@k2b/cloud 0.46.0 → 0.47.0

package/src/services/identity/resource-readers.ts

@@ -0,0 +1,80 @@
+import { sql } from "bun";
+import { z } from "zod";
+import { type ResourcePrincipal, ResourcePrincipalSchema } from "../../contracts/capabilities";
+import type { AccessSubject } from "../../contracts/shared";
+import { decodeAccountCategoryEnabled } from "../account-category-policy";
+import { toPgUuidArray } from "../postgres";
+import type { ServiceAccount } from "../service-accounts";
+
+/** Account authority only: no session, credential scopes, or content authority. */
+export type ResourceReader = {
+  principal: ResourcePrincipal;
+  subject: AccessSubject;
+  binding: Pick<ServiceAccount, "appId" | "resourceType" | "resourceId"> | null;
+};
+
+type UserRow = { id: string; category_enabled: string | null };
+type AccountRow = {
+  id: string;
+  kind: ServiceAccount["kind"];
+  delegated_user_id: string | null;
+  app_id: string | null;
+  resource_type: string | null;
+  resource_id: string | null;
+};
+
+/** Resolve at most 500 current accounts, including delegated users and account-category policy.
+ * Grants and resource bindings remain the resource provider's responsibility.
+ */
+export const resolveResourceReaders = async (principals: readonly ResourcePrincipal[]): Promise<ResourceReader[]> => {
+  const input = z.array(ResourcePrincipalSchema).max(500).parse(principals);
+  if (!input.length) return [];
+  const userIds = input.flatMap((principal) => (principal.type === "user" ? [principal.userId] : []));
+  const accountIds = input.flatMap((principal) => (principal.type === "service_account" ? [principal.serviceAccountId] : []));
+  const accounts = await sql<AccountRow[]>`
+    SELECT id, kind, delegated_user_id, app_id, resource_type, resource_id
+    FROM auth.service_accounts WHERE id = ANY(${toPgUuidArray(accountIds)}::uuid[]) AND status = 'active'
+  `;
+  const users = await sql<UserRow[]>`
+    SELECT u.id, category.value AS category_enabled FROM auth.users u
+    LEFT JOIN settings.entries category ON category.key = 'user.category.' ||
+      CASE WHEN u.provider = 'ipa' THEN 'freeipa' WHEN u.profile = 'guest' THEN 'guest' ELSE 'login' END || '.enabled'
+    WHERE u.id = ANY(${toPgUuidArray([...userIds, ...accounts.flatMap((account) => (account.delegated_user_id ? [account.delegated_user_id] : []))])}::uuid[])
+      AND (u.account_expires IS NULL OR u.account_expires > clock_timestamp())
+  `;
+  const enabled = new Map<string | null, boolean>();
+  const allowedUsers = new Set<string>();
+  for (const user of users) {
+    if (!enabled.has(user.category_enabled)) enabled.set(user.category_enabled, await decodeAccountCategoryEnabled(user.category_enabled));
+    if (enabled.get(user.category_enabled)) allowedUsers.add(user.id);
+  }
+  const accountsById = new Map(accounts.map((account) => [account.id, account]));
+  return input.flatMap((principal): ResourceReader[] => {
+    if (principal.type === "user") {
+      const userId = principal.userId.toLowerCase();
+      return allowedUsers.has(userId) ? [{ principal, subject: { type: "user", userId }, binding: null }] : [];
+    }
+    const account = accountsById.get(principal.serviceAccountId.toLowerCase());
+    if (!account) return [];
+    if (account.kind === "user_delegated")
+      return account.delegated_user_id && allowedUsers.has(account.delegated_user_id)
+        ? [
+            {
+              principal,
+              subject: { type: "user", userId: account.delegated_user_id, delegatedByServiceAccountId: account.id },
+              binding: null,
+            },
+          ]
+        : [];
+    return [
+      {
+        principal,
+        subject: { type: "service_account", serviceAccountId: account.id },
+        binding:
+          account.kind === "resource_bound"
+            ? { appId: account.app_id, resourceType: account.resource_type, resourceId: account.resource_id }
+            : null,
+      },
+    ];
+  });
+};

package/src/services/identity/runtime-config.ts

@@ -52,20 +52,28 @@ export const readIdentityGroupsAdmin = async (db: SQL): Promise<readonly string[
   return Object.freeze(normalizeGroups(groups));
 };
 
