@agent-native/core 0.82.0 → 0.84.0

package/dist/server/open-route.d.ts

@@ -7,6 +7,15 @@ export interface OpenRouteOptions {
         view?: string;
         params: Record<string, string>;
     }) => string | null | undefined;
+    /** Per-template escape hatch for public deep-link targets. Return true only
+     *  when the resolved SPA target is safe to show without a session. The open
+     *  route will redirect without writing application state. */
+    allowUnauthenticatedOpen?: (params: {
+        app?: string;
+        view?: string;
+        params: Record<string, string>;
+        target: string;
+    }) => boolean | Promise<boolean>;
 }
 export declare function createOpenRouteHandler(options?: OpenRouteOptions): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<Response>>;
 //# sourceMappingURL=open-route.d.ts.map

package/dist/server/open-route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-route.d.ts","sourceRoot":"","sources":["../../src/server/open-route.ts"],"names":[],"mappings":"AAkEA,MAAM,WAAW,gBAAgB;IAC/B;;yEAEqE;IACrE,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE;QACzB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACjC;AAoFD,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,gBAAqB,2FAoIpE"}
+{"version":3,"file":"open-route.d.ts","sourceRoot":"","sources":["../../src/server/open-route.ts"],"names":[],"mappings":"AAkEA,MAAM,WAAW,gBAAgB;IAC/B;;yEAEqE;IACrE,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE;QACzB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAChC,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChC;;iEAE6D;IAC7D,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE;QAClC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClC;AAoFD,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,gBAAqB,2FA8IpE"}

package/dist/server/open-route.js

@@ -128,11 +128,58 @@ export function createOpenRouteHandler(options = {}) {
         const view = search.get("view") ?? undefined;
         const toParam = search.get("to") ?? undefined;
         const compose = search.get("compose") ?? undefined;
+        // Build the navigation payload from every non-reserved query param
+        // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).
+        const navParams = {};
+        for (const [k, v] of search.entries()) {
+            if (RESERVED.has(k))
+                continue;
+            navParams[k] = v;
+        }
+        const navPayload = { ...navParams };
+        if (view)
+            navPayload.view = view;
+        // Resolve the SPA path to redirect to.
+        let target = safeRelativePath(toParam) ??
+            safeRelativePath(options.resolveOpenPath?.({ app, view, params: navParams }) ??
+                (view ? `/${view}` : null)) ??
+            "/";
+        // Forward filter params (f_*) onto the redirect so dashboards/lists open
+        // pre-filtered even before the navigate command is drained.
+        const filters = new URLSearchParams();
+        for (const [k, v] of search.entries()) {
+            if (k.startsWith("f_"))
+                filters.set(k, v);
+        }
+        target = appendSearchParams(target, filters);
+        const embedParams = new URLSearchParams();
+        for (const key of [
+            EMBED_MODE_QUERY_PARAM,
+            EMBED_TOKEN_QUERY_PARAM,
+            MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
+        ]) {
+            const value = search.get(key);
+            if (value)
+                embedParams.set(key, value);
+        }
+        target = appendSearchParams(target, embedParams);
+        target = withCollapsedAgentSidebarParam(target);
+        target = withConfiguredRedirectBasePath(target);
         // Resolve the BROWSER session. When unauthenticated, serve the same login
         // form the guard would — at this URL — so the post-login reload returns
-        // here authenticated.
+        // here authenticated. Public templates may opt specific deep-link targets
+        // into anonymous redirect; no app-state writes happen without a session.
         const session = await getSession(event);
         if (!session?.email) {
+            const allowAnonymous = await options.allowUnauthenticatedOpen?.({
+                app,
+                view,
+                params: navParams,
+                target,
+            });
+            if (allowAnonymous) {
+                return redirect(event, target, requestHasEmbedAuthMarker(event));
+            }
             const html = getConfiguredLoginHtml(event);
             if (html) {
                 return new Response(html, {
@@ -143,17 +190,6 @@ export function createOpenRouteHandler(options = {}) {
             // No auth guard configured (fully open app) — best effort: still send
             // the user to the view; nothing to scope the navigate write to.
         }
-        // Build the navigation payload from every non-reserved query param
-        // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).
-        const navParams = {};
-        for (const [k, v] of search.entries()) {
-            if (RESERVED.has(k))
-                continue;
-            navParams[k] = v;
-        }
-        const navPayload = { ...navParams };
-        if (view)
-            navPayload.view = view;
         if (session?.email) {
             try {
                 await appStatePut(session.email, "navigate", navPayload, {
@@ -204,32 +240,6 @@ export function createOpenRouteHandler(options = {}) {
                 // below still lands the user on the right view.
             }
         }
-        // Resolve the SPA path to redirect to.
-        let target = safeRelativePath(toParam) ??
-            safeRelativePath(options.resolveOpenPath?.({ app, view, params: navParams }) ??
-                (view ? `/${view}` : null)) ??
-            "/";
-        // Forward filter params (f_*) onto the redirect so dashboards/lists open
-        // pre-filtered even before the navigate command is drained.
-        const filters = new URLSearchParams();
-        for (const [k, v] of search.entries()) {
-            if (k.startsWith("f_"))
-                filters.set(k, v);
-        }
-        target = appendSearchParams(target, filters);
-        const embedParams = new URLSearchParams();
-        for (const key of [
-            EMBED_MODE_QUERY_PARAM,
-            EMBED_TOKEN_QUERY_PARAM,
-            MCP_APP_CHAT_BRIDGE_QUERY_PARAM,
-        ]) {
-            const value = search.get(key);
-            if (value)
-                embedParams.set(key, value);
-        }
-        target = appendSearchParams(target, embedParams);
-        target = withCollapsedAgentSidebarParam(target);
-        target = withConfiguredRedirectBasePath(target);
         return redirect(event, target, requestHasEmbedAuthMarker(event));
     });
 }

