@k2b/cloud 0.28.0 → 0.29.1

package/src/services/outgoing-mail/store.ts

@@ -8,6 +8,9 @@ import {
   MailAppAccessSchema,
   type MailBounceErrorCode,
   type MailErrorCode,
+  type MailLogAccess,
+  MailLogAccessSchema,
+  MailLogAppIdSchema,
   type MailProfile,
   type MailProfileInput,
   MailProfileInputSchema,
@@ -22,7 +25,7 @@ export class OutgoingMailError extends Error {
   constructor(
     public readonly code: MailErrorCode,
     message: string,
-    public readonly status: 400 | 404 | 409 | 502 = 400,
+    public readonly status: 400 | 403 | 404 | 409 | 502 = 400,
   ) {
     super(message);
   }
@@ -75,11 +78,12 @@ const locked = async <T>(run: (tx: SQL) => Promise<T>): Promise<T> =>
     await tx`SELECT pg_advisory_xact_lock(hashtextextended('outgoing_mail.policy', 0))`;
     return run(tx);
   });
-const record = (db: SQL, context: MailAuditContext, action: string, target: string) =>
+const record = (db: SQL, context: MailAuditContext, action: string, target: string, metadata?: Record<string, unknown>) =>
   audit.record(
     {
       ...context,
       action: `outgoing_mail.${action}`,
+      ...(metadata ? { metadata } : {}),
       outcome: "allowed",
       target: { type: action.startsWith("profile.") ? "outgoing_mail_profile" : "outgoing_mail_app", id: target },
     },
@@ -241,7 +245,9 @@ const appsState = async (
   const registered = registeredApps ?? (await listApps());
   const { access, grants } = await accessRows(db);
   const [profile] = await db<{ key: string }[]>`SELECT key FROM outgoing_mail.profiles WHERE is_default`;
-  const ids = new Set([...registered.map((app) => app.id), ...access.map((a) => a.app_id)]);
+  const logGrants = await db<{ app_id: string; source_app_id: string }[]>`
+    SELECT app_id, source_app_id FROM outgoing_mail.app_log_access ORDER BY source_app_id`;
+  const ids = new Set([...registered.map((app) => app.id), ...access.map((a) => a.app_id), ...logGrants.map((g) => g.app_id)]);
   const items = [...ids]
     .map((appId): AdminMailApp => {
       const app = registered.find((a) => a.id === appId);
@@ -251,6 +257,13 @@ const appsState = async (
         name: app?.name ?? appId,
         registered: !!app,
         declared: !!app?.platformPermissions?.includes("mail:send"),
+        readDeclared: appId !== "core" && !!app?.platformPermissions?.includes("mail:read"),
+        logApps:
+          appId === "core"
+            ? []
+            : logGrants
+                .filter((g) => g.app_id === appId && g.source_app_id !== "core" && g.source_app_id !== appId)
+                .map((g) => g.source_app_id),
         mode,
         profiles: mode === "selected" ? grants.filter((g) => g.app_id === appId).map((g) => g.key) : [],
       };
@@ -285,6 +298,41 @@ const setAppAccess = async (appId: string, value: MailAppAccess, context: MailAu
         name: appId,
         registered: false,
         declared: false,
+        readDeclared: false,
+        logApps: [],
+        mode: "default",
+        profiles: [],
+      }
+    );
+  });
+};
+const logAppsFor = async (appId: string): Promise<string[]> => {
+  if (appId === "core") return [];
+  const rows = await sql<{ source_app_id: string }[]>`SELECT source_app_id FROM outgoing_mail.app_log_access
+    WHERE app_id = ${appId} AND source_app_id <> 'core' AND source_app_id <> app_id ORDER BY source_app_id`;
+  return rows.map((row) => row.source_app_id);
+};
+const setAppLogAccess = async (appId: string, value: MailLogAccess, context: MailAuditContext): Promise<AdminMailApp> => {
+  const reader = MailLogAppIdSchema.safeParse(appId);
+  const parsed = MailLogAccessSchema.safeParse(value);
+  if (!reader.success || appId === "core" || !parsed.success || parsed.data.apps.includes(appId))
+    throw new OutgoingMailError("bad_input", "Choose a valid reader and distinct source apps other than Core or the reader itself.");
+  const apps = [...parsed.data.apps].sort();
+  const registered = await listApps();
+  return locked(async (tx) => {
+    await tx`DELETE FROM outgoing_mail.app_log_access WHERE app_id = ${appId}`;
+    await tx`INSERT INTO outgoing_mail.app_log_access(app_id, source_app_id, created_by)
+      SELECT ${appId}, source_app_id, ${context.actor.userId ?? null}
+      FROM unnest(${toPgTextArray(apps)}::text[]) AS source_app_id`;
+    await record(tx, context, "app_log_access.update", appId, { apps });
+    return (
+      (await appsState(tx, registered)).items.find((app) => app.appId === appId) ?? {
+        appId,
+        name: appId,
+        registered: false,
+        declared: false,
+        readDeclared: false,
+        logApps: [],
         mode: "default",
         profiles: [],
       }
@@ -319,7 +367,18 @@ const profilesForApp = async (appId: string): Promise<MailProfile[]> => {
     quota: { dailyRecipients: row.daily_recipient_limit, usedLast24h: row.used },
   }));
 };
-export const outgoingMailStore = { list, get, put, setDefault, delete: remove, apps: appsState, setAppAccess, profilesForApp };
+export const outgoingMailStore = {
+  list,
+  get,
+  put,
+  setDefault,
+  delete: remove,
+  apps: appsState,
+  setAppAccess,
+  setAppLogAccess,
+  logAppsFor,
+  profilesForApp,
+};
 
