@agent-native/core 0.15.12 → 0.16.0

package/dist/server/poll.js

@@ -16,6 +16,7 @@ import { EventEmitter } from "node:events";
 import { defineEventHandler, getQuery, setResponseStatus } from "h3";
 import { getAppStateEmitter } from "../application-state/emitter.js";
 import { getDbExec } from "../db/client.js";
+import { EXTENSION_CHANGE_MARKER_KEY, parseExtensionChangeMarker, } from "../extensions/change-marker.js";
 import { getSettingsEmitter } from "../settings/store.js";
 import { getSession } from "./auth.js";
 // In-memory ring buffer of recent changes. Kept small since clients
@@ -37,6 +38,9 @@ let _versionSeeded = false;
 let _lastDbCheck = 0;
 let _lastAppStateTs = 0;
 let _lastSettingsTs = 0;
+let _lastExtensionsTs = 0;
+let _lastExtensionsUpdatedAt;
+let _lastExtensionMarkerTs = 0;
 /**
  * Tracks the latest updated_at seen on the `__screen_refresh__` key in
  * application_state. Bumped when the agent calls the `refresh-screen` tool,
@@ -62,6 +66,49 @@ function wireLocalEmitters() {
         recordChange(event);
     });
 }
+function timestampValue(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    if (typeof value !== "string")
+        return 0;
+    const numeric = Number(value);
+    if (Number.isFinite(numeric))
+        return numeric;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+function sqlWatermarkValue(value) {
+    if (typeof value === "string" && value.length > 0)
+        return value;
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    return undefined;
+}
+async function readMaxUpdatedAtRaw(db, table) {
+    try {
+        const result = await db.execute(`SELECT MAX(updated_at) as max_ts FROM ${table}`);
+        return result.rows[0]?.max_ts;
+    }
+    catch {
+        // Optional framework tables may not exist in every app yet.
+        return undefined;
+    }
+}
+async function readMaxUpdatedAt(db, table) {
+    return timestampValue(await readMaxUpdatedAtRaw(db, table));
+}
+async function readExtensionMarkerMaxUpdatedAt(db) {
+    try {
+        const result = await db.execute({
+            sql: "SELECT MAX(updated_at) as max_ts FROM application_state WHERE key = ?",
+            args: [EXTENSION_CHANGE_MARKER_KEY],
+        });
+        return timestampValue(result.rows[0]?.max_ts);
+    }
+    catch {
+        return 0;
+    }
+}
 /** Get the current global version counter. */
 export function getVersion() {
     return _version;
@@ -92,6 +139,80 @@ export function recordChange(event) {
     }
     _pollEmitter.emit(POLL_CHANGE_EVENT, entry);
 }
+function extensionTargetKey(target) {
+    if (target.owner)
+        return `owner:${target.owner}`;
+    if (target.orgId)
+        return `org:${target.orgId}`;
+    return null;
+}
+function addExtensionTarget(targets, target) {
+    const key = extensionTargetKey(target);
+    if (key)
+        targets.set(key, target);
+}
+function recordExtensionChanges(targets) {
+    const uniqueTargets = new Map();
+    for (const target of targets)
+        addExtensionTarget(uniqueTargets, target);
+    for (const target of uniqueTargets.values()) {
+        recordChange({
+            source: "extensions",
+            type: "change",
+            key: "*",
+            ...(target.owner ? { owner: target.owner } : {}),
+            ...(target.orgId ? { orgId: target.orgId } : {}),
+        });
+    }
+}
+function extensionTargetsForRow(row, shareRows) {
+    const targets = new Map();
+    const owner = typeof row.owner_email === "string" ? row.owner_email : "";
+    const orgId = typeof row.org_id === "string" ? row.org_id : "";
+    const visibility = typeof row.visibility === "string" ? row.visibility : "private";
+    if (owner)
+        addExtensionTarget(targets, { owner });
+    if (visibility === "org" && orgId)
+        addExtensionTarget(targets, { orgId });
+    for (const share of shareRows) {
+        const principalType = typeof share.principal_type === "string" ? share.principal_type : "";
+        const principalId = typeof share.principal_id === "string" ? share.principal_id : "";
+        if (principalType === "user" && principalId) {
+            addExtensionTarget(targets, { owner: principalId });
+        }
+        else if (principalType === "org" && principalId) {
+            addExtensionTarget(targets, { orgId: principalId });
+        }
+    }
+    return Array.from(targets.values());
+}
+async function readExtensionTargetsForRows(db, rows) {
+    const ids = rows
+        .map((row) => (typeof row.id === "string" ? row.id : ""))
+        .filter(Boolean);
+    const sharesByResourceId = new Map();
+    if (ids.length > 0) {
+        try {
+            const placeholders = ids.map(() => "?").join(", ");
+            const shareResult = await db.execute({
+                sql: `SELECT resource_id, principal_type, principal_id FROM tool_shares WHERE resource_id IN (${placeholders})`,
+                args: ids,
+            });
+            for (const share of shareResult.rows) {
+                const resourceId = typeof share.resource_id === "string" ? share.resource_id : "";
+                if (!resourceId)
+                    continue;
+                const bucket = sharesByResourceId.get(resourceId) ?? [];
+                bucket.push(share);
+                sharesByResourceId.set(resourceId, bucket);
+            }
+        }
+        catch {
+            // Sharing tables are optional during early app initialization.
+        }
+    }
+    return rows.map((row) => extensionTargetsForRow(row, sharesByResourceId.get(typeof row.id === "string" ? row.id : "") ?? []));
+}
 /** Get all changes after a given version. */
 export function getChangesSince(since) {
     if (since >= _version) {
@@ -128,22 +249,28 @@ async function seedVersionFromDb() {
     _versionSeeded = true;
     try {
         const db = getDbExec();
-        const [appResult, settingsResult, refreshResult] = await Promise.all([
-            db.execute("SELECT MAX(updated_at) as max_ts FROM application_state"),
-            db.execute("SELECT MAX(updated_at) as max_ts FROM settings"),
-            db.execute({
+        const [appTs, settingsTs, extensionsMaxUpdatedAt, extensionMarkerTs, refreshResult,] = await Promise.all([
+            readMaxUpdatedAt(db, "application_state"),
+            readMaxUpdatedAt(db, "settings"),
+            readMaxUpdatedAtRaw(db, "tools"),
+            readExtensionMarkerMaxUpdatedAt(db),
+            db
+                .execute({
                 sql: "SELECT updated_at FROM application_state WHERE key = ?",
                 args: [SCREEN_REFRESH_KEY],
-            }),
+            })
+                .catch(() => ({ rows: [] })),
         ]);
-        const appTs = Number(appResult.rows[0]?.max_ts) || 0;
-        const settingsTs = Number(settingsResult.rows[0]?.max_ts) || 0;
-        const refreshTs = Number(refreshResult.rows[0]?.updated_at) || 0;
+        const extensionsTs = timestampValue(extensionsMaxUpdatedAt);
+        const refreshTs = timestampValue(refreshResult.rows[0]?.updated_at);
         // Seed version — never decrease an already-set value
-        _version = Math.max(_version, appTs, settingsTs);
+        _version = Math.max(_version, appTs, settingsTs, extensionsTs, extensionMarkerTs);
         // Set baselines so checkExternalDbChanges detects future writes
         _lastAppStateTs = appTs;
         _lastSettingsTs = settingsTs;
+        _lastExtensionsTs = extensionsTs;
+        _lastExtensionsUpdatedAt = sqlWatermarkValue(extensionsMaxUpdatedAt);
+        _lastExtensionMarkerTs = extensionMarkerTs;
         _lastScreenRefreshTs = refreshTs;
         _screenRefreshInitialized = true;
     }
@@ -171,10 +298,12 @@ async function checkExternalDbChanges() {
             args: [_lastAppStateTs],
         });
         if (appResult.rows.length > 0) {
-            const appTs = appResult.rows.reduce((max, row) => Math.max(max, Number(row.updated_at) || 0), _lastAppStateTs);
+            const appTs = appResult.rows.reduce((max, row) => Math.max(max, timestampValue(row.updated_at)), _lastAppStateTs);
             if (_lastAppStateTs > 0) {
                 for (const row of appResult.rows) {
                     const key = typeof row.key === "string" ? row.key : "*";
+                    if (key === EXTENSION_CHANGE_MARKER_KEY)
+                        continue;
                     const owner = typeof row.session_id === "string" ? row.session_id : undefined;
                     recordChange({
                         source: "app-state",
@@ -194,7 +323,7 @@ async function checkExternalDbChanges() {
             sql: "SELECT updated_at, value FROM application_state WHERE key = ?",
             args: [SCREEN_REFRESH_KEY],
         });
-        const refreshTs = Number(refreshResult.rows[0]?.updated_at) || 0;
+        const refreshTs = timestampValue(refreshResult.rows[0]?.updated_at);
         if (!_screenRefreshInitialized) {
             _lastScreenRefreshTs = refreshTs;
             _screenRefreshInitialized = true;
@@ -218,15 +347,57 @@ async function checkExternalDbChanges() {
             });
             _lastScreenRefreshTs = refreshTs;
         }
+        // Extension mutations write a durable marker row so delete and hide/unhide
+        // operations are visible across serverless invocations. Translate those
+        // marker rows back into extension-source events for targeted client
+        // invalidation while preserving user/org scope.
+        const extensionMarkerTs = await readExtensionMarkerMaxUpdatedAt(db);
+        if (extensionMarkerTs > _lastExtensionMarkerTs) {
+            const extensionMarkerResult = await db.execute({
+                sql: "SELECT session_id, value, updated_at FROM application_state WHERE key = ? ORDER BY updated_at ASC",
+                args: [EXTENSION_CHANGE_MARKER_KEY],
+            });
+            const changedExtensionMarkers = extensionMarkerResult.rows.filter((row) => timestampValue(row.updated_at) > _lastExtensionMarkerTs);
+            if (_lastExtensionMarkerTs > 0) {
+                recordExtensionChanges(changedExtensionMarkers
+                    .map((row) => parseExtensionChangeMarker(row.session_id, row.value))
+                    .filter((target) => !!target));
+            }
+            _lastExtensionMarkerTs = extensionMarkerTs;
+        }
         // Check settings for external writes
-        const settingsResult = await db.execute("SELECT MAX(updated_at) as max_ts FROM settings");
-        const settingsTs = Number(settingsResult.rows[0]?.max_ts) || 0;
+        const settingsTs = await readMaxUpdatedAt(db, "settings");
         if (settingsTs > _lastSettingsTs) {
             if (_lastSettingsTs > 0) {
                 recordChange({ source: "settings", type: "change", key: "*" });
             }
             _lastSettingsTs = settingsTs;
         }
+        // Extension rows live in the legacy physical `tools` table. Keep this as a
+        // compatibility fallback for direct table writes, but scope events to the
+        // resource owner/share targets instead of broadcasting deployment-wide.
+        const extensionsMaxUpdatedAt = await readMaxUpdatedAtRaw(db, "tools");
+        const extensionsTs = timestampValue(extensionsMaxUpdatedAt);
+        if (extensionsTs > _lastExtensionsTs) {
+            const since = _lastExtensionsUpdatedAt;
+            const extensionResult = since === undefined
+                ? await db.execute({
+                    sql: "SELECT id, owner_email, org_id, visibility, updated_at FROM tools ORDER BY updated_at ASC",
+                    args: [],
+                })
+                : await db.execute({
+                    sql: "SELECT id, owner_email, org_id, visibility, updated_at FROM tools WHERE updated_at > ? ORDER BY updated_at ASC",
+                    args: [since],
+                });
+            const changedExtensionRows = extensionResult.rows.filter((row) => timestampValue(row.updated_at) > _lastExtensionsTs);
+            if (_lastExtensionsTs > 0) {
+                const targetsByRow = await readExtensionTargetsForRows(db, changedExtensionRows);
+                for (const targets of targetsByRow)
+                    recordExtensionChanges(targets);
+            }
+            _lastExtensionsTs = extensionsTs;
+            _lastExtensionsUpdatedAt = sqlWatermarkValue(extensionsMaxUpdatedAt);
+        }
     }
     catch {
         // Tables may not exist yet — ignore

