@agent-native/core-corpus 0.201.0-nightly-20261005153421 → 0.201.0

package/corpus/templates/factory/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/corpus/templates/factory/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/corpus/templates/factory/package.json

@@ -17,6 +17,7 @@
   "dependencies": {
     "@agent-native/core": "workspace:*",
     "@agent-native/dispatch": "workspace:*",
+    "@agent-native/otel": "workspace:*",
     "@agent-native/toolkit": "workspace:*",
     "@electric-sql/pglite": "^0.5.8",
     "@fontsource-variable/inter": "^5.2.8",

package/corpus/templates/factory/server/plugins/otel.ts

@@ -0,0 +1,6 @@
+import { defineNitroPlugin } from "@agent-native/core/server";
+import { startAgentNativeOtel } from "@agent-native/otel";
+
+export default defineNitroPlugin(() => {
+  startAgentNativeOtel();
+});

package/corpus/templates/forms/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/corpus/templates/forms/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/corpus/templates/forms/README.md

@@ -4,7 +4,7 @@ An open-source, agent-native alternative to Typeform and Google Forms. Describe
 the form you want, refine it in the visual editor, and publish a public form that
 stores submissions in your own SQL database.
 
-**Live app: [forms.agent-native.com](https://forms.agent-native.com)**
+**Live app: [forms.agent-native.com](https://forms.agent-native.com?utm_source=github&utm_medium=referral&utm_content=forms-readme)**
 
 Build forms conversationally or by hand — the agent updates the schema and the
 preview updates from SQL-backed state. Route new submissions wherever you need
@@ -32,7 +32,7 @@ pnpm install
 pnpm dev
 ```
 
-Full docs: [agent-native.com/docs/template-forms](https://agent-native.com/docs/template-forms).
+Full docs: [agent-native.com/docs/template-forms](https://agent-native.com/docs/template-forms?utm_source=github&utm_medium=referral&utm_content=forms-readme).
 
 ## Submission destinations
 

package/corpus/templates/forms/package.json

@@ -18,6 +18,7 @@
   },
   "dependencies": {
     "@agent-native/core": "workspace:*",
+    "@agent-native/otel": "workspace:*",
     "@agent-native/toolkit": "workspace:*",
     "@electric-sql/pglite": "^0.5.8",
     "@fontsource-variable/inter": "^5.2.8",

package/corpus/templates/forms/server/plugins/auth.ts

@@ -4,7 +4,8 @@ export default createAuthPlugin({
   workspaceAppPublicPaths: ["/"],
   marketing: {
     appName: "Forms",
-    learnMoreUrl: "https://agent-native.com/apps/forms",
+    learnMoreUrl:
+      "https://agent-native.com/apps/forms?utm_source=app&utm_medium=product&utm_content=onboarding-learn-more",
     tagline:
       "Your AI agent builds, publishes, and analyzes forms alongside you.",
     features: [

package/corpus/templates/forms/server/plugins/otel.ts

@@ -0,0 +1,6 @@
+import { defineNitroPlugin } from "@agent-native/core/server";
+import { startAgentNativeOtel } from "@agent-native/otel";
+
+export default defineNitroPlugin(() => {
+  startAgentNativeOtel();
+});

package/corpus/templates/mail/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/corpus/templates/mail/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/corpus/templates/mail/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable user-facing changes to Agent-Native Mail are documented here. Open it any
 time from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-10-02
+
+### Improved
+
+- Builder.io setup copy now clarifies the account action and available credits.
+
 ## 2026-10-01
 
 ### Improved

package/corpus/templates/mail/README.md

@@ -4,7 +4,7 @@ An open-source, agent-native alternative to Superhuman. An agent-powered,
 keyboard-first email client for Gmail — the agent can read, draft, send, and
 organize email for you, and the codebase is yours to own.
 
-**Live app: [mail.agent-native.com](https://mail.agent-native.com)**
+**Live app: [mail.agent-native.com](https://mail.agent-native.com?utm_source=github&utm_medium=referral&utm_content=mail-readme)**
 
 Connect one or more Gmail accounts and drive a fast, keyboard-first inbox
 yourself, or ask the agent to do anything you can. The agent always knows which
@@ -32,4 +32,4 @@ pnpm dev
 ```
 
