@agent-native/core 0.131.5 → 0.131.7

package/corpus/templates/brain/server/lib/distillation-queue.ts

@@ -0,0 +1,147 @@
+import { writeAppState } from "@agent-native/core/application-state";
+import { and, desc, eq, inArray } from "drizzle-orm";
+
+import { getDb, schema } from "../db/index.js";
+import {
+  nanoid,
+  nowIso,
+  parseJson,
+  readBrainAgentGuidance,
+  serializeDistillationQueue,
+  stableJson,
+} from "./brain.js";
+
+type CaptureRow = typeof schema.brainRawCaptures.$inferSelect;
+type BrainAgentGuidance = Awaited<
+  ReturnType<typeof readBrainAgentGuidance>
+>["guidance"];
+
+async function writeDistillationRequest(values: {
+  captureId: string;
+  queueId: string;
+  sourceId: string;
+  requestedAt: string;
+  instructions?: string | null;
+  guidance: BrainAgentGuidance;
+}) {
+  await writeAppState(`brain-distill-request-${values.captureId}`, {
+    kind: "distill-capture",
+    captureId: values.captureId,
+    queueId: values.queueId,
+    sourceId: values.sourceId,
+    requestedAt: values.requestedAt,
+    instructions: values.instructions ?? null,
+    guidance: values.guidance,
+    message:
+      `Distill Brain capture ${values.captureId} for ${values.guidance.identity.companyName ?? "this workspace"}. ` +
+      `Apply the Brain settings guidance in context. Use get-capture with ` +
+      `includeRawContent=true when you need exact quote validation, extract ` +
+      `only durable company knowledge with exact evidence quotes, ` +
+      `call write-knowledge for supported entries or proposals, then call ` +
+      `mark-capture-distilled when finished. If the capture is personal or ` +
+      `out of scope, call mark-capture-distilled with status ignored.`,
+  });
+}
+
+export async function enqueueCaptureDistillation(values: {
+  capture: CaptureRow;
+  priority?: number;
+  instructions?: string;
+  payload?: Record<string, unknown>;
+  guidance?: BrainAgentGuidance;
+}) {
+  const guidance = values.guidance ?? (await readBrainAgentGuidance()).guidance;
+  const db = getDb();
+  const now = nowIso();
+  const [existing] = await db
+    .select()
+    .from(schema.brainIngestQueue)
+    .where(
+      and(
+        eq(schema.brainIngestQueue.captureId, values.capture.id),
+        eq(schema.brainIngestQueue.operation, "distill"),
+        inArray(schema.brainIngestQueue.status, ["queued", "processing"]),
+      ),
+    )
+    .orderBy(desc(schema.brainIngestQueue.updatedAt))
+    .limit(1);
+
+  if (existing) {
+    if (values.capture.status !== "distilling") {
+      await db
+        .update(schema.brainRawCaptures)
+        .set({ status: "distilling", updatedAt: now })
+        .where(eq(schema.brainRawCaptures.id, values.capture.id));
+    }
+    const payload = parseJson<Record<string, unknown>>(
+      existing.payloadJson,
+      {},
+    );
+    const existingInstructions =
+      typeof payload.instructions === "string"
+        ? payload.instructions
+        : undefined;
+    await writeDistillationRequest({
+      captureId: values.capture.id,
+      queueId: existing.id,
+      sourceId: values.capture.sourceId,
+      requestedAt: now,
+      instructions: values.instructions ?? existingInstructions,
+      guidance,
+    });
+    return {
+      queueItem: serializeDistillationQueue(existing),
+      existing: true,
+      guidance: guidance.distillation,
+    };
+  }
+
+  const id = nanoid();
+  const priority = values.priority ?? 50;
+  await db.insert(schema.brainIngestQueue).values({
+    id,
+    sourceId: values.capture.sourceId,
+    captureId: values.capture.id,
+    operation: "distill",
+    status: "queued",
+    priority,
+    attempts: 0,
+    payloadJson: stableJson({
+      ...(values.payload ?? {}),
+      instructions: values.instructions,
+    }),
+    error: null,
+    runAfter: null,
+    createdAt: now,
+    updatedAt: now,
+  });
+  await db
+    .update(schema.brainRawCaptures)
+    .set({ status: "distilling", updatedAt: now })
+    .where(eq(schema.brainRawCaptures.id, values.capture.id));
+  await writeDistillationRequest({
+    captureId: values.capture.id,
+    queueId: id,
+    sourceId: values.capture.sourceId,
+    requestedAt: now,
+    instructions: values.instructions ?? null,
+    guidance,
+  });
+
+  return {
+    queueItem: {
+      id,
+      sourceId: values.capture.sourceId,
+      captureId: values.capture.id,
+      status: "queued" as const,
+      priority,
+      attempts: 0,
+      error: null,
+      runAfter: null,
+      createdAt: now,
+      updatedAt: now,
+    },
+    existing: false,
+    guidance: guidance.distillation,
+  };
+}

