@agent-native/core 0.162.0 → 0.163.1

package/dist/deploy/build.js

@@ -891,6 +891,77 @@ function isTruthyRuntimeValue(value) {
   );
 }
 
+function normalizeExplicitDeploymentEnvironment(value) {
+  const normalized = firstNonEmpty(value)?.toLowerCase();
+  if (!normalized) return;
+  if (
+    normalized !== "local" &&
+    normalized !== "beta" &&
+    normalized !== "production" &&
+    normalized !== "preview"
+  ) {
+    throw new Error(
+      'AGENT_NATIVE_DEPLOYMENT_ENVIRONMENT must be "local", "beta", "production", or "preview"',
+    );
+  }
+  return normalized;
+}
+
+function normalizeFallbackDeploymentEnvironment(value) {
+  const normalized = firstNonEmpty(value)?.toLowerCase();
+  if (normalized === "development" || normalized === "test") return "local";
+  return normalized === "local" ||
+    normalized === "beta" ||
+    normalized === "production" ||
+    normalized === "preview"
+    ? normalized
+    : undefined;
+}
+
+function resolveDeploymentEnvironment() {
+  const env = globalThis.process?.env || {};
+  const explicit = normalizeExplicitDeploymentEnvironment(
+    env.AGENT_NATIVE_DEPLOYMENT_ENVIRONMENT,
+  );
+  if (explicit) return explicit;
+
+  const context = firstNonEmpty(
+    typeof env.CONTEXT === "string" ? env.CONTEXT : undefined,
+    typeof env.NETLIFY_CONTEXT === "string" ? env.NETLIFY_CONTEXT : undefined,
+    typeof env.AGENT_NATIVE_BUILD_DEPLOY_CONTEXT === "string"
+      ? env.AGENT_NATIVE_BUILD_DEPLOY_CONTEXT
+      : undefined,
+  )?.toLowerCase();
+  const branch =
+    typeof env.BRANCH === "string" ? env.BRANCH.trim().toLowerCase() : "";
+  const vercelEnv = String(env.VERCEL_ENV || "").trim().toLowerCase();
+  const sentryEnvironment = firstNonEmpty(env.SENTRY_ENVIRONMENT);
+  if (branch === "beta") return "beta";
+  if (
+    branch === "production" ||
+    (context === "production" && branch !== "beta")
+  ) {
+    return "production";
+  }
+  if (context === "branch-deploy" && branch === "main") return "beta";
+  if (
+    context === "deploy-preview" ||
+    context === "branch-deploy" ||
+    branch.startsWith("deploy-preview") ||
+    vercelEnv === "preview"
+  ) {
+    return "preview";
+  }
+  if (!context && !branch && !vercelEnv && sentryEnvironment) {
+    return normalizeFallbackDeploymentEnvironment(sentryEnvironment) || "production";
+  }
+  return (
+    normalizeFallbackDeploymentEnvironment(firstNonEmpty(context, vercelEnv)) ||
+    normalizeFallbackDeploymentEnvironment(env.NODE_ENV) ||
+    "production"
+  );
+}
+
 function getSentryClientConfigScript() {
   const env = globalThis.process?.env || {};
   const key = firstNonEmpty(env.SENTRY_CLIENT_KEY, env.VITE_SENTRY_CLIENT_KEY);
@@ -909,16 +980,15 @@ function getSentryClientConfigScript() {
       env.VITE_SENTRY_DSN,
       env.SENTRY_DSN,
     ) || (key && projectId && host ? "https://" + key + "@" + host + "/" + projectId : undefined);
-  if (!dsn) return null;
+  const deploymentEnvironment = resolveDeploymentEnvironment();
   const config = {
-    sentryDsn: dsn,
-    sentryEnvironment:
-      firstNonEmpty(
-        env.SENTRY_ENVIRONMENT,
-        env.NETLIFY_CONTEXT,
-        env.VERCEL_ENV,
-        env.NODE_ENV,
-      ) || "production",
+    ...(dsn
+      ? {
+          sentryDsn: dsn,
+          sentryEnvironment: deploymentEnvironment,
+        }
+      : {}),
+    deploymentEnvironment,
   };
   return (
     '<script data-agent-native-sentry-config>' +
@@ -3742,7 +3812,9 @@ function createBrowserOnlyServerStubPlugin() {
         },
     };
 }
-export function resolveNitroBuildReplacements(env = process.env) {
+export function resolveNitroBuildReplacements(env = process.env, deploymentEnvironment) {
+    const configuredDeploymentEnvironment = deploymentEnvironment?.trim() ||
+        env.AGENT_NATIVE_DEPLOYMENT_ENVIRONMENT?.trim();
     return {
         // Netlify exposes DEPLOY_ID only while building. Embed it into the Nitro
         // function so preview OAuth relays can target this immutable deployment
@@ -3755,7 +3827,12 @@ export function resolveNitroBuildReplacements(env = process.env) {
         // a separate server build, so embed release migration ownership here as
         // well as in the Vite server bundle.
         "process.env.AGENT_NATIVE_RELEASE_MIGRATIONS": JSON.stringify(env.AGENT_NATIVE_RELEASE_MIGRATIONS?.trim() || ""),
-        "process.env.AGENT_NATIVE_BUILD_DEPLOY_CONTEXT": JSON.stringify(env.CONTEXT?.trim() || ""),
+        "process.env.AGENT_NATIVE_BUILD_DEPLOY_CONTEXT": JSON.stringify(env.CONTEXT?.trim() || env.NETLIFY_CONTEXT?.trim() || ""),
+        ...(configuredDeploymentEnvironment
+            ? {
+                "process.env.AGENT_NATIVE_DEPLOYMENT_ENVIRONMENT": JSON.stringify(configuredDeploymentEnvironment),
+            }
+            : {}),
     };
 }
 async function buildWithNitro() {
@@ -3841,7 +3918,7 @@ export default bundle;
         virtual: {
             "virtual:agents-bundle": agentsBundleModuleSource,
         },
-        replace: resolveNitroBuildReplacements(),
+        replace: resolveNitroBuildReplacements(process.env, nitroAgentConfig.deployment?.environment),
         // Replace browser-only renderers (Excalidraw/Mermaid) with an inert proxy in
         // the server bundle. Without this, Nitro's Rolldown build pulls the real
         // Excalidraw into a shared vendor chunk imported statically by the SSR render

