@k2b/cloud 0.39.0 → 0.41.0

package/src/_internal/heartbeat.ts

@@ -1,6 +1,8 @@
 /** Keep an app discoverable even when the ephemeral registry is recreated. */
 
-import { APP_REGISTRY_TTL_MS } from "./registry";
+import { createHash, randomBytes } from "node:crypto";
+import { hostname } from "node:os";
+import { APP_REGISTRY_TTL_MS, type AppInstanceRecord, appInstancePrefix } from "./registry";
 
 const HEARTBEAT_INTERVAL_MS = 60_000;
 const HEARTBEAT_WRITE_TIMEOUT_MS = 10_000;
@@ -15,8 +17,171 @@ type HeartbeatRegistry<T> = {
   delete: (input: { key: string }) => Promise<unknown>;
 };
 
+type SnapshotRegistry<T> = {
+  snapshot: (input: { prefix: string }) => Promise<{ entries: { key: string; value: T }[] }>;
+};
+
+type MembershipRegistry = HeartbeatRegistry<AppInstanceRecord> & SnapshotRegistry<AppInstanceRecord>;
+
+type SharedEntry = {
+  read: () => Promise<{ value: unknown } | undefined>;
+  write: () => Promise<unknown>;
+  remove: () => Promise<unknown>;
+  prepare: (() => Promise<void>) | undefined;
+};
+
+const entryDigest = (value: unknown): string => createHash("sha256").update(JSON.stringify(value)).digest("base64url");
+
+type MembershipLock = {
+  withLock: <T>(
+    input: { resource: string; ttlMs?: number; signal?: AbortSignal },
+    fn: (lock: { expiresAt: Date }) => Promise<T>,
+  ) => Promise<T | null>;
+};
+
+/** One process membership shared by its app and capability heartbeats. Getters stay lazy until use. */
+export const createRegistryMembership = (
+  appId: string,
+  options: {
+    registry: () => MembershipRegistry;
+    lock: () => MembershipLock;
+    instanceId?: string;
+    hostname?: string;
+    startedAt?: number;
+    writeTimeoutMs?: number;
+  },
+) => {
+  const instanceId = options.instanceId ?? randomBytes(12).toString("base64url");
+  const prefix = appInstancePrefix(appId);
+  const key = `${prefix}${instanceId}`;
+  const value: AppInstanceRecord = {
+    appId,
+    instanceId,
+    hostname: options.hostname ?? hostname(),
+    startedAt: options.startedAt ?? Date.now(),
+    entries: {},
+  };
+  const writeTimeoutMs = options.writeTimeoutMs ?? HEARTBEAT_WRITE_TIMEOUT_MS;
+  if (!Number.isFinite(writeTimeoutMs) || writeTimeoutMs <= 0) throw new RangeError("Membership write timeout must be positive and finite");
+  let left = false;
+  const sharedEntries = new Map<string, SharedEntry>();
+
+  // Prepare idempotent dependent data outside the lock to preserve its bounded lease.
+  const prepareShared = async (sharedKey: string): Promise<void> => {
+    for (const [key, { prepare }] of sharedEntries) {
+      if (key !== sharedKey) await prepare?.();
+    }
+  };
+
+  const locked = async (write: (lock: { expiresAt: Date }) => Promise<void>): Promise<void> => {
+    const result = await options
+      .lock()
+      .withLock({ resource: appId, ttlMs: writeTimeoutMs, signal: AbortSignal.timeout(writeTimeoutMs) }, async (lock) => {
+        await write(lock);
+        return true;
+      });
+    if (result === null) throw new Error(`Registry membership lock unavailable for app ${appId}`);
+  };
+  const upsert = () => options.registry().upsert({ key, value });
+  const publishShared = async (): Promise<void> => {
+    if (left) return;
+    await upsert();
+    // Never mix entries from different processes: the capability catalog rejects mismatched manifests.
+    for (const { write } of sharedEntries.values()) {
+      if (left) return;
+      await write();
+    }
+  };
+
+  return {
+    join: async (sharedKey: string, sharedValue: unknown, entry: SharedEntry): Promise<void> => {
+      left = false;
+      await prepareShared(sharedKey);
+      await locked(async () => {
+        value.entries[sharedKey] = entryDigest(sharedValue);
+        sharedEntries.set(sharedKey, entry);
+        await publishShared();
+      });
+    },
+    publish: async (sharedKey: string): Promise<void> => {
+      if (left) return;
+      await prepareShared(sharedKey);
+      await locked(async () => {
+        if (left) return;
+        await publishShared();
+      });
+    },
+    adopt: async (sharedKey: string): Promise<void> => {
+      if (left) return;
+      // A live process started after this one covers stored state when all read keys it declares match.
