@k2b/cloud 0.43.0 → 0.44.0

package/src/services/identity/invocation-token.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
 import { createRemoteJWKSet, decodeProtectedHeader, errors, type JWTVerifyGetKey, jwtVerify, SignJWT } from "jose";
 import { z } from "zod";
@@ -46,7 +47,7 @@ export const normalizeInvocationRequestId = (value: unknown): string | undefined
   return parsed.success ? parsed.data : undefined;
 };
 
-const InvocationPayloadSchema = z
+const InvocationPayloadBaseSchema = z
   .object({
     iss: z.string().url(),
     aud: z.string().regex(/^app:[a-z][a-z0-9-]{0,79}$/),
@@ -61,6 +62,8 @@ const InvocationPayloadSchema = z
     /** Only for an app session of the mobile app, which never acts as an administrator. */
     session_kind: z.literal("app").optional(),
     credential_id: BoundedIdentifierSchema.optional(),
+    oauth_client_id: z.string().min(1).max(200).optional(),
+    credential_expires_at: z.iso.datetime().optional(),
     scopes: z
       .array(ScopeSchema)
       .max(100)
@@ -79,52 +82,66 @@ const InvocationPayloadSchema = z
     nbf: z.number().int().nonnegative(),
     exp: z.number().int().positive(),
   })
-  .strict()
-  .superRefine((claims, context) => {
-    if (
-      (claims.parent_invocation_id
-        ? claims.exp <= claims.iat ||
-          claims.exp - claims.iat > CLOUD_INVOCATION_TOKEN_TTL_SECONDS ||
-          !claims.op.startsWith("capability.query:")
-        : claims.exp - claims.iat !== CLOUD_INVOCATION_TOKEN_TTL_SECONDS) ||
-      claims.nbf !== claims.iat
-    ) {
-      context.addIssue({ code: "custom", message: "Invocation lifetime is invalid" });
-    }
+  .strict();
 
-    if (claims.principal_type === "user") {
-      if (claims.access_subject_type !== "user" || claims.access_subject_id !== claims.sub || claims.delegated_user_id !== undefined) {
-        context.addIssue({ code: "custom", message: "User invocation authority is inconsistent" });
-      }
-      if (claims.credential_kind === "api_key") {
-        context.addIssue({ code: "custom", message: "An API key must act through a service account" });
-      }
-    } else if (claims.delegated_user_id) {
-      if (claims.access_subject_type !== "user" || claims.access_subject_id !== claims.delegated_user_id) {
-        context.addIssue({ code: "custom", message: "Delegated invocation authority is inconsistent" });
-      }
-    } else if (claims.access_subject_type !== "service_account" || claims.access_subject_id !== claims.sub) {
-      context.addIssue({ code: "custom", message: "Service-account invocation authority is inconsistent" });
-    }
-    if (claims.credential_kind === "session" && claims.principal_type !== "user") {
-      context.addIssue({ code: "custom", message: "A session invocation must use a user principal" });
-    }
-    if (claims.session_kind && claims.credential_kind !== "session") {
-      context.addIssue({ code: "custom", message: "Only a session invocation has a session kind" });
+const validateInvocationClaims = (claims: z.infer<typeof InvocationPayloadBaseSchema>, context: z.RefinementCtx, subjectProbe = false) => {
+  if (
+    (claims.parent_invocation_id
+      ? claims.exp <= claims.iat ||
+        claims.exp - claims.iat > CLOUD_INVOCATION_TOKEN_TTL_SECONDS ||
+        !claims.op.startsWith("capability.query:")
+      : claims.exp - claims.iat !== CLOUD_INVOCATION_TOKEN_TTL_SECONDS) ||
+    claims.nbf !== claims.iat
+  ) {
+    context.addIssue({ code: "custom", message: "Invocation lifetime is invalid" });
+  }
+
+  if (claims.principal_type === "user") {
+    if (claims.access_subject_type !== "user" || claims.access_subject_id !== claims.sub || claims.delegated_user_id !== undefined) {
+      context.addIssue({ code: "custom", message: "User invocation authority is inconsistent" });
     }
-    if (claims.credential_kind === "session" && claims.scopes.length > 0) {
-      context.addIssue({ code: "custom", message: "A session invocation cannot carry credential scopes" });
+    if (claims.credential_kind === "api_key") {
+      context.addIssue({ code: "custom", message: "An API key must act through a service account" });
     }
-    if (claims.credential_kind === "api_key" && !claims.credential_id) {
-      context.addIssue({ code: "custom", message: "An API-key invocation requires credential provenance" });
+  } else if (claims.delegated_user_id) {
+    if (claims.access_subject_type !== "user" || claims.access_subject_id !== claims.delegated_user_id) {
+      context.addIssue({ code: "custom", message: "Delegated invocation authority is inconsistent" });
     }
+  } else if (claims.access_subject_type !== "service_account" || claims.access_subject_id !== claims.sub) {
+    context.addIssue({ code: "custom", message: "Service-account invocation authority is inconsistent" });
+  }
+  if (claims.credential_kind === "session" && claims.principal_type !== "user") {
+    context.addIssue({ code: "custom", message: "A session invocation must use a user principal" });
+  }
+  if (claims.session_kind && claims.credential_kind !== "session") {
+    context.addIssue({ code: "custom", message: "Only a session invocation has a session kind" });
+  }
+  if (claims.credential_kind === "session" && claims.scopes.length > 0) {
+    context.addIssue({ code: "custom", message: "A session invocation cannot carry credential scopes" });
+  }
+  if (claims.credential_kind === "api_key" && !claims.credential_id) {
+    context.addIssue({ code: "custom", message: "An API-key invocation requires credential provenance" });
+  }
 
