@agent-native/core 0.14.8 → 0.15.1

package/dist/server/agent-discovery.d.ts

@@ -1,3 +1,4 @@
+import { type WorkspaceAppAudience } from "../shared/workspace-app-audience.js";
 export interface DiscoveredAgent {
     id: string;
     name: string;
@@ -5,6 +6,18 @@ export interface DiscoveredAgent {
     url: string;
     color: string;
 }
+export interface WorkspaceAppMetadataOverride {
+    name?: string;
+    description?: string;
+    generated?: boolean;
+    sourcePrompt?: string;
+    updatedAt?: string;
+    updatedBy?: string;
+}
+export interface WorkspaceAppMetadataSettings {
+    apps: Record<string, WorkspaceAppMetadataOverride>;
+}
+export declare const WORKSPACE_APP_METADATA_SETTINGS_KEY = "workspace-app-metadata";
 export interface WorkspaceAppManifestEntry {
     id: string;
     name: string;
@@ -12,7 +25,29 @@ export interface WorkspaceAppManifestEntry {
     path: string;
     url?: string | null;
     isDispatch?: boolean;
+    audience?: WorkspaceAppAudience;
+    publicPaths?: string[];
+    protectedPaths?: string[];
 }
+export declare function workspaceAppMetadataSettingsKey(input?: {
+    orgId?: string | null;
+    userEmail?: string | null;
+}): string | null;
+export declare function parseWorkspaceAppMetadataSettings(raw: unknown): WorkspaceAppMetadataSettings;
+export declare function readWorkspaceAppMetadataSettings(): Promise<WorkspaceAppMetadataSettings>;
+export declare function writeWorkspaceAppMetadataOverride(input: {
+    appId: string;
+    name?: string | null;
+    description?: string | null;
+    generated?: boolean;
+    sourcePrompt?: string | null;
+    updatedBy?: string | null;
+}): Promise<WorkspaceAppMetadataSettings>;
+export declare function applyWorkspaceAppMetadataOverride<T extends {
+    id: string;
+    name: string;
+    description?: string | null;
+}>(app: T, settings: WorkspaceAppMetadataSettings): T;
 /**
  * Resolve the workspace app manifest from the same fallback chain that
  * `discoverWorkspaceAgents` uses: `AGENT_NATIVE_WORKSPACE_APPS_JSON` env →

package/dist/server/agent-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-discovery.d.ts","sourceRoot":"","sources":["../../src/server/agent-discovery.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAuCD,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,IACrC,yBAAyB,EAAE,GAC3B,IAAI,CAMP;AAED,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAChC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAST;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE,CAUtE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,EAAE,CAAC,CAyE5B;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAItC;AAmND;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAOnD,CAAC"}
+{"version":3,"file":"agent-discovery.d.ts","sourceRoot":"","sources":["../../src/server/agent-discovery.ts"],"names":[],"mappings":"AAKA,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAE7C,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;CACpD;AAsCD,eAAO,MAAM,mCAAmC,2BAA2B,CAAC;AAE5E,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,+BAA+B,CAAC,KAAK,CAAC,EAAE;IACtD,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,MAAM,GAAG,IAAI,CAShB;AAMD,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,GACX,4BAA4B,CAkC9B;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAU9F;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAgCxC;AAED,wBAAgB,iCAAiC,CAC/C,CAAC,SAAS;IACR,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,EACD,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,4BAA4B,GAAG,CAAC,CAiBnD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,IACrC,yBAAyB,EAAE,GAC3B,IAAI,CAMP;AAED,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE;IAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAChC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAST;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE,CAUtE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,EAAE,CAAC,CAyE5B;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAItC;AAyOD;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,EAAE,eAAe,EAOnD,CAAC"}

package/dist/server/agent-discovery.js

@@ -2,6 +2,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { TEMPLATES } from "../cli/templates-meta.js";
+import { getRequestOrgId, getRequestUserEmail } from "./request-context.js";
+import { DEFAULT_WORKSPACE_APP_AUDIENCE, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromPackageJson, } from "../shared/workspace-app-audience.js";
 /**
  * Built-in agent registry. Derive this from the published CLI metadata so
  * connected-agent discovery stays aligned with first-party template metadata
@@ -19,6 +21,123 @@ const BUILTIN_AGENTS = TEMPLATES.filter((template) => (!template.hidden || templ
 const HIDDEN_FIRST_PARTY_AGENT_IDS = new Set(TEMPLATES.filter((template) => template.hidden && !template.defaultAgent && template.prodUrl).map((template) => template.name));
 const WORKSPACE_APPS_ENV_KEY = "AGENT_NATIVE_WORKSPACE_APPS_JSON";
 const WORKSPACE_APPS_MANIFEST_FILE = "workspace-apps.json";
+export const WORKSPACE_APP_METADATA_SETTINGS_KEY = "workspace-app-metadata";
+export function workspaceAppMetadataSettingsKey(input) {
+    const orgId = input?.orgId ?? getRequestOrgId() ?? null;
+    if (orgId)
+        return `${WORKSPACE_APP_METADATA_SETTINGS_KEY}:org:${orgId}`;
+    const userEmail = input?.userEmail ?? getRequestUserEmail() ?? null;
+    if (userEmail)
+        return `${WORKSPACE_APP_METADATA_SETTINGS_KEY}:user:${userEmail}`;
+    return null;
+}
+function cleanOptionalText(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+export function parseWorkspaceAppMetadataSettings(raw) {
+    const record = raw && typeof raw === "object" && !Array.isArray(raw)
+        ? raw
+        : {};
+    const rawApps = record.apps &&
+        typeof record.apps === "object" &&
+        !Array.isArray(record.apps)
+        ? record.apps
+        : {};
+    const apps = {};
+    for (const [id, value] of Object.entries(rawApps)) {
+        if (!id.trim() || !value || typeof value !== "object")
+            continue;
+        const item = value;
+        const override = {};
+        const name = cleanOptionalText(item.name);
+        const description = cleanOptionalText(item.description);
+        const sourcePrompt = cleanOptionalText(item.sourcePrompt);
+        const updatedAt = cleanOptionalText(item.updatedAt);
+        const updatedBy = cleanOptionalText(item.updatedBy);
+        if (name)
+            override.name = name;
+        if (description)
+            override.description = description;
+        if (item.generated === true)
+            override.generated = true;
+        if (sourcePrompt)
+            override.sourcePrompt = sourcePrompt;
+        if (updatedAt)
+            override.updatedAt = updatedAt;
+        if (updatedBy)
+            override.updatedBy = updatedBy;
+        if (Object.keys(override).length > 0)
+            apps[id.trim()] = override;
+    }
+    return { apps };
+}
+export async function readWorkspaceAppMetadataSettings() {
+    const key = workspaceAppMetadataSettingsKey();
+    if (!key)
+        return { apps: {} };
+    try {
+        const { getSetting } = await import("../settings/index.js");
+        return parseWorkspaceAppMetadataSettings(await getSetting(key));
+    }
+    catch {
+        return { apps: {} };
+    }
+}
+export async function writeWorkspaceAppMetadataOverride(input) {
+    const key = workspaceAppMetadataSettingsKey();
+    if (!key)
+        throw new Error("no authenticated user");
+    const appId = input.appId.trim();
+    if (!appId)
+        throw new Error("appId is required");
+    const { getSetting, putSetting } = await import("../settings/index.js");
+    const current = parseWorkspaceAppMetadataSettings(await getSetting(key));
+    const existing = current.apps[appId] ?? {};
+    const next = {
+        ...existing,
+        updatedAt: new Date().toISOString(),
+    };
+    const name = cleanOptionalText(input.name);
+    const description = cleanOptionalText(input.description);
+    const sourcePrompt = cleanOptionalText(input.sourcePrompt);
+    const updatedBy = cleanOptionalText(input.updatedBy);
+    if (name)
+        next.name = name;
+    else
+        delete next.name;
+    if (description)
+        next.description = description;
+    else
+        delete next.description;
+    if (input.generated === true)
+        next.generated = true;
+    else if (input.generated === false)
+        delete next.generated;
+    if (sourcePrompt)
+        next.sourcePrompt = sourcePrompt;
+    if (updatedBy)
+        next.updatedBy = updatedBy;
+    current.apps[appId] = next;
+    await putSetting(key, current);
+    return current;
+}
+export function applyWorkspaceAppMetadataOverride(app, settings) {
+    const override = settings.apps[app.id];
+    if (!override)
+        return app;
+    const name = cleanOptionalText(override.name);
+    const description = cleanOptionalText(override.description);
+    const generated = override.generated === true;
+    const shouldApplyName = !!name && !generated;
+    const shouldApplyDescription = !!description && (!generated || !cleanOptionalText(app.description));
+    if (!shouldApplyName && !shouldApplyDescription)
+        return app;
+    return {
+        ...app,
+        ...(shouldApplyName ? { name } : {}),
+        ...(shouldApplyDescription ? { description } : {}),
+    };
+}
 /**
  * Resolve the workspace app manifest from the same fallback chain that
  * `discoverWorkspaceAgents` uses: `AGENT_NATIVE_WORKSPACE_APPS_JSON` env →
@@ -123,7 +242,7 @@ export async function discoverAgents(selfAppId) {
     }
     // Overlay sibling workspace apps last so same-origin workspaces prefer the
     // app mounted in this workspace over the public template with the same id.
