@agent-native/dispatch 0.6.1 → 0.7.0

package/dist/server/lib/vault-store.d.ts

@@ -1,3 +1,11 @@
+import { type SecretScope } from "@agent-native/core/secrets";
+import { schema } from "../../db/index.js";
+export type VaultAccessMode = "all-apps" | "manual";
+export interface VaultAccessSettings {
+    mode: VaultAccessMode;
+    scope: "org" | "user";
+    scopeId: string;
+}
 /**
  * Caller-supplied access context for vault operations.
  *
@@ -17,6 +25,10 @@ export interface VaultCtx {
  * leaked rows across tenants when a misconfigured environment skipped auth.
  */
 export declare function requireVaultCtx(): VaultCtx;
+export declare function getVaultAccessSettings(): Promise<VaultAccessSettings>;
+export declare function setVaultAccessSettings(input: {
+    mode: VaultAccessMode;
+}): Promise<VaultAccessSettings>;
 export declare function recordVaultAudit(input: {
     action: string;
     secretId?: string | null;
@@ -149,6 +161,12 @@ export declare function createGrant(secretId: string, appId: string, ctx?: Vault
 }>;
 export declare function grantSecretsToApp(secretIds: string[], appId: string, ctx?: VaultCtx): Promise<{
     appId: string;
+    accessMode: "all-apps";
+    created: any[];
+    skipped: string[];
+} | {
+    appId: string;
+    accessMode: "manual";
     created: any[];
     skipped: string[];
 }>;
@@ -164,10 +182,43 @@ export declare function revokeGrant(grantId: string, ctx?: VaultCtx): Promise<{
     createdAt: number;
     updatedAt: number;
 }>;
+type VaultSecretRow = typeof schema.vaultSecrets.$inferSelect;
+export declare function credentialStoreScopeForVaultCtx(ctx: VaultCtx): {
+    scope: Extract<SecretScope, "org" | "workspace">;
+    scopeId: string;
+};
+export declare function syncSecretsToCredentialStore(secrets: VaultSecretRow[], ctx: VaultCtx): Promise<{
+    keys: string[];
+    scope: Extract<SecretScope, "org" | "workspace">;
+    scopeId: string;
+}>;
 export declare function syncGrantsToApp(appId: string, ctx?: VaultCtx): Promise<{
     appId: string;
+    accessMode: VaultAccessMode;
+    synced: number;
+    keys: any[];
+    credentialStore?: undefined;
+    envVars?: undefined;
+} | {
+    appId: string;
+    accessMode: VaultAccessMode;
     synced: number;
     keys: string[];
+    credentialStore: {
+        scope: "org" | "workspace";
+        scopeId: string;
+        synced: number;
+    };
+    envVars: {
+        status: "synced";
+        keys: string[];
+    } | {
+        status: "skipped";
+        reason: string;
+    } | {
+        status: "failed";
+        reason: string;
+    };
 }>;
 export declare function listRequests(filter?: {
     status?: string;
@@ -259,12 +310,16 @@ export interface AppIntegrations {
     url: string;
     color: string;
     integrations: IntegrationEntry[];
+    vaultAccessMode: VaultAccessMode;
     reachable: boolean;
 }
 export declare function listIntegrationsCatalog(): Promise<AppIntegrations[]>;
 export declare function listVaultOverview(): Promise<{
+    accessMode: VaultAccessMode;
     secretCount: number;
     activeGrantCount: number;
+    manualGrantCount: number;
     pendingRequestCount: number;
 }>;
+export {};
 //# sourceMappingURL=vault-store.d.ts.map

package/dist/server/lib/vault-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/vault-store.ts"],"names":[],"mappings":"AAUA;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,QAAQ,CAM1C;AA6CD,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,iBAcA;AAED,wBAAsB,cAAc,CAAC,KAAK,SAAK;;;;;;;;;;;KAQ9C;AAID,wBAAsB,WAAW;;;;;;;;;;;;KAOhC;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ;;;;;;;;;;;;GAa9D;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE;IACL,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,EACD,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAoClC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAuBlC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAqClC;AAID,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;;;;;;;;;;;KAcA;AAED,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,QAA4B;;;;;;;;;;;GAclC;