@agent-native/dispatch 0.9.3 → 0.10.0

package/README.md

@@ -11,6 +11,7 @@ The agent and the UI are equal citizens of the same system. Every action works b
 ![Agents and UIs fully connected](https://cdn.builder.io/api/v1/file/assets%2FYJIGb4i01jvw0SRdL5Bt%2Fadc1e9e9368e4a8cb1b4dbb5aae5aaa2)
 
 - **Everything syncs** — Agent and UI share one database and one state. Changes from either side show up instantly on the other.
+- **Real-time multiplayer** — Humans and agents collaborate in the same document simultaneously: CRDT merging, live presence (cursors, selection rings, who's on which slide), and the agent as a first-class peer editor. Works on any SQL database and any host, including serverless.
 - **Context-aware** — The agent knows what you're looking at. Select text, hit Cmd+I, and tell it what to do.
 - **Per-user workspace** — Skills, memory, instructions, sub-agents, and MCP servers — SQL-backed, customizable per user. Claude-Code-level flexibility, SaaS-grade economics.
 - **Agents call agents** — Tag another agent from any app. They discover each other over A2A and take action across your stack.
@@ -19,6 +20,21 @@ The agent and the UI are equal citizens of the same system. Every action works b
 - **Any database, any host** — Any SQL database Drizzle supports. Any hosting target Nitro supports. No lock-in.
 - **Any AI agent** — Claude Code, Codex, Gemini CLI, OpenCode, or Builder.io. Use whichever agent you prefer.
 
+## Try it with a skill
+
+Don't want to scaffold a whole app yet? Add agent-native superpowers to a coding agent you already use — Claude Code, Codex, or Cursor — with one command:
+
+```bash
+npx @agent-native/core@latest skills add visual-plan
+```
+
+It installs the skills, registers the hosted MCP connector, and signs you in in one step. You get two slash commands that upgrade how your agent plans and reports its work:
+
+- **`/visual-plan`** — before the agent writes code, it opens a structured, reviewable plan document instead of a wall of text: inline diagrams, UI wireframes and prototypes, file-by-file implementation maps, and annotations you can comment on and approve.
+- **`/visual-recap`** — after changes land, it turns a PR or git diff into a high-altitude visual recap: schema, API, and file changes rendered as grounded before/after blocks with a shareable review link, instead of scrolling a raw diff.
+
+See the **[Skills Guide](https://agent-native.com/docs/skills-guide#app-backed-skills)** for more skills and local installs.
+
 ## Templates
 
 Start from a complete, production-grade SaaS app — cloneable, not scaffolded. Each one replaces tools you're paying for, except you own everything and can customize it however you want. Not demos; products.
@@ -49,6 +65,19 @@ Manage events, sync with Google Calendar, and share a public booking page with A
 </td>
 <td width="33%" align="center" valign="top">
 
+**Plans**
+
+<a href="https://agent-native.com/templates/plan"><img src="https://cdn.builder.io/api/v1/image/assets%2FYJIGb4i01jvw0SRdL5Bt%2Fb6f4213ac7cc42eeb10c12e8ccda8936?format=webp&width=800" alt="Plans template" width="100%" /></a>
+
+**Visual plan mode for coding agents**
+
+Install `/visual-plan` and `/visual-recap` so your coding agent can plan before it builds and recap changes after they land — high-level code reviews with diagrams, wireframes, annotations, and review links.
+
+</td>
+</tr>
+<tr>
+<td width="33%" align="center" valign="top">
+
 **Content**
 
 <a href="https://agent-native.com/templates/content"><img src="https://cdn.builder.io/api/v1/image/assets%2FYJIGb4i01jvw0SRdL5Bt%2F89bcfc6106304bfbaf8ec8a7ccd721eb?format=webp&width=800" alt="Content template" width="100%" /></a>
@@ -58,8 +87,6 @@ Manage events, sync with Google Calendar, and share a public booking page with A
 Write and organize content with an agent that knows your brand and publishing workflow.
 
 </td>
-</tr>
-<tr>
 <td width="33%" align="center" valign="top">
 
 **Slides**
@@ -82,6 +109,8 @@ Generate and edit React-based presentations via prompt or point-and-click.
 Create and edit Remotion video compositions with agent assistance.
 
 </td>
+</tr>
+<tr>
 <td width="33%" align="center" valign="top">
 
 **Analytics**
@@ -93,8 +122,6 @@ Create and edit Remotion video compositions with agent assistance.
 Connect analytics data sources, prompt for real charts, and build reusable dashboards. Shared workspace connections can provide provider credentials, while Analytics still owns metrics, source-of-truth choices, and saved analyses.
 
 </td>
-</tr>
-<tr>
 <td width="33%" align="center" valign="top">
 
 **Clips**
@@ -117,6 +144,8 @@ Record your screen with auto-transcripts, shareable links, and an agent that sum
 Create and edit visual designs by prompt or by hand, with the agent as your co-designer.
 
 </td>
+</tr>
+<tr>
 <td width="33%" align="center" valign="top">
 
 **Dispatch**
@@ -128,8 +157,6 @@ Create and edit visual designs by prompt or by hand, with the agent as your co-d
 Message, manage, and delegate to agents from Slack, Telegram, or the web. Dispatch is also the control plane for vault secrets, reusable provider connections, app grants, routing, memory, and approvals.
 
 </td>
-</tr>
-<tr>
 <td width="33%" align="center" valign="top">
 
 **Forms**
@@ -145,18 +172,20 @@ Generate forms from a prompt, branch logic with the agent, and own every respons
 
 **Brain**
 
-<a href="https://agent-native.com/templates/brain">Brain template</a>
+<a href="https://agent-native.com/templates/brain"><img src="https://cdn.builder.io/api/v1/image/assets%2FYJIGb4i01jvw0SRdL5Bt%2F9c9fe3b5b9494e33803cd3f494cba356?format=webp&width=800" alt="Brain template" width="100%" /></a>
 
 **Agent-Native company memory**
 
 Ask questions over cited company knowledge from approved Slack, meetings, transcripts, GitHub, and decisions.
 
 </td>
+</tr>
+<tr>
 <td width="33%" align="center" valign="top">
 
 **Assets**
 
-<a href="https://agent-native.com/templates/assets">Assets template</a>
+<a href="https://agent-native.com/templates/assets"><img src="https://cdn.builder.io/api/v1/image/assets%2FYJIGb4i01jvw0SRdL5Bt%2F769092170a14474f998cbca47384f891?format=webp&width=800" alt="Assets template" width="100%" /></a>
 
