@agent-native/core 0.161.23 → 0.163.0

package/dist/config.d.ts

@@ -38,6 +38,11 @@ export interface AgentNativeRuntimeConfig {
     database?: AgentNativeRuntimeDatabaseConfig;
     environment?: AgentNativeRuntimeEnvironmentConfig;
 }
+export type AgentNativeDeploymentEnvironment = "local" | "beta" | "production" | "preview";
+export interface AgentNativeDeploymentConfig {
+    /** The release lane that produced the currently running client bundle. */
+    environment?: AgentNativeDeploymentEnvironment;
+}
 export interface AgentNativeDiagnosticsConfig {
     /** Fail a production Vite build when runtime configuration has issues. */
     failOnBuild?: boolean;
@@ -73,6 +78,7 @@ export interface AgentNativeConfig {
     version?: typeof AGENT_NATIVE_CONFIG_VERSION;
     onboarding?: AgentNativeOnboardingConfig;
     runtime?: AgentNativeRuntimeConfig;
+    deployment?: AgentNativeDeploymentConfig;
     diagnostics?: AgentNativeDiagnosticsConfig;
     instructions?: AgentNativeInstructionsConfig;
     translations?: AgentNativeTranslationsConfig;
@@ -99,3 +105,12 @@ export declare function normalizeAgentNativeConfig(input: unknown, source?: stri
 export declare function mergeAgentNativeConfigs(base: AgentNativeConfig, override: AgentNativeConfig): AgentNativeConfig;
 export declare function resolveAgentNativeConfig(input: AgentNativeConfigInput | undefined, context: AgentNativeConfigContext): AgentNativeConfig;
 export declare function resolveFirstRunOnboardingMode(setting: AgentNativeFirstRunOnboardingSetting, context: AgentNativeConfigContext): AgentNativeFirstRunOnboardingMode;
+export declare function isAgentNativeDeploymentEnvironment(value: unknown): value is AgentNativeDeploymentEnvironment;
+/**
+ * Resolve the public deployment lane from hosting facts at build time.
+ *
+ * Netlify exposes `CONTEXT` and `BRANCH` to builds. Keeping this inference in
+ * the Vite/config boundary means browser code consumes typed public config and
+ * never parses process.env itself.
+ */
+export declare function inferAgentNativeDeploymentEnvironment(env: Record<string, string | undefined>, mode?: string): AgentNativeDeploymentEnvironment | undefined;

