@agent-native/core 0.99.1 → 0.99.2

package/corpus/templates/analytics/server/lib/error-capture.ts

@@ -18,7 +18,6 @@ import { fileURLToPath } from "node:url";
  * reads go through `accessFilter` so an org-scoped key surfaces its issues to
  * the whole org exactly like session recordings.
  */
-import { appStateGet } from "@agent-native/core/application-state";
 import { notifyWithDelivery } from "@agent-native/core/notifications";
 import { recordChange } from "@agent-native/core/server";
 import { accessFilter } from "@agent-native/core/sharing";
@@ -1099,56 +1098,6 @@ export interface ListErrorIssuesFilters {
   limit?: number;
 }
 
-export const ERROR_REPORTING_ANONYMOUS_EMAIL = "anonymous@builder.io";
-const ERROR_REPORTING_EMAIL_PATTERN = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
-
-/**
- * Error reports contain emails in identity fields, messages, stacks, URLs,
- * tags, extra context, and breadcrumbs. Redact every string at this owning
- * read seam so demo mode never depends on browser interception timing.
- */
-export function anonymizeErrorReportingEmails<T>(value: T): T {
-  if (typeof value === "string") {
-    return value.replace(
-      ERROR_REPORTING_EMAIL_PATTERN,
-      ERROR_REPORTING_ANONYMOUS_EMAIL,
-    ) as T;
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => anonymizeErrorReportingEmails(item)) as T;
-  }
-  if (value && typeof value === "object") {
-    if (value instanceof Date) return value;
-    const output: Record<string, unknown> = {};
-    for (const [key, entry] of Object.entries(value)) {
-      output[key] = anonymizeErrorReportingEmails(entry);
-    }
-    return output as T;
-  }
-  return value;
-}
-
-async function isErrorDemoModeEnabled(
-  userEmail?: string | null,
-): Promise<boolean> {
-  if (process.env.DEMO_MODE === "true") return true;
-  if (!userEmail) return false;
-  try {
-    // Keep demo state tied to the caller whose issues are being read.
-    const state = await appStateGet(userEmail, "demo-mode");
-    return state?.enabled === true;
-  } catch {
-    return false;
-  }
-}
-
-function anonymizeErrorReportingEmailsInDemoMode<T>(
-  value: T,
-  enabled: boolean,
-): T {
-  return enabled ? anonymizeErrorReportingEmails(value) : value;
-}
-
 export interface ErrorIssueSummary {
   id: string;
   fingerprint: string;
@@ -1221,7 +1170,6 @@ export async function listErrorIssues(
   scope: ErrorReadScope,
   filters: ListErrorIssuesFilters = {},
 ): Promise<ErrorIssueSummary[]> {
-  const demoModeEnabled = isErrorDemoModeEnabled(scope.userEmail);
   const db = getDb() as any;
   const limit = Math.min(
     MAX_ISSUE_LIMIT,
@@ -1312,7 +1260,7 @@ export async function listErrorIssues(
     template: row.template ?? null,
     sparkline: sparklines.get(row.id) ?? new Array(SPARKLINE_DAYS).fill(0),
   }));
-  return anonymizeErrorReportingEmailsInDemoMode(issues, await demoModeEnabled);
+  return issues;
 }
 
 export interface ErrorEventDetail {
@@ -1404,7 +1352,6 @@ export async function getErrorIssue(
   issueId: string,
   options: { eventsLimit?: number } = {},
 ): Promise<ErrorIssueDetail> {
-  const demoModeEnabled = isErrorDemoModeEnabled(scope.userEmail);
   const db = getDb() as any;
   const [issueRow] = await db
     .select()
@@ -1530,14 +1477,11 @@ export async function getErrorIssue(
     sparkline: sparklines.get(issueId) ?? new Array(SPARKLINE_DAYS).fill(0),
   };
 
