@agent-native/creative-context 0.7.25 → 0.8.0-nightly-20260915020720

package/src/server/generation-context-a2a.spec.ts

@@ -15,7 +15,9 @@ const mocks = vi.hoisted(() => ({
   hasA2A: vi.fn(),
   callA2A: vi.fn(),
   getRequestOrgId: vi.fn(),
+  getRequestUserEmail: vi.fn(() => "user@example.test"),
   createArtifactCapability: vi.fn(),
+  isCreativeContextLabAvailable: vi.fn(),
 }));
 
 vi.mock("@agent-native/core/application-state", () => ({
@@ -24,6 +26,7 @@ vi.mock("@agent-native/core/application-state", () => ({
 
 vi.mock("@agent-native/core/server/request-context", () => ({
   getRequestOrgId: mocks.getRequestOrgId,
+  getRequestUserEmail: mocks.getRequestUserEmail,
 }));
 
 vi.mock("../store/index.js", () => ({
@@ -60,6 +63,14 @@ vi.mock("./isolated-a2a.js", () => ({
   })),
 }));
 
+vi.mock("./labs.js", () => ({
+  isCreativeContextLabAvailable: mocks.isCreativeContextLabAvailable,
+}));
+
+vi.mock("./context.js", () => ({
+  getCreativeContext: () => ({ labKey: "creative-context.library" }),
+}));
+
 vi.mock("./generation-artifact-access.js", () => ({
   assertGenerationArtifactAccess: vi.fn(),
   createGenerationArtifactAccessCapability: mocks.createArtifactCapability,
@@ -88,6 +99,7 @@ describe("generation context isolated A2A routing", () => {
     mocks.createArtifactCapability.mockImplementation(
       async (_identity, _target, operation) => `cap-${operation}`,
     );
+    mocks.isCreativeContextLabAvailable.mockResolvedValue(true);
     mocks.callA2A.mockResolvedValue(emptyRemoteContext);
     mocks.listCreativeContexts.mockResolvedValue({ contexts: [] });
     mocks.getCreativeContextById.mockResolvedValue(null);
@@ -147,6 +159,31 @@ describe("generation context isolated A2A routing", () => {
     expect(mocks.getLocal).not.toHaveBeenCalled();
   });
 
+  it.each([
+    { path: "isolated A2A", hasA2A: true },
+    { path: "local storage", hasA2A: false },
+  ])(
+    "does not record through $path when Labs is disabled",
+    async ({ hasA2A }) => {
+      mocks.isCreativeContextLabAvailable.mockResolvedValue(false);
+      mocks.hasA2A.mockReturnValue(hasA2A);
+
+      await expect(
+        recordGenerationCreativeContext({
+          appId: "slides",
+          artifactType: "deck",
+          artifactId: "deck-1",
+          contextMode: "auto",
+          contextPackId: null,
+          reuseLabels: [],
+        }),
+      ).resolves.toBeNull();
+
+      expect(mocks.callA2A).not.toHaveBeenCalled();
+      expect(mocks.recordLocal).not.toHaveBeenCalled();
+    },
+  );
+
   it("keeps the in-process path as the zero-configuration default", async () => {
     mocks.hasA2A.mockReturnValue(false);
     mocks.performCreativeContextSearch.mockResolvedValue({

package/src/server/generation-context-off.spec.ts

@@ -7,6 +7,8 @@ const mocks = vi.hoisted(() => ({
   listAccessibleSearchDocuments: vi.fn(),
   performCreativeContextSearch: vi.fn(),
   callIsolatedCreativeContextA2A: vi.fn(),
+  isCreativeContextLabAvailable: vi.fn(),
+  getGenerationCreativeContextLocal: vi.fn(),
 }));
 
 vi.mock("@agent-native/core/application-state", () => ({
@@ -19,6 +21,11 @@ vi.mock("../store/index.js", () => ({
   listAccessibleSearchDocuments: mocks.listAccessibleSearchDocuments,
 }));
 
