@agent-native/core 0.90.11 → 0.91.0

package/dist/sharing/actions/list-resource-shares.js

@@ -1,8 +1,33 @@
-import { eq } from "drizzle-orm";
+import { eq, inArray } from "drizzle-orm";
 import { z } from "zod";
 import { defineAction } from "../../action.js";
+import { organizations } from "../../org/schema.js";
 import { resolveAccess } from "../access.js";
 import { requireShareableResource } from "../registry.js";
+async function loadOrgDisplayNames(db, shares) {
+    const orgIds = Array.from(new Set(shares
+        .filter((s) => s.principalType === "org" && s.principalId)
+        .map((s) => s.principalId)));
+    if (!orgIds.length)
+        return new Map();
+    try {
+        const rows = await db
+            .select({ id: organizations.id, name: organizations.name })
+            .from(organizations)
+            .where(inArray(organizations.id, orgIds));
+        return new Map(rows.flatMap((row) => {
+            if (typeof row.id !== "string" || typeof row.name !== "string") {
+                return [];
+            }
+            const name = row.name.trim();
+            return name ? [[row.id, name]] : [];
+        }));
+    }
+    catch {
+        // Some templates or older local databases may not have org tables yet.
+        return new Map();
+    }
+}
 export default defineAction({
     description: "List the current visibility and share grants on a shareable resource. Any read access is sufficient.",
     schema: z.object({
@@ -26,6 +51,7 @@ export default defineAction({
             .select()
             .from(reg.sharesTable)
             .where(eq(reg.sharesTable.resourceId, args.resourceId));
+        const orgDisplayNames = await loadOrgDisplayNames(db, shares);
         return {
             ownerEmail: access.resource.ownerEmail ?? null,
             orgId: access.resource.orgId ?? null,
@@ -35,6 +61,9 @@ export default defineAction({
                 id: s.id,
                 principalType: s.principalType,
                 principalId: s.principalId,
+                displayName: s.principalType === "org"
+                    ? orgDisplayNames.get(s.principalId)
+                    : undefined,
                 role: s.role,
                 createdAt: s.createdAt,
             })),

package/dist/sharing/actions/list-resource-shares.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-resource-shares.js","sourceRoot":"","sources":["../../../src/sharing/actions/list-resource-shares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,sGAAsG;IACxG,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC;IACF,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IACvB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG;YACb,sEAAsE;YACtE,kDAAkD;YAClD,WAAW,EAAE,GAAG,CAAC,WAAW,KAAK,KAAK;YACtC,6BAA6B,EAAE,GAAG,CAAC,6BAA6B,KAAK,IAAI;SAC1E,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAEpE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAE1D,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;YAC9C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI;YACpC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS;YACnD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;YACH,MAAM;SACP,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { eq } from \"drizzle-orm\";\nimport { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { resolveAccess } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\n\nexport default defineAction({\n  description:\n    \"List the current visibility and share grants on a shareable resource. Any read access is sufficient.\",\n  schema: z.object({\n    resourceType: z.string(),\n    resourceId: z.string(),\n  }),\n  http: { method: \"GET\" },\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    const policy = {\n      // Defaults match registration defaults so the UI behaves the same for\n      // resources that haven't opted into restrictions.\n      allowPublic: reg.allowPublic !== false,\n      requireOrgMemberForUserShares: reg.requireOrgMemberForUserShares === true,\n    };\n    const access = await resolveAccess(args.resourceType, args.resourceId);\n    if (!access)\n      return { ownerEmail: null, visibility: null, shares: [], policy };\n\n    const db = reg.getDb() as any;\n    const shares = await db\n      .select()\n      .from(reg.sharesTable)\n      .where(eq(reg.sharesTable.resourceId, args.resourceId));\n\n    return {\n      ownerEmail: access.resource.ownerEmail ?? null,\n      orgId: access.resource.orgId ?? null,\n      visibility: access.resource.visibility ?? \"private\",\n      role: access.role,\n      shares: shares.map((s: any) => ({\n        id: s.id,\n        principalType: s.principalType,\n        principalId: s.principalId,\n        role: s.role,\n        createdAt: s.createdAt,\n      })),\n      policy,\n    };\n  },\n});\n"]}
+{"version":3,"file":"list-resource-shares.js","sourceRoot":"","sources":["../../../src/sharing/actions/list-resource-shares.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,KAAK,UAAU,mBAAmB,CAChC,EAAO,EACP,MAA6D;IAE7D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CACvB,IAAI,GAAG,CACL,MAAM;SACH,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,KAAK,IAAI,CAAC,CAAC,WAAW,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAC7B,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC;aAC1D,IAAI,CAAC,aAAa,CAAC;aACnB,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,GAAG,CACZ,IAAI,CAAC,OAAO,CACV,CAAC,GAGA,EAA2B,EAAE;YAC5B,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/D,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,CAAC,CACF,CACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,sGAAsG;IACxG,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC;IACF,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IACvB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG;YACb,sEAAsE;YACtE,kDAAkD;YAClD,WAAW,EAAE,GAAG,CAAC,WAAW,KAAK,KAAK;YACtC,6BAA6B,EAAE,GAAG,CAAC,6BAA6B,KAAK,IAAI;SAC1E,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM;YACT,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;QAEpE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1D,MAAM,eAAe,GAAG,MAAM,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAE9D,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,IAAI;YAC9C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI;YACpC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS;YACnD,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,aAAa,EAAE,CAAC,CAAC,aAAa;gBAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EACT,CAAC,CAAC,aAAa,KAAK,KAAK;oBACvB,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;oBACpC,CAAC,CAAC,SAAS;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;YACH,MAAM;SACP,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { eq, inArray } from \"drizzle-orm\";\nimport { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { organizations } from \"../../org/schema.js\";\nimport { resolveAccess } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\n\nasync function loadOrgDisplayNames(\n  db: any,\n  shares: Array<{ principalType: string; principalId: string }>,\n): Promise<Map<string, string>> {\n  const orgIds = Array.from(\n    new Set(\n      shares\n        .filter((s) => s.principalType === \"org\" && s.principalId)\n        .map((s) => s.principalId),\n    ),\n  );\n  if (!orgIds.length) return new Map();\n\n  try {\n    const rows = await db\n      .select({ id: organizations.id, name: organizations.name })\n      .from(organizations)\n      .where(inArray(organizations.id, orgIds));\n    return new Map(\n      rows.flatMap(\n        (row: {\n          id?: string | null;\n          name?: string | null;\n        }): Array<[string, string]> => {\n          if (typeof row.id !== \"string\" || typeof row.name !