@k2b/cloud 0.40.0 → 0.42.0

package/src/api/capability-streams.ts

@@ -15,9 +15,10 @@ import {
   capabilityResultSchema,
 } from "../contracts/capabilities";
 import type { RequestAuthority } from "../server";
+import { AppAccessDeniedError, appAccessDeniedBody } from "../server/middleware/app-access";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { capabilityInvocationOperation } from "../services/identity/invocation-operations";
-import { signInvocationToken } from "../services/identity/invocation-token";
+import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 import { logger } from "../services/logging";
 import { decryptSecret, encryptSecret } from "../services/secrets";
@@ -142,17 +143,20 @@ export async function dispatchCapabilityStream(
     destructive = "destructive" in operation && operation.destructive;
     const signed = await (dependencies.withActiveSigner ?? withActiveIdentitySigner)(
       "invocation",
-      (signer) =>
-        (dependencies.signInvocation ?? signInvocationToken)({
-          targetAppId: grant.appId,
-          callingAppId: "core",
-          operation: capabilityInvocationOperation(grant.kind, grant.capabilityId),
-          schemaHash: operation.schemaHash,
-          authority: invocationAuthorityFromRequest(authority),
-          requestId: grant.requestId,
-          signer,
-          issuer: signer.issuer,
-        }),
+      (signer, db) =>
+        (dependencies.signInvocation ?? signInvocationToken)(
+          {
+            targetAppId: grant.appId,
+            callingAppId: "core",
+            operation: capabilityInvocationOperation(grant.kind, grant.capabilityId),
+            schemaHash: operation.schemaHash,
+            authority: invocationAuthorityFromRequest(authority),
+            requestId: grant.requestId,
+            signer,
+            issuer: signer.issuer,
+          },
+          { db, groupsAdmin: signer.groupsAdmin },
+        ),
       { signal, timeoutMs: 30_000 },
     );
     const headers = new Headers({
@@ -265,7 +269,11 @@ export async function dispatchCapabilityStream(
       if (!error.success || response.status === 401) return denied(status, "STREAM_FAILED");
     } else await record(response.status);
     return Response.json(receipt.data, { status: response.status, headers: { "cache-control": "no-store" } });
-  } catch {
+  } catch (error) {
+    if (error instanceof AppAccessDeniedError) {
+      await record(403, error.code);
+      return Response.json(appAccessDeniedBody(error.app), { status: 403 });
+    }
     const status = request.signal.aborted ? 499 : signal.aborted ? 504 : 502;
     const code = status === 499 ? "REQUEST_CANCELLED" : status === 504 ? "DEADLINE_EXCEEDED" : "STREAM_FAILED";
     await record(status, code);

package/src/api/cli-plugins.ts

@@ -4,13 +4,16 @@ import { listApps } from "../_internal/registry";
 import type { CloudCliPluginSummary } from "../cli/plugin";
 import type { AuthContext } from "../server/middleware/auth";
 
+import { appAccessAuthority } from "../services/app-access";
+import { discoverableApps } from "../services/app-discovery";
+
 /**
  * `GET /cli/plugins`: the `cld` plugins that live applications serve, under
  * the same access rule as the plugin downloads. Core mounts this list; each
  * application serves its own plugin files.
  */
 export const cliPluginListRoutes = new Hono<AuthContext>().get("/", requireCliPluginAccess, async (c) => {
-  const plugins: CloudCliPluginSummary[] = (await listApps())
+  const plugins: CloudCliPluginSummary[] = (await discoverableApps(appAccessAuthority(c), await listApps()))
     .flatMap((app) => (app.cliModules ?? []).map((name) => ({ name, app: app.id, version: app.runtime?.version ?? "unknown" })))
     .sort((left, right) => (left.name < right.name ? -1 : left.name > right.name ? 1 : 0));
   return c.json({ plugins }, 200, { "cache-control": "private, no-store" });

