@agent-native/core 0.201.1 → 0.202.0-nightly-20261006033736

package/dist/sharing/actions/approve-resource-access-request.d.ts

@@ -0,0 +1,10 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    requestId: string;
+    generation: number;
+    role?: "admin" | "commenter" | "editor" | "viewer";
+}, {
+    state: "approved";
+    role: import("../schema.js").ShareRole;
+    email: import("../access-requests.js").AccessGrantedEmail;
+}>;
+export default _default;

package/dist/sharing/actions/approve-resource-access-request.js

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { approveAccessRequest } from "../access-requests.js";
+export default defineAction({
+    description: "Allow a pending access request, giving the requester a role on the resource under the same sharing rules as Share. A stronger role they already hold is kept. `email` says whether the requester was emailed: sent, skipped, or failed.",
+    schema: z.object({
+        requestId: z.string().min(1),
+        generation: z.number().int().positive(),
+        role: z.enum(["viewer", "commenter", "editor", "admin"]).default("viewer"),
+    }),
+    agentTool: false,
+    mcpTool: false,
+    toolCallable: false,
+    run: (args) => approveAccessRequest(args),
+});

package/dist/sharing/actions/decline-resource-access-request.d.ts

@@ -0,0 +1,7 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    requestId: string;
+    generation: number;
+}, {
+    state: "declined";
+}>;
+export default _default;

package/dist/sharing/actions/decline-resource-access-request.js

@@ -0,0 +1,14 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { declineAccessRequest } from "../access-requests.js";
+export default defineAction({
+    description: "Decline a pending access request. The requester isn't told, and can ask again after a cooldown.",
+    schema: z.object({
+        requestId: z.string().min(1),
+        generation: z.number().int().positive(),
+    }),
+    agentTool: false,
+    mcpTool: false,
+    toolCallable: false,
+    run: (args) => declineAccessRequest(args),
+});

package/dist/sharing/actions/get-resource-access-request.d.ts

@@ -0,0 +1,4 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    requestId: string;
+}, import("../access-requests.js").AccessRequestReview>;
+export default _default;

package/dist/sharing/actions/get-resource-access-request.js

@@ -0,0 +1,13 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { getAccessRequestReview } from "../access-requests.js";
+export default defineAction({
+    description: "Read one access request for review: who asked, for which resource, and whether it is still pending. Only someone who manages access to the resource can read it.",
+    schema: z.object({ requestId: z.string().min(1) }),
+    http: { method: "GET" },
+    readOnly: true,
+    agentTool: false,
+    mcpTool: false,
+    toolCallable: false,
+    run: ({ requestId }) => getAccessRequestReview(requestId),
+});

package/dist/sharing/actions/get-resource-access-status.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    resourceType: string;
+    resourceId: string;
+}, import("../access-requests.js").ResourceLinkStatus>;
+export default _default;

package/dist/sharing/actions/get-resource-access-status.js

@@ -0,0 +1,19 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { resolveLinkStatus } from "../access-requests.js";
+export default defineAction({
+    description: "Say whether the current viewer can open a shareable resource, and if not, whether the link points at something that exists and whether they can ask for access. Returns only the state, the viewer's own role, and their own request; never the title, owner, visibility, or workspace.",
+    schema: z.object({
+        resourceType: z.string().min(1),
+        resourceId: z.string().min(1),
+    }),
+    http: { method: "GET" },
+    readOnly: true,
+    // A signed-out visitor holding a link gets `signed-out` and nothing else.
+    requiresAuth: false,
+    // Only the app's own access screens ask; agents read resources directly.
+    agentTool: false,
+    mcpTool: false,
+    toolCallable: false,
+    run: async ({ resourceType, resourceId }) => resolveLinkStatus(resourceType, resourceId),
+});

package/dist/sharing/actions/list-resource-access-requests.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    resourceType: string;
+    resourceId: string;
+}, import("../access-requests.js").ResourceAccessRequestList>;
+export default _default;

package/dist/sharing/actions/list-resource-access-requests.js

@@ -0,0 +1,16 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { listResourceAccessRequests } from "../access-requests.js";
+export default defineAction({
+    description: "List the newest pending access requests for a shareable resource, up to 50; `hasMore` says older ones exist. Only someone who manages access to it can list them.",
+    schema: z.object({
+        resourceType: z.string().min(1),
+        resourceId: z.string().min(1),
+    }),
+    http: { method: "GET" },
+    readOnly: true,
+    agentTool: false,
+    mcpTool: false,
+    toolCallable: false,
+    run: ({ resourceType, resourceId }) => listResourceAccessRequests(resourceType, resourceId),
+});

