@agent-native/core 0.85.6 → 0.86.0

package/corpus/core/src/org/context.ts

@@ -60,6 +60,49 @@ export async function getOrgContext(event: H3Event): Promise<OrgContext> {
   return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));
 }
 
+type MembershipRow = { orgId: string; role: OrgRole; orgName: string };
+
+const MEMBERSHIPS_CACHE_KEY = "__anOrgMembershipsCache";
+
+/**
+ * Per-request memoization of the org_members lookup, keyed by email on
+ * `event.context`. Both the session org backfill (inside `getSession`) and
+ * `getOrgContext` need the membership rows; without sharing, every request
+ * whose session lacks an orgId pays the query twice.
+ */
+function loadMembershipsForEvent(
+  event: H3Event,
+  exec: ReturnType<typeof getDbExec>,
+  email: string,
+): Promise<MembershipRow[] | null> {
+  const ctx = event.context as Record<string, unknown>;
+  const cache = ((ctx[MEMBERSHIPS_CACHE_KEY] as
+    | Map<string, Promise<MembershipRow[] | null>>
+    | undefined) ??
+    (ctx[MEMBERSHIPS_CACHE_KEY] = new Map<
+      string,
+      Promise<MembershipRow[] | null>
+    >())) as Map<string, Promise<MembershipRow[] | null>>;
+  let promise = cache.get(email);
+  if (!promise) {
+    promise = loadMemberships(exec, email);
+    cache.set(email, promise);
+  }
+  return promise;
+}
+
+function updateMembershipsForEvent(
+  event: H3Event,
+  email: string,
+  memberships: MembershipRow[] | null,
+): void {
+  const ctx = event.context as Record<string, unknown>;
+  const cache = ctx[MEMBERSHIPS_CACHE_KEY] as
+    | Map<string, Promise<MembershipRow[] | null>>
+    | undefined;
+  cache?.set(email, Promise.resolve(memberships));
+}
+
 async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
   const session = await getSession(event);
   const email = session?.email;
@@ -72,7 +115,7 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
 
   const exec = getDbExec();
 
-  let memberships = await loadMemberships(exec, email);
+  let memberships = await loadMembershipsForEvent(event, exec, email);
   if (memberships === null) {
     if (sessionOrgId) {
       return {
@@ -118,7 +161,10 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
     });
     if (joined.joined.length > 0) {
       const refreshed = await loadMemberships(exec, email);
-      if (refreshed !== null) memberships = refreshed;
+      if (refreshed !== null) {
+        memberships = refreshed;
+        updateMembershipsForEvent(event, email, refreshed);
+      }
     }
 
     if (joined.activeOrgId) {
@@ -230,6 +276,37 @@ export async function resolveOrgIdForEmail(
   }
 }
 
+/**
+ * Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.
+ * Shares the per-request membership lookup with `getOrgContext`, so the
+ * session org backfill inside `getSession` and a later `getOrgContext` call
+ * in the same request pay ONE org_members round trip, not two.
+ */
+export async function resolveOrgIdForEmailViaEvent(
+  event: H3Event,
+  email: string,
+): Promise<string | null> {
+  try {
+    const exec = getDbExec();
+    if (!exec) return null;
+    const memberships = await loadMembershipsForEvent(event, exec, email);
+    if (!memberships || memberships.length === 0) return null;
+    if (memberships.length === 1) return memberships[0].orgId;
+    const activeOrgSetting = (await getUserSetting(email, "active-org-id")) as {
+      orgId: string;
+    } | null;
+    if (
+      activeOrgSetting?.orgId &&
+      memberships.some((m) => m.orgId === activeOrgSetting.orgId)
+    ) {
+      return activeOrgSetting.orgId;
+    }
+    return memberships[0].orgId;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Create a new organization and add the caller as a member with the given
  * role. Generates a per-org A2A secret for cross-app delegation and writes

