@agent-native/dispatch 0.8.5 → 0.8.7

package/dist/server/lib/mcp-access-store.js

@@ -0,0 +1,64 @@
+import { getOrgSetting, getUserSetting, putOrgSetting, putUserSetting, } from "@agent-native/core/settings";
+import { getRequestOrgId, getRequestUserEmail, } from "@agent-native/core/server";
+export const MCP_APP_ACCESS_SETTINGS_KEY = "dispatch-mcp-app-access";
+function uniqueAppIds(values) {
+    const input = Array.isArray(values) ? values : [];
+    return Array.from(new Set(input
+        .filter((value) => typeof value === "string")
+        .map((value) => value.trim().toLowerCase())
+        .filter(Boolean)));
+}
+export function normalizeMcpAppAccessSettings(raw) {
+    const record = raw && typeof raw === "object" && !Array.isArray(raw)
+        ? raw
+        : {};
+    const mode = record.mode === "selected-apps" ? "selected-apps" : "all-apps";
+    return {
+        mode,
+        selectedAppIds: uniqueAppIds(record.selectedAppIds),
+        updatedAt: typeof record.updatedAt === "string" ? record.updatedAt : undefined,
+        updatedBy: typeof record.updatedBy === "string" ? record.updatedBy : undefined,
+    };
+}
+function currentAccessScope() {
+    const actor = getRequestUserEmail();
+    if (!actor)
+        throw new Error("no authenticated user");
+    const orgId = getRequestOrgId();
+    if (orgId)
+        return { kind: "org", id: orgId, actor };
+    return { kind: "user", id: actor, actor };
+}
+export async function getDispatchMcpAppAccessSettings() {
+    const scope = currentAccessScope();
+    const raw = scope.kind === "org"
+        ? await getOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY)
+        : await getUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY);
+    return normalizeMcpAppAccessSettings(raw);
+}
+export async function setDispatchMcpAppAccessSettings(input) {
+    const scope = currentAccessScope();
+    const next = {
+        mode: input.mode,
+        selectedAppIds: uniqueAppIds(input.selectedAppIds),
+        updatedAt: new Date().toISOString(),
+        updatedBy: scope.actor,
+    };
+    const value = next;
+    if (scope.kind === "org") {
+        await putOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);
+    }
+    else {
+        await putUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);
+    }
+    return next;
+}
+export function isAppAllowedByMcpAccess(appId, settings) {
+    const normalized = appId.trim().toLowerCase();
+    if (!normalized)
+        return false;
+    if (settings.mode === "all-apps")
+        return true;
+    return settings.selectedAppIds.includes(normalized);
+}
+//# sourceMappingURL=mcp-access-store.js.map

package/dist/server/lib/mcp-access-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-access-store.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-access-store.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,cAAc,EACd,aAAa,EACb,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,CAAC,MAAM,2BAA2B,GAAG,yBAAyB,CAAC;AAiBrE,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CACL,KAAK;SACF,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CACnB,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAAY;IAEZ,MAAM,MAAM,GACV,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;IAC5E,OAAO;QACL,IAAI;QACJ,cAAc,EAAE,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;QACnD,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACrE,SAAS,EACP,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACpD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B;IACnD,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,KAAK;QAClB,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC;QAC5D,CAAC,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAClE,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CAAC,KAGrD;IACC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAiC;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,cAAc,CAAC;QAClD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,KAAK,CAAC,KAAK;KACvB,CAAC;IACF,MAAM,KAAK,GAAG,IAA0C,CAAC;IACzD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,MAAM,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAsC;IAEtC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import {\n  getOrgSetting,\n  getUserSetting,\n  putOrgSetting,\n  putUserSetting,\n} from \"@agent-native/core/settings\";\nimport {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"@agent-native/core/server\";\n\nexport const MCP_APP_ACCESS_SETTINGS_KEY = \"dispatch-mcp-app-access\";\n\nexport type DispatchMcpAppAccessMode = \"all-apps\" | \"selected-apps\";\n\nexport interface DispatchMcpAppAccessSettings {\n  mode: DispatchMcpAppAccessMode;\n  selectedAppIds: string[];\n  updatedAt?: string;\n  updatedBy?: string;\n}\n\ninterface AccessScope {\n  kind: \"org\" | \"user\";\n  id: string;\n  actor: string;\n}\n\nfunction uniqueAppIds(values: unknown): string[] {\n  const input = Array.isArray(values) ? values : [];\n  return Array.from(\n    new Set(\n      input\n        .filter((value): value is string => typeof value === \"string\")\n        .map((value) => value.trim().toLowerCase())\n        .filter(Boolean),\n    ),\n  );\n}\n\nexport function normalizeMcpAppAccessSettings(\n  raw: unknown,\n): DispatchMcpAppAccessSettings {\n  const record =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? (raw as Record<string, unknown>)\n      : {};\n  const mode = record.mode === \"selected-apps\" ? \"selected-apps\" : \"all-apps\";\n  return {\n    mode,\n    selectedAppIds: uniqueAppIds(record.selectedAppIds),\n    updatedAt:\n      typeof record.updatedAt === \"string\" ? record.updatedAt : undefined,\n    updatedBy:\n      typeof record.updatedBy === \"string\" ? record.updatedBy : undefined,\n  };\n}\n\nfunction currentAccessScope(): AccessScope {\n  const actor = getRequestUserEmail();\n  if (!actor) throw new Error(\"no authenticated user\");\n  const orgId = getRequestOrgId();\n  if (orgId) return { kind: \"org\", id: orgId, actor };\n  return { kind: \"user\", id: actor, actor };\n}\n\nexport async function getDispatchMcpAppAccessSettings(): Promise<DispatchMcpAppAccessSettings> {\n  const scope = currentAccessScope();\n  const raw =\n    scope.kind === \"org\"\n      ? await getOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY)\n      : await getUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY);\n  return normalizeMcpAppAccessSettings(raw);\n}\n\nexport async function setDispatchMcpAppAccessSettings(input: {\n  mode: DispatchMcpAppAccessMode;\n  selectedAppIds?: string[];\n}): Promise<DispatchMcpAppAccessSettings> {\n  const scope = currentAccessScope();\n  const next: DispatchMcpAppAccessSettings = {\n    mode: input.mode,\n    selectedAppIds: uniqueAppIds(input.selectedAppIds),\n    updatedAt: new Date().toISOString(),\n    updatedBy: scope.actor,\n  };\n  const value = next as unknown as Record<string, unknown>;\n  if (scope.kind === \"org\") {\n    await putOrgSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n  } else {\n    await putUserSetting(scope.id, MCP_APP_ACCESS_SETTINGS_KEY, value);\n  }\n  return next;\n}\n\nexport function isAppAllowedByMcpAccess(\n  appId: string,\n  settings: DispatchMcpAppAccessSettings,\n): boolean {\n  const normalized = appId.trim().toLowerCase();\n  if (!normalized) return false;\n  if (settings.mode === \"all-apps\") return true;\n  return settings.selectedAppIds.includes(normalized);\n}\n"]}

package/dist/server/lib/mcp-gateway.d.ts

@@ -0,0 +1,47 @@
+import { type DispatchMcpAppAccessSettings } from "./mcp-access-store.js";
+export interface DispatchMcpAccessibleApp {
+    id: string;
+    name: string;
+    description: string;
+    url: string;
+    color: string;
+    granted: boolean;
+}
+export declare function listDispatchMcpApps(): Promise<{
+    settings: DispatchMcpAppAccessSettings;
+    apps: DispatchMcpAccessibleApp[];
+}>;
+export declare function listGrantedDispatchMcpApps(): Promise<DispatchMcpAccessibleApp[]>;
+export declare function resolveGrantedDispatchMcpApp(app: string): Promise<DispatchMcpAccessibleApp>;
+export declare function askGrantedDispatchMcpApp(app: string, message: string): Promise<{
+    app: string;
+    routedVia: "a2a";
+    response: string;
+}>;
+export declare function openGrantedDispatchMcpApp(input: {
+    app: string;
+    view?: string;
+    path?: string;
+    params?: Record<string, string | number | boolean>;
+    embed?: boolean;
+    chrome?: "full" | "minimal";
+}): Promise<{
+    app: string;
+    view?: string;
+    path?: string;
+    url: string;
+    embed?: boolean;
+    chrome?: "full" | "minimal";
+}>;
+export declare function createGrantedDispatchMcpEmbedSession(input: {
+    app?: string;
+    url?: string;
+    path?: string;
+    chrome?: "full" | "minimal";
+}): Promise<{
+    startUrl: string;
+    targetPath?: string;
+    expiresAt?: number;
+    app: string;
+}>;
+//# sourceMappingURL=mcp-gateway.d.ts.map

package/dist/server/lib/mcp-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-gateway.d.ts","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAoBA,OAAO,EAGL,KAAK,4BAA4B,EAClC,MAAM,uBAAuB,CAAC;AAQ/B,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AA6KD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC;IACnD,QAAQ,EAAE,4BAA4B,CAAC;IACvC,IAAI,EAAE,wBAAwB,EAAE,CAAC;CAClC,CAAC,CAcD;AAED,wBAAsB,0BAA0B,IAAI,OAAO,CACzD,wBAAwB,EAAE,CAC3B,CAGA;AAED,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,wBAAwB,CAAC,CAmBnC;AAED,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB9D;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,CAAC,CAyBD;AAqGD,wBAAsB,oCAAoC,CAAC,KAAK,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,GAAG,OAAO,CAAC;IACV,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC,CA6ED"}

package/dist/server/lib/mcp-gateway.js

@@ -0,0 +1,393 @@
+import { callAgent, signA2AToken } from "@agent-native/core/a2a";
+import { buildMcpToolName, McpClientManager, } from "@agent-native/core/mcp-client";
+import { buildDeepLink, buildEmbedStartPath, createEmbedSessionTicket, getRequestContext, } from "@agent-native/core/server";
+import { discoverAgents, } from "@agent-native/core/server/agent-discovery";
+import { getRequestOrgId, getRequestUserEmail, } from "@agent-native/core/server";
+import { getOrgA2ASecret, getOrgDomain } from "@agent-native/core/org";
+import { getDispatchMcpAppAccessSettings, isAppAllowedByMcpAccess, } from "./mcp-access-store.js";
+const DISPATCH_APP_ID = "dispatch";
+const DISPATCH_NAME = "Agent-Native Dispatch";
+const DISPATCH_DESCRIPTION = "Workspace control plane for extensions, agents, vault, integrations, approvals, and app routing.";
+const DISPATCH_COLOR = "#14B8A6";
+function normalizeAppId(value) {
+    return value.trim().toLowerCase();
+}
+function normalizeBaseUrl(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return null;
+        return url.toString().replace(/\/+$/, "");
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeBasePath(value) {
+    const trimmed = value?.trim();
+    if (!trimmed || trimmed === "/")
+        return "";
+    const normalized = trimmed.replace(/^\/+/, "").replace(/\/+$/, "");
+    return normalized ? `/${normalized}` : "";
+}
+function withConfiguredBasePath(baseUrl) {
+    const basePath = normalizeBasePath(process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH);
+    if (!basePath)
+        return baseUrl;
+    try {
+        const url = new URL(baseUrl);
+        const path = normalizeBasePath(url.pathname);
+        if (path === basePath || path.startsWith(`${basePath}/`)) {
+            return baseUrl;
+        }
+        url.pathname = path && path !== "/" ? `${basePath}${path}` : `${basePath}/`;
+        return url.toString().replace(/\/+$/, "");
+    }
+    catch {
+        return baseUrl;
+    }
+}
+function dispatchSelfBaseUrl() {
+    const requestOrigin = normalizeBaseUrl(getRequestContext()?.requestOrigin);
+    if (requestOrigin)
+        return withConfiguredBasePath(requestOrigin);
+    const configured = normalizeBaseUrl(process.env.WORKSPACE_GATEWAY_URL) ??
