@agent-native/creative-context 0.4.0 → 0.5.1

package/src/client/index.ts

@@ -1,6 +1,11 @@
 export {
   CREATIVE_CONTEXT_ACTIONS,
+  parseContextMemberships,
+  parseContextMembershipsForResource,
+  parseCreativeContexts,
+  useContextMemberships,
   useCreativeContextBrandProfile,
+  useCreativeContexts,
   useCreativeContextGooglePickerSession,
   useCreativeContextImportStatus,
   useCreativeContextPack,
@@ -8,16 +13,30 @@ export {
   useCreativeContextSearch,
   useCreativeContextSources,
   useManageCreativeContextSource,
+  useManageCreativeContext,
+  useManageContextMembership,
   usePreviewCreativeContextImport,
   usePublishCreativeContextBrandDna,
   useRefreshCreativeContextSource,
   useReviewCreativeContextItems,
   useStartCreativeContextImport,
   type GetBrandProfileResult,
+  type CreativeContextMembership,
+  type CreativeContextMembershipRank,
+  type CreativeContextPolicy,
+  type CreativeContextSummary,
   type GetContextImportStatusResult,
   type GetContextPackResult,
   type GetGooglePickerSessionResult,
   type ListContextPacksResult,
+  type ListContextMembershipsParams,
+  type ListContextMembershipsResult,
+  type ListCreativeContextsParams,
+  type ListCreativeContextsResult,
+  type ManageContextMembershipParams,
+  type ManageContextMembershipResult,
+  type ManageCreativeContextParams,
+  type ManageCreativeContextResult,
   type ListContextSourcesParams,
   type ListContextSourcesResult,
   type ManageContextSourceParams,
@@ -38,6 +57,7 @@ export {
   normalizeCreativeContextState,
   readCreativeContextState,
   setCreativeContextMode,
+  setSelectedCreativeContext,
   setCreativeContextState,
   setPinnedCreativeContextPack,
   useCreativeContextState,
@@ -47,12 +67,25 @@ export {
 export {
   CreativeContextChip,
   CreativeContextComposerChip,
+  resolveCreativeContextChipSelection,
   type CreativeContextChipProps,
+  type CreativeContextChipSelection,
 } from "./CreativeContextChip.js";
 export {
   CreativeContextPanel,
   type CreativeContextPanelProps,
 } from "./CreativeContextPanel.js";
+export {
+  CreativeContextShareSheet,
+  CreativeContextShareTab,
+  creativeContextSafePreviewUrl,
+  normalizeCreativeContextResources,
+  requiresBroaderPublication,
+  submitCreativeContextResources,
+  type CreativeContextResourceDescriptor,
+  type CreativeContextResourcePreview,
+  type CreativeContextShareTabProps,
+} from "./CreativeContextShareTab.js";
 export { CreativeContextSettingsLink } from "./CreativeContextSettingsLink.js";
 export {
   createCreativeContextAgentTab,

