From 7f8b367076747bddb304c3b8e4dc9a5ee5fc4cb1 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Mon, 21 Sep 2026 17:34:16 +0000
Subject: [PATCH 01/18] feat(workspace): document portability and private reuse

---
 .env.example                                  |   1 +
 .../features/workspace/WorkspaceEditor.tsx    |  41 ++-
 .../workspace/WorkspacePortabilityPanel.tsx   | 219 ++++++++++++++
 src/lib/workspace/document-conversion.ts      | 246 +++++++++++++--
 src/lib/workspace/google-drive.ts             | 112 +++++++
 src/lib/workspace/portability-client.ts       | 120 ++++++++
 src/locales/en.json                           |  27 ++
 src/locales/es.json                           |  27 ++
 src/locales/hu.json                           |  27 ++
 src/pages/LibraryPage.tsx                     |  21 ++
 src/pages/WorkspacePage.tsx                   |  19 ++
 .../workspace/document-conversion.test.ts     |  16 +
 supabase/README.md                            |   5 +-
 supabase/config.toml                          |   6 +
 .../functions/_shared/google-connections.ts   | 134 +++++++++
 .../functions/google-connections/index.ts     | 154 ++++++++++
 .../functions/workspace-google-docs/index.ts  | 193 ++++++++++++
 .../20260921190000_workspace_portability.sql  | 281 ++++++++++++++++++
 18 files changed, 1616 insertions(+), 33 deletions(-)
 create mode 100644 src/components/features/workspace/WorkspacePortabilityPanel.tsx
 create mode 100644 src/lib/workspace/google-drive.ts
 create mode 100644 src/lib/workspace/portability-client.ts
 create mode 100644 supabase/functions/_shared/google-connections.ts
 create mode 100644 supabase/functions/google-connections/index.ts
 create mode 100644 supabase/functions/workspace-google-docs/index.ts
 create mode 100644 supabase/migrations/20260921190000_workspace_portability.sql

diff --git a/.env.example b/.env.example
index a3f0218a8..11ddf9ec9 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,4 @@
 VITE_SENTRY_DSN=
 VITE_POSTHOG_KEY=
 VITE_POSTHOG_HOST=https://eu.i.posthog.com
+VITE_GOOGLE_PICKER_API_KEY=
diff --git a/src/components/features/workspace/WorkspaceEditor.tsx b/src/components/features/workspace/WorkspaceEditor.tsx
index cea48f2e7..59593afd4 100644
--- a/src/components/features/workspace/WorkspaceEditor.tsx
+++ b/src/components/features/workspace/WorkspaceEditor.tsx
@@ -21,6 +21,8 @@ import { createProposal, createQuoteAnchor, type ProposalHunkInput } from "@/lib
 import { createWorkspaceComment, saveWorkspaceProposal } from "@/lib/workspace/client";
 import { useOnlineStatus } from "@/hooks/use-online-status";
 import type { WorkspaceSource } from "@/lib/workspace/practice-client";
+import type { JSONContent } from "@tiptap/core";
+import { savePrivateWritingItem } from "@/lib/workspace/portability-client";
 
 const acknowledgementSchema = z.object({
   epoch: z.number().int().nonnegative(),
@@ -34,6 +36,7 @@ export type SaveStatus = "Offline" | "Saved" | "Saving";
 export function WorkspaceEditor({
   documentId,
   citationToInsert,
+  contentToInsert,
   aiSuggestion,
   editable,
   epoch,
@@ -44,12 +47,15 @@ export function WorkspaceEditor({
   workspaceId,
   onDurableSequence,
   onCitationInserted,
+  onContentInserted,
   onAiSuggestionConsumed,
   onSaveStatus,
   onTextChange,
+  onDocumentChange,
 }: {
   documentId: string;
   citationToInsert?: WorkspaceSource | null;
+  contentToInsert?: { content: JSONContent; id: string; mode: "insert" | "replace" } | null;
   aiSuggestion?: { id: string; text: string } | null;
   editable: boolean;
   epoch: number;
@@ -60,9 +66,11 @@ export function WorkspaceEditor({
   workspaceId: string;
   onDurableSequence?: (sequence: number) => void;
   onCitationInserted?: () => void;
+  onContentInserted?: () => void;
   onAiSuggestionConsumed?: () => void;
   onSaveStatus?: (status: SaveStatus) => void;
   onTextChange?: (text: string) => void;
+  onDocumentChange?: (content: JSONContent) => void;
 }) {
   const { t } = useTranslation();
   const online = useOnlineStatus();
@@ -243,7 +251,10 @@ export function WorkspaceEditor({
         provider,
         user: { color: `hsl(${Math.abs(userId.charCodeAt(0) * 47) % 360} 70% 45%)`, name: userName },
       });
-      reportText = () => onTextChange?.(activeEditor?.getText() ?? "");
+      reportText = () => {
+        onTextChange?.(activeEditor?.getText() ?? "");
+        if (activeEditor) onDocumentChange?.(activeEditor.getJSON());
+      };
       activeEditor.on("update", reportText);
       reportText();
       document.on("update", (_update, origin) => {
@@ -268,7 +279,7 @@ export function WorkspaceEditor({
       provider?.destroy();
       document.destroy();
     };
-  }, [documentId, editable, epoch, identity, onDurableSequence, onTextChange, online, queryClient, t, token, userId, userName, workspaceId]);
+  }, [documentId, editable, epoch, identity, onDocumentChange, onDurableSequence, onTextChange, online, queryClient, t, token, userId, userName, workspaceId]);
 
   useEffect(() => {
     if (!editor || !citationToInsert) return;
@@ -286,6 +297,30 @@ export function WorkspaceEditor({
     onCitationInserted?.();
   }, [citationToInsert, editor, onCitationInserted]);
 
+  useEffect(() => {
+    if (!editor || !contentToInsert || status !== "Saved") return;
+    if (contentToInsert.mode === "replace") editor.commands.setContent(contentToInsert.content);
+    else editor.chain().focus().insertContent(contentToInsert.content.content ?? []).run();
+    onContentInserted?.();
+  }, [contentToInsert, editor, onContentInserted, status]);
+
+  const saveWriting = async (kind: "snippet" | "template") => {
+    if (!editor) return;
+    const content = kind === "snippet"
+      ? { type: "doc", content: editor.state.selection.content().content.toJSON() }
+      : editor.getJSON();
+    if (kind === "snippet" && !content.content.length) return;
+    const title = window.prompt(t(kind === "snippet" ? "workspaces.snippetTitlePrompt" : "workspaces.templateTitlePrompt"));
+    if (!title?.trim()) return;
+    await savePrivateWritingItem({
+      content,
+      kind,
+      provenance: { documentEpoch: epoch, documentId, workspaceId },
+      title: title.trim(),
+    });
+    await queryClient.invalidateQueries({ queryKey: ["private-writing-items"] });
+  };
+
   useEffect(() => {
     if (!editor || !aiSuggestion || status !== "Saved") return;
     onAiSuggestionConsumed?.();
@@ -326,6 +361,8 @@ export function WorkspaceEditor({
         <Button type="button" size="sm" variant="ghost" onClick={() => editor.chain().focus().insertTable({ cols: 2, rows: 2, withHeaderRow: true }).run()}>{t("workspaces.table", "Table")}</Button>
         <Input className="h-9 w-48" aria-label={t("workspaces.linkUrl", "Link URL")} value={link} onChange={(event) => setLink(event.target.value)} />
         <Button type="button" size="sm" variant="outline" onClick={() => editor.chain().focus().setLink({ href: link }).run()}>{t("workspaces.link", "Link")}</Button>
+        <Button type="button" size="sm" variant="outline" disabled={editor.state.selection.empty} onClick={() => void saveWriting("snippet")}>{t("workspaces.saveSnippet", "Save snippet")}</Button>
+        <Button type="button" size="sm" variant="outline" onClick={() => void saveWriting("template")}>{t("workspaces.saveTemplate", "Save template")}</Button>
         <Button type="button" size="sm" variant="ghost" onClick={() => editor.commands.undo()}>{t("workspaces.undo", "Undo")}</Button>
         <Button type="button" size="sm" variant="ghost" onClick={() => editor.commands.redo()}>{t("workspaces.redo", "Redo")}</Button>
         <Button type="button" size="sm" variant="ghost" disabled={!online} onClick={() => setCommentOpen((current) => !current)}>{t("workspaces.comment", "Comment")}</Button>
diff --git a/src/components/features/workspace/WorkspacePortabilityPanel.tsx b/src/components/features/workspace/WorkspacePortabilityPanel.tsx
new file mode 100644
index 000000000..c6ae96394
--- /dev/null
+++ b/src/components/features/workspace/WorkspacePortabilityPanel.tsx
@@ -0,0 +1,219 @@
+import { useState } from "react";
+import type { JSONContent } from "@tiptap/core";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { useTranslation } from "react-i18next";
+import { Button } from "@/components/ui/button";
+import { Textarea } from "@/components/ui/textarea";
+import {
+  previewWorkspaceImport,
+  fromWorkspaceMarkdown,
+  toWorkspaceMarkdown,
+  toWorkspaceDocx,
+  toWorkspacePacketDocx,
+  toWorkspacePacketPdf,
+  toWorkspacePdf,
+} from "@/lib/workspace/document-conversion";
+import { listWorkspacePractice } from "@/lib/workspace/practice-client";
+import {
+  deletePrivateWritingItem,
+  getWorkspaceExportManifest,
+  listPrivateWritingItems,
+  saveWorkspaceDocumentProvenance,
+} from "@/lib/workspace/portability-client";
+import { workspaceSchema } from "@/lib/workspace/schema";
+import {
+  connectGoogleAccount,
+  disconnectGoogleAccount,
+  exportGoogleDocument,
+  importGoogleDocument,
+  listGoogleConnections,
+  pickGoogleDocument,
+} from "@/lib/workspace/google-drive";
+
+function download(bytes: Uint8Array, name: string, type: string) {
+  const blob = new Blob([new Uint8Array(bytes)], { type });
+  const url = URL.createObjectURL(blob);
+  const link = document.createElement("a");
+  link.href = url;
+  link.download = name;
+  link.click();
+  URL.revokeObjectURL(url);
+}
+
+export function WorkspacePortabilityPanel({
+  content,
+  documentId,
+  documentTitle,
+  onInsertContent,
+  userId,
+  workspaceId,
+}: {
+  content: JSONContent;
+  documentId: string;
+  documentTitle: string;
+  onInsertContent: (content: JSONContent, mode: "insert" | "replace") => void;
+  userId: string;
+  workspaceId: string;
+}) {
+  const { t } = useTranslation();
+  const queryClient = useQueryClient();
+  const [preview, setPreview] = useState<{
+    content: JSONContent;
+    markdown: string;
+    name: string;
+    provenance: Record<string, unknown>;
+    sourceKind: "markdown" | "docx" | "google_docs";
+    warnings: string[];
+  } | null>(null);
+  const [selectedArtifactIds, setSelectedArtifactIds] = useState<string[]>([]);
+  const [includeReview, setIncludeReview] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [connectionId, setConnectionId] = useState("");
+  const [googleExportRequestId, setGoogleExportRequestId] = useState(() => crypto.randomUUID());
+  const library = useQuery({ queryKey: ["private-writing-items", userId], queryFn: listPrivateWritingItems });
+  const practice = useQuery({ queryKey: ["workspace-practice", userId, workspaceId], queryFn: () => listWorkspacePractice(workspaceId) });
+  const connections = useQuery({ queryKey: ["google-connections", userId], queryFn: listGoogleConnections });
+  const selectedConnectionId = connectionId || connections.data?.[0]?.id || "";
+  const run = async (operation: () => Promise<void>) => {
+    if (busy) return;
+    setBusy(true);
+    setError(null);
+    try {
+      await operation();
+    } catch (cause) {
+      setError(cause instanceof Error ? cause.message : t("workspaces.portabilityFailed", "The document operation failed."));
+    } finally {
+      setBusy(false);
+    }
+  };
+  const insertItem = (value: unknown, mode: "insert" | "replace") => {
+    try {
+      onInsertContent(workspaceSchema.nodeFromJSON(value).toJSON(), mode);
+    } catch {
+      setError(t("workspaces.invalidLibraryItem", "This saved item is not a valid workspace document."));
+    }
+  };
+  const packet = async (format: "docx" | "pdf") => {
+    const manifest = await getWorkspaceExportManifest(workspaceId, selectedArtifactIds, includeReview);
+    const bytes = format === "docx" ? await toWorkspacePacketDocx(manifest) : await toWorkspacePacketPdf(manifest);
+    download(bytes, `workspace-packet.${format}`, format === "docx" ? "application/vnd.openxmlformats-officedocument.wordprocessingml.document" : "application/pdf");
+  };
+
+  return (
+    <details className="rounded-lg border border-border bg-card p-3">
+      <summary className="cursor-pointer font-medium">{t("workspaces.portability", "Import, reuse & export")}</summary>
+
+      <div className="mt-3 grid gap-2">
+        <p className="text-xs font-medium">{t("workspaces.privateWriting", "Private snippets and templates")}</p>
+        {library.data?.map((item) => (
+          <div key={item.id} className="flex flex-wrap items-center gap-1 rounded-md border border-border p-2 text-sm">
+            <span className="mr-auto min-w-0 truncate"><span className="text-xs text-muted-foreground">{item.kind}</span> · {item.title}</span>
+            <Button type="button" size="sm" variant="outline" onClick={() => insertItem(item.content, "insert")}>{t("workspaces.insertCopy", "Insert copy")}</Button>
+            {item.kind === "template" && <Button type="button" size="sm" variant="outline" onClick={() => insertItem(item.content, "replace")}>{t("workspaces.useTemplate", "Use template")}</Button>}
+            <Button type="button" size="sm" variant="ghost" disabled={busy} onClick={() => void run(async () => {
+              await deletePrivateWritingItem(item.id);
+              await queryClient.invalidateQueries({ queryKey: ["private-writing-items"] });
+            })}>{t("common.delete", "Delete")}</Button>
+          </div>
+        ))}
+      </div>
+
+      <div className="mt-3 grid gap-2 border-t border-border pt-3">
+        <label className="text-xs font-medium" htmlFor="workspace-document-import">{t("workspaces.importSpeech", "Import Markdown or DOCX")}</label>
+        <input id="workspace-document-import" type="file" accept=".md,.markdown,.docx,text/markdown,application/vnd.openxmlformats-officedocument.wordprocessingml.document" disabled={busy} onChange={(event) => {
+          const file = event.target.files?.[0];
+          if (!file) return;
+          void run(async () => {
+            const imported = await previewWorkspaceImport(file);
+            setPreview({
+              ...imported,
+              name: file.name,
+              provenance: { fileName: file.name, fileSize: file.size, importedAt: new Date().toISOString() },
+              sourceKind: file.name.toLowerCase().endsWith(".docx") ? "docx" : "markdown",
+            });
+          });
+        }} />
+        {preview && (
+          <div className="grid gap-2 rounded-md border border-border p-2">
+            <p className="text-xs font-medium">{preview.name}</p>
+            {preview.warnings.map((warning) => <p key={warning} className="text-xs text-amber-700 dark:text-amber-300">{warning}</p>)}
+            <Textarea aria-label={t("workspaces.importPreview", "Import preview")} className="min-h-40" readOnly value={preview.markdown} />
+            <Button type="button" size="sm" disabled={busy} onClick={() => void run(async () => {
+              await saveWorkspaceDocumentProvenance({ documentId, provenance: preview.provenance, sourceKind: preview.sourceKind, workspaceId });
+              onInsertContent(preview.content, "replace");
+              setPreview(null);
+            })}>{t("workspaces.replaceWithImport", "Replace with independent copy")}</Button>
+          </div>
+        )}
+      </div>
+
+      <div className="mt-3 grid gap-2 border-t border-border pt-3">
+        <p className="text-xs font-medium">{t("workspaces.exportDocument", "Export this document")}</p>
+        <div className="flex gap-2">
+          <Button type="button" size="sm" variant="outline" disabled={busy} onClick={() => void run(async () => download(await toWorkspaceDocx(content), `${documentTitle}.docx`, "application/vnd.openxmlformats-officedocument.wordprocessingml.document"))}>DOCX</Button>
+          <Button type="button" size="sm" variant="outline" disabled={busy} onClick={() => void run(async () => download(await toWorkspacePdf(content), `${documentTitle}.pdf`, "application/pdf"))}>PDF</Button>
+        </div>
+        <p className="text-xs font-medium">{t("workspaces.packetArtifacts", "Practice feedback to include")}</p>
+        {practice.data?.artifacts.filter((item) => item.status === "complete").map((artifact) => (
+          <label key={artifact.id} className="flex items-center gap-2 text-xs">
+            <input type="checkbox" checked={selectedArtifactIds.includes(artifact.id)} onChange={() => setSelectedArtifactIds((current) => current.includes(artifact.id) ? current.filter((id) => id !== artifact.id) : [...current, artifact.id])} />
+            {artifact.tool} · {new Date(artifact.created_at).toLocaleDateString()}
+          </label>
+        ))}
+        <label className="flex items-center gap-2 text-xs">
+          <input type="checkbox" checked={includeReview} onChange={(event) => setIncludeReview(event.target.checked)} />
+          {t("workspaces.includeReviewAppendix", "Include labelled review appendix")}
+        </label>
+        <div className="flex gap-2">
+          <Button type="button" size="sm" variant="outline" disabled={busy} onClick={() => void run(() => packet("docx"))}>{t("workspaces.exportPacketDocx", "Packet DOCX")}</Button>
+          <Button type="button" size="sm" variant="outline" disabled={busy} onClick={() => void run(() => packet("pdf"))}>{t("workspaces.exportPacketPdf", "Packet PDF")}</Button>
+        </div>
+      </div>
+
+      <div className="mt-3 grid gap-2 border-t border-border pt-3">
+        <p className="text-xs font-medium">{t("workspaces.googleAccounts", "Google Drive accounts")}</p>
+        {connections.data?.length ? (
+          <>
+            <select className="h-9 rounded-md border border-input bg-background px-3 text-sm" aria-label={t("workspaces.googleAccount", "Google account")} value={selectedConnectionId} onChange={(event) => setConnectionId(event.target.value)}>
+              {connections.data.map((connection) => <option key={connection.id} value={connection.id}>{connection.account_label} · {connection.email}</option>)}
+            </select>
+            <div className="flex flex-wrap gap-2">
+              <Button type="button" size="sm" variant="outline" disabled={busy || !selectedConnectionId} onClick={() => void run(async () => {
+                const picked = await pickGoogleDocument(selectedConnectionId);
+                const imported = await importGoogleDocument(selectedConnectionId, picked.id);
+                const markdown = imported.tabs.map((tab) => `# ${tab.title}\n\n${tab.markdown}`).join("\n\n");
+                setPreview({
+                  content: fromWorkspaceMarkdown(markdown),
+                  markdown,
+                  name: imported.title,
+                  provenance: {
+                    accountConnectionId: imported.accountConnectionId,
+                    modifiedTime: imported.modifiedTime,
+                    revision: imported.revision,
+                    sourceUrl: imported.sourceUrl,
+                    tabs: imported.tabs.map((tab) => tab.title),
+                  },
+                  sourceKind: "google_docs",
+                  warnings: [],
+                });
+              })}>{t("workspaces.importGoogleDoc", "Choose Google Doc")}</Button>
+              <Button type="button" size="sm" variant="outline" disabled={busy || !selectedConnectionId} onClick={() => void run(async () => {
+                const exported = await exportGoogleDocument({ connectionId: selectedConnectionId, markdown: toWorkspaceMarkdown(content), requestId: googleExportRequestId, title: documentTitle });
+                setGoogleExportRequestId(crypto.randomUUID());
+                window.open(exported.url, "_blank", "noopener,noreferrer");
+              })}>{t("workspaces.exportGoogleDoc", "Export new Google Doc")}</Button>
+              <Button type="button" size="sm" variant="ghost" disabled={busy || !selectedConnectionId} onClick={() => void run(async () => {
+                await disconnectGoogleAccount(selectedConnectionId);
+                setConnectionId("");
+                await queryClient.invalidateQueries({ queryKey: ["google-connections", userId] });
+              })}>{t("workspaces.disconnectGoogle", "Disconnect")}</Button>
+            </div>
+          </>
+        ) : <p className="text-xs text-muted-foreground">{t("workspaces.noGoogleAccounts", "Connect a Google account to import or export Docs without changing your DebateLab login.")}</p>}
+        <Button type="button" size="sm" variant="outline" disabled={busy} onClick={() => void connectGoogleAccount(`/app/workspaces/${workspaceId}`)}>{t("workspaces.connectGoogle", "Connect another Google account")}</Button>
+      </div>
+      {error && <p role="alert" className="mt-2 text-sm text-destructive">{error}</p>}
+    </details>
+  );
+}
diff --git a/src/lib/workspace/document-conversion.ts b/src/lib/workspace/document-conversion.ts
index cd838d4f8..e075c1896 100644
--- a/src/lib/workspace/document-conversion.ts
+++ b/src/lib/workspace/document-conversion.ts
@@ -47,12 +47,13 @@ function inlineMarkdown(content: JSONContent[] = []) {
 
 function serializeList(node: JSONContent, depth = 0): string {
   const lines: string[] = [];
-  for (const item of node.content ?? []) {
+  for (const [index, item] of (node.content ?? []).entries()) {
     const blocks = item.content ?? [];
     const paragraph = blocks.find((block) => block.type === "paragraph");
-    lines.push(`${"  ".repeat(depth)}- ${inlineMarkdown(paragraph?.content)}`);
+    const marker = node.type === "orderedList" ? `${index + Number(node.attrs?.start ?? 1)}.` : "-";
+    lines.push(`${"  ".repeat(depth)}${marker} ${inlineMarkdown(paragraph?.content)}`);
     for (const child of blocks) {
-      if (child.type === "bulletList") lines.push(serializeList(child, depth + 1));
+      if (child.type === "bulletList" || child.type === "orderedList") lines.push(serializeList(child, depth + 1));
     }
   }
   return lines.join("\n");
@@ -79,7 +80,7 @@ export function toWorkspaceMarkdown(document: JSONContent): string {
       return `${"#".repeat(Number(node.attrs?.level) || 1)} ${inlineMarkdown(node.content)}`;
     }
     if (node.type === "paragraph") return inlineMarkdown(node.content);
-    if (node.type === "bulletList") return serializeList(node);
+    if (node.type === "bulletList" || node.type === "orderedList") return serializeList(node);
     if (node.type === "table") return serializeTable(node);
     return "";
   }).filter(Boolean).join("\n\n");
@@ -111,17 +112,19 @@ function parseCitation(href: string): JSONContent | null {
 
 function parseMarkedText(text: string, extraMarks: JSONContent["marks"] = []): JSONContent[] {
   const nodes: JSONContent[] = [];
-  const pattern = /(\*\*([^*]+)\*\*|\*([^*]+)\*|~~([^~]+)~~)/g;
+  const pattern = /(\*\*\*([^*]+)\*\*\*|\*\*([^*]+)\*\*|\*([^*]+)\*|~~([^~]+)~~)/g;
   let start = 0;
   for (const match of text.matchAll(pattern)) {
     if (match.index > start) {
       nodes.push({ type: "text", text: unescapeMarkdown(text.slice(start, match.index)), marks: extraMarks });
     }
-    const mark = match[2] ? "bold" : match[3] ? "italic" : "strike";
+    const marks = match[2]
+      ? [{ type: "bold" }, { type: "italic" }]
+      : [{ type: match[3] ? "bold" : match[4] ? "italic" : "strike" }];
     nodes.push({
       type: "text",
-      text: unescapeMarkdown(match[2] ?? match[3] ?? match[4]),
-      marks: [...extraMarks, { type: mark }],
+      text: unescapeMarkdown(match[2] ?? match[3] ?? match[4] ?? match[5]),
+      marks: [...extraMarks, ...marks],
     });
     start = match.index + match[0].length;
   }
@@ -190,9 +193,12 @@ function parseTable(lines: string[], start: number) {
 
 function parseList(lines: string[], start: number, indent: number) {
   const items: JSONContent[] = [];
+  const first = /^(\s*)(?:(\d+)\.|[-+*])\s+(.*)$/.exec(lines[start]);
+  const ordered = Boolean(first?.[2]);
+  const order = Number(first?.[2] ?? 1);
   let index = start;
   while (index < lines.length) {
-    const match = /^(\s*)-\s+(.*)$/.exec(lines[index]);
+    const match = /^(\s*)(?:(\d+)\.|[-+*])\s+(.*)$/.exec(lines[index]);
     if (!match || match[1].length < indent) break;
     if (match[1].length > indent) {
       const nested = parseList(lines, index, match[1].length);
@@ -202,11 +208,14 @@ function parseList(lines: string[], start: number, indent: number) {
     }
     items.push({
       type: "listItem",
-      content: [{ type: "paragraph", content: parseInline(match[2]) }],
+      content: [{ type: "paragraph", content: parseInline(match[3]) }],
     });
     index += 1;
   }
-  return { node: { type: "bulletList", content: items } satisfies JSONContent, index };
+  return {
+    node: { type: ordered ? "orderedList" : "bulletList", ...(ordered ? { attrs: { start: order } } : {}), content: items } satisfies JSONContent,
+    index,
+  };
 }
 
 export function fromWorkspaceMarkdown(markdown: string): JSONContent {
@@ -229,7 +238,7 @@ export function fromWorkspaceMarkdown(markdown: string): JSONContent {
       index += 1;
       continue;
     }
-    if (/^\s*-\s+/.test(line)) {
+    if (/^\s*(?:(?:\d+)\.|[-+*])\s+/.test(line)) {
       const list = parseList(lines, index, /^\s*/.exec(line)?.[0].length ?? 0);
       content.push(list.node);
       index = list.index;
@@ -283,10 +292,12 @@ function docxList(node: JSONContent, docx: typeof import("docx"), depth = 0): im
     const paragraph = blocks.find((block) => block.type === "paragraph");
     paragraphs.push(new docx.Paragraph({
       children: docxInline(paragraph?.content, docx),
-      bullet: { level: depth },
+      ...(node.type === "orderedList"
+        ? { numbering: { reference: "workspace-numbering", level: depth } }
+        : { bullet: { level: depth } }),
     }));
     for (const child of blocks) {
-      if (child.type === "bulletList") paragraphs.push(...docxList(child, docx, depth + 1));
+      if (child.type === "bulletList" || child.type === "orderedList") paragraphs.push(...docxList(child, docx, depth + 1));
     }
   }
   return paragraphs;
@@ -305,10 +316,8 @@ function docxTable(node: JSONContent, docx: typeof import("docx")) {
   });
 }
 