+      // Ignore keys it never registered, but heal split pairs when both keys are declared.
+      // Start order is total (instance id breaks ties), so two live replicas never take turns.
+      const startedLater = (other: AppInstanceRecord): boolean =>
+        other.startedAt > value.startedAt || (other.startedAt === value.startedAt && other.instanceId > value.instanceId);
+      const needsRepublish = async (): Promise<boolean> => {
+        const stored = await Promise.all(
+          [...sharedEntries].map(async ([key, { read }]) => {
+            const entry = await read();
+            return { key, digest: entry ? entryDigest(entry.value) : undefined };
+          }),
+        );
+        if (stored.some(({ digest }) => digest === undefined)) return false;
+        if (stored.every(({ key, digest }) => digest === value.entries[key])) return false;
+        const snapshot = await options.registry().snapshot({ prefix });
+        return !snapshot.entries.some(
+          ({ value }) =>
+            startedLater(value) &&
+            stored.some(({ key }) => key in value.entries) &&
+            stored.every(({ key, digest }) => !(key in value.entries) || value.entries[key] === digest),
+        );
+      };
+      if (!(await needsRepublish())) return;
+      await prepareShared(sharedKey);
+      await locked(async (lock) => {
+        if (left) return;
+        const stillNeedsRepublish = await needsRepublish();
+        if (left || !stillNeedsRepublish) return;
+        if (Date.now() > lock.expiresAt.getTime() - writeTimeoutMs / 2) {
+          throw new Error("membership lease expired during adoption; shared entry left to its TTL");
+        }
+        await publishShared();
+      });
+    },
+    renew: async (): Promise<void> => {
+      if (left) return;
+      if (!(await options.registry().touch({ key }))) {
+        await locked(async () => {
+          if (!left) await upsert();
+        });
+      }
+    },
+    leave: async (): Promise<void> => {
+      left = true;
+      // A failed delete must never lead to shared removal: leave routing to its TTL.
+      // Repeat the delete even after leaving, to remove a late registration write.
+      await options.registry().delete({ key });
+      await locked(async (lock) => {
+        const snapshot = await options.registry().snapshot({ prefix });
+        // Ephemeral has no conditional delete, so the remaining lease bounds the removal window.
+        // A delete that NATS applies only after the lease expired can still remove a newer
+        // replica's entry; that replica restores it on its next refresh (at most 60 s).
+        if (Date.now() > lock.expiresAt.getTime() - writeTimeoutMs / 2) {
+          throw new Error("membership lease expired during stop; shared entry left to its TTL");
+        }
+        if (!snapshot.entries.some((entry) => entry.key !== key)) {
+          for (const { remove } of sharedEntries.values()) {
+            if (Date.now() > lock.expiresAt.getTime() - writeTimeoutMs / 2) {
+              throw new Error("membership lease expired during stop; shared entry left to its TTL");
+            }
+            await remove();
+          }
+        }
+      });
+    },
+  };
+};
+
 type HeartbeatOptions<T> = {
-  registry: HeartbeatRegistry<T>;
   key?: string;
   /** Publish dependent data before advertising or renewing the app. */
   beforeWrite?: () => Promise<void>;
@@ -26,7 +191,10 @@ type HeartbeatOptions<T> = {
   writeTimeoutMs?: number;
   onError?: (error: unknown) => void;
   onStale?: (error: unknown) => void;
-};
+} & (
+  | { registry: HeartbeatRegistry<T>; membership?: undefined }
+  | { registry: HeartbeatRegistry<T> & SnapshotRegistry<T>; membership: ReturnType<typeof createRegistryMembership> }
+);
 
 export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOptions<T>) => {
   const intervalMs = options.intervalMs ?? HEARTBEAT_INTERVAL_MS;
@@ -44,6 +212,7 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
   let timer: Timer | null = null;
   let inFlight: Promise<void> | null = null;
   let running = false;
+  let needsMembershipCleanup = false;
   let lastSuccessAt = 0;
   let staleReported = false;
   const key = options.key ?? `apps/${appId}`;
@@ -54,31 +223,49 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
     staleReported = false;
   };
 
