npm - @agent-native/creative-context - Versions diffs - 0.3.0 → 0.5.0 - Mend

@agent-native/creative-context 0.3.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (185) hide show

package/README.md +51 -9
package/agent-native.package.json +4 -0
package/dist/actions/index.d.ts.map +1 -1
package/dist/actions/index.js +8 -0
package/dist/actions/index.js.map +1 -1
package/dist/actions/list-context-memberships.d.ts +11 -0
package/dist/actions/list-context-memberships.d.ts.map +1 -0
package/dist/actions/list-context-memberships.js +47 -0
package/dist/actions/list-context-memberships.js.map +1 -0
package/dist/actions/list-creative-contexts.d.ts +12 -0
package/dist/actions/list-creative-contexts.d.ts.map +1 -0
package/dist/actions/list-creative-contexts.js +28 -0
package/dist/actions/list-creative-contexts.js.map +1 -0
package/dist/actions/manage-context-membership.d.ts +64 -0
package/dist/actions/manage-context-membership.d.ts.map +1 -0
package/dist/actions/manage-context-membership.js +70 -0
package/dist/actions/manage-context-membership.js.map +1 -0
package/dist/actions/manage-context-pack.d.ts +3 -0
package/dist/actions/manage-context-pack.js +6 -0
package/dist/actions/manage-context-pack.js.map +1 -1
package/dist/actions/manage-context-source.js +4 -11
package/dist/actions/manage-context-source.js.map +1 -1
package/dist/actions/manage-creative-context.d.ts +28 -0
package/dist/actions/manage-creative-context.d.ts.map +1 -0
package/dist/actions/manage-creative-context.js +65 -0
package/dist/actions/manage-creative-context.js.map +1 -0
package/dist/actions/process-context-purge.d.ts +16 -1
package/dist/actions/process-context-purge.js +2 -1
package/dist/actions/process-context-purge.js.map +1 -1
package/dist/actions/search-creative-context.d.ts +1 -0
package/dist/actions/search-creative-context.js +2 -1
package/dist/actions/search-creative-context.js.map +1 -1
package/dist/client/CreativeContextChip.d.ts +5 -1
package/dist/client/CreativeContextChip.d.ts.map +1 -1
package/dist/client/CreativeContextChip.js +36 -7
package/dist/client/CreativeContextChip.js.map +1 -1
package/dist/client/CreativeContextPanel.d.ts.map +1 -1
package/dist/client/CreativeContextPanel.js +406 -89
package/dist/client/CreativeContextPanel.js.map +1 -1
package/dist/client/CreativeContextShareTab.d.ts +56 -0
package/dist/client/CreativeContextShareTab.d.ts.map +1 -0
package/dist/client/CreativeContextShareTab.js +213 -0
package/dist/client/CreativeContextShareTab.js.map +1 -0
package/dist/client/actions.d.ts +210 -0
package/dist/client/actions.d.ts.map +1 -1
package/dist/client/actions.js +318 -0
package/dist/client/actions.js.map +1 -1
package/dist/client/application-state.d.ts +2 -0
package/dist/client/application-state.d.ts.map +1 -1
package/dist/client/application-state.js +25 -2
package/dist/client/application-state.js.map +1 -1
package/dist/client/index.d.ts +4 -3
package/dist/client/index.d.ts.map +1 -1
package/dist/client/index.js +4 -3
package/dist/client/index.js.map +1 -1
package/dist/client/messages.d.ts +1 -1
package/dist/client/messages.d.ts.map +1 -1
package/dist/client/messages.js +77 -0
package/dist/client/messages.js.map +1 -1
package/dist/connectors/types.d.ts +2 -2
package/dist/connectors/types.d.ts.map +1 -1
package/dist/schema/index.d.ts +1592 -0
package/dist/schema/index.d.ts.map +1 -1
package/dist/schema/index.js +95 -0
package/dist/schema/index.js.map +1 -1
package/dist/schema/migrations.d.ts.map +1 -1
package/dist/schema/migrations.js +80 -0
package/dist/schema/migrations.js.map +1 -1
package/dist/server/generation-artifact-access.js +2 -0
package/dist/server/generation-artifact-access.js.map +1 -1
package/dist/server/generation-context.d.ts +12 -4
package/dist/server/generation-context.d.ts.map +1 -1
package/dist/server/generation-context.js +129 -7
package/dist/server/generation-context.js.map +1 -1
package/dist/server/index.d.ts +4 -0
package/dist/server/index.d.ts.map +1 -1
package/dist/server/index.js +16 -0
package/dist/server/index.js.map +1 -1
package/dist/server/isolated-a2a.d.ts +3 -0
package/dist/server/isolated-a2a.d.ts.map +1 -1
package/dist/server/isolated-a2a.js +3 -1
package/dist/server/isolated-a2a.js.map +1 -1
package/dist/server/media.d.ts +1 -1
package/dist/server/media.d.ts.map +1 -1
package/dist/server/media.js +24 -9
package/dist/server/media.js.map +1 -1
package/dist/server/native-resource-capture.d.ts +78 -0
package/dist/server/native-resource-capture.d.ts.map +1 -0
package/dist/server/native-resource-capture.js +94 -0
package/dist/server/native-resource-capture.js.map +1 -0
package/dist/server/public-serialization.js +1 -1
package/dist/server/public-serialization.js.map +1 -1
package/dist/server/retrieval.d.ts +1 -0
package/dist/server/retrieval.d.ts.map +1 -1
package/dist/server/retrieval.js +2 -0
package/dist/server/retrieval.js.map +1 -1
package/dist/server/safe-native-preview.d.ts +15 -0
package/dist/server/safe-native-preview.d.ts.map +1 -0
package/dist/server/safe-native-preview.js +149 -0
package/dist/server/safe-native-preview.js.map +1 -0
package/dist/store/brand.d.ts.map +1 -1
package/dist/store/brand.js +2 -16
package/dist/store/brand.js.map +1 -1
package/dist/store/content.d.ts +1 -0
package/dist/store/content.d.ts.map +1 -1
package/dist/store/content.js +84 -20
package/dist/store/content.js.map +1 -1
package/dist/store/contexts.d.ts +216 -0
package/dist/store/contexts.d.ts.map +1 -0
package/dist/store/contexts.js +1341 -0
package/dist/store/contexts.js.map +1 -0
package/dist/store/index.d.ts +1 -0
package/dist/store/index.d.ts.map +1 -1
package/dist/store/index.js +1 -0
package/dist/store/index.js.map +1 -1
package/dist/store/packs.d.ts +3 -0
package/dist/store/packs.d.ts.map +1 -1
package/dist/store/packs.js +126 -9
