@k2b/cloud 0.38.0 → 0.40.0

package/src/services/session/index.ts

@@ -5,6 +5,8 @@ import { HTTPException } from "hono/http-exception";
 import { env } from "../../config/env";
 import { PWA_AUTH_PATH, PWA_COOKIES } from "../../contracts/pwa";
 import type { User } from "../../contracts/shared";
+import { getLocale } from "../../server/locale";
+import { describeRequest } from "../../server/request-context";
 import { isAccountCategoryAllowed } from "../account-category-policy";
 import { isAccountExpired } from "../account-model";
 import { audit } from "../audit";
@@ -12,6 +14,17 @@ import { IDENTITY_CLOCK_TOLERANCE_SECONDS, IDENTITY_ROLLOUT_MARGIN_MS } from "..
 import { invalidateIdentitySignerCache, type PreparedIdentitySigner, prepareIdentitySigner } from "../identity/key-ring";
 import { getIdentityRuntimeConfig } from "../identity/runtime-config";
 import { type CloudSessionClaims, isSessionJwtCandidate, signSessionToken, verifySessionToken } from "../identity/session-token";
+import {
+  announceNewBrowser,
+  type NewBrowserSignInNotice,
+  type NewBrowserSignInNotifier,
+  newBrowserCookie,
+  noticeFirstName,
+  readBrowserCookie,
+  rememberSignIn,
+  type SignInMethod,
+  setBrowserCookie,
+} from "../known-browsers";
 import * as settings from "../settings";
 import { loadJwtSession, loadJwtSessionIdentity } from "./user";
 
@@ -144,12 +157,24 @@ const revokeToken = async (token: string, requestId?: string | null): Promise<vo
   }
 };
 
+export class SessionEpochChangedError extends Error {}
+/** The Cloud Login device that approved a sign-in was removed before the session was issued. */
+export class SessionAppDeviceInactiveError extends Error {}
+
 export type SessionIssueOptions = {
+  authEpoch?: number;
   ttlSeconds: number;
+  /** Only web session.create supplies browser persistence, never mobile issuance. */
+  knownBrowser?: Pick<
+    Parameters<typeof rememberSignIn>[1],
+    "cookie" | "browser" | "os" | "country" | "city" | "method" | "device" | "locale" | "announce"
+  >;
   /** Pre-chosen family id, for callers that record it in the same transaction. */
   sid?: string;
   /** Binds the family to a paired phone of the mobile app; the device must be active. */
   pwaDeviceId?: string | null;
+  /** The active Cloud Login device that approved this web sign-in. */
+  appDeviceId?: string;
   /** Web sign-ins update `last_login_local`; app renewals track use per device instead. */
   recordLogin?: boolean;
 };
@@ -162,12 +187,14 @@ type PreparedFamily = {
   expiresAt: Date;
   signer: PreparedIdentitySigner;
   options: SessionIssueOptions;
+  notice: NewBrowserSignInNotice | null;
 };
 
 const SIGNER_INACTIVE = "Prepared Cloud session signer is no longer active";
 const isSignerInactive = (error: unknown) => error instanceof Error && error.message === SIGNER_INACTIVE;
 
