@k2b/cloud 0.42.0 → 0.44.0

package/src/api/capabilities.ts

@@ -1,6 +1,7 @@
 import { Hono, type MiddlewareHandler } from "hono";
 import { describeRoute } from "hono-openapi";
 import { z } from "zod";
+import { type CatalogSubscription, projectAppEventCatalog, readCatalogSubscriptions } from "../_internal/app-event-catalog";
 import { readBoundedJson } from "../_internal/bounded-json";
 import { resolveCapabilityManifestPresentation } from "../_internal/capabilities";
 import {
@@ -55,15 +56,23 @@ import {
   v,
 } from "../server/middleware";
 import { AppAccessDeniedError, appAccessDeniedBody } from "../server/middleware/app-access";
+import { oauthScopeByOperation } from "../server/middleware/auth";
 import { noTransform } from "../server/middleware/no-transform";
+import { hasOAuthScope } from "../server/oauth-scope";
 import { appAccessAuthority, canUseApp } from "../services/app-access";
 import { discoverableApps } from "../services/app-discovery";
-import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
+import { authorityFromParentInvocation, invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { capabilityInvocationOperation } from "../services/identity/invocation-operations";
-import type { InvocationAuthority } from "../services/identity/invocation-token";
+import type { CloudInvocationClaims, InvocationAuthority } from "../services/identity/invocation-token";
 import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
 import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
+import {
+  NESTED_INVOCATION_SETUP_BUDGET_MS,
+  type NestedInvocationLease,
+  nestedInvocationLeases,
+  nestedSourceDeadline,
+} from "../services/identity/nested-invocation";
 import { logger } from "../services/logging";
 import { withMandateIssueAuthority } from "../services/mandates";
 import * as settings from "../services/settings";
@@ -104,6 +113,7 @@ const CapabilityCatalogQuerySchema = z
   .strict();
 export type CapabilityRouteDependencies = {
   listApps?: () => Promise<AppRegistryEntry[]>;
+  eventSubscriptions?: () => Promise<CatalogSubscription[]>;
   getCapability?: (appId: string) => Promise<CapabilityRegistryEntry | null>;
   fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
   authenticate?: MiddlewareHandler<AuthContext>;
@@ -157,7 +167,7 @@ const invocationAuthorityFromMandate = (authority: {
 
