@agent-native/dispatch 0.13.12 → 0.14.0

package/dist/server/lib/env-config.js

@@ -2,6 +2,16 @@ export const envKeys = [
     {
         key: "SLACK_BOT_TOKEN",
         label: "Slack bot token",
+        required: false,
+    },
+    {
+        key: "SLACK_CLIENT_ID",
+        label: "Slack OAuth client ID",
+        required: true,
+    },
+    {
+        key: "SLACK_CLIENT_SECRET",
+        label: "Slack OAuth client secret",
         required: true,
     },
     {
@@ -14,6 +24,41 @@ export const envKeys = [
         label: "Telegram bot token",
         required: true,
     },
+    {
+        key: "TELEGRAM_WEBHOOK_SECRET",
+        label: "Telegram webhook secret",
+        required: true,
+    },
+    {
+        key: "MICROSOFT_TEAMS_APP_ID",
+        label: "Microsoft Bot app ID",
+        required: false,
+    },
+    {
+        key: "MICROSOFT_TEAMS_APP_PASSWORD",
+        label: "Microsoft Bot client secret",
+        required: false,
+    },
+    {
+        key: "MICROSOFT_TEAMS_APP_TENANT_ID",
+        label: "Microsoft Bot tenant ID",
+        required: false,
+    },
+    {
+        key: "MICROSOFT_TEAMS_ALLOWED_TENANT_IDS",
+        label: "Allowed Microsoft Teams tenant IDs",
+        required: false,
+    },
+    {
+        key: "DISCORD_APPLICATION_ID",
+        label: "Discord application ID",
+        required: false,
+    },
+    {
+        key: "DISCORD_PUBLIC_KEY",
+        label: "Discord public key",
+        required: false,
+    },
     {
         key: "EMAIL_AGENT_ADDRESS",
         label: "Agent email address",
@@ -39,6 +84,11 @@ export const envKeys = [
         label: "WhatsApp phone number ID",
         required: false,
     },
+    {
+        key: "WHATSAPP_APP_SECRET",
+        label: "WhatsApp app secret",
+        required: false,
+    },
     {
         key: "PYLON_API_KEY",
         label: "Pylon API key",

package/dist/server/lib/env-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../../../src/server/lib/env-config.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,OAAO,GAAmB;IACrC;QACE,GAAG,EAAE,iBAAiB;QACtB,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,8BAA8B;QACnC,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,KAAK;KAChB;CACF,CAAC","sourcesContent":["import type { EnvKeyConfig } from \"@agent-native/core/server\";\n\nexport const envKeys: EnvKeyConfig[] = [\n  {\n    key: \"SLACK_BOT_TOKEN\",\n    label: \"Slack bot token\",\n    required: true,\n  },\n  {\n    key: \"SLACK_SIGNING_SECRET\",\n    label: \"Slack signing secret\",\n    required: true,\n  },\n  {\n    key: \"TELEGRAM_BOT_TOKEN\",\n    label: \"Telegram bot token\",\n    required: true,\n  },\n  {\n    key: \"EMAIL_AGENT_ADDRESS\",\n    label: \"Agent email address\",\n    required: false,\n  },\n  {\n    key: \"DISPATCH_DEFAULT_OWNER_EMAIL\",\n    label: \"Default Slack owner email\",\n    required: false,\n  },\n  {\n    key: \"WHATSAPP_ACCESS_TOKEN\",\n    label: \"WhatsApp access token\",\n    required: false,\n  },\n  {\n    key: \"WHATSAPP_VERIFY_TOKEN\",\n    label: \"WhatsApp verify token\",\n    required: false,\n  },\n  {\n    key: \"WHATSAPP_PHONE_NUMBER_ID\",\n    label: \"WhatsApp phone number ID\",\n    required: false,\n  },\n  {\n    key: \"PYLON_API_KEY\",\n    label: \"Pylon API key\",\n    required: false,\n  },\n];\n"]}
+{"version":3,"file":"env-config.js","sourceRoot":"","sources":["../../../src/server/lib/env-config.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,OAAO,GAAmB;IACrC;QACE,GAAG,EAAE,iBAAiB;QACtB,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,sBAAsB;QAC3B,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,yBAAyB;QAC9B,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,IAAI;KACf;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,8BAA8B;QACnC,KAAK,EAAE,6BAA6B;QACpC,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,+BAA+B;QACpC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,oCAAoC;QACzC,KAAK,EAAE,oCAAoC;QAC3C,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,KAAK,EAAE,wBAAwB;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,KAAK,EAAE,oBAAoB;QAC3B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,8BAA8B;QACnC,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,uBAAuB;QAC5B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,0BAA0B;QAC/B,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,qBAAqB;QAC1B,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,KAAK;KAChB;CACF,CAAC","sourcesContent":["import type { EnvKeyConfig } from \"@agent-native/core/server\";\n\nexport const envKeys: EnvKeyConfig[] = [\n  {\n    key: \"SLACK_BOT_TOKEN\",\n    label: \"Slack bot token\",\n    required: false,\n  },\n  {\n    key: \"SLACK_CLIENT_ID\",\n    label: \"Slack OAuth client ID\",\n    required: true,\n  },\n  {\n    key: \"SLACK_CLIENT_SECRET\",\n    label: \"Slack OAuth client secret\",\n    required: true,\n  },\n  {\n    key: \"SLACK_SIGNING_SECRET\",\n    label: \"Slack signing secret\",\n    required: true,\n  },\n  {\n    key: \"TELEGRAM_BOT_TOKEN\",\n    label: \"Telegram bot token\",\n    required: true,\n  },\n  {\n    key: \"TELEGRAM_WEBHOOK_SECRET\",\n    label: \"Telegram webhook secret\",\n    required: true,\n  },\n  {\n    key: \"MICROSOFT_TEAMS_APP_ID\",\n    label: \"Microsoft Bot app ID\",\n    required: false,\n  },\n  {\n    key: \"MICROSOFT_TEAMS_APP_PASSWORD\",\n    label: \"Microsoft Bot client secret\",\n    required: false,\n  },\n  {\n    key: \"MICROSOFT_TEAMS_APP_TENANT_ID\",\n    label: \"Microsoft Bot tenant ID\",\n    required: false,\n  },\n  {\n    key: \"MICROSOFT_TEAMS_ALLOWED_TENANT_IDS\",\n    label: \"Allowed Microsoft Teams tenant IDs\",\n    required: false,\n  },\n  {\n    key: \"DISCORD_APPLICATION_ID\",\n    label: \"Discord application ID\",\n    required: false,\n  },\n  {\n    key: \"DISCORD_PUBLIC_KEY\",\n    label: \"Discord public key\",\n    required: false,\n  },\n  {\n    key: \"EMAIL_AGENT_ADDRESS\",\n    label: \"Agent email address\",\n    required: false,\n  },\n  {\n    key: \"DISPATCH_DEFAULT_OWNER_EMAIL\",\n    label: \"Default Slack owner email\",\n    required: false,\n  },\n  {\n    key: \"WHATSAPP_ACCESS_TOKEN\",\n    label: \"WhatsApp access token\",\n    required: false,\n  },\n  {\n    key: \"WHATSAPP_VERIFY_TOKEN\",\n    label: \"WhatsApp verify token\",\n    required: false,\n  },\n  {\n    key: \"WHATSAPP_PHONE_NUMBER_ID\",\n    label: \"WhatsApp phone number ID\",\n    required: false,\n  },\n  {\n    key: \"WHATSAPP_APP_SECRET\",\n    label: \"WhatsApp app secret\",\n    required: false,\n  },\n  {\n    key: \"PYLON_API_KEY\",\n    label: \"Pylon API key\",\n    required: false,\n  },\n];\n"]}

