npm - @agent-native/core - Versions diffs - 0.84.24 → 0.84.27 - Mend

@agent-native/core 0.84.24 → 0.84.27

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (82) hide show

package/dist/sharing/actions/set-resource-visibility.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"set-resource-visibility.js","sourceRoot":"","sources":["../../../src/sharing/actions/set-resource-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,8BAA8B,GAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,~~wOAAwO~~;~~IAC1O~~,~~sEAAsE~~;~~IACtE,oEAAoE~~;~~IACpE~~,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE;QACN,cAAc,EAAE,IAAI;KACrB;IACD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;KACjD,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC9D,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,mFAAmF,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,MAAM,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACxE,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,8BAA8B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;QAC1E,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;YACzD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,uBAAuB,GAC3B,CAAC,CAAC,SAAS,CAAC,KAAK;oBACjB,CAAC,CAAC,GAAG,CAAC,oBAAoB;oBAC1B,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;gBAC1B,qEAAqE;gBACrE,qEAAqE;gBACrE,iEAAiE;gBACjE,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAC7B,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,sFAAsF,CACzG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,6EAA6E;gBAC7E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,8EAA8E;gBAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC5B,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,wDAAwD,CAC3E,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,MAAM,sBAAsB,GAAG,MAAM,8BAA8B,CACjE,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,MAAM,EAAE;aACL,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;aACzB,GAAG,CAAC,MAAM,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACpD,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACnD,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { eq } from \"drizzle-orm\";\nimport { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport {\n assertAccess,\n currentAccess,\n ForbiddenError,\n resolveRegisteredAccessContext,\n} from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\nimport {\n getExtensionShareChangeTargets,\n notifyExtensionShareChanged,\n} from \"./extension-change.js\";\n\nexport default defineAction({\n description:\n \"Change the coarse visibility of a shareable resource: 'private' keeps it owner-only, 'org' shares it with all members of the owner's organization, 'public' makes it accessible to anyone with the link. ~~Owner~~ or admin role ~~required~~.\",\n // (audit H5) Visibility changes ~~are admin-tier and~~ can flip a private~~\n //~~ resource org-wide or public. Refuse from the tools iframe bridge.\n toolCallable: false,\n mcpApp: {\n compactCatalog: true,\n },\n schema: z.object({\n resourceType: z.string(),\n resourceId: z.string(),\n visibility: z.enum([\"private\", \"org\", \"public\"]),\n }),\n run: async (args) => {\n const reg = requireShareableResource(args.resourceType);\n if (args.visibility === \"public\" && reg.allowPublic === false) {\n throw new ForbiddenError(\n `${reg.displayName} cannot be made public — share with specific people or your organization instead.`,\n );\n }\n const access = await assertAccess(\n args.resourceType,\n args.resourceId,\n \"admin\",\n );\n const db = reg.getDb() as any;\n const update: Record<string, unknown> = { visibility: args.visibility };\n const rawAccess = currentAccess();\n const currentOrgId = resolveRegisteredAccessContext(reg, rawAccess).orgId;\n if (args.visibility === \"org\" && !access.resource?.orgId) {\n if (!currentOrgId) {\n const canKeepResourceUnscoped =\n !!rawAccess.orgId &&\n !!reg.resolveAccessContext &&\n access.role === \"owner\";\n // Some templates intentionally normalize local single-user resources\n // out of request org scope. In that mode, keep the row unbound while\n // still allowing the owner to persist the visibility preference.\n if (!canKeepResourceUnscoped) {\n throw new ForbiddenError(\n `${reg.displayName} cannot be shared with your organization because no active organization is selected.`,\n );\n }\n } else {\n // Only the resource owner may bind an org to a previously unscoped resource.\n // If a non-owner admin did this, the resource would adopt the admin's org\n // and ownerMatchesActiveScope would then lock the real owner out of their\n // own resource. Non-owner admins can still flip visibility once orgId is set.\n if (access.role !== \"owner\") {\n throw new ForbiddenError(\n `${reg.displayName} can only be attached to an organization by its owner.`,\n );\n }\n update.orgId = currentOrgId;\n }\n }\n const beforeExtensionTargets = await getExtensionShareChangeTargets(\n args.resourceType,\n args.resourceId,\n );\n await db\n .update(reg.resourceTable)\n .set(update)\n .where(eq(reg.resourceTable.id, args.resourceId));\n await notifyExtensionShareChanged(\n args.resourceType,\n args.resourceId,\n beforeExtensionTargets,\n );\n return { ok: true, visibility: args.visibility };\n },\n});\n"]}
