@k2b/cloud 0.45.0 → 0.46.0

package/src/services/accounts/local-groups.ts

@@ -1,4 +1,4 @@
-import { sql } from "bun";
+import { sql, type TransactionSQL } from "bun";
 import type { BaseGroup, GroupMember, MutationResult, UserProvider } from "../../contracts/shared";
 import { escapeLikePattern, isUniqueViolation } from "../postgres";
 import { buildBaseGroup, personalOwnerJoin } from "./base-group";
@@ -23,8 +23,8 @@ const toBaseGroup = (row: LocalGroupRow): BaseGroup => ({
   personalOwner: null,
 });
 
-const getLocalGroupById = async (id: string): Promise<LocalGroupRow | null> => {
-  const [row] = await sql<DbRow[]>`
+const getLocalGroupById = async (id: string, db: typeof sql | TransactionSQL = sql): Promise<LocalGroupRow | null> => {
+  const [row] = await db<DbRow[]>`
     SELECT id, provider, name, description, gid_number
     FROM auth.groups
     WHERE id = ${id}::uuid AND provider = 'local'
@@ -39,20 +39,23 @@ const getLocalGroupById = async (id: string): Promise<LocalGroupRow | null> => {
   };
 };
 
-const getUserProvider = async (userId: string): Promise<UserProvider | null> => {
-  const [row] = await sql<DbRow[]>`SELECT provider FROM auth.users WHERE id = ${userId}`;
+const getUserProvider = async (userId: string, db: typeof sql | TransactionSQL = sql): Promise<UserProvider | null> => {
+  const [row] = await db<DbRow[]>`SELECT provider FROM auth.users WHERE id = ${userId}`;
   return (row?.provider as UserProvider | undefined) ?? null;
 };
 
-const ensureLocalGroupTreeMember = async (groupId: string): Promise<boolean> => {
-  const [row] = await sql<DbRow[]>`SELECT 1 FROM auth.groups WHERE id = ${groupId} AND provider = 'local'`;
+const ensureLocalGroupTreeMember = async (groupId: string, db: typeof sql | TransactionSQL = sql): Promise<boolean> => {
+  const [row] = await db<DbRow[]>`SELECT 1 FROM auth.groups WHERE id = ${groupId} AND provider = 'local'`;
   return Boolean(row);
 };
 
-const wouldCreateLocalGroupCycle = async (params: { parentGroupId: string; childGroupId: string }): Promise<boolean> => {
+const wouldCreateLocalGroupCycle = async (
+  params: { parentGroupId: string; childGroupId: string },
+  db: typeof sql | TransactionSQL = sql,
+): Promise<boolean> => {
   if (params.parentGroupId === params.childGroupId) return true;
 
-  const [row] = await sql<DbRow[]>`
+  const [row] = await db<DbRow[]>`
     WITH RECURSIVE descendants AS (
       SELECT gg.child_group_id
       FROM auth.group_groups_v2 gg
@@ -272,7 +275,11 @@ export const getMembers = async (params: { id: string; type?: GroupMember["type"
   return members;
 };
 
-export const getManagers = async (params: { id: string; type?: "user" | "group"; recursive?: boolean }): Promise<GroupMember[]> => {
+export const getManagers = async (params: {
+  id: string;
+  type?: "user" | "group" | "service_account";
+  recursive?: boolean;
+}): Promise<GroupMember[]> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return [];
 
@@ -342,6 +349,16 @@ export const getManagers = async (params: { id: string; type?: "user" | "group";
     }
   }
 
+  if (!params.type || params.type === "service_account") {
+    const rows = await sql<{ id: string; name: string; kind: "standalone" | "agent" }[]>`
+      SELECT sa.id, sa.name, sa.kind FROM auth.group_manager_service_accounts gm
+      JOIN auth.service_accounts sa ON sa.id = gm.service_account_id
+      WHERE gm.group_id = ${group.id}::uuid AND sa.kind IN ('standalone', 'agent')
+      ORDER BY sa.name, sa.id`;
+    managers.push(
+      ...rows.map((row) => ({ type: "service_account" as const, id: row.id, displayName: row.name, serviceAccountKind: row.kind })),
+    );
+  }
   return managers;
 };
 
@@ -416,25 +433,28 @@ export const getManagedGroups = async (params: { id: string; recursive?: boolean
   return rows.map((row) => row.group_id as string);
 };
 
-export const addMember = async (params: {
-  id: string;
-  user?: string;
-  group?: string;
-  serviceAccount?: string;
-}): Promise<MutationResult<void>> => {
-  const group = await getLocalGroupById(params.id);
+export const addMember = async (
+  params: {
+    id: string;
+    user?: string;
+    group?: string;
+    serviceAccount?: string;
+  },
+  db: typeof sql | TransactionSQL = sql,
+): Promise<MutationResult<void>> => {
+  const group = await getLocalGroupById(params.id, db);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
   const [personal] = await sql`SELECT 1 FROM auth.personal_groups
     WHERE group_id = ${group.id}::uuid OR group_id = ${params.group ?? null}::uuid`;
   if (personal) return { ok: false, error: "Personal Linux groups cannot be used in group relationships", status: 409 };
 
   if (params.serviceAccount) {
-    const [account] = await sql<{ id: string }[]>`
+    const [account] = await db<{ id: string }[]>`
       SELECT id FROM auth.service_accounts
       WHERE id = ${params.serviceAccount}::uuid AND status = 'active' AND kind IN ('standalone', 'agent')
     `;
     if (!account) return { ok: false, error: "An active standalone or agent account is required", status: 400 };
-    const inserted = await sql`
+    const inserted = await db`
       INSERT INTO auth.service_account_groups (service_account_id, group_id)
       VALUES (${account.id}::uuid, ${group.id}::uuid) ON CONFLICT DO NOTHING
     `;
@@ -443,9 +463,9 @@ export const addMember = async (params: {
   }
 
   if (params.user) {
-    const provider = await getUserProvider(params.user);
+    const provider = await getUserProvider(params.user, db);
     if (!provider) return { ok: false, error: "User not found", status: 404 };
-    const [existing] = await sql<DbRow[]>`
+    const [existing] = await db<DbRow[]>`
       SELECT 1
       FROM auth.user_groups_v2
       WHERE user_id = ${params.user}::uuid
@@ -453,14 +473,14 @@ export const addMember = async (params: {
       LIMIT 1
     `;
     if (existing) return { ok: false, error: "User is already a direct member of this group", status: 409 };
-    await sql`INSERT INTO auth.user_groups_v2 (user_id, group_id) VALUES (${params.user}, ${group.id}) ON CONFLICT DO NOTHING`;
+    await db`INSERT INTO auth.user_groups_v2 (user_id, group_id) VALUES (${params.user}, ${group.id}) ON CONFLICT DO NOTHING`;
     return { ok: true, data: undefined };
   }
 
   if (params.group) {
-    const isLocal = await ensureLocalGroupTreeMember(params.group);
+    const isLocal = await ensureLocalGroupTreeMember(params.group, db);
     if (!isLocal) return { ok: false, error: "Only local groups can be nested into local groups", status: 400 };
-    const [existing] = await sql<DbRow[]>`
+    const [existing] = await db<DbRow[]>`
       SELECT 1
       FROM auth.group_groups_v2
       WHERE parent_group_id = ${group.id}::uuid
@@ -468,51 +488,69 @@ export const addMember = async (params: {
       LIMIT 1
     `;
     if (existing) return { ok: false, error: "Group is already a direct member of this group", status: 409 };
-    if (await wouldCreateLocalGroupCycle({ parentGroupId: group.id, childGroupId: params.group })) {
+    if (await wouldCreateLocalGroupCycle({ parentGroupId: group.id, childGroupId: params.group }, db)) {
       return { ok: false, error: "Local group nesting cannot create cycles", status: 400 };
     }
-    await sql`INSERT INTO auth.group_groups_v2 (parent_group_id, child_group_id) VALUES (${group.id}, ${params.group}) ON CONFLICT DO NOTHING`;
+    await db`INSERT INTO auth.group_groups_v2 (parent_group_id, child_group_id) VALUES (${group.id}, ${params.group}) ON CONFLICT DO NOTHING`;
     return { ok: true, data: undefined };
   }
 
   return { ok: false, error: "Missing member", status: 400 };
 };
 