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -2,6 +2,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
 }, {
+    role?: undefined;
     ownerEmail: any;
     visibility: any;
     shares: any[];
@@ -11,7 +12,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
         supportsGroupShares?: boolean;
     };
     orgId?: undefined;
-    role?: undefined;
     agentReadable?: undefined;
 } | {
     ownerEmail: string;

package/dist/sharing/actions/request-resource-access.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("../../action.js").ActionDefinition<{
+    resourceType: string;
+    resourceId: string;
+    note?: string;
+}, import("../access-requests.js").RequestResourceAccessResult>;
+export default _default;

package/dist/sharing/actions/request-resource-access.js

@@ -0,0 +1,17 @@
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { ACCESS_REQUEST_NOTE_MAX_LENGTH, requestResourceAccess, } from "../access-requests.js";
+export default defineAction({
+    description: "Ask the owner and admins of a shareable resource the signed-in viewer can't open to give them access. Asking again while a request is open sends nothing.",
+    schema: z.object({
+        resourceType: z.string().min(1),
+        resourceId: z.string().min(1),
+        note: z.string().max(ACCESS_REQUEST_NOTE_MAX_LENGTH).optional(),
+    }),
+    // It emails other people, so only the person holding the link asks, from
+    // the access screen.
+    agentTool: false,
+    mcpTool: false,
+    toolCallable: false,
+    run: (args) => requestResourceAccess(args),
+});

package/dist/sharing/actions/share-resource.d.ts

@@ -9,7 +9,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceUrl?: string;
     message?: string;
 }, {
-    id: any;
+    id: string;
     updated: boolean;
     change?: import("../../action-ui.js").ActionChange;
 }>;

