@k2b/cloud 0.41.0 → 0.42.0

package/src/browser/panel-slot.ts

@@ -1,14 +1,21 @@
 import { attachResizeSeparator, LocaleProvider, parkWorkspaceDetailDrawers } from "@k2b/ui";
-import { createComponent } from "solid-js";
+import { createComponent, createSignal } from "solid-js";
 import { render } from "solid-js/web";
 import { PANEL_MAX_WIDTH_REM, PANEL_MIN_WIDTH_REM, readPanelCookie, serializePanelCookie } from "../_internal/panel-cookie";
 import { CloudResourceRefSchema } from "../contracts/capabilities";
 import type { PanelPageContext } from "../contracts/panel-context";
-import { isPanelShortcut, PANEL_CONTEXT_PARAM, panelProviderNeedsConsent, withPanelContext } from "../contracts/panel-context-plain";
+import {
+  isPanelPageContext,
+  isPanelShortcut,
+  PANEL_CONTEXT_PARAM,
+  panelProviderNeedsConsent,
+  withPanelContext,
+} from "../contracts/panel-context-plain";
 import { helpShortcutGroups } from "../ssr/layout-help-start";
 import { platformMessages } from "../ssr/platform-messages";
 import { readShellData } from "../ssr/shell-data";
 import { COMMANDS_CHANGED, contextCommandsWithShortcuts } from "./command-shortcuts";
+import PanelLeaveNotice from "./PanelLeaveNotice";
 import type { PanelRequest } from "./panel";
 import {
   PAGE_CONTEXT_CHANGED,
@@ -17,8 +24,9 @@ import {
   type PanelConsentRequest,
   type PanelState,
 } from "./panel-context-bridge";
+import { panelCanLeave } from "./panel-leave";
 import PanelMenu from "./panel-menu";
-import { isPanelCloseMessage, isPanelReadyMessage, isPanelSearchMessage } from "./panel-messages";
+import { isPanelCloseMessage, isPanelNavigateMessage, isPanelReadyMessage, isPanelSearchMessage } from "./panel-messages";
 import { importOnDemand } from "./reload";
 