package/dist/store/packs.js.map +1 -1
package/dist/store/purge.d.ts.map +1 -1
package/dist/store/purge.js +103 -6
package/dist/store/purge.js.map +1 -1
package/dist/store/sources.d.ts.map +1 -1
package/dist/store/sources.js +2 -15
package/dist/store/sources.js.map +1 -1
package/dist/store/suggestions.d.ts.map +1 -1
package/dist/store/suggestions.js +3 -1
package/dist/store/suggestions.js.map +1 -1
package/dist/types.d.ts +77 -0
package/dist/types.d.ts.map +1 -1
package/dist/types.js +9 -1
package/dist/types.js.map +1 -1
package/docs/skills/creative-context/SKILL.md +13 -5
package/package.json +3 -3
package/src/actions/index.ts +8 -0
package/src/actions/job-public-serialization.spec.ts +21 -0
package/src/actions/list-context-memberships.ts +56 -0
package/src/actions/list-creative-contexts.spec.ts +38 -0
package/src/actions/list-creative-contexts.ts +32 -0
package/src/actions/manage-context-membership.ts +80 -0
package/src/actions/manage-context-pack.ts +6 -0
package/src/actions/manage-context-source.ts +8 -11
package/src/actions/manage-creative-context.ts +73 -0
package/src/actions/process-context-purge.ts +4 -1
package/src/actions/search-creative-context.ts +2 -1
package/src/client/CreativeContextChip.spec.ts +32 -0
package/src/client/CreativeContextChip.tsx +83 -14
package/src/client/CreativeContextPanel.tsx +1947 -885
package/src/client/CreativeContextShareTab.spec.ts +70 -0
package/src/client/CreativeContextShareTab.tsx +657 -0
package/src/client/actions.spec.ts +177 -0
package/src/client/actions.ts +566 -0
package/src/client/application-state.spec.ts +5 -0
package/src/client/application-state.ts +30 -2
package/src/client/index.ts +33 -0
package/src/client/messages.ts +95 -0
package/src/connectors/types.ts +6 -8
package/src/eval/library-flow.acceptance.spec.tsx +1 -0
package/src/schema/index.ts +116 -0
package/src/schema/migrations.ts +80 -0
package/src/server/generation-artifact-access.ts +1 -0
package/src/server/generation-context-a2a.spec.ts +133 -0
package/src/server/generation-context.ts +153 -7
package/src/server/index.spec.ts +15 -0
package/src/server/index.ts +16 -0
package/src/server/isolated-a2a.ts +4 -1
package/src/server/media.spec.ts +30 -2
package/src/server/media.ts +31 -12
package/src/server/native-resource-capture.spec.ts +121 -0
package/src/server/native-resource-capture.ts +198 -0
package/src/server/public-serialization.spec.ts +1 -0
package/src/server/public-serialization.ts +1 -1
package/src/server/retrieval.ts +3 -0
package/src/server/safe-native-preview.spec.ts +29 -0
package/src/server/safe-native-preview.ts +200 -0
package/src/store/access.integration.spec.ts +1116 -0
package/src/store/brand.ts +2 -21
package/src/store/content.ts +217 -17
package/src/store/contexts.ts +1826 -0
package/src/store/index.ts +1 -0
package/src/store/packs.ts +279 -24
package/src/store/purge.ts +139 -6
package/src/store/sources.ts +2 -18
package/src/store/suggestions.ts +3 -1
package/src/types.ts +95 -0

package/src/store/access.integration.spec.ts CHANGED Viewed

@@ -1266,6 +1266,762 @@ describe("creative context access and revocation", () => {
     ).rejects.toThrow("unavailable at the pinned source version");
   });
+  it("publishes trusted Slides and Figma hierarchies without losing compiler metadata or child pins", async () => {
+    const { runWithRequestContext, store } = await setup();
+    const { reassembleNativeCreativeArtifact } =
+      await import("../native-artifact-reassembly.js");
+    const asAlice = <T>(fn: () => Promise<T>) =>
+      runWithRequestContext(
+        { userEmail: "alice@example.test", orgId: "org-1" },
+        fn,
+      );
+    const asBob = <T>(fn: () => Promise<T>) =>
+      runWithRequestContext(
+        { userEmail: "bob@example.test", orgId: "org-1" },
+        fn,
+      );
+    const fidelityReport = {
+      exact: { count: 1 },
+      approximated: { count: 0, reasons: [] },
+      imageFallback: { count: 0, reasons: [] },
+    };
+    for (const fixture of [
+      {
+        app: "slides" as const,
+        format: "slides-html" as const,
+        compiler: "@agent-native/creative-context:google-slides-native",
+      },
+      {
+        app: "design" as const,
+        format: "design-html" as const,
+        compiler: "@agent-native/core/ingestion:figma-node-to-html",
+      },
+    ]) {
+      const rootExternalId = `${fixture.app}:published-root`;
+      const childExternalId = `${fixture.app}:published-child`;
+      const rootHtml = `<!doctype html><html><head></head><body><div data-creative-context-child="${childExternalId}"></div></body></html>`;
+      const childHtml = `<!doctype html><html><head></head><body><div>${fixture.app} child</div></body></html>`;
+      const ingested = await asAlice(() =>
+        store.ingestItems({
+          sourceId: "source-1",
+          items: [
+            {
+              externalId: rootExternalId,
+              kind: "native-manifest",
+              title: `${fixture.app} root`,
+              mimeType: "text/html",
+              content: rootHtml,
+              contentHash: `${fixture.app}-root-v1`,
+              provenance: { compiler: fixture.compiler },
+              metadata: {
+                nativeArtifact: {
+                  schemaVersion: 1,
+                  app: fixture.app,
+                  format: fixture.format,
+                  rootExternalId,
+                  childExternalIds: [childExternalId],
+                  manifest: {
+                    kind: "hierarchical-artboard",
+                    children: [
+                      {
+                        externalId: childExternalId,
+                        sourceNodeId: "child-1",
+                        bounds: { x: 0, y: 0, width: 10, height: 10 },
+                        zOrder: 0,
