@agent-native/core 0.162.0 → 0.163.0

package/corpus/templates/tasks/.agents/skills/sharing/SKILL.md

@@ -18,6 +18,11 @@ Any resource a user **creates** (dashboards, documents, forms, decks, compositio
 
 This is the framework-level primitive. Every ownable resource gets it for free — same API, same UI, same skill.
 
+Workspace apps are the intentional organization-scoped exception: their default
+visibility is `org`, configurable by an organization owner/admin. The creator is
+stored as the app owner, and the creator or an organization owner/admin can
+change the app's visibility or manage its share grants.
+
 ## Concepts
 
 ### Three visibility levels
@@ -26,7 +31,8 @@ This is the framework-level primitive. Every ownable resource gets it for free
 - **`org`** — owner + explicit grants + anyone in the same org (read-only).
 - **`public`** — owner + explicit grants + **anyone with the link** (read-only). Public docs do NOT appear in other users' list/sidebar/search results — `accessFilter` omits them by default. They're reachable by id (`resolveAccess` admits them) so direct links and SSR routes like `/p/:id` keep working. If a list endpoint legitimately needs cross-user public discovery (a template gallery, etc.), pass `accessFilter(table, shares, ctx, minRole, { includePublic: true })`.
 
-Visibility is coarse. Explicit share grants are fine-grained (per user or per org).
+Visibility is coarse. Explicit share grants are fine-grained (per user, reusable
+organization group, or per org).
 
 ### Roles on a share grant
 
@@ -101,6 +107,7 @@ registerShareableResource({
   // ...
   allowPublic: false, // hides "Public" in the share dialog and rejects it server-side
   requireOrgMemberForUserShares: true, // user shares must target an org member or pending invitee
+  supportsGroupShares: true, // enable reusable organization groups for this resource
 });
 ```
 
@@ -111,6 +118,21 @@ Use both for resources that execute code or expose privileged data with the *vie
 
 Defaults match historical behaviour: `allowPublic: true`, `requireOrgMemberForUserShares: false`. Resources that don't set the flags work as before.
 
+### Reusable organization groups
+
+The workspace organization model stores reusable groups in
+`workspace_user_groups`. Organization owners/admins manage the groups and their
+members through the existing group actions. Set `supportsGroupShares: true` on a
+resource registration to enable `principalType: "group"` in the generic share
+actions and the shared popover's autocomplete. Group ids are always checked
+against the resource's organization, and membership is evaluated at access time
+so group changes apply to existing shares.
+
+Workspace apps opt into this flag and use the organization default visibility
+setting. The app creator is the durable `owner_email`, while organization
+owners/admins receive admin access through the registration's
+`canManageAccess` callback.
+
 ## Filter list/read queries
 
 ```ts
@@ -197,6 +219,9 @@ All app share popovers should use the same compact surface contract:
 - Add `ShareAgentsSection` only when the resource has a real agent-readable
   link or prompt. Keep it collapsed by default and supply domain-specific
   content through the shared section shell.
+- When `supportsGroupShares` is enabled, keep the existing people input as the
+  only entry point and include organization groups in its autocomplete. Do not
+  add a separate group-management surface to each resource.
 - App-specific tabs or controls may remain when they represent a real domain
   action (for example, an embed-code editor), but they should retain the same
   trigger, copy-row, access, and spacing language.
@@ -211,7 +236,7 @@ The framework auto-mounts these actions in every template — no per-template bo
 
 | Action                     | Args                                                                           | Purpose                                   |
 | -------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------- |
-| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
+| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user, group, or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
 | `unshare-resource`         | `resourceType, resourceId, principalType, principalId`                         | Revoke access.                            |
 | `list-resource-shares`     | `resourceType, resourceId`                                                     | Current visibility + all share grants.    |
 | `set-resource-visibility`  | `resourceType, resourceId, visibility`                                         | Change to `private` / `org` / `public`.  |

package/dist/app-config/schema.d.ts

@@ -43,6 +43,7 @@ export declare const appConfigSchema: z.ZodObject<{
         isWorkspace: z.ZodOptional<z.ZodBoolean>;
         appsJson: z.ZodOptional<z.ZodString>;
         gatewayUrl: z.ZodOptional<z.ZodString>;
+        orgDirectoryUrl: z.ZodOptional<z.ZodString>;
         oauthOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;

package/dist/app-config/workspace.d.ts

@@ -19,5 +19,6 @@ export declare const workspaceConfig: z.ZodObject<{
     isWorkspace: z.ZodOptional<z.ZodBoolean>;
     appsJson: z.ZodOptional<z.ZodString>;
     gatewayUrl: z.ZodOptional<z.ZodString>;
+    orgDirectoryUrl: z.ZodOptional<z.ZodString>;
     oauthOrigin: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/app-config/workspace.js

@@ -42,6 +42,14 @@ export const workspaceConfig = z.object({
         env: ["WORKSPACE_GATEWAY_URL", "VITE_WORKSPACE_GATEWAY_URL"],
         doc: "URL of the workspace gateway fronting this app.",
     }),
+    orgDirectoryUrl: z
+        .string()
+        .min(1)
+        .optional()
+        .meta({
+        env: ["AGENT_NATIVE_ORG_DIRECTORY_URL"],
+        doc: "URL of the authoritative organization Dispatch directory.",
+    }),
     oauthOrigin: z
         .string()
         .min(1)

package/dist/chat-threads/schema.d.ts

@@ -403,14 +403,14 @@ export declare const chatThreadShares: import("drizzle-orm/sqlite-core").SQLiteT
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "org" | "user";
+            data: "group" | "org" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "org"];
+            enumValues: ["user", "group", "org"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/client/org/TeamPage.js

