@agent-native/dispatch 0.27.9 → 0.27.11

package/dist/actions/create_workspace_app_embed_session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create_workspace_app_embed_session.d.ts","sourceRoot":"","sources":["../../src/actions/create_workspace_app_embed_session.ts"],"names":[],"mappings":"AAcA;;;;GAIG;AACH,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CAsCf"}
+{"version":3,"file":"create_workspace_app_embed_session.d.ts","sourceRoot":"","sources":["../../src/actions/create_workspace_app_embed_session.ts"],"names":[],"mappings":"AAcA;;;;GAIG;AACH,wBAAsB,iCAAiC,CACrD,OAAO,EAAE,OAAO,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CAuCf"}

package/dist/actions/create_workspace_app_embed_session.js

@@ -17,10 +17,13 @@ function isPathWithinApp(pathname, appPath) {
 export async function assertWorkspaceEmbedSessionCaller(headers) {
     if (!headers)
         return;
-    const authorization = headers.get("authorization")?.trim();
-    if (authorization?.toLowerCase().startsWith("bearer "))
+    const fetchSite = headers.get("sec-fetch-site")?.trim().toLowerCase();
+    // Browsers always send Sec-Fetch-Site and page scripts cannot forge or strip
+    // this forbidden header. Native clients do not send it and authenticate
+    // through the normal action request context below.
+    if (!fetchSite)
         return;
-    if (headers.get("sec-fetch-site")?.toLowerCase() === "cross-site") {
+    if (fetchSite !== "same-origin") {
         throw new Error("Workspace app sessions must be requested by Dispatch.");
     }
     const referer = headers.get("referer");

