@agent-native/core 0.7.2 → 0.7.6

package/dist/sharing/actions/set-resource-visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-resource-visibility.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/set-resource-visibility.ts"],"names":[],"mappings":";AAMA,wBAkBG"}

package/dist/sharing/actions/set-resource-visibility.js

@@ -0,0 +1,24 @@
+import { eq } from "drizzle-orm";
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { assertAccess } from "../access.js";
+import { requireShareableResource } from "../registry.js";
+export default defineAction({
+    description: "Change the coarse visibility of a shareable resource: 'private' | 'org' | 'public'. Owner or admin role required.",
+    schema: z.object({
+        resourceType: z.string(),
+        resourceId: z.string(),
+        visibility: z.enum(["private", "org", "public"]),
+    }),
+    run: async (args) => {
+        const reg = requireShareableResource(args.resourceType);
+        await assertAccess(args.resourceType, args.resourceId, "admin");
+        const db = reg.getDb();
+        await db
+            .update(reg.resourceTable)
+            .set({ visibility: args.visibility })
+            .where(eq(reg.resourceTable.id, args.resourceId));
+        return { ok: true, visibility: args.visibility };
+    },
+});
+//# sourceMappingURL=set-resource-visibility.js.map

package/dist/sharing/actions/set-resource-visibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-resource-visibility.js","sourceRoot":"","sources":["../../../src/sharing/actions/set-resource-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,mHAAmH;IACrH,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;KACjD,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,EAAE;aACL,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;aACzB,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;aACpC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACnD,CAAC;CACF,CAAC,CAAC"}

package/dist/sharing/actions/share-resource.d.ts

@@ -0,0 +1,3 @@
+declare const _default: any;
+export default _default;
+//# sourceMappingURL=share-resource.d.ts.map

package/dist/sharing/actions/share-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-resource.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/share-resource.ts"],"names":[],"mappings":";AAgBA,wBAyDG"}

package/dist/sharing/actions/share-resource.js

@@ -0,0 +1,64 @@
+import { and, eq } from "drizzle-orm";
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { getRequestUserEmail } from "../../server/request-context.js";
+import { assertAccess, ForbiddenError } from "../access.js";
+import { requireShareableResource } from "../registry.js";
+function nanoid(size = 12) {
+    const chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+    let id = "";
+    const bytes = crypto.getRandomValues(new Uint8Array(size));
+    for (const byte of bytes)
+        id += chars[byte % chars.length];
+    return id;
+}
+export default defineAction({
+    description: "Grant a user or org access to a shareable resource. Owner or admin role required.",
+    schema: z.object({
+        resourceType: z
+            .string()
+            .describe("Registered resource type, e.g. 'document', 'form'."),
+        resourceId: z.string().describe("Id of the resource to share."),
+        principalType: z
+            .enum(["user", "org"])
+            .describe("'user' for an individual, 'org' for a whole organization."),
+        principalId: z
+            .string()
+            .describe("Email (user) or org id (org) of the principal."),
+        role: z
+            .enum(["viewer", "editor", "admin"])
+            .default("viewer")
+            .describe("Role to grant."),
+    }),
+    run: async (args) => {
+        const reg = requireShareableResource(args.resourceType);
+        await assertAccess(args.resourceType, args.resourceId, "admin");
+        const actor = getRequestUserEmail();
+        if (!actor)
+            throw new ForbiddenError("Not signed in");
+        const db = reg.getDb();
+        const [existing] = await db
+            .select()
+            .from(reg.sharesTable)
+            .where(and(eq(reg.sharesTable.resourceId, args.resourceId), eq(reg.sharesTable.principalType, args.principalType), eq(reg.sharesTable.principalId, args.principalId)));
+        if (existing) {
+            await db
+                .update(reg.sharesTable)
+                .set({ role: args.role })
+                .where(eq(reg.sharesTable.id, existing.id));
+            return { id: existing.id, updated: true };
+        }
+        const id = nanoid();
+        await db.insert(reg.sharesTable).values({
+            id,
+            resourceId: args.resourceId,
+            principalType: args.principalType,
+            principalId: args.principalId,
+            role: args.role,
+            createdBy: actor,
+            createdAt: new Date().toISOString(),
+        });
+        return { id, updated: false };
+    },
+});
+//# sourceMappingURL=share-resource.js.map

