@agent-native/dispatch 0.40.40 → 0.40.41-beta-dispatch-embed-01a15dc9-20261027050558

package/dist/server/lib/community-apps.js

@@ -33,7 +33,7 @@ export const CURATED_COMMUNITY_APP_SOURCES = [
             },
             {
                 path: "actions/generate-qr-code.spec.ts",
-                blobSha: "3459217b7252c6ee0076c68cfdb83001cc74f29e",
+                blobSha: "42a1a84ecb421e1e6435cc2e7fd00e2f4f2e1ea9",
             },
             {
                 path: "actions/generate-qr-code.ts",

package/dist/server/lib/community-apps.js.map

@@ -1 +1 @@
-{"version":3,"file":"community-apps.js","sourceRoot":"","sources":["../../../src/server/lib/community-apps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,gCAAgC,EAChC,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAK1D,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oCAAoC,GAErC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAqB7B,MAAM,CAAC,MAAM,6BAA6B,GACxC;IACE;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,0DAA0D;QACvE,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,wBAAwB;QAC9B,GAAG,EAAE,MAAM;QACX,OAAO,EAAE,KAAK;QACd,UAAU,EACR,mFAAmF;QACrF,YAAY,EAAE,wBAAwB;QACtC,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,kCAAkC;gBACxC,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,0CAA0C;aACpD;SACF;KACF;CACF,CAAC;AAEJ,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,6BAA6B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CACnE,CAAC;AAEF,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,mEAAmE,EAAE;YACxE,SAAS,EAAE,8BAA8B;YACzC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAc;IAEd,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;AACzE,CAAC;AAED,SAAS,iCAAiC,CAAC,KAAa;IACtD,MAAM,KAAK,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,2BAA2B,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;QACrE,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzC,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,EACvC,CAAC;QACD,IAAI,CAAC,0DAA0D,EAAE;YAC/D,SAAS,EAAE,sCAAsC;YACjD,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB;IACpC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,sDAAsD,EAAE;YAC3D,SAAS,EAAE,kCAAkC;YAC7C,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,kBAAkB,EAAE;QACrE,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,mEAAmE,EAAE;YACxE,SAAS,EAAE,6BAA6B;YACxC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,YAAY,GAAG,yBAAyB,EAAE;IAE1C,IAAI,YAAY;QAAE,OAAO,OAAO,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAG5C,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC;IACjD,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QACtE,sBAAsB,CAAC,YAAY,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,YAAY,GAChB,SAAS,EAAE,iBAAiB,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC;QACnD,MAAM,wBAAwB,GAAG,SAAS;YACxC,CAAC,CAAC,UAAU;gBACV,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,SAAS;YACb,CAAC,CAAC,CAAC,kBAAkB;gBACnB,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,CAAC,YAAY;oBACb,CAAC,CAAC,4BAA4B;oBAC9B,CAAC,CAAC,SAAS,CAAC;QAClB,OAAO;YACL,GAAG,MAAM;YACT,SAAS,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC;YAC5C,OAAO;YACP,WAAW,EAAE,YAAY,IAAI,kBAAkB,IAAI,CAAC,SAAS;YAC7D,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,CAAC,qBAAqB,KAAK,sBAAsB,EAAE;QACrD,SAAS,EAAE,2BAA2B;QACtC,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAiC,EACjC,GAAwB;IAExB,OAAO;QACL,IAAI,EACF,GAAG,CAAC,MAAM,KAAK,SAAS;YACtB,CAAC,CAAE,SAAmB;YACtB,CAAC,CAAE,mBAA6B;QACpC,MAAM;QACN,GAAG,EAAE;YACH,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO;YAC7B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;YACpC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;SACnC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,MAAiC,EACjC,KAAa;IAEb,MAAM,SAAS,GAAG,sBAAsB,MAAM,CAAC,IAAI,SAAS,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IAChG,OAAO;QACL,qEAAqE;QACrE,+CAA+C,SAAS,6JAA6J;QACrN,6BAA6B,KAAK,GAAG;QACrC,mBAAmB,MAAM,CAAC,OAAO,iBAAiB,MAAM,CAAC,UAAU,EAAE;QACrE,6TAA6T;KAC9T,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAGhD;IAUC,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,kEAAkE,EAAE;YACvE,SAAS,EAAE,8BAA8B;YACzC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,CACf,MAAM,iBAAiB,CAAC;QACtB,iBAAiB,EAAE,KAAK;QACxB,eAAe,EAAE,IAAI;KACtB,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,iBAAiB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAC7C,OAAO,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,CACF,gIAAgI,EAChI;YACE,SAAS,EAAE,sCAAsC;YACjD,UAAU,EAAE,GAAG;SAChB,CACF,CAAC;IACJ,CAAC;IAED,IAAI,WAEH,CAAC;IACF,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,oCAAoC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CACF,kFAAkF,EAClF;YACE,SAAS,EACP,0BAA0B,CAAC,KAAK,CAAC,KAAK,WAAW;gBAC/C,CAAC,CAAC,mCAAmC;gBACrC,CAAC,CAAC,8BAA8B;YACpC,UAAU,EAAE,GAAG;SAChB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;QAC7C,MAAM,EAAE,2BAA2B,CAAC,MAAM,EAAE,KAAK,CAAC;QAClD,KAAK;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,iBAAiB,EAAE,MAAM,CAAC,EAAE;QAC5B,WAAW;KACZ,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,CACZ,MAAM,iBAAiB,CAAC;YACtB,iBAAiB,EAAE,KAAK;YACxB,eAAe,EAAE,IAAI;SACtB,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3C,OAAO,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,KAAK;YAAE,4BAA4B,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,2CAA2C;QACnD,UAAU,EAAE,eAAe;QAC3B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,aAAa,MAAM,CAAC,IAAI,6BAA6B;QAC9D,QAAQ,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAClD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB;KACF,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAEzB,CAAC;AACJ,CAAC","sourcesContent":["import { fail } from \"@agent-native/core/action\";\nimport { getUserLabEnabled } from \"@agent-native/core/labs/server\";\nimport {\n  getWorkspaceAppIdValidationError,\n  normalizeWorkspaceAppId,\n} from \"@agent-native/core/shared\";\nimport {\n  BUILTIN_AGENT_CATALOG_IDS,\n  HIDDEN_FIRST_PARTY_AGENT_IDS,\n} from \"@agent-native/core/shared/first-party-agents\";\n\nimport { COMMUNITY_APPS_LAB } from \"../../shared/labs.js\";\nimport type {\n  StartWorkspaceAppCreationResult,\n  WorkspaceAppSummary,\n} from \"./app-creation-store.js\";\nimport {\n  getAppCreationSettings,\n  getWorkspaceInfo,\n  isLocalAppCreationRuntime,\n  listWorkspaceApps,\n  startWorkspaceAppCreation,\n} from \"./app-creation-store.js\";\nimport {\n  loadPinnedCommunitySourceAttachments,\n  type PinnedCommunitySource,\n} from \"./community-source.js\";\nimport { CURATED_WORKSPACE_TEMPLATES } from \"./curated-workspace-templates.js\";\nimport {\n  currentOrgId,\n  currentOwnerEmail,\n  recordAudit,\n} from \"./dispatch-store.js\";\n\nexport interface CuratedCommunityAppSource extends PinnedCommunitySource {\n  id: string;\n  name: string;\n  description: string;\n  appId: string;\n  license: string;\n  provenance: string;\n}\n\nexport interface CuratedCommunityApp extends CuratedCommunityAppSource {\n  installed: boolean;\n  pending: boolean;\n  installable: boolean;\n  installUnavailableReason?:\n    | \"workspace-required\"\n    | \"app-id-conflict\"\n    | \"builder-install-unverified\";\n}\n\nexport const CURATED_COMMUNITY_APP_SOURCES: readonly CuratedCommunityAppSource[] =\n  [\n    {\n      id: \"community-qr\",\n      name: \"QR\",\n      description: \"Generate public PNG or SVG QR images from links or text.