovalRequesterKind; ref: string } },
   db?: SQL,
 ): Promise<ApprovalConsumeResult> => {
   const argsDigest = approvalArgsDigest(input.input),

package/src/services/approvals/list.ts

@@ -1,9 +1,10 @@
 import { sql } from "bun";
+import { type AiStoredActionReview, storedActionReview } from "../../ai/action-review";
 import { AI_WEBSITE_APPROVAL_TOOL, aiTurnAllowsRememberedApprovals } from "../../ai/approvals";
 import type { AiTurnRunConfig } from "../../ai/types";
 import type { RuntimeAppMeta } from "../../contracts/app";
 import { APPROVALS_PAGE_SIZE, type ApprovalCounts, type PendingApproval } from "../../contracts/approvals";
-import { CapabilityActionReviewSchema } from "../../contracts/capabilities";
+import { type CapabilityActionPolicy, CapabilityActionReviewDataSchema } from "../../contracts/capabilities";
 import type { ApprovalAssurance } from ".";
 import { decodeApprovalCursor, encodeApprovalCursor } from "./cursor";
 
@@ -18,6 +19,7 @@ export type PendingApprovalRow = {
   assurance: ApprovalAssurance;
   sentence: string;
   details: unknown;
+  storedReview: AiStoredActionReview | null;
   createdAt: Date;
   expiresAt: Date;
   cursorCreatedAt: string;
@@ -61,10 +63,21 @@ export const listPending = async (input: {
       to_char(r.created_at AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.US"Z"') AS "cursorCreatedAt",
       question.short_id AS "conversationShortId", question.title AS "conversationTitle",
       question.allow_chat AS "allowChat", question.allow_always AS "allowAlways",
-      question.remember_tool_name AS "rememberToolName", question.tool_name AS "toolName", question.run_config AS "runConfig"
+      question.remember_tool_name AS "rememberToolName", question.tool_name AS "toolName", question.run_config AS "runConfig",
+      question.stored_review AS "storedReview"
     FROM open r JOIN LATERAL (
-      SELECT c.short_id, c.title, p.allow_chat, p.allow_always, p.remember_tool_name, p.tool_name, t.run_config
+      SELECT c.short_id, c.title, p.allow_chat, p.allow_always, p.remember_tool_name, p.tool_name, t.run_config,
+        (SELECT m.meta->'toolReviews'->review.call_id FROM (
+          SELECT meta, conversation_id, loop_id, role, seq FROM ai.messages
+          UNION ALL
+          SELECT meta, conversation_id, loop_id, role, seq FROM ai.task_messages
+        ) m WHERE m.conversation_id=p.conversation_id AND m.loop_id=p.turn_id::text AND m.role='assistant'
+          AND m.meta->'toolReviews'->review.call_id IS NOT NULL
+        ORDER BY m.seq DESC LIMIT 1) AS stored_review
       FROM ai.pending_actions p JOIN ai.conversations c ON c.id=p.conversation_id JOIN ai.turns t ON t.id=p.turn_id
+        -- A capability's own approval waits as "<call>-approval-<n>"; its review is stored under the call itself.
+        CROSS JOIN LATERAL (SELECT CASE WHEN p.kind = 'custom_approval'
+          THEN COALESCE(substring(p.call_id FROM '^(.*)-approval-[0-9]+$'), p.call_id) ELSE p.call_id END AS call_id) review
       WHERE p.approval_id=r.id AND p.status='pending' ORDER BY p.created_at DESC, p.id DESC LIMIT 1
     ) question ON true
     WHERE ${matches(input.appId, input.link)}
@@ -93,9 +106,17 @@ export const countPending = async (input: { approverUserId: string }): Promise<A
 export const presentPendingApproval = (
   row: PendingApprovalRow,
   apps: readonly Pick<RuntimeAppMeta, "id" | "name" | "icon">[],
+  policy?: CapabilityActionPolicy,
 ): PendingApproval => {
   const app = apps.find((entry) => entry.id === row.appId);
-  const review = CapabilityActionReviewSchema.nullable().safeParse(row.details);
+  const review = CapabilityActionReviewDataSchema.nullable().safeParse(row.details);
+  const originalReview = review.success ? review.data : null;
+  const displayReview =
+    originalReview && "sentence" in originalReview
+      ? row.storedReview && "sentence" in row.storedReview
+        ? row.storedReview
+        : storedActionReview(originalReview, policy)
+      : originalReview;
   const remember = row.assurance === "standard" && aiTurnAllowsRememberedApprovals(row.runConfig);
   return {
     id: row.id,
@@ -103,7 +124,7 @@ export const presentPendingApproval = (
     action: row.action,
     assurance: row.assurance,
     sentence: row.sentence,
-    review: review.success ? review.data : null,
+    review: displayReview && "legacy" in displayReview ? originalReview : displayReview,
     requester: {
       kind: "chat",
       appId: row.requesterAppId,