package/dist/sharing/actions/share-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"share-resource.js","sourceRoot":"","sources":["../../../src/sharing/actions/share-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,SAAS,MAAM,CAAC,IAAI,GAAG,EAAE;IACvB,MAAM,KAAK,GACT,gEAAgE,CAAC;IACnE,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,mFAAmF;IACrF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,CAAC,oDAAoD,CAAC;QACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC/D,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;aACrB,QAAQ,CAAC,2DAA2D,CAAC;QACxE,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;aACnC,OAAO,CAAC,QAAQ,CAAC;aACjB,QAAQ,CAAC,gBAAgB,CAAC;KAC9B,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;QAEtD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;aACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EACrD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAClD,CACF,CAAC;QAEJ,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,EAAE;iBACL,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;iBACvB,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;YACtC,EAAE;YACF,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;CACF,CAAC,CAAC"}

package/dist/sharing/actions/unshare-resource.d.ts

@@ -0,0 +1,3 @@
+declare const _default: any;
+export default _default;
+//# sourceMappingURL=unshare-resource.d.ts.map

package/dist/sharing/actions/unshare-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unshare-resource.d.ts","sourceRoot":"","sources":["../../../src/sharing/actions/unshare-resource.ts"],"names":[],"mappings":";AAMA,wBAwBG"}

package/dist/sharing/actions/unshare-resource.js

@@ -0,0 +1,24 @@
+import { and, eq } from "drizzle-orm";
+import { z } from "zod";
+import { defineAction } from "../../action.js";
+import { assertAccess } from "../access.js";
+import { requireShareableResource } from "../registry.js";
+export default defineAction({
+    description: "Revoke a previously granted share. Owner or admin role required.",
+    schema: z.object({
+        resourceType: z.string(),
+        resourceId: z.string(),
+        principalType: z.enum(["user", "org"]),
+        principalId: z.string(),
+    }),
+    run: async (args) => {
+        const reg = requireShareableResource(args.resourceType);
+        await assertAccess(args.resourceType, args.resourceId, "admin");
+        const db = reg.getDb();
+        await db
+            .delete(reg.sharesTable)
+            .where(and(eq(reg.sharesTable.resourceId, args.resourceId), eq(reg.sharesTable.principalType, args.principalType), eq(reg.sharesTable.principalId, args.principalId)));
+        return { ok: true };
+    },
+});
+//# sourceMappingURL=unshare-resource.js.map

package/dist/sharing/actions/unshare-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unshare-resource.js","sourceRoot":"","sources":["../../../src/sharing/actions/unshare-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,kEAAkE;IACpE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;KACxB,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,EAAE;aACL,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;aACvB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EACrD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAClD,CACF,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/sharing/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Framework-level sharing / privacy primitive.
+ *
+ * Templates make their resource tables ownable and register them here so the
+ * shared share actions and UI work end-to-end. See
+ * `.agents/skills/sharing/SKILL.md` for the full pattern.
+ */
+export { ownableColumns, createSharesTable, roleSatisfies, ROLE_RANK, type Visibility, type ShareRole, type PrincipalType, } from "./schema.js";
+export { registerShareableResource, getShareableResource, requireShareableResource, listShareableResources, type ShareableResourceRegistration, } from "./registry.js";
+export { accessFilter, resolveAccess, assertAccess, currentAccess, ForbiddenError, type AccessContext, type ResolvedAccess, } from "./access.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/sharing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sharing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,SAAS,EACT,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,EACd,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC"}

package/dist/sharing/index.js

@@ -0,0 +1,11 @@
+/**
+ * Framework-level sharing / privacy primitive.
+ *
+ * Templates make their resource tables ownable and register them here so the
+ * shared share actions and UI work end-to-end. See
+ * `.agents/skills/sharing/SKILL.md` for the full pattern.
+ */
+export { ownableColumns, createSharesTable, roleSatisfies, ROLE_RANK, } from "./schema.js";
+export { registerShareableResource, getShareableResource, requireShareableResource, listShareableResources, } from "./registry.js";
+export { accessFilter, resolveAccess, assertAccess, currentAccess, ForbiddenError, } from "./access.js";
+//# sourceMappingURL=index.js.map

package/dist/sharing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sharing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,SAAS,GAIV,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,GAEvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,EACb,cAAc,GAGf,MAAM,aAAa,CAAC"}

