@agent-native/core 0.114.0 → 0.114.1

package/corpus/README.md

@@ -28,6 +28,6 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- core files: 1513
+- core files: 1514
 - toolkit files: 137
-- template files: 6055
+- template files: 6086

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @agent-native/core
 
+## 0.114.1
+
+### Patch Changes
+
+- c913280: Keep action mutations pending until asynchronous success callbacks finish.
+- c913280: Allow email-password signup without email verification on Netlify deploy previews while preserving explicit verification overrides, and hold auth requests until their serverless routes finish mounting.
+- c913280: Fence incompatible cached browser clients from newer action backends and reload version-aware tabs with a cache-busted build.
+- c913280: Honor an explicit Personal context for users who also belong to organizations.
+
 ## 0.114.0
 
 ### Minor Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.114.0",
+  "version": "0.114.1",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/client/build-compatibility.ts

@@ -0,0 +1,77 @@
+declare const __AGENT_NATIVE_BUILD_ID__: string | undefined;
+declare const __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__: string | undefined;
+
+const RELOAD_MARKER_KEY = "__agentNativeClientCompatibilityReload";
+export const BUILD_CACHE_BUSTER_PARAM = "__an_build";
+
+type CompatibilityWindow = Pick<Window, "location" | "history"> & {
+  sessionStorage?: Storage;
+  __agentNativeClientCompatibilityReload?: string;
+};
+
+export function clientBuildId(): string {
+  if (typeof __AGENT_NATIVE_BUILD_ID__ === "string") {
+    return __AGENT_NATIVE_BUILD_ID__;
+  }
+  return (
+    (globalThis as typeof globalThis & { __AGENT_NATIVE_BUILD_ID__?: string })
+      .__AGENT_NATIVE_BUILD_ID__ ?? ""
+  );
+}
+
+export function clientCompatibilityVersion(): string {
+  if (typeof __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__ === "string") {
+    return __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__;
+  }
+  return (
+    (
+      globalThis as typeof globalThis & {
+        __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__?: string;
+      }
+    ).__AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__ ?? ""
+  );
+}
+
+function readReloadMarker(win: CompatibilityWindow): string {
+  try {
+    return win.sessionStorage?.getItem(RELOAD_MARKER_KEY) ?? "";
+  } catch {
+    return win.__agentNativeClientCompatibilityReload ?? "";
+  }
+}
+
+function writeReloadMarker(win: CompatibilityWindow, marker: string): void {
+  win.__agentNativeClientCompatibilityReload = marker;
+  try {
+    win.sessionStorage?.setItem(RELOAD_MARKER_KEY, marker);
+  } catch {}
+}
+
+export function reloadForClientCompatibilityMismatch(
+  serverBuildId: string,
+  requiredCompatibility: string,
+  win: CompatibilityWindow | undefined = typeof window === "undefined"
+    ? undefined
+    : window,
+): boolean {
+  if (!win?.location) return false;
+  const marker = `${requiredCompatibility}:${serverBuildId}`;
+  if (readReloadMarker(win) === marker) return false;
+  writeReloadMarker(win, marker);
+  const target = new URL(win.location.href);
+  target.searchParams.set(BUILD_CACHE_BUSTER_PARAM, serverBuildId || "latest");
+  win.location.replace(target.href);
+  return true;
+}
+
+export function stripBuildCompatibilityCacheBuster(
+  win: CompatibilityWindow | undefined = typeof window === "undefined"
+    ? undefined
+    : window,
+): void {
+  if (!win?.location || !win.history) return;
+  const target = new URL(win.location.href);
+  if (!target.searchParams.has(BUILD_CACHE_BUSTER_PARAM)) return;
+  target.searchParams.delete(BUILD_CACHE_BUSTER_PARAM);
+  win.history.replaceState(win.history.state, "", target.href);
+}

package/corpus/core/src/client/route-chunk-recovery/index.ts

@@ -1 +1,2 @@
 export * from "../route-chunk-recovery.js";
+export * from "../build-compatibility.js";

package/corpus/core/src/client/use-action.ts

@@ -30,6 +30,11 @@ import type {
 import { trackEvent } from "./analytics.js";
 import { agentNativePath } from "./api-path.js";
 import { getBrowserTabId } from "./browser-tab-id.js";
+import {
+  clientBuildId,
+  clientCompatibilityVersion,
+  reloadForClientCompatibilityMismatch,
+} from "./build-compatibility.js";
 import { ensureEmbedAuthFetchInterceptor } from "./embed-auth.js";
 
