@agent-native/core 0.162.0 → 0.163.1

package/corpus/templates/slides/app/components/layout/Header.tsx

@@ -1,5 +1,6 @@
 import { AgentToggleButton } from "@agent-native/core/client/agent-chat";
 import { useT } from "@agent-native/core/client/i18n";
+import { NotificationsBell } from "@agent-native/core/client/notifications";
 import { RunsTray } from "@agent-native/core/client/progress";
 import {
   useHeaderTitle,
@@ -68,6 +69,7 @@ export function Header() {
       </div>
       <div className="flex items-center gap-2 shrink-0">
         {actions}
+        <NotificationsBell pollMs={30_000} />
         <RunsTray pollMs={0} />
         <AgentToggleButton />
       </div>

package/corpus/templates/slides/app/hooks/use-deck-access.ts

@@ -0,0 +1,51 @@
+import {
+  useActionMutation,
+  useActionQuery,
+} from "@agent-native/core/client/hooks";
+import { toast } from "sonner";
+
+export type DeckAccessStatusResponse = {
+  exists: boolean;
+  hasAccess: boolean;
+  signedIn: boolean;
+  viewerEmail: string | null;
+  viewerName: string | null;
+  role: "owner" | "viewer" | "commenter" | "editor" | "admin" | null;
+  visibility: "private" | "org" | "public" | null;
+};
+
+export function useDeckAccessStatus(deckId?: string) {
+  return useActionQuery<DeckAccessStatusResponse>(
+    "get-deck-access-status",
+    { deckId: deckId ?? "" },
+    {
+      enabled: Boolean(deckId),
+      retry: false,
+    },
+  );
+}
+
+export type RequestDeckAccessResult = {
+  ok: true;
+  alreadyHasAccess: boolean;
+  notifiedOwner: boolean;
+  requestId?: string;
+  message: string;
+};
+
+function showActionError(message: string) {
+  return (error: Error) => {
+    toast.error(
+      error.message
+        ? error.message.replace(/^Action [\w-]+ failed:\s*/, "")
+        : message,
+    );
+  };
+}
+
+export function useRequestDeckAccess() {
+  return useActionMutation<RequestDeckAccessResult, { deckId: string }>(
+    "request-deck-access",
+    { onError: showActionError("Failed to request access") },
+  );
+}

package/corpus/templates/slides/app/i18n/en-US.ts

@@ -565,6 +565,18 @@ const messages = {
       "This link points to a team presentation. Join the team shown above and the deck will open here automatically.",
     deckUnavailableDescription:
       "This deck may have been removed, or your account does not have access to it.",
+    privateDeckTitle: "This deck is private",
+    privateDeckDescription:
+      "Ask the owner for access to open this deck. They’ll be notified when you send a request.",
+    signedInAs: "You're signed in as",
+    accessRequestSentDescription:
+      "The owner has been notified. You can open this deck once access is granted.",
+    accessRequestRecordedDescription:
+      "Your request has been recorded. You can open this deck once access is granted.",
+    requestAccessPending: "Sending request...",
+    accessRequestSent: "Request sent",
+    requestAccess: "Request access",
+    signInToRequestAccess: "Sign in to request access",
     backToDecks: "Back to Decks",
     tryAgain: "Try again",
     imageUploadFailed: "Image upload failed",

package/corpus/templates/slides/app/lib/deck-editor-loading.ts

@@ -12,6 +12,7 @@ export function shouldShowDeckEditorSkeleton({
   accessCheckKey,
   checkedAccessKey,
   retrying,
+  privateDeckAccessConfirmed,
 }: {
   deckFound: boolean;
   decksLoading: boolean;
@@ -19,7 +20,13 @@ export function shouldShowDeckEditorSkeleton({
   accessCheckKey: string | null;
   checkedAccessKey: string | null;
   retrying: boolean;
+  privateDeckAccessConfirmed: boolean;
 }): boolean {
+  // A private deck intentionally returns 404 from the content action. The
+  // metadata-only access check is the source of truth for this state, so do
+  // not leave the user on the editor skeleton while that protected fetch
+  // settles.
+  if (privateDeckAccessConfirmed) return false;
   if (decksLoading) return true;
   if (deckFound || !accessCheckKey) return false;
   return orgLoading || checkedAccessKey !== accessCheckKey || retrying;