 export const PANEL_READY_TIMEOUT_MS = 10_000;
@@ -53,13 +61,100 @@ export function installPanelSlot(): () => void {
   let provider = panel.providers.find((item) => item.id === slot.dataset.provider) ?? panel.providers[0]!;
   let frame = slot.querySelector<HTMLIFrameElement>("[data-cloud-panel-frame]");
   let disposed = false;
-  let context = panel.context ?? null;
+  const [leaveBlocked, setLeaveBlocked] = createSignal(false);
+  const transitionTo = (action: () => void) => {
+    const target = frame?.contentWindow;
+    if (target && !panelCanLeave(target)) {
+      setLeaveBlocked(true);
+      return;
+    }
+    setLeaveBlocked(false);
+    action();
+  };
+  const leaveHost = document.createElement("div");
+  body.before(leaveHost);
+  const disposeLeave = render(
+    () =>
+      createComponent(LocaleProvider, {
+        locale: lang,
+        get children() {
+          return createComponent(PanelLeaveNotice, {
+            get blocked() {
+              return leaveBlocked();
+            },
+            locale: lang,
+            resume: () => {
+              setLeaveBlocked(false);
+              frame?.focus();
+            },
+          });
+        },
+      }),
+    leaveHost,
+  );
+  let base = panel.context ?? null;
+  let context = base;
+  let pageRoot = document.querySelector("[data-nav-root]");
+  let documentPageId = context?.pageId;
+  let lastSeq = context?.seq ?? 0;
+  // The retained provider may have locked onto this document before a swap and this lazy installer.
+  try {
+    const raw = frame && new URL(frame.src, location.href).searchParams.get(PANEL_CONTEXT_PARAM);
+    const initial: unknown = raw ? JSON.parse(raw) : null;
+    if (isPanelPageContext(initial)) {
+      documentPageId = initial.pageId;
+      lastSeq = context?.pageId === documentPageId ? Math.max(lastSeq, initial.seq) : initial.seq;
+      if (context && context.pageId !== documentPageId) context = { ...context, pageId: documentPageId, seq: ++lastSeq };
+    }
+  } catch {
+    // A malformed or absent URL context leaves the shown page's context in charge.
+  }
+  // Set when a swapped page's context has not been delivered yet; cleared by the next delivery.
+  let pageUnsent = false;
+  const followPage = () => {
+    const nextRoot = document.querySelector("[data-nav-root]");
+    if (nextRoot === pageRoot) return;
+    pageRoot = nextRoot;
+    pageUnsent = true;
+    const arriving = readShellData()?.panel;
+    // The arriving page carries the server's current consent answer, as a reload would; a newer revision wins.
+    const consent = arriving?.consent;
+    if (consent) {
+      // Page observations fence pending choices even when a read already learned this revision or the provider changed.
+      if (consent.revision > (observedRevisions.get(consent.provider) ?? 0)) observedRevisions.set(consent.provider, consent.revision);
+      if (consent.revision > (revisions.get(consent.provider) ?? 0)) {
+        answers.set(consent.provider, consent.allowed);
+        revisions.set(consent.provider, consent.revision);
+      }
+    }
+    if (consent && consent.provider === provider.id) {
+      if (consent.allowed !== answers.get(consent.provider) || consent.revision !== revisions.get(consent.provider)) {
+        // An older or unreadable answer (`allowed: null`) is what a reload would show: stop and read again.
+        void revalidate();
+      }
+    } else if (provider.consent && isOpen()) {
+      // The server sends an answer only while the shared cookie shows this provider open; without it, read again.
+      void revalidate();
+    } else if (consentPending === 0) {
+      // A reload would read these answers again when a consent provider opens; so does the next open here.
+      for (const item of panel.providers) if (item.consent) answers.delete(item.id);
+      answersRead = undefined;
+    }
+    base = arriving?.context ?? null;
+    if (base) {
+      documentPageId ??= base.pageId;
+      context = { ...base, pageId: documentPageId, seq: ++lastSeq };
+    } else context = null;
+  };
   let loadVersion = 0;
   const answers = new Map<string, boolean | null>();
   const revisions = new Map<string, number>();
+  // A newer server page supersedes choices made before it, including queued saves and conflict retries.
+  const observedRevisions = new Map<string, number>();
   if (panel.consent) {