 **Agent-Native asset library**
 
@@ -185,50 +214,6 @@ Want a single app, no monorepo? Use `--standalone`:
 npx @agent-native/core create my-app --standalone --template mail
 ```
 
-Need a coding agent workspace? `agent-native` or `agent-native code` opens an open-source Claude Code/Codex-like Code workspace with no prompt required. From there, type a task, run slash goals interactively, or call them directly from your shell:
-
-```bash
-npx @agent-native/core@latest
-npx @agent-native/core@latest "fix the failing auth tests"
-npx @agent-native/core@latest code
-npx @agent-native/core@latest code "fix the failing auth tests"
-npx @agent-native/core@latest code exec "fix the failing auth tests"
-npx @agent-native/core@latest code -p "fix the failing auth tests"
-npx @agent-native/core@latest code --plan "explain the auth test failures"
-npx @agent-native/core@latest code --auto "fix the failing auth tests"
-npx @agent-native/core@latest code /migrate ./my-next-app --out ../migrated-app
-npx @agent-native/core@latest code /migrate ./my-next-app --emit ../migration-dossier
-npx @agent-native/core@latest code list
-npx @agent-native/core@latest code status --last
-npx @agent-native/core@latest code attach --last
-npx @agent-native/core@latest code logs --last
-npx @agent-native/core@latest code stop --last
-npx @agent-native/core@latest code ui
-npx @agent-native/core@latest code approve --last
-npx @agent-native/core@latest code resume --last
-npx @agent-native/core@latest code --continue "check the auth edge cases next"
-npx @agent-native/core@latest code resume --last "check the auth edge cases next"
-```
-
-Slash goals can run from the interactive shell or directly from the command line, and `agent-native code goals` shows the goals registered in your checkout. A bare prompt starts a local coding-agent session, streams work, records transcript/status/tool events, and accepts follow-up prompts; `/migrate` is one specialized capability inside that general Code workspace. Project-specific slash commands live in `.agents/commands/*.md`, so teams can add prompts such as `/release-check` or `/migrate-commerce` without changing the framework. Installed `agent-native` with no arguments launches the Code workspace; `agent-native "fix tests"` starts an Agent-Native Code task directly. Use `agent-native create` when you want to create apps or workspaces.
-
-Working inside this repository? Use `pnpm dev` for the lazy framework dev gateway. It exposes the core templates on one local origin and starts each app only when you visit it, which keeps memory usage much lower than booting every server at once. To focus on specific templates, pass `--apps`, for example `pnpm dev -- --apps analytics,brain`. Use `pnpm dev:eager` only when you intentionally want the older eager mode that starts the selected template servers, frame, docs, and core watcher immediately. The old `pnpm dev:all` name still works as an alias for eager mode.
-
-Use `pnpm dev:cli ...` to run the source CLI without building first, for example `pnpm dev:cli --help` or `pnpm dev:cli code goals`.
-
-The Code workspace uses the familiar Codex/Claude-style session loop: pick a previous session, list runs, check status, attach to live output, print logs, stop work, resume with context, open the local UI, and continue the same run from Desktop or CLI. The Desktop Code tab, `agent-native code ui`, background sessions, and sub-agent sessions all converge on the shared run harness/controller model instead of separate ad hoc runners. The primary modes are intentionally simple:
-
-- **Plan mode** (`--plan`) inspects, explains, and proposes without writing files.
-- **Auto mode** (`--auto`, default) edits files, runs checks, and only pauses for genuinely destructive file, git, publish, or data operations.
-
-`agent-native migrate` still works as a direct shortcut; `code /migrate` is the Agent-Native Code entrypoint for the migration goal. By default it creates an Agent-Native Code session and portable migration dossier, not a scaffolded app/template. `resume --last` reopens the latest run handoff; adding a quoted prompt records it as a follow-up transcript event for that run so the next active coding agent can pick it up. If a high-risk command is paused for approval, `code approve --last` runs that one pending command and then points you back to resume the session. Use `--app-surface` only when you want the legacy hidden migration detail app for assessment, approval, tasks, artifacts, and verification.
-Use `--emit` when you want only the portable dossier for Codex, Claude Code, Cursor, or another coding agent.
-Agent-Native Code also includes lightweight goals such as `/audit`:
-
-```bash
-npx @agent-native/core@latest code /audit --url https://example.com
-```
-
 ## Workspaces (Monorepo)
 
 A workspace is the default shape of an agent-native project. Every app sits under `apps/`, and `packages/shared/` is available for the small amount of code, instructions, skills, or branding that should truly apply to every app.

package/dist/actions/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/actions/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAqF7D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAqFvD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/actions/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAsF7D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAsFvD,CAAC"}

package/dist/actions/index.js

@@ -56,6 +56,7 @@ import previewDreamProposal from "./preview-dream-proposal.js";
 import previewWorkspaceResourceChange from "./preview-workspace-resource-change.js";
 import providerApiCatalog from "./provider-api-catalog.js";
 import providerApiDocs from "./provider-api-docs.js";
+import providerApiRegister from "./provider-api-register.js";
 import providerApiRequest from "./provider-api-request.js";
 import rejectDispatchChange from "./reject-dispatch-change.js";
 import rejectDreamProposal from "./reject-dream-proposal.js";
@@ -146,6 +147,7 @@ export const dispatchActions = {
     "preview-workspace-resource-change": previewWorkspaceResourceChange,
     "provider-api-catalog": providerApiCatalog,
     "provider-api-docs": providerApiDocs,
+    "provider-api-register": providerApiRegister,
     "provider-api-request": providerApiRequest,
     "reject-dispatch-change": rejectDispatchChange,
     "reject-dream-proposal": rejectDreamProposal,

package/dist/actions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/actions/index.ts"],"names":[],"mappings":"AACA,OAAO,qBAAqB,MAAM,8BAA8B,CAAC;AACjE,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,MAAM,MAAM,cAAc,CAAC;AAClC,OAAO,eAAe,MAAM,wBAAwB,CAAC;AACrD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,4BAA4B,MAAM,sCAAsC,CAAC;AAChF,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AACrE,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,iBAAiB,MAAM,yBAAyB,CAAC;AACxD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AACrE,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,cAAc,MAAM,uBAAuB,CAAC;AACnD,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,mBAAmB,MAAM,6BAA6B,CAAC;AAC9D,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,oCAAoC,MAAM,+CAA+C,CAAC;AACjG,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,4BAA4B,MAAM,uCAAuC,CAAC;AACjF,OAAO,sBAAsB,MAAM,iCAAiC,CAAC;AACrE,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,+BAA+B,MAAM,yCAAyC,CAAC;AACtF,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,gBAAgB,MAAM,wBAAwB,CAAC;AACtD,OAAO,qBAAqB,MAAM,8BAA8B,CAAC;AACjE,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,wBAAwB,MAAM,kCAAkC,CAAC;AACxE,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AACrE,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,gBAAgB,MAAM,0BAA0B,CAAC;AACxD,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,cAAc,MAAM,uBAAuB,CAAC;AACnD,OAAO,eAAe,MAAM,wBAAwB,CAAC;AACrD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,4BAA4B,MAAM,sCAAsC,CAAC;AAChF,OAAO,2BAA2B,MAAM,qCAAqC,CAAC;AAC9E,OAAO,4BAA4B,MAAM,uCAAuC,CAAC;AACjF,OAAO,sBAAsB,MAAM,+BAA+B,CAAC;AACnE,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,OAAO,MAAM,eAAe,CAAC;AACpC,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,8BAA8B,MAAM,wCAAwC,CAAC;AACpF,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,eAAe,MAAM,wBAAwB,CAAC;AACrD,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,yBAAyB,MAAM,mCAAmC,CAAC;AAC1E,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,4BAA4B,MAAM,sCAAsC,CAAC;AAChF,OAAO,gCAAgC,MAAM,0CAA0C,CAAC;AACxF,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,0BAA0B,MAAM,qCAAqC,CAAC;AAC7E,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,yBAAyB,MAAM,mCAAmC,CAAC;AAC1E,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,eAAe,MAAM,yBAAyB,CAAC;AACtD,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,yBAAyB,MAAM,mCAAmC,CAAC;AAC1E,OAAO,cAAc,MAAM,wBAAwB,CAAC;AACpD,OAAO,qBAAqB,MAAM,8BAA8B,CAAC;AACjE,OAAO,0BAA0B,MAAM,oCAAoC,CAAC;AAC5E,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AACrE,OAAO,iBAAiB,MAAM,yBAAyB,CAAC;AACxD,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgC;IAC1D,yBAAyB,EAAE,qBAAqB;IAChD,uBAAuB,EAAE,mBAAmB;IAC5C,uBAAuB,EAAE,mBAAmB;IAC5C,OAAO,EAAE,MAAM;IACf,mBAAmB,EAAE,eAAe;IACpC,qBAAqB,EAAE,iBAAiB;IACxC,oBAAoB,EAAE,gBAAgB;IACtC,qBAAqB,EAAE,iBAAiB;IACxC,iCAAiC,EAAE,4BAA4B;IAC/D,2BAA2B,EAAE,uBAAuB;IACpD,qBAAqB,EAAE,iBAAiB;IACxC,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,iBAAiB;IACvC,qBAAqB,EAAE,iBAAiB;IACxC,2BAA2B,EAAE,uBAAuB;IACpD,oBAAoB,EAAE,gBAAgB;IACtC,kBAAkB,EAAE,cAAc;IAClC,2BAA2B,EAAE,sBAAsB;IACnD,wBAAwB,EAAE,mBAAmB;IAC7C,WAAW,EAAE,QAAQ;IACrB,oBAAoB,EAAE,gBAAgB;IACtC,uBAAuB,EAAE,mBAAmB;IAC5C,2BAA2B,EAAE,sBAAsB;IACnD,0CAA0C,EACxC,oCAAoC;IACtC,oBAAoB,EAAE,gBAAgB;IACtC,kCAAkC,EAAE,4BAA4B;IAChE,4BAA4B,EAAE,sBAAsB;IACpD,2BAA2B,EAAE,sBAAsB;IACnD,oCAAoC,EAAE,+BAA+B;IACrE,uBAAuB,EAAE,mBAAmB;IAC5C,mBAAmB,EAAE,gBAAgB;IACrC,yBAAyB,EAAE,qBAAqB;IAChD,qBAAqB,EAAE,iBAAiB;IACxC,wBAAwB,EAAE,oBAAoB;IAC9C,6BAA6B,EAAE,wBAAwB;IACvD,uBAAuB,EAAE,mBAAmB;IAC5C,aAAa,EAAE,UAAU;IACzB,2BAA2B,EAAE,uBAAuB;IACpD,wBAAwB,EAAE,oBAAoB;IAC9C,qBAAqB,EAAE,gBAAgB;IACvC,SAAS,EAAE,QAAQ;IACnB,kBAAkB,EAAE,cAAc;IAClC,mBAAmB,EAAE,eAAe;IACpC,qBAAqB,EAAE,iBAAiB;IACxC,2BAA2B,EAAE,sBAAsB;IACnD,oBAAoB,EAAE,gBAAgB;IACtC,qBAAqB,EAAE,iBAAiB;IACxC,iCAAiC,EAAE,4BAA4B;IAC/D,gCAAgC,EAAE,2BAA2B;IAC7D,kCAAkC,EAAE,4BAA4B;IAChE,0BAA0B,EAAE,sBAAsB;IAClD,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,OAAO;IACjB,sBAAsB,EAAE,kBAAkB;IAC1C,wBAAwB,EAAE,oBAAoB;IAC9C,mCAAmC,EAAE,8BAA8B;IACnE,sBAAsB,EAAE,kBAAkB;IAC1C,mBAAmB,EAAE,eAAe;IACpC,sBAAsB,EAAE,kBAAkB;IAC1C,wBAAwB,EAAE,oBAAoB;IAC9C,uBAAuB,EAAE,mBAAmB;IAC5C,8BAA8B,EAAE,yBAAyB;IACzD,sBAAsB,EAAE,kBAAkB;IAC1C,oBAAoB,EAAE,gBAAgB;IACtC,iCAAiC,EAAE,4BAA4B;IAC/D,qCAAqC,EAAE,gCAAgC;IACvE,wBAAwB,EAAE,oBAAoB;IAC9C,sBAAsB,EAAE,kBAAkB;IAC1C,gCAAgC,EAAE,0BAA0B;IAC5D,uBAAuB,EAAE,mBAAmB;IAC5C,2BAA2B,EAAE,sBAAsB;IACnD,8BAA8B,EAAE,yBAAyB;IACzD,oBAAoB,EAAE,gBAAgB;IACtC,oBAAoB,EAAE,eAAe;IACrC,2BAA2B,EAAE,sBAAsB;IACnD,8BAA8B,EAAE,yBAAyB;IACzD,mBAAmB,EAAE,cAAc;IACnC,yBAAyB,EAAE,qBAAqB;IAChD,+BAA+B,EAAE,0BAA0B;IAC3D,qBAAqB,EAAE,iBAAiB;IACxC,2BAA2B,EAAE,uBAAuB;IACpD,oBAAoB,EAAE,iBAAiB;IACvC,aAAa,EAAE,UAAU;CAC1B,CAAC","sourcesContent":["import type { ActionEntry } from \"@agent-native/core/server\";\nimport approveDispatchChange from \"./approve-dispatch-change.js\";\nimport approveVaultRequest from \"./approve-vault-request.js\";\nimport archiveWorkspaceApp from \"./archive-workspace-app.js\";\nimport askApp from \"./ask_app.js\";\nimport createLinkToken from \"./create-link-token.js\";\nimport createPylonTicket from \"./create-pylon-ticket.js\";\nimport createVaultGrant from \"./create-vault-grant.js\";\nimport createVaultSecret from \"./create-vault-secret.js\";\nimport createWorkspaceResourceGrant from \"./create-workspace-resource-grant.js\";\nimport createWorkspaceResource from \"./create-workspace-resource.js\";\nimport createDreamReport from \"./create-dream-report.js\";\nimport createEmbedSession from \"./create_embed_session.js\";\nimport deleteDestination from \"./delete-destination.js\";\nimport deleteVaultSecret from \"./delete-vault-secret.js\";\nimport deleteWorkspaceResource from \"./delete-workspace-resource.js\";\nimport denyVaultRequest from \"./deny-vault-request.js\";\nimport ensureDreamJob from \"./ensure-dream-job.js\";\nimport getAppCreationSettings from \"./get-app-creation-settings.js\";\nimport getAgentThreadDebug from \"./get-agent-thread-debug.js\";\nimport getDream from \"./get-dream.js\";\nimport getDreamSettings from \"./get-dream-settings.js\";\nimport getDispatchSettings from \"./get-dispatch-settings.js\";\nimport getVaultAccessSettings from \"./get-vault-access-settings.js\";\nimport getWorkspaceResourceEffectiveContext from \"./get-workspace-resource-effective-context.js\";\nimport getWorkspaceInfo from \"./get-workspace-info.js\";\nimport grantWorkspaceResourcesToApp from \"./grant-workspace-resources-to-app.js\";\nimport grantVaultSecretsToApp from \"./grant-vault-secrets-to-app.js\";\nimport listAgentThreadSources from \"./list-agent-thread-sources.js\";\nimport listAvailableWorkspaceTemplates from \"./list-available-workspace-templates.js\";\nimport listConnectedAgents from \"./list-connected-agents.js\";\nimport listDestinations from \"./list-destinations.js\";\nimport listDispatchApprovals from \"./list-dispatch-approvals.js\";\nimport listDispatchAudit from \"./list-dispatch-audit.js\";\nimport listDispatchOverview from \"./list-dispatch-overview.js\";\nimport listDispatchUsageMetrics from \"./list-dispatch-usage-metrics.js\";\nimport listDreamCandidates from \"./list-dream-candidates.js\";\nimport listDreams from \"./list-dreams.js\";\nimport listIntegrationsCatalog from \"./list-integrations-catalog.js\";\nimport listLinkedIdentities from \"./list-linked-identities.js\";\nimport listMcpAppAccess from \"./list-mcp-app-access.js\";\nimport listApps from \"./list_apps.js\";\nimport listVaultAudit from \"./list-vault-audit.js\";\nimport listVaultGrants from \"./list-vault-grants.js\";\nimport listVaultRequests from \"./list-vault-requests.js\";\nimport listVaultSecretOptions from \"./list-vault-secret-options.js\";\nimport listVaultSecrets from \"./list-vault-secrets.js\";\nimport listWorkspaceApps from \"./list-workspace-apps.js\";\nimport listWorkspaceResourceOptions from \"./list-workspace-resource-options.js\";\nimport listWorkspaceResourceGrants from \"./list-workspace-resource-grants.js\";\nimport listWorkspaceResourcesForApp from \"./list-workspace-resources-for-app.js\";\nimport listWorkspaceResources from \"./list-workspace-resources.js\";\nimport navigate from \"./navigate.js\";\nimport openApp from \"./open_app.js\";\nimport applyDreamProposal from \"./apply-dream-proposal.js\";\nimport previewDreamProposal from \"./preview-dream-proposal.js\";\nimport previewWorkspaceResourceChange from \"./preview-workspace-resource-change.js\";\nimport providerApiCatalog from \"./provider-api-catalog.js\";\nimport providerApiDocs from \"./provider-api-docs.js\";\nimport providerApiRequest from \"./provider-api-request.js\";\nimport rejectDispatchChange from \"./reject-dispatch-change.js\";\nimport rejectDreamProposal from \"./reject-dream-proposal.js\";\nimport removePendingWorkspaceApp from \"./remove-pending-workspace-app.js\";\nimport requestVaultSecret from \"./request-vault-secret.js\";\nimport revokeVaultGrant from \"./revoke-vault-grant.js\";\nimport revokeWorkspaceResourceGrant from \"./revoke-workspace-resource-grant.js\";\nimport restoreStarterWorkspaceResources from \"./restore-starter-workspace-resources.js\";\nimport scaffoldWorkspaceApp from \"./scaffold-workspace-app.js\";\nimport searchAgentThreads from \"./search-agent-threads.js\";\nimport sendCodeAgentRemoteCommand from \"./send-code-agent-remote-command.js\";\nimport sendPlatformMessage from \"./send-platform-message.js\";\nimport setAppCreationSettings from \"./set-app-creation-settings.js\";\nimport setDispatchApprovalPolicy from \"./set-dispatch-approval-policy.js\";\nimport setDreamSettings from \"./set-dream-settings.js\";\nimport setMcpAppAccess from \"./set-mcp-app-access.js\";\nimport setVaultAccessSettings from \"./set-vault-access-settings.js\";\nimport startWorkspaceAppCreation from \"./start-workspace-app-creation.js\";\nimport syncVaultToApp from \"./sync-vault-to-app.js\";\nimport unarchiveWorkspaceApp from \"./unarchive-workspace-app.js\";\nimport updateWorkspaceAppMetadata from \"./update-workspace-app-metadata.js\";\nimport updateVaultSecret from \"./update-vault-secret.js\";\nimport updateWorkspaceResource from \"./update-workspace-resource.js\";\nimport upsertDestination from \"./upsert-destination.js\";\nimport viewScreen from \"./view-screen.js\";\n\n/**\n * Dispatch's actions registered as a flat name→entry map. Imported by\n * `@agent-native/dispatch/server`'s side-effect block, which calls\n * `registerPackageActions(dispatchActions)` so the framework's action\n * loader picks them up.