== \"string\") {\n            return [];\n          }\n          const name = row.name.trim();\n          return name ? [[row.id, name]] : [];\n        },\n      ),\n    );\n  } catch {\n    // Some templates or older local databases may not have org tables yet.\n    return new Map();\n  }\n}\n\nexport default defineAction({\n  description:\n    \"List the current visibility and share grants on a shareable resource. Any read access is sufficient.\",\n  schema: z.object({\n    resourceType: z.string(),\n    resourceId: z.string(),\n  }),\n  http: { method: \"GET\" },\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    const policy = {\n      // Defaults match registration defaults so the UI behaves the same for\n      // resources that haven't opted into restrictions.\n      allowPublic: reg.allowPublic !== false,\n      requireOrgMemberForUserShares: reg.requireOrgMemberForUserShares === true,\n    };\n    const access = await resolveAccess(args.resourceType, args.resourceId);\n    if (!access)\n      return { ownerEmail: null, visibility: null, shares: [], policy };\n\n    const db = reg.getDb() as any;\n    const shares = await db\n      .select()\n      .from(reg.sharesTable)\n      .where(eq(reg.sharesTable.resourceId, args.resourceId));\n    const orgDisplayNames = await loadOrgDisplayNames(db, shares);\n\n    return {\n      ownerEmail: access.resource.ownerEmail ?? null,\n      orgId: access.resource.orgId ?? null,\n      visibility: access.resource.visibility ?? \"private\",\n      role: access.role,\n      shares: shares.map((s: any) => ({\n        id: s.id,\n        principalType: s.principalType,\n        principalId: s.principalId,\n        displayName:\n          s.principalType === \"org\"\n            ? orgDisplayNames.get(s.principalId)\n            : undefined,\n        role: s.role,\n        createdAt: s.createdAt,\n      })),\n      policy,\n    };\n  },\n});\n"]}

package/dist/sharing/actions/share-resource.js

@@ -85,6 +85,9 @@ function normalizePrincipalId(principalType, principalId) {
         ? principalId.trim().toLowerCase()
         : principalId;
 }
+function isEmailPrincipalId(value) {
+    return /^[^\s@]+@[^\s@]+$/.test(value.trim());
+}
 function principalIdMatches(sharesTable, principalType, principalId) {
     return principalType === "user"
         ? sql `lower(${sharesTable.principalId}) = ${principalId}`
@@ -155,6 +158,9 @@ export default defineAction({
         if (!actor)
             throw new ForbiddenError("Not signed in");
         const principalId = normalizePrincipalId(args.principalType, args.principalId);
+        if (args.principalType === "user" && !isEmailPrincipalId(principalId)) {
+            throw new Error("User shares must use an email address, not an internal user id.");
+        }
         const beforeExtensionTargets = await getExtensionShareChangeTargets(args.resourceType, args.resourceId);
         if (reg.requireOrgMemberForUserShares) {
             const resourceOrgId = access.resource?.orgId;

package/dist/sharing/actions/share-resource.js.map

@@ -1 +1 @@
-{"version":3,"file":"share-resource.js","sourceRoot":"","sources":["../../../src/sharing/actions/share-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,CAAC,MAAM,KAAK,cAAc;YACxB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxB,MAAM,KAAK,iBAAiB;YAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnD,MAAM,mBAAmB,GACvB,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,mBAAmB;gBAChC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE;gBACzB,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;YAC3C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,WAA+B,EAC/B,YAAgC,EAChC,MAAM,GAAG,mBAAmB,EAAE;IAE9B,KAAK,MAAM,SAAS,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,GAAG,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,IAAI,GAAG,EAAE;IACvB,MAAM,KAAK,GACT,gEAAgE,CAAC;IACnE,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,oBAAoB,CAC3B,aAA6B,EAC7B,WAAmB;IAEnB,OAAO,aAAa,KAAK,MAAM;QAC7B,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CACzB,WAAgB,EAChB,aAA6B,EAC7B,WAAmB;IAEnB,OAAO,aAAa,KAAK,MAAM;QAC7B,CAAC,CAAC,GAAG,CAAA,SAAS,WAAW,CAAC,WAAW,OAAO,WAAW,EAAE;QACzD,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,yEAAyE;QAC9E,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACnC,GAAG,EAAE,oGAAoG;QACzG,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,mFAAmF;IACrF,sEAAsE;IACtE,qEAAqE;IACrE,gEAAgE;IAChE,sDAAsD;IACtD,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,CAAC,oDAAoD,CAAC;QACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC/D,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;aACrB,QAAQ,CAAC,2DAA2D,CAAC;QACxE,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;aACnC,OAAO,CAAC,QAAQ,CAAC;aACjB,QAAQ,CAAC,gBAAgB,CAAC;QAC7B,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,2EAA2E,CAC5E;QACH,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,gGAAgG,CACjG;KACJ,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;QACF,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,MAAM,sBAAsB,GAAG,MAAM,8BAA8B,CACjE,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,IAAI,GAAG,CAAC,6BAA6B,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAkC,CAAC;YAC1E,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,wFAAwF,CAC3G,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBAClC,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,IAAI,cAAc,CACtB,GAAG,WAAW,kFAAkF,CACjG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxC,8DAA8D;gBAC9D,gEAAgE;gBAChE,6DAA6D;gBAC7D,8CAA8C;gBAC9C,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;oBAClC,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,qEAAqE,CACxF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;aACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EACrD,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CACrE,CACF,CAAC;QAEJ,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,EAAE;iBACL,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;iBACvB,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,2BAA2B,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAChE,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;YACtC,EAAE;YACF,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,2BAA2B,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;QAEF,IACE,IAAI,CAAC,MAAM,KAAK,KAAK;YACrB,IAAI,CAAC,aAAa,KAAK,MAAM;YAC7B,CAAC,MAAM,iBAAiB,EAAE,CAAC;YAC3B,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAChC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC;gBAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;qBACxB,MAAM,EAAE;qBACR,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;qBACvB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBACpD,MAAM,aAAa,GAChB,QAAQ,EAAE,CAAC,QAAQ,CAAwB,IAAI,IAAI,CAAC,YAAY,CAAC;gBACpE,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBACrC,MAAM,YAAY,GAChB,QAAQ,IAAI,GAAG,CAAC,eAAe;oBAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC;oBAC/B,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,eAAe,GAAG,2BAA2B,CACjD,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,MAAM,CACP,CAAC;gBACF,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,cAAc,CAAC;gBACtE,MAAM,OAAO,GAAG,GAAG,KAAK,YAAY,aAAa,iBAAiB,OAAO,EAAE,CAAC;gBAC5E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;oBACjC,SAAS,EAAE,OAAO;oBAClB,OAAO,EAAE,0BAA0B;oBACnC,UAAU,EAAE;wBACV,GAAG,WAAW,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,aAAa,CAAC,kBAAkB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBAChI,8DAA8D,WAAW,CAAC,WAAW,CAAC,GAAG;qBAC1F;oBACD,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;oBAC/D,MAAM,EAAE,6BAA6B,KAAK,gBAAgB,IAAI,CAAC,IAAI,UAAU;iBAC9E,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,qDAAqD,EACrD,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { and, eq, sql, type SQL } from \"drizzle-orm\";\nimport { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { getDbExec } from \"../../db/client.js\";\nimport { getAppProductionUrl } from \"../../server/app-url.js\";\nimport { renderEmail, emailStrong } from \"../../server/email-template.js\";\nimport { sendEmail, isEmailConfigured } from \"../../server/email.js\";\nimport { invalidateCollabAccessCache } from \"../../server/poll.js\";\nimport { getRequestUserEmail } from \"../../server/request-context.js\";\nimport { assertAccess, ForbiddenError } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\nimport {\n  getExtensionShareChangeTargets,\n  notifyExtensionShareChanged,\n} from \"./extension-change.js\";\n\nexport function isSyntheticQaEmail(email: string): boolean {\n  const trimmed = email.trim().toLowerCase();\n  const at = trimmed.lastIndexOf(\"@\");\n  if (at <= 0) return false;\n  const local = trimmed.slice(0, at);\n  const domain = trimmed.slice(at + 1);\n  return (\n    local.includes(\"+qa\") &&\n    (domain === \"example.test\" ||\n      domain.endsWith(\".test\") ||\n      domain === \"example.invalid\" ||\n      domain.endsWith(\".invalid\"))\n  );\n}\n\nfunction appPath(path: string): string {\n  if (!path.startsWith(\"/\")) return path;\n  const raw = process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH || \"\";\n  const base = raw.trim().replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  if (!base) return path;\n  const normalizedBase = `/${base}`;\n  if (path === normalizedBase || path.startsWith(`${normalizedBase}/`)) {\n    return path;\n  }\n  return `${normalizedBase}${path}`;\n}\n\nfunction safeNotificationUrl(value: string, appUrl: string): string | null {\n  const trimmed = value.trim();\n  if (!trimmed) return null;\n\n  try {\n    const base = new URL(appUrl);\n    if (trimmed.startsWith(\"/\")) {\n      const path = appPath(trimmed);\n      const basePath = base.pathname.replace(/\\/+$/, \"\");\n      const alreadyIncludesBase =\n        basePath && basePath !== \"/\" && path.startsWith(`${basePath}/`);\n      const joined = alreadyIncludesBase\n        ? `${base.origin}${path}`\n        : `${appUrl.replace(/\\/+$/, \"\")}${path}`;\n      return new URL(joined).toString();\n    }\n\n    const url = new URL(trimmed);\n    if (![\"http:\", \"https:\"].includes(url.protocol)) return null;\n    if (url.origin !== base.origin) return null;\n    return url.toString();\n  } catch {\n    return null;\n  }\n}\n\nexport function resolveShareNotificationUrl(\n  explicitUrl: string | undefined,\n  fallbackPath: string | undefined,\n  appUrl = getAppProductionUrl(),\n): string {\n  for (const candidate of [explicitUrl, fallbackPath]) {\n    if (!candidate) continue;\n    const url = safeNotificationUrl(candidate, appUrl);\n    if (url) return url;\n  }\n  return appUrl;\n}\n\nfunction nanoid(size = 12): string {\n  const chars =\n    \"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz\";\n  let id = \"\";\n  const bytes = crypto.getRandomValues(new Uint8Array(size));\n  for (const byte of bytes) id += chars[byte % chars.length];\n  return id;\n}\n\nfunction normalizePrincipalId(\n  principalType: \"user\" | \"org\",\n  principalId: string,\n): string {\n  return principalType === \"user\"\n    ? principalId.trim().toLowerCase()\n    : principalId;\n}\n\nfunction principalIdMatches(\n  sharesTable: any,\n  principalType: \"user\" | \"org\",\n  principalId: string,\n): SQL {\n  return principalType === \"user\"\n    ? sql`lower(${sharesTable.principalId}) = ${principalId}`\n    : eq(sharesTable.principalId, principalId);\n}\n\n/**\n * Returns true if the given email is either an active member of `orgId` or\n * has a pending invitation to `orgId`. Used by resources whose registration\n * sets `requireOrgMemberForUserShares` (currently extensions) to refuse\n * cross-org user shares.\n *\n * Both `org_members` and `org_invitations` store email case-insensitively\n * via `LOWER()` in the rest of the framework, so we follow the same\n * convention here.\n */\nasync function isOrgMemberOrInvited(\n  orgId: string,\n  email: string,\n): Promise<boolean> {\n  const lower = email.trim().toLowerCase();\n  if (!lower || !orgId) return false;\n  const client = getDbExec();\n  const member = await client.execute({\n    sql: `SELECT 1 FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n    args: [orgId, lower],\n  });\n  if (member.rows.length > 0) return true;\n  const invited = await client.execute({\n    sql: `SELECT 1 FROM org_invitations WHERE org_id = ? AND LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n    args: [orgId, lower],\n  });\n  return invited.rows.length > 0;\n}\n\nexport default defineAction({\n  description:\n    \"Grant a user or org access to a shareable resource. Owner or admin role required.\",\n  // (audit H5) Sharing-grant operations are admin-tier and let a caller\n  // expand who can read/write a resource. Refuse from the tools iframe\n  // bridge so a malicious shared tool can't silently re-share its\n  // viewer's resources to an attacker-controlled email.\n  toolCallable: false,\n  schema: z.object({\n    resourceType: z\n      .string()\n      .describe(\"Registered resource type, e.g. 'document', 'form'.\"),\n    resourceId: z.string().describe(\"Id of the resource to share.\"),\n    principalType: z\n      .enum([\"user\", \"org\"])\n      .describe(\"'user' for an individual, 'org' for a whole organization.\"),\n    principalId: z\n      .string()\n      .describe(\"Email (user) or org id (org) of the principal.\"),\n    role: z\n      .enum([\"viewer\", \"editor\", \"admin\"])\n      .default(\"viewer\")\n      .describe(\"Role to grant.\"),\n    notify: z\n      .boolean()\n      .default(true)\n      .describe(\n        \"Whether to email the user about a new individual share. Defaults to true.\",\n      ),\n    resourceUrl: z\n      .string()\n      .optional()\n      .describe(\n        \"Optional app-relative or same-origin URL recipients should open. External origins are ignored.\",\n      ),\n  }),\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    const access = await assertAccess(\n      args.resourceType,\n      args.resourceId,\n      \"admin\",\n    );\n    const actor = getRequestUserEmail();\n    if (!actor) throw new ForbiddenError(\"Not signed in\");\n    const principalId = normalizePrincipalId(\n      args.principalType,\n      args.principalId,\n    );\n    const beforeExtensionTargets = await getExtensionShareChangeTargets(\n      args.resourceType,\n      args.resourceId,\n    );\n\n    if (reg.requireOrgMemberForUserShares) {\n      const resourceOrgId = access.resource?.orgId as string | undefined | null;\n      if (!resourceOrgId) {\n        throw new ForbiddenError(\n          `${reg.displayName} can only be shared from within an organization. Create or join an organization first.`,\n        );\n      }\n      if (args.principalType === \"user\") {\n        const ok = await isOrgMemberOrInvited(resourceOrgId, principalId);\n        if (!ok) {\n          throw new ForbiddenError(\n            `${principalId} is not in your organization. Invite them to the organization first, then share.`,\n          );\n        }\n      } else if (args.principalType === \"org\") {\n        // Cross-org org shares would let an outside org's members run\n        // extension code in the viewer's auth context — the same threat\n        // model that blocks public + cross-org user shares. Pin org-\n        // principal shares to the resource's own org.\n        if (principalId !== resourceOrgId) {\n          throw new ForbiddenError(\n            `${reg.displayName} can only be shared with its own organization, not a different one.