@k2b/cloud 0.40.0 → 0.42.0

package/src/access/PrincipalPicker.tsx

@@ -1,7 +1,7 @@
 import { Combobox, type ComboboxOption, useLocale } from "@k2b/ui";
 import type { Principal, ServiceAccountKind } from "../contracts/shared";
-import { groupDisplayName } from "../shared/account-display";
 import { accessMessages } from "./messages";
+import { principalLabel } from "./principal-label";
 import { serviceAccountKindDisplay } from "./service-account-kind";
 
 export const principalKey = (p: Principal) =>
@@ -13,7 +13,7 @@ export const principalKey = (p: Principal) =>
         ? `s:${p.serviceAccountId}`
         : p.type;
 type Entity =
-  | { kind: "user"; user: { id: string; displayName: string; uid: string; mail: string | null } }
+  | { kind: "user"; user: { id: string; displayName: string; uid: string; mail: string | null; avatarHash?: string | null } }
   | { kind: "group"; group: { id: string; name: string; description: string | null } }
   | {
       kind: "service_account";
@@ -35,17 +35,36 @@ export default function PrincipalPicker(props: {
   disabled?: boolean;
   readOnly?: boolean;
   /** `serviceAccountKind` is set for service accounts so a new row can show the same kind as the result. */
-  onSelect: (principal: Principal, display: { displayName: string; serviceAccountKind?: ServiceAccountKind }) => void;
+  onSelect: (
+    principal: Principal,
+    display: { displayName: string; avatarHash?: string | null; serviceAccountKind?: ServiceAccountKind },
+  ) => void;
 }) {
   const locale = useLocale(),
     t = () => accessMessages.resolve([locale()]).t;
-  type Entry = { principal: Principal; label: string; icon: string; description?: string; serviceAccountKind?: ServiceAccountKind };
+  type Entry = {
+    principal: Principal;
+    label: string;
+    icon: string;
+    description?: string;
+    avatarHash?: string | null;
+    serviceAccountKind?: ServiceAccountKind;
+  };
   let selectable = new Map<string, Entry>();
   const load = async (search: string, signal: AbortSignal): Promise<ComboboxOption[]> => {
     const entries: Entry[] = [];
     if (props.allowAuthenticated !== false)
-      entries.push({ principal: { type: "authenticated" }, label: t().allUsers, icon: "ti ti-lock-open-2" });
-    if (props.allowPublic) entries.push({ principal: { type: "public" }, label: t().public, icon: "ti ti-world" });
+      entries.push({
+        principal: { type: "authenticated" },
+        label: principalLabel({ principal: { type: "authenticated" } }, locale()),
+        icon: "ti ti-lock-open-2",
+      });
+    if (props.allowPublic)
+      entries.push({
+        principal: { type: "public" },
+        label: principalLabel({ principal: { type: "public" } }, locale()),
+        icon: "ti ti-world",
+      });
     if (search.length >= 2) {
       const url = new URL("/api/accounts/entities", window.location.origin);
       url.searchParams.set("search", search);
@@ -64,14 +83,18 @@ export default function PrincipalPicker(props: {
         if (e.kind === "user")
           entries.push({
             principal: { type: "user", userId: e.user.id },
-            label: e.user.displayName || e.user.uid,
+            label: principalLabel(
+              { principal: { type: "user", userId: e.user.id }, displayName: e.user.displayName || e.user.uid },
+              locale(),
+            ),
+            avatarHash: e.user.avatarHash,
             icon: "ti ti-user",
             description: e.user.mail ?? e.user.uid,
           });
         else if (e.kind === "group")
           entries.push({
             principal: { type: "group", groupId: e.group.id },
-            label: groupDisplayName(e.group.name, locale()),
+            label: principalLabel({ principal: { type: "group", groupId: e.group.id }, displayName: e.group.name }, locale()),
             icon: "ti ti-users-group",
             description: e.group.description ?? undefined,
           });
@@ -80,7 +103,14 @@ export default function PrincipalPicker(props: {
           const kind = serviceAccountKindDisplay(account.kind, t());
           entries.push({
             principal: { type: "service_account", serviceAccountId: account.id },
-            label: account.name,
+            label: principalLabel(
+              {
+                principal: { type: "service_account", serviceAccountId: account.id },
+                displayName: account.name,
+                serviceAccountKind: account.kind,
+              },
+              locale(),
+            ),
             // Resource-bound accounts often share a name; their binding tells them apart.
             description:
               account.kind === "resource_bound"
@@ -114,7 +144,12 @@ export default function PrincipalPicker(props: {
       fetchData={load}
       onSelect={(option) => {
         const entry = selectable.get(option.id);
-        if (entry) props.onSelect(entry.principal, { displayName: entry.label, serviceAccountKind: entry.serviceAccountKind });
+        if (entry)
+          props.onSelect(entry.principal, {
+            displayName: entry.label,
+            avatarHash: entry.avatarHash,
+            serviceAccountKind: entry.serviceAccountKind,
+          });
       }}
     />
   );

