@k2b/cloud 0.45.0 → 0.47.0

package/src/services/identity/workload-runtime.ts

@@ -0,0 +1,253 @@
+/** Core-only workload issuer. This module never reads identity signing keys, OAuth secrets, or sessions. */
+import type { NatsConnection } from "@nats-io/transport-node";
+import { sql } from "bun";
+import { getProcessNats } from "../../_internal/process-sync";
+import { APP_REGISTRY_TTL_MS, appInstancePrefix, appInstanceRegistry } from "../../_internal/registry";
+import {
+  WORKLOAD_CHECK_INTERVAL_MS,
+  WORKLOAD_LIFETIME_MS,
+  WORKLOAD_ROTATE_BEFORE_MS,
+  type WorkloadRequest,
+  WorkloadRequestSchema,
+  type WorkloadResponse,
+  workloadSubject,
+} from "../../_internal/workload-protocol";
+import { env } from "../../config/env";
+import { audit } from "../audit";
+import { logger } from "../logging";
+import { serviceAccountCredentials } from "../service-account-credentials";
+import { serviceAccounts } from "../service-accounts";
+
+const isRegistered = async (appId: string, instanceId: string): Promise<boolean> => {
+  const key = `${appInstancePrefix(appId)}${instanceId}`;
+  const snapshot = await appInstanceRegistry().snapshot({ prefix: key });
+  return snapshot.entries.some((entry) => entry.key === key && entry.value.appId === appId && entry.value.instanceId === instanceId);
+};
+
+export const issueAppWorkloadCredential = async (
+  request: WorkloadRequest,
+  registered: (appId: string, instanceId: string) => Promise<boolean> = isRegistered,
+): Promise<WorkloadResponse> => {
+  if (!(await registered(request.appId, request.instanceId))) return { status: "unregistered" };
+  const account = await serviceAccounts.getOrCreateResourceBound({
+    name: `${request.appId} workload`,
+    appId: request.appId,
+    resourceType: "cloud.app",
+    resourceId: request.appId,
+  });
+  if (!account.ok) return { status: "unavailable" };
+  return sql.begin(async (db) => {
+    // One account lock serializes issuance/rotation/removal across Core replicas. Admin revocation
+    // locks the credential row too, so it cannot be overwritten by an in-flight refresh.
+    const [owner] = await db<{ status: string }[]>`SELECT status FROM auth.service_accounts WHERE id = ${account.data.id}::uuid FOR UPDATE`;
+    if (owner?.status !== "active") return { status: "revoked" };
+    const [current] = await db<{ id: string; status: string; expires_at: Date; previous_credential_id: string | null }[]>`
+      SELECT c.id, c.status, c.expires_at, i.previous_credential_id FROM auth.app_workload_instances i
+      JOIN auth.service_account_credentials c ON c.id = i.credential_id
+      WHERE i.app_id = ${request.appId} AND i.instance_id = ${request.instanceId}
+      FOR UPDATE OF c
+    `;
+    if (request.operation === "release") {
+      if (current?.status === "active") {
+        for (const credentialId of [current.id, current.previous_credential_id]) {
+          if (!credentialId) continue;
+          const revoked = await serviceAccountCredentials.revoke(
+            { credentialId, system: { service: "app-workload", reason: "instance stopped" } },
+            { db },
+          );
+          if (!revoked.ok) throw new Error("Stopped workload credential could not be revoked");
+        }
+        await db`DELETE FROM auth.app_workload_instances WHERE app_id = ${request.appId} AND instance_id = ${request.instanceId}`;
+        await db`DELETE FROM auth.service_account_credentials WHERE id = ${current.id}::uuid OR id = ${current.previous_credential_id}::uuid`;
+      }
+      return { status: "revoked" };
+    }
+    if (!(await registered(request.appId, request.instanceId))) return { status: "unregistered" };
+    await db`UPDATE auth.app_workload_instances SET last_refreshed_at = now()
+      WHERE app_id = ${request.appId} AND instance_id = ${request.instanceId}`;
+    if (
+      current?.status === "active" &&
+      current.id === request.credentialId &&
+      current.expires_at.getTime() - Date.now() > WORKLOAD_ROTATE_BEFORE_MS
+    ) {
+      return { status: "current", credentialId: current.id };
+    }
+    const expiresAt = new Date(Date.now() + WORKLOAD_LIFETIME_MS).toISOString();
