@k2b/cloud 0.41.0 → 0.42.0

package/src/api/capability-streams.ts

@@ -15,9 +15,10 @@ import {
   capabilityResultSchema,
 } from "../contracts/capabilities";
 import type { RequestAuthority } from "../server";
+import { AppAccessDeniedError, appAccessDeniedBody } from "../server/middleware/app-access";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { capabilityInvocationOperation } from "../services/identity/invocation-operations";
-import { signInvocationToken } from "../services/identity/invocation-token";
+import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 import { logger } from "../services/logging";
 import { decryptSecret, encryptSecret } from "../services/secrets";
@@ -142,17 +143,20 @@ export async function dispatchCapabilityStream(
     destructive = "destructive" in operation && operation.destructive;
     const signed = await (dependencies.withActiveSigner ?? withActiveIdentitySigner)(
       "invocation",
-      (signer) =>
-        (dependencies.signInvocation ?? signInvocationToken)({
-          targetAppId: grant.appId,
-          callingAppId: "core",
-          operation: capabilityInvocationOperation(grant.kind, grant.capabilityId),
-          schemaHash: operation.schemaHash,
-          authority: invocationAuthorityFromRequest(authority),
-          requestId: grant.requestId,
-          signer,
-          issuer: signer.issuer,
-        }),
+      (signer, db) =>
+        (dependencies.signInvocation ?? signInvocationToken)(
+          {
+            targetAppId: grant.appId,
+            callingAppId: "core",
+            operation: capabilityInvocationOperation(grant.kind, grant.capabilityId),
+            schemaHash: operation.schemaHash,
+            authority: invocationAuthorityFromRequest(authority),
+            requestId: grant.requestId,
+            signer,
+            issuer: signer.issuer,
+          },
+          { db, groupsAdmin: signer.groupsAdmin },
+        ),
       { signal, timeoutMs: 30_000 },
     );
     const headers = new Headers({
@@ -265,7 +269,11 @@ export async function dispatchCapabilityStream(
       if (!error.success || response.status === 401) return denied(status, "STREAM_FAILED");
     } else await record(response.status);
     return Response.json(receipt.data, { status: response.status, headers: { "cache-control": "no-store" } });
-  } catch {
+  } catch (error) {
+    if (error instanceof AppAccessDeniedError) {
+      await record(403, error.code);
+      return Response.json(appAccessDeniedBody(error.app), { status: 403 });
+    }
     const status = request.signal.aborted ? 499 : signal.aborted ? 504 : 502;
     const code = status === 499 ? "REQUEST_CANCELLED" : status === 504 ? "DEADLINE_EXCEEDED" : "STREAM_FAILED";
     await record(status, code);

package/src/api/cli-plugins.ts

@@ -4,13 +4,16 @@ import { listApps } from "../_internal/registry";
 import type { CloudCliPluginSummary } from "../cli/plugin";
 import type { AuthContext } from "../server/middleware/auth";
 
+import { appAccessAuthority } from "../services/app-access";
+import { discoverableApps } from "../services/app-discovery";
+
 /**
  * `GET /cli/plugins`: the `cld` plugins that live applications serve, under
  * the same access rule as the plugin downloads. Core mounts this list; each
  * application serves its own plugin files.
  */
 export const cliPluginListRoutes = new Hono<AuthContext>().get("/", requireCliPluginAccess, async (c) => {
-  const plugins: CloudCliPluginSummary[] = (await listApps())
+  const plugins: CloudCliPluginSummary[] = (await discoverableApps(appAccessAuthority(c), await listApps()))
     .flatMap((app) => (app.cliModules ?? []).map((name) => ({ name, app: app.id, version: app.runtime?.version ?? "unknown" })))
     .sort((left, right) => (left.name < right.name ? -1 : left.name > right.name ? 1 : 0));
   return c.json({ plugins }, 200, { "cache-control": "private, no-store" });

