@agent-native/core-corpus 0.216.0 → 0.217.0

package/corpus/templates/content/actions/_database-view-setup.ts

@@ -15,12 +15,14 @@ import {
 import {
   CONTENT_DATABASE_ITEM_LAYOUT_PRESET_IDS,
   CONTENT_DATABASE_ITEM_LEADING_KINDS,
+  CONTENT_DATABASE_ITEM_LINE2_SOURCES,
   CONTENT_DATABASE_ITEM_TITLE_WEIGHTS,
   MAX_ITEM_LAYOUT_META_PROPERTIES,
   contentDatabaseItemLayoutPresets,
   contentDatabaseItemLayoutReferenceErrors,
   dropDeletedContentDatabaseItemLayoutReferences,
   itemLayoutLeadingCandidates,
+  itemLayoutLine2Candidates,
   normalizeContentDatabaseItemLayout,
   pruneContentDatabaseItemLayout,
   savableContentDatabaseItemLayout,
@@ -118,6 +120,7 @@ export const contentDatabaseItemLayoutSchema = z
     titleWeight: z.enum(CONTENT_DATABASE_ITEM_TITLE_WEIGHTS),
     line2: z
       .object({
+        source: z.enum(CONTENT_DATABASE_ITEM_LINE2_SOURCES).optional(),
         propertyId: itemLayoutPropertyIdSchema.nullable(),
         lines: itemLayoutLinesSchema,
       })
@@ -139,6 +142,7 @@ const itemLayoutPatchSchema = z
     titleWeight: z.enum(CONTENT_DATABASE_ITEM_TITLE_WEIGHTS).optional(),
     line2: z
       .object({
+        source: z.enum(CONTENT_DATABASE_ITEM_LINE2_SOURCES).optional(),
         propertyId: itemLayoutPropertyIdSchema.nullable().optional(),
         lines: itemLayoutLinesSchema.optional(),
       })
@@ -149,7 +153,7 @@ const itemLayoutPatchSchema = z
   })
   .strict()
   .describe(
-    "List views only. Slots to change in each row; omitted slots keep their saved value. leading.kind checkbox or status uses the first property of that type unless propertyId names one. line2 shows a text, URL, or Blocks property; line3 and trailing list property IDs in order. Trailing values move under the title on narrow screens. Pass null to restore the default rows.",
+    "List views only. Slots to change in each row; omitted slots keep their saved value. leading.kind checkbox or status uses the first property of that type unless propertyId names one. line2 shows a text, URL, or Blocks property, or with source page the first lines of each row's page; line3 and trailing list property IDs in order. Trailing values move under the title on narrow screens. Pass null to restore the default rows.",
   );
 
 const listPatchFields = {
@@ -467,6 +471,17 @@ function nextListItemLayout(
     const ids = itemLayout[slot];
     if (ids) uniqueReferences(ids, slot);
   }
+  if (itemLayout.line2?.source === "page" && itemLayout.line2.propertyId) {
+    setupError(
+      "INVALID_VIEW_REFERENCE",
+      "line2.propertyId must be null or left out when line2.source is page.",
+      400,
+    );
+  }
+  // Naming a property switches line 2 back from page text.
+  const line2Source =
+    itemLayout.line2?.source ??
+    (itemLayout.line2?.propertyId !== undefined ? "property" : undefined);
   const leading = itemLayout.leading && {
     kind: itemLayout.leading.kind,
     propertyId:
@@ -480,10 +495,14 @@ function nextListItemLayout(
       leading: leading ?? from.leading,
       titleWeight: itemLayout.titleWeight ?? from.titleWeight,
       line2: {
+        source: line2Source ?? from.line2.source,
         propertyId:
           itemLayout.line2?.propertyId !== undefined
             ? itemLayout.line2.propertyId
-            : from.line2.propertyId,
+            : line2Source === "property" && from.line2.source === "page"
+              ? (itemLayoutLine2Candidates(properties)[0]?.definition.id ??
+                null)
+              : from.line2.propertyId,
         lines: itemLayout.line2?.lines ?? from.line2.lines,
       },
       line3: itemLayout.line3 ?? from.line3,

