@k2b/cloud 0.7.0 → 0.9.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@k2b/cloud",
-  "version": "0.7.0",
-  "description": "Modular Hono+SolidJS framework for building per-app docker services behind a dynamic gateway. Powers cloud.stuve-ulm.de.",
+  "version": "0.9.0",
+  "description": "Application platform library for independently deployed Hono and SolidJS services behind a dynamic gateway.",
   "license": "AGPL-3.0-or-later",
   "repository": {
     "type": "git",
@@ -18,6 +18,7 @@
     "!src/**/*.test.ts",
     "!src/**/*.test.tsx",
     "!src/**/*.integration.test.ts",
+    "!src/**/*.test-fixture.ts",
     "!scripts/**/*.test.ts",
     "!scripts/runtime-recovery-*.ts"
   ],
@@ -85,7 +86,7 @@
   "scripts": {
     "test": "bun test --isolate --path-ignore-patterns '**/*.behavior.test.tsx' --path-ignore-patterns '**/*.dom.test.tsx' && bun run test:dom",
     "test:dom": "bun test --isolate --conditions=browser --preload ../ui/test/solid-dom-preload.ts behavior.test.tsx dom.test.tsx",
-    "typecheck": "tsc -p tsconfig.json --noEmit --pretty false 2>&1 | grep -v node_modules | (! grep -q 'error TS')"
+    "typecheck": "tsc -p tsconfig.json --noEmit --pretty false"
   },
   "dependencies": {
     "@firecrawl/anydoc": "0.1.9",
@@ -97,7 +98,7 @@
     "@tailwindcss/typography": "0.5.20",
     "@k2b/nessi": "0.12.0",
     "@k2b/ssr": "0.14.0",
-    "@k2b/ui": "0.3.0",
+    "@k2b/ui": "0.4.1",
     "@k2b/stdlib": "0.25.0",
     "@k2b/sync": "6.4.0",
     "@nats-io/transport-node": "3.4.0",

package/scripts/README.md

@@ -0,0 +1,10 @@
+# Cloud platform scripts
+
+- `build.ts` — production build for one Cloud app (`APP_ID`); used by the Dockerfiles and `bun run build` targets.
+- `preload.ts` — dev-mode preload that registers the SSR plugin and builds CSS before app code loads.
+- `build-pdf-renderer.ts` — packages the PDF decoder and native assets for bundles that import PDF vision.
+- `app-favicon.ts` — generates app favicons from Tabler icons; imported by `build.ts` and `preload.ts`.
+- `browser-performance.ts` — bundles the web-vitals browser asset for core; imported by `build.ts` and `preload.ts`.
+- `runtime-recovery-acceptance.ts` — shared-runtime recovery acceptance on disposable Docker containers: `bun packages/cloud/scripts/runtime-recovery-acceptance.ts` (also `bun run test:runtime-recovery`).
+- `runtime-recovery-worker.ts` — the containerized fixture started by `runtime-recovery-acceptance.ts`; not run directly.
+- `sync-recovery-smoke.ts` — two-phase NATS recovery smoke: `bun packages/cloud/scripts/sync-recovery-smoke.ts prepare --namespace cloud-recovery-smoke-<unique>`, restart the fleet, then `... recover --namespace <same>`.

