@k2b/cloud 0.43.0 → 0.44.0

package/src/api/pwa.ts

@@ -28,7 +28,7 @@ const log = logger("pwa");
 
 const MESSAGES: Record<PwaError["code"], string> = {
   UNAVAILABLE: "The mobile app is not available right now.",
-  REAUTHENTICATE: "Sign in again to pair a phone.",
+  REAUTHENTICATE: "Sign in again to pair a device.",
   FORBIDDEN: "Use Cloud on the web for this.",
   ACCOUNT_BLOCKED: "This account cannot use the mobile app right now.",
   INVALID_REQUEST: "The request is not valid.",
@@ -40,7 +40,7 @@ const MESSAGES: Record<PwaError["code"], string> = {
   ALREADY_PAIRED: "This app is paired with another account.",
   ACCOUNT_MISMATCH: "This browser is signed in to another account.",
   LIMIT_REACHED: "The limit for this account was reached.",
-  UNPAIRED: "This phone is not paired.",
+  UNPAIRED: "This device is not paired.",
 };
 
 /** `{ code, message }` with a safe English message; the UI maps codes to its own catalog. */
@@ -95,7 +95,7 @@ const webActor = async (c: Context) => {
   const session = token ? await auth.session.authenticateRequest(c, token) : null;
   if (!session) throw new PwaError("REAUTHENTICATE", 403);
   if (session.data.kind !== "web") throw new PwaError("FORBIDDEN", 403);
-  return { userId: session.user.id, sid: session.data.sid };
+  return { userId: session.user.id, sid: session.data.sid, admin: session.user.roles.includes("admin") };
 };
 
 /** The phone this request also comes from (Chrome on a paired Android phone shares the app's cookies). */
@@ -119,7 +119,7 @@ export const createPwaRoutes = (options: PwaRouteOptions = {}) => {
       "/pairings",
       describeRoute({
         tags,
-        summary: "Start pairing a phone",
+        summary: "Start pairing a device",
         description: "Needs a web sign-in from the last ten minutes. The link secret is returned once.",
         responses: { 201: jsonResponse(PwaPairingStartResultSchema, "Pairing started") },
       }),
@@ -129,13 +129,33 @@ export const createPwaRoutes = (options: PwaRouteOptions = {}) => {
         return c.json(await service.startPairing(actor), 201);
       },
     )
+    .post(
+      "/users/:userId/pairings",
+      describeRoute({
+        tags,
+        summary: "Pair the Cloud app for another person",
+        description:
+          "Administrator web session only, signed in within ten minutes. App sessions and API keys are refused. The target account must be active. Uses the existing account pairing and device limits. After the administrator confirms the device code, the device must explicitly accept before credentials are issued.",
+        responses: {
+          201: jsonResponse(PwaPairingStartResultSchema, "Administrative pairing started"),
+          403: { description: "Administrator, fresh web sign-in or active account required" },
+        },
+      }),
+      v("param", z.object({ userId: z.string().uuid() }), pwaInvalidRequest),
+      async (c) => {
+        const actor = await webActor(c);
+        if (!actor.admin) throw new PwaError("FORBIDDEN", 403);
+        if (!shellAvailable(c)) throw new PwaError("UNAVAILABLE", 503);
+        return c.json(await service.startUserPairing(actor, c.req.valid("param").userId), 201);
+      },
+    )
     .get(
       "/pairings/:id",
       describeRoute({
         tags,
         summary: "Read a pairing",
         description:
-          "Only for the web session that started it. Never returns the code. A pending read is held for up to one poll interval and answers as soon as the phone claims the link.",
+          "Only for the web session that started it. Never returns the code. A pending read is held for up to one poll interval and answers as soon as the device claims the link.",
         responses: { 200: jsonResponse(PwaPairingStatusSchema, "Pairing state") },
       }),
       v("param", IdParamSchema, pwaInvalidRequest),
@@ -147,7 +167,13 @@ export const createPwaRoutes = (options: PwaRouteOptions = {}) => {
     )
     .post(
       "/pairings/:id/confirm",
-      describeRoute({ tags, summary: "Confirm a pairing with the code the phone shows", responses: { 204: { description: "Confirmed" } } }),
+      describeRoute({
+        tags,
+        summary: "Confirm a pairing with the code the device shows",
+        description:
+          "Administrative pairings enter awaiting_device; only the claiming device can then accept or reject. Self-pairing proceeds as before.",
+        responses: { 204: { description: "Confirmed" } },
+      }),
       v("param", IdParamSchema, pwaInvalidRequest),
       v("json", PwaPairingConfirmSchema, pwaInvalidRequest),
       async (c) => {
@@ -166,7 +192,7 @@ export const createPwaRoutes = (options: PwaRouteOptions = {}) => {
     )
     .get(
       "/devices",
-      describeRoute({ tags, summary: "List paired phones", responses: { 200: jsonResponse(PwaDeviceListSchema, "Active phones") } }),
+      describeRoute({ tags, summary: "List paired devices", responses: { 200: jsonResponse(PwaDeviceListSchema, "Active devices") } }),
       async (c) => {
         const actor = await webActor(c);
         return c.json({ items: await service.list(actor, await currentDeviceId(c, actor.userId)) });
@@ -174,7 +200,7 @@ export const createPwaRoutes = (options: PwaRouteOptions = {}) => {
     )
     .delete(
       "/devices/:id",
-      describeRoute({ tags, summary: "Remove a paired phone", responses: { 204: { description: "Removed; idempotent" } } }),
+      describeRoute({ tags, summary: "Remove a paired device", responses: { 204: { description: "Removed; idempotent" } } }),
       v("param", IdParamSchema, pwaInvalidRequest),
       async (c) => {
         await service.revoke(await webActor(c), c.req.valid("param").id);