-    for (const agent of discoverWorkspaceAgents(selfAppId)) {
+    for (const agent of await discoverWorkspaceAgents(selfAppId)) {
         agentsById.set(agent.id, agent);
     }
     return Array.from(agentsById.values());
@@ -203,6 +322,11 @@ function parseWorkspaceAppsManifest(parsed) {
             isDispatch: typeof entry.isDispatch === "boolean"
                 ? entry.isDispatch
                 : id === "dispatch",
+            audience: entry.audience === undefined
+                ? DEFAULT_WORKSPACE_APP_AUDIENCE
+                : normalizeWorkspaceAppAudience(entry.audience),
+            publicPaths: normalizeWorkspaceAppPathList(entry.publicPaths),
+            protectedPaths: normalizeWorkspaceAppPathList(entry.protectedPaths),
         };
     })
         .filter((app) => !!app)
@@ -269,12 +393,17 @@ function readWorkspaceAppsFromFilesystem() {
         const pkg = readJson(path.join(appDir, "package.json"));
         if (!pkg)
             return null;
+        const routeAccess = workspaceAppRouteAccessFromPackageJson(pkg);
         return {
             id: entry.name,
             name: pkg.displayName || titleCase(entry.name),
             description: pkg.description || "",
             path: `/${entry.name}`,
             isDispatch: entry.name === "dispatch",
+            audience: workspaceAppAudienceFromPackageJson(pkg) ??
+                DEFAULT_WORKSPACE_APP_AUDIENCE,
+            publicPaths: routeAccess.publicPaths ?? [],
+            protectedPaths: routeAccess.protectedPaths ?? [],
         };
     })
         .filter((app) => !!app)
@@ -308,23 +437,25 @@ function workspaceAppUrl(app) {
         return null;
     }
 }
-function discoverWorkspaceAgents(selfAppId) {
+async function discoverWorkspaceAgents(selfAppId) {
     const workspaceApps = loadWorkspaceAppsManifest();
     if (!workspaceApps)
         return [];
+    const metadataSettings = await readWorkspaceAppMetadataSettings();
     return workspaceApps
         .filter((app) => app.id !== selfAppId)
         .map((app) => {
-        const url = workspaceAppUrl(app);
+        const withOverride = applyWorkspaceAppMetadataOverride(app, metadataSettings);
+        const url = workspaceAppUrl(withOverride);
         if (!url)
             return null;
-        const builtin = BUILTIN_AGENTS.find((agent) => agent.id === app.id);
+        const builtin = BUILTIN_AGENTS.find((agent) => agent.id === withOverride.id);
         return {
-            id: app.id,
-            name: app.name,
-            description: app.description ||
+            id: withOverride.id,
+            name: withOverride.name,
+            description: withOverride.description ||
                 builtin?.description ||
-                `Workspace app mounted at ${app.path}`,
+                `Workspace app mounted at ${withOverride.path}`,
             url,
             color: builtin?.color || "#6B7280",
         };

package/dist/server/agent-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-discovery.js","sourceRoot":"","sources":["../../src/server/agent-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAoBrD;;;;GAIG;AACH,MAAM,cAAc,GAAiB,SAAS,CAAC,MAAM,CACnD,CAAC,QAAQ,EAAE,EAAE,CACX,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CACpE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACnB,EAAE,EAAE,QAAQ,CAAC,IAAI;IACjB,IAAI,EAAE,QAAQ,CAAC,KAAK;IACpB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI;IAClD,GAAG,EAAE,QAAQ,CAAC,OAAQ;IACtB,MAAM,EAAE,oBAAoB,QAAQ,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;CACtB,CAAC,CAAC,CAAC;AAEJ,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAC1C,SAAS,CAAC,MAAM,CACd,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,CAC5E,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnC,CAAC;AAEF,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAW3D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB;IAGvC,OAAO,CACL,wBAAwB,EAAE;QAC1B,iCAAiC,EAAE;QACnC,+BAA+B,EAAE,CAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,QAAgC,EAChC,SAAkB;IAElB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,YAAY,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,mBAAmB,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,mBAAmB,IAAI,YAAY,KAAK,mBAAmB,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,4BAA4B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB;IACjD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CACxE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACR,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;KACjB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAkB;IAElB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEtD,uBAAuB;IACvB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,GAC/C,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAExC,MAAM,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,GAChE,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAE3C,MAAM,SAAS,GAAwC,EAAE,CAAC;QAC1D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,8BAA8B,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChE,IAAI,CAAC,QAAQ,IAAI,CAAC,gCAAgC,CAAC,QAAQ,EAAE,SAAS,CAAC;oBACrE,SAAS;gBAEX,qEAAqE;gBACrE,qEAAqE;gBACrE,gEAAgE;gBAChE,qEAAqE;gBACrE,kEAAkE;gBAClE,sEAAsE;gBACtE,2DAA2D;gBAC3D,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;gBACvB,MAAM,YAAY,GAChB,OAAO,OAAO,KAAK,WAAW;oBAC9B,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC;gBACzC,IACE,YAAY;oBACZ,OAAO,GAAG,KAAK,QAAQ;oBACvB,yDAAyD,CAAC,IAAI,CAAC,GAAG,CAAC,EACnE,CAAC;oBACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC5C,IAAI,OAAO,EAAE,GAAG;wBAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;gBACtC,CAAC;gBAED,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC1B,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;oBACvC,GAAG;oBACH,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,SAAS;iBACnC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,KAAK,MAAM,KAAK,IAAI,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,SAAkB;IAElB,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,CACL,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAe;IACtC,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,IAAI,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE;IACjD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC7D,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CACjC,MAAW;IAEX,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,IAAI,GAAG,OAAO;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO;YACL,EAAE;YACF,IAAI,EACF,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;gBACjD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;gBACnB,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YACnB,WAAW,EACT,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YAChE,IAAI,EAAE,SAAS;YACf,GAAG,EACD,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC/C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;gBAClB,CAAC,CAAC,IAAI;YACV,UAAU,EACR,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS;gBACnC,CAAC,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,EAAE,KAAK,UAAU;SACY,CAAC;IACxC,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAoC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SACxD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC,EACvE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,4BAA4B,CAAC,CACvD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,4BAA4B,CAAC,EACnE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