package/src/api/geo-glyphs.ts

@@ -0,0 +1,11 @@
+import { appAssetPath } from "../server/app-assets";
+
+declare const __CLOUD_APP_ASSETS__: string | undefined;
+
+/** The route validates the font and range before resolving a bundled asset. */
+export const geoGlyphFile = (font: string, range: string) =>
+  Bun.file(
+    typeof __CLOUD_APP_ASSETS__ === "string"
+      ? appAssetPath("map-glyphs", font, range)
+      : new URL(`./map-glyphs/${encodeURIComponent(font)}/${range}`, import.meta.resolve("@k2b/ui/package.json")),
+  );

package/src/api/geo.ts

@@ -0,0 +1,128 @@
+import { mapStyle } from "@k2b/ui";
+import { Hono, type MiddlewareHandler } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { GEO_MAP_MAX_ZOOM } from "../contracts/geo-map";
+import { type AuthContext, auth, getLocale, requiresAuth, v } from "../server";
+import { REQUEST_IDLE_TIMEOUT_SECONDS, setRequestTimeout } from "../server/request-timeout";
+import { GEO_TIMEOUT_MS } from "../services/geo/bucket";
+import { GeoError } from "../services/geo/errors";
+import { coreGeoMap } from "../services/geo/map";
+
+import { geoGlyphFile } from "./geo-glyphs";
+
+const styleQuery = z.object({
+  theme: z.enum(["light", "dark"]).default("light"),
+  locale: z
+    .string()
+    .max(100)
+    .refine((locale) => {
+      try {
+        new Intl.Locale(locale);
+        return true;
+      } catch {
+        return false;
+      }
+    })
+    .optional(),
+});
+const tileParams = z.object({
+  z: z.coerce.number().int().min(0).max(GEO_MAP_MAX_ZOOM),
+  x: z.coerce.number().int().nonnegative(),
+  y: z.string().regex(/^\d+\.pbf$/),
+});
+const glyphParams = z.object({ font: z.literal("IBM Plex Sans Medium"), range: z.string().regex(/^\d+-\d+\.pbf$/) });
+
+export const createGeoRoutes = (
+  authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("authenticated"),
+  service: typeof coreGeoMap = coreGeoMap,
+) =>
+  new Hono<AuthContext>()
+    .use("*", authenticate)
+    .use("*", auth.requireOAuthScope("read", "admin"))
+    .onError((cause, c) => {
+      const error = cause instanceof GeoError ? cause : new GeoError("GEO_PROVIDER_FAILED");
+      c.header("Cache-Control", "private, no-store");
+      if (error.code === "GEO_BUSY") c.header("Retry-After", String(error.details.retryAfterSeconds ?? 1));
+      return Response.json(
+        { code: error.code, details: error.details },
+        {
+          status: error.status,
+          headers: {
+            "Cache-Control": "private, no-store",
+            ...(error.code === "GEO_BUSY" ? { "Retry-After": String(error.details.retryAfterSeconds ?? 1) } : {}),
+          },
+        },
+      );
+    })
+    .get(
+      "/style",
+      describeRoute({ ...requiresAuth, tags: ["Places and maps"], summary: "Get the Cloud map style with same-origin tiles and glyphs" }),
+      v("query", styleQuery),
+      async (c) => {
+        const query = c.req.valid("query");
+        const locale = query.locale ?? getLocale(c);
+        await service.style({ theme: query.theme }, { actor: c.get("actor"), accessSubject: c.get("accessSubject"), locale });
+        c.header("Cache-Control", "private, no-store");
+        return c.json(
+          mapStyle({
+            theme: query.theme,
+            locale,
+            tiles: "/api/geo/tiles/{z}/{x}/{y}.pbf",
+            glyphs: "/api/geo/glyphs/{fontstack}/{range}.pbf",
+            maxzoom: GEO_MAP_MAX_ZOOM,
+          }),
+        );
+      },
+    )
+    .get(
+      "/tiles/:z/:x/:y",
+      describeRoute({ ...requiresAuth, tags: ["Places and maps"], summary: "Load one budgeted Geoapify EU vector tile" }),
+      v("param", tileParams),
+      async (c) => {
+        const params = c.req.valid("param");
+        setRequestTimeout(c, Math.ceil(GEO_TIMEOUT_MS.tiles / 1000) + REQUEST_IDLE_TIMEOUT_SECONDS);
+        try {
+          const bytes = await service.tile(
+            { z: params.z, x: params.x, y: Number(params.y.slice(0, -4)) },
+            {
+              actor: c.get("actor"),
+              accessSubject: c.get("accessSubject"),
+              locale: getLocale(c),
+              signal: c.req.raw.signal,
+            },
+          );
+          return new Response(bytes, {
+            headers: {
+              "Content-Type": "application/vnd.mapbox-vector-tile",
+              "Cache-Control": "private, max-age=604800",
+              "X-Content-Type-Options": "nosniff",
+            },
+          });
+        } finally {
+          setRequestTimeout(c, REQUEST_IDLE_TIMEOUT_SECONDS);
+        }
+      },
+    )
+    .get(
+      "/glyphs/:font/:range",
+      describeRoute({ ...requiresAuth, tags: ["Places and maps"], summary: "Load locally bundled IBM Plex map labels" }),
+      v("param", glyphParams),
+      async (c) => {
+        const { font, range } = c.req.valid("param");
+        const [start, end] = range.slice(0, -4).split("-").map(Number);
+        if (start === undefined || end === undefined || start < 0 || end > 65535 || start % 256 !== 0 || end !== start + 255)
+          return c.notFound();
+        const file = geoGlyphFile(font, range);
+        if (!(await file.exists())) return c.notFound();
+        return new Response(file, {
+          headers: {
+            "Content-Type": "application/x-protobuf",
+            "Cache-Control": "private, max-age=604800",
+            "X-Content-Type-Options": "nosniff",
+          },
+        });
+      },
+    );
+
+export default createGeoRoutes();