package/src/access/messages.ts

@@ -8,6 +8,10 @@ export const accessMessages = i18n.define({
       edit: "Edit",
       manage: "Manage",
       noAccess: "No access",
+      unknownPerson: "Unknown person",
+      deletedGroup: "Deleted group",
+      unknownServiceAccount: "Unknown service account",
+      unknownAgent: "Unknown agent",
       allUsers: "All users (including guests)",
       public: "Public",
       signedInDescription: "Anyone signed in to Cloud",
@@ -87,6 +91,10 @@ export const accessMessages = i18n.define({
       edit: "Bearbeiten",
       manage: "Verwalten",
       noAccess: "Kein Zugriff",
+      unknownPerson: "Unbekannte Person",
+      deletedGroup: "Gelöschte Gruppe",
+      unknownServiceAccount: "Unbekanntes Dienstkonto",
+      unknownAgent: "Unbekannter Agent",
       allUsers: "Alle Benutzer einschließlich Gäste",
       public: "Öffentlich",
       signedInDescription: "Alle bei Cloud angemeldeten Personen",

package/src/access/principal-label.ts

@@ -0,0 +1,18 @@
+import type { Principal, ServiceAccountKind } from "../contracts/shared";
+import { groupDisplayName } from "../shared/account-display";
+import { accessMessages } from "./messages";
+
+/** A human label, never an identity. Resolve names only after authorizing the resource operation. */
+export const principalLabel = (
+  entry: { principal: Principal; displayName?: string | null; serviceAccountKind?: ServiceAccountKind },
+  locale: string | null | undefined,
+): string => {
+  const { t } = accessMessages.resolve([locale ?? "en"]);
+  const { principal, displayName } = entry;
+  if (principal.type === "authenticated") return t.allUsers;
+  if (principal.type === "public") return t.public;
+  if (displayName) return principal.type === "group" ? groupDisplayName(displayName, locale) : displayName;
+  if (principal.type === "user") return t.unknownPerson;
+  if (principal.type === "group") return t.deletedGroup;
+  return entry.serviceAccountKind === "agent" ? t.unknownAgent : t.unknownServiceAccount;
+};

package/src/access/ui.ts

@@ -10,6 +10,7 @@ export { isManagerEntry, type ManagerCandidate } from "./managers";
 export type { AllowedLevel, GrantableLevel } from "./PermissionEditor";
 export { default as PermissionEditor } from "./PermissionEditor";
 export { default as PrincipalPicker, principalKey } from "./PrincipalPicker";
+export { principalLabel } from "./principal-label";
 export type {
   ResourceApiKey,
   ResourceApiKeyPermissionOption,

package/src/account/EntitySearch.tsx

@@ -3,6 +3,7 @@ import { Button, ScrollArea, TextInput, useLocale } from "@k2b/ui";
 import type { JSX } from "solid-js";
 import { createSignal, For, Show } from "solid-js";
 import { accessMessages } from "../access/messages";
+import { principalLabel } from "../access/principal-label";
 import { serviceAccountKindDisplay } from "../access/service-account-kind";
 import { groupDisplayName } from "../shared/account-display";
 import { CloudAvatar } from "./Avatar";
@@ -233,8 +234,8 @@ const EntitySearch = (props: EntitySearchProps) => {
             <Show when={props.includeAuthenticated}>
               <ResultRow
                 icon="ti-lock-open-2"
-                title="All users (incl. guests)"
-                subtitle="Anyone signed in to the cloud"
+                title={principalLabel({ principal: { type: "authenticated" } }, locale())}
+                subtitle={accessMessages.resolve([locale()]).t.signedInDescription}
                 disabled={props.disabled}
                 onSelect={() => props.onSelect({ type: "authenticated" })}
               />
@@ -242,8 +243,8 @@ const EntitySearch = (props: EntitySearchProps) => {
             <Show when={props.includePublic}>
               <ResultRow
                 icon="ti-world"
-                title="Public"
-                subtitle="Anyone with the link, even unauthenticated"
+                title={principalLabel({ principal: { type: "public" } }, locale())}
+                subtitle={accessMessages.resolve([locale()]).t.publicDescription}
                 disabled={props.disabled}
                 onSelect={() => props.onSelect({ type: "public" })}
               />

