frontpage-host 0.3.13 → 0.3.15

package/AGENTS.md

@@ -264,7 +264,7 @@ Manual group selection uses `groups.people` (20 per page, phone-only contacts in
 
 ## AI Support Agent
 
-Scale and internal sites, after owner activation. No pilot allowlist. Use `frontpage customer-inbox get|put|post RESOURCE`, stable write keys and current versions. Full guide: [CUSTOMER-INBOX.md](./CUSTOMER-INBOX.md). `export CONVERSATION_ID --out FILE` writes authorized paginated history and file metadata; `download FILE_ID --out FILE` downloads through a file grant. Outputs never overwrite existing files. `frontpage usage` reports shared site credits, mail and storage. The owner toolbar uses `manage_customer_inbox` for all site-wide Inbox settings, unlocked knowledge, files, customer conversations, private guidance, replies, takeover/return and recovery. The support agent has a separate server-bound customer scope and requires verification for People data. Both agents cannot edit or unlock locked knowledge; human UI/CLI can unlock it. Never lend a website agent a human CLI key.
+Scale and internal sites, after owner activation. No pilot allowlist. Use `frontpage customer-inbox get|put|post RESOURCE`, stable write keys and current versions for settings, sources and conversations. Knowledge saves use last-save-wins; read the latest note before editing. Knowledge history supports limit/cursor pagination and full revision reads by version, within the plan Rewind allowance plus the latest revision. Archive notes through POST knowledge/ID/archive with {} to stop future use while preserving all records; do not archive without the owner asking. Full guide: [CUSTOMER-INBOX.md](./CUSTOMER-INBOX.md). `export CONVERSATION_ID --out FILE` writes authorized paginated history and file metadata; `download FILE_ID --out FILE` downloads through a file grant. Outputs never overwrite existing files. `frontpage usage` reports shared site credits, mail and storage. The owner toolbar uses `manage_customer_inbox` for all site-wide Inbox settings, unlocked knowledge, files, customer conversations, private guidance, replies, takeover/return and recovery. The support agent has a separate server-bound customer scope and requires verification for People data. Both agents cannot edit, archive or unlock locked knowledge; human UI/CLI can unlock it. Never lend a website agent a human CLI key.
 
 
 Payments, invoices and recurring billing: see packaged [PAYMENTS.md](./PAYMENTS.md), `frontpage help payments`, and https://frontpage.host/developers/payments. Version 0.2.0 removes writable currency, Store checkout mode and Store-owned money commands; Store stays cart-only. Preview/review before sends; keep stable operation keys on retries. Autopay requires the customer’s own verified authorization.
@@ -299,3 +299,19 @@ For a manual group, `groups.people` accepts `availability: "all" | "available" |
 Complete Store edits: use existing items update --file with changed fields and variantUpdates. stock requires expectedStock from a fresh items get. One transaction saves all changes or none. On 409 review current stock; never silently substitute it. firstVariant plus optionNames enables versions. Keep explicit stock/variant commands for single operations. Routines add accepts --request-id UUID; reuse that ID and exact schedule after a lost response. Ordinary form edits live only in the active task; Cancel keeps input, Discard loses unfinished input. Submitted payments, imports, builds, and API-key status are separate operations.
 