package/src/api/geo-glyphs.ts

@@ -0,0 +1,11 @@
+import { appAssetPath } from "../server/app-assets";
+
+declare const __CLOUD_APP_ASSETS__: string | undefined;
+
+/** The route validates the font and range before resolving a bundled asset. */
+export const geoGlyphFile = (font: string, range: string) =>
+  Bun.file(
+    typeof __CLOUD_APP_ASSETS__ === "string"
+      ? appAssetPath("map-glyphs", font, range)
+      : new URL(`./map-glyphs/${encodeURIComponent(font)}/${range}`, import.meta.resolve("@k2b/ui/package.json")),
+  );

package/src/api/geo.ts

@@ -0,0 +1,128 @@
+import { mapStyle } from "@k2b/ui";
+import { Hono, type MiddlewareHandler } from "hono";
+import { describeRoute } from "hono-openapi";
+import { z } from "zod";
+import { GEO_MAP_MAX_ZOOM } from "../contracts/geo-map";
+import { type AuthContext, auth, getLocale, requiresAuth, v } from "../server";
+import { REQUEST_IDLE_TIMEOUT_SECONDS, setRequestTimeout } from "../server/request-timeout";
+import { GEO_TIMEOUT_MS } from "../services/geo/bucket";
+import { GeoError } from "../services/geo/errors";
+import { coreGeoMap } from "../services/geo/map";
+
+import { geoGlyphFile } from "./geo-glyphs";
+
+const styleQuery = z.object({
+  theme: z.enum(["light", "dark"]).default("light"),
+  locale: z
+    .string()
+    .max(100)
+    .refine((locale) => {
+      try {
+        new Intl.Locale(locale);
+        return true;
+      } catch {
+        return false;
+      }
+    })
+    .optional(),
+});
+const tileParams = z.object({
+  z: z.coerce.number().int().min(0).max(GEO_MAP_MAX_ZOOM),
+  x: z.coerce.number().int().nonnegative(),
+  y: z.string().regex(/^\d+\.pbf$/),
+});
+const glyphParams = z.object({ font: z.literal("IBM Plex Sans Medium"), range: z.string().regex(/^\d+-\d+\.pbf$/) });
+
+export const createGeoRoutes = (
+  authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("authenticated"),
+  service: typeof coreGeoMap = coreGeoMap,
+) =>
+  new Hono<AuthContext>()
+    .use("*", authenticate)
+    .use("*", auth.requireOAuthScope("read", "admin"))
+    .onError((cause, c) => {
+      const error = cause instanceof GeoError ? cause : new GeoError("GEO_PROVIDER_FAILED");
+      c.header("Cache-Control", "private, no-store");
+      if (error.code === "GEO_BUSY") c.header("Retry-After", String(error.details.retryAfterSeconds ?? 1));
+      return Response.json(
+        { code: error.code, details: error.details },
+        {
+          status: error.status,
+          headers: {
+            "Cache-Control": "private, no-store",
+            ...(error.code === "GEO_BUSY" ? { "Retry-After": String(error.details.retryAfterSeconds ?? 1) } : {}),
+          },
+        },
+      );
+    })
+    .get(
+      "/style",
+      describeRoute({ ...requiresAuth, tags: ["Places and maps"], summary: "Get the Cloud map style with same-origin tiles and glyphs" }),
+      v("query", styleQuery),
+      async (c) => {
+        const query = c.req.valid("query");
+        const locale = query.locale ?? getLocale(c);
+        await service.style({ theme: query.theme }, { actor: c.get("actor"), accessSubject: c.get("accessSubject"), locale });
+        c.header("Cache-Control", "private, no-store");
+        return c.json(
+          mapStyle({
+            theme: query.theme,
+            locale,
+            tiles: "/api/geo/tiles/{z}/{x}/{y}.pbf",
+            glyphs: "/api/geo/glyphs/{fontstack}/{range}.pbf",
+            maxzoom: GEO_MAP_MAX_ZOOM,
+          }),
+        );
+      },
+    )
+    .get(
+      "/tiles/:z/:x/:y",
+      describeRoute({ ...requiresAuth, tags: ["Places and maps"], summary: "Load one budgeted Geoapify EU vector tile" }),
+      v("param", tileParams),
+      async (c) => {
+        const params = c.req.valid("param");
+        setRequestTimeout(c, Math.ceil(GEO_TIMEOUT_MS.tiles / 1000) + REQUEST_IDLE_TIMEOUT_SECONDS);
+        try {
+          const bytes = await service.tile(
+            { z: params.z, x: params.x, y: Number(params.y.slice(0, -4)) },
+            {
+              actor: c.get("actor"),
+              accessSubject: c.get("accessSubject"),
+              locale: getLocale(c),
+              signal: c.req.raw.signal,
+            },
+          );
+          return new Response(bytes, {
+            headers: {
+              "Content-Type": "application/vnd.mapbox-vector-tile",
+              "Cache-Control": "private, max-age=604800",
+              "X-Content-Type-Options": "nosniff",
+            },
+          });
+        } finally {
+          setRequestTimeout(c, REQUEST_IDLE_TIMEOUT_SECONDS);
+        }
+      },
+    )
+    .get(
+      "/glyphs/:font/:range",
+      describeRoute({ ...requiresAuth, tags: ["Places and maps"], summary: "Load locally bundled IBM Plex map labels" }),
+      v("param", glyphParams),
+      async (c) => {
+        const { font, range } = c.req.valid("param");
+        const [start, end] = range.slice(0, -4).split("-").map(Number);
+        if (start === undefined || end === undefined || start < 0 || end > 65535 || start % 256 !== 0 || end !== start + 255)
+          return c.notFound();
+        const file = geoGlyphFile(font, range);
+        if (!(await file.exists())) return c.notFound();
+        return new Response(file, {
+          headers: {
+            "Content-Type": "application/x-protobuf",
+            "Cache-Control": "private, max-age=604800",
+            "X-Content-Type-Options": "nosniff",
+          },
+        });
+      },
+    );
+
+export default createGeoRoutes();