-    const mandateFields = [claims.mandate_id, claims.mandate_revision, claims.workload_type, claims.workload_id];
-    const mandateFieldCount = mandateFields.filter((value) => value !== undefined).length;
-    if (claims.credential_kind === "mandate" ? mandateFieldCount !== mandateFields.length : mandateFieldCount !== 0) {
-      context.addIssue({ code: "custom", message: "Mandate provenance is incomplete or unexpected" });
-    }
-  });
+  const mandateFields = [claims.mandate_id, claims.mandate_revision, claims.workload_type, claims.workload_id];
+  const mandateFieldCount = mandateFields.filter((value) => value !== undefined).length;
+  if (
+    claims.credential_kind === "mandate"
+      ? mandateFieldCount !== mandateFields.length && !(subjectProbe && mandateFieldCount === 0)
+      : mandateFieldCount !== 0
+  ) {
+    context.addIssue({ code: "custom", message: "Mandate provenance is incomplete or unexpected" });
+  }
+};
+
+const InvocationPayloadSchema = InvocationPayloadBaseSchema.superRefine((claims, context) => validateInvocationClaims(claims, context));
+const AppAccessProbeSchema = InvocationPayloadBaseSchema.extend({
+  token_use: z.literal("app_access_probe"),
+  act: z.object({ sub: z.literal("app:core") }).strict(),
+  op: z.literal("app-access.check"),
+  schema_hash: z.null(),
+  parent_invocation_id: z.never().optional(),
+}).superRefine((claims, context) => validateInvocationClaims({ ...claims, token_use: "invocation" }, context, true));
 
 export type CloudInvocationClaims = z.infer<typeof InvocationPayloadSchema>;
 export type InvocationAuthority = Pick<
@@ -137,6 +154,8 @@ export type InvocationAuthority = Pick<
   | "credential_kind"
   | "session_kind"
   | "credential_id"
+  | "oauth_client_id"
+  | "credential_expires_at"
   | "scopes"
   | "mandate_id"
   | "mandate_revision"
@@ -245,6 +264,26 @@ export const signInvocationToken = async (params: {
   }
 };
 