 export const loadCapabilityCatalogPage = async (
   query: { cursor?: string; limit: number },
-  dependencies: Pick<CapabilityRouteDependencies, "listApps" | "getCapability"> = {},
+  dependencies: Pick<CapabilityRouteDependencies, "listApps" | "getCapability" | "eventSubscriptions"> = {},
   locale?: string,
   authority: RequestAuthority | null = null,
 ): Promise<CapabilityCatalog> => {
@@ -170,6 +180,21 @@ export const loadCapabilityCatalogPage = async (
   const liveApps = entries
     .filter((entry) => entry.capabilities?.protocolVersion === CAPABILITY_PROTOCOL_VERSION)
     .sort((left, right) => left.id.localeCompare(right.id));
+  const resolved = new Map<string, CapabilityRegistryEntry | null>();
+  const lookup = async (appId: string) => {
+    if (!resolved.has(appId)) resolved.set(appId, await capabilityLookup(appId));
+    return resolved.get(appId) ?? null;
+  };
+  let subscriptions: CatalogSubscription[] | undefined;
+  const loadSubscribers = async () => {
+    if (!subscriptions) {
+      const visibleApps = new Set(liveApps.map((entry) => entry.id));
+      subscriptions = (await (dependencies.eventSubscriptions ?? readCatalogSubscriptions)()).filter((subscription) =>
+        visibleApps.has(subscription.appId),
+      );
+    }
+    return subscriptions;
+  };
   const start = query.cursor ? liveApps.findIndex((entry) => entry.id > query.cursor!) : 0;
   const offset = start < 0 ? liveApps.length : start;
   const apps: CapabilityCatalog["apps"] = [];
@@ -184,22 +209,29 @@ export const loadCapabilityCatalogPage = async (
   ).byteLength;
   for (const entry of liveApps.slice(offset)) {
     if (apps.length === query.limit) break;
-    const capability = await capabilityLookup(entry.id);
+    const capability = await lookup(entry.id);
     if (!capability || capability.manifest.manifestHash !== entry.capabilities?.manifestHash) {
       lastScannedAppId = entry.id;
       continue;
     }
     const presentedEntry = locale ? resolveAppPresentation(entry, locale) : entry;
+    const manifest = locale
+      ? resolveCapabilityManifestPresentation(capability.manifest, capability.presentation, locale)
+      : capability.manifest;
     const projected = {
       appId: capability.appId,
       appName: presentedEntry.name,
       appIcon: capability.appIcon,
       appDescription: presentedEntry.description,
-      manifest: locale ? resolveCapabilityManifestPresentation(capability.manifest, capability.presentation, locale) : capability.manifest,
+      manifest,
+      ...(manifest.events ? { events: projectAppEventCatalog(manifest, manifest.events.length ? await loadSubscribers() : []) } : {}),
     };
     const projectedBytes = new TextEncoder().encode(JSON.stringify(projected)).byteLength;
     const separatingCommas = apps.length;
-    if (apps.length > 0 && envelopeBytes + bytes + separatingCommas + projectedBytes > CAPABILITY_MAX_CATALOG_BYTES) break;
+    if (envelopeBytes + bytes + separatingCommas + projectedBytes > CAPABILITY_MAX_CATALOG_BYTES) {
+      if (!apps.length) throw new RangeError("An app's event catalog exceeds the catalog response byte limit");
+      break;
+    }
     apps.push(projected);
     bytes += projectedBytes;
     lastScannedAppId = entry.id;
@@ -238,6 +270,12 @@ export type CapabilityDispatchParams = {
   /** Cloud surface this invocation came from; recorded on the execution row. */
   origin: CapabilityOrigin;
   authority?: RequestAuthority;
+  /** Core-only verified parent; never constructed from app JSON. */
+  parentInvocation?: CloudInvocationClaims;
+  /** Core-only turn coordinates used to recheck allowed tools at a child exchange. */
+  assistantTurn?: { conversationId: string; turnId: string };
+  /** Core-only absolute child deadline; cannot be extended by the application. */
+  deadline?: number;
   mandate?: MandatedCapabilityAuthority;
   callingAppId?: string;
   /** Internal observation only: called immediately before attempting the app request. */
@@ -251,6 +289,8 @@ type CapabilityDispatchOutcome = { body: unknown; status: number; replayed?: boo
 type CapabilityDispatchObservation = {
   subject: { type: "user" | "service_account"; id: string } | null;
   destructive: boolean;
+  invocationId?: string;
+  leaseId?: string;
 };
 
 type CapabilityPrincipal = { type: "user" | "service_account"; id: string } | null;
@@ -347,7 +387,7 @@ const runCapabilityDispatch = async (
     return invalid;
   }
 
-  if (params.mandate && operation.stream)
+  if ((params.mandate || params.parentInvocation) && operation.stream)
     return errorResponse("STREAM_UNSUPPORTED_AUTHORITY", "Streams require an interactive user or service-account request", 403);
 
   let requestBody: string;
@@ -364,6 +404,28 @@ const runCapabilityDispatch = async (
 
