@agent-native/core 0.196.0-nightly-20260928172902 → 0.196.0

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 10498
+- template files: 10508

package/corpus/templates/analytics/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable user-facing changes to Agent-Native Analytics are documented here. Open it any
 time from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-28
+
+### Improved
+
+- Ask Analytics now starts with a focused title.
+
+## 2026-09-27
+
+### Improved
+
+- Ask Analytics now opens with a centered chat and starter guidance.
+- Metric cards include their comparison period and change.
+- Complete single-number analysis queries show a compact card, and sampled tables are marked.
+- The chat home keeps suggested prompts above the composer in a centered layout.
+
 ## 2026-09-26
 
 ### Improved
@@ -24,6 +39,8 @@ time from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Improved
 
+- In the redesigned Settings, alert rules and data sources are tabs on Analytics General, and error emails and the bell sound have their own Notifications page.
+- Settings now opens from your name at the bottom of the sidebar, or with ⌘,.
 - Analytics captures confirmed query guidance for future conversations
 - Public status pages, dashboards, and analyses show resource details in link previews
 - The chat composer keeps a consistent background while AI setup is open.

package/corpus/templates/assets/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable user-facing changes to Assets are documented here. Open it any
 time from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-28
+
+### Improved
+
+- Create starter prompts now appear below the composer.
+
+## 2026-09-27
+
+### Improved
+
+- Assets chat now opens with a centered composer and starter prompts.
+- Reference actions use clearer, shorter labels.
+- Show generated image variations with save, reference, and refine actions in chat
+- The Create chat home keeps suggested prompts above the composer in a centered layout.
+
 ## 2026-09-26
 
 ### Improved
@@ -22,6 +37,9 @@ time from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Improved
 
+- Image generation uses the provider your organization picks for it, then falls back to Builder.io
+- In the new Settings, generation setup and storage are on Assets › General, and generation emails are on Assets › Notifications.
+- Settings now opens from your name at the bottom of the sidebar, or with ⌘,.
 - Brand-kit and template uploads show how to connect file storage when it is not configured
 - Public asset library links show their title and description in previews.
 

package/corpus/templates/brain/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable user-facing changes to Agent-Native Brain are documented here. Open it any
 time from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-25
+
+### Improved
+
+- Brain settings now live in tabs on Brain › General (Identity, Behavior, Publishing, Safety, and Privacy), and each change saves as you make it.
+
 ## 2026-09-22
 
 ### Added

package/corpus/templates/calendar/CHANGELOG.md

@@ -7,6 +7,8 @@ time from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Improved
 
+- Calendar time suggestions now format dates and times in your language.
+- Invitation rules now link to Automations for actions beyond accept, decline, and hide.
 - Events created by the agent now show their date and time with a direct link to Calendar.
 - Calendar shows cards for event changes and lets you start an event draft from a suggested time.
 
@@ -50,6 +52,8 @@ time from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Improved
 
+- Calendar settings are reorganized into General, Calendars, Booking, and Notifications in the new Settings.
+- Settings now opens from your name at the bottom of the sidebar, or with ⌘,.
 - The bookings list shows the latest bookings first and keeps dates and times together.
 - Colleague events use the saved accent color shown in the calendar sidebar.
 - If Zoom cannot confirm a meeting, Calendar keeps the booking and follows up with meeting details

package/corpus/templates/clips/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable user-facing changes to Clips are documented here. Open it any time
 from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-09-28
+
+### Improved
+
+- Viewers can share recordings with agents from shared recording menus
+
+### Fixed
+
+- Agent links stay valid when clip details change
+
+### Security
+
+- Password changes immediately invalidate old recording links
+- Password-protected recording links stop working when the password changes
+
 ## 2026-09-26
 
 ### Improved
@@ -16,6 +31,7 @@ from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Fixed
 
+- Removing a member from your organization now completes instead of failing with a pending cleanup error
 - Clips asks you to connect storage only when you choose an upload
 - Clips can play recordings from public S3-compatible storage in more hosted environments.
 - Dismissing storage setup now cancels queued uploads.
@@ -31,6 +47,9 @@ from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Improved
 