     answers.set(panel.consent.provider, panel.consent.allowed);
     revisions.set(panel.consent.provider, panel.consent.revision);
+    observedRevisions.set(panel.consent.provider, panel.consent.revision);
   }
   const saving = new Set<string>();
   const errors = new Set<string>();
@@ -78,13 +173,13 @@ export function installPanelSlot(): () => void {
   // Whether the current frame has seen a context, in its URL or by message; only such a frame needs a clearing null.
   let disclosed = !!frame && new URL(frame.src, location.origin).searchParams.has(PANEL_CONTEXT_PARAM);
   // The frame may have navigated on its own; only the selected provider's page below its panel path may receive context.
-  const showsProvider = () => {
+  const showsProvider = (requireReady = true) => {
     try {
       const shown = frame?.contentWindow?.location;
       const scope = new URL(provider.href, location.origin).pathname.replace(/\/$/, "");
       return (
         !!shown &&
-        frame?.contentDocument?.documentElement.dataset.cloudPanelReady === provider.id &&
+        (!requireReady || frame?.contentDocument?.documentElement.dataset.cloudPanelReady === provider.id) &&
         (shown.pathname === scope || shown.pathname.startsWith(`${scope}/`))
       );
     } catch {
@@ -106,6 +201,7 @@ export function installPanelSlot(): () => void {
   let lastShortcutsJson: string | undefined;
   const canSend = () => isOpen() && allowed() && !!context && slot.dataset.state === "ready" && !!frame?.contentWindow && showsProvider();
   const sendContext = () => {
+    pageUnsent = false;
     if (!canSend()) return;
     const list = !panelProviderNeedsConsent(provider.id) ? shortcuts() : undefined;
     frame?.contentWindow?.postMessage(
@@ -158,15 +254,16 @@ export function installPanelSlot(): () => void {
     if (forgetUrlContext()) disclosed = false;
   };
   const collectContext = () => {
+    followPage();
     if (!context) return;
     const collection: PageContextCollection = { sources: [] };
     window.dispatchEvent(new CustomEvent(PAGE_CONTEXT_COLLECT, { detail: collection }));
     const source = collection.sources.findLast((source) => source.scope !== undefined);
     const parsed = source ? CloudResourceRefSchema.safeParse(source.scope) : undefined;
-    const scope = source ? (parsed?.success ? parsed.data : undefined) : panel.context?.scope;
+    const scope = source ? (parsed?.success ? parsed.data : undefined) : base?.scope;
     if (scope?.type === context.scope?.type && scope?.id === context.scope?.id) return;
-    const { scope: _previous, ...base } = context;
-    context = { ...base, seq: context.seq + 1, ...(scope ? { scope } : {}) };
+    const { scope: _previous, ...previous } = context;
+    context = { ...previous, seq: ++lastSeq, ...(scope ? { scope } : {}) };
     sendContext();
   };
   // Share or stop sharing after every consent step; an open question or its absence follows in update().
@@ -220,8 +317,13 @@ export function installPanelSlot(): () => void {
     }
     for (const item of panel.providers) {
       if (!item.consent) continue;
+      const knownRevision = revisions.get(item.id) ?? 0;
+      const readRevision = nextRevisions.get(item.id);
+      // A page swap can observe a newer answer while this request is in flight. Never rewind that answer.
+      if (readRevision !== undefined && readRevision < knownRevision) continue;
       answers.set(item.id, next.get(item.id) ?? null);
-      revisions.set(item.id, nextRevisions.get(item.id) ?? 0);
+      // An unreadable answer still stops sharing, but must not forget the newest observed revision.
+      revisions.set(item.id, readRevision ?? knownRevision);
     }
     answersStale = false;
   };
@@ -330,7 +432,7 @@ export function installPanelSlot(): () => void {
     clearTimer();
     slot.dataset.state = "ready";
     if (status) status.textContent = "";
-    if (allowed()) {
+    if (allowed() && context) {
       sendContext();
       return;
     }
@@ -427,6 +529,8 @@ export function installPanelSlot(): () => void {
     if (!item || typeof request.allowed !== "boolean" || saving.has(item.id)) return;
     saving.add(item.id);
     errors.delete(item.id);
+    const observedRevision = observedRevisions.get(item.id);
+    const current = () => observedRevisions.get(item.id) === observedRevision;