\n */\nexport const dispatchActions: Record<string, ActionEntry> = {\n  \"approve-dispatch-change\": approveDispatchChange,\n  \"approve-vault-request\": approveVaultRequest,\n  \"archive-workspace-app\": archiveWorkspaceApp,\n  ask_app: askApp,\n  \"create-link-token\": createLinkToken,\n  \"create-pylon-ticket\": createPylonTicket,\n  \"create-vault-grant\": createVaultGrant,\n  \"create-vault-secret\": createVaultSecret,\n  \"create-workspace-resource-grant\": createWorkspaceResourceGrant,\n  \"create-workspace-resource\": createWorkspaceResource,\n  \"create-dream-report\": createDreamReport,\n  create_embed_session: createEmbedSession,\n  \"delete-destination\": deleteDestination,\n  \"delete-vault-secret\": deleteVaultSecret,\n  \"delete-workspace-resource\": deleteWorkspaceResource,\n  \"deny-vault-request\": denyVaultRequest,\n  \"ensure-dream-job\": ensureDreamJob,\n  \"get-app-creation-settings\": getAppCreationSettings,\n  \"get-agent-thread-debug\": getAgentThreadDebug,\n  \"get-dream\": getDream,\n  \"get-dream-settings\": getDreamSettings,\n  \"get-dispatch-settings\": getDispatchSettings,\n  \"get-vault-access-settings\": getVaultAccessSettings,\n  \"get-workspace-resource-effective-context\":\n    getWorkspaceResourceEffectiveContext,\n  \"get-workspace-info\": getWorkspaceInfo,\n  \"grant-workspace-resources-to-app\": grantWorkspaceResourcesToApp,\n  \"grant-vault-secrets-to-app\": grantVaultSecretsToApp,\n  \"list-agent-thread-sources\": listAgentThreadSources,\n  \"list-available-workspace-templates\": listAvailableWorkspaceTemplates,\n  \"list-connected-agents\": listConnectedAgents,\n  \"list-destinations\": listDestinations,\n  \"list-dispatch-approvals\": listDispatchApprovals,\n  \"list-dispatch-audit\": listDispatchAudit,\n  \"list-dispatch-overview\": listDispatchOverview,\n  \"list-dispatch-usage-metrics\": listDispatchUsageMetrics,\n  \"list-dream-candidates\": listDreamCandidates,\n  \"list-dreams\": listDreams,\n  \"list-integrations-catalog\": listIntegrationsCatalog,\n  \"list-linked-identities\": listLinkedIdentities,\n  \"list-mcp-app-access\": listMcpAppAccess,\n  list_apps: listApps,\n  \"list-vault-audit\": listVaultAudit,\n  \"list-vault-grants\": listVaultGrants,\n  \"list-vault-requests\": listVaultRequests,\n  \"list-vault-secret-options\": listVaultSecretOptions,\n  \"list-vault-secrets\": listVaultSecrets,\n  \"list-workspace-apps\": listWorkspaceApps,\n  \"list-workspace-resource-options\": listWorkspaceResourceOptions,\n  \"list-workspace-resource-grants\": listWorkspaceResourceGrants,\n  \"list-workspace-resources-for-app\": listWorkspaceResourcesForApp,\n  \"list-workspace-resources\": listWorkspaceResources,\n  navigate: navigate,\n  open_app: openApp,\n  \"apply-dream-proposal\": applyDreamProposal,\n  \"preview-dream-proposal\": previewDreamProposal,\n  \"preview-workspace-resource-change\": previewWorkspaceResourceChange,\n  \"provider-api-catalog\": providerApiCatalog,\n  \"provider-api-docs\": providerApiDocs,\n  \"provider-api-request\": providerApiRequest,\n  \"reject-dispatch-change\": rejectDispatchChange,\n  \"reject-dream-proposal\": rejectDreamProposal,\n  \"remove-pending-workspace-app\": removePendingWorkspaceApp,\n  \"request-vault-secret\": requestVaultSecret,\n  \"revoke-vault-grant\": revokeVaultGrant,\n  \"revoke-workspace-resource-grant\": revokeWorkspaceResourceGrant,\n  \"restore-starter-workspace-resources\": restoreStarterWorkspaceResources,\n  \"scaffold-workspace-app\": scaffoldWorkspaceApp,\n  \"search-agent-threads\": searchAgentThreads,\n  \"send-code-agent-remote-command\": sendCodeAgentRemoteCommand,\n  \"send-platform-message\": sendPlatformMessage,\n  \"set-app-creation-settings\": setAppCreationSettings,\n  \"set-dispatch-approval-policy\": setDispatchApprovalPolicy,\n  \"set-dream-settings\": setDreamSettings,\n  \"set-mcp-app-access\": setMcpAppAccess,\n  \"set-vault-access-settings\": setVaultAccessSettings,\n  \"start-workspace-app-creation\": startWorkspaceAppCreation,\n  \"sync-vault-to-app\": syncVaultToApp,\n  \"unarchive-workspace-app\": unarchiveWorkspaceApp,\n  \"update-workspace-app-metadata\": updateWorkspaceAppMetadata,\n  \"update-vault-secret\": updateVaultSecret,\n  \"update-workspace-resource\": updateWorkspaceResource,\n  \"upsert-destination\": upsertDestination,\n  \"view-screen\": viewScreen,\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/actions/index.ts"],"names":[],"mappings":"AACA,OAAO,qBAAqB,MAAM,8BAA8B,CAAC;AACjE,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,MAAM,MAAM,cAAc,CAAC;AAClC,OAAO,eAAe,MAAM,wBAAwB,CAAC;AACrD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,4BAA4B,MAAM,sCAAsC,CAAC;AAChF,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AACrE,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,iBAAiB,MAAM,yBAAyB,CAAC;AACxD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AACrE,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,cAAc,MAAM,uBAAuB,CAAC;AACnD,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,mBAAmB,MAAM,6BAA6B,CAAC;AAC9D,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,oCAAoC,MAAM,+CAA+C,CAAC;AACjG,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,4BAA4B,MAAM,uCAAuC,CAAC;AACjF,OAAO,sBAAsB,MAAM,iCAAiC,CAAC;AACrE,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,+BAA+B,MAAM,yCAAyC,CAAC;AACtF,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,gBAAgB,MAAM,wBAAwB,CAAC;AACtD,OAAO,qBAAqB,MAAM,8BAA8B,CAAC;AACjE,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,wBAAwB,MAAM,kCAAkC,CAAC;AACxE,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAC1C,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AACrE,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,gBAAgB,MAAM,0BAA0B,CAAC;AACxD,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,cAAc,MAAM,uBAAuB,CAAC;AACnD,OAAO,eAAe,MAAM,wBAAwB,CAAC;AACrD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,4BAA4B,MAAM,sCAAsC,CAAC;AAChF,OAAO,2BAA2B,MAAM,qCAAqC,CAAC;AAC9E,OAAO,4BAA4B,MAAM,uCAAuC,CAAC;AACjF,OAAO,sBAAsB,MAAM,+BAA+B,CAAC;AACnE,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,OAAO,MAAM,eAAe,CAAC;AACpC,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,8BAA8B,MAAM,wCAAwC,CAAC;AACpF,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,eAAe,MAAM,wBAAwB,CAAC;AACrD,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,yBAAyB,MAAM,mCAAmC,CAAC;AAC1E,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,4BAA4B,MAAM,sCAAsC,CAAC;AAChF,OAAO,gCAAgC,MAAM,0CAA0C,CAAC;AACxF,OAAO,oBAAoB,MAAM,6BAA6B,CAAC;AAC/D,OAAO,kBAAkB,MAAM,2BAA2B,CAAC;AAC3D,OAAO,0BAA0B,MAAM,qCAAqC,CAAC;AAC7E,OAAO,mBAAmB,MAAM,4BAA4B,CAAC;AAC7D,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,yBAAyB,MAAM,mCAAmC,CAAC;AAC1E,OAAO,gBAAgB,MAAM,yBAAyB,CAAC;AACvD,OAAO,eAAe,MAAM,yBAAyB,CAAC;AACtD,OAAO,sBAAsB,MAAM,gCAAgC,CAAC;AACpE,OAAO,yBAAyB,MAAM,mCAAmC,CAAC;AAC1E,OAAO,cAAc,MAAM,wBAAwB,CAAC;AACpD,OAAO,qBAAqB,MAAM,8BAA8B,CAAC;AACjE,OAAO,0BAA0B,MAAM,oCAAoC,CAAC;AAC5E,OAAO,iBAAiB,MAAM,0BAA0B,CAAC;AACzD,OAAO,uBAAuB,MAAM,gCAAgC,CAAC;AACrE,OAAO,iBAAiB,MAAM,yBAAyB,CAAC;AACxD,OAAO,UAAU,MAAM,kBAAkB,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgC;IAC1D,yBAAyB,EAAE,qBAAqB;IAChD,uBAAuB,EAAE,mBAAmB;IAC5C,uBAAuB,EAAE,mBAAmB;IAC5C,OAAO,EAAE,MAAM;IACf,mBAAmB,EAAE,eAAe;IACpC,qBAAqB,EAAE,iBAAiB;IACxC,oBAAoB,EAAE,gBAAgB;IACtC,qBAAqB,EAAE,iBAAiB;IACxC,iCAAiC,EAAE,4BAA4B;IAC/D,2BAA2B,EAAE,uBAAuB;IACpD,qBAAqB,EAAE,iBAAiB;IACxC,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,iBAAiB;IACvC,qBAAqB,EAAE,iBAAiB;IACxC,2BAA2B,EAAE,uBAAuB;IACpD,oBAAoB,EAAE,gBAAgB;IACtC,kBAAkB,EAAE,cAAc;IAClC,2BAA2B,EAAE,sBAAsB;IACnD,wBAAwB,EAAE,mBAAmB;IAC7C,WAAW,EAAE,QAAQ;IACrB,oBAAoB,EAAE,gBAAgB;IACtC,uBAAuB,EAAE,mBAAmB;IAC5C,2BAA2B,EAAE,sBAAsB;IACnD,0CAA0C,EACxC,oCAAoC;IACtC,oBAAoB,EAAE,gBAAgB;IACtC,kCAAkC,EAAE,4BAA4B;IAChE,4BAA4B,EAAE,sBAAsB;IACpD,2BAA2B,EAAE,sBAAsB;IACnD,oCAAoC,EAAE,+BAA+B;IACrE,uBAAuB,EAAE,mBAAmB;IAC5C,mBAAmB,EAAE,gBAAgB;IACrC,yBAAyB,EAAE,qBAAqB;IAChD,qBAAqB,EAAE,iBAAiB;IACxC,wBAAwB,EAAE,oBAAoB;IAC9C,6BAA6B,EAAE,wBAAwB;IACvD,uBAAuB,EAAE,mBAAmB;IAC5C,aAAa,EAAE,UAAU;IACzB,2BAA2B,EAAE,uBAAuB;IACpD,wBAAwB,EAAE,oBAAoB;IAC9C,qBAAqB,EAAE,gBAAgB;IACvC,SAAS,EAAE,QAAQ;IACnB,kBAAkB,EAAE,cAAc;IAClC,mBAAmB,EAAE,eAAe;IACpC,qBAAqB,EAAE,iBAAiB;IACxC,2BAA2B,EAAE,sBAAsB;IACnD,oBAAoB,EAAE,gBAAgB;IACtC,qBAAqB,EAAE,iBAAiB;IACxC,iCAAiC,EAAE,4BAA4B;IAC/D,gCAAgC,EAAE,2BAA2B;IAC7D,kCAAkC,EAAE,4BAA4B;IAChE,0BAA0B,EAAE,sBAAsB;IAClD,QAAQ,EAAE,QAAQ;IAClB,QAAQ,EAAE,OAAO;IACjB,sBAAsB,EAAE,kBAAkB;IAC1C,wBAAwB,EAAE,oBAAoB;IAC9C,mCAAmC,EAAE,8BAA8B;IACnE,sBAAsB,EAAE,kBAAkB;IAC1C,mBAAmB,EAAE,eAAe;IACpC,uBAAuB,EAAE,mBAAmB;IAC5C,sBAAsB,EAAE,kBAAkB;IAC1C,wBAAwB,EAAE,oBAAoB;IAC9C,uBAAuB,EAAE,mBAAmB;IAC5C,8BAA8B,EAAE,yBAAyB;IACzD,sBAAsB,EAAE,kBAAkB;IAC1C,oBAAoB,EAAE,gBAAgB;IACtC,iCAAiC,EAAE,4BAA4B;IAC/D,qCAAqC,EAAE,gCAAgC;IACvE,wBAAwB,EAAE,oBAAoB;IAC9C,sBAAsB,EAAE,kBAAkB;IAC1C,gCAAgC,EAAE,0BAA0B;IAC5D,uBAAuB,EAAE,mBAAmB;IAC5C,2BAA2B,EAAE,sBAAsB;IACnD,8BAA8B,EAAE,yBAAyB;IACzD,oBAAoB,EAAE,gBAAgB;IACtC,oBAAoB,EAAE,eAAe;IACrC,2BAA2B,EAAE,sBAAsB;IACnD,8BAA8B,EAAE,yBAAyB;IACzD,mBAAmB,EAAE,cAAc;IACnC,yBAAyB,EAAE,qBAAqB;IAChD,+BAA+B,EAAE,0BAA0B;IAC3D,qBAAqB,EAAE,iBAAiB;IACxC,2BAA2B,EAAE,uBAAuB;IACpD,oBAAoB,EAAE,iBAAiB;IACvC,aAAa,EAAE,UAAU;CAC1B,CAAC","sourcesContent":["import type { ActionEntry } from \"@agent-native/core/server\";\nimport approveDispatchChange from \"./approve-dispatch-change.js\";\nimport approveVaultRequest from \"./approve-vault-request.js\";\nimport archiveWorkspaceApp from \"./archive-workspace-app.js\";\nimport askApp from \"./ask_app.js\";\nimport createLinkToken from \"./create-link-token.js\";\nimport createPylonTicket from \"./create-pylon-ticket.js\";\nimport createVaultGrant from \"./create-vault-grant.js\";\nimport createVaultSecret from \"./create-vault-secret.js\";\nimport createWorkspaceResourceGrant from \"./create-workspace-resource-grant.js\";\nimport createWorkspaceResource from \"./create-workspace-resource.js\";\nimport createDreamReport from \"./create-dream-report.js\";\nimport createEmbedSession from \"./create_embed_session.js\";\nimport deleteDestination from \"./delete-destination.js\";\nimport deleteVaultSecret from \"./delete-vault-secret.js\";\nimport deleteWorkspaceResource from \"./delete-workspace-resource.js\";\nimport denyVaultRequest from \"./deny-vault-request.js\";\nimport ensureDreamJob from \"./ensure-dream-job.js\";\nimport getAppCreationSettings from \"./get-app-creation-settings.js\";\nimport getAgentThreadDebug from \"./get-agent-thread-debug.js\";\nimport getDream from \"./get-dream.js\";\nimport getDreamSettings from \"./get-dream-settings.js\";\nimport getDispatchSettings from \"./get-dispatch-settings.js\";\nimport getVaultAccessSettings from \"./get-vault-access-settings.js\";\nimport getWorkspaceResourceEffectiveContext from \"./get-workspace-resource-effective-context.js\";\nimport getWorkspaceInfo from \"./get-workspace-info.js\";\nimport grantWorkspaceResourcesToApp from \"./grant-workspace-resources-to-app.js\";\nimport grantVaultSecretsToApp from \"./grant-vault-secrets-to-app.js\";\nimport listAgentThreadSources from \"./list-agent-thread-sources.js\";\nimport listAvailableWorkspaceTemplates from \"./list-available-workspace-templates.js\";\nimport listConnectedAgents from \"./list-connected-agents.js\";\nimport listDestinations from \"./list-destinations.js\";\nimport listDispatchApprovals from \"./list-dispatch-approvals.js\";\nimport listDispatchAudit from \"./list-dispatch-audit.js\";\nimport listDispatchOverview from \"./list-dispatch-overview.js\";\nimport listDispatchUsageMetrics from \"./list-dispatch-usage-metrics.js\";\nimport listDreamCandidates from \"./list-dream-candidates.js\";\nimport listDreams from \"./list-dreams.js\";\nimport listIntegrationsCatalog from \"./list-integrations-catalog.js\";\nimport listLinkedIdentities from \"./list-linked-identities.js\";\nimport listMcpAppAccess from \"./list-mcp-app-access.js\";\nimport listApps from \"./list_apps.js\";\nimport listVaultAudit from \"./list-vault-audit.js\";\nimport listVaultGrants from \"./list-vault-grants.js\";\nimport listVaultRequests from \"./list-vault-requests.js\";\nimport listVaultSecretOptions from \"./list-vault-secret-options.js\";\nimport listVaultSecrets from \"./list-vault-secrets.js\";\nimport listWorkspaceApps from \"./list-workspace-apps.js\";\nimport listWorkspaceResourceOptions from \"./list-workspace-resource-options.js\";\nimport listWorkspaceResourceGrants from \"./list-workspace-resource-grants.js\";\nimport listWorkspaceResourcesForApp from \"./list-workspace-resources-for-app.js\";\nimport listWorkspaceResources from \"./list-workspace-resources.js\";\nimport navigate from \"./navigate.js\";\nimport openApp from \"./open_app.js\";\nimport applyDreamProposal from \"./apply-dream-proposal.js\";\nimport previewDreamProposal from \"./preview-dream-proposal.js\";\nimport previewWorkspaceResourceChange from \"./preview-workspace-resource-change.js\";\nimport providerApiCatalog from \"./provider-api-catalog.js\";\nimport providerApiDocs from \"./provider-api-docs.js\";\nimport providerApiRegister from \"./provider-api-register.js\";\nimport providerApiRequest from \"./provider-api-request.js\";\nimport rejectDispatchChange from \"./reject-dispatch-change.js\";\nimport rejectDreamProposal from \"./reject-dream-proposal.js\";\nimport removePendingWorkspaceApp from \"./remove-pending-workspace-app.js\";\nimport requestVaultSecret from \"./request-vault-secret.js\";\nimport revokeVaultGrant from \"./revoke-vault-grant.js\";\nimport revokeWorkspaceResourceGrant from \"./revoke-workspace-resource-grant.js\";\nimport restoreStarterWorkspaceResources from \"./restore-starter-workspace-resources.js\";\nimport scaffoldWorkspaceApp from \"./scaffold-workspace-app.js\";\nimport searchAgentThreads from \"./search-agent-threads.js\";\nimport sendCodeAgentRemoteCommand from \"./send-code-agent-remote-command.js\";\nimport sendPlatformMessage from \"./send-platform-message.js\";\nimport setAppCreationSettings from \"./set-app-creation-settings.js\";\nimport setDispatchApprovalPolicy from \"./set-dispatch-approval-policy.js\";\nimport setDreamSettings from \"./set-dream-settings.js\";\nimport setMcpAppAccess from \"./set-mcp-app-access.js\";\nimport setVaultAccessSettings from \"./set-vault-access-settings.js\";\nimport startWorkspaceAppCreation from \"./start-workspace-app-creation.js\";\nimport syncVaultToApp from \"./sync-vault-to-app.js\";\nimport unarchiveWorkspaceApp from \"./unarchive-workspace-app.js\";\nimport updateWorkspaceAppMetadata from \"./update-workspace-app-metadata.js\";\nimport updateVaultSecret from \"./update-vault-secret.js\";\nimport updateWorkspaceResource from \"./update-workspace-resource.js\";\nimport upsertDestination from \"./upsert-destination.js\";\nimport viewScreen from \"./view-screen.js\";\n\n/**\n * Dispatch's actions registered as a flat name→entry map. Imported by\n * `@agent-native/dispatch/server`'s side-effect block, which calls\n * `registerPackageActions(dispatchActions)` so the framework's action\n * loader picks them up.