package/dist/server/lib/onboarding-steps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding-steps.d.ts","sourceRoot":"","sources":["../../../src/server/lib/onboarding-steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,wBAAgB,+BAA+B,IAAI,IAAI,CAgCtD"}
+{"version":3,"file":"onboarding-steps.d.ts","sourceRoot":"","sources":["../../../src/server/lib/onboarding-steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,wBAAgB,+BAA+B,IAAI,IAAI,CA2DtD"}

package/dist/server/lib/onboarding-steps.js

@@ -8,7 +8,9 @@
  * the user has even created a real app. This step nudges them at adding
  * their first workspace app first.
  */
+import { listIntegrationInstallations } from "@agent-native/core/integrations";
 import { registerOnboardingStep } from "@agent-native/core/onboarding";
+import { getRequestOrgId, getRequestUserEmail, } from "@agent-native/core/server/request-context";
 import { listWorkspaceApps } from "./app-creation-store.js";
 let registered = false;
 export function registerDispatchOnboardingSteps() {
@@ -43,5 +45,28 @@ export function registerDispatchOnboardingSteps() {
             }
         },
     });
+    registerOnboardingStep({
+        id: "dispatch:connect-slack-workspace",
+        title: "Connect a Slack workspace",
+        description: "Install Agent Native with OAuth, then configure channel identities and access policies.",
+        order: 60,
+        required: false,
+        methods: [
+            {
+                id: "open-messaging",
+                kind: "link",
+                primary: true,
+                label: "Open Messaging",
+                payload: { url: "/messaging", external: false },
+            },
+        ],
+        isComplete: async () => {
+            const userEmail = getRequestUserEmail();
+            if (!userEmail)
+                return false;
+            const rows = await listIntegrationInstallations({ userEmail, orgId: getRequestOrgId() ?? null }, "slack").catch(() => []);
+            return rows.some((row) => row.status === "connected");
+        },
+    });
 }
 //# sourceMappingURL=onboarding-steps.js.map