\",\n      appId: \"community-qr\",\n      repo: \"BuilderIO/agent-native\",\n      ref: \"main\",\n      license: \"MIT\",\n      provenance:\n        \"Reviewed Agent-Native Framework template, sanitized for independent installation.\",\n      templatePath: \"templates/community/qr\",\n      files: [\n        {\n          path: \"AGENTS.md\",\n          blobSha: \"7dc9e18bc426dfd21526f91225cc615759450816\",\n        },\n        {\n          path: \"LICENSE\",\n          blobSha: \"69c7182efb3eb1a8b7f6fd5989f3e4fd737d0645\",\n        },\n        {\n          path: \"README.md\",\n          blobSha: \"e05e72bb9213732f56ccbc96f7dcb1c3a064cb19\",\n        },\n        {\n          path: \"actions/generate-qr-code.spec.ts\",\n          blobSha: \"3459217b7252c6ee0076c68cfdb83001cc74f29e\",\n        },\n        {\n          path: \"actions/generate-qr-code.ts\",\n          blobSha: \"98d30e218bfed796d5e402d5ce19a8626d8da0cf\",\n        },\n        {\n          path: \"actions/run.ts\",\n          blobSha: \"b46ab15b667c34741364ba08f010f7aca9d0f02e\",\n        },\n        {\n          path: \"agent-native.json\",\n          blobSha: \"accc32476792b84557f69e2b48b317c27b5546dc\",\n        },\n        {\n          path: \"package.json\",\n          blobSha: \"5815e6665e06176df9954183e89b234acf5c5c37\",\n        },\n        {\n          path: \"server/db/index.ts\",\n          blobSha: \"17007b456530f75a72e7209bdfe9f4bd4c9224e0\",\n        },\n        {\n          path: \"server/db/schema.ts\",\n          blobSha: \"2e4cd01c5f46463e78bc7beb6e954f3e526c0b57\",\n        },\n        {\n          path: \"server/plugins/db.ts\",\n          blobSha: \"78a5b431c1ad1ea14f593123c090f5376a36df10\",\n        },\n        {\n          path: \"tsconfig.json\",\n          blobSha: \"5267473a32dcab8e5dc2c9d9a720afed7f40174c\",\n        },\n      ],\n    },\n  ];\n\nconst communitySourceById = new Map(\n  CURATED_COMMUNITY_APP_SOURCES.map((source) => [source.id, source]),\n);\n\nfunction requireCommunitySource(sourceId: string): CuratedCommunityAppSource {\n  const source = communitySourceById.get(sourceId.trim());\n  if (!source) {\n    fail(\"That community app is not in Dispatch's reviewed install catalog.\", {\n      errorCode: \"unknown_community_app_source\",\n      statusCode: 404,\n    });\n  }\n  return source;\n}\n\nfunction communitySourceFailureKind(\n  error: unknown,\n): \"unavailable\" | \"integrity\" {\n  if (!(error instanceof Error) || !(\"failureKind\" in error)) {\n    return \"unavailable\";\n  }\n  return error.failureKind === \"integrity\" ? \"integrity\" : \"unavailable\";\n}\n\nfunction requireNonShadowingCommunityAppId(appId: string): void {\n  const error = getWorkspaceAppIdValidationError(appId);\n  if (error) {\n    fail(error, { errorCode: \"invalid_community_app_id\", statusCode: 400 });\n  }\n  if (\n    CURATED_WORKSPACE_TEMPLATES.some((template) => template.id === appId) ||\n    BUILTIN_AGENT_CATALOG_IDS.includes(appId) ||\n    HIDDEN_FIRST_PARTY_AGENT_IDS.has(appId)\n  ) {\n    fail(\"Community apps cannot use a first-party template app id.\", {\n      errorCode: \"community_app_id_shadows_first_party\",\n      statusCode: 409,\n    });\n  }\n}\n\nasync function requireCommunityAppsLab(): Promise<void> {\n  const userEmail = currentOwnerEmail().trim();\n  const orgId = currentOrgId();\n  if (!userEmail || !orgId) {\n    fail(\"Sign in to an organization to browse community apps.\", {\n      errorCode: \"community_apps_identity_required\",\n      statusCode: 403,\n    });\n  }\n  const enabled = await getUserLabEnabled(userEmail, COMMUNITY_APPS_LAB, {\n    orgId,\n  });\n  if (!enabled) {\n    fail(\"Community app catalog and installs are disabled for this account.\", {\n      errorCode: \"community_apps_lab_disabled\",\n      statusCode: 403,\n    });\n  }\n}\n\nasync function hasAssociatedWorkspace(\n  localRuntime = isLocalAppCreationRuntime(),\n): Promise<boolean> {\n  if (localRuntime) return Boolean(getWorkspaceInfo().rootPath);\n  return Boolean((await getAppCreationSettings()).builderProjectId);\n}\n\nexport async function listCuratedCommunityApps(): Promise<\n  CuratedCommunityApp[]\n> {\n  await requireCommunityAppsLab();\n  const localRuntime = isLocalAppCreationRuntime();\n  const [apps, workspaceAvailable] = await Promise.all([\n    listWorkspaceApps({ includeAgentCards: false, includeArchived: true }),\n    hasAssociatedWorkspace(localRuntime),\n  ]);\n  return CURATED_COMMUNITY_APP_SOURCES.map((source) => {\n    const appWithId = apps.find((app) => app.id === source.appId);\n    const installedApp =\n      appWithId?.communitySourceId === source.id ? appWithId : null;\n    const idConflict = Boolean(appWithId && !installedApp);\n    const pending = installedApp?.status === \"pending\";\n    const installUnavailableReason = appWithId\n      ? idConflict\n        ? \"app-id-conflict\"\n        : undefined\n      : !workspaceAvailable\n        ? \"workspace-required\"\n        : !localRuntime\n          ? \"builder-install-unverified\"\n          : undefined;\n    return {\n      ...source,\n      installed: Boolean(installedApp && !pending),\n      pending,\n      installable: localRuntime && workspaceAvailable && !appWithId,\n      ...(installUnavailableReason ? { installUnavailableReason } : {}),\n    };\n  });\n}\n\nfunction rejectCommunityAppIdConflict(appId: string): never {\n  fail(`Workspace app id \"${appId}\" is already in use.