@k2b/cloud 0.44.0 → 0.45.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
@@ -31,6 +31,8 @@
     "./server/*": "./src/server/*",
     "./geo/ui": "./src/geo/ui.ts",
     "./browser": "./src/server/api-client.ts",
+    "./browser/session": "./src/browser/session.ts",
+    "./browser/shared-text": "./src/browser/shared-text.ts",
     "./browser/app-approval": "./src/browser/app-approval.ts",
     "./browser/app-badges": "./src/browser/app-badges.ts",
     "./browser/live": "./src/browser/live.ts",
@@ -123,7 +125,7 @@
     "@tailwindcss/typography": "0.5.20",
     "@k2b/nessi": "0.18.0",
     "@k2b/ssr": "0.20.1",
-    "@k2b/ui": "0.34.0",
+    "@k2b/ui": "0.35.0",
     "@k2b/stdlib": "0.30.0",
     "@k2b/sync": "7.0.1",
     "@nats-io/jetstream": "3.4.0",
@@ -136,6 +138,7 @@
     "htmlparser2": "12.0.0",
     "jose": "6.2.12",
     "katex": "0.18.9",
+    "lib0": "0.2.117",
     "liquidjs": "10.29.0",
     "marked": "18.0.14",
     "mermaid": "12.0.0",
@@ -149,6 +152,7 @@
     "web-push": "3.6.7",
     "web-vitals": "6.2.2",
     "yaml": "2.9.1",
+    "y-protocols": "1.0.7",
     "yjs": "13.6.33",
     "hash-wasm": "4.12.0",
     "@types/sanitize-html": "2.16.1",

package/src/access/GroupCoverage.tsx

@@ -2,16 +2,18 @@ import { query } from "@k2b/stdlib/solid";
 import { Button, InlineGuidance, useLocale } from "@k2b/ui";
 import { createSignal, createUniqueId, For, Show } from "solid-js";
 import { CloudAvatar } from "../account/Avatar";
-import type { BaseUser, EntityListItem, PaginationResponse } from "../contracts/shared";
+import type { EntityListItem, PaginationResponse } from "../contracts/shared";
 import { accessMessages } from "./messages";
+import { serviceAccountKindDisplay } from "./service-account-kind";
 
 /** Members per request. Further pages load only when the viewer asks for them. */
 const PAGE_SIZE = 20;
+type GroupMember = Exclude<EntityListItem, { kind: "group" }>;
 
 type MembersPage =
   /** The directory withholds group members from this viewer (guest accounts). */
   | { visible: false; directoryGroup: boolean }
-  | { visible: true; directoryGroup: boolean; members: BaseUser[]; total: number; page: number; hasNext: boolean };
+  | { visible: true; directoryGroup: boolean; members: GroupMember[]; total: number; page: number; hasNext: boolean };
 
 /** Reads the Accounts directory with the viewer's own visibility: `null` when it is withheld. */
 const listEntities = async (params: Record<string, string>, signal: AbortSignal) => {
@@ -38,7 +40,7 @@ export const createGroupCoverage = (groupId: string) => {
       const page = cursor ?? 1;
       const [list, group] = await Promise.all([
         listEntities(
-          { kinds: "user", member_of_group_id: id, recursive: "true", page: String(page), per_page: String(PAGE_SIZE) },
+          { kinds: "user,service_account", member_of_group_id: id, recursive: "true", page: String(page), per_page: String(PAGE_SIZE) },
           abortSignal,
         ),
         // Only the first page needs the group itself, for the directory hint.
@@ -49,7 +51,7 @@ export const createGroupCoverage = (groupId: string) => {
       return {
         visible: true,
         directoryGroup,
-        members: list.items.flatMap((item) => (item.kind === "user" ? [item.user] : [])),
+        members: list.items.filter((item) => item.kind !== "group"),
         total: list.pagination.total,
         page,
         hasNext: list.pagination.has_next,
@@ -146,7 +148,20 @@ export function GroupCoveragePanel(props: { coverage: GroupCoverage; groupName:
       <Show when={shown().length > 0}>
         <ul ref={list} tabindex="-1" aria-label={t().groupMembersOf({ name: props.groupName })} class="flex flex-col gap-1 outline-none">
           <For each={shown()}>
-            {(user) => {
+            {(member) => {
+              if (member.kind === "service_account") {
+                const kind = () => serviceAccountKindDisplay(member.serviceAccount.kind, t());
+                return (
+                  <li class="flex min-w-0 items-center gap-2 text-sm">
+                    <span class="flex h-6 w-6 shrink-0 items-center justify-center rounded-full bg-zinc-200 text-secondary dark:bg-zinc-700">
+                      <i class={`ti ${kind().icon}`} aria-hidden="true" />
+                    </span>
+                    <span class="truncate">{member.serviceAccount.name}</span>
+                    <span class="shrink-0 text-xs text-muted">{kind().label}</span>
+                  </li>
+                );
+              }
+              const user = member.user;
               const name = user.displayName || user.mail || user.uid;
               return (
                 <li class="flex min-w-0 items-center gap-2 text-sm">