package/corpus/templates/slides/app/pages/DeckEditor.tsx

@@ -1,5 +1,8 @@
 import { useGuidedQuestionFlow } from "@agent-native/core/client/agent-chat";
-import { appBasePath } from "@agent-native/core/client/api-path";
+import {
+  agentNativePath,
+  appBasePath,
+} from "@agent-native/core/client/api-path";
 import {
   useCollaborativeDoc,
   emailToColor,
@@ -8,6 +11,7 @@ import {
 import { useSession } from "@agent-native/core/client/hooks";
 import { useT } from "@agent-native/core/client/i18n";
 import { useOrg } from "@agent-native/core/client/org";
+import { buildSignInReturnHref } from "@agent-native/core/client/ui";
 import {
   DndContext,
   closestCenter,
@@ -17,9 +21,13 @@ import {
   DragEndEvent,
 } from "@dnd-kit/core";
 import {
+  IconAt,
   IconArrowLeft,
   IconLock,
+  IconLoader2,
+  IconLogin2,
   IconRefresh,
+  IconUserPlus,
   IconUsersGroup,
 } from "@tabler/icons-react";
 import { nanoid } from "nanoid";
@@ -67,6 +75,11 @@ import {
   useSaveState,
 } from "@/context/DeckContext";
 import { useAgentGenerating } from "@/hooks/use-agent-generating";
+import {
+  useDeckAccessStatus,
+  useRequestDeckAccess,
+  type DeckAccessStatusResponse,
+} from "@/hooks/use-deck-access";
 import { useDeckDesignSystem } from "@/hooks/use-deck-design-system";
 import { useDeckPresence } from "@/hooks/use-deck-presence";
 import { useDeckRole } from "@/hooks/use-deck-role";
@@ -109,37 +122,70 @@ import { shortcutLabel } from "@/lib/utils";
 type EditorSidePanel = "comments" | null;
 
 function MissingDeckAccessPane({
+  accessStatus,
+  accessStatusError,
+  accessStatusLoading,
   hasTeamJoinOption,
   orgLoading,
   orgError,
+  requestAccessPending,
+  accessRequestSent,
+  accessRequestNotified,
+  signedIn,
+  viewerEmail,
   refreshing,
+  onRequestAccess,
+  onSignIn,
   onRetry,
   onBack,
 }: {
+  accessStatus: DeckAccessStatusResponse | null;
+  accessStatusError: boolean;
+  accessStatusLoading: boolean;
   hasTeamJoinOption: boolean;
   orgLoading: boolean;
   orgError: boolean;
+  requestAccessPending: boolean;
+  accessRequestSent: boolean;
+  accessRequestNotified: boolean;
+  signedIn: boolean;
+  viewerEmail: string | null;
   refreshing: boolean;
+  onRequestAccess: () => void;
+  onSignIn: () => void;
   onRetry: () => void;
   onBack: () => void;
 }) {
   const t = useT();
+  const privateDeck = Boolean(
+    accessStatus?.exists &&
+    !accessStatus.hasAccess &&
+    accessStatus.visibility === "private",
+  );
+  const checkingAccess = !privateDeck && (accessStatusLoading || orgLoading);
+  const accessCheckFailed = accessStatusError || orgError;
   const Icon =
-    hasTeamJoinOption || orgLoading || orgError ? IconUsersGroup : IconLock;
-  const title = orgLoading
+    privateDeck || (!hasTeamJoinOption && !checkingAccess && !accessCheckFailed)
+      ? IconLock
+      : IconUsersGroup;
+  const title = checkingAccess
     ? t("deckEditor.lookingForDeck")
-    : orgError
-      ? t("deckEditor.teamAccessCheckFailed")
-      : hasTeamJoinOption
-        ? t("deckEditor.joinTeamToOpen")
-        : t("deckEditor.deckUnavailable");
-  const description = orgLoading
+    : privateDeck
+      ? t("deckEditor.privateDeckTitle")
+      : accessCheckFailed
+        ? t("deckEditor.teamAccessCheckFailed")
+        : hasTeamJoinOption
+          ? t("deckEditor.joinTeamToOpen")
+          : t("deckEditor.deckUnavailable");
+  const description = checkingAccess
     ? t("deckEditor.checkingSharedAccess")
-    : orgError
-      ? t("deckEditor.verifySharedAccessFailed")
-      : hasTeamJoinOption
-        ? t("deckEditor.joinTeamDescription")
-        : t("deckEditor.deckUnavailableDescription");
+    : privateDeck
+      ? t("deckEditor.privateDeckDescription")
+      : accessCheckFailed
+        ? t("deckEditor.verifySharedAccessFailed")
+        : hasTeamJoinOption
+          ? t("deckEditor.joinTeamDescription")
+          : t("deckEditor.deckUnavailableDescription");
 
