@agent-native/core 0.157.0 → 0.157.2

package/corpus/templates/calendar/server/handlers/bookings.ts

@@ -19,6 +19,7 @@ import {
   type H3Event,
 } from "h3";
 import { nanoid } from "nanoid";
+import { z } from "zod";
 
 import type {
   Booking,
@@ -33,6 +34,7 @@ import { getDb, schema } from "../db/index.js";
 import {
   parseBookingLinkDurations,
   resolveAvailabilityDuration,
+  type BookingDurationSource,
 } from "../lib/booking-durations.js";
 import {
   sendBookingCancellationEmails,
@@ -45,6 +47,7 @@ import {
 import {
   getBookingLinkCoHostEmails,
   getBookingLinkRequiredHostEmails,
+  normalizeBookingHosts,
 } from "../lib/booking-link-utils.js";
 import { getOwnerBookingTimeZone } from "../lib/booking-timezone.js";
 import { eventBlocksAvailability } from "../lib/calendar-availability.js";
@@ -173,6 +176,7 @@ type AvailabilityContext = {
   hostEmails: string[];
   slug: string;
   bookingLink?: BookingLinkRow;
+  durationSource?: BookingDurationSource;
   conflictSlugs: string[];
 };
 
@@ -182,6 +186,86 @@ type BookingLinkRow = typeof schema.bookingLinks.$inferSelect;
 type ConflictDb = Pick<ReturnType<typeof getDb>, "select">;
 const BOOKING_SLOT_STEP_MINUTES = 30;
 
+const bookingAvailabilityDraftSchema = z
+  .object({
+    slug: z.string().trim().min(1).max(200),
+    durations: z
+      .array(
+        z
+          .number()
+          .int()
+          .min(1)
+          .max(24 * 60),
+      )
+      .min(1)
+      .max(20),
+    hosts: z
+      .array(
+        z.object({
+          email: z.string().email().max(320),
+          displayName: z.string().max(200).optional(),
+        }),
+      )
+      .max(20),
+  })
+  .strict();
+
+type BookingAvailabilityDraft = z.infer<typeof bookingAvailabilityDraftSchema>;
+
+export function parseBookingAvailabilityDraft(
+  raw: unknown,
+): { draft: BookingAvailabilityDraft } | { error: string } {
+  if (typeof raw !== "string") {
+    return { error: "draft must be a JSON object" };
+  }
+  if (raw.length > 16_000) {
+    return { error: "draft is too large" };
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { error: "draft must be valid JSON" };
+  }
+
+  const result = bookingAvailabilityDraftSchema.safeParse(parsed);
+  return result.success
+    ? { draft: result.data }
+    : { error: "draft has an invalid booking-link configuration" };
+}
+
+export function resolveBookingLinkAvailabilityOverrides({
+  bookingLink,
+  draft,
+}: {
+  bookingLink: BookingLinkRow;
+  draft?: BookingAvailabilityDraft;
+}): {
+  hostEmails: string[];
+  durationSource: BookingDurationSource;
+} {
+  if (!draft) {
+    return {
+      hostEmails: getBookingLinkRequiredHostEmails(bookingLink),
+      durationSource: bookingLink,
+    };
+  }
+
+  const ownerEmail = bookingLink.ownerEmail;
+  const draftHosts = normalizeBookingHosts(draft.hosts, ownerEmail);
+  return {
+    hostEmails: [
+      ...(ownerEmail ? [ownerEmail] : []),
+      ...draftHosts.map((host) => host.email),
+    ],
+    durationSource: {
+      duration: draft.durations[0],
+      durations: JSON.stringify(draft.durations),
+    },
+  };
+}
+
 type LocalDateTimeParts = {
   year: number;
   month: number;
@@ -382,9 +466,11 @@ function formatLocalTime(totalMinutes: number): string {
 
