@agent-native/dispatch 0.1.1

package/dist/server/plugins/core-routes.js

@@ -0,0 +1,6 @@
+import { createCoreRoutesPlugin } from "@agent-native/core/server";
+import { envKeys } from "../lib/env-config.js";
+export default createCoreRoutesPlugin({
+    envKeys,
+});
+//# sourceMappingURL=core-routes.js.map

package/dist/server/plugins/core-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-routes.js","sourceRoot":"","sources":["../../../src/server/plugins/core-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAE/C,eAAe,sBAAsB,CAAC;IACpC,OAAO;CACR,CAAC,CAAC","sourcesContent":["import { createCoreRoutesPlugin } from \"@agent-native/core/server\";\nimport { envKeys } from \"../lib/env-config.js\";\n\nexport default createCoreRoutesPlugin({\n  envKeys,\n});\n"]}

package/dist/server/plugins/db.d.ts

@@ -0,0 +1,3 @@
+declare const _default: (nitroApp: any) => void | Promise<void>;
+export default _default;
+//# sourceMappingURL=db.d.ts.map

package/dist/server/plugins/db.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/db.ts"],"names":[],"mappings":";AAGA,wBAEG"}

package/dist/server/plugins/db.js

@@ -0,0 +1,6 @@
+import { runMigrations } from "@agent-native/core/db";
+import { dispatchMigrations } from "../../db/migrations.js";
+export default runMigrations(dispatchMigrations, {
+    table: "dispatch_migrations",
+});
+//# sourceMappingURL=db.js.map

package/dist/server/plugins/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../src/server/plugins/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,eAAe,aAAa,CAAC,kBAAkB,EAAE;IAC/C,KAAK,EAAE,qBAAqB;CAC7B,CAAC,CAAC","sourcesContent":["import { runMigrations } from \"@agent-native/core/db\";\nimport { dispatchMigrations } from \"../../db/migrations.js\";\n\nexport default runMigrations(dispatchMigrations, {\n  table: \"dispatch_migrations\",\n});\n"]}

package/dist/server/plugins/integrations.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Defer plugin construction until the Nitro plugin actually fires so the
+ * config-aware system prompt resolves AFTER `setupDispatch(config)` has
+ * stamped the active config (plugin module load order is not guaranteed).
+ */
+declare const dispatchIntegrationsPlugin: (nitroApp: any) => Promise<void>;
+export default dispatchIntegrationsPlugin;
+//# sourceMappingURL=integrations.d.ts.map

package/dist/server/plugins/integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/integrations.ts"],"names":[],"mappings":"AA4BA;;;;GAIG;AACH,QAAA,MAAM,0BAA0B,GAAU,UAAU,GAAG,kBAuBtD,CAAC;AAEF,eAAe,0BAA0B,CAAC"}

