@k2b/cloud 0.46.0 → 0.48.0

package/src/_internal/registry.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import type { EphemeralConfig, MutexConfig } from "@k2b/sync";
 import type { AppAppearanceColor } from "../contracts/app";
+import { appStatusIssues } from "../contracts/app-status";
 import { calendarSourceIssues } from "../contracts/calendar-source";
 import type { CapabilityManifest, CapabilityPresentationCatalog } from "../contracts/capabilities";
 import { discussionsIssues } from "../contracts/discussions";
@@ -16,6 +17,7 @@ import {
   WIDGET_TITLE_MAX_LENGTH,
   type WidgetSettingsDeclaration,
 } from "../contracts/widgets";
+import type { PlatformBootstrapMetadata } from "../runtime/connections";
 import { resolveAppPresentations } from "../shared/app-presentation";
 import { compileCapabilityPresentation, parseCapabilityManifest } from "./capabilities";
 import { lazySync } from "./process-sync";
@@ -63,6 +65,8 @@ export type AppInstanceRecord = {
   hostname: string;
   startedAt: number;
   entries: Record<string, string>;
+  /** Missing on older instances means unknown, never env or successful bootstrap. */
+  bootstrap?: PlatformBootstrapMetadata;
 };
 
 // The id and owner are a cross-version contract: all replicas must use the same lock.
@@ -103,6 +107,8 @@ export type AppRegistryDetail = AppRegistryEntry & {
   updatedAt: number;
   expiresAt: number;
   version: string;
+  /** Per-process startup metadata for admin readers. null means an older/unknown producer. */
+  instances?: { instanceId: string; hostname: string; startedAt: number; bootstrap: PlatformBootstrapMetadata | null }[];
 };
 
 export type AppRegistryIssue = {
@@ -238,6 +244,7 @@ const reportLeftOutEntries = (sent: unknown, manifest: CapabilityManifest): void
   });
   if (groups.calendarSource !== undefined && !manifest.calendarSource) leftOut.push("calendarSource");
   if (groups.fileProvider !== undefined && !manifest.fileProvider) leftOut.push("fileProvider");
+  if (groups.appStatus !== undefined && !manifest.appStatus) leftOut.push("appStatus");
   if (groups.discussions !== undefined && !manifest.discussions) leftOut.push("discussions");
   if (leftOut.length === 0) return;
   console.warn(
@@ -348,6 +355,32 @@ const withValidDiscussions = (manifest: CapabilityManifest): CapabilityManifest
   return rest;
 };
 
+const checkedAppStatus = new Map<string, { manifestHash: string; valid: boolean }>();
+const withValidAppStatus = (manifest: CapabilityManifest): CapabilityManifest => {
+  if (!manifest.appStatus) return manifest;
+  const checked = checkedAppStatus.get(manifest.appId);
+  let valid = checked?.manifestHash === manifest.manifestHash ? checked.valid : undefined;
+  if (valid === undefined) {
+    const issues = appStatusIssues(manifest);
+    valid = issues.length === 0;
+    checkedAppStatus.set(manifest.appId, { manifestHash: manifest.manifestHash, valid });
+    if (!valid)
+      console.error(
+        JSON.stringify({
+          level: "error",
+          source: "capability-registry",
+          message: "Ignored an incompatible appStatus provider",
+          appId: manifest.appId,
+          manifestHash: manifest.manifestHash,
+          issues,
+        }),
+      );
+  }
+  if (valid) return manifest;
+  const { appStatus: _ignored, ...rest } = manifest;
+  return rest;
+};
+
 /** Ignores record fields from a newer release; the endpoint always comes from the live app registry. */
 export const resolveLiveCapabilityRegistryEntry = (
   key: string,
@@ -362,7 +395,7 @@ export const resolveLiveCapabilityRegistryEntry = (
   if (!endpoint) return null;
   try {
     const read = parseCapabilityManifest(record.manifest, app.id);
-    const supported = withValidDiscussions(withValidCalendarSource(withValidFileProvider(read)));
+    const supported = withValidAppStatus(withValidDiscussions(withValidCalendarSource(withValidFileProvider(read))));
     const manifest = supported.resourcePages
       ? {
           ...supported,
@@ -411,8 +444,21 @@ export const getCapability = async (appId: string): Promise<CapabilityRegistryEn
  * Same as `listApps` but returns registry metadata for admin observability.
  */
 export const listAppsDetailed = async (): Promise<AppRegistryDetail[]> => {
-  const snapshot = await readAppRegistrySnapshot();
-  return snapshot.apps;
+  const [snapshot, instances] = await Promise.all([
+    readAppRegistrySnapshot(),
+    appInstanceRegistry().snapshot({ prefix: APP_INSTANCE_PREFIX }),
+  ]);
+  return snapshot.apps.map((app) => ({
+    ...app,
+    instances: instances.entries
+      .filter(({ value }) => value.appId === app.id)
+      .map(({ value }) => ({
+        instanceId: value.instanceId,
+        hostname: value.hostname,
+        startedAt: value.startedAt,
+        bootstrap: value.bootstrap ?? null,
+      })),
+  }));
 };
 