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;GAuClC;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;GAyBlC;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,QAA4B;;;;;;;;;;;GAkClC;AAID,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;GA6DlC;AAID,wBAAsB,YAAY,CAAC,MAAM,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;KAW9D;AAED,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAclC;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;;;;;;;;;;;;;GA+BA;AAED,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAoElC;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAmClC;AAID,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAwE1E;AAID,wBAAsB,iBAAiB;;;;GAYtC"}
+{"version":3,"file":"vault-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/vault-store.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAO9E,OAAO,EAAS,MAAM,EAAE,MAAM,mBAAmB,CAAC;AASlD,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEpD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,QAAQ;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,QAAQ,CAM1C;AAqDD,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAU3E;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,IAAI,EAAE,eAAe,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmB/B;AAID,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,iBAcA;AAED,wBAAsB,cAAc,CAAC,KAAK,SAAK;;;;;;;;;;;KAQ9C;AAID,wBAAsB,WAAW;;;;;;;;;;;;KAOhC;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ;;;;;;;;;;;;GAa9D;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE;IACL,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,EACD,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAqFlC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAuBlC;AAED,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,GAAE,QAA4B;;;;;;;;;;;;GAqClC;AAID,wBAAsB,UAAU,CAAC,MAAM,CAAC,EAAE;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;;;;;;;;;;;KAcA;AAED,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,QAA4B;;;;;;;;;;;GAclC;AAED,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;GAuClC;AAED,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;GAkClC;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,GAAG,GAAE,QAA4B;;;;;;;;;;;GAkClC;AAID,KAAK,cAAc,GAAG,OAAO,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC;AAE9D,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,QAAQ,GAAG;IAC9D,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;CACjB,CAGA;AAED,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,cAAc,EAAE,EACzB,GAAG,EAAE,QAAQ;;WATN,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,WAAW,CAAC;aACvC,MAAM;GA0BhB;AAID,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,QAA4B;;;;;;;;;;;;;;;;;;gBAyCnB,QAAQ;cAAQ,MAAM,EAAE;;gBACxB,SAAS;gBAAU,MAAM;;gBACzB,QAAQ;gBAAU,MAAM;;GAqEvC;AAID,wBAAsB,YAAY,CAAC,MAAM,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;KAW9D;AAED,wBAAsB,UAAU,CAC9B,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAclC;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;;;;;;;;;;;;;GA+BA;AAED,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAoElC;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,EACtB,GAAG,GAAE,QAA4B;;;;;;;;;;;;;GAmClC;AAID,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,eAAe,EAAE,eAAe,CAAC;IACjC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CA8E1E;AAID,wBAAsB,iBAAiB;;;;;;GAiBtC"}

package/dist/server/lib/vault-store.js

@@ -1,8 +1,11 @@
 import crypto from "node:crypto";
 import { and, desc, eq, isNull, or } from "drizzle-orm";
 import { discoverAgents } from "@agent-native/core/server/agent-discovery";
+import { writeAppSecret } from "@agent-native/core/secrets";
+import { getOrgSetting, getUserSetting, putOrgSetting, putUserSetting, } from "@agent-native/core/settings";
 import { getDb, schema } from "../../db/index.js";
 import { currentOwnerEmail, currentOrgId, recordAudit, } from "./dispatch-store.js";
+const VAULT_ACCESS_SETTINGS_KEY = "dispatch-vault-access-settings";
 /**
  * Build a VaultCtx from the current request. Throws if the request is
  * unauthenticated — the previous behavior of falling back to "local@localhost"