+                      },
+                    ],
+                  },
+                  fidelityReport,
+                },
+              },
+              edges: [
+                {
+                  relation: "contains-native-child",
+                  toExternalId: childExternalId,
+                },
+              ],
+            },
+            {
+              externalId: childExternalId,
+              kind: "native-child",
+              title: `${fixture.app} child`,
+              mimeType: "text/html",
+              content: childHtml,
+              contentHash: `${fixture.app}-child-v1`,
+              provenance: { compiler: fixture.compiler },
+              metadata: {
+                nativeArtifact: {
+                  schemaVersion: 1,
+                  app: fixture.app,
+                  format: fixture.format,
+                  rootExternalId: childExternalId,
+                  fidelityReport,
+                },
+              },
+            },
+          ],
+        }),
+      );
+      const context = await asAlice(() =>
+        store.createCreativeContext({
+          name: `${fixture.app} fidelity`,
+          kind: "specialty",
+        }),
+      );
+      await asAlice(() =>
+        store.manageContextMembership({
+          operation: "submit",
+          contextId: context!.id,
+          itemId: ingested.itemIds[0],
+          confirmBroaderPublication: true,
+        }),
+      );
+      const membership = (
+        await asAlice(() =>
+          store.listContextMemberships({ contextId: context!.id, limit: 20 }),
+        )
+      ).memberships.find(
+        (entry) => entry.artifactKey === `source-1:${rootExternalId}`,
+      )!;
+      const published = await asBob(() =>
+        store.getCreativeContextItem(
+          membership.publishedItemId!,
+          membership.publishedItemVersionId!,
+        ),
+      );
+      expect(published?.item.provenance.compiler).toBe(fixture.compiler);
+      expect(published?.version.metadata).toMatchObject({
+        nativeArtifact: { app: fixture.app, format: fixture.format },
+      });
+      const reassembled = await asBob(() =>
+        reassembleNativeCreativeArtifact({
+          root: published!,
+          app: fixture.app,
+          format: fixture.format,
+          resolveChild: store.getCreativeContextItemByExternalId,
+        }),
+      );
+      expect(reassembled.html).toContain(`${fixture.app} child`);
+      expect(reassembled.evidence).toHaveLength(2);
+      const childEdge = published!.edges.find(
+        (edge) => edge.relation === "contains-native-child",
+      );
+      expect(childEdge).toMatchObject({
+        toItemId: expect.any(String),
+        toItemVersionId: expect.any(String),
+      });
+      const pack = await asAlice(() =>
+        store.createContextPack({
+          name: `${fixture.app} hierarchical replay`,
+          baseContextId: context!.id,
+          members: [
+            {
+              itemId: published!.item.id,
+              itemVersionId: published!.version.id,
+              reason: "Explicit root",
+              score: 0.91,
+              scoreMetadata: { source: "test" },
+            },
+          ],
+        }),
+      );
+      expect(pack.members).toEqual([
+        expect.objectContaining({
+          itemId: published!.item.id,
+          itemVersionId: published!.version.id,
+          ordinal: 0,
+          reason: "Explicit root",
+          score: 0.91,
+          scoreMetadata: { source: "test" },
+        }),
+        expect.objectContaining({
+          itemId: childEdge!.toItemId,
+          itemVersionId: childEdge!.toItemVersionId,
+          ordinal: 1,
+          reason: "Native artifact dependency",
+          score: null,
+        }),
+      ]);
+      await asAlice(() =>
+        store.manageContextMembership({
+          operation: "remove",
+          contextId: context!.id,
+          membershipId: membership.id,
+        }),
+      );
+      const removedMemberships = await asAlice(() =>
+        store.listContextMemberships({ contextId: context!.id, limit: 20 }),
+      );
+      expect(
+        removedMemberships.memberships.filter(
+          (entry) =>
+            entry.publishedItemId === published!.item.id ||
+            entry.publishedItemId === childEdge!.toItemId,
+        ),
+      ).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            publishedItemId: published!.item.id,
+            status: "removed",
+          }),
+          expect.objectContaining({
+            publishedItemId: childEdge!.toItemId,
+            status: "removed",
+          }),
+        ]),
+      );
+      const replayPack = await asBob(() => store.getContextPack(pack.id));
+      expect(replayPack?.members).toHaveLength(2);
+      const replayRoot = await asBob(() =>
+        store.getCreativeContextItem(published!.item.id, published!.version.id),
+      );
+      const replayChild = await asBob(() =>
+        store.getCreativeContextItem(
+          childEdge!.toItemId!,
+          childEdge!.toItemVersionId!,
+        ),
+      );
+      expect(replayRoot?.version.id).toBe(published!.version.id);
+      expect(replayChild?.version.id).toBe(childEdge!.toItemVersionId);
+      const replayed = await asBob(() =>
+        reassembleNativeCreativeArtifact({
+          root: replayRoot!,
+          app: fixture.app,
+          format: fixture.format,
+          resolveChild: store.getCreativeContextItemByExternalId,
+        }),
+      );
+      expect(replayed.html).toContain(`${fixture.app} child`);
+      expect(replayed.evidence).toEqual(
+        expect.arrayContaining([
+          {
+            itemId: published!.item.id,
+            itemVersionId: published!.version.id,
