@k2b/cloud 0.45.0 → 0.46.0

package/src/ai/migrate.ts

@@ -2,6 +2,7 @@ import { sql } from "bun";
 import { CapabilityActionReviewDataSchema } from "../contracts/capabilities";
 import { APPROVAL_MAX_WAIT_MS, approvalAssurance, approvalScopeFromToolName, approvals, migrateApprovals } from "../services/approvals";
 import { migrateChatTaskReasons } from "./chat-task-reasons-migrate";
+import { migrateAiMaps } from "./map-store";
 import { migrateAiMessageQueue } from "./message-queue";
 import { migrateAiModelAccess } from "./model-access-migrate";
 import { migrateAiQuotas } from "./quotas-migrate";
@@ -81,6 +82,8 @@ export const migrateCloudAi = async (): Promise<void> => {
     END $$
   `.simple();
 
+  await migrateAiMaps();
+
   await sql`ALTER TABLE ai.conversations ADD COLUMN IF NOT EXISTS short_id TEXT`.simple();
   await sql`CREATE UNIQUE INDEX IF NOT EXISTS idx_ai_conversations_short_id ON ai.conversations(short_id)`.simple();
   await backfillAiShortIds(

package/src/ai/protocol.ts

@@ -258,6 +258,7 @@ export const buildBlocksFromMessages = (
       toolPresentations?: Record<string, AiToolPresentation>;
       toolReviews?: Record<string, AiStoredActionReview>;
       toolChecks?: Record<string, AiActionCheck>;
+      toolInterimResults?: Record<string, unknown>;
       toolOutcomes?: Record<string, "rejected" | "approved" | "expired">;
       websiteReceipts?: Record<string, Record<string, { method: string; url: string }>>;
     } | null;
@@ -287,6 +288,7 @@ export const buildBlocksFromMessages = (
             presentation: meta?.toolPresentations?.[block.id],
             review: meta?.toolReviews?.[block.id],
             check: meta?.toolChecks?.[block.id],
+            result: meta?.toolInterimResults?.[block.id],
             // A turn that ended before an approved call returned records the approval on the call's message, and an
             // approval it left waiting as expired.
             ...(outcome === "approved" || outcome === "expired" ? { approved: outcome === "approved" } : {}),
@@ -311,7 +313,7 @@ export const buildBlocksFromMessages = (
         blocks[at!] = {
           ...existing,
           status: outcome === "rejected" ? "rejected" : message.isError ? "failed" : "completed",
-          result: message.result,
+          result: message.isError && existing.result !== undefined ? existing.result : message.result,
           isError: message.isError,
           ...(createdAt ? { at: createdAt } : {}),
           ...(outcome === "approved" ? { approved: true } : {}),

package/src/ai/routes.ts

@@ -66,6 +66,7 @@ import {
 } from "./http";
 import { AI_LOCAL_TOOL_NAMES, AiLocalClientSchema } from "./local-tool-contracts";
 import { aiMaintenanceJobs } from "./maintenance";
+import { aiMapRoutes } from "./map-routes";
 import { AI_MEMORY_CONTENT_MAX_CHARS, aiMemories } from "./memories";
 import { aiMemoryLearningRuns } from "./memory-learning-runs";
 import { createCloudAiMemoryTool } from "./memory-tool";
@@ -338,6 +339,7 @@ export const aiRoutes = (() => {
       .use("*", noTransform())
       .use(rateLimit())
       .use("*", auth.requireRole("authenticated"))
+      .route("/conversations", aiMapRoutes)
       .get("/status", async (c) => {
         const [status, enabled] = await Promise.all([
           assistantAiSettingsState(c.get("accessSubject")),

package/src/ai/store.ts

@@ -7,12 +7,14 @@ import { type CapabilityActionReviewPresentation, CapabilityActionReviewPresenta
 import { logger } from "../services/logging";
 import { toPgTextArray } from "../services/postgres";
 import { AI_TOOL_CHECK_STALE_MS, type AiActionCheck, type AiStoredActionReview } from "./action-review";
+import { AiMapSchema } from "./map-contracts";
 
 export { AI_TOOL_CHECK_STALE_MS };
 
