@agent-native/core 0.157.2 → 0.157.4

package/dist/localization/default-messages.js

@@ -699,6 +699,7 @@ const messages = {
         embedUrl: "Embed URL",
         embedCode: "Embed code",
         copy: "Copy",
+        copied: "Copied",
         role: "Role",
         private: "Private",
         privateDescription: "Only people with access can view",

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
     updated?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
-    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-} | {
     error?: undefined;
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
+    error?: undefined;
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
+    ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    deleted?: undefined;
     id?: undefined;
-    provider?: undefined;
+    message?: undefined;
+    deleted?: undefined;
     providers: {
         id: string;
         label: string;
@@ -88,45 +88,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
+    provider?: undefined;
     found?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
     id?: undefined;
-    providers?: undefined;
+    message?: undefined;
     count?: undefined;
+    deleted?: undefined;
+    providers?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
+    count?: undefined;
     deleted?: undefined;
-    provider?: undefined;
     providers?: undefined;
-    count?: undefined;
+    provider?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    provider?: undefined;
-    providers?: undefined;
+    message?: undefined;
     count?: undefined;
+    providers?: undefined;
+    provider?: undefined;
     found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    count?: undefined;
     deleted?: undefined;
-    provider?: undefined;
     providers?: undefined;
-    count?: undefined;
+    provider?: undefined;
     found?: undefined;
     registered: boolean;
     id: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,9 +311,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        id?: undefined;
-        message?: undefined;
         deleted?: undefined;
+        id?: undefined;
+        provider?: undefined;
         providers: {
             id: string;
             label: string;
@@ -324,45 +324,45 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
-        provider?: undefined;
         found?: undefined;
         registered?: undefined;
         label?: undefined;
-    } | {
-        id?: undefined;
         message?: undefined;
-        count?: undefined;
+    } | {
         deleted?: undefined;
+        id?: undefined;
         providers?: undefined;
+        count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        count?: undefined;
+    } | {
         deleted?: undefined;
-        providers?: undefined;
         provider?: undefined;
+        providers?: undefined;
+        count?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-    } | {
         message?: undefined;
-        count?: undefined;
-        providers?: undefined;
+    } | {
         provider?: undefined;
+        providers?: undefined;
+        count?: undefined;
         found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        count?: undefined;
         deleted?: undefined;
-        providers?: undefined;
         provider?: undefined;
+        providers?: undefined;
+        count?: undefined;
         found?: undefined;
         registered: boolean;
         id: string;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.js

@@ -65,7 +65,7 @@ import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js
 import { readDesktopSso, writeDesktopSso, clearDesktopSso, } from "./desktop-sso.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthDesktopExchangePage, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
-import { isCanonicalAgentNativeAppRequest, isDesktopSsoCanaryUserAgent, isIdentitySsoEnabled, } from "./identity-sso-store.js";
+import { isCanonicalAgentNativeAppRequest, isCanonicalIdentitySsoClientRequest, isDesktopSsoCanaryUserAgent, isIdentitySsoExplicitlyEnabled, } from "./identity-sso-store.js";
 import { ensureCanonicalUserForLegacySession } from "./legacy-auth-migration.js";
 import { encodeMagicLinkSignupAttribution, MAGIC_LINK_ATTRIBUTION_PARAM, } from "./magic-link-attribution.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
@@ -1709,15 +1709,18 @@ function createAuthGuardFn() {
         // 401-for-/_agent-native/*: they resolve / mint the browser session
         // themselves and verify a signature-bound, single-use, CSRF-stated
         // hub token — not a cookie. The handler fails closed with 404 unless
-        // direct web SSO is configured or this is the packaged SSO Canary on a
-        // canonical app origin. Keeping the bypass exact lets that request-scoped
-        // decision happen without exposing any other identity subpath.
+        // direct web SSO is configured or the request is from an exact canonical
+        // hosted app origin. Keeping the bypass exact avoids exposing any other
+        // identity subpath.
         const isIdentitySsoEntryPath = p === "/_agent-native/identity/login" ||
             p === "/_agent-native/identity/callback";
         const isDesktopCanaryIdentityRequest = isDesktopSsoCanaryUserAgent(getHeader(event, "user-agent")) &&
             isCanonicalAgentNativeAppRequest(getHeader(event, "host"), getHeader(event, "x-forwarded-proto"));
+        const isCanonicalHostedIdentityRequest = isCanonicalIdentitySsoClientRequest(getHeader(event, "host"), getHeader(event, "x-forwarded-proto"));
         if (isIdentitySsoEntryPath &&
-            (isIdentitySsoEnabled() || isDesktopCanaryIdentityRequest)) {
+            (isIdentitySsoExplicitlyEnabled() ||
+                isDesktopCanaryIdentityRequest ||
+                isCanonicalHostedIdentityRequest)) {
             return;
         }
         // Internal processor endpoint for the A2A async-mode fanout. Mirrors the