+          },
+          {
+            itemId: childEdge!.toItemId,
+            itemVersionId: childEdge!.toItemVersionId,
+          },
+        ]),
+      );
+    }
+  });
+  it("does not turn a forged compiler id into a trusted published artifact", async () => {
+    const { runWithRequestContext, store } = await setup();
+    const { reassembleNativeCreativeArtifact } =
+      await import("../native-artifact-reassembly.js");
+    const asAlice = <T>(fn: () => Promise<T>) =>
+      runWithRequestContext(
+        { userEmail: "alice@example.test", orgId: "org-1" },
+        fn,
+      );
+    const ingested = await asAlice(() =>
+      store.ingestItems({
+        sourceId: "source-1",
+        items: [
+          {
+            externalId: "forged-native",
+            kind: "native",
+            title: "Forged",
+            mimeType: "text/html",
+            content:
+              "<!doctype html><html><head></head><body><div>forged</div></body></html>",
+            contentHash: "forged-v1",
+            provenance: { compiler: "attacker/compiler" },
+            metadata: {
+              nativeArtifact: {
+                schemaVersion: 1,
+                app: "design",
+                format: "design-html",
+                rootExternalId: "forged-native",
+                fidelityReport: {
+                  exact: { count: 1 },
+                  approximated: { count: 0, reasons: [] },
+                  imageFallback: { count: 0, reasons: [] },
+                },
+              },
+            },
+          },
+        ],
+      }),
+    );
+    const context = await asAlice(() =>
+      store.createCreativeContext({ name: "forged", kind: "specialty" }),
+    );
+    await asAlice(() =>
+      store.manageContextMembership({
+        operation: "submit",
+        contextId: context!.id,
+        itemId: ingested.itemIds[0],
+        confirmBroaderPublication: true,
+      }),
+    );
+    const membership = (
+      await asAlice(() =>
+        store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+      )
+    ).memberships[0]!;
+    const published = await asAlice(() =>
+      store.getCreativeContextItem(
+        membership.publishedItemId!,
+        membership.publishedItemVersionId!,
+      ),
+    );
+    await expect(
+      asAlice(() =>
+        reassembleNativeCreativeArtifact({
+          root: published!,
+          app: "design",
+          format: "design-html",
+          resolveChild: store.getCreativeContextItemByExternalId,
+        }),
+      ),
+    ).rejects.toThrow(/trusted native artifact compiler/i);
+  });
+  it("keeps pending submissions private to their submitter and context reviewers", async () => {
+    const { exec, runWithRequestContext, store } = await setup();
+    const asUser = <T>(userEmail: string, fn: () => Promise<T>) =>
+      runWithRequestContext({ userEmail, orgId: "org-1" }, fn);
+    const asAlice = <T>(fn: () => Promise<T>) =>
+      asUser("alice@example.test", fn);
+    const asBob = <T>(fn: () => Promise<T>) => asUser("bob@example.test", fn);
+    const asCarol = <T>(fn: () => Promise<T>) =>
+      asUser("carol@example.test", fn);
+    const asDrew = <T>(fn: () => Promise<T>) => asUser("drew@example.test", fn);
+    const context = await asAlice(() =>
+      store.createCreativeContext({
+        name: "Review-only governance",
+        kind: "specialty",
+        approvalPolicy: "review",
+      }),
+    );
+    const timestamp = "2026-07-17T00:00:00.000Z";
+    await exec.execute({
+      sql: `INSERT INTO creative_context_source_shares
+        (id, resource_id, principal_type, principal_id, role, created_by, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "source-share-bob",
+        "source-1",
+        "user",
+        "bob@example.test",
+        "admin",
+        "alice@example.test",
+        timestamp,
+      ],
+    });
+    for (const [id, email] of [
+      ["context-share-bob", "bob@example.test"],
+      ["context-share-drew", "drew@example.test"],
+    ]) {
+      await exec.execute({
+        sql: `INSERT INTO creative_context_shares
+          (id, resource_id, principal_type, principal_id, role, created_by, created_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          id,
+          context!.id,
+          "user",
+          email,
+          "editor",
+          "alice@example.test",
+          timestamp,
+        ],
+      });
+    }
+    await exec.execute({
+      sql: "UPDATE creative_context_items SET thumbnail_blob_ref = ? WHERE id = ?",
+      args: ["creative-context-blob:v1:pending-preview-opaque", "allowed"],
+    });
+    await expect(
+      asCarol(() =>
+        store.manageContextMembership({
+          operation: "submit",
+          contextId: context!.id,
+          itemId: "allowed",
+        }),
+      ),
+    ).rejects.toThrow();
+    expect(
+      (await asBob(() => store.getCreativeContextById(context!.id)))?.access,
+    ).toMatchObject({ canSubmit: true, canReview: false });
+    const submitted = await asBob(() =>
+      store.manageContextMembership({
+        operation: "submit",
+        contextId: context!.id,
+        itemId: "allowed",
+        confirmBroaderPublication: true,
+      }),
+    );
+    const membershipId = submitted.membershipId;
+    await expect(
+      asBob(() =>
+        store.manageContextMembership({
+          operation: "approve",
+          contextId: context!.id,
+          membershipId,
+        }),
+      ),
+    ).rejects.toThrow();
+    await expect(
+      asDrew(() =>
+        store.manageContextMembership({
+          operation: "remove",
+          contextId: context!.id,
+          membershipId,
+        }),
+      ),
+    ).rejects.toThrow();
+    await expect(
+      asBob(() =>