-export async function toWorkspaceDocx(document: JSONContent): Promise<Uint8Array> {
-  workspaceSchema.nodeFromJSON(document).check();
-  const docx = await import("docx");
-  const children = (document.content ?? []).flatMap((node) => {
+function docxBlocks(document: JSONContent, docx: typeof import("docx")) {
+  return (document.content ?? []).flatMap((node) => {
     if (node.type === "heading") {
       const levels = [
         docx.HeadingLevel.HEADING_1,
@@ -326,11 +335,31 @@ export async function toWorkspaceDocx(document: JSONContent): Promise<Uint8Array
     if (node.type === "paragraph") {
       return [new docx.Paragraph({ children: docxInline(node.content, docx) })];
     }
-    if (node.type === "bulletList") return docxList(node, docx);
+    if (node.type === "bulletList" || node.type === "orderedList") return docxList(node, docx);
     if (node.type === "table") return [docxTable(node, docx)];
     return [];
   });
-  const file = new docx.Document({ sections: [{ children }] });
+}
+
+export async function toWorkspaceDocx(document: JSONContent): Promise<Uint8Array> {
+  workspaceSchema.nodeFromJSON(document).check();
+  const docx = await import("docx");
+  const children = docxBlocks(document, docx);
+  const file = new docx.Document({
+    numbering: {
+      config: [{
+        reference: "workspace-numbering",
+        levels: Array.from({ length: 9 }, (_, level) => ({
+          alignment: docx.AlignmentType.START,
+          format: docx.LevelFormat.DECIMAL,
+          level,
+          style: { paragraph: { indent: { hanging: 360, left: 720 * (level + 1) } } },
+          text: `%${level + 1}.`,
+        })),
+      }],
+    },
+    sections: [{ children }],
+  });
   return new Uint8Array(await docx.Packer.toBuffer(file));
 }
 
@@ -370,8 +399,10 @@ function htmlParagraph(element: Element): JSONContent {
 }
 
 function htmlList(element: Element): JSONContent {
+  const ordered = element.tagName.toLowerCase() === "ol";
   return {
-    type: "bulletList",
+    type: ordered ? "orderedList" : "bulletList",
+    ...(ordered && element.getAttribute("start") ? { attrs: { start: Number(element.getAttribute("start")) || 1 } } : {}),
     content: Array.from(element.children)
       .filter((child) => child.tagName.toLowerCase() === "li")
       .map((item) => {
@@ -432,12 +463,58 @@ export function fromWorkspaceHtml(html: string): JSONContent {
   return parsed.toJSON();
 }
 
-export async function fromWorkspaceDocx(bytes: Uint8Array): Promise<JSONContent> {
+async function convertWorkspaceDocx(bytes: Uint8Array) {
   const mammoth = await import("mammoth");
   const arrayBuffer = new Uint8Array(bytes).buffer;
   const input = { arrayBuffer, buffer: bytes };
   const result = await mammoth.convertToHtml(input);
-  return fromWorkspaceHtml(result.value);
+  const body = new DOMParser().parseFromString(result.value, "text/html").body;
+  const unsupported = body.querySelectorAll("img,video,audio,iframe,object,embed,svg").length;
+  return {
+    content: fromWorkspaceHtml(result.value),
+    warnings: [
+      ...result.messages.map((message) => message.message),
+      ...(unsupported ? [`${unsupported} unsupported embedded item(s) were omitted.`] : []),
+    ],
+  };
+}
+
+export async function fromWorkspaceDocx(bytes: Uint8Array): Promise<JSONContent> {
+  return (await convertWorkspaceDocx(bytes)).content;
+}
+
+function validateDocxArchive(bytes: Uint8Array) {
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  let total = 0;
+  let entries = 0;
+  for (let offset = 0; offset + 46 <= bytes.byteLength; offset += 1) {
+    if (view.getUint32(offset, true) !== 0x02014b50) continue;
+    total += view.getUint32(offset + 24, true);
+    entries += 1;
+    if (total > 20 * 1024 * 1024 || entries > 2_000) throw new Error("DOCX expands beyond the safe import limit.");
+    offset += 45 + view.getUint16(offset + 28, true) + view.getUint16(offset + 30, true) + view.getUint16(offset + 32, true);
+  }
+  if (!entries) throw new Error("The file is not a valid DOCX archive.");
+}
+
+export async function previewWorkspaceImport(file: File) {
+  if (file.size > 8 * 1024 * 1024) throw new Error("The document exceeds the 8 MB import limit.");
+  const name = file.name.toLowerCase();
+  if (name.endsWith(".md") || name.endsWith(".markdown")) {
+    const markdown = await file.text();
+    if (new TextEncoder().encode(markdown).byteLength > 1024 * 1024) throw new Error("Markdown exceeds the 1 MB import limit.");
+    return { content: fromWorkspaceMarkdown(markdown), markdown, warnings: [] as string[] };
+  }
+  if (!name.endsWith(".docx")) throw new Error("Import a Markdown or DOCX speech.");
+  const bytes = new Uint8Array(await file.arrayBuffer());
+  validateDocxArchive(bytes);
+  const converted = await Promise.race([
+    convertWorkspaceDocx(bytes),
+    new Promise<never>((_, reject) => setTimeout(() => reject(new Error("DOCX parsing timed out.")), 5_000)),
+  ]);
+  const markdown = toWorkspaceMarkdown(converted.content);
+  if (new TextEncoder().encode(JSON.stringify(converted.content)).byteLength > 1024 * 1024) throw new Error("Converted document exceeds the safe import limit.");
+  return { ...converted, markdown };
 }
 
 function visibleInlineText(content: JSONContent[] = []) {
@@ -448,15 +525,28 @@ function visibleInlineText(content: JSONContent[] = []) {
   ).join("");
 }
 
+function inlineLinks(content: JSONContent[] = []) {
+  return content.flatMap((node) => {
+    if (node.type === "citation" && node.attrs?.href) return [{ href: String(node.attrs.href), text: citationLabel(node.attrs) }];
+    const href = node.marks?.find((mark) => mark.type === "link")?.attrs?.href;
+    return href ? [{ href: String(href), text: node.text || String(href) }] : [];
+  });
+}
+
 function pdfLines(document: JSONContent) {
-  const lines: Array<{ text: string; fontSize: number; indent: number }> = [];
+  const lines: Array<{ text: string; fontSize: number; indent: number; href?: string; pageBreakBefore?: boolean }> = [];
+  const addLinks = (content: JSONContent[] = [], indent = 0) => {
+    for (const link of inlineLinks(content)) lines.push({ text: `${link.text}: ${link.href}`, fontSize: 9, indent, href: link.href });
+  };
   const addList = (node: JSONContent, depth = 0) => {
-    for (const item of node.content ?? []) {
+    for (const [index, item] of (node.content ?? []).entries()) {
       const blocks = item.content ?? [];
       const paragraph = blocks.find((block) => block.type === "paragraph");
-      lines.push({ text: `• ${visibleInlineText(paragraph?.content)}`, fontSize: 11, indent: depth * 6 });
+      const marker = node.type === "orderedList" ? `${index + Number(node.attrs?.start ?? 1)}.` : "•";
+      lines.push({ text: `${marker} ${visibleInlineText(paragraph?.content)}`, fontSize: 11, indent: depth * 6 });
+      addLinks(paragraph?.content, depth * 6);
       for (const child of blocks) {
-        if (child.type === "bulletList") addList(child, depth + 1);
+        if (child.type === "bulletList" || child.type === "orderedList") addList(child, depth + 1);
       }
     }
   };
@@ -467,11 +557,14 @@ function pdfLines(document: JSONContent) {
         text: visibleInlineText(node.content),
         fontSize: Math.max(12, 18 - Number(node.attrs?.level || 1) * 2),
         indent: 0,
+        pageBreakBefore: Number(node.attrs?.level || 1) === 1,
       });
+      addLinks(node.content);
     } else if (node.type === "paragraph") {
       const text = visibleInlineText(node.content);
       if (text) lines.push({ text, fontSize: 11, indent: 0 });
-    } else if (node.type === "bulletList") {
+      addLinks(node.content);
+    } else if (node.type === "bulletList" || node.type === "orderedList") {
       addList(node);
     } else if (node.type === "table") {
       for (const row of node.content ?? []) {
@@ -482,6 +575,7 @@ function pdfLines(document: JSONContent) {
           fontSize: 10,
           indent: 0,
         });
+        for (const cell of row.content ?? []) for (const block of cell.content ?? []) addLinks(block.content);
       }
     }
   }
@@ -498,7 +592,7 @@ function binaryString(bytes: Uint8Array) {
 
 export async function toWorkspacePdf(
   document: JSONContent,
-  options: { fontData?: Uint8Array } = {},
+  options: { fontData?: Uint8Array; pageBreakBeforeTopHeadings?: boolean } = {},
 ): Promise<Uint8Array> {
   workspaceSchema.nodeFromJSON(document).check();
   const { jsPDF } = await import("jspdf");
@@ -515,6 +609,11 @@ export async function toWorkspacePdf(
   const pageBottom = pdf.internal.pageSize.getHeight() - margin;
   let y = margin;
   for (const line of pdfLines(document)) {
+    if (options.pageBreakBeforeTopHeadings && line.pageBreakBefore && y > margin) {
+      pdf.addPage();
+      pdf.setFont("LiberationSans", "normal");
+      y = margin;
+    }
     pdf.setFontSize(line.fontSize);
     const wrapped = Array.from(pdf.splitTextToSize(line.text, width - line.indent), String);
     const lineHeight = line.fontSize * 0.4;
@@ -523,8 +622,95 @@ export async function toWorkspacePdf(
       pdf.setFont("LiberationSans", "normal");
       y = margin;
     }
-    pdf.text(wrapped, margin + line.indent, y);
+    if (line.href) {
+      wrapped.forEach((part, index) => pdf.textWithLink(part, margin + line.indent, y + index * lineHeight, { url: line.href }));
+    } else {
+      pdf.text(wrapped, margin + line.indent, y);
+    }
     y += wrapped.length * lineHeight + 3;
   }
   return new Uint8Array(pdf.output("arraybuffer"));
 }
+
+export interface WorkspacePacketManifest {
+  artifacts: Array<{ output?: unknown; status: string; tool: string }>;
+  capturedAt: string;
+  documents: Array<{ assigneeId?: string | null; content: JSONContent; provenance?: Record<string, unknown> | null; side: "pro" | "con"; title: string }>;
+  excluded: { archived: number; trashed: number };
+  reviews?: { comments: Array<Record<string, unknown>>; proposals: Array<Record<string, unknown>> } | null;
+  sources: Array<{ citationSnapshot: Record<string, unknown>; title: string }>;
+  workspace: { motion: string; title?: string | null };
+}
+
+function packetContent(manifest: WorkspacePacketManifest): JSONContent {
+  const paragraph = (text: string): JSONContent => ({ type: "paragraph", content: text ? [{ type: "text", text }] : [] });
+  const heading = (text: string, level = 1): JSONContent => ({ type: "heading", attrs: { level }, content: [{ type: "text", text }] });
+  const content: JSONContent[] = [
+    heading(manifest.workspace.title || manifest.workspace.motion),
+    paragraph(manifest.workspace.motion),
+    paragraph(`Captured ${manifest.capturedAt}. Excluded: ${manifest.excluded.archived} archived, ${manifest.excluded.trashed} trashed.`),
+  ];
+  for (const document of manifest.documents) {
+    content.push(
+      heading(`${document.side === "pro" ? "For" : "Against"} · ${document.title}`),
+      paragraph(document.assigneeId ? `Assignee: ${document.assigneeId}` : "Unassigned"),
+      ...(document.provenance ? [paragraph(`Imported copy provenance: ${JSON.stringify(document.provenance)}`)] : []),
+      ...(document.content.content ?? []),
+    );
+  }
+  if (manifest.sources.length) {
+    content.push(heading("Bibliography"));
+    for (const source of manifest.sources) {
+      const href = typeof source.citationSnapshot.href === "string"
+        ? source.citationSnapshot.href
+        : typeof source.citationSnapshot.url === "string" ? source.citationSnapshot.url : null;
+      content.push({
+        type: "paragraph",
+        content: [{ type: "text", text: source.title, ...(href ? { marks: [{ type: "link", attrs: { href } }] } : {}) }],
+      });
+    }
+  }
+  if (manifest.artifacts.length) {
+    content.push(heading("Selected practice appendix"));
+    for (const artifact of manifest.artifacts) {
+      content.push(heading(`${artifact.tool} · ${artifact.status}`, 2), paragraph(JSON.stringify(artifact.output, null, 2).slice(0, 20_000)));
+    }
+  }
+  if (manifest.reviews) {
+    content.push(heading("Review appendix"));
+    for (const comment of manifest.reviews.comments) content.push(paragraph(`Comment: ${String(comment.body ?? "")}`));
+    for (const proposal of manifest.reviews.proposals) content.push(paragraph(`Proposal: ${JSON.stringify(proposal.payload).slice(0, 20_000)}`));
+  }
+  return workspaceSchema.nodeFromJSON({ type: "doc", content }).toJSON();
+}
+
+export async function toWorkspacePacketDocx(manifest: WorkspacePacketManifest) {
+  const docx = await import("docx");
+  const content = packetContent(manifest);
+  const children = (content.content ?? []).flatMap((source, index) => {
+    const blocks = docxBlocks({ type: "doc", content: [source] }, docx);
+    return source.type === "heading" && Number(source.attrs?.level) === 1 && index > 0
+      ? [new docx.Paragraph({ children: [new docx.PageBreak()] }), ...blocks]
+      : blocks;
+  });
+  const file = new docx.Document({
+    numbering: {
+      config: [{
+        reference: "workspace-numbering",
+        levels: Array.from({ length: 9 }, (_, level) => ({
+          alignment: docx.AlignmentType.START,
+          format: docx.LevelFormat.DECIMAL,
+          level,
+          style: { paragraph: { indent: { hanging: 360, left: 720 * (level + 1) } } },
+          text: `%${level + 1}.`,
+        })),
+      }],
+    },
+    sections: [{ children }],
+  });
+  return new Uint8Array(await docx.Packer.toBuffer(file));
+}
+
+export function toWorkspacePacketPdf(manifest: WorkspacePacketManifest, options: { fontData?: Uint8Array } = {}) {
+  return toWorkspacePdf(packetContent(manifest), { ...options, pageBreakBeforeTopHeadings: true });
+}
diff --git a/src/lib/workspace/google-drive.ts b/src/lib/workspace/google-drive.ts
new file mode 100644
index 000000000..db6bed1f4
--- /dev/null
+++ b/src/lib/workspace/google-drive.ts
@@ -0,0 +1,112 @@
+import { z } from "zod";
+import { supabase } from "@/lib/supabase/client";
+
+const connectionSchema = z.object({
+  account_label: z.string(),
+  email: z.string(),
+  id: z.string().uuid(),
+  scopes: z.array(z.string()),
+  status: z.enum(["active", "revoked"]),
+});
+export type GoogleConnection = z.infer<typeof connectionSchema>;
+
+type GooglePickerBuilder = {
+  addView(view: unknown): GooglePickerBuilder;
+  build(): { setVisible(value: boolean): void };
+  disableFeature(feature: string): GooglePickerBuilder;
+  setCallback(callback: (data: Record<string, unknown>) => void): GooglePickerBuilder;
+  setDeveloperKey(key: string): GooglePickerBuilder;
+  setOAuthToken(token: string): GooglePickerBuilder;
+};
+
+async function invoke<T>(name: "google-connections" | "workspace-google-docs", body: Record<string, unknown>) {
+  const { data, error } = await supabase.functions.invoke(name, { body });
+  if (error) throw error;
+  return data as T;
+}
+
+export async function listGoogleConnections() {
+  const { data, error } = await supabase.from("google_connections")
+    .select("account_label,email,id,scopes,status").eq("status", "active").order("created_at");
+  if (error) throw error;
+  return connectionSchema.array().parse(data ?? []);
+}
+
+export async function connectGoogleAccount(returnTo: string) {
+  const result = await invoke<{ url: string }>("google-connections", { action: "authorize", returnTo });
+  window.location.assign(result.url);
+}
+
+export async function disconnectGoogleAccount(connectionId: string) {
+  await invoke("google-connections", { action: "disconnect", connectionId });
+}
+
+declare global {
+  interface Window {
+    gapi?: { load(name: string, callback: () => void): void };
+    google?: {
+      picker: {
+        Action: { PICKED: string };
+        DocsView: new (viewId: string) => { setMimeTypes(types: string): unknown };
+        Feature: { MULTISELECT_ENABLED: string };
+        PickerBuilder: new () => GooglePickerBuilder;
+        Response: { ACTION: string; DOCUMENTS: string };
+        ViewId: { DOCUMENTS: string };
+      };
+    };
+  }
+}
+
+function loadPickerScript() {
+  if (window.gapi) return Promise.resolve();
+  return new Promise<void>((resolve, reject) => {
+    const script = document.createElement("script");
+    script.src = "https://apis.google.com/js/api.js";
+    script.onload = () => resolve();
+    script.onerror = () => reject(new Error("Google Picker could not load"));
+    document.head.appendChild(script);
+  });
+}
+
+export async function pickGoogleDocument(connectionId: string) {
+  const pickerKey = import.meta.env.VITE_GOOGLE_PICKER_API_KEY as string | undefined;
+  if (!pickerKey) throw new Error("Google Picker is not configured");
+  const { accessToken } = await invoke<{ accessToken: string }>("google-connections", { action: "picker-token", connectionId });
+  await loadPickerScript();
+  await new Promise<void>((resolve) => window.gapi!.load("picker", resolve));
+  return new Promise<{ id: string; name: string }>((resolve, reject) => {
+    const picker = window.google!.picker;
+    const view = new picker.DocsView(picker.ViewId.DOCUMENTS);
+    view.setMimeTypes("application/vnd.google-apps.document");
+    const built = new picker.PickerBuilder()
+      .addView(view)
+      .disableFeature(picker.Feature.MULTISELECT_ENABLED)
+      .setDeveloperKey(pickerKey)
+      .setOAuthToken(accessToken)
+      .setCallback((data) => {
+        if (data[picker.Response.ACTION] !== picker.Action.PICKED) return;
+        const selected = (data[picker.Response.DOCUMENTS] as Array<Record<string, unknown>> | undefined)?.[0];
+        if (!selected?.id) reject(new Error("Google Picker returned no document"));
+        else resolve({ id: String(selected.id), name: String(selected.name ?? "Google document") });
+      })
+      .build();
+    built.setVisible(true);
+  });
+}
+
+const importSchema = z.object({
+  accountConnectionId: z.string().uuid(),
+  modifiedTime: z.string().optional(),
+  revision: z.union([z.string(), z.number()]).optional(),
+  sourceUrl: z.string().url(),
+  tabs: z.array(z.object({ markdown: z.string(), title: z.string() })).min(1),
+  title: z.string(),
+});
+
+export async function importGoogleDocument(connectionId: string, fileId: string) {
+  return importSchema.parse(await invoke("workspace-google-docs", { action: "import", connectionId, fileId }));
+}
+
+export async function exportGoogleDocument(input: { connectionId: string; markdown: string; requestId: string; title: string }) {
+  return z.object({ documentId: z.string(), url: z.string().url() }).parse(await invoke("workspace-google-docs", { action: "export", ...input }));
+}
diff --git a/src/lib/workspace/portability-client.ts b/src/lib/workspace/portability-client.ts
new file mode 100644
index 000000000..239cca48b
--- /dev/null
+++ b/src/lib/workspace/portability-client.ts
@@ -0,0 +1,120 @@
+import { z } from "zod";
+import * as Y from "yjs";
+import { yXmlFragmentToProsemirrorJSON } from "@tiptap/y-tiptap";
+import type { JSONContent } from "@tiptap/core";
+import { supabase } from "@/lib/supabase/client";
+import { WORKSPACE_CONTENT_FIELD, workspaceSchema } from "./schema";
+
+const writingItemSchema = z.object({
+  content: z.unknown(),
+  created_at: z.string(),
+  id: z.string().uuid(),
+  kind: z.enum(["snippet", "template"]),
+  provenance: z.record(z.string(), z.unknown()),
+  title: z.string(),
+  updated_at: z.string(),
+});
+export type PrivateWritingItem = z.infer<typeof writingItemSchema>;
+
+const manifestSchema = z.object({
+  artifacts: z.array(z.object({
+    createdAt: z.string(),
+    documentId: z.string().uuid().nullable(),
+    id: z.string().uuid(),
+    output: z.unknown().nullable(),
+    status: z.string(),
+    tool: z.string(),
+  })),
+  capturedAt: z.string(),
+  documents: z.array(z.object({
+    assigneeId: z.string().uuid().nullable(),
+    epoch: z.number().int().nonnegative(),
+    id: z.string().uuid(),
+    position: z.number().int().nonnegative(),
+    provenance: z.record(z.string(), z.unknown()).nullable(),
+    sequence: z.number().int().nonnegative(),
+    side: z.enum(["pro", "con"]),
+    snapshot: z.string(),
+    title: z.string(),
+  })),
+  excluded: z.object({ archived: z.number(), trashed: z.number() }),
+  sources: z.array(z.object({
+    citationSnapshot: z.record(z.string(), z.unknown()),
+    id: z.string().uuid(),
+    provenance: z.record(z.string(), z.unknown()),
+    title: z.string(),
+  })),
+  reviews: z.object({
+    comments: z.array(z.record(z.string(), z.unknown())),
+    proposals: z.array(z.record(z.string(), z.unknown())),
+  }).nullable(),
+  workspace: z.object({ id: z.string().uuid(), motion: z.string(), revision: z.number(), title: z.string().nullable() }),
+});
+export type WorkspaceExportManifest = z.infer<typeof manifestSchema> & {
+  documents: Array<z.infer<typeof manifestSchema>["documents"][number] & { content: JSONContent }>;
+};
+
+export async function listPrivateWritingItems() {
+  const { data, error } = await supabase.from("private_writing_items")
+    .select("content,created_at,id,kind,provenance,title,updated_at")
+    .order("updated_at", { ascending: false });
+  if (error) throw error;
+  return writingItemSchema.array().parse(data ?? []);
+}
+
+export async function savePrivateWritingItem(input: {
+  content: unknown;
+  kind: "snippet" | "template";
+  provenance?: Record<string, unknown>;
+  title: string;
+}) {
+  const { data, error } = await supabase.from("private_writing_items")
+    .insert({ ...input, provenance: input.provenance ?? {} })
+    .select("id").single();
+  if (error) throw error;
+  return z.object({ id: z.string().uuid() }).parse(data).id;
+}
+
+export async function deletePrivateWritingItem(id: string) {
+  const { error } = await supabase.from("private_writing_items").delete().eq("id", id);
+  if (error) throw error;
+}
+
+function decodeSnapshot(value: string) {
+  const binary = atob(value.replace(/\s/g, ""));
+  const snapshot = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  const document = new Y.Doc();
+  try {
+    Y.applyUpdate(document, snapshot);
+    const json = yXmlFragmentToProsemirrorJSON(document.getXmlFragment(WORKSPACE_CONTENT_FIELD));
+    return workspaceSchema.nodeFromJSON(json).toJSON();
+  } finally {
+    document.destroy();
+  }
+}
+
+export async function getWorkspaceExportManifest(workspaceId: string, artifactIds: string[] = [], includeReview = false) {
+  const { data, error } = await supabase.rpc("get_workspace_export_manifest", {
+    p_artifact_ids: artifactIds,
+    p_include_review: includeReview,
+    p_workspace_id: workspaceId,
+  });
+  if (error) throw error;
+  const manifest = manifestSchema.parse(data);
+  return { ...manifest, documents: manifest.documents.map((document) => ({ ...document, content: decodeSnapshot(document.snapshot) })) };
+}
+
+export async function saveWorkspaceDocumentProvenance(input: {
+  documentId: string;
+  provenance: Record<string, unknown>;
+  sourceKind: "markdown" | "docx" | "google_docs";
+  workspaceId: string;
+}) {
+  const { error } = await supabase.rpc("save_workspace_document_provenance", {
+    p_document_id: input.documentId,
+    p_provenance: input.provenance,
+    p_source_kind: input.sourceKind,
+    p_workspace_id: input.workspaceId,
+  });
+  if (error) throw error;
+}
diff --git a/src/locales/en.json b/src/locales/en.json
index 17f85807c..5df359167 100644
--- a/src/locales/en.json
+++ b/src/locales/en.json
@@ -200,6 +200,31 @@
     "sharePrivateResult": "Share a private result",
     "shareResult": "Share",
     "resumePractice": "Resume",
+    "saveSnippet": "Save snippet",
+    "saveTemplate": "Save template",
+    "snippetTitlePrompt": "Snippet name",
+    "templateTitlePrompt": "Template name",
+    "portability": "Import, reuse & export",
+    "privateWriting": "Private snippets and templates",
+    "insertCopy": "Insert copy",
+    "useTemplate": "Use template",
+    "importSpeech": "Import Markdown or DOCX",
+    "importPreview": "Import preview",
+    "replaceWithImport": "Replace with independent copy",
+    "exportDocument": "Export this document",
+    "packetArtifacts": "Practice feedback to include",
+    "includeReviewAppendix": "Include labelled review appendix",
+    "exportPacketDocx": "Packet DOCX",
+    "exportPacketPdf": "Packet PDF",
+    "portabilityFailed": "The document operation failed.",
+    "invalidLibraryItem": "This saved item is not a valid workspace document.",
+    "googleAccounts": "Google Drive accounts",
+    "googleAccount": "Google account",
+    "importGoogleDoc": "Choose Google Doc",
+    "exportGoogleDoc": "Export new Google Doc",
+    "disconnectGoogle": "Disconnect",
+    "connectGoogle": "Connect another Google account",
+    "noGoogleAccounts": "Connect a Google account to import or export Docs without changing your DebateLab login.",
     "contextSummary": "Included: selected document, {{included}} sources{{thread}}. Omitted: {{omitted}} sources.",
     "contextThread": ", shared thread",
     "contextDocuments": "AI context documents",
@@ -1499,6 +1524,8 @@
   },
   "libraryPage": {
     "title": "Source Library",
+    "privateWriting": "Private snippets and speech templates",
+    "privateWritingEmpty": "Save selected workspace text as a snippet, or a whole speech as a template.",
     "addSource": "Add Source",
     "cancel": "Cancel",
     "clearAll": "Clear All",
diff --git a/src/locales/es.json b/src/locales/es.json
index 11b5151fe..d2c3f14cf 100644
--- a/src/locales/es.json
+++ b/src/locales/es.json
@@ -200,6 +200,31 @@
     "sharePrivateResult": "Compartir un resultado privado",
     "shareResult": "Compartir",
     "resumePractice": "Reanudar",
+    "saveSnippet": "Guardar fragmento",
+    "saveTemplate": "Guardar plantilla",
+    "snippetTitlePrompt": "Nombre del fragmento",
+    "templateTitlePrompt": "Nombre de la plantilla",
+    "portability": "Importar, reutilizar y exportar",
+    "privateWriting": "Fragmentos y plantillas privados",
+    "insertCopy": "Insertar copia",
+    "useTemplate": "Usar plantilla",
+    "importSpeech": "Importar Markdown o DOCX",
+    "importPreview": "Vista previa de importación",
+    "replaceWithImport": "Reemplazar con una copia independiente",
+    "exportDocument": "Exportar este documento",
+    "packetArtifacts": "Comentarios de práctica para incluir",
+    "includeReviewAppendix": "Incluir apéndice de revisión etiquetado",
+    "exportPacketDocx": "Paquete DOCX",
+    "exportPacketPdf": "Paquete PDF",
+    "portabilityFailed": "La operación del documento falló.",
+    "invalidLibraryItem": "Este elemento guardado no es un documento válido.",
+    "googleAccounts": "Cuentas de Google Drive",
+    "googleAccount": "Cuenta de Google",
+    "importGoogleDoc": "Elegir Google Doc",
+    "exportGoogleDoc": "Exportar un Google Doc nuevo",
+    "disconnectGoogle": "Desconectar",
+    "connectGoogle": "Conectar otra cuenta de Google",
+    "noGoogleAccounts": "Conecta una cuenta de Google para importar o exportar Docs sin cambiar tu inicio de sesión de DebateLab.",
     "contextSummary": "Incluido: documento seleccionado, {{included}} fuentes{{thread}}. Omitido: {{omitted}} fuentes.",
     "contextThread": ", hilo compartido",
     "contextDocuments": "Documentos del contexto de IA",
@@ -1499,6 +1524,8 @@
   },
   "libraryPage": {
     "title": "Biblioteca de Fuentes",
+    "privateWriting": "Fragmentos privados y plantillas de discursos",
+    "privateWritingEmpty": "Guarda texto seleccionado como fragmento o un discurso completo como plantilla.",
     "addSource": "Añadir Fuente",
     "cancel": "Cancelar",
     "clearAll": "Borrar Todo",
diff --git a/src/locales/hu.json b/src/locales/hu.json
index 9943ac957..89a2df7dc 100644
--- a/src/locales/hu.json
+++ b/src/locales/hu.json
@@ -200,6 +200,31 @@
     "sharePrivateResult": "Privát eredmény megosztása",
     "shareResult": "Megosztás",
     "resumePractice": "Folytatás",
+    "saveSnippet": "Részlet mentése",
+    "saveTemplate": "Sablon mentése",
+    "snippetTitlePrompt": "Részlet neve",
+    "templateTitlePrompt": "Sablon neve",
+    "portability": "Importálás, újrahasználat és export",
+    "privateWriting": "Privát részletek és sablonok",
+    "insertCopy": "Másolat beszúrása",
+    "useTemplate": "Sablon használata",
+    "importSpeech": "Markdown vagy DOCX importálása",
+    "importPreview": "Import előnézete",
+    "replaceWithImport": "Csere független másolatra",
+    "exportDocument": "Dokumentum exportálása",
+    "packetArtifacts": "Beillesztendő gyakorlási visszajelzések",
+    "includeReviewAppendix": "Címkézett felülvizsgálati melléklet",
+    "exportPacketDocx": "DOCX csomag",
+    "exportPacketPdf": "PDF csomag",
+    "portabilityFailed": "A dokumentumművelet sikertelen.",
+    "invalidLibraryItem": "A mentett elem nem érvényes munkatér-dokumentum.",
+    "googleAccounts": "Google Drive-fiókok",
+    "googleAccount": "Google-fiók",
+    "importGoogleDoc": "Google-dokumentum kiválasztása",
+    "exportGoogleDoc": "Új Google-dokumentum exportálása",
+    "disconnectGoogle": "Leválasztás",
+    "connectGoogle": "Másik Google-fiók csatlakoztatása",
+    "noGoogleAccounts": "Csatlakoztass Google-fiókot dokumentumok importálásához vagy exportálásához a DebateLab-bejelentkezés megváltoztatása nélkül.",
     "contextSummary": "Bevonva: kijelölt dokumentum, {{included}} forrás{{thread}}. Kihagyva: {{omitted}} forrás.",
     "contextThread": ", közös beszélgetés",
     "contextDocuments": "AI-kontextus dokumentumai",
@@ -1499,6 +1524,8 @@
   },
   "libraryPage": {
     "title": "Forráskönyvtár",
+    "privateWriting": "Privát részletek és beszédsablonok",
+    "privateWritingEmpty": "Ments kijelölt munkatérszöveget részletként, vagy teljes beszédet sablonként.",
     "addSource": "Forrás Hozzáadása",
     "cancel": "Mégse",
     "clearAll": "Összes Törlése",
diff --git a/src/pages/LibraryPage.tsx b/src/pages/LibraryPage.tsx
index 3923d8b5d..09409c685 100644
--- a/src/pages/LibraryPage.tsx
+++ b/src/pages/LibraryPage.tsx
@@ -35,6 +35,7 @@ import {
   SheetHeader,
   SheetTitle,
 } from '@/components/ui/sheet';
+import { deletePrivateWritingItem, listPrivateWritingItems } from '@/lib/workspace/portability-client';
 