-/** Inserts one family in `tx`. Locks the user row first, like every caller that locks more rows. */
+/** Inserts one family in `tx`. Locks the user row first, like every caller that locks more rows; `NO KEY UPDATE`
+ * serializes with every other account lock but lets foreign-key checks of concurrent writes pass. */
 const insertFamily = async (
   tx: SQL,
   c: Context,
@@ -175,19 +202,22 @@ const insertFamily = async (
   signer: PreparedIdentitySigner,
   options: SessionIssueOptions,
 ): Promise<PreparedFamily> => {
-  const issuedAt = new Date();
-  const expiresAt = new Date(issuedAt.getTime() + options.ttlSeconds * 1_000);
   const sid = options.sid ?? crypto.randomUUID();
   const requestId = c.req.header("x-request-id")?.slice(0, 64) ?? null;
   const userAgent = c.req.header("user-agent")?.slice(0, 256) ?? null;
-  const [user] = await tx<Array<{ auth_epoch: string | number | bigint; provider: "local" | "ipa"; profile: "guest" | "user" }>>`
-    SELECT auth_epoch, provider, profile FROM auth.users WHERE id = ${userId}::uuid FOR UPDATE
+  const [user] = await tx<
+    Array<{ given_name: string | null; auth_epoch: string | number | bigint; provider: "local" | "ipa"; profile: "guest" | "user" }>
+  >`
+    SELECT given_name, auth_epoch, provider, profile FROM auth.users WHERE id = ${userId}::uuid FOR NO KEY UPDATE
   `;
   if (!user) throw new Error("Cannot create a session for an unknown user");
+  const issuedAt = new Date();
+  const expiresAt = new Date(issuedAt.getTime() + options.ttlSeconds * 1_000);
   if (!(await isAccountCategoryAllowed(user, tx)))
     throw new HTTPException(403, { message: "This account category is disabled. Contact an administrator." });
   const epoch = Number(user.auth_epoch);
   if (!Number.isSafeInteger(epoch) || epoch < 0) throw new Error("User auth_epoch is invalid");
+  if (options.authEpoch !== undefined && epoch !== options.authEpoch) throw new SessionEpochChangedError();
   if (options.pwaDeviceId) {
     // Device revocation locks the same user row first, so a revoked device never gets a new family.
     const [device] = await tx`
@@ -195,6 +225,14 @@ const insertFamily = async (
     `;
     if (!device) throw new Error("Cannot create an app session for an inactive device");
   }
+  if (options.appDeviceId) {
+    // A device that decides a terminal sign-in holds its row and then takes a key-share lock on this user row, so the
+    // user row above is held without blocking key-share locks. Removals that end the device's sign-ins hold the user
+    // row too, so they wait for this family.
+    const [device] = await tx`SELECT id FROM auth.app_devices
+      WHERE id=${options.appDeviceId}::uuid AND user_id=${userId}::uuid AND revoked_at IS NULL`;
+    if (!device) throw new SessionAppDeviceInactiveError("Cannot create a session for an inactive sign-in device");
+  }
   const [activeKey] = await tx<Array<{ kid: string }>>`
     UPDATE auth.signing_keys
     SET verify_until = GREATEST(verify_until, ${new Date(expiresAt.getTime() + IDENTITY_CLOCK_TOLERANCE_SECONDS * 1_000 + IDENTITY_ROLLOUT_MARGIN_MS)})
@@ -204,12 +242,15 @@ const insertFamily = async (
   if (!activeKey) throw new Error(SIGNER_INACTIVE);
   await tx`
     INSERT INTO auth.session_families (
-      sid, user_id, auth_epoch, signing_kid, issued_at, expires_at, created_request_id, created_user_agent, legal_pending, pwa_device_id
+      sid, user_id, auth_epoch, signing_kid, issued_at, expires_at, created_request_id, created_user_agent, legal_pending, pwa_device_id, app_device_id
     ) VALUES (${sid}, ${userId}, ${epoch}, ${signer.kid}, ${issuedAt}, ${expiresAt}, ${requestId}, ${userAgent},
-      NOT EXISTS (SELECT 1 FROM auth.legal_acceptances WHERE user_id = ${userId}::uuid), ${options.pwaDeviceId ?? null})
+      NOT EXISTS (SELECT 1 FROM auth.legal_acceptances WHERE user_id = ${userId}::uuid), ${options.pwaDeviceId ?? null}, ${options.appDeviceId ?? null})
   `;
+  const notice = options.knownBrowser
+    ? await rememberSignIn(tx, { ...options.knownBrowser, userId, firstName: noticeFirstName(user.given_name), now: issuedAt })
+    : null;
   if (options.recordLogin !== false) await tx`UPDATE auth.users SET last_login_local = ${issuedAt} WHERE id = ${userId}::uuid`;
-  return { userId, sid, authEpoch: epoch, issuedAt, expiresAt, signer, options };
+  return { userId, sid, authEpoch: epoch, issuedAt, expiresAt, signer, options, notice };
 };
 
 /** Signs a committed family. Null when the signer was revoked meanwhile; the family is revoked then. */
@@ -244,7 +285,13 @@ const signFamily = async (family: PreparedFamily): Promise<string | null> => {
 };
 