 Template history (frontpage-host 0.3.11+): read `mail template get ID` before editing. `mail template history ID --limit 20 --cursor CURSOR` pages saved copies; `mail template history-get ID --history-id COPY_ID` fetches full content. Edit any copy, then `mail template set ID --file content.json` with the stable template ID and content fields only to make a new latest copy. Last template save wins; past copies remain. Campaign and series conflict checks remain. Retry uncertain saves through `mail save` with the same requestKey and exact payload. History begins with content retained at launch; earlier overwritten edits are unavailable. History reads use the plan’s Rewind window and always include Latest, even when older. Older copies stay stored; lists and direct reads apply the same limit. Window metadata explains the limit and whether older copies exist. See MAIL.md.
+
+## Uploaded video preparation
+
+The current CLI attempts browser-compatible H.264 MP4 preparation after a local video
+upload. This applies to `frontpage media upload` and `frontpage prompt --attach ./clip.mov`.
+Use the returned `sitePath`; do not reconstruct a path from the original filename.
+A successful conversion returns `prepared:true` and the MP4's actual filename, size and
+URL. If preparation fails, the original remains usable as an upload with `prepared:false`
+and a compatibility warning. Warnings print on stderr and appear in JSON success data.
+An original's MP4/MOV extension does not establish browser compatibility.
+
+`frontpage media list` and the website agent's `list_site_assets` prefer a completed
+prepared copy over its exact original. Different uploads with the same display name
+remain distinct. Existing URLs and published videos are not converted automatically.
+Upgrade the CLI to receive upload-time preparation. Source path and access denials
+remain errors; they do not become original-file fallback successes.

package/CUSTOMER-INBOX.md

@@ -50,9 +50,11 @@ Aliases use 3–48 ASCII letters, numbers and single hyphens. The service normal
 | --- | --- | --- |
 | `knowledge` | GET | Recent notes; optional `?q=search` |
 | `knowledge/<id>` | GET | One full note |
-| `knowledge/<id>/history` | GET | Immutable revisions for that note |
-| `knowledge` | PUT | `{"title":"Evening visits","body":"Ask the owner before promising an evening visit.","expectedVersion":0,"reason":"Owner policy"}` |
-| `knowledge/<id>` | PUT | Current title/body, `expectedVersion`, `reason`, optional `locked` or `restoreVersion` |
+| `knowledge/<id>/history?limit=20` | GET | Revision summaries, `nextCursor`, and the plan history allowance; follow `&cursor=...` |
+| `knowledge/<id>/history?version=3` | GET | One full revision within the plan allowance, or the latest version |
+| `knowledge/<id>/archive` | POST | `{}`; keeps content and history, removes the note from future use |
+| `knowledge` | PUT | `{"title":"Evening visits","body":"Ask the owner before promising an evening visit.","reason":"Owner policy"}` |
+| `knowledge/<id>` | PUT | Current title/body, `reason`, optional `locked` or `restoreVersion`; legacy `expectedVersion` is accepted but does not reject a save |
 | `sources` | GET | Approved source records; `?overview=true` also includes the latest learning job status |
 | `sources` | PUT | `{"url":"https://example.com/help","enabled":true,"expectedVersion":0}`; fetches public text |
 
@@ -73,7 +75,19 @@ The response data is the same source with `enabled:false` and version `3`; its s
 
 Supply `body` on a source write to save an owner-approved excerpt instead of fetching. Published sources refresh when the agent reads a source older than 24 hours. The fetcher reuses Core's DNS-pinned public HTTP infrastructure, rejects private addresses, checks redirects and bounds content. Sources over 16000 text characters require an owner-approved excerpt. No scripts run. A source version/digest fences knowledge updates against a changed source.
 