package/corpus/templates/content/actions/_delete-content-space.ts

@@ -1,6 +1,7 @@
 import { and, eq } from "drizzle-orm";
 
 import { getDb, schema } from "../server/db/index.js";
+import { cleanupBuilderPrivatePayload } from "./_builder-cms-blob-custody.js";
 import { resolveContentSpaceAccess } from "./_content-space-access.js";
 import {
   deleteDocumentRootsRecursive,
@@ -11,7 +12,8 @@ type Db = ReturnType<typeof getDb>;
 const MAX_DELETE_SCOPE_ATTEMPTS = 3;
 
 async function deleteUserContentSpaceOnce(db: Db, spaceId: string) {
-  return db.transaction(async (tx) => {
+  const deletedBlobReferences = new Set<string>();
+  const result = await db.transaction(async (tx) => {
     const scopedDb = tx as unknown as Db;
     const access = await resolveContentSpaceAccess(spaceId, "editor", {
       db: scopedDb,
@@ -53,6 +55,7 @@ async function deleteUserContentSpaceOnce(db: Db, spaceId: string) {
       scopedDb,
       [mapping.documentId, filesDatabase.documentId],
       access.space.ownerEmail,
+      deletedBlobReferences,
     );
 
     const remainingDocuments = await scopedDb
@@ -79,6 +82,10 @@ async function deleteUserContentSpaceOnce(db: Db, spaceId: string) {
       deletedDocuments: deletedDocuments.length,
     };
   });
+  for (const reference of deletedBlobReferences) {
+    await cleanupBuilderPrivatePayload(reference, "deleted workspace source");
+  }
+  return result;
 }
 
 export async function deleteUserContentSpace(db: Db, spaceId: string) {

package/corpus/templates/content/actions/_github-source-freshness.ts

@@ -26,6 +26,12 @@ export const GITHUB_SOURCE_STALE_MS = 60_000;
 const READ_SYNC_BUDGET_MS = 3_000;
 /** One link's share of a background sync, which has 90 seconds in all. */
 const SWEEP_SYNC_BUDGET_MS = 20_000;
+/**
+ * The share of a link partway through a push, like a big folder's first fill.
+ * It stops before the next background sync starts a minute later, so that one
+ * finds the link free and carries the push on.
+ */
+const SWEEP_PUSH_BUDGET_MS = 50_000;
 /** Links the background sync checks at once. */
 const SWEEP_CONCURRENCY = 4;
 /** The background sync skips links a read or another sync checked this recently. */
@@ -274,10 +280,25 @@ export async function runGitHubSourceSweep(context: RecurringSweepContext) {
       asc(sql`coalesce(${schema.contentDatabaseSources.lastRefreshedAt}, '')`),
     )
     .limit(SWEEP_MAX_LINKS);
+  // A link partway through a push goes after the rest, so a big folder's
+  // first fill doesn't hold up a push to a small one. Those links take turns
+  // by when a run last moved their push, oldest first. The query's order
+  // can't do that: a run partway through isn't a check, so it leaves
+  // lastRefreshedAt as it was, and the same link would go first every time.
+  const carrying = new Set(
+    due
+      .map((link) => ({ link, state: linkState(link.metadataJson) }))
+      .filter(({ state }) => state?.pendingCommitSha)
+      .sort((a, b) =>
+        (a.state?.checkedAt ?? "").localeCompare(b.state?.checkedAt ?? ""),
+      )
+      .map(({ link }) => link),
+  );
+  const order = [...due.filter((link) => !carrying.has(link)), ...carrying];
   let next = 0;
   const worker = async () => {
-    while (next < due.length) {
-      const link = due[next++]!;
+    while (next < order.length) {
+      const link = order[next++]!;
       const remaining = context.deadlineAt - Date.now();
       if (context.signal?.aborted || remaining < 2_000) return;
       const owner = linkedBy(link);
@@ -288,7 +309,12 @@ export async function runGitHubSourceSweep(context: RecurringSweepContext) {
           () =>
             syncGitHubSource({
               sourceId: link.sourceId,
-              budgetMs: Math.min(SWEEP_SYNC_BUDGET_MS, remaining - 1_000),
+              budgetMs: Math.min(
+                carrying.has(link)
+                  ? SWEEP_PUSH_BUDGET_MS
+                  : SWEEP_SYNC_BUDGET_MS,
+                remaining - 1_000,
+              ),
               signal: context.signal,
             }),
         );
@@ -303,6 +329,6 @@ export async function runGitHubSourceSweep(context: RecurringSweepContext) {
     }
   };
   await Promise.all(
-    Array.from({ length: Math.min(SWEEP_CONCURRENCY, due.length) }, worker),
+    Array.from({ length: Math.min(SWEEP_CONCURRENCY, order.length) }, worker),
   );
 }

