@agent-native/core 0.152.1 → 0.153.1

package/corpus/templates/content/actions/attach-content-database-source.ts

@@ -52,6 +52,41 @@ const sourceTypeSchema = z
 const BUILDER_CMS_ATTACH_INITIAL_PAGES = 1;
 const BUILDER_CMS_ATTACH_METADATA_LIMIT = 10_000;
 
+export function shouldBootstrapLocalDetailsSource(args: {
+  relationshipMode: "items" | "details" | undefined;
+  hasExistingSource: boolean;
+}) {
+  return args.relationshipMode === "details" && !args.hasExistingSource;
+}
+
+export function assertDetailsSourceJoin(args: {
+  relationshipMode: "items" | "details" | undefined;
+  hasJoin: boolean;
+}) {
+  if (args.relationshipMode === "details" && !args.hasJoin) {
+    throw new Error("Choose a match key before adding source details.");
+  }
+}
+
+export async function readBeforeLocalDetailsBootstrap<
+  T extends {
+    readState: BuilderCmsReadResult["state"];
+    readMessage: string | null;
+  },
+>(args: {
+  readCandidate: () => Promise<T>;
+  bootstrapLocalSource: () => Promise<void>;
+}) {
+  const candidate = await args.readCandidate();
+  if (candidate.readState !== "live") {
+    throw new Error(
+      candidate.readMessage ?? "Source read failed before connection.",
+    );
+  }
+  await args.bootstrapLocalSource();
+  return candidate;
+}
+
 export async function readInitialBuilderCmsAttachEntries(
   sourceTable: string,
   readEntries: typeof readBuilderCmsContentEntries = readBuilderCmsContentEntries,
@@ -244,6 +279,65 @@ function identityFederation(
   };
 }
 
+async function readDetailsSourceCandidate(args: {
+  sourceType: ContentDatabaseSourceType;
+  sourceTable: string;
+  limit: number;
+  offset: number;
+  now: string;
+}) {
+  const adapter = getContentDatabaseSourceAdapter(args.sourceType);
+  if (adapter) {
+    const read = await adapter.read({
+      sourceTable: args.sourceTable,
+      limit: args.limit,
+      offset: args.offset,
+    });
+    return {
+      readState: read.state,
+      readMessage: read.message,
+      entries: read.state === "live" ? read.entries : [],
+      modelFields: read.fields,
+      builderRead:
+        args.sourceType === "builder-cms"
+          ? ({
+              state: read.state,
+              entries: read.entries,
+              fetchedAt: read.fetchedAt,
+              message: read.message,
+              progress: read.progress!,
+            } satisfies BuilderCmsReadResult)
+          : null,
+      adapterMetadata: read.metadata,
+      adapterFetchedAt: read.fetchedAt,
+      adapterMessage: read.message,
+    };
+  }
+  if (args.sourceType === "builder-cms") {
+    const initial = await readInitialBuilderCmsAttachSource(args.sourceTable);
+    return {
+      readState: initial.read.state,
+      readMessage: initial.read.message,
+      entries: initial.read.state === "live" ? initial.read.entries : [],
+      modelFields: initial.modelFields,
+      builderRead: initial.read,
+      adapterMetadata: undefined,
+      adapterFetchedAt: args.now,
+      adapterMessage: null,
+    };
+  }
+  return {
+    readState: "live" as const,
+    readMessage: null,
+    entries: [] as BuilderCmsSourceEntry[],
+    modelFields: [] as BuilderCmsModelFieldSummary[],
+    builderRead: null,
+    adapterMetadata: undefined,
+    adapterFetchedAt: args.now,
+    adapterMessage: null,
+  };
+}
+
 export default defineAction({
   description:
     "Attach or replace a safe local source binding for a content database. Builder CMS bindings store source metadata, field mappings, row identity, provenance, freshness, capabilities, and local-only diff state without calling external APIs.",
@@ -317,37 +411,60 @@ export default defineAction({
     const relationshipMode =
       args.relationshipMode ?? (args.mode === "add" ? "items" : undefined);
 