   const invocationOperation = capabilityInvocationOperation(params.kind, params.capabilityId, params.review);
   const mandate = params.mandate;
+  const lease: NestedInvocationLease | undefined =
+    !params.parentInvocation && (mandate || params.authority?.credentialProof || params.assistantTurn)
+      ? {
+          appId: params.appId,
+          deadline: Math.min(
+            Date.now() + deadline.remainingMs(),
+            nestedSourceDeadline(params.authority?.credentialProof),
+            params.authority?.actor.kind === "service_account" && params.authority.actor.credentialExpiresAt
+              ? Date.parse(params.authority.actor.credentialExpiresAt)
+              : Infinity,
+          ),
+          origin: params.origin,
+          ...(params.authority?.credentialProof ? { proof: params.authority.credentialProof } : {}),
+          ...(params.assistantTurn ? { assistantTurn: params.assistantTurn } : {}),
+        }
+      : undefined;
+  let leaseClaims: CloudInvocationClaims | undefined;
+  const observeSigned = (signed: Awaited<ReturnType<typeof signInvocationToken>>) => {
+    observed.invocationId = signed.claims.jti;
+    leaseClaims = signed.claims;
+    return signed;
+  };
   let headers: Headers;
   try {
     headers = mandate
@@ -392,16 +454,22 @@ const runCapabilityDispatch = async (
                     return (params.dependencies?.signInvocation ?? signInvocationToken)(
                       {
                         targetAppId: params.appId,
-                        callingAppId: mandate.ownerAppId,
+                        callingAppId: params.callingAppId ?? mandate.ownerAppId,
                         operation: invocationOperation,
                         schemaHash: operation.schemaHash,
-                        authority: invocationAuthorityFromMandate(mandateAuthority),
+                        authority: params.parentInvocation
+                          ? authorityFromParentInvocation(params.parentInvocation)
+                          : invocationAuthorityFromMandate(mandateAuthority),
+                        parent: params.parentInvocation,
+                        expiresAt: params.parentInvocation
+                          ? Math.floor((params.deadline ?? params.parentInvocation.exp * 1000) / 1000)
+                          : undefined,
                         requestId,
                         signer,
                         issuer: signer.issuer,
                       },
                       { db, groupsAdmin: signer.groupsAdmin },
-                    );
+                    ).then(observeSigned);
                   },
                   { db, groupsAdmin: signer.groupsAdmin },
                 );
@@ -433,13 +501,19 @@ const runCapabilityDispatch = async (
                     callingAppId: params.callingAppId ?? "core",
                     operation: invocationOperation,
                     schemaHash: operation.schemaHash,
-                    authority: invocationAuthorityFromRequest(authority),
+                    authority: params.parentInvocation
+                      ? authorityFromParentInvocation(params.parentInvocation)
+                      : invocationAuthorityFromRequest(authority),
+                    parent: params.parentInvocation,
+                    expiresAt: params.parentInvocation
+                      ? Math.floor((params.deadline ?? params.parentInvocation.exp * 1000) / 1000)
+                      : undefined,
                     requestId,
                     signer,
                     issuer: signer.issuer,
                   },
                   { db, groupsAdmin: signer.groupsAdmin },
-                );
+                ).then(observeSigned);
               },
               { signal, timeoutMs: deadline.remainingMs() },
             ),
@@ -474,6 +548,20 @@ const runCapabilityDispatch = async (
     const failure = errorResponse(CAPABILITY_FRAMEWORK_ERROR_CODES.internal, messages.issuanceFailed, 500, { retrySafe: true });
     return failure;
   }
+  // Optional exchange state belongs to the active dispatch, after the signing
+  // transaction. Losing it disables nesting without failing the original call.
+  if (lease && leaseClaims) {
+    const claims = leaseClaims;
+    observed.leaseId = claims.jti;
+    const setup = createCapabilityDeadline(NESTED_INVOCATION_SETUP_BUDGET_MS, signal);
+    try {