`,\n          );\n        }\n      }\n    }\n\n    const db = reg.getDb() as any;\n    const [existing] = await db\n      .select()\n      .from(reg.sharesTable)\n      .where(\n        and(\n          eq(reg.sharesTable.resourceId, args.resourceId),\n          eq(reg.sharesTable.principalType, args.principalType),\n          principalIdMatches(reg.sharesTable, args.principalType, principalId),\n        ),\n      );\n\n    if (existing) {\n      await db\n        .update(reg.sharesTable)\n        .set({ role: args.role })\n        .where(eq(reg.sharesTable.id, existing.id));\n      invalidateCollabAccessCache(args.resourceType, args.resourceId);\n      await notifyExtensionShareChanged(\n        args.resourceType,\n        args.resourceId,\n        beforeExtensionTargets,\n      );\n      return { id: existing.id, updated: true };\n    }\n\n    const id = nanoid();\n    await db.insert(reg.sharesTable).values({\n      id,\n      resourceId: args.resourceId,\n      principalType: args.principalType,\n      principalId,\n      role: args.role,\n      createdBy: actor,\n      createdAt: new Date().toISOString(),\n    });\n    invalidateCollabAccessCache(args.resourceType, args.resourceId);\n    await notifyExtensionShareChanged(\n      args.resourceType,\n      args.resourceId,\n      beforeExtensionTargets,\n    );\n\n    if (\n      args.notify !== false &&\n      args.principalType === \"user\" &&\n      (await isEmailConfigured()) &&\n      !isSyntheticQaEmail(principalId)\n    ) {\n      try {\n        const titleCol = reg.titleColumn ?? \"title\";\n        const [resource] = await db\n          .select()\n          .from(reg.resourceTable)\n          .where(eq(reg.resourceTable.id, args.resourceId));\n        const resourceTitle: string =\n          (resource?.[titleCol] as string | undefined) ?? args.resourceType;\n        const appUrl = getAppProductionUrl();\n        const resourcePath =\n          resource && reg.getResourcePath\n            ? reg.getResourcePath(resource)\n            : undefined;\n        const notificationUrl = resolveShareNotificationUrl(\n          args.resourceUrl,\n          resourcePath,\n          appUrl,\n        );\n        const appName =\n          process.env.APP_NAME || process.env.VITE_APP_NAME || \"Agent Native\";\n        const subject = `${actor} shared \"${resourceTitle}\" with you on ${appName}`;\n        const { html, text } = renderEmail({\n          preheader: subject,\n          heading: \"You've been given access\",\n          paragraphs: [\n            `${emailStrong(actor)} has shared the ${reg.displayName} ${emailStrong(resourceTitle)} with you as a ${emailStrong(args.role)}.`,\n            `Use the button below to open it. If prompted, sign in with ${emailStrong(principalId)}.`,\n          ],\n          cta: { label: `Open ${reg.displayName}`, url: notificationUrl },\n          footer: `You received this because ${actor} granted you ${args.role} access.`,\n        });\n        await sendEmail({ to: principalId, subject, html, text });\n      } catch (err) {\n        console.error(\n          \"[share-resource] failed to send share notification:\",\n          err,\n        );\n      }\n    }\n\n    return { id, updated: false };\n  },\n});\n"]}
+{"version":3,"file":"share-resource.js","sourceRoot":"","sources":["../../../src/sharing/actions/share-resource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrB,CAAC,MAAM,KAAK,cAAc;YACxB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;YACxB,MAAM,KAAK,iBAAiB;YAC5B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,cAAc,GAAG,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACnD,MAAM,mBAAmB,GACvB,QAAQ,IAAI,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,mBAAmB;gBAChC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE;gBACzB,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC;YAC3C,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,WAA+B,EAC/B,YAAgC,EAChC,MAAM,GAAG,mBAAmB,EAAE;IAE9B,KAAK,MAAM,SAAS,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,MAAM,GAAG,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,IAAI,GAAG,EAAE;IACvB,MAAM,KAAK,GACT,gEAAgE,CAAC;IACnE,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,oBAAoB,CAC3B,aAA6B,EAC7B,WAAmB;IAEnB,OAAO,aAAa,KAAK,MAAM;QAC7B,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,kBAAkB,CACzB,WAAgB,EAChB,aAA6B,EAC7B,WAAmB;IAEnB,OAAO,aAAa,KAAK,MAAM;QAC7B,CAAC,CAAC,GAAG,CAAA,SAAS,WAAW,CAAC,WAAW,OAAO,WAAW,EAAE;QACzD,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,oBAAoB,CACjC,KAAa,EACb,KAAa;IAEb,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,yEAAyE;QAC9E,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACnC,GAAG,EAAE,oGAAoG;QACzG,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,mFAAmF;IACrF,sEAAsE;IACtE,qEAAqE;IACrE,gEAAgE;IAChE,sDAAsD;IACtD,YAAY,EAAE,KAAK;IACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,CAAC,oDAAoD,CAAC;QACjE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAC/D,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;aACrB,QAAQ,CAAC,2DAA2D,CAAC;QACxE,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,CAAC,gDAAgD,CAAC;QAC7D,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;aACnC,OAAO,CAAC,QAAQ,CAAC;aACjB,QAAQ,CAAC,gBAAgB,CAAC;QAC7B,MAAM,EAAE,CAAC;aACN,OAAO,EAAE;aACT,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,2EAA2E,CAC5E;QACH,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,gGAAgG,CACjG;KACJ,CAAC;IACF,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAClB,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,OAAO,CACR,CAAC;QACF,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,cAAc,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,WAAW,CACjB,CAAC;QACF,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,sBAAsB,GAAG,MAAM,8BAA8B,CACjE,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,CAChB,CAAC;QAEF,IAAI,GAAG,CAAC,6BAA6B,EAAE,CAAC;YACtC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAkC,CAAC;YAC1E,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,wFAAwF,CAC3G,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;gBAClC,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;gBAClE,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,IAAI,cAAc,CACtB,GAAG,WAAW,kFAAkF,CACjG,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;gBACxC,8DAA8D;gBAC9D,gEAAgE;gBAChE,6DAA6D;gBAC7D,8CAA8C;gBAC9C,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;oBAClC,MAAM,IAAI,cAAc,CACtB,GAAG,GAAG,CAAC,WAAW,qEAAqE,CACxF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAS,CAAC;QAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC;aACrB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,EAC/C,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,EACrD,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CACrE,CACF,CAAC;QAEJ,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,EAAE;iBACL,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;iBACvB,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;iBACxB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC9C,2BAA2B,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAChE,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC;YACtC,EAAE;YACF,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,WAAW;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;QACH,2BAA2B,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,2BAA2B,CAC/B,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,UAAU,EACf,sBAAsB,CACvB,CAAC;QAEF,IACE,IAAI,CAAC,MAAM,KAAK,KAAK;YACrB,IAAI,CAAC,aAAa,KAAK,MAAM;YAC7B,CAAC,MAAM,iBAAiB,EAAE,CAAC;YAC3B,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAChC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC;gBAC5C,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;qBACxB,MAAM,EAAE;qBACR,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;qBACvB,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;gBACpD,MAAM,aAAa,GAChB,QAAQ,EAAE,CAAC,QAAQ,CAAwB,IAAI,IAAI,CAAC,YAAY,CAAC;gBACpE,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;gBACrC,MAAM,YAAY,GAChB,QAAQ,IAAI,GAAG,CAAC,eAAe;oBAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,CAAC;oBAC/B,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,eAAe,GAAG,2BAA2B,CACjD,IAAI,CAAC,WAAW,EAChB,YAAY,EACZ,MAAM,CACP,CAAC;gBACF,MAAM,OAAO,GACX,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,cAAc,CAAC;gBACtE,MAAM,OAAO,GAAG,GAAG,KAAK,YAAY,aAAa,iBAAiB,OAAO,EAAE,CAAC;gBAC5E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC;oBACjC,SAAS,EAAE,OAAO;oBAClB,OAAO,EAAE,0BAA0B;oBACnC,UAAU,EAAE;wBACV,GAAG,WAAW,CAAC,KAAK,CAAC,mBAAmB,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,aAAa,CAAC,kBAAkB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBAChI,8DAA8D,WAAW,CAAC,WAAW,CAAC,GAAG;qBAC1F;oBACD,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;oBAC/D,MAAM,EAAE,6BAA6B,KAAK,gBAAgB,IAAI,CAAC,IAAI,UAAU;iBAC9E,CAAC,CAAC;gBACH,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,qDAAqD,EACrD,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAChC,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { and, eq, sql, type SQL } from \"drizzle-orm\";\nimport { z } from \"zod\";\n\nimport { defineAction } from \"../../action.js\";\nimport { getDbExec } from \"../../db/client.js\";\nimport { getAppProductionUrl } from \"../../server/app-url.js\";\nimport { renderEmail, emailStrong } from \"../../server/email-template.js\";\nimport { sendEmail, isEmailConfigured } from \"../../server/email.js\";\nimport { invalidateCollabAccessCache } from \"../../server/poll.js\";\nimport { getRequestUserEmail } from \"../../server/request-context.js\";\nimport { assertAccess, ForbiddenError } from \"../access.js\";\nimport { requireShareableResource } from \"../registry.js\";\nimport {\n  getExtensionShareChangeTargets,\n  notifyExtensionShareChanged,\n} from \"./extension-change.js\";\n\nexport function isSyntheticQaEmail(email: string): boolean {\n  const trimmed = email.trim().toLowerCase();\n  const at = trimmed.lastIndexOf(\"@\");\n  if (at <= 0) return false;\n  const local = trimmed.slice(0, at);\n  const domain = trimmed.slice(at + 1);\n  return (\n    local.includes(\"+qa\") &&\n    (domain === \"example.test\" ||\n      domain.endsWith(\".test\") ||\n      domain === \"example.invalid\" ||\n      domain.endsWith(\".invalid\"))\n  );\n}\n\nfunction appPath(path: string): string {\n  if (!path.startsWith(\"/\")) return path;\n  const raw = process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH || \"\";\n  const base = raw.trim().replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  if (!base) return path;\n  const normalizedBase = `/${base}`;\n  if (path === normalizedBase || path.startsWith(`${normalizedBase}/`)) {\n    return path;\n  }\n  return `${normalizedBase}${path}`;\n}\n\nfunction safeNotificationUrl(value: string, appUrl: string): string | null {\n  const trimmed = value.trim();\n  if (!trimmed) return null;\n\n  try {\n    const base = new URL(appUrl);\n    if (trimmed.startsWith(\"/\")) {\n      const path = appPath(trimmed);\n      const basePath = base.pathname.replace(/\\/+$/, \"\");\n      const alreadyIncludesBase =\n        basePath && basePath !== \"/\" && path.startsWith(`${basePath}/`);\n      const joined = alreadyIncludesBase\n        ? `${base.origin}${path}`\n        : `${appUrl.replace(/\\/+$/, \"\")}${path}`;\n      return new URL(joined).toString();\n    }\n\n    const url = new URL(trimmed);\n    if (![\"http:\", \"https:\"].includes(url.protocol)) return null;\n    if (url.origin !== base.origin) return null;\n    return url.toString();\n  } catch {\n    return null;\n  }\n}\n\nexport function resolveShareNotificationUrl(\n  explicitUrl: string | undefined,\n  fallbackPath: string | undefined,\n  appUrl = getAppProductionUrl(),\n): string {\n  for (const candidate of [explicitUrl, fallbackPath]) {\n    if (!candidate) continue;\n    const url = safeNotificationUrl(candidate, appUrl);\n    if (url) return url;\n  }\n  return appUrl;\n}\n\nfunction nanoid(size = 12): string {\n  const chars =\n    \"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz\";\n  let id = \"\";\n  const bytes = crypto.getRandomValues(new Uint8Array(size));\n  for (const byte of bytes) id += chars[byte % chars.length];\n  return id;\n}\n\nfunction normalizePrincipalId(\n  principalType: \"user\" | \"org\",\n  principalId: string,\n): string {\n  return principalType === \"user\"\n    ? principalId.trim().toLowerCase()\n    : principalId;\n}\n\nfunction isEmailPrincipalId(value: string): boolean {\n  return /^[^\\s@]+@[^\\s@]+$/.test(value.trim());\n}\n\nfunction principalIdMatches(\n  sharesTable: any,\n  principalType: \"user\" | \"org\",\n  principalId: string,\n): SQL {\n  return principalType === \"user\"\n    ? sql`lower(${sharesTable.principalId}) = ${principalId}`\n    : eq(sharesTable.principalId, principalId);\n}\n\n/**\n * Returns true if the given email is either an active member of `orgId` or\n * has a pending invitation to `orgId`. Used by resources whose registration\n * sets `requireOrgMemberForUserShares` (currently extensions) to refuse\n * cross-org user shares.\n *\n * Both `org_members` and `org_invitations` store email case-insensitively\n * via `LOWER()` in the rest of the framework, so we follow the same\n * convention here.\n */\nasync function isOrgMemberOrInvited(\n  orgId: string,\n  email: string,\n): Promise<boolean> {\n  const lower = email.trim().toLowerCase();\n  if (!lower || !orgId) return false;\n  const client = getDbExec();\n  const member = await client.execute({\n    sql: `SELECT 1 FROM org_members WHERE org_id = ? AND LOWER(email) = ? LIMIT 1`,\n    args: [orgId, lower],\n  });\n  if (member.rows.length > 0) return true;\n  const invited = await client.execute({\n    sql: `SELECT 1 FROM org_invitations WHERE org_id = ? AND LOWER(email) = ? AND status = 'pending' LIMIT 1`,\n    args: [orgId, lower],\n  });\n  return invited.rows.length > 0;\n}\n\nexport default defineAction({\n  description:\n    \"Grant a user or org access to a shareable resource. Owner or admin role required.\",\n  // (audit H5) Sharing-grant operations are admin-tier and let a caller\n  // expand who can read/write a resource. Refuse from the tools iframe\n  // bridge so a malicious shared tool can't silently re-share its\n  // viewer's resources to an attacker-controlled email.\n  toolCallable: false,\n  schema: z.object({\n    resourceType: z\n      .string()\n      .describe(\"Registered resource type, e.g. 'document', 'form'.\"),\n    resourceId: z.string().describe(\"Id of the resource to share.\"),\n    principalType: z\n      .enum([\"user\", \"org\"])\n      .describe(\"'user' for an individual, 'org' for a whole organization.\"),\n    principalId: z\n      .string()\n      .describe(\"Email (user) or org id (org) of the principal.\"),\n    role: z\n      .enum([\"viewer\", \"editor\", \"admin\"])\n      .default(\"viewer\")\n      .describe(\"Role to grant.\"),\n    notify: z\n      .boolean()\n      .default(true)\n      .describe(\n        \"Whether to email the user about a new individual share. Defaults to true.\",\n      ),\n    resourceUrl: z\n      .string()\n      .optional()\n      .describe(\n        \"Optional app-relative or same-origin URL recipients should open. External origins are ignored.