+vi.mock("../store/generation.js", () => ({
+  getGenerationCreativeContext: mocks.getGenerationCreativeContextLocal,
+  recordGenerationCreativeContext: vi.fn(),
+}));
+
 vi.mock("./retrieval.js", () => ({
   performCreativeContextSearch: mocks.performCreativeContextSearch,
 }));
@@ -29,7 +36,16 @@ vi.mock("./isolated-a2a.js", () => ({
   isolatedResolvePayload: vi.fn((input) => input),
 }));
 
+vi.mock("./labs.js", () => ({
+  isCreativeContextLabAvailable: mocks.isCreativeContextLabAvailable,
+}));
+
+vi.mock("./context.js", () => ({
+  getCreativeContext: () => ({ labKey: "creative-context.library" }),
+}));
+
 import {
+  getGenerationCreativeContext,
   resolveGenerationCreativeContext,
   validateGenerationCreativeContext,
 } from "./generation-context.js";
@@ -37,6 +53,7 @@ import {
 describe("creative context structural opt-out", () => {
   beforeEach(() => {
     vi.clearAllMocks();
+    mocks.isCreativeContextLabAvailable.mockResolvedValue(true);
     mocks.readAppState.mockResolvedValue({ contextMode: "off" });
   });
 
@@ -52,6 +69,60 @@ describe("creative context structural opt-out", () => {
     expect(mocks.callIsolatedCreativeContextA2A).not.toHaveBeenCalled();
   });
 
+  it("does not resolve automatic context while its Lab is disabled", async () => {
+    mocks.isCreativeContextLabAvailable.mockResolvedValue(false);
+
+    await expect(
+      resolveGenerationCreativeContext({ role: "design", query: "dashboard" }),
+    ).resolves.toMatchObject({ contextMode: "off", results: [] });
+    expect(mocks.readAppState).not.toHaveBeenCalled();
+    expect(mocks.callIsolatedCreativeContextA2A).not.toHaveBeenCalled();
+    expect(mocks.performCreativeContextSearch).not.toHaveBeenCalled();
+  });
+
+  it("does not read inherited generation context while its Lab is disabled", async () => {
+    mocks.isCreativeContextLabAvailable.mockResolvedValue(false);
+
+    await expect(
+      getGenerationCreativeContext({
+        appId: "slides",
+        artifactType: "deck",
+        artifactId: "deck-1",
+      }),
+    ).resolves.toBeNull();
+    expect(mocks.readAppState).not.toHaveBeenCalled();
+    expect(mocks.callIsolatedCreativeContextA2A).not.toHaveBeenCalled();
+    expect(mocks.getGenerationCreativeContextLocal).not.toHaveBeenCalled();
+  });
+
+  it("does not treat an unreadable Lab as permission to read inherited context", async () => {
+    mocks.isCreativeContextLabAvailable.mockRejectedValue(
+      new Error("settings unavailable"),
+    );
+
+    await expect(
+      getGenerationCreativeContext({
+        appId: "slides",
+        artifactType: "deck",
+        artifactId: "deck-1",
+      }),
+    ).rejects.toThrow("settings unavailable");
+    expect(mocks.callIsolatedCreativeContextA2A).not.toHaveBeenCalled();
+    expect(mocks.getGenerationCreativeContextLocal).not.toHaveBeenCalled();
+  });
+
+  it("fails closed when Labs state cannot be read", async () => {
+    mocks.isCreativeContextLabAvailable.mockRejectedValue(
+      new Error("settings unavailable"),
+    );
+
+    await expect(
+      resolveGenerationCreativeContext({ role: "design", query: "dashboard" }),
+    ).rejects.toThrow("settings unavailable");
+    expect(mocks.callIsolatedCreativeContextA2A).not.toHaveBeenCalled();
+    expect(mocks.performCreativeContextSearch).not.toHaveBeenCalled();
+  });
+
   it("rejects an explicit pack before validating final-write provenance", async () => {
     await expect(
       validateGenerationCreativeContext({