package/dist/sharing/actions/share-resource.js

@@ -1,21 +1,17 @@
-import { and, eq, ne, sql } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import { z } from "zod";
-import { defineAction, fail } from "../../action.js";
+import { defineAction } from "../../action.js";
 import { getAppConfig } from "../../app-config/index.js";
-import { getDbExec } from "../../db/client.js";
 import { CORE_RESOURCE_SHARED_EMAIL_ID, renderTransactionalEmail, } from "../../email-catalog/templates.js";
-import { isOrgMember } from "../../org/membership.js";
 import { getAppProductionUrl } from "../../server/app-url.js";
 import { sendEmail, isEmailConfigured } from "../../server/email.js";
-import { invalidateCollabAccessCache } from "../../server/poll.js";
 import { getRequestUserEmail } from "../../server/request-context.js";
 import { track } from "../../tracking/registry.js";
 import { getUserProfile } from "../../user-profile/store.js";
-import { assertWorkspaceUserGroupIds } from "../../workspace-connections/groups.js";
-import { assertAccess, ForbiddenError } from "../access.js";
+import { assertAccess } from "../access.js";
+import { announceResourceAccessChange, grantResourceAccess, isEmailPrincipalId, isOrgMemberOrInvited, normalizePrincipalId, principalIdMatches, } from "../grant.js";
 import { requireShareableResource } from "../registry.js";
 import { resourceSharingChange } from "./change-result.js";
-import { getExtensionShareChangeTargets, notifyExtensionShareChanged, } from "./extension-change.js";
 function appPath(path) {
     if (!path.startsWith("/"))
         return path;
@@ -65,40 +61,6 @@ export function resolveShareNotificationUrl(explicitUrl, fallbackPath, appUrl =
     }
     return appUrl;
 }
-function nanoid(size = 12) {
-    const chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-    let id = "";
-    const bytes = crypto.getRandomValues(new Uint8Array(size));
-    for (const byte of bytes)
-        id += chars[byte % chars.length];
-    return id;
-}
-function normalizePrincipalId(principalType, principalId) {
-    return principalType === "user"
-        ? principalId.trim().toLowerCase()
-        : principalId;
-}
-function isEmailPrincipalId(value) {
-    return /^[^\s@]+@[^\s@]+$/.test(value.trim());
-}
-function principalIdMatches(sharesTable, principalType, principalId) {
-    return principalType === "user"
-        ? sql `lower(${sharesTable.principalId}) = ${principalId}`
-        : eq(sharesTable.principalId, principalId);
-}
-async function isOrgMemberOrInvited(orgId, email) {
-    const lower = email.trim().toLowerCase();
-    if (!lower || !orgId)
-        return false;
-    const client = getDbExec();
-    if (await isOrgMember(orgId, lower))
-        return true;
-    const invited = await client.execute({
-        sql: `SELECT 1 FROM org_invitations WHERE org_id = ? AND LOWER(email) = ? AND status = 'pending' LIMIT 1`,
-        args: [orgId, lower],
-    });
-    return invited.rows.length > 0;
-}
 async function needsExternalShareApproval(args) {
     if (args.principalType === "group")
         return false;
@@ -163,116 +125,28 @@ export default defineAction({
     needsApproval: needsExternalShareApproval,
     run: async (args) => {
         const reg = requireShareableResource(args.resourceType);
-        const access = await assertAccess(args.resourceType, args.resourceId, "admin");
-        const actor = getRequestUserEmail();
-        if (!actor)
-            throw new ForbiddenError("Not signed in");
-        const principalId = normalizePrincipalId(args.principalType, args.principalId);
-        if (args.principalType === "group" && reg.supportsGroupShares !== true) {
-            throw new ForbiddenError(`${reg.displayName} does not support organization groups yet.`);
-        }
-        if (args.principalType === "user" && !isEmailPrincipalId(principalId)) {
-            fail("User shares must use an email address, not an internal user id.", {
-                errorCode: "invalid_user_share_principal",
-            });
-        }
-        if (args.principalType === "group") {
-            const resourceOrgId = access.resource?.orgId;
-            if (!resourceOrgId) {
-                throw new ForbiddenError(`${reg.displayName} can only be shared with a group from within an organization.`);
-            }
-            try {
-                await assertWorkspaceUserGroupIds([principalId], resourceOrgId);
-            }
-            catch {
-                throw new ForbiddenError(`${reg.displayName} can only be shared with a group from its own organization.`);
-            }
-        }
-        const beforeExtensionTargets = await getExtensionShareChangeTargets(args.resourceType, args.resourceId);
-        if (reg.requireOrgMemberForUserShares) {
-            const resourceOrgId = access.resource?.orgId;
-            if (!resourceOrgId) {
-                throw new ForbiddenError(`${reg.displayName} can only be shared from within an organization. Create or join an organization first.`);
-            }
-            if (args.principalType === "user") {
-                const ok = await isOrgMemberOrInvited(resourceOrgId, principalId);