\n */\nexport const dispatchActions: Record<string, ActionEntry> = {\n  \"approve-dispatch-change\": approveDispatchChange,\n  \"approve-vault-request\": approveVaultRequest,\n  \"archive-workspace-app\": archiveWorkspaceApp,\n  ask_app: askApp,\n  \"create-link-token\": createLinkToken,\n  \"create-pylon-ticket\": createPylonTicket,\n  \"create-vault-grant\": createVaultGrant,\n  \"create-vault-secret\": createVaultSecret,\n  \"create-workspace-resource-grant\": createWorkspaceResourceGrant,\n  \"create-workspace-resource\": createWorkspaceResource,\n  \"create-dream-report\": createDreamReport,\n  create_embed_session: createEmbedSession,\n  \"delete-destination\": deleteDestination,\n  \"delete-vault-secret\": deleteVaultSecret,\n  \"delete-workspace-resource\": deleteWorkspaceResource,\n  \"deny-vault-request\": denyVaultRequest,\n  \"ensure-dream-job\": ensureDreamJob,\n  \"get-app-creation-settings\": getAppCreationSettings,\n  \"get-agent-thread-debug\": getAgentThreadDebug,\n  \"get-dream\": getDream,\n  \"get-dream-settings\": getDreamSettings,\n  \"get-dispatch-settings\": getDispatchSettings,\n  \"get-vault-access-settings\": getVaultAccessSettings,\n  \"get-workspace-resource-effective-context\":\n    getWorkspaceResourceEffectiveContext,\n  \"get-workspace-info\": getWorkspaceInfo,\n  \"grant-workspace-resources-to-app\": grantWorkspaceResourcesToApp,\n  \"grant-vault-secrets-to-app\": grantVaultSecretsToApp,\n  \"list-agent-thread-sources\": listAgentThreadSources,\n  \"list-available-workspace-templates\": listAvailableWorkspaceTemplates,\n  \"list-connected-agents\": listConnectedAgents,\n  \"list-destinations\": listDestinations,\n  \"list-dispatch-approvals\": listDispatchApprovals,\n  \"list-dispatch-audit\": listDispatchAudit,\n  \"list-dispatch-overview\": listDispatchOverview,\n  \"list-dispatch-usage-metrics\": listDispatchUsageMetrics,\n  \"list-dream-candidates\": listDreamCandidates,\n  \"list-dreams\": listDreams,\n  \"list-integrations-catalog\": listIntegrationsCatalog,\n  \"list-linked-identities\": listLinkedIdentities,\n  \"list-mcp-app-access\": listMcpAppAccess,\n  list_apps: listApps,\n  \"list-vault-audit\": listVaultAudit,\n  \"list-vault-grants\": listVaultGrants,\n  \"list-vault-requests\": listVaultRequests,\n  \"list-vault-secret-options\": listVaultSecretOptions,\n  \"list-vault-secrets\": listVaultSecrets,\n  \"list-workspace-apps\": listWorkspaceApps,\n  \"list-workspace-resource-options\": listWorkspaceResourceOptions,\n  \"list-workspace-resource-grants\": listWorkspaceResourceGrants,\n  \"list-workspace-resources-for-app\": listWorkspaceResourcesForApp,\n  \"list-workspace-resources\": listWorkspaceResources,\n  navigate: navigate,\n  open_app: openApp,\n  \"apply-dream-proposal\": applyDreamProposal,\n  \"preview-dream-proposal\": previewDreamProposal,\n  \"preview-workspace-resource-change\": previewWorkspaceResourceChange,\n  \"provider-api-catalog\": providerApiCatalog,\n  \"provider-api-docs\": providerApiDocs,\n  \"provider-api-register\": providerApiRegister,\n  \"provider-api-request\": providerApiRequest,\n  \"reject-dispatch-change\": rejectDispatchChange,\n  \"reject-dream-proposal\": rejectDreamProposal,\n  \"remove-pending-workspace-app\": removePendingWorkspaceApp,\n  \"request-vault-secret\": requestVaultSecret,\n  \"revoke-vault-grant\": revokeVaultGrant,\n  \"revoke-workspace-resource-grant\": revokeWorkspaceResourceGrant,\n  \"restore-starter-workspace-resources\": restoreStarterWorkspaceResources,\n  \"scaffold-workspace-app\": scaffoldWorkspaceApp,\n  \"search-agent-threads\": searchAgentThreads,\n  \"send-code-agent-remote-command\": sendCodeAgentRemoteCommand,\n  \"send-platform-message\": sendPlatformMessage,\n  \"set-app-creation-settings\": setAppCreationSettings,\n  \"set-dispatch-approval-policy\": setDispatchApprovalPolicy,\n  \"set-dream-settings\": setDreamSettings,\n  \"set-mcp-app-access\": setMcpAppAccess,\n  \"set-vault-access-settings\": setVaultAccessSettings,\n  \"start-workspace-app-creation\": startWorkspaceAppCreation,\n  \"sync-vault-to-app\": syncVaultToApp,\n  \"unarchive-workspace-app\": unarchiveWorkspaceApp,\n  \"update-workspace-app-metadata\": updateWorkspaceAppMetadata,\n  \"update-vault-secret\": updateVaultSecret,\n  \"update-workspace-resource\": updateWorkspaceResource,\n  \"upsert-destination\": upsertDestination,\n  \"view-screen\": viewScreen,\n};\n"]}

package/dist/actions/provider-api-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api-catalog.d.ts","sourceRoot":"","sources":["../../src/actions/provider-api-catalog.ts"],"names":[],"mappings":";AASA,wBAiBG"}
+{"version":3,"file":"provider-api-catalog.d.ts","sourceRoot":"","sources":["../../src/actions/provider-api-catalog.ts"],"names":[],"mappings":";AAIA,wBAqBG"}

package/dist/actions/provider-api-catalog.js

@@ -1,18 +1,21 @@
 import { defineAction } from "@agent-native/core";
 import { z } from "zod";
-import { DISPATCH_PROVIDER_API_IDS, listProviderApiCatalog, } from "../server/lib/provider-api.js";
-const ProviderSchema = z.enum(DISPATCH_PROVIDER_API_IDS);
+import { listProviderApiCatalog } from "../server/lib/provider-api.js";
 export default defineAction({
-    description: "List raw HTTP API capabilities for shared workspace integrations and configured providers. Use before provider-api-request when grant/setup metadata is not enough and the provider's actual API must be inspected. Returns base URLs, auth style, credential key names, docs/spec URLs, placeholders, and examples; never returns secret values.",
+    description: "List raw HTTP API capabilities for shared workspace integrations, configured providers, and custom registered providers. Use before provider-api-request when grant/setup metadata is not enough and the provider's actual API must be inspected. Returns base URLs, auth style, credential key names, docs/spec URLs, placeholders, and examples; never returns secret values. Custom providers registered via provider-api-register are included.",
     schema: z.object({
-        provider: ProviderSchema.optional().describe("Optional provider id to inspect. Omit to list every provider API escape hatch."),
+        provider: z
+            .string()
+            .optional()
+            .describe("Optional provider id to inspect (built-in or custom). Omit to list every available provider API."),
     }),
     http: { method: "GET" },
     readOnly: true,
     run: async ({ provider }) => {
+        const providers = await listProviderApiCatalog(provider);
         return {
-            providers: listProviderApiCatalog(provider),
-            guidance: "Workspace integrations and grants are not capability limits. When a provider can answer a question through its HTTP API, inspect docs/spec URLs here and call provider-api-request with the exact provider API method/path/query/body instead of adding a rigid one-off action.",
+            providers,
+            guidance: "Workspace integrations and grants are not capability limits. When a provider can answer a question through its HTTP API, inspect docs/spec URLs here and call provider-api-request with the exact provider API method/path/query/body instead of adding a rigid one-off action. Custom providers registered via provider-api-register also appear here.",
         };
     },
 });

package/dist/actions/provider-api-catalog.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api-catalog.js","sourceRoot":"","sources":["../../src/actions/provider-api-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEzD,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,mVAAmV;IACrV,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAC1C,gFAAgF,CACjF;KACF,CAAC;IACF,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IACvB,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC1B,OAAO;YACL,SAAS,EAAE,sBAAsB,CAAC,QAAQ,CAAC;YAC3C,QAAQ,EACN,iRAAiR;SACpR,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { defineAction } from \"@agent-native/core\";\nimport { z } from \"zod\";\nimport {\n  DISPATCH_PROVIDER_API_IDS,\n  listProviderApiCatalog,\n} from \"../server/lib/provider-api.js\";\n\nconst ProviderSchema = z.enum(DISPATCH_PROVIDER_API_IDS);\n\nexport default defineAction({\n  description:\n    \"List raw HTTP API capabilities for shared workspace integrations and configured providers. Use before provider-api-request when grant/setup metadata is not enough and the provider's actual API must be inspected. Returns base URLs, auth style, credential key names, docs/spec URLs, placeholders, and examples; never returns secret values.\",\n  schema: z.object({\n    provider: ProviderSchema.optional().describe(\n      \"Optional provider id to inspect. Omit to list every provider API escape hatch.\",\n    ),\n  }),\n  http: { method: \"GET\" },\n  readOnly: true,\n  run: async ({ provider }) => {\n    return {\n      providers: listProviderApiCatalog(provider),\n      guidance:\n        \"Workspace integrations and grants are not capability limits. When a provider can answer a question through its HTTP API, inspect docs/spec URLs here and call provider-api-request with the exact provider API method/path/query/body instead of adding a rigid one-off action.\",\n    };\n  },\n});\n"]}
+{"version":3,"file":"provider-api-catalog.js","sourceRoot":"","sources":["../../src/actions/provider-api-catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,qbAAqb;IACvb,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,kGAAkG,CACnG;KACJ,CAAC;IACF,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IACvB,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzD,OAAO;YACL,SAAS;YACT,QAAQ,EACN,yVAAyV;SAC5V,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { defineAction } from \"@agent-native/core\";\nimport { z } from \"zod\";\nimport { listProviderApiCatalog } from \"../server/lib/provider-api.js\";\n\nexport default defineAction({\n  description:\n    \"List raw HTTP API capabilities for shared workspace integrations, configured providers, and custom registered providers. Use before provider-api-request when grant/setup metadata is not enough and the provider's actual API must be inspected. Returns base URLs, auth style, credential key names, docs/spec URLs, placeholders, and examples; never returns secret values. Custom providers registered via provider-api-register are included.\",\n  schema: z.object({\n    provider: z\n      .string()\n      .optional()\n      .describe(\n        \"Optional provider id to inspect (built-in or custom). Omit to list every available provider API.\",\n      ),\n  }),\n  http: { method: \"GET\" },\n  readOnly: true,\n  run: async ({ provider }) => {\n    const providers = await listProviderApiCatalog(provider);\n    return {\n      providers,\n      guidance:\n        \"Workspace integrations and grants are not capability limits. When a provider can answer a question through its HTTP API, inspect docs/spec URLs here and call provider-api-request with the exact provider API method/path/query/body instead of adding a rigid one-off action. Custom providers registered via provider-api-register also appear here.\",\n    };\n  },\n});\n"]}

package/dist/actions/provider-api-docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api-docs.d.ts","sourceRoot":"","sources":["../../src/actions/provider-api-docs.ts"],"names":[],"mappings":";AASA,wBAyBG"}
+{"version":3,"file":"provider-api-docs.d.ts","sourceRoot":"","sources":["../../src/actions/provider-api-docs.ts"],"names":[],"mappings":";AAIA,wBA4BG"}

package/dist/actions/provider-api-docs.js

@@ -1,16 +1,18 @@
 import { defineAction } from "@agent-native/core";
 import { z } from "zod";
-import { DISPATCH_PROVIDER_API_IDS, fetchProviderApiDocs, } from "../server/lib/provider-api.js";
-const ProviderSchema = z.enum(DISPATCH_PROVIDER_API_IDS);
+import { fetchProviderApiDocs } from "../server/lib/provider-api.js";
 export default defineAction({
-    description: "Inspect provider API docs/spec metadata, or fetch a registered provider docs/spec URL. Use this before arbitrary provider-api-request calls when the exact endpoint, filter operator, payload shape, pagination, or API version is uncertain.",
+    description: "Inspect provider API docs/spec metadata, or fetch ANY public API documentation page, OpenAPI spec, changelog, or web page. Registered docs/spec URLs from provider-api-catalog are curated starting points, but any public https/http URL is allowed. Use web-search to find documentation URLs first when uncertain, then fetch them here. SSRF guard still applies — private/internal addresses are blocked.",
     schema: z.object({
-        provider: ProviderSchema.describe("Provider whose API docs/spec to inspect."),
+        provider: z
+            .string()
+            .min(1)
+            .describe("Provider whose API docs/spec to inspect. Can be a built-in provider id or a custom provider id registered via provider-api-register."),
         url: z
             .string()
             .url()
             .optional()
-            .describe("Optional docs/spec URL from provider-api-catalog to fetch. Only registered docs/spec origins are allowed."),
+            .describe("Optional URL to fetch. Can be any public https/http URL — API documentation pages, OpenAPI specs, changelogs, README files, etc. Registered docs/spec URLs from provider-api-catalog are curated starting points."),
         maxBytes: z.coerce
             .number()
             .int()

package/dist/actions/provider-api-docs.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api-docs.js","sourceRoot":"","sources":["../../src/actions/provider-api-docs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AAEzD,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,+OAA+O;IACjP,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAC/B,0CAA0C,CAC3C;QACD,GAAG,EAAE,CAAC;aACH,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CACP,2GAA2G,CAC5G;QACH,QAAQ,EAAE,CAAC,CAAC,MAAM;aACf,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,KAAK,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;aACpB,QAAQ,EAAE;aACV,QAAQ,CAAC,uDAAuD,CAAC;KACrE,CAAC;IACF,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IACvB,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC","sourcesContent":["import { defineAction } from \"@agent-native/core\";\nimport { z } from \"zod\";\nimport {\n  DISPATCH_PROVIDER_API_IDS,\n  fetchProviderApiDocs,\n} from \"../server/lib/provider-api.js\";\n\nconst ProviderSchema = z.enum(DISPATCH_PROVIDER_API_IDS);\n\nexport default defineAction({\n  description:\n    \"Inspect provider API docs/spec metadata, or fetch a registered provider docs/spec URL. Use this before arbitrary provider-api-request calls when the exact endpoint, filter operator, payload shape, pagination, or API version is uncertain.\",\n  schema: z.object({\n    provider: ProviderSchema.describe(\n      \"Provider whose API docs/spec to inspect.\",\n    ),\n    url: z\n      .string()\n      .url()\n      .optional()\n      .describe(\n        \"Optional docs/spec URL from provider-api-catalog to fetch. Only registered docs/spec origins are allowed.\",\n      ),\n    maxBytes: z.coerce\n      .number()\n      .int()\n      .min(1_000)\n      .max(4 * 1024 * 1024)\n      .optional()\n      .describe(\"Maximum response bytes to read. Default 1MB, max 4MB.\"),\n  }),\n  http: { method: \"GET\" },\n  readOnly: true,\n  run: async (args) => fetchProviderApiDocs(args),\n});\n"]}
