@agent-native/core 0.114.0 → 0.114.1

package/corpus/templates/content/actions/delete-database-items.ts

@@ -1,8 +1,10 @@
 import { defineAction } from "@agent-native/core";
 import { writeAppState } from "@agent-native/core/application-state";
 import { assertAccess } from "@agent-native/core/sharing";
+import { inArray } from "drizzle-orm";
 
-import { getDb } from "../server/db/index.js";
+import { getDb, schema } from "../server/db/index.js";
+import { assertNotWorkspaceCatalogDocuments } from "./_content-space-catalog-guards.js";
 import {
   databaseRowBatchSchema,
   renumberDatabaseRows,
@@ -20,12 +22,37 @@ export default defineAction({
     const { database, rows } = await resolveDatabaseRowsForBatch(args);
 
     await assertAccess("document", database.documentId, "editor");
+    if (database.systemRole === "favorites") {
+      const removedItemIds = rows.map((row) => row.item.id);
+      const removedDocumentIds = rows.map((row) => row.document.id);
+      const now = new Date().toISOString();
+      await db.transaction(async (tx) => {
+        await tx
+          .delete(schema.contentDatabaseItems)
+          .where(inArray(schema.contentDatabaseItems.id, removedItemIds));
+        await renumberDatabaseRows(
+          tx as unknown as ReturnType<typeof getDb>,
+          database,
+          now,
+        );
+      });
+      await writeAppState("refresh-signal", { ts: Date.now() });
+      return {
+        ...(await getContentDatabaseResponse(database.id)),
+        deletedItemIds: removedItemIds,
+        deletedDocumentIds: [],
+        deletedCount: 0,
+        removedDocumentIds,
+        removedCount: removedItemIds.length,
+      };
+    }
     for (const row of rows) {
       await assertAccess("document", row.document.id, "admin");
     }
 
     const deletedItemIds = rows.map((row) => row.item.id);
     const deletedDocumentIds = rows.map((row) => row.document.id);
+    await assertNotWorkspaceCatalogDocuments(db, deletedDocumentIds, "deleted");
     const now = new Date().toISOString();
 
     await db.transaction(async (tx) => {

package/corpus/templates/content/actions/delete-document-property.ts

@@ -44,6 +44,9 @@ export default defineAction({
         ),
       );
     if (!definition) throw new Error(`Property "${propertyId}" not found`);
+    if (definition.systemRole) {
+      throw new Error("System properties cannot be deleted.");
+    }
 
     const isBlocks = isBlocksPropertyType(
       definition.type as DocumentPropertyType,

package/corpus/templates/content/actions/delete-document.ts

@@ -6,6 +6,7 @@ import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
 import { chunks } from "./_batch-utils.js";
+import { assertNotWorkspaceCatalogDocuments } from "./_content-space-catalog-guards.js";
 
 const DELETE_BATCH_SIZE = 90;
 
@@ -170,6 +171,7 @@ export async function deleteDocumentRecursive(
 ): Promise<string[]> {
   const { documentIds, ownedDatabaseIds } =
     await collectDocumentSubtreeForDelete(db, id, ownerEmail);
+  await assertNotWorkspaceCatalogDocuments(db, documentIds, "deleted");
 
   const propertyDefinitionIds: string[] = [];
   await deleteWhereIn(ownedDatabaseIds, async (databaseIdBatch) => {
@@ -355,15 +357,50 @@ export default defineAction({
   description: "Delete a document and all its children recursively.",
   schema: z.object({
     id: z.string().optional().describe("Document ID (required)"),
+    databaseDocumentId: z
+      .string()
+      .optional()
+      .describe("Database page the deletion was initiated from"),
   }),
   run: async (args) => {
     const id = args.id;
     if (!id) throw new Error("--id is required");
 
+    const db = getDb();
+    if (args.databaseDocumentId) {
+      const [contextDatabase] = await db
+        .select()
+        .from(schema.contentDatabases)
+        .where(
+          and(
+            eq(schema.contentDatabases.documentId, args.databaseDocumentId),
+            eq(schema.contentDatabases.systemRole, "favorites"),
+          ),
+        );
+      if (contextDatabase) {
+        await assertAccess("document", contextDatabase.documentId, "editor");
+        const [membership] = await db
+          .select({ id: schema.contentDatabaseItems.id })
+          .from(schema.contentDatabaseItems)
+          .where(
+            and(
+              eq(schema.contentDatabaseItems.databaseId, contextDatabase.id),
+              eq(schema.contentDatabaseItems.documentId, id),
+            ),
+          );
+        if (!membership) {
+          throw new Error("Document is not part of Favorites");
+        }
+        await db
+          .delete(schema.contentDatabaseItems)
+          .where(eq(schema.contentDatabaseItems.id, membership.id));
+        await writeAppState("refresh-signal", { ts: Date.now() });
+        return { success: true, deleted: 0, removed: 1 };
+      }
+    }
+
     const access = await assertAccess("document", id, "admin");
     const existing = access.resource;
-
-    const db = getDb();
     const [systemDatabase] = await db
       .select({ systemRole: schema.contentDatabases.systemRole })
       .from(schema.contentDatabases)