     const questionHadFocus = slot.querySelector("[data-cloud-panel-consent]")?.contains(document.activeElement);
     // Enqueueing blocks sharing at once, so a withdrawal stops disclosure before its save even starts.
     // keepalive: leaving the page does not cancel the save. A save the browser gives up on (timeout) is rolled back
@@ -441,11 +545,14 @@ export function installPanelSlot(): () => void {
       });
     void enqueueConsent(async () => {
       try {
+        if (!current()) return;
         let response = await put();
+        if (!current()) return;
         // Changed meanwhile (another tab, or a read that failed): the person's choice now is the newest one, so read
         // the current revision and save it once more. A second conflict shows the question again.
         if (response.status === 409) {
           await readAnswersNow();
+          if (!current()) return;
           response = await put();
         }
         if (!response.ok) throw new Error("Panel consent was not saved");
@@ -463,13 +570,17 @@ export function installPanelSlot(): () => void {
           saved.revision <= 0
         )
           throw new Error("Invalid panel consent answer");
-        answers.set(item.id, request.allowed);
-        revisions.set(item.id, saved.revision);
+        if (current() && saved.revision >= (revisions.get(item.id) ?? 0)) {
+          answers.set(item.id, request.allowed);
+          revisions.set(item.id, saved.revision);
+        }
       } catch {
+        // A superseded request cannot invalidate the newer page's answer either.
+        if (!current()) return;
         // Not saved: nothing is shared until the person answers again; the read learns the current revision.
         errors.add(item.id);
         await readAnswersNow();
-        answers.set(item.id, null);
+        if (current()) answers.set(item.id, null);
       } finally {
         saving.delete(item.id);
       }
@@ -509,9 +620,10 @@ export function installPanelSlot(): () => void {
     }
     main.focus();
   };
-  const close = () => {
+  const closeNow = () => {
     if (!isOpen()) return;
     canvas.removeAttribute(attribute());
+    if (!isPhone()) canvas.removeAttribute("data-panel-sheet");
     disposeResize();
     disposeResize = attachResize();
     unload();
@@ -520,7 +632,8 @@ export function installPanelSlot(): () => void {
     update();
     returnFocus();
   };
-  const open = (id: string, nextSearch?: string) => {
+  const close = () => transitionTo(closeNow);
+  const openNow = (id: string, nextSearch?: string) => {
     const next = panel.providers.find((item) => item.id === id);
     if (!next) return;
     parkWorkspaceDetailDrawers(document);
@@ -542,6 +655,7 @@ export function installPanelSlot(): () => void {
     if (frame) focusPanel();
     else focusPending = true;
   };
+  const open = (id: string, nextSearch?: string) => transitionTo(() => openNow(id, nextSearch));
   const request = (request: PanelRequest) => {
     if (request.action === "open") open(request.provider, request.search);
     else if (request.action === "close" || isOpen()) close();
@@ -551,7 +665,17 @@ export function installPanelSlot(): () => void {
     if (!frame || event.source !== frame.contentWindow || event.origin !== location.origin) return;
     if (isPanelReadyMessage(event.data, provider.id)) markReady();
     else if (isPanelCloseMessage(event.data)) close();
-    else if (isPanelSearchMessage(event.data)) {
+    else if (isPanelNavigateMessage(event.data)) {
+      if (!URL.canParse(event.data.href)) return;
+      const url = new URL(event.data.href, location.origin);
+      if (url.origin !== location.origin || !showsProvider(false)) return;
+      const scope = new URL(provider.href, location.origin).pathname.replace(/\/$/, "");
+      const internal = url.pathname === scope || url.pathname.startsWith(`${scope}/`);
+      transitionTo(() => {
+        if (internal) frame?.contentWindow?.location.assign(url.href);
+        else window.location.assign(url.href);
+      });
+    } else if (isPanelSearchMessage(event.data)) {
       const command = contextCommandsWithShortcuts().find((command) => command.id === "cloud.search" && command.shortcut);
       if (command) void importOnDemand(() => import("./commands")).then((commands) => commands?.runContextAwareCommand(command));
     }
@@ -562,8 +686,10 @@ export function installPanelSlot(): () => void {