 const ACTION_PREFIX = agentNativePath("/_agent-native/actions");
@@ -281,6 +286,12 @@ async function performActionFetch<T>(
         }
       : {}),
   };
+  const compatibilityVersion = clientCompatibilityVersion();
+  if (compatibilityVersion) {
+    headers["X-Agent-Native-Client-Compatibility"] = compatibilityVersion;
+  }
+  const buildId = clientBuildId();
+  if (buildId) headers["X-Agent-Native-Build-Id"] = buildId;
   const tz = resolveUserTimezone();
   if (tz) headers["x-user-timezone"] = tz;
   const init: RequestInit = {
@@ -349,6 +360,26 @@ async function performActionFetch<T>(
       throw new Error(`Action ${name} failed: ${cause}`);
     }
 
+    if (
+      res.status === 409 &&
+      res.headers.get("X-Agent-Native-Client-Mismatch") === "1"
+    ) {
+      const serverBuildId =
+        res.headers.get("X-Agent-Native-Build-Id") ?? "latest";
+      const requiredCompatibility =
+        res.headers.get("X-Agent-Native-Client-Compatibility") ?? "unknown";
+      reloadForClientCompatibilityMismatch(
+        serverBuildId,
+        requiredCompatibility,
+      );
+      const error = new Error(
+        `Action ${name} requires a refreshed browser client`,
+      );
+      (error as any).status = 409;
+      (error as any).code = "client_build_mismatch";
+      throw error;
+    }
+
     // 204 No Content — nothing to parse.
     if (res.status === 204) return null as T;
 
@@ -760,7 +791,7 @@ export function useActionMutation<
       if (!skipActionQueryInvalidation) {
         queryClient.invalidateQueries({ queryKey: ["action"] });
       }
-      (onSuccess as Function)?.(...args);
+      return (onSuccess as Function)?.(...args);
     },
   });
 }

package/corpus/core/src/deploy/build.ts

@@ -1240,7 +1240,7 @@ async function getHandler() {
         headers: {
           "Access-Control-Allow-Origin": "*",
           "Access-Control-Allow-Methods": "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS",
-          "Access-Control-Allow-Headers": "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,X-Agent-Native-Embed-Target",
+          "Access-Control-Allow-Headers": "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-Agent-Native-Embed-Target",
         },
       });
     }
@@ -3479,6 +3479,9 @@ export default bundle;
       "process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID": JSON.stringify(
         process.env.GA_MEASUREMENT_ID?.trim() || "",
       ),
+      "process.env.AGENT_NATIVE_BUILD_DEPLOY_CONTEXT": JSON.stringify(
+        process.env.CONTEXT?.trim() || "",
+      ),
     },
     // Replace browser-only renderers (Excalidraw/Mermaid) with an inert proxy in
     // the server bundle. Without this, Nitro's Rolldown build pulls the real

package/corpus/core/src/org/context.ts

@@ -41,7 +41,8 @@ const nanoid = (): string =>
 /**
  * Resolve the current user's organization context from their session.
  *
- * - For users in multiple orgs, honors their `active-org-id` user setting.
+ * - Honors the user's `active-org-id` setting, including an explicit Personal
+ *   context represented by `{ orgId: null }`.
  * - Falls back to the user's first membership.
  * - When the authenticated user has zero memberships, provisions a default org
  *   named after the user ({name}'s workspace, falling back to the email
@@ -63,6 +64,34 @@ export async function getOrgContext(event: H3Event): Promise<OrgContext> {
 type MembershipRow = { orgId: string; role: OrgRole; orgName: string };
 