@@ -19,7 +19,7 @@ import { SettingsSkeleton } from "../settings/SettingsSkeleton.js";
 import { useShareOrgMemberSearch } from "../sharing/share-controller-helpers.js";
 import { useActionMutation, useActionQuery } from "../use-action.js";
 import { cn } from "../utils.js";
-import { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useDeleteOrg, useSwitchOrg, useSetOrgDomain, useSetOrgWorkspaceUrl, useSetOrgAuthProvider, useRevealA2ASecret, useSetA2ASecret, useSyncA2ASecret, useJoinByDomain, useAppRoles, useSetAppMemberRole, ORG_MEMBER_PAGE_SIZE, } from "./hooks.js";
+import { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useDeleteOrg, useSwitchOrg, useSetOrgDomain, useSetWorkspaceAppDefaultVisibility, useSetOrgWorkspaceUrl, useSetOrgAuthProvider, useRevealA2ASecret, useSetA2ASecret, useSyncA2ASecret, useJoinByDomain, useAppRoles, useSetAppMemberRole, ORG_MEMBER_PAGE_SIZE, } from "./hooks.js";
 const Button = forwardRef(({ className, ...props }, ref) => (_jsx(ToolkitButton, { ref: ref, variant: "ghost", className: cn("h-auto p-0 hover:bg-transparent hover:text-inherit active:scale-100 [&_svg]:!size-auto", className), ...props })));
 Button.displayName = "TeamPrimitiveButton";
 function RoleIcon({ role }) {
@@ -219,7 +219,20 @@ function MembersCard({ appRoles }) {
     const totalMembers = membersData?.totalCount ?? 0;
     const pendingInvites = invitationsData?.invitations ?? [];
     const hasMultipleOrgs = (org.orgs?.length ?? 0) > 1;
-    return (_jsxs("div", { className: "space-y-6", children: [_jsxs(SettingsGroup, { title: "Organization", children: [_jsx(SettingsRow, { id: "organization", label: _jsxs("span", { className: "flex items-center gap-2", children: [_jsx(IconUsersGroup, { className: "size-4 text-muted-foreground" }), _jsx(OrgNameDisplay, { name: org.orgName ?? "", canEdit: isOwnerOrAdmin })] }), description: `${t("org.memberCount", { count: totalMembers })} · ${t("org.youAreRole", { role: org.role })}`, control: hasMultipleOrgs ? (_jsxs(Select, { value: org.orgId ?? "", onValueChange: (value) => switchOrg.mutate(value || null), disabled: switchOrg.isPending, children: [_jsx(SelectTrigger, { className: "h-auto w-full rounded-md border border-border bg-background px-2.5 py-1.5 text-xs sm:w-auto", children: _jsx(SelectValue, {}) }), _jsx(SelectContent, { children: org.orgs.map((o) => (_jsx(SelectItem, { value: o.orgId, children: o.orgName }, o.orgId))) })] })) : undefined }), isOwnerOrAdmin && (_jsxs(_Fragment, { children: [_jsx(DomainSettingsSection, { domain: org.allowedDomain, ownerEmail: org.email }), _jsx(WorkspaceUrlSettingsSection, { workspaceUrl: org.workspaceUrl }), _jsx(AuthProviderSettingsSection, { requiredAuthProvider: org.requiredAuthProvider }), isOwner && _jsx(A2ASecretSection, { isSet: Boolean(org.a2aSecretSet) })] })), switchOrg.error && (_jsx("div", { className: "px-5 pb-4", children: _jsx(ErrorText, { error: switchOrg.error }) }))] }), _jsx(MembersTableCard, { members: members, totalMembers: totalMembers, pendingInvites: pendingInvites, isLoadingMembers: isLoadingMembers, isFetchingMembers: isFetchingMembers, currentUserEmail: org.email, currentUserRole: org.role ?? null, appRoles: appRoles, groups: groupsQuery.data ?? [], canManageGroups: isOwnerOrAdmin, memberOffset: memberOffset, hasNextPage: membersData?.hasMore === true, nextMemberOffset: membersData?.nextOffset ?? null, onMemberPageChange: setMemberOffset }), isOwnerOrAdmin && (_jsx(WorkspaceGroupsCard, { groups: groupsQuery.data ?? [] })), isOwner && _jsx(DangerZoneCard, { orgName: org.orgName ?? "" })] }));
+    return (_jsxs("div", { className: "space-y-6", children: [_jsxs(SettingsGroup, { title: "Organization", children: [_jsx(SettingsRow, { id: "organization", label: _jsxs("span", { className: "flex items-center gap-2", children: [_jsx(IconUsersGroup, { className: "size-4 text-muted-foreground" }), _jsx(OrgNameDisplay, { name: org.orgName ?? "", canEdit: isOwnerOrAdmin })] }), description: `${t("org.memberCount", { count: totalMembers })} · ${t("org.youAreRole", { role: org.role })}`, control: hasMultipleOrgs ? (_jsxs(Select, { value: org.orgId ?? "", onValueChange: (value) => switchOrg.mutate(value || null), disabled: switchOrg.isPending, children: [_jsx(SelectTrigger, { className: "h-auto w-full rounded-md border border-border bg-background px-2.5 py-1.5 text-xs sm:w-auto", children: _jsx(SelectValue, {}) }), _jsx(SelectContent, { children: org.orgs.map((o) => (_jsx(SelectItem, { value: o.orgId, children: o.orgName }, o.orgId))) })] })) : undefined }), isOwnerOrAdmin && (_jsxs(_Fragment, { children: [_jsx(DomainSettingsSection, { domain: org.allowedDomain, ownerEmail: org.email }), _jsx(WorkspaceAppPrivacySettingsSection, { visibility: org.workspaceAppDefaultVisibility ?? "org" }), _jsx(WorkspaceUrlSettingsSection, { workspaceUrl: org.workspaceUrl }), _jsx(AuthProviderSettingsSection, { requiredAuthProvider: org.requiredAuthProvider }), isOwner && _jsx(A2ASecretSection, { isSet: Boolean(org.a2aSecretSet) })] })), switchOrg.error && (_jsx("div", { className: "px-5 pb-4", children: _jsx(ErrorText, { error: switchOrg.error }) }))] }), _jsx(MembersTableCard, { members: members, totalMembers: totalMembers, pendingInvites: pendingInvites, isLoadingMembers: isLoadingMembers, isFetchingMembers: isFetchingMembers, currentUserEmail: org.email, currentUserRole: org.role ?? null, appRoles: appRoles, groups: groupsQuery.data ?? [], canManageGroups: isOwnerOrAdmin, memberOffset: memberOffset, hasNextPage: membersData?.hasMore === true, nextMemberOffset: membersData?.nextOffset ?? null, onMemberPageChange: setMemberOffset }), isOwnerOrAdmin && (_jsx(WorkspaceGroupsCard, { groups: groupsQuery.data ?? [] })), isOwner && _jsx(DangerZoneCard, { orgName: org.orgName ?? "" })] }));
+}
+function WorkspaceAppPrivacySettingsSection({ visibility, }) {
+    const t = useT();
+    const setDefault = useSetWorkspaceAppDefaultVisibility();
+    return (_jsx(SettingsRow, { id: "workspace-app-default-visibility", label: t("org.workspaceAppsDefaultPrivacy", {
+            defaultValue: "New app privacy",
+        }), description: t("org.workspaceAppsDefaultPrivacyDescription", {
+            defaultValue: "Choose whether new workspace apps start private to their creator or visible to the organization.",
+        }), control: _jsxs(Select, { value: visibility, onValueChange: (value) => setDefault.mutate(value === "private" ? "private" : "org"), disabled: setDefault.isPending, children: [_jsx(SelectTrigger, { className: "h-auto w-full rounded-md border border-border bg-background px-2.5 py-1.5 text-xs sm:w-auto", children: _jsx(SelectValue, {}) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "org", children: t("org.workspaceAppsOrganization", {
+                                defaultValue: "Organization",
+                            }) }), _jsx(SelectItem, { value: "private", children: t("org.workspaceAppsCreatorOnly", {
+                                defaultValue: "Creator only",
+                            }) })] })] }) }));
 }
 function MembersTableCard({ members, totalMembers, pendingInvites, isLoadingMembers, isFetchingMembers, currentUserEmail, currentUserRole, appRoles, groups, canManageGroups, memberOffset, hasNextPage, nextMemberOffset, onMemberPageChange, }) {
     const t = useT();