package/dist/server/plugins/integrations.js

@@ -0,0 +1,51 @@
+import { createIntegrationsPlugin } from "@agent-native/core/server";
+import { beforeDispatchProcess, resolveDispatchOwner, } from "../lib/dispatch-integrations.js";
+import { getDispatchConfig } from "../index.js";
+import { dispatchActions } from "../../actions/index.js";
+const DISPATCH_INTEGRATION_SYSTEM_PROMPT = `You are the central dispatch for this workspace, responding via a messaging platform integration (Slack, Telegram, email, etc.).
+
+Default posture:
+- Treat Slack, Telegram, and email as shared entrypoints into the workspace.
+- Heavily delegate domain work to specialized agents through A2A (call-agent) when another app owns the job. Apps you can delegate to include slides (decks/presentations), analytics (data/dashboards), content (docs/articles), videos (Remotion compositions), forms (form builder), clips (screen recordings), and design (visual designs).
+- Use list-connected-agents to see what agents are available before assuming a request must be handled locally.
+- When asked whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. Without that probe, missing agent-card fields mean unchecked, not unavailable.
+- Keep durable memory and operating instructions in resources rather than ephemeral chat.
+- Reply in the originating thread unless the user explicitly asks you to send to a saved destination.
+
+When a user asks for something:
+- If it belongs to analytics, content, slides, videos, etc., delegate via call-agent — do not re-implement the domain logic in dispatch.
+- After call-agent returns an answer, RELAY IT DIRECTLY to the user with at most a one-line preface — do not rephrase, summarize, or add commentary. The downstream agent already crafted the answer; your job is delivery, not editing. This minimizes round-trips and keeps the user-visible reply fast.
+- Exception: if the downstream agent reports a missing model/provider credential, do not name exact env vars, Vault keys, tokens, or secrets. Say the target app needs an LLM connection and recommend connecting Builder/managed LLM for that app; keep bring-your-own provider keys as a secondary option only if the user asks.
+- If the user asks to create, build, make, scaffold, or generate a new workspace app or agent, call start-workspace-app-creation with their prompt. In this codebase, "agent" and "app" are synonyms — every agent-native app is an agent, so "build me an agent" and "build me an app" mean the same thing. Route both to start-workspace-app-creation. If the request is too vague to produce an app, ask one concise follow-up. If the action returns mode "builder", reply with the Builder branch URL. If it returns mode "local-agent", tell the user it is ready for the local code agent and include the returned app path/prompt summary. If it returns mode "coming-soon" or "builder-unavailable", explain the missing Builder setup and ask them to connect/configure Builder.
+- For digests, reminders, or saved behavior, prefer recurring jobs, resources, or destinations over chat replies.
+- Keep responses concise and operational — messaging platforms have character limits.
+- Use markdown sparingly (bold and lists are fine, avoid complex formatting).
+- If a task requires many steps, summarize what you did rather than streaming every detail.`;
+/**
+ * Defer plugin construction until the Nitro plugin actually fires so the
+ * config-aware system prompt resolves AFTER `setupDispatch(config)` has
+ * stamped the active config (plugin module load order is not guaranteed).
+ */
+const dispatchIntegrationsPlugin = async (nitroApp) => {
+    const { integrations = {} } = getDispatchConfig();
+    const promptOverride = integrations.systemPrompt;
+    const systemPrompt = typeof promptOverride === "string"
+        ? promptOverride
+        : typeof promptOverride === "function"
+            ? promptOverride(DISPATCH_INTEGRATION_SYSTEM_PROMPT)
+            : DISPATCH_INTEGRATION_SYSTEM_PROMPT;
+    const plugin = createIntegrationsPlugin({
+        appId: "dispatch",
+        actions: dispatchActions,
+        resolveOwner: resolveDispatchOwner,
+        beforeProcess: beforeDispatchProcess,
+        systemPrompt,
+        // Inherit the framework default (claude-sonnet-4-6 from
+        // packages/core/src/integrations/plugin.ts). Haiku was tried for latency
+        // but hallucinated URLs/IDs after delegated call-agent results
+        // (e.g. inventing `https://slides.workspace.com/deck/builder-io-deck-2024`).
+    });
+    return plugin(nitroApp);
+};
+export default dispatchIntegrationsPlugin;
+//# sourceMappingURL=integrations.js.map