+async function verifyWithKeyRefresh(
+  verify: (key: JWTVerifyGetKey) => ReturnType<typeof jwtVerify>,
+  key: JWTVerifyGetKey,
+  remote: { url: URL; state: RemoteSetState } | null,
+) {
+  try {
+    return await verify(key);
+  } catch (error) {
+    if (!(error instanceof errors.JWKSNoMatchingKey) || !remote) throw error;
+    const now = Date.now();
+    if (now - remote.state.lastForcedRefreshAt < 30_000) throw error;
+    remote.state.lastForcedRefreshAt = now;
+    identityMetrics.increment("unknown_kid_refresh");
+    const refreshed = createRemoteSet(remote.url);
+    const verified = await verify(refreshed);
+    remote.state.key = refreshed;
+    return verified;
+  }
+}
+
 /** With deferSchemaBinding, the caller must compare schema_hash after resolving live authority. */
 export const verifyInvocationToken = async (
   token: string,
@@ -262,7 +301,7 @@ export const verifyInvocationToken = async (
     const jwksUrl = options.jwksUrl ?? runtime?.invocationJwksUrl;
     const state = options.key || !jwksUrl ? null : remoteSet(jwksUrl);
     if (state && jwksUrl) remote = { url: jwksUrl, state };
-    let key = options.key ?? state?.key;
+    const key = options.key ?? state?.key;
     if (!key) throw new Error("Cloud invocation verifier has no public key source");
     assertProtectedHeader(decodeProtectedHeader(token));
     const verify = (candidate: JWTVerifyGetKey) =>
@@ -274,19 +313,7 @@ export const verifyInvocationToken = async (
         clockTolerance: INVOCATION_CLOCK_TOLERANCE_SECONDS,
         currentDate: options.now,
       });
-    let verified: Awaited<ReturnType<typeof jwtVerify>>;
-    try {
-      verified = await verify(key);
-    } catch (error) {
-      if (!(error instanceof errors.JWKSNoMatchingKey) || !remote) throw error;
-      const now = Date.now();
-      if (now - remote.state.lastForcedRefreshAt < 30_000) throw error;
-      remote.state.lastForcedRefreshAt = now;
-      identityMetrics.increment("unknown_kid_refresh");
-      key = createRemoteSet(remote.url);
-      verified = await verify(key);
-      remote.state.key = key;
-    }
+    const verified = await verifyWithKeyRefresh(verify, key, remote);
     const parsed = InvocationPayloadSchema.safeParse(verified.payload);
     if (!parsed.success || parsed.data.op !== operation || (!options.deferSchemaBinding && parsed.data.schema_hash !== schemaHash)) {
       throw new Error("Cloud invocation JWT claims do not match the target operation");
@@ -303,3 +330,158 @@ export const verifyInvocationToken = async (
 export const clearInvocationVerifierCachesForTest = (): void => {
   remoteSets.clear();
 };
+
+const AppEventInvocationClaimsSchema = z
+  .object({
+    iss: z.string().url(),
+    aud: z.string(),
+    token_use: z.literal("app_event_delivery"),
+    act: z.literal("app:core"),
+    op: z.literal("app-event.deliver"),
+    subscription_id: z.string().min(1).max(400),
+    event_id: z.uuid(),
+    payload_hash: z.string().regex(/^[a-f0-9]{64}$/),
+    iat: z.number().int(),
+    nbf: z.number().int(),
+    exp: z.number().int(),
+    jti: z.uuid(),
+  })
+  .strict();
+
+export const appEventPayloadHash = (payload: unknown): string => createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+
+/** Core-to-app invocation, bound to one subscription, event and exact request body. */
+export const signAppEventInvocation = async (input: {
+  appId: string;
+  subscriptionId: string;
+  eventId: string;
+  payload: unknown;
+  issuer?: string;
+  signer?: PreparedIdentitySigner;
+  now?: Date;
+  jti?: string;
+}) => {
+  const issuer = input.issuer ?? (await getIdentityRuntimeConfig()).issuer;
+  const signer = input.signer ?? (await prepareIdentitySigner("invocation"));
+  const now = Math.floor((input.now?.getTime() ?? Date.now()) / 1_000);
+  if (signer.signUntil.getTime() < (now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS) * 1000)
+    throw new Error("Invocation signing key expires before the delivery token");
+  const claims = AppEventInvocationClaimsSchema.parse({
+    iss: issuer,
+    aud: `app:${AppIdSchema.parse(input.appId)}`,
+    token_use: "app_event_delivery",
+    act: "app:core",
+    op: "app-event.deliver",
+    subscription_id: input.subscriptionId,
+    event_id: input.eventId,
+    payload_hash: appEventPayloadHash(input.payload),
+    iat: now,
+    nbf: now,
+    exp: now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS,
+    jti: input.jti ?? crypto.randomUUID(),
+  });
+  return new SignJWT(claims)