package/src/services/auth-flows/notification-sender.ts

@@ -1,9 +1,12 @@
+import type { NewBrowserSignInNotifier } from "../known-browsers";
+
 export type AuthNotificationDeliveryResult = {
   id: string;
   status: "queued" | "delivered" | "suppressed" | "error";
 };
 
 export type AuthNotificationSender = {
+  sendNewBrowserSignIn: NewBrowserSignInNotifier;
   sendMagicLink: (input: { email: string; token: string; magicLink: string; locale?: string }) => Promise<AuthNotificationDeliveryResult>;
   sendIpaLoginHint: (input: { email: string; loginUrl: string; locale?: string }) => Promise<AuthNotificationDeliveryResult>;
   sendPasswordReset: (input: { email: string; resetLink: string; locale?: string }) => Promise<AuthNotificationDeliveryResult>;

package/src/services/geoip/index.ts

@@ -0,0 +1,164 @@
+import { sql } from "bun";
+import { HTTPException } from "hono/http-exception";
+import {
+  DBIP_ATTRIBUTION,
+  GEOIP_MAX_DATABASE_BYTES,
+  GEOIP_MAX_REQUEST_BYTES,
+  type GeoIpAdminDatabase,
+  type GeoIpAdminStatus,
+  type GeoIpKind,
+} from "../../contracts/geoip";
+import { createGeoIp, type GeoIp, type GeoIpDatabaseInfo, getGeoIp } from "../../server/request-context/geoip";
+import { audit } from "../audit";
+import { GeoIpError, parseGeoIpUpload, readGeoIpUpload } from "./upload";
+
+export { GEOIP_MAX_DATABASE_BYTES, GEOIP_MAX_REQUEST_BYTES } from "../../contracts/geoip";
+export { GeoIpError } from "./upload";
+
+type Actor = { id: string; roles: readonly string[]; uid?: string; provider?: string };
+export type GeoIpUploadInfo = {
+  kind: GeoIpKind;
+  sha256: string;
+  size: number;
+  database_type: string;
+  build_epoch: Date;
+  description: string | null;
+  uploaded_at: Date;
+  uploaded_by: string | null;
+  uploader_name: string | null;
+};
+const requireAdmin = (actor: Actor) => {
+  if (!actor.roles.includes("admin")) throw new HTTPException(403, { message: "Administrator access required." });
+};
+let bundledInfo: ReturnType<GeoIp["status"]> | undefined;
+const getBundledInfo = () => (bundledInfo ??= createGeoIp().status());
+const isDbIp = (value: string) => /db[\s-]?ip/i.test(value);
+
+export const geoIpAdminStatus = (
+  rows: GeoIpUploadInfo[],
+  bundled: { city: GeoIpDatabaseInfo | null; asn: GeoIpDatabaseInfo | null },
+  now: number,
+): GeoIpAdminStatus => {
+  const database = (kind: GeoIpKind): GeoIpAdminDatabase => {
+    const row = rows.find((row) => row.kind === kind);
+    const info = bundled[kind];
+    const buildDate = row?.build_epoch ?? info?.buildDate;
+    return {
+      kind,
+      source: row ? "uploaded" : (info?.source ?? null),
+      bundled: info !== null,
+      databaseType: row?.database_type ?? info?.databaseType ?? null,
+      buildDate: buildDate?.toISOString() ?? null,
+      stale: buildDate !== undefined && now - buildDate.getTime() > 183 * 24 * 60 * 60 * 1000,
+      dbIp: row ? isDbIp(`${row.database_type} ${row.description ?? ""}`) : info !== null,
+      upload: row
+        ? {
+            sha256: row.sha256,
+            size: row.size,
+            uploadedAt: row.uploaded_at.toISOString(),
+            uploadedBy: row.uploaded_by ? { id: row.uploaded_by, name: row.uploader_name ?? row.uploaded_by } : null,
+          }
+        : null,
+    };
+  };
+  const databases: GeoIpAdminStatus["databases"] = [database("city"), database("asn")];
+  return {
+    databases,
+    attribution: databases.some((item) => item.dbIp) ? DBIP_ATTRIBUTION : null,
+    limits: { maxDatabaseBytes: GEOIP_MAX_DATABASE_BYTES, maxRequestBytes: GEOIP_MAX_REQUEST_BYTES },
+  };
+};
+
+let uploading = false;
+// Each write and its reader install run one after another in this process, so the local reader follows the
+// commit order; other instances follow through their refresh.
+let writes: Promise<unknown> = Promise.resolve();
+const serialized = <T>(write: () => Promise<T>): Promise<T> => {
+  const run = writes.then(write, write);
