@agent-native/core 0.85.7 → 0.86.1

package/corpus/core/src/org/context.ts

@@ -60,6 +60,49 @@ export async function getOrgContext(event: H3Event): Promise<OrgContext> {
   return (ctx.__anOrgContextCache ??= resolveOrgContextUncached(event));
 }
 
+type MembershipRow = { orgId: string; role: OrgRole; orgName: string };
+
+const MEMBERSHIPS_CACHE_KEY = "__anOrgMembershipsCache";
+
+/**
+ * Per-request memoization of the org_members lookup, keyed by email on
+ * `event.context`. Both the session org backfill (inside `getSession`) and
+ * `getOrgContext` need the membership rows; without sharing, every request
+ * whose session lacks an orgId pays the query twice.
+ */
+function loadMembershipsForEvent(
+  event: H3Event,
+  exec: ReturnType<typeof getDbExec>,
+  email: string,
+): Promise<MembershipRow[] | null> {
+  const ctx = event.context as Record<string, unknown>;
+  const cache = ((ctx[MEMBERSHIPS_CACHE_KEY] as
+    | Map<string, Promise<MembershipRow[] | null>>
+    | undefined) ??
+    (ctx[MEMBERSHIPS_CACHE_KEY] = new Map<
+      string,
+      Promise<MembershipRow[] | null>
+    >())) as Map<string, Promise<MembershipRow[] | null>>;
+  let promise = cache.get(email);
+  if (!promise) {
+    promise = loadMemberships(exec, email);
+    cache.set(email, promise);
+  }
+  return promise;
+}
+
+function updateMembershipsForEvent(
+  event: H3Event,
+  email: string,
+  memberships: MembershipRow[] | null,
+): void {
+  const ctx = event.context as Record<string, unknown>;
+  const cache = ctx[MEMBERSHIPS_CACHE_KEY] as
+    | Map<string, Promise<MembershipRow[] | null>>
+    | undefined;
+  cache?.set(email, Promise.resolve(memberships));
+}
+
 async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
   const session = await getSession(event);
   const email = session?.email;
@@ -72,7 +115,7 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
 
   const exec = getDbExec();
 
-  let memberships = await loadMemberships(exec, email);
+  let memberships = await loadMembershipsForEvent(event, exec, email);
   if (memberships === null) {
     if (sessionOrgId) {
       return {
@@ -118,7 +161,10 @@ async function resolveOrgContextUncached(event: H3Event): Promise<OrgContext> {
     });
     if (joined.joined.length > 0) {
       const refreshed = await loadMemberships(exec, email);
-      if (refreshed !== null) memberships = refreshed;
+      if (refreshed !== null) {
+        memberships = refreshed;
+        updateMembershipsForEvent(event, email, refreshed);
+      }
     }
 
     if (joined.activeOrgId) {
@@ -230,6 +276,37 @@ export async function resolveOrgIdForEmail(
   }
 }
 
+/**
+ * Event-aware variant of `resolveOrgIdForEmail` for HTTP request paths.
+ * Shares the per-request membership lookup with `getOrgContext`, so the
+ * session org backfill inside `getSession` and a later `getOrgContext` call
+ * in the same request pay ONE org_members round trip, not two.
+ */
+export async function resolveOrgIdForEmailViaEvent(
+  event: H3Event,
+  email: string,
+): Promise<string | null> {
+  try {
+    const exec = getDbExec();
+    if (!exec) return null;
+    const memberships = await loadMembershipsForEvent(event, exec, email);
+    if (!memberships || memberships.length === 0) return null;
+    if (memberships.length === 1) return memberships[0].orgId;
+    const activeOrgSetting = (await getUserSetting(email, "active-org-id")) as {
+      orgId: string;
+    } | null;
+    if (
+      activeOrgSetting?.orgId &&
+      memberships.some((m) => m.orgId === activeOrgSetting.orgId)
+    ) {
+      return activeOrgSetting.orgId;
+    }
+    return memberships[0].orgId;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Create a new organization and add the caller as a member with the given
  * role. Generates a per-org A2A secret for cross-app delegation and writes

