@agent-native/core 0.129.1 → 0.130.0

package/dist/org/schema.d.ts

@@ -114,6 +114,25 @@ export declare const organizations: import("drizzle-orm/sqlite-core").SQLiteTabl
         }, {}, {
             length: number;
         }>;
+        workspaceUrl: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "workspace_url";
+            tableName: "organizations";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
     };
     dialect: 'sqlite';
 }>;

package/dist/org/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/org/schema.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOxB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMrB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQzB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQzB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/org/schema.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQxB,CAAC;AAEH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMrB,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQzB,CAAC;AAEH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQzB,CAAC"}

package/dist/org/schema.js

@@ -6,6 +6,7 @@ export const organizations = table("organizations", {
     createdAt: integer("created_at").notNull(),
     allowedDomain: text("allowed_domain"),
     a2aSecret: text("a2a_secret"),
+    workspaceUrl: text("workspace_url"),
 });
 export const orgMembers = table("org_members", {
     id: text("id").primaryKey(),

package/dist/org/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/org/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC,eAAe,EAAE;IAClD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,EAAE;IAC7C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;CACzC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,kBAAkB,EAAE;IACtD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,iBAAiB,EAAE;IACrD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;CACnB,CAAC,CAAC","sourcesContent":["import { table, text, integer } from \"../db/schema.js\";\n\nexport const organizations = table(\"organizations\", {\n  id: text(\"id\").primaryKey(),\n  name: text(\"name\").notNull(),\n  createdBy: text(\"created_by\").notNull(),\n  createdAt: integer(\"created_at\").notNull(),\n  allowedDomain: text(\"allowed_domain\"),\n  a2aSecret: text(\"a2a_secret\"),\n});\n\nexport const orgMembers = table(\"org_members\", {\n  id: text(\"id\").primaryKey(),\n  orgId: text(\"org_id\").notNull(),\n  email: text(\"email\").notNull(),\n  role: text(\"role\").notNull(),\n  joinedAt: integer(\"joined_at\").notNull(),\n});\n\n/**\n * Per-app role assignments, keyed to an existing `org_members` row. An app role\n * only narrows what a member may do inside one app; it never grants membership,\n * and it never implies an org role.\n */\nexport const appMemberRoles = table(\"app_member_roles\", {\n  id: text(\"id\").primaryKey(),\n  orgId: text(\"org_id\").notNull(),\n  appId: text(\"app_id\").notNull(),\n  email: text(\"email\").notNull(),\n  role: text(\"role\").notNull(),\n  updatedBy: text(\"updated_by\").notNull(),\n  updatedAt: integer(\"updated_at\").notNull(),\n});\n\nexport const orgInvitations = table(\"org_invitations\", {\n  id: text(\"id\").primaryKey(),\n  orgId: text(\"org_id\").notNull(),\n  email: text(\"email\").notNull(),\n  invitedBy: text(\"invited_by\").notNull(),\n  createdAt: integer(\"created_at\").notNull(),\n  status: text(\"status\").notNull(),\n  role: text(\"role\"),\n});\n"]}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/org/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC,eAAe,EAAE;IAClD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC;IACrC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,EAAE;IAC7C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;CACzC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,kBAAkB,EAAE;IACtD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,iBAAiB,EAAE;IACrD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;IAC3B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAC/B,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC1C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;CACnB,CAAC,CAAC","sourcesContent":["import { table, text, integer } from \"../db/schema.js\";\n\nexport const organizations = table(\"organizations\", {\n  id: text(\"id\").primaryKey(),\n  name: text(\"name\").notNull(),\n  createdBy: text(\"created_by\").notNull(),\n  createdAt: integer(\"created_at\").notNull(),\n  allowedDomain: text(\"allowed_domain\"),\n  a2aSecret: text(\"a2a_secret\"),\n  workspaceUrl: text(\"workspace_url\"),\n});\n\nexport const orgMembers = table(\"org_members\", {\n  id: text(\"id\").primaryKey(),\n  orgId: text(\"org_id\").notNull(),\n  email: text(\"email\").notNull(),\n  role: text(\"role\").notNull(),\n  joinedAt: integer(\"joined_at\").notNull(),\n});\n\n/**\n * Per-app role assignments, keyed to an existing `org_members` row. An app role\n * only narrows what a member may do inside one app; it never grants membership,\n * and it never implies an org role.\n */\nexport const appMemberRoles = table(\"app_member_roles\", {\n  id: text(\"id\").primaryKey(),\n  orgId: text(\"org_id\").notNull(),\n  appId: text(\"app_id\").notNull(),\n  email: text(\"email\").notNull(),\n  role: text(\"role\").notNull(),\n  updatedBy: text(\"updated_by\").notNull(),\n  updatedAt: integer(\"updated_at\").notNull(),\n});\n\nexport const orgInvitations = table(\"org_invitations\", {\n  id: text(\"id\").primaryKey(),\n  orgId: text(\"org_id\").notNull(),\n  email: text(\"email\").notNull(),\n  invitedBy: text(\"invited_by\").notNull(),\n  createdAt: integer(\"created_at\").notNull(),\n  status: text(\"status\").notNull(),\n  role: text(\"role\"),\n});\n"]}