+    // Validate before bootstrapping the local primary so an invalid details
+    // attach cannot leave a source record behind.
+    assertDetailsSourceJoin({
+      relationshipMode,
+      hasJoin: Boolean(args.join),
+    });
+
     // A normal local Content database has rows but no explicit source record.
-    // Bootstrap that local snapshot before attaching a read-only details source
-    // so Notion federation works without forcing users to attach Builder first.
+    // A details join needs that local snapshot to remain the primary side;
+    // otherwise the candidate source would fall through to replacement semantics.
+    let initialDetailsSource:
+      | Awaited<ReturnType<typeof readDetailsSourceCandidate>>
+      | undefined;
     if (
-      sourceType === "notion-database" &&
-      relationshipMode === "details" &&
-      !existingSource
+      shouldBootstrapLocalDetailsSource({
+        relationshipMode,
+        hasExistingSource: Boolean(existingSource),
+      })
     ) {
-      const setup = await sourceSetupPayload(database.id);
-      const localSourceId = await replaceSourceMetadata({
-        database,
-        source: null,
-        sourceType: "mock-local",
-        sourceName: "Local Content database",
-        sourceTable: database.id,
-        now,
-      });
-      await seedMockSourceFields({
-        sourceId: localSourceId,
-        ownerEmail: database.ownerEmail,
-        sourceType: "mock-local",
-        properties: setup.properties,
-        now,
-      });
-      await seedMockSourceRows({
-        sourceId: localSourceId,
-        ownerEmail: database.ownerEmail,
-        sourceType: "mock-local",
-        sourceTable: database.id,
-        items: setup.response.items,
-        now,
+      initialDetailsSource = await readBeforeLocalDetailsBootstrap({
+        readCandidate: () =>
+          readDetailsSourceCandidate({
+            sourceType,
+            sourceTable,
+            limit: args.limit,
+            offset: args.offset,
+            now,
+          }),
+        bootstrapLocalSource: async () => {
+          const setup = await sourceSetupPayload(database.id);
+          const localSourceId = await replaceSourceMetadata({
+            database,
+            source: null,
+            sourceType: "mock-local",
+            sourceName: "Local Content database",
+            sourceTable: database.id,
+            now,
+          });
+          await seedMockSourceFields({
+            sourceId: localSourceId,
+            ownerEmail: database.ownerEmail,
+            sourceType: "mock-local",
+            properties: setup.properties,
+            now,
+          });
+          await seedMockSourceRows({
+            sourceId: localSourceId,
+            ownerEmail: database.ownerEmail,
+            sourceType: "mock-local",
+            sourceTable: database.id,
+            items: setup.response.items,
+            now,
+          });
+        },
       });
       existingSource = await getExistingSource(database.id);
     }
@@ -359,42 +476,22 @@ export default defineAction({
       if (!args.join) {
         throw new Error("Choose a match key before adding source details.");
       }
-      let entries: BuilderCmsSourceEntry[];
-      let modelFields: BuilderCmsModelFieldSummary[];
-      let builderRead: BuilderCmsReadResult | null = null;
-      let adapterMetadata: Record<string, unknown> | undefined;
-      let adapterFetchedAt = now;
-      let adapterMessage: string | null = null;
-      const adapter = getContentDatabaseSourceAdapter(sourceType);
-      if (adapter) {
-        const read = await adapter.read({
+      const {
+        entries,
+        modelFields,
+        builderRead,
+        adapterMetadata,
+        adapterFetchedAt,
+        adapterMessage,
+      } =
+        initialDetailsSource ??
+        (await readDetailsSourceCandidate({
+          sourceType,
           sourceTable,
           limit: args.limit,
           offset: args.offset,
-        });
-        entries = read.state === "live" ? read.entries : [];
-        modelFields = read.fields;
-        adapterMetadata = read.metadata;
-        adapterFetchedAt = read.fetchedAt;
-        adapterMessage = read.message;
-        if (sourceType === "builder-cms") {
-          builderRead = {
-            state: read.state,
-            entries: read.entries,
-            fetchedAt: read.fetchedAt,
-            message: read.message,
-            progress: read.progress!,
-          };
-        }
-      } else if (sourceType === "builder-cms") {
-        const initial = await readInitialBuilderCmsAttachSource(sourceTable);
-        modelFields = initial.modelFields;
-        builderRead = initial.read;
-        entries = builderRead.state === "live" ? builderRead.entries : [];
-      } else {
-        entries = [];
-        modelFields = [];
-      }
+          now,
+        }));
 