package/dist/client/org/hooks.d.ts

@@ -59,6 +59,8 @@ export declare function useSwitchOrg(): import("@tanstack/react-query").UseMutat
 export declare function useDeleteOrg(): import("@tanstack/react-query").UseMutationResult<any, Error, string, unknown>;
 export declare function useJoinByDomain(): import("@tanstack/react-query").UseMutationResult<any, Error, string, unknown>;
 export declare function useSetOrgDomain(): import("@tanstack/react-query").UseMutationResult<any, Error, string | null, unknown>;
+export type WorkspaceAppDefaultVisibility = "private" | "org";
+export declare function useSetWorkspaceAppDefaultVisibility(): import("@tanstack/react-query").UseMutationResult<any, Error, WorkspaceAppDefaultVisibility, unknown>;
 export declare function useSetOrgWorkspaceUrl(): import("@tanstack/react-query").UseMutationResult<any, Error, string | null, unknown>;
 export declare function useSetOrgAuthProvider(): import("@tanstack/react-query").UseMutationResult<any, Error, "google" | null, unknown>;
 export interface AppRoleAssignment {

package/dist/client/org/hooks.js

@@ -247,6 +247,18 @@ export function useSetOrgDomain() {
         },
     });
 }
+export function useSetWorkspaceAppDefaultVisibility() {
+    const qc = useQueryClient();
+    return useMutation({
+        mutationFn: (visibility) => apiFetch(`${ORG_BASE}/workspace-app-default-visibility`, {
+            method: "PUT",
+            body: JSON.stringify({ visibility }),
+        }),
+        onSuccess: async () => {
+            await qc.invalidateQueries({ queryKey: ["org-me"] });
+        },
+    });
+}
 export function useSetOrgWorkspaceUrl() {
     const qc = useQueryClient();
     return useMutation({

package/dist/client/org/index.d.ts

@@ -1,5 +1,5 @@
-export { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useInviteMember, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useDeleteOrg, useSwitchOrg, useJoinByDomain, useSetOrgDomain, useSetOrgWorkspaceUrl, useRevealA2ASecret, useSetA2ASecret, useSyncA2ASecret, useOrgRole, useAppRoles, useAppRole, useSetAppMemberRole, } from "./hooks.js";
-export type { InviteRole, InviteVars, BulkInviteResult, SyncA2ASecretResult, UseOrgRoleResult, AppRoleAssignment, AppRolesInfo, } from "./hooks.js";
+export { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useInviteMember, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useDeleteOrg, useSwitchOrg, useJoinByDomain, useSetOrgDomain, useSetWorkspaceAppDefaultVisibility, useSetOrgWorkspaceUrl, useRevealA2ASecret, useSetA2ASecret, useSyncA2ASecret, useOrgRole, useAppRoles, useAppRole, useSetAppMemberRole, } from "./hooks.js";
+export type { InviteRole, InviteVars, BulkInviteResult, SyncA2ASecretResult, UseOrgRoleResult, AppRoleAssignment, AppRolesInfo, WorkspaceAppDefaultVisibility, } from "./hooks.js";
 export type { AppRolesDescriptor } from "../../org/app-roles.js";
 export { OrgSwitcher, type OrgSwitcherProps } from "./OrgSwitcher.js";
 export { InvitationBanner, type InvitationBannerProps, } from "./InvitationBanner.js";

