@k2b/cloud 0.29.0 → 0.30.0

package/src/services/outgoing-mail/messages.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 import {
   type AdminMailFilter,
   type AdminMailRecord,
+  type MailFilter,
   type MailMessage,
   type MailPage,
   type MailPageParams,
@@ -86,16 +87,17 @@ type LogRow = Pick<
   | "sent_at"
   | "content_purged_at"
 >;
-const logColumns = (db: SQL, includeText: boolean) => db`id, app_id, profile_key, batch_id, ref_scope, ref_id, to_addresses, subject,
-  ${includeText ? db`text_body` : db`NULL::text AS text_body`}, attachments, status, error_code, error_message, smtp_response,
+const logColumns = (db: SQL, ownApp?: string) => db`id, app_id, profile_key, batch_id, ref_scope, ref_id, to_addresses, subject,
+  ${ownApp === undefined ? db`NULL::text AS text_body` : db`CASE WHEN app_id = ${ownApp} THEN text_body END AS text_body`}, attachments, status, error_code, error_message, smtp_response,
   failures, attempt_count, actor_id, actor_name, created_at, created_at::text AS cursor_created_at, sent_at, content_purged_at`;
 const metadata = async (id: string): Promise<AdminMailRecord | undefined> => {
-  const [row] = await sql<LogRow[]>`SELECT ${logColumns(sql, false)} FROM outgoing_mail.messages WHERE id = ${id}::uuid`;
+  const [row] = await sql<LogRow[]>`SELECT ${logColumns(sql)} FROM outgoing_mail.messages WHERE id = ${id}::uuid`;
   return row ? adminMessageRecord(row) : undefined;
 };
 const date = (value: Date | string) => new Date(value).toISOString();
 export const messageRecord = (row: LogRow): MailRecord => ({
   id: row.id,
+  appId: row.app_id,
   profile: row.profile_key,
   to: row.to_addresses,
   subject: row.subject,
@@ -329,28 +331,67 @@ export const decodeMailCursor = (cursor?: string) => {
     throw new OutgoingMailError("bad_input", "Invalid outgoing mail cursor.");
   }
 };
+type LogFilter = AdminMailFilter & Pick<MailFilter, "apps"> & { recipientExact?: string };
+/**
+ * The longest one search of the send log may run, the same budget as a Mail search; its statements share
+ * it. A broad search on a large log, or one that runs before Core has built the search indexes, could
+ * otherwise read every record on every page.
+ */
+const SEARCH_BUDGET_MS = 5_000;
+const searchTooBroad = () =>
+  new OutgoingMailError("bad_input", "This search took too long. Narrow it with a longer term, fewer apps, or a shorter time range.");
+const isStatementTimeout = (error: unknown) => {
+  const candidate = error as { code?: unknown; errno?: unknown } | null;
+  return candidate?.errno === "57014" || candidate?.code === "57014";
+};
+const withinSearchBudget = async <T>(read: (tx: SQL, limit: () => Promise<void>) => Promise<T>): Promise<T> => {
+  const deadline = Date.now() + SEARCH_BUDGET_MS;
+  try {
+    return await sql.begin((tx) =>
+      read(tx, async () => {
+        const remainingMs = Math.floor(deadline - Date.now());
+        if (remainingMs < 1) throw searchTooBroad();
+        await tx`SELECT set_config('statement_timeout', ${`${remainingMs}ms`}, true)`;
+      }),
+    );
+  } catch (error) {
+    throw isStatementTimeout(error) ? searchTooBroad() : error;
+  }
+};
 const list = async (
-  filter: AdminMailFilter,
+  filter: LogFilter,
   page: MailPageParams = {},
   metadata = false,
+  ownApp?: string,
 ): Promise<MailPage<MailRecord | AdminMailRecord>> => {
   const cursor = decodeMailCursor(page.cursor);
   const perPage = page.perPage ?? 50;
   const pageNumber = cursor?.page ?? page.page ?? 1;
-  const where = sql`WHERE TRUE
-    ${filter.app === undefined ? sql`` : sql`AND app_id = ${filter.app}`}
-    ${filter.profile === undefined ? sql`` : sql`AND profile_key = ${filter.profile}`}
-    ${filter.ids === undefined ? sql`` : sql`AND id = ANY(${toPgUuidArray(filter.ids)}::uuid[])`}
