deepspace 0.33.1 → 0.34.0

package/features/documents/feature.json

@@ -56,6 +56,14 @@
     {
       "src": "src/editor/DocumentsTiptapToolbar.tsx",
       "dest": "src/pages/documents/editor/DocumentsTiptapToolbar.tsx"
+    },
+    {
+      "src": "src/documents-invitee-lookup.ts",
+      "dest": "src/pages/documents/documents-invitee-lookup.ts"
+    },
+    {
+      "src": "src/documents-find-invitee-action.ts",
+      "dest": "src/actions/documents-find-invitee.ts"
     }
   ],
   "schema": {
@@ -63,6 +71,13 @@
     "importPath": "./schemas/documents-schema",
     "spreadOperator": true
   },
+  "actions": [
+    {
+      "exportName": "documentsFindInviteeAction",
+      "registerAs": "documents-find-invitee",
+      "importPath": "./documents-find-invitee"
+    }
+  ],
   "route": {
     "path": "/documents",
     "protected": true

package/features/documents/src/DocumentsListPage.tsx

@@ -10,6 +10,7 @@ import { useUser } from 'deepspace'
 import { useQuery } from 'deepspace'
 import { useMutations } from 'deepspace'
 import { ROLES, type Role } from 'deepspace'
+import { useToast } from '@/components/ui'
 import {
   FileText,
   Plus,
@@ -81,6 +82,7 @@ function formatDate(iso: string): string {
 export default function DocumentsListPage() {
   const { user } = useUser()
   const navigate = useNavigate()
+  const toast = useToast()
   const userRole = (user?.role ?? ROLES.VIEWER) as Role
   const roleCanCreate = userRole === ROLES.MEMBER || userRole === ROLES.ADMIN
 
@@ -233,15 +235,27 @@ export default function DocumentsListPage() {
 
   const handleNewDocument = useCallback(async () => {
     if (!user || !canCreate) return
-    const id = await createConfirmed({
-      title: UNTITLED,
-      ownerId: user.id,
-      collaborators: '[]',
-      editors: '[]',
-      folderId: folderIdForNew,
-    })
+    // A confirmed write answers with an ack the provider-level onWriteError
+    // never sees, so a refusal or timeout has to be reported here — otherwise
+    // the click does nothing and the rejection is unhandled.
+    let id: string
+    try {
+      id = await createConfirmed({
+        title: UNTITLED,
+        ownerId: user.id,
+        collaborators: '[]',
+        editors: '[]',
+        folderId: folderIdForNew,
+      })
+    } catch (err) {
+      toast.error(
+        'Document not created',
+        err instanceof Error ? err.message : 'DeepSpace did not confirm the write.',
+      )
+      return
+    }
     navigate(`/documents/${id}`)
-  }, [canCreate, createConfirmed, folderIdForNew, navigate, user])
+  }, [canCreate, createConfirmed, folderIdForNew, navigate, toast, user])
 
   const handleDelete = useCallback(
     async (docId: string) => {

package/features/documents/src/InviteDialog.tsx

@@ -1,6 +1,6 @@
 import { useMemo, useState } from 'react'
 import type { RecordData } from 'deepspace'
-import { useMutations, useQuery, useUser } from 'deepspace'
+import { useMutations, useUser, useUserLookup } from 'deepspace'
 import { Mail, ShieldCheck, UserMinus, Users } from 'lucide-react'
 import { Modal, useToast } from '@/components/ui'
 import {
@@ -8,10 +8,15 @@ import {
   type DocumentsDocumentFields,
   type InviteAclDiff,
 } from './documents-library-types'
+import { findDocumentsInvitee } from './documents-invitee-lookup'
+import type { DocumentsInviteeLookup } from '@/actions/documents-find-invitee'
 
-interface UserFields {
+/** One row of "People with access", drawn from the roster every member receives. */
+interface PersonRow {
+  id: string
+  name: string
+  /** Only admins receive emails in the roster. */
   email?: string
-  name?: string
   imageUrl?: string
 }
 