package/corpus/templates/content/actions/duplicate-database-item.ts

@@ -7,6 +7,7 @@ import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
 import { ensureDocumentFilesMembership } from "./_content-files.js";
+import { assertNotWorkspaceCatalogDocuments } from "./_content-space-catalog-guards.js";
 import { getContentDatabaseResponse } from "./_database-utils.js";
 import { nanoid } from "./_property-utils.js";
 
@@ -58,6 +59,11 @@ export default defineAction({
 
     await assertAccess("document", row.database.documentId, "editor");
     await assertAccess("document", row.document.id, "viewer");
+    await assertNotWorkspaceCatalogDocuments(
+      db,
+      [row.document.id],
+      "duplicated",
+    );
 
     const now = new Date().toISOString();
     const nextDocumentId = nanoid();

package/corpus/templates/content/actions/duplicate-database-items.ts

@@ -6,6 +6,7 @@ import { and, eq, gte, inArray, sql } from "drizzle-orm";
 
 import { getDb, schema } from "../server/db/index.js";
 import { ensureDocumentsFilesMembership } from "./_content-files.js";
+import { assertNotWorkspaceCatalogDocuments } from "./_content-space-catalog-guards.js";
 import {
   databaseRowBatchSchema,
   resolveDatabaseRowsForBatch,
@@ -33,6 +34,11 @@ export default defineAction({
     }
 
     const sourceDocumentIds = rows.map((row) => row.document.id);
+    await assertNotWorkspaceCatalogDocuments(
+      db,
+      sourceDocumentIds,
+      "duplicated",
+    );
     const sourceItemIds = rows.map((row) => row.item.id);
     const now = new Date().toISOString();
     const insertionPosition =

package/corpus/templates/content/actions/duplicate-document-property.ts

@@ -48,6 +48,9 @@ export default defineAction({
         ),
       );
     if (!definition) throw new Error(`Property "${propertyId}" not found`);
+    if (definition.systemRole) {
+      throw new Error("System properties cannot be duplicated.");
+    }
 
     const now = new Date().toISOString();
     const newPropertyId = nanoid();

package/corpus/templates/content/actions/get-content-database.ts

@@ -8,6 +8,7 @@ import type {
   ContentDatabaseResponse,
   ContentDatabaseUnavailableResponse,
 } from "../shared/api.js";
+import { resolveContentSpaceAccess } from "./_content-space-access.js";
 import {
   CONTENT_DATABASE_MAX_READ_LIMIT,
   getContentDatabaseResponse,
@@ -65,8 +66,16 @@ export default defineAction({
       };
     }
 
-    const access = await resolveAccess("document", database.documentId);
-    if (!access) throw new Error(`Database "${resolvedDatabaseId}" not found`);
+    let canRead = Boolean(await resolveAccess("document", database.documentId));
+    if (!canRead && database.systemRole === "files" && database.spaceId) {
+      try {
+        await resolveContentSpaceAccess(database.spaceId);
+        canRead = true;
+      } catch {
+        canRead = false;
+      }
+    }
+    if (!canRead) throw new Error(`Database "${resolvedDatabaseId}" not found`);
 
     if (database.deletedAt) {
       return {

package/corpus/templates/content/actions/get-content-sidebar-state.ts

@@ -0,0 +1,23 @@
+import { defineAction } from "@agent-native/core/action";
+import { getUserSetting } from "@agent-native/core/settings";
+import { z } from "zod";
+
+import {
+  CONTENT_SIDEBAR_STATE_SETTING_KEY,
+  normalizeContentSidebarState,
+} from "./_content-sidebar-state.js";
+
+export default defineAction({
+  description: "Read the current user's Content sidebar expansion state.",
+  schema: z.object({}),
+  http: { method: "GET" },
+  agentTool: false,
+  run: async (_args, ctx) => {
+    if (!ctx?.userEmail) throw new Error("Not authenticated.");
+    const stored = await getUserSetting(
+      ctx.userEmail,
+      CONTENT_SIDEBAR_STATE_SETTING_KEY,
+    );
+    return { state: normalizeContentSidebarState(stored) };
+  },
+});

package/corpus/templates/content/actions/get-document.ts

@@ -1,12 +1,14 @@
 import { defineAction } from "@agent-native/core";
 import { buildDeepLink } from "@agent-native/core/server";
+import { getRequestUserEmail } from "@agent-native/core/server/request-context";
 import { resolveAccess } from "@agent-native/core/sharing";
+import { eq } from "drizzle-orm";
 import { z } from "zod";
 