 /** One issuance attempt is retried once when the signing key changes underneath it. */
-const issueJwtSession = async (c: Context, userId: string, options: SessionIssueOptions, attempt = 0): Promise<string> => {
+const issueJwtSession = async (
+  c: Context,
+  userId: string,
+  options: SessionIssueOptions,
+  attempt = 0,
+  committedNotice: NewBrowserSignInNotice | null = null,
+): Promise<{ token: string; notice: NewBrowserSignInNotice | null }> => {
   const signer = await prepareIdentitySigner("session");
   let family: PreparedFamily;
   try {
@@ -252,13 +299,14 @@ const issueJwtSession = async (c: Context, userId: string, options: SessionIssue
   } catch (error) {
     if (attempt === 0 && isSignerInactive(error)) {
       invalidateIdentitySignerCache("session", signer.kid);
-      return issueJwtSession(c, userId, options, 1);
+      return issueJwtSession(c, userId, options, 1, committedNotice);
     }
     throw error;
   }
   const token = await signFamily(family);
-  if (token) return token;
-  if (attempt === 0) return issueJwtSession(c, userId, { ...options, sid: undefined }, 1);
+  const notice = committedNotice ?? family.notice;
+  if (token) return { token, notice };
+  if (attempt === 0) return issueJwtSession(c, userId, { ...options, sid: undefined }, 1, notice);
   throw new Error("Cloud session signer changed repeatedly during issuance");
 };
 
@@ -281,7 +329,7 @@ const issueInTransaction = async <T>(
       value = await sql.begin((tx) =>
         work(tx, async (userId, options) => {
           if (family) throw new Error("Only one session family per transaction");
-          family = await insertFamily(tx, c, userId, signer, options);
+          family = await insertFamily(tx, c, userId, signer, { ...options, knownBrowser: undefined });
           return family.sid;
         }),
       );
@@ -294,7 +342,7 @@ const issueInTransaction = async <T>(
     }
     if (!family) return { value, token: null };
     const token = await signFamily(family);
-    return { value, token: token ?? (await issueJwtSession(c, family.userId, { ...family.options, sid: undefined }, 1)) };
+    return { value, token: token ?? (await issueJwtSession(c, family.userId, { ...family.options, sid: undefined }, 1)).token };
   }
 };
 
@@ -349,11 +397,43 @@ export const session = {
 
   getBearerToken: (c: Context): string | null => parseBearer(c.req.header("Authorization")),
 
-  create: async (c: Context, userId: string): Promise<string> => {
+  create: async (
+    c: Context,
+    userId: string,
+    signIn: {
+      method: SignInMethod;
+      device?: string | null;
+      /** Null means this sign-in announces nothing, including during maintenance. */
+      notify: NewBrowserSignInNotifier | null;
+      /** Account epoch an earlier approval was bound to; issuance fails when sign-out everywhere moved it. */
+      authEpoch?: number;
+      /** The Cloud Login device that approved this sign-in; removing the device can end the session. */
+      appDeviceId?: string;
+    },
+  ): Promise<string> => {
     const expiryHours = await settings.get<number>("user.session.expiry_hours");
     if (!Number.isFinite(expiryHours) || expiryHours < 1) throw new Error("user.session.expiry_hours must be a positive number");
     const ttlSeconds = Math.floor(expiryHours * 60 * 60);
-    const clientToken = await issueJwtSession(c, userId, { ttlSeconds });
+    const cookie = readBrowserCookie(c) ?? newBrowserCookie();
+    const { browser, os, country, city } = describeRequest(c);
+    const { token: clientToken, notice } = await issueJwtSession(c, userId, {
+      ttlSeconds,
+      authEpoch: signIn.authEpoch,
+      appDeviceId: signIn.appDeviceId,
+      knownBrowser: {
+        cookie,
+        browser,
+        os,
+        country,
+        city,
+        method: signIn.method,
+        device: signIn.device ?? null,
+        locale: getLocale(c),
+        announce: signIn.notify !== null,
+      },
+    });
+    // Handoff precedes the response so the person signing in cannot turn the notice off first.
+    if (signIn.notify !== null && notice) await announceNewBrowser(signIn.notify, notice);
 
     setCookie(c, "session_token", clientToken, {
       httpOnly: true,
@@ -362,6 +442,7 @@ export const session = {
       maxAge: ttlSeconds,
       path: "/",
     });
+    setBrowserCookie(c, cookie);
     return clientToken;
   },
 

package/src/services/session/recent.ts

@@ -11,6 +11,15 @@ export type EligibleAccount = {
   account_expires: Date | null;
 };
 
