@agent-native/core 0.169.1 → 0.171.0

package/corpus/templates/calendar/server/lib/google-calendar.ts

@@ -5,13 +5,14 @@ import {
   listOAuthAccountsByOwner,
 } from "@agent-native/core/oauth-tokens";
 import {
-  isOAuthConnected,
   getOAuthAccounts,
+  getCredentialContext,
   getRequestOrgId,
   resolveSecret,
   runWithRequestContext,
   resolveGoogleProviderCredentialCandidatesWithReader,
 } from "@agent-native/core/server";
+import { resolveWorkspaceConnectionForApp } from "@agent-native/core/workspace-connections";
 
 import type {
   CalendarEvent,
@@ -31,11 +32,37 @@ import {
   calendarUpdateEvent,
   peopleGetProfile,
 } from "./google-api.js";
+import { getCalendarProviderApiRuntime } from "./provider-api.js";
 import {
   alignSeriesRecurrenceToStart,
   shiftSeriesDateValue,
 } from "./series-recurrence.js";
 
+type ManagedCalendarClient = {
+  email: string;
+  accessToken: string;
+};
+
+async function resolveManagedCalendarClient(): Promise<ManagedCalendarClient | null> {
+  if (!getCredentialContext()) return null;
+  const connection = await resolveWorkspaceConnectionForApp({
+    appId: "calendar",
+    provider: "google_calendar",
+    requireConnected: true,
+  });
+  if (!connection.available) return null;
+  const credential =
+    await getCalendarProviderApiRuntime().resolveOAuthAccessToken({
+      provider: "google_calendar",
+    });
+  if (!credential.accountId) {
+    throw new Error(
+      "The connected Google Calendar workspace account has no account id.",
+    );
+  }
+  return { email: credential.accountId, accessToken: credential.accessToken };
+}
+
 const SCOPES = [
   "https://www.googleapis.com/auth/calendar.readonly",
   "https://www.googleapis.com/auth/calendar.events",
@@ -55,6 +82,16 @@ interface GoogleTokens {
   photoUrl?: string;
 }
 
+const CALENDAR_SCOPE_PREFIX = "https://www.googleapis.com/auth/calendar.";
+
+function hasCalendarScope(tokens: Record<string, unknown>): boolean {
+  const scope = tokens.scope;
+  if (typeof scope !== "string" || !scope.trim()) return true;
+  return scope
+    .split(/[\s,]+/)
+    .some((value) => value.startsWith(CALENDAR_SCOPE_PREFIX));
+}
+
 function optionalString(value: unknown): string | undefined {
   return typeof value === "string" && value.length > 0 ? value : undefined;
 }
@@ -562,8 +599,10 @@ export async function getClient(
   email: string | undefined,
 ): Promise<{ accessToken: string } | null> {
   if (!email) return null;
-  const accounts = await listOAuthAccountsByOwner("google", email);
-  if (accounts.length === 0) return null;
+  const accounts = (await listOAuthAccountsByOwner("google", email)).filter(
+    (account) => hasCalendarScope(account.tokens),
+  );
+  if (accounts.length === 0) return resolveManagedCalendarClient();
 
   const account = accounts.find((a) => a.accountId === email) ?? accounts[0];
 
@@ -584,7 +623,9 @@ export interface GoogleAccountSelection {
 export async function getDefaultAccountSelection(
   ownerEmail: string,
 ): Promise<GoogleAccountSelection> {
-  const accounts = await listOAuthAccountsByOwner("google", ownerEmail);
+  const accounts = (
+    await listOAuthAccountsByOwner("google", ownerEmail)
+  ).filter((account) => hasCalendarScope(account.tokens));
   const account =
     accounts.find(
       (candidate) =>
@@ -592,6 +633,10 @@ export async function getDefaultAccountSelection(
         ownerEmail.trim().toLowerCase(),
     ) ?? accounts[0];
   if (!account) {
+    const managed = await resolveManagedCalendarClient();
+    if (managed) {
+      return { ownerEmail, accountEmail: managed.email };
+    }
     throw new Error(
       "Google Calendar not connected. Connect via Settings first.",
     );
@@ -605,12 +650,21 @@ export async function getClientForAccount({
   accountEmail,
 }: GoogleAccountSelection): Promise<{ accessToken: string }> {
   const normalizedAccountEmail = accountEmail.trim().toLowerCase();
-  const accounts = await listOAuthAccountsByOwner("google", ownerEmail);
+  const accounts = (
+    await listOAuthAccountsByOwner("google", ownerEmail)
+  ).filter((account) => hasCalendarScope(account.tokens));
   const account = accounts.find(
     (candidate) =>
       candidate.accountId.trim().toLowerCase() === normalizedAccountEmail,
   );
   if (!account) {
+    const managed = await resolveManagedCalendarClient();
+    if (
+      managed &&
+      managed.email.trim().toLowerCase() === normalizedAccountEmail
+    ) {
+      return { accessToken: managed.accessToken };
+    }
     throw new Error(
       `Google Calendar account not connected for this user: ${accountEmail}`,
     );
@@ -654,7 +708,9 @@ export async function getClientsWithErrors(forEmail?: string): Promise<{
   errors: Array<{ email: string; error: string }>;
 }> {
   if (!forEmail) return { clients: [], errors: [] };
-  const accounts = await listOAuthAccountsByOwner("google", forEmail);
+  const accounts = (await listOAuthAccountsByOwner("google", forEmail)).filter(
+    (account) => hasCalendarScope(account.tokens),
+  );
 
   const clients: Array<{ email: string; accessToken: string }> = [];
   const errors: Array<{ email: string; error: string }> = [];
@@ -682,6 +738,18 @@ export async function getClientsWithErrors(forEmail?: string): Promise<{
     }
   }
 
+  if (clients.length === 0) {
+    try {
+      const managed = await resolveManagedCalendarClient();
+      if (managed) clients.push(managed);
+    } catch (err: any) {
+      errors.push({
+        email: "workspace",
+        error: err?.message || "Workspace Google Calendar connection failed",
+      });
+    }
+  }
+
   return { clients, errors };
 }
 
@@ -695,7 +763,9 @@ export async function getOwnedAccountEmails(
   forEmail?: string,
 ): Promise<string[]> {
   if (!forEmail) return [];
-  const accounts = await listOAuthAccountsByOwner("google", forEmail);
+  const accounts = (await listOAuthAccountsByOwner("google", forEmail)).filter(
+    (account) => hasCalendarScope(account.tokens),
+  );
   return accounts.map((account) => account.accountId);
 }
 
@@ -716,7 +786,47 @@ export async function getClientsForAccountsWithErrors(
       resolvedAccounts: [],
     };
   }
-  const accounts = await listOAuthAccountsByOwner("google", forEmail);
+  const accounts = (await listOAuthAccountsByOwner("google", forEmail)).filter(
+    (account) => hasCalendarScope(account.tokens),
+  );
+  if (accounts.length === 0) {
+    const managed = await resolveManagedCalendarClient();
+    if (!managed) {
+      if (accountEmails?.length) {
+        throw new Error(
+          `Google Calendar account not connected for this user: ${accountEmails.join(", ")}`,
+        );
+      }
+      return {
+        clients: [],
+        errors: [],
+        requestedAccounts: [],
+        resolvedAccounts: [],
+      };
+    }
+    const requestedAccounts = Array.from(
+      new Set(
+        (accountEmails ?? [managed.email])
+          .map((email) => email.trim().toLowerCase())
+          .filter(Boolean),
+      ),
+    );
+    if (
+      requestedAccounts.some(
+        (email) => email !== managed.email.trim().toLowerCase(),
+      )
+    ) {
+      throw new Error(
+        `Google Calendar account not connected for this user: ${requestedAccounts.join(", ")}`,
+      );
+    }
+    return {
+      clients: [managed],
+      errors: [],
+      requestedAccounts,
+      resolvedAccounts: [managed.email],
+    };
+  }
   const byNormalized = new Map(
     accounts.map((account) => [
       account.accountId.trim().toLowerCase(),
@@ -765,15 +875,22 @@ export async function getClientsForAccountsWithErrors(
 }
 