package/src/api/help.ts

@@ -1,6 +1,7 @@
 import { Hono, type MiddlewareHandler } from "hono";
 import { type AuthContext, auth, getLocale } from "../server";
 import { buildHelpDocumentPayload } from "../server/help-payload";
+import { appAccessAuthority } from "../services/app-access";
 import { createHelpReader, type HelpReaderFactory } from "../services/help";
 import type { HelpSearchPayload } from "../shared/help";
 import type { renderHelpMarkdown } from "../shared/markdown";
@@ -24,16 +25,23 @@ export const createHelpRoutes = (dependencies: HelpRouteDependencies = {}) => {
       const query = c.req.query("q")?.trim().slice(0, 200) ?? "";
       const payload: HelpSearchPayload = {
         locale,
-        ids: (await reader(locale, c.get("actor")).search({ query, appId: c.req.param("appId"), limit: 25 })).map(
-          (document) => document.documentId,
-        ),
+        ids: (
+          await reader(locale, c.get("actor"), { authority: appAccessAuthority(c) }).search({
+            query,
+            appId: c.req.param("appId"),
+            limit: 25,
+          })
+        ).map((document) => document.documentId),
       };
       return c.json(payload);
     })
     .get("/help/v1/:appId/documents/:documentId", async (c) => {
       const locale = getLocale(c);
       const { t } = helpApiMessages.resolve([locale]);
-      const document = await reader(locale, c.get("actor")).read({ appId: c.req.param("appId"), documentId: c.req.param("documentId") });
+      const document = await reader(locale, c.get("actor"), { authority: appAccessAuthority(c) }).read({
+        appId: c.req.param("appId"),
+        documentId: c.req.param("documentId"),
+      });
       if (!document) return c.json({ code: "HELP_NOT_FOUND", message: t.notFound }, 404);
       const payload = buildHelpDocumentPayload(document, c.req.header("User-Agent") ?? "", dependencies.renderMarkdown);
       return c.json(payload);

