@agent-native/creative-context 0.3.0 → 0.5.0

package/src/store/index.ts

@@ -1,5 +1,6 @@
 export * from "./brand.js";
 export * from "./content.js";
+export * from "./contexts.js";
 export * from "./generation.js";
 export * from "./inference.js";
 export * from "./jobs.js";

package/src/store/packs.ts

@@ -3,9 +3,20 @@ import {
   assertAccess,
   resolveAccess,
 } from "@agent-native/core/sharing";
-import { and, asc, eq, gt, inArray, isNull, ne } from "drizzle-orm";
+import {
+  and,
+  asc,
+  eq,
+  gt,
+  inArray,
+  isNotNull,
+  isNull,
+  ne,
+  or,
+} from "drizzle-orm";
 
 import { getCreativeContext } from "../server/context.js";
+import { sanitizePublicMetadata } from "../server/public-serialization.js";
 import type {
   ContextPackDetail,
   ContextPackMember,
@@ -20,6 +31,16 @@ import {
   stringifyJson,
 } from "./helpers.js";
 
+type ResolvedPackMember = {
+  itemId: string;
+  itemVersionId: string;
+  reason?: string;
+  score?: number;
+  scoreMetadata?: Record<string, unknown>;
+};
+
+const MAX_NATIVE_PACK_DEPENDENCIES = 256;
+
 export function assertImmutablePackMembership(operation: string): never {
   throw new Error(
     `Context-pack membership is append-only; ${operation} must derive a new pack snapshot`,
@@ -48,15 +69,9 @@ async function resolveBrandDnaVersion(
   return dnaVersionId;
 }
 
-async function resolveMembers(members: ContextPackMemberInput[]): Promise<
-  Array<{
-    itemId: string;
-    itemVersionId: string;
-    reason?: string;
-    score?: number;
-    scoreMetadata?: Record<string, unknown>;
-  }>
-> {
+async function resolveMembers(
+  members: ContextPackMemberInput[],
+): Promise<ResolvedPackMember[]> {
   const { getDb, schema } = getCreativeContext();
   const itemIds = members.map((member) => member.itemId);
   if (new Set(itemIds).size !== itemIds.length) {
@@ -73,12 +88,34 @@ async function resolveMembers(members: ContextPackMemberInput[]): Promise<
       schema.contextSources,
       eq(schema.contextSources.id, schema.contextItems.sourceId),
     )
+    .leftJoin(
+      schema.creativeContextMemberships,
+      and(
+        eq(
+          schema.creativeContextMemberships.publishedItemId,
+          schema.contextItems.id,
+        ),
+        eq(schema.creativeContextMemberships.status, "active"),
+      ),
+    )
+    .leftJoin(
+      schema.creativeContexts,
+      eq(
+        schema.creativeContexts.id,
+        schema.creativeContextMemberships.contextId,
+      ),
+    )
     .where(
       and(
         inArray(schema.contextItems.id, itemIds),
-        accessFilter(schema.contextSources, schema.contextSourceShares),
-        ne(schema.contextSources.upstreamAccess, "restricted"),
-        ne(schema.contextSources.status, "archived"),
+        or(
+          and(
+            accessFilter(schema.contextSources, schema.contextSourceShares),
+            ne(schema.contextSources.upstreamAccess, "restricted"),
+            ne(schema.contextSources.status, "archived"),
+          ),
+          accessFilter(schema.creativeContexts, schema.creativeContextShares),
+        ),
         eq(schema.contextItems.curationStatus, "included"),
         ne(schema.contextItems.curationRank, "ignored"),
         eq(schema.contextItems.status, "active"),
@@ -130,12 +167,140 @@ async function resolveMembers(members: ContextPackMemberInput[]): Promise<
   });
 }
 