-Knowledge search uses bounded literal keywords from natural-language queries and ranks notes by matched terms. Read the full matching note before updating it; update its current ID/version instead of creating a conflicting duplicate.
+Knowledge search uses bounded literal keywords from natural-language queries and ranks notes by matched terms. Read the full matching note before updating it; read its latest content and update that same ID instead of creating a duplicate. Knowledge uses last-save-wins: two saves can both succeed; the last completed save becomes current, and each saved change stays in history. This does not change version checks for settings, approved sources, or conversations.
+
+History uses the same central Rewind allowance as template history. Scale includes 90 days; internal sites have uncapped history. The latest revision stays available regardless of age. Older snapshots remain stored, but history reads and restores only allow revisions within the allowance or the latest revision. A paginated response includes `revisions` (version, actor, createdAt), `currentVersion`, `nextCursor`, `windowDays`, `unlimited`, `canUpgrade`, and `moreBeyondWindow`. A `version` request returns `{revision}` with full saved content. Older callers that omit pagination keep their full-revision response shape, bounded to 100 entries and the same allowance.
+
+```bash
+frontpage customer-inbox get 'knowledge/NOTE_UUID/history?limit=20' --site my-site --json
+frontpage customer-inbox get 'knowledge/NOTE_UUID/history?limit=20&cursor=21' --site my-site --json
+frontpage customer-inbox get 'knowledge/NOTE_UUID/history?version=3' --site my-site --json
+# archive.json contains {}. Use the same file and key when retrying.
+frontpage customer-inbox post knowledge/NOTE_UUID/archive --file archive.json --request-key archive_note_001 --site my-site --json
+```
+
+Archiving retains the note and every revision, hides it from normal lists/searches and future agent reads, and prevents later saves from reactivating it. There is no archived-notes screen or permanent-delete action. Runs already in progress keep what they loaded. Archiving does not remove matching information from approved webpages or replies already sent.
 
 Lock a knowledge note with `locked:true`. Neither the support agent nor the owner toolbar agent can change locked notes or locks. Human UI/CLI actions can unlock them. Restore an older note with `restoreVersion`; the service creates a new revision and preserves the old history. The agent can change only internal knowledge, using verified owner guidance or a current approved source. It cannot edit public pages or articles.
 
@@ -372,7 +386,7 @@ The support agent has its own system prompt plus the versioned private business
 | --- | --- | --- |
 | `knowledge_read` | `query`, `id` or `sourceId` | Search internal notes or read complete approved evidence. |
 | `history_read` | `before`, optional `query` | Retrieve up to ten older eligible messages in the assigned conversation under the `knowledge_read` grant; bounded to 6000 text characters. |
-| `knowledge_update` | Optional `id`; `title`, `body`, `expectedVersion`, `reason`, `evidenceKind`, `evidenceId`; source `evidenceVersion` | Available only in a restricted learning job. Update unlocked business facts from that job's assigned owner guidance or approved source revision. One-off guidance stays in the conversation. No public editing. |
+| `knowledge_update` | Optional `id` and legacy `expectedVersion`; `title`, `body`, `reason`, `evidenceKind`, `evidenceId`; source `evidenceVersion` | Available only in a restricted learning job. Update unlocked business facts from that job's assigned owner guidance or approved source revision. One-off guidance stays in the conversation. No public editing. |
 | `customer_read` | `sections` (`profile`, `notes`, `orders`, `activity`), optional `before` | Read only the request-bound verified customer. Notes page 25 at a time; orders page 20. A cursor must belong to that same customer and site. Order ownership ambiguity for an app identity returns `account_mapping_required`, with no orders. |
 | `verify_customer` | None | Request proof at the server-bound mailbox and pause. Resume unanswered work after confirmation and People projection. No recipient selector. |
 | `customer_update` | `name`/`phone`, `evidenceMessageId` | Enrich from an explicit customer statement; cannot change identity or permission. |

package/README.md

@@ -113,7 +113,7 @@ An explicit stock target already equal to the current count is a no-op. Repeatin
 
 ### AI Support Agent
 
-Included on Scale and internal sites after owner activation. Use `frontpage customer-inbox` for settings, knowledge and customer conversations. The command and API paths keep their existing names. See [AI Support Agent](./CUSTOMER-INBOX.md) for permissions, private guidance, takeover, verification and shared usage.
+Included on Scale and internal sites after owner activation. Use `frontpage customer-inbox` for settings, knowledge and customer conversations. Knowledge saves use last-save-wins. Read paginated revision history within the plan Rewind allowance, or archive a note to stop future use without deleting its records. The command and API paths keep their existing names. See [AI Support Agent](./CUSTOMER-INBOX.md) for permissions, private guidance, takeover, verification and shared usage.
 
