@k2b/cloud 0.46.0 → 0.48.0

package/src/services/settings/store.ts

@@ -16,10 +16,12 @@
 import { sql } from "bun";
 import { HTTPException } from "hono/http-exception";
 import { hasRole, type User } from "../../contracts/shared";
+import { connections } from "../../runtime/connections";
 import { claimCacheFill, completeCacheFill, MISSING_SETTING } from "../cache-fill";
 import { stripImageDataUrlMetadata } from "../image-metadata";
 import { toPgTextArray } from "../postgres";
 import { requestCacheRedis } from "../request-cache-redis";
+import { bindSettingValue, resolveBoundSetting, settingOwners, unwrapSettingValue } from "./binding";
 import { decryptValue, encryptValue } from "./crypto";
 import { SETTINGS, SETTINGS_MAP, type SettingDef, validateSettingValue } from "./defaults";
 import { SettingUnreadableError } from "./errors";
@@ -32,7 +34,7 @@ const REDIS_KEY = (k: string) => `settings:${k}`;
 type SqlClient = typeof sql;
 
 export type StoredSettingState = "none" | "readable" | "unreadable";
-export type SettingRead = { value: unknown; stored: StoredSettingState };
+export type SettingRead = { value: unknown; stored: StoredSettingState; bindingMismatch?: true };
 
 /**
  * Forget cached values so every container re-reads on next access.
@@ -43,7 +45,8 @@ export type SettingRead = { value: unknown; stored: StoredSettingState };
  * therefore invalidate after it commits.
  */
 export const invalidateSettingsCache = async (keys: readonly string[]): Promise<void> => {
-  if (keys.length > 0) await (await requestCacheRedis()).del(...keys.map(REDIS_KEY));
+  if (keys.length > 0)
+    await (await requestCacheRedis()).del(...keys.flatMap((key) => [key, ...(SETTINGS_MAP.get(key)?.resetOnChange ?? [])]).map(REDIS_KEY));
 };
 const REDIS_TTL_SEC = 300;
 
@@ -87,6 +90,17 @@ export const readKeyState = async (key: string, db: SqlClient = sql): Promise<Se
 export const bulkRead = async (keys: readonly string[]): Promise<Map<string, unknown>> => {
   const result = new Map<string, unknown>();
   if (keys.length === 0) return result;
+  // Missing startup is a programming error, never a cache outage or unreadable row.
+  connections();
+  // Bound access is read with its endpoint in one database snapshot. Never
+  // resolve it from an independently cached secret.
+  const boundKeys = keys.filter((key) => settingOwners(key).length > 0);
+  if (boundKeys.length) {
+    const bound = await readStates(boundKeys);
+    const other = await bulkRead(keys.filter((key) => !bound.has(key)));
+    for (const key of keys) result.set(key, bound.has(key) ? bound.get(key)!.value : other.get(key));
+    return result;
+  }
   let cached: Array<string | null>;
   try {
     cached = await (await requestCacheRedis()).mget(...keys.map(REDIS_KEY));
@@ -152,17 +166,30 @@ export const bulkRead = async (keys: readonly string[]): Promise<Map<string, unk
 export const readStates = async (keys: readonly string[], db: SqlClient = sql): Promise<Map<string, SettingRead>> => {
   const result = new Map<string, SettingRead>();
   if (keys.length === 0) return result;
-  const rows = await db<StoredRow[]>`SELECT key, value FROM settings.entries WHERE key = ANY(${toPgTextArray([...keys])}::text[])`;
+  connections();
+  const snapshotKeys = [...new Set(keys.flatMap((key) => [key, ...settingOwners(key).map((owner) => owner.key)]))];
+  const rows = await db<StoredRow[]>`SELECT key, value FROM settings.entries WHERE key = ANY(${toPgTextArray(snapshotKeys)}::text[])`;
   const byKey = new Map(rows.map((row) => [row.key, row]));
+  const resolve = async (key: string) => {
+    const row = byKey.get(key);
+    const def = SETTINGS_MAP.get(key);
+    if (!row) return resolveFallback(def);
+    const raw = await decryptValue(row.value);
+    const checked = def ? validateSettingValue(def, unwrapSettingValue(key, raw)) : { ok: true as const, value: raw };
+    if (!checked.ok) throw new SettingUnreadableError(key);
+    return checked.value;
+  };
   for (const key of keys) {
     const row = byKey.get(key);
     const def = SETTINGS_MAP.get(key);
     result.set(key, { stored: row ? "unreadable" : "none", value: resolveFallback(def) });
     if (!row) continue;
     try {
-      const value = await decryptValue(row.value);
-      const validated = def ? validateSettingValue(def, value) : { ok: true as const, value };
-      if (validated.ok) result.set(key, { stored: "readable", value: validated.value });
+      const raw = await decryptValue(row.value);
+      const bound = await resolveBoundSetting(key, raw, resolve);
+      const validated = def ? validateSettingValue(def, bound.value) : { ok: true as const, value: bound.value };
+      if (validated.ok)
+        result.set(key, { stored: "readable", value: validated.value, ...(bound.mismatch ? { bindingMismatch: true } : {}) });
     } catch {
       // Keep this process's fallback without changing the stored row or cache.
     }
@@ -183,6 +210,7 @@ const knownKeysWith = (extraKnownKeys: readonly string[]) =>
   Array.from(new Set([...allKnownKeys(), ...retainedLegacyKeys, ...extraKnownKeys]));
 