package/src/api/resource-links.ts

@@ -1,6 +1,10 @@
 import { z } from "zod";
-import { getCapability } from "../_internal/registry";
+import { canonicalRoute } from "../_internal/app-path";
+import { readBoundedJson } from "../_internal/bounded-json";
+import { resolveCapabilityManifestPresentation } from "../_internal/capabilities";
+import { getCapability, listApps, listCapabilities } from "../_internal/registry";
 import {
+  CAPABILITY_MAX_RESULT_BYTES,
   CapabilitySemanticLinkSchema,
   type CloudResourceRef,
   CloudResourceRefSchema,
@@ -8,20 +12,26 @@ import {
   cloudResourceRefAppId,
   resolveCapabilityResourceReader,
 } from "../contracts/capabilities";
+import { parseCloudResourceUrl } from "../contracts/resource-clipboard";
+import { localCloudResourceUrl, matchCloudResourcePage } from "../contracts/resource-pages";
+import type { ResolvedCloudResourceUrl } from "../contracts/resource-resolution";
 import type { RequestAuthority } from "../server";
+import * as settings from "../services/settings";
+import { publicCloudOrigin } from "../shared/app-url";
 import { dispatchCapability } from "./capabilities";
 
-export const resolveCloudResourceHref = async (
+const readCloudResourceLink = async (
   params: { ref: CloudResourceRef; request: Request; authority: RequestAuthority; locale?: string },
   dependencies: { getCapability?: typeof getCapability; dispatch?: typeof dispatchCapability } = {},
-): Promise<string | null> => {
+): Promise<ResolvedCloudResourceUrl | null> => {
   const parsed = CloudResourceRefSchema.safeParse(params.ref);
   if (!parsed.success) return null;
   const ref = parsed.data;
   const appId = cloudResourceRefAppId(ref);
   const app = await (dependencies.getCapability ?? getCapability)(appId);
   if (!app || app.appId !== appId) return null;
-  const reader = resolveCapabilityResourceReader(app.manifest, ref);
+  const manifest = params.locale ? resolveCapabilityManifestPresentation(app.manifest, app.presentation, params.locale) : app.manifest;
+  const reader = resolveCapabilityResourceReader(manifest, ref);
   if (!reader) return null;
   const response = await (dependencies.dispatch ?? dispatchCapability)({
     request: params.request,
@@ -34,10 +44,77 @@ export const resolveCloudResourceHref = async (
     input: { id: ref.id },
   });
   if (!response.ok) return null;
-  const result = capabilityResultSchema(z.unknown(), { consumer: true }).safeParse(await response.json());
+  const body = await readBoundedJson(response, CAPABILITY_MAX_RESULT_BYTES, params.request.signal);
+  if (!body.ok) return null;
+  const result = capabilityResultSchema(z.unknown(), { consumer: true }).safeParse(body.data);
   if (!result.success) return null;
   const link = CapabilitySemanticLinkSchema.safeParse(
     result.data.links?.find((link) => link.rel === "open") ?? result.data.links?.find((link) => link.rel === "edit"),
   );
-  return link.success ? link.data.href : null;
+  if (!link.success) return null;
+  const type = manifest.types.find((type) => `${appId}.${type.localId}` === ref.type);
+  if (!type) return null;
+  const reference = result.data.refs?.find((entry) => entry.type === ref.type && entry.id === ref.id);
+  const icon = reference?.icon ?? type.icon;
+  return { ref, title: reference?.title ?? type.title, ...(icon ? { icon } : {}), href: link.data.href };
+};
+
+/** Resolve a known reference through its authorized reader. */