+        normalizeBaseUrl(process.env.APP_URL) ??
+        normalizeBaseUrl(process.env.URL) ??
+        normalizeBaseUrl(process.env.DEPLOY_URL) ??
+        normalizeBaseUrl(process.env.BETTER_AUTH_URL);
+    if (configured)
+        return withConfiguredBasePath(configured);
+    return process.env.NODE_ENV === "production"
+        ? "https://dispatch.agent-native.com"
+        : "http://localhost:8092";
+}
+function dispatchSelfApp(settings) {
+    return {
+        id: DISPATCH_APP_ID,
+        name: DISPATCH_NAME,
+        description: DISPATCH_DESCRIPTION,
+        url: dispatchSelfBaseUrl(),
+        color: DISPATCH_COLOR,
+        granted: isAppAllowedByMcpAccess(DISPATCH_APP_ID, settings),
+    };
+}
+const CONTROL_CHARS = new RegExp("[\\u0000-\\u001f\\u007f]");
+function safeAppPath(raw) {
+    if (typeof raw !== "string" || !raw.trim())
+        return null;
+    const value = raw.trim();
+    if (CONTROL_CHARS.test(value))
+        return null;
+    if (!value.startsWith("/"))
+        return null;
+    if (value.startsWith("//") || value.startsWith("/\\"))
+        return null;
+    if (/^\/[a-z][a-z0-9+.-]*:/i.test(value))
+        return null;
+    if (/%(?:2f|5c)/i.test(value))
+        return null;
+    const rawPath = value.split(/[?#]/, 1)[0] ?? value;
+    let parsed;
+    try {
+        parsed = new URL(value, "http://agent-native.invalid");
+    }
+    catch {
+        return null;
+    }
+    if (parsed.pathname !== rawPath)
+        return null;
+    return value;
+}
+function appendParamsToPath(path, params) {
+    if (!params || Object.keys(params).length === 0)
+        return path;
+    const url = new URL(path, "http://agent-native.invalid");
+    for (const [key, value] of Object.entries(params)) {
+        url.searchParams.set(key, String(value));
+    }
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+function appOrigin(app) {
+    return new URL(app.url).origin;
+}
+function appBaseUrl(app) {
+    return app.url.replace(/\/+$/, "");
+}
+function appBasePath(app) {
+    const pathname = new URL(appBaseUrl(app)).pathname.replace(/\/+$/, "");
+    return pathname === "/" ? "" : pathname;
+}
+function appMatchesUrlPath(app, url) {
+    if (url.origin !== appOrigin(app))
+        return false;
+    const basePath = appBasePath(app);
+    if (!basePath)
+        return true;
+    return url.pathname === basePath || url.pathname.startsWith(`${basePath}/`);
+}
+function appPathSpecificity(app) {
+    return appBasePath(app).length;
+}
+function appRelativePath(app, url) {
+    const basePath = appBasePath(app);
+    const path = basePath
+        ? url.pathname === basePath
+            ? "/"
+            : url.pathname.slice(basePath.length)
+        : url.pathname;
+    return `${path || "/"}${url.search}${url.hash}`;
+}
+function isDispatchControlPath(path) {
+    if (!path)
+        return false;
+    const route = path.split(/[?#]/, 1)[0] ?? path;
+    return (route === "/extensions" ||
+        route.startsWith("/extensions/") ||
+        route === "/tools" ||
+        route.startsWith("/tools/"));
+}
+function assertAppCanOpenPath(app, path) {
+    if (app.id !== DISPATCH_APP_ID && isDispatchControlPath(path)) {
+        throw new Error(`Path "${path}" belongs to Dispatch. Use app: "dispatch" for Dispatch extension and tool routes.`);
+    }
+}
+function toAccessibleApp(agent, settings) {
+    return {
+        id: agent.id,
+        name: agent.name,
+        description: agent.description,
+        url: agent.url,
+        color: agent.color,
+        granted: isAppAllowedByMcpAccess(agent.id, settings),
+    };
+}
+export async function listDispatchMcpApps() {
+    const [settings, agents] = await Promise.all([
+        getDispatchMcpAppAccessSettings(),
+        discoverAgents("dispatch"),
+    ]);
+    return {
+        settings,
+        apps: [
+            dispatchSelfApp(settings),
+            ...agents
+                .filter((agent) => normalizeAppId(agent.id) !== DISPATCH_APP_ID)
+                .map((agent) => toAccessibleApp(agent, settings)),
+        ],
+    };
+}
+export async function listGrantedDispatchMcpApps() {
+    const { apps } = await listDispatchMcpApps();
+    return apps.filter((app) => app.granted);
+}
+export async function resolveGrantedDispatchMcpApp(app) {
+    const target = normalizeAppId(app);
+    if (!target)
+        throw new Error("app is required");
+    const { apps } = await listDispatchMcpApps();
+    const match = apps.find((candidate) => candidate.id === target || candidate.name.toLowerCase() === target);
+    if (!match) {
+        throw new Error(`Unknown app "${app}". Call list_apps to see apps available through Dispatch MCP.`);
+    }
+    if (!match.granted) {
+        throw new Error(`Dispatch MCP access to "${match.id}" is not granted. Open Dispatch > Agents to change MCP app access.`);
+    }
+    return match;
+}
+export async function askGrantedDispatchMcpApp(app, message) {
+    const trimmedMessage = message.trim();
+    if (!trimmedMessage)
+        throw new Error("message is required");
+    const target = await resolveGrantedDispatchMcpApp(app);
+    const userEmail = getRequestUserEmail();
+    if (!userEmail)
+        throw new Error("no authenticated user");
+    const orgId = getRequestOrgId();
+    const [orgDomain, orgSecret] = orgId
+        ? await Promise.all([
+            getOrgDomain(orgId).catch(() => null),
+            getOrgA2ASecret(orgId).catch(() => null),
+        ])
+        : [null, null];
+    const response = await callAgent(target.url, trimmedMessage, {
+        userEmail,
+        orgDomain: orgDomain ?? undefined,
+        orgSecret: orgSecret ?? undefined,
+        timeoutMs: 5 * 60_000,
+    });
+    return { app: target.id, routedVia: "a2a", response };
+}
+export async function openGrantedDispatchMcpApp(input) {
+    const view = input.view?.trim() ?? "";
+    const hasPathInput = input.path != null;
+    const path = safeAppPath(input.path);
+    if (hasPathInput && !path) {
+        throw new Error("path must be a safe app-relative route");
+    }
+    if (!view && !path)
