@k2b/cloud 0.7.0 → 0.9.0

package/src/services/ipa/sync.ts

@@ -6,9 +6,9 @@ import { applyIpaAccountTransitionPolicy } from "../accounts/switching";
 import { getFreeIpaConfig } from "../freeipa-config";
 import { logger } from "../logging";
 import { session } from "../session";
-import { mirrorIpaPosix } from "./posix";
 import * as settings from "../settings";
 import { buildEffectiveIpaGroupsByUid } from "./effective-groups";
+import { mirrorIpaPosix } from "./posix";
 import { calculateIpaProfileFromEffectiveProjection, getEffectiveUserGroups } from "./profile";
 import { createIpaRuntimeCheckpoint, type IpaSyncRuntime } from "./runtime";
 import { assessIpaDestructionGuard, formatIpaDestructionGuardFailure, readCompleteIpaList, selectStaleLocalIpaRows } from "./sync-planning";

package/src/services/logging/index.ts

@@ -1,10 +1,10 @@
-import { readWebVitals } from "./web-vitals";
 import { sql } from "bun";
 import type { PaginationParams } from "../../contracts/shared";
 import { escapeLikePattern, parsePgJsonRecord, toPgTextArray } from "../postgres";
 import { registerSettings } from "../settings/defaults";
 import { redactMetadata } from "./redaction";
 import { observeSyncEvent, TRACE_STUCK_AFTER_MS, trace } from "./trace";
+import { readWebVitals } from "./web-vitals";
 
 export type {
   TraceAttributes,

package/src/services/logging/trace.ts

@@ -1,7 +1,7 @@
-import { getProcessApplicationId } from "../../_internal/process-identity";
 import { createHash, randomBytes } from "node:crypto";
 import type { SyncEvent } from "@k2b/sync";
 import { sql } from "bun";
+import { getProcessApplicationId } from "../../_internal/process-identity";
 import type { PaginationParams } from "../../contracts/shared";
 import { escapeLikePattern, parsePgJsonRecord, toPgTextArray } from "../postgres";
 import { isSensitiveMetadataKey, REDACTED, redactMetadata } from "./redaction";

package/src/services/mandates/index.ts

@@ -9,9 +9,9 @@ import { parsePgJsonValue } from "../postgres";
 import { isMandatePolicyNarrowing, type MandatePolicyV1, MandatePolicyV1Schema, mandatePolicyAllows, parseMandatePolicy } from "./policy";
 
 export {
-  CapabilityGrantsSchema,
-  CapabilityGrantSchema,
   type CapabilityGrant,
+  CapabilityGrantSchema,
+  CapabilityGrantsSchema,
   capabilityGrantAllows,
   isMandatePolicyNarrowing,
   MANDATE_POLICY_MAX_IDENTIFIERS,
@@ -20,6 +20,9 @@ export {
   MandatePolicyV1Schema,
   mandatePolicyAllows,
   parseMandatePolicy,
+  type TaskGrant,
+  TaskGrantSchema,
+  TaskGrantsSchema,
 } from "./policy";
 
 export type MandateState = "active" | "paused" | "revoked";

package/src/services/mandates/policy.ts

@@ -12,6 +12,8 @@ const identifierList = <T extends z.ZodType<string>>(schema: T) =>
 
 const operationSchema = z.union([
   z.literal("search.query"),
+  z.literal("runtime.http"),
+  z.literal("runtime.database"),
   z.string().refine((value) => {
     const [prefix, localId, extra] = value.split(":");
     return (
@@ -36,6 +38,79 @@ export const CapabilityGrantSchema = z
 export const CapabilityGrantsSchema = z.array(CapabilityGrantSchema).max(MANDATE_POLICY_MAX_IDENTIFIERS / 2);
 export type CapabilityGrant = z.output<typeof CapabilityGrantSchema>;
 