package/src/server/generation-context.ts

@@ -1,5 +1,8 @@
 import { readAppState } from "@agent-native/core/application-state";
-import { getRequestOrgId } from "@agent-native/core/server/request-context";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server/request-context";
 
 import {
   getGenerationCreativeContext as getGenerationCreativeContextLocal,
@@ -23,6 +26,7 @@ import {
   sanitizeUntrustedReference,
   UNTRUSTED_REFERENCE_ROLE,
 } from "../untrusted-reference.js";
+import { getCreativeContext } from "./context.js";
 import {
   assertGenerationArtifactAccess,
   createGenerationArtifactAccessCapability,
@@ -35,6 +39,7 @@ import {
   isolatedResolvePayload,
   type IsolatedRecordPayload,
 } from "./isolated-a2a.js";
+import { isCreativeContextLabAvailable } from "./labs.js";
 import { performCreativeContextSearch } from "./retrieval.js";
 
 export type CreativeGenerationRole =
@@ -56,6 +61,13 @@ const SPECIALTY_STOP_WORDS = new Set([
   "with",
 ]);
 
+async function creativeContextLabEnabled() {
+  return isCreativeContextLabAvailable(
+    getRequestUserEmail(),
+    getCreativeContext().labKey,
+  );
+}
+
 function specialtyTokens(value: string) {
   return new Set(
     value
@@ -249,16 +261,23 @@ export async function resolveGenerationCreativeContext(
   if (input.contextModeOverride === "off") {
     return resolveGenerationCreativeContextLocal(input);
   }
+  if (!(await creativeContextLabEnabled())) {
+    return resolveGenerationCreativeContextLocal({
+      ...input,
+      contextModeOverride: "off",
+    });
+  }
   if (hasIsolatedCreativeContextA2A()) {
-    const state = (await readAppState("creative-context").catch(
-      () => null,
-    )) as {
+    const state = (await readAppState("creative-context")) as {
       contextMode?: "auto" | "off";
       pinnedPackId?: string | null;
       selectedContextId?: string | null;
     } | null;
     if (state?.contextMode === "off") {
-      return resolveGenerationCreativeContextLocal(input);
+      return resolveGenerationCreativeContextLocal({
+        ...input,
+        contextModeOverride: "off",
+      });
     }
     return callIsolatedCreativeContextA2A("resolve", {
       ...isolatedResolvePayload(input),
@@ -295,7 +314,7 @@ export async function resolveGenerationCreativeContextLocal(
       results: [],
     };
   }
-  const state = (await readAppState("creative-context").catch(() => null)) as {
+  const state = (await readAppState("creative-context")) as {
     contextMode?: "auto" | "off";
     pinnedPackId?: string | null;
     selectedContextId?: string | null;
@@ -449,14 +468,21 @@ export async function validateGenerationCreativeContext(
   if (input.contextModeOverride === "off") {
     return validateGenerationCreativeContextLocal(input);
   }
+  if (!(await creativeContextLabEnabled())) {
+    return validateGenerationCreativeContextLocal({
+      ...input,
+      contextModeOverride: "off",
+    });
+  }
   if (hasIsolatedCreativeContextA2A()) {
-    const state = (await readAppState("creative-context").catch(
-      () => null,
-    )) as {
+    const state = (await readAppState("creative-context")) as {
       contextMode?: "auto" | "off";
     } | null;
     if (state?.contextMode === "off") {
-      return validateGenerationCreativeContextLocal(input);
+      return validateGenerationCreativeContextLocal({
+        ...input,
+        contextModeOverride: "off",
+      });
     }
     return callIsolatedCreativeContextA2A("validate", {
       contextPackId: input.contextPackId,
@@ -500,7 +526,7 @@ export async function validateGenerationCreativeContextLocal(
       results: [],
     };
   }
-  const state = (await readAppState("creative-context").catch(() => null)) as {
+  const state = (await readAppState("creative-context")) as {
     contextMode?: "auto" | "off";
   } | null;
   if (state?.contextMode === "off") {
@@ -557,6 +583,7 @@ export async function recordGenerationCreativeContext(
   input: IsolatedRecordPayload,
   options: { db?: any; artifactAccess?: GenerationArtifactAccessTarget } = {},
 ) {
+  if (!(await creativeContextLabEnabled())) return null;
   const artifactAccessTarget = collaborativeArtifactTarget(
     input,
     options.artifactAccess,
@@ -602,14 +629,13 @@ export async function getGenerationCreativeContext(
     db?: any;
   } = {},
 ) {
+  if (!(await creativeContextLabEnabled())) return null;
   const artifactAccessTarget = collaborativeArtifactTarget(
     input,
     options.artifactAccess,
   );
   if (!options.db && hasIsolatedCreativeContextA2A()) {
-    const state = (await readAppState("creative-context").catch(
-      () => null,
-    )) as {
+    const state = (await readAppState("creative-context")) as {
       contextMode?: "auto" | "off";
     } | null;
     if (state?.contextMode !== "off") {