 export const listLegacyKeys = async (extraKnownKeys: readonly string[] = []): Promise<LegacySettingRow[]> => {
+  connections();
   const knownKeys = knownKeysWith(extraKnownKeys);
   const rows = await sql<LegacyStoredRow[]>`
     SELECT key, value, updated_at
@@ -220,6 +248,37 @@ export const deleteLegacyKeys = async (extraKnownKeys: readonly string[] = []):
   return { deleted };
 };
 
+/** Serialize a setting and every value it discards, including missing rows. */
+export const lockSettingChanges = async (tx: SqlClient, key: string): Promise<void> => {
+  const owners = SETTINGS.filter((def) => def.resetOnChange?.length && (def.key === key || def.resetOnChange.includes(key)));
+  for (const owner of owners.sort((a, b) => a.key.localeCompare(b.key)))
+    await tx`SELECT pg_advisory_xact_lock(hashtextextended(${`settings.change:${owner.key}`}, 0))`;
+};
+
+/** Keep an empty row so environment bootstrap cannot restore discarded access. */
+export const resetChangedSettings = async (
+  tx: SqlClient,
+  key: string,
+  value: unknown,
+  preserve: ReadonlySet<string> = new Set(),
+  prior?: SettingRead,
+): Promise<void> => {
+  const def = SETTINGS_MAP.get(key);
+  if (!def?.resetOnChange?.length) return;
+  const previous = prior ?? (await readKeyState(key, tx));
+  if (previous.stored !== "unreadable" && JSON.stringify(previous.value) === JSON.stringify(value)) return;
+  for (const target of def.resetOnChange) {
+    if (preserve.has(target)) continue;
+    const targetDef = SETTINGS_MAP.get(target);
+    if (!targetDef) throw new Error(`Unknown setting: ${target}`);
+    const empty = await encryptValue(targetDef.default);
+    await tx`
+      INSERT INTO settings.entries (key, value, updated_at) VALUES (${target}, ${empty}, now())
+      ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = EXCLUDED.updated_at
+    `;
+  }
+};
+
 /**
  * Encrypt the value, upsert the DB row, invalidate the Redis key.
  *
@@ -238,8 +297,16 @@ export const writeKey = async (key: string, value: unknown, db?: SqlClient, opti
 
   const storedValue =
     def.kind === "image" && typeof validated.value === "string" ? stripImageDataUrlMetadata(validated.value) : validated.value;
-  const encrypted = await encryptValue(storedValue);
   const write = async (tx: SqlClient) => {
+    await lockSettingChanges(tx, key);
+    await resetChangedSettings(tx, key, validated.value);
+    const encrypted = await encryptValue(
+      await bindSettingValue(key, storedValue, async (owner) => {
+        const state = await readKeyState(owner, tx);
+        if (state.stored === "unreadable") throw new SettingUnreadableError(owner);
+        return state.value;
+      }),
+    );
     for (let attempt = 0; attempt < 3; attempt++) {
       let [row] = await tx<{ value: string }[]>`UPDATE settings.entries SET value = value WHERE key = ${key} RETURNING value`;
       if (!row) {
@@ -256,7 +323,7 @@ export const writeKey = async (key: string, value: unknown, db?: SqlClient, opti
       if (options?.replaceUnreadable !== true) {
         let readable = false;
         try {
-          readable = validateSettingValue(def, await decryptValue(row.value)).ok;
+          readable = validateSettingValue(def, unwrapSettingValue(key, await decryptValue(row.value))).ok;
         } catch {
           // Only the key is exposed by the recovery error.
         }
@@ -283,7 +350,10 @@ export const writeKey = async (key: string, value: unknown, db?: SqlClient, opti
 