-import {
-  parseDocumentFavorite,
-  parseDocumentHideFromSearch,
-} from "../server/lib/documents.js";
+import { getDb, schema } from "../server/db/index.js";
+import { parseDocumentHideFromSearch } from "../server/lib/documents.js";
+import { favoriteDocumentIds } from "./_content-favorites.js";
+import { resolveContentSpaceAccess } from "./_content-space-access.js";
 import {
   getDatabaseByDocumentId,
   getDocumentContextPath,
@@ -15,7 +17,6 @@ import {
   serializeDatabaseMembership,
 } from "./_database-utils.js";
 import { serializeDocumentSource } from "./_document-source.js";
-import "../server/db/index.js";
 import {
   listPropertiesForDocument,
   serializeDatabase,
@@ -29,6 +30,26 @@ function canManageRole(role: string) {
   return role === "owner" || role === "admin";
 }
 
+async function resolveDocumentAccess(id: string) {
+  const current = await resolveAccess("document", id);
+  if (current) return current;
+  const [reference] = await getDb()
+    .select({ spaceId: schema.documents.spaceId })
+    .from(schema.documents)
+    .where(eq(schema.documents.id, id))
+    .limit(1);
+  if (!reference?.spaceId) return null;
+  try {
+    const spaceAccess = await resolveContentSpaceAccess(reference.spaceId);
+    return resolveAccess("document", id, {
+      userEmail: spaceAccess.authority.userEmail,
+      orgId: spaceAccess.authority.orgId ?? undefined,
+    });
+  } catch {
+    return null;
+  }
+}
+
 export default defineAction({
   description: "Get a single document by ID with full content.",
   schema: z.object({
@@ -40,7 +61,7 @@ export default defineAction({
   run: async (args) => {
     if (!args.id) throw new Error("--id is required");
 
-    const access = await resolveAccess("document", args.id);
+    const access = await resolveDocumentAccess(args.id);
     // Not-found is a deterministic client-state condition (deleted or
     // inaccessible document still referenced by an open tab) — 404, not a
     // 500 that floods the console as Internal Server Error.
@@ -57,6 +78,10 @@ export default defineAction({
     const doc = access.resource;
     const database = await getDatabaseByDocumentId(doc.id);
     const databaseMembership = await getDatabaseItemByDocumentId(doc.id);
+    const userEmail = getRequestUserEmail();
+    const favoriteIds = userEmail
+      ? await favoriteDocumentIds(getDb(), userEmail, [doc.id])
+      : new Set<string>();
 
     return {
       id: doc.id,
@@ -71,7 +96,7 @@ export default defineAction({
       description: doc.description,
       icon: doc.icon,
       position: doc.position,
-      isFavorite: parseDocumentFavorite(doc.isFavorite),
+      isFavorite: favoriteIds.has(doc.id),
       hideFromSearch: parseDocumentHideFromSearch(doc.hideFromSearch),
       visibility: doc.visibility,
       source: serializeDocumentSource(doc),

package/corpus/templates/content/actions/import-content-source.ts

@@ -15,6 +15,10 @@ import {
   parseContentSourceFile,
   type ParsedContentSourceFile,
 } from "../shared/content-source.js";
+import {
+  favoriteDocumentIds,
+  setFavoriteMembership,
+} from "./_content-favorites.js";
 import { ensureDocumentsFilesMembership } from "./_content-files.js";
 import { resolveContentSpaceAccess } from "./_content-space-access.js";
 import {
@@ -231,6 +235,16 @@ export default defineAction({
         .filter((document) => document.sourcePath)
         .map((document) => [document.sourcePath!, document]),
     );
+    const existingFavoriteIds = await favoriteDocumentIds(
+      db,
+      currentUserEmail,
+      [
+        ...new Set([
+          ...parsed.flatMap((file) => (file.id ? [file.id] : [])),
+          ...existingLocalDocs.map((document) => document.id),
+        ]),
+      ],
+    );
 
