@agent-native/core 0.161.23 → 0.163.0

package/dist/provider-api/index.js

@@ -991,6 +991,11 @@ const PROVIDER_CONFIGS = {
         id: "slack",
         label: "Slack Web API",
         defaultBaseUrl: "https://slack.com/api",
+        // Slack answers every call with HTTP 200, success or failure — see
+        // bodyOkField's doc comment. Without this, a rejected chat.postMessage
+        // (not_in_channel, channel_not_found, msg_too_long, …) looks identical to
+        // a delivered one at the transport level.
+        bodyOkField: "ok",
         auth: {
             type: "bearer",
             keys: ["SLACK_BOT_TOKEN"],
@@ -1301,7 +1306,7 @@ export async function executeProviderApiRequest(args, runtime) {
                 body: pageBody,
                 headers,
             });
-            const resp = await fetchWithTimeout(pageUrl.href, {
+            const resp = applyBodyEnvelopeOutcome(await fetchWithTimeout(pageUrl.href, {
                 method,
                 headers,
                 body: pageBody,
@@ -1315,7 +1320,7 @@ export async function executeProviderApiRequest(args, runtime) {
                     target: describeProviderRequestTarget(pageUrl.href, auth.secretValues),
                     requestKey,
                 },
-            });
+            }), config);
             return {
                 text: resp.text ??
                     (resp.json !== undefined ? JSON.stringify(resp.json) : ""),
@@ -1347,7 +1352,7 @@ export async function executeProviderApiRequest(args, runtime) {
         body,
         headers,
     });
-    const response = await fetchWithTimeout(url.href, {
+    const response = applyBodyEnvelopeOutcome(await fetchWithTimeout(url.href, {
         method,
         headers,
         body,
@@ -1361,12 +1366,12 @@ export async function executeProviderApiRequest(args, runtime) {
             target: describeProviderRequestTarget(url.href, auth.secretValues),
             requestKey,
         },
-    });
+    }), config);
     // saveToFile: write full body to workspace file and return compact summary.
     if (args.saveToFile) {
         const rawText = response.text ??
             (response.json !== undefined ? JSON.stringify(response.json) : "");
-        const saved = (await handleSaveToFile(args.saveToFile, rawText, response.contentType, response.status));
+        const saved = (await handleSaveToFile(args.saveToFile, rawText, response.contentType, response.status, response.ok));
         return {
             provider: { id: config.id, label: config.label },
             request: {
@@ -2119,7 +2124,7 @@ async function executeCustomProviderApiRequest(args, customConfig, runtime) {
     if (args.saveToFile) {
         const rawText = response.text ??
             (response.json !== undefined ? JSON.stringify(response.json) : "");
-        const saved = (await handleSaveToFile(args.saveToFile, rawText, response.contentType, response.status));
+        const saved = (await handleSaveToFile(args.saveToFile, rawText, response.contentType, response.status, response.ok));
         return {
             provider: {
                 id: customConfig.id,
@@ -3817,6 +3822,31 @@ function providerQuotaExhaustedResponse(detail) {
         },
     };
 }
+/**
+ * Flip transport-level `ok` to `false` when the provider's own success field
+ * (config.bodyOkField) says the call failed. See ProviderApiConfig's
+ * bodyOkField doc comment: Slack answers every request with HTTP 200, so
+ * without this a rejected send is indistinguishable from a delivered one to
+ * any caller — including the agent — that trusts `response.ok`.
+ */
+function applyBodyEnvelopeOutcome(response, config) {
+    const field = config.bodyOkField;
+    if (!field || !response.ok)
+        return response;
+    const body = response.json;
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        return response;
+    if (body[field] !== false)
+        return response;
+    const error = stringOrNull(body.error);
+    return {
+        ...response,
+        ok: false,
+        statusText: error
+            ? `${response.statusText} (${config.label} reported ${field}: false — ${error})`
+            : `${response.statusText} (${config.label} reported ${field}: false)`,
+    };
+}
 async function fetchProviderResponse(url, fetchOptions, options) {
     const startedAt = Date.now();
     const res = await fetch(url, fetchOptions);
@@ -4000,8 +4030,8 @@ function dotGet(obj, path) {
  * Handle saveToFile: write the full provider-api response body to a workspace
  * file and return a compact summary.
  */
-async function handleSaveToFile(filePath, responseText, contentType, status) {
-    const { writeWorkspaceFile, SAVE_TO_FILE_MAX_BYTES: maxSaveBytes } = await import("../workspace-files/store.js");
+async function handleSaveToFile(filePath, responseText, contentType, status, ok = true) {
+    const { writeWorkspaceFile, SAVE_TO_FILE_MAX_BYTES: maxSaveBytes, isScratchWorkspacePath, toWorkspaceFileCard, } = await import("../workspace-files/store.js");
     const { getRequestOrgId, getRequestUserEmail } = await import("../server/request-context.js");
     const orgId = getRequestOrgId();
     const email = getRequestUserEmail();
@@ -4014,7 +4044,7 @@ async function handleSaveToFile(filePath, responseText, contentType, status) {
         throw new Error("saveToFile requires an authenticated request context (no user email or orgId found).");
     }
     const mimeType = contentType?.split(";")[0].trim() ?? "text/plain";
-    await writeWorkspaceFile(scope, filePath, responseText, mimeType, {
+    const meta = await writeWorkspaceFile(scope, filePath, responseText, mimeType, {
         maxFileBytes: maxSaveBytes,
     });
     const bytes = Buffer.byteLength(responseText, "utf8");
@@ -4023,9 +4053,15 @@ async function handleSaveToFile(filePath, responseText, contentType, status) {
         savedToFile: true,
         savedTo: filePath,
         status,
+        ok,
         bytes,
         contentType: mimeType,
         preview: preview.length < responseText.length ? `${preview}…` : preview,
+        // A durable (non-scratch) file renders a download card the moment it's
+        // created — no separate show-workspace-file call needed to get a link.
+        ...(isScratchWorkspacePath(filePath)
+            ? {}
+            : { file: toWorkspaceFileCard(meta) }),
     };
 }
 /**

