@notis_ai/cli 0.2.0-beta.1792679782834.1 → 0.2.0-beta.1792692436042.1

package/dist/agent-hooks/notis-agent-hook.mjs

@@ -38037,7 +38037,7 @@ function validateTextFile(relPath, content) {
   const extension = extname(relPath);
   const rules = getCompiledRules();
   if (extension === ".css" || extension === ".scss" || extension === ".sass" || extension === ".pcss") {
-    return applyRules(content, rules.css, relPath);
+    return applyRules(maskComments(content, ".css"), rules.css, relPath);
   }
   if (extension === ".js" || extension === ".jsx" || extension === ".ts" || extension === ".tsx") {
     return applyRules(maskSerializedJsonData(content, extension), rules.javascript, relPath);
@@ -38442,8 +38442,55 @@ function resolveBuiltBundleDir(projectDir) {
   }
   return null;
 }
+function maskCssForSelectorMatching(css) {
+  let masked = "";
+  let index = 0;
+  const skipString = (from) => {
+    const quote = css[from];
+    let end = from + 1;
+    while (end < css.length && css[end] !== quote && css[end] !== "\n") end += css[end] === "\\" ? 2 : 1;
+    return Math.min(end + 1, css.length);
+  };
+  while (index < css.length) {
+    const char = css[index];
+    if (char === "\\") {
+      masked += css.slice(index, index + 2);
+      index += 2;
+    } else if (char === "/" && css[index + 1] === "*") {
+      const close = css.indexOf("*/", index + 2);
+      const end = close === -1 ? css.length : close + 2;
+      masked += css.slice(index, end).replace(/[^\n]/g, " ");
+      index = end;
+    } else if (char === '"' || char === "'") {
+      const end = skipString(index);
+      masked += "x".repeat(end - index);
+      index = end;
+    } else if (char === "[") {
+      let end = index + 1;
+      while (end < css.length && css[end] !== "]") {
+        end = css[end] === '"' || css[end] === "'" ? skipString(end) : end + (css[end] === "\\" ? 2 : 1);
+      }
+      end = Math.min(end + 1, css.length);
+      masked += "x".repeat(end - index);
+      index = end;
+    } else {
+      masked += char;
+      index += 1;
+    }
+  }
+  return masked;
+}
+var SHADOW_GLOBAL_SELECTOR = /(?:(?<![\w\-.#:\\])html|(?<![\w\-\\]):root)\s*(?:,\s*:host\s*)?\{|(?<![\w\-.#:\\])body\s*\{/g;
 function normalizeShadowScopedCss(css) {
-  return css.replace(/(?:html|:root)\s*,\s*:host\s*\{/g, "[data-notis-app-root],:host{").replace(/:root\s*\{/g, "[data-notis-app-root],:host{").replace(/html\s*\{/g, "[data-notis-app-root],:host{").replace(/body\s*\{/g, "[data-notis-app-root]{");
+  const masked = maskCssForSelectorMatching(css);
+  let output = "";
+  let last = 0;
+  for (const match of masked.matchAll(SHADOW_GLOBAL_SELECTOR)) {
+    output += css.slice(last, match.index);
+    output += match[0].startsWith("body") ? "[data-notis-app-root]{" : "[data-notis-app-root],:host{";
+    last = match.index + match[0].length;
+  }
+  return output + css.slice(last);
 }
 function normalizeBundleStylesheets(projectDir) {
   const bundleDir = join16(projectDir, BUNDLE_DIR);
@@ -41142,6 +41189,15 @@ function viewDeclarations(manifest) {
     ...["portal", "hidden"].includes(manifest.chrome) ? { chrome: manifest.chrome } : {}
   };
 }
+var RECORD_VIEW_READS = { record: "readonly note snapshot", html: "stored HTML page", report: "report source" };
+function recordViewExample(operation, key2) {
+  const result = {
+    record: { record_key: key2, writable: false, schema: { properties: {} }, document: { record_key: key2, properties: {} } },
+    html: { record_key: key2, html: "<h1>Fictional page</h1>" },
+    report: { source: "export default function Report() { return null; }", export_name: "default" }
+  }[operation];
+  return JSON.stringify({ operation, record_key: key2, result });
+}
 var VIEWER_READS = { list_databases: "databases", get_database: "databases", query_database: "databases", list_skills: "skills", get_skill: "skills" };
 function createSpaceFixtureEngine(release) {
   const bodyTemplates = structuredClone(release.manifest.actions || {});
@@ -41233,18 +41289,27 @@ function createSpaceFixtureEngine(release) {
     if (previousBodies.some((request) => isDeepStrictEqual(request, entry.request))) throw usageError("Ambiguous document body fixture.");
     previousBodies.push(entry.request);
   }
+  const viewName = JSON.stringify(release.manifest?.local_key || release.manifest?.name || "view");
+  const fixtureWhere = `View ${viewName}${release.fixturePath ? ` (${release.fixturePath})` : ""}:`;
   const recordViews = fixtures.recordViews ?? [];
   if (!Array.isArray(recordViews) || recordViews.length > 100) throw usageError("Declare bounded synthetic recordViews fixtures.");
   const recordDeclarations = Object.values(release.manifest.params || {}).filter((value) => value?.type === "record");
+  const nativeDatabases = Object.values(bodyResources).some((value) => value?.kind === "database");
   const previousViews = /* @__PURE__ */ new Set();
   for (const entry of recordViews) {
-    if (!object(entry) || Object.keys(entry).sort().join(",") !== "operation,record_key,result" || !["record", "html", "report"].includes(entry.operation) || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(entry.record_key) || !object(entry.result) || !recordDeclarations.length || !recordDeclarations.every((value2) => bodyResources[value2.database]?.kind === "database")) throw usageError("Declare readonly recordViews only for a declared native record param.");
+    if (!object(entry) || Object.keys(entry).sort().join(",") !== "operation,record_key,result" || !["record", "html", "report"].includes(entry.operation) || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(entry.record_key) || !object(entry.result) || !nativeDatabases || !recordDeclarations.every((value2) => bodyResources[value2.database]?.kind === "database")) throw usageError("Declare readonly recordViews only for a declared native database resource.");
     const identity = entry.operation + ":" + entry.record_key;
     if (previousViews.has(identity)) throw usageError("Ambiguous record view fixture.");
     previousViews.add(identity);
     const value = entry.result;
     if (entry.operation === "record" && (value.record_key !== entry.record_key || !object(value.document) || !object(value.schema) || value.writable !== false || Object.hasOwn(value, "target") || value.document.record_key !== entry.record_key)) throw usageError("Record fixtures must be readonly snapshots without authoring targets.");