-  return anonymizeErrorReportingEmailsInDemoMode(
-    {
-      issue,
-      events,
-      sessions: Array.from(sessions.values()),
-    },
-    await demoModeEnabled,
-  );
+  return {
+    issue,
+    events,
+    sessions: Array.from(sessions.values()),
+  };
 }
 
 export interface UpdateErrorIssueInput {

package/corpus/templates/analytics/server/lib/first-party-metric-catalog.ts

@@ -163,6 +163,7 @@ const DASHBOARD_WAU_BASE_RANGE_FILTER = dashboardLookbackTimeRangeFilter(
 );
 const DASHBOARD_EMAIL_FILTER =
   "('{{emailFilter}}' IN ('', 'all') OR ('{{emailFilter}}' = 'exclude_builder' AND lower(coalesce(user_id, '')) NOT LIKE '%@builder.io') OR ('{{emailFilter}}' = 'only_builder' AND lower(coalesce(user_id, '')) LIKE '%@builder.io'))";
+const SESSION_STATUS_FILTER = `event_name = 'session status' AND ${DASHBOARD_TIME_RANGE_FILTER} AND ${DASHBOARD_EMAIL_FILTER}`;
 const SIGNED_IN_ACTIVITY_KEY_SQL = USER_KEY_SQL;
 const SIGNED_IN_ACTIVITY_FILTER = `event_name = 'session status' AND signed_in = 'true' AND ${SIGNED_IN_ACTIVITY_KEY_SQL} IS NOT NULL`;
 const SIGNED_IN_PRODUCT_ACTIVITY_FILTER = `${SIGNED_IN_ACTIVITY_FILTER} AND ${PRODUCT_ACTIVITY_TEMPLATE_FILTER}`;
@@ -292,7 +293,7 @@ const ENTRIES: FirstPartyMetric[] = [
     width: 2,
     windowed: false,
     buildSql: fixed(
-      "SELECT COALESCE(NULLIF(app, ''), 'unknown') AS app, COUNT(*) AS count FROM analytics_events WHERE event_name = 'session status' GROUP BY COALESCE(NULLIF(app, ''), 'unknown') ORDER BY count DESC LIMIT 20",
+      `SELECT COALESCE(NULLIF(app, ''), 'unknown') AS app, COUNT(*) AS count FROM analytics_events WHERE ${SESSION_STATUS_FILTER} GROUP BY COALESCE(NULLIF(app, ''), 'unknown') ORDER BY count DESC LIMIT 20`,
     ),
     config: {
       xKey: "app",
@@ -310,7 +311,7 @@ const ENTRIES: FirstPartyMetric[] = [
     width: 1,
     windowed: false,
     buildSql: fixed(
-      `SELECT ${EVENT_DATE_SQL} AS date, COUNT(*) AS count FROM analytics_events WHERE event_name = 'session status' GROUP BY ${EVENT_DATE_SQL} ORDER BY date`,
+      `SELECT ${EVENT_DATE_SQL} AS date, COUNT(*) AS count FROM analytics_events WHERE ${SESSION_STATUS_FILTER} GROUP BY ${EVENT_DATE_SQL} ORDER BY date`,
     ),
     config: { xKey: "date", yKey: "count", color: "#10b981" },
   },
@@ -380,7 +381,7 @@ const ENTRIES: FirstPartyMetric[] = [
     width: 1,
     windowed: false,
     buildSql: fixed(
-      "SELECT COALESCE(NULLIF(signed_in, ''), 'unknown') AS signed_in, COUNT(*) AS count FROM analytics_events WHERE event_name = 'session status' GROUP BY COALESCE(NULLIF(signed_in, ''), 'unknown') ORDER BY signed_in",
+      `SELECT COALESCE(NULLIF(signed_in, ''), 'unknown') AS signed_in, COUNT(*) AS count FROM analytics_events WHERE ${SESSION_STATUS_FILTER} GROUP BY COALESCE(NULLIF(signed_in, ''), 'unknown') ORDER BY signed_in`,
     ),
     config: {
       xKey: "signed_in",
@@ -1007,14 +1008,28 @@ export function buildPanel(
     overrides.width <= 6
       ? overrides.width
       : metric.width;
+  const title =
+    overrides.title?.trim() ||
+    (window === "all"
+      ? metric.title.replace(/\(\d+d\)$/i, "(all-time)")
+      : metric.title);
+  const config = { ...metric.config };
+  if (metric.windowed) {
+    config.timeScope = window === "all" ? "all-time" : "fixed-window";
+    if (window === "all") {
+      const description =
+        typeof config.description === "string" ? config.description.trim() : "";
+      config.description = `${description ? `${description} ` : ""}This panel is explicitly configured for an all-time window.`;
+    }
+  }
   return {
     id: overrides.id?.trim() || metric.key,
-    title: overrides.title?.trim() || metric.title,
+    title,
     chartType: overrides.chartType?.trim() || metric.chartType,
     source: "first-party",
     width,
     sql: metric.buildSql(window),
     // Clone so callers can't mutate the shared catalog config object.
-    config: { ...metric.config },
+    config,
   };
 }