package/dist/config.js

@@ -26,6 +26,7 @@ export function normalizeAgentNativeConfig(input, source = "agent-native config"
     }
     const onboardingValue = input.onboarding;
     const runtimeValue = input.runtime;
+    const deploymentValue = input.deployment;
     const diagnosticsValue = input.diagnostics;
     const instructionsValue = input.instructions;
     const translationsValue = input.translations;
@@ -46,6 +47,9 @@ export function normalizeAgentNativeConfig(input, source = "agent-native config"
     if (runtimeValue !== undefined) {
         normalized.runtime = normalizeRuntimeConfig(runtimeValue, `${source}.runtime`);
     }
+    if (deploymentValue !== undefined) {
+        normalized.deployment = normalizeDeploymentConfig(deploymentValue, `${source}.deployment`);
+    }
     if (diagnosticsValue !== undefined) {
         normalized.diagnostics = normalizeDiagnosticsConfig(diagnosticsValue, `${source}.diagnostics`);
     }
@@ -101,6 +105,12 @@ export function mergeAgentNativeConfigs(base, override) {
                     : undefined,
             }
             : undefined,
+        deployment: base.deployment || override.deployment
+            ? {
+                ...base.deployment,
+                ...override.deployment,
+            }
+            : undefined,
         diagnostics: base.diagnostics || override.diagnostics
             ? {
                 ...base.diagnostics,
@@ -205,6 +215,18 @@ function normalizeRuntimeConfig(value, source) {
     }
     return result;
 }
+function normalizeDeploymentConfig(value, source) {
+    if (!isRecord(value)) {
+        throw new Error(`${source} must be an object`);
+    }
+    const environment = value.environment;
+    if (environment === undefined)
+        return {};
+    if (!isAgentNativeDeploymentEnvironment(environment)) {
+        throw new Error(`${source}.environment must be "local", "beta", "production", or "preview"`);
+    }
+    return { environment };
+}
 function normalizeDiagnosticsConfig(value, source) {
     if (!isRecord(value)) {
         throw new Error(`${source} must be an object`);
@@ -338,6 +360,37 @@ function isAgentNativeHarnessRuntime(value) {
         value === "pi" ||
         value === "opencode");
 }
+export function isAgentNativeDeploymentEnvironment(value) {
+    return (value === "local" ||
+        value === "beta" ||
+        value === "production" ||
+        value === "preview");
+}
+/**
+ * Resolve the public deployment lane from hosting facts at build time.
+ *
+ * Netlify exposes `CONTEXT` and `BRANCH` to builds. Keeping this inference in
+ * the Vite/config boundary means browser code consumes typed public config and
+ * never parses process.env itself.
+ */
+export function inferAgentNativeDeploymentEnvironment(env, mode) {
+    const context = env.CONTEXT?.trim().toLowerCase();
+    const branch = env.BRANCH?.trim().toLowerCase();
+    if (branch === "production" || context === "production") {
+        return "production";
+    }
+    if (branch === "beta" || (context === "branch-deploy" && branch === "main")) {
+        return "beta";
+    }
+    if (context === "deploy-preview" ||
+        context === "branch-deploy" ||
+        branch?.startsWith("deploy-preview")) {
+        return "preview";
+    }
+    if (mode === "development")
+        return "local";
+    return undefined;
+}
 function isRecord(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }

package/dist/dashboard-storage/schema.d.ts

@@ -464,14 +464,14 @@ export declare function createDashboardStorageSchema(options?: DashboardStorageS
                 tableName: string;
                 dataType: "string";
                 columnType: "SQLiteText";
-                data: "org" | "user";
+                data: "group" | "org" | "user";
                 driverParam: string;
                 notNull: true;
                 hasDefault: false;
                 isPrimaryKey: false;
                 isAutoincrement: false;
                 hasRuntimeDefault: false;
-                enumValues: ["user", "org"];
+                enumValues: ["user", "group", "org"];
                 baseColumn: never;
                 identity: undefined;
                 generated: undefined;

package/dist/data-programs/schema.d.ts

@@ -411,14 +411,14 @@ export declare const dataProgramShares: import("drizzle-orm/sqlite-core").SQLite
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "org" | "user";
+            data: "group" | "org" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "org"];
+            enumValues: ["user", "group", "org"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/extensions/fetch-tool.js

@@ -306,7 +306,7 @@ export function createFetchToolEntry(opts = {}) {
                     // saveToFile: write full body to workspace and return compact summary.
                     if (saveToFilePath) {
                         try {
-                            const { writeWorkspaceFile, SAVE_TO_FILE_MAX_BYTES } = await import("../workspace-files/store.js");
+                            const { writeWorkspaceFile, SAVE_TO_FILE_MAX_BYTES, isScratchWorkspacePath, toWorkspaceFileCard, } = await import("../workspace-files/store.js");
                             const { getRequestOrgId, getRequestUserEmail } = await import("../server/request-context.js");
                             const orgId = getRequestOrgId();
                             const email = getRequestUserEmail();
@@ -317,7 +317,7 @@ export function createFetchToolEntry(opts = {}) {
                                     : null;
                             if (!scope)
                                 throw new Error("No authenticated context for saveToFile");
-                            await writeWorkspaceFile(scope, saveToFilePath, body, contentType, {
+                            const meta = await writeWorkspaceFile(scope, saveToFilePath, body, contentType, {
                                 maxFileBytes: SAVE_TO_FILE_MAX_BYTES,
                             });
                             const bytes = Buffer.byteLength(body, "utf8");
@@ -330,6 +330,12 @@ export function createFetchToolEntry(opts = {}) {
                                 contentType,
                                 responseMode: processedMode,
                                 preview: preview.length < displayBody.length ? `${preview}…` : preview,
+                                // A durable (non-scratch) file renders a download card the
+                                // moment it's created — no separate show-workspace-file call
+                                // needed to get a link.
+                                ...(isScratchWorkspacePath(saveToFilePath)
+                                    ? {}
+                                    : { file: toWorkspaceFileCard(meta) }),
                             });
                         }
                         catch (saveErr) {