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -7750,16 +7750,20 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             // queued messages durable across reloads without piggybacking
             // on full-thread saves.
             if (method === "POST" && isThreadSubroute("queued")) {
-              const thread = await getThread(threadId);
-              if (!thread || thread.ownerEmail !== owner) {
-                setResponseStatus(event, 404);
-                return { error: "Thread not found" };
-              }
               const body = await readBody(event);
               const queued = Array.isArray(body?.queuedMessages)
                 ? body.queuedMessages
                 : [];
-              await setThreadQueuedMessages(threadId, queued);
+              // Ownership is checked inside setThreadQueuedMessages (under
+              // the thread-data lock) — no separate getThread pre-read on
+              // this debounced hot path.
+              const saved = await setThreadQueuedMessages(threadId, queued, {
+                ownerEmail: owner,
+              });
+              if (!saved) {
+                setResponseStatus(event, 404);
+                return { error: "Thread not found" };
+              }
               return { ok: true };
             }
 

package/corpus/core/src/server/auth-marketing.ts

@@ -155,16 +155,6 @@ export const BUILT_IN_AUTH_MARKETING: Record<string, AuthMarketingContent> = {
       "Use the built-in app-agent loop or plug in your own agent backend",
     ],
   },
-  videos: {
-    appName: "Agent-Native Videos",
-    tagline:
-      "Your AI agent builds, animates, and refines programmatic videos alongside you.",
-    features: [
-      "Generate animated components and compositions from a description",
-      "Fine-tune tracks, keyframes, and easing without touching code",
-      "Camera moves, interactive elements, and effects the agent wires for you",
-    ],
-  },
 };
 
 const SLUG_ALIASES: Record<string, string> = {
@@ -174,7 +164,6 @@ const SLUG_ALIASES: Record<string, string> = {
   asset: "assets",
   image: "assets",
   images: "assets",
-  video: "videos",
 };
 
 function cloneMarketing(marketing: AuthMarketingContent): AuthMarketingContent {

package/corpus/core/src/server/auth.ts

@@ -2131,10 +2131,17 @@ function mapBetterAuthSession(baSession: {
  * org is active.
  *
  */
-async function backfillSessionOrg(session: AuthSession): Promise<AuthSession> {
+async function backfillSessionOrg(
+  session: AuthSession,
+  event: H3Event,
+): Promise<AuthSession> {
   if (session.orgId) return session;
-  const { resolveOrgIdForEmail } = await import("../org/context.js");
-  const orgId = await resolveOrgIdForEmail(session.email).catch(() => null);
+  // Event-aware variant: shares the per-request org_members lookup with
+  // getOrgContext so one request never pays the membership query twice.
+  const { resolveOrgIdForEmailViaEvent } = await import("../org/context.js");
+  const orgId = await resolveOrgIdForEmailViaEvent(event, session.email).catch(
+    () => null,
+  );
   return orgId ? { ...session, orgId } : session;
 }
 
@@ -2166,7 +2173,7 @@ export async function getSession(event: H3Event): Promise<AuthSession | null> {
   };
   return (ctx.__anSessionCache ??= (async () => {
     const session = await resolveSessionUncached(event);
-    return session?.email ? backfillSessionOrg(session) : session;
+    return session?.email ? backfillSessionOrg(session, event) : session;
   })());
 }
 

package/corpus/core/src/server/builder-design-systems.ts

@@ -12,6 +12,68 @@ export interface BuilderDesignSystemIndexFile {
   mimeType?: string;
 }
 
+export interface BuilderDesignSystemCodeFileInput {
+  filename: string;
+  content: string;
+  mimeType?: string;
+}
+
+export interface BuildBuilderDesignSystemIndexFilesOptions {
+  codeFiles?: BuilderDesignSystemCodeFileInput[];
+  designMd?: string;
+  designMdFilename?: string;
+  maxCodeFiles?: number;
+  maxTotalCodeBytes?: number;
+}
+
+export interface BuilderDesignSystemProxyFieldsOptions {
+  result: BuilderDesignSystemIndexResult;
+  projectName?: string;
+  description?: string;
+  surface: "design" | "slides";
+}
+
+export interface BuilderDesignSystemProxyFields {
+  title: string;
+  description: string;
+  data: string;
+  customInstructions: string;
+}
+
+export interface BuilderDesignSystemProxyReference {
+  source: "builder";
+  builderDesignSystemId: string;
+  builderJobId: string;
+  builderProjectId?: string;
+  builderUrl?: string;
+  builderStatus?: string;
+}
+
+export interface BuilderDesignSystemDocsOptions {
+  page?: number;
+  pageSize?: number;
+  minimal?: boolean;
+  type?: string;
+}
+
+export interface BuilderDesignSystemDocument {
+  id?: string;
+  name?: string;
+  type?: string;
+  description?: string;
+  content?: string;
+  tokenValues?: Record<string, string>;
+  rawTokens?: string[];
+  relevantFiles?: string[];
+  relatedComponents?: string[];
+}
+
+export interface BuilderDesignSystemHydratedReference extends BuilderDesignSystemProxyReference {
+  docs: BuilderDesignSystemDocument[];
+  tokenValues: Record<string, string>;
+  docCount: number;
+}
+
 export interface BuilderDesignSystemIndexOptions {
   projectName?: string;
   description?: string;
@@ -49,6 +111,10 @@ interface GenerateResponse {
   designSystemId?: string;
 }
 