-export const removeMember = async (params: {
-  id: string;
-  user?: string;
-  group?: string;
-  serviceAccount?: string;
-}): Promise<MutationResult<void>> => {
-  const group = await getLocalGroupById(params.id);
+export const removeMember = async (
+  params: {
+    id: string;
+    user?: string;
+    group?: string;
+    serviceAccount?: string;
+  },
+  db: typeof sql | TransactionSQL = sql,
+): Promise<MutationResult<void>> => {
+  const group = await getLocalGroupById(params.id, db);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
 
   if (params.serviceAccount) {
-    await sql`DELETE FROM auth.service_account_groups
+    await db`DELETE FROM auth.service_account_groups
       WHERE service_account_id = ${params.serviceAccount}::uuid AND group_id = ${group.id}::uuid`;
     return { ok: true, data: undefined };
   }
 
   if (params.user) {
-    await sql`DELETE FROM auth.user_groups_v2 WHERE user_id = ${params.user}::uuid AND group_id = ${group.id}::uuid`;
+    await db`DELETE FROM auth.user_groups_v2 WHERE user_id = ${params.user}::uuid AND group_id = ${group.id}::uuid`;
     return { ok: true, data: undefined };
   }
 
   if (params.group) {
-    await sql`DELETE FROM auth.group_groups_v2 WHERE parent_group_id = ${group.id}::uuid AND child_group_id = ${params.group}::uuid`;
+    await db`DELETE FROM auth.group_groups_v2 WHERE parent_group_id = ${group.id}::uuid AND child_group_id = ${params.group}::uuid`;
     return { ok: true, data: undefined };
   }
 
   return { ok: false, error: "Missing member", status: 400 };
 };
 
-export const addManager = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
+export const addManager = async (params: {
+  id: string;
+  user?: string;
+  group?: string;
+  serviceAccount?: string;
+}): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
   const [personal] = await sql`SELECT 1 FROM auth.personal_groups
     WHERE group_id = ${group.id}::uuid OR group_id = ${params.group ?? null}::uuid`;
   if (personal) return { ok: false, error: "Personal Linux groups cannot be used in group relationships", status: 409 };
 
+  if (params.serviceAccount) {
+    const [account] = await sql`SELECT id FROM auth.service_accounts
+      WHERE id = ${params.serviceAccount}::uuid AND status = 'active' AND kind IN ('standalone', 'agent')`;
+    if (!account) return { ok: false, error: "An active standalone or agent account is required", status: 400 };
+    const inserted = await sql`INSERT INTO auth.group_manager_service_accounts(group_id, service_account_id)
+      VALUES (${group.id}::uuid, ${params.serviceAccount}::uuid) ON CONFLICT DO NOTHING`;
+    if (inserted.count === 0) return { ok: false, error: "Service account already manages this group", status: 409 };
+    return { ok: true, data: undefined };
+  }
+
   if (params.user) {
     const provider = await getUserProvider(params.user);
     if (!provider) return { ok: false, error: "User not found", status: 404 };
@@ -546,10 +584,21 @@ export const addManager = async (params: { id: string; user?: string; group?: st
   return { ok: false, error: "Missing manager", status: 400 };
 };
 
-export const removeManager = async (params: { id: string; user?: string; group?: string }): Promise<MutationResult<void>> => {
+export const removeManager = async (params: {
+  id: string;
+  user?: string;
+  group?: string;
+  serviceAccount?: string;
+}): Promise<MutationResult<void>> => {
   const group = await getLocalGroupById(params.id);
   if (!group) return { ok: false, error: "Group not found", status: 404 };
 