package/corpus/templates/analytics/server/lib/session-replay-agent-context.ts

@@ -663,7 +663,7 @@ export function resolveSessionReplayAgentAccess(
     resourceId: recordingId,
   });
   // Replay grants are always minted by an authenticated viewer. Fail closed
-  // for grants without that signed identity: demo-mode policy is viewer-scoped,
+  // for grants without that signed identity: access policy is viewer-scoped,
   // so guessing from the ambient request could expose identities to agents.
   if (!result.ok || !result.viewerEmail) return null;
   return { viewerEmail: result.viewerEmail };

package/corpus/templates/analytics/server/lib/session-replay.ts

@@ -2,7 +2,6 @@ import { Buffer } from "node:buffer";
 import { createHash, randomUUID } from "node:crypto";
 import { gzipSync, gunzipSync } from "node:zlib";
 
-import { appStateGet } from "@agent-native/core/application-state";
 import {
   deletePrivateBlob,
   putPrivateBlob,
@@ -258,8 +257,6 @@ const DEFAULT_REPLAY_MAX_REQUESTS_PER_MINUTE = 120;
 const RETENTION_DELETE_BATCH_SIZE = 500;
 const REPLAY_PRIVATE_BLOB_REF_KIND = "agent-native.session-replay.private-blob";
 const REPLAY_PRIVATE_BLOB_REF_VERSION = 1;
-const SESSION_DEMO_EMAIL_PATTERN = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
-const SESSION_DEMO_ANONYMOUS_EMAIL = "anonymous@builder.io";
 let inlineReplayFallbackWarned = false;
 
 function replayError(message: string, statusCode: number): Error {
@@ -297,89 +294,6 @@ function replayEmail(value: unknown): string | null {
   return raw && raw.includes("@") ? raw : null;
 }
 