@@ -17,7 +20,10 @@ export function requireVaultCtx() {
 }
 /** WHERE clause that limits a vault row to the caller's ownership scope. */
 function ctxScope(table, ctx) {
-    return or(eq(table.ownerEmail, ctx.ownerEmail), ctx.orgId ? eq(table.orgId, ctx.orgId) : isNull(table.orgId));
+    if (!ctx.orgId) {
+        return and(eq(table.ownerEmail, ctx.ownerEmail), isNull(table.orgId));
+    }
+    return or(eq(table.ownerEmail, ctx.ownerEmail), eq(table.orgId, ctx.orgId));
 }
 /** Build a ctx that scopes to a specific row's owner/org (used when a
  * request approver acts on behalf of the original requester so the
@@ -34,9 +40,50 @@ function now() {
 function safeJson(value) {
     return JSON.stringify(value ?? null);
 }
-function orgFilter(table) {
+function scopedFilter(table) {
+    return ctxScope(table, requireVaultCtx());
+}
+function normalizeCredentialKey(value) {
+    return value.trim();
+}
+function vaultAccessScope() {
     const orgId = currentOrgId();
-    return and(eq(table.ownerEmail, currentOwnerEmail()), orgId ? eq(table.orgId, orgId) : isNull(table.orgId));
+    if (orgId)
+        return { scope: "org", scopeId: orgId };
+    return { scope: "user", scopeId: currentOwnerEmail() };
+}
+function parseVaultAccessMode(value) {
+    return value === "manual" ? "manual" : "all-apps";
+}
+export async function getVaultAccessSettings() {
+    const scope = vaultAccessScope();
+    const raw = scope.scope === "org"
+        ? await getOrgSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY)
+        : await getUserSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY);
+    return {
+        ...scope,
+        mode: parseVaultAccessMode(raw?.mode),
+    };
+}
+export async function setVaultAccessSettings(input) {
+    const scope = vaultAccessScope();
+    const next = { mode: parseVaultAccessMode(input.mode) };
+    if (scope.scope === "org") {
+        await putOrgSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY, next);
+    }
+    else {
+        await putUserSetting(scope.scopeId, VAULT_ACCESS_SETTINGS_KEY, next);
+    }
+    await recordAudit({
+        action: "vault.access-settings.updated",
+        targetType: "vault-settings",
+        targetId: VAULT_ACCESS_SETTINGS_KEY,
+        summary: next.mode === "all-apps"
+            ? "Set vault access to all workspace apps"
+            : "Set vault access to manual per-app grants",
+        metadata: next,
+    });
+    return getVaultAccessSettings();
 }
 // ─── Vault Audit ──────────────────────────────────────────────────
 export async function recordVaultAudit(input) {
@@ -59,7 +106,7 @@ export async function listVaultAudit(limit = 50) {
     return db
         .select()
         .from(schema.vaultAuditLog)
-        .where(orgFilter(schema.vaultAuditLog))
+        .where(scopedFilter(schema.vaultAuditLog))
         .orderBy(desc(schema.vaultAuditLog.createdAt))
         .limit(limit);
 }
@@ -69,7 +116,7 @@ export async function listSecrets() {
     return db
         .select()
         .from(schema.vaultSecrets)
-        .where(orgFilter(schema.vaultSecrets))
+        .where(scopedFilter(schema.vaultSecrets))
         .orderBy(desc(schema.vaultSecrets.updatedAt));
 }
 export async function getSecret(secretId, ctx) {
@@ -84,6 +131,41 @@ export async function getSecret(secretId, ctx) {
 export async function createSecret(input, ctx = requireVaultCtx()) {
     const db = getDb();
     const timestamp = now();
+    const credentialKey = normalizeCredentialKey(input.credentialKey);
+    if (!credentialKey)
+        throw new Error("Credential key is required");
+    const existing = await db
+        .select()
+        .from(schema.vaultSecrets)
+        .where(and(eq(schema.vaultSecrets.credentialKey, credentialKey), ctxScope(schema.vaultSecrets, ctx)))
+        .orderBy(desc(schema.vaultSecrets.updatedAt))
+        .limit(1);
+    if (existing[0]) {
+        await db
+            .update(schema.vaultSecrets)
+            .set({
+            name: input.name,
+            credentialKey,
+            value: input.value,
+            provider: input.provider || null,
