@agent-native/core 0.113.0 → 0.114.1

package/corpus/templates/clips/.agents/skills/self-modifying-code/SKILL.md

@@ -40,9 +40,11 @@ Tier 4 includes **all** of the following — not only editing package source:
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
-allows copying the smallest reference UI component from the installed source
-into the app. The copy must use public runtime contracts and must not replace
-Core auth, DB, actions, agent execution, or transport behavior.
+uses `agent-native eject` to transfer the smallest supported unit from the
+installed package into the app. The ejected unit must keep public runtime
+contracts and must not replace Core auth, DB, actions, agent execution, or
+transport behavior. Manual copying is only the fallback described by an unknown
+third-party package's add-style blueprint.
 
 When an older branch needs current packages, use **`agent-native upgrade`**
 (see the `upgrade-agent-native` skill). If upgrade or typecheck fails, fix
@@ -94,8 +96,9 @@ inline strings in components.
 - Don't modify `.env` files or files containing secrets
 - Don't modify `@agent-native/core`, `@agent-native/dispatch`, or other
   `@agent-native/*` package internals (including under `node_modules`)
-- Don't confuse a read-only reference copy with editing package internals: use
-  `customizing-agent-native` for selective app-owned UI adoption
+- Don't confuse readable package source with app-owned code: use
+  `customizing-agent-native` and `agent-native eject` for supported ownership
+  transfer
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
   `@agent-native/*` to "make the app run" after a version bump
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
@@ -107,7 +110,7 @@ inline strings in components.
 ## Related Skills
 
 - **upgrade-agent-native** — supported path to bring an older app/workspace current
-- **customizing-agent-native** — safe selective adoption of installed reference UI
+- **customizing-agent-native** — configure, compose, or eject installed features safely
 - **storing-data** — Tier 1 modifications (data files) are the safest and most common
 - **actions** — The agent can create or modify actions to add new capabilities
 - **delegate-to-agent** — Self-modification requests come through the agent chat

package/corpus/templates/content/.agents/skills/customizing-agent-native/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: customizing-agent-native
 description: >-
-  How to adopt, compose, or selectively copy Agent Native UI into app-owned
-  code. Use when overriding shared components, customizing a template, adding
-  UI to chat or headless apps, or inspecting installed framework source.
+  How to configure, compose, or eject Agent Native features into app-owned
+  code. Use when overriding shared components or integrations, customizing a
+  template, adding UI to chat or headless apps, or inspecting package source.
 scope: dev
 metadata:
   internal: true
@@ -14,21 +14,59 @@ metadata:
 ## Rule
 
 Start with the public component and its props, slots, callbacks, and stable
-class names. If those seams are not enough, copy the smallest useful reference
-implementation into the app and make that copy app-owned. Never edit
-`node_modules`, deep-import a private source file at runtime, or patch an
+class names. If those seams are not enough, use the eject CLI to transfer the
+smallest supported feature into the app and make that copy app-owned. Never
+edit `node_modules`, deep-import a private source file at runtime, or patch an
 `@agent-native/*` package.
 
 Use this order:
 
 1. Configure the public component.
 2. Compose public primitives behind a local app component.
-3. Copy one component or helper into app source and change the app import.
+3. Eject the smallest feature into app-owned source.
 4. Propose a new Toolkit seam when the same override is useful in two apps.
 
-Copying is for intentional product customization, not for hiding an upgrade
+Ejection is for intentional product customization, not for hiding an upgrade
 failure or replacing Core runtime behavior.
 
+## Eject A Feature
+
+Discover and inspect the ejection units published by installed first-party
+packages before changing source:
+
+```bash
+agent-native eject --list
+agent-native eject inspect <unit>
+agent-native eject <unit> --app <app>
+agent-native eject <unit> --app <app> --apply
+```
+
+The command is dry-run by default. It prints the file closure, consumer import
+rewrites, protected package contracts, and verification commands before
+writing. `--apply` copies the package-version-matched source into the app and
+rewrites only imports covered by the unit manifest.
+
+Every first-party public ejection unit must have a complete manifest. If one is
+missing, treat that as a framework coverage bug instead of inventing a copy
+recipe. For an unknown third-party package, use the emitted add-style blueprint
+as a starting point. Protected runtime behavior is never copied; follow the
+reported configuration, adapter, or extension seam instead.
+
+Applied ejections are recorded in the committed
+`agent-native.ejections.json`, including package version, manifest digest,
+target hashes, and import rewrites. Use the recorded state to review drift or
+undo an unchanged ejection:
+
+```bash
+agent-native eject diff <unit> --app <app>
+agent-native eject restore <unit> --app <app>
+agent-native eject restore <unit> --app <app> --apply
+```
+
+Restore is hash-gated. It refuses to remove locally edited files or reverse
+changed imports and prints their diff instead. Keep an edited ejection as
+app-owned code, or reconcile those edits before restoring it.
+
 ## Find The Installed Implementation
 