+const DEFAULT_MAX_CODE_FILES = 50;
+const DEFAULT_MAX_TOTAL_CODE_BYTES = 2 * 1024 * 1024;
+const MAX_DOC_CONTENT_CHARS = 4_000;
+
 function trimTrailingSlash(value: string): string {
   return value.replace(/\/+$/, "");
 }
@@ -89,6 +155,66 @@ function makeBuilderHeaders(
   };
 }
 
+export function mimeTypeForBuilderDesignSystemFilename(
+  filename: string,
+  explicit?: string,
+): string {
+  if (explicit?.trim()) return explicit.trim();
+  const lower = filename.toLowerCase();
+  if (lower.endsWith(".fig")) return "application/octet-stream";
+  if (lower.endsWith(".pdf")) return "application/pdf";
+  if (lower.endsWith(".md") || lower.endsWith(".markdown"))
+    return "text/markdown";
+  if (lower.endsWith(".mdx")) return "text/markdown";
+  if (lower.endsWith(".json")) return "application/json";
+  if (lower.endsWith(".css")) return "text/css";
+  if (lower.endsWith(".html") || lower.endsWith(".htm")) return "text/html";
+  if (lower.endsWith(".svg")) return "image/svg+xml";
+  return "text/plain";
+}
+
+export function buildBuilderDesignSystemIndexFiles({
+  codeFiles,
+  designMd,
+  designMdFilename,
+  maxCodeFiles = DEFAULT_MAX_CODE_FILES,
+  maxTotalCodeBytes = DEFAULT_MAX_TOTAL_CODE_BYTES,
+}: BuildBuilderDesignSystemIndexFilesOptions): BuilderDesignSystemIndexFile[] {
+  const encoder = new TextEncoder();
+  const files: BuilderDesignSystemIndexFile[] = [];
+  let totalBytes = 0;
+
+  function pushTextFile(filename: string, content: string, mimeType?: string) {
+    const normalizedName = filename.replace(/^\/+/, "") || "code.txt";
+    const data = encoder.encode(content);
+    if (data.byteLength === 0) return;
+    if (totalBytes + data.byteLength > maxTotalCodeBytes) return;
+    totalBytes += data.byteLength;
+    files.push({
+      name: normalizedName,
+      data,
+      mimeType: mimeTypeForBuilderDesignSystemFilename(
+        normalizedName,
+        mimeType,
+      ),
+    });
+  }
+
+  if (designMd?.trim()) {
+    pushTextFile(
+      designMdFilename?.trim() || "design.md",
+      designMd,
+      "text/markdown",
+    );
+  }
+
+  for (const file of (codeFiles ?? []).slice(0, maxCodeFiles)) {
+    pushTextFile(file.filename, file.content, file.mimeType);
+  }
+
+  return files;
+}
+
 async function resolveBuilderDesignSystemCredentials(): Promise<BuilderDesignSystemCredentials> {
   const credentials = await resolveBuilderCredentials();
   if (!credentials.privateKey || !credentials.publicKey) {
@@ -107,15 +233,7 @@ async function resolveBuilderDesignSystemCredentials(): Promise<BuilderDesignSys
 }
 
 function mimeTypeForFile(file: BuilderDesignSystemIndexFile): string {
-  if (file.mimeType?.trim()) return file.mimeType.trim();
-  const lower = file.name.toLowerCase();
-  if (lower.endsWith(".fig")) return "application/octet-stream";
-  if (lower.endsWith(".pdf")) return "application/pdf";
-  if (lower.endsWith(".md") || lower.endsWith(".markdown"))
-    return "text/markdown";
-  if (lower.endsWith(".json")) return "application/json";
-  if (lower.endsWith(".css")) return "text/css";
-  return "text/plain";
+  return mimeTypeForBuilderDesignSystemFilename(file.name, file.mimeType);
 }
 
 function makeBody(bytes: Uint8Array, mimeType: string): BodyInit {
@@ -204,6 +322,207 @@ export function builderDesignSystemUrl(designSystemId?: string | null): string {
     : `${host}/app/design-system-intelligence`;
 }
 