package/dist/client/org/index.js

@@ -1,5 +1,5 @@
 // Public client API for the org module.
-export { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useInviteMember, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useDeleteOrg, useSwitchOrg, useJoinByDomain, useSetOrgDomain, useSetOrgWorkspaceUrl, useRevealA2ASecret, useSetA2ASecret, useSyncA2ASecret, useOrgRole, useAppRoles, useAppRole, useSetAppMemberRole, } from "./hooks.js";
+export { useOrg, useOrgMembers, useOrgInvitations, useCreateOrg, useUpdateOrg, useInviteMember, useBulkInviteMembers, useChangeMemberRole, useAcceptInvitation, useRemoveMember, useDeleteOrg, useSwitchOrg, useJoinByDomain, useSetOrgDomain, useSetWorkspaceAppDefaultVisibility, useSetOrgWorkspaceUrl, useRevealA2ASecret, useSetA2ASecret, useSyncA2ASecret, useOrgRole, useAppRoles, useAppRole, useSetAppMemberRole, } from "./hooks.js";
 export { OrgSwitcher } from "./OrgSwitcher.js";
 export { InvitationBanner, } from "./InvitationBanner.js";
 export { WorkspaceNotice } from "./WorkspaceNotice.js";

package/dist/client/sharing/ShareButton.js

@@ -131,7 +131,7 @@ export function ShareButton(props) {
 function SharePanel(props) {
     const t = useT();
     const { controller } = props;
-    const { inviteEmail, setInviteEmail: onInviteEmailChange, activeShareTab, handleShareTabChange, data, policy, visibility, canManage, role, setRole, notifyPeople, setNotifyPeople, shareMessage, setShareMessage, messageOpen, setMessageOpen, shareError, setShareError, suggestionsOpen, setSuggestionsOpen, inFlight, memberSearch, memberSuggestions, knownMembers, shares, handleVisibility, handleHideInSearch, handleAdd, handleChangeRole, handleRemove, } = controller;
+    const { inviteEmail, setInviteEmail: onInviteEmailChange, activeShareTab, handleShareTabChange, data, policy, visibility, canManage, role, setRole, notifyPeople, setNotifyPeople, shareMessage, setShareMessage, messageOpen, setMessageOpen, shareError, setShareError, suggestionsOpen, setSuggestionsOpen, inFlight, memberSearch, memberSuggestions, groupSuggestions, selectGroup, knownMembers, shares, handleVisibility, handleHideInSearch, handleAdd, handleChangeRole, handleRemove, } = controller;
     const hasInviteEmail = inviteEmail.trim().length > 0;
     const isLoading = data === undefined;
     const meta = visibilityMeta(visibility, t, props.visibilityCopy);
@@ -155,8 +155,13 @@ function SharePanel(props) {
                                             onInviteEmailChange(next);
                                             if (shareError)
                                                 setShareError(null);
-                                        }, onSelectMember: (member) => {
-                                            onInviteEmailChange(member.email);
+                                        }, onSelectSuggestion: (suggestion) => {
+                                            if (suggestion.principalType === "group") {
+                                                selectGroup(suggestion);
+                                            }
+                                            else {
+                                                onInviteEmailChange(suggestion.email);
+                                            }
                                             setSuggestionsOpen(false);
                                             if (shareError)
                                                 setShareError(null);
@@ -165,8 +170,21 @@ function SharePanel(props) {
                                                 defaultValue: "Add people from your organization",
                                             })
                                             : t("agentChat.share.addPeopleEmail", {
-                                                defaultValue: "Add people by email",
-                                            }), suggestions: memberSuggestions, search: memberSearch }), _jsx(RoleSelect, { value: role, onChange: setRole, roleCopy: props.roleCopy, allowedRoles: props.allowedRoles }), _jsx("button", { type: "button", onClick: handleAdd, disabled: !hasInviteEmail, className: BUTTON_PRIMARY_SM, children: t("agentChat.share.add", { defaultValue: "Add" }) })] }), shareError ? (_jsx("div", { role: "alert", className: "rounded-md border border-destructive/40 bg-destructive/10 px-3 py-2 text-xs text-destructive", children: shareError })) : null, hasInviteEmail ? (_jsxs("div", { className: "flex flex-wrap items-center gap-x-3 gap-y-2 text-xs text-muted-foreground", children: [_jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx("input", { type: "checkbox", checked: notifyPeople, onChange: (e) => setNotifyPeople(e.target.checked), className: "h-4 w-4 rounded border-input accent-primary" }), t("agentChat.share.notifyPeople", {
+                                                defaultValue: policy.supportsGroupShares
+                                                    ? "Add people or groups"
+                                                    : "Add people by email",
+                                            }), suggestions: [
+                                            ...memberSuggestions.map((member) => ({
+                                                ...member,
+                                                principalType: "user",
+                                            })),
+                                            ...(policy.supportsGroupShares
+                                                ? groupSuggestions.map((group) => ({
+                                                    ...group,
+                                                    principalType: "group",
+                                                }))
+                                                : []),
+                                        ], search: memberSearch }), _jsx(RoleSelect, { value: role, onChange: setRole, roleCopy: props.roleCopy, allowedRoles: props.allowedRoles }), _jsx("button", { type: "button", onClick: handleAdd, disabled: !hasInviteEmail, className: BUTTON_PRIMARY_SM, children: t("agentChat.share.add", { defaultValue: "Add" }) })] }), shareError ? (_jsx("div", { role: "alert", className: "rounded-md border border-destructive/40 bg-destructive/10 px-3 py-2 text-xs text-destructive", children: shareError })) : null, hasInviteEmail ? (_jsxs("div", { className: "flex flex-wrap items-center gap-x-3 gap-y-2 text-xs text-muted-foreground", children: [_jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx("input", { type: "checkbox", checked: notifyPeople, onChange: (e) => setNotifyPeople(e.target.checked), className: "h-4 w-4 rounded border-input accent-primary" }), t("agentChat.share.notifyPeople", {
                                                 defaultValue: "Notify people",
                                             })] }), notifyPeople ? (_jsx("button", { type: "button", "aria-expanded": messageOpen, onClick: () => setMessageOpen(!messageOpen), className: "rounded-sm px-1 py-0.5 font-medium text-foreground underline decoration-border underline-offset-2 transition-colors hover:bg-accent hover:text-accent-foreground", children: messageOpen