package/scripts/build.ts

@@ -17,6 +17,7 @@
  *   _ssr/<island>.js     hydration bundles (auto-emitted by the SSR plugin)
  *   public/<id>/app.css  Tailwind, if the app has src/styles/app.css
  *   public/<id>/...      anything from <appDir>/public/
+ *   assets/...           anything from <appDir>/src/assets/ (appAssetPath)
  *
  * If the app needs additional artefacts (core's global.css, logo, katex),
  * it ships a `scripts/build-extras.ts` that this script runs at the end.
@@ -47,6 +48,10 @@ const release = process.env.CLOUD_RELEASE?.trim() || "local";
 if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(release)) {
   throw new Error(`Invalid CLOUD_RELEASE: ${JSON.stringify(release)}`);
 }
+const version = process.env.CLOUD_VERSION?.trim() || "0.0.0-local";
+if (!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(version)) {
+  throw new Error(`Invalid CLOUD_VERSION: ${JSON.stringify(version)}`);
+}
 const syncPackagePath = Bun.resolveSync("@k2b/sync/package.json", frameworkDir);
 const syncPackage = JSON.parse(await readFile(syncPackagePath, "utf8")) as {
   version?: unknown;
@@ -121,9 +126,11 @@ try {
     minify: true,
     metafile: true,
     define: {
+      __CLOUD_VERSION__: JSON.stringify(version),
       __CLOUD_RELEASE__: JSON.stringify(release),
       __CLOUD_SYNC_VERSION__: JSON.stringify(syncVersion),
       __CLOUD_PDF_RENDER_WORKER__: JSON.stringify("./pdf-render/worker.js"),
+      __CLOUD_APP_ASSETS__: JSON.stringify("./assets/"),
     },
     plugins: [(app?.plugin ?? plugin)()],
   });
@@ -134,7 +141,7 @@ if (!server.success) {
   for (const m of server.logs) console.error(m);
   throw new Error("Server bundle failed");
 }
-if (Object.keys(server.metafile?.inputs ?? {}).some(path => path.endsWith("/ai/pdf-render.ts"))) {
+if (Object.keys(server.metafile?.inputs ?? {}).some((path) => path.endsWith("/ai/pdf-render.ts"))) {
   await buildPdfRenderer(dist);
 }
 
@@ -162,6 +169,12 @@ if (existsSync(appPublic)) {
   await cp(appPublic, resolve(distPublic, appId), { recursive: true });
 }
 
+// Server-side assets the bundle reads through appAssetPath().
+const appAssets = resolve(appDir, "src/assets");
+if (existsSync(appAssets)) {
+  await cp(appAssets, resolve(dist, "assets"), { recursive: true });
+}
+
 if (appId !== "core" && app) {
   await writeAppFavicon({
     publicDir: distPublic,

package/scripts/preload.ts

@@ -132,6 +132,13 @@ if (appId === "core" && existsSync(globalCssEntry)) {
 const appPublicDir = resolve(publicDir, appId);
 await mkdir(appPublicDir, { recursive: true });
 
+// Static assets from <appDir>/public, same as step 3 of the production build.
+const appPublicSource = resolve(appDir, "public");
+// A standalone application's public directory can be the serving root itself; never copy a tree into itself.
+if (existsSync(appPublicSource) && appPublicSource !== publicDir && !appPublicDir.startsWith(`${appPublicSource}/`)) {
+  await cp(appPublicSource, appPublicDir, { recursive: true });
+}
+
 if (appId !== "core" && app) {
   await writeAppFavicon({
     publicDir,

package/scripts/sync-recovery-smoke.ts

@@ -1,15 +1,17 @@
 /**
  * Isolated two-process recovery acceptance for the local NATS cluster.
  *
- * SYNC_RECOVERY_NAMESPACE=cloud-recovery-smoke-<unique> bun packages/cloud/scripts/sync-recovery-smoke.ts prepare
+ * bun packages/cloud/scripts/sync-recovery-smoke.ts prepare --namespace cloud-recovery-smoke-<unique>
  * Stop the application fleet across the printed nextTick boundary, keeping NATS up.
  * Restart the fleet, then run the same command with `recover`.
  * No provider or application-domain effects; successful recovery deletes only
  * the exact test streams after checking their broker identity metadata.
  */
-import { env } from "../src/config/env";
+
+import { parseArgs } from "node:util";
 import { createSync, type SyncResourceSummary, type Worker } from "@k2b/sync";
 import { connect, type NatsConnection } from "@nats-io/transport-node";
+import { env } from "../src/config/env";
 
 const APPLICATION = "cloud-recovery-smoke";
 const JOB_ID = "restart-job";
@@ -49,11 +51,24 @@ const removeTestStreams = async (connection: NatsConnection, namespace: string,
 };
 