+export function localBuilderDesignSystemId(
+  builderDesignSystemId: string,
+): string {
+  const slug = builderDesignSystemId
+    .replace(/[^a-zA-Z0-9_-]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 96);
+  return `builder-${slug || "design-system"}`;
+}
+
+export function createBuilderDesignSystemProxyFields({
+  result,
+  projectName,
+  description,
+  surface,
+}: BuilderDesignSystemProxyFieldsOptions): BuilderDesignSystemProxyFields {
+  const title = projectName?.trim() || "Builder indexed design system";
+  const fallbackDescription =
+    description ?? `Builder indexed design system ${result.designSystemId}`;
+  const surfaceNoun = surface === "slides" ? "slides" : "designs";
+  const spacingKey = surface === "slides" ? "slidePadding" : "pagePadding";
+  const data = JSON.stringify({
+    source: "builder",
+    builderDesignSystemId: result.designSystemId,
+    builderJobId: result.jobId,
+    builderProjectId: result.projectId,
+    builderUrl: result.builderUrl,
+    builderStatus: result.status,
+    colors: {
+      primary: "var(--primary)",
+      secondary: "var(--secondary)",
+      accent: "var(--accent)",
+      background: "var(--background)",
+      surface: "var(--card)",
+      text: "var(--foreground)",
+      textMuted: "var(--muted-foreground)",
+    },
+    typography: {
+      headingFont: "inherit",
+      bodyFont: "inherit",
+      headingWeight: "700",
+      bodyWeight: "400",
+      headingSizes: { h1: "48px", h2: "32px", h3: "24px" },
+    },
+    spacing: { elementGap: "24px", [spacingKey]: "48px" },
+    borders: { radius: "12px", accentWidth: "1px" },
+    logos: [],
+    notes: [
+      "This is a local selectable proxy for a Builder DSI-indexed design system.",
+      `Builder design system id: ${result.designSystemId}`,
+      `Builder indexing job id: ${result.jobId}`,
+      `Builder project id: ${result.projectId}`,
+      `Builder URL: ${result.builderUrl}`,
+      projectName ? `Requested name: ${projectName}` : "",
+      description ? `Context: ${description}` : "",
+      "Builder Design System Intelligence is the source of truth for extracted tokens, components, assets, and usage guidance.",
+    ]
+      .filter(Boolean)
+      .join("\n"),
+  });
+  const customInstructions = [
+    "This design system is indexed by Builder Design System Intelligence (DSI).",
+    `Builder design system id: ${result.designSystemId}`,
+    `Builder job id: ${result.jobId}`,
+    `Builder project id: ${result.projectId}`,
+    `Builder URL: ${result.builderUrl}`,
+    `When generating ${surfaceNoun}, treat Builder DSI as the source of truth for extracted tokens, components, assets, and usage guidance.`,
+    "Call get-design-system for this local id before generation and use the returned builder docs and token values when available.",
+  ].join("\n");
+
+  return {
+    title,
+    description: fallbackDescription,
+    data,
+    customInstructions,
+  };
+}
+
+export function parseBuilderDesignSystemProxyReference(
+  data: unknown,
+): BuilderDesignSystemProxyReference | null {
+  let parsed: unknown = data;
+  if (typeof data === "string") {
+    try {
+      parsed = JSON.parse(data);
+    } catch {
+      return null;
+    }
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const value = parsed as Record<string, unknown>;
+  if (value.source !== "builder") return null;
+  if (typeof value.builderDesignSystemId !== "string") return null;
+  if (typeof value.builderJobId !== "string") return null;
+  return {
+    source: "builder",
+    builderDesignSystemId: value.builderDesignSystemId,
+    builderJobId: value.builderJobId,
+    builderProjectId:
+      typeof value.builderProjectId === "string"
+        ? value.builderProjectId