+            description: input.description || null,
+            updatedAt: timestamp,
+        })
+            .where(and(eq(schema.vaultSecrets.id, existing[0].id), ctxScope(schema.vaultSecrets, ctx)));
+        await recordVaultAudit({
+            action: "secret.updated",
+            secretId: existing[0].id,
+            summary: `Updated secret "${input.name}" (${credentialKey})`,
+            metadata: { credentialKey, provider: input.provider },
+        });
+        await recordAudit({
+            action: "vault.secret.updated",
+            targetType: "vault-secret",
+            targetId: existing[0].id,
+            summary: `Updated vault secret "${input.name}" (${credentialKey})`,
+        });
+        return getSecret(existing[0].id, ctx);
+    }
     const secretId = id();
     const actor = ctx.ownerEmail;
     await db.insert(schema.vaultSecrets).values({
@@ -91,7 +173,7 @@ export async function createSecret(input, ctx = requireVaultCtx()) {
         ownerEmail: actor,
         orgId: ctx.orgId,
         name: input.name,
-        credentialKey: input.credentialKey,
+        credentialKey,
         value: input.value,
         provider: input.provider || null,
         description: input.description || null,
@@ -102,14 +184,14 @@ export async function createSecret(input, ctx = requireVaultCtx()) {
     await recordVaultAudit({
         action: "secret.created",
         secretId,
-        summary: `Created secret "${input.name}" (${input.credentialKey})`,
-        metadata: { credentialKey: input.credentialKey, provider: input.provider },
+        summary: `Created secret "${input.name}" (${credentialKey})`,
+        metadata: { credentialKey, provider: input.provider },
     });
     await recordAudit({
         action: "vault.secret.created",
         targetType: "vault-secret",
         targetId: secretId,
-        summary: `Created vault secret "${input.name}" (${input.credentialKey})`,
+        summary: `Created vault secret "${input.name}" (${credentialKey})`,
     });
     return getSecret(secretId, ctx);
 }
@@ -160,7 +242,7 @@ export async function deleteSecret(secretId, ctx = requireVaultCtx()) {
 // ─── Grants ──────────────────────────────────────────────────────
 export async function listGrants(filter) {
     const db = getDb();
-    const conditions = [orgFilter(schema.vaultGrants)];
+    const conditions = [scopedFilter(schema.vaultGrants)];
     if (filter?.secretId) {
         conditions.push(eq(schema.vaultGrants.secretId, filter.secretId));
     }
@@ -218,7 +300,16 @@ export async function createGrant(secretId, appId, ctx = requireVaultCtx()) {
     return getGrant(grantId);
 }
 export async function grantSecretsToApp(secretIds, appId, ctx = requireVaultCtx()) {
+    const access = await getVaultAccessSettings();
     const uniqueSecretIds = Array.from(new Set(secretIds));
+    if (access.mode === "all-apps") {
+        return {
+            appId,
+            accessMode: access.mode,
+            created: [],
+            skipped: uniqueSecretIds,
+        };
+    }
     const existingActive = (await listGrants({ appId })).filter((grant) => grant.status === "active");
     const existingSecretIds = new Set(existingActive.map((grant) => grant.secretId));
     const created = [];
@@ -234,7 +325,7 @@ export async function grantSecretsToApp(secretIds, appId, ctx = requireVaultCtx(
             existingSecretIds.add(secretId);
         }
     }
-    return { appId, created, skipped };
+    return { appId, accessMode: access.mode, created, skipped };
 }
 export async function revokeGrant(grantId, ctx = requireVaultCtx()) {
     const db = getDb();
@@ -261,43 +352,92 @@ export async function revokeGrant(grantId, ctx = requireVaultCtx()) {
     });
     return getGrant(grantId, ctx);
 }
+export function credentialStoreScopeForVaultCtx(ctx) {
+    if (ctx.orgId)
+        return { scope: "org", scopeId: ctx.orgId };
+    return { scope: "workspace", scopeId: `solo:${ctx.ownerEmail}` };
+}
+export async function syncSecretsToCredentialStore(secrets, ctx) {