 export async function isConnected(forEmail?: string): Promise<boolean> {
-  return isOAuthConnected("google", forEmail ?? "");
+  if (!forEmail) return false;
+  const accounts = await listOAuthAccountsByOwner("google", forEmail);
+  if (accounts.some((account) => hasCalendarScope(account.tokens))) return true;
+  return Boolean(await resolveManagedCalendarClient());
 }
 
 export async function getConnectedAccounts(
   forEmail?: string,
 ): Promise<string[]> {
   if (!forEmail) return [];
-  const accounts = await listOAuthAccountsByOwner("google", forEmail);
-  return accounts.map((a) => a.accountId);
+  const accounts = (await listOAuthAccountsByOwner("google", forEmail)).filter(
+    (account) => hasCalendarScope(account.tokens),
+  );
+  if (accounts.length > 0) return accounts.map((a) => a.accountId);
+  const managed = await resolveManagedCalendarClient();
+  return managed ? [managed.email] : [];
 }
 
 export async function getPrimaryAccountPhotoUrl(
@@ -781,7 +898,9 @@ export async function getPrimaryAccountPhotoUrl(
 ): Promise<string | undefined> {
   if (!forEmail) return undefined;
   const fallbackUserImage = await getBetterAuthUserImage(forEmail);
-  const accounts = await listOAuthAccountsByOwner("google", forEmail);
+  const accounts = (await listOAuthAccountsByOwner("google", forEmail)).filter(
+    (account) => hasCalendarScope(account.tokens),
+  );
   const account = accounts.find((a) => a.accountId === forEmail) ?? accounts[0];
   if (!account) return fallbackUserImage;
 
@@ -805,16 +924,22 @@ export async function getAuthStatus(
   forEmail?: string,
   orgId?: string,
 ): Promise<GoogleAuthStatus> {
-  const oauthAccounts = await getOAuthAccounts("google", forEmail);
+  const oauthAccounts = (await getOAuthAccounts("google", forEmail)).filter(
+    (account) => hasCalendarScope(account.tokens),
+  );
 
   if (oauthAccounts.length === 0) {
-    return { connected: false, accounts: [] };
+    const managed = await resolveManagedCalendarClient();
+    return managed
+      ? { connected: true, accounts: [{ email: managed.email, shared: true }] }
+      : { connected: false, accounts: [] };
   }
 
   const result: Array<{
     email: string;
     expiresAt?: string;
     photoUrl?: string;
+    shared?: boolean;
   }> = [];
   for (const account of oauthAccounts) {
     const tokens = account.tokens as unknown as GoogleTokens;