package/dist/server/plugins/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../../src/server/plugins/integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,kCAAkC,GAAG;;;;;;;;;;;;;;;;;;4FAkBiD,CAAC;AAE7F;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,KAAK,EAAE,QAAa,EAAE,EAAE;IACzD,MAAM,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,CAAC;IACjD,MAAM,YAAY,GAChB,OAAO,cAAc,KAAK,QAAQ;QAChC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,OAAO,cAAc,KAAK,UAAU;YACpC,CAAC,CAAC,cAAc,CAAC,kCAAkC,CAAC;YACpD,CAAC,CAAC,kCAAkC,CAAC;IAE3C,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,eAAe;QACxB,YAAY,EAAE,oBAAoB;QAClC,aAAa,EAAE,qBAAqB;QACpC,YAAY;QACZ,wDAAwD;QACxD,yEAAyE;QACzE,+DAA+D;QAC/D,6EAA6E;KAC9E,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,eAAe,0BAA0B,CAAC","sourcesContent":["import { createIntegrationsPlugin } from \"@agent-native/core/server\";\nimport {\n  beforeDispatchProcess,\n  resolveDispatchOwner,\n} from \"../lib/dispatch-integrations.js\";\nimport { getDispatchConfig } from \"../index.js\";\nimport { dispatchActions } from \"../../actions/index.js\";\n\nconst DISPATCH_INTEGRATION_SYSTEM_PROMPT = `You are the central dispatch for this workspace, responding via a messaging platform integration (Slack, Telegram, email, etc.).\n\nDefault posture:\n- Treat Slack, Telegram, and email as shared entrypoints into the workspace.\n- Heavily delegate domain work to specialized agents through A2A (call-agent) when another app owns the job. Apps you can delegate to include slides (decks/presentations), analytics (data/dashboards), content (docs/articles), videos (Remotion compositions), forms (form builder), clips (screen recordings), and design (visual designs).\n- Use list-connected-agents to see what agents are available before assuming a request must be handled locally.\n- When asked whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. Without that probe, missing agent-card fields mean unchecked, not unavailable.\n- Keep durable memory and operating instructions in resources rather than ephemeral chat.\n- Reply in the originating thread unless the user explicitly asks you to send to a saved destination.\n\nWhen a user asks for something:\n- If it belongs to analytics, content, slides, videos, etc., delegate via call-agent — do not re-implement the domain logic in dispatch.\n- After call-agent returns an answer, RELAY IT DIRECTLY to the user with at most a one-line preface — do not rephrase, summarize, or add commentary. The downstream agent already crafted the answer; your job is delivery, not editing. This minimizes round-trips and keeps the user-visible reply fast.\n- Exception: if the downstream agent reports a missing model/provider credential, do not name exact env vars, Vault keys, tokens, or secrets. Say the target app needs an LLM connection and recommend connecting Builder/managed LLM for that app; keep bring-your-own provider keys as a secondary option only if the user asks.\n- If the user asks to create, build, make, scaffold, or generate a new workspace app or agent, call start-workspace-app-creation with their prompt. In this codebase, \"agent\" and \"app\" are synonyms — every agent-native app is an agent, so \"build me an agent\" and \"build me an app\" mean the same thing. Route both to start-workspace-app-creation. If the request is too vague to produce an app, ask one concise follow-up. If the action returns mode \"builder\", reply with the Builder branch URL. If it returns mode \"local-agent\", tell the user it is ready for the local code agent and include the returned app path/prompt summary. If it returns mode \"coming-soon\" or \"builder-unavailable\", explain the missing Builder setup and ask them to connect/configure Builder.\n- For digests, reminders, or saved behavior, prefer recurring jobs, resources, or destinations over chat replies.\n- Keep responses concise and operational — messaging platforms have character limits.\n- Use markdown sparingly (bold and lists are fine, avoid complex formatting).\n- If a task requires many steps, summarize what you did rather than streaming every detail.`;\n\n/**\n * Defer plugin construction until the Nitro plugin actually fires so the\n * config-aware system prompt resolves AFTER `setupDispatch(config)` has\n * stamped the active config (plugin module load order is not guaranteed).\n */\nconst dispatchIntegrationsPlugin = async (nitroApp: any) => {\n  const { integrations = {} } = getDispatchConfig();\n  const promptOverride = integrations.systemPrompt;\n  const systemPrompt =\n    typeof promptOverride === \"string\"\n      ? promptOverride\n      : typeof promptOverride === \"function\"\n        ? promptOverride(DISPATCH_INTEGRATION_SYSTEM_PROMPT)\n        : DISPATCH_INTEGRATION_SYSTEM_PROMPT;\n\n  const plugin = createIntegrationsPlugin({\n    appId: \"dispatch\",\n    actions: dispatchActions,\n    resolveOwner: resolveDispatchOwner,\n    beforeProcess: beforeDispatchProcess,\n    systemPrompt,\n    // Inherit the framework default (claude-sonnet-4-6 from\n    // packages/core/src/integrations/plugin.ts). Haiku was tried for latency\n    // but hallucinated URLs/IDs after delegated call-agent results\n    // (e.g. inventing `https://slides.workspace.com/deck/builder-io-deck-2024`).\n  });\n\n  return plugin(nitroApp);\n};\n\nexport default dispatchIntegrationsPlugin;\n"]}

