@agent-native/core 0.134.0 → 0.135.0

package/corpus/templates/content/server/lib/comment-notifications.ts

@@ -0,0 +1,146 @@
+/**
+ * Email notifications for document comments, replies, and mentions.
+ *
+ * Recipient resolution, preference filtering, and delivery reporting come from
+ * `@agent-native/core/server`; this module owns only the Documents rows and the
+ * email copy. Share invites are not routed through the `emailNotifications`
+ * preference — they have their own delivery path.
+ */
+
+import {
+  emailStrong,
+  getAppProductionUrl,
+  notifyActivity,
+  renderEmail,
+  runActivityNotification,
+  sendEmail,
+  type ActivityNotificationResult,
+} from "@agent-native/core/server";
+import { filterRecipientsByResourceAccess } from "@agent-native/core/sharing";
+import { and, eq } from "drizzle-orm";
+
+import { CONTENT_USER_PREFS_KEY } from "../../shared/content-user-prefs.js";
+import { getDb, schema } from "../db/index.js";
+
+export type DocumentCommentNotificationResult = ActivityNotificationResult;
+
+const LOG_LABEL = "[content] comment notification";
+const EXCERPT_LIMIT = 240;
+
+function excerpt(content: string): string {
+  const collapsed = content.replace(/\s+/g, " ").trim();
+  return collapsed.length > EXCERPT_LIMIT
+    ? `${collapsed.slice(0, EXCERPT_LIMIT - 1)}…`
+    : collapsed;
+}
+
+function documentUrl(documentId: string): string {
+  const base = getAppProductionUrl().replace(/\/+$/, "");
+  return `${base}/page/${encodeURIComponent(documentId)}`;
+}
+
+async function threadParticipants(
+  documentId: string,
+  threadId: string,
+): Promise<string[]> {
+  const rows = await getDb()
+    .select({ authorEmail: schema.documentComments.authorEmail })
+    .from(schema.documentComments)
+    .where(
+      and(
+        eq(schema.documentComments.documentId, documentId),
+        eq(schema.documentComments.threadId, threadId),
+      ),
+    );
+  return rows.map((row) => row.authorEmail);
+}
+
+export interface DocumentCommentNotificationInput {
+  documentId: string;
+  /** Read from the access-checked resource by the caller, never re-queried. */
+  documentTitle: string;
+  /** The document's org, so `org` visibility resolves for its members. */
+  orgId?: string | null;
+  threadId: string;
+  ownerEmail: string;
+  authorEmail: string;
+  authorName?: string | null;
+  content: string;
+  mentions: { email: string; name: string }[];
+  isReply: boolean;
+}
+
+export async function notifyDocumentComment(
+  input: DocumentCommentNotificationInput,
+): Promise<DocumentCommentNotificationResult> {
+  return runActivityNotification(LOG_LABEL, () =>
+    deliverDocumentCommentEmails(input),
+  );
+}
+
+async function deliverDocumentCommentEmails(
+  input: DocumentCommentNotificationInput,
+): Promise<DocumentCommentNotificationResult> {
+  const title = input.documentTitle.trim() || "Untitled";
+  const mentioned = new Set(
+    input.mentions.map((mention) => mention.email.trim().toLowerCase()),
+  );
+
+  const candidates = [input.ownerEmail, ...mentioned];
+  if (input.isReply) {
+    candidates.push(
+      ...(await threadParticipants(input.documentId, input.threadId)),
+    );
+  }
+
+  // Mentions are caller-supplied and thread rows are historical; re-check both
+  // against the document's live ACL before mailing anyone its contents.
+  const allowed = await filterRecipientsByResourceAccess({
+    resourceType: "document",
+    resourceId: input.documentId,
+    emails: candidates,
+    orgId: input.orgId,
+  });
+
+  const actor = input.authorName?.trim() || input.authorEmail;
+  const url = documentUrl(input.documentId);
+
+  return notifyActivity({
+    candidates: allowed,
+    actorEmail: input.authorEmail,
+    preferenceKey: CONTENT_USER_PREFS_KEY,
+    logLabel: LOG_LABEL,
+    send: async (to) => {
+      const wasMentioned = mentioned.has(to);
+      const lead = wasMentioned
+        ? `${emailStrong(actor)} mentioned you in a comment on ${emailStrong(title)}.`
+        : input.isReply
+          ? `${emailStrong(actor)} replied in a comment thread on ${emailStrong(title)}.`
+          : `${emailStrong(actor)} commented on ${emailStrong(title)}.`;
+
+      const { html, text } = renderEmail({
+        preheader: `${actor} commented on ${title}.`,
+        heading: wasMentioned
+          ? "You were mentioned"
+          : input.isReply
+            ? "New reply on your document"
+            : "New comment",
+        paragraphs: [lead, `"${excerpt(input.content)}"`],
+        cta: { label: "Open document", url },
+        footer:
+          "You received this because you own, were mentioned in, or participated in this thread. Turn these off in Documents settings.",
+      });
+
+      await sendEmail({
+        to,
+        subject: wasMentioned
+          ? `${actor} mentioned you on "${title}"`
+          : input.isReply
+            ? `${actor} replied to a comment on "${title}"`
+            : `${actor} commented on "${title}"`,
+        html,
+        text,
+      });
+    },
+  });
+}