package/dist/server/lib/onboarding-steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding-steps.js","sourceRoot":"","sources":["../../../src/server/lib/onboarding-steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB,MAAM,UAAU,+BAA+B;IAC7C,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAElB,sBAAsB,CAAC;QACrB,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,mGAAmG;QACrG,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE;YACP;gBACE,EAAE,EAAE,WAAW;gBACf,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE;aACpD;SACF;QACD,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;oBACnC,iBAAiB,EAAE,KAAK;oBACxB,eAAe,EAAE,IAAI;iBACtB,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Dispatch-specific onboarding steps.\n *\n * Slack/Telegram/etc. are auto-registered at order 60 by the framework when\n * their env keys are declared `required: true` in `env-config.ts`. Without\n * any earlier dispatch-specific step, a brand-new workspace lands on\n * \"Connect Slack\" as the first visible to-do — which is intimidating before\n * the user has even created a real app. This step nudges them at adding\n * their first workspace app first.\n */\n\nimport { registerOnboardingStep } from \"@agent-native/core/onboarding\";\n\nimport { listWorkspaceApps } from \"./app-creation-store.js\";\n\nlet registered = false;\n\nexport function registerDispatchOnboardingSteps(): void {\n  if (registered) return;\n  registered = true;\n\n  registerOnboardingStep({\n    id: \"dispatch:create-first-app\",\n    title: \"Create your first app\",\n    description:\n      \"Add a workspace app like Mail, Calendar, or Slides — or describe a custom app from the Apps page.\",\n    order: 5,\n    required: false,\n    methods: [\n      {\n        id: \"open-apps\",\n        kind: \"link\",\n        primary: true,\n        label: \"Browse apps\",\n        payload: { url: \"/dispatch/apps\", external: false },\n      },\n    ],\n    isComplete: async () => {\n      try {\n        const apps = await listWorkspaceApps({\n          includeAgentCards: false,\n          includeArchived: true,\n        });\n        return apps.some((app) => !app.isDispatch);\n      } catch {\n        return false;\n      }\n    },\n  });\n}\n"]}
+{"version":3,"file":"onboarding-steps.js","sourceRoot":"","sources":["../../../src/server/lib/onboarding-steps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,IAAI,UAAU,GAAG,KAAK,CAAC;AAEvB,MAAM,UAAU,+BAA+B;IAC7C,IAAI,UAAU;QAAE,OAAO;IACvB,UAAU,GAAG,IAAI,CAAC;IAElB,sBAAsB,CAAC;QACrB,EAAE,EAAE,2BAA2B;QAC/B,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,mGAAmG;QACrG,KAAK,EAAE,CAAC;QACR,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE;YACP;gBACE,EAAE,EAAE,WAAW;gBACf,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE;aACpD;SACF;QACD,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;oBACnC,iBAAiB,EAAE,KAAK;oBACxB,eAAe,EAAE,IAAI;iBACtB,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,sBAAsB,CAAC;QACrB,EAAE,EAAE,kCAAkC;QACtC,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,yFAAyF;QAC3F,KAAK,EAAE,EAAE;QACT,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE;YACP;gBACE,EAAE,EAAE,gBAAgB;gBACpB,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,gBAAgB;gBACvB,OAAO,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE;aAChD;SACF;QACD,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;YACxC,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAC7B,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAC7C,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,EAC/C,OAAO,CACR,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QACxD,CAAC;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Dispatch-specific onboarding steps.\n *\n * Slack/Telegram/etc. are auto-registered at order 60 by the framework when\n * their env keys are declared `required: true` in `env-config.ts`. Without\n * any earlier dispatch-specific step, a brand-new workspace lands on\n * \"Connect Slack\" as the first visible to-do — which is intimidating before\n * the user has even created a real app. This step nudges them at adding\n * their first workspace app first.\n */\n\nimport { listIntegrationInstallations } from \"@agent-native/core/integrations\";\nimport { registerOnboardingStep } from \"@agent-native/core/onboarding\";\nimport {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"@agent-native/core/server/request-context\";\n\nimport { listWorkspaceApps } from \"./app-creation-store.js\";\n\nlet registered = false;\n\nexport function registerDispatchOnboardingSteps(): void {\n  if (registered) return;\n  registered = true;\n\n  registerOnboardingStep({\n    id: \"dispatch:create-first-app\",\n    title: \"Create your first app\",\n    description:\n      \"Add a workspace app like Mail, Calendar, or Slides — or describe a custom app from the Apps page.\",\n    order: 5,\n    required: false,\n    methods: [\n      {\n        id: \"open-apps\",\n        kind: \"link\",\n        primary: true,\n        label: \"Browse apps\",\n        payload: { url: \"/dispatch/apps\", external: false },\n      },\n    ],\n    isComplete: async () => {\n      try {\n        const apps = await listWorkspaceApps({\n          includeAgentCards: false,\n          includeArchived: true,\n        });\n        return apps.some((app) => !app.isDispatch);\n      } catch {\n        return false;\n      }\n    },\n  });\n\n  registerOnboardingStep({\n    id: \"dispatch:connect-slack-workspace\",\n    title: \"Connect a Slack workspace\",\n    description:\n      \"Install Agent Native with OAuth, then configure channel identities and access policies.\",\n    order: 60,\n    required: false,\n    methods: [\n      {\n        id: \"open-messaging\",\n        kind: \"link\",\n        primary: true,\n        label: \"Open Messaging\",\n        payload: { url: \"/messaging\", external: false },\n      },\n    ],\n    isComplete: async () => {\n      const userEmail = getRequestUserEmail();\n      if (!userEmail) return false;\n      const rows = await listIntegrationInstallations(\n        { userEmail, orgId: getRequestOrgId() ?? null },\n        \"slack\",\n      ).catch(() => []);\n      return rows.some((row) => row.status === \"connected\");\n    },\n  });\n}\n"]}

package/dist/server/lib/provider-api.d.ts

@@ -1,10 +1,10 @@
 import { type ProviderApiDocsOptions, type ProviderApiId, type ProviderApiMethod, type ProviderApiRequestArgs } from "@agent-native/core/provider-api";
 export declare const DISPATCH_APP_ID = "dispatch";
-export declare const DISPATCH_PROVIDER_API_IDS: readonly ["amplitude", "apollo", "bigquery", "commonroom", "dataforseo", "ga4", "gcloud", "github", "figma", "gmail", "gong", "google_calendar", "google_drive", "granola", "grafana", "hubspot", "jira", "mixpanel", "notion", "posthog", "prometheus", "pylon", "sentry", "slack", "stripe", "twitter"];
+export declare const DISPATCH_PROVIDER_API_IDS: readonly ["amplitude", "apollo", "bigquery", "clay", "commonroom", "dataforseo", "ga4", "gcloud", "github", "figma", "gmail", "gong", "google_calendar", "google_drive", "granola", "grafana", "hubspot", "jira", "mixpanel", "notion", "posthog", "prometheus", "pylon", "sentry", "slack", "stripe", "twitter"];
 export type DispatchProviderApiId = ProviderApiId;
 export type { ProviderApiMethod, ProviderApiRequestArgs };
 export declare function listProviderApiCatalog(provider?: string): {
-    id: "amplitude" | "apollo" | "bigquery" | "commonroom" | "dataforseo" | "figma" | "ga4" | "gcloud" | "github" | "gmail" | "gong" | "google_calendar" | "google_drive" | "grafana" | "granola" | "hubspot" | "jira" | "mixpanel" | "notion" | "posthog" | "prometheus" | "pylon" | "sentry" | "slack" | "stripe" | "twitter";
+    id: "amplitude" | "apollo" | "bigquery" | "clay" | "commonroom" | "dataforseo" | "figma" | "ga4" | "gcloud" | "github" | "gmail" | "gong" | "google_calendar" | "google_drive" | "grafana" | "granola" | "hubspot" | "jira" | "mixpanel" | "notion" | "posthog" | "prometheus" | "pylon" | "sentry" | "slack" | "stripe" | "twitter";
     label: string;
     defaultBaseUrl: string;
     baseUrlCredentialKey: string;