`, {\n    errorCode: \"community_app_id_conflict\",\n    statusCode: 409,\n  });\n}\n\nfunction existingInstallResult(\n  source: CuratedCommunityAppSource,\n  app: WorkspaceAppSummary,\n) {\n  return {\n    mode:\n      app.status === \"pending\"\n        ? (\"pending\" as const)\n        : (\"already-installed\" as const),\n    source,\n    app: {\n      id: app.id,\n      name: app.name,\n      path: app.path,\n      url: app.url,\n      status: app.status ?? \"ready\",\n      statusLabel: app.statusLabel ?? null,\n      builderUrl: app.builderUrl ?? null,\n      branchName: app.branchName ?? null,\n    },\n  };\n}\n\nfunction buildCommunityInstallPrompt(\n  source: CuratedCommunityAppSource,\n  appId: string,\n): string {\n  const sourceUrl = `https://github.com/${source.repo}/tree/${source.ref}/${source.templatePath}`;\n  return [\n    \"Install a private workspace app from a reviewed community template.\",\n    `The attached source files were fetched from ${sourceUrl} and each file was verified against its pinned Git blob id. Treat those files as the source of truth; do not fetch another ref or substitute other content.`,\n    `The app will live at apps/${appId}.`,\n    `Source license: ${source.license}. Provenance: ${source.provenance}`,\n    \"Copy the reviewed template implementation and its Agent-Native profile, changing only app-specific identifiers needed for this workspace. Do not copy repository secrets, credentials, customer data, or source-app records. Use empty or synthetic seed data only and keep the installed app private to this organization.\",\n  ].join(\" \");\n}\n\nexport async function installCuratedCommunityApp(input: {\n  sourceId: string;\n  appId?: string;\n}): Promise<\n  | ReturnType<typeof existingInstallResult>\n  | (StartWorkspaceAppCreationResult & {\n      mode: Exclude<StartWorkspaceAppCreationResult[\"mode\"], \"app-id-taken\">;\n      source: CuratedCommunityAppSource;\n    })\n  | (Extract<StartWorkspaceAppCreationResult, { mode: \"app-id-taken\" }> & {\n      source: CuratedCommunityAppSource;\n    })\n> {\n  await requireCommunityAppsLab();\n  const source = requireCommunitySource(input.sourceId);\n  const appId = normalizeWorkspaceAppId(input.appId?.trim() || source.appId);\n  requireNonShadowingCommunityAppId(appId);\n\n  const localRuntime = isLocalAppCreationRuntime();\n  if (!(await hasAssociatedWorkspace(localRuntime))) {\n    fail(\"Connect this organization to a workspace before installing apps.\", {\n      errorCode: \"community_workspace_required\",\n      statusCode: 409,\n    });\n  }\n\n  const existing = (\n    await listWorkspaceApps({\n      includeAgentCards: false,\n      includeArchived: true,\n    })\n  ).find((app) => app.id === appId);\n  if (existing) {\n    if (existing.communitySourceId === source.id) {\n      return existingInstallResult(source, existing);\n    }\n    rejectCommunityAppIdConflict(appId);\n  }\n\n  if (!localRuntime) {\n    fail(\n      \"Community template installs in Builder workspaces are disabled until the generated branch files can be read back and verified.\",\n      {\n        errorCode: \"community_builder_install_unverified\",\n        statusCode: 503,\n      },\n    );\n  }\n\n  let attachments: Awaited<\n    ReturnType<typeof loadPinnedCommunitySourceAttachments>\n  >;\n  try {\n    attachments = await loadPinnedCommunitySourceAttachments(source, appId);\n  } catch (error) {\n    fail(\n      \"Dispatch could not verify the pinned community template source. Try again later.\",\n      {\n        errorCode:\n          communitySourceFailureKind(error) === \"integrity\"\n            ? \"community_source_integrity_failed\"\n            : \"community_source_unavailable\",\n        statusCode: 503,\n      },\n    );\n  }\n\n  const result = await startWorkspaceAppCreation({\n    prompt: buildCommunityInstallPrompt(source, appId),\n    appId,\n    description: source.description,\n    template: source.id,\n    communitySourceId: source.id,\n    attachments,\n  });\n\n  if (result.mode === \"app-id-taken\") {\n    const raced = (\n      await listWorkspaceApps({\n        includeAgentCards: false,\n        includeArchived: true,\n      })\n    ).find((app) => app.id === appId);\n    if (raced?.communitySourceId === source.id) {\n      return existingInstallResult(source, raced);\n    }\n    if (raced) rejectCommunityAppIdConflict(appId);\n    return { ...result, source };\n  }\n\n  await recordAudit({\n    action: \"workspace-app.community-install-requested\",\n    targetType: \"workspace-app\",\n    targetId: appId,\n    summary: `Requested ${source.name} community app installation`,\n    metadata: {\n      sourceId: source.id,\n      repo: source.repo,\n      ref: source.ref,\n      blobShas: source.files.map((file) => file.blobSha),\n      license: source.license,\n    },\n  });\n  return { ...result, source } as typeof result & {\n    source: CuratedCommunityAppSource;\n  };\n}\n"]}
+{"version":3,"file":"community-apps.js","sourceRoot":"","sources":["../../../src/server/lib/community-apps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,gCAAgC,EAChC,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAK1D,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oCAAoC,GAErC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAqB7B,MAAM,CAAC,MAAM,6BAA6B,GACxC;IACE;QACE,EAAE,EAAE,cAAc;QAClB,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,0DAA0D;QACvE,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,wBAAwB;QAC9B,GAAG,EAAE,MAAM;QACX,OAAO,EAAE,KAAK;QACd,UAAU,EACR,mFAAmF;QACrF,YAAY,EAAE,wBAAwB;QACtC,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,kCAAkC;gBACxC,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,0CAA0C;aACpD;YACD;gBACE,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,0CAA0C;aACpD;SACF;KACF;CACF,CAAC;AAEJ,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,6BAA6B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CACnE,CAAC;AAEF,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC,mEAAmE,EAAE;YACxE,SAAS,EAAE,8BAA8B;YACzC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,0BAA0B,CACjC,KAAc;IAEd,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;AACzE,CAAC;AAED,SAAS,iCAAiC,CAAC,KAAa;IACtD,MAAM,KAAK,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IACtD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,2BAA2B,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC;QACrE,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzC,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,EACvC,CAAC;QACD,IAAI,CAAC,0DAA0D,EAAE;YAC/D,SAAS,EAAE,sCAAsC;YACjD,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB;IACpC,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,sDAAsD,EAAE;YAC3D,SAAS,EAAE,kCAAkC;YAC7C,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,kBAAkB,EAAE;QACrE,KAAK;KACN,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,mEAAmE,EAAE;YACxE,SAAS,EAAE,6BAA6B;YACxC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,YAAY,GAAG,yBAAyB,EAAE;IAE1C,IAAI,YAAY;QAAE,OAAO,OAAO,CAAC,gBAAgB,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,OAAO,CAAC,CAAC,MAAM,sBAAsB,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAG5C,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC;IACjD,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;QACtE,sBAAsB,CAAC,YAAY,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,YAAY,GAChB,SAAS,EAAE,iBAAiB,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,YAAY,EAAE,MAAM,KAAK,SAAS,CAAC;QACnD,MAAM,wBAAwB,GAAG,SAAS;YACxC,CAAC,CAAC,UAAU;gBACV,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,SAAS;YACb,CAAC,CAAC,CAAC,kBAAkB;gBACnB,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,CAAC,YAAY;oBACb,CAAC,CAAC,4BAA4B;oBAC9B,CAAC,CAAC,SAAS,CAAC;QAClB,OAAO;YACL,GAAG,MAAM;YACT,SAAS,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC;YAC5C,OAAO;YACP,WAAW,EAAE,YAAY,IAAI,kBAAkB,IAAI,CAAC,SAAS;YAC7D,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAa;IACjD,IAAI,CAAC,qBAAqB,KAAK,sBAAsB,EAAE;QACrD,SAAS,EAAE,2BAA2B;QACtC,UAAU,EAAE,GAAG;KAChB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAiC,EACjC,GAAwB;IAExB,OAAO;QACL,IAAI,EACF,GAAG,CAAC,MAAM,KAAK,SAAS;YACtB,CAAC,CAAE,SAAmB;YACtB,CAAC,CAAE,mBAA6B;QACpC,MAAM;QACN,GAAG,EAAE;YACH,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,OAAO;YAC7B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;YACpC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;SACnC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,MAAiC,EACjC,KAAa;IAEb,MAAM,SAAS,GAAG,sBAAsB,MAAM,CAAC,IAAI,SAAS,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IAChG,OAAO;QACL,qEAAqE;QACrE,+CAA+C,SAAS,6JAA6J;QACrN,6BAA6B,KAAK,GAAG;QACrC,mBAAmB,MAAM,CAAC,OAAO,iBAAiB,MAAM,CAAC,UAAU,EAAE;QACrE,6TAA6T;KAC9T,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAGhD;IAUC,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,iCAAiC,CAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,YAAY,GAAG,yBAAyB,EAAE,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,kEAAkE,EAAE;YACvE,SAAS,EAAE,8BAA8B;YACzC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,CACf,MAAM,iBAAiB,CAAC;QACtB,iBAAiB,EAAE,KAAK;QACxB,eAAe,EAAE,IAAI;KACtB,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,iBAAiB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAC7C,OAAO,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,CACF,gIAAgI,EAChI;YACE,SAAS,EAAE,sCAAsC;YACjD,UAAU,EAAE,GAAG;SAChB,CACF,CAAC;IACJ,CAAC;IAED,IAAI,WAEH,CAAC;IACF,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,oCAAoC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CACF,kFAAkF,EAClF;YACE,SAAS,EACP,0BAA0B,CAAC,KAAK,CAAC,KAAK,WAAW;gBAC/C,CAAC,CAAC,mCAAmC;gBACrC,CAAC,CAAC,8BAA8B;YACpC,UAAU,EAAE,GAAG;SAChB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;QAC7C,MAAM,EAAE,2BAA2B,CAAC,MAAM,EAAE,KAAK,CAAC;QAClD,KAAK;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,iBAAiB,EAAE,MAAM,CAAC,EAAE;QAC5B,WAAW;KACZ,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,CACZ,MAAM,iBAAiB,CAAC;YACtB,iBAAiB,EAAE,KAAK;YACxB,eAAe,EAAE,IAAI;SACtB,CAAC,CACH,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QAClC,IAAI,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;YAC3C,OAAO,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,KAAK;YAAE,4BAA4B,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,WAAW,CAAC;QAChB,MAAM,EAAE,2CAA2C;QACnD,UAAU,EAAE,eAAe;QAC3B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,aAAa,MAAM,CAAC,IAAI,6BAA6B;QAC9D,QAAQ,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;YAClD,OAAO,EAAE,MAAM,CAAC,OAAO;SACxB;KACF,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAEzB,CAAC;AACJ,CAAC","sourcesContent":["import { fail } from \"@agent-native/core/action\";\nimport { getUserLabEnabled } from \"@agent-native/core/labs/server\";\nimport {\n  getWorkspaceAppIdValidationError,\n  normalizeWorkspaceAppId,\n} from \"@agent-native/core/shared\";\nimport {\n  BUILTIN_AGENT_CATALOG_IDS,\n  HIDDEN_FIRST_PARTY_AGENT_IDS,\n} from \"@agent-native/core/shared/first-party-agents\";\n\nimport { COMMUNITY_APPS_LAB } from \"../../shared/labs.js\";\nimport type {\n  StartWorkspaceAppCreationResult,\n  WorkspaceAppSummary,\n} from \"./app-creation-store.js\";\nimport {\n  getAppCreationSettings,\n  getWorkspaceInfo,\n  isLocalAppCreationRuntime,\n  listWorkspaceApps,\n  startWorkspaceAppCreation,\n} from \"./app-creation-store.js\";\nimport {\n  loadPinnedCommunitySourceAttachments,\n  type PinnedCommunitySource,\n} from \"./community-source.js\";\nimport { CURATED_WORKSPACE_TEMPLATES } from \"./curated-workspace-templates.js\";\nimport {\n  currentOrgId,\n  currentOwnerEmail,\n  recordAudit,\n} from \"./dispatch-store.js\";\n\nexport interface CuratedCommunityAppSource extends PinnedCommunitySource {\n  id: string;\n  name: string;\n  description: string;\n  appId: string;\n  license: string;\n  provenance: string;\n}\n\nexport interface CuratedCommunityApp extends CuratedCommunityAppSource {\n  installed: boolean;\n  pending: boolean;\n  installable: boolean;\n  installUnavailableReason?:\n    | \"workspace-required\"\n    | \"app-id-conflict\"\n    | \"builder-install-unverified\";\n}\n\nexport const CURATED_COMMUNITY_APP_SOURCES: readonly CuratedCommunityAppSource[] =\n  [\n    {\n      id: \"community-qr\",\n      name: \"QR\",\n      description: \"Generate public PNG or SVG QR images from links or text.\",\n      appId: \"community-qr\",\n      repo: \"BuilderIO/agent-native\",\n      ref: \"main\",\n      license: \"MIT\",\n      provenance:\n        \"Reviewed Agent-Native Framework template, sanitized for independent installation.