package/dist/extensions/schema.d.ts

@@ -316,14 +316,14 @@ export declare const extensionShares: import("drizzle-orm/sqlite-core").SQLiteTa
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "org" | "user";
+            data: "group" | "org" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "org"];
+            enumValues: ["user", "group", "org"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/extensions/store.js

@@ -244,6 +244,9 @@ async function extensionChangeTargetsForRow(row) {
         else if (share.principalType === "org") {
             addExtensionChangeTarget(targets, { orgId: share.principalId });
         }
+        else if (share.principalType === "group" && row.orgId) {
+            addExtensionChangeTarget(targets, { orgId: row.orgId });
+        }
     }
     return Array.from(targets.values());
 }

package/dist/localization/core-messages/ar-SA.js

@@ -486,6 +486,7 @@ const messages = {
     "share.unknownPerson": "شخص غير معروف",
     "share.viewer": "مشاهد",
     "share.viewerDescription": "يمكنه العرض",
+    "share.userGroup": "مجموعة مستخدمين",
     "status.resuming": "جارٍ الاستئناف",
     "status.stillWorking": "لا يزال قيد العمل",
     "status.thinking": "يفكّر",

package/dist/localization/core-messages/de-DE.js

@@ -521,5 +521,6 @@ const messages = {
     "share.unknownPerson": "Unbekannte Person",
     "share.viewer": "Betrachter",
     "share.viewerDescription": "Kann ansehen",
+    "share.userGroup": "Benutzergruppe",
 };
 export default messages;

package/dist/localization/core-messages/en-US.d.ts

@@ -470,6 +470,7 @@ declare const messages: {
     readonly "share.unknownPerson": "Unknown person";
     readonly "share.viewer": "Viewer";
     readonly "share.viewerDescription": "Can view";
+    readonly "share.userGroup": "User group";
     readonly "status.resuming": "Resuming";
     readonly "status.stillWorking": "Still working";
     readonly "status.thinking": "Thinking";

package/dist/localization/core-messages/en-US.js

@@ -470,6 +470,7 @@ const messages = {
     "share.unknownPerson": "Unknown person",
     "share.viewer": "Viewer",
     "share.viewerDescription": "Can view",
+    "share.userGroup": "User group",
     "status.resuming": "Resuming",
     "status.stillWorking": "Still working",
     "status.thinking": "Thinking",

package/dist/localization/core-messages/es-ES.js

@@ -528,5 +528,6 @@ const messages = {
     "share.unknownPerson": "Persona desconocida",
     "share.viewer": "Lector",
     "share.viewerDescription": "Puede ver",
+    "share.userGroup": "Grupo de usuarios",
 };
 export default messages;

package/dist/localization/core-messages/fr-FR.js

@@ -528,5 +528,6 @@ const messages = {
     "share.unknownPerson": "Personne inconnue",
     "share.viewer": "Lecteur",
     "share.viewerDescription": "Peut consulter",
+    "share.userGroup": "Groupe d’utilisateurs",
 };
 export default messages;

package/dist/localization/core-messages/hi-IN.js

@@ -470,6 +470,7 @@ const messages = {
     "share.unknownPerson": "अज्ञात व्यक्ति",
     "share.viewer": "दर्शक",
     "share.viewerDescription": "देख सकता है",
+    "share.userGroup": "उपयोगकर्ता समूह",
     "status.resuming": "फिर से शुरू हो रहा है",
     "status.stillWorking": "अभी काम जारी है",
     "status.thinking": "सोच रहा है",