   return (
     <div className="flex min-h-screen items-center justify-center bg-background px-4 py-10">
@@ -153,21 +199,64 @@ function MissingDeckAccessPane({
           </div>
         </div>
         <p className="text-sm leading-6 text-muted-foreground">{description}</p>
-        <div className="mt-5 flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
-          <Button type="button" variant="outline" onClick={onBack}>
-            <IconArrowLeft className="size-4" />
-            {t("deckEditor.backToDecks")}
-          </Button>
-          <Button
-            type="button"
-            onClick={onRetry}
-            disabled={refreshing || orgLoading}
-          >
-            <IconRefresh
-              className={refreshing ? "size-4 animate-spin" : "size-4"}
-            />
-            {t("deckEditor.tryAgain")}
-          </Button>
+        {privateDeck && viewerEmail ? (
+          <div className="mt-4 flex items-center gap-2 rounded-md border border-border bg-muted/35 px-3 py-2 text-sm">
+            <IconAt className="size-4 shrink-0 text-muted-foreground" />
+            <span className="min-w-0 truncate text-muted-foreground">
+              {t("deckEditor.signedInAs")}{" "}
+              <span className="font-medium text-foreground">{viewerEmail}</span>
+            </span>
+          </div>
+        ) : null}
+        {privateDeck && accessRequestSent ? (
+          <div className="mt-3 rounded-md border border-emerald-500/25 bg-emerald-500/10 px-3 py-2 text-sm text-emerald-700 dark:text-emerald-300">
+            {t(
+              accessRequestNotified
+                ? "deckEditor.accessRequestSentDescription"
+                : "deckEditor.accessRequestRecordedDescription",
+            )}
+          </div>
+        ) : null}
+        <div className="mt-5 flex flex-col gap-2">
+          {privateDeck ? (
+            <Button
+              type="button"
+              onClick={signedIn ? onRequestAccess : onSignIn}
+              disabled={requestAccessPending || accessRequestSent}
+            >
+              {requestAccessPending ? (
+                <IconLoader2 className="size-4 animate-spin" />
+              ) : signedIn ? (
+                <IconUserPlus className="size-4" />
+              ) : (
+                <IconLogin2 className="size-4" />
+              )}
+              {requestAccessPending
+                ? t("deckEditor.requestAccessPending")
+                : accessRequestSent
+                  ? t("deckEditor.accessRequestSent")
+                  : signedIn
+                    ? t("deckEditor.requestAccess")
+                    : t("deckEditor.signInToRequestAccess")}
+            </Button>
+          ) : null}
+          <div className="flex flex-col-reverse gap-2 sm:flex-row sm:justify-end">
+            <Button type="button" variant="outline" onClick={onBack}>
+              <IconArrowLeft className="size-4" />
+              {t("deckEditor.backToDecks")}
+            </Button>
+            <Button
+              type="button"
+              variant={privateDeck ? "ghost" : "default"}
+              onClick={onRetry}
+              disabled={refreshing || checkingAccess}
+            >
+              <IconRefresh
+                className={refreshing ? "size-4 animate-spin" : "size-4"}
+              />
+              {t("deckEditor.tryAgain")}
+            </Button>
+          </div>
         </div>
       </div>
     </div>
@@ -200,6 +289,7 @@ export default function DeckEditor() {
   const { id } = useParams<{ id: string }>();
   const navigate = useNavigate();
   const [searchParams, setSearchParams] = useSearchParams();
+  const { session, isLoading: sessionLoading } = useSession();
   const {
     getDeck,
     reloadDecks,
@@ -219,6 +309,8 @@ export default function DeckEditor() {
     loading,
     loadError,
   } = useDecks();
+  const deckAccessStatusQuery = useDeckAccessStatus(id);
+  const requestDeckAccessMutation = useRequestDeckAccess();
   const [activeSlideId, setActiveSlideId] = useState<string | null>(null);
   const [inlineEditActive, setInlineEditActive] = useState(false);
   const [addSlideGenerating, setAddSlideGenerating] = useState(false);
@@ -294,6 +386,10 @@ export default function DeckEditor() {
   const [wideContextToolbarSlot, setWideContextToolbarSlot] =
     useState<HTMLDivElement | null>(null);
   const [retryingMissingDeck, setRetryingMissingDeck] = useState(false);
+  const [accessRequestSentDeckId, setAccessRequestSentDeckId] = useState<
+    string | null
+  >(null);
+  const [accessRequestNotified, setAccessRequestNotified] = useState(false);
   const [checkedDeckAccessKey, setCheckedDeckAccessKey] = useState<
     string | null
   >(null);
@@ -349,6 +445,7 @@ export default function DeckEditor() {
   const uploadInputRef = useRef<HTMLInputElement>(null);
 