package/src/api/index.ts

@@ -26,6 +26,7 @@ import adminAiQuotaRoutes from "./admin-ai-quotas";
 import adminAiSkillsRoutes from "./admin-ai-skills";
 import adminAiUsageRoutes from "./admin-ai-usage";
 import adminCoreSettingsRoutes from "./admin-core-settings";
+import adminGeoRoutes from "./admin-geo";
 import adminGeoIpRoutes from "./admin-geoip";
 import adminIdentityRoutes from "./admin-identity";
 import adminLifecycleRoutes from "./admin-lifecycle";
@@ -38,6 +39,7 @@ import { approvalRoutes } from "./approvals";
 import { appDiscoveryRoutes } from "./apps";
 import { createAuthRoutes } from "./auth";
 import { createCapabilityRoutes } from "./capabilities";
+import geoRoutes from "./geo";
 import { createHelpRoutes } from "./help";
 import { createMcpRoutes } from "./mcp";
 import meRoutes from "./me";
@@ -46,6 +48,7 @@ import { createSearchRoutes } from "./search";
 import { createSyncOpsProxyRoutes } from "./sync-ops";
 import { createWidgetRoutes } from "./widgets";
 
+export { withCapabilityRequestTimeout } from "../_internal/capability-timeout";
 export { createAiOpenAiRoutes } from "../ai/openai-api";
 export { type CapabilityDispatchDependencies, dispatchCapability } from "./capabilities";
 export { cliPluginListRoutes } from "./cli-plugins";
@@ -78,6 +81,7 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/auth", createAuthRoutes(options.notifications))
     .route("/me", meRoutes)
     .route("/accounts", accountsEntitiesRoutes)
+    .route("/geo", geoRoutes)
     .route("/apps", appDiscoveryRoutes)
     .route("/approvals", approvalRoutes)
     .route("/announcements", announcementRoutes)
@@ -91,6 +95,7 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/admin/core/rail", adminRailRoutes)
     .route("/admin/core/linux-identities", adminLinuxIdentityRoutes)
     .route("/admin/core/geoip", adminGeoIpRoutes)
+    .route("/admin/core/geo", adminGeoRoutes)
     .route("/admin/identity", adminIdentityRoutes)
     .route("/admin/sync", createSyncOpsProxyRoutes())
     .route("/admin/lifecycle", adminLifecycleRoutes)

package/src/api/mcp.ts

@@ -15,6 +15,8 @@ import {
 import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
+import { capabilitySentenceText } from "../_internal/capability-sentences";
+import { withCapabilityRequestTimeout } from "../_internal/capability-timeout";
 import {
   HELP_SEARCH_MAX_LIMIT,
   helpAgentMarkdown,
@@ -31,6 +33,7 @@ import {
   CAPABILITY_MAX_RESULT_BYTES,
   CAPABILITY_PROTOCOL_VERSION,
   type CapabilityActionManifest,
+  CapabilityActionReceiptSchema,
   type CapabilityQueryManifest,
   CapabilitySemanticLinkSchema,
   type CloudResourceRef,
@@ -42,12 +45,15 @@ import {
 } from "../contracts/capabilities";
 import type { AppRegistryEntry, CapabilityRegistryEntry } from "../contracts/registry";
 import { type AuthContext, auth, type RequestAuthority, rateLimit, rejectReservedWorkloadCredential, resolveLocale } from "../server";
+import { preferredLocale } from "../server/locale";
 import { noTransform } from "../server/middleware/no-transform";
+import { discoverableApps } from "../services/app-discovery";
 import { createHelpReader, type HelpArticle, type HelpMetadata, type HelpReader, type HelpReaderFactory } from "../services/help";
 import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
 import { logger } from "../services/logging";
 import { get } from "../services/settings";
 import { cloudMcpResourceUri, publicCloudOrigin } from "../shared/app-url";
+import { normalizeTimeZone } from "../shared/time";
 import { type CapabilityDispatchDependencies, dispatchCapability } from "./capabilities";
 