     const seenIds = new Set<string>();
     const duplicateIds = new Set<string>();
@@ -311,7 +325,7 @@ export default defineAction({
           file.icon !== undefined && file.icon !== existing.icon;
         const favoriteChanged =
           file.isFavorite !== undefined &&
-          boolToInt(file.isFavorite) !== (existing.isFavorite ?? 0);
+          file.isFavorite !== existingFavoriteIds.has(id);
         const discoverabilityChanged =
           file.hideFromSearch !== undefined &&
           boolToInt(file.hideFromSearch) !== (existing.hideFromSearch ?? 0);
@@ -363,6 +377,15 @@ export default defineAction({
             .update(schema.documents)
             .set(updates)
             .where(eq(schema.documents.id, id));
+          if (favoriteChanged) {
+            await setFavoriteMembership({
+              db,
+              userEmail: currentUserEmail,
+              documentId: id,
+              favorite: file.isFavorite === true,
+              now,
+            });
+          }
         }
 
         updated.push({ id, path: file.path, title: file.title });
@@ -389,6 +412,15 @@ export default defineAction({
             createdAt: now,
             updatedAt: now,
           });
+          if (file.isFavorite) {
+            await setFavoriteMembership({
+              db,
+              userEmail: currentUserEmail,
+              documentId: id,
+              favorite: true,
+              now,
+            });
+          }
         } catch (err) {
           errors.push({
             path: file.path,

package/corpus/templates/content/actions/list-content-spaces.ts

@@ -1,6 +1,6 @@
 import { defineAction } from "@agent-native/core";
 import { getRequestUserEmail } from "@agent-native/core/server/request-context";
-import { and, eq, isNull } from "drizzle-orm";
+import { and, eq, inArray, isNull } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
@@ -26,6 +26,7 @@ export default defineAction({
     const db = getDb();
     const personalSpaceId = personalContentSpaceId(email);
     const catalogIds = systemIdsForContentSpace(personalSpaceId, "workspaces");
+    const favoritesIds = systemIdsForContentSpace(personalSpaceId, "favorites");
     const memberships = await listContentOrganizationMemberships(email);
     const roleByOrgId = new Map(
       memberships.map((membership) => [
@@ -65,11 +66,26 @@ export default defineAction({
           isNull(schema.contentSpaces.archivedAt),
         ),
       );
+    const filesDatabaseIds = rows.map((row) => row.space.filesDatabaseId);
+    const databaseIds = [...filesDatabaseIds, favoritesIds.databaseId];
+    const filesDatabases = databaseIds.length
+      ? await db
+          .select({
+            id: schema.contentDatabases.id,
+            documentId: schema.contentDatabases.documentId,
+          })
+          .from(schema.contentDatabases)
+          .where(inArray(schema.contentDatabases.id, databaseIds))
+      : [];
+    const filesDocumentIdByDatabaseId = new Map(
+      filesDatabases.map((database) => [database.id, database.documentId]),
+    );
     const spaces = [] as Array<{
       id: string;
       name: string;
       kind: string;
       filesDatabaseId: string;
+      filesDocumentId: string;
       orgId: string | null;
       role: string;
       catalogItemId: string;
@@ -87,17 +103,33 @@ export default defineAction({
           ? "owner"
           : undefined;
       if (!role) continue;
+      const filesDocumentId = filesDocumentIdByDatabaseId.get(
+        row.space.filesDatabaseId,
+      );
+      if (!filesDocumentId) continue;
       spaces.push({
         id: row.space.id,
         name: row.space.name,
         kind: row.space.kind,
         filesDatabaseId: row.space.filesDatabaseId,
+        filesDocumentId,
         orgId: row.space.orgId,
         role,
         catalogItemId: row.mapping.databaseItemId,
         catalogDocumentId: row.mapping.documentId,
       });
     }
-    return { catalogDatabaseId: catalogIds.databaseId, spaces };
+    return {
+      catalogDatabaseId: catalogIds.databaseId,
+      catalogDocumentId: catalogIds.documentId,
+      favoritesDatabaseId: filesDocumentIdByDatabaseId.has(
+        favoritesIds.databaseId,
+      )
+        ? favoritesIds.databaseId
+        : null,
+      favoritesDocumentId:
+        filesDocumentIdByDatabaseId.get(favoritesIds.databaseId) ?? null,
+      spaces,
+    };
   },
 });