 Use the source that matches the installed package version:
@@ -45,12 +83,13 @@ rg -n "<component or symbol>" node_modules/@agent-native/core/corpus
 - Core and first-party template source lives under
   `node_modules/@agent-native/core/corpus/core/` and
   `node_modules/@agent-native/core/corpus/templates/`.
-- Treat those trees as read-only references. Copy files into an app directory
-  such as `app/components/`, then import the local copy.
+- Treat those trees as read-only references. Prefer `agent-native eject` so the
+  package manifest selects the complete source closure and rewrites imports.
+  Manual inspection is still useful for deciding whether to configure,
+  compose, eject, or propose a shared seam.
 
-When a copied component imports sibling helpers, copy only the required
-siblings or replace them with public package imports. Do not copy an entire
-package or template to change one surface.
+Do not manually guess at sibling dependencies. The ejection manifest owns the
+required file closure and keeps protected contracts on public package imports.
 
 ## Preserve The Agent-Native Contract
 
@@ -69,29 +108,33 @@ UI ownership may change; product contracts should not:
 ## App Shapes
 
 - **Template app:** begin with its existing local adapters and domain UI. Use
-  Toolkit for repeated workspace UI; copy only the piece being customized.
+  Toolkit for repeated workspace UI; eject only the unit being customized.
 - **Chat app:** keep `AgentChatSurface`, thread state, and chat transport in
-  Core. Compose or copy Toolkit presentation such as chat-history UI around it.
+  Core. Compose or eject Toolkit presentation such as chat-history UI around it.
 - **Headless app:** stay action-first while no UI is needed. When adding a UI,
   use the Chat template as the on-ramp or add Toolkit components without
   replacing the existing actions.
 - **Workspace:** put one-app overrides in that app. Promote a local component
   to `packages/shared` only when multiple workspace apps use it.
 
-## After Copying
+## After Ejecting
 
-- Remove unused dependencies and imports from the copied file.
+- Commit `agent-native.ejections.json` with the app-owned files and rewrites.
+- Remove unused dependencies and imports from the ejected files.
 - Keep visible text in the app's localization catalogs.
-- Run the app's formatter, typecheck, and focused tests.
+- Run the manifest verification commands plus the app's formatter, typecheck,
+  and focused tests.
 - Re-check the installed source during future package upgrades; the app-owned
-  copy does not receive upstream fixes automatically.
+  ejection does not receive upstream fixes automatically. Use `eject diff` to
+  distinguish recorded output from subsequent local edits.
 
 ## Don't
 
 - Don't edit or import from `node_modules/@agent-native/*/src` at runtime.
 - Don't add `pnpm.overrides`, patches, or resolutions for Agent Native packages.
 - Don't copy Core auth, DB, action, agent-loop, or transport internals.
-- Don't fork a full template when a prop, slot, wrapper, or one-file copy works.
+- Don't manually copy a first-party unit with a missing recipe; fix its manifest.
+- Don't eject a full package when a prop, slot, wrapper, or smaller unit works.
 
 ## Related Skills
 

package/corpus/templates/content/.agents/skills/self-modifying-code/SKILL.md

@@ -40,9 +40,11 @@ Tier 4 includes **all** of the following — not only editing package source:
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
-allows copying the smallest reference UI component from the installed source
-into the app. The copy must use public runtime contracts and must not replace
-Core auth, DB, actions, agent execution, or transport behavior.
+uses `agent-native eject` to transfer the smallest supported unit from the
+installed package into the app. The ejected unit must keep public runtime
+contracts and must not replace Core auth, DB, actions, agent execution, or
+transport behavior. Manual copying is only the fallback described by an unknown
+third-party package's add-style blueprint.
 
