@k2b/cloud 0.39.0 → 0.41.0

package/src/api/auth/schemas.ts

@@ -54,6 +54,9 @@ export const AuthResponseSchema = z.object({
   user: UserSchema,
 });
 
+/** Password-change sign-in result; retry ending other sign-ins when signOutOthersFailed is true. */
+export const PasswordChangeAuthResponseSchema = AuthResponseSchema.extend({ signOutOthersFailed: z.boolean() });
+
 export const VerifyPasskeyAuthenticationSchema = z.object({
   response: z.unknown(),
   acceptedAgb: z.literal(true).optional(),

package/src/api/auth.ts

@@ -9,6 +9,7 @@ import { accounts, audit, authFlows, getFreeIpaConfig, logger, webauthn } from "
 import { isAccountCategoryAllowed } from "../services/account-category-policy";
 import type { AuthNotificationSender } from "../services/auth-flows/notification-sender";
 import { legalConsent } from "../services/legal-consent";
+import { SessionEpochChangedError } from "../services/session";
 import * as categorySettings from "../services/settings";
 import { publicCloudOrigin } from "../shared/app-url";
 
@@ -20,6 +21,7 @@ import {
   AuthResponseSchema,
   EmailLoginSchema,
   LoginSchema,
+  PasswordChangeAuthResponseSchema,
   PasswordResetCompleteSchema,
   PasswordResetRequestSchema,
   VerifyPasskeyAuthenticationSchema,
@@ -52,6 +54,7 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         responses: {
           200: jsonResponse(AuthResponseSchema, "Login successful"),
           401: jsonResponse(ErrorResponseSchema, "Invalid username or password"),
+          409: jsonResponse(ErrorResponseSchema, "Signed out everywhere while signing in; sign in again"),
           503: jsonResponse(ErrorResponseSchema, "FreeIPA unavailable"),
         },
       }),
@@ -76,7 +79,18 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         }
 
         // Issue through the configured migration gate (legacy opaque or JWT family).
-        const sessionToken = await auth.session.create(c, loginResult.userId);
+        let sessionToken: string;
+        try {
+          sessionToken = await auth.session.create(c, loginResult.userId, {
+            method: "password",
+            notify: notificationSender.sendNewBrowserSignIn,
+            authEpoch: loginResult.authEpoch,
+          });
+        } catch (error) {
+          if (error instanceof SessionEpochChangedError)
+            return c.json({ message: "You were signed out everywhere while signing in. Sign in again." }, 409);
+          throw error;
+        }
 
         log.info("Login successful", { uid: loginResult.user.uid });
         return c.json({
@@ -119,7 +133,10 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
           return c.json({ message: result.error.message, code: result.error.code }, status as 400 | 401 | 403 | 404 | 409 | 500);
         }
 
-        const sessionToken = await auth.session.create(c, result.data.user.id);
+        const sessionToken = await auth.session.create(c, result.data.user.id, {
+          method: "passkey",
+          notify: notificationSender.sendNewBrowserSignIn,
+        });
         log.info("Passkey login successful", { uid: result.data.user.uid });
         return c.json({ session_token: sessionToken, user: result.data.user });
       },
@@ -147,10 +164,11 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         tags: ["Auth"],
         summary: "Change expired password",
         description:
-          "Change an expired or temporary password using FreeIPA's change_password endpoint. No active session required. For regular password changes of a logged-in user, use POST /api/me/password instead.",
+          "Change an expired or temporary password using FreeIPA's change_password endpoint. Ends the account's existing sign-ins before creating the new browser session. When signOutOthersFailed is true, the new browser session is issued and the client retries POST /api/me/sign-ins/sign-out-others. No active session required. For regular password changes of a logged-in user, use POST /api/me/password instead.",
         responses: {
-          200: jsonResponse(AuthResponseSchema, "Password changed and logged in"),
+          200: jsonResponse(PasswordChangeAuthResponseSchema, "Password changed and logged in"),
           400: jsonResponse(ErrorResponseSchema, "Failed to change password"),
+          409: jsonResponse(ErrorResponseSchema, "Password changed, but signed out everywhere while signing in; sign in again"),
           503: jsonResponse(ErrorResponseSchema, "FreeIPA unavailable"),
         },
       }),
@@ -177,10 +195,24 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
           return jsonError(c, changeResult.message, changeResult.status === 401 ? 401 : 400);
         }
 