-    ${filter.batchId === undefined ? sql`` : sql`AND batch_id = ${filter.batchId}::uuid`}
-    ${filter.status === undefined ? sql`` : sql`AND status = ANY(${toPgTextArray(filter.status)}::text[])`}
-    ${filter.since === undefined ? sql`` : sql`AND created_at >= ${filter.since}::timestamptz`}
-    ${filter.ref === undefined ? sql`` : sql`AND ref_scope = ${filter.ref.scope}`}
-    ${filter.ref?.id === undefined ? sql`` : sql`AND ref_id = ${filter.ref.id}`}
-    ${filter.recipient === undefined ? sql`` : sql`AND EXISTS(SELECT 1 FROM unnest(to_addresses) AS address WHERE address ILIKE ${`%${escapeLikePattern(filter.recipient)}%`})`}`;
-  const [count] = await sql<{ total: number }[]>`SELECT count(*)::int AS total FROM outgoing_mail.messages ${where}`;
-  const rows = await sql<LogRow[]>`SELECT ${logColumns(sql, !metadata)} FROM outgoing_mail.messages ${where}
-    ${cursor ? sql`AND (created_at < ${cursor.createdAt}::timestamptz OR (created_at = ${cursor.createdAt}::timestamptz AND id > ${cursor.id}::uuid))` : sql``}
-    ORDER BY created_at DESC, id LIMIT ${perPage + 1} OFFSET ${cursor ? 0 : (pageNumber - 1) * perPage}`;
+  const where = (db: SQL) => db`WHERE TRUE
+    ${filter.apps === undefined ? db`` : db`AND app_id = ANY(${toPgTextArray(filter.apps)}::text[])`}
+    ${filter.app === undefined ? db`` : db`AND app_id = ${filter.app}`}
+    ${filter.profile === undefined ? db`` : db`AND profile_key = ${filter.profile}`}
+    ${filter.ids === undefined ? db`` : db`AND id = ANY(${toPgUuidArray(filter.ids)}::uuid[])`}
+    ${filter.batchId === undefined ? db`` : db`AND batch_id = ${filter.batchId}::uuid`}
+    ${filter.status === undefined ? db`` : db`AND status = ANY(${toPgTextArray(filter.status)}::text[])`}
+    ${filter.since === undefined ? db`` : db`AND created_at >= ${filter.since}::timestamptz`}
+    ${filter.until === undefined ? db`` : db`AND created_at < ${filter.until}::timestamptz`}
+    ${filter.q === undefined ? db`` : db`AND outgoing_mail.search_text(subject, to_addresses) ILIKE ${`%${escapeLikePattern(filter.q.toLowerCase())}%`}`}
+    ${filter.recipientExact === undefined ? db`` : db`AND outgoing_mail.lower_addresses(to_addresses) @> ARRAY[pg_catalog.lower(${filter.recipientExact})]`}
+    ${filter.ref === undefined ? db`` : db`AND ref_scope = ${filter.ref.scope}`}
+    ${filter.ref?.id === undefined ? db`` : db`AND ref_id = ${filter.ref.id}`}
+    ${filter.recipient === undefined ? db`` : db`AND EXISTS(SELECT 1 FROM unnest(to_addresses) AS address WHERE address ILIKE ${`%${escapeLikePattern(filter.recipient)}%`})`}`;
+  const read = async (db: SQL, limit: () => Promise<void>) => {
+    await limit();
+    const [count] = await db<{ total: number }[]>`SELECT count(*)::int AS total FROM outgoing_mail.messages ${where(db)}`;
+    await limit();
+    const rows = await db<LogRow[]>`SELECT ${logColumns(db, metadata ? undefined : ownApp)} FROM outgoing_mail.messages ${where(db)}
+      ${cursor ? db`AND (created_at < ${cursor.createdAt}::timestamptz OR (created_at = ${cursor.createdAt}::timestamptz AND id > ${cursor.id}::uuid))` : db``}
+      ORDER BY created_at DESC, id LIMIT ${perPage + 1} OFFSET ${cursor ? 0 : (pageNumber - 1) * perPage}`;
+    return { total: count?.total ?? 0, rows };
+  };
+  const { total, rows } =
+    filter.q === undefined && filter.recipientExact === undefined ? await read(sql, async () => {}) : await withinSearchBudget(read);
   const hasNext = rows.length > perPage;
   const items = rows.slice(0, perPage);
   const last = items.at(-1);
@@ -358,7 +399,7 @@ const list = async (
     items: items.map(metadata ? adminMessageRecord : messageRecord),
     page: pageNumber,
     perPage,
-    total: count?.total ?? 0,
+    total,
     hasNext,
     ...(hasNext && last
       ? {

