@agent-native/core 0.114.0 → 0.114.2

package/corpus/templates/content/.agents/skills/agent-native-toolkit/SKILL.md

@@ -0,0 +1,133 @@
+---
+name: agent-native-toolkit
+description: >-
+  Inventory and ownership rules for shared Agent Native workspace UI. Use
+  before building app chrome, settings, navigation, sharing, collaboration,
+  setup, history, comments, chat rails, agent UX, or repeated workspace behavior.
+scope: dev
+metadata:
+  internal: true
+---
+
+# Agent-Native Toolkit
+
+Use this skill when deciding whether app chrome, settings, collaboration,
+sharing, navigation, organization, setup, history, comments, or agent UX should
+be built app-locally or moved into reusable framework/toolkit pieces.
+
+## Core Rule
+
+Apps own domain models, domain actions, and product-specific workflows. The
+framework and `@agent-native/toolkit` own repeated workspace behavior users
+expect to work the same everywhere.
+
+Move behavior into shared toolkit primitives when it is:
+
+- workspace-wide, such as settings, nav, search, org membership, or setup
+- agent-visible, such as context, actions, run progress, or proof-of-done
+- governed, such as secrets, permissions, sharing, audit, or billing
+- repeated by two or more apps
+- not tied to one domain model
+
+Keep behavior app-local when the abstraction would hide important domain
+language or make a simple app-specific workflow harder to understand.
+
+## Discover Before Building
+
+Before creating an app-local version of repeated workspace or agent UI:
+
+1. Check the reusable kits below and the installed package documentation.
+2. Search installed public components and source with `docs-search` and
+   `source-search`.
+3. Run `agent-native eject --list` to see the version-matched units published
+   by the packages installed in this app.
+4. Read `customizing-agent-native` and configure, compose, or eject the
+   smallest unit instead of recreating shared behavior from memory.
+
+Use public package exports at runtime. Published source and ejection manifests
+are discovery and ownership-transfer mechanisms, not private runtime APIs.
+
+## Settings Direction
+
+Durable settings belong in the Settings app or a registered settings route. The
+agent sidebar should not become a second settings app. It can show contextual
+quick controls and deep links such as:
+
+- `/settings/ai`
+- `/settings/connections`
+- `/settings/secrets`
+- `/settings/usage`
+- `/settings/apps/:appId`
+
+When adding a new API key, OAuth grant, provider connection, model selector, app
+preference, notification preference, or usage/billing surface, register it as a
+settings tab or app settings panel first. Only add sidebar UI when it is needed
+in the moment of agent use.
+
+## Reusable Kits
+
+- **Settings kit**: a searchable settings page with account, workspace, AI
+  models, LLM keys, connections, secrets, usage, notifications, changelog, and
+  app-specific panels. Search is on by default; register a `SettingsSearchEntry`
+  per control so users find settings by name across tabs.
+- **Collaboration kit**: Yjs docs, presence, agent presence, live cursors,
+  remote selections, recent edit highlights, real-time sync indicators, and
+  undo/redo grouping.
+- **Sharing kit**: private/workspace/org/public-link access, invites, roles,
+  expirations, agent-readable links, and resource registration.
+- **Navigation and command kit**: app shell, side nav, breadcrumbs, app switcher,
+  command palette entries, recent resources, pinned resources, and global search.
+- **Organization kit**: folders, tags, favorites, archive, trash, ownership,
+  membership, and common resource metadata.
+- **Setup and connections kit**: declarative setup requirements, model readiness,
+  missing-secret states, OAuth grants, and provider connection health.
+- **Agent UX kit**: sidebar, composer, staged context, mentions, voice, human
+  approval, generative UI, progress, and screen-state exposure.
+- **Chat history kit**: presentational chat lists and recent-chat rails belong
+  in Toolkit; Core keeps thread persistence, agent execution, transport, and
+  page-to-sidebar handoff. Apps inject routing, labels, and domain actions.
+- **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
+  `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
+  Access tabs plus a Personal/Organization scope toggle. The canonical home
+  for context transparency, MCP servers, A2A remote agents, recurring
+  jobs/automations, and external-client connect flows. See the `agent-page`
+  skill.
+- **History and recovery kit**: audit log, activity feed, version history,
+  checkpoints, undo, redo, restore, and proof-of-done.
+- **Comments and review kit**: anchored comments, pins, mentions, review
+  requests, resolved threads, agent follow-up tasks, and notifications.
+- **Workflow and observability kit**: notifications, approvals, scheduled work,
+  background runs, recurring jobs, traces, evals, feedback, and run timelines.
+
+## Implementation Checklist
+
+When adding or refactoring one of these areas:
+
+1. Search existing framework and template code for duplicated UI or actions.
+2. Decide the shared contract: data shape, action API, React component/hook, and
+   app adapter points.
+3. Keep shared data provider-agnostic and scoped by auth/sharing rules.
+4. Expose the same capability to the UI and agent through actions or documented
+   client helpers.
+5. Register app-specific labels, routes, resource adapters, and settings panels
+   instead of hardcoding app names in core UI.
+6. Update docs and relevant skills so future apps discover the shared path.
+7. Keep the component easy to adopt piecemeal: expose props/slots first and
+   ship readable source plus a complete ejection unit so apps can take ownership
+   of the smallest feature when needed. See `customizing-agent-native` for the
+   configure → compose → eject → propose seam ladder.
+
+## Related Skills
+
+Read these alongside this skill when the work touches the specific area:
+
+- `sharing`
+- `real-time-collab`
+- `real-time-sync`
+- `client-side-routing`
+- `context-awareness`
+- `onboarding`
+- `secrets`
+- `audit-log`
+- `observability`
+- `frontend-design`