package/dist/org/types.d.ts

@@ -32,6 +32,14 @@ export interface OrgInfo {
     pendingInvitations: OrgInvitationSummary[];
     domainMatches: DomainMatchOrg[];
     allowedDomain: string | null;
+    /**
+     * Origin of the org's own workspace deployment, when it runs one. Members
+     * who land on a different host (a shared hosted app reached from the
+     * template catalog) get pointed here instead of concluding their team's
+     * apps are missing. Null for the common case of an org with no separate
+     * workspace.
+     */
+    workspaceUrl: string | null;
     /**
      * Whether the active org has an A2A secret. The value itself is never part
      * of this payload — owners/admins fetch it on demand from

package/dist/org/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/org/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;IAC3C,aAAa,EAAE,cAAc,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/org/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;IAC3C,aAAa,EAAE,cAAc,EAAE,CAAC;IAChC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;;;OAMG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;CAC1B"}

package/dist/org/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/org/types.ts"],"names":[],"mappings":"AAAA;;GAEG","sourcesContent":["/**\n * Shared types for the org module. Server and client both depend on these.\n */\n\nexport type OrgRole = \"owner\" | \"admin\" | \"member\";\n\nexport interface OrgContext {\n  email: string;\n  orgId: string | null;\n  orgName: string | null;\n  role: OrgRole | null;\n}\n\nexport interface OrgSummary {\n  orgId: string;\n  orgName: string;\n  role: OrgRole;\n}\n\nexport interface OrgInvitationSummary {\n  id: string;\n  orgId: string;\n  orgName: string;\n  invitedBy: string;\n}\n\nexport interface DomainMatchOrg {\n  orgId: string;\n  orgName: string;\n}\n\nexport interface OrgInfo {\n  email: string;\n  orgId: string | null;\n  orgName: string | null;\n  role: OrgRole | null;\n  orgs: OrgSummary[];\n  pendingInvitations: OrgInvitationSummary[];\n  domainMatches: DomainMatchOrg[];\n  allowedDomain: string | null;\n  /**\n   * Whether the active org has an A2A secret. The value itself is never part\n   * of this payload — owners/admins fetch it on demand from\n   * `GET /_agent-native/org/a2a-secret`.\n   */\n  a2aSecretSet?: boolean;\n}\n\nexport interface OrgMember {\n  email: string;\n  role: OrgRole;\n  joinedAt: number;\n}\n\nexport interface OrgPendingInvitation {\n  id: string;\n  email: string;\n  invitedBy: string;\n  createdAt: number;\n  status: string;\n  role: \"admin\" | \"member\";\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/org/types.ts"],"names":[],"mappings":"AAAA;;GAEG","sourcesContent":["/**\n * Shared types for the org module. Server and client both depend on these.\n */\n\nexport type OrgRole = \"owner\" | \"admin\" | \"member\";\n\nexport interface OrgContext {\n  email: string;\n  orgId: string | null;\n  orgName: string | null;\n  role: OrgRole | null;\n}\n\nexport interface OrgSummary {\n  orgId: string;\n  orgName: string;\n  role: OrgRole;\n}\n\nexport interface OrgInvitationSummary {\n  id: string;\n  orgId: string;\n  orgName: string;\n  invitedBy: string;\n}\n\nexport interface DomainMatchOrg {\n  orgId: string;\n  orgName: string;\n}\n\nexport interface OrgInfo {\n  email: string;\n  orgId: string | null;\n  orgName: string | null;\n  role: OrgRole | null;\n  orgs: OrgSummary[];\n  pendingInvitations: OrgInvitationSummary[];\n  domainMatches: DomainMatchOrg[];\n  allowedDomain: string | null;\n  /**\n   * Origin of the org's own workspace deployment, when it runs one. Members\n   * who land on a different host (a shared hosted app reached from the\n   * template catalog) get pointed here instead of concluding their team's\n   * apps are missing. Null for the common case of an org with no separate\n   * workspace.\n   */\n  workspaceUrl: string | null;\n  /**\n   * Whether the active org has an A2A secret. The value itself is never part\n   * of this payload — owners/admins fetch it on demand from\n   * `GET /_agent-native/org/a2a-secret`.\n   */\n  a2aSecretSet?: boolean;\n}\n\nexport interface OrgMember {\n  email: string;\n  role: OrgRole;\n  joinedAt: number;\n}\n\nexport interface OrgPendingInvitation {\n  id: string;\n  email: string;\n  invitedBy: string;\n  createdAt: number;\n  status: string;\n  role: \"admin\" | \"member\";\n}\n"]}