package/dist/server/open-route.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-route.js","sourceRoot":"","sources":["../../src/server/open-route.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,iEAAiE;AACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,KAAK;IACL,MAAM;IACN,IAAI;IACJ,SAAS;IACT,sBAAsB;IACtB,uBAAuB;IACvB,+BAA+B;IAC/B,yBAAyB;CAC1B,CAAC,CAAC;AAEH,2EAA2E;AAC3E,0BAA0B;AAC1B,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE7D,yDAAyD;AACzD,2EAA2E;AAC3E,sEAAsE;AACtE,0CAA0C;AAC1C,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAa3C,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,GAAG,eAAe,GAAI,KAAa,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,OAAQ,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAK,KAAa,CAAC,IAAI,IAAI,GAAG,CAAC;AACrE,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAA8B;IACtD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,OAAgB;IAC1D,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,gFAAgF;QAChF,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAO,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CACf,KAAc,EACd,QAAgB,EAChB,aAAsB;IAEtB,wEAAwE;IACxE,8CAA8C;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,IAAI,aAAa;QAAE,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,MAAuB;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CAAC,MAAc;IACpD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QACtE,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAO,GAAqB,EAAE;IACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;gBACnE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,YAAY,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAEnD,0EAA0E;QAC1E,wEAAwE;QACxE,sBAAsB;QACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;iBACxD,CAAC,CAAC;YACL,CAAC;YACD,sEAAsE;YACtE,gEAAgE;QAClE,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC9B,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,UAAU,GAA4B,EAAE,GAAG,SAAS,EAAE,CAAC;QAC7D,IAAI,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;QAEjC,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE;oBACvD,aAAa,EAAE,WAAW;iBAC3B,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;wBACnD,iEAAiE;wBACjE,iEAAiE;wBACjE,gEAAgE;wBAChE,gDAAgD;wBAChD,IACE,KAAK;4BACL,OAAO,KAAK,KAAK,QAAQ;4BACzB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;4BAC5B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EACzB,CAAC;4BACD,MAAM,UAAU,GAAG,WAAW,KAAK,CAAC,EAAE,EAAE,CAAC;4BACzC,gEAAgE;4BAChE,8DAA8D;4BAC9D,+DAA+D;4BAC/D,gEAAgE;4BAChE,8DAA8D;4BAC9D,gEAAgE;4BAChE,gEAAgE;4BAChE,MAAM,UAAU,GACd,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gCACzD,CAAC,CAAC,KAAK,CAAC,EAAE;gCACV,CAAC,CAAC,KAAK,CAAC,EAAE;gCACV,CAAC,CAAC,KAAK,CAAC,GAAG;gCACX,CAAC,CAAC,KAAK,CAAC,IAAI;gCACZ,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;4BAC1B,MAAM,QAAQ,GAAG,UAAU;gCACzB,CAAC,CAAC,IAAI;gCACN,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;4BACjD,IAAI,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;gCAC5B,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;oCAClD,aAAa,EAAE,WAAW;iCAC3B,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,0DAA0D;oBAC5D,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;gBAChE,gDAAgD;YAClD,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,IAAI,MAAM,GACR,gBAAgB,CAAC,OAAO,CAAC;YACzB,gBAAgB,CACd,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACzD,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7B;YACD,GAAG,CAAC;QAEN,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI;YAChB,sBAAsB;YACtB,uBAAuB;YACvB,+BAA+B;SAChC,EAAE,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;QAEhD,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * `/_agent-native/open` — the stable deep-link route.\n *\n * An external coding agent (Claude Code / Cowork / Codex) surfaces an\n * \"Open in <app> →\" link (built by an action's `link` builder, see\n * `deep-link.ts`). When the user clicks it in any browser / inline webview,\n * this route:\n *   1. Resolves the *browser* session (NOT the agent token) — so the record\n *      always lands where the human is logged in.\n *   2. When unauthenticated, serves the same sign-in form the auth guard\n *      would, *at this same URL*. The login form's success handler reloads\n *      `window.location.href`, so the now-authenticated request re-enters\n *      this route and proceeds. No `?next=` plumbing needed.\n *   3. Writes the existing one-shot `navigate` application-state command (the\n *      exact key the UI already drains every 2s — we don't invent a new\n *      navigation mechanism, we bridge to it), plus an optional `compose-<id>`\n *      draft.\n *   4. 302-redirects to the rendered SPA view so the page loads immediately;\n *      the polled `navigate` command then applies record-level focus.\n *\n * The link itself is a pure pointer (view + record ids + filters) and carries\n * no privileged state.\n */\nimport type { H3Event } from \"h3\";\nimport { defineEventHandler, getHeader, getMethod } from \"h3\";\n\nimport { appStatePut, appStateGet } from \"../application-state/store.js\";\nimport {\n  AGENT_SIDEBAR_QUERY_PARAM,\n  withCollapsedAgentSidebarParam,\n} from \"../shared/agent-sidebar-url.js\";\nimport {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_TOKEN_QUERY_PARAM,\n  MCP_APP_CHAT_BRIDGE_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\nimport {\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n} from \"../shared/mcp-embed-headers.js\";\nimport { getConfiguredAppBasePath } from \"./app-base-path.js\";\nimport { getSession, getConfiguredLoginHtml } from \"./auth.js\";\nimport { requestHasEmbedAuthMarker } from \"./embed-session.js\";\n\n/** Query keys that are route control, not navigation payload. */\nconst RESERVED = new Set([\n  \"app\",\n  \"view\",\n  \"to\",\n  \"compose\",\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_TOKEN_QUERY_PARAM,\n  MCP_APP_CHAT_BRIDGE_QUERY_PARAM,\n  AGENT_SIDEBAR_QUERY_PARAM,\n]);\n\n// Control-char guard (NUL..US + DEL). Defined via codepoints so the source\n// file stays plain ASCII.\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\n\n// Compose-draft id charset. Mirrors `sanitizeDraftId` in\n// templates/mail/actions/manage-draft.ts so the id we concatenate into the\n// `compose-<id>` application-state key can't escape the key namespace\n// (path-traversal / key injection guard).\nconst COMPOSE_ID = /^[a-zA-Z0-9_-]{1,64}$/;\n\nexport interface OpenRouteOptions {\n  /** Per-template override that turns the parsed deep-link params into the\n   *  client-side SPA path to redirect to. Return `null` to use the default\n   *  (`/<view>`). Filter params (`f_*`) are appended automatically. */\n  resolveOpenPath?: (params: {\n    app?: string;\n    view?: string;\n    params: Record<string, string>;\n  }) => string | null | undefined;\n}\n\nfunction getRequestUrl(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return `${mountedPathname}${(event as any).url?.search ?? \"\"}`;\n  }\n  return (event as any).node?.req?.url ?? (event as any).path ?? \"/\";\n}\n\n/** Decode a base64url string to UTF-8 (Node Buffer; this route is Node-only). */\nfunction decodeBase64Url(input: string): string {\n  return Buffer.from(input, \"base64url\").toString(\"utf8\");\n}\n\n/**\n * Normalize a candidate redirect path to a safe, same-origin, leading-slash\n * relative path. Rejects absolute URLs, scheme-relative `//host`, and control\n * chars (open-redirect guard). Returns `null` when unsafe.\n */\nfunction safeRelativePath(raw: string | undefined | null): string | null {\n  if (!raw) return null;\n  if (CONTROL_CHARS.test(raw)) return null;\n  if (!raw.startsWith(\"/\")) return null;\n  if (raw.startsWith(\"//\") || raw.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(raw)) return null;\n  return raw;\n}\n\nfunction addMcpEmbedHeaders(event: H3Event, headers: Headers): Headers {\n  headers.set(\"Cross-Origin-Embedder-Policy\", \"require-corp\");\n  headers.set(\"Cross-Origin-Opener-Policy\", \"same-origin\");\n  headers.set(\"Cross-Origin-Resource-Policy\", \"cross-origin\");\n  headers.set(\"Referrer-Policy\", \"no-referrer\");\n  const origin = getHeader(event, \"origin\");\n  if (isMcpEmbedCorsOrigin(origin)) {\n    // origin is non-null: isMcpEmbedCorsOrigin only returns true for truthy origins\n    headers.set(\"Access-Control-Allow-Origin\", origin!);\n    headers.set(\"Vary\", \"Origin\");\n    headers.set(\"Access-Control-Allow-Methods\", \"GET,HEAD,OPTIONS\");\n    headers.set(\"Access-Control-Allow-Headers\", MCP_EMBED_CORS_ALLOW_HEADERS);\n    headers.set(\"Access-Control-Expose-Headers\", \"Location\");\n  }\n  return headers;\n}\n\nfunction redirect(\n  event: H3Event,\n  location: string,\n  embedRedirect: boolean,\n): Response {\n  // Native web Response (not h3 v2's reworked sendRedirect) — matches the\n  // redirect pattern used elsewhere in auth.ts.\n  const headers = new Headers({ Location: location });\n  if (embedRedirect) addMcpEmbedHeaders(event, headers);\n  return new Response(\"\", { status: 302, headers });\n}\n\nfunction appendSearchParams(target: string, params: URLSearchParams): string {\n  if (!params.toString()) return target;\n  try {\n    const url = new URL(target, \"http://an.invalid\");\n    for (const [k, v] of params.entries()) url.searchParams.set(k, v);\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return target;\n  }\n}\n\nfunction withConfiguredRedirectBasePath(target: string): string {\n  const base = getConfiguredAppBasePath();\n  if (!base) return target;\n  try {\n    const url = new URL(target, \"http://an.invalid\");\n    if (url.pathname === base || url.pathname.startsWith(`${base}/`)) {\n      return `${url.pathname}${url.search}${url.hash}`;\n    }\n    url.pathname = url.pathname === \"/\" ? base : `${base}${url.pathname}`;\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return target;\n  }\n}\n\nexport function createOpenRouteHandler(options: OpenRouteOptions = {}) {\n  return defineEventHandler(async (event: H3Event) => {\n    const method = getMethod(event);\n    if (method !== \"GET\" && method !== \"HEAD\") {\n      return new Response(JSON.stringify({ error: \"Method not allowed\" }), {\n        status: 405,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n\n    const rawUrl = getRequestUrl(event);\n    let search: URLSearchParams;\n    try {\n      search = new URL(rawUrl, \"http://an.invalid\").searchParams;\n    } catch {\n      search = new URLSearchParams();\n    }\n\n    const app = search.get(\"app\") ?? undefined;\n    const view = search.get(\"view\") ?? undefined;\n    const toParam = search.get(\"to\") ?? undefined;\n    const compose = search.get(\"compose\") ?? undefined;\n\n    // Resolve the BROWSER session. When unauthenticated, serve the same login\n    // form the guard would — at this URL — so the post-login reload returns\n    // here authenticated.\n    const session = await getSession(event);\n    if (!session?.email) {\n      const html = getConfiguredLoginHtml(event);\n      if (html) {\n        return new Response(html, {\n          status: 200,\n          headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n        });\n      }\n      // No auth guard configured (fully open app) — best effort: still send\n      // the user to the view; nothing to scope the navigate write to.\n    }\n\n    // Build the navigation payload from every non-reserved query param\n    // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).\n    const navParams: Record<string, string> = {};\n    for (const [k, v] of search.entries()) {\n      if (RESERVED.has(k)) continue;\n      navParams[k] = v;\n    }\n    const navPayload: Record<string, unknown> = { ...navParams };\n    if (view) navPayload.view = view;\n\n    if (session?.email) {\n      try {\n        await appStatePut(session.email, \"navigate\", navPayload, {\n          requestSource: \"deep-link\",\n        });\n        if (compose) {\n          try {\n            const draft = JSON.parse(decodeBase64Url(compose));\n            // Validate the id before using it as a key segment. An unsafe id\n            // could escape the `compose-` namespace and clobber an unrelated\n            // application-state key; skip the write (the view still opens),\n            // mirroring the malformed-payload branch below.\n            if (\n              draft &&\n              typeof draft === \"object\" &&\n              typeof draft.id === \"string\" &&\n              COMPOSE_ID.test(draft.id)\n            ) {\n              const composeKey = `compose-${draft.id}`;\n              // A compact deep link may carry only `{ id, subject }` when the\n              // full draft was too large to inline in the URL. The complete\n              // draft is already persisted at `compose-<id>` by manage-draft\n              // on create/update. Never let the truncated stub overwrite that\n              // richer saved draft (would silently lose body / recipients /\n              // reply metadata). Only write when the payload actually carries\n              // content, or when nothing is saved yet (composer still opens).\n              const hasContent =\n                (typeof draft.body === \"string\" && draft.body.length > 0) ||\n                !!draft.to ||\n                !!draft.cc ||\n                !!draft.bcc ||\n                !!draft.html ||\n                !!draft.replyToThreadId;\n              const existing = hasContent\n                ? null\n                : await appStateGet(session.email, composeKey);\n              if (hasContent || !existing) {\n                await appStatePut(session.email, composeKey, draft, {\n                  requestSource: \"deep-link\",\n                });\n              }\n            }\n          } catch {\n            // Malformed compose payload — skip; the view still opens.\n          }\n        }\n      } catch {\n        // App-state write failure shouldn't 500 the click; the redirect\n        // below still lands the user on the right view.\n      }\n    }\n\n    // Resolve the SPA path to redirect to.\n    let target =\n      safeRelativePath(toParam) ??\n      safeRelativePath(\n        options.resolveOpenPath?.({ app, view, params: navParams }) ??\n          (view ? `/${view}` : null),\n      ) ??\n      \"/\";\n\n    // Forward filter params (f_*) onto the redirect so dashboards/lists open\n    // pre-filtered even before the navigate command is drained.\n    const filters = new URLSearchParams();\n    for (const [k, v] of search.entries()) {\n      if (k.startsWith(\"f_\")) filters.set(k, v);\n    }\n    target = appendSearchParams(target, filters);\n    const embedParams = new URLSearchParams();\n    for (const key of [\n      EMBED_MODE_QUERY_PARAM,\n      EMBED_TOKEN_QUERY_PARAM,\n      MCP_APP_CHAT_BRIDGE_QUERY_PARAM,\n    ]) {\n      const value = search.get(key);\n      if (value) embedParams.set(key, value);\n    }\n    target = appendSearchParams(target, embedParams);\n    target = withCollapsedAgentSidebarParam(target);\n    target = withConfiguredRedirectBasePath(target);\n\n    return redirect(event, target, requestHasEmbedAuthMarker(event));\n  });\n}\n"]}