-const resolveCoreJwksUrl = (issuer: string, path: string, transportOrigin = env.CLOUD_IDENTITY_JWKS_ORIGIN): URL => {
+const resolveCoreJwksUrl = (
+  issuer: string,
+  path: string,
+  transportOrigin = env.CLOUD_IDENTITY_JWKS_ORIGIN ?? env.CLOUD_CORE_INTERNAL_ORIGIN,
+): URL => {
   if (!transportOrigin) return new URL(path, issuer);
   const origin = new URL(transportOrigin);
   if (origin.protocol !== "http:" && origin.protocol !== "https:") {
-    throw new Error("CLOUD_IDENTITY_JWKS_ORIGIN must use http or https");
+    throw new Error("Core JWKS origin (CLOUD_CORE_INTERNAL_ORIGIN or legacy CLOUD_IDENTITY_JWKS_ORIGIN) must use http or https");
   }
   return new URL(path, origin);
 };
 
-export const resolveSessionJwksUrl = (issuer: string, transportOrigin = env.CLOUD_IDENTITY_JWKS_ORIGIN): URL =>
-  resolveCoreJwksUrl(issuer, CLOUD_SESSION_JWKS_PATH, transportOrigin);
+export const resolveSessionJwksUrl = (
+  issuer: string,
+  transportOrigin = env.CLOUD_IDENTITY_JWKS_ORIGIN ?? env.CLOUD_CORE_INTERNAL_ORIGIN,
+): URL => resolveCoreJwksUrl(issuer, CLOUD_SESSION_JWKS_PATH, transportOrigin);
 
-export const resolveInvocationJwksUrl = (issuer: string, transportOrigin = env.CLOUD_IDENTITY_JWKS_ORIGIN): URL =>
-  resolveCoreJwksUrl(issuer, CLOUD_INVOCATION_JWKS_PATH, transportOrigin);
+export const resolveInvocationJwksUrl = (
+  issuer: string,
+  transportOrigin = env.CLOUD_IDENTITY_JWKS_ORIGIN ?? env.CLOUD_CORE_INTERNAL_ORIGIN,
+): URL => resolveCoreJwksUrl(issuer, CLOUD_INVOCATION_JWKS_PATH, transportOrigin);
 
 export const resolveOAuthJwksUrl = (issuer: string, transportOrigin = env.CLOUD_OAUTH_JWKS_ORIGIN): URL => {
   if (!transportOrigin) return new URL(CLOUD_OAUTH_JWKS_PATH, issuer);