package/dist/org/workspace-url.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Parsing and comparison for `organizations.workspace_url` — the origin of an
+ * org's own workspace deployment.
+ *
+ * The value is set by an owner/admin and then rendered as a link target for
+ * every member of the org, so it is parsed at the trust boundary rather than
+ * on the way out: anything that is not an `http(s)` origin never reaches the
+ * database.
+ */
+export type ParsedWorkspaceUrl = {
+    ok: true;
+    url: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Normalize a workspace URL to a bare origin (`https://host[:port]`).
+ *
+ * Path, query, and hash are dropped: this points at a deployment, not a page,
+ * and keeping them would send members to a route that may not exist in the
+ * app they arrive at.
+ */
+export declare function parseWorkspaceUrl(raw: string): ParsedWorkspaceUrl;
+/**
+ * Whether a member currently on `currentUrl` should be pointed at the org's
+ * workspace. False when the org has no workspace, when the stored value is
+ * unusable, or when they are already on it — including any subdomain-free
+ * port/scheme difference, which `URL.origin` compares exactly.
+ */
+export declare function shouldOfferWorkspace(currentUrl: string, workspaceUrl: string | null | undefined): boolean;
+//# sourceMappingURL=workspace-url.d.ts.map

package/dist/org/workspace-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-url.d.ts","sourceRoot":"","sources":["../../src/org/workspace-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CA2BjE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,OAAO,CAcT"}