@@ -46,14 +51,18 @@ function initialsFor(name: string): string {
 
 export function InviteDialog({ open, onOpenChange, doc, isOwner, onAclChange }: InviteDialogProps) {
   const { user } = useUser()
-  const { records: users, status: usersStatus } = useQuery<UserFields>('users')
+  // The roster names everyone who has signed in to the app, projected to
+  // public identity for members. A plain `useQuery('users')` is self-only
+  // under the scaffold's `member: { read: 'own' }` policy, so it cannot name
+  // a collaborator — or resolve an email — for an ordinary owner.
+  const { getUser } = useUserLookup()
   const { putConfirmed, ready: documentsMutationsReady } =
     useMutations<DocumentsDocumentFields>('documents')
   const toast = useToast()
   const [email, setEmail] = useState('')
   const [role, setRole] = useState<InviteRole>('editor')
   const [saving, setSaving] = useState(false)
-  const ready = usersStatus === 'ready' && documentsMutationsReady
+  const ready = documentsMutationsReady
 
   const collaborators = useMemo(
     () => parseDocumentsIdList(doc.data.collaborators),
@@ -61,17 +70,22 @@ export function InviteDialog({ open, onOpenChange, doc, isOwner, onAclChange }:
   )
   const editors = useMemo(() => parseDocumentsIdList(doc.data.editors), [doc.data.editors])
 
-  const ownerRecord = useMemo(
-    () => users.find((u) => u.recordId === doc.data.ownerId),
-    [doc.data.ownerId, users],
-  )
+  const ownerRecord = useMemo(() => getUser(doc.data.ownerId), [doc.data.ownerId, getUser])
 
-  const collaboratorRecords = useMemo(
+  // Every collaborator id stays listed even before the roster names it, so
+  // access can always be changed or removed.
+  const collaboratorRecords = useMemo<PersonRow[]>(
     () =>
-      collaborators
-        .map((id) => users.find((u) => u.recordId === id))
-        .filter((u): u is RecordData<UserFields> => Boolean(u)),
-    [collaborators, users],
+      collaborators.map((id) => {
+        const u = getUser(id)
+        return {
+          id,
+          name: u?.name?.trim() || 'Collaborator',
+          email: u?.email,
+          imageUrl: u?.imageUrl,
+        }
+      }),
+    [collaborators, getUser],
   )
 
   if (!isOwner) return null
@@ -122,30 +136,41 @@ export function InviteDialog({ open, onOpenChange, doc, isOwner, onAclChange }:
 
   const addInvite = async () => {
     const normalized = email.trim().toLowerCase()
-    if (!normalized) return
+    if (!normalized || !ready) return
 
-    const target = users.find((u) => u.data.email?.trim().toLowerCase() === normalized)
-    if (!target) {
+    // The email resolves server-side (owner-only action): members cannot read
+    // other users' rows, and the roster carries no emails for them.
+    let target: DocumentsInviteeLookup
+    setSaving(true)
+    try {
+      target = await findDocumentsInvitee(doc.recordId, normalized)
+    } catch (err) {
+      toast.error('Could not look up that email', err instanceof Error ? err.message : undefined)
+      return
+    } finally {
+      setSaving(false)
+    }
+    if (!target.found) {
       toast.error(
         'User not found',
         'Ask them to sign in to this app once, then invite the same email again.',
       )
       return
     }
-    if (target.recordId === doc.data.ownerId || target.recordId === user?.id) {
+    if (target.userId === doc.data.ownerId || target.userId === user?.id) {
       toast.info('Already has access', 'That user is the document owner.')
       return
     }
-    if (collaborators.includes(target.recordId)) {
-      toast.info('Already invited', `${target.data.email ?? normalized} already has access.`)
+    if (collaborators.includes(target.userId)) {
+      toast.info('Already invited', `${normalized} already has access.`)
       return
     }
 
-    const nextCollaborators = [...collaborators, target.recordId]
-    const nextEditors = role === 'editor' ? [...editors, target.recordId] : editors
+    const nextCollaborators = [...collaborators, target.userId]
+    const nextEditors = role === 'editor' ? [...editors, target.userId] : editors
     if (!(await saveAccess(nextCollaborators, nextEditors))) return
     setEmail('')
-    toast.success('Invite added', `${target.data.email ?? normalized} now has ${role} access.`)
+    toast.success('Invite added', `${normalized} now has ${role} access.`)
   }
 
   const setCollaboratorRole = async (userId: string, nextRole: InviteRole) => {
@@ -163,12 +188,7 @@ export function InviteDialog({ open, onOpenChange, doc, isOwner, onAclChange }:
     )
   }
 