+async function includeNativeArtifactDependencies(
+  explicitMembers: ResolvedPackMember[],
+): Promise<ResolvedPackMember[]> {
+  if (!explicitMembers.length) return explicitMembers;
+  const { getDb, schema } = getCreativeContext();
+  const members = [...explicitMembers];
+  const byItemId = new Map(members.map((member) => [member.itemId, member]));
+  const sourceByVersion = new Map<string, string>();
+  const initialItems = await getDb()
+    .select({
+      itemId: schema.contextItems.id,
+      itemVersionId: schema.contextItemVersions.id,
+      sourceId: schema.contextItems.sourceId,
+    })
+    .from(schema.contextItemVersions)
+    .innerJoin(
+      schema.contextItems,
+      eq(schema.contextItems.id, schema.contextItemVersions.itemId),
+    )
+    .where(
+      inArray(
+        schema.contextItemVersions.id,
+        explicitMembers.map((member) => member.itemVersionId),
+      ),
+    );
+  for (const item of initialItems as Array<{
+    itemId: string;
+    itemVersionId: string;
+    sourceId: string;
+  }>) {
+    sourceByVersion.set(item.itemVersionId, item.sourceId);
+  }
+
+  let frontier = explicitMembers.map((member) => member.itemVersionId);
+  let dependencyCount = 0;
+  while (frontier.length) {
+    const edges = await getDb()
+      .select({
+        fromItemVersionId: schema.contextEdges.fromItemVersionId,
+        toItemId: schema.contextEdges.toItemId,
+        toItemVersionId: schema.contextEdges.toItemVersionId,
+        toExternalId: schema.contextEdges.toExternalId,
+        childSourceId: schema.contextItems.sourceId,
+        childVersionId: schema.contextItemVersions.id,
+      })
+      .from(schema.contextEdges)
+      .leftJoin(
+        schema.contextItems,
+        eq(schema.contextItems.id, schema.contextEdges.toItemId),
+      )
+      .leftJoin(
+        schema.contextItemVersions,
+        and(
+          eq(
+            schema.contextItemVersions.id,
+            schema.contextEdges.toItemVersionId,
+          ),
+          eq(schema.contextItemVersions.itemId, schema.contextEdges.toItemId),
+        ),
+      )
+      .where(
+        and(
+          inArray(schema.contextEdges.fromItemVersionId, frontier),
+          eq(schema.contextEdges.relation, "contains-native-child"),
+        ),
+      )
+      .orderBy(
+        asc(schema.contextEdges.fromItemVersionId),
+        asc(schema.contextEdges.toExternalId),
+      );
+    const next: string[] = [];
+    for (const edge of edges as Array<{
+      fromItemVersionId: string;
+      toItemId: string | null;
+      toItemVersionId: string | null;
+      toExternalId: string | null;
+      childSourceId: string | null;
+      childVersionId: string | null;
+    }>) {
+      if (
+        !edge.toItemId ||
+        !edge.toItemVersionId ||
+        !edge.childSourceId ||
+        !edge.childVersionId
+      ) {
+        throw new Error(
+          `Native artifact child ${edge.toExternalId ?? "(unknown)"} has no immutable version reference`,
+        );
+      }
+      const parentSourceId = sourceByVersion.get(edge.fromItemVersionId);
+      if (!parentSourceId || parentSourceId !== edge.childSourceId) {
+        throw new Error(
+          "Native artifact dependencies must stay within the pinned source snapshot",
+        );
+      }
+      const existing = byItemId.get(edge.toItemId);
+      if (existing) {
+        if (existing.itemVersionId !== edge.toItemVersionId) {
+          throw new Error(
+            "A native artifact dependency conflicts with an explicitly pinned item version",
+          );
+        }
+        continue;
+      }
+      dependencyCount += 1;
+      if (dependencyCount > MAX_NATIVE_PACK_DEPENDENCIES) {
+        throw new Error(
+          "Native artifact pack dependencies exceed the safe limit",
+        );
+      }
+      const dependency: ResolvedPackMember = {
+        itemId: edge.toItemId,
+        itemVersionId: edge.toItemVersionId,
+        reason: "Native artifact dependency",
+      };
+      members.push(dependency);
+      byItemId.set(dependency.itemId, dependency);
+      sourceByVersion.set(dependency.itemVersionId, edge.childSourceId);
+      next.push(dependency.itemVersionId);