package/src/client/messages.ts

@@ -53,6 +53,7 @@ export type CreativeContextMessageKey =
   | "personal"
   | "organization"
   | "addSource"
+  | "addToContext"
   | "sourceName"
   | "sourceReference"
   | "preview"
@@ -74,6 +75,12 @@ export type CreativeContextMessageKey =
   | "influence"
   | "cancel"
   | "saveFailed"
+  | "updateAvailable"
+  | "submitUpdate"
+  | "submittingUpdate"
+  | "submitUpdateTitle"
+  | "submitUpdateDescription"
+  | "submitUpdateFailed"
   | "chooseFiles"
   | "chooseFolder"
   | "dropFiles"
@@ -162,6 +169,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "Personal",
     organization: "Organization",
     addSource: "Add a source",
+    addToContext: "Add to context…",
     sourceName: "Source name",
     sourceReference: "Source reference",
     preview: "Preview",
@@ -183,6 +191,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "Influence",
     cancel: "Close",
     saveFailed: "Could not save these changes.",
+    updateAvailable: "Update available",
+    submitUpdate: "Submit update",
+    submittingUpdate: "Submitting…",
+    submitUpdateTitle: "Submit the latest version?",
+    submitUpdateDescription:
+      'Capture the current version of "{{name}}" and send it through this context’s approval policy. This may publish it to a broader audience.',
+    submitUpdateFailed: "Could not submit the latest version.",
     chooseFiles: "Choose files",
     chooseFolder: "Choose folder",
     dropFiles: "Drop PPTX, DOCX, PDF, or image files here.",
@@ -263,6 +278,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "個人",
     organization: "組織",
     addSource: "新增來源",
+    addToContext: "新增至脈絡…",
     sourceName: "來源名稱",
     sourceReference: "來源參考",
     preview: "預覽",
@@ -284,6 +300,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "影響",
     cancel: "關閉",
     saveFailed: "無法儲存這些變更。",
+    updateAvailable: "有可用更新",
+    submitUpdate: "提交更新",
+    submittingUpdate: "提交中…",
+    submitUpdateTitle: "提交最新版本？",
+    submitUpdateDescription:
+      "擷取「{{name}}」的目前版本，並依此內容環境的核准政策提交。這可能會將其發布給更廣泛的對象。",
+    submitUpdateFailed: "無法提交最新版本。",
     chooseFiles: "選擇檔案",
     chooseFolder: "選擇資料夾",
     dropFiles: "將 PPTX、DOCX、PDF 或圖片檔案拖放到這裡。",
@@ -362,6 +385,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "个人",
     organization: "组织",
     addSource: "添加来源",
+    addToContext: "添加到上下文…",
     sourceName: "来源名称",
     sourceReference: "来源引用",
     preview: "预览",
@@ -383,6 +407,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "影响",
     cancel: "关闭",
     saveFailed: "无法保存这些更改。",
+    updateAvailable: "有可用更新",
+    submitUpdate: "提交更新",
+    submittingUpdate: "正在提交…",
+    submitUpdateTitle: "提交最新版本？",
+    submitUpdateDescription:
+      "捕获“{{name}}”的当前版本，并按此上下文的审批策略提交。这可能会将其发布给更广泛的受众。",
+    submitUpdateFailed: "无法提交最新版本。",
     chooseFiles: "选择文件",
     chooseFolder: "选择文件夹",
     dropFiles: "将 PPTX、DOCX、PDF 或图片文件拖放到此处。",
@@ -467,6 +498,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "Personal",
     organization: "Organización",
     addSource: "Añadir una fuente",
+    addToContext: "Añadir al contexto…",
     sourceName: "Nombre de la fuente",
     sourceReference: "Referencia de la fuente",
     preview: "Vista previa",
@@ -488,6 +520,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "Influencia",
     cancel: "Cerrar",
     saveFailed: "No se pudieron guardar estos cambios.",
+    updateAvailable: "Actualización disponible",
+    submitUpdate: "Enviar actualización",
+    submittingUpdate: "Enviando…",
+    submitUpdateTitle: "¿Enviar la versión más reciente?",