     if (answer && isOpen()) void saveConsent({ provider: provider.id, allowed: answer.dataset.cloudPanelConsentAnswer === "allow" });
     else if (event.target.closest("[data-cloud-panel-close]")) close();
     else if (event.target.closest("[data-cloud-panel-retry]") && isOpen()) {
-      load(true);
-      frame?.focus();
+      transitionTo(() => {
+        load(true);
+        frame?.focus();
+      });
     } else if (event.target.closest("[data-cloud-panel-grow]") && isPhone()) {
       const full = slot.dataset.panelSize !== "full";
       if (full) slot.dataset.panelSize = "full";
@@ -599,17 +725,18 @@ export function installPanelSlot(): () => void {
     if (isOpen()) {
       seedWidth();
       load();
+    } else if (frame) {
+      // A viewport change must not hide an editor while its leave decision is blocked.
+      canvas.setAttribute(attribute(), "open");
+      transitionTo(closeNow);
     } else unload();
     disposeResize = attachResize();
     update();
   };
   const closeSheet = () => {
     const wasOpen = canvas.dataset.panelSheet === "open";
-    canvas.removeAttribute("data-panel-sheet");
-    if (wasOpen && isPhone()) {
-      unload();
-      update();
-    }
+    if (wasOpen && isPhone()) close();
+    else canvas.removeAttribute("data-panel-sheet");
   };
   const pageShow = (event: PageTransitionEvent) => {
     if (!event.persisted) return;
@@ -657,6 +784,12 @@ export function installPanelSlot(): () => void {
             committedWidth = value;
             writeCookie();
           },
+          onReset: () => {
+            committedWidth = undefined;
+            canvas.style.removeProperty("--cloud-panel-width-set");
+            writeCookie();
+            seedWidth();
+          },
           onCollapseIntent: (armed) => {
             if (armed) slot.dataset.closing = "true";
             else delete slot.dataset.closing;
@@ -680,7 +813,18 @@ export function installPanelSlot(): () => void {
         })
       : () => {};
   let disposeResize = attachResize();
+  // A column island may already have published its place while it mounted; each page's context goes out once.
+  const swapped = () => {
+    collectContext();
+    if (pageUnsent) {
+      pageUnsent = false;
+      if (context && allowed()) sendContext();
+      else stopSharing();
+    } else if (provider.consent && !allowed()) stopSharing();
+    update();
+  };
   collectContext();
+  window.addEventListener("ssr:nav-swapped", swapped);
   window.addEventListener(PAGE_CONTEXT_CHANGED, collectContext);
   window.addEventListener(COMMANDS_CHANGED, commandsChanged);
   window.addEventListener("cloud.panel.consent", consentRequest);
@@ -693,6 +837,7 @@ export function installPanelSlot(): () => void {
   // Restored from the back/forward cache before this lazy module arrived: the server's answers may be outdated.
   if (document.documentElement.hasAttribute("data-cloud-page-restored")) void revalidate();
   window.addEventListener("popstate", closeSheet);
+  window.addEventListener("ssr:nav-popstate", closeSheet);
   window.navigation?.addEventListener("currententrychange", entryChange);
   window.addEventListener("resize", seedWidth);
   // An SSR iframe can have posted its one-shot ready before this lazy module
@@ -730,6 +875,8 @@ export function installPanelSlot(): () => void {
   const dispose = () => {
     if (disposed) return;
     disposed = true;
+    disposeLeave();
+    leaveHost.remove();
     disposeMenu();
     requests.abort();
     ++loadVersion;
@@ -737,6 +884,7 @@ export function installPanelSlot(): () => void {
     clearTimer();
     disposeResize();
     removeFallbackFocus();
+    window.removeEventListener("ssr:nav-swapped", swapped);
     window.removeEventListener(PAGE_CONTEXT_CHANGED, collectContext);
     window.removeEventListener(COMMANDS_CHANGED, commandsChanged);
     window.removeEventListener("cloud.panel.consent", consentRequest);
@@ -747,6 +895,7 @@ export function installPanelSlot(): () => void {
     column.removeEventListener("change", modeChange);
     window.removeEventListener("pageshow", pageShow);
     window.removeEventListener("popstate", closeSheet);
+    window.removeEventListener("ssr:nav-popstate", closeSheet);
     window.navigation?.removeEventListener("currententrychange", entryChange);
     window.removeEventListener("resize", seedWidth);
     installed = undefined;

package/src/browser/panel.ts

@@ -1,4 +1,7 @@
 import type { PanelPageContext } from "../contracts/panel-context";
+
+export { onPanelBeforeLeave } from "./panel-leave";
+
 import {
   PAGE_CONTEXT_CHANGED,
   PAGE_CONTEXT_COLLECT,

package/src/browser/resource-search-messages.ts

@@ -4,6 +4,7 @@ export const resourceSearchMessages = i18n.define({
   baseLocale: "en",
   messages: {
     en: {
+      app: "App",
       actions: "Actions",
       contextActions: "On this page",
       commandPlaceholder: "Find an action…",
@@ -54,6 +55,7 @@ export const resourceSearchMessages = i18n.define({
       loadingTags: "Loading filters…",
     },
     de: {
+      app: "App",
       actions: "Aktionen",
       contextActions: "Auf dieser Seite",
       commandPlaceholder: "Aktion finden…",

package/src/capabilities/client.ts

@@ -2,8 +2,13 @@ import { z } from "zod";
 import {
   CAPABILITY_FRAMEWORK_ERROR_CODES,
   CAPABILITY_MAX_CATALOG_BYTES,
+  CAPABILITY_MAX_REVIEW_CONTENT_BYTES,
+  CAPABILITY_MAX_REVIEW_RESPONSE_BYTES,
   CapabilityActionReviewDataSchema,
   CapabilityCatalogSchema,
+  type CapabilityReviewContentRef,
+  CapabilityReviewContentRefSchema,
+  CapabilityReviewContentSchema,
   capabilityResultSchema,
 } from "../contracts/capabilities";
 import { capabilityMessages } from "../shared/capability-messages";
@@ -142,7 +147,29 @@ export const reviewCapabilityAction = async <TInput = unknown>(
       body: JSON.stringify({ input: invocation.input }),
       signal: invocation.signal,
     });
-    return readCapabilityResponse(response, CapabilityActionReviewDataSchema);
+    return await readCapabilityResponse(
+      response,
+      CapabilityActionReviewDataSchema,
+      CAPABILITY_MAX_REVIEW_RESPONSE_BYTES,
+      invocation.signal,
+    );
+  } catch (cause) {
+    return unavailable(cause, undefined, clientLocale(options.headers));
+  }
+};
+
+/** Load exactly one stored snapshot using the caller's normal Cloud authentication. A locator grants no access. */
+export const readCapabilityReviewContent = async (
+  reference: CapabilityReviewContentRef,
+  options: CapabilityHttpOptions & { signal?: AbortSignal } = {},
+) => {
+  try {
+    const ref = CapabilityReviewContentRefSchema.parse(reference);
+    const response = await (options.fetch ?? globalThis.fetch)(
+      requestUrl(options.baseUrl ?? "/api", `${ref.href.slice(4)}?digest=${encodeURIComponent(ref.digest)}`),
+      { headers: options.headers, credentials: "same-origin", cache: "no-store", signal: options.signal },
+    );
+    return await readCapabilityResponse(response, CapabilityReviewContentSchema, CAPABILITY_MAX_REVIEW_CONTENT_BYTES, options.signal);
   } catch (cause) {
     return unavailable(cause, undefined, clientLocale(options.headers));
   }

package/src/capabilities/executions.ts

@@ -1,5 +1,7 @@
 import { sql } from "bun";
+import { createCapabilityDeadline } from "../_internal/capability-timeout";
 import type { CapabilityOrigin } from "../contracts/capabilities";
+import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
 import { pruneApprovalRequests } from "../services/approvals";
 import { logger } from "../services/logging";
 import { CAPABILITY_CLAIM_RETENTION_HOURS, pruneCapabilityIdempotencyClaims } from "./claims";
@@ -101,7 +103,17 @@ export type CapabilityExecution = {
 /** Insert one execution record. Called only by the capability dispatcher and the surfaces that deny before it. */
 export const recordCapabilityExecution = async (input: CapabilityExecutionInput): Promise<string> => {
   const durationMs = Math.max(0, Math.round(input.completedAt.getTime() - input.startedAt.getTime()));
-  const [row] = await sql<{ id: string }[]>`
+  // An observational write has its own transport-headroom budget, even when
+  // the invocation already expired. Do not hold its caller on a dead database.
+  const deadline = createCapabilityDeadline(REQUEST_IDLE_TIMEOUT_SECONDS * 1000, new AbortController().signal);
+  try {
+    return await deadline.wait(() =>
+      sql.begin(async (db) => {
+        // A connection obtained after the deadline must never start the insert.
+        deadline.check();
+        await db`SELECT set_config('statement_timeout', ${`${deadline.remainingMs()}ms`}, true)`;
+        deadline.check();
+        const [row] = await db<{ id: string }[]>`
     INSERT INTO capabilities.executions (
       request_id, origin, app_id, capability, kind, destructive,
       actor_kind, actor_id, user_id, access_subject_type, access_subject_id,
@@ -117,8 +129,15 @@ export const recordCapabilityExecution = async (input: CapabilityExecutionInput)
       ${input.idempotencyKey ?? null}, ${input.replayed ?? false}, ${input.startedAt}, ${input.completedAt}, ${durationMs}
     )
     RETURNING id::text AS id
-  `;
-  return row!.id;
+        `;
+        // Roll back a late result rather than commit an abandoned transaction.
+        deadline.check();
+        return row!.id;
+      }),
+    );
+  } finally {
+    deadline.clear();
+  }
 };
 
 export type CapabilityExecutionFilter = {

package/src/capabilities/geo-client.ts

@@ -0,0 +1,57 @@
+import type { z } from "zod";
+import { geoContract } from "../contracts/geo";
+import { geoMapContract } from "../contracts/geo-map";
+import { geoRouteContract } from "../contracts/geo-route";
+import { type CapabilityCaller, invokeCapabilityWithDataSchema } from "./server";
+
+/** Calls Core using the caller's interactive identity, invocation transport, or durable mandate. */
+export const geoClient = {
+  mapStyle: (input: z.input<typeof geoMapContract.style.input>, caller: CapabilityCaller) =>
+    invokeCapabilityWithDataSchema(
+      { kind: "query", appId: "core", capabilityId: geoMapContract.style.id, input },
+      geoMapContract.style.data,
+      caller,
+    ),
+  calculateRoute: (input: z.input<typeof geoRouteContract.calculateRoute.input>, caller: CapabilityCaller) =>
+    invokeCapabilityWithDataSchema(
+      { kind: "query", appId: "core", capabilityId: geoRouteContract.calculateRoute.id, input },
+      geoRouteContract.calculateRoute.data,
+      caller,
+    ),
+  updateRoute: (input: z.input<typeof geoRouteContract.updateRoute.input>, caller: CapabilityCaller) =>
+    invokeCapabilityWithDataSchema(
+      { kind: "query", appId: "core", capabilityId: geoRouteContract.updateRoute.id, input },
+      geoRouteContract.updateRoute.data,
+      caller,
+    ),
+  autocomplete: (input: z.input<typeof geoContract.autocomplete.input>, caller: CapabilityCaller) =>
+    invokeCapabilityWithDataSchema(
+      { kind: "query", appId: "core", capabilityId: geoContract.autocomplete.id, input },
+      geoContract.autocomplete.data,
+      caller,
+    ),
+  geocode: (input: z.input<typeof geoContract.geocode.input>, caller: CapabilityCaller) =>
+    invokeCapabilityWithDataSchema(
+      { kind: "query", appId: "core", capabilityId: geoContract.geocode.id, input },
+      geoContract.geocode.data,
+      caller,
+    ),
+  reverse: (input: z.input<typeof geoContract.reverse.input>, caller: CapabilityCaller) =>
+    invokeCapabilityWithDataSchema(
+      { kind: "query", appId: "core", capabilityId: geoContract.reverse.id, input },
+      geoContract.reverse.data,
+      caller,
+    ),
+  searchPlaces: (input: z.input<typeof geoContract.searchPlaces.input>, caller: CapabilityCaller) =>
+    invokeCapabilityWithDataSchema(
+      { kind: "query", appId: "core", capabilityId: geoContract.searchPlaces.id, input },
+      geoContract.searchPlaces.data,
+      caller,
+    ),
+  availability: (caller: CapabilityCaller) =>
+    invokeCapabilityWithDataSchema(
+      { kind: "query", appId: "core", capabilityId: geoContract.availability.id, input: {} },
+      geoContract.availability.data,
+      caller,
+    ),
+};