+const httpsUrl = z
+  .string()
+  .url()
+  .max(2000)
+  .refine((value) => {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password && !url.hash;
+  }, "Use HTTPS without credentials or fragment");
+export const TaskGrantSchema = z.union([
+  CapabilityGrantSchema,
+  z
+    .object({
+      kind: z.literal("http").describe("Authorize scheduled Code Mode HTTP requests."),
+      fixedInput: z
+        .object({
+          origin: httpsUrl
+            .refine((value) => new URL(value).origin === value, "Use an exact origin without path")
+            .optional()
+            .describe("Exact HTTPS origin, without path, wildcard or trailing slash."),
+          url: httpsUrl.optional().describe("Exact full URL, including query parameters."),
+          method: z
+            .enum(["GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"])
+            .optional()
+            .describe("Exact HTTP method; omit to permit every supported method."),
+        })
+        .strict()
+        .default({})
+        .describe("Fixed input values. Omitted fields are unrestricted; empty input permits every supported target and operation."),
+    })
+    .strict(),
+  z
+    .object({
+      kind: z.literal("database").describe("Authorize scheduled Code Mode RSQL operations."),
+      fixedInput: z
+        .object({
+          resourceId: z.string().min(1).max(80).optional().describe("Exact Studio app ID whose database may be used."),
+          operation: z
+            .enum([
+              "connect",
+              "status",
+              "export",
+              "clear",
+              "reset",
+              "tables.list",
+              "tables.create",
+              "tables.update",
+              "tables.delete",
+              "schema.get",
+              "rows.list",
+              "rows.get",
+              "rows.insert",
+              "rows.update",
+              "rows.delete",
+              "query",
+            ])
+            .optional()
+            .describe("Exact database operation; connect needs its own grant when operation is fixed."),
+          table: z
+            .string()
+            .min(1)
+            .max(63)
+            .optional()
+            .describe("Exact table; applies to row and schema operations, not arbitrary SQL queries."),
+        })
+        .strict()
+        .default({})
+        .describe("Fixed input values. Omitted fields are unrestricted; empty input permits every supported target and operation."),
+    })
+    .strict(),
+]);
+export const TaskGrantsSchema = z.array(TaskGrantSchema).max(MANDATE_POLICY_MAX_IDENTIFIERS / 2);
+export type TaskGrant = z.output<typeof TaskGrantSchema>;
+
 const equalJson = (a: unknown, b: unknown): boolean => {
   if (a === b) return true;
   if (!a || !b || typeof a !== "object" || typeof b !== "object") return false;
@@ -66,7 +141,7 @@ export const MandatePolicyV1Schema = z
     apps: z.union([z.literal("*"), identifierList(CapabilityAppIdSchema)]),
     operations: z.union([z.literal("*"), identifierList(operationSchema)]),
     actions: z.enum(["deny", "require_approval", "preapproved"]),
-    grants: CapabilityGrantsSchema.optional(),
+    grants: TaskGrantsSchema.optional(),
   })
   .strict()
   .superRefine((policy, context) => {
@@ -107,11 +182,17 @@ export const isMandatePolicyNarrowing = (current: MandatePolicyV1, next: Mandate
   setAllows(current.apps, next.apps) &&
   setAllows(current.operations, next.operations) &&
   ACTION_AUTHORITY[next.actions] <= ACTION_AUTHORITY[current.actions] &&
-  (current.grants === undefined ||
-    (next.grants !== undefined &&
+  (current.grants === undefined
+    ? !next.grants?.some((grant) => grant.kind === "http" || grant.kind === "database")
+    : next.grants !== undefined &&
       next.grants.every((grant) =>
-        current.grants!.some((existing) => capabilityGrantAllows(existing, { ...grant, input: grant.fixedInput })),
-      )));
+        current.grants!.some((existing) => {
+          if (existing.kind !== grant.kind) return false;
+          if ("appId" in existing && "appId" in grant && (existing.appId !== grant.appId || existing.capabilityId !== grant.capabilityId))
+            return false;
+          return Object.entries(existing.fixedInput).every(([key, value]) => equalJson(value, Reflect.get(grant.fixedInput, key)));
+        }),
+      ));
 