+  writes = run.catch(() => {});
+  return run;
+};
+export const createGeoIpService = (options: { db?: typeof sql; reader?: GeoIp; bundled?: () => ReturnType<GeoIp["status"]> } = {}) => {
+  const db = options.db ?? sql;
+  const reader = () => options.reader ?? getGeoIp();
+  const status = async (actor: Actor, config: { now?: () => number } = {}): Promise<GeoIpAdminStatus> => {
+    requireAdmin(actor);
+    const rows = await db<GeoIpUploadInfo[]>`
+      SELECT d.kind, d.sha256, (d.metadata->>'size')::int AS size, d.database_type, d.build_epoch,
+        d.metadata->'description'->>'en' AS description, d.uploaded_at, d.uploaded_by,
+        COALESCE(NULLIF(u.display_name, ''), u.uid) AS uploader_name
+      FROM geoip.databases d LEFT JOIN auth.users u ON u.id = d.uploaded_by`;
+    return geoIpAdminStatus(rows, (options.bundled ?? getBundledInfo)(), (config.now ?? Date.now)());
+  };
+  return {
+    status,
+    async upload(actor: Actor, body: ReadableStream<Uint8Array>, config: { contentLength?: number; signal?: AbortSignal }) {
+      requireAdmin(actor);
+      if (uploading) throw new GeoIpError("geoip_upload_busy");
+      uploading = true;
+      try {
+        const bytes = await readGeoIpUpload(body, config.contentLength);
+        const { kind, database, metadata } = parseGeoIpUpload(bytes);
+        const sha256 = new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
+        database.info.sha256 = sha256;
+        config.signal?.throwIfAborted();
+        await serialized(async () => {
+          await db.begin(async (tx) => {
+            await tx`
+              INSERT INTO geoip.databases (kind, data, sha256, database_type, build_epoch, metadata, uploaded_by)
+              VALUES (${kind}, ${bytes}, ${sha256}, ${metadata.databaseType}, ${metadata.buildEpoch}::timestamptz,
+                ${JSON.stringify(metadata)}::jsonb, ${actor.id}::uuid)
+              ON CONFLICT (kind) DO UPDATE SET data = EXCLUDED.data, sha256 = EXCLUDED.sha256,
+                database_type = EXCLUDED.database_type, build_epoch = EXCLUDED.build_epoch, metadata = EXCLUDED.metadata,
+                uploaded_by = EXCLUDED.uploaded_by, uploaded_at = now()`;
+            await audit.record(
+              {
+                action: "core.geoip.upload",
+                outcome: "allowed",
+                actor: { ...actor, userId: actor.id },
+                metadata: { kind, databaseType: metadata.databaseType, buildDate: metadata.buildEpoch, sha256, size: bytes.length },
+              },
+              tx,
+            );
+            config.signal?.throwIfAborted();
+          });
+          reader().install(kind, database);
+        });
+        return { ...(await status(actor)), kind };
+      } finally {
+        uploading = false;
+      }
+    },
+    async reset(actor: Actor, kind: GeoIpKind) {
+      requireAdmin(actor);
+      const changed = await serialized(async () => {
+        const deleted = await db.begin(async (tx) => {
+          const [row] = await tx<{ sha256: string; database_type: string; build_epoch: Date; size: number }[]>`
+          DELETE FROM geoip.databases WHERE kind = ${kind}
+          RETURNING sha256, database_type, build_epoch, octet_length(data) AS size`;
+          if (!row) return false;
+          await audit.record(
+            {
+              action: "core.geoip.reset",
+              outcome: "allowed",
+              actor: { ...actor, userId: actor.id },
+              metadata: {
+                kind,
+                databaseType: row.database_type,
+                buildDate: row.build_epoch.toISOString(),
+                sha256: row.sha256,
+                size: row.size,
+              },
+            },
+            tx,
+          );
+          return true;
+        });
+        reader().install(kind, null);
+        return deleted;
+      });
+      return { ...(await status(actor)), changed };
+    },
+  };
+};
+export const geoip = createGeoIpService();

