@k2b/cloud 0.44.0 → 0.46.0

package/src/services/accounts/machine-group-management.ts

@@ -0,0 +1,94 @@
+import { sql } from "bun";
+import type { ServiceAccountRequestActor } from "../../server/middleware/auth";
+import { err, fail, ok, type Result } from "../../server/services";
+import { audit } from "../audit";
+import * as localGroups from "./local-groups";
+
+/** Runs the existing local membership operation while its direct management grant is locked. */
+export async function mutateMachineGroupMember(params: {
+  actor: ServiceAccountRequestActor;
+  id: string;
+  userId?: string;
+  groupId?: string;
+  serviceAccountId?: string;
+  operation: "add" | "remove";
+  requestId?: string;
+}): Promise<Result<void>> {
+  const { actor } = params;
+  const action = `accounts.group.member.${params.operation}`;
+  const target = { type: "group", id: params.id };
+  const metadata = {
+    actorServiceAccountId: actor.serviceAccount.id,
+    credentialId: actor.credentialId ?? null,
+    oauthClientId: actor.oauthClientId ?? null,
+    userId: params.userId ?? null,
+    groupId: params.groupId ?? null,
+    serviceAccountId: params.serviceAccountId ?? null,
+  };
+  const unexpired = (expiration: string | Date | null | undefined) =>
+    expiration == null || (typeof expiration === "string" ? Date.parse(expiration) : expiration.getTime()) > Date.now();
+  const denied = () => fail(err.forbidden("A current management grant for this group and write scope are required"));
+  if (
+    actor.delegatedUser ||
+    !["standalone", "agent"].includes(actor.serviceAccount.kind) ||
+    !actor.scopes.some((scope) => scope === "write" || scope === "admin") ||
+    !unexpired(actor.credentialExpiresAt) ||
+    (!actor.credentialId && (!actor.oauthClientId || !actor.credentialExpiresAt))
+  )
+    return audit.recordResult({ action, target, metadata, requestId: params.requestId, result: denied() });
+
+  return sql.begin(async (db) => {
+    // Account -> credential -> group -> grant matches the group deletion cascade.
+    const [account] = await db`SELECT id FROM auth.service_accounts
+      WHERE id = ${actor.serviceAccount.id}::uuid AND status = 'active' AND kind IN ('standalone','agent') FOR SHARE`;
+    let allowed = Boolean(account);
+    let storedExpiration: Date | null = null;
+    if (allowed && actor.credentialId) {
+      const [credential] = await db<{ expires_at: Date | null }[]>`SELECT expires_at FROM auth.service_account_credentials
+        WHERE id = ${actor.credentialId}::uuid AND service_account_id = ${actor.serviceAccount.id}::uuid
+          AND status = 'active' AND (expires_at IS NULL OR expires_at > clock_timestamp())
+          AND scopes && ARRAY['write','admin']::text[] FOR SHARE`;
+      allowed = Boolean(credential);
+      storedExpiration = credential?.expires_at ?? null;
+    } else if (allowed) {
+      const [client] = await db`SELECT id FROM oauth.clients WHERE client_id=${actor.oauthClientId ?? null} FOR SHARE`;
+      allowed = Boolean(client);
+    }
+    const [group] = allowed ? await db`SELECT id FROM auth.groups WHERE id=${params.id}::uuid AND provider='local' FOR SHARE` : [];
+    const [grant] = group
+      ? await db`SELECT group_id FROM auth.group_manager_service_accounts
+        WHERE group_id=${params.id}::uuid AND service_account_id=${actor.serviceAccount.id}::uuid FOR SHARE`
+      : [];
+    let result: Result<void> = denied();
+    // The authorization locks define admission; time must be current after any lock wait.
+    if (grant && unexpired(actor.credentialExpiresAt) && unexpired(storedExpiration)) {
+      if ([params.userId, params.groupId, params.serviceAccountId].filter(Boolean).length !== 1) {
+        result = fail(err.badInput("Choose exactly one member"));
+      } else {
+        const changed = await localGroups[params.operation === "add" ? "addMember" : "removeMember"](
+          {
+            id: params.id,
+            user: params.userId,
+            group: params.groupId,
+            serviceAccount: params.serviceAccountId,
+          },
+          db,
+        );
+        result = changed.ok
+          ? ok()
+          : fail({ code: changed.status === 403 ? "FORBIDDEN" : "GROUP_MUTATION_FAILED", message: changed.error, status: changed.status });
+      }
+    }
+    await audit.record(
+      {
+        action,
+        target,
+        metadata,
+        requestId: params.requestId,
+        outcome: result.ok ? "allowed" : result.error.status === 403 ? "denied" : "failed",
+      },
+      db,
+    );
+    return result;
+  });
+}