 /**

package/src/_internal/resource-principals.ts

@@ -1,36 +1,6 @@
-import { sql } from "bun";
 import type { ResourcePrincipal } from "../contracts/capabilities";
-import { decodeAccountCategoryEnabled } from "../services/account-category-policy";
-import { toPgTextArray } from "../services/postgres";
+import { resolveResourceReaders } from "../services/identity/resource-readers";
 
-/** One bounded identity lookup before any provider-owned readability check. */
-export const activeResourcePrincipals = async (principals: ResourcePrincipal[]): Promise<ResourcePrincipal[]> => {
-  if (!principals.length) return [];
-  const users = principals.flatMap((principal) => (principal.type === "user" ? [principal.userId] : []));
-  const accounts = principals.flatMap((principal) => (principal.type === "service_account" ? [principal.serviceAccountId] : []));
-  const rows = await sql<{ type: ResourcePrincipal["type"]; id: string; category_enabled: string | null }[]>`
-    SELECT 'user' AS type, u.id, category.value AS category_enabled
-    FROM auth.users u
-    LEFT JOIN settings.entries category ON category.key = 'user.category.' ||
-      CASE WHEN u.provider = 'ipa' THEN 'freeipa' WHEN u.profile = 'guest' THEN 'guest' ELSE 'login' END || '.enabled'
-    WHERE u.id = ANY(${toPgTextArray(users)}::uuid[])
-      AND (u.account_expires IS NULL OR u.account_expires > clock_timestamp())
-    UNION ALL
-    SELECT 'service_account', sa.id, category.value
-    FROM auth.service_accounts sa
-    LEFT JOIN auth.users du ON du.id = sa.delegated_user_id
-    LEFT JOIN settings.entries category ON sa.kind = 'user_delegated' AND category.key = 'user.category.' ||
-      CASE WHEN du.provider = 'ipa' THEN 'freeipa' WHEN du.profile = 'guest' THEN 'guest' ELSE 'login' END || '.enabled'
-    WHERE sa.id = ANY(${toPgTextArray(accounts)}::uuid[]) AND sa.status = 'active'
-      AND (sa.kind <> 'user_delegated' OR (du.id IS NOT NULL AND (du.account_expires IS NULL OR du.account_expires > clock_timestamp())))
-  `;
-  const enabled = new Map<string | null, boolean>();
-  const active = new Set<string>();
-  for (const row of rows) {
-    if (!enabled.has(row.category_enabled)) enabled.set(row.category_enabled, await decodeAccountCategoryEnabled(row.category_enabled));
-    if (enabled.get(row.category_enabled)) active.add(`${row.type}:${row.id}`);
-  }
-  return principals.filter((principal) =>
-    active.has(`${principal.type}:${(principal.type === "user" ? principal.userId : principal.serviceAccountId).toLowerCase()}`),
-  );
-};
+/** Apply the same current-account rules as provider-owned readability checks. */
+export const activeResourcePrincipals = async (principals: ResourcePrincipal[]): Promise<ResourcePrincipal[]> =>
+  (await resolveResourceReaders(principals)).map((reader) => reader.principal);