+{"version":3,"file":"open-route.js","sourceRoot":"","sources":["../../src/server/open-route.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,iEAAiE;AACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,KAAK;IACL,MAAM;IACN,IAAI;IACJ,SAAS;IACT,sBAAsB;IACtB,uBAAuB;IACvB,+BAA+B;IAC/B,yBAAyB;CAC1B,CAAC,CAAC;AAEH,2EAA2E;AAC3E,0BAA0B;AAC1B,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE7D,yDAAyD;AACzD,2EAA2E;AAC3E,sEAAsE;AACtE,0CAA0C;AAC1C,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAsB3C,SAAS,aAAa,CAAC,KAAc;IACnC,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,GAAG,eAAe,GAAI,KAAa,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,OAAQ,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAK,KAAa,CAAC,IAAI,IAAI,GAAG,CAAC;AACrE,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAA8B;IACtD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,OAAgB;IAC1D,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,gFAAgF;QAChF,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAO,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CACf,KAAc,EACd,QAAgB,EAChB,aAAsB;IAEtB,wEAAwE;IACxE,8CAA8C;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpD,IAAI,aAAa;QAAE,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,MAAuB;IACjE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,8BAA8B,CAAC,MAAc;IACpD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QACtE,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAO,GAAqB,EAAE;IACnE,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,EAAE;gBACnE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,YAAY,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAEnD,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC9B,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,UAAU,GAA4B,EAAE,GAAG,SAAS,EAAE,CAAC;QAC7D,IAAI,IAAI;YAAE,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC;QAEjC,uCAAuC;QACvC,IAAI,MAAM,GACR,gBAAgB,CAAC,OAAO,CAAC;YACzB,gBAAgB,CACd,OAAO,CAAC,eAAe,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;gBACzD,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7B;YACD,GAAG,CAAC;QAEN,yEAAyE;QACzE,4DAA4D;QAC5D,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,eAAe,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI;YAChB,sBAAsB;YACtB,uBAAuB;YACvB,+BAA+B;SAChC,EAAE,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,KAAK;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;QAEhD,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,wBAAwB,EAAE,CAAC;gBAC9D,GAAG;gBACH,IAAI;gBACJ,MAAM,EAAE,SAAS;gBACjB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;iBACxD,CAAC,CAAC;YACL,CAAC;YACD,sEAAsE;YACtE,gEAAgE;QAClE,CAAC;QAED,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE;oBACvD,aAAa,EAAE,WAAW;iBAC3B,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;wBACnD,iEAAiE;wBACjE,iEAAiE;wBACjE,gEAAgE;wBAChE,gDAAgD;wBAChD,IACE,KAAK;4BACL,OAAO,KAAK,KAAK,QAAQ;4BACzB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;4BAC5B,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EACzB,CAAC;4BACD,MAAM,UAAU,GAAG,WAAW,KAAK,CAAC,EAAE,EAAE,CAAC;4BACzC,gEAAgE;4BAChE,8DAA8D;4BAC9D,+DAA+D;4BAC/D,gEAAgE;4BAChE,8DAA8D;4BAC9D,gEAAgE;4BAChE,gEAAgE;4BAChE,MAAM,UAAU,GACd,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;gCACzD,CAAC,CAAC,KAAK,CAAC,EAAE;gCACV,CAAC,CAAC,KAAK,CAAC,EAAE;gCACV,CAAC,CAAC,KAAK,CAAC,GAAG;gCACX,CAAC,CAAC,KAAK,CAAC,IAAI;gCACZ,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;4BAC1B,MAAM,QAAQ,GAAG,UAAU;gCACzB,CAAC,CAAC,IAAI;gCACN,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;4BACjD,IAAI,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;gCAC5B,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE;oCAClD,aAAa,EAAE,WAAW;iCAC3B,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,0DAA0D;oBAC5D,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;gBAChE,gDAAgD;YAClD,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * `/_agent-native/open` — the stable deep-link route.\n *\n * An external coding agent (Claude Code / Cowork / Codex) surfaces an\n * \"Open in <app> →\" link (built by an action's `link` builder, see\n * `deep-link.ts`). When the user clicks it in any browser / inline webview,\n * this route:\n *   1. Resolves the *browser* session (NOT the agent token) — so the record\n *      always lands where the human is logged in.\n *   2. When unauthenticated, serves the same sign-in form the auth guard\n *      would, *at this same URL*. The login form's success handler reloads\n *      `window.location.href`, so the now-authenticated request re-enters\n *      this route and proceeds. No `?next=` plumbing needed.\n *   3. Writes the existing one-shot `navigate` application-state command (the\n *      exact key the UI already drains every 2s — we don't invent a new\n *      navigation mechanism, we bridge to it), plus an optional `compose-<id>`\n *      draft.\n *   4. 302-redirects to the rendered SPA view so the page loads immediately;\n *      the polled `navigate` command then applies record-level focus.\n *\n * The link itself is a pure pointer (view + record ids + filters) and carries\n * no privileged state.\n */\nimport type { H3Event } from \"h3\";\nimport { defineEventHandler, getHeader, getMethod } from \"h3\";\n\nimport { appStatePut, appStateGet } from \"../application-state/store.js\";\nimport {\n  AGENT_SIDEBAR_QUERY_PARAM,\n  withCollapsedAgentSidebarParam,\n} from \"../shared/agent-sidebar-url.js\";\nimport {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_TOKEN_QUERY_PARAM,\n  MCP_APP_CHAT_BRIDGE_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\nimport {\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n} from \"../shared/mcp-embed-headers.js\";\nimport { getConfiguredAppBasePath } from \"./app-base-path.js\";\nimport { getSession, getConfiguredLoginHtml } from \"./auth.js\";\nimport { requestHasEmbedAuthMarker } from \"./embed-session.js\";\n\n/** Query keys that are route control, not navigation payload. */\nconst RESERVED = new Set([\n  \"app\",\n  \"view\",\n  \"to\",\n  \"compose\",\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_TOKEN_QUERY_PARAM,\n  MCP_APP_CHAT_BRIDGE_QUERY_PARAM,\n  AGENT_SIDEBAR_QUERY_PARAM,\n]);\n\n// Control-char guard (NUL..US + DEL). Defined via codepoints so the source\n// file stays plain ASCII.\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\n\n// Compose-draft id charset. Mirrors `sanitizeDraftId` in\n// templates/mail/actions/manage-draft.ts so the id we concatenate into the\n// `compose-<id>` application-state key can't escape the key namespace\n// (path-traversal / key injection guard).\nconst COMPOSE_ID = /^[a-zA-Z0-9_-]{1,64}$/;\n\nexport interface OpenRouteOptions {\n  /** Per-template override that turns the parsed deep-link params into the\n   *  client-side SPA path to redirect to. Return `null` to use the default\n   *  (`/<view>`). Filter params (`f_*`) are appended automatically. */\n  resolveOpenPath?: (params: {\n    app?: string;\n    view?: string;\n    params: Record<string, string>;\n  }) => string | null | undefined;\n  /** Per-template escape hatch for public deep-link targets. Return true only\n   *  when the resolved SPA target is safe to show without a session. The open\n   *  route will redirect without writing application state. */\n  allowUnauthenticatedOpen?: (params: {\n    app?: string;\n    view?: string;\n    params: Record<string, string>;\n    target: string;\n  }) => boolean | Promise<boolean>;\n}\n\nfunction getRequestUrl(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return `${mountedPathname}${(event as any).url?.search ?? \"\"}`;\n  }\n  return (event as any).node?.req?.url ?? (event as any).path ?? \"/\";\n}\n\n/** Decode a base64url string to UTF-8 (Node Buffer; this route is Node-only). */\nfunction decodeBase64Url(input: string): string {\n  return Buffer.from(input, \"base64url\").toString(\"utf8\");\n}\n\n/**\n * Normalize a candidate redirect path to a safe, same-origin, leading-slash\n * relative path. Rejects absolute URLs, scheme-relative `//host`, and control\n * chars (open-redirect guard). Returns `null` when unsafe.\n */\nfunction safeRelativePath(raw: string | undefined | null): string | null {\n  if (!raw) return null;\n  if (CONTROL_CHARS.test(raw)) return null;\n  if (!raw.startsWith(\"/\")) return null;\n  if (raw.startsWith(\"//\") || raw.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(raw)) return null;\n  return raw;\n}\n\nfunction addMcpEmbedHeaders(event: H3Event, headers: Headers): Headers {\n  headers.set(\"Cross-Origin-Embedder-Policy\", \"require-corp\");\n  headers.set(\"Cross-Origin-Opener-Policy\", \"same-origin\");\n  headers.set(\"Cross-Origin-Resource-Policy\", \"cross-origin\");\n  headers.set(\"Referrer-Policy\", \"no-referrer\");\n  const origin = getHeader(event, \"origin\");\n  if (isMcpEmbedCorsOrigin(origin)) {\n    // origin is non-null: isMcpEmbedCorsOrigin only returns true for truthy origins\n    headers.set(\"Access-Control-Allow-Origin\", origin!);\n    headers.set(\"Vary\", \"Origin\");\n    headers.set(\"Access-Control-Allow-Methods\", \"GET,HEAD,OPTIONS\");\n    headers.set(\"Access-Control-Allow-Headers\", MCP_EMBED_CORS_ALLOW_HEADERS);\n    headers.set(\"Access-Control-Expose-Headers\", \"Location\");\n  }\n  return headers;\n}\n\nfunction redirect(\n  event: H3Event,\n  location: string,\n  embedRedirect: boolean,\n): Response {\n  // Native web Response (not h3 v2's reworked sendRedirect) — matches the\n  // redirect pattern used elsewhere in auth.ts.\n  const headers = new Headers({ Location: location });\n  if (embedRedirect) addMcpEmbedHeaders(event, headers);\n  return new Response(\"\", { status: 302, headers });\n}\n\nfunction appendSearchParams(target: string, params: URLSearchParams): string {\n  if (!params.toString()) return target;\n  try {\n    const url = new URL(target, \"http://an.invalid\");\n    for (const [k, v] of params.entries()) url.searchParams.set(k, v);\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return target;\n  }\n}\n\nfunction withConfiguredRedirectBasePath(target: string): string {\n  const base = getConfiguredAppBasePath();\n  if (!base) return target;\n  try {\n    const url = new URL(target, \"http://an.invalid\");\n    if (url.pathname === base || url.pathname.startsWith(`${base}/`)) {\n      return `${url.pathname}${url.search}${url.hash}`;\n    }\n    url.pathname = url.pathname === \"/\" ? base : `${base}${url.pathname}`;\n    return `${url.pathname}${url.search}${url.hash}`;\n  } catch {\n    return target;\n  }\n}\n\nexport function createOpenRouteHandler(options: OpenRouteOptions = {}) {\n  return defineEventHandler(async (event: H3Event) => {\n    const method = getMethod(event);\n    if (method !== \"GET\" && method !== \"HEAD\") {\n      return new Response(JSON.stringify({ error: \"Method not allowed\" }), {\n        status: 405,\n        headers: { \"Content-Type\": \"application/json\" },\n      });\n    }\n\n    const rawUrl = getRequestUrl(event);\n    let search: URLSearchParams;\n    try {\n      search = new URL(rawUrl, \"http://an.invalid\").searchParams;\n    } catch {\n      search = new URLSearchParams();\n    }\n\n    const app = search.get(\"app\") ?? undefined;\n    const view = search.get(\"view\") ?? undefined;\n    const toParam = search.get(\"to\") ?? undefined;\n    const compose = search.get(\"compose\") ?? undefined;\n\n    // Build the navigation payload from every non-reserved query param\n    // (record ids + filters: threadId, eventId, dashboardId, f_*, ...).\n    const navParams: Record<string, string> = {};\n    for (const [k, v] of search.entries()) {\n      if (RESERVED.has(k)) continue;\n      navParams[k] = v;\n    }\n    const navPayload: Record<string, unknown> = { ...navParams };\n    if (view) navPayload.view = view;\n\n    // Resolve the SPA path to redirect to.\n    let target =\n      safeRelativePath(toParam) ??\n      safeRelativePath(\n        options.resolveOpenPath?.({ app, view, params: navParams }) ??\n          (view ? `/${view}` : null),\n      ) ??\n      \"/\";\n\n    // Forward filter params (f_*) onto the redirect so dashboards/lists open\n    // pre-filtered even before the navigate command is drained.\n    const filters = new URLSearchParams();\n    for (const [k, v] of search.entries()) {\n      if (k.startsWith(\"f_\")) filters.set(k, v);\n    }\n    target = appendSearchParams(target, filters);\n    const embedParams = new URLSearchParams();\n    for (const key of [\n      EMBED_MODE_QUERY_PARAM,\n      EMBED_TOKEN_QUERY_PARAM,\n      MCP_APP_CHAT_BRIDGE_QUERY_PARAM,\n    ]) {\n      const value = search.get(key);\n      if (value) embedParams.set(key, value);\n    }\n    target = appendSearchParams(target, embedParams);\n    target = withCollapsedAgentSidebarParam(target);\n    target = withConfiguredRedirectBasePath(target);\n\n    // Resolve the BROWSER session. When unauthenticated, serve the same login\n    // form the guard would — at this URL — so the post-login reload returns\n    // here authenticated. Public templates may opt specific deep-link targets\n    // into anonymous redirect; no app-state writes happen without a session.\n    const session = await getSession(event);\n    if (!session?.email) {\n      const allowAnonymous = await options.allowUnauthenticatedOpen?.({\n        app,\n        view,\n        params: navParams,\n        target,\n      });\n      if (allowAnonymous) {\n        return redirect(event, target, requestHasEmbedAuthMarker(event));\n      }\n      const html = getConfiguredLoginHtml(event);\n      if (html) {\n        return new Response(html, {\n          status: 200,\n          headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n        });\n      }\n      // No auth guard configured (fully open app) — best effort: still send\n      // the user to the view; nothing to scope the navigate write to.\n    }\n\n    if (session?.email) {\n      try {\n        await appStatePut(session.email, \"navigate\", navPayload, {\n          requestSource: \"deep-link\",\n        });\n        if (compose) {\n          try {\n            const draft = JSON.parse(decodeBase64Url(compose));\n            // Validate the id before using it as a key segment. An unsafe id\n            // could escape the `compose-` namespace and clobber an unrelated\n            // application-state key; skip the write (the view still opens),\n            // mirroring the malformed-payload branch below.\n            if (\n              draft &&\n              typeof draft === \"object\" &&\n              typeof draft.id === \"string\" &&\n              COMPOSE_ID.test(draft.id)\n            ) {\n              const composeKey = `compose-${draft.id}`;\n              // A compact deep link may carry only `{ id, subject }` when the\n              // full draft was too large to inline in the URL. The complete\n              // draft is already persisted at `compose-<id>` by manage-draft\n              // on create/update. Never let the truncated stub overwrite that\n              // richer saved draft (would silently lose body / recipients /\n              // reply metadata). Only write when the payload actually carries\n              // content, or when nothing is saved yet (composer still opens).\n              const hasContent =\n                (typeof draft.body === \"string\" && draft.body.length > 0) ||\n                !!draft.to ||\n                !!draft.cc ||\n                !!draft.bcc ||\n                !!draft.html ||\n                !!draft.replyToThreadId;\n              const existing = hasContent\n                ? null\n                : await appStateGet(session.email, composeKey);\n              if (hasContent || !existing) {\n                await appStatePut(session.email, composeKey, draft, {\n                  requestSource: \"deep-link\",\n                });\n              }\n            }\n          } catch {\n            // Malformed compose payload — skip; the view still opens.\n          }\n        }\n      } catch {\n        // App-state write failure shouldn't 500 the click; the redirect\n        // below still lands the user on the right view.\n      }\n    }\n\n    return redirect(event, target, requestHasEmbedAuthMarker(event));\n  });\n}\n"]}