+  const remove = () => (options.membership ? options.membership.leave() : registry.delete({ key }));
+  const upsert = () => registry.upsert({ key, value: entry });
+
   const register = async (): Promise<void> => {
     await options.beforeWrite?.();
-    await registry.upsert({ key, value: entry });
+    if (options.membership) {
+      const registry = options.registry;
+      await options.membership.join(key, entry, {
+        read: async () => (await registry.snapshot({ prefix: key })).entries.find((candidate) => candidate.key === key),
+        write: upsert,
+        remove: () => registry.delete({ key }),
+        prepare: options.beforeWrite,
+      });
+    } else await upsert();
     noteSuccess();
   };
 
   const refresh = async (): Promise<void> => {
     // Touch renews the existing entry (and emits a registry invalidation).
     // Avoid rebuilding the manifest here. A missing entry is repaired
-    // immediately, preserving restart-free registry recovery.
+    // immediately, preserving restart-free registry recovery. The newest live
+    // publisher wins; an entry whose publisher left is replaced by this one.
     await options.beforeWrite?.();
+    await options.membership?.renew();
     const touched = await registry.touch({ key });
-    if (!touched) await registry.upsert({ key, value: entry });
+    if (!touched) {
+      if (options.membership) await options.membership.publish(key);
+      else await upsert();
+    } else if (options.membership) {
+      await options.membership.adopt(key);
+    }
     noteSuccess();
   };
 
   const writeWithTimeout = async (write: Promise<void>): Promise<void> => {
     let timer: Timer | null = null;
     let timedOut = false;
-    void write
-      .then(async () => {
-        // A write that completed after its timeout must not resurrect a stopped app.
-        if (timedOut && !running) await registry.delete({ key }).catch(() => false);
-      })
-      .catch(() => undefined);
+    // A write that settled after its timeout must not resurrect a stopped app. A failed
+    // operation may still have landed earlier steps, such as the liveness key.
+    const removeLateWrite = async () => {
+      if (timedOut && !running) await remove().catch(() => false);
+    };
+    void write.then(removeLateWrite, removeLateWrite).catch(() => undefined);
     try {
       await Promise.race([
         write,
@@ -140,6 +327,7 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
         return;
       }
       running = true;
+      needsMembershipCleanup = options.membership !== undefined;
       const operation = writeWithTimeout(register());
       inFlight = operation;
       try {
@@ -153,7 +341,7 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
       schedule(intervalMs);
     },
     stop: async () => {
-      if (!running) return;
+      if (!running && !needsMembershipCleanup) return;
       running = false;
       if (timer) clearTimeout(timer);
       timer = null;
@@ -165,7 +353,8 @@ export const createHeartbeat = <T>(appId: string, entry: T, options: HeartbeatOp
         // still required so a stopped app cannot remain discoverable.
       }
       inFlight = null;
-      await registry.delete({ key });
+      await remove();
+      needsMembershipCleanup = false;
     },
   };
 };

package/src/_internal/registry.ts

@@ -1,4 +1,5 @@
-import type { EphemeralConfig } from "@k2b/sync";
+import { createHash } from "node:crypto";
+import type { EphemeralConfig, MutexConfig } from "@k2b/sync";
 import type { AppAppearanceColor } from "../contracts/app";
 import type { CapabilityManifest, CapabilityPresentationCatalog } from "../contracts/capabilities";
 import { fileProviderIssues } from "../contracts/file-provider";
@@ -45,6 +46,32 @@ export const CAPABILITY_REGISTRY_CONFIG = {
 } as const satisfies EphemeralConfig;
 
 export const APP_REGISTRY_PREFIX = "apps/";
+export const APP_INSTANCE_PREFIX = "instances/";
+
+// Fit Sync's 96-byte name limit for every app id that fits apps/<id>; appId stays in the record value.
+export const appInstancePrefix = (appId: string): string => {
+  const segment = createHash("sha256").update(appId).digest("base64url").slice(0, 16);
+  return `${APP_INSTANCE_PREFIX}${segment}/`;
+};
+
+export type AppInstanceRecord = {
+  appId: string;
+  instanceId: string;
+  hostname: string;
+  startedAt: number;
+  entries: Record<string, string>;
+};
+
+// The id and owner are a cross-version contract: all replicas must use the same lock.
+// TTL and retry are local budgets; Sync's drift identity is [id, owner, replicas].
+export const APP_MEMBERSHIP_LOCK_CONFIG = {
+  id: "cloud-app-membership",
+  owner: REGISTRY_OWNER,
+  retry: { delayMs: 200, maxAttempts: 50 },
+} as const satisfies MutexConfig;
+
+export const appInstanceRegistry = lazySync((sync) => sync.ephemeral<AppInstanceRecord>(APP_REGISTRY_CONFIG));
+export const appMembershipLock = lazySync((sync) => sync.mutex(APP_MEMBERSHIP_LOCK_CONFIG));
 