                                             ? t("agentChat.share.hideMessage", {
@@ -178,7 +196,7 @@ function SharePanel(props) {
                                         defaultValue: "Message",
                                     }), placeholder: t("agentChat.share.messagePlaceholder", {
                                         defaultValue: "Add a short note (optional)",
-                                    }), value: shareMessage, onChange: (event) => setShareMessage(event.target.value), maxLength: 500, rows: 3, className: "w-full resize-y rounded-md border border-input bg-card px-3 py-2 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 focus:ring-offset-background" }) })) : null] })) : null, _jsxs("ul", { className: "flex list-none flex-col gap-1 p-0 m-0", children: [data?.ownerEmail ? (_jsxs("li", { className: "flex items-center gap-3 px-1 py-1.5 text-sm", children: [_jsx(Avatar, { label: displayName(data.ownerEmail, knownMembers, t) }), _jsx("span", { className: "flex-1 min-w-0 truncate", children: displayName(data.ownerEmail, knownMembers, t) }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("agentChat.share.owner", { defaultValue: "Owner" }) })] })) : null, shares.map((s) => (_jsxs("li", { className: cn("flex items-center gap-3 px-1 py-1.5 text-sm", inFlight.has(keyOf(s)) && "opacity-60"), children: [_jsx(Avatar, { label: principalLabel(s, knownMembers, t), org: s.principalType === "org" }), _jsx("span", { className: "flex-1 min-w-0 truncate", children: principalLabel(s, knownMembers, t) }), canManage ? (_jsx(RoleSelect, { value: s.role, onChange: (r) => handleChangeRole(s, r), disabled: inFlight.has(keyOf(s)), plain: true, roleCopy: props.roleCopy, allowedRoles: props.allowedRoles })) : (_jsx("span", { className: "text-xs text-muted-foreground", children: roleMeta(s.role, t, props.roleCopy).label })), canManage ? (_jsx("button", { type: "button", "aria-label": t("agentChat.share.remove", {
+                                    }), value: shareMessage, onChange: (event) => setShareMessage(event.target.value), maxLength: 500, rows: 3, className: "w-full resize-y rounded-md border border-input bg-card px-3 py-2 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 focus:ring-offset-background" }) })) : null] })) : null, _jsxs("ul", { className: "flex list-none flex-col gap-1 p-0 m-0", children: [data?.ownerEmail ? (_jsxs("li", { className: "flex items-center gap-3 px-1 py-1.5 text-sm", children: [_jsx(Avatar, { label: displayName(data.ownerEmail, knownMembers, t) }), _jsx("span", { className: "flex-1 min-w-0 truncate", children: displayName(data.ownerEmail, knownMembers, t) }), _jsx("span", { className: "text-xs text-muted-foreground", children: t("agentChat.share.owner", { defaultValue: "Owner" }) })] })) : null, shares.map((s) => (_jsxs("li", { className: cn("flex items-center gap-3 px-1 py-1.5 text-sm", inFlight.has(keyOf(s)) && "opacity-60"), children: [_jsx(Avatar, { label: principalLabel(s, knownMembers, t), org: s.principalType === "org", group: s.principalType === "group" }), _jsx("span", { className: "flex-1 min-w-0 truncate", children: principalLabel(s, knownMembers, t) }), canManage ? (_jsx(RoleSelect, { value: s.role, onChange: (r) => handleChangeRole(s, r), disabled: inFlight.has(keyOf(s)), plain: true, roleCopy: props.roleCopy, allowedRoles: props.allowedRoles })) : (_jsx("span", { className: "text-xs text-muted-foreground", children: roleMeta(s.role, t, props.roleCopy).label })), canManage ? (_jsx("button", { type: "button", "aria-label": t("agentChat.share.remove", {
                                             defaultValue: "Remove",
                                         }), onClick: () => handleRemove(s), disabled: inFlight.has(keyOf(s)), className: BUTTON_GHOST_ICON, children: _jsx(IconTrash, { size: 14 }) })) : null] }, keyOf(s)))), !shares.length && !data?.ownerEmail ? (_jsx("li", { className: "px-1 py-1.5 text-sm text-muted-foreground", children: t("agentChat.share.noAccess", {
                                     defaultValue: "No one has access yet.",
@@ -219,13 +237,13 @@ function AdvancedAccessPopover({ control, canManage, onToggle, }) {
                                                     defaultValue: "People with the link can still open this.",
                                                 }) })] })] })] }) })] }));
 }
-function MemberAutocomplete({ value, open, onOpenChange, onValueChange, onSelectMember, onSubmit, placeholder, suggestions, search, }) {
+function MemberAutocomplete({ value, open, onOpenChange, onValueChange, onSelectSuggestion, onSubmit, placeholder, suggestions, search, }) {
     const t = useT();
     const rawListboxId = useId();
     const listboxId = rawListboxId.replace(/:/g, "");
     const inputRef = useRef(null);
     const [activeIndex, setActiveIndex] = useState(-1);
-    const activeMember = activeIndex >= 0 && activeIndex < suggestions.length
+    const activeSuggestion = activeIndex >= 0 && activeIndex < suggestions.length
         ? suggestions[activeIndex]
         : null;
     useEffect(() => {
@@ -243,8 +261,8 @@ function MemberAutocomplete({ value, open, onOpenChange, onValueChange, onSelect
             .getElementById(optionId(listboxId, activeIndex))
             ?.scrollIntoView({ block: "nearest" });
     }, [activeIndex, listboxId]);
-    const chooseMember = (member) => {
-        onSelectMember(member);
+    const chooseSuggestion = (suggestion) => {
+        onSelectSuggestion(suggestion);
         onOpenChange(false);
         inputRef.current?.focus();
     };
@@ -273,9 +291,9 @@ function MemberAutocomplete({ value, open, onOpenChange, onValueChange, onSelect
             return;
         }
         if (event.key === "Enter") {
-            if (open && activeMember) {
+            if (open && activeSuggestion) {
                 event.preventDefault();
-                chooseMember(activeMember);
+                chooseSuggestion(activeSuggestion);
                 return;
             }
             if (value.trim()) {
@@ -299,7 +317,7 @@ function MemberAutocomplete({ value, open, onOpenChange, onValueChange, onSelect
             search.loadMore();
         }
     };
-    return (_jsxs(Popover, { open: open, onOpenChange: onOpenChange, children: [_jsx(PopoverAnchor, { asChild: true, children: _jsxs("div", { className: "relative flex-1 min-w-0", children: [_jsx(IconSearch, { "aria-hidden": true, size: 15, strokeWidth: 1.8, className: "pointer-events-none absolute start-2.5 top-1/2 -translate-y-1/2 text-muted-foreground" }), _jsx("input", { ref: inputRef, type: "email", role: "combobox", "aria-autocomplete": "list", "aria-expanded": open, "aria-controls": open ? listboxId : undefined, "aria-activedescendant": activeIndex >= 0 ? optionId(listboxId, activeIndex) : undefined, placeholder: placeholder, value: value, onChange: (event) => {