 async function resolveAvailabilityContext({
   slug,
+  draft,
   db = getDb(),
 }: {
   slug: string;
+  draft?: BookingAvailabilityDraft;
   db?: ConflictDb;
 }): Promise<AvailabilityContext> {
   const [configRaw, bookingLink] = await Promise.all([
@@ -393,17 +479,34 @@ async function resolveAvailabilityContext({
       ? db
           .select()
           .from(schema.bookingLinks)
-          .where(eq(schema.bookingLinks.slug, slug))
+          .where(
+            draft
+              ? and(
+                  eq(schema.bookingLinks.slug, slug),
+                  accessFilter(
+                    schema.bookingLinks,
+                    schema.bookingLinkShares,
+                    undefined,
+                    "editor",
+                  ),
+                )
+              : eq(schema.bookingLinks.slug, slug),
+          )
           .then((rows) => rows[0])
       : Promise.resolve(undefined),
   ]);
+  if (draft && !bookingLink) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: "Booking link not found",
+    });
+  }
   const config = configRaw as unknown as AvailabilityConfig | null;
   const ownerEmail = bookingLink?.ownerEmail;
-  const hostEmails = bookingLink
-    ? getBookingLinkRequiredHostEmails(bookingLink)
-    : ownerEmail
-      ? [ownerEmail]
-      : [];
+  const overrides = bookingLink
+    ? resolveBookingLinkAvailabilityOverrides({ bookingLink, draft })
+    : undefined;
+  const hostEmails = overrides?.hostEmails ?? (ownerEmail ? [ownerEmail] : []);
   const [ownerConfigRaw, ownerSettingsRaw, conflictSlugs] = await Promise.all([
     ownerEmail
       ? getUserSetting(ownerEmail, "calendar-availability")
@@ -432,6 +535,7 @@ async function resolveAvailabilityContext({
     hostEmails,
     slug,
     bookingLink,
+    durationSource: overrides?.durationSource,
     conflictSlugs,
   };
 }
@@ -1182,111 +1286,138 @@ export const createBooking = defineEventHandler(async (event: H3Event) => {
   }
 });
 