package/src/api/help.ts

@@ -1,6 +1,7 @@
 import { Hono, type MiddlewareHandler } from "hono";
 import { type AuthContext, auth, getLocale } from "../server";
 import { buildHelpDocumentPayload } from "../server/help-payload";
+import { appAccessAuthority } from "../services/app-access";
 import { createHelpReader, type HelpReaderFactory } from "../services/help";
 import type { HelpSearchPayload } from "../shared/help";
 import type { renderHelpMarkdown } from "../shared/markdown";
@@ -24,16 +25,23 @@ export const createHelpRoutes = (dependencies: HelpRouteDependencies = {}) => {
       const query = c.req.query("q")?.trim().slice(0, 200) ?? "";
       const payload: HelpSearchPayload = {
         locale,
-        ids: (await reader(locale, c.get("actor")).search({ query, appId: c.req.param("appId"), limit: 25 })).map(
-          (document) => document.documentId,
-        ),
+        ids: (
+          await reader(locale, c.get("actor"), { authority: appAccessAuthority(c) }).search({
+            query,
+            appId: c.req.param("appId"),
+            limit: 25,
+          })
+        ).map((document) => document.documentId),
       };
       return c.json(payload);
     })
     .get("/help/v1/:appId/documents/:documentId", async (c) => {
       const locale = getLocale(c);
       const { t } = helpApiMessages.resolve([locale]);
-      const document = await reader(locale, c.get("actor")).read({ appId: c.req.param("appId"), documentId: c.req.param("documentId") });
+      const document = await reader(locale, c.get("actor"), { authority: appAccessAuthority(c) }).read({
+        appId: c.req.param("appId"),
+        documentId: c.req.param("documentId"),
+      });
       if (!document) return c.json({ code: "HELP_NOT_FOUND", message: t.notFound }, 404);
       const payload = buildHelpDocumentPayload(document, c.req.header("User-Agent") ?? "", dependencies.renderMarkdown);
       return c.json(payload);