+    const issued = await serviceAccountCredentials.createApiToken(
+      {
+        serviceAccountId: account.data.id,
+        name: `Runtime ${request.instanceId}`,
+        scopes: ["identity:invoke"],
+        expiresAt,
+      },
+      { db },
+    );
+    if (!issued.ok) return { status: "unavailable" };
+    // An acknowledged current token overlaps its successor until expiry. When a reply was
+    // lost, replace only the undelivered generation and keep the token the caller still knows.
+    const retainedId = current
+      ? request.credentialId === current.id
+        ? current.id
+        : current.previous_credential_id === request.credentialId
+          ? current.previous_credential_id
+          : null
+      : null;
+    for (const retiredId of [current?.id, current?.previous_credential_id]) {
+      if (!retiredId || retiredId === retainedId) continue;
+      const revoked = await serviceAccountCredentials.revoke(
+        { credentialId: retiredId, system: { service: "app-workload", reason: "rotation" } },
+        { db },
+      );
+      if (!revoked.ok) throw new Error("Workload rotation could not retire previous credential");
+    }
+    await db`
+      INSERT INTO auth.app_workload_instances (app_id, instance_id, credential_id, previous_credential_id)
+      VALUES (${request.appId}, ${request.instanceId}, ${issued.data.credential.id}::uuid, ${retainedId}::uuid)
+      ON CONFLICT (app_id, instance_id) DO UPDATE
+      SET credential_id = EXCLUDED.credential_id, previous_credential_id = EXCLUDED.previous_credential_id, last_refreshed_at = now()
+    `;
+    for (const retiredId of [current?.id, current?.previous_credential_id]) {
+      if (retiredId && retiredId !== retainedId) await db`DELETE FROM auth.service_account_credentials WHERE id = ${retiredId}::uuid`;
+    }
+    await audit.record(
+      {
+        action: "service_account_credential.create",
+        outcome: "allowed",
+        target: { type: "service_account_credential", id: issued.data.credential.id, label: issued.data.credential.name },
+        metadata: {
+          provenance: "system",
+          service: "app-workload",
+          appId: request.appId,
+          instanceId: request.instanceId,
+          serviceAccountId: account.data.id,
+        },
+      },
+      db,
+    );
+    // Deliberately construct the response: only a newly minted app-bound token and its coordinates.
+    return {
+      status: "issued",
+      appId: request.appId,
+      instanceId: request.instanceId,
+      credentialId: issued.data.credential.id,
+      token: issued.data.token,
+      expiresAt,
+    };
+  });
+};
+
+/** Revoke disappeared instances, including TTL expiry after an ungraceful stop. Pages bound memory. */
+export const revokeRemovedAppWorkloads = async (
+  registered: (appId: string, instanceId: string) => Promise<boolean> = isRegistered,
+): Promise<void> => {
+  let afterApp = "";
+  let afterInstance = "";
+  for (;;) {
+    // Same page size as the credential administration API; never materialize credential history.
+    const rows = await sql<{ app_id: string; instance_id: string; credential_id: string; service_account_id: string }[]>`
+      SELECT i.app_id, i.instance_id, i.credential_id, c.service_account_id
+      FROM auth.app_workload_instances i JOIN auth.service_account_credentials c ON c.id = i.credential_id
+      WHERE c.status = 'active' AND i.last_refreshed_at < ${new Date(Date.now() - APP_REGISTRY_TTL_MS)} AND (i.app_id, i.instance_id) > (${afterApp}, ${afterInstance})
+      ORDER BY i.app_id, i.instance_id LIMIT 100
+    `;
+    if (!rows.length) return;
+    for (const row of rows) {
+      afterApp = row.app_id;
+      afterInstance = row.instance_id;
+      if (await registered(row.app_id, row.instance_id)) continue;
+      await sql.begin(async (db) => {
+        await db`SELECT id FROM auth.service_accounts WHERE id = ${row.service_account_id}::uuid FOR UPDATE`;
+        if (await registered(row.app_id, row.instance_id)) return;
+        // Read again under the account lock, in case another Core replica rotated it meanwhile.
