@agent-native/core 0.69.0 → 0.70.1

package/corpus/templates/clips/desktop/src-tauri/src/lib.rs

@@ -68,6 +68,8 @@ pub fn run() {
             clips::hide_recording_chrome,
             clips::show_region_guides,
             clips::hide_region_guides,
+            clips::show_region_record_border,
+            clips::hide_region_record_border,
             clips::show_region_guide_editor,
             clips::show_region_capture_selector,
             clips::close_bubble,

package/corpus/templates/clips/desktop/src-tauri/src/util.rs

@@ -208,7 +208,10 @@ pub fn reapply_capture_exclusion_to_overlays(app: &tauri::AppHandle) {
                 set_window_capture_excluded(window, false);
                 continue;
             }
-            let private_guide = matches!(label.as_str(), "region-guides" | "region-guide-editor");
+            let private_guide = matches!(
+                label.as_str(),
+                "region-guides" | "region-guide-editor" | "region-record-border"
+            );
             set_window_capture_excluded(window, private_guide || !visible);
         }
     }

package/corpus/templates/clips/server/routes/api/video/[recordingId].get.ts

@@ -41,6 +41,7 @@ import {
   setCookie,
   type H3Event,
 } from "h3";
+import { eq } from "drizzle-orm";
 import { readAppState } from "@agent-native/core/application-state";
 import {
   createSsrfSafeDispatcher,
@@ -49,6 +50,7 @@ import {
 import { getOrgContext } from "@agent-native/core/org";
 import { resolveAccess } from "@agent-native/core/sharing";
 import {
+  captureRouteError,
   getSession,
   runWithRequestContext,
   signShortLivedToken,
@@ -61,6 +63,7 @@ import {
   loomEmbedUrlForRecording,
 } from "../../../../shared/loom.js";
 import { verifySharePassword } from "../../../lib/share-password.js";
+import { getDb, schema } from "../../../db/index.js";
 
 interface RecordingRow {
   expiresAt?: string | null;
@@ -300,12 +303,39 @@ export default defineEventHandler(async (event: H3Event) => {
   return runWithRequestContext(
     { userEmail: session?.email, orgId },
     async () => {
+      // Resolve via share grants first (owner / org / shared viewers). When
+      // there is no grant — e.g. an anonymous viewer on a public share/embed
+      // page — fall back to the public-visibility gate so public clips stay
+      // playable without signing in. This mirrors the visibility check in
+      // `/api/public-recording.get.ts` (which hands the player its videoUrl) so
+      // the metadata endpoint and this media endpoint never disagree about who
+      // can play a clip. Without this, anonymous viewers hit a 403 here and the
+      // player fails with "Could not start playback. Try again."
       const access = await resolveAccess("recording", recordingId);
-      if (!access) {
-        setResponseStatus(event, 403);
-        return { error: "Forbidden" };
+      let recRow: RecordingRow | null =
+        (access?.resource as RecordingRow | undefined) ?? null;
+      let role: string | null = access?.role ?? null;
+
+      if (!recRow) {
+        const db = getDb();
+        const [row] = await db
+          .select()
+          .from(schema.recordings)
+          .where(eq(schema.recordings.id, recordingId))
+          .limit(1);
+        if (!row) {
+          setResponseStatus(event, 404);
+          return { error: "Not found" };
+        }
+        if (row.visibility !== "public") {
+          setResponseStatus(event, 403);
+          return { error: "Forbidden" };
+        }
+        recRow = row as RecordingRow;
+        role = "viewer";
       }
-      const rec = access.resource as RecordingRow;
+
+      const rec = recRow;
 
       if (rec.expiresAt) {
         const expires = new Date(rec.expiresAt).getTime();
@@ -332,7 +362,7 @@ export default defineEventHandler(async (event: H3Event) => {
         password?: string;
         t?: string;
       };
-      if (rec.password && access.role !== "owner") {
+      if (rec.password && role !== "owner") {
         const token = typeof q.t === "string" ? q.t : "";
         const cookieToken =
           getCookie(event, protectedMediaCookieName(recordingId)) ?? "";
@@ -404,7 +434,56 @@ export default defineEventHandler(async (event: H3Event) => {
           setResponseStatus(event, upstream.status);
           return { error: upstream.error };
         }
-        return providerResponse(upstream);
+        // The provider answered, but with a server error (e.g. the CDN asset is
+        // broken and returns 5xx). Don't proxy an opaque upstream error — and
+        // don't risk reconstructing a Response from it, which previously threw
+        // and surfaced as an unhandled 500 on every request. Capture it so the
+        // broken asset is diagnosable, and return a clean 502.
+        if (upstream.status >= 500) {
+          captureRouteError(
+            new Error(
+              `Storage provider returned ${upstream.status} for recording media`,
+            ),
+            {
+              route: "api/video",
+              tags: {
+                mediaPath: "provider-proxy",
+                upstreamStatus: String(upstream.status),
+              },
+              extra: { recordingId },
+            },
+          );
+          setResponseStatus(event, 502);
+          setResponseHeader(
+            event,
+            "Cache-Control",
+            "private, max-age=0, no-store",
+          );
+          return {
+            error: "The recording's media could not be loaded from storage.",
+            upstreamStatus: upstream.status,
+          };
+        }
+        try {
+          return providerResponse(upstream);
+        } catch (err) {
+          // Reconstructing the proxied Response should not happen, but if it
+          // does, fail cleanly instead of as an unhandled 500.
+          captureRouteError(err, {
+            route: "api/video",
+            tags: { mediaPath: "provider-proxy-response" },
+            extra: { recordingId, upstreamStatus: String(upstream.status) },
+          });
+          setResponseStatus(event, 502);
+          setResponseHeader(
+            event,
+            "Cache-Control",
+            "private, max-age=0, no-store",
+          );
+          return {
+            error: "The recording's media could not be loaded from storage.",
+          };
+        }
       }
       const mimeType =
         typeof blob?.mimeType === "string" ? blob.mimeType : "video/webm";

