@agent-native/core 0.162.0 → 0.163.0

package/dist/org/schema.js

@@ -1,4 +1,4 @@
-import { table, text, integer } from "../db/schema.js";
+import { table, text, integer, ownableColumns, createSharesTable, } from "../db/schema.js";
 export const organizations = table("organizations", {
     id: text("id").primaryKey(),
     name: text("name").notNull(),
@@ -39,3 +39,22 @@ export const orgInvitations = table("org_invitations", {
     status: text("status").notNull(),
     role: text("role"),
 });
+/** Workspace app access is framework-owned so every mounted app can enforce it. */
+export const workspaceApps = table("workspace_apps", {
+    id: text("id").primaryKey(),
+    ...ownableColumns(),
+    // Workspace apps are visible to their organization by default. The generic
+    // ownable primitive remains private-by-default for user-created resources;
+    // app creation is a deliberate workspace-level exception.
+    visibility: text("visibility", {
+        enum: ["private", "org", "public"],
+    })
+        .notNull()
+        .default("org"),
+    name: text("name").notNull(),
+    description: text("description"),
+    path: text("path").notNull(),
+    createdAt: integer("created_at").notNull(),
+    updatedAt: integer("updated_at").notNull(),
+});
+export const workspaceAppShares = createSharesTable("workspace_app_shares");

package/dist/org/types.d.ts

@@ -3,6 +3,7 @@
  */
 export type OrgRole = "owner" | "admin" | "member";
 export type RequiredAuthProvider = "google" | null;
+export type WorkspaceAppDefaultVisibility = "private" | "org";
 export interface OrgContext {
     email: string;
     orgId: string | null;
@@ -43,6 +44,8 @@ export interface OrgInfo {
     workspaceUrl: string | null;
     /** Sign-in provider required for members of the active org. */
     requiredAuthProvider: RequiredAuthProvider;
+    /** Default visibility applied when a new workspace app is first registered. */
+    workspaceAppDefaultVisibility?: WorkspaceAppDefaultVisibility;
     /**
      * Whether the active org has an A2A secret. The value itself is never part
      * of this payload — owners/admins fetch it on demand from

package/dist/org/workspace-app-access.d.ts

@@ -0,0 +1,10 @@
+export interface WorkspaceAppAccessContext {
+    email: string;
+    orgId?: string | null;
+}
+/**
+ * Enforce the workspace-app ACL before a hosted app's authenticated API
+ * surface is reached. The app shell remains cacheable and anonymous; this
+ * check protects the session-backed APIs/actions that make the app useful.
+ */
+export declare function isWorkspaceAppAccessAllowed(appId: string, context: WorkspaceAppAccessContext): Promise<boolean>;