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import { defineEventHandler, getMethod, getQuery, getRequestIP, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, getHeader, } from "h3";
 import { getAppConfig } from "../app-config/index.js";
+import { isWorkspaceAppAccessAllowed } from "../org/workspace-app-access.js";
 import { EMBED_START_PATH } from "../shared/embed-auth.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import { FIRST_RUN_ONBOARDING_COOKIE, FIRST_RUN_ONBOARDING_MAX_AGE, } from "../shared/first-run-onboarding.js";
@@ -636,9 +637,16 @@ async function ensureEmailVerifiedForRedirect(request, response) {
             args: [email],
         });
     }
-    catch {
-        // Better Auth already handled the verification route. This repair is
-        // best-effort so response cookies/redirects are never lost to DB noise.
+    catch (error) {
+        // Better Auth already handled the verification route, so this repair
+        // staying best-effort (never blocking the response) is correct. But a
+        // failure here must never be silent: "repair didn't run" and "there was
+        // nothing to repair" are the same observable outcome to a caller unless
+        // this is logged, which is exactly the shape of "clicked the verify
+        // link, login still says not verified" (Slack C0ATH3CCZT4, reported
+        // 2026-07-31 and 2026-08-05) — this UPDATE is the only place that would
+        // show whether Better Auth's own write is failing too.
+        captureAuthError(error, { route: "verify-email", email });
     }
 }
 async function emailFromVerificationResponseSession(response) {
@@ -2163,8 +2171,20 @@ function createAuthGuardFn(app) {
             return;
         }
         const session = await getSession(event);
-        if (session)
+        if (session) {
+            const workspaceAppId = getAppConfig().app.workspaceId?.trim() || "";
+            if (workspaceAppId &&
+                workspaceAppId !== "dispatch" &&
+                (p.startsWith("/api/") || p.startsWith("/_agent-native/")) &&
+                !(await isWorkspaceAppAccessAllowed(workspaceAppId, {
+                    email: session.email,
+                    orgId: session.orgId,
+                }))) {
+                setResponseStatus(event, 403);
+                return { error: "You do not have access to this workspace app." };
+            }
             return;
+        }
         if (p.startsWith("/api/") || p.startsWith("/_agent-native/")) {
             setResponseStatus(event, 401);
             return { error: "Unauthorized" };