 export const mandatePolicyAllows = (
   policy: MandatePolicyV1,
@@ -125,6 +206,23 @@ export const mandatePolicyAllows = (
 ): boolean => {
   if (policy.apps !== "*" && !policy.apps.includes(input.appId)) return false;
   if (policy.operations !== "*" && !policy.operations.includes(input.operation)) return false;
+  if (input.operation === "runtime.http" || input.operation === "runtime.database") {
+    const kind = input.operation === "runtime.http" ? "http" : "database";
+    return (
+      input.appId === "assistant" &&
+      !!policy.grants?.some(
+        (grant) =>
+          grant.kind === kind &&
+          Object.entries(grant.fixedInput).every(
+            ([key, value]) =>
+              input.input !== null &&
+              typeof input.input === "object" &&
+              Object.hasOwn(input.input, key) &&
+              equalJson(value, Reflect.get(input.input, key)),
+          ),
+      )
+    );
+  }
   if (policy.grants !== undefined) {
     const [operation, capabilityId] = input.operation.split(":");
     const kind =
@@ -136,7 +234,9 @@ export const mandatePolicyAllows = (
     if (
       !kind ||
       !capabilityId ||
-      !policy.grants.some((grant) => capabilityGrantAllows(grant, { appId: input.appId, capabilityId, kind, input: input.input }))
+      !policy.grants.some(
+        (grant) => "appId" in grant && capabilityGrantAllows(grant, { appId: input.appId, capabilityId, kind, input: input.input }),
+      )
     )
       return false;
     if (kind === "action" && input.capabilityApproval !== "none" && input.capabilityApproval !== "rememberable") return false;

package/src/services/notifications/batches.ts

@@ -786,4 +786,5 @@ export const __notificationBatchTest = {
   selectionHash,
   recipientHash,
   resolveCandidates,
+  processBatchChunk,
 };

package/src/services/pdf/gotenberg.ts

@@ -126,8 +126,9 @@ const fileName = (name: string) => {
 };
 
 function htmlForm(input: RenderHtmlToPdfInput, config: GotenbergConfig): FormData {
-  const total = [input.html, input.headerHtml ?? "", input.footerHtml ?? ""].reduce((sum, value) => sum + byteLength(value), 0)
-    + (input.assets ?? []).reduce((sum, asset) => sum + asset.data.size, 0);
+  const total =
+    [input.html, input.headerHtml ?? "", input.footerHtml ?? ""].reduce((sum, value) => sum + byteLength(value), 0) +
+    (input.assets ?? []).reduce((sum, asset) => sum + asset.data.size, 0);
   if (total > config.maxHtmlBytes) throw new GotenbergRenderError("html_too_large", "HTML and assets exceed the configured input budget.");
   const form = new FormData();
   form.append("files", new Blob([input.html], { type: "text/html" }), "index.html");
@@ -136,7 +137,8 @@ function htmlForm(input: RenderHtmlToPdfInput, config: GotenbergConfig): FormDat
   const names = new Set(["index.html", "header.html", "footer.html", "factur-x.xml"]);
   for (const asset of input.assets ?? []) {
     const name = fileName(asset.name);
-    if (names.has(name.toLowerCase())) throw new GotenbergRenderError("bad_input", "Asset filenames must be unique and cannot replace HTML documents.");
+    if (names.has(name.toLowerCase()))
+      throw new GotenbergRenderError("bad_input", "Asset filenames must be unique and cannot replace HTML documents.");
     names.add(name.toLowerCase());
     form.append("files", asset.data, name);
   }
@@ -151,7 +153,8 @@ function htmlForm(input: RenderHtmlToPdfInput, config: GotenbergConfig): FormDat
     form.append("landscape", String(input.page.landscape ?? false));
     for (const side of ["top", "right", "bottom", "left"] as const) {
       const value = input.page.margin?.[side] ?? 15;
-      if (!Number.isFinite(value) || value < 0) throw new GotenbergRenderError("bad_input", "Page margins must be nonnegative millimeters.");
+      if (!Number.isFinite(value) || value < 0)
+        throw new GotenbergRenderError("bad_input", "Page margins must be nonnegative millimeters.");
       form.append(`margin${side[0]!.toUpperCase()}${side.slice(1)}`, String(value / 25.4));
     }
   }
@@ -159,14 +162,24 @@ function htmlForm(input: RenderHtmlToPdfInput, config: GotenbergConfig): FormDat
 }
 