+    }
+    frontier = [...new Set(next)];
+  }
+  return members;
+}
+
 export async function createContextPack(input: {
   name: string;
   description?: string | null;
   derivedFromPackId?: string;
   brandDnaVersionId?: string | null;
   contextMode?: string;
+  baseContextId?: string | null;
+  specialtyContextId?: string | null;
+  selectionReason?: string | null;
   request?: Record<string, unknown>;
   members: ContextPackMemberInput[];
   pinned?: boolean;
@@ -144,10 +309,12 @@ export async function createContextPack(input: {
   const actor = requireActor();
   const timestamp = nowIso();
   const id = newId("ccp");
-  const [resolvedMembers, brandDnaVersionId] = await Promise.all([
+  const [explicitMembers, brandDnaVersionId] = await Promise.all([
     resolveMembers(input.members),
     resolveBrandDnaVersion(input.brandDnaVersionId),
   ]);
+  const resolvedMembers =
+    await includeNativeArtifactDependencies(explicitMembers);
   if (input.derivedFromPackId) {
     await assertAccess(
       "creative-context-pack",
@@ -157,6 +324,18 @@ export async function createContextPack(input: {
       { skipResourceBody: true },
     );
   }
+  const contextAccess = input.baseContextId
+    ? await resolveAccess("creative-context", input.baseContextId)
+    : null;
+  if (input.baseContextId && !contextAccess) {
+    throw new Error("Base Creative Context not found or not accessible");
+  }
+  const inheritedShares = input.baseContextId
+    ? await getDb()
+        .select()
+        .from(schema.creativeContextShares)
+        .where(eq(schema.creativeContextShares.resourceId, input.baseContextId))
+    : [];
   await getDb().transaction(async (tx: any) => {
     await tx.insert(schema.contextPacks).values({
       id,
@@ -165,11 +344,14 @@ export async function createContextPack(input: {
       derivedFromPackId: input.derivedFromPackId ?? null,
       brandDnaVersionId,
       contextMode: input.contextMode ?? "manual",
+      baseContextId: input.baseContextId ?? null,
+      specialtyContextId: input.specialtyContextId ?? null,
+      selectionReason: input.selectionReason ?? null,
       request: stringifyJson(input.request),
       archivedAt: null,
       ownerEmail: actor.ownerEmail,
       orgId: actor.orgId,
-      visibility: "private",
+      visibility: contextAccess?.resource.visibility ?? "private",
       createdAt: timestamp,
     });
     if (resolvedMembers.length) {
@@ -189,6 +371,19 @@ export async function createContextPack(input: {
         })),
       );
     }
+    if (inheritedShares.length) {
+      await tx.insert(schema.contextPackShares).values(
+        (inheritedShares as any[]).map((share) => ({
+          id: newId("ccpsh"),
+          resourceId: id,
+          principalType: share.principalType,
+          principalId: share.principalId,
+          role: share.role,
+          createdBy: actor.ownerEmail,
+          createdAt: timestamp,
+        })),
+      );
+    }
     if (input.pinned) {
       await tx.insert(schema.contextPackPins).values({
         id: newId("ccpp"),
@@ -241,6 +436,9 @@ export async function deriveContextPack(input: {
         ? base.brandDnaVersionId
         : input.brandDnaVersionId,
     contextMode: base.contextMode,
+    baseContextId: base.baseContextId,
+    specialtyContextId: base.specialtyContextId,
+    selectionReason: base.selectionReason,
     request: base.request,
     members: Array.from(members.values()),
     pinned: input.pinned,
@@ -338,12 +536,37 @@ export async function listContextPacks(input: {
             schema.contextSources,
             eq(schema.contextSources.id, schema.contextItems.sourceId),
           )
+          .leftJoin(
+            schema.creativeContextPublishedSnapshots,
+            and(
+              eq(
+                schema.creativeContextPublishedSnapshots.itemId,
+                schema.contextPackMembers.itemId,
+              ),
+              eq(
+                schema.creativeContextPublishedSnapshots.itemVersionId,
+                schema.contextPackMembers.itemVersionId,
+              ),
+              eq(
+                schema.creativeContextPublishedSnapshots.sourceId,