 const SOURCE_ROW_HEIGHT = 92;
 const SOURCE_LIST_HEIGHT = 600;
@@ -162,6 +163,10 @@ export default function LibraryPage() {
     : folder === 'Auto-saved'
       ? t('aiClient.autoSavedFolder')
       : folder;
+  const [writingItems, setWritingItems] = useState<Awaited<ReturnType<typeof listPrivateWritingItems>>>([]);
+  useEffect(() => {
+    void listPrivateWritingItems().then(setWritingItems).catch(() => setWritingItems([]));
+  }, []);
   const {
     sourceLibrary,
     sourceFolders,
@@ -716,6 +721,22 @@ export default function LibraryPage() {
         )}
 
         <div className="grid gap-6">
+          <Card>
+            <CardHeader>
+              <CardTitle className="text-xl">{t('libraryPage.privateWriting', 'Private snippets and speech templates')}</CardTitle>
+            </CardHeader>
+            <CardContent className="grid gap-2">
+              {writingItems.length ? writingItems.map((item) => (
+                <div key={item.id} className="flex items-center gap-2 rounded-lg border px-3 py-2">
+                  <Badge variant="outline">{item.kind}</Badge>
+                  <span className="min-w-0 flex-1 truncate text-sm font-medium">{item.title}</span>
+                  <Button type="button" size="sm" variant="ghost" className="text-destructive" onClick={() => void deletePrivateWritingItem(item.id).then(() => setWritingItems((current) => current.filter(({ id }) => id !== item.id)))}>
+                    <Trash2 className="mr-1 h-3.5 w-3.5" />{t('common.delete', 'Delete')}
+                  </Button>
+                </div>
+              )) : <p className="text-sm text-muted-foreground">{t('libraryPage.privateWritingEmpty', 'Save selected workspace text as a snippet, or a whole speech as a template.')}</p>}
+            </CardContent>
+          </Card>
           <Card>
             <CardHeader className="space-y-4">
               <div className="flex flex-col justify-between gap-3 sm:flex-row sm:items-center">
diff --git a/src/pages/WorkspacePage.tsx b/src/pages/WorkspacePage.tsx
index a624f58ba..ca9621e69 100644
--- a/src/pages/WorkspacePage.tsx
+++ b/src/pages/WorkspacePage.tsx
@@ -11,6 +11,8 @@ import { WorkspaceAccessPanel } from "@/components/features/workspace/WorkspaceA
 import { WorkspaceReviewPanel } from "@/components/features/workspace/WorkspaceReviewPanel";
 import { WorkspaceVersions } from "@/components/features/workspace/WorkspaceVersions";
 import { WorkspacePracticePanel } from "@/components/features/workspace/WorkspacePracticePanel";
+import { WorkspacePortabilityPanel } from "@/components/features/workspace/WorkspacePortabilityPanel";
+import type { JSONContent } from "@tiptap/core";
 import { useAuth } from "@/lib/supabase/AuthProvider";
 import {
   changeWorkspaceState,
@@ -39,7 +41,9 @@ export default function WorkspacePage() {
   const [busy, setBusy] = useState(false);
   const [operationError, setOperationError] = useState<string | null>(null);
   const [documentText, setDocumentText] = useState("");
+  const [documentContent, setDocumentContent] = useState<JSONContent>({ type: "doc", content: [] });
   const [citationToInsert, setCitationToInsert] = useState<WorkspaceSource | null>(null);
+  const [contentToInsert, setContentToInsert] = useState<{ content: JSONContent; id: string; mode: "insert" | "replace" } | null>(null);
   const [aiSuggestion, setAiSuggestion] = useState<{ id: string; text: string } | null>(null);
   const [preferenceLoaded, setPreferenceLoaded] = useState(false);
   const workspace = useQuery({
@@ -85,7 +89,9 @@ export default function WorkspacePage() {
   useEffect(() => {
     setEditorStatus("Saving");
     setDocumentText("");
+    setDocumentContent({ type: "doc", content: [] });
     setCitationToInsert(null);
+    setContentToInsert(null);
     setAiSuggestion(null);
   }, [selectedDocument?.id]);
 
@@ -353,6 +359,7 @@ export default function WorkspacePage() {
               <WorkspaceEditor
                 aiSuggestion={aiSuggestion}
                 citationToInsert={citationToInsert}
+                contentToInsert={contentToInsert}
                 documentId={selectedDocument.id}
                 editable={workspace.data.workspace.status === "active" && view === "active"}
                 epoch={selectedDocument.document_epoch}
@@ -367,8 +374,10 @@ export default function WorkspacePage() {
                 workspaceId={workspace.data.workspace.id}
                 onDurableSequence={setDurableSequence}
                 onCitationInserted={() => setCitationToInsert(null)}
+                onContentInserted={() => setContentToInsert(null)}
                 onAiSuggestionConsumed={() => setAiSuggestion(null)}
                 onSaveStatus={setEditorStatus}
+                onDocumentChange={setDocumentContent}
                 onTextChange={setDocumentText}
               />
             ) : (
@@ -409,6 +418,16 @@ export default function WorkspacePage() {
                       workspaceId={workspace.data.workspace.id}
                     />
                   )}
+                  {user && (
+                    <WorkspacePortabilityPanel
+                      content={documentContent}
+                      documentId={selectedDocument.id}
+                      documentTitle={selectedDocument.title}
+                      onInsertContent={(content, mode) => setContentToInsert({ content, id: crypto.randomUUID(), mode })}
+                      userId={user.id}
+                      workspaceId={workspace.data.workspace.id}
+                    />
+                  )}
                   {session && (
                     <WorkspaceReviewPanel
                       key={`review:${selectedDocument.id}`}
diff --git a/src/test/workspace/document-conversion.test.ts b/src/test/workspace/document-conversion.test.ts
index 47648770a..ff961445a 100644
--- a/src/test/workspace/document-conversion.test.ts
+++ b/src/test/workspace/document-conversion.test.ts
@@ -86,6 +86,22 @@ describe("workspace document conversion", () => {
     }
   });
 
+  it("preserves numbered lists, nested marks, links, tables, and Hungarian text", () => {
+    const imported = fromWorkspaceMarkdown(`1. ***Első tűrő***
+2. [Második](https://example.com/hungarian)
+
+| Név | Érték |
+| --- | --- |
+| Ősz | árvíztűrő |`);
+    const serialized = JSON.stringify(imported);
+
+    expect(serialized).toContain('"type":"orderedList"');
+    expect(serialized).toContain('"type":"bold"');
+    expect(serialized).toContain('"type":"italic"');
+    expect(serialized).toContain("https://example.com/hungarian");
+    expect(toWorkspaceMarkdown(imported)).toContain("árvíztűrő");
+  });
+
   it("round-trips supported semantics and multilingual text through DOCX", async () => {
     expect(toWorkspaceDocx).toBeTypeOf("function");
     expect(fromWorkspaceDocx).toBeTypeOf("function");
diff --git a/supabase/README.md b/supabase/README.md
index d4e44e665..382e091fd 100644
--- a/supabase/README.md
+++ b/supabase/README.md
@@ -40,6 +40,8 @@ The browser boundary is [`../src/lib/ai/client.ts`](../src/lib/ai/client.ts). Sh
 - `import-source`: authenticated public-URL import with SSRF protection on redirects, timeout, content-type and size limits, readable-text extraction, quota checks, and logging.
 - `share`: authenticated creation of expiring share codes for supported saved content.
 - `workspace-invites`: authenticated workspace code and email invitation creation, rotation, revocation, and redemption. The handler keeps raw invite values and email addresses out of database calls and uses service-role-only transactional RPCs for limits and membership changes.
+- `google-connections`: separate multi-account Google OAuth connection, callback, Picker-token and disconnect boundary.
+- `workspace-google-docs`: connection-owned Google Doc import and idempotent new-document export for workspaces.
 - `export-gdoc`: authenticated Google Docs export using a short-lived Google access token. It rejects refresh tokens.
 
 ### Authentication and administration
@@ -140,7 +142,8 @@ Document names, never values. Depending on deployed features, server-side config
 - `WORKSPACE_INVITE_SECRET` for invite derivation, keyed hashes, and target-email encryption;
 - `WORKSPACE_INVITE_MAILER_URL`, `WORKSPACE_INVITE_MAILER_TOKEN`, and `WORKSPACE_INVITE_BASE_URL` for the operator-supplied email relay, plus `WORKSPACE_INVITE_ALLOWED_ORIGINS` for an exact preview origin;
 - sparring integrity material;
-- Google export configuration;
+- `GOOGLE_OAUTH_CLIENT_ID`, `GOOGLE_OAUTH_CLIENT_SECRET`, `GOOGLE_OAUTH_REDIRECT_URI`, `GOOGLE_CONNECTION_ENCRYPTION_KEY`, and `APP_ORIGIN` for separate Google connections;
+- `VITE_GOOGLE_PICKER_API_KEY` as the public Picker developer key;
 - allowed origins and environment-specific application URLs.
 
 Use `supabase secrets` or protected deployment configuration for server values. Never place server secrets in `VITE_*`, source files, docs, screenshots, traces, logs, or comments.
diff --git a/supabase/config.toml b/supabase/config.toml
index 9314aec59..4ac0248f3 100644
--- a/supabase/config.toml
+++ b/supabase/config.toml
@@ -36,6 +36,12 @@ verify_jwt = false
 [functions.workspace-invites]
 verify_jwt = false
 