package/corpus/templates/calendar/server/onboarding.ts

@@ -0,0 +1,85 @@
+import { listOAuthAccountsByOwner } from "@agent-native/core/oauth-tokens";
+import { registerOnboardingStep } from "@agent-native/core/onboarding";
+import { hasWorkspaceProviderOAuthCredentials } from "@agent-native/core/server";
+import { resolveWorkspaceConnectionForApp } from "@agent-native/core/workspace-connections";
+
+const CALENDAR_SCOPES = [
+  "https://www.googleapis.com/auth/calendar.readonly",
+  "https://www.googleapis.com/auth/calendar.events",
+] as const;
+
+function hasRequiredScope(tokens: unknown): boolean {
+  if (!tokens || typeof tokens !== "object" || Array.isArray(tokens)) {
+    return false;
+  }
+  const scope = (tokens as { scope?: unknown }).scope;
+  if (typeof scope !== "string" || !scope.trim()) return true;
+  const granted = new Set(scope.split(/[\s,]+/).filter(Boolean));
+  return CALENDAR_SCOPES.some((requiredScope) => granted.has(requiredScope));
+}
+
+registerOnboardingStep({
+  id: "google-calendar",
+  order: 100,
+  required: false,
+  title: "Connect Google Calendar",
+  description: "Manage events and availability with your Google account.",
+  isAvailable: () => hasWorkspaceProviderOAuthCredentials("google_calendar"),
+  methods: [
+    {
+      id: "oauth",
+      kind: "link",
+      primary: true,
+      label: "Connect Google Calendar for me",
+      description:
+        "One-click Google sign-in using the workspace's managed OAuth connection. Only you can use this connection.",
+      payload: {
+        url: "/_agent-native/connections/oauth/google_calendar/start?scope=user&appId=calendar&return=/settings",
+        external: false,
+      },
+    },
+    {
+      id: "oauth-workspace",
+      kind: "link",
+      label: "Connect Google Calendar for my workspace",
+      description:
+        "Workspace admins can connect once and make this Calendar connection available to selected apps or everyone in the workspace.",
+      payload: {
+        url: "/_agent-native/connections/oauth/google_calendar/start?scope=organization&appId=calendar&return=/settings",
+        external: false,
+      },
+    },
+    {
+      id: "agent-task",
+      kind: "agent-task",
+      badge: "beta",
+      label: "Have the agent connect it",
+      payload: {
+        prompt:
+          "Help me connect Google Calendar through the managed Google OAuth connection. Start the one-click Calendar connection flow, explain the Google permission screen, and confirm whether I want the connection available only to me or to the workspace. Do not ask me to create Google Cloud credentials or paste keys.",
+      },
+    },
+  ],
+  isComplete: async (context) => {
+    if (!context?.userEmail) return false;
+    try {
+      const accounts = await listOAuthAccountsByOwner(
+        "google",
+        context.userEmail,
+      );
+      if (accounts.some((account) => hasRequiredScope(account.tokens))) {
+        return true;
+      }
+      return (
+        await resolveWorkspaceConnectionForApp({
+          appId: "calendar",
+          provider: "google_calendar",
+          requireConnected: true,
+        })
+      ).available;
+    } catch {
+      // coercion-ok: a failed lookup must leave onboarding incomplete, never completed.
+      return false;
+    }
+  },
+});

package/corpus/templates/calendar/server/plugins/agent-chat.ts

@@ -1,5 +1,7 @@
 import { registerEvent } from "@agent-native/core/event-bus";
 import { getOrgContext } from "@agent-native/core/org";
+
+import "../onboarding.js";
 import {
   createAgentChatPlugin,
   loadActionsFromStaticRegistry,

package/corpus/templates/calendar/shared/api.ts

@@ -310,13 +310,21 @@ export interface BookingLink {
   isActive: boolean;
   /** Sharing visibility: private (default), org, or public */
   visibility?: "private" | "org" | "public";
+  /** Effective management role for the current caller, when loaded from a list. */
+  accessRole?: "owner" | "admin" | "editor" | "commenter" | "viewer";
   createdAt: string;
   updatedAt: string;
 }
 
 export interface GoogleAuthStatus {
+  configured?: boolean;
   connected: boolean;
-  accounts: Array<{ email: string; expiresAt?: string; photoUrl?: string }>;
+  accounts: Array<{
+    email: string;
+    expiresAt?: string;
+    photoUrl?: string;
+    shared?: boolean;
+  }>;
 }
 
 export interface ExternalCalendar {

package/corpus/templates/chat/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/chat/app/routes.ts

@@ -1,4 +1,6 @@
 import { type RouteConfig } from "@react-router/dev/routes";
 import { flatRoutes } from "@react-router/fs-routes";
 
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/corpus/templates/chat/vitest.config.ts

@@ -11,4 +11,12 @@ export default defineConfig({
       "@shared": path.resolve(__dirname, "./shared"),
     },
   },
+  test: {
+    exclude: [
+      "**/node_modules/**",
+      "**/.git/**",
+      "**/dist/**",
+      "**/.react-router/**",
+    ],
+  },
 });

package/corpus/templates/clips/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/clips/actions/get-meeting.ts