 ### Website models and AI credits
 
@@ -122,3 +122,19 @@ GPT 6 Luna is the default for new website runs. Explicit site model preferences
 ### Template history
 
 Template history (0.3.11+): `frontpage mail template history ID` lists saved copies; `history-get ID --history-id COPY_ID` reads full content. Edit any copy and save with `template set ID --file content.json` to make it latest. Use the stable template ID, read current content before editing, and see [MAIL.md](./MAIL.md#template-history) for paging, access and retry-safe saves.
+
+## Uploaded video preparation
+
+The current CLI attempts browser-compatible H.264 MP4 preparation after a local video
+upload. This applies to `frontpage media upload` and `frontpage prompt --attach ./clip.mov`.
+Use the returned `sitePath`; do not reconstruct a path from the original filename.
+A successful conversion returns `prepared:true` and the MP4's actual filename, size and
+URL. If preparation fails, the original remains usable as an upload with `prepared:false`
+and a compatibility warning. Warnings print on stderr and appear in JSON success data.
+An original's MP4/MOV extension does not establish browser compatibility.
+
+`frontpage media list` and the website agent's `list_site_assets` prefer a completed
+prepared copy over its exact original. Different uploads with the same display name
+remain distinct. Existing URLs and published videos are not converted automatically.
+Upgrade the CLI to receive upload-time preparation. Source path and access denials
+remain errors; they do not become original-file fallback successes.

package/dist/commands/customer-inbox.js

@@ -5,7 +5,7 @@ import { takeFlag, assertNoUnknownFlags } from "../argv.js";
 import { getApiKey } from "../auth/keychain.js";
 import { apiBase, v1Get, httpErrorFromV1, CliHttpError, EXIT_AUTH, EXIT_USAGE, EXIT_OK, exitCodeForError, } from "../http/client.js";
 import { emitOk, emitErr, isJson } from "../runtime.js";
-const RESOURCE = /^(?:status|activation|address|widget|website|settings|knowledge(?:\/[0-9a-f-]+(?:\/history)?)?|sources(?:\/[0-9a-f-]+)?|blocks(?:\/[0-9a-f-]+\/unblock)?|jobs(?:\/[0-9a-f-]+(?:\/resume)?)?|files(?:\/[0-9a-f-]+)?|receipts(?:\/[0-9a-f-]+)?|conversations(?:\/[0-9a-f-]+(?:\/(?:messages|routing|guidance|reply|control|state|revoke-sessions|verification))?)?)(?:\?[^#]*)?$/;
+const RESOURCE = /^(?:status|activation|address|widget|website|settings|knowledge(?:\/[0-9a-f-]+(?:\/(?:history|archive))?)?|sources(?:\/[0-9a-f-]+)?|blocks(?:\/[0-9a-f-]+\/unblock)?|jobs(?:\/[0-9a-f-]+(?:\/resume)?)?|files(?:\/[0-9a-f-]+)?|receipts(?:\/[0-9a-f-]+)?|conversations(?:\/[0-9a-f-]+(?:\/(?:messages|routing|guidance|reply|control|state|revoke-sessions|verification))?)?)(?:\?[^#]*)?$/;
 export function inboxCommand(args) {
     const work = [...args], verb = work.shift(), resource = work.shift(), file = takeFlag(work, "--file"), key = takeFlag(work, "--request-key"), out = takeFlag(work, "--out");
     assertNoUnknownFlags(work, "customer-inbox");

package/dist/commands/prompt-attach.d.ts

@@ -23,6 +23,7 @@ export type PromptAttachmentsPayload = {
         url: string;
         name?: string;
         sizeBytes?: number;
+        warning?: string;
     }>;
 };
 export type MediaUploadResult = UploadedMedia;