package/dist/server/poll.js

@@ -231,6 +231,12 @@ function extensionTargetsForRow(row, shareRows) {
         else if (principalType === "org" && principalId) {
             addExtensionTarget(targets, { orgId: principalId });
         }
+        else if (principalType === "group" && orgId) {
+            // Group membership is org-scoped. Invalidating the org target is a
+            // conservative fallback that keeps group-share changes fresh for every
+            // member without making the poll layer own group-directory queries.
+            addExtensionTarget(targets, { orgId });
+        }
     }
     return Array.from(targets.values());
 }
@@ -1506,11 +1512,15 @@ export class AppSyncState {
             // marker rows back into extension-source events for targeted client
             // invalidation while preserving user/org scope.
             if (extensionMarkerTs > this.lastExtensionMarkerTs) {
+                // Bound the scan by the watermark instead of reading every marker row
+                // ever written and filtering in memory: this table keeps one row per
+                // session that has ever mutated an extension, so the unbounded read
+                // grows with lifetime users rather than with pending work.
                 const extensionMarkerResult = await db.execute({
-                    sql: "SELECT session_id, value, updated_at FROM application_state WHERE key = ? ORDER BY updated_at ASC",
-                    args: [EXTENSION_CHANGE_MARKER_KEY],
+                    sql: "SELECT session_id, value, updated_at FROM application_state WHERE key = ? AND updated_at > ? ORDER BY updated_at ASC",
+                    args: [EXTENSION_CHANGE_MARKER_KEY, this.lastExtensionMarkerTs],
                 });
-                const changedExtensionMarkers = extensionMarkerResult.rows.filter((row) => timestampValue(row.updated_at) > this.lastExtensionMarkerTs);
+                const changedExtensionMarkers = extensionMarkerResult.rows;
                 if (this.lastExtensionMarkerTs > 0) {
                     this.recordExtensionChanges(changedExtensionMarkers
                         .map((row) => parseExtensionChangeMarker(row.session_id, row.value))

package/dist/server/sentry.d.ts

@@ -57,7 +57,7 @@ export declare function setSentryRequestContext(ctx: {
  * this just records the error for observability.
  */
 export declare function captureAuthError(error: unknown, context: {
-    route: "login" | "signup" | "logout" | "magic-link";
+    route: "login" | "signup" | "logout" | "magic-link" | "verify-email";
     email?: string;
 }): string | undefined;
 export interface RouteErrorContext {

package/dist/sharing/access.d.ts

@@ -5,8 +5,8 @@
  * 1. Direct ownership — `owner_email = currentUser`.
  * 2. Visibility — `'private' | 'org' | 'public'`. `org` grants read to anyone
  *    in the same org; `public` grants read to any authenticated user.
- * 3. Share rows — per-user or per-org grants in the `{type}_shares` table
- *    with a role (`viewer | commenter | editor | admin`).
+ * 3. Share rows — per-user, per-group, or per-org grants in the
+ *    `{type}_shares` table with a role (`viewer | commenter | editor | admin`).
  *
  * Use `applyAccessFilter()` on list/read queries to filter rows the current
  * user can see. Use `assertAccess()` at the top of write actions to reject