 /** Delete the DB row and invalidate Redis. With `db`, the caller owns geo budget pair validation and post-commit invalidation. */
 export const deleteKey = async (key: string, db?: SqlClient): Promise<void> => {
+  const def = SETTINGS_MAP.get(key);
   const remove = async (tx: SqlClient) => {
+    await lockSettingChanges(tx, key);
+    await resetChangedSettings(tx, key, resolveFallback(def));
     await tx`DELETE FROM settings.entries WHERE key = ${key}`;
   };
   if (db) await remove(db);

package/src/services/settings/validation.ts

@@ -0,0 +1,40 @@
+import { BlockList, isIP } from "node:net";
+import { parseNetworkAllowlist } from "../../shared/network-address";
+
+export const DEFAULT_TRUSTED_PROXIES = ["127.0.0.0/8", "::1/128", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "fc00::/7"];
+
+/** One parser for admin writes and the gateway's startup check. */
+export const trustedProxySet = (entries: readonly string[]): BlockList => {
+  const set = new BlockList();
+  for (const entry of entries) {
+    const [address = "", prefix, ...rest] = entry.split("/");
+    const version = isIP(address);
+    const max = version === 4 ? 32 : 128;
+    if (!version || rest.length || address.includes("%") || (prefix !== undefined && !/^\d{1,3}$/.test(prefix)))
+      throw new Error("Trusted proxies must contain only IP addresses or CIDR ranges");
+    const bits = prefix === undefined ? max : Number(prefix);
+    if (bits < 1 || bits > max) throw new Error("Trusted proxy CIDR prefixes must be greater than zero and within the address width");
+    set.addSubnet(address, bits, version === 4 ? "ipv4" : "ipv6");
+  }
+  return set;
+};
+
+export const validateTrustedProxies = (value: unknown): string | undefined => {
+  if (!Array.isArray(value) || !value.every((entry): entry is string => typeof entry === "string"))
+    return "Trusted proxies must be a list of strings";
+  try {
+    trustedProxySet(value);
+  } catch (error) {
+    return error instanceof Error ? error.message : "Invalid trusted proxies";
+  }
+};
+
+export const validateNetworkAllowlist = (value: unknown): string | undefined => {
+  if (!Array.isArray(value) || !value.every((entry): entry is string => typeof entry === "string"))
+    return "Network targets must be a list of strings";
+  try {
+    parseNetworkAllowlist(value);
+  } catch {
+    return "Network targets must be exact host names, IP addresses or canonical CIDRs; /0 is forbidden. Host:port and [ipv6]:port are supported.";
+  }
+};

package/src/shared/index.ts

@@ -1,5 +1,16 @@
 // Cloud-specific shared utils (NOT in stdlib)
 
+// The standalone editor owns the formula engine; Cloud preserves its existing shared API.
+export type { ErrorCode, EvalContext, EvalError, EvalResult, EvalValue, ProgressValue } from "@k2b/editor/formula";
+export {
+  createProgressValue,
+  evaluateFormula,
+  evaluateTableCell,
+  formatValue,
+  isFormula,
+  isTotalRow,
+  parseProgressValue,
+} from "@k2b/editor/formula";
 // Re-export from stdlib for backward compatibility
 // Prefer importing directly from @k2b/stdlib
 export { dates, dates as calendar, encoding, fileIcons, gradients } from "@k2b/stdlib";
@@ -49,16 +60,6 @@ export * from "./locale-preference";
 export * from "./login-method";
 export { markdown } from "./markdown";
 export { markdownCalloutSanitizeOptions } from "./markdown/callout-sanitizer";
-export type { ErrorCode, EvalContext, EvalError, EvalResult, EvalValue, ProgressValue } from "./markdown/formula";
-export {
-  createProgressValue,
-  evaluateFormula,
-  evaluateTableCell,
-  formatValue,
-  isFormula,
-  isTotalRow,
-  parseProgressValue,
-} from "./markdown/formula";
 export type { MockCover, MockCoverIcon, MockCoverOptions, MockCoverTheme } from "./mock-cover";
 export { createMockCover, createMockCoverSvg, parseDataUrl } from "./mock-cover";
 export * from "./network-address";

package/src/shared/markdown/extensions/tables.ts

@@ -20,8 +20,17 @@
  * NULL/datetime cell-formatting, no zebra columns. If you need any of
  * those, you're rendering data not prose; use the Grids app.
  */
+
+import {
+  type EvalContext,
+  evaluateFormula,
+  formatValue,
+  isFormula,
+  isTotalRow,
+  type ProgressValue,
+  parseProgressValue,
+} from "@k2b/editor/formula";
 import type { MarkedExtension, Tokens } from "marked";
-import { type EvalContext, evaluateFormula, formatValue, isFormula, isTotalRow, type ProgressValue, parseProgressValue } from "../formula";
 import { escapeHtml } from "../shared";
 