 const MEMBERSHIPS_CACHE_KEY = "__anOrgMembershipsCache";
+const ACTIVE_ORG_SETTING_CACHE_KEY = "__anActiveOrgSettingCache";
+
+type ActiveOrgSetting = { orgId: string | null } | null;
+
+function loadActiveOrgSettingForEvent(
+  event: H3Event,
+  email: string,
+): Promise<ActiveOrgSetting> {
+  const ctx = event.context as Record<string, unknown>;
+  const cache = ((ctx[ACTIVE_ORG_SETTING_CACHE_KEY] as
+    | Map<string, Promise<ActiveOrgSetting>>
+    | undefined) ??
+    (ctx[ACTIVE_ORG_SETTING_CACHE_KEY] = new Map<
+      string,
+      Promise<ActiveOrgSetting>
+    >())) as Map<string, Promise<ActiveOrgSetting>>;
+  const normalizedEmail = email.toLowerCase();
+  let promise = cache.get(normalizedEmail);
+  if (!promise) {
+    promise = getUserSetting(email, "active-org-id").then((value) => {
+      if (!value || !("orgId" in value)) return null;
+      if (value.orgId === null) return { orgId: null };
+      return typeof value.orgId === "string" ? { orgId: value.orgId } : null;
+    });
+    cache.set(normalizedEmail, promise);
+  }
+  return promise;
+}
 
 /**
  * Per-request memoization of the org_members lookup, keyed by email on
@@ -128,32 +157,29 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
     return { email, orgId: null, orgName: null, role: null };
   }
 
-  if (memberships.length > 1) {
-    const activeOrgSetting = (await getUserSetting(email, "active-org-id")) as {
-      orgId: string;
-    } | null;
-    if (activeOrgSetting?.orgId) {
-      const active = memberships.find(
-        (m) => m.orgId === activeOrgSetting.orgId,
-      );
-      if (active) {
-        return {
-          email,
-          orgId: active.orgId,
-          orgName: active.orgName,
-          role: active.role,
-        };
-      }
+  const shouldTryDomainAutoJoin =
+    memberships.length === 0 ||
+    (memberships.length === 1 &&
+      isLikelyPersonalWorkspace(memberships[0], email, session));
+  const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
+  if (activeOrgSetting?.orgId === null) {
+    return { email, orgId: null, orgName: null, role: null };
+  }
+  if (activeOrgSetting?.orgId) {
+    const active = memberships.find((m) => m.orgId === activeOrgSetting.orgId);
+    if (active && !shouldTryDomainAutoJoin) {
+      return {
+        email,
+        orgId: active.orgId,
+        orgName: active.orgName,
+        role: active.role,
+      };
     }
   }
 
   const sessionMembership = sessionOrgId
     ? memberships.find((m) => m.orgId === sessionOrgId)
     : null;
-  const shouldTryDomainAutoJoin =
-    memberships.length === 0 ||
-    (memberships.length === 1 &&
-      isLikelyPersonalWorkspace(memberships[0], email, session));
 
   if (shouldTryDomainAutoJoin) {
     const joined = await autoJoinDomainMatchingOrgs(email, {
@@ -248,7 +274,8 @@ async function loadMemberships(
 /**
  * Resolve the active org ID for a given email — for non-HTTP contexts like
  * the integration webhook handler where we have an email but no event/session.
- * Picks the user's active-org-id setting if set, otherwise the first membership.
+ * Picks the user's active-org-id setting if set, including explicit Personal,
+ * otherwise the first membership.
  * Returns null if the user has no memberships.
  */
 export async function resolveOrgIdForEmail(
@@ -263,10 +290,11 @@ export async function resolveOrgIdForEmail(
     });
     if (rows.length === 0) return null;
     const ids = rows.map((r: any) => String(r.org_id));
-    if (ids.length === 1) return ids[0];
-    const activeOrgSetting = (await getUserSetting(email, "active-org-id")) as {
-      orgId: string;
-    } | null;
+    const activeOrgSetting = (await getUserSetting(
+      email,
+      "active-org-id",
+    )) as ActiveOrgSetting;
+    if (activeOrgSetting?.orgId === null) return null;
     if (activeOrgSetting?.orgId && ids.includes(activeOrgSetting.orgId)) {
       return activeOrgSetting.orgId;
     }
@@ -291,10 +319,8 @@ export async function resolveOrgIdForEmailViaEvent(
     if (!exec) return null;
     const memberships = await loadMembershipsForEvent(event, exec, email);
     if (!memberships || memberships.length === 0) return null;
-    if (memberships.length === 1) return memberships[0].orgId;
-    const activeOrgSetting = (await getUserSetting(email, "active-org-id")) as {
-      orgId: string;
-    } | null;
+    const activeOrgSetting = await loadActiveOrgSettingForEvent(event, email);
+    if (activeOrgSetting?.orgId === null) return null;
     if (
       activeOrgSetting?.orgId &&
       memberships.some((m) => m.orgId === activeOrgSetting.orgId)