+export const resolveCloudResourceHref = async (
+  params: Parameters<typeof readCloudResourceLink>[0],
+  dependencies: Parameters<typeof readCloudResourceLink>[1] = {},
+): Promise<string | null> => (await readCloudResourceLink(params, dependencies))?.href ?? null;
+
+/** Recognize one local URL, then read the resource under the caller's authority. All failures are opaque. */
+export const resolveCloudResourceUrl = async (
+  params: { url: string; request: Request; authority: RequestAuthority; locale?: string },
+  dependencies: Parameters<typeof readCloudResourceLink>[1] & {
+    appUrl?: () => Promise<string | null | undefined>;
+    listApps?: typeof listApps;
+    listCapabilities?: typeof listCapabilities;
+  } = {},
+): Promise<ResolvedCloudResourceUrl | null> => {
+  try {
+    const configured = await (dependencies.appUrl ?? (() => settings.get<string>("app.url")))();
+    const origin = configured ? publicCloudOrigin(configured) : null;
+    const url = localCloudResourceUrl(params.url, origin);
+    if (!url) return null;
+    // Permalinks share the existing parser; fragments and incidental query parameters do not change identity.
+    let ref = parseCloudResourceUrl(`${url.pathname}`, origin ?? url.origin);
+    if (!ref && !url.pathname.startsWith("/open/")) {
+      const apps = await (dependencies.listApps ?? listApps)();
+      // Honor a more specific live owner, including apps that publish no resource pages.
+      // A root or ancestor route must not capture their links. Equal prefix claims fail closed.
+      const pathname = canonicalRoute(url.pathname);
+      const namespace = pathname.split("/");
+      const routes = apps.flatMap((app) =>
+        app.routes.flatMap((route) => {
+          const prefix = canonicalRoute(route);
+          if (!prefix.startsWith("/") || /[%\\?#\s]/.test(prefix) || prefix.split("/").some((part) => part === "." || part === ".."))
+            return [];
+          if (namespace[1] === "app" && namespace[2] && namespace[2] !== app.id) return [];
+          return prefix === "/" || pathname === prefix || pathname.startsWith(`${prefix}/`)
+            ? [{ appId: app.id, length: prefix.length }]
+            : [];
+        }),
+      );
+      const longest = routes.reduce((length, route) => Math.max(length, route.length), 0);
+      const owners = new Set(routes.filter((route) => route.length === longest).map((route) => route.appId));
+      if (owners.size !== 1) return null;
+      const catalog = await (dependencies.listCapabilities ?? listCapabilities)(apps);
+      const pages = catalog.flatMap((entry) => {
+        const app = apps.find((app) => app.id === entry.appId);
+        if (!app || !owners.has(app.id) || entry.manifest.appId !== app.id) return [];
+        return (entry.manifest.resourcePages ?? []).flatMap((page) => {
+          const ref = { type: `${app.id}.${page.type}`, id: "candidate" };
+          return resolveCapabilityResourceReader(entry.manifest, ref) ? [{ type: ref.type, path: page.path, prefixes: app.routes }] : [];
+        });
+      });
+      ref = matchCloudResourcePage(`${url.pathname}${url.search}`, pages);
+    }
+    return ref ? await readCloudResourceLink({ ...params, ref }, dependencies) : null;
+  } catch {
+    // Never include a pasted URL, resource existence, or provider error in this result.
+    return null;
+  }
 };