package/corpus/templates/content/actions/add-content-database-source-field-property.ts

@@ -393,15 +393,23 @@ export default defineAction({
       throw new Error("The title source field is already mapped to Name.");
     }
 
-    let federationRole: string | null = null;
+    let sourceMetadata: {
+      builderSpacePublicKey?: unknown;
+      connectionId?: unknown;
+      federation?: { role?: unknown };
+    } = {};
     try {
-      const parsed = JSON.parse(source.metadataJson ?? "{}") as {
-        federation?: { role?: string };
-      };
-      federationRole = parsed.federation?.role ?? null;
+      const parsed = JSON.parse(source.metadataJson ?? "{}") as unknown;
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        sourceMetadata = parsed as typeof sourceMetadata;
+      }
     } catch {
-      federationRole = null;
+      sourceMetadata = {};
     }
+    const federationRole =
+      typeof sourceMetadata.federation?.role === "string"
+        ? sourceMetadata.federation.role
+        : null;
     const isSecondary = federationRole === "secondary";
 
     const materializeProperty = (
@@ -676,9 +684,18 @@ export default defineAction({
 
       const builderRead = await readBuilderCmsContentEntries({
         model: source.sourceTable,
+        expectedSourceSpace:
+          typeof sourceMetadata.builderSpacePublicKey === "string"
+            ? sourceMetadata.builderSpacePublicKey
+            : undefined,
+        expectedSourceConnectionId:
+          typeof sourceMetadata.connectionId === "string"
+            ? sourceMetadata.connectionId
+            : undefined,
         fieldPaths: [field.sourceFieldKey],
         limit: Math.max(BUILDER_FIELD_REFRESH_MINIMUM_LIMIT, error.rowCount),
         offset: 0,
+        requireBoundOAuth: true,
       });
       if (builderRead.state !== "live") {
         throw new Error(

package/corpus/templates/content/actions/cancel-prepared-builder-source-update.ts

@@ -1,7 +1,7 @@
-import { defineAction } from "@agent-native/core/action";
+import { defineAction, fail } from "@agent-native/core/action";
 import { getRequestUserEmail } from "@agent-native/core/server/request-context";
 import { assertAccess } from "@agent-native/core/sharing";
-import { and, eq, inArray } from "drizzle-orm";
+import { and, eq, inArray, isNull } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
@@ -9,6 +9,7 @@ import type {
   CancelPreparedBuilderSourceUpdateRequest,
   CancelPreparedBuilderSourceUpdateResponse,
 } from "../shared/api.js";
+import { readBuilderExecutionPayload } from "./_builder-cms-blob-custody.js";
 import {
   CANCELLED_BUILDER_EXECUTION_SUMMARY,
   CANCELLED_BUILDER_REVIEW_NOTE_PREFIX,
@@ -45,28 +46,63 @@ function isLocalBlockedDryRun(payload: Record<string, unknown>) {
   );
 }
 