 export type CapabilityRegistryRecord = { appId: string; manifest: CapabilityManifest; presentation?: CapabilityPresentationCatalog };
 

package/src/_internal/runtime-watcher.ts

@@ -19,6 +19,7 @@ import { buildRuntimeFromRegistry } from "./runtime-context";
 const log = logger("runtime-watcher");
 
 let current: CloudRuntime | undefined;
+let coreRelease: string | undefined;
 let initPromise: Promise<void> | undefined;
 let watcherTask: Promise<void> | undefined;
 let abort: AbortController | undefined;
@@ -27,8 +28,12 @@ const refresh = async () => {
   const apps = await listApps();
   const capabilities = await listCapabilities(apps);
   current = buildRuntimeFromRegistry(apps, capabilities);
+  coreRelease = apps.find((app) => app.id === "core")?.runtime?.release;
 };
 
+/** Core's release from the live registry, absent before initialization and after shutdown. */
+export const registeredCoreRelease = (): string | undefined => coreRelease;
+
 export const ensureRuntimeWatcher = (): Promise<void> => {
   // Concurrent callers (start() + first request) wait on the same init —
   // returning before `current` is populated would race getCurrentRuntime().
@@ -68,6 +73,7 @@ export const stopRuntimeWatcher = async (): Promise<void> => {
   watcherTask = undefined;
   initPromise = undefined;
   current = undefined;
+  coreRelease = undefined;
 };
 
 export const getCurrentRuntime = (): CloudRuntime => {

package/src/_internal/setup-lock.ts

@@ -0,0 +1,103 @@
+import type { Mutex } from "@k2b/sync";
+import { expBackoff } from "@k2b/sync/retry";
+import { logger } from "../services/logging";
+import { lazySync, waitForNats } from "./process-sync";
+
+const SETUP_LEASE_MS = 60_000;
+const setupMutex = lazySync((sync) => sync.mutex({ id: "app-setup", owner: "cloud", ttlMs: SETUP_LEASE_MS, retry: { maxAttempts: 1 } }));
+
+const scheduleRenewal = (renew: () => Promise<void> | undefined, intervalMs: number): (() => void) => {
+  const timer = setInterval(() => void renew(), intervalMs);
+  timer.unref();
+  return () => clearInterval(timer);
+};
+
+/** Internal seam for testing lease timing without NATS or wall-clock waits. */
+export const runExclusive = async ({
+  mutex,
+  resource,
+  run,
+  leaseMs = SETUP_LEASE_MS,
+  sleep = Bun.sleep,
+  now = Date.now,
+  schedule = scheduleRenewal,
+  log = logger("setup"),
+}: {
+  mutex: Pick<Mutex, "ready" | "acquire" | "extend" | "release">;
+  resource: string;
+  run: () => Promise<void>;
+  leaseMs?: number;
+  sleep?: (ms: number) => Promise<unknown>;
+  now?: () => number;
+  schedule?: typeof scheduleRenewal;
+  log?: Pick<ReturnType<typeof logger>, "info" | "warn" | "error">;
+}): Promise<void> => {
+  const startedAt = now();
+  const nats = { application: resource };
+  await waitForNats(() => mutex.ready(), nats);
+  let lastWaitLog = Number.NEGATIVE_INFINITY;
+  let attempt = 1;
+  let lock = await waitForNats(() => mutex.acquire({ resource }), nats);
+  while (!lock) {
+    if (now() - lastWaitLog >= 30_000) {
+      lastWaitLog = now();
+      log.info("waiting for setup on another replica", { appId: resource, waitedMs: now() - startedAt });
+    }
+    await sleep(Math.min(2_000, expBackoff(attempt++, { baseMs: 250, maxMs: 2_000, jitter: 0.2 })));
+    lock = await waitForNats(() => mutex.acquire({ resource }), nats);
+  }
+
+  const lease = lock;
+  let lost = false;
+  let running = true;
+  let confirmedExpiresAt = lease.expiresAt.getTime();
+  let renewing: Promise<void> | undefined;
+  const checkExpiry = () => {
+    if (running && now() >= confirmedExpiresAt) lost = true;
+  };
+  const cancelRenewal = schedule(() => {
+    // Check even when an earlier extend is still in flight or the event loop was delayed.
+    checkExpiry();
+    if (renewing || lost) return;
+    renewing = (async () => {
+      try {
+        const extended = await mutex.extend(lease);
+        // extend mutates the handle; check the previous confirmed expiry first.
+        checkExpiry();
+        if (extended) confirmedExpiresAt = lease.expiresAt.getTime();
+        else lost = true;
+      } catch (error) {
+        log.warn("setup lease renewal failed", { appId: resource, error });
+        checkExpiry();
+      }
+    })().finally(() => {
+      renewing = undefined;
+    });
+    return renewing;
+  }, leaseMs / 3);
+
+  try {
+    try {
+      await run();
+    } finally {
+      checkExpiry();
+      running = false;
+      cancelRenewal();
+      // Do not race a release against an unfinished renewal.
+      await renewing;
+      if (lost) {
+        log.error("setup lease lost; another replica may have run setup concurrently; restarting so setup reruns", { appId: resource });
+      }
+    }
+    if (lost) throw new Error(`Setup lease lost for application "${resource}"`);
+  } finally {
+    try {
+      if (!(await mutex.release(lease))) log.warn("setup lease release failed; it will expire", { appId: resource });
+    } catch (error) {
+      log.warn("setup lease release failed; it will expire", { appId: resource, error });
+    }
+  }
+};
+
+export const runSetupExclusively = (appId: string, setup: () => Promise<void>): Promise<void> =>
+  runExclusive({ mutex: setupMutex(), resource: appId, run: setup });