package/corpus/templates/content/server/routes/_agent-native/content/user-prefs.get.ts

@@ -0,0 +1,17 @@
+import { getSession } from "@agent-native/core/server";
+import { getUserSetting } from "@agent-native/core/settings";
+import { defineEventHandler, setResponseStatus } from "h3";
+
+import { CONTENT_USER_PREFS_KEY } from "../../../../shared/content-user-prefs.js";
+
+export default defineEventHandler(async (event) => {
+  const session = await getSession(event);
+  if (!session?.email) {
+    setResponseStatus(event, 401);
+    return { error: "unauthorized" };
+  }
+
+  const stored = await getUserSetting(session.email, CONTENT_USER_PREFS_KEY);
+  // coercion-ok: a null read means this user has no preferences yet, which is a real state.
+  return stored ?? {};
+});

package/corpus/templates/content/server/routes/_agent-native/content/user-prefs.put.ts

@@ -0,0 +1,36 @@
+import { getSession } from "@agent-native/core/server";
+import { getUserSetting, putUserSetting } from "@agent-native/core/settings";
+import { defineEventHandler, getHeader, readBody, setResponseStatus } from "h3";
+
+import { CONTENT_USER_PREFS_KEY } from "../../../../shared/content-user-prefs.js";
+
+export default defineEventHandler(async (event) => {
+  const session = await getSession(event);
+  if (!session?.email) {
+    setResponseStatus(event, 401);
+    return { error: "unauthorized" };
+  }
+
+  // coercion-ok: an unparsable body is rejected with 400 immediately below.
+  const body = await readBody(event).catch(() => null);
+  if (!body || typeof body !== "object" || Array.isArray(body)) {
+    setResponseStatus(event, 400);
+    return { error: "Invalid settings payload" };
+  }
+
+  // Merge so a partial save never wipes preferences written elsewhere.
+  const stored = await getUserSetting(session.email, CONTENT_USER_PREFS_KEY);
+  // coercion-ok: a null read means this user has no preferences yet, which is a real state.
+  const existing = stored ?? {};
+  const next = {
+    ...(typeof existing === "object" && !Array.isArray(existing)
+      ? existing
+      : {}),
+    ...(body as Record<string, unknown>),
+  };
+
+  await putUserSetting(session.email, CONTENT_USER_PREFS_KEY, next, {
+    requestSource: getHeader(event, "x-request-source") || undefined,
+  });
+  return next;
+});

package/corpus/templates/content/shared/api.ts

@@ -29,6 +29,7 @@ export interface Document {
   notionPageUrl?: string | null;
   visibility?: "private" | "org" | "public";
   accessRole?: DocumentAccessRole;
+  canView?: boolean;
   canEdit?: boolean;
   canManage?: boolean;
   source?: DocumentSourceInfo;
@@ -795,6 +796,9 @@ export interface ContentDatabaseResponse {
   duplicatedDocumentIds?: string[];
   deletedItemIds?: string[];
   deletedDocumentIds?: string[];
+  removedItemIds?: string[];
+  removedDocumentIds?: string[];
+  removedCount?: number;
   timings?: BuilderActionTiming[];
   tableQueryMode?: "server" | "client-required";
   /** Client-only optimistic state while real provider rows are being attached. */