package/dist/actions/create_workspace_app_embed_session.js.map

@@ -1 +1 @@
-{"version":3,"file":"create_workspace_app_embed_session.js","sourceRoot":"","sources":["../../src/actions/create_workspace_app_embed_session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAE9E,SAAS,eAAe,CAAC,QAAgB,EAAE,OAAe;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACtD,OAAO,UAAU,KAAK,GAAG;QACvB,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1B,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA4B;IAE5B,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,aAAa,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO;IAE/D,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,iBAAiB,EAAE,EAAE,aAAa,CAAC;IACzD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,UAAe,CAAC;IACpB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,iBAAiB,EAAE,KAAK;QACxB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,IACE,IAAI,CAAC,IAAI,CACP,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,GAAG,CAAC,UAAU,IAAI,eAAe,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CACpE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,4LAA4L;IAC9L,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC;aACH,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,6CAA6C,CAAC;QAC1D,GAAG,EAAE,CAAC;aACH,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,wCAAwC,CAAC;QACrD,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,2DAA2D,CAAC;QACxE,MAAM,EAAE,CAAC;aACN,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;aACzB,QAAQ,EAAE;aACV,QAAQ,CAAC,4CAA4C,CAAC;KAC1D,CAAC;IACF,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE,KAAK;IAChB,YAAY,EAAE,KAAK;IACnB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,iCAAiC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACjE,OAAO,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { defineAction } from \"@agent-native/core\";\nimport { getRequestContext } from \"@agent-native/core/server\";\nimport { z } from \"zod\";\n\nimport { listWorkspaceApps } from \"../server/lib/app-creation-store.js\";\nimport { createWorkspaceSsoEmbedSession } from \"../server/lib/mcp-gateway.js\";\n\nfunction isPathWithinApp(pathname: string, appPath: string): boolean {\n  const normalized = appPath.replace(/\\/+$/, \"\") || \"/\";\n  return normalized === \"/\"\n    ? pathname.startsWith(\"/\")\n    : pathname === normalized || pathname.startsWith(`${normalized}/`);\n}\n\n/**\n * Browser callers must come from the Dispatch parent surface. Native callers\n * carry the parent bearer explicitly; direct in-process action calls have no\n * request headers and are already inside the server authorization boundary.\n */\nexport async function assertWorkspaceEmbedSessionCaller(\n  headers: Headers | undefined,\n): Promise<void> {\n  if (!headers) return;\n\n  const authorization = headers.get(\"authorization\")?.trim();\n  if (authorization?.toLowerCase().startsWith(\"bearer \")) return;\n\n  if (headers.get(\"sec-fetch-site\")?.toLowerCase() === \"cross-site\") {\n    throw new Error(\"Workspace app sessions must be requested by Dispatch.\");\n  }\n\n  const referer = headers.get(\"referer\");\n  const requestOrigin = getRequestContext()?.requestOrigin;\n  if (!referer || !requestOrigin) {\n    throw new Error(\"Workspace app sessions must be requested by Dispatch.\");\n  }\n\n  let refererUrl: URL;\n  try {\n    refererUrl = new URL(referer);\n  } catch {\n    throw new Error(\"Workspace app sessions must be requested by Dispatch.\");\n  }\n  if (refererUrl.origin !== requestOrigin) {\n    throw new Error(\"Workspace app sessions must be requested by Dispatch.\");\n  }\n\n  const apps = await listWorkspaceApps({\n    includeAgentCards: false,\n    audience: \"all\",\n  });\n  if (\n    apps.some(\n      (app) =>\n        !app.isDispatch && isPathWithinApp(refererUrl.pathname, app.path),\n    )\n  ) {\n    throw new Error(\"Workspace apps cannot mint sessions for themselves.\");\n  }\n}\n\nexport default defineAction({\n  description:\n    \"Create a one-time app-scoped embed session for a workspace app opened inside Dispatch. This browser-only path is rollout-gated and never exposes an app's reusable session to another app.\",\n  schema: z.object({\n    app: z\n      .string()\n      .optional()\n      .describe(\"Workspace app id when path is app-relative.\"),\n    url: z\n      .string()\n      .optional()\n      .describe(\"Absolute app URL or app-relative path.\"),\n    path: z\n      .string()\n      .optional()\n      .describe(\"App-relative path. Requires app when url is not provided.\"),\n    chrome: z\n      .enum([\"full\", \"minimal\"])\n      .optional()\n      .describe(\"Embed chrome preference. Defaults to full.\"),\n  }),\n  readOnly: false,\n  parallelSafe: false,\n  agentTool: false,\n  toolCallable: false,\n  run: async (args, context) => {\n    await assertWorkspaceEmbedSessionCaller(context?.requestHeaders);\n    return createWorkspaceSsoEmbedSession(args);\n  },\n});\n"]}
+{"version":3,"file":"create_workspace_app_embed_session.js","sourceRoot":"","sources":["../../src/actions/create_workspace_app_embed_session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAE9E,SAAS,eAAe,CAAC,QAAgB,EAAE,OAAe;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;IACtD,OAAO,UAAU,KAAK,GAAG;QACvB,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1B,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,OAA4B;IAE5B,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtE,6EAA6E;IAC7E,wEAAwE;IACxE,mDAAmD;IACnD,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,SAAS,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,iBAAiB,EAAE,EAAE,aAAa,CAAC;IACzD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,UAAe,CAAC;IACpB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACnC,iBAAiB,EAAE,KAAK;QACxB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IACH,IACE,IAAI,CAAC,IAAI,CACP,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,GAAG,CAAC,UAAU,IAAI,eAAe,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CACpE,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,4LAA4L;IAC9L,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,GAAG,EAAE,CAAC;aACH,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,6CAA6C,CAAC;QAC1D,GAAG,EAAE,CAAC;aACH,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,wCAAwC,CAAC;QACrD,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,2DAA2D,CAAC;QACxE,MAAM,EAAE,CAAC;aACN,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;aACzB,QAAQ,EAAE;aACV,QAAQ,CAAC,4CAA4C,CAAC;KAC1D,CAAC;IACF,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE,KAAK;IAChB,YAAY,EAAE,KAAK;IACnB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC3B,MAAM,iCAAiC,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACjE,OAAO,8BAA8B,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { defineAction } from \"@agent-native/core\";\nimport { getRequestContext } from \"@agent-native/core/server\";\nimport { z } from \"zod\";\n\nimport { listWorkspaceApps } from \"../server/lib/app-creation-store.js\";\nimport { createWorkspaceSsoEmbedSession } from \"../server/lib/mcp-gateway.js\";\n\nfunction isPathWithinApp(pathname: string, appPath: string): boolean {\n  const normalized = appPath.replace(/\\/+$/, \"\") || \"/\";\n  return normalized === \"/\"\n    ? pathname.startsWith(\"/\")\n    : pathname === normalized || pathname.startsWith(`${normalized}/`);\n}\n\n/**\n * Browser callers must come from the Dispatch parent surface. Native callers\n * carry the parent bearer explicitly; direct in-process action calls have no\n * request headers and are already inside the server authorization boundary.\n */\nexport async function assertWorkspaceEmbedSessionCaller(\n  headers: Headers | undefined,\n): Promise<void> {\n  if (!headers) return;\n\n  const fetchSite = headers.get(\"sec-fetch-site\")?.trim().toLowerCase();\n  // Browsers always send Sec-Fetch-Site and page scripts cannot forge or strip\n  // this forbidden header. Native clients do not send it and authenticate\n  // through the normal action request context below.\n  if (!fetchSite) return;\n  if (fetchSite !== \"same-origin\") {\n    throw new Error(\"Workspace app sessions must be requested by Dispatch.\");\n  }\n\n  const referer = headers.get(\"referer\");\n  const requestOrigin = getRequestContext()?.requestOrigin;\n  if (!referer || !requestOrigin) {\n    throw new Error(\"Workspace app sessions must be requested by Dispatch.\");\n  }\n\n  let refererUrl: URL;\n  try {\n    refererUrl = new URL(referer);\n  } catch {\n    throw new Error(\"Workspace app sessions must be requested by Dispatch.\");\n  }\n  if (refererUrl.origin !== requestOrigin) {\n    throw new Error(\"Workspace app sessions must be requested by Dispatch.\");\n  }\n  const apps = await listWorkspaceApps({\n    includeAgentCards: false,\n    audience: \"all\",\n  });\n  if (\n    apps.some(\n      (app) =>\n        !app.isDispatch && isPathWithinApp(refererUrl.pathname, app.path),\n    )\n  ) {\n    throw new Error(\"Workspace apps cannot mint sessions for themselves.\");\n  }\n}\n\nexport default defineAction({\n  description:\n    \"Create a one-time app-scoped embed session for a workspace app opened inside Dispatch. This browser-only path is rollout-gated and never exposes an app's reusable session to another app.\",\n  schema: z.object({\n    app: z\n      .string()\n      .optional()\n      .describe(\"Workspace app id when path is app-relative.\"),\n    url: z\n      .string()\n      .optional()\n      .describe(\"Absolute app URL or app-relative path.\"),\n    path: z\n      .string()\n      .optional()\n      .describe(\"App-relative path. Requires app when url is not provided.\"),\n    chrome: z\n      .enum([\"full\", \"minimal\"])\n      .optional()\n      .describe(\"Embed chrome preference. Defaults to full.\"),\n  }),\n  readOnly: false,\n  parallelSafe: false,\n  agentTool: false,\n  toolCallable: false,\n  run: async (args, context) => {\n    await assertWorkspaceEmbedSessionCaller(context?.requestHeaders);\n    return createWorkspaceSsoEmbedSession(args);\n  },\n});\n"]}

package/dist/server/lib/app-creation-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-creation-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/app-creation-store.ts"],"names":[],"mappings":"AA+EA,KAAK,oBAAoB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sBAAsB,EAAE,KAAK,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;IACjE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qEAAqE;IACrE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAmFD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,MAAM,CAcR;AA6hBD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAcxC;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAexC;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAkBhC;AA+ZD,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAOtD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAiChD;AAyCD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+C/B;AAED,wBAAsB,iBAAiB,CACrC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA0DhC;AAwHD,wBAAsB,+BAA+B,IAAI,OAAO,CAC9D,0BAA0B,EAAE,CAC7B,CAOA;AAID,wBAAsB,gCAAgC,CAAC,KAAK,EAAE;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuC/D;AA6CD,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CA+B3E;AA6DD,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB/B;AAWD,wBAAgB,yBAAyB,IAAI,OAAO,CAcnD;AA8PD;;;GAGG;AACH,MAAM,MAAM,4BAA4B,GACpC,qBAAqB,GACrB,8BAA8B,GAC9B,uBAAuB,GACvB,8BAA8B,GAC9B,eAAe,CAAC;AAEpB,MAAM,WAAW,oCAAoC;IACnD,IAAI,EAAE,qBAAqB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qBAAqB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mCAAmC;IAClD,IAAI,EAAE,qBAAqB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC,4BAA4B,EAAE,qBAAqB,CAAC,CAAC;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,+BAA+B,GACvC,oCAAoC,GACpC,mCAAmC,GACnC,2BAA2B,GAC3B,2BAA2B,GAC3B,wBAAwB,CAAC;AAE7B,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAmM3C"}
+{"version":3,"file":"app-creation-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/app-creation-store.ts"],"names":[],"mappings":"AA+EA,KAAK,oBAAoB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAElD,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;CACzC;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,sBAAsB,EAAE,KAAK,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAC;IACjE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,qEAAqE;IACrE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAmFD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,MAAM,CAcR;AAkiBD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAcxC;AAED,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAexC;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAkBhC;AA+ZD,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAOtD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAiChD;AAyCD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+C/B;AAED,wBAAsB,iBAAiB,CACrC,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA0DhC;AAwHD,wBAAsB,+BAA+B,IAAI,OAAO,CAC9D,0BAA0B,EAAE,CAC7B,CAOA;AAID,wBAAsB,gCAAgC,CAAC,KAAK,EAAE;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuC/D;AA6CD,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CA+B3E;AA6DD,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgB/B;AAWD,wBAAgB,yBAAyB,IAAI,OAAO,CAcnD;AA8PD;;;GAGG;AACH,MAAM,MAAM,4BAA4B,GACpC,qBAAqB,GACrB,8BAA8B,GAC9B,uBAAuB,GACvB,8BAA8B,GAC9B,eAAe,CAAC;AAEpB,MAAM,WAAW,oCAAoC;IACnD,IAAI,EAAE,qBAAqB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,qBAAqB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mCAAmC;IAClD,IAAI,EAAE,qBAAqB,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC,4BAA4B,EAAE,qBAAqB,CAAC,CAAC;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,+BAA+B,GACvC,oCAAoC,GACpC,mCAAmC,GACnC,2BAA2B,GAC3B,2BAA2B,GAC3B,wBAAwB,CAAC;AAE7B,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAmM3C"}

package/dist/server/lib/app-creation-store.js

@@ -260,6 +260,11 @@ function applyWorkspaceAppMetadataOverride(app, settings) {
             : {}),
     };
 }
+// Workspace apps are mounted beneath the Dispatch gateway origin. That makes
+// them same-origin with Dispatch, so a mounted pane runs with the signed-in
+// user's session cookie (`path: "/"`). Only trusted, workspace-owner-authored
+// code belongs here; changes to authorship, content trust, or sharing require
+// an explicit auth, origin, or sandbox boundary before this invariant changes.
 function workspaceAppUrl(appPath) {
     const base = process.env.WORKSPACE_GATEWAY_URL ||
         process.env.APP_URL ||