package/src/ai/action-review.ts

@@ -4,6 +4,7 @@ import type {
   CapabilityActionReceipt,
   CapabilityActionReview,
   CapabilityActionReviewData,
+  CapabilityReviewContentRef,
   CapabilitySemanticLink,
 } from "../contracts/capabilities";
 
@@ -32,7 +33,7 @@ export type AiLegacyActionReview = {
 };
 
 /** A new review, with `ask` filled from the declared policy when the call itself names no reason. */
-export type AiStoredActionReview = CapabilityActionCallReview | AiLegacyActionReview;
+export type AiStoredActionReview = (CapabilityActionCallReview & { contentRef?: CapabilityReviewContentRef }) | AiLegacyActionReview;
 
 export const isLegacyActionReview = (review: AiStoredActionReview): review is AiLegacyActionReview => "legacy" in review;
 

package/src/ai/app-skill-store.ts

@@ -79,7 +79,7 @@ const reconcileApp = async (app: AppRegistryEntry, tx: TransactionSQL): Promise<
     { skills: unknown }[]
   >`SELECT skills FROM ai.app_skill_catalogs WHERE app_id=${app.id} AND manifest_hash=${manifest}`;
   if (!catalog) return false; // Publication may still be in flight: keep the last known state.
-  const roles = appAudienceRoles(app.nav);
+  const roles = app.access === undefined ? appAudienceRoles(app.nav) : undefined;
   const roleArray = roles === undefined ? null : toPgTextArray([...roles]);
   const [state] = await tx<{ current: boolean }[]>`SELECT
     EXISTS(SELECT 1 FROM ai.app_skills WHERE app_id=${app.id}) AND