package/dist/shared/reasoning-effort.js

@@ -93,6 +93,9 @@ function supportsClaudeXHigh(model) {
     // claude-fable-5 is a Mythos-class model and also supports xhigh.
     if (model.includes("fable-5"))
         return true;
+    // Sonnet 5 supports the expanded effort ladder through Builder/Anthropic.
+    if (model.includes("sonnet-5"))
+        return true;
     // opus-4-7 introduced xhigh; all opus-4.x successors (4-8, 4-9…) should too.
     const opusMatch = model.match(/opus-4-(\d+)/);
     if (opusMatch) {

package/dist/shared/reasoning-effort.js.map

@@ -1 +1 @@
-{"version":3,"file":"reasoning-effort.js","sourceRoot":"","sources":["../../src/shared/reasoning-effort.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;CACG,CAAC;AAIX,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,wBAAwB,GAAsB;IAClD,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;CACP,CAAC;AAEF,MAAM,mBAAmB,GAAsB;IAC7C,GAAG,wBAAwB;IAC3B,OAAO;CACR,CAAC;AAEF,MAAM,+BAA+B,GAAsB;IACzD,GAAG,wBAAwB;IAC3B,OAAO;IACP,KAAK;CACN,CAAC;AAEF,MAAM,sBAAsB,GAAsB;IAChD,GAAG,wBAAwB;IAC3B,KAAK;CACN,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,CAAC;AAErD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,mBAAmB,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,sBAAsB,CAAC;IAC7B,CAAC;IACD,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAyB,EACzB,MAAmC;IAEnC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,UAAU,GAAG,MAAM,CAAC;IACxB,IACE,UAAU,KAAK,OAAO;QACtB,sBAAsB,CAAC,KAAK,CAAC;QAC7B,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAC3B,CAAC;QACD,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC;IACD,IAAI,UAAU,KAAK,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,UAAU,GAAG,OAAO,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAmC;IACtE,OAAO,uBAAuB,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,kDAAkD;IAClD,kEAAkE;IAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,6EAA6E;IAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC","sourcesContent":["export const REASONING_EFFORTS = [\n  \"auto\",\n  \"none\",\n  \"minimal\",\n  \"low\",\n  \"medium\",\n  \"high\",\n  \"xhigh\",\n  \"max\",\n] as const;\n\nexport type ReasoningEffort = (typeof REASONING_EFFORTS)[number];\n\nexport const REASONING_EFFORT_LABELS: Record<ReasoningEffort, string> = {\n  auto: \"Auto\",\n  none: \"None\",\n  minimal: \"Minimal\",\n  low: \"Low\",\n  medium: \"Medium\",\n  high: \"High\",\n  xhigh: \"Extra High\",\n  max: \"Max\",\n};\n\nconst VISIBLE_STANDARD_EFFORTS: ReasoningEffort[] = [\n  \"auto\",\n  \"low\",\n  \"medium\",\n  \"high\",\n];\n\nconst VISIBLE_GPT_EFFORTS: ReasoningEffort[] = [\n  ...VISIBLE_STANDARD_EFFORTS,\n  \"xhigh\",\n];\n\nconst VISIBLE_CLAUDE_BUILT_IN_EFFORTS: ReasoningEffort[] = [\n  ...VISIBLE_STANDARD_EFFORTS,\n  \"xhigh\",\n  \"max\",\n];\n\nconst VISIBLE_CLAUDE_EFFORTS: ReasoningEffort[] = [\n  ...VISIBLE_STANDARD_EFFORTS,\n  \"max\",\n];\n\nconst effortSet = new Set<string>(REASONING_EFFORTS);\n\nexport function isReasoningEffort(value: unknown): value is ReasoningEffort {\n  return typeof value === \"string\" && effortSet.has(value);\n}\n\nexport function getReasoningEffortOptionsForModel(\n  model: string | undefined,\n): ReasoningEffort[] {\n  if (!model) return [];\n  if (isGPTReasoningModel(model)) {\n    return VISIBLE_GPT_EFFORTS;\n  }\n  if (isClaudeReasoningModel(model)) {\n    return supportsClaudeXHigh(model)\n      ? VISIBLE_CLAUDE_BUILT_IN_EFFORTS\n      : VISIBLE_CLAUDE_EFFORTS;\n  }\n  if (isGeminiReasoningModel(model)) {\n    return VISIBLE_STANDARD_EFFORTS;\n  }\n  return [];\n}\n\nexport function normalizeReasoningEffortForModel(\n  model: string | undefined,\n  effort: ReasoningEffort | undefined,\n): ReasoningEffort | undefined {\n  if (!model || !effort || effort === \"auto\") {\n    return undefined;\n  }\n  let normalized = effort;\n  if (\n    normalized === \"xhigh\" &&\n    isClaudeReasoningModel(model) &&\n    !supportsClaudeXHigh(model)\n  ) {\n    normalized = \"high\";\n  }\n  if (normalized === \"max\" && isGPTReasoningModel(model)) {\n    normalized = \"xhigh\";\n  }\n  const options = getReasoningEffortOptionsForModel(model);\n  if (!options.length || !options.includes(normalized)) {\n    return undefined;\n  }\n  return normalized;\n}\n\nexport function reasoningEffortLabel(effort: ReasoningEffort | undefined) {\n  return REASONING_EFFORT_LABELS[effort ?? \"auto\"];\n}\n\nfunction isGPTReasoningModel(model: string) {\n  return /^gpt-5/.test(model) || /^o\\d/.test(model);\n}\n\nfunction isClaudeReasoningModel(model: string) {\n  return /^claude-/.test(model);\n}\n\nfunction supportsClaudeXHigh(model: string) {\n  // Models that support the xhigh effort tier (built-in extended thinking via\n  // output_config.effort). Keep this version-aware so any future Claude model\n  // with a higher patch/minor number is automatically included rather than\n  // silently falling back to the lower \"high\" tier.\n  // claude-fable-5 is a Mythos-class model and also supports xhigh.\n  if (model.includes(\"fable-5\")) return true;\n  // opus-4-7 introduced xhigh; all opus-4.x successors (4-8, 4-9…) should too.\n  const opusMatch = model.match(/opus-4-(\\d+)/);\n  if (opusMatch) {\n    return parseInt(opusMatch[1], 10) >= 7;\n  }\n  return false;\n}\n\nfunction isGeminiReasoningModel(model: string) {\n  return /^gemini-/.test(model);\n}\n"]}
+{"version":3,"file":"reasoning-effort.js","sourceRoot":"","sources":["../../src/shared/reasoning-effort.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;CACG,CAAC;AAIX,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,KAAK;CACX,CAAC;AAEF,MAAM,wBAAwB,GAAsB;IAClD,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;CACP,CAAC;AAEF,MAAM,mBAAmB,GAAsB;IAC7C,GAAG,wBAAwB;IAC3B,OAAO;CACR,CAAC;AAEF,MAAM,+BAA+B,GAAsB;IACzD,GAAG,wBAAwB;IAC3B,OAAO;IACP,KAAK;CACN,CAAC;AAEF,MAAM,sBAAsB,GAAsB;IAChD,GAAG,wBAAwB;IAC3B,KAAK;CACN,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,CAAC;AAErD,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,KAAyB;IAEzB,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,mBAAmB,CAAC,KAAK,CAAC;YAC/B,CAAC,CAAC,+BAA+B;YACjC,CAAC,CAAC,sBAAsB,CAAC;IAC7B,CAAC;IACD,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,wBAAwB,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,KAAyB,EACzB,MAAmC;IAEnC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,UAAU,GAAG,MAAM,CAAC;IACxB,IACE,UAAU,KAAK,OAAO;QACtB,sBAAsB,CAAC,KAAK,CAAC;QAC7B,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAC3B,CAAC;QACD,UAAU,GAAG,MAAM,CAAC;IACtB,CAAC;IACD,IAAI,UAAU,KAAK,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,UAAU,GAAG,OAAO,CAAC;IACvB,CAAC;IACD,MAAM,OAAO,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAmC;IACtE,OAAO,uBAAuB,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,kDAAkD;IAClD,kEAAkE;IAClE,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,0EAA0E;IAC1E,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,6EAA6E;IAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC","sourcesContent":["export const REASONING_EFFORTS = [\n  \"auto\",\n  \"none\",\n  \"minimal\",\n  \"low\",\n  \"medium\",\n  \"high\",\n  \"xhigh\",\n  \"max\",\n] as const;\n\nexport type ReasoningEffort = (typeof REASONING_EFFORTS)[number];\n\nexport const REASONING_EFFORT_LABELS: Record<ReasoningEffort, string> = {\n  auto: \"Auto\",\n  none: \"None\",\n  minimal: \"Minimal\",\n  low: \"Low\",\n  medium: \"Medium\",\n  high: \"High\",\n  xhigh: \"Extra High\",\n  max: \"Max\",\n};\n\nconst VISIBLE_STANDARD_EFFORTS: ReasoningEffort[] = [\n  \"auto\",\n  \"low\",\n  \"medium\",\n  \"high\",\n];\n\nconst VISIBLE_GPT_EFFORTS: ReasoningEffort[] = [\n  ...VISIBLE_STANDARD_EFFORTS,\n  \"xhigh\",\n];\n\nconst VISIBLE_CLAUDE_BUILT_IN_EFFORTS: ReasoningEffort[] = [\n  ...VISIBLE_STANDARD_EFFORTS,\n  \"xhigh\",\n  \"max\",\n];\n\nconst VISIBLE_CLAUDE_EFFORTS: ReasoningEffort[] = [\n  ...VISIBLE_STANDARD_EFFORTS,\n  \"max\",\n];\n\nconst effortSet = new Set<string>(REASONING_EFFORTS);\n\nexport function isReasoningEffort(value: unknown): value is ReasoningEffort {\n  return typeof value === \"string\" && effortSet.has(value);\n}\n\nexport function getReasoningEffortOptionsForModel(\n  model: string | undefined,\n): ReasoningEffort[] {\n  if (!model) return [];\n  if (isGPTReasoningModel(model)) {\n    return VISIBLE_GPT_EFFORTS;\n  }\n  if (isClaudeReasoningModel(model)) {\n    return supportsClaudeXHigh(model)\n      ? VISIBLE_CLAUDE_BUILT_IN_EFFORTS\n      : VISIBLE_CLAUDE_EFFORTS;\n  }\n  if (isGeminiReasoningModel(model)) {\n    return VISIBLE_STANDARD_EFFORTS;\n  }\n  return [];\n}\n\nexport function normalizeReasoningEffortForModel(\n  model: string | undefined,\n  effort: ReasoningEffort | undefined,\n): ReasoningEffort | undefined {\n  if (!model || !effort || effort === \"auto\") {\n    return undefined;\n  }\n  let normalized = effort;\n  if (\n    normalized === \"xhigh\" &&\n    isClaudeReasoningModel(model) &&\n    !supportsClaudeXHigh(model)\n  ) {\n    normalized = \"high\";\n  }\n  if (normalized === \"max\" && isGPTReasoningModel(model)) {\n    normalized = \"xhigh\";\n  }\n  const options = getReasoningEffortOptionsForModel(model);\n  if (!options.length || !options.includes(normalized)) {\n    return undefined;\n  }\n  return normalized;\n}\n\nexport function reasoningEffortLabel(effort: ReasoningEffort | undefined) {\n  return REASONING_EFFORT_LABELS[effort ?? \"auto\"];\n}\n\nfunction isGPTReasoningModel(model: string) {\n  return /^gpt-5/.test(model) || /^o\\d/.test(model);\n}\n\nfunction isClaudeReasoningModel(model: string) {\n  return /^claude-/.test(model);\n}\n\nfunction supportsClaudeXHigh(model: string) {\n  // Models that support the xhigh effort tier (built-in extended thinking via\n  // output_config.effort). Keep this version-aware so any future Claude model\n  // with a higher patch/minor number is automatically included rather than\n  // silently falling back to the lower \"high\" tier.\n  // claude-fable-5 is a Mythos-class model and also supports xhigh.\n  if (model.includes(\"fable-5\")) return true;\n  // Sonnet 5 supports the expanded effort ladder through Builder/Anthropic.\n  if (model.includes(\"sonnet-5\")) return true;\n  // opus-4-7 introduced xhigh; all opus-4.x successors (4-8, 4-9…) should too.\n  const opusMatch = model.match(/opus-4-(\\d+)/);\n  if (opusMatch) {\n    return parseInt(opusMatch[1], 10) >= 7;\n  }\n  return false;\n}\n\nfunction isGeminiReasoningModel(model: string) {\n  return /^gemini-/.test(model);\n}\n"]}

package/dist/sharing/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/sharing/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAoB,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAMzD,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAmBxD,qBAAa,cAAe,SAAQ,KAAK;IACvC,UAAU,SAAO;IACjB,YAAY,OAAO,SAAc,EAGhC;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,wBAAgB,aAAa,IAAI,aAAa,CAK7C;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,6BAA6B,GAAG,SAAS,EAC9C,GAAG,EAAE,aAAa,GACjB,aAAa,CAEf;AAWD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,GAAG,EAClB,WAAW,EAAE,GAAG,EAChB,MAAM,GAAE,aAA+B,EACvC,OAAO,GAAE,SAAoB,EAC7B,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,GAAG,CA0DL;AAgED,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,yCAAyC;IACzC,QAAQ,EAAE,GAAG,CAAC;CACf;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,aAA+B,GACtC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAoChC;AA+CD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,SAAS,GAAG,OAAkB,EACvC,GAAG,GAAE,aAA+B,GACnC,OAAO,CAAC,cAAc,CAAC,CAWzB"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/sharing/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAoB,KAAK,GAAG,EAAE,MAAM,aAAa,CAAC;AAMzD,OAAO,EAGL,KAAK,6BAA6B,EACnC,MAAM,eAAe,CAAC;AACvB,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAmBxD,qBAAa,cAAe,SAAQ,KAAK;IACvC,UAAU,SAAO;IACjB,YAAY,OAAO,SAAc,EAGhC;CACF;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,wBAAgB,aAAa,IAAI,aAAa,CAK7C;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,EAAE,6BAA6B,GAAG,SAAS,EAC9C,GAAG,EAAE,aAAa,GACjB,aAAa,CAEf;AAWD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,GAAG,EAClB,WAAW,EAAE,GAAG,EAChB,MAAM,GAAE,aAA+B,EACvC,OAAO,GAAE,SAAoB,EAC7B,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GACxC,GAAG,CA0DL;AAgED,MAAM,WAAW,cAAc;IAC7B,yEAAyE;IACzE,IAAI,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,yCAAyC;IACzC,QAAQ,EAAE,GAAG,CAAC;CACf;AAmBD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,aAA+B,GACtC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAuChC;AA+CD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,SAAS,GAAG,OAAkB,EACvC,GAAG,GAAE,aAA+B,GACnC,OAAO,CAAC,cAAc,CAAC,CAWzB"}

package/dist/sharing/access.js

@@ -160,6 +160,19 @@ function explicitSharesAllowedForResource(reg, resource, ctx) {
     const resourceOrgId = resource?.orgId ?? null;
     return !!resourceOrgId && !!ctx.orgId && resourceOrgId === ctx.orgId;
 }
+async function publicAccessRoleForResource(reg, resource, ctx) {
+    const roleResolver = reg.publicAccessRole;
+    if (!roleResolver)
+        return "viewer";
+    return typeof roleResolver === "function"
+        ? await roleResolver(resource, ctx)
+        : roleResolver;
+}
+function higherShareRole(a, b) {
+    if (!b)
+        return a;
+    return ROLE_RANK[b] > ROLE_RANK[a] ? b : a;
+}
 /**
  * Return the effective role the current user has on a specific resource, or
  * null if they have no access. Loads the resource and relevant share rows.
@@ -182,9 +195,12 @@ export async function resolveAccess(resourceType, resourceId, rawCtx = currentAc
         return { role: "owner", resource };
     }
     if (resource.visibility === "public" && reg.allowPublic !== false) {
-        // No share row needed; default viewer unless upgraded below.
+        // No share row needed; default viewer unless the resource registration
+        // deliberately grants a stronger public-by-link role or explicit shares
+        // upgrade the current principal.
+        const publicRole = await publicAccessRoleForResource(reg, resource, ctx);
         const role = await highestShareRole(reg, resourceId, ctx, resource);
-        return { role: role ?? "viewer", resource };
+        return { role: higherShareRole(publicRole, role), resource };
     }
     // `visibility === "public"` on an `allowPublic: false` resource is treated
     // as private: only owner + explicit shares grant access. Falls through to