package/src/services/identity/workload-runtime.ts

@@ -0,0 +1,253 @@
+/** Core-only workload issuer. This module never reads identity signing keys, OAuth secrets, or sessions. */
+import type { NatsConnection } from "@nats-io/transport-node";
+import { sql } from "bun";
+import { getProcessNats } from "../../_internal/process-sync";
+import { APP_REGISTRY_TTL_MS, appInstancePrefix, appInstanceRegistry } from "../../_internal/registry";
+import {
+  WORKLOAD_CHECK_INTERVAL_MS,
+  WORKLOAD_LIFETIME_MS,
+  WORKLOAD_ROTATE_BEFORE_MS,
+  type WorkloadRequest,
+  WorkloadRequestSchema,
+  type WorkloadResponse,
+  workloadSubject,
+} from "../../_internal/workload-protocol";
+import { env } from "../../config/env";
+import { audit } from "../audit";
+import { logger } from "../logging";
+import { serviceAccountCredentials } from "../service-account-credentials";
+import { serviceAccounts } from "../service-accounts";
+
+const isRegistered = async (appId: string, instanceId: string): Promise<boolean> => {
+  const key = `${appInstancePrefix(appId)}${instanceId}`;
+  const snapshot = await appInstanceRegistry().snapshot({ prefix: key });
+  return snapshot.entries.some((entry) => entry.key === key && entry.value.appId === appId && entry.value.instanceId === instanceId);
+};
+
+export const issueAppWorkloadCredential = async (
+  request: WorkloadRequest,
+  registered: (appId: string, instanceId: string) => Promise<boolean> = isRegistered,
+): Promise<WorkloadResponse> => {
+  if (!(await registered(request.appId, request.instanceId))) return { status: "unregistered" };
+  const account = await serviceAccounts.getOrCreateResourceBound({
+    name: `${request.appId} workload`,
+    appId: request.appId,
+    resourceType: "cloud.app",
+    resourceId: request.appId,
+  });
+  if (!account.ok) return { status: "unavailable" };
+  return sql.begin(async (db) => {
+    // One account lock serializes issuance/rotation/removal across Core replicas. Admin revocation
+    // locks the credential row too, so it cannot be overwritten by an in-flight refresh.
+    const [owner] = await db<{ status: string }[]>`SELECT status FROM auth.service_accounts WHERE id = ${account.data.id}::uuid FOR UPDATE`;
+    if (owner?.status !== "active") return { status: "revoked" };
+    const [current] = await db<{ id: string; status: string; expires_at: Date; previous_credential_id: string | null }[]>`
+      SELECT c.id, c.status, c.expires_at, i.previous_credential_id FROM auth.app_workload_instances i
+      JOIN auth.service_account_credentials c ON c.id = i.credential_id
+      WHERE i.app_id = ${request.appId} AND i.instance_id = ${request.instanceId}
+      FOR UPDATE OF c
+    `;
+    if (request.operation === "release") {
+      if (current?.status === "active") {
+        for (const credentialId of [current.id, current.previous_credential_id]) {
+          if (!credentialId) continue;
+          const revoked = await serviceAccountCredentials.revoke(
+            { credentialId, system: { service: "app-workload", reason: "instance stopped" } },
+            { db },
+          );
+          if (!revoked.ok) throw new Error("Stopped workload credential could not be revoked");
+        }
+        await db`DELETE FROM auth.app_workload_instances WHERE app_id = ${request.appId} AND instance_id = ${request.instanceId}`;
+        await db`DELETE FROM auth.service_account_credentials WHERE id = ${current.id}::uuid OR id = ${current.previous_credential_id}::uuid`;
+      }
+      return { status: "revoked" };
+    }
+    if (!(await registered(request.appId, request.instanceId))) return { status: "unregistered" };
+    await db`UPDATE auth.app_workload_instances SET last_refreshed_at = now()
+      WHERE app_id = ${request.appId} AND instance_id = ${request.instanceId}`;
+    if (
+      current?.status === "active" &&
+      current.id === request.credentialId &&
+      current.expires_at.getTime() - Date.now() > WORKLOAD_ROTATE_BEFORE_MS
+    ) {
+      return { status: "current", credentialId: current.id };
+    }
+    const expiresAt = new Date(Date.now() + WORKLOAD_LIFETIME_MS).toISOString();
+    const issued = await serviceAccountCredentials.createApiToken(
+      {
+        serviceAccountId: account.data.id,
+        name: `Runtime ${request.instanceId}`,
+        scopes: ["identity:invoke"],
+        expiresAt,
+      },
+      { db },
+    );
+    if (!issued.ok) return { status: "unavailable" };
+    // An acknowledged current token overlaps its successor until expiry. When a reply was
+    // lost, replace only the undelivered generation and keep the token the caller still knows.
+    const retainedId = current
+      ? request.credentialId === current.id
+        ? current.id
+        : current.previous_credential_id === request.credentialId
+          ? current.previous_credential_id
+          : null
+      : null;
+    for (const retiredId of [current?.id, current?.previous_credential_id]) {
+      if (!retiredId || retiredId === retainedId) continue;
+      const revoked = await serviceAccountCredentials.revoke(
+        { credentialId: retiredId, system: { service: "app-workload", reason: "rotation" } },
+        { db },
+      );
+      if (!revoked.ok) throw new Error("Workload rotation could not retire previous credential");
+    }
+    await db`
+      INSERT INTO auth.app_workload_instances (app_id, instance_id, credential_id, previous_credential_id)
+      VALUES (${request.appId}, ${request.instanceId}, ${issued.data.credential.id}::uuid, ${retainedId}::uuid)
+      ON CONFLICT (app_id, instance_id) DO UPDATE
+      SET credential_id = EXCLUDED.credential_id, previous_credential_id = EXCLUDED.previous_credential_id, last_refreshed_at = now()
+    `;
+    for (const retiredId of [current?.id, current?.previous_credential_id]) {
+      if (retiredId && retiredId !== retainedId) await db`DELETE FROM auth.service_account_credentials WHERE id = ${retiredId}::uuid`;
+    }
+    await audit.record(
+      {
+        action: "service_account_credential.create",
+        outcome: "allowed",
+        target: { type: "service_account_credential", id: issued.data.credential.id, label: issued.data.credential.name },
