@agent-native/dispatch 0.40.12 → 0.40.13

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @agent-native/dispatch
 
+## 0.40.13
+
+### Patch Changes
+
+- Release all public npm packages with a patch version bump.
+- Updated dependencies [88908c5]
+- Updated dependencies [cc3c820]
+- Updated dependencies [a78f2a0]
+- Updated dependencies [bdb9e68]
+- Updated dependencies [bb72f96]
+- Updated dependencies
+- Updated dependencies [5d05eb6]
+- Updated dependencies [cbfea3c]
+- Updated dependencies [b88b078]
+  - @agent-native/toolkit@0.201.1
+
 ## 0.40.12
 
 ### Patch Changes
@@ -1121,11 +1137,4 @@
 - 907dfa3: Resolve hosted workspace app sign-in from the authenticated live registry so custom mounted apps can receive Dispatch embed sessions without a copied app list. Keep the registry action scoped to its verified A2A caller and refresh the desktop canary identity state before automatic sign-in.
 - 907dfa3: Preserve organization Google-only policies during shared sign-in by marking only Dispatch identities with a verified Google account link, while keeping existing local accounts and sessions additive.
 
-## 0.27.6
-
-### Patch Changes
-
-- 9e73795: Resolve hosted workspace app sign-in from the authenticated live registry so custom mounted apps can receive Dispatch embed sessions without a copied app list. Keep the registry action scoped to its verified A2A caller and refresh the desktop canary identity state before automatic sign-in.
-- 9e73795: Preserve organization Google-only policies during shared sign-in by marking only Dispatch identities with a verified Google account link, while keeping existing local accounts and sessions additive.
-
 For the full list of releases, see the [changelog archive](./changelog/archive/CHANGELOG.md).

package/dist/actions/provider-api-register.d.ts

@@ -47,9 +47,10 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
     notes?: string | undefined;
     scope?: "org" | "user" | undefined;
 }, {
+    message?: undefined;
     id?: undefined;
-    deleted?: undefined;
     provider?: undefined;
+    deleted?: undefined;
     providers: {
         id: string;
         label: string;
@@ -63,8 +64,8 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
     found?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
     id?: undefined;
     deleted?: undefined;
     providers?: undefined;
@@ -73,18 +74,18 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
     provider: import("node_modules/@agent-native/core/dist/provider-api").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
+    message?: undefined;
     provider?: undefined;
+    deleted?: undefined;
     providers?: undefined;
     count?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
     provider?: undefined;
     providers?: undefined;
     count?: undefined;
@@ -93,10 +94,9 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
     provider?: undefined;
+    deleted?: undefined;
     providers?: undefined;
     count?: undefined;
     found?: undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.40.12",
+  "version": "0.40.13",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -89,7 +89,7 @@
     "tailwind-merge": "^3.5.0",
     "vaul": "^1.1.2",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "0.201.0"
+    "@agent-native/toolkit": "0.201.1"
   },
   "devDependencies": {
     "@react-router/dev": "^8.1.0",
@@ -103,7 +103,7 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.201.0"
+    "@agent-native/core": "0.201.1"
   },
   "peerDependencies": {
     "@agent-native/core": ">=0.198.6",

package/src/server/lib/private-icon-assets.spec.ts

@@ -1,4 +1,7 @@
 import { createHmac } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
@@ -436,46 +439,62 @@ describe("Dispatch private icon assets", () => {
   });
 
   it("accepts a signed service JWT only for the private-icon audience", async () => {
-    vi.stubEnv("A2A_SECRET", "example-dispatch-shared-secret");
-    vi.stubEnv("APP_URL", "https://dispatch.example.test");
-    const { verifyA2AToken } = await vi.importActual<
-      typeof import("@agent-native/core/a2a")
-    >("@agent-native/core/a2a");
-    mocks.verifyA2AToken.mockImplementation(verifyA2AToken);
+    const databaseDir = fs.mkdtempSync(
+      path.join(os.tmpdir(), "dispatch-private-icon-assets-"),
+    );
+    let closeDatabase: (() => Promise<void>) | undefined;
+    try {
+      vi.stubEnv("A2A_SECRET", "example-dispatch-shared-secret");
+      vi.stubEnv("APP_URL", "https://dispatch.example.test");
+      vi.stubEnv("DATABASE_URL", `pglite:${databaseDir}`);
+      const { closeDbExec, getDbExec } = await import("@agent-native/core/db");
+      closeDatabase = closeDbExec;
+      const db = getDbExec();
+      await db.execute(
+        "CREATE TABLE organizations (id TEXT PRIMARY KEY, allowed_domain TEXT)",
+      );
+      await db.execute({
+        sql: "INSERT INTO organizations (id, allowed_domain) VALUES (?, ?)",
+        args: ["dispatch-org", null],
+      });
 
-    const token = (aud: string) => {
-      const now = Math.floor(Date.now() / 1000);
-      const head = Buffer.from(
-        JSON.stringify({ alg: "HS256", typ: "JWT" }),
-      ).toString("base64url");
-      const body = Buffer.from(
-        JSON.stringify({
-          sub: "owner@example.test",
-          iss: "https://content.example.test",
-          aud,
-          scope: "private-icon:read",
-          org_id: "dispatch-org",
-          asset_id: id,
-          iat: now,
-          exp: now + 60,
-        }),
-      ).toString("base64url");
-      const unsigned = `${head}.${body}`;
-      const signature = createHmac("sha256", "example-dispatch-shared-secret")
-        .update(unsigned)
-        .digest("base64url");
-      return `${unsigned}.${signature}`;
-    };
+      const { verifyA2AToken } = await vi.importActual<
+        typeof import("@agent-native/core/a2a")
+      >("@agent-native/core/a2a");
+      mocks.verifyA2AToken.mockImplementation(verifyA2AToken);
 
-    const withToken = (value: string) => {
-      const requestEvent = event("GET");
-      requestEvent.req = new Request(requestEvent.url, {
-        headers: { authorization: `Bearer ${value}` },
-      });
-      return requestEvent;
-    };
+      const token = (aud: string) => {
+        const now = Math.floor(Date.now() / 1000);
+        const head = Buffer.from(
+          JSON.stringify({ alg: "HS256", typ: "JWT" }),
+        ).toString("base64url");
+        const body = Buffer.from(
+          JSON.stringify({
+            sub: "owner@example.test",
+            iss: "https://content.example.test",
+            aud,
+            scope: "private-icon:read",
+            org_id: "dispatch-org",
+            asset_id: id,
+            iat: now,
+            exp: now + 60,
+          }),
+        ).toString("base64url");
+        const unsigned = `${head}.${body}`;
+        const signature = createHmac("sha256", "example-dispatch-shared-secret")
+          .update(unsigned)
+          .digest("base64url");
+        return `${unsigned}.${signature}`;
+      };
+
+      const withToken = (value: string) => {
+        const requestEvent = event("GET");
+        requestEvent.req = new Request(requestEvent.url, {
+          headers: { authorization: `Bearer ${value}` },
+        });
+        return requestEvent;
+      };
 
-    try {
       const handler = createPrivateIconAssetsHandler();
       expect(
         (
@@ -492,7 +511,12 @@ describe("Dispatch private icon assets", () => {
         ).status,
       ).toBe(200);
     } finally {
-      vi.unstubAllEnvs();
+      try {
+        await closeDatabase?.();
+      } finally {
+        vi.unstubAllEnvs();
+        fs.rmSync(databaseDir, { recursive: true, force: true });
+      }
     }
   }, 20_000);
 });