-        const sessionToken = await auth.session.create(c, changeResult.userId);
+        let sessionToken: string;
+        try {
+          sessionToken = await auth.session.create(c, changeResult.userId, {
+            method: "expired_password",
+            notify: notificationSender.sendNewBrowserSignIn,
+            authEpoch: changeResult.authEpoch,
+          });
+        } catch (error) {
+          if (error instanceof SessionEpochChangedError)
+            return c.json(
+              { message: "Your password was changed, but you were signed out everywhere while signing in. Sign in again." },
+              409,
+            );
+          throw error;
+        }
 
         log.info("Password changed via expired flow", { uid: username });
-        return c.json({ session_token: sessionToken, user: changeResult.user });
+        return c.json({ session_token: sessionToken, user: changeResult.user, signOutOthersFailed: changeResult.signOutOthersFailed });
       },
     )
     .post(
@@ -228,7 +260,11 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         }
 
         // Create session (no IPA session for email-only users)
-        const sessionToken = await auth.session.create(c, verifyResult.userId);
+        const sessionToken = await auth.session.create(c, verifyResult.userId, {
+          method: "email_code",
+          // An account created by this sign-in has nobody else to warn.
+          notify: verifyResult.createdGuest ? null : notificationSender.sendNewBrowserSignIn,
+        });
 
         if (verifyResult.createdGuest) {
           log.info("Guest user created", {
@@ -265,11 +301,13 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         tags: ["Auth"],
         summary: "Complete password reset",
         description:
-          "Set a new password using a one-time reset token. Creates a normal Cloud session only after the password was changed successfully.",
+          "Use a one-time reset token to first sign the account out everywhere, including unpairing Cloud Login and mobile app phones, then set the password, sign out everywhere again and create the new browser session. If signing out everywhere fails before the change, the password stays unchanged; if it fails after the change, no session is issued. Both answer 500, and a new reset link is required. signOutOthersFailed is false whenever a session is issued.",
         responses: {
-          200: jsonResponse(AuthResponseSchema, "Password reset completed and session created"),
+          200: jsonResponse(PasswordChangeAuthResponseSchema, "Password reset completed and session created"),
           400: jsonResponse(ErrorResponseSchema, "Password reset failed"),
           401: jsonResponse(ErrorResponseSchema, "Invalid or expired reset token"),
+          409: jsonResponse(ErrorResponseSchema, "Password changed, but signed out everywhere while signing in; sign in again"),
+          500: jsonResponse(ErrorResponseSchema, "Password reset failed"),
         },
       }),
       v("json", PasswordResetCompleteSchema),
@@ -288,9 +326,23 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
           return jsonError(c, result.message, status);
         }
 
-        const sessionToken = await auth.session.create(c, result.userId);
+        let sessionToken: string;
+        try {
+          sessionToken = await auth.session.create(c, result.userId, {
+            method: "password_reset",
+            notify: notificationSender.sendNewBrowserSignIn,
+            authEpoch: result.authEpoch,
+          });
+        } catch (error) {
+          if (error instanceof SessionEpochChangedError)
+            return c.json(
+              { message: "Your password was changed, but you were signed out everywhere while signing in. Sign in again." },
+              409,
+            );
+          throw error;
+        }
         log.info("Password reset completed", { uid: result.user.uid });
-        return c.json({ user: result.user, session_token: sessionToken });
+        return c.json({ user: result.user, session_token: sessionToken, signOutOthersFailed: result.signOutOthersFailed });
       },
     )
     .post(
@@ -359,7 +411,10 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         const user = await accounts.users.get({ uid: "admin" });
         if (!user) return jsonError(c, "Failed to resolve admin user.", 500);
 