-    if (entry.operation === "html" && (typeof value.html !== "string" || value.record_key !== entry.record_key)) throw usageError("HTML fixtures contain a record key and HTML.");
+    if (entry.operation === "html" && typeof value.html !== "string") {
+      throw usageError(`${fixtureWhere} the html recordViews fixture for record ${entry.record_key} is missing result.html, the page HTML as a string. Use ${recordViewExample("html", entry.record_key)}.`);
+    }
+    if (entry.operation === "html" && value.record_key !== entry.record_key) {
+      throw usageError(`${fixtureWhere} the html recordViews fixture for record ${entry.record_key} needs result.record_key set to that same record key. Use ${recordViewExample("html", entry.record_key)}.`);
+    }
+    if (entry.operation === "html" && value.title !== void 0 && value.title !== null && typeof value.title !== "string") throw usageError("HTML fixtures contain a record key, HTML and an optional title.");
     if (entry.operation === "report" && (typeof value.source !== "string" || typeof value.export_name !== "string")) throw usageError("Report fixtures contain an explicit readonly source and export.");
   }
   return {
@@ -41252,7 +41317,10 @@ function createSpaceFixtureEngine(release) {
     digest: createHash13("sha256").update(JSON.stringify(fixtures)).digest("hex"),
     executeRecordView(operation, key2) {
       const match = recordViews.find((value) => value.operation === operation && value.record_key === key2);
-      if (!match) throw usageError("Add an explicit synthetic record view fixture.");
+      if (!match) {
+        const where = release.fixturePath ? `Add it to recordViews in ${release.fixturePath}` : "This Space declares no verificationFixtures file: add one to its Space definition with a recordViews entry";
+        throw usageError(`View ${viewName} reads the ${RECORD_VIEW_READS[operation] || operation} of record ${key2}, but its fixtures have no recordViews entry with operation "${operation}" and that record_key. ${where}, for example ${recordViewExample(operation, key2)}.`);
+      }
       return structuredClone(match.result);
     },
     executeBody(request) {
@@ -41375,32 +41443,48 @@ function createSpaceFixtureBroker({
     },
     async read(request) {
       let result;
-      const log = { operation: request?.operation, ...request?.action_id ? { actionId: request.action_id } : {}, ok: false };
+      const log = {
+        operation: request?.operation,
+        ...request?.action_id ? { actionId: request.action_id } : {},
+        ...typeof request?.record_key === "string" ? { recordKey: request.record_key } : {},
+        ok: false
+      };
       calls.push(log);
-      if (calls.length > 256) throw usageError("The offline fixture read limit was reached.");
-      if (request?.operation === "action" && exact(request, ["operation", "action_id", "inputs", "request_id"])) {
-        if (frozen.descriptor.space.actions[request.action_id]?.readOnly !== true) throw usageError("Offline verification never runs write actions.");
-        result = engine.execute(request.action_id, request.inputs);
-      } else if (request?.operation === "shown" && exact(request, ["operation", "name", "params", "options"])) {
-        result = engine.executeShown(request.name, request.params, request.options);
-      } else if (request?.operation === "viewer_read" && exact(request, ["operation", "name", "input"])) {
-        result = engine.executeViewerRead(request.name, request.input);
-      } else if (request?.operation === "document_body" && exact(request, ["operation", "record_key", "binding", "read_action"])) {
-        if (frozen.descriptor.space.actions[request.read_action]?.readOnly !== true) throw usageError("This document read action is unavailable.");
-        result = engine.executeBody({ operation: "read", recordKey: request.record_key, binding: request.binding, readAction: request.read_action });
-      } else if (["record", "html", "report"].includes(request?.operation) && exact(request, ["operation", "record_key"])) {
-        result = engine.executeRecordView(request.operation, request.record_key);
-      } else {
-        throw usageError("Only declared read-only synthetic fixtures are available.");
+      try {
+        result = readFixture(request);
+      } catch (error) {
+        log.error = String(error?.message || error).slice(0, 2e3);
+        throw error;
       }
       log.ok = true;
       return result;
     },
     async finish() {
-      if (calls.some((value2) => !value2.ok)) throw usageError("A synthetic fixture read failed.");
+      const failed = calls.find((value2) => !value2.ok);
+      if (failed) throw usageError(failed.error ? `A synthetic fixture read failed: ${failed.error}` : "A synthetic fixture read failed.");
       return { valid: true };
     }
   };
+  function readFixture(request) {
+    let result;
+    if (calls.length > 256) throw usageError("The offline fixture read limit was reached.");
+    if (request?.operation === "action" && exact(request, ["operation", "action_id", "inputs", "request_id"])) {
+      if (frozen.descriptor.space.actions[request.action_id]?.readOnly !== true) throw usageError("Offline verification never runs write actions.");
+      result = engine.execute(request.action_id, request.inputs);
+    } else if (request?.operation === "shown" && exact(request, ["operation", "name", "params", "options"])) {
+      result = engine.executeShown(request.name, request.params, request.options);
+    } else if (request?.operation === "viewer_read" && exact(request, ["operation", "name", "input"])) {
+      result = engine.executeViewerRead(request.name, request.input);
+    } else if (request?.operation === "document_body" && exact(request, ["operation", "record_key", "binding", "read_action"])) {
+      if (frozen.descriptor.space.actions[request.read_action]?.readOnly !== true) throw usageError("This document read action is unavailable.");
+      result = engine.executeBody({ operation: "read", recordKey: request.record_key, binding: request.binding, readAction: request.read_action });
+    } else if (["record", "html", "report"].includes(request?.operation) && exact(request, ["operation", "record_key"])) {
+      result = engine.executeRecordView(request.operation, request.record_key);
+    } else {
+      throw usageError("Only declared read-only synthetic fixtures are available.");
+    }
+    return result;
+  }
 }
 