+        const [current] = await db<
+          { credential_id: string; previous_credential_id: string | null; status: string; last_refreshed_at: Date }[]
+        >`
+          SELECT i.credential_id, i.previous_credential_id, c.status, i.last_refreshed_at FROM auth.app_workload_instances i
+          JOIN auth.service_account_credentials c ON c.id = i.credential_id
+          WHERE i.app_id = ${row.app_id} AND i.instance_id = ${row.instance_id}
+          FOR UPDATE OF c
+        `;
+        if (current?.status === "active" && current.last_refreshed_at.getTime() < Date.now() - APP_REGISTRY_TTL_MS) {
+          for (const credentialId of [current.credential_id, current.previous_credential_id]) {
+            if (!credentialId) continue;
+            const revoked = await serviceAccountCredentials.revoke(
+              { credentialId, system: { service: "app-workload", reason: "instance removed" } },
+              { db },
+            );
+            if (!revoked.ok) throw new Error("Removed workload credential could not be revoked");
+          }
+          // An automatically retired instance may register again after a registry reset. An
+          // admin-revoked credential keeps its mapping and disabled account until explicit recovery.
+          await db`DELETE FROM auth.app_workload_instances WHERE app_id = ${row.app_id} AND instance_id = ${row.instance_id}`;
+          await db`DELETE FROM auth.service_account_credentials WHERE id = ${current.credential_id}::uuid OR id = ${current.previous_credential_id}::uuid`;
+        }
+      });
+    }
+  }
+};
+
+export const startAppWorkloadBroker = async (
+  options: {
+    connection?: NatsConnection;
+    namespace?: string;
+    issue?: (request: WorkloadRequest) => Promise<WorkloadResponse>;
+    reconcile?: () => Promise<void>;
+  } = {},
+): Promise<() => Promise<void>> => {
+  const connection = options.connection ?? getProcessNats();
+  const issue = options.issue ?? issueAppWorkloadCredential;
+  const reconcile = options.reconcile ?? revokeRemovedAppWorkloads;
+  const log = logger("app-workload");
+  // Issuance gets four concurrent DB transactions per Core replica, reserving the rest of
+  // Bun SQL's default ten-connection pool for identity requests. Overload retries at the caller.
+  const inFlight = new Set<Promise<void>>();
+  let stopped = false;
+  let maintenance: Promise<void> | undefined;
+  let timer: Timer | undefined;
+  const subscription = connection.subscribe(workloadSubject(options.namespace ?? env.SYNC_NAMESPACE), {
+    queue: "core-workload-v1",
+    callback: (error, message) => {
+      if (error || !message.reply) return;
+      // App id, instance id and UUID fit in 1 KiB including JSON escaping. Reject larger input before parsing.
+      if (stopped || inFlight.size >= 4 || message.data.length > 1024) {
+        message.respond(JSON.stringify({ status: "unavailable" }));
+        return;
+      }
+      const operation = (async () => {
+        let response: WorkloadResponse = { status: "unavailable" };
+        try {
+          const parsed = WorkloadRequestSchema.safeParse(message.json<unknown>());
+          if (parsed.success) response = await issue(parsed.data);
+        } catch {
+          log.error("Workload credential issuance failed; caller will retry");
+        }
+        if (!stopped) message.respond(JSON.stringify(response));
+      })();
+      inFlight.add(operation);
+      void operation.finally(() => inFlight.delete(operation));
+    },
+  });
+  const maintain = () => {
+    maintenance = reconcile()
+      .catch(() => {
+        log.error("Workload removal reconciliation failed; retrying");
+      })
+      .finally(() => {
+        if (!stopped) timer = setTimeout(maintain, WORKLOAD_CHECK_INTERVAL_MS);
+      });
+  };
+  const stop = async () => {
+    stopped = true;
+    clearTimeout(timer);
+    subscription.unsubscribe();
+    await Promise.allSettled([...inFlight, ...(maintenance ? [maintenance] : [])]);
+  };
+  maintain();
+  try {
+    await connection.flush();
+  } catch (error) {
+    await stop();
+    throw error;
+  }
+  return stop;
+};

package/src/services/index.ts

@@ -8,6 +8,7 @@ export type { PosixCandidate } from "./accounts/posix";
 export { accountIdentities, AccountIdentityError } from "./accounts/identities";
 export type { AccountIdentityUser, AccountIdentityGroup, AccountIdentityPage, AccountIdentityAvailability } from "./accounts/identities";
 export type { AccountIdentityReconciliation } from "./accounts/identity-reconciliation";
+export { getAppWorkloadCredential } from "../_internal/workload-credential";
 export { providers } from "./providers";
 export { createAllowedNetworkFetch } from "./allowed-network-fetch";
 export { requestPublicHttps, type PublicHttpInput } from "./public-http";
@@ -281,7 +282,9 @@ export {
   type AppAccessSnapshot,
 } from "./app-access-management";
 
-export { storage } from "./object-store";
+import { storage as platformStorage } from "./object-store";
+/** @deprecated Import storage from @k2b/cloud. */
+export const storage = platformStorage;
 export type {
   ObjectStoreFile,
   ObjectVisibility,

package/src/services/outgoing-mail/resolve-host.ts

@@ -1,8 +1,9 @@
-import { env } from "../../config/env";
 import { networkAddressFamily, normalizeNetworkHostname, parseNetworkAllowlistEnv } from "../../shared/network-address";
 import { NetworkTargetBlockedError, resolveAllowedNetworkAddresses } from "../network-security";
+import { coreSettings } from "../settings/api";
 
-export const outgoingMailAllowlist = () => parseNetworkAllowlistEnv("OUTGOING_MAIL_ALLOWED_TARGETS", env.OUTGOING_MAIL_ALLOWED_TARGETS);
+export const outgoingMailAllowlist = async () =>
+  parseNetworkAllowlistEnv("outgoing_mail.allowed_targets", await coreSettings.get<string[]>("outgoing_mail.allowed_targets"));
 
 /** One bounded lookup shared by SMTP and bounce IMAP; clients use only the checked addresses. */
 export const resolveMailHost = async (host: string, signal?: AbortSignal, resolve = resolveAllowedNetworkAddresses, port?: number) => {
@@ -14,7 +15,7 @@ export const resolveMailHost = async (host: string, signal?: AbortSignal, resolv
   try {
     cancellation.throwIfAborted();
     const addresses = await Promise.race([
-      resolve(hostname, outgoingMailAllowlist(), undefined, port),
+      outgoingMailAllowlist().then((allowlist) => resolve(hostname, allowlist, undefined, port)),
       new Promise<never>((_, reject) => {
         abort = () => reject(cancellation.reason);
         cancellation.addEventListener("abort", abort, { once: true });
@@ -29,7 +30,7 @@ export const resolveMailHost = async (host: string, signal?: AbortSignal, resolv
   } catch (error) {
     if (error instanceof NetworkTargetBlockedError)
       throw new NetworkTargetBlockedError(
-        "Outgoing mail target is on an internal network. An operator can allow it with OUTGOING_MAIL_ALLOWED_TARGETS.",
+        "Outgoing mail target is on an internal network. An operator can allow it with outgoing_mail.allowed_targets.",
       );
     throw error;
   } finally {

package/src/services/pdf/geo-snapshot.ts

@@ -0,0 +1,107 @@
+import {
+  GEO_SNAPSHOT_MAX_BYTES,
+  GEO_SNAPSHOT_MAX_METADATA_BYTES,
+  type GeoMapSnapshotManifest,
+  GeoMapSnapshotManifestSchema,
+  geoMapSnapshotPart,
+} from "../../contracts/geo-snapshot";
+import { type PreparePdfImageOptions, preparePdfImage } from "./image";
+
+export type GeoMapSnapshotAsset = { id: string; name: string; data: Blob; type: "image/png" | "image/jpeg"; width: number; height: number };
+export type GeoMapSnapshotAssetErrorCode = "invalid" | "stale" | "missing" | "too_large" | "unreadable" | "timed_out" | "aborted";
+export class GeoMapSnapshotAssetError extends Error {
+  constructor(readonly code: GeoMapSnapshotAssetErrorCode) {
+    super(`Map snapshot upload: ${code}`);
+    this.name = "GeoMapSnapshotAssetError";
+  }
+}
+
+/**
+ * Application calls only after authorizing and reading its canonical saved revision/maps.
+ * Validates a presentation upload; it cannot attest that the client's pixels depict the saved geography.
+ * Enforce a streaming HTTP body limit BEFORE parsing FormData. Never accept resource URLs or renderer credentials.
+ */
+export async function prepareGeoMapSnapshotAssets(
+  form: FormData,
+  expected: { revision: string; maps: Pick<GeoMapSnapshotManifest["images"][number], "id" | "fingerprint">[]; maxBytes: number },
+  options: PreparePdfImageOptions = {},
+): Promise<GeoMapSnapshotAsset[]> {
+  const fail = (code: GeoMapSnapshotAssetErrorCode): never => {
+    throw new GeoMapSnapshotAssetError(code);
+  };
+  if (!Number.isSafeInteger(expected.maxBytes) || expected.maxBytes < 0) throw new RangeError("Invalid PDF asset budget");
+  const timeout = options.timeoutMs ?? 30_000;
+  if (!Number.isInteger(timeout) || timeout < 1 || timeout > 240_000) throw new RangeError("Invalid map preflight timeout");
+  const deadline = Date.now() + timeout;
+  const check = () => {
+    if (options.signal?.aborted) fail("aborted");
+    if (Date.now() >= deadline) fail("timed_out");
+  };
+  check();
+  const metadata = form.getAll("mapSnapshots");
+  if (metadata.length !== 1 || typeof metadata[0] !== "string") return fail("invalid");
+  if (new TextEncoder().encode(metadata[0]).byteLength > GEO_SNAPSHOT_MAX_METADATA_BYTES) return fail("too_large");
+  let manifest: GeoMapSnapshotManifest;
+  try {
+    manifest = GeoMapSnapshotManifestSchema.parse(JSON.parse(metadata[0]));
+  } catch {
+    return fail("invalid");
+  }
+  if (manifest.revision !== expected.revision) return fail("stale");
+  const maps = new Map(expected.maps.map((map) => [map.id, map.fingerprint]));
+  if (maps.size !== expected.maps.length) throw new Error("Expected maps must have unique IDs");
+  if (manifest.images.length !== maps.size) return fail("missing");
+  for (const image of manifest.images) {
+    if (!maps.has(image.id)) return fail("invalid");
+    if (maps.get(image.id) !== image.fingerprint) return fail("stale");
+  }
+  const names = new Set(manifest.images.map((image) => geoMapSnapshotPart(image.id)));
+  for (const name of form.keys()) if (name.startsWith("map-snapshot-") && !names.has(name)) return fail("invalid");
+  const maximum = Math.min(expected.maxBytes, GEO_SNAPSHOT_MAX_BYTES);
+  let inputBytes = 0;
+  const uploads = manifest.images.map((image) => {
+    const parts = form.getAll(geoMapSnapshotPart(image.id));
+    if (parts.length !== 1 || !(parts[0] instanceof Blob)) return fail("missing");
+    const data = parts[0];
+    if (data.type !== "image/png") return fail("invalid");
+    inputBytes += data.size;
+    if (data.size < 33 || inputBytes > maximum) return fail("too_large");
+    return { image, data };
+  });
+  // Check every PNG IHDR before starting any expensive decoder. Filenames are ignored.
+  for (const { image, data } of uploads) {
+    check();
+    const header = new Uint8Array(await data.slice(0, 33).arrayBuffer());
+    const view = new DataView(header.buffer);
+    if (
+      ![137, 80, 78, 71, 13, 10, 26, 10].every((byte, index) => header[index] === byte) ||
+      view.getUint32(8) !== 13 ||
+      view.getUint32(12) !== 0x49484452 ||
+      view.getUint32(16) !== image.width ||
+      view.getUint32(20) !== image.height
+    )
+      return fail("invalid");
+  }
+  const assets: GeoMapSnapshotAsset[] = [];
+  let outputBytes = 0;
+  for (const { image, data } of uploads) {
+    check();
+    const remaining = maximum - outputBytes;
+    if (remaining < 1) return fail("too_large");
+    const prepared = await preparePdfImage(
+      { data, boxes: [{ width: image.width, height: image.height }], maxBytes: remaining },
+      {
+        signal: options.signal,
+        timeoutMs: Math.max(1, deadline - Date.now()),
+      },
+    );
+    check();
+    if (!prepared.ok) return fail(prepared.code === "unsupported_format" ? "invalid" : prepared.code);
+    const variant = prepared.variants[0];
+    if (!variant) return fail("too_large");
+    if (variant.width !== image.width || variant.height !== image.height) return fail("invalid");
+    outputBytes += variant.data.size;
+    assets.push({ id: image.id, name: `geo-map-${assets.length}.${variant.type === "image/png" ? "png" : "jpg"}`, ...variant });
+  }
+  return assets;
+}

package/src/services/pdf/index.ts

@@ -1,3 +1,5 @@
+export type { GeoMapSnapshotAsset, GeoMapSnapshotAssetErrorCode } from "./geo-snapshot";
+export { GeoMapSnapshotAssetError, prepareGeoMapSnapshotAssets } from "./geo-snapshot";
 export type {
   AttachPdfFilesInput,
   GotenbergConfig,

package/src/services/service-account-credentials.ts

@@ -221,10 +221,10 @@ const verifyApiTokenSecret = async (secret: string, storedHash: string, scopes:
   }
 };
 
-const generateUniqueTokenParts = async (): Promise<{ tokenPrefix: string; secret: string; token: string }> => {
+const generateUniqueTokenParts = async (db: SqlRunner): Promise<{ tokenPrefix: string; secret: string; token: string }> => {
   for (let i = 0; i < 5; i += 1) {
     const parts = generateTokenParts();
-    const [row] = await sql<{ exists: boolean }[]>`
+    const [row] = await db<{ exists: boolean }[]>`
       SELECT EXISTS(
         SELECT 1 FROM auth.service_account_credentials WHERE token_prefix = ${parts.tokenPrefix}
       ) AS exists
@@ -342,7 +342,7 @@ const insertApiToken = async (
     if (expiresAt.getTime() <= Date.now()) return fail(err.badInput("Expiry must be in the future"));
   }
 
-  const parts = await generateUniqueTokenParts();
+  const parts = await generateUniqueTokenParts(db);
   const secretHash = hashApiTokenSecret(parts.secret, params.scopes ?? []);
 
   try {
@@ -376,15 +376,18 @@ const insertApiToken = async (
   }
 };
 
-export const createApiToken = async (params: {
-  serviceAccountId: string;
-  name: string;
-  createdBy?: string | null;
-  expiresAt?: string | null;
-  scopes?: string[];
-}): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
+export const createApiToken = async (
+  params: {
+    serviceAccountId: string;
+    name: string;
+    createdBy?: string | null;
+    expiresAt?: string | null;
+    scopes?: string[];
+  },
+  options: { db?: SQL } = {},
+): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
   if (params.scopes?.includes(AI_INFERENCE_SCOPE)) return fail(err.badInput("ai:inference is reserved for models-only personal API keys"));
-  return insertApiToken(sql, params);
+  return insertApiToken(options.db ?? sql, params);
 };
 
 export const createUserApiToken = async (params: {
@@ -531,7 +534,7 @@ export const listForDelegatedUser = async (params: { userId: string }): Promise<
       c.last_used_at, c.created_by, c.created_at, c.revoked_at, c.revoked_by
     FROM auth.service_account_credentials c
     JOIN auth.service_accounts sa ON sa.id = c.service_account_id
-    WHERE sa.kind = 'user_delegated'
+    WHERE c.kind = 'api_token' AND sa.kind = 'user_delegated'
       AND sa.delegated_user_id = ${params.userId}::uuid
       AND c.status = 'active'
     ORDER BY c.created_at DESC
@@ -569,7 +572,7 @@ export const listOverview = async (config?: {
     FROM auth.service_account_credentials c
     JOIN auth.service_accounts sa ON sa.id = c.service_account_id
     LEFT JOIN auth.users du ON du.id = sa.delegated_user_id
-    WHERE (${serviceAccountKind}::text IS NULL OR sa.kind = ${serviceAccountKind})
+    WHERE c.kind = 'api_token' AND (${serviceAccountKind}::text IS NULL OR sa.kind = ${serviceAccountKind})
       AND (${credentialStatus}::text IS NULL OR c.status = ${credentialStatus})
       AND (${userId}::uuid IS NULL OR sa.delegated_user_id = ${userId}::uuid)
       AND (${serviceAccountId}::uuid IS NULL OR sa.id = ${serviceAccountId}::uuid)
@@ -621,7 +624,7 @@ export const listOverview = async (config?: {
     FROM auth.service_account_credentials c
     JOIN auth.service_accounts sa ON sa.id = c.service_account_id
     LEFT JOIN auth.users du ON du.id = sa.delegated_user_id
-    WHERE (${serviceAccountKind}::text IS NULL OR sa.kind = ${serviceAccountKind})
+    WHERE c.kind = 'api_token' AND (${serviceAccountKind}::text IS NULL OR sa.kind = ${serviceAccountKind})
       AND (${credentialStatus}::text IS NULL OR c.status = ${credentialStatus})
       AND (${userId}::uuid IS NULL OR sa.delegated_user_id = ${userId}::uuid)
       AND (${serviceAccountId}::uuid IS NULL OR sa.id = ${serviceAccountId}::uuid)
@@ -688,7 +691,7 @@ export const getOverview = async (params: { id: string }): Promise<ServiceAccoun
     FROM auth.service_account_credentials c
     JOIN auth.service_accounts sa ON sa.id = c.service_account_id
     LEFT JOIN auth.users du ON du.id = sa.delegated_user_id
-    WHERE c.id = ${params.id}::uuid
+    WHERE c.kind = 'api_token' AND c.id = ${params.id}::uuid
     LIMIT 1
   `;
   return row ? mapCredentialOverview(row) : null;
@@ -732,14 +735,14 @@ type RevokeCredentialInput =
 export const revoke = async (params: RevokeCredentialInput, options: { db?: SQL } = {}): Promise<Result<void>> => {
   if (!UUID_PATTERN.test(params.credentialId)) return fail(err.notFound("API key"));
 