\",\n      ),\n  }),\n  run: async (args) => {\n    const reg = requireShareableResource(args.resourceType);\n    const access = await assertAccess(\n      args.resourceType,\n      args.resourceId,\n      \"admin\",\n    );\n    const actor = getRequestUserEmail();\n    if (!actor) throw new ForbiddenError(\"Not signed in\");\n    const principalId = normalizePrincipalId(\n      args.principalType,\n      args.principalId,\n    );\n    if (args.principalType === \"user\" && !isEmailPrincipalId(principalId)) {\n      throw new Error(\n        \"User shares must use an email address, not an internal user id.\",\n      );\n    }\n    const beforeExtensionTargets = await getExtensionShareChangeTargets(\n      args.resourceType,\n      args.resourceId,\n    );\n\n    if (reg.requireOrgMemberForUserShares) {\n      const resourceOrgId = access.resource?.orgId as string | undefined | null;\n      if (!resourceOrgId) {\n        throw new ForbiddenError(\n          `${reg.displayName} can only be shared from within an organization. Create or join an organization first.`,\n        );\n      }\n      if (args.principalType === \"user\") {\n        const ok = await isOrgMemberOrInvited(resourceOrgId, principalId);\n        if (!ok) {\n          throw new ForbiddenError(\n            `${principalId} is not in your organization. Invite them to the organization first, then share.`,\n          );\n        }\n      } else if (args.principalType === \"org\") {\n        // Cross-org org shares would let an outside org's members run\n        // extension code in the viewer's auth context — the same threat\n        // model that blocks public + cross-org user shares. Pin org-\n        // principal shares to the resource's own org.\n        if (principalId !== resourceOrgId) {\n          throw new ForbiddenError(\n            `${reg.displayName} can only be shared with its own organization, not a different one.`,\n          );\n        }\n      }\n    }\n\n    const db = reg.getDb() as any;\n    const [existing] = await db\n      .select()\n      .from(reg.sharesTable)\n      .where(\n        and(\n          eq(reg.sharesTable.resourceId, args.resourceId),\n          eq(reg.sharesTable.principalType, args.principalType),\n          principalIdMatches(reg.sharesTable, args.principalType, principalId),\n        ),\n      );\n\n    if (existing) {\n      await db\n        .update(reg.sharesTable)\n        .set({ role: args.role })\n        .where(eq(reg.sharesTable.id, existing.id));\n      invalidateCollabAccessCache(args.resourceType, args.resourceId);\n      await notifyExtensionShareChanged(\n        args.resourceType,\n        args.resourceId,\n        beforeExtensionTargets,\n      );\n      return { id: existing.id, updated: true };\n    }\n\n    const id = nanoid();\n    await db.insert(reg.sharesTable).values({\n      id,\n      resourceId: args.resourceId,\n      principalType: args.principalType,\n      principalId,\n      role: args.role,\n      createdBy: actor,\n      createdAt: new Date().toISOString(),\n    });\n    invalidateCollabAccessCache(args.resourceType, args.resourceId);\n    await notifyExtensionShareChanged(\n      args.resourceType,\n      args.resourceId,\n      beforeExtensionTargets,\n    );\n\n    if (\n      args.notify !== false &&\n      args.principalType === \"user\" &&\n      (await isEmailConfigured()) &&\n      !isSyntheticQaEmail(principalId)\n    ) {\n      try {\n        const titleCol = reg.titleColumn ?? \"title\";\n        const [resource] = await db\n          .select()\n          .from(reg.resourceTable)\n          .where(eq(reg.resourceTable.id, args.resourceId));\n        const resourceTitle: string =\n          (resource?.[titleCol] as string | undefined) ?? args.resourceType;\n        const appUrl = getAppProductionUrl();\n        const resourcePath =\n          resource && reg.getResourcePath\n            ? reg.getResourcePath(resource)\n            : undefined;\n        const notificationUrl = resolveShareNotificationUrl(\n          args.resourceUrl,\n          resourcePath,\n          appUrl,\n        );\n        const appName =\n          process.env.APP_NAME || process.env.VITE_APP_NAME || \"Agent Native\";\n        const subject = `${actor} shared \"${resourceTitle}\" with you on ${appName}`;\n        const { html, text } = renderEmail({\n          preheader: subject,\n          heading: \"You've been given access\",\n          paragraphs: [\n            `${emailStrong(actor)} has shared the ${reg.displayName} ${emailStrong(resourceTitle)} with you as a ${emailStrong(args.role)}.`,\n            `Use the button below to open it. If prompted, sign in with ${emailStrong(principalId)}.`,\n          ],\n          cta: { label: `Open ${reg.displayName}`, url: notificationUrl },\n          footer: `You received this because ${actor} granted you ${args.role} access.`,\n        });\n        await sendEmail({ to: principalId, subject, html, text });\n      } catch (err) {\n        console.error(\n          \"[share-resource] failed to send share notification:\",\n          err,\n        );\n      }\n    }\n\n    return { id, updated: false };\n  },\n});\n"]}

package/dist/templates/workspace-core/.agents/skills/agent-native-toolkit/SKILL.md

@@ -40,8 +40,10 @@ in the moment of agent use.
 
 ## Reusable Kits
 
-- **Settings kit**: account, workspace, AI models, LLM keys, connections,
-  secrets, usage, notifications, changelog, and app-specific panels.
+- **Settings kit**: a searchable settings page with account, workspace, AI
+  models, LLM keys, connections, secrets, usage, notifications, changelog, and
+  app-specific panels. Search is on by default; register a `SettingsSearchEntry`
+  per control so users find settings by name across tabs.
 - **Collaboration kit**: Yjs docs, presence, agent presence, live cursors,
   remote selections, recent edit highlights, real-time sync indicators, and
   undo/redo grouping.

package/dist/templates/workspace-core/.agents/skills/changelog/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 Every template app keeps a `CHANGELOG.md` of **user-facing** changes that
 renders in-app via the command menu (Cmd+K → "What's new") and on the settings
 page. The flow mirrors changesets so it survives many agents working in
-parallel: each change drops a small **pending entry file**, and a later
-**release** rolls all pending files into a dated `CHANGELOG.md` section.
+parallel: each change drops a small **pending entry file**, the in-app surface
+reads pending files plus `CHANGELOG.md`, and a later **release** can roll those
+pending files into dated `CHANGELOG.md` sections.
 
 ## When to add an entry
 
@@ -69,9 +70,10 @@ agent-native changelog release            # uses today's date
 agent-native changelog list               # preview pending + released
 ```
 
-Releasing is usually done at deploy/merge time. The in-app surface reads
-`CHANGELOG.md`, so only released entries are visible to users — pending entries
-stay invisible until rolled up.
+Releasing is usually done at deploy/merge time to keep the source tree tidy.
+The in-app surface imports `CHANGELOG.md?raw`, and the core Vite plugin merges
+adjacent `changelog/*.md` pending entries into that raw markdown at dev/build
+time, so product notes become visible without waiting for a manual rollup.
 
 ## Wiring the in-app surface (once per template)
 
@@ -108,4 +110,5 @@ host with no server route or runtime file access.
 - [ ] Shipped a user-visible change? Run `agent-native changelog add "…"`.
 - [ ] New template UI? Pass `changelog` to its `CommandMenu` and seed a
       `CHANGELOG.md`.
-- [ ] Releasing/deploying? `agent-native changelog release` rolls pending → dated.
+- [ ] Releasing/deploying? Optional: `agent-native changelog release` rolls
+      pending → dated sections and deletes the pending files.