+        metadata: {
+          provenance: "system",
+          service: "app-workload",
+          appId: request.appId,
+          instanceId: request.instanceId,
+          serviceAccountId: account.data.id,
+        },
+      },
+      db,
+    );
+    // Deliberately construct the response: only a newly minted app-bound token and its coordinates.
+    return {
+      status: "issued",
+      appId: request.appId,
+      instanceId: request.instanceId,
+      credentialId: issued.data.credential.id,
+      token: issued.data.token,
+      expiresAt,
+    };
+  });
+};
+
+/** Revoke disappeared instances, including TTL expiry after an ungraceful stop. Pages bound memory. */
+export const revokeRemovedAppWorkloads = async (
+  registered: (appId: string, instanceId: string) => Promise<boolean> = isRegistered,
+): Promise<void> => {
+  let afterApp = "";
+  let afterInstance = "";
+  for (;;) {
+    // Same page size as the credential administration API; never materialize credential history.
+    const rows = await sql<{ app_id: string; instance_id: string; credential_id: string; service_account_id: string }[]>`
+      SELECT i.app_id, i.instance_id, i.credential_id, c.service_account_id
+      FROM auth.app_workload_instances i JOIN auth.service_account_credentials c ON c.id = i.credential_id
+      WHERE c.status = 'active' AND i.last_refreshed_at < ${new Date(Date.now() - APP_REGISTRY_TTL_MS)} AND (i.app_id, i.instance_id) > (${afterApp}, ${afterInstance})
+      ORDER BY i.app_id, i.instance_id LIMIT 100
+    `;
+    if (!rows.length) return;
+    for (const row of rows) {
+      afterApp = row.app_id;
+      afterInstance = row.instance_id;
+      if (await registered(row.app_id, row.instance_id)) continue;
+      await sql.begin(async (db) => {
+        await db`SELECT id FROM auth.service_accounts WHERE id = ${row.service_account_id}::uuid FOR UPDATE`;
+        if (await registered(row.app_id, row.instance_id)) return;
+        // Read again under the account lock, in case another Core replica rotated it meanwhile.
+        const [current] = await db<
+          { credential_id: string; previous_credential_id: string | null; status: string; last_refreshed_at: Date }[]
+        >`
+          SELECT i.credential_id, i.previous_credential_id, c.status, i.last_refreshed_at FROM auth.app_workload_instances i
+          JOIN auth.service_account_credentials c ON c.id = i.credential_id
+          WHERE i.app_id = ${row.app_id} AND i.instance_id = ${row.instance_id}
+          FOR UPDATE OF c
+        `;
+        if (current?.status === "active" && current.last_refreshed_at.getTime() < Date.now() - APP_REGISTRY_TTL_MS) {
+          for (const credentialId of [current.credential_id, current.previous_credential_id]) {
+            if (!credentialId) continue;
+            const revoked = await serviceAccountCredentials.revoke(
+              { credentialId, system: { service: "app-workload", reason: "instance removed" } },
+              { db },
+            );
+            if (!revoked.ok) throw new Error("Removed workload credential could not be revoked");
+          }
+          // An automatically retired instance may register again after a registry reset. An
+          // admin-revoked credential keeps its mapping and disabled account until explicit recovery.
+          await db`DELETE FROM auth.app_workload_instances WHERE app_id = ${row.app_id} AND instance_id = ${row.instance_id}`;
+          await db`DELETE FROM auth.service_account_credentials WHERE id = ${current.credential_id}::uuid OR id = ${current.previous_credential_id}::uuid`;
+        }
+      });
+    }
+  }
+};
+
+export const startAppWorkloadBroker = async (
+  options: {
+    connection?: NatsConnection;
+    namespace?: string;
+    issue?: (request: WorkloadRequest) => Promise<WorkloadResponse>;
+    reconcile?: () => Promise<void>;
+  } = {},
+): Promise<() => Promise<void>> => {
+  const connection = options.connection ?? getProcessNats();
+  const issue = options.issue ?? issueAppWorkloadCredential;
+  const reconcile = options.reconcile ?? revokeRemovedAppWorkloads;
+  const log = logger("app-workload");
+  // Issuance gets four concurrent DB transactions per Core replica, reserving the rest of
+  // Bun SQL's default ten-connection pool for identity requests. Overload retries at the caller.
+  const inFlight = new Set<Promise<void>>();
+  let stopped = false;
+  let maintenance: Promise<void> | undefined;
+  let timer: Timer | undefined;
+  const subscription = connection.subscribe(workloadSubject(options.namespace ?? env.SYNC_NAMESPACE), {
+    queue: "core-workload-v1",
+    callback: (error, message) => {
+      if (error || !message.reply) return;
+      // App id, instance id and UUID fit in 1 KiB including JSON escaping. Reject larger input before parsing.
+      if (stopped || inFlight.size >= 4 || message.data.length > 1024) {
+        message.respond(JSON.stringify({ status: "unavailable" }));
+        return;
+      }
+      const operation = (async () => {
+        let response: WorkloadResponse = { status: "unavailable" };
+        try {
+          const parsed = WorkloadRequestSchema.safeParse(message.json<unknown>());
+          if (parsed.success) response = await issue(parsed.data);
+        } catch {
+          log.error("Workload credential issuance failed; caller will retry");
+        }
+        if (!stopped) message.respond(JSON.stringify(response));
+      })();
+      inFlight.add(operation);
+      void operation.finally(() => inFlight.delete(operation));
+    },
+  });
+  const maintain = () => {
+    maintenance = reconcile()
+      .catch(() => {
+        log.error("Workload removal reconciliation failed; retrying");
+      })
+      .finally(() => {
+        if (!stopped) timer = setTimeout(maintain, WORKLOAD_CHECK_INTERVAL_MS);
+      });
+  };
+  const stop = async () => {
+    stopped = true;
+    clearTimeout(timer);
+    subscription.unsubscribe();
+    await Promise.allSettled([...inFlight, ...(maintenance ? [maintenance] : [])]);
+  };
+  maintain();
+  try {
+    await connection.flush();
+  } catch (error) {
+    await stop();
+    throw error;
+  }
+  return stop;
+};