+function isLivePreflightBlocked(payload: Record<string, unknown>) {
+  const preflight = payload.livePreflight;
+  if (!preflight || typeof preflight !== "object" || Array.isArray(preflight)) {
+    return false;
+  }
+  const record = preflight as Record<string, unknown>;
+  return (
+    typeof record.checkedAt === "string" &&
+    typeof record.exists === "boolean" &&
+    (record.lastUpdated === null ||
+      typeof record.lastUpdated === "number" ||
+      typeof record.lastUpdated === "string") &&
+    (record.blocksHash === null || typeof record.blocksHash === "string")
+  );
+}
+
+function isDefinitivelyRejectedWrite(payload: Record<string, unknown>) {
+  const response = payload.response;
+  if (!response || typeof response !== "object" || Array.isArray(response)) {
+    return false;
+  }
+  const record = response as Record<string, unknown>;
+  return (
+    record.ok === false &&
+    typeof record.status === "number" &&
+    Number.isInteger(record.status) &&
+    record.status >= 400 &&
+    record.status < 500
+  );
+}
+
 function assertProvablyPreDispatch(execution: {
   state: string;
   summary: string;
   payloadJson: string;
   attemptToken: string | null;
 }) {
-  if (!PRE_DISPATCH_STATES.has(execution.state)) {
+  const payload = parseExecutionPayload(execution.payloadJson);
+  const definitiveRejectedWrite =
+    (execution.state === "failed" || execution.state === "blocked") &&
+    isDefinitivelyRejectedWrite(payload);
+  if (!PRE_DISPATCH_STATES.has(execution.state) && !definitiveRejectedWrite) {
     throw new Error(
       `Cannot cancel a Builder execution in state ${execution.state}. Its outcome must be preserved.`,
     );
   }
-  if (execution.attemptToken) {
+  if (execution.attemptToken && !definitiveRejectedWrite) {
     throw new Error(
       "Cannot cancel this Builder update because a dispatch attempt was recorded.",
     );
   }
 
-  const payload = parseExecutionPayload(execution.payloadJson);
   if (
     Object.prototype.hasOwnProperty.call(payload, "response") ||
     Object.prototype.hasOwnProperty.call(payload, "dispatch")
   ) {
+    if (definitiveRejectedWrite) return;
     throw new Error(
       "Cannot cancel this Builder update because dispatch or response evidence was recorded.",
     );
@@ -74,7 +110,8 @@ function assertProvablyPreDispatch(execution: {
   if (
     execution.state === "blocked" &&
     execution.summary !== CANCELLED_BUILDER_EXECUTION_SUMMARY &&
-    !isLocalBlockedDryRun(payload)
+    !isLocalBlockedDryRun(payload) &&
+    !isLivePreflightBlocked(payload)
   ) {
     throw new Error(
       "Cannot cancel this blocked Builder update because it is not provably a local pre-dispatch block.",
@@ -111,7 +148,7 @@ function assertCanonicalClaims(
 
 export default defineAction({
   description:
-    "Cancel one exact prepared Builder update only when every execution is provably pre-dispatch. This never calls Builder or deletes audit history.",
+    "Cancel one exact prepared Builder update only when every execution never dispatched or Builder definitively rejected it. This never calls Builder or deletes audit history.",
   schema: z
     .object({
       databaseId: z.string().optional().describe("Collection ID"),
@@ -167,7 +204,7 @@ export default defineAction({
         .limit(1);
       if (!changeSet) throw new Error("Source change-set not found.");
 
-      const executions = await tx
+      const storedExecutions = await tx
         .select()
         .from(schema.contentDatabaseSourceExecutions)
         .where(
@@ -179,6 +216,24 @@ export default defineAction({
             ),
           ),
         );
+      const executions = await Promise.all(
+        storedExecutions.map(async (execution) => ({
+          ...execution,
+          storedPayloadJson: execution.payloadJson,
+          payloadJson: JSON.stringify(
+            await readBuilderExecutionPayload({
+              payloadJson: execution.payloadJson,
+              binding: {
+                ownerEmail: execution.ownerEmail,
+                sourceId: execution.sourceId,
+                changeSetId: execution.changeSetId,
+                executionId: execution.id,
+                idempotencyKey: execution.idempotencyKey,
+              },
+            }),
+          ),
+        })),
+      );
       executionIds = executions.map((execution) => execution.id);
 
       if (executions.length === 0) {
@@ -253,23 +308,40 @@ export default defineAction({
         );
       }
 