@@ -48,7 +48,7 @@ function safeParseArray<T>(
 
 export default defineAction({
   description:
-    "Get a meeting by id with its participants, action items, and a reference to its recording (if any). Returns null if the user lacks access.",
+    'Get a meeting by id with its participants, action items, and a reference to its recording (if any). When no meeting is returned, `meeting` is null and `reason` is "unavailable" — it does not distinguish missing from inaccessible. A read failure throws instead.',
   schema: z.object({
     id: z.string().describe("Meeting id"),
   }),
@@ -59,12 +59,17 @@ export default defineAction({
       const materialized = await materializeCalendarMeetingFromVirtualId(
         args.id,
       );
-      if (!materialized?.meeting?.id) return { meeting: null };
+      if (!materialized?.meeting?.id)
+        return { meeting: null, reason: "unavailable" as const };
       meetingId = materialized.meeting.id;
     }
 
+    // "cannot see it" and "does not exist" deliberately share one reason: a
+    // caller that could tell them apart could probe ids to learn which
+    // meetings exist. The distinction callers actually need is this vs a
+    // thrown read failure, which stays separate.
     const access = await resolveAccess("meeting", meetingId);
-    if (!access) return { meeting: null };
+    if (!access) return { meeting: null, reason: "unavailable" as const };
 
     const db = getDb();
     const [row] = await db
@@ -77,7 +82,7 @@ export default defineAction({
         ),
       )
       .limit(1);
-    if (!row) return { meeting: null };
+    if (!row) return { meeting: null, reason: "unavailable" as const };
 
     // Server-side JSON parse — clients see structured arrays, not raw TEXT.
     const bullets = safeParseArray<Bullet>(

package/corpus/templates/clips/actions/list-recordings.ts

@@ -188,9 +188,19 @@ export default defineAction({
       // Meeting recordings are transcript-only (no playable media) and live on
       // the /meetings surface, so keep them out of clip library views. The link
       // is meetings.recordingId (no meetingId column on recordings), so exclude
-      // any recording referenced by a meeting. The subquery filters out NULLs
-      // so NOT IN doesn't collapse to an empty result under SQL NULL semantics.
-      const meetingRecordingIds = db
+      // any recording referenced by a meeting. Keep the exclusion database-side
+      // as a NOT IN (SELECT ...) subquery instead of pulling every meeting's
+      // recording id into memory — this table only grows. `await db` with no
+      // chain resolves the lazy proxy from create-get-db.ts to the real db
+      // instance without issuing a query; only *then* build the subquery off
+      // that resolved instance. Building it off `db` directly and handing the
+      // still-unresolved chain straight to notInArray() is the cold-start bug
+      // this used to have — drizzle reads `.getSQL()` on it synchronously, and
+      // the proxy throws rather than silently building wrong SQL. The subquery
+      // filters out NULLs so NOT IN doesn't collapse to an empty result under
+      // SQL NULL semantics.
+      const resolvedDb = await db;
+      const meetingRecordingIds = resolvedDb
         .select({ id: schema.meetings.recordingId })
         .from(schema.meetings)
         .where(isNotNull(schema.meetings.recordingId));
@@ -200,6 +210,9 @@ export default defineAction({
     // Lifecycle view filters
     if (args.view === "trash") {
       whereClauses.push(isNotNull(schema.recordings.trashedAt));
+      if (orgId) {
+        whereClauses.push(eq(schema.recordings.organizationId, orgId));
+      }
     } else {
       whereClauses.push(isNull(schema.recordings.trashedAt));
       if (args.view === "archive") {

package/corpus/templates/clips/actions/search-meetings.ts

@@ -38,6 +38,7 @@ const MEETING_COLUMNS = {
   source: schema.meetings.source,
   platform: schema.meetings.platform,
   trashedAt: schema.meetings.trashedAt,
+  ownerEmail: schema.meetings.ownerEmail,
 } as const;
 