 import { AI_WEBSITE_APPROVAL_TOOL } from "./approvals";
 import { projectSettledAiToolChecks } from "./capability-result";
 import { aiTurnErrorText } from "./chat/turn-error";
+import { projectAiMaps } from "./map-store";
 import { AI_MEMORY_LEARNING_DEFAULT_ENABLED } from "./prefs";
 import type { AiTurnBlock } from "./protocol";
 import { collectRecentSentResourceRefs, RECENT_SENT_CONVERSATION_SCAN_LIMIT, RECENT_SENT_MESSAGE_SCAN_LIMIT } from "./recent-sent-refs";
@@ -1515,6 +1517,17 @@ export const aiConversations: AiConversationService = {
         SELECT ${target.id}::uuid, path, bytes, media_type, size, origin, dictation_recorded_at, updated_at, version
         FROM ai.files WHERE conversation_id = ${input.sourceConversationId}::uuid
       `;
+      // A fork owns independent snapshots. Rewrite only copied map references, never the source conversation.
+      const mapRows = await tx<
+        { id: string; snapshot: unknown; retry: unknown }[]
+      >`SELECT id,snapshot,retry FROM ai.maps WHERE conversation_id=${input.sourceConversationId}::uuid AND (id IN (SELECT (message->'result'->'map'->>'id')::uuid FROM ai.messages WHERE conversation_id=${target.id}::uuid AND role='tool_result' AND message->>'name'='map') OR snapshot->>'originCallId' IN (SELECT block->>'id' FROM ai.messages CROSS JOIN LATERAL jsonb_array_elements(message->'content') block WHERE conversation_id=${target.id}::uuid AND role='assistant' AND block->>'type'='tool_call' AND block->>'name'='map'))`;
+      for (const saved of mapRows) {
+        const id = crypto.randomUUID();
+        const snapshot = AiMapSchema.parse(typeof saved.snapshot === "string" ? JSON.parse(saved.snapshot) : saved.snapshot);
+        const next = { ...snapshot, id, conversationId: target.short_id };
+        await tx`INSERT INTO ai.maps(id,conversation_id,revision,snapshot,retry) VALUES(${id}::uuid,${target.id}::uuid,${snapshot.revision},${JSON.stringify(next)}::text::jsonb,${saved.retry ? JSON.stringify(saved.retry) : null}::text::jsonb)`;
+        await tx`UPDATE ai.messages SET message=jsonb_set(message,'{result,map}',${JSON.stringify({ ...next })}::text::jsonb) WHERE conversation_id=${target.id}::uuid AND role='tool_result' AND message->>'name'='map' AND message->'result'->'map'->>'id'=${saved.id}`;
+      }
       return rowToConversation(target);
     });
   },
@@ -2569,7 +2582,7 @@ export const aiConversations: AiConversationService = {
         AND NOT (kind = 'summary' AND compacted_at IS NOT NULL)
       ORDER BY seq ASC, (kind = 'summary')::int ASC
     `;
-    return rows.map(rowToMessage);
+    return projectAiMaps(rows.map(rowToMessage));
   },
 
   listMessagesPage: async (input) => {
@@ -2598,7 +2611,7 @@ export const aiConversations: AiConversationService = {
         AND NOT (kind = 'summary' AND compacted_at IS NOT NULL)
       ORDER BY seq ASC, (kind = 'summary')::int ASC
     `;
-    const messages = rows.map(rowToMessage);
+    const messages = await projectAiMaps(rows.map(rowToMessage));
     const oldestSeq = messages[0]?.seq;
     if (oldestSeq === undefined) return { messages, hasMore: false };
     const older = await sql<{ exists: boolean }[]>`
@@ -2639,7 +2652,7 @@ export const aiConversations: AiConversationService = {
     `;
     const page = rows.filter((row) => Number(row.page_rank) <= limit);
     return {
-      messages: page.map(rowToMessage),
+      messages: await projectAiMaps(page.map(rowToMessage)),
       ...(rows.some((row) => Number(row.page_rank) > limit) && page.at(-1) ? { nextCursor: String(page.at(-1)!.seq) } : {}),
     };
   },
@@ -2758,7 +2771,7 @@ export const aiConversations: AiConversationService = {
         AND compacted_at IS NULL
       ORDER BY seq ASC
     `;
-    return rows.map(rowToMessage);
+    return projectAiMaps(rows.map(rowToMessage));
   },
 
   listTurnMessages: async (input) => {
@@ -2773,7 +2786,7 @@ export const aiConversations: AiConversationService = {
         AND (${input.includeCompacted ?? false} OR compacted_at IS NULL)
       ORDER BY seq ASC
     `;
-    return rows.map(rowToMessage);
+    return projectAiMaps(rows.map(rowToMessage));
   },
 