package/dist/extensions/schema.d.ts

@@ -316,14 +316,14 @@ export declare const extensionShares: import("drizzle-orm/sqlite-core").SQLiteTa
             tableName: string;
             dataType: "string";
             columnType: "SQLiteText";
-            data: "org" | "user";
+            data: "group" | "org" | "user";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["user", "org"];
+            enumValues: ["user", "group", "org"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/extensions/store.js

@@ -244,6 +244,9 @@ async function extensionChangeTargetsForRow(row) {
         else if (share.principalType === "org") {
             addExtensionChangeTarget(targets, { orgId: share.principalId });
         }
+        else if (share.principalType === "group" && row.orgId) {
+            addExtensionChangeTarget(targets, { orgId: row.orgId });
+        }
     }
     return Array.from(targets.values());
 }

package/dist/localization/core-messages/ar-SA.js

@@ -486,6 +486,7 @@ const messages = {
     "share.unknownPerson": "شخص غير معروف",
     "share.viewer": "مشاهد",
     "share.viewerDescription": "يمكنه العرض",
+    "share.userGroup": "مجموعة مستخدمين",
     "status.resuming": "جارٍ الاستئناف",
     "status.stillWorking": "لا يزال قيد العمل",
     "status.thinking": "يفكّر",

package/dist/localization/core-messages/de-DE.js

@@ -521,5 +521,6 @@ const messages = {
     "share.unknownPerson": "Unbekannte Person",
     "share.viewer": "Betrachter",
     "share.viewerDescription": "Kann ansehen",
+    "share.userGroup": "Benutzergruppe",
 };
 export default messages;

package/dist/localization/core-messages/en-US.d.ts

@@ -470,6 +470,7 @@ declare const messages: {
     readonly "share.unknownPerson": "Unknown person";
     readonly "share.viewer": "Viewer";
     readonly "share.viewerDescription": "Can view";
+    readonly "share.userGroup": "User group";
     readonly "status.resuming": "Resuming";
     readonly "status.stillWorking": "Still working";
     readonly "status.thinking": "Thinking";