+- Clips settings are reorganized in the new Settings: General with Recordings and Meetings tabs, Notifications, and Slack link previews under Channels.
+- The account menu at the bottom of the sidebar shows your photo, name, and organization, and holds Settings, Usage, Get apps and extensions, and Log out
+- Video storage now uses the shared storage form, and Clear credentials asks before it removes your storage keys
 - Connect Builder storage by creating an account in one click.
 - Public clip embeds and meeting notes show richer link previews.
 - The no-comments sidebar gives viewers a concise reason to try Clips and a clear path to sign up.

package/corpus/templates/clips/actions/create-recording-agent-link.ts

@@ -12,6 +12,7 @@ import {
   CLIPS_AGENT_ACCESS_TTL_SECONDS,
   getServerAppBasePath,
 } from "../server/lib/public-agent-context.js";
+import { getRecordingAccessTokenResourceId } from "../server/lib/share-password.js";
 import {
   buildAgentApiUrls,
   CLIP_AGENT_ACCESS_TOKEN_PREFIX,
@@ -64,7 +65,8 @@ export default defineAction({
 
     const recording = access.resource as {
       id: string;
-      password?: string | null;
+      password: string | null;
+      sharePasswordVersion: string;
       archivedAt?: string | null;
       trashedAt?: string | null;
     };
@@ -86,7 +88,11 @@ export default defineAction({
 
     const grant = createScopedAgentAccessGrant({
       resourceKind: CLIP_AGENT_ACCESS_TOKEN_PREFIX,
-      resourceId: recording.id,
+      resourceId: getRecordingAccessTokenResourceId(
+        recording.id,
+        recording.password,
+        recording.sharePasswordVersion,
+      ),
       viewerEmail: getRequestUserEmail() || undefined,
       agentLabel: args.agentLabel,
       ttlSeconds: args.ttlSeconds ?? CLIPS_AGENT_ACCESS_TTL_SECONDS,

package/corpus/templates/clips/actions/update-recording.ts

@@ -1,3 +1,5 @@
+import { randomUUID } from "node:crypto";
+
 import { defineAction } from "@agent-native/core/action";
 import { writeAppState } from "@agent-native/core/application-state";
 import { assertAccess } from "@agent-native/core/sharing";
@@ -64,8 +66,10 @@ export default defineAction({
       patch.defaultSpeed = args.defaultSpeed;
     if (typeof args.animatedThumbnailEnabled === "boolean")
       patch.animatedThumbnailEnabled = args.animatedThumbnailEnabled;
-    if (args.password !== undefined)
+    if (args.password !== undefined) {
       patch.password = encryptSharePassword(args.password);
+      patch.sharePasswordVersion = randomUUID();
+    }
     if (args.expiresAt !== undefined) patch.expiresAt = args.expiresAt ?? null;
     if (typeof args.chaptersJson === "string")
       patch.chaptersJson = args.chaptersJson;

package/corpus/templates/clips/app/routes/share.$shareId.tsx

@@ -251,9 +251,11 @@ export async function loader({ params, url }: LoaderFunctionArgs) {
       verifyScopedAgentAccessToken,
     },
     { resolveAccess },
+    { getRecordingAccessTokenResourceId },
   ] = await Promise.all([
     import("@agent-native/core/server"),
     import("@agent-native/core/sharing"),
+    import("../../server/lib/share-password.js"),
   ]);
 
   const db = getDb();
@@ -265,6 +267,7 @@ export async function loader({ params, url }: LoaderFunctionArgs) {
       thumbnailUrl: schema.recordings.thumbnailUrl,
       animatedThumbnailUrl: schema.recordings.animatedThumbnailUrl,
       updatedAt: schema.recordings.updatedAt,
+      sharePasswordVersion: schema.recordings.sharePasswordVersion,
       visibility: schema.recordings.visibility,
       status: schema.recordings.status,
       ownerEmail: schema.recordings.ownerEmail,
@@ -282,15 +285,19 @@ export async function loader({ params, url }: LoaderFunctionArgs) {
 
   const agentAccessToken = url.searchParams.get(CLIPS_AGENT_ACCESS_PARAM) ?? "";
   const hasAgentAccessToken = Boolean(agentAccessToken);
+  if (!rec) return shareLoaderData(emptyLoaderData(url), hasAgentAccessToken);
+
   const tokenGrantsAgentAccess = agentAccessToken
     ? verifyScopedAgentAccessToken(agentAccessToken, {
         resourceKind: CLIP_AGENT_ACCESS_TOKEN_PREFIX,
-        resourceId: id,
+        resourceId: getRecordingAccessTokenResourceId(
+          id,
+          rec.password,
+          rec.sharePasswordVersion,
+        ),
       }).ok
     : false;
 