package/src/ai/capabilities.ts

@@ -12,6 +12,7 @@ import {
   capabilityApprovalText,
 } from "../_internal/capability-sentences";
 import { HELP_READ_MAX_CHARS, HELP_SEARCH_MAX_LIMIT, readHelpArticle } from "../_internal/help-catalog";
+import type { listApps } from "../_internal/registry";
 import {
   type CapabilityActionManifest,
   type CapabilityActionReviewData,
@@ -23,6 +24,8 @@ import {
 } from "../contracts/capabilities";
 import type { CapabilityRegistryEntry } from "../contracts/registry";
 import type { RequestActor } from "../server";
+import type { RequestAuthority } from "../server/middleware/auth";
+import { discoverableAppEntries } from "../services/app-discovery";
 import type { HelpReader, HelpReaderFactory } from "../services/help";
 import { type MandatePolicyV1, mandatePolicyCanPermitCapability } from "../services/mandates/policy";
 import { resolveAppIdentityPresentation } from "../shared/app-presentation";
@@ -869,6 +872,7 @@ export const createAiToolResolver =
   (input: {
     conversationId: string;
     actor: RequestActor;
+    authority?: RequestAuthority | null;
     staticTools: AiRuntimeTool[];
     allowedTools?: readonly string[] | null;
     /** Undefined for interactive runs; null fails closed when a background mandate cannot be loaded. */
@@ -880,6 +884,7 @@ export const createAiToolResolver =
     runtimeContext?: Omit<AiToolPreparationContext, "actor" | "conversationId">;
     store: Pick<AiConversationService, "getLoadedTools" | "loadTools">;
     listRegistry?: () => Promise<CapabilityRegistryEntry[]>;
+    listApps?: typeof listApps;
     onCapabilityRegistryError?: (error: unknown) => void;
     help?: HelpReaderFactory;
     locale?: string;
@@ -904,7 +909,17 @@ export const createAiToolResolver =
       input.listRegistry ? resolveCapabilityRegistry(input.listRegistry, input.onCapabilityRegistryError) : [],
       input.store.getLoadedTools({ conversationId: input.conversationId }),
     ]);
-    const registry = liveRegistry ?? [];
+    const registry =
+      (await resolveCapabilityRegistry(
+        () => discoverableAppEntries(input.authority ?? null, liveRegistry ?? [], input.listApps),
+        input.onCapabilityRegistryError,
+      )) ?? [];
+    const visibleAppIds = new Set(registry.map((app) => app.appId));
+    const hiddenNames = new Set(
+      buildAiCapabilityCatalog(liveRegistry ?? [])
+        .filter((entry) => !visibleAppIds.has(entry.appId))
+        .flatMap((entry) => [entry.name, entry.providerName]),
+    );
     const configuredLimit = Math.floor(input.maxLoadedTools ?? 0);
     const loadedNames = configuredLimit > 0 ? persistedLoadedNames.slice(-configuredLimit) : persistedLoadedNames;
     if (loadedNames.length !== persistedLoadedNames.length) {
@@ -931,7 +946,9 @@ export const createAiToolResolver =
     );
     const capabilityCatalog = fullCapabilityCatalog.filter((entry) => (!allowed || allowed.has(entry.name)) && mandateAllows(entry));
     // The turn's actor decides which apps' Help exists for the model, like every other Help surface.
-    const helpTools = input.help ? createAiHelpTools(input.help(input.locale ?? "en", input.actor)) : [];
+    const helpTools = input.help
+      ? createAiHelpTools(input.help(input.locale ?? "en", input.actor, { authority: input.authority ?? null }))
+      : [];
     const resourceTool =
       input.execute && (capabilityCatalog.length > 0 || input.staticTools.some((tool) => tool.def.name === "code_read"))
         ? createAiResourceReaderTool({ apps: registry, catalog: capabilityCatalog, execute: input.execute })
@@ -940,7 +957,7 @@ export const createAiToolResolver =
     const builtIns = allBuiltIns.filter((tool) => !allowed || allowed.has(tool.def.name));
     const catalog = buildAiToolCatalog(builtIns, capabilityCatalog);
     const catalogNames = new Set(catalog.map((entry) => entry.name));
-    const unavailableLoadedNames = loadedNames.filter((name) => !catalogNames.has(name));
+    const unavailableLoadedNames = loadedNames.filter((name) => !catalogNames.has(name) && !hiddenNames.has(name));
     const outOfScope = new Set([
       ...allBuiltIns.map((tool) => tool.def.name),
       ...fullCapabilityCatalog.flatMap((entry) => [entry.name, entry.providerName]),
@@ -959,6 +976,7 @@ export const createAiToolResolver =
     const unavailableReason = (requested: string): AiToolUnavailableReason => {
       if (input.skillNames?.includes(requested)) return "skill";
       const name = loadedByProviderName.get(requested) ?? requested;
+      if (hiddenNames.has(requested) || hiddenNames.has(name)) return "unknown";
       if (mandateExcluded.has(name)) return "not_allowed";
       if (allowed && outOfScope.has(name) && !allowed.has(name)) return "not_allowed";
       if (unoffered.has(name)) return "not_offered_in_turn";

package/src/ai/capability-execution.ts

@@ -10,8 +10,7 @@ import {
   type CapabilityActionReviewData,
   CapabilityActionReviewDataSchema,
 } from "../contracts/capabilities";
-import type { RequestActor } from "../server";
-import type { AccessSubject } from "../server/services/access";
+import type { RequestActor, RequestAuthority } from "../server";
 import { isAccountCategoryAllowed } from "../services/account-category-policy";
 import { isAccountExpired } from "../services/account-model";
 import { accounts } from "../services/accounts";
@@ -26,13 +25,14 @@ import type { AiConversationService } from "./types";
 export { AiCapabilityExecutionError, aiCapabilityCheckResult } from "./capability-result";
 
 type CapabilityActor = Extract<RequestActor, { kind: "user" }>;
+type AiCapabilityAuthority = RequestAuthority & { actor: CapabilityActor };
 