+[functions.google-connections]
+verify_jwt = false
+
+[functions.workspace-google-docs]
+verify_jwt = false
+
 # Stripe webhook calls come from Stripe (no Supabase JWT), so gateway JWT
 # verification must be disabled for this endpoint.
 [functions.stripe-webhook]
diff --git a/supabase/functions/_shared/google-connections.ts b/supabase/functions/_shared/google-connections.ts
new file mode 100644
index 000000000..1ecf31568
--- /dev/null
+++ b/supabase/functions/_shared/google-connections.ts
@@ -0,0 +1,134 @@
+type QueryResult = { data: unknown; error: { message?: string } | null };
+type ServiceDatabase = {
+  from(table: string): {
+    select(columns: string): {
+      eq(column: string, value: unknown): {
+        maybeSingle(): Promise<QueryResult>;
+        single(): Promise<QueryResult>;
+      };
+    };
+  };
+  rpc(name: string, parameters: Record<string, unknown>): Promise<QueryResult>;
+};
+
+function bytesToBase64(bytes: Uint8Array) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+
+function base64ToBytes(value: string) {
+  const binary = atob(value);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+
+async function encryptionKey() {
+  const raw = base64ToBytes(Deno.env.get("GOOGLE_CONNECTION_ENCRYPTION_KEY") ?? "");
+  if (raw.byteLength !== 32) throw new Error("Google connection encryption is unavailable");
+  return crypto.subtle.importKey("raw", raw, "AES-GCM", false, ["encrypt", "decrypt"]);
+}
+
+export async function encryptGoogleSecret(value: string) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+  const encrypted = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, await encryptionKey(), new TextEncoder().encode(value)));
+  const combined = new Uint8Array(iv.byteLength + encrypted.byteLength);
+  combined.set(iv);
+  combined.set(encrypted, iv.byteLength);
+  return bytesToBase64(combined);
+}
+
+export async function decryptGoogleSecret(value: string) {
+  const combined = base64ToBytes(value);
+  if (combined.byteLength < 29) throw new Error("Invalid encrypted Google token");
+  const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv: combined.slice(0, 12) }, await encryptionKey(), combined.slice(12));
+  return new TextDecoder().decode(decrypted);
+}
+
+export function randomUrlToken(bytes = 32) {
+  return bytesToBase64(crypto.getRandomValues(new Uint8Array(bytes)))
+    .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+
+export async function sha256(value: string) {
+  return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value))))
+    .map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+function row(value: unknown): Record<string, unknown> | null {
+  if (Array.isArray(value)) return row(value[0]);
+  return value && typeof value === "object" ? value as Record<string, unknown> : null;
+}
+
+export async function getGoogleAccessToken(database: ServiceDatabase, userId: string, connectionId: string) {
+  const claimId = crypto.randomUUID();
+  const claim = await database.rpc("claim_google_connection_refresh", {
+    p_claim_id: claimId,
+    p_connection_id: connectionId,
+    p_user_id: userId,
+  });
+  if (claim.error) throw new Error("Google connection unavailable");
+  const claimed = row(claim.data);
+  if (!claimed) throw new Error("Google connection unavailable");
+  if (!claimed.claimed) {
+    for (let attempt = 0; attempt < 12; attempt += 1) {
+      await new Promise((resolve) => setTimeout(resolve, 250));
+      const current = await database.from("google_connections")
+        .select("access_token_ciphertext,access_expires_at,refresh_claim_id,status,user_id")
+        .eq("id", connectionId).maybeSingle();
+      const currentRow = row(current.data);
+      if (!current.error && currentRow?.user_id === userId && currentRow.status === "active" && !currentRow.refresh_claim_id && currentRow.access_token_ciphertext) {
+        return decryptGoogleSecret(String(currentRow.access_token_ciphertext));
+      }
+    }
+    throw new Error("Google connection is busy; try again");
+  }
+
+  const accessCipher = typeof claimed.access_token_ciphertext === "string" ? claimed.access_token_ciphertext : null;
+  const accessExpiry = typeof claimed.access_expires_at === "string" ? new Date(claimed.access_expires_at).getTime() : 0;
+  if (accessCipher && accessExpiry > Date.now() + 60_000) {
+    await database.rpc("finish_google_connection_refresh", {
+      p_access_expires_at: claimed.access_expires_at,
+      p_access_token_ciphertext: accessCipher,
+      p_claim_id: claimId,
+      p_connection_id: connectionId,
+      p_refresh_token_ciphertext: null,
+    });
+    return decryptGoogleSecret(accessCipher);
+  }
+
+  try {
+    const response = await fetch("https://oauth2.googleapis.com/token", {
+      body: new URLSearchParams({
+        client_id: Deno.env.get("GOOGLE_OAUTH_CLIENT_ID") ?? "",
+        client_secret: Deno.env.get("GOOGLE_OAUTH_CLIENT_SECRET") ?? "",
+        grant_type: "refresh_token",
+        refresh_token: await decryptGoogleSecret(String(claimed.refresh_token_ciphertext)),
+      }),
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      method: "POST",
+    });
+    const payload = await response.json() as { access_token?: string; expires_in?: number; refresh_token?: string };
+    if (!response.ok || !payload.access_token) throw new Error("Google token refresh failed");
+    const nextAccessCipher = await encryptGoogleSecret(payload.access_token);
+    const nextRefreshCipher = payload.refresh_token ? await encryptGoogleSecret(payload.refresh_token) : null;
+    const expiresAt = new Date(Date.now() + Math.max(60, payload.expires_in ?? 3600) * 1000).toISOString();
+    const finished = await database.rpc("finish_google_connection_refresh", {
+      p_access_expires_at: expiresAt,
+      p_access_token_ciphertext: nextAccessCipher,
+      p_claim_id: claimId,
+      p_connection_id: connectionId,
+      p_refresh_token_ciphertext: nextRefreshCipher,
+    });
+    if (finished.error || finished.data !== true) throw new Error("Google token refresh lost its claim");
+    return payload.access_token;
+  } catch (error) {
+    await database.rpc("finish_google_connection_refresh", {
+      p_access_expires_at: claimed.access_expires_at ?? new Date(0).toISOString(),
+      p_access_token_ciphertext: accessCipher ?? await encryptGoogleSecret("invalid"),
+      p_claim_id: claimId,
+      p_connection_id: connectionId,
+      p_refresh_token_ciphertext: null,
+    });
+    throw error;
+  }
+}
diff --git a/supabase/functions/google-connections/index.ts b/supabase/functions/google-connections/index.ts
new file mode 100644
index 000000000..6bc099c68
--- /dev/null
+++ b/supabase/functions/google-connections/index.ts
@@ -0,0 +1,154 @@
+import { createAdminClient, HttpError, jsonError, requireUser } from "../_shared/auth.ts";
+import {
+  decryptGoogleSecret,
+  encryptGoogleSecret,
+  getGoogleAccessToken,
+  randomUrlToken,
+  sha256,
+} from "../_shared/google-connections.ts";
+
+const DRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
+const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080"];
+
+function cors(origin: string | null) {
+  return {
+    "Access-Control-Allow-Origin": origin && ORIGINS.includes(origin) ? origin : ORIGINS[0],
+    "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+  };
+}
+
+function json(value: unknown, status: number, headers: Record<string, string>) {
+  return new Response(JSON.stringify(value), { status, headers: { ...headers, "Content-Type": "application/json" } });
+}
+
+function uuid(value: unknown) {
+  const text = String(value ?? "");
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(text)) throw new HttpError(400, "Invalid connection");
+  return text;
+}
+
+function oauthConfig() {
+  const clientId = Deno.env.get("GOOGLE_OAUTH_CLIENT_ID") ?? "";
+  const clientSecret = Deno.env.get("GOOGLE_OAUTH_CLIENT_SECRET") ?? "";
+  const redirectUri = Deno.env.get("GOOGLE_OAUTH_REDIRECT_URI") ?? "";
+  if (!clientId || !clientSecret || !redirectUri) throw new Error("Google connections are not configured");
+  return { clientId, clientSecret, redirectUri };
+}
+
+async function callback(req: Request) {
+  const config = oauthConfig();
+  const requestUrl = new URL(req.url);
+  const code = requestUrl.searchParams.get("code") ?? "";
+  const state = requestUrl.searchParams.get("state") ?? "";
+  const database = createAdminClient();
+  const { data: stored, error } = await database.from("google_connection_states")
+    .select("expires_at,nonce,return_to,user_id,used_at,verifier_ciphertext")
+    .eq("state_hash", await sha256(state)).maybeSingle();
+  if (error || !stored || stored.used_at || new Date(stored.expires_at).getTime() < Date.now() || !code) throw new HttpError(400, "Google connection expired");
+  const { data: claimed } = await database.from("google_connection_states")
+    .update({ used_at: new Date().toISOString() }).eq("state_hash", await sha256(state)).is("used_at", null).select("state_hash").maybeSingle();
+  if (!claimed) throw new HttpError(400, "Google connection was already used");
+
+  const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
+    body: new URLSearchParams({
+      client_id: config.clientId,
+      client_secret: config.clientSecret,
+      code,
+      code_verifier: await decryptGoogleSecret(stored.verifier_ciphertext),
+      grant_type: "authorization_code",
+      redirect_uri: config.redirectUri,
+    }),
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    method: "POST",
+  });
+  const tokens = await tokenResponse.json() as { access_token?: string; expires_in?: number; id_token?: string; refresh_token?: string; scope?: string };
+  if (!tokenResponse.ok || !tokens.access_token || !tokens.id_token) throw new HttpError(400, "Google authorization failed");
+  const identityResponse = await fetch(`https://oauth2.googleapis.com/tokeninfo?id_token=${encodeURIComponent(tokens.id_token)}`);
+  const identity = await identityResponse.json() as { aud?: string; email?: string; name?: string; nonce?: string; sub?: string };
+  if (!identityResponse.ok || identity.aud !== config.clientId || identity.nonce !== stored.nonce || !identity.email || !identity.sub) throw new HttpError(400, "Google identity validation failed");
+  const existing = await database.from("google_connections").select("id,refresh_token_ciphertext")
+    .eq("user_id", stored.user_id).eq("email", identity.email).maybeSingle();
+  const refreshCipher = tokens.refresh_token
+    ? await encryptGoogleSecret(tokens.refresh_token)
+    : existing.data?.refresh_token_ciphertext;
+  if (!refreshCipher) throw new HttpError(400, "Google did not grant offline access");
+  const connection = {
+    access_expires_at: new Date(Date.now() + Math.max(60, tokens.expires_in ?? 3600) * 1000).toISOString(),
+    access_token_ciphertext: await encryptGoogleSecret(tokens.access_token),
+    account_label: identity.name || identity.email,
+    email: identity.email,
+    refresh_token_ciphertext: refreshCipher,
+    scopes: (tokens.scope ?? DRIVE_SCOPE).split(/\s+/).filter(Boolean),
+    status: "active",
+    updated_at: new Date().toISOString(),
+    user_id: stored.user_id,
+  };
+  const saved = existing.data?.id
+    ? await database.from("google_connections").update(connection).eq("id", existing.data.id).select("id").single()
+    : await database.from("google_connections").insert(connection).select("id").single();
+  if (saved.error) throw new Error("Google connection could not be saved");
+  const appOrigin = Deno.env.get("APP_ORIGIN") ?? ORIGINS[0];
+  return Response.redirect(new URL(`${stored.return_to}${stored.return_to.includes("?") ? "&" : "?"}google=connected`, appOrigin), 302);
+}
+
+Deno.serve(async (req) => {
+  const headers = cors(req.headers.get("origin"));
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers });
+  try {
+    if (req.method === "GET") return await callback(req);
+    if (req.method !== "POST") throw new HttpError(405, "Method not allowed");
+    const auth = await requireUser(req);
+    const body = await req.json() as Record<string, unknown>;
+    if (body.action === "authorize") {
+      const returnTo = typeof body.returnTo === "string" && /^\/app(?:\/|$)/.test(body.returnTo) ? body.returnTo : "/app/library";
+      const config = oauthConfig();
+      const state = randomUrlToken();
+      const verifier = randomUrlToken(48);
+      const nonce = randomUrlToken();
+      const challengeBytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
+      const challenge = btoa(String.fromCharCode(...challengeBytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+      const { error } = await auth.adminClient.from("google_connection_states").insert({
+        expires_at: new Date(Date.now() + 10 * 60_000).toISOString(),
+        nonce,
+        return_to: returnTo,
+        state_hash: await sha256(state),
+        user_id: auth.user.id,
+        verifier_ciphertext: await encryptGoogleSecret(verifier),
+      });
+      if (error) throw new Error("Google authorization could not start");
+      const url = new URL("https://accounts.google.com/o/oauth2/v2/auth");
+      url.search = new URLSearchParams({
+        access_type: "offline",
+        client_id: config.clientId,
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        include_granted_scopes: "true",
+        nonce,
+        prompt: "consent select_account",
+        redirect_uri: config.redirectUri,
+        response_type: "code",
+        scope: `openid email profile ${DRIVE_SCOPE}`,
+        state,
+      }).toString();
+      return json({ url: url.toString() }, 200, headers);
+    }
+    const connectionId = uuid(body.connectionId);
+    if (body.action === "picker-token") {
+      const accessToken = await getGoogleAccessToken(auth.adminClient as never, auth.user.id, connectionId);
+      return json({ accessToken }, 200, headers);
+    }
+    if (body.action === "disconnect") {
+      const { data: connection } = await auth.adminClient.from("google_connections")
+        .select("refresh_token_ciphertext").eq("id", connectionId).eq("user_id", auth.user.id).maybeSingle();
+      if (!connection) throw new HttpError(404, "Google connection unavailable");
+      const token = await decryptGoogleSecret(connection.refresh_token_ciphertext);
+      await fetch(`https://oauth2.googleapis.com/revoke?token=${encodeURIComponent(token)}`, { method: "POST" }).catch(() => undefined);
+      await auth.adminClient.from("google_connections").delete().eq("id", connectionId).eq("user_id", auth.user.id);
+      return json({ disconnected: true }, 200, headers);
+    }
+    throw new HttpError(400, "Invalid action");
+  } catch (error) {
+    return jsonError(error, headers);
+  }
+});
diff --git a/supabase/functions/workspace-google-docs/index.ts b/supabase/functions/workspace-google-docs/index.ts
new file mode 100644
index 000000000..e529fcbec
--- /dev/null
+++ b/supabase/functions/workspace-google-docs/index.ts
@@ -0,0 +1,193 @@
+import { HttpError, jsonError, requireUser } from "../_shared/auth.ts";
+import { getGoogleAccessToken } from "../_shared/google-connections.ts";
+
+const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080"];
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function cors(origin: string | null) {
+  return {
+    "Access-Control-Allow-Origin": origin && ORIGINS.includes(origin) ? origin : ORIGINS[0],
+    "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
+    "Access-Control-Allow-Methods": "POST, OPTIONS",
+  };
+}
+
+function json(value: unknown, status: number, headers: Record<string, string>) {
+  return new Response(JSON.stringify(value), { status, headers: { ...headers, "Content-Type": "application/json" } });
+}
+
+function requiredUuid(value: unknown, name: string) {
+  const text = String(value ?? "");
+  if (!UUID.test(text)) throw new HttpError(400, `Invalid ${name}`);
+  return text;
+}
+
+function requiredText(value: unknown, name: string, maximum: number) {
+  const text = String(value ?? "").trim();
+  if (!text || new TextEncoder().encode(text).byteLength > maximum) throw new HttpError(400, `Invalid ${name}`);
+  return text;
+}
+
+function escapeMarkdown(text: string) {
+  return text.replace(/([\\`*_[\]()|])/g, "\\$1");
+}
+
+function googleInline(elements: unknown[]) {
+  return elements.map((raw) => {
+    const element = raw && typeof raw === "object" ? raw as Record<string, unknown> : {};
+    const run = element.textRun && typeof element.textRun === "object" ? element.textRun as Record<string, unknown> : null;
+    if (!run) return "";
+    const style = run.textStyle && typeof run.textStyle === "object" ? run.textStyle as Record<string, unknown> : {};
+    let text = escapeMarkdown(String(run.content ?? "").replace(/\n$/, ""));
+    if (!text) return "";
+    if (style.bold) text = `**${text}**`;
+    if (style.italic) text = `*${text}*`;
+    const link = style.link && typeof style.link === "object" ? String((style.link as Record<string, unknown>).url ?? "") : "";
+    return link && /^https?:\/\//i.test(link) ? `[${text}](${link})` : text;
+  }).join("");
+}
+
+function structuralMarkdown(content: unknown[]) {
+  const lines: string[] = [];
+  for (const raw of content) {
+    const item = raw && typeof raw === "object" ? raw as Record<string, unknown> : {};
+    const paragraph = item.paragraph && typeof item.paragraph === "object" ? item.paragraph as Record<string, unknown> : null;
+    if (paragraph) {
+      const text = googleInline(Array.isArray(paragraph.elements) ? paragraph.elements : []);
+      const style = paragraph.paragraphStyle && typeof paragraph.paragraphStyle === "object" ? paragraph.paragraphStyle as Record<string, unknown> : {};
+      const named = String(style.namedStyleType ?? "");
+      const heading = /^HEADING_(\d)$/.exec(named);
+      const bullet = paragraph.bullet ? "- " : "";
+      lines.push(`${heading ? `${"#".repeat(Number(heading[1]))} ` : bullet}${text}`);
+      continue;
+    }
+    const table = item.table && typeof item.table === "object" ? item.table as Record<string, unknown> : null;
+    if (table) {
+      const rows = Array.isArray(table.tableRows) ? table.tableRows : [];
+      rows.forEach((rawRow, rowIndex) => {
+        const row = rawRow && typeof rawRow === "object" ? rawRow as Record<string, unknown> : {};
+        const cells = Array.isArray(row.tableCells) ? row.tableCells : [];
+        lines.push(`| ${cells.map((rawCell) => {
+          const cell = rawCell && typeof rawCell === "object" ? rawCell as Record<string, unknown> : {};
+          return structuralMarkdown(Array.isArray(cell.content) ? cell.content : []).replace(/\n+/g, " ").trim();
+        }).join(" | ")} |`);
+        if (rowIndex === 0) lines.push(`| ${cells.map(() => "---").join(" | ")} |`);
+      });
+    }
+  }
+  return lines.join("\n");
+}
+
+function tabsMarkdown(document: Record<string, unknown>) {
+  const tabs = Array.isArray(document.tabs) ? document.tabs : [];
+  if (!tabs.length) {
+    const body = document.body && typeof document.body === "object" ? document.body as Record<string, unknown> : {};
+    return [{ title: String(document.title ?? "Google document"), markdown: structuralMarkdown(Array.isArray(body.content) ? body.content : []) }];
+  }
+  const output: Array<{ title: string; markdown: string }> = [];
+  const visit = (raw: unknown) => {
+    const tab = raw && typeof raw === "object" ? raw as Record<string, unknown> : {};
+    const properties = tab.tabProperties && typeof tab.tabProperties === "object" ? tab.tabProperties as Record<string, unknown> : {};
+    const content = tab.documentTab && typeof tab.documentTab === "object" ? tab.documentTab as Record<string, unknown> : {};
+    const body = content.body && typeof content.body === "object" ? content.body as Record<string, unknown> : {};
+    output.push({ title: String(properties.title ?? "Tab"), markdown: structuralMarkdown(Array.isArray(body.content) ? body.content : []) });
+    if (Array.isArray(tab.childTabs)) tab.childTabs.forEach(visit);
+  };
+  tabs.forEach(visit);
+  return output;
+}
+
+function markdownRequests(markdown: string) {
+  const requests: Record<string, unknown>[] = [];
+  let text = "";
+  const paragraphs: Array<{ start: number; end: number; heading?: number; bullet?: boolean }> = [];
+  for (const rawLine of markdown.split(/\r?\n/)) {
+    const heading = /^(#{1,6})\s+(.*)$/.exec(rawLine);
+    const bullet = /^\s*(?:[-+*]|\d+\.)\s+(.*)$/.exec(rawLine);
+    const line = heading?.[2] ?? bullet?.[1] ?? rawLine;
+    const plain = line.replace(/\[([^\]]+)\]\((https?:\/\/[^)]+)\)/g, "$1").replace(/\*\*([^*]+)\*\*/g, "$1").replace(/\*([^*]+)\*/g, "$1").replace(/~~([^~]+)~~/g, "$1");
+    const start = text.length + 1;
+    text += `${plain}\n`;
+    paragraphs.push({ start, end: text.length + 1, heading: heading?.[1].length, bullet: Boolean(bullet) });
+  }
+  requests.push({ insertText: { endOfSegmentLocation: {}, text } });
+  for (const paragraph of paragraphs) {
+    if (paragraph.heading) requests.push({ updateParagraphStyle: { fields: "namedStyleType", paragraphStyle: { namedStyleType: `HEADING_${paragraph.heading}` }, range: { startIndex: paragraph.start, endIndex: paragraph.end } } });
+    if (paragraph.bullet) requests.push({ createParagraphBullets: { bulletPreset: "BULLET_DISC_CIRCLE_SQUARE", range: { startIndex: paragraph.start, endIndex: paragraph.end } } });
+  }
+  return requests;
+}
+
+Deno.serve(async (req) => {
+  const headers = cors(req.headers.get("origin"));
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers });
+  try {
+    if (req.method !== "POST") throw new HttpError(405, "Method not allowed");
+    const auth = await requireUser(req);
+    const body = await req.json() as Record<string, unknown>;
+    const connectionId = requiredUuid(body.connectionId, "connection");
+    const accessToken = await getGoogleAccessToken(auth.adminClient as never, auth.user.id, connectionId);
+    if (body.action === "import") {
+      const fileId = requiredText(body.fileId, "file", 300);
+      const metadataResponse = await fetch(`https://www.googleapis.com/drive/v3/files/${encodeURIComponent(fileId)}?fields=id,name,mimeType,modifiedTime,version,webViewLink`, { headers: { Authorization: `Bearer ${accessToken}` } });
+      const metadata = await metadataResponse.json() as Record<string, unknown>;
+      if (!metadataResponse.ok) throw new HttpError(403, "Select the Google Doc with the account picker first");
+      if (metadata.mimeType !== "application/vnd.google-apps.document") throw new HttpError(400, "Select a Google Doc");
+      const documentResponse = await fetch(`https://docs.googleapis.com/v1/documents/${encodeURIComponent(fileId)}?includeTabsContent=true`, { headers: { Authorization: `Bearer ${accessToken}` } });
+      const document = await documentResponse.json() as Record<string, unknown>;
+      if (!documentResponse.ok) throw new HttpError(403, "Google Doc access was denied");
+      return json({
+        accountConnectionId: connectionId,
+        modifiedTime: metadata.modifiedTime,
+        revision: metadata.version,
+        sourceUrl: metadata.webViewLink,
+        tabs: tabsMarkdown(document),
+        title: metadata.name,
+      }, 200, headers);
+    }
+    if (body.action === "export") {
+      const requestId = requiredUuid(body.requestId, "request");
+      const markdown = requiredText(body.markdown, "document", 1024 * 1024);
+      const title = requiredText(body.title, "title", 300);
+      const { data: inserted, error: insertError } = await auth.adminClient.from("google_file_operations").insert({
+        connection_id: connectionId,
+        kind: "export",
+        request_id: requestId,
+        user_id: auth.user.id,
+      }).select("id,provider_file_id,status").maybeSingle();
+      const operation = inserted ?? (await auth.adminClient.from("google_file_operations")
+        .select("id,provider_file_id,status").eq("user_id", auth.user.id).eq("request_id", requestId).single()).data;
+      if (!operation || insertError && insertError.code !== "23505") throw new Error("Google export could not start");
+      let fileId = operation.provider_file_id as string | null;
+      if (!fileId) {
+        const createdResponse = await fetch("https://docs.googleapis.com/v1/documents", {
+          body: JSON.stringify({ title }),
+          headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
+          method: "POST",
+        });
+        const created = await createdResponse.json() as { documentId?: string };
+        if (!createdResponse.ok || !created.documentId) throw new Error("Google document creation failed");
+        fileId = created.documentId;
+        await auth.adminClient.from("google_file_operations").update({ provider_file_id: fileId, updated_at: new Date().toISOString() }).eq("id", operation.id);
+      }
+      const currentResponse = await fetch(`https://docs.googleapis.com/v1/documents/${encodeURIComponent(fileId)}`, { headers: { Authorization: `Bearer ${accessToken}` } });
+      const current = await currentResponse.json() as { body?: { content?: Array<{ endIndex?: number }> } };
+      const endIndex = current.body?.content?.at(-1)?.endIndex ?? 1;
+      const requests = [
+        ...(endIndex > 2 ? [{ deleteContentRange: { range: { startIndex: 1, endIndex: endIndex - 1 } } }] : []),
+        ...markdownRequests(markdown),
+      ];
+      const updateResponse = await fetch(`https://docs.googleapis.com/v1/documents/${encodeURIComponent(fileId)}:batchUpdate`, {
+        body: JSON.stringify({ requests }),
+        headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
+        method: "POST",
+      });
+      if (!updateResponse.ok) throw new Error("Google document formatting failed");
+      await auth.adminClient.from("google_file_operations").update({ status: "complete", updated_at: new Date().toISOString() }).eq("id", operation.id);
+      return json({ documentId: fileId, url: `https://docs.google.com/document/d/${fileId}/edit` }, 200, headers);
+    }
+    throw new HttpError(400, "Invalid action");
+  } catch (error) {
+    return jsonError(error, headers);
+  }
+});
diff --git a/supabase/migrations/20260921190000_workspace_portability.sql b/supabase/migrations/20260921190000_workspace_portability.sql
new file mode 100644
index 000000000..894cc2ac8
--- /dev/null
+++ b/supabase/migrations/20260921190000_workspace_portability.sql
@@ -0,0 +1,281 @@
+CREATE TABLE public.private_writing_items (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE DEFAULT auth.uid(),
+  kind text NOT NULL CHECK (kind IN ('snippet', 'template')),
+  title text NOT NULL CHECK (length(btrim(title)) BETWEEN 1 AND 200),
+  content jsonb NOT NULL,
+  provenance jsonb NOT NULL DEFAULT '{}'::jsonb,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CHECK (octet_length(convert_to(content::text, 'UTF8')) <= 1048576),
+  CHECK (octet_length(convert_to(provenance::text, 'UTF8')) <= 16384)
+);
+
+CREATE TABLE public.workspace_document_provenance (
+  document_id uuid PRIMARY KEY,
+  workspace_id uuid NOT NULL,
+  imported_by uuid NOT NULL REFERENCES auth.users(id) ON DELETE RESTRICT,
+  source_kind text NOT NULL CHECK (source_kind IN ('markdown', 'docx', 'google_docs')),
+  provenance jsonb NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  FOREIGN KEY (workspace_id, document_id) REFERENCES public.workspace_documents(workspace_id, id) ON DELETE CASCADE,
+  CHECK (octet_length(convert_to(provenance::text, 'UTF8')) <= 32768)
+);
+ALTER TABLE public.workspace_document_provenance ENABLE ROW LEVEL SECURITY;
+CREATE POLICY workspace_document_provenance_select_member ON public.workspace_document_provenance
+  FOR SELECT TO authenticated USING ((SELECT private.is_current_workspace_member(workspace_id)));
+REVOKE ALL ON public.workspace_document_provenance FROM PUBLIC, anon;
+GRANT SELECT ON public.workspace_document_provenance TO authenticated;
+
+CREATE FUNCTION public.save_workspace_document_provenance(
+  p_workspace_id uuid,
+  p_document_id uuid,
+  p_source_kind text,
+  p_provenance jsonb
+)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+BEGIN
+  IF auth.uid() IS NULL OR p_source_kind NOT IN ('markdown', 'docx', 'google_docs')
+    OR p_provenance IS NULL OR octet_length(convert_to(p_provenance::text, 'UTF8')) > 32768
+    OR NOT private.is_current_workspace_member(p_workspace_id)
+    OR NOT EXISTS (SELECT 1 FROM public.workspace_documents WHERE workspace_id = p_workspace_id AND id = p_document_id)
+  THEN RAISE EXCEPTION 'workspace unavailable'; END IF;
+  INSERT INTO public.workspace_document_provenance (
+    document_id, workspace_id, imported_by, source_kind, provenance
+  ) VALUES (p_document_id, p_workspace_id, auth.uid(), p_source_kind, p_provenance)
+  ON CONFLICT (document_id) DO UPDATE SET
+    imported_by = auth.uid(), source_kind = EXCLUDED.source_kind,
+    provenance = EXCLUDED.provenance, updated_at = now();
+END;
+$$;
+REVOKE ALL ON FUNCTION public.save_workspace_document_provenance(uuid, uuid, text, jsonb) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.save_workspace_document_provenance(uuid, uuid, text, jsonb) TO authenticated;
+
+CREATE INDEX private_writing_items_user_updated_idx
+  ON public.private_writing_items(user_id, updated_at DESC);
+
+ALTER TABLE public.private_writing_items ENABLE ROW LEVEL SECURITY;
+CREATE POLICY private_writing_items_owner_select ON public.private_writing_items
+  FOR SELECT TO authenticated USING ((SELECT auth.uid()) = user_id);
+CREATE POLICY private_writing_items_owner_insert ON public.private_writing_items
+  FOR INSERT TO authenticated WITH CHECK ((SELECT auth.uid()) = user_id);
+CREATE POLICY private_writing_items_owner_update ON public.private_writing_items
+  FOR UPDATE TO authenticated USING ((SELECT auth.uid()) = user_id)
+  WITH CHECK ((SELECT auth.uid()) = user_id);
+CREATE POLICY private_writing_items_owner_delete ON public.private_writing_items
+  FOR DELETE TO authenticated USING ((SELECT auth.uid()) = user_id);
+
+REVOKE ALL ON public.private_writing_items FROM anon;
+GRANT SELECT, INSERT, UPDATE, DELETE ON public.private_writing_items TO authenticated;
+
+CREATE FUNCTION public.get_workspace_export_manifest(
+  p_workspace_id uuid,
+  p_artifact_ids uuid[] DEFAULT ARRAY[]::uuid[],
+  p_include_review boolean DEFAULT false
+)
+RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+DECLARE v_manifest jsonb;
+BEGIN
+  IF auth.uid() IS NULL OR NOT EXISTS (
+    SELECT 1 FROM public.workspace_members
+    WHERE workspace_id = p_workspace_id AND user_id = auth.uid()
+  ) OR coalesce(array_length(p_artifact_ids, 1), 0) > 50 THEN
+    RAISE EXCEPTION 'workspace unavailable';
+  END IF;
+  IF EXISTS (
+    SELECT 1 FROM unnest(coalesce(p_artifact_ids, ARRAY[]::uuid[])) AS requested(id)
+    WHERE NOT EXISTS (
+      SELECT 1 FROM public.workspace_artifacts
+      WHERE workspace_id = p_workspace_id AND id = requested.id
+    )
+  ) THEN RAISE EXCEPTION 'workspace unavailable'; END IF;
+
+  SELECT jsonb_build_object(
+    'capturedAt', now(),
+    'workspace', jsonb_build_object(
+      'id', workspace.id, 'motion', workspace.motion, 'title', workspace.title,
+      'revision', workspace.revision
+    ),
+    'documents', (
+      SELECT coalesce(jsonb_agg(jsonb_build_object(
+        'id', document.id, 'title', document.title, 'side', document.side,
+        'position', document.position, 'assigneeId', document.assignee_id,
+        'epoch', state.epoch, 'sequence', state.durable_sequence,
+        'snapshot', encode(state.snapshot, 'base64'),
+        'provenance', (SELECT provenance FROM public.workspace_document_provenance WHERE document_id = document.id)
+      ) ORDER BY document.side, document.position), '[]'::jsonb)
+      FROM public.workspace_documents AS document
+      JOIN private.workspace_document_state AS state ON state.document_id = document.id
+      WHERE document.workspace_id = p_workspace_id AND document.state = 'active'
+    ),
+    'excluded', (
+      SELECT jsonb_build_object(
+        'archived', count(*) FILTER (WHERE state = 'archived'),
+        'trashed', count(*) FILTER (WHERE state = 'trashed')
+      ) FROM public.workspace_documents WHERE workspace_id = p_workspace_id
+    ),
+    'sources', (
+      SELECT coalesce(jsonb_agg(jsonb_build_object(
+        'id', id, 'title', title, 'citationSnapshot', citation_snapshot,
+        'provenance', provenance
+      ) ORDER BY created_at), '[]'::jsonb)
+      FROM public.workspace_sources WHERE workspace_id = p_workspace_id
+    ),
+    'artifacts', (
+      SELECT coalesce(jsonb_agg(jsonb_build_object(
+        'id', id, 'tool', tool, 'status', status, 'documentId', document_id,
+        'output', output_snapshot, 'createdAt', created_at
+      ) ORDER BY created_at), '[]'::jsonb)
+      FROM public.workspace_artifacts
+      WHERE workspace_id = p_workspace_id
+        AND id = ANY(coalesce(p_artifact_ids, ARRAY[]::uuid[]))
+    ),
+    'reviews', CASE WHEN p_include_review THEN jsonb_build_object(
+      'proposals', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+        'documentId', document_id, 'authorId', author_id, 'payload', payload, 'createdAt', created_at
+      ) ORDER BY created_at), '[]'::jsonb) FROM public.workspace_proposals WHERE workspace_id = p_workspace_id),
+      'comments', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+        'documentId', document_id, 'authorId', author_id, 'body', body,
+        'resolvedAt', resolved_at, 'createdAt', created_at
+      ) ORDER BY created_at), '[]'::jsonb) FROM public.workspace_comments WHERE workspace_id = p_workspace_id)
+    ) ELSE NULL END
+  ) INTO v_manifest
+  FROM public.workspaces AS workspace
+  WHERE workspace.id = p_workspace_id AND workspace.status <> 'deleted';
+
+  IF v_manifest IS NULL THEN RAISE EXCEPTION 'workspace unavailable'; END IF;
+  RETURN v_manifest;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.get_workspace_export_manifest(uuid, uuid[], boolean) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.get_workspace_export_manifest(uuid, uuid[], boolean) TO authenticated;
+
+CREATE TABLE public.google_connections (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  email text NOT NULL CHECK (length(email) BETWEEN 3 AND 320),
+  account_label text NOT NULL CHECK (length(account_label) BETWEEN 1 AND 200),
+  scopes text[] NOT NULL DEFAULT ARRAY[]::text[],
+  refresh_token_ciphertext text NOT NULL,
+  access_token_ciphertext text,
+  access_expires_at timestamptz,
+  refresh_claim_id uuid,
+  refresh_claimed_at timestamptz,
+  status text NOT NULL DEFAULT 'active' CHECK (status IN ('active', 'revoked')),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (user_id, email)
+);
+
+CREATE TABLE public.google_file_operations (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  connection_id uuid NOT NULL REFERENCES public.google_connections(id) ON DELETE CASCADE,
+  request_id uuid NOT NULL,
+  kind text NOT NULL CHECK (kind IN ('export')),
+  provider_file_id text,
+  status text NOT NULL DEFAULT 'progress' CHECK (status IN ('progress', 'complete')),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  UNIQUE (user_id, request_id)
+);
+ALTER TABLE public.google_file_operations ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON public.google_file_operations FROM PUBLIC, anon, authenticated;
+
+CREATE TABLE public.google_connection_states (
+  state_hash text PRIMARY KEY,
+  user_id uuid NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  verifier_ciphertext text NOT NULL,
+  nonce text NOT NULL,
+  return_to text NOT NULL CHECK (return_to ~ '^/app(?:/|$)'),
+  expires_at timestamptz NOT NULL,
+  used_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+ALTER TABLE public.google_connection_states ENABLE ROW LEVEL SECURITY;
+REVOKE ALL ON public.google_connection_states FROM PUBLIC, anon, authenticated;
+
+ALTER TABLE public.google_connections ENABLE ROW LEVEL SECURITY;
+CREATE POLICY google_connections_owner_select ON public.google_connections
+  FOR SELECT TO authenticated USING ((SELECT auth.uid()) = user_id);
+REVOKE ALL ON public.google_connections FROM PUBLIC, anon, authenticated;
+GRANT SELECT (id, email, account_label, scopes, status, created_at, updated_at)
+  ON public.google_connections TO authenticated;
+
+CREATE FUNCTION public.claim_google_connection_refresh(
+  p_connection_id uuid,
+  p_user_id uuid,
+  p_claim_id uuid
+)
+RETURNS TABLE (
+  access_token_ciphertext text,
+  access_expires_at timestamptz,
+  refresh_token_ciphertext text,
+  claimed boolean
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+BEGIN
+  IF current_user NOT IN ('service_role', 'postgres') THEN RAISE EXCEPTION 'workspace unavailable'; END IF;
+  RETURN QUERY
+  UPDATE public.google_connections
+  SET refresh_claim_id = CASE
+        WHEN google_connections.refresh_claim_id IS NULL OR google_connections.refresh_claimed_at < now() - interval '1 minute'
+        THEN p_claim_id ELSE google_connections.refresh_claim_id END,
+      refresh_claimed_at = CASE
+        WHEN google_connections.refresh_claim_id IS NULL OR google_connections.refresh_claimed_at < now() - interval '1 minute'
+        THEN now() ELSE google_connections.refresh_claimed_at END
+  WHERE id = p_connection_id AND user_id = p_user_id AND status = 'active'
+  RETURNING google_connections.access_token_ciphertext,
+    google_connections.access_expires_at,
+    google_connections.refresh_token_ciphertext,
+    google_connections.refresh_claim_id = p_claim_id;
+END;
+$$;
+
+CREATE FUNCTION public.finish_google_connection_refresh(
+  p_connection_id uuid,
+  p_claim_id uuid,
+  p_access_token_ciphertext text,
+  p_access_expires_at timestamptz,
+  p_refresh_token_ciphertext text DEFAULT NULL
+)
+RETURNS boolean
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+DECLARE v_updated bigint;
+BEGIN
+  IF current_user NOT IN ('service_role', 'postgres') THEN RAISE EXCEPTION 'workspace unavailable'; END IF;
+  UPDATE public.google_connections
+  SET access_token_ciphertext = p_access_token_ciphertext,
+      access_expires_at = p_access_expires_at,
+      refresh_token_ciphertext = coalesce(p_refresh_token_ciphertext, refresh_token_ciphertext),
+      refresh_claim_id = NULL,
+      refresh_claimed_at = NULL,
+      updated_at = now()
+  WHERE id = p_connection_id AND refresh_claim_id = p_claim_id;
+  GET DIAGNOSTICS v_updated = ROW_COUNT;
+  RETURN v_updated > 0;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.claim_google_connection_refresh(uuid, uuid, uuid),
+  public.finish_google_connection_refresh(uuid, uuid, text, timestamptz, text)
+FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.claim_google_connection_refresh(uuid, uuid, uuid),
+  public.finish_google_connection_refresh(uuid, uuid, text, timestamptz, text)
+TO service_role;