package/src/services/outgoing-mail/store.ts

@@ -8,6 +8,9 @@ import {
   MailAppAccessSchema,
   type MailBounceErrorCode,
   type MailErrorCode,
+  type MailLogAccess,
+  MailLogAccessSchema,
+  MailLogAppIdSchema,
   type MailProfile,
   type MailProfileInput,
   MailProfileInputSchema,
@@ -22,7 +25,7 @@ export class OutgoingMailError extends Error {
   constructor(
     public readonly code: MailErrorCode,
     message: string,
-    public readonly status: 400 | 404 | 409 | 502 = 400,
+    public readonly status: 400 | 403 | 404 | 409 | 502 = 400,
   ) {
     super(message);
   }
@@ -75,11 +78,12 @@ const locked = async <T>(run: (tx: SQL) => Promise<T>): Promise<T> =>
     await tx`SELECT pg_advisory_xact_lock(hashtextextended('outgoing_mail.policy', 0))`;
     return run(tx);
   });
-const record = (db: SQL, context: MailAuditContext, action: string, target: string) =>
+const record = (db: SQL, context: MailAuditContext, action: string, target: string, metadata?: Record<string, unknown>) =>
   audit.record(
     {
       ...context,
       action: `outgoing_mail.${action}`,
+      ...(metadata ? { metadata } : {}),
       outcome: "allowed",
       target: { type: action.startsWith("profile.") ? "outgoing_mail_profile" : "outgoing_mail_app", id: target },
     },
@@ -241,7 +245,9 @@ const appsState = async (
   const registered = registeredApps ?? (await listApps());
   const { access, grants } = await accessRows(db);
   const [profile] = await db<{ key: string }[]>`SELECT key FROM outgoing_mail.profiles WHERE is_default`;
-  const ids = new Set([...registered.map((app) => app.id), ...access.map((a) => a.app_id)]);
+  const logGrants = await db<{ app_id: string; source_app_id: string }[]>`
+    SELECT app_id, source_app_id FROM outgoing_mail.app_log_access ORDER BY source_app_id`;
+  const ids = new Set([...registered.map((app) => app.id), ...access.map((a) => a.app_id), ...logGrants.map((g) => g.app_id)]);
   const items = [...ids]
     .map((appId): AdminMailApp => {
       const app = registered.find((a) => a.id === appId);
@@ -251,6 +257,13 @@ const appsState = async (
         name: app?.name ?? appId,
         registered: !!app,
         declared: !!app?.platformPermissions?.includes("mail:send"),
+        readDeclared: appId !== "core" && !!app?.platformPermissions?.includes("mail:read"),
+        logApps:
+          appId === "core"
+            ? []
+            : logGrants
+                .filter((g) => g.app_id === appId && g.source_app_id !== "core" && g.source_app_id !== appId)
+                .map((g) => g.source_app_id),
         mode,
         profiles: mode === "selected" ? grants.filter((g) => g.app_id === appId).map((g) => g.key) : [],
       };
@@ -285,6 +298,41 @@ const setAppAccess = async (appId: string, value: MailAppAccess, context: MailAu
         name: appId,
         registered: false,
         declared: false,
+        readDeclared: false,
+        logApps: [],
+        mode: "default",
+        profiles: [],
+      }
+    );
+  });
+};
+const logAppsFor = async (appId: string): Promise<string[]> => {
+  if (appId === "core") return [];
+  const rows = await sql<{ source_app_id: string }[]>`SELECT source_app_id FROM outgoing_mail.app_log_access
+    WHERE app_id = ${appId} AND source_app_id <> 'core' AND source_app_id <> app_id ORDER BY source_app_id`;
+  return rows.map((row) => row.source_app_id);
+};
+const setAppLogAccess = async (appId: string, value: MailLogAccess, context: MailAuditContext): Promise<AdminMailApp> => {
+  const reader = MailLogAppIdSchema.safeParse(appId);
+  const parsed = MailLogAccessSchema.safeParse(value);
+  if (!reader.success || appId === "core" || !parsed.success || parsed.data.apps.includes(appId))
+    throw new OutgoingMailError("bad_input", "Choose a valid reader and distinct source apps other than Core or the reader itself.");
+  const apps = [...parsed.data.apps].sort();
+  const registered = await listApps();
+  return locked(async (tx) => {
+    await tx`DELETE FROM outgoing_mail.app_log_access WHERE app_id = ${appId}`;
+    await tx`INSERT INTO outgoing_mail.app_log_access(app_id, source_app_id, created_by)
+      SELECT ${appId}, source_app_id, ${context.actor.userId ?? null}
+      FROM unnest(${toPgTextArray(apps)}::text[]) AS source_app_id`;
+    await record(tx, context, "app_log_access.update", appId, { apps });
+    return (
+      (await appsState(tx, registered)).items.find((app) => app.appId === appId) ?? {
+        appId,
+        name: appId,
+        registered: false,
+        declared: false,
+        readDeclared: false,
+        logApps: [],
         mode: "default",
         profiles: [],
       }
@@ -319,7 +367,18 @@ const profilesForApp = async (appId: string): Promise<MailProfile[]> => {
     quota: { dailyRecipients: row.daily_recipient_limit, usedLast24h: row.used },
   }));
 };
-export const outgoingMailStore = { list, get, put, setDefault, delete: remove, apps: appsState, setAppAccess, profilesForApp };
+export const outgoingMailStore = {
+  list,
+  get,
+  put,
+  setDefault,
+  delete: remove,
+  apps: appsState,
+  setAppAccess,
+  setAppLogAccess,
+  logAppsFor,
+  profilesForApp,
+};
 
