@agent-native/core 0.206.0 → 0.206.1-nightly-20261009213000

package/dist/shared/embed-auth.js

@@ -10,12 +10,145 @@ export const MCP_DIRECTORY_WIDGET_SESSION_EXPIRED_HEADER = "x-agent-native-widge
 export const MCP_DIRECTORY_WIDGET_READ_CAPABILITY_PREFIX = "capability:mcp-directory-widget-read:";
 export const MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX = "capability:mcp-directory-widget-write:";
 export const MCP_DIRECTORY_WIDGET_READ_CAPABILITY_MAX_LENGTH = 2048;
+// The scope is signed into the embed token (about 1.3x its length plus the
+// session claims), and that token is also the embed session cookie, which a
+// browser drops above 4096 bytes. A realistic Slides grant signs to about 3.1 KB;
+// only the widest identities exceed a cookie, and setEmbedSessionCookie then
+// leaves the page on its query/bearer token. embed-session.spec.ts measures both.
 export const MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_LENGTH = 4096;
 export const MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_AGE_MS = 15 * 60 * 1000;
 const MCP_DIRECTORY_WIDGET_INTEGER_ARGUMENT_MAX = 5_000;
 const MCP_DIRECTORY_ACTION_NAME = /^[A-Za-z0-9_.-]{1,128}$/;
 const MCP_DIRECTORY_SCOPE_KEY = /^[A-Za-z0-9_.-]{1,128}$/;
 const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+// Capability scopes travel inside a signed cookie that browsers drop above
+// 4096 bytes, so the payload is base64url JSON with two compact argument
+// markers: `0` is `{type:"actionSchema"}` and `["key"]` is the literal
+// `resourceIds[key]`. Markers are non-strings so they can never collide with a
+// string literal. Scopes minted before this form are URI-encoded JSON (always
+// `%7B...`) and still decode.
+const ACTION_ARGUMENT_FIELDS = [
+    "actionArguments",
+    "readActionArguments",
+    "writeActionArguments",
+];
+function isPlainRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function encodeBase64Url(text) {
+    const binary = encodeURIComponent(text).replace(/%([0-9A-F]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+function decodeBase64Url(payload) {
+    if (!/^[A-Za-z0-9_-]*$/.test(payload) || payload.length % 4 === 1) {
+        throw new URIError("Malformed base64url payload.");
+    }
+    const binary = atob(payload.replace(/-/g, "+").replace(/_/g, "/") +
+        "=".repeat((4 - (payload.length % 4)) % 4));
+    return decodeURIComponent(Array.from(binary, (char) => `%${char.charCodeAt(0).toString(16).padStart(2, "0")}`).join(""));
+}
+function compactArgument(argument, resourceIds) {
+    if (typeof argument !== "string") {
+        return argument.type === "actionSchema" ? 0 : argument;
+    }
+    const key = Object.keys(resourceIds).find((resourceKey) => resourceIds[resourceKey] === argument);
+    return key !== undefined &&
+        JSON.stringify([key]).length < JSON.stringify(argument).length
+        ? [key]
+        : argument;
+}
+function encodeCapabilityPayload(capability) {
+    const wire = { ...capability };
+    for (const field of ACTION_ARGUMENT_FIELDS) {
+        const actions = capability[field];
+        if (!actions)
+            continue;
+        wire[field] = Object.fromEntries(Object.entries(actions).map(([actionName, args]) => [
+            actionName,
+            Object.fromEntries(Object.entries(args).map(([name, argument]) => [
+                name,
+                compactArgument(argument, capability.resourceIds),
+            ])),
+        ]));
+    }
+    return encodeBase64Url(JSON.stringify(wire));
+}
+// Returns undefined for a marker that is not `0` or a one-element reference to
+// an existing resource id, so the whole capability is rejected.
+function expandCompactArgument(value, resourceIds) {
+    if (value === 0)
+        return { type: "actionSchema" };
+    if (Array.isArray(value)) {
+        const [key] = value;
+        return value.length === 1 &&
+            typeof key === "string" &&
+            isPlainRecord(resourceIds) &&
+            Object.hasOwn(resourceIds, key) &&
+            typeof resourceIds[key] === "string"
+            ? resourceIds[key]
+            : undefined;
+    }
+    return typeof value === "string" || isPlainRecord(value) ? value : undefined;
+}
+function expandCompactCapability(value) {
+    if (!isPlainRecord(value))
+        return value;
+    const expanded = { ...value };
+    for (const field of ACTION_ARGUMENT_FIELDS) {
+        const actions = value[field];
+        if (!isPlainRecord(actions))
+            continue;
+        const expandedActions = [];
+        for (const [actionName, args] of Object.entries(actions)) {
+            if (!isPlainRecord(args)) {
+                expandedActions.push([actionName, args]);
+                continue;
+            }
+            const expandedArgs = [];
+            for (const [name, argument] of Object.entries(args)) {
+                const result = expandCompactArgument(argument, value.resourceIds);
+                if (result === undefined)
+                    return undefined;
+                expandedArgs.push([name, result]);
+            }
+            expandedActions.push([actionName, Object.fromEntries(expandedArgs)]);
+        }
