@agent-native/core 0.14.8 → 0.15.1

package/dist/client/use-pinch-zoom.js

@@ -0,0 +1,105 @@
+import { useEffect, useRef } from "react";
+/**
+ * Pinch-to-zoom for canvas-style editors. Wires the trackpad pinch / Cmd+scroll
+ * wheel gesture and 2-pointer touchscreen pinch onto a scrolling container.
+ *
+ * Trackpad pinch is detected via `wheel` events with `ctrlKey: true` — browsers
+ * have synthesized that since ~2015 specifically so web apps can intercept the
+ * gesture. `metaKey` is also accepted so Cmd+scroll on Mac feels native.
+ *
+ * The hook only calls `setZoom(next)` — it doesn't render anything. Templates
+ * decide how to translate the zoom percentage into visual scaling (CSS
+ * `transform: scale()`, width/height, etc.).
+ */
+export function usePinchZoom({ containerRef, zoom, setZoom, min = 25, max = 400, zoomToCursor = true, enabled = true, }) {
+    const zoomRef = useRef(zoom);
+    const setZoomRef = useRef(setZoom);
+    zoomRef.current = zoom;
+    setZoomRef.current = setZoom;
+    useEffect(() => {
+        if (!enabled)
+            return;
+        const container = containerRef.current;
+        if (!container)
+            return;
+        const clamp = (n) => Math.max(min, Math.min(max, n));
+        const handleWheel = (e) => {
+            if (!(e.ctrlKey || e.metaKey))
+                return;
+            e.preventDefault();
+            const currentZoom = zoomRef.current;
+            const clampedDelta = Math.max(-50, Math.min(50, e.deltaY));
+            const factor = Math.exp(-clampedDelta * 0.01);
+            const nextZoom = clamp(currentZoom * factor);
+            if (nextZoom === currentZoom)
+                return;
+            if (zoomToCursor) {
+                const rect = container.getBoundingClientRect();
+                const cx = e.clientX - rect.left + container.scrollLeft;
+                const cy = e.clientY - rect.top + container.scrollTop;
+                const ratio = nextZoom / currentZoom;
+                const dx = cx * (ratio - 1);
+                const dy = cy * (ratio - 1);
+                setZoomRef.current(nextZoom);
+                requestAnimationFrame(() => {
+                    container.scrollLeft += dx;
+                    container.scrollTop += dy;
+                });
+            }
+            else {
+                setZoomRef.current(nextZoom);
+            }
+        };
+        const activePointers = new Map();
+        let initialDistance = 0;
+        let initialZoom = 0;
+        const handlePointerDown = (e) => {
+            if (e.pointerType !== "touch")
+                return;
+            activePointers.set(e.pointerId, { x: e.clientX, y: e.clientY });
+            if (activePointers.size === 2) {
+                const [p1, p2] = Array.from(activePointers.values());
+                initialDistance = Math.hypot(p2.x - p1.x, p2.y - p1.y);
+                initialZoom = zoomRef.current;
+            }
+        };
+        const handlePointerMove = (e) => {
+            if (e.pointerType !== "touch")
+                return;
+            if (!activePointers.has(e.pointerId))
+                return;
+            activePointers.set(e.pointerId, { x: e.clientX, y: e.clientY });
+            if (activePointers.size === 2 && initialDistance > 0) {
+                const [p1, p2] = Array.from(activePointers.values());
+                const distance = Math.hypot(p2.x - p1.x, p2.y - p1.y);
+                const nextZoom = clamp(initialZoom * (distance / initialDistance));
+                if (nextZoom !== zoomRef.current) {
+                    setZoomRef.current(nextZoom);
+                }
+                e.preventDefault();
+            }
+        };
+        const handlePointerEnd = (e) => {
+            if (e.pointerType !== "touch")