package/dist/localization/core-messages/ja-JP.js

@@ -466,6 +466,7 @@ const messages = {
     "share.unknownPerson": "不明なユーザー",
     "share.viewer": "閲覧者",
     "share.viewerDescription": "閲覧可能",
+    "share.userGroup": "ユーザーグループ",
     "status.resuming": "再開中",
     "status.stillWorking": "処理を続けています",
     "status.thinking": "思考中",

package/dist/localization/core-messages/ko-KR.js

@@ -466,6 +466,7 @@ const messages = {
     "share.unknownPerson": "알 수 없는 사용자",
     "share.viewer": "뷰어",
     "share.viewerDescription": "보기 가능",
+    "share.userGroup": "사용자 그룹",
     "status.resuming": "재개 중",
     "status.stillWorking": "계속 작업 중",
     "status.thinking": "생각 중",

package/dist/localization/core-messages/pt-BR.js

@@ -528,5 +528,6 @@ const messages = {
     "share.unknownPerson": "Pessoa desconhecida",
     "share.viewer": "Visualizador",
     "share.viewerDescription": "Pode visualizar",
+    "share.userGroup": "Grupo de usuários",
 };
 export default messages;

package/dist/localization/core-messages/zh-CN.js

@@ -466,6 +466,7 @@ const messages = {
     "share.unknownPerson": "未知人员",
     "share.viewer": "查看者",
     "share.viewerDescription": "可以查看",
+    "share.userGroup": "用户组",
     "status.resuming": "正在恢复",
     "status.stillWorking": "仍在处理",
     "status.thinking": "正在思考",

package/dist/localization/core-messages/zh-TW.js

@@ -466,6 +466,7 @@ const messages = {
     "share.unknownPerson": "未知人員",
     "share.viewer": "檢視者",
     "share.viewerDescription": "可以檢視",
+    "share.userGroup": "使用者群組",
     "status.resuming": "正在繼續",
     "status.stillWorking": "仍在處理",
     "status.thinking": "正在思考",

package/dist/localization/core-messages.d.ts

@@ -472,6 +472,7 @@ export declare const englishAgentChatMessages: {
     readonly "share.unknownPerson": "Unknown person";
     readonly "share.viewer": "Viewer";
     readonly "share.viewerDescription": "Can view";
+    readonly "share.userGroup": "User group";
     readonly "status.resuming": "Resuming";
     readonly "status.stillWorking": "Still working";
     readonly "status.thinking": "Thinking";

package/dist/localization/default-messages.d.ts

@@ -879,6 +879,10 @@ declare const messages: {
         owner: string;
         admin: string;
         member: string;
+        workspaceAppsDefaultPrivacy: string;
+        workspaceAppsDefaultPrivacyDescription: string;
+        workspaceAppsOrganization: string;
+        workspaceAppsCreatorOnly: string;
         members: string;
         inviteMembers: string;
         invited: string;

package/dist/localization/default-messages.js

@@ -885,6 +885,10 @@ const messages = {
         owner: "Owner",
         admin: "Admin",
         member: "Member",
+        workspaceAppsDefaultPrivacy: "New app privacy",
+        workspaceAppsDefaultPrivacyDescription: "Choose whether new workspace apps start private to their creator or visible to the organization.",
+        workspaceAppsOrganization: "Organization",
+        workspaceAppsCreatorOnly: "Creator only",
         members: "Members",
         inviteMembers: "Invite members",
         invited: "Invited",