-  if (!rec) return shareLoaderData(emptyLoaderData(url), hasAgentAccessToken);
-
   if (isRecordingExpired(rec.expiresAt)) {
     return shareLoaderData(emptyLoaderData(url), hasAgentAccessToken);
   }

package/corpus/templates/clips/changelog/2026-09-28-agent-links-stay-valid-when-clip-details-change.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-09-28
+---
+
+Agent links stay valid when clip details change

package/corpus/templates/clips/changelog/2026-09-28-password-changes-immediately-invalidate-old-recording-links.md

@@ -0,0 +1,6 @@
+---
+type: security
+date: 2026-09-28
+---
+
+Password changes immediately invalidate old recording links

package/corpus/templates/clips/changelog/2026-09-28-password-protected-recording-links-stop-working-when-the-pas.md

@@ -0,0 +1,6 @@
+---
+type: security
+date: 2026-09-28
+---
+
+Password-protected recording links stop working when the password changes

package/corpus/templates/clips/server/db/schema.ts

@@ -171,6 +171,9 @@ export const recordings = table("recordings", {
   chaptersJson: text("chapters_json").notNull().default("[]"),
 
   password: text("password"),
+  sharePasswordVersion: text("share_password_version")
+    .notNull()
+    .default("initial"),
   expiresAt: text("expires_at"),
 
   enableComments: boolean("enable_comments").notNull().default(true),

package/corpus/templates/clips/server/lib/player-video-url.ts

@@ -5,10 +5,12 @@ import {
   isLoomEmbedBackedRecording,
   isLoomRecordingSource,
 } from "../../shared/loom.js";
+import { getRecordingAccessTokenResourceId } from "./share-password.js";
 
 type PlayerVideoRecording = {
   id: string;
   password?: string | null;
+  sharePasswordVersion?: string | null;
   sourceAppName?: string | null;
   sourceWindowTitle?: string | null;
   videoUrl?: string | null;
@@ -66,7 +68,13 @@ export function resolvePlayerVideoUrl(
     recording.password &&
     resolvedVideoUrl.startsWith("/api/video/")
   ) {
-    const token = signShortLivedToken({ resourceId: recording.id });
+    const token = signShortLivedToken({
+      resourceId: getRecordingAccessTokenResourceId(
+        recording.id,
+        recording.password,
+        recording.sharePasswordVersion,
+      ),
+    });
     resolvedVideoUrl = appendQueryParam(resolvedVideoUrl, "t", token);
   }
 

package/corpus/templates/clips/server/lib/public-agent-context.ts

@@ -40,7 +40,10 @@ import {
 import { resolveTranscriptPresentation } from "../../shared/transcript-status.js";
 import { getDb, schema } from "../db/index.js";
 import { recordAgentView } from "./agent-views.js";
-import { verifySharePassword } from "./share-password.js";
+import {
+  getRecordingAccessTokenResourceId,
+  verifySharePassword,
+} from "./share-password.js";
 