CACnD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,iDAAiD;IACnD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iCAAiC;IAGxC,KAAK,MAAM,IAAI,IAAI,+BAA+B,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,+BAA+B;IACtC,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;IAC1C,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,IAAI,GAAG,EAAE;SACZ,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAoC,EAAE;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YAClC,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE;YACtB,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,UAAU;SACF,CAAC;IACxC,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAoC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SACxD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAA8B;IACrD,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC5B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,SAAkB;IACjD,MAAM,aAAa,GAAG,yBAAyB,EAAE,CAAC;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAE9B,OAAO,aAAa;SACjB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC;SACrC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EACT,GAAG,CAAC,WAAW;gBACf,OAAO,EAAE,WAAW;gBACpB,4BAA4B,GAAG,CAAC,IAAI,EAAE;YACxC,GAAG;YACH,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,SAAS;SACT,CAAC;IAC9B,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAA4B,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpD,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,cAAc;IAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;CACjB,CAAC,CAAC,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { TEMPLATES } from \"../cli/templates-meta.js\";\n\nexport interface DiscoveredAgent {\n  id: string;\n  name: string;\n  description: string;\n  url: string;\n  color: string;\n}\n\ninterface AgentEntry {\n  id: string;\n  name: string;\n  description: string;\n  url: string;\n  devUrl?: string;\n  devPort: number;\n  color: string;\n}\n\n/**\n * Built-in agent registry. Derive this from the published CLI metadata so\n * connected-agent discovery stays aligned with first-party template metadata\n * without depending on @agent-native/shared-app-config at runtime.\n */\nconst BUILTIN_AGENTS: AgentEntry[] = TEMPLATES.filter(\n  (template) =>\n    (!template.hidden || template.defaultAgent) && !!template.prodUrl,\n).map((template) => ({\n  id: template.name,\n  name: template.label,\n  description: template.description ?? template.hint,\n  url: template.prodUrl!,\n  devUrl: `http://localhost:${template.devPort}`,\n  devPort: template.devPort,\n  color: template.color,\n}));\n\nconst HIDDEN_FIRST_PARTY_AGENT_IDS = new Set(\n  TEMPLATES.filter(\n    (template) => template.hidden && !template.defaultAgent && template.prodUrl,\n  ).map((template) => template.name),\n);\n\nconst WORKSPACE_APPS_ENV_KEY = \"AGENT_NATIVE_WORKSPACE_APPS_JSON\";\nconst WORKSPACE_APPS_MANIFEST_FILE = \"workspace-apps.json\";\n\nexport interface WorkspaceAppManifestEntry {\n  id: string;\n  name: string;\n  description: string;\n  path: string;\n  url?: string | null;\n  isDispatch?: boolean;\n}\n\n/**\n * Resolve the workspace app manifest from the same fallback chain that\n * `discoverWorkspaceAgents` uses: `AGENT_NATIVE_WORKSPACE_APPS_JSON` env →\n * `.agent-native/workspace-apps.json` (or sibling) on disk → live filesystem\n * scan of `apps/<id>/package.json` under the workspace root.\n *\n * Callers (e.g. the dispatch `/dispatch/<appId>` catch-all loader) need this\n * to behave the same in production deploys (which write the manifest file)\n * and during local dev (where new apps appear under `apps/` without an env\n * restart). Reading only the env var would silently downgrade the behavior\n * in both cases.\n */\nexport function loadWorkspaceAppsManifest():\n  | WorkspaceAppManifestEntry[]\n  | null {\n  return (\n    readWorkspaceAppsFromEnv() ??\n    readWorkspaceAppsFromManifestFile() ??\n    readWorkspaceAppsFromFilesystem()\n  );\n}\n\nexport function shouldIncludeRemoteAgentManifest(\n  manifest: { id?: string | null },\n  selfAppId?: string,\n): boolean {\n  const id = manifest.id?.trim();\n  if (!id) return false;\n  const normalizedId = id.toLowerCase();\n  const normalizedSelfAppId = selfAppId?.trim().toLowerCase();\n  if (normalizedSelfAppId && normalizedId === normalizedSelfAppId) {\n    return false;\n  }\n  return !HIDDEN_FIRST_PARTY_AGENT_IDS.has(normalizedId);\n}\n\n/**\n * Get built-in agents (static, no DB). Used as fallback and for seeding.\n */\nexport function getBuiltinAgents(selfAppId?: string): DiscoveredAgent[] {\n  return BUILTIN_AGENTS.filter((app) => app.id !== selfAppId && app.url).map(\n    (app) => ({\n      id: app.id,\n      name: app.name,\n      description: app.description,\n      url: resolveAgentUrl(app),\n      color: app.color,\n    }),\n  );\n}\n\n/**\n * Discover all agents: built-in + custom agents stored as resources.\n * Custom agents override built-in agents with the same ID.\n */\nexport async function discoverAgents(\n  selfAppId?: string,\n): Promise<DiscoveredAgent[]> {\n  const builtins = getBuiltinAgents(selfAppId);\n  const agentsById = new Map<string, DiscoveredAgent>();\n\n  // Start with built-ins\n  for (const agent of builtins) {\n    agentsById.set(agent.id, agent);\n  }\n\n  // Overlay custom agents from resources\n  try {\n    const { resourceList, resourceGet, SHARED_OWNER } =\n      await import(\"../resources/store.js\");\n\n    const { parseRemoteAgentManifest, REMOTE_AGENT_RESOURCE_PREFIXES } =\n      await import(\"../resources/metadata.js\");\n\n    const resources: Array<{ id: string; path: string }> = [];\n    for (const prefix of [...REMOTE_AGENT_RESOURCE_PREFIXES].reverse()) {\n      resources.push(...(await resourceList(SHARED_OWNER, prefix)));\n    }\n\n    for (const r of resources) {\n      if (!r.path.endsWith(\".json\")) continue;\n      try {\n        const full = await resourceGet(r.id);\n        if (!full) continue;\n        const manifest = parseRemoteAgentManifest(full.content, r.path);\n        if (!manifest || !shouldIncludeRemoteAgentManifest(manifest, selfAppId))\n          continue;\n\n        // If the resource override carries a localhost URL but we're running\n        // in production (e.g. a stale dev-time seed got promoted to the prod\n        // DB), fall back to the matching built-in's prod URL instead of\n        // letting the override win — otherwise outbound `call-agent` fetches\n        // from a serverless function would target localhost and fail with\n        // \"fetch failed\" instantly. The override still wins for non-localhost\n        // URLs (the supported case for self-hosted custom agents).\n        let url = manifest.url;\n        const isProduction =\n          typeof process !== \"undefined\" &&\n          process.env?.NODE_ENV === \"production\";\n        if (\n          isProduction &&\n          typeof url === \"string\" &&\n          /^https?:\\/\\/(localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0)(:|\\/|$)/.test(url)\n        ) {\n          const builtin = agentsById.get(manifest.id);\n          if (builtin?.url) url = builtin.url;\n        }\n\n        agentsById.set(manifest.id, {\n          id: manifest.id,\n          name: manifest.name,\n          description: manifest.description || \"\",\n          url,\n          color: manifest.color || \"#6B7280\",\n        });\n      } catch {\n        // Skip unreadable resources\n      }\n    }\n  } catch {\n    // Resources not available — use built-ins only\n  }\n\n  // Overlay sibling workspace apps last so same-origin workspaces prefer the\n  // app mounted in this workspace over the public template with the same id.