package/dist/server/poll.js.map

@@ -1 +1 @@
-{"version":3,"file":"poll.js","sourceRoot":"","sources":["../../src/server/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAoBvC,oEAAoE;AACpE,2EAA2E;AAC3E,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,IAAI,QAAQ,GAAG,CAAC,CAAC;AACjB,MAAM,OAAO,GAAkB,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;AACxC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,sEAAsE;AACtE,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,IAAI,eAAe,GAAG,CAAC,CAAC;AAExB;;;;;;;;;GASG;AACH,IAAI,oBAAoB,GAAG,CAAC,CAAC;AAC7B,IAAI,yBAAyB,GAAG,KAAK,CAAC;AACtC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,SAAS,iBAAiB;IACxB,IAAI,mBAAmB;QAAE,OAAO;IAChC,mBAAmB,GAAG,IAAI,CAAC;IAC3B,kBAAkB,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7C,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,kBAAkB,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,UAAU;IACxB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAkB,EAClB,SAAiB,EACjB,KAAyB;IAEzB,+DAA+D;IAC/D,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,KAK5B;IACC,qEAAqE;IACrE,iEAAiE;IACjE,0DAA0D;IAC1D,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAgB,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,eAAe,CAAC,KAAa;IAI3C,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,SAAiB,EACjB,KAAyB;IAEzB,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CACrE,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB;IAC9B,IAAI,cAAc;QAAE,OAAO;IAC3B,cAAc,GAAG,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QAEvB,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACnE,EAAE,CAAC,OAAO,CAAC,yDAAyD,CAAC;YACrE,EAAE,CAAC,OAAO,CAAC,gDAAgD,CAAC;YAC5D,EAAE,CAAC,OAAO,CAAC;gBACT,GAAG,EAAE,wDAAwD;gBAC7D,IAAI,EAAE,CAAC,kBAAkB,CAAC;aAC3B,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAEjE,qDAAqD;QACrD,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAEjD,gEAAgE;QAChE,eAAe,GAAG,KAAK,CAAC;QACxB,eAAe,GAAG,UAAU,CAAC;QAC7B,oBAAoB,GAAG,SAAS,CAAC;QACjC,yBAAyB,GAAG,IAAI,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,YAAY,GAAG,IAAI;QAAE,OAAO;IACtC,YAAY,GAAG,GAAG,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QAEvB,2EAA2E;QAC3E,8EAA8E;QAC9E,mEAAmE;QACnE,wDAAwD;QACxD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,wGAAwG;YAC7G,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EACxD,eAAe,CAChB,CAAC;YACF,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;oBACjC,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;oBACxD,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;oBAClE,YAAY,CAAC;wBACX,MAAM,EAAE,WAAW;wBACnB,IAAI,EAAE,QAAQ;wBACd,GAAG;wBACH,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,eAAe,GAAG,KAAK,CAAC;QAC1B,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,oEAAoE;QACpE,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YACrC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,kBAAkB,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QACjE,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,oBAAoB,GAAG,SAAS,CAAC;YACjC,yBAAyB,GAAG,IAAI,CAAC;QACnC,CAAC;aAAM,IAAI,SAAS,GAAG,oBAAoB,EAAE,CAAC;YAC5C,IAAI,KAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC/B,IAAI,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ;wBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,YAAY,CAAC;gBACX,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,kBAAkB;gBACvB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5B,CAAC,CAAC;YACH,oBAAoB,GAAG,SAAS,CAAC;QACnC,CAAC;QAED,qCAAqC;QACrC,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,OAAO,CACrC,gDAAgD,CACjD,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;gBACxB,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,eAAe,GAAG,UAAU,CAAC;QAC/B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB;IAC/B,iBAAiB,EAAE,CAAC;IACpB,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QACD,qEAAqE;QACrE,MAAM,iBAAiB,EAAE,CAAC;QAC1B,mDAAmD;QACnD,MAAM,sBAAsB,EAAE,CAAC;QAE/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Polling-based change notification.\n *\n * Replaces SSE with a simple version counter. Each DB mutation (app-state,\n * settings, resources) increments the version. Clients poll `/_agent-native/poll?since=N`\n * and receive any events that occurred after version N.\n *\n * Works in all deployment environments (serverless, edge, long-lived).\n *\n * Also detects cross-process DB writes by periodically checking the\n * application_state and settings tables' updated_at timestamps. This ensures\n * that changes made by external processes (e.g., CLI actions, cron jobs)\n * are picked up even though they don't call recordChange() in this process.\n */\n\nimport { EventEmitter } from \"node:events\";\nimport { defineEventHandler, getQuery, setResponseStatus } from \"h3\";\nimport { getAppStateEmitter } from \"../application-state/emitter.js\";\nimport { getDbExec } from \"../db/client.js\";\nimport { getSettingsEmitter } from \"../settings/store.js\";\nimport { getSession } from \"./auth.js\";\n\nexport interface ChangeEvent {\n  version: number;\n  source: string;\n  type: string;\n  key?: string;\n  /**\n   * Owner email for tenant-scoped events. When absent, the event is treated\n   * as deployment-global (e.g. table-level \"something changed\" pings) and\n   * delivered to every authenticated poller. Specific events that should\n   * only fan out to one user MUST set this — otherwise polling clients\n   * across tenants see each other's signals.\n   */\n  owner?: string;\n  /** Optional org ID for org-scoped events. */\n  orgId?: string;\n  [k: string]: unknown;\n}\n\n// In-memory ring buffer of recent changes. Kept small since clients\n// poll frequently (every 2-3s) and only need events since their last poll.\nconst MAX_BUFFER = 200;\nlet _version = 0;\nconst _buffer: ChangeEvent[] = [];\nexport const POLL_CHANGE_EVENT = \"poll-change\";\nconst _pollEmitter = new EventEmitter();\n_pollEmitter.setMaxListeners(0);\n\n/**\n * Whether we've seeded _version from the DB. In serverless (Netlify,\n * Vercel, etc.) each invocation starts fresh — without seeding, _version\n * resets to 0 and polling clients see the version jump backwards, causing\n * duplicate events and stuck UI.\n */\nlet _versionSeeded = false;\n\n/** Tracks the latest updated_at we've seen from the DB, per table. */\nlet _lastDbCheck = 0;\nlet _lastAppStateTs = 0;\nlet _lastSettingsTs = 0;\n\n/**\n * Tracks the latest updated_at seen on the `__screen_refresh__` key in\n * application_state. Bumped when the agent calls the `refresh-screen` tool,\n * and surfaced as a distinct `screen-refresh` event so clients can remount\n * the main content subtree via React key.\n *\n * `_screenRefreshInitialized` guards against spurious emits on the first\n * poll after a restart (where an existing row would look like a fresh bump).\n * Once we've taken a baseline reading, any subsequent increase emits.\n */\nlet _lastScreenRefreshTs = 0;\nlet _screenRefreshInitialized = false;\nconst SCREEN_REFRESH_KEY = \"__screen_refresh__\";\nlet _localEmittersWired = false;\n\nfunction wireLocalEmitters(): void {\n  if (_localEmittersWired) return;\n  _localEmittersWired = true;\n  getAppStateEmitter().on(\"app-state\", (event) => {\n    recordChange(event);\n  });\n  getSettingsEmitter().on(\"settings\", (event) => {\n    recordChange(event);\n  });\n}\n\n/** Get the current global version counter. */\nexport function getVersion(): number {\n  return _version;\n}\n\nexport function getPollEmitter(): EventEmitter {\n  return _pollEmitter;\n}\n\nexport function canSeeChangeForUser(\n  event: ChangeEvent,\n  userEmail: string,\n  orgId: string | undefined,\n): boolean {\n  // Global / unowned events: every authenticated user gets them.\n  if (!event.owner && !event.orgId) return true;\n  if (event.owner && event.owner === userEmail) return true;\n  if (event.orgId && orgId && event.orgId === orgId) return true;\n  return false;\n}\n\n/** Record a change event. Called by emitter listeners. */\nexport function recordChange(event: {\n  source: string;\n  type: string;\n  key?: string;\n  [k: string]: unknown;\n}): void {\n  // Use timestamp-aligned versions so all serverless instances produce\n  // values in the same range (seeded from DB, then incremented via\n  // Date.now). Plain ++counter diverges across cold starts.\n  _version = Math.max(_version + 1, Date.now());\n  const entry: ChangeEvent = { ...event, version: _version };\n  _buffer.push(entry);\n  if (_buffer.length > MAX_BUFFER) {\n    _buffer.splice(0, _buffer.length - MAX_BUFFER);\n  }\n  _pollEmitter.emit(POLL_CHANGE_EVENT, entry);\n}\n\n/** Get all changes after a given version. */\nexport function getChangesSince(since: number): {\n  version: number;\n  events: ChangeEvent[];\n} {\n  if (since >= _version) {\n    return { version: _version, events: [] };\n  }\n  const events = _buffer.filter((e) => e.version > since);\n  return { version: _version, events };\n}\n\n/**\n * Get changes after a given version, filtered to events the caller is\n * allowed to see.\n *\n * Filtering rules:\n *   - Events without an `owner` are deployment-global (table-level pings,\n *     screen-refresh, etc.) and visible to every authenticated user.\n *   - Events with `owner === userEmail` go to that user.\n *   - Events with `orgId === orgId` go to anyone in that org.\n *   - All other owned events are filtered out.\n */\nexport function getChangesSinceForUser(\n  since: number,\n  userEmail: string,\n  orgId: string | undefined,\n): { version: number; events: ChangeEvent[] } {\n  if (since >= _version) {\n    return { version: _version, events: [] };\n  }\n  const events = _buffer.filter(\n    (e) => e.version > since && canSeeChangeForUser(e, userEmail, orgId),\n  );\n  return { version: _version, events };\n}\n\n/**\n * Seed _version from DB timestamps on the first call so serverless\n * cold starts don't return version 0 and confuse polling clients.\n */\nasync function seedVersionFromDb(): Promise<void> {\n  if (_versionSeeded) return;\n  _versionSeeded = true;\n\n  try {\n    const db = getDbExec();\n\n    const [appResult, settingsResult, refreshResult] = await Promise.all([\n      db.execute(\"SELECT MAX(updated_at) as max_ts FROM application_state\"),\n      db.execute(\"SELECT MAX(updated_at) as max_ts FROM settings\"),\n      db.execute({\n        sql: \"SELECT updated_at FROM application_state WHERE key = ?\",\n        args: [SCREEN_REFRESH_KEY],\n      }),\n    ]);\n\n    const appTs = Number(appResult.rows[0]?.max_ts) || 0;\n    const settingsTs = Number(settingsResult.rows[0]?.max_ts) || 0;\n    const refreshTs = Number(refreshResult.rows[0]?.updated_at) || 0;\n\n    // Seed version — never decrease an already-set value\n    _version = Math.max(_version, appTs, settingsTs);\n\n    // Set baselines so checkExternalDbChanges detects future writes\n    _lastAppStateTs = appTs;\n    _lastSettingsTs = settingsTs;\n    _lastScreenRefreshTs = refreshTs;\n    _screenRefreshInitialized = true;\n  } catch {\n    // Tables may not exist yet — ignore\n  }\n}\n\n/**\n * Check for cross-process DB writes by comparing updated_at timestamps.