package/src/services/index.ts

@@ -8,6 +8,7 @@ export type { PosixCandidate } from "./accounts/posix";
 export { accountIdentities, AccountIdentityError } from "./accounts/identities";
 export type { AccountIdentityUser, AccountIdentityGroup, AccountIdentityPage, AccountIdentityAvailability } from "./accounts/identities";
 export type { AccountIdentityReconciliation } from "./accounts/identity-reconciliation";
+export { getAppWorkloadCredential } from "../_internal/workload-credential";
 export { providers } from "./providers";
 export { createAllowedNetworkFetch } from "./allowed-network-fetch";
 export { requestPublicHttps, type PublicHttpInput } from "./public-http";
@@ -281,7 +282,9 @@ export {
   type AppAccessSnapshot,
 } from "./app-access-management";
 
-export { storage } from "./object-store";
+import { storage as platformStorage } from "./object-store";
+/** @deprecated Import storage from @k2b/cloud. */
+export const storage = platformStorage;
 export type {
   ObjectStoreFile,
   ObjectVisibility,

package/src/services/outgoing-mail/resolve-host.ts

@@ -1,8 +1,9 @@
-import { env } from "../../config/env";
 import { networkAddressFamily, normalizeNetworkHostname, parseNetworkAllowlistEnv } from "../../shared/network-address";
 import { NetworkTargetBlockedError, resolveAllowedNetworkAddresses } from "../network-security";
+import { coreSettings } from "../settings/api";
 
-export const outgoingMailAllowlist = () => parseNetworkAllowlistEnv("OUTGOING_MAIL_ALLOWED_TARGETS", env.OUTGOING_MAIL_ALLOWED_TARGETS);
+export const outgoingMailAllowlist = async () =>
+  parseNetworkAllowlistEnv("outgoing_mail.allowed_targets", await coreSettings.get<string[]>("outgoing_mail.allowed_targets"));
 
 /** One bounded lookup shared by SMTP and bounce IMAP; clients use only the checked addresses. */
 export const resolveMailHost = async (host: string, signal?: AbortSignal, resolve = resolveAllowedNetworkAddresses, port?: number) => {
@@ -14,7 +15,7 @@ export const resolveMailHost = async (host: string, signal?: AbortSignal, resolv
   try {
     cancellation.throwIfAborted();
     const addresses = await Promise.race([
-      resolve(hostname, outgoingMailAllowlist(), undefined, port),
+      outgoingMailAllowlist().then((allowlist) => resolve(hostname, allowlist, undefined, port)),
       new Promise<never>((_, reject) => {
         abort = () => reject(cancellation.reason);
         cancellation.addEventListener("abort", abort, { once: true });
@@ -29,7 +30,7 @@ export const resolveMailHost = async (host: string, signal?: AbortSignal, resolv
   } catch (error) {
     if (error instanceof NetworkTargetBlockedError)
       throw new NetworkTargetBlockedError(
-        "Outgoing mail target is on an internal network. An operator can allow it with OUTGOING_MAIL_ALLOWED_TARGETS.",
+        "Outgoing mail target is on an internal network. An operator can allow it with outgoing_mail.allowed_targets.",
       );
     throw error;
   } finally {

package/src/services/service-account-credentials.ts

@@ -221,10 +221,10 @@ const verifyApiTokenSecret = async (secret: string, storedHash: string, scopes:
   }
 };
 