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -7750,16 +7750,20 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // queued messages durable across reloads without piggybacking
             // on full-thread saves.
             if (method === "POST" && isThreadSubroute("queued")) {
-              const thread = await getThread(threadId);
-              if (!thread || thread.ownerEmail !== owner) {
-                setResponseStatus(event, 404);
-                return { error: "Thread not found" };
-              }
               const body = await readBody(event);
               const queued = Array.isArray(body?.queuedMessages)
                 ? body.queuedMessages
                 : [];
-              await setThreadQueuedMessages(threadId, queued);
+              // Ownership is checked inside setThreadQueuedMessages (under
+              // the thread-data lock) — no separate getThread pre-read on
+              // this debounced hot path.
+              const saved = await setThreadQueuedMessages(threadId, queued, {
+                ownerEmail: owner,
+              });
+              if (!saved) {
+                setResponseStatus(event, 404);
+                return { error: "Thread not found" };
+              }
               return { ok: true };
             }
 

package/corpus/core/src/server/auth-marketing.ts

@@ -155,16 +155,6 @@ export const BUILT_IN_AUTH_MARKETING: Record<string, AuthMarketingContent> = {
       "Use the built-in app-agent loop or plug in your own agent backend",
     ],
   },
-  videos: {
-    appName: "Agent-Native Videos",
-    tagline:
-      "Your AI agent builds, animates, and refines programmatic videos alongside you.",
-    features: [
-      "Generate animated components and compositions from a description",
-      "Fine-tune tracks, keyframes, and easing without touching code",
-      "Camera moves, interactive elements, and effects the agent wires for you",
-    ],
-  },
 };
 
 const SLUG_ALIASES: Record<string, string> = {
@@ -174,7 +164,6 @@ const SLUG_ALIASES: Record<string, string> = {
   asset: "assets",
   image: "assets",
   images: "assets",
-  video: "videos",
 };
 
 function cloneMarketing(marketing: AuthMarketingContent): AuthMarketingContent {

package/corpus/core/src/server/auth.ts

@@ -2131,10 +2131,17 @@ function mapBetterAuthSession(baSession: {
  * org is active.
  *
  */
-async function backfillSessionOrg(session: AuthSession): Promise<AuthSession> {
+async function backfillSessionOrg(
+  session: AuthSession,
+  event: H3Event,
+): Promise<AuthSession> {
   if (session.orgId) return session;
-  const { resolveOrgIdForEmail } = await import("../org/context.js");
-  const orgId = await resolveOrgIdForEmail(session.email).catch(() => null);
+  // Event-aware variant: shares the per-request org_members lookup with
+  // getOrgContext so one request never pays the membership query twice.
+  const { resolveOrgIdForEmailViaEvent } = await import("../org/context.js");
+  const orgId = await resolveOrgIdForEmailViaEvent(event, session.email).catch(
+    () => null,
+  );
   return orgId ? { ...session, orgId } : session;
 }
 
@@ -2166,7 +2173,7 @@ export async function getSession(event: H3Event): Promise<AuthSession | null> {
   };
   return (ctx.__anSessionCache ??= (async () => {
     const session = await resolveSessionUncached(event);
-    return session?.email ? backfillSessionOrg(session) : session;
+    return session?.email ? backfillSessionOrg(session, event) : session;
   })());
 }
 

package/corpus/core/src/server/collab-plugin.ts

@@ -45,6 +45,13 @@ type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
 /** Default maximum body size in bytes for collab write operations (2 MB). */
 const DEFAULT_MAX_PAYLOAD_BYTES = 2 * 1024 * 1024;
 