 /** Platform email send path only. Never use this helper to shape API or CLI responses. */
 export const resolveMailCredentials = async (key?: string | { id: string }) => {

package/src/shared/network-address.ts

@@ -65,6 +65,7 @@ const UNSAFE_IPV6_RANGES: ReadonlyArray<readonly [bigint, number]> = [
   [ipv6ToBigInt("2001:2::")!, 48],
   [ipv6ToBigInt("2001:db8::")!, 32],
   [ipv6ToBigInt("2002::")!, 16],
+  [ipv6ToBigInt("3fff::")!, 20],
   [ipv6ToBigInt("fc00::")!, 7],
   [ipv6ToBigInt("fe80::")!, 10],
   [ipv6ToBigInt("fec0::")!, 10],

package/src/ssr/AppLaunchpadPanel.tsx

@@ -2,11 +2,11 @@ import { documentNavigate } from "@k2b/ssr/nav";
 import { IconButton, ScrollArea, TextInput, useLocale } from "@k2b/ui";
 import { createSignal, For, type JSX, Show } from "solid-js";
 import { Dynamic } from "solid-js/web";
+import { importOnDemand } from "../browser/reload";
 import type { CloudTheme } from "../shared/theme";
 import { AppBadge, useAppBadgeDescription } from "./AppBadge";
 import { MobileProfileActions } from "./MobileProfileActions";
 import { platformMessages } from "./platform-messages";
-import { openRailEditor } from "./RailEditor";
 import { readRailContext } from "./rail-context";
 import { railMessages } from "./rail-messages";
 import { projectRailNavigation } from "./rail-navigation";
@@ -64,6 +64,7 @@ export const AppLaunchpadPanel = (
   const t = () => railMessages.resolve([locale()]).t;
   const rail = readRailContext();
   const [query, setQuery] = createSignal("");
+  const [editorLoading, setEditorLoading] = createSignal(false);
   const messages = () => platformMessages.resolve([locale()]).t;
   const matches = (label: string, description = "") =>
     `${label} ${description}`.toLocaleLowerCase(locale()).includes(query().trim().toLocaleLowerCase(locale()));
@@ -106,14 +107,22 @@ export const AppLaunchpadPanel = (
               label={t().customize}
               tooltip={t().customize}
               tooltipDelay={0}
+              aria-busy={editorLoading() ? "true" : undefined}
               onClick={async () => {
+                if (editorLoading()) return;
+                // The editor and its validation load only when someone customizes the app bar, while this panel
+                // stays open and shows that it is busy. The button stays enabled so it keeps focus.
+                setEditorLoading(true);
+                const editor = await importOnDemand(() => import("./RailEditor"));
+                setEditorLoading(false);
+                if (!editor) return;
                 if (props.beforeSelect) {
                   if (!(await props.beforeSelect())) return;
                 } else props.close();
-                openRailEditor(locale());
+                editor.openRailEditor(locale());
               }}
             >
-              <i class="ti ti-adjustments-horizontal" aria-hidden="true" />
+              <i class={editorLoading() ? "ti ti-loader-2 animate-spin" : "ti ti-adjustments-horizontal"} aria-hidden="true" />
             </IconButton>
           </div>
         </Show>

package/src/ssr/GlobalAnnouncements.island.tsx

@@ -4,10 +4,10 @@ import {