package/dist/sharing/registry.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Registry of shareable resources.
+ *
+ * Each template registers its ownable resource(s) once on module load so the
+ * framework-level share actions (`share-resource`, `list-resource-shares`,
+ * etc.) can dispatch to the correct tables.
+ *
+ *   import { registerShareableResource } from "@agent-native/core/sharing";
+ *   import * as schema from "./schema.js";
+ *
+ *   registerShareableResource({
+ *     type: "document",
+ *     resourceTable: schema.documents,
+ *     sharesTable: schema.documentShares,
+ *     displayName: "Document",
+ *     titleColumn: "title",
+ *   });
+ */
+export interface ShareableResourceRegistration {
+    /** Stable identifier used across actions, UI, and analytics. e.g. "document". */
+    type: string;
+    /** Drizzle table for the parent resource (must have ownableColumns()). */
+    resourceTable: any;
+    /** Drizzle table produced by createSharesTable(). */
+    sharesTable: any;
+    /** Human-readable singular label shown in the share dialog. */
+    displayName: string;
+    /**
+     * Column on the resource table that holds a human-readable title for
+     * display in the share UI. Default: "title".
+     */
+    titleColumn?: string;
+    /**
+     * Drizzle DB accessor from the template's server/db/index.ts. Required —
+     * the framework-level share actions and access helpers call this to reach
+     * the right DB instance (schema is template-specific).
+     */
+    getDb: () => any;
+}
+export declare function registerShareableResource(entry: ShareableResourceRegistration): void;
+export declare function getShareableResource(type: string): ShareableResourceRegistration | undefined;
+export declare function requireShareableResource(type: string): ShareableResourceRegistration;
+export declare function listShareableResources(): ShareableResourceRegistration[];
+//# sourceMappingURL=registry.d.ts.map

package/dist/sharing/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sharing/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,6BAA6B;IAC5C,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,aAAa,EAAE,GAAG,CAAC;IACnB,qDAAqD;IACrD,WAAW,EAAE,GAAG,CAAC;IACjB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC;CAClB;AAuBD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,6BAA6B,GACnC,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,GACX,6BAA6B,GAAG,SAAS,CAE3C;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GACX,6BAA6B,CAS/B;AAED,wBAAgB,sBAAsB,IAAI,6BAA6B,EAAE,CAExE"}

package/dist/sharing/registry.js

@@ -0,0 +1,54 @@
+/**
+ * Registry of shareable resources.
+ *
+ * Each template registers its ownable resource(s) once on module load so the
+ * framework-level share actions (`share-resource`, `list-resource-shares`,
+ * etc.) can dispatch to the correct tables.
+ *
+ *   import { registerShareableResource } from "@agent-native/core/sharing";
+ *   import * as schema from "./schema.js";
+ *
+ *   registerShareableResource({
+ *     type: "document",
+ *     resourceTable: schema.documents,
+ *     sharesTable: schema.documentShares,
+ *     displayName: "Document",
+ *     titleColumn: "title",
+ *   });
+ */
+// Stash the registry on globalThis so it survives SSR bundle duplication.
+// Vite SSR's `noExternal: /^(?!node:)/` policy means @agent-native/core gets
+// inlined into every server bundle that imports it — and each bundle gets its
+// own module-level state. A plain `new Map()` here would create one Map per
+// bundle, so the template's `registerShareableResource()` (called from the
+// Nitro plugin graph) wouldn't be visible to the framework's auto-mounted
+// share-resource action (loaded via `import("../sharing/actions/...js")` in a
+// different module instance). Using globalThis collapses them back to one Map.
+const REGISTRY_KEY = "__agentNativeShareableResources__";
+const globalRegistry = globalThis;
+function getRegistry() {
+    let r = globalRegistry[REGISTRY_KEY];
+    if (!r) {
+        r = new Map();
+        globalRegistry[REGISTRY_KEY] = r;
+    }
+    return r;
+}
+export function registerShareableResource(entry) {
+    getRegistry().set(entry.type, entry);
+}
+export function getShareableResource(type) {
+    return getRegistry().get(type);
+}
+export function requireShareableResource(type) {
+    const reg = getRegistry();
+    const entry = reg.get(type);
+    if (!entry) {
+        throw new Error(`Unknown shareable resource type: "${type}". Did you forget registerShareableResource()?`);
+    }
+    return entry;
+}
+export function listShareableResources() {
+    return Array.from(getRegistry().values());
+}
+//# sourceMappingURL=registry.js.map

package/dist/sharing/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sharing/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAwBH,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAEzD,MAAM,cAAc,GAClB,UAAiB,CAAC;AACpB,SAAS,WAAW;IAClB,IAAI,CAAC,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,IAAI,GAAG,EAAyC,CAAC;QACrD,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAoC;IAEpC,WAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY;IAEZ,OAAO,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAY;IAEZ,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,gDAAgD,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/sharing/schema.d.ts