package/dist/mcp/embed-app.js

@@ -735,7 +735,7 @@ export function embedApp(options = {}) {
 
     function stripDevOnlyModuleImports(code) {
       return String(code).replace(
-        /\\bimport\\s+(?:[^"']+\\s+from\\s+)?["'][^"']*(?:virtual:react-router\\/inject-hmr-runtime|__x00__virtual:react-router\\/inject-hmr-runtime)[^"']*["']\\s*;?/g,
+        /\\bimport\\s+(?:[^"']+\\s+from\\s+)?["'][^"']*(?:virtual:react-router\\/(?:inject-)?hmr-runtime|__x00__virtual:react-router\\/(?:inject-)?hmr-runtime)[^"']*["']\\s*;?/g,
         ""
       );
     }

package/dist/notifications/routes.d.ts

@@ -28,6 +28,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/org/handlers.d.ts

@@ -1,4 +1,4 @@
-import type { OrgRole } from "./types.js";
+import type { OrgRole, WorkspaceAppDefaultVisibility } from "./types.js";
 /** GET /_agent-native/org/me — current user's active org, all orgs, pending invitations */
 export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     email: string;
@@ -23,8 +23,13 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     allowedDomain: string;
     workspaceUrl: string;
     requiredAuthProvider: "google";
+    workspaceAppDefaultVisibility: WorkspaceAppDefaultVisibility;
     a2aSecretSet: boolean;
 }>>;
+/** PUT /_agent-native/org/workspace-app-default-visibility - org admins only */
+export declare const setWorkspaceAppDefaultVisibilityHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    visibility: WorkspaceAppDefaultVisibility;
+}>>;
 /** POST /_agent-native/org — create a new organization */
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     id: string;

package/dist/org/handlers.js

@@ -35,6 +35,7 @@ import { getSession } from "../server/auth.js";
 import { renderInviteEmail } from "../server/email-templates.js";
 import { sendEmail, isEmailConfigured } from "../server/email.js";
 import { readBody } from "../server/h3-helpers.js";
+import { getOrgSetting, putOrgSetting } from "../settings/org-settings.js";
 import { setActiveOrgId } from "./active-org.js";
 import { setRequiredAuthProvider } from "./auth-policy.js";
 import { invalidateDomainMatchCache } from "./auto-join-domain.js";
@@ -42,6 +43,14 @@ import { getOrgContext, createOrganization } from "./context.js";
 import { isFreeEmailProvider } from "./free-email-providers.js";
 import { invalidateMemberOrgCaches } from "./request-org-cache.js";
 import { parseWorkspaceUrl } from "./workspace-url.js";
+const WORKSPACE_APP_DEFAULT_VISIBILITY_KEY = "workspace-app-default-visibility";
+function normalizeWorkspaceAppDefaultVisibility(value) {
+    if (value === "private" || value === "org")
+        return value;
+    if (value == null)
+        return "org";
+    throw new Error("Workspace app default visibility is invalid; refusing to widen access.");
+}
 function getInviteAppUrl(event) {
     return getAppProductionUrl(event);
 }
@@ -119,6 +128,11 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         }
     }
     const isOwnerOrAdmin = ctx.role === "owner" || ctx.role === "admin";
+    let workspaceAppDefaultVisibility = "org";
+    if (ctx.orgId) {
+        const setting = await getOrgSetting(ctx.orgId, WORKSPACE_APP_DEFAULT_VISIBILITY_KEY);
+        workspaceAppDefaultVisibility = normalizeWorkspaceAppDefaultVisibility(setting?.visibility);
+    }
     const invitesRes = await e.execute({
         // Case-insensitive match: invitations are stored with whatever case
         // the inviter typed, but the session email may be normalized
@@ -147,6 +161,7 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         allowedDomain,
         workspaceUrl,
         requiredAuthProvider,
+        workspaceAppDefaultVisibility,
         // Never serialize the A2A secret here. This route runs on every page load,
         // so the value would sit in JSON any script on the page can read, and it
         // signs the JWTs peers accept as first-party callers. Reveal is an explicit
@@ -154,6 +169,34 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         a2aSecretSet: isOwnerOrAdmin ? a2aSecretSet : undefined,
     };
 });
+/** PUT /_agent-native/org/workspace-app-default-visibility - org admins only */
+export const setWorkspaceAppDefaultVisibilityHandler = defineEventHandler(async (event) => {
+    const ctx = await getOrgContext(event);
+    if (ctx.role !== "owner" && ctx.role !== "admin") {
+        throw createError({
+            statusCode: 403,
+            message: "Only organization admins can change app defaults.",
+        });
+    }
+    if (!ctx.orgId) {
+        throw createError({
+            statusCode: 400,
+            message: "Join an organization before changing app defaults.",
+        });
+    }
+    const body = await readBody(event);
+    if (body?.visibility !== "private" && body?.visibility !== "org") {
+        throw createError({
+            statusCode: 400,
+            message: "visibility must be either private or org.",
+        });
+    }
+    const visibility = body.visibility;
+    await putOrgSetting(ctx.orgId, WORKSPACE_APP_DEFAULT_VISIBILITY_KEY, {
+        visibility,
+    });
+    return { visibility };
+});
 /** POST /_agent-native/org — create a new organization */
 export const createOrgHandler = defineEventHandler(async (event) => {
     const session = await getSession(event);