package/dist/org/workspace-app-access.js

@@ -0,0 +1,179 @@
+import { signA2AToken } from "../a2a/client.js";
+import { getAppConfig } from "../app-config/index.js";
+import { getDbExec } from "../db/client.js";
+import { workspaceUserGroupsIncludeUser } from "../workspace-connections/groups.js";
+import { getOrgA2ASecret, getOrgDomain } from "./context.js";
+const WORKSPACE_APPS_ACTION_PATH = "/_agent-native/actions/list-workspace-apps";
+const WORKSPACE_APP_ACCESS_TIMEOUT_MS = 2_500;
+function normalizedEmail(email) {
+    return email.trim().toLowerCase();
+}
+function configuredWorkspaceDirectory() {
+    const workspace = getAppConfig().workspace;
+    return (workspace.orgDirectoryUrl?.trim() || workspace.gatewayUrl?.trim() || null);
+}
+function workspaceAppsActionUrl(base) {
+    try {
+        const baseUrl = new URL(base);
+        if (baseUrl.protocol !== "http:" && baseUrl.protocol !== "https:") {
+            return null;
+        }
+        const basePath = baseUrl.pathname.replace(/\/+$/, "");
+        baseUrl.pathname = `${basePath}${WORKSPACE_APPS_ACTION_PATH}`;
+        baseUrl.search = "";
+        baseUrl.searchParams.set("includeAgentCards", "false");
+        baseUrl.searchParams.set("audience", "all");
+        baseUrl.hash = "";
+        return baseUrl;
+    }
+    catch {
+        // coercion-ok: malformed configured URL is a typed unavailable registry.
+        return null;
+    }
+}
+function workspaceAppsFromResponse(value) {
+    if (Array.isArray(value))
+        return value;
+    if (value &&
+        typeof value === "object" &&
+        Array.isArray(value.apps)) {
+        return value.apps;
+    }
+    return [];
+}
+/**
+ * Hosted app databases are not the authority for workspace-app rows. Ask the
+ * Dispatch registry action, which resolves the ACL against its shared store,
+ * so an app-scoped database cannot accidentally turn a missing local row into
+ * access. A configured registry is fail-closed on every network/auth error.
+ */
+async function hostedWorkspaceAppAccess(appId, context, email) {
+    const configuredDirectory = configuredWorkspaceDirectory();
+    if (!configuredDirectory)
+        return null;
+    const url = workspaceAppsActionUrl(configuredDirectory);
+    if (!url)
+        return false;
+    const orgId = context.orgId?.trim() || null;
+    const [orgDomain, orgSecret] = orgId
+        ? await Promise.all([getOrgDomain(orgId), getOrgA2ASecret(orgId)])
+        : [null, null];
+    let token;
+    try {
+        token = await signA2AToken(email, orgDomain?.trim() || undefined, orgSecret?.trim() || undefined, {
+            expiresIn: "1m",
+            preferGlobalSecret: true,
+            ...(orgId ? { extraClaims: { org_id: orgId } } : {}),
+        });
+    }
+    catch (error) {
+        console.error("[workspace-app-access] registry token unavailable", error);
+        return false;
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), WORKSPACE_APP_ACCESS_TIMEOUT_MS);
+    try {
+        const response = await fetch(url, {
+            headers: {
+                accept: "application/json",
+                Authorization: `Bearer ${token}`,
+            },
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return false;
+        const apps = workspaceAppsFromResponse(
+        // coercion-ok: malformed registry JSON is an authorization failure.
+        await response.json().catch(() => null));
+        return apps.some((app) => app.id === appId);
+    }
+    catch (error) {
+        console.error("[workspace-app-access] registry access check failed", error);
+        return false;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Enforce the workspace-app ACL before a hosted app's authenticated API
+ * surface is reached. The app shell remains cacheable and anonymous; this
+ * check protects the session-backed APIs/actions that make the app useful.
+ */
+export async function isWorkspaceAppAccessAllowed(appId, context) {
+    const normalizedAppId = appId.trim();
+    const email = normalizedEmail(context.email);
+    if (!normalizedAppId || normalizedAppId === "dispatch" || !email) {
+        return true;
+    }
+    const hostedAccess = await hostedWorkspaceAppAccess(normalizedAppId, context, email);
+    if (hostedAccess !== null)
+        return hostedAccess;
+    // Standalone/local deployments have no Dispatch registry URL. Keep the
+    // direct lookup for that mode, but never let missing or malformed ACL state
+    // grant access.
+    try {
+        const db = getDbExec();
+        const appResult = await db.execute({
+            sql: `SELECT owner_email, org_id, visibility
+            FROM workspace_apps WHERE id = ? LIMIT 1`,
+            args: [normalizedAppId],
+        });
+        const app = appResult.rows[0];
+        if (!app)
+            return false;
+        const ownerEmail = normalizedEmail(typeof app.owner_email === "string" ? app.owner_email : "");
+        const resourceOrgId = (typeof app.org_id === "string" ? app.org_id : "").trim() || null;
+        const orgId = context.orgId?.trim() || null;
+        const sameOrg = !!resourceOrgId && resourceOrgId === orgId;
+        if (ownerEmail === email && (!resourceOrgId || sameOrg))
+            return true;
+        if (!sameOrg || !orgId)
+            return false;
+        const memberResult = await db.execute({
+            sql: `SELECT role FROM org_members
+            WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,
+            args: [orgId, email],
+        });
+        if (memberResult.rows.length === 0)
+            return false;
+        const memberRole = String(memberResult.rows[0]?.role ?? "");
+        if (memberRole === "owner" || memberRole === "admin")
+            return true;
+        if (app.visibility === "org")
+            return true;
+        if (app.visibility !== "private")
+            return false;
+        const userShare = await db.execute({
+            sql: `SELECT 1 FROM workspace_app_shares
+            WHERE resource_id = ? AND principal_type = 'user'
+              AND LOWER(principal_id) = ? LIMIT 1`,
+            args: [normalizedAppId, email],
+        });
+        if (userShare.rows.length > 0)
+            return true;
+        const orgShare = await db.execute({
+            sql: `SELECT 1 FROM workspace_app_shares
+            WHERE resource_id = ? AND principal_type = 'org'
+              AND principal_id = ? LIMIT 1`,
+            args: [normalizedAppId, orgId],
+        });
+        if (orgShare.rows.length > 0)
+            return true;
+        const groupShares = await db.execute({
+            sql: `SELECT principal_id FROM workspace_app_shares
+            WHERE resource_id = ? AND principal_type = 'group'`,
+            args: [normalizedAppId],
+        });
+        const groupIds = groupShares.rows
+            .map((row) => typeof row.principal_id === "string" ? row.principal_id : "")
+            .filter(Boolean);
+        return workspaceUserGroupsIncludeUser(resourceOrgId, groupIds, email);
+    }
+    catch (error) {
+        // Missing migrations, missing rows, and every other DB failure deny
+        // protected app access until the authoritative ACL is available.
+        console.error("[workspace-app-access] access check failed", error);
+        return false;
+    }
+}