-function normalizedEmail(value: unknown): string | null {
-  return replayEmail(value)?.toLowerCase() ?? null;
-}
-
-function isBuilderEmail(value: unknown): boolean {
-  return normalizedEmail(value)?.endsWith("@builder.io") === true;
-}
-
-async function isSessionDemoModeEnabled(
-  userEmail?: string | null,
-): Promise<boolean> {
-  if (process.env.DEMO_MODE === "true") return true;
-  if (!userEmail) return false;
-  try {
-    // These reads also run from custom routes and actions, so use the
-    // authenticated scope explicitly instead of ambient request state.
-    const state = await appStateGet(userEmail, "demo-mode");
-    return state?.enabled === true;
-  } catch {
-    return false;
-  }
-}
-
-function demoBuilderSessionCondition() {
-  return or(
-    sql`lower(${schema.sessionRecordings.userId}) like ${"%@builder.io"}`,
-    sql`lower(${schema.sessionRecordings.userKey}) like ${"%@builder.io"}`,
-  );
-}
-
-class SessionDemoAnonymizer {
-  aliasFor(value: unknown): string | null {
-    const raw = replayString(value);
-    if (!raw || raw.match(SESSION_DEMO_EMAIL_PATTERN)?.[0] !== raw) {
-      return null;
-    }
-    return SESSION_DEMO_ANONYMOUS_EMAIL;
-  }
-
-  summarize(row: any, role?: SessionReplayAccessRole): SessionRecordingSummary {
-    const summary = rowToSessionRecordingSummary(row, role);
-    return {
-      ...summary,
-      userId: this.aliasFor(row.userId) ?? summary.userId,
-      userKey: this.aliasFor(row.userKey) ?? summary.userKey,
-      ownerEmail: this.aliasFor(summary.ownerEmail) ?? summary.ownerEmail,
-      metadata: anonymizeEmailValue(summary.metadata, this) as Record<
-        string,
-        unknown
-      >,
-    };
-  }
-}
-
-function anonymizeEmailValue(
-  value: unknown,
-  anonymizer: SessionDemoAnonymizer,
-): unknown {
-  const alias = anonymizer.aliasFor(value);
-  if (alias) return alias;
-  if (Array.isArray(value)) {
-    return value.map((item) => anonymizeEmailValue(item, anonymizer));
-  }
-  if (typeof value === "string") {
-    return value.replace(SESSION_DEMO_EMAIL_PATTERN, (email) => {
-      return anonymizer.aliasFor(email) ?? email;
-    });
-  }
-  if (value && typeof value === "object") {
-    const out: Record<string, unknown> = {};
-    for (const [key, item] of Object.entries(value)) {
-      out[key] = anonymizeEmailValue(item, anonymizer);
-    }
-    return out;
-  }
-  return value;
-}
-
-function assertDemoVisibleSession(row: any): void {
-  if (isBuilderEmail(row.userId) || isBuilderEmail(row.userKey)) return;
-  throw replayError("Session recording not found", 404);
-}
-
 function replayInteger(value: unknown): number | null {
   if (typeof value === "number" && Number.isInteger(value)) return value;
   if (typeof value === "string" && /^-?\d+$/.test(value.trim())) {
@@ -1686,7 +1600,6 @@ export async function listSessionRecordings(
   filters: SessionReplayListFilters = {},
 ): Promise<SessionRecordingSummary[]> {
   const db = getDb() as any;
-  const demoMode = await isSessionDemoModeEnabled(scope.userEmail);
   const limit = Math.min(
     MAX_SESSION_RECORDINGS_LIMIT,
     Math.max(1, filters.limit ?? DEFAULT_SESSION_RECORDINGS_LIMIT),
@@ -1699,7 +1612,6 @@ export async function listSessionRecordings(
     replayVisibleIdentityCondition(),
     replayPlayableEventsCondition(),
   ];
-  if (demoMode) conditions.push(demoBuilderSessionCondition());
   if (filters.app)
     conditions.push(eq(schema.sessionRecordings.app, filters.app));
   if (filters.template) {
@@ -1753,22 +1665,13 @@ export async function listSessionRecordings(
     .where(and(...conditions))
     .orderBy(desc(schema.sessionRecordings.startedAt))
     .limit(limit);
-  if (!demoMode) {
-    return rows.map((row: any) => rowToSessionRecordingSummary(row));
-  }
-  const anonymizer = new SessionDemoAnonymizer();
-  return rows
-    .filter(
-      (row: any) => isBuilderEmail(row.userId) || isBuilderEmail(row.userKey),
-    )
-    .map((row: any) => anonymizer.summarize(row));
+  return rows.map((row: any) => rowToSessionRecordingSummary(row));
 }
 