package/src/services/geoip/store.ts

@@ -0,0 +1,30 @@
+import { sql } from "bun";
+import { GEOIP_MAX_DATABASE_BYTES, type GeoIpKind } from "../../contracts/geoip";
+import type { GeoIpUploads } from "../../server/request-context/geoip";
+
+const SLICE_BYTES = 8 * 1024 * 1024;
+export const createGeoIpUploads = (db: typeof sql = sql): GeoIpUploads => ({
+  async versions() {
+    const rows = await db<{ kind: GeoIpKind; sha256: string }[]>`SELECT kind, sha256 FROM geoip.databases`;
+    return Object.fromEntries(rows.map((row) => [row.kind, row.sha256]));
+  },
+  async read(kind, sha256) {
+    const [row] = await db<{ size: number }[]>`
+      SELECT octet_length(data) AS size FROM geoip.databases WHERE kind = ${kind} AND sha256 = ${sha256}`;
+    if (!row) return null;
+    if (row.size < 1 || row.size > GEOIP_MAX_DATABASE_BYTES) throw new Error("Invalid GeoIP database size");
+    const bytes = Buffer.allocUnsafe(row.size);
+    for (let offset = 0; offset < bytes.length; offset += SLICE_BYTES) {
+      const length = Math.min(SLICE_BYTES, bytes.length - offset);
+      const [slice] = await db<{ data: Uint8Array }[]>`
+        SELECT substring(data FROM ${offset + 1} FOR ${length}) AS data
+        FROM geoip.databases WHERE kind = ${kind} AND sha256 = ${sha256}`;
+      if (!slice) return null;
+      if (slice.data.byteLength !== length) throw new Error("Incomplete GeoIP database slice");
+      bytes.set(slice.data, offset);
+    }
+    return bytes;
+  },
+});
+
+export const geoIpUploads = createGeoIpUploads();