package/corpus/templates/clips/shared/share-attribution.ts

@@ -0,0 +1,79 @@
+/**
+ * Viral attribution contract for shared Clips links.
+ *
+ * Shared clip URLs self-attribute so the signup funnel can be measured even
+ * when `document.referrer` is empty (desktop app, Slack, native clients, etc.).
+ * The framework captures first-touch from these params into a cookie and
+ * enriches the `signup` event; Clips' job is to (a) tag share/embed URLs and
+ * (b) emit funnel events from the public share page.
+ *
+ * Contract strings are centralized here so the minting side (share dialog) and
+ * the measuring side (public share page) cannot drift apart.
+ *
+ * Privacy: `via` must be a non-PII stable id (e.g. the owner's user id), never
+ * an email. Omit `via` rather than leak PII into a public URL or event.
+ */
+
+/** Fixed referral source for clip shares. */
+export const CLIP_SHARE_REF = "clip_share";
+
+/** Query param names that carry attribution. */
+export const REF_PARAM = "ref";
+export const VIA_PARAM = "via";
+
+/**
+ * Append `ref=clip_share` (and `via=<ownerId>` when a non-PII owner id is
+ * known) to an absolute share/embed URL, preserving any existing query params.
+ * Returns the input unchanged when it isn't a parseable absolute URL.
+ */
+export function withShareAttribution(
+  url: string,
+  ownerId?: string | null,
+): string {
+  if (!url) return url;
+  try {
+    const parsed = new URL(url);
+    parsed.searchParams.set(REF_PARAM, CLIP_SHARE_REF);
+    const owner = (ownerId ?? "").trim();
+    if (owner) parsed.searchParams.set(VIA_PARAM, owner);
+    return parsed.toString();
+  } catch {
+    return url;
+  }
+}
+
+export type ShareAttribution = {
+  ref: string | undefined;
+  via: string | undefined;
+};
+
+/**
+ * Read `ref`/`via` from a query string (e.g. `window.location.search`). Falls
+ * back to `ref=clip_share` so downstream attribution stays meaningful even when
+ * the visitor arrived via a link that lost the param.
+ */
+export function readShareAttribution(search: string): ShareAttribution {
+  let ref: string | undefined;
+  let via: string | undefined;
+  try {
+    const params = new URLSearchParams(search ?? "");
+    ref = params.get(REF_PARAM) ?? undefined;
+    via = params.get(VIA_PARAM) ?? undefined;
+  } catch {
+    // Ignore malformed query strings — fall through to the default below.
+  }
+  return { ref: ref || CLIP_SHARE_REF, via: via || undefined };
+}
+
+/**
+ * Build the attribution-forwarding signup path so attribution survives even if
+ * cookies are blocked. The framework also captures these params on the
+ * `/signup` page load.
+ */
+export function buildSignupAttributionQuery(via?: string | null): string {
+  const params = new URLSearchParams();
+  params.set(REF_PARAM, CLIP_SHARE_REF);
+  const owner = (via ?? "").trim();
+  if (owner) params.set(VIA_PARAM, owner);
+  return params.toString();
+}