@@ -0,0 +1,202 @@
+/**
+ * Schema factories for sharing/ownership.
+ *
+ * Templates make a resource table "ownable" by spreading `ownableColumns()` into
+ * the table definition and declaring a companion shares table via
+ * `createSharesTable()`. The shares table carries per-principal grants; the
+ * parent table's `visibility` column is the coarse default (private / org /
+ * public).
+ *
+ *   import { table, text, ownableColumns, createSharesTable } from
+ *     "@agent-native/core/db/schema";
+ *
+ *   export const decks = table("decks", {
+ *     id: text("id").primaryKey(),
+ *     title: text("title").notNull(),
+ *     data: text("data").notNull(),
+ *     ...ownableColumns(),
+ *   });
+ *
+ *   export const deckShares = createSharesTable("deck_shares");
+ *
+ * The share row `role` supports `viewer | editor | admin`. `admin` is a
+ * share-level capability — it lets non-owners manage shares. The single
+ * `owner_email` column on the resource remains the ground truth for ownership.
+ */
+/**
+ * Columns any ownable resource should include. Spread into the table definition.
+ *
+ * - `ownerEmail` — the creator. Auto-filled by write actions from the request context.
+ * - `orgId`     — owner's active org at creation time. Used for `visibility = 'org'` checks.
+ * - `visibility`— coarse default: `'private' | 'org' | 'public'`. Default `'private'`.
+ */
+export declare function ownableColumns(): {
+    ownerEmail: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm/sqlite-core").SQLiteTextBuilderInitial<"owner_email", [string, ...string[]], number>>>;
+    orgId: import("drizzle-orm/sqlite-core").SQLiteTextBuilderInitial<"org_id", [string, ...string[]], number>;
+    visibility: import("drizzle-orm").HasDefault<import("drizzle-orm").NotNull<import("drizzle-orm/sqlite-core").SQLiteTextBuilderInitial<"visibility", ["private", "org", "public"], number>>>;
+};
+/**
+ * Create a companion shares table for an ownable resource. Call this right
+ * after defining the parent table.
+ *
+ * Columns:
+ * - `id`              — share row id (generated by the share action)
+ * - `resourceId`      — id of the parent resource
+ * - `principalType`   — `'user' | 'org'`
+ * - `principalId`     — email (for user) or org id (for org)
+ * - `role`            — `'viewer' | 'editor' | 'admin'`
+ * - `createdBy`       — email of the user who created the share
+ * - `createdAt`       — ISO timestamp
+ *
+ * Uniqueness across `(resource_id, principal_type, principal_id)` is enforced
+ * at the action layer via upsert-style logic. A composite DB-level unique
+ * index can be added per template if desired — omitted here to keep the
+ * factory dialect-agnostic.
+ */
+export declare function createSharesTable(tableName: string): import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: string;
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        resourceId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "resource_id";
+            tableName: string;
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        principalType: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "principal_type";
+            tableName: string;
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "user" | "org";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["user", "org"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        principalId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "principal_id";
+            tableName: string;
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        role: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "role";
+            tableName: string;
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "admin" | "viewer" | "editor";
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["viewer", "editor", "admin"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        createdBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_by";
+            tableName: string;
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "created_at";
+            tableName: string;
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+export type Visibility = "private" | "org" | "public";
+export type ShareRole = "viewer" | "editor" | "admin";
+export type PrincipalType = "user" | "org";
+/** Role precedence — higher number = stronger capability. */
+export declare const ROLE_RANK: Record<ShareRole | "owner", number>;
+export declare function roleSatisfies(actual: ShareRole | "owner", minimum: ShareRole | "owner"): boolean;
+//# sourceMappingURL=schema.d.ts.map

package/dist/sharing/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/sharing/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH;;;;;;GAMG;AACH,wBAAgB,cAAc;;;;EAU7B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAclD;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;AACtD,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AACtD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,CAAC;AAE3C,6DAA6D;AAC7D,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,OAAO,EAAE,MAAM,CAKzD,CAAC;AAEF,wBAAgB,aAAa,CAC3B,MAAM,EAAE,SAAS,GAAG,OAAO,EAC3B,OAAO,EAAE,SAAS,GAAG,OAAO,GAC3B,OAAO,CAET"}