package/dist/vite/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/vite/client.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAa,MAAM,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAiB1D,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,kCAAkC,CAAC;AAuY1C;;;;;GAKG;AACH,iBAAS,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAgE9C;AAED;;;;;;GAMG;AACH,iBAAS,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkCvD;AAOD;;;;;GAKG;AACH,iBAAS,qBAAqB,CAC5B,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAc9C;AAwCD,iBAAS,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAuNrD;AAyKD,MAAM,WAAW,YAAY;IAC3B,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,YAAY,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9E,oGAAoG;IACpG,QAAQ,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,8BAA8B;IAC9B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iDAAiD;IACjD,YAAY,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACvD,wCAAwC;IACxC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,iCAAiC,CAAC;IAChD;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,0BAA0B,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,4BAA6B,SAAQ,IAAI,CACxD,mBAAmB,EACnB,SAAS,GAAG,aAAa,CAC1B;IACC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAkiBD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAWT;AAiwBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CACzB,OAAO,GAAE,4BAAiC,GACzC,MAAM,EAAE,CAcV;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,UAAU,CAU1E;AAED,OAAO,EACL,eAAe,IAAI,gBAAgB,EACnC,sBAAsB,IAAI,uBAAuB,EACjD,mBAAmB,IAAI,oBAAoB,EAC3C,qBAAqB,IAAI,sBAAsB,GAChD,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/vite/client.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAa,MAAM,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAqB1D,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,kCAAkC,CAAC;AA0X1C;;;;;GAKG;AACH,iBAAS,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAgE9C;AAED;;;;;;GAMG;AACH,iBAAS,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkCvD;AAOD;;;;;GAKG;AACH,iBAAS,qBAAqB,CAC5B,GAAG,EAAE,MAAM,GACV,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAc9C;AAoDD,iBAAS,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CA2NrD;AAyKD,MAAM,WAAW,YAAY;IAC3B,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,YAAY,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9E,oGAAoG;IACpG,QAAQ,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,8BAA8B;IAC9B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iDAAiD;IACjD,YAAY,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACvD,wCAAwC;IACxC,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,iCAAiC,CAAC;IAChD;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,0BAA0B,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,4BAA6B,SAAQ,IAAI,CACxD,mBAAmB,EACnB,SAAS,GAAG,aAAa,CAC1B;IACC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAkiBD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAWT;AAg7BD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CACzB,OAAO,GAAE,4BAAiC,GACzC,MAAM,EAAE,CAcV;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,UAAU,CAU1E;AAED,OAAO,EACL,eAAe,IAAI,gBAAgB,EACnC,sBAAsB,IAAI,uBAAuB,EACjD,mBAAmB,IAAI,oBAAoB,EAC3C,qBAAqB,IAAI,sBAAsB,GAChD,CAAC"}

package/dist/vite/client.js

@@ -3,6 +3,7 @@ import fs from "fs";
 import { createRequire, syncBuiltinESMExports } from "module";
 import path from "path";
 import { fileURLToPath } from "url";
+import { mergePendingChangelog, parsePendingEntry, } from "../changelog/parse.js";
 import { getViteDevRecoveryScript } from "../client/vite-dev-recovery-script.js";
 import { findWorkspaceRoot } from "../scripts/utils.js";
 import { verifyEmbedSessionToken } from "../server/embed-session.js";
@@ -255,9 +256,7 @@ function findWorkspaceCoreSync(startDir) {
     }
     return null;
 }
-function findLocalWorkspacePackageDeps(startDir, workspaceRoot) {
-    if (!workspaceRoot)
-        return [];
+function findLocalWorkspacePackageDeps(startDir, _workspaceRoot) {
     const pkgPath = path.join(startDir, "package.json");
     if (!fs.existsSync(pkgPath))
         return [];
@@ -268,22 +267,25 @@ function findLocalWorkspacePackageDeps(startDir, workspaceRoot) {
             ...(pkg.devDependencies ?? {}),
             ...(pkg.peerDependencies ?? {}),
         };
-        const req = createRequire(pkgPath);
         const seen = new Set();
         const packages = [];
         for (const [packageName, range] of Object.entries(deps)) {
-            if (!range.startsWith("workspace:"))
-                continue;
             if (seen.has(packageName))
                 continue;
             seen.add(packageName);
             try {
-                const packageJsonPath = findInstalledPackageJsonPath(pkgPath, packageName) ??
-                    findPackageJsonFromEntry(req.resolve(packageName));
+                let packageJsonPath = null;
+                if (range.startsWith("file:")) {
+                    packageJsonPath = findFilePackageJsonPath(pkgPath, range);
+                }
+                else {
+                    continue;
+                }
                 if (!packageJsonPath)
                     continue;
                 const packageDir = fs.realpathSync(path.dirname(packageJsonPath));
-                if (!packageDir.startsWith(path.join(workspaceRoot, "packages")))
+                const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf-8"));
+                if (packageJson?.name !== packageName)
                     continue;
                 packages.push({ packageName, packageDir });
             }
@@ -297,24 +299,13 @@ function findLocalWorkspacePackageDeps(startDir, workspaceRoot) {
         return [];
     }
 }
-function findInstalledPackageJsonPath(pkgPath, packageName) {
-    const candidate = path.join(path.dirname(pkgPath), "node_modules", ...packageName.split("/"), "package.json");
-    return fs.existsSync(candidate) ? candidate : null;
-}
-function findPackageJsonFromEntry(entryPath) {
-    let dir = fs.statSync(entryPath).isDirectory()
-        ? entryPath
-        : path.dirname(entryPath);
-    for (let i = 0; i < 20; i++) {
-        const candidate = path.join(dir, "package.json");
-        if (fs.existsSync(candidate))
-            return candidate;
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return null;
+function findFilePackageJsonPath(pkgPath, range) {
+    const spec = range.slice("file:".length);
+    const packageDir = spec.startsWith("//")
+        ? fileURLToPath(range)
+        : path.resolve(path.dirname(pkgPath), spec);
+    const packageJsonPath = path.join(packageDir, "package.json");
+    return fs.existsSync(packageJsonPath) ? packageJsonPath : null;
 }
 function findPnpmWorkspaceRoot(startDir) {
     let dir = path.resolve(startDir);
@@ -524,6 +515,17 @@ const CORE_CLIENT_SUBPATHS = [
     "@agent-native/core/client/transcription/use-live-transcription",
     "@agent-native/core/voice",
 ];
+const TOOLKIT_CLIENT_SUBPATHS = [
+    "@agent-native/toolkit",
+    "@agent-native/toolkit/app-shell",
+    "@agent-native/toolkit/collab-ui",
+    "@agent-native/toolkit/hooks",
+    "@agent-native/toolkit/onboarding",
+    "@agent-native/toolkit/provider",
+    "@agent-native/toolkit/sharing",
+    "@agent-native/toolkit/ui",
+    "@agent-native/toolkit/utils",
+];
 const NODE_SSR_NATIVE_EXTERNALS = ["better-sqlite3", "bindings"];
 function getDefaultOptimizeDeps(cwd) {
     const inMonorepo = findCoreSrcDir(cwd) !== null;
@@ -581,6 +583,10 @@ function getDefaultOptimizeDeps(cwd) {
                     specifier: "@agent-native/core/client/tools",
                     packageName: "@agent-native/core",
                 },
+                ...TOOLKIT_CLIENT_SUBPATHS.map((specifier) => ({
+                    specifier,
+                    packageName: "@agent-native/toolkit",
+                })),
             ]),
         { specifier: "@libsql/client" },
         { specifier: "@amplitude/analytics-browser" },
@@ -1471,6 +1477,119 @@ function ssrStubPlugin(packages) {
         },
     };
 }
+function splitViteRequest(id) {
+    const queryIndex = id.indexOf("?");
+    if (queryIndex === -1)
+        return null;
+    return {
+        file: id.slice(0, queryIndex),
+        query: id.slice(queryIndex + 1),
+    };
+}
+function hasRawQuery(query) {
+    return new URLSearchParams(query).has("raw");
+}
+function normalizeViteFilePath(file) {
+    if (!file || file.startsWith("\0"))
+        return null;
+    const fsPath = file.startsWith("/@fs/") ? file.slice("/@fs".length) : file;
+    try {
+        return decodeURI(fsPath);
+    }
+    catch {
+        return fsPath;
+    }
+}
+function changelogRawPathFromId(id) {
+    const request = splitViteRequest(id);
+    if (!request || !hasRawQuery(request.query))
+        return null;
+    const file = normalizeViteFilePath(request.file);
+    if (!file || path.basename(file) !== "CHANGELOG.md")
+        return null;
+    return path.resolve(file);
+}
+function resolveChangelogRawImport(source, importer) {
+    const request = splitViteRequest(source);
+    if (!request || !hasRawQuery(request.query))
+        return null;
+    const rawFile = normalizeViteFilePath(request.file);
+    if (!rawFile || path.basename(rawFile) !== "CHANGELOG.md")
+        return null;
+    const rawImporter = importer?.split("?")[0];
+    const importerFile = (rawImporter && normalizeViteFilePath(rawImporter)) ||
+        rawImporter ||
+        path.join(process.cwd(), "index.ts");
+    const resolved = path.isAbsolute(rawFile)
+        ? rawFile
+        : path.resolve(path.dirname(importerFile), rawFile);
+    return `${resolved}?${request.query}`;
+}
+function readAppChangelogMarkdown(changelogPath, watchFile) {
+    // Only ever register real files with Vite's `addWatchFile`. Passing a
+    // directory makes import-analysis try to resolve it as a module and fail
+    // with "Failed to resolve import .../changelog", which breaks hydration for
+    // every template in dev. New/removed pending files are still picked up via
+    // `handleHotUpdate` (Vite watches the project root recursively).