+  if (params.serviceAccount) {
+    await sql`DELETE FROM auth.group_manager_service_accounts
+      WHERE group_id = ${group.id}::uuid AND service_account_id = ${params.serviceAccount}::uuid`;
+    return { ok: true, data: undefined };
+  }
+
   if (params.user) {
     await sql`DELETE FROM auth.group_manager_users_v2 WHERE group_id = ${group.id}::uuid AND user_id = ${params.user}::uuid`;
     return { ok: true, data: undefined };

package/src/services/accounts/machine-group-management.ts

@@ -0,0 +1,94 @@
+import { sql } from "bun";
+import type { ServiceAccountRequestActor } from "../../server/middleware/auth";
+import { err, fail, ok, type Result } from "../../server/services";
+import { audit } from "../audit";
+import * as localGroups from "./local-groups";
+
+/** Runs the existing local membership operation while its direct management grant is locked. */
+export async function mutateMachineGroupMember(params: {
+  actor: ServiceAccountRequestActor;
+  id: string;
+  userId?: string;
+  groupId?: string;
+  serviceAccountId?: string;
+  operation: "add" | "remove";
+  requestId?: string;
+}): Promise<Result<void>> {
+  const { actor } = params;
+  const action = `accounts.group.member.${params.operation}`;
+  const target = { type: "group", id: params.id };
+  const metadata = {
+    actorServiceAccountId: actor.serviceAccount.id,
+    credentialId: actor.credentialId ?? null,
+    oauthClientId: actor.oauthClientId ?? null,
+    userId: params.userId ?? null,
+    groupId: params.groupId ?? null,
+    serviceAccountId: params.serviceAccountId ?? null,
+  };
+  const unexpired = (expiration: string | Date | null | undefined) =>
+    expiration == null || (typeof expiration === "string" ? Date.parse(expiration) : expiration.getTime()) > Date.now();
+  const denied = () => fail(err.forbidden("A current management grant for this group and write scope are required"));
+  if (
+    actor.delegatedUser ||
+    !["standalone", "agent"].includes(actor.serviceAccount.kind) ||
+    !actor.scopes.some((scope) => scope === "write" || scope === "admin") ||
+    !unexpired(actor.credentialExpiresAt) ||
+    (!actor.credentialId && (!actor.oauthClientId || !actor.credentialExpiresAt))
+  )
+    return audit.recordResult({ action, target, metadata, requestId: params.requestId, result: denied() });
+
+  return sql.begin(async (db) => {
+    // Account -> credential -> group -> grant matches the group deletion cascade.
+    const [account] = await db`SELECT id FROM auth.service_accounts
+      WHERE id = ${actor.serviceAccount.id}::uuid AND status = 'active' AND kind IN ('standalone','agent') FOR SHARE`;
+    let allowed = Boolean(account);
+    let storedExpiration: Date | null = null;
+    if (allowed && actor.credentialId) {
+      const [credential] = await db<{ expires_at: Date | null }[]>`SELECT expires_at FROM auth.service_account_credentials
+        WHERE id = ${actor.credentialId}::uuid AND service_account_id = ${actor.serviceAccount.id}::uuid
+          AND status = 'active' AND (expires_at IS NULL OR expires_at > clock_timestamp())
+          AND scopes && ARRAY['write','admin']::text[] FOR SHARE`;
+      allowed = Boolean(credential);
+      storedExpiration = credential?.expires_at ?? null;
+    } else if (allowed) {
+      const [client] = await db`SELECT id FROM oauth.clients WHERE client_id=${actor.oauthClientId ?? null} FOR SHARE`;
+      allowed = Boolean(client);
+    }
+    const [group] = allowed ? await db`SELECT id FROM auth.groups WHERE id=${params.id}::uuid AND provider='local' FOR SHARE` : [];
+    const [grant] = group
+      ? await db`SELECT group_id FROM auth.group_manager_service_accounts
+        WHERE group_id=${params.id}::uuid AND service_account_id=${actor.serviceAccount.id}::uuid FOR SHARE`
+      : [];
+    let result: Result<void> = denied();
+    // The authorization locks define admission; time must be current after any lock wait.
+    if (grant && unexpired(actor.credentialExpiresAt) && unexpired(storedExpiration)) {
+      if ([params.userId, params.groupId, params.serviceAccountId].filter(Boolean).length !== 1) {
+        result = fail(err.badInput("Choose exactly one member"));
+      } else {
+        const changed = await localGroups[params.operation === "add" ? "addMember" : "removeMember"](
+          {
+            id: params.id,
+            user: params.userId,
+            group: params.groupId,
+            serviceAccount: params.serviceAccountId,
+          },
+          db,
+        );
+        result = changed.ok
+          ? ok()
+          : fail({ code: changed.status === 403 ? "FORBIDDEN" : "GROUP_MUTATION_FAILED", message: changed.error, status: changed.status });
+      }
+    }
+    await audit.record(
+      {
+        action,
+        target,
+        metadata,
+        requestId: params.requestId,
+        outcome: result.ok ? "allowed" : result.error.status === 403 ? "denied" : "failed",
+      },
+      db,
+    );
+    return result;
+  });
+}

package/src/services/geo/cache.ts

@@ -4,13 +4,14 @@ import type { GeoFunction } from "../../contracts/geo";
 import { requestCacheRedis } from "../request-cache-redis";
 import type { GeoRedis } from "./bucket";
 