       const secondaryId = await insertSecondarySource({
         database,

package/corpus/templates/content/actions/create-document.ts

@@ -323,6 +323,7 @@ export default defineAction({
       hideFromSearch: parseDocumentHideFromSearch(doc.hideFromSearch),
       visibility: doc.visibility,
       accessRole: inheritedRole,
+      canComment: true,
       canEdit: true,
       canManage: inheritedRole === "owner" || inheritedRole === "admin",
       createdAt: doc.createdAt,

package/corpus/templates/content/actions/delete-comment.ts

@@ -34,7 +34,7 @@ export default defineAction({
 
     const userEmail = getRequestUserEmail();
     if (comment.authorEmail === userEmail) {
-      await assertAccess("document", comment.documentId, "viewer");
+      await assertAccess("document", comment.documentId, "commenter");
     } else {
       await assertAccess("document", comment.documentId, "editor");
     }

package/corpus/templates/content/actions/get-document.ts

@@ -1,7 +1,7 @@
 import { defineAction } from "@agent-native/core";
 import { buildDeepLink } from "@agent-native/core/server";
 import { getRequestUserEmail } from "@agent-native/core/server/request-context";
-import { resolveAccess } from "@agent-native/core/sharing";
+import { resolveAccess, roleSatisfies } from "@agent-native/core/sharing";
 import { eq } from "drizzle-orm";
 import { z } from "zod";
 
@@ -29,6 +29,13 @@ function canEditRole(role: string) {
   return role === "owner" || role === "admin" || role === "editor";
 }
 
+function canCommentRole(role: string) {
+  return roleSatisfies(
+    role as Parameters<typeof roleSatisfies>[0],
+    "commenter",
+  );
+}
+
 function canManageRole(role: string) {
   return role === "owner" || role === "admin";
 }
@@ -161,6 +168,7 @@ export default defineAction({
       visibility: doc.visibility,
       source: serializeDocumentSource(doc),
       accessRole: access.role,
+      canComment: canCommentRole(access.role),
       canEdit: canEditRole(access.role),
       canManage: canManageRole(access.role),
       database: database

package/corpus/templates/content/actions/import-content-source.ts

@@ -29,6 +29,7 @@ import {
 
 const MAX_SOURCE_FILES = 500;
 const MAX_SOURCE_FILE_BYTES = 2 * 1024 * 1024;
+const MAX_DOCUMENT_BODY_BYTES = 512 * 1024;
 const SNAPSHOT_INTERVAL_MS = 5 * 60 * 1000;
 
 function nanoid(size = 12): string {
@@ -284,6 +285,13 @@ export default defineAction({
         });
         continue;
       }
+      if (Buffer.byteLength(file.content, "utf8") > MAX_DOCUMENT_BODY_BYTES) {
+        errors.push({
+          path: file.path,
+          reason: `Document body exceeds the ${MAX_DOCUMENT_BODY_BYTES}-byte import limit.`,
+        });
+        continue;
+      }
 
       const sourceMatchedDocument = file.id
         ? null

package/corpus/templates/content/actions/list-documents.ts

@@ -3,7 +3,11 @@ import {
   getRequestOrgId,
   getRequestUserEmail,
 } from "@agent-native/core/server/request-context";
-import { ROLE_RANK, type ShareRole } from "@agent-native/core/sharing";
+import {
+  ROLE_RANK,
+  roleSatisfies,
+  type ShareRole,
+} from "@agent-native/core/sharing";
 import { and, asc, eq, inArray, isNull, or, sql } from "drizzle-orm";
 import { z } from "zod";
 