From 308db873d0bdee0eae7f669ee451e8fc1efe985e Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Mon, 21 Sep 2026 17:36:30 +0000
Subject: [PATCH 02/18] test(workspace): lock portability boundaries

---
 supabase/tests/workspace_portability_test.sql | 75 +++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 supabase/tests/workspace_portability_test.sql

diff --git a/supabase/tests/workspace_portability_test.sql b/supabase/tests/workspace_portability_test.sql
new file mode 100644
index 000000000..5fc15c305
--- /dev/null
+++ b/supabase/tests/workspace_portability_test.sql
@@ -0,0 +1,75 @@
+BEGIN;
+SELECT plan(16);
+
+SELECT has_table('public', 'private_writing_items', 'private writing library exists');
+SELECT has_table('public', 'workspace_document_provenance', 'workspace import provenance exists');
+SELECT has_table('public', 'google_connections', 'separate Google connections exist');
+SELECT has_table('public', 'google_file_operations', 'idempotent Google operations exist');
+SELECT has_function('public', 'get_workspace_export_manifest', ARRAY['uuid','uuid[]','boolean'], 'packet export captures a server manifest');
+SELECT has_function('public', 'save_workspace_document_provenance', ARRAY['uuid','uuid','text','jsonb'], 'imports record provenance through an RPC');
+SELECT ok((SELECT relrowsecurity FROM pg_class WHERE oid = 'public.private_writing_items'::regclass), 'private writing enables RLS');
+SELECT ok((SELECT relrowsecurity FROM pg_class WHERE oid = 'public.google_connections'::regclass), 'Google connections enable RLS');
+
+INSERT INTO auth.users (id) VALUES
+  ('a1111111-1111-4111-8111-111111111111'),
+  ('a2222222-2222-4222-8222-222222222222'),
+  ('a3333333-3333-4333-8333-333333333333');
+SET LOCAL ROLE authenticated;
+SELECT set_config('request.jwt.claim.sub', 'a1111111-1111-4111-8111-111111111111', true);
+SELECT set_config('request.jwt.claim.role', 'authenticated', true);
+SELECT lives_ok(
+  $$SELECT public.create_workspace('Portable motion', 'Portable workspace', 'en', 'a0000000-0000-4000-8000-000000000001')$$,
+  'owner creates a portable workspace'
+);
+SELECT lives_ok(
+  $$INSERT INTO public.private_writing_items (user_id, kind, title, content)
+    VALUES (auth.uid(), 'snippet', 'R1 paragraph', '{"type":"doc","content":[]}')$$,
+  'owner saves private writing'
+);
+SELECT results_eq($$SELECT count(*)::bigint FROM public.private_writing_items$$, ARRAY[1::bigint], 'owner reads private writing');
+
+RESET ROLE;
+INSERT INTO public.workspace_members (workspace_id, user_id)
+SELECT id, 'a2222222-2222-4222-8222-222222222222' FROM public.workspaces
+WHERE owner_id = 'a1111111-1111-4111-8111-111111111111';
+
+SET LOCAL ROLE authenticated;
+SELECT set_config('request.jwt.claim.sub', 'a2222222-2222-4222-8222-222222222222', true);
+SELECT set_config('request.jwt.claim.role', 'authenticated', true);
+SELECT results_eq($$SELECT count(*)::bigint FROM public.private_writing_items$$, ARRAY[0::bigint], 'teammate cannot browse private writing');
+SELECT lives_ok(
+  $$SELECT public.save_workspace_document_provenance(
+    (SELECT workspace_id FROM public.workspace_members WHERE user_id = auth.uid() LIMIT 1),
+    (SELECT document_id FROM private.workspace_document_state WHERE workspace_id = (SELECT workspace_id FROM public.workspace_members WHERE user_id = auth.uid() LIMIT 1) LIMIT 1),
+    'markdown', '{"fileName":"speech.md"}'
+  )$$,
+  'member records independent-copy provenance'
+);
+SELECT results_eq(
+  $$SELECT jsonb_array_length(public.get_workspace_export_manifest(
+    (SELECT workspace_id FROM public.workspace_members WHERE user_id = auth.uid() LIMIT 1), ARRAY[]::uuid[], true
+  )->'documents')::bigint$$,
+  ARRAY[8::bigint],
+  'member captures all active documents in one manifest'
+);
+
+SET LOCAL ROLE authenticated;
+SELECT set_config('request.jwt.claim.sub', 'a3333333-3333-4333-8333-333333333333', true);
+SELECT set_config('request.jwt.claim.role', 'authenticated', true);
+SELECT throws_ok(
+  $$SELECT public.save_workspace_document_provenance(
+    (SELECT id FROM public.workspaces LIMIT 1),
+    (SELECT document_id FROM private.workspace_document_state LIMIT 1),
+    'docx', '{}'
+  )$$,
+  'P0001', 'workspace unavailable',
+  'outsider cannot attach import provenance'
+);
+
+RESET ROLE;
+SELECT ok(NOT has_table_privilege('anon', 'public.private_writing_items', 'SELECT'), 'anonymous callers cannot read private writing');
+SELECT ok(NOT has_column_privilege('authenticated', 'public.google_connections', 'refresh_token_ciphertext', 'SELECT'), 'browser cannot read encrypted refresh tokens');
+SELECT ok(NOT has_function_privilege('authenticated', 'public.claim_google_connection_refresh(uuid,uuid,uuid)', 'EXECUTE'), 'browser cannot claim token refresh');
+
+SELECT * FROM finish();
+ROLLBACK;

From b9eefdc486f82c4fcda68bbf8d2044b2d2f439a6 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Mon, 21 Sep 2026 17:45:23 +0000
Subject: [PATCH 03/18] test(workspace): verify portability boundaries

---
 .../features/workspace/WorkspaceEditor.tsx    | 18 +++---
 src/locales/en.json                           |  1 +
 src/locales/es.json                           |  1 +
 src/locales/hu.json                           |  1 +
 .../workspace/document-conversion.test.ts     | 26 ++++++++
 .../_shared/google-connections.test.ts        | 59 +++++++++++++++++++
 supabase/tests/workspace_portability_test.sql |  6 +-
 7 files changed, 102 insertions(+), 10 deletions(-)
 create mode 100644 supabase/functions/_shared/google-connections.test.ts

diff --git a/src/components/features/workspace/WorkspaceEditor.tsx b/src/components/features/workspace/WorkspaceEditor.tsx
index 59593afd4..05702bc42 100644
--- a/src/components/features/workspace/WorkspaceEditor.tsx
+++ b/src/components/features/workspace/WorkspaceEditor.tsx
@@ -312,13 +312,17 @@ export function WorkspaceEditor({
     if (kind === "snippet" && !content.content.length) return;
     const title = window.prompt(t(kind === "snippet" ? "workspaces.snippetTitlePrompt" : "workspaces.templateTitlePrompt"));
     if (!title?.trim()) return;
-    await savePrivateWritingItem({
-      content,
-      kind,
-      provenance: { documentEpoch: epoch, documentId, workspaceId },
-      title: title.trim(),
-    });
-    await queryClient.invalidateQueries({ queryKey: ["private-writing-items"] });
+    try {
+      await savePrivateWritingItem({
+        content,
+        kind,
+        provenance: { documentEpoch: epoch, documentId, workspaceId },
+        title: title.trim(),
+      });
+      await queryClient.invalidateQueries({ queryKey: ["private-writing-items"] });
+    } catch {
+      setReviewError(t("workspaces.privateWritingFailed", "Private writing could not be saved."));
+    }
   };
 
   useEffect(() => {
diff --git a/src/locales/en.json b/src/locales/en.json
index 5df359167..95b779fca 100644
--- a/src/locales/en.json
+++ b/src/locales/en.json
@@ -206,6 +206,7 @@
     "templateTitlePrompt": "Template name",
     "portability": "Import, reuse & export",
     "privateWriting": "Private snippets and templates",
+    "privateWritingFailed": "Private writing could not be saved.",
     "insertCopy": "Insert copy",
     "useTemplate": "Use template",
     "importSpeech": "Import Markdown or DOCX",
diff --git a/src/locales/es.json b/src/locales/es.json
index d2c3f14cf..ee9f13866 100644
--- a/src/locales/es.json
+++ b/src/locales/es.json
@@ -206,6 +206,7 @@
     "templateTitlePrompt": "Nombre de la plantilla",
     "portability": "Importar, reutilizar y exportar",
     "privateWriting": "Fragmentos y plantillas privados",
+    "privateWritingFailed": "No se pudo guardar el texto privado.",
     "insertCopy": "Insertar copia",
     "useTemplate": "Usar plantilla",
     "importSpeech": "Importar Markdown o DOCX",
diff --git a/src/locales/hu.json b/src/locales/hu.json
index 89a2df7dc..876e16c06 100644
--- a/src/locales/hu.json
+++ b/src/locales/hu.json
@@ -206,6 +206,7 @@
     "templateTitlePrompt": "Sablon neve",
     "portability": "Importálás, újrahasználat és export",
     "privateWriting": "Privát részletek és sablonok",
+    "privateWritingFailed": "A privát írás nem menthető.",
     "insertCopy": "Másolat beszúrása",
     "useTemplate": "Sablon használata",
     "importSpeech": "Markdown vagy DOCX importálása",
diff --git a/src/test/workspace/document-conversion.test.ts b/src/test/workspace/document-conversion.test.ts
index ff961445a..144e26396 100644
--- a/src/test/workspace/document-conversion.test.ts
+++ b/src/test/workspace/document-conversion.test.ts
@@ -9,7 +9,10 @@ import {
   fromWorkspaceMarkdown,
   toWorkspaceDocx,
   toWorkspaceMarkdown,
+  toWorkspacePacketDocx,
+  toWorkspacePacketPdf,
   toWorkspacePdf,
+  type WorkspacePacketManifest,
 } from "@/lib/workspace/document-conversion";
 import {
   STRUCTURED_SPEECH,
@@ -141,6 +144,29 @@ describe("workspace document conversion", () => {
     expect(extracted).toContain("[Public evidence, p. 7]");
   });
 
+  it("exports a captured multi-document packet with real page boundaries", async () => {
+    const manifest: WorkspacePacketManifest = {
+      artifacts: [],
+      capturedAt: "2026-09-21T00:00:00.000Z",
+      documents: [
+        { assigneeId: null, content: STRUCTURED_SPEECH, side: "pro" as const, title: "R1" },
+        { assigneeId: null, content: STRUCTURED_SPEECH, side: "con" as const, title: "O1" },
+      ],
+      excluded: { archived: 1, trashed: 1 },
+      sources: [{ citationSnapshot: { url: "https://example.com/evidence" }, title: "Evidence" }],
+      workspace: { motion: "A fair transition", title: "Packet" },
+    };
+    const docx = await toWorkspacePacketDocx(manifest);
+    expect(Array.from(docx.slice(0, 2))).toEqual([0x50, 0x4b]);
+
+    const fontData = await readFile(resolve(process.cwd(), "node_modules/pdfjs-dist/standard_fonts/LiberationSans-Regular.ttf"));
+    const pdfBytes = await toWorkspacePacketPdf(manifest, { fontData });
+    const loadingTask = getDocument({ data: pdfBytes, useWorkerFetch: false });
+    const pdf = await loadingTask.promise;
+    expect(pdf.numPages).toBeGreaterThanOrEqual(4);
+    await loadingTask.destroy();
+  });
+
   it("keeps malformed citations, scripts, and unsafe links outside imported schema", () => {
     const warning = vi.spyOn(console, "warn").mockImplementation(() => undefined);
     const imported = fromWorkspaceHtml(`
diff --git a/supabase/functions/_shared/google-connections.test.ts b/supabase/functions/_shared/google-connections.test.ts
new file mode 100644
index 000000000..c00bd28d5
--- /dev/null
+++ b/supabase/functions/_shared/google-connections.test.ts
@@ -0,0 +1,59 @@
+import { assertEquals, assertRejects } from "jsr:@std/assert@1";
+import { decryptGoogleSecret, encryptGoogleSecret, getGoogleAccessToken } from "./google-connections.ts";
+
+const CONNECTION_ID = "a0000000-0000-4000-8000-000000000001";
+const USER_ID = "a0000000-0000-4000-8000-000000000002";
+
+Deno.test("Google connection secrets round-trip through AES-GCM", async () => {
+  Deno.env.set("GOOGLE_CONNECTION_ENCRYPTION_KEY", btoa("12345678901234567890123456789012"));
+  const encrypted = await encryptGoogleSecret("refresh-secret");
+  assertEquals(await decryptGoogleSecret(encrypted), "refresh-secret");
+});
+
+Deno.test("valid cached access tokens release the refresh claim", async () => {
+  Deno.env.set("GOOGLE_CONNECTION_ENCRYPTION_KEY", btoa("12345678901234567890123456789012"));
+  const access = await encryptGoogleSecret("cached-access");
+  const calls: Array<{ name: string; parameters: Record<string, unknown> }> = [];
+  const database = {
+    from: () => ({ select: () => ({ eq: () => ({ maybeSingle: async () => ({ data: null, error: null }) }) }) }),
+    rpc: async (name: string, parameters: Record<string, unknown>) => {
+      calls.push({ name, parameters });
+      if (name === "claim_google_connection_refresh") return { data: [{ access_token_ciphertext: access, access_expires_at: new Date(Date.now() + 120_000).toISOString(), refresh_token_ciphertext: "unused", claimed: true }], error: null };
+      return { data: true, error: null };
+    },
+  };
+  assertEquals(await getGoogleAccessToken(database as never, USER_ID, CONNECTION_ID), "cached-access");
+  assertEquals(calls.at(-1)?.name, "finish_google_connection_refresh");
+});
+
+Deno.test("refresh preserves an omitted replacement refresh token", async () => {
+  Deno.env.set("GOOGLE_CONNECTION_ENCRYPTION_KEY", btoa("12345678901234567890123456789012"));
+  Deno.env.set("GOOGLE_OAUTH_CLIENT_ID", "client");
+  Deno.env.set("GOOGLE_OAUTH_CLIENT_SECRET", "secret");
+  const refresh = await encryptGoogleSecret("refresh-secret");
+  const calls: Array<{ name: string; parameters: Record<string, unknown> }> = [];
+  const database = {
+    from: () => ({ select: () => ({ eq: () => ({ maybeSingle: async () => ({ data: null, error: null }) }) }) }),
+    rpc: async (name: string, parameters: Record<string, unknown>) => {
+      calls.push({ name, parameters });
+      if (name === "claim_google_connection_refresh") return { data: [{ access_token_ciphertext: null, access_expires_at: null, refresh_token_ciphertext: refresh, claimed: true }], error: null };
+      return { data: true, error: null };
+    },
+  };
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = () => Promise.resolve(new Response(JSON.stringify({ access_token: "fresh-access", expires_in: 3600 }), { status: 200 }));
+  try {
+    assertEquals(await getGoogleAccessToken(database as never, USER_ID, CONNECTION_ID), "fresh-access");
+    assertEquals(calls.at(-1)?.parameters.p_refresh_token_ciphertext, null);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+Deno.test("a foreign or missing connection is rejected", async () => {
+  const database = {
+    from: () => ({ select: () => ({ eq: () => ({ maybeSingle: async () => ({ data: null, error: null }) }) }) }),
+    rpc: () => Promise.resolve({ data: [], error: null }),
+  };
+  await assertRejects(() => getGoogleAccessToken(database as never, USER_ID, CONNECTION_ID), Error, "Google connection unavailable");
+});
diff --git a/supabase/tests/workspace_portability_test.sql b/supabase/tests/workspace_portability_test.sql
index 5fc15c305..48097bec4 100644
--- a/supabase/tests/workspace_portability_test.sql
+++ b/supabase/tests/workspace_portability_test.sql
@@ -1,5 +1,5 @@
 BEGIN;
-SELECT plan(16);
+SELECT plan(18);
 
 SELECT has_table('public', 'private_writing_items', 'private writing library exists');
 SELECT has_table('public', 'workspace_document_provenance', 'workspace import provenance exists');
@@ -40,7 +40,7 @@ SELECT results_eq($$SELECT count(*)::bigint FROM public.private_writing_items$$,
 SELECT lives_ok(
   $$SELECT public.save_workspace_document_provenance(
     (SELECT workspace_id FROM public.workspace_members WHERE user_id = auth.uid() LIMIT 1),
-    (SELECT document_id FROM private.workspace_document_state WHERE workspace_id = (SELECT workspace_id FROM public.workspace_members WHERE user_id = auth.uid() LIMIT 1) LIMIT 1),
+    (SELECT id FROM public.workspace_documents WHERE workspace_id = (SELECT workspace_id FROM public.workspace_members WHERE user_id = auth.uid() LIMIT 1) LIMIT 1),
     'markdown', '{"fileName":"speech.md"}'
   )$$,
   'member records independent-copy provenance'
@@ -59,7 +59,7 @@ SELECT set_config('request.jwt.claim.role', 'authenticated', true);
 SELECT throws_ok(
   $$SELECT public.save_workspace_document_provenance(
     (SELECT id FROM public.workspaces LIMIT 1),
-    (SELECT document_id FROM private.workspace_document_state LIMIT 1),
+    (SELECT id FROM public.workspace_documents LIMIT 1),
     'docx', '{}'
   )$$,
   'P0001', 'workspace unavailable',

From e7b032d798e3f6094fcec101ac6ce86e5c56255d Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Mon, 21 Sep 2026 18:10:22 +0000
Subject: [PATCH 04/18] fix(workspace): harden Google portability

---
 package.json                                  |   2 +-
 src/lib/workspace/portability-client.ts       |   6 +
 src/pages/LibraryPage.tsx                     |  43 +++-
 .../functions/_shared/native-cors.test.ts     |   2 +
 .../functions/google-connections/index.ts     |   2 +-
 .../functions/workspace-google-docs/index.ts  | 219 ++++++++++++++----
 .../workspace-google-docs/index_test.ts       |  70 ++++++
 7 files changed, 285 insertions(+), 59 deletions(-)
 create mode 100644 supabase/functions/workspace-google-docs/index_test.ts

diff --git a/package.json b/package.json
index bdda8f8ed..e9ee7f152 100644
--- a/package.json
+++ b/package.json
@@ -21,7 +21,7 @@
     "test:collaboration": "vitest run --config services/collaboration/vitest.config.ts",
     "start:collaboration": "tsx services/collaboration/src/index.ts",
     "test:watch": "vitest",
-    "test:edge": "deno test --allow-read --allow-env=DEMO_CODE_PEPPER,EXA_API_KEY,SUPABASE_URL,SUPABASE_ANON_KEY,SUPABASE_SERVICE_ROLE_KEY,SPARRING_INTEGRITY_SECRET,OPENROUTER_API_KEY,WORKSPACE_INVITE_SECRET,WORKSPACE_INVITE_MAILER_URL,WORKSPACE_INVITE_MAILER_TOKEN,WORKSPACE_INVITE_MAILER_FORMAT,WORKSPACE_INVITE_BASE_URL,WORKSPACE_INVITE_ALLOWED_ORIGINS,WORKSPACE_INVITE_SERVICE_ROLE_KEY --allow-net=127.0.0.1 supabase/functions/",
+    "test:edge": "deno test --allow-read --allow-env=DEMO_CODE_PEPPER,EXA_API_KEY,SUPABASE_URL,SUPABASE_ANON_KEY,SUPABASE_SERVICE_ROLE_KEY,SPARRING_INTEGRITY_SECRET,OPENROUTER_API_KEY,WORKSPACE_INVITE_SECRET,WORKSPACE_INVITE_MAILER_URL,WORKSPACE_INVITE_MAILER_TOKEN,WORKSPACE_INVITE_MAILER_FORMAT,WORKSPACE_INVITE_BASE_URL,WORKSPACE_INVITE_ALLOWED_ORIGINS,WORKSPACE_INVITE_SERVICE_ROLE_KEY,GOOGLE_CONNECTION_ENCRYPTION_KEY,GOOGLE_OAUTH_CLIENT_ID,GOOGLE_OAUTH_CLIENT_SECRET --allow-net=127.0.0.1 supabase/functions/",
     "test:db": "supabase test db && bash scripts/test-daily-quota.sh && bash scripts/test-workspace-invite-concurrency.sh && bash scripts/test-workspace-mutation-concurrency.sh",
     "test:e2e": "playwright test --project=desktop-chromium --project=mobile-chromium",
     "test:e2e:webkit": "playwright test --project=webkit",
diff --git a/src/lib/workspace/portability-client.ts b/src/lib/workspace/portability-client.ts
index 239cca48b..c67329015 100644
--- a/src/lib/workspace/portability-client.ts
+++ b/src/lib/workspace/portability-client.ts
@@ -80,6 +80,12 @@ export async function deletePrivateWritingItem(id: string) {
   if (error) throw error;
 }
 
+export async function updatePrivateWritingItem(id: string, input: { content: unknown; title: string }) {
+  const { error } = await supabase.from("private_writing_items")
+    .update({ ...input, updated_at: new Date().toISOString() }).eq("id", id);
+  if (error) throw error;
+}
+
 function decodeSnapshot(value: string) {
   const binary = atob(value.replace(/\s/g, ""));
   const snapshot = Uint8Array.from(binary, (character) => character.charCodeAt(0));
diff --git a/src/pages/LibraryPage.tsx b/src/pages/LibraryPage.tsx
index 09409c685..9f238707f 100644
--- a/src/pages/LibraryPage.tsx
+++ b/src/pages/LibraryPage.tsx
@@ -35,7 +35,9 @@ import {
   SheetHeader,
   SheetTitle,
 } from '@/components/ui/sheet';
-import { deletePrivateWritingItem, listPrivateWritingItems } from '@/lib/workspace/portability-client';
+import { deletePrivateWritingItem, listPrivateWritingItems, updatePrivateWritingItem } from '@/lib/workspace/portability-client';
+import { fromWorkspaceMarkdown, toWorkspaceMarkdown } from '@/lib/workspace/document-conversion';
+import { workspaceSchema } from '@/lib/workspace/schema';
 
 const SOURCE_ROW_HEIGHT = 92;
 const SOURCE_LIST_HEIGHT = 600;
@@ -164,6 +166,9 @@ export default function LibraryPage() {
       ? t('aiClient.autoSavedFolder')
       : folder;
   const [writingItems, setWritingItems] = useState<Awaited<ReturnType<typeof listPrivateWritingItems>>>([]);
+  const [editingWritingId, setEditingWritingId] = useState<string | null>(null);
+  const [writingTitle, setWritingTitle] = useState('');
+  const [writingMarkdown, setWritingMarkdown] = useState('');
   useEffect(() => {
     void listPrivateWritingItems().then(setWritingItems).catch(() => setWritingItems([]));
   }, []);
@@ -727,12 +732,36 @@ export default function LibraryPage() {
             </CardHeader>
             <CardContent className="grid gap-2">
               {writingItems.length ? writingItems.map((item) => (
-                <div key={item.id} className="flex items-center gap-2 rounded-lg border px-3 py-2">
-                  <Badge variant="outline">{item.kind}</Badge>
-                  <span className="min-w-0 flex-1 truncate text-sm font-medium">{item.title}</span>
-                  <Button type="button" size="sm" variant="ghost" className="text-destructive" onClick={() => void deletePrivateWritingItem(item.id).then(() => setWritingItems((current) => current.filter(({ id }) => id !== item.id)))}>
-                    <Trash2 className="mr-1 h-3.5 w-3.5" />{t('common.delete', 'Delete')}
-                  </Button>
+                <div key={item.id} className="grid gap-2 rounded-lg border px-3 py-2">
+                  <div className="flex items-center gap-2">
+                    <Badge variant="outline">{item.kind}</Badge>
+                    <span className="min-w-0 flex-1 truncate text-sm font-medium">{item.title}</span>
+                    <Button type="button" size="sm" variant="ghost" onClick={() => {
+                      try {
+                        setWritingMarkdown(toWorkspaceMarkdown(workspaceSchema.nodeFromJSON(item.content).toJSON()));
+                        setWritingTitle(item.title);
+                        setEditingWritingId(item.id);
+                      } catch {
+                        toast({ title: t('common.error', 'Error'), description: t('workspaces.invalidLibraryItem', 'This saved item is not a valid workspace document.'), variant: 'destructive' });
+                      }
+                    }}><Pencil className="mr-1 h-3.5 w-3.5" />{t('common.edit', 'Edit')}</Button>
+                    <Button type="button" size="sm" variant="ghost" className="text-destructive" onClick={() => void deletePrivateWritingItem(item.id).then(() => setWritingItems((current) => current.filter(({ id }) => id !== item.id)))}>
+                      <Trash2 className="mr-1 h-3.5 w-3.5" />{t('common.delete', 'Delete')}
+                    </Button>
+                  </div>
+                  {editingWritingId === item.id && (
+                    <div className="grid gap-2 border-t pt-2">
+                      <Input aria-label={t('libraryPage.privateWritingTitle', 'Saved writing title')} value={writingTitle} onChange={(event) => setWritingTitle(event.target.value)} />
+                      <Textarea aria-label={t('libraryPage.privateWritingContent', 'Saved writing Markdown')} className="min-h-32" value={writingMarkdown} onChange={(event) => setWritingMarkdown(event.target.value)} />
+                      <div className="flex gap-2">
+                        <Button type="button" size="sm" disabled={!writingTitle.trim()} onClick={() => void updatePrivateWritingItem(item.id, { content: fromWorkspaceMarkdown(writingMarkdown), title: writingTitle.trim() }).then(() => {
+                          setWritingItems((current) => current.map((entry) => entry.id === item.id ? { ...entry, content: fromWorkspaceMarkdown(writingMarkdown), title: writingTitle.trim() } : entry));
+                          setEditingWritingId(null);
+                        })}>{t('common.save', 'Save')}</Button>
+                        <Button type="button" size="sm" variant="ghost" onClick={() => setEditingWritingId(null)}>{t('common.cancel', 'Cancel')}</Button>
+                      </div>
+                    </div>
+                  )}
                 </div>
               )) : <p className="text-sm text-muted-foreground">{t('libraryPage.privateWritingEmpty', 'Save selected workspace text as a snippet, or a whole speech as a template.')}</p>}
             </CardContent>
diff --git a/supabase/functions/_shared/native-cors.test.ts b/supabase/functions/_shared/native-cors.test.ts
index cbee47cdf..1db079a41 100644
--- a/supabase/functions/_shared/native-cors.test.ts
+++ b/supabase/functions/_shared/native-cors.test.ts
@@ -9,8 +9,10 @@ const browserCalledFunctions = [
   "create-portal",
   "export-gdoc",
   "import-source",
+  "google-connections",
   "redeem-promo",
   "share",
+  "workspace-google-docs",
 ];
 
 for (const functionName of browserCalledFunctions) {
diff --git a/supabase/functions/google-connections/index.ts b/supabase/functions/google-connections/index.ts
index 6bc099c68..7a833cedf 100644
--- a/supabase/functions/google-connections/index.ts
+++ b/supabase/functions/google-connections/index.ts
@@ -8,7 +8,7 @@ import {
 } from "../_shared/google-connections.ts";
 
 const DRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
-const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080"];
+const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080", "capacitor://localhost"];
 
 function cors(origin: string | null) {
   return {
diff --git a/supabase/functions/workspace-google-docs/index.ts b/supabase/functions/workspace-google-docs/index.ts
index e529fcbec..41b85e69f 100644
--- a/supabase/functions/workspace-google-docs/index.ts
+++ b/supabase/functions/workspace-google-docs/index.ts
@@ -1,7 +1,7 @@
 import { HttpError, jsonError, requireUser } from "../_shared/auth.ts";
 import { getGoogleAccessToken } from "../_shared/google-connections.ts";
 