   setMessageFeedback: async (input) => {
@@ -3968,7 +3981,7 @@ export const aiConversations: AiConversationService = {
           ).map(rowToMessage)
         : await aiConversations.listContextMessages({ conversationId: input.conversationId });
       return projectSettledAiToolChecks(
-        rows.map((row) => ({
+        (await projectAiMaps(rows, true)).map((row) => ({
           seq: row.seq,
           kind: row.kind,
           meta: row.meta,

package/src/ai/tools.ts

@@ -4,6 +4,7 @@ import type { z } from "zod";
 import type { CapabilityActionCallReview } from "../contracts/capabilities";
 import type { RequestActor } from "../server";
 import { aiToolNeedsApproval } from "./approvals";
+import { resolveAiToolResultMaxChars } from "./tool-result-budget";
 import type {
   AiApprovalTarget,
   AiDataBoundary,
@@ -64,6 +65,8 @@ export const defineAiTool = <TInput extends z.ZodType, TOutput extends z.ZodType
           timeZone?: string;
           /** Localized short status; never include payloads or secrets. */
           reportProgress?: (message: string) => Promise<void>;
+          /** A validated result snapshot while a server tool is still running. */
+          reportResult?: (result: z.infer<TOutput>) => Promise<void>;
           /** Asks like `requestApproval`, and lets the person remember the approval of `target`. */
           requestApprovalFor?: (message: string, target: AiApprovalTarget, review?: CapabilityActionCallReview) => Promise<boolean>;
           /** Relays a decision for an effect another platform component consumes and executes. */
@@ -117,6 +120,8 @@ export type AiToolPreparationContext = {
   locale?: string;
   timeZone?: string;
   reportToolProgress?: (callId: string, message: string) => Promise<void>;
+  reportToolResult?: (callId: string, result: unknown) => Promise<void>;
+  maxToolResultChars?: number;
   /** Uses the approved snapshot immediately before the tool executes its effect. */
   consumeApproval?: (approvalCallId: string, input: unknown) => Promise<AiApprovalUse>;
   /** Links a relayed decision to the record the effect owner will consume. */
@@ -241,6 +246,15 @@ export const prepareAiTools = (input: AiToolPreparationContext & { tools?: AiRun
           locale: input.locale,
           timeZone: input.timeZone,
           reportProgress: callId && report ? (message) => report(callId, message) : undefined,
+          reportResult:
+            callId && input.reportToolResult
+              ? async (result) => {
+                  const validated = tool.def.outputSchema.parse(result);
+                  const maximum = input.maxToolResultChars ?? resolveAiToolResultMaxChars({ configuredMaxChars: Number.MAX_SAFE_INTEGER });
+                  if (JSON.stringify(validated).length > maximum) throw new Error("AI_TOOL_INTERIM_RESULT_TOO_LARGE");
+                  await input.reportToolResult!(callId, validated);
+                }
+              : undefined,
           reportWebsiteReceipts:
             callId && input.reportWebsiteReceipts ? (receipts) => input.reportWebsiteReceipts!(callId, receipts) : undefined,
         });

package/src/ai/types.ts

@@ -313,6 +313,7 @@ export type AiStoredMessage = {
     toolPresentations?: Record<string, AiToolPresentation>;
     toolReviews?: Record<string, AiStoredActionReview>;
     toolChecks?: Record<string, AiActionCheck>;
+    toolInterimResults?: Record<string, unknown>;
     /** How the person decided an approval; `expired` when the turn ended while it still waited. */
     toolOutcomes?: Record<string, "rejected" | "approved" | "expired">;
     /** Requests a website approval let through, by tool call and then by `AiWebsiteReceipt.index`. */
@@ -1159,6 +1160,8 @@ export type AiToolRuntime<TInput extends z.ZodType = z.ZodType, TOutput extends
           timeZone?: string;
           /** Localized short status; never include payloads or secrets. */
           reportProgress?: (message: string) => Promise<void>;
+          /** A validated result snapshot while a server tool is still running. */
+          reportResult?: (result: z.infer<TOutput>) => Promise<void>;
           /** Asks like `requestApproval`, and lets the person remember the approval of `target`. */
           requestApprovalFor?: (message: string, target: AiApprovalTarget, review?: CapabilityActionCallReview) => Promise<boolean>;
           /** Relays a decision for an effect another platform component consumes and executes. */