-        const sessionToken = await auth.session.create(c, user.id);
+        const sessionToken = await auth.session.create(c, user.id, {
+          method: "admin_token",
+          notify: notificationSender.sendNewBrowserSignIn,
+        });
         log.info("Admin login successful");
         return c.json({ session_token: sessionToken, user });
       },

package/src/api/capabilities.ts

@@ -3,6 +3,11 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { resolveCapabilityManifestPresentation } from "../_internal/capabilities";
+import {
+  capabilityActionReceiptIssues,
+  capabilityActionReviewIssues,
+  capabilityQueryChecksActionOutcome,
+} from "../_internal/capability-reviews";
 import { getCapability, listApps } from "../_internal/registry";
 import { resolveCommandLink } from "../capabilities/command-link";
 import {
@@ -25,12 +30,13 @@ import {
   CAPABILITY_MAX_RESULT_BYTES,
   CAPABILITY_ORIGIN_HEADER,
   CAPABILITY_PROTOCOL_VERSION,
-  CapabilityActionReviewSchema,
+  CapabilityActionReviewDataSchema,
   type CapabilityCatalog,
   CapabilityCatalogSchema,
   CapabilityErrorSchema,
   CapabilityIdempotencyKeySchema,
   type CapabilityOrigin,
+  capabilityActionPolicy,
   capabilityResultJsonSchema,
 } from "../contracts/capabilities";
 import { CapabilityStreamSchema } from "../contracts/capability-streams";
@@ -48,6 +54,7 @@ import {
   requiresAuth,
   v,
 } from "../server";
+import { noTransform } from "../server/middleware/no-transform";
 import { logger, settings } from "../services";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { capabilityInvocationOperation } from "../services/identity/invocation-operations";
@@ -60,7 +67,7 @@ import { capabilityMessages } from "../shared/capability-messages";
 import { dispatchCapabilityStream, sealCapabilityStream } from "./capability-streams";
 
 const log = logger("capabilities");
-const QUERY_TIMEOUT_MS = 15_000;
+export const QUERY_TIMEOUT_MS = 15_000;
 const ACTION_TIMEOUT_MS = 30_000;
 const DEFAULT_CATALOG_LIMIT = 10;
 const MAX_CATALOG_LIMIT = 25;
@@ -238,6 +245,8 @@ export type CapabilityDispatchParams = {
   authority?: RequestAuthority;
   mandate?: MandatedCapabilityAuthority;
   callingAppId?: string;
+  /** Internal observation only: called immediately before attempting the app request. */
+  onUpstreamAttempt?: () => void;
   dependencies?: CapabilityDispatchDependencies;
 };
 
@@ -381,6 +390,7 @@ const runCapabilityDispatch = async (
                     actionApproval: mandate.actionApproval ?? "none",
                     input: params.input,
                     capabilityApproval: "approval" in operation ? (operation.approval ?? "always") : "always",
+                    capabilityPolicy: capabilityActionPolicy(entry.manifest, params.capabilityId),
                     requestId,
                   },
                   async (mandateAuthority) => {
@@ -547,6 +557,7 @@ const runCapabilityDispatch = async (
 
   let response: Response;
   try {
+    params.onUpstreamAttempt?.();
     response = await fetchUpstream(
       `${entry.endpoint}/${params.kind}/${encodeURIComponent(params.capabilityId)}${params.review ? "/review" : ""}`,
       {
@@ -608,18 +619,39 @@ const runCapabilityDispatch = async (
     return settle(invalid, "uncertain");
   }
 