package/src/services/accounts/users.ts

@@ -1,5 +1,14 @@
 import { type SQL, sql } from "bun";
-import type { BaseUser, MutationResult, PaginationResponse, Role, User, UserProfile, UserProvider } from "../../contracts/shared";
+import type {
+  BaseUser,
+  MutationResult,
+  PaginationResponse,
+  RequestActor,
+  Role,
+  User,
+  UserProfile,
+  UserProvider,
+} from "../../contracts/shared";
 import { freeipa } from "../../server/services";
 import { createAuthLoginUrl } from "../../shared/redirect";
 import { isAccountCategoryAllowed } from "../account-category-policy";
@@ -225,9 +234,10 @@ export const getMinimal = async (params: { id: string } | { uid: string }): Prom
 };
 
 /** Audience roles for a resolved access subject, including delegated users and group managers. */
-export const getRoles = async (userId: string): Promise<Role[]> => {
-  const { groupsAdmin } = await getFreeIpaConfig();
-  const [row] = await sql<DbRow[]>`SELECT u.provider, u.profile,
+export const getRoles = async (userId: string, options?: { db: typeof sql }): Promise<Role[]> => {
+  const db = options?.db ?? sql;
+  const groupsAdmin = options ? await getFreeIpaAdminGroups(db) : (await getFreeIpaConfig()).groupsAdmin;
+  const [row] = await db<DbRow[]>`SELECT u.provider, u.profile,
     CASE WHEN u.provider='local' THEN u.admin ELSE EXISTS (
       SELECT 1 FROM auth.ipa_user_effective_groups eg WHERE eg.user_id=u.id
         AND eg.group_name=ANY(${toPgTextArray(groupsAdmin)}::text[])
@@ -239,6 +249,26 @@ export const getRoles = async (userId: string): Promise<Role[]> => {
   return buildRoles({ provider, profile, memberofGroup: [], manages: stringArray(row.manages), admin: Boolean(row.effective_admin) });
 };
 
+/**
+ * Revalidate installation authority and retain it until the caller commits.
+ * Lock users before grant/membership or mandate/profile locks, matching user
+ * deletion and provider sync. Projection and settings locks also cover rows
+ * inserted or replaced while lock acquisition was waiting.
+ */
+export const hasInstallationAdminInTransaction = async (actor: RequestActor, db: typeof sql): Promise<boolean> => {
+  if (actor.kind !== "user" || actor.sessionKind === "app" || !actor.user.roles.includes("admin")) return false;
+  const [user] = await db<{ provider: UserProvider; profile: UserProfile; expired: boolean }[]>`
+    SELECT provider, profile, (account_expires IS NOT NULL AND account_expires <= statement_timestamp()) AS expired
+    FROM auth.users WHERE id=${actor.user.id}::uuid FOR SHARE`;
+  if (!user || user.expired || user.profile !== "user") return false;
+  await db`LOCK TABLE settings.entries IN SHARE MODE`;
+  if (!(await isAccountCategoryAllowed(user, db))) return false;
+  if (user.provider === "ipa") {
+    await db`LOCK TABLE auth.ipa_user_effective_groups IN SHARE MODE`;
+  }
+  return (await getRoles(actor.user.id, { db })).includes("admin");
+};
+
 export const getByUid = async (params: { uid: string }): Promise<{ id: string; roles: Role[] } | null> => {
   const { groupsAdmin } = await getFreeIpaConfig();
   const rows = await sql<DbRow[]>`
@@ -347,15 +377,15 @@ export const list = async (params: {
   };
 };
 