package/dist/server/lib/provider-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api.d.ts","sourceRoot":"","sources":["../../../src/server/lib/provider-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAE3B,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,iCAAiC,CAAC;AAGzC,eAAO,MAAM,eAAe,aAAa,CAAC;AAC1C,eAAO,MAAM,yBAAyB,2SAAmB,CAAC;AAC1D,MAAM,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;AA0C1D,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;yBAEvD;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,oBAGvD;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,sBAAsB,oBAErE"}
+{"version":3,"file":"provider-api.d.ts","sourceRoot":"","sources":["../../../src/server/lib/provider-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,sBAAsB,EAE3B,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,iCAAiC,CAAC;AAGzC,eAAO,MAAM,eAAe,aAAa,CAAC;AAC1C,eAAO,MAAM,yBAAyB,mTAAmB,CAAC;AAC1D,MAAM,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;AA0C1D,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;;yBAEvD;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,sBAAsB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,oBAGvD;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,sBAAsB,oBAErE"}

package/dist/server/plugins/integrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/integrations.ts"],"names":[],"mappings":"AA8CA;;;;GAIG;AACH,QAAA,MAAM,0BAA0B,aAAoB,GAAG,kBAuBtD,CAAC;eAEa,0BAA0B"}
+{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../../src/server/plugins/integrations.ts"],"names":[],"mappings":"AAiDA;;;;GAIG;AACH,QAAA,MAAM,0BAA0B,aAAoB,GAAG,kBAuBtD,CAAC;eAEa,0BAA0B"}

package/dist/server/plugins/integrations.js

@@ -1,7 +1,7 @@
 import { createIntegrationsPlugin } from "@agent-native/core/server";
 import { dispatchActions } from "../../actions/index.js";
 import { getDispatchConfig } from "../index.js";
-import { beforeDispatchProcess, resolveDispatchOwner, } from "../lib/dispatch-integrations.js";
+import { beforeDispatchProcess, resolveDispatchExecutionContext, } from "../lib/dispatch-integrations.js";
 const dispatchIntegrationActions = {
     ...dispatchActions,
     // Messaging integrations should use the core call-agent tool for cross-app
@@ -26,6 +26,9 @@ Default posture:
 
 When a user asks for something:
 - If it belongs to analytics, content, slides, clips, assets, etc., delegate via call-agent — do not re-implement the domain logic in dispatch.
+- Synthetic uptime, health-check, and URL-availability monitors belong to Analytics, even when the monitored target is another app such as Clips. Delegate creation to Analytics and relay its exact monitor URL. Dispatch-native recurring jobs are for reminders, digests, and agent workflows, not HTTP uptime probes.
+- Route by the requested artifact type, not by organization-specific names stored in code. For structured records, databases, tables, queues, boards, and intake forms, resolve the owning app and canonical destination from loaded workspace instructions/resources plus discovered app capabilities; do not assume Content, a database ID, schema, owner, or required fields. Visual designs, mockups, wireframes, screens, and interfaces belong to Design. A trusted Required target agent hint in integration context is authoritative.
+- When delegating structured intake to the resolved owning app, preserve the exact Source thread URL and the workspace instruction context, inspect the destination's current required fields, ask only for missing values, submit once, verify the saved record, and return the exact link.
 - In messaging integrations, use call-agent for cross-app delegation; do not use ask_app.
 - After call-agent returns an answer, RELAY IT DIRECTLY to the user with at most a one-line preface — do not rephrase, summarize, or add commentary. The downstream agent already crafted the answer; your job is delivery, not editing. This minimizes round-trips and keeps the user-visible reply fast.
 - Exception: if the downstream agent reports a missing model/provider credential, do not name exact env vars, Vault keys, tokens, or secrets. Say the target app needs an LLM connection and recommend connecting Builder/managed LLM for that app; keep bring-your-own provider keys as a secondary option only if the user asks.
@@ -53,7 +56,7 @@ const dispatchIntegrationsPlugin = async (nitroApp) => {
     const plugin = createIntegrationsPlugin({
         appId: "dispatch",
         actions: dispatchIntegrationActions,
-        resolveOwner: resolveDispatchOwner,
+        resolveExecutionContext: resolveDispatchExecutionContext,
         beforeProcess: beforeDispatchProcess,
         systemPrompt,
         // Inherit the framework default (claude-sonnet-4-6 from