   ANNOUNCEMENTS_COOKIE,
   ANNOUNCEMENTS_COOKIE_MAX_AGE_SECONDS,
   type AnnouncementCookieState,
-  type AnnouncementDisplayEntry,
   mergeAnnouncementCookieState,
   serializeAnnouncementCookieState,
-} from "../contracts/announcements";
+} from "../contracts/announcement-cookie";
+import type { AnnouncementDisplayEntry } from "../contracts/announcements";
 import { platformMessages } from "./platform-messages";
 
 type Props = {

package/src/ssr/GlobalSearchDialog.tsx

@@ -1,5 +1,5 @@
 import { query } from "@k2b/stdlib/solid";
-import { type DialogRender, dialogCore, toast, useLocale } from "@k2b/ui";
+import { type DialogRender, toast, useLocale } from "@k2b/ui";
 import { createEffect, createSignal, For, onCleanup, onMount } from "solid-js";
 import type { SearchItem } from "../api/search/schemas";
 import CloudResourceSearch from "../browser/CloudResourceSearch";
@@ -7,7 +7,6 @@ import { COMMANDS_CHANGED, collectContextAwareCommands } from "../browser/comman
 import { contextCommandsWithShortcuts } from "../browser/command-shortcuts";
 import { openCommand, runContextAwareCommand } from "../browser/commands";
 import type { NavigationSearchItem } from "../browser/navigation-search";
-import { resourceSearchDialogOptions } from "../browser/resource-search-dialog";
 import { resourceSearchMessages } from "../browser/resource-search-messages";
 import { type GlobalSearchOptions, requestSearchNavigation } from "../browser/search-bridge";
 import { loadSearchCommands, type PaletteCommand } from "../browser/search-commands";
@@ -139,44 +138,3 @@ export default function GlobalSearchDialog(props: GlobalSearchDialogProps) {
     </div>
   );
 }
-
-/** Owned by the layout island; neither dialog state nor callbacks cross SSR props. */
-export const createGlobalSearchHost = (searchLinks: () => NavigationSearchItem[], searchResources = true) => {
-  const [request, setRequest] = createSignal<GlobalSearchOptions>({});
-  let controller: AbortController | undefined;
-  return {
-    open: (options: GlobalSearchOptions) => {
-      setRequest({ ...options });
-      if (controller) {
-        document.querySelector<HTMLInputElement>(".cloud-global-search input[role=combobox]")?.focus();
-        return;
-      }
-      const current = new AbortController();
-      controller = current;
-      const locale = document.documentElement.lang || "en";
-      void dialogCore
-        .open<void>(
-          (close, context) => (
-            <GlobalSearchDialog
-              request={request()}
-              searchLinks={searchLinks()}
-              searchResources={searchResources}
-              close={close}
-              context={context}
-            />
-          ),
-          { ...resourceSearchDialogOptions(resourceSearchMessages.resolve([locale]).t.searchCloudResources), signal: current.signal },
-        )
-        .catch(() => {
-          toast.error(resourceSearchMessages.resolve([locale]).t.searchFailed);
-        })
-        .finally(() => {
-          if (controller === current) controller = undefined;
-        });
-    },
-    dispose: () => {
-      controller?.abort();
-      controller = undefined;
-    },
-  };
-};