-/** Technical membership reads stay complete; human-facing lists exclude personal groups explicitly. */
-export const getGroups = async (params: { id: string; recursive?: boolean; includePersonal?: boolean }): Promise<string[]> => {
+/** Exported group names exclude personal groups; authorization uses the complete group ID projection. */
+export const getGroups = async (params: { id: string; recursive?: boolean }): Promise<string[]> => {
   if (params.recursive) {
     const rows = await sql<DbRow[]>`${recursiveUserGroupsSubquery({
       userId: params.id,
       select: sql`
         SELECT DISTINCT g.name FROM user_all_groups ag
         JOIN auth.groups g ON g.id = ag.group_id
-        WHERE (${params.includePersonal !== false} OR NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id))
+        WHERE NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
         ORDER BY g.name
       `,
     })}`;
@@ -364,7 +394,7 @@ export const getGroups = async (params: { id: string; recursive?: boolean; inclu
   const rows = await sql<DbRow[]>`
     SELECT g.name FROM auth.groups g
     WHERE g.id IN (SELECT group_id FROM auth.user_groups_v2 WHERE user_id = ${params.id}::uuid)
-      AND (${params.includePersonal !== false} OR NOT EXISTS (SELECT 1 FROM auth.user_posix p WHERE p.primary_group_id = g.id))
+      AND NOT EXISTS (SELECT 1 FROM auth.personal_groups p WHERE p.group_id = g.id)
     ORDER BY g.name
   `;
   return rows.map((row) => row.name as string);

package/src/services/geo/cache.ts

@@ -4,13 +4,14 @@ import type { GeoFunction } from "../../contracts/geo";
 import { requestCacheRedis } from "../request-cache-redis";
 import type { GeoRedis } from "./bucket";
 
-export const GEO_ADAPTER_VERSION = "geoapify-v2";
+export const GEO_ADAPTER_VERSION = "geoapify-v3";
 export const GEO_MAX_JSON_BYTES = 256 * 1024;
 // Raw provider geometry is compacted before entering the public result/cache budget.
 export const GEO_MAX_ROUTE_RESPONSE_BYTES = 26 * GEO_MAX_JSON_BYTES;
 const hash = (value: string) => createHash("sha256").update(value).digest("hex");
 export const normalizeGeoInput = (input: unknown, fn: GeoFunction, path = ""): unknown => {
   const field = path.split(".").at(-1);
+  if (typeof input === "string" && fn === "places" && field === "name") return input.trim();
   if (typeof input === "string" && fn === "route") return field === "polyline6" ? hash(input) : input;
   if (typeof input === "string") return field === "polyline6" ? hash(input) : input.toLowerCase().trim().replace(/\s+/g, " ");
   if (typeof input === "number") {

package/src/services/geo/geoapify.ts

@@ -86,6 +86,7 @@ const address = (p: RawProperties, provenance: GeoProvenance): GeoAddress => ({
   point: { lat: p.lat, lon: p.lon },
   formatted: p.formatted ?? p.address_line1 ?? "",
   confidence: p.rank?.confidence ?? null,
+  buildingConfidence: p.rank?.confidence_building_level ?? null,
   provenance,
 });
 const areaFilter = (area: NonNullable<GeoAutocompleteInput["area"]>) =>
@@ -247,6 +248,7 @@ export class GeoapifyAdapter {
     if (input.along && line)
       body = {
         categories,
+        ...(input.name !== undefined ? { name: input.name } : {}),
         limit: input.limit ?? 20,
         filter: {
           type: "polyline",
@@ -256,6 +258,7 @@ export class GeoapifyAdapter {
       };
     else {
       params.set("categories", categories.join(","));
+      if (input.name !== undefined) params.set("name", input.name);
       if (input.near) params.set("bias", `proximity:${input.near.lon},${input.near.lat}`);
       if (input.area) params.set("filter", areaFilter(input.area));
     }