-  const run = async (db: SQL): Promise<Result<void>> => {
+  const run = async (db: SQL, credentialId = params.credentialId): Promise<Result<void>> => {
     const [row] = await db<DbCredentialRow[]>`
       UPDATE auth.service_account_credentials
       SET status = 'revoked',
         revoked_at = now(),
         revoked_by = ${params.actor?.id ?? null}::uuid
-      WHERE id = ${params.credentialId}::uuid
-        AND status = 'active'
+      WHERE id = ${credentialId}::uuid
+        AND status = 'active' AND kind = 'api_token'
       RETURNING id, service_account_id, name, kind, status, token_prefix, scopes, expires_at,
         last_used_at, created_by, created_at, revoked_at, revoked_by
     `;
@@ -750,14 +753,14 @@ export const revoke = async (params: RevokeCredentialInput, options: { db?: SQL
           SELECT id, service_account_id, name, kind, status, token_prefix, scopes, expires_at,
             last_used_at, created_by, created_at, revoked_at, revoked_by
           FROM auth.service_account_credentials
-          WHERE id = ${params.credentialId}::uuid
+          WHERE id = ${credentialId}::uuid AND kind = 'api_token'
           LIMIT 1
         `;
     const result = row || existing?.status === "revoked" ? ok() : fail(err.notFound("API key"));
     return audit.recordResult({
       action: "service_account_credential.revoke",
       actor: params.actor ? actorForUser(params.actor) : null,
-      target: { type: "service_account_credential", id: params.credentialId, label: row?.name ?? existing?.name ?? null },
+      target: { type: "service_account_credential", id: credentialId, label: row?.name ?? existing?.name ?? null },
       metadata: {
         serviceAccountId: row?.service_account_id ?? existing?.service_account_id ?? null,
         ...(params.actor ? { adminAction: true } : { provenance: "system", service: params.system.service, reason: params.system.reason }),
@@ -766,7 +769,46 @@ export const revoke = async (params: RevokeCredentialInput, options: { db?: SQL
       db,
     });
   };
-  return options.db ? run(options.db) : sql.begin(run);
+  const revokeWithWorkload = async (db: SQL): Promise<Result<void>> => {
+    if (params.actor) {
+      const [instance] = await db<{ app_id: string; instance_id: string; service_account_id: string }[]>`
+        SELECT i.app_id, i.instance_id, c.service_account_id FROM auth.app_workload_instances i
+        JOIN auth.service_account_credentials c ON c.id = i.credential_id
+        WHERE i.credential_id = ${params.credentialId}::uuid OR i.previous_credential_id = ${params.credentialId}::uuid
+      `;
+      if (instance) {
+        // Same lock order as Core rotation. Resolve the latest generation *after* waiting,
+        // so an admin revoking the displayed token also revokes an overlapping rotation.
+        await db`SELECT id FROM auth.service_accounts WHERE id = ${instance.service_account_id}::uuid FOR UPDATE`;
+        // The account is the durable app-wide off switch, including future process instances.
+        await db`UPDATE auth.service_accounts SET status = 'disabled' WHERE id = ${instance.service_account_id}::uuid`;
+        await audit.record(
+          {
+            action: "service_account.disable",
+            outcome: "allowed",
+            actor: actorForUser(params.actor),
+            target: { type: "service_account", id: instance.service_account_id },
+            metadata: { appId: instance.app_id, serviceAccountId: instance.service_account_id, status: "disabled" },
+          },
+          db,
+        );
+        const [current] = await db<{ credential_id: string; previous_credential_id: string | null }[]>`
+          SELECT credential_id, previous_credential_id FROM auth.app_workload_instances
+          WHERE app_id = ${instance.app_id} AND instance_id = ${instance.instance_id}
+        `;
+        if (current) {
+          for (const credentialId of [current.credential_id, current.previous_credential_id]) {
+            if (!credentialId) continue;
+            const result = await run(db, credentialId);
+            if (!result.ok) return result;
+          }
+          return ok();
+        }
+      }
+    }
+    return run(db);
+  };
+  return options.db ? revokeWithWorkload(options.db) : sql.begin(revokeWithWorkload);
 };
 