package/src/api/index.ts

@@ -26,6 +26,7 @@ import adminAiQuotaRoutes from "./admin-ai-quotas";
 import adminAiSkillsRoutes from "./admin-ai-skills";
 import adminAiUsageRoutes from "./admin-ai-usage";
 import adminCoreSettingsRoutes from "./admin-core-settings";
+import adminGeoRoutes from "./admin-geo";
 import adminGeoIpRoutes from "./admin-geoip";
 import adminIdentityRoutes from "./admin-identity";
 import adminLifecycleRoutes from "./admin-lifecycle";
@@ -38,6 +39,7 @@ import { approvalRoutes } from "./approvals";
 import { appDiscoveryRoutes } from "./apps";
 import { createAuthRoutes } from "./auth";
 import { createCapabilityRoutes } from "./capabilities";
+import geoRoutes from "./geo";
 import { createHelpRoutes } from "./help";
 import { createMcpRoutes } from "./mcp";
 import meRoutes from "./me";
@@ -46,6 +48,7 @@ import { createSearchRoutes } from "./search";
 import { createSyncOpsProxyRoutes } from "./sync-ops";
 import { createWidgetRoutes } from "./widgets";
 
+export { withCapabilityRequestTimeout } from "../_internal/capability-timeout";
 export { createAiOpenAiRoutes } from "../ai/openai-api";
 export { type CapabilityDispatchDependencies, dispatchCapability } from "./capabilities";
 export { cliPluginListRoutes } from "./cli-plugins";
@@ -78,6 +81,7 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/auth", createAuthRoutes(options.notifications))
     .route("/me", meRoutes)
     .route("/accounts", accountsEntitiesRoutes)
+    .route("/geo", geoRoutes)
     .route("/apps", appDiscoveryRoutes)
     .route("/approvals", approvalRoutes)
     .route("/announcements", announcementRoutes)
@@ -91,6 +95,7 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/admin/core/rail", adminRailRoutes)
     .route("/admin/core/linux-identities", adminLinuxIdentityRoutes)
     .route("/admin/core/geoip", adminGeoIpRoutes)
+    .route("/admin/core/geo", adminGeoRoutes)
     .route("/admin/identity", adminIdentityRoutes)
     .route("/admin/sync", createSyncOpsProxyRoutes())
     .route("/admin/lifecycle", adminLifecycleRoutes)