-                if (!ok) {
-                    throw new ForbiddenError(`${principalId} is not in your organization. Invite them to the organization first, then share.`);
-                }
-            }
-            else if (args.principalType === "org") {
-                if (principalId !== resourceOrgId) {
-                    throw new ForbiddenError(`${reg.displayName} can only be shared with its own organization, not a different one.`);
-                }
-            }
-            else if (args.principalType === "group") {
-                // Group ownership was validated above against the resource org.
-            }
-        }
-        const db = reg.getDb();
-        const [existing] = await db
-            .select()
-            .from(reg.sharesTable)
-            .where(and(eq(reg.sharesTable.resourceId, args.resourceId), eq(reg.sharesTable.principalType, args.principalType), principalIdMatches(reg.sharesTable, args.principalType, principalId)));
-        if (existing) {
-            const [updated] = await db
-                .update(reg.sharesTable)
-                .set({ role: args.role })
-                .where(and(eq(reg.sharesTable.id, existing.id), ne(reg.sharesTable.role, args.role)))
-                .returning({ id: reg.sharesTable.id });
-            invalidateCollabAccessCache(args.resourceType, args.resourceId);
-            await notifyExtensionShareChanged(args.resourceType, args.resourceId, beforeExtensionTargets);
-            return {
-                id: existing.id,
-                updated: Boolean(updated),
-                ...(updated
-                    ? {
-                        change: resourceSharingChange(reg, access.resource, "updated", `${args.principalType}:${principalId} · ${args.role}`).change,
-                    }
-                    : {}),
-            };
-        }
-        const id = nanoid();
-        const [inserted] = await db
-            .insert(reg.sharesTable)
-            .values({
-            id,
+        const grant = await grantResourceAccess({
+            resourceType: args.resourceType,
             resourceId: args.resourceId,
             principalType: args.principalType,
-            principalId,
+            principalId: args.principalId,
             role: args.role,
-            createdBy: actor,
-            createdAt: new Date().toISOString(),
-        })
-            .onConflictDoNothing()
-            .returning({ id: reg.sharesTable.id });
-        if (!inserted) {
-            const [existingAfterConflict] = await db
-                .select()
-                .from(reg.sharesTable)
-                .where(and(eq(reg.sharesTable.resourceId, args.resourceId), eq(reg.sharesTable.principalType, args.principalType), principalIdMatches(reg.sharesTable, args.principalType, principalId)));
-            if (!existingAfterConflict) {
-                throw new Error("Share conflict could not be resolved.");
-            }
-            const [updated] = await db
-                .update(reg.sharesTable)
-                .set({ role: args.role })
-                .where(and(eq(reg.sharesTable.id, existingAfterConflict.id), ne(reg.sharesTable.role, args.role)))
-                .returning({ id: reg.sharesTable.id });
-            invalidateCollabAccessCache(args.resourceType, args.resourceId);
-            await notifyExtensionShareChanged(args.resourceType, args.resourceId, beforeExtensionTargets);
+        });
+        const actor = getRequestUserEmail();
+        const { id, principalId, resource: accessResource } = grant;
+        await announceResourceAccessChange(args.resourceType, args.resourceId, grant.extensionTargetsBefore);
+        if (!grant.created) {
             return {
-                id: existingAfterConflict.id,
-                updated: Boolean(updated),
-                ...(updated
+                id,
+                updated: grant.updated,
+                ...(grant.updated
                     ? {
-                        change: resourceSharingChange(reg, access.resource, "updated", `${args.principalType}:${principalId} · ${args.role}`).change,
+                        change: resourceSharingChange(reg, accessResource, "updated", `${args.principalType}:${principalId} · ${args.role}`).change,
                     }
                     : {}),
             };
         }
-        invalidateCollabAccessCache(args.resourceType, args.resourceId);
-        await notifyExtensionShareChanged(args.resourceType, args.resourceId, beforeExtensionTargets);
+        const db = reg.getDb();
         const shouldNotify = args.notify !== false &&
             args.principalType === "user" &&
             (await isEmailConfigured());
@@ -408,7 +282,7 @@ export default defineAction({
         return {
             id,
             updated: false,
-            change: resourceSharingChange(reg, access.resource, "created", `${args.principalType}:${principalId} · ${args.role}`).change,
+            change: resourceSharingChange(reg, accessResource, "created", `${args.principalType}:${principalId} · ${args.role}`).change,
         };
     },
 });