package/src/services/identity/invocation-token.ts

@@ -485,3 +485,113 @@ export const verifyAppAccessProbe = async (
     return null;
   }
 };
+
+// A separate payload prevents app authority from ever entering the person/mandate resolver.
+const AppQueryClaimsSchema = z
+  .object({
+    iss: z.string().url(),
+    aud: z.string().regex(/^app:[a-z][a-z0-9-]{0,79}$/),
+    token_use: z.literal("app_query"),
+    sub: AppIdSchema,
+    credential_id: z.uuid(),
+    service_account_id: z.uuid(),
+    op: OperationSchema.refine((value) => value.startsWith("capability.query:")),
+    schema_hash: z.string().regex(/^[a-f0-9]{64}$/),
+    input_hash: z.string().regex(/^[a-f0-9]{64}$/),
+    request_id: BoundedIdentifierSchema,
+    jti: z.uuid(),
+    iat: z.number().int(),
+    nbf: z.number().int(),
+    exp: z.number().int(),
+  })
+  .strict()
+  .refine((claims) => claims.nbf === claims.iat && claims.exp - claims.iat === CLOUD_INVOCATION_TOKEN_TTL_SECONDS);
+
+export const signAppQueryInvocation = async (input: {
+  workload: import("./workload-auth").AuthenticatedWorkload;
+  targetAppId: string;
+  capabilityId: string;
+  schemaHash: string;
+  input: unknown;
+  requestId: string;
+  signer: PreparedIdentitySigner & { issuer: string };
+}) => {
+  const now = Math.floor(Date.now() / 1000);
+  if (input.signer.signUntil.getTime() < (now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS) * 1000)
+    throw new Error("Signing key expires before the app query");
+  const claims = AppQueryClaimsSchema.parse({
+    iss: input.signer.issuer,
+    aud: `app:${input.targetAppId}`,
+    token_use: "app_query",
+    sub: input.workload.appId,
+    credential_id: input.workload.credentialId,
+    service_account_id: input.workload.serviceAccountId,
+    op: `capability.query:${input.capabilityId}`,
+    schema_hash: input.schemaHash,
+    input_hash: appEventPayloadHash(input.input),
+    request_id: input.requestId,
+    jti: crypto.randomUUID(),
+    iat: now,
+    nbf: now,
+    exp: now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS,
+  });
+  const token = await new SignJWT(claims)
+    .setProtectedHeader({ alg: CLOUD_IDENTITY_ALGORITHM, typ: CLOUD_INVOCATION_TOKEN_TYPE, kid: input.signer.kid })
+    .sign(input.signer.key);
+  if (Buffer.byteLength(token) > IDENTITY_MAX_COMPACT_TOKEN_BYTES) throw new Error("App query token exceeds its byte budget");
+  return { token, claims };
+};
+
+export const verifyAppQueryInvocation = async (
+  token: string,
+  expected: { appId: string; capabilityId: string; schemaHash: string; input: unknown },
+  options: { issuer?: string; key?: JWTVerifyGetKey; now?: Date } = {},
+) => {
+  if (Buffer.byteLength(token) > IDENTITY_MAX_COMPACT_TOKEN_BYTES) return null;
+  try {
+    assertProtectedHeader(decodeProtectedHeader(token));
+  } catch {
+    return null;
+  }
+  // Configuration and key-fetch failures must remain retryable, rather than look like invalid tokens.
+  const runtime = options.issuer && options.key ? null : await getIdentityRuntimeConfig();
+  try {
+    const issuer = options.issuer ?? runtime!.issuer;
+    const state = options.key ? null : remoteSet(runtime!.invocationJwksUrl);
+    const key = options.key ?? state!.key;
+    const verified = await verifyWithKeyRefresh(
+      (candidate) =>
+        jwtVerify(token, candidate, {
+          algorithms: [CLOUD_IDENTITY_ALGORITHM],
+          issuer,
+          audience: `app:${expected.appId}`,
+          typ: CLOUD_INVOCATION_TOKEN_TYPE,
+          clockTolerance: INVOCATION_CLOCK_TOLERANCE_SECONDS,
+          currentDate: options.now,
+        }),
+      key,
+      state ? { url: runtime!.invocationJwksUrl, state } : null,
+    );
+    const claims = AppQueryClaimsSchema.parse(verified.payload);
+    if (
+      claims.op !== `capability.query:${expected.capabilityId}` ||
+      claims.schema_hash !== expected.schemaHash ||
+      claims.input_hash !== appEventPayloadHash(expected.input)
+    )
+      return null;
+    return claims;
+  } catch (error) {
+    if (
+      error instanceof z.ZodError ||
+      error instanceof errors.JWTExpired ||
+      error instanceof errors.JWTClaimValidationFailed ||
+      error instanceof errors.JWTInvalid ||
+      error instanceof errors.JWSInvalid ||
+      error instanceof errors.JWSSignatureVerificationFailed ||
+      error instanceof errors.JWKSNoMatchingKey ||
+      error instanceof errors.JOSENotSupported
+    )
+      return null;
+    throw error;
+  }
+};