+  const reviewContext = {
+    policy: capabilityActionPolicy(entry.manifest, params.capabilityId),
+    approval: "approval" in operation ? operation.approval : undefined,
+    queries: entry.manifest.queries,
+    validateQueryInput: (query: (typeof entry.manifest.queries)[number], input: Record<string, unknown>) =>
+      schemaValidator(`${query.schemaHash}:input`, query.inputSchema)?.safeParse(input).success === true,
+    ...(entry.presentation ? { locales: [entry.presentation.baseLocale, ...Object.keys(entry.presentation.translations)] } : {}),
+  };
   const resultValidator = params.review
-    ? CapabilityActionReviewSchema
+    ? CapabilityActionReviewDataSchema
     : schemaValidator(`${operation.schemaHash}:result`, capabilityResultJsonSchema(operation.dataSchema));
   const parsedResult = resultValidator?.safeParse(upstreamBody.data);
-  const parsedReview = params.review ? CapabilityActionReviewSchema.safeParse(upstreamBody.data) : null;
-  // A rememberable Action may leave out its scope for arguments that should ask every time; any other Action has none.
-  const reviewApprovalScopeIsValid =
-    !params.review ||
-    !parsedReview?.success ||
-    ("approval" in operation && operation.approval === "rememberable") ||
-    parsedReview.data.approvalScope === undefined;
-  if (!resultValidator || !parsedResult?.success || !reviewApprovalScopeIsValid) {
+  const field = (value: unknown, key: string): unknown =>
+    value !== null && typeof value === "object" ? Object.getOwnPropertyDescriptor(value, key)?.value : undefined;
+  const receipt = field(upstreamBody.data, "receipt");
+  const links = field(upstreamBody.data, "links");
+  const reviewIssues = params.review
+    ? capabilityActionReviewIssues(upstreamBody.data, reviewContext)
+    : receipt === undefined
+      ? []
+      : params.kind === "queries"
+        ? ["Queries cannot return a receipt"]
+        : capabilityActionReceiptIssues(receipt, links);
+  const nestedReceipt = field(field(upstreamBody.data, "data"), "receipt");
+  if (
+    !params.review &&
+    params.kind === "queries" &&
+    nestedReceipt !== undefined &&
+    !("idempotency" in operation) &&
+    capabilityQueryChecksActionOutcome(operation)
+  )
+    reviewIssues.push(...capabilityActionReceiptIssues(nestedReceipt, links));
+  if (!resultValidator || !parsedResult?.success || reviewIssues.length > 0) {
     if (actionWithoutRetrySafety) return settle(outcomeUnknown(), "uncertain");
     const invalid = errorResponse("INVALID_APP_RESPONSE", messages.outsideResultSchema({ appId: params.appId }), 502);
     return settle(invalid, "uncertain");
@@ -741,6 +773,7 @@ export const createCapabilityRoutes = (dependencies: CapabilityRouteDependencies
     (c.req.param("kind") === "actions" ? requireWriteScope : requireReadScope)(c, next);
 
   return new Hono<AuthContext>()
+    .use("/capabilities/v1/*", noTransform())
     .use("/capabilities/v1/*", dependencies.authenticate ?? auth.requireRole("authenticated"))
     .use("/capabilities/v1/*", rejectReservedWorkloadCredential)
     .post(

package/src/api/capability-streams.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
+import { capabilityActionReceiptIssues } from "../_internal/capability-reviews";
 import { getCapability } from "../_internal/registry";
 import { recordCapabilityExecution } from "../capabilities/executions";
 import { exactStream } from "../capabilities/stream-body";
@@ -245,6 +246,17 @@ export async function dispatchCapabilityStream(
         await record(502, "STREAM_FAILED");
         return denied(502, "STREAM_FAILED");
       }
+      // The same receipt rules as an ordinary Action result, so a stream completion cannot skip them.
+      if (
+        nested &&
+        typeof nested === "object" &&
+        "receipt" in nested &&
+        nested.receipt !== undefined &&
+        (grant.kind !== "actions" || capabilityActionReceiptIssues(nested.receipt, "links" in nested ? nested.links : undefined).length > 0)
+      ) {
+        await record(502, "STREAM_FAILED");
+        return denied(502, "STREAM_FAILED");
+      }
     }
     if (!response.ok) {
       const error = CapabilityErrorSchema.safeParse(receipt.data);

package/src/api/help.ts

@@ -1,10 +1,9 @@
-import { keyboardPlatform } from "@k2b/ui";
 import { Hono, type MiddlewareHandler } from "hono";
-import { helpAgentMarkdown } from "../_internal/help-catalog";
 import { type AuthContext, auth, getLocale } from "../server";
+import { buildHelpDocumentPayload } from "../server/help-payload";
 import { createHelpReader, type HelpReaderFactory } from "../services/help";
-import { type HelpDocumentPayload, type HelpSearchPayload, parseHelpReference } from "../shared/help";
-import { renderHelpMarkdown } from "../shared/markdown";
+import type { HelpSearchPayload } from "../shared/help";
+import type { renderHelpMarkdown } from "../shared/markdown";
 import { helpApiMessages } from "./help-messages";
 