+    .setProtectedHeader({ alg: CLOUD_IDENTITY_ALGORITHM, typ: CLOUD_INVOCATION_TOKEN_TYPE, kid: signer.kid })
+    .sign(signer.key);
+};
+
+export const verifyAppEventInvocation = async (
+  token: string,
+  input: { appId: string; subscriptionId: string; eventId: string; payload: unknown },
+  options: { issuer?: string; key?: JWTVerifyGetKey; jwksUrl?: URL; now?: Date } = {},
+): Promise<boolean> => {
+  if (new TextEncoder().encode(token).byteLength > IDENTITY_MAX_COMPACT_TOKEN_BYTES) return false;
+  try {
+    assertProtectedHeader(decodeProtectedHeader(token));
+    const runtime = options.issuer && (options.key || options.jwksUrl) ? null : await getIdentityRuntimeConfig();
+    const issuer = options.issuer ?? runtime!.issuer;
+    const url = options.jwksUrl ?? runtime?.invocationJwksUrl;
+    const state = options.key || !url ? null : remoteSet(url);
+    const key = options.key ?? state?.key;
+    if (!key) return false;
+    const verify = (key: JWTVerifyGetKey) =>
+      jwtVerify(token, key, {
+        algorithms: [CLOUD_IDENTITY_ALGORITHM],
+        audience: `app:${AppIdSchema.parse(input.appId)}`,
+        issuer,
+        typ: CLOUD_INVOCATION_TOKEN_TYPE,
+        clockTolerance: INVOCATION_CLOCK_TOLERANCE_SECONDS,
+        currentDate: options.now,
+      });
+    const result = await verifyWithKeyRefresh(verify, key, state && url ? { url, state } : null);
+    const claims = AppEventInvocationClaimsSchema.parse(result.payload);
+    return (
+      claims.exp - claims.iat === CLOUD_INVOCATION_TOKEN_TTL_SECONDS &&
+      claims.nbf === claims.iat &&
+      claims.subscription_id === input.subscriptionId &&
+      claims.event_id === input.eventId &&
+      claims.payload_hash === appEventPayloadHash(input.payload)
+    );
+  } catch {
+    return false;
+  }
+};
+
+/** Core-only, target-bound existence proof. It cannot authorize an application operation. */
+export const signAppAccessProbe = async (input: {
+  appId: string;
+  authority: InvocationAuthority;
+  issuer?: string;
+  signer?: PreparedIdentitySigner;
+  now?: Date;
+}) => {
+  const issuer = input.issuer ?? (await getIdentityRuntimeConfig()).issuer;
+  const signer = input.signer ?? (await prepareIdentitySigner("invocation"));
+  const now = Math.floor((input.now?.getTime() ?? Date.now()) / 1_000);
+  if (signer.signUntil.getTime() < (now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS) * 1000)
+    throw new Error("Invocation signing key expires before the app-access probe");
+  const claims = AppAccessProbeSchema.parse({
+    ...input.authority,
+    iss: issuer,
+    aud: `app:${AppIdSchema.parse(input.appId)}`,
+    token_use: "app_access_probe",
+    act: { sub: "app:core" },
+    op: "app-access.check",
+    schema_hash: null,
+    ver: CLOUD_INVOCATION_PROTOCOL_VERSION,
+    iat: now,
+    nbf: now,
+    exp: now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS,
+    jti: crypto.randomUUID(),
+  });
+  const token = await new SignJWT(claims)
+    .setProtectedHeader({ alg: CLOUD_IDENTITY_ALGORITHM, typ: CLOUD_INVOCATION_TOKEN_TYPE, kid: signer.kid })
+    .sign(signer.key);
+  if (new TextEncoder().encode(token).byteLength > IDENTITY_MAX_COMPACT_TOKEN_BYTES) throw new Error("App-access probe exceeds 4 KiB");
+  return token;
+};
+
+export const verifyAppAccessProbe = async (
+  token: string,
+  appId: string,
+  options: { issuer?: string; key?: JWTVerifyGetKey; jwksUrl?: URL; now?: Date } = {},
+): Promise<z.infer<typeof AppAccessProbeSchema> | null> => {
+  if (new TextEncoder().encode(token).byteLength > IDENTITY_MAX_COMPACT_TOKEN_BYTES) return null;
+  try {
+    assertProtectedHeader(decodeProtectedHeader(token));
+    const runtime = options.issuer && (options.key || options.jwksUrl) ? null : await getIdentityRuntimeConfig();
+    const issuer = options.issuer ?? runtime!.issuer;
+    const url = options.jwksUrl ?? runtime?.invocationJwksUrl;
+    const state = options.key || !url ? null : remoteSet(url);
+    const key = options.key ?? state?.key;
+    if (!key) return null;
+    const verify = (key: JWTVerifyGetKey) =>
+      jwtVerify(token, key, {
+        algorithms: [CLOUD_IDENTITY_ALGORITHM],
+        audience: `app:${AppIdSchema.parse(appId)}`,
+        issuer,
+        typ: CLOUD_INVOCATION_TOKEN_TYPE,
+        clockTolerance: INVOCATION_CLOCK_TOLERANCE_SECONDS,
+        currentDate: options.now,
+      });
+    const result = await verifyWithKeyRefresh(verify, key, state && url ? { url, state } : null);
+    return AppAccessProbeSchema.parse(result.payload);
+  } catch {
+    return null;
+  }
+};