\n  for (const agent of discoverWorkspaceAgents(selfAppId)) {\n    agentsById.set(agent.id, agent);\n  }\n\n  return Array.from(agentsById.values());\n}\n\n/**\n * Look up a single agent by ID or name (case-insensitive).\n */\nexport async function findAgent(\n  idOrName: string,\n  selfAppId?: string,\n): Promise<DiscoveredAgent | undefined> {\n  const lower = idOrName.toLowerCase();\n  const agents = await discoverAgents(selfAppId);\n  return agents.find((a) => a.id === lower || a.name.toLowerCase() === lower);\n}\n\nfunction isDevEnvironment(): boolean {\n  return (\n    typeof process !== \"undefined\" && process.env?.NODE_ENV !== \"production\"\n  );\n}\n\nfunction resolveAgentUrl(app: AgentEntry): string {\n  if (isDevEnvironment()) {\n    return app.devUrl || `http://localhost:${app.devPort}`;\n  }\n  return app.url;\n}\n\nfunction readJson(file: string): any {\n  try {\n    return JSON.parse(fs.readFileSync(file, \"utf8\"));\n  } catch {\n    return null;\n  }\n}\n\nfunction findWorkspaceRoot(startDir = process.cwd()): string | null {\n  let dir = path.resolve(startDir);\n  for (let i = 0; i < 20; i++) {\n    const pkg = readJson(path.join(dir, \"package.json\"));\n    if (typeof pkg?.[\"agent-native\"]?.workspaceCore === \"string\") {\n      return dir;\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\nfunction titleCase(value: string): string {\n  return value\n    .split(/[-_\\s]+/)\n    .filter(Boolean)\n    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))\n    .join(\" \");\n}\n\nfunction parseWorkspaceAppsManifest(\n  parsed: any,\n): WorkspaceAppManifestEntry[] | null {\n  const rawApps = Array.isArray(parsed?.apps)\n    ? parsed.apps\n    : Array.isArray(parsed)\n      ? parsed\n      : null;\n  if (!rawApps) return null;\n\n  const apps = rawApps\n    .map((entry) => {\n      if (!entry || typeof entry !== \"object\") return null;\n      const id = typeof entry.id === \"string\" ? entry.id.trim() : \"\";\n      const pathValue = typeof entry.path === \"string\" ? entry.path.trim() : \"\";\n      if (!id || !pathValue.startsWith(\"/\")) return null;\n      return {\n        id,\n        name:\n          typeof entry.name === \"string\" && entry.name.trim()\n            ? entry.name.trim()\n            : titleCase(id),\n        description:\n          typeof entry.description === \"string\" ? entry.description : \"\",\n        path: pathValue,\n        url:\n          typeof entry.url === \"string\" && entry.url.trim()\n            ? entry.url.trim()\n            : null,\n        isDispatch:\n          typeof entry.isDispatch === \"boolean\"\n            ? entry.isDispatch\n            : id === \"dispatch\",\n      } satisfies WorkspaceAppManifestEntry;\n    })\n    .filter((app): app is WorkspaceAppManifestEntry => !!app)\n    .sort((a, b) => {\n      if (a.id === \"dispatch\") return -1;\n      if (b.id === \"dispatch\") return 1;\n      return a.name.localeCompare(b.name);\n    });\n\n  return apps.length ? apps : null;\n}\n\nfunction readWorkspaceAppsFromEnv(): WorkspaceAppManifestEntry[] | null {\n  const raw = process.env[WORKSPACE_APPS_ENV_KEY];\n  if (!raw) return null;\n  try {\n    return parseWorkspaceAppsManifest(JSON.parse(raw));\n  } catch {\n    return null;\n  }\n}\n\nfunction workspaceAppsManifestCandidates(): string[] {\n  const candidates: string[] = [];\n  try {\n    candidates.push(\n      path.join(process.cwd(), \".agent-native\", WORKSPACE_APPS_MANIFEST_FILE),\n      path.join(process.cwd(), WORKSPACE_APPS_MANIFEST_FILE),\n    );\n  } catch {\n    // Some edge runtimes do not expose process.cwd().\n  }\n  try {\n    const moduleDir = path.dirname(fileURLToPath(import.meta.url));\n    candidates.push(\n      path.join(moduleDir, \".agent-native\", WORKSPACE_APPS_MANIFEST_FILE),\n      path.join(moduleDir, WORKSPACE_APPS_MANIFEST_FILE),\n    );\n  } catch {\n    // Some edge runtimes expose non-file module URLs. The env manifest still\n    // works there, so skip file-relative candidates.\n  }\n  return candidates;\n}\n\nfunction readWorkspaceAppsFromManifestFile():\n  | WorkspaceAppManifestEntry[]\n  | null {\n  for (const file of workspaceAppsManifestCandidates()) {\n    if (!fs.existsSync(file)) continue;\n    const apps = parseWorkspaceAppsManifest(readJson(file));\n    if (apps) return apps;\n  }\n  return null;\n}\n\nfunction readWorkspaceAppsFromFilesystem(): WorkspaceAppManifestEntry[] | null {\n  const workspaceRoot = findWorkspaceRoot();\n  if (!workspaceRoot) return null;\n  const appsDir = path.join(workspaceRoot, \"apps\");\n  if (!fs.existsSync(appsDir)) return null;\n\n  const apps = fs\n    .readdirSync(appsDir, { withFileTypes: true })\n    .filter((entry) => entry.isDirectory())\n    .map((entry): WorkspaceAppManifestEntry | null => {\n      const appDir = path.join(appsDir, entry.name);\n      const pkg = readJson(path.join(appDir, \"package.json\"));\n      if (!pkg) return null;\n      return {\n        id: entry.name,\n        name: pkg.displayName || titleCase(entry.name),\n        description: pkg.description || \"\",\n        path: `/${entry.name}`,\n        isDispatch: entry.name === \"dispatch\",\n      } satisfies WorkspaceAppManifestEntry;\n    })\n    .filter((app): app is WorkspaceAppManifestEntry => !!app)\n    .sort((a, b) => {\n      if (a.id === \"dispatch\") return -1;\n      if (b.id === \"dispatch\") return 1;\n      return a.name.localeCompare(b.name);\n    });\n\n  return apps.length ? apps : null;\n}\n\nfunction workspaceBaseUrl(): string | null {\n  return (\n    process.env.WORKSPACE_GATEWAY_URL ||\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL ||\n    null\n  );\n}\n\nfunction workspaceAppUrl(app: WorkspaceAppManifestEntry): string | null {\n  if (app.url) return app.url;\n  const base = workspaceBaseUrl();\n  if (!base) return null;\n  try {\n    return new URL(app.path, `${base.replace(/\\/$/, \"\")}/`).toString();\n  } catch {\n    return null;\n  }\n}\n\nfunction discoverWorkspaceAgents(selfAppId?: string): DiscoveredAgent[] {\n  const workspaceApps = loadWorkspaceAppsManifest();\n  if (!workspaceApps) return [];\n\n  return workspaceApps\n    .filter((app) => app.id !== selfAppId)\n    .map((app) => {\n      const url = workspaceAppUrl(app);\n      if (!url) return null;\n      const builtin = BUILTIN_AGENTS.find((agent) => agent.id === app.id);\n      return {\n        id: app.id,\n        name: app.name,\n        description:\n          app.description ||\n          builtin?.description ||\n          `Workspace app mounted at ${app.path}`,\n        url,\n        color: builtin?.color || \"#6B7280\",\n      } satisfies DiscoveredAgent;\n    })\n    .filter((agent): agent is DiscoveredAgent => !!agent);\n}\n\n/**\n * Like `getBuiltinAgents`, but always returns the production URL — never the\n * env-resolved devUrl. Used by the resource seeder so that a one-time seed\n * (`ON CONFLICT DO NOTHING`) can't permanently bake a localhost URL into the\n * DB, which would override the built-in's prod URL for every later\n * production deploy.\n */\nexport const BUILTIN_AGENTS_FOR_SEEDING: DiscoveredAgent[] =\n  BUILTIN_AGENTS.filter((app) => app.url).map((app) => ({\n    id: app.id,\n    name: app.name,\n    description: app.description,\n    url: app.url, // ALWAYS prod\n    color: app.color,\n  }));\n"]}