package/dist/sharing/access.js

@@ -5,16 +5,18 @@
  * 1. Direct ownership — `owner_email = currentUser`.
  * 2. Visibility — `'private' | 'org' | 'public'`. `org` grants read to anyone
  *    in the same org; `public` grants read to any authenticated user.
- * 3. Share rows — per-user or per-org grants in the `{type}_shares` table
- *    with a role (`viewer | commenter | editor | admin`).
+ * 3. Share rows — per-user, per-group, or per-org grants in the
+ *    `{type}_shares` table with a role (`viewer | commenter | editor | admin`).
  *
  * Use `applyAccessFilter()` on list/read queries to filter rows the current
  * user can see. Use `assertAccess()` at the top of write actions to reject
  * callers who lack the required role.
  */
 import { and, eq, or, sql } from "drizzle-orm";
+import { isPostgres } from "../db/client.js";
 import { orgMembers } from "../org/schema.js";
 import { getRequestAuthCapability, getRequestUserEmail, getRequestOrgId, } from "../server/request-context.js";
+import { workspaceUserGroupsIncludeUser, workspaceUserGroupsTable, } from "../workspace-connections/groups.js";
 import { listShareableResources, requireShareableResource, } from "./registry.js";
 import { ROLE_RANK } from "./schema.js";
 /**
@@ -140,6 +142,38 @@ export function accessFilter(resourceTable, sharesTable, rawCtx = currentAccess(
                     and ${shareScope}
                     and ${minRoleSql(minRole)})`);
     }
+    if (reg?.supportsGroupShares && normalizedUserEmail && orgId) {
+        const groupTable = sql.raw(workspaceUserGroupsTable());
+        const groupMemberPredicate = isPostgres()
+            ? sql `exists (
+          select 1
+          from jsonb_array_elements_text(
+            workspace_group.member_emails_json::jsonb
+          ) as group_member(email)
+          where lower(group_member.email) = ${normalizedUserEmail}
+        )`
+            : sql `exists (
+          select 1
+          from json_each(workspace_group.member_emails_json) as group_member
+          where lower(group_member.value) = ${normalizedUserEmail}
+        )`;
+        clauses.push(sql `exists (select 1 from ${sharesTable}
+                  where ${sharesTable.resourceId} = ${resourceTable.id}
+                    and ${sharesTable.principalType} = 'group'
+                    and ${minRoleSql(minRole)}
+                    and exists (
+                      select 1 from ${groupTable} as workspace_group
+                      where workspace_group.id = ${sharesTable.principalId}
+                        and workspace_group.org_id = ${resourceTable.orgId}
+                        and workspace_group.org_id = ${orgId}
+                        and exists (
+                          select 1 from ${orgMembers} as workspace_member
+                          where workspace_member.org_id = workspace_group.org_id
+                            and lower(workspace_member.email) = ${normalizedUserEmail}
+                        )
+                        and ${groupMemberPredicate}
+                    ))`);
+    }
     return or(...clauses) ?? sql `1=0`;
 }
 function ownerScopeFilter(reg, resourceTable, ctx) {
@@ -314,6 +348,9 @@ async function resolveAccessImpl(resourceType, resourceId, rawCtx = currentAcces
         ownerMatchesActiveScope(reg, resource, ctx)) {
         return { role: "owner", resource };
     }
+    if (reg.canManageAccess && (await reg.canManageAccess(resource, ctx))) {
+        return { role: "admin", resource };
+    }
     if (resource.visibility === "public" && reg.allowPublic !== false) {
         // No share row needed; default viewer unless the resource registration
         // deliberately grants a stronger public-by-link role or explicit shares
@@ -359,12 +396,28 @@ async function highestShareRole(reg, resourceId, ctx, resource) {
     if (orgId) {
         principalClauses.push(and(eq(reg.sharesTable.principalType, "org"), eq(reg.sharesTable.principalId, orgId)));
     }
+    let best = null;
+    if (reg.supportsGroupShares && normalizedUserEmail && resource.orgId) {
+        const groupRows = await db
+            .select({
+            principalId: reg.sharesTable.principalId,
+            role: reg.sharesTable.role,
+        })
+            .from(reg.sharesTable)
+            .where(and(eq(reg.sharesTable.resourceId, resourceId), eq(reg.sharesTable.principalType, "group")));
+        for (const row of groupRows) {
+            if (await workspaceUserGroupsIncludeUser(resource.orgId, [row.principalId], normalizedUserEmail)) {
+                if (!best || ROLE_RANK[row.role] > ROLE_RANK[best]) {
+                    best = row.role;
+                }
+            }
+        }
+    }
     const rows = await db
         .select({ role: reg.sharesTable.role })
         .from(reg.sharesTable)
         .where(and(eq(reg.sharesTable.resourceId, resourceId), or(...principalClauses)))
         .limit(10);
-    let best = null;
     for (const r of rows) {
         if (!best || ROLE_RANK[r.role] > ROLE_RANK[best])
             best = r.role;

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -8,6 +8,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     policy: {
         allowPublic: boolean;
         requireOrgMemberForUserShares: boolean;
+        supportsGroupShares?: boolean;
     };
     orgId?: undefined;
     role?: undefined;
@@ -22,6 +23,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     policy: {
         allowPublic: boolean;
         requireOrgMemberForUserShares: boolean;
+        supportsGroupShares?: boolean;
     };
 }>;
 export default _default;