+{"version":3,"file":"provider-api-docs.js","sourceRoot":"","sources":["../../src/actions/provider-api-docs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,gZAAgZ;IAClZ,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,sIAAsI,CACvI;QACH,GAAG,EAAE,CAAC;aACH,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CACP,mNAAmN,CACpN;QACH,QAAQ,EAAE,CAAC,CAAC,MAAM;aACf,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,KAAK,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;aACpB,QAAQ,EAAE;aACV,QAAQ,CAAC,uDAAuD,CAAC;KACrE,CAAC;IACF,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IACvB,QAAQ,EAAE,IAAI;IACd,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC","sourcesContent":["import { defineAction } from \"@agent-native/core\";\nimport { z } from \"zod\";\nimport { fetchProviderApiDocs } from \"../server/lib/provider-api.js\";\n\nexport default defineAction({\n  description:\n    \"Inspect provider API docs/spec metadata, or fetch ANY public API documentation page, OpenAPI spec, changelog, or web page. Registered docs/spec URLs from provider-api-catalog are curated starting points, but any public https/http URL is allowed. Use web-search to find documentation URLs first when uncertain, then fetch them here. SSRF guard still applies — private/internal addresses are blocked.\",\n  schema: z.object({\n    provider: z\n      .string()\n      .min(1)\n      .describe(\n        \"Provider whose API docs/spec to inspect. Can be a built-in provider id or a custom provider id registered via provider-api-register.\",\n      ),\n    url: z\n      .string()\n      .url()\n      .optional()\n      .describe(\n        \"Optional URL to fetch. Can be any public https/http URL — API documentation pages, OpenAPI specs, changelogs, README files, etc. Registered docs/spec URLs from provider-api-catalog are curated starting points.\",\n      ),\n    maxBytes: z.coerce\n      .number()\n      .int()\n      .min(1_000)\n      .max(4 * 1024 * 1024)\n      .optional()\n      .describe(\"Maximum response bytes to read. Default 1MB, max 4MB.\"),\n  }),\n  http: { method: \"GET\" },\n  readOnly: true,\n  run: async (args) => fetchProviderApiDocs(args),\n});\n"]}

package/dist/actions/provider-api-register.d.ts

@@ -0,0 +1,3 @@
+declare const _default: any;
+export default _default;
+//# sourceMappingURL=provider-api-register.d.ts.map

package/dist/actions/provider-api-register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-api-register.d.ts","sourceRoot":"","sources":["../../src/actions/provider-api-register.ts"],"names":[],"mappings":";AA+CA,wBAsJG"}

package/dist/actions/provider-api-register.js

@@ -0,0 +1,160 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import { upsertCustomProvider, deleteCustomProvider, listCustomProviders, getCustomProvider, } from "@agent-native/core/provider-api";
+import { getCredentialContext } from "@agent-native/core/server";
+const AuthSchema = z.discriminatedUnion("type", [
+    z.object({
+        type: z.literal("none"),
+    }),
+    z.object({
+        type: z.literal("bearer"),
+        credentialKey: z
+            .string()
+            .min(1)
+            .describe("Name of the credential key (e.g. MY_API_TOKEN). Must already be saved via app secrets — this action never accepts secret values."),
+    }),
+    z.object({
+        type: z.literal("basic"),
+        usernameKey: z
+            .string()
+            .min(1)
+            .describe("Credential key name for the username/login."),
+        passwordKey: z
+            .string()
+            .min(1)
+            .describe("Credential key name for the password/secret."),
+    }),
+    z.object({
+        type: z.literal("api-key-header"),
+        credentialKey: z
+            .string()
+            .min(1)
+            .describe("Credential key name for the API key value."),
+        headerName: z
+            .string()
+            .min(1)
+            .describe("HTTP header name to send the key in (e.g. X-Api-Key)."),
+    }),
+]);
+export default defineAction({
+    description: `Register or update a custom API provider so the agent can call it via provider-api-request and look up its docs via provider-api-docs.
+
+IMPORTANT — credentials:
+- This action stores only credential KEY NAMES, never secret values.
+- If the required API key is not yet saved, instruct the user to add it via app Settings → Keys, or use the create-vault-secret action, before calling this action.
+- Supported auth kinds: none, bearer, basic, api-key-header.
+  google-service-account and oauth-bearer are NOT supported for custom providers.
+
+After registration the provider appears in provider-api-catalog and can be used with provider-api-request.`,
+    schema: z.object({
+        operation: z
+            .enum(["upsert", "delete", "list", "get"])
+            .default("upsert")
+            .describe("Operation: upsert (create or update), delete (remove), list (all custom providers), get (single provider)."),
+        id: z
+            .string()
+            .min(1)
+            .max(64)
+            .optional()
+            .describe("Provider slug (e.g. my-api). Lowercase letters, digits, hyphens only. Required for upsert/delete/get."),
+        label: z
+            .string()
+            .min(1)
+            .max(200)
+            .optional()
+            .describe("Human-readable name (e.g. 'My Analytics API'). Required for upsert."),
+        baseUrl: z
+            .string()
+            .url()
+            .optional()
+            .describe("Base URL for the API (e.g. https://api.example.com/v1). Required for upsert. Must be a public https/http URL."),
+        auth: AuthSchema.optional().describe("Auth configuration. Required for upsert. Use type 'none' for public APIs."),
+        docsUrls: z
+            .array(z.string().url())
+            .optional()
+            .describe("Optional list of documentation URLs for this provider."),
+        allowedHostSuffixes: z
+            .array(z.string())
+            .optional()
+            .describe("Optional list of additional host suffixes requests may target beyond the base URL origin (e.g. ['example.com'])."),
+        defaultHeaders: z
+            .record(z.string(), z.string())
+            .optional()
+            .describe("Optional headers to include on every request (e.g. { 'Accept': 'application/json' })."),
+        notes: z
+            .string()
+            .max(1000)
+            .optional()
+            .describe("Optional notes about this provider shown in the catalog."),
+        scope: z
+            .enum(["user", "org"])
+            .default("org")
+            .describe("Whether to store the provider for the current user only ('user') or for the whole workspace ('org')."),
+    }),
+    http: false,
+    run: async ({ operation, id, label, baseUrl, auth, docsUrls, allowedHostSuffixes, defaultHeaders, notes, scope, }) => {
+        const ctx = getCredentialContext();
+        if (!ctx) {
+            throw new Error("provider-api-register requires an authenticated request context.");
+        }
+        const scopeId = scope === "org" ? (ctx.orgId ?? ctx.userEmail) : ctx.userEmail;
+        if (operation === "list") {
+            const providers = await listCustomProviders(scope, scopeId);
+            return {
+                providers: providers.map((p) => ({
+                    id: p.id,
+                    label: p.label,
+                    baseUrl: p.baseUrl,
+                    authType: p.auth.type,
+                    docsUrls: p.docsUrls,
+                    notes: p.notes,
+                    updatedAt: p.updatedAt,
+                })),
+                count: providers.length,
+            };
+        }
+        if (operation === "get") {
+            if (!id)
+                throw new Error("id is required for get operation.");
+            const provider = await getCustomProvider(scope, scopeId, id);
+            if (!provider) {
+                return { found: false, id };
+            }
+            return { found: true, provider };
+        }
+        if (operation === "delete") {
+            if (!id)
+                throw new Error("id is required for delete operation.");
+            const deleted = await deleteCustomProvider(scope, scopeId, id);
+            return { deleted, id };
+        }
+        // upsert
+        if (!id)
+            throw new Error("id is required for upsert operation.");
+        if (!label)
+            throw new Error("label is required for upsert operation.");
+        if (!baseUrl)
+            throw new Error("baseUrl is required for upsert operation.");
+        if (!auth)
+            throw new Error("auth is required for upsert operation.");
+        await upsertCustomProvider({
+            scope,
+            scopeId,
+            id,
+            label,
+            baseUrl,
+            auth,
+            docsUrls,
+            allowedHostSuffixes,
+            defaultHeaders,
+            notes,
+        });
+        return {
+            registered: true,
+            id,
+            label,
+            message: `Custom provider "${id}" registered. Use provider-api-catalog to inspect it and provider-api-request to call it.`,
+        };
+    },
+});
+//# sourceMappingURL=provider-api-register.js.map

package/dist/actions/provider-api-register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-api-register.js","sourceRoot":"","sources":["../../src/actions/provider-api-register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,UAAU,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9C,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;KACxB,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,kIAAkI,CACnI;KACJ,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,6CAA6C,CAAC;QAC1D,WAAW,EAAE,CAAC;aACX,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,8CAA8C,CAAC;KAC5D,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,4CAA4C,CAAC;QACzD,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,uDAAuD,CAAC;KACrE,CAAC;CACH,CAAC,CAAC;AAEH,eAAe,YAAY,CAAC;IAC1B,WAAW,EAAE;;;;;;;;2GAQ4F;IACzG,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,SAAS,EAAE,CAAC;aACT,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;aACzC,OAAO,CAAC,QAAQ,CAAC;aACjB,QAAQ,CACP,4GAA4G,CAC7G;QACH,EAAE,EAAE,CAAC;aACF,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,CAAC;aACP,QAAQ,EAAE;aACV,QAAQ,CACP,uGAAuG,CACxG;QACH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,qEAAqE,CACtE;QACH,OAAO,EAAE,CAAC;aACP,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CACP,+GAA+G,CAChH;QACH,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAClC,2EAA2E,CAC5E;QACD,QAAQ,EAAE,CAAC;aACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC;aACvB,QAAQ,EAAE;aACV,QAAQ,CAAC,wDAAwD,CAAC;QACrE,mBAAmB,EAAE,CAAC;aACnB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,EAAE;aACV,QAAQ,CACP,kHAAkH,CACnH;QACH,cAAc,EAAE,CAAC;aACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aAC9B,QAAQ,EAAE;aACV,QAAQ,CACP,uFAAuF,CACxF;QACH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,CAAC,IAAI,CAAC;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,0DAA0D,CAAC;QACvE,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;aACrB,OAAO,CAAC,KAAK,CAAC;aACd,QAAQ,CACP,sGAAsG,CACvG;KACJ,CAAC;IACF,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,KAAK,EAAE,EACV,SAAS,EACT,EAAE,EACF,KAAK,EACL,OAAO,EACP,IAAI,EACJ,QAAQ,EACR,mBAAmB,EACnB,cAAc,EACd,KAAK,EACL,KAAK,GACN,EAAE,EAAE;QACH,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;QAEjE,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC5D,OAAO;gBACL,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC/B,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI;oBACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,SAAS,EAAE,CAAC,CAAC,SAAS;iBACvB,CAAC,CAAC;gBACH,KAAK,EAAE,SAAS,CAAC,MAAM;aACxB,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAC9B,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACnC,CAAC;QAED,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;QAED,SAAS;QACT,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAErE,MAAM,oBAAoB,CAAC;YACzB,KAAK;YACL,OAAO;YACP,EAAE;YACF,KAAK;YACL,OAAO;YACP,IAAI;YACJ,QAAQ;YACR,mBAAmB;YACnB,cAAc;YACd,KAAK;SACN,CAAC,CAAC;QAEH,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,EAAE;YACF,KAAK;YACL,OAAO,EAAE,oBAAoB,EAAE,2FAA2F;SAC3H,CAAC;IACJ,CAAC;CACF,CAAC,CAAC","sourcesContent":["import { defineAction } from \"@agent-native/core\";\nimport { z } from \"zod\";\nimport {\n  upsertCustomProvider,\n  deleteCustomProvider,\n  listCustomProviders,\n  getCustomProvider,\n} from \"@agent-native/core/provider-api\";\nimport { getCredentialContext } from \"@agent-native/core/server\";\n\nconst AuthSchema = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"none\"),\n  }),\n  z.object({\n    type: z.literal(\"bearer\"),\n    credentialKey: z\n      .string()\n      .min(1)\n      .describe(\n        \"Name of the credential key (e.g. MY_API_TOKEN). Must already be saved via app secrets — this action never accepts secret values.\",\n      ),\n  }),\n  z.object({\n    type: z.literal(\"basic\"),\n    usernameKey: z\n      .string()\n      .min(1)\n      .describe(\"Credential key name for the username/login.\"),\n    passwordKey: z\n      .string()\n      .min(1)\n      .describe(\"Credential key name for the password/secret.\"),\n  }),\n  z.object({\n    type: z.literal(\"api-key-header\"),\n    credentialKey: z\n      .string()\n      .min(1)\n      .describe(\"Credential key name for the API key value.\"),\n    headerName: z\n      .string()\n      .min(1)\n      .describe(\"HTTP header name to send the key in (e.g. X-Api-Key).\"),\n  }),\n]);\n\nexport default defineAction({\n  description: `Register or update a custom API provider so the agent can call it via provider-api-request and look up its docs via provider-api-docs.\n\nIMPORTANT — credentials:\n- This action stores only credential KEY NAMES, never secret values.\n- If the required API key is not yet saved, instruct the user to add it via app Settings → Keys, or use the create-vault-secret action, before calling this action.\n- Supported auth kinds: none, bearer, basic, api-key-header.\n  google-service-account and oauth-bearer are NOT supported for custom providers.\n\nAfter registration the provider appears in provider-api-catalog and can be used with provider-api-request.`,\n  schema: z.object({\n    operation: z\n      .enum([\"upsert\", \"delete\", \"list\", \"get\"])\n      .default(\"upsert\")\n      .describe(\n        \"Operation: upsert (create or update), delete (remove), list (all custom providers), get (single provider).\",\n      ),\n    id: z\n      .string()\n      .min(1)\n      .max(64)\n      .optional()\n      .describe(\n        \"Provider slug (e.g. my-api). Lowercase letters, digits, hyphens only. Required for upsert/delete/get.\",\n      ),\n    label: z\n      .string()\n      .min(1)\n      .max(200)\n      .optional()\n      .describe(\n        \"Human-readable name (e.g. 'My Analytics API'). Required for upsert.\",\n      ),\n    baseUrl: z\n      .string()\n      .url()\n      .optional()\n      .describe(\n        \"Base URL for the API (e.g. https://api.example.com/v1). Required for upsert. Must be a public https/http URL.\",\n      ),\n    auth: AuthSchema.optional().describe(\n      \"Auth configuration. Required for upsert. Use type 'none' for public APIs.\",\n    ),\n    docsUrls: z\n      .array(z.string().url())\n      .optional()\n      .describe(\"Optional list of documentation URLs for this provider.\"),\n    allowedHostSuffixes: z\n      .array(z.string())\n      .optional()\n      .describe(\n        \"Optional list of additional host suffixes requests may target beyond the base URL origin (e.g. ['example.com']).\",\n      ),\n    defaultHeaders: z\n      .record(z.string(), z.string())\n      .optional()\n      .describe(\n        \"Optional headers to include on every request (e.g. { 'Accept': 'application/json' }).