+        throw new Error("open_app requires view or path");
+    const target = await resolveGrantedDispatchMcpApp(input.app);
+    if (path)
+        assertAppCanOpenPath(target, path);
+    const relUrl = path
+        ? appendParamsToPath(path, input.params)
+        : buildDeepLink({
+            app: target.id,
+            view,
+            params: input.params,
+        });
+    return {
+        app: target.id,
+        ...(view ? { view } : {}),
+        ...(path ? { path } : {}),
+        url: `${appBaseUrl(target)}${relUrl}`,
+        ...(input.embed === true ? { embed: true } : {}),
+        ...(input.chrome ? { chrome: input.chrome } : {}),
+    };
+}
+function parseMcpToolTextResult(result) {
+    if (result && typeof result === "object") {
+        const structured = result.structuredContent;
+        if (structured && typeof structured === "object")
+            return structured;
+        const parts = Array.isArray(result.content)
+            ? result.content
+            : [];
+        const text = parts.find((part) => part?.type === "text" && typeof part.text === "string")?.text;
+        if (typeof text === "string" && text.trim()) {
+            const parsed = JSON.parse(text);
+            if (parsed && typeof parsed === "object")
+                return parsed;
+        }
+    }
+    throw new Error("Target app did not return an embed session.");
+}
+async function resolveDispatchEmbedTarget(input) {
+    const explicitApp = input.app?.trim()
+        ? await resolveGrantedDispatchMcpApp(input.app)
+        : null;
+    if (explicitApp && input.path) {
+        const path = safeAppPath(input.path);
+        if (!path)
+            throw new Error("path must be a safe app-relative route");
+        assertAppCanOpenPath(explicitApp, path);
+        return {
+            app: explicitApp,
+            path,
+            url: `${appBaseUrl(explicitApp)}${path}`,
+        };
+    }
+    if (!input.url) {
+        throw new Error("create_embed_session requires a url or app + path.");
+    }
+    let parsed;
+    try {
+        parsed = new URL(input.url);
+    }
+    catch {
+        if (!explicitApp) {
+            throw new Error("Relative embed paths require an app id.");
+        }
+        const path = safeAppPath(input.url);
+        if (!path)
+            throw new Error("url must be a safe app route.");
+        return {
+            app: explicitApp,
+            path,
+            url: `${appBaseUrl(explicitApp)}${path}`,
+        };
+    }
+    const apps = explicitApp ? [explicitApp] : await listGrantedDispatchMcpApps();
+    const target = apps
+        .filter((app) => appMatchesUrlPath(app, parsed))
+        .sort((a, b) => appPathSpecificity(b) - appPathSpecificity(a))[0];
+    if (!target) {
+        throw new Error("Embed URL must belong to an app granted through Dispatch.");
+    }
+    const path = safeAppPath(appRelativePath(target, parsed));
+    if (!path)
+        throw new Error("Embed URL path is not safe.");
+    assertAppCanOpenPath(target, path);
+    return { app: target, path, url: `${appBaseUrl(target)}${path}` };
+}
+async function createDispatchSelfEmbedSession(input) {
+    const ticket = await createEmbedSessionTicket({
+        ownerEmail: input.ownerEmail,
+        orgId: input.orgId,
+        targetPath: input.path,
+        scope: input.chrome ?? null,
+    });
+    const startPath = buildEmbedStartPath(ticket.ticket);
+    return {
+        startUrl: new URL(startPath, input.baseUrl).toString(),
+        targetPath: input.path,
+        expiresAt: ticket.expiresAt,
+        app: DISPATCH_APP_ID,
+    };
+}
+export async function createGrantedDispatchMcpEmbedSession(input) {
+    const userEmail = getRequestUserEmail();
+    if (!userEmail)
+        throw new Error("no authenticated user");
+    const target = await resolveDispatchEmbedTarget(input);
+    const orgId = getRequestOrgId();
+    if (target.app.id === DISPATCH_APP_ID) {
+        return createDispatchSelfEmbedSession({
+            ownerEmail: userEmail,
+            orgId,
+            path: target.path,
+            baseUrl: appBaseUrl(target.app),
+            chrome: input.chrome,
+        });
+    }
+    const [orgDomain, orgSecret] = orgId
+        ? await Promise.all([
+            getOrgDomain(orgId).catch(() => null),
+            getOrgA2ASecret(orgId).catch(() => null),
+        ])
+        : [null, null];
+    const token = await signA2AToken(userEmail, orgDomain ?? undefined, orgSecret ?? undefined, {
+        expiresIn: "5m",
+        preferGlobalSecret: !orgSecret,
+    });
+    const serverId = "target";
+    const manager = new McpClientManager({
+        servers: {
+            [serverId]: {
+                type: "http",
+                url: `${appBaseUrl(target.app)}/_agent-native/mcp`,
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                },
+            },
+        },
+    });
+    await manager.start();
+    try {
+        const result = await manager.callTool(buildMcpToolName(serverId, "create_embed_session"), {
+            url: target.url,
+            chrome: input.chrome ?? "full",
+        });
+        const parsed = parseMcpToolTextResult(result);
+        if (!parsed.startUrl) {
+            throw new Error("Target app did not return an embed start URL.");
+        }
+        const output = {
+            startUrl: parsed.startUrl,
+            app: target.app.id,
+        };
+        if (parsed.targetPath)
+            output.targetPath = parsed.targetPath;
+        if (typeof parsed.expiresAt === "number")
+            output.expiresAt = parsed.expiresAt;
+        return output;
+    }
+    finally {
+        await manager.stop();
+    }
+}
+//# sourceMappingURL=mcp-gateway.js.map