-  const ownerName =
-    ownerRecord?.data.name?.trim() ||
-    ownerRecord?.data.email?.trim() ||
-    user?.name ||
-    user?.email ||
-    'Owner'
+  const ownerName = ownerRecord?.name?.trim() || user?.name || user?.email || 'Owner'
 
   return (
     <Modal
@@ -216,6 +236,10 @@ export function InviteDialog({ open, onOpenChange, doc, isOwner, onAclChange }:
             <select
               value={role}
               onChange={(e) => setRole(e.target.value as InviteRole)}
+              // addInvite grants the role captured when Add was pressed; lock
+              // the select while the lookup and save run so the UI cannot show
+              // one role and grant another.
+              disabled={!ready || saving}
               className="h-10 rounded-lg border bg-transparent px-3 text-sm font-medium outline-none focus-visible:ring-2 focus-visible:ring-ring/30"
               style={{ borderColor: 'var(--documents-el-line)', color: 'var(--documents-el-text)' }}
             >
@@ -251,7 +275,7 @@ export function InviteDialog({ open, onOpenChange, doc, isOwner, onAclChange }:
               <div className="min-w-0 flex-1">
                 <div className="truncate text-sm font-medium">{ownerName}</div>
                 <div className="truncate text-xs" style={{ color: 'var(--documents-el-muted)' }}>
-                  {ownerRecord?.data.email ?? user?.email ?? 'Owner'}
+                  {ownerRecord?.email ?? user?.email ?? 'Owner'}
                 </div>
               </div>
               <span className="inline-flex items-center gap-1 rounded-full border px-2.5 py-1 text-xs font-medium">
@@ -261,39 +285,36 @@ export function InviteDialog({ open, onOpenChange, doc, isOwner, onAclChange }:
             </div>
 
             {collaboratorRecords.map((u) => {
-              const name = u.data.name?.trim() || u.data.email?.trim() || 'Collaborator'
-              const userRole: InviteRole = editors.includes(u.recordId) ? 'editor' : 'viewer'
+              const userRole: InviteRole = editors.includes(u.id) ? 'editor' : 'viewer'
               return (
                 <div
-                  key={u.recordId}
+                  key={u.id}
                   className="flex items-center gap-3 rounded-xl border p-3"
                   style={{ borderColor: 'var(--documents-el-line)' }}
                 >
-                  {u.data.imageUrl ? (
+                  {u.imageUrl ? (
                     <img
-                      src={u.data.imageUrl}
+                      src={u.imageUrl}
                       alt=""
                       className="h-9 w-9 shrink-0 rounded-full object-cover"
                     />
                   ) : (
                     <div className="flex h-9 w-9 shrink-0 items-center justify-center rounded-full bg-black/5 text-xs font-bold dark:bg-white/10">
-                      {initialsFor(name)}
+                      {initialsFor(u.name)}
                     </div>
                   )}
                   <div className="min-w-0 flex-1">
-                    <div className="truncate text-sm font-medium">{name}</div>
+                    <div className="truncate text-sm font-medium">{u.name}</div>
                     <div
                       className="truncate text-xs"
                       style={{ color: 'var(--documents-el-muted)' }}
                     >
-                      {u.data.email ?? 'No email'}
+                      {u.email ?? (userRole === 'editor' ? 'Can edit' : 'Can view')}
                     </div>
                   </div>
                   <select
                     value={userRole}
-                    onChange={(e) =>
-                      void setCollaboratorRole(u.recordId, e.target.value as InviteRole)
-                    }
+                    onChange={(e) => void setCollaboratorRole(u.id, e.target.value as InviteRole)}
                     disabled={!ready || saving}
                     className="h-8 rounded-lg border bg-transparent px-2 text-xs font-medium outline-none"
                     style={{
@@ -306,7 +327,7 @@ export function InviteDialog({ open, onOpenChange, doc, isOwner, onAclChange }:
                   </select>
                   <button
                     type="button"
-                    onClick={() => void removeCollaborator(u.recordId)}
+                    onClick={() => void removeCollaborator(u.id)}
                     disabled={!ready || saving}
                     className="rounded-lg p-1.5 text-red-600 transition-colors hover:bg-red-500/10 disabled:opacity-50"
                     title="Remove access"