-const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080"];
+const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080", "capacitor://localhost"];
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
 function cors(origin: string | null) {
@@ -42,12 +42,13 @@ function googleInline(elements: unknown[]) {
     if (!text) return "";
     if (style.bold) text = `**${text}**`;
     if (style.italic) text = `*${text}*`;
+    if (style.strikethrough) text = `~~${text}~~`;
     const link = style.link && typeof style.link === "object" ? String((style.link as Record<string, unknown>).url ?? "") : "";
     return link && /^https?:\/\//i.test(link) ? `[${text}](${link})` : text;
   }).join("");
 }
 
-function structuralMarkdown(content: unknown[]) {
+function structuralMarkdown(content: unknown[], lists: Record<string, unknown> = {}) {
   const lines: string[] = [];
   for (const raw of content) {
     const item = raw && typeof raw === "object" ? raw as Record<string, unknown> : {};
@@ -57,8 +58,18 @@ function structuralMarkdown(content: unknown[]) {
       const style = paragraph.paragraphStyle && typeof paragraph.paragraphStyle === "object" ? paragraph.paragraphStyle as Record<string, unknown> : {};
       const named = String(style.namedStyleType ?? "");
       const heading = /^HEADING_(\d)$/.exec(named);
-      const bullet = paragraph.bullet ? "- " : "";
-      lines.push(`${heading ? `${"#".repeat(Number(heading[1]))} ` : bullet}${text}`);
+      const bullet = paragraph.bullet && typeof paragraph.bullet === "object" ? paragraph.bullet as Record<string, unknown> : null;
+      let listPrefix = "";
+      if (bullet) {
+        const list = lists[String(bullet.listId)] as Record<string, unknown> | undefined;
+        const properties = list?.listProperties as Record<string, unknown> | undefined;
+        const levels = Array.isArray(properties?.nestingLevels) ? properties.nestingLevels : [];
+        const nesting = Math.max(0, Number(bullet.nestingLevel ?? 0));
+        const level = levels[nesting] && typeof levels[nesting] === "object" ? levels[nesting] as Record<string, unknown> : {};
+        const ordered = /DECIMAL|ALPHA|ROMAN/i.test(String(level.glyphType ?? ""));
+        listPrefix = `${"  ".repeat(nesting)}${ordered ? "1." : "-"} `;
+      }
+      lines.push(`${heading ? `${"#".repeat(Number(heading[1]))} ` : listPrefix}${text}`);
       continue;
     }
     const table = item.table && typeof item.table === "object" ? item.table as Record<string, unknown> : null;
@@ -69,7 +80,7 @@ function structuralMarkdown(content: unknown[]) {
         const cells = Array.isArray(row.tableCells) ? row.tableCells : [];
         lines.push(`| ${cells.map((rawCell) => {
           const cell = rawCell && typeof rawCell === "object" ? rawCell as Record<string, unknown> : {};
-          return structuralMarkdown(Array.isArray(cell.content) ? cell.content : []).replace(/\n+/g, " ").trim();
+          return structuralMarkdown(Array.isArray(cell.content) ? cell.content : [], lists).replace(/\n+/g, " ").trim();
         }).join(" | ")} |`);
         if (rowIndex === 0) lines.push(`| ${cells.map(() => "---").join(" | ")} |`);
       });
@@ -78,11 +89,12 @@ function structuralMarkdown(content: unknown[]) {
   return lines.join("\n");
 }
 
-function tabsMarkdown(document: Record<string, unknown>) {
+export function tabsMarkdown(document: Record<string, unknown>) {
   const tabs = Array.isArray(document.tabs) ? document.tabs : [];
   if (!tabs.length) {
     const body = document.body && typeof document.body === "object" ? document.body as Record<string, unknown> : {};
-    return [{ title: String(document.title ?? "Google document"), markdown: structuralMarkdown(Array.isArray(body.content) ? body.content : []) }];
+    const lists = document.lists && typeof document.lists === "object" ? document.lists as Record<string, unknown> : {};
+    return [{ title: String(document.title ?? "Google document"), markdown: structuralMarkdown(Array.isArray(body.content) ? body.content : [], lists) }];
   }
   const output: Array<{ title: string; markdown: string }> = [];
   const visit = (raw: unknown) => {
@@ -90,35 +102,159 @@ function tabsMarkdown(document: Record<string, unknown>) {
     const properties = tab.tabProperties && typeof tab.tabProperties === "object" ? tab.tabProperties as Record<string, unknown> : {};
     const content = tab.documentTab && typeof tab.documentTab === "object" ? tab.documentTab as Record<string, unknown> : {};
     const body = content.body && typeof content.body === "object" ? content.body as Record<string, unknown> : {};
-    output.push({ title: String(properties.title ?? "Tab"), markdown: structuralMarkdown(Array.isArray(body.content) ? body.content : []) });
+    const lists = content.lists && typeof content.lists === "object" ? content.lists as Record<string, unknown> : {};
+    output.push({ title: String(properties.title ?? "Tab"), markdown: structuralMarkdown(Array.isArray(body.content) ? body.content : [], lists) });
     if (Array.isArray(tab.childTabs)) tab.childTabs.forEach(visit);
   };
   tabs.forEach(visit);
   return output;
 }
 
-function markdownRequests(markdown: string) {
-  const requests: Record<string, unknown>[] = [];
-  let text = "";
-  const paragraphs: Array<{ start: number; end: number; heading?: number; bullet?: boolean }> = [];
-  for (const rawLine of markdown.split(/\r?\n/)) {
-    const heading = /^(#{1,6})\s+(.*)$/.exec(rawLine);
-    const bullet = /^\s*(?:[-+*]|\d+\.)\s+(.*)$/.exec(rawLine);
-    const line = heading?.[2] ?? bullet?.[1] ?? rawLine;
-    const plain = line.replace(/\[([^\]]+)\]\((https?:\/\/[^)]+)\)/g, "$1").replace(/\*\*([^*]+)\*\*/g, "$1").replace(/\*([^*]+)\*/g, "$1").replace(/~~([^~]+)~~/g, "$1");
-    const start = text.length + 1;
-    text += `${plain}\n`;
-    paragraphs.push({ start, end: text.length + 1, heading: heading?.[1].length, bullet: Boolean(bullet) });
+function escapeHtml(value: string) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+
+function safeLink(value: string) {
+  if (/^https?:\/\//i.test(value)) return value;
+  if (!value.startsWith("debatelab-citation:")) return null;
+  try {
+    const query = value.split("?", 2)[1] ?? "";
+    const href = new URLSearchParams(query).get("href");
+    return href && /^https?:\/\//i.test(href) ? href : null;
+  } catch {
+    return null;
+  }
+}
+
+function inlineHtml(value: string): string {
+  const links: string[] = [];
+  const withPlaceholders: string = value.replace(/\[([^\]]*)\]\(([^)]+)\)/g, (_match, label: string, destination: string): string => {
+    const href = safeLink(destination);
+    const html: string = href ? `<a href="${escapeHtml(href)}">${inlineHtml(label)}</a>` : inlineHtml(label);
+    const index: number = links.push(html) - 1;
+    return `\uE000LINK${index}\uE000`;
+  });
+  return escapeHtml(withPlaceholders)
+    .replace(/\*\*\*([^*]+)\*\*\*/g, "<strong><em>$1</em></strong>")
+    .replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>")
+    .replace(/\*([^*]+)\*/g, "<em>$1</em>")
+    .replace(/~~([^~]+)~~/g, "<s>$1</s>")
+    .replace(/\uE000LINK(\d+)\uE000/g, (_match, index: string) => links[Number(index)] ?? "");
+}
+
+function splitMarkdownRow(line: string) {
+  return line.trim().replace(/^\||\|$/g, "").split(/(?<!\\)\|/).map((cell) => cell.trim().replace(/\\\|/g, "|"));
+}
+
+function listHtml(lines: string[]) {
+  let html = "";
+  const stack: Array<"ol" | "ul"> = [];
+  let currentDepth = -1;
+  for (const line of lines) {
+    const match = /^(\s*)([-+*]|\d+\.)\s+(.*)$/.exec(line)!;
+    const depth = Math.floor(match[1].length / 2);
+    const type = /\d+\./.test(match[2]) ? "ol" : "ul";
+    while (currentDepth > depth) {
+      html += `</li></${stack.pop()}>`;
+      currentDepth -= 1;
+    }
+    if (currentDepth === depth && currentDepth >= 0) html += "</li>";
+    if (stack[depth] && stack[depth] !== type) {
+      html += `</${stack.pop()}>`;
+      currentDepth -= 1;
+    }
+    while (currentDepth < depth) {
+      stack.push(type);
+      html += `<${type}>`;
+      currentDepth += 1;
+    }
+    if (currentDepth < 0) {
+      stack.push(type);
+      html += `<${type}>`;
+      currentDepth = 0;
+    }
+    html += `<li>${inlineHtml(match[3])}`;
   }
-  requests.push({ insertText: { endOfSegmentLocation: {}, text } });
-  for (const paragraph of paragraphs) {
-    if (paragraph.heading) requests.push({ updateParagraphStyle: { fields: "namedStyleType", paragraphStyle: { namedStyleType: `HEADING_${paragraph.heading}` }, range: { startIndex: paragraph.start, endIndex: paragraph.end } } });
-    if (paragraph.bullet) requests.push({ createParagraphBullets: { bulletPreset: "BULLET_DISC_CIRCLE_SQUARE", range: { startIndex: paragraph.start, endIndex: paragraph.end } } });
+  while (currentDepth >= 0) {
+    html += `</li></${stack.pop()}>`;
+    currentDepth -= 1;
   }
-  return requests;
+  return html;
 }
 
-Deno.serve(async (req) => {
+export function markdownToGoogleHtml(markdown: string, title: string) {
+  const lines = markdown.replace(/\r\n/g, "\n").split("\n");
+  const blocks: string[] = [];
+  for (let index = 0; index < lines.length;) {
+    const line = lines[index];
+    if (!line.trim()) { index += 1; continue; }
+    const heading = /^(#{1,6})\s+(.*)$/.exec(line);
+    if (heading) {
+      blocks.push(`<h${heading[1].length}>${inlineHtml(heading[2])}</h${heading[1].length}>`);
+      index += 1;
+      continue;
+    }
+    if (/^\s*(?:[-+*]|\d+\.)\s+/.test(line)) {
+      const start = index;
+      while (index < lines.length && /^\s*(?:[-+*]|\d+\.)\s+/.test(lines[index])) index += 1;
+      blocks.push(listHtml(lines.slice(start, index)));
+      continue;
+    }
+    if (/^\s*\|/.test(line) && /^\s*\|(?:\s*:?-+:?\s*\|)+\s*$/.test(lines[index + 1] ?? "")) {
+      const rows: string[][] = [];
+      while (index < lines.length && /^\s*\|/.test(lines[index])) {
+        if (!/^\s*\|(?:\s*:?-+:?\s*\|)+\s*$/.test(lines[index])) rows.push(splitMarkdownRow(lines[index]));
+        index += 1;
+      }
+      blocks.push(`<table>${rows.map((row, rowIndex) => `<tr>${row.map((cell) => `<${rowIndex ? "td" : "th"}>${inlineHtml(cell)}</${rowIndex ? "td" : "th"}>`).join("")}</tr>`).join("")}</table>`);
+      continue;
+    }
+    blocks.push(`<p>${inlineHtml(line)}</p>`);
+    index += 1;
+  }
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title></head><body>${blocks.join("\n")}</body></html>`;
+}
+
+export async function findOrCreateGoogleDocument(accessToken: string, requestId: string, title: string, markdown: string) {
+  const markerQuery = `appProperties has { key='debatelabRequestId' and value='${requestId}' } and trashed = false`;
+  const searchUrl = new URL("https://www.googleapis.com/drive/v3/files");
+  searchUrl.search = new URLSearchParams({ fields: "files(id)", pageSize: "2", q: markerQuery, spaces: "drive" }).toString();
+  const searchResponse = await fetch(searchUrl, { headers: { Authorization: `Bearer ${accessToken}` } });
+  const search = await searchResponse.json() as { files?: Array<{ id?: string }> };
+  if (!searchResponse.ok) throw new Error("Google export reconciliation failed");
+  const existing = search.files?.find((file) => file.id)?.id;
+  if (existing) return existing;
+
+  const boundary = `debatelab_${crypto.randomUUID()}`;
+  const metadata = JSON.stringify({
+    appProperties: { debatelabRequestId: requestId },
+    mimeType: "application/vnd.google-apps.document",
+    name: title,
+  });
+  const media = markdownToGoogleHtml(markdown, title);
+  const body = [
+    `--${boundary}`,
+    "Content-Type: application/json; charset=UTF-8",
+    "",
+    metadata,
+    `--${boundary}`,
+    "Content-Type: text/html; charset=UTF-8",
+    "",
+    media,
+    `--${boundary}--`,
+    "",
+  ].join("\r\n");
+  const createdResponse = await fetch("https://www.googleapis.com/upload/drive/v3/files?uploadType=multipart&fields=id", {
+    body,
+    headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": `multipart/related; boundary=${boundary}` },
+    method: "POST",
+  });
+  const created = await createdResponse.json() as { id?: string };
+  if (!createdResponse.ok || !created.id) throw new Error("Google document creation failed");
+  return created.id;
+}
+
+export async function handleRequest(req: Request) {
   const headers = cors(req.headers.get("origin"));
   if (req.method === "OPTIONS") return new Response(null, { status: 204, headers });
   try {
@@ -160,34 +296,17 @@ Deno.serve(async (req) => {
       if (!operation || insertError && insertError.code !== "23505") throw new Error("Google export could not start");
       let fileId = operation.provider_file_id as string | null;
       if (!fileId) {
-        const createdResponse = await fetch("https://docs.googleapis.com/v1/documents", {
-          body: JSON.stringify({ title }),
-          headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
-          method: "POST",
-        });
-        const created = await createdResponse.json() as { documentId?: string };
-        if (!createdResponse.ok || !created.documentId) throw new Error("Google document creation failed");
-        fileId = created.documentId;
-        await auth.adminClient.from("google_file_operations").update({ provider_file_id: fileId, updated_at: new Date().toISOString() }).eq("id", operation.id);
+        fileId = await findOrCreateGoogleDocument(accessToken, requestId, title, markdown);
       }
-      const currentResponse = await fetch(`https://docs.googleapis.com/v1/documents/${encodeURIComponent(fileId)}`, { headers: { Authorization: `Bearer ${accessToken}` } });
-      const current = await currentResponse.json() as { body?: { content?: Array<{ endIndex?: number }> } };
-      const endIndex = current.body?.content?.at(-1)?.endIndex ?? 1;
-      const requests = [
-        ...(endIndex > 2 ? [{ deleteContentRange: { range: { startIndex: 1, endIndex: endIndex - 1 } } }] : []),
-        ...markdownRequests(markdown),
-      ];
-      const updateResponse = await fetch(`https://docs.googleapis.com/v1/documents/${encodeURIComponent(fileId)}:batchUpdate`, {
-        body: JSON.stringify({ requests }),
-        headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json" },
-        method: "POST",
-      });
-      if (!updateResponse.ok) throw new Error("Google document formatting failed");
-      await auth.adminClient.from("google_file_operations").update({ status: "complete", updated_at: new Date().toISOString() }).eq("id", operation.id);
+      const saved = await auth.adminClient.from("google_file_operations")
+        .update({ provider_file_id: fileId, status: "complete", updated_at: new Date().toISOString() }).eq("id", operation.id);
+      if (saved.error) throw new Error("Google export confirmation failed");
       return json({ documentId: fileId, url: `https://docs.google.com/document/d/${fileId}/edit` }, 200, headers);
     }
     throw new HttpError(400, "Invalid action");
   } catch (error) {
     return jsonError(error, headers);
   }
-});
+}
+
+if (import.meta.main) Deno.serve(handleRequest);
diff --git a/supabase/functions/workspace-google-docs/index_test.ts b/supabase/functions/workspace-google-docs/index_test.ts
new file mode 100644
index 000000000..74ba80bb3
--- /dev/null
+++ b/supabase/functions/workspace-google-docs/index_test.ts
@@ -0,0 +1,70 @@
+import { assertEquals, assertStringIncludes } from "jsr:@std/assert@1";
+
+Deno.env.set("SUPABASE_URL", "http://127.0.0.1:54321");
+Deno.env.set("SUPABASE_ANON_KEY", "test-anon-key");
+Deno.env.set("SUPABASE_SERVICE_ROLE_KEY", "test-service-role-key");
+const modulePromise = import("./index.ts");
+
+Deno.test("workspace Markdown becomes rich Google import HTML", async () => {
+  const { markdownToGoogleHtml } = await modulePromise;
+  const html = markdownToGoogleHtml(`# Cím Ősz
+
+1. ***Első***
+  - [Forrás](https://example.com/evidence)
+
+| Név | Érték |
+| --- | --- |
+| Árvíz | tűrő |`, "Beszéd");
+  for (const expected of ["<h1>", "<ol>", "<ul>", "<strong><em>", "<a href=\"https://example.com/evidence\"", "<table>", "Árvíz", "tűrő"]) {
+    assertStringIncludes(html, expected);
+  }
+});
+
+Deno.test("Google ordered and nested list metadata survives import", async () => {
+  const { tabsMarkdown } = await modulePromise;
+  const tabs = tabsMarkdown({
+    title: "List",
+    lists: {
+      list1: { listProperties: { nestingLevels: [{ glyphType: "DECIMAL" }, { glyphType: "GLYPH_TYPE_UNSPECIFIED" }] } },
+    },
+    body: { content: [
+      { paragraph: { bullet: { listId: "list1", nestingLevel: 0 }, elements: [{ textRun: { content: "First\n", textStyle: {} } }] } },
+      { paragraph: { bullet: { listId: "list1", nestingLevel: 1 }, elements: [{ textRun: { content: "Nested\n", textStyle: {} } }] } },
+    ] },
+  });
+  assertEquals(tabs[0].markdown, "1. First\n  - Nested");
+});
+
+Deno.test("provider marker reconciles a retry without creating another Doc", async () => {
+  const { findOrCreateGoogleDocument } = await modulePromise;
+  const originalFetch = globalThis.fetch;
+  const calls: string[] = [];
+  globalThis.fetch = (input) => {
+    calls.push(String(input));
+    return Promise.resolve(new Response(JSON.stringify({ files: [{ id: "existing-doc" }] }), { status: 200 }));
+  };
+  try {
+    assertEquals(await findOrCreateGoogleDocument("token", "a0000000-0000-4000-8000-000000000001", "Title", "# Body"), "existing-doc");
+    assertEquals(calls.length, 1);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+Deno.test("new Google Doc creation carries its idempotency marker and rich HTML atomically", async () => {
+  const { findOrCreateGoogleDocument } = await modulePromise;
+  const originalFetch = globalThis.fetch;
+  const bodies: string[] = [];
+  globalThis.fetch = (_input, init) => {
+    if (!init?.method) return Promise.resolve(new Response(JSON.stringify({ files: [] }), { status: 200 }));
+    bodies.push(String(init.body));
+    return Promise.resolve(new Response(JSON.stringify({ id: "created-doc" }), { status: 200 }));
+  };
+  try {
+    assertEquals(await findOrCreateGoogleDocument("token", "a0000000-0000-4000-8000-000000000001", "Title", "**Body**"), "created-doc");
+    assertStringIncludes(bodies[0], "debatelabRequestId");
+    assertStringIncludes(bodies[0], "<strong>Body</strong>");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});

From e86ba83f455b1aafa51026c9548e32f3ded82d1a Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Mon, 21 Sep 2026 18:25:33 +0000
Subject: [PATCH 05/18] fix(workspace): serialize Google document creation

---
 .../functions/workspace-google-docs/index.ts  | 56 ++++++++++++++---
 .../workspace-google-docs/index_test.ts       | 11 ++--
 .../20260921190000_workspace_portability.sql  | 61 +++++++++++++++++++
 supabase/tests/workspace_portability_test.sql | 39 +++++++++++-
 4 files changed, 153 insertions(+), 14 deletions(-)

diff --git a/supabase/functions/workspace-google-docs/index.ts b/supabase/functions/workspace-google-docs/index.ts
index 41b85e69f..ccf2f9411 100644
--- a/supabase/functions/workspace-google-docs/index.ts
+++ b/supabase/functions/workspace-google-docs/index.ts
@@ -50,6 +50,7 @@ function googleInline(elements: unknown[]) {
 
 function structuralMarkdown(content: unknown[], lists: Record<string, unknown> = {}) {
   const lines: string[] = [];
+  const listCounters = new Map<string, number>();
   for (const raw of content) {
     const item = raw && typeof raw === "object" ? raw as Record<string, unknown> : {};
     const paragraph = item.paragraph && typeof item.paragraph === "object" ? item.paragraph as Record<string, unknown> : null;
@@ -67,7 +68,10 @@ function structuralMarkdown(content: unknown[], lists: Record<string, unknown> =
         const nesting = Math.max(0, Number(bullet.nestingLevel ?? 0));
         const level = levels[nesting] && typeof levels[nesting] === "object" ? levels[nesting] as Record<string, unknown> : {};
         const ordered = /DECIMAL|ALPHA|ROMAN/i.test(String(level.glyphType ?? ""));
-        listPrefix = `${"  ".repeat(nesting)}${ordered ? "1." : "-"} `;
+        const counterKey = `${String(bullet.listId)}:${nesting}`;
+        const number = listCounters.get(counterKey) ?? Math.max(1, Number(level.startNumber ?? 1));
+        if (ordered) listCounters.set(counterKey, number + 1);
+        listPrefix = `${"  ".repeat(nesting)}${ordered ? `${number}.` : "-"} `;
       }
       lines.push(`${heading ? `${"#".repeat(Number(heading[1]))} ` : listPrefix}${text}`);
       continue;
@@ -127,8 +131,13 @@ function safeLink(value: string) {
 }
 
 function inlineHtml(value: string): string {
+  const literals: string[] = [];
   const links: string[] = [];
-  const withPlaceholders: string = value.replace(/\[([^\]]*)\]\(([^)]+)\)/g, (_match, label: string, destination: string): string => {
+  const withoutEscapes = value.replace(/\\([\\`*_\[\]()|])/g, (_match, literal: string) => {
+    const index = literals.push(escapeHtml(literal)) - 1;
+    return `\uE001LITERAL${index}\uE001`;
+  });
+  const withPlaceholders: string = withoutEscapes.replace(/\[([^\]]*)\]\(([^)]+)\)/g, (_match, label: string, destination: string): string => {
     const href = safeLink(destination);
     const html: string = href ? `<a href="${escapeHtml(href)}">${inlineHtml(label)}</a>` : inlineHtml(label);
     const index: number = links.push(html) - 1;
@@ -139,7 +148,8 @@ function inlineHtml(value: string): string {
     .replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>")
     .replace(/\*([^*]+)\*/g, "<em>$1</em>")
     .replace(/~~([^~]+)~~/g, "<s>$1</s>")
-    .replace(/\uE000LINK(\d+)\uE000/g, (_match, index: string) => links[Number(index)] ?? "");
+    .replace(/\uE000LINK(\d+)\uE000/g, (_match, index: string) => links[Number(index)] ?? "")
+    .replace(/\uE001LITERAL(\d+)\uE001/g, (_match, index: string) => literals[Number(index)] ?? "");
 }
 
 function splitMarkdownRow(line: string) {
@@ -163,14 +173,17 @@ function listHtml(lines: string[]) {
       html += `</${stack.pop()}>`;
       currentDepth -= 1;
     }
+    const open = () => type === "ol" && /^\d+\.$/.test(match[2])
+      ? `<ol start="${Number(match[2].slice(0, -1))}">`
+      : `<${type}>`;
     while (currentDepth < depth) {
       stack.push(type);
-      html += `<${type}>`;
+      html += open();
       currentDepth += 1;
     }
     if (currentDepth < 0) {
       stack.push(type);
-      html += `<${type}>`;
+      html += open();
       currentDepth = 0;
     }
     html += `<li>${inlineHtml(match[3])}`;
@@ -296,11 +309,36 @@ export async function handleRequest(req: Request) {
       if (!operation || insertError && insertError.code !== "23505") throw new Error("Google export could not start");
       let fileId = operation.provider_file_id as string | null;
       if (!fileId) {
-        fileId = await findOrCreateGoogleDocument(accessToken, requestId, title, markdown);
+        const claimId = crypto.randomUUID();
+        const claimResult = await auth.adminClient.rpc("claim_google_file_operation", {
+          p_claim_id: claimId,
+          p_request_id: requestId,
+          p_user_id: auth.user.id,
+        });
+        const claim = Array.isArray(claimResult.data) ? claimResult.data[0] : claimResult.data;
+        if (claimResult.error || !claim) throw new Error("Google export could not claim creation");
+        if (!claim.claimed) {
+          for (let attempt = 0; attempt < 20; attempt += 1) {
+            await new Promise((resolve) => setTimeout(resolve, 250));
+            const current = await auth.adminClient.from("google_file_operations")
+              .select("provider_file_id,status").eq("id", operation.id).single();
+            if (current.data?.provider_file_id && current.data.status === "complete") {
+              fileId = current.data.provider_file_id;
+              break;
+            }
+          }
+          if (!fileId) throw new HttpError(409, "Google export is already in progress");
+        } else {
+          fileId = await findOrCreateGoogleDocument(accessToken, requestId, title, markdown);
+          const finished = await auth.adminClient.rpc("finish_google_file_operation", {
+            p_claim_id: claimId,
+            p_operation_id: operation.id,
+            p_provider_file_id: fileId,
+          });
+          if (finished.error || finished.data !== true) throw new Error("Google export confirmation failed");
+        }
       }
-      const saved = await auth.adminClient.from("google_file_operations")
-        .update({ provider_file_id: fileId, status: "complete", updated_at: new Date().toISOString() }).eq("id", operation.id);
-      if (saved.error) throw new Error("Google export confirmation failed");
+      if (!fileId) throw new Error("Google export did not return a document");
       return json({ documentId: fileId, url: `https://docs.google.com/document/d/${fileId}/edit` }, 200, headers);
     }
     throw new HttpError(400, "Invalid action");
diff --git a/supabase/functions/workspace-google-docs/index_test.ts b/supabase/functions/workspace-google-docs/index_test.ts
index 74ba80bb3..6a61a06b2 100644
--- a/supabase/functions/workspace-google-docs/index_test.ts
+++ b/supabase/functions/workspace-google-docs/index_test.ts
@@ -9,15 +9,18 @@ Deno.test("workspace Markdown becomes rich Google import HTML", async () => {
   const { markdownToGoogleHtml } = await modulePromise;
   const html = markdownToGoogleHtml(`# Cím Ősz
 