+{"version":3,"file":"agent-discovery.js","sourceRoot":"","sources":["../../src/server/agent-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,6BAA6B,EAC7B,mCAAmC,EACnC,sCAAsC,GAEvC,MAAM,qCAAqC,CAAC;AAiC7C;;;;GAIG;AACH,MAAM,cAAc,GAAiB,SAAS,CAAC,MAAM,CACnD,CAAC,QAAQ,EAAE,EAAE,CACX,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CACpE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACnB,EAAE,EAAE,QAAQ,CAAC,IAAI;IACjB,IAAI,EAAE,QAAQ,CAAC,KAAK;IACpB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI;IAClD,GAAG,EAAE,QAAQ,CAAC,OAAQ;IACtB,MAAM,EAAE,oBAAoB,QAAQ,CAAC,OAAO,EAAE;IAC9C,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;CACtB,CAAC,CAAC,CAAC;AAEJ,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAC1C,SAAS,CAAC,MAAM,CACd,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,OAAO,CAC5E,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnC,CAAC;AAEF,MAAM,sBAAsB,GAAG,kCAAkC,CAAC;AAClE,MAAM,4BAA4B,GAAG,qBAAqB,CAAC;AAC3D,MAAM,CAAC,MAAM,mCAAmC,GAAG,wBAAwB,CAAC;AAc5E,MAAM,UAAU,+BAA+B,CAAC,KAG/C;IACC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,IAAI,eAAe,EAAE,IAAI,IAAI,CAAC;IACxD,IAAI,KAAK;QAAE,OAAO,GAAG,mCAAmC,QAAQ,KAAK,EAAE,CAAC;IAExE,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,IAAI,mBAAmB,EAAE,IAAI,IAAI,CAAC;IACpE,IAAI,SAAS;QACX,OAAO,GAAG,mCAAmC,SAAS,SAAS,EAAE,CAAC;IAEpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,GAAY;IAEZ,MAAM,MAAM,GACV,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnD,CAAC,CAAE,GAA+B;QAClC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GACX,MAAM,CAAC,IAAI;QACX,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACzB,CAAC,CAAE,MAAM,CAAC,IAAgC;QAC1C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,IAAI,GAAiD,EAAE,CAAC;IAE9D,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAChE,MAAM,IAAI,GAAG,KAAgC,CAAC;QAC9C,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEpD,IAAI,IAAI;YAAE,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC;QAC/B,IAAI,WAAW;YAAE,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;QACpD,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;YAAE,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC;QACvD,IAAI,YAAY;YAAE,QAAQ,CAAC,YAAY,GAAG,YAAY,CAAC;QACvD,IAAI,SAAS;YAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9C,IAAI,SAAS;YAAE,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAE9C,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC;IACpD,MAAM,GAAG,GAAG,+BAA+B,EAAE,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC5D,OAAO,iCAAiC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAOvD;IACC,MAAM,GAAG,GAAG,+BAA+B,EAAE,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAEnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAEjD,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,iCAAiC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAiC;QACzC,GAAG,QAAQ;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IAEF,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAErD,IAAI,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC;IACtB,IAAI,WAAW;QAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;;QAC3C,OAAO,IAAI,CAAC,WAAW,CAAC;IAC7B,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;QAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;SAC/C,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1D,IAAI,YAAY;QAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnD,IAAI,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAE1C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAC3B,MAAM,UAAU,CAAC,GAAG,EAAE,OAA6C,CAAC,CAAC;IACrE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAM/C,GAAM,EAAE,QAAsC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC;IAE1B,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,KAAK,IAAI,CAAC;IAC9C,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC;IAC7C,MAAM,sBAAsB,GAC1B,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,eAAe,IAAI,CAAC,sBAAsB;QAAE,OAAO,GAAG,CAAC;IAE5D,OAAO;QACL,GAAG,GAAG;QACN,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB;IAGvC,OAAO,CACL,wBAAwB,EAAE;QAC1B,iCAAiC,EAAE;QACnC,+BAA+B,EAAE,CAClC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,QAAgC,EAChC,SAAkB;IAElB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,MAAM,YAAY,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,mBAAmB,GAAG,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,mBAAmB,IAAI,YAAY,KAAK,mBAAmB,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,4BAA4B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAkB;IACjD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CACxE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACR,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;KACjB,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAkB;IAElB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEtD,uBAAuB;IACvB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,GAC/C,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAExC,MAAM,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,GAChE,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAE3C,MAAM,SAAS,GAAwC,EAAE,CAAC;QAC1D,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,8BAA8B,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACnE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,SAAS;YACxC,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACrC,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChE,IAAI,CAAC,QAAQ,IAAI,CAAC,gCAAgC,CAAC,QAAQ,EAAE,SAAS,CAAC;oBACrE,SAAS;gBAEX,qEAAqE;gBACrE,qEAAqE;gBACrE,gEAAgE;gBAChE,qEAAqE;gBACrE,kEAAkE;gBAClE,sEAAsE;gBACtE,2DAA2D;gBAC3D,IAAI,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;gBACvB,MAAM,YAAY,GAChB,OAAO,OAAO,KAAK,WAAW;oBAC9B,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC;gBACzC,IACE,YAAY;oBACZ,OAAO,GAAG,KAAK,QAAQ;oBACvB,yDAAyD,CAAC,IAAI,CAAC,GAAG,CAAC,EACnE,CAAC;oBACD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC5C,IAAI,OAAO,EAAE,GAAG;wBAAE,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;gBACtC,CAAC;gBAED,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC1B,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;oBACvC,GAAG;oBACH,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,SAAS;iBACnC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,KAAK,MAAM,KAAK,IAAI,MAAM,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,SAAkB;IAElB,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,CACL,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CACzE,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAe;IACtC,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,MAAM,IAAI,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE;IACjD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC7D,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC3D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CACjC,MAAW;IAEX,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACrB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,IAAI,GAAG,OAAO;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,OAAO;YACL,EAAE;YACF,IAAI,EACF,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;gBACjD,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;gBACnB,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YACnB,WAAW,EACT,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;YAChE,IAAI,EAAE,SAAS;YACf,GAAG,EACD,