package/dist/sharing/grant.d.ts

@@ -0,0 +1,49 @@
+import { type SQL } from "drizzle-orm";
+import type { ExtensionChangeTarget } from "../extensions/change-marker.js";
+import { type PrincipalType, type ShareRole } from "./schema.js";
+export declare function normalizePrincipalId(principalType: PrincipalType, principalId: string): string;
+export declare function isEmailPrincipalId(value: string): boolean;
+export declare function principalIdMatches(sharesTable: any, principalType: PrincipalType, principalId: string): SQL;
+export declare function isOrgMemberOrInvited(orgId: string, email: string): Promise<boolean>;
+export interface GrantResourceAccessInput {
+    resourceType: string;
+    resourceId: string;
+    principalType: PrincipalType;
+    principalId: string;
+    role: ShareRole;
+    /**
+     * Keep a stronger role the principal already holds instead of replacing it.
+     * Share replaces roles in both directions; approving a request only raises.
+     */
+    keepStrongerRole?: boolean;
+}
+export interface GrantResourceAccessResult {
+    /** The principal's share row. */
+    id: string;
+    /** A new share row was inserted. */
+    created: boolean;
+    /** An existing share row's role changed. */
+    updated: boolean;
+    /** The role the share row holds now. */
+    role: ShareRole;
+    principalId: string;
+    /** The resource as the actor's admin access check loaded it. */
+    resource: any;
+    /** Pass to {@link announceResourceAccessChange} once the grant commits. */
+    extensionTargetsBefore: ExtensionChangeTarget[];
+}
+/**
+ * Gives a principal a role on a resource, as the signed-in actor. The actor
+ * needs admin on the resource, and every sharing rule applies: group support,
+ * organization-only sharing, and the principal's form. Share and approving an
+ * access request both grant through here, so neither can skip a rule.
+ *
+ * It only writes the share row. Call {@link announceResourceAccessChange}
+ * afterwards, outside any transaction, so open sessions see the change.
+ */
+export declare function grantResourceAccess(input: GrantResourceAccessInput): Promise<GrantResourceAccessResult>;
+/**
+ * Tells open sessions that a resource's sharing changed, after the grant that
+ * changed it has committed.
+ */
+export declare function announceResourceAccessChange(resourceType: string, resourceId: string, extensionTargetsBefore: ExtensionChangeTarget[]): Promise<void>;