 Connecting Gmail in dev needs a Google OAuth client — see the docs for setup.
-Full docs: [agent-native.com/docs/template-mail](https://agent-native.com/docs/template-mail).
+Full docs: [agent-native.com/docs/template-mail](https://agent-native.com/docs/template-mail?utm_source=github&utm_medium=referral&utm_content=mail-readme).

package/corpus/templates/mail/package.json

@@ -18,6 +18,7 @@
   },
   "dependencies": {
     "@agent-native/core": "workspace:*",
+    "@agent-native/otel": "workspace:*",
     "@agent-native/toolkit": "workspace:*",
     "@ai-sdk/openai": "4.0.70",
     "@electric-sql/pglite": "^0.5.8",

package/corpus/templates/mail/server/plugins/auth.ts

@@ -28,7 +28,8 @@ export default createAuthPlugin({
   ],
   marketing: {
     appName: "Mail",
-    learnMoreUrl: "https://agent-native.com/apps/mail",
+    learnMoreUrl:
+      "https://agent-native.com/apps/mail?utm_source=app&utm_medium=product&utm_content=onboarding-learn-more",
     tagline: "Your AI agent reads, drafts, and organizes email alongside you.",
     features: [
       "Replies that match your tone and style",

package/corpus/templates/mail/server/plugins/otel.ts

@@ -0,0 +1,6 @@
+import { defineNitroPlugin } from "@agent-native/core/server";
+import { startAgentNativeOtel } from "@agent-native/otel";
+
+export default defineNitroPlugin(() => {
+  startAgentNativeOtel();
+});

package/corpus/templates/plan/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/corpus/templates/plan/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/corpus/templates/plan/CHANGELOG.md

@@ -11,6 +11,7 @@ time from the command menu (Cmd+K → "What's new").
 
 ### Fixed
 
+- Two people editing one plan at the same time, or one of them offline, now keep both sets of edits, and opening a plan together no longer duplicates its content.
 - Consecutive Plan edits now use the latest saved revision.
 
 ## 2026-09-25

package/corpus/templates/plan/README.md

@@ -5,7 +5,7 @@ Codex / Claude Code / Markdown plan into a reviewable document — diagrams,
 wireframes, prototype options, annotated code walkthroughs, file trees, comments,
 share links, and HTML export.
 
-**Live app: [plan.agent-native.com](https://plan.agent-native.com)**
+**Live app: [plan.agent-native.com](https://plan.agent-native.com?utm_source=github&utm_medium=referral&utm_content=plan-readme)**
 