+        store.updateCreativeContext(context!.id, { name: "Unapproved edit" }),
+      ),
+    ).rejects.toThrow();
+    const ownPending = await asBob(() =>
+      store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+    );
+    expect(ownPending.memberships).toEqual([
+      expect.objectContaining({
+        id: membershipId,
+        artifactKey: "source-1:allowed",
+        pendingSubmission: expect.objectContaining({
+          submittedBy: "bob@example.test",
+          proposedItem: expect.objectContaining({
+            title: "allowed title",
+            itemVersionId: expect.any(String),
+          }),
+        }),
+      }),
+    ]);
+    const proposedItem =
+      ownPending.memberships[0]?.pendingSubmission?.proposedItem;
+    expect(proposedItem).toMatchObject({
+      id: expect.any(String),
+      itemVersionId: expect.any(String),
+    });
+    expect(JSON.stringify(ownPending)).not.toContain("pending-preview-opaque");
+    await expect(
+      asBob(() =>
+        store.readPendingCreativeContextMedia({
+          itemId: proposedItem!.id,
+          itemVersionId: proposedItem!.itemVersionId,
+        }),
+      ),
+    ).resolves.toMatchObject({
+      storageKey: "creative-context-blob:v1:pending-preview-opaque",
+    });
+    await expect(
+      asAlice(() =>
+        store.readPendingCreativeContextMedia({
+          itemId: proposedItem!.id,
+          itemVersionId: proposedItem!.itemVersionId,
+        }),
+      ),
+    ).resolves.toMatchObject({
+      storageKey: "creative-context-blob:v1:pending-preview-opaque",
+    });
+    await expect(
+      asDrew(() =>
+        store.readPendingCreativeContextMedia({
+          itemId: proposedItem!.id,
+          itemVersionId: proposedItem!.itemVersionId,
+        }),
+      ),
+    ).resolves.toBeNull();
+    await expect(
+      asCarol(() =>
+        store.readPendingCreativeContextMedia({
+          itemId: proposedItem!.id,
+          itemVersionId: proposedItem!.itemVersionId,
+        }),
+      ),
+    ).resolves.toBeNull();
+    await expect(
+      asDrew(() =>
+        store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+      ),
+    ).resolves.toMatchObject({ memberships: [] });
+    await expect(
+      asCarol(() =>
+        store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+      ),
+    ).resolves.toMatchObject({ memberships: [] });
+    const reviewerView = await asAlice(() =>
+      store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+    );
+    expect(reviewerView.memberships[0]).toMatchObject({
+      id: membershipId,
+      pendingSubmission: expect.objectContaining({
+        submittedBy: "bob@example.test",
+        proposedItem: expect.objectContaining({
+          title: "allowed title",
+        }),
+      }),
+    });
+    expect(
+      (await asAlice(() => store.getCreativeContextById(context!.id)))?.access,
+    ).toMatchObject({ canReview: true, canAdmin: true });
+    await asAlice(() =>
+      store.manageContextMembership({
+        operation: "approve",
+        contextId: context!.id,
+        membershipId,
+      }),
+    );
+    const approvedForViewer = await asCarol(() =>
+      store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+    );
+    expect(approvedForViewer.memberships).toEqual([
+      expect.objectContaining({
+        id: membershipId,
+        artifactKey: "source-1:allowed",
+        pendingSubmissionId: null,
+        pendingSubmission: null,
+        publishedItem: expect.objectContaining({ id: expect.any(String) }),
+      }),
+    ]);
+    const approvedVersionId =
+      approvedForViewer.memberships[0]!.publishedItemVersionId;
+    await asAlice(() =>
+      store.ingestItems({
+        sourceId: "source-1",
+        items: [
+          {
+            externalId: "allowed",
+            kind: "slide",
+            title: "allowed title update",
+            content: "new source version pending review",
+            contentHash: "allowed-hash-v3",
+            upstreamAccess: "available",
+          },
+        ],
+      }),
+    );
+    await asBob(() =>
+      store.manageContextMembership({
+        operation: "submit",
+        contextId: context!.id,
+        itemId: "allowed",
+        confirmBroaderPublication: true,
+      }),
+    );
+    const viewerDuringUpdate = await asCarol(() =>
+      store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+    );
+    expect(viewerDuringUpdate.memberships[0]).toMatchObject({
+      publishedItemVersionId: approvedVersionId,
+      pendingSubmissionId: null,
+      pendingSubmission: null,
+    });
+    const reviewerDuringUpdate = await asAlice(() =>
+      store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+    );
+    expect(reviewerDuringUpdate.memberships[0]).toMatchObject({
+      publishedItemVersionId: approvedVersionId,
+      pendingSubmission: expect.objectContaining({ status: "pending" }),
+    });
+  });
+  it("applies open and admins-only publication policies to editor submissions", async () => {
+    const { exec, runWithRequestContext, store } = await setup();
+    const asUser = <T>(userEmail: string, fn: () => Promise<T>) =>
+      runWithRequestContext({ userEmail, orgId: "org-1" }, fn);
+    const asAlice = <T>(fn: () => Promise<T>) =>
+      asUser("alice@example.test", fn);
+    const asBob = <T>(fn: () => Promise<T>) => asUser("bob@example.test", fn);
+    await exec.execute({
+      sql: "UPDATE creative_context_sources SET visibility = 'org' WHERE id = 'source-1'",
+      args: [],
+    });
+    const [open, adminsOnly] = await Promise.all([
+      asAlice(() =>
+        store.createCreativeContext({
+          name: "Open",
+          kind: "specialty",
+          approvalPolicy: "open",
+        }),
+      ),