 type Align = "left" | "right" | "center" | null;

package/src/ssr/admin-navigation.ts

@@ -70,7 +70,6 @@ export const buildAdminGroups = (apps: readonly RuntimeContext["apps"][number][]
       links: [
         { href: "/admin", icon: "ti-dashboard", label: t.overview },
         { href: "/admin/apps", icon: "ti-apps", label: t.apps },
-        { href: "/admin/app-credentials", icon: "ti-key", label: t.appCredentials },
         { href: "/admin/rail", icon: "ti-layout-sidebar", label: t.rail },
         { href: "/admin/announcements", icon: "ti-speakerphone", label: t.announcements },
       ],

package/src/ssr/platform-messages.ts

@@ -40,7 +40,6 @@ export const platformMessages = i18n.define({
       general: "General",
       rail: "App bar",
       announcements: "Announcements",
-      appCredentials: "App credentials",
       ai: "AI",
       observability: "Observability",
       baseSettings: "Base settings",
@@ -147,7 +146,6 @@ export const platformMessages = i18n.define({
       general: "Allgemein",
       rail: "App-Leiste",
       announcements: "Ankündigungen",
-      appCredentials: "App-Schlüssel",
       ai: "KI",
       observability: "Observability",
       baseSettings: "Grundeinstellungen",

package/src/start.ts

@@ -0,0 +1,57 @@
+// Keep this entry independent of the platform barrel and application modules.
+import { parseAppKey } from "./app-key";
+import { env } from "./config/env";
+import { bootstrapConnections } from "./runtime/bootstrap-client";
+import type { BootstrapResponse } from "./runtime/bootstrap-protocol";
+import { initializeClients } from "./runtime/clients";
+import { bindConnections, hasConnections } from "./runtime/connections";
+import { resolveConnections } from "./runtime/resolve-connections";
+
+export type PlatformStartOptions = {
+  appId: string;
+  /** Core and Gateway always use infrastructure environment values. */
+  source?: "env";
+};
+
+let initializing = false;
+
+/** Initialize before importing any application module, also in dev and data workers. */
+export const initializePlatform = async ({ appId, source }: PlatformStartOptions): Promise<void> => {
+  if (!/^[a-z][a-z0-9-]{0,79}$/.test(appId)) throw new Error("Platform start requires a valid appId");
+  if (initializing || hasConnections()) throw new Error("Platform has already started");
+  initializing = true;
+  try {
+    const keyValue = env.CLOUD_APP_KEY;
+    const envOnly = source === "env" || appId === "core" || appId === "gateway";
+    if (keyValue && envOnly) throw new Error("App keys are forbidden in forced env mode (including Core and Gateway)");
+    let bootstrap: BootstrapResponse | undefined;
+    if (keyValue) {
+      // Parsing never prints the private value. A present invalid key cannot fall back to env.
+      const key = parseAppKey(keyValue);
+      if (key.appId !== appId) throw new Error("App-key appId does not match the declared application");
+      bootstrap = await bootstrapConnections(key, env.CLOUD_CORE_INTERNAL_ORIGIN);
+    }
+    const resolved = resolveConnections({ appId, core: bootstrap?.connections });
+    resolved.bootstrap = {
+      mode: bootstrap ? "core" : "env",
+      ...(bootstrap ? { keyId: bootstrap.identity.keyId } : {}),
+      sources: resolved.sources,
+      keyFormat: "cloud-app-key-v1",
+      protocol: 1,
+    };
+    bindConnections(resolved);
+    try {
+      await initializeClients();
+    } catch (error) {
+      bindConnections(undefined);
+      throw error;
+    }
+  } finally {
+    initializing = false;
+  }
+};
+
+export const startPlatform = async <T>({ load, ...options }: PlatformStartOptions & { load: () => Promise<T> }): Promise<T> => {
+  await initializePlatform(options);
+  return load();
+};

package/src/workflows/ai/index.ts

@@ -1,4 +1,5 @@
 export { startWorkflowAiRuntime, stopWorkflowAiRuntime, submitWorkflowAiTask, type WorkflowAiRuntimeOptions } from "./runtime";
+export { getWorkflowAiBudget } from "./settings";
 export {
   createWorkflowAiTask,
   getWorkflowAiTask,