package/features/documents/src/__tests__/documents-find-invitee-action.test.ts

@@ -0,0 +1,131 @@
+import { describe, expect, it, vi } from 'vitest'
+import type { ActionContext, ActionTools } from 'deepspace/worker'
+import { documentsFindInviteeAction } from '../documents-find-invitee-action'
+
+type Doc = { ownerId: string }
+type UserRow = { email: string; name: string }
+
+/**
+ * The action's tools run RBAC-off, so the fake answers whatever the handler
+ * asks for; the assertions are about what the handler asks for and returns.
+ */
+function fakeTools(opts: {
+  document?: Doc | null
+  users?: Array<{ recordId: string; data: UserRow }>
+  usersQueryFails?: boolean
+}): ActionTools & { query: ReturnType<typeof vi.fn> } {
+  const get = vi.fn(async () =>
+    opts.document
+      ? {
+          success: true as const,
+          data: {
+            record: {
+              recordId: 'doc-1',
+              data: opts.document,
+              createdBy: opts.document.ownerId,
+              createdAt: 't',
+              updatedAt: 't',
+            },
+          },
+        }
+      : { success: false as const, error: 'Record not found' },
+  )
+  const query = vi.fn(async () =>
+    opts.usersQueryFails
+      ? { success: false as const, error: 'boom' }
+      : {
+          success: true as const,
+          data: {
+            records: (opts.users ?? []).map((u) => ({
+              ...u,
+              createdBy: u.recordId,
+              createdAt: 't',
+              updatedAt: 't',
+            })),
+            count: (opts.users ?? []).length,
+          },
+        },
+  )
+  return { get, query } as unknown as ActionTools & { query: ReturnType<typeof vi.fn> }
+}
+
+function ctx(userId: string, params: Record<string, unknown>, tools: ActionTools): ActionContext {
+  return { userId, params, tools, env: {}, callerJwt: 'jwt' }
+}
+
+describe('documentsFindInviteeAction', () => {
+  it('refuses a call without a document id or an email', async () => {
+    const tools = fakeTools({ document: { ownerId: 'owner' } })
+    expect(await documentsFindInviteeAction(ctx('owner', { email: 'b@x.test' }, tools))).toEqual({
+      success: false,
+      error: 'docId and email are required',
+    })
+    expect(await documentsFindInviteeAction(ctx('owner', { docId: 'doc-1' }, tools))).toEqual({
+      success: false,
+      error: 'docId and email are required',
+    })
+    expect(tools.query).not.toHaveBeenCalled()
+  })
+
+  it('refuses an unknown document with the same answer as a foreign one (no existence oracle)', async () => {
+    const tools = fakeTools({ document: null })
+    const result = await documentsFindInviteeAction(
+      ctx('owner', { docId: 'missing', email: 'b@x.test' }, tools),
+    )
+    expect(result).toEqual({ success: false, error: 'Only the document owner can share it' })
+    expect(tools.query).not.toHaveBeenCalled()
+  })
+
+  it('refuses a caller who is not the document owner without touching the users table', async () => {
+    const tools = fakeTools({
+      document: { ownerId: 'owner' },
+      users: [{ recordId: 'u-b', data: { email: 'b@x.test', name: 'B' } }],
+    })
+    const result = await documentsFindInviteeAction(
+      ctx('editor', { docId: 'doc-1', email: 'b@x.test' }, tools),
+    )
+    expect(result).toEqual({ success: false, error: 'Only the document owner can share it' })
+    expect(tools.query).not.toHaveBeenCalled()
+  })
+
+  it('resolves an exact email to the public user id for the document owner', async () => {
+    const tools = fakeTools({
+      document: { ownerId: 'owner' },
+      users: [{ recordId: 'u-b', data: { email: 'b@x.test', name: 'B' } }],
+    })
+    const result = await documentsFindInviteeAction(
+      ctx('owner', { docId: 'doc-1', email: 'b@x.test' }, tools),
+    )
+    // Exactly the id: no email, name, or other column leaves the action.
+    expect(result).toEqual({ success: true, data: { found: true, userId: 'u-b' } })
+    expect(tools.query).toHaveBeenCalledTimes(1)
+    expect(tools.query).toHaveBeenCalledWith('users', { where: { email: 'b@x.test' }, limit: 1 })
+  })
+
+  it('normalizes the email the way the auth plane stores it before matching', async () => {
+    const tools = fakeTools({
+      document: { ownerId: 'owner' },
+      users: [{ recordId: 'u-b', data: { email: 'b@x.test', name: 'B' } }],
+    })
+    await documentsFindInviteeAction(
+      ctx('owner', { docId: 'doc-1', email: '  B@X.Test \n' }, tools),
+    )
+    expect(tools.query).toHaveBeenCalledWith('users', { where: { email: 'b@x.test' }, limit: 1 })
+  })
+
+  it('reports found: false when nobody with that email has signed in', async () => {
+    const tools = fakeTools({ document: { ownerId: 'owner' }, users: [] })
+    const result = await documentsFindInviteeAction(
+      ctx('owner', { docId: 'doc-1', email: 'nobody@x.test' }, tools),
+    )
+    expect(result).toEqual({ success: true, data: { found: false } })
+  })
+
+  it('surfaces a failed users query instead of reporting not found', async () => {
+    const tools = fakeTools({ document: { ownerId: 'owner' }, usersQueryFails: true })
+    const result = await documentsFindInviteeAction(
+      ctx('owner', { docId: 'doc-1', email: 'b@x.test' }, tools),
+    )
+    expect(result).toEqual({ success: false, error: 'User lookup failed' })
+  })
+})