package/src/services/mandates/index.ts

@@ -207,7 +207,7 @@ const validSubject = async (subject: MandateSubject, db: SQL): Promise<boolean>
     SELECT EXISTS (
       SELECT 1 FROM auth.service_accounts
       WHERE id = ${subject.id}::uuid
-        AND kind = 'resource_bound'
+        AND kind IN ('resource_bound', 'standalone', 'agent')
         AND status = 'active'
     ) AS active
   `;
@@ -687,7 +687,7 @@ export const validateMandateIssueAuthority = async (
         WHEN 'user' THEN user_account.id IS NOT NULL
           AND (user_account.account_expires IS NULL OR user_account.account_expires > now())
         WHEN 'service_account' THEN service_account.id IS NOT NULL
-          AND service_account.kind = 'resource_bound'
+          AND service_account.kind IN ('resource_bound', 'standalone', 'agent')
           AND service_account.status = 'active'
         ELSE false
       END AS subject_active

package/src/services/mandates/policy.ts

@@ -14,6 +14,7 @@ const operationSchema = z.union([
   z.literal("search.query"),
   z.literal("runtime.http"),
   z.literal("runtime.database"),
+  z.literal("workflow.run"),
   z.string().refine((value) => {
     const [prefix, localId, extra] = value.split(":");
     return (