package/src/capabilities/response.ts

@@ -7,8 +7,9 @@ export const readCapabilityResponse = async <T>(
   response: Response,
   schema: z.ZodType<T>,
   maxBytes = CAPABILITY_MAX_RESULT_BYTES,
+  signal?: AbortSignal,
 ): Promise<CapabilityResultState<T>> => {
-  const parsedBody = await readBoundedJson(response, maxBytes);
+  const parsedBody = await readBoundedJson(response, maxBytes, signal);
   if (!parsedBody.ok && parsedBody.reason === "too_large") {
     return {
       ok: false,

package/src/capabilities/review-storage.ts

@@ -0,0 +1,24 @@
+import { CapabilityReviewContentSchema } from "../contracts/capabilities";
+
+/** JSONB cannot store NUL or lone UTF-16 surrogates. Nest the content's JSON as
+ * text in the existing snapshot, preserving every code unit and the public digest. */
+export const serializeReviewSnapshot = (review: unknown): string => {
+  if (review && typeof review === "object" && "content" in review && review.content !== undefined)
+    return JSON.stringify({ ...review, content: JSON.stringify(CapabilityReviewContentSchema.parse(review.content)) });
+  return JSON.stringify(review);
+};
+
+export const parseStoredReviewContent = (value: unknown) => {
+  try {
+    return CapabilityReviewContentSchema.safeParse(typeof value === "string" ? JSON.parse(value) : value);
+  } catch {
+    return CapabilityReviewContentSchema.safeParse(null);
+  }
+};
+
+export const restoreReviewSnapshot = (review: unknown): unknown => {
+  if (!review || typeof review !== "object" || !("content" in review)) return review;
+  const content = parseStoredReviewContent(review.content);
+  // Invalid stored content must fail validation, never become a content-free review.
+  return { ...review, content: content.success ? content.data : null };
+};

package/src/capabilities/reviews.ts

@@ -14,10 +14,11 @@ export const capabilityPreviewIssues = (
   preview: CapabilityPreview | undefined,
   links: readonly CapabilitySemanticLink[] | undefined,
   sends = false,
+  completeContent = false,
 ): string[] => {
   if (!preview) return [];
   const issues: string[] = [];
-  const open = links?.some((link) => link.rel === "open");
+  const open = completeContent || links?.some((link) => link.rel === "open");
   if ("truncated" in preview && preview.truncated && !open) issues.push("A truncated preview requires an open link");
   if (preview.kind === "message") {
     if ((Object.values(preview.more ?? {}).some((count) => count > 0) || (preview.moreAttachments ?? 0) > 0) && !open)
@@ -33,9 +34,22 @@ export const capabilityReviewFormIssues = (review: CapabilityActionCallReview):
   for (const form of ["confirm", "decline"] as const)
     if (Array.from(capabilityReviewSentence(review, form, { timeZone: "UTC" })).length > 40)
       issues.push(`${form} exceeds 40 rendered characters`);
-  issues.push(...capabilityPreviewIssues(review.preview, review.links, review.ask === "sends"));
+  issues.push(...capabilityPreviewIssues(review.preview, review.links, review.ask === "sends", Boolean(review.content)));
+  if (
+    review.content &&
+    review.preview &&
+    review.content.kind !== review.preview.kind &&
+    !(review.content.kind === "message" && review.preview.kind === "page")
+  )
+    issues.push("Full content must have the same kind as its preview");
+  if (review.content?.kind === "message" && review.ask === "sends") {
+    if (!review.content.from) issues.push("Full sends content requires from");
+    if (!review.content.to.length && !review.content.cc?.length && !review.content.bcc?.length)
+      issues.push("Full sends content requires a recipient");
+  }
   try {
-    if (new TextEncoder().encode(JSON.stringify(review)).byteLength > CAPABILITY_MAX_REVIEW_BYTES) issues.push("Review exceeds 32 KiB");
+    const { content: _content, ...compact } = review;
+    if (new TextEncoder().encode(JSON.stringify(compact)).byteLength > CAPABILITY_MAX_REVIEW_BYTES) issues.push("Review exceeds 32 KiB");
   } catch {
     issues.push("Review is not JSON serializable");
   }