+type CollabAwarenessScope = {
+  owner?: string;
+  orgId?: string;
+  resourceType?: string;
+  resourceId?: string;
+};
+
 /**
  * Whether the no-resourceType warning has already been logged once per server
  * process. Avoids flooding logs on every request in templates that deliberately
@@ -111,16 +118,17 @@ export function createCollabPlugin(
     // Security: when resourceType is configured, resolve the resource's
     // owner/org so getChangesSinceForUser can scope delivery. We use
     // resolveAccess to obtain the resource row — it already handles ownership,
-    // visibility, and share rows. Rather than trying to enumerate every sharee
-    // (which would require querying the shares table for every update), the
-    // conservative strategy is:
-    //   • tag the event with the resource owner's email and org (owner-scoped).
-    //   • non-owner sharees who have explicit viewer+ access will NOT receive
-    //     the push event; they fall back to the state-vector catch-up via the
-    //     poll loop.  This is safe (never delivers to someone without access)
-    //     at the cost of sharees seeing slightly higher latency (state-vector
-    //     fetch on the next poll cycle) rather than the push path.
-    // See also: SECURITY comment in poll.ts on getChangesSinceForUser.
+    // visibility, and share rows. In addition to the owner/org tags we also
+    // tag the event with `resourceType` + `resourceId` so the per-user
+    // delivery filter (canSeeChangeForUser) can evaluate resource access
+    // directly for non-owner sharees:
+    //   • tag the event with the resource owner's email and org (owner-scoped)
+    //     for backward compatibility with the conservative owner/org fast path.
+    //   • ALSO tag with resourceType/resourceId so canSeeChangeForUser can run
+    //     an access-aware (cached) check and push to explicit viewer+ sharees
+    //     who don't match owner/org — instead of only degrading them to the
+    //     poll fallback.
+    // See also: SECURITY comment in poll.ts on canSeeChangeForUser.
     if (!resourceType && !_unscoped_warning_logged) {
       _unscoped_warning_logged = true;
       console.warn(
@@ -180,12 +188,15 @@ export function createCollabPlugin(
         const orgId =
           typeof resource.orgId === "string" ? resource.orgId : undefined;
 
-        // Tag the event with owner/org. Non-owner sharees fall back to poll;
-        // this is acceptable (see comment above).
+        // Tag the event with owner/org (backward-compat fast path) AND with
+        // resourceType/resourceId so canSeeChangeForUser can run an
+        // access-aware check for non-owner sharees (see poll.ts).
         recordChange({
           ...event,
           ...(ownerEmail ? { owner: ownerEmail } : {}),
           ...(orgId ? { orgId } : {}),
+          resourceType,
+          resourceId,
         });
       } catch {
         // If we fail to resolve the resource (DB not ready, etc.) we skip
@@ -244,7 +255,25 @@ export function createCollabPlugin(
 
             if (isWrite) {
               // assertAccess throws ForbiddenError (→ 403) if no editor access
-              await assertAccess(resourceType, resourceId, "editor");
+              const access = await assertAccess(
+                resourceType,
+                resourceId,
+                "editor",
+              );
+              const resource = access.resource as Record<string, unknown>;
+              const awarenessScope: CollabAwarenessScope = {
+                resourceType,
+                resourceId,
+                ...(typeof resource.ownerEmail === "string"
+                  ? { owner: resource.ownerEmail }
+                  : {}),
+                ...(typeof resource.orgId === "string"
+                  ? { orgId: resource.orgId }
+                  : {}),
+              };
+              if (event.context) {
+                event.context._collabAwarenessScope = awarenessScope;
+              }
             } else {
               // resolveAccess returns null when no access; return 404 to avoid leaking existence
               const access = await resolveAccess(resourceType, resourceId);
@@ -252,6 +281,20 @@ export function createCollabPlugin(
                 setResponseStatus(event, 404);
                 return { error: "Not found" };
               }
+              const resource = access.resource as Record<string, unknown>;
+              const awarenessScope: CollabAwarenessScope = {
+                resourceType,
+                resourceId,
+                ...(typeof resource.ownerEmail === "string"
+                  ? { owner: resource.ownerEmail }
+                  : {}),
+                ...(typeof resource.orgId === "string"
+                  ? { orgId: resource.orgId }
+                  : {}),
+              };
+              if (event.context) {
+                event.context._collabAwarenessScope = awarenessScope;
+              }
             }
           }
 

package/corpus/core/src/server/design-token-utils.ts

@@ -4,7 +4,7 @@
  * Pure functions for parsing Tailwind configs, CSS files, package.json,
  * documents, and URLs to extract colors, fonts, spacing, border-radius,
  * and CSS custom properties. Used by the import-* actions across all
- * templates (design, slides, videos).
+ * templates (design and slides).
  *
  * No framework dependencies — no defineAction, no zod, no drizzle.
  */