package/src/services/pdf/geo-snapshot.ts

@@ -0,0 +1,107 @@
+import {
+  GEO_SNAPSHOT_MAX_BYTES,
+  GEO_SNAPSHOT_MAX_METADATA_BYTES,
+  type GeoMapSnapshotManifest,
+  GeoMapSnapshotManifestSchema,
+  geoMapSnapshotPart,
+} from "../../contracts/geo-snapshot";
+import { type PreparePdfImageOptions, preparePdfImage } from "./image";
+
+export type GeoMapSnapshotAsset = { id: string; name: string; data: Blob; type: "image/png" | "image/jpeg"; width: number; height: number };
+export type GeoMapSnapshotAssetErrorCode = "invalid" | "stale" | "missing" | "too_large" | "unreadable" | "timed_out" | "aborted";
+export class GeoMapSnapshotAssetError extends Error {
+  constructor(readonly code: GeoMapSnapshotAssetErrorCode) {
+    super(`Map snapshot upload: ${code}`);
+    this.name = "GeoMapSnapshotAssetError";
+  }
+}
+
+/**
+ * Application calls only after authorizing and reading its canonical saved revision/maps.
+ * Validates a presentation upload; it cannot attest that the client's pixels depict the saved geography.
+ * Enforce a streaming HTTP body limit BEFORE parsing FormData. Never accept resource URLs or renderer credentials.
+ */
+export async function prepareGeoMapSnapshotAssets(
+  form: FormData,
+  expected: { revision: string; maps: Pick<GeoMapSnapshotManifest["images"][number], "id" | "fingerprint">[]; maxBytes: number },
+  options: PreparePdfImageOptions = {},
+): Promise<GeoMapSnapshotAsset[]> {
+  const fail = (code: GeoMapSnapshotAssetErrorCode): never => {
+    throw new GeoMapSnapshotAssetError(code);
+  };
+  if (!Number.isSafeInteger(expected.maxBytes) || expected.maxBytes < 0) throw new RangeError("Invalid PDF asset budget");
+  const timeout = options.timeoutMs ?? 30_000;
+  if (!Number.isInteger(timeout) || timeout < 1 || timeout > 240_000) throw new RangeError("Invalid map preflight timeout");
+  const deadline = Date.now() + timeout;
+  const check = () => {
+    if (options.signal?.aborted) fail("aborted");
+    if (Date.now() >= deadline) fail("timed_out");
+  };
+  check();
+  const metadata = form.getAll("mapSnapshots");
+  if (metadata.length !== 1 || typeof metadata[0] !== "string") return fail("invalid");
+  if (new TextEncoder().encode(metadata[0]).byteLength > GEO_SNAPSHOT_MAX_METADATA_BYTES) return fail("too_large");
+  let manifest: GeoMapSnapshotManifest;
+  try {
+    manifest = GeoMapSnapshotManifestSchema.parse(JSON.parse(metadata[0]));
+  } catch {
+    return fail("invalid");
+  }
+  if (manifest.revision !== expected.revision) return fail("stale");
+  const maps = new Map(expected.maps.map((map) => [map.id, map.fingerprint]));
+  if (maps.size !== expected.maps.length) throw new Error("Expected maps must have unique IDs");
+  if (manifest.images.length !== maps.size) return fail("missing");
+  for (const image of manifest.images) {
+    if (!maps.has(image.id)) return fail("invalid");
+    if (maps.get(image.id) !== image.fingerprint) return fail("stale");
+  }
+  const names = new Set(manifest.images.map((image) => geoMapSnapshotPart(image.id)));
+  for (const name of form.keys()) if (name.startsWith("map-snapshot-") && !names.has(name)) return fail("invalid");
+  const maximum = Math.min(expected.maxBytes, GEO_SNAPSHOT_MAX_BYTES);
+  let inputBytes = 0;
+  const uploads = manifest.images.map((image) => {
+    const parts = form.getAll(geoMapSnapshotPart(image.id));
+    if (parts.length !== 1 || !(parts[0] instanceof Blob)) return fail("missing");
+    const data = parts[0];
+    if (data.type !== "image/png") return fail("invalid");
+    inputBytes += data.size;
+    if (data.size < 33 || inputBytes > maximum) return fail("too_large");
+    return { image, data };
+  });
+  // Check every PNG IHDR before starting any expensive decoder. Filenames are ignored.
+  for (const { image, data } of uploads) {
+    check();
+    const header = new Uint8Array(await data.slice(0, 33).arrayBuffer());
+    const view = new DataView(header.buffer);
+    if (
+      ![137, 80, 78, 71, 13, 10, 26, 10].every((byte, index) => header[index] === byte) ||
+      view.getUint32(8) !== 13 ||
+      view.getUint32(12) !== 0x49484452 ||
+      view.getUint32(16) !== image.width ||
+      view.getUint32(20) !== image.height
+    )
+      return fail("invalid");
+  }
+  const assets: GeoMapSnapshotAsset[] = [];
+  let outputBytes = 0;
+  for (const { image, data } of uploads) {
+    check();
+    const remaining = maximum - outputBytes;
+    if (remaining < 1) return fail("too_large");
+    const prepared = await preparePdfImage(
+      { data, boxes: [{ width: image.width, height: image.height }], maxBytes: remaining },
+      {
+        signal: options.signal,
+        timeoutMs: Math.max(1, deadline - Date.now()),
+      },
+    );
+    check();
+    if (!prepared.ok) return fail(prepared.code === "unsupported_format" ? "invalid" : prepared.code);
+    const variant = prepared.variants[0];
+    if (!variant) return fail("too_large");
+    if (variant.width !== image.width || variant.height !== image.height) return fail("invalid");
+    outputBytes += variant.data.size;
+    assets.push({ id: image.id, name: `geo-map-${assets.length}.${variant.type === "image/png" ? "png" : "jpg"}`, ...variant });
+  }
+  return assets;
+}

package/src/services/pdf/index.ts

@@ -1,3 +1,5 @@
+export type { GeoMapSnapshotAsset, GeoMapSnapshotAssetErrorCode } from "./geo-snapshot";
+export { GeoMapSnapshotAssetError, prepareGeoMapSnapshotAssets } from "./geo-snapshot";
 export type {
   AttachPdfFilesInput,
   GotenbergConfig,