package/src/server/index.ts

@@ -23,10 +23,16 @@ import {
   getCreativeContext,
   type CreativeContextServerContext,
 } from "./context.js";
+import { gateCreativeContextActions } from "./labs.js";
 import { createCreativeContextMediaPlugin } from "./media.js";
 import { registerCreativeContextPromptProvider } from "./prompt-provider.js";
 import { getCreativeContextResourcePath } from "./resource-paths.js";
 
+export {
+  assertCreativeContextLabEnabled,
+  isCreativeContextLabAvailable,
+} from "./labs.js";
+
 export interface CreativeContextSetupOptions extends Partial<
   Omit<CreativeContextServerContext, "connectorContext">
 > {
@@ -35,7 +41,7 @@ export interface CreativeContextSetupOptions extends Partial<
   continuationDispatcher?: CreativeContextImportContinuationDispatcher;
 }
 
-registerPackageActions(creativeContextActions);
+registerPackageActions(gateCreativeContextActions(creativeContextActions));
 registerWorkspaceConnectionLifecycleListener(async (event) => {
   await handleWorkspaceConnectionLifecycle(event);
 });
@@ -103,6 +109,7 @@ export function setupCreativeContext(
   configureCreativeContext({
     getDb: options.getDb,
     schema: options.schema,
+    labKey: options.labKey,
     vectorAdapter: options.vectorAdapter,
     connectors: options.connectors,
     projections: options.projections,
@@ -155,7 +162,7 @@ export {
   type RenderedDesignExtractionStatus,
 } from "../connectors/rendered-design.js";
 export { serializePrivateBlobHandle } from "../connectors/private-artifacts.js";
-export { resolveNativeContextCloneReference } from "../store/contexts.js";
+export { resolveNativeContextCloneReference } from "./native-context-clone.js";
 export {
   CREATIVE_CONTEXT_BACKGROUND_PROCESSOR_ROUTE,
   CREATIVE_CONTEXT_IMPORT_PROCESSOR_ROUTE,