-const generateUniqueTokenParts = async (): Promise<{ tokenPrefix: string; secret: string; token: string }> => {
+const generateUniqueTokenParts = async (db: SqlRunner): Promise<{ tokenPrefix: string; secret: string; token: string }> => {
   for (let i = 0; i < 5; i += 1) {
     const parts = generateTokenParts();
-    const [row] = await sql<{ exists: boolean }[]>`
+    const [row] = await db<{ exists: boolean }[]>`
       SELECT EXISTS(
         SELECT 1 FROM auth.service_account_credentials WHERE token_prefix = ${parts.tokenPrefix}
       ) AS exists
@@ -342,7 +342,7 @@ const insertApiToken = async (
     if (expiresAt.getTime() <= Date.now()) return fail(err.badInput("Expiry must be in the future"));
   }
 
-  const parts = await generateUniqueTokenParts();
+  const parts = await generateUniqueTokenParts(db);
   const secretHash = hashApiTokenSecret(parts.secret, params.scopes ?? []);
 
   try {
@@ -376,15 +376,18 @@ const insertApiToken = async (
   }
 };
 
-export const createApiToken = async (params: {
-  serviceAccountId: string;
-  name: string;
-  createdBy?: string | null;
-  expiresAt?: string | null;
-  scopes?: string[];
-}): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
+export const createApiToken = async (
+  params: {
+    serviceAccountId: string;
+    name: string;
+    createdBy?: string | null;
+    expiresAt?: string | null;
+    scopes?: string[];
+  },
+  options: { db?: SQL } = {},
+): Promise<Result<{ credential: ServiceAccountCredential; token: string }>> => {
   if (params.scopes?.includes(AI_INFERENCE_SCOPE)) return fail(err.badInput("ai:inference is reserved for models-only personal API keys"));
-  return insertApiToken(sql, params);
+  return insertApiToken(options.db ?? sql, params);
 };
 
 export const createUserApiToken = async (params: {
@@ -531,7 +534,7 @@ export const listForDelegatedUser = async (params: { userId: string }): Promise<
       c.last_used_at, c.created_by, c.created_at, c.revoked_at, c.revoked_by
     FROM auth.service_account_credentials c
     JOIN auth.service_accounts sa ON sa.id = c.service_account_id
-    WHERE sa.kind = 'user_delegated'
+    WHERE c.kind = 'api_token' AND sa.kind = 'user_delegated'
       AND sa.delegated_user_id = ${params.userId}::uuid
       AND c.status = 'active'
     ORDER BY c.created_at DESC
@@ -569,7 +572,7 @@ export const listOverview = async (config?: {
     FROM auth.service_account_credentials c
     JOIN auth.service_accounts sa ON sa.id = c.service_account_id
     LEFT JOIN auth.users du ON du.id = sa.delegated_user_id
-    WHERE (${serviceAccountKind}::text IS NULL OR sa.kind = ${serviceAccountKind})
+    WHERE c.kind = 'api_token' AND (${serviceAccountKind}::text IS NULL OR sa.kind = ${serviceAccountKind})
       AND (${credentialStatus}::text IS NULL OR c.status = ${credentialStatus})
       AND (${userId}::uuid IS NULL OR sa.delegated_user_id = ${userId}::uuid)
       AND (${serviceAccountId}::uuid IS NULL OR sa.id = ${serviceAccountId}::uuid)
@@ -621,7 +624,7 @@ export const listOverview = async (config?: {
     FROM auth.service_account_credentials c
     JOIN auth.service_accounts sa ON sa.id = c.service_account_id
     LEFT JOIN auth.users du ON du.id = sa.delegated_user_id
-    WHERE (${serviceAccountKind}::text IS NULL OR sa.kind = ${serviceAccountKind})
+    WHERE c.kind = 'api_token' AND (${serviceAccountKind}::text IS NULL OR sa.kind = ${serviceAccountKind})
       AND (${credentialStatus}::text IS NULL OR c.status = ${credentialStatus})
       AND (${userId}::uuid IS NULL OR sa.delegated_user_id = ${userId}::uuid)
       AND (${serviceAccountId}::uuid IS NULL OR sa.id = ${serviceAccountId}::uuid)
@@ -688,7 +691,7 @@ export const getOverview = async (params: { id: string }): Promise<ServiceAccoun
     FROM auth.service_account_credentials c
     JOIN auth.service_accounts sa ON sa.id = c.service_account_id
     LEFT JOIN auth.users du ON du.id = sa.delegated_user_id
-    WHERE c.id = ${params.id}::uuid
+    WHERE c.kind = 'api_token' AND c.id = ${params.id}::uuid
     LIMIT 1
   `;
   return row ? mapCredentialOverview(row) : null;
@@ -732,14 +735,14 @@ type RevokeCredentialInput =
 export const revoke = async (params: RevokeCredentialInput, options: { db?: SQL } = {}): Promise<Result<void>> => {
   if (!UUID_PATTERN.test(params.credentialId)) return fail(err.notFound("API key"));
 