+      asAlice(() =>
+        store.createCreativeContext({
+          name: "Admin publishing",
+          kind: "specialty",
+          approvalPolicy: "admins-only",
+        }),
+      ),
+    ]);
+    for (const [id, contextId] of [
+      ["open-editor", open!.id],
+      ["admins-editor", adminsOnly!.id],
+    ]) {
+      await exec.execute({
+        sql: `INSERT INTO creative_context_shares
+          (id, resource_id, principal_type, principal_id, role, created_by, created_at)
+          VALUES (?, ?, 'user', 'bob@example.test', 'editor', 'alice@example.test', ?)`,
+        args: [id, contextId, "2026-07-17T00:00:00.000Z"],
+      });
+    }
+    const openSubmission = await asBob(() =>
+      store.manageContextMembership({
+        operation: "submit",
+        contextId: open!.id,
+        itemId: "allowed",
+      }),
+    );
+    expect(openSubmission.submission).toMatchObject({ status: "approved" });
+    const governedSubmission = await asBob(() =>
+      store.manageContextMembership({
+        operation: "submit",
+        contextId: adminsOnly!.id,
+        itemId: "allowed",
+      }),
+    );
+    expect(governedSubmission.submission).toMatchObject({ status: "pending" });
+    await expect(
+      asBob(() =>
+        store.manageContextMembership({
+          operation: "approve",
+          contextId: adminsOnly!.id,
+          membershipId: governedSubmission.membershipId,
+        }),
+      ),
+    ).rejects.toThrow();
+    await expect(
+      asAlice(() =>
+        store.manageContextMembership({
+          operation: "approve",
+          contextId: adminsOnly!.id,
+          membershipId: governedSubmission.membershipId,
+        }),
+      ),
+    ).resolves.toEqual({ approved: true });
+  });
+  it("serializes concurrent Default creation to one scope-owned context", async () => {
+    const { exec, runWithRequestContext, store } = await setup();
+    const createDefault = () =>
+      runWithRequestContext(
+        { userEmail: "alice@example.test", orgId: "org-1" },
+        () => store.createCreativeContext({ name: "Default", kind: "default" }),
+      );
+    const [first, second] = await Promise.all([
+      createDefault(),
+      createDefault(),
+    ]);
+    expect(first?.id).toBe(second?.id);
+    const rows = await exec.execute({
+      sql: `SELECT id FROM creative_contexts
+        WHERE default_scope_key = ?`,
+      args: ["org:org-1"],
+    });
+    expect(rows.rows).toHaveLength(1);
+  });
+  it("keeps Default non-archivable and does not broaden private corpus during org backfill", async () => {
+    const { runWithRequestContext, store } = await setup();
+    const asAlice = <T>(fn: () => Promise<T>) =>
+      runWithRequestContext(
+        { userEmail: "alice@example.test", orgId: "org-1" },
+        fn,
+      );
+    const context = await asAlice(() => store.ensureDefaultCreativeContext());
+    expect(context).toMatchObject({ kind: "default", visibility: "org" });
+    await expect(
+      asAlice(() => store.archiveCreativeContext(context!.id)),
+    ).rejects.toThrow(/Default Creative Context cannot be archived/);
+    const memberships = await asAlice(() =>
+      store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+    );
+    expect(memberships.memberships).toEqual([]);
+  });
+  it("applies each Creative Context's rank to the same item at retrieval time", async () => {
+    const { exec, runWithRequestContext, store } = await setup();
+    const asAlice = <T>(fn: () => Promise<T>) =>
+      runWithRequestContext(
+        { userEmail: "alice@example.test", orgId: "org-1" },
+        fn,
+      );
+    const [canonical, normal] = await Promise.all([
+      asAlice(() =>
+        store.createCreativeContext({
+          name: "Canonical lane",
+          kind: "specialty",
+        }),
+      ),
+      asAlice(() =>
+        store.createCreativeContext({ name: "Normal lane", kind: "specialty" }),
+      ),
+    ]);
+    for (const [id, contextId, rank] of [
+      ["canonical-membership", canonical!.id, "canonical"],
+      ["normal-membership", normal!.id, "normal"],
+    ]) {
+      await exec.execute({
+        sql: `INSERT INTO creative_context_memberships
+          (id, context_id, artifact_key, published_item_id, published_item_version_id,
+           rank, status, created_at, updated_at, owner_email, org_id)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          id,
+          contextId,
+          "source-1:allowed",
+          "allowed",
+          "allowed-v2",
+          rank,
+          "active",
+          "2026-07-17T00:00:00.000Z",
+          "2026-07-17T00:00:00.000Z",
+          "alice@example.test",
+          "org-1",
+        ],
+      });
+    }
+    const [canonicalResults, normalResults, canonicalDocuments] =
+      await Promise.all([
+        asAlice(() =>
+          store.listAccessibleLexicalCandidates({
+            query: "canonical version 2",
+            contextId: canonical!.id,
+            limit: 10,
+          }),
+        ),
+        asAlice(() =>
+          store.listAccessibleLexicalCandidates({
+            query: "canonical version 2",
+            contextId: normal!.id,
+            limit: 10,
+          }),
+        ),
+        asAlice(() =>
+          store.listAccessibleSearchDocuments({
+            contextId: canonical!.id,
+            limit: 10,
+          }),
+        ),
+      ]);
+    expect(canonicalResults.results[0]).toMatchObject({
+      itemId: "allowed",
+      itemVersionId: "allowed-v2",
+    });
+    expect(canonicalResults.results[0]!.score).toBeGreaterThan(
+      normalResults.results[0]!.score,
+    );
+    expect(canonicalDocuments[0]).toMatchObject({
+      itemId: "allowed",
+      curationRank: "canonical",
+    });
+  });