package/src/ssr/GlobalSearchTrigger.island.tsx

@@ -1,11 +1,12 @@
 import { IconButton, Tooltip, useLocale } from "@k2b/ui";
 import { createEffect, onCleanup, onMount } from "solid-js";
+import { registerContextAwareCommand } from "../browser/command-bridge";
 import { attachCommandShortcuts } from "../browser/command-shortcuts";
-import { registerContextAwareCommand, runContextAwareCommand } from "../browser/commands";
 import type { NavigationSearchItem } from "../browser/navigation-search";
+import { importOnDemand } from "../browser/reload";
 import { openGlobalSearch } from "../browser/search";
 import { registerGlobalSearchHost } from "../browser/search-bridge";
-import { createGlobalSearchHost } from "./GlobalSearchDialog";
+import { createGlobalSearchHost } from "./global-search-host";
 import { platformMessages } from "./platform-messages";
 
 type GlobalSearchTriggerProps = {
@@ -26,7 +27,15 @@ export default function GlobalSearchTrigger(props: GlobalSearchTriggerProps) {
     onMount(() => {
       onCleanup(registerGlobalSearchHost(host.open, host.dispose));
     });
-    onMount(() => onCleanup(attachCommandShortcuts((command) => void runContextAwareCommand(command))));
+    // Commands, their schemas and the capability client load on the first shortcut, not with every page.
+    onMount(() =>
+      onCleanup(
+        attachCommandShortcuts(
+          (command) =>
+            void importOnDemand(() => import("../browser/commands")).then((commands) => commands?.runContextAwareCommand(command)),
+        ),
+      ),
+    );
     createEffect(() =>
       onCleanup(
         registerContextAwareCommand({

package/src/ssr/LayoutHelpTrigger.island.tsx

@@ -1,6 +1,6 @@
 import { IconButton, Tooltip, useLocale } from "@k2b/ui";
 import { createEffect, onCleanup } from "solid-js";
-import { registerContextAwareCommand } from "../browser/commands";
+import { registerContextAwareCommand } from "../browser/command-bridge";
 import type { GlobalSearchHelpApp } from "./GlobalSearchHelpDialog";
 import { openLayoutHelpDialog } from "./LayoutHelp";
 import { platformMessages } from "./platform-messages";

package/src/ssr/PwaRuntime.island.tsx

@@ -1,7 +1,7 @@
 import { observeMobileShell, syncThemeColor, type ToastHandle, toast, useLocale } from "@k2b/ui";
 import { onCleanup, onMount } from "solid-js";
 import { renewAppSession } from "../browser/app-session";
-import { PWA_SCOPE, PWA_SERVICE_WORKER_PATH } from "../contracts/pwa";
+import { PWA_SCOPE, PWA_SERVICE_WORKER_PATH } from "../contracts/pwa-paths";
 import { pwaMessages } from "./pwa-messages";
 