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,10 +75,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
+    message?: undefined;
     id?: undefined;
     provider?: undefined;
     deleted?: undefined;
-    message?: undefined;
     providers: {
         id: string;
         label: string;
@@ -93,40 +93,40 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
+    message?: undefined;
+    count?: undefined;
     id?: undefined;
     deleted?: undefined;
-    message?: undefined;
     providers?: undefined;
-    count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
 } | {
+    message?: undefined;
+    count?: undefined;
     provider?: undefined;
     deleted?: undefined;
-    message?: undefined;
     providers?: undefined;
-    count?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
 } | {
-    provider?: undefined;
     message?: undefined;
-    providers?: undefined;
     count?: undefined;
+    provider?: undefined;
+    providers?: undefined;
     found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
 } | {
+    count?: undefined;
     provider?: undefined;
     deleted?: undefined;
     providers?: undefined;
-    count?: undefined;
     found?: undefined;
     registered: boolean;
     id: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -312,6 +312,7 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         scope?: "org" | "user" | undefined;
     }, {
         id?: undefined;
+        deleted?: undefined;
         providers: {
             id: string;
             label: string;
@@ -324,27 +325,26 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         count: number;
         provider?: undefined;
         found?: undefined;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
         id?: undefined;
+        deleted?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
+        deleted?: undefined;
         providers?: undefined;
         count?: undefined;
         provider?: undefined;
         found: boolean;
         id: string;
-        deleted?: undefined;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
@@ -359,11 +359,11 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
+        deleted?: undefined;
         providers?: undefined;
         count?: undefined;
         provider?: undefined;
         found?: undefined;
-        deleted?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import { defineEventHandler, getMethod, getQuery, getRequestIP, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, getHeader, } from "h3";
 import { getAppConfig } from "../app-config/index.js";
+import { isWorkspaceAppAccessAllowed } from "../org/workspace-app-access.js";
 import { EMBED_START_PATH } from "../shared/embed-auth.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import { FIRST_RUN_ONBOARDING_COOKIE, FIRST_RUN_ONBOARDING_MAX_AGE, } from "../shared/first-run-onboarding.js";
@@ -2170,8 +2171,20 @@ function createAuthGuardFn(app) {
             return;
         }
         const session = await getSession(event);
-        if (session)
+        if (session) {
+            const workspaceAppId = getAppConfig().app.workspaceId?.trim() || "";
+            if (workspaceAppId &&
+                workspaceAppId !== "dispatch" &&
+                (p.startsWith("/api/") || p.startsWith("/_agent-native/")) &&
+                !(await isWorkspaceAppAccessAllowed(workspaceAppId, {
+                    email: session.email,
+                    orgId: session.orgId,
+                }))) {
+                setResponseStatus(event, 403);
+                return { error: "You do not have access to this workspace app." };
+            }
             return;
+        }
         if (p.startsWith("/api/") || p.startsWith("/_agent-native/")) {
             setResponseStatus(event, 401);
             return { error: "Unauthorized" };

package/dist/server/poll.js

@@ -231,6 +231,12 @@ function extensionTargetsForRow(row, shareRows) {
         else if (principalType === "org" && principalId) {
             addExtensionTarget(targets, { orgId: principalId });
         }
+        else if (principalType === "group" && orgId) {
+            // Group membership is org-scoped. Invalidating the org target is a
+            // conservative fallback that keeps group-share changes fresh for every
+            // member without making the poll layer own group-directory queries.
+            addExtensionTarget(targets, { orgId });
+        }
     }
     return Array.from(targets.values());
 }