package/src/workflows/ai/runtime.ts

@@ -7,8 +7,10 @@ import { resolveAiWorkflowModel, runAiStructured } from "../../ai/structured";
 import { executeAiTask } from "../../ai/task-execution";
 import { resolveApplicationAiTaskModel } from "../../ai/task-model";
 import { isAiSettingsError } from "../../ai/validate";
-import { env } from "../../config/env";
+import { DEFAULT_WORKFLOW_AI_BUDGET } from "../../config/workflow-ai";
+import { coreSettings } from "../../services/settings/api";
 import { WorkflowAiAdmissionError, workflowAiModelHash } from "./policy";
+import { getWorkflowAiBudget } from "./settings";
 
 import {
   claimWorkflowAiTask,
@@ -44,13 +46,14 @@ export type WorkflowAiProcessOptions = Required<Omit<WorkflowAiRuntimeOptions, "
   attemptTimeoutMs?: number;
 };
 
+let workerBudget = DEFAULT_WORKFLOW_AI_BUDGET;
 const workflowAiJob = lazySync((sync) =>
   sync.job<{ taskId: string }>({
     id: WORKFLOW_AI_JOB_ID,
     whenFull: "reject",
     owner: "cloud",
     delivery: {
-      maxInFlight: env.WORKFLOW_AI_BUDGET.globalConcurrent,
+      maxInFlight: workerBudget.globalConcurrent,
       ackWaitMs: 30_000,
       maxAttempts: MAX_ATTEMPTS,
       backoffMs: [1_000, 2_000],
@@ -137,6 +140,7 @@ export const processWorkflowAiTask = async (
   ctx: { signal: AbortSignal; heartbeat(): Promise<void> },
   options: WorkflowAiProcessOptions,
 ): Promise<void> => {
+  const attemptTimeoutMs = options.attemptTimeoutMs ?? (await coreSettings.get<number>("ai.workflow_attempt_timeout_ms"));
   const task = await claimWorkflowAiTask(taskId);
   if (!task) {
     const terminal = await getWorkflowAiTask(taskId);
@@ -150,7 +154,7 @@ export const processWorkflowAiTask = async (
   const deadline = setTimeout(() => {
     timedOut = true;
     controller.abort(new Error("Workflow AI attempt deadline exceeded. Retry the workflow or inspect the provider."));
-  }, options.attemptTimeoutMs ?? env.WORKFLOW_AI_ATTEMPT_TIMEOUT_MS);
+  }, attemptTimeoutMs);
   let canceled = false;
   let monitorError: unknown;
   let checking = false;
@@ -230,9 +234,12 @@ let recovery: Promise<void> | null = null;
 let shutdown: AbortController | null = null;
 
 const recover = (): Promise<void> => {
-  recovery ??= expireWorkflowAiTasks(env.WORKFLOW_AI_QUEUE_TIMEOUT_MS).finally(() => {
-    recovery = null;
-  });
+  recovery ??= coreSettings
+    .get<number>("ai.workflow_queue_timeout_ms")
+    .then((timeout) => expireWorkflowAiTasks(timeout))
+    .finally(() => {
+      recovery = null;
+    });
   return recovery;
 };
 
@@ -242,14 +249,15 @@ export const startWorkflowAiRuntime = async (input: WorkflowAiRuntimeOptions = {
     runStructured: input.runStructured ?? runAiStructured,
     maxAttempts: MAX_ATTEMPTS,
     cancelPollMs: input.cancelPollMs ?? DEFAULT_CANCEL_POLL_MS,
-    attemptTimeoutMs: input.attemptTimeoutMs ?? env.WORKFLOW_AI_ATTEMPT_TIMEOUT_MS,
+    attemptTimeoutMs: input.attemptTimeoutMs,
   };
+  workerBudget = await getWorkflowAiBudget();
   const next = workflowAiJob();
   activeJob = next;
   const controller = new AbortController();
   shutdown = controller;
   try {
-    activeWorker = await next.process({ concurrency: env.WORKFLOW_AI_BUDGET.globalConcurrent }, async (context) => {
+    activeWorker = await next.process({ concurrency: workerBudget.globalConcurrent }, async (context) => {
       try {
         await processWorkflowAiTask(
           context.input.taskId,

package/src/workflows/ai/settings.ts

@@ -0,0 +1,5 @@
+import { workflowAiBudgetSchema } from "../../config/workflow-ai";
+import { coreSettings } from "../../services/settings/api";
+
+export const getWorkflowAiBudget = async () =>
+  workflowAiBudgetSchema.parse(JSON.parse(await coreSettings.get<string>("ai.workflow_budget")));