+        : undefined,
+    builderUrl:
+      typeof value.builderUrl === "string" ? value.builderUrl : undefined,
+    builderStatus:
+      typeof value.builderStatus === "string" ? value.builderStatus : undefined,
+  };
+}
+
+function truncateDocContent(content: unknown): string | undefined {
+  if (typeof content !== "string") return undefined;
+  if (content.length <= MAX_DOC_CONTENT_CHARS) return content;
+  return `${content.slice(0, MAX_DOC_CONTENT_CHARS)}\n\n[truncated]`;
+}
+
+function normalizeBuilderDesignSystemDocument(
+  value: unknown,
+): BuilderDesignSystemDocument {
+  const doc =
+    value && typeof value === "object"
+      ? (value as Record<string, unknown>)
+      : {};
+  return {
+    id: typeof doc.id === "string" ? doc.id : undefined,
+    name: typeof doc.name === "string" ? doc.name : undefined,
+    type: typeof doc.type === "string" ? doc.type : undefined,
+    description:
+      typeof doc.description === "string" ? doc.description : undefined,
+    content: truncateDocContent(doc.content),
+    tokenValues:
+      doc.tokenValues && typeof doc.tokenValues === "object"
+        ? (doc.tokenValues as Record<string, string>)
+        : undefined,
+    rawTokens: Array.isArray(doc.rawTokens)
+      ? doc.rawTokens.filter(
+          (token): token is string => typeof token === "string",
+        )
+      : undefined,
+    relevantFiles: Array.isArray(doc.relevantFiles)
+      ? doc.relevantFiles.filter(
+          (file): file is string => typeof file === "string",
+        )
+      : undefined,
+    relatedComponents: Array.isArray(doc.relatedComponents)
+      ? doc.relatedComponents.filter(
+          (component): component is string => typeof component === "string",
+        )
+      : undefined,
+  };
+}
+
+export async function fetchBuilderDesignSystemDocs(
+  designSystemId: string,
+  options: BuilderDesignSystemDocsOptions = {},
+): Promise<BuilderDesignSystemDocument[]> {
+  const credentials = await resolveBuilderDesignSystemCredentials();
+  const url = makeBuilderDesignSystemUrl(
+    `${encodeURIComponent(designSystemId)}/docs`,
+    credentials,
+  );
+  if (options.page !== undefined)
+    url.searchParams.set("page", String(options.page));
+  if (options.pageSize !== undefined)
+    url.searchParams.set("pageSize", String(options.pageSize));
+  if (options.minimal !== undefined)
+    url.searchParams.set("minimal", options.minimal ? "true" : "false");
+  if (options.type?.trim()) url.searchParams.set("type", options.type.trim());
+
+  const response = await fetchWithTimeout(url, {
+    method: "GET",
+    headers: makeBuilderHeaders(credentials),
+  });
+  await assertOk(response, "Builder design-system docs fetch failed");
+  const json = (await response.json()) as unknown;
+  if (!Array.isArray(json)) return [];
+  return json.map(normalizeBuilderDesignSystemDocument);
+}
+
+export async function hydrateBuilderDesignSystemReference(
+  reference: BuilderDesignSystemProxyReference,
+  options: BuilderDesignSystemDocsOptions = { page: 0, pageSize: 40 },
+): Promise<BuilderDesignSystemHydratedReference> {
+  const docs = await fetchBuilderDesignSystemDocs(
+    reference.builderDesignSystemId,
+    options,
+  );
+  const tokenValues: Record<string, string> = {};
+  for (const doc of docs) {
+    if (!doc.tokenValues) continue;
+    for (const [name, value] of Object.entries(doc.tokenValues)) {
+      if (typeof value === "string") tokenValues[name] = value;
+    }
+  }
+  return {
+    ...reference,
+    docs,
+    tokenValues,
+    docCount: docs.length,
+  };
+}
+
 export async function startBuilderDesignSystemIndex(
   options: BuilderDesignSystemIndexOptions,
 ): Promise<BuilderDesignSystemIndexResult> {