package/dist/sharing/schema.js

@@ -0,0 +1,88 @@
+/**
+ * Schema factories for sharing/ownership.
+ *
+ * Templates make a resource table "ownable" by spreading `ownableColumns()` into
+ * the table definition and declaring a companion shares table via
+ * `createSharesTable()`. The shares table carries per-principal grants; the
+ * parent table's `visibility` column is the coarse default (private / org /
+ * public).
+ *
+ *   import { table, text, ownableColumns, createSharesTable } from
+ *     "@agent-native/core/db/schema";
+ *
+ *   export const decks = table("decks", {
+ *     id: text("id").primaryKey(),
+ *     title: text("title").notNull(),
+ *     data: text("data").notNull(),
+ *     ...ownableColumns(),
+ *   });
+ *
+ *   export const deckShares = createSharesTable("deck_shares");
+ *
+ * The share row `role` supports `viewer | editor | admin`. `admin` is a
+ * share-level capability — it lets non-owners manage shares. The single
+ * `owner_email` column on the resource remains the ground truth for ownership.
+ */
+import { table, text, now } from "../db/schema.js";
+/**
+ * Columns any ownable resource should include. Spread into the table definition.
+ *
+ * - `ownerEmail` — the creator. Auto-filled by write actions from the request context.
+ * - `orgId`     — owner's active org at creation time. Used for `visibility = 'org'` checks.
+ * - `visibility`— coarse default: `'private' | 'org' | 'public'`. Default `'private'`.
+ */
+export function ownableColumns() {
+    return {
+        ownerEmail: text("owner_email").notNull().default("local@localhost"),
+        orgId: text("org_id"),
+        visibility: text("visibility", {
+            enum: ["private", "org", "public"],
+        })
+            .notNull()
+            .default("private"),
+    };
+}
+/**
+ * Create a companion shares table for an ownable resource. Call this right
+ * after defining the parent table.
+ *
+ * Columns:
+ * - `id`              — share row id (generated by the share action)
+ * - `resourceId`      — id of the parent resource
+ * - `principalType`   — `'user' | 'org'`
+ * - `principalId`     — email (for user) or org id (for org)
+ * - `role`            — `'viewer' | 'editor' | 'admin'`
+ * - `createdBy`       — email of the user who created the share
+ * - `createdAt`       — ISO timestamp
+ *
+ * Uniqueness across `(resource_id, principal_type, principal_id)` is enforced
+ * at the action layer via upsert-style logic. A composite DB-level unique
+ * index can be added per template if desired — omitted here to keep the
+ * factory dialect-agnostic.
+ */
+export function createSharesTable(tableName) {
+    return table(tableName, {
+        id: text("id").primaryKey(),
+        resourceId: text("resource_id").notNull(),
+        principalType: text("principal_type", {
+            enum: ["user", "org"],
+        }).notNull(),
+        principalId: text("principal_id").notNull(),
+        role: text("role", { enum: ["viewer", "editor", "admin"] })
+            .notNull()
+            .default("viewer"),
+        createdBy: text("created_by").notNull(),
+        createdAt: text("created_at").notNull().default(now()),
+    });
+}
+/** Role precedence — higher number = stronger capability. */
+export const ROLE_RANK = {
+    viewer: 1,
+    editor: 2,
+    admin: 3,
+    owner: 4,
+};
+export function roleSatisfies(actual, minimum) {
+    return ROLE_RANK[actual] >= ROLE_RANK[minimum];
+}
+//# sourceMappingURL=schema.js.map

package/dist/sharing/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/sharing/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACpE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;QACrB,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;YAC7B,IAAI,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC;SACnC,CAAC;aACC,OAAO,EAAE;aACT,OAAO,CAAC,SAAS,CAAC;KACtB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,OAAO,KAAK,CAAC,SAAS,EAAE;QACtB,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE;QAC3B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;QACzC,aAAa,EAAE,IAAI,CAAC,gBAAgB,EAAE;YACpC,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;SACtB,CAAC,CAAC,OAAO,EAAE;QACZ,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;QAC3C,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;aACxD,OAAO,EAAE;aACT,OAAO,CAAC,QAAQ,CAAC;QACpB,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;QACvC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAMD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,SAAS,GAAwC;IAC5D,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,MAAM,UAAU,aAAa,CAC3B,MAA2B,EAC3B,OAA4B;IAE5B,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC"}