+                schema.contextItems.sourceId,
+              ),
+            ),
+          )
           .where(
             and(
               inArray(schema.contextPackMembers.packId, ids),
-              accessFilter(schema.contextSources, schema.contextSourceShares),
-              ne(schema.contextSources.upstreamAccess, "restricted"),
-              ne(schema.contextSources.status, "archived"),
+              or(
+                and(
+                  accessFilter(
+                    schema.contextSources,
+                    schema.contextSourceShares,
+                  ),
+                  ne(schema.contextSources.upstreamAccess, "restricted"),
+                  ne(schema.contextSources.status, "archived"),
+                ),
+                isNotNull(schema.creativeContextPublishedSnapshots.id),
+              ),
               eq(schema.contextItems.curationStatus, "included"),
               ne(schema.contextItems.curationRank, "ignored"),
               eq(schema.contextItems.status, "active"),
@@ -375,7 +598,11 @@ export async function listContextPacks(input: {
       derivedFromPackId: row.derivedFromPackId ?? null,
       brandDnaVersionId: row.brandDnaVersionId ?? null,
       contextMode: row.contextMode,
-      request: parseJson(row.request, {}),
+      baseContextId: row.baseContextId ?? null,
+      specialtyContextId: row.specialtyContextId ?? null,
+      selectionReason: row.selectionReason ?? null,
+      request: (sanitizePublicMetadata(parseJson(row.request, {})) ??
+        {}) as Record<string, unknown>,
       memberCount: memberCount.get(row.id) ?? 0,
       pinned: pinned.has(row.id),
       archivedAt: row.archivedAt ?? null,
@@ -414,12 +641,34 @@ export async function getContextPack(
         schema.contextSources,
         eq(schema.contextSources.id, schema.contextItems.sourceId),
       )
+      .leftJoin(
+        schema.creativeContextPublishedSnapshots,
+        and(
+          eq(
+            schema.creativeContextPublishedSnapshots.itemId,
+            schema.contextPackMembers.itemId,
+          ),
+          eq(
+            schema.creativeContextPublishedSnapshots.itemVersionId,
+            schema.contextPackMembers.itemVersionId,
+          ),
+          eq(
+            schema.creativeContextPublishedSnapshots.sourceId,
+            schema.contextItems.sourceId,
+          ),
+        ),
+      )
       .where(
         and(
           eq(schema.contextPackMembers.packId, packId),
-          accessFilter(schema.contextSources, schema.contextSourceShares),
-          ne(schema.contextSources.upstreamAccess, "restricted"),
-          ne(schema.contextSources.status, "archived"),
+          or(
+            and(
+              accessFilter(schema.contextSources, schema.contextSourceShares),
+              ne(schema.contextSources.upstreamAccess, "restricted"),
+              ne(schema.contextSources.status, "archived"),
+            ),
+            isNotNull(schema.creativeContextPublishedSnapshots.id),
+          ),
           eq(schema.contextItems.curationStatus, "included"),
           ne(schema.contextItems.curationRank, "ignored"),
           eq(schema.contextItems.status, "active"),
@@ -446,7 +695,9 @@ export async function getContextPack(
     ordinal: member.ordinal,
     reason: member.reason ?? null,
     score: member.score ?? null,
-    scoreMetadata: parseJson(member.scoreMetadata, {}),
+    scoreMetadata: (sanitizePublicMetadata(
+      parseJson(member.scoreMetadata, {}),
+    ) ?? {}) as Record<string, unknown>,
   }));
   return {
     id: row.id,
@@ -455,7 +706,11 @@ export async function getContextPack(
     derivedFromPackId: row.derivedFromPackId ?? null,
     brandDnaVersionId: row.brandDnaVersionId ?? null,
     contextMode: row.contextMode,
-    request: parseJson(row.request, {}),
+    baseContextId: row.baseContextId ?? null,
+    specialtyContextId: row.specialtyContextId ?? null,
+    selectionReason: row.selectionReason ?? null,
+    request: (sanitizePublicMetadata(parseJson(row.request, {})) ??
+      {}) as Record<string, unknown>,
     memberCount: members.length,
     pinned: Boolean(pinRows[0]),
     archivedAt: row.archivedAt ?? null,