package/dist/localization/core-messages/en-US.js

@@ -470,6 +470,7 @@ const messages = {
     "share.unknownPerson": "Unknown person",
     "share.viewer": "Viewer",
     "share.viewerDescription": "Can view",
+    "share.userGroup": "User group",
     "status.resuming": "Resuming",
     "status.stillWorking": "Still working",
     "status.thinking": "Thinking",

package/dist/localization/core-messages/es-ES.js

@@ -528,5 +528,6 @@ const messages = {
     "share.unknownPerson": "Persona desconocida",
     "share.viewer": "Lector",
     "share.viewerDescription": "Puede ver",
+    "share.userGroup": "Grupo de usuarios",
 };
 export default messages;

package/dist/localization/core-messages/fr-FR.js

@@ -528,5 +528,6 @@ const messages = {
     "share.unknownPerson": "Personne inconnue",
     "share.viewer": "Lecteur",
     "share.viewerDescription": "Peut consulter",
+    "share.userGroup": "Groupe d’utilisateurs",
 };
 export default messages;

package/dist/localization/core-messages/hi-IN.js

@@ -470,6 +470,7 @@ const messages = {
     "share.unknownPerson": "अज्ञात व्यक्ति",
     "share.viewer": "दर्शक",
     "share.viewerDescription": "देख सकता है",
+    "share.userGroup": "उपयोगकर्ता समूह",
     "status.resuming": "फिर से शुरू हो रहा है",
     "status.stillWorking": "अभी काम जारी है",
     "status.thinking": "सोच रहा है",

package/dist/localization/core-messages/ja-JP.js

@@ -466,6 +466,7 @@ const messages = {
     "share.unknownPerson": "不明なユーザー",
     "share.viewer": "閲覧者",
     "share.viewerDescription": "閲覧可能",
+    "share.userGroup": "ユーザーグループ",
     "status.resuming": "再開中",
     "status.stillWorking": "処理を続けています",
     "status.thinking": "思考中",

package/dist/localization/core-messages/ko-KR.js

@@ -466,6 +466,7 @@ const messages = {
     "share.unknownPerson": "알 수 없는 사용자",
     "share.viewer": "뷰어",
     "share.viewerDescription": "보기 가능",
+    "share.userGroup": "사용자 그룹",
     "status.resuming": "재개 중",
     "status.stillWorking": "계속 작업 중",
     "status.thinking": "생각 중",

package/dist/localization/core-messages/pt-BR.js

@@ -528,5 +528,6 @@ const messages = {
     "share.unknownPerson": "Pessoa desconhecida",
     "share.viewer": "Visualizador",
     "share.viewerDescription": "Pode visualizar",
+    "share.userGroup": "Grupo de usuários",
 };
 export default messages;

package/dist/localization/core-messages/zh-CN.js

@@ -466,6 +466,7 @@ const messages = {
     "share.unknownPerson": "未知人员",
     "share.viewer": "查看者",
     "share.viewerDescription": "可以查看",
+    "share.userGroup": "用户组",
     "status.resuming": "正在恢复",
     "status.stillWorking": "仍在处理",
     "status.thinking": "正在思考",

package/dist/localization/core-messages/zh-TW.js

@@ -466,6 +466,7 @@ const messages = {
     "share.unknownPerson": "未知人員",
     "share.viewer": "檢視者",
     "share.viewerDescription": "可以檢視",
+    "share.userGroup": "使用者群組",
     "status.resuming": "正在繼續",
     "status.stillWorking": "仍在處理",
     "status.thinking": "正在思考",

package/dist/localization/core-messages.d.ts

@@ -472,6 +472,7 @@ export declare const englishAgentChatMessages: {
     readonly "share.unknownPerson": "Unknown person";
     readonly "share.viewer": "Viewer";
     readonly "share.viewerDescription": "Can view";
+    readonly "share.userGroup": "User group";
     readonly "status.resuming": "Resuming";
     readonly "status.stillWorking": "Still working";
     readonly "status.thinking": "Thinking";

package/dist/localization/default-messages.d.ts

@@ -879,6 +879,10 @@ declare const messages: {
         owner: string;
         admin: string;
         member: string;
+        workspaceAppsDefaultPrivacy: string;
+        workspaceAppsDefaultPrivacyDescription: string;
+        workspaceAppsOrganization: string;
+        workspaceAppsCreatorOnly: string;
         members: string;
         inviteMembers: string;
         invited: string;