-export const getAvailableSlots = defineEventHandler(async (event: H3Event) => {
-  try {
-    const query = getQuery(event);
-    const date = typeof query.date === "string" ? query.date : "";
-    const from = parseDateOnly(query.from);
-    const to = parseDateOnly(query.to);
-    const hasRangeQuery = query.from !== undefined || query.to !== undefined;
-    const slug = typeof query.slug === "string" ? query.slug : "";
-
-    if (hasRangeQuery) {
-      if (!from || !to) {
-        setResponseStatus(event, 400);
-        return {
-          error:
-            "from and to query parameters are required together in YYYY-MM-DD format",
-        };
-      }
-      if (from > to) {
-        setResponseStatus(event, 400);
-        return { error: "from must be before to" };
-      }
-      if (countDaysInclusive(from, to) > MAX_AVAILABILITY_RANGE_DAYS) {
-        setResponseStatus(event, 400);
-        return {
-          error: `date range cannot exceed ${MAX_AVAILABILITY_RANGE_DAYS} days`,
-        };
-      }
-    } else if (!parseDateOnly(date)) {
+async function getAvailableSlotsForQuery(
+  event: H3Event,
+  query: Record<string, unknown>,
+  draft?: BookingAvailabilityDraft,
+) {
+  const date = typeof query.date === "string" ? query.date : "";
+  const from = parseDateOnly(query.from);
+  const to = parseDateOnly(query.to);
+  const hasRangeQuery = query.from !== undefined || query.to !== undefined;
+  const slug = typeof query.slug === "string" ? query.slug : "";
+
+  if (hasRangeQuery) {
+    if (!from || !to) {
       setResponseStatus(event, 400);
-      return { error: "date query parameter is required" };
-    }
-
-    const context = await resolveAvailabilityContext({ slug });
-    if (!context.effectiveConfig) {
-      return hasRangeQuery ? { dates: [] } : { slots: [] };
+      return {
+        error:
+          "from and to query parameters are required together in YYYY-MM-DD format",
+      };
     }
-    const durationResult = resolveAvailabilityDuration({
-      rawDuration: query.duration,
-      bookingLink: context.bookingLink,
-      availability: context.effectiveConfig,
-    });
-    if ("error" in durationResult) {
+    if (from > to) {
       setResponseStatus(event, 400);
-      return { error: durationResult.error };
+      return { error: "from must be before to" };
     }
-    const duration = durationResult.duration;
-
-    if (hasRangeQuery) {
-      const rangeStart = formatDateOnly(from!);
-      const rangeEnd = formatDateOnly(to!);
-      const timezone = context.effectiveConfig.timezone || "UTC";
-      const conflictResult = await getConflictItems({
-        ownerEmail: context.ownerEmail,
-        hostEmails: context.hostEmails,
-        conflictSlugs: context.conflictSlugs,
-        rangeStartIso: dateStartIso(rangeStart, timezone),
-        rangeEndIso: dateEndIso(rangeEnd, timezone),
-        timezone,
-      });
-      if (conflictResult.unavailableReason) {
-        return unavailableAvailabilityResponse(event);
-      }
-      const dates: string[] = [];
-      for (
-        let cursor = new Date(from!);
-        cursor <= to!;
-        cursor = addLocalDays(cursor, 1)
-      ) {
-        const day = formatDateOnly(cursor);
-        const slots = generateAvailableSlotsForDate({
-          date: day,
-          duration,
-          config: context.effectiveConfig,
-          conflictItems: conflictResult.items,
-        });
-        if (slots.length > 0) {
-          dates.push(day);
-        }
-      }
-      return { dates };
+    if (countDaysInclusive(from, to) > MAX_AVAILABILITY_RANGE_DAYS) {
+      setResponseStatus(event, 400);
+      return {
+        error: `date range cannot exceed ${MAX_AVAILABILITY_RANGE_DAYS} days`,
+      };
     }
+  } else if (!parseDateOnly(date)) {
+    setResponseStatus(event, 400);
+    return { error: "date query parameter is required" };
+  }
+
+  const context = await resolveAvailabilityContext({ slug, draft });
+  if (!context.effectiveConfig) {
+    return hasRangeQuery ? { dates: [] } : { slots: [] };
+  }
+  const durationResult = resolveAvailabilityDuration({
+    rawDuration: query.duration,
+    bookingLink: context.durationSource ?? context.bookingLink,
+    availability: context.effectiveConfig,
+  });
+  if ("error" in durationResult) {
+    setResponseStatus(event, 400);
+    return { error: durationResult.error };
+  }
+  const duration = durationResult.duration;
 
+  if (hasRangeQuery) {
+    const rangeStart = formatDateOnly(from!);
+    const rangeEnd = formatDateOnly(to!);
     const timezone = context.effectiveConfig.timezone || "UTC";
     const conflictResult = await getConflictItems({
       ownerEmail: context.ownerEmail,
       hostEmails: context.hostEmails,
       conflictSlugs: context.conflictSlugs,
-      rangeStartIso: dateStartIso(date, timezone),
-      rangeEndIso: dateEndIso(date, timezone),
+      rangeStartIso: dateStartIso(rangeStart, timezone),
+      rangeEndIso: dateEndIso(rangeEnd, timezone),
       timezone,
     });
     if (conflictResult.unavailableReason) {
       return unavailableAvailabilityResponse(event);
     }
-    const availableSlots = generateAvailableSlotsForDate({
-      date,
-      duration,
-      config: context.effectiveConfig,
-      conflictItems: conflictResult.items,
-    });
+    const dates: string[] = [];
+    for (
+      let cursor = new Date(from!);
+      cursor <= to!;
+      cursor = addLocalDays(cursor, 1)
+    ) {
+      const day = formatDateOnly(cursor);
+      const slots = generateAvailableSlotsForDate({
+        date: day,
+        duration,
+        config: context.effectiveConfig,
+        conflictItems: conflictResult.items,
+      });
+      if (slots.length > 0) {
+        dates.push(day);
+      }
+    }
+    return { dates };
+  }
 