package/src/access/PermissionEditor.tsx

@@ -449,6 +449,8 @@ export default function PermissionEditor(props: PermissionEditorProps) {
                   allowPublic={allowPublic()}
                   allowAuthenticated={allowAuthenticated()}
                   allowServiceAccounts={props.allowServiceAccounts}
+                  serviceAccountKinds={props.serviceAccountKinds}
+                  serviceAccountStatus={props.serviceAccountStatus ?? "active"}
                   placeholder={props.placeholder}
                   signedIn={props.signedIn}
                   disabled={saving()}
@@ -651,7 +653,7 @@ function AccessEntryRow(props: {
       >
         <Show when={!props.expanded} fallback={<PrincipalAvatar entry={props.entry} label={displayName()} />}>
           <Show
-            when={props.entry.principal.type === "user"}
+            when={props.entry.principal.type === "user" || props.entry.principal.type === "service_account"}
             fallback={
               <div class="flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-zinc-200 text-secondary dark:bg-zinc-700">
                 <i class={`ti ${getPrincipalIcon(props.entry, t())} text-sm`} />
@@ -660,8 +662,15 @@ function AccessEntryRow(props: {
           >
             <CloudAvatar
               username={displayName()}
-              userId={props.entry.principal.type === "user" ? props.entry.principal.userId : undefined}
+              userId={
+                props.entry.principal.type === "user"
+                  ? props.entry.principal.userId
+                  : props.entry.principal.type === "service_account"
+                    ? props.entry.principal.serviceAccountId
+                    : undefined
+              }
               avatarHash={props.entry.avatarHash}
+              kind={props.entry.principal.type === "service_account" ? "service_account" : "user"}
               size="xs"
               class="h-7 w-7"
             />

package/src/access/PrincipalAvatar.tsx

@@ -2,9 +2,9 @@ import { Show } from "solid-js";
 import { CloudAvatar } from "../account/Avatar";
 import type { AccessEntry } from "../contracts/shared";
 
-// One hue per principal kind from the avatar palette, so a group, a service account and all signed-in people
-// read apart at a glance. People use a neutral background.
-const hues = { group: "#22c55e", service_account: "#8b5cf6", authenticated: "#3b82f6" } as const;
+// One hue per principal kind from the avatar palette, so a group and all signed-in people read apart at a glance.
+// People use a neutral background; a service account shows its robot or photo, never a bare icon.
+const hues = { group: "#22c55e", authenticated: "#3b82f6" } as const;
 
 /** The 32px avatar of an access entry in the expanded editor and on the denial page. */
 export default function PrincipalAvatar(props: {
@@ -15,8 +15,6 @@ export default function PrincipalAvatar(props: {
     switch (props.entry.principal.type) {
       case "group":
         return "ti-users-group";
-      case "service_account":
-        return "ti-robot";
       case "authenticated":
         return "ti-world";
       default:
@@ -25,27 +23,38 @@ export default function PrincipalAvatar(props: {
   };
   const hue = () => {
     const type = props.entry.principal.type;
-    return type === "group" || type === "service_account" || type === "authenticated" ? hues[type] : undefined;
+    return type === "group" || type === "authenticated" ? hues[type] : undefined;
   };
   return (
     <Show
       when={props.entry.principal.type === "user" ? props.entry.principal : undefined}
       fallback={
-        <span
-          class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-[var(--ui-surface-muted)] text-secondary"
-          // The avatar formula: a light share of the hue on the surface, a dark share on the text, in both themes.
-          style={
-            hue()
-              ? {
-                  background: `color-mix(in srgb, ${hue()} 18%, var(--k2b-surface))`,
-                  color: `color-mix(in srgb, ${hue()} 55%, var(--k2b-text))`,
-                }
-              : undefined
-          }
-          aria-hidden="true"
-        >
-          <i class={`ti ${icon()} text-xs`} />
-        </span>
+        props.entry.principal.type === "service_account" ? (
+          <CloudAvatar
+            username={props.label}
+            userId={props.entry.principal.serviceAccountId}
+            avatarHash={props.entry.avatarHash}
+            kind="service_account"
+            size="sm"
+            class="h-8 w-8"
+          />
+        ) : (
+          <span
+            class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-[var(--ui-surface-muted)] text-secondary"
+            // The avatar formula: a light share of the hue on the surface, a dark share on the text, in both themes.
+            style={
+              hue()
+                ? {
+                    background: `color-mix(in srgb, ${hue()} 18%, var(--k2b-surface))`,
+                    color: `color-mix(in srgb, ${hue()} 55%, var(--k2b-text))`,
+                  }
+                : undefined
+            }
+            aria-hidden="true"
+          >
+            <i class={`ti ${icon()} text-xs`} />
+          </span>
+        )
       }
     >
       {(user) => (