+        expanded[field] = Object.fromEntries(expandedActions);
+    }
+    return expanded;
+}
+function parseCapabilityPayload(payload) {
+    const legacy = payload.startsWith("%");
+    let json;
+    try {
+        json = legacy ? decodeURIComponent(payload) : decodeBase64Url(payload);
+    }
+    catch (error) {
+        if (error instanceof URIError) {
+            return { ok: false, reason: "invalid-encoding" };
+        }
+        throw error;
+    }
+    let value;
+    try {
+        value = JSON.parse(json);
+    }
+    catch (error) {
+        if (error instanceof SyntaxError) {
+            return { ok: false, reason: "invalid-json" };
+        }
+        throw error;
+    }
+    if (legacy)
+        return { ok: true, value };
+    const expanded = expandCompactCapability(value);
+    return expanded === undefined
+        ? { ok: false, reason: "invalid-capability" }
+        : { ok: true, value: expanded };
+}
 function isStringRecord(value, { minEntries = 1, maxEntries = 16 } = {}) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {
         return false;
@@ -96,26 +229,10 @@ function decodeMcpDirectoryWidgetReadCapability(scope) {
         scope.length > MCP_DIRECTORY_WIDGET_READ_CAPABILITY_MAX_LENGTH) {
         return { ok: false, reason: "invalid-scope" };
     }
-    let json;
-    try {
-        json = decodeURIComponent(scope.slice(MCP_DIRECTORY_WIDGET_READ_CAPABILITY_PREFIX.length));
-    }
-    catch (error) {
-        if (error instanceof URIError) {
-            return { ok: false, reason: "invalid-encoding" };
-        }
-        throw error;
-    }
-    let value;
-    try {
-        value = JSON.parse(json);
-    }
-    catch (error) {
-        if (error instanceof SyntaxError) {
-            return { ok: false, reason: "invalid-json" };
-        }
-        throw error;
-    }
+    const parsed = parseCapabilityPayload(scope.slice(MCP_DIRECTORY_WIDGET_READ_CAPABILITY_PREFIX.length));
+    if (!parsed.ok)
+        return parsed;
+    const value = parsed.value;
     return isWidgetReadCapability(value)
         ? { ok: true, capability: value }
         : { ok: false, reason: "invalid-capability" };
@@ -126,7 +243,10 @@ function decodeMcpDirectoryWidgetWriteCapability(scope) {
         return undefined;
     }
     try {
-        const value = JSON.parse(decodeURIComponent(scope.slice(MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX.length)));
+        const parsed = parseCapabilityPayload(scope.slice(MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX.length));
+        if (!parsed.ok)
+            return undefined;
+        const value = parsed.value;
         if (value.version !== 1 ||
             typeof value.appId !== "string" ||
             !MCP_DIRECTORY_SCOPE_KEY.test(value.appId) ||
@@ -224,7 +344,7 @@ export function createMcpDirectoryWidgetReadCapability(input) {
         ])),
     };
     const scope = MCP_DIRECTORY_WIDGET_READ_CAPABILITY_PREFIX +
-        encodeURIComponent(JSON.stringify(capability));
+        encodeCapabilityPayload(capability);
     return scope.length <= MCP_DIRECTORY_WIDGET_READ_CAPABILITY_MAX_LENGTH
         ? scope
         : undefined;
@@ -285,7 +405,7 @@ export function createMcpDirectoryWidgetWriteCapability(input) {
         ])),
     };
     const scope = MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_PREFIX +
-        encodeURIComponent(JSON.stringify(capability));
+        encodeCapabilityPayload(capability);
     return scope.length <= MCP_DIRECTORY_WIDGET_WRITE_CAPABILITY_MAX_LENGTH
         ? scope
         : undefined;
@@ -407,6 +527,14 @@ export function isExpiredMcpDirectoryWidgetWriteCapability(scope, input) {
         capability.userEmail === input.userEmail.trim().toLowerCase() &&
         capability.orgId === (input.orgId ?? undefined));
 }
+export function getMcpDirectoryWidgetReadCapabilityResourceIds(scope, input) {
+    if (!matchesMcpDirectoryWidgetReadCapabilityResource(scope, input) ||
+        !scope) {
+        return undefined;
+    }
+    const decoded = decodeMcpDirectoryWidgetReadCapability(scope);
+    return decoded.ok ? { ...decoded.capability.resourceIds } : undefined;
+}
 export function getMcpDirectoryWidgetWriteCapabilityGrant(scope, input) {
     if (!matchesMcpDirectoryWidgetWriteCapability(scope, input) || !scope) {
         return undefined;
@@ -552,6 +680,11 @@ export function normalizeMcpDirectoryWidgetWriteActionArguments(scope, input) {
         return undefined;
     }
     const suppliedArgs = Object.entries(input.args ?? {});
+    // Every literal-bound argument must be supplied and equal: an omitted
+    // binding would otherwise rely on the action's own schema to reject it.
+    const unboundLiteral = Object.entries(expectedArgs).some(([name, expected]) => typeof expected === "string" && input.args?.[name] !== expected);
+    if (unboundLiteral)
+        return undefined;
     const includesResourceBinding = suppliedArgs.some(([name, value]) => typeof expectedArgs[name] === "string" && expectedArgs[name] === value) ||
         Object.values(expectedArgs).some((expected) => typeof expected !== "string" &&
             expected.type === "actionSchemaResourceBound" &&