package/package.json

@@ -0,0 +1,103 @@
+{
+  "name": "@agent-native/dispatch",
+  "version": "0.1.1",
+  "type": "module",
+  "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/BuilderIO/agent-native",
+    "directory": "packages/dispatch"
+  },
+  "bugs": {
+    "url": "https://github.com/BuilderIO/agent-native/issues"
+  },
+  "homepage": "https://github.com/BuilderIO/agent-native#readme",
+  "exports": {
+    ".": "./dist/index.js",
+    "./routes": "./dist/routes/index.js",
+    "./routes/pages/*": "./dist/routes/pages/*.js",
+    "./server": "./dist/server/index.js",
+    "./actions": "./dist/actions/index.js",
+    "./db": "./dist/db/index.js",
+    "./components": "./dist/components/index.js"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "peerDependencies": {
+    "@agent-native/core": ">=0.7.82",
+    "react": ">=18",
+    "react-dom": ">=18",
+    "react-router": ">=7"
+  },
+  "dependencies": {
+    "@radix-ui/react-accordion": "^1.2.12",
+    "@radix-ui/react-alert-dialog": "^1.1.15",
+    "@radix-ui/react-aspect-ratio": "^1.1.8",
+    "@radix-ui/react-avatar": "^1.1.11",
+    "@radix-ui/react-checkbox": "^1.3.2",
+    "@radix-ui/react-collapsible": "^1.1.12",
+    "@radix-ui/react-context-menu": "^2.2.16",
+    "@radix-ui/react-dialog": "^1.1.14",
+    "@radix-ui/react-dropdown-menu": "^2.1.15",
+    "@radix-ui/react-hover-card": "^1.1.15",
+    "@radix-ui/react-label": "^2.1.7",
+    "@radix-ui/react-menubar": "^1.1.16",
+    "@radix-ui/react-navigation-menu": "^1.2.14",
+    "@radix-ui/react-popover": "^1.1.14",
+    "@radix-ui/react-progress": "^1.1.8",
+    "@radix-ui/react-radio-group": "^1.3.7",
+    "@radix-ui/react-scroll-area": "^1.2.9",
+    "@radix-ui/react-select": "^2.2.5",
+    "@radix-ui/react-separator": "^1.1.7",
+    "@radix-ui/react-slider": "^1.3.5",
+    "@radix-ui/react-slot": "^1.2.3",
+    "@radix-ui/react-switch": "^1.2.5",
+    "@radix-ui/react-tabs": "^1.1.12",
+    "@radix-ui/react-toast": "^1.2.15",
+    "@radix-ui/react-toggle": "^1.1.10",
+    "@radix-ui/react-toggle-group": "^1.1.11",
+    "@radix-ui/react-tooltip": "^1.2.7",
+    "@tabler/icons-react": "^3.40.0",
+    "@tanstack/react-query": "^5.99.2",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "cmdk": "^1.1.1",
+    "drizzle-orm": "^0.45.2",
+    "embla-carousel-react": "^8.6.0",
+    "h3": "^2.0.1-rc.20",
+    "input-otp": "^1.4.2",
+    "lucide-react": "^1.8.0",
+    "next-themes": "^0.4.6",
+    "react-day-picker": "^9.14.0",
+    "react-hook-form": "^7.71.2",
+    "react-resizable-panels": "^4.10.0",
+    "recharts": "^3.8.1",
+    "sonner": "^2.0.7",
+    "tailwind-merge": "^3.5.0",
+    "vaul": "^1.1.2",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@react-router/dev": "^7.13.1",
+    "@types/node": "^24.2.1",
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
+    "react": "^19.2.5",
+    "react-dom": "^19.2.5",
+    "react-router": "^7.13.1",
+    "tsc-alias": "^1.8.10",
+    "typescript": "^6.0.3",
+    "vite": "8.0.3",
+    "vitest": "^4.1.5",
+    "@agent-native/core": "0.7.83"
+  },
+  "scripts": {
+    "build": "tsc && tsc-alias",
+    "dev": "tsc --watch & tsc-alias --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest --run src --passWithNoTests"
+  }
+}