package/features/documents/src/__tests__/documents-invitee-lookup.test.ts

@@ -0,0 +1,67 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+// The lookup signs its request with the app session's bearer token; the
+// dialog imports it from the public `deepspace` entry, so mock that boundary.
+vi.mock('deepspace', () => ({ getAuthToken: async () => 'jwt-123' }))
+
+import { findDocumentsInvitee } from '../documents-invitee-lookup'
+
+function jsonResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  })
+}
+
+describe('findDocumentsInvitee', () => {
+  const fetchMock = vi.fn<typeof fetch>()
+
+  beforeEach(() => {
+    fetchMock.mockReset()
+    vi.stubGlobal('fetch', fetchMock)
+  })
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('posts the document id and email to the feature action with the session bearer', async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse(200, { success: true, data: { found: true, userId: 'u-b' } }),
+    )
+
+    const result = await findDocumentsInvitee('doc-1', 'b@x.test')
+
+    expect(result).toEqual({ found: true, userId: 'u-b' })
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+    const [url, init] = fetchMock.mock.calls[0]
+    expect(url).toBe('/api/actions/documents-find-invitee')
+    expect(init?.method).toBe('POST')
+    expect(new Headers(init?.headers).get('Authorization')).toBe('Bearer jwt-123')
+    expect(new Headers(init?.headers).get('Content-Type')).toBe('application/json')
+    expect(JSON.parse(String(init?.body))).toEqual({ docId: 'doc-1', email: 'b@x.test' })
+  })
+
+  it('passes a not-found answer through unchanged', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(200, { success: true, data: { found: false } }))
+    expect(await findDocumentsInvitee('doc-1', 'nobody@x.test')).toEqual({ found: false })
+  })
+
+  it("throws the action's own refusal text so the dialog can show it", async () => {
+    fetchMock.mockResolvedValue(
+      jsonResponse(200, { success: false, error: 'Only the document owner can share it' }),
+    )
+    await expect(findDocumentsInvitee('doc-1', 'b@x.test')).rejects.toThrow(
+      'Only the document owner can share it',
+    )
+  })
+
+  it('throws a status-bearing error when the route itself fails', async () => {
+    fetchMock.mockResolvedValue(new Response('<html>', { status: 502 }))
+    await expect(findDocumentsInvitee('doc-1', 'b@x.test')).rejects.toThrow('Lookup failed (502)')
+  })
+
+  it('throws when the action route is missing (feature installed without its action)', async () => {
+    fetchMock.mockResolvedValue(jsonResponse(404, { error: 'Action not found' }))
+    await expect(findDocumentsInvitee('doc-1', 'b@x.test')).rejects.toThrow('Action not found')
+  })
+})