package/dist/server/plugins/integrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../../src/server/plugins/integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAEzC,MAAM,0BAA0B,GAAG;IACjC,GAAG,eAAe;IAClB,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,OAAO,EAAE;QACP,GAAG,eAAe,CAAC,OAAO;QAC1B,SAAS,EAAE,KAAK;KACjB;CACF,CAAC;AAEF,MAAM,kCAAkC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;4FAwBiD,CAAC;AAE7F;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,KAAK,EAAE,QAAa,EAAE,EAAE;IACzD,MAAM,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,CAAC;IACjD,MAAM,YAAY,GAChB,OAAO,cAAc,KAAK,QAAQ;QAChC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,OAAO,cAAc,KAAK,UAAU;YACpC,CAAC,CAAC,cAAc,CAAC,kCAAkC,CAAC;YACpD,CAAC,CAAC,kCAAkC,CAAC;IAE3C,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,0BAA0B;QACnC,YAAY,EAAE,oBAAoB;QAClC,aAAa,EAAE,qBAAqB;QACpC,YAAY;QACZ,wDAAwD;QACxD,yEAAyE;QACzE,+DAA+D;QAC/D,6EAA6E;KAC9E,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,eAAe,0BAA0B,CAAC","sourcesContent":["import { createIntegrationsPlugin } from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../../actions/index.js\";\nimport { getDispatchConfig } from \"../index.js\";\nimport {\n  beforeDispatchProcess,\n  resolveDispatchOwner,\n} from \"../lib/dispatch-integrations.js\";\n\nconst dispatchIntegrationActions = {\n  ...dispatchActions,\n  // Messaging integrations should use the core call-agent tool for cross-app\n  // delegation because it queues A2A continuations when serverless budgets are\n  // tight. The MCP-facing ask_app action is still available outside this path.\n  ask_app: {\n    ...dispatchActions.ask_app,\n    agentTool: false,\n  },\n};\n\nconst DISPATCH_INTEGRATION_SYSTEM_PROMPT = `You are the central dispatch for this workspace, responding via a messaging platform integration (Slack, Telegram, email, etc.).\n\nDefault posture:\n- Treat Slack, Telegram, and email as shared entrypoints into the workspace.\n- Heavily delegate domain work to specialized agents through A2A (call-agent) when another app owns the job. Apps you can delegate to include slides (decks/presentations), analytics (data/dashboards), content (docs/articles), forms (form builder), clips (screen recordings), design (visual designs), and assets (brand libraries plus generated images/videos).\n- Use the available-apps prompt context first, then list-connected-agents when you need fresh details, to see what agents are available before assuming a request must be handled locally.\n- When asked whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. Without that probe, missing agent-card fields mean unchecked, not unavailable.\n- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.\n- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.\n- Keep durable memory and operating instructions in resources rather than ephemeral chat.\n- Reply in the originating thread unless the user explicitly asks you to send to a saved destination.\n\nWhen a user asks for something:\n- If it belongs to analytics, content, slides, clips, assets, etc., delegate via call-agent — do not re-implement the domain logic in dispatch.\n- In messaging integrations, use call-agent for cross-app delegation; do not use ask_app.\n- After call-agent returns an answer, RELAY IT DIRECTLY to the user with at most a one-line preface — do not rephrase, summarize, or add commentary. The downstream agent already crafted the answer; your job is delivery, not editing. This minimizes round-trips and keeps the user-visible reply fast.\n- Exception: if the downstream agent reports a missing model/provider credential, do not name exact env vars, Vault keys, tokens, or secrets. Say the target app needs an LLM connection and recommend connecting Builder/managed LLM for that app; keep bring-your-own provider keys as a secondary option only if the user asks.\n- If the user asks to create, build, make, scaffold, or generate an \"agent\" from Dispatch chat or by tagging @agent-native in Slack, email, or Telegram, first classify the ask. If it is a simple Dispatch-native behavior like a reminder, digest, monitor, routing rule, saved instruction, or recurring workflow, create or update the recurring job/resource/destination in Dispatch. If it is a robust unique product or teammate that needs its own UI, data model, actions, integrations, or domain workflow, treat it as a new workspace app and call start-workspace-app-creation.\n- If a new-app prompt asks for access to Mail, Calendar, Analytics, Brain, Assets, or similar first-party app data/agents, keep using the existing hosted/connected app and A2A path. Do not ask Builder to scaffold those apps as children of the new app unless the user explicitly asks for a customized fork/copy.\n- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible \"Chat\", \"Starter\", \"Blank app\", or \"New app\" UI behind.\n- If the user explicitly asks for a new app or workspace app, call start-workspace-app-creation with their prompt and include a concise generated description by default. Do not satisfy a new-app request by adding a route, page, component, or file inside apps/chat or another existing app unless the user explicitly asks to modify that existing app. If the request is too vague to classify, ask one concise follow-up. If the action returns mode \"builder\", reply with the Builder branch URL; Builder is responsible for creating the separate workspace app under apps/<app-id>, mounting it at /<app-id>, ensuring apps/<app-id>/package.json exists with name/displayName and description so Dispatch discovers it, using relative /<app-id> links instead of hardcoded localhost/dev ports, and preserving APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath() in the React Router client entry. The new app lives at the workspace root /<app-id>, NOT under /dispatch/<app-id>, /apps/<app-id>, or any other Dispatch tab — when telling the user where to find it, link to /<app-id> only. There is no separate workspace app registry to edit. If it returns mode \"local-agent\", tell the user it is ready for the local code agent and include the returned app path/prompt summary. If it returns mode \"coming-soon\", say this requires a code change and they can edit locally or use Builder.io to edit this code in the cloud and continue customizing the app any way they like; do not send them to Builder org/beta settings. If it returns mode \"builder-unavailable\", report the action's message exactly enough to preserve the missing identity/credential detail.\n- For digests, reminders, or saved behavior, prefer recurring jobs, resources, or destinations over chat replies.\n- Keep responses concise and operational — messaging platforms have character limits.\n- Use markdown sparingly (bold and lists are fine, avoid complex formatting).\n- If a task requires many steps, summarize what you did rather than streaming every detail.`;\n\n/**\n * Defer plugin construction until the Nitro plugin actually fires so the\n * config-aware system prompt resolves AFTER `setupDispatch(config)` has\n * stamped the active config (plugin module load order is not guaranteed).\n */\nconst dispatchIntegrationsPlugin = async (nitroApp: any) => {\n  const { integrations = {} } = getDispatchConfig();\n  const promptOverride = integrations.systemPrompt;\n  const systemPrompt =\n    typeof promptOverride === \"string\"\n      ? promptOverride\n      : typeof promptOverride === \"function\"\n        ? promptOverride(DISPATCH_INTEGRATION_SYSTEM_PROMPT)\n        : DISPATCH_INTEGRATION_SYSTEM_PROMPT;\n\n  const plugin = createIntegrationsPlugin({\n    appId: \"dispatch\",\n    actions: dispatchIntegrationActions,\n    resolveOwner: resolveDispatchOwner,\n    beforeProcess: beforeDispatchProcess,\n    systemPrompt,\n    // Inherit the framework default (claude-sonnet-4-6 from\n    // packages/core/src/integrations/plugin.ts). Haiku was tried for latency\n    // but hallucinated URLs/IDs after delegated call-agent results\n    // (e.g. inventing `https://slides.workspace.com/deck/builder-io-deck-2024`).\n  });\n\n  return plugin(nitroApp);\n};\n\nexport default dispatchIntegrationsPlugin;\n"]}