\",\n      ),\n    notes: z\n      .string()\n      .max(1000)\n      .optional()\n      .describe(\"Optional notes about this provider shown in the catalog.\"),\n    scope: z\n      .enum([\"user\", \"org\"])\n      .default(\"org\")\n      .describe(\n        \"Whether to store the provider for the current user only ('user') or for the whole workspace ('org').\",\n      ),\n  }),\n  http: false,\n  run: async ({\n    operation,\n    id,\n    label,\n    baseUrl,\n    auth,\n    docsUrls,\n    allowedHostSuffixes,\n    defaultHeaders,\n    notes,\n    scope,\n  }) => {\n    const ctx = getCredentialContext();\n    if (!ctx) {\n      throw new Error(\n        \"provider-api-register requires an authenticated request context.\",\n      );\n    }\n    const scopeId =\n      scope === \"org\" ? (ctx.orgId ?? ctx.userEmail) : ctx.userEmail;\n\n    if (operation === \"list\") {\n      const providers = await listCustomProviders(scope, scopeId);\n      return {\n        providers: providers.map((p) => ({\n          id: p.id,\n          label: p.label,\n          baseUrl: p.baseUrl,\n          authType: p.auth.type,\n          docsUrls: p.docsUrls,\n          notes: p.notes,\n          updatedAt: p.updatedAt,\n        })),\n        count: providers.length,\n      };\n    }\n\n    if (operation === \"get\") {\n      if (!id) throw new Error(\"id is required for get operation.\");\n      const provider = await getCustomProvider(scope, scopeId, id);\n      if (!provider) {\n        return { found: false, id };\n      }\n      return { found: true, provider };\n    }\n\n    if (operation === \"delete\") {\n      if (!id) throw new Error(\"id is required for delete operation.\");\n      const deleted = await deleteCustomProvider(scope, scopeId, id);\n      return { deleted, id };\n    }\n\n    // upsert\n    if (!id) throw new Error(\"id is required for upsert operation.\");\n    if (!label) throw new Error(\"label is required for upsert operation.\");\n    if (!baseUrl) throw new Error(\"baseUrl is required for upsert operation.\");\n    if (!auth) throw new Error(\"auth is required for upsert operation.\");\n\n    await upsertCustomProvider({\n      scope,\n      scopeId,\n      id,\n      label,\n      baseUrl,\n      auth,\n      docsUrls,\n      allowedHostSuffixes,\n      defaultHeaders,\n      notes,\n    });\n\n    return {\n      registered: true,\n      id,\n      label,\n      message: `Custom provider \"${id}\" registered. Use provider-api-catalog to inspect it and provider-api-request to call it.`,\n    };\n  },\n});\n"]}

package/dist/actions/provider-api-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api-request.d.ts","sourceRoot":"","sources":["../../src/actions/provider-api-request.ts"],"names":[],"mappings":";AAUA,wBAmEG"}
+{"version":3,"file":"provider-api-request.d.ts","sourceRoot":"","sources":["../../src/actions/provider-api-request.ts"],"names":[],"mappings":";AAMA,wBA8GG"}

package/dist/actions/provider-api-request.js

@@ -1,12 +1,14 @@
 import { defineAction } from "@agent-native/core";
 import { z } from "zod";
-import { DISPATCH_PROVIDER_API_IDS, executeProviderApiRequest, } from "../server/lib/provider-api.js";
-const ProviderSchema = z.enum(DISPATCH_PROVIDER_API_IDS);
+import { executeProviderApiRequest } from "../server/lib/provider-api.js";
 const MethodSchema = z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]);
 export default defineAction({
-    description: "Make an arbitrary authenticated HTTP request to a shared workspace integration or configured provider API. Use this as the flexible escape hatch when Dispatch needs a provider endpoint, filter, pagination mode, payload, or API version that no canned action models. The request is constrained to the provider host, uses configured credentials automatically, blocks private/internal URLs, and redacts secrets from responses.",
+    description: "Make an arbitrary authenticated HTTP request to a shared workspace integration, configured provider API, or custom provider registered via provider-api-register. Use this as the flexible escape hatch when Dispatch needs a provider endpoint, filter, pagination mode, payload, or API version that no canned action models. The request is constrained to the provider host, uses configured credentials automatically, blocks private/internal URLs, and redacts secrets from responses.",
     schema: z.object({
-        provider: ProviderSchema.describe("Configured provider API to call, e.g. slack, github, notion, hubspot, gmail, google_drive, google_calendar, granola, stripe, jira."),
+        provider: z
+            .string()
+            .min(1)
+            .describe("Provider id to call — built-in (e.g. slack, github, notion, hubspot, gmail, google_drive, google_calendar, granola, stripe, jira) or a custom provider id registered via provider-api-register. Use provider-api-catalog to list available providers."),
         method: MethodSchema.default("GET").describe("HTTP method to use."),
         path: z
             .string()
@@ -49,7 +51,33 @@ export default defineAction({
             .min(1_000)
             .max(4 * 1024 * 1024)
             .optional()
-            .describe("Maximum response bytes to read. Default 1MB, max 4MB."),
+            .describe("Maximum response bytes to read. Default 1MB, max 4MB. Ignored when saveToFile is set (allows up to 20MB)."),
+        saveToFile: z
+            .string()
+            .optional()
+            .describe("Workspace file path to save the full response body to instead of returning it in context (e.g. 'analysis/hubspot-deals.json'). When set, returns only a compact summary {savedTo, status, bytes, preview} and allows up to 20MB response. Useful for large datasets that would overflow context."),
+        fetchAllPages: z
+            .object({
+            cursorPath: z
+                .string()
+                .describe("Dot-path in the JSON response body where the next-page cursor lives, e.g. 'meta.next_cursor' or 'pagination.next_page_token'."),
+            cursorParam: z
+                .string()
+                .describe("Query parameter name to pass the cursor on subsequent pages, e.g. 'cursor' or 'page_token'."),
+            itemsPath: z
+                .string()
+                .optional()
+                .describe("Dot-path to the items array in each response, e.g. 'results' or 'data.items'. When omitted, the whole response body is appended per page."),
+            maxPages: z.coerce
+                .number()
+                .int()
+                .min(1)
+                .max(50)
+                .optional()
+                .describe("Maximum pages to fetch. Default 10, max 50. Stops early when the cursor is empty."),
+        })
+            .optional()
+            .describe("Enable cursor-based pagination. After each response, reads cursorPath from the JSON body and re-issues the request with cursorParam set, accumulating items from itemsPath (or whole bodies) until cursor is empty or maxPages is reached. Combine with saveToFile to write the full dataset to a workspace file."),
     }),
     http: false,
     run: async (args) => executeProviderApiRequest(args),

package/dist/actions/provider-api-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api-request.js","sourceRoot":"","sources":["../../src/actions/provider-api-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,yBAAyB,GAC1B,MAAM,+BAA+B,CAAC;AAEvC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;AACzD,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/E,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,waAAwa;IAC1a,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAC/B,oIAAoI,CACrI;QACD,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACnE,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,wMAAwM,CACzM;QACH,KAAK,EAAE,CAAC;aACL,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,4FAA4F,CAC7F;QACH,OAAO,EAAE,CAAC;aACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;aAC/B,QAAQ,EAAE;aACV,QAAQ,CACP,mHAAmH,CACpH;QACH,IAAI,EAAE,CAAC;aACJ,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,iFAAiF,CAClF;QACH,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;aACzB,OAAO,CAAC,SAAS,CAAC;aAClB,QAAQ,CACP,iIAAiI,CAClI;QACH,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,oGAAoG,CACrG;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,8GAA8G,CAC/G;QACH,SAAS,EAAE,CAAC,CAAC,MAAM;aAChB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,KAAK,CAAC;aACV,GAAG,CAAC,OAAO,CAAC;aACZ,QAAQ,EAAE;aACV,QAAQ,CAAC,6DAA6D,CAAC;QAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM;aACf,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,KAAK,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;aACpB,QAAQ,EAAE;aACV,QAAQ,CAAC,uDAAuD,CAAC;KACrE,CAAC;IACF,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;CACrD,CAAC,CAAC","sourcesContent":["import { defineAction } from \"@agent-native/core\";\nimport { z } from \"zod\";\nimport {\n  DISPATCH_PROVIDER_API_IDS,\n  executeProviderApiRequest,\n} from \"../server/lib/provider-api.js\";\n\nconst ProviderSchema = z.enum(DISPATCH_PROVIDER_API_IDS);\nconst MethodSchema = z.enum([\"GET\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\", \"HEAD\"]);\n\nexport default defineAction({\n  description:\n    \"Make an arbitrary authenticated HTTP request to a shared workspace integration or configured provider API. Use this as the flexible escape hatch when Dispatch needs a provider endpoint, filter, pagination mode, payload, or API version that no canned action models. The request is constrained to the provider host, uses configured credentials automatically, blocks private/internal URLs, and redacts secrets from responses.\",\n  schema: z.object({\n    provider: ProviderSchema.describe(\n      \"Configured provider API to call, e.g. slack, github, notion, hubspot, gmail, google_drive, google_calendar, granola, stripe, jira.\",\n    ),\n    method: MethodSchema.default(\"GET\").describe(\"HTTP method to use.\"),\n    path: z\n      .string()\n      .min(1)\n      .describe(\n        \"Provider API path such as /search.messages, /repos/org/repo/issues, /crm/v3/objects/deals/search, or a full URL on an allowed provider host. Use placeholders from provider-api-catalog when provided.\",\n      ),\n    query: z\n      .unknown()\n      .optional()\n      .describe(\n        \"Optional query params as a JSON object/string. Array values produce repeated query params.\",\n      ),\n    headers: z\n      .record(z.string(), z.unknown())\n      .optional()\n      .describe(\n        \"Optional extra headers. Unsafe hop-by-hop headers are ignored. Auth headers are injected from stored credentials.\",\n      ),\n    body: z\n      .unknown()\n      .optional()\n      .describe(\n        \"Optional request body. Objects/arrays are JSON encoded; strings are sent as-is.\",\n      ),\n    auth: z\n      .enum([\"default\", \"none\"])\n      .default(\"default\")\n      .describe(\n        \"Use default to inject configured provider auth. Use none only for public provider endpoints that intentionally require no auth.\",\n      ),\n    connectionId: z\n      .string()\n      .optional()\n      .describe(\n        \"Optional shared workspace connection id to use when the provider has multiple granted connections.\",\n      ),\n    accountId: z\n      .string()\n      .optional()\n      .describe(\n        \"Optional OAuth account id to use for OAuth-backed providers such as Gmail, Google Calendar, or Google Drive.\",\n      ),\n    timeoutMs: z.coerce\n      .number()\n      .int()\n      .min(1_000)\n      .max(120_000)\n      .optional()\n      .describe(\"Request timeout in milliseconds. Default 30000, max 120000.\"),\n    maxBytes: z.coerce\n      .number()\n      .int()\n      .min(1_000)\n      .max(4 * 1024 * 1024)\n      .optional()\n      .describe(\"Maximum response bytes to read. Default 1MB, max 4MB.\"),\n  }),\n  http: false,\n  run: async (args) => executeProviderApiRequest(args),\n});\n"]}
+{"version":3,"file":"provider-api-request.js","sourceRoot":"","sources":["../../src/actions/provider-api-request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/E,eAAe,YAAY,CAAC;IAC1B,WAAW,EACT,+dAA+d;IACje,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC;aACR,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,uPAAuP,CACxP;QACH,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACnE,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CACP,wMAAwM,CACzM;QACH,KAAK,EAAE,CAAC;aACL,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,4FAA4F,CAC7F;QACH,OAAO,EAAE,CAAC;aACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;aAC/B,QAAQ,EAAE;aACV,QAAQ,CACP,mHAAmH,CACpH;QACH,IAAI,EAAE,CAAC;aACJ,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,iFAAiF,CAClF;QACH,IAAI,EAAE,CAAC;aACJ,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;aACzB,OAAO,CAAC,SAAS,CAAC;aAClB,QAAQ,CACP,iIAAiI,CAClI;QACH,YAAY,EAAE,CAAC;aACZ,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,oGAAoG,CACrG;QACH,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,8GAA8G,CAC/G;QACH,SAAS,EAAE,CAAC,CAAC,MAAM;aAChB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,KAAK,CAAC;aACV,GAAG,CAAC,OAAO,CAAC;aACZ,QAAQ,EAAE;aACV,QAAQ,CAAC,6DAA6D,CAAC;QAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM;aACf,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,KAAK,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;aACpB,QAAQ,EAAE;aACV,QAAQ,CACP,2GAA2G,CAC5G;QACH,UAAU,EAAE,CAAC;aACV,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CACP,kSAAkS,CACnS;QACH,aAAa,EAAE,CAAC;aACb,MAAM,CAAC;YACN,UAAU,EAAE,CAAC;iBACV,MAAM,EAAE;iBACR,QAAQ,CACP,+HAA+H,CAChI;YACH,WAAW,EAAE,CAAC;iBACX,MAAM,EAAE;iBACR,QAAQ,CACP,6FAA6F,CAC9F;YACH,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CACP,2IAA2I,CAC5I;YACH,QAAQ,EAAE,CAAC,CAAC,MAAM;iBACf,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,EAAE,CAAC;iBACP,QAAQ,EAAE;iBACV,QAAQ,CACP,mFAAmF,CACpF;SACJ,CAAC;aACD,QAAQ,EAAE;aACV,QAAQ,CACP,mTAAmT,CACpT;KACJ,CAAC;IACF,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;CACrD,CAAC,CAAC","sourcesContent":["import { defineAction } from \"@agent-native/core\";\nimport { z } from \"zod\";\nimport { executeProviderApiRequest } from \"../server/lib/provider-api.js\";\n\nconst MethodSchema = z.enum([\"GET\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\", \"HEAD\"]);\n\nexport default defineAction({\n  description:\n    \"Make an arbitrary authenticated HTTP request to a shared workspace integration, configured provider API, or custom provider registered via provider-api-register. Use this as the flexible escape hatch when Dispatch needs a provider endpoint, filter, pagination mode, payload, or API version that no canned action models. The request is constrained to the provider host, uses configured credentials automatically, blocks private/internal URLs, and redacts secrets from responses.\",\n  schema: z.object({\n    provider: z\n      .string()\n      .min(1)\n      .describe(\n        \"Provider id to call — built-in (e.g. slack, github, notion, hubspot, gmail, google_drive, google_calendar, granola, stripe, jira) or a custom provider id registered via provider-api-register. Use provider-api-catalog to list available providers.\",\n      ),\n    method: MethodSchema.default(\"GET\").describe(\"HTTP method to use.\"),\n    path: z\n      .string()\n      .min(1)\n      .describe(\n        \"Provider API path such as /search.messages, /repos/org/repo/issues, /crm/v3/objects/deals/search, or a full URL on an allowed provider host. Use placeholders from provider-api-catalog when provided.\",\n      ),\n    query: z\n      .unknown()\n      .optional()\n      .describe(\n        \"Optional query params as a JSON object/string. Array values produce repeated query params.