 // src/runtime/space-verification.js
@@ -41506,6 +41590,13 @@ async function verifySpaceRelease(release, {
     });
     const runtimeCalls = brokers.flatMap(({ width, broker }) => broker.calls.map((call) => ({ width, ...call })));
     const passed = renders.every((value) => value.status === "passed") && runtimeCalls.every((call) => call.ok);
+    const fixtureErrors = [...new Map(runtimeCalls.filter((call) => !call.ok && call.error).map((call) => [call.error, {
+      phase: "fixture",
+      operation: call.operation,
+      ...call.recordKey ? { record_key: call.recordKey } : {},
+      ...call.actionId ? { action_id: call.actionId } : {},
+      message: call.error
+    }])).values()].slice(0, 10);
     return {
       ...diagnostic,
       status: passed ? "passed" : "failed",
@@ -41516,7 +41607,7 @@ async function verifySpaceRelease(release, {
       browser_count: 1,
       renders,
       runtimeCalls,
-      errors: passed ? [] : [{ phase: "renderer", message: "At least one width or read-only fixture failed verification." }]
+      errors: passed ? [] : [...fixtureErrors, { phase: "renderer", message: "At least one width or read-only fixture failed verification." }]
     };
   } catch (error) {
     return {
@@ -42380,7 +42471,11 @@ async function sourceRelease(ctx, publish, stageOnly = false) {
     }
     const diagnosticPath = saveSpaceVerification(directory, { ...render, space_id: body.space_id });
     if (!["passed", "not_applicable_container"].includes(render.status)) {
-      throw usageError("The built Space did not pass offline render verification. Nothing was published.", { render, diagnostic_path: diagnosticPath });
+      const reason = render.errors?.find((value) => value.phase === "fixture")?.message;
+      throw usageError(
+        `The built Space did not pass offline render verification. Nothing was published.${reason ? ` ${reason}` : ""}`,
+        { render, diagnostic_path: diagnosticPath }
+      );
     }
     if (publish && !ctx.options.dryRun) {
       verification = spacePublicationIntent(directory, identity, {