package/corpus/templates/brain/server/lib/source-policy.ts

@@ -0,0 +1,264 @@
+import { accessFilter } from "@agent-native/core/sharing";
+import { and, inArray } from "drizzle-orm";
+
+import { getDb, schema } from "../db/index.js";
+import { parseJson } from "./brain.js";
+
+export type SourceTrustTier = "blessed" | "standard" | "untrusted";
+export type SourceConflictBehavior =
+  | "prefer-higher-authority"
+  | "surface-conflicts"
+  | "require-review";
+
+export interface SourceAnswerPolicy {
+  trustTier: SourceTrustTier;
+  answerEligible: boolean;
+  authority: number;
+  freshnessWindowDays: number | null;
+  reviewRequired: boolean;
+  conflictBehavior: SourceConflictBehavior;
+}
+
+export interface SourcePolicySnapshot extends SourceAnswerPolicy {
+  sourceId: string;
+  provider: string;
+  lastSyncedAt: string | null;
+  updatedAt: string;
+}
+
+export interface EvaluatedSourceAnswerPolicy extends SourceAnswerPolicy {
+  sourceIds: string[];
+  eligible: boolean;
+  freshness: "fresh" | "stale" | "not-configured";
+  exclusionReasons: Array<"answer-ineligible" | "stale" | "review-required">;
+}
+
+export const DEFAULT_SOURCE_ANSWER_POLICY: SourceAnswerPolicy = {
+  trustTier: "standard",
+  answerEligible: true,
+  authority: 50,
+  freshnessWindowDays: null,
+  reviewRequired: false,
+  conflictBehavior: "prefer-higher-authority",
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function isTrustTier(value: unknown): value is SourceTrustTier {
+  return ["blessed", "standard", "untrusted"].includes(String(value));
+}
+
+function isConflictBehavior(value: unknown): value is SourceConflictBehavior {
+  return [
+    "prefer-higher-authority",
+    "surface-conflicts",
+    "require-review",
+  ].includes(String(value));
+}
+
+function boundedInteger(
+  value: unknown,
+  fallback: number,
+  min: number,
+  max: number,
+) {
+  const parsed =
+    typeof value === "number"
+      ? value
+      : typeof value === "string" && value.trim()
+        ? Number(value)
+        : Number.NaN;
+  if (!Number.isFinite(parsed)) return fallback;
+  return Math.max(min, Math.min(max, Math.round(parsed)));
+}
+
+export function normalizeSourceAnswerPolicy(
+  value: unknown,
+  base: SourceAnswerPolicy = DEFAULT_SOURCE_ANSWER_POLICY,
+): SourceAnswerPolicy {
+  if (!isRecord(value)) return { ...base };
+  const trustTier = isTrustTier(value.trustTier)
+    ? value.trustTier
+    : base.trustTier;
+  const tierChanged =
+    isTrustTier(value.trustTier) && trustTier !== base.trustTier;
+  const answerEligible =
+    typeof value.answerEligible === "boolean"
+      ? value.answerEligible
+      : tierChanged
+        ? trustTier !== "untrusted"
+        : base.answerEligible;
+  const reviewRequired =
+    typeof value.reviewRequired === "boolean"
+      ? value.reviewRequired
+      : tierChanged
+        ? trustTier === "untrusted"
+        : base.reviewRequired;
+  const freshnessWindowDays =
+    value.freshnessWindowDays === null
+      ? null
+      : value.freshnessWindowDays === undefined
+        ? base.freshnessWindowDays
+        : boundedInteger(value.freshnessWindowDays, 0, 0, 3650);
+
+  return {
+    trustTier,
+    answerEligible,
+    authority: boundedInteger(value.authority, base.authority, 0, 100),
+    freshnessWindowDays,
+    reviewRequired,
+    conflictBehavior: isConflictBehavior(value.conflictBehavior)
+      ? value.conflictBehavior
+      : base.conflictBehavior,
+  };
+}
+
+export function sourceAnswerPolicyFromConfig(
+  config: Record<string, unknown>,
+): SourceAnswerPolicy {
+  return normalizeSourceAnswerPolicy(config.answerPolicy);
+}
+
+export function withSourceAnswerPolicy(
+  config: Record<string, unknown>,
+  input: unknown,
+): Record<string, unknown> {
+  const current = sourceAnswerPolicyFromConfig(config);
+  return {
+    ...config,
+    answerPolicy: normalizeSourceAnswerPolicy(input, current),
+  };
+}
+
+export async function loadAccessibleSourcePolicySnapshots(
+  sourceIds: string[],