\",\n      ),\n    headers: z\n      .record(z.string(), z.unknown())\n      .optional()\n      .describe(\n        \"Optional extra headers. Unsafe hop-by-hop headers are ignored. Auth headers are injected from stored credentials.\",\n      ),\n    body: z\n      .unknown()\n      .optional()\n      .describe(\n        \"Optional request body. Objects/arrays are JSON encoded; strings are sent as-is.\",\n      ),\n    auth: z\n      .enum([\"default\", \"none\"])\n      .default(\"default\")\n      .describe(\n        \"Use default to inject configured provider auth. Use none only for public provider endpoints that intentionally require no auth.\",\n      ),\n    connectionId: z\n      .string()\n      .optional()\n      .describe(\n        \"Optional shared workspace connection id to use when the provider has multiple granted connections.\",\n      ),\n    accountId: z\n      .string()\n      .optional()\n      .describe(\n        \"Optional OAuth account id to use for OAuth-backed providers such as Gmail, Google Calendar, or Google Drive.\",\n      ),\n    timeoutMs: z.coerce\n      .number()\n      .int()\n      .min(1_000)\n      .max(120_000)\n      .optional()\n      .describe(\"Request timeout in milliseconds. Default 30000, max 120000.\"),\n    maxBytes: z.coerce\n      .number()\n      .int()\n      .min(1_000)\n      .max(4 * 1024 * 1024)\n      .optional()\n      .describe(\n        \"Maximum response bytes to read. Default 1MB, max 4MB. Ignored when saveToFile is set (allows up to 20MB).\",\n      ),\n    saveToFile: z\n      .string()\n      .optional()\n      .describe(\n        \"Workspace file path to save the full response body to instead of returning it in context (e.g. 'analysis/hubspot-deals.json'). When set, returns only a compact summary {savedTo, status, bytes, preview} and allows up to 20MB response. Useful for large datasets that would overflow context.\",\n      ),\n    fetchAllPages: z\n      .object({\n        cursorPath: z\n          .string()\n          .describe(\n            \"Dot-path in the JSON response body where the next-page cursor lives, e.g. 'meta.next_cursor' or 'pagination.next_page_token'.\",\n          ),\n        cursorParam: z\n          .string()\n          .describe(\n            \"Query parameter name to pass the cursor on subsequent pages, e.g. 'cursor' or 'page_token'.\",\n          ),\n        itemsPath: z\n          .string()\n          .optional()\n          .describe(\n            \"Dot-path to the items array in each response, e.g. 'results' or 'data.items'. When omitted, the whole response body is appended per page.\",\n          ),\n        maxPages: z.coerce\n          .number()\n          .int()\n          .min(1)\n          .max(50)\n          .optional()\n          .describe(\n            \"Maximum pages to fetch. Default 10, max 50. Stops early when the cursor is empty.\",\n          ),\n      })\n      .optional()\n      .describe(\n        \"Enable cursor-based pagination. After each response, reads cursorPath from the JSON body and re-issues the request with cursorParam set, accumulating items from itemsPath (or whole bodies) until cursor is empty or maxPages is reached. Combine with saveToFile to write the full dataset to a workspace file.\",\n      ),\n  }),\n  http: false,\n  run: async (args) => executeProviderApiRequest(args),\n});\n"]}

package/dist/server/lib/provider-api.d.ts

@@ -2,7 +2,7 @@ import { type ProviderApiId, type ProviderApiMethod, type ProviderApiRequestArgs
 export declare const DISPATCH_PROVIDER_API_IDS: readonly ["amplitude", "apollo", "bigquery", "commonroom", "dataforseo", "ga4", "gcloud", "github", "gmail", "gong", "google_calendar", "google_drive", "granola", "grafana", "hubspot", "jira", "mixpanel", "notion", "posthog", "prometheus", "pylon", "sentry", "slack", "stripe", "twitter"];
 export type DispatchProviderApiId = ProviderApiId;
 export type { ProviderApiMethod, ProviderApiRequestArgs };
-export declare function listProviderApiCatalog(provider?: DispatchProviderApiId): {
+export declare function listProviderApiCatalog(provider?: string): {
     id: "amplitude" | "bigquery" | "sentry" | "posthog" | "mixpanel" | "github" | "slack" | "twitter" | "notion" | "gmail" | "google_drive" | "hubspot" | "granola" | "apollo" | "commonroom" | "dataforseo" | "ga4" | "gcloud" | "gong" | "google_calendar" | "grafana" | "jira" | "prometheus" | "pylon" | "stripe";
     label: string;
     defaultBaseUrl: string;
@@ -17,9 +17,9 @@ export declare function listProviderApiCatalog(provider?: DispatchProviderApiId)
     examples: readonly import("@agent-native/core/provider-api").ProviderApiExample[];
     notes: readonly string[];
     templateUses: readonly import("@agent-native/core").WorkspaceConnectionTemplateUse[];
-}[];
+}[] | Promise<unknown[]>;
 export declare function fetchProviderApiDocs(options: {
-    provider: DispatchProviderApiId;
+    provider: string;
     url?: string;
     maxBytes?: number;
 }): Promise<unknown>;

package/dist/server/lib/provider-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api.d.ts","sourceRoot":"","sources":["../../../src/server/lib/provider-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,iCAAiC,CAAC;AAGzC,eAAO,MAAM,yBAAyB,kSAAmB,CAAC;AAC1D,MAAM,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;AAgB1D,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,qBAAqB;;;;;;;;;;;;;;;IAEtE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,QAAQ,EAAE,qBAAqB,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,oBAEA;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,sBAAsB,oBAErE"}
+{"version":3,"file":"provider-api.d.ts","sourceRoot":"","sources":["../../../src/server/lib/provider-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC5B,MAAM,iCAAiC,CAAC;AAGzC,eAAO,MAAM,yBAAyB,kSAAmB,CAAC;AAC1D,MAAM,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC;AA0C1D,wBAAgB,sBAAsB,CAAC,QAAQ,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;yBAEvD;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,oBAEA;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,sBAAsB,oBAErE"}

package/dist/server/lib/provider-api.js

@@ -1,15 +1,39 @@
-import { PROVIDER_API_IDS, createProviderApiRuntime, } from "@agent-native/core/provider-api";
+import { PROVIDER_API_IDS, createProviderApiRuntime, listCustomProviders, } from "@agent-native/core/provider-api";
 import { getCredentialContext } from "@agent-native/core/server";
 export const DISPATCH_PROVIDER_API_IDS = PROVIDER_API_IDS;
+function requireCtx(action) {
+    const ctx = getCredentialContext();
+    if (!ctx) {
+        throw new Error(`Dispatch provider API ${action} requires an authenticated request context.`);
+    }
+    return ctx;
+}
 const runtime = createProviderApiRuntime({
     appId: "dispatch",
     localCredentialSource: "dispatch_local",
-    getCredentialContext: () => {
+    getCredentialContext: () => requireCtx("requests"),
+    getCustomProviders: async () => {
         const ctx = getCredentialContext();
-        if (!ctx) {
-            throw new Error("Dispatch provider API requests require an authenticated request context.");
+        if (!ctx)
+            return [];
+        // Load custom providers for both user scope and org scope.
+        const results = await Promise.allSettled([
+            listCustomProviders("user", ctx.userEmail),
+            ctx.orgId ? listCustomProviders("org", ctx.orgId) : Promise.resolve([]),
+        ]);
+        const userProviders = results[0].status === "fulfilled" ? results[0].value : [];
+        const orgProviders = results[1].status === "fulfilled" ? results[1].value : [];
+        // Merge: user-scope providers take precedence over org-scope ones with the
+        // same id, and neither can shadow a built-in id.
+        const seen = new Set(PROVIDER_API_IDS);
+        const merged = [];
+        for (const p of [...userProviders, ...orgProviders]) {
+            if (!seen.has(p.id)) {
+                seen.add(p.id);
+                merged.push(p);
+            }
         }
-        return ctx;
+        return merged;
     },
 });
 export function listProviderApiCatalog(provider) {

package/dist/server/lib/provider-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-api.js","sourceRoot":"","sources":["../../../src/server/lib/provider-api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,wBAAwB,GAIzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAI1D,MAAM,OAAO,GAAG,wBAAwB,CAAC;IACvC,KAAK,EAAE,UAAU;IACjB,qBAAqB,EAAE,gBAAgB;IACvC,oBAAoB,EAAE,GAAG,EAAE;QACzB,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,QAAgC;IACrE,OAAO,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAIpC;IACC,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAA4B;IACpE,OAAO,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import {\n  PROVIDER_API_IDS,\n  createProviderApiRuntime,\n  type ProviderApiId,\n  type ProviderApiMethod,\n  type ProviderApiRequestArgs,\n} from \"@agent-native/core/provider-api\";\nimport { getCredentialContext } from \"@agent-native/core/server\";\n\nexport const DISPATCH_PROVIDER_API_IDS = PROVIDER_API_IDS;\nexport type DispatchProviderApiId = ProviderApiId;\nexport type { ProviderApiMethod, ProviderApiRequestArgs };\n\nconst runtime = createProviderApiRuntime({\n  appId: \"dispatch\",\n  localCredentialSource: \"dispatch_local\",\n  getCredentialContext: () => {\n    const ctx = getCredentialContext();\n    if (!ctx) {\n      throw new Error(\n        \"Dispatch provider API requests require an authenticated request context.\",\n      );\n    }\n    return ctx;\n  },\n});\n\nexport function listProviderApiCatalog(provider?: DispatchProviderApiId) {\n  return runtime.listCatalog(provider);\n}\n\nexport function fetchProviderApiDocs(options: {\n  provider: DispatchProviderApiId;\n  url?: string;\n  maxBytes?: number;\n}) {\n  return runtime.fetchDocs(options);\n}\n\nexport function executeProviderApiRequest(args: ProviderApiRequestArgs) {\n  return runtime.executeRequest(args);\n}\n"]}
+{"version":3,"file":"provider-api.js","sourceRoot":"","sources":["../../../src/server/lib/provider-api.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,GAIpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAI1D,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,6CAA6C,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAAG,wBAAwB,CAAC;IACvC,KAAK,EAAE,UAAU;IACjB,qBAAqB,EAAE,gBAAgB;IACvC,oBAAoB,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IAClD,kBAAkB,EAAE,KAAK,IAAI,EAAE;QAC7B,MAAM,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QACpB,2DAA2D;QAC3D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;YACvC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC;YAC1C,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;QACH,MAAM,aAAa,GACjB,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,YAAY,GAChB,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,2EAA2E;QAC3E,iDAAiD;QACjD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,gBAAuC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,QAAiB;IACtD,OAAO,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAIpC;IACC,OAAO,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAA4B;IACpE,OAAO,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import {\n  PROVIDER_API_IDS,\n  createProviderApiRuntime,\n  listCustomProviders,\n  type ProviderApiId,\n  type ProviderApiMethod,\n  type ProviderApiRequestArgs,\n} from \"@agent-native/core/provider-api\";\nimport { getCredentialContext } from \"@agent-native/core/server\";\n\nexport const DISPATCH_PROVIDER_API_IDS = PROVIDER_API_IDS;\nexport type DispatchProviderApiId = ProviderApiId;\nexport type { ProviderApiMethod, ProviderApiRequestArgs };\n\nfunction requireCtx(action: string) {\n  const ctx = getCredentialContext();\n  if (!ctx) {\n    throw new Error(\n      `Dispatch provider API ${action} requires an authenticated request context.`,\n    );\n  }\n  return ctx;\n}\n\nconst runtime = createProviderApiRuntime({\n  appId: \"dispatch\",\n  localCredentialSource: \"dispatch_local\",\n  getCredentialContext: () => requireCtx(\"requests\"),\n  getCustomProviders: async () => {\n    const ctx = getCredentialContext();\n    if (!ctx) return [];\n    // Load custom providers for both user scope and org scope.\n    const results = await Promise.allSettled([\n      listCustomProviders(\"user\", ctx.userEmail),\n      ctx.orgId ? listCustomProviders(\"org\", ctx.orgId) : Promise.resolve([]),\n    ]);\n    const userProviders =\n      results[0].status === \"fulfilled\" ? results[0].value : [];\n    const orgProviders =\n      results[1].status === \"fulfilled\" ? results[1].value : [];\n    // Merge: user-scope providers take precedence over org-scope ones with the\n    // same id, and neither can shadow a built-in id.\n    const seen = new Set<string>(PROVIDER_API_IDS as unknown as string[]);\n    const merged = [];\n    for (const p of [...userProviders, ...orgProviders]) {\n      if (!seen.has(p.id)) {\n        seen.add(p.id);\n        merged.push(p);\n      }\n    }\n    return merged;\n  },\n});\n\nexport function listProviderApiCatalog(provider?: string) {\n  return runtime.listCatalog(provider);\n}\n\nexport function fetchProviderApiDocs(options: {\n  provider: string;\n  url?: string;\n  maxBytes?: number;\n}) {\n  return runtime.fetchDocs(options);\n}\n\nexport function executeProviderApiRequest(args: ProviderApiRequestArgs) {\n  return runtime.executeRequest(args);\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/dispatch",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "type": "module",
   "description": "Dispatch — workspace control plane for agent-native apps. Vault, integrations, destinations, scheduled jobs, and cross-app delegation, shipped as a single drop-in package.",
   "license": "MIT",

package/src/actions/index.ts

@@ -57,6 +57,7 @@ import previewDreamProposal from "./preview-dream-proposal.js";
 import previewWorkspaceResourceChange from "./preview-workspace-resource-change.js";
 import providerApiCatalog from "./provider-api-catalog.js";
 import providerApiDocs from "./provider-api-docs.js";
+import providerApiRegister from "./provider-api-register.js";
 import providerApiRequest from "./provider-api-request.js";
 import rejectDispatchChange from "./reject-dispatch-change.js";
 import rejectDreamProposal from "./reject-dream-proposal.js";
@@ -149,6 +150,7 @@ export const dispatchActions: Record<string, ActionEntry> = {
   "preview-workspace-resource-change": previewWorkspaceResourceChange,
   "provider-api-catalog": providerApiCatalog,
   "provider-api-docs": providerApiDocs,
+  "provider-api-register": providerApiRegister,
   "provider-api-request": providerApiRequest,
   "reject-dispatch-change": rejectDispatchChange,
   "reject-dream-proposal": rejectDreamProposal,

package/src/actions/provider-api-catalog.ts

@@ -1,27 +1,26 @@
 import { defineAction } from "@agent-native/core";
 import { z } from "zod";
-import {
-  DISPATCH_PROVIDER_API_IDS,
-  listProviderApiCatalog,
-} from "../server/lib/provider-api.js";
-
-const ProviderSchema = z.enum(DISPATCH_PROVIDER_API_IDS);
+import { listProviderApiCatalog } from "../server/lib/provider-api.js";
 
 export default defineAction({
   description:
-    "List raw HTTP API capabilities for shared workspace integrations and configured providers. Use before provider-api-request when grant/setup metadata is not enough and the provider's actual API must be inspected. Returns base URLs, auth style, credential key names, docs/spec URLs, placeholders, and examples; never returns secret values.",
+    "List raw HTTP API capabilities for shared workspace integrations, configured providers, and custom registered providers. Use before provider-api-request when grant/setup metadata is not enough and the provider's actual API must be inspected. Returns base URLs, auth style, credential key names, docs/spec URLs, placeholders, and examples; never returns secret values. Custom providers registered via provider-api-register are included.",