+    return (_jsxs(Popover, { open: open, onOpenChange: onOpenChange, children: [_jsx(PopoverAnchor, { asChild: true, children: _jsxs("div", { className: "relative flex-1 min-w-0", children: [_jsx(IconSearch, { "aria-hidden": true, size: 15, strokeWidth: 1.8, className: "pointer-events-none absolute start-2.5 top-1/2 -translate-y-1/2 text-muted-foreground" }), _jsx("input", { ref: inputRef, type: "text", role: "combobox", "aria-autocomplete": "list", "aria-expanded": open, "aria-controls": open ? listboxId : undefined, "aria-activedescendant": activeIndex >= 0 ? optionId(listboxId, activeIndex) : undefined, placeholder: placeholder, value: value, onChange: (event) => {
                                 onValueChange(event.target.value);
                                 onOpenChange(true);
                             }, onFocus: () => onOpenChange(true), onBlur: () => {
@@ -308,11 +326,15 @@ function MemberAutocomplete({ value, open, onOpenChange, onValueChange, onSelect
                                         onOpenChange(false);
                                     }
                                 }, 0);
-                            }, onKeyDown: handleKeyDown, autoComplete: "off", className: "h-9 w-full min-w-0 rounded-md border border-input bg-card ps-8 pe-8 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 focus:ring-offset-background" }), search.isLoading ? (_jsx(IconLoader2, { "aria-hidden": true, size: 15, strokeWidth: 1.8, className: "pointer-events-none absolute end-2.5 top-1/2 -translate-y-1/2 animate-spin text-muted-foreground" })) : null] }) }), _jsx(PopoverContent, { align: "start", sideOffset: 4, "data-agent-native-share-overlay": "", onOpenAutoFocus: (event) => event.preventDefault(), className: cn(SHARE_NESTED_OVERLAY_Z, "w-[var(--radix-popper-anchor-width)] min-w-[18rem] rounded-md p-1 shadow-lg", SHARE_POPOVER_SURFACE), children: _jsxs("div", { id: listboxId, role: "listbox", className: "max-h-56 overflow-y-auto overflow-x-hidden", onScroll: handleScroll, children: [suggestions.map((member, index) => {
+                            }, onKeyDown: handleKeyDown, autoComplete: "off", className: "h-9 w-full min-w-0 rounded-md border border-input bg-card ps-8 pe-8 text-sm text-foreground placeholder:text-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:ring-offset-2 focus:ring-offset-background" }), search.isLoading ? (_jsx(IconLoader2, { "aria-hidden": true, size: 15, strokeWidth: 1.8, className: "pointer-events-none absolute end-2.5 top-1/2 -translate-y-1/2 animate-spin text-muted-foreground" })) : null] }) }), _jsx(PopoverContent, { align: "start", sideOffset: 4, "data-agent-native-share-overlay": "", onOpenAutoFocus: (event) => event.preventDefault(), className: cn(SHARE_NESTED_OVERLAY_Z, "w-[var(--radix-popper-anchor-width)] min-w-[18rem] rounded-md p-1 shadow-lg", SHARE_POPOVER_SURFACE), children: _jsxs("div", { id: listboxId, role: "listbox", className: "max-h-56 overflow-y-auto overflow-x-hidden", onScroll: handleScroll, children: [suggestions.map((suggestion, index) => {
                             const active = index === activeIndex;
-                            return (_jsxs("div", { id: optionId(listboxId, index), role: "option", "aria-selected": active, onMouseDown: (event) => event.preventDefault(), onMouseEnter: () => setActiveIndex(index), onClick: () => chooseMember(member), className: cn("flex cursor-pointer select-none flex-col rounded-sm px-3 py-2 text-sm outline-none", active
+                            return (_jsxs("div", { id: optionId(listboxId, index), role: "option", "aria-selected": active, onMouseDown: (event) => event.preventDefault(), onMouseEnter: () => setActiveIndex(index), onClick: () => chooseSuggestion(suggestion), className: cn("flex cursor-pointer select-none flex-col rounded-sm px-3 py-2 text-sm outline-none", active
                                     ? "bg-accent text-accent-foreground"
-                                    : "text-foreground hover:bg-accent hover:text-accent-foreground"), children: [_jsx("span", { className: "truncate font-medium", children: member.name?.trim() || member.email }), member.name?.trim() ? (_jsx("span", { className: "truncate text-xs text-muted-foreground", children: member.email })) : null] }, member.email));
+                                    : "text-foreground hover:bg-accent hover:text-accent-foreground"), children: [_jsxs("span", { className: "flex items-center gap-2 truncate font-medium", children: [suggestion.principalType === "group" ? (_jsx(IconUsersGroup, { "aria-hidden": true, size: 14, strokeWidth: 1.8, className: "shrink-0 text-muted-foreground" })) : null, _jsx("span", { className: "truncate", children: suggestion.principalType === "group"
+                                                    ? suggestion.name
+                                                    : suggestion.name?.trim() || suggestion.email })] }), suggestion.principalType === "group" ? (_jsx("span", { className: "truncate text-xs text-muted-foreground", children: t("agentChat.share.userGroup", {
+                                            defaultValue: "User group",
+                                        }) })) : suggestion.name?.trim() ? (_jsx("span", { className: "truncate text-xs text-muted-foreground", children: suggestion.email })) : null] }, `${suggestion.principalType}:${suggestion.principalType === "group" ? suggestion.id : suggestion.email}`));
                         }), search.isLoading && suggestions.length === 0 ? (_jsx("div", { className: "px-3 py-3 text-sm text-muted-foreground", children: t("agentChat.share.searching", {
                                 defaultValue: "Searching...",
                             }) })) : null, search.error ? (_jsx("div", { className: "px-3 py-3 text-sm text-muted-foreground", children: t("agentChat.share.loadPeopleFailed", {
@@ -375,8 +397,8 @@ function VisibilitySelect(props) {
                                     .description,
                             })) }) }) }) })] }));
 }
-function Avatar({ label, org }) {
-    return (_jsx("span", { "aria-hidden": true, className: "inline-flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-muted text-[11px] font-semibold text-muted-foreground", children: org ? _jsx(IconUsersGroup, { size: 14, strokeWidth: 1.75 }) : initials(label) }));
+function Avatar({ label, org, group, }) {
+    return (_jsx("span", { "aria-hidden": true, className: "inline-flex h-7 w-7 shrink-0 items-center justify-center rounded-full bg-muted text-[11px] font-semibold text-muted-foreground", children: org || group ? (_jsx(IconUsersGroup, { size: 14, strokeWidth: 1.75 })) : (initials(label)) }));
 }
 function keyOf(s) {
     return `${s.principalType}:${s.principalId}`;
@@ -393,6 +415,9 @@ function principalLabel(share, members, t) {
         return t("agentChat.share.organization", {
             defaultValue: "Organization",
         });
+    if (share.principalType === "group")
+        return (serverLabel ||
+            t("agentChat.share.userGroup", { defaultValue: "User group" }));
     return displayName(share.principalId, members, t);
 }
 function displayName(emailOrId, members, t) {