package/dist/sharing/actions/list-resource-shares.js

@@ -2,6 +2,7 @@ import { eq, inArray } from "drizzle-orm";
 import { z } from "zod";
 import { defineAction } from "../../action.js";
 import { organizations } from "../../org/schema.js";
+import { listWorkspaceUserGroupsForOrg } from "../../workspace-connections/groups.js";
 import { resolveAccess } from "../access.js";
 import { requireShareableResource } from "../registry.js";
 async function loadOrgDisplayNames(db, shares) {
@@ -28,6 +29,24 @@ async function loadOrgDisplayNames(db, shares) {
         return new Map();
     }
 }
+async function loadGroupDisplayNames(orgId, shares) {
+    const groupIds = Array.from(new Set(shares
+        .filter((share) => share.principalType === "group" && share.principalId)
+        .map((share) => share.principalId)));
+    if (!groupIds.length || !orgId)
+        return new Map();
+    try {
+        const groups = await listWorkspaceUserGroupsForOrg(orgId, groupIds);
+        return new Map(groups.flatMap((group) => {
+            const id = group.id;
+            const name = group.name.trim();
+            return id && name ? [[id, name]] : [];
+        }));
+    }
+    catch {
+        return new Map();
+    }
+}
 export default defineAction({
     description: "List the current visibility and share grants on a shareable resource. Any read access is sufficient.",
     schema: z.object({
@@ -42,6 +61,9 @@ export default defineAction({
             // resources that haven't opted into restrictions.
             allowPublic: reg.allowPublic !== false,
             requireOrgMemberForUserShares: reg.requireOrgMemberForUserShares === true,
+            ...(reg.supportsGroupShares === true
+                ? { supportsGroupShares: true }
+                : {}),
         };
         // Only `ownerEmail`/`orgId`/`visibility` are read below, all of which the
         // projected load carries — so the share dialog never pulls a resource's
@@ -55,6 +77,7 @@ export default defineAction({
             .from(reg.sharesTable)
             .where(eq(reg.sharesTable.resourceId, args.resourceId));
         const orgDisplayNames = await loadOrgDisplayNames(db, shares);
+        const groupDisplayNames = await loadGroupDisplayNames(access.resource.orgId, shares);
         return {
             ownerEmail: access.resource.ownerEmail ?? null,
             orgId: access.resource.orgId ?? null,
@@ -67,7 +90,9 @@ export default defineAction({
                 principalId: s.principalId,
                 displayName: s.principalType === "org"
                     ? orgDisplayNames.get(s.principalId)
-                    : undefined,
+                    : s.principalType === "group"
+                        ? groupDisplayNames.get(s.principalId)
+                        : undefined,
                 role: s.role,
                 createdAt: s.createdAt,
             })),

package/dist/sharing/actions/share-resource.d.ts

@@ -3,7 +3,7 @@ export declare function resolveShareNotificationUrl(explicitUrl: string | undefi
 declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
-    principalType: "org" | "user";
+    principalType: "group" | "org" | "user";
     principalId: string;
     role?: "admin" | "commenter" | "editor" | "viewer";
     notify?: boolean;

package/dist/sharing/actions/share-resource.js

@@ -8,6 +8,7 @@ import { sendEmail, isEmailConfigured } from "../../server/email.js";
 import { invalidateCollabAccessCache } from "../../server/poll.js";
 import { getRequestUserEmail } from "../../server/request-context.js";
 import { getUserProfile } from "../../user-profile/store.js";
+import { assertWorkspaceUserGroupIds } from "../../workspace-connections/groups.js";
 import { assertAccess, ForbiddenError } from "../access.js";
 import { requireShareableResource } from "../registry.js";
 import { getExtensionShareChangeTargets, notifyExtensionShareChanged, } from "./extension-change.js";
@@ -122,7 +123,7 @@ async function isOrgMemberOrInvited(orgId, email) {
     return invited.rows.length > 0;
 }
 export default defineAction({
-    description: "Grant a user or org access to a shareable resource. Owner or admin role required.",
+    description: "Grant a user, group, or org access to a shareable resource. Owner or admin role required.",
     // (audit H5) Sharing-grant operations are admin-tier and let a caller
     // expand who can read/write a resource. Refuse from the tools iframe
     // bridge so a malicious shared tool can't silently re-share its
@@ -134,11 +135,11 @@ export default defineAction({
             .describe("Registered resource type, e.g. 'document', 'form'."),
         resourceId: z.string().describe("Id of the resource to share."),
         principalType: z
-            .enum(["user", "org"])
-            .describe("'user' for an individual, 'org' for a whole organization."),
+            .enum(["user", "group", "org"])
+            .describe("'user' for an individual, 'group' for an organization group, or 'org' for the whole organization."),
         principalId: z
             .string()
-            .describe("Email (user) or org id (org) of the principal."),
+            .describe("Email (user), group id (group), or org id (org) of the principal."),
         role: z
             .enum(["viewer", "commenter", "editor", "admin"])
             .default("viewer")
@@ -165,9 +166,24 @@ export default defineAction({
         if (!actor)
             throw new ForbiddenError("Not signed in");
         const principalId = normalizePrincipalId(args.principalType, args.principalId);
+        if (args.principalType === "group" && reg.supportsGroupShares !== true) {
+            throw new ForbiddenError(`${reg.displayName} does not support organization groups yet.`);
+        }
         if (args.principalType === "user" && !isEmailPrincipalId(principalId)) {
             throw new Error("User shares must use an email address, not an internal user id.");
         }
+        if (args.principalType === "group") {
+            const resourceOrgId = access.resource?.orgId;
+            if (!resourceOrgId) {
+                throw new ForbiddenError(`${reg.displayName} can only be shared with a group from within an organization.`);
+            }
+            try {
+                await assertWorkspaceUserGroupIds([principalId], resourceOrgId);
+            }
+            catch {
+                throw new ForbiddenError(`${reg.displayName} can only be shared with a group from its own organization.`);
+            }
+        }
         const beforeExtensionTargets = await getExtensionShareChangeTargets(args.resourceType, args.resourceId);
         if (reg.requireOrgMemberForUserShares) {
             const resourceOrgId = access.resource?.orgId;
@@ -189,6 +205,9 @@ export default defineAction({
                     throw new ForbiddenError(`${reg.displayName} can only be shared with its own organization, not a different one.`);
                 }
             }
+            else if (args.principalType === "group") {
+                // Group ownership was validated above against the resource org.
+            }
         }
         const db = reg.getDb();
         const [existing] = await db