package/dist/sharing/access.d.ts

@@ -5,8 +5,8 @@
  * 1. Direct ownership — `owner_email = currentUser`.
  * 2. Visibility — `'private' | 'org' | 'public'`. `org` grants read to anyone
  *    in the same org; `public` grants read to any authenticated user.
- * 3. Share rows — per-user or per-org grants in the `{type}_shares` table
- *    with a role (`viewer | commenter | editor | admin`).
+ * 3. Share rows — per-user, per-group, or per-org grants in the
+ *    `{type}_shares` table with a role (`viewer | commenter | editor | admin`).
  *
  * Use `applyAccessFilter()` on list/read queries to filter rows the current
  * user can see. Use `assertAccess()` at the top of write actions to reject

package/dist/sharing/access.js

@@ -5,16 +5,18 @@
  * 1. Direct ownership — `owner_email = currentUser`.
  * 2. Visibility — `'private' | 'org' | 'public'`. `org` grants read to anyone
  *    in the same org; `public` grants read to any authenticated user.
- * 3. Share rows — per-user or per-org grants in the `{type}_shares` table
- *    with a role (`viewer | commenter | editor | admin`).
+ * 3. Share rows — per-user, per-group, or per-org grants in the
+ *    `{type}_shares` table with a role (`viewer | commenter | editor | admin`).
  *
  * Use `applyAccessFilter()` on list/read queries to filter rows the current
  * user can see. Use `assertAccess()` at the top of write actions to reject
  * callers who lack the required role.
  */
 import { and, eq, or, sql } from "drizzle-orm";
+import { isPostgres } from "../db/client.js";
 import { orgMembers } from "../org/schema.js";
 import { getRequestAuthCapability, getRequestUserEmail, getRequestOrgId, } from "../server/request-context.js";
+import { workspaceUserGroupsIncludeUser, workspaceUserGroupsTable, } from "../workspace-connections/groups.js";
 import { listShareableResources, requireShareableResource, } from "./registry.js";
 import { ROLE_RANK } from "./schema.js";
 /**
@@ -140,6 +142,38 @@ export function accessFilter(resourceTable, sharesTable, rawCtx = currentAccess(
                     and ${shareScope}
                     and ${minRoleSql(minRole)})`);
     }
+    if (reg?.supportsGroupShares && normalizedUserEmail && orgId) {
+        const groupTable = sql.raw(workspaceUserGroupsTable());
+        const groupMemberPredicate = isPostgres()
+            ? sql `exists (
+          select 1
+          from jsonb_array_elements_text(
+            workspace_group.member_emails_json::jsonb
+          ) as group_member(email)
+          where lower(group_member.email) = ${normalizedUserEmail}
+        )`
+            : sql `exists (
+          select 1
+          from json_each(workspace_group.member_emails_json) as group_member
+          where lower(group_member.value) = ${normalizedUserEmail}
+        )`;
+        clauses.push(sql `exists (select 1 from ${sharesTable}
+                  where ${sharesTable.resourceId} = ${resourceTable.id}
+                    and ${sharesTable.principalType} = 'group'
+                    and ${minRoleSql(minRole)}
+                    and exists (
+                      select 1 from ${groupTable} as workspace_group
+                      where workspace_group.id = ${sharesTable.principalId}
+                        and workspace_group.org_id = ${resourceTable.orgId}
+                        and workspace_group.org_id = ${orgId}
+                        and exists (
+                          select 1 from ${orgMembers} as workspace_member
+                          where workspace_member.org_id = workspace_group.org_id
+                            and lower(workspace_member.email) = ${normalizedUserEmail}
+                        )
+                        and ${groupMemberPredicate}
+                    ))`);
+    }
     return or(...clauses) ?? sql `1=0`;
 }
 function ownerScopeFilter(reg, resourceTable, ctx) {
@@ -314,6 +348,9 @@ async function resolveAccessImpl(resourceType, resourceId, rawCtx = currentAcces
         ownerMatchesActiveScope(reg, resource, ctx)) {
         return { role: "owner", resource };
     }
+    if (reg.canManageAccess && (await reg.canManageAccess(resource, ctx))) {
+        return { role: "admin", resource };
+    }
     if (resource.visibility === "public" && reg.allowPublic !== false) {
         // No share row needed; default viewer unless the resource registration
         // deliberately grants a stronger public-by-link role or explicit shares
@@ -359,12 +396,28 @@ async function highestShareRole(reg, resourceId, ctx, resource) {
     if (orgId) {
         principalClauses.push(and(eq(reg.sharesTable.principalType, "org"), eq(reg.sharesTable.principalId, orgId)));
     }
+    let best = null;
+    if (reg.supportsGroupShares && normalizedUserEmail && resource.orgId) {
+        const groupRows = await db
+            .select({
+            principalId: reg.sharesTable.principalId,
+            role: reg.sharesTable.role,
+        })
+            .from(reg.sharesTable)
+            .where(and(eq(reg.sharesTable.resourceId, resourceId), eq(reg.sharesTable.principalType, "group")));
+        for (const row of groupRows) {
+            if (await workspaceUserGroupsIncludeUser(resource.orgId, [row.principalId], normalizedUserEmail)) {
+                if (!best || ROLE_RANK[row.role] > ROLE_RANK[best]) {
+                    best = row.role;
+                }
+            }
+        }
+    }
     const rows = await db
         .select({ role: reg.sharesTable.role })
         .from(reg.sharesTable)
         .where(and(eq(reg.sharesTable.resourceId, resourceId), or(...principalClauses)))
         .limit(10);
-    let best = null;
     for (const r of rows) {
         if (!best || ROLE_RANK[r.role] > ROLE_RANK[best])
             best = r.role;