package/src/services/geoip/upload.ts

@@ -0,0 +1,150 @@
+import { Readable } from "node:stream";
+import { createGunzip } from "node:zlib";
+import { Reader } from "mmdb-lib";
+import { GEOIP_MAX_DATABASE_BYTES, GEOIP_MAX_REQUEST_BYTES, type GeoIpErrorCode, type GeoIpKind } from "../../contracts/geoip";
+import { hasBoundedMmdbMetadata, openGeoIpDatabase, truncateUtf8 } from "../../server/request-context/geoip";
+
+const probeAddresses = [
+  ...Array.from({ length: 512 }, (_, i) => [`${i >> 1}.${(i % 2) * 128}.0.0`, `${(0x2000 + i * 16).toString(16)}::`]).flat(),
+  "1.1.1.1",
+  "8.8.8.8",
+  "9.9.9.9",
+  "2001:4860:4860::8888",
+  "2606:4700:4700::1111",
+  "2a01:4f8::1",
+];
+
+const errors = {
+  geoip_request_too_large: { status: 413, message: "The request body exceeds 128 MiB. Upload the .mmdb.gz file." },
+  geoip_too_large: { status: 413, message: "The GeoIP database exceeds 192 MiB unpacked." },
+  geoip_empty: { status: 400, message: "The GeoIP upload is empty." },
+  geoip_invalid: { status: 422, message: "Upload a valid IPv6 MMDB database with a build date." },
+  geoip_unsupported_type: { status: 422, message: "Upload a City or ASN MMDB database." },
+  geoip_upload_busy: { status: 409, message: "Another GeoIP upload is being processed. Try again shortly." },
+} as const;
+export class GeoIpError extends Error {
+  readonly status;
+  constructor(public readonly code: GeoIpErrorCode) {
+    super(errors[code].message);
+    this.status = errors[code].status;
+  }
+}
+
+/** Backpressure reaches the request; both limits are enforced before retaining a chunk. */
+export const readGeoIpUpload = async (body: ReadableStream<Uint8Array>, contentLength?: number): Promise<Buffer> => {
+  if (contentLength !== undefined && contentLength > GEOIP_MAX_REQUEST_BYTES) throw new GeoIpError("geoip_request_too_large");
+  const reader = body.getReader();
+  let requestBytes = 0;
+  async function* counted() {
+    while (true) {
+      const chunk = await reader.read();
+      if (chunk.done) return;
+      requestBytes += chunk.value.byteLength;
+      if (requestBytes > GEOIP_MAX_REQUEST_BYTES) throw new GeoIpError("geoip_request_too_large");
+      if (chunk.value.byteLength) yield chunk.value;
+    }
+  }
+  let source: Readable | undefined;
+  let gunzip: ReturnType<typeof createGunzip> | undefined;
+  try {
+    const chunks = counted();
+    const prefix: Uint8Array[] = [];
+    let prefixBytes = 0;
+    while (prefixBytes < 2) {
+      const next = await chunks.next();
+      if (next.done) break;
+      prefix.push(next.value);
+      prefixBytes += next.value.byteLength;
+    }
+    if (!prefixBytes) throw new GeoIpError("geoip_empty");
+    const first = prefix[0]!;
+    const gzip = first[0] === 0x1f && (first.byteLength > 1 ? first[1] : prefix[1]?.[0]) === 0x8b;
+    source = Readable.from(
+      (async function* () {
+        yield* prefix;
+        yield* chunks;
+      })(),
+    );
+    let output = source;
+    if (gzip) {
+      gunzip = createGunzip();
+      source.on("error", (error) => gunzip?.destroy(error));
+      output = source.pipe(gunzip);
+    }
+    // A resizable backing store avoids retaining all chunks plus a second full-size concatenation.
+    const storage = new ArrayBuffer(0, { maxByteLength: GEOIP_MAX_DATABASE_BYTES });
+    let size = 0;
+    for await (const chunk of output) {
+      if (!(chunk instanceof Uint8Array)) throw new GeoIpError("geoip_invalid");