 export type PublicAgentRecording = typeof schema.recordings._.inferSelect;
 export type PublicAgentTranscript =
@@ -302,11 +305,16 @@ export async function loadPublicAgentAccess(
   const viewerIsOwner = Boolean(
     session?.email && sameOwnerEmail(session.email, recording.ownerEmail),
   );
+  const scopedRecordingId = getRecordingAccessTokenResourceId(
+    recording.id,
+    recording.password,
+    recording.sharePasswordVersion,
+  );
   const suppliedToken = options.token ?? "";
   const tokenAccess = suppliedToken
     ? verifyScopedAgentAccessToken(suppliedToken, {
         resourceKind: CLIP_AGENT_ACCESS_TOKEN_PREFIX,
-        resourceId: recording.id,
+        resourceId: scopedRecordingId,
       })
     : null;
   const tokenAllowsAgentAccess = Boolean(tokenAccess?.ok);
@@ -346,7 +354,7 @@ export async function loadPublicAgentAccess(
   ) {
     apiToken = signScopedAgentAccessToken({
       resourceKind: CLIP_AGENT_ACCESS_TOKEN_PREFIX,
-      resourceId: recording.id,
+      resourceId: scopedRecordingId,
       ttlSeconds: CLIPS_AGENT_ACCESS_TTL_SECONDS,
     });
   }
@@ -363,7 +371,7 @@ export async function loadPublicAgentAccess(
       allowed = true;
       apiToken = signScopedAgentAccessToken({
         resourceKind: CLIP_AGENT_ACCESS_TOKEN_PREFIX,
-        resourceId: recording.id,
+        resourceId: scopedRecordingId,
         ttlSeconds: CLIPS_AGENT_ACCESS_TTL_SECONDS,
       });
     }

package/corpus/templates/clips/server/lib/share-password.ts

@@ -55,3 +55,28 @@ export function verifySharePassword(
   const b = createHash("sha256").update(expected, "utf8").digest();
   return timingSafeEqual(a, b);
 }
+
+export function getRecordingAccessTokenResourceId(
+  recordingId: string,
+  storedPassword: string | null | undefined,
+  sharePasswordVersion: string | null | undefined,
+): string {
+  if (
+    sharePasswordVersion === "initial" ||
+    sharePasswordVersion?.startsWith("legacy:")
+  ) {
+    // Keep pre-version grants and grants from older writers valid until a password mutation.
+    return recordingId;
+  }
+
+  // Encrypted passwords scope grants to the ciphertext; other rows use the dedicated version.
+  const versionSource =
+    storedPassword && isEncryptedSecretValue(storedPassword)
+      ? storedPassword
+      : sharePasswordVersion;
+  if (!versionSource) {
+    throw new Error("Recording access scope requires a password version");
+  }
+  const version = createHash("sha256").update(versionSource).digest("hex");
+  return `${recordingId}:access:${version}`;
+}

package/corpus/templates/clips/server/plugins/db.ts

@@ -1117,6 +1117,42 @@ export const migrations = runMigrations(
       name: "recording-failure-backfill-completion",
       sql: `ALTER TABLE clips_backfill_leases ADD COLUMN IF NOT EXISTS completed_at TEXT`,
     },
+    {
+      version: 77,
+      name: "recording-share-password-version",
+      // guard:allow-unscoped — initializes each row from its existing token scope.
+      // Keep the DDL atomic; the migration runner splits SQL on semicolons.
+      sql: `
+        DO 'BEGIN
+          EXECUTE ''ALTER TABLE recordings ADD COLUMN IF NOT EXISTS share_password_version TEXT'';
+          EXECUTE ''UPDATE recordings
+            SET share_password_version = ''''legacy:'''' || updated_at
+            WHERE share_password_version IS NULL'';
+          EXECUTE ''ALTER TABLE recordings ALTER COLUMN share_password_version SET DEFAULT ''''initial'''''';
+          EXECUTE ''ALTER TABLE recordings ALTER COLUMN share_password_version SET NOT NULL'';
+          EXECUTE format(
+            ''CREATE OR REPLACE FUNCTION public.clips_recordings_rotate_share_password_version()
+              RETURNS trigger
+              LANGUAGE plpgsql
+              AS %L'',
+            $function$BEGIN
+              IF NEW.password IS DISTINCT FROM OLD.password THEN
+                NEW.share_password_version := ''password-change:'' || COALESCE(NEW.share_password_version, OLD.share_password_version, ''initial'');
+              END IF;
+              RETURN NEW;
+            END;$function$
+          );
+          BEGIN
+            EXECUTE ''CREATE TRIGGER clips_recordings_rotate_share_password_version
+              BEFORE UPDATE OF password ON public.recordings
+              FOR EACH ROW
+              EXECUTE FUNCTION public.clips_recordings_rotate_share_password_version()'';
+          EXCEPTION WHEN duplicate_object THEN
+            NULL;
+          END;
+        END';
+      `,
+    },
   ],
   { table: "clips_migrations" },
 );