package/src/_internal/workload-credential.ts

@@ -0,0 +1,154 @@
+import { env } from "../config/env";
+import { connections } from "../runtime/connections";
+import { getProcessApplicationId } from "./process-identity";
+import { getProcessNats } from "./process-sync";
+import {
+  WORKLOAD_CHECK_INTERVAL_MS,
+  WORKLOAD_REQUEST_TIMEOUT_MS,
+  type WorkloadRequest,
+  WorkloadResponseSchema,
+  workloadSubject,
+} from "./workload-protocol";
+
+export type WorkloadCredentialHealth = { status: "ready"; source: "runtime" | "override" } | { status: "unavailable"; reason: string };
+let active: { appId: string; token: string; expiresAt: number } | undefined;
+let health: WorkloadCredentialHealth | undefined;
+let refreshRuntime: { appId: string; refresh: () => Promise<void> } | undefined;
+
+/** Refresh only this process's app authority; concurrent broker rejections share one request. */
+export const refreshAppWorkloadCredential = async (appId: string): Promise<string | undefined> => {
+  if (appId !== getProcessApplicationId()) return undefined;
+  if (refreshRuntime?.appId === appId) await refreshRuntime.refresh();
+  return getAppWorkloadCredential();
+};
+
+/** One server-side accessor for workers and app-authority invocation clients. Never send to a target app. */
+export const getAppWorkloadCredential = (): string | undefined => {
+  const override = env.CLOUD_APP_CREDENTIAL?.trim();
+  if (override) return override;
+  if (active && active.appId === getProcessApplicationId() && active.expiresAt > Date.now()) return active.token;
+  return undefined;
+};
+
+export const getAppWorkloadCredentialHealth = (): WorkloadCredentialHealth | undefined => {
+  if (env.CLOUD_APP_CREDENTIAL?.trim()) return { status: "ready", source: "override" };
+  if (active && active.expiresAt <= Date.now()) return { status: "unavailable", reason: "expired" };
+  return health;
+};
+
+export const createAppWorkloadCredential = (options: {
+  appId: string;
+  instanceId: string;
+  request?: (request: WorkloadRequest) => Promise<unknown>;
+  onUnavailable?: (reason: string) => void;
+  onRecovered?: () => void;
+}) => {
+  let credentialId: string | null = null;
+  let running = false;
+  let refreshFailed = false;
+  let timer: Timer | undefined;
+  let inFlight: Promise<void> | undefined;
+  const request =
+    options.request ??
+    (async (input: WorkloadRequest) => {
+      const response = await getProcessNats().request(workloadSubject(connections().nats.namespace), JSON.stringify(input), {
+        timeout: WORKLOAD_REQUEST_TIMEOUT_MS,
+      });
+      return response.json<unknown>();
+    });
+  const unavailable = (reason: string, preserve = false) => {
+    refreshFailed = true;
+    if (preserve && active && active.expiresAt > Date.now()) return;
+    if (!preserve) {
+      active = undefined;
+      credentialId = null;
+    }
+    const changed = health?.status !== "unavailable" || health.reason !== reason;
+    health = { status: "unavailable", reason };
+    if (changed) options.onUnavailable?.(reason);
+  };
+  const recovered = () => {
+    health = { status: "ready", source: "runtime" };
+    if (refreshFailed) options.onRecovered?.();
+    refreshFailed = false;
+  };
+  const refresh = async (): Promise<void> => {
+    if (env.CLOUD_APP_CREDENTIAL?.trim()) {
+      active = undefined;
+      health = { status: "ready", source: "override" };
+      return;
+    }
+    try {
+      const response = WorkloadResponseSchema.parse(
+        await request({ operation: "refresh", appId: options.appId, instanceId: options.instanceId, credentialId }),
+      );
+      if (!running) return;
+      if (response.status === "issued") {
+        if (
+          response.appId !== options.appId ||
+          response.instanceId !== options.instanceId ||
+          Date.parse(response.expiresAt) <= Date.now()
+        ) {
+          unavailable("invalid_response");
+          return;
+        }
+        credentialId = response.credentialId;
+        active = { appId: options.appId, token: response.token, expiresAt: Date.parse(response.expiresAt) };
+        recovered();
+      } else if (response.status === "current" && response.credentialId === credentialId && active && active.expiresAt > Date.now()) {
+        recovered();
+      } else {
+        unavailable(response.status === "current" ? "invalid_response" : response.status, response.status === "unavailable");
+      }
+    } catch {
+      if (running) {
+        unavailable("issuance_unavailable", true);
+      }
+    }
+  };
+  const refreshOnce = (): Promise<void> => {
+    if (inFlight) return inFlight;
+    const operation = refresh().finally(() => {
+      if (inFlight === operation) inFlight = undefined;
+    });
+    inFlight = operation;
+    return operation;
+  };
+  const schedule = () => {
+    if (!running) return;
+    timer = setTimeout(
+      () => {
+        void refreshOnce().finally(schedule);
+      },
+      refreshFailed || health?.status === "unavailable" ? 5_000 : WORKLOAD_CHECK_INTERVAL_MS,
+    );
+  };
+  return {
+    start: async () => {
+      if (running) {
+        await inFlight;
+        return;
+      }
+      running = true;
+      refreshRuntime = { appId: options.appId, refresh: refreshOnce };
+      health = { status: "unavailable", reason: "starting" };
+      await refreshOnce();
+      schedule();
+    },
+    refresh: refreshOnce,
+    stop: async () => {
+      running = false;
+      if (refreshRuntime?.refresh === refreshOnce) refreshRuntime = undefined;
+      clearTimeout(timer);
+      await inFlight;
+      if (!env.CLOUD_APP_CREDENTIAL?.trim()) {
+        await request({ operation: "release", appId: options.appId, instanceId: options.instanceId, credentialId }).catch(() => {
+          // Core's registry reconciliation revokes after disappearance even when this reply is lost.
+          options.onUnavailable?.("release_unavailable");
+        });
+      }
+      active = undefined;
+      health = undefined;
+    },
+  };
+};