+): Promise<Map<string, SourcePolicySnapshot>> {
+  const ids = Array.from(new Set(sourceIds.filter(Boolean)));
+  if (!ids.length) return new Map();
+  const rows = await getDb()
+    .select()
+    .from(schema.brainSources)
+    .where(
+      and(
+        accessFilter(schema.brainSources, schema.brainSourceShares),
+        inArray(schema.brainSources.id, ids),
+      ),
+    );
+  return new Map(
+    rows.map((row) => [
+      row.id,
+      {
+        sourceId: row.id,
+        provider: row.provider,
+        lastSyncedAt: row.lastSyncedAt,
+        updatedAt: row.updatedAt,
+        ...sourceAnswerPolicyFromConfig(
+          parseJson<Record<string, unknown>>(row.configJson, {}),
+        ),
+      },
+    ]),
+  );
+}
+
+const TRUST_RANK: Record<SourceTrustTier, number> = {
+  blessed: 3,
+  standard: 2,
+  untrusted: 1,
+};
+
+function primaryPolicy(policies: SourcePolicySnapshot[]): SourceAnswerPolicy {
+  const [primary] = [...policies].sort(
+    (left, right) =>
+      TRUST_RANK[right.trustTier] - TRUST_RANK[left.trustTier] ||
+      right.authority - left.authority,
+  );
+  return primary ?? DEFAULT_SOURCE_ANSWER_POLICY;
+}
+
+export function evaluateSourceAnswerPolicy(args: {
+  sourceIds: string[];
+  sourcePolicies: Map<string, SourcePolicySnapshot>;
+  contentUpdatedAt: string;
+  resultType: "knowledge" | "capture";
+  reviewed?: boolean;
+  now?: Date;
+}): EvaluatedSourceAnswerPolicy {
+  const sourceIds = Array.from(new Set(args.sourceIds.filter(Boolean)));
+  const effectivePolicies = sourceIds.length
+    ? sourceIds.map(
+        (id) =>
+          args.sourcePolicies.get(id) ?? {
+            sourceId: id,
+            provider: "legacy",
+            lastSyncedAt: null,
+            updatedAt: args.contentUpdatedAt,
+            ...DEFAULT_SOURCE_ANSWER_POLICY,
+          },
+      )
+    : [
+        {
+          sourceId: "",
+          provider: "legacy",
+          lastSyncedAt: null,
+          updatedAt: args.contentUpdatedAt,
+          ...DEFAULT_SOURCE_ANSWER_POLICY,
+        },
+      ];
+  const primary = primaryPolicy(effectivePolicies);
+  const now = (args.now ?? new Date()).getTime();
+  const updatedAt = Date.parse(args.contentUpdatedAt);
+  const stale = effectivePolicies.some((policy) => {
+    if (policy.freshnessWindowDays === null) return false;
+    if (!Number.isFinite(updatedAt)) return true;
+    return now - updatedAt > policy.freshnessWindowDays * 24 * 60 * 60 * 1000;
+  });
+  const answerIneligible = effectivePolicies.some(
+    (policy) => !policy.answerEligible,
+  );
+  const missingRequiredReview =
+    !args.reviewed &&
+    effectivePolicies.some(
+      (policy) =>
+        policy.reviewRequired || policy.conflictBehavior === "require-review",
+    );
+  const exclusionReasons: EvaluatedSourceAnswerPolicy["exclusionReasons"] = [];
+  if (answerIneligible) exclusionReasons.push("answer-ineligible");
+  if (stale) exclusionReasons.push("stale");
+  if (missingRequiredReview) exclusionReasons.push("review-required");
+
+  return {
+    ...primary,
+    sourceIds,
+    reviewRequired: effectivePolicies.some((policy) => policy.reviewRequired),
+    freshnessWindowDays: effectivePolicies.reduce<number | null>(
+      (minimum, policy) => {
+        if (policy.freshnessWindowDays === null) return minimum;
+        return minimum === null
+          ? policy.freshnessWindowDays
+          : Math.min(minimum, policy.freshnessWindowDays);
+      },
+      null,
+    ),
+    eligible: exclusionReasons.length === 0,
+    freshness: effectivePolicies.every(
+      (policy) => policy.freshnessWindowDays === null,
+    )
+      ? "not-configured"
+      : stale
+        ? "stale"
+        : "fresh",
+    exclusionReasons,
+  };
+}
+
+export function compareEvaluatedSourcePolicies(
+  left: EvaluatedSourceAnswerPolicy,
+  right: EvaluatedSourceAnswerPolicy,
+) {
+  return (
+    TRUST_RANK[right.trustTier] - TRUST_RANK[left.trustTier] ||
+    right.authority - left.authority
+  );
+}