package/corpus/templates/content/shared/content-user-prefs.ts

@@ -0,0 +1,11 @@
+/**
+ * Per-user Documents preferences, stored under one user-setting key so
+ * Settings and the notification senders read and write the same object.
+ */
+
+export const CONTENT_USER_PREFS_KEY = "content-user-prefs";
+
+export type ContentUserPrefs = {
+  /** Comment, reply, and mention emails only — never share invites. */
+  emailNotifications?: boolean;
+};

package/corpus/templates/content/vitest.config.ts

@@ -1,21 +1,25 @@
 import path from "node:path";
 
+import baseConfig from "@agent-native/core/vitest-config";
 import react from "@vitejs/plugin-react-swc";
-import { defineConfig } from "vitest/config";
+import { defineConfig, mergeConfig } from "vitest/config";
 
-export default defineConfig({
-  plugins: [react()],
-  resolve: {
-    alias: {
-      "@": path.resolve(__dirname, "./app"),
-      "@shared": path.resolve(__dirname, "./shared"),
+export default mergeConfig(
+  baseConfig,
+  defineConfig({
+    plugins: [react()],
+    resolve: {
+      alias: {
+        "@": path.resolve(__dirname, "./app"),
+        "@shared": path.resolve(__dirname, "./shared"),
+      },
     },
-  },
-  test: {
-    include: ["**/*.{test,spec}.?(c|m)[jt]s?(x)"],
-    exclude: ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/e2e/**"],
-    hookTimeout: 60_000,
-    testTimeout: 60_000,
-    maxWorkers: "50%",
-  },
-});
+    test: {
+      include: ["**/*.{test,spec}.?(c|m)[jt]s?(x)"],
+      exclude: ["**/node_modules/**", "**/.git/**", "**/dist/**", "**/e2e/**"],
+      hookTimeout: 60_000,
+      testTimeout: 60_000,
+      maxWorkers: "50%",
+    },
+  }),
+);

package/corpus/templates/crm/app/routes/settings.tsx

@@ -1,6 +1,8 @@
 import { ChangelogSettingsCard } from "@agent-native/core/client/changelog";
 import { LanguagePicker, useT } from "@agent-native/core/client/i18n";
 import {
+  SettingsGroup,
+  SettingsRow,
   SettingsTabsPage,
   useAgentSettingsTabs,
   type SettingsTabItem,
@@ -20,14 +22,6 @@ import { AdvancedSettings } from "@/components/crm/settings/AdvancedSettings";
 import { ConnectionSettings } from "@/components/crm/settings/ConnectionSettings";
 import { FieldsSettings } from "@/components/crm/settings/FieldsSettings";
 import { ListsSettings } from "@/components/crm/settings/ListsSettings";
-import {
-  Card,
-  CardContent,
-  CardDescription,
-  CardHeader,
-  CardTitle,
-} from "@/components/ui/card";
-import { Label } from "@/components/ui/label";
 
 import changelog from "../../CHANGELOG.md?raw";
 
@@ -117,20 +111,18 @@ export default function SettingsRoute() {
             </p>
           </div>
 
-          <Card id="language" className="scroll-mt-16">
-            <CardHeader>
-              <CardTitle className="text-base">
-                {t("settings.languageTitle")}
-              </CardTitle>
-              <CardDescription>
-                {t("settings.languageDescription")}
-              </CardDescription>
-            </CardHeader>
-            <CardContent className="max-w-xs space-y-1.5">
-              <Label>{t("settings.languageLabel")}</Label>
-              <LanguagePicker label={t("settings.languageLabel")} />
-            </CardContent>
-          </Card>
+          <SettingsGroup>
+            <SettingsRow
+              id="language"
+              label={t("settings.languageTitle")}
+              description={t("settings.languageDescription")}
+              control={
+                <div className="w-56">
+                  <LanguagePicker label={t("settings.languageLabel")} />
+                </div>
+              }
+            />
+          </SettingsGroup>
         </div>
       }
       whatsNew={

package/corpus/templates/crm/vitest.config.ts

@@ -1,5 +1,9 @@
-import { defineConfig } from "vitest/config";
+import baseConfig from "@agent-native/core/vitest-config";
+import { defineConfig, mergeConfig } from "vitest/config";
 