+      await setup.wait(() => nestedInvocationLeases.create(claims, lease, setup.signal));
+    } catch {
+      log.warn("Nested Query exchange unavailable", { invocationId: claims.jti });
+    } finally {
+      setup.clear();
+    }
+  }
   deadline.check();
   headers.set("x-request-id", requestId);
   headers.set(CAPABILITY_ORIGIN_HEADER, params.origin);
@@ -755,16 +843,31 @@ const resultDataMeta = (body: unknown) =>
  */
 export const dispatchCapability = async (params: CapabilityDispatchParams): Promise<Response> => {
   const deadline = createCapabilityDeadline(
-    capabilityTimeoutMs(params.review ? "review" : params.kind === "queries" ? "query" : "action", params.dependencies),
+    Math.min(
+      capabilityTimeoutMs(params.review ? "review" : params.kind === "queries" ? "query" : "action", params.dependencies),
+      params.deadline ? Math.max(0, params.deadline - Date.now()) : Infinity,
+    ),
     params.request.signal,
   );
+  const observed: CapabilityDispatchObservation = { subject: null, destructive: false };
+  const revoke = () =>
+    observed.leaseId
+      ? nestedInvocationLeases.revoke(observed.leaseId).catch(() => {
+          log.error("Invocation exchange lease could not be revoked", { invocationId: observed.leaseId });
+        })
+      : Promise.resolve();
+  const onAbort = () => {
+    void revoke();
+  };
+  deadline.signal.addEventListener("abort", onAbort, { once: true });
   try {
     const requestId = normalizeInvocationRequestId(params.request.headers.get("x-request-id")) ?? crypto.randomUUID();
-    const observed: CapabilityDispatchObservation = { subject: null, destructive: false };
     const startedAt = new Date();
     let outcome: CapabilityDispatchOutcome;
     try {
-      outcome = await runCapabilityDispatch(params, requestId, observed, deadline);
+      outcome = hasOAuthScope(params.authority, params.review || params.kind === "queries" ? "read" : "write", "admin")
+        ? await runCapabilityDispatch(params, requestId, observed, deadline)
+        : errorResponse("FORBIDDEN", "Insufficient OAuth scope", 403);
     } catch (error) {
       if (!deadline.signal.aborted) throw error;
       const cancelled = params.request.signal.aborted;
@@ -790,6 +893,9 @@ export const dispatchCapability = async (params: CapabilityDispatchParams): Prom
       const recording = recordCapabilityExecution({
         requestId,
         origin: params.origin,
+        invocationId: observed.invocationId,
+        parentInvocationId: params.parentInvocation?.jti,
+        viaAppId: params.parentInvocation ? params.callingAppId : undefined,
         appId: params.appId,
         capability: `${params.appId}.${params.capabilityId}`,
         kind: params.kind === "queries" ? "query" : "action",
@@ -828,6 +934,8 @@ export const dispatchCapability = async (params: CapabilityDispatchParams): Prom
     }
     return capabilityJsonResponse(outcome.body, outcome.status);
   } finally {
+    deadline.signal.removeEventListener("abort", onAbort);
+    void revoke();
     deadline.clear();
   }
 };
@@ -850,6 +958,7 @@ export const createCapabilityRoutes = (dependencies: CapabilityRouteDependencies
     .use("/capabilities/v1/*", rejectReservedWorkloadCredential)
     .post(
       "/capabilities/v1/streams/:verb",
+      oauthScopeByOperation,
       describeRoute({
         tags: ["Capabilities"],
         summary: "Transfer or inspect one authorized binary stream",
@@ -895,6 +1004,7 @@ export const createCapabilityRoutes = (dependencies: CapabilityRouteDependencies
     )
     .post(
       "/capabilities/v1/commands/:appId/:capabilityId",
+      auth.readOnly,
       describeRoute({
         tags: ["Capabilities"],
         summary: "Resolve an interactive Command link",
@@ -944,6 +1054,7 @@ export const createCapabilityRoutes = (dependencies: CapabilityRouteDependencies
     )
     .post(
       "/capabilities/v1/actions/:appId/:capabilityId/review",
+      auth.readOnly,
       describeRoute({
         tags: ["Capabilities"],
         summary: "Review one live app Action",
@@ -995,6 +1106,7 @@ export const createCapabilityRoutes = (dependencies: CapabilityRouteDependencies
     )
     .post(
       "/capabilities/v1/:kind{queries|actions}/:appId/:capabilityId",
+      oauthScopeByOperation,
       describeRoute({
         tags: ["Capabilities"],
         summary: "Invoke one live app capability",

