Take a video uploaded in a Content page as a private Clip bound to the page

templates/clips/.agents/skills/video-sharing/SKILL.md

@@ -143,6 +143,11 @@ A Clip placed in a Content document has one `recording_content_bindings` row per
 - The token is signed with `CONTENT_CLIPS_PEER_SECRET` (`clips.contentPeerSecret`, read with `resolveContentClipsPeerSecret`), a secret only the Content and Clips deployments hold, and Clips verifies it with that secret alone. That is what makes the token's issuer trustworthy as the Content app: a token signed with the deployment `A2A_SECRET` or a workspace secret is refused, because other apps hold those. While the secret is unset, shorter than 32 characters, or equal to `A2A_SECRET`, every route answers 503 with code `content_clips_not_configured`; set it on both deployments.
 - Playback returns Clips media URLs with a five-minute `content_grant` that names the reader, not a role. The grant is signed with a key derived from `CONTENT_CLIPS_PEER_SECRET`, never the app's own server secret (which a workspace derives from `A2A_SECRET`), and a media request carrying a grant while the secret is unusable gets the same 503. `/api/video` and `/api/thumbnail` re-run every gate on each request, so trashing the binding stops a URL already handed out. An expired grant is a 403 with code `content_grant_expired`; Content's player then asks Content for playback again, which re-checks document access.
 - Each reader's reads and writes of one Clip through one document are rate-limited per process. A request counts against the Clip's bucket only once Clips has opened it: Content mints a token for any recording id a page reader names, so counting earlier would let a reader name made-up ids until their own spent bucket dropped out. A full map drops its oldest bucket rather than refuse a new one. A request whose Clip doesn't open counts as a miss against that reader's misses for that Clip and document; once they are spent, the Clip is refused before any database read. Misses are kept per Clip so made-up ids can't use up a real Clip's, which leaves a caller who keeps naming new made-up ids unbounded here: each costs one lookup, and Content's own per-visitor limit has to bound it. Every signed-out reader of a document shares the public reader's buckets.
+- A Content editor's upload uses the `content-clip:upload` scope, whose token carries `document_id`, the editor's `name`, and the browser's `client_ip` when Content knows it, never a `recording_id`. Content checks that the reader can edit the page before minting it. `GET /api/content-clips/upload-status` answers the editor's `storage` state (`ready`, `free` with what's left, `used_up`, `none`, or `account_required` when the email has no Clips account or workspace; Clips never makes either). `POST /api/content-clips/uploads` adds the `upload` binding first, then a private recording the editor owns, and returns a ticketed `chunkUrl` and `cancelUrl`; a state that can't take the file is a 409 `storage_required` with that `storage`. The start carries the `uploadKey` Content makes once per picked file, kept on the binding with the file's type and size: a start repeated with the same key, page, and editor never makes a second Clip. It answers that upload with another ticket and the first start's plan while it is uploading, a 409 `upload_already_finished` with `recordingId` and `status` once a final chunk holds it or Clips is making the Clip, a 409 `upload_starting` while the latest start is still making its recording (Content repeats it after a few seconds), or a 409 `upload_key_used` when it was cancelled or failed, is parked until storage is connected, began in another block, or describes a file of another type or size. A start that fails deletes its binding only when nothing can be left: a refusal raised before any recording or free clip (`refusedStart`), or an error with `cleanupConfirmed: true`. Any other failure keeps the binding and marks `upload_start_failed_at`, and a repeat that finds no recording under a marked binding, or one whose latest attempt is `RESERVATION_GRACE_MS` old, takes the start over with a compare-and-swap on the binding (`takeOverStart`) and makes the recording under the binding's own recording id, so the free clip reserved per recording id is never held twice; of repeats that overlap, the rest get `upload_starting`. A kept binding whose start left a recording answers from where that upload stands, so one whose recording failed answers `upload_key_used` like a cancelled one; that key's upload ended, and Content starts the file again under a new key. Earlier tickets keep working, since overlapping repeats each hand one back: a recording keeps its four newest (`addRecordingUploadTicket`) and still holds one upload slot, while an agent's `create-recording-upload` keeps one. A repeat skips the storage check, since its first start may have taken the last free clip.
+- The editor's browser posts the file to `/api/uploads/:recordingId/content-chunk` with the ticket in the query, no cookie, and no custom headers, so the request is a CORS simple request and no preflight reaches the auth guard. Only the paired built-in Content's origin (`pairedContentOrigin`) gets `Access-Control-Allow-Origin`, never the request's own `Origin`, and the answer never allows credentials.
+- When the page gives an upload up (its block is gone, the editor can no longer edit, or a chunk failed for good), the browser POSTs `cancelUrl` (`/api/uploads/:recordingId/content-cancel?ticket=…`) the same way. Clips' own abort fails the recording and releases its free clip, as the lease reaper would an hour later; the `upload` binding stays. Where an upload stands is one answer, `readUploadPhase` in `server/lib/final-chunk-claim.ts`: `uploading`, `finishing` (a final chunk holds it), `parked` (Clips has the whole file and waits for storage), `finished` (`processing` or `ready`) or `ended` (cancelled or failed). The repeated start, the cancel and the Content chunk route all use it, and nothing else reads its three stores (the final chunk's claim, the upload state and the recording row) together. It reads the claim first, then the upload state, then the row. Before Clips takes the final chunk's bytes, on the buffered and the resumable path alike, the Content chunk route renews the row's lease to outlast its claim, only while the row is `uploading`, then claims the upload, changing its upload state with the same compare-and-swap the abort claims with; once Clips accepts the chunk it writes `parked` or `finished` into the upload state, and only then gives the claim up, so a reader that finds no claim finds where the upload went. A final chunk that fails gives the claim up with the upload still `uploading`. A claim older than `FINAL_CHUNK_CLAIM_TTL_MS` (a little over Clips' 75 s function timeout) was left by a request that was cut off, so the upload reads `uploading` again and the next final chunk or cancel takes it over. A live claim is never taken over: a cancel or another send of the final chunk changes nothing while the upload is `finishing` and answers 409 `upload_finishing` (`CONTENT_CLIP_CHUNK_FINISHING` for the chunk), which Content repeats every few seconds, the chunk for a little longer than the claim lasts. A final chunk sent once the upload is `parked` or `finished` answers the first one's success (202 `waitingForStorage`, or 200 with `status`) and Clips takes no bytes; one that finds the upload `ended` is refused (409). The answer's `outcome` comes from the phase read after the abort, never from the abort's `ok`: `cancelled` (200) once it is `ended`, a repeat included and a parked upload too, or `already_finished` (409, with `status`) once it is `finished`. Any other answer means it wasn't cancelled; an upload whose cancels keep finding `finishing` is left to the reaper. The reaper reads only the row's lease, never the phase: it fails a row whose lease ran out in one conditional update, so it either failed the row before the final chunk renewed it, and the chunk finds it `ended`, or it leaves the row. A page in Trash can still cancel. A closed tab is still left to the reaper.
+- Upload-origin Clips are listed under From Content (`list-recordings` view `from-content`, each with `contentPageUrl` back to its page), and Library's own list leaves them out. A folder someone moved one into still lists it, and linked Clips stay in Library.
+- `isActiveUploadBinding` / `activeUploadBinding()` in `server/lib/content-uploads.ts` is the one test for an active upload binding. Playback's grant, the chunk route, From Content and its page links all use it, so an upload whose page is in Trash plays for no document reader, takes no chunks (409), and lists in neither From Content nor Library.
 - Create and change binding rows only through Content's upload and lifecycle flows.
 
 ## Embed URLs

templates/clips/actions/create-recording-upload.test.ts

@@ -158,6 +158,7 @@ describe("create-recording-upload", () => {
     expect(mocks.releaseRecordingUploadTicket).toHaveBeenCalledWith(
       "owner@example.com",
       "rec-1",
+      "hash",
     );
   });
 

templates/clips/actions/create-recording-upload.ts

@@ -3,17 +3,11 @@ import {
   getAppProductionUrl,
   getRequestContext,
 } from "@agent-native/core/server";
-import { UPLOAD_SLICE_BYTES } from "@shared/recording-core.js";
 import { formatUploadBytes, MAX_UPLOAD_BYTES } from "@shared/upload-limits.js";
 import { z } from "zod";
 
 import { getServerAppBasePath } from "../server/lib/public-agent-context.js";
-import {
-  createRecordingUploadTicket,
-  releaseRecordingUploadTicket,
-} from "../server/lib/recording-upload-ticket.js";
-import { getCurrentOwnerEmail, nanoid } from "../server/lib/recordings.js";
-import createRecording from "./create-recording.js";
+import { startRecordingUpload } from "../server/lib/recording-upload-start.js";
 
 const MAX_UPLOAD_SIZE = formatUploadBytes(MAX_UPLOAD_BYTES, "down");
 