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC/C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;gBAClB,CAAC,CAAC,IAAI;YACV,UAAU,EACR,OAAO,KAAK,CAAC,UAAU,KAAK,SAAS;gBACnC,CAAC,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,EAAE,KAAK,UAAU;YACvB,QAAQ,EACN,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAC1B,CAAC,CAAC,8BAA8B;gBAChC,CAAC,CAAC,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC;YACnD,WAAW,EAAE,6BAA6B,CAAC,KAAK,CAAC,WAAW,CAAC;YAC7D,cAAc,EAAE,6BAA6B,CAAC,KAAK,CAAC,cAAc,CAAC;SAChC,CAAC;IACxC,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAoC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SACxD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,+BAA+B;IACtC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC,EACvE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,4BAA4B,CAAC,CACvD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,UAAU,CAAC,IAAI,CACb,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,4BAA4B,CAAC,EACnE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CACnD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,iDAAiD;IACnD,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iCAAiC;IAGxC,KAAK,MAAM,IAAI,IAAI,+BAA+B,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,+BAA+B;IACtC,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;IAC1C,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,MAAM,IAAI,GAAG,EAAE;SACZ,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;SACtC,GAAG,CAAC,CAAC,KAAK,EAAoC,EAAE;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,WAAW,GAAG,sCAAsC,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;YAC9C,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YAClC,IAAI,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE;YACtB,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,UAAU;YACrC,QAAQ,EACN,mCAAmC,CAAC,GAAG,CAAC;gBACxC,8BAA8B;YAChC,WAAW,EAAE,WAAW,CAAC,WAAW,IAAI,EAAE;YAC1C,cAAc,EAAE,WAAW,CAAC,cAAc,IAAI,EAAE;SACb,CAAC;IACxC,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAAoC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SACxD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC,CAAC;QACnC,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,IAAI,CACL,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAA8B;IACrD,IAAI,GAAG,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC;IAC5B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,SAAkB;IAElB,MAAM,aAAa,GAAG,yBAAyB,EAAE,CAAC;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,gBAAgB,GAAG,MAAM,gCAAgC,EAAE,CAAC;IAElE,OAAO,aAAa;SACjB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC;SACrC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,MAAM,YAAY,GAAG,iCAAiC,CACpD,GAAG,EACH,gBAAgB,CACjB,CAAC;QACF,MAAM,GAAG,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,YAAY,CAAC,EAAE,CACxC,CAAC;QACF,OAAO;YACL,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,IAAI,EAAE,YAAY,CAAC,IAAI;YACvB,WAAW,EACT,YAAY,CAAC,WAAW;gBACxB,OAAO,EAAE,WAAW;gBACpB,4BAA4B,YAAY,CAAC,IAAI,EAAE;YACjD,GAAG;YACH,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,SAAS;SACT,CAAC;IAC9B,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAA4B,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GACrC,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpD,EAAE,EAAE,GAAG,CAAC,EAAE;IACV,IAAI,EAAE,GAAG,CAAC,IAAI;IACd,WAAW,EAAE,GAAG,CAAC,WAAW;IAC5B,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,cAAc;IAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;CACjB,CAAC,CAAC,CAAC","sourcesContent":["import fs from \"node:fs\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { TEMPLATES } from \"../cli/templates-meta.js\";\nimport { getRequestOrgId, getRequestUserEmail } from \"./request-context.js\";\nimport {\n  DEFAULT_WORKSPACE_APP_AUDIENCE,\n  normalizeWorkspaceAppAudience,\n  normalizeWorkspaceAppPathList,\n  workspaceAppAudienceFromPackageJson,\n  workspaceAppRouteAccessFromPackageJson,\n  type WorkspaceAppAudience,\n} from \"../shared/workspace-app-audience.js\";\n\nexport interface DiscoveredAgent {\n  id: string;\n  name: string;\n  description: string;\n  url: string;\n  color: string;\n}\n\nexport interface WorkspaceAppMetadataOverride {\n  name?: string;\n  description?: string;\n  generated?: boolean;\n  sourcePrompt?: string;\n  updatedAt?: string;\n  updatedBy?: string;\n}\n\nexport interface WorkspaceAppMetadataSettings {\n  apps: Record<string, WorkspaceAppMetadataOverride>;\n}\n\ninterface AgentEntry {\n  id: string;\n  name: string;\n  description: string;\n  url: string;\n  devUrl?: string;\n  devPort: number;\n  color: string;\n}\n\n/**\n * Built-in agent registry. Derive this from the published CLI metadata so\n * connected-agent discovery stays aligned with first-party template metadata\n * without depending on @agent-native/shared-app-config at runtime.\n */\nconst BUILTIN_AGENTS: AgentEntry[] = TEMPLATES.filter(\n  (template) =>\n    (!template.hidden || template.defaultAgent) && !!template.prodUrl,\n).map((template) => ({\n  id: template.name,\n  name: template.label,\n  description: template.description ?? template.hint,\n  url: template.prodUrl!,\n  devUrl: `http://localhost:${template.devPort}`,\n  devPort: template.devPort,\n  color: template.color,\n}));\n\nconst HIDDEN_FIRST_PARTY_AGENT_IDS = new Set(\n  TEMPLATES.filter(\n    (template) => template.hidden && !template.defaultAgent && template.prodUrl,\n  ).map((template) => template.name),\n);\n\nconst WORKSPACE_APPS_ENV_KEY = \"AGENT_NATIVE_WORKSPACE_APPS_JSON\";\nconst WORKSPACE_APPS_MANIFEST_FILE = \"workspace-apps.json\";\nexport const WORKSPACE_APP_METADATA_SETTINGS_KEY = \"workspace-app-metadata\";\n\nexport interface WorkspaceAppManifestEntry {\n  id: string;\n  name: string;\n  description: string;\n  path: string;\n  url?: string | null;\n  isDispatch?: boolean;\n  audience?: WorkspaceAppAudience;\n  publicPaths?: string[];\n  protectedPaths?: string[];\n}\n\nexport function workspaceAppMetadataSettingsKey(input?: {\n  orgId?: string | null;\n  userEmail?: string | null;\n}): string | null {\n  const orgId = input?.orgId ?? getRequestOrgId() ?? null;\n  if (orgId) return `${WORKSPACE_APP_METADATA_SETTINGS_KEY}:org:${orgId}`;\n\n  const userEmail = input?.userEmail ?? getRequestUserEmail() ?? null;\n  if (userEmail)\n    return `${WORKSPACE_APP_METADATA_SETTINGS_KEY}:user:${userEmail}`;\n\n  return null;\n}\n\nfunction cleanOptionalText(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nexport function parseWorkspaceAppMetadataSettings(\n  raw: unknown,\n): WorkspaceAppMetadataSettings {\n  const record =\n    raw && typeof raw === \"object\" && !Array.isArray(raw)\n      ? (raw as Record<string, unknown>)\n      : {};\n  const rawApps =\n    record.apps &&\n    typeof record.apps === \"object\" &&\n    !Array.isArray(record.apps)\n      ? (record.apps as Record<string, unknown>)\n      : {};\n  const apps: Record<string, WorkspaceAppMetadataOverride> = {};\n\n  for (const [id, value] of Object.entries(rawApps)) {\n    if (!id.trim() || !value || typeof value !