package/src/api/resource-resolve.ts

@@ -0,0 +1,50 @@
+import { Hono } from "hono";
+import { describeRoute, resolver } from "hono-openapi";
+import { z } from "zod";
+import { readBoundedJson } from "../_internal/bounded-json";
+import { withCapabilityRequestTimeout } from "../_internal/capability-timeout";
+import { RESOURCE_URL_MAX_LENGTH } from "../contracts/resource-pages";
+import { ResolvedCloudResourceUrlSchema } from "../contracts/resource-resolution";
+import { type AuthContext, auth, getLocale } from "../server";
+import { resolveCloudResourceUrl } from "./resource-links";
+
+const Input = z.object({ url: z.string().min(1).max(RESOURCE_URL_MAX_LENGTH) }).strict();
+const NotFound = { error: "Resource not found" } as const;
+
+export const createResourceResolveRoutes = (resolve = resolveCloudResourceUrl) =>
+  new Hono<AuthContext>().post(
+    "/resolve",
+    auth.readOnly,
+    auth.requireRole("authenticated"),
+    describeRoute({
+      tags: ["Resources"],
+      summary: "Resolve a Cloud URL through its authorized resource reader",
+      requestBody: { required: true, content: { "application/json": { schema: resolver(Input) } } },
+      responses: {
+        200: { description: "Readable resource", content: { "application/json": { schema: resolver(ResolvedCloudResourceUrlSchema) } } },
+        404: {
+          description: "Resource not found",
+          content: { "application/json": { schema: resolver(z.object({ error: z.literal(NotFound.error) })) } },
+        },
+      },
+    }),
+    async (c) => {
+      try {
+        // JSON may encode each UTF-16 unit as six bytes. Bound the envelope before parsing.
+        const body = await readBoundedJson(c.req.raw, RESOURCE_URL_MAX_LENGTH * 6 + 100, c.req.raw.signal);
+        const input = body.ok ? Input.safeParse(body.data) : null;
+        if (!input?.success) return c.json(NotFound, 404);
+        const result = await withCapabilityRequestTimeout(c, "query", () =>
+          resolve({
+            url: input.data.url,
+            request: c.req.raw,
+            authority: auth.getAuthority(c),
+            locale: getLocale(c),
+          }),
+        );
+        return result ? c.json(result, 200) : c.json(NotFound, 404);
+      } catch {
+        return c.json(NotFound, 404);
+      }
+    },
+  );

package/src/api/search/schemas.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { CloudResourceRefSchema } from "../../contracts";
-import { CapabilitySearchTagManifestSchema } from "../../contracts/capabilities";
+import { CapabilitySearchTagManifestSchema, CloudResourceReferenceSchema } from "../../contracts/capabilities";
 
 const TAG_PATTERN = /^[^\s#]+$/;
 const SEARCH_BASE_URL = "https://cloud.invalid";
@@ -69,6 +69,8 @@ export const SearchItemSchema = z.object({
   ref: CloudResourceRefSchema,
   title: z.string(),
   href: SameOriginPathSchema,
+  context: CloudResourceReferenceSchema.shape.context,
+  status: CloudResourceReferenceSchema.shape.status,
   preview: z.string().optional(),
   icon: z.string().optional(),
   priority: z.number().int().min(0).max(9).optional(),