-export const GEO_ADAPTER_VERSION = "geoapify-v2";
+export const GEO_ADAPTER_VERSION = "geoapify-v3";
 export const GEO_MAX_JSON_BYTES = 256 * 1024;
 // Raw provider geometry is compacted before entering the public result/cache budget.
 export const GEO_MAX_ROUTE_RESPONSE_BYTES = 26 * GEO_MAX_JSON_BYTES;
 const hash = (value: string) => createHash("sha256").update(value).digest("hex");
 export const normalizeGeoInput = (input: unknown, fn: GeoFunction, path = ""): unknown => {
   const field = path.split(".").at(-1);
+  if (typeof input === "string" && fn === "places" && field === "name") return input.trim();
   if (typeof input === "string" && fn === "route") return field === "polyline6" ? hash(input) : input;
   if (typeof input === "string") return field === "polyline6" ? hash(input) : input.toLowerCase().trim().replace(/\s+/g, " ");
   if (typeof input === "number") {

package/src/services/geo/geoapify.ts

@@ -86,6 +86,7 @@ const address = (p: RawProperties, provenance: GeoProvenance): GeoAddress => ({
   point: { lat: p.lat, lon: p.lon },
   formatted: p.formatted ?? p.address_line1 ?? "",
   confidence: p.rank?.confidence ?? null,
+  buildingConfidence: p.rank?.confidence_building_level ?? null,
   provenance,
 });
 const areaFilter = (area: NonNullable<GeoAutocompleteInput["area"]>) =>
@@ -247,6 +248,7 @@ export class GeoapifyAdapter {
     if (input.along && line)
       body = {
         categories,
+        ...(input.name !== undefined ? { name: input.name } : {}),
         limit: input.limit ?? 20,
         filter: {
           type: "polyline",
@@ -256,6 +258,7 @@ export class GeoapifyAdapter {
       };
     else {
       params.set("categories", categories.join(","));
+      if (input.name !== undefined) params.set("name", input.name);
       if (input.near) params.set("bias", `proximity:${input.near.lon},${input.near.lat}`);
       if (input.area) params.set("filter", areaFilter(input.area));
     }