 export const resolveAiCapabilityActor = async (input: {
   conversationId: string;
   persistedActor?: RequestActor;
   store: Pick<AiConversationService, "getConversation">;
   getUser?: typeof accounts.users.get;
-}): Promise<{ actor: CapabilityActor; accessSubject: AccessSubject }> => {
+}): Promise<AiCapabilityAuthority> => {
   if (input.persistedActor?.kind !== "user") throw new Error("Cloud capabilities require a current user-backed actor.");
   const conversation = await input.store.getConversation({ conversationId: input.conversationId });
   if (!conversation?.createdByUserId || conversation.createdByUserId !== input.persistedActor.user.id) {
@@ -44,9 +44,16 @@ export const resolveAiCapabilityActor = async (input: {
   if (!(await isAccountCategoryAllowed(user))) throw new Error("Cloud capability actor category is disabled.");
   // A turn started in the mobile app keeps its limits: no administrator role, and invocations say so.
   if (input.persistedActor.sessionKind === "app") {
-    return { actor: { kind: "user", user: withoutAdminRole(user), sessionKind: "app" }, accessSubject: { type: "user", userId: user.id } };
+    return {
+      actor: { kind: "user", user: withoutAdminRole(user), sessionKind: "app" },
+      accessSubject: { type: "user", userId: user.id },
+      credentialKind: "session",
+      scopes: [],
+    };
   }
-  return { actor: { kind: "user", user }, accessSubject: { type: "user", userId: user.id } };
+  // Assistant persists a user actor, not a reusable transport credential. Its supported
+  // delegation is the current conversation owner's session authority.
+  return { actor: { kind: "user", user }, accessSubject: { type: "user", userId: user.id }, credentialKind: "session", scopes: [] };
 };
 
 const idempotencyKey = (conversationId: string, callId: string): string =>
@@ -83,7 +90,7 @@ const parseCapabilityResponse = async (response: Response, dispatched: boolean):
 type AiCapabilityCall = {
   conversationId: string;
   turnId?: string;
-  authority: { actor: CapabilityActor; accessSubject: AccessSubject };
+  authority: AiCapabilityAuthority;
   locale?: string;
   entry: AiCapabilityCatalogEntry;
   args: unknown;
@@ -140,12 +147,7 @@ const dispatchAiCapability = async (
     appId: input.entry.appId,
     capabilityId: input.entry.operation.localId,
     input: input.args,
-    authority: {
-      actor: input.authority.actor,
-      accessSubject: input.authority.accessSubject,
-      credentialKind: "session",
-      scopes: [],
-    },
+    authority: input.authority,
     mandate: input.mandate
       ? {
           mandateId: input.mandate.id,

package/src/ai/chat/action-card.ts

@@ -1,10 +1,12 @@
 import {
   type CapabilitySentencePart,
   capabilityAskReasonText,
+  capabilityPersonText,
   capabilityQuestionText,
   capabilityReceiptParts,
   capabilityReviewSentence,
   capabilityReviewSentenceParts,
+  capabilitySentenceParts,
   capabilitySentenceText,
 } from "../../_internal/capability-sentences";
 import type {
@@ -14,6 +16,7 @@ import type {
   CapabilityAskReason,
   CapabilityConsequence,
   CapabilityPreview,
+  CapabilityReviewContentRef,
   CapabilitySemanticLink,
   CapabilitySlot,
 } from "../../contracts/capabilities";
@@ -55,11 +58,13 @@ export type ActionPreviewModel =
       locale: string;
       timeZone: string;
       preview?: CapabilityPreview;
-      consequences: { text: ActionText; mark?: "added" | "removed" }[];
+      /** Original slots for plain rule sentences, retaining people’s addresses. */
+      slots?: CapabilityActionCallReview["slots"];
+      consequences: { text: ActionText; plain: string; mark?: "added" | "removed" }[];
       /** The rule sentence of a `rule` preview, with its chips. */
       when?: ActionText;
       /** Each `may` line of a `rule` preview. */
-      may?: { text: ActionText; mark?: "added" | "removed" }[];
+      may?: { text: ActionText; plain: string; mark?: "added" | "removed" }[];
     }
   | { kind: "legacy"; rows: AiLegacyReviewRow[]; markdown?: string; input?: unknown };
 