-1. ***Első***
+3. ***Első***
   - [Forrás](https://example.com/evidence)
 
+\\*literal\\*
+
 | Név | Érték |
 | --- | --- |
 | Árvíz | tűrő |`, "Beszéd");
-  for (const expected of ["<h1>", "<ol>", "<ul>", "<strong><em>", "<a href=\"https://example.com/evidence\"", "<table>", "Árvíz", "tűrő"]) {
+  for (const expected of ["<h1>", "<ol start=\"3\">", "<ul>", "<strong><em>", "<a href=\"https://example.com/evidence\"", "<table>", "*literal*", "Árvíz", "tűrő"]) {
     assertStringIncludes(html, expected);
   }
+  if (html.includes("<em>literal</em>")) throw new Error("escaped literal became formatting");
 });
 
 Deno.test("Google ordered and nested list metadata survives import", async () => {
@@ -25,14 +28,14 @@ Deno.test("Google ordered and nested list metadata survives import", async () =>
   const tabs = tabsMarkdown({
     title: "List",
     lists: {
-      list1: { listProperties: { nestingLevels: [{ glyphType: "DECIMAL" }, { glyphType: "GLYPH_TYPE_UNSPECIFIED" }] } },
+      list1: { listProperties: { nestingLevels: [{ glyphType: "DECIMAL", startNumber: 3 }, { glyphType: "GLYPH_TYPE_UNSPECIFIED" }] } },
     },
     body: { content: [
       { paragraph: { bullet: { listId: "list1", nestingLevel: 0 }, elements: [{ textRun: { content: "First\n", textStyle: {} } }] } },
       { paragraph: { bullet: { listId: "list1", nestingLevel: 1 }, elements: [{ textRun: { content: "Nested\n", textStyle: {} } }] } },
     ] },
   });
-  assertEquals(tabs[0].markdown, "1. First\n  - Nested");
+  assertEquals(tabs[0].markdown, "3. First\n  - Nested");
 });
 
 Deno.test("provider marker reconciles a retry without creating another Doc", async () => {
diff --git a/supabase/migrations/20260921190000_workspace_portability.sql b/supabase/migrations/20260921190000_workspace_portability.sql
index 894cc2ac8..f25af8aaf 100644
--- a/supabase/migrations/20260921190000_workspace_portability.sql
+++ b/supabase/migrations/20260921190000_workspace_portability.sql
@@ -184,6 +184,8 @@ CREATE TABLE public.google_file_operations (
   request_id uuid NOT NULL,
   kind text NOT NULL CHECK (kind IN ('export')),
   provider_file_id text,
+  provider_claim_id uuid,
+  provider_claimed_at timestamptz,
   status text NOT NULL DEFAULT 'progress' CHECK (status IN ('progress', 'complete')),
   created_at timestamptz NOT NULL DEFAULT now(),
   updated_at timestamptz NOT NULL DEFAULT now(),
@@ -279,3 +281,62 @@ FROM PUBLIC, anon, authenticated;
 GRANT EXECUTE ON FUNCTION public.claim_google_connection_refresh(uuid, uuid, uuid),
   public.finish_google_connection_refresh(uuid, uuid, text, timestamptz, text)
 TO service_role;
+
+CREATE FUNCTION public.claim_google_file_operation(
+  p_user_id uuid,
+  p_request_id uuid,
+  p_claim_id uuid
+)
+RETURNS TABLE (
+  operation_id uuid,
+  provider_file_id text,
+  status text,
+  claimed boolean
+)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+BEGIN
+  RETURN QUERY
+  UPDATE public.google_file_operations
+  SET provider_claim_id = CASE
+        WHEN google_file_operations.provider_claim_id IS NULL OR google_file_operations.provider_claimed_at < now() - interval '1 minute'
+        THEN p_claim_id ELSE google_file_operations.provider_claim_id END,
+      provider_claimed_at = CASE
+        WHEN google_file_operations.provider_claim_id IS NULL OR google_file_operations.provider_claimed_at < now() - interval '1 minute'
+        THEN now() ELSE google_file_operations.provider_claimed_at END
+  WHERE user_id = p_user_id AND request_id = p_request_id
+  RETURNING id, google_file_operations.provider_file_id,
+    google_file_operations.status, google_file_operations.provider_claim_id = p_claim_id;
+END;
+$$;
+
+CREATE FUNCTION public.finish_google_file_operation(
+  p_operation_id uuid,
+  p_claim_id uuid,
+  p_provider_file_id text
+)
+RETURNS boolean
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = ''
+AS $$
+DECLARE v_updated bigint;
+BEGIN
+  UPDATE public.google_file_operations
+  SET provider_file_id = p_provider_file_id,
+      status = 'complete', provider_claim_id = NULL,
+      provider_claimed_at = NULL, updated_at = now()
+  WHERE id = p_operation_id AND provider_claim_id = p_claim_id;
+  GET DIAGNOSTICS v_updated = ROW_COUNT;
+  RETURN v_updated > 0;
+END;
+$$;
+
+REVOKE ALL ON FUNCTION public.claim_google_file_operation(uuid, uuid, uuid),
+  public.finish_google_file_operation(uuid, uuid, text)
+FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.claim_google_file_operation(uuid, uuid, uuid),
+  public.finish_google_file_operation(uuid, uuid, text)
+TO service_role;
diff --git a/supabase/tests/workspace_portability_test.sql b/supabase/tests/workspace_portability_test.sql
index 48097bec4..6940c5057 100644
--- a/supabase/tests/workspace_portability_test.sql
+++ b/supabase/tests/workspace_portability_test.sql
@@ -1,5 +1,5 @@
 BEGIN;
-SELECT plan(18);
+SELECT plan(22);
 
 SELECT has_table('public', 'private_writing_items', 'private writing library exists');
 SELECT has_table('public', 'workspace_document_provenance', 'workspace import provenance exists');
@@ -7,6 +7,8 @@ SELECT has_table('public', 'google_connections', 'separate Google connections ex
 SELECT has_table('public', 'google_file_operations', 'idempotent Google operations exist');
 SELECT has_function('public', 'get_workspace_export_manifest', ARRAY['uuid','uuid[]','boolean'], 'packet export captures a server manifest');
 SELECT has_function('public', 'save_workspace_document_provenance', ARRAY['uuid','uuid','text','jsonb'], 'imports record provenance through an RPC');
+SELECT has_function('public', 'claim_google_file_operation', ARRAY['uuid','uuid','uuid'], 'Google export creation has a database claim');
+SELECT has_function('public', 'finish_google_file_operation', ARRAY['uuid','uuid','text'], 'Google export completion confirms its claim');
 SELECT ok((SELECT relrowsecurity FROM pg_class WHERE oid = 'public.private_writing_items'::regclass), 'private writing enables RLS');
 SELECT ok((SELECT relrowsecurity FROM pg_class WHERE oid = 'public.google_connections'::regclass), 'Google connections enable RLS');
 
@@ -71,5 +73,40 @@ SELECT ok(NOT has_table_privilege('anon', 'public.private_writing_items', 'SELEC
 SELECT ok(NOT has_column_privilege('authenticated', 'public.google_connections', 'refresh_token_ciphertext', 'SELECT'), 'browser cannot read encrypted refresh tokens');
 SELECT ok(NOT has_function_privilege('authenticated', 'public.claim_google_connection_refresh(uuid,uuid,uuid)', 'EXECUTE'), 'browser cannot claim token refresh');
 
+INSERT INTO public.google_connections (
+  id, user_id, email, account_label, refresh_token_ciphertext
+) VALUES (
+  'a0000000-0000-4000-8000-000000000010',
+  'a1111111-1111-4111-8111-111111111111',
+  'owner@example.com', 'Owner', 'encrypted'
+);
+INSERT INTO public.google_file_operations (
+  id, user_id, connection_id, request_id, kind
+) VALUES (
+  'a0000000-0000-4000-8000-000000000011',
+  'a1111111-1111-4111-8111-111111111111',
+  'a0000000-0000-4000-8000-000000000010',
+  'a0000000-0000-4000-8000-000000000012', 'export'
+);
+SET LOCAL ROLE service_role;
+SELECT results_eq(
+  $$SELECT claimed FROM public.claim_google_file_operation(
+    'a1111111-1111-4111-8111-111111111111',
+    'a0000000-0000-4000-8000-000000000012',
+    'a0000000-0000-4000-8000-000000000013'
+  )$$,
+  ARRAY[true],
+  'first Google export worker owns creation'
+);
+SELECT results_eq(
+  $$SELECT claimed FROM public.claim_google_file_operation(
+    'a1111111-1111-4111-8111-111111111111',
+    'a0000000-0000-4000-8000-000000000012',
+    'a0000000-0000-4000-8000-000000000014'
+  )$$,
+  ARRAY[false],
+  'concurrent Google export worker cannot create a duplicate'
+);
+
 SELECT * FROM finish();
 ROLLBACK;

From 4ca8a87bf9632a4f1a1e3dc61177a046db8c91a8 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Mon, 21 Sep 2026 18:28:05 +0000
Subject: [PATCH 06/18] test(workspace): cover portability journey

---
 e2e/workspace-collaboration.spec.ts | 80 +++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)

diff --git a/e2e/workspace-collaboration.spec.ts b/e2e/workspace-collaboration.spec.ts
index c9b23392d..b77dfa183 100644
--- a/e2e/workspace-collaboration.spec.ts
+++ b/e2e/workspace-collaboration.spec.ts
@@ -488,3 +488,83 @@ test("workspace evidence, team AI review, and practice survive a teammate reload
     await Promise.allSettled(ids.map((id) => admin.auth.admin.deleteUser(id)));
   }
 });
+
+test("private writing and independent imports export useful workspace files", async ({ browser }, testInfo) => {
+  test.skip(testInfo.project.name === "mobile-chromium", "The complete mobile collaboration journey runs above");
+  test.setTimeout(120_000);
+  const admin = createClient(supabaseUrl!, serviceKey!, { auth: { persistSession: false } });
+  const password = `Local-${crypto.randomUUID()}!`;
+  const ids: string[] = [];
+  const contexts: BrowserContext[] = [];
+  let collaboration: ChildProcess | undefined;
+
+  try {
+    const email = `portability-${Date.now()}-${crypto.randomUUID()}@workspace.test`;
+    const created = await admin.auth.admin.createUser({ email, email_confirm: true, password });
+    if (created.error || !created.data.user) throw created.error ?? new Error("User creation failed");
+    ids.push(created.data.user.id);
+    const client = createClient(supabaseUrl!, anonKey!, { auth: { persistSession: false } });
+    const signedIn = await client.auth.signInWithPassword({ email, password });
+    if (signedIn.error || !signedIn.data.session) throw signedIn.error ?? new Error("Sign in failed");
+
+    collaboration = await startCollaboration();
+    const owner = await authenticatedPage(browser, signedIn.data.session);
+    contexts.push(owner.context);
+    await owner.page.goto("/app/workspaces");
+    await owner.page.getByRole("textbox", { name: "Motion" }).fill("Schools should teach media literacy");
+    await owner.page.getByRole("button", { name: "Create workspace" }).click();
+    await expect(owner.page).toHaveURL(/\/app\/workspaces\/[0-9a-f-]+$/, { timeout: 20_000 });
+    await owner.page.getByRole("button", { name: "R1" }).click();
+    await owner.page.locator(".ProseMirror").fill("Reusable R1 paragraph");
+    await expect(owner.page.getByText("Saved", { exact: true })).toBeVisible();
+
+    await owner.page.locator(".ProseMirror").click();
+    await owner.page.locator(".ProseMirror").press("ControlOrMeta+A");
+    owner.page.once("dialog", (dialog) => dialog.accept("R1 snippet"));
+    await owner.page.getByRole("button", { name: "Save snippet" }).click();
+    owner.page.once("dialog", (dialog) => dialog.accept("R1 template"));
+    await owner.page.getByRole("button", { name: "Save template" }).click();
+    await expect.poll(async () => {
+      const result = await admin.from("private_writing_items").select("id").eq("user_id", ids[0]);
+      if (result.error) throw result.error;
+      return result.data.length;
+    }).toBe(2);
+
+    await owner.page.goto("/app/workspaces");
+    await owner.page.getByRole("textbox", { name: "Motion" }).fill("Cities should expand transit");
+    await owner.page.getByRole("button", { name: "Create workspace" }).click();
+    await expect(owner.page).toHaveURL(/\/app\/workspaces\/[0-9a-f-]+$/, { timeout: 20_000 });
+    await owner.page.getByRole("button", { name: "R1" }).click();
+    await openPanel(owner.page, "Import, reuse & export");
+    const snippet = owner.page.getByText("R1 snippet", { exact: true }).locator("..");
+    await snippet.getByRole("button", { name: "Insert copy" }).click();
+    await expect(owner.page.locator(".ProseMirror")).toContainText("Reusable R1 paragraph");
+    const changed = await admin.from("private_writing_items").update({
+      content: { type: "doc", content: [{ type: "paragraph", content: [{ type: "text", text: "Changed original" }] }] },
+    }).eq("user_id", ids[0]).eq("title", "R1 snippet");
+    if (changed.error) throw changed.error;
+    await expect(owner.page.locator(".ProseMirror")).not.toContainText("Changed original");
+
+    await owner.page.locator("#workspace-document-import").setInputFiles({
+      buffer: Buffer.from("# Importált beszéd\n\n1. Árvíztűrő tükörfúrógép\n2. [Forrás](https://example.com)"),
+      mimeType: "text/markdown",
+      name: "speech.md",
+    });
+    await expect(owner.page.getByLabel("Import preview")).toContainText("Árvíztűrő");
+    await owner.page.getByRole("button", { name: "Replace with independent copy" }).click();
+    await expect(owner.page.locator(".ProseMirror")).toContainText("Árvíztűrő tükörfúrógép");
+    await expect(owner.page.getByText("Saved", { exact: true })).toBeVisible();
+
+    const portability = owner.page.locator("details").filter({ has: owner.page.locator("summary").filter({ hasText: "Import, reuse & export" }) });
+    for (const name of ["DOCX", "PDF", "Packet DOCX", "Packet PDF"]) {
+      const download = owner.page.waitForEvent("download");
+      await portability.getByRole("button", { name, exact: true }).click();
+      await expect(await download).toBeTruthy();
+    }
+    await expect(portability.getByRole("button", { name: "Connect another Google account" })).toBeVisible();
+  } finally {
+    await stop(collaboration);
+    await Promise.allSettled(contexts.map((context) => context.close()));
+    await Promise.allSettled(ids.map((id) => admin.auth.admin.deleteUser(id)));
+  }
+});

From 19d2b8a853f356aedbdae71b979accdc25c99d22 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 17:51:58 +0000
Subject: [PATCH 07/18] fix(workspace): bound Google portability claims

---
 .../_shared/google-connections.test.ts        | 27 +++++++++++++++++++
 .../functions/_shared/google-connections.ts   |  3 ++-
 .../functions/_shared/google-cors.test.ts     | 21 +++++++++++++++
 .../functions/_shared/native-cors.test.ts     |  2 +-
 .../functions/google-connections/index.ts     |  8 +++---
 .../functions/workspace-google-docs/index.ts  | 13 ++++++---
 .../workspace-google-docs/index_test.ts       | 24 ++++++++++++++++-
 7 files changed, 89 insertions(+), 9 deletions(-)
 create mode 100644 supabase/functions/_shared/google-cors.test.ts

diff --git a/supabase/functions/_shared/google-connections.test.ts b/supabase/functions/_shared/google-connections.test.ts
index c00bd28d5..72743a62d 100644
--- a/supabase/functions/_shared/google-connections.test.ts
+++ b/supabase/functions/_shared/google-connections.test.ts
@@ -50,6 +50,33 @@ Deno.test("refresh preserves an omitted replacement refresh token", async () =>
   }
 });
 
+Deno.test("a slow refresh aborts before its database claim can expire", async () => {
+  Deno.env.set("GOOGLE_CONNECTION_ENCRYPTION_KEY", btoa("12345678901234567890123456789012"));
+  const refresh = await encryptGoogleSecret("refresh-secret");
+  const calls: Array<{ name: string; parameters: Record<string, unknown> }> = [];
+  const database = {
+    from: () => ({ select: () => ({ eq: () => ({ maybeSingle: async () => ({ data: null, error: null }) }) }) }),
+    rpc: async (name: string, parameters: Record<string, unknown>) => {
+      calls.push({ name, parameters });
+      if (name === "claim_google_connection_refresh") return { data: [{ access_token_ciphertext: null, access_expires_at: null, refresh_token_ciphertext: refresh, claimed: true }], error: null };
+      return { data: true, error: null };
+    },
+  };
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (_input, init) => new Promise<Response>((_resolve, reject) => {
+    const signal = init?.signal;
+    const abort = () => reject(signal?.reason ?? new Error("aborted"));
+    if (signal?.aborted) abort();
+    else signal?.addEventListener("abort", abort, { once: true });
+  });
+  try {
+    await assertRejects(() => getGoogleAccessToken(database as never, USER_ID, CONNECTION_ID, 1));
+    assertEquals(calls.at(-1)?.name, "finish_google_connection_refresh");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
 Deno.test("a foreign or missing connection is rejected", async () => {
   const database = {
     from: () => ({ select: () => ({ eq: () => ({ maybeSingle: async () => ({ data: null, error: null }) }) }) }),
diff --git a/supabase/functions/_shared/google-connections.ts b/supabase/functions/_shared/google-connections.ts
index 1ecf31568..7bcb2416d 100644
--- a/supabase/functions/_shared/google-connections.ts
+++ b/supabase/functions/_shared/google-connections.ts
@@ -59,7 +59,7 @@ function row(value: unknown): Record<string, unknown> | null {
   return value && typeof value === "object" ? value as Record<string, unknown> : null;
 }
 
-export async function getGoogleAccessToken(database: ServiceDatabase, userId: string, connectionId: string) {
+export async function getGoogleAccessToken(database: ServiceDatabase, userId: string, connectionId: string, providerTimeoutMs = 30_000) {
   const claimId = crypto.randomUUID();
   const claim = await database.rpc("claim_google_connection_refresh", {
     p_claim_id: claimId,
@@ -106,6 +106,7 @@ export async function getGoogleAccessToken(database: ServiceDatabase, userId: st
       }),
       headers: { "Content-Type": "application/x-www-form-urlencoded" },
       method: "POST",
+      signal: AbortSignal.timeout(providerTimeoutMs),
     });
     const payload = await response.json() as { access_token?: string; expires_in?: number; refresh_token?: string };
     if (!response.ok || !payload.access_token) throw new Error("Google token refresh failed");
diff --git a/supabase/functions/_shared/google-cors.test.ts b/supabase/functions/_shared/google-cors.test.ts
new file mode 100644
index 000000000..a65061e54
--- /dev/null
+++ b/supabase/functions/_shared/google-cors.test.ts
@@ -0,0 +1,21 @@
+import { assertEquals } from "jsr:@std/assert@1";
+
+Deno.env.set("SUPABASE_URL", "http://127.0.0.1:54321");
+Deno.env.set("SUPABASE_ANON_KEY", "test-anon-key");
+Deno.env.set("SUPABASE_SERVICE_ROLE_KEY", "test-service-role-key");
+const modules = Promise.all([
+  import("../google-connections/index.ts"),
+  import("../workspace-google-docs/index.ts"),
+]);
+
+for (const [name, index] of [["connections", 0], ["documents", 1]] as const) {
+  Deno.test(`Google ${name} preflight allows the isolated browser origin`, async () => {
+    const handler = (await modules)[index].handleRequest;
+    const response = await handler(new Request("http://localhost", {
+      headers: { Origin: "http://127.0.0.1:18080" },
+      method: "OPTIONS",
+    }));
+    assertEquals(response.status, 204);
+    assertEquals(response.headers.get("Access-Control-Allow-Origin"), "http://127.0.0.1:18080");
+  });
+}
diff --git a/supabase/functions/_shared/native-cors.test.ts b/supabase/functions/_shared/native-cors.test.ts
index 1db079a41..d5b29ae9d 100644
--- a/supabase/functions/_shared/native-cors.test.ts
+++ b/supabase/functions/_shared/native-cors.test.ts
@@ -22,7 +22,7 @@ for (const functionName of browserCalledFunctions) {
   });
 }
 
-for (const functionName of ["admin", "announcements"]) {
+for (const functionName of ["admin", "announcements", "google-connections", "workspace-google-docs"]) {
   Deno.test(`${functionName} allows the isolated staging browser origin`, async () => {
     const source = await Deno.readTextFile(new URL(`../${functionName}/index.ts`, import.meta.url));
     assertStringIncludes(source, '"http://127.0.0.1:18080"');
diff --git a/supabase/functions/google-connections/index.ts b/supabase/functions/google-connections/index.ts
index 7a833cedf..629436485 100644
--- a/supabase/functions/google-connections/index.ts
+++ b/supabase/functions/google-connections/index.ts
@@ -8,7 +8,7 @@ import {
 } from "../_shared/google-connections.ts";
 
 const DRIVE_SCOPE = "https://www.googleapis.com/auth/drive.file";
-const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080", "capacitor://localhost"];
+const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080", "http://127.0.0.1:18080", "capacitor://localhost"];
 
 function cors(origin: string | null) {
   return {
@@ -92,7 +92,7 @@ async function callback(req: Request) {
   return Response.redirect(new URL(`${stored.return_to}${stored.return_to.includes("?") ? "&" : "?"}google=connected`, appOrigin), 302);
 }
 
-Deno.serve(async (req) => {
+export async function handleRequest(req: Request) {
   const headers = cors(req.headers.get("origin"));
   if (req.method === "OPTIONS") return new Response(null, { status: 204, headers });
   try {
@@ -151,4 +151,6 @@ Deno.serve(async (req) => {
   } catch (error) {
     return jsonError(error, headers);
   }
-});
+}
+
+if (import.meta.main) Deno.serve(handleRequest);
diff --git a/supabase/functions/workspace-google-docs/index.ts b/supabase/functions/workspace-google-docs/index.ts
index ccf2f9411..3f9cc8215 100644
--- a/supabase/functions/workspace-google-docs/index.ts
+++ b/supabase/functions/workspace-google-docs/index.ts
@@ -1,7 +1,7 @@
 import { HttpError, jsonError, requireUser } from "../_shared/auth.ts";
 import { getGoogleAccessToken } from "../_shared/google-connections.ts";
 
-const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080", "capacitor://localhost"];
+const ORIGINS = ["https://debate.pi-stack.org", "http://localhost:8080", "http://localhost:18080", "http://127.0.0.1:18080", "capacitor://localhost"];
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
 function cors(origin: string | null) {
@@ -228,11 +228,17 @@ export function markdownToGoogleHtml(markdown: string, title: string) {
   return `<!doctype html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title></head><body>${blocks.join("\n")}</body></html>`;
 }
 
-export async function findOrCreateGoogleDocument(accessToken: string, requestId: string, title: string, markdown: string) {
+export async function findOrCreateGoogleDocument(
+  accessToken: string,
+  requestId: string,
+  title: string,
+  markdown: string,
+  signal: AbortSignal = AbortSignal.timeout(30_000),
+) {
   const markerQuery = `appProperties has { key='debatelabRequestId' and value='${requestId}' } and trashed = false`;
   const searchUrl = new URL("https://www.googleapis.com/drive/v3/files");
   searchUrl.search = new URLSearchParams({ fields: "files(id)", pageSize: "2", q: markerQuery, spaces: "drive" }).toString();
-  const searchResponse = await fetch(searchUrl, { headers: { Authorization: `Bearer ${accessToken}` } });
+  const searchResponse = await fetch(searchUrl, { headers: { Authorization: `Bearer ${accessToken}` }, signal });
   const search = await searchResponse.json() as { files?: Array<{ id?: string }> };
   if (!searchResponse.ok) throw new Error("Google export reconciliation failed");
   const existing = search.files?.find((file) => file.id)?.id;
@@ -261,6 +267,7 @@ export async function findOrCreateGoogleDocument(accessToken: string, requestId:
     body,
     headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": `multipart/related; boundary=${boundary}` },
     method: "POST",
+    signal,
   });
   const created = await createdResponse.json() as { id?: string };
   if (!createdResponse.ok || !created.id) throw new Error("Google document creation failed");
diff --git a/supabase/functions/workspace-google-docs/index_test.ts b/supabase/functions/workspace-google-docs/index_test.ts
index 6a61a06b2..aaeb0b37b 100644
--- a/supabase/functions/workspace-google-docs/index_test.ts
+++ b/supabase/functions/workspace-google-docs/index_test.ts
@@ -1,4 +1,4 @@
-import { assertEquals, assertStringIncludes } from "jsr:@std/assert@1";
+import { assertEquals, assertRejects, assertStringIncludes } from "jsr:@std/assert@1";
 
 Deno.env.set("SUPABASE_URL", "http://127.0.0.1:54321");
 Deno.env.set("SUPABASE_ANON_KEY", "test-anon-key");
@@ -71,3 +71,25 @@ Deno.test("new Google Doc creation carries its idempotency marker and rich HTML
     globalThis.fetch = originalFetch;
   }
 });
+
+Deno.test("slow Drive reconciliation aborts before its creation claim can expire", async () => {
+  const { findOrCreateGoogleDocument } = await modulePromise;
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = (_input, init) => new Promise<Response>((_resolve, reject) => {
+    const signal = init?.signal;
+    const abort = () => reject(signal?.reason ?? new Error("aborted"));
+    if (signal?.aborted) abort();
+    else signal?.addEventListener("abort", abort, { once: true });
+  });
+  try {
+    await assertRejects(() => findOrCreateGoogleDocument(
+      "token",
+      "a0000000-0000-4000-8000-000000000001",
+      "Title",
+      "Body",
+      AbortSignal.timeout(1),
+    ));
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});