package/corpus/templates/content/AGENTS.md

@@ -7,6 +7,11 @@ application state shared with the UI.
 Detailed document editing, Notion, storage, and UI rules live in
 `.agents/skills/`.
 
+Before building common workspace or agent UI, read `agent-native-toolkit` to
+inventory existing public kits and installed package seams. Use
+`customizing-agent-native` for the configure → compose → eject → propose seam
+ladder.
+
 ## Core Rules
 
 - Store large file/blob payloads in configured file/blob storage, not SQL: no
@@ -134,6 +139,8 @@ cd templates/content && pnpm action <name> [args]
 | `ensure-content-spaces`                     |                                                                                                                                                                                                    | Idempotently provision the signed-in user's personal and current organization Content spaces, system databases, and catalog references                                            |
 | `backfill-content-files`                    |                                                                                                                                                                                                    | Assign legacy pages to Content spaces and reconcile exactly one canonical Files database membership per non-system page                                                           |
 | `list-content-spaces`                       |                                                                                                                                                                                                    | List already-provisioned Content spaces authorized by the signed-in user's current ownership or organization memberships                                                          |
+| `create-content-space`                      | `--name <name> --requestId <opaque-id>`                                                                                                                                                            | Idempotently create a private named Content workspace with its own canonical Files database                                                                                       |
+| `delete-content-space`                      | `--spaceId <id>`                                                                                                                                                                                   | Permanently delete a user-created Content workspace and all of its content; Personal and organization workspaces are protected                                                    |
 | `create-content-database`                   | `[--documentId <id>] [--spaceId <id>] [--parentId <id>] [--title <text>] [--description <text>]`                                                                                                   | Create a described database page in a Content space or convert an existing page into a database                                                                                   |
 | `create-inline-content-database`            | `--hostDocumentId <id> [--title <text>] [--description <text>]`                                                                                                                                    | Create a described database owned by an inline database block in the host document                                                                                                |
 | `get-content-database`                      | `--databaseId <id>` or `--documentId <id>`                                                                                                                                                         | Get a database with its description, property/option schema guidance, item pages, and computed ancestry context                                                                   |

package/corpus/templates/content/actions/_content-database-personal-view.ts

@@ -4,8 +4,12 @@ import { and, eq, isNull } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
+import { CONTENT_DATABASE_PERSONAL_VIEW_OVERRIDES_VERSION } from "../shared/api.js";
+import { resolveContentSpaceAccess } from "./_content-space-access.js";
+import { filesParentPropertyId } from "./_files-system-properties.js";
 
-export const PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION = 1;
+export const PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION =
+  CONTENT_DATABASE_PERSONAL_VIEW_OVERRIDES_VERSION;
 
 export const personalDatabaseViewSettingKey = (databaseId: string) =>
   `content-database-personal-view:${databaseId}`;
@@ -38,8 +42,7 @@ export const filterSchema = z.object({
   parentFilterGroupId: z.string().optional(),
 });
 