@@ -33,6 +37,10 @@ function canEditRole(role: EffectiveRole) {
   return role === "owner" || role === "admin" || role === "editor";
 }
 
+function canCommentRole(role: EffectiveRole) {
+  return roleSatisfies(role, "commenter");
+}
+
 function canManageRole(role: EffectiveRole) {
   return role === "owner" || role === "admin";
 }
@@ -331,6 +339,7 @@ export default defineAction({
           ? serializeDatabaseMembership(databaseMembership)
           : undefined,
         accessRole,
+        canComment: canCommentRole(accessRole),
         canEdit: canEditRole(accessRole),
         canManage: canManageRole(accessRole),
         createdAt: d.createdAt,

package/corpus/templates/content/actions/update-comment.ts

@@ -43,7 +43,7 @@ export default defineAction({
     ) {
       await assertAccess("document", comment.documentId, "editor");
     } else {
-      await assertAccess("document", comment.documentId, "viewer");
+      await assertAccess("document", comment.documentId, "commenter");
     }
 
     const updatedAt = new Date().toISOString();

package/corpus/templates/content/actions/update-document.ts

@@ -175,6 +175,15 @@ function canEditRole(role: string) {
   return role === "owner" || role === "admin" || role === "editor";
 }
 
+function canCommentRole(role: string) {
+  return (
+    role === "owner" ||
+    role === "admin" ||
+    role === "editor" ||
+    role === "commenter"
+  );
+}
+
 function builderBodyWithoutImageSourceComponentMarkers(
   content: string | null | undefined,
 ) {
@@ -645,6 +654,7 @@ export default defineAction({
               ),
               visibility: current.visibility,
               accessRole: access.role,
+              canComment: canCommentRole(access.role),
               canEdit: canEditRole(access.role),
               canManage: canManageRole(access.role),
               createdAt: current.createdAt,
@@ -730,6 +740,7 @@ export default defineAction({
         hideFromSearch: parseDocumentHideFromSearch(doc.hideFromSearch),
         visibility: doc.visibility,
         accessRole: access.role,
+        canComment: canCommentRole(access.role),
         canEdit: canEditRole(access.role),
         canManage: canManageRole(access.role),
         createdAt: doc.createdAt,

package/corpus/templates/content/app/components/editor/CommentsSidebar.tsx

@@ -312,6 +312,8 @@ interface CommentsSidebarProps {
   onSelectedThreadChange?: (id: string | null) => void;
   onHoveredThreadChange?: (id: string | null) => void;
   currentUserEmail?: string;
+  canComment?: boolean;
+  canResolve?: boolean;
   alignToAnchors?: boolean;
   forceVisible?: boolean;
 }
@@ -329,6 +331,8 @@ export function CommentsSidebar({
   onSelectedThreadChange,
   onHoveredThreadChange,
   currentUserEmail,
+  canComment = true,
+  canResolve = false,
   alignToAnchors = true,
   forceVisible = false,
 }: CommentsSidebarProps) {
@@ -367,6 +371,7 @@ export function CommentsSidebar({
   }, [pendingComment]);
 
   const handlePendingSubmit = () => {
+    if (!canComment) return;
     if (!pendingText.trim() || createComment.isPending) return;
     createComment.mutate(
       {
@@ -401,6 +406,7 @@ export function CommentsSidebar({
   };
 
   const handleReply = (threadId: string) => {
+    if (!canComment) return;
     if (!replyText.trim() || createComment.isPending) return;
     const thread = threads?.find((t) => t.threadId === threadId);
     createComment.mutate(
@@ -583,6 +589,7 @@ export function CommentsSidebar({
   );
 
