@agent-native/core 0.106.3 → 0.107.1

package/corpus/templates/clips/server/routes/api/public-recording.get.ts

@@ -6,11 +6,11 @@
  * authenticated `/_agent-native/actions/get-recording-player-data` route.
  *
  * Only returns data when:
- *   - recording.visibility === 'public' (or the signed-in viewer is owner), AND
+ *   - recording.visibility === 'public', or the signed-in viewer has org/share access, AND
  *   - either no password is set, the viewer is owner, or the provided password matches
  *
- * For `org` or `private` visibility, returns 401 (viewer must sign in and use
- * the authenticated player route).
+ * For `org` or `private` visibility, signed-in org members and explicit shares
+ * may load the same player payload as the authenticated route.
  */
 
 import {
@@ -467,11 +467,17 @@ export default defineEventHandler(async (event) => {
       placement: c.placement,
     })),
     viewer: session?.email
-      ? {
-          canEdit: viewerIsOwner,
-          isOwner: viewerIsOwner,
-          role: viewerIsOwner ? "owner" : "viewer",
-        }
+      ? (() => {
+          const role =
+            viewerAccess?.role ?? (viewerIsOrgMember ? "viewer" : null);
+          const canEdit =
+            role === "owner" || role === "admin" || role === "editor";
+          return {
+            canEdit,
+            isOwner: role === "owner",
+            role: role ?? "viewer",
+          };
+        })()
       : null,
   };
 });

package/corpus/templates/clips/shared/view-analytics.ts

@@ -0,0 +1,4 @@
+export function clampCompletionPct(value: number | null | undefined): number {
+  if (typeof value !== "number" || !Number.isFinite(value)) return 0;
+  return Math.min(100, Math.max(0, value));
+}

package/corpus/templates/content/.agents/skills/creative-context/SKILL.md

@@ -35,9 +35,11 @@ role cannot silently stand in for another:
 
 1. Follow the user's explicit instructions and the object currently selected in
    the app.
-2. Read the `creative-context` application-state record. If
-   `pinnedPackId` is set, prefer that immutable pack. Otherwise use
-   `currentPackId` when it records context already selected for this session.
+2. Read the `creative-context` application-state record. If `pinnedPackId` is
+   set, replay that immutable pack. Otherwise honor `selectedContextId`; when it
+   is unset, let retrieval use Default plus at most one app-bound or
+   semantically matching specialty context. `currentPackId` is the receipt from
+   the latest materialized generation, not a replacement for context selection.
 3. Call `search-creative-context` with a narrow query for exact facts, visual
    language, audience guidance, prior decisions, or reusable references.
 4. Call `get-context-item` only for the specific search result versions
@@ -60,6 +62,7 @@ The single state key is `creative-context`:
 ```json
 {
   "contextMode": "auto",
+  "selectedContextId": null,
   "currentPackId": null,
   "pinnedPackId": null
 }
@@ -83,3 +86,9 @@ versions may support factual claims. Preserve the returned `contextPackId`
 and short reuse labels with the document generation provenance. A published
 brand profile can guide tone automatically; it never overrides the user's
 current brief, and it must not turn an unsupported prior claim into a fact.
+
+When an approved app-created document already fits, call
+`clone-creative-context-document` with its exact item and version ids before
+rewriting from excerpts. The typed action resolves the approved private
+Markdown/document payload through Content's normal create path; generic context
+actions never expose that payload.

package/corpus/templates/content/AGENTS.md

@@ -43,6 +43,11 @@ Detailed document editing, Notion, storage, and UI rules live in
   document first, then a pinned/current pack, then narrow library search.
   Respect `creative-context.contextMode: "off"` without silently restoring a
   pack.
+- To submit a document to a governed Creative Context, use the Context tab or
+  `manage-context-membership`; the app flushes live collaboration and captures
+  one immutable Markdown version. Reuse only its opaque native clone reference.
+  Use `operation="submit-latest"` with a Library membership id when its native
+  update status reports `update-available`.
 
 - `navigation` exposes document, selected block, comment, media, and Notion view
   context.