 /** Platform email send path only. Never use this helper to shape API or CLI responses. */
 export const resolveMailCredentials = async (key?: string | { id: string }) => {

package/src/services/pdf/template-preview.ts

@@ -1,4 +1,4 @@
-import { type LiquidTemplateOptions, renderLiquidTemplate } from "../../shared/template-rendering";
+import { LiquidTemplateError, type LiquidTemplateOptions, renderLiquidTemplate } from "../../shared/template-rendering";
 import {
   type GotenbergConfig,
   GotenbergRenderError,
@@ -84,6 +84,7 @@ export const renderTemplatePdfPreview = async (
       ok: false,
       error: {
         phase: "template",
+        ...(error instanceof LiquidTemplateError ? { code: error.reason } : {}),
         message: error instanceof Error ? error.message : "Template rendering failed.",
         status: 400,
       },

package/src/services/settings/app.ts

@@ -9,6 +9,7 @@
 
 import { err, fail, ok, type PageParams, type Paginated } from "@k2b/stdlib";
 import { paginateItems } from "../../server/services";
+import { ImageMetadataError } from "../image-metadata";
 import type { SettingEntry } from ".";
 import * as settingsPrimitives from ".";
 import { SETTINGS_MAP, validateSettingValue } from "./defaults";
@@ -66,6 +67,8 @@ export const settingsService = {
         await settingsPrimitives.set(config.key, validated.value);
         return ok(undefined);
       } catch (error) {
+        // A Result cannot carry 422; the typed HTTPException keeps its status through Hono.
+        if (error instanceof ImageMetadataError) throw error;
         const message = error instanceof Error ? error.message : String(error);
         if (message.startsWith("Unknown setting:")) {
           return fail(err.badInput(message));

package/src/services/settings/store.ts

@@ -17,6 +17,7 @@ import { sql } from "bun";
 import { HTTPException } from "hono/http-exception";
 import { hasRole, type User } from "../../contracts/shared";
 import { claimCacheFill, completeCacheFill, MISSING_SETTING } from "../cache-fill";
+import { stripImageDataUrlMetadata } from "../image-metadata";
 import { toPgTextArray } from "../postgres";
 import { requestCacheRedis } from "../request-cache-redis";
 import { decryptValue, encryptValue } from "./crypto";
@@ -193,7 +194,9 @@ export const writeKey = async (key: string, value: unknown, db?: SqlClient): Pro
   const validated = validateSettingValue(def, value);
   if (!validated.ok) throw new Error(validated.error);
 