   schema: z.object({
-    provider: ProviderSchema.optional().describe(
-      "Optional provider id to inspect. Omit to list every provider API escape hatch.",
-    ),
+    provider: z
+      .string()
+      .optional()
+      .describe(
+        "Optional provider id to inspect (built-in or custom). Omit to list every available provider API.",
+      ),
   }),
   http: { method: "GET" },
   readOnly: true,
   run: async ({ provider }) => {
+    const providers = await listProviderApiCatalog(provider);
     return {
-      providers: listProviderApiCatalog(provider),
+      providers,
       guidance:
-        "Workspace integrations and grants are not capability limits. When a provider can answer a question through its HTTP API, inspect docs/spec URLs here and call provider-api-request with the exact provider API method/path/query/body instead of adding a rigid one-off action.",
+        "Workspace integrations and grants are not capability limits. When a provider can answer a question through its HTTP API, inspect docs/spec URLs here and call provider-api-request with the exact provider API method/path/query/body instead of adding a rigid one-off action. Custom providers registered via provider-api-register also appear here.",
     };
   },
 });

package/src/actions/provider-api-docs.ts

@@ -1,25 +1,23 @@
 import { defineAction } from "@agent-native/core";
 import { z } from "zod";
-import {
-  DISPATCH_PROVIDER_API_IDS,
-  fetchProviderApiDocs,
-} from "../server/lib/provider-api.js";
-
-const ProviderSchema = z.enum(DISPATCH_PROVIDER_API_IDS);
+import { fetchProviderApiDocs } from "../server/lib/provider-api.js";
 
 export default defineAction({
   description:
-    "Inspect provider API docs/spec metadata, or fetch a registered provider docs/spec URL. Use this before arbitrary provider-api-request calls when the exact endpoint, filter operator, payload shape, pagination, or API version is uncertain.",
+    "Inspect provider API docs/spec metadata, or fetch ANY public API documentation page, OpenAPI spec, changelog, or web page. Registered docs/spec URLs from provider-api-catalog are curated starting points, but any public https/http URL is allowed. Use web-search to find documentation URLs first when uncertain, then fetch them here. SSRF guard still applies — private/internal addresses are blocked.",
   schema: z.object({
-    provider: ProviderSchema.describe(
-      "Provider whose API docs/spec to inspect.",
-    ),
+    provider: z
+      .string()
+      .min(1)
+      .describe(
+        "Provider whose API docs/spec to inspect. Can be a built-in provider id or a custom provider id registered via provider-api-register.",
+      ),
     url: z
       .string()
       .url()
       .optional()
       .describe(
-        "Optional docs/spec URL from provider-api-catalog to fetch. Only registered docs/spec origins are allowed.",
+        "Optional URL to fetch. Can be any public https/http URL — API documentation pages, OpenAPI specs, changelogs, README files, etc. Registered docs/spec URLs from provider-api-catalog are curated starting points.",
       ),
     maxBytes: z.coerce
       .number()

package/src/actions/provider-api-register.ts

@@ -0,0 +1,198 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+import {
+  upsertCustomProvider,
+  deleteCustomProvider,
+  listCustomProviders,
+  getCustomProvider,
+} from "@agent-native/core/provider-api";
+import { getCredentialContext } from "@agent-native/core/server";
+
+const AuthSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("none"),
+  }),
+  z.object({
+    type: z.literal("bearer"),
+    credentialKey: z
+      .string()
+      .min(1)
+      .describe(
+        "Name of the credential key (e.g. MY_API_TOKEN). Must already be saved via app secrets — this action never accepts secret values.",
+      ),
+  }),
+  z.object({
+    type: z.literal("basic"),
+    usernameKey: z
+      .string()
+      .min(1)
+      .describe("Credential key name for the username/login."),
+    passwordKey: z
+      .string()
+      .min(1)
+      .describe("Credential key name for the password/secret."),
+  }),
+  z.object({
+    type: z.literal("api-key-header"),
+    credentialKey: z
+      .string()
+      .min(1)
+      .describe("Credential key name for the API key value."),
+    headerName: z
+      .string()
+      .min(1)
+      .describe("HTTP header name to send the key in (e.g. X-Api-Key)."),
+  }),
+]);
+
+export default defineAction({
+  description: `Register or update a custom API provider so the agent can call it via provider-api-request and look up its docs via provider-api-docs.
+
+IMPORTANT — credentials:
+- This action stores only credential KEY NAMES, never secret values.
+- If the required API key is not yet saved, instruct the user to add it via app Settings → Keys, or use the create-vault-secret action, before calling this action.
+- Supported auth kinds: none, bearer, basic, api-key-header.
+  google-service-account and oauth-bearer are NOT supported for custom providers.
+
+After registration the provider appears in provider-api-catalog and can be used with provider-api-request.`,
+  schema: z.object({
+    operation: z
+      .enum(["upsert", "delete", "list", "get"])
+      .default("upsert")
+      .describe(
+        "Operation: upsert (create or update), delete (remove), list (all custom providers), get (single provider).",
+      ),
+    id: z
+      .string()
+      .min(1)
+      .max(64)
+      .optional()
+      .describe(
+        "Provider slug (e.g. my-api). Lowercase letters, digits, hyphens only. Required for upsert/delete/get.",
+      ),
+    label: z
+      .string()
+      .min(1)
+      .max(200)
+      .optional()
+      .describe(
+        "Human-readable name (e.g. 'My Analytics API'). Required for upsert.",
+      ),
+    baseUrl: z
+      .string()
+      .url()
+      .optional()
+      .describe(
+        "Base URL for the API (e.g. https://api.example.com/v1). Required for upsert. Must be a public https/http URL.",
+      ),
+    auth: AuthSchema.optional().describe(
+      "Auth configuration. Required for upsert. Use type 'none' for public APIs.",
+    ),
+    docsUrls: z
+      .array(z.string().url())
+      .optional()
+      .describe("Optional list of documentation URLs for this provider."),
+    allowedHostSuffixes: z
+      .array(z.string())
+      .optional()
+      .describe(
+        "Optional list of additional host suffixes requests may target beyond the base URL origin (e.g. ['example.com']).",
+      ),
+    defaultHeaders: z
+      .record(z.string(), z.string())
+      .optional()
+      .describe(
+        "Optional headers to include on every request (e.g. { 'Accept': 'application/json' }).",
+      ),
+    notes: z
+      .string()
+      .max(1000)
+      .optional()
+      .describe("Optional notes about this provider shown in the catalog."),
+    scope: z
+      .enum(["user", "org"])
+      .default("org")
+      .describe(
+        "Whether to store the provider for the current user only ('user') or for the whole workspace ('org').",
+      ),
+  }),
+  http: false,
+  run: async ({
+    operation,
+    id,
+    label,
+    baseUrl,
+    auth,
+    docsUrls,
+    allowedHostSuffixes,
+    defaultHeaders,
+    notes,
+    scope,
+  }) => {
+    const ctx = getCredentialContext();
+    if (!ctx) {
+      throw new Error(
+        "provider-api-register requires an authenticated request context.",
+      );
+    }
+    const scopeId =
+      scope === "org" ? (ctx.orgId ?? ctx.userEmail) : ctx.userEmail;
+
+    if (operation === "list") {
+      const providers = await listCustomProviders(scope, scopeId);
+      return {
+        providers: providers.map((p) => ({
+          id: p.id,
+          label: p.label,
+          baseUrl: p.baseUrl,
+          authType: p.auth.type,
+          docsUrls: p.docsUrls,
+          notes: p.notes,
+          updatedAt: p.updatedAt,
+        })),
+        count: providers.length,
+      };
+    }
+
+    if (operation === "get") {
+      if (!id) throw new Error("id is required for get operation.");
+      const provider = await getCustomProvider(scope, scopeId, id);
+      if (!provider) {
+        return { found: false, id };
+      }
+      return { found: true, provider };
+    }
+
+    if (operation === "delete") {
+      if (!id) throw new Error("id is required for delete operation.");
+      const deleted = await deleteCustomProvider(scope, scopeId, id);
+      return { deleted, id };
+    }
+
+    // upsert
+    if (!id) throw new Error("id is required for upsert operation.");
+    if (!label) throw new Error("label is required for upsert operation.");
+    if (!baseUrl) throw new Error("baseUrl is required for upsert operation.");
+    if (!auth) throw new Error("auth is required for upsert operation.");
+
+    await upsertCustomProvider({
+      scope,
+      scopeId,
+      id,
+      label,
+      baseUrl,
+      auth,
+      docsUrls,
+      allowedHostSuffixes,
+      defaultHeaders,
+      notes,
+    });
+
+    return {
+      registered: true,
+      id,
+      label,
+      message: `Custom provider "${id}" registered. Use provider-api-catalog to inspect it and provider-api-request to call it.`,
+    };
+  },
+});

package/src/actions/provider-api-request.ts

@@ -1,20 +1,19 @@
 import { defineAction } from "@agent-native/core";
 import { z } from "zod";
-import {
-  DISPATCH_PROVIDER_API_IDS,
-  executeProviderApiRequest,
-} from "../server/lib/provider-api.js";
+import { executeProviderApiRequest } from "../server/lib/provider-api.js";
 
-const ProviderSchema = z.enum(DISPATCH_PROVIDER_API_IDS);
 const MethodSchema = z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]);
 
 export default defineAction({
   description:
-    "Make an arbitrary authenticated HTTP request to a shared workspace integration or configured provider API. Use this as the flexible escape hatch when Dispatch needs a provider endpoint, filter, pagination mode, payload, or API version that no canned action models. The request is constrained to the provider host, uses configured credentials automatically, blocks private/internal URLs, and redacts secrets from responses.",
+    "Make an arbitrary authenticated HTTP request to a shared workspace integration, configured provider API, or custom provider registered via provider-api-register. Use this as the flexible escape hatch when Dispatch needs a provider endpoint, filter, pagination mode, payload, or API version that no canned action models. The request is constrained to the provider host, uses configured credentials automatically, blocks private/internal URLs, and redacts secrets from responses.",
   schema: z.object({
-    provider: ProviderSchema.describe(
-      "Configured provider API to call, e.g. slack, github, notion, hubspot, gmail, google_drive, google_calendar, granola, stripe, jira.",
-    ),
+    provider: z
+      .string()
+      .min(1)
+      .describe(
+        "Provider id to call — built-in (e.g. slack, github, notion, hubspot, gmail, google_drive, google_calendar, granola, stripe, jira) or a custom provider id registered via provider-api-register. Use provider-api-catalog to list available providers.",
+      ),
     method: MethodSchema.default("GET").describe("HTTP method to use."),
     path: z
       .string()
@@ -71,7 +70,47 @@ export default defineAction({
       .min(1_000)
       .max(4 * 1024 * 1024)
       .optional()
-      .describe("Maximum response bytes to read. Default 1MB, max 4MB."),
+      .describe(
+        "Maximum response bytes to read. Default 1MB, max 4MB. Ignored when saveToFile is set (allows up to 20MB).",
+      ),
+    saveToFile: z
+      .string()
+      .optional()
+      .describe(
+        "Workspace file path to save the full response body to instead of returning it in context (e.g. 'analysis/hubspot-deals.json'). When set, returns only a compact summary {savedTo, status, bytes, preview} and allows up to 20MB response. Useful for large datasets that would overflow context.",
+      ),
+    fetchAllPages: z
+      .object({
+        cursorPath: z
+          .string()
+          .describe(
+            "Dot-path in the JSON response body where the next-page cursor lives, e.g. 'meta.next_cursor' or 'pagination.next_page_token'.",
+          ),
+        cursorParam: z
+          .string()
+          .describe(
+            "Query parameter name to pass the cursor on subsequent pages, e.g. 'cursor' or 'page_token'.",
+          ),
+        itemsPath: z
+          .string()
+          .optional()
+          .describe(
+            "Dot-path to the items array in each response, e.g. 'results' or 'data.items'. When omitted, the whole response body is appended per page.",
+          ),
+        maxPages: z.coerce
+          .number()
+          .int()
+          .min(1)
+          .max(50)
+          .optional()
+          .describe(
+            "Maximum pages to fetch. Default 10, max 50. Stops early when the cursor is empty.",
+          ),
+      })
+      .optional()
+      .describe(
+        "Enable cursor-based pagination. After each response, reads cursorPath from the JSON body and re-issues the request with cursorParam set, accumulating items from itemsPath (or whole bodies) until cursor is empty or maxPages is reached. Combine with saveToFile to write the full dataset to a workspace file.",
+      ),
   }),
   http: false,
   run: async (args) => executeProviderApiRequest(args),

package/src/server/lib/provider-api.ts

@@ -1,6 +1,7 @@
 import {
   PROVIDER_API_IDS,
   createProviderApiRuntime,
+  listCustomProviders,
   type ProviderApiId,
   type ProviderApiMethod,
   type ProviderApiRequestArgs,
@@ -11,26 +12,52 @@ export const DISPATCH_PROVIDER_API_IDS = PROVIDER_API_IDS;
 export type DispatchProviderApiId = ProviderApiId;
 export type { ProviderApiMethod, ProviderApiRequestArgs };
 
+function requireCtx(action: string) {
+  const ctx = getCredentialContext();
+  if (!ctx) {
+    throw new Error(
+      `Dispatch provider API ${action} requires an authenticated request context.`,
+    );
+  }
+  return ctx;
+}
+
 const runtime = createProviderApiRuntime({
   appId: "dispatch",
   localCredentialSource: "dispatch_local",
-  getCredentialContext: () => {
+  getCredentialContext: () => requireCtx("requests"),
+  getCustomProviders: async () => {
     const ctx = getCredentialContext();
-    if (!ctx) {
-      throw new Error(
-        "Dispatch provider API requests require an authenticated request context.",
-      );
+    if (!ctx) return [];
+    // Load custom providers for both user scope and org scope.
+    const results = await Promise.allSettled([
+      listCustomProviders("user", ctx.userEmail),
+      ctx.orgId ? listCustomProviders("org", ctx.orgId) : Promise.resolve([]),
+    ]);
+    const userProviders =
+      results[0].status === "fulfilled" ? results[0].value : [];
+    const orgProviders =
+      results[1].status === "fulfilled" ? results[1].value : [];
+    // Merge: user-scope providers take precedence over org-scope ones with the
+    // same id, and neither can shadow a built-in id.
+    const seen = new Set<string>(PROVIDER_API_IDS as unknown as string[]);
+    const merged = [];
+    for (const p of [...userProviders, ...orgProviders]) {
+      if (!seen.has(p.id)) {
+        seen.add(p.id);
+        merged.push(p);
+      }
     }
-    return ctx;
+    return merged;
   },
 });
 
-export function listProviderApiCatalog(provider?: DispatchProviderApiId) {
+export function listProviderApiCatalog(provider?: string) {
   return runtime.listCatalog(provider);
 }
 
 export function fetchProviderApiDocs(options: {
-  provider: DispatchProviderApiId;
+  provider: string;
   url?: string;
   maxBytes?: number;
 }) {