package/dist/base-skills/notis-query/.notis-base-skill.json

@@ -1 +1 @@
-{"schema":1,"stamp":1792562865,"commit":"8250916acfec33698df9868db2b05d15c18692fb"}
+{"schema":1,"stamp":1792690862,"commit":"5b15dbc2bb00fe99a710e6336a9ba696a7044a66"}

package/dist/base-skills/notis-query/references/documents.md

@@ -22,6 +22,15 @@ access before acting. It is not permission to change a record or run a provider.
    shapes are not guessed. A stale revision requires a merge, not blind replacement.
    A relation value takes the related record's `record_key` or row ID; one you
    cannot resolve answers `invalid_relation_value` naming the property.
+   To create a record with its body, send `input.content_markdown` (at most
+   2,000,000 characters, never with `body`) on `LOCAL_NOTIS_DATABASE_INSERT`
+   with a direct Editor or standalone target: the record is created, then its
+   body is saved like an UPDATE body. `record_body_not_saved` or
+   `record_body_outcome_unknown` means the record exists; the error names its
+   `record_key` and `revision`. Repeat the exact call with the same request ID
+   (it replays the same record and resumes the body), or save the body with
+   `LOCAL_NOTIS_DATABASE_UPDATE`. Never insert again with a new ID. A declared
+   insert action takes no body: insert, then save through its update action.
 3. On an unknown outcome, recover the original receipt using the same intent.
    Do not repeat an insert with a new ID. Read back the same row afterward.
    `space_temporarily_unavailable` (503) is load, not a refusal: retry the same

package/dist/base-skills/notis-spaces/.notis-base-skill.json

@@ -1 +1 @@
-{"schema":1,"stamp":1792677351,"commit":"771883529c1d8ea5c48ead21c09b868da2362b87"}
+{"schema":1,"stamp":1792690862,"commit":"5b15dbc2bb00fe99a710e6336a9ba696a7044a66"}

package/dist/base-skills/notis-spaces/SKILL.md

@@ -196,6 +196,10 @@ you prepare it and only the submission page's Publish button publishes.
 
 Existing report rows render through `<ReportFrame>` in their database's view.
 Follow [Reports](references/reports.md) for saved pages and interactive reports.
+To show another Space page live inside a view (a slide whose Page property holds
+a Notis link), use `<SpacePageFrame href>` from [SDK](references/sdk.md): only a
+Space view of the same Notis origin is framed, view only, with the viewer's own
+access; any other link shows a card with Open page.
 
 [Context sharing](references/context.md) keeps selected text and annotations as
 unsent reference context. Page context, memory hits and source content are not

package/dist/base-skills/notis-spaces/references/sdk.md

@@ -20,7 +20,7 @@ account credential or backend transport.
 | `useShown<Row>(name, options?)` | Execute the native list in `shows[name]` with current params. Options: `sorts`, `pageSize`, `offset`, `includeContent`, `allPages` (every page, for a whole count or a local search); rows are in `data?.rows` and the schema revision a write needs in `data?.schema_revision`, with `loading`, `hasData`, `isFetching`, `error`, `refetch` (resolves to the read's error, or null when it succeeded; it never rejects). |
 | `useShownAvailable(name)` | Check whether this host exposes the declared native list. A record Site can expose only its exact server-pinned row scope. |
 | `useAction<Inputs, Result>(name)` / `useActionQuery<Result>(name, inputs)` | Call a declared action (`call(inputs, options)`); read the result of a declared read action. Never call account-wide tools from a Space. |
-| `useNativeMutation(binding, operation)` | Insert, update or delete one row of a linked database through the action that declares `LOCAL_NOTIS_DATABASE_INSERT`, `_UPDATE` or `_DELETE` on that binding with `request: { $input: 'request' }`. `mutate(input, {schemaRevision, requestId})` returns the receipt (`record_key`, `revision`); a delete moves the record to the bin. One new request ID per effect. |
+| `useNativeMutation(binding, operation)` | Insert, update or delete one row of a linked database through the action that declares `LOCAL_NOTIS_DATABASE_INSERT`, `_UPDATE` or `_DELETE` on that binding with `request: { $input: 'request' }`. `mutate(input, {schemaRevision, requestId})` returns the receipt (`record_key`, `revision`); a delete moves the record to the bin. One new request ID per effect. An insert action takes no `content_markdown`: insert, then save the body with `useNativeDocumentBody` and the record's revision. |
 | `useNativeDocumentBody(binding, recordKey, {readAction, writeAction?, enabled?})` | Markdown body adapter. Keep drafts in the view; save with the original content, record/schema revisions and stable request ID. Rich editing normally uses `DocumentEditor`. |
 | `useNotis()` | Host resource, Space labels, route and ready state. Use `resource.id` for the current Space identity. |
 