+    submitUpdateDescription:
+      "Captura la versión actual de «{{name}}» y envíala mediante la política de aprobación de este contexto. Esto puede publicarla para una audiencia más amplia.",
+    submitUpdateFailed: "No se pudo enviar la versión más reciente.",
     chooseFiles: "Elegir archivos",
     chooseFolder: "Elegir carpeta",
     dropFiles: "Suelta aquí archivos PPTX, DOCX, PDF o imágenes.",
@@ -575,6 +614,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "Personnel",
     organization: "Organisation",
     addSource: "Ajouter une source",
+    addToContext: "Ajouter au contexte…",
     sourceName: "Nom de la source",
     sourceReference: "Référence de la source",
     preview: "Aperçu",
@@ -596,6 +636,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "Influence",
     cancel: "Fermer",
     saveFailed: "Impossible d’enregistrer ces modifications.",
+    updateAvailable: "Mise à jour disponible",
+    submitUpdate: "Envoyer la mise à jour",
+    submittingUpdate: "Envoi…",
+    submitUpdateTitle: "Envoyer la dernière version ?",
+    submitUpdateDescription:
+      "Capturez la version actuelle de « {{name}} » et soumettez-la à la politique d’approbation de ce contexte. Elle peut être publiée auprès d’un public plus large.",
+    submitUpdateFailed: "Impossible d’envoyer la dernière version.",
     chooseFiles: "Choisir des fichiers",
     chooseFolder: "Choisir un dossier",
     dropFiles: "Déposez ici des fichiers PPTX, DOCX, PDF ou image.",
@@ -683,6 +730,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "Persönlich",
     organization: "Organisation",
     addSource: "Quelle hinzufügen",
+    addToContext: "Zum Kontext hinzufügen…",
     sourceName: "Quellenname",
     sourceReference: "Quellenreferenz",
     preview: "Vorschau",
@@ -704,6 +752,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "Einfluss",
     cancel: "Schließen",
     saveFailed: "Diese Änderungen konnten nicht gespeichert werden.",
+    updateAvailable: "Aktualisierung verfügbar",
+    submitUpdate: "Aktualisierung einreichen",
+    submittingUpdate: "Wird eingereicht…",
+    submitUpdateTitle: "Neueste Version einreichen?",
+    submitUpdateDescription:
+      "Erfassen Sie die aktuelle Version von „{{name}}“ und reichen Sie sie gemäß der Freigaberichtlinie dieses Kontexts ein. Dadurch kann sie für ein größeres Publikum veröffentlicht werden.",
+    submitUpdateFailed: "Die neueste Version konnte nicht eingereicht werden.",
     chooseFiles: "Dateien auswählen",
     chooseFolder: "Ordner auswählen",
     dropFiles: "PPTX-, DOCX-, PDF- oder Bilddateien hier ablegen.",
@@ -791,6 +846,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "個人",
     organization: "組織",
     addSource: "ソースを追加",
+    addToContext: "コンテキストに追加…",
     sourceName: "ソース名",
     sourceReference: "ソース参照",
     preview: "プレビュー",
@@ -812,6 +868,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "影響",
     cancel: "閉じる",
     saveFailed: "変更を保存できませんでした。",
+    updateAvailable: "更新があります",
+    submitUpdate: "更新を送信",
+    submittingUpdate: "送信中…",
+    submitUpdateTitle: "最新バージョンを送信しますか？",
+    submitUpdateDescription:
+      "「{{name}}」の現在のバージョンを取得し、このコンテキストの承認ポリシーに従って送信します。より広い対象に公開される場合があります。",
+    submitUpdateFailed: "最新バージョンを送信できませんでした。",
     chooseFiles: "ファイルを選択",
     chooseFolder: "フォルダを選択",
     dropFiles: "PPTX、DOCX、PDF、画像ファイルをここにドロップします。",
@@ -898,6 +961,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "개인",
     organization: "조직",
     addSource: "소스 추가",
+    addToContext: "컨텍스트에 추가…",
     sourceName: "소스 이름",
     sourceReference: "소스 참조",