@@ -78,78 +72,35 @@ export default defineAction({
       .describe("Video height in pixels."),
   }),
   run: async (args, actionContext) => {
-    const ownerEmail = getCurrentOwnerEmail();
-    // The ticket comes first: if it is refused or fails to save, no recording
-    // is left stranded in "uploading" with nothing able to finish it.
-    const recordingId = nanoid();
-    const ticket = await createRecordingUploadTicket(
-      ownerEmail,
-      recordingId,
-      getRequestContext()?.authUserId,
+    const upload = await startRecordingUpload(
+      {
+        title: args.title,
+        visibility: args.visibility,
+        mimeType: args.mimeType,
+        sizeBytes: args.sizeBytes,
+        durationMs: args.durationMs,
+        width: args.width,
+        height: args.height,
+        recordingSource: "agent_upload",
+      },
+      actionContext,
     );
-    let created: Awaited<ReturnType<typeof createRecording.run>>;
-    try {
-      created = await createRecording.run(
-        {
-          id: recordingId,
-          title: args.title,
-          visibility: args.visibility,
-          mimeType: args.mimeType,
-          sizeBytes: args.sizeBytes,
-          width: args.width,
-          height: args.height,
-          hasAudio: true,
-          hasCamera: false,
-          recordingSource: "agent_upload",
-          requestStreaming: true,
-        },
-        actionContext,
-      );
-    } catch (error) {
-      // create-recording fails its own half-made row, or the lease reaper does;
-      // only the ticket, which the agent never received, is ours to release.
-      await releaseRecordingUploadTicket(ownerEmail, recordingId).catch(
-        (releaseError) => {
-          console.warn("[create-recording-upload] ticket release failed", {
-            recordingId,
-            error:
-              releaseError instanceof Error
-                ? releaseError.message
-                : String(releaseError),
-          });
-        },
-      );
-      throw error;
-    }
-
+    const { recordingId, totalChunks } = upload;
     const appUrl = `${new URL(getRequestContext()?.requestOrigin || getAppProductionUrl()).origin}${getServerAppBasePath()}`;
-    const totalChunks = Math.max(
-      1,
-      Math.ceil(args.sizeBytes / UPLOAD_SLICE_BYTES),
-    );
-    const query = new URLSearchParams({
-      mimeType: args.mimeType,
-      total: String(totalChunks),
-      hasAudio: "1",
-      hasCamera: "0",
-    });
-    if (args.durationMs) query.set("durationMs", String(args.durationMs));
-    if (args.width) query.set("width", String(args.width));
-    if (args.height) query.set("height", String(args.height));
 
     return {
-      recordingId: created.id,
+      recordingId,
       visibility: args.visibility,
-      shareUrl: `${appUrl}/share/${encodeURIComponent(created.id)}`,
+      shareUrl: `${appUrl}/share/${encodeURIComponent(recordingId)}`,
       method: "POST" as const,
-      chunkUrl: `${appUrl}/api/uploads/${encodeURIComponent(created.id)}/agent-chunk?${query.toString()}`,
+      chunkUrl: `${appUrl}/api/uploads/${encodeURIComponent(recordingId)}/agent-chunk?${upload.chunkQuery.toString()}`,
       headers: {
-        Authorization: `Bearer ${ticket.token}`,
+        Authorization: `Bearer ${upload.ticket}`,
         "Content-Type": args.mimeType,
       },
-      chunkSizeBytes: UPLOAD_SLICE_BYTES,
+      chunkSizeBytes: upload.chunkSizeBytes,
       totalChunks,
-      expiresAt: new Date(ticket.expiresAt).toISOString(),
+      expiresAt: upload.expiresAt,
       next: `Split the file into ${totalChunks} chunk(s) of chunkSizeBytes (the last may be shorter). POST them one at a time, in order, as the raw request body to chunkUrl + "&index=N&isFinal=0" with the returned headers, N counting from 0. Send the last chunk with "&isFinal=1": that request finalizes the recording, so do not call finalize-recording. Retry a failed chunk with the same index. The upload URL stops working once the last chunk is accepted (a retried last chunk then gets 409 saying so; read the clip with get-recording-player-data rather than uploading again) or at expiresAt. Then give the user shareUrl; transcription, and a title when none was given, follow in the background.`,
     };
   },