package/src/api/capability-streams.ts

@@ -16,6 +16,7 @@ import {
 } from "../contracts/capabilities";
 import type { RequestAuthority } from "../server";
 import { AppAccessDeniedError, appAccessDeniedBody } from "../server/middleware/app-access";
+import { hasOAuthScope } from "../server/oauth-scope";
 import { invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { capabilityInvocationOperation } from "../services/identity/invocation-operations";
 import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
@@ -94,11 +95,7 @@ export async function dispatchCapabilityStream(
   if (dependencies.allow && !(await dependencies.allow(grant))) return denied();
   if (Date.parse(grant.stream.expiresAt) <= Date.now()) return denied(410, "STREAM_EXPIRED");
   if ((verb === "read") !== (grant.stream.direction === "read")) return denied();
-  if (
-    authority.credentialKind === "oauth" &&
-    !authority.scopes.some((scope) => scope === "admin" || scope === (grant.kind === "actions" ? "write" : "read"))
-  )
-    return denied();
+  if (!hasOAuthScope(authority, grant.kind === "actions" ? "write" : "read", "admin")) return denied();
   const startedAt = new Date();
   let recorded = false;
   let destructive = false;

package/src/api/identity-child-invocation.ts

@@ -0,0 +1,145 @@
+import { Hono } from "hono";
+import { decodeJwt } from "jose";
+import { z } from "zod";
+import { readBoundedJson } from "../_internal/bounded-json";
+import { createCapabilityDeadline, withCapabilityRequestTimeout } from "../_internal/capability-timeout";
+import { authorizeCodeExecution } from "../ai/code-execution";
+import { CAPABILITY_MAX_REQUEST_BYTES, CapabilityAppIdSchema, CapabilityLocalIdSchema } from "../contracts/capabilities";
+import {
+  isNestedSourceCurrent,
+  matchesInvocationSubject,
+  nestedInvocationLeases,
+  resolveInvocationAuthority,
+  verifyInvocationToken,
+} from "../services/identity";
+import { dispatchCapability } from "./capabilities";
+
+const Input = z
+  .object({
+    targetApp: CapabilityAppIdSchema,
+    capabilityId: CapabilityLocalIdSchema,
+    input: z.unknown(),
+  })
+  .strict()
+  .refine((value) => Object.hasOwn(value, "input"));
+const denied = () =>
+  Response.json(
+    { code: "FORBIDDEN", message: "The parent invocation does not authorize this Query" },
+    { status: 403, headers: { "cache-control": "no-store" } },
+  );
+
+/** One read-only dependency of an active Core dispatch, never a generic bearer exchange. */
+export function createIdentityChildInvocationRoutes(
+  dependencies: {
+    verify?: typeof verifyInvocationToken;
+    resolve?: typeof resolveInvocationAuthority;
+    sourceCurrent?: typeof isNestedSourceCurrent;
+    leases?: typeof nestedInvocationLeases;
+    authorizeTurn?: (turn: { conversationId: string; turnId: string }, userId: string, query: string) => Promise<boolean>;
+    dispatch?: typeof dispatchCapability;
+  } = {},
+) {
+  const leases = dependencies.leases ?? nestedInvocationLeases;
+  const authorizeTurn =
+    dependencies.authorizeTurn ??
+    (async (turn, userId, query) => {
+      const { conversation } = await authorizeCodeExecution(turn.conversationId, turn.turnId, userId);
+      return !conversation.allowedTools || conversation.allowedTools.includes(query);
+    });
+  return new Hono().post("/invoke-child", async (c) =>
+    withCapabilityRequestTimeout(c, "query", async () => {
+      let deadline: ReturnType<typeof createCapabilityDeadline> | undefined;
+      try {
+        const token = c.req.header("authorization")?.match(/^Bearer (\S+)$/i)?.[1];
+        if (!token || token.length > 4096) return denied();
+        // Decode only routing expectations, then verify signature and every binding.
+        const hint = decodeJwt(token);
+        if (
+          typeof hint.aud !== "string" ||
+          !hint.aud.startsWith("app:") ||
+          typeof hint.op !== "string" ||
+          !(
+            hint.op.startsWith("capability.query:") ||
+            hint.op.startsWith("capability.action.run:") ||