package/dist/org/workspace-url.js

@@ -0,0 +1,63 @@
+/**
+ * Parsing and comparison for `organizations.workspace_url` — the origin of an
+ * org's own workspace deployment.
+ *
+ * The value is set by an owner/admin and then rendered as a link target for
+ * every member of the org, so it is parsed at the trust boundary rather than
+ * on the way out: anything that is not an `http(s)` origin never reaches the
+ * database.
+ */
+/**
+ * Normalize a workspace URL to a bare origin (`https://host[:port]`).
+ *
+ * Path, query, and hash are dropped: this points at a deployment, not a page,
+ * and keeping them would send members to a route that may not exist in the
+ * app they arrive at.
+ */
+export function parseWorkspaceUrl(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed) {
+        return { ok: false, reason: "Workspace URL is empty" };
+    }
+    // Accept a bare host ("agent-workspace.builder.io") the way a browser bar
+    // does — otherwise the most natural thing to paste is rejected.
+    const withScheme = /^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed)
+        ? trimmed
+        : `https://${trimmed}`;
+    let parsed;
+    try {
+        parsed = new URL(withScheme);
+    }
+    catch {
+        return { ok: false, reason: "Not a valid URL" };
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        return { ok: false, reason: "Workspace URL must be http or https" };
+    }
+    if (!parsed.hostname.includes(".") && parsed.hostname !== "localhost") {
+        return { ok: false, reason: "Workspace URL must include a full hostname" };
+    }
+    return { ok: true, url: parsed.origin };
+}
+/**
+ * Whether a member currently on `currentUrl` should be pointed at the org's
+ * workspace. False when the org has no workspace, when the stored value is
+ * unusable, or when they are already on it — including any subdomain-free
+ * port/scheme difference, which `URL.origin` compares exactly.
+ */
+export function shouldOfferWorkspace(currentUrl, workspaceUrl) {
+    if (!workspaceUrl)
+        return false;
+    const parsed = parseWorkspaceUrl(workspaceUrl);
+    if (!parsed.ok)
+        return false;
+    let currentOrigin;
+    try {
+        currentOrigin = new URL(currentUrl).origin;
+    }
+    catch {
+        return false;
+    }
+    return currentOrigin !== parsed.url;
+}
+//# sourceMappingURL=workspace-url.js.map

package/dist/org/workspace-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-url.js","sourceRoot":"","sources":["../../src/org/workspace-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACzD,CAAC;IAED,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,UAAU,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QACzD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC;IAEzB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IAC7E,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,UAAkB,EAClB,YAAuC;IAEvC,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAEhC,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE7B,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,aAAa,KAAK,MAAM,CAAC,GAAG,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Parsing and comparison for `organizations.workspace_url` — the origin of an\n * org's own workspace deployment.\n *\n * The value is set by an owner/admin and then rendered as a link target for\n * every member of the org, so it is parsed at the trust boundary rather than\n * on the way out: anything that is not an `http(s)` origin never reaches the\n * database.\n */\n\nexport type ParsedWorkspaceUrl =\n  | { ok: true; url: string }\n  | { ok: false; reason: string };\n\n/**\n * Normalize a workspace URL to a bare origin (`https://host[:port]`).\n *\n * Path, query, and hash are dropped: this points at a deployment, not a page,\n * and keeping them would send members to a route that may not exist in the\n * app they arrive at.\n */\nexport function parseWorkspaceUrl(raw: string): ParsedWorkspaceUrl {\n  const trimmed = raw.trim();\n  if (!trimmed) {\n    return { ok: false, reason: \"Workspace URL is empty\" };\n  }\n\n  // Accept a bare host (\"agent-workspace.builder.io\") the way a browser bar\n  // does — otherwise the most natural thing to paste is rejected.\n  const withScheme = /^[a-z][a-z0-9+.-]*:\\/\\//i.test(trimmed)\n    ? trimmed\n    : `https://${trimmed}`;\n\n  let parsed: URL;\n  try {\n    parsed = new URL(withScheme);\n  } catch {\n    return { ok: false, reason: \"Not a valid URL\" };\n  }\n\n  if (parsed.protocol !== \"https:\" && parsed.protocol !== \"http:\") {\n    return { ok: false, reason: \"Workspace URL must be http or https\" };\n  }\n  if (!parsed.hostname.includes(\".\") && parsed.hostname !== \"localhost\") {\n    return { ok: false, reason: \"Workspace URL must include a full hostname\" };\n  }\n\n  return { ok: true, url: parsed.origin };\n}\n\n/**\n * Whether a member currently on `currentUrl` should be pointed at the org's\n * workspace. False when the org has no workspace, when the stored value is\n * unusable, or when they are already on it — including any subdomain-free\n * port/scheme difference, which `URL.origin` compares exactly.\n */\nexport function shouldOfferWorkspace(\n  currentUrl: string,\n  workspaceUrl: string | null | undefined,\n): boolean {\n  if (!workspaceUrl) return false;\n\n  const parsed = parseWorkspaceUrl(workspaceUrl);\n  if (!parsed.ok) return false;\n\n  let currentOrigin: string;\n  try {\n    currentOrigin = new URL(currentUrl).origin;\n  } catch {\n    return false;\n  }\n\n  return currentOrigin !== parsed.url;\n}\n"]}