package/src/api/search.ts

@@ -139,9 +139,14 @@ export const createSearchRoutes = (dependencies: SearchRouteDependencies = {}) =
       const stream = acceptsStream(c.req.header("accept"));
       const requestId = normalizeInvocationRequestId(c.req.header("x-request-id"));
       const invocationAuthority = invocationAuthorityFromRequest(auth.getAuthority(c));
+      // One request-wide budget covers resource access, signing and provider I/O.
+      const providerDeadline = AbortSignal.timeout(PROVIDER_TIMEOUT_MS);
+      // A client that stops reading a stream ends the search too.
+      const streamCancelled = new AbortController();
+      const fanoutSignal = AbortSignal.any([c.req.raw.signal, providerDeadline, streamCancelled.signal]);
       let entries: CapabilityRegistryEntry[];
       try {
-        entries = await discoverableAppEntries(appAccessAuthority(c), await registry(), dependencies.listApps);
+        entries = await discoverableAppEntries(appAccessAuthority(c), await registry(), dependencies.listApps, { signal: fanoutSignal });
       } catch (error) {
         log.warn("Search capability registry unavailable", { error: error instanceof Error ? error.message : String(error) });
         return c.json(
@@ -227,11 +232,6 @@ export const createSearchRoutes = (dependencies: SearchRouteDependencies = {}) =
       // at GLOBAL_RESULT_LIMIT so a single app can saturate the response
       // but no more.
       const effectiveProviderLimit = active.length === 1 ? Math.min(GLOBAL_RESULT_LIMIT, query.provider_limit * 3) : query.provider_limit;
-      // The same request-wide budget covers signing and provider I/O.
-      const providerDeadline = AbortSignal.timeout(PROVIDER_TIMEOUT_MS);
-      // A client that stops reading a stream, such as the browser on the next keystroke, ends the search too.
-      const streamCancelled = new AbortController();
-      const fanoutSignal = AbortSignal.any([c.req.raw.signal, providerDeadline, streamCancelled.signal]);
       // Guard the whole issuance batch once, then reuse the prepared signer for
       // every target. This is one Postgres check per outer search request, not
       // one check per provider.
@@ -258,7 +258,7 @@ export const createSearchRoutes = (dependencies: SearchRouteDependencies = {}) =
                           signer,
                           issuer: signer.issuer,
                         },
-                        { db, groupsAdmin: signer.groupsAdmin },
+                        { db, groupsAdmin: signer.groupsAdmin, signal: fanoutSignal },
                       ),
                     fanoutSignal,
                   ),
@@ -353,6 +353,8 @@ export const createSearchRoutes = (dependencies: SearchRouteDependencies = {}) =
             ref: view.ref,
             title: view.title,
             href: open.href,
+            context: view.context,
+            status: view.status,
             preview: view.preview,
             icon: view.icon,
             priority: view.priority,

package/src/app-pwa/contracts.ts

@@ -114,6 +114,8 @@ export const appPwaDeviceOperation = <I, O>(definition: {
   run: async (context, input) => parse(definition.output, await definition.handler(context, parse(definition.input, input))),
 });
 
+export type AppPwaCoreQuery = "address.autocomplete";
+
 export type AppPwaOptions = {
   app: { id: string; installable: Pick<AppInstallable, "path"> };
   /** Authoritative configured public origin, never a Host/Forwarded/request header. HTTPS is mandatory. */
@@ -131,6 +133,8 @@ export type AppPwaOptions = {
    * Called before issuance and again before commit, including issuance retries. */
   authorizeVisit(signIn: AppPwaWebSignIn, subject: unknown, tx: TransactionSQL): Promise<boolean>;
   queries?: Readonly<Record<string, AppPwaQuery>>;
+  /** Read-only platform queries available through the closed guest Core-query route. Empty by default. */
+  coreQueries?: readonly AppPwaCoreQuery[];
   commands?: Readonly<Record<string, AppPwaCommand>>;
   deviceOperations?: Readonly<Record<string, AppPwaDeviceOperation>>;
   /** Missing operation declarations deny access; operation registration alone grants nothing. */

package/src/app-pwa/core-query-error.ts

@@ -0,0 +1,20 @@
+import type { GeoError } from "../services/geo/errors";
+
+/** Guest-safe errors from the allowlisted platform adapter, never from application handlers. */
+export class AppPwaCoreQueryError extends Error {
+  readonly code: GeoError["code"];
+  readonly status: GeoError["status"];
+  readonly details?: { scope: "person" | "cloud"; resetsAt: string };
+  constructor(error: GeoError) {
+    super(error.code);
+    this.code = error.code;
+    this.status = error.status;
+    if (
+      error.code === "GEO_BUDGET_EXHAUSTED" &&
+      (error.details.scope === "person" || error.details.scope === "cloud") &&
+      typeof error.details.resetsAt === "string"
+    ) {
+      this.details = { scope: error.details.scope, resetsAt: error.details.resetsAt };
+    }
+  }
+}

