@k2b/cloud 0.6.0-rc.0 → 0.7.0

package/src/api/admin-ai-skills.ts

@@ -1,7 +1,8 @@
 import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
-import { AiSkillLastAdminError, aiSkills } from "../ai/skills";
-import { PrincipalSchema } from "../contracts/shared";
+import { getBuiltinAiSkillTemplates } from "../ai/skill-seeds";
+import { AiSkillInputError, AiSkillLastAdminError, AiSkillRevisionConflictError, aiSkills } from "../ai/skills";
+import { AuthenticatedPrincipalSchema } from "../contracts/shared";
 import { type AuthContext, auth, err, fail, ok, respond, v } from "../server";
 
 const ListSkillsSchema = z
@@ -11,12 +12,11 @@ const ListSkillsSchema = z
     perPage: z.coerce.number().int().min(1).max(500).default(100),
   })
   .strict();
-const SkillAccessSchema = z.object({ principal: PrincipalSchema, permission: z.enum(["read", "write", "admin"]) }).strict();
+const SkillAccessSchema = z.object({ principal: AuthenticatedPrincipalSchema, permission: z.enum(["read", "write", "admin"]) }).strict();
 const SkillAccessUpdateSchema = z.object({ permission: z.enum(["read", "write", "admin"]) }).strict();
 
 const notFound = (c: Parameters<typeof respond>[0], noun: string) => respond(c, fail(err.notFound(noun)));
-const conflict = (c: Parameters<typeof respond>[0], error: AiSkillLastAdminError) =>
-  respond(c, { ok: false, error: error.message, status: 409 as const });
+const conflict = (c: Parameters<typeof respond>[0], error: Error) => respond(c, { ok: false, error: error.message, status: 409 as const });
 
 export const createAdminAiSkillsRoutes = (authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
   new Hono<AuthContext>()
@@ -33,6 +33,49 @@ export const createAdminAiSkillsRoutes = (authenticate: MiddlewareHandler<AuthCo
         }),
       );
     })
+    .get("/templates", (c) =>
+      respond(c, ok({ templates: getBuiltinAiSkillTemplates().map(({ key, version, name }) => ({ templateId: key, version, name })) })),
+    )
+    .post(
+      "/:skillId/template",
+      v(
+        "json",
+        z
+          .object({
+            templateId: z.string().min(1),
+            templateVersion: z.number().int().positive(),
+            expectedRevision: z.number().int().positive(),
+            mode: z.enum(["associate", "reset"]),
+            confirmed: z.literal(true),
+          })
+          .strict(),
+      ),
+      async (c) => {
+        const skill = await aiSkills.admin.getByShortId(c.req.param("skillId")!);
+        if (!skill) return notFound(c, "Skill");
+        try {
+          return (await aiSkills.admin.applyTemplate(skill.id, c.req.valid("json")))
+            ? respond(c, ok({ updated: true }))
+            : notFound(c, "Skill");
+        } catch (error) {
+          if (error instanceof AiSkillRevisionConflictError) return conflict(c, error);
+          if (error instanceof AiSkillInputError) return respond(c, fail(err.badInput(error.message)));
+          if (
+            typeof error === "object" &&
+            error !== null &&
+            (("code" in error && error.code === "23505") || ("errno" in error && error.errno === "23505"))
+          )
+            return conflict(c, new Error("A Skill with this name already exists."));
+          throw error;
+        }
+      },
+    )
+    .get("/:skillId/projects", async c => {
+      const skill = await aiSkills.admin.getByShortId(c.req.param("skillId")!);
+      if (!skill) return notFound(c, "Skill");
+      const projects = await aiSkills.admin.linkedProjects(skill.id,c.get("accessSubject") ?? null);
+      return respond(c,ok({ projects:projects.map(project=>({id:project.shortId,name:project.name})) }));
+    })
     .get("/:skillId/access", async (c) => {
       const skill = await aiSkills.admin.getByShortId(c.req.param("skillId")!);
       return skill ? respond(c, ok({ access: await aiSkills.admin.listAccess(skill.id) })) : notFound(c, "Skill");