package/src/api/capabilities.ts

@@ -3,14 +3,14 @@ import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { type CatalogSubscription, projectAppEventCatalog, readCatalogSubscriptions } from "../_internal/app-event-catalog";
 import { readBoundedJson } from "../_internal/bounded-json";
-import { resolveCapabilityManifestPresentation } from "../_internal/capabilities";
+import { isPersonVisibleCapabilityQuery, resolveCapabilityManifestPresentation } from "../_internal/capabilities";
 import {
   capabilityActionReceiptIssues,
   capabilityActionReviewIssues,
   capabilityQueryChecksActionOutcome,
 } from "../_internal/capability-reviews";
 import { capabilityTimeoutMs, createCapabilityDeadline, withCapabilityRequestTimeout } from "../_internal/capability-timeout";
-import { getCapability, listApps } from "../_internal/registry";
+import { getApp, getCapability, listApps } from "../_internal/registry";
 import { resolveCommandLink } from "../capabilities/command-link";
 import {
   type CapabilityClaimScope,
@@ -59,12 +59,13 @@ import { AppAccessDeniedError, appAccessDeniedBody } from "../server/middleware/
 import { oauthScopeByOperation } from "../server/middleware/auth";
 import { noTransform } from "../server/middleware/no-transform";
 import { hasOAuthScope } from "../server/oauth-scope";
+import { ratelimit } from "../server/ratelimit";
 import { appAccessAuthority, canUseApp } from "../services/app-access";
 import { discoverableApps } from "../services/app-discovery";
 import { authorityFromParentInvocation, invocationAuthorityFromRequest } from "../services/identity/invocation-authority";
 import { capabilityInvocationOperation } from "../services/identity/invocation-operations";
 import type { CloudInvocationClaims, InvocationAuthority } from "../services/identity/invocation-token";
-import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
+import { normalizeInvocationRequestId, signAppQueryInvocation } from "../services/identity/invocation-token";
 import { issueInvocationToken as signInvocationToken } from "../services/identity/issue-invocation";
 import { withActiveIdentitySigner } from "../services/identity/key-ring";
 import {
@@ -73,6 +74,7 @@ import {
   nestedInvocationLeases,
   nestedSourceDeadline,
 } from "../services/identity/nested-invocation";
+import type { AuthenticatedWorkload } from "../services/identity/workload-auth";
 import { logger } from "../services/logging";
 import { withMandateIssueAuthority } from "../services/mandates";
 import * as settings from "../services/settings";
@@ -80,6 +82,9 @@ import { resolveAppPresentation } from "../shared/app-presentation";
 import { capabilityMessages } from "../shared/capability-messages";
 import { dispatchCapabilityStream, sealCapabilityStream } from "./capability-streams";
 
+// Approved reader-check budget, shared across targets for each calling application.
+export const APP_QUERY_REQUESTS_PER_MINUTE = 1_501;
+const appQueryLimit = ratelimit({ id: "app-queries", limit: APP_QUERY_REQUESTS_PER_MINUTE, windowSecs: 60 });
 const log = logger("capabilities");
 const DEFAULT_CATALOG_LIMIT = 10;
 const MAX_CATALOG_LIMIT = 25;
@@ -114,6 +119,7 @@ const CapabilityCatalogQuerySchema = z
 export type CapabilityRouteDependencies = {
   listApps?: () => Promise<AppRegistryEntry[]>;
   eventSubscriptions?: () => Promise<CatalogSubscription[]>;
+  getApp?: (appId: string) => Promise<AppRegistryEntry | null>;
   getCapability?: (appId: string) => Promise<CapabilityRegistryEntry | null>;
   fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
   authenticate?: MiddlewareHandler<AuthContext>;
@@ -122,12 +128,15 @@ export type CapabilityRouteDependencies = {
   withMandateIssueAuthority?: typeof withMandateIssueAuthority;
   queryTimeoutMs?: number;
   actionTimeoutMs?: number;
+  checkAppQueryRate?: (appId: string) => Promise<{ limited: boolean }>;
   reviewTimeoutMs?: number;
   appUrl?: () => Promise<string>;
 };
 