package/dist/client/sharing/useShareButtonController.d.ts

@@ -1,13 +1,18 @@
-import type { useActionQuery } from "../use-action.js";
+import { useActionQuery } from "../use-action.js";
 export type ShareButtonVisibility = "private" | "org" | "public";
 export type ShareButtonRole = "viewer" | "commenter" | "editor" | "admin";
 export interface ShareButtonShare {
     id: string;
-    principalType: "user" | "org";
+    principalType: "user" | "group" | "org";
     principalId: string;
     displayName?: string | null;
     role: ShareButtonRole;
 }
+export interface ShareButtonGroup {
+    id: string;
+    name: string;
+    memberEmails?: string[];
+}
 export interface ShareButtonSharesResponse {
     ownerEmail: string | null;
     orgId: string | null;
@@ -18,6 +23,7 @@ export interface ShareButtonSharesResponse {
     policy?: {
         allowPublic: boolean;
         requireOrgMemberForUserShares: boolean;
+        supportsGroupShares?: boolean;
     };
 }
 export interface ShareButtonOrgMember {
@@ -65,6 +71,7 @@ export interface ShareButtonController {
     policy: {
         allowPublic: boolean;
         requireOrgMemberForUserShares: boolean;
+        supportsGroupShares?: boolean;
     };
     visibility: ShareButtonVisibility;
     triggerVisibility: ShareButtonVisibility | null;
@@ -84,7 +91,10 @@ export interface ShareButtonController {
     inFlight: Set<string>;
     memberSearch: ShareButtonOrgMemberSearch;
     memberSuggestions: ShareButtonOrgMember[];
+    groupSuggestions: ShareButtonGroup[];
     knownMembers: ShareButtonOrgMember[];
+    selectedGroup: ShareButtonGroup | null;
+    selectGroup: (group: ShareButtonGroup) => void;
     shares: ShareButtonShare[];
     handleVisibility: (visibility: ShareButtonVisibility) => void;
     handleHideInSearch: () => void;