package/features/documents/src/documents-find-invitee-action.ts

@@ -0,0 +1,56 @@
+/**
+ * Documents feature — owner-only invitee lookup.
+ *
+ * The Share dialog resolves an email to a user id. The client cannot do that
+ * itself: the scaffold's users schema is `member: { read: 'own' }`, so an
+ * ordinary member's `useQuery('users')` holds only their own row, and the
+ * `useUsers()` roster is projected to public identity (no email). Only the
+ * app owner (admin) reads full rows.
+ *
+ * Tools run RBAC-off, so this action is the authorization boundary: only the
+ * owner of `docId` may ask, only by exact email, and the answer is the public
+ * id alone — the same id every signed-in member already sees in the roster.
+ *
+ * What it deliberately adds: any member who owns a document (members can
+ * create one) can learn whether an exact address has signed in to this app.
+ * That is the price of invite-by-email; there is no list surface and no rate
+ * limit here. Being RBAC-off, the query also ignores a users schema's
+ * `roster: 'read-policy'` partitioning — an app that must not resolve
+ * addresses across tenants should remove or adapt this action.
+ */
+
+import type { ActionHandler } from 'deepspace/worker'
+
+export type DocumentsInviteeLookup = { found: false } | { found: true; userId: string }
+
+type DocumentRow = { ownerId?: string }
+type UserRow = { email?: string }
+
+// `<unknown>`: the lookup never reads `env`, so it registers under any app's
+// `Record<string, ActionHandler<Env>>` without naming that app's bindings.
+export const documentsFindInviteeAction: ActionHandler<unknown> = async ({
+  userId,
+  params,
+  tools,
+}) => {
+  const docId = typeof params.docId === 'string' ? params.docId : ''
+  // The room stores emails lowercased (registerUser), so exact equality on the
+  // normalized input is the whole match.
+  const email = typeof params.email === 'string' ? params.email.trim().toLowerCase() : ''
+  if (!docId || !email) return { success: false, error: 'docId and email are required' }
+
+  // One refusal for "no such document" and "not yours": a distinct not-found
+  // answer would let any member probe which document ids exist.
+  const doc = await tools.get<DocumentRow>('documents', docId)
+  if (!doc.success || doc.data.record.data.ownerId !== userId) {
+    return { success: false, error: 'Only the document owner can share it' }
+  }
+
+  const users = await tools.query<UserRow>('users', { where: { email }, limit: 1 })
+  if (!users.success) return { success: false, error: 'User lookup failed' }
+  const match = users.data.records[0]
+  const data: DocumentsInviteeLookup = match
+    ? { found: true, userId: match.recordId }
+    : { found: false }
+  return { success: true, data }
+}

package/features/documents/src/documents-invitee-lookup.ts

@@ -0,0 +1,38 @@
+/**
+ * Client half of the Share dialog's invitee lookup: calls the feature's
+ * owner-only server action (`src/actions/documents-find-invitee.ts`) with the
+ * app session's bearer token and hands back its answer.
+ *
+ * Kept apart from the dialog so the wire contract is testable without
+ * rendering the modal.
+ */
+
+import { getAuthToken } from 'deepspace'
+import type { ActionResult } from 'deepspace/worker'
+import type { DocumentsInviteeLookup } from '@/actions/documents-find-invitee'
+
+const ACTION_PATH = '/api/actions/documents-find-invitee'
+
+/** The action's own result envelope, or the route's `{ error }` for 401/404. */
+type ActionEnvelope = ActionResult<DocumentsInviteeLookup> | { error?: string }
+
+/** Throws with the action's own refusal text, or a status-bearing message. */
+export async function findDocumentsInvitee(
+  docId: string,
+  email: string,
+): Promise<DocumentsInviteeLookup> {
+  const token = await getAuthToken()
+  const res = await fetch(ACTION_PATH, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    },
+    body: JSON.stringify({ docId, email }),
+  })
+  const body = (await res.json().catch(() => null)) as ActionEnvelope | null
+  if (!res.ok || !body || !('success' in body) || !body.success) {
+    throw new Error((body && 'error' in body && body.error) || `Lookup failed (${res.status})`)
+  }
+  return body.data
+}

package/features/documents/src/documents-ui.css

@@ -178,12 +178,22 @@
   color: var(--documents-editor-paper-muted);
 }
 
+/* Tailwind's preflight resets `ul, ol { list-style: none }`; the editor's
+   lists need their markers back. The task-list rule below opts back out. */
 .documents-paged-editor .ProseMirror ul,
 .documents-paged-editor .ProseMirror ol {
   padding-left: 1.4em;
   margin: 0 0 0.45em;
 }
 
+.documents-paged-editor .ProseMirror ul {
+  list-style-type: disc;
+}
+
+.documents-paged-editor .ProseMirror ol {
+  list-style-type: decimal;
+}
+
 .documents-paged-editor .ProseMirror ul[data-type='taskList'] {
   list-style: none;
   padding: 0;