   const deck = getDeck(id || "");
+  const deckAccessStatus = deckAccessStatusQuery.data ?? null;
   const fitDims = getAspectRatioDims(deck?.aspectRatio);
   const currentDeckAccessKey = deckAccessCheckKey(id, org?.orgId);
   const hasTeamJoinOption =
@@ -511,6 +608,32 @@ export default function DeckEditor() {
     }
   }, [refetchOrg, reloadDecks]);
 
+  const openSignIn = useCallback(() => {
+    window.location.href = buildSignInReturnHref();
+  }, []);
+
+  const requestDeckAccess = useCallback(() => {
+    if (!id) return;
+    requestDeckAccessMutation.mutate(
+      { deckId: id },
+      {
+        onSuccess: (result) => {
+          setAccessRequestSentDeckId(id);
+          setAccessRequestNotified(result.notifiedOwner);
+          toast.success(result.message);
+          if (result.alreadyHasAccess) void reloadDecks();
+        },
+      },
+    );
+  }, [id, reloadDecks, requestDeckAccessMutation]);
+
+  useEffect(() => {
+    if (accessRequestSentDeckId && accessRequestSentDeckId !== id) {
+      setAccessRequestSentDeckId(null);
+      setAccessRequestNotified(false);
+    }
+  }, [accessRequestSentDeckId, id]);
+
   // The final generation write can race the last sync event. Pull the
   // authoritative open deck when the run settles so a stale canvas does not
   // require a browser refresh to reveal completed slides.
@@ -1204,7 +1327,6 @@ export default function DeckEditor() {
     useRef<typeof deck extends undefined ? null : any>(null);
 