@@ -74,6 +79,7 @@ export type ActionCard = {
   preview: ActionPreviewModel | null;
   /** Opens exactly this version of the thing. */
   readMore?: string;
+  contentRef?: CapabilityReviewContentRef;
   /** The review's other links, such as editing the draft, each with its words. */
   links: { href: string; label: string }[];
   /** Where the thing itself opens, for an outcome Cloud could not see. */
@@ -96,6 +102,16 @@ export type ActionCard = {
   hasCheck: boolean;
   /** The receipt text of an old review's success summary. */
   summary?: string;
+  /**
+   * For plain text: every value a new review's slots stand for (each person with address, title, text, time, count),
+   * also in consequences and rule lines, and whether the app left people out. Plain text that does not show each value
+   * whole is incomplete.
+   */
+  slotValues?: {
+    values: string[];
+    times: { text: string; start: string; end?: string; format: "date" | "date-time" }[];
+    unlisted: boolean;
+  };
 };
 
 const REASON_LOOK: Record<CapabilityAskReason, Omit<ActionReason, "code" | "text">> = {
@@ -174,6 +190,19 @@ export const actionPlainText = (text: ActionText): string =>
     })
     .join("");
 
+/** The short template, else the action sentence, read as the card's chips without person addresses or title quotes. */
+export const reviewShortText = (review: CapabilityActionCallReview, context: ActionCardContext): string =>
+  actionPlainText(
+    partsText(
+      capabilitySentenceParts(review.sentence.short ?? review.sentence.action, review.slots, {
+        locale: review.locale,
+        timeZone: context.timeZone,
+      }),
+      review.locale,
+      context.app,
+    ),
+  );
+
 const firstLink = (links: readonly CapabilitySemanticLink[] | undefined, rels: CapabilitySemanticLink["rel"][]) =>
   rels.map((rel) => links?.find((link) => link.rel === rel)?.href).find(Boolean);
 
@@ -192,7 +221,38 @@ const firstObjectHref = (review: CapabilityActionCallReview): string | undefined
     .map((slot) => ((slot.kind === "object" || slot.kind === "place") && slot.ref ? cloudResourceHref(slot.ref) : undefined))
     .find(Boolean);
 
-export const reviewActionCard = (review: CapabilityActionCallReview, context: ActionCardContext): ActionCard => {
+const slotValues = (slots: CapabilitySlot[], context: { locale: string; timeZone: string }) => ({
+  values: slots.flatMap((slot) =>
+    slot.kind === "person"
+      ? slot.people.map(capabilityPersonText)
+      : slot.kind === "object" || slot.kind === "place"
+        ? [slot.title]
+        : slot.kind === "text"
+          ? [slot.value]
+          : slot.kind === "count"
+            ? [capabilitySentenceText("{value}", { value: slot }, context)]
+            : [],
+  ),
+  // A time is shown whole as its words, or as typed rows that hold its start and end with at least its precision.
+  times: slots.flatMap((slot) =>
+    slot.kind === "time"
+      ? [
+          {
+            text: capabilitySentenceText("{value}", { value: slot }, context),
+            start: slot.start,
+            ...(slot.end ? { end: slot.end } : {}),
+            format: slot.format,
+          },
+        ]
+      : [],
+  ),
+  unlisted: slots.some((slot) => slot.kind === "person" && (slot.total ?? slot.people.length) > slot.people.length),
+});
+
+export const reviewActionCard = (
+  review: CapabilityActionCallReview & { contentRef?: CapabilityReviewContentRef },
+  context: ActionCardContext,
+): ActionCard => {
   const locale = review.locale;
   const tz = { timeZone: context.timeZone };
   const parts = (form: Parameters<typeof capabilityReviewSentenceParts>[1]) =>
@@ -206,6 +266,7 @@ export const reviewActionCard = (review: CapabilityActionCallReview, context: Ac
     );
   const consequence = (entry: CapabilityConsequence) => ({
     text: sentence(entry.text, entry.slots),
+    plain: capabilitySentenceText(entry.text, entry.slots ?? review.slots, { locale, timeZone: context.timeZone }),
     ...(entry.mark ? { mark: entry.mark } : {}),
   });
   const code = review.ask ?? "app_asks";
@@ -224,12 +285,14 @@ export const reviewActionCard = (review: CapabilityActionCallReview, context: Ac
             locale,
             timeZone: context.timeZone,
             ...(preview ? { preview } : {}),
+            slots: review.slots,
             consequences: (review.consequences ?? []).map(consequence),
             ...(preview?.kind === "rule"
               ? { when: sentence(preview.when.text, preview.when.slots), may: preview.may.map(consequence) }
               : {}),
           }
         : null,
+    contentRef: review.contentRef,
     readMore: firstLink(review.links, ["open", "preview"]),
     links: otherLinks(review.links, locale, context.app.name),
     open: firstLink(review.links, ["open", "edit", "status"]) ?? firstObjectHref(review),
@@ -255,6 +318,14 @@ export const reviewActionCard = (review: CapabilityActionCallReview, context: Ac
       : plainText(context.app.name),
     short: capabilityReviewSentence(review, "short", tz),
     hasCheck: Boolean(review.check),
+    slotValues: slotValues(
+      [
+        review.slots,
+        ...(review.consequences ?? []).map((entry) => entry.slots ?? {}),
+        ...(preview?.kind === "rule" ? [preview.when.slots ?? {}, ...preview.may.map((entry) => entry.slots ?? {})] : []),
+      ].flatMap((slots) => Object.values(slots)),
+      { locale, timeZone: context.timeZone },
+    ),
   };
 };
 