 export const main = async (): Promise<void> => {
-  const phase = Bun.argv[2];
+  const { values: options, positionals } = parseArgs({
+    args: Bun.argv.slice(2),
+    allowPositionals: true,
+    options: { namespace: { type: "string" }, help: { type: "boolean", default: false } },
+  });
+  if (options.help) {
+    console.log(`Usage: bun packages/cloud/scripts/sync-recovery-smoke.ts <prepare|recover> --namespace cloud-recovery-smoke-<unique>
+
+Two-phase recovery acceptance against the application's NATS servers (NATS_SERVERS, default nats://127.0.0.1:4222).
+Run "prepare", restart the application fleet while NATS stays up, then run "recover" with the same namespace.
+`);
+    return;
+  }
+  const phase = positionals[0];
   check(phase === "prepare" || phase === "recover", "Pass prepare or recover");
-  const namespace = process.env.SYNC_RECOVERY_NAMESPACE?.trim() ?? "";
-  check(/^cloud-recovery-smoke-[A-Za-z0-9_-]{6,60}$/.test(namespace), "Set a unique SYNC_RECOVERY_NAMESPACE=cloud-recovery-smoke-<suffix>");
-  const servers = (process.env.NATS_SERVERS ?? "nats://127.0.0.1:4222")
+  const namespace = options.namespace?.trim() ?? "";
+  check(/^cloud-recovery-smoke-[A-Za-z0-9_-]{6,60}$/.test(namespace), "Pass a unique --namespace cloud-recovery-smoke-<suffix>");
+  const servers = (env.NATS_SERVERS ?? "nats://127.0.0.1:4222")
     .split(",")
     .map((value) => value.trim())
     .filter(Boolean);

package/src/_internal/build-metadata.ts

@@ -1,9 +1,16 @@
 import type { AppRuntimeMetadata } from "../contracts/registry";
 
+declare const __CLOUD_VERSION__: string;
 declare const __CLOUD_RELEASE__: string;
 declare const __CLOUD_SYNC_VERSION__: string;
 
-export const appRuntimeMetadata: AppRuntimeMetadata = {
+/** Cloud version and release label baked into the bundle by `scripts/build.ts`. */
+export const buildMetadata = {
+  version: typeof __CLOUD_VERSION__ === "string" ? __CLOUD_VERSION__ : "0.0.0-local",
   release: typeof __CLOUD_RELEASE__ === "string" ? __CLOUD_RELEASE__ : "development",
+} as const;
+
+export const appRuntimeMetadata: AppRuntimeMetadata = {
+  ...buildMetadata,
   syncVersion: typeof __CLOUD_SYNC_VERSION__ === "string" ? __CLOUD_SYNC_VERSION__ : "unknown",
 };

package/src/_internal/capabilities.ts

@@ -10,9 +10,9 @@ import {
   type CapabilityActionManifest,
   type CapabilityActionReviewResult,
   CapabilityActionReviewSchema,
-  type CapabilityDefinitions,
   type CapabilityCommandManifest,
   CapabilityCommandManifestSchema,
+  type CapabilityDefinitions,
   type CapabilityError,
   CapabilityErrorSchema,
   type CapabilityExecutionContext,
@@ -433,7 +433,11 @@ const compileOperationSchemas = (definition: CapabilityQueryDefinition | Capabil
     inputSchema,
     dataSchema,
     resultZodSchema,
-    schemaHash: capabilityHash({ inputSchema, dataSchema, ...(definition.stream ? { stream: { direction: definition.stream.direction, maxBytes: definition.stream.maxBytes } } : {}) }),
+    schemaHash: capabilityHash({
+      inputSchema,
+      dataSchema,
+      ...(definition.stream ? { stream: { direction: definition.stream.direction, maxBytes: definition.stream.maxBytes } } : {}),
+    }),
   };
 };
 