package/dist/shared/inline-bytes.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Inline file bytes reached a SQL write with no durable URL to stand in for
+ * them. Raised only by the `reject` policy; a durable dispatch payload must
+ * carry a reference the worker can re-read, never a placeholder.
+ */
+export declare class DurableAttachmentReferenceRequiredError extends Error {
+    readonly code = "attachment_storage_required";
+    constructor();
+}
+/**
+ * `reject` throws when an attachment has bytes but no durable URL;
+ * `placeholder` keeps a visible `{ type: "file", name, mediaType, omitted:
+ * "inline-bytes" }` stub, for snapshots saved before the upload returned a URL.
+ */
+export type InlineBytesPolicy = "reject" | "placeholder";
+/**
+ * The one boundary every chat SQL write passes through (thread snapshots, run
+ * events, durable dispatch payloads): inline image/file bytes become their
+ * durable URL when the part carries one, and otherwise follow `policy`. Data
+ * URLs embedded in any other string become a visible `[inline … omitted]`.
+ */
+export declare function stripInlineBytes<T>(value: T, policy: InlineBytesPolicy): T;
+/** `stripInlineBytes` for serialized JSON; skips the parse when no body can be present. */
+export declare function stripInlineBytesFromJson(json: string, policy: InlineBytesPolicy): string;
+/**
+ * Throws with the JSON path of the first inline file body in `value` (an
+ * object, or a JSON string as read back from a SQL column). For tests.
+ */
+export declare function assertNoInlineImageBytes(value: unknown, label?: string): void;