   const handleResolve = (thread: CommentThread) => {
+    if (!canResolve) return;
     resolveComment.mutate({
       id: thread.comments[0].id,
       documentId,
@@ -597,6 +604,7 @@ export function CommentsSidebar({
   };
 
   const handleReopen = (thread: CommentThread) => {
+    if (!canResolve) return;
     resolveComment.mutate({
       id: thread.comments[0].id,
       documentId,
@@ -706,9 +714,11 @@ export function CommentsSidebar({
                   scrollContainerRef?.current ?? null,
                   threadPositions.get(thread.threadId)?.documentTop,
                 );
-                setReplyingThreadId((current) =>
-                  current === thread.threadId ? null : thread.threadId,
-                );
+                if (canComment) {
+                  setReplyingThreadId((current) =>
+                    current === thread.threadId ? null : thread.threadId,
+                  );
+                }
                 setReplyText("");
                 setReplyMentions([]);
               }}
@@ -725,6 +735,8 @@ export function CommentsSidebar({
               }
               onHeightChange={handleThreadCardHeightChange}
               members={members}
+              canComment={canComment}
+              canResolve={canResolve}
               onSubmitReply={() => handleReply(thread.threadId)}
               onResolve={() => handleResolve(thread)}
               onSendToAI={() => handleSendToAI(thread)}
@@ -753,6 +765,7 @@ export function CommentsSidebar({
                 <ResolvedThreadView
                   key={thread.threadId}
                   thread={thread}
+                  canResolve={canResolve}
                   onReopen={() => handleReopen(thread)}
                   t={t}
                 />
@@ -814,6 +827,8 @@ function ThreadView({
   onHeightChange,
   onSubmitReply,
   onResolve,
+  canComment,
+  canResolve,
   onSendToAI,
   t,
 }: {
@@ -832,6 +847,8 @@ function ThreadView({
   onHeightChange: (threadId: string, height: number) => void;
   onSubmitReply: () => void;
   onResolve: () => void;
+  canComment: boolean;
+  canResolve: boolean;
   onSendToAI: () => void;
   t: ReturnType<typeof useT>;
 }) {
@@ -890,20 +907,22 @@ function ThreadView({
             </TooltipTrigger>
             <TooltipContent>{t("comments.askAi")}</TooltipContent>
           </Tooltip>
-          <Tooltip>
-            <TooltipTrigger asChild>
-              <button
-                onClick={(e) => {
-                  e.stopPropagation();
-                  onResolve();
-                }}
-                className="p-1.5 text-muted-foreground hover:text-foreground hover:bg-accent"
-              >
-                <IconCheck size={14} />
-              </button>
-            </TooltipTrigger>
-            <TooltipContent>{t("comments.resolve")}</TooltipContent>
-          </Tooltip>
+          {canResolve ? (
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <button
+                  onClick={(e) => {
+                    e.stopPropagation();
+                    onResolve();
+                  }}
+                  className="p-1.5 text-muted-foreground hover:text-foreground hover:bg-accent"
+                >
+                  <IconCheck size={14} />
+                </button>
+              </TooltipTrigger>
+              <TooltipContent>{t("comments.resolve")}</TooltipContent>
+            </Tooltip>
+          ) : null}
         </div>
 