package/dist/sharing/access.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/sharing/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAkB,MAAM,aAAa,CAAC;AAExD;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAC9B,aAAkB;IAElB,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,aAAa,KAAK,aAAa;YAAE,OAAO,GAAG,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,UAAU,GAAG,GAAG,CAAC;IACjB,YAAY,OAAO,GAAG,WAAW;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAOD,wEAAwE;AACxE,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,SAAS,EAAE,mBAAmB,EAAE;QAChC,KAAK,EAAE,eAAe,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAA8C,EAC9C,GAAkB;IAElB,OAAO,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACzE,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACxD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,UAAU,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAW,EAAE,KAAa;IACpD,OAAO,GAAG,CAAA,SAAS,MAAM,OAAO,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAC1B,aAAkB,EAClB,WAAgB,EAChB,MAAM,GAAkB,aAAa,EAAE,EACvC,OAAO,GAAc,QAAQ,EAC7B,OAAO,GAAgC,EAAE;IAEzC,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,aAAa;IACb,MAAM,GAAG,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,8BAA8B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACjC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,GAAG,EAAE,WAAW,KAAK,KAAK,CAAC;IACjD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC;IACxE,MAAM,OAAO,GAAU,EAAE,CAAC;IAE1B,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CACV,GAAG,CACD,kBAAkB,CAAC,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,EACjE,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CACzC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CACV,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,EACnC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAC9B,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CACV,GAAG,CAAA,yBAAyB,WAAW;0BACnB,WAAW,CAAC,UAAU,MAAM,aAAa,CAAC,EAAE;0BAC5C,WAAW,CAAC,aAAa;gCACnB,WAAW,CAAC,WAAW,OAAO,mBAAmB;0BACvD,UAAU;0BACV,UAAU,CAAC,OAAO,CAAC,GAAG,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CACV,GAAG,CAAA,yBAAyB,WAAW;0BACnB,WAAW,CAAC,UAAU,MAAM,aAAa,CAAC,EAAE;0BAC5C,WAAW,CAAC,aAAa;0BACzB,WAAW,CAAC,WAAW,MAAM,KAAK;0BAClC,UAAU;0BACV,UAAU,CAAC,OAAO,CAAC,GAAG,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,CAAA,KAAK,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CACvB,GAA8C,EAC9C,aAAkB,EAClB,GAAkB;IAElB,IAAI,GAAG,EAAE,qBAAqB,KAAK,IAAI;QAAE,OAAO,GAAG,CAAA,KAAK,CAAC;IACzD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,OAAO,EAAE,CACP,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAClC,GAAG,CAAA,GAAG,aAAa,CAAC,KAAK,UAAU,CACnC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAA,GAAG,aAAa,CAAC,KAAK,UAAU,CAAC;AAC7C,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAA8C,EAC9C,QAAa,EACb,GAAkB;IAElB,IAAI,GAAG,EAAE,qBAAqB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,aAAa,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IAC9C,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,GAAG,CAAC,KAAK,KAAK,aAAa,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,OAAkB;IACpC,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,4BAA4B;QAC5B,OAAO,GAAG,CAAA,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,GAAG,CAAA,4BAA4B,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAA,gBAAgB,CAAC;AAC7B,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAA8C,EAC9C,aAAkB,EAClB,GAAkB;IAElB,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,GAAG,EAAE,6BAA6B,KAAK,IAAI;QAAE,OAAO,GAAG,CAAA,KAAK,CAAC;IACjE,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,GAAG,CAAA,KAAK,CAAC;IAChC,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gCAAgC,CACvC,GAAkC,EAClC,QAAa,EACb,GAAkB;IAElB,IAAI,GAAG,CAAC,6BAA6B,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,aAAa,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IAC9C,OAAO,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,aAAa,KAAK,GAAG,CAAC,KAAK,CAAC;AACvE,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,YAAoB,EACpB,UAAkB,EAClB,MAAM,GAAkB,aAAa,EAAE;IAEvC,MAAM,GAAG,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,8BAA8B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;IAE9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACjC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAE/D,IACE,mBAAmB;QACnB,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,mBAAmB;QACpE,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAC3C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAClE,6DAA6D;QAC7D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,IAAI,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpE,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,GAAkC,EAClC,UAAkB,EAClB,GAAkB,EAClB,QAAa;IAEb,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACjC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,mBAAmB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,gCAAgC,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;IAE9B,MAAM,gBAAgB,GAA6B,EAAE,CAAC;IACtD,IAAI,mBAAmB,EAAE,CAAC;QACxB,gBAAgB,CAAC,IAAI,CACnB,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,EACzC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,mBAAmB,CAAC,CACrE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,gBAAgB,CAAC,IAAI,CACnB,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,EACxC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CACvC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SACtC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;SACrB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CACzE;SACA,KAAK,CAAC,EAAE,CAAC,CAAC;IAEb,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,IAAkC,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,UAAkB,EAClB,OAAO,GAAwB,QAAQ,EACvC,GAAG,GAAkB,aAAa,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,cAAc,CAAC,gBAAgB,YAAY,IAAI,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,cAAc,CACtB,YAAY,OAAO,YAAY,YAAY,IAAI,UAAU,UAAU,MAAM,CAAC,IAAI,GAAG,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Access-control helpers for shareable resources.\n *\n * The access model combines:\n * 1. Direct ownership — `owner_email = currentUser`.\n * 2. Visibility — `'private' | 'org' | 'public'`. `org` grants read to anyone\n *    in the same org; `public` grants read to any authenticated user.\n * 3. Share rows — per-user or per-org grants in the `{type}_shares` table\n *    with a role (`viewer | editor | admin`).\n *\n * Use `applyAccessFilter()` on list/read queries to filter rows the current\n * user can see. Use `assertAccess()` at the top of write actions to reject\n * callers who lack the required role.\n */\n\nimport { and, eq, or, sql, type SQL } from \"drizzle-orm\";\n\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n} from \"../server/request-context.js\";\nimport {\n  listShareableResources,\n  requireShareableResource,\n  type ShareableResourceRegistration,\n} from \"./registry.js\";\nimport { ROLE_RANK, type ShareRole } from \"./schema.js\";\n\n/**\n * Find a registration by its drizzle table identity. Used to look up\n * per-resource policy flags (e.g. `allowPublic`) inside `accessFilter`,\n * which receives only the table — not the resource-type name.\n *\n * Identity is stable within a single bundle (Vite dedupes module instances);\n * the SSR/server side is the only caller, so per-bundle identity is fine.\n */\nfunction findRegistrationByTable(\n  resourceTable: any,\n): ShareableResourceRegistration | undefined {\n  for (const reg of listShareableResources()) {\n    if (reg.resourceTable === resourceTable) return reg;\n  }\n  return undefined;\n}\n\nexport class ForbiddenError extends Error {\n  statusCode = 403;\n  constructor(message = \"Forbidden\") {\n    super(message);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport interface AccessContext {\n  userEmail?: string;\n  orgId?: string;\n}\n\n/** Current request's access context. Pulls from request-context ALS. */\nexport function currentAccess(): AccessContext {\n  return {\n    userEmail: getRequestUserEmail(),\n    orgId: getRequestOrgId(),\n  };\n}\n\nexport function resolveRegisteredAccessContext(\n  reg: ShareableResourceRegistration | undefined,\n  ctx: AccessContext,\n): AccessContext {\n  return reg?.resolveAccessContext ? reg.resolveAccessContext(ctx) : ctx;\n}\n\nfunction normalizeEmailForAccess(email: string | undefined): string | null {\n  const normalized = email?.trim().toLowerCase();\n  return normalized || null;\n}\n\nfunction emailColumnMatches(column: any, email: string): SQL {\n  return sql`lower(${column}) = ${email}`;\n}\n\n/**\n * Build a Drizzle `WHERE` clause that admits rows the current user can see.\n * Pass the ownable resource table and its shares table; optional min role\n * (defaults to 'viewer') gates which share rows count.\n *\n * `visibility = 'public'` is intentionally NOT admitted by default. Public\n * means \"anyone with the link can view\" (still honoured by `resolveAccess`\n * for read-by-id), not \"appears in every signed-in user's list/sidebar.\"\n * Pass `{ includePublic: true }` for the rare list endpoint that wants\n * cross-user public discovery (a public template gallery, for example).\n *\n * Example:\n *\n *   const rows = await db\n *     .select()\n *     .from(schema.documents)\n *     .where(accessFilter(schema.documents, schema.documentShares));\n */\nexport function accessFilter(\n  resourceTable: any,\n  sharesTable: any,\n  rawCtx: AccessContext = currentAccess(),\n  minRole: ShareRole = \"viewer\",\n  options: { includePublic?: boolean } = {},\n): SQL {\n  // Defense in depth — resources registered with `allowPublic: false` must\n  // never participate in cross-user \"public\" discovery, even if a caller\n  // accidentally passes `includePublic: true` or if a stale public row sits\n  // in the DB.\n  const reg = findRegistrationByTable(resourceTable);\n  const ctx = resolveRegisteredAccessContext(reg, rawCtx);\n  const { userEmail, orgId } = ctx;\n  const normalizedUserEmail = normalizeEmailForAccess(userEmail);\n  const publicAllowed = reg?.allowPublic !== false;\n  const includePublic = (options.includePublic ?? false) && publicAllowed;\n  const clauses: SQL[] = [];\n\n  if (normalizedUserEmail) {\n    clauses.push(\n      and(\n        emailColumnMatches(resourceTable.ownerEmail, normalizedUserEmail),\n        ownerScopeFilter(reg, resourceTable, ctx),\n      )!,\n    );\n  }\n  if (minRole === \"viewer\") {\n    if (includePublic) {\n      clauses.push(eq(resourceTable.visibility, \"public\"));\n    }\n    if (orgId) {\n      clauses.push(\n        and(\n          eq(resourceTable.visibility, \"org\"),\n          eq(resourceTable.orgId, orgId),\n        )!,\n      );\n    }\n  }\n  if (normalizedUserEmail) {\n    const shareScope = restrictedShareScopeSql(reg, resourceTable, ctx);\n    clauses.push(\n      sql`exists (select 1 from ${sharesTable}\n                  where ${sharesTable.resourceId} = ${resourceTable.id}\n                    and ${sharesTable.principalType} = 'user'\n                    and lower(${sharesTable.principalId}) = ${normalizedUserEmail}\n                    and ${shareScope}\n                    and ${minRoleSql(minRole)})`,\n    );\n  }\n  if (orgId) {\n    const shareScope = restrictedShareScopeSql(reg, resourceTable, ctx);\n    clauses.push(\n      sql`exists (select 1 from ${sharesTable}\n                  where ${sharesTable.resourceId} = ${resourceTable.id}\n                    and ${sharesTable.principalType} = 'org'\n                    and ${sharesTable.principalId} = ${orgId}\n                    and ${shareScope}\n                    and ${minRoleSql(minRole)})`,\n    );\n  }\n\n  return or(...clauses) ?? sql`1=0`;\n}\n\nfunction ownerScopeFilter(\n  reg: ShareableResourceRegistration | undefined,\n  resourceTable: any,\n  ctx: AccessContext,\n): SQL {\n  if (reg?.ownerAccessIgnoresOrg === true) return sql`1=1`;\n  if (ctx.orgId) {\n    // Rows created before org-scoping, or in solo mode, have no org_id. Keep\n    // them manageable by their owner after the owner joins or switches into an\n    // organization, while still keeping rows from other orgs out of scope.\n    return or(\n      eq(resourceTable.orgId, ctx.orgId),\n      sql`${resourceTable.orgId} IS NULL`,\n    )!;\n  }\n  return sql`${resourceTable.orgId} IS NULL`;\n}\n\nfunction ownerMatchesActiveScope(\n  reg: ShareableResourceRegistration | undefined,\n  resource: any,\n  ctx: AccessContext,\n): boolean {\n  if (reg?.ownerAccessIgnoresOrg === true) return true;\n  const resourceOrgId = resource?.orgId ?? null;\n  if (!resourceOrgId) return true;\n  return ctx.orgId === resourceOrgId;\n}\n\nfunction minRoleSql(minRole: ShareRole): SQL {\n  if (minRole === \"viewer\") {\n    // any role satisfies viewer\n    return sql`1=1`;\n  }\n  if (minRole === \"editor\") {\n    return sql`role in ('editor','admin')`;\n  }\n  return sql`role = 'admin'`;\n}\n\nfunction restrictedShareScopeSql(\n  reg: ShareableResourceRegistration | undefined,\n  resourceTable: any,\n  ctx: AccessContext,\n): SQL {\n  // Restricted resources (extensions) must stay inside their resource org even\n  // if stale cross-org share rows already exist from older code or bad data.\n  if (reg?.requireOrgMemberForUserShares !== true) return sql`1=1`;\n  if (!ctx.orgId) return sql`1=0`;\n  return eq(resourceTable.orgId, ctx.orgId);\n}\n\nfunction explicitSharesAllowedForResource(\n  reg: ShareableResourceRegistration,\n  resource: any,\n  ctx: AccessContext,\n): boolean {\n  if (reg.requireOrgMemberForUserShares !== true) return true;\n  const resourceOrgId = resource?.orgId ?? null;\n  return !!resourceOrgId && !!ctx.orgId && resourceOrgId === ctx.orgId;\n}\n\nexport interface ResolvedAccess {\n  /** Effective role: 'owner' for the resource owner, or the share role. */\n  role: \"owner\" | ShareRole;\n  /** The resource row (already loaded). */\n  resource: any;\n}\n\n/**\n * Return the effective role the current user has on a specific resource, or\n * null if they have no access. Loads the resource and relevant share rows.\n */\nexport async function resolveAccess(\n  resourceType: string,\n  resourceId: string,\n  rawCtx: AccessContext = currentAccess(),\n): Promise<ResolvedAccess | null> {\n  const reg = requireShareableResource(resourceType);\n  const ctx = resolveRegisteredAccessContext(reg, rawCtx);\n  const db = reg.getDb() as any;\n\n  const [resource] = await db\n    .select()\n    .from(reg.resourceTable)\n    .where(eq(reg.resourceTable.id, resourceId));\n  if (!resource) return null;\n\n  const { userEmail, orgId } = ctx;\n  const normalizedUserEmail = normalizeEmailForAccess(userEmail);\n\n  if (\n    normalizedUserEmail &&\n    normalizeEmailForAccess(resource.ownerEmail) === normalizedUserEmail &&\n    ownerMatchesActiveScope(reg, resource, ctx)\n  ) {\n    return { role: \"owner\", resource };\n  }\n  if (resource.visibility === \"public\" && reg.allowPublic !== false) {\n    // No share row needed; default viewer unless upgraded below.\n    const role = await highestShareRole(reg, resourceId, ctx, resource);\n    return { role: role ?? \"viewer\", resource };\n  }\n  // `visibility === \"public\"` on an `allowPublic: false` resource is treated\n  // as private: only owner + explicit shares grant access. Falls through to\n  // the explicit-share lookup below.\n  if (resource.visibility === \"org\" && orgId && resource.orgId === orgId) {\n    const role = await highestShareRole(reg, resourceId, ctx, resource);\n    return { role: role ?? \"viewer\", resource };\n  }\n  const role = await highestShareRole(reg, resourceId, ctx, resource);\n  if (role) return { role, resource };\n  return null;\n}\n\nasync function highestShareRole(\n  reg: ShareableResourceRegistration,\n  resourceId: string,\n  ctx: AccessContext,\n  resource: any,\n): Promise<ShareRole | null> {\n  const { userEmail, orgId } = ctx;\n  const normalizedUserEmail = normalizeEmailForAccess(userEmail);\n  if (!normalizedUserEmail && !orgId) return null;\n  if (!explicitSharesAllowedForResource(reg, resource, ctx)) return null;\n  const db = reg.getDb() as any;\n\n  const principalClauses: ReturnType<typeof and>[] = [];\n  if (normalizedUserEmail) {\n    principalClauses.push(\n      and(\n        eq(reg.sharesTable.principalType, \"user\"),\n        emailColumnMatches(reg.sharesTable.principalId, normalizedUserEmail),\n      ),\n    );\n  }\n  if (orgId) {\n    principalClauses.push(\n      and(\n        eq(reg.sharesTable.principalType, \"org\"),\n        eq(reg.sharesTable.principalId, orgId),\n      ),\n    );\n  }\n\n  const rows = await db\n    .select({ role: reg.sharesTable.role })\n    .from(reg.sharesTable)\n    .where(\n      and(eq(reg.sharesTable.resourceId, resourceId), or(...principalClauses)),\n    )\n    .limit(10);\n\n  let best: ShareRole | null = null;\n  for (const r of rows as Array<{ role: ShareRole }>) {\n    if (!best || ROLE_RANK[r.role] > ROLE_RANK[best]) best = r.role;\n  }\n  return best;\n}\n\n/**\n * Throw ForbiddenError if the current user can't act on this resource with at\n * least the given role. Used at the top of update/delete actions.\n */\nexport async function assertAccess(\n  resourceType: string,\n  resourceId: string,\n  minRole: ShareRole | \"owner\" = \"viewer\",\n  ctx: AccessContext = currentAccess(),\n): Promise<ResolvedAccess> {\n  const access = await resolveAccess(resourceType, resourceId, ctx);\n  if (!access) {\n    throw new ForbiddenError(`No access to ${resourceType} ${resourceId}`);\n  }\n  if (ROLE_RANK[access.role] < ROLE_RANK[minRole]) {\n    throw new ForbiddenError(\n      `Requires ${minRole} role on ${resourceType} ${resourceId} (have ${access.role})`,\n    );\n  }\n  return access;\n}\n"]}