package/corpus/core/src/server/collab-plugin.ts

@@ -45,6 +45,13 @@ type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
 /** Default maximum body size in bytes for collab write operations (2 MB). */
 const DEFAULT_MAX_PAYLOAD_BYTES = 2 * 1024 * 1024;
 
+type CollabAwarenessScope = {
+  owner?: string;
+  orgId?: string;
+  resourceType?: string;
+  resourceId?: string;
+};
+
 /**
  * Whether the no-resourceType warning has already been logged once per server
  * process. Avoids flooding logs on every request in templates that deliberately
@@ -111,16 +118,17 @@ export function createCollabPlugin(
     // Security: when resourceType is configured, resolve the resource's
     // owner/org so getChangesSinceForUser can scope delivery. We use
     // resolveAccess to obtain the resource row — it already handles ownership,
-    // visibility, and share rows. Rather than trying to enumerate every sharee
-    // (which would require querying the shares table for every update), the
-    // conservative strategy is:
-    //   • tag the event with the resource owner's email and org (owner-scoped).
-    //   • non-owner sharees who have explicit viewer+ access will NOT receive
-    //     the push event; they fall back to the state-vector catch-up via the
-    //     poll loop.  This is safe (never delivers to someone without access)
-    //     at the cost of sharees seeing slightly higher latency (state-vector
-    //     fetch on the next poll cycle) rather than the push path.
-    // See also: SECURITY comment in poll.ts on getChangesSinceForUser.
+    // visibility, and share rows. In addition to the owner/org tags we also
+    // tag the event with `resourceType` + `resourceId` so the per-user
+    // delivery filter (canSeeChangeForUser) can evaluate resource access
+    // directly for non-owner sharees:
+    //   • tag the event with the resource owner's email and org (owner-scoped)
+    //     for backward compatibility with the conservative owner/org fast path.
+    //   • ALSO tag with resourceType/resourceId so canSeeChangeForUser can run
+    //     an access-aware (cached) check and push to explicit viewer+ sharees
+    //     who don't match owner/org — instead of only degrading them to the
+    //     poll fallback.
+    // See also: SECURITY comment in poll.ts on canSeeChangeForUser.
     if (!resourceType && !_unscoped_warning_logged) {
       _unscoped_warning_logged = true;
       console.warn(
@@ -180,12 +188,15 @@ export function createCollabPlugin(
         const orgId =
           typeof resource.orgId === "string" ? resource.orgId : undefined;
 
-        // Tag the event with owner/org. Non-owner sharees fall back to poll;
-        // this is acceptable (see comment above).
+        // Tag the event with owner/org (backward-compat fast path) AND with
+        // resourceType/resourceId so canSeeChangeForUser can run an
+        // access-aware check for non-owner sharees (see poll.ts).
         recordChange({
           ...event,
           ...(ownerEmail ? { owner: ownerEmail } : {}),
           ...(orgId ? { orgId } : {}),
+          resourceType,
+          resourceId,
         });
       } catch {
         // If we fail to resolve the resource (DB not ready, etc.) we skip
@@ -244,7 +255,25 @@ export function createCollabPlugin(
 
             if (isWrite) {
               // assertAccess throws ForbiddenError (→ 403) if no editor access
-              await assertAccess(resourceType, resourceId, "editor");
+              const access = await assertAccess(
+                resourceType,
+                resourceId,
+                "editor",
+              );
+              const resource = access.resource as Record<string, unknown>;
+              const awarenessScope: CollabAwarenessScope = {
+                resourceType,
+                resourceId,
+                ...(typeof resource.ownerEmail === "string"
+                  ? { owner: resource.ownerEmail }
+                  : {}),
+                ...(typeof resource.orgId === "string"
+                  ? { orgId: resource.orgId }
+                  : {}),
+              };
+              if (event.context) {
+                event.context._collabAwarenessScope = awarenessScope;
+              }
             } else {
               // resolveAccess returns null when no access; return 404 to avoid leaking existence
               const access = await resolveAccess(resourceType, resourceId);
@@ -252,6 +281,20 @@ export function createCollabPlugin(
                 setResponseStatus(event, 404);
                 return { error: "Not found" };
               }
+              const resource = access.resource as Record<string, unknown>;
+              const awarenessScope: CollabAwarenessScope = {
+                resourceType,
+                resourceId,
+                ...(typeof resource.ownerEmail === "string"
+                  ? { owner: resource.ownerEmail }
+                  : {}),
+                ...(typeof resource.orgId === "string"
+                  ? { orgId: resource.orgId }
+                  : {}),
+              };
+              if (event.context) {
+                event.context._collabAwarenessScope = awarenessScope;
+              }
             }
           }
 

package/corpus/core/src/server/design-token-utils.ts

@@ -4,7 +4,7 @@
  * Pure functions for parsing Tailwind configs, CSS files, package.json,
  * documents, and URLs to extract colors, fonts, spacing, border-radius,
  * and CSS custom properties. Used by the import-* actions across all
- * templates (design, slides, videos).
+ * templates (design and slides).
  *
  * No framework dependencies — no defineAction, no zod, no drizzle.
  */