 export type CapabilityDispatchDependencies = Pick<
   CapabilityRouteDependencies,
+  | "checkAppQueryRate"
+  | "getApp"
   | "getCapability"
   | "fetch"
   | "queryTimeoutMs"
@@ -223,7 +232,7 @@ export const loadCapabilityCatalogPage = async (
       appName: presentedEntry.name,
       appIcon: capability.appIcon,
       appDescription: presentedEntry.description,
-      manifest,
+      manifest: { ...manifest, queries: manifest.queries.filter(isPersonVisibleCapabilityQuery) },
       ...(manifest.events ? { events: projectAppEventCatalog(manifest, manifest.events.length ? await loadSubscribers() : []) } : {}),
     };
     const projectedBytes = new TextEncoder().encode(JSON.stringify(projected)).byteLength;
@@ -276,6 +285,8 @@ export type CapabilityDispatchParams = {
   assistantTurn?: { conversationId: string; turnId: string };
   /** Core-only absolute child deadline; cannot be extended by the application. */
   deadline?: number;
+  /** Core-only authenticated workload. Never populated from request JSON. */
+  workload?: AuthenticatedWorkload;
   mandate?: MandatedCapabilityAuthority;
   callingAppId?: string;
   /** Internal observation only: called immediately before attempting the app request. */
@@ -342,6 +353,43 @@ const runCapabilityDispatch = async (
     );
     return error;
   }
+  if ("appOnly" in operation && operation.appOnly !== undefined && !params.workload)
+    return errorResponse("FORBIDDEN", "App authority required for this query", 403);
+  if (params.workload) {
+    if (
+      params.authority ||
+      params.mandate ||
+      params.parentInvocation ||
+      params.review ||
+      params.kind !== "queries" ||
+      !("appOnly" in operation) ||
+      operation.appOnly !== true ||
+      operation.stream
+    )
+      return errorResponse("FORBIDDEN", "App caller is not allowed for this query", 403);
+    try {
+      const caller = await deadline.wait(() => (params.dependencies?.getApp ?? getApp)(params.workload!.appId));
+      if (!caller) return errorResponse("APP_UNAVAILABLE", "Calling app registry entry unavailable", 503);
+      if (!caller.platformPermissions?.includes("resources:readers"))
+        return errorResponse("APP_QUERY_NOT_ADMITTED", "App caller does not declare resources:readers", 403);
+    } catch {
+      deadline.check();
+      return errorResponse("APP_UNAVAILABLE", "App registry unavailable", 503);
+    }
+    try {
+      if (
+        (
+          await deadline.wait(() =>
+            (params.dependencies?.checkAppQueryRate ?? ((appId) => appQueryLimit.check(appId)))(params.workload!.appId),
+          )
+        ).limited
+      )
+        return errorResponse("RATE_LIMITED", "App query rate limit exceeded; retry after one minute", 429);
+    } catch {
+      deadline.check();
+      return errorResponse("APP_UNAVAILABLE", "App query rate limiter unavailable", 503);
+    }
+  }
   if (params.review && (params.kind !== "actions" || !("review" in operation) || operation.review !== true)) {
     const error = errorResponse(
       "CAPABILITY_NOT_FOUND",
@@ -488,6 +536,33 @@ const runCapabilityDispatch = async (
           });
         })()
       : await (async () => {
+          if (params.workload) {
+            const workload = params.workload;
+            return deadline.wait(() =>
+              (params.dependencies?.withActiveSigner ?? withActiveIdentitySigner)(
+                "invocation",
+                async (signer) => {
+                  deadline.check();
+                  const signed = await signAppQueryInvocation({
+                    workload,
+                    targetAppId: params.appId,
+                    capabilityId: params.capabilityId,
+                    schemaHash: operation.schemaHash,
+                    input: input.data,
+                    requestId,
+                    signer,
+                  });
+                  observed.invocationId = signed.claims.jti;
+                  return new Headers({
+                    "content-type": "application/json",
+                    accept: "application/json",
+                    authorization: `Bearer ${signed.token}`,
+                  });
+                },
+                { signal, timeoutMs: deadline.remainingMs() },
+              ),
+            );
+          }
           if (!params.authority) throw new Error("Resolved request authority is required for Cloud invocation issuance");
           const authority = params.authority;
           const signed = await deadline.wait(() =>
@@ -665,12 +740,15 @@ const runCapabilityDispatch = async (
   try {
     params.onUpstreamAttempt?.();
     const fetchResponse = () =>
-      fetchUpstream(`${entry.endpoint}/${params.kind}/${encodeURIComponent(params.capabilityId)}${params.review ? "/review" : ""}`, {
-        method: "POST",
-        headers,
-        body: requestBody,
-        signal,
-      });
+      fetchUpstream(
+        `${entry.endpoint}/${params.workload ? "app-queries" : params.kind}/${encodeURIComponent(params.capabilityId)}${params.review ? "/review" : ""}`,
+        {
+          method: "POST",
+          headers,
+          body: requestBody,
+          signal,
+        },
+      );
     // A read may be released at its deadline; Action effects retain their existing uncertainty handling.
     response = params.kind === "queries" || params.review ? await deadline.wait(fetchResponse) : await fetchResponse();
   } catch (error) {
@@ -895,12 +973,12 @@ export const dispatchCapability = async (params: CapabilityDispatchParams): Prom
         origin: params.origin,
         invocationId: observed.invocationId,
         parentInvocationId: params.parentInvocation?.jti,
-        viaAppId: params.parentInvocation ? params.callingAppId : undefined,
+        viaAppId: params.workload?.appId ?? (params.parentInvocation ? params.callingAppId : undefined),
         appId: params.appId,
         capability: `${params.appId}.${params.capabilityId}`,
         kind: params.kind === "queries" ? "query" : "action",
         destructive: observed.destructive,
-        actorKind: principal?.type ?? null,
+        actorKind: params.workload ? "app" : (principal?.type ?? null),
         actorId: principal?.id ?? null,
         userId: actor?.kind === "user" ? actor.user.id : (actor?.delegatedUser?.id ?? (principal?.type === "user" ? principal.id : null)),
         accessSubject: subject && subject.id !== principal?.id ? subject : null,