package/src/services/identity/invocation-token.ts

@@ -485,3 +485,113 @@ export const verifyAppAccessProbe = async (
     return null;
   }
 };
+
+// A separate payload prevents app authority from ever entering the person/mandate resolver.
+const AppQueryClaimsSchema = z
+  .object({
+    iss: z.string().url(),
+    aud: z.string().regex(/^app:[a-z][a-z0-9-]{0,79}$/),
+    token_use: z.literal("app_query"),
+    sub: AppIdSchema,
+    credential_id: z.uuid(),
+    service_account_id: z.uuid(),
+    op: OperationSchema.refine((value) => value.startsWith("capability.query:")),
+    schema_hash: z.string().regex(/^[a-f0-9]{64}$/),
+    input_hash: z.string().regex(/^[a-f0-9]{64}$/),
+    request_id: BoundedIdentifierSchema,
+    jti: z.uuid(),
+    iat: z.number().int(),
+    nbf: z.number().int(),
+    exp: z.number().int(),
+  })
+  .strict()
+  .refine((claims) => claims.nbf === claims.iat && claims.exp - claims.iat === CLOUD_INVOCATION_TOKEN_TTL_SECONDS);
+
+export const signAppQueryInvocation = async (input: {
+  workload: import("./workload-auth").AuthenticatedWorkload;
+  targetAppId: string;
+  capabilityId: string;
+  schemaHash: string;
+  input: unknown;
+  requestId: string;
+  signer: PreparedIdentitySigner & { issuer: string };
+}) => {
+  const now = Math.floor(Date.now() / 1000);
+  if (input.signer.signUntil.getTime() < (now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS) * 1000)
+    throw new Error("Signing key expires before the app query");
+  const claims = AppQueryClaimsSchema.parse({
+    iss: input.signer.issuer,
+    aud: `app:${input.targetAppId}`,
+    token_use: "app_query",
+    sub: input.workload.appId,
+    credential_id: input.workload.credentialId,
+    service_account_id: input.workload.serviceAccountId,
+    op: `capability.query:${input.capabilityId}`,
+    schema_hash: input.schemaHash,
+    input_hash: appEventPayloadHash(input.input),
+    request_id: input.requestId,
+    jti: crypto.randomUUID(),
+    iat: now,
+    nbf: now,
+    exp: now + CLOUD_INVOCATION_TOKEN_TTL_SECONDS,
+  });
+  const token = await new SignJWT(claims)
+    .setProtectedHeader({ alg: CLOUD_IDENTITY_ALGORITHM, typ: CLOUD_INVOCATION_TOKEN_TYPE, kid: input.signer.kid })
+    .sign(input.signer.key);
+  if (Buffer.byteLength(token) > IDENTITY_MAX_COMPACT_TOKEN_BYTES) throw new Error("App query token exceeds its byte budget");
+  return { token, claims };
+};
+
+export const verifyAppQueryInvocation = async (
+  token: string,
+  expected: { appId: string; capabilityId: string; schemaHash: string; input: unknown },
+  options: { issuer?: string; key?: JWTVerifyGetKey; now?: Date } = {},
+) => {
+  if (Buffer.byteLength(token) > IDENTITY_MAX_COMPACT_TOKEN_BYTES) return null;
+  try {
+    assertProtectedHeader(decodeProtectedHeader(token));
+  } catch {
+    return null;
+  }
+  // Configuration and key-fetch failures must remain retryable, rather than look like invalid tokens.
+  const runtime = options.issuer && options.key ? null : await getIdentityRuntimeConfig();
+  try {
+    const issuer = options.issuer ?? runtime!.issuer;
+    const state = options.key ? null : remoteSet(runtime!.invocationJwksUrl);
+    const key = options.key ?? state!.key;
+    const verified = await verifyWithKeyRefresh(
+      (candidate) =>
+        jwtVerify(token, candidate, {
+          algorithms: [CLOUD_IDENTITY_ALGORITHM],
+          issuer,
+          audience: `app:${expected.appId}`,
+          typ: CLOUD_INVOCATION_TOKEN_TYPE,
+          clockTolerance: INVOCATION_CLOCK_TOLERANCE_SECONDS,
+          currentDate: options.now,
+        }),
+      key,
+      state ? { url: runtime!.invocationJwksUrl, state } : null,
+    );
+    const claims = AppQueryClaimsSchema.parse(verified.payload);
+    if (
+      claims.op !== `capability.query:${expected.capabilityId}` ||
+      claims.schema_hash !== expected.schemaHash ||
+      claims.input_hash !== appEventPayloadHash(expected.input)
+    )
+      return null;
+    return claims;
+  } catch (error) {
+    if (
+      error instanceof z.ZodError ||
+      error instanceof errors.JWTExpired ||
+      error instanceof errors.JWTClaimValidationFailed ||
+      error instanceof errors.JWTInvalid ||
+      error instanceof errors.JWSInvalid ||
+      error instanceof errors.JWSSignatureVerificationFailed ||
+      error instanceof errors.JWKSNoMatchingKey ||
+      error instanceof errors.JOSENotSupported
+    )
+      return null;
+    throw error;
+  }
+};