@@ -340,7 +411,8 @@ const messageRows = (block: ToolBlock): AiLegacyReviewRow[] => {
   for (const line of message.split("\n").map((entry) => entry.trim())) {
     if (!line || /^Review the validated arguments below before running this action\.$/i.test(line)) continue;
     const heading = /^([^:]{1,40}):$/.exec(line);
-    const match = /^([^:]{1,40}):\s+(.+)$/.exec(line);
+    // The value starts at its first visible character, so the pattern never backtracks over the white space before it.
+    const match = /^([^:]{1,40}):\s+(\S.*)$/.exec(line);
     if (heading) {
       open = { label: heading[1]!, value: "" };
       rows.push(open);

package/src/ai/chat/action-messages.ts

@@ -36,6 +36,13 @@ const messages = i18n.define({
       unavailable: "You can't answer this question here.",
       stopping: "The response is stopping.",
       submitFailed: "Your answer didn't go through. Try again.",
+      fullReview: "Read the complete proposal",
+      baseRevision: ({ revision }: { revision: number }) => `Based on revision ${revision}`,
+      fullReviewLoading: "Loading the complete proposal …",
+      fullReviewFailed: "The complete proposal could not be loaded. Try again before approving.",
+      fullReviewRequired: "Read the complete proposal before approving.",
+      fullReviewRetry: "Try again",
+      fullReviewClose: "Close",
       // Preview
       from: "From",
       to: "To",
@@ -94,6 +101,13 @@ const messages = i18n.define({
       unavailable: "Diese Frage kannst du hier nicht beantworten.",
       stopping: "Die Antwort wird angehalten.",
       submitFailed: "Deine Antwort ging nicht durch. Versuche es noch einmal.",
+      fullReview: "Vollständigen Vorschlag lesen",
+      baseRevision: ({ revision }: { revision: number }) => `Auf Basis von Version ${revision}`,
+      fullReviewLoading: "Der vollständige Vorschlag wird geladen …",
+      fullReviewFailed: "Der vollständige Vorschlag konnte nicht geladen werden. Versuche es vor der Freigabe noch einmal.",
+      fullReviewRequired: "Lies vor der Freigabe den vollständigen Vorschlag.",
+      fullReviewRetry: "Noch einmal versuchen",
+      fullReviewClose: "Schließen",
       from: "Von",
       to: "An",
       cc: "Cc",

package/src/ai/chat/action-question.browser-harness.tsx

@@ -22,6 +22,18 @@ type ToolBlock = Extract<AiTurnBlock, { kind: "tool" }>;
 const params = new URLSearchParams(location.search);
 const lang = (params.get("lang") === "en" ? "en" : "de") as ActionFixtureLocale;
 const fixtures = actionFixtures(lang);
+if (params.has("full")) {
+  const block = fixtures.mail!.block;
+  if (block.review && "sentence" in block.review) {
+    block.review = {
+      ...block.review,
+      contentRef: {
+        href: "/api/approvals/11111111-1111-4111-8111-111111111111/content",
+        digest: "a".repeat(64),
+      },
+    };
+  }
+}
 const state = params.get("state") ?? "open";
 /** Each entry is `fixture` or `fixture:state`; its id is unique even when one fixture shows in several states. */
 const entries = (params.get("scenarios") ?? "mail")