package/dist/localization/default-messages.js

@@ -885,6 +885,10 @@ const messages = {
         owner: "Owner",
         admin: "Admin",
         member: "Member",
+        workspaceAppsDefaultPrivacy: "New app privacy",
+        workspaceAppsDefaultPrivacyDescription: "Choose whether new workspace apps start private to their creator or visible to the organization.",
+        workspaceAppsOrganization: "Organization",
+        workspaceAppsCreatorOnly: "Creator only",
         members: "Members",
         inviteMembers: "Invite members",
         invited: "Invited",

package/dist/observability/routes.d.ts

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/tracking-identity.js

@@ -1,3 +1,4 @@
+import { resolveDeployEnvironment } from "../server/deploy-environment.js";
 function normalizeTrackingSlug(value) {
     const raw = value?.trim().toLowerCase();
     if (!raw)
@@ -44,6 +45,7 @@ export function trackingIdentityProperties() {
         normalizeTrackingSlug(process.env.VITE_APP_TEMPLATE) ||
         app;
     return {
+        deployment_environment: resolveDeployEnvironment(),
         ...(app ? { app, agent_native_app: app } : {}),
         ...(template ? { template, agent_native_template: template } : {}),
     };

package/dist/org/handlers.d.ts

@@ -1,4 +1,4 @@
-import type { OrgRole } from "./types.js";
+import type { OrgRole, WorkspaceAppDefaultVisibility } from "./types.js";
 /** GET /_agent-native/org/me — current user's active org, all orgs, pending invitations */
 export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     email: string;
@@ -23,8 +23,13 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     allowedDomain: string;
     workspaceUrl: string;
     requiredAuthProvider: "google";
+    workspaceAppDefaultVisibility: WorkspaceAppDefaultVisibility;
     a2aSecretSet: boolean;
 }>>;
+/** PUT /_agent-native/org/workspace-app-default-visibility - org admins only */
+export declare const setWorkspaceAppDefaultVisibilityHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    visibility: WorkspaceAppDefaultVisibility;
+}>>;
 /** POST /_agent-native/org — create a new organization */
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     id: string;

package/dist/org/handlers.js

@@ -35,6 +35,7 @@ import { getSession } from "../server/auth.js";
 import { renderInviteEmail } from "../server/email-templates.js";
 import { sendEmail, isEmailConfigured } from "../server/email.js";
 import { readBody } from "../server/h3-helpers.js";
+import { getOrgSetting, putOrgSetting } from "../settings/org-settings.js";
 import { setActiveOrgId } from "./active-org.js";
 import { setRequiredAuthProvider } from "./auth-policy.js";
 import { invalidateDomainMatchCache } from "./auto-join-domain.js";
@@ -42,6 +43,14 @@ import { getOrgContext, createOrganization } from "./context.js";
 import { isFreeEmailProvider } from "./free-email-providers.js";
 import { invalidateMemberOrgCaches } from "./request-org-cache.js";
 import { parseWorkspaceUrl } from "./workspace-url.js";
+const WORKSPACE_APP_DEFAULT_VISIBILITY_KEY = "workspace-app-default-visibility";
+function normalizeWorkspaceAppDefaultVisibility(value) {
+    if (value === "private" || value === "org")
+        return value;
+    if (value == null)
+        return "org";
+    throw new Error("Workspace app default visibility is invalid; refusing to widen access.");
+}
 function getInviteAppUrl(event) {
     return getAppProductionUrl(event);
 }
@@ -119,6 +128,11 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         }
     }
     const isOwnerOrAdmin = ctx.role === "owner" || ctx.role === "admin";
+    let workspaceAppDefaultVisibility = "org";
+    if (ctx.orgId) {
+        const setting = await getOrgSetting(ctx.orgId, WORKSPACE_APP_DEFAULT_VISIBILITY_KEY);
+        workspaceAppDefaultVisibility = normalizeWorkspaceAppDefaultVisibility(setting?.visibility);
+    }
     const invitesRes = await e.execute({
         // Case-insensitive match: invitations are stored with whatever case
         // the inviter typed, but the session email may be normalized
@@ -147,6 +161,7 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         allowedDomain,
         workspaceUrl,
         requiredAuthProvider,
+        workspaceAppDefaultVisibility,
         // Never serialize the A2A secret here. This route runs on every page load,
         // so the value would sit in JSON any script on the page can read, and it
         // signs the JWTs peers accept as first-party callers. Reveal is an explicit
@@ -154,6 +169,34 @@ export const getMyOrgHandler = defineEventHandler(async (event) => {
         a2aSecretSet: isOwnerOrAdmin ? a2aSecretSet : undefined,
     };
 });
+/** PUT /_agent-native/org/workspace-app-default-visibility - org admins only */
+export const setWorkspaceAppDefaultVisibilityHandler = defineEventHandler(async (event) => {
+    const ctx = await getOrgContext(event);
+    if (ctx.role !== "owner" && ctx.role !== "admin") {
+        throw createError({
+            statusCode: 403,
+            message: "Only organization admins can change app defaults.",
+        });
+    }
+    if (!ctx.orgId) {
+        throw createError({
+            statusCode: 400,
+            message: "Join an organization before changing app defaults.",
+        });
+    }
+    const body = await readBody(event);
+    if (body?.visibility !== "private" && body?.visibility !== "org") {
+        throw createError({
+            statusCode: 400,
+            message: "visibility must be either private or org.",
+        });
+    }
+    const visibility = body.visibility;
+    await putOrgSetting(ctx.orgId, WORKSPACE_APP_DEFAULT_VISIBILITY_KEY, {
+        visibility,
+    });
+    return { visibility };
+});
 /** POST /_agent-native/org — create a new organization */
 export const createOrgHandler = defineEventHandler(async (event) => {
     const session = await getSession(event);