-  const encrypted = await encryptValue(validated.value);
+  const storedValue =
+    def.kind === "image" && typeof validated.value === "string" ? stripImageDataUrlMetadata(validated.value) : validated.value;
+  const encrypted = await encryptValue(storedValue);
   await (db ?? sql)`
     INSERT INTO settings.entries (key, value, updated_at)
     VALUES (${key}, ${encrypted}, now())

package/src/services/weather/geo.ts

@@ -36,7 +36,11 @@ const mapPlace = (place: GeoPlace): WeatherCity => ({
 const getGeoBaseUrl = async (): Promise<Result<string>> => {
   const geoUrl = (await settings.get<string>("weather.geo_url")).trim();
   if (!geoUrl) {
-    return fail(err.internal("Geo API URL is not configured. Set weather.geo_url."));
+    return fail({
+      code: "WEATHER_CITY_SEARCH_NOT_CONFIGURED",
+      message: "Geo API URL is not configured. Set weather.geo_url.",
+      status: 500,
+    });
   }
   return ok(geoUrl.replace(/\/$/, ""));
 };
@@ -69,7 +73,7 @@ const list = async (config: {
   }
 
   const baseUrlResult = await getGeoBaseUrl();
-  if (!baseUrlResult.ok) return unavailable();
+  if (!baseUrlResult.ok) return baseUrlResult;
   const geoUrl = baseUrlResult.data;
   const result = await geoService.place.list({
     baseUrl: geoUrl,

package/src/shared/ai-platform-prompt.ts

@@ -57,7 +57,7 @@ Most replies need no offer. Make at most one offer, in the last sentence of the
 - The user corrected a result that their own Skill shaped: offer to add the correction to that Skill.
 {%- endif %}
 {%- if memoryToolEnabled %}
-- The user corrected the tone of a result that a built-in or shared Skill shaped, such as a mail that is too formal: offer to remember it as their preference. Memory keeps only the user's own words, so a plain yes cannot be saved: suggest a one-line rule they can send back, such as "Always write mails casually and briefly".
+- The user corrected the tone of a result, such as a mail that is too formal, without stating a lasting rule: offer to remember it as their preference. Memory keeps only the user's own words, so a plain yes cannot be saved: suggest a one-line rule they can send back, such as "Always write mails casually and briefly".
 {%- endif %}
 - The user says the request recurs (again, every week, like last time, always), pastes a long reusable instruction, or a workflow default covers it: offer to save it as a {% if skillOffers %}Skill or {% endif %}scheduled task.
 - A concrete next step clearly saves the user real work they may not know you can do: offer it, such as a manual follow-up the user mentioned, drafting the reply, or turning findings into Space tasks.
@@ -66,7 +66,7 @@ Offer only what the Skills, tool hints, and apps in this prompt support. Do not
 Offer a new Skill only when no listed Skill{% if skillSearch %} or search_skills result{% endif %} already covers the approach; a single preference belongs in memory, not a Skill. Built-in and shared Skills change for everyone, so change one only when the user asks for that. After a yes to a Skill offer, load skill-creator and draft from this conversation; its create or update review is the confirmation.
 {%- endif %}
 Make no offer for a simple fact or small talk, while you ask a question or wait for approval, after a failure or blocker, when your previous reply already ended with an offer, when the user declined it in this chat, or when the user asked for no suggestions or only a short answer. A request to shorten a draft or text is a correction, not a request for no offers. Organization, Project, and user instructions about suggestions take precedence.
-When the user asks what you can do, first take one quick look, where your tools allow it, at what they already work with, such as their Spaces, recent chats, or files, and lead with that. Give three to five concrete examples grounded in that work and in the Skills, tools, and apps available to you; leave out apps where they have no data, such as mail without a mailbox.
+When the user asks what you can do, lead with what they already work with: use the Recent work section when it is present; otherwise first take one quick look, where your tools allow it, at their Spaces, recent chats, or files. Give three to five concrete examples grounded in that work and in the Skills, tools, and apps available to you; leave out apps where they have no data, such as mail without a mailbox.
 {%- endif %}
 {%- if tools.size > 0 %}
 