package/src/api/mcp.ts

@@ -16,6 +16,7 @@ import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { capabilitySentenceText } from "../_internal/capability-sentences";
+import { withCapabilityRequestTimeout } from "../_internal/capability-timeout";
 import {
   HELP_SEARCH_MAX_LIMIT,
   helpAgentMarkdown,
@@ -46,6 +47,7 @@ import type { AppRegistryEntry, CapabilityRegistryEntry } from "../contracts/reg
 import { type AuthContext, auth, type RequestAuthority, rateLimit, rejectReservedWorkloadCredential, resolveLocale } from "../server";
 import { preferredLocale } from "../server/locale";
 import { noTransform } from "../server/middleware/no-transform";
+import { discoverableApps } from "../services/app-discovery";
 import { createHelpReader, type HelpArticle, type HelpMetadata, type HelpReader, type HelpReaderFactory } from "../services/help";
 import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
 import { logger } from "../services/logging";
@@ -493,7 +495,7 @@ const createMcpServer = (
   oauthScopes: string[] | null,
   authority?: RequestAuthority,
 ): Server => {
-  const registry = dependencies.listApps ?? listApps;
+  const registry = async () => discoverableApps(authority ?? null, await (dependencies.listApps ?? listApps)());
   const capabilityLookup = dependencies.getCapability ?? getCapability;
   let helpLocale: Promise<string> | undefined;
   const resolveHelpLocale = () =>
@@ -501,9 +503,10 @@ const createMcpServer = (
       resolveLocale(request.headers, operatorDefault),
     ));
   const helpReader = async () =>
-    (dependencies.help ?? ((locale, viewer) => createHelpReader(locale, viewer, { listApps: registry })))(
+    (dependencies.help ?? ((locale, viewer) => createHelpReader(locale, viewer, { listApps: registry, authority: authority ?? null })))(
       await resolveHelpLocale(),
       authority?.actor,
+      { authority: authority ?? null },
     );
   const hasScope = (scope: "read" | "write"): boolean =>
     oauthScopes === null || oauthScopes.includes(scope) || oauthScopes.includes("admin");
@@ -781,42 +784,47 @@ export const createMcpRoutes = (dependencies: McpRouteDependencies = {}) =>
     .use("/mcp/v1", dependencies.authenticate ?? mcpAuthentication(dependencies.getAppUrl ?? defaultAppUrl))
     .use("/mcp/v1", rejectReservedWorkloadCredential)
     .use("/mcp/v1", dependencies.limit ?? rateLimit())
-    .all("/mcp/v1", async (c) => {
-      if (c.req.method !== "POST") {
-        return new Response(null, { status: 405, headers: { Allow: "POST" } });
-      }
-      let request = c.req.raw;
-      const parsed = await readBoundedJson(request, CAPABILITY_MAX_REQUEST_BYTES);
-      if (!parsed.ok) {
-        return c.json(
-          {
-            jsonrpc: "2.0",
-            id: null,
-            error: {
-              code: parsed.reason === "too_large" ? -32600 : -32700,
-              message: parsed.reason === "too_large" ? "MCP request is too large" : "MCP request body must be JSON",
+    .all("/mcp/v1", async (c) =>
+      withCapabilityRequestTimeout(c, "query", async () => {
+        if (c.req.method !== "POST") {
+          return new Response(null, { status: 405, headers: { Allow: "POST" } });
+        }
+        let request = c.req.raw;
+        const parsed = await readBoundedJson(request, CAPABILITY_MAX_REQUEST_BYTES);
+        if (!parsed.ok) {
+          return c.json(
+            {
+              jsonrpc: "2.0",
+              id: null,
+              error: {
+                code: parsed.reason === "too_large" ? -32600 : -32700,
+                message: parsed.reason === "too_large" ? "MCP request is too large" : "MCP request body must be JSON",
+              },
             },
-          },
-          parsed.reason === "too_large" ? 413 : 400,
-        );
-      }
-      const headers = new Headers(request.headers);
-      headers.delete("content-length");
-      request = new Request(request.url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(parsed.data),
-        signal: request.signal,
-      });
-      const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
-      const server = createMcpServer(request, dependencies, c.get("oauthScopes") ?? null, auth.getAuthority(c));
-      await server.connect(transport);
-      try {
-        return await transport.handleRequest(request);
-      } finally {
-        await transport.close();
-        await server.close();
-      }
-    });
+            parsed.reason === "too_large" ? 413 : 400,
+          );
+        }
+        const headers = new Headers(request.headers);
+        headers.delete("content-length");
+        request = new Request(request.url, {
+          method: "POST",
+          headers,
+          body: JSON.stringify(parsed.data),
+          signal: request.signal,
+        });
+        const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+        const server = createMcpServer(request, dependencies, c.get("oauthScopes") ?? null, auth.getAuthority(c));
+        try {
+          await server.connect(transport);
+          return await transport.handleRequest(request);
+        } finally {
+          try {
+            await transport.close();
+          } finally {
+            await server.close();
+          }
+        }
+      }),
+    );
 
 export type McpApiType = ReturnType<typeof createMcpRoutes>;

package/src/api/me-panel-consent.ts

@@ -5,6 +5,8 @@ import { z } from "zod";
 import { CapabilityAppIdSchema } from "../contracts/capabilities";
 import { panelProviderNeedsConsent } from "../contracts/panel-context-plain";
 import { type AuthContext, jsonResponse, requiresAuth, v } from "../server";
+import { appAccessAuthority } from "../services/app-access";
+import { discoverableApps } from "../services/app-discovery";
 import { PanelConsentCancelled, panelContextConsent } from "../services/panel-context-consent";
 import { getRuntimeContext } from "../ssr/runtime";
 