@@ -51,6 +51,7 @@ user data.
 | `<HtmlFrame recordKey>` | Attached HTML under viewer CSP and an opaque-origin sandbox. Source cannot relax that boundary. |
 | `<ReportFrame recordKey>` | A report row's saved independent implementation in its database's current view. |
 | `<ShareControl recordKey>` | Private/shared record Site, copy link and revoke. |
+| `<SpacePageFrame href>` | Another Notis Space page, live in this view: `href` is a Notis link (a path or a full link of this origin, such as a Page property). The Portal shows only that page's view (no sidebar, top bar or chat) with the viewer's own session and permissions. `interactive` (default `false`) lets it take clicks and keys; off, the view around it (a deck's arrows and swipes) keeps them. `title`, `className` (sizes the box it fills). Any other link, and every verify or build preview, shows a card with the title, the path and Open page. |
 
 In its own Space's view, a record's Site is a row of the top bar Share panel, not
 a toolbar button. The published Space declares the database binding; the server
@@ -229,7 +230,9 @@ extracts tables, lists, controls and visible document/HTML content automatically
   `NotisSelectionBoundary`, `NotisCommentBoundary` and `NotisCommentBox` support
   explicit reference context. [Context sharing](context.md) owns the contract.
 - `Dialog` supplies a themed modal with focus handling; while it is open, only
-  its own keys and Escape work.
+  its own keys and Escape work. For a confirmation (delete, discard), pass
+  `nativeOnTouch` and mark the buttons `data-dialog-confirm` and
+  `data-dialog-cancel`: phones and tablets then ask with the system dialog.
 - `MarkdownEditor` is for a view-owned Markdown draft/persistence adapter. Native
   documents use `DocumentEditor` so collaboration and file authority stay with Notis.
 
@@ -239,5 +242,13 @@ Declare a `verificationFixtures` JSON source with `actions` and optional `contex
 `shown`, `viewerReads`, `documentBodies`, `recordViews`. Cases match exact action
 inputs/list params. Record views use `{operation: 'record'|'html'|'report', record_key,
 result}`; native record snapshots require `writable: false` and no authoring target.
+A record view fixture needs a declared native database resource; a record param is
+optional (a list row's `HtmlFrame` takes none). An `HtmlFrame` preview reads
+`{operation: 'html', record_key: '<row uuid>', result: {record_key: '<same uuid>',
+html: '<!doctype html>...', title: 'Optional'}}` and renders that HTML in the live
+sandbox and viewer CSP, sized by its `className` (a 1920x1080 slide box shows the
+real slide in verify screenshots); popups and network stay blocked offline.
+When a view reads a record view its fixtures lack, verify names the view, the read,
+the record key and the missing field, and prints a valid entry to copy.
 Keep every fixture fictional and include every load-time read. Failed or missing
 fixtures fail verification; there is no fallback to the user's real account.

package/dist/sdk/src/components/Dialog.tsx

@@ -1,6 +1,7 @@
 'use client';
 
-import React, { useEffect, useId, useRef, type ReactNode } from 'react';
+import React, { useEffect, useId, useRef, useState, type ReactNode } from 'react';
+import { useIsoLayoutEffect } from '../ui/util';
 
 export interface DialogProps {
   open: boolean;
@@ -9,21 +10,79 @@ export interface DialogProps {
   title: ReactNode;
   description?: ReactNode;
   role?: 'dialog' | 'alertdialog';
+  /**
+   * A confirmation: on phones and tablets the operating system's own dialog asks instead of the card. OK clicks the
+   * button marked `data-dialog-confirm`; Cancel clicks the one marked `data-dialog-cancel`, else calls `onClose`.
+   * Desktop browsers and the Desktop app keep the card.
+   */
+  nativeOnTouch?: boolean;
   children: ReactNode;
 }
 