   // Session for collab user identity
-  const { session } = useSession();
   const currentUser = session?.email
     ? {
         email: session.email,
@@ -1242,7 +1364,7 @@ export default function DeckEditor() {
     recentEdits: deckRecentEdits,
     awareness: deckPresenceAwareness,
   } = useDeckPresence({
-    deckId: id ?? null,
+    deckId: deck ? (id ?? null) : null,
     activeSlideId: activeSlideId,
     user: currentUser,
   });
@@ -1254,7 +1376,10 @@ export default function DeckEditor() {
   const agentActive = generating || deckAgentActive || slideAgentActive;
 
   // Comments for the current slide (for badge count)
-  const currentSlideCommentsQuery = useSlideComments(id ?? null, activeSlideId);
+  const currentSlideCommentsQuery = useSlideComments(
+    deck ? (id ?? null) : null,
+    activeSlideId,
+  );
   const currentSlideThreads: CommentThread[] =
     currentSlideCommentsQuery.data ?? [];
   const unresolvedCommentCount = currentSlideThreads.filter(
@@ -1269,6 +1394,11 @@ export default function DeckEditor() {
       accessCheckKey: currentDeckAccessKey,
       checkedAccessKey: checkedDeckAccessKey,
       retrying: retryingMissingDeck,
+      privateDeckAccessConfirmed: Boolean(
+        deckAccessStatus?.exists &&
+        !deckAccessStatus.hasAccess &&
+        deckAccessStatus.visibility === "private",
+      ),
     })
   ) {
     return <DeckEditorSkeleton label={t("deckEditor.lookingForDeck")} />;
@@ -1276,10 +1406,20 @@ export default function DeckEditor() {
   if (!deck || !id) {
     return (
       <MissingDeckAccessPane
+        accessStatus={deckAccessStatus}
+        accessStatusError={deckAccessStatusQuery.isError}
+        accessStatusLoading={loading || deckAccessStatusQuery.isLoading}
         hasTeamJoinOption={hasTeamJoinOption}
         orgLoading={orgLoading}
         orgError={orgError || loadError}
+        requestAccessPending={requestDeckAccessMutation.isPending}
+        accessRequestSent={accessRequestSentDeckId === id}
+        accessRequestNotified={accessRequestNotified}
+        signedIn={Boolean(session) && !sessionLoading}
+        viewerEmail={session?.email ?? deckAccessStatus?.viewerEmail ?? null}
         refreshing={retryingMissingDeck}
+        onRequestAccess={requestDeckAccess}
+        onSignIn={openSignIn}
         onRetry={() => void retryOpenDeck()}
         onBack={() => navigate("/")}
       />
@@ -1629,7 +1769,7 @@ export default function DeckEditor() {
               slideAgentActive ||
               (deckAgentActive && agentSlideId === currentSlide.id) ||
               (isNewDeckGenerating &&
-                currentSlide.id === deck.slides.at(-1)?.id)
+                currentSlide.id === deck.slides[deck.slides.length - 1]?.id)
             }
             recentEdits={deckRecentEdits}
             onComment={(quotedText) => {

package/corpus/templates/slides/changelog/2026-08-18-private-deck-links-now-explain-access-and-let-viewers-notify.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-18
+---
+
+Private deck links now explain access and let viewers notify the owner

package/corpus/templates/slides/server/db/schema.ts

@@ -83,3 +83,13 @@ export const slideComments = table("slide_comments", {
   createdAt: text("created_at").notNull().default(now()),
   updatedAt: text("updated_at").notNull().default(now()),
 });
+
+export const deckEvents = table("deck_events", {
+  id: text("id").primaryKey(),
+  deckId: text("deck_id").notNull(),
+  type: text("type").notNull(),
+  message: text("message").notNull(),
+  payload: text("payload"),
+  createdBy: text("created_by").notNull().default("human"),
+  createdAt: text("created_at").notNull().default(now()),
+});