-export default defineConfig({
-  test: { include: ["**/*.test.ts"], environment: "node" },
-});
+export default mergeConfig(
+  baseConfig,
+  defineConfig({
+    test: { include: ["**/*.test.ts"], environment: "node" },
+  }),
+);

package/corpus/templates/design/.generated/bridge/editor-chrome.generated.ts

@@ -560,17 +560,28 @@ export const editorChromeBridgeScript: string = `"use strict";
       }
       renderRuntimeInteractionStatePreviews();
     }
-    function runtimeHeadHtmlWithoutEditorChrome() {
-      if (!document.head) return "";
-      var clone = document.head.cloneNode(true);
-      Array.prototype.slice.call(
-        clone.querySelectorAll(
-          "[data-agent-native-editor-chrome-style], [data-agent-native-editing-safety-style]"
-        )
-      ).forEach(function(node) {
+    var lastSourceHeadHtml = null;
+    function replaceSourceHeadNodes(previousSourceHtml, nextSourceHtml) {
+      if (!document.head) return;
+      var stale = document.createElement("head");
+      stale.innerHTML = previousSourceHtml || "";
+      var staleCounts = {};
+      Array.prototype.forEach.call(stale.children, function(node) {
+        var key = node.outerHTML;
+        staleCounts[key] = (staleCounts[key] || 0) + 1;
+      });
+      Array.prototype.slice.call(document.head.children).forEach(function(node) {
+        var key = node.outerHTML;
+        if (!staleCounts[key]) return;
+        staleCounts[key] -= 1;
         if (node.parentNode) node.parentNode.removeChild(node);
       });
-      return clone.innerHTML;
+      var next = document.createElement("head");
+      next.innerHTML = nextSourceHtml || "";
+      var anchor = document.head.firstChild;
+      Array.prototype.slice.call(next.children).forEach(function(node) {
+        document.head.insertBefore(document.importNode(node, true), anchor);
+      });
     }
     function chromeScaleX() {
       return 1 / Math.max(0.05, editorChromeScaleX);
@@ -2536,7 +2547,10 @@ export const editorChromeBridgeScript: string = `"use strict";
       }
       var nextHeadHtml = nextDoc.head ? nextDoc.head.innerHTML : "";
       ensureEditorChromeStyle();
-      var currentHeadHtml = runtimeHeadHtmlWithoutEditorChrome();
+      if (lastSourceHeadHtml === null) {
+        lastSourceHeadHtml = nextHeadHtml;
+      }
+      var currentHeadHtml = lastSourceHeadHtml;
       if (nextHeadHtml === currentHeadHtml && activeCandidates.length > 0) {
         var currentMatch = null;
         var nextMatch = null;
@@ -2598,8 +2612,9 @@ export const editorChromeBridgeScript: string = `"use strict";
         }
       }
       if (currentHeadHtml !== nextHeadHtml) {
-        document.head.innerHTML = nextHeadHtml;
+        replaceSourceHeadNodes(currentHeadHtml, nextHeadHtml);
         ensureEditorChromeStyle();
+        lastSourceHeadHtml = nextHeadHtml;
       }
       Array.prototype.slice.call(document.body.attributes).forEach(function(attribute) {
         document.body.removeAttribute(attribute.name);

package/corpus/templates/design/actions/take-design-screenshot.ts

@@ -588,8 +588,15 @@ export default defineAction({
         const consoleErrors: string[] = [];
         const fontLoadFailures: string[] = [];
         page.on("console", (msg) => {
+          // Alpine reports failed expressions at warn level, and that warning
+          // is the only place the expression and element appear — its paired
+          // `pageerror` is a bare "Invalid or unexpected token".
           if (msg.type() === "error") {
             consoleErrors.push(msg.text().slice(0, 300));
+            return;
+          }
+          if (msg.type() === "warning" && /Alpine/.test(msg.text())) {
+            consoleErrors.push(msg.text().slice(0, 300));
           }
         });
         page.on("pageerror", (err) => {