package/dist/shared/inline-bytes.js

@@ -0,0 +1,170 @@
+import { parseDataUrl } from "./data-url.js";
+/**
+ * Inline file bytes reached a SQL write with no durable URL to stand in for
+ * them. Raised only by the `reject` policy; a durable dispatch payload must
+ * carry a reference the worker can re-read, never a placeholder.
+ */
+export class DurableAttachmentReferenceRequiredError extends Error {
+    code = "attachment_storage_required";
+    constructor() {
+        super("An attachment has inline bytes but no durable file URL. Configure file storage and retry this background run.");
+        this.name = "DurableAttachmentReferenceRequiredError";
+    }
+}
+const ATTACHMENT_TYPES = new Set(["image", "file", "document"]);
+const ATTACHMENT_LIST_KEYS = new Set([
+    "attachments",
+    "requestAttachments",
+    "images",
+    "_agentImages",
+]);
+const INLINE_URL_KEYS = ["image", "url", "referenceUrl", "dataUrl"];
+const DATA_URL_PREFIX = /^\s*data:/i;
+// URL schemes are case-insensitive: `DATA:image/png;base64,...` is still bytes.
+const DATA_SCHEME = /data:/i;
+const HTTP_URL = /^https?:\/\//i;
+const EMBEDDED_DATA_URL = /\bdata:[\w.+-]+\/[\w.+-]+(?:;[^,;\s"'<>]*)*,[^\s"'<>)\]]*/gi;
+function isDataUrl(value) {
+    return typeof value === "string" && DATA_URL_PREFIX.test(value);
+}
+function durableUrl(item) {
+    const metadata = item.metadata;
+    for (const candidate of [
+        item.url,
+        item.referenceUrl,
+        item.uploadUrl,
+        item.image,
+        metadata?.uploadUrl,
+    ]) {
+        if (typeof candidate === "string" &&
+            candidate.trim() &&
+            !isDataUrl(candidate)) {
+            return candidate;
+        }
+    }
+    return undefined;
+}
+function inlineKeys(item) {
+    const keys = INLINE_URL_KEYS.filter((key) => isDataUrl(item[key]));
+    if (typeof item.data === "string" &&
+        item.data.length > 0 &&
+        !HTTP_URL.test(item.data)) {
+        keys.push("data");
+    }
+    return keys;
+}
+function inlineMediaType(item, keys) {
+    for (const key of ["mediaType", "mimeType", "contentType"]) {
+        if (typeof item[key] === "string")
+            return item[key];
+    }
+    for (const key of keys) {
+        const parsed = typeof item[key] === "string" ? parseDataUrl(item[key].trim()) : null;
+        if (parsed)
+            return parsed.mediaType;
+    }
+    return undefined;
+}
+function scrubString(value) {
+    return DATA_SCHEME.test(value)
+        ? value.replace(EMBEDDED_DATA_URL, (match) => {
+            const mediaType = /^data:([^;,]+)/i.exec(match)?.[1] ?? "unknown";
+            return `[inline ${mediaType.toLowerCase()} data omitted]`;
+        })
+        : value;
+}
+function sanitize(value, policy, inAttachmentList, inheritedUrl) {
+    if (typeof value === "string")
+        return scrubString(value);
+    if (Array.isArray(value)) {
+        return value.map((item) => sanitize(item, policy, inAttachmentList, inheritedUrl));
+    }
+    if (!value || typeof value !== "object")
+        return value;
+    const item = value;
+    const isAttachment = inAttachmentList || ATTACHMENT_TYPES.has(item.type);
+    const ownUrl = isAttachment ? durableUrl(item) : undefined;
+    const fallbackUrl = ownUrl ?? (isAttachment ? inheritedUrl : undefined);
+    const inline = isAttachment ? inlineKeys(item) : [];
+    const unreferenced = inline.length > 0 &&
+        !fallbackUrl &&
+        !(typeof item.fileId === "string" && item.fileId);
+    if (unreferenced && policy === "reject") {
+        throw new DurableAttachmentReferenceRequiredError();
+    }
+    const out = {};
+    for (const [key, child] of Object.entries(item)) {
+        if (inline.includes(key)) {
+            if (fallbackUrl && (key === "image" || key === "url")) {
+                out[key] = fallbackUrl;
+            }
+            continue;
+        }
+        out[key] = sanitize(child, policy, ATTACHMENT_LIST_KEYS.has(key), fallbackUrl);
+    }
+    if (unreferenced) {
+        const name = item.name ?? item.filename ?? item.label;
+        const mediaType = inlineMediaType(item, inline);
+        return {
+            ...out,
+            type: "file",
+            ...(typeof name === "string" ? { name } : {}),
+            ...(mediaType ? { mediaType } : {}),
+            omitted: "inline-bytes",
+        };
+    }
+    return out;
+}
+/**
+ * The one boundary every chat SQL write passes through (thread snapshots, run
+ * events, durable dispatch payloads): inline image/file bytes become their
+ * durable URL when the part carries one, and otherwise follow `policy`. Data
+ * URLs embedded in any other string become a visible `[inline … omitted]`.
+ */
+export function stripInlineBytes(value, policy) {
+    return sanitize(value, policy, false, undefined);
+}
+/** `stripInlineBytes` for serialized JSON; skips the parse when no body can be present. */
+export function stripInlineBytesFromJson(json, policy) {
+    if (!DATA_SCHEME.test(json) && !json.includes('"data"'))
+        return json;
+    return JSON.stringify(stripInlineBytes(JSON.parse(json), policy));
+}
+/**
+ * Throws with the JSON path of the first inline file body in `value` (an
+ * object, or a JSON string as read back from a SQL column). For tests.
+ */
+export function assertNoInlineImageBytes(value, label = "value") {
+    const visit = (node, path, inList) => {
+        if (typeof node === "string") {
+            if (/base64,|data:image/i.test(node)) {
+                throw new Error(`${label} stores inline image bytes at ${path}: ${node.slice(0, 80)}`);
+            }
+            return;
+        }
+        if (Array.isArray(node)) {
+            node.forEach((child, index) => visit(child, `${path}[${index}]`, inList));
+            return;
+        }
+        if (!node || typeof node !== "object")
+            return;
+        const record = node;
+        if ((inList || ATTACHMENT_TYPES.has(record.type)) &&
+            inlineKeys(record).includes("data")) {
+            throw new Error(`${label} stores inline bytes at ${path}.data`);
+        }
+        for (const [key, child] of Object.entries(record)) {
+            visit(child, `${path}.${key}`, ATTACHMENT_LIST_KEYS.has(key));
+        }
+    };
+    visit(typeof value === "string" ? safeJson(value) : value, label, false);
+}
+function safeJson(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        // coercion-ok: a non-JSON string is checked as the text it is.
+        return value;
+    }
+}

