@k2b/cloud 0.44.0 → 0.45.0

package/src/services/accounts/groups.ts

@@ -31,8 +31,6 @@ const listCanonical = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
-  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
-  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }): Promise<{
@@ -48,7 +46,6 @@ const listCanonical = async (params: {
   const scope = params.scope ?? (params.userId ? "member" : "all");
   const scopeUserId = params.userId ?? "00000000-0000-0000-0000-000000000000";
   const idsCondition = ids.length === 0 ? sql`TRUE` : sql`g.id = ANY(${toPgUuidArray(ids)}::uuid[])`;
-  const includePersonal = params.includePersonal === true || params.ids !== undefined;
 
   if (params.ids && params.ids.length === 0) {
     return {
@@ -69,7 +66,7 @@ const listCanonical = async (params: {
     ${personalOwnerJoin()}
     WHERE (${params.provider ?? null}::text IS NULL OR g.provider = ${params.provider ?? null})
       AND ${idsCondition}
-      AND (${includePersonal} = true OR personal_owner.personal_owner_id IS NULL)
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       AND (
         ${scope === "all"} = true
         OR ${params.userId ?? null}::uuid IS NULL
@@ -107,8 +104,6 @@ export const list = async (params: {
   scope?: GroupListScope;
   search?: string;
   provider?: UserProvider;
-  /** Personal Linux groups are left out of browsing and search unless requested; an explicit `ids` lookup always returns them. */
-  includePersonal?: boolean;
   page?: number;
   perPage?: number;
 }) => {
@@ -122,13 +117,13 @@ export const get = async (params: { id: string }): Promise<BaseGroup | null> =>
 export const getMembers = async (params: {
   id: string;
   provider?: UserProvider;
-  type?: "user" | "group";
+  type?: GroupMember["type"];
   recursive?: boolean;
 }): Promise<GroupMember[]> => {
   const provider = params.provider ?? (await getGroup(params.id))?.provider;
   if (provider === "local") return localGroups.getMembers(params);
-  if (!provider) return [];
-  return providers.ipa.groups.getMembers(params);
+  if (!provider || params.type === "service_account") return [];
+  return providers.ipa.groups.getMembers({ ...params, type: params.type });
 };
 
 export const getManagers = async (params: {
@@ -225,9 +220,13 @@ export const addMember = async (params: {
   provider?: UserProvider;
   user?: string;
   group?: string;
+  serviceAccount?: string;
 }): Promise<MutationResult<void>> => {
-  const provider = params.provider ?? (await getGroup(params.id))?.provider;
-  if (provider === "local") return localGroups.addMember({ id: params.id, user: params.user, group: params.group });
+  const provider = (await getGroup(params.id))?.provider;
+  if (provider === "local")
+    return localGroups.addMember({ id: params.id, user: params.user, group: params.group, serviceAccount: params.serviceAccount });
+  if (params.serviceAccount)
+    return { ok: false, error: "Service accounts can only join local Cloud groups, not directory groups", status: 400 };
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
   return providers.ipa.groups.addMember({
@@ -243,9 +242,13 @@ export const removeMember = async (params: {
   provider?: UserProvider;
   user?: string;
   group?: string;
+  serviceAccount?: string;
 }): Promise<MutationResult<void>> => {
-  const provider = params.provider ?? (await getGroup(params.id))?.provider;
-  if (provider === "local") return localGroups.removeMember({ id: params.id, user: params.user, group: params.group });
+  const provider = (await getGroup(params.id))?.provider;
+  if (provider === "local")
+    return localGroups.removeMember({ id: params.id, user: params.user, group: params.group, serviceAccount: params.serviceAccount });
+  if (params.serviceAccount)
+    return { ok: false, error: "Service accounts can only join local Cloud groups, not directory groups", status: 400 };
   const serviceSession = await getServiceIpaSession();
   if (!serviceSession.ok) return serviceSession;
   return providers.ipa.groups.removeMember({