-    return { slots: availableSlots };
+  const timezone = context.effectiveConfig.timezone || "UTC";
+  const conflictResult = await getConflictItems({
+    ownerEmail: context.ownerEmail,
+    hostEmails: context.hostEmails,
+    conflictSlugs: context.conflictSlugs,
+    rangeStartIso: dateStartIso(date, timezone),
+    rangeEndIso: dateEndIso(date, timezone),
+    timezone,
+  });
+  if (conflictResult.unavailableReason) {
+    return unavailableAvailabilityResponse(event);
+  }
+  const availableSlots = generateAvailableSlotsForDate({
+    date,
+    duration,
+    config: context.effectiveConfig,
+    conflictItems: conflictResult.items,
+  });
+
+  return { slots: availableSlots };
+}
+
+export const getAvailableSlots = defineEventHandler(async (event: H3Event) => {
+  try {
+    const query = getQuery(event);
+    const rawDraft = query.draft;
+    if (rawDraft !== undefined) {
+      const parsedDraft = parseBookingAvailabilityDraft(rawDraft);
+      if ("error" in parsedDraft) {
+        setResponseStatus(event, 400);
+        return { error: parsedDraft.error };
+      }
+      if (typeof query.slug !== "string" || !query.slug) {
+        setResponseStatus(event, 400);
+        return { error: "slug query parameter is required for draft preview" };
+      }
+      return await requireRequestContext(event, () =>
+        getAvailableSlotsForQuery(event, query, parsedDraft.draft),
+      );
+    }
+
+    return await getAvailableSlotsForQuery(event, query);
   } catch (error: any) {
-    setResponseStatus(event, 500);
-    return { error: error.message };
+    setResponseStatus(
+      event,
+      Number.isInteger(error?.statusCode) ? error.statusCode : 500,
+    );
+    return { error: error?.message || "Failed to fetch available slots" };
   }
 });
 

package/corpus/templates/calendar/server/plugins/auth.ts

@@ -16,8 +16,6 @@ export default createAuthPlugin({
       "Manages availability and booking links automatically",
       "Answers schedule questions and resolves conflicts instantly",
     ],
-    runLocalCommand:
-      "npx @agent-native/core@latest create my-calendar-app --template calendar",
   },
   publicPaths: [
     "/book",

package/corpus/templates/clips/actions/create-folder.ts

@@ -1,6 +1,7 @@
 import { defineAction } from "@agent-native/core";
 import { writeAppState } from "@agent-native/core/application-state";
 import { and, eq, isNull, sql } from "drizzle-orm";
+import { createError } from "h3";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
@@ -74,7 +75,12 @@ export default defineAction({
         .from(schema.folders)
         .where(and(...parentWhereClauses))
         .limit(1);
-      if (!parent) throw new Error(`Parent folder not found: ${args.parentId}`);
+      if (!parent) {
+        throw createError({
+          statusCode: 404,
+          statusMessage: `Parent folder not found: ${args.parentId}`,
+        });
+      }
     }
 
     // Next position within siblings

package/corpus/templates/clips/actions/create-meeting.ts

@@ -78,7 +78,7 @@ export default defineAction({
     .refine((v) => v.title || v.calendarEventId, {
       message: "Provide either title or calendarEventId",
     }),
-  run: async (args) => {
+  run: async (args, actionContext) => {
     const db = getDb();
     const ownerEmail = getCurrentOwnerEmail();
     const orgId = await getActiveOrganizationId();
@@ -191,7 +191,11 @@ export default defineAction({
     }
 
     const visibility =
-      args.visibility ?? (await getDefaultRecordingVisibility(orgId));
+      args.visibility ??
+      (await getDefaultRecordingVisibility(
+        orgId,
+        actionContext?.userEmail ?? ownerEmail,
+      ));
 
     try {
       await db.insert(schema.meetings).values({

package/corpus/templates/clips/actions/create-recording.ts

@@ -39,7 +39,7 @@ export default defineAction({
   description:
     "Create a new recording row in 'uploading' status and return its id plus the chunk upload URL template. The frontend POSTs chunks to /api/uploads/:id/chunk?index=N&total=T&isFinal=0|1, then finalizes on the last chunk. Recorders can pass app/window title context for an immediate fallback title.",
   schema: createRecordingSchema,
-  run: async (args) => {
+  run: async (args, actionContext) => {
     const db = getDb();
     const ownerEmail = getCurrentOwnerEmail();
     const id = args.id || nanoid();
@@ -52,8 +52,10 @@ export default defineAction({
     const { organizationId } = await requireOrganizationAccess(
       args.organizationId,
     );
-    const defaultVisibility =
-      await getDefaultRecordingVisibility(organizationId);
+    const defaultVisibility = await getDefaultRecordingVisibility(
+      organizationId,
+      actionContext?.userEmail ?? ownerEmail,
+    );
 
     const spaceIds = (args.spaceIds ?? []).filter(
       (value, index, arr) => value && arr.indexOf(value) === index,

package/corpus/templates/clips/actions/finalize-recording.ts

@@ -48,6 +48,7 @@ import {
   deleteResumableSession,
   getResumableSession,
 } from "../server/lib/resumable-session.js";
+import { abortResumableUploadSession } from "../server/lib/resumable-upload-cleanup.js";
 import { resolveResumableUploadProvider } from "../server/lib/resumable-upload-provider.js";
 import { fetchS3ObjectByUrl } from "../server/lib/s3-upload-provider.js";
 import {
@@ -1183,17 +1184,35 @@ export default defineAction({
               ),
             );
         }
-        try {
-          const uploadProvider = await resolveResumableUploadProvider(
-            resumableSession.providerId,
+        const uploadProvider = await resolveResumableUploadProvider(
+          resumableSession.providerId,
+        );
+        if (!uploadProvider?.resumable) {
+          throw new Error(
+            "Upload completion failed: No resumable upload provider configured",
           );
-          if (!uploadProvider?.resumable) {
-            throw new Error("No resumable upload provider configured");
-          }
-          if (resumableSession.bytesUploaded <= 0) {
-            throw new Error("Recording upload contained no video bytes");
+        }
+        if (resumableSession.bytesUploaded <= 0) {
+          const cleaned = await abortResumableUploadSession(resumableSession, {
+            provider: uploadProvider,
+            label: `finalize-${id}`,
+          });
+          if (cleaned) {
+            await deleteResumableSession(id, generationId).catch((deleteErr) =>
+              console.warn(
+                "[finalize] failed to retire empty resumable session:",
+                deleteErr,
+              ),
+            );
           }
-          const videoUrl = await uploadProvider.resumable.completeSession(
+          throw new Error(
+            "Upload completion failed: Recording upload contained no video bytes",
+          );
+        }
+
+        let videoUrl: string;
+        try {
+          videoUrl = await uploadProvider.resumable.completeSession(
             {
               sessionId: resumableSession.sessionId,
               meta: resumableSession.meta,
@@ -1203,74 +1222,87 @@ export default defineAction({
               : "",
             { stableUrl: true, recordAsset: false },
           );
-          debugLog("[finalize] resumable upload completed", { id, videoUrl });
-          let servedBytes: number | null;
-          try {
-            servedBytes = await verifyServedMediaUrl(id, videoUrl, true);
-          } catch (err) {
-            const failureReason =
-              err instanceof Error ? err.message : String(err);
-            const pending = await leaveRecordingProcessingForMediaVerification({
-              id,
-              ownerEmail,
-              failureReason,
-              media: {
-                videoUrl,
-                videoSizeBytes: resumableSession.bytesUploaded,
-                sourceSizeBytes: resumableSession.bytesUploaded,
-                videoFormat,
-                finalDurationMs,
-                finalWidth,
-                finalHeight,
-                finalHasAudio,
-                finalHasCamera,
-                seekableApplied: false,
-                mimeType,
-                providerId: resumableSession.providerId,
-                locallyTranscoded: args.locallyTranscoded === true,
-              },
-            });
+        } catch (err) {