 const MCP_TOOL_PAGE_SIZE = 100;
@@ -67,6 +73,7 @@ type McpRouteDependencies = CapabilityDispatchDependencies & {
   listApps?: () => Promise<AppRegistryEntry[]>;
   help?: HelpReaderFactory;
   getOperatorLocale?: () => Promise<string | undefined>;
+  getOperatorTimeZone?: () => Promise<string | undefined>;
   getAppUrl?: () => Promise<string>;
   authenticate?: MiddlewareHandler<AuthContext>;
   limit?: MiddlewareHandler<AuthContext>;
@@ -488,7 +495,7 @@ const createMcpServer = (
   oauthScopes: string[] | null,
   authority?: RequestAuthority,
 ): Server => {
-  const registry = dependencies.listApps ?? listApps;
+  const registry = async () => discoverableApps(authority ?? null, await (dependencies.listApps ?? listApps)());
   const capabilityLookup = dependencies.getCapability ?? getCapability;
   let helpLocale: Promise<string> | undefined;
   const resolveHelpLocale = () =>
@@ -496,9 +503,10 @@ const createMcpServer = (
       resolveLocale(request.headers, operatorDefault),
     ));
   const helpReader = async () =>
-    (dependencies.help ?? ((locale, viewer) => createHelpReader(locale, viewer, { listApps: registry })))(
+    (dependencies.help ?? ((locale, viewer) => createHelpReader(locale, viewer, { listApps: registry, authority: authority ?? null })))(
       await resolveHelpLocale(),
       authority?.actor,
+      { authority: authority ?? null },
     );
   const hasScope = (scope: "read" | "write"): boolean =>
     oauthScopes === null || oauthScopes.includes(scope) || oauthScopes.includes("admin");
@@ -682,14 +690,33 @@ const createMcpServer = (
         origin,
       );
     }
-    const resultFor = (value: Record<string, unknown>): CallToolResult => {
+    const receipt = response.ok && selected.kind === "actions" ? CapabilityActionReceiptSchema.safeParse(body.receipt) : null;
+    let receiptText: string | undefined;
+    if (receipt?.success) {
+      // The receipt line is extra presentation: if Cloud cannot word it, the completed Action's result still goes out.
+      try {
+        const locale = preferredLocale(request.headers) ?? (await resolveHelpLocale());
+        const timeZone = normalizeTimeZone(
+          await (dependencies.getOperatorTimeZone ?? (() => get<string>("app.timezone")))().catch(() => "UTC"),
+        );
+        receiptText = capabilitySentenceText(receipt.data.text, receipt.data.slots ?? {}, { locale, timeZone });
+      } catch (error) {
+        log.warn("MCP receipt text unavailable", { error: error instanceof Error ? error.message : String(error) });
+      }
+    }
+    const resultFor = (value: Record<string, unknown>, withReceipt = true): CallToolResult => {
       const result = toolResult(value, !response.ok);
       if (origin) result.content.push(...semanticResourceLinks(value, origin));
+      if (withReceipt && receiptText) result.content.unshift({ type: "text", text: receiptText });
       return result;
     };
-    // Added hrefs are optional: they never turn a result that fits into RESPONSE_TOO_LARGE.
+    // Both enrichments are optional: neither turns a result that fits into RESPONSE_TOO_LARGE.
     const result = resultFor(body);
-    return ensureBoundedToolResult(fitsToolResult(result) || body === providerBody ? result : resultFor(providerBody));
+    if (fitsToolResult(result)) return result;
+    const plain = resultFor(body, false);
+    if (fitsToolResult(plain)) return plain;
+    const original = resultFor(providerBody);
+    return ensureBoundedToolResult(fitsToolResult(original) ? original : resultFor(providerBody, false));
   });
 