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../../src/server/plugins/integrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EACL,qBAAqB,EACrB,+BAA+B,GAChC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,0BAA0B,GAAG;IACjC,GAAG,eAAe;IAClB,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,OAAO,EAAE;QACP,GAAG,eAAe,CAAC,OAAO;QAC1B,SAAS,EAAE,KAAK;KACjB;CACF,CAAC;AAEF,MAAM,kCAAkC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;4FA2BiD,CAAC;AAE7F;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,KAAK,EAAE,QAAa,EAAE,EAAE;IACzD,MAAM,EAAE,YAAY,GAAG,EAAE,EAAE,GAAG,iBAAiB,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,CAAC;IACjD,MAAM,YAAY,GAChB,OAAO,cAAc,KAAK,QAAQ;QAChC,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,OAAO,cAAc,KAAK,UAAU;YACpC,CAAC,CAAC,cAAc,CAAC,kCAAkC,CAAC;YACpD,CAAC,CAAC,kCAAkC,CAAC;IAE3C,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,0BAA0B;QACnC,uBAAuB,EAAE,+BAA+B;QACxD,aAAa,EAAE,qBAAqB;QACpC,YAAY;QACZ,wDAAwD;QACxD,yEAAyE;QACzE,+DAA+D;QAC/D,6EAA6E;KAC9E,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,eAAe,0BAA0B,CAAC","sourcesContent":["import { createIntegrationsPlugin } from \"@agent-native/core/server\";\n\nimport { dispatchActions } from \"../../actions/index.js\";\nimport { getDispatchConfig } from \"../index.js\";\nimport {\n  beforeDispatchProcess,\n  resolveDispatchExecutionContext,\n} from \"../lib/dispatch-integrations.js\";\n\nconst dispatchIntegrationActions = {\n  ...dispatchActions,\n  // Messaging integrations should use the core call-agent tool for cross-app\n  // delegation because it queues A2A continuations when serverless budgets are\n  // tight. The MCP-facing ask_app action is still available outside this path.\n  ask_app: {\n    ...dispatchActions.ask_app,\n    agentTool: false,\n  },\n};\n\nconst DISPATCH_INTEGRATION_SYSTEM_PROMPT = `You are the central dispatch for this workspace, responding via a messaging platform integration (Slack, Telegram, email, etc.).\n\nDefault posture:\n- Treat Slack, Telegram, and email as shared entrypoints into the workspace.\n- Heavily delegate domain work to specialized agents through A2A (call-agent) when another app owns the job. Apps you can delegate to include slides (decks/presentations), analytics (data/dashboards), content (docs/articles), forms (form builder), clips (screen recordings), design (visual designs), and assets (brand libraries plus generated images/videos).\n- Use the available-apps prompt context first, then list-connected-agents when you need fresh details, to see what agents are available before assuming a request must be handled locally.\n- When asked whether workspace apps expose agent cards or A2A endpoints, call list-workspace-apps with includeAgentCards=true. Without that probe, missing agent-card fields mean unchecked, not unavailable.\n- Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.\n- Integration grants are not provider capability limits. For ad hoc provider inspection, querying, reporting, or troubleshooting, call provider-api-catalog/provider-api-docs, then provider-api-request against the provider's real HTTP API. Use connectionId for a specific shared grant and accountId for a specific OAuth account. Never expose secret values or silently widen app access while doing this.\n- Keep durable memory and operating instructions in resources rather than ephemeral chat.\n- Reply in the originating thread unless the user explicitly asks you to send to a saved destination.\n\nWhen a user asks for something:\n- If it belongs to analytics, content, slides, clips, assets, etc., delegate via call-agent — do not re-implement the domain logic in dispatch.\n- Synthetic uptime, health-check, and URL-availability monitors belong to Analytics, even when the monitored target is another app such as Clips. Delegate creation to Analytics and relay its exact monitor URL. Dispatch-native recurring jobs are for reminders, digests, and agent workflows, not HTTP uptime probes.\n- Route by the requested artifact type, not by organization-specific names stored in code. For structured records, databases, tables, queues, boards, and intake forms, resolve the owning app and canonical destination from loaded workspace instructions/resources plus discovered app capabilities; do not assume Content, a database ID, schema, owner, or required fields. Visual designs, mockups, wireframes, screens, and interfaces belong to Design. A trusted Required target agent hint in integration context is authoritative.\n- When delegating structured intake to the resolved owning app, preserve the exact Source thread URL and the workspace instruction context, inspect the destination's current required fields, ask only for missing values, submit once, verify the saved record, and return the exact link.\n- In messaging integrations, use call-agent for cross-app delegation; do not use ask_app.\n- After call-agent returns an answer, RELAY IT DIRECTLY to the user with at most a one-line preface — do not rephrase, summarize, or add commentary. The downstream agent already crafted the answer; your job is delivery, not editing. This minimizes round-trips and keeps the user-visible reply fast.\n- Exception: if the downstream agent reports a missing model/provider credential, do not name exact env vars, Vault keys, tokens, or secrets. Say the target app needs an LLM connection and recommend connecting Builder/managed LLM for that app; keep bring-your-own provider keys as a secondary option only if the user asks.\n- If the user asks to create, build, make, scaffold, or generate an \"agent\" from Dispatch chat or by tagging @agent-native in Slack, email, or Telegram, first classify the ask. If it is a simple Dispatch-native behavior like a reminder, digest, monitor, routing rule, saved instruction, or recurring workflow, create or update the recurring job/resource/destination in Dispatch. If it is a robust unique product or teammate that needs its own UI, data model, actions, integrations, or domain workflow, treat it as a new workspace app and call start-workspace-app-creation.\n- If a new-app prompt asks for access to Mail, Calendar, Analytics, Brain, Assets, or similar first-party app data/agents, keep using the existing hosted/connected app and A2A path. Do not ask Builder to scaffold those apps as children of the new app unless the user explicitly asks for a customized fork/copy.\n- If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible \"Chat\", \"Starter\", \"Blank app\", or \"New app\" UI behind.\n- If the user explicitly asks for a new app or workspace app, call start-workspace-app-creation with their prompt and include a concise generated description by default. Do not satisfy a new-app request by adding a route, page, component, or file inside apps/chat or another existing app unless the user explicitly asks to modify that existing app. If the request is too vague to classify, ask one concise follow-up. If the action returns mode \"builder\", reply with the Builder branch URL; Builder is responsible for creating the separate workspace app under apps/<app-id>, mounting it at /<app-id>, ensuring apps/<app-id>/package.json exists with name/displayName and description so Dispatch discovers it, using relative /<app-id> links instead of hardcoded localhost/dev ports, and preserving APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath() in the React Router client entry. The new app lives at the workspace root /<app-id>, NOT under /dispatch/<app-id>, /apps/<app-id>, or any other Dispatch tab — when telling the user where to find it, link to /<app-id> only. There is no separate workspace app registry to edit. If it returns mode \"local-agent\", tell the user it is ready for the local code agent and include the returned app path/prompt summary. If it returns mode \"coming-soon\", say this requires a code change and they can edit locally or use Builder.io to edit this code in the cloud and continue customizing the app any way they like; do not send them to Builder org/beta settings. If it returns mode \"builder-unavailable\", report the action's message exactly enough to preserve the missing identity/credential detail.\n- For digests, reminders, or saved behavior, prefer recurring jobs, resources, or destinations over chat replies.\n- Keep responses concise and operational — messaging platforms have character limits.\n- Use markdown sparingly (bold and lists are fine, avoid complex formatting).\n- If a task requires many steps, summarize what you did rather than streaming every detail.`;\n\n/**\n * Defer plugin construction until the Nitro plugin actually fires so the\n * config-aware system prompt resolves AFTER `setupDispatch(config)` has\n * stamped the active config (plugin module load order is not guaranteed).\n */\nconst dispatchIntegrationsPlugin = async (nitroApp: any) => {\n  const { integrations = {} } = getDispatchConfig();\n  const promptOverride = integrations.systemPrompt;\n  const systemPrompt =\n    typeof promptOverride === \"string\"\n      ? promptOverride\n      : typeof promptOverride === \"function\"\n        ? promptOverride(DISPATCH_INTEGRATION_SYSTEM_PROMPT)\n        : DISPATCH_INTEGRATION_SYSTEM_PROMPT;\n\n  const plugin = createIntegrationsPlugin({\n    appId: \"dispatch\",\n    actions: dispatchIntegrationActions,\n    resolveExecutionContext: resolveDispatchExecutionContext,\n    beforeProcess: beforeDispatchProcess,\n    systemPrompt,\n    // Inherit the framework default (claude-sonnet-4-6 from\n    // packages/core/src/integrations/plugin.ts). Haiku was tried for latency\n    // but hallucinated URLs/IDs after delegated call-agent results\n    // (e.g. inventing `https://slides.workspace.com/deck/builder-io-deck-2024`).\n  });\n\n  return plugin(nitroApp);\n};\n\nexport default dispatchIntegrationsPlugin;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.13.12",
+  "version": "0.14.0",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -94,7 +94,7 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.92.0"
+    "@agent-native/core": "0.93.0"
   },
   "peerDependencies": {
     "@agent-native/core": ">=0.8.0",