 /** Bounded transport shared by HTML conversion and attachment embedding. */
-async function requestPdf(route: string, form: FormData, config: GotenbergConfig, options: RenderHtmlToPdfOptions): Promise<RenderHtmlToPdfResult> {
+async function requestPdf(
+  route: string,
+  form: FormData,
+  config: GotenbergConfig,
+  options: RenderHtmlToPdfOptions,
+): Promise<RenderHtmlToPdfResult> {
   const headers = new Headers();
   const auth = basicAuthHeader(config);
   if (auth) headers.set("Authorization", auth);
   const signal = options.signal ? AbortSignal.any([options.signal, abortSignal(config.timeoutMs)]) : abortSignal(config.timeoutMs);
   let reader: ReadableStreamDefaultReader<Uint8Array> | undefined;
   try {
-    const response = await (options.fetch ?? fetch)(`${normalizeBaseUrl(config.url)}${route}`, { method: "POST", headers, body: form, signal });
+    const response = await (options.fetch ?? fetch)(`${normalizeBaseUrl(config.url)}${route}`, {
+      method: "POST",
+      headers,
+      body: form,
+      signal,
+    });
     if (!response.ok) {
       await response.body?.cancel();
       throw new GotenbergRenderError("bad_response", `Gotenberg returned HTTP ${response.status}.`, response.status);
@@ -190,20 +203,36 @@ async function requestPdf(route: string, form: FormData, config: GotenbergConfig
     }
     const pdf = new Uint8Array(size);
     let offset = 0;
-    for (const chunk of chunks) { pdf.set(chunk, offset); offset += chunk.byteLength; }
+    for (const chunk of chunks) {
+      pdf.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
     return { pdf, contentType };
   } catch (error) {
     await reader?.cancel().catch(() => {});
     throw sanitizeFetchError(error);
-  } finally { reader?.releaseLock(); }
+  } finally {
+    reader?.releaseLock();
+  }
 }
 
-export const renderHtmlToPdfWithConfig = async (input: RenderHtmlToPdfInput, config: GotenbergConfig, options: RenderHtmlToPdfOptions = {}): Promise<RenderHtmlToPdfResult> =>
-  requestPdf("/forms/chromium/convert/html", htmlForm(input, config), config, options);
+export const renderHtmlToPdfWithConfig = async (
+  input: RenderHtmlToPdfInput,
+  config: GotenbergConfig,
+  options: RenderHtmlToPdfOptions = {},
+): Promise<RenderHtmlToPdfResult> => requestPdf("/forms/chromium/convert/html", htmlForm(input, config), config, options);
 
-export const renderFacturXHtmlToPdfWithConfig = async (input: RenderFacturXHtmlToPdfInput, config: GotenbergConfig, options: RenderHtmlToPdfOptions = {}): Promise<RenderHtmlToPdfResult> => {
+export const renderFacturXHtmlToPdfWithConfig = async (
+  input: RenderFacturXHtmlToPdfInput,
+  config: GotenbergConfig,
+  options: RenderHtmlToPdfOptions = {},
+): Promise<RenderHtmlToPdfResult> => {
   const xmlBytes = byteLength(input.xml);
-  if (!xmlBytes || xmlBytes > config.maxHtmlBytes) throw new GotenbergRenderError(xmlBytes ? "html_too_large" : "bad_input", "Invoice XML is empty or exceeds the configured input budget.");
+  if (!xmlBytes || xmlBytes > config.maxHtmlBytes)
+    throw new GotenbergRenderError(
+      xmlBytes ? "html_too_large" : "bad_input",
+      "Invoice XML is empty or exceeds the configured input budget.",
+    );
   const form = htmlForm(input, { ...config, maxHtmlBytes: config.maxHtmlBytes - xmlBytes });
   form.append("facturxXml", new Blob([input.xml], { type: "application/xml" }), "factur-x.xml");
   form.append("facturxConformanceLevel", input.conformanceLevel ?? "EN 16931");
@@ -213,7 +242,11 @@ export const renderFacturXHtmlToPdfWithConfig = async (input: RenderFacturXHtmlT
   return requestPdf("/forms/chromium/convert/html", form, config, options);
 };
 
