@agent-native/core 0.178.0-nightly-20260909183543 → 0.178.0

package/dist/org/federation.js

@@ -17,9 +17,8 @@ const MAX_FEDERATION_ROSTER_MEMBERS = 10_000;
 const LOCALHOST_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
 function requestEventFromContext() {
     const requestOrigin = getRequestContext()?.requestOrigin;
-    if (!requestOrigin) {
-        throw new Error("Federated membership validation requires a request origin.");
-    }
+    if (!requestOrigin)
+        return undefined;
     let url;
     try {
         url = new URL(requestOrigin);
@@ -295,7 +294,7 @@ export async function validateFederatedOrganizationMembership(event, input) {
     if (!identityAuthority || !ORG_ID_PATTERN.test(identityId)) {
         throw new Error("Organization has an invalid identity mapping.");
     }
-    const currentOrigin = normalizeAuthority(getOrigin(event));
+    const currentOrigin = event ? normalizeAuthority(getOrigin(event)) : null;
     if (currentOrigin === identityAuthority) {
         return { active: true, role: localRole };
     }
@@ -306,6 +305,9 @@ export async function validateFederatedOrganizationMembership(event, input) {
     if (rollout === "unavailable") {
         throw new Error("Cross-app organization federation rollout is unavailable.");
     }
+    if (!event) {
+        throw new Error("Federated membership validation requires a request origin.");
+    }
     const hub = resolveIdentityHubUrl(event);
     const authority = normalizeAuthority(hub ?? "");
     if (!authority || authority !== identityAuthority) {

package/dist/org/index.d.ts

@@ -8,7 +8,8 @@ export { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
 export type { AutoJoinDomainResult } from "./auto-join-domain.js";
 export { setActiveOrgId } from "./active-org.js";
 export { invalidateMemberOrgCaches } from "./request-org-cache.js";
-export { isWorkspaceAppAccessAllowed } from "./workspace-app-access.js";
+export { isMissingOrganizationTableError } from "./membership.js";
+export { isStandaloneDispatchRuntime, isWorkspaceAppAccessAllowed, } from "./workspace-app-access.js";
 export { defineAppRoles, getRegisteredAppRoles, listRegisteredAppRoles, listAppMemberRoles, resolveAppRole, setAppMemberRole, } from "./app-roles.js";
 export type { AppRoles, AppRolesDescriptor, AppRoleCaller, AppRoleLookup, AppMemberRoleRow, } from "./app-roles.js";
 export { ORG_MIGRATIONS } from "./migrations.js";

package/dist/org/index.js

@@ -6,7 +6,8 @@ export { acceptPendingInvitationsForEmail } from "./accept-pending.js";
 export { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
 export { setActiveOrgId } from "./active-org.js";
 export { invalidateMemberOrgCaches } from "./request-org-cache.js";
-export { isWorkspaceAppAccessAllowed } from "./workspace-app-access.js";
+export { isMissingOrganizationTableError } from "./membership.js";
+export { isStandaloneDispatchRuntime, isWorkspaceAppAccessAllowed, } from "./workspace-app-access.js";
 export { defineAppRoles, getRegisteredAppRoles, listRegisteredAppRoles, listAppMemberRoles, resolveAppRole, setAppMemberRole, } from "./app-roles.js";
 export { ORG_MIGRATIONS } from "./migrations.js";
 export { CROSS_APP_ORG_FEDERATION_FLAG, CROSS_APP_ORG_FEDERATION_SCOPE, } from "./feature-flags.js";

package/dist/org/membership.js

@@ -10,7 +10,7 @@ export function isMissingOrganizationTableError(error) {
         seen.add(current);
         const candidate = current;
         const message = String(candidate.message ?? "");
-        if (/no such table:\s*["'`]?organizations["'`]?|relation\s+["'`]?organizations["'`]?\s+does not exist/i.test(message)) {
+        if (/no such table:\s*["'`]?(?:organizations|org_members)["'`]?|relation\s+["'`]?(?:organizations|org_members)["'`]?\s+does not exist/i.test(message)) {
             return true;
         }
         current = candidate.cause;