package/src/shared/network-address.ts

@@ -65,6 +65,7 @@ const UNSAFE_IPV6_RANGES: ReadonlyArray<readonly [bigint, number]> = [
   [ipv6ToBigInt("2001:2::")!, 48],
   [ipv6ToBigInt("2001:db8::")!, 32],
   [ipv6ToBigInt("2002::")!, 16],
+  [ipv6ToBigInt("3fff::")!, 20],
   [ipv6ToBigInt("fc00::")!, 7],
   [ipv6ToBigInt("fe80::")!, 10],
   [ipv6ToBigInt("fec0::")!, 10],

package/src/shared/redirect.ts

@@ -9,7 +9,8 @@ export const normalizeRedirectTo = (value: string | null | undefined): string |
 
   try {
     const url = new URL(trimmed, REDIRECT_BASE);
-    if (url.origin !== REDIRECT_BASE) return undefined;
+    // Dot segments can resolve to `//host`, which a browser reads as another host.
+    if (url.origin !== REDIRECT_BASE || url.pathname.startsWith("//")) return undefined;
     return `${url.pathname}${url.search}${url.hash}`;
   } catch {
     return undefined;

package/src/shared/template-rendering.ts

@@ -1,10 +1,24 @@
-import { Liquid } from "liquidjs";
+import {
+  AssertionError,
+  Context,
+  defaultOperators,
+  type Emitter,
+  type FilterImplOptions,
+  Liquid,
+  LiquidError,
+  type Operators,
+  toValue,
+  toValueSync,
+} from "liquidjs";
 
 const TEMPLATE_MAX_BYTES = 200_000;
 const RENDER_MAX_BYTES = 300_000;
+// Synchronous rendering blocks every request in the app process. Legitimate templates
+// take milliseconds; keep this well below normal request latency budgets.
+const RENDER_TIMEOUT_MS = 1_000;
 
 type LiquidEngine = Liquid;
-export type LiquidTemplateErrorReason = "render_too_large";
+export type LiquidTemplateErrorReason = "render_too_large" | "render_timeout" | "render_memory_limit";
 
 export class LiquidTemplateError extends Error {
   constructor(
@@ -22,6 +36,7 @@ export type LiquidTemplateOptions = {
   escapeOutput?: boolean | ((value: unknown) => string);
   templateMaxBytes?: number;
   renderMaxBytes?: number;
+  renderTimeoutMs?: number;
   memoryLimit?: number;
 };
 
@@ -52,6 +67,35 @@ const TEMPLATE_TAG_RE = /{%-?\s*([A-Za-z_][A-Za-z0-9_]*)\b/g;
 
 const byteLength = (value: string): number => new TextEncoder().encode(value).byteLength;
 