package/src/actions/provider-api-audit.spec.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  buildProviderApiAuditSummary,
+  sanitizeProviderApiAuditPath,
+} from "./provider-api-audit.js";
+
+describe("provider API audit summaries", () => {
+  it("redacts every query value from relative and absolute request paths", () => {
+    expect(
+      sanitizeProviderApiAuditPath(
+        "/v1/resources?api_key=secret-example&cursor=page-example",
+      ),
+    ).toBe("/v1/resources?api_key=[redacted]&cursor=[redacted]");
+    expect(
+      sanitizeProviderApiAuditPath(
+        "https://api.example.test/download?X-Amz-Signature=signed-example&part=1",
+      ),
+    ).toBe(
+      "https://api.example.test/download?X-Amz-Signature=[redacted]&part=[redacted]",
+    );
+  });
+
+  it("redacts credential-named and opaque path segments", () => {
+    expect(
+      sanitizeProviderApiAuditPath(
+        "/hooks/token/secret-example-value/callback/api_key=another-example",
+      ),
+    ).toBe("/hooks/token/[redacted]/callback/api_key=[redacted]");
+    expect(
+      sanitizeProviderApiAuditPath(
+        "/download/0123456789abcdef0123456789abcdef/file",
+      ),
+    ).toBe("/download/[redacted]/file");
+  });
+
+  it("drops fragments and keeps explicit query arguments out of summaries", () => {
+    const summary = buildProviderApiAuditSummary({
+      method: "get",
+      provider: "example",
+      path: "/records?filter=customer-example#secret-example-fragment",
+      query: { api_key: "query-secret-example" },
+    } as Parameters<typeof buildProviderApiAuditSummary>[0] & {
+      query: unknown;
+    });
+
+    expect(summary).toBe("GET example /records?filter=[redacted]");
+    expect(summary).not.toContain("customer-example");
+    expect(summary).not.toContain("secret-example");
+    expect(summary).not.toContain("query-secret-example");
+  });
+});