+/** How long the card stays hidden after OK while the work runs; a slow or failed action shows it again. */
+const NATIVE_CONFIRM_REVEAL_MS = 1500;
+/** A Cancel faster than this came from a browser with no OS dialog (an embedded view): show the card instead. */
+const NATIVE_CONFIRM_MISSING_MS = 30;
+
+/** Touch-first devices confirm with the operating system's dialog, as the Portal's AlertDialog does. */
+export function prefersNativeConfirm(): boolean {
+  if (typeof window === 'undefined' || typeof window.confirm !== 'function') return false;
+  if ((window as Window & { electronAPI?: { isElectron?: boolean } }).electronAPI?.isElectron) return false;
+  return window.matchMedia?.('(hover: none) and (pointer: coarse)').matches === true;
+}
+
+/** One OS dialog: the question first, then each line of the explanation as its own paragraph. */
+function nativeConfirmMessage(title: string, description: string): string {
+  return [title, ...description.split(/\n+/)].map((part) => part.trim()).filter(Boolean).join('\n\n');
+}
+
 /** Native top-layer dialog; content and actions remain app-owned. */
-export function Dialog({ open, onClose, title, description, role = 'dialog', children }: DialogProps) {
+export function Dialog({ open, onClose, title, description, role = 'dialog', nativeOnTouch = false, children }: DialogProps) {
   const ref = useRef<HTMLDialogElement>(null);
   const titleId = useId();
   const descriptionId = useId();
+  const onCloseRef = useRef(onClose);
+  onCloseRef.current = onClose;
+  // Each opening asks the OS again.
+  const [native, setNative] = useState(false);
 
-  useEffect(() => {
+  // Before paint, so a touch confirmation never flashes the card first.
+  useIsoLayoutEffect(() => {
     if (!open) return;
     const dialog = ref.current!;
     dialog.showModal();
-    return () => dialog.close();
-  }, [open]);
+    setNative(nativeOnTouch && prefersNativeConfirm());
+    return () => { if (dialog.open) dialog.close(); };
+  }, [open, nativeOnTouch]);
+
+  useEffect(() => {
+    if (!open || !native) return;
+    const dialog = ref.current!;
+    let reveal: ReturnType<typeof setTimeout> | undefined;
+    // Let the dialog finish opening (title, buttons) before the OS takes over.
+    const ask = setTimeout(() => {
+      const asked = performance.now();
+      const describedBy = dialog.querySelector('.notis-dialog-description') as HTMLElement | null;
+      const confirmed = window.confirm(nativeConfirmMessage(
+        dialog.querySelector('.notis-dialog-title')?.textContent ?? '',
+        describedBy ? (typeof describedBy.innerText === 'string' ? describedBy.innerText : describedBy.textContent ?? '') : '',
+      ));
+      if (!confirmed && performance.now() - asked < NATIVE_CONFIRM_MISSING_MS) {
+        setNative(false);
+        return;
+      }
+      if (confirmed) dialog.querySelector<HTMLButtonElement>('[data-dialog-confirm]')?.click();
+      else {
+        const cancel = dialog.querySelector<HTMLButtonElement>('[data-dialog-cancel]');
+        if (cancel) cancel.click(); else onCloseRef.current();
+      }
+      reveal = setTimeout(() => setNative(false), confirmed ? NATIVE_CONFIRM_REVEAL_MS : 0);
+    }, 0);
+    return () => {
+      clearTimeout(ask);
+      if (reveal !== undefined) clearTimeout(reveal);
+    };
+  }, [open, native]);
 
   return (
     <dialog
@@ -32,10 +91,8 @@ export function Dialog({ open, onClose, title, description, role = 'dialog', chi
       role={role}
       aria-labelledby={titleId}
       aria-describedby={description == null ? undefined : descriptionId}
-      onCancel={(event) => {
-        event.preventDefault();
-        onClose();
-      }}
+      data-native-confirm={native ? '' : undefined}
+      onCancel={(event) => { event.preventDefault(); onClose(); }}
       onKeyDown={(event) => event.stopPropagation()}
     >
       <h2 id={titleId} className="notis-dialog-title">{title}</h2>

package/dist/sdk/src/components/RecordComponents.tsx

@@ -2,7 +2,9 @@
 
 import type { ReactElement } from 'react';
 import { useNotisRuntime } from '../provider';
-import type { NotisHtmlFrameProps, NotisRecordPropertiesProps, NotisReportFrameProps, NotisShareControlProps } from '../runtime';
+import type {
+  NotisHtmlFrameProps, NotisRecordPropertiesProps, NotisReportFrameProps, NotisShareControlProps, NotisSpacePageFrameProps,
+} from '../runtime';
 import { pick, type Locale, type Words } from '../words/types';
 