+                return;
+            activePointers.delete(e.pointerId);
+            if (activePointers.size < 2)
+                initialDistance = 0;
+        };
+        container.addEventListener("wheel", handleWheel, { passive: false });
+        container.addEventListener("pointerdown", handlePointerDown);
+        container.addEventListener("pointermove", handlePointerMove, {
+            passive: false,
+        });
+        container.addEventListener("pointerup", handlePointerEnd);
+        container.addEventListener("pointercancel", handlePointerEnd);
+        return () => {
+            container.removeEventListener("wheel", handleWheel);
+            container.removeEventListener("pointerdown", handlePointerDown);
+            container.removeEventListener("pointermove", handlePointerMove);
+            container.removeEventListener("pointerup", handlePointerEnd);
+            container.removeEventListener("pointercancel", handlePointerEnd);
+        };
+    }, [containerRef, enabled, min, max, zoomToCursor]);
+}
+//# sourceMappingURL=use-pinch-zoom.js.map

package/dist/client/use-pinch-zoom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-pinch-zoom.js","sourceRoot":"","sources":["../../src/client/use-pinch-zoom.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAwB1C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,GAAG,GAAG,EAAE,EACR,GAAG,GAAG,GAAG,EACT,YAAY,GAAG,IAAI,EACnB,OAAO,GAAG,IAAI,GACM;IACpB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC;IAE7B,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAE7D,MAAM,WAAW,GAAG,CAAC,CAAa,EAAE,EAAE;YACpC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC;gBAAE,OAAO;YACtC,CAAC,CAAC,cAAc,EAAE,CAAC;YAEnB,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;YACpC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC;YAE7C,IAAI,QAAQ,KAAK,WAAW;gBAAE,OAAO;YAErC,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC;gBAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC;gBACxD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC;gBACtD,MAAM,KAAK,GAAG,QAAQ,GAAG,WAAW,CAAC;gBACrC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC5B,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC5B,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC7B,qBAAqB,CAAC,GAAG,EAAE;oBACzB,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;oBAC3B,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC;gBAC5B,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoC,CAAC;QACnE,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,MAAM,iBAAiB,GAAG,CAAC,CAAe,EAAE,EAAE;YAC5C,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO;gBAAE,OAAO;YACtC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBACvD,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;YAChC,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,iBAAiB,GAAG,CAAC,CAAe,EAAE,EAAE;YAC5C,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO;gBAAE,OAAO;YACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;gBAAE,OAAO;YAC7C,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,IAAI,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,GAAG,CAAC,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC;gBACnE,IAAI,QAAQ,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;oBACjC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAC/B,CAAC;gBACD,CAAC,CAAC,cAAc,EAAE,CAAC;YACrB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,gBAAgB,GAAG,CAAC,CAAe,EAAE,EAAE;YAC3C,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO;gBAAE,OAAO;YACtC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC;gBAAE,eAAe,GAAG,CAAC,CAAC;QACnD,CAAC,CAAC;QAEF,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,SAAS,CAAC,gBAAgB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAC7D,SAAS,CAAC,gBAAgB,CAAC,aAAa,EAAE,iBAAiB,EAAE;YAC3D,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,SAAS,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC1D,SAAS,CAAC,gBAAgB,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;QAE9D,OAAO,GAAG,EAAE;YACV,SAAS,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACpD,SAAS,CAAC,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YAChE,SAAS,CAAC,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;YAChE,SAAS,CAAC,mBAAmB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;YAC7D,SAAS,CAAC,mBAAmB,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;QACnE,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import { useEffect, useRef } from \"react\";\n\nexport interface UsePinchZoomOptions {\n  /** Scrolling viewport that receives the gesture. The scaled content should\n   *  live inside this element. */\n  containerRef: React.RefObject<HTMLElement | null>;\n  /** Current zoom as a percentage (100 = 100%). */\n  zoom: number;\n  /** Setter for the zoom value (called with the next percentage). */\n  setZoom: (next: number) => void;\n  /** Minimum zoom percentage. Default 25. */\n  min?: number;\n  /** Maximum zoom percentage. Default 400. */\n  max?: number;\n  /** When true (default), adjusts container scroll so the point under the\n   *  cursor stays under the cursor during wheel-zoom. Assumes the scaled\n   *  content uses `transform-origin: top left` (or equivalent — e.g. resizing\n   *  the inner container's width proportionally to zoom). Disable for layouts\n   *  with `transform-origin: center center`. */\n  zoomToCursor?: boolean;\n  /** Disable the hook entirely without unmounting it. */\n  enabled?: boolean;\n}\n\n/**\n * Pinch-to-zoom for canvas-style editors. Wires the trackpad pinch / Cmd+scroll\n * wheel gesture and 2-pointer touchscreen pinch onto a scrolling container.\n *\n * Trackpad pinch is detected via `wheel` events with `ctrlKey: true` — browsers\n * have synthesized that since ~2015 specifically so web apps can intercept the\n * gesture. `metaKey` is also accepted so Cmd+scroll on Mac feels native.\n *\n * The hook only calls `setZoom(next)` — it doesn't render anything. Templates\n * decide how to translate the zoom percentage into visual scaling (CSS\n * `transform: scale()`, width/height, etc.).\n */\nexport function usePinchZoom({\n  containerRef,\n  zoom,\n  setZoom,\n  min = 25,\n  max = 400,\n  zoomToCursor = true,\n  enabled = true,\n}: UsePinchZoomOptions) {\n  const zoomRef = useRef(zoom);\n  const setZoomRef = useRef(setZoom);\n  zoomRef.current = zoom;\n  setZoomRef.current = setZoom;\n\n  useEffect(() => {\n    if (!enabled) return;\n    const container = containerRef.current;\n    if (!container) return;\n\n    const clamp = (n: number) => Math.max(min, Math.min(max, n));\n\n    const handleWheel = (e: WheelEvent) => {\n      if (!(e.ctrlKey || e.metaKey)) return;\n      e.preventDefault();\n\n      const currentZoom = zoomRef.current;\n      const clampedDelta = Math.max(-50, Math.min(50, e.deltaY));\n      const factor = Math.exp(-clampedDelta * 0.01);\n      const nextZoom = clamp(currentZoom * factor);\n\n      if (nextZoom === currentZoom) return;\n\n      if (zoomToCursor) {\n        const rect = container.getBoundingClientRect();\n        const cx = e.clientX - rect.left + container.scrollLeft;\n        const cy = e.clientY - rect.top + container.scrollTop;\n        const ratio = nextZoom / currentZoom;\n        const dx = cx * (ratio - 1);\n        const dy = cy * (ratio - 1);\n        setZoomRef.current(nextZoom);\n        requestAnimationFrame(() => {\n          container.scrollLeft += dx;\n          container.scrollTop += dy;\n        });\n      } else {\n        setZoomRef.current(nextZoom);\n      }\n    };\n\n    const activePointers = new Map<number, { x: number; y: number }>();\n    let initialDistance = 0;\n    let initialZoom = 0;\n\n    const handlePointerDown = (e: PointerEvent) => {\n      if (e.pointerType !