package/dist/server/lib/mcp-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-gateway.js","sourceRoot":"","sources":["../../../src/server/lib/mcp-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,cAAc,GAEf,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,GAExB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAC9C,MAAM,oBAAoB,GACxB,kGAAkG,CAAC;AACrG,MAAM,cAAc,GAAG,SAAS,CAAC;AAWjC,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,GAA8B;IACtD,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAChC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YACzD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,GAAG,CAAC;QAC5E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,aAAa,GAAG,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3E,IAAI,aAAa;QAAE,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAEhE,MAAM,UAAU,GACd,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACnD,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACrC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QACjC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACxC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,UAAU;QAAE,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAE1D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAC1C,CAAC,CAAC,mCAAmC;QACrC,CAAC,CAAC,uBAAuB,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe,CACtB,QAAsC;IAEtC,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,oBAAoB;QACjC,GAAG,EAAE,mBAAmB,EAAE;QAC1B,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,uBAAuB,CAAC,eAAe,EAAE,QAAQ,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE7D,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACnD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,MAA6D;IAE7D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAAC,GAA6B;IAC9C,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,GAA6B;IAC/C,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,GAA6B;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvE,OAAO,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAA6B,EAAE,GAAQ;IAChE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,kBAAkB,CAAC,GAA6B;IACvD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,GAA6B,EAAE,GAAQ;IAC9D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,QAAQ;QACnB,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjB,OAAO,GAAG,IAAI,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAmB;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/C,OAAO,CACL,KAAK,KAAK,aAAa;QACvB,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;QAChC,KAAK,KAAK,QAAQ;QAClB,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA6B,EAAE,IAAY;IACvE,IAAI,GAAG,CAAC,EAAE,KAAK,eAAe,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,oFAAoF,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,KAAsB,EACtB,QAAsC;IAEtC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC;KACrD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IAIvC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC3C,+BAA+B,EAAE;QACjC,cAAc,CAAC,UAAU,CAAC;KAC3B,CAAC,CAAC;IACH,OAAO;QACL,QAAQ;QACR,IAAI,EAAE;YACJ,eAAe,CAAC,QAAQ,CAAC;YACzB,GAAG,MAAM;iBACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,eAAe,CAAC;iBAC/D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAG9C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAW;IAEX,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CACrB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,EAAE,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACrE,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gBAAgB,GAAG,+DAA+D,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,2BAA2B,KAAK,CAAC,EAAE,oEAAoE,CACxG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,OAAe;IAEf,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEzD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEjB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE;QAC3D,SAAS;QACT,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,SAAS,EAAE,SAAS,IAAI,SAAS;QACjC,SAAS,EAAE,CAAC,GAAG,MAAM;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,KAO/C;IAQC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,YAAY,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,IAAI;QAAE,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI;QACjB,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;QACxC,CAAC,CAAC,aAAa,CAAC;YACZ,GAAG,EAAE,MAAM,CAAC,EAAE;YACd,IAAI;YACJ,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACP,OAAO;QACL,GAAG,EAAE,MAAM,CAAC,EAAE;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;QACrC,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAe;IAC7C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,UAAU,GAAI,MAAc,CAAC,iBAAiB,CAAC;QACrD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;YAAE,OAAO,UAAU,CAAC;QACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAE,MAAc,CAAC,OAAO,CAAC;YAClD,CAAC,CAAG,MAAc,CAAC,OAA0C;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CACrB,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CACjE,EAAE,IAAI,CAAC;QACR,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAIzC;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,MAAM,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC;QAC/C,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACrE,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO;YACL,GAAG,EAAE,WAAW;YAChB,IAAI;YACJ,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC5D,OAAO;YACL,GAAG,EAAE,WAAW;YAChB,IAAI;YACJ,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,IAAI,EAAE;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,0BAA0B,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI;SAChB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC1D,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,KAM7C;IAMC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC;QAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO;QACL,QAAQ,EAAE,IAAI,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;QACtD,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,EAAE,eAAe;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAK1D;IAMC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,8BAA8B,CAAC;YACpC,UAAU,EAAE,SAAS;YACrB,KAAK;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,KAAK;QAClC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YACrC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SACzC,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAC9B,SAAS,EACT,SAAS,IAAI,SAAS,EACtB,SAAS,IAAI,SAAS,EACtB;QACE,SAAS,EAAE,IAAI;QACf,kBAAkB,EAAE,CAAC,SAAS;KAC/B,CACF,CAAC;IAEF,MAAM,QAAQ,GAAG,QAAQ,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC;QACnC,OAAO,EAAE;YACP,CAAC,QAAQ,CAAC,EAAE;gBACV,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB;gBAClD,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;aACF;SACF;KACF,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CACnC,gBAAgB,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAClD;YACE,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,MAAM;SAC/B,CACF,CAAC;QACF,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAI3C,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,MAAM,GAKR;YACF,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;SACnB,CAAC;QACF,IAAI,MAAM,CAAC,UAAU;YAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAC7D,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACtC,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;AACH,CAAC","sourcesContent":["import { callAgent, signA2AToken } from \"@agent-native/core/a2a\";\nimport {\n  buildMcpToolName,\n  McpClientManager,\n} from \"@agent-native/core/mcp-client\";\nimport {\n  buildDeepLink,\n  buildEmbedStartPath,\n  createEmbedSessionTicket,\n  getRequestContext,\n} from \"@agent-native/core/server\";\nimport {\n  discoverAgents,\n  type DiscoveredAgent,\n} from \"@agent-native/core/server/agent-discovery\";\nimport {\n  getRequestOrgId,\n  getRequestUserEmail,\n} from \"@agent-native/core/server\";\nimport { getOrgA2ASecret, getOrgDomain } from \"@agent-native/core/org\";\nimport {\n  getDispatchMcpAppAccessSettings,\n  isAppAllowedByMcpAccess,\n  type DispatchMcpAppAccessSettings,\n} from \"./mcp-access-store.js\";\n\nconst DISPATCH_APP_ID = \"dispatch\";\nconst DISPATCH_NAME = \"Agent-Native Dispatch\";\nconst DISPATCH_DESCRIPTION =\n  \"Workspace control plane for extensions, agents, vault, integrations, approvals, and app routing.\";\nconst DISPATCH_COLOR = \"#14B8A6\";\n\nexport interface DispatchMcpAccessibleApp {\n  id: string;\n  name: string;\n  description: string;\n  url: string;\n  color: string;\n  granted: boolean;\n}\n\nfunction normalizeAppId(value: string): string {\n  return value.trim().toLowerCase();\n}\n\nfunction normalizeBaseUrl(raw: string | undefined | null): string | null {\n  const value = raw?.trim();\n  if (!value) return null;\n  try {\n    const url = new URL(value);\n    if (url.protocol !== \"http:\" && url.protocol !== \"https:\") return null;\n    return url.toString().replace(/\\/+$/, \"\");\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeBasePath(value: string | undefined): string {\n  const trimmed = value?.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  const normalized = trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\n  return normalized ? `/${normalized}` : \"\";\n}\n\nfunction withConfiguredBasePath(baseUrl: string): string {\n  const basePath = normalizeBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n  if (!basePath) return baseUrl;\n  try {\n    const url = new URL(baseUrl);\n    const path = normalizeBasePath(url.pathname);\n    if (path === basePath || path.startsWith(`${basePath}/`)) {\n      return baseUrl;\n    }\n    url.pathname = path && path !== \"/\" ? `${basePath}${path}` : `${basePath}/`;\n    return url.toString().replace(/\\/+$/, \"\");\n  } catch {\n    return baseUrl;\n  }\n}\n\nfunction dispatchSelfBaseUrl(): string {\n  const requestOrigin = normalizeBaseUrl(getRequestContext()?.requestOrigin);\n  if (requestOrigin) return withConfiguredBasePath(requestOrigin);\n\n  const configured =\n    normalizeBaseUrl(process.env.WORKSPACE_GATEWAY_URL) ??\n    normalizeBaseUrl(process.env.APP_URL) ??\n    normalizeBaseUrl(process.env.URL) ??\n    normalizeBaseUrl(process.env.DEPLOY_URL) ??\n    normalizeBaseUrl(process.env.BETTER_AUTH_URL);\n  if (configured) return withConfiguredBasePath(configured);\n\n  return process.env.NODE_ENV === \"production\"\n    ? \"https://dispatch.agent-native.com\"\n    : \"http://localhost:8092\";\n}\n\nfunction dispatchSelfApp(\n  settings: DispatchMcpAppAccessSettings,\n): DispatchMcpAccessibleApp {\n  return {\n    id: DISPATCH_APP_ID,\n    name: DISPATCH_NAME,\n    description: DISPATCH_DESCRIPTION,\n    url: dispatchSelfBaseUrl(),\n    color: DISPATCH_COLOR,\n    granted: isAppAllowedByMcpAccess(DISPATCH_APP_ID, settings),\n  };\n}\n\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\n\nfunction safeAppPath(raw: unknown): string | null {\n  if (typeof raw !== \"string\" || !raw.trim()) return null;\n  const value = raw.trim();\n  if (CONTROL_CHARS.test(value)) return null;\n  if (!value.startsWith(\"/\")) return null;\n  if (value.startsWith(\"//\") || value.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(value)) return null;\n  if (/%(?:2f|5c)/i.test(value)) return null;\n  const rawPath = value.split(/[?#]/, 1)[0] ?? value;\n  let parsed: URL;\n  try {\n    parsed = new URL(value, \"http://agent-native.invalid\");\n  } catch {\n    return null;\n  }\n  if (parsed.pathname !== rawPath) return null;\n  return value;\n}\n\nfunction appendParamsToPath(\n  path: string,\n  params: Record<string, string | number | boolean> | undefined,\n): string {\n  if (!params || Object.keys(params).length === 0) return path;\n  const url = new URL(path, \"http://agent-native.invalid\");\n  for (const [key, value] of Object.entries(params)) {\n    url.searchParams.set(key, String(value));\n  }\n  return `${url.pathname}${url.search}${url.hash}`;\n}\n\nfunction appOrigin(app: DispatchMcpAccessibleApp): string {\n  return new URL(app.url).origin;\n}\n\nfunction appBaseUrl(app: DispatchMcpAccessibleApp): string {\n  return app.url.replace(/\\/+$/, \"\");\n}\n\nfunction appBasePath(app: DispatchMcpAccessibleApp): string {\n  const pathname = new URL(appBaseUrl(app)).pathname.replace(/\\/+$/, \"\");\n  return pathname === \"/\" ? \"\" : pathname;\n}\n\nfunction appMatchesUrlPath(app: DispatchMcpAccessibleApp, url: URL): boolean {\n  if (url.origin !