 /** Set once per browsing session, so the first page renews and later navigations do not. */

package/src/ssr/app-navigation.ts

@@ -1,6 +1,7 @@
+import { hasAnyAppRole } from "../_internal/app-roles";
 import type { RuntimeAppMeta } from "../contracts/app";
-import { isPwaPartId } from "../contracts/pwa";
-import { hasRole, type Role, type User } from "../contracts/shared";
+import { isPwaPartId } from "../contracts/pwa-paths";
+import type { User } from "../contracts/shared";
 import { resolveAppPresentation } from "../shared/app-presentation";
 
 export type VisibleNavigationApp = RuntimeAppMeta & {
@@ -27,14 +28,11 @@ export const hasDedicatedRuntimeRoute = (apps: readonly RuntimeAppMeta[], pathna
   return !!match && match.app.id !== currentAppId;
 };
 
-const hasAnyRole = (user: User | undefined, roles: readonly Role[] | undefined): boolean =>
-  !roles || (!!user && roles.some((role) => (role === "guest" ? user.profile === "guest" : hasRole(user, role))));
-
 /** Apps rendered in the navigation for a given authenticated user. */
 export const visibleNavigationApps = (apps: readonly RuntimeAppMeta[], user: User | undefined): VisibleNavigationApp[] =>
   apps.filter(
     (app): app is VisibleNavigationApp =>
-      !!app.nav && app.nav.section !== "hidden" && (!app.nav.requiresAuth || !!user) && hasAnyRole(user, app.nav.requiresRoles),
+      !!app.nav && app.nav.section !== "hidden" && (!app.nav.requiresAuth || !!user) && hasAnyAppRole(user, app.nav.requiresRoles),
   );
 
 export type VisiblePwaPart = RuntimeAppMeta & { pwa: NonNullable<RuntimeAppMeta["pwa"]> };
@@ -49,7 +47,7 @@ export const visiblePwaParts = (apps: readonly RuntimeAppMeta[], user: User | un
   return apps
     .filter(
       (app): app is VisiblePwaPart =>
-        !!app.pwa && isPwaPartId(app.id) && app.routes.includes(app.pwa.href) && hasAnyRole(user, app.pwa.requiresRoles),
+        !!app.pwa && isPwaPartId(app.id) && app.routes.includes(app.pwa.href) && hasAnyAppRole(user, app.pwa.requiresRoles),
     )
     .map((app) => resolveAppPresentation(app, locale))
     .sort((a, b) => a.name.localeCompare(b.name, locale) || a.id.localeCompare(b.id));

package/src/ssr/global-search-host.tsx

@@ -0,0 +1,55 @@
+import { dialogCore, toast } from "@k2b/ui";
+import { createSignal } from "solid-js";
+import type { NavigationSearchItem } from "../browser/navigation-search";
+import { importOnDemand } from "../browser/reload";
+import { resourceSearchDialogOptions } from "../browser/resource-search-dialog";
+import { resourceSearchMessages } from "../browser/resource-search-messages";
+import type { GlobalSearchOptions } from "../browser/search-bridge";
+
+/**
+ * Owned by the layout island; neither dialog state nor callbacks cross SSR props. The dialog with search, commands
+ * and their schemas loads on first open, so no page pays for it before someone searches.
+ */
+export const createGlobalSearchHost = (searchLinks: () => NavigationSearchItem[], searchResources = true) => {
+  const [request, setRequest] = createSignal<GlobalSearchOptions>({});
+  let controller: AbortController | undefined;
+  return {
+    open: (options: GlobalSearchOptions) => {
+      setRequest({ ...options });
+      if (controller) {
+        document.querySelector<HTMLInputElement>(".cloud-global-search input[role=combobox]")?.focus();
+        return;
+      }
+      const current = new AbortController();
+      controller = current;
+      const locale = document.documentElement.lang || "en";
+      void importOnDemand(() => import("./GlobalSearchDialog"))
+        .then((loaded) => {
+          if (!loaded || current.signal.aborted) return;
+          const GlobalSearchDialog = loaded.default;
+          return dialogCore.open<void>(
+            (close, context) => (
+              <GlobalSearchDialog
+                request={request()}
+                searchLinks={searchLinks()}
+                searchResources={searchResources}
+                close={close}
+                context={context}
+              />
+            ),
+            { ...resourceSearchDialogOptions(resourceSearchMessages.resolve([locale]).t.searchCloudResources), signal: current.signal },
+          );
+        })
+        .catch(() => {
+          toast.error(resourceSearchMessages.resolve([locale]).t.searchFailed);
+        })
+        .finally(() => {
+          if (controller === current) controller = undefined;
+        });
+    },
+    dispose: () => {
+      controller?.abort();
+      controller = undefined;
+    },
+  };
+};