package/dist/server/identity-sso-store.d.ts

@@ -15,17 +15,22 @@
  * development may initialize these tables lazily; production release
  * migrations own their creation before serverless requests are served.
  */
+export declare const CANONICAL_IDENTITY_SSO_HUB_URL = "https://dispatch.agent-native.com";
 export declare const SSO_STATE_TTL_MS: number;
 export declare const SSO_LOGIN_MAX = 60;
 export declare const SSO_LOGIN_WINDOW_MS = 60000;
 export declare function getIdentityHubUrl(): string | undefined;
+export declare function isIdentitySsoExplicitlyEnabled(): boolean;
 export declare function isIdentitySsoEnabled(): boolean;
 export declare function isDesktopSsoCanaryUserAgent(userAgent: string | undefined): boolean;
 export declare function isCanonicalAgentNativeAppOrigin(origin: string | undefined): boolean;
+export declare function isCanonicalIdentitySsoClientOrigin(origin: string | undefined): boolean;
 export declare function isCanonicalAgentNativeAppRequest(host: string | undefined, forwardedProtocol: string | undefined): boolean;
+export declare function isCanonicalIdentitySsoClientRequest(host: string | undefined, forwardedProtocol: string | undefined): boolean;
 /**
  * The conditional login entry is the only browser UI this feature adds. It
- * stays byte-for-byte absent when the direct web federation env is unset.
+ * stays byte-for-byte absent on self-hosted apps; canonical hosted clients
+ * use their exact registered origin as the implicit opt-in.
  */
 export declare function identitySsoLoginButtonHtml(): string;
 export interface CreateSsoStateInput {