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/sharing/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAEzD,OAAO,EACL,mBAAmB,EACnB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAkB,MAAM,aAAa,CAAC;AAExD;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAC9B,aAAkB;IAElB,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,aAAa,KAAK,aAAa;YAAE,OAAO,GAAG,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,UAAU,GAAG,GAAG,CAAC;IACjB,YAAY,OAAO,GAAG,WAAW;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAOD,wEAAwE;AACxE,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,SAAS,EAAE,mBAAmB,EAAE;QAChC,KAAK,EAAE,eAAe,EAAE;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAA8C,EAC9C,GAAkB;IAElB,OAAO,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACzE,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACxD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,UAAU,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAW,EAAE,KAAa;IACpD,OAAO,GAAG,CAAA,SAAS,MAAM,OAAO,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,YAAY,CAC1B,aAAkB,EAClB,WAAgB,EAChB,MAAM,GAAkB,aAAa,EAAE,EACvC,OAAO,GAAc,QAAQ,EAC7B,OAAO,GAAgC,EAAE;IAEzC,yEAAyE;IACzE,uEAAuE;IACvE,0EAA0E;IAC1E,aAAa;IACb,MAAM,GAAG,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,8BAA8B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACjC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,GAAG,EAAE,WAAW,KAAK,KAAK,CAAC;IACjD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,aAAa,CAAC;IACxE,MAAM,OAAO,GAAU,EAAE,CAAC;IAE1B,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CACV,GAAG,CACD,kBAAkB,CAAC,aAAa,CAAC,UAAU,EAAE,mBAAmB,CAAC,EACjE,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CACzC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,aAAa,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CACV,GAAG,CACD,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC,EACnC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAC9B,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CACV,GAAG,CAAA,yBAAyB,WAAW;0BACnB,WAAW,CAAC,UAAU,MAAM,aAAa,CAAC,EAAE;0BAC5C,WAAW,CAAC,aAAa;gCACnB,WAAW,CAAC,WAAW,OAAO,mBAAmB;0BACvD,UAAU;0BACV,UAAU,CAAC,OAAO,CAAC,GAAG,CAC3C,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CACV,GAAG,CAAA,yBAAyB,WAAW;0BACnB,WAAW,CAAC,UAAU,MAAM,aAAa,CAAC,EAAE;0BAC5C,WAAW,CAAC,aAAa;0BACzB,WAAW,CAAC,WAAW,MAAM,KAAK;0BAClC,UAAU;0BACV,UAAU,CAAC,OAAO,CAAC,GAAG,CAC3C,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,CAAA,KAAK,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CACvB,GAA8C,EAC9C,aAAkB,EAClB,GAAkB;IAElB,IAAI,GAAG,EAAE,qBAAqB,KAAK,IAAI;QAAE,OAAO,GAAG,CAAA,KAAK,CAAC;IACzD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,yEAAyE;QACzE,2EAA2E;QAC3E,uEAAuE;QACvE,OAAO,EAAE,CACP,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,EAClC,GAAG,CAAA,GAAG,aAAa,CAAC,KAAK,UAAU,CACnC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAA,GAAG,aAAa,CAAC,KAAK,UAAU,CAAC;AAC7C,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAA8C,EAC9C,QAAa,EACb,GAAkB;IAElB,IAAI,GAAG,EAAE,qBAAqB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,aAAa,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IAC9C,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,GAAG,CAAC,KAAK,KAAK,aAAa,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,OAAkB;IACpC,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,4BAA4B;QAC5B,OAAO,GAAG,CAAA,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,GAAG,CAAA,4BAA4B,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAA,gBAAgB,CAAC;AAC7B,CAAC;AAED,SAAS,uBAAuB,CAC9B,GAA8C,EAC9C,aAAkB,EAClB,GAAkB;IAElB,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,GAAG,EAAE,6BAA6B,KAAK,IAAI;QAAE,OAAO,GAAG,CAAA,KAAK,CAAC;IACjE,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,GAAG,CAAA,KAAK,CAAC;IAChC,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gCAAgC,CACvC,GAAkC,EAClC,QAAa,EACb,GAAkB;IAElB,IAAI,GAAG,CAAC,6BAA6B,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,aAAa,GAAG,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;IAC9C,OAAO,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,aAAa,KAAK,GAAG,CAAC,KAAK,CAAC;AACvE,CAAC;AASD,KAAK,UAAU,2BAA2B,CACxC,GAAkC,EAClC,QAAa,EACb,GAAkB;IAElB,MAAM,YAAY,GAAG,GAAG,CAAC,gBAAgB,CAAC;IAC1C,IAAI,CAAC,YAAY;QAAE,OAAO,QAAQ,CAAC;IACnC,OAAO,OAAO,YAAY,KAAK,UAAU;QACvC,CAAC,CAAC,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC;QACnC,CAAC,CAAC,YAAY,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,CAAY,EAAE,CAAmB;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,YAAoB,EACpB,UAAkB,EAClB,MAAM,GAAkB,aAAa,EAAE;IAEvC,MAAM,GAAG,GAAG,wBAAwB,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,8BAA8B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;IAE9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;SACxB,MAAM,EAAE;SACR,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;SACvB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACjC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAE/D,IACE,mBAAmB;QACnB,uBAAuB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,mBAAmB;QACpE,uBAAuB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,EAC3C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAClE,uEAAuE;QACvE,wEAAwE;QACxE,iCAAiC;QACjC,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC/D,CAAC;IACD,2EAA2E;IAC3E,0EAA0E;IAC1E,mCAAmC;IACnC,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,IAAI,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QACvE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpE,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,GAAkC,EAClC,UAAkB,EAClB,GAAkB,EAClB,QAAa;IAEb,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACjC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC/D,IAAI,CAAC,mBAAmB,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,gCAAgC,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;IAE9B,MAAM,gBAAgB,GAA6B,EAAE,CAAC;IACtD,IAAI,mBAAmB,EAAE,CAAC;QACxB,gBAAgB,CAAC,IAAI,CACnB,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,MAAM,CAAC,EACzC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,mBAAmB,CAAC,CACrE,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,gBAAgB,CAAC,IAAI,CACnB,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,KAAK,CAAC,EACxC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,CACvC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;SACtC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;SACrB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CACzE;SACA,KAAK,CAAC,EAAE,CAAC,CAAC;IAEb,IAAI,IAAI,GAAqB,IAAI,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,IAAkC,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC;YAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoB,EACpB,UAAkB,EAClB,OAAO,GAAwB,QAAQ,EACvC,GAAG,GAAkB,aAAa,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,cAAc,CAAC,gBAAgB,YAAY,IAAI,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,cAAc,CACtB,YAAY,OAAO,YAAY,YAAY,IAAI,UAAU,UAAU,MAAM,CAAC,IAAI,GAAG,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Access-control helpers for shareable resources.\n *\n * The access model combines:\n * 1. Direct ownership — `owner_email = currentUser`.\n * 2. Visibility — `'private' | 'org' | 'public'`. `org` grants read to anyone\n *    in the same org; `public` grants read to any authenticated user.\n * 3. Share rows — per-user or per-org grants in the `{type}_shares` table\n *    with a role (`viewer | editor | admin`).\n *\n * Use `applyAccessFilter()` on list/read queries to filter rows the current\n * user can see. Use `assertAccess()` at the top of write actions to reject\n * callers who lack the required role.\n */\n\nimport { and, eq, or, sql, type SQL } from \"drizzle-orm\";\n\nimport {\n  getRequestUserEmail,\n  getRequestOrgId,\n} from \"../server/request-context.js\";\nimport {\n  listShareableResources,\n  requireShareableResource,\n  type ShareableResourceRegistration,\n} from \"./registry.js\";\nimport { ROLE_RANK, type ShareRole } from \"./schema.js\";\n\n/**\n * Find a registration by its drizzle table identity. Used to look up\n * per-resource policy flags (e.g. `allowPublic`) inside `accessFilter`,\n * which receives only the table — not the resource-type name.\n *\n * Identity is stable within a single bundle (Vite dedupes module instances);\n * the SSR/server side is the only caller, so per-bundle identity is fine.\n */\nfunction findRegistrationByTable(\n  resourceTable: any,\n): ShareableResourceRegistration | undefined {\n  for (const reg of listShareableResources()) {\n    if (reg.resourceTable === resourceTable) return reg;\n  }\n  return undefined;\n}\n\nexport class ForbiddenError extends Error {\n  statusCode = 403;\n  constructor(message = \"Forbidden\") {\n    super(message);\n    this.name = \"ForbiddenError\";\n  }\n}\n\nexport interface AccessContext {\n  userEmail?: string;\n  orgId?: string;\n}\n\n/** Current request's access context. Pulls from request-context ALS. */\nexport function currentAccess(): AccessContext {\n  return {\n    userEmail: getRequestUserEmail(),\n    orgId: getRequestOrgId(),\n  };\n}\n\nexport function resolveRegisteredAccessContext(\n  reg: ShareableResourceRegistration | undefined,\n  ctx: AccessContext,\n): AccessContext {\n  return reg?.resolveAccessContext ? reg.resolveAccessContext(ctx) : ctx;\n}\n\nfunction normalizeEmailForAccess(email: string | undefined): string | null {\n  const normalized = email?.trim().toLowerCase();\n  return normalized || null;\n}\n\nfunction emailColumnMatches(column: any, email: string): SQL {\n  return sql`lower(${column}) = ${email}`;\n}\n\n/**\n * Build a Drizzle `WHERE` clause that admits rows the current user can see.\n * Pass the ownable resource table and its shares table; optional min role\n * (defaults to 'viewer') gates which share rows count.\n *\n * `visibility = 'public'` is intentionally NOT admitted by default. Public\n * means \"anyone with the link can view\" (still honoured by `resolveAccess`\n * for read-by-id), not \"appears in every signed-in user's list/sidebar.\"\n * Pass `{ includePublic: true }` for the rare list endpoint that wants\n * cross-user public discovery (a public template gallery, for example).\n *\n * Example:\n *\n *   const rows = await db\n *     .select()\n *     .from(schema.documents)\n *     .where(accessFilter(schema.documents, schema.documentShares));\n */\nexport function accessFilter(\n  resourceTable: any,\n  sharesTable: any,\n  rawCtx: AccessContext = currentAccess(),\n  minRole: ShareRole = \"viewer\",\n  options: { includePublic?: boolean } = {},\n): SQL {\n  // Defense in depth — resources registered with `allowPublic: false` must\n  // never participate in cross-user \"public\" discovery, even if a caller\n  // accidentally passes `includePublic: true` or if a stale public row sits\n  // in the DB.\n  const reg = findRegistrationByTable(resourceTable);\n  const ctx = resolveRegisteredAccessContext(reg, rawCtx);\n  const { userEmail, orgId } = ctx;\n  const normalizedUserEmail = normalizeEmailForAccess(userEmail);\n  const publicAllowed = reg?.allowPublic !== false;\n  const includePublic = (options.includePublic ?? false) && publicAllowed;\n  const clauses: SQL[] = [];\n\n  if (normalizedUserEmail) {\n    clauses.push(\n      and(\n        emailColumnMatches(resourceTable.ownerEmail, normalizedUserEmail),\n        ownerScopeFilter(reg, resourceTable, ctx),\n      )!,\n    );\n  }\n  if (minRole === \"viewer\") {\n    if (includePublic) {\n      clauses.push(eq(resourceTable.visibility, \"public\"));\n    }\n    if (orgId) {\n      clauses.push(\n        and(\n          eq(resourceTable.visibility, \"org\"),\n          eq(resourceTable.orgId, orgId),\n        )!,\n      );\n    }\n  }\n  if (normalizedUserEmail) {\n    const shareScope = restrictedShareScopeSql(reg, resourceTable, ctx);\n    clauses.push(\n      sql`exists (select 1 from ${sharesTable}\n                  where ${sharesTable.resourceId} = ${resourceTable.id}\n                    and ${sharesTable.principalType} = 'user'\n                    and lower(${sharesTable.principalId}) = ${normalizedUserEmail}\n                    and ${shareScope}\n                    and ${minRoleSql(minRole)})`,\n    );\n  }\n  if (orgId) {\n    const shareScope = restrictedShareScopeSql(reg, resourceTable, ctx);\n    clauses.push(\n      sql`exists (select 1 from ${sharesTable}\n                  where ${sharesTable.resourceId} = ${resourceTable.id}\n                    and ${sharesTable.principalType} = 'org'\n                    and ${sharesTable.principalId} = ${orgId}\n                    and ${shareScope}\n                    and ${minRoleSql(minRole)})`,\n    );\n  }\n\n  return or(...clauses) ?? sql`1=0`;\n}\n\nfunction ownerScopeFilter(\n  reg: ShareableResourceRegistration | undefined,\n  resourceTable: any,\n  ctx: AccessContext,\n): SQL {\n  if (reg?.ownerAccessIgnoresOrg === true) return sql`1=1`;\n  if (ctx.orgId) {\n    // Rows created before org-scoping, or in solo mode, have no org_id. Keep\n    // them manageable by their owner after the owner joins or switches into an\n    // organization, while still keeping rows from other orgs out of scope.\n    return or(\n      eq(resourceTable.orgId, ctx.orgId),\n      sql`${resourceTable.orgId} IS NULL`,\n    )!;\n  }\n  return sql`${resourceTable.orgId} IS NULL`;\n}\n\nfunction ownerMatchesActiveScope(\n  reg: ShareableResourceRegistration | undefined,\n  resource: any,\n  ctx: AccessContext,\n): boolean {\n  if (reg?.ownerAccessIgnoresOrg === true) return true;\n  const resourceOrgId = resource?.orgId ?? null;\n  if (!resourceOrgId) return true;\n  return ctx.orgId === resourceOrgId;\n}\n\nfunction minRoleSql(minRole: ShareRole): SQL {\n  if (minRole === \"viewer\") {\n    // any role satisfies viewer\n    return sql`1=1`;\n  }\n  if (minRole === \"editor\") {\n    return sql`role in ('editor','admin')`;\n  }\n  return sql`role = 'admin'`;\n}\n\nfunction restrictedShareScopeSql(\n  reg: ShareableResourceRegistration | undefined,\n  resourceTable: any,\n  ctx: AccessContext,\n): SQL {\n  // Restricted resources (extensions) must stay inside their resource org even\n  // if stale cross-org share rows already exist from older code or bad data.\n  if (reg?.requireOrgMemberForUserShares !== true) return sql`1=1`;\n  if (!ctx.orgId) return sql`1=0`;\n  return eq(resourceTable.orgId, ctx.orgId);\n}\n\nfunction explicitSharesAllowedForResource(\n  reg: ShareableResourceRegistration,\n  resource: any,\n  ctx: AccessContext,\n): boolean {\n  if (reg.requireOrgMemberForUserShares !== true) return true;\n  const resourceOrgId = resource?.orgId ?? null;\n  return !!resourceOrgId && !!ctx.orgId && resourceOrgId === ctx.orgId;\n}\n\nexport interface ResolvedAccess {\n  /** Effective role: 'owner' for the resource owner, or the share role. */\n  role: \"owner\" | ShareRole;\n  /** The resource row (already loaded). */\n  resource: any;\n}\n\nasync function publicAccessRoleForResource(\n  reg: ShareableResourceRegistration,\n  resource: any,\n  ctx: AccessContext,\n): Promise<ShareRole> {\n  const roleResolver = reg.publicAccessRole;\n  if (!roleResolver) return \"viewer\";\n  return typeof roleResolver === \"function\"\n    ? await roleResolver(resource, ctx)\n    : roleResolver;\n}\n\nfunction higherShareRole(a: ShareRole, b: ShareRole | null): ShareRole {\n  if (!b) return a;\n  return ROLE_RANK[b] > ROLE_RANK[a] ? b : a;\n}\n\n/**\n * Return the effective role the current user has on a specific resource, or\n * null if they have no access. Loads the resource and relevant share rows.\n */\nexport async function resolveAccess(\n  resourceType: string,\n  resourceId: string,\n  rawCtx: AccessContext = currentAccess(),\n): Promise<ResolvedAccess | null> {\n  const reg = requireShareableResource(resourceType);\n  const ctx = resolveRegisteredAccessContext(reg, rawCtx);\n  const db = reg.getDb() as any;\n\n  const [resource] = await db\n    .select()\n    .from(reg.resourceTable)\n    .where(eq(reg.resourceTable.id, resourceId));\n  if (!resource) return null;\n\n  const { userEmail, orgId } = ctx;\n  const normalizedUserEmail = normalizeEmailForAccess(userEmail);\n\n  if (\n    normalizedUserEmail &&\n    normalizeEmailForAccess(resource.ownerEmail) === normalizedUserEmail &&\n    ownerMatchesActiveScope(reg, resource, ctx)\n  ) {\n    return { role: \"owner\", resource };\n  }\n  if (resource.visibility === \"public\" && reg.allowPublic !== false) {\n    // No share row needed; default viewer unless the resource registration\n    // deliberately grants a stronger public-by-link role or explicit shares\n    // upgrade the current principal.\n    const publicRole = await publicAccessRoleForResource(reg, resource, ctx);\n    const role = await highestShareRole(reg, resourceId, ctx, resource);\n    return { role: higherShareRole(publicRole, role), resource };\n  }\n  // `visibility === \"public\"` on an `allowPublic: false` resource is treated\n  // as private: only owner + explicit shares grant access. Falls through to\n  // the explicit-share lookup below.\n  if (resource.visibility === \"org\" && orgId && resource.orgId === orgId) {\n    const role = await highestShareRole(reg, resourceId, ctx, resource);\n    return { role: role ?? \"viewer\", resource };\n  }\n  const role = await highestShareRole(reg, resourceId, ctx, resource);\n  if (role) return { role, resource };\n  return null;\n}\n\nasync function highestShareRole(\n  reg: ShareableResourceRegistration,\n  resourceId: string,\n  ctx: AccessContext,\n  resource: any,\n): Promise<ShareRole | null> {\n  const { userEmail, orgId } = ctx;\n  const normalizedUserEmail = normalizeEmailForAccess(userEmail);\n  if (!normalizedUserEmail && !orgId) return null;\n  if (!explicitSharesAllowedForResource(reg, resource, ctx)) return null;\n  const db = reg.getDb() as any;\n\n  const principalClauses: ReturnType<typeof and>[] = [];\n  if (normalizedUserEmail) {\n    principalClauses.push(\n      and(\n        eq(reg.sharesTable.principalType, \"user\"),\n        emailColumnMatches(reg.sharesTable.principalId, normalizedUserEmail),\n      ),\n    );\n  }\n  if (orgId) {\n    principalClauses.push(\n      and(\n        eq(reg.sharesTable.principalType, \"org\"),\n        eq(reg.sharesTable.principalId, orgId),\n      ),\n    );\n  }\n\n  const rows = await db\n    .select({ role: reg.sharesTable.role })\n    .from(reg.sharesTable)\n    .where(\n      and(eq(reg.sharesTable.resourceId, resourceId), or(...principalClauses)),\n    )\n    .limit(10);\n\n  let best: ShareRole | null = null;\n  for (const r of rows as Array<{ role: ShareRole }>) {\n    if (!best || ROLE_RANK[r.role] > ROLE_RANK[best]) best = r.role;\n  }\n  return best;\n}\n\n/**\n * Throw ForbiddenError if the current user can't act on this resource with at\n * least the given role. Used at the top of update/delete actions.\n */\nexport async function assertAccess(\n  resourceType: string,\n  resourceId: string,\n  minRole: ShareRole | \"owner\" = \"viewer\",\n  ctx: AccessContext = currentAccess(),\n): Promise<ResolvedAccess> {\n  const access = await resolveAccess(resourceType, resourceId, ctx);\n  if (!access) {\n    throw new ForbiddenError(`No access to ${resourceType} ${resourceId}`);\n  }\n  if (ROLE_RANK[access.role] < ROLE_RANK[minRole]) {\n    throw new ForbiddenError(\n      `Requires ${minRole} role on ${resourceType} ${resourceId} (have ${access.role})`,\n    );\n  }\n  return access;\n}\n"]}