package/dist/org/index.d.ts

@@ -1,4 +1,4 @@
-export type { OrgRole, OrgContext, OrgSummary, OrgInvitationSummary, OrgInfo, OrgMember, OrgPendingInvitation, RequiredAuthProvider, } from "./types.js";
+export type { OrgRole, OrgContext, OrgSummary, OrgInvitationSummary, OrgInfo, OrgMember, OrgPendingInvitation, RequiredAuthProvider, WorkspaceAppDefaultVisibility, } from "./types.js";
 export { canInviteOrgMembers, canManageOrg, canManageOrgDomain, orgRoleAtLeast, orgRoleRank, } from "./permissions.js";
 export { getOrgContext, getOrgDomain, getOrgA2ASecret, getA2ASecretByDomain, resolveOrgByDomain, resolveOrgIdForEmail, createOrganization, } from "./context.js";
 export { implicitServiceOrgRole, parseServiceIdentityEmail, } from "./service-identity.js";
@@ -11,8 +11,8 @@ export type { AppRoles, AppRolesDescriptor, AppRoleCaller, AppRoleLookup, AppMem
 export { ORG_MIGRATIONS } from "./migrations.js";
 export { getRequiredAuthProviderForEmail, getRequiredAuthProviderForOrg, isGoogleSignInRequiredForEmail, setRequiredAuthProvider, } from "./auth-policy.js";
 export { createOrgPlugin, defaultOrgPlugin } from "./plugin.js";
-export { organizations, orgMembers, orgInvitations, appMemberRoles, } from "./schema.js";
-export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setRequiredAuthProviderHandler, } from "./handlers.js";
+export { organizations, orgMembers, orgInvitations, appMemberRoles, workspaceApps, workspaceAppShares, } from "./schema.js";
+export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setRequiredAuthProviderHandler, setWorkspaceAppDefaultVisibilityHandler, } from "./handlers.js";
 export { listAppRolesHandler, setAppRoleHandler, } from "./app-roles-handlers.js";
 export { isFreeEmailProvider } from "./free-email-providers.js";
 export { isOrgMember } from "./membership.js";

package/dist/org/index.js

@@ -10,10 +10,10 @@ export { getRequiredAuthProviderForEmail, getRequiredAuthProviderForOrg, isGoogl
 export { createOrgPlugin, defaultOrgPlugin } from "./plugin.js";
 // Drizzle schema (re-exported so templates can write typed queries against
 // org tables without redefining the schema themselves).
-export { organizations, orgMembers, orgInvitations, appMemberRoles, } from "./schema.js";
+export { organizations, orgMembers, orgInvitations, appMemberRoles, workspaceApps, workspaceAppShares, } from "./schema.js";
 // Individual handlers — exported so templates can compose a custom org plugin
 // while still using the framework-provided handlers.
-export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setRequiredAuthProviderHandler, } from "./handlers.js";
+export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setRequiredAuthProviderHandler, setWorkspaceAppDefaultVisibilityHandler, } from "./handlers.js";
 export { listAppRolesHandler, setAppRoleHandler, } from "./app-roles-handlers.js";
 export { isFreeEmailProvider } from "./free-email-providers.js";
 export { isOrgMember } from "./membership.js";