\",\n      templatePath: \"templates/community/qr\",\n      files: [\n        {\n          path: \"AGENTS.md\",\n          blobSha: \"7dc9e18bc426dfd21526f91225cc615759450816\",\n        },\n        {\n          path: \"LICENSE\",\n          blobSha: \"69c7182efb3eb1a8b7f6fd5989f3e4fd737d0645\",\n        },\n        {\n          path: \"README.md\",\n          blobSha: \"e05e72bb9213732f56ccbc96f7dcb1c3a064cb19\",\n        },\n        {\n          path: \"actions/generate-qr-code.spec.ts\",\n          blobSha: \"42a1a84ecb421e1e6435cc2e7fd00e2f4f2e1ea9\",\n        },\n        {\n          path: \"actions/generate-qr-code.ts\",\n          blobSha: \"98d30e218bfed796d5e402d5ce19a8626d8da0cf\",\n        },\n        {\n          path: \"actions/run.ts\",\n          blobSha: \"b46ab15b667c34741364ba08f010f7aca9d0f02e\",\n        },\n        {\n          path: \"agent-native.json\",\n          blobSha: \"accc32476792b84557f69e2b48b317c27b5546dc\",\n        },\n        {\n          path: \"package.json\",\n          blobSha: \"5815e6665e06176df9954183e89b234acf5c5c37\",\n        },\n        {\n          path: \"server/db/index.ts\",\n          blobSha: \"17007b456530f75a72e7209bdfe9f4bd4c9224e0\",\n        },\n        {\n          path: \"server/db/schema.ts\",\n          blobSha: \"2e4cd01c5f46463e78bc7beb6e954f3e526c0b57\",\n        },\n        {\n          path: \"server/plugins/db.ts\",\n          blobSha: \"78a5b431c1ad1ea14f593123c090f5376a36df10\",\n        },\n        {\n          path: \"tsconfig.json\",\n          blobSha: \"5267473a32dcab8e5dc2c9d9a720afed7f40174c\",\n        },\n      ],\n    },\n  ];\n\nconst communitySourceById = new Map(\n  CURATED_COMMUNITY_APP_SOURCES.map((source) => [source.id, source]),\n);\n\nfunction requireCommunitySource(sourceId: string): CuratedCommunityAppSource {\n  const source = communitySourceById.get(sourceId.trim());\n  if (!source) {\n    fail(\"That community app is not in Dispatch's reviewed install catalog.\", {\n      errorCode: \"unknown_community_app_source\",\n      statusCode: 404,\n    });\n  }\n  return source;\n}\n\nfunction communitySourceFailureKind(\n  error: unknown,\n): \"unavailable\" | \"integrity\" {\n  if (!(error instanceof Error) || !(\"failureKind\" in error)) {\n    return \"unavailable\";\n  }\n  return error.failureKind === \"integrity\" ? \"integrity\" : \"unavailable\";\n}\n\nfunction requireNonShadowingCommunityAppId(appId: string): void {\n  const error = getWorkspaceAppIdValidationError(appId);\n  if (error) {\n    fail(error, { errorCode: \"invalid_community_app_id\", statusCode: 400 });\n  }\n  if (\n    CURATED_WORKSPACE_TEMPLATES.some((template) => template.id === appId) ||\n    BUILTIN_AGENT_CATALOG_IDS.includes(appId) ||\n    HIDDEN_FIRST_PARTY_AGENT_IDS.has(appId)\n  ) {\n    fail(\"Community apps cannot use a first-party template app id.\", {\n      errorCode: \"community_app_id_shadows_first_party\",\n      statusCode: 409,\n    });\n  }\n}\n\nasync function requireCommunityAppsLab(): Promise<void> {\n  const userEmail = currentOwnerEmail().trim();\n  const orgId = currentOrgId();\n  if (!userEmail || !orgId) {\n    fail(\"Sign in to an organization to browse community apps.\", {\n      errorCode: \"community_apps_identity_required\",\n      statusCode: 403,\n    });\n  }\n  const enabled = await getUserLabEnabled(userEmail, COMMUNITY_APPS_LAB, {\n    orgId,\n  });\n  if (!enabled) {\n    fail(\"Community app catalog and installs are disabled for this account.\", {\n      errorCode: \"community_apps_lab_disabled\",\n      statusCode: 403,\n    });\n  }\n}\n\nasync function hasAssociatedWorkspace(\n  localRuntime = isLocalAppCreationRuntime(),\n): Promise<boolean> {\n  if (localRuntime) return Boolean(getWorkspaceInfo().rootPath);\n  return Boolean((await getAppCreationSettings()).builderProjectId);\n}\n\nexport async function listCuratedCommunityApps(): Promise<\n  CuratedCommunityApp[]\n> {\n  await requireCommunityAppsLab();\n  const localRuntime = isLocalAppCreationRuntime();\n  const [apps, workspaceAvailable] = await Promise.all([\n    listWorkspaceApps({ includeAgentCards: false, includeArchived: true }),\n    hasAssociatedWorkspace(localRuntime),\n  ]);\n  return CURATED_COMMUNITY_APP_SOURCES.map((source) => {\n    const appWithId = apps.find((app) => app.id === source.appId);\n    const installedApp =\n      appWithId?.communitySourceId === source.id ? appWithId : null;\n    const idConflict = Boolean(appWithId && !installedApp);\n    const pending = installedApp?.status === \"pending\";\n    const installUnavailableReason = appWithId\n      ? idConflict\n        ? \"app-id-conflict\"\n        : undefined\n      : !workspaceAvailable\n        ? \"workspace-required\"\n        : !localRuntime\n          ? \"builder-install-unverified\"\n          : undefined;\n    return {\n      ...source,\n      installed: Boolean(installedApp && !pending),\n      pending,\n      installable: localRuntime && workspaceAvailable && !appWithId,\n      ...(installUnavailableReason ? { installUnavailableReason } : {}),\n    };\n  });\n}\n\nfunction rejectCommunityAppIdConflict(appId: string): never {\n  fail(`Workspace app id \"${appId}\" is already in use.`, {\n    errorCode: \"community_app_id_conflict\",\n    statusCode: 409,\n  });\n}\n\nfunction existingInstallResult(\n  source: CuratedCommunityAppSource,\n  app: WorkspaceAppSummary,\n) {\n  return {\n    mode:\n      app.status === \"pending\"\n        ? (\"pending\" as const)\n        : (\"already-installed\" as const),\n    source,\n    app: {\n      id: app.id,\n      name: app.name,\n      path: app.path,\n      url: app.url,\n      status: app.status ?? \"ready\",\n      statusLabel: app.statusLabel ?? null,\n      builderUrl: app.builderUrl ?? null,\n      branchName: app.branchName ?? null,\n    },\n  };\n}\n\nfunction buildCommunityInstallPrompt(\n  source: CuratedCommunityAppSource,\n  appId: string,\n): string {\n  const sourceUrl = `https://github.com/${source.repo}/tree/${source.ref}/${source.templatePath}`;\n  return [\n    \"Install a private workspace app from a reviewed community template.\",\n    `The attached source files were fetched from ${sourceUrl} and each file was verified against its pinned Git blob id. Treat those files as the source of truth; do not fetch another ref or substitute other content.`,\n    `The app will live at apps/${appId}.`,\n    `Source license: ${source.license}. Provenance: ${source.provenance}`,\n    \"Copy the reviewed template implementation and its Agent-Native profile, changing only app-specific identifiers needed for this workspace. Do not copy repository secrets, credentials, customer data, or source-app records. Use empty or synthetic seed data only and keep the installed app private to this organization.