 export type HelpRouteDependencies = {
@@ -36,30 +35,7 @@ export const createHelpRoutes = (dependencies: HelpRouteDependencies = {}) => {
       const { t } = helpApiMessages.resolve([locale]);
       const document = await reader(locale, c.get("actor")).read({ appId: c.req.param("appId"), documentId: c.req.param("documentId") });
       if (!document) return c.json({ code: "HELP_NOT_FOUND", message: t.notFound }, 404);
-      const links = (reference: { appId?: string; documentId: string }) =>
-        document.links[`${reference.appId ?? document.appId}/${reference.documentId}`];
-      const resolve = (reference: string) => {
-        const ref = parseHelpReference(reference);
-        return ref ? links(ref) : undefined;
-      };
-      const payload: HelpDocumentPayload = {
-        locale: document.locale,
-        id: document.documentId,
-        title: document.title,
-        markdown: helpAgentMarkdown(document),
-        kind: document.kind,
-        needs: document.needs,
-        next: document.next ? resolve(document.next) : undefined,
-        related: document.related.flatMap((reference) => {
-          const target = resolve(reference);
-          return target ? [target] : [];
-        }),
-        html: (dependencies.renderMarkdown ?? renderHelpMarkdown)(document.markdown, {
-          locale: document.locale,
-          platform: keyboardPlatform(c.req.header("User-Agent") ?? ""),
-          links,
-        }),
-      };
+      const payload = buildHelpDocumentPayload(document, c.req.header("User-Agent") ?? "", dependencies.renderMarkdown);
       return c.json(payload);
     });
 };

package/src/api/index.ts

@@ -26,6 +26,7 @@ import adminAiQuotaRoutes from "./admin-ai-quotas";
 import adminAiSkillsRoutes from "./admin-ai-skills";
 import adminAiUsageRoutes from "./admin-ai-usage";
 import adminCoreSettingsRoutes from "./admin-core-settings";
+import adminGeoIpRoutes from "./admin-geoip";
 import adminIdentityRoutes from "./admin-identity";
 import adminLifecycleRoutes from "./admin-lifecycle";
 import adminLinuxIdentityRoutes from "./admin-linux-identities";
@@ -69,7 +70,10 @@ const buildCoreApi = (options: CoreApiOptions) => {
   const widgetRoutes = createWidgetRoutes();
   return new Hono()
     .use(prettyJSON())
-    .route("/auth/app-approval/v1", createAppApprovalRoutes(undefined, undefined, options.terminalLogins))
+    .route(
+      "/auth/app-approval/v1",
+      createAppApprovalRoutes({ notify: options.notifications.sendNewBrowserSignIn }, undefined, undefined, options.terminalLogins),
+    )
     .route("/auth/pwa/v1", createPwaRoutes())
     .route("/auth", createAuthRoutes(options.notifications))
     .route("/me", meRoutes)
@@ -86,6 +90,7 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/admin/core/settings", adminCoreSettingsRoutes)
     .route("/admin/core/rail", adminRailRoutes)
     .route("/admin/core/linux-identities", adminLinuxIdentityRoutes)
+    .route("/admin/core/geoip", adminGeoIpRoutes)
     .route("/admin/identity", adminIdentityRoutes)
     .route("/admin/sync", createSyncOpsProxyRoutes())
     .route("/admin/lifecycle", adminLifecycleRoutes)

package/src/api/lasting-access-messages.ts

@@ -0,0 +1,17 @@
+import { i18n } from "@k2b/stdlib";
+
+export const lastingAccessApiMessages = i18n.define({
+  baseLocale: "en",
+  messages: {
+    en: {
+      browserSignInRequired: "Create API keys and passkeys in the browser.",
+      reauthenticate: "Sign in again to confirm it is you.",
+      forbidden: "This account cannot create new access.",
+    },
+    de: {
+      browserSignInRequired: "API-Schlüssel und Passkeys legst du im Browser an.",
+      reauthenticate: "Melde dich erneut an, um zu bestätigen, dass du es bist.",
+      forbidden: "Dieses Konto kann keinen neuen Zugang anlegen.",
+    },
+  },
+});