\n * Runs at most once per second to avoid excessive queries.\n */\nasync function checkExternalDbChanges(): Promise<void> {\n  const now = Date.now();\n  if (now - _lastDbCheck < 1000) return;\n  _lastDbCheck = now;\n\n  try {\n    const db = getDbExec();\n\n    // Check application_state for external writes. Preserve the changed key so\n    // clients can invalidate one-shot command queries (`navigate`, `__set_url__`)\n    // only when those command rows actually change; noisy keys such as\n    // `slide-fit-check` should not wake navigation readers.\n    const appResult = await db.execute({\n      sql: \"SELECT session_id, key, updated_at FROM application_state WHERE updated_at > ? ORDER BY updated_at ASC\",\n      args: [_lastAppStateTs],\n    });\n    if (appResult.rows.length > 0) {\n      const appTs = appResult.rows.reduce(\n        (max, row) => Math.max(max, Number(row.updated_at) || 0),\n        _lastAppStateTs,\n      );\n      if (_lastAppStateTs > 0) {\n        for (const row of appResult.rows) {\n          const key = typeof row.key === \"string\" ? row.key : \"*\";\n          const owner =\n            typeof row.session_id === \"string\" ? row.session_id : undefined;\n          recordChange({\n            source: \"app-state\",\n            type: \"change\",\n            key,\n            ...(owner ? { owner } : {}),\n          });\n        }\n      }\n      _lastAppStateTs = appTs;\n    }\n\n    // Check for screen-refresh requests from the agent. The `refresh-screen`\n    // tool writes to application_state under a well-known key; when its\n    // updated_at bumps, emit a distinct event so the client invalidates\n    // all queries (not just the ones matching its default queryKey prefix).\n    const refreshResult = await db.execute({\n      sql: \"SELECT updated_at, value FROM application_state WHERE key = ?\",\n      args: [SCREEN_REFRESH_KEY],\n    });\n    const refreshTs = Number(refreshResult.rows[0]?.updated_at) || 0;\n    if (!_screenRefreshInitialized) {\n      _lastScreenRefreshTs = refreshTs;\n      _screenRefreshInitialized = true;\n    } else if (refreshTs > _lastScreenRefreshTs) {\n      let scope: string | undefined;\n      try {\n        const raw = refreshResult.rows[0]?.value;\n        if (typeof raw === \"string\") {\n          const parsed = JSON.parse(raw);\n          if (typeof parsed?.scope === \"string\") scope = parsed.scope;\n        }\n      } catch {}\n      recordChange({\n        source: \"screen-refresh\",\n        type: \"change\",\n        key: SCREEN_REFRESH_KEY,\n        ...(scope ? { scope } : {}),\n      });\n      _lastScreenRefreshTs = refreshTs;\n    }\n\n    // Check settings for external writes\n    const settingsResult = await db.execute(\n      \"SELECT MAX(updated_at) as max_ts FROM settings\",\n    );\n    const settingsTs = Number(settingsResult.rows[0]?.max_ts) || 0;\n    if (settingsTs > _lastSettingsTs) {\n      if (_lastSettingsTs > 0) {\n        recordChange({ source: \"settings\", type: \"change\", key: \"*\" });\n      }\n      _lastSettingsTs = settingsTs;\n    }\n  } catch {\n    // Tables may not exist yet — ignore\n  }\n}\n\n/**\n * Create an H3 handler for the poll endpoint.\n *\n * GET /_agent-native/poll?since=N → { version, events[] }\n *\n * Requires an authenticated session. Events are filtered to the caller's\n * tenant — global events (owner-less, table-level pings) reach every\n * authenticated caller; owned events reach only the matching user/org.\n * Without auth + filtering, an anonymous attacker could poll the deployment\n * and infer cross-tenant activity from the global event stream.\n */\nexport function createPollHandler() {\n  wireLocalEmitters();\n  return defineEventHandler(async (event) => {\n    const session = await getSession(event).catch(() => null);\n    if (!session?.email) {\n      setResponseStatus(event, 401);\n      return { error: \"Unauthenticated\" };\n    }\n    // On cold start, seed _version from DB so we don't return version: 0\n    await seedVersionFromDb();\n    // Check for cross-process writes before responding\n    await checkExternalDbChanges();\n\n    const query = getQuery(event);\n    const since = parseInt(String(query.since ?? \"0\"), 10) || 0;\n    return getChangesSinceForUser(since, session.email, session.orgId);\n  });\n}\n"]}
+{"version":3,"file":"poll.js","sourceRoot":"","sources":["../../src/server/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,GAE3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAoBvC,oEAAoE;AACpE,2EAA2E;AAC3E,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,IAAI,QAAQ,GAAG,CAAC,CAAC;AACjB,MAAM,OAAO,GAAkB,EAAE,CAAC;AAClC,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;AAC/C,MAAM,YAAY,GAAG,IAAI,YAAY,EAAE,CAAC;AACxC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AAEhC;;;;;GAKG;AACH,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,sEAAsE;AACtE,IAAI,YAAY,GAAG,CAAC,CAAC;AACrB,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,IAAI,eAAe,GAAG,CAAC,CAAC;AACxB,IAAI,iBAAiB,GAAG,CAAC,CAAC;AAC1B,IAAI,wBAAqD,CAAC;AAC1D,IAAI,sBAAsB,GAAG,CAAC,CAAC;AAE/B;;;;;;;;;GASG;AACH,IAAI,oBAAoB,GAAG,CAAC,CAAC;AAC7B,IAAI,yBAAyB,GAAG,KAAK,CAAC;AACtC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAChD,IAAI,mBAAmB,GAAG,KAAK,CAAC;AAEhC,SAAS,iBAAiB;IACxB,IAAI,mBAAmB;QAAE,OAAO;IAChC,mBAAmB,GAAG,IAAI,CAAC;IAC3B,kBAAkB,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE;QAC7C,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,kBAAkB,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,EAIC,EACD,KAAiD;IAEjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B,yCAAyC,KAAK,EAAE,CACjD,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,EAIC,EACD,KAAiD;IAEjD,OAAO,cAAc,CAAC,MAAM,mBAAmB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,EAI9C;IACC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YAC9B,GAAG,EAAE,uEAAuE;YAC5E,IAAI,EAAE,CAAC,2BAA2B,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,UAAU;IACxB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAkB,EAClB,SAAiB,EACjB,KAAyB;IAEzB,+DAA+D;IAC/D,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,KAK5B;IACC,qEAAqE;IACrE,iEAAiE;IACjE,0DAA0D;IAC1D,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAgB,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,IAAI,OAAO,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA6B;IACvD,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,SAAS,MAAM,CAAC,KAAK,EAAE,CAAC;IACjD,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,OAA2C,EAC3C,MAA6B;IAE7B,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgC;IAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IAC/D,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACxE,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,YAAY,CAAC;YACX,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,GAAG;YACR,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,GAA4B,EAC5B,SAAyC;IAEzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IACzD,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,UAAU,GACd,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAElE,IAAI,KAAK;QAAE,kBAAkB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,KAAK,IAAI,KAAK;QAAE,kBAAkB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAE1E,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,MAAM,WAAW,GACf,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,aAAa,KAAK,MAAM,IAAI,WAAW,EAAE,CAAC;YAC5C,kBAAkB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,aAAa,KAAK,KAAK,IAAI,WAAW,EAAE,CAAC;YAClD,kBAAkB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,EAIC,EACD,IAAoC;IAEpC,MAAM,GAAG,GAAG,IAAI;SACb,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACxD,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0C,CAAC;IAE7E,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;gBACnC,GAAG,EAAE,2FAA2F,YAAY,GAAG;gBAC/G,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;gBACrC,MAAM,UAAU,GACd,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,kBAAkB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACtB,sBAAsB,CACpB,GAAG,EACH,kBAAkB,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CACvE,CACF,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,eAAe,CAAC,KAAa;IAI3C,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,SAAiB,EACjB,KAAyB;IAEzB,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,CACrE,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,iBAAiB;IAC9B,IAAI,cAAc;QAAE,OAAO;IAC3B,cAAc,GAAG,IAAI,CAAC;IAEtB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QAEvB,MAAM,CACJ,KAAK,EACL,UAAU,EACV,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACd,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,gBAAgB,CAAC,EAAE,EAAE,mBAAmB,CAAC;YACzC,gBAAgB,CAAC,EAAE,EAAE,UAAU,CAAC;YAChC,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC;YAChC,+BAA+B,CAAC,EAAE,CAAC;YACnC,EAAE;iBACC,OAAO,CAAC;gBACP,GAAG,EAAE,wDAAwD;gBAC7D,IAAI,EAAE,CAAC,kBAAkB,CAAC;aAC3B,CAAC;iBACD,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;SAC/B,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QAEpE,qDAAqD;QACrD,QAAQ,GAAG,IAAI,CAAC,GAAG,CACjB,QAAQ,EACR,KAAK,EACL,UAAU,EACV,YAAY,EACZ,iBAAiB,CAClB,CAAC;QAEF,gEAAgE;QAChE,eAAe,GAAG,KAAK,CAAC;QACxB,eAAe,GAAG,UAAU,CAAC;QAC7B,iBAAiB,GAAG,YAAY,CAAC;QACjC,wBAAwB,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,sBAAsB,GAAG,iBAAiB,CAAC;QAC3C,oBAAoB,GAAG,SAAS,CAAC;QACjC,yBAAyB,GAAG,IAAI,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,GAAG,GAAG,YAAY,GAAG,IAAI;QAAE,OAAO;IACtC,YAAY,GAAG,GAAG,CAAC;IAEnB,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;QAEvB,2EAA2E;QAC3E,8EAA8E;QAC9E,mEAAmE;QACnE,wDAAwD;QACxD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YACjC,GAAG,EAAE,wGAAwG;YAC7G,IAAI,EAAE,CAAC,eAAe,CAAC;SACxB,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CACjC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAC3D,eAAe,CAChB,CAAC;YACF,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;gBACxB,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;oBACjC,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;oBACxD,IAAI,GAAG,KAAK,2BAA2B;wBAAE,SAAS;oBAClD,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;oBAClE,YAAY,CAAC;wBACX,MAAM,EAAE,WAAW;wBACnB,IAAI,EAAE,QAAQ;wBACd,GAAG;wBACH,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,eAAe,GAAG,KAAK,CAAC;QAC1B,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,oEAAoE;QACpE,wEAAwE;QACxE,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;YACrC,GAAG,EAAE,+DAA+D;YACpE,IAAI,EAAE,CAAC,kBAAkB,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC/B,oBAAoB,GAAG,SAAS,CAAC;YACjC,yBAAyB,GAAG,IAAI,CAAC;QACnC,CAAC;aAAM,IAAI,SAAS,GAAG,oBAAoB,EAAE,CAAC;YAC5C,IAAI,KAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;gBACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBAC/B,IAAI,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ;wBAAE,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;gBAC9D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,YAAY,CAAC;gBACX,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,QAAQ;gBACd,GAAG,EAAE,kBAAkB;gBACvB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