     preview: "미리보기",
@@ -919,6 +983,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "영향",
     cancel: "닫기",
     saveFailed: "변경 사항을 저장할 수 없습니다.",
+    updateAvailable: "업데이트 있음",
+    submitUpdate: "업데이트 제출",
+    submittingUpdate: "제출 중…",
+    submitUpdateTitle: "최신 버전을 제출할까요?",
+    submitUpdateDescription:
+      "“{{name}}”의 현재 버전을 캡처하여 이 컨텍스트의 승인 정책에 따라 제출합니다. 더 넓은 대상에게 게시될 수 있습니다.",
+    submitUpdateFailed: "최신 버전을 제출할 수 없습니다.",
     chooseFiles: "파일 선택",
     chooseFolder: "폴더 선택",
     dropFiles: "PPTX, DOCX, PDF 또는 이미지 파일을 여기에 놓으세요.",
@@ -1005,6 +1076,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "Pessoal",
     organization: "Organização",
     addSource: "Adicionar uma fonte",
+    addToContext: "Adicionar ao contexto…",
     sourceName: "Nome da fonte",
     sourceReference: "Referência da fonte",
     preview: "Prévia",
@@ -1026,6 +1098,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "Influência",
     cancel: "Fechar",
     saveFailed: "Não foi possível salvar estas alterações.",
+    updateAvailable: "Atualização disponível",
+    submitUpdate: "Enviar atualização",
+    submittingUpdate: "Enviando…",
+    submitUpdateTitle: "Enviar a versão mais recente?",
+    submitUpdateDescription:
+      "Capture a versão atual de “{{name}}” e envie-a pela política de aprovação deste contexto. Isso pode publicá-la para um público mais amplo.",
+    submitUpdateFailed: "Não foi possível enviar a versão mais recente.",
     chooseFiles: "Escolher arquivos",
     chooseFolder: "Escolher pasta",
     dropFiles: "Solte arquivos PPTX, DOCX, PDF ou imagens aqui.",
@@ -1109,6 +1188,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "व्यक्तिगत",
     organization: "संगठन",
     addSource: "स्रोत जोड़ें",
+    addToContext: "कॉन्टेक्स्ट में जोड़ें…",
     sourceName: "स्रोत का नाम",
     sourceReference: "स्रोत संदर्भ",
     preview: "पूर्वावलोकन",
@@ -1130,6 +1210,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "प्रभाव",
     cancel: "बंद करें",
     saveFailed: "इन बदलावों को सहेजा नहीं जा सका।",
+    updateAvailable: "अपडेट उपलब्ध है",
+    submitUpdate: "अपडेट सबमिट करें",
+    submittingUpdate: "सबमिट हो रहा है…",
+    submitUpdateTitle: "नवीनतम संस्करण सबमिट करें?",
+    submitUpdateDescription:
+      "“{{name}}” का मौजूदा संस्करण कैप्चर करके इस कॉन्टेक्स्ट की स्वीकृति नीति के अनुसार सबमिट करें। यह बड़े दर्शक वर्ग के लिए प्रकाशित हो सकता है।",
+    submitUpdateFailed: "नवीनतम संस्करण सबमिट नहीं किया जा सका।",
     chooseFiles: "फ़ाइलें चुनें",
     chooseFolder: "फ़ोल्डर चुनें",
     dropFiles: "PPTX, DOCX, PDF या इमेज फ़ाइलें यहाँ छोड़ें।",
@@ -1213,6 +1300,7 @@ export const creativeContextMessagesByLocale: Record<
     personal: "شخصي",
     organization: "المؤسسة",
     addSource: "إضافة مصدر",
+    addToContext: "إضافة إلى السياق…",
     sourceName: "اسم المصدر",
     sourceReference: "مرجع المصدر",
     preview: "معاينة",
@@ -1234,6 +1322,13 @@ export const creativeContextMessagesByLocale: Record<
     influence: "التأثير",
     cancel: "إغلاق",
     saveFailed: "تعذّر حفظ هذه التغييرات.",
+    updateAvailable: "يتوفر تحديث",
+    submitUpdate: "إرسال التحديث",
+    submittingUpdate: "جارٍ الإرسال…",
+    submitUpdateTitle: "إرسال أحدث إصدار؟",
+    submitUpdateDescription:
+      'التقط الإصدار الحالي من "{{name}}" وأرسله وفق سياسة الموافقة لهذا السياق. قد يؤدي ذلك إلى نشره لجمهور أوسع.',
+    submitUpdateFailed: "تعذّر إرسال أحدث إصدار.",
     chooseFiles: "اختيار ملفات",
     chooseFolder: "اختيار مجلد",
     dropFiles: "أفلت ملفات PPTX أو DOCX أو PDF أو الصور هنا.",