package/corpus/core/src/server/action-routes.ts

@@ -30,6 +30,26 @@ import {
   getAllowedCorsOrigin as resolveAllowedCorsOrigin,
   readCorsAllowedOrigins,
 } from "./cors-origins.js";
+
+declare const __AGENT_NATIVE_BUILD_ID__: string | undefined;
+declare const __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__: string | undefined;
+
+function requiredClientCompatibilityVersion(): string {
+  const configured =
+    typeof __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__ === "string"
+      ? __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__
+      : process.env.AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION;
+  return configured?.trim() ?? "";
+}
+
+function currentBuildId(): string {
+  const configured =
+    typeof __AGENT_NATIVE_BUILD_ID__ === "string"
+      ? __AGENT_NATIVE_BUILD_ID__
+      : process.env.AGENT_NATIVE_BUILD_ID;
+  return configured?.trim() || "unknown";
+}
+
 /**
  * Auto-mount actions as HTTP endpoints under /_agent-native/actions/:name.
  *
@@ -187,8 +207,8 @@ function handleOptionsRequest(event: any): string {
       event,
       "Access-Control-Allow-Headers",
       cors.credentials
-        ? `Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,${EMBED_TARGET_HEADER}`
-        : `${MCP_EMBED_CORS_ALLOW_HEADERS},X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend`,
+        ? `Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,${EMBED_TARGET_HEADER}`
+        : `${MCP_EMBED_CORS_ALLOW_HEADERS},X-Agent-Native-Tool-Bridge,X-Agent-Native-Tool-Id,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id`,
     );
   }
 
@@ -320,6 +340,11 @@ export function mountActionRoutes(
         }
 
         setResponseHeader(event, "Cache-Control", "no-store");
+        setResponseHeader(
+          event,
+          "Access-Control-Expose-Headers",
+          "X-Agent-Native-Client-Mismatch,X-Agent-Native-Build-Id,X-Agent-Native-Client-Compatibility",
+        );
 
         // Allow the declared method
         if (effectiveMethod !== method) {
@@ -327,6 +352,31 @@ export function mountActionRoutes(
           return { error: `Method not allowed. Use ${method}.` };
         }
 
+        const requiredCompatibility = requiredClientCompatibilityVersion();
+        if (isFrontendActionRequest(event) && requiredCompatibility) {
+          const receivedCompatibility = getHeader(
+            event,
+            "x-agent-native-client-compatibility",
+          );
+          if (receivedCompatibility !== requiredCompatibility) {
+            const serverBuildId = currentBuildId();
+            setResponseStatus(event, 409);
+            setResponseHeader(event, "X-Agent-Native-Client-Mismatch", "1");
+            setResponseHeader(event, "X-Agent-Native-Build-Id", serverBuildId);
+            setResponseHeader(
+              event,
+              "X-Agent-Native-Client-Compatibility",
+              requiredCompatibility,
+            );
+            return {
+              error: "This browser tab must reload before it can use this app.",
+              code: "client_build_mismatch",
+              serverBuildId,
+              requiredCompatibility,
+            };
+          }
+        }
+
         // (audit H5) Per-action `toolCallable` opt-out for the tools-iframe
         // bridge. The bridge tags every outbound action call with
         // X-Agent-Native-Tool-Bridge: 1. When that header is present and the

package/corpus/core/src/server/auth-plugin.ts

@@ -4,16 +4,21 @@ import {
   getH3App,
   awaitBootstrap,
   markDefaultPluginProvided,
+  trackPluginInit,
 } from "./framework-request-handler.js";
 
 type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
 
 export function createAuthPlugin(options?: AuthOptions): NitroPluginDef {
-  return async (nitroApp: any) => {
+  return (nitroApp: any) => {
     markDefaultPluginProvided(nitroApp, "auth");
-    // Wait for any other default plugins to finish mounting first.
-    await awaitBootstrap(nitroApp);
-    await autoMountAuth(getH3App(nitroApp), options);
+    const initPromise = (async () => {
+      await awaitBootstrap(nitroApp);
+      await autoMountAuth(getH3App(nitroApp), options);
+    })();
+    trackPluginInit(nitroApp, initPromise, {
+      paths: ["/_agent-native/auth"],
+    });
   };
 }
 