package/dist/org/index.d.ts

@@ -1,4 +1,4 @@
-export type { OrgRole, OrgContext, OrgSummary, OrgInvitationSummary, OrgInfo, OrgMember, OrgPendingInvitation, RequiredAuthProvider, } from "./types.js";
+export type { OrgRole, OrgContext, OrgSummary, OrgInvitationSummary, OrgInfo, OrgMember, OrgPendingInvitation, RequiredAuthProvider, WorkspaceAppDefaultVisibility, } from "./types.js";
 export { canInviteOrgMembers, canManageOrg, canManageOrgDomain, orgRoleAtLeast, orgRoleRank, } from "./permissions.js";
 export { getOrgContext, getOrgDomain, getOrgA2ASecret, getA2ASecretByDomain, resolveOrgByDomain, resolveOrgIdForEmail, createOrganization, } from "./context.js";
 export { implicitServiceOrgRole, parseServiceIdentityEmail, } from "./service-identity.js";
@@ -11,8 +11,8 @@ export type { AppRoles, AppRolesDescriptor, AppRoleCaller, AppRoleLookup, AppMem
 export { ORG_MIGRATIONS } from "./migrations.js";
 export { getRequiredAuthProviderForEmail, getRequiredAuthProviderForOrg, isGoogleSignInRequiredForEmail, setRequiredAuthProvider, } from "./auth-policy.js";
 export { createOrgPlugin, defaultOrgPlugin } from "./plugin.js";
-export { organizations, orgMembers, orgInvitations, appMemberRoles, } from "./schema.js";
-export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setRequiredAuthProviderHandler, } from "./handlers.js";
+export { organizations, orgMembers, orgInvitations, appMemberRoles, workspaceApps, workspaceAppShares, } from "./schema.js";
+export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setRequiredAuthProviderHandler, setWorkspaceAppDefaultVisibilityHandler, } from "./handlers.js";
 export { listAppRolesHandler, setAppRoleHandler, } from "./app-roles-handlers.js";
 export { isFreeEmailProvider } from "./free-email-providers.js";
 export { isOrgMember } from "./membership.js";

package/dist/org/index.js

@@ -10,10 +10,10 @@ export { getRequiredAuthProviderForEmail, getRequiredAuthProviderForOrg, isGoogl
 export { createOrgPlugin, defaultOrgPlugin } from "./plugin.js";
 // Drizzle schema (re-exported so templates can write typed queries against
 // org tables without redefining the schema themselves).
-export { organizations, orgMembers, orgInvitations, appMemberRoles, } from "./schema.js";
+export { organizations, orgMembers, orgInvitations, appMemberRoles, workspaceApps, workspaceAppShares, } from "./schema.js";
 // Individual handlers — exported so templates can compose a custom org plugin
 // while still using the framework-provided handlers.
-export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setRequiredAuthProviderHandler, } from "./handlers.js";
+export { getMyOrgHandler, createOrgHandler, updateOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setRequiredAuthProviderHandler, setWorkspaceAppDefaultVisibilityHandler, } from "./handlers.js";
 export { listAppRolesHandler, setAppRoleHandler, } from "./app-roles-handlers.js";
 export { isFreeEmailProvider } from "./free-email-providers.js";
 export { isOrgMember } from "./membership.js";