== \"object\") continue;\n    const item = value as Record<string, unknown>;\n    const override: WorkspaceAppMetadataOverride = {};\n    const name = cleanOptionalText(item.name);\n    const description = cleanOptionalText(item.description);\n    const sourcePrompt = cleanOptionalText(item.sourcePrompt);\n    const updatedAt = cleanOptionalText(item.updatedAt);\n    const updatedBy = cleanOptionalText(item.updatedBy);\n\n    if (name) override.name = name;\n    if (description) override.description = description;\n    if (item.generated === true) override.generated = true;\n    if (sourcePrompt) override.sourcePrompt = sourcePrompt;\n    if (updatedAt) override.updatedAt = updatedAt;\n    if (updatedBy) override.updatedBy = updatedBy;\n\n    if (Object.keys(override).length > 0) apps[id.trim()] = override;\n  }\n\n  return { apps };\n}\n\nexport async function readWorkspaceAppMetadataSettings(): Promise<WorkspaceAppMetadataSettings> {\n  const key = workspaceAppMetadataSettingsKey();\n  if (!key) return { apps: {} };\n\n  try {\n    const { getSetting } = await import(\"../settings/index.js\");\n    return parseWorkspaceAppMetadataSettings(await getSetting(key));\n  } catch {\n    return { apps: {} };\n  }\n}\n\nexport async function writeWorkspaceAppMetadataOverride(input: {\n  appId: string;\n  name?: string | null;\n  description?: string | null;\n  generated?: boolean;\n  sourcePrompt?: string | null;\n  updatedBy?: string | null;\n}): Promise<WorkspaceAppMetadataSettings> {\n  const key = workspaceAppMetadataSettingsKey();\n  if (!key) throw new Error(\"no authenticated user\");\n\n  const appId = input.appId.trim();\n  if (!appId) throw new Error(\"appId is required\");\n\n  const { getSetting, putSetting } = await import(\"../settings/index.js\");\n  const current = parseWorkspaceAppMetadataSettings(await getSetting(key));\n  const existing = current.apps[appId] ?? {};\n  const next: WorkspaceAppMetadataOverride = {\n    ...existing,\n    updatedAt: new Date().toISOString(),\n  };\n\n  const name = cleanOptionalText(input.name);\n  const description = cleanOptionalText(input.description);\n  const sourcePrompt = cleanOptionalText(input.sourcePrompt);\n  const updatedBy = cleanOptionalText(input.updatedBy);\n\n  if (name) next.name = name;\n  else delete next.name;\n  if (description) next.description = description;\n  else delete next.description;\n  if (input.generated === true) next.generated = true;\n  else if (input.generated === false) delete next.generated;\n  if (sourcePrompt) next.sourcePrompt = sourcePrompt;\n  if (updatedBy) next.updatedBy = updatedBy;\n\n  current.apps[appId] = next;\n  await putSetting(key, current as unknown as Record<string, unknown>);\n  return current;\n}\n\nexport function applyWorkspaceAppMetadataOverride<\n  T extends {\n    id: string;\n    name: string;\n    description?: string | null;\n  },\n>(app: T, settings: WorkspaceAppMetadataSettings): T {\n  const override = settings.apps[app.id];\n  if (!override) return app;\n\n  const name = cleanOptionalText(override.name);\n  const description = cleanOptionalText(override.description);\n  const generated = override.generated === true;\n  const shouldApplyName = !!name && !generated;\n  const shouldApplyDescription =\n    !!description && (!generated || !cleanOptionalText(app.description));\n  if (!shouldApplyName && !shouldApplyDescription) return app;\n\n  return {\n    ...app,\n    ...(shouldApplyName ? { name } : {}),\n    ...(shouldApplyDescription ? { description } : {}),\n  };\n}\n\n/**\n * Resolve the workspace app manifest from the same fallback chain that\n * `discoverWorkspaceAgents` uses: `AGENT_NATIVE_WORKSPACE_APPS_JSON` env →\n * `.agent-native/workspace-apps.json` (or sibling) on disk → live filesystem\n * scan of `apps/<id>/package.json` under the workspace root.\n *\n * Callers (e.g. the dispatch `/dispatch/<appId>` catch-all loader) need this\n * to behave the same in production deploys (which write the manifest file)\n * and during local dev (where new apps appear under `apps/` without an env\n * restart). Reading only the env var would silently downgrade the behavior\n * in both cases.\n */\nexport function loadWorkspaceAppsManifest():\n  | WorkspaceAppManifestEntry[]\n  | null {\n  return (\n    readWorkspaceAppsFromEnv() ??\n    readWorkspaceAppsFromManifestFile() ??\n    readWorkspaceAppsFromFilesystem()\n  );\n}\n\nexport function shouldIncludeRemoteAgentManifest(\n  manifest: { id?: string | null },\n  selfAppId?: string,\n): boolean {\n  const id = manifest.id?.trim();\n  if (!id) return false;\n  const normalizedId = id.toLowerCase();\n  const normalizedSelfAppId = selfAppId?.trim().toLowerCase();\n  if (normalizedSelfAppId && normalizedId === normalizedSelfAppId) {\n    return false;\n  }\n  return !HIDDEN_FIRST_PARTY_AGENT_IDS.has(normalizedId);\n}\n\n/**\n * Get built-in agents (static, no DB). Used as fallback and for seeding.\n */\nexport function getBuiltinAgents(selfAppId?: string): DiscoveredAgent[] {\n  return BUILTIN_AGENTS.filter((app) => app.id !== selfAppId && app.url).map(\n    (app) => ({\n      id: app.id,\n      name: app.name,\n      description: app.description,\n      url: resolveAgentUrl(app),\n      color: app.color,\n    }),\n  );\n}\n\n/**\n * Discover all agents: built-in + custom agents stored as resources.\n * Custom agents override built-in agents with the same ID.\n */\nexport async function discoverAgents(\n  selfAppId?: string,\n): Promise<DiscoveredAgent[]> {\n  const builtins = getBuiltinAgents(selfAppId);\n  const agentsById = new Map<string, DiscoveredAgent>();\n\n  // Start with built-ins\n  for (const agent of builtins) {\n    agentsById.set(agent.id, agent);\n  }\n\n  // Overlay custom agents from resources\n  try {\n    const { resourceList, resourceGet, SHARED_OWNER } =\n      await import(\"../resources/store.js\");\n\n    const { parseRemoteAgentManifest, REMOTE_AGENT_RESOURCE_PREFIXES } =\n      await import(\"../resources/metadata.js\");\n\n    const resources: Array<{ id: string; path: string }> = [];\n    for (const prefix of [...REMOTE_AGENT_RESOURCE_PREFIXES].reverse()) {\n      resources.push(...(await resourceList(SHARED_OWNER, prefix)));\n    }\n\n    for (const r of resources) {\n      if (!r.path.endsWith(\".json\")) continue;\n      try {\n        const full = await resourceGet(r.id);\n        if (!full) continue;\n        const manifest = parseRemoteAgentManifest(full.content, r.path);\n        if (!manifest || !shouldIncludeRemoteAgentManifest(manifest, selfAppId))\n          continue;\n\n        // If the resource override carries a localhost URL but we're running\n        // in production (e.g. a stale dev-time seed got promoted to the prod\n        // DB), fall back to the matching built-in's prod URL instead of\n        // letting the override win — otherwise outbound `call-agent` fetches\n        // from a serverless function would target localhost and fail with\n        // \"fetch failed\" instantly. The override still wins for non-localhost\n        // URLs (the supported case for self-hosted custom agents).\n        let url = manifest.url;\n        const isProduction =\n          typeof process !== \"undefined\" &&\n          process.env?.NODE_ENV === \"production\";\n        if (\n          isProduction &&\n          typeof url === \"string\" &&\n          /^https?:\\/\\/(localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0)(:|\\/|$)/.test(url)\n        ) {\n          const builtin = agentsById.get(manifest.id);\n          if (builtin?.url) url = builtin.url;\n        }\n\n        agentsById.set(manifest.id, {\n          id: manifest.id,\n          name: manifest.name,\n          description: manifest.description || \"\",\n          url,\n          color: manifest.color || \"#6B7280\",\n        });\n      } catch {\n        // Skip unreadable resources\n      }\n    }\n  } catch {\n    // Resources not available — use built-ins only\n  }\n\n  // Overlay sibling workspace apps last so same-origin workspaces prefer the\n  // app mounted in this workspace over the public template with the same id.