package/src/access/messages.ts

@@ -47,8 +47,8 @@ export const accessMessages = i18n.define({
         count === 0
           ? "No one receives access through this group right now."
           : count === 1
-            ? "1 person receives access through this group right now."
-            : `${count.toLocaleString("en")} people receive access through this group right now.`,
+            ? "1 account receives access through this group right now."
+            : `${count.toLocaleString("en")} accounts receive access through this group right now.`,
       groupMembersLoading: "Loading members…",
       groupMembersHidden: "Your account can't see who belongs to this group.",
       groupMembersFailed: "Members couldn't be loaded.",
@@ -137,8 +137,8 @@ export const accessMessages = i18n.define({
         count === 0
           ? "Über diese Gruppe erhält gerade niemand Zugriff."
           : count === 1
-            ? "Über diese Gruppe erhält gerade 1 Person Zugriff."
-            : `Über diese Gruppe erhalten gerade ${count.toLocaleString("de")} Personen Zugriff.`,
+            ? "Über diese Gruppe erhält gerade 1 Konto Zugriff."
+            : `Über diese Gruppe erhalten gerade ${count.toLocaleString("de")} Konten Zugriff.`,
       groupMembersLoading: "Mitglieder werden geladen…",
       groupMembersHidden: "Dein Konto kann nicht sehen, wer zu dieser Gruppe gehört.",
       groupMembersFailed: "Die Mitglieder konnten nicht geladen werden.",

package/src/account/EntitySearch.tsx

@@ -5,6 +5,7 @@ import { createSignal, For, Show } from "solid-js";
 import { accessMessages } from "../access/messages";
 import { principalLabel } from "../access/principal-label";
 import { serviceAccountKindDisplay } from "../access/service-account-kind";
+import type { ServiceAccountKind, ServiceAccountStatus } from "../contracts/shared";
 import { groupDisplayName } from "../shared/account-display";
 import { CloudAvatar } from "./Avatar";
 
@@ -52,6 +53,10 @@ type EntitySearchProps = {
   includeGroups?: boolean;
   /** Surface service accounts in the result list. Off by default. */
   includeServiceAccounts?: boolean;
+  /** Restrict service-account kinds before pagination. Omitted or empty allows all kinds. */
+  serviceAccountKinds?: ServiceAccountKind[];
+  /** Restrict service-account status before pagination. Omitted allows both statuses. */
+  serviceAccountStatus?: ServiceAccountStatus;
   /** Inject a synthetic "All authenticated users" row at the top. */
   includeAuthenticated?: boolean;
   /** Inject a synthetic "Public" row at the top. */
@@ -171,6 +176,12 @@ const EntitySearch = (props: EntitySearchProps) => {
       if (props.excludeServiceAccountIds?.length) {
         url.searchParams.set("exclude_service_account_ids", props.excludeServiceAccountIds.join(","));
       }
+      if (props.includeServiceAccounts && props.serviceAccountKinds?.length) {
+        url.searchParams.set("service_account_kinds", props.serviceAccountKinds.join(","));
+      }
+      if (props.includeServiceAccounts && props.serviceAccountStatus) {
+        url.searchParams.set("service_account_status", props.serviceAccountStatus);
+      }
       if (props.onlyMembersOf?.length) {
         url.searchParams.set("user_member_of_group_ids", props.onlyMembersOf.join(","));
       }
@@ -296,6 +307,7 @@ const EntitySearch = (props: EntitySearchProps) => {
               {(serviceAccount) => (
                 <ResultRow
                   icon={serviceAccountKind(serviceAccount).icon}
+                  avatar={<CloudAvatar username={serviceAccount.name} userId={serviceAccount.id} kind="service_account" size="sm" />}
                   title={serviceAccount.name}
                   subtitle={
                     // Resource-bound accounts often share a name; their binding tells them apart.