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,11 +75,11 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    deleted?: undefined;
     id?: undefined;
+    message?: undefined;
     provider?: undefined;
+    deleted?: undefined;
     found?: undefined;
-    message?: undefined;
     providers: {
         id: string;
         label: string;
@@ -93,41 +93,41 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
-    deleted?: undefined;
-    count?: undefined;
     id?: undefined;
     message?: undefined;
+    deleted?: undefined;
     providers?: undefined;
+    count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
 } | {
-    deleted?: undefined;
-    count?: undefined;
-    provider?: undefined;
     message?: undefined;
+    provider?: undefined;
+    deleted?: undefined;
     providers?: undefined;
+    count?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
 } | {
-    count?: undefined;
+    message?: undefined;
     provider?: undefined;
     found?: undefined;
-    message?: undefined;
     providers?: undefined;
+    count?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
 } | {
-    deleted?: undefined;
-    count?: undefined;
     provider?: undefined;
+    deleted?: undefined;
     found?: undefined;
     providers?: undefined;
+    count?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -312,7 +312,6 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         scope?: "org" | "user" | undefined;
     }, {
         id?: undefined;
-        deleted?: undefined;
         found?: undefined;
         providers: {
             id: string;
@@ -325,32 +324,33 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         }[];
         count: number;
         provider?: undefined;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
-        id?: undefined;
-        deleted?: undefined;
         count?: undefined;
+        id?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
-        deleted?: undefined;
         count?: undefined;
         providers?: undefined;
         provider?: undefined;
         found: boolean;
         id: string;
+        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
-        found?: undefined;
         count?: undefined;
+        found?: undefined;
         providers?: undefined;
         provider?: undefined;
         deleted: boolean;
@@ -359,11 +359,11 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        deleted?: undefined;
-        found?: undefined;
         count?: undefined;
+        found?: undefined;
         providers?: undefined;
         provider?: undefined;
+        deleted?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/resources/handlers.d.ts

@@ -33,9 +33,8 @@ export declare function handleGetEffectiveResourceContext(event: any): Promise<i
     error: string;
 }>;
 /** GET /_agent-native/resources/:id — get single resource with content.
- *  If the request comes from an <img>/<video>/etc tag (Accept includes the
- *  resource's mime type, or query param `?raw` is set), return the raw binary
- *  with the correct Content-Type so the browser can render it inline. */
+ *  `?raw` returns the bytes inline; `?download=1` returns the same bytes as a
+ *  safe attachment. */
 export declare function handleGetResource(event: any): Promise<import("./store.js").Resource | Response | {
     error: string;
 }>;

package/dist/resources/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/resources/handlers.ts"],"names":[],"mappings":"AAkBA,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAgBL,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AA2GpB,UAAU,WAAW;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,cAAc,CAAC;IAC3D,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,eAAe,CAAC,EAAE,mBAAmB,CAAC;CACvC;AA2DD,oDAAoD;AACpD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,GAAG;;GAiCnD;AAED,4DAA4D;AAC5D,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,GAAG;;GA4CrD;AAED,+EAA+E;AAC/E,wBAAsB,iCAAiC,CAAC,KAAK,EAAE,GAAG;;GAYjE;AAwED;;;yEAGyE;AACzE,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,GAAG;;GAoDjD;AAED,wDAAwD;AACxD,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,GAAG;;GAoCpD;AAED,qEAAqE;AACrE,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,GAAG;;GAyFpD;AAED,8DAA8D;AAC9D,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,GAAG;;;;;;GA+CpD;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;GAoFpD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/resources/handlers.ts"],"names":[],"mappings":"AAkBA,OAAO,EAML,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAgBL,KAAK,YAAY,EAClB,MAAM,YAAY,CAAC;AAiIpB,UAAU,WAAW;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,cAAc,CAAC;IAC3D,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B,eAAe,CAAC,EAAE,mBAAmB,CAAC;CACvC;AA2DD,oDAAoD;AACpD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,GAAG;;GAiCnD;AAED,4DAA4D;AAC5D,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,GAAG;;GA4CrD;AAED,+EAA+E;AAC/E,wBAAsB,iCAAiC,CAAC,KAAK,EAAE,GAAG;;GAYjE;AAwED;;uBAEuB;AACvB,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,GAAG;;GA6DjD;AAED,wDAAwD;AACxD,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,GAAG;;GAoCpD;AAED,qEAAqE;AACrE,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,GAAG;;GAyFpD;AAED,8DAA8D;AAC9D,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,GAAG;;;;;;GA+CpD;AAED,yEAAyE;AACzE,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;GAoFpD"}