   return server;
@@ -757,42 +784,47 @@ export const createMcpRoutes = (dependencies: McpRouteDependencies = {}) =>
     .use("/mcp/v1", dependencies.authenticate ?? mcpAuthentication(dependencies.getAppUrl ?? defaultAppUrl))
     .use("/mcp/v1", rejectReservedWorkloadCredential)
     .use("/mcp/v1", dependencies.limit ?? rateLimit())
-    .all("/mcp/v1", async (c) => {
-      if (c.req.method !== "POST") {
-        return new Response(null, { status: 405, headers: { Allow: "POST" } });
-      }
-      let request = c.req.raw;
-      const parsed = await readBoundedJson(request, CAPABILITY_MAX_REQUEST_BYTES);
-      if (!parsed.ok) {
-        return c.json(
-          {
-            jsonrpc: "2.0",
-            id: null,
-            error: {
-              code: parsed.reason === "too_large" ? -32600 : -32700,
-              message: parsed.reason === "too_large" ? "MCP request is too large" : "MCP request body must be JSON",
+    .all("/mcp/v1", async (c) =>
+      withCapabilityRequestTimeout(c, "query", async () => {
+        if (c.req.method !== "POST") {
+          return new Response(null, { status: 405, headers: { Allow: "POST" } });
+        }
+        let request = c.req.raw;
+        const parsed = await readBoundedJson(request, CAPABILITY_MAX_REQUEST_BYTES);
+        if (!parsed.ok) {
+          return c.json(
+            {
+              jsonrpc: "2.0",
+              id: null,
+              error: {
+                code: parsed.reason === "too_large" ? -32600 : -32700,
+                message: parsed.reason === "too_large" ? "MCP request is too large" : "MCP request body must be JSON",
+              },
             },
-          },
-          parsed.reason === "too_large" ? 413 : 400,
-        );
-      }
-      const headers = new Headers(request.headers);
-      headers.delete("content-length");
-      request = new Request(request.url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(parsed.data),
-        signal: request.signal,
-      });
-      const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
-      const server = createMcpServer(request, dependencies, c.get("oauthScopes") ?? null, auth.getAuthority(c));
-      await server.connect(transport);
-      try {
-        return await transport.handleRequest(request);
-      } finally {
-        await transport.close();
-        await server.close();
-      }
-    });
+            parsed.reason === "too_large" ? 413 : 400,
+          );
+        }
+        const headers = new Headers(request.headers);
+        headers.delete("content-length");
+        request = new Request(request.url, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(parsed.data),
+          signal: request.signal,
+        });
+        const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+        const server = createMcpServer(request, dependencies, c.get("oauthScopes") ?? null, auth.getAuthority(c));
+        try {
+          await server.connect(transport);
+          return await transport.handleRequest(request);
+        } finally {
+          try {
+            await transport.close();
+          } finally {
+            await server.close();
+          }
+        }
+      }),
+    );
 
 export type McpApiType = ReturnType<typeof createMcpRoutes>;

package/src/api/me-panel-consent.ts

@@ -5,6 +5,8 @@ import { z } from "zod";
 import { CapabilityAppIdSchema } from "../contracts/capabilities";
 import { panelProviderNeedsConsent } from "../contracts/panel-context-plain";
 import { type AuthContext, jsonResponse, requiresAuth, v } from "../server";
+import { appAccessAuthority } from "../services/app-access";
+import { discoverableApps } from "../services/app-discovery";
 import { PanelConsentCancelled, panelContextConsent } from "../services/panel-context-consent";
 import { getRuntimeContext } from "../ssr/runtime";
 
@@ -15,9 +17,9 @@ const SavedSchema = ProviderSchema.extend(AnswerSchema.shape).strict();
 