 /** The words a record component says outside Notis, in English and French. */
@@ -11,6 +13,9 @@ export const RECORD_COMPONENT_WORDS = Object.freeze({
   /** Short enough for a toolbar (C11); the full sentence is its tooltip. */
   shareUnavailable: { en: 'Share unavailable', fr: 'Partage indisponible' },
   shareUnavailableHint: { en: 'Open this record in Notis to share it.', fr: 'Ouvre cet enregistrement dans Notis pour le partager.' },
+  spacePageTitle: { en: 'Space page', fr: 'Page du Space' },
+  spacePagePreview: { en: 'This page shows here live when the Space opens in Notis.', fr: 'Cette page s’affiche ici en direct quand le Space est ouvert dans Notis.' },
+  spacePageOpen: { en: 'Open page', fr: 'Ouvrir la page' },
 }) satisfies Readonly<Record<string, Words>>;
 
 function useLocale(): Locale {
@@ -51,3 +56,56 @@ export function ShareControl(props: NotisShareControlProps): ReactElement {
     {pick(RECORD_COMPONENT_WORDS.shareUnavailable, locale)}
   </span>;
 }
+
+/**
+ * The path a Space page link names and the link the fallback card may open: a site-relative path, or an http(s) URL
+ * without credentials. Anything else (script URLs, protocol-relative links) opens nothing.
+ */
+export function spacePageLink(href: string): { path: string; openHref: string | null } {
+  const value = typeof href === 'string' ? href.trim() : '';
+  // Control characters and backslashes change how browsers read a URL; such a link never opens.
+  if (!value || /[\u0000-\u001f\u007f\\]/.test(value)) return { path: value, openHref: null };
+  if (value.startsWith('/') && !value.startsWith('//')) {
+    const path = value.split(/[?#]/, 1)[0] || '/';
+    return { path, openHref: value };
+  }
+  try {
+    const url = new URL(value);
+    if ((url.protocol === 'https:' || url.protocol === 'http:') && !url.username && !url.password) {
+      return { path: url.pathname, openHref: url.href };
+    }
+  } catch { /* not a URL */ }
+  return { path: value, openHref: null };
+}
+
+/** What a Space page frame shows when the host does not draw it (previews, verify): its title, its path and Open page. */
+export function SpacePageCard({ href, title, className, notice }: Pick<NotisSpacePageFrameProps, 'href' | 'title' | 'className'> & {
+  /** One sentence under the path; default: the page shows live once the Space opens in Notis. */
+  notice?: string;
+}): ReactElement {
+  const locale = useLocale();
+  const { path, openHref } = spacePageLink(href);
+  const muted = 'hsl(var(--muted-foreground))';
+  return <div role="group" aria-label={title || pick(RECORD_COMPONENT_WORDS.spacePageTitle, locale)} className={className}
+    data-notis-space-page-card=""
+    style={{ display: 'grid', alignContent: 'start', gap: 8, padding: 16, borderRadius: 10, minWidth: 0,
+      background: 'hsl(var(--muted) / .5)', color: 'hsl(var(--foreground))' }}>
+    <div style={{ fontSize: 14, fontWeight: 500, overflowWrap: 'anywhere' }}>{title || pick(RECORD_COMPONENT_WORDS.spacePageTitle, locale)}</div>
+    {path ? <div style={{ fontSize: 12, color: muted, overflowWrap: 'anywhere',
+      fontFamily: 'ui-monospace, SFMono-Regular, Menlo, monospace' }}>{path}</div> : null}
+    <div style={{ fontSize: 13, color: muted }}>{notice ?? pick(RECORD_COMPONENT_WORDS.spacePagePreview, locale)}</div>
+    {openHref ? <div><a className="nui-btn" href={openHref} style={{ textDecoration: 'none' }}>
+      {pick(RECORD_COMPONENT_WORDS.spacePageOpen, locale)}
+    </a></div> : null}
+  </div>;
+}
+
+/**
+ * Another Space page shown live inside this view. The host loads only a Space page of its own Notis origin, with the
+ * viewer's own access; any other link (and every host without the frame) shows a card with the title, the path and
+ * Open page. Not interactive by default, so a deck around it keeps its keys and clicks.
+ */
+export function SpacePageFrame(props: NotisSpacePageFrameProps): ReactElement {
+  const Host = useNotisRuntime()?.ui?.SpacePageFrame;
+  return Host ? <Host {...props} /> : <SpacePageCard href={props.href} title={props.title} className={props.className} />;
+}