-      await tx
-        .update(schema.contentDatabaseSourceExecutions)
-        .set({
-          state: "blocked",
-          summary: CANCELLED_BUILDER_EXECUTION_SUMMARY,
-          lastError: null,
-          updatedAt: now,
-        })
-        .where(
-          and(
-            eq(schema.contentDatabaseSourceExecutions.sourceId, source.id),
-            eq(
-              schema.contentDatabaseSourceExecutions.changeSetId,
-              changeSet.id,
+      for (const execution of executions) {
+        const [updated] = await tx
+          .update(schema.contentDatabaseSourceExecutions)
+          .set({
+            state: "blocked",
+            summary: CANCELLED_BUILDER_EXECUTION_SUMMARY,
+            attemptToken: null,
+            lastError: null,
+            updatedAt: now,
+          })
+          .where(
+            and(
+              eq(schema.contentDatabaseSourceExecutions.id, execution.id),
+              eq(schema.contentDatabaseSourceExecutions.state, execution.state),
+              eq(
+                schema.contentDatabaseSourceExecutions.payloadJson,
+                execution.storedPayloadJson,
+              ),
+              execution.attemptToken
+                ? eq(
+                    schema.contentDatabaseSourceExecutions.attemptToken,
+                    execution.attemptToken,
+                  )
+                : isNull(schema.contentDatabaseSourceExecutions.attemptToken),
             ),
-          ),
-        );
+          )
+          .returning({ id: schema.contentDatabaseSourceExecutions.id });
+        if (!updated) {
+          fail(
+            "Cannot cancel this Builder update because an execution changed before cancellation committed.",
+            { errorCode: "builder_update_changed", statusCode: 409 },
+          );
+        }
+      }
 
       const noteSuffix = args.note?.trim() ? ` Note: ${args.note.trim()}` : "";
       await tx.insert(schema.contentDatabaseSourceChangeReviews).values({
@@ -284,10 +356,22 @@ export default defineAction({
         note: `${CANCELLED_BUILDER_REVIEW_NOTE_PREFIX} by ${actor} at ${now}.${noteSuffix}`,
         createdAt: now,
       });
-      await tx
+      const [rejectedChangeSet] = await tx
         .update(schema.contentDatabaseSourceChangeSets)
         .set({ state: "rejected", updatedAt: now })
-        .where(eq(schema.contentDatabaseSourceChangeSets.id, changeSet.id));
+        .where(
+          and(
+            eq(schema.contentDatabaseSourceChangeSets.id, changeSet.id),
+            eq(schema.contentDatabaseSourceChangeSets.state, changeSet.state),
+          ),
+        )
+        .returning({ id: schema.contentDatabaseSourceChangeSets.id });
+      if (!rejectedChangeSet) {
+        fail(
+          "Cannot cancel this Builder update because its review state changed before cancellation committed.",
+          { errorCode: "builder_update_changed", statusCode: 409 },
+        );
+      }
       await tx
         .update(schema.contentDatabaseSources)
         .set({ updatedAt: now })

package/corpus/templates/content/actions/change-content-database-source-role.ts

@@ -1,4 +1,4 @@
-import { defineAction } from "@agent-native/core/action";
+import { defineAction, fail } from "@agent-native/core/action";
 import { assertAccess } from "@agent-native/core/sharing";
 import { and, asc, eq, inArray, isNull, ne, sql } from "drizzle-orm";
 import { z } from "zod";
@@ -135,6 +135,33 @@ function sourceRole(source: SourceRecord): "primary" | "secondary" | null {
   }
 }
 