 /** Mounted below /me's session and user guards. The live request registry owns provider membership. */
 export const createMePanelConsentRoutes = (service = panelContextConsent) => {
-  const providers = (c: Parameters<typeof getRuntimeContext>[0]) =>
-    getRuntimeContext(c)
-      .apps.filter((app) => app.panel && panelProviderNeedsConsent(app.id))
+  const providers = async (c: import("hono").Context<AuthContext>) =>
+    (await discoverableApps(appAccessAuthority(c), getRuntimeContext(c).apps))
+      .filter((app) => app.panel && panelProviderNeedsConsent(app.id))
       .map((app) => app.id);
   return new Hono<AuthContext>()
     .use("*", async (c, next) => {
@@ -33,7 +35,7 @@ export const createMePanelConsentRoutes = (service = panelContextConsent) => {
         ...requiresAuth,
         responses: { 200: jsonResponse(AnswersSchema, "Answers for registered panel providers") },
       }),
-      async (c) => c.json({ answers: await service.list(c.get("user").id, providers(c)) }),
+      async (c) => c.json({ answers: await service.list(c.get("user").id, await providers(c)) }),
     )
     .put(
       "/panel-consent/:provider",
@@ -53,7 +55,8 @@ export const createMePanelConsentRoutes = (service = panelContextConsent) => {
       v("json", AnswerSchema),
       async (c) => {
         const { provider } = c.req.valid("param");
-        if (!providers(c).includes(provider)) return c.json({ code: "PANEL_PROVIDER_NOT_FOUND", message: "Panel provider not found" }, 404);
+        if (!(await providers(c)).includes(provider))
+          return c.json({ code: "PANEL_PROVIDER_NOT_FOUND", message: "Panel provider not found" }, 404);
         const { allowed, revision } = c.req.valid("json");
         let saved: Awaited<ReturnType<typeof service.set>>;
         try {

package/src/api/me.ts

@@ -7,6 +7,7 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
 import { sql } from "bun";
 import { type Context, Hono, type MiddlewareHandler } from "hono";
+import { deleteCookie } from "hono/cookie";
 import { createMiddleware } from "hono/factory";
 import { describeRoute } from "hono-openapi";
 import { z } from "zod";
@@ -27,6 +28,7 @@ import {
   NotificationQuietSettingsSchema,
   RegisterBrowserNotificationEndpointSchema,
   ServiceAccountCredentialSchema,
+  SignOutOthersResponseSchema,
   UpdateAvatarResponseSchema,
   UpdateAvatarSchema,
   UpdateNotificationQuietSettingsSchema,
@@ -47,6 +49,7 @@ import {
   accountsAppService as accountsService,
   audit,
   browserNotifications,
+  logger,
   mandates,
   notifications,
   serviceAccountCredentials,
@@ -61,6 +64,8 @@ import { createMePanelConsentRoutes } from "./me-panel-consent";
 import { createMeRailRoutes } from "./me-rail";
 import { createMeWebVitalsRoutes } from "./me-web-vitals";
 