package/dist/sdk/src/index.ts

@@ -80,7 +80,7 @@ export { Markdown } from './components/Markdown';
 export type { MarkdownProps } from './components/Markdown';
 export { DocumentEditor } from './components/DocumentEditor';
 export { DocumentPage, DocumentPageSkeleton, usePrefetchRecord } from './components/DocumentPage';
-export { RecordProperties, HtmlFrame, ReportFrame, ShareControl } from './components/RecordComponents';
+export { RecordProperties, HtmlFrame, ReportFrame, ShareControl, SpacePageFrame } from './components/RecordComponents';
 export { RenderChartData } from './ui/charts/RenderChartData';
 export { MarkdownEditor } from './components/MarkdownEditor';
 export { NotisSelectionBoundary, NOTIS_CONTEXT_CLIPBOARD_TYPE } from './components/NotisSelectionBoundary';
@@ -175,6 +175,7 @@ export type {
   NotisHtmlFrameProps,
   NotisReportFrameProps,
   NotisShareControlProps,
+  NotisSpacePageFrameProps,
   NotisMarkdownEditorProps,
   NotisMarkdownEditorSavePayload,
   NotisMarkdownEditorSaveResult,

package/dist/sdk/src/runtime.ts

@@ -268,6 +268,23 @@ export type NotisHtmlFrameProps = ({ recordKey: string; html?: never } | { html:
 export interface NotisReportFrameProps extends NotisRecordProps {}
 export interface NotisShareControlProps extends NotisRecordProps {}
 
+/**
+ * Another Space page (a Space view or record page link on the current Notis origin) shown live inside this view.
+ * The host loads only links to a Space page of its own origin; any other link shows a card with an Open link.
+ */
+export interface NotisSpacePageFrameProps {
+  /** A Space page link: a path such as '/slides/decks?deck=...' or the same link with the current Notis origin. */
+  href: string;
+  /** Names the frame for assistive technology and the fallback card. */
+  title?: string;
+  className?: string;
+  /**
+   * False (the default) ignores clicks and keys inside the page, so the view around it (for example a slide
+   * deck) keeps its own navigation. True lets the viewer use the page in place.
+   */
+  interactive?: boolean;
+}
+
 /** One breadcrumb before the record title; the title is always the last crumb. */
 export interface NotisDocumentPageCrumb {
   label: string;
@@ -414,6 +431,7 @@ export interface NotisRuntimeUI {
   HtmlFrame?: ComponentType<NotisHtmlFrameProps>;
   ReportFrame?: ComponentType<NotisReportFrameProps>;
   ShareControl?: ComponentType<NotisShareControlProps>;
+  SpacePageFrame?: ComponentType<NotisSpacePageFrameProps>;
   /** Starts reading a record (and the page's code) before it opens, for example when a list row is hovered. */
   prefetchRecord?: (recordKey: string) => void;
 }

package/dist/sdk/src/styles.css

@@ -8,26 +8,7 @@
  * The portal injects the live Notis theme variables at render time.
  */
 
-/* Top-layer surfaces must remain distinct from the app's flat content panels. */
-dialog.notis-dialog {
-  position: fixed;
-  inset: 0;
-  margin: auto;
-  box-sizing: border-box;
-  width: min(28rem, calc(100% - 2rem));
-  max-height: calc(100dvh - 2rem);
-  overflow: auto;
-  padding: 1.25rem;
-  border: 1px solid hsl(var(--border));
-  border-radius: 0.75rem;
-  background: hsl(var(--popover));
-  color: hsl(var(--popover-foreground));
-  box-shadow: 0 16px 48px rgb(0 0 0 / 0.2);
-}
-
-dialog.notis-dialog::backdrop { background: rgb(0 0 0 / 0.45); }
-.notis-dialog-title { margin: 0; font-size: 1rem; font-weight: 600; line-height: 1.5; }
-.notis-dialog-description { margin: 0.5rem 0 0; color: hsl(var(--muted-foreground)); font-size: 0.875rem; line-height: 1.5; }
+/* The SDK Dialog's rules live in toolkit.css (section: dialog), so they also reach a Space's shadow root. */
 
 /* Framework-neutral styles: the app owns its Tailwind entry point. This file
  * is also consumed in shadow roots and by apps on older Tailwind versions.