+            hint.op.startsWith("capability.action.review:")
+          )
+        )
+          return denied();
+        const parent = await (dependencies.verify ?? verifyInvocationToken)(token, {
+          targetAppId: hint.aud.slice(4),
+          operation: hint.op,
+          schemaHash: typeof hint.schema_hash === "string" ? hint.schema_hash : null,
+        });
+        if (!parent || parent.parent_invocation_id || parent.exp * 1000 <= Date.now()) return denied();
+
+        deadline = createCapabilityDeadline(parent.exp * 1000 - Date.now(), c.req.raw.signal);
+        const body = await deadline.wait(() => readBoundedJson(c.req.raw, CAPABILITY_MAX_REQUEST_BYTES));
+        const input = body.ok ? Input.safeParse(body.data) : null;
+        if (!input?.success) return Response.json({ code: "VALIDATION_FAILED", message: "Invalid child Query input" }, { status: 400 });
+        if (`app:${input.data.targetApp}` === parent.aud) return denied();
+        c.req.raw.signal.throwIfAborted();
+        const lease = await deadline.wait(() => leases.take(parent.jti));
+        if (!lease || `app:${lease.appId}` !== parent.aud) return denied();
+        deadline.clear();
+        deadline = createCapabilityDeadline(Math.max(0, Math.min(lease.deadline, parent.exp * 1000) - Date.now()), c.req.raw.signal);
+        const authority = await deadline.wait(() => (dependencies.resolve ?? resolveInvocationAuthority)(parent));
+        if (!authority || !matchesInvocationSubject(parent, authority)) return denied();
+        if (
+          parent.credential_kind !== "mandate" &&
+          lease.origin !== "assistant" &&
+          (!lease.proof || !(await deadline.wait(() => (dependencies.sourceCurrent ?? isNestedSourceCurrent)(lease.proof!, parent))))
+        )
+          return denied();
+        if (lease.origin === "assistant") {
+          if (!lease.assistantTurn || parent.principal_type !== "user") return denied();
+          if (
+            !(await deadline.wait(() =>
+              authorizeTurn(lease.assistantTurn!, parent.sub, `${input.data.targetApp}.${input.data.capabilityId}`),
+            ))
+          )
+            return denied();
+        }
+        deadline.check();
+        deadline.clear();
+        const headers = new Headers({ "content-type": "application/json" });
+        if (parent.request_id) headers.set("x-request-id", parent.request_id);
+        for (const name of ["x-cloud-locale", "traceparent", "tracestate"]) {
+          const value = c.req.header(name);
+          if (value) headers.set(name, value);
+        }
+        const response = await (dependencies.dispatch ?? dispatchCapability)({
+          request: new Request(c.req.url, { method: "POST", headers, signal: c.req.raw.signal }),
+          kind: "queries",
+          origin: lease.origin,
+          authority,
+          parentInvocation: parent,
+          callingAppId: lease.appId,
+          deadline: Math.min(lease.deadline, parent.exp * 1000),
+          appId: input.data.targetApp,
+          capabilityId: input.data.capabilityId,
+          input: input.data.input,
+          ...(parent.credential_kind === "mandate"
+            ? {
+                mandate: {
+                  mandateId: parent.mandate_id!,
+                  mandateRevision: parent.mandate_revision!,
+                  ownerAppId: parent.act.sub.slice(4),
+                },
+              }
+            : {}),
+        });
+        response.headers.set("cache-control", "no-store");
+        return response;
+      } catch {
+        if (c.req.raw.signal.aborted)
+          return Response.json({ code: "REQUEST_CANCELLED", message: "The request was cancelled" }, { status: 499 });
+        if (deadline?.signal.aborted)
+          return Response.json({ code: "DEADLINE_EXCEEDED", message: "The parent deadline was exceeded" }, { status: 504 });
+        // Invalid signatures, unavailable live authority and store failures fail closed.
+        return denied();
+      } finally {
+        deadline?.clear();
+      }
+    }),
+  );
+}