@@ -15,9 +17,9 @@ const SavedSchema = ProviderSchema.extend(AnswerSchema.shape).strict();
 
 /** Mounted below /me's session and user guards. The live request registry owns provider membership. */
 export const createMePanelConsentRoutes = (service = panelContextConsent) => {
-  const providers = (c: Parameters<typeof getRuntimeContext>[0]) =>
-    getRuntimeContext(c)
-      .apps.filter((app) => app.panel && panelProviderNeedsConsent(app.id))
+  const providers = async (c: import("hono").Context<AuthContext>) =>
+    (await discoverableApps(appAccessAuthority(c), getRuntimeContext(c).apps))
+      .filter((app) => app.panel && panelProviderNeedsConsent(app.id))
       .map((app) => app.id);
   return new Hono<AuthContext>()
     .use("*", async (c, next) => {
@@ -33,7 +35,7 @@ export const createMePanelConsentRoutes = (service = panelContextConsent) => {
         ...requiresAuth,
         responses: { 200: jsonResponse(AnswersSchema, "Answers for registered panel providers") },
       }),
-      async (c) => c.json({ answers: await service.list(c.get("user").id, providers(c)) }),
+      async (c) => c.json({ answers: await service.list(c.get("user").id, await providers(c)) }),
     )
     .put(
       "/panel-consent/:provider",
@@ -53,7 +55,8 @@ export const createMePanelConsentRoutes = (service = panelContextConsent) => {
       v("json", AnswerSchema),
       async (c) => {
         const { provider } = c.req.valid("param");
-        if (!providers(c).includes(provider)) return c.json({ code: "PANEL_PROVIDER_NOT_FOUND", message: "Panel provider not found" }, 404);
+        if (!(await providers(c)).includes(provider))
+          return c.json({ code: "PANEL_PROVIDER_NOT_FOUND", message: "Panel provider not found" }, 404);
         const { allowed, revision } = c.req.valid("json");
         let saved: Awaited<ReturnType<typeof service.set>>;
         try {

package/src/api/search.ts

@@ -2,7 +2,7 @@ import { Hono, type MiddlewareHandler } from "hono";
 import { describeRoute, resolver } from "hono-openapi";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { resolveCapabilityManifestPresentation } from "../_internal/capabilities";
-import { listCapabilities } from "../_internal/registry";
+import { type listApps, listCapabilities } from "../_internal/registry";
 import type { CapabilityRegistryEntry } from "../contracts";
 import {
   CAPABILITY_FRAMEWORK_ERROR_CODES,
@@ -14,9 +14,12 @@ import {
 import { type AuthContext, auth, expectUserBackedActor, jsonResponse, preferredLocale, requiresAuth, v } from "../server";
 import { noTransform } from "../server/middleware/no-transform";
 import { logger } from "../services";
+import { appAccessAuthority } from "../services/app-access";
+import { discoverableAppEntries } from "../services/app-discovery";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { searchInvocationOperation } from "../services/identity/invocation-operations";
-import { normalizeInvocationRequestId, signInvocationToken } from "../services/identity/invocation-token";
+import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
+import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 import { LOCALE_HEADER } from "../shared/locale";
 import { ndjsonLine, ndjsonStream, ndjsonStreamHeaders, startBounded, waitWithin } from "./fanout";
@@ -83,6 +86,7 @@ type SearchRouteDependencies = {
   listCapabilities?: () => Promise<CapabilityRegistryEntry[]>;
   fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
   authenticate?: MiddlewareHandler<AuthContext>;
+  listApps?: typeof listApps;
   signInvocation?: typeof signInvocationToken;
   withActiveSigner?: typeof withActiveIdentitySigner;
 };
@@ -137,7 +141,7 @@ export const createSearchRoutes = (dependencies: SearchRouteDependencies = {}) =
       const invocationAuthority = invocationAuthorityFromRequest(auth.getAuthority(c));
       let entries: CapabilityRegistryEntry[];
       try {
-        entries = await registry();
+        entries = await discoverableAppEntries(appAccessAuthority(c), await registry(), dependencies.listApps);
       } catch (error) {
         log.warn("Search capability registry unavailable", { error: error instanceof Error ? error.message : String(error) });
         return c.json(
@@ -237,22 +241,25 @@ export const createSearchRoutes = (dependencies: SearchRouteDependencies = {}) =
           signedInvocations = await waitWithin(
             (dependencies.withActiveSigner ?? withActiveIdentitySigner)(
               "invocation",
-              (signer) =>
+              (signer, db) =>
                 Promise.all(
                   startBounded(
                     active,
                     PROVIDER_CONCURRENCY,
                     (provider) =>
-                      (dependencies.signInvocation ?? signInvocationToken)({
-                        targetAppId: provider.appId,
-                        callingAppId: "core",
-                        operation: searchInvocationOperation,
-                        schemaHash: provider.schemaHash,
-                        authority: invocationAuthority,
-                        requestId,
-                        signer,
-                        issuer: signer.issuer,
-                      }),
+                      (dependencies.signInvocation ?? signInvocationToken)(
+                        {
+                          targetAppId: provider.appId,
+                          callingAppId: "core",
+                          operation: searchInvocationOperation,
+                          schemaHash: provider.schemaHash,
+                          authority: invocationAuthority,
+                          requestId,
+                          signer,
+                          issuer: signer.issuer,
+                        },
+                        { db, groupsAdmin: signer.groupsAdmin },
+                      ),
                     fanoutSignal,
                   ),
                 ),