package/dist/sharing/registry.d.ts

@@ -55,6 +55,16 @@ export interface ShareableResourceRegistration {
      * Default: `true` (matches the historical behavior — most resources can be public).
      */
     allowPublic?: boolean;
+    /**
+     * Optional role granted by a public-by-link read. Most resources should omit
+     * this so public visibility remains viewer-only. Use narrowly for local or
+     * otherwise constrained resources where the resource owner intentionally wants
+     * unauthenticated link holders to do more than view.
+     */
+    publicAccessRole?: "viewer" | "editor" | "admin" | ((resource: any, ctx: {
+        userEmail?: string;
+        orgId?: string;
+    }) => "viewer" | "editor" | "admin" | Promise<"viewer" | "editor" | "admin">);
     /**
      * When `true`, individual user shares (`principalType: "user"`) must target
      * an email that is already a member of the same org as the resource, OR has

package/dist/sharing/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sharing/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,6BAA6B;IAC5C,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,aAAa,EAAE,GAAG,CAAC;IACnB,qDAAqD;IACrD,WAAW,EAAE,GAAG,CAAC;IACjB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC;IACxD;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC;IACjB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;OAUG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK;QACtE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAuCD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,6BAA6B,GACnC,IAAI,CAGN;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,GACX,6BAA6B,GAAG,SAAS,CAE3C;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GACX,6BAA6B,CAS/B;AAED,wBAAgB,sBAAsB,IAAI,6BAA6B,EAAE,CAExE"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/sharing/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,6BAA6B;IAC5C,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,aAAa,EAAE,GAAG,CAAC;IACnB,qDAAqD;IACrD,WAAW,EAAE,GAAG,CAAC;IACjB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC;IACxD;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,CAAC;IACjB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,gBAAgB,CAAC,EACb,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,CAAC,CACC,QAAQ,EAAE,GAAG,EACb,GAAG,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAEzC,QAAQ,GACR,QAAQ,GACR,OAAO,GACP,OAAO,CAAC,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;IAChD;;;;;;;;;;OAUG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK;QACtE,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAuCD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,6BAA6B,GACnC,IAAI,CAGN;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,GACX,6BAA6B,GAAG,SAAS,CAE3C;AAED,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,GACX,6BAA6B,CAS/B;AAED,wBAAgB,sBAAsB,IAAI,6BAA6B,EAAE,CAExE"}