-export const personalViewOverridesSchema = z.object({
-  version: z.literal(PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION),
+const personalViewOverridesFields = {
   activeViewId: z.string().optional(),
   views: z.array(
     z.object({
@@ -49,6 +52,16 @@ export const personalViewOverridesSchema = z.object({
       filterMode: z.enum(["and", "or"]).default("and"),
     }),
   ),
+};
+
+export const personalViewOverridesSchema = z.object({
+  version: z.literal(PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION),
+  ...personalViewOverridesFields,
+});
+
+const legacyPersonalViewOverridesSchema = z.object({
+  version: z.literal(1),
+  ...personalViewOverridesFields,
 });
 
 export async function assertContentDatabaseViewerAccess(databaseId: string) {
@@ -64,7 +77,12 @@ export async function assertContentDatabaseViewerAccess(databaseId: string) {
     );
   if (!database) throw new Error(`Database "${databaseId}" not found`);
 
-  await assertAccess("document", database.documentId, "viewer");
+  try {
+    await assertAccess("document", database.documentId, "viewer");
+  } catch (error) {
+    if (database.systemRole !== "files" || !database.spaceId) throw error;
+    await resolveContentSpaceAccess(database.spaceId);
+  }
 }
 
 export async function readPersonalDatabaseViewOverrides(
@@ -76,5 +94,31 @@ export async function readPersonalDatabaseViewOverrides(
     personalDatabaseViewSettingKey(databaseId),
   );
   const parsed = personalViewOverridesSchema.safeParse(stored);
-  return parsed.success ? parsed.data : null;
+  if (parsed.success) return parsed.data;
+
+  const legacy = legacyPersonalViewOverridesSchema.safeParse(stored);
+  if (!legacy.success) return null;
+  const [database] = await getDb()
+    .select({ systemRole: schema.contentDatabases.systemRole })
+    .from(schema.contentDatabases)
+    .where(eq(schema.contentDatabases.id, databaseId));
+  const legacyParentKey = filesParentPropertyId(databaseId);
+  return {
+    ...legacy.data,
+    version: PERSONAL_DATABASE_VIEW_OVERRIDES_VERSION,
+    views: legacy.data.views.map((view) => ({
+      ...view,
+      filters:
+        database?.systemRole === "files"
+          ? view.filters.filter(
+              (filter) =>
+                !(
+                  filter.key === legacyParentKey &&
+                  filter.operator === "is_empty" &&
+                  filter.value === ""
+                ),
+            )
+          : view.filters,
+    })),
+  };
 }

package/corpus/templates/content/actions/_content-document-access.ts

@@ -0,0 +1,21 @@
+import { getRequestUserEmail } from "@agent-native/core/server/request-context";
+import { resolveAccess } from "@agent-native/core/sharing";
+
+import { listContentOrganizationMemberships } from "./_content-space-access.js";
+
+export async function resolveContentDocumentAccess(documentId: string) {
+  const current = await resolveAccess("document", documentId);
+  if (current) return current;
+
+  const userEmail = getRequestUserEmail();
+  if (!userEmail) return null;
+  const memberships = await listContentOrganizationMemberships(userEmail);
+  for (const membership of memberships) {
+    const access = await resolveAccess("document", documentId, {
+      userEmail,
+      orgId: membership.orgId,
+    });
+    if (access) return access;
+  }
+  return null;
+}