package/src/api/admin-ai-usage.ts

@@ -2,8 +2,8 @@ import { Hono, type MiddlewareHandler } from "hono";
 import { describeRoute } from "hono-openapi";
 import { z } from "zod";
 import { aiUsage } from "../ai/usage";
+import { type AuthContext, auth, err, fail, ok, respond, v } from "../server";
 import { AiUsageQuerySchema } from "../shared/ai-usage";
-import { auth, type AuthContext, v, respond, ok, fail, err } from "../server";
 
 export const createAdminAiUsageRoutes = (
   authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin"),
@@ -32,7 +32,7 @@ export const createAdminAiUsageRoutes = (
     .get(
       "/runs/:kind/:id",
       describeRoute({ summary: "Read an AI run and its stored error", tags: ["Admin AI usage"] }),
-      v("param", z.object({ kind: z.enum(["chat", "background", "tool"]), id: z.uuid() })),
+      v("param", z.object({ kind: z.enum(["chat", "background"]), id: z.uuid() })),
       async (c) => {
         const { kind, id } = c.req.valid("param");
         const result = await service.detail(kind, id);

package/src/api/admin-core-settings.ts

@@ -31,6 +31,8 @@ import { GotenbergRenderError, testGotenberg } from "../services/pdf";
 import * as settings from "../services/settings";
 import { SETTINGS_MAP, validateSettingValue } from "../services/settings/defaults";
 
+import { invalidateSettingsCacheForAdmin } from "../services/settings/store";
+
 const BulkSaveSchema = z.union([
   z
     .object({
@@ -58,6 +60,7 @@ const AI_PROFILES_KEY = "ai.model_profiles_json";
 const AI_ENABLED_KEY = "ai.enabled";
 const AI_DEFAULT_MODEL_KEY = "ai.default_model_id";
 const AI_BACKGROUND_MODEL_KEY = "ai.background_model_id";
+const AI_AUDIO_MODEL_KEY = "ai.audio_model_id";
 const AI_VISION_MODEL_KEY = "ai.vision_model_id";
 const AI_WORKFLOW_MODEL_KEY = "ai.workflow_model_id";
 const AI_CONFIGURATION_KEYS = new Set([
@@ -65,6 +68,7 @@ const AI_CONFIGURATION_KEYS = new Set([
   AI_DEFAULT_MODEL_KEY,
   AI_BACKGROUND_MODEL_KEY,
   AI_VISION_MODEL_KEY,
+  AI_AUDIO_MODEL_KEY,
   AI_WORKFLOW_MODEL_KEY,
   AI_PROFILES_KEY,
 ]);
@@ -116,6 +120,7 @@ const prepareAiSettingsMutation = async (
     currentDefaultModelId,
     currentBackgroundModelId,
     currentVisionModelId,
+    currentAudioModelId,
     currentWorkflowModelId,
     currentProfilesJson,
   ] = await Promise.all([
@@ -123,6 +128,7 @@ const prepareAiSettingsMutation = async (
     settings.get<string>(AI_DEFAULT_MODEL_KEY),
     settings.get<string>(AI_BACKGROUND_MODEL_KEY),
     settings.get<string>(AI_VISION_MODEL_KEY),
+    settings.get<string>(AI_AUDIO_MODEL_KEY),
     settings.get<string>(AI_WORKFLOW_MODEL_KEY),
     settings.get<string>(AI_PROFILES_KEY),
   ]);
@@ -162,6 +168,7 @@ const prepareAiSettingsMutation = async (
     enabled: nextEnabled,
     defaultModelId: String(valueAfterMutation(AI_DEFAULT_MODEL_KEY, currentDefaultModelId ?? "", updates, resets)),
     backgroundModelId: String(valueAfterMutation(AI_BACKGROUND_MODEL_KEY, currentBackgroundModelId ?? "", updates, resets)),
+    audioModelId: String(valueAfterMutation(AI_AUDIO_MODEL_KEY, currentAudioModelId ?? "", updates, resets)),
     visionModelId: String(valueAfterMutation(AI_VISION_MODEL_KEY, currentVisionModelId ?? "", updates, resets)),
     workflowModelId: String(valueAfterMutation(AI_WORKFLOW_MODEL_KEY, currentWorkflowModelId ?? "", updates, resets)),
     profiles: nextParsed.profiles,
@@ -184,6 +191,24 @@ const invalidateCommittedSettings = async (keys: readonly string[]): Promise<voi
 const liveSettingKeys = async () => (await listApps()).flatMap((app) => [...(app.settingKeys ?? [])]);
 