package/src/store/purge.ts

@@ -5,7 +5,7 @@ import {
   sharedResourceOwner,
 } from "@agent-native/core/resources/store";
 import { accessFilter, assertAccess } from "@agent-native/core/sharing";
-import { and, eq, inArray, or } from "drizzle-orm";
+import { and, eq, inArray, like, or } from "drizzle-orm";
 
 import { parsePrivateBlobHandle } from "../connectors/private-artifacts.js";
 import { deletePostgresFtsDocuments } from "../search/postgres-fts.js";
@@ -29,12 +29,75 @@ export async function purgeContextSourceArtifacts(sourceId: string) {
     .limit(1);
   const source = sourceRows[0];
   if (!source) throw new Error("Creative context source not found");
-  const items = await getDb()
+  const originalItems = await getDb()
     .select({ id: schema.contextItems.id })
     .from(schema.contextItems)
     .where(eq(schema.contextItems.sourceId, sourceId));
+  const derivedSubmissions = await getDb()
+    .select({
+      id: schema.creativeContextSubmissions.id,
+      membershipId: schema.creativeContextSubmissions.membershipId,
+      stagingItemId: schema.creativeContextSubmissions.stagingItemId,
+      publishedItemId: schema.creativeContextSubmissions.publishedItemId,
+      privateMetadata: schema.creativeContextSubmissions.privateMetadata,
+    })
+    .from(schema.creativeContextSubmissions)
+    .where(
+      like(schema.creativeContextSubmissions.artifactKey, `${sourceId}:%`),
+    );
+  const derivedSubmissionIds = derivedSubmissions.map((row: any) =>
+    String(row.id),
+  );
+  const publishedCopies = derivedSubmissionIds.length
+    ? await getDb()
+        .select({ itemId: schema.creativeContextPublishedSnapshots.itemId })
+        .from(schema.creativeContextPublishedSnapshots)
+        .where(
+          inArray(
+            schema.creativeContextPublishedSnapshots.submissionId,
+            derivedSubmissionIds,
+          ),
+        )
+    : [];
+  const stagedChildIds = derivedSubmissions.flatMap((row: any) => {
+    const metadata = parseJson<Record<string, unknown>>(
+      row.privateMetadata,
+      {},
+    );
+    return Array.isArray(metadata.stagedChildren)
+      ? metadata.stagedChildren.flatMap((child) =>
+          child &&
+          typeof child === "object" &&
+          typeof (child as { itemId?: unknown }).itemId === "string"
+            ? [(child as { itemId: string }).itemId]
+            : [],
+        )
+      : [];
+  });
+  const candidateItemIds = [
+    ...originalItems.map((item: any) => String(item.id)),
+    ...derivedSubmissions.flatMap((row: any) =>
+      [row.stagingItemId, row.publishedItemId].filter(
+        (value): value is string => typeof value === "string",
+      ),
+    ),
+    ...publishedCopies.map((row: any) => String(row.itemId)),
+    ...stagedChildIds,
+  ];
+  const items = candidateItemIds.length
+    ? await getDb()
+        .select({
+          id: schema.contextItems.id,
+          sourceId: schema.contextItems.sourceId,
+        })
+        .from(schema.contextItems)
+        .where(inArray(schema.contextItems.id, [...new Set(candidateItemIds)]))
+    : [];
   const itemIds = items.map((item: any) => item.id as string);
   if (!itemIds.length) return { sourceId, purgedItems: 0, purgedBlobs: 0 };
+  const affectedSourceIds = [
+    ...new Set([sourceId, ...items.map((item: any) => String(item.sourceId))]),
+  ];
   const versions = await getDb()
     .select({
       id: schema.contextItemVersions.id,
@@ -43,6 +106,16 @@ export async function purgeContextSourceArtifacts(sourceId: string) {
     .from(schema.contextItemVersions)
     .where(inArray(schema.contextItemVersions.itemId, itemIds));
   const versionIds = versions.map((version: any) => version.id as string);
+  const referencedMemberships = await getDb()
+    .select({ id: schema.creativeContextMemberships.id })
+    .from(schema.creativeContextMemberships)
+    .where(inArray(schema.creativeContextMemberships.publishedItemId, itemIds));
+  const affectedMembershipIds = [
+    ...new Set([
+      ...referencedMemberships.map((row: any) => String(row.id)),
+      ...derivedSubmissions.map((row: any) => String(row.membershipId)),
+    ]),
+  ];
   const [
     chunks,
     media,
@@ -140,10 +213,24 @@ export async function purgeContextSourceArtifacts(sourceId: string) {
   for (const layout of promotedLayouts) {
     await projections?.layoutTemplate?.demote(layout);
   }
+  const cloneBlobRefs = derivedSubmissions.flatMap((row: any) => {
+    const metadata = parseJson<Record<string, unknown>>(
+      row.privateMetadata,
+      {},
+    );
+    const clone =
+      metadata.clone &&
+      typeof metadata.clone === "object" &&
+      !Array.isArray(metadata.clone)
+        ? (metadata.clone as Record<string, unknown>)
+        : null;
+    return clone?.handle ? [clone.handle] : [];
+  });
   let purgedBlobs = 0;
   for (const reference of [
     ...versions.map((version: any) => version.rawSnapshotBlobRef),
     ...media.map((entry: any) => entry.storageKey),
+    ...cloneBlobRefs,
   ]) {
     const handle = parsePrivateBlobHandle(reference);
     if (!handle) continue;
@@ -161,6 +248,40 @@ export async function purgeContextSourceArtifacts(sourceId: string) {
     chunks.map((chunk: any) => chunk.id),
   ).catch(() => 0);
   await getDb().transaction(async (tx: any) => {
+    if (affectedMembershipIds.length) {
+      await tx
+        .update(schema.creativeContextMemberships)
+        .set({
+          publishedItemId: null,
+          publishedItemVersionId: null,
+          pendingSubmissionId: null,
+          status: "removed",
+          updatedAt: nowIso(),
+        })
+        .where(
+          inArray(schema.creativeContextMemberships.id, affectedMembershipIds),
+        );
+    }
+    await tx
+      .delete(schema.creativeContextPublishedSnapshots)
+      .where(
+        derivedSubmissionIds.length
+          ? or(
+              inArray(schema.creativeContextPublishedSnapshots.itemId, itemIds),
+              inArray(
+                schema.creativeContextPublishedSnapshots.submissionId,
+                derivedSubmissionIds,
+              ),
+            )
+          : inArray(schema.creativeContextPublishedSnapshots.itemId, itemIds),
+      );
+    if (derivedSubmissionIds.length) {
+      await tx
+        .delete(schema.creativeContextSubmissions)
+        .where(
+          inArray(schema.creativeContextSubmissions.id, derivedSubmissionIds),
+        );
+    }
     if (derivedEdges.length) {
       await tx
         .update(schema.contextItems)
@@ -266,11 +387,23 @@ export async function purgeContextSourceArtifacts(sourceId: string) {
     await tx
       .delete(schema.contextItems)
       .where(inArray(schema.contextItems.id, itemIds));
-    await tx
-      .update(schema.contextSources)
-      .set({ itemCount: 0, restrictedItemCount: 0, updatedAt: nowIso() })
-      .where(eq(schema.contextSources.id, sourceId));
   });
+  for (const affectedSourceId of affectedSourceIds) {
+    const remaining = await getDb()
+      .select({ upstreamAccess: schema.contextItems.upstreamAccess })
+      .from(schema.contextItems)
+      .where(eq(schema.contextItems.sourceId, affectedSourceId));
+    await getDb()
+      .update(schema.contextSources)
+      .set({
+        itemCount: remaining.length,
+        restrictedItemCount: remaining.filter(
+          (item: any) => item.upstreamAccess !== "available",
+        ).length,
+        updatedAt: nowIso(),
+      })
+      .where(eq(schema.contextSources.id, affectedSourceId));
+  }
   const profileIds = [
     ...new Set(affectedProfiles.map((row: any) => row.profileId as string)),
   ];