5B,CAAC,CAAC;YACH,oBAAoB,GAAG,SAAS,CAAC;QACnC,CAAC;QAED,2EAA2E;QAC3E,wEAAwE;QACxE,oEAAoE;QACpE,gDAAgD;QAChD,MAAM,iBAAiB,GAAG,MAAM,+BAA+B,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,iBAAiB,GAAG,sBAAsB,EAAE,CAAC;YAC/C,MAAM,qBAAqB,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;gBAC7C,GAAG,EAAE,mGAAmG;gBACxG,IAAI,EAAE,CAAC,2BAA2B,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAC/D,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,sBAAsB,CACjE,CAAC;YACF,IAAI,sBAAsB,GAAG,CAAC,EAAE,CAAC;gBAC/B,sBAAsB,CACpB,uBAAuB;qBACpB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;qBACnE,MAAM,CAAC,CAAC,MAAM,EAAmC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CACjE,CAAC;YACJ,CAAC;YACD,sBAAsB,GAAG,iBAAiB,CAAC;QAC7C,CAAC;QAED,qCAAqC;QACrC,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,UAAU,GAAG,eAAe,EAAE,CAAC;YACjC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;gBACxB,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,eAAe,GAAG,UAAU,CAAC;QAC/B,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,sBAAsB,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,YAAY,GAAG,cAAc,CAAC,sBAAsB,CAAC,CAAC;QAC5D,IAAI,YAAY,GAAG,iBAAiB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,wBAAwB,CAAC;YACvC,MAAM,eAAe,GACnB,KAAK,KAAK,SAAS;gBACjB,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC;oBACf,GAAG,EAAE,2FAA2F;oBAChG,IAAI,EAAE,EAAE;iBACT,CAAC;gBACJ,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC;oBACf,GAAG,EAAE,gHAAgH;oBACrH,IAAI,EAAE,CAAC,KAAK,CAAC;iBACd,CAAC,CAAC;YACT,MAAM,oBAAoB,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CACtD,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,iBAAiB,CAC5D,CAAC;YACF,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,YAAY,GAAG,MAAM,2BAA2B,CACpD,EAAE,EACF,oBAAoB,CACrB,CAAC;gBACF,KAAK,MAAM,OAAO,IAAI,YAAY;oBAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACtE,CAAC;YACD,iBAAiB,GAAG,YAAY,CAAC;YACjC,wBAAwB,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB;IAC/B,iBAAiB,EAAE,CAAC;IACpB,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QACtC,CAAC;QACD,qEAAqE;QACrE,MAAM,iBAAiB,EAAE,CAAC;QAC1B,mDAAmD;QACnD,MAAM,sBAAsB,EAAE,CAAC;QAE/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Polling-based change notification.\n *\n * Replaces SSE with a simple version counter. Each DB mutation (app-state,\n * settings, resources) increments the version. Clients poll `/_agent-native/poll?since=N`\n * and receive any events that occurred after version N.\n *\n * Works in all deployment environments (serverless, edge, long-lived).\n *\n * Also detects cross-process DB writes by periodically checking the\n * application_state and settings tables' updated_at timestamps. This ensures\n * that changes made by external processes (e.g., CLI actions, cron jobs)\n * are picked up even though they don't call recordChange() in this process.\n */\n\nimport { EventEmitter } from \"node:events\";\nimport { defineEventHandler, getQuery, setResponseStatus } from \"h3\";\nimport { getAppStateEmitter } from \"../application-state/emitter.js\";\nimport { getDbExec } from \"../db/client.js\";\nimport {\n  EXTENSION_CHANGE_MARKER_KEY,\n  parseExtensionChangeMarker,\n  type ExtensionChangeTarget,\n} from \"../extensions/change-marker.js\";\nimport { getSettingsEmitter } from \"../settings/store.js\";\nimport { getSession } from \"./auth.js\";\n\nexport interface ChangeEvent {\n  version: number;\n  source: string;\n  type: string;\n  key?: string;\n  /**\n   * Owner email for tenant-scoped events. When absent, the event is treated\n   * as deployment-global (e.g. table-level \"something changed\" pings) and\n   * delivered to every authenticated poller. Specific events that should\n   * only fan out to one user MUST set this — otherwise polling clients\n   * across tenants see each other's signals.\n   */\n  owner?: string;\n  /** Optional org ID for org-scoped events. */\n  orgId?: string;\n  [k: string]: unknown;\n}\n\n// In-memory ring buffer of recent changes. Kept small since clients\n// poll frequently (every 2-3s) and only need events since their last poll.\nconst MAX_BUFFER = 200;\nlet _version = 0;\nconst _buffer: ChangeEvent[] = [];\nexport const POLL_CHANGE_EVENT = \"poll-change\";\nconst _pollEmitter = new EventEmitter();\n_pollEmitter.setMaxListeners(0);\n\n/**\n * Whether we've seeded _version from the DB. In serverless (Netlify,\n * Vercel, etc.) each invocation starts fresh — without seeding, _version\n * resets to 0 and polling clients see the version jump backwards, causing\n * duplicate events and stuck UI.\n */\nlet _versionSeeded = false;\n\n/** Tracks the latest updated_at we've seen from the DB, per table. */\nlet _lastDbCheck = 0;\nlet _lastAppStateTs = 0;\nlet _lastSettingsTs = 0;\nlet _lastExtensionsTs = 0;\nlet _lastExtensionsUpdatedAt: string | number | undefined;\nlet _lastExtensionMarkerTs = 0;\n\n/**\n * Tracks the latest updated_at seen on the `__screen_refresh__` key in\n * application_state. Bumped when the agent calls the `refresh-screen` tool,\n * and surfaced as a distinct `screen-refresh` event so clients can remount\n * the main content subtree via React key.\n *\n * `_screenRefreshInitialized` guards against spurious emits on the first\n * poll after a restart (where an existing row would look like a fresh bump).\n * Once we've taken a baseline reading, any subsequent increase emits.\n */\nlet _lastScreenRefreshTs = 0;\nlet _screenRefreshInitialized = false;\nconst SCREEN_REFRESH_KEY = \"__screen_refresh__\";\nlet _localEmittersWired = false;\n\nfunction wireLocalEmitters(): void {\n  if (_localEmittersWired) return;\n  _localEmittersWired = true;\n  getAppStateEmitter().on(\"app-state\", (event) => {\n    recordChange(event);\n  });\n  getSettingsEmitter().on(\"settings\", (event) => {\n    recordChange(event);\n  });\n}\n\nfunction timestampValue(value: unknown): number {\n  if (typeof value === \"number\" && Number.isFinite(value)) return value;\n  if (typeof value !== \"string\") return 0;\n  const numeric = Number(value);\n  if (Number.isFinite(numeric)) return numeric;\n  const parsed = Date.parse(value);\n  return Number.isFinite(parsed) ? parsed : 0;\n}\n\nfunction sqlWatermarkValue(value: unknown): string | number | undefined {\n  if (typeof value === \"string\" && value.length > 0) return value;\n  if (typeof value === \"number\" && Number.isFinite(value)) return value;\n  return undefined;\n}\n\nasync function readMaxUpdatedAtRaw(\n  db: {\n    execute: (\n      query: string | { sql: string; args?: unknown[] },\n    ) => Promise<{ rows: Array<Record<string, unknown>> }>;\n  },\n  table: \"application_state\" | \"settings\" | \"tools\",\n): Promise<unknown> {\n  try {\n    const result = await db.execute(\n      `SELECT MAX(updated_at) as max_ts FROM ${table}`,\n    );\n    return result.rows[0]?.max_ts;\n  } catch {\n    // Optional framework tables may not exist in every app yet.\n    return undefined;\n  }\n}\n\nasync function readMaxUpdatedAt(\n  db: {\n    execute: (\n      query: string | { sql: string; args?: unknown[] },\n    ) => Promise<{ rows: Array<Record<string, unknown>> }>;\n  },\n  table: \"application_state\" | \"settings\" | \"tools\",\n): Promise<number> {\n  return timestampValue(await readMaxUpdatedAtRaw(db, table));\n}\n\nasync function readExtensionMarkerMaxUpdatedAt(db: {\n  execute: (\n    query: string | { sql: string; args?: unknown[] },\n  ) => Promise<{ rows: Array<Record<string, unknown>> }>;\n}): Promise<number> {\n  try {\n    const result = await db.execute({\n      sql: \"SELECT MAX(updated_at) as max_ts FROM application_state WHERE key = ?\",\n      args: [EXTENSION_CHANGE_MARKER_KEY],\n    });\n    return timestampValue(result.rows[0]?.max_ts);\n  } catch {\n    return 0;\n  }\n}\n\n/** Get the current global version counter. */\nexport function getVersion(): number {\n  return _version;\n}\n\nexport function getPollEmitter(): EventEmitter {\n  return _pollEmitter;\n}\n\nexport function canSeeChangeForUser(\n  event: ChangeEvent,\n  userEmail: string,\n  orgId: string | undefined,\n): boolean {\n  // Global / unowned events: every authenticated user gets them.\n  if (!event.owner && !event.orgId) return true;\n  if (event.owner && event.owner === userEmail) return true;\n  if (event.orgId && orgId && event.orgId === orgId) return true;\n  return false;\n}\n\n/** Record a change event. Called by emitter listeners. */\nexport function recordChange(event: {\n  source: string;\n  type: string;\n  key?: string;\n  [k: string]: unknown;\n}): void {\n  // Use timestamp-aligned versions so all serverless instances produce\n  // values in the same range (seeded from DB, then incremented via\n  // Date.now). Plain ++counter diverges across cold starts.\n  _version = Math.max(_version + 1, Date.now());\n  const entry: ChangeEvent = { ...event, version: _version };\n  _buffer.push(entry);\n  if (_buffer.length > MAX_BUFFER) {\n    _buffer.splice(0, _buffer.length - MAX_BUFFER);\n  }\n  _pollEmitter.emit(POLL_CHANGE_EVENT, entry);\n}\n\nfunction extensionTargetKey(target: ExtensionChangeTarget): string | null {\n  if (target.owner) return `owner:${target.owner}`;\n  if (target.orgId) return `org:${target.orgId}`;\n  return null;\n}\n\nfunction addExtensionTarget(\n  targets: Map<string, ExtensionChangeTarget>,\n  target: ExtensionChangeTarget,\n): void {\n  const key = extensionTargetKey(target);\n  if (key) targets.set(key, target);\n}\n\nfunction recordExtensionChanges(targets: ExtensionChangeTarget[]): void {\n  const uniqueTargets = new Map<string, ExtensionChangeTarget>();\n  for (const target of targets) addExtensionTarget(uniqueTargets, target);\n  for (const target of uniqueTargets.values()) {\n    recordChange({\n      source: \"extensions\",\n      type: \"change\",\n      key: \"*\",\n      ...(target.owner ? { owner: target.owner } : {}),\n      ...(target.orgId ? { orgId: target.orgId } : {}),\n    });\n  }\n}\n\nfunction extensionTargetsForRow(\n  row: Record<string, unknown>,\n  shareRows: Array<Record<string, unknown>>,\n): ExtensionChangeTarget[] {\n  const targets = new Map<string, ExtensionChangeTarget>();\n  const owner = typeof row.owner_email === \"string\" ? row.owner_email : \"\";\n  const orgId = typeof row.org_id === \"string\" ? row.org_id : \"\";\n  const visibility =\n    typeof row.visibility === \"string\" ? row.visibility : \"private\";\n\n  if (owner) addExtensionTarget(targets, { owner });\n  if (visibility === \"org\" && orgId) addExtensionTarget(targets, { orgId });\n\n  for (const share of shareRows) {\n    const principalType =\n      typeof share.principal_type === \"string\" ? share.principal_type : \"\";\n    const principalId =\n      typeof share.principal_id === \"string\" ? share.principal_id : \"\";\n    if (principalType === \"user\" && principalId) {\n      addExtensionTarget(targets, { owner: principalId });\n    } else if (principalType === \"org\" && principalId) {\n      addExtensionTarget(targets, { orgId: principalId });\n    }\n  }\n\n  return Array.from(targets.values());\n}\n\nasync function readExtensionTargetsForRows(\n  db: {\n    execute: (\n      query: string | { sql: string; args?: unknown[] },\n    ) => Promise<{ rows: Array<Record<string, unknown>> }>;\n  },\n  rows: Array<Record<string, unknown>>,\n): Promise<ExtensionChangeTarget[][]> {\n  const ids = rows\n    .map((row) => (typeof row.id === \"string\" ? row.id : \"\"))\n    .filter(Boolean);\n  const sharesByResourceId = new Map<string, Array<Record<string, unknown>>>();\n\n  if (ids.length > 0) {\n    try {\n      const placeholders = ids.map(() => \"?