package/src/connectors/types.ts

@@ -5,16 +5,14 @@ import type {
 } from "@agent-native/core/private-blob";
 import type { ProviderApiRuntime } from "@agent-native/core/provider-api";
 
-import type { NormalizedContextItem, UpstreamAccess } from "../types.js";
+import type {
+  ContextSourceKind,
+  NormalizedContextItem,
+  UpstreamAccess,
+} from "../types.js";
 import type { RenderedPageProvider } from "./rendered-page.js";
 
-export type ContextConnectorKind =
-  | "manual"
-  | "upload"
-  | "google-slides"
-  | "figma"
-  | "notion"
-  | "website";
+export type ContextConnectorKind = Exclude<ContextSourceKind, "native-app">;
 
 export interface ContextConnectorInventoryItem {
   externalId: string;

package/src/eval/library-flow.acceptance.spec.tsx

@@ -131,6 +131,7 @@ describe("credential-free Library acceptance", () => {
       contextMode: "off",
       currentPackId: null,
       pinnedPackId: null,
+      selectedContextId: null,
     });
     const offMarkup = renderToStaticMarkup(
       <CreativeContextChip state={off} packs={[pack]} />,

package/src/schema/index.ts

@@ -293,6 +293,9 @@ export const contextPacks = table("creative_context_packs", {
   derivedFromPackId: text("derived_from_pack_id"),
   brandDnaVersionId: text("brand_dna_version_id"),
   contextMode: text("context_mode").notNull().default("manual"),
+  baseContextId: text("base_context_id"),
+  specialtyContextId: text("specialty_context_id"),
+  selectionReason: text("selection_reason"),
   request: text("request").notNull().default("{}"),
   archivedAt: text("archived_at"),
   createdAt: text("created_at").notNull(),
@@ -323,6 +326,119 @@ export const contextPackPins = table("creative_context_pack_pins", {
   ...scopedColumns(),
 });
 
+/** A governed, shareable collection of published creative artifacts. */
+export const creativeContexts = table("creative_contexts", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  description: text("description"),
+  kind: text("kind", { enum: ["default", "specialty"] }).notNull(),
+  defaultScopeKey: text("default_scope_key"),
+  brandProfileId: text("brand_profile_id"),
+  stagingSourceId: text("staging_source_id").notNull(),
+  // This source is owned by the context and is intentionally not a library source.
+  publishedSourceId: text("published_source_id").notNull(),
+  approvalPolicy: text("approval_policy", {
+    enum: ["open", "review", "admins-only"],
+  })
+    .notNull()
+    .default("open"),
+  archivedAt: text("archived_at"),
+  createdAt: text("created_at").notNull(),
+  updatedAt: text("updated_at").notNull(),
+  ...ownableColumns(),
+});
+
+export const creativeContextShares = createSharesTable(
+  "creative_context_shares",
+);
+
+export const creativeContextAudit = table("creative_context_audit", {
+  id: text("id").primaryKey(),
+  contextId: text("context_id").notNull(),
+  operation: text("operation").notNull(),
+  actorEmail: text("actor_email").notNull(),
+  details: text("details").notNull().default("{}"),
+  createdAt: text("created_at").notNull(),