package/src/api/mcp.ts

@@ -16,7 +16,7 @@ import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
 import { type CatalogSubscription, projectAppEventCatalog, readEventCatalogSubscriptions } from "../_internal/app-event-catalog";
 import { readBoundedJson } from "../_internal/bounded-json";
-import { resolveCapabilityManifestPresentation } from "../_internal/capabilities";
+import { isPersonVisibleCapabilityQuery, resolveCapabilityManifestPresentation } from "../_internal/capabilities";
 import { capabilitySentenceText } from "../_internal/capability-sentences";
 import { withCapabilityRequestTimeout } from "../_internal/capability-timeout";
 import {
@@ -311,7 +311,9 @@ const orderedCapabilityEntries = function* (app: CapabilityRegistryEntry): Gener
   for (const operation of [...app.manifest.actions].sort((left, right) => left.localId.localeCompare(right.localId))) {
     yield { app, kind: "actions", operation };
   }
-  for (const operation of [...app.manifest.queries].sort((left, right) => left.localId.localeCompare(right.localId))) {
+  for (const operation of app.manifest.queries
+    .filter(isPersonVisibleCapabilityQuery)
+    .sort((left, right) => left.localId.localeCompare(right.localId))) {
     yield { app, kind: "queries", operation };
   }
 };

package/src/browser/notifications.ts

@@ -13,6 +13,8 @@ export type BrowserNotificationState = {
   permission: NotificationPermission;
   enabled: boolean;
   reason?: string;
+  /** On iPhone and iPad outside the Home Screen app: notifications start working once Cloud is added to the Home Screen. */
+  homeScreenRequired?: true;
 };
 
 const isIos = (): boolean =>
@@ -21,7 +23,15 @@ const isIos = (): boolean =>
 const isStandalone = (): boolean =>
   window.matchMedia("(display-mode: standalone)").matches || (navigator as Navigator & { standalone?: boolean }).standalone === true;
 
-const support = (): { supported: boolean; reason?: string } => {
+const support = (): { supported: boolean; reason?: string; homeScreenRequired?: true } => {
+  // Safari on iPhone and iPad offers push only to the Home Screen app, so it lacks the APIs checked below.
+  if (typeof window !== "undefined" && isIos() && !isStandalone()) {
+    return {
+      supported: false,
+      reason: "On iPhone and iPad, add Cloud to your Home Screen before enabling browser notifications.",
+      homeScreenRequired: true,
+    };
+  }
   if (
     typeof window === "undefined" ||
     !window.isSecureContext ||
@@ -31,12 +41,6 @@ const support = (): { supported: boolean; reason?: string } => {
   ) {
     return { supported: false, reason: "Browser notifications are not supported in this browser." };
   }
-  if (isIos() && !isStandalone()) {
-    return {
-      supported: false,
-      reason: "On iPhone and iPad, add Cloud to your Home Screen before enabling browser notifications.",
-    };
-  }
   return { supported: true };
 };
 