package/src/services/pdf/geo-snapshot.ts

@@ -0,0 +1,107 @@
+import {
+  GEO_SNAPSHOT_MAX_BYTES,
+  GEO_SNAPSHOT_MAX_METADATA_BYTES,
+  type GeoMapSnapshotManifest,
+  GeoMapSnapshotManifestSchema,
+  geoMapSnapshotPart,
+} from "../../contracts/geo-snapshot";
+import { type PreparePdfImageOptions, preparePdfImage } from "./image";
+
+export type GeoMapSnapshotAsset = { id: string; name: string; data: Blob; type: "image/png" | "image/jpeg"; width: number; height: number };
+export type GeoMapSnapshotAssetErrorCode = "invalid" | "stale" | "missing" | "too_large" | "unreadable" | "timed_out" | "aborted";
+export class GeoMapSnapshotAssetError extends Error {
+  constructor(readonly code: GeoMapSnapshotAssetErrorCode) {
+    super(`Map snapshot upload: ${code}`);
+    this.name = "GeoMapSnapshotAssetError";
+  }
+}
+
+/**
+ * Application calls only after authorizing and reading its canonical saved revision/maps.
+ * Validates a presentation upload; it cannot attest that the client's pixels depict the saved geography.
+ * Enforce a streaming HTTP body limit BEFORE parsing FormData. Never accept resource URLs or renderer credentials.
+ */
+export async function prepareGeoMapSnapshotAssets(
+  form: FormData,
+  expected: { revision: string; maps: Pick<GeoMapSnapshotManifest["images"][number], "id" | "fingerprint">[]; maxBytes: number },
+  options: PreparePdfImageOptions = {},
+): Promise<GeoMapSnapshotAsset[]> {
+  const fail = (code: GeoMapSnapshotAssetErrorCode): never => {
+    throw new GeoMapSnapshotAssetError(code);
+  };
+  if (!Number.isSafeInteger(expected.maxBytes) || expected.maxBytes < 0) throw new RangeError("Invalid PDF asset budget");
+  const timeout = options.timeoutMs ?? 30_000;
+  if (!Number.isInteger(timeout) || timeout < 1 || timeout > 240_000) throw new RangeError("Invalid map preflight timeout");
+  const deadline = Date.now() + timeout;
+  const check = () => {
+    if (options.signal?.aborted) fail("aborted");
+    if (Date.now() >= deadline) fail("timed_out");
+  };
+  check();
+  const metadata = form.getAll("mapSnapshots");
+  if (metadata.length !== 1 || typeof metadata[0] !== "string") return fail("invalid");
+  if (new TextEncoder().encode(metadata[0]).byteLength > GEO_SNAPSHOT_MAX_METADATA_BYTES) return fail("too_large");
+  let manifest: GeoMapSnapshotManifest;
+  try {
+    manifest = GeoMapSnapshotManifestSchema.parse(JSON.parse(metadata[0]));
+  } catch {
+    return fail("invalid");
+  }
+  if (manifest.revision !== expected.revision) return fail("stale");
+  const maps = new Map(expected.maps.map((map) => [map.id, map.fingerprint]));
+  if (maps.size !== expected.maps.length) throw new Error("Expected maps must have unique IDs");
+  if (manifest.images.length !== maps.size) return fail("missing");
+  for (const image of manifest.images) {
+    if (!maps.has(image.id)) return fail("invalid");
+    if (maps.get(image.id) !== image.fingerprint) return fail("stale");
+  }
+  const names = new Set(manifest.images.map((image) => geoMapSnapshotPart(image.id)));
+  for (const name of form.keys()) if (name.startsWith("map-snapshot-") && !names.has(name)) return fail("invalid");
+  const maximum = Math.min(expected.maxBytes, GEO_SNAPSHOT_MAX_BYTES);
+  let inputBytes = 0;
+  const uploads = manifest.images.map((image) => {
+    const parts = form.getAll(geoMapSnapshotPart(image.id));
+    if (parts.length !== 1 || !(parts[0] instanceof Blob)) return fail("missing");
+    const data = parts[0];
+    if (data.type !== "image/png") return fail("invalid");
+    inputBytes += data.size;
+    if (data.size < 33 || inputBytes > maximum) return fail("too_large");
+    return { image, data };
+  });
+  // Check every PNG IHDR before starting any expensive decoder. Filenames are ignored.
+  for (const { image, data } of uploads) {
+    check();
+    const header = new Uint8Array(await data.slice(0, 33).arrayBuffer());
+    const view = new DataView(header.buffer);
+    if (
+      ![137, 80, 78, 71, 13, 10, 26, 10].every((byte, index) => header[index] === byte) ||
+      view.getUint32(8) !== 13 ||
+      view.getUint32(12) !== 0x49484452 ||
+      view.getUint32(16) !== image.width ||
+      view.getUint32(20) !== image.height
+    )
+      return fail("invalid");
+  }
+  const assets: GeoMapSnapshotAsset[] = [];
+  let outputBytes = 0;
+  for (const { image, data } of uploads) {
+    check();
+    const remaining = maximum - outputBytes;
+    if (remaining < 1) return fail("too_large");
+    const prepared = await preparePdfImage(
+      { data, boxes: [{ width: image.width, height: image.height }], maxBytes: remaining },
+      {
+        signal: options.signal,
+        timeoutMs: Math.max(1, deadline - Date.now()),
+      },
+    );
+    check();
+    if (!prepared.ok) return fail(prepared.code === "unsupported_format" ? "invalid" : prepared.code);
+    const variant = prepared.variants[0];
+    if (!variant) return fail("too_large");
+    if (variant.width !== image.width || variant.height !== image.height) return fail("invalid");
+    outputBytes += variant.data.size;
+    assets.push({ id: image.id, name: `geo-map-${assets.length}.${variant.type === "image/png" ? "png" : "jpg"}`, ...variant });
+  }
+  return assets;
+}