package/src/actions/approve-dispatch-change.ts

@@ -0,0 +1,11 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { approveRequest } from "../server/lib/dispatch-store.js";
+
+export default defineAction({
+  description: "Approve a pending dispatch change request and apply it.",
+  schema: z.object({
+    id: z.string().describe("Approval request id"),
+  }),
+  run: async ({ id }) => approveRequest(id),
+});

package/src/actions/approve-vault-request.ts

@@ -0,0 +1,23 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { approveRequest, requireVaultCtx } from "../server/lib/vault-store.js";
+
+export default defineAction({
+  description:
+    "Approve a pending vault secret request. Creates the secret (if it doesn't exist) and grants it to the requesting app. Admin only.",
+  schema: z.object({
+    id: z.string().describe("Request ID to approve"),
+    secretValue: z.string().describe("The secret value to store"),
+    secretName: z
+      .string()
+      .optional()
+      .describe("Human-readable name for the secret"),
+  }),
+  run: async (args) =>
+    approveRequest(
+      args.id,
+      args.secretValue,
+      args.secretName,
+      requireVaultCtx(),
+    ),
+});

package/src/actions/create-link-token.ts

@@ -0,0 +1,12 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { createLinkToken } from "../server/lib/dispatch-store.js";
+
+export default defineAction({
+  description:
+    "Create a /link token so a Slack or Telegram user can bind to their personal dispatch identity.",
+  schema: z.object({
+    platform: z.enum(["slack", "telegram"]),
+  }),
+  run: async ({ platform }) => createLinkToken(platform),
+});

package/src/actions/create-vault-grant.ts

@@ -0,0 +1,15 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { createGrant } from "../server/lib/vault-store.js";
+
+export default defineAction({
+  description:
+    "Grant an app access to a vault secret. The secret can then be synced to the app. Admin only.",
+  schema: z.object({
+    secretId: z.string().describe("ID of the secret to grant"),
+    appId: z
+      .string()
+      .describe("App ID to grant access to, e.g. mail, calendar"),
+  }),
+  run: async (args) => createGrant(args.secretId, args.appId),
+});

package/src/actions/create-vault-secret.ts

@@ -0,0 +1,21 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { createSecret } from "../server/lib/vault-store.js";
+
+export default defineAction({
+  description:
+    "Store a new secret in the workspace vault. Admin only. The secret can then be granted to specific apps.",
+  schema: z.object({
+    credentialKey: z
+      .string()
+      .describe("Environment variable name, e.g. GOOGLE_CLIENT_ID"),
+    value: z.string().describe("The secret value"),
+    name: z.string().describe("Human-readable label for this secret"),
+    provider: z
+      .string()
+      .optional()
+      .describe("Provider grouping tag, e.g. google, sendgrid, slack"),
+    description: z.string().optional().describe("Optional description"),
+  }),
+  run: async (args) => createSecret(args),
+});