\").join(\", \");\n      const shareResult = await db.execute({\n        sql: `SELECT resource_id, principal_type, principal_id FROM tool_shares WHERE resource_id IN (${placeholders})`,\n        args: ids,\n      });\n      for (const share of shareResult.rows) {\n        const resourceId =\n          typeof share.resource_id === \"string\" ? share.resource_id : \"\";\n        if (!resourceId) continue;\n        const bucket = sharesByResourceId.get(resourceId) ?? [];\n        bucket.push(share);\n        sharesByResourceId.set(resourceId, bucket);\n      }\n    } catch {\n      // Sharing tables are optional during early app initialization.\n    }\n  }\n\n  return rows.map((row) =>\n    extensionTargetsForRow(\n      row,\n      sharesByResourceId.get(typeof row.id === \"string\" ? row.id : \"\") ?? [],\n    ),\n  );\n}\n\n/** Get all changes after a given version. */\nexport function getChangesSince(since: number): {\n  version: number;\n  events: ChangeEvent[];\n} {\n  if (since >= _version) {\n    return { version: _version, events: [] };\n  }\n  const events = _buffer.filter((e) => e.version > since);\n  return { version: _version, events };\n}\n\n/**\n * Get changes after a given version, filtered to events the caller is\n * allowed to see.\n *\n * Filtering rules:\n *   - Events without an `owner` are deployment-global (table-level pings,\n *     screen-refresh, etc.) and visible to every authenticated user.\n *   - Events with `owner === userEmail` go to that user.\n *   - Events with `orgId === orgId` go to anyone in that org.\n *   - All other owned events are filtered out.\n */\nexport function getChangesSinceForUser(\n  since: number,\n  userEmail: string,\n  orgId: string | undefined,\n): { version: number; events: ChangeEvent[] } {\n  if (since >= _version) {\n    return { version: _version, events: [] };\n  }\n  const events = _buffer.filter(\n    (e) => e.version > since && canSeeChangeForUser(e, userEmail, orgId),\n  );\n  return { version: _version, events };\n}\n\n/**\n * Seed _version from DB timestamps on the first call so serverless\n * cold starts don't return version 0 and confuse polling clients.\n */\nasync function seedVersionFromDb(): Promise<void> {\n  if (_versionSeeded) return;\n  _versionSeeded = true;\n\n  try {\n    const db = getDbExec();\n\n    const [\n      appTs,\n      settingsTs,\n      extensionsMaxUpdatedAt,\n      extensionMarkerTs,\n      refreshResult,\n    ] = await Promise.all([\n      readMaxUpdatedAt(db, \"application_state\"),\n      readMaxUpdatedAt(db, \"settings\"),\n      readMaxUpdatedAtRaw(db, \"tools\"),\n      readExtensionMarkerMaxUpdatedAt(db),\n      db\n        .execute({\n          sql: \"SELECT updated_at FROM application_state WHERE key = ?\",\n          args: [SCREEN_REFRESH_KEY],\n        })\n        .catch(() => ({ rows: [] })),\n    ]);\n\n    const extensionsTs = timestampValue(extensionsMaxUpdatedAt);\n    const refreshTs = timestampValue(refreshResult.rows[0]?.updated_at);\n\n    // Seed version — never decrease an already-set value\n    _version = Math.max(\n      _version,\n      appTs,\n      settingsTs,\n      extensionsTs,\n      extensionMarkerTs,\n    );\n\n    // Set baselines so checkExternalDbChanges detects future writes\n    _lastAppStateTs = appTs;\n    _lastSettingsTs = settingsTs;\n    _lastExtensionsTs = extensionsTs;\n    _lastExtensionsUpdatedAt = sqlWatermarkValue(extensionsMaxUpdatedAt);\n    _lastExtensionMarkerTs = extensionMarkerTs;\n    _lastScreenRefreshTs = refreshTs;\n    _screenRefreshInitialized = true;\n  } catch {\n    // Tables may not exist yet — ignore\n  }\n}\n\n/**\n * Check for cross-process DB writes by comparing updated_at timestamps.\n * Runs at most once per second to avoid excessive queries.\n */\nasync function checkExternalDbChanges(): Promise<void> {\n  const now = Date.now();\n  if (now - _lastDbCheck < 1000) return;\n  _lastDbCheck = now;\n\n  try {\n    const db = getDbExec();\n\n    // Check application_state for external writes. Preserve the changed key so\n    // clients can invalidate one-shot command queries (`navigate`, `__set_url__`)\n    // only when those command rows actually change; noisy keys such as\n    // `slide-fit-check` should not wake navigation readers.\n    const appResult = await db.execute({\n      sql: \"SELECT session_id, key, updated_at FROM application_state WHERE updated_at > ? ORDER BY updated_at ASC\",\n      args: [_lastAppStateTs],\n    });\n    if (appResult.rows.length > 0) {\n      const appTs = appResult.rows.reduce(\n        (max, row) => Math.max(max, timestampValue(row.updated_at)),\n        _lastAppStateTs,\n      );\n      if (_lastAppStateTs > 0) {\n        for (const row of appResult.rows) {\n          const key = typeof row.key === \"string\" ? row.key : \"*\";\n          if (key === EXTENSION_CHANGE_MARKER_KEY) continue;\n          const owner =\n            typeof row.session_id === \"string\" ? row.session_id : undefined;\n          recordChange({\n            source: \"app-state\",\n            type: \"change\",\n            key,\n            ...(owner ? { owner } : {}),\n          });\n        }\n      }\n      _lastAppStateTs = appTs;\n    }\n\n    // Check for screen-refresh requests from the agent. The `refresh-screen`\n    // tool writes to application_state under a well-known key; when its\n    // updated_at bumps, emit a distinct event so the client invalidates\n    // all queries (not just the ones matching its default queryKey prefix).\n    const refreshResult = await db.execute({\n      sql: \"SELECT updated_at, value FROM application_state WHERE key = ?\",\n      args: [SCREEN_REFRESH_KEY],\n    });\n    const refreshTs = timestampValue(refreshResult.rows[0]?.updated_at);\n    if (!_screenRefreshInitialized) {\n      _lastScreenRefreshTs = refreshTs;\n      _screenRefreshInitialized = true;\n    } else if (refreshTs > _lastScreenRefreshTs) {\n      let scope: string | undefined;\n      try {\n        const raw = refreshResult.rows[0]?.value;\n        if (typeof raw === \"string\") {\n          const parsed = JSON.parse(raw);\n          if (typeof parsed?.scope === \"string\") scope = parsed.scope;\n        }\n      } catch {}\n      recordChange({\n        source: \"screen-refresh\",\n        type: \"change\",\n        key: SCREEN_REFRESH_KEY,\n        ...(scope ? { scope } : {}),\n      });\n      _lastScreenRefreshTs = refreshTs;\n    }\n\n    // Extension mutations write a durable marker row so delete and hide/unhide\n    // operations are visible across serverless invocations. Translate those\n    // marker rows back into extension-source events for targeted client\n    // invalidation while preserving user/org scope.\n    const extensionMarkerTs = await readExtensionMarkerMaxUpdatedAt(db);\n    if (extensionMarkerTs > _lastExtensionMarkerTs) {\n      const extensionMarkerResult = await db.execute({\n        sql: \"SELECT session_id, value, updated_at FROM application_state WHERE key = ? ORDER BY updated_at ASC\",\n        args: [EXTENSION_CHANGE_MARKER_KEY],\n      });\n      const changedExtensionMarkers = extensionMarkerResult.rows.filter(\n        (row) => timestampValue(row.updated_at) > _lastExtensionMarkerTs,\n      );\n      if (_lastExtensionMarkerTs > 0) {\n        recordExtensionChanges(\n          changedExtensionMarkers\n            .map((row) => parseExtensionChangeMarker(row.session_id, row.value))\n            .filter((target): target is ExtensionChangeTarget => !!target),\n        );\n      }\n      _lastExtensionMarkerTs = extensionMarkerTs;\n    }\n\n    // Check settings for external writes\n    const settingsTs = await readMaxUpdatedAt(db, \"settings\");\n    if (settingsTs > _lastSettingsTs) {\n      if (_lastSettingsTs > 0) {\n        recordChange({ source: \"settings\", type: \"change\", key: \"*\" });\n      }\n      _lastSettingsTs = settingsTs;\n    }\n\n    // Extension rows live in the legacy physical `tools` table. Keep this as a\n    // compatibility fallback for direct table writes, but scope events to the\n    // resource owner/share targets instead of broadcasting deployment-wide.\n    const extensionsMaxUpdatedAt = await readMaxUpdatedAtRaw(db, \"tools\");\n    const extensionsTs = timestampValue(extensionsMaxUpdatedAt);\n    if (extensionsTs > _lastExtensionsTs) {\n      const since = _lastExtensionsUpdatedAt;\n      const extensionResult =\n        since === undefined\n          ? await db.execute({\n              sql: \"SELECT id, owner_email, org_id, visibility, updated_at FROM tools ORDER BY updated_at ASC\",\n              args: [],\n            })\n          : await db.execute({\n              sql: \"SELECT id, owner_email, org_id, visibility, updated_at FROM tools WHERE updated_at > ? ORDER BY updated_at ASC\",\n              args: [since],\n            });\n      const changedExtensionRows = extensionResult.rows.filter(\n        (row) => timestampValue(row.updated_at) > _lastExtensionsTs,\n      );\n      if (_lastExtensionsTs > 0) {\n        const targetsByRow = await readExtensionTargetsForRows(\n          db,\n          changedExtensionRows,\n        );\n        for (const targets of targetsByRow) recordExtensionChanges(targets);\n      }\n      _lastExtensionsTs = extensionsTs;\n      _lastExtensionsUpdatedAt = sqlWatermarkValue(extensionsMaxUpdatedAt);\n    }\n  } catch {\n    // Tables may not exist yet — ignore\n  }\n}\n\n/**\n * Create an H3 handler for the poll endpoint.\n *\n * GET /_agent-native/poll?since=N → { version, events[] }\n *\n * Requires an authenticated session. Events are filtered to the caller's\n * tenant — global events (owner-less, table-level pings) reach every\n * authenticated caller; owned events reach only the matching user/org.\n * Without auth + filtering, an anonymous attacker could poll the deployment\n * and infer cross-tenant activity from the global event stream.\n */\nexport function createPollHandler() {\n  wireLocalEmitters();\n  return defineEventHandler(async (event) => {\n    const session = await getSession(event).catch(() => null);\n    if (!session?.email) {\n      setResponseStatus(event, 401);\n      return { error: \"Unauthenticated\" };\n    }\n    // On cold start, seed _version from DB so we don't return version: 0\n    await seedVersionFromDb();\n    // Check for cross-process writes before responding\n    await checkExternalDbChanges();\n\n    const query = getQuery(event);\n    const since = parseInt(String(query.since ?? \"0\"), 10) || 0;\n    return getChangesSinceForUser(since, session.email, session.orgId);\n  });\n}\n"]}