+/** New personal access requires a browser sign-in from the last ten minutes. */
+export const LASTING_ACCESS_SIGN_IN_SECONDS = 600;
+
+export class ConfirmedBrowserSignInError extends Error {
+  constructor(readonly code: "REAUTHENTICATE" | "FORBIDDEN") {
+    super(code === "REAUTHENTICATE" ? "Sign in again to confirm it is you." : "This account cannot create new access.");
+  }
+}
+
 type Reject = (code: "REAUTHENTICATE" | "FORBIDDEN") => never;
 
 /** The account exists, has not expired and its category is enabled. */
@@ -40,3 +49,7 @@ export const requireRecentWebSession = async (
   if (!row) return reject("REAUTHENTICATE");
   return requireEligibleAccount(tx, actor.userId, reject);
 };
+
+/** Checks the browser session inside the transaction that creates personal access. */
+export const requireConfirmedBrowserSignIn = (tx: SQL, signIn: { userId: string; sid: string }, reject: Reject): Promise<EligibleAccount> =>
+  requireRecentWebSession(tx, signIn, LASTING_ACCESS_SIGN_IN_SECONDS, reject);

package/src/services/settings/api.ts

@@ -12,13 +12,14 @@
  *     `services/weather/forecast.ts`, OpenAPI middleware, cron callbacks).
  *     Loosely typed (caller provides the value type via the `T` generic).
  *
- * Backend: cache-aside via `store.ts` (Redis 5min TTL + DB fallback). All
- * functions are async — sync render-time access uses the per-request snapshot
+ * Backend: value reads use cache-aside via `store.ts` (Redis 5min TTL + DB
+ * fallback); stored-state reads use Postgres. All functions are async — sync
+ * render-time access uses the per-request snapshot
  * exposed via `c.get("settings")`.
  */
 
 import type { AppSettingsMap, KindToType } from "../../contracts/settings-types";
-import { deleteKey, readKey, writeKey } from "./store";
+import { deleteKey, readKey, readKeyState, type StoredSettingState, writeKey } from "./store";
 
 /**
  * Per-app typed settings API. Keys constrained to those declared in the
@@ -26,7 +27,8 @@ import { deleteKey, readKey, writeKey } from "./store";
  */
 export interface SettingsAPI<F extends Record<string, unknown>> {
   get<K extends keyof F & string>(key: K): Promise<F[K]>;
-  set<K extends keyof F & string>(key: K, value: F[K]): Promise<void>;
+  read<K extends keyof F & string>(key: K): Promise<{ value: F[K]; stored: StoredSettingState }>;
+  set<K extends keyof F & string>(key: K, value: F[K], options?: { replaceUnreadable?: boolean }): Promise<void>;
   remove<K extends keyof F & string>(key: K): Promise<void>;
 }
 
@@ -40,7 +42,8 @@ export const createSettingsAPI = <S extends AppSettingsMap>(): SettingsAPI<{
   [K in keyof S]: KindToType<S[K]["kind"]>;
 }> => ({
   get: async (key) => readKey(key) as never,
-  set: async (key, value) => writeKey(key, value),
+  read: async (key) => readKeyState(key) as never,
+  set: async (key, value, options) => writeKey(key, value, undefined, options),
   remove: async (key) => deleteKey(key),
 });
 
@@ -56,6 +59,8 @@ export const createSettingsAPI = <S extends AppSettingsMap>(): SettingsAPI<{
  */
 export const coreSettings = {
   get: <T = unknown>(key: string): Promise<T> => readKey(key) as Promise<T>,
-  set: (key: string, value: unknown): Promise<void> => writeKey(key, value),
+  read: <T = unknown>(key: string): Promise<{ value: T; stored: StoredSettingState }> =>
+    readKeyState(key) as Promise<{ value: T; stored: StoredSettingState }>,
+  set: (key: string, value: unknown, options?: { replaceUnreadable?: boolean }): Promise<void> => writeKey(key, value, undefined, options),
   remove: (key: string): Promise<void> => deleteKey(key),
 };

package/src/services/settings/app.ts

@@ -13,6 +13,7 @@ import { ImageMetadataError } from "../image-metadata";
 import type { SettingEntry } from ".";
 import * as settingsPrimitives from ".";
 import { SETTINGS_MAP, validateSettingValue } from "./defaults";
+import { SettingUnreadableError } from "./store";
 