1	+ {"version":3,"file":"set-resource-visibility.js","sourceRoot":"","sources":["../../../src/sharing/actions/set-resource-visibility.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EACL,YAAY,EACZ,aAAa,EACb,cAAc,EACd,8BAA8B,GAC/B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,0PAA0P;IAC5P,wEAAwE;IACxE,+CAA+C;IAC/C,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE;QACN,cAAc,EAAE,IAAI;KACrB;IACD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;KACjD,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAC9D,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,mFAAmF,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,MAAM,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACxE,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,8BAA8B,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;QAC1E,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;YACzD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,uBAAuB,GAC3B,CAAC,CAAC,SAAS,CAAC,KAAK;oBACjB,CAAC,CAAC,GAAG,CAAC,oBAAoB;oBAC1B,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;gBAC1B,qEAAqE;gBACrE,qEAAqE;gBACrE,iEAAiE;gBACjE,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBAC7B,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,sFAAsF,CACzG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,6EAA6E;gBAC7E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,8EAA8E;gBAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC5B,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,wDAAwD,CAC3E,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,MAAM,sBAAsB,GAAG,MAAM,8BAA8B,CACjE,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,MAAM,EAAE;aACL,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;aACzB,GAAG,CAAC,MAAM,CAAC;aACX,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACpD,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACnD,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { eq } from \"drizzle-orm\";\nimport { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport {\n assertAccess,\n currentAccess,\n ForbiddenError,\n resolveRegisteredAccessContext,\n} from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\nimport {\n getExtensionShareChangeTargets,\n notifyExtensionShareChanged,\n} from \"./extension-change.js\";\n\nexport default defineAction({\n description:\n \"Change the coarse visibility of a shareable resource: 'private' keeps it owner-only, 'org' shares it with all members of the owner's organization, 'public' makes it accessible to anyone with the link. Visibility changes require owner or admin role.\",\n // (audit H5) Visibility changes can flip a private resource org-wide or\n // public. Refuse from the tools iframe bridge.\n toolCallable: false,\n mcpApp: {\n compactCatalog: true,\n },\n schema: z.object({\n resourceType: z.string(),\n resourceId: z.string(),\n visibility: z.enum([\"private\", \"org\", \"public\"]),\n }),\n run: async (args) => {\n const reg = requireShareableResource(args.resourceType);\n if (args.visibility === \"public\" && reg.allowPublic === false) {\n throw new ForbiddenError(\n `${reg.displayName} cannot be made public — share with specific people or your organization instead.`,\n );\n }\n const access = await assertAccess(\n args.resourceType,\n args.resourceId,\n \"admin\",\n );\n const db = reg.getDb() as any;\n const update: Record<string, unknown> = { visibility: args.visibility };\n const rawAccess = currentAccess();\n const currentOrgId = resolveRegisteredAccessContext(reg, rawAccess).orgId;\n if (args.visibility === \"org\" && !access.resource?.orgId) {\n if (!currentOrgId) {\n const canKeepResourceUnscoped =\n !!rawAccess.orgId &&\n !!reg.resolveAccessContext &&\n access.role === \"owner\";\n // Some templates intentionally normalize local single-user resources\n // out of request org scope. In that mode, keep the row unbound while\n // still allowing the owner to persist the visibility preference.\n if (!canKeepResourceUnscoped) {\n throw new ForbiddenError(\n `${reg.displayName} cannot be shared with your organization because no active organization is selected.`,\n );\n }\n } else {\n // Only the resource owner may bind an org to a previously unscoped resource.\n // If a non-owner admin did this, the resource would adopt the admin's org\n // and ownerMatchesActiveScope would then lock the real owner out of their\n // own resource. Non-owner admins can still flip visibility once orgId is set.\n if (access.role !== \"owner\") {\n throw new ForbiddenError(\n `${reg.displayName} can only be attached to an organization by its owner.`,\n );\n }\n update.orgId = currentOrgId;\n }\n }\n const beforeExtensionTargets = await getExtensionShareChangeTargets(\n args.resourceType,\n args.resourceId,\n );\n await db\n .update(reg.resourceTable)\n .set(update)\n .where(eq(reg.resourceTable.id, args.resourceId));\n await notifyExtensionShareChanged(\n args.resourceType,\n args.resourceId,\n beforeExtensionTargets,\n );\n return { ok: true, visibility: args.visibility };\n },\n});\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.84.24",
+  "version": "0.84.27",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {