@k2b/cloud 0.41.0 → 0.42.0

package/src/access/messages.ts

@@ -8,6 +8,10 @@ export const accessMessages = i18n.define({
       edit: "Edit",
       manage: "Manage",
       noAccess: "No access",
+      unknownPerson: "Unknown person",
+      deletedGroup: "Deleted group",
+      unknownServiceAccount: "Unknown service account",
+      unknownAgent: "Unknown agent",
       allUsers: "All users (including guests)",
       public: "Public",
       signedInDescription: "Anyone signed in to Cloud",
@@ -87,6 +91,10 @@ export const accessMessages = i18n.define({
       edit: "Bearbeiten",
       manage: "Verwalten",
       noAccess: "Kein Zugriff",
+      unknownPerson: "Unbekannte Person",
+      deletedGroup: "Gelöschte Gruppe",
+      unknownServiceAccount: "Unbekanntes Dienstkonto",
+      unknownAgent: "Unbekannter Agent",
       allUsers: "Alle Benutzer einschließlich Gäste",
       public: "Öffentlich",
       signedInDescription: "Alle bei Cloud angemeldeten Personen",

package/src/access/principal-label.ts

@@ -0,0 +1,18 @@
+import type { Principal, ServiceAccountKind } from "../contracts/shared";
+import { groupDisplayName } from "../shared/account-display";
+import { accessMessages } from "./messages";
+
+/** A human label, never an identity. Resolve names only after authorizing the resource operation. */
+export const principalLabel = (
+  entry: { principal: Principal; displayName?: string | null; serviceAccountKind?: ServiceAccountKind },
+  locale: string | null | undefined,
+): string => {
+  const { t } = accessMessages.resolve([locale ?? "en"]);
+  const { principal, displayName } = entry;
+  if (principal.type === "authenticated") return t.allUsers;
+  if (principal.type === "public") return t.public;
+  if (displayName) return principal.type === "group" ? groupDisplayName(displayName, locale) : displayName;
+  if (principal.type === "user") return t.unknownPerson;
+  if (principal.type === "group") return t.deletedGroup;
+  return entry.serviceAccountKind === "agent" ? t.unknownAgent : t.unknownServiceAccount;
+};

package/src/access/ui.ts

@@ -10,6 +10,7 @@ export { isManagerEntry, type ManagerCandidate } from "./managers";
 export type { AllowedLevel, GrantableLevel } from "./PermissionEditor";
 export { default as PermissionEditor } from "./PermissionEditor";
 export { default as PrincipalPicker, principalKey } from "./PrincipalPicker";
+export { principalLabel } from "./principal-label";
 export type {
   ResourceApiKey,
   ResourceApiKeyPermissionOption,

package/src/account/EntitySearch.tsx

@@ -3,6 +3,7 @@ import { Button, ScrollArea, TextInput, useLocale } from "@k2b/ui";
 import type { JSX } from "solid-js";
 import { createSignal, For, Show } from "solid-js";
 import { accessMessages } from "../access/messages";
+import { principalLabel } from "../access/principal-label";
 import { serviceAccountKindDisplay } from "../access/service-account-kind";
 import { groupDisplayName } from "../shared/account-display";
 import { CloudAvatar } from "./Avatar";
@@ -233,8 +234,8 @@ const EntitySearch = (props: EntitySearchProps) => {
             <Show when={props.includeAuthenticated}>
               <ResultRow
                 icon="ti-lock-open-2"
-                title="All users (incl. guests)"
-                subtitle="Anyone signed in to the cloud"
+                title={principalLabel({ principal: { type: "authenticated" } }, locale())}
+                subtitle={accessMessages.resolve([locale()]).t.signedInDescription}
                 disabled={props.disabled}
                 onSelect={() => props.onSelect({ type: "authenticated" })}
               />
@@ -242,8 +243,8 @@ const EntitySearch = (props: EntitySearchProps) => {
             <Show when={props.includePublic}>
               <ResultRow
                 icon="ti-world"
-                title="Public"
-                subtitle="Anyone with the link, even unauthenticated"
+                title={principalLabel({ principal: { type: "public" } }, locale())}
+                subtitle={accessMessages.resolve([locale()]).t.publicDescription}
                 disabled={props.disabled}
                 onSelect={() => props.onSelect({ type: "public" })}
               />

package/src/ai/action-review.ts

@@ -4,6 +4,7 @@ import type {
   CapabilityActionReceipt,
   CapabilityActionReview,
   CapabilityActionReviewData,
+  CapabilityReviewContentRef,
   CapabilitySemanticLink,
 } from "../contracts/capabilities";
 
@@ -32,7 +33,7 @@ export type AiLegacyActionReview = {
 };
 
 /** A new review, with `ask` filled from the declared policy when the call itself names no reason. */
-export type AiStoredActionReview = CapabilityActionCallReview | AiLegacyActionReview;
+export type AiStoredActionReview = (CapabilityActionCallReview & { contentRef?: CapabilityReviewContentRef }) | AiLegacyActionReview;
 
 export const isLegacyActionReview = (review: AiStoredActionReview): review is AiLegacyActionReview => "legacy" in review;
 

package/src/ai/app-skill-store.ts

@@ -79,7 +79,7 @@ const reconcileApp = async (app: AppRegistryEntry, tx: TransactionSQL): Promise<
     { skills: unknown }[]
   >`SELECT skills FROM ai.app_skill_catalogs WHERE app_id=${app.id} AND manifest_hash=${manifest}`;
   if (!catalog) return false; // Publication may still be in flight: keep the last known state.
-  const roles = appAudienceRoles(app.nav);
+  const roles = app.access === undefined ? appAudienceRoles(app.nav) : undefined;
   const roleArray = roles === undefined ? null : toPgTextArray([...roles]);
   const [state] = await tx<{ current: boolean }[]>`SELECT
     EXISTS(SELECT 1 FROM ai.app_skills WHERE app_id=${app.id}) AND

package/src/ai/capabilities.ts

@@ -12,6 +12,7 @@ import {
   capabilityApprovalText,
 } from "../_internal/capability-sentences";
 import { HELP_READ_MAX_CHARS, HELP_SEARCH_MAX_LIMIT, readHelpArticle } from "../_internal/help-catalog";
+import type { listApps } from "../_internal/registry";
 import {
   type CapabilityActionManifest,
   type CapabilityActionReviewData,
@@ -23,6 +24,8 @@ import {
 } from "../contracts/capabilities";
 import type { CapabilityRegistryEntry } from "../contracts/registry";
 import type { RequestActor } from "../server";
+import type { RequestAuthority } from "../server/middleware/auth";
+import { discoverableAppEntries } from "../services/app-discovery";
 import type { HelpReader, HelpReaderFactory } from "../services/help";
 import { type MandatePolicyV1, mandatePolicyCanPermitCapability } from "../services/mandates/policy";
 import { resolveAppIdentityPresentation } from "../shared/app-presentation";
@@ -869,6 +872,7 @@ export const createAiToolResolver =
   (input: {
     conversationId: string;
     actor: RequestActor;
+    authority?: RequestAuthority | null;
     staticTools: AiRuntimeTool[];
     allowedTools?: readonly string[] | null;
     /** Undefined for interactive runs; null fails closed when a background mandate cannot be loaded. */
@@ -880,6 +884,7 @@ export const createAiToolResolver =
     runtimeContext?: Omit<AiToolPreparationContext, "actor" | "conversationId">;
     store: Pick<AiConversationService, "getLoadedTools" | "loadTools">;
     listRegistry?: () => Promise<CapabilityRegistryEntry[]>;
+    listApps?: typeof listApps;
     onCapabilityRegistryError?: (error: unknown) => void;
     help?: HelpReaderFactory;
     locale?: string;
@@ -904,7 +909,17 @@ export const createAiToolResolver =
       input.listRegistry ? resolveCapabilityRegistry(input.listRegistry, input.onCapabilityRegistryError) : [],
       input.store.getLoadedTools({ conversationId: input.conversationId }),
     ]);
-    const registry = liveRegistry ?? [];
+    const registry =
+      (await resolveCapabilityRegistry(
+        () => discoverableAppEntries(input.authority ?? null, liveRegistry ?? [], input.listApps),
+        input.onCapabilityRegistryError,
+      )) ?? [];
+    const visibleAppIds = new Set(registry.map((app) => app.appId));
+    const hiddenNames = new Set(
+      buildAiCapabilityCatalog(liveRegistry ?? [])
+        .filter((entry) => !visibleAppIds.has(entry.appId))
+        .flatMap((entry) => [entry.name, entry.providerName]),
+    );
     const configuredLimit = Math.floor(input.maxLoadedTools ?? 0);
     const loadedNames = configuredLimit > 0 ? persistedLoadedNames.slice(-configuredLimit) : persistedLoadedNames;
     if (loadedNames.length !== persistedLoadedNames.length) {
@@ -931,7 +946,9 @@ export const createAiToolResolver =
     );
     const capabilityCatalog = fullCapabilityCatalog.filter((entry) => (!allowed || allowed.has(entry.name)) && mandateAllows(entry));
     // The turn's actor decides which apps' Help exists for the model, like every other Help surface.
-    const helpTools = input.help ? createAiHelpTools(input.help(input.locale ?? "en", input.actor)) : [];
+    const helpTools = input.help
+      ? createAiHelpTools(input.help(input.locale ?? "en", input.actor, { authority: input.authority ?? null }))
+      : [];
     const resourceTool =
       input.execute && (capabilityCatalog.length > 0 || input.staticTools.some((tool) => tool.def.name === "code_read"))
         ? createAiResourceReaderTool({ apps: registry, catalog: capabilityCatalog, execute: input.execute })
@@ -940,7 +957,7 @@ export const createAiToolResolver =
     const builtIns = allBuiltIns.filter((tool) => !allowed || allowed.has(tool.def.name));
     const catalog = buildAiToolCatalog(builtIns, capabilityCatalog);
     const catalogNames = new Set(catalog.map((entry) => entry.name));
-    const unavailableLoadedNames = loadedNames.filter((name) => !catalogNames.has(name));
+    const unavailableLoadedNames = loadedNames.filter((name) => !catalogNames.has(name) && !hiddenNames.has(name));
     const outOfScope = new Set([
       ...allBuiltIns.map((tool) => tool.def.name),
       ...fullCapabilityCatalog.flatMap((entry) => [entry.name, entry.providerName]),
@@ -959,6 +976,7 @@ export const createAiToolResolver =
     const unavailableReason = (requested: string): AiToolUnavailableReason => {
       if (input.skillNames?.includes(requested)) return "skill";
       const name = loadedByProviderName.get(requested) ?? requested;
+      if (hiddenNames.has(requested) || hiddenNames.has(name)) return "unknown";
       if (mandateExcluded.has(name)) return "not_allowed";
       if (allowed && outOfScope.has(name) && !allowed.has(name)) return "not_allowed";
       if (unoffered.has(name)) return "not_offered_in_turn";

package/src/ai/capability-execution.ts

@@ -10,8 +10,7 @@ import {
   type CapabilityActionReviewData,
   CapabilityActionReviewDataSchema,
 } from "../contracts/capabilities";
-import type { RequestActor } from "../server";
-import type { AccessSubject } from "../server/services/access";
+import type { RequestActor, RequestAuthority } from "../server";
 import { isAccountCategoryAllowed } from "../services/account-category-policy";
 import { isAccountExpired } from "../services/account-model";
 import { accounts } from "../services/accounts";
@@ -26,13 +25,14 @@ import type { AiConversationService } from "./types";
 export { AiCapabilityExecutionError, aiCapabilityCheckResult } from "./capability-result";
 
 type CapabilityActor = Extract<RequestActor, { kind: "user" }>;
+type AiCapabilityAuthority = RequestAuthority & { actor: CapabilityActor };
 
 export const resolveAiCapabilityActor = async (input: {
   conversationId: string;
   persistedActor?: RequestActor;
   store: Pick<AiConversationService, "getConversation">;
   getUser?: typeof accounts.users.get;
-}): Promise<{ actor: CapabilityActor; accessSubject: AccessSubject }> => {
+}): Promise<AiCapabilityAuthority> => {
   if (input.persistedActor?.kind !== "user") throw new Error("Cloud capabilities require a current user-backed actor.");
   const conversation = await input.store.getConversation({ conversationId: input.conversationId });
   if (!conversation?.createdByUserId || conversation.createdByUserId !== input.persistedActor.user.id) {
@@ -44,9 +44,16 @@ export const resolveAiCapabilityActor = async (input: {
   if (!(await isAccountCategoryAllowed(user))) throw new Error("Cloud capability actor category is disabled.");
   // A turn started in the mobile app keeps its limits: no administrator role, and invocations say so.
   if (input.persistedActor.sessionKind === "app") {
-    return { actor: { kind: "user", user: withoutAdminRole(user), sessionKind: "app" }, accessSubject: { type: "user", userId: user.id } };
+    return {
+      actor: { kind: "user", user: withoutAdminRole(user), sessionKind: "app" },
+      accessSubject: { type: "user", userId: user.id },
+      credentialKind: "session",
+      scopes: [],
+    };
   }
-  return { actor: { kind: "user", user }, accessSubject: { type: "user", userId: user.id } };
+  // Assistant persists a user actor, not a reusable transport credential. Its supported
+  // delegation is the current conversation owner's session authority.
+  return { actor: { kind: "user", user }, accessSubject: { type: "user", userId: user.id }, credentialKind: "session", scopes: [] };
 };
 
 const idempotencyKey = (conversationId: string, callId: string): string =>
@@ -83,7 +90,7 @@ const parseCapabilityResponse = async (response: Response, dispatched: boolean):
 type AiCapabilityCall = {
   conversationId: string;
   turnId?: string;
-  authority: { actor: CapabilityActor; accessSubject: AccessSubject };
+  authority: AiCapabilityAuthority;
   locale?: string;
   entry: AiCapabilityCatalogEntry;
   args: unknown;
@@ -140,12 +147,7 @@ const dispatchAiCapability = async (
     appId: input.entry.appId,
     capabilityId: input.entry.operation.localId,
     input: input.args,
-    authority: {
-      actor: input.authority.actor,
-      accessSubject: input.authority.accessSubject,
-      credentialKind: "session",
-      scopes: [],
-    },
+    authority: input.authority,
     mandate: input.mandate
       ? {
           mandateId: input.mandate.id,