+      if (size + chunk.byteLength > GEOIP_MAX_DATABASE_BYTES) throw new GeoIpError("geoip_too_large");
+      const needed = size + chunk.byteLength;
+      if (needed > storage.byteLength)
+        storage.resize(Math.min(GEOIP_MAX_DATABASE_BYTES, Math.ceil(needed / (8 * 1024 * 1024)) * 8 * 1024 * 1024));
+      new Uint8Array(storage).set(chunk, size);
+      size = needed;
+    }
+    if (!size) throw new GeoIpError("geoip_empty");
+    storage.resize(size);
+    return Buffer.from(storage);
+  } catch (error) {
+    if (error instanceof GeoIpError) throw error;
+    throw new GeoIpError("geoip_invalid");
+  } finally {
+    source?.destroy();
+    gunzip?.destroy();
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+};
+
+export const parseGeoIpUpload = (bytes: Uint8Array) => {
+  if (!hasBoundedMmdbMetadata(bytes)) throw new GeoIpError("geoip_invalid");
+  try {
+    const metadata = new Reader(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength)).metadata;
+    const type = metadata.databaseType.toLowerCase();
+    const kind: GeoIpKind | null = type.includes("city") ? "city" : type.includes("asn") ? "asn" : null;
+    if (!kind) throw new GeoIpError("geoip_unsupported_type");
+    const database = openGeoIpDatabase(kind, bytes, "uploaded");
+    if (!database || Buffer.byteLength(metadata.databaseType) > 128) throw new GeoIpError("geoip_invalid");
+    const description: unknown = metadata.description;
+    const english =
+      typeof description === "object" && description !== null && "en" in description && typeof description.en === "string"
+        ? description.en
+        : "";
+    const languages: unknown = metadata.languages;
+    const subset = {
+      databaseType: metadata.databaseType,
+      buildEpoch: metadata.buildEpoch.toISOString(),
+      ipVersion: metadata.ipVersion,
+      // `languages` is optional in MMDB metadata; mmdb-lib leaves it undefined despite its type.
+      languages: (Array.isArray(languages) ? languages : [])
+        .filter((language): language is string => typeof language === "string")
+        .slice(0, 16)
+        .map((language) => truncateUtf8(language, 32)),
+      description: { en: truncateUtf8(english, 256) },
+      nodeCount: metadata.nodeCount,
+      recordSize: metadata.recordSize,
+      size: bytes.byteLength,
+    };
+    if (
+      subset.databaseType.includes("\0") ||
+      subset.description.en.includes("\0") ||
+      subset.languages.some((language) => language.includes("\0"))
+    )
+      throw new GeoIpError("geoip_invalid");
+    // Pretty JSON is larger than PostgreSQL jsonb text, including its separator spaces.
+    if (Buffer.byteLength(JSON.stringify(subset, null, 1)) > 4096) throw new GeoIpError("geoip_invalid");
+    // A bounded probe catches gross corruption, not every bad record; request lookups still fail closed. Each
+    // address is one lookup that keeps nothing: at most 32 KiB of decode work and one decoded record in memory.
+    // A crafted file with records at that cap can block this Core process for about ten seconds; normal files take
+    // milliseconds.
+    for (const address of probeAddresses) {
+      const record = database.get(address);
+      if (record !== null && (typeof record !== "object" || Array.isArray(record))) throw new GeoIpError("geoip_invalid");
+    }
+    return { kind, database, metadata: subset };
+  } catch (error) {
+    if (error instanceof GeoIpError) throw error;
+    throw new GeoIpError("geoip_invalid");
+  }
+};