package/corpus/templates/design/app/components/design/DesignCanvas.tsx

@@ -106,6 +106,7 @@ import {
   forwardEmbeddedCanvasPanMessage,
   type EmbeddedCanvasPanSession,
 } from "./design-canvas/iframe-pan";
+import { withLocalRuntimes } from "./design-canvas/local-runtime";
 import type { MotionTrackWire } from "./design-canvas/motion-types";
 import {
   PENDING_TEXT_EDIT_TIMEOUT_MS,
@@ -1018,7 +1019,14 @@ function runtimeDocumentNeedsReload(
     Array.from(html.matchAll(SCRIPT_ELEMENT_RE), (match) => match[0]).join(
       "\n",
     );
-  return scriptSignature(previousContent) !== scriptSignature(nextContent);
+  // A changed <head> is replaced wholesale, which drops whatever the page's own
+  // runtime injected there and cannot re-run the scripts that produced it.
+  const headSignature = (html: string) =>
+    /<head\b[^>]*>([\s\S]*?)<\/head\s*>/i.exec(html)?.[1] ?? "";
+  return (
+    scriptSignature(previousContent) !== scriptSignature(nextContent) ||
+    headSignature(previousContent) !== headSignature(nextContent)
+  );
 }
 
 /**
@@ -2261,7 +2269,7 @@ export function DesignCanvas({
       editorChromeBridge +
       imageDiagBridge;
     const frameContent = getEmbeddedFrameDocumentContent({
-      content: iframeRenderContent,
+      content: withLocalRuntimes(iframeRenderContent),
       embeddedFrameBackground,
       transparentBackground,
       contentOffsetX: embeddedFrame?.contentOffsetX ?? 0,
@@ -2282,7 +2290,7 @@ export function DesignCanvas({
           embeddedFrame?.contentOffsetY ?? 0,
         ),
       ].join("");
-      frameDocument = `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">${frameStyle}</head><body>${iframeRenderContent}${bridgeToInject}</body></html>`;
+      frameDocument = `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">${frameStyle}</head><body>${withLocalRuntimes(iframeRenderContent)}${bridgeToInject}</body></html>`;
     }
     // Overview frames report their own content height so the canvas can
     // content-fit them (Framer-style). Embedded (overview) frames only — a

package/corpus/templates/design/app/components/design/MultiScreenCanvas.tsx

@@ -88,6 +88,7 @@ import {
   type ContentSizeSample,
 } from "./design-canvas/content-size-report";
 import { appendHitTestResponder } from "./design-canvas/hit-test";
+import { withLocalRuntimes } from "./design-canvas/local-runtime";
 import { DesignCanvas } from "./DesignCanvas";
 import { dndHostLog } from "./dnd-debug";
 import {
@@ -9499,7 +9500,9 @@ const Screen = memo(function Screen({
     // editable DesignCanvas is supplied) still report their own height and
     // content-fit. The editable DesignCanvas path injects its own reporter.
     return injectSessionReplayIframeBootstrap(
-      appendContentSizeReporter(appendHitTestResponder(screen.content)),
+      appendContentSizeReporter(
+        appendHitTestResponder(withLocalRuntimes(screen.content)),
+      ),
     );
     // eslint-disable-next-line react-hooks/exhaustive-deps
   }, [screen.content]);

package/corpus/templates/design/app/components/design/bridge/editor-chrome.bridge.ts

@@ -315,19 +315,49 @@ declare var __SELECTED_LAYER_DRAG_PRIORITY__: boolean;
     renderRuntimeInteractionStatePreviews();
   }
 