package/src/_internal/workload-protocol.ts

@@ -0,0 +1,36 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+import { CapabilityAppIdSchema } from "../contracts/capabilities";
+
+// Core NATS request/reply only: no JetStream subject, KV value, or retained raw token.
+export const workloadSubject = (namespace: string): string => `cloud.workload.${createHash("sha256").update(namespace).digest("hex")}.v1`;
+export const WORKLOAD_CHECK_INTERVAL_MS = 60_000;
+export const WORKLOAD_REQUEST_TIMEOUT_MS = 5_000;
+export const WORKLOAD_LIFETIME_MS = 60 * 60_000;
+export const WORKLOAD_ROTATE_BEFORE_MS = WORKLOAD_LIFETIME_MS / 2;
+
+export const WorkloadRequestSchema = z
+  .object({
+    operation: z.enum(["refresh", "release"]),
+    appId: CapabilityAppIdSchema,
+    instanceId: z.string().regex(/^[A-Za-z0-9_-]{16}$/),
+    credentialId: z.uuid().nullable(),
+  })
+  .strict();
+export type WorkloadRequest = z.infer<typeof WorkloadRequestSchema>;
+
+export const WorkloadResponseSchema = z.discriminatedUnion("status", [
+  z
+    .object({
+      status: z.literal("issued"),
+      appId: CapabilityAppIdSchema,
+      instanceId: z.string(),
+      credentialId: z.uuid(),
+      token: z.string().regex(/^cld_[a-f0-9]{24}_[a-f0-9]{64}$/),
+      expiresAt: z.iso.datetime(),
+    })
+    .strict(),
+  z.object({ status: z.literal("current"), credentialId: z.uuid() }).strict(),
+  z.object({ status: z.enum(["unavailable", "revoked", "unregistered"]) }).strict(),
+]);
+export type WorkloadResponse = z.infer<typeof WorkloadResponseSchema>;

package/src/ai/application-tasks.ts

@@ -1,6 +1,6 @@
 import type { SQL } from "bun";
-import { env } from "../config/env";
 import type { AccessSubject } from "../server/services/access";
+import { coreSettings } from "../services/settings/api";
 import { WorkflowAiAdmissionError, type WorkflowAiScope, workflowAiHash, workflowAiModelHash } from "../workflows/ai/policy";
 import { submitWorkflowAiTask } from "../workflows/ai/runtime";
 import {
@@ -56,7 +56,10 @@ export const runApplicationAiTask = async (input: ApplicationAiTaskInput) => {
   let task = await getWorkflowAiTaskByEffectKey(effectKey);
   if (!task) {
     const resolved = await resolveApplicationAiTaskModel(input.usageSubject, input.request.model);
-    const admissionSignal = AbortSignal.any([input.signal, AbortSignal.timeout(env.WORKFLOW_AI_QUEUE_TIMEOUT_MS)]);
+    const admissionSignal = AbortSignal.any([
+      input.signal,
+      AbortSignal.timeout(await coreSettings.get<number>("ai.workflow_queue_timeout_ms")),
+    ]);
     for (;;) {
       input.signal.throwIfAborted();
       if (admissionSignal.aborted) throw new WorkflowAiAdmissionError("WORKFLOW_AI_QUEUE_TIMEOUT");