package/corpus/templates/clips/server/routes/[...page].get.ts

@@ -29,6 +29,7 @@ import {
   queryString,
 } from "../lib/public-agent-context.js";
 import { isRecordingExpiredForViewer } from "../lib/recording-page-access.js";
+import { getRecordingAccessTokenResourceId } from "../lib/share-password.js";
 
 const ssrHandler = createH3SSRHandler(
   () => import("virtual:react-router/server-build"),
@@ -86,6 +87,8 @@ async function buildClipAgentDiscovery(event: H3Event): Promise<{
       id: schema.recordings.id,
       title: schema.recordings.title,
       status: schema.recordings.status,
+      updatedAt: schema.recordings.updatedAt,
+      sharePasswordVersion: schema.recordings.sharePasswordVersion,
       visibility: schema.recordings.visibility,
       password: schema.recordings.password,
       expiresAt: schema.recordings.expiresAt,
@@ -113,7 +116,11 @@ async function buildClipAgentDiscovery(event: H3Event): Promise<{
   const tokenGrantsAgentAccess = suppliedToken
     ? verifyScopedAgentAccessToken(suppliedToken, {
         resourceKind: CLIP_AGENT_ACCESS_TOKEN_PREFIX,
-        resourceId: recording.id,
+        resourceId: getRecordingAccessTokenResourceId(
+          recording.id,
+          recording.password,
+          recording.sharePasswordVersion,
+        ),
       }).ok
     : false;
   const anonymousAccess =

package/corpus/templates/clips/server/routes/api/public-recording.get.ts

@@ -49,7 +49,10 @@ import {
   type RecordingVisibility,
 } from "../../lib/recordings.js";
 import { isSeekableRepairPending } from "../../lib/seekable-media-state.js";
-import { verifySharePassword } from "../../lib/share-password.js";
+import {
+  getRecordingAccessTokenResourceId,
+  verifySharePassword,
+} from "../../lib/share-password.js";
 import { hydrateCommentAuthorNames } from "../../lib/user-identities.js";
 
 function appPath(path: string): string {
@@ -95,9 +98,15 @@ function isHttpsRequest(event: H3Event): boolean {
 function setProtectedMediaAccessCookie(
   event: H3Event,
   recordingId: string,
+  password: string | null | undefined,
+  sharePasswordVersion: string | null | undefined,
 ): string {
   const token = signShortLivedToken({
-    resourceId: recordingId,
+    resourceId: getRecordingAccessTokenResourceId(
+      recordingId,
+      password,
+      sharePasswordVersion,
+    ),
     ttlSeconds: PROTECTED_MEDIA_ACCESS_TTL_SECONDS,
   });
   const secure = isHttpsRequest(event);
@@ -213,7 +222,11 @@ export default defineEventHandler(async (event) => {
   const tokenAllowsAgentAccess = suppliedAgentAccessToken
     ? verifyScopedAgentAccessToken(suppliedAgentAccessToken, {
         resourceKind: CLIP_AGENT_ACCESS_TOKEN_PREFIX,
-        resourceId: rec.id,
+        resourceId: getRecordingAccessTokenResourceId(
+          rec.id,
+          rec.password,
+          rec.sharePasswordVersion,
+        ),
       }).ok
     : false;
 
@@ -294,9 +307,19 @@ export default defineEventHandler(async (event) => {
         return { error: "Password required", passwordRequired: true };
       }
     }
-    protectedMediaToken = setProtectedMediaAccessCookie(event, recordingId);
+    protectedMediaToken = setProtectedMediaAccessCookie(
+      event,
+      recordingId,
+      rec.password,
+      rec.sharePasswordVersion,
+    );
   } else if (tokenAllowsAgentAccess && !viewerIsOwner) {
-    protectedMediaToken = setProtectedMediaAccessCookie(event, recordingId);
+    protectedMediaToken = setProtectedMediaAccessCookie(
+      event,
+      recordingId,
+      rec.password,
+      rec.sharePasswordVersion,
+    );
   }
 