package/src/api/mcp.ts

@@ -15,6 +15,7 @@ import {
 import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
+import { capabilitySentenceText } from "../_internal/capability-sentences";
 import {
   HELP_SEARCH_MAX_LIMIT,
   helpAgentMarkdown,
@@ -31,6 +32,7 @@ import {
   CAPABILITY_MAX_RESULT_BYTES,
   CAPABILITY_PROTOCOL_VERSION,
   type CapabilityActionManifest,
+  CapabilityActionReceiptSchema,
   type CapabilityQueryManifest,
   CapabilitySemanticLinkSchema,
   type CloudResourceRef,
@@ -42,11 +44,14 @@ import {
 } from "../contracts/capabilities";
 import type { AppRegistryEntry, CapabilityRegistryEntry } from "../contracts/registry";
 import { type AuthContext, auth, type RequestAuthority, rateLimit, rejectReservedWorkloadCredential, resolveLocale } from "../server";
+import { preferredLocale } from "../server/locale";
+import { noTransform } from "../server/middleware/no-transform";
 import { createHelpReader, type HelpArticle, type HelpMetadata, type HelpReader, type HelpReaderFactory } from "../services/help";
 import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
 import { logger } from "../services/logging";
 import { get } from "../services/settings";
 import { cloudMcpResourceUri, publicCloudOrigin } from "../shared/app-url";
+import { normalizeTimeZone } from "../shared/time";
 import { type CapabilityDispatchDependencies, dispatchCapability } from "./capabilities";
 
 const MCP_TOOL_PAGE_SIZE = 100;
@@ -66,6 +71,7 @@ type McpRouteDependencies = CapabilityDispatchDependencies & {
   listApps?: () => Promise<AppRegistryEntry[]>;
   help?: HelpReaderFactory;
   getOperatorLocale?: () => Promise<string | undefined>;
+  getOperatorTimeZone?: () => Promise<string | undefined>;
   getAppUrl?: () => Promise<string>;
   authenticate?: MiddlewareHandler<AuthContext>;
   limit?: MiddlewareHandler<AuthContext>;
@@ -681,14 +687,33 @@ const createMcpServer = (
         origin,
       );
     }
-    const resultFor = (value: Record<string, unknown>): CallToolResult => {
+    const receipt = response.ok && selected.kind === "actions" ? CapabilityActionReceiptSchema.safeParse(body.receipt) : null;
+    let receiptText: string | undefined;
+    if (receipt?.success) {
+      // The receipt line is extra presentation: if Cloud cannot word it, the completed Action's result still goes out.
+      try {
+        const locale = preferredLocale(request.headers) ?? (await resolveHelpLocale());
+        const timeZone = normalizeTimeZone(
+          await (dependencies.getOperatorTimeZone ?? (() => get<string>("app.timezone")))().catch(() => "UTC"),
+        );
+        receiptText = capabilitySentenceText(receipt.data.text, receipt.data.slots ?? {}, { locale, timeZone });
+      } catch (error) {
+        log.warn("MCP receipt text unavailable", { error: error instanceof Error ? error.message : String(error) });
+      }
+    }
+    const resultFor = (value: Record<string, unknown>, withReceipt = true): CallToolResult => {
       const result = toolResult(value, !response.ok);
       if (origin) result.content.push(...semanticResourceLinks(value, origin));
+      if (withReceipt && receiptText) result.content.unshift({ type: "text", text: receiptText });
       return result;
     };
-    // Added hrefs are optional: they never turn a result that fits into RESPONSE_TOO_LARGE.
+    // Both enrichments are optional: neither turns a result that fits into RESPONSE_TOO_LARGE.
     const result = resultFor(body);
-    return ensureBoundedToolResult(fitsToolResult(result) || body === providerBody ? result : resultFor(providerBody));
+    if (fitsToolResult(result)) return result;
+    const plain = resultFor(body, false);
+    if (fitsToolResult(plain)) return plain;
+    const original = resultFor(providerBody);
+    return ensureBoundedToolResult(fitsToolResult(original) ? original : resultFor(providerBody, false));
   });
 