package/src/services/identity/issue-invocation.ts

@@ -33,6 +33,7 @@ export const resolveIssuanceAuthority = async (
 
 type RegisteredAppAccessOptions = {
   db?: SQL;
+  signal?: AbortSignal;
   getApp?: (id: string) => Promise<Pick<AppMeta, "id" | "access"> | null>;
 };
 
@@ -41,8 +42,10 @@ export const requireRegisteredAppAccess = async (
   appId: string,
   options: RegisteredAppAccessOptions = {},
 ): Promise<void> => {
+  options.signal?.throwIfAborted();
   const app = await (options.getApp ?? getApp)(appId).catch(() => null);
-  if (!app || !authority || !(await canUseApp(authority, app, { db: options.db }))) {
+  if (!app || !authority || !(await canUseApp(authority, app, { db: options.db, signal: options.signal }))) {
+    options.signal?.throwIfAborted();
     if (app) recordAppAccessDenied(app.id);
     throw new AppAccessDeniedError(app ?? { id: appId });
   }
@@ -57,6 +60,7 @@ export const issueInvocationToken = async (
     sign?: typeof signInvocationToken;
   } = {},
 ): ReturnType<typeof signInvocationToken> => {
+  dependencies.signal?.throwIfAborted();
   const authority = await (dependencies.resolve ?? resolveIssuanceAuthority)(
     params.authority,
     params.callingAppId,
@@ -66,5 +70,6 @@ export const issueInvocationToken = async (
   if (params.parent && (!authority || !matchesInvocationSubject(params.parent, authority)))
     throw new AppAccessDeniedError({ id: params.targetAppId });
   await requireRegisteredAppAccess(authority, params.targetAppId, dependencies);
+  dependencies.signal?.throwIfAborted();
   return (dependencies.sign ?? signInvocationToken)(params);
 };

package/src/services/image-metadata.ts

@@ -366,12 +366,76 @@ const stripWebp = (bytes: Uint8Array): Uint8Array => {
   return out.subarray(0, written);
 };
 