package/corpus/templates/slides/server/handlers/request-auth-context.ts

@@ -21,6 +21,7 @@ export interface SlidesRequestAuthContext {
  */
 export class SlidesSessionLookupError extends Error {
   readonly statusCode = 503;
+  readonly cause: unknown;
   constructor(cause: unknown) {
     super("Could not verify your session. Please try again.");
     this.name = "SlidesSessionLookupError";

package/corpus/templates/slides/server/plugins/db.ts

@@ -235,6 +235,23 @@ export const runSlidesMigrations = runMigrations(
       name: "slides-share-design-system-snapshot",
       sql: `ALTER TABLE deck_share_links ADD COLUMN IF NOT EXISTS design_system_data TEXT`,
     },
+    // v22: durable access-request events for private deck links. The request
+    // action also sends the owner an email when outbound email is configured,
+    // but the event remains the source of truth when it is not.
+    {
+      version: 22,
+      name: "slides-deck-access-requests",
+      sql: `CREATE TABLE IF NOT EXISTS deck_events (
+    id TEXT PRIMARY KEY,
+    deck_id TEXT NOT NULL,
+    type TEXT NOT NULL,
+    message TEXT NOT NULL,
+    payload TEXT,
+    created_by TEXT NOT NULL DEFAULT 'human',
+    created_at TEXT NOT NULL DEFAULT (datetime('now'))
+  );
+  CREATE INDEX IF NOT EXISTS deck_events_deck_created_idx ON deck_events (deck_id, created_at)`,
+    },
   ],
   { table: "slides_migrations" },
 );

package/corpus/templates/tasks/.agents/skills/sharing/SKILL.md

@@ -18,6 +18,11 @@ Any resource a user **creates** (dashboards, documents, forms, decks, compositio
 
 This is the framework-level primitive. Every ownable resource gets it for free — same API, same UI, same skill.
 
+Workspace apps are the intentional organization-scoped exception: their default
+visibility is `org`, configurable by an organization owner/admin. The creator is
+stored as the app owner, and the creator or an organization owner/admin can
+change the app's visibility or manage its share grants.
+
 ## Concepts
 
 ### Three visibility levels
@@ -26,7 +31,8 @@ This is the framework-level primitive. Every ownable resource gets it for free
 - **`org`** — owner + explicit grants + anyone in the same org (read-only).
 - **`public`** — owner + explicit grants + **anyone with the link** (read-only). Public docs do NOT appear in other users' list/sidebar/search results — `accessFilter` omits them by default. They're reachable by id (`resolveAccess` admits them) so direct links and SSR routes like `/p/:id` keep working. If a list endpoint legitimately needs cross-user public discovery (a template gallery, etc.), pass `accessFilter(table, shares, ctx, minRole, { includePublic: true })`.
 
-Visibility is coarse. Explicit share grants are fine-grained (per user or per org).
+Visibility is coarse. Explicit share grants are fine-grained (per user, reusable
+organization group, or per org).
 
 ### Roles on a share grant
 
@@ -101,6 +107,7 @@ registerShareableResource({
   // ...
   allowPublic: false, // hides "Public" in the share dialog and rejects it server-side
   requireOrgMemberForUserShares: true, // user shares must target an org member or pending invitee
+  supportsGroupShares: true, // enable reusable organization groups for this resource
 });
 ```
 
@@ -111,6 +118,21 @@ Use both for resources that execute code or expose privileged data with the *vie
 
 Defaults match historical behaviour: `allowPublic: true`, `requireOrgMemberForUserShares: false`. Resources that don't set the flags work as before.
 
+### Reusable organization groups
+
+The workspace organization model stores reusable groups in
+`workspace_user_groups`. Organization owners/admins manage the groups and their
+members through the existing group actions. Set `supportsGroupShares: true` on a
+resource registration to enable `principalType: "group"` in the generic share
+actions and the shared popover's autocomplete. Group ids are always checked
+against the resource's organization, and membership is evaluated at access time
+so group changes apply to existing shares.
+
+Workspace apps opt into this flag and use the organization default visibility
+setting. The app creator is the durable `owner_email`, while organization
+owners/admins receive admin access through the registration's
+`canManageAccess` callback.
+
 ## Filter list/read queries
 