 /**
  * Redact secret-kind setting values before they leave the server.
@@ -54,7 +55,7 @@ export const settingsService = {
 
       return paginateItems(filtered, config?.pagination);
     },
-    update: async (config: { key: string; value: unknown }) => {
+    update: async (config: { key: string; value: unknown; replaceUnreadable?: boolean }) => {
       if (!SETTINGS_MAP.has(config.key)) {
         return fail(err.badInput(`Unknown setting: ${config.key}`));
       }
@@ -64,11 +65,11 @@ export const settingsService = {
         return fail(err.badInput(validated.error));
       }
       try {
-        await settingsPrimitives.set(config.key, validated.value);
+        await settingsPrimitives.set(config.key, validated.value, undefined, { replaceUnreadable: config.replaceUnreadable });
         return ok(undefined);
       } catch (error) {
-        // A Result cannot carry 422; the typed HTTPException keeps its status through Hono.
-        if (error instanceof ImageMetadataError) throw error;
+        // Preserve the typed HTTP status and recovery code through Hono.
+        if (error instanceof ImageMetadataError || error instanceof SettingUnreadableError) throw error;
         const message = error instanceof Error ? error.message : String(error);
         if (message.startsWith("Unknown setting:")) {
           return fail(err.badInput(message));

package/src/services/settings/core-settings.ts

@@ -385,15 +385,16 @@ export const CORE_SETTINGS = {
     default: 10000,
     min: 100,
     max: 120000,
-    description: "Maximum time in milliseconds for one Gotenberg render request.",
+    description:
+      "Maximum time in milliseconds for one Gotenberg render request. Gotenberg's own --api-timeout (default 30 s) also caps it.",
   },
   "gotenberg.max_html_bytes": {
     kind: "number",
-    label: "Max HTML Bytes",
+    label: "Max input bytes",
     default: 1048576,
     min: 1024,
     max: 10485760,
-    description: "Maximum HTML input size accepted before sending a render request.",
+    description: "Maximum size of one render request: HTML, header, footer, images and fonts together.",
   },
   "gotenberg.max_pdf_bytes": {
     kind: "number",

package/src/services/settings/index.ts

@@ -3,8 +3,8 @@
  *
  * Resolution order: DB value -> env fallback -> code default.
  *
- * Custom DB values are encrypted at rest using APP_SECRET. All read/write
- * goes through the Redis cache-aside layer in `./store.ts` (5-minute TTL).
+ * Custom DB values are encrypted at rest using APP_SECRET. Value reads use
+ * Redis cache-aside in `./store.ts` (5-minute TTL); stored-state reads use DB.
  * `loadCache()` runs once at boot to normalize legacy rows and bootstrap
  * env-backed entries into Postgres. Startup never replaces an existing row;
  * env bootstrap only fills missing keys.
@@ -13,7 +13,7 @@
 import { redis, sql } from "bun";
 import { decryptValue, encryptValue, getAppSecret } from "./crypto";
 import { resolveSettingPresentation, SETTINGS, SETTINGS_MAP, type SettingDef, validateSettingValue } from "./defaults";
-import { bulkRead, deleteKey, readKey, writeKey } from "./store";
+import { deleteKey, readKey, readKeyState, readStates, type SettingRead, writeKey } from "./store";
 
 type SqlClient = typeof sql;
 
@@ -162,8 +162,8 @@ const bootstrapEnvBackedEntries = async (config: {
 
 /**
  * Boot-time normalization + env-bootstrap. Runs once at startup. Does NOT
- * populate any in-process cache — every read goes through Redis cache-aside
- * (`store.ts`) at request time.
+ * populate any in-process cache — value reads use Redis cache-aside
+ * (`store.ts`), and stored-state reads go directly to Postgres.
  */
 export async function loadCache(): Promise<void> {
   getAppSecret();
@@ -187,8 +187,12 @@ export async function get<T = unknown>(key: string): Promise<T> {
  * Write a setting. Pass `db` to run inside a caller's transaction — then the
  * caller must also call `invalidateSettingsCache` once it commits.
  */
-export async function set(key: string, value: unknown, db?: SqlClient): Promise<void> {
-  await writeKey(key, value, db);
+export async function set(key: string, value: unknown, db?: SqlClient, options?: { replaceUnreadable?: boolean }): Promise<void> {
+  await writeKey(key, value, db, options);
+}
+
+export async function read(key: string): Promise<SettingRead> {
+  return readKeyState(key);
 }
 