@@ -101,7 +105,13 @@ const pushSubscriptionError = (cause: unknown): Error => {
 const currentState = async (registration?: ServiceWorkerRegistration): Promise<BrowserNotificationState> => {
   const capability = support();
   if (!capability.supported) {
-    return { supported: false, permission: "denied", enabled: false, reason: capability.reason };
+    return {
+      supported: false,
+      permission: "denied",
+      enabled: false,
+      reason: capability.reason,
+      ...(capability.homeScreenRequired ? { homeScreenRequired: true } : {}),
+    };
   }
   return withNotificationTimeout(
     (async () => {
@@ -131,6 +141,13 @@ export const browserNotificationClient = {
     return (await response.json()).state;
   },
 
+  /** End do not disturb now, for every app. Quiet hours keep their schedule. Returns the quiet state afterwards. */
+  endDoNotDisturb: async (): Promise<NotificationQuietState> => {
+    const response = await apiClient.me.notifications.quiet.$patch({ json: { doNotDisturbUntil: null } });
+    if (!response.ok) throw await responseError(response, "Failed to end do not disturb.");
+    return (await response.json()).state;
+  },
+
   /** Close this application's group on this device without opting into notifications. */
   closeGroup: async (appId: string, group: string): Promise<void> => {
     const tag = notificationGroupTag(appId, group);

package/src/capabilities/discussion-providers.ts

@@ -0,0 +1,99 @@
+import { discussionsIssues } from "../contracts/discussions";
+import { type CapabilityCaller, listCapabilityCatalog } from "./server-invoke";
+import type { CapabilityCatalogApp } from "./types";
+
+// Same interactive discovery budget as the calendar reader. Cursor pages are sequential (one in flight).
+const MAX_CALLS = 60;
+const MAX_BYTES = 4 * 1024 * 1024;
+export type DiscussionProvider = {
+  app: CapabilityCatalogApp;
+  itemType: string;
+  containerType: string;
+  containers: string;
+  activity?: string;
+};
+
+/** Request-local discovery. Failure, truncation, and cancellation throw; no partial success or retained authority. */
+export const discussionProviders = async (
+  caller: CapabilityCaller,
+  options: { deadline: number; signal?: AbortSignal },
+): Promise<DiscussionProvider[]> => {
+  if (!Number.isFinite(options.deadline)) throw new RangeError("Discussion deadline must be a finite epoch time in milliseconds");
+  const controller = new AbortController();
+  const signal = AbortSignal.any([
+    controller.signal,
+    ...[caller.signal, options.signal].filter((signal): signal is AbortSignal => !!signal),
+  ]);
+  const timer = setTimeout(() => controller.abort(new Error("DISCUSSION_DEADLINE")), Math.max(0, options.deadline - Date.now()));
+  let bytes = 0;
+  const addBytes = (size: number) => {
+    bytes += size;
+    if (bytes > MAX_BYTES) {
+      controller.abort(new Error("DISCUSSION_BYTE_BUDGET"));
+      signal.throwIfAborted();
+    }
+  };
+  const credentials: CapabilityCaller = {
+    ...caller,
+    signal,
+    ...(!caller.authority
+      ? {
+          transport: async (request: Request) => {
+            const response = await (caller.transport ?? ((request: Request) => fetch(request, { redirect: "error" })))(request);
+            if (!response.body) return response;
+            const body = response.body.pipeThrough(
+              new TransformStream<Uint8Array, Uint8Array>({
+                transform(chunk, stream) {
+                  addBytes(chunk.byteLength);
+                  stream.enqueue(chunk);
+                },
+              }),
+              { signal },
+            );
+            return new Response(body, { status: response.status, headers: response.headers });
+          },
+        }
+      : {}),
+  };
+  const providers: DiscussionProvider[] = [];
+  const seen = new Set<string>();
+  const appIds = new Set<string>();
+  let cursor: string | undefined;
+  let onAbort: (() => void) | undefined;
+  const cancelled = new Promise<never>((_, reject) => {
+    onAbort = () => reject(signal.reason);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+  try {
+    for (let calls = 0; calls < MAX_CALLS; calls++) {
+      if (options.deadline <= Date.now()) controller.abort(new Error("DISCUSSION_DEADLINE"));
+      signal.throwIfAborted();
+      const page = await Promise.race([listCapabilityCatalog({ caller: credentials, cursor, limit: 25 }), cancelled]);
+      signal.throwIfAborted();
+      if (!page.ok) throw new Error(`Discussion discovery unavailable: ${page.error.code}`);
+      if (caller.authority) addBytes(new TextEncoder().encode(JSON.stringify(page.data)).byteLength);
+      for (const app of page.data.apps) {
+        const role = app.manifest.discussions;
+        const model = app.manifest.resourceTypes?.find((model) => model.type === role?.item);
+        if (!role || !model?.container || discussionsIssues(app.manifest).length || appIds.has(app.appId)) continue;
+        appIds.add(app.appId);
+        providers.push({
+          app,
+          itemType: `${app.appId}.${role.item}`,
+          containerType: `${app.appId}.${model.container}`,
+          containers: role.containers,
+          ...(role.activity ? { activity: role.activity } : {}),
+        });
+      }
+      if (!page.data.page.hasMore) return providers;
+      cursor = page.data.page.nextCursor;
+      if (seen.has(cursor)) throw new Error("DISCUSSION_CURSOR_LOOP");
+      seen.add(cursor);
+    }
+    throw new Error("DISCUSSION_CALL_BUDGET");
+  } finally {
+    clearTimeout(timer);
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+    controller.abort();
+  }
+};