+const log = logger("api:me");
+
 const toAccountsActor = (user: AuthContext["Variables"]["user"]) => ({
   userId: user.id,
   uid: user.uid,
@@ -747,25 +752,96 @@ const app = new Hono<AuthContext>()
     describeRoute({
       tags: ["Me"],
       summary: "Change current user password",
-      description: "Change the authenticated user's password. Requires the current password for verification.",
+      description:
+        "Change the authenticated user's password and end every other sign-in. Requires the current password. The current browser stays signed in with a new cookie and its original sign-in time. signInAgain is true when the caller must sign in again: this browser could not be kept, or the request did not come from a browser sign-in.",
       ...requiresAuth,
       responses: {
-        200: jsonResponse(MessageResponseSchema, "Password changed"),
+        200: jsonResponse(SignOutOthersResponseSchema, "Password changed"),
         400: jsonResponse(ErrorResponseSchema, "Failed to change password"),
         401: jsonResponse(ErrorResponseSchema, "Current password is incorrect"),
+        500: jsonResponse(
+          ErrorResponseSchema,
+          "Password changed, but signing out other sign-ins failed (SIGN_OUT_OTHERS_FAILED). Retry POST /api/me/sign-ins/sign-out-others.",
+        ),
         403: jsonResponse(ErrorResponseSchema, "Not permitted for API keys or other credentials"),
       },
     }),
     v("json", ChangePasswordSchema),
     async (c) =>
       respond(c, async () => {
+        const keep = await auth.browserSignIn(c);
         const result = await accountsService.user.changeOwnPassword({
+          keep: keep && { sid: keep.sid, authEpoch: keep.authEpoch },
           user: c.get("user"),
           currentPassword: c.req.valid("json").currentPassword,
           newPassword: c.req.valid("json").newPassword,
         });
         if (!result.ok) return result;
-        return ok({ message: "Password changed successfully." });
+        if (result.data.kept) auth.session.setWebCookie(c, result.data.kept.token, result.data.kept.expiresAt);
+        const signInAgain = !result.data.kept;
+        if (keep && signInAgain) deleteCookie(c, "session_token", { path: "/" });
+        return ok({
+          message: signInAgain
+            ? keep
+              ? "Password changed. You are signed out everywhere, including this browser. Sign in again."
+              : "Password changed. You are signed out everywhere. Sign in again."
+            : "Password changed successfully.",
+          signInAgain,
+        });
+      }),
+  )
+
+  .post(
+    "/sign-ins/sign-out-others",
+    auth.rejectAppSession,
+    requireBrowserSignIn,
+    describeRoute({
+      tags: ["Me"],
+      summary: "Sign out every other sign-in",
+      description:
+        "End other sign-ins and rotate this browser's cookie while preserving its sign-in time and expiry; signInAgain is true if this browser could not be kept. Cloud Login phones stay paired. API keys, passkeys and mandates stay valid.",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(SignOutOthersResponseSchema, "Other sign-ins ended"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(
+          ErrorResponseSchema,
+          "Browser sign-in required (BROWSER_SIGN_IN_REQUIRED); mobile app sessions receive FORBIDDEN",
+        ),
+        500: jsonResponse(ErrorResponseSchema, "Signing out other sign-ins failed (SIGN_OUT_OTHERS_FAILED)"),
+      },
+    }),
+    async (c) =>
+      respond(c, async () => {
+        const signIn = await auth.browserSignIn(c);
+        if (!signIn) throw new Error("Browser sign-in gate was not applied");
+        try {
+          const { kept } = await auth.session.endOtherSignIns(c.get("user").id, {
+            keep: { sid: signIn.sid, authEpoch: signIn.authEpoch },
+            reason: "sign_out_others",
+          });
+          const user = c.get("user");
+          try {
+            await audit.record({
+              action: "auth.session.sign_out_others",
+              outcome: "allowed",
+              actor: toAccountsActor(user),
+              target: { type: "user", id: user.id, label: user.uid, provider: user.provider },
+              metadata: { keptThisBrowser: !!kept },
+            });
+          } catch {
+            log.warn("Other sign-ins ended, but recording the audit event failed", { userId: user.id });
+          }
+          if (kept) auth.session.setWebCookie(c, kept.token, kept.expiresAt);
+          const signInAgain = !kept;
+          if (signInAgain) deleteCookie(c, "session_token", { path: "/" });
+          return ok({
+            message: signInAgain ? "Other sign-ins ended. Sign in again in this browser." : "Other sign-ins ended.",
+            signInAgain,
+          });
+        } catch {
+          return fail({ code: "SIGN_OUT_OTHERS_FAILED", status: 500, message: "Signing out your other sign-ins did not work. Try again." });
+        }
       }),
   )