package/dist/org/workspace-app-access.d.ts

@@ -2,6 +2,7 @@ export interface WorkspaceAppAccessContext {
     email: string;
     orgId?: string | null;
 }
+export declare function isStandaloneDispatchRuntime(): boolean;
 /**
  * Enforce the workspace-app ACL before a hosted app's authenticated API
  * surface is reached. The app shell remains cacheable and anonymous; this

package/dist/org/workspace-app-access.js

@@ -1,7 +1,7 @@
 import { signA2AToken } from "../a2a/client.js";
 import { getAppConfig } from "../app-config/index.js";
 import { getDbExec } from "../db/client.js";
-import { resolveVercelDeploymentProtectionHeaders } from "../server/credential-provider.js";
+import { isHostedWorkspaceRuntime, resolveVercelDeploymentProtectionHeaders, } from "../server/credential-provider.js";
 import { workspaceUserGroupsIncludeUser } from "../workspace-connections/groups.js";
 import { getOrgA2ASecret, getOrgDomain } from "./context.js";
 import { isMissingOrganizationTableError } from "./membership.js";
@@ -10,6 +10,17 @@ const WORKSPACE_APP_ACCESS_TIMEOUT_MS = 2_500;
 function normalizedEmail(email) {
     return email.trim().toLowerCase();
 }
+export function isStandaloneDispatchRuntime() {
+    const app = getAppConfig().app;
+    const isDispatch = [
+        app.id,
+        app.legacyId,
+        app.template,
+        app.slug,
+        app.packageName,
+    ].some((value) => value?.trim().toLowerCase() === "dispatch");
+    return isDispatch && !isHostedWorkspaceRuntime();
+}
 function configuredWorkspaceDirectory() {
     const workspace = getAppConfig().workspace;
     return (workspace.orgDirectoryUrl?.trim() || workspace.gatewayUrl?.trim() || null);
@@ -120,6 +131,8 @@ async function loadWorkspaceOrgMember(db, orgId, email) {
     catch (error) {
         if (!isMissingOrganizationTableError(error))
             throw error;
+        if (!isStandaloneDispatchRuntime())
+            throw error;
         memberResult = await db.execute({
             sql: `SELECT role FROM org_members
             WHERE org_id = ? AND LOWER(email) = ?
@@ -149,18 +162,19 @@ async function isActiveWorkspaceOrgMember(member, orgId, email) {
 }
 async function isDispatchWorkspaceAppAccessAllowed(context, email) {
     const orgId = context.orgId?.trim() || null;
-    // Dispatch remains available in personal/no-org mode. Organization-scoped
-    // Dispatch is a private control plane for owners and admins.
     if (!orgId)
         return true;
     try {
         const member = await loadWorkspaceOrgMember(getDbExec(), orgId, email);
-        if (!member || !(await isActiveWorkspaceOrgMember(member, orgId, email))) {
-            return false;
-        }
-        return member.role === "owner" || member.role === "admin";
+        // Standalone Dispatch hosts can carry an org id before enabling the org
+        // schema. Preserve their authenticated-only access until that schema exists.
+        return Boolean(member && (await isActiveWorkspaceOrgMember(member, orgId, email)));
     }
     catch (error) {
+        if (isMissingOrganizationTableError(error) &&
+            isStandaloneDispatchRuntime()) {
+            return true;
+        }
         console.error("[workspace-app-access] Dispatch access check failed", error);
         return false;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.178.0-nightly-20260909183543",
+  "version": "0.178.0",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -445,8 +445,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.32",
     "zod": "^4.3.6",
-    "@agent-native/recap-cli": "0.5.27",
-    "@agent-native/toolkit": "^0.19.6-nightly-20260909183543"
+    "@agent-native/recap-cli": "0.5.28",
+    "@agent-native/toolkit": "^0.19.6"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",