 const findActiveByTokenPrefix = async (tokenPrefix: string): Promise<DbCredentialWithSecretRow | null> => {

package/src/services/settings/api.ts

@@ -27,7 +27,7 @@ import { deleteKey, readKey, readKeyState, type StoredSettingState, writeKey } f
  */
 export interface SettingsAPI<F extends Record<string, unknown>> {
   get<K extends keyof F & string>(key: K): Promise<F[K]>;
-  read<K extends keyof F & string>(key: K): Promise<{ value: F[K]; stored: StoredSettingState }>;
+  read<K extends keyof F & string>(key: K): Promise<{ value: F[K]; stored: StoredSettingState; bindingMismatch?: true }>;
   set<K extends keyof F & string>(key: K, value: F[K], options?: { replaceUnreadable?: boolean }): Promise<void>;
   remove<K extends keyof F & string>(key: K): Promise<void>;
 }
@@ -59,8 +59,8 @@ export const createSettingsAPI = <S extends AppSettingsMap>(): SettingsAPI<{
  */
 export const coreSettings = {
   get: <T = unknown>(key: string): Promise<T> => readKey(key) as Promise<T>,
-  read: <T = unknown>(key: string): Promise<{ value: T; stored: StoredSettingState }> =>
-    readKeyState(key) as Promise<{ value: T; stored: StoredSettingState }>,
+  read: <T = unknown>(key: string): Promise<{ value: T; stored: StoredSettingState; bindingMismatch?: true }> =>
+    readKeyState(key) as Promise<{ value: T; stored: StoredSettingState; bindingMismatch?: true }>,
   set: (key: string, value: unknown, options?: { replaceUnreadable?: boolean }): Promise<void> => writeKey(key, value, undefined, options),
   remove: (key: string): Promise<void> => deleteKey(key),
 };

package/src/services/settings/binding.ts

@@ -0,0 +1,45 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { SETTINGS, SETTINGS_MAP } from "./defaults";
+
+const envelope = z.object({ value: z.unknown(), bindings: z.record(z.string(), z.string()) });
+const hash = (value: unknown) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+export const settingOwners = (key: string) => SETTINGS.filter((def) => def.resetOnChange?.includes(key));
+
+/** Bind the value inside its encrypted row; no independently writable marker. */
+export const bindSettingValue = async (key: string, value: unknown, resolve: (key: string) => Promise<unknown>): Promise<unknown> => {
+  const owners = settingOwners(key);
+  if (!owners.length) return value;
+  const bindings: Record<string, string> = {};
+  for (const owner of owners) bindings[owner.key] = hash(await resolve(owner.key));
+  return { value, bindings };
+};
+
+export const unwrapSettingValue = (key: string, raw: unknown): unknown => {
+  if (!settingOwners(key).length) return raw;
+  const parsed = envelope.safeParse(raw);
+  return parsed.success ? parsed.data.value : raw;
+};
+
+export const replaceSettingValue = (key: string, raw: unknown, value: unknown): unknown => {
+  if (!settingOwners(key).length) return value;
+  const parsed = envelope.safeParse(raw);
+  return parsed.success ? { ...parsed.data, value } : value;
+};
+
+/** Missing or stale bindings require a new value, including legacy unbound rows. */
+export const resolveBoundSetting = async (
+  key: string,
+  raw: unknown,
+  resolve: (key: string) => Promise<unknown>,
+): Promise<{ value: unknown; mismatch: boolean }> => {
+  const owners = settingOwners(key);
+  const fallback = SETTINGS_MAP.get(key)?.default;
+  if (!owners.length) return { value: raw, mismatch: false };
+  const parsed = envelope.safeParse(raw);
+  if (!parsed.success) return { value: fallback, mismatch: true };
+  for (const owner of owners) {
+    if (parsed.data.bindings[owner.key] !== hash(await resolve(owner.key))) return { value: fallback, mismatch: true };
+  }
+  return { value: parsed.data.value, mismatch: false };
+};