package/src/api/sync-ops.ts

@@ -2,10 +2,12 @@ import { Hono, type MiddlewareHandler } from "hono";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { getApp, listApps } from "../_internal/registry";
 import { type AuthContext, auth, rejectReservedWorkloadCredential } from "../server";
+import { AppAccessDeniedError, appAccessDeniedBody } from "../server/middleware/app-access";
 import { noTransform } from "../server/middleware/no-transform";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { syncInvocationOperation } from "../services/identity/invocation-operations";
-import { normalizeInvocationRequestId, signInvocationToken } from "../services/identity/invocation-token";
+import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
+import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 
 type Dependencies = {
@@ -53,17 +55,20 @@ export const createSyncOpsProxyRoutes = (dependencies: Dependencies = {}) =>
       try {
         const signed = await (dependencies.withActiveSigner ?? withActiveIdentitySigner)(
           "invocation",
-          (signer) =>
-            (dependencies.signInvocation ?? signInvocationToken)({
-              targetAppId: app.id,
-              callingAppId: "core",
-              operation,
-              schemaHash: null,
-              authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
-              requestId,
-              signer,
-              issuer: signer.issuer,
-            }),
+          (signer, db) =>
+            (dependencies.signInvocation ?? signInvocationToken)(
+              {
+                targetAppId: app.id,
+                callingAppId: "core",
+                operation,
+                schemaHash: null,
+                authority: invocationAuthorityFromRequest(auth.getAuthority(c)),
+                requestId,
+                signer,
+                issuer: signer.issuer,
+              },
+              { db, groupsAdmin: signer.groupsAdmin },
+            ),
           { signal, timeoutMs: 5_000 },
         );
         const headers = new Headers({ authorization: `Bearer ${signed.token}`, accept: "application/json" });
@@ -75,7 +80,8 @@ export const createSyncOpsProxyRoutes = (dependencies: Dependencies = {}) =>
         const result = await readBoundedJson(response, 4 * 1024 * 1024);
         if (!result.ok) return c.json({ message: "Invalid Sync operations response" }, 502);
         return Response.json(result.data, { status: response.status, headers: { "cache-control": "no-store" } });
-      } catch {
+      } catch (error) {
+        if (error instanceof AppAccessDeniedError) return c.json(appAccessDeniedBody(error.app), 403);
         return c.json({ message: "Sync operations unavailable" }, 502);
       }
     });