+    watchFile(changelogPath);
+    const existing = fs.existsSync(changelogPath)
+        ? fs.readFileSync(changelogPath, "utf-8")
+        : "";
+    const pendingDir = path.join(path.dirname(changelogPath), "changelog");
+    if (!fs.existsSync(pendingDir)) {
+        return existing;
+    }
+    const pending = fs
+        .readdirSync(pendingDir)
+        .filter((file) => file.endsWith(".md") && file.toLowerCase() !== "readme.md")
+        .sort()
+        .map((file) => {
+        const filePath = path.join(pendingDir, file);
+        watchFile(filePath);
+        return parsePendingEntry(fs.readFileSync(filePath, "utf-8"));
+    });
+    return mergePendingChangelog(existing, pending);
+}
+function isChangelogSourceFile(file) {
+    if (path.basename(file) === "CHANGELOG.md")
+        return true;
+    return (path.basename(path.dirname(file)) === "changelog" &&
+        file.endsWith(".md") &&
+        path.basename(file).toLowerCase() !== "readme.md");
+}
+function invalidateChangelogRawModules(server) {
+    const moduleGraph = server.moduleGraph;
+    if (!moduleGraph?.idToModuleMap || !moduleGraph.invalidateModule)
+        return;
+    for (const mod of moduleGraph.idToModuleMap.values()) {
+        if (!mod?.id || !changelogRawPathFromId(mod.id))
+            continue;
+        moduleGraph.invalidateModule(mod);
+    }
+}
+function appChangelogRawPlugin() {
+    return {
+        name: "agent-native-app-changelog-raw",
+        enforce: "pre",
+        resolveId(source, importer) {
+            return resolveChangelogRawImport(source, importer);
+        },
+        load(id) {
+            const changelogPath = changelogRawPathFromId(id);
+            if (!changelogPath)
+                return null;
+            const markdown = readAppChangelogMarkdown(changelogPath, (file) => this.addWatchFile(file));
+            return `export default ${JSON.stringify(markdown)};`;
+        },
+        handleHotUpdate(ctx) {
+            if (!isChangelogSourceFile(ctx.file))
+                return;
+            invalidateChangelogRawModules(ctx.server);
+            ctx.server.ws.send({ type: "full-reload" });
+            return [];
+        },
+    };
+}
 /**
  * Expose the resolved Vite dev server port as process.env.PORT so that
  * in-process scripts (which use localFetch → http://localhost:${PORT}/api/...)
@@ -1659,12 +1778,13 @@ function localWorkspacePackageAliases(packages) {
             if (!exportsMap || typeof exportsMap !== "object")
                 continue;
             for (const [exportPath, target] of Object.entries(exportsMap)) {
-                if (typeof target !== "string")
+                const exportTarget = localWorkspaceExportTarget(packageDir, target);
+                if (!exportTarget)
                     continue;
                 const importPath = exportPath === "."
                     ? packageName
                     : `${packageName}${exportPath.slice(1)}`;
-                const replacement = path.resolve(packageDir, target);
+                const replacement = path.resolve(packageDir, exportTarget);
                 if (importPath.includes("*") || replacement.includes("*")) {
                     aliases.push({
                         find: new RegExp(`^${escapeRegex(importPath).replace("\\*", "(.+)")}$`),
@@ -1684,6 +1804,48 @@ function localWorkspacePackageAliases(packages) {
     }
     return aliases;
 }
+function localWorkspaceExportTarget(packageDir, target) {
+    const rawTarget = pickLocalWorkspaceExportTarget(target);
+    if (!rawTarget)
+        return null;
+    return distExportToSourceTarget(packageDir, rawTarget);
+}
+function pickLocalWorkspaceExportTarget(target) {
+    if (typeof target === "string")
+        return target;
+    if (!target || typeof target !== "object" || Array.isArray(target)) {
+        return null;
+    }
+    const record = target;
+    for (const condition of ["development", "browser", "import", "default"]) {
+        const resolved = pickLocalWorkspaceExportTarget(record[condition]);
+        if (resolved)
+            return resolved;
+    }
+    return null;
+}
+function distExportToSourceTarget(packageDir, target) {
+    if (!target.startsWith("./dist/"))
+        return target;
+    if (target.includes("*")) {
+        return target
+            .replace("./dist/", "./src/")
+            .replace(/\.d\.ts$/, "")
+            .replace(/\.js$/, "");
+    }
+    const sourceBase = target
+        .replace("./dist/", "./src/")
+        .replace(/\.d\.ts$/, "")
+        .replace(/\.js$/, "");
+    const candidates = target.endsWith(".css")
+        ? [sourceBase]
+        : [`${sourceBase}.tsx`, `${sourceBase}.ts`, sourceBase];
+    for (const candidate of candidates) {
+        if (fs.existsSync(path.resolve(packageDir, candidate)))
+            return candidate;
+    }
+    return target;
+}
 function aliasArrayFrom(alias) {
     if (!alias)
         return [];
@@ -1701,7 +1863,6 @@ const DEFAULT_VITE_WATCH_IGNORES = [
     "**/.generated/**",
     "**/.agents/**",
     "**/.claude/**",
-    "**/changelog/**",
     "**/data/**",
     "**/dist/**",
     "**/build/**",
@@ -1722,6 +1883,7 @@ function createAgentNativePlugins(options, { command, includeReactTransform, use
         // the server, so we can't blanket-stub it here).
         ssrStubPlugin(options.ssrStubs ?? []),
         ...userPlugins,
+        appChangelogRawPlugin(),
         actionTypesPlugin(),
         agentsBundlePlugin(),
         autoReloadOnOptimizeDep(),