== \"touch\") return;\n      activePointers.set(e.pointerId, { x: e.clientX, y: e.clientY });\n      if (activePointers.size === 2) {\n        const [p1, p2] = Array.from(activePointers.values());\n        initialDistance = Math.hypot(p2.x - p1.x, p2.y - p1.y);\n        initialZoom = zoomRef.current;\n      }\n    };\n\n    const handlePointerMove = (e: PointerEvent) => {\n      if (e.pointerType !== \"touch\") return;\n      if (!activePointers.has(e.pointerId)) return;\n      activePointers.set(e.pointerId, { x: e.clientX, y: e.clientY });\n      if (activePointers.size === 2 && initialDistance > 0) {\n        const [p1, p2] = Array.from(activePointers.values());\n        const distance = Math.hypot(p2.x - p1.x, p2.y - p1.y);\n        const nextZoom = clamp(initialZoom * (distance / initialDistance));\n        if (nextZoom !== zoomRef.current) {\n          setZoomRef.current(nextZoom);\n        }\n        e.preventDefault();\n      }\n    };\n\n    const handlePointerEnd = (e: PointerEvent) => {\n      if (e.pointerType !== \"touch\") return;\n      activePointers.delete(e.pointerId);\n      if (activePointers.size < 2) initialDistance = 0;\n    };\n\n    container.addEventListener(\"wheel\", handleWheel, { passive: false });\n    container.addEventListener(\"pointerdown\", handlePointerDown);\n    container.addEventListener(\"pointermove\", handlePointerMove, {\n      passive: false,\n    });\n    container.addEventListener(\"pointerup\", handlePointerEnd);\n    container.addEventListener(\"pointercancel\", handlePointerEnd);\n\n    return () => {\n      container.removeEventListener(\"wheel\", handleWheel);\n      container.removeEventListener(\"pointerdown\", handlePointerDown);\n      container.removeEventListener(\"pointermove\", handlePointerMove);\n      container.removeEventListener(\"pointerup\", handlePointerEnd);\n      container.removeEventListener(\"pointercancel\", handlePointerEnd);\n    };\n  }, [containerRef, enabled, min, max, zoomToCursor]);\n}\n"]}

package/dist/deploy/workspace-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-deploy.d.ts","sourceRoot":"","sources":["../../src/deploy/workspace-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAM7C,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAsC9E,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,OAAO,YAAY,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,IAAI,CAAC,CAwGf"}
+{"version":3,"file":"workspace-deploy.d.ts","sourceRoot":"","sources":["../../src/deploy/workspace-deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAe7C,MAAM,MAAM,qBAAqB,GAAG,kBAAkB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAiD9E,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,MAAM,CAAC,EAAE,qBAAqB,CAAC;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,OAAO,YAAY,CAAC;CAChC;AAED,wBAAsB,kBAAkB,CACtC,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,IAAI,CAAC,CAwGf"}

package/dist/deploy/workspace-deploy.js

@@ -19,6 +19,7 @@ import fs from "fs";
 import path from "path";
 import { findWorkspaceRoot } from "../scripts/utils.js";
 import { DISPATCH_WORKSPACE_ROOT_REDIRECTS } from "../shared/workspace-app-id.js";
+import { DEFAULT_WORKSPACE_APP_AUDIENCE, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromPackageJson, } from "../shared/workspace-app-audience.js";
 const NETLIFY_WORKSPACE_STATIC_DIR = "_workspace_static";
 const NETLIFY_PUBLIC_ASSET_EXTENSIONS = new Set([
     "avif",
@@ -121,6 +122,8 @@ export async function runWorkspaceDeploy(opts = {}) {
 }
 function buildOneApp(workspaceRoot, app, preset, execFile, workspaceApps) {