   it("finds native artifacts through bounded code-token chunks", async () => {
     const { runWithRequestContext, store } = await setup();
     const { performCreativeContextSearch } =
@@ -1578,6 +2334,366 @@ describe("creative context access and revocation", () => {
     ]);
   });
+  it("limits pack replay bypasses to context-owned published snapshots", async () => {
+    const { exec, runWithRequestContext, store } = await setup();
+    const asAlice = <T>(fn: () => Promise<T>) =>
+      runWithRequestContext(
+        { userEmail: "alice@example.test", orgId: "org-1" },
+        fn,
+      );
+    const asBob = <T>(fn: () => Promise<T>) =>
+      runWithRequestContext(
+        { userEmail: "bob@example.test", orgId: "org-1" },
+        fn,
+      );
+    await exec.execute({
+      sql: `INSERT INTO creative_context_packs
+        (id, name, context_mode, request, created_at, owner_email, org_id, visibility)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "unsafe-pack",
+        "Unsafe library replay",
+        "manual",
+        "{}",
+        "2026-07-16T00:00:00.000Z",
+        "alice@example.test",
+        "org-1",
+        "private",
+      ],
+    });
+    await exec.execute({
+      sql: `INSERT INTO creative_context_pack_members
+        (id, pack_id, item_id, item_version_id, ordinal, score_metadata,
+         created_at, owner_email, org_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "unsafe-member",
+        "unsafe-pack",
+        "allowed",
+        "allowed-v1",
+        0,
+        "{}",
+        "2026-07-16T00:00:00.000Z",
+        "alice@example.test",
+        "org-1",
+      ],
+    });
+    await exec.execute({
+      sql: `INSERT INTO creative_context_pack_shares
+        (id, resource_id, principal_type, principal_id, role, created_by, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "unsafe-pack-share",
+        "unsafe-pack",
+        "user",
+        "bob@example.test",
+        "viewer",
+        "alice@example.test",
+        "2026-07-16T00:00:00.000Z",
+      ],
+    });
+    await exec.execute(
+      "UPDATE creative_context_sources SET upstream_access = 'restricted' WHERE id = 'source-1'",
+    );
+    await expect(
+      asBob(() => store.getCreativeContextItem("allowed", "allowed-v1")),
+    ).resolves.toBeNull();
+    await expect(
+      asBob(() =>
+        store.listAccessibleLexicalCandidates({
+          query: "version 1",
+          packId: "unsafe-pack",
+          limit: 10,
+        }),
+      ),
+    ).resolves.toEqual({ results: [], nextCursor: undefined });
+    for (const source of [
+      ["context-staging-source", "Context staging"],
+      ["context-published-source", "Context published"],
+    ]) {
+      await exec.execute({
+        sql: `INSERT INTO creative_context_sources
+          (id, name, kind, config, upstream_access, status, health_status,
+           item_count, restricted_item_count, owner_email, org_id, visibility,
+           created_at, updated_at)
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+        args: [
+          source[0],
+          source[1],
+          "native-app",
+          "{}",
+          "available",
+          "active",
+          "healthy",
+          1,
+          0,
+          "alice@example.test",
+          "org-1",
+          "private",
+          "2026-07-16T00:00:00.000Z",
+          "2026-07-16T00:00:00.000Z",
+        ],
+      });
+    }
+    await exec.execute({
+      sql: `INSERT INTO creative_contexts
+        (id, name, kind, staging_source_id, published_source_id, approval_policy,
+         created_at, updated_at, owner_email, org_id, visibility)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "context-owned",
+        "Governed context",
+        "specialty",
+        "context-staging-source",
+        "context-published-source",
+        "review",
+        "2026-07-16T00:00:00.000Z",
+        "2026-07-16T00:00:00.000Z",
+        "alice@example.test",
+        "org-1",
+        "private",
+      ],
+    });
+    await exec.execute({
+      sql: `INSERT INTO creative_context_items
+        (id, source_id, external_id, kind, title, current_version_id,
+         current_content_hash, status, upstream_access, curation_status,
+         curation_rank, inventory_state, index_state, tags, colors, provenance,
+         metadata, created_at, updated_at, owner_email, org_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "published-item",
+        "context-published-source",
+        "published-artifact",
+        "slide",
+        "Published evidence",
+        "published-version",
+        "published-hash",
+        "active",
+        "available",
+        "included",
+        "normal",
+        "available",
+        "pending",
+        "[]",
+        "[]",
+        "{}",
+        "{}",
+        "2026-07-16T00:00:00.000Z",
+        "2026-07-16T00:00:00.000Z",
+        "alice@example.test",
+        "org-1",
+      ],
+    });
+    await exec.execute({
+      sql: `INSERT INTO creative_context_item_versions
+        (id, item_id, version_number, content_hash, title, content, parse_status,
+         metadata, created_at, owner_email, org_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "published-version",
+        "published-item",
+        1,
+        "published-hash",
+        "Published evidence",
+        "historical governed context evidence",
+        "parsed",
+        "{}",
+        "2026-07-16T00:00:00.000Z",
+        "alice@example.test",
+        "org-1",
+      ],
+    });
+    await exec.execute({
+      sql: `INSERT INTO creative_context_chunks
+        (id, item_id, item_version_id, ordinal, kind, text, metadata,
+         created_at, owner_email, org_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "published-chunk",