@@ -469,8 +473,13 @@ export const compileCapabilities = (appId: string, definitions: CapabilityDefini
   for (const [localId, definition] of Object.entries(definitions.queries ?? {}).sort(([left], [right]) => left.localeCompare(right))) {
     registerLocalId(localId, "Query");
     const label = `Query ${localId}`;
-    if (definition.stream && ((definition.stream.direction === "write" && !("idempotency" in definition)) || definition.stream.maxBytes <= 0)) throw new Error(`${label}: write streams require an Action and a positive byte budget`);
-    if (definition.stream?.direction === "write" && "idempotency" in definition && definition.idempotency !== "required") throw new Error(`${label}: write streams require idempotency`);
+    if (
+      definition.stream &&
+      ((definition.stream.direction === "write" && !("idempotency" in definition)) || definition.stream.maxBytes <= 0)
+    )
+      throw new Error(`${label}: write streams require an Action and a positive byte budget`);
+    if (definition.stream?.direction === "write" && "idempotency" in definition && definition.idempotency !== "required")
+      throw new Error(`${label}: write streams require idempotency`);
     const schemas = compileOperationSchemas(definition, label);
     if (definition.universalSearch) {
       const expectedInput = projectSchema(UniversalSearchInputSchema, "Universal Search input", "input");
@@ -540,8 +549,13 @@ export const compileCapabilities = (appId: string, definitions: CapabilityDefini
     if (definition.approval === "rememberable" && !definition.review) {
       throw new Error(`${label} must provide a review before approval can be remembered`);
     }
-    if (definition.stream && ((definition.stream.direction === "write" && !("idempotency" in definition)) || definition.stream.maxBytes <= 0)) throw new Error(`${label}: write streams require an Action and a positive byte budget`);
-    if (definition.stream?.direction === "write" && "idempotency" in definition && definition.idempotency !== "required") throw new Error(`${label}: write streams require idempotency`);
+    if (
+      definition.stream &&
+      ((definition.stream.direction === "write" && !("idempotency" in definition)) || definition.stream.maxBytes <= 0)
+    )
+      throw new Error(`${label}: write streams require an Action and a positive byte budget`);
+    if (definition.stream?.direction === "write" && "idempotency" in definition && definition.idempotency !== "required")
+      throw new Error(`${label}: write streams require idempotency`);
     const schemas = compileOperationSchemas(definition, label);
     const manifest = {
       localId,
@@ -736,13 +750,14 @@ export const parseCapabilityManifest = (value: unknown, expectedAppId: string):
       );
     }
     assertClosedObjectInput(inputSchema, `Operation ${operation.localId} input`);
-    if (
-      operation.stream?.direction === "write" &&
-      (!("idempotency" in operation) || operation.idempotency !== "required")
-    ) {
+    if (operation.stream?.direction === "write" && (!("idempotency" in operation) || operation.idempotency !== "required")) {
       throw new Error(`Operation ${operation.localId} write streams require an idempotent Action`);
     }
-    const expectedSchemaHash = capabilityHash({ inputSchema: operation.inputSchema, dataSchema: operation.dataSchema, ...(operation.stream ? { stream: operation.stream } : {}) });
+    const expectedSchemaHash = capabilityHash({
+      inputSchema: operation.inputSchema,
+      dataSchema: operation.dataSchema,
+      ...(operation.stream ? { stream: operation.stream } : {}),
+    });
     if (operation.schemaHash !== expectedSchemaHash)
       throw new Error(`Operation ${operation.localId} schemaHash does not match its schemas`);
     if ("universalSearch" in operation && operation.universalSearch) {
@@ -1086,7 +1101,15 @@ export const invokeCompiledCapability = async (params: {
       return normalizeProviderError(invoked.error, "Capability returned an invalid error", params.onUnexpectedError);
     }
     const stream = invoked.data.stream;
-    if (stream && (Buffer.byteLength(stream.id) > 2048 || !operation.definition.stream || stream.direction !== operation.definition.stream.direction || stream.size > operation.definition.stream.maxBytes || Date.parse(stream.expiresAt) <= Date.now() || Date.parse(stream.expiresAt) > Date.now() + 86_400_000))
+    if (
+      stream &&
+      (Buffer.byteLength(stream.id) > 2048 ||
+        !operation.definition.stream ||
+        stream.direction !== operation.definition.stream.direction ||
+        stream.size > operation.definition.stream.maxBytes ||
+        Date.parse(stream.expiresAt) <= Date.now() ||
+        Date.parse(stream.expiresAt) > Date.now() + 86_400_000)
+    )
       return invalidProviderError("Stream is outside its declared policy or 24 hour lifetime");
     const validated = validateCapabilityResult(params.compiled, operation, invoked.data, params.onUnexpectedError);
     return validated.ok