package/corpus/templates/content/actions/_content-favorites.ts

@@ -0,0 +1,91 @@
+import { createHash } from "node:crypto";
+
+import { and, eq, inArray, sql } from "drizzle-orm";
+
+import { schema } from "../server/db/index.js";
+import { normalizeContentSpaceEmail } from "./_content-space-access.js";
+import {
+  personalContentSpaceId,
+  systemIdsForContentSpace,
+} from "./_content-spaces.js";
+
+type Db = any;
+
+export function favoritesSystemIds(userEmail: string) {
+  return systemIdsForContentSpace(
+    personalContentSpaceId(normalizeContentSpaceEmail(userEmail)),
+    "favorites",
+  );
+}
+
+export async function favoriteDocumentIds(
+  db: Db,
+  userEmail: string,
+  documentIds: string[],
+) {
+  if (documentIds.length === 0) return new Set<string>();
+  const favoritesDatabaseId = favoritesSystemIds(userEmail).databaseId;
+  const rows = await db
+    .select({ documentId: schema.contentDatabaseItems.documentId })
+    .from(schema.contentDatabaseItems)
+    .where(
+      and(
+        eq(schema.contentDatabaseItems.databaseId, favoritesDatabaseId),
+        inArray(schema.contentDatabaseItems.documentId, documentIds),
+      ),
+    );
+  return new Set(rows.map((row: { documentId: string }) => row.documentId));
+}
+
+export async function setFavoriteMembership(args: {
+  db: Db;
+  userEmail: string;
+  documentId: string;
+  favorite: boolean;
+  now: string;
+}) {
+  const email = normalizeContentSpaceEmail(args.userEmail);
+  const favoritesDatabaseId = favoritesSystemIds(email).databaseId;
+  const [existing] = await args.db
+    .select({ id: schema.contentDatabaseItems.id })
+    .from(schema.contentDatabaseItems)
+    .where(
+      and(
+        eq(schema.contentDatabaseItems.databaseId, favoritesDatabaseId),
+        eq(schema.contentDatabaseItems.documentId, args.documentId),
+      ),
+    );
+
+  if (!args.favorite) {
+    if (existing) {
+      await args.db
+        .delete(schema.contentDatabaseItems)
+        .where(eq(schema.contentDatabaseItems.id, existing.id));
+    }
+    return false;
+  }
+  if (existing) return true;
+
+  const [position] = await args.db
+    .select({ max: sql<number>`COALESCE(MAX(position), -1)` })
+    .from(schema.contentDatabaseItems)
+    .where(eq(schema.contentDatabaseItems.databaseId, favoritesDatabaseId));
+  const id = `content_database_item_${createHash("sha256")
+    .update(`${favoritesDatabaseId}:${args.documentId}`)
+    .digest("hex")
+    .slice(0, 32)}`;
+  await args.db
+    .insert(schema.contentDatabaseItems)
+    .values({
+      id,
+      ownerEmail: email,
+      orgId: null,
+      databaseId: favoritesDatabaseId,
+      documentId: args.documentId,
+      position: Number(position?.max ?? -1) + 1,
+      createdAt: args.now,
+      updatedAt: args.now,
+    })
+    .onConflictDoNothing();
+  return true;
+}

package/corpus/templates/content/actions/_content-files.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 
 import { accessFilter } from "@agent-native/core/sharing";
-import { and, eq, inArray, isNull, or, sql } from "drizzle-orm";
+import { and, eq, inArray, isNotNull, isNull, or, sql } from "drizzle-orm";
 