+class BoundedEmitter implements Emitter {
+  buffer = "";
+  private bytes = 0;
+  private lastCodeUnit = 0;
+
+  constructor(private readonly maxBytes: number) {}
+
+  write(input: unknown): void {
+    const value: unknown = toValue(input);
+    // Match LiquidJS's emitter: nil is empty, arrays concatenate their elements.
+    if (value === null || value === undefined) return;
+    if (Array.isArray(value)) {
+      for (const item of value) this.write(item);
+      return;
+    }
+    const chunk = String(value);
+    if (!chunk) return;
+    const last = this.lastCodeUnit;
+    const first = chunk.charCodeAt(0);
+    // A surrogate pair split across writes encodes as four bytes, rather than six.
+    const paired = last >= 0xd800 && last <= 0xdbff && first >= 0xdc00 && first <= 0xdfff;
+    const bytes = this.bytes + byteLength(chunk) - (paired ? 2 : 0);
+    if (bytes > this.maxBytes) throw new LiquidTemplateError("render_too_large", "Rendered template is too large");
+    this.bytes = bytes;
+    this.lastCodeUnit = chunk.charCodeAt(chunk.length - 1);
+    this.buffer += chunk;
+  }
+}
+
 export const escapeTemplateOutput = (value: unknown): string =>
   String(value).replace(/[&<>"'`=/]/g, (char) => {
     switch (char) {
@@ -76,16 +120,34 @@ export const escapeTemplateOutput = (value: unknown): string =>
     }
   });
 
+const expandedTextLength = (input: unknown): number => {
+  const value: unknown = toValue(input);
+  if (typeof value === "string") return value.length;
+  if (Array.isArray(value)) return value.reduce((length: number, item: unknown) => length + expandedTextLength(item), 0);
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return String(value).length;
+  return 0;
+};
+
 const createEngine = (options: LiquidTemplateOptions = {}) => {
   const outputEscape =
     typeof options.escapeOutput === "function" ? options.escapeOutput : options.escapeOutput === false ? undefined : escapeTemplateOutput;
+  const operators: Operators = {};
+  for (const [name, handler] of Object.entries(defaultOperators)) {
+    operators[name] = (...args: [unknown, Context] | [unknown, unknown, Context]): boolean => {
+      const result: boolean = Reflect.apply(handler, undefined, args);
+      const context = args[args.length - 1];
+      if (context instanceof Context) context.renderLimit.check(performance.now());
+      return result;
+    };
+  }
   const engine = new Liquid({
+    operators,
     strictVariables: true,
     strictFilters: true,
     ownPropertyOnly: true,
     ...(outputEscape ? { outputEscape } : {}),
     parseLimit: options.templateMaxBytes ?? TEMPLATE_MAX_BYTES,
-    renderLimit: options.renderMaxBytes ?? RENDER_MAX_BYTES,
+    renderLimit: options.renderTimeoutMs ?? RENDER_TIMEOUT_MS,
     memoryLimit: options.memoryLimit ?? 2_000_000,
     cache: false,
     dynamicPartials: false,
@@ -94,7 +156,42 @@ const createEngine = (options: LiquidTemplateOptions = {}) => {
     partials: [],
   });
 
+  const renderTemplates = engine.renderer.renderTemplates.bind(engine.renderer);
+  engine.renderer.renderTemplates = function* (templates, context, emitter) {
+    // Capture renders without an emitter; bound its intermediate buffer as well.
+    const result = yield* renderTemplates(
+      templates,
+      context,
+      emitter ?? new BoundedEmitter(Math.max(options.renderMaxBytes ?? RENDER_MAX_BYTES, RENDER_MAX_BYTES)),
+    );
+    // LiquidJS checks before templates and every loop body (even an empty one).
+    // Check after them too, so a slow final filter cannot return over budget.
+    context.renderLimit.check(performance.now());
+    return result;
+  };
+
+  for (const name of ["push", "concat", "unshift", "map"]) {
+    const filter = engine.filters[name];
+    if (!filter) continue;
+    const handler = typeof filter === "function" ? filter : filter.handler;
+    const bounded: FilterImplOptions = function* (...args: [unknown, ...unknown[]]): Generator<unknown, unknown, unknown> {
+      const result: unknown = yield handler.apply(this, args);
+      // Charge added text only; charging the left array again would compound.
+      this.context.memoryLimit.use(expandedTextLength(name === "map" ? result : args[1]));
+      return result;
+    };
+    engine.registerFilter(name, typeof filter === "function" ? bounded : { ...filter, handler: bounded });
+  }
   for (const [name, filter] of Object.entries(options.filters ?? {})) engine.registerFilter(name, filter);
+  for (const [name, filter] of Object.entries(engine.filters)) {
+    const handler = typeof filter === "function" ? filter : filter.handler;
+    const timed: FilterImplOptions = function* (...args: [unknown, ...unknown[]]): Generator<unknown, unknown, unknown> {
+      const result: unknown = yield handler.apply(this, args);
+      this.context.renderLimit.check(performance.now());
+      return result;
+    };
+    engine.registerFilter(name, typeof filter === "function" ? timed : { ...filter, handler: timed });
+  }
   return engine;
 };
 