 ```ts
@@ -197,6 +219,9 @@ All app share popovers should use the same compact surface contract:
 - Add `ShareAgentsSection` only when the resource has a real agent-readable
   link or prompt. Keep it collapsed by default and supply domain-specific
   content through the shared section shell.
+- When `supportsGroupShares` is enabled, keep the existing people input as the
+  only entry point and include organization groups in its autocomplete. Do not
+  add a separate group-management surface to each resource.
 - App-specific tabs or controls may remain when they represent a real domain
   action (for example, an embed-code editor), but they should retain the same
   trigger, copy-row, access, and spacing language.
@@ -211,7 +236,7 @@ The framework auto-mounts these actions in every template — no per-template bo
 
 | Action                     | Args                                                                           | Purpose                                   |
 | -------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------- |
-| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
+| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?, message?` | Grant a user, group, or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link and `message` an optional short note for the notification email. |
 | `unshare-resource`         | `resourceType, resourceId, principalType, principalId`                         | Revoke access.                            |
 | `list-resource-shares`     | `resourceType, resourceId`                                                     | Current visibility + all share grants.    |
 | `set-resource-visibility`  | `resourceType, resourceId, visibility`                                         | Change to `private` / `org` / `public`.  |

package/dist/app-config/schema.d.ts

@@ -43,6 +43,7 @@ export declare const appConfigSchema: z.ZodObject<{
         isWorkspace: z.ZodOptional<z.ZodBoolean>;
         appsJson: z.ZodOptional<z.ZodString>;
         gatewayUrl: z.ZodOptional<z.ZodString>;
+        orgDirectoryUrl: z.ZodOptional<z.ZodString>;
         oauthOrigin: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;

package/dist/app-config/workspace.d.ts

@@ -19,5 +19,6 @@ export declare const workspaceConfig: z.ZodObject<{
     isWorkspace: z.ZodOptional<z.ZodBoolean>;
     appsJson: z.ZodOptional<z.ZodString>;
     gatewayUrl: z.ZodOptional<z.ZodString>;
+    orgDirectoryUrl: z.ZodOptional<z.ZodString>;
     oauthOrigin: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;

package/dist/app-config/workspace.js

@@ -42,6 +42,14 @@ export const workspaceConfig = z.object({
         env: ["WORKSPACE_GATEWAY_URL", "VITE_WORKSPACE_GATEWAY_URL"],
         doc: "URL of the workspace gateway fronting this app.",
     }),
+    orgDirectoryUrl: z
+        .string()
+        .min(1)
+        .optional()
+        .meta({
+        env: ["AGENT_NATIVE_ORG_DIRECTORY_URL"],
+        doc: "URL of the authoritative organization Dispatch directory.",
+    }),
     oauthOrigin: z
         .string()
         .min(1)

package/dist/chat-threads/schema.d.ts

@@ -403,14 +403,14 @@ export declare const chatThreadShares: import("drizzle-orm/sqlite-core").SQLiteT
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "org" | "user";
+            data: "group" | "org" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "org"];
+            enumValues: ["user", "group", "org"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/client/analytics.d.ts

@@ -21,6 +21,7 @@ declare global {
             workspaceRuntime?: boolean;
             sentryDsn?: string;
             sentryEnvironment?: string;
+            deploymentEnvironment?: string;
             /**
              * Public PostHog project key + host. Publishable and identical for every
              * visitor, so it ships inside the CDN-cached SSR shell alongside the