package/src/api/index.ts

@@ -21,11 +21,13 @@ import { aiProjectsRoutes } from "../ai/projects-routes";
 import { aiRoutes } from "../ai/routes";
 import { aiSkillsRoutes } from "../ai/skills-routes";
 import accountsEntitiesRoutes from "./accounts-entities";
+import adminAiRoutes from "./admin-ai";
 import adminAiProjectsRoutes from "./admin-ai-projects";
 import adminAiQuotaRoutes from "./admin-ai-quotas";
 import adminAiSkillsRoutes from "./admin-ai-skills";
 import adminAiUsageRoutes from "./admin-ai-usage";
 import adminCoreSettingsRoutes from "./admin-core-settings";
+import adminDirectorySharesRoutes from "./admin-directory-shares";
 import adminGeoRoutes from "./admin-geo";
 import adminGeoIpRoutes from "./admin-geoip";
 import adminIdentityRoutes from "./admin-identity";
@@ -35,6 +37,7 @@ import adminOutgoingMailRoutes from "./admin-outgoing-mail";
 import adminRailRoutes from "./admin-rail";
 import { adminAnnouncementRoutes, announcementRoutes } from "./announcements";
 import { createAppApprovalRoutes } from "./app-approval";
+import { createAppEventRoutes } from "./app-events";
 import { approvalRoutes } from "./approvals";
 import { appDiscoveryRoutes } from "./apps";
 import { createAuthRoutes } from "./auth";
@@ -44,6 +47,7 @@ import { createHelpRoutes } from "./help";
 import { createMcpRoutes } from "./mcp";
 import meRoutes from "./me";
 import { createPwaRoutes } from "./pwa";
+import { createResourceResolveRoutes } from "./resource-resolve";
 import { createSearchRoutes } from "./search";
 import { createSyncOpsProxyRoutes } from "./sync-ops";
 import { createWidgetRoutes } from "./widgets";
@@ -52,6 +56,7 @@ export { withCapabilityRequestTimeout } from "../_internal/capability-timeout";
 export { createAiOpenAiRoutes } from "../ai/openai-api";
 export { type CapabilityDispatchDependencies, dispatchCapability } from "./capabilities";
 export { cliPluginListRoutes } from "./cli-plugins";
+export { createIdentityChildInvocationRoutes } from "./identity-child-invocation";
 export { createPwaPhoneRoutes } from "./pwa-phone";
 
 /**
@@ -83,8 +88,11 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/accounts", accountsEntitiesRoutes)
     .route("/geo", geoRoutes)
     .route("/apps", appDiscoveryRoutes)
+    .route("/app-events", createAppEventRoutes())
+    .route("/resources", createResourceResolveRoutes())
     .route("/approvals", approvalRoutes)
     .route("/announcements", announcementRoutes)
+    .route("/admin/core/ai", adminAiRoutes)
     .route("/admin/core/ai-usage", adminAiUsageRoutes)
     .route("/admin/core/ai-quotas", adminAiQuotaRoutes)
     .route("/admin/core/ai-projects", adminAiProjectsRoutes)
@@ -96,6 +104,7 @@ const buildCoreApi = (options: CoreApiOptions) => {
     .route("/admin/core/linux-identities", adminLinuxIdentityRoutes)
     .route("/admin/core/geoip", adminGeoIpRoutes)
     .route("/admin/core/geo", adminGeoRoutes)
+    .route("/admin/identity/directory-shares", adminDirectorySharesRoutes)
     .route("/admin/identity", adminIdentityRoutes)
     .route("/admin/sync", createSyncOpsProxyRoutes())
     .route("/admin/lifecycle", adminLifecycleRoutes)
@@ -124,6 +133,7 @@ export const createCoreApiRouter = (options: CoreApiOptions) => {
   return { api };
 };
 
+export { createAppAccessRoutes } from "./app-access";
 export {
   CLOUD_MCP_PATH,
   CLOUD_MCP_PROTECTED_RESOURCE_PATH,
@@ -132,5 +142,4 @@ export {
   createMcpRoutes,
   publicCloudOrigin,
 } from "./mcp";
-
-export { resolveCloudResourceHref } from "./resource-links";
+export { resolveCloudResourceHref, resolveCloudResourceUrl } from "./resource-links";