package/dist/server/identity-sso-store.js

@@ -20,6 +20,7 @@ import { getDbExec, intType, isConnectionError, isPostgres, isProductionServerle
 import { ensureTableExists } from "../db/ddl-guard.js";
 let _initPromise;
 const DESKTOP_SSO_CANARY_USER_AGENT = /AgentNativeDesktopSsoCanary\//i;
+export const CANONICAL_IDENTITY_SSO_HUB_URL = "https://dispatch.agent-native.com";
 const CANONICAL_IDENTITY_SSO_APP_ORIGINS = new Set([
     "https://analytics.agent-native.com",
     "https://assets.agent-native.com",
@@ -47,28 +48,61 @@ const CLIENT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 const CODE_CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
 const LOCALHOST_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+const CANONICAL_IDENTITY_SSO_CLIENT_ORIGINS = new Set([...CANONICAL_IDENTITY_SSO_APP_ORIGINS].filter((origin) => origin !== CANONICAL_IDENTITY_SSO_HUB_URL));
 // ---------------------------------------------------------------------------
 // Feature switch — this module is intentionally dependency-light because the
 // auth guard and the route handler both import the same pure switch.
 // ---------------------------------------------------------------------------
+function configuredAppOrigin() {
+    for (const raw of [
+        process.env.APP_URL,
+        process.env.BETTER_AUTH_URL,
+        process.env.VITE_APP_URL,
+        process.env.VITE_BETTER_AUTH_URL,
+        process.env.URL,
+        process.env.DEPLOY_PRIME_URL,
+        process.env.DEPLOY_URL,
+    ]) {
+        const value = raw?.trim();
+        if (!value)
+            continue;
+        try {
+            const url = new URL(value);
+            return `${url.protocol}//${url.host}${url.pathname}`.replace(/\/+$/, "");
+        }
+        catch (error) {
+            void error;
+        }
+    }
+    return undefined;
+}
 export function getIdentityHubUrl() {
     const raw = process.env.AGENT_NATIVE_IDENTITY_HUB_URL?.trim();
-    if (!raw)
-        return undefined;
-    try {
-        const u = new URL(raw);
-        if (u.protocol !== "https:" &&
-            !(u.protocol === "http:" && LOCALHOST_HOSTS.has(u.hostname))) {
-            return undefined;
+    if (raw) {
+        try {
+            const u = new URL(raw);
+            if (u.protocol !== "https:" &&
+                !(u.protocol === "http:" && LOCALHOST_HOSTS.has(u.hostname))) {
+                return undefined;
+            }
+            if (u.username || u.password || u.search || u.hash)
+                return undefined;
+            return `${u.protocol}//${u.host}${u.pathname}`.replace(/\/+$/, "");
         }
-        if (u.username || u.password || u.search || u.hash)
+        catch (error) {
+            void error;
             return undefined;
-        return `${u.protocol}//${u.host}${u.pathname}`.replace(/\/+$/, "");
-    }
-    catch (error) {
-        void error;
-        return undefined;
+        }
     }
+    // Canonical hosted apps are all registered with Dispatch already. Keep
+    // self-hosted deployments opt-in, and never make Dispatch federate to itself.
+    const appOrigin = configuredAppOrigin();
+    return isCanonicalIdentitySsoClientOrigin(appOrigin)
+        ? CANONICAL_IDENTITY_SSO_HUB_URL
+        : undefined;
+}
+export function isIdentitySsoExplicitlyEnabled() {
+    return Boolean(process.env.AGENT_NATIVE_IDENTITY_HUB_URL?.trim() && getIdentityHubUrl());
 }
 export function isIdentitySsoEnabled() {
     return !!getIdentityHubUrl();
@@ -94,14 +128,23 @@ export function isCanonicalAgentNativeAppOrigin(origin) {
         return false;
     }
 }
+export function isCanonicalIdentitySsoClientOrigin(origin) {
+    return Boolean(origin && CANONICAL_IDENTITY_SSO_CLIENT_ORIGINS.has(origin));
+}
 export function isCanonicalAgentNativeAppRequest(host, forwardedProtocol) {
     if (!host || forwardedProtocol !== "https")
         return false;
     return isCanonicalAgentNativeAppOrigin(`https://${host}`);
 }
+export function isCanonicalIdentitySsoClientRequest(host, forwardedProtocol) {
+    if (!host || forwardedProtocol !== "https")
+        return false;
+    return isCanonicalIdentitySsoClientOrigin(`https://${host}`);
+}
 /**
  * The conditional login entry is the only browser UI this feature adds. It
- * stays byte-for-byte absent when the direct web federation env is unset.
+ * stays byte-for-byte absent on self-hosted apps; canonical hosted clients
+ * use their exact registered origin as the implicit opt-in.
  */
 export function identitySsoLoginButtonHtml() {
     if (!isIdentitySsoEnabled())

package/dist/server/identity-sso.d.ts

@@ -7,11 +7,10 @@
  * callback-scoped cookie and redeems the code server-to-server. Only that
  * server-to-server response may contain the signed identity assertion.
  *
- * Direct browser federation remains opt-in through
- * `AGENT_NATIVE_IDENTITY_HUB_URL`. The packaged Desktop Canary may use the
- * canonical Dispatch authority on canonical app origins, as established by
- * the merged feature-flagged Desktop work. This module does not change the
- * Desktop implementation or any ordinary auth surface.
+ * Direct browser federation uses the canonical Dispatch authority for exact
+ * first-party hosted app origins and remains opt-in through
+ * `AGENT_NATIVE_IDENTITY_HUB_URL` for self-hosted deployments. The packaged
+ * Desktop Canary follows the same canonical-origin boundary.
  */
 import type { H3Event } from "h3";
 import { getIdentityHubUrl, identitySsoLoginButtonHtml, isIdentitySsoEnabled } from "./identity-sso-store.js";
@@ -22,9 +21,9 @@ export declare const IDENTITY_SSO_DESKTOP_COMPLETE_PATH = "/_agent-native/identi
 export declare const IDENTITY_SSO_CALLBACK_PATH = "/_agent-native/identity/callback";
 export declare const IDENTITY_SSO_TOKEN_PATH = "/_agent-native/identity/token";
 /**
- * The packaged Desktop SSO Canary may use Dispatch without each canonical app
- * deploying the direct-web hub env. Ordinary browsers and self-hosted apps
- * remain strictly env-gated.
+ * Canonical hosted apps may use Dispatch without per-app hub configuration.
+ * Self-hosted apps remain strictly env-gated. The exact-origin check is kept
+ * request-scoped so a missing deployment URL cannot broaden the trust set.
  */
 export declare function resolveIdentityHubUrl(event: H3Event): string | undefined;
 export declare function handleIdentitySso(event: H3Event, subpath: string): Promise<Response>;