@@ -126,11 +223,27 @@ export const validateLiquidTemplate = (
 export const renderLiquidTemplate = (template: string, data: Record<string, unknown>, options: LiquidTemplateOptions = {}): string => {
   const valid = validateLiquidTemplate(template, options);
   if (!valid.ok) throw new Error(valid.error);
-  const rendered = engineFor(options).parseAndRenderSync(template, data);
-  if (byteLength(rendered) > (options.renderMaxBytes ?? RENDER_MAX_BYTES)) {
-    throw new LiquidTemplateError("render_too_large", "Rendered template is too large");
+  const engine = engineFor(options);
+  const context = new Context(data, engine.options, { sync: true }, { liquid: engine });
+  const emitter = new BoundedEmitter(options.renderMaxBytes ?? RENDER_MAX_BYTES);
+  try {
+    toValueSync(engine.renderer.renderTemplates(engine.parse(template), context, emitter));
+    return emitter.buffer;
+  } catch (error) {
+    // LiquidJS wraps emitter and limiter failures in RenderError.originalError.
+    let original = error;
+    while (original instanceof LiquidError && original.originalError) original = original.originalError;
+    if (original instanceof LiquidTemplateError) throw original;
+    if (original instanceof AssertionError) {
+      if (original.message === "template render limit exceeded") {
+        throw new LiquidTemplateError("render_timeout", "Template rendering exceeded its time budget");
+      }
+      if (original.message === "memory alloc limit exceeded") {
+        throw new LiquidTemplateError("render_memory_limit", "Template rendering exceeded its memory limit");
+      }
+    }
+    throw error;
   }
-  return rendered;
 };
 
 export const liquidTemplateVariables = (template: string, options: LiquidTemplateOptions = {}): string[] => {

package/src/ssr/AppBadge.tsx

@@ -0,0 +1,30 @@
+import { useLocale } from "@k2b/ui";
+import { Show } from "solid-js";
+import { appBadgeCount } from "./app-badges";
+import { railMessages } from "./rail-messages";
+
+/** What a screen reader hears after the app name; empty without a count. Says no more than the "99+" shown. */
+export const useAppBadgeDescription = (endpoint: () => string | undefined) => {
+  const locale = useLocale();
+  return () => {
+    const count = appBadgeCount(endpoint());
+    const t = railMessages.resolve([locale()]).t;
+    return count > 99 ? t.badgeMany : count > 0 ? t.badge({ count }) : "";
+  };
+};
+
+/**
+ * Count on the corner of an app icon. It is positioned over the icon and never
+ * takes layout space, so appearing, growing to "99+", or clearing moves
+ * nothing. Decorative: the link carries the description.
+ */
+export function AppBadge(props: { endpoint?: string }) {
+  const count = () => appBadgeCount(props.endpoint);
+  return (
+    <Show when={count() > 0}>
+      <span class="cloud-app-badge" aria-hidden="true">
+        {count() > 99 ? "99+" : count()}
+      </span>
+    </Show>
+  );
+}