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -8,6 +8,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     policy: {
         allowPublic: boolean;
         requireOrgMemberForUserShares: boolean;
+        supportsGroupShares?: boolean;
     };
     orgId?: undefined;
     role?: undefined;
@@ -22,6 +23,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     policy: {
         allowPublic: boolean;
         requireOrgMemberForUserShares: boolean;
+        supportsGroupShares?: boolean;
     };
 }>;
 export default _default;

package/dist/sharing/actions/list-resource-shares.js

@@ -2,6 +2,7 @@ import { eq, inArray } from "drizzle-orm";
 import { z } from "zod";
 import { defineAction } from "../../action.js";
 import { organizations } from "../../org/schema.js";
+import { listWorkspaceUserGroupsForOrg } from "../../workspace-connections/groups.js";
 import { resolveAccess } from "../access.js";
 import { requireShareableResource } from "../registry.js";
 async function loadOrgDisplayNames(db, shares) {
@@ -28,6 +29,24 @@ async function loadOrgDisplayNames(db, shares) {
         return new Map();
     }
 }
+async function loadGroupDisplayNames(orgId, shares) {
+    const groupIds = Array.from(new Set(shares
+        .filter((share) => share.principalType === "group" && share.principalId)
+        .map((share) => share.principalId)));
+    if (!groupIds.length || !orgId)
+        return new Map();
+    try {
+        const groups = await listWorkspaceUserGroupsForOrg(orgId, groupIds);
+        return new Map(groups.flatMap((group) => {
+            const id = group.id;
+            const name = group.name.trim();
+            return id && name ? [[id, name]] : [];
+        }));
+    }
+    catch {
+        return new Map();
+    }
+}
 export default defineAction({
     description: "List the current visibility and share grants on a shareable resource. Any read access is sufficient.",
     schema: z.object({
@@ -42,6 +61,9 @@ export default defineAction({
             // resources that haven't opted into restrictions.
             allowPublic: reg.allowPublic !== false,
             requireOrgMemberForUserShares: reg.requireOrgMemberForUserShares === true,
+            ...(reg.supportsGroupShares === true
+                ? { supportsGroupShares: true }
+                : {}),
         };
         // Only `ownerEmail`/`orgId`/`visibility` are read below, all of which the
         // projected load carries — so the share dialog never pulls a resource's
@@ -55,6 +77,7 @@ export default defineAction({
             .from(reg.sharesTable)
             .where(eq(reg.sharesTable.resourceId, args.resourceId));
         const orgDisplayNames = await loadOrgDisplayNames(db, shares);
+        const groupDisplayNames = await loadGroupDisplayNames(access.resource.orgId, shares);
         return {
             ownerEmail: access.resource.ownerEmail ?? null,
             orgId: access.resource.orgId ?? null,
@@ -67,7 +90,9 @@ export default defineAction({
                 principalId: s.principalId,
                 displayName: s.principalType === "org"
                     ? orgDisplayNames.get(s.principalId)
-                    : undefined,
+                    : s.principalType === "group"
+                        ? groupDisplayNames.get(s.principalId)
+                        : undefined,
                 role: s.role,
                 createdAt: s.createdAt,
             })),