== appOrigin(app)) return false;\n  const basePath = appBasePath(app);\n  if (!basePath) return true;\n  return url.pathname === basePath || url.pathname.startsWith(`${basePath}/`);\n}\n\nfunction appPathSpecificity(app: DispatchMcpAccessibleApp): number {\n  return appBasePath(app).length;\n}\n\nfunction appRelativePath(app: DispatchMcpAccessibleApp, url: URL): string {\n  const basePath = appBasePath(app);\n  const path = basePath\n    ? url.pathname === basePath\n      ? \"/\"\n      : url.pathname.slice(basePath.length)\n    : url.pathname;\n  return `${path || \"/\"}${url.search}${url.hash}`;\n}\n\nfunction isDispatchControlPath(path: string | null): boolean {\n  if (!path) return false;\n  const route = path.split(/[?#]/, 1)[0] ?? path;\n  return (\n    route === \"/extensions\" ||\n    route.startsWith(\"/extensions/\") ||\n    route === \"/tools\" ||\n    route.startsWith(\"/tools/\")\n  );\n}\n\nfunction assertAppCanOpenPath(app: DispatchMcpAccessibleApp, path: string) {\n  if (app.id !== DISPATCH_APP_ID && isDispatchControlPath(path)) {\n    throw new Error(\n      `Path \"${path}\" belongs to Dispatch. Use app: \"dispatch\" for Dispatch extension and tool routes.`,\n    );\n  }\n}\n\nfunction toAccessibleApp(\n  agent: DiscoveredAgent,\n  settings: DispatchMcpAppAccessSettings,\n): DispatchMcpAccessibleApp {\n  return {\n    id: agent.id,\n    name: agent.name,\n    description: agent.description,\n    url: agent.url,\n    color: agent.color,\n    granted: isAppAllowedByMcpAccess(agent.id, settings),\n  };\n}\n\nexport async function listDispatchMcpApps(): Promise<{\n  settings: DispatchMcpAppAccessSettings;\n  apps: DispatchMcpAccessibleApp[];\n}> {\n  const [settings, agents] = await Promise.all([\n    getDispatchMcpAppAccessSettings(),\n    discoverAgents(\"dispatch\"),\n  ]);\n  return {\n    settings,\n    apps: [\n      dispatchSelfApp(settings),\n      ...agents\n        .filter((agent) => normalizeAppId(agent.id) !== DISPATCH_APP_ID)\n        .map((agent) => toAccessibleApp(agent, settings)),\n    ],\n  };\n}\n\nexport async function listGrantedDispatchMcpApps(): Promise<\n  DispatchMcpAccessibleApp[]\n> {\n  const { apps } = await listDispatchMcpApps();\n  return apps.filter((app) => app.granted);\n}\n\nexport async function resolveGrantedDispatchMcpApp(\n  app: string,\n): Promise<DispatchMcpAccessibleApp> {\n  const target = normalizeAppId(app);\n  if (!target) throw new Error(\"app is required\");\n  const { apps } = await listDispatchMcpApps();\n  const match = apps.find(\n    (candidate) =>\n      candidate.id === target || candidate.name.toLowerCase() === target,\n  );\n  if (!match) {\n    throw new Error(\n      `Unknown app \"${app}\". Call list_apps to see apps available through Dispatch MCP.`,\n    );\n  }\n  if (!match.granted) {\n    throw new Error(\n      `Dispatch MCP access to \"${match.id}\" is not granted. Open Dispatch > Agents to change MCP app access.`,\n    );\n  }\n  return match;\n}\n\nexport async function askGrantedDispatchMcpApp(\n  app: string,\n  message: string,\n): Promise<{ app: string; routedVia: \"a2a\"; response: string }> {\n  const trimmedMessage = message.trim();\n  if (!trimmedMessage) throw new Error(\"message is required\");\n  const target = await resolveGrantedDispatchMcpApp(app);\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n\n  const orgId = getRequestOrgId();\n  const [orgDomain, orgSecret] = orgId\n    ? await Promise.all([\n        getOrgDomain(orgId).catch(() => null),\n        getOrgA2ASecret(orgId).catch(() => null),\n      ])\n    : [null, null];\n\n  const response = await callAgent(target.url, trimmedMessage, {\n    userEmail,\n    orgDomain: orgDomain ?? undefined,\n    orgSecret: orgSecret ?? undefined,\n    timeoutMs: 5 * 60_000,\n  });\n  return { app: target.id, routedVia: \"a2a\", response };\n}\n\nexport async function openGrantedDispatchMcpApp(input: {\n  app: string;\n  view?: string;\n  path?: string;\n  params?: Record<string, string | number | boolean>;\n  embed?: boolean;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  app: string;\n  view?: string;\n  path?: string;\n  url: string;\n  embed?: boolean;\n  chrome?: \"full\" | \"minimal\";\n}> {\n  const view = input.view?.trim() ?? \"\";\n  const hasPathInput = input.path != null;\n  const path = safeAppPath(input.path);\n  if (hasPathInput && !path) {\n    throw new Error(\"path must be a safe app-relative route\");\n  }\n  if (!view && !path) throw new Error(\"open_app requires view or path\");\n  const target = await resolveGrantedDispatchMcpApp(input.app);\n  if (path) assertAppCanOpenPath(target, path);\n  const relUrl = path\n    ? appendParamsToPath(path, input.params)\n    : buildDeepLink({\n        app: target.id,\n        view,\n        params: input.params,\n      });\n  return {\n    app: target.id,\n    ...(view ? { view } : {}),\n    ...(path ? { path } : {}),\n    url: `${appBaseUrl(target)}${relUrl}`,\n    ...(input.embed === true ? { embed: true } : {}),\n    ...(input.chrome ? { chrome: input.chrome } : {}),\n  };\n}\n\nfunction parseMcpToolTextResult(result: unknown): Record<string, unknown> {\n  if (result && typeof result === \"object\") {\n    const structured = (result as any).structuredContent;\n    if (structured && typeof structured === \"object\") return structured;\n    const parts = Array.isArray((result as any).content)\n      ? ((result as any).content as Array<Record<string, unknown>>)\n      : [];\n    const text = parts.find(\n      (part) => part?.type === \"text\" && typeof part.text === \"string\",\n    )?.text;\n    if (typeof text === \"string\" && text.trim()) {\n      const parsed = JSON.parse(text);\n      if (parsed && typeof parsed === \"object\") return parsed;\n    }\n  }\n  throw new Error(\"Target app did not return an embed session.\");\n}\n\nasync function resolveDispatchEmbedTarget(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n}): Promise<{ app: DispatchMcpAccessibleApp; path: string; url: string }> {\n  const explicitApp = input.app?.trim()\n    ? await resolveGrantedDispatchMcpApp(input.app)\n    : null;\n  if (explicitApp && input.path) {\n    const path = safeAppPath(input.path);\n    if (!path) throw new Error(\"path must be a safe app-relative route\");\n    assertAppCanOpenPath(explicitApp, path);\n    return {\n      app: explicitApp,\n      path,\n      url: `${appBaseUrl(explicitApp)}${path}`,\n    };\n  }\n\n  if (!input.url) {\n    throw new Error(\"create_embed_session requires a url or app + path.