package/src/services/accounts/identities.ts

@@ -189,18 +189,25 @@ export const createAccountIdentityService = (db: typeof sql = sql, upstreamIdent
         eligible: current.profile === "user",
       };
     }
+    const [ownership] = await db<{ personal: boolean }[]>`SELECT EXISTS (
+      SELECT 1 FROM auth.personal_groups p
+      WHERE (${input.identityId ?? null}::uuid IS NOT NULL AND p.group_id = ${input.identityId ?? null}::uuid)
+         OR (${input.identityId ?? null}::uuid IS NULL AND p.group_name = ${input.name})
+    ) AS personal`;
+    const personal = ownership?.personal === true;
     const rows = await groupRows(sql`(g.provider = 'local' AND g.name = ${input.name}) OR g.id = ${input.identityId ?? null}::uuid`);
     const expected = rows.find((row) => row.id === input.identityId);
     if (expected && (expected.provider !== "local" || expected.name !== input.name))
       return { state: "unknown", reason: "identity_conflict" };
     const matches = rows.filter((row) => row.provider === "local" && row.name === input.name);
-    if (!matches.length) return { state: "absent" };
+    if (!matches.length) return personal ? { state: "absent", personal: true } : { state: "absent" };
     if (matches.length !== 1) return { state: "unknown", reason: "invalid_response" };
     const current = matches[0]!;
     return {
       state: "present",
       identity: { id: current.id, name: current.name, uidNumber: null, gidNumber: current.gidNumber },
       eligible: current.gidNumber !== null,
+      ...(personal ? { personal: true } : {}),
     };
   };
   const validateLookup = (input: { kind: "users" | "groups"; name: string }) => {

package/src/services/accounts/identity-reconciliation.ts

@@ -9,8 +9,10 @@ export type AccountIdentityReconciliation =
       state: "present";
       identity: { id: string | null; name: string; uidNumber: number | null; gidNumber: number | null };
       eligible: boolean;
+      /** Proven Cloud personal-group ownership, including retained directory bindings. */
+      personal?: boolean;
     }
-  | { state: "absent" }
+  | { state: "absent"; personal?: boolean }
   | { state: "unknown"; reason: "provider_disabled" | "provider_unavailable" | "invalid_response" | "identity_conflict" };
 export type IdentityLookup = { kind: "users" | "groups"; name: string; signal?: AbortSignal };
 

package/src/services/accounts/local-groups.ts

@@ -2,6 +2,7 @@ import { sql } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
 import { escapeLikePattern, isUniqueViolation } from "../postgres";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
+import { recursiveServiceAccountGroupIdsSubquery } from "./group-sql";
 
 type DbRow = Record<string, unknown>;
 
@@ -122,6 +123,7 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
     SELECT COUNT(*)::int AS count
     FROM auth.groups g
     WHERE g.provider = 'local'
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       AND (${pattern}::text IS NULL OR LOWER(g.name) LIKE ${pattern} ESCAPE '\\' OR LOWER(g.description) LIKE ${pattern} ESCAPE '\\')
   `;
   const total = Number(countRow?.count ?? 0);
@@ -130,6 +132,7 @@ export const list = async (params: { page?: number; perPage?: number; search?: s
     FROM auth.groups g
     ${personalOwnerJoin()}
     WHERE g.provider = 'local'
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       AND (${pattern}::text IS NULL OR LOWER(g.name) LIKE ${pattern} ESCAPE '\\' OR LOWER(g.description) LIKE ${pattern} ESCAPE '\\')
     ORDER BY g.name
     LIMIT ${perPage} OFFSET ${offset}
@@ -177,7 +180,7 @@ export const remove = async (params: { id: string }): Promise<MutationResult<voi
   return { ok: true, data: undefined };
 };
 