 const app = new Hono<AuthContext>()
+  .get("/web-vitals", auth.requireRole("admin"), async (c) =>
+    c.json({ enabled: (await settings.get("observability.web_vitals.enabled")) === true }),
+  )
+  .delete(
+    "/cache",
+    auth.requireRole("admin"),
+    describeRoute({
+      tags: ["Administration"],
+      summary: "Invalidate registered settings cache",
+      ...requiresAdmin,
+      responses: { 200: jsonResponse(z.object({ success: z.literal(true) }), "Cache invalidated") },
+    }),
+    async (c) => {
+      await invalidateSettingsCacheForAdmin(c.get("user"), await liveSettingKeys());
+      c.header("Cache-Control", "no-store");
+      return c.json({ success: true as const });
+    },
+  )
   .get(
     "/documentation",
     auth.requireRole("admin"),

package/src/api/admin-identity.ts

@@ -1,7 +1,9 @@
 import { fail, ok } from "@k2b/stdlib";
 import type { MiddlewareHandler } from "hono";
 import { Hono } from "hono";
+import { describeRoute } from "hono-openapi";
 import { z } from "zod";
+import { listApps } from "../_internal/registry";
 import { CapabilityAppIdSchema } from "../contracts/capabilities";
 import { type AuthContext, auth, err, respond, v } from "../server";
 import { getIdentitySigningKeyStatus, identityMetrics, revokeIdentitySigningKey, rewrapIdentitySigningKeys } from "../services/identity";
@@ -40,6 +42,7 @@ const MandateListQuerySchema = z
   .strict();
 
 type IdentityAdminDependencies = {
+  apps: () => Promise<Array<{ id: string; name: string }>>;
   status: typeof getIdentitySigningKeyStatus;
   rewrap: typeof rewrapIdentitySigningKeys;
   revoke: typeof revokeIdentitySigningKey;
@@ -49,6 +52,7 @@ type IdentityAdminDependencies = {
 };
 
 const dependencies: IdentityAdminDependencies = {
+  apps: async () => (await listApps()).map(({ id, name }) => ({ id, name })),
   status: getIdentitySigningKeyStatus,
   rewrap: rewrapIdentitySigningKeys,
   revoke: revokeIdentitySigningKey,
@@ -63,60 +67,96 @@ export const createAdminIdentityRoutes = (
 ) =>
   new Hono<AuthContext>()
     .use(authenticate)
-    .post("/workloads/:appId/credentials", v("param", WorkloadAppParamsSchema), v("json", WorkloadCredentialInputSchema), async (c) =>
-      respond(
-        c,
-        async () => {
-          const { appId } = c.req.valid("param");
-          const input = c.req.valid("json");
-          const actor = c.get("user");
-          const account = await service.serviceAccounts.getOrCreateResourceBound({
-            name: `${appId} workload`,
-            appId,
-            resourceType: "cloud.app",
-            resourceId: appId,
-            createdBy: actor.id,
-          });
-          if (!account.ok) return fail(account.error);
+    .use("*", async (c, next) => {
+      c.header("Cache-Control", "no-store");
+      await next();
+    })
+    .get(
+      "/workloads",
+      describeRoute({ tags: ["App credentials"], summary: "List registered applications for workload credentials" }),
+      async (c) => c.json(await service.apps()),
+    )
+    .get(
+      "/workloads/credentials",
+      describeRoute({ tags: ["App credentials"], summary: "List credential metadata across applications without secrets" }),
+      v("query", WorkloadCredentialListQuerySchema),
+      async (c) =>
+        c.json(
+          await service.credentials.listOverview({
+            pagination: c.req.valid("query"),
+            filter: { serviceAccountKind: "resource_bound", resourceType: "cloud.app" },
+          }),
+        ),
+    )
+    .post(
+      "/workloads/:appId/credentials",
+      describeRoute({ tags: ["App credentials"], summary: "Create an app-bound credential; return its token once" }),
+      v("param", WorkloadAppParamsSchema),
+      v("json", WorkloadCredentialInputSchema),
+      async (c) =>
+        respond(
+          c,
+          async () => {
+            const { appId } = c.req.valid("param");
+            const input = c.req.valid("json");
+            const actor = c.get("user");
+            const account = await service.serviceAccounts.getOrCreateResourceBound({
+              name: `${appId} workload`,
+              appId,
+              resourceType: "cloud.app",
+              resourceId: appId,
+              createdBy: actor.id,
+            });
+            if (!account.ok) return fail(account.error);
 