package/src/server/labs.spec.ts

@@ -0,0 +1,116 @@
+import type { ActionEntry } from "@agent-native/core/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  getUserLabs: vi.fn(),
+  getRequestUserEmail: vi.fn(),
+  getCreativeContext: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/labs/server", () => mocks);
+vi.mock("@agent-native/core/server/request-context", () => mocks);
+vi.mock("./context.js", () => mocks);
+
+import {
+  assertCreativeContextLabEnabled,
+  gateCreativeContextActions,
+  isCreativeContextLabAvailable,
+} from "./labs.js";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.getCreativeContext.mockReturnValue({
+    labKey: "content.creative-context",
+  });
+});
+
+describe("isCreativeContextLabAvailable", () => {
+  it("does not expose the library without an authenticated user", async () => {
+    await expect(isCreativeContextLabAvailable(undefined)).resolves.toBe(false);
+    expect(mocks.getUserLabs).not.toHaveBeenCalled();
+  });
+
+  it("uses the shared Creative Context Lab by default", async () => {
+    mocks.getUserLabs.mockResolvedValue({ "creative-context.library": true });
+
+    await expect(
+      isCreativeContextLabAvailable("user@example.com"),
+    ).resolves.toBe(true);
+    expect(mocks.getUserLabs).toHaveBeenCalledWith("user@example.com");
+  });
+
+  it("supports an app's existing Creative Context Lab key", async () => {
+    mocks.getUserLabs.mockResolvedValue({ "content.creative-context": true });
+
+    await expect(
+      isCreativeContextLabAvailable(
+        "user@example.com",
+        "content.creative-context",
+      ),
+    ).resolves.toBe(true);
+  });
+
+  it("preserves unreadable lab state as an error", async () => {
+    mocks.getUserLabs.mockRejectedValue(new Error("settings unavailable"));
+
+    await expect(
+      isCreativeContextLabAvailable("user@example.com"),
+    ).rejects.toThrow("settings unavailable");
+  });
+
+  it("requires the configured app Lab before Creative Context operations", async () => {
+    mocks.getUserLabs.mockResolvedValue({ "content.creative-context": true });
+    await expect(
+      assertCreativeContextLabEnabled("user@example.com"),
+    ).resolves.toBeUndefined();
+    expect(mocks.getUserLabs).toHaveBeenCalledWith("user@example.com");
+    expect(mocks.getCreativeContext).toHaveBeenCalled();
+
+    mocks.getUserLabs.mockResolvedValue({ "content.creative-context": false });
+    await expect(
+      assertCreativeContextLabEnabled("user@example.com"),
+    ).rejects.toThrow("Creative Context is disabled in Labs");
+  });
+
+  it("gates package actions with the configured app Lab", async () => {
+    const run = vi.fn().mockResolvedValue({ ok: true });
+    const actions = gateCreativeContextActions({
+      "manage-creative-context": {
+        tool: {} as ActionEntry["tool"],
+        run,
+      },
+    });
+    const action = actions["manage-creative-context"];
+
+    mocks.getUserLabs.mockResolvedValue({ "content.creative-context": true });
+    await expect(
+      action.run({}, { caller: "tool", userEmail: "user@example.test" }),
+    ).resolves.toEqual({ ok: true });
+    expect(mocks.getUserLabs).toHaveBeenCalledWith("user@example.test");
+    expect(mocks.getCreativeContext).toHaveBeenCalled();
+    expect(run).toHaveBeenCalledOnce();
+
+    mocks.getUserLabs.mockResolvedValue({ "content.creative-context": false });
+    await expect(
+      action.run({}, { caller: "tool", userEmail: "user@example.test" }),
+    ).rejects.toThrow("Creative Context is disabled in Labs");
+    expect(run).toHaveBeenCalledOnce();
+  });
+
+  it("keeps approved purge cleanup runnable after disabling the Lab", async () => {
+    const run = vi.fn().mockResolvedValue({ ok: true });
+    const actions = gateCreativeContextActions({
+      "process-context-purge": {
+        tool: {} as ActionEntry["tool"],
+        run,
+      },
+    });
+    mocks.getUserLabs.mockRejectedValue(new Error("settings unavailable"));
+
+    await expect(actions["process-context-purge"].run({})).resolves.toEqual({
+      ok: true,
+    });
+    expect(mocks.getUserLabs).not.toHaveBeenCalled();
+    expect(run).toHaveBeenCalledOnce();
+  });
+});