package/dist/server/identity-sso.js

@@ -7,11 +7,10 @@
  * callback-scoped cookie and redeems the code server-to-server. Only that
  * server-to-server response may contain the signed identity assertion.
  *
- * Direct browser federation remains opt-in through
- * `AGENT_NATIVE_IDENTITY_HUB_URL`. The packaged Desktop Canary may use the
- * canonical Dispatch authority on canonical app origins, as established by
- * the merged feature-flagged Desktop work. This module does not change the
- * Desktop implementation or any ordinary auth surface.
+ * Direct browser federation uses the canonical Dispatch authority for exact
+ * first-party hosted app origins and remains opt-in through
+ * `AGENT_NATIVE_IDENTITY_HUB_URL` for self-hosted deployments. The packaged
+ * Desktop Canary follows the same canonical-origin boundary.
  */
 import { createHash, randomBytes } from "node:crypto";
 import { deleteCookie, getCookie, getHeader, getMethod, setCookie } from "h3";
@@ -22,7 +21,7 @@ import { getAppName } from "./app-name.js";
 import { getSession, isExpectedAuthFailure, safeReturnPath } from "./auth.js";
 import { getBetterAuth, getBetterAuthInternalAdapter, } from "./better-auth-instance.js";
 import { createOAuthSession, getOrigin } from "./google-oauth.js";
-import { consumeSsoState, createSsoState, getIdentityHubUrl, identitySsoLoginButtonHtml, isCanonicalAgentNativeAppRequest, isDesktopSsoCanaryUserAgent, isIdentitySsoEnabled, isJtiReplayed, SSO_STATE_TTL_MS, } from "./identity-sso-store.js";
+import { consumeSsoState, createSsoState, CANONICAL_IDENTITY_SSO_HUB_URL, getIdentityHubUrl, identitySsoLoginButtonHtml, isCanonicalAgentNativeAppRequest, isCanonicalIdentitySsoClientRequest, isDesktopSsoCanaryUserAgent, isIdentitySsoExplicitlyEnabled, isIdentitySsoEnabled, isJtiReplayed, SSO_STATE_TTL_MS, } from "./identity-sso-store.js";
 export { getIdentityHubUrl, identitySsoLoginButtonHtml, isIdentitySsoEnabled };
 export const IDENTITY_SSO_PROVIDER_ID = "agent-native";
 export const IDENTITY_SSO_SCOPE = "identity";
@@ -33,7 +32,6 @@ const DESKTOP_COMPLETION_NONCE = /^[A-Za-z0-9_-]{32,128}$/;
 const STATE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 const CODE = /^[A-Za-z0-9_-]{43}$/;
 const CODE_VERIFIER = /^[A-Za-z0-9._~-]{43,128}$/;
-const DESKTOP_IDENTITY_HUB_URL = "https://dispatch.agent-native.com";
 const SSO_VERIFIER_COOKIE_PREFIX = "agent_native_sso_verifier_";
 const MAX_ASSERTION_AGE_SECONDS = 5 * 60;
 const LOCALHOST_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
@@ -153,14 +151,19 @@ function resolveClientBinding(event, hub) {
     return { appId, clientId, redirectUri, authority };
 }
 /**
- * The packaged Desktop SSO Canary may use Dispatch without each canonical app
- * deploying the direct-web hub env. Ordinary browsers and self-hosted apps
- * remain strictly env-gated.
+ * Canonical hosted apps may use Dispatch without per-app hub configuration.
+ * Self-hosted apps remain strictly env-gated. The exact-origin check is kept
+ * request-scoped so a missing deployment URL cannot broaden the trust set.
  */
 export function resolveIdentityHubUrl(event) {
-    const configured = getIdentityHubUrl();
+    const configured = isIdentitySsoExplicitlyEnabled()
+        ? getIdentityHubUrl()
+        : undefined;
     if (configured)
         return configured;
+    if (isCanonicalIdentitySsoClientRequest(getHeader(event, "host"), getHeader(event, "x-forwarded-proto"))) {
+        return CANONICAL_IDENTITY_SSO_HUB_URL;
+    }
     if (!isDesktopSsoCanaryUserAgent(getHeader(event, "user-agent"))) {
         return undefined;
     }
@@ -168,7 +171,7 @@ export function resolveIdentityHubUrl(event) {
         if (!isCanonicalAgentNativeAppRequest(getHeader(event, "host"), getHeader(event, "x-forwarded-proto"))) {
             return undefined;
         }
-        return DESKTOP_IDENTITY_HUB_URL;
+        return CANONICAL_IDENTITY_SSO_HUB_URL;
     }
     catch (error) {
         void error;