package/corpus/templates/content/actions/_content-space-access.ts

@@ -1,9 +1,25 @@
 import { getDbExec } from "@agent-native/core/db";
+import { table, text } from "@agent-native/core/db/schema";
 import { getRequestUserEmail } from "@agent-native/core/server/request-context";
-import { eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 
 import { getDb, schema } from "../server/db/index.js";
 
+// Keep these lightweight table references local. Importing the public org
+// barrel also initializes auth's long-lived cleanup timer, which breaks test
+// suites that intentionally drain fake timers.
+const organizations = table("organizations", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  createdBy: text("created_by").notNull(),
+});
+
+const orgMembers = table("org_members", {
+  orgId: text("org_id").notNull(),
+  email: text("email").notNull(),
+  role: text("role").notNull(),
+});
+
 export type ContentSpaceRole = "viewer" | "editor" | "owner";
 
 export type ContentSpaceAccess = {
@@ -21,7 +37,32 @@ export function normalizeContentSpaceEmail(email: string): string {
 export async function getContentOrganizationMembership(
   orgId: string,
   userEmail: string,
+  options: { db?: any } = {},
 ): Promise<{ role: string; name: string; createdBy: string } | null> {
+  if (options.db) {
+    const [row] = await options.db
+      .select({
+        role: orgMembers.role,
+        name: organizations.name,
+        createdBy: organizations.createdBy,
+      })
+      .from(orgMembers)
+      .innerJoin(organizations, eq(organizations.id, orgMembers.orgId))
+      .where(
+        and(
+          eq(orgMembers.orgId, orgId),
+          sql`LOWER(${orgMembers.email}) = ${normalizeContentSpaceEmail(userEmail)}`,
+        ),
+      )
+      .limit(1);
+    return row
+      ? {
+          role: String(row.role ?? "member").toLowerCase(),
+          name: row.name,
+          createdBy: row.createdBy,
+        }
+      : null;
+  }
   const result = await getDbExec().execute({
     sql: `SELECT m.role AS role, o.name AS name, o.created_by AS "createdBy"
           FROM org_members m
@@ -90,11 +131,12 @@ export async function listContentOrganizationMemberships(userEmail: string) {
 export async function resolveContentSpaceAccess(
   spaceId: string,
   requiredRole: "viewer" | "editor" = "viewer",
+  options: { db?: any } = {},
 ): Promise<ContentSpaceAccess> {
   const userEmail = getRequestUserEmail();
   if (!userEmail) throw new Error("no authenticated user");
   const normalizedUserEmail = normalizeContentSpaceEmail(userEmail);
-  const [space] = await getDb()
+  const [space] = await (options.db ?? getDb())
     .select()
     .from(schema.contentSpaces)
     .where(eq(schema.contentSpaces.id, spaceId));
@@ -115,6 +157,7 @@ export async function resolveContentSpaceAccess(
   const membership = await getContentOrganizationMembership(
     space.orgId,
     normalizedUserEmail,
+    options,
   );
   if (!membership)
     throw new Error(`Not authorized for Content space "${spaceId}"`);

package/corpus/templates/content/actions/clone-creative-context-document.ts

@@ -0,0 +1,61 @@
+import { createHash } from "node:crypto";
+
+import { defineAction } from "@agent-native/core";
+import {
+  readPrivateBlob,
+  type PrivateBlobHandle,
+} from "@agent-native/core/private-blob";
+import { resolveNativeContextCloneReference } from "@agent-native/creative-context/server";
+import { z } from "zod";
+
+import createDocument from "./create-document.js";
+
+export default defineAction({
+  description:
+    "Clone one exact governed Markdown document without returning its private source payload.",
+  schema: z.object({
+    contextId: z.string(),
+    artifactKey: z.string(),
+    resourceId: z.string(),
+    expectedUpdatedAt: z.string().optional(),
+    title: z.string().optional(),
+    parentId: z.string().optional(),
+  }),
+  publicAgent: { expose: true, readOnly: false, requiresAuth: true },
+  run: async (args) => {
+    const reference = await resolveNativeContextCloneReference({
+      appId: "content",
+      resourceType: "document",
+      resourceId: args.resourceId,
+      expectedUpdatedAt: args.expectedUpdatedAt,
+      contextId: args.contextId,
+      artifactKey: args.artifactKey,
+    });
+    const raw = await readPrivateBlob(
+      reference.cloneHandle as PrivateBlobHandle,
+    );
+    const content = Buffer.from(raw.data).toString("utf8");
+    const hash = createHash("sha256").update(content).digest("hex");
+    if (
+      raw.metadata?.appId !== "content" ||
+      raw.metadata?.resourceType !== "document" ||
+      raw.metadata?.resourceId !== args.resourceId ||