 export async function getSessionReplaySummary(
   recordingId: string,
   scope: SessionReplayScope,
 ): Promise<SessionRecordingSummary> {
-  const demoMode = await isSessionDemoModeEnabled(scope.userEmail);
   const access = await resolveAccess("session-recording", recordingId, {
     userEmail: scope.userEmail,
     orgId: scope.orgId ?? undefined,
@@ -1777,22 +1680,15 @@ export async function getSessionReplaySummary(
   if (!isVisibleSessionRecording(access.resource)) {
     throw replayError("Session recording not found", 404);
   }
-  if (!demoMode) {
-    return rowToSessionRecordingSummary(access.resource, access.role);
-  }
-  assertDemoVisibleSession(access.resource);
-  return new SessionDemoAnonymizer().summarize(access.resource, access.role);
+  return rowToSessionRecordingSummary(access.resource, access.role);
 }
 
 export async function getSessionReplayTokenizedSummary(
   recordingId: string,
   viewerEmail: string,
 ): Promise<SessionRecordingSummary> {
-  // Tokenized reads often run without an authenticated request session. Use
-  // the viewer identity embedded in the signed, recording-scoped grant so a
-  // link minted while demo mode is enabled cannot reveal real identities when
-  // it is opened in a signed-out browser or by an external agent.
-  const demoMode = await isSessionDemoModeEnabled(viewerEmail);
+  // Tokenized reads often run without an authenticated request session. The
+  // viewer identity is still required by the signed, recording-scoped grant.
   const db = getDb() as any;
   // guard:allow-unscoped -- called only after verifySessionReplayAgentAccess(recordingId, token) verifies a signed, recording-scoped agent_access token.
   const [row] = await db
@@ -1803,9 +1699,7 @@ export async function getSessionReplayTokenizedSummary(
   if (!row || !isVisibleSessionRecording(row)) {
     throw replayError("Session recording not found", 404);
   }
-  if (!demoMode) return rowToSessionRecordingSummary(row, "viewer");
-  assertDemoVisibleSession(row);
-  return new SessionDemoAnonymizer().summarize(row, "viewer");
+  return rowToSessionRecordingSummary(row, "viewer");
 }
 
 function parseInlineReplayEvents(inlineData: string): unknown[] {

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -286,6 +286,7 @@ export default createAgentChatPlugin({
       analyticsSourceGuidanceOpening() +
       "DASHBOARD CREATION RULE — You may create dashboards, analyses, SQL panels, or other resources only when the user explicitly asks you to (e.g. 'build me a dashboard for...', 'create a new analysis', 'add a chart for...'). Never create any resource proactively during research, trend analysis, or answering questions. If you think a dashboard would be useful, suggest it and wait for explicit confirmation before creating anything. Never add new items to the sidebar or modify existing dashboards without an explicit user directive. " +
       "DASHBOARD MUTATION RULE — For dashboard edits, default to `mutate-dashboard` with the typed `dashboard.*` script API so the main payload is a string and avoids native-array serialization traps. It can move panels by id, edit titles/SQL/config, insert, duplicate, remove, and patch dashboard fields in one atomic save. The script API is constrained: no variables/imports/loops/functions, only JSON-compatible arguments on documented dashboard methods. Do not count shifting `/panels/<index>` positions for ordinary dashboard edits unless the user specifically asks for low-level JSON-pointer operations. " +
+      'FIRST-PARTY DASHBOARD TIME RULE — AI-generated `source: "first-party"` panels are dashboard-time-bound by default: set `config.timeScope` to `dashboard` and include a matching dashboard time predicate. `{{timeRange}}` requires a matching `filters` entry with `id: "timeRange"` and `type: "select"`; `{{<id>Start}}`/`{{<id>End}}` require a matching `type: "date-range"` filter with that id. Allowed `timeScope` values are `dashboard`, `fixed-window`, `cohort-history`, and `all-time`; use `all-time` only when the user requests full available history and put all-time, lifetime, or historical in the title or description. Server validation rejects unbound first-party SQL. ' +
       "DASHBOARD READ RULE — `get-sql-dashboard` is compact by default: use its `panels` summaries plus `layout.panelOrder`, `layout.firstPanelIds`, and `layout.groups[].rows[].rowNumber/panelIds` for orientation and verification. Pass `includeConfig: true` only when you truly need full panel SQL/config. " +
       'DASHBOARD REORDER RULE — For simple chart/section moves, use `mutate-dashboard` code such as `dashboard.panels(["panel-a","panel-b"]).moveToTop();`. For visible placement requests like "second row" or "next to return rates", use row-aware placement such as `dashboard.insertPanel({...}).nextTo("retention-over-time")`, `.atRow(2)`, or `dashboard.panel("panel-a").moveNextTo("panel-b")`; these keep panels in the intended rendered row and expand/rebalance that row when needed. Never count shifting `/panels/<index>` positions for ordinary \'move this chart\' requests. Use `get-sql-dashboard.layout.groups[].rows` as proof of visible row placement, not only flat `panelOrder`. ' +
       "Use configured data sources and actions only. Call `data-source-status` when you need to know which providers are connected, and treat provider actions as unavailable for analysis if they return missing credentials, permission, syntax, quota, or network errors. " +