+    const target = credentialStoreScopeForVaultCtx(ctx);
+    const syncedKeys = [];
+    for (const secret of secrets) {
+        if (!secret.credentialKey || !secret.value)
+            continue;
+        await writeAppSecret({
+            key: secret.credentialKey,
+            value: secret.value,
+            scope: target.scope,
+            scopeId: target.scopeId,
+            description: `Synced from Dispatch vault: ${secret.name}`,
+        });
+        syncedKeys.push(secret.credentialKey);
+    }
+    return { ...target, keys: syncedKeys };
+}
 // ─── Sync ──────────────────────────────────────────────────────
 export async function syncGrantsToApp(appId, ctx = requireVaultCtx()) {
     const db = getDb();
+    const access = await getVaultAccessSettings();
     const agents = await discoverAgents("dispatch");
     const agent = agents.find((a) => a.id === appId);
     if (!agent)
         throw new Error(`App "${appId}" not found in agent registry`);
-    const grants = await listGrants({ appId });
-    const activeGrants = grants.filter((g) => g.status === "active");
-    if (activeGrants.length === 0) {
-        return { appId, synced: 0, keys: [] };
+    const secretsToSync = [];
+    const activeGrants = access.mode === "manual"
+        ? (await listGrants({ appId })).filter((g) => g.status === "active")
+        : [];
+    if (access.mode === "all-apps") {
+        const secrets = await listSecrets();
+        for (const secret of secrets) {
+            secretsToSync.push(secret);
+        }
     }
-    // Resolve secret values for each grant
-    const vars = [];
-    for (const grant of activeGrants) {
-        const secret = await getSecret(grant.secretId, ctx);
-        if (secret) {
-            vars.push({ key: secret.credentialKey, value: secret.value });
+    else {
+        for (const grant of activeGrants) {
+            const secret = await getSecret(grant.secretId, ctx);
+            if (secret) {
+                secretsToSync.push(secret);
+            }
         }
     }
-    if (vars.length === 0) {
-        return { appId, synced: 0, keys: [] };
+    if (secretsToSync.length === 0) {
+        return { appId, accessMode: access.mode, synced: 0, keys: [] };
     }
-    // Push to the app's env-vars endpoint
-    const res = await fetch(`${agent.url}/_agent-native/env-vars`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ vars }),
-    });
-    if (!res.ok) {
-        const err = await res.text().catch(() => "Unknown error");
-        throw new Error(`Failed to sync to ${appId}: ${err}`);
+    const credentialStoreSync = await syncSecretsToCredentialStore(secretsToSync, ctx);
+    const vars = secretsToSync.map((secret) => ({
+        key: secret.credentialKey,
+        value: secret.value,
+    }));
+    let envVarSync;
+    // Best-effort push to the app's env-vars endpoint for local/dev apps that
+    // still read process.env directly. Production/shared-DB apps intentionally
+    // reject env writes; the encrypted app_secrets sync above is the canonical
+    // path for request-scoped credentials.
+    try {
+        const res = await fetch(`${agent.url}/_agent-native/env-vars`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ vars }),
+        });
+        if (res.ok) {
+            const result = await res.json();
+            envVarSync = { status: "synced", keys: result.saved || [] };
+        }
+        else {
+            const err = await res.text().catch(() => "Unknown error");
+            envVarSync = { status: "skipped", reason: err };
+        }
     }
-    const result = await res.json();
-    const syncedKeys = result.saved || [];
+    catch (err) {
+        envVarSync = {
+            status: "failed",
+            reason: err instanceof Error ? err.message : String(err),
+        };
+    }
+    const syncedKeys = credentialStoreSync.keys;
     const timestamp = now();
-    // Update syncedAt on grants that were successfully pushed
+    // Update syncedAt on grants that were successfully pushed to the shared
+    // credential store. All-apps mode has no explicit grant rows to update.