 When an older branch needs current packages, use **`agent-native upgrade`**
 (see the `upgrade-agent-native` skill). If upgrade or typecheck fails, fix
@@ -94,8 +96,9 @@ inline strings in components.
 - Don't modify `.env` files or files containing secrets
 - Don't modify `@agent-native/core`, `@agent-native/dispatch`, or other
   `@agent-native/*` package internals (including under `node_modules`)
-- Don't confuse a read-only reference copy with editing package internals: use
-  `customizing-agent-native` for selective app-owned UI adoption
+- Don't confuse readable package source with app-owned code: use
+  `customizing-agent-native` and `agent-native eject` for supported ownership
+  transfer
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
   `@agent-native/*` to "make the app run" after a version bump
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
@@ -107,7 +110,7 @@ inline strings in components.
 ## Related Skills
 
 - **upgrade-agent-native** — supported path to bring an older app/workspace current
-- **customizing-agent-native** — safe selective adoption of installed reference UI
+- **customizing-agent-native** — configure, compose, or eject installed features safely
 - **storing-data** — Tier 1 modifications (data files) are the safest and most common
 - **actions** — The agent can create or modify actions to add new capabilities
 - **delegate-to-agent** — Self-modification requests come through the agent chat

package/corpus/templates/content/AGENTS.md

@@ -134,6 +134,8 @@ cd templates/content && pnpm action <name> [args]
 | `ensure-content-spaces`                     |                                                                                                                                                                                                    | Idempotently provision the signed-in user's personal and current organization Content spaces, system databases, and catalog references                                            |
 | `backfill-content-files`                    |                                                                                                                                                                                                    | Assign legacy pages to Content spaces and reconcile exactly one canonical Files database membership per non-system page                                                           |
 | `list-content-spaces`                       |                                                                                                                                                                                                    | List already-provisioned Content spaces authorized by the signed-in user's current ownership or organization memberships                                                          |
+| `create-content-space`                      | `--name <name> --requestId <opaque-id>`                                                                                                                                                            | Idempotently create a private named Content workspace with its own canonical Files database                                                                                       |
+| `delete-content-space`                      | `--spaceId <id>`                                                                                                                                                                                   | Permanently delete a user-created Content workspace and all of its content; Personal and organization workspaces are protected                                                    |
 | `create-content-database`                   | `[--documentId <id>] [--spaceId <id>] [--parentId <id>] [--title <text>] [--description <text>]`                                                                                                   | Create a described database page in a Content space or convert an existing page into a database                                                                                   |
 | `create-inline-content-database`            | `--hostDocumentId <id> [--title <text>] [--description <text>]`                                                                                                                                    | Create a described database owned by an inline database block in the host document                                                                                                |
 | `get-content-database`                      | `--databaseId <id>` or `--documentId <id>`                                                                                                                                                         | Get a database with its description, property/option schema guidance, item pages, and computed ancestry context                                                                   |

package/corpus/templates/content/actions/_content-database-personal-view.ts

@@ -4,8 +4,12 @@ import { and, eq, isNull } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { CONTENT_DATABASE_PERSONAL_VIEW_OVERRIDES_VERSION } from "../shared/api.js";
+import { resolveContentSpaceAccess } from "./_content-space-access.js";
+import { filesParentPropertyId } from "./_files-system-properties.js";
 
-export const PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION = 1;
+export const PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION =
+  CONTENT_DATABASE_PERSONAL_VIEW_OVERRIDES_VERSION;
 
 export const personalDatabaseViewSettingKey = (databaseId: string) =>
   `content-database-personal-view:${databaseId}`;
@@ -38,8 +42,7 @@ export const filterSchema = z.object({
   parentFilterGroupId: z.string().optional(),
 });
 
-export const personalViewOverridesSchema = z.object({
-  version: z.literal(PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION),
+const personalViewOverridesFields = {
   activeViewId: z.string().optional(),
   views: z.array(
     z.object({
@@ -49,6 +52,16 @@ export const personalViewOverridesSchema = z.object({
       filterMode: z.enum(["and", "or"]).default("and"),
     }),
   ),
+};
+
+export const personalViewOverridesSchema = z.object({
+  version: z.literal(PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION),
+  ...personalViewOverridesFields,
+});
+
+const legacyPersonalViewOverridesSchema = z.object({
+  version: z.literal(1),
+  ...personalViewOverridesFields,
 });
 
 export async function assertContentDatabaseViewerAccess(databaseId: string) {
@@ -64,7 +77,12 @@ export async function assertContentDatabaseViewerAccess(databaseId: string) {
     );
   if (!database) throw new Error(`Database "${databaseId}" not found`);
 