-export const attachPdfFilesWithConfig = async (input: AttachPdfFilesInput, config: GotenbergConfig, options: RenderHtmlToPdfOptions = {}): Promise<RenderHtmlToPdfResult> => {
+export const attachPdfFilesWithConfig = async (
+  input: AttachPdfFilesInput,
+  config: GotenbergConfig,
+  options: RenderHtmlToPdfOptions = {},
+): Promise<RenderHtmlToPdfResult> => {
   if (!input.attachments.length) throw new GotenbergRenderError("bad_input", "At least one attachment is required.");
   if (input.document.size + input.attachments.reduce((sum, file) => sum + file.data.size, 0) > config.maxPdfBytes)
     throw new GotenbergRenderError("pdf_too_large", "PDF and attachments exceed the configured input budget.");
@@ -226,7 +259,10 @@ export const attachPdfFilesWithConfig = async (input: AttachPdfFilesInput, confi
     if (names.has(name.toLowerCase())) throw new GotenbergRenderError("bad_input", "Attachment filenames must be unique.");
     names.add(name.toLowerCase());
     form.append("embeds", attachment.data, name);
-    metadata[name] = { mimeType: attachment.data.type || "application/octet-stream", relationship: attachment.relationship ?? "Unspecified" };
+    metadata[name] = {
+      mimeType: attachment.data.type || "application/octet-stream",
+      relationship: attachment.relationship ?? "Unspecified",
+    };
   }
   form.append("embedsMetadata", JSON.stringify(metadata));
   return requestPdf("/forms/pdfengines/embed", form, config, options);

package/src/services/pdf/index.ts

@@ -1,6 +1,6 @@
 export type {
-  GotenbergConfig,
   AttachPdfFilesInput,
+  GotenbergConfig,
   GotenbergRenderErrorCode,
   MergePdfsInput,
   RenderFacturXHtmlToPdfInput,
@@ -9,10 +9,10 @@ export type {
   RenderHtmlToPdfResult,
 } from "./gotenberg";
 export {
-  GotenbergRenderError,
-  getGotenbergConfig,
   attachPdfFiles,
   attachPdfFilesWithConfig,
+  GotenbergRenderError,
+  getGotenbergConfig,
   mergePdfs,
   mergePdfsWithConfig,
   renderFacturXHtmlToPdf,
@@ -21,14 +21,6 @@ export {
   renderHtmlToPdfWithConfig,
   testGotenberg,
 } from "./gotenberg";
-export type {
-  RenderTemplatePdfPreviewInput,
-  RenderTemplatePdfPreviewOptions,
-  TemplatePdfPreviewError,
-  TemplatePdfPreviewPhase,
-  TemplatePdfPreviewResult,
-} from "./template-preview";
-export { renderTemplatePdfPreview } from "./template-preview";
 export type {
   MarkdownPdfErrorCode,
   MarkdownPdfTemplateId,
@@ -44,3 +36,11 @@ export {
   renderMarkdownToPdf,
   renderMarkdownToPdfWithConfig,
 } from "./markdown";
+export type {
+  RenderTemplatePdfPreviewInput,
+  RenderTemplatePdfPreviewOptions,
+  TemplatePdfPreviewError,
+  TemplatePdfPreviewPhase,
+  TemplatePdfPreviewResult,
+} from "./template-preview";
+export { renderTemplatePdfPreview } from "./template-preview";

package/src/services/public-http.ts

@@ -1,5 +1,5 @@
-import { request, type RequestOptions } from "node:https";
 import type { ClientRequest, IncomingMessage } from "node:http";
+import { type RequestOptions, request } from "node:https";
 import { resolvePublicNetworkAddresses } from "./network-security";
 