package/dist/org/migrations.js

@@ -132,4 +132,37 @@ export const ORG_MIGRATIONS = [
         version: 1014,
         sql: `ALTER TABLE organizations ADD COLUMN IF NOT EXISTS required_auth_provider TEXT`,
     },
+    {
+        version: 1015,
+        sql: `CREATE TABLE IF NOT EXISTS workspace_apps (
+      id TEXT PRIMARY KEY,
+      owner_email TEXT NOT NULL,
+      org_id TEXT,
+      visibility TEXT NOT NULL DEFAULT 'org',
+      name TEXT NOT NULL,
+      description TEXT,
+      path TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    )`,
+    },
+    {
+        version: 1016,
+        sql: `CREATE TABLE IF NOT EXISTS workspace_app_shares (
+      id TEXT PRIMARY KEY,
+      resource_id TEXT NOT NULL,
+      principal_type TEXT NOT NULL,
+      principal_id TEXT NOT NULL,
+      role TEXT NOT NULL DEFAULT 'viewer',
+      created_at TEXT NOT NULL,
+      created_by TEXT NOT NULL DEFAULT '',
+      UNIQUE(resource_id, principal_type, principal_id)
+    )`,
+    },
+    {
+        version: 1017,
+        name: "workspace-app-access-indexes",
+        sql: `CREATE INDEX IF NOT EXISTS workspace_apps_org_visibility_idx
+          ON workspace_apps (org_id, visibility)`,
+    },
 ];

package/dist/org/plugin.js

@@ -2,7 +2,7 @@ import { defineEventHandler, setResponseStatus, getMethod, getRequestURL, } from
 import { runMigrations } from "../db/migrations.js";
 import { awaitBootstrap, getH3App, FRAMEWORK_PREFIX, markDefaultPluginProvided, } from "../server/framework-request-handler.js";
 import { listAppRolesHandler, setAppRoleHandler, } from "./app-roles-handlers.js";
-import { getMyOrgHandler, createOrgHandler, updateOrgHandler, deleteOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, joinByDomainHandler, setDomainHandler, setWorkspaceUrlHandler, setRequiredAuthProviderHandler, revealA2ASecretHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, } from "./handlers.js";
+import { getMyOrgHandler, createOrgHandler, updateOrgHandler, deleteOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, joinByDomainHandler, setDomainHandler, setWorkspaceUrlHandler, setRequiredAuthProviderHandler, revealA2ASecretHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setWorkspaceAppDefaultVisibilityHandler, } from "./handlers.js";
 import { ORG_MIGRATIONS } from "./migrations.js";
 const ORG_PREFIX = `${FRAMEWORK_PREFIX}/org`;
 /**
@@ -97,6 +97,15 @@ export function createOrgPlugin() {
             }
             return removeMemberHandler(event);
         }));
+        // PUT /workspace-app-default-visibility — org admins choose the default
+        // for newly created workspace apps. Existing apps retain their setting.
+        app.use(`${ORG_PREFIX}/workspace-app-default-visibility`, defineEventHandler(async (event) => {
+            if (getMethod(event) !== "PUT") {
+                setResponseStatus(event, 405);
+                return { error: "Method not allowed" };
+            }
+            return setWorkspaceAppDefaultVisibilityHandler(event);
+        }));
         // /invitations and /invitations/:id/accept — same pattern.
         app.use(`${ORG_PREFIX}/invitations`, defineEventHandler(async (event) => {
             const tail = getRequestURL(event).pathname || "/";