package/corpus/templates/brain/server/plugins/agent-chat.ts

@@ -48,15 +48,16 @@ export default createAgentChatPlugin({
   codeExecution: { production: "sandboxed" },
   systemPrompt: `You are the Brain institutional-knowledge agent.
 
-Use actions as the source of truth. Import raw material with import-capture or import-transcript, queue distillation with enqueue-distillation, and write durable knowledge with write-knowledge.
+Use actions as the source of truth. Import raw material with import-capture or import-transcript, which queue distillation by default, use enqueue-distillation to retry or explicitly queue an existing capture, and write durable knowledge with write-knowledge.
 
 Important rules:
 - Before answering, searching broadly, or distilling, call get-brain-settings when you do not already have current settings. Apply its guidance for assistant name, company name, tone, source policy, citation requirements, publish tier, pre-save capture sanitization, redaction, and distillation instructions.
 - Evidence quotes must be exact substrings of a raw capture. Use get-capture with includeRawContent=true only when you need exact quote validation; normal capture reads are redacted by default.
 - No vector database exists; search-knowledge uses SQL text matching.
 - Source policy matters: strict means answer from reviewed knowledge only; balanced means raw captures are fallback context when reviewed knowledge is thin; exploratory means raw captures and sources may be surfaced as clearly labeled leads.
+- Source answer policy is enforced separately from the workspace retrieval mode. For approved FAQs, docs, or other source-owner-published resources, create a generic source with policy.trustTier=blessed and choose answer eligibility, authority, freshness, review, and conflict behavior deliberately. Prefer blessed, higher-authority eligible sources in cited answers; never answer from stale or answer-ineligible sources.
 - Company-tier knowledge may create a proposal instead of publishing immediately, depending on settings.
-- Slack and Granola sources are configurable v1 connectors. Generic transcript import is always available.
+- Slack and Granola sources are configurable v1 connectors. Generic capture and transcript import are always available.
 - Source/read actions are convenience readers, not provider capability limits. Before any provider API request, call list-connection-providers and inspect the matching provider. If configured is not true, do not attempt the request; explain that the connection needs setup or repair and include setupLink. Jira is queried on demand through the provider API rather than indexed as a Brain source. For ad hoc provider analysis that needs an endpoint, filter, payload, pagination mode, or API version not modeled by a Brain action, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account.
 - For broad searches, joins, classification, source-corpus counts, or absence claims across provider records, fetch every relevant page or an explicitly bounded cohort, stage/save large responses with stageAs/saveToFile/fetchAllPages, then use query-staged-dataset or run-code to reduce the corpus. Report source, filters, row counts, pagination, truncation, and gaps.`,
   a2aMessageFallback: async ({ text }) => tryAnswerBrainA2AQuestion(text),

package/corpus/templates/brain/server/routes/api/_agent-native/brain/ingest.post.ts

@@ -11,11 +11,21 @@ import {
   BrainCaptureBlockedError,
   createCapture,
   parseJson,
+  retireUpstreamDeletedCapture,
   serializeCapture,
   sha256Hex,
 } from "../../../../lib/brain.js";
+import { enqueueCaptureDistillation } from "../../../../lib/distillation-queue.js";
 import { resolveMeetingMemberEmails } from "../../../../lib/meeting-audience.js";
 