package/corpus/templates/assets/app/routes/library.tsx

@@ -1339,13 +1339,12 @@ function AllAssetsBrowser() {
                   </div>
                 </button>
                 {(asset as any).libraryTitle ? (
-                  <button
-                    type="button"
-                    onClick={() => navigate(`/library/${asset.libraryId}`)}
+                  <Link
+                    to={`/library/${asset.libraryId}`}
                     className="absolute bottom-2 left-2 z-10 max-w-[calc(100%-1rem)] truncate rounded-full bg-background/95 px-2.5 py-1 text-[11px] font-medium shadow-sm transition hover:bg-background"
                   >
                     {(asset as any).libraryTitle}
-                  </button>
+                  </Link>
                 ) : null}
                 <TooltipProvider>
                   <Tooltip>

package/corpus/templates/assets/changelog/2026-07-13-internal-library-links-open-in-new-tabs.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-13
+---
+
+Internal library links now support opening in a new tab.

package/corpus/templates/calendar/app/pages/BookingLinksPage.tsx

@@ -48,7 +48,7 @@ import {
 } from "date-fns";
 import { nanoid } from "nanoid";
 import { useEffect, useMemo, useRef, useState } from "react";
-import { useNavigate, useSearchParams } from "react-router";
+import { Link, useNavigate, useSearchParams } from "react-router";
 import { toast } from "sonner";
 
 import { CloudUpgrade } from "@/components/CloudUpgrade";
@@ -915,12 +915,10 @@ export default function BookingLinksPage({
     toast.error(t("common.clipboardUnavailable"));
   }
 
-  function openPreview(slug: string) {
-    // For local preview, use the local path
-    const localPath = bookingUsername
+  function bookingPreviewPath(slug: string) {
+    return bookingUsername
       ? `/book/${bookingUsername}/${slug}`
       : `/book/${slug}`;
-    window.open(localPath, "_blank", "noopener,noreferrer");
   }
 