     const appDir = path.join(workspaceRoot, "apps", app);
+    const workspaceAppAudience = workspaceAppAudienceForApp(workspaceApps, app);
+    const workspaceAppRouteAccess = workspaceAppRouteAccessForApp(workspaceApps, app);
     const workspaceGatewayUrl = process.env.VITE_WORKSPACE_GATEWAY_URL || workspaceBaseUrl();
     const workspaceOAuthUrl = workspaceOAuthOrigin(workspaceGatewayUrl);
     const env = {
@@ -130,6 +133,13 @@ function buildOneApp(workspaceRoot, app, preset, execFile, workspaceApps) {
         VITE_AGENT_NATIVE_WORKSPACE: "1",
         APP_BASE_PATH: `/${app}`,
         VITE_APP_BASE_PATH: `/${app}`,
+        AGENT_NATIVE_WORKSPACE_APP_AUDIENCE: workspaceAppAudience,
+        AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: JSON.stringify(workspaceAppRouteAccess.publicPaths),
+        AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: JSON.stringify(workspaceAppRouteAccess.protectedPaths),
+        VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE: workspaceAppAudience,
+        VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: JSON.stringify(workspaceAppRouteAccess.publicPaths),
+        VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: JSON.stringify(workspaceAppRouteAccess.protectedPaths),
+        VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON: JSON.stringify(workspaceApps),
         ...(workspaceGatewayUrl
             ? {
                 WORKSPACE_GATEWAY_URL: process.env.WORKSPACE_GATEWAY_URL || workspaceGatewayUrl,
@@ -263,6 +273,10 @@ function writeCloudflareRoutingManifest(distDir, apps) {
         : "";
     const dispatchRootDynamicAliasRoutes = apps.includes("dispatch")
         ? `    if (pathname.startsWith("/apps/")) return Response.redirect(new URL("/dispatch" + pathname + search, request.url).toString(), 302);
+`
+        : "";
+    const dispatchMountedRootRedirect = apps.includes("dispatch")
+        ? `    if (pathname === "/dispatch" || pathname === "/dispatch/") return Response.redirect(new URL("/dispatch/overview" + search, request.url).toString(), 302);
 `
         : "";
     const worker = `${imports}
@@ -270,7 +284,7 @@ function writeCloudflareRoutingManifest(distDir, apps) {
 export default {
   async fetch(request, env, ctx) {
     const { pathname, search } = new URL(request.url);
-${dispatchRootFrameworkRoutes}${dispatchRootFaviconRoute}${dispatchRootAliasRoutes}${dispatchRootDynamicAliasRoutes}${dispatch}
+${dispatchRootFrameworkRoutes}${dispatchRootFaviconRoute}${dispatchRootAliasRoutes}${dispatchRootDynamicAliasRoutes}${dispatchMountedRootRedirect}${dispatch}
     if (pathname === "/") {
       return Response.redirect(new URL("${cloudflareRootRedirectPath(apps)}", request.url).toString(), 302);
     }
@@ -302,6 +316,7 @@ function writeNetlifyRedirects(distDir, apps) {
     if (apps.includes("dispatch")) {
         lines.push("/ /dispatch/overview 302");
         lines.push("/dispatch /dispatch/overview 302");
+        lines.push("/dispatch/ /dispatch/overview 302");
         for (const [from, to] of DISPATCH_WORKSPACE_ROOT_REDIRECTS) {
             lines.push(`/${from} /dispatch/${to} 302`);
         }
@@ -320,7 +335,7 @@ function writeVercelBuildConfig(outputDir, apps) {
         if (faviconAsset) {
             routes.push(vercelRedirect("/favicon.ico", `/dispatch/${faviconAsset}`));
         }
-        routes.push(vercelRedirect("/", "/dispatch/overview"), vercelRedirect("/dispatch", "/dispatch/overview"));
+        routes.push(vercelRedirect("/", "/dispatch/overview"), vercelRedirect("/dispatch", "/dispatch/overview"), vercelRedirect("/dispatch/", "/dispatch/overview"));
         for (const [from, to] of DISPATCH_WORKSPACE_ROOT_REDIRECTS) {
             routes.push(vercelRedirect(`/${from}`, `/dispatch/${to}`));