package/src/_internal/static-assets.ts

@@ -1,7 +1,43 @@
+import { createHash } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
 import { resolve, sep } from "node:path";
 import type { Context } from "hono";
 
 const publicRoot = resolve(process.cwd(), "public");
+const versions = new Map<string, { size: number; mtimeMs: number; version: string }>();
+
+/**
+ * Version of Core's shared stylesheets: the release, which names one build. `local` and `development` are the
+ * defaults of unnamed builds and name many, so those sheets get no version and are revalidated instead.
+ */
+export function sharedStylesheetVersion(release: string | undefined): string | undefined {
+  return !release || release === "local" || release === "development" ? undefined : release;
+}
+
+/**
+ * Content version of a file below `public/`: hashed on first use and re-hashed only when the file's size or
+ * modification time changes; a missing or unreadable file has no version.
+ */
+export function publicFileVersion(pathname: string): string | undefined {
+  const path = resolvePublicAsset(pathname);
+  if (!path) return undefined;
+  try {
+    const stat = statSync(path, { throwIfNoEntry: false });
+    if (!stat?.isFile()) return undefined;
+    const cached = versions.get(path);
+    if (cached && cached.size === stat.size && cached.mtimeMs === stat.mtimeMs) return cached.version;
+    const version = createHash("sha256").update(readFileSync(path)).digest("hex").slice(0, 16);
+    versions.set(path, { size: stat.size, mtimeMs: stat.mtimeMs, version });
+    return version;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Append a URL-encoded version only when the asset has one. */
+export function versionedPublicHref(pathname: string, version: string | undefined): string {
+  return version === undefined ? pathname : `${pathname}?v=${encodeURIComponent(version)}`;
+}
 
 function decodePathname(pathname: string): string | null {
   try {
@@ -48,14 +84,15 @@ async function encodedFile(path: string, encoding: "br" | "gzip"): Promise<Bun.B
   return (await file.exists()) ? file : null;
 }
 
-export function servePublicAsset(isDevelopment: boolean) {
+export function servePublicAsset(isDevelopment: boolean, sharedVersion?: string) {
   return async (c: Context) => {
     if (c.req.method !== "GET" && c.req.method !== "HEAD") {
       c.header("Allow", "GET, HEAD");
       return c.text("Method Not Allowed", 405);
     }
 