         {/* Comments */}
@@ -931,7 +950,7 @@ function ThreadView({
       </div>
 
       {/* Expanded: Notion-style reply input */}
-      {isExpanded && (
+      {isExpanded && canComment && (
         <div
           className="flex items-center gap-2 px-3 pb-3 pt-1"
           onClick={(e) => e.stopPropagation()}
@@ -979,10 +998,12 @@ function ThreadView({
 function ResolvedThreadView({
   thread,
   onReopen,
+  canResolve,
   t,
 }: {
   thread: CommentThread;
   onReopen: () => void;
+  canResolve: boolean;
   t: ReturnType<typeof useT>;
 }) {
   const first = thread.comments[0];
@@ -1003,17 +1024,19 @@ function ResolvedThreadView({
         <span className="flex-1 truncate text-[13px] text-muted-foreground">
           {renderCommentBody(first.content, first.mentions)}
         </span>
-        <Tooltip>
-          <TooltipTrigger asChild>
-            <button
-              onClick={onReopen}
-              className="p-1 text-muted-foreground opacity-0 transition-opacity hover:text-foreground group-hover/resolved:opacity-100"
-            >
-              <IconArrowBackUp size={14} />
-            </button>
-          </TooltipTrigger>
-          <TooltipContent>{t("comments.reopen")}</TooltipContent>
-        </Tooltip>
+        {canResolve ? (
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <button
+                onClick={onReopen}
+                className="p-1 text-muted-foreground opacity-0 transition-opacity hover:text-foreground group-hover/resolved:opacity-100"
+              >
+                <IconArrowBackUp size={14} />
+              </button>
+            </TooltipTrigger>
+            <TooltipContent>{t("comments.reopen")}</TooltipContent>
+          </Tooltip>
+        ) : null}
       </div>
     </div>
   );

package/corpus/templates/content/app/components/editor/DocumentEditor.tsx

@@ -578,6 +578,13 @@ function DocumentEditorBody({
   // Shared with DocumentToolbar via the same localStorage key — both read it.
   const [autoSync] = useLocalStorage(`notion-auto-sync:${documentId}`, false);
   const isLocalFileDocument = document.source?.mode === "local-files";
+  const canComment =
+    !isLocalFileDocument &&
+    (document.canComment ??
+      (document.accessRole === "owner" ||
+        document.accessRole === "admin" ||
+        document.accessRole === "editor" ||
+        document.accessRole === "commenter"));
   const canDelete =
     !isLocalFileDocument &&
     !document.database?.systemRole &&
@@ -1466,7 +1473,7 @@ function DocumentEditorBody({
   const [utilityPanel, setUtilityPanel] = useState<DocumentUtilityPanel>(null);
   const activeThreadId = hoveredThreadId ?? selectedThreadId;
   const { data: threads, isLoading: commentsLoading } = useComments(
-    canEdit && !isLocalFileDocument ? documentId : null,
+    !isLocalFileDocument ? documentId : null,
   );
   const hasUtilityRailSpace = useMinViewportWidth(1024);
   const showDesktopUtilityPanel = utilityPanel !== null && hasUtilityRailSpace;
@@ -1655,6 +1662,8 @@ function DocumentEditorBody({
       onSelectedThreadChange={setSelectedThreadId}
       onHoveredThreadChange={setHoveredThreadId}
       currentUserEmail={session?.email}
+      canComment={canComment}
+      canResolve={canEdit}
       alignToAnchors={hasUtilityRailSpace}
       forceVisible
     />
@@ -1770,7 +1779,7 @@ function DocumentEditorBody({
             onDelete={handleDeleteDocument}
             utilityPanel={utilityPanel}
             onUtilityPanelChange={handleUtilityPanelChange}
-            showCommentsControl={editorCanEdit && !isLocalFileDocument}
+            showCommentsControl={canComment && !isLocalFileDocument}
             onOpenBreadcrumbItem={handleOpenToolbarBreadcrumb}
           />
 
@@ -1994,16 +2003,12 @@ function DocumentEditorBody({
                           localFilePath={
                             isLocalFileDocument ? document.source?.path : null
                           }
-                          onComment={
-                            editorCanEdit && !isLocalFileDocument
-                              ? handleComment
-                              : undefined
-                          }
+                          onComment={canComment ? handleComment : undefined}
                           commentThreads={threads ?? []}
                           activeThreadId={activeThreadId}
                           pendingHighlight={pendingComment?.range ?? null}
                           onActivateThread={
-                            editorCanEdit && !isLocalFileDocument
+                            !isLocalFileDocument
                               ? activateCommentThread
                               : undefined
                           }