package/src/app-pwa/index.ts

@@ -2,6 +2,7 @@ export {
   APP_PWA_LIMITS,
   type AppPwaActor,
   type AppPwaCommandContext,
+  type AppPwaCoreQuery,
   type AppPwaDeviceActor,
   type AppPwaDeviceContext,
   type AppPwaDeviceView,

package/src/app-pwa/service.ts

@@ -1,10 +1,17 @@
 import { sql, type TransactionSQL } from "bun";
 import { z } from "zod";
+import { GeoAutocompleteInputSchema } from "../contracts/geo";
 import { isInstallablePath } from "../contracts/installable";
 import { PWA_LIMITS } from "../contracts/pwa";
+import { ratelimit } from "../server/ratelimit";
+import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
 import { getEffectivePermission, hasPermission } from "../server/services/access";
 import { audit } from "../services/audit";
+import { GeoError } from "../services/geo/errors";
+import { coreGeo } from "../services/geo/service";
+import { geoPlan, readGeoConfig } from "../services/geo/settings";
 import { pairingSecret } from "../services/pairing-secret";
+import { get as getSetting } from "../services/settings";
 import { databaseClock, lockWebAuthority } from "./authority";
 import {
   type AppPwaActor,
@@ -22,9 +29,11 @@ import {
   parseAppPwaInput as parse,
   pwaFail,
 } from "./contracts";
+import { AppPwaCoreQueryError } from "./core-query-error";
 import { appPwaQr, parseAppPwaQr } from "./protocol";
 import { appPwaSchemaName, setupAppPwa } from "./schema";
 import { withAppPwaTransaction } from "./transaction";
+import { untilAppPwaAbort } from "./transport-input";
 