+      raw.metadata?.contentHash !== hash
+    )
+      throw new Error(
+        "Governed document clone payload failed integrity verification.",
+      );
+    const result = await createDocument.run({
+      title: args.title?.trim() || "Context document",
+      content,
+      ...(args.parentId ? { parentId: args.parentId } : {}),
+    });
+    if (!result?.id) throw new Error("Document clone did not persist.");
+    return {
+      id: result.id,
+      title: result.title,
+      urlPath: result.urlPath,
+      clonedExactVersion: reference.publishedItemVersionId,
+    };
+  },
+});

package/corpus/templates/content/actions/create-content-database.ts

@@ -5,7 +5,13 @@ import {
   getRequestOrgId,
   getRequestUserEmail,
 } from "@agent-native/core/server/request-context";
-import { assertAccess, type ShareRole } from "@agent-native/core/sharing";
+import {
+  accessFilter,
+  assertAccess,
+  currentAccess,
+  ForbiddenError,
+  type ShareRole,
+} from "@agent-native/core/sharing";
 import { and, eq, sql } from "drizzle-orm";
 import { z } from "zod";
 
@@ -158,9 +164,34 @@ export async function resolveContentDatabaseSpace(
   return spaceId;
 }
 
+async function assertDocumentEditorAccess(db: any, documentId: string) {
+  const [document] = await db
+    .select()
+    .from(schema.documents)
+    .where(
+      and(
+        eq(schema.documents.id, documentId),
+        accessFilter(
+          schema.documents,
+          schema.documentShares,
+          currentAccess(),
+          "editor",
+        ),
+      ),
+    );
+  if (!document) {
+    throw new ForbiddenError(`No editor access to document ${documentId}`);
+  }
+  return document;
+}
+
 export async function createContentDatabaseRecord(
   args: CreateDatabaseRequest,
-  options: { db?: any; spaceId?: string } = {},
+  options: {
+    db?: any;
+    spaceId?: string;
+    resolveSpaceAccess?: typeof resolveContentSpaceAccess;
+  } = {},
 ): Promise<string> {
   const db = options.db ?? getDb();
   const now = new Date().toISOString();
@@ -178,8 +209,7 @@ export async function createContentDatabaseRecord(
   }> = [];
 
   if (documentId) {
-    const access = await assertAccess("document", documentId, "editor");
-    const document = access.resource;
+    const document = await assertDocumentEditorAccess(db, documentId);
     ownerEmail = document.ownerEmail as string;
     orgId = (document.orgId as string | null) ?? null;
     spaceId = (document.spaceId as string | null) ?? spaceId;
@@ -230,8 +260,7 @@ export async function createContentDatabaseRecord(
     let hideFromSearch = 0;
 
     if (parentId) {
-      const parentAccess = await assertAccess("document", parentId, "editor");
-      const parent = parentAccess.resource;
+      const parent = await assertDocumentEditorAccess(db, parentId);
       ownerEmail = parent.ownerEmail as string;
       orgId = (parent.orgId as string | null) ?? null;
       spaceId = (parent.spaceId as string | null) ?? spaceId;
@@ -257,7 +286,12 @@ export async function createContentDatabaseRecord(
           "A top-level database requires a resolved Content space",
         );
       }
-      const spaceAccess = await resolveContentSpaceAccess(spaceId, "editor");
+      const spaceAccess = await (
+        options.resolveSpaceAccess ?? resolveContentSpaceAccess
+      )(spaceId, "editor", { db });
+      if (spaceAccess.space.id !== spaceId) {
+        throw new Error("Resolved Content space does not match the request");
+      }
       ownerEmail = getRequestUserEmail() ?? ownerEmail;
       orgId = spaceAccess.space.orgId;
       visibility = orgId ? "org" : "private";

package/corpus/templates/content/actions/provider-api-request.ts

@@ -202,6 +202,7 @@ export default defineAction({
       ),
   }),
   http: false,
+  toolCallable: false,
   run: async (args) => {
     if (args.stageAs) {
       const ctx = getCredentialContext();

package/corpus/templates/content/app/components/editor/DocumentToolbar.tsx

@@ -7,6 +7,7 @@ import {
   type CollabUser,
 } from "@agent-native/core/client";
 import { ShareButton } from "@agent-native/core/client";
+import { CreativeContextShareTab } from "@agent-native/creative-context/client";
 import type { DocumentSourceInfo } from "@shared/api";
 import {
   IconArrowBarDown,
@@ -711,6 +712,26 @@ export function DocumentToolbar({
                   onCheckedChange: handleHideFromSearchChange,
                 }}
                 variant="compact"
+                shareTabs={{
+                  tabs: [
+                    {
+                      value: "context",
+                      label: "Context",