 ## Install (recommended)
 
@@ -42,4 +42,4 @@ pnpm install
 pnpm dev
 ```
 
-Full docs: [agent-native.com/docs/template-plan](https://agent-native.com/docs/template-plan).
+Full docs: [agent-native.com/docs/template-plan](https://agent-native.com/docs/template-plan?utm_source=github&utm_medium=referral&utm_content=plan-readme).

package/corpus/templates/plan/package.json

@@ -16,6 +16,7 @@
   },
   "dependencies": {
     "@agent-native/core": "workspace:*",
+    "@agent-native/otel": "workspace:*",
     "@agent-native/toolkit": "workspace:*",
     "@electric-sql/pglite": "^0.5.8",
     "@excalidraw/excalidraw": "0.18.1",

package/corpus/templates/plan/server/plugins/auth.ts

@@ -51,7 +51,8 @@ export default createAuthPlugin({
   ],
   marketing: {
     appName: "Plan",
-    learnMoreUrl: "https://agent-native.com/apps/plan",
+    learnMoreUrl:
+      "https://agent-native.com/apps/plan?utm_source=app&utm_medium=product&utm_content=onboarding-learn-more",
     tagline:
       "Turn coding-agent plans into visual, annotatable HTML before code changes happen.",
     features: [

package/corpus/templates/plan/server/plugins/otel.ts

@@ -0,0 +1,6 @@
+import { defineNitroPlugin } from "@agent-native/core/server";
+import { startAgentNativeOtel } from "@agent-native/otel";
+
+export default defineNitroPlugin(() => {
+  startAgentNativeOtel();
+});

package/corpus/templates/slides/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/corpus/templates/slides/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/corpus/templates/slides/CHANGELOG.md

@@ -3,10 +3,31 @@
 All notable user-facing changes to Agent-Native Slides are documented here. Open it any
 time from the command menu (Cmd+K → "What's new").
 
+## 2026-10-05
+
+### Fixed
+
+- The Recent tab shows loading placeholders until your decks are ready.
+
+## 2026-10-03
+
+### Fixed
+
+- Slide text edits preserve layout with inline-size containment.
+
 ## 2026-10-02
 
+### Improved
+
+- Builder.io setup now routes account activation through the one-click flow.
+- Recent appears when you have accessible decks, and shared decks are shown when you have none of your own.
+- In-place slide editing now supports slash commands, Markdown shortcuts, and reliable list authoring while preserving text styling.
+- Slides refreshes faster when a collaborator changes the deck open in your tab.
+
 ### Fixed
 
+- Markdown list shortcuts work when text inherits link formatting
+- Only one queued message action menu stays open at a time
 - Google Slides imports keep skipped slides and their images in the right place.
 - Heading text stays intact when Backspace joins it into a styled block.
 - Slide text editing now preserves formatting and caret placement across browsers.
@@ -15,11 +36,13 @@ time from the command menu (Cmd+K → "What's new").
 
 ### Improved
 
+- Filter decks by owner with an option to view items shared with me.
 - Recover failed deck saves with explicit retry or reload
 - The observability settings tab is now labeled Observability.
 
 ### Fixed
 
+- Collaborators editing different text boxes on the same slide now keep both edits instead of hitting a text conflict, and comments, replies and resolves reach other open editors within about a second.
 - A prompt you send before connecting AI is sent automatically once you connect, and a deck generation that ends without slides shows Try again instead of an empty canvas.
 - Blank speaker notes can be edited and saved without a conflict.
 - New deck prompts no longer add a default design system unless you choose one, and empty failed generations explain what happened.

package/corpus/templates/slides/README.md

@@ -3,7 +3,7 @@
 An open-source, agent-native alternative to Google Slides, Pitch, and PowerPoint.
 Generate full decks from a prompt, edit slides visually, and present full-screen.
 
-**Live app: [slides.agent-native.com](https://slides.agent-native.com)**
+**Live app: [slides.agent-native.com](https://slides.agent-native.com?utm_source=github&utm_medium=referral&utm_content=slides-readme)**
 
 Ask the agent for "a 10-slide pitch deck for a coffee subscription service" and
 watch it stream in slide-by-slide, then refine it visually or by prompt. Anything
@@ -31,4 +31,4 @@ pnpm install
 pnpm dev
 ```
 
-Full docs: [agent-native.com/docs/template-slides](https://agent-native.com/docs/template-slides).
+Full docs: [agent-native.com/docs/template-slides](https://agent-native.com/docs/template-slides?utm_source=github&utm_medium=referral&utm_content=slides-readme).

package/corpus/templates/slides/actions/list-decks.ts

@@ -139,9 +139,11 @@ export default defineAction({
           "Use includePreview for the first slide only.",
       ),
     createdBy: z
-      .enum(["all", "me"])
+      .enum(["all", "me", "not-me"])
       .optional()
-      .describe("Set to 'me' to list only decks created by the current user"),
+      .describe(
+        "Set to 'me' to list decks owned by the current user or 'not-me' to list accessible decks owned by someone else",
+      ),
     search: z
       .string()
       .trim()
@@ -196,7 +198,10 @@ export default defineAction({
       throw err;
     }
 
-    if (args.createdBy === "me" && normalizedOwnerEmail === null) {
+    if (
+      (args.createdBy === "me" || args.createdBy === "not-me") &&
+      normalizedOwnerEmail === null
+    ) {
       return { count: 0, decks: [] };
     }
 
@@ -205,7 +210,9 @@ export default defineAction({
       visibleDecks,
       args.createdBy === "me" && normalizedOwnerEmail !== null
         ? sql`lower(trim(${schema.decks.ownerEmail})) = ${normalizedOwnerEmail}`
-        : undefined,
+        : args.createdBy === "not-me" && normalizedOwnerEmail !== null
+          ? sql`lower(trim(${schema.decks.ownerEmail})) <> ${normalizedOwnerEmail}`
+          : undefined,
       args.search
         ? sql`strpos(lower(${schema.decks.title}), ${args.search.toLowerCase()}) > 0`
         : undefined,