-          // The raw token intentionally appears only in this one create response.
-          return service.credentials.createResourceApiToken({
-            serviceAccountId: account.data.id,
-            actor,
-            name: input.name,
-            scopes: input.scopes,
-            expiresAt: input.expiresAt,
-          });
-        },
-        201,
-      ),
+            // The raw token intentionally appears only in this one create response.
+            return service.credentials.createResourceApiToken({
+              serviceAccountId: account.data.id,
+              actor,
+              name: input.name,
+              scopes: input.scopes,
+              expiresAt: input.expiresAt,
+            });
+          },
+          201,
+        ),
     )
-    .get("/workloads/:appId/credentials", v("param", WorkloadAppParamsSchema), v("query", WorkloadCredentialListQuerySchema), async (c) => {
-      const { appId } = c.req.valid("param");
-      return c.json(
-        await service.credentials.listOverview({
-          pagination: c.req.valid("query"),
-          filter: { serviceAccountKind: "resource_bound", appId, resourceType: "cloud.app", resourceId: appId },
-        }),
-      );
-    })
-    .delete("/workloads/:appId/credentials/:credentialId", v("param", WorkloadCredentialParamsSchema), async (c) =>
-      respond(c, async () => {
-        const { appId, credentialId } = c.req.valid("param");
-        const credential = await service.credentials.getOverview({ id: credentialId });
-        if (
-          !credential ||
-          credential.owner.type !== "resource" ||
-          credential.owner.appId !== appId ||
-          credential.owner.resourceType !== "cloud.app" ||
-          credential.owner.resourceId !== appId
-        ) {
-          return fail(err.notFound("Workload credential"));
-        }
+    .get(
+      "/workloads/:appId/credentials",
+      describeRoute({ tags: ["App credentials"], summary: "List app credential metadata without secrets" }),
+      v("param", WorkloadAppParamsSchema),
+      v("query", WorkloadCredentialListQuerySchema),
+      async (c) => {
+        const { appId } = c.req.valid("param");
+        return c.json(
+          await service.credentials.listOverview({
+            pagination: c.req.valid("query"),
+            filter: { serviceAccountKind: "resource_bound", appId, resourceType: "cloud.app", resourceId: appId },
+          }),
+        );
+      },
+    )
+    .delete(
+      "/workloads/:appId/credentials/:credentialId",
+      describeRoute({ tags: ["App credentials"], summary: "Revoke one exact app credential" }),
+      v("param", WorkloadCredentialParamsSchema),
+      async (c) =>
+        respond(c, async () => {
+          const { appId, credentialId } = c.req.valid("param");
+          const credential = await service.credentials.getOverview({ id: credentialId });
+          if (
+            !credential ||
+            credential.owner.type !== "resource" ||
+            credential.owner.appId !== appId ||
+            credential.owner.resourceType !== "cloud.app" ||
+            credential.owner.resourceId !== appId
+          ) {
+            return fail(err.notFound("Workload credential"));
+          }
 