   return server;
@@ -750,6 +775,8 @@ export const createMcpProtectedResourceRoutes = (dependencies: Pick<McpRouteDepe
 /** One authenticated, stateless MCP endpoint projected from live capabilities. */
 export const createMcpRoutes = (dependencies: McpRouteDependencies = {}) =>
   new Hono<AuthContext>()
+    .use("/mcp/v1", noTransform())
+    .use("/mcp/v1/*", noTransform())
     .use("/mcp/v1", validateMcpOrigin(dependencies.getAppUrl ?? defaultAppUrl))
     .use("/mcp/v1", dependencies.authenticate ?? mcpAuthentication(dependencies.getAppUrl ?? defaultAppUrl))
     .use("/mcp/v1", rejectReservedWorkloadCredential)

package/src/api/me-panel-consent.ts

@@ -0,0 +1,71 @@
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { CapabilityAppIdSchema } from "../contracts/capabilities";
+import { panelProviderNeedsConsent } from "../contracts/panel-context-plain";
+import { type AuthContext, jsonResponse, requiresAuth, v } from "../server";
+import { PanelConsentCancelled, panelContextConsent } from "../services/panel-context-consent";
+import { getRuntimeContext } from "../ssr/runtime";
+
+const AnswerSchema = z.object({ allowed: z.boolean(), revision: z.number().int().min(0).max(2_147_483_647) }).strict();
+const AnswersSchema = z.object({ answers: z.record(CapabilityAppIdSchema, AnswerSchema) }).strict();
+const ProviderSchema = z.object({ provider: CapabilityAppIdSchema }).strict();
+const SavedSchema = ProviderSchema.extend(AnswerSchema.shape).strict();
+
+/** Mounted below /me's session and user guards. The live request registry owns provider membership. */
+export const createMePanelConsentRoutes = (service = panelContextConsent) => {
+  const providers = (c: Parameters<typeof getRuntimeContext>[0]) =>
+    getRuntimeContext(c)
+      .apps.filter((app) => app.panel && panelProviderNeedsConsent(app.id))
+      .map((app) => app.id);
+  return new Hono<AuthContext>()
+    .use("*", async (c, next) => {
+      c.header("Cache-Control", "no-store");
+      if (!c.get("user")) return c.json({ message: "Authentication required" }, 401);
+      await next();
+    })
+    .get(
+      "/panel-consent",
+      describeRoute({
+        tags: ["Me"],
+        summary: "Read personal panel context answers",
+        ...requiresAuth,
+        responses: { 200: jsonResponse(AnswersSchema, "Answers for registered panel providers") },
+      }),
+      async (c) => c.json({ answers: await service.list(c.get("user").id, providers(c)) }),
+    )
+    .put(
+      "/panel-consent/:provider",
+      describeRoute({
+        tags: ["Me"],
+        summary: "Save a personal panel context answer",
+        ...requiresAuth,
+        responses: {
+          200: jsonResponse(SavedSchema, "Saved answer"),
+          404: { description: "Panel provider not found" },
+          409: { description: "Answer changed since it was read" },
+        },
+      }),
+      // The answer and revision fit within 256 bytes, including ordinary JSON whitespace.
+      bodyLimit({ maxSize: 256 }),
+      v("param", ProviderSchema),
+      v("json", AnswerSchema),
+      async (c) => {
+        const { provider } = c.req.valid("param");
+        if (!providers(c).includes(provider)) return c.json({ code: "PANEL_PROVIDER_NOT_FOUND", message: "Panel provider not found" }, 404);
+        const { allowed, revision } = c.req.valid("json");
+        let saved: Awaited<ReturnType<typeof service.set>>;
+        try {
+          saved = await service.set(c.get("user").id, provider, allowed, revision, c.req.raw.signal);
+        } catch (error) {
+          // The browser stopped waiting; the save was rolled back and nobody reads this answer.
+          if (error instanceof PanelConsentCancelled) return c.json({ code: "CANCELLED", message: "Request cancelled" }, 503);
+          throw error;
+        }
+        return saved
+          ? c.json({ provider, ...saved })
+          : c.json({ code: "CONFLICT", message: "Panel consent changed. Read the current answer before saving again." }, 409);
+      },
+    );
+};