package/corpus/core/src/server/better-auth-instance.ts

@@ -317,8 +317,12 @@ export function resolveSignupTrackingProperties(): Record<string, string> {
 export function shouldSkipEmailVerification(): boolean {
   const value = process.env.AUTH_SKIP_EMAIL_VERIFICATION;
   if (value == null) {
+    const deployContext =
+      process.env.AGENT_NATIVE_BUILD_DEPLOY_CONTEXT || process.env.CONTEXT;
     return (
-      process.env.NODE_ENV === "development" || process.env.NODE_ENV === "test"
+      process.env.NODE_ENV === "development" ||
+      process.env.NODE_ENV === "test" ||
+      deployContext === "deploy-preview"
     );
   }
   const normalized = value.trim().toLowerCase();

package/corpus/core/src/shared/mcp-embed-headers.ts

@@ -1,5 +1,5 @@
 export const MCP_EMBED_CORS_ALLOW_HEADERS =
-  "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+  "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 
 const CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\.claudemcpcontent\.com$/i;

package/corpus/core/src/vite/client.ts

@@ -1351,6 +1351,12 @@ export interface ClientConfigOptions {
   optimizeDeps?: NonNullable<UserConfig["optimizeDeps"]>;
   /** Additional Vite define constants. */
   define?: UserConfig["define"];
+  /**
+   * Browser/server compatibility epoch for app changes that cannot safely run
+   * across a cached client and a newer action backend. Bump only for an
+   * incompatible protocol or data-model transition, not for every deploy.
+   */
+  clientCompatibilityVersion?: string;
   /**
    * Framework route warmup behavior mounted by AgentSidebar.
    *
@@ -2685,6 +2691,13 @@ function createAgentNativeConfig(
   userConfig: UserConfig = {},
 ): UserConfig {
   const cwd = process.cwd();
+  const buildId =
+    process.env.DEPLOY_ID?.trim() ||
+    process.env.COMMIT_REF?.trim() ||
+    process.env.VERCEL_GIT_COMMIT_SHA?.trim() ||
+    process.env.CF_PAGES_COMMIT_SHA?.trim() ||
+    process.env.AGENT_NATIVE_BUILD_SHA?.trim() ||
+    "development";
 
   // Workspace env fallback. If this app is inside a workspace, tell Vite to
   // also look for .env files at the workspace root. Per-app .env still wins
@@ -2769,6 +2782,10 @@ function createAgentNativeConfig(
     define: {
       ...(userConfig.define ?? {}),
       ...(options.define ?? {}),
+      __AGENT_NATIVE_BUILD_ID__: JSON.stringify(buildId),
+      __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__: JSON.stringify(
+        options.clientCompatibilityVersion?.trim() || "",
+      ),
       __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: JSON.stringify(
         process.env.GA_MEASUREMENT_ID?.trim() || "",
       ),

package/corpus/templates/content/AGENTS.md

@@ -134,6 +134,8 @@ cd templates/content && pnpm action <name> [args]
 | `ensure-content-spaces`                     |                                                                                                                                                                                                    | Idempotently provision the signed-in user's personal and current organization Content spaces, system databases, and catalog references                                            |
 | `backfill-content-files`                    |                                                                                                                                                                                                    | Assign legacy pages to Content spaces and reconcile exactly one canonical Files database membership per non-system page                                                           |
 | `list-content-spaces`                       |                                                                                                                                                                                                    | List already-provisioned Content spaces authorized by the signed-in user's current ownership or organization memberships                                                          |
+| `create-content-space`                      | `--name <name> --requestId <opaque-id>`                                                                                                                                                            | Idempotently create a private named Content workspace with its own canonical Files database                                                                                       |
+| `delete-content-space`                      | `--spaceId <id>`                                                                                                                                                                                   | Permanently delete a user-created Content workspace and all of its content; Personal and organization workspaces are protected                                                    |
 | `create-content-database`                   | `[--documentId <id>] [--spaceId <id>] [--parentId <id>] [--title <text>] [--description <text>]`                                                                                                   | Create a described database page in a Content space or convert an existing page into a database                                                                                   |
 | `create-inline-content-database`            | `--hostDocumentId <id> [--title <text>] [--description <text>]`                                                                                                                                    | Create a described database owned by an inline database block in the host document                                                                                                |
 | `get-content-database`                      | `--databaseId <id>` or `--documentId <id>`                                                                                                                                                         | Get a database with its description, property/option schema guidance, item pages, and computed ancestry context                                                                   |

package/corpus/templates/content/actions/_content-database-personal-view.ts

@@ -4,8 +4,12 @@ import { and, eq, isNull } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { CONTENT_DATABASE_PERSONAL_VIEW_OVERRIDES_VERSION } from "../shared/api.js";
+import { resolveContentSpaceAccess } from "./_content-space-access.js";
+import { filesParentPropertyId } from "./_files-system-properties.js";
 