package/src/actions/provider-api-audit.ts

@@ -0,0 +1,88 @@
+const REDACTED = "[redacted]";
+
+const CREDENTIAL_NAME =
+  /^(?:api[-_]?key|access[-_]?token|auth(?:orization)?|bearer|credential|password|secret|signature|sig|token|x-amz-credential|x-amz-signature)$/i;
+
+function decodePathSegment(segment: string): string {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+
+function looksLikeCredentialValue(segment: string): boolean {
+  const value = decodePathSegment(segment);
+  if (/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) {
+    return true;
+  }
+  if (
+    /^(?:sk|pk|rk|ghp|github_pat|xox[baprs]|ya29|AIza)[-_][A-Za-z0-9_-]+$/i.test(
+      value,
+    )
+  ) {
+    return true;
+  }
+  return value.length >= 32 && /^[A-Za-z0-9._~-]+$/.test(value);
+}
+
+function sanitizePathname(pathname: string): string {
+  let redactNext = false;
+  return pathname
+    .split("/")
+    .map((segment) => {
+      if (!segment) return segment;
+      const decoded = decodePathSegment(segment);
+      if (redactNext) {
+        redactNext = false;
+        return REDACTED;
+      }
+
+      const assignment = decoded.match(/^([^=:]+)([=:])(.+)$/);
+      if (assignment && CREDENTIAL_NAME.test(assignment[1]!)) {
+        return `${assignment[1]}${assignment[2]}${REDACTED}`;
+      }
+      if (CREDENTIAL_NAME.test(decoded)) {
+        redactNext = true;
+        return segment;
+      }
+      return looksLikeCredentialValue(segment) ? REDACTED : segment;
+    })
+    .join("/");
+}
+
+function sanitizeQuery(search: string): string {
+  if (!search) return "";
+  const redacted = Array.from(new URLSearchParams(search).keys(), (key) => {
+    const safeKey = encodeURIComponent(key.slice(0, 100));
+    return `${safeKey}=${REDACTED}`;
+  });
+  return redacted.length > 0 ? `?${redacted.join("&")}` : "";
+}
+
+export function sanitizeProviderApiAuditPath(path: unknown): string {
+  const raw = String(path ?? "");
+  const withoutFragment = raw.split("#", 1)[0] ?? "";
+
+  try {
+    const url = new URL(withoutFragment);
+    return `${url.protocol}//${url.host}${sanitizePathname(url.pathname)}${sanitizeQuery(url.search)}`;
+  } catch {
+    const queryIndex = withoutFragment.indexOf("?");
+    const pathname =
+      queryIndex >= 0 ? withoutFragment.slice(0, queryIndex) : withoutFragment;
+    const search = queryIndex >= 0 ? withoutFragment.slice(queryIndex + 1) : "";
+    return `${sanitizePathname(pathname)}${sanitizeQuery(search)}`;
+  }
+}
+
+export function buildProviderApiAuditSummary(args: {
+  method?: unknown;
+  provider?: unknown;
+  path?: unknown;
+}): string {
+  const method = String(args.method || "GET").toUpperCase();
+  const provider = String(args.provider ?? "");
+  const path = sanitizeProviderApiAuditPath(args.path);
+  return `${method} ${provider} ${path}`.slice(0, 200);
+}

package/src/actions/provider-api-request.ts

@@ -7,6 +7,7 @@ import {
   DISPATCH_APP_ID,
   executeProviderApiRequest,
 } from "../server/lib/provider-api.js";
+import { buildProviderApiAuditSummary } from "./provider-api-audit.js";
 
 const MethodSchema = z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]);
 
@@ -197,6 +198,15 @@ export default defineAction({
       ),
   }),
   http: false,
+  audit: {
+    recordInputs: false,
+    target: (args) => ({
+      type: "provider-api",
+      id: String(args.provider),
+      visibility: "private",
+    }),
+    summary: (args) => buildProviderApiAuditSummary(args),
+  },
   run: async (args) => {
     if (args.stageAs) {
       const ctx = getCredentialContext();

package/src/actions/send-platform-message.spec.ts

@@ -0,0 +1,108 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  getInstallation: vi.fn(),
+  resolveTokenBundle: vi.fn(),
+  resolveSecret: vi.fn(),
+  sendMessageToTarget: vi.fn(),
+  getDestinationById: vi.fn(),
+  slackAdapter: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/integrations", () => ({
+  listIntegrationInstallations: mocks.getInstallation,
+  resolveIntegrationTokenBundle: mocks.resolveTokenBundle,
+}));
+
+vi.mock("@agent-native/core/server", () => ({
+  getRequestUserEmail: () => "member@example.com",
+  getRequestOrgId: () => "org-a",
+  resolveSecret: mocks.resolveSecret,
+  isEmailConfigured: vi.fn(),
+  slackAdapter: mocks.slackAdapter,
+  telegramAdapter: vi.fn(),
+  emailAdapter: vi.fn(),
+}));
+
+vi.mock("../server/lib/dispatch-store.js", () => ({
+  getDestinationById: mocks.getDestinationById,
+}));
+
+const action = (await import("./send-platform-message.js")).default;
+
+describe("send-platform-message tenant scoping", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.getDestinationById.mockResolvedValue(null);
+    mocks.resolveSecret.mockResolvedValue(null);
+    mocks.slackAdapter.mockImplementation(
+      (options: { resolveBotToken: () => Promise<string | undefined> }) => ({
+        formatAgentResponse: (text: string) => ({
+          text,
+          platformContext: {},
+        }),
+        sendMessageToTarget: async (...args: unknown[]) => {
+          expect(await options.resolveBotToken()).toBe("own-managed-token");
+          return mocks.sendMessageToTarget(...args);
+        },
+      }),
+    );
+  });
+
+  it("resolves and uses only the caller org's Slack installation", async () => {
+    mocks.getInstallation.mockResolvedValue([
+      {
+        id: "installation-a",
+        installationKey: "team:T1:app:A1",
+        teamId: "T1",
+        enterpriseId: null,
+      },
+    ]);
+    mocks.resolveTokenBundle.mockResolvedValue({
+      accessToken: "own-managed-token",
+    });
+
+    await action.run(
+      {
+        platform: "slack",
+        destination: "C1",
+        tenantId: "T1",
+        text: "hello",
+      },
+      {} as never,
+    );
+
+    expect(mocks.getInstallation).toHaveBeenCalledWith(
+      {
+        userEmail: "member@example.com",
+        orgId: "org-a",
+      },
+      "slack",
+    );
+    expect(mocks.resolveTokenBundle).toHaveBeenCalledWith(
+      "slack",
+      "team:T1:app:A1",
+    );
+    expect(mocks.sendMessageToTarget).toHaveBeenCalledOnce();
+  });
+
+  it("does not use another org's managed installation", async () => {
+    mocks.getInstallation.mockResolvedValue([]);
+
+    await expect(
+      action.run(
+        {
+          platform: "slack",
+          destination: "C1",
+          tenantId: "T-other",
+          text: "hello",
+        },
+        {} as never,
+      ),
+    ).rejects.toThrow("That Slack workspace is not connected");
+
+    expect(mocks.resolveTokenBundle).not.toHaveBeenCalled();
+    expect(mocks.slackAdapter).not.toHaveBeenCalled();
+    expect(mocks.sendMessageToTarget).not.toHaveBeenCalled();
+  });
+});