package/src/store/sources.ts

@@ -1,4 +1,4 @@
-import { getDbExec } from "@agent-native/core/db";
+import { currentRequestUserIsOrgAdmin } from "@agent-native/core/server";
 import {
   accessFilter,
   assertAccess,
@@ -580,22 +580,6 @@ export async function contextSourceBoundary(input: {
   };
 }
 
-async function currentUserIsOrgAdmin(
-  orgId: string,
-  ownerEmail: string,
-): Promise<boolean> {
-  try {
-    const result = await getDbExec().execute({
-      sql: "SELECT role FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1",
-      args: [orgId, ownerEmail.toLowerCase()],
-    });
-    const role = String(result.rows[0]?.role ?? "").toLowerCase();
-    return role === "owner" || role === "admin";
-  } catch {
-    return false;
-  }
-}
-
 export async function previewContextSourcePromotion(
   sourceId: string,
 ): Promise<ContextSourcePromotionPreview> {
@@ -608,7 +592,7 @@ export async function previewContextSourcePromotion(
   if (!actor.orgId) {
     throw new Error("Select an organization before promoting a context source");
   }
-  const orgAdmin = await currentUserIsOrgAdmin(actor.orgId, actor.ownerEmail);
+  const orgAdmin = await currentRequestUserIsOrgAdmin(actor.orgId);
   const verifiedOwner =
     access.role === "owner" &&
     Boolean(access.resource.containerOwnerVerifiedAt);

package/src/store/suggestions.ts

@@ -5,6 +5,7 @@ import { assertContextItemSqlTextLimits } from "../connectors/normalize.js";
 import { reassembleNativeCreativeArtifact } from "../native-artifact-reassembly.js";
 import { nativeCreativeArtifactFromMetadata } from "../native-artifact.js";
 import { getCreativeContext } from "../server/context.js";
+import { sanitizePublicMetadata } from "../server/public-serialization.js";
 import type { CreativeContextSuggestion } from "../types.js";
 import {
   getCreativeContextItem,
@@ -30,7 +31,8 @@ function mapSuggestion(row: any): CreativeContextSuggestion {
     itemId: row.itemId,
     itemVersionId: row.itemVersionId,
     reason: row.reason ?? null,
-    payload: parseJson(row.payload, {}),
+    payload: (sanitizePublicMetadata(parseJson(row.payload, {})) ??
+      {}) as Record<string, unknown>,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
   };