package/dist/server/resources-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-plugin.d.ts","sourceRoot":"","sources":["../../src/server/resources-plugin.ts"],"names":[],"mappings":"AAeA,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CA2DtD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC"}
+{"version":3,"file":"resources-plugin.d.ts","sourceRoot":"","sources":["../../src/server/resources-plugin.ts"],"names":[],"mappings":"AAgBA,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CA2EtD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC"}

package/dist/server/resources-plugin.js

@@ -1,6 +1,6 @@
 import { getH3App, markDefaultPluginProvided, } from "./framework-request-handler.js";
 import { defineEventHandler, setResponseStatus, getMethod } from "h3";
-import { handleListResources, handleGetResourceTree, handleGetResource, handleCreateResource, handleUpdateResource, handleDeleteResource, handleUploadResource, } from "../resources/handlers.js";
+import { handleListResources, handleGetResourceTree, handleGetEffectiveResourceContext, handleGetResource, handleCreateResource, handleUpdateResource, handleDeleteResource, handleUploadResource, } from "../resources/handlers.js";
 /**
  * Creates a Nitro plugin that mounts all resource CRUD routes.
  *
@@ -17,6 +17,13 @@ export function createResourcesPlugin() {
     return async (nitroApp) => {
         markDefaultPluginProvided(nitroApp, "resources");
         // Mount specific sub-routes BEFORE the catch-all
+        getH3App(nitroApp).use("/_agent-native/resources/effective", defineEventHandler(async (event) => {
+            if (getMethod(event) !== "GET") {
+                setResponseStatus(event, 405);
+                return { error: "Method not allowed" };
+            }
+            return handleGetEffectiveResourceContext(event);
+        }));
         getH3App(nitroApp).use("/_agent-native/resources/tree", defineEventHandler(async (event) => {
             if (getMethod(event) !== "GET") {
                 setResponseStatus(event, 405);
@@ -47,7 +54,9 @@ export function createResourcesPlugin() {
                 return { error: "Method not allowed" };
             }
             // Already handled by dedicated routes above
-            if (subPath === "tree" || subPath === "upload")
+            if (subPath === "effective" ||
+                subPath === "tree" ||
+                subPath === "upload")
                 return;
             // /_agent-native/resources/:id — get, update, delete
             event.context.params = { ...event.context.params, id: subPath };