package/src/server/labs.ts

@@ -0,0 +1,53 @@
+import { getUserLabs } from "@agent-native/core/labs/server";
+import type { ActionEntry } from "@agent-native/core/server";
+import { getRequestUserEmail } from "@agent-native/core/server/request-context";
+
+import { CREATIVE_CONTEXT_LIBRARY_LAB } from "../labs.js";
+import { getCreativeContext } from "./context.js";
+
+export async function isCreativeContextLabAvailable(
+  userEmail: string | undefined,
+  labKey = CREATIVE_CONTEXT_LIBRARY_LAB.key,
+): Promise<boolean> {
+  if (!userEmail) return false;
+  const labs = await getUserLabs(userEmail);
+  return labs[labKey] === true;
+}
+
+export async function assertCreativeContextLabEnabled(
+  userEmail = getRequestUserEmail(),
+): Promise<void> {
+  if (
+    !(await isCreativeContextLabAvailable(
+      userEmail,
+      getCreativeContext().labKey,
+    ))
+  ) {
+    throw new Error("Creative Context is disabled in Labs");
+  }
+}
+
+function gateCreativeContextAction(action: ActionEntry): ActionEntry {
+  return {
+    ...action,
+    async run(args, context) {
+      await assertCreativeContextLabEnabled(
+        context?.userEmail ?? getRequestUserEmail(),
+      );
+      return action.run(args, context);
+    },
+  };
+}
+
+export function gateCreativeContextActions(
+  actions: Record<string, ActionEntry>,
+): Record<string, ActionEntry> {
+  return Object.fromEntries(
+    Object.entries(actions).map(([name, action]) => [
+      name,
+      name === "process-context-purge"
+        ? action
+        : gateCreativeContextAction(action),
+    ]),
+  );
+}

package/src/server/media.spec.ts

@@ -7,6 +7,8 @@ const mocks = vi.hoisted(() => ({
   readPrivateArtifact: vi.fn(async () => new Uint8Array([1, 2, 3])),
   getCreativeContextItem: vi.fn(),
   readPendingCreativeContextMedia: vi.fn(),
+  isCreativeContextLabAvailable: vi.fn(),
+  labKey: "creative-context.library",
 }));
 
 vi.mock("@agent-native/core/server", () => ({
@@ -36,7 +38,14 @@ vi.mock("../store/index.js", () => ({
 }));
 
 vi.mock("./context.js", () => ({
-  getCreativeContext: vi.fn(() => ({ connectorContext: {} })),
+  getCreativeContext: vi.fn(() => ({
+    connectorContext: {},
+    labKey: mocks.labKey,
+  })),
+}));
+
+vi.mock("./labs.js", () => ({
+  isCreativeContextLabAvailable: mocks.isCreativeContextLabAvailable,
 }));
 
 const { createCreativeContextMediaPlugin } = await import("./media.js");
@@ -56,6 +65,9 @@ describe("creative context media route", () => {
     mocks.handler = null;
     mocks.getSession.mockReset();
     mocks.runWithRequestContext.mockClear();
+    mocks.readPrivateArtifact.mockClear();
+    mocks.isCreativeContextLabAvailable.mockReset().mockResolvedValue(true);
+    mocks.labKey = "creative-context.library";
     mocks.getCreativeContextItem.mockReset().mockResolvedValue({
       item: {
         id: "item-1",
@@ -74,6 +86,45 @@ describe("creative context media route", () => {
     expect(response.status).toBe(401);
     expect(mocks.runWithRequestContext).not.toHaveBeenCalled();
     expect(mocks.getCreativeContextItem).not.toHaveBeenCalled();
+    expect(mocks.isCreativeContextLabAvailable).not.toHaveBeenCalled();
+  });
+
+  it("does not read private media when its app-specific Lab is disabled", async () => {
+    mocks.getSession.mockResolvedValue({
+      email: "Alice@Example.test ",
+      orgId: "org-1",
+    });
+    mocks.labKey = "content.creative-context";
+    mocks.isCreativeContextLabAvailable.mockResolvedValue(false);
+
+    const response = await mocks.handler!(event());
+
+    expect(response.status).toBe(404);
+    expect(mocks.isCreativeContextLabAvailable).toHaveBeenCalledWith(
+      "alice@example.test",
+      "content.creative-context",
+    );
+    expect(mocks.runWithRequestContext).not.toHaveBeenCalled();
+    expect(mocks.getCreativeContextItem).not.toHaveBeenCalled();
+    expect(mocks.readPendingCreativeContextMedia).not.toHaveBeenCalled();
+    expect(mocks.readPrivateArtifact).not.toHaveBeenCalled();
+  });
+
+  it("fails closed when the app Labs setting cannot be read", async () => {
+    mocks.getSession.mockResolvedValue({
+      email: "alice@example.test",
+      orgId: "org-1",
+    });
+    mocks.isCreativeContextLabAvailable.mockRejectedValue(
+      new Error("Labs settings unavailable"),
+    );
+
+    await expect(mocks.handler!(event())).rejects.toThrow(
+      "Labs settings unavailable",
+    );
+    expect(mocks.runWithRequestContext).not.toHaveBeenCalled();
+    expect(mocks.getCreativeContextItem).not.toHaveBeenCalled();
+    expect(mocks.readPrivateArtifact).not.toHaveBeenCalled();
   });
 