package/dist/sharing/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sharing/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA0EH,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAEzD,MAAM,cAAc,GAClB,UAAiB,CAAC;AAEpB,SAAS,aAAa;IACpB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;QAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;IACtC,OAAO,oEAAoE,CAAC,IAAI,CAC9E,KAAK,CACN,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,CAAC,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,IAAI,GAAG,EAAyC,CAAC;QACrD,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAoC;IAEpC,IAAI,CAAC,aAAa,EAAE,IAAI,4BAA4B,EAAE;QAAE,OAAO;IAC/D,WAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY;IAEZ,OAAO,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAY;IAEZ,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,gDAAgD,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["/**\n * Registry of shareable resources.\n *\n * Each template registers its ownable resource(s) once on module load so the\n * framework-level share actions (`share-resource`, `list-resource-shares`,\n * etc.) can dispatch to the correct tables.\n *\n *   import { registerShareableResource } from \"@agent-native/core/sharing\";\n *   import * as schema from \"./schema.js\";\n *\n *   registerShareableResource({\n *     type: \"document\",\n *     resourceTable: schema.documents,\n *     sharesTable: schema.documentShares,\n *     displayName: \"Document\",\n *     titleColumn: \"title\",\n *   });\n */\n\nexport interface ShareableResourceRegistration {\n  /** Stable identifier used across actions, UI, and analytics. e.g. \"document\". */\n  type: string;\n  /** Drizzle table for the parent resource (must have ownableColumns()). */\n  resourceTable: any;\n  /** Drizzle table produced by createSharesTable(). */\n  sharesTable: any;\n  /** Human-readable singular label shown in the share dialog. */\n  displayName: string;\n  /**\n   * Column on the resource table that holds a human-readable title for\n   * display in the share UI. Default: \"title\".\n   */\n  titleColumn?: string;\n  /**\n   * Optional app-relative path to this resource. Used by share notifications\n   * when the caller does not pass a more specific resourceUrl.\n   */\n  getResourcePath?: (resource: any) => string | undefined;\n  /**\n   * Drizzle DB accessor from the template's server/db/index.ts. Required —\n   * the framework-level share actions and access helpers call this to reach\n   * the right DB instance (schema is template-specific).\n   */\n  getDb: () => any;\n  /**\n   * When `false`, `visibility: \"public\"` is rejected by `set-resource-visibility`,\n   * and `accessFilter` / `resolveAccess` treat any stored public row as private\n   * (defense in depth — only owner + explicit shares grant access).\n   *\n   * Use this for resources that execute code or expose privileged data and must\n   * never be reachable by a random authenticated user. Extensions set this:\n   * extension HTML runs inside an iframe that calls actions / DB / proxied APIs\n   * as the *viewer*, so a public extension would be arbitrary code with the\n   * viewer's credentials.\n   *\n   * Default: `true` (matches the historical behavior — most resources can be public).\n   */\n  allowPublic?: boolean;\n  /**\n   * When `true`, individual user shares (`principalType: \"user\"`) must target\n   * an email that is already a member of the same org as the resource, OR has\n   * a pending invitation to that org. Cross-org user shares are rejected.\n   *\n   * Pair with `allowPublic: false` for resources that need a hard \"this org\n   * only\" trust boundary. Extensions set this so a malicious caller can't\n   * widen reach by sharing a code-executing extension to an outsider email.\n   *\n   * Default: `false` (matches the historical behavior — any email can be granted).\n   */\n  requireOrgMemberForUserShares?: boolean;\n  /**\n   * Optional per-resource access-context adapter. Most resources should use the\n   * request user/org unchanged. Templates with an intentional alternate local\n   * identity can normalize here so the generic framework sharing actions and\n   * access helpers stay in sync with template-owned actions.\n   */\n  resolveAccessContext?: (ctx: { userEmail?: string; orgId?: string }) => {\n    userEmail?: string;\n    orgId?: string;\n  };\n  /**\n   * When true, direct ownership is recognized by owner_email regardless of the\n   * caller's active org. Use this only for resource types where the template's\n   * own actions already treat owner_email as the cross-org authority and list\n   * views add their own org filters.\n   *\n   * Default: `false`.\n   */\n  ownerAccessIgnoresOrg?: boolean;\n}\n\n// Stash the registry on globalThis so it survives SSR bundle duplication.\n// Vite SSR's `noExternal: /^(?!node:)/` policy means @agent-native/core gets\n// inlined into every server bundle that imports it — and each bundle gets its\n// own module-level state. A plain `new Map()` here would create one Map per\n// bundle, so the template's `registerShareableResource()` (called from the\n// Nitro plugin graph) wouldn't be visible to the framework's auto-mounted\n// share-resource action (loaded via `import(\"../sharing/actions/...js\")` in a\n// different module instance). Using globalThis collapses them back to one Map.\nconst REGISTRY_KEY = \"__agentNativeShareableResources__\";\ntype RegistryStore = Map<string, ShareableResourceRegistration>;\nconst globalRegistry: { [K in typeof REGISTRY_KEY]?: RegistryStore } =\n  globalThis as any;\n\nfunction isTestRuntime(): boolean {\n  return (\n    process.env.NODE_ENV === \"test\" ||\n    process.env.VITEST === \"true\" ||\n    process.env.VITEST === \"1\"\n  );\n}\n\nfunction registrationCameFromTestFile(): boolean {\n  const stack = new Error().stack ?? \"\";\n  return /[./\\\\](?:[^/\\\\]+[.-])(?:test|spec)\\.[cm]?[jt]sx?(?::\\d+)?(?::\\d+)?/.test(\n    stack,\n  );\n}\n\nfunction getRegistry(): RegistryStore {\n  let r = globalRegistry[REGISTRY_KEY];\n  if (!r) {\n    r = new Map<string, ShareableResourceRegistration>();\n    globalRegistry[REGISTRY_KEY] = r;\n  }\n  return r;\n}\n\nexport function registerShareableResource(\n  entry: ShareableResourceRegistration,\n): void {\n  if (!isTestRuntime() && registrationCameFromTestFile()) return;\n  getRegistry().set(entry.type, entry);\n}\n\nexport function getShareableResource(\n  type: string,\n): ShareableResourceRegistration | undefined {\n  return getRegistry().get(type);\n}\n\nexport function requireShareableResource(\n  type: string,\n): ShareableResourceRegistration {\n  const reg = getRegistry();\n  const entry = reg.get(type);\n  if (!entry) {\n    throw new Error(\n      `Unknown shareable resource type: \"${type}\". Did you forget registerShareableResource()?`,\n    );\n  }\n  return entry;\n}\n\nexport function listShareableResources(): ShareableResourceRegistration[] {\n  return Array.from(getRegistry().values());\n}\n"]}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/sharing/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA4FH,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,YAAY,GAAG,mCAAmC,CAAC;AAEzD,MAAM,cAAc,GAClB,UAAiB,CAAC;AAEpB,SAAS,aAAa;IACpB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM;QAC/B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;QAC7B,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAC3B,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;IACtC,OAAO,oEAAoE,CAAC,IAAI,CAC9E,KAAK,CACN,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,CAAC,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,CAAC,GAAG,IAAI,GAAG,EAAyC,CAAC;QACrD,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAoC;IAEpC,IAAI,CAAC,aAAa,EAAE,IAAI,4BAA4B,EAAE;QAAE,OAAO;IAC/D,WAAW,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAY;IAEZ,OAAO,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAY;IAEZ,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,gDAAgD,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["/**\n * Registry of shareable resources.\n *\n * Each template registers its ownable resource(s) once on module load so the\n * framework-level share actions (`share-resource`, `list-resource-shares`,\n * etc.) can dispatch to the correct tables.\n *\n *   import { registerShareableResource } from \"@agent-native/core/sharing\";\n *   import * as schema from \"./schema.js\";\n *\n *   registerShareableResource({\n *     type: \"document\",\n *     resourceTable: schema.documents,\n *     sharesTable: schema.documentShares,\n *     displayName: \"Document\",\n *     titleColumn: \"title\",\n *   });\n */\n\nexport interface ShareableResourceRegistration {\n  /** Stable identifier used across actions, UI, and analytics. e.g. \"document\". */\n  type: string;\n  /** Drizzle table for the parent resource (must have ownableColumns()). */\n  resourceTable: any;\n  /** Drizzle table produced by createSharesTable(). */\n  sharesTable: any;\n  /** Human-readable singular label shown in the share dialog. */\n  displayName: string;\n  /**\n   * Column on the resource table that holds a human-readable title for\n   * display in the share UI. Default: \"title\".\n   */\n  titleColumn?: string;\n  /**\n   * Optional app-relative path to this resource. Used by share notifications\n   * when the caller does not pass a more specific resourceUrl.\n   */\n  getResourcePath?: (resource: any) => string | undefined;\n  /**\n   * Drizzle DB accessor from the template's server/db/index.ts. Required —\n   * the framework-level share actions and access helpers call this to reach\n   * the right DB instance (schema is template-specific).\n   */\n  getDb: () => any;\n  /**\n   * When `false`, `visibility: \"public\"` is rejected by `set-resource-visibility`,\n   * and `accessFilter` / `resolveAccess` treat any stored public row as private\n   * (defense in depth — only owner + explicit shares grant access).\n   *\n   * Use this for resources that execute code or expose privileged data and must\n   * never be reachable by a random authenticated user. Extensions set this:\n   * extension HTML runs inside an iframe that calls actions / DB / proxied APIs\n   * as the *viewer*, so a public extension would be arbitrary code with the\n   * viewer's credentials.\n   *\n   * Default: `true` (matches the historical behavior — most resources can be public).\n   */\n  allowPublic?: boolean;\n  /**\n   * Optional role granted by a public-by-link read. Most resources should omit\n   * this so public visibility remains viewer-only. Use narrowly for local or\n   * otherwise constrained resources where the resource owner intentionally wants\n   * unauthenticated link holders to do more than view.\n   */\n  publicAccessRole?:\n    | \"viewer\"\n    | \"editor\"\n    | \"admin\"\n    | ((\n        resource: any,\n        ctx: { userEmail?: string; orgId?: string },\n      ) =>\n        | \"viewer\"\n        | \"editor\"\n        | \"admin\"\n        | Promise<\"viewer\" | \"editor\" | \"admin\">);\n  /**\n   * When `true`, individual user shares (`principalType: \"user\"`) must target\n   * an email that is already a member of the same org as the resource, OR has\n   * a pending invitation to that org. Cross-org user shares are rejected.\n   *\n   * Pair with `allowPublic: false` for resources that need a hard \"this org\n   * only\" trust boundary. Extensions set this so a malicious caller can't\n   * widen reach by sharing a code-executing extension to an outsider email.\n   *\n   * Default: `false` (matches the historical behavior — any email can be granted).\n   */\n  requireOrgMemberForUserShares?: boolean;\n  /**\n   * Optional per-resource access-context adapter. Most resources should use the\n   * request user/org unchanged. Templates with an intentional alternate local\n   * identity can normalize here so the generic framework sharing actions and\n   * access helpers stay in sync with template-owned actions.\n   */\n  resolveAccessContext?: (ctx: { userEmail?: string; orgId?: string }) => {\n    userEmail?: string;\n    orgId?: string;\n  };\n  /**\n   * When true, direct ownership is recognized by owner_email regardless of the\n   * caller's active org. Use this only for resource types where the template's\n   * own actions already treat owner_email as the cross-org authority and list\n   * views add their own org filters.\n   *\n   * Default: `false`.\n   */\n  ownerAccessIgnoresOrg?: boolean;\n}\n\n// Stash the registry on globalThis so it survives SSR bundle duplication.\n// Vite SSR's `noExternal: /^(?!node:)/` policy means @agent-native/core gets\n// inlined into every server bundle that imports it — and each bundle gets its\n// own module-level state. A plain `new Map()` here would create one Map per\n// bundle, so the template's `registerShareableResource()` (called from the\n// Nitro plugin graph) wouldn't be visible to the framework's auto-mounted\n// share-resource action (loaded via `import(\"../sharing/actions/...js\")` in a\n// different module instance). Using globalThis collapses them back to one Map.\nconst REGISTRY_KEY = \"__agentNativeShareableResources__\";\ntype RegistryStore = Map<string, ShareableResourceRegistration>;\nconst globalRegistry: { [K in typeof REGISTRY_KEY]?: RegistryStore } =\n  globalThis as any;\n\nfunction isTestRuntime(): boolean {\n  return (\n    process.env.NODE_ENV === \"test\" ||\n    process.env.VITEST === \"true\" ||\n    process.env.VITEST === \"1\"\n  );\n}\n\nfunction registrationCameFromTestFile(): boolean {\n  const stack = new Error().stack ?? \"\";\n  return /[./\\\\](?:[^/\\\\]+[.-])(?:test|spec)\\.[cm]?[jt]sx?(?::\\d+)?(?::\\d+)?/.test(\n    stack,\n  );\n}\n\nfunction getRegistry(): RegistryStore {\n  let r = globalRegistry[REGISTRY_KEY];\n  if (!r) {\n    r = new Map<string, ShareableResourceRegistration>();\n    globalRegistry[REGISTRY_KEY] = r;\n  }\n  return r;\n}\n\nexport function registerShareableResource(\n  entry: ShareableResourceRegistration,\n): void {\n  if (!isTestRuntime() && registrationCameFromTestFile()) return;\n  getRegistry().set(entry.type, entry);\n}\n\nexport function getShareableResource(\n  type: string,\n): ShareableResourceRegistration | undefined {\n  return getRegistry().get(type);\n}\n\nexport function requireShareableResource(\n  type: string,\n): ShareableResourceRegistration {\n  const reg = getRegistry();\n  const entry = reg.get(type);\n  if (!entry) {\n    throw new Error(\n      `Unknown shareable resource type: \"${type}\". Did you forget registerShareableResource()?`,\n    );\n  }\n  return entry;\n}\n\nexport function listShareableResources(): ShareableResourceRegistration[] {\n  return Array.from(getRegistry().values());\n}\n"]}