 export async function remove(key: string, db?: SqlClient): Promise<void> {
@@ -198,20 +202,17 @@ export async function remove(key: string, db?: SqlClient): Promise<void> {
 import type { SettingEntry } from "../../contracts/shared";
 
 export type { SettingEntry } from "../../contracts/shared";
-export { invalidateSettingsCache } from "./store";
+export type { SettingRead, StoredSettingState } from "./store";
+export { invalidateSettingsCache, readStates, SettingUnreadableError } from "./store";
 
 export async function getAll(locale?: string): Promise<SettingEntry[]> {
-  // Determine which keys have a custom row in Postgres (vs. falling back to
-  // env / code default). One indexed scan, then bulk-read all values.
-  const customRows = await sql<{ key: string }[]>`SELECT key FROM settings.entries`;
-  const customKeys = new Set(customRows.map((row) => row.key));
-
   const allKeys = SETTINGS.map((def) => def.key);
-  const values = await bulkRead(allKeys);
+  const values = await readStates(allKeys);
 
   return SETTINGS.map((def) => {
     const presentation = resolveSettingPresentation(def, locale);
-    const isCustom = customKeys.has(def.key);
+    const { value, stored } = values.get(def.key)!;
+    const isCustom = stored !== "none";
     const envFallback = resolveEnvValue(def, "fallback");
     const resetValue = envFallback ?? def.default;
 
@@ -222,12 +223,13 @@ export async function getAll(locale?: string): Promise<SettingEntry[]> {
       description: presentation.description ?? "",
       placeholder: presentation.placeholder,
       group: def.group,
-      value: values.get(def.key),
+      value,
       default: def.default,
       resetValue: def.kind === "secret" ? "" : resetValue,
-      valueSource: isCustom ? "custom" : envFallback === undefined ? "default" : "env",
+      valueSource: stored === "readable" ? "custom" : envFallback === undefined ? "default" : "env",
       resetValueSource: envFallback === undefined ? "default" : "env",
       isCustom,
+      unreadable: stored === "unreadable",
       templateVars: "templateVars" in def ? def.templateVars : undefined,
       options: presentation.options,
       min: "min" in def ? def.min : undefined,

package/src/services/settings/namespace.ts

@@ -1,8 +1,9 @@
-import { get, getAll, loadCache, remove, set } from "./index";
+import { get, getAll, loadCache, read, remove, set } from "./index";
 
 export const settings = {
   loadCache,
   get,
+  read,
   set,
   remove,
   getAll,

package/src/services/settings/store.ts

@@ -1,7 +1,7 @@
 /**
  * Settings store — Redis cache-aside read/write primitives.
  *
- * Pattern: each key is cached in Redis with a 5-minute TTL. Reads try Redis
+ * Pattern: each key is cached in Redis with a 5-minute TTL. Value reads try Redis
  * first, fall back to DB on miss, and populate Redis. Writes update DB and
  * delete the Redis key (next reader repopulates with fresh DB state).
  *
@@ -27,6 +27,19 @@ const REDIS_KEY = (k: string) => `settings:${k}`;
 
 type SqlClient = typeof sql;
 
+export type StoredSettingState = "none" | "readable" | "unreadable";
+export type SettingRead = { value: unknown; stored: StoredSettingState };
+
+export class SettingUnreadableError extends HTTPException {
+  readonly code = "setting_unreadable" as const;
+
+  constructor(readonly key: string) {
+    const message = `The stored value of setting "${key}" cannot be read by this application. Replace it with a new value or reset it to the default.`;
+    super(409, { message, res: Response.json({ code: "setting_unreadable", message }, { status: 409 }) });
+    this.name = "SettingUnreadableError";
+  }
+}
+
 /**
  * Forget cached values so every container re-reads on next access.
  *
@@ -70,6 +83,12 @@ const resolveFallback = (def: SettingDef | undefined): unknown => {
  */
 export const readKey = async (key: string): Promise<unknown> => (await bulkRead([key])).get(key);
 