-  const run = async (db: SQL): Promise<Result<void>> => {
+  const run = async (db: SQL, credentialId = params.credentialId): Promise<Result<void>> => {
     const [row] = await db<DbCredentialRow[]>`
       UPDATE auth.service_account_credentials
       SET status = 'revoked',
         revoked_at = now(),
         revoked_by = ${params.actor?.id ?? null}::uuid
-      WHERE id = ${params.credentialId}::uuid
-        AND status = 'active'
+      WHERE id = ${credentialId}::uuid
+        AND status = 'active' AND kind = 'api_token'
       RETURNING id, service_account_id, name, kind, status, token_prefix, scopes, expires_at,
         last_used_at, created_by, created_at, revoked_at, revoked_by
     `;
@@ -750,14 +753,14 @@ export const revoke = async (params: RevokeCredentialInput, options: { db?: SQL
           SELECT id, service_account_id, name, kind, status, token_prefix, scopes, expires_at,
             last_used_at, created_by, created_at, revoked_at, revoked_by
           FROM auth.service_account_credentials
-          WHERE id = ${params.credentialId}::uuid
+          WHERE id = ${credentialId}::uuid AND kind = 'api_token'
           LIMIT 1
         `;
     const result = row || existing?.status === "revoked" ? ok() : fail(err.notFound("API key"));
     return audit.recordResult({
       action: "service_account_credential.revoke",
       actor: params.actor ? actorForUser(params.actor) : null,
-      target: { type: "service_account_credential", id: params.credentialId, label: row?.name ?? existing?.name ?? null },
+      target: { type: "service_account_credential", id: credentialId, label: row?.name ?? existing?.name ?? null },
       metadata: {
         serviceAccountId: row?.service_account_id ?? existing?.service_account_id ?? null,
         ...(params.actor ? { adminAction: true } : { provenance: "system", service: params.system.service, reason: params.system.reason }),
@@ -766,7 +769,46 @@ export const revoke = async (params: RevokeCredentialInput, options: { db?: SQL
       db,
     });
   };
-  return options.db ? run(options.db) : sql.begin(run);
+  const revokeWithWorkload = async (db: SQL): Promise<Result<void>> => {
+    if (params.actor) {
+      const [instance] = await db<{ app_id: string; instance_id: string; service_account_id: string }[]>`
+        SELECT i.app_id, i.instance_id, c.service_account_id FROM auth.app_workload_instances i
+        JOIN auth.service_account_credentials c ON c.id = i.credential_id
+        WHERE i.credential_id = ${params.credentialId}::uuid OR i.previous_credential_id = ${params.credentialId}::uuid
+      `;
+      if (instance) {
+        // Same lock order as Core rotation. Resolve the latest generation *after* waiting,
+        // so an admin revoking the displayed token also revokes an overlapping rotation.
+        await db`SELECT id FROM auth.service_accounts WHERE id = ${instance.service_account_id}::uuid FOR UPDATE`;
+        // The account is the durable app-wide off switch, including future process instances.
+        await db`UPDATE auth.service_accounts SET status = 'disabled' WHERE id = ${instance.service_account_id}::uuid`;
+        await audit.record(
+          {
+            action: "service_account.disable",
+            outcome: "allowed",
+            actor: actorForUser(params.actor),
+            target: { type: "service_account", id: instance.service_account_id },
+            metadata: { appId: instance.app_id, serviceAccountId: instance.service_account_id, status: "disabled" },
+          },
+          db,
+        );
+        const [current] = await db<{ credential_id: string; previous_credential_id: string | null }[]>`
+          SELECT credential_id, previous_credential_id FROM auth.app_workload_instances
+          WHERE app_id = ${instance.app_id} AND instance_id = ${instance.instance_id}
+        `;
+        if (current) {
+          for (const credentialId of [current.credential_id, current.previous_credential_id]) {
+            if (!credentialId) continue;
+            const result = await run(db, credentialId);
+            if (!result.ok) return result;
+          }
+          return ok();
+        }
+      }
+    }
+    return run(db);
+  };
+  return options.db ? revokeWithWorkload(options.db) : sql.begin(revokeWithWorkload);
 };
 