-  function runtimeHeadHtmlWithoutEditorChrome(): string {
-    if (!document.head) return "";
-    var clone = document.head.cloneNode(true) as HTMLElement;
-    Array.prototype.slice
-      .call(
-        clone.querySelectorAll(
-          "[data-agent-native-editor-chrome-style], [data-agent-native-editing-safety-style]",
-        ),
-      )
-      .forEach(function (node) {
-        if (node.parentNode) node.parentNode.removeChild(node);
-      });
-    return clone.innerHTML;
+  /**
+   * The last source <head> this bridge applied. Compared against instead of the
+   * live head, which also carries nodes the page's own runtime injected —
+   * @tailwindcss/browser's compiled sheet above all. Against the live head the
+   * comparison always differs, the head gets wiped, the compiled CSS goes with
+   * it, and the re-inserted `<script src>` cannot rebuild it because innerHTML
+   * never executes scripts. The screen then renders unstyled for good.
+   */
+  var lastSourceHeadHtml: string | null = null;
+
+  /**
+   * Swaps only the nodes the previous source head contributed. Assigning
+   * `document.head.innerHTML` instead destroys whatever the page's own runtime
+   * injected — @tailwindcss/browser's compiled sheet above all — and the
+   * `<script src>` re-inserted in its place can never rebuild it, because
+   * innerHTML does not execute scripts.
+   */
+  function replaceSourceHeadNodes(
+    previousSourceHtml: string | null,
+    nextSourceHtml: string,
+  ): void {
+    if (!document.head) return;
+    var stale = document.createElement("head");
+    stale.innerHTML = previousSourceHtml || "";
+    var staleCounts: Record<string, number> = {};
+    Array.prototype.forEach.call(stale.children, function (node: Element) {
+      var key = node.outerHTML;
+      staleCounts[key] = (staleCounts[key] || 0) + 1;
+    });
+    Array.prototype.slice.call(document.head.children).forEach(function (
+      node: Element,
+    ) {
+      var key = node.outerHTML;
+      if (!staleCounts[key]) return;
+      staleCounts[key] -= 1;
+      if (node.parentNode) node.parentNode.removeChild(node);
+    });
+    var next = document.createElement("head");
+    next.innerHTML = nextSourceHtml || "";
+    var anchor = document.head.firstChild;
+    Array.prototype.slice.call(next.children).forEach(function (node: Element) {
+      document.head.insertBefore(document.importNode(node, true), anchor);
+    });
   }
 
   function chromeScaleX(): number {
@@ -3123,8 +3153,8 @@ declare var __SELECTED_LAYER_DRAG_PRIORITY__: boolean;
   // Both layer states are painted here, from the one `layer-states` message,
   // so every call site that re-runs after a runtime document swap restores
   // hide AND lock together. Locked paints an attribute only; the hairline
-  // treatment lives in the editor chrome stylesheet so it is stripped from
-  // runtimeHeadHtmlWithoutEditorChrome and never reaches source or export.
+  // treatment lives in the editor chrome stylesheet, which is never part of
+  // the source head and so never reaches source or export.
   function applyLayerStateSelectors(): void {
     document
       .querySelectorAll("[data-agent-native-runtime-hidden]")
@@ -3248,7 +3278,13 @@ declare var __SELECTED_LAYER_DRAG_PRIORITY__: boolean;
 
     var nextHeadHtml = nextDoc.head ? nextDoc.head.innerHTML : "";
     ensureEditorChromeStyle();
-    var currentHeadHtml = runtimeHeadHtmlWithoutEditorChrome();
+    if (lastSourceHeadHtml === null) {
+      // First patch after a srcdoc build, so the document already carries this
+      // source head. Forced replacements adopt too: treating the live head as
+      // the baseline is what wipes the runtime's own nodes.
+      lastSourceHeadHtml = nextHeadHtml;
+    }
+    var currentHeadHtml = lastSourceHeadHtml;
     if (nextHeadHtml === currentHeadHtml && activeCandidates.length > 0) {
       var currentMatch = null;
       var nextMatch = null;
@@ -3326,8 +3362,9 @@ declare var __SELECTED_LAYER_DRAG_PRIORITY__: boolean;
       }
     }
     if (currentHeadHtml !== nextHeadHtml) {
-      document.head.innerHTML = nextHeadHtml;
+      replaceSourceHeadNodes(currentHeadHtml, nextHeadHtml);
       ensureEditorChromeStyle();
+      lastSourceHeadHtml = nextHeadHtml;
     }
     Array.prototype.slice.call(document.body.attributes).forEach(function (
       attribute: Attr,