templates/clips/actions/list-organization-state.test.ts

@@ -28,6 +28,10 @@ vi.mock("../server/lib/agent-recording-access.js", () => ({
   isAgentRecordingCaller: () => false,
 }));
 
+vi.mock("../server/lib/content-uploads.js", () => ({
+  uploadFromTrashedPage: () => ({ op: "upload-from-trashed-page" }),
+}));
+
 vi.mock("../server/lib/recordings.js", () => ({
   getActiveOrganizationId: (...args: unknown[]) =>
     mockGetActiveOrganizationId(...args),
@@ -62,6 +66,7 @@ vi.mock("drizzle-orm", () => ({
   eq: (...args: unknown[]) => ({ op: "eq", args }),
   isNotNull: (...args: unknown[]) => ({ op: "isNotNull", args }),
   isNull: (...args: unknown[]) => ({ op: "isNull", args }),
+  not: (...args: unknown[]) => ({ op: "not", args }),
   notExists: (...args: unknown[]) => ({ op: "notExists", args }),
   or: (...args: unknown[]) => ({ op: "or", args }),
   sql: () => ({ raw: "sql" }),
@@ -85,7 +90,7 @@ function builder(
     "groupBy",
     "limit",
   ]) {
-    b[method] = () => b;
+    b[method] = vi.fn(() => b);
   }
   b.then = (
     resolve: (value: unknown) => unknown,
@@ -224,5 +229,12 @@ describe("list-organization-state action", () => {
     expect(result.folders).toEqual([
       expect.objectContaining({ id: "f1", recordingCount: 2 }),
     ]);
+    expect(builders[5].where).toHaveBeenCalledWith(
+      expect.objectContaining({
+        args: expect.arrayContaining([
+          { op: "not", args: [{ op: "upload-from-trashed-page" }] },
+        ]),
+      }),
+    );
   });
 });

templates/clips/actions/list-organization-state.ts

@@ -13,6 +13,7 @@ import {
   eq,
   isNotNull,
   isNull,
+  not,
   notExists,
   or,
   sql,
@@ -24,6 +25,7 @@ import {
   agentRecordingAccessFilter,
   isAgentRecordingCaller,
 } from "../server/lib/agent-recording-access.js";
+import { uploadFromTrashedPage } from "../server/lib/content-uploads.js";
 import { recordingExpiryQuery } from "../server/lib/recording-expiry-query.js";
 import {
   getActiveOrganizationId,
@@ -178,6 +180,7 @@ export default defineAction({
             recordingExpiryQuery(ownerEmail).available,
             isNull(schema.recordings.archivedAt),
             isNull(schema.recordings.trashedAt),
+            not(uploadFromTrashedPage()),
             notExists(
               db
                 .select({ one: sql`1` })

templates/clips/actions/list-recordings.expiry.test.ts

@@ -107,6 +107,7 @@ describe("list recordings expiry with PostgreSQL", () => {
       schema.recordingComments,
       schema.recordingReactions,
       schema.recordingEvents,
+      schema.recordingContentBindings,
       schema.meetings,
       schema.meetingShares,
       schema.meetingParticipants,

templates/clips/actions/list-recordings.test.ts

@@ -150,6 +150,10 @@ vi.mock("../server/db/index.js", () => ({
       trashedAt: "recordings.trashedAt",
     }),
     recordingShares: "recordingShares",
+    recordingContentBindings: {
+      recordingId: "recordingContentBindings.recordingId",
+      origin: "recordingContentBindings.origin",
+    },
     recordingTags: mockTables.recordingTags,
     recordingViews: Object.assign(mockTables.recordingViews, {
       recordingId: "recordingViews.recordingId",