\",\n  ].join(\" \");\n}\n\nexport async function installCuratedCommunityApp(input: {\n  sourceId: string;\n  appId?: string;\n}): Promise<\n  | ReturnType<typeof existingInstallResult>\n  | (StartWorkspaceAppCreationResult & {\n      mode: Exclude<StartWorkspaceAppCreationResult[\"mode\"], \"app-id-taken\">;\n      source: CuratedCommunityAppSource;\n    })\n  | (Extract<StartWorkspaceAppCreationResult, { mode: \"app-id-taken\" }> & {\n      source: CuratedCommunityAppSource;\n    })\n> {\n  await requireCommunityAppsLab();\n  const source = requireCommunitySource(input.sourceId);\n  const appId = normalizeWorkspaceAppId(input.appId?.trim() || source.appId);\n  requireNonShadowingCommunityAppId(appId);\n\n  const localRuntime = isLocalAppCreationRuntime();\n  if (!(await hasAssociatedWorkspace(localRuntime))) {\n    fail(\"Connect this organization to a workspace before installing apps.\", {\n      errorCode: \"community_workspace_required\",\n      statusCode: 409,\n    });\n  }\n\n  const existing = (\n    await listWorkspaceApps({\n      includeAgentCards: false,\n      includeArchived: true,\n    })\n  ).find((app) => app.id === appId);\n  if (existing) {\n    if (existing.communitySourceId === source.id) {\n      return existingInstallResult(source, existing);\n    }\n    rejectCommunityAppIdConflict(appId);\n  }\n\n  if (!localRuntime) {\n    fail(\n      \"Community template installs in Builder workspaces are disabled until the generated branch files can be read back and verified.\",\n      {\n        errorCode: \"community_builder_install_unverified\",\n        statusCode: 503,\n      },\n    );\n  }\n\n  let attachments: Awaited<\n    ReturnType<typeof loadPinnedCommunitySourceAttachments>\n  >;\n  try {\n    attachments = await loadPinnedCommunitySourceAttachments(source, appId);\n  } catch (error) {\n    fail(\n      \"Dispatch could not verify the pinned community template source. Try again later.\",\n      {\n        errorCode:\n          communitySourceFailureKind(error) === \"integrity\"\n            ? \"community_source_integrity_failed\"\n            : \"community_source_unavailable\",\n        statusCode: 503,\n      },\n    );\n  }\n\n  const result = await startWorkspaceAppCreation({\n    prompt: buildCommunityInstallPrompt(source, appId),\n    appId,\n    description: source.description,\n    template: source.id,\n    communitySourceId: source.id,\n    attachments,\n  });\n\n  if (result.mode === \"app-id-taken\") {\n    const raced = (\n      await listWorkspaceApps({\n        includeAgentCards: false,\n        includeArchived: true,\n      })\n    ).find((app) => app.id === appId);\n    if (raced?.communitySourceId === source.id) {\n      return existingInstallResult(source, raced);\n    }\n    if (raced) rejectCommunityAppIdConflict(appId);\n    return { ...result, source };\n  }\n\n  await recordAudit({\n    action: \"workspace-app.community-install-requested\",\n    targetType: \"workspace-app\",\n    targetId: appId,\n    summary: `Requested ${source.name} community app installation`,\n    metadata: {\n      sourceId: source.id,\n      repo: source.repo,\n      ref: source.ref,\n      blobShas: source.files.map((file) => file.blobSha),\n      license: source.license,\n    },\n  });\n  return { ...result, source } as typeof result & {\n    source: CuratedCommunityAppSource;\n  };\n}\n"]}

package/dist/server/lib/mcp-gateway.d.ts

@@ -6,6 +6,7 @@ export interface DispatchMcpAccessibleApp {
     description: string;
     url: string;
     homeUrl?: string;
+    mcpUrl?: string;
     color: string;
     granted: boolean;
 }

package/dist/server/lib/mcp-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-gateway.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,2BAA2B,EAChC,KAAK,IAAI,EACV,MAAM,wBAAwB,CAAC;AA+BhC,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,uBAAuB,CAAC;AA8B/B,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AA2DD,KAAK,uBAAuB,GAAG,2BAA2B,CAAC;AAiC3D,KAAK,iCAAiC,GAClC,WAAW,GACX,SAAS,GACT,cAAc,GACd,cAAc,CAAC;AAEnB,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,iBAAS,wBAAwB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE;IACR,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GACA,wBAAwB,CA8C1B;AAiaD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;CAClC,CAAC,CAcD;AAED,wBAAsB,0BAA0B,IAAI,OAAO,CACzD,wBAAwB,EAAE,CAC3B,CAGA;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG1E;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAwBnC;AAqFD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAqDtD;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC,CAoEnC;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC,CAkDD;AAoTD,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAWD;AA0FD,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAwCD"}
+{"version":3,"file":"mcp-gateway.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EASL,KAAK,2BAA2B,EAChC,KAAK,IAAI,EACV,MAAM,wBAAwB,CAAC;AAkChC,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,uBAAuB,CAAC;AA8B/B,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AA2DD,KAAK,uBAAuB,GAAG,2BAA2B,CAAC;AAiC3D,KAAK,iCAAiC,GAClC,WAAW,GACX,SAAS,GACT,cAAc,GACd,cAAc,CAAC;AAEnB,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,KAAK,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,aAAa,CAAC,EAAE,iCAAiC,CAAC;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,SAAS,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,iBAAS,wBAAwB,CAC/B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE;IACR,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GACA,wBAAwB,CA8C1B;AA4dD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;CAClC,CAAC,CAcD;AAED,wBAAsB,0BAA0B,IAAI,OAAO,CACzD,wBAAwB,EAAE,CAC3B,CAGA;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAG1E;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAwBnC;AAuFD,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,OAAO,CAAC,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAC,CAqDtD;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC,CAoEnC;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC,CAkDD;AA2XD,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAWD;AAqHD,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CAwCD"}

package/dist/server/lib/mcp-gateway.js

@@ -1,9 +1,11 @@
-import { A2AClient, canonicalA2AAudience, extractA2APersistedMutationReceipts, getGlobalA2ASecret, signA2AOrganizationToken, signA2AToken, stripA2APersistedArtifactMarkers, } from "@agent-native/core/a2a";
+import { A2AClient, canonicalA2AAudience, extractA2APersistedMutationReceipts, getGlobalA2ASecret, signA2AOrgMemberDelegationToken, signA2AOrganizationToken, signA2AToken, stripA2APersistedArtifactMarkers, } from "@agent-native/core/a2a";
+import { getAppConfig } from "@agent-native/core/app-config";
 import { isFeatureFlagEnabled } from "@agent-native/core/feature-flags";