+const stripGif = (bytes: Uint8Array): Uint8Array => {
+  const bad = () => new ImageMetadataError("GIF");
+  if (bytes.length < 13) throw bad();
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (!view.getUint16(6, true) || !view.getUint16(8, true)) throw bad();
+  let offset = 13 + (bytes[10]! & 0x80 ? 3 * (1 << ((bytes[10]! & 7) + 1)) : 0);
+  if (offset > bytes.length) throw bad();
+  const out = new Uint8Array(bytes.length);
+  let written = copy(out, 0, bytes, 0, offset);
+  let image = false;
+  const blocksEnd = (start: number) => {
+    let next = start;
+    while (next < bytes.length) {
+      const size = bytes[next++]!;
+      if (!size) return next;
+      if (next + size > bytes.length) throw bad();
+      next += size;
+    }
+    throw bad();
+  };
+  while (offset < bytes.length) {
+    const start = offset;
+    const type = bytes[offset++]!;
+    if (type === 0x3b) {
+      if (!image) throw bad();
+      out[written++] = type;
+      return out.subarray(0, written);
+    }
+    if (type === 0x2c) {
+      if (offset + 9 > bytes.length || !view.getUint16(offset + 4, true) || !view.getUint16(offset + 6, true)) throw bad();
+      const packed = bytes[offset + 8]!;
+      offset += 9 + (packed & 0x80 ? 3 * (1 << ((packed & 7) + 1)) : 0);
+      if (offset >= bytes.length || bytes[offset]! < 2 || bytes[offset]! > 8) throw bad();
+      offset = blocksEnd(offset + 1);
+      written = copy(out, written, bytes, start, offset);
+      image = true;
+    } else if (type === 0x21) {
+      if (offset >= bytes.length) throw bad();
+      const label = bytes[offset++]!;
+      const payload = offset;
+      offset = blocksEnd(offset);
+      if (label === 0xf9) {
+        if (bytes[payload] !== 4 || offset !== payload + 6) throw bad();
+        written = copy(out, written, bytes, start, offset);
+      } else if (label === 0x01) {
+        // Plain text extensions contribute visible content, unlike comments and private application blocks.
+        if (bytes[payload] !== 12) throw bad();
+        written = copy(out, written, bytes, start, offset);
+      } else if (
+        label === 0xff &&
+        bytes[payload] === 11 &&
+        offset === start + 19 &&
+        (startsWith(bytes, "NETSCAPE2.0", payload + 1) || startsWith(bytes, "ANIMEXTS1.0", payload + 1)) &&
+        bytes[payload + 12] === 3 &&
+        bytes[payload + 13] === 1
+      ) {
+        written = copy(out, written, bytes, start, offset);
+      }
+    } else throw bad();
+  }
+  throw bad();
+};
+
 /**
- * Losslessly removes non-rendering metadata from JPEG, PNG and WebP, selected
+ * Losslessly removes non-rendering metadata from JPEG, PNG, WebP and GIF, selected
  * by magic bytes. Call only for uploads the application classifies as images.
  * Other formats are returned unchanged. No decoding; linear time and space.
  */
 export const stripImageMetadata = (bytes: Uint8Array): Uint8Array => {
+  if (startsWith(bytes, "GIF87a") || startsWith(bytes, "GIF89a")) return stripGif(bytes);
   if (bytes[0] === 0xff && bytes[1] === 0xd8) return stripJpeg(bytes);
   if (startsWith(bytes, "\x89PNG")) return stripPng(bytes);
   if (startsWith(bytes, "RIFF") && startsWith(bytes, "WEBP", 8)) return stripWebp(bytes);

package/src/services/index.ts

@@ -104,7 +104,7 @@ export type {
   ServiceAccountCredentialOwner,
   ServiceAccountCredentialStatus,
 } from "./service-account-credentials";
-export { oauthTokens } from "./oauth-tokens";
+export { isServiceAccountOAuthAuthorityCurrent, oauthTokens } from "./oauth-tokens";
 export type { AuthenticatedOAuthToken } from "./oauth-tokens";
 export { webauthn } from "./webauthn";
 export type { WebAuthnRp } from "./webauthn";
@@ -251,6 +251,7 @@ export {
 export type { NetworkLookup, PublicNetworkAddress } from "./network-security";
 
 export { geoip } from "./geoip";
+export { appDetails } from "./app-details";
 export {
   knownBrowsers,
   KNOWN_BROWSER_LIMITS,
@@ -279,3 +280,14 @@ export {
   requireAppAccessManager,
   type AppAccessSnapshot,
 } from "./app-access-management";
+
+export { storage } from "./object-store";
+export type {
+  ObjectStoreFile,
+  ObjectVisibility,
+  ObjectWriteData,
+  ObjectWriteOptions,
+  ObjectPresignOptions,
+  ObjectListOptions,
+  ObjectListResult,
+} from "./object-store";