package/dist/server/resources-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-plugin.js","sourceRoot":"","sources":["../../src/server/resources-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAIlC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,EAAE,QAAa,EAAE,EAAE;QAC7B,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjD,iDAAiD;QAEjD,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,+BAA+B,EAC/B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CACH,CAAC;QAEF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,iCAAiC,EACjC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;gBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,0BAA0B,EAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,6DAA6D;YAC7D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAEvC,yDAAyD;YACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBAC/B,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAC1D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,4CAA4C;YAC5C,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ;gBAAE,OAAO;YAEvD,qDAAqD;YACrD,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;YAEhE,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE5D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB,qBAAqB,EAAE,CAAC","sourcesContent":["import {\n  getH3App,\n  markDefaultPluginProvided,\n} from \"./framework-request-handler.js\";\nimport { defineEventHandler, setResponseStatus, getMethod } from \"h3\";\nimport {\n  handleListResources,\n  handleGetResourceTree,\n  handleGetResource,\n  handleCreateResource,\n  handleUpdateResource,\n  handleDeleteResource,\n  handleUploadResource,\n} from \"../resources/handlers.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\n/**\n * Creates a Nitro plugin that mounts all resource CRUD routes.\n *\n * Routes:\n *   GET    /_agent-native/resources          — list resources\n *   POST   /_agent-native/resources          — create resource\n *   GET    /_agent-native/resources/tree     — get resource tree\n *   POST   /_agent-native/resources/upload   — upload file\n *   GET    /_agent-native/resources/:id      — get resource by ID\n *   PUT    /_agent-native/resources/:id      — update resource\n *   DELETE /_agent-native/resources/:id      — delete resource\n */\nexport function createResourcesPlugin(): NitroPluginDef {\n  return async (nitroApp: any) => {\n    markDefaultPluginProvided(nitroApp, \"resources\");\n    // Mount specific sub-routes BEFORE the catch-all\n\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources/tree\",\n      defineEventHandler(async (event) => {\n        if (getMethod(event) !== \"GET\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n        return handleGetResourceTree(event);\n      }),\n    );\n\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources/upload\",\n      defineEventHandler(async (event) => {\n        if (getMethod(event) !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n        return handleUploadResource(event);\n      }),\n    );\n\n    // Catch-all for /_agent-native/resources and /_agent-native/resources/:id\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources\",\n      defineEventHandler(async (event) => {\n        const method = getMethod(event);\n        // h3 strips the mount prefix, so event.path is \"/\" or \"/:id\"\n        const raw = (event.path || \"/\").split(\"?\")[0];\n        const subPath = raw.replace(/^\\//, \"\");\n\n        // No sub-path: /_agent-native/resources — list or create\n        if (!subPath || subPath === \"\") {\n          if (method === \"GET\") return handleListResources(event);\n          if (method === \"POST\") return handleCreateResource(event);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // Already handled by dedicated routes above\n        if (subPath === \"tree\" || subPath === \"upload\") return;\n\n        // /_agent-native/resources/:id — get, update, delete\n        event.context.params = { ...event.context.params, id: subPath };\n\n        if (method === \"GET\") return handleGetResource(event);\n        if (method === \"PUT\") return handleUpdateResource(event);\n        if (method === \"DELETE\") return handleDeleteResource(event);\n\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }),\n    );\n  };\n}\n\n/**\n * Default resources plugin — mount with no configuration needed.\n *\n * Usage in templates:\n * ```ts\n * // server/plugins/resources.ts\n * import { defaultResourcesPlugin } from \"@agent-native/core/server\";\n * export default defaultResourcesPlugin;\n * ```\n */\nexport const defaultResourcesPlugin: NitroPluginDef = createResourcesPlugin();\n"]}
+{"version":3,"file":"resources-plugin.js","sourceRoot":"","sources":["../../src/server/resources-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iCAAiC,EACjC,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAIlC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,EAAE,QAAa,EAAE,EAAE;QAC7B,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjD,iDAAiD;QAEjD,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,oCAAoC,EACpC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,iCAAiC,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC,CAAC,CACH,CAAC;QAEF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,+BAA+B,EAC/B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CACH,CAAC;QAEF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,iCAAiC,EACjC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;gBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,0BAA0B,EAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,6DAA6D;YAC7D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAEvC,yDAAyD;YACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBAC/B,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAC1D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,4CAA4C;YAC5C,IACE,OAAO,KAAK,WAAW;gBACvB,OAAO,KAAK,MAAM;gBAClB,OAAO,KAAK,QAAQ;gBAEpB,OAAO;YAET,qDAAqD;YACrD,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;YAEhE,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE5D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB,qBAAqB,EAAE,CAAC","sourcesContent":["import {\n  getH3App,\n  markDefaultPluginProvided,\n} from \"./framework-request-handler.js\";\nimport { defineEventHandler, setResponseStatus, getMethod } from \"h3\";\nimport {\n  handleListResources,\n  handleGetResourceTree,\n  handleGetEffectiveResourceContext,\n  handleGetResource,\n  handleCreateResource,\n  handleUpdateResource,\n  handleDeleteResource,\n  handleUploadResource,\n} from \"../resources/handlers.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\n/**\n * Creates a Nitro plugin that mounts all resource CRUD routes.\n *\n * Routes:\n *   GET    /_agent-native/resources          — list resources\n *   POST   /_agent-native/resources          — create resource\n *   GET    /_agent-native/resources/tree     — get resource tree\n *   POST   /_agent-native/resources/upload   — upload file\n *   GET    /_agent-native/resources/:id      — get resource by ID\n *   PUT    /_agent-native/resources/:id      — update resource\n *   DELETE /_agent-native/resources/:id      — delete resource\n */\nexport function createResourcesPlugin(): NitroPluginDef {\n  return async (nitroApp: any) => {\n    markDefaultPluginProvided(nitroApp, \"resources\");\n    // Mount specific sub-routes BEFORE the catch-all\n\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources/effective\",\n      defineEventHandler(async (event) => {\n        if (getMethod(event) !== \"GET\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n        return handleGetEffectiveResourceContext(event);\n      }),\n    );\n\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources/tree\",\n      defineEventHandler(async (event) => {\n        if (getMethod(event) !== \"GET\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n        return handleGetResourceTree(event);\n      }),\n    );\n\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources/upload\",\n      defineEventHandler(async (event) => {\n        if (getMethod(event) !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n        return handleUploadResource(event);\n      }),\n    );\n\n    // Catch-all for /_agent-native/resources and /_agent-native/resources/:id\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources\",\n      defineEventHandler(async (event) => {\n        const method = getMethod(event);\n        // h3 strips the mount prefix, so event.path is \"/\" or \"/:id\"\n        const raw = (event.path || \"/\").split(\"?\")[0];\n        const subPath = raw.replace(/^\\//, \"\");\n\n        // No sub-path: /_agent-native/resources — list or create\n        if (!subPath || subPath === \"\") {\n          if (method === \"GET\") return handleListResources(event);\n          if (method === \"POST\") return handleCreateResource(event);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // Already handled by dedicated routes above\n        if (\n          subPath === \"effective\" ||\n          subPath === \"tree\" ||\n          subPath === \"upload\"\n        )\n          return;\n\n        // /_agent-native/resources/:id — get, update, delete\n        event.context.params = { ...event.context.params, id: subPath };\n\n        if (method === \"GET\") return handleGetResource(event);\n        if (method === \"PUT\") return handleUpdateResource(event);\n        if (method === \"DELETE\") return handleDeleteResource(event);\n\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }),\n    );\n  };\n}\n\n/**\n * Default resources plugin — mount with no configuration needed.\n *\n * Usage in templates:\n * ```ts\n * // server/plugins/resources.ts\n * import { defaultResourcesPlugin } from \"@agent-native/core/server\";\n * export default defaultResourcesPlugin;\n * ```\n */\nexport const defaultResourcesPlugin: NitroPluginDef = createResourcesPlugin();\n"]}

package/dist/sharing/actions/extension-change.d.ts

@@ -0,0 +1,4 @@
+import type { ExtensionChangeTarget } from "../../extensions/change-marker.js";
+export declare function getExtensionShareChangeTargets(resourceType: string, resourceId: string): Promise<ExtensionChangeTarget[]>;
+export declare function notifyExtensionShareChanged(resourceType: string, resourceId: string, beforeTargets: ExtensionChangeTarget[]): Promise<void>;
+//# sourceMappingURL=extension-change.d.ts.map

package/dist/sharing/actions/extension-change.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-change.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/extension-change.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAE/E,wBAAsB,8BAA8B,CAClD,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAKlC;AAED,wBAAsB,2BAA2B,CAC/C,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,qBAAqB,EAAE,GACrC,OAAO,CAAC,IAAI,CAAC,CAKf"}

package/dist/sharing/actions/extension-change.js

@@ -0,0 +1,13 @@
+export async function getExtensionShareChangeTargets(resourceType, resourceId) {
+    if (resourceType !== "extension")
+        return [];
+    const { getExtensionChangeTargets } = await import("../../extensions/store.js");
+    return getExtensionChangeTargets(resourceId);
+}
+export async function notifyExtensionShareChanged(resourceType, resourceId, beforeTargets) {
+    if (resourceType !== "extension")
+        return;
+    const { notifyExtensionChangeForResource } = await import("../../extensions/store.js");
+    await notifyExtensionChangeForResource(resourceId, beforeTargets);
+}
+//# sourceMappingURL=extension-change.js.map