-  await assertAccess("document", database.documentId, "viewer");
+  try {
+    await assertAccess("document", database.documentId, "viewer");
+  } catch (error) {
+    if (database.systemRole !== "files" || !database.spaceId) throw error;
+    await resolveContentSpaceAccess(database.spaceId);
+  }
 }
 
 export async function readPersonalDatabaseViewOverrides(
@@ -76,5 +94,31 @@ export async function readPersonalDatabaseViewOverrides(
     personalDatabaseViewSettingKey(databaseId),
   );
   const parsed = personalViewOverridesSchema.safeParse(stored);
-  return parsed.success ? parsed.data : null;
+  if (parsed.success) return parsed.data;
+
+  const legacy = legacyPersonalViewOverridesSchema.safeParse(stored);
+  if (!legacy.success) return null;
+  const [database] = await getDb()
+    .select({ systemRole: schema.contentDatabases.systemRole })
+    .from(schema.contentDatabases)
+    .where(eq(schema.contentDatabases.id, databaseId));
+  const legacyParentKey = filesParentPropertyId(databaseId);
+  return {
+    ...legacy.data,
+    version: PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION,
+    views: legacy.data.views.map((view) => ({
+      ...view,
+      filters:
+        database?.systemRole === "files"
+          ? view.filters.filter(
+              (filter) =>
+                !(
+                  filter.key === legacyParentKey &&
+                  filter.operator === "is_empty" &&
+                  filter.value === ""
+                ),
+            )
+          : view.filters,
+    })),
+  };
 }

package/corpus/templates/content/actions/_content-document-access.ts

@@ -0,0 +1,21 @@
+import { getRequestUserEmail } from "@agent-native/core/server/request-context";
+import { resolveAccess } from "@agent-native/core/sharing";
+
+import { listContentOrganizationMemberships } from "./_content-space-access.js";
+
+export async function resolveContentDocumentAccess(documentId: string) {
+  const current = await resolveAccess("document", documentId);
+  if (current) return current;
+
+  const userEmail = getRequestUserEmail();
+  if (!userEmail) return null;
+  const memberships = await listContentOrganizationMemberships(userEmail);
+  for (const membership of memberships) {
+    const access = await resolveAccess("document", documentId, {
+      userEmail,
+      orgId: membership.orgId,
+    });
+    if (access) return access;
+  }
+  return null;
+}

package/corpus/templates/content/actions/_content-favorites.ts

@@ -0,0 +1,91 @@
+import { createHash } from "node:crypto";
+
+import { and, eq, inArray, sql } from "drizzle-orm";
+
+import { schema } from "../server/db/index.js";
+import { normalizeContentSpaceEmail } from "./_content-space-access.js";
+import {
+  personalContentSpaceId,
+  systemIdsForContentSpace,
+} from "./_content-spaces.js";
+
+type Db = any;
+
+export function favoritesSystemIds(userEmail: string) {
+  return systemIdsForContentSpace(
+    personalContentSpaceId(normalizeContentSpaceEmail(userEmail)),
+    "favorites",
+  );
+}
+
+export async function favoriteDocumentIds(
+  db: Db,
+  userEmail: string,
+  documentIds: string[],
+) {
+  if (documentIds.length === 0) return new Set<string>();
+  const favoritesDatabaseId = favoritesSystemIds(userEmail).databaseId;
+  const rows = await db
+    .select({ documentId: schema.contentDatabaseItems.documentId })
+    .from(schema.contentDatabaseItems)
+    .where(
+      and(
+        eq(schema.contentDatabaseItems.databaseId, favoritesDatabaseId),
+        inArray(schema.contentDatabaseItems.documentId, documentIds),
+      ),
+    );
+  return new Set(rows.map((row: { documentId: string }) => row.documentId));
+}
+
+export async function setFavoriteMembership(args: {
+  db: Db;
+  userEmail: string;
+  documentId: string;
+  favorite: boolean;
+  now: string;
+}) {
+  const email = normalizeContentSpaceEmail(args.userEmail);
+  const favoritesDatabaseId = favoritesSystemIds(email).databaseId;
+  const [existing] = await args.db
+    .select({ id: schema.contentDatabaseItems.id })
+    .from(schema.contentDatabaseItems)
+    .where(
+      and(
+        eq(schema.contentDatabaseItems.databaseId, favoritesDatabaseId),
+        eq(schema.contentDatabaseItems.documentId, args.documentId),
+      ),
+    );
+
+  if (!args.favorite) {
+    if (existing) {
+      await args.db
+        .delete(schema.contentDatabaseItems)
+        .where(eq(schema.contentDatabaseItems.id, existing.id));
+    }
+    return false;
+  }
+  if (existing) return true;
+
+  const [position] = await args.db
+    .select({ max: sql<number>`COALESCE(MAX(position), -1)` })
+    .from(schema.contentDatabaseItems)
+    .where(eq(schema.contentDatabaseItems.databaseId, favoritesDatabaseId));
+  const id = `content_database_item_${createHash("sha256")
+    .update(`${favoritesDatabaseId}:${args.documentId}`)
+    .digest("hex")
+    .slice(0, 32)}`;
+  await args.db
+    .insert(schema.contentDatabaseItems)
+    .values({
+      id,
+      ownerEmail: email,
+      orgId: null,
+      databaseId: favoritesDatabaseId,
+      documentId: args.documentId,
+      position: Number(position?.max ?? -1) + 1,
+      createdAt: args.now,
+      updatedAt: args.now,
+    })
+    .onConflictDoNothing();
+  return true;
+}