         }
@@ -401,6 +416,8 @@ function patchNetlifyFunctionEntry(functionDir, app, workspaceApps, staticDir) {
     if (!fs.existsSync(serverPath))
         return;
     const basePath = `/${app}`;
+    const workspaceAppAudience = workspaceAppAudienceForApp(workspaceApps, app);
+    const workspaceAppRouteAccess = workspaceAppRouteAccessForApp(workspaceApps, app);
     const pathConfig = app === "dispatch"
         ? ["/_agent-native/*", "/.well-known/*", `${basePath}/*`]
         : [basePath, `${basePath}/*`];
@@ -429,8 +446,15 @@ function setBasePathEnv() {
   Object.assign(processRef.env, {
     AGENT_NATIVE_WORKSPACE: "1",
     APP_BASE_PATH: basePath,
+    AGENT_NATIVE_WORKSPACE_APP_AUDIENCE: ${JSON.stringify(workspaceAppAudience)},
+    AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.publicPaths))},
+    AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.protectedPaths))},
     VITE_AGENT_NATIVE_WORKSPACE: "1",
     VITE_APP_BASE_PATH: basePath,
+    VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE: ${JSON.stringify(workspaceAppAudience)},
+    VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.publicPaths))},
+    VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.protectedPaths))},
+    VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON: ${JSON.stringify(JSON.stringify(workspaceApps))},
     ${JSON.stringify(WORKSPACE_APPS_ENV_KEY)}: ${JSON.stringify(JSON.stringify(workspaceApps))},
   });
 }
@@ -469,6 +493,8 @@ function patchVercelFunctionEntry(functionDir, app, workspaceApps) {
     fs.rmSync(mainPath, { force: true });
     fs.renameSync(entryPath, mainPath);
     const basePath = `/${app}`;
+    const workspaceAppAudience = workspaceAppAudienceForApp(workspaceApps, app);
+    const workspaceAppRouteAccess = workspaceAppRouteAccessForApp(workspaceApps, app);
     const entry = `const basePath = ${JSON.stringify(basePath)};
 
 function setBasePathEnv() {
@@ -477,8 +503,15 @@ function setBasePathEnv() {
   Object.assign(processRef.env, {
     AGENT_NATIVE_WORKSPACE: "1",
     APP_BASE_PATH: basePath,
+    AGENT_NATIVE_WORKSPACE_APP_AUDIENCE: ${JSON.stringify(workspaceAppAudience)},
+    AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.publicPaths))},
+    AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.protectedPaths))},
     VITE_AGENT_NATIVE_WORKSPACE: "1",
     VITE_APP_BASE_PATH: basePath,
+    VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE: ${JSON.stringify(workspaceAppAudience)},
+    VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.publicPaths))},
+    VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS: ${JSON.stringify(JSON.stringify(workspaceAppRouteAccess.protectedPaths))},
+    VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON: ${JSON.stringify(JSON.stringify(workspaceApps))},
     ${JSON.stringify(WORKSPACE_APPS_ENV_KEY)}: ${JSON.stringify(JSON.stringify(workspaceApps))},
   });
 }
@@ -590,6 +623,17 @@ function readWorkspaceAppManifest(workspaceRoot, apps) {
         const appPath = `/${app}`;
         const explicit = explicitApps.get(app);
         const url = normalizeWorkspaceAppUrl(explicit?.url) ?? workspaceAppUrl(appPath);
+        const audience = workspaceAppAudienceFromPackageJson(pkg) ??
+            explicit?.audience ??
+            DEFAULT_WORKSPACE_APP_AUDIENCE;
+        const packageRouteAccess = workspaceAppRouteAccessFromPackageJson(pkg);
+        // Prefer the package.json value whenever the field was set — including
+        // an explicit empty array, which is how a per-app package.json signals
+        // "clear any previously-published manifest override." Falling back on
+        // length > 0 would silently keep the explicit override even after the
+        // app owner blanked their list.