package/src/ai/dictation-runtime.ts

@@ -1,5 +1,6 @@
 import { sql } from "bun";
 import { lazySync } from "../_internal/process-sync";
+import { get as getUser } from "../services/accounts/users";
 import { logger, trace } from "../services/logging";
 import { superviseRuntimeTask } from "../services/runtime-lifecycle";
 import { aiModelAccess } from "./model-access";
@@ -85,8 +86,11 @@ export const processAiDictation = async (
     if (!conversation) throw new Error("Conversation unavailable.");
     const subject = { type: "user" as const, userId: task.user_id };
     await aiModelAccess.assertAllowed(task.model_profile_id, subject);
-    if (conversation.project_id && !(await aiProjects.snapshot(conversation.project_id, subject)))
-      throw new Error("Project access unavailable.");
+    if (conversation.project_id) {
+      const user = await getUser({ id: task.user_id });
+      if (!user || !(await aiProjects.snapshot(conversation.project_id, { actor: { kind: "user", user }, accessSubject: subject })))
+        throw new Error("Project access unavailable.");
+    }
     const result = await run({
       task: "dictation",
       traceParent: span,

package/src/ai/executor.ts

@@ -57,6 +57,7 @@ import { answerOpenToolCalls } from "./open-tool-calls";
 import { type AiUserPrefs, aiActorUser, aiUserPrefs } from "./prefs";
 import { createCloudAiReadProjectKnowledgeTool, createCloudAiSearchProjectTool } from "./project-tool";
 import { aiProjects } from "./projects";
+import type { AiResourceContext } from "./projects-authorization";
 import {
   AI_TURN_LEASE_MS,
   type AiTurnBlock,
@@ -306,6 +307,11 @@ const accessSubjectForActor = (actor: RequestActor | undefined): AccessSubject |
   return { type: "service_account", serviceAccountId: actor.serviceAccount.id };
 };
 
+const resourceContextForActor = (actor: RequestActor | undefined): AiResourceContext | null => {
+  const accessSubject = accessSubjectForActor(actor);
+  return actor && accessSubject ? { actor, accessSubject } : null;
+};
+
 export type ExecutorConfig = {
   leaseOwner: string;
   heartbeatMs: number;
@@ -883,7 +889,7 @@ export class AiTurnExecutor {
       if (allowed) material.tools = material.tools.filter((tool) => allowed.has(tool.def.name));
       chatId ||= conversation?.shortId ?? "";
       if (config.project) {
-        const subject = accessSubjectForActor(material.actor);
+        const subject = resourceContextForActor(material.actor);
         const project = subject ? await aiProjects.getByShortId(config.project.id, subject, "read") : null;
         if (!project) {
           throw new AiTurnFailure("not_allowed", "Project access is no longer available.");
@@ -966,11 +972,11 @@ export class AiTurnExecutor {
     const timeZone = String((await coreSettings.get<string>("app.timezone")) || "").trim() || "UTC";
     const promptLocale = normalizeLocale(config.locale ?? (await coreSettings.get<string>("app.locale")));
     const project = config.project;
-    const projectSubject = project ? accessSubjectForActor(material.actor) : null;
+    const projectSubject = project ? resourceContextForActor(material.actor) : null;
     // Skills are an Assistant/default-tool capability. Custom and structured
     // executions must not gain an implicit database dependency or extra tools.
     const skillSubject =
-      defaultToolSource && resolved.profile.capabilities.includes("tools") ? accessSubjectForActor(material.actor) : null;
+      defaultToolSource && resolved.profile.capabilities.includes("tools") ? resourceContextForActor(material.actor) : null;
     const availableSkills = skillSubject
       ? (await aiSkills.list(skillSubject, { authority: toolAuthority })).filter((skill) => skill.enabled)
       : [];