+export const readKeyState = async (key: string): Promise<SettingRead> => {
+  const state = (await readStates([key])).get(key);
+  if (!state) throw new Error(`Missing read state for setting "${key}"`);
+  return state;
+};
+
 /** One warm MGET; missing rows are cached independently of local env/defaults. */
 export const bulkRead = async (keys: readonly string[]): Promise<Map<string, unknown>> => {
   const result = new Map<string, unknown>();
@@ -131,6 +150,32 @@ export const bulkRead = async (keys: readonly string[]): Promise<Map<string, unk
   return result;
 };
 
+/**
+ * Stored state is per process (APP_SECRET), but the plaintext cache is shared.
+ * State reads go directly to Postgres without reading or filling the cache;
+ * value reads (`get`, snapshot) keep using the cache.
+ */
+export const readStates = async (keys: readonly string[]): Promise<Map<string, SettingRead>> => {
+  const result = new Map<string, SettingRead>();
+  if (keys.length === 0) return result;
+  const rows = await sql<StoredRow[]>`SELECT key, value FROM settings.entries WHERE key = ANY(${toPgTextArray([...keys])}::text[])`;
+  const byKey = new Map(rows.map((row) => [row.key, row]));
+  for (const key of keys) {
+    const row = byKey.get(key);
+    const def = SETTINGS_MAP.get(key);
+    result.set(key, { stored: row ? "unreadable" : "none", value: resolveFallback(def) });
+    if (!row) continue;
+    try {
+      const value = await decryptValue(row.value);
+      const validated = def ? validateSettingValue(def, value) : { ok: true as const, value };
+      if (validated.ok) result.set(key, { stored: "readable", value: validated.value });
+    } catch {
+      // Keep this process's fallback without changing the stored row or cache.
+    }
+  }
+  return result;
+};
+
 /**
  * Get every known setting key (across all registered defs).
  * Used by snapshot loader to determine what to bulk-read.
@@ -184,11 +229,12 @@ export const deleteLegacyKeys = async (extraKnownKeys: readonly string[] = []):
 /**
  * Encrypt the value, upsert the DB row, invalidate the Redis key.
  *
- * Validation is the caller's responsibility — the typed wrapper API
- * (createSettingsAPI) validates against the declared SettingDef before reaching
- * here. Direct callers must ensure the value matches the setting's kind.
+ * Validate new values and refuse to overwrite unreadable stored rows unless
+ * the caller explicitly replaces them. The row check and write share a transaction.
+ * Lock with a no-op UPDATE so ROW EXCLUSIVE is acquired before the row lock,
+ * preserving lock order with table-level SHARE locks (#1303 review).
  */
-export const writeKey = async (key: string, value: unknown, db?: SqlClient): Promise<void> => {
+export const writeKey = async (key: string, value: unknown, db?: SqlClient, options?: { replaceUnreadable?: boolean }): Promise<void> => {
   const def = SETTINGS_MAP.get(key);
   if (!def) throw new Error(`Unknown setting: ${key}`);
   const validated = validateSettingValue(def, value);
@@ -197,12 +243,38 @@ export const writeKey = async (key: string, value: unknown, db?: SqlClient): Pro
   const storedValue =
     def.kind === "image" && typeof validated.value === "string" ? stripImageDataUrlMetadata(validated.value) : validated.value;
   const encrypted = await encryptValue(storedValue);
-  await (db ?? sql)`
-    INSERT INTO settings.entries (key, value, updated_at)
-    VALUES (${key}, ${encrypted}, now())
-    ON CONFLICT (key)
-    DO UPDATE SET value = ${encrypted}, updated_at = now()
-  `;
+  const write = async (tx: SqlClient) => {
+    for (let attempt = 0; attempt < 3; attempt++) {
+      let [row] = await tx<{ value: string }[]>`UPDATE settings.entries SET value = value WHERE key = ${key} RETURNING value`;
+      if (!row) {
+        const inserted = await tx<{ key: string }[]>`
+          INSERT INTO settings.entries (key, value, updated_at)
+          VALUES (${key}, ${encrypted}, now())
+          ON CONFLICT (key) DO NOTHING RETURNING key
+        `;
+        if (inserted.length > 0) return;
+        // A concurrent insert can win after the missing-row read; lock and check its value before updating.
+        [row] = await tx<{ value: string }[]>`UPDATE settings.entries SET value = value WHERE key = ${key} RETURNING value`;
+        if (!row) continue;
+      }
+      if (options?.replaceUnreadable !== true) {
+        let readable = false;
+        try {
+          readable = validateSettingValue(def, await decryptValue(row.value)).ok;
+        } catch {
+          // Only the key is exposed by the recovery error.
+        }
+        if (!readable) throw new SettingUnreadableError(key);
+      }
+      await tx`
+        UPDATE settings.entries SET value = ${encrypted}, updated_at = now() WHERE key = ${key}
+      `;
+      return;
+    }
+    throw new Error(`Could not write setting "${key}" after 3 attempts`);
+  };
+  if (db) await write(db);
+  else await sql.begin(write);
 