package/dist/commands/prompt-attach.js

@@ -101,8 +101,9 @@ export function addUploadResult(out, data) {
             if (!out.videos.some((x) => x.url === data.url)) {
                 out.videos.push({
                     url: data.url,
-                    name,
+                    name: data.prepared ? data.filename ?? name : name,
                     sizeBytes: data.sizeBytes,
+                    ...(data.warning ? { warning: data.warning } : {}),
                 });
             }
             return;
@@ -122,7 +123,7 @@ export async function uploadLocalForAttach(slug, filePath) {
     return uploadLocalMedia({ slug, filePath });
 }
 export async function resolveSitePathUrl(slug, sitePath) {
-    const data = await v1Get(`/api/v1/sites/${encodeURIComponent(slug)}/media`);
+    const data = await v1Get(`/api/v1/sites/${encodeURIComponent(slug)}/media?path=${encodeURIComponent(sitePath.replace(/\/+/g, "/").replace(/\/$/, ""))}`);
     const norm = (p) => p.replace(/\/+/g, "/").replace(/\/$/, "") || p;
     const want = norm(sitePath);
     const hit = data.assets.find((a) => a.sitePath === sitePath || norm(a.sitePath) === want);

package/dist/media/upload.d.ts

@@ -8,6 +8,8 @@ export type UploadedMedia = {
     contentType?: string;
     content?: string;
     transport?: "proxy" | "client";
+    prepared?: boolean;
+    warning?: string;
 };
 /** Upload a local file using the Phase E transport matrix. */
 export declare function uploadLocalMedia(args: {

package/dist/media/upload.js

@@ -5,7 +5,7 @@ import { randomUUID } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { basename } from "node:path";
 import { put } from "@vercel/blob/client";
-import { apiBase, CliHttpError, EXIT_AUTH, EXIT_UNEXPECTED, EXIT_USAGE, getBearerAuthHeader, httpErrorFromV1, v1PostMultipart, } from "../http/client.js";
+import { apiBase, CliHttpError, EXIT_AUTH, EXIT_UNEXPECTED, EXIT_USAGE, getBearerAuthHeader, httpErrorFromV1, v1PostMultipart, v1Post, } from "../http/client.js";
 import { contentTypeForExt, sitePathFromKey } from "./limits.js";
 import { selectMediaTransport } from "./select-transport.js";
 async function requestClientToken(args) {
@@ -81,7 +81,7 @@ async function uploadViaClient(args) {
             multipart,
         });
         const key = blob.pathname.replace(/^\//, "");
-        return {
+        const original = {
             kind: args.kind,
             url: blob.url,
             key,
@@ -91,8 +91,28 @@ async function uploadViaClient(args) {
             contentType: args.contentType || contentTypeForExt(args.ext),
             transport: "client",
         };
+        if (args.kind !== "video")
+            return original;
+        try {
+            const prepared = await v1Post(`/api/v1/sites/${encodeURIComponent(args.slug)}/media/prepare`, { key, filename: args.filename }, { timeoutMs: 110000 });
+            if (typeof prepared.url !== "string" || typeof prepared.sitePath !== "string" || typeof prepared.filename !== "string" || typeof prepared.prepared !== "boolean")
+                throw new Error("Invalid video preparation response");
+            const result = { ...prepared, transport: "client" };
+            if (result.warning)
+                console.error(result.warning);
+            return result;
+        }
+        catch (error) {
+            if (error instanceof CliHttpError && error.status >= 400 && error.status < 500 && ![408, 429].includes(error.status))
+                throw error;
+            const warning = "Uploaded original video. Some browsers may not play this format.";
+            console.error(warning);
+            return { ...original, prepared: false, warning };
+        }
     }
     catch (err) {
+        if (err instanceof CliHttpError)
+            throw err;
         const msg = err instanceof Error ? err.message : String(err);
         throw new CliHttpError(`Upload failed: ${msg}`, EXIT_UNEXPECTED, 500);
     }