-export const getMembers = async (params: { id: string; type?: "user" | "group"; recursive?: boolean }): Promise<GroupMember[]> => {
+export const getMembers = async (params: { id: string; type?: GroupMember["type"]; recursive?: boolean }): Promise<GroupMember[]> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return [];
   const members: GroupMember[] = [];
@@ -231,6 +234,7 @@ export const getMembers = async (params: { id: string; type?: "user" | "group";
           SELECT DISTINCT g.id, g.name
           FROM local_group_tree tree
           JOIN auth.groups g ON g.id = tree.child_group_id
+          WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
           ORDER BY g.name
         `
       : await sql<DbRow[]>`
@@ -238,6 +242,7 @@ export const getMembers = async (params: { id: string; type?: "user" | "group";
           FROM auth.group_groups_v2 gg
           JOIN auth.groups g ON g.id = gg.child_group_id
           WHERE gg.parent_group_id = ${group.id} AND g.provider = 'local'
+            AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
           ORDER BY g.name
         `;
     for (const row of groupRows) {
@@ -245,6 +250,25 @@ export const getMembers = async (params: { id: string; type?: "user" | "group";
     }
   }
 
+  if (!params.type || params.type === "service_account") {
+    const rows = await sql<{ id: string; name: string; kind: "standalone" | "agent" }[]>`
+      SELECT sa.id, sa.name, sa.kind
+      FROM auth.service_accounts sa
+      WHERE sa.kind IN ('standalone', 'agent') AND ${
+        params.recursive === true
+          ? sql`${group.id}::uuid IN (${recursiveServiceAccountGroupIdsSubquery(sql`sa.id`)})`
+          : sql`EXISTS (
+              SELECT 1 FROM auth.service_account_groups sg
+              WHERE sg.service_account_id = sa.id AND sg.group_id = ${group.id}::uuid
+            )`
+      }
+      ORDER BY sa.name, sa.id
+    `;
+    members.push(
+      ...rows.map((row) => ({ type: "service_account" as const, id: row.id, displayName: row.name, serviceAccountKind: row.kind })),
+    );
+  }
+
   return members;
 };
 
@@ -310,6 +334,7 @@ export const getManagers = async (params: { id: string; type?: "user" | "group";
       FROM auth.group_manager_groups_v2 gmg
       JOIN auth.groups g ON g.id = gmg.manager_group_id
       WHERE gmg.group_id = ${group.id} AND g.provider = 'local'
+        AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       ORDER BY g.name
     `;
     for (const row of groupRows) {
@@ -340,7 +365,8 @@ export const getParents = async (params: { id: string; recursive?: boolean }): P
           WHERE g.provider = 'local'
         )
         SELECT DISTINCT parent_group_id
-        FROM local_parent_tree
+        FROM local_parent_tree tree
+        WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = tree.parent_group_id)
       `
     : await sql<DbRow[]>`
         SELECT gg.parent_group_id
@@ -348,6 +374,7 @@ export const getParents = async (params: { id: string; recursive?: boolean }): P
         JOIN auth.groups g ON g.id = gg.parent_group_id
         WHERE gg.child_group_id = ${group.id}
           AND g.provider = 'local'
+          AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
         ORDER BY g.name
       `;
 
@@ -374,6 +401,7 @@ export const getManagedGroups = async (params: { id: string; recursive?: boolean
         JOIN auth.group_manager_groups_v2 gmg ON gmg.manager_group_id = tree.manager_group_id
         JOIN auth.groups g ON g.id = gmg.group_id
         WHERE g.provider = 'local'
+          AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
       `
     : await sql<DbRow[]>`
         SELECT gmg.group_id
@@ -381,15 +409,38 @@ export const getManagedGroups = async (params: { id: string; recursive?: boolean
         JOIN auth.groups g ON g.id = gmg.group_id
         WHERE gmg.manager_group_id = ${group.id}
           AND g.provider = 'local'
+          AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
         ORDER BY g.name
       `;
 
   return rows.map((row) => row.group_id as string);
 };
 