   it("runs access-scoped reads under the authenticated request context", async () => {
@@ -91,6 +142,10 @@ describe("creative context media route", () => {
       "item-1",
       "version-1",
     );
+    expect(mocks.isCreativeContextLabAvailable).toHaveBeenCalledWith(
+      "alice@example.test",
+      "creative-context.library",
+    );
   });
 
   it("uses the narrow pending-submission path only after generic item access fails", async () => {

package/src/server/media.ts

@@ -16,6 +16,7 @@ import {
   readPendingCreativeContextMedia,
 } from "../store/index.js";
 import { getCreativeContext } from "./context.js";
+import { isCreativeContextLabAvailable } from "./labs.js";
 
 const SAFE_MIME_TYPES = new Set([
   "image/png",
@@ -38,6 +39,14 @@ export function createCreativeContextMediaPlugin(): NitroPluginDef {
       if (!userEmail) {
         return new Response("Authentication required", { status: 401 });
       }
+      if (
+        !(await isCreativeContextLabAvailable(
+          userEmail,
+          getCreativeContext().labKey,
+        ))
+      ) {
+        return new Response("Not found", { status: 404 });
+      }
       const orgId = session?.orgId;
       const url = new URL(
         event.req.url,

package/src/server/native-context-clone.spec.ts

@@ -0,0 +1,55 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  assertCreativeContextLabEnabled: vi.fn(),
+  resolveFromStore: vi.fn(),
+}));
+
+vi.mock("./labs.js", () => ({
+  assertCreativeContextLabEnabled: mocks.assertCreativeContextLabEnabled,
+}));
+
+vi.mock("../store/contexts.js", () => ({
+  resolveNativeContextCloneReference: mocks.resolveFromStore,
+}));
+
+import { resolveNativeContextCloneReference } from "./native-context-clone.js";
+
+describe("resolveNativeContextCloneReference", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("checks Labs before reading a clone reference", async () => {
+    const input = {
+      appId: "design",
+      resourceType: "design",
+      resourceId: "design-1",
+      contextId: "context-1",
+      artifactKey: "design:design:design-1",
+    };
+    const reference = { publishedItemVersionId: "version-1" };
+    mocks.resolveFromStore.mockResolvedValue(reference);
+
+    await expect(resolveNativeContextCloneReference(input)).resolves.toBe(
+      reference,
+    );
+    expect(mocks.assertCreativeContextLabEnabled).toHaveBeenCalledOnce();
+    expect(mocks.resolveFromStore).toHaveBeenCalledWith(input);
+  });
+
+  it("does not read the reference when Labs is disabled or unreadable", async () => {
+    mocks.assertCreativeContextLabEnabled.mockRejectedValue(
+      new Error("Creative Context is disabled in Labs"),
+    );
+
+    await expect(
+      resolveNativeContextCloneReference({
+        appId: "design",
+        resourceType: "design",
+        resourceId: "design-1",
+        contextId: "context-1",
+        artifactKey: "design:design:design-1",
+      }),
+    ).rejects.toThrow("Creative Context is disabled in Labs");
+    expect(mocks.resolveFromStore).not.toHaveBeenCalled();
+  });
+});