package/dist/registry.js

@@ -407,6 +407,9 @@ export const COMMANDS = [
         ],
         flags: [
             "Auto-selects proxy (≤4 MB) vs direct-to-Blob for large rasters/PDFs and all video",
+            "Video uploads then attempt browser-compatible MP4 preparation; use the returned sitePath",
+            "Preparation failure keeps the original with a stderr warning and prepared:false in JSON",
+            "media list prefers an exact completed prepared video over its original",
             "Human success: sitePath first (markup-safe), then url: (blob URL for debugging)",
             "Use sitePath (/__media/uploads/<slug>/…) in markup — never raw blob hosts in pages",
             "Text/CSV upload is inline only — not a media-library asset (no /__media link); --json omits full content",
@@ -425,12 +428,16 @@ export const COMMANDS = [
             "frontpage customer-inbox put settings --file ./inbox-settings.json --request-key settings_revision_1",
             "frontpage customer-inbox get conversations",
             "frontpage customer-inbox get knowledge",
+            "frontpage customer-inbox get 'knowledge/NOTE_UUID/history?limit=20'",
+            "frontpage customer-inbox post knowledge/NOTE_UUID/archive --file archive.json --request-key archive_note_001",
         ],
         flags: [
             "Available on Scale and internal sites after owner activation; no pilot allowlist",
             "Writes require a stable --request-key and a JSON file; reuse both on retries",
             "Human CLI and owner-agent tools manage authorized conversations; customer support tools stay bound to the verified customer",
             "Luna and 10× AI billing are fixed",
+            "Knowledge uses last-save-wins; history follows plan Rewind limits and always includes the latest revision",
+            "Archive knowledge with {} to stop future use while keeping the note and history",
             "Full request examples: CUSTOMER-INBOX.md",
         ],
         seeAlso: ["people", "usage"],

package/llms.txt

@@ -59,3 +59,7 @@ The workspace validates and saves unfinished group settings before opening email
 Complete Store edits: use existing items update --file with changed fields and variantUpdates. stock requires expectedStock from a fresh items get. One transaction saves all changes or none. On 409 review current stock; never silently substitute it. firstVariant plus optionNames enables versions. Keep explicit stock/variant commands for single operations. Routines add accepts --request-id UUID; reuse that ID and exact schedule after a lost response. Ordinary form edits live only in the active task; Cancel keeps input, Discard loses unfinished input. Submitted payments, imports, builds, and API-key status are separate operations.
 
 Template history (frontpage-host 0.3.11+): read `mail template get ID` before editing. `mail template history ID --limit 20 --cursor CURSOR` pages saved copies; `mail template history-get ID --history-id COPY_ID` fetches full content. Edit any copy, then `mail template set ID --file content.json` with the stable template ID and content fields only to make a new latest copy. Last template save wins; past copies remain. Campaign and series conflict checks remain. Retry uncertain saves through `mail save` with the same requestKey and exact payload. History begins with content retained at launch; earlier overwritten edits are unavailable. History reads use the plan’s Rewind window and always include Latest, even when older. Older copies stay stored; lists and direct reads apply the same limit. Window metadata explains the limit and whether older copies exist. See MAIL.md.
+
+Video uploads: the current CLI prepares a browser-compatible MP4 after uploading a local video, including prompt --attach. Use the returned sitePath and actual filename. prepared:false plus warning means the original was retained and playback compatibility is not assured. media list prefers an exact completed prepared copy. Existing video URLs are unchanged. See AGENTS.md for the upload and fallback contract.
+
+AI Support Agent knowledge: read the latest note, then save the same ID. Last save wins and prior saved changes remain in history. Knowledge history supports limit/cursor and version reads within the plan Rewind allowance plus the latest version. Archive with customer-inbox post knowledge/ID/archive and {} to stop future use without deleting records. See CUSTOMER-INBOX.md.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frontpage-host",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "description": "Frontpage CLI — manage your site from the terminal",
   "type": "module",
   "bin": {