package/src/services/pdf/index.ts

@@ -1,3 +1,5 @@
+export type { GeoMapSnapshotAsset, GeoMapSnapshotAssetErrorCode } from "./geo-snapshot";
+export { GeoMapSnapshotAssetError, prepareGeoMapSnapshotAssets } from "./geo-snapshot";
 export type {
   AttachPdfFilesInput,
   GotenbergConfig,

package/src/ssr/AdminArea.tsx

@@ -84,7 +84,7 @@ export const AdminAreaSaveStatusHead = () => (
   </div>
 );
 export const AdminAreaSaveStatusFoot = () => (
-  <div class="sticky bottom-0 flex justify-end bg-(--k2b-surface) px-4 py-3 md:hidden">
+  <div class="sticky bottom-0 flex justify-end bg-(--k2b-surface) px-2 py-3 md:hidden">
     <SettingsSaveStatus />
   </div>
 );
@@ -124,7 +124,7 @@ export function AdminAreaPane(props: {
       minSize={props.minSize}
       defaultSize={props.minSize}
     >
-      <div class="app-rows px-[var(--ui-space-shell)] pb-[var(--ui-space-shell)]">{props.children}</div>
+      <div class="app-rows pb-[var(--ui-space-shell)]">{props.children}</div>
       {props.saveStatus ? <AdminAreaSaveStatusFoot /> : null}
     </AppWorkspace.MainPane>
   );

package/src/ssr/AdminLayout.tsx

@@ -47,7 +47,7 @@ export default function AdminLayout(props: Props) {
   const breadcrumbs: Breadcrumb[] = [{ title: t.start, href: "/" }, { title: overview ? t.admin : title }];
   return (
     <Layout c={c} fullWidth fullPage title={breadcrumbs}>
-      <AppWorkspace mobileSurface="flush" class="min-h-0 flex-1" resizable={false}>
+      <AppWorkspace mobileSurface="flush" class="min-h-0 flex-1">
         <AdminSidebar currentPath={currentPath} apps={runtime.apps} />
         <AppWorkspace.Content>
           {props.ownMain ? (

package/src/ssr/AdminSidebar.tsx

@@ -52,7 +52,7 @@ export default function AdminSidebar({ currentPath, apps }: { currentPath: strin
           })),
         }))}
       />
-      <AppWorkspace.Sidebar resizable={false}>
+      <AppWorkspace.Sidebar>
         <AppWorkspace.SidebarDesktop>
           <AppWorkspace.SidebarBody scrollPreserveKey="admin-sidebar">
             <AdminNavigation currentPath={currentPath} groups={groups()} />

package/src/styles/global.css

@@ -869,3 +869,5 @@ solid-island {
 }
 .cloud-mobile-profile { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: .5rem; border-top: 1px solid var(--ui-border); padding-top: 1rem; }
 .cloud-mobile-profile > :is(a, button) { min-height: 2.75rem; white-space: normal; text-align: start; justify-content: flex-start; }
+
+@import "../ai/chat/map-widget.css";