 const findActiveByTokenPrefix = async (tokenPrefix: string): Promise<DbCredentialWithSecretRow | null> => {

package/src/services/settings/api.ts

@@ -27,7 +27,7 @@ import { deleteKey, readKey, readKeyState, type StoredSettingState, writeKey } f
  */
 export interface SettingsAPI<F extends Record<string, unknown>> {
   get<K extends keyof F & string>(key: K): Promise<F[K]>;
-  read<K extends keyof F & string>(key: K): Promise<{ value: F[K]; stored: StoredSettingState }>;
+  read<K extends keyof F & string>(key: K): Promise<{ value: F[K]; stored: StoredSettingState; bindingMismatch?: true }>;
   set<K extends keyof F & string>(key: K, value: F[K], options?: { replaceUnreadable?: boolean }): Promise<void>;
   remove<K extends keyof F & string>(key: K): Promise<void>;
 }
@@ -59,8 +59,8 @@ export const createSettingsAPI = <S extends AppSettingsMap>(): SettingsAPI<{
  */
 export const coreSettings = {
   get: <T = unknown>(key: string): Promise<T> => readKey(key) as Promise<T>,
-  read: <T = unknown>(key: string): Promise<{ value: T; stored: StoredSettingState }> =>
-    readKeyState(key) as Promise<{ value: T; stored: StoredSettingState }>,
+  read: <T = unknown>(key: string): Promise<{ value: T; stored: StoredSettingState; bindingMismatch?: true }> =>
+    readKeyState(key) as Promise<{ value: T; stored: StoredSettingState; bindingMismatch?: true }>,
   set: (key: string, value: unknown, options?: { replaceUnreadable?: boolean }): Promise<void> => writeKey(key, value, undefined, options),
   remove: (key: string): Promise<void> => deleteKey(key),
 };

package/src/services/settings/binding.ts

@@ -0,0 +1,45 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { SETTINGS, SETTINGS_MAP } from "./defaults";
+
+const envelope = z.object({ value: z.unknown(), bindings: z.record(z.string(), z.string()) });
+const hash = (value: unknown) => createHash("sha256").update(JSON.stringify(value)).digest("hex");
+export const settingOwners = (key: string) => SETTINGS.filter((def) => def.resetOnChange?.includes(key));
+
+/** Bind the value inside its encrypted row; no independently writable marker. */
+export const bindSettingValue = async (key: string, value: unknown, resolve: (key: string) => Promise<unknown>): Promise<unknown> => {
+  const owners = settingOwners(key);
+  if (!owners.length) return value;
+  const bindings: Record<string, string> = {};
+  for (const owner of owners) bindings[owner.key] = hash(await resolve(owner.key));
+  return { value, bindings };
+};
+
+export const unwrapSettingValue = (key: string, raw: unknown): unknown => {
+  if (!settingOwners(key).length) return raw;
+  const parsed = envelope.safeParse(raw);
+  return parsed.success ? parsed.data.value : raw;
+};
+
+export const replaceSettingValue = (key: string, raw: unknown, value: unknown): unknown => {
+  if (!settingOwners(key).length) return value;
+  const parsed = envelope.safeParse(raw);
+  return parsed.success ? { ...parsed.data, value } : value;
+};
+
+/** Missing or stale bindings require a new value, including legacy unbound rows. */
+export const resolveBoundSetting = async (
+  key: string,
+  raw: unknown,
+  resolve: (key: string) => Promise<unknown>,
+): Promise<{ value: unknown; mismatch: boolean }> => {
+  const owners = settingOwners(key);
+  const fallback = SETTINGS_MAP.get(key)?.default;
+  if (!owners.length) return { value: raw, mismatch: false };
+  const parsed = envelope.safeParse(raw);
+  if (!parsed.success) return { value: fallback, mismatch: true };
+  for (const owner of owners) {
+    if (parsed.data.bindings[owner.key] !== hash(await resolve(owner.key))) return { value: fallback, mismatch: true };
+  }
+  return { value: parsed.data.value, mismatch: false };
+};