package/dist/shared/mcp-embed-headers.d.ts

@@ -1,4 +1,4 @@
-export declare const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-Browser-Tab,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Session-Id,X-Agent-Native-Client-Platform,X-Agent-Native-Desktop-Verifier,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+export declare const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Content-Save-Origin,X-Agent-Native-Browser-Tab,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Session-Id,X-Agent-Native-Client-Platform,X-Agent-Native-Desktop-Verifier,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export declare const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 export declare function isLocalMcpEmbedOrigin(origin: string | null | undefined): boolean;
 export declare function isClaudeMcpContentOrigin(origin: string | null | undefined): boolean;

package/dist/shared/mcp-embed-headers.js

@@ -1,4 +1,4 @@
-export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-Browser-Tab,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Session-Id,X-Agent-Native-Client-Platform,X-Agent-Native-Desktop-Verifier,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Content-Save-Origin,X-Agent-Native-Browser-Tab,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Session-Id,X-Agent-Native-Client-Platform,X-Agent-Native-Desktop-Verifier,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 const CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\.claudemcpcontent\.com$/i;
 const CHATGPT_MCP_SANDBOX_HOST_RE = /^(?:[^.]+\.)?web-sandbox\.oaiusercontent\.com$/i;

package/dist/sharing/actions/list-resource-shares.d.ts

@@ -2,7 +2,6 @@ declare const _default: import("../../action.js").ActionDefinition<{
     resourceType: string;
     resourceId: string;
 }, {
-    role?: undefined;
     ownerEmail: any;
     visibility: any;
     shares: any[];
@@ -12,6 +11,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
         supportsGroupShares?: boolean;
     };
     orgId?: undefined;
+    role?: undefined;
     agentReadable?: undefined;
 } | {
     ownerEmail: string;