-export const PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION = 1;
+export const PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION =
+  CONTENT_DATABASE_PERSONAL_VIEW_OVERRIDES_VERSION;
 
 export const personalDatabaseViewSettingKey = (databaseId: string) =>
   `content-database-personal-view:${databaseId}`;
@@ -38,8 +42,7 @@ export const filterSchema = z.object({
   parentFilterGroupId: z.string().optional(),
 });
 
-export const personalViewOverridesSchema = z.object({
-  version: z.literal(PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION),
+const personalViewOverridesFields = {
   activeViewId: z.string().optional(),
   views: z.array(
     z.object({
@@ -49,6 +52,16 @@ export const personalViewOverridesSchema = z.object({
       filterMode: z.enum(["and", "or"]).default("and"),
     }),
   ),
+};
+
+export const personalViewOverridesSchema = z.object({
+  version: z.literal(PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION),
+  ...personalViewOverridesFields,
+});
+
+const legacyPersonalViewOverridesSchema = z.object({
+  version: z.literal(1),
+  ...personalViewOverridesFields,
 });
 
 export async function assertContentDatabaseViewerAccess(databaseId: string) {
@@ -64,7 +77,12 @@ export async function assertContentDatabaseViewerAccess(databaseId: string) {
     );
   if (!database) throw new Error(`Database "${databaseId}" not found`);
 
-  await assertAccess("document", database.documentId, "viewer");
+  try {
+    await assertAccess("document", database.documentId, "viewer");
+  } catch (error) {
+    if (database.systemRole !== "files" || !database.spaceId) throw error;
+    await resolveContentSpaceAccess(database.spaceId);
+  }
 }
 
 export async function readPersonalDatabaseViewOverrides(
@@ -76,5 +94,31 @@ export async function readPersonalDatabaseViewOverrides(
     personalDatabaseViewSettingKey(databaseId),
   );
   const parsed = personalViewOverridesSchema.safeParse(stored);
-  return parsed.success ? parsed.data : null;
+  if (parsed.success) return parsed.data;
+
+  const legacy = legacyPersonalViewOverridesSchema.safeParse(stored);
+  if (!legacy.success) return null;
+  const [database] = await getDb()
+    .select({ systemRole: schema.contentDatabases.systemRole })
+    .from(schema.contentDatabases)
+    .where(eq(schema.contentDatabases.id, databaseId));
+  const legacyParentKey = filesParentPropertyId(databaseId);
+  return {
+    ...legacy.data,
+    version: PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION,
+    views: legacy.data.views.map((view) => ({
+      ...view,
+      filters:
+        database?.systemRole === "files"
+          ? view.filters.filter(
+              (filter) =>
+                !(
+                  filter.key === legacyParentKey &&
+                  filter.operator === "is_empty" &&
+                  filter.value === ""
+                ),
+            )
+          : view.filters,
+    })),
+  };
 }

package/corpus/templates/content/actions/_content-document-access.ts

@@ -0,0 +1,21 @@
+import { getRequestUserEmail } from "@agent-native/core/server/request-context";
+import { resolveAccess } from "@agent-native/core/sharing";
+
+import { listContentOrganizationMemberships } from "./_content-space-access.js";
+
+export async function resolveContentDocumentAccess(documentId: string) {
+  const current = await resolveAccess("document", documentId);
+  if (current) return current;
+
+  const userEmail = getRequestUserEmail();
+  if (!userEmail) return null;
+  const memberships = await listContentOrganizationMemberships(userEmail);
+  for (const membership of memberships) {
+    const access = await resolveAccess("document", documentId, {
+      userEmail,
+      orgId: membership.orgId,
+    });
+    if (access) return access;
+  }
+  return null;
+}