package/src/actions/create-workspace-resource-grant.ts

@@ -0,0 +1,15 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { createResourceGrant } from "../server/lib/workspace-resources-store.js";
+
+export default defineAction({
+  description:
+    "Grant an app access to a workspace resource (skill, instruction, or agent). Admin only.",
+  schema: z.object({
+    resourceId: z.string().describe("Workspace resource ID"),
+    appId: z
+      .string()
+      .describe("App ID to grant access to, e.g. mail, analytics"),
+  }),
+  run: async (args) => createResourceGrant(args.resourceId, args.appId),
+});

package/src/actions/create-workspace-resource.ts

@@ -0,0 +1,29 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { createWorkspaceResource } from "../server/lib/workspace-resources-store.js";
+
+export default defineAction({
+  description:
+    'Create a workspace-wide skill, instruction, or agent profile. Set scope to "all" to push to every app, or "selected" to grant per-app.',
+  schema: z.object({
+    kind: z
+      .enum(["skill", "instruction", "agent"])
+      .describe("Resource kind: skill, instruction, or agent"),
+    name: z.string().describe("Human-readable name"),
+    description: z.string().optional().describe("Short description"),
+    path: z
+      .string()
+      .describe(
+        'Resource path, e.g. "skills/designer.md", "agents/researcher.md", or "remote-agents/researcher.json"',
+      ),
+    content: z
+      .string()
+      .describe("Full resource content (markdown or remote-agent JSON)"),
+    scope: z
+      .enum(["all", "selected"])
+      .describe(
+        '"all" = push to every app, "selected" = only apps with explicit grants',
+      ),
+  }),
+  run: async (args) => createWorkspaceResource(args),
+});

package/src/actions/delete-destination.ts

@@ -0,0 +1,11 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { deleteDestination } from "../server/lib/dispatch-store.js";
+
+export default defineAction({
+  description: "Delete a saved dispatch destination.",
+  schema: z.object({
+    id: z.string().describe("Destination id"),
+  }),
+  run: async ({ id }) => deleteDestination(id),
+});

package/src/actions/delete-vault-secret.ts

@@ -0,0 +1,12 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { deleteSecret } from "../server/lib/vault-store.js";
+
+export default defineAction({
+  description:
+    "Delete a secret from the workspace vault. Also revokes all active grants for this secret. Admin only.",
+  schema: z.object({
+    id: z.string().describe("Secret ID to delete"),
+  }),
+  run: async (args) => deleteSecret(args.id),
+});

package/src/actions/delete-workspace-resource.ts

@@ -0,0 +1,12 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { deleteWorkspaceResource } from "../server/lib/workspace-resources-store.js";
+
+export default defineAction({
+  description:
+    "Delete a workspace resource and revoke all its grants. Admin only.",
+  schema: z.object({
+    id: z.string().describe("Resource ID to delete"),
+  }),
+  run: async (args) => deleteWorkspaceResource(args.id),
+});

package/src/actions/deny-vault-request.ts

@@ -0,0 +1,12 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { denyRequest, requireVaultCtx } from "../server/lib/vault-store.js";
+
+export default defineAction({
+  description: "Deny a pending vault secret request. Admin only.",
+  schema: z.object({
+    id: z.string().describe("Request ID to deny"),
+    reason: z.string().optional().describe("Reason for denial"),
+  }),
+  run: async (args) => denyRequest(args.id, args.reason, requireVaultCtx()),
+});

package/src/actions/get-app-creation-settings.ts

@@ -0,0 +1,11 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { getAppCreationSettings } from "../server/lib/app-creation-store.js";
+
+export default defineAction({
+  description:
+    "Get Dispatch settings for creating new workspace apps, including the default Builder project.",
+  schema: z.object({}),
+  http: { method: "GET" },
+  run: async () => getAppCreationSettings(),
+});