package/dist/sharing/actions/extension-change.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-change.js","sourceRoot":"","sources":["../../../src/sharing/actions/extension-change.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,YAAoB,EACpB,UAAkB;IAElB,IAAI,YAAY,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,EAAE,yBAAyB,EAAE,GACjC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAC5C,OAAO,yBAAyB,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,YAAoB,EACpB,UAAkB,EAClB,aAAsC;IAEtC,IAAI,YAAY,KAAK,WAAW;QAAE,OAAO;IACzC,MAAM,EAAE,gCAAgC,EAAE,GACxC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IAC5C,MAAM,gCAAgC,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACpE,CAAC","sourcesContent":["import type { ExtensionChangeTarget } from \"../../extensions/change-marker.js\";\n\nexport async function getExtensionShareChangeTargets(\n  resourceType: string,\n  resourceId: string,\n): Promise<ExtensionChangeTarget[]> {\n  if (resourceType !== \"extension\") return [];\n  const { getExtensionChangeTargets } =\n    await import(\"../../extensions/store.js\");\n  return getExtensionChangeTargets(resourceId);\n}\n\nexport async function notifyExtensionShareChanged(\n  resourceType: string,\n  resourceId: string,\n  beforeTargets: ExtensionChangeTarget[],\n): Promise<void> {\n  if (resourceType !== \"extension\") return;\n  const { notifyExtensionChangeForResource } =\n    await import(\"../../extensions/store.js\");\n  await notifyExtensionChangeForResource(resourceId, beforeTargets);\n}\n"]}

package/dist/sharing/actions/set-resource-visibility.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-resource-visibility.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/set-resource-visibility.ts"],"names":[],"mappings":";AAOA,wBAmCG"}
+{"version":3,"file":"set-resource-visibility.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/set-resource-visibility.ts"],"names":[],"mappings":";AAWA,wBA4CG"}

package/dist/sharing/actions/set-resource-visibility.js

@@ -4,6 +4,7 @@ import { defineAction } from "../../action.js";
 import { getRequestOrgId } from "../../server/request-context.js";
 import { assertAccess, ForbiddenError } from "../access.js";
 import { requireShareableResource } from "../registry.js";
+import { getExtensionShareChangeTargets, notifyExtensionShareChanged, } from "./extension-change.js";
 export default defineAction({
     description: "Change the coarse visibility of a shareable resource: 'private' | 'org' | 'public'. Owner or admin role required.",
     // (audit H5) Visibility changes are admin-tier and can flip a private
@@ -20,6 +21,7 @@ export default defineAction({
             throw new ForbiddenError(`${reg.displayName} cannot be made public — share with specific people or your organization instead.`);
         }
         const access = await assertAccess(args.resourceType, args.resourceId, "admin");
+        const beforeExtensionTargets = await getExtensionShareChangeTargets(args.resourceType, args.resourceId);
         const db = reg.getDb();
         const update = { visibility: args.visibility };
         const currentOrgId = getRequestOrgId();
@@ -30,6 +32,7 @@ export default defineAction({
             .update(reg.resourceTable)
             .set(update)
             .where(eq(reg.resourceTable.id, args.resourceId));
+        await notifyExtensionShareChanged(args.resourceType, args.resourceId, beforeExtensionTargets);
         return { ok: true, visibility: args.visibility };
     },
 });

package/dist/sharing/actions/set-resource-visibility.js.map

@@ -1 +1 @@
-{"version":3,"file":"set-resource-visibility.js","sourceRoot":"","sources":["../../../src/sharing/actions/set-resource-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,mHAAmH;IACrH,sEAAsE;IACtE,oEAAoE;IACpE,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;KACjD,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC9D,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,mFAAmF,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,MAAM,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACxE,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;YACzE,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC;QAC9B,CAAC;QACD,MAAM,EAAE;aACL,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;aACzB,GAAG,CAAC,MAAM,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACnD,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { eq } from \"drizzle-orm\";\nimport { z } from \"zod\";\nimport { defineAction } from \"../../action.js\";\nimport { getRequestOrgId } from \"../../server/request-context.js\";\nimport { assertAccess, ForbiddenError } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\n\nexport default defineAction({\n  description:\n    \"Change the coarse visibility of a shareable resource: 'private' | 'org' | 'public'. Owner or admin role required.\",\n  // (audit H5) Visibility changes are admin-tier and can flip a private\n  // resource org-wide or public. Refuse from the tools iframe bridge.\n  toolCallable: false,\n  schema: z.object({\n    resourceType: z.string(),\n    resourceId: z.string(),\n    visibility: z.enum([\"private\", \"org\", \"public\"]),\n  }),\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    if (args.visibility === \"public\" && reg.allowPublic === false) {\n      throw new ForbiddenError(\n        `${reg.displayName} cannot be made public — share with specific people or your organization instead.`,\n      );\n    }\n    const access = await assertAccess(\n      args.resourceType,\n      args.resourceId,\n      \"admin\",\n    );\n    const db = reg.getDb() as any;\n    const update: Record<string, unknown> = { visibility: args.visibility };\n    const currentOrgId = getRequestOrgId();\n    if (args.visibility === \"org\" && currentOrgId && !access.resource?.orgId) {\n      update.orgId = currentOrgId;\n    }\n    await db\n      .update(reg.resourceTable)\n      .set(update)\n      .where(eq(reg.resourceTable.id, args.resourceId));\n    return { ok: true, visibility: args.visibility };\n  },\n});\n"]}
+{"version":3,"file":"set-resource-visibility.js","sourceRoot":"","sources":["../../../src/sharing/actions/set-resource-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,mHAAmH;IACrH,sEAAsE;IACtE,oEAAoE;IACpE,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;KACjD,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC9D,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,mFAAmF,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;QACF,MAAM,sBAAsB,GAAG,MAAM,8BAA8B,CACjE,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,MAAM,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACxE,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;YACzE,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC;QAC9B,CAAC;QACD,MAAM,EAAE;aACL,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;aACzB,GAAG,CAAC,MAAM,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACpD,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACnD,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { eq } from \"drizzle-orm\";\nimport { z } from \"zod\";\nimport { defineAction } from \"../../action.js\";\nimport { getRequestOrgId } from \"../../server/request-context.js\";\nimport { assertAccess, ForbiddenError } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\nimport {\n  getExtensionShareChangeTargets,\n  notifyExtensionShareChanged,\n} from \"./extension-change.js\";\n\nexport default defineAction({\n  description:\n    \"Change the coarse visibility of a shareable resource: 'private' | 'org' | 'public'. Owner or admin role required.\",\n  // (audit H5) Visibility changes are admin-tier and can flip a private\n  // resource org-wide or public. Refuse from the tools iframe bridge.\n  toolCallable: false,\n  schema: z.object({\n    resourceType: z.string(),\n    resourceId: z.string(),\n    visibility: z.enum([\"private\", \"org\", \"public\"]),\n  }),\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    if (args.visibility === \"public\" && reg.allowPublic === false) {\n      throw new ForbiddenError(\n        `${reg.displayName} cannot be made public — share with specific people or your organization instead.`,\n      );\n    }\n    const access = await assertAccess(\n      args.resourceType,\n      args.resourceId,\n      \"admin\",\n    );\n    const beforeExtensionTargets = await getExtensionShareChangeTargets(\n      args.resourceType,\n      args.resourceId,\n    );\n    const db = reg.getDb() as any;\n    const update: Record<string, unknown> = { visibility: args.visibility };\n    const currentOrgId = getRequestOrgId();\n    if (args.visibility === \"org\" && currentOrgId && !access.resource?.orgId) {\n      update.orgId = currentOrgId;\n    }\n    await db\n      .update(reg.resourceTable)\n      .set(update)\n      .where(eq(reg.resourceTable.id, args.resourceId));\n    await notifyExtensionShareChanged(\n      args.resourceType,\n      args.resourceId,\n      beforeExtensionTargets,\n    );\n    return { ok: true, visibility: args.visibility };\n  },\n});\n"]}

package/dist/sharing/actions/share-resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"share-resource.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/share-resource.ts"],"names":[],"mappings":"AAWA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAazD;AAwCD,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,SAAwB,GAC7B,MAAM,CAOR;;AAwCD,wBAwJG"}
+{"version":3,"file":"share-resource.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/share-resource.ts"],"names":[],"mappings":"AAeA,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAazD;AAwCD,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,SAAwB,GAC7B,MAAM,CAOR;;AAwCD,wBAsKG"}

package/dist/sharing/actions/share-resource.js

@@ -8,6 +8,7 @@ import { sendEmail, isEmailConfigured } from "../../server/email.js";
 import { renderEmail, emailStrong } from "../../server/email-template.js";
 import { getAppProductionUrl } from "../../server/app-url.js";
 import { getDbExec } from "../../db/client.js";
+import { getExtensionShareChangeTargets, notifyExtensionShareChanged, } from "./extension-change.js";
 export function isSyntheticQaEmail(email) {
     const trimmed = email.trim().toLowerCase();
     const at = trimmed.lastIndexOf("@");
@@ -142,6 +143,7 @@ export default defineAction({
         const actor = getRequestUserEmail();
         if (!actor)
             throw new ForbiddenError("Not signed in");
+        const beforeExtensionTargets = await getExtensionShareChangeTargets(args.resourceType, args.resourceId);
         if (reg.requireOrgMemberForUserShares) {
             const resourceOrgId = access.resource?.orgId;
             if (!resourceOrgId) {
@@ -173,6 +175,7 @@ export default defineAction({
                 .update(reg.sharesTable)
                 .set({ role: args.role })
                 .where(eq(reg.sharesTable.id, existing.id));
+            await notifyExtensionShareChanged(args.resourceType, args.resourceId, beforeExtensionTargets);
             return { id: existing.id, updated: true };
         }
         const id = nanoid();
@@ -185,6 +188,7 @@ export default defineAction({
             createdBy: actor,
             createdAt: new Date().toISOString(),
         });
+        await notifyExtensionShareChanged(args.resourceType, args.resourceId, beforeExtensionTargets);
         if (args.notify !== false &&
             args.principalType === "user" &&
             isEmailConfigured() &&