+        "published-item",
+        "published-version",
+        0,
+        "text",
+        "historical governed context evidence",
+        "{}",
+        "2026-07-16T00:00:00.000Z",
+        "alice@example.test",
+        "org-1",
+      ],
+    });
+    await exec.execute({
+      sql: `INSERT INTO creative_context_memberships
+        (id, context_id, artifact_key, published_item_id, published_item_version_id,
+         rank, status, created_at, updated_at, owner_email, org_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "removed-membership",
+        "context-owned",
+        "published-artifact",
+        "published-item",
+        "published-version",
+        "normal",
+        "removed",
+        "2026-07-16T00:00:00.000Z",
+        "2026-07-16T00:00:00.000Z",
+        "alice@example.test",
+        "org-1",
+      ],
+    });
+    await exec.execute({
+      sql: `INSERT INTO creative_context_published_snapshots
+        (id, context_id, source_id, membership_id, item_id, item_version_id,
+         submission_id, created_at, owner_email, org_id)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "published-snapshot",
+        "context-owned",
+        "context-published-source",
+        "removed-membership",
+        "published-item",
+        "published-version",
+        "approved-submission",
+        "2026-07-16T00:00:00.000Z",
+        "alice@example.test",
+        "org-1",
+      ],
+    });
+    const historicalPack = await asAlice(() =>
+      store.createContextPack({
+        name: "Historical governed replay",
+        baseContextId: "context-owned",
+        members: [
+          { itemId: "published-item", itemVersionId: "published-version" },
+        ],
+      }),
+    );
+    await exec.execute({
+      sql: `INSERT INTO creative_context_pack_shares
+        (id, resource_id, principal_type, principal_id, role, created_by, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      args: [
+        "historical-pack-share",
+        historicalPack.id,
+        "user",
+        "bob@example.test",
+        "viewer",
+        "alice@example.test",
+        "2026-07-16T00:00:00.000Z",
+      ],
+    });
+    await expect(
+      asBob(() => store.getContextPack(historicalPack.id)),
+    ).resolves.toMatchObject({
+      members: [
+        expect.objectContaining({
+          itemId: "published-item",
+          itemVersionId: "published-version",
+        }),
+      ],
+    });
+    await expect(
+      asBob(() =>
+        store.getCreativeContextItem("published-item", "published-version"),
+      ),
+    ).resolves.toMatchObject({
+      version: { id: "published-version" },
+    });
+    await expect(
+      asBob(() =>
+        store.listAccessibleLexicalCandidates({
+          query: "historical governed",
+          packId: historicalPack.id,
+          limit: 10,
+        }),
+      ),
+    ).resolves.toMatchObject({
+      results: [
+        expect.objectContaining({ itemVersionId: "published-version" }),
+      ],
+    });
+  });
+  it("legal purge follows provenance into staged and context-owned copies", async () => {
+    const { exec, runWithRequestContext, store } = await setup();
+    const asAlice = <T>(fn: () => Promise<T>) =>
+      runWithRequestContext(
+        { userEmail: "alice@example.test", orgId: "org-1" },
+        fn,
+      );
+    const context = await asAlice(() =>
+      store.createCreativeContext({
+        name: "Purge provenance",
+        kind: "specialty",
+        approvalPolicy: "open",
+      }),
+    );
+    const submitted = await asAlice(() =>
+      store.manageContextMembership({
+        operation: "submit",
+        contextId: context!.id,
+        itemId: "allowed",
+        confirmBroaderPublication: true,
+      }),
+    );
+    const membership = (
+      await asAlice(() =>
+        store.listContextMemberships({ contextId: context!.id, limit: 10 }),
+      )
+    ).memberships[0]!;
+    await asAlice(() =>
+      store.createContextPack({
+        name: "Published snapshot receipt",
+        members: [
+          {
+            itemId: membership.publishedItemId!,
+            itemVersionId: membership.publishedItemVersionId!,
+          },
+        ],
+      }),
+    );
+    await expect(
+      asAlice(() => store.purgeContextSourceArtifacts("source-1")),
+    ).resolves.toMatchObject({ sourceId: "source-1" });
+    const membershipRows = await exec.execute({
+      sql: `SELECT status, published_item_id, published_item_version_id,
+        pending_submission_id FROM creative_context_memberships WHERE id = ?`,
+      args: [submitted.membershipId],
+    });
+    expect(membershipRows.rows[0]).toMatchObject({
+      status: "removed",
+      published_item_id: null,
+      published_item_version_id: null,
+      pending_submission_id: null,
+    });
+    for (const table of [
+      "creative_context_submissions",
+      "creative_context_published_snapshots",
+    ]) {
+      const rows = await exec.execute({
+        sql: `SELECT id FROM ${table} WHERE context_id = ?`,
+        args: [context!.id],
+      });
+      expect(rows.rows).toEqual([]);
+    }
+    const copiedItems = await exec.execute({
+      sql: `SELECT id FROM creative_context_items
+        WHERE id = ? OR source_id IN (
+          SELECT staging_source_id FROM creative_contexts WHERE id = ?
+          UNION
+          SELECT published_source_id FROM creative_contexts WHERE id = ?
+        )`,
+      args: [membership.publishedItemId, context!.id, context!.id],
+    });
+    expect(copiedItems.rows).toEqual([]);
+  });
   it("allows explicit deprecated search without making removed items retrievable", async () => {
     const { exec, runWithRequestContext, store } = await setup();
     await exec.execute(