package/src/_internal/define-app.ts

@@ -1,6 +1,6 @@
-import { invokeCapabilityStream } from "./capability-streams";
 import { registerHelp } from "../services/help";
 import { preloadLayoutHelp } from "../ssr/help";
+import { invokeCapabilityStream } from "./capability-streams";
 import { bindProcessApplicationId, clearProcessApplicationId } from "./process-identity";
 /**
  * defineApp() — The single entry point for every cloud app.
@@ -72,8 +72,8 @@ import { compileCapabilities, invokeCompiledCapability, reviewCompiledCapability
 import { createHeartbeat } from "./heartbeat";
 import { compileHelp } from "./help";
 import { createPageResponses } from "./page-responses";
-import { getProcessSync, startProcessSync } from "./process-sync";
 import { configurePostgresApplicationName } from "./postgres-application-name";
+import { getProcessSync, startProcessSync } from "./process-sync";
 import { APP_READINESS_PATH, appReadinessResponse } from "./readiness";
 import { appRegistry, type CapabilityRegistryRecord, capabilityRegistry } from "./registry";
 import { ensureRuntimeWatcher, getCurrentRuntime, stopRuntimeWatcher } from "./runtime-watcher";
@@ -303,7 +303,7 @@ export const defineApp = <
   opts: AppOptions<S, N, AppId>,
 ): AppDefinition<S, N, AppId> => {
   configurePostgresApplicationName(opts.id);
-  const isDevelopment = process.env.NODE_ENV === "development";
+  const isDevelopment = env.IS_DEVELOPMENT;
   const notifications = bindNotificationDefinitions(opts.id, opts.notifications);
 
   // ── 0. Register declared settings into the runtime registry ──────────
@@ -321,7 +321,7 @@ export const defineApp = <
     dev: isDevelopment,
     verbose: true,
     rootDir,
-    componentRoots: [resolve(process.env.APP_DIR ?? rootDir, "src"), fileURLToPath(new URL("../", import.meta.url))],
+    componentRoots: [resolve(env.APP_DIR ?? rootDir, "src"), fileURLToPath(new URL("../", import.meta.url))],
     basePath: opts.basePath,
     template: ({ body, scripts, title, description, theme, lang, performanceRoute }) => {
       const themeFixed = theme !== undefined;
@@ -673,13 +673,30 @@ export const defineApp = <
             };
           });
         for (const kind of ["queries", "actions"] as const) {
-          server.post(`/api/_internal/capabilities/v1/streams/${kind}/:capabilityId/:verb`, capabilityAuth(kind), auth.requireOAuthScope(kind === "queries" ? "read" : "write", "admin"), async c => {
-            const actor = c.get("actor");
-            return invokeCapabilityStream({ compiled: compiledCapabilities, kind, localId: c.req.param("capabilityId") ?? "", verb: c.req.param("verb") ?? "", request: c.req.raw,
-              context: { actor, accessSubject: c.get("accessSubject"), user: actor.kind === "user" ? actor.user : actor.delegatedUser,
-                locale: resolveLocale(c.req.raw.headers, await get<string>("app.locale")),
-                requestId: normalizeInvocationRequestId(c.req.header("x-request-id")) ?? crypto.randomUUID(), origin: CapabilityOriginSchema.catch("http").parse(c.req.header(CAPABILITY_ORIGIN_HEADER)), signal: c.req.raw.signal } });
-          });
+          server.post(
+            `/api/_internal/capabilities/v1/streams/${kind}/:capabilityId/:verb`,
+            capabilityAuth(kind),
+            auth.requireOAuthScope(kind === "queries" ? "read" : "write", "admin"),
+            async (c) => {
+              const actor = c.get("actor");
+              return invokeCapabilityStream({
+                compiled: compiledCapabilities,
+                kind,
+                localId: c.req.param("capabilityId") ?? "",
+                verb: c.req.param("verb") ?? "",
+                request: c.req.raw,
+                context: {
+                  actor,
+                  accessSubject: c.get("accessSubject"),
+                  user: actor.kind === "user" ? actor.user : actor.delegatedUser,
+                  locale: resolveLocale(c.req.raw.headers, await get<string>("app.locale")),
+                  requestId: normalizeInvocationRequestId(c.req.header("x-request-id")) ?? crypto.randomUUID(),
+                  origin: CapabilityOriginSchema.catch("http").parse(c.req.header(CAPABILITY_ORIGIN_HEADER)),
+                  signal: c.req.raw.signal,
+                },
+              });
+            },
+          );
         }
         const capabilityReadScope = auth.requireOAuthScope("read", "admin");
         const capabilityWriteScope = auth.requireOAuthScope("write", "admin");