package/dist/sharing/grant.js

@@ -0,0 +1,195 @@
+import { and, eq, inArray, ne, sql } from "drizzle-orm";
+import { drizzle as drizzleProxy } from "drizzle-orm/pg-proxy";
+import { fail } from "../action.js";
+import { getDbExec, getScopedDbExec } from "../db/client.js";
+import { isOrgMember } from "../org/membership.js";
+import { invalidateCollabAccessCache } from "../server/poll.js";
+import { getRequestUserEmail } from "../server/request-context.js";
+import { assertWorkspaceUserGroupIds } from "../workspace-connections/groups.js";
+import { assertAccess, ForbiddenError } from "./access.js";
+import { getExtensionShareChangeTargets, notifyExtensionShareChanged, } from "./actions/extension-change.js";
+import { requireShareableResource, } from "./registry.js";
+import { ROLE_RANK } from "./schema.js";
+export function normalizePrincipalId(principalType, principalId) {
+    return principalType === "user"
+        ? principalId.trim().toLowerCase()
+        : principalId;
+}
+export function isEmailPrincipalId(value) {
+    return /^[^\s@]+@[^\s@]+$/.test(value.trim());
+}
+export function principalIdMatches(sharesTable, principalType, principalId) {
+    return principalType === "user"
+        ? sql `lower(${sharesTable.principalId}) = ${principalId}`
+        : eq(sharesTable.principalId, principalId);
+}
+export async function isOrgMemberOrInvited(orgId, email) {
+    const lower = email.trim().toLowerCase();
+    if (!lower || !orgId)
+        return false;
+    const client = getDbExec();
+    if (await isOrgMember(orgId, lower))
+        return true;
+    const invited = await client.execute({
+        sql: `SELECT 1 FROM org_invitations WHERE org_id = ? AND LOWER(email) = ? AND status = 'pending' LIMIT 1`,
+        args: [orgId, lower],
+    });
+    return invited.rows.length > 0;
+}
+function nanoid(size = 12) {
+    const chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+    let id = "";
+    const bytes = crypto.getRandomValues(new Uint8Array(size));
+    for (const byte of bytes)
+        id += chars[byte % chars.length];
+    return id;
+}
+// Inside a transaction (see `withDbExec`), share rows are written through the
+// transaction's handle so they commit or roll back with everything else.
+function sharesDb(reg) {
+    const transaction = getScopedDbExec();
+    if (!transaction)
+        return reg.getDb();
+    return drizzleProxy(async (query, params) => {
+        const result = await transaction.execute({ sql: query, args: params });
+        return { rows: result.rows.map((row) => Object.values(row)) };
+    });
+}
+const SHARE_ROLES = ["viewer", "commenter", "editor", "admin"];
+function weakerRoles(role) {
+    return SHARE_ROLES.filter((other) => ROLE_RANK[other] < ROLE_RANK[role]);
+}
+/**
+ * Gives a principal a role on a resource, as the signed-in actor. The actor
+ * needs admin on the resource, and every sharing rule applies: group support,
+ * organization-only sharing, and the principal's form. Share and approving an
+ * access request both grant through here, so neither can skip a rule.
+ *
+ * It only writes the share row. Call {@link announceResourceAccessChange}
+ * afterwards, outside any transaction, so open sessions see the change.
+ */
+export async function grantResourceAccess(input) {
+    const reg = requireShareableResource(input.resourceType);
+    const access = await assertAccess(input.resourceType, input.resourceId, "admin");
+    const actor = getRequestUserEmail();
+    if (!actor)
+        throw new ForbiddenError("Not signed in");
+    const principalId = normalizePrincipalId(input.principalType, input.principalId);
+    if (input.principalType === "group" && reg.supportsGroupShares !== true) {
+        throw new ForbiddenError(`${reg.displayName} does not support organization groups yet.`);
+    }
+    if (input.principalType === "user" && !isEmailPrincipalId(principalId)) {
+        fail("User shares must use an email address, not an internal user id.", {
+            errorCode: "invalid_user_share_principal",
+        });
+    }
+    if (input.principalType === "group") {
+        const resourceOrgId = access.resource?.orgId;
+        if (!resourceOrgId) {
+            throw new ForbiddenError(`${reg.displayName} can only be shared with a group from within an organization.`);
+        }
+        try {
+            await assertWorkspaceUserGroupIds([principalId], resourceOrgId);
+        }
+        catch {
+            throw new ForbiddenError(`${reg.displayName} can only be shared with a group from its own organization.`);
+        }
+    }
+    const extensionTargetsBefore = await getExtensionShareChangeTargets(input.resourceType, input.resourceId);
+    if (reg.requireOrgMemberForUserShares) {
+        const resourceOrgId = access.resource?.orgId;
+        if (!resourceOrgId) {
+            throw new ForbiddenError(`${reg.displayName} can only be shared from within an organization. Create or join an organization first.`);
+        }
+        if (input.principalType === "user") {
+            const ok = await isOrgMemberOrInvited(resourceOrgId, principalId);
+            if (!ok) {
+                throw new ForbiddenError(`${principalId} is not in your organization. Invite them to the organization first, then share.`);
+            }
+        }
+        else if (input.principalType === "org") {
+            if (principalId !== resourceOrgId) {
+                throw new ForbiddenError(`${reg.displayName} can only be shared with its own organization, not a different one.`);
+            }
+        }
+    }
+    const db = sharesDb(reg);
+    const findExisting = async () => {
+        const [row] = await db
+            .select({ id: reg.sharesTable.id, role: reg.sharesTable.role })
+            .from(reg.sharesTable)
+            .where(and(eq(reg.sharesTable.resourceId, input.resourceId), eq(reg.sharesTable.principalType, input.principalType), principalIdMatches(reg.sharesTable, input.principalType, principalId)));
+        return row;
+    };
+    const setRole = async (existing) => {
+        const keep = input.keepStrongerRole === true &&
+            ROLE_RANK[existing.role] >= ROLE_RANK[input.role];
+        if (keep) {
+            return { id: existing.id, updated: false, role: existing.role };
+        }
+        // The role can change between the read above and this write, so keeping a
+        // stronger role is checked by the write itself, not only by the read.
+        const replaceable = input.keepStrongerRole
+            ? inArray(reg.sharesTable.role, weakerRoles(input.role))
+            : ne(reg.sharesTable.role, input.role);
+        const [updated] = await db
+            .update(reg.sharesTable)
+            .set({ role: input.role })
+            .where(and(eq(reg.sharesTable.id, existing.id), replaceable))
+            .returning({ id: reg.sharesTable.id });
+        if (updated || !input.keepStrongerRole) {
+            return { id: existing.id, updated: Boolean(updated), role: input.role };
+        }
+        const current = await findExisting();
+        if (!current) {
+            fail("Access changed while it was being granted. Try again.", {
+                errorCode: "share_conflict",
+                statusCode: 409,
+            });
+        }
+        return { id: current.id, updated: false, role: current.role };
+    };
+    const result = {
+        principalId,
+        resource: access.resource,
+        extensionTargetsBefore,
+    };
+    const existing = await findExisting();
+    if (existing) {
+        return { ...result, ...(await setRole(existing)), created: false };
+    }
+    const id = nanoid();
+    const [inserted] = await db
+        .insert(reg.sharesTable)
+        .values({
+        id,
+        resourceId: input.resourceId,
+        principalType: input.principalType,
+        principalId,
+        role: input.role,
+        createdBy: actor,
+        createdAt: new Date().toISOString(),
+    })
+        .onConflictDoNothing()
+        .returning({ id: reg.sharesTable.id });
+    if (inserted) {
+        return { ...result, id, created: true, updated: false, role: input.role };
+    }
+    const existingAfterConflict = await findExisting();
+    if (!existingAfterConflict) {
+        throw new Error("Share conflict could not be resolved.");
+    }
+    return {
+        ...result,
+        ...(await setRole(existingAfterConflict)),
+        created: false,
+    };
+}
+/**
+ * Tells open sessions that a resource's sharing changed, after the grant that
+ * changed it has committed.
+ */
+export async function announceResourceAccessChange(resourceType, resourceId, extensionTargetsBefore) {
+    invalidateCollabAccessCache(resourceType, resourceId);
+    await notifyExtensionShareChanged(resourceType, resourceId, extensionTargetsBefore);
+}