package/dist/sharing/actions/list-resource-shares.js

@@ -3,8 +3,9 @@ import { z } from "zod";
 import { defineAction } from "../../action.js";
 import { organizations } from "../../org/schema.js";
 import { listWorkspaceUserGroupsForOrg } from "../../workspace-connections/groups.js";
-import { resolveAccess } from "../access.js";
+import { assertAccess, resolveAccess } from "../access.js";
 import { requireShareableResource } from "../registry.js";
+import { assertWidgetShareReadGrant } from "../widget-grant.js";
 async function loadOrgDisplayNames(db, shares) {
     const orgIds = Array.from(new Set(shares
         .filter((s) => s.principalType === "org" && s.principalId)
@@ -47,13 +48,14 @@ async function loadGroupDisplayNames(orgId, shares) {
     }
 }
 export default defineAction({
-    description: "List the current visibility and share grants on a shareable resource. Any read access is sufficient.",
+    description: "List the current visibility and share grants on a shareable resource. Ordinary reads require resource access; widget reads require admin access.",
     schema: z.object({
         resourceType: z.string(),
         resourceId: z.string(),
     }),
     http: { method: "GET" },
-    run: async (args) => {
+    run: async (args, context) => {
+        assertWidgetShareReadGrant(context, args);
         const reg = requireShareableResource(args.resourceType);
         const policy = {
             allowPublic: reg.allowPublic !== false,
@@ -62,7 +64,11 @@ export default defineAction({
                 ? { supportsGroupShares: true }
                 : {}),
         };
-        const access = await resolveAccess(args.resourceType, args.resourceId, undefined, { skipResourceBody: true });
+        const access = context?.mcpDirectoryWidgetReadOnly
+            ? await assertAccess(args.resourceType, args.resourceId, "admin", undefined, { skipResourceBody: true })
+            : await resolveAccess(args.resourceType, args.resourceId, undefined, {
+                skipResourceBody: true,
+            });
         if (!access)
             return { ownerEmail: null, visibility: null, shares: [], policy };
         const db = reg.getDb();

package/dist/sharing/actions/set-resource-visibility.js

@@ -6,6 +6,7 @@ import { invalidateCollabAccessCache } from "../../server/poll.js";
 import { track } from "../../tracking/registry.js";
 import { assertAccess, currentAccess, ForbiddenError, resolveRegisteredAccessContext, } from "../access.js";
 import { requireShareableResource } from "../registry.js";
+import { assertWidgetShareWriteGrant } from "../widget-grant.js";
 import { resourceSharingChange } from "./change-result.js";
 import { getExtensionShareChangeTargets, notifyExtensionShareChanged, } from "./extension-change.js";
 export default defineAction({
@@ -28,7 +29,8 @@ export default defineAction({
         const access = await assertAccess(args.resourceType, args.resourceId, "admin", undefined, { skipResourceBody: true });
         return access.resource.visibility !== "public";
     },
-    run: async (args) => {
+    run: async (args, ctx) => {
+        assertWidgetShareWriteGrant(ctx, "set-resource-visibility", args);
         const reg = requireShareableResource(args.resourceType);
         if (args.visibility === "public" && reg.allowPublic === false) {
             throw new ForbiddenError(`${reg.displayName} cannot be made public — share with specific people or your organization instead.`);

package/dist/sharing/actions/share-resource.js

@@ -11,6 +11,7 @@ import { getUserProfile } from "../../user-profile/store.js";
 import { assertAccess } from "../access.js";
 import { announceResourceAccessChange, grantResourceAccess, isEmailPrincipalId, isOrgMemberOrInvited, normalizePrincipalId, principalIdMatches, } from "../grant.js";
 import { requireShareableResource } from "../registry.js";
+import { assertWidgetShareWriteGrant, widgetShareMessage, } from "../widget-grant.js";
 import { resourceSharingChange } from "./change-result.js";
 function appPath(path) {
     if (!path.startsWith("/"))
@@ -123,7 +124,8 @@ export default defineAction({
             .describe("Optional short note included in the notification email to an individual recipient."),
     }),
     needsApproval: needsExternalShareApproval,
-    run: async (args) => {
+    run: async (args, ctx) => {
+        assertWidgetShareWriteGrant(ctx, "share-resource", args);
         const reg = requireShareableResource(args.resourceType);
         const grant = await grantResourceAccess({
             resourceType: args.resourceType,
@@ -236,7 +238,7 @@ export default defineAction({
                         url: notificationUrl,
                     },
                     role: args.role,
-                    message: args.message,
+                    message: widgetShareMessage(ctx, args.message),
                     app: { name: brandName, logoUrl: brandLogoUrl },
                     heroHtml,
                     extras,