package/src/ssr/AppLaunchpadPanel.tsx

@@ -3,6 +3,7 @@ import { IconButton, ScrollArea, TextInput, useLocale } from "@k2b/ui";
 import { createSignal, For, type JSX, Show } from "solid-js";
 import { Dynamic } from "solid-js/web";
 import type { CloudTheme } from "../shared/theme";
+import { AppBadge, useAppBadgeDescription } from "./AppBadge";
 import { MobileProfileActions } from "./MobileProfileActions";
 import { platformMessages } from "./platform-messages";
 import { openRailEditor } from "./RailEditor";
@@ -17,6 +18,8 @@ export type AppLaunchpadApp = {
   href: string;
   description?: string;
   accent?: string;
+  /** The app's `nav.badge` endpoint. */
+  badge?: string;
 };
 
 export type AppLaunchpadLegalLink = {
@@ -119,39 +122,57 @@ export const AppLaunchpadPanel = (
         <section class="mb-5" aria-label={t().shortcuts}>
           <div class="flex flex-wrap justify-center gap-3">
             <For each={shortcuts()}>
-              {(shortcut) => (
-                <a
-                  onClick={follow}
-                  href={shortcut.href}
-                  class="group flex w-16 min-w-0 flex-col items-center gap-1 rounded-lg p-1 text-center focus-ui"
-                >
-                  <span class="grid h-9 w-9 place-items-center rounded-xl bg-[var(--ui-hover)] text-lg transition-colors group-hover:bg-[var(--ui-active)]">
-                    <i class={shortcut.iconClass} aria-hidden="true" />
-                  </span>
-                  <span class="max-w-full truncate text-[11px] font-medium text-primary dark:text-white">{shortcut.label}</span>
-                </a>
-              )}
+              {(shortcut) => {
+                const badge = useAppBadgeDescription(() => shortcut.badge);
+                return (
+                  <a
+                    onClick={follow}
+                    href={shortcut.href}
+                    class="group flex w-16 min-w-0 flex-col items-center gap-1 rounded-lg p-1 text-center focus-ui"
+                  >
+                    <span class="relative grid h-9 w-9 place-items-center rounded-xl bg-[var(--ui-hover)] text-lg transition-colors group-hover:bg-[var(--ui-active)]">
+                      <i class={shortcut.iconClass} aria-hidden="true" />
+                      <AppBadge endpoint={shortcut.badge} />
+                    </span>
+                    <span class="max-w-full truncate text-[11px] font-medium text-primary dark:text-white">
+                      {shortcut.label}
+                      <Show when={badge()}>
+                        <span class="sr-only">, {badge()}</span>
+                      </Show>
+                    </span>
+                  </a>
+                );
+              }}
             </For>
           </div>
         </section>
       </Show>
       <div class="launchpad-apps-grid flex flex-wrap justify-center gap-x-4 gap-y-4 sm:gap-x-7 sm:gap-y-6">
         <For each={apps()}>
-          {(app) => (
-            <a
-              onClick={follow}
-              href={app.href}
-              class="launchpad-app group flex w-[4.75rem] min-w-0 flex-col items-center gap-1.5 rounded-2xl p-1 text-center focus-ui sm:w-[6.25rem] sm:gap-2 sm:p-2"
-            >
-              <span
-                class="app-icon grid h-12 w-12 place-items-center rounded-[0.95rem] text-[1.25rem] sm:h-16 sm:w-16 sm:rounded-[1.25rem] sm:text-[1.7rem]"
-                style={appIconStyle(app)}
+          {(app) => {
+            const badge = useAppBadgeDescription(() => app.badge);
+            return (
+              <a
+                onClick={follow}
+                href={app.href}
+                class="launchpad-app group flex w-[4.75rem] min-w-0 flex-col items-center gap-1.5 rounded-2xl p-1 text-center focus-ui sm:w-[6.25rem] sm:gap-2 sm:p-2"
               >
-                <i class={app.iconClass} />
-              </span>
-              <span class="max-w-full truncate text-[11px] font-medium text-primary sm:text-xs dark:text-white">{app.label}</span>
-            </a>
-          )}
+                <span
+                  class="app-icon relative grid h-12 w-12 place-items-center rounded-[0.95rem] text-[1.25rem] sm:h-16 sm:w-16 sm:rounded-[1.25rem] sm:text-[1.7rem]"
+                  style={appIconStyle(app)}
+                >
+                  <i class={app.iconClass} />
+                  <AppBadge endpoint={app.badge} />
+                </span>
+                <span class="max-w-full truncate text-[11px] font-medium text-primary sm:text-xs dark:text-white">
+                  {app.label}
+                  <Show when={badge()}>
+                    <span class="sr-only">, {badge()}</span>
+                  </Show>
+                </span>
+              </a>
+            );
+          }}
         </For>
       </div>
       <Show when={!apps().length && !shortcuts().length}>