+          const cleaned = await abortResumableUploadSession(resumableSession, {
+            provider: uploadProvider,
+            label: `finalize-${id}`,
+          });
+          if (cleaned) {
             await deleteResumableSession(id, generationId).catch((deleteErr) =>
               console.warn(
-                "[finalize] failed to retire pending resumable session:",
+                "[finalize] failed to retire aborted resumable session:",
                 deleteErr,
               ),
             );
-            return pending;
           }
-          const result = await markRecordingReady({
-            ...readyParams,
-            videoUrl,
-            videoSizeBytes: servedBytes ?? resumableSession.bytesUploaded,
-            sourceSizeBytes: resumableSession.bytesUploaded,
-            // Streaming path forwards raw MediaRecorder bytes straight to the
-            // provider — no faststart/Cues rewrite happened. Repair in the
-            // background.
-            seekableApplied: false,
-          });
-          if (result.status === "ready" && result.transitionedToReady) {
-            queueBackgroundBuilderCompression({
-              recordingId: id,
-              ownerEmail,
+          console.error("[finalize] resumable complete failed:", err);
+          throw new Error(
+            `Upload completion failed: ${err instanceof Error ? err.message : String(err)}`,
+          );
+        }
+
+        debugLog("[finalize] resumable upload completed", { id, videoUrl });
+        let servedBytes: number | null;
+        try {
+          servedBytes = await verifyServedMediaUrl(id, videoUrl, true);
+        } catch (err) {
+          const failureReason =
+            err instanceof Error ? err.message : String(err);
+          const pending = await leaveRecordingProcessingForMediaVerification({
+            id,
+            ownerEmail,
+            failureReason,
+            media: {
               videoUrl,
+              videoSizeBytes: resumableSession.bytesUploaded,
+              sourceSizeBytes: resumableSession.bytesUploaded,
+              videoFormat,
+              finalDurationMs,
+              finalWidth,
+              finalHeight,
+              finalHasAudio,
+              finalHasCamera,
+              seekableApplied: false,
               mimeType,
               providerId: resumableSession.providerId,
-              sourceSizeBytes: resumableSession.bytesUploaded,
               locallyTranscoded: args.locallyTranscoded === true,
-            });
-          }
-          // Delete only after durable state is written — so a retry before
-          // this point can still find the session and re-enter this path.
-          deleteResumableSession(id, generationId).catch((err) =>
-            console.warn("[finalize] failed to delete resumable session:", err),
-          );
-          return result;
-        } catch (err) {
-          console.error("[finalize] resumable complete failed:", err);
-          throw new Error(
-            `Upload completion failed: ${err instanceof Error ? err.message : String(err)}`,
+            },
+          });
+          await deleteResumableSession(id, generationId).catch((deleteErr) =>
+            console.warn(
+              "[finalize] failed to retire pending resumable session:",
+              deleteErr,
+            ),
           );
+          return pending;
         }
+        const result = await markRecordingReady({
+          ...readyParams,
+          videoUrl,
+          videoSizeBytes: servedBytes ?? resumableSession.bytesUploaded,
+          sourceSizeBytes: resumableSession.bytesUploaded,
+          // Streaming path forwards raw MediaRecorder bytes straight to the
+          // provider — no faststart/Cues rewrite happened. Repair in the
+          // background.
+          seekableApplied: false,
+        });
+        if (result.status === "ready" && result.transitionedToReady) {
+          queueBackgroundBuilderCompression({
+            recordingId: id,
+            ownerEmail,
+            videoUrl,
+            mimeType,
+            providerId: resumableSession.providerId,
+            sourceSizeBytes: resumableSession.bytesUploaded,
+            locallyTranscoded: args.locallyTranscoded === true,
+          });
+        }
+        // Delete only after durable state is written — so a retry before
+        // this point can still find the session and re-enter this path.
+        deleteResumableSession(id, generationId).catch((err) =>
+          console.warn("[finalize] failed to delete resumable session:", err),
+        );
+        return result;
       }
 
       // Buffered path — assemble chunks from application_state, then upload.