package/src/ai/chat/action-card.ts

@@ -16,6 +16,7 @@ import type {
   CapabilityAskReason,
   CapabilityConsequence,
   CapabilityPreview,
+  CapabilityReviewContentRef,
   CapabilitySemanticLink,
   CapabilitySlot,
 } from "../../contracts/capabilities";
@@ -78,6 +79,7 @@ export type ActionCard = {
   preview: ActionPreviewModel | null;
   /** Opens exactly this version of the thing. */
   readMore?: string;
+  contentRef?: CapabilityReviewContentRef;
   /** The review's other links, such as editing the draft, each with its words. */
   links: { href: string; label: string }[];
   /** Where the thing itself opens, for an outcome Cloud could not see. */
@@ -247,7 +249,10 @@ const slotValues = (slots: CapabilitySlot[], context: { locale: string; timeZone
   unlisted: slots.some((slot) => slot.kind === "person" && (slot.total ?? slot.people.length) > slot.people.length),
 });
 
-export const reviewActionCard = (review: CapabilityActionCallReview, context: ActionCardContext): ActionCard => {
+export const reviewActionCard = (
+  review: CapabilityActionCallReview & { contentRef?: CapabilityReviewContentRef },
+  context: ActionCardContext,
+): ActionCard => {
   const locale = review.locale;
   const tz = { timeZone: context.timeZone };
   const parts = (form: Parameters<typeof capabilityReviewSentenceParts>[1]) =>
@@ -287,6 +292,7 @@ export const reviewActionCard = (review: CapabilityActionCallReview, context: Ac
               : {}),
           }
         : null,
+    contentRef: review.contentRef,
     readMore: firstLink(review.links, ["open", "preview"]),
     links: otherLinks(review.links, locale, context.app.name),
     open: firstLink(review.links, ["open", "edit", "status"]) ?? firstObjectHref(review),

package/src/ai/chat/action-messages.ts

@@ -36,6 +36,13 @@ const messages = i18n.define({
       unavailable: "You can't answer this question here.",
       stopping: "The response is stopping.",
       submitFailed: "Your answer didn't go through. Try again.",
+      fullReview: "Read the complete proposal",
+      baseRevision: ({ revision }: { revision: number }) => `Based on revision ${revision}`,
+      fullReviewLoading: "Loading the complete proposal …",
+      fullReviewFailed: "The complete proposal could not be loaded. Try again before approving.",
+      fullReviewRequired: "Read the complete proposal before approving.",
+      fullReviewRetry: "Try again",
+      fullReviewClose: "Close",
       // Preview
       from: "From",
       to: "To",
@@ -94,6 +101,13 @@ const messages = i18n.define({
       unavailable: "Diese Frage kannst du hier nicht beantworten.",
       stopping: "Die Antwort wird angehalten.",
       submitFailed: "Deine Antwort ging nicht durch. Versuche es noch einmal.",
+      fullReview: "Vollständigen Vorschlag lesen",
+      baseRevision: ({ revision }: { revision: number }) => `Auf Basis von Version ${revision}`,
+      fullReviewLoading: "Der vollständige Vorschlag wird geladen …",
+      fullReviewFailed: "Der vollständige Vorschlag konnte nicht geladen werden. Versuche es vor der Freigabe noch einmal.",
+      fullReviewRequired: "Lies vor der Freigabe den vollständigen Vorschlag.",
+      fullReviewRetry: "Noch einmal versuchen",
+      fullReviewClose: "Schließen",
       from: "Von",
       to: "An",
       cc: "Cc",

package/src/ai/chat/action-question.browser-harness.tsx

@@ -22,6 +22,18 @@ type ToolBlock = Extract<AiTurnBlock, { kind: "tool" }>;
 const params = new URLSearchParams(location.search);
 const lang = (params.get("lang") === "en" ? "en" : "de") as ActionFixtureLocale;
 const fixtures = actionFixtures(lang);
+if (params.has("full")) {
+  const block = fixtures.mail!.block;
+  if (block.review && "sentence" in block.review) {
+    block.review = {
+      ...block.review,
+      contentRef: {
+        href: "/api/approvals/11111111-1111-4111-8111-111111111111/content",
+        digest: "a".repeat(64),
+      },
+    };
+  }
+}
 const state = params.get("state") ?? "open";
 /** Each entry is `fixture` or `fixture:state`; its id is unique even when one fixture shows in several states. */
 const entries = (params.get("scenarios") ?? "mail")