     for (const grant of activeGrants) {
         const secret = await getSecret(grant.secretId, ctx);
         if (secret && syncedKeys.includes(secret.credentialKey)) {
@@ -311,14 +451,33 @@ export async function syncGrantsToApp(appId, ctx = requireVaultCtx()) {
         action: "secret.synced",
         appId,
         summary: `Synced ${syncedKeys.length} secret(s) to ${appId}: ${syncedKeys.join(", ")}`,
-        metadata: { syncedKeys },
+        metadata: {
+            syncedKeys,
+            accessMode: access.mode,
+            credentialStore: {
+                scope: credentialStoreSync.scope,
+                scopeId: credentialStoreSync.scopeId,
+            },
+            envVars: envVarSync,
+        },
     });
-    return { appId, synced: syncedKeys.length, keys: syncedKeys };
+    return {
+        appId,
+        accessMode: access.mode,
+        synced: syncedKeys.length,
+        keys: syncedKeys,
+        credentialStore: {
+            scope: credentialStoreSync.scope,
+            scopeId: credentialStoreSync.scopeId,
+            synced: credentialStoreSync.keys.length,
+        },
+        envVars: envVarSync,
+    };
 }
 // ─── Requests ──────────────────────────────────────────────────────
 export async function listRequests(filter) {
     const db = getDb();
-    const conditions = [orgFilter(schema.vaultRequests)];
+    const conditions = [scopedFilter(schema.vaultRequests)];
     if (filter?.status) {
         conditions.push(eq(schema.vaultRequests.status, filter.status));
     }
@@ -441,6 +600,7 @@ export async function denyRequest(requestId, reason, ctx = requireVaultCtx()) {
     return getRequest(requestId, ctx);
 }
 export async function listIntegrationsCatalog() {
+    const access = await getVaultAccessSettings();
     const agents = await discoverAgents("dispatch");
     const grants = await listGrants();
     const secrets = await listSecrets();
@@ -458,6 +618,7 @@ export async function listIntegrationsCatalog() {
                     url: agent.url,
                     color: agent.color,
                     integrations: [],
+                    vaultAccessMode: access.mode,
                     reachable: false,
                 });
                 continue;
@@ -472,7 +633,9 @@ export async function listIntegrationsCatalog() {
                     label: env.label,
                     required: env.required,
                     configured: env.configured,
-                    vaultGranted: !!matchingSecret && grantedSecretIds.has(matchingSecret.id),
+                    vaultGranted: !!matchingSecret &&
+                        (access.mode === "all-apps" ||
+                            grantedSecretIds.has(matchingSecret.id)),
                     vaultSecretId: matchingSecret?.id,
                 };
             });
@@ -482,6 +645,7 @@ export async function listIntegrationsCatalog() {
                 url: agent.url,
                 color: agent.color,
                 integrations,
+                vaultAccessMode: access.mode,
                 reachable: true,
             });
         }
@@ -492,6 +656,7 @@ export async function listIntegrationsCatalog() {
                 url: agent.url,
                 color: agent.color,
                 integrations: [],
+                vaultAccessMode: access.mode,
                 reachable: false,
             });
         }
@@ -500,14 +665,18 @@ export async function listIntegrationsCatalog() {
 }
 // ─── Vault Overview (for dashboard) ──────────────────────────────
 export async function listVaultOverview() {
-    const [secrets, grants, requests] = await Promise.all([
+    const [secrets, grants, requests, access] = await Promise.all([
         listSecrets(),
         listGrants(),
         listRequests(),
+        getVaultAccessSettings(),
     ]);
+    const manualGrantCount = grants.filter((g) => g.status === "active").length;
     return {
+        accessMode: access.mode,
         secretCount: secrets.length,
-        activeGrantCount: grants.filter((g) => g.status === "active").length,
+        activeGrantCount: access.mode === "all-apps" ? secrets.length : manualGrantCount,
+        manualGrantCount,
         pendingRequestCount: requests.filter((r) => r.status === "pending").length,
     };
 }