package/src/services/ipa/sync.ts

@@ -1,4 +1,5 @@
 import { sql } from "bun";
+import { coreUserEventPublisher } from "../../events/core-user-created";
 import { freeipa } from "../../server/services";
 import { writeDeletedAccountAudit } from "../account-lifecycle/audit";
 import { calculateIpaProfileFromGroupNames, parseIpaAccountTransitionPolicy, parseIpaMatchMode } from "../account-model";
@@ -461,8 +462,11 @@ export const syncFromIpa = async (runtime: IpaSyncRuntime = {}): Promise<void> =
         RETURNING id, (xmax = 0) AS inserted`;
       await upsertUserIpaData(tx, { userId: upserted[0]!.id as string, ...u });
       upsertedUsersByUid += 1;
-      if (Boolean(upserted[0]?.inserted)) insertedUsersByUid += 1;
-      else updatedUsersByUid += 1;
+      if (Boolean(upserted[0]?.inserted)) {
+        insertedUsersByUid += 1;
+        const userId = upserted[0]!.id as string;
+        await coreUserEventPublisher().publish(tx, "user.created", { subject: userId, data: { userId, provider: "ipa" } });
+      } else updatedUsersByUid += 1;
     }
 
     for (let staleIndex = 0; staleIndex < staleLocalUsers.length; staleIndex += 1) {

package/src/services/ipa/users.ts

@@ -1,6 +1,7 @@
 import { password } from "@k2b/stdlib";
 import { sql } from "bun";
 import type { MutationResult, UserProfile } from "../../contracts/shared";
+import { coreUserEventPublisher } from "../../events/core-user-created";
 import { freeipa } from "../../server/services";
 import { writeDeletedAccountAudit } from "../account-lifecycle/audit";
 import { resolveProviderProfile } from "../accounts/base-user";
@@ -366,7 +367,7 @@ export const addIpa = async (params: {
           display_name = EXCLUDED.display_name,
           mail = EXCLUDED.mail,
           account_expires = EXCLUDED.account_expires
-        RETURNING id
+        RETURNING id, (xmax = 0) AS inserted
       `;
         id = insertRows[0]!.id as string;
         await upsertUserIpaData(
@@ -381,6 +382,8 @@ export const addIpa = async (params: {
           },
           tx,
         );
+        if (insertRows[0]?.inserted)
+          await coreUserEventPublisher().publish(tx, "user.created", { subject: id, data: { userId: id, provider: "ipa" } });
       }
     } catch (dbError) {
       log.error("CRITICAL: FreeIPA user created but local DB update failed. Manual reconciliation needed.", {

package/src/services/mandates/policy.ts

@@ -194,6 +194,11 @@ export const isMandatePolicyNarrowing = (current: MandatePolicyV1, next: Mandate
         }),
       ));
 
+/**
+ * True when a background mandate permits one operation. Unattended Actions must fit the live
+ * capability policy whenever the mandate has grants or preapproves Actions; a `require_approval`
+ * mandate without grants runs an Action only after its separate approval completed through Cloud.
+ */
 export const mandatePolicyAllows = (
   policy: MandatePolicyV1,
   input: {
@@ -224,14 +229,14 @@ export const mandatePolicyAllows = (
       )
     );
   }
+  const [operation, capabilityId] = input.operation.split(":");
+  const kind =
+    operation === "capability.query"
+      ? "query"
+      : operation === "capability.action.run" || operation === "capability.action.review"
+        ? "action"
+        : null;
   if (policy.grants !== undefined) {
-    const [operation, capabilityId] = input.operation.split(":");
-    const kind =
-      operation === "capability.query"
-        ? "query"
-        : operation === "capability.action.run" || operation === "capability.action.review"
-          ? "action"
-          : null;
     if (
       !kind ||
       !capabilityId ||
@@ -240,11 +245,13 @@ export const mandatePolicyAllows = (
       )
     )
       return false;
-    if (kind === "action") {
-      if (input.capabilityPolicy) {
-        if (!("silent" in input.capabilityPolicy) || input.capabilityPolicy.routines === false) return false;
-      } else if (input.capabilityApproval !== "none" && input.capabilityApproval !== "rememberable") return false;
-    }
+  }
+  // Routine grants and unattended preapproval must both fit the live capability policy.
+  // A no-grants require_approval mandate keeps its separately approved execution path.
+  if (kind === "action" && (policy.grants !== undefined || policy.actions === "preapproved")) {
+    if (input.capabilityPolicy) {
+      if (!("silent" in input.capabilityPolicy) || input.capabilityPolicy.routines === false) return false;
+    } else if (input.capabilityApproval !== "none" && input.capabilityApproval !== "rememberable") return false;
   }
   if (!input.operation.startsWith("capability.action.run:")) return true;
   if (policy.actions === "deny") return false;