package/dist/org/migrations.js

@@ -132,4 +132,37 @@ export const ORG_MIGRATIONS = [
         version: 1014,
         sql: `ALTER TABLE organizations ADD COLUMN IF NOT EXISTS required_auth_provider TEXT`,
     },
+    {
+        version: 1015,
+        sql: `CREATE TABLE IF NOT EXISTS workspace_apps (
+      id TEXT PRIMARY KEY,
+      owner_email TEXT NOT NULL,
+      org_id TEXT,
+      visibility TEXT NOT NULL DEFAULT 'org',
+      name TEXT NOT NULL,
+      description TEXT,
+      path TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL
+    )`,
+    },
+    {
+        version: 1016,
+        sql: `CREATE TABLE IF NOT EXISTS workspace_app_shares (
+      id TEXT PRIMARY KEY,
+      resource_id TEXT NOT NULL,
+      principal_type TEXT NOT NULL,
+      principal_id TEXT NOT NULL,
+      role TEXT NOT NULL DEFAULT 'viewer',
+      created_at TEXT NOT NULL,
+      created_by TEXT NOT NULL DEFAULT '',
+      UNIQUE(resource_id, principal_type, principal_id)
+    )`,
+    },
+    {
+        version: 1017,
+        name: "workspace-app-access-indexes",
+        sql: `CREATE INDEX IF NOT EXISTS workspace_apps_org_visibility_idx
+          ON workspace_apps (org_id, visibility)`,
+    },
 ];

package/dist/org/plugin.js

@@ -2,7 +2,7 @@ import { defineEventHandler, setResponseStatus, getMethod, getRequestURL, } from
 import { runMigrations } from "../db/migrations.js";
 import { awaitBootstrap, getH3App, FRAMEWORK_PREFIX, markDefaultPluginProvided, } from "../server/framework-request-handler.js";
 import { listAppRolesHandler, setAppRoleHandler, } from "./app-roles-handlers.js";
-import { getMyOrgHandler, createOrgHandler, updateOrgHandler, deleteOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, joinByDomainHandler, setDomainHandler, setWorkspaceUrlHandler, setRequiredAuthProviderHandler, revealA2ASecretHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, } from "./handlers.js";
+import { getMyOrgHandler, createOrgHandler, updateOrgHandler, deleteOrgHandler, switchOrgHandler, listMembersHandler, removeMemberHandler, changeMemberRoleHandler, listInvitationsHandler, createInvitationHandler, acceptInvitationHandler, joinByDomainHandler, setDomainHandler, setWorkspaceUrlHandler, setRequiredAuthProviderHandler, revealA2ASecretHandler, setA2ASecretHandler, syncA2ASecretHandler, receiveA2ASecretHandler, setWorkspaceAppDefaultVisibilityHandler, } from "./handlers.js";
 import { ORG_MIGRATIONS } from "./migrations.js";
 const ORG_PREFIX = `${FRAMEWORK_PREFIX}/org`;
 /**
@@ -97,6 +97,15 @@ export function createOrgPlugin() {
             }
             return removeMemberHandler(event);
         }));
+        // PUT /workspace-app-default-visibility — org admins choose the default
+        // for newly created workspace apps. Existing apps retain their setting.
+        app.use(`${ORG_PREFIX}/workspace-app-default-visibility`, defineEventHandler(async (event) => {
+            if (getMethod(event) !== "PUT") {
+                setResponseStatus(event, 405);
+                return { error: "Method not allowed" };
+            }
+            return setWorkspaceAppDefaultVisibilityHandler(event);
+        }));
         // /invitations and /invitations/:id/accept — same pattern.
         app.use(`${ORG_PREFIX}/invitations`, defineEventHandler(async (event) => {
             const tail = getRequestURL(event).pathname || "/";