package/src/ssr/help.ts

@@ -10,14 +10,14 @@ const manifests = new WeakMap<object, HelpManifestResult | null>();
 const log = logger("help:ssr");
 export const getLayoutHelp = (c: object): HelpManifestResult | null => manifests.get(c) ?? null;
 
-/** Explicit Help pages also work anonymously; automatic layout loading requires a user. */
+/** Help metadata for the current or an explicit app; `null` without a user or when the user may not see the app. */
 export const preloadLayoutHelp = async (c: Context, appId?: string): Promise<HelpManifestResult | null> => {
   if (manifests.has(c)) return getLayoutHelp(c);
-  if (!c.get("runtime") || (!appId && !c.get("user"))) return null;
+  if (!c.get("runtime") || !c.get("user")) return null;
   const id = appId ?? resolveCurrentApp(getRuntimeContext(c).apps, c.req.path)?.id;
   if (!id) return null;
   try {
-    const manifest = await createHelpReader(getLocale(c)).manifest(id);
+    const manifest = await createHelpReader(getLocale(c), c.get("actor")).manifest(id);
     manifests.set(c, manifest);
     return manifest;
   } catch (error) {

package/src/ssr/rail-context.ts

@@ -1,4 +1,4 @@
-import { type RailPreferences, type RailSnapshot, RailSnapshotSchema } from "../contracts/rail-preferences";
+import type { RailPreferences, RailSnapshot } from "../contracts/rail-preferences";
 import type { RailApp } from "./rail-navigation";
 
 export type RailContext = { apps: RailApp[]; settings: RailSnapshot };
@@ -8,9 +8,10 @@ export const readRailContext = (): RailContext | undefined => {
   if (typeof document === "undefined") return undefined;
   const text = document.getElementById("cloud-rail-data")?.textContent;
   if (!text) return undefined;
-  // Framework-generated, escaped SSR data; never loaded from localStorage.
+  // Framework-generated, escaped SSR data; never loaded from localStorage. The server validates the snapshot when
+  // it reads it, so the shell does not load the schemas on every page.
   const value: RailContext = JSON.parse(text);
-  return { apps: value.apps, settings: RailSnapshotSchema.parse(value.settings) };
+  return { apps: value.apps, settings: value.settings };
 };
 
 export const publishRailPreferences = (settings: RailPreferences) => {

package/src/ssr/runtime.ts

@@ -4,7 +4,7 @@
  */
 import type { CloudRuntime } from "../contracts/app";
 import { getLocale } from "../server/locale";
-import { resolveAppPresentations } from "../shared/app-presentation";
+import { resolveAppPresentation, resolveAppPresentations } from "../shared/app-presentation";
 
 export type RuntimeContext = CloudRuntime;
 
@@ -29,3 +29,16 @@ export const getLocalizedRuntimeContext = (carrier: RuntimeCarrier & { req: { ra
   const locale = getLocale(carrier as Parameters<typeof getLocale>[0]);
   return { ...runtime, apps: resolveAppPresentations(runtime.apps, locale) };
 };
+
+/** An app's name in the request locale while the app is registered; `fallback` (its stored base name) otherwise. */
+export const localizedAppName = (
+  carrier: RuntimeCarrier & { req: { raw: { headers: Headers } } },
+  appId: string,
+  fallback: string,
+): string => {
+  const runtime = carrier.get("runtime");
+  const apps =
+    runtime && typeof runtime === "object" && Array.isArray((runtime as RuntimeContext).apps) ? (runtime as RuntimeContext).apps : [];
+  const app = apps.find((entry) => entry.id === appId);
+  return app ? resolveAppPresentation(app, getLocale(carrier as Parameters<typeof getLocale>[0])).name : fallback;
+};