-export const addMember = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
+export const addMember = async (params: {
+  id: string;
+  user?: string;
+  group?: string;
+  serviceAccount?: string;
+}): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
+  const [personal] = await sql`SELECT 1 FROM auth.personal_groups
+    WHERE group_id = ${group.id}::uuid OR group_id = ${params.group ?? null}::uuid`;
+  if (personal) return { ok: false, error: "Personal Linux groups cannot be used in group relationships", status: 409 };
+
+  if (params.serviceAccount) {
+    const [account] = await sql<{ id: string }[]>`
+      SELECT id FROM auth.service_accounts
+      WHERE id = ${params.serviceAccount}::uuid AND status = 'active' AND kind IN ('standalone', 'agent')
+    `;
+    if (!account) return { ok: false, error: "An active standalone or agent account is required", status: 400 };
+    const inserted = await sql`
+      INSERT INTO auth.service_account_groups (service_account_id, group_id)
+      VALUES (${account.id}::uuid, ${group.id}::uuid) ON CONFLICT DO NOTHING
+    `;
+    if (inserted.count === 0) return { ok: false, error: "Service account is already a direct member of this group", status: 409 };
+    return { ok: true, data: undefined };
+  }
 
   if (params.user) {
     const provider = await getUserProvider(params.user);
@@ -427,10 +478,21 @@ export const addMember = async (params: { id: string; user?: string; group?: str
   return { ok: false, error: "Missing member", status: 400 };
 };
 
-export const removeMember = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
+export const removeMember = async (params: {
+  id: string;
+  user?: string;
+  group?: string;
+  serviceAccount?: string;
+}): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
 
+  if (params.serviceAccount) {
+    await sql`DELETE FROM auth.service_account_groups
+      WHERE service_account_id = ${params.serviceAccount}::uuid AND group_id = ${group.id}::uuid`;
+    return { ok: true, data: undefined };
+  }
+
   if (params.user) {
     await sql`DELETE FROM auth.user_groups_v2 WHERE user_id = ${params.user}::uuid AND group_id = ${group.id}::uuid`;
     return { ok: true, data: undefined };
@@ -447,6 +509,9 @@ export const removeMember = async (params: { id: string; user?: string; group?:
 export const addManager = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
+  const [personal] = await sql`SELECT 1 FROM auth.personal_groups
+    WHERE group_id = ${group.id}::uuid OR group_id = ${params.group ?? null}::uuid`;
+  if (personal) return { ok: false, error: "Personal Linux groups cannot be used in group relationships", status: 409 };
 
   if (params.user) {
     const provider = await getUserProvider(params.user);

package/src/services/accounts/users.ts

@@ -1,5 +1,14 @@
 import { type SQL, sql } from "bun";
-import type { BaseUser, MutationResult, PaginationResponse, Role, User, UserProfile, UserProvider } from "../../contracts/shared";
+import type {
+  BaseUser,
+  MutationResult,
+  PaginationResponse,
+  RequestActor,
+  Role,
+  User,
+  UserProfile,
+  UserProvider,
+} from "../../contracts/shared";
 import { freeipa } from "../../server/services";
 import { createAuthLoginUrl } from "../../shared/redirect";
 import { isAccountCategoryAllowed } from "../account-category-policy";
@@ -225,9 +234,10 @@ export const getMinimal = async (params: { id: string } | { uid: string }): Prom
 };
 
 /** Audience roles for a resolved access subject, including delegated users and group managers. */
-export const getRoles = async (userId: string): Promise<Role[]> => {
-  const { groupsAdmin } = await getFreeIpaConfig();
-  const [row] = await sql<DbRow[]>`SELECT u.provider, u.profile,
+export const getRoles = async (userId: string, options?: { db: typeof sql }): Promise<Role[]> => {
+  const db = options?.db ?? sql;
+  const groupsAdmin = options ? await getFreeIpaAdminGroups(db) : (await getFreeIpaConfig()).groupsAdmin;
+  const [row] = await db<DbRow[]>`SELECT u.provider, u.profile,
     CASE WHEN u.provider='local' THEN u.admin ELSE EXISTS (
       SELECT 1 FROM auth.ipa_user_effective_groups eg WHERE eg.user_id=u.id
         AND eg.group_name=ANY(${toPgTextArray(groupsAdmin)}::text[])
@@ -239,6 +249,26 @@ export const getRoles = async (userId: string): Promise<Role[]> => {
   return buildRoles({ provider, profile, memberofGroup: [], manages: stringArray(row.manages), admin: Boolean(row.effective_admin) });
 };
 