 type MeetingRow = Pick<

package/corpus/templates/clips/actions/view-screen.ts

@@ -210,7 +210,14 @@ async function fetchLibrary({
       conditions.push(eq(schema.recordings.organizationId, organizationId));
     }
   }
-  const meetingRecordingIds = db
+  // Meeting recordings are transcript-only and live on /meetings, so keep them
+  // out of clip library views. `await db` with no chain resolves the lazy proxy
+  // from create-get-db.ts to the real instance without issuing a query; the
+  // subquery must be built off *that*. Building it off `db` hands an unresolved
+  // chain to notInArray(), which reads `.getSQL()` synchronously on a cold-start
+  // proxy. The subquery filters NULLs so NOT IN doesn't collapse to empty.
+  const resolvedDb = await db;
+  const meetingRecordingIds = resolvedDb
     .select({ id: schema.meetings.recordingId })
     .from(schema.meetings)
     .where(isNotNull(schema.meetings.recordingId));

package/corpus/templates/clips/app/components/meetings/meeting-history-row.tsx

@@ -26,6 +26,7 @@ export interface MeetingHistoryItem {
   actualEnd?: string | null;
   createdAt?: string | null;
   participants?: AttendeeStackParticipant[];
+  ownerEmail?: string | null;
 }
 
 function formatTime(iso?: string | null): string {
@@ -56,6 +57,28 @@ export function formatParticipantNames(
   return `${names.slice(0, 2).join(", ")} & ${names.length - 2} others`;
 }
 
+/**
+ * A meeting's owner — who actually recorded it in Clips — isn't necessarily
+ * on the attendee list (an ad-hoc note has none at all), and two attendees on
+ * the same call can each hold their own copy. Unlike the attendee subtitle,
+ * this is shown unconditionally, including the viewer's own meetings, so
+ * ownership is never ambiguous once a meeting is shared.
+ */
+export function formatOwnerHint(
+  ownerEmail: string | null | undefined,
+  viewerEmail: string | null | undefined,
+  t: ReturnType<typeof useT>,
+): string {
+  const owner = ownerEmail?.trim();
+  if (!owner) return "";
+  const viewer = viewerEmail?.trim().toLowerCase();
+  const name =
+    viewer && owner.toLowerCase() === viewer
+      ? t("meetingDetail.me")
+      : owner.replace(/@.*$/, "");
+  return t("meetingDetail.recordedBy", { name });
+}
+
 export function MeetingHistoryRow({
   meeting,
   snippet,
@@ -66,11 +89,17 @@ export function MeetingHistoryRow({
   const t = useT();
   const { session } = useSession();
   const participants = meeting.participants ?? [];
-  const subtitle =
+  const ownerHint = formatOwnerHint(meeting.ownerEmail, session?.email, t);
+  const primaryText =
     snippet?.trim() || formatParticipantNames(participants, session?.email);
+  const subtitle = [primaryText, ownerHint].filter(Boolean).join(" · ");
   const time = formatTime(
     meeting.actualStart ?? meeting.scheduledStart ?? meeting.createdAt,
   );
+  const soloOwnerAvatar: AttendeeStackParticipant[] =
+    participants.length === 0 && ownerHint && meeting.ownerEmail
+      ? [{ email: meeting.ownerEmail }]
+      : [];
 
   return (
     <NavLink
@@ -79,6 +108,8 @@ export function MeetingHistoryRow({
     >
       {participants.length > 0 ? (
         <AttendeeStack participants={participants} size="md" max={2} />
+      ) : soloOwnerAvatar.length > 0 ? (
+        <AttendeeStack participants={soloOwnerAvatar} size="md" max={1} />
       ) : (
         <span className="flex h-7 w-7 shrink-0 items-center justify-center rounded-md bg-muted text-muted-foreground">
           <IconFileText className="h-3.5 w-3.5" />

package/corpus/templates/clips/app/components/player/delete-recording-menu.tsx

@@ -94,7 +94,7 @@ export function RecordingOptionsMenu({
           <Button
             variant="ghost"
             size="icon"
-            className="-mx-1.5 h-auto w-auto shrink-0 px-0.5 py-1.5"
+            className="h-auto w-auto shrink-0 px-0.5 py-1.5"
             aria-label={t("deleteRecordingMenu.clipOptions")}
           >
             <IconDotsVertical className="h-4 w-4" />