\n  for (const agent of await discoverWorkspaceAgents(selfAppId)) {\n    agentsById.set(agent.id, agent);\n  }\n\n  return Array.from(agentsById.values());\n}\n\n/**\n * Look up a single agent by ID or name (case-insensitive).\n */\nexport async function findAgent(\n  idOrName: string,\n  selfAppId?: string,\n): Promise<DiscoveredAgent | undefined> {\n  const lower = idOrName.toLowerCase();\n  const agents = await discoverAgents(selfAppId);\n  return agents.find((a) => a.id === lower || a.name.toLowerCase() === lower);\n}\n\nfunction isDevEnvironment(): boolean {\n  return (\n    typeof process !== \"undefined\" && process.env?.NODE_ENV !== \"production\"\n  );\n}\n\nfunction resolveAgentUrl(app: AgentEntry): string {\n  if (isDevEnvironment()) {\n    return app.devUrl || `http://localhost:${app.devPort}`;\n  }\n  return app.url;\n}\n\nfunction readJson(file: string): any {\n  try {\n    return JSON.parse(fs.readFileSync(file, \"utf8\"));\n  } catch {\n    return null;\n  }\n}\n\nfunction findWorkspaceRoot(startDir = process.cwd()): string | null {\n  let dir = path.resolve(startDir);\n  for (let i = 0; i < 20; i++) {\n    const pkg = readJson(path.join(dir, \"package.json\"));\n    if (typeof pkg?.[\"agent-native\"]?.workspaceCore === \"string\") {\n      return dir;\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return null;\n}\n\nfunction titleCase(value: string): string {\n  return value\n    .split(/[-_\\s]+/)\n    .filter(Boolean)\n    .map((part) => part.charAt(0).toUpperCase() + part.slice(1))\n    .join(\" \");\n}\n\nfunction parseWorkspaceAppsManifest(\n  parsed: any,\n): WorkspaceAppManifestEntry[] | null {\n  const rawApps = Array.isArray(parsed?.apps)\n    ? parsed.apps\n    : Array.isArray(parsed)\n      ? parsed\n      : null;\n  if (!rawApps) return null;\n\n  const apps = rawApps\n    .map((entry) => {\n      if (!entry || typeof entry !== \"object\") return null;\n      const id = typeof entry.id === \"string\" ? entry.id.trim() : \"\";\n      const pathValue = typeof entry.path === \"string\" ? entry.path.trim() : \"\";\n      if (!id || !pathValue.startsWith(\"/\")) return null;\n      return {\n        id,\n        name:\n          typeof entry.name === \"string\" && entry.name.trim()\n            ? entry.name.trim()\n            : titleCase(id),\n        description:\n          typeof entry.description === \"string\" ? entry.description : \"\",\n        path: pathValue,\n        url:\n          typeof entry.url === \"string\" && entry.url.trim()\n            ? entry.url.trim()\n            : null,\n        isDispatch:\n          typeof entry.isDispatch === \"boolean\"\n            ? entry.isDispatch\n            : id === \"dispatch\",\n        audience:\n          entry.audience === undefined\n            ? DEFAULT_WORKSPACE_APP_AUDIENCE\n            : normalizeWorkspaceAppAudience(entry.audience),\n        publicPaths: normalizeWorkspaceAppPathList(entry.publicPaths),\n        protectedPaths: normalizeWorkspaceAppPathList(entry.protectedPaths),\n      } satisfies WorkspaceAppManifestEntry;\n    })\n    .filter((app): app is WorkspaceAppManifestEntry => !!app)\n    .sort((a, b) => {\n      if (a.id === \"dispatch\") return -1;\n      if (b.id === \"dispatch\") return 1;\n      return a.name.localeCompare(b.name);\n    });\n\n  return apps.length ? apps : null;\n}\n\nfunction readWorkspaceAppsFromEnv(): WorkspaceAppManifestEntry[] | null {\n  const raw = process.env[WORKSPACE_APPS_ENV_KEY];\n  if (!raw) return null;\n  try {\n    return parseWorkspaceAppsManifest(JSON.parse(raw));\n  } catch {\n    return null;\n  }\n}\n\nfunction workspaceAppsManifestCandidates(): string[] {\n  const candidates: string[] = [];\n  try {\n    candidates.push(\n      path.join(process.cwd(), \".agent-native\", WORKSPACE_APPS_MANIFEST_FILE),\n      path.join(process.cwd(), WORKSPACE_APPS_MANIFEST_FILE),\n    );\n  } catch {\n    // Some edge runtimes do not expose process.cwd().\n  }\n  try {\n    const moduleDir = path.dirname(fileURLToPath(import.meta.url));\n    candidates.push(\n      path.join(moduleDir, \".agent-native\", WORKSPACE_APPS_MANIFEST_FILE),\n      path.join(moduleDir, WORKSPACE_APPS_MANIFEST_FILE),\n    );\n  } catch {\n    // Some edge runtimes expose non-file module URLs. The env manifest still\n    // works there, so skip file-relative candidates.\n  }\n  return candidates;\n}\n\nfunction readWorkspaceAppsFromManifestFile():\n  | WorkspaceAppManifestEntry[]\n  | null {\n  for (const file of workspaceAppsManifestCandidates()) {\n    if (!fs.existsSync(file)) continue;\n    const apps = parseWorkspaceAppsManifest(readJson(file));\n    if (apps) return apps;\n  }\n  return null;\n}\n\nfunction readWorkspaceAppsFromFilesystem(): WorkspaceAppManifestEntry[] | null {\n  const workspaceRoot = findWorkspaceRoot();\n  if (!workspaceRoot) return null;\n  const appsDir = path.join(workspaceRoot, \"apps\");\n  if (!fs.existsSync(appsDir)) return null;\n\n  const apps = fs\n    .readdirSync(appsDir, { withFileTypes: true })\n    .filter((entry) => entry.isDirectory())\n    .map((entry): WorkspaceAppManifestEntry | null => {\n      const appDir = path.join(appsDir, entry.name);\n      const pkg = readJson(path.join(appDir, \"package.json\"));\n      if (!pkg) return null;\n      const routeAccess = workspaceAppRouteAccessFromPackageJson(pkg);\n      return {\n        id: entry.name,\n        name: pkg.displayName || titleCase(entry.name),\n        description: pkg.description || \"\",\n        path: `/${entry.name}`,\n        isDispatch: entry.name === \"dispatch\",\n        audience:\n          workspaceAppAudienceFromPackageJson(pkg) ??\n          DEFAULT_WORKSPACE_APP_AUDIENCE,\n        publicPaths: routeAccess.publicPaths ?? [],\n        protectedPaths: routeAccess.protectedPaths ?? [],\n      } satisfies WorkspaceAppManifestEntry;\n    })\n    .filter((app): app is WorkspaceAppManifestEntry => !!app)\n    .sort((a, b) => {\n      if (a.id === \"dispatch\") return -1;\n      if (b.id === \"dispatch\") return 1;\n      return a.name.localeCompare(b.name);\n    });\n\n  return apps.length ? apps : null;\n}\n\nfunction workspaceBaseUrl(): string | null {\n  return (\n    process.env.WORKSPACE_GATEWAY_URL ||\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL ||\n    null\n  );\n}\n\nfunction workspaceAppUrl(app: WorkspaceAppManifestEntry): string | null {\n  if (app.url) return app.url;\n  const base = workspaceBaseUrl();\n  if (!base) return null;\n  try {\n    return new URL(app.path, `${base.replace(/\\/$/, \"\")}/`).toString();\n  } catch {\n    return null;\n  }\n}\n\nasync function discoverWorkspaceAgents(\n  selfAppId?: string,\n): Promise<DiscoveredAgent[]> {\n  const workspaceApps = loadWorkspaceAppsManifest();\n  if (!workspaceApps) return [];\n\n  const metadataSettings = await readWorkspaceAppMetadataSettings();\n\n  return workspaceApps\n    .filter((app) => app.id !== selfAppId)\n    .map((app) => {\n      const withOverride = applyWorkspaceAppMetadataOverride(\n        app,\n        metadataSettings,\n      );\n      const url = workspaceAppUrl(withOverride);\n      if (!url) return null;\n