package/src/_internal/page-responses.ts

@@ -1,8 +1,8 @@
 import type { HtmlFn } from "@k2b/ssr";
 import type { Context } from "hono";
 import type { ClientErrorStatusCode, ServerErrorStatusCode } from "hono/utils/http-status";
-import { preloadLayoutAnnouncements } from "../server/middleware/settings";
 import { getLocale } from "../server/locale";
+import { preloadLayoutAnnouncements } from "../server/middleware/settings";
 import { createLoginRedirectUrl } from "../shared/redirect";
 import type { PageOptions } from "./define-app";
 

package/src/_internal/readiness.ts

@@ -1,3 +1,6 @@
+import { buildMetadata } from "./build-metadata";
+
 export const APP_READINESS_PATH = "/_cloud/ready";
 
-export const appReadinessResponse = (appId: string): Response => Response.json({ status: "ready", appId });
+export const appReadinessResponse = (appId: string): Response =>
+  Response.json({ status: "ready", appId, version: buildMetadata.version, release: buildMetadata.release });

package/src/_internal/runtime-context.ts

@@ -39,7 +39,7 @@ export const buildRuntimeFromRegistry = (entries: AppRegistryEntry[], capabiliti
       appearance: e.appearance,
       adminHref: e.nav?.adminHref,
       adminNav: e.adminNav?.map((group) => ({
-        ...(group.section ? {section:group.section} : {}),
+        ...(group.section ? { section: group.section } : {}),
         id: group.id,
         label: group.label,
         links: group.links.map((link) => ({ ...link })),

package/src/access/PermissionEditor.tsx

@@ -1,10 +1,10 @@
-import PrincipalPicker from "./PrincipalPicker";
 import { mutation } from "@k2b/stdlib/solid";
-import { Button, IconButton, Placeholder, prompts, SelectChip, Tooltip, useLocale } from "@k2b/ui";
+import { IconButton, Placeholder, prompts, SelectChip, Tooltip, useLocale } from "@k2b/ui";
 import { createSignal, For, Show } from "solid-js";
 import { CloudAvatar } from "../account/Avatar";
 import type { AccessEntry, PermissionLevel, Principal } from "../contracts/shared";
 import { accessMessages } from "./messages";
+import PrincipalPicker from "./PrincipalPicker";
 
 // ─────────────────────────────────────────────────────────────────────────
 // Public API
@@ -147,7 +147,8 @@ export default function PermissionEditor(props: PermissionEditorProps) {
   const canEdit = () => props.canEdit !== false;
   const allowPublic = () => props.allowPublic === true;
   const allowAuthenticated = () => props.allowAuthenticated !== false;
-  const allowed = (principal: Principal) => resolveAllowedLevels(typeof props.allowedLevels === "function" ? props.allowedLevels(principal) : props.allowedLevels, t());
+  const allowed = (principal: Principal) =>
+    resolveAllowedLevels(typeof props.allowedLevels === "function" ? props.allowedLevels(principal) : props.allowedLevels, t());
 
   // Defensive dev-warning: an empty allowedLevels array makes the editor
   // unable to grant anything.
@@ -229,12 +230,17 @@ export default function PermissionEditor(props: PermissionEditorProps) {
           level on pick. The user upgrades via the row pill if they want
           a higher level. KISS: one decision per step. */}
       <Show when={canEdit()}>
-        <PrincipalPicker existing={entries().map(e=>e.principal)} allowPublic={allowPublic()} allowAuthenticated={allowAuthenticated()} allowServiceAccounts={props.allowServiceAccounts}
-          disabled={busy()} onSelect={(principal,display)=>{
-            const permission=allowed(principal)[0]?.level;
-            if(permission&&!busy())grantMut.mutate({principal,permission,display});
-          }}/>
-
+        <PrincipalPicker
+          existing={entries().map((e) => e.principal)}
+          allowPublic={allowPublic()}
+          allowAuthenticated={allowAuthenticated()}
+          allowServiceAccounts={props.allowServiceAccounts}
+          disabled={busy()}
+          onSelect={(principal, display) => {
+            const permission = allowed(principal)[0]?.level;
+            if (permission && !busy()) grantMut.mutate({ principal, permission, display });
+          }}
+        />
       </Show>
     </div>
   );