+function builderSourceReadBinding(source: SourceRecord) {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(source.metadataJson ?? "{}");
+  } catch {
+    fail("Builder source connection metadata is unreadable.", {
+      errorCode: "builder_source_binding_invalid",
+      statusCode: 412,
+    });
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    fail("Builder source connection metadata is unreadable.", {
+      errorCode: "builder_source_binding_invalid",
+      statusCode: 412,
+    });
+  }
+  const metadata = parsed as Record<string, unknown>;
+  return {
+    expectedSourceSpace:
+      typeof metadata.builderSpacePublicKey === "string"
+        ? metadata.builderSpacePublicKey
+        : null,
+    expectedSourceConnectionId:
+      typeof metadata.connectionId === "string" ? metadata.connectionId : null,
+  };
+}
+
 async function clearSourceFederation(sourceId: string, now: string) {
   await mutateContentDatabaseSourceMetadata({
     sourceId,
@@ -235,6 +262,8 @@ export async function readBuilderCmsEntriesForRoleChange(
   args: {
     model: string;
     existingFieldPaths?: readonly string[];
+    expectedSourceSpace?: string | null;
+    expectedSourceConnectionId?: string | null;
   },
   dependencies: {
     readModelFields?: typeof readBuilderCmsModelFields;
@@ -247,7 +276,11 @@ export async function readBuilderCmsEntriesForRoleChange(
   let modelFields: BuilderCmsModelFieldSummary[] = [];
   let modelFieldsError: unknown = null;
   try {
-    modelFields = await readModelFields({ model: args.model });
+    modelFields = await readModelFields({
+      model: args.model,
+      expectedSourceSpace: args.expectedSourceSpace,
+      expectedSourceConnectionId: args.expectedSourceConnectionId,
+    });
   } catch (error) {
     modelFieldsError = error;
   }
@@ -257,14 +290,23 @@ export async function readBuilderCmsEntriesForRoleChange(
       ...(args.existingFieldPaths ?? []),
       ...modelFields.map((field) => `data.${field.name}`),
     ],
+    expectedSourceSpace: args.expectedSourceSpace,
+    expectedSourceConnectionId: args.expectedSourceConnectionId,
+    requireBoundOAuth: true,
   });
   if (modelFieldsError) throw modelFieldsError;
+  if (read.state !== "live") {
+    throw new Error(
+      read.message ??
+        "Builder source could not be read for this role change; no source changes were made.",
+    );
+  }
   return { read, modelFields };
 }
 
 async function readSourceEntries(args: {
   sourceType: ContentDatabaseSourceType;
-  sourceTable: string;
+  source: SourceRecord;
   limit: number;
   offset: number;
 }): Promise<{
@@ -276,7 +318,8 @@ async function readSourceEntries(args: {
 }> {
   if (args.sourceType === "builder-cms") {
     const { read, modelFields } = await readBuilderCmsEntriesForRoleChange({
-      model: args.sourceTable,
+      model: args.source.sourceTable,
+      ...builderSourceReadBinding(args.source),
     });
     return {
       entries: read.state === "live" ? read.entries : [],
@@ -288,7 +331,7 @@ async function readSourceEntries(args: {
   }
   if (args.sourceType === "local-table") {
     const { entries, modelFields } = await readLocalTableEntries(
-      args.sourceTable,
+      args.source.sourceTable,
       { limit: args.limit, offset: args.offset },
     );
     return {
@@ -302,7 +345,7 @@ async function readSourceEntries(args: {
   if (args.sourceType === "notion-database") {
     const read = await getContentDatabaseSourceAdapter("notion-database")!.read(
       {
-        sourceTable: args.sourceTable,
+        sourceTable: args.source.sourceTable,
         limit: args.limit,
         offset: args.offset,
       },
@@ -372,7 +415,7 @@ export default defineAction({
 
       const { entries, modelFields } = await readSourceEntries({
         sourceType: normalizedType,
-        sourceTable: source.sourceTable,
+        source,
         limit: args.limit ?? 100,
         offset: args.offset ?? 0,
       });
@@ -433,6 +476,7 @@ export default defineAction({
           existingFieldPaths: existingSourceFields.map(
             (field) => field.sourceFieldKey,
           ),
+          ...builderSourceReadBinding(source),
         });
       const entries = read.state === "live" ? read.entries : [];
       await db