 import { buildMcpToolName, McpClientManager, } from "@agent-native/core/mcp-client";
 import { getOrgA2ASecret, getOrgDomain } from "@agent-native/core/org";
-import { buildDeepLink, buildEmbedStartPath, createEmbedSessionTicket, getRequestContext, getRequestOrgId, getRequestUserEmail, } from "@agent-native/core/server";
+import { buildDeepLink, buildEmbedStartPath, createEmbedSessionTicket, getConfiguredAppBasePath, getRequestContext, getRequestOrgId, getRequestUserEmail, } from "@agent-native/core/server";
 import { discoverAgents, getBuiltinAgents, } from "@agent-native/core/server/agent-discovery";
+import { EMBED_START_PATH } from "@agent-native/core/shared";
 import { DESKTOP_WORKSPACE_SSO_FLAG } from "../../shared/feature-flags.js";
 import { DISPATCH_WORKSPACE_SSO_FLAG, isWorkspaceSsoAppUrl, } from "../../shared/workspace-sso.js";
 import { listWorkspaceApps } from "./app-creation-store.js";
@@ -424,11 +426,61 @@ function appHomeBaseUrl(app) {
     }
     return appBaseUrl(app);
 }
+function workspaceGatewayMcpUrl(appUrl) {
+    const configuredGateway = getAppConfig().workspace.gatewayUrl?.trim();
+    if (!configuredGateway)
+        return undefined;
+    let configuredUrl;
+    try {
+        configuredUrl = new URL(configuredGateway);
+    }
+    catch {
+        throw new Error("WORKSPACE_GATEWAY_URL must be a valid absolute HTTP(S) URL.");
+    }
+    if (configuredUrl.protocol !== "http:" &&
+        configuredUrl.protocol !== "https:") {
+        throw new Error("WORKSPACE_GATEWAY_URL must use http or https.");
+    }
+    const gateway = new URL(projectEnvironmentUrl(configuredUrl.toString()));
+    if (gateway.protocol !== "http:" && gateway.protocol !== "https:") {
+        throw new Error("WORKSPACE_GATEWAY_URL must use http or https.");
+    }
+    const target = new URL(appUrl);
+    if (gateway.origin !== target.origin)
+        return undefined;
+    const configuredBasePath = getConfiguredAppBasePath();
+    const gatewayPath = gateway.pathname.replace(/\/+$/, "");
+    const basePath = configuredBasePath &&
+        gatewayPath !== configuredBasePath &&
+        !gatewayPath.startsWith(`${configuredBasePath}/`)
+        ? `${configuredBasePath}${gatewayPath}`
+        : gatewayPath;
+    gateway.pathname = `${basePath}/mcp`;
+    gateway.search = "";
+    gateway.hash = "";
+    return gateway.toString().replace(/\/$/, "");
+}
+function appMcpUrl(app) {
+    const explicit = app.mcpUrl?.trim();
+    return (explicit?.replace(/\/+$/, "") ??
+        workspaceGatewayMcpUrl(app.url) ??
+        `${appHomeBaseUrl(app)}/mcp`);
+}
+function appMcpBaseUrl(app) {
+    const url = new URL(appMcpUrl(app));
+    url.pathname = url.pathname.replace(/\/mcp\/?$/, "") || "/";
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/$/, "");
+}
 function resolveGrantedAppEmbedStartUrl(app, startUrl) {
     try {
-        const baseUrl = appHomeBaseUrl(app);
+        const baseUrl = appMcpBaseUrl(app);
         const resolved = new URL(startUrl, `${baseUrl}/`);
-        if (!appMatchesUrlPath(app, resolved)) {
+        const base = new URL(baseUrl);
+        const basePath = base.pathname.replace(/\/+$/, "");
+        const expectedPath = `${basePath}${EMBED_START_PATH}`;
+        if (resolved.origin !== base.origin || resolved.pathname !== expectedPath) {
             throw new Error("Target app returned an embed start URL outside the granted app.");
         }
         return resolved.toString();
@@ -565,11 +617,13 @@ async function listWorkspaceSsoApps() {
     for (const app of mountedApps) {
         if (app.isDispatch || !app.url)
             continue;
+        const mcpUrl = workspaceGatewayMcpUrl(app.url);
         candidatesById.set(app.id, {
             id: app.id,
             name: app.name,
             description: app.description,
             url: app.url,
+            ...(mcpUrl ? { mcpUrl } : {}),
             color: DISPATCH_COLOR,
             granted: true,
         });
@@ -834,13 +888,16 @@ function isRetryableTargetMcpError(error) {
     return /streamable http|handshake|failed to fetch|fetch failed|networkerror|econnrefused|enotfound|timed out|timeout/i.test(message);
 }
 function targetMcpErrorStatus(error) {
+    const status = httpStatusFromError(error);
+    if (status !== undefined)
+        return status;
     const message = error instanceof Error
         ? error.message
         : typeof error === "string"
             ? error
             : safeJson(error);
-    const status = message.match(/\b([45]\d{2})\b/)?.[1];
-    return status ? Number(status) : undefined;
+    const matchedStatus = message.match(/\b([45]\d{2})\b/)?.[1];
+    return matchedStatus ? Number(matchedStatus) : undefined;
 }
 function targetMcpRequestDetails(input) {
     const targetUrl = new URL(input.url);
@@ -855,6 +912,20 @@ function targetMcpConnectTimeout(deadline) {
     const budget = Math.min(TARGET_EMBED_SESSION_CONNECT_TIMEOUT_MS, remaining);
     return Math.max(1000, budget);
 }
+class TargetMcpAuthenticationRejectedError extends Error {
+    status;
+    constructor(cause) {
+        super("Target MCP authentication was rejected", { cause });
+        this.name = "TargetMcpAuthenticationRejectedError";
+        const status = httpStatusFromError(cause) ?? targetMcpErrorStatus(cause);
+        if (status !== undefined)
+            this.status = status;
+    }
+}
+function isTargetMcpAuthenticationRejected(error) {
+    const status = httpStatusFromError(error);
+    return status === 401 || status === 403;
+}
 function targetMcpRetryDelay(attempt) {
     const base = TARGET_EMBED_SESSION_RETRY_BASE_MS * Math.pow(2, Math.max(0, attempt - 1));
     return base + Math.floor(Math.random() * 100);
@@ -867,21 +938,35 @@ async function callTargetCreateEmbedSession(input) {
             servers: {
                 [serverId]: {
                     type: "http",
-                    url: `${appHomeBaseUrl(input.app)}/mcp`,
+                    url: appMcpUrl(input.app),
                     headers: {
                         Authorization: `Bearer ${input.token}`,
                     },
                 },
             },
         }, { connectTimeoutMs: targetMcpConnectTimeout(deadline) });
+        let connected = false;
         try {
             await manager.start();
+            const connectErrorStatus = manager.getConnectErrorStatus(serverId);
+            if (connectErrorStatus === 401 || connectErrorStatus === 403) {