 import { schema } from "../server/db/index.js";
 import {
@@ -62,9 +62,44 @@ async function reconcileDocuments(args: {
     args.filesDatabases.map((database) => [database.spaceId, database]),
   );
   const filesDatabaseIds = args.filesDatabases.map((database) => database.id);
-  const filesBackingDocumentIds = new Set(
-    args.filesDatabases.map((database) => database.documentId),
-  );
+  const documentIds = args.documents.map((document) => document.id);
+  const [systemDatabaseDocuments, workspaceReferenceDocuments] =
+    documentIds.length > 0
+      ? await Promise.all([
+          args.db
+            .select({ id: schema.contentDatabases.documentId })
+            .from(schema.contentDatabases)
+            .where(
+              and(
+                inArray(schema.contentDatabases.documentId, documentIds),
+                isNotNull(schema.contentDatabases.systemRole),
+              ),
+            ),
+          args.db
+            .select({ id: schema.contentSpaceCatalogItems.documentId })
+            .from(schema.contentSpaceCatalogItems)
+            .innerJoin(
+              schema.contentDatabases,
+              eq(
+                schema.contentDatabases.id,
+                schema.contentSpaceCatalogItems.catalogDatabaseId,
+              ),
+            )
+            .where(
+              and(
+                inArray(
+                  schema.contentSpaceCatalogItems.documentId,
+                  documentIds,
+                ),
+                eq(schema.contentDatabases.systemRole, "workspaces"),
+              ),
+            ),
+        ])
+      : [[], []];
+  const excludedDocumentIds = new Set([
+    ...systemDatabaseDocuments.map((document: any) => document.id),
+    ...workspaceReferenceDocuments.map((document: any) => document.id),
+  ]);
   const existingItems = filesDatabaseIds.length
     ? await args.db
         .select()
@@ -93,7 +128,7 @@ async function reconcileDocuments(args: {
   const inserts: Array<typeof schema.contentDatabaseItems.$inferInsert> = [];
   for (const document of args.documents) {
     const existing = itemsByDocument.get(document.id) ?? [];
-    if (filesBackingDocumentIds.has(document.id)) {
+    if (excludedDocumentIds.has(document.id)) {
       for (const item of existing) deleteIds.add(item.id);
       continue;
     }
@@ -239,24 +274,23 @@ export async function reconcileContentFilesMemberships(
   const email = normalizeContentSpaceEmail(userEmail);
   const memberships = await listContentOrganizationMemberships(email);
   const personalSpaceId = personalContentSpaceId(email);
-  const orgSpaceIds = new Map<string, string>();
+  const orgSpaces = new Map<
+    string,
+    { spaceId: string; canReconcilePrivateDocuments: boolean }
+  >();
   for (const membership of memberships) {
     const spaceId = organizationContentSpaceId(membership.orgId);
-    try {
-      await resolveContentSpaceAccess(spaceId, "editor");
-      orgSpaceIds.set(membership.orgId, spaceId);
-    } catch (error) {
-      if (
-        error instanceof Error &&
-        error.message ===
-          `Editor access is required for Content space "${spaceId}"`
-      ) {
-        continue;
-      }
-      throw error;
-    }
+    await resolveContentSpaceAccess(spaceId);
+    orgSpaces.set(membership.orgId, {
+      spaceId,
+      canReconcilePrivateDocuments:
+        membership.role === "owner" || membership.role === "admin",
+    });
   }
-  const accessibleSpaceIds = [personalSpaceId, ...orgSpaceIds.values()];
+  const accessibleSpaceIds = [
+    personalSpaceId,
+    ...[...orgSpaces.values()].map(({ spaceId }) => spaceId),
+  ];
   const now = new Date().toISOString();
   const result: ContentFilesReconciliation = {
     assignedSpaces: 0,
@@ -288,7 +322,7 @@ export async function reconcileContentFilesMemberships(
         );
       result.assignedSpaces += personalLegacyDocuments.length;
     }
-    for (const [orgId, spaceId] of orgSpaceIds) {
+    for (const [orgId, orgSpace] of orgSpaces) {
       const legacyDocuments = await tx
         .select({ id: schema.documents.id })
         .from(schema.documents)
@@ -296,12 +330,19 @@ export async function reconcileContentFilesMemberships(
           and(
             eq(schema.documents.orgId, orgId),
             isNull(schema.documents.spaceId),
+            orgSpace.canReconcilePrivateDocuments
+              ? undefined
+              : or(
+                  eq(schema.documents.ownerEmail, email),
+                  eq(schema.documents.visibility, "org"),
+                  eq(schema.documents.visibility, "public"),
+                ),
           ),
         );
       if (!legacyDocuments.length) continue;
       await tx
         .update(schema.documents)
-        .set({ spaceId, updatedAt: now })
+        .set({ spaceId: orgSpace.spaceId, updatedAt: now })
         .where(
           inArray(
             schema.documents.id,
@@ -311,10 +352,25 @@ export async function reconcileContentFilesMemberships(
       result.assignedSpaces += legacyDocuments.length;
     }
 
-    const documents = await tx
+    const accessibleDocuments = await tx
       .select()
       .from(schema.documents)
       .where(inArray(schema.documents.spaceId, accessibleSpaceIds));
+    const orgSpaceById = new Map(
+      [...orgSpaces.values()].map((space) => [space.spaceId, space]),
+    );
+    const documents = accessibleDocuments.filter((document: any) => {
+      if (document.spaceId === personalSpaceId) {
+        return normalizeContentSpaceEmail(document.ownerEmail) === email;
+      }
+      const orgSpace = orgSpaceById.get(document.spaceId);
+      return (
+        orgSpace?.canReconcilePrivateDocuments === true ||
+        normalizeContentSpaceEmail(document.ownerEmail) === email ||
+        document.visibility === "org" ||
+        document.visibility === "public"
+      );
+    });
     const filesDatabases = await tx
       .select()
       .from(schema.contentDatabases)