package/dist/sharing/actions/unshare-resource.js

@@ -4,6 +4,7 @@ import { defineAction } from "../../action.js";
 import { invalidateCollabAccessCache } from "../../server/poll.js";
 import { assertAccess } from "../access.js";
 import { requireShareableResource } from "../registry.js";
+import { assertWidgetShareWriteGrant } from "../widget-grant.js";
 import { resourceSharingChange } from "./change-result.js";
 import { getExtensionShareChangeTargets, notifyExtensionShareChanged, } from "./extension-change.js";
 function normalizePrincipalId(principalType, principalId) {
@@ -25,7 +26,8 @@ export default defineAction({
         principalType: z.enum(["user", "group", "org"]),
         principalId: z.string(),
     }),
-    run: async (args) => {
+    run: async (args, ctx) => {
+        assertWidgetShareWriteGrant(ctx, "unshare-resource", args);
         const reg = requireShareableResource(args.resourceType);
         const access = await assertAccess(args.resourceType, args.resourceId, "admin");
         const beforeExtensionTargets = await getExtensionShareChangeTargets(args.resourceType, args.resourceId);

package/dist/sharing/widget-grant.d.ts

@@ -0,0 +1,19 @@
+import type { ActionRunContext } from "../action.js";
+interface WidgetShareTarget {
+    resourceType: string;
+    resourceId: string;
+}
+interface WidgetShareGrantee {
+    principalType?: string;
+    role?: string;
+}
+/**
+ * The widget route already pins these arguments to the signed grant; this
+ * repeats the pin inside the action so a mistake in the route's wiring cannot
+ * widen what a widget may share. Other callers pass through untouched.
+ */
+export declare function assertWidgetShareWriteGrant(ctx: ActionRunContext | undefined, actionName: string, args: WidgetShareTarget & WidgetShareGrantee): void;
+/** The note in a share email is the caller's free text, so a widget sends none. */
+export declare function widgetShareMessage(ctx: ActionRunContext | undefined, message: string | undefined): string | undefined;
+export declare function assertWidgetShareReadGrant(ctx: ActionRunContext | undefined, args: WidgetShareTarget): void;
+export {};

package/dist/sharing/widget-grant.js

@@ -0,0 +1,55 @@
+import { ForbiddenError } from "./access.js";
+function assertGrantMatches(resourceIds, args) {
+    // A widget grant names its resource as `resourceType` plus `<type>Id`
+    // (`{ resourceType: "deck", deckId }`), the same keys the route binds.
+    const idKey = `${args.resourceType}Id`;
+    if (!resourceIds ||
+        resourceIds.resourceType !== args.resourceType ||
+        !Object.hasOwn(resourceIds, idKey) ||
+        resourceIds[idKey] !== args.resourceId) {
+        throw new ForbiddenError("This widget grant is missing or scoped to a different resource.");
+    }
+}
+/**
+ * The widget route already pins these arguments to the signed grant; this
+ * repeats the pin inside the action so a mistake in the route's wiring cannot
+ * widen what a widget may share. Other callers pass through untouched.
+ */
+export function assertWidgetShareWriteGrant(ctx, actionName, args) {
+    if (ctx?.caller === "mcp-widget") {
+        throw new ForbiddenError("A read-only widget session cannot change sharing.");
+    }
+    if (ctx?.caller !== "mcp-widget-write")
+        return;
+    const grant = ctx.mcpDirectoryWidgetWrite;
+    if (!grant?.actionNames.includes(actionName)) {
+        throw new ForbiddenError("This widget grant is missing or does not include this action.");
+    }
+    assertGrantMatches(grant.resourceIds, args);
+    if (actionName === "share-resource")
+        assertWidgetMayGrant(args);
+}
+/**
+ * A widget ticket is a short-lived credential an iframe holds, not the person
+ * clicking: what it can grant outlives it. It hands out access to individuals,
+ * and never the admin role that lets the grantee manage sharing in turn.
+ */
+function assertWidgetMayGrant(args) {
+    if (args.principalType !== undefined && args.principalType !== "user") {
+        throw new ForbiddenError("A widget can share only with individual people, not an organization or group.");
+    }
+    if (args.role === "admin") {
+        throw new ForbiddenError("A widget cannot grant the admin role. Change that access in the app.");
+    }
+}
+/** The note in a share email is the caller's free text, so a widget sends none. */
+export function widgetShareMessage(ctx, message) {
+    return ctx?.caller === "mcp-widget-write" ? undefined : message;
+}
+export function assertWidgetShareReadGrant(ctx, args) {
+    if (ctx?.caller !== "mcp-widget" && ctx?.caller !== "mcp-widget-write") {
+        return;
+    }
+    assertGrantMatches(ctx.mcpDirectoryWidgetResourceIds ??
+        ctx.mcpDirectoryWidgetWrite?.resourceIds, args);
+}