package/src/actions/get-dispatch-settings.ts

@@ -0,0 +1,10 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { getApprovalPolicy } from "../server/lib/dispatch-store.js";
+
+export default defineAction({
+  description: "Get dispatch approval settings for the current organization.",
+  schema: z.object({}),
+  http: { method: "GET" },
+  run: async () => getApprovalPolicy(),
+});

package/src/actions/get-workspace-info.ts

@@ -0,0 +1,11 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { getWorkspaceInfo } from "../server/lib/app-creation-store.js";
+
+export default defineAction({
+  description:
+    "Get the current workspace's identity (name and app count) from the workspace root package.json. Surfaced in the Dispatch UI so users can see which workspace their apps belong to.",
+  schema: z.object({}),
+  http: { method: "GET" },
+  run: async () => getWorkspaceInfo(),
+});

package/src/actions/grant-vault-secrets-to-app.ts

@@ -0,0 +1,20 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { grantSecretsToApp } from "../server/lib/vault-store.js";
+
+export default defineAction({
+  description:
+    "Grant multiple Dispatch vault secrets to a workspace app. Existing active grants are skipped.",
+  http: { method: "POST" },
+  schema: z.object({
+    appId: z
+      .string()
+      .regex(/^[a-z][a-z0-9-]{0,63}$/)
+      .describe("Workspace app id/path, e.g. customer-health"),
+    secretIds: z
+      .array(z.string())
+      .max(100)
+      .describe("Vault secret IDs to grant to the app"),
+  }),
+  run: async (args) => grantSecretsToApp(args.secretIds, args.appId),
+});