 type Browser = { credential_hash: string; device_id: string | null; expires_at: Date };
 type Device = {
@@ -121,6 +130,9 @@ const liveVisit = (visit: Visit, time: Date) =>
 export const createAppPwaService = (options: AppPwaOptions) => {
   if (typeof options.authorizeStaff !== "function" || typeof options.authorizeVisit !== "function")
     throw new Error("App-PWA requires staff and visit-subject authorization");
+  const coreQueries = new Set(options.coreQueries ?? []);
+  if (!Array.isArray(options.coreQueries ?? []) || [...coreQueries].some((query) => query !== "address.autocomplete"))
+    throw new Error("Unsupported App-PWA Core query");
   const db = options.db ?? sql;
   const appId = options.app.id;
   const path = options.app.installable.path;
@@ -343,6 +355,32 @@ export const createAppPwaService = (options: AppPwaOptions) => {
     if (visit.device_id !== device.id || visit.browser_hash !== device.browser_hash) return pwaFail("NOT_FOUND", 404);
     return visit;
   };
+  const coreActor = async (tx: TransactionSQL, device: Device, beforeCommit: BeforeCommit, visitId?: string): Promise<AppPwaActor> => {
+    const currentVisit = visitId ?? device.active_visit_id;
+    if (!currentVisit) return deviceActor(device);
+    const visit = await boundVisit(tx, device, currentVisit);
+    if (device.active_visit_id !== visit.id) return pwaFail("REVOKED", 410);
+    // Device mode resumes after a visit ends. Explicit visit requests never fall back.
+    if (!visitId && !liveVisit(visit, await databaseClock(tx))) return deviceActor(device);
+    beforeCommit.deadline((time) => checkVisit(visit, time));
+    checkVisit(visit, await databaseClock(tx));
+    return visitActor(device, visit);
+  };
+  const recordCoreQuery = (actor: AppPwaActor, outcome: "allowed" | "denied" | "failed", code?: string, tx?: TransactionSQL) =>
+    audit.record(
+      {
+        action: "app_pwa.core.query",
+        outcome,
+        target: { type: "core.query", id: "address.autocomplete" },
+        ...(code ? { error: { code } } : {}),
+        metadata: {
+          appId,
+          subject: { type: "user", userId: actor.ownerUserId },
+          via: { kind: actor.kind, appId, deviceId: actor.deviceId, ...(actor.kind === "visit" ? { visitId: actor.visitId } : {}) },
+        },
+      },
+      tx,
+    );
   const readAttempt = async (tx: TransactionSQL, visitId: string, attemptId: string) => {
     const [row] = await tx<Attempt[]>`SELECT route, input_digest, result FROM ${tables.attempts}
       WHERE app_id = ${appId} AND visit_id = ${visitId}::uuid AND attempt_id = ${parse(AppPwaId, attemptId)}::uuid`;
@@ -627,6 +665,59 @@ export const createAppPwaService = (options: AppPwaOptions) => {
         },
         signal,
       ),
+    coreQuery: async (
+      credential: string,
+      visitId: string | undefined,
+      query: string,
+      input: unknown,
+      signal?: AbortSignal,
+      locale?: string,
+    ) => {
+      const requestSignal = AbortSignal.any([...(signal ? [signal] : []), AbortSignal.timeout(REQUEST_IDLE_TIMEOUT_SECONDS * 1000)]);
+      return untilAppPwaAbort(requestSignal, async () => {
+        if (query !== "address.autocomplete" || !coreQueries.has(query)) return pwaFail("FORBIDDEN", 403);
+        const value = parse(GeoAutocompleteInputSchema, bounded(input, options.budgets.requestBytes));
+        const actor = await guest(
+          credential,
+          (tx, device, _signal, beforeCommit) => coreActor(tx, device, beforeCommit, visitId),
+          requestSignal,
+        );
+        try {
+          // No pairing transaction or settings lock spans a pool checkout or provider request.
+          // Bound each device/visit by both the operator's request budget and the Geo plan's RPS.
+          const [requestRate, geoConfig] = await Promise.all([getSetting<number>("security.rate_limit_per_second"), readGeoConfig()]);
+          if (requestSignal.aborted) return pwaFail("UNAVAILABLE", 503);
+          const limiter = ratelimit({ id: `app-pwa:${appId}:core`, limit: Math.min(requestRate, geoPlan(geoConfig).rps) });
+          if ((await limiter.check(`device:${actor.deviceId}`)).limited) return pwaFail("RATE_LIMITED", 429);
+          if (actor.kind === "visit" && (await limiter.check(`visit:${actor.visitId}`)).limited) return pwaFail("RATE_LIMITED", 429);
+          if (requestSignal.aborted) return pwaFail("UNAVAILABLE", 503);
+          const result = bounded(await coreGeo.autocompleteForAppPwa(value, { actor, signal: requestSignal, locale }));
+          await guest(
+            credential,
+            async (tx, device, _signal, beforeCommit) => {
+              const current = await coreActor(tx, device, beforeCommit, actor.kind === "visit" ? actor.visitId : undefined);
+              // A newly opened visit changes device-mode authority; retry with its current status.
+              if (current.kind !== actor.kind) return pwaFail("UNAVAILABLE", 503);
+              if (current.deviceId !== actor.deviceId || current.ownerUserId !== actor.ownerUserId) return pwaFail("REVOKED", 410);
+              await recordCoreQuery(current, "allowed", undefined, tx);
+              return null;
+            },
+            requestSignal,
+          );
+          return result;
+        } catch (error) {
+          const code = error instanceof AppPwaError || error instanceof GeoError ? error.code : "UNAVAILABLE";
+          await recordCoreQuery(
+            actor,
+            error instanceof AppPwaError || (error instanceof GeoError && error.status < 500) ? "denied" : "failed",
+            code,
+          );
+          if (error instanceof GeoError) throw new AppPwaCoreQueryError(error);
+          if (error instanceof AppPwaError) throw error;
+          return pwaFail("UNAVAILABLE", 503);
+        }
+      });
+    },
     query: (credential: string, visitId: string, route: string, input: unknown, signal?: AbortSignal) =>
       guest(
         credential,