+        const publicPaths = packageRouteAccess.publicPaths ?? explicit?.publicPaths ?? [];
+        const protectedPaths = packageRouteAccess.protectedPaths ?? explicit?.protectedPaths ?? [];
         return {
             id: app,
             name: pkg?.displayName || titleCase(app),
@@ -597,6 +641,9 @@ function readWorkspaceAppManifest(workspaceRoot, apps) {
             path: appPath,
             ...(url ? { url } : {}),
             isDispatch: app === "dispatch",
+            audience,
+            publicPaths,
+            protectedPaths,
         };
     })
         .sort((a, b) => {
@@ -645,20 +692,36 @@ function parseWorkspaceAppsManifest(parsed) {
         if (!id)
             return null;
         const url = normalizeWorkspaceAppUrl(entry.url);
+        const audience = entry.audience === undefined
+            ? undefined
+            : normalizeWorkspaceAppAudience(entry.audience);
+        const publicPaths = normalizeWorkspaceAppPathList(entry.publicPaths);
+        const protectedPaths = normalizeWorkspaceAppPathList(entry.protectedPaths);
         return {
             id,
             ...(url ? { url } : {}),
+            ...(audience ? { audience } : {}),
+            ...(publicPaths.length > 0 ? { publicPaths } : {}),
+            ...(protectedPaths.length > 0 ? { protectedPaths } : {}),
         };
     })
         .filter((app) => !!app);
     return apps.length ? apps : null;
 }
 function workspaceBaseUrl() {
-    return (process.env.WORKSPACE_GATEWAY_URL ||
-        process.env.APP_URL ||
+    const gatewayOrigin = process.env.WORKSPACE_GATEWAY_URL || process.env.VITE_WORKSPACE_GATEWAY_URL;
+    const publicGatewayOrigin = normalizeOrigin(gatewayOrigin);
+    const gatewayFallback = publicGatewayOrigin && !isLoopbackOrigin(publicGatewayOrigin)
+        ? gatewayOrigin
+        : null;
+    return (process.env.APP_URL ||
+        process.env.WORKSPACE_OAUTH_ORIGIN ||
+        process.env.VITE_WORKSPACE_OAUTH_ORIGIN ||
         process.env.URL ||
         process.env.DEPLOY_URL ||
         process.env.BETTER_AUTH_URL ||
+        gatewayFallback ||
+        gatewayOrigin ||
         null);
 }
 function normalizeOrigin(value) {
@@ -671,14 +734,34 @@ function normalizeOrigin(value) {
         return undefined;
     }
 }
+function isLoopbackOrigin(origin) {
+    if (!origin)
+        return false;
+    try {
+        const host = new URL(origin).hostname.toLowerCase();
+        return (host === "localhost" ||
+            host === "127.0.0.1" ||
+            host === "[::1]" ||
+            host === "::1");
+    }
+    catch {
+        return false;
+    }
+}
 function workspaceOAuthOrigin(workspaceGatewayUrl) {
+    // Explicit overrides (env vars set by the operator) win even if they happen
+    // to be loopback — that's a deliberate dev-against-prod choice.
+    // The gateway-URL fallback, however, is auto-resolved and would silently
+    // send users to localhost if the configured gateway is loopback in a
+    // production deploy. Strip loopback there so OAuth fails loudly instead.
+    const gatewayFallback = normalizeOrigin(workspaceGatewayUrl);
     return (normalizeOrigin(process.env.VITE_WORKSPACE_OAUTH_ORIGIN) ||
         normalizeOrigin(process.env.WORKSPACE_OAUTH_ORIGIN) ||
         normalizeOrigin(process.env.APP_URL) ||
         normalizeOrigin(process.env.BETTER_AUTH_URL) ||
         normalizeOrigin(process.env.URL) ||
         normalizeOrigin(process.env.DEPLOY_URL) ||
-        normalizeOrigin(workspaceGatewayUrl));
+        (isLoopbackOrigin(gatewayFallback) ? undefined : gatewayFallback));
 }
 function workspaceAppUrl(appPath) {
     const base = workspaceBaseUrl();
@@ -780,6 +863,17 @@ function normalizePreset(value) {
 function moduleIdent(app) {
     return "app_" + app.replace(/[^a-zA-Z0-9_]/g, "_");
 }
+function workspaceAppAudienceForApp(workspaceApps, app) {
+    return (workspaceApps.find((entry) => entry.id === app)?.audience ??
+        DEFAULT_WORKSPACE_APP_AUDIENCE);
+}
+function workspaceAppRouteAccessForApp(workspaceApps, app) {
+    const entry = workspaceApps.find((candidate) => candidate.id === app);
+    return {
+        publicPaths: entry?.publicPaths ?? [],
+        protectedPaths: entry?.protectedPaths ?? [],
+    };
+}
 function compareWorkspaceAppIds(a, b) {
     if (a === "dispatch")
         return -1;