package/src/capabilities/executions.ts

@@ -63,7 +63,7 @@ export type CapabilityExecutionInput = {
   capability: string;
   kind: "query" | "action";
   destructive: boolean;
-  actorKind?: "user" | "service_account" | null;
+  actorKind?: "user" | "service_account" | "app" | null;
   actorId?: string | null;
   userId?: string | null;
   /** Recorded only when the access subject differs from the acting principal. */
@@ -90,7 +90,7 @@ export type CapabilityExecution = {
   capability: string;
   kind: "query" | "action";
   destructive: boolean;
-  actorKind: "user" | "service_account" | null;
+  actorKind: "user" | "service_account" | "app" | null;
   actorId: string | null;
   userId: string | null;
   accessSubjectType: "user" | "service_account" | null;

package/src/capabilities/migrate.ts

@@ -35,7 +35,7 @@ export const migrateCloudCapabilities = async (): Promise<void> => {
       duration_ms INTEGER NOT NULL DEFAULT 0,
       CONSTRAINT capabilities_executions_origin_check CHECK (origin IN ('assistant', 'mcp', 'http', 'app')),
       CONSTRAINT capabilities_executions_kind_check CHECK (kind IN ('query', 'action')),
-      CONSTRAINT capabilities_executions_actor_kind_check CHECK (actor_kind IS NULL OR actor_kind IN ('user', 'service_account')),
+      CONSTRAINT capabilities_executions_actor_kind_check CHECK (actor_kind IS NULL OR actor_kind IN ('user', 'service_account', 'app')),
       CONSTRAINT capabilities_executions_subject_check CHECK (access_subject_type IS NULL OR access_subject_type IN ('user', 'service_account')),
       CONSTRAINT capabilities_executions_status_check CHECK (status IN ('succeeded', 'failed', 'denied', 'invalid_input', 'timed_out', 'rejected'))
     )
@@ -59,6 +59,15 @@ export const migrateCloudCapabilities = async (): Promise<void> => {
   await sql`ALTER TABLE capabilities.executions ADD COLUMN IF NOT EXISTS parent_invocation_id UUID`.simple();
   await sql`ALTER TABLE capabilities.executions ADD COLUMN IF NOT EXISTS via_app_id TEXT`.simple();
 
+  await sql`DO $$ BEGIN
+    IF EXISTS (SELECT 1 FROM pg_constraint WHERE conrelid = 'capabilities.executions'::regclass
+      AND conname = 'capabilities_executions_actor_kind_check' AND position('''app''' in pg_get_constraintdef(oid)) = 0) THEN
+      ALTER TABLE capabilities.executions DROP CONSTRAINT capabilities_executions_actor_kind_check;
+      ALTER TABLE capabilities.executions ADD CONSTRAINT capabilities_executions_actor_kind_check
+        CHECK (actor_kind IS NULL OR actor_kind IN ('user', 'service_account', 'app'));
+    END IF;
+  END $$`.simple();
+
   // Platform-owned idempotency claims. One row per
   // (app, capability, principal, key); the dispatcher claims before it
   // forwards and resolves the row once the outcome is known. Response bodies