package/corpus/templates/content/actions/_content-sidebar-state.ts

@@ -0,0 +1,24 @@
+import { z } from "zod";
+
+export const CONTENT_SIDEBAR_STATE_VERSION = 1;
+export const CONTENT_SIDEBAR_STATE_SETTING_KEY = "content-sidebar-state";
+
+const expandedIdSchema = z.string().min(1).max(256);
+
+export const contentSidebarStateSchema = z.object({
+  version: z.literal(CONTENT_SIDEBAR_STATE_VERSION),
+  expandedWorkspaceIds: z.array(expandedIdSchema).max(1_000),
+  expandedDocumentIds: z.array(expandedIdSchema).max(5_000),
+});
+
+export type ContentSidebarState = z.infer<typeof contentSidebarStateSchema>;
+
+export function normalizeContentSidebarState(value: unknown) {
+  const parsed = contentSidebarStateSchema.safeParse(value);
+  if (!parsed.success) return null;
+  return {
+    ...parsed.data,
+    expandedWorkspaceIds: [...new Set(parsed.data.expandedWorkspaceIds)],
+    expandedDocumentIds: [...new Set(parsed.data.expandedDocumentIds)],
+  };
+}

package/corpus/templates/content/actions/_content-space-access.ts

@@ -1,25 +1,9 @@
 import { getDbExec } from "@agent-native/core/db";
-import { table, text } from "@agent-native/core/db/schema";
 import { getRequestUserEmail } from "@agent-native/core/server/request-context";
 import { and, eq, sql } from "drizzle-orm";
 
 import { getDb, schema } from "../server/db/index.js";
 
-// Keep these lightweight table references local. Importing the public org
-// barrel also initializes auth's long-lived cleanup timer, which breaks test
-// suites that intentionally drain fake timers.
-const organizations = table("organizations", {
-  id: text("id").primaryKey(),
-  name: text("name").notNull(),
-  createdBy: text("created_by").notNull(),
-});
-
-const orgMembers = table("org_members", {
-  orgId: text("org_id").notNull(),
-  email: text("email").notNull(),
-  role: text("role").notNull(),
-});
-
 export type ContentSpaceRole = "viewer" | "editor" | "owner";
 
 export type ContentSpaceAccess = {
@@ -40,6 +24,10 @@ export async function getContentOrganizationMembership(
   options: { db?: any } = {},
 ): Promise<{ role: string; name: string; createdBy: string } | null> {
   if (options.db) {
+    // The canonical tables carry the active database dialect. Loading them only
+    // for transaction-scoped checks avoids initializing auth timers elsewhere.
+    const { organizations, orgMembers } =
+      await import("@agent-native/core/org");
     const [row] = await options.db
       .select({
         role: orgMembers.role,
@@ -130,7 +118,7 @@ export async function listContentOrganizationMemberships(userEmail: string) {
 
 export async function resolveContentSpaceAccess(
   spaceId: string,
-  requiredRole: "viewer" | "editor" = "viewer",
+  requiredRole: "viewer" | "contributor" | "editor" = "viewer",
   options: { db?: any } = {},
 ): Promise<ContentSpaceAccess> {
   const userEmail = getRequestUserEmail();
@@ -167,6 +155,16 @@ export async function resolveContentSpaceAccess(
       : membership.role === "admin"
         ? "editor"
         : "viewer";
+  if (
+    requiredRole === "contributor" &&
+    membership.role !== "owner" &&
+    membership.role !== "admin" &&
+    membership.role !== "member"
+  ) {
+    throw new Error(
+      `Contributor access is required for Content space "${spaceId}"`,
+    );
+  }
   if (requiredRole === "editor" && role === "viewer") {
     throw new Error(`Editor access is required for Content space "${spaceId}"`);
   }

package/corpus/templates/content/actions/_content-space-catalog-guards.ts

@@ -0,0 +1,20 @@
+import { inArray } from "drizzle-orm";
+
+import { schema } from "../server/db/index.js";
+
+type Db = any;
+
+export async function assertNotWorkspaceCatalogDocuments(
+  db: Db,
+  documentIds: string[],
+  operation: string,
+) {
+  if (documentIds.length === 0) return;
+  const [workspaceReference] = await db
+    .select({ id: schema.contentSpaceCatalogItems.id })
+    .from(schema.contentSpaceCatalogItems)
+    .where(inArray(schema.contentSpaceCatalogItems.documentId, documentIds));
+  if (workspaceReference) {
+    throw new Error(`Workspace references cannot be ${operation} as pages`);
+  }
+}