-        const revoked = await service.credentials.revoke({ credentialId, actor: c.get("user") });
-        return revoked.ok ? ok({ revoked: true as const }) : revoked;
-      }),
+          const revoked = await service.credentials.revoke({ credentialId, actor: c.get("user") });
+          return revoked.ok ? ok({ revoked: true as const }) : revoked;
+        }),
     )
     .get("/mandates", v("query", MandateListQuerySchema), async (c) => {
       const query = c.req.valid("query");

package/src/api/admin-rail.ts

@@ -0,0 +1,58 @@
+import { Hono, type MiddlewareHandler } from "hono";
+import { HTTPException } from "hono/http-exception";
+import { bodyLimit } from "hono/body-limit";
+import { describeRoute } from "hono-openapi";
+import { RailAdminSchema, RailAdminInputSchema } from "../contracts/rail-admin";
+import { RAIL_PREFERENCES_MAX_BYTES } from "../contracts/rail-preferences";
+import { type AuthContext, auth, jsonResponse, requiresAdmin, v } from "../server";
+import { RailAdminError, railShortcuts } from "../services/rail-shortcuts";
+
+export const createAdminRailRoutes = (service = railShortcuts, authenticate: MiddlewareHandler<AuthContext> = auth.requireRole("admin")) =>
+  new Hono<AuthContext>()
+    .use("*", authenticate)
+    .onError((error, c) => {
+      if (error instanceof RailAdminError) return c.json({ message: error.message }, error.status);
+      if (error instanceof HTTPException) return error.getResponse();
+      throw error;
+    })
+    .use("*", async (c, next) => {
+      c.header("Cache-Control", "no-store");
+      await next();
+    })
+    .delete(
+      "/cache",
+      describeRoute({
+        tags: ["Admin app bar"],
+        summary: "Invalidate app bar caches for all users",
+        ...requiresAdmin,
+        responses: { 204: { description: "Caches invalidated; rebuilt on the next read" } },
+      }),
+      async (c) => {
+        await service.invalidateCache(c.get("user"));
+        return c.body(null, 204);
+      },
+    )
+    .get(
+      "/",
+      describeRoute({
+        tags: ["Admin app bar"],
+        summary: "Read global app bar shortcuts and audiences",
+        ...requiresAdmin,
+        responses: { 200: jsonResponse(RailAdminSchema, "Global app bar configuration") },
+      }),
+      async (c) => c.json(await service.list(c.get("user"))),
+    )
+    .put(
+      "/",
+      describeRoute({
+        tags: ["Admin app bar"],
+        summary: "Save global app bar shortcuts and audiences",
+        ...requiresAdmin,
+        responses: { 200: jsonResponse(RailAdminSchema, "Saved configuration"), 409: { description: "Configuration changed" } },
+      }),
+      bodyLimit({ maxSize: RAIL_PREFERENCES_MAX_BYTES }),
+      v("json", RailAdminInputSchema),
+      async (c) => c.json(await service.save(c.get("user"), c.req.valid("json"))),
+    );
+
+export default createAdminRailRoutes();

package/src/api/announcements.ts

@@ -44,6 +44,20 @@ export const announcementRoutes = new Hono<AuthContext>().get(
 
 export const adminAnnouncementRoutes = new Hono<AuthContext>()
   .use(auth.requireRole("admin"))
+  .delete(
+    "/cache",
+    describeRoute({
+      tags: ["Admin Announcements"],
+      summary: "Invalidate announcement cache",
+      ...requiresAdmin,
+      responses: { 200: jsonResponse(z.object({ success: z.literal(true) }), "Cache invalidated") },
+    }),
+    async (c) => {
+      await announcements.admin.invalidateCache(c.get("user"));
+      c.header("Cache-Control", "no-store");
+      return c.json({ success: true as const });
+    },
+  )
   .get(
     "/",
     describeRoute({