+/**
+ * Revalidate installation authority and retain it until the caller commits.
+ * Lock users before grant/membership or mandate/profile locks, matching user
+ * deletion and provider sync. Projection and settings locks also cover rows
+ * inserted or replaced while lock acquisition was waiting.
+ */
+export const hasInstallationAdminInTransaction = async (actor: RequestActor, db: typeof sql): Promise<boolean> => {
+  if (actor.kind !== "user" || actor.sessionKind === "app" || !actor.user.roles.includes("admin")) return false;
+  const [user] = await db<{ provider: UserProvider; profile: UserProfile; expired: boolean }[]>`
+    SELECT provider, profile, (account_expires IS NOT NULL AND account_expires <= statement_timestamp()) AS expired
+    FROM auth.users WHERE id=${actor.user.id}::uuid FOR SHARE`;
+  if (!user || user.expired || user.profile !== "user") return false;
+  await db`LOCK TABLE settings.entries IN SHARE MODE`;
+  if (!(await isAccountCategoryAllowed(user, db))) return false;
+  if (user.provider === "ipa") {
+    await db`LOCK TABLE auth.ipa_user_effective_groups IN SHARE MODE`;
+  }
+  return (await getRoles(actor.user.id, { db })).includes("admin");
+};
+
 export const getByUid = async (params: { uid: string }): Promise<{ id: string; roles: Role[] } | null> => {
   const { groupsAdmin } = await getFreeIpaConfig();
   const rows = await sql<DbRow[]>`
@@ -347,15 +377,15 @@ export const list = async (params: {
   };
 };
 
-/** Technical membership reads stay complete; human-facing lists exclude personal groups explicitly. */
-export const getGroups = async (params: { id: string; recursive?: boolean; includePersonal?: boolean }): Promise<string[]> => {
+/** Exported group names exclude personal groups; authorization uses the complete group ID projection. */
+export const getGroups = async (params: { id: string; recursive?: boolean }): Promise<string[]> => {
   if (params.recursive) {
     const rows = await sql<DbRow[]>`${recursiveUserGroupsSubquery({
       userId: params.id,
       select: sql`
         SELECT DISTINCT g.name FROM user_all_groups ag
         JOIN auth.groups g ON g.id = ag.group_id
-        WHERE (${params.includePersonal !== false} OR NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id))
+        WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
         ORDER BY g.name
       `,
     })}`;
@@ -364,7 +394,7 @@ export const getGroups = async (params: { id: string; recursive?: boolean; inclu
   const rows = await sql<DbRow[]>`
     SELECT g.name FROM auth.groups g
     WHERE g.id IN (SELECT group_id FROM auth.user_groups_v2 WHERE user_id = ${params.id}::uuid)
-      AND (${params.includePersonal !== false} OR NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id))
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
     ORDER BY g.name
   `;
   return rows.map((row) => row.name as string);

package/src/services/mandates/index.ts

@@ -207,7 +207,7 @@ const validSubject = async (subject: MandateSubject, db: SQL): Promise<boolean>
     SELECT EXISTS (
       SELECT 1 FROM auth.service_accounts
       WHERE id = ${subject.id}::uuid
-        AND kind = 'resource_bound'
+        AND kind IN ('resource_bound', 'standalone', 'agent')
         AND status = 'active'
     ) AS active
   `;
@@ -687,7 +687,7 @@ export const validateMandateIssueAuthority = async (
         WHEN 'user' THEN user_account.id IS NOT NULL
           AND (user_account.account_expires IS NULL OR user_account.account_expires > now())
         WHEN 'service_account' THEN service_account.id IS NOT NULL
-          AND service_account.kind = 'resource_bound'
+          AND service_account.kind IN ('resource_bound', 'standalone', 'agent')
           AND service_account.status = 'active'
         ELSE false
       END AS subject_active

package/src/services/mandates/policy.ts

@@ -14,6 +14,7 @@ const operationSchema = z.union([
   z.literal("search.query"),
   z.literal("runtime.http"),
   z.literal("runtime.database"),
+  z.literal("workflow.run"),
   z.string().refine((value) => {
     const [prefix, localId, extra] = value.split(":");
     return (

package/src/services/session/index.ts

@@ -648,11 +648,20 @@ export const session = {
 
   revoke: revokeToken,
 
-  /** Signs out the web session (or an explicit bearer session). The mobile app's session is unaffected. */
-  delete: async (c: Context): Promise<void> => {
+  /** Signs out the web session (or an explicit bearer). False when an expected account no longer owns the request's credential. */
+  delete: async (c: Context, expectedUserId?: string | null): Promise<boolean> => {
+    // Capture once: another tab may replace the browser cookie while this
+    // request runs, but both the comparison and revocation concern this token.
     const token = getWebOrBearerToken(c);
+    if (token && expectedUserId !== undefined) {
+      const claims = await verifySessionToken(token);
+      if (claims && claims.sub !== expectedUserId) return false;
+    }
     if (token) await revokeToken(token, c.req.header("x-request-id"));
-    deleteCookie(c, "session_token", { path: "/" });
+    // Bound browser logout revokes the captured family without mutating the
+    // shared cookie: its response may arrive after another tab signs in.
+    if (expectedUserId === undefined) deleteCookie(c, "session_token", { path: "/" });
+    return true;
   },
 
   issueInTransaction,

package/src/shared/email-html.ts

@@ -6,6 +6,7 @@ export const EMAIL_HTML_TAGS = [
   "br",
   "code",
   "div",
+  "del",
   "em",
   "h1",
   "h2",

package/src/shared/markdown/extensions/katex.ts

@@ -8,6 +8,7 @@
 
 import katex from "katex";
 import type { MarkedExtension, Tokens } from "marked";
+import { escapeHtml } from "../shared";
 
 /**
  * Token shape produced by the math tokenizers below. The marked extension API
@@ -40,7 +41,7 @@ function renderInlineMath(latex: string): string {
   }
 }
 
-export function katexExtension(): MarkedExtension {
+export function katexExtension(literal = false): MarkedExtension {
   return {
     extensions: [
       // ```math code blocks
@@ -63,6 +64,10 @@ export function katexExtension(): MarkedExtension {
           return undefined;
         },
         renderer(token: Tokens.Generic) {
+          if (literal) {
+            const source = token.raw.slice("```math\n".length, -"\n```".length);
+            return `<pre>${escapeHtml(source)}</pre>\n`;
+          }
           const latex = (token as MathToken).latex;
           return renderBlockMath(latex);
         },
@@ -87,6 +92,7 @@ export function katexExtension(): MarkedExtension {
           return undefined;
         },
         renderer(token: Tokens.Generic) {
+          if (literal) return `<p>${escapeHtml(token.raw)}</p>\n`;
           const latex = (token as MathToken).latex;
           return renderBlockMath(latex);
         },
@@ -111,6 +117,7 @@ export function katexExtension(): MarkedExtension {
           return undefined;
         },
         renderer(token: Tokens.Generic) {
+          if (literal) return escapeHtml(token.raw);
           const latex = (token as MathToken).latex;
           return renderInlineMath(latex);
         },

package/src/shared/markdown/extensions/tables.ts

@@ -66,11 +66,24 @@ const renderCell = (alignCls: string, originalText: string, ctx: EvalContext, ht
   return `<td><span class="md-table-cell md-formula-error${alignCls}" title="${escapeHtml(tooltip)}">⚠ ${escapeHtml(originalText)}</span></td>`;
 };
 
-export function tablesExtension(): MarkedExtension {
+export function tablesExtension(plain = false): MarkedExtension {
   return {
     renderer: {
       table(token: Tokens.Table): string {
         const align = token.align ?? [];
+        // Email has no Cloud stylesheet or formula widgets. Keep alignment on the
+        // structural cells and escape formula source before Markdown can interpret it.
+        if (plain) {
+          const cellHtml = (cell: Tokens.TableCell, tag: "th" | "td", column: number): string => {
+            const alignment = align[column];
+            const attribute = alignment ? ` align="${alignment}"` : "";
+            const content = isFormula(cell.text) ? escapeHtml(cell.text) : this.parser.parseInline(cell.tokens);
+            return `<${tag}${attribute}>${content}</${tag}>`;
+          };
+          const header = token.header.map((cell, column) => cellHtml(cell, "th", column)).join("");
+          const rows = token.rows.map((row) => `<tr>${row.map((cell, column) => cellHtml(cell, "td", column)).join("")}</tr>`).join("");
+          return `<table><thead><tr>${header}</tr></thead><tbody>${rows}</tbody></table>`;
+        }
 
         // Build the EvalContext once per table — formulas reference
         // raw cell text, not other formulas' results, so a single pass

package/src/shared/markdown/index.ts

@@ -25,8 +25,15 @@ import { escapeHtml } from "./shared";
 // Create a configured marked instance
 type MarkdownProfile = "content" | "help";
 type LinkStyle = "widget" | "plain";
+type MarkdownOutput = "cloud" | "email";
 
-const createMarked = (profile: MarkdownProfile, links: LinkStyle, infoBlocks: MarkedExtension, locale?: string) => {
+const createMarked = (
+  profile: MarkdownProfile,
+  links: LinkStyle,
+  infoBlocks: MarkedExtension,
+  locale?: string,
+  output: MarkdownOutput = "cloud",
+) => {
   const marked = new Marked();
 
   marked.use({
@@ -38,12 +45,12 @@ const createMarked = (profile: MarkdownProfile, links: LinkStyle, infoBlocks: Ma
   // Note: katexExtension must come before codeExtension to handle ```math blocks
   marked.use(infoBlocks);
   marked.use(taskListExtension());
-  marked.use(tablesExtension());
+  marked.use(tablesExtension(output === "email"));
   // Plain output keeps marked's own link renderer and renders code blocks as a bare `pre`.
   // Cloud links are calm reference pills and quiet web links from `@k2b/ui`.
   if (links === "widget") marked.use(linksExtension({ internalTarget: profile === "help" ? "_self" : "_blank", locale }));
   marked.use(imagesExtension());
-  marked.use(katexExtension());
+  marked.use(katexExtension(output === "email"));
   marked.use(links === "widget" ? codeExtension() : plainCodeExtension());
   // Inline-style decorators come last so they run after structural tokenizers.
   marked.use(markExtension());
@@ -57,12 +64,12 @@ const createMarked = (profile: MarkdownProfile, links: LinkStyle, infoBlocks: Ma
 // headers choose the locale, and `markdownInfoBlocks()` returns one extension
 // for every locale that shares a catalog, so the cache stays bounded.
 const instances = new Map<MarkedExtension, Map<string, Marked>>();
-const markedFor = (profile: MarkdownProfile, links: LinkStyle = "widget", locale?: string): Marked => {
+const markedFor = (profile: MarkdownProfile, links: LinkStyle = "widget", locale?: string, output: MarkdownOutput = "cloud"): Marked => {
   const infoBlocks = markdownInfoBlocks({ locale });
   const byStyle = instances.get(infoBlocks) ?? new Map<string, Marked>();
   instances.set(infoBlocks, byStyle);
-  const key = `${profile}:${links}`;
-  const instance = byStyle.get(key) ?? createMarked(profile, links, infoBlocks, locale);
+  const key = `${profile}:${links}:${output}`;
+  const instance = byStyle.get(key) ?? createMarked(profile, links, infoBlocks, locale, output);
   byStyle.set(key, instance);
   return instance;
 };
@@ -70,18 +77,21 @@ const markedFor = (profile: MarkdownProfile, links: LinkStyle = "widget", locale
 const marked = markedFor("content");
 
 export type MarkdownRenderOptions = {
+  /** `"email"` keeps strikethrough and structural table alignment, and renders table formulas and math as literal source. Defaults to Cloud's styled output with formula evaluation. */
+  output?: MarkdownOutput;
   /** `"plain"` renders each link as an ordinary anchor around its text, for HTML read outside Cloud such as email. It also renders a code block, fenced or indented and including a Mermaid fence, as its source in a `pre` without the language label. The default renders references to Cloud content as calm pills and web links as quiet text links. */
   links?: LinkStyle;
   /** Request locale for the screen-reader names of untitled info blocks. Defaults to English on the server and the page language in the browser. */
   locale?: string;
 };
 
-const sanitizeRenderedHtml = (html: string, profile: MarkdownProfile = "content"): string => {
+const sanitizeRenderedHtml = (html: string, profile: MarkdownProfile = "content", output: MarkdownOutput = "cloud"): string => {
   const callouts = markdownCalloutSanitizeOptions();
   return sanitizeHtml(html, {
     ...callouts,
     allowedTags: [
       ...sanitizeHtml.defaults.allowedTags,
+      ...(output === "email" ? ["del"] : []),
       "annotation",
       "aside",
       "br",
@@ -137,6 +147,7 @@ const sanitizeRenderedHtml = (html: string, profile: MarkdownProfile = "content"
       input: ["checked", "class", "disabled", "type"],
       math: ["xmlns"],
       pre: ["class"],
+      ...(output === "email" ? { th: ["align"], td: ["align"] } : {}),
       ...callouts.allowedAttributes,
       span: ["aria-hidden", "class", "style", "title"],
     },
@@ -192,10 +203,10 @@ const sanitizeRenderedHtml = (html: string, profile: MarkdownProfile = "content"
 export function renderMarkdown(content: string, options: MarkdownRenderOptions = {}): string {
   if (!content || typeof content !== "string") return "";
 
-  const html = markedFor("content", options.links, options.locale).parse(content);
+  const html = markedFor("content", options.links, options.locale, options.output).parse(content);
   if (typeof html !== "string") return "";
 
-  return sanitizeRenderedHtml(html);
+  return sanitizeRenderedHtml(html, "content", options.output);
 }
 
 /**
@@ -204,10 +215,10 @@ export function renderMarkdown(content: string, options: MarkdownRenderOptions =
 export function renderMarkdownSync(content: string, options: MarkdownRenderOptions = {}): string {
   if (!content || typeof content !== "string") return "";
 
-  const html = markedFor("content", options.links, options.locale).parse(content);
+  const html = markedFor("content", options.links, options.locale, options.output).parse(content);
   if (typeof html !== "string") return "";
 
-  return sanitizeRenderedHtml(html);
+  return sanitizeRenderedHtml(html, "content", options.output);
 }
 
 /**

package/src/shared-text/anchors.ts

@@ -0,0 +1,29 @@
+import * as Y from "yjs";
+
+/** Capture an existing character, never a boundary that could drift to a neighbour. */
+export const captureTextAnchor = (text: Y.Text, index: number): Uint8Array => {
+  if (!text.doc || !Number.isSafeInteger(index) || index < 0 || index >= text.length)
+    throw new RangeError("A text anchor must identify an existing character in an attached Y.Text");
+  return Y.encodeRelativePosition(Y.createRelativePositionFromTypeIndex(text, index, 0));
+};
+
+/**
+ * Resolve only the original live character. Ordinary relative positions also
+ * resolve beside deleted characters and follow undo replacements; neither is
+ * a safe target for a delayed structural action.
+ */
+export const resolveTextAnchor = (text: Y.Text, bytes: Uint8Array): number | null => {
+  if (!text.doc) return null;
+  try {
+    const anchor = Y.decodeRelativePosition(bytes);
+    if (!anchor.item || anchor.assoc !== 0) return null;
+    const position = Y.createAbsolutePositionFromRelativePosition(anchor, text.doc, false);
+    if (!position || position.type !== text || position.index < 0 || position.index >= text.length) return null;
+    // Item encodings omit the root type name. Compare two decoded positions,
+    // rather than a decoded anchor with a fresh position containing that name.
+    const live = Y.decodeRelativePosition(captureTextAnchor(text, position.index));
+    return Y.compareRelativePositions(anchor, live) ? position.index : null;
+  } catch {
+    return null;
+  }
+};