 export type PublicHttpInput = {

package/src/services/rail-shortcuts.ts

@@ -1,5 +1,5 @@
 import { type SQL, sql } from "bun";
-import { RailAdminSchema, RailAdminInputSchema, type RailAdminInput, type RailAdminState } from "../contracts/rail-admin";
+import { type RailAdminInput, RailAdminInputSchema, RailAdminSchema, type RailAdminState } from "../contracts/rail-admin";
 import { RailShortcutSchema } from "../contracts/rail-preferences";
 import { hasRole, type User } from "../contracts/shared";
 import { buildAccessPrincipalCondition, createAccess } from "../server/services/access";

package/src/services/rail-snapshot.ts

@@ -1,8 +1,8 @@
-import { requestCacheRedis } from "./request-cache-redis";
 import { type RailSnapshot, RailSnapshotSchema } from "../contracts/rail-preferences";
 import type { User } from "../contracts/shared";
 import { railPreferences } from "./rail-preferences";
 import { railShortcuts } from "./rail-shortcuts";
+import { requestCacheRedis } from "./request-cache-redis";
 
 // Private request metadata: never serialized into the public User contract.
 const versions = new WeakMap<User, string>();

package/src/services/request-cache-redis.ts

@@ -1,4 +1,5 @@
 import { RedisClient } from "bun";
+import { env } from "../config/env";
 
 // Cache commands must not queue across a disconnect: delayed fills/invalidations
 // are not useful, and reads must be able to fall back to Postgres. Keep this
@@ -9,7 +10,7 @@ let reconnecting: Promise<void> | undefined;
 
 export const requestCacheRedis = async (): Promise<RedisClient> => {
   if (!client) {
-    client = new RedisClient(process.env.VALKEY_URL || process.env.REDIS_URL, { enableOfflineQueue: false });
+    client = new RedisClient(env.REDIS_URL, { enableOfflineQueue: false });
     // The first operation waits for normal connection establishment (Bun's
     // connection timeout applies). Later disconnected operations fail promptly.
     initialConnection = client.connect().catch(() => {});

package/src/services/session/user.ts

@@ -6,8 +6,8 @@ import { resolveProviderProfile } from "../accounts/base-user";
 import { managedGroupIdsSubquery } from "../accounts/group-sql";
 import { buildIpaUserData, emptyIpaUserData, userIpaDataColumns, userIpaDataJoin } from "../accounts/ipa-data";
 import { resolveAccountExpires } from "../accounts/model";
-import { setRailCacheVersion } from "../rail-snapshot";
 import { toPgTextArray } from "../postgres";
+import { setRailCacheVersion } from "../rail-snapshot";
 
 type DbRow = Record<string, unknown>;
 

package/src/services/settings/app.ts

@@ -30,7 +30,11 @@ const redactSecretValue = (entry: SettingEntry): SettingEntry => {
 
 export const settingsService = {
   entry: {
-    list: async (config?: { pagination?: PageParams; filter?: { query?: string; group?: string }; locale?: string }): Promise<Paginated<SettingEntry>> => {
+    list: async (config?: {
+      pagination?: PageParams;
+      filter?: { query?: string; group?: string };
+      locale?: string;
+    }): Promise<Paginated<SettingEntry>> => {
       const entries = await settingsPrimitives.getAll(config?.locale);
       const query = config?.filter?.query?.trim().toLowerCase();
       const group = config?.filter?.group?.trim().toLowerCase();

package/src/services/settings/core-settings.ts

@@ -1,3 +1,5 @@
+import { env } from "../../config/env";
+
 /**
  * Platform-owned settings, declared in the `defineApp({ settings: ... })` shape.
  *
@@ -14,11 +16,6 @@
  *   - keep `description`, `label`, `placeholder`, `default`, `kind` complete
  */
 
-const envString = (key: string): string | undefined => {
-  const value = process.env[key]?.trim();
-  return value && value.length > 0 ? value : undefined;
-};
-
 const IPA_MATCH_MODE_OPTIONS = [
   { value: "ignore", label: "Ignore local match" },
   { value: "migrate", label: "Migrate matching local account" },
@@ -124,8 +121,8 @@ export const CORE_SETTINGS = {
     description:
       "Public-facing application URL used for links in emails, OAuth redirects, and WebSocket connections (with or without scheme)",
     placeholder: "e.g. https://cloud.example.org",
-    envFallback: () => envString("APP_URL"),
-    envBootstrap: () => envString("APP_URL"),
+    envFallback: () => env.APP_URL,
+    envBootstrap: () => env.APP_URL,
   },
   "app.home_path": {
     kind: "string",
@@ -294,7 +291,8 @@ export const CORE_SETTINGS = {
     integer: true,
     default: 30,
     min: 0,
-    description: "Maximum running time per AI turn. Zero or an empty field disables this limit. Existing turns keep their original budget; request and tool timeouts still apply.",
+    description:
+      "Maximum running time per AI turn. Zero or an empty field disables this limit. Existing turns keep their original budget; request and tool timeouts still apply.",
   },
   "ai.max_tool_result_chars": {
     kind: "number",

package/src/services/settings/index.ts

@@ -11,8 +11,8 @@
 
 import { redis, sql } from "bun";
 import { decryptValue, encryptValue, getAppSecret } from "./crypto";
-import { SETTINGS, SETTINGS_MAP, resolveSettingPresentation, type SettingDef, validateSettingValue } from "./defaults";
-import { bulkRead, deleteKey, invalidateSettingsCache, readKey, writeKey } from "./store";
+import { resolveSettingPresentation, SETTINGS, SETTINGS_MAP, type SettingDef, validateSettingValue } from "./defaults";
+import { bulkRead, deleteKey, readKey, writeKey } from "./store";
 
 type SqlClient = typeof sql;
 
@@ -175,8 +175,8 @@ export async function remove(key: string, db?: SqlClient): Promise<void> {
 
 import type { SettingEntry } from "../../contracts/shared";
 
-export { invalidateSettingsCache } from "./store";
 export type { SettingEntry } from "../../contracts/shared";
+export { invalidateSettingsCache } from "./store";
 
 export async function getAll(locale?: string): Promise<SettingEntry[]> {
   // Determine which keys have a custom row in Postgres (vs. falling back to

package/src/services/settings/store.ts

@@ -13,12 +13,12 @@
  * snapshot exposed via `c.get("settings")` (built by snapshot.ts middleware).
  */
 
+import { sql } from "bun";
 import { HTTPException } from "hono/http-exception";
 import { hasRole, type User } from "../../contracts/shared";
-import { sql } from "bun";
-import { requestCacheRedis } from "../request-cache-redis";
-import { toPgTextArray } from "../postgres";
 import { claimCacheFill, completeCacheFill, MISSING_SETTING } from "../cache-fill";
+import { toPgTextArray } from "../postgres";
+import { requestCacheRedis } from "../request-cache-redis";
 import { decryptValue, encryptValue } from "./crypto";
 import { SETTINGS, SETTINGS_MAP, type SettingDef, validateSettingValue } from "./defaults";
 

package/src/services/webauthn.ts

@@ -1,3 +1,4 @@
+import { err, fail, ok, type Result } from "@k2b/stdlib";
 import {
   type AuthenticationResponseJSON,
   type AuthenticatorTransportFuture,
@@ -10,7 +11,6 @@ import {
   verifyRegistrationResponse,
   type WebAuthnCredential,
 } from "@simplewebauthn/server";
-import { err, fail, ok, type Result } from "@k2b/stdlib";
 import { redis, sql } from "bun";
 import type { User, WebAuthnPasskey } from "../contracts/shared";
 import { accounts } from "./accounts";

package/src/shared/index.ts

@@ -11,8 +11,11 @@ export {
 } from "./account-action-notice";
 export * from "./account-display";
 export * from "./account-session";
+export * from "./ai-costs";
 export type { AiPromptContextInput, AiToolPromptHint } from "./ai-platform-prompt";
 export { AI_PLATFORM_PROMPT_TEMPLATE, aiPromptContext, renderAiPlatformPrompt } from "./ai-platform-prompt";
+export type { AiChatQuotaSnapshot } from "./ai-quotas";
+export * from "./ai-quotas";
 export {
   AI_USAGE_RANGES,
   AI_USAGE_REASONS,
@@ -52,9 +55,3 @@ export {
 } from "./template-rendering";
 export * from "./theme";
 export * from "./time";
-
-export * from "./ai-quotas";
-
-export type { AiChatQuotaSnapshot } from "./ai-quotas";
-
-export * from "./ai-costs";

package/src/shared/markdown/extensions/info-blocks.ts

@@ -13,8 +13,8 @@
  * Supported types: note, info, success, warning, danger
  */
 
-import type { MarkedExtension, Tokens } from "marked";
 import { NOTICE_CARD_CLASSES, NOTICE_CARD_ICONS, type NoticeTone } from "@k2b/ui";
+import type { MarkedExtension, Tokens } from "marked";
 import { escapeHtml } from "../shared";
 
 type BlockType = "note" | "info" | "success" | "warning" | "danger";

package/src/ssr/AdminSidebar.tsx

@@ -1,9 +1,9 @@
-import WorkspaceNavigation from "./WorkspaceNavigation.island";
 import { AppWorkspace, useLocale } from "@k2b/ui";
 import { activeAdminHref } from "./admin-active-link";
 import { type AdminLink, buildAdminGroups } from "./admin-navigation";
-import type { RuntimeContext } from "./runtime";
 import { platformMessages } from "./platform-messages";
+import type { RuntimeContext } from "./runtime";
+import WorkspaceNavigation from "./WorkspaceNavigation.island";
 
 const AdminNavigation = (props: { currentPath: string; groups: ReturnType<typeof buildAdminGroups> }) => {
   const activeHref = activeAdminHref(

package/src/ssr/AppLaunchpad.island.tsx

@@ -1,6 +1,8 @@
-import { AppLaunchpadPanel, type AppLaunchpadApp, type AppLaunchpadLegalLink, type AppLaunchpadContext } from "./AppLaunchpadPanel";
+import { type AppLaunchpadApp, type AppLaunchpadContext, type AppLaunchpadLegalLink, AppLaunchpadPanel } from "./AppLaunchpadPanel";
 import { openCloudMobileMenu } from "./MobileNavigation";
+
 export type { AppLaunchpadApp, AppLaunchpadLegalLink } from "./AppLaunchpadPanel";
+
 import { dialogCore, IconButton, Tooltip, useLocale } from "@k2b/ui";
 import { createEffect } from "solid-js";
 import { platformMessages } from "./platform-messages";
@@ -117,7 +119,15 @@ export function AppLaunchpad(props: AppLaunchpadContext & { variant?: "provider"
     return <AppLaunchpadProvider apps={props.apps} legalLinks={props.legalLinks} profile={props.profile} />;
   }
 
-  return <AppLaunchpadButton apps={props.apps} legalLinks={props.legalLinks} profile={props.profile} variant={props.variant} label={props.label} />;
+  return (
+    <AppLaunchpadButton
+      apps={props.apps}
+      legalLinks={props.legalLinks}
+      profile={props.profile}
+      variant={props.variant}
+      label={props.label}
+    />
+  );
 }
 
 export default AppLaunchpad;

package/src/ssr/AppLaunchpadPanel.tsx

@@ -1,10 +1,10 @@
+import { documentNavigate } from "@k2b/ssr/nav";
+import { IconButton, ScrollArea, TextInput, useLocale } from "@k2b/ui";
+import { createSignal, For, type JSX, Show } from "solid-js";
+import { Dynamic } from "solid-js/web";
 import type { CloudTheme } from "../shared/theme";
 import { MobileProfileActions } from "./MobileProfileActions";
-import { Dynamic } from "solid-js/web";
 import { platformMessages } from "./platform-messages";
-import { IconButton, ScrollArea, TextInput, useLocale } from "@k2b/ui";
-import { createSignal, For, Show, type JSX } from "solid-js";
-import { documentNavigate } from "@k2b/ssr/nav";
 import { openRailEditor } from "./RailEditor";
 import { readRailContext } from "./rail-context";
 import { railMessages } from "./rail-messages";