package/src/access/PrincipalPicker.tsx

@@ -91,9 +91,15 @@ export default function PrincipalPicker(props: {
   return (
     <Combobox
       disabled={props.disabled}
-      placeholder={props.allowAuthenticated !== false || props.allowPublic
-        ? (props.allowServiceAccounts ? t().addAll : t().addAudience)
-        : (props.allowServiceAccounts ? t().addService : t().addBasic)}
+      placeholder={
+        props.allowAuthenticated !== false || props.allowPublic
+          ? props.allowServiceAccounts
+            ? t().addAll
+            : t().addAudience
+          : props.allowServiceAccounts
+            ? t().addService
+            : t().addBasic
+      }
       fetchData={load}
       onSelect={(option) => {
         const principal = principals.get(option.id);

package/src/access/ResourceApiKeys.tsx

@@ -1,6 +1,6 @@
 import { dates } from "@k2b/stdlib";
 import { mutation as mutations } from "@k2b/stdlib/solid";
-import { NoticeCard, Button, CopyButton, DateTimePicker, Placeholder, prompts, Select, Tag, TextInput, useLocale } from "@k2b/ui";
+import { Button, CopyButton, DateTimePicker, NoticeCard, Placeholder, prompts, Select, Tag, TextInput, useLocale } from "@k2b/ui";
 import { createEffect, createSignal, For, Show } from "solid-js";
 import type { PermissionLevel, ServiceAccountCredential } from "../contracts/shared";
 import { accessMessages } from "./messages";

package/src/access/ui.ts

@@ -8,11 +8,10 @@
 
 export type { AllowedLevel, GrantableLevel } from "./PermissionEditor";
 export { default as PermissionEditor } from "./PermissionEditor";
+export { default as PrincipalPicker, principalKey } from "./PrincipalPicker";
 export type {
   ResourceApiKey,
   ResourceApiKeyPermissionOption,
   ResourceApiKeysProps,
 } from "./ResourceApiKeys";
 export { default as ResourceApiKeys } from "./ResourceApiKeys";
-
-export { default as PrincipalPicker, principalKey } from "./PrincipalPicker";

package/src/ai/admin.ts

@@ -1,5 +1,5 @@
-export { aiQuotas, AiQuotaError } from "./quotas";
-export { quotaReport, quotaAdminConfig } from "./quota-report";
+export { quotaAdminConfig, quotaReport } from "./quota-report";
+export { AiQuotaError, aiQuotas } from "./quotas";
 /** Server-only AI administration and usage accounting. */
 
 export { type AiModelAccessDraft, type AiModelAccessMap, type AiModelAccessState, aiModelAccess } from "./model-access";

package/src/ai/assistant-models.ts

@@ -1,8 +1,8 @@
-import { resolveAiAudioModel } from "./transcription";
 import type { AccessSubject, RequestActor } from "../server";
 import { aiModelAccess } from "./model-access";
 import { personalAiModelPolicy } from "./personal-agent";
 import { listAiModels, toPublicAiSettingsState } from "./settings";
+import { resolveAiAudioModel } from "./transcription";
 import type { AiChatTurnRunConfig, AiModelPolicy, AiSettingsError } from "./types";
 
 export const aiChatAccessSubject = (actor: RequestActor | undefined): AccessSubject | null => {

package/src/ai/audio-tool.ts

@@ -4,7 +4,7 @@ import { aiProjectFilePathFromMount } from "./file-mount";
 import { aiFileStore, normalizeAiFilePath } from "./files-store";
 import { aiModelAccess } from "./model-access";
 import { defineAiTool } from "./tools";
-import { resolveAiAudioModel, runAiTranscription, type AiResolvedAudioModel } from "./transcription";
+import { type AiResolvedAudioModel, resolveAiAudioModel, runAiTranscription } from "./transcription";
 
 export const CloudAiTranscribeAudioInputSchema = z.object({
   path: z.string().trim().min(1).describe("Absolute path of the stored audio file. Project files are below /project."),