package/dist/sharing/index.d.ts

@@ -1,4 +1,5 @@
 export { ownableColumns, createSharesTable, roleSatisfies, ROLE_RANK, type Visibility, type ShareRole, type PrincipalType, } from "./schema.js";
 export { registerShareableResource, getShareableResource, requireShareableResource, listShareableResources, type ShareableResourceRegistration, type ShareEmailExtras, } from "./registry.js";
-export { accessFilter, resolveAccess, assertAccess, currentAccess, ForbiddenError, type AccessContext, type ResolvedAccess, } from "./access.js";
+export { accessFilter, resolveAccess, assertAccess, currentAccess, ForbiddenError, isResourceAvailable, resolveAccessStatus, type AccessContext, type ResolvedAccess, type ResourceAccessState, type ResourceAccessStatus, } from "./access.js";
+export { ACCESS_REQUEST_NOTE_MAX_LENGTH, accessRequestReviewPath, approveAccessRequest, declineAccessRequest, getAccessRequestReview, listResourceAccessRequests, requestResourceAccess, resolveLinkStatus, type AccessGrantedEmail, type AccessRequestReview, type RequestResourceAccessResult, type ResourceAccessRequestList, type ResourceLinkStatus, type ViewerAccessRequest, } from "./access-requests.js";
 export { filterRecipientsByResourceAccess, type FilterRecipientsInput, } from "./recipients.js";

package/dist/sharing/index.js

@@ -1,4 +1,5 @@
 export { ownableColumns, createSharesTable, roleSatisfies, ROLE_RANK, } from "./schema.js";
 export { registerShareableResource, getShareableResource, requireShareableResource, listShareableResources, } from "./registry.js";
-export { accessFilter, resolveAccess, assertAccess, currentAccess, ForbiddenError, } from "./access.js";
+export { accessFilter, resolveAccess, assertAccess, currentAccess, ForbiddenError, isResourceAvailable, resolveAccessStatus, } from "./access.js";
+export { ACCESS_REQUEST_NOTE_MAX_LENGTH, accessRequestReviewPath, approveAccessRequest, declineAccessRequest, getAccessRequestReview, listResourceAccessRequests, requestResourceAccess, resolveLinkStatus, } from "./access-requests.js";
 export { filterRecipientsByResourceAccess, } from "./recipients.js";