   const handleSaveRef = useRef(handleSave);
@@ -952,14 +950,13 @@ export default function BookingLinksPage({
     }
     return {
       left: (
-        <button
-          type="button"
-          onClick={() => navigate("/booking-links")}
+        <Link
+          to="/booking-links"
           className="flex items-center gap-1.5 text-sm text-muted-foreground hover:text-foreground"
         >
           <IconChevronLeft className="h-4 w-4" />
           {t("bookingLinks.back")}
-        </button>
+        </Link>
       ),
       right: selectedLink ? (
         <div className="flex items-center gap-1.5">
@@ -1008,14 +1005,19 @@ export default function BookingLinksPage({
             <Tooltip>
               <TooltipTrigger asChild>
                 <Button
-                  type="button"
+                  asChild
                   variant="ghost"
                   size="icon"
-                  onClick={() => openPreview(draft.slug)}
                   className={cn("h-8 w-8", BRAND_ICON_LINK_CLASS)}
                   aria-label={t("bookingLinks.openBookingLink")}
                 >
-                  <IconExternalLink className="h-4 w-4" />
+                  <a
+                    href={bookingPreviewPath(draft.slug)}
+                    target="_blank"
+                    rel="noopener noreferrer"
+                  >
+                    <IconExternalLink className="h-4 w-4" />
+                  </a>
                 </Button>
               </TooltipTrigger>
               <TooltipContent>{t("bookingLinks.openLink")}</TooltipContent>
@@ -1300,14 +1302,19 @@ export default function BookingLinksPage({
                     <Tooltip>
                       <TooltipTrigger asChild>
                         <Button
-                          type="button"
+                          asChild
                           variant="ghost"
                           size="icon"
-                          onClick={() => openPreview(draft.slug)}
                           className={cn("h-8 w-8", BRAND_ICON_LINK_CLASS)}
                           aria-label={t("bookingLinks.openBookingPageNewTab")}
                         >
-                          <IconExternalLink className="h-4 w-4" />
+                          <a
+                            href={bookingPreviewPath(draft.slug)}
+                            target="_blank"
+                            rel="noopener noreferrer"
+                          >
+                            <IconExternalLink className="h-4 w-4" />
+                          </a>
                         </Button>
                       </TooltipTrigger>
                       <TooltipContent>
@@ -1499,7 +1506,7 @@ export default function BookingLinksPage({
                   availability={availability ?? undefined}
                   bookingUrl={previewUrl}
                   onCopy={() => void copyPreviewUrl(draft.slug)}
-                  onOpen={() => openPreview(draft.slug)}
+                  openHref={bookingPreviewPath(draft.slug)}
                   onCollapse={() => setIsPreviewCollapsed(true)}
                 />
               )}
@@ -1597,9 +1604,8 @@ export default function BookingLinksPage({
                     >
                       <div className="flex flex-col gap-3 px-4 py-4 sm:flex-row sm:items-center sm:gap-4 sm:px-5">
                         {/* Info — clickable to edit */}
-                        <button
-                          type="button"
-                          onClick={() => navigate(`/booking-links/${link.id}`)}
+                        <Link
+                          to={`/booking-links/${link.id}`}
                           className="min-w-0 flex-1 text-left"
                         >
                           <div className="flex items-center gap-2">
@@ -1622,7 +1628,7 @@ export default function BookingLinksPage({
                               {availability.timezone}
                             </p>
                           )}
-                        </button>
+                        </Link>
 
                         {/* Actions */}
                         <div className="flex shrink-0 items-center gap-2">
@@ -1642,19 +1648,17 @@ export default function BookingLinksPage({
                                 <IconLink className="h-3.5 w-3.5" />
                                 {t("bookingLinks.copyLink")}
                               </button>
-                              <button
-                                type="button"
-                                onClick={(e) => {
-                                  e.stopPropagation();
-                                  openPreview(link.slug);
-                                }}
+                              <a
+                                href={bookingPreviewPath(link.slug)}
+                                target="_blank"
+                                rel="noopener noreferrer"
                                 className={cn(
                                   "flex h-9 w-9 items-center justify-center rounded-full border",
                                   BRAND_PILL_LINK_CLASS,
                                 )}
                               >
                                 <IconExternalLink className="h-4 w-4" />
-                              </button>
+                              </a>
                             </>
                           )}
 