package/corpus/templates/content/actions/_content-files.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 
 import { accessFilter } from "@agent-native/core/sharing";
-import { and, eq, inArray, isNull, or, sql } from "drizzle-orm";
+import { and, eq, inArray, isNotNull, isNull, or, sql } from "drizzle-orm";
 
 import { schema } from "../server/db/index.js";
 import {
@@ -62,9 +62,44 @@ async function reconcileDocuments(args: {
     args.filesDatabases.map((database) => [database.spaceId, database]),
   );
   const filesDatabaseIds = args.filesDatabases.map((database) => database.id);
-  const filesBackingDocumentIds = new Set(
-    args.filesDatabases.map((database) => database.documentId),
-  );
+  const documentIds = args.documents.map((document) => document.id);
+  const [systemDatabaseDocuments, workspaceReferenceDocuments] =
+    documentIds.length > 0
+      ? await Promise.all([
+          args.db
+            .select({ id: schema.contentDatabases.documentId })
+            .from(schema.contentDatabases)
+            .where(
+              and(
+                inArray(schema.contentDatabases.documentId, documentIds),
+                isNotNull(schema.contentDatabases.systemRole),
+              ),
+            ),
+          args.db
+            .select({ id: schema.contentSpaceCatalogItems.documentId })
+            .from(schema.contentSpaceCatalogItems)
+            .innerJoin(
+              schema.contentDatabases,
+              eq(
+                schema.contentDatabases.id,
+                schema.contentSpaceCatalogItems.catalogDatabaseId,
+              ),
+            )
+            .where(
+              and(
+                inArray(
+                  schema.contentSpaceCatalogItems.documentId,
+                  documentIds,
+                ),
+                eq(schema.contentDatabases.systemRole, "workspaces"),
+              ),
+            ),
+        ])
+      : [[], []];
+  const excludedDocumentIds = new Set([
+    ...systemDatabaseDocuments.map((document: any) => document.id),
+    ...workspaceReferenceDocuments.map((document: any) => document.id),
+  ]);
   const existingItems = filesDatabaseIds.length
     ? await args.db
         .select()
@@ -93,7 +128,7 @@ async function reconcileDocuments(args: {
   const inserts: Array<typeof schema.contentDatabaseItems.$inferInsert> = [];
   for (const document of args.documents) {
     const existing = itemsByDocument.get(document.id) ?? [];
-    if (filesBackingDocumentIds.has(document.id)) {
+    if (excludedDocumentIds.has(document.id)) {
       for (const item of existing) deleteIds.add(item.id);
       continue;
     }
@@ -239,24 +274,23 @@ export async function reconcileContentFilesMemberships(
   const email = normalizeContentSpaceEmail(userEmail);
   const memberships = await listContentOrganizationMemberships(email);
   const personalSpaceId = personalContentSpaceId(email);
-  const orgSpaceIds = new Map<string, string>();
+  const orgSpaces = new Map<
+    string,
+    { spaceId: string; canReconcilePrivateDocuments: boolean }
+  >();
   for (const membership of memberships) {
     const spaceId = organizationContentSpaceId(membership.orgId);
-    try {
-      await resolveContentSpaceAccess(spaceId, "editor");
-      orgSpaceIds.set(membership.orgId, spaceId);
-    } catch (error) {
-      if (
-        error instanceof Error &&
-        error.message ===
-          `Editor access is required for Content space "${spaceId}"`
-      ) {
-        continue;
-      }
-      throw error;
-    }
+    await resolveContentSpaceAccess(spaceId);
+    orgSpaces.set(membership.orgId, {
+      spaceId,
+      canReconcilePrivateDocuments:
+        membership.role === "owner" || membership.role === "admin",
+    });
   }
-  const accessibleSpaceIds = [personalSpaceId, ...orgSpaceIds.values()];
+  const accessibleSpaceIds = [
+    personalSpaceId,
+    ...[...orgSpaces.values()].map(({ spaceId }) => spaceId),
+  ];
   const now = new Date().toISOString();
   const result: ContentFilesReconciliation = {
     assignedSpaces: 0,
@@ -288,7 +322,7 @@ export async function reconcileContentFilesMemberships(
         );
       result.assignedSpaces += personalLegacyDocuments.length;
     }
-    for (const [orgId, spaceId] of orgSpaceIds) {
+    for (const [orgId, orgSpace] of orgSpaces) {
       const legacyDocuments = await tx
         .select({ id: schema.documents.id })
         .from(schema.documents)
@@ -296,12 +330,19 @@ export async function reconcileContentFilesMemberships(
           and(
             eq(schema.documents.orgId, orgId),
             isNull(schema.documents.spaceId),
+            orgSpace.canReconcilePrivateDocuments
+              ? undefined
+              : or(
+                  eq(schema.documents.ownerEmail, email),
+                  eq(schema.documents.visibility, "org"),
+                  eq(schema.documents.visibility, "public"),
+                ),
           ),
         );
       if (!legacyDocuments.length) continue;
       await tx
         .update(schema.documents)
-        .set({ spaceId, updatedAt: now })
+        .set({ spaceId: orgSpace.spaceId, updatedAt: now })
         .where(
           inArray(
             schema.documents.id,
@@ -311,10 +352,25 @@ export async function reconcileContentFilesMemberships(
       result.assignedSpaces += legacyDocuments.length;
     }
 