package/dist/resources/handlers.js

@@ -26,6 +26,22 @@ function canReadOwner(owner, email, orgId) {
         owner === WORKSPACE_OWNER ||
         (!!ownerOrgId && ownerOrgId === orgId));
 }
+function resourceDownloadDisposition(path) {
+    const basename = path.replaceAll("\\", "/").split("/").pop()?.trim() || "";
+    const filename = Array.from(basename)
+        .slice(0, 180)
+        .map((character) => {
+        const codePoint = character.codePointAt(0) ?? 0;
+        return codePoint <= 31 || codePoint === 127 ? "_" : character;
+    })
+        .join("");
+    const safeFilename = filename && filename !== "." && filename !== ".." ? filename : "download";
+    const asciiFilename = safeFilename
+        .replace(/[^\x20-\x7e]/g, "_")
+        .replace(/["\\]/g, "_");
+    const encodedFilename = encodeURIComponent(safeFilename).replace(/['()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+    return `attachment; filename="${asciiFilename}"; filename*=UTF-8''${encodedFilename}`;
+}
 function mergeScopedResources(primary, inherited) {
     const seen = new Set(primary.map((resource) => resource.path));
     return [
@@ -282,9 +298,8 @@ async function enrichTreeNodes(nodes) {
     }
 }
 /** GET /_agent-native/resources/:id — get single resource with content.
- *  If the request comes from an <img>/<video>/etc tag (Accept includes the
- *  resource's mime type, or query param `?raw` is set), return the raw binary
- *  with the correct Content-Type so the browser can render it inline. */
+ *  `?raw` returns the bytes inline; `?download=1` returns the same bytes as a
+ *  safe attachment. */
 export async function handleGetResource(event) {
     const id = getRouterParam(event, "id") || event.context.params?.id;
     if (!id) {
@@ -302,10 +317,10 @@ export async function handleGetResource(event) {
         setResponseStatus(event, 404);
         return { error: "Resource not found" };
     }
-    // Serve raw binary when ?raw query param is set (used by <img> tags etc.)
     const query = getQuery(event);
     const wantsRaw = query.raw !== undefined;
-    if (wantsRaw && resource.content) {
+    const wantsDownload = query.download === "1";
+    if ((wantsRaw || wantsDownload) && typeof resource.content === "string") {
         const isText = resource.mimeType.startsWith("text/") ||
             resource.mimeType === "application/json";
         const buf = isText
@@ -313,6 +328,11 @@ export async function handleGetResource(event) {
             : Buffer.from(resource.content, "base64");
         setResponseHeader(event, "Content-Type", resource.mimeType);
         setResponseHeader(event, "Content-Length", String(buf.length));
+        setResponseHeader(event, "Cache-Control", "private, no-store");
+        setResponseHeader(event, "X-Content-Type-Options", "nosniff");
+        if (wantsDownload) {
+            setResponseHeader(event, "Content-Disposition", resourceDownloadDisposition(resource.path));
+        }
         return new Response(buf);
     }
     // For binary resources (images, audio, video), omit the content field from