package/src/services/notifications/browser.ts

@@ -29,6 +29,7 @@ type BrowserDeliveryPayload = {
   group?: string;
   badge?: number;
   createdAt?: number;
+  alert?: false;
 };
 
 // RFC 8030 section 7.2 guarantees 4,096 bytes; aes128gcm adds a header, tag, and padding delimiter.
@@ -44,6 +45,7 @@ const browserPushMessage = (payload: BrowserDeliveryPayload): string =>
     ...(payload.group !== undefined ? { group: payload.group } : {}),
     ...(payload.badge !== undefined ? { badge: payload.badge } : {}),
     ...(payload.createdAt !== undefined ? { createdAt: payload.createdAt } : {}),
+    ...(payload.alert === false ? { alert: false } : {}),
   });
 
 const BrowserDeliveryPayloadSchema = z.object({
@@ -59,6 +61,7 @@ const BrowserDeliveryPayloadSchema = z.object({
     .optional(),
   badge: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
   createdAt: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).optional(),
+  alert: z.literal(false).optional(),
 });
 
 const BrowserDestinationContextSchema = z.object({
@@ -192,6 +195,7 @@ const browserDriver = {
       ...(group !== undefined ? { group } : {}),
       ...(presentation.badge !== undefined ? { badge: presentation.badge } : {}),
       ...(presentation.group !== undefined || presentation.badge !== undefined ? { createdAt: Date.now() } : {}),
+      ...(presentation.alert === false ? { alert: false } : {}),
     });
     if (payload.preview !== undefined && Buffer.byteLength(browserPushMessage(payload), "utf8") > WEB_PUSH_PLAINTEXT_BUDGET) {
       const { preview: _preview, ...titleOnlyPayload } = payload;

package/src/services/notifications/catalog.ts

@@ -17,15 +17,16 @@ const isSchemaUnavailable = (error: unknown): boolean => {
 const upsertDefinition = async (definition: AnyBoundNotificationDefinition, db: typeof sql = sql): Promise<void> => {
   const recommended = toPgTextArray([...(definition.delivery?.recommended ?? [])]);
   const required = toPgTextArray([...(definition.delivery?.required ?? [])]);
+  const excluded = toPgTextArray([...(definition.delivery?.excluded ?? [])]);
   await db`
     INSERT INTO notifications.definitions (
       id, app_id, kind, label, description, presentation, recipient_kind,
-      recommended_channels, required_channels, active, last_seen_at, updated_at
+      recommended_channels, required_channels, excluded_channels, excluded_reason, active, last_seen_at, updated_at
     ) VALUES (
       ${definition.id}, ${definition.appId}, ${definition.key}, ${definition.label},
       ${definition.description}, (${definition.presentation ? JSON.stringify(definition.presentation) : null}::text)::jsonb,
       ${definition.recipient}, ${recommended}::text[],
-      ${required}::text[], true, now(), now()
+      ${required}::text[], ${excluded}::text[], ${definition.excludedReason ?? null}, true, now(), now()
     )
     ON CONFLICT (id) DO UPDATE SET
       app_id = EXCLUDED.app_id,
@@ -36,6 +37,8 @@ const upsertDefinition = async (definition: AnyBoundNotificationDefinition, db:
       recipient_kind = EXCLUDED.recipient_kind,
       recommended_channels = EXCLUDED.recommended_channels,
       required_channels = EXCLUDED.required_channels,
+      excluded_channels = EXCLUDED.excluded_channels,
+      excluded_reason = EXCLUDED.excluded_reason,
       active = true,
       last_seen_at = now(),
       updated_at = now()