package/src/ai/index.ts

@@ -290,6 +290,7 @@ export {
   type AiProjectReference,
   aiProjects,
 } from "./projects";
+export { type AiResourceContext, AiResourceCredentialError } from "./projects-authorization";
 export {
   type AiProjectsRoutes,
   aiProjectsRoutes,

package/src/ai/project-tool.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
-import type { AccessSubject } from "../server";
 import { mountAiProjectFilePath } from "./file-mount";
 import { aiProjects } from "./projects";
+import type { AiResourceContext } from "./projects-authorization";
 import { AI_SHORT_ID_PATTERN } from "./short-id";
 import { defineAiTool } from "./tools";
 
@@ -31,11 +31,11 @@ export const CloudAiReadProjectKnowledgeInputSchema = z
 
 export const CloudAiReadProjectKnowledgeOutputSchema = z.object({ title: z.string(), content: z.string() }).strict();
 
-const requireProjectAccess = async (projectId: string, subject: AccessSubject): Promise<void> => {
+const requireProjectAccess = async (projectId: string, subject: AiResourceContext): Promise<void> => {
   if (!(await aiProjects.get(projectId, subject, "read"))) throw new Error("Project access is no longer available.");
 };
 
-export const createCloudAiSearchProjectTool = (projectId: string, subject: AccessSubject) =>
+export const createCloudAiSearchProjectTool = (projectId: string, subject: AiResourceContext) =>
   defineAiTool({
     name: "search_project",
     description:
@@ -77,7 +77,7 @@ export const createCloudAiSearchProjectTool = (projectId: string, subject: Acces
     return { items: all.slice(0, 100), truncated: all.length > 100 };
   });
 
-export const createCloudAiReadProjectKnowledgeTool = (projectId: string, subject: AccessSubject) =>
+export const createCloudAiReadProjectKnowledgeTool = (projectId: string, subject: AiResourceContext) =>
   defineAiTool({
     name: "read_project_knowledge",
     description:

package/src/ai/projects-authorization.ts

@@ -0,0 +1,53 @@
+import type { AccessSubject, RequestActor } from "../server";
+import { hasPermission, type PermissionLevel } from "../server/services/access";
+
+/** Resource operations retain the actor's credential alongside the grant subject. */
+export type AiResourceContext = { actor: RequestActor; accessSubject: AccessSubject };
+
+export const aiResourceAccessSubject = (subject: AiResourceContext | null): AccessSubject | null => subject?.accessSubject ?? null;
+
+/** Projects and Skills have no supported resource-bound credential contract. */
+export const aiResourcePermissionCap = (subject: AiResourceContext | null): PermissionLevel => {
+  if (!subject?.actor || !subject.accessSubject) return "none";
+  const { actor, accessSubject } = subject;
+  if (actor.kind === "user") {
+    return accessSubject.type === "user" && accessSubject.userId === actor.user.id ? "admin" : "none";
+  }
+  if (actor.serviceAccount.kind === "resource_bound") return "none";
+  if (actor.delegatedUser) {
+    return actor.serviceAccount.kind === "user_delegated" &&
+      accessSubject.type === "user" &&
+      accessSubject.userId === actor.delegatedUser.id
+      ? "admin"
+      : "none";
+  }
+  if (
+    (actor.serviceAccount.kind !== "standalone" && actor.serviceAccount.kind !== "agent") ||
+    accessSubject.type !== "service_account" ||
+    accessSubject.serviceAccountId !== actor.serviceAccount.id
+  )
+    return "none";
+  return actor.scopes.includes("admin")
+    ? "admin"
+    : actor.scopes.includes("write")
+      ? "write"
+      : actor.scopes.includes("read")
+        ? "read"
+        : "none";
+};
+
+export const capAiResourcePermission = (granted: PermissionLevel, subject: AiResourceContext | null): PermissionLevel => {
+  const cap = aiResourcePermissionCap(subject);
+  return hasPermission(granted, cap) ? cap : granted;
+};
+
+export class AiResourceCredentialError extends Error {
+  constructor() {
+    super("The credential does not permit creating Projects or Skills.");
+    this.name = "AiResourceCredentialError";
+  }
+}
+
+export const requireAiResourceCreation = (subject: AiResourceContext): void => {
+  if (!hasPermission(aiResourcePermissionCap(subject), "write")) throw new AiResourceCredentialError();
+};