From 580fd984fe5ffe6a9a9a98991cea062fccb5ddf8 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 19:30:16 +0000
Subject: [PATCH 08/18] chore(workspace): add private trial lifecycle

---
 .superset/workspace-trial-nginx.conf |  50 +++++++++++
 .superset/workspace-trial.sh         | 129 +++++++++++++++++++++++++++
 scripts/workspace-test-env.mjs       |   6 +-
 3 files changed, 183 insertions(+), 2 deletions(-)
 create mode 100644 .superset/workspace-trial-nginx.conf
 create mode 100755 .superset/workspace-trial.sh

diff --git a/.superset/workspace-trial-nginx.conf b/.superset/workspace-trial-nginx.conf
new file mode 100644
index 000000000..3d4357aa1
--- /dev/null
+++ b/.superset/workspace-trial-nginx.conf
@@ -0,0 +1,50 @@
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    '' close;
+}
+
+server {
+    listen 127.0.0.1:18480;
+    server_name codex-remote.tailab0ab3.ts.net;
+
+    if ($host != "codex-remote.tailab0ab3.ts.net:18443") { return 444; }
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; img-src 'self' data: https:; font-src 'self' data: https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src 'self' https://*.jam.dev; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com https://*.jam.dev; connect-src 'self' wss://codex-remote.tailab0ab3.ts.net:18443 https://*.jam.dev https://oauth2.googleapis.com https://www.googleapis.com;" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "no-referrer" always;
+    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
+    add_header X-Robots-Tag "noindex, nofollow" always;
+
+    location ^~ /supabase/ {
+        proxy_pass http://127.0.0.1:54321/;
+        proxy_set_header Host 127.0.0.1:54321;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-Host $host;
+    }
+
+    location = /collaboration {
+        proxy_pass http://127.0.0.1:12345;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host 127.0.0.1:12345;
+        proxy_read_timeout 1h;
+    }
+
+    location ^~ /access/ {
+        proxy_pass http://127.0.0.1:12345;
+        proxy_set_header Host 127.0.0.1:12345;
+    }
+
+    location ^~ /review/ {
+        proxy_pass http://127.0.0.1:12345;
+        proxy_set_header Host 127.0.0.1:12345;
+    }
+
+    location ~ /\. { return 404; }
+    location ~* \.(?:env|log|lock|md|ya?ml)$ { return 404; }
+    location / { try_files $uri $uri/ /index.html; }
+}
diff --git a/.superset/workspace-trial.sh b/.superset/workspace-trial.sh
new file mode 100755
index 000000000..5477cd4bd
--- /dev/null
+++ b/.superset/workspace-trial.sh
@@ -0,0 +1,129 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$DIR/lib/lock.sh"
+
+DB_LOCK="$HOME/.superset/debatelab-db.lock"
+TRIAL_ORIGIN="https://codex-remote.tailab0ab3.ts.net:18443"
+APP_PORT=18480
+COLLABORATION_PORT=12345
+SERVE_PORT=18443
+PROXY_NAME="debatelab-workspace-trial-proxy"
+
+runtime_dir=""
+stack_started=false
+serve_started=false
+owned_pids=()
+
+stop_owned_processes() {
+  local index
+  docker rm --force "$PROXY_NAME" >/dev/null 2>&1 || true
+  for ((index=${#owned_pids[@]}-1; index>=0; index--)); do
+    kill -- "-${owned_pids[$index]}" 2>/dev/null || true
+  done
+  for ((index=${#owned_pids[@]}-1; index>=0; index--)); do
+    wait "${owned_pids[$index]}" 2>/dev/null || true
+  done
+}
+
+cleanup() {
+  local status=$?
+  trap - EXIT INT TERM
+  if [ "$serve_started" = true ]; then
+    tailscale serve --https="$SERVE_PORT" off >/dev/null 2>&1 || status=1
+  fi
+  stop_owned_processes
+  if [ "$stack_started" = true ] && ! supabase stop; then
+    status=1
+  fi
+  if [ -n "$runtime_dir" ] && [ -d "$runtime_dir" ]; then
+    rm -r -- "$runtime_dir"
+  fi
+  lock_release "$DB_LOCK"
+  exit "$status"
+}
+
+for port in "$APP_PORT" "$COLLABORATION_PORT"; do
+  if ss -ltn "sport = :$port" | tail -n +2 | grep -q .; then
+    echo "Workspace trial port $port is already in use" >&2
+    exit 1
+  fi
+done
+if tailscale serve status --json | node -e 'const s=JSON.parse(require("fs").readFileSync(0,"utf8")); process.exit(s.TCP?.[process.argv[1]] ? 0 : 1)' "$SERVE_PORT"; then
+  echo "Tailscale Serve port $SERVE_PORT is already configured" >&2
+  exit 1
+fi
+if supabase status -o json >/dev/null 2>&1; then
+  echo "A local Supabase stack is already running" >&2
+  exit 1
+fi
+
+lock_acquire "$DB_LOCK" 600
+trap cleanup EXIT INT TERM
+runtime_dir="$(mktemp -d)"
+
+supabase start >"$runtime_dir/supabase.log" 2>&1
+stack_started=true
+status_json="$(supabase status -o json 2>/dev/null)"
+status_value() {
+  node -e 'const value=JSON.parse(process.argv[1])[process.argv[2]]; if (!value) process.exit(1); process.stdout.write(String(value))' "$status_json" "$1"
+}
+api_url="$(status_value API_URL)"
+anon_key="$(status_value ANON_KEY)"
+service_role_key="$(status_value SERVICE_ROLE_KEY)"
+database_url="$(status_value DB_URL)"
+project_id="$(basename "$(pwd)")"
+mailer_host="$(docker ps --filter "name=supabase_inbucket_$project_id" --format '{{.Names}}')"
+if [ -z "$mailer_host" ]; then
+  echo "Local Mailpit container is unavailable" >&2
+  exit 1
+fi
+
+LOCAL_SERVICE_ROLE_KEY="$service_role_key" \
+LOCAL_MAILER_HOST="$mailer_host" \
+  node scripts/workspace-test-env.mjs .superset/workspace-test.env "$runtime_dir/function.env" "$TRIAL_ORIGIN"
+
+setsid supabase functions serve workspace-invites --no-verify-jwt \
+  --env-file "$runtime_dir/function.env" >"$runtime_dir/functions.log" 2>&1 &
+owned_pids+=("$!")
+
+COLLABORATION_DATABASE_URL="$database_url" \
+COLLABORATION_PORT="$COLLABORATION_PORT" \
+COLLABORATION_ALLOWED_ORIGINS="$TRIAL_ORIGIN" \
+SUPABASE_URL="$api_url" \
+SUPABASE_ANON_KEY="$anon_key" \
+  setsid npm run start:collaboration >"$runtime_dir/collaboration.log" 2>&1 &
+owned_pids+=("$!")
+
+VITE_LOCAL_PREVIEW=true \
+VITE_LOCAL_SUPABASE_URL="$TRIAL_ORIGIN/supabase" \
+VITE_LOCAL_SUPABASE_ANON_KEY="$anon_key" \
+VITE_COLLABORATION_URL="wss://codex-remote.tailab0ab3.ts.net:$SERVE_PORT/collaboration" \
+  npm run build
+
+setsid docker run --rm --name "$PROXY_NAME" --network host \
+  --volume "$PWD/dist:/usr/share/nginx/html:ro" \
+  --volume "$DIR/workspace-trial-nginx.conf:/etc/nginx/conf.d/default.conf:ro" \
+  nginx:alpine >"$runtime_dir/proxy.log" 2>&1 &
+owned_pids+=("$!")
+
+for _ in $(seq 1 200); do
+  if curl --fail --silent --output /dev/null --header "Host: codex-remote.tailab0ab3.ts.net:$SERVE_PORT" "http://127.0.0.1:$APP_PORT"; then break; fi
+  sleep 0.1
+done
+curl --fail --silent --output /dev/null --header "Host: codex-remote.tailab0ab3.ts.net:$SERVE_PORT" "http://127.0.0.1:$APP_PORT"
+
+tailscale serve --bg --https="$SERVE_PORT" "http://127.0.0.1:$APP_PORT"
+serve_started=true
+curl --fail --silent --output /dev/null "$TRIAL_ORIGIN"
+
+echo "Workspace trial ready: $TRIAL_ORIGIN"
+echo "Commit: $(git rev-parse HEAD)"
+echo "Stop with: systemctl --user stop debatelab-workspace-trial.service"
+
+while kill -0 "${owned_pids[0]}" 2>/dev/null && kill -0 "${owned_pids[1]}" 2>/dev/null; do
+  sleep 5
+done
+echo "A workspace trial process exited unexpectedly" >&2
+exit 1
diff --git a/scripts/workspace-test-env.mjs b/scripts/workspace-test-env.mjs
index 48b67bb6f..6b5dc99b5 100644
--- a/scripts/workspace-test-env.mjs
+++ b/scripts/workspace-test-env.mjs
@@ -1,8 +1,10 @@
 import { readFile, writeFile } from "node:fs/promises";
 
-const [source, target] = process.argv.slice(2);
+const [source, target, appOrigin] = process.argv.slice(2);
 const serviceRoleKey = process.env.LOCAL_SERVICE_ROLE_KEY;
 const mailerHost = process.env.LOCAL_MAILER_HOST;
 if (!source || !target || !serviceRoleKey || !mailerHost) throw new Error("Local Edge environment is incomplete");
-const fixture = (await readFile(source, "utf8")).replace("workspace-mailer.invalid", mailerHost);
+const fixture = (await readFile(source, "utf8"))
+  .replace("workspace-mailer.invalid", mailerHost)
+  .replaceAll("http://127.0.0.1:18081", appOrigin || "http://127.0.0.1:18081");
 await writeFile(target, `${fixture.trim()}\nWORKSPACE_INVITE_SERVICE_ROLE_KEY=${serviceRoleKey}\n`, { mode: 0o600 });

From 64381e764a43b3f90c7d76fc51905b720d3f1e49 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 19:33:28 +0000
Subject: [PATCH 09/18] fix(workspace): accept private proxy host

---
 .superset/workspace-trial-nginx.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.superset/workspace-trial-nginx.conf b/.superset/workspace-trial-nginx.conf
index 3d4357aa1..9214fe72b 100644
--- a/.superset/workspace-trial-nginx.conf
+++ b/.superset/workspace-trial-nginx.conf
@@ -7,7 +7,7 @@ server {
     listen 127.0.0.1:18480;
     server_name codex-remote.tailab0ab3.ts.net;
 
-    if ($host != "codex-remote.tailab0ab3.ts.net:18443") { return 444; }
+    if ($host !~ ^(codex-remote\.tailab0ab3\.ts\.net:18443|127\.0\.0\.1:18480)$) { return 444; }
 
     root /usr/share/nginx/html;
     index index.html;

From 35e91287f9275209a4625a5d363e02aeff19e772 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 19:36:07 +0000
Subject: [PATCH 10/18] fix(workspace): validate raw trial host

---
 .superset/workspace-trial-nginx.conf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.superset/workspace-trial-nginx.conf b/.superset/workspace-trial-nginx.conf
index 9214fe72b..60a79cded 100644
--- a/.superset/workspace-trial-nginx.conf
+++ b/.superset/workspace-trial-nginx.conf
@@ -7,7 +7,7 @@ server {
     listen 127.0.0.1:18480;
     server_name codex-remote.tailab0ab3.ts.net;
 
-    if ($host !~ ^(codex-remote\.tailab0ab3\.ts\.net:18443|127\.0\.0\.1:18480)$) { return 444; }
+    if ($http_host !~ ^(codex-remote\.tailab0ab3\.ts\.net(:18443)?|127\.0\.0\.1:18480)$) { return 444; }
 
     root /usr/share/nginx/html;
     index index.html;

From 9d729a6196a7e91efb67229d6b6f7d4a1feb2ce2 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 19:38:03 +0000
Subject: [PATCH 11/18] fix(workspace): verify private trial over tailnet IP

---
 .superset/workspace-trial.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.superset/workspace-trial.sh b/.superset/workspace-trial.sh
index 5477cd4bd..582015292 100755
--- a/.superset/workspace-trial.sh
+++ b/.superset/workspace-trial.sh
@@ -116,7 +116,10 @@ curl --fail --silent --output /dev/null --header "Host: codex-remote.tailab0ab3.
 
 tailscale serve --bg --https="$SERVE_PORT" "http://127.0.0.1:$APP_PORT"
 serve_started=true
-curl --fail --silent --output /dev/null "$TRIAL_ORIGIN"
+tailscale_ip="$(tailscale ip -4)"
+curl --fail --silent --output /dev/null \
+  --resolve "codex-remote.tailab0ab3.ts.net:$SERVE_PORT:$tailscale_ip" \
+  "$TRIAL_ORIGIN"
 
 echo "Workspace trial ready: $TRIAL_ORIGIN"
 echo "Commit: $(git rev-parse HEAD)"

From bab3a8a432ca467044d3914b49f5a07f48b1bce9 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 19:52:00 +0000
Subject: [PATCH 12/18] test(workspace): exercise the private trial journey

---
 e2e/workspace-collaboration.spec.ts                        | 7 ++++++-
 playwright.workspace.config.ts                             | 2 ++
 .../features/workspace/WorkspacePortabilityPanel.tsx       | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/e2e/workspace-collaboration.spec.ts b/e2e/workspace-collaboration.spec.ts
index b77dfa183..b1b4f7f68 100644
--- a/e2e/workspace-collaboration.spec.ts
+++ b/e2e/workspace-collaboration.spec.ts
@@ -10,6 +10,7 @@ const anonKey = process.env.LOCAL_SUPABASE_ANON_KEY;
 const serviceKey = process.env.LOCAL_SUPABASE_SERVICE_ROLE_KEY;
 const mailerUrl = process.env.WORKSPACE_TEST_MAILER_URL;
 const collaborationPort = Number(process.env.COLLABORATION_PORT ?? 12345);
+const reuseCollaboration = process.env.WORKSPACE_TEST_REUSE_COLLABORATION === "true";
 
 test.skip(!supabaseUrl || !anonKey || !serviceKey || !mailerUrl, "Local workspace services are required");
 
@@ -42,6 +43,10 @@ async function stop(child: ChildProcess | undefined) {
 }
 
 async function startCollaboration() {
+  if (reuseCollaboration) {
+    await waitForPort(collaborationPort);
+    return undefined;
+  }
   const child = spawn("npm", ["run", "start:collaboration"], {
     cwd: process.cwd(),
     detached: true,
@@ -536,7 +541,7 @@ test("private writing and independent imports export useful workspace files", as
     await expect(owner.page).toHaveURL(/\/app\/workspaces\/[0-9a-f-]+$/, { timeout: 20_000 });
     await owner.page.getByRole("button", { name: "R1" }).click();
     await openPanel(owner.page, "Import, reuse & export");
-    const snippet = owner.page.getByText("R1 snippet", { exact: true }).locator("..");
+    const snippet = owner.page.getByRole("group", { name: "R1 snippet" });
     await snippet.getByRole("button", { name: "Insert copy" }).click();
     await expect(owner.page.locator(".ProseMirror")).toContainText("Reusable R1 paragraph");
     const changed = await admin.from("private_writing_items").update({
diff --git a/playwright.workspace.config.ts b/playwright.workspace.config.ts
index 3f1c69452..df8e88940 100644
--- a/playwright.workspace.config.ts
+++ b/playwright.workspace.config.ts
@@ -1,6 +1,7 @@
 import { defineConfig, devices } from "@playwright/test";
 
 const baseURL = process.env.PLAYWRIGHT_BASE_URL ?? "http://127.0.0.1:18081";
+const hostResolverRules = process.env.PLAYWRIGHT_HOST_RESOLVER_RULES;
 
 export default defineConfig({
   testDir: "./e2e",
@@ -11,6 +12,7 @@ export default defineConfig({
   use: {
     actionTimeout: 10_000,
     baseURL,
+    launchOptions: hostResolverRules ? { args: [`--host-resolver-rules=${hostResolverRules}`] } : undefined,
     locale: "en-US",
     screenshot: "only-on-failure",
     trace: "retain-on-failure",
diff --git a/src/components/features/workspace/WorkspacePortabilityPanel.tsx b/src/components/features/workspace/WorkspacePortabilityPanel.tsx
index c6ae96394..2b2b81824 100644
--- a/src/components/features/workspace/WorkspacePortabilityPanel.tsx
+++ b/src/components/features/workspace/WorkspacePortabilityPanel.tsx
@@ -107,7 +107,7 @@ export function WorkspacePortabilityPanel({
       <div className="mt-3 grid gap-2">
         <p className="text-xs font-medium">{t("workspaces.privateWriting", "Private snippets and templates")}</p>
         {library.data?.map((item) => (
-          <div key={item.id} className="flex flex-wrap items-center gap-1 rounded-md border border-border p-2 text-sm">
+          <div key={item.id} role="group" aria-label={item.title} className="flex flex-wrap items-center gap-1 rounded-md border border-border p-2 text-sm">
             <span className="mr-auto min-w-0 truncate"><span className="text-xs text-muted-foreground">{item.kind}</span> · {item.title}</span>
             <Button type="button" size="sm" variant="outline" onClick={() => insertItem(item.content, "insert")}>{t("workspaces.insertCopy", "Insert copy")}</Button>
             {item.kind === "template" && <Button type="button" size="sm" variant="outline" onClick={() => insertItem(item.content, "replace")}>{t("workspaces.useTemplate", "Use template")}</Button>}

From cfc39118de9c44c9413443e539537eae04558c43 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 19:56:04 +0000
Subject: [PATCH 13/18] fix(workspace): deliver portability downloads reliably

---
 .../features/workspace/WorkspacePortabilityPanel.tsx     | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/src/components/features/workspace/WorkspacePortabilityPanel.tsx b/src/components/features/workspace/WorkspacePortabilityPanel.tsx
index 2b2b81824..ff5e47040 100644
--- a/src/components/features/workspace/WorkspacePortabilityPanel.tsx
+++ b/src/components/features/workspace/WorkspacePortabilityPanel.tsx
@@ -1,5 +1,6 @@
 import { useState } from "react";
 import type { JSONContent } from "@tiptap/core";
+import { saveAs } from "file-saver";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { useTranslation } from "react-i18next";
 import { Button } from "@/components/ui/button";
@@ -31,13 +32,7 @@ import {
 } from "@/lib/workspace/google-drive";
 
 function download(bytes: Uint8Array, name: string, type: string) {
-  const blob = new Blob([new Uint8Array(bytes)], { type });
-  const url = URL.createObjectURL(blob);
-  const link = document.createElement("a");
-  link.href = url;
-  link.download = name;
-  link.click();
-  URL.revokeObjectURL(url);
+  saveAs(new Blob([new Uint8Array(bytes)], { type }), name);
 }
 
 export function WorkspacePortabilityPanel({

From 43cc9aebaff280cbb331b55176efcbf84c35d501 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 20:00:10 +0000
Subject: [PATCH 14/18] fix(workspace): generate DOCX in browsers

---
 src/lib/workspace/document-conversion.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/workspace/document-conversion.ts b/src/lib/workspace/document-conversion.ts
index e075c1896..4735fd4d8 100644
--- a/src/lib/workspace/document-conversion.ts
+++ b/src/lib/workspace/document-conversion.ts
@@ -360,7 +360,7 @@ export async function toWorkspaceDocx(document: JSONContent): Promise<Uint8Array
     },
     sections: [{ children }],
   });
-  return new Uint8Array(await docx.Packer.toBuffer(file));
+  return new Uint8Array(await docx.Packer.toArrayBuffer(file));
 }
 
 function htmlInline(node: ChildNode, marks: JSONContent["marks"] = []): JSONContent[] {
@@ -708,7 +708,7 @@ export async function toWorkspacePacketDocx(manifest: WorkspacePacketManifest) {
     },
     sections: [{ children }],
   });
-  return new Uint8Array(await docx.Packer.toBuffer(file));
+  return new Uint8Array(await docx.Packer.toArrayBuffer(file));
 }
 
 export function toWorkspacePacketPdf(manifest: WorkspacePacketManifest, options: { fontData?: Uint8Array } = {}) {

From 7f58ee61367e88b2067c771338a579a648c4d246 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 20:22:31 +0000
Subject: [PATCH 15/18] fix(workspace): export untouched documents safely

---
 src/lib/workspace/portability-client.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/lib/workspace/portability-client.ts b/src/lib/workspace/portability-client.ts
index c67329015..f5a8dbd0e 100644
--- a/src/lib/workspace/portability-client.ts
+++ b/src/lib/workspace/portability-client.ts
@@ -87,6 +87,7 @@ export async function updatePrivateWritingItem(id: string, input: { content: unk
 }
 
 function decodeSnapshot(value: string) {
+  if (!value.trim()) return { type: "doc", content: [] };
   const binary = atob(value.replace(/\s/g, ""));
   const snapshot = Uint8Array.from(binary, (character) => character.charCodeAt(0));
   const document = new Y.Doc();

From c0583e7d4d324778a65fd585f7adb7aca97c9760 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 20:29:57 +0000
Subject: [PATCH 16/18] fix(workspace): own private trial proxy cleanup

---
 .superset/workspace-trial.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.superset/workspace-trial.sh b/.superset/workspace-trial.sh
index 582015292..a735456a1 100755
--- a/.superset/workspace-trial.sh
+++ b/.superset/workspace-trial.sh
@@ -9,16 +9,19 @@ TRIAL_ORIGIN="https://codex-remote.tailab0ab3.ts.net:18443"
 APP_PORT=18480
 COLLABORATION_PORT=12345
 SERVE_PORT=18443
-PROXY_NAME="debatelab-workspace-trial-proxy"
+PROXY_NAME="debatelab-workspace-trial-proxy-$$"
 
 runtime_dir=""
 stack_started=false
 serve_started=false
+proxy_started=false
 owned_pids=()
 
 stop_owned_processes() {
   local index
-  docker rm --force "$PROXY_NAME" >/dev/null 2>&1 || true
+  if [ "$proxy_started" = true ]; then
+    docker rm --force "$PROXY_NAME" >/dev/null 2>&1 || true
+  fi
   for ((index=${#owned_pids[@]}-1; index>=0; index--)); do
     kill -- "-${owned_pids[$index]}" 2>/dev/null || true
   done
@@ -107,6 +110,7 @@ setsid docker run --rm --name "$PROXY_NAME" --network host \
   --volume "$DIR/workspace-trial-nginx.conf:/etc/nginx/conf.d/default.conf:ro" \
   nginx:alpine >"$runtime_dir/proxy.log" 2>&1 &
 owned_pids+=("$!")
+proxy_started=true
 
 for _ in $(seq 1 200); do
   if curl --fail --silent --output /dev/null --header "Host: codex-remote.tailab0ab3.ts.net:$SERVE_PORT" "http://127.0.0.1:$APP_PORT"; then break; fi

From b112c03080fc574d24882c14cb87832b5fedc455 Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 20:33:00 +0000
Subject: [PATCH 17/18] fix(workspace): satisfy Google docs lint

---
 supabase/functions/workspace-google-docs/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/supabase/functions/workspace-google-docs/index.ts b/supabase/functions/workspace-google-docs/index.ts
index 3f9cc8215..a86b6b6b5 100644
--- a/supabase/functions/workspace-google-docs/index.ts
+++ b/supabase/functions/workspace-google-docs/index.ts
@@ -133,7 +133,7 @@ function safeLink(value: string) {
 function inlineHtml(value: string): string {
   const literals: string[] = [];
   const links: string[] = [];
-  const withoutEscapes = value.replace(/\\([\\`*_\[\]()|])/g, (_match, literal: string) => {
+  const withoutEscapes = value.replace(/\\([\\`*_[\]()|])/g, (_match, literal: string) => {
     const index = literals.push(escapeHtml(literal)) - 1;
     return `\uE001LITERAL${index}\uE001`;
   });

From d52598cc0964d25dd3329df4db43f441c99a0a0b Mon Sep 17 00:00:00 2001
From: Adam <adam.gaborjani.szabo@gmail.com>
Date: Tue, 22 Sep 2026 20:41:24 +0000
Subject: [PATCH 18/18] fix(workspace): route Deno boundary tests correctly

---
 supabase/functions/_shared/google-connections.test.ts | 2 +-
 supabase/functions/_shared/google-cors.test.ts        | 2 +-
 vitest.config.ts                                      | 8 ++++++--
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/supabase/functions/_shared/google-connections.test.ts b/supabase/functions/_shared/google-connections.test.ts
index 72743a62d..991b704f4 100644
--- a/supabase/functions/_shared/google-connections.test.ts
+++ b/supabase/functions/_shared/google-connections.test.ts
@@ -1,4 +1,4 @@
-import { assertEquals, assertRejects } from "jsr:@std/assert@1";
+import { assertEquals, assertRejects } from "jsr:@std/assert@1.0.19";
 import { decryptGoogleSecret, encryptGoogleSecret, getGoogleAccessToken } from "./google-connections.ts";
 
 const CONNECTION_ID = "a0000000-0000-4000-8000-000000000001";
diff --git a/supabase/functions/_shared/google-cors.test.ts b/supabase/functions/_shared/google-cors.test.ts
index a65061e54..5d6cf9462 100644
--- a/supabase/functions/_shared/google-cors.test.ts
+++ b/supabase/functions/_shared/google-cors.test.ts
@@ -1,4 +1,4 @@
-import { assertEquals } from "jsr:@std/assert@1";
+import { assertEquals } from "jsr:@std/assert@1.0.19";
 
 Deno.env.set("SUPABASE_URL", "http://127.0.0.1:54321");
 Deno.env.set("SUPABASE_ANON_KEY", "test-anon-key");
diff --git a/vitest.config.ts b/vitest.config.ts
index c13e7994b..1e36f4cd4 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -12,10 +12,14 @@ export default defineConfig({
       "src/**/*.{test,spec}.{ts,tsx}",
       "supabase/functions/**/*.{test,spec}.{ts,tsx}",
     ],
-    // This boundary test imports the deployed Edge Function entrypoint and its
+    // These boundary tests import deployed Edge Function entrypoints and their
     // remote Deno dependencies. Run it with `deno test`; Vite cannot resolve
     // those URL imports in the browser-oriented Vitest suite.
-    exclude: [...configDefaults.exclude, "supabase/functions/ai/handler-research.test.ts"],
+    exclude: [
+      ...configDefaults.exclude,
+      "supabase/functions/ai/handler-research.test.ts",
+      "supabase/functions/_shared/google-cors.test.ts",
+    ],
     coverage: {
       provider: "v8",
       // Omit `all` intentionally: this is a selected-scope gate for the audited