package/corpus/templates/content/actions/delete-document.ts

@@ -15,6 +15,13 @@ import { documentChangeResource } from "../server/lib/document-change-resource.j
 import { deleteDocumentImports } from "../server/lib/document-imports.js";
 import { chunks } from "./_batch-utils.js";
 import { deleteBlocksFieldIdentity } from "./_blocks-field-identity.js";
+import {
+  builderExecutionPayloadReference,
+  cleanupBuilderPrivatePayload,
+  enqueueBuilderPrivatePayloadCleanup,
+  isBuilderPrivatePayloadBoundToSource,
+} from "./_builder-cms-blob-custody.js";
+import { assertNoActiveBuilderSourceExecutions } from "./_builder-source-execution-guard.js";
 import {
   lockContentDatabaseMutation,
   touchContentDatabase,
@@ -972,19 +979,26 @@ export async function deleteDocumentRecursive(
   id: string,
   ownerEmail: string,
 ): Promise<string[]> {
-  return db.transaction((tx) =>
+  const deletedBlobReferences = new Set<string>();
+  const deleted = await db.transaction((tx) =>
     deleteDocumentRootsRecursive(
       tx as unknown as ReturnType<typeof getDb>,
       [id],
       ownerEmail,
+      deletedBlobReferences,
     ),
   );
+  for (const reference of deletedBlobReferences) {
+    await cleanupBuilderPrivatePayload(reference, "deleted document source");
+  }
+  return deleted;
 }
 
 export async function deleteDocumentRootsRecursive(
   db: ReturnType<typeof getDb>,
   rootIds: string[],
   ownerEmail: string,
+  deletedBlobReferences: Set<string>,
 ): Promise<string[]> {
   const collectScope = () =>
     collectDocumentSubtreeForDelete(db, rootIds, ownerEmail);
@@ -998,6 +1012,7 @@ export async function deleteDocumentRootsRecursive(
     documentIds,
     ownedDatabaseIds,
     ownerEmail,
+    deletedBlobReferences,
   );
 }
 
@@ -1006,6 +1021,7 @@ async function deleteCollectedDocuments(
   documentIds: string[],
   ownedDatabaseIds: string[],
   ownerEmail: string,
+  deletedBlobReferences: Set<string>,
 ): Promise<string[]> {
   await assertNotWorkspaceCatalogDocuments(db, documentIds, "deleted");
 
@@ -1041,6 +1057,7 @@ async function deleteCollectedDocuments(
   });
 
   await deleteWhereIn(sourceIds, async (sourceIdBatch) => {
+    await assertNoActiveBuilderSourceExecutions(db, sourceIdBatch);
     await db
       .delete(schema.contentDatabaseBodyHydrationQueue)
       .where(
@@ -1049,11 +1066,30 @@ async function deleteCollectedDocuments(
           sourceIdBatch,
         ),
       );
-    await db
+    const deletedExecutions = await db
       .delete(schema.contentDatabaseSourceExecutions)
       .where(
         inArray(schema.contentDatabaseSourceExecutions.sourceId, sourceIdBatch),
-      );
+      )
+      .returning({
+        ownerEmail: schema.contentDatabaseSourceExecutions.ownerEmail,
+        sourceId: schema.contentDatabaseSourceExecutions.sourceId,
+        payloadJson: schema.contentDatabaseSourceExecutions.payloadJson,
+      });
+    for (const row of deletedExecutions) {
+      const reference = builderExecutionPayloadReference(row.payloadJson);
+      if (
+        reference &&
+        isBuilderPrivatePayloadBoundToSource(
+          reference,
+          row.ownerEmail,
+          row.sourceId,
+        )
+      ) {
+        deletedBlobReferences.add(reference);
+        await enqueueBuilderPrivatePayloadCleanup(db, reference);
+      }
+    }
     await db
       .delete(schema.contentDatabaseSourceChangeReviews)
       .where(
@@ -1225,6 +1261,7 @@ export async function deleteTrashedDocumentSubtree(
   db: ReturnType<typeof getDb>,
   id: string,
   ownerEmail: string,
+  deletedBlobReferences: Set<string>,
   frozen?: ReadonlyArray<{
     documentId: string;
     expectedTrashedAt: string;
@@ -1374,6 +1411,7 @@ export async function deleteTrashedDocumentSubtree(
     documentIds,
     ownedDatabaseIds,
     ownerEmail,
+    deletedBlobReferences,
   );
 }