+  ...scopedColumns(),
+});
+
+/** One stable row per context/artifact identity; published pointers are mutable. */
+export const creativeContextMemberships = table(
+  "creative_context_memberships",
+  {
+    id: text("id").primaryKey(),
+    contextId: text("context_id").notNull(),
+    artifactKey: text("artifact_key").notNull(),
+    publishedItemId: text("published_item_id"),
+    publishedItemVersionId: text("published_item_version_id"),
+    pendingSubmissionId: text("pending_submission_id"),
+    rank: text("rank", { enum: ["canonical", "exemplar", "normal"] })
+      .notNull()
+      .default("normal"),
+    purpose: text("purpose"),
+    status: text("status", { enum: ["active", "removed"] })
+      .notNull()
+      .default("active"),
+    createdAt: text("created_at").notNull(),
+    updatedAt: text("updated_at").notNull(),
+    ...scopedColumns(),
+  },
+);
+
+/** Submission rows track workflow state; immutable version pins and audit rows preserve evidence. */
+export const creativeContextSubmissions = table(
+  "creative_context_submissions",
+  {
+    id: text("id").primaryKey(),
+    contextId: text("context_id").notNull(),
+    membershipId: text("membership_id").notNull(),
+    artifactKey: text("artifact_key").notNull(),
+    stagingItemId: text("staging_item_id"),
+    stagingItemVersionId: text("staging_item_version_id"),
+    publishedItemId: text("published_item_id"),
+    publishedItemVersionId: text("published_item_version_id"),
+    note: text("note"),
+    privateMetadata: text("private_metadata").notNull().default("{}"),
+    status: text("status", {
+      enum: ["pending", "approved", "rejected", "withdrawn", "superseded"],
+    }).notNull(),
+    submittedBy: text("submitted_by").notNull(),
+    reviewedBy: text("reviewed_by"),
+    reviewNote: text("review_note"),
+    createdAt: text("created_at").notNull(),
+    reviewedAt: text("reviewed_at"),
+    ...scopedColumns(),
+  },
+);
+
+export const creativeContextAppBindings = table(
+  "creative_context_app_bindings",
+  {
+    id: text("id").primaryKey(),
+    appId: text("app_id").notNull(),
+    contextId: text("context_id").notNull(),
+    createdAt: text("created_at").notNull(),
+    updatedAt: text("updated_at").notNull(),
+    ...scopedColumns(),
+  },
+);
+
+/** Internal history of publish/materialization operations; never public API. */
+export const creativeContextPublishedSnapshots = table(
+  "creative_context_published_snapshots",
+  {
+    id: text("id").primaryKey(),
+    contextId: text("context_id").notNull(),
+    sourceId: text("source_id").notNull(),
+    membershipId: text("membership_id").notNull(),
+    itemId: text("item_id").notNull(),
+    itemVersionId: text("item_version_id").notNull(),
+    submissionId: text("submission_id").notNull(),
+    createdAt: text("created_at").notNull(),
+    ...scopedColumns(),
+  },
+);
+
 export const contextJobs = table("creative_context_jobs", {
   id: text("id").primaryKey(),
   dedupeKey: text("dedupe_key"),