   // Passing a transaction means the caller owns invalidation, because the row
   // is not visible to anyone else until they commit.

package/src/services/webauthn.ts

@@ -16,6 +16,7 @@ import { accounts } from "./accounts";
 import { audit } from "./audit";
 import { logger } from "./logging";
 import { isUniqueViolation, toPgTextArray } from "./postgres";
+import { ConfirmedBrowserSignInError, requireConfirmedBrowserSignIn } from "./session/recent";
 import { coreSettings } from "./settings/api";
 
 const CHALLENGE_TTL_SECONDS = 300;
@@ -185,6 +186,7 @@ export const beginRegistration = async (params: { user: User }): Promise<Result<
 
 export const finishRegistration = async (params: {
   user: User;
+  browserSignIn: { userId: string; sid: string };
   name: string;
   response: RegistrationResponseJSON;
 }): Promise<Result<WebAuthnPasskey>> => {
@@ -221,6 +223,16 @@ export const finishRegistration = async (params: {
 
   try {
     return sql.begin(async (tx) => {
+      if (params.browserSignIn.userId !== params.user.id) return fail(err.forbidden("The browser sign-in belongs to another account."));
+      try {
+        await requireConfirmedBrowserSignIn(tx, params.browserSignIn, (code) => {
+          throw new ConfirmedBrowserSignInError(code);
+        });
+      } catch (error) {
+        if (error instanceof ConfirmedBrowserSignInError) return fail({ code: error.code, status: 403, message: error.message });
+        throw error;
+      }
+
       const [row] = await tx<DbPasskeyRow[]>`
         INSERT INTO auth.webauthn_credentials (
           user_id,

package/src/shared/ai-platform-prompt.ts

@@ -59,7 +59,7 @@ Most replies need no offer. Make at most one offer, in the last sentence of the
 {%- if memoryToolEnabled %}
 - The user corrected the tone of a result, such as a mail that is too formal, without stating a lasting rule: offer to remember it as their preference. Memory keeps only the user's own words, so a plain yes cannot be saved: suggest a one-line rule they can send back, such as "Always write mails casually and briefly".
 {%- endif %}
-- The user says the request recurs (again, every week, like last time, always), pastes a long reusable instruction, or a workflow default covers it: offer to save it as a {% if skillOffers %}Skill or {% endif %}scheduled task.
+- The user says the request recurs (again, every week, like last time, always), pastes a long reusable instruction, or a workflow default covers it: offer to save it as a {% if skillOffers %}Skill or {% endif %}routine.
 - A concrete next step clearly saves the user real work they may not know you can do: offer it, such as a manual follow-up the user mentioned, drafting the reply, or turning findings into Space tasks.
 Offer only what the Skills, tool hints, and apps in this prompt support. Do not search mail, chats, or other data only to justify an offer, and do not claim how often something happened unless the user said it or this chat shows it. Do not start the offered work until the user agrees.
 {%- if skillOffers %}

package/src/shared/app-presentation.ts

@@ -65,6 +65,7 @@ export const resolveAppPresentation = <T extends AppMeta>(app: T, requestedLocal
   return {
     ...app,
     ...resolveAppIdentityPresentation(app, requestedLocale),
+    ...(app.panel ? { panel: { ...app.panel, label: translation.panelLabel ?? app.panel.label } } : {}),
     adminNav: app.adminNav?.map((group) => ({
       ...group,
       label: (group.id && translation.adminGroups?.[group.id]) || group.label,