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -11,11 +11,13 @@ declare const _default: import("../../action.js").ActionDefinition<{
     };
     orgId?: undefined;
     role?: undefined;
+    agentReadable?: undefined;
 } | {
     ownerEmail: string;
     orgId: string;
     visibility: import("../schema.js").Visibility;
     role: "owner" | import("../schema.js").ShareRole;
+    agentReadable: boolean;
     shares: any;
     policy: {
         allowPublic: boolean;

package/dist/sharing/actions/list-resource-shares.js

@@ -60,6 +60,7 @@ export default defineAction({
             orgId: access.resource.orgId ?? null,
             visibility: access.resource.visibility ?? "private",
             role: access.role,
+            agentReadable: Boolean(reg.agentReadable),
             shares: shares.map((s) => ({
                 id: s.id,
                 principalType: s.principalType,

package/dist/sharing/schema.d.ts

@@ -160,7 +160,7 @@ export declare function createSharesTable(tableName: string): import("drizzle-or
             data: string;
             driverParam: string;
             notNull: true;
-            hasDefault: false;
+            hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;

package/dist/sharing/schema.js

@@ -73,7 +73,10 @@ export function createSharesTable(tableName) {
         })
             .notNull()
             .default("viewer"),
-        createdBy: text("created_by").notNull(),
+        // Older app databases may already contain share rows from before this
+        // audit field existed. A literal default lets additive schema repair add
+        // the column without inventing an actor for those historical rows.
+        createdBy: text("created_by").notNull().default(""),
         createdAt: text("created_at").notNull().default(now()),
     });
 }

package/dist/templates/chat/.agents/skills/agent-native-toolkit/SKILL.md

@@ -182,6 +182,11 @@ in the moment of agent use.
   five-item sidebar preview and a footer row with New chat followed by an
   ellipsis disclosure up to fifteen. Apps inject routing, labels, and domain
   actions.
+- **Data grid kit**: provider-agnostic spreadsheet mechanics belong in
+  `@agent-native/toolkit/data-grid`. Apps provide rows, typed columns, editor
+  slots, selection and width state, persistence callbacks, and product-level
+  row/body slots. Keep database models, access checks, grouping, drag/drop,
+  and domain actions in the app adapter.
 - **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
   `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
   Access tabs plus a Personal/Organization scope toggle. The canonical home

package/dist/templates/chat/.agents/skills/sharing/SKILL.md

@@ -184,6 +184,27 @@ import { ShareButton } from "@agent-native/core/client/sharing";
 
 For list views, show `<VisibilityBadge visibility={row.visibility} />` next to each resource.
 
+## Standard share surface
+
+All app share popovers should use the same compact surface contract:
+
+- Use the text-only `ShareTrigger` from `@agent-native/toolkit/sharing`.
+- Render ordinary links with `ShareCopyRow`, which exposes a Copy action without
+  printing the raw URL.
+- Keep general access and individual people access in the standard Core sharing
+  flow. The people flow supports email invites, roles, notifications, and
+  removal through the shared share actions.
+- Add `ShareAgentsSection` only when the resource has a real agent-readable
+  link or prompt. Keep it collapsed by default and supply domain-specific
+  content through the shared section shell.
+- App-specific tabs or controls may remain when they represent a real domain
+  action (for example, an embed-code editor), but they should retain the same
+  trigger, copy-row, access, and spacing language.
+
+`ShareDisclosureSection` is the toolkit-owned shell for optional expandable
+share details; use its `ShareAgentsSection` or `SharePeopleSection` wrappers
+instead of creating another collapsible share panel in a template.
+
 ## Actions available everywhere
 
 The framework auto-mounts these actions in every template — no per-template boilerplate:

package/dist/templates/default/.agents/skills/agent-native-toolkit/SKILL.md

@@ -182,6 +182,11 @@ in the moment of agent use.
   five-item sidebar preview and a footer row with New chat followed by an
   ellipsis disclosure up to fifteen. Apps inject routing, labels, and domain
   actions.
+- **Data grid kit**: provider-agnostic spreadsheet mechanics belong in
+  `@agent-native/toolkit/data-grid`. Apps provide rows, typed columns, editor
+  slots, selection and width state, persistence callbacks, and product-level
+  row/body slots. Keep database models, access checks, grouping, drag/drop,
+  and domain actions in the app adapter.
 - **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
   `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
   Access tabs plus a Personal/Organization scope toggle. The canonical home