package/corpus/templates/content/AGENTS.md

@@ -122,7 +122,8 @@ cd templates/content && pnpm action <name> [args]
 | `configure-document-property`               | `--documentId <id> [--id <propertyId>] --name <name> --type <type> [--visibility always_show\|hide_when_empty\|always_hide]`             | Create or update a property definition                                                                                                  |
 | `duplicate-document-property`               | `--documentId <id> --propertyId <propertyId>`                                                                                            | Duplicate a property definition and its stored values                                                                                   |
 | `delete-document-property`                  | `--documentId <id> --propertyId <propertyId>`                                                                                            | Delete a property definition and its stored values                                                                                      |
-| `set-document-property`                     | `--documentId <id> --propertyId <propertyId> --value <json>`                                                                             | Set a document property value                                                                                                           |
+| `set-document-property`                     | `--documentId <id> --propertyId <propertyId> --value <json>`                                                                             | Set a document property value (for a `blocks` field, the value is its markdown content)                                                 |
+| `reorder-document-property`                 | `--documentId <id> --propertyId <propertyId> --targetPropertyId <id> [--position before\|after]`                                         | Reorder a property definition within its database (used to reorder Blocks fields on the page)                                           |
 | `set-document-discoverability`              | `--id <id> --hideFromSearch true\|false [--includeChildren true\|false]`                                                                 | Hide/show an org-accessible document in Organization/search while keeping link access                                                   |
 | `move-document`                             | `--id <id> [--parentId] [--position]`                                                                                                    | Move or reorder a document in the page tree                                                                                             |
 | `delete-document`                           | `--id <id>`                                                                                                                              | Delete with recursive children                                                                                                          |
@@ -413,10 +414,26 @@ Document properties are SQL-backed, Notion-style structured metadata rather
 than YAML embedded in the markdown body. Database property definitions support
 `text`, `number`, `select`, `multi_select`, `status`, `date`, `person`,
 `place`, `files_media` (`Files & media`), `checkbox`, `url`, `email`,
-`phone`, plus computed `formula`, `id`, `created_time`, `created_by`, and
+`phone`, `blocks` (Capacities-style rich-text body field), plus computed
+`formula`, `id`, `created_time`, `created_by`, and
 `last_edited_time`, `last_edited_by`, plus property visibility (`always_show`,
 `hide_when_empty`, `always_hide`). The value table stores per-row-document JSON
-values. Formula properties store their expression in property options and support
+values.
+
+**Blocks fields.** A `blocks` field is independent rich-text content per row —
+NOT YAML and NOT a pointer to the body. Every database is seeded with one
+primary "Content" Blocks field whose content is backed by `documents.content`
+(so it reuses the collaborative TipTap/Yjs body editor and existing data
+migrates for free). Each additional Blocks field stores its own content in
+`document_block_field_contents`, keyed by `(document_id, property_id)`, so no
+two Blocks fields ever share content — adding a second Blocks field creates a
+new, empty, independent field. On the page: one Blocks field renders chromeless
+(no header, just the body); two or more each show their name as a header and are
+collapsible and reorderable (the surviving lone field keeps its stored name).
+In table views a Blocks column shows a word count (e.g. "412 words"), not the
+body. A Blocks field can only be deleted from the database view's column menu
+(not from the page body); deleting the last Blocks field warns that it removes
+the body for every object of the type. Formula properties store their expression in property options and support
 `{Property name}` substitution plus simple numeric math such as `{MSV} * 2`.
 Database views support multiple named table, list, gallery, board, calendar, and timeline views saved in
 `content_databases.view_config_json`. Each view has its own stacked sorts,

package/corpus/templates/content/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+All notable user-facing changes to Agent-Native Content are documented here. Open it any
+time from the command menu (Cmd+K → "What's new").
+
+## 2026-06-23
+
+### Added
+
+- See what's new right inside Agent-Native Content — a changelog now lives in the command menu (Cmd+K).

package/corpus/templates/content/actions/_database-utils.ts

@@ -123,6 +123,10 @@ export async function getContentDatabaseResponse(
 
   if (!database) throw new Error(`Database "${databaseId}" not found`);
 
+  // PURE read: the primary "Content" Blocks field is seeded at create time and
+  // by the one-time startup repair — never here. Reading a database (including a
+  // shared one a viewer is opening) must not mutate schema.
+
   const { limit, offset } = normalizeContentDatabasePageOptions(options);
   const [itemCount] = await db
     .select({ count: sql<number>`COUNT(*)` })
@@ -261,6 +265,11 @@ export async function deleteDatabaseDataForDocument(
       await db
         .delete(schema.documentPropertyValues)
         .where(eq(schema.documentPropertyValues.propertyId, definition.id));
+      // Independent Blocks-field content is keyed by property id; drop it so
+      // deleting a database leaves no orphaned document_block_field_contents.
+      await db
+        .delete(schema.documentBlockFieldContents)
+        .where(eq(schema.documentBlockFieldContents.propertyId, definition.id));
     }
     const sources = await db
       .select({ id: schema.contentDatabaseSources.id })
@@ -309,6 +318,12 @@ export async function deleteDatabaseDataForDocument(
           eq(schema.documentPropertyValues.ownerEmail, ownerEmail),
         ),
       );
+    // A deleted row document's independent Blocks-field content is keyed by
+    // document id; drop it so no document_block_field_contents rows are
+    // orphaned when the row is removed.
+    await db
+      .delete(schema.documentBlockFieldContents)
+      .where(eq(schema.documentBlockFieldContents.documentId, documentId));
     await db
       .delete(schema.contentDatabaseItems)
       .where(eq(schema.contentDatabaseItems.documentId, documentId));