+                      content: (
+                        <CreativeContextShareTab
+                          resource={{
+                            appId: "content",
+                            resourceType: "document",
+                            resourceId: documentId,
+                            title: documentTitle || "Untitled",
+                            updatedAt: documentUpdatedAt ?? undefined,
+                            preview: { kind: "document", label: "Document" },
+                          }}
+                        />
+                      ),
+                    },
+                  ],
+                }}
               />
 
               <VersionHistoryPanel

package/corpus/templates/content/app/components/layout/Layout.tsx

@@ -189,7 +189,7 @@ export function Layout({ children }: LayoutProps) {
         )}
         <AgentSidebar
           position="right"
-          defaultOpen={!isMobile && !isNarrowDesktop}
+          defaultOpen={false}
           agentPageHref="/agent"
           emptyStateText={t("chat.emptyState")}
           suggestions={[

package/corpus/templates/content/app/components/sidebar/DocumentTreeItem.tsx

@@ -1,4 +1,5 @@
 import { useT } from "@agent-native/core/client";
+import { CreativeContextShareSheet } from "@agent-native/creative-context/client";
 import {
   SortableContext,
   useSortable,
@@ -114,6 +115,7 @@ export function DocumentTreeItem({
   const hasMenuActions = canEdit || canManage;
   const canCreateChild = canEdit && !isLocalFileNode;
   const [deleteDialogOpen, setDeleteDialogOpen] = useState(false);
+  const [contextSheetOpen, setContextSheetOpen] = useState(false);
   const indent = depth * 12 + 12;
   const rowWidth =
     sidebarWidth === undefined ? undefined : Math.max(0, sidebarWidth - 8);
@@ -250,6 +252,18 @@ export function DocumentTreeItem({
                   </DropdownMenuItem>
                 )}
                 {canEdit && canManage && <DropdownMenuSeparator />}
+                {canEdit && !isLocalFileNode && (
+                  <DropdownMenuItem
+                    onSelect={(event) => {
+                      event.preventDefault();
+                      event.stopPropagation();
+                      setContextSheetOpen(true);
+                    }}
+                  >
+                    <IconPlus size={14} className="me-2" />
+                    {t("creativeContext.addToContext" /* i18n-key-ignore */)}
+                  </DropdownMenuItem>
+                )}
                 {canManage && (
                   <DropdownMenuItem
                     className="text-destructive"
@@ -310,6 +324,21 @@ export function DocumentTreeItem({
         </div>
       </div>
 
+      <CreativeContextShareSheet
+        open={contextSheetOpen}
+        onOpenChange={setContextSheetOpen}
+        resource={{
+          appId: "content",
+          resourceType: "document",
+          resourceId: node.id,
+          title: node.title || "Untitled",
+          updatedAt: node.updatedAt,
+          visibility: node.visibility,
+          preview: { kind: "document", label: "Document" },
+        }}
+        canManage={canManage}
+      />
+
       {hasChildren && expanded && (
         <SortableContext
           items={node.children.map((child) => child.id)}

package/corpus/templates/content/app/root.tsx

@@ -479,15 +479,6 @@ function PublicAgentShell({ children }: { children: React.ReactNode }) {
 
   useEffect(() => setMounted(true), []);
 
-  useEffect(() => {
-    if (!mounted) return;
-    if (!window.matchMedia("(min-width: 768px)").matches) return;
-    const id = window.setTimeout(() => {
-      window.dispatchEvent(new Event("agent-panel:open"));
-    }, 0);
-    return () => window.clearTimeout(id);
-  }, [mounted]);
-
   const content = <>{children}</>;
 
   if (!mounted) {
@@ -503,7 +494,7 @@ function PublicAgentShell({ children }: { children: React.ReactNode }) {
   return (
     <AgentSidebar
       position="right"
-      defaultOpen
+      defaultOpen={false}
       defaultSidebarWidth={420}
       emptyStateText={t("chat.publicEmptyState")}
       suggestions={[

package/corpus/templates/content/changelog/2026-07-17-creating-a-database-now-completes-reliably-in-hosted-workspa.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-17
+---
+
+Creating a database now completes reliably in hosted workspaces

package/corpus/templates/content/changelog/2026-07-17-library-now-flags-published-documents-with-newer-versions-an.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-17
+---
+
+Library now flags published documents with newer versions and lets you submit the update in place.

package/corpus/templates/content/changelog/2026-07-17-resources-can-be-added-to-creative-context-from-their-action.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-07-17
+---
+
+Resources can be added to Creative Context from their action menus.

package/corpus/templates/content/changelog/2026-07-17-the-agent-chat-sidebar-stays-closed-until-you-open-it-or-sta.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-17
+---
+
+The agent chat sidebar stays closed until you open it or start a chat handoff.

package/corpus/templates/content/changelog/2026-07-17-you-can-add-exact-approved-artifact-versions-to-governed-cre.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-07-17
+---
+
+You can add exact, approved artifact versions to governed Creative Contexts for safe reuse.

package/corpus/templates/content/parity/matrix.md

@@ -20,7 +20,7 @@ This generated matrix tracks whether high-value Content UI operations use the sa
 | sharing.document-discoverability-and-export        | sharing     | Share, hide from search, export, and reveal documents                                          | action-backed         | `export-document`, `reveal-local-source-file`, `set-document-discoverability`, `share-local-file-document`                                                                                                                                                                                                                                                                                                  | `app/components/editor/DocumentToolbar.tsx`, `app/hooks/use-documents.ts`                                                                                                                 | Search discoverability, shareable copies, exports, and OS reveal requests are managed through Content actions.                                                                                                         | -                                                                                                                                                                                                                                          | -                | P0             | covered       | `actions/_local-file-documents.test.ts`                                                                                                                                                                                 | `local-file-source-truth`        | -                              |
 | sharing.os-reveal-local-source                     | sharing     | Reveal a local source file in the system file manager                                          | host-only             | `reveal-local-source-file`                                                                                                                                                                                                                                                                                                                                                                                  | `app/components/editor/DocumentToolbar.tsx`, `actions/reveal-local-source-file.ts`                                                                                                        | -                                                                                                                                                                                                                      | OS reveal depends on trusted local host capabilities and should not spend agent tool surface or imply portable hosted behavior.                                                                                                            | -                | P2             | seeded        | -                                                                                                                                                                                                                       | -                                | Local folder exception/docs PR |
 | sidebar.chrome-state                               | sidebar     | Collapse sections and resize the sidebar                                                       | client-only-ephemeral | -                                                                                                                                                                                                                                                                                                                                                                                                           | `app/components/sidebar/DocumentSidebar.tsx`, `app/components/layout/Layout.tsx`                                                                                                          | -                                                                                                                                                                                                                      | -                                                                                                                                                                                                                                          | -                | P2             | none          | -                                                                                                                                                                                                                       | -                                | -                              |
-| sidebar.document-tree-crud                         | sidebar     | Create, delete, move, favorite, list, search, and open pages                                   | action-backed         | `create-document`, `delete-document`, `get-document`, `list-documents`, `move-document`, `search-documents`, `update-document`                                                                                                                                                                                                                                                                              | `app/components/sidebar/DocumentSidebar.tsx`, `app/components/sidebar/DocumentTreeItem.tsx`, `app/hooks/use-documents.ts`                                                                 | Document tree rows and document metadata are created, updated, deleted, moved, searched, or read.                                                                                                                      | -                                                                                                                                                                                                                                          | -                | P0             | covered       | `actions/content-database-lifecycle.db.test.ts`, `actions/_local-file-documents.test.ts`                                                                                                                                | `document-search-edit`           | -                              |
+| sidebar.document-tree-crud                         | sidebar     | Create, delete, move, favorite, list, search, and open pages                                   | action-backed         | `create-document`, `clone-creative-context-document`, `delete-document`, `get-document`, `list-documents`, `move-document`, `search-documents`, `update-document`                                                                                                                                                                                                                                           | `app/components/sidebar/DocumentSidebar.tsx`, `app/components/sidebar/DocumentTreeItem.tsx`, `app/hooks/use-documents.ts`                                                                 | Document tree rows and document metadata are created, updated, deleted, moved, searched, or read.                                                                                                                      | -                                                                                                                                                                                                                                          | -                | P0             | covered       | `actions/content-database-lifecycle.db.test.ts`, `actions/_local-file-documents.test.ts`                                                                                                                                | `document-search-edit`           | -                              |
 | sidebar.navigation-and-screen-context              | sidebar     | Navigate between documents and expose current screen context                                   | action-equivalent     | `navigate`, `view-screen`                                                                                                                                                                                                                                                                                                                                                                                   | `app/components/sidebar/DocumentSidebar.tsx`, `actions/navigate.ts`, `actions/view-screen.ts`                                                                                             | Application navigation state is updated or read so the agent can reason about the user's current page/view.                                                                                                            | Human navigation is router-local, while agent navigation/screen inspection uses application-state actions to produce the same workspace orientation effect.                                                                                | -                | P1             | seeded        | -                                                                                                                                                                                                                       | -                                | -                              |
 | source-sync.builder-body-hydration-worker          | source-sync | Process queued Builder CMS body hydration work                                                 | action-backed         | `process-builder-body-hydration`                                                                                                                                                                                                                                                                                                                                                                            | `app/components/editor/DocumentEditor.tsx`, `app/components/editor/database/DatabaseView.tsx`, `app/hooks/use-content-database.ts`                                                        | Queued Builder body hydration entries are processed into readable Content document/database body state.                                                                                                                | This action is intentionally hidden from the model with agentTool: false because it is an internal bounded queue worker; agents should use source refresh, review, and execution actions rather than manually driving hydration internals. | -                | P0             | covered       | `actions/_database-source-utils.test.ts`                                                                                                                                                                                | -                                | -                              |
 | source-sync.builder-cms-review-and-write-gates     | source-sync | Review, stage, validate, cancel, and execute Builder CMS source writes                         | action-backed         | `cancel-prepared-builder-source-update`, `execute-builder-source-batch`, `execute-builder-source-execution`, `prepare-builder-source-execution`, `prepare-builder-source-review`, `preview-builder-source-review`, `review-content-database-source-change-set`, `set-content-database-source-write-mode`, `stage-builder-source-bulk-update`, `stage-builder-revision`, `validate-builder-source-execution` | `app/components/editor/DocumentDatabase.tsx`, `app/components/editor/database/DatabaseView.tsx`, `app/components/editor/database-sources/BuilderSourceReviewDialog.tsx`                   | Builder source write mode, staged reviews, pre-dispatch cancellations, validation records, and bounded execution records are created through guarded actions.                                                          | -                                                                                                                                                                                                                                          | -                | P0             | covered       | `actions/builder-source-review-gates.db.test.ts`, `actions/cancel-prepared-builder-source-update.db.test.ts`, `actions/execute-builder-source-execution.test.ts`, `actions/stage-builder-source-bulk-update.db.test.ts` | `builder-source-review-readonly` | -                              |

package/corpus/templates/content/parity/matrix.ts

@@ -17,6 +17,7 @@ export const parityMatrix: ParityRow[] = [
     status: "action-backed",
     actions: [
       "create-document",
+      "clone-creative-context-document",
       "delete-document",
       "get-document",
       "list-documents",