package/src/app-pwa/transport.ts

@@ -1,11 +1,13 @@
 import { type Context, Hono } from "hono";
 import { setCookie } from "hono/cookie";
 import { z } from "zod";
+import { resolveLocale } from "../server/locale";
 import type { AuthContext } from "../server/middleware/auth";
 import { rateLimit } from "../server/middleware/rate-limit";
 import { REQUEST_IDLE_TIMEOUT_SECONDS } from "../server/request-timeout";
 import { pairingSecret } from "../services/pairing-secret";
 import { session } from "../services/session";
+import { get as getSetting } from "../services/settings";
 import {
   AppPwaAttempt,
   AppPwaClaim,
@@ -17,6 +19,7 @@ import {
   parseAppPwaInput as parse,
   pwaFail,
 } from "./contracts";
+import { AppPwaCoreQueryError } from "./core-query-error";
 import { type AppPwaService, createAppPwaService } from "./service";
 import { readAppPwaJson, untilAppPwaAbort } from "./transport-input";
 
@@ -57,6 +60,11 @@ export const createAppPwaRouter = (service: AppPwaService) => {
   const router = new Hono<AuthContext>();
   const limiter = rateLimit({ keyBy: "ip" });
   router.onError((error, c) => {
+    if (error instanceof AppPwaCoreQueryError)
+      return Response.json(
+        { code: error.code, ...(error.details ? { details: error.details } : {}) },
+        { status: error.status, headers: c.res.headers },
+      );
     const safe = error instanceof AppPwaError ? error : new AppPwaError("UNAVAILABLE", 503);
     return c.json({ code: safe.code }, safe.status);
   });
@@ -130,6 +138,20 @@ export const createAppPwaRouter = (service: AppPwaService) => {
     const input = parse(z.strictObject({ visitId: AppPwaId, attemptId: AppPwaId }), await body(c));
     return c.json(await service.attempt(key, input.visitId, input.attemptId, c.req.raw.signal));
   });
+  router.post(`${guestBase}/core/query/:query`, async (c) => {
+    const key = credential(c);
+    const input = parse(z.strictObject({ visitId: AppPwaId.optional(), input: z.unknown() }), await body(c));
+    return c.json(
+      await service.coreQuery(
+        key,
+        input.visitId,
+        c.req.param("query"),
+        input.input,
+        c.req.raw.signal,
+        resolveLocale(c.req.raw.headers, await getSetting<string>("app.locale")),
+      ),
+    );
+  });
   router.post(`${guestBase}/query/:route`, async (c) => {
     const key = credential(c);
     const input = parse(queryInput, await body(c));

package/src/approvals/messages.ts

@@ -10,7 +10,7 @@ export const approvalMessages = i18n.define({
       rejectAllTitle: "Reject all open approvals?",
       rejectAllBody: ({ count }: { count: number }) =>
         `${count === 1 ? "The open Action does not run." : `None of the ${count.toLocaleString("en")} open Actions runs.`} Where Cloud asked, it continues with your rejection.`,
-      emptyTitle: "Nothing is waiting for you.",
+      emptyTitle: "You're all set.",
       emptyBody: "When an Action needs your approval, it appears here and in the chat it comes from.",
       loading: "Loading approvals…",
       loadFailed: "Approvals could not be loaded.",
@@ -48,7 +48,7 @@ export const approvalMessages = i18n.define({
       rejectAllTitle: "Alle offenen Freigaben ablehnen?",
       rejectAllBody: ({ count }) =>
         `${count === 1 ? "Die offene Aktion läuft nicht." : `Keine der ${count.toLocaleString("de")} offenen Aktionen läuft.`} Wo Cloud gefragt hat, geht es mit deiner Ablehnung weiter.`,
-      emptyTitle: "Nichts wartet auf dich.",
+      emptyTitle: "Alles erledigt.",
       emptyBody: "Wenn eine Aktion deine Freigabe braucht, erscheint sie hier und im Chat, aus dem sie kommt.",
       loading: "Freigaben werden geladen …",
       loadFailed: "Die Freigaben konnten nicht geladen werden.",