@@ -1669,12 +1673,10 @@ export default function BookingLinksPage({
                               </button>
                             </DropdownMenuTrigger>
                             <DropdownMenuContent align="end">
-                              <DropdownMenuItem
-                                onClick={() =>
-                                  navigate(`/booking-links/${link.id}`)
-                                }
-                              >
-                                {t("eventForm.edit")}
+                              <DropdownMenuItem asChild>
+                                <Link to={`/booking-links/${link.id}`}>
+                                  {t("eventForm.edit")}
+                                </Link>
                               </DropdownMenuItem>
                               <DropdownMenuItem
                                 onClick={() => {
@@ -1949,7 +1951,7 @@ function BookingPreview({
   availability,
   bookingUrl,
   onCopy,
-  onOpen,
+  openHref,
   onCollapse,
 }: {
   title: string;
@@ -1961,7 +1963,7 @@ function BookingPreview({
   availability?: AvailabilityConfig;
   bookingUrl?: string;
   onCopy?: () => void;
-  onOpen?: () => void;
+  openHref?: string;
   onCollapse?: () => void;
 }) {
   const t = useT();
@@ -2138,19 +2140,20 @@ function BookingPreview({
                 <TooltipContent>{t("bookingLinks.copyLink")}</TooltipContent>
               </Tooltip>
             )}
-            {onOpen && (
+            {openHref && (
               <Tooltip>
                 <TooltipTrigger asChild>
-                  <button
-                    type="button"
-                    onClick={onOpen}
+                  <a
+                    href={openHref}
+                    target="_blank"
+                    rel="noopener noreferrer"
                     className={cn(
                       "flex h-6 w-6 items-center justify-center rounded",
                       BRAND_ICON_LINK_CLASS,
                     )}
                   >
                     <IconExternalLink className="h-3.5 w-3.5" />
-                  </button>
+                  </a>
                 </TooltipTrigger>
                 <TooltipContent>
                   {t("bookingLinks.openInteractiveBookingLink")}

package/corpus/templates/calendar/app/pages/ManageBookingPage.tsx

@@ -9,7 +9,7 @@ import {
 import { useQuery, useMutation } from "@tanstack/react-query";
 import { format, parseISO } from "date-fns";
 import { useState } from "react";
-import { useParams, useNavigate } from "react-router";
+import { Link, useParams, useNavigate } from "react-router";
 import { toast } from "sonner";
 
 import {
@@ -118,13 +118,11 @@ export function ManageBookingPage() {
           {t("manageBooking.cancelledSuffix")}
         </p>
         {booking.slug && (
-          <Button
-            variant="outline"
-            className="mt-6 gap-2"
-            onClick={() => navigate(`/book/${booking.slug}`)}
-          >
-            <IconCalendarPlus className="h-4 w-4" />
-            {t("manageBooking.reschedule")}
+          <Button asChild variant="outline" className="mt-6 gap-2">
+            <Link to={`/book/${booking.slug}`}>
+              <IconCalendarPlus className="h-4 w-4" />
+              {t("manageBooking.reschedule")}
+            </Link>
           </Button>
         )}
       </div>

package/corpus/templates/calendar/changelog/2026-07-13-booking-links-and-previews-open-in-new-tabs.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-13
+---
+
+Booking links and previews now support opening in a new tab.

package/corpus/templates/clips/app/components/player/sign-in-prompt-dialog.tsx

@@ -58,13 +58,10 @@ export function SignInPromptDialog({
           <Button variant="ghost" onClick={() => onOpenChange(false)}>
             {t("signInPrompt.notNow")}
           </Button>
-          <Button
-            onClick={() => {
-              onSignIn?.();
-              window.location.href = buildSignInHref(returnTo);
-            }}
-          >
-            {t("signInPrompt.signIn")}
+          <Button asChild>
+            <a href={buildSignInHref(returnTo)} onClick={() => onSignIn?.()}>
+              {t("signInPrompt.signIn")}
+            </a>
           </Button>
         </DialogFooter>
       </DialogContent>