-    const path = resolvePublicAsset(new URL(c.req.url).pathname);
+    const url = new URL(c.req.url);
+    const path = resolvePublicAsset(url.pathname);
     if (!path) return c.notFound();
 
     const sourceFile = Bun.file(path);
@@ -84,8 +121,20 @@ export function servePublicAsset(isDevelopment: boolean) {
     // Development rebuilds files in place under the same address, so the browser asks again on every use; an
     // unchanged file then costs one round trip instead of its whole size on every page.
     const etag = `"${selectedEncoding ?? "identity"}-${selected.size.toString(36)}-${selected.lastModified.toString(36)}"`;
+    // The page head links these files with the version this process names for them. Any other version may name
+    // other content (a rolling deploy, an app started before a Core redeploy), so it is revalidated, never kept.
+    let cacheControl = isDevelopment ? "no-cache" : "public, max-age=31536000, immutable";
+    if (!isDevelopment) {
+      const pathname = decodePathname(url.pathname)!;
+      const shared = /^\/public\/(fonts|tabler-icons|global)\.css$/.test(pathname);
+      const own = /^\/public\/[^/]+\/(app\.css|favicon\.svg)$/.test(pathname);
+      if (shared || own) {
+        const expected = shared ? sharedVersion : publicFileVersion(url.pathname);
+        if (expected === undefined || url.searchParams.get("v") !== expected) cacheControl = "no-cache";
+      }
+    }
     const headers = new Headers({
-      "Cache-Control": isDevelopment ? "no-cache" : "public, max-age=31536000, immutable",
+      "Cache-Control": cacheControl,
       ETag: etag,
       Vary: "Accept-Encoding",
     });

package/src/_internal/status-preserving-ssr.ts

@@ -2,6 +2,7 @@ import type { HtmlFn, RenderFn } from "@k2b/ssr";
 import { createSSRHandler } from "@k2b/ssr/hono";
 import type { Context, Env, MiddlewareHandler, TypedResponse } from "hono";
 import type { StatusCode } from "hono/utils/http-status";
+import type { PanelConsentSnapshot } from "../contracts/panel-context";
 import type { RailSnapshot } from "../contracts/rail-preferences";
 import type { SettingsFlat, Unflatten } from "../contracts/settings-types";
 import type { User } from "../contracts/shared";
@@ -13,6 +14,7 @@ type PageEnv<T extends object> = {
     page: Partial<T>;
     user?: User;
     railPreferences?: RailSnapshot;
+    panelConsent?: PanelConsentSnapshot;
     settings?: Unflatten<SettingsFlat<typeof CORE_SETTINGS>>;
   };
 };

package/src/access/PermissionEditor.tsx

@@ -425,7 +425,7 @@ function AccessEntryRow(props: {
         <Show
           when={props.entry.principal.type === "user"}
           fallback={
-            <div class="flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-zinc-200 text-zinc-600 dark:bg-zinc-700 dark:text-zinc-300">
+            <div class="flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-zinc-200 text-secondary dark:bg-zinc-700">
               <i class={`ti ${getPrincipalIcon(props.entry, t())} text-sm`} />
             </div>
           }
@@ -509,7 +509,7 @@ function AccessEntryRow(props: {
               aria-label={t().remove({ name: displayName() })}
               // A disabled button takes no focus and touch has no hover, so the reason also reaches assistive technology.
               aria-description={props.lastManager ? removeLabel() : undefined}
-              class="focus-ui flex h-7 w-7 items-center justify-center rounded text-zinc-400 transition-colors focus:opacity-100 enabled:hover:bg-red-500/[0.08] enabled:hover:text-red-600 dark:enabled:hover:text-red-400"
+              class="focus-ui flex h-7 w-7 items-center justify-center rounded text-dimmed transition-colors focus:opacity-100 enabled:hover:bg-red-500/[0.08] enabled:hover:text-red-600 dark:enabled:hover:text-red-400"
             >
               <i class="ti ti-x text-sm" />
             </IconButton>

package/src/account/EntitySearch.tsx

@@ -350,7 +350,7 @@ const ResultRow = (props: {
     <Show
       when={props.avatar}
       fallback={
-        <div class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-zinc-200 text-xs text-zinc-600 dark:bg-zinc-700 dark:text-zinc-300">
+        <div class="flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-zinc-200 text-xs text-secondary dark:bg-zinc-700">
           <i class={`ti ${props.icon} text-sm`} />
         </div>
       }