package/corpus/templates/content/actions/list-documents.ts

@@ -14,9 +14,10 @@ import { z } from "zod";
 import { getDb, schema } from "../server/db/index.js";
 import {
   documentDiscoveryFilter,
-  parseDocumentFavorite,
   parseDocumentHideFromSearch,
 } from "../server/lib/documents.js";
+import { favoriteDocumentIds } from "./_content-favorites.js";
+import { listContentOrganizationMemberships } from "./_content-space-access.js";
 import { serializeDatabaseMembership } from "./_database-utils.js";
 import { serializeDocumentSource } from "./_document-source.js";
 import { parseDatabaseViewConfig } from "./_property-utils.js";
@@ -50,7 +51,23 @@ export default defineAction({
   run: async () => {
     const db = getDb();
     const userEmail = getRequestUserEmail();
-    const orgId = getRequestOrgId();
+    const activeOrgId = getRequestOrgId();
+    const memberships = userEmail
+      ? await listContentOrganizationMemberships(userEmail)
+      : [];
+    const authorizedOrgIds = [
+      ...new Set([
+        ...memberships.map((membership) => membership.orgId),
+        ...(!userEmail && activeOrgId ? [activeOrgId] : []),
+      ]),
+    ];
+    const accessContexts = [
+      { userEmail: userEmail ?? undefined },
+      ...authorizedOrgIds.map((orgId) => ({
+        userEmail: userEmail ?? undefined,
+        orgId,
+      })),
+    ];
     // Projection that deliberately avoids pulling the full `content` blob:
     // document bodies can be multi-MB, and the list/tree path only needs a
     // short preview plus the true length. `substr` truncates the transferred
@@ -84,8 +101,15 @@ export default defineAction({
       .from(schema.documents)
       .where(
         and(
-          accessFilter(schema.documents, schema.documentShares),
-          documentDiscoveryFilter(),
+          or(
+            ...accessContexts.map((context) =>
+              accessFilter(schema.documents, schema.documentShares, context),
+            ),
+          ),
+          documentDiscoveryFilter({
+            userEmail,
+            orgIds: authorizedOrgIds,
+          }),
         ),
       )
       .orderBy(asc(schema.documents.position));
@@ -104,6 +128,13 @@ export default defineAction({
       }
     >();
     const softDeletedDocumentIds = new Set<string>();
+    const favoriteIds = userEmail
+      ? await favoriteDocumentIds(
+          db,
+          userEmail,
+          documents.map((document) => document.id),
+        )
+      : new Set<string>();
 
     if (documents.length > 0) {
       const visibleDocumentIds = documents.map((d) => d.id);
@@ -117,7 +148,7 @@ export default defineAction({
           )!,
         );
       }
-      if (orgId) {
+      for (const orgId of authorizedOrgIds) {
         principalClauses.push(
           and(
             eq(schema.documentShares.principalType, "org"),
@@ -170,6 +201,7 @@ export default defineAction({
           )
           .orderBy(
             sql`CASE WHEN ${schema.contentDatabases.systemRole} IS NULL THEN 0 ELSE 1 END`,
+            sql`CASE WHEN ${schema.contentDatabases.systemRole} = 'files' THEN 0 ELSE 1 END`,
             asc(schema.contentDatabases.id),
           ),
         db
@@ -277,7 +309,7 @@ export default defineAction({
         if (
           userEmail &&
           d.ownerEmail === userEmail &&
-          (orgId ? d.orgId === orgId : !d.orgId)
+          (!d.orgId || authorizedOrgIds.includes(d.orgId))
         ) {
           accessRole = "owner";
         }
@@ -291,7 +323,7 @@ export default defineAction({
           contentLength: Number(d.contentLength) || 0,
           icon: d.icon,
           position: d.position,
-          isFavorite: parseDocumentFavorite(d.isFavorite),
+          isFavorite: favoriteIds.has(d.id),
           hideFromSearch: parseDocumentHideFromSearch(d.hideFromSearch),
           notionPageId: notionPageIdByDocumentId.get(d.id) ?? null,
           notionPageUrl: notionPageIdByDocumentId.has(d.id)

package/corpus/templates/content/actions/reorder-document-property.ts

@@ -42,6 +42,15 @@ export default defineAction({
     if (!ids.includes(targetPropertyId)) {
       throw new Error(`Property "${targetPropertyId}" not found`);
     }
+    const definitionById = new Map(
+      definitions.map((definition) => [definition.id, definition]),
+    );
+    if (
+      definitionById.get(propertyId)?.systemRole ||
+      definitionById.get(targetPropertyId)?.systemRole
+    ) {
+      throw new Error("System properties cannot be reordered.");
+    }
     if (propertyId === targetPropertyId) {
       return {
         documentId,