package/src/schema/migrations.ts

@@ -255,4 +255,84 @@ export const creativeContextMigrations: CreativeContextMigration[] = [
         ON creative_context_jobs (dedupe_scope, scoped_dedupe_key);
     `,
   },
+  {
+    version: 6,
+    name: "creative-context-governed-collections",
+    sql: `
+      CREATE TABLE IF NOT EXISTS creative_contexts (
+        id TEXT PRIMARY KEY, name TEXT NOT NULL, description TEXT,
+        kind TEXT NOT NULL, brand_profile_id TEXT, staging_source_id TEXT NOT NULL, published_source_id TEXT NOT NULL,
+        approval_policy TEXT NOT NULL DEFAULT 'open', archived_at TEXT,
+        created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+        owner_email TEXT NOT NULL DEFAULT 'local@localhost', org_id TEXT,
+        visibility TEXT NOT NULL DEFAULT 'private'
+      );
+      CREATE TABLE IF NOT EXISTS creative_context_shares (
+        id TEXT PRIMARY KEY, resource_id TEXT NOT NULL, principal_type TEXT NOT NULL,
+        principal_id TEXT NOT NULL, role TEXT NOT NULL DEFAULT 'viewer',
+        created_by TEXT NOT NULL, created_at TEXT NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS creative_context_audit (
+        id TEXT PRIMARY KEY, context_id TEXT NOT NULL, operation TEXT NOT NULL,
+        actor_email TEXT NOT NULL, details TEXT NOT NULL DEFAULT '{}', created_at TEXT NOT NULL,
+        owner_email TEXT NOT NULL, org_id TEXT
+      );
+      CREATE TABLE IF NOT EXISTS creative_context_memberships (
+        id TEXT PRIMARY KEY, context_id TEXT NOT NULL, artifact_key TEXT NOT NULL,
+        published_item_id TEXT, published_item_version_id TEXT, pending_submission_id TEXT,
+        rank TEXT NOT NULL DEFAULT 'normal', purpose TEXT, status TEXT NOT NULL DEFAULT 'active',
+        created_at TEXT NOT NULL, updated_at TEXT NOT NULL, owner_email TEXT NOT NULL, org_id TEXT
+      );
+      CREATE TABLE IF NOT EXISTS creative_context_submissions (
+        id TEXT PRIMARY KEY, context_id TEXT NOT NULL, membership_id TEXT NOT NULL,
+        artifact_key TEXT NOT NULL, staging_item_id TEXT, staging_item_version_id TEXT,
+        published_item_id TEXT, published_item_version_id TEXT, note TEXT,
+        private_metadata TEXT NOT NULL DEFAULT '{}', status TEXT NOT NULL,
+        submitted_by TEXT NOT NULL, reviewed_by TEXT, review_note TEXT,
+        created_at TEXT NOT NULL, reviewed_at TEXT, owner_email TEXT NOT NULL, org_id TEXT
+      );
+      CREATE TABLE IF NOT EXISTS creative_context_app_bindings (
+        id TEXT PRIMARY KEY, app_id TEXT NOT NULL, context_id TEXT NOT NULL,
+        created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+        owner_email TEXT NOT NULL, org_id TEXT
+      );
+      CREATE TABLE IF NOT EXISTS creative_context_published_snapshots (
+        id TEXT PRIMARY KEY, context_id TEXT NOT NULL, source_id TEXT NOT NULL,
+        membership_id TEXT NOT NULL, item_id TEXT NOT NULL, item_version_id TEXT NOT NULL,
+        submission_id TEXT NOT NULL, created_at TEXT NOT NULL, owner_email TEXT NOT NULL, org_id TEXT
+      );
+      ALTER TABLE creative_context_packs ADD COLUMN base_context_id TEXT;
+      ALTER TABLE creative_context_packs ADD COLUMN specialty_context_id TEXT;
+      ALTER TABLE creative_context_packs ADD COLUMN selection_reason TEXT;
+      CREATE UNIQUE INDEX IF NOT EXISTS creative_context_membership_artifact_uidx
+        ON creative_context_memberships (context_id, artifact_key);
+      CREATE INDEX IF NOT EXISTS creative_context_memberships_context_status_idx
+        ON creative_context_memberships (context_id, status, updated_at);
+      CREATE INDEX IF NOT EXISTS creative_context_submissions_context_status_idx
+        ON creative_context_submissions (context_id, status, created_at);
+      CREATE INDEX IF NOT EXISTS creative_context_app_bindings_lookup_idx
+        ON creative_context_app_bindings (app_id, owner_email, org_id, updated_at);
+      CREATE INDEX IF NOT EXISTS creative_context_memberships_published_item_idx
+        ON creative_context_memberships (published_item_id, published_item_version_id);
+      CREATE INDEX IF NOT EXISTS creative_context_published_snapshots_source_item_idx
+        ON creative_context_published_snapshots (source_id, item_id, item_version_id);
+      CREATE INDEX IF NOT EXISTS creative_context_shares_lookup_idx
+        ON creative_context_shares (resource_id, principal_type, principal_id);
+    `,
+  },
+  {
+    version: 7,
+    name: "creative-context-default-scope-uniqueness",
+    sql: `
+      ALTER TABLE creative_contexts ADD COLUMN default_scope_key TEXT;
+      UPDATE creative_contexts
+      SET default_scope_key = CASE
+        WHEN kind = 'default' AND org_id IS NOT NULL THEN 'org:' || org_id
+        WHEN kind = 'default' THEN 'user:' || owner_email
+        ELSE NULL
+      END;
+      CREATE UNIQUE INDEX IF NOT EXISTS creative_context_default_scope_uidx
+        ON creative_contexts (default_scope_key);
+    `,
+  },
 ];

package/src/server/generation-artifact-access.ts

@@ -197,6 +197,7 @@ async function verifyCapabilitySignature(
   let bytes: Uint8Array;
   try {
     bytes = Buffer.from(signature, "base64url");
+    if (Buffer.from(bytes).toString("base64url") !== signature) return false;
   } catch {
     return false;
   }