   const [transcript] = await db
@@ -405,7 +428,11 @@ export default defineEventHandler(async (event) => {
       : canExposeAgentContext && rec.password
         ? signScopedAgentAccessToken({
             resourceKind: CLIP_AGENT_ACCESS_TOKEN_PREFIX,
-            resourceId: recordingId,
+            resourceId: getRecordingAccessTokenResourceId(
+              recordingId,
+              rec.password,
+              rec.sharePasswordVersion,
+            ),
           })
         : undefined;
   const agentContextUrl = canExposeAgentContext

package/corpus/templates/clips/server/routes/api/thumbnail/[recordingId].get.ts

@@ -30,7 +30,10 @@ import {
 } from "../../../lib/pending-redactions.js";
 import { isRecordingExpiredForViewer } from "../../../lib/recording-page-access.js";
 import { getOrganizationRoleForEmail } from "../../../lib/recordings.js";
-import { verifySharePassword } from "../../../lib/share-password.js";
+import {
+  getRecordingAccessTokenResourceId,
+  verifySharePassword,
+} from "../../../lib/share-password.js";
 
 const FETCH_TIMEOUT_MS = 30_000;
 const PROTECTED_MEDIA_ACCESS_TTL_SECONDS = 6 * 60 * 60;
@@ -53,6 +56,8 @@ type ThumbnailRecording = {
   expiresAt?: string | null;
   organizationId?: string | null;
   password?: string | null;
+  sharePasswordVersion?: string | null;
+  updatedAt?: string | null;
   visibility?: string | null;
 };
 
@@ -79,9 +84,18 @@ function isHttpsRequest(event: H3Event): boolean {
   );
 }
 
-function renewProtectedMediaCookie(event: H3Event, recordingId: string): void {
+function renewProtectedMediaCookie(
+  event: H3Event,
+  recordingId: string,
+  password: string | null | undefined,
+  sharePasswordVersion: string | null | undefined,
+): void {
   const token = signShortLivedToken({
-    resourceId: recordingId,
+    resourceId: getRecordingAccessTokenResourceId(
+      recordingId,
+      password,
+      sharePasswordVersion,
+    ),
     ttlSeconds: PROTECTED_MEDIA_ACCESS_TTL_SECONDS,
   });
   const secure = isHttpsRequest(event);
@@ -211,6 +225,8 @@ async function loadRecording(recordingId: string, event: H3Event) {
         expiresAt: schema.recordings.expiresAt,
         organizationId: schema.recordings.organizationId,
         password: schema.recordings.password,
+        sharePasswordVersion: schema.recordings.sharePasswordVersion,
+        updatedAt: schema.recordings.updatedAt,
         visibility: schema.recordings.visibility,
       })
       .from(schema.recordings)
@@ -280,17 +296,29 @@ export default defineEventHandler(async (event: H3Event) => {
       if (recording.password && loaded.role !== "owner") {
         const queryToken = typeof query.t === "string" ? query.t : "";
         const cookieToken = getCookie(event, cookieName(recordingId)) ?? "";
+        const scopedRecordingId = getRecordingAccessTokenResourceId(
+          recordingId,
+          recording.password,
+          recording.sharePasswordVersion,
+        );
         const password =
           typeof query.password === "string" ? query.password : "";
         const allowed =
-          (queryToken && verifyShortLivedToken(queryToken, recordingId).ok) ||
-          (cookieToken && verifyShortLivedToken(cookieToken, recordingId).ok) ||
+          (queryToken &&
+            verifyShortLivedToken(queryToken, scopedRecordingId).ok) ||
+          (cookieToken &&
+            verifyShortLivedToken(cookieToken, scopedRecordingId).ok) ||
           (password && verifySharePassword(password, recording.password));
         if (!allowed) {
           setResponseStatus(event, 401);
           return { error: "Password required", passwordRequired: true };
         }
-        renewProtectedMediaCookie(event, recordingId);
+        renewProtectedMediaCookie(
+          event,
+          recordingId,
+          recording.password,
+          recording.sharePasswordVersion,
+        );
       }
 
       const sourceUrl =