package/dist/client/sharing/useShareButtonController.js

@@ -1,8 +1,10 @@
 import { useCallback, useEffect, useRef, useState } from "react";
+import { useActionQuery } from "../use-action.js";
 import { DEFAULT_MEMBER_SEARCH_DEBOUNCE_MS, DEFAULT_MEMBER_SUGGESTION_LIMIT, extractShareErrorMessage, optimisticallyUpdateShareCache, rollbackShareCache, useShareOrgMemberSearch, useShareMutationGuard, useShareMutations, useShareQuery, } from "./share-controller-helpers.js";
 export function useShareButtonController(options) {
     const [open, setOpen] = useState(false);
     const [inviteEmail, setInviteEmail] = useState("");
+    const [selectedGroup, setSelectedGroup] = useState(null);
     const shareTabDefaultValue = options.shareTabs?.defaultValue ?? "share";
     const [activeShareTab, setActiveShareTab] = useState(shareTabDefaultValue);
     const [visibilityOverride, setVisibilityOverride] = useState(null);
@@ -25,6 +27,7 @@ export function useShareButtonController(options) {
     }, [options, shareTabDefaultValue, sharesQuery, visibilityOverride]);
     useEffect(() => {
         setInviteEmail("");
+        setSelectedGroup(null);
         setShareMessage("");
         setMessageOpen(false);
     }, [options.resourceId, options.resourceType]);
@@ -141,6 +144,10 @@ export function useShareButtonController(options) {
         limit: DEFAULT_MEMBER_SUGGESTION_LIMIT,
         debounceMs: DEFAULT_MEMBER_SEARCH_DEBOUNCE_MS,
     });
+    const groupsQuery = useActionQuery("list-workspace-user-groups", {}, {
+        enabled: canManage && policy.supportsGroupShares === true && suggestionsOpen,
+        staleTime: 30_000,
+    });
     const serverShares = data?.shares ?? [];
     const shares = [
         ...serverShares
@@ -160,7 +167,21 @@ export function useShareButtonController(options) {
         }
     }
     const memberSuggestions = memberSearch.members.filter((member) => !excludedMemberEmails.has(member.email.toLowerCase()));
+    const excludedGroupIds = new Set(shares
+        .filter((share) => share.principalType === "group")
+        .map((share) => share.principalId));
+    const groupSuggestions = (Array.isArray(groupsQuery.data) ? groupsQuery.data : []).filter((group) => !excludedGroupIds.has(group.id) &&
+        (!inviteEmail.trim() ||
+            group.name.toLowerCase().includes(inviteEmail.trim().toLowerCase())));
     const knownMembers = memberSearch.members;
+    const setInviteEmailValue = useCallback((email) => {
+        setSelectedGroup(null);
+        setInviteEmail(email);
+    }, []);
+    const selectGroup = useCallback((group) => {
+        setSelectedGroup(group);
+        setInviteEmail(group.name);
+    }, []);
     const handleVisibility = useCallback((next) => {
         if (next === visibility)
             return;
@@ -189,11 +210,14 @@ export function useShareButtonController(options) {
         const trimmed = inviteEmail.trim();
         if (!trimmed || !canManage)
             return;
-        const message = notifyPeople ? shareMessage.trim() : "";
+        const principalType = selectedGroup ? "group" : "user";
+        const principalId = selectedGroup?.id ?? trimmed;
+        const message = principalType === "user" && notifyPeople ? shareMessage.trim() : "";
         const optimistic = {
-            id: `pending-${trimmed}`,
-            principalType: "user",
-            principalId: trimmed,
+            id: `pending-${principalType}-${principalId}`,
+            principalType,
+            principalId,
+            ...(selectedGroup ? { displayName: selectedGroup.name } : {}),
             role,
         };
         const key = keyOf(optimistic);
@@ -202,6 +226,7 @@ export function useShareButtonController(options) {
         setShareError(null);
         setPendingAdds((previous) => [...previous, optimistic]);
         setInviteEmail("");
+        setSelectedGroup(null);
         setShareMessage("");
         setMessageOpen(false);
         setSuggestionsOpen(false);
@@ -210,10 +235,10 @@ export function useShareButtonController(options) {
         share.mutate({
             resourceType: options.resourceType,
             resourceId: options.resourceId,
-            principalType: "user",
-            principalId: trimmed,
+            principalType,
+            principalId,
             role,
-            notify: notifyPeople,
+            notify: principalType === "user" && notifyPeople,
             resourceUrl: getNotificationUrl(options.shareUrl),
             ...(message ? { message } : {}),
         }, {
@@ -228,6 +253,7 @@ export function useShareButtonController(options) {
                 setPendingAdds((previous) => previous.filter((item) => item.id !== optimistic.id));
                 clearInFlight(key);
                 setInviteEmail(trimmed);
+                setSelectedGroup(selectedGroup);
                 setShareMessage((current) => current || message);
                 setMessageOpen((current) => current || Boolean(message));
                 setShareError(extractShareErrorMessage(error));
@@ -244,6 +270,7 @@ export function useShareButtonController(options) {
         options.resourceType,
         options.shareUrl,
         role,
+        selectedGroup,
         shareMessage,
         share,
         queryClient,
@@ -368,7 +395,7 @@ export function useShareButtonController(options) {
         activeShareTab,
         handleShareTabChange,
         inviteEmail,
-        setInviteEmail,
+        setInviteEmail: setInviteEmailValue,
         sharesQuery,
         visibilityOverride,
         handleVisibilityChange,
@@ -399,6 +426,9 @@ export function useShareButtonController(options) {
         handleAdd,
         handleChangeRole,
         handleRemove,
+        groupSuggestions,
+        selectedGroup,
+        selectGroup,
     };
 }
 function keyOf(share) {

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/dashboard-storage/schema.d.ts

@@ -464,14 +464,14 @@ export declare function createDashboardStorageSchema(options?: DashboardStorageS
                 tableName: string;
                 dataType: "string";
                 columnType: "SQLiteText";
-                data: "org" | "user";
+                data: "group" | "org" | "user";
                 driverParam: string;
                 notNull: true;
                 hasDefault: false;
                 isPrimaryKey: false;
                 isAutoincrement: false;
                 hasRuntimeDefault: false;
-                enumValues: ["user", "org"];
+                enumValues: ["user", "group", "org"];
                 baseColumn: never;
                 identity: undefined;
                 generated: undefined;

package/dist/data-programs/schema.d.ts

@@ -411,14 +411,14 @@ export declare const dataProgramShares: import("drizzle-orm/sqlite-core").SQLite
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "org" | "user";
+            data: "group" | "org" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "org"];
+            enumValues: ["user", "group", "org"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/extensions/schema.d.ts

@@ -316,14 +316,14 @@ export declare const extensionShares: import("drizzle-orm/sqlite-core").SQLiteTa
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "org" | "user";
+            data: "group" | "org" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "org"];
+            enumValues: ["user", "group", "org"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;