@agent-native/dispatch 0.40.4-nightly-20260930124743 → 0.40.4

package/CHANGELOG.md

@@ -1,13 +1,16 @@
 # @agent-native/dispatch
 
-## 0.40.4-nightly-20260930124743
+## 0.40.4
 
 ### Patch Changes
 
+- 036c2c7: Tighten test-only assertions for the dev auth secret and the Dispatch auth plugin so they fail when the behavior they name breaks. No runtime change.
+- Release all public npm packages with a patch version bump.
+- Updated dependencies
 - Updated dependencies [ce1245c]
-- Updated dependencies [e90dedc]
-  - @agent-native/core@0.198.3-nightly-20260930124743
-  - @agent-native/toolkit@0.198.3-nightly-20260930124743
+- Updated dependencies [e6de282]
+- Updated dependencies [d2b14cf]
+  - @agent-native/toolkit@0.198.3
 
 ## 0.40.3
 
@@ -1077,24 +1080,4 @@
 - Updated dependencies [f07ec04]
   - @agent-native/toolkit@0.15.0
 
-## 0.25.0
-
-### Minor Changes
-
-- 89f194f: Add a default-off Dispatch workspace sign-in rollout for iframe app panes. The
-  flagged path mints short-lived, app-scoped embed sessions for exact first-party
-  origins, explicitly registered custom workspace apps, and same-origin mounted
-  workspace apps without changing the existing MCP access policy.
-- 89f194f: Add folder-backed agent packs with safe Claude/Cowork-style import, agent-owned
-  references and skills, and a shared Factory Agents surface for managing simple
-  agents alongside mounted agentic apps.
-- 89f194f: Add a simple Agents workspace for creating reusable profiles, importing Claude-style or generic agent definitions, and connecting existing HTTP/A2A agents.
-
-### Patch Changes
-
-- 89f194f: Keep visited workspace app frames mounted while switching apps so returning restores live state instantly.
-- 89f194f: Provision cross-app SSO state and authorization-code tables during release migrations so production serverless requests never perform schema DDL.
-- Updated dependencies [89f194f]
-  - @agent-native/toolkit@0.14.3
-
 For the full list of releases, see the [changelog archive](./changelog/archive/CHANGELOG.md).

package/dist/actions/provider-api-register.d.ts

@@ -48,8 +48,9 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
     scope?: "org" | "user" | undefined;
 }, {
     id?: undefined;
-    deleted?: undefined;
+    message?: undefined;
     found?: undefined;
+    deleted?: undefined;
     providers: {
         id: string;
         label: string;
@@ -63,42 +64,41 @@ declare const _default: import("node_modules/@agent-native/core/dist").ActionDef
     provider?: undefined;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
     id?: undefined;
+    message?: undefined;
     deleted?: undefined;
-    count?: undefined;
     providers?: undefined;
+    count?: undefined;
     found: boolean;
     provider: import("node_modules/@agent-native/core/dist/provider-api").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
     deleted?: undefined;
-    count?: undefined;
     providers?: undefined;
+    count?: undefined;
     provider?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
+    message?: undefined;
     found?: undefined;
-    count?: undefined;
     providers?: undefined;
+    count?: undefined;
     provider?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-    message?: undefined;
 } | {
-    deleted?: undefined;
     found?: undefined;
-    count?: undefined;
+    deleted?: undefined;
     providers?: undefined;
+    count?: undefined;
     provider?: undefined;
     registered: boolean;
     id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.40.4-nightly-20260930124743",
+  "version": "0.40.4",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -89,7 +89,7 @@
     "tailwind-merge": "^3.5.0",
     "vaul": "^1.1.2",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "0.198.3-nightly-20260930124743"
+    "@agent-native/toolkit": "0.198.3"
   },
   "devDependencies": {
     "@react-router/dev": "^8.1.0",
@@ -103,10 +103,10 @@
     "typescript-7": "npm:typescript@^7.0.2",
     "vite": "8.1.0",
     "vitest": "^4.1.5",
-    "@agent-native/core": "0.198.3-nightly-20260930124743"
+    "@agent-native/core": "0.198.3"
   },
   "peerDependencies": {
-    "@agent-native/core": "0.198.3-nightly-20260930124743",
+    "@agent-native/core": ">=0.8.0",
     "react": ">=19.2.7",
     "react-dom": ">=19.2.7",
     "react-router": ">=8"

package/src/server/plugins/auth.spec.ts

@@ -37,8 +37,14 @@ describe("dispatchAuthPlugin", () => {
     await dispatchAuthPlugin(nitroApp);
 
     expect(mocks.createAuthPlugin).toHaveBeenCalledOnce();
+    // The template's own public routes must reach the auth guard, and the
+    // Dispatch workspace root must stay public alongside them.
     expect(mocks.createAuthPlugin).toHaveBeenCalledWith(
-      expect.objectContaining({ googleOnly: true, publicPaths }),
+      expect.objectContaining({
+        googleOnly: true,
+        publicPaths,
+        workspaceAppPublicPaths: ["/"],
+      }),
     );
     expect(mocks.authPlugin).toHaveBeenCalledWith(nitroApp);
   });