-    const documents = await tx
+    const accessibleDocuments = await tx
       .select()
       .from(schema.documents)
       .where(inArray(schema.documents.spaceId, accessibleSpaceIds));
+    const orgSpaceById = new Map(
+      [...orgSpaces.values()].map((space) => [space.spaceId, space]),
+    );
+    const documents = accessibleDocuments.filter((document: any) => {
+      if (document.spaceId === personalSpaceId) {
+        return normalizeContentSpaceEmail(document.ownerEmail) === email;
+      }
+      const orgSpace = orgSpaceById.get(document.spaceId);
+      return (
+        orgSpace?.canReconcilePrivateDocuments === true ||
+        normalizeContentSpaceEmail(document.ownerEmail) === email ||
+        document.visibility === "org" ||
+        document.visibility === "public"
+      );
+    });
     const filesDatabases = await tx
       .select()
       .from(schema.contentDatabases)

package/corpus/templates/content/actions/_content-sidebar-state.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+
+export const CONTENT_SIDEBAR_STATE_VERSION = 1;
+export const CONTENT_SIDEBAR_STATE_SETTING_KEY = "content-sidebar-state";
+
+const expandedIdSchema = z.string().min(1).max(256);
+
+export const contentSidebarStateSchema = z.object({
+  version: z.literal(CONTENT_SIDEBAR_STATE_VERSION),
+  expandedWorkspaceIds: z.array(expandedIdSchema).max(1_000),
+  expandedDocumentIds: z.array(expandedIdSchema).max(5_000),
+});
+
+export type ContentSidebarState = z.infer<typeof contentSidebarStateSchema>;
+
+export function normalizeContentSidebarState(value: unknown) {
+  const parsed = contentSidebarStateSchema.safeParse(value);
+  if (!parsed.success) return null;
+  return {
+    ...parsed.data,
+    expandedWorkspaceIds: [...new Set(parsed.data.expandedWorkspaceIds)],
+    expandedDocumentIds: [...new Set(parsed.data.expandedDocumentIds)],
+  };
+}