package/src/services/identity/routes.ts

@@ -2,9 +2,13 @@ import { type Context, Hono } from "hono";
 import { CLOUD_INVOCATION_JWKS_PATH, CLOUD_SESSION_JWKS_PATH, IDENTITY_JWKS_MAX_AGE_SECONDS } from "./constants";
 import { listIdentityJwks } from "./key-ring";
 
+// If-None-Match uses weak comparison, including lists and the wildcard.
+const matchesEtag = (header: string | undefined, etag: string): boolean =>
+  header?.trim() === "*" || (header?.match(/(?:W\/)?"[^"]*"/g) ?? []).some((tag) => tag.replace(/^W\//, "") === etag.replace(/^W\//, ""));
+
 const serveJwks = (purpose: "session" | "invocation") => async (c: Context) => {
   const jwks = await listIdentityJwks(purpose);
-  if (c.req.header("if-none-match") === jwks.etag) {
+  if (matchesEtag(c.req.header("if-none-match"), jwks.etag)) {
     c.header("ETag", jwks.etag);
     c.header("Cache-Control", `public, max-age=${IDENTITY_JWKS_MAX_AGE_SECONDS}, must-revalidate`);
     return c.body(null, 304);

package/src/services/index.ts

@@ -114,8 +114,8 @@ export type { AccountLifecycleNotificationSender } from "./account-lifecycle/not
 export { lifecycleJobs } from "./account-lifecycle/scheduler";
 
 export { settings } from "./settings/namespace";
-export { loadCache, get, set, remove, getAll } from "./settings";
-export type { SettingEntry } from "./settings";
+export { loadCache, get, read, readStates, set, remove, getAll, SettingUnreadableError } from "./settings";
+export type { SettingEntry, SettingRead, StoredSettingState } from "./settings";
 export { SETTINGS, SETTINGS_MAP, registerSettings } from "./settings/defaults";
 export { validateSettingValue, normalizeSettingValue, getSettingLabel } from "./settings/defaults";
 export type { SettingDef, SettingKind, SettingOption } from "./settings/defaults";
@@ -164,6 +164,9 @@ export {
   renderHtmlToPdfWithConfig,
   renderTemplatePdfPreview,
   testGotenberg,
+  preparePdfImage,
+  PDF_IMAGE_MAX_INPUT_BYTES,
+  PDF_IMAGE_MAX_BOXES,
 } from "./pdf";
 export type {
   BuildPresetPdfHtmlInput,
@@ -184,6 +187,12 @@ export type {
   TemplatePdfPreviewError,
   TemplatePdfPreviewPhase,
   TemplatePdfPreviewResult,
+  PdfImageBox,
+  PdfImageVariant,
+  PdfImageErrorCode,
+  PreparePdfImageInput,
+  PreparePdfImageOptions,
+  PreparePdfImageResult,
 } from "./pdf";
 
 export { createSyncOpsRoutes, SYNC_OPS_DEAD_LETTER_LIMIT } from "./sync-ops";
@@ -198,7 +207,16 @@ export type {
 
 export { latestTopicCursor } from "./topic-cursor";
 export { readAccountCategoryPolicy, isAccountCategoryAllowed } from "./account-category-policy";
-export { AppApprovalError, appApproval, type AppDeviceAdministrator, type AppDeviceEnrollmentNotice } from "./app-approval";
+export {
+  AppApprovalError,
+  appApproval,
+  type AppDeviceAdministrator,
+  type AppDeviceEnrollmentNotice,
+  type AppApprovalConfig,
+  type AppTerminalLogins,
+  type AppTerminalLoginInput,
+  readAppApprovalConfig,
+} from "./app-approval";
 export { PwaError, pwaDevices, type PwaDeviceAdministrator, type PwaDevicePairedNotice } from "./pwa-devices";
 export { legalConsent } from "./legal-consent";
 
@@ -228,3 +246,14 @@ export {
   resolveAllowedNetworkAddresses,
 } from "./network-security";
 export type { NetworkLookup, PublicNetworkAddress } from "./network-security";
+
+export { geoip } from "./geoip";
+export {
+  knownBrowsers,
+  KNOWN_BROWSER_LIMITS,
+  SIGN_IN_METHODS,
+  type SignInMethod,
+  type NewBrowserSignInNotice,
+  type NewBrowserSignInNotifier,
+} from "./known-browsers";
+export { LASTING_ACCESS_SIGN_IN_SECONDS, requireConfirmedBrowserSignIn } from "./session/recent";