package/dist/sharing/actions/unshare-resource.d.ts

@@ -1,7 +1,7 @@
 declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
-    principalType: "org" | "user";
+    principalType: "group" | "org" | "user";
     principalId: string;
 }, {
     ok: boolean;

package/dist/sharing/actions/unshare-resource.js

@@ -22,7 +22,7 @@ export default defineAction({
     schema: z.object({
         resourceType: z.string(),
         resourceId: z.string(),
-        principalType: z.enum(["user", "org"]),
+        principalType: z.enum(["user", "group", "org"]),
         principalId: z.string(),
     }),
     run: async (args) => {

package/dist/sharing/registry.d.ts

@@ -168,6 +168,18 @@ export interface ShareableResourceRegistration {
      * Default: `false` (matches the historical behavior — any email can be granted).
      */
     requireOrgMemberForUserShares?: boolean;
+    /** Set true when this resource's DB is mounted with the org group tables. */
+    supportsGroupShares?: boolean;
+    /**
+     * Optional resource-specific manager check. Returning true grants the
+     * caller admin capability even when the row is private or they have no
+     * explicit share. Workspace apps use this for organization owners/admins;
+     * the owner is still recognized by the normal owner_email check.
+     */
+    canManageAccess?: (resource: any, ctx: {
+        userEmail?: string;
+        orgId?: string;
+    }) => boolean | Promise<boolean>;
     /**
      * Optional per-resource access-context adapter. Most resources should use the
      * request user/org unchanged. Templates with an intentional alternate local

package/dist/sharing/schema.d.ts

@@ -42,7 +42,7 @@ export declare function ownableColumns(): {
  * Columns:
  * - `id`              — share row id (generated by the share action)
  * - `resourceId`      — id of the parent resource
- * - `principalType`   — `'user' | 'org'`
+ * - `principalType`   — `'user' | 'group' | 'org'`
  * - `principalId`     — email (for user) or org id (for org)
  * - `role`            — `'viewer' | 'commenter' | 'editor' | 'admin'`
  * - `createdBy`       — email of the user who created the share
@@ -100,14 +100,14 @@ export declare function createSharesTable(tableName: string): import("drizzle-or
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "org" | "user";
+            data: "group" | "org" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "org"];
+            enumValues: ["user", "group", "org"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;
@@ -195,7 +195,7 @@ export declare function createSharesTable(tableName: string): import("drizzle-or
 }>;
 export type Visibility = "private" | "org" | "public";
 export type ShareRole = "viewer" | "commenter" | "editor" | "admin";
-export type PrincipalType = "user" | "org";
+export type PrincipalType = "user" | "group" | "org";
 /** Role precedence — higher number = stronger capability. */
 export declare const ROLE_RANK: Record<ShareRole | "owner", number>;
 export declare function roleSatisfies(actual: ShareRole | "owner", minimum: ShareRole | "owner"): boolean;