+const captureKindSchema = z.enum([
+  "transcript",
+  "note",
+  "message",
+  "document",
+  "generic",
+]);
+
 const segmentSchema = z
   .object({
     startMs: z.coerce.number().int().min(0).optional(),
@@ -29,17 +39,40 @@ const rawCapturePayloadSchema = z
   .object({
     sourceKey: z.string().min(1),
     externalId: z.string().min(1),
-    title: z.string().min(1),
+    title: z.string().min(1).optional(),
+    kind: captureKindSchema.optional(),
+    content: z.string().optional(),
     participants: z.array(z.unknown()).default([]),
+    capturedAt: z.string().optional(),
     occurredAt: z.string().optional(),
     transcript: z.string().optional(),
     segments: z.array(segmentSchema).optional(),
     sourceUrl: z.string().url().optional(),
     tags: z.array(z.string()).default([]),
+    metadata: z.record(z.string(), z.unknown()).default({}),
     raw: z.unknown().optional(),
+    deleted: z.boolean().default(false),
   })
-  .refine((payload) => payload.transcript?.trim() || payload.segments?.length, {
-    message: "Provide transcript or segments",
+  .superRefine((payload, context) => {
+    if (payload.deleted) return;
+    if (!payload.title) {
+      context.addIssue({
+        code: "custom",
+        message: "Provide title",
+        path: ["title"],
+      });
+    }
+    if (
+      !payload.content?.trim() &&
+      !payload.transcript?.trim() &&
+      !payload.segments?.length
+    ) {
+      context.addIssue({
+        code: "custom",
+        message: "Provide content, transcript, or segments",
+        path: ["content"],
+      });
+    }
   });
 
 function bearerToken(event: H3Event) {
@@ -50,6 +83,7 @@ function bearerToken(event: H3Event) {
 }
 
 function textFromPayload(payload: z.infer<typeof rawCapturePayloadSchema>) {
+  if (payload.content?.trim()) return payload.content.trim();
   if (payload.transcript?.trim()) return payload.transcript.trim();
   return (payload.segments ?? [])
     .map((segment) => {
@@ -60,6 +94,33 @@ function textFromPayload(payload: z.infer<typeof rawCapturePayloadSchema>) {
     .trim();
 }
 
+function kindFromPayload(payload: z.infer<typeof rawCapturePayloadSchema>) {
+  if (payload.kind) return payload.kind;
+  if (payload.transcript?.trim() || payload.segments?.length) {
+    return "transcript" as const;
+  }
+  return "generic" as const;
+}
+
+function metadataFromPayload(
+  payload: z.infer<typeof rawCapturePayloadSchema>,
+  kind: z.infer<typeof captureKindSchema>,
+) {
+  const metadata = {
+    ...payload.metadata,
+    sourceKey: payload.sourceKey,
+    sourceUrl: payload.sourceUrl,
+    tags: payload.tags,
+  };
+  if (kind !== "transcript") return metadata;
+  return {
+    ...metadata,
+    participants: payload.participants,
+    segments: payload.segments ?? [],
+    raw: payload.raw,
+  };
+}
+
 function sourceKeyConfigPattern(sourceKey: string) {
   return `%"sourceKey":${JSON.stringify(sourceKey)}%`;
 }
@@ -112,6 +173,22 @@ export default defineEventHandler(async (event) => {
       orgId: source.orgId ?? undefined,
     },
     async () => {
+      if (payload.deleted) {
+        const retired = await retireUpstreamDeletedCapture({
+          sourceId: source.id,
+          externalId: payload.externalId,
+          provider: source.provider,
+        });
+        return {
+          ok: true,
+          sourceId: source.id,
+          capture: null,
+          deleted: true,
+          retired,
+        };
+      }
+
+      const kind = kindFromPayload(payload);
       const memberEmails = resolveMeetingMemberEmails(
         payload.participants,
         source.ownerEmail,
@@ -121,23 +198,19 @@ export default defineEventHandler(async (event) => {
         capture = await createCapture({
           sourceId: source.id,
           externalId: payload.externalId,
-          title: payload.title,
-          kind: "transcript",
+          title: payload.title!,
+          kind,
           content: textFromPayload(payload),
-          capturedAt: payload.occurredAt,
-          metadata: {
-            sourceKey: payload.sourceKey,
-            participants: payload.participants,
-            segments: payload.segments ?? [],
-            sourceUrl: payload.sourceUrl,
-            tags: payload.tags,
-            raw: payload.raw,
-          },
-          audience: {
-            kind: "meeting",
-            memberEmails,
-            upstreamRefHash: payload.externalId,
-          },
+          capturedAt: payload.capturedAt ?? payload.occurredAt,
+          metadata: metadataFromPayload(payload, kind),
+          audience:
+            kind === "transcript"
+              ? {
+                  kind: "meeting",
+                  memberEmails,
+                  upstreamRefHash: payload.externalId,
+                }
+              : undefined,
         });
       } catch (error) {
         if (!(error instanceof BrainCaptureBlockedError)) throw error;
@@ -149,10 +222,34 @@ export default defineEventHandler(async (event) => {
         };
       }
 