\");\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(input.url);\n  } catch {\n    if (!explicitApp) {\n      throw new Error(\"Relative embed paths require an app id.\");\n    }\n    const path = safeAppPath(input.url);\n    if (!path) throw new Error(\"url must be a safe app route.\");\n    return {\n      app: explicitApp,\n      path,\n      url: `${appBaseUrl(explicitApp)}${path}`,\n    };\n  }\n\n  const apps = explicitApp ? [explicitApp] : await listGrantedDispatchMcpApps();\n  const target = apps\n    .filter((app) => appMatchesUrlPath(app, parsed))\n    .sort((a, b) => appPathSpecificity(b) - appPathSpecificity(a))[0];\n  if (!target) {\n    throw new Error(\n      \"Embed URL must belong to an app granted through Dispatch.\",\n    );\n  }\n  const path = safeAppPath(appRelativePath(target, parsed));\n  if (!path) throw new Error(\"Embed URL path is not safe.\");\n  assertAppCanOpenPath(target, path);\n  return { app: target, path, url: `${appBaseUrl(target)}${path}` };\n}\n\nasync function createDispatchSelfEmbedSession(input: {\n  ownerEmail: string;\n  orgId?: string;\n  path: string;\n  baseUrl: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const ticket = await createEmbedSessionTicket({\n    ownerEmail: input.ownerEmail,\n    orgId: input.orgId,\n    targetPath: input.path,\n    scope: input.chrome ?? null,\n  });\n  const startPath = buildEmbedStartPath(ticket.ticket);\n  return {\n    startUrl: new URL(startPath, input.baseUrl).toString(),\n    targetPath: input.path,\n    expiresAt: ticket.expiresAt,\n    app: DISPATCH_APP_ID,\n  };\n}\n\nexport async function createGrantedDispatchMcpEmbedSession(input: {\n  app?: string;\n  url?: string;\n  path?: string;\n  chrome?: \"full\" | \"minimal\";\n}): Promise<{\n  startUrl: string;\n  targetPath?: string;\n  expiresAt?: number;\n  app: string;\n}> {\n  const userEmail = getRequestUserEmail();\n  if (!userEmail) throw new Error(\"no authenticated user\");\n  const target = await resolveDispatchEmbedTarget(input);\n\n  const orgId = getRequestOrgId();\n  if (target.app.id === DISPATCH_APP_ID) {\n    return createDispatchSelfEmbedSession({\n      ownerEmail: userEmail,\n      orgId,\n      path: target.path,\n      baseUrl: appBaseUrl(target.app),\n      chrome: input.chrome,\n    });\n  }\n\n  const [orgDomain, orgSecret] = orgId\n    ? await Promise.all([\n        getOrgDomain(orgId).catch(() => null),\n        getOrgA2ASecret(orgId).catch(() => null),\n      ])\n    : [null, null];\n  const token = await signA2AToken(\n    userEmail,\n    orgDomain ?? undefined,\n    orgSecret ?? undefined,\n    {\n      expiresIn: \"5m\",\n      preferGlobalSecret: !orgSecret,\n    },\n  );\n\n  const serverId = \"target\";\n  const manager = new McpClientManager({\n    servers: {\n      [serverId]: {\n        type: \"http\",\n        url: `${appBaseUrl(target.app)}/_agent-native/mcp`,\n        headers: {\n          Authorization: `Bearer ${token}`,\n        },\n      },\n    },\n  });\n  await manager.start();\n  try {\n    const result = await manager.callTool(\n      buildMcpToolName(serverId, \"create_embed_session\"),\n      {\n        url: target.url,\n        chrome: input.chrome ?? \"full\",\n      },\n    );\n    const parsed = parseMcpToolTextResult(result) as {\n      startUrl?: string;\n      targetPath?: string;\n      expiresAt?: number;\n    };\n    if (!parsed.startUrl) {\n      throw new Error(\"Target app did not return an embed start URL.\");\n    }\n    const output: {\n      startUrl: string;\n      targetPath?: string;\n      expiresAt?: number;\n      app: string;\n    } = {\n      startUrl: parsed.startUrl,\n      app: target.app.id,\n    };\n    if (parsed.targetPath) output.targetPath = parsed.targetPath;\n    if (typeof parsed.expiresAt === \"number\")\n      output.expiresAt = parsed.expiresAt;\n    return output;\n  } finally {\n    await manager.stop();\n  }\n}\n"]}

package/dist/server/lib/usage-metrics-store.d.ts

@@ -26,6 +26,7 @@ export interface AppAccessMetric {
     name: string;
     path: string;
     status: WorkspaceAppSummary["status"];
+    statusLabel?: string;
     isDispatch: boolean;
     accessModel: "workspace" | "solo";
     accessLabel: string;

package/dist/server/lib/usage-metrics-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage-metrics-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/usage-metrics-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAYlC,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtC,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,WAAW,GAAG,MAAM,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,cAAc,GAAG,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AA+QD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA+PhC"}
+{"version":3,"file":"usage-metrics-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/usage-metrics-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAYlC,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,yBAAyB,CAAC;AAMjC,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,eAAgB,SAAQ,iBAAiB;IACxD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,WAAW,GAAG,MAAM,CAAC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,gBAAgB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,EAAE,cAAc,GAAG,MAAM,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,MAAM,EAAE;QACN,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,iBAAiB,EAAE,CAAC;CAC7B;AA+QD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgQhC"}

package/dist/server/lib/usage-metrics-store.js

@@ -355,6 +355,7 @@ export async function listDispatchUsageMetrics(input) {
             name: app.name,
             path: app.path,
             status: app.status,
+            statusLabel: app.statusLabel,
             isDispatch: app.isDispatch,
             accessModel,
             accessLabel,