+                const error = Object.assign(new Error(`HTTP ${connectErrorStatus}`), {
+                    status: connectErrorStatus,
+                });
+                throw new TargetMcpAuthenticationRejectedError(error);
+            }
+            connected = true;
             return await manager.callTool(buildMcpToolName(serverId, "create_embed_session"), {
                 url: input.url,
                 chrome: input.chrome ?? "full",
             });
         }
         catch (error) {
+            if (!connected &&
+                !(error instanceof TargetMcpAuthenticationRejectedError) &&
+                isTargetMcpAuthenticationRejected(error)) {
+                throw new TargetMcpAuthenticationRejectedError(error);
+            }
             if (attempt >= TARGET_EMBED_SESSION_ATTEMPTS ||
                 !isRetryableTargetMcpError(error) ||
                 deadline - Date.now() < TARGET_EMBED_SESSION_RETRY_BASE_MS) {
@@ -896,17 +981,42 @@ async function callTargetCreateEmbedSession(input) {
         }
     }
 }
-async function createTargetMcpUserToken(input) {
-    if (!getGlobalA2ASecret()) {
-        throw new Error("Cross-app embed sessions require A2A_SECRET to preserve the authenticated user identity; an organization-only A2A credential cannot create a user-owned session.");
+async function createTargetMcpUserCredentials(input) {
+    const audience = canonicalA2AAudience(appMcpUrl(input.target));
+    const orgDomain = input.orgId
+        ? (await getOrgDomain(input.orgId))?.trim().toLowerCase() || undefined
+        : undefined;
+    const credentials = [];
+    if (getGlobalA2ASecret()) {
+        credentials.push({
+            strategy: "deployment-user",
+            token: await signA2AToken(input.ownerEmail, undefined, undefined, {
+                expiresIn: "5m",
+                audience,
+                preferGlobalSecret: true,
+            }),
+        });
     }
-    const audience = canonicalA2AAudience(`${appHomeBaseUrl(input.target)}/mcp`);
-    return signA2AToken(input.ownerEmail, undefined, undefined, {
-        expiresIn: "5m",
-        audience,
-        preferGlobalSecret: true,
-        ...(input.orgId ? { extraClaims: { org_id: input.orgId } } : {}),
-    });
+    const loadOrgMemberCredential = async () => {
+        if (!input.orgId || !orgDomain)
+            return undefined;
+        const orgSecret = await getOrgA2ASecret(input.orgId);
+        if (!orgSecret)
+            return undefined;
+        return {
+            strategy: "org-member-delegation",
+            token: await signA2AOrgMemberDelegationToken(input.ownerEmail, orgDomain, orgSecret, audience),
+        };
+    };
+    if (credentials.length === 0) {
+        const orgMemberCredential = await loadOrgMemberCredential();
+        if (orgMemberCredential)
+            credentials.push(orgMemberCredential);
+    }
+    if (credentials.length === 0) {
+        throw new Error("Cross-app embed sessions require a deployment A2A secret or an organization secret with member delegation enabled on the target.");
+    }
+    return { credentials, loadOrgMemberCredential };
 }
 async function resolveEmbedTarget(input, options) {
     const explicitApp = input.app?.trim()
@@ -1008,9 +1118,9 @@ async function createEmbedSessionForResolvedApp(input) {
             chrome,
         });
     }
-    const targetToken = await createTargetMcpUserToken({
+    const targetCredentials = await createTargetMcpUserCredentials({
         ownerEmail,
-        orgId,
+        ...(orgId !== undefined ? { orgId } : {}),
         target: target.app,
     });
     const targetDetails = targetMcpRequestDetails({
@@ -1018,28 +1128,50 @@ async function createEmbedSessionForResolvedApp(input) {
         url: target.url,
     });
     let parsed;
-    console.info("[dispatch] workspace embed target request", {
-        ...targetDetails,
-        authStrategy: "user-identity",
-    });
-    try {
-        const result = await callTargetCreateEmbedSession({
-            app: target.app,
-            token: targetToken,
-            url: target.url,
-            chrome,
-        });
-        parsed = parseMcpToolTextResult(result);
-    }
-    catch (error) {
-        console.warn("[dispatch] workspace embed target response", {
+    const credentials = [...targetCredentials.credentials];
+    for (const [index, credential] of credentials.entries()) {
+        console.info("[dispatch] workspace embed target request", {
             ...targetDetails,
-            authStrategy: "user-identity",
-            status: targetMcpErrorStatus(error),
-            category: isRetryableTargetMcpError(error) ? "transient" : "permanent",
+            authStrategy: credential.strategy,
         });
-        throw error;
+        try {
+            const result = await callTargetCreateEmbedSession({
+                app: target.app,
+                token: credential.token,
+                url: target.url,
+                ...(chrome !== undefined ? { chrome } : {}),
+            });
+            parsed = parseMcpToolTextResult(result);
+            break;
+        }
+        catch (error) {
+            if (error instanceof TargetMcpAuthenticationRejectedError &&
+                credential.strategy === "deployment-user" &&
+                index === credentials.length - 1) {
+                const orgMemberCredential = await targetCredentials.loadOrgMemberCredential();
+                if (orgMemberCredential)
+                    credentials.push(orgMemberCredential);
+            }
+            if (error instanceof TargetMcpAuthenticationRejectedError &&
+                index < credentials.length - 1) {
+                console.warn("[dispatch] workspace embed auth candidate rejected", {
+                    ...targetDetails,
+                    authStrategy: credential.strategy,
+                    status: targetMcpErrorStatus(error),
+                });
+                continue;
+            }
+            console.warn("[dispatch] workspace embed target response", {
+                ...targetDetails,
+                authStrategy: credential.strategy,
+                status: targetMcpErrorStatus(error),
+                category: isRetryableTargetMcpError(error) ? "transient" : "permanent",
+            });
+            throw error;
+        }
     }
+    if (!parsed)
+        throw new Error("Target app did not return an embed session.");
     if (!parsed.startUrl) {
         throw new Error("Target app did not return an embed start URL.");
     }