+      const distillation =
+        capture.status === "distilled" || capture.status === "ignored"
+          ? null
+          : await enqueueCaptureDistillation({
+              capture,
+              priority: 50,
+              payload: {
+                sourceKey: payload.sourceKey,
+                externalId: payload.externalId,
+              },
+            });
+
       return {
         ok: true,
         sourceId: source.id,
         capture: serializeCapture(capture),
+        distillation: distillation
+          ? {
+              queued: true,
+              queueId: distillation.queueItem.id,
+              existing: distillation.existing,
+            }
+          : {
+              queued: false,
+              queueId: null,
+              existing: false,
+              reason: `already-${capture.status}`,
+            },
       };
     },
   );

package/corpus/templates/clips/app/components/meetings/google-oauth-identity-notice.tsx

@@ -0,0 +1,51 @@
+import { useT } from "@agent-native/core/client/i18n";
+import { IconAlertTriangle, IconInfoCircle } from "@tabler/icons-react";
+
+import { Button } from "@/components/ui/button";
+import {
+  Popover,
+  PopoverContent,
+  PopoverTrigger,
+} from "@/components/ui/popover";
+import { cn } from "@/lib/utils";
+
+export function GoogleOAuthIdentityNotice({
+  className,
+}: {
+  className?: string;
+}) {
+  const t = useT();
+  return (
+    <Popover>
+      <PopoverTrigger asChild>
+        <Button
+          type="button"
+          variant="ghost"
+          size="sm"
+          className={cn(
+            "h-auto gap-1 px-0 py-0 text-[11px] font-normal text-muted-foreground/70 hover:bg-transparent hover:text-muted-foreground",
+            className,
+          )}
+        >
+          <IconInfoCircle className="size-3" />
+          {t("meetingsRoute.googleMayShowWarning")}
+        </Button>
+      </PopoverTrigger>
+      <PopoverContent align="start" className="w-72 text-start">
+        <div className="flex items-start gap-2.5">
+          <div className="mt-0.5 flex size-6 shrink-0 items-center justify-center rounded-md bg-amber-500/15 text-amber-300">
+            <IconAlertTriangle className="size-3.5" />
+          </div>
+          <div className="space-y-1.5">
+            <p className="text-[13px] font-medium text-foreground">
+              {t("meetingsRoute.googleNotVerifiedTitle")}
+            </p>
+            <p className="text-xs leading-relaxed text-muted-foreground">
+              {t("meetingsRoute.googleWarningBeforeAdvanced")}
+            </p>
+          </div>
+        </div>
+      </PopoverContent>
+    </Popover>
+  );
+}

package/corpus/templates/clips/app/i18n/en-US.ts

@@ -1498,6 +1498,10 @@ All notable user-facing changes to Clips are documented here. Open it any time f
     calendarNeedsReconnect:
       "Google Calendar needs to be reconnected to keep showing your upcoming meetings.",
     connectGoogleCalendar: "Connect Google Calendar",
+    googleMayShowWarning: "Review Google access",
+    googleNotVerifiedTitle: "Verify the app before connecting",
+    googleWarningBeforeAdvanced:
+      "Confirm the app name and requested Calendar access match the Clips deployment you trust. If Google shows an unverified-app warning or the identity looks unfamiliar, stop and contact your workspace administrator.",
     desktopReminder:
       "Connect Google Calendar, keep Clips Desktop open, then click Start notes from the reminder or the menu bar when your meeting begins.",
     getDesktopApp: "Get desktop app",