package/src/actions/index.ts

@@ -0,0 +1,102 @@
+import type { ActionEntry } from "@agent-native/core/server";
+import approveDispatchChange from "./approve-dispatch-change.js";
+import approveVaultRequest from "./approve-vault-request.js";
+import createLinkToken from "./create-link-token.js";
+import createVaultGrant from "./create-vault-grant.js";
+import createVaultSecret from "./create-vault-secret.js";
+import createWorkspaceResourceGrant from "./create-workspace-resource-grant.js";
+import createWorkspaceResource from "./create-workspace-resource.js";
+import deleteDestination from "./delete-destination.js";
+import deleteVaultSecret from "./delete-vault-secret.js";
+import deleteWorkspaceResource from "./delete-workspace-resource.js";
+import denyVaultRequest from "./deny-vault-request.js";
+import getAppCreationSettings from "./get-app-creation-settings.js";
+import getDispatchSettings from "./get-dispatch-settings.js";
+import getWorkspaceInfo from "./get-workspace-info.js";
+import grantVaultSecretsToApp from "./grant-vault-secrets-to-app.js";
+import listConnectedAgents from "./list-connected-agents.js";
+import listDestinations from "./list-destinations.js";
+import listDispatchApprovals from "./list-dispatch-approvals.js";
+import listDispatchAudit from "./list-dispatch-audit.js";
+import listDispatchOverview from "./list-dispatch-overview.js";
+import listIntegrationsCatalog from "./list-integrations-catalog.js";
+import listLinkedIdentities from "./list-linked-identities.js";
+import listVaultAudit from "./list-vault-audit.js";
+import listVaultGrants from "./list-vault-grants.js";
+import listVaultRequests from "./list-vault-requests.js";
+import listVaultSecretOptions from "./list-vault-secret-options.js";
+import listVaultSecrets from "./list-vault-secrets.js";
+import listWorkspaceApps from "./list-workspace-apps.js";
+import listWorkspaceResourceGrants from "./list-workspace-resource-grants.js";
+import listWorkspaceResources from "./list-workspace-resources.js";
+import navigate from "./navigate.js";
+import rejectDispatchChange from "./reject-dispatch-change.js";
+import requestVaultSecret from "./request-vault-secret.js";
+import revokeVaultGrant from "./revoke-vault-grant.js";
+import revokeWorkspaceResourceGrant from "./revoke-workspace-resource-grant.js";
+import sendPlatformMessage from "./send-platform-message.js";
+import setAppCreationSettings from "./set-app-creation-settings.js";
+import setDispatchApprovalPolicy from "./set-dispatch-approval-policy.js";
+import startWorkspaceAppCreation from "./start-workspace-app-creation.js";
+import syncVaultToApp from "./sync-vault-to-app.js";
+import syncWorkspaceResourcesToAll from "./sync-workspace-resources-to-all.js";
+import syncWorkspaceResourcesToApp from "./sync-workspace-resources-to-app.js";
+import updateVaultSecret from "./update-vault-secret.js";
+import updateWorkspaceResource from "./update-workspace-resource.js";
+import upsertDestination from "./upsert-destination.js";
+import viewScreen from "./view-screen.js";
+
+/**
+ * Dispatch's actions registered as a flat name→entry map. Imported by
+ * `@agent-native/dispatch/server`'s side-effect block, which calls
+ * `registerPackageActions(dispatchActions)` so the framework's action
+ * loader picks them up.
+ */
+export const dispatchActions: Record<string, ActionEntry> = {
+  "approve-dispatch-change": approveDispatchChange,
+  "approve-vault-request": approveVaultRequest,
+  "create-link-token": createLinkToken,
+  "create-vault-grant": createVaultGrant,
+  "create-vault-secret": createVaultSecret,
+  "create-workspace-resource-grant": createWorkspaceResourceGrant,
+  "create-workspace-resource": createWorkspaceResource,
+  "delete-destination": deleteDestination,
+  "delete-vault-secret": deleteVaultSecret,
+  "delete-workspace-resource": deleteWorkspaceResource,
+  "deny-vault-request": denyVaultRequest,
+  "get-app-creation-settings": getAppCreationSettings,
+  "get-dispatch-settings": getDispatchSettings,
+  "get-workspace-info": getWorkspaceInfo,
+  "grant-vault-secrets-to-app": grantVaultSecretsToApp,
+  "list-connected-agents": listConnectedAgents,
+  "list-destinations": listDestinations,
+  "list-dispatch-approvals": listDispatchApprovals,
+  "list-dispatch-audit": listDispatchAudit,
+  "list-dispatch-overview": listDispatchOverview,
+  "list-integrations-catalog": listIntegrationsCatalog,
+  "list-linked-identities": listLinkedIdentities,
+  "list-vault-audit": listVaultAudit,
+  "list-vault-grants": listVaultGrants,
+  "list-vault-requests": listVaultRequests,
+  "list-vault-secret-options": listVaultSecretOptions,
+  "list-vault-secrets": listVaultSecrets,
+  "list-workspace-apps": listWorkspaceApps,
+  "list-workspace-resource-grants": listWorkspaceResourceGrants,
+  "list-workspace-resources": listWorkspaceResources,
+  navigate: navigate,
+  "reject-dispatch-change": rejectDispatchChange,
+  "request-vault-secret": requestVaultSecret,
+  "revoke-vault-grant": revokeVaultGrant,
+  "revoke-workspace-resource-grant": revokeWorkspaceResourceGrant,
+  "send-platform-message": sendPlatformMessage,
+  "set-app-creation-settings": setAppCreationSettings,
+  "set-dispatch-approval-policy": setDispatchApprovalPolicy,
+  "start-workspace-app-creation": startWorkspaceAppCreation,
+  "sync-vault-to-app": syncVaultToApp,
+  "sync-workspace-resources-to-all": syncWorkspaceResourcesToAll,
+  "sync-workspace-resources-to-app": syncWorkspaceResourcesToApp,
+  "update-vault-secret": updateVaultSecret,
+  "update-workspace-resource": updateWorkspaceResource,
+  "upsert-destination": upsertDestination,
+  "view-screen": viewScreen,
+};