package/src/ssr/IslandError.tsx

@@ -0,0 +1,33 @@
+import type { IslandErrorProps } from "@k2b/ssr";
+import { i18n } from "@k2b/stdlib";
+import { Button, Placeholder, useLocale } from "@k2b/ui";
+
+const messages = i18n.define({
+  baseLocale: "en",
+  messages: {
+    en: { title: "This section could not be displayed.", retry: "Try again" },
+    de: { title: "Dieser Bereich konnte nicht angezeigt werden.", retry: "Erneut versuchen" },
+  },
+});
+
+/**
+ * Takes the place of an island or client component whose rendering failed.
+ * `defineApp` hands it to @k2b/ssr as `errorFallback`, so every island of every
+ * app gets it; the locale comes from `<html lang>`. "Try again" remounts the
+ * island with its original props.
+ */
+export default function IslandError(props: IslandErrorProps) {
+  const locale = useLocale();
+  const t = () => messages.resolve([locale()]).t;
+  return (
+    <Placeholder
+      state="error"
+      title={t().title}
+      action={
+        <Button variant="secondary" onClick={() => props.reset()}>
+          {t().retry}
+        </Button>
+      }
+    />
+  );
+}

package/src/ssr/Layout.tsx

@@ -61,6 +61,7 @@ function buildNavLinks(
       match: resolveNavMatch(app) ?? app.nav.href.split("?")[0] ?? app.nav.href,
       description: app.description,
       accent: app.appearance?.accent,
+      badge: app.nav.badge,
     } satisfies LayoutAppLink,
   }));
   const primary = links.filter((entry) => entry.section === "primary").map((entry) => entry.link);
@@ -75,6 +76,7 @@ function buildNavLinks(
       match: "/admin",
       description: t.platformAdministration,
       accent: undefined,
+      badge: undefined,
     });
   }
   return { primary, more };
@@ -166,6 +168,7 @@ export default function Layout(props: LayoutProps) {
     href: app.href,
     description: app.description,
     accent: app.accent,
+    badge: app.badge,
   }));
   const searchLinks = navigationSearchItems(
     runtime.apps,

package/src/ssr/LayoutHelp.tsx

@@ -95,11 +95,13 @@ const registerTopic = (topic: HelpTopic) => {
 /** Register an app's server-prepared Markdown manifest with the shared help UI. */
 export function LayoutHelpDocuments(props: LayoutHelpDocumentsProps) {
   onMount(() => {
-    window.__cloudLayoutHelpPageBase = props.pageBase;
+    // Cleanup runs while this unmounts, when a parent `<Show>` may already have dropped the props' source.
+    const pageBase = props.pageBase;
+    window.__cloudLayoutHelpPageBase = pageBase;
     const disposers = props.documents.map((document) => registerTopic({ ...document, kind: "document" }));
     onCleanup(() => {
       disposers.forEach((dispose) => dispose());
-      if (window.__cloudLayoutHelpPageBase === props.pageBase) delete window.__cloudLayoutHelpPageBase;
+      if (window.__cloudLayoutHelpPageBase === pageBase) delete window.__cloudLayoutHelpPageBase;
     });
   });
   return null;