package/src/services/session/index.ts

@@ -648,11 +648,20 @@ export const session = {
 
   revoke: revokeToken,
 
-  /** Signs out the web session (or an explicit bearer session). The mobile app's session is unaffected. */
-  delete: async (c: Context): Promise<void> => {
+  /** Signs out the web session (or an explicit bearer). False when an expected account no longer owns the request's credential. */
+  delete: async (c: Context, expectedUserId?: string | null): Promise<boolean> => {
+    // Capture once: another tab may replace the browser cookie while this
+    // request runs, but both the comparison and revocation concern this token.
     const token = getWebOrBearerToken(c);
+    if (token && expectedUserId !== undefined) {
+      const claims = await verifySessionToken(token);
+      if (claims && claims.sub !== expectedUserId) return false;
+    }
     if (token) await revokeToken(token, c.req.header("x-request-id"));
-    deleteCookie(c, "session_token", { path: "/" });
+    // Bound browser logout revokes the captured family without mutating the
+    // shared cookie: its response may arrive after another tab signs in.
+    if (expectedUserId === undefined) deleteCookie(c, "session_token", { path: "/" });
+    return true;
   },
 
   issueInTransaction,

package/src/shared/email-html.ts

@@ -6,6 +6,7 @@ export const EMAIL_HTML_TAGS = [
   "br",
   "code",
   "div",
+  "del",
   "em",
   "h1",
   "h2",

package/src/shared/markdown/extensions/katex.ts

@@ -8,6 +8,7 @@
 
 import katex from "katex";
 import type { MarkedExtension, Tokens } from "marked";
+import { escapeHtml } from "../shared";
 
 /**
  * Token shape produced by the math tokenizers below. The marked extension API
@@ -40,7 +41,7 @@ function renderInlineMath(latex: string): string {
   }
 }
 
-export function katexExtension(): MarkedExtension {
+export function katexExtension(literal = false): MarkedExtension {
   return {
     extensions: [
       // ```math code blocks
@@ -63,6 +64,10 @@ export function katexExtension(): MarkedExtension {
           return undefined;
         },
         renderer(token: Tokens.Generic) {
+          if (literal) {
+            const source = token.raw.slice("```math\n".length, -"\n```".length);
+            return `<pre>${escapeHtml(source)}</pre>\n`;
+          }
           const latex = (token as MathToken).latex;
           return renderBlockMath(latex);
         },
@@ -87,6 +92,7 @@ export function katexExtension(): MarkedExtension {
           return undefined;
         },
         renderer(token: Tokens.Generic) {
+          if (literal) return `<p>${escapeHtml(token.raw)}</p>\n`;
           const latex = (token as MathToken).latex;
           return renderBlockMath(latex);
         },
@@ -111,6 +117,7 @@ export function katexExtension(): MarkedExtension {
           return undefined;
         },
         renderer(token: Tokens.Generic) {
+          if (literal) return escapeHtml(token.raw);
           const latex = (token as MathToken).latex;
           return renderInlineMath(latex);
         },

package/src/shared/markdown/extensions/tables.ts

@@ -66,11 +66,24 @@ const renderCell = (alignCls: string, originalText: string, ctx: EvalContext, ht
   return `<td><span class="md-table-cell md-formula-error${alignCls}" title="${escapeHtml(tooltip)}">⚠ ${escapeHtml(originalText)}</span></td>`;
 };
 
-export function tablesExtension(): MarkedExtension {
+export function tablesExtension(plain = false): MarkedExtension {
   return {
     renderer: {
       table(token: Tokens.Table): string {
         const align = token.align ?? [];
+        // Email has no Cloud stylesheet or formula widgets. Keep alignment on the
+        // structural cells and escape formula source before Markdown can interpret it.
+        if (plain) {
+          const cellHtml = (cell: Tokens.TableCell, tag: "th" | "td", column: number): string => {
+            const alignment = align[column];
+            const attribute = alignment ? ` align="${alignment}"` : "";
+            const content = isFormula(cell.text) ? escapeHtml(cell.text) : this.parser.parseInline(cell.tokens);
+            return `<${tag}${attribute}>${content}</${tag}>`;
+          };
+          const header = token.header.map((cell, column) => cellHtml(cell, "th", column)).join("");
+          const rows = token.rows.map((row) => `<tr>${row.map((cell, column) => cellHtml(cell, "td", column)).join("")}</tr>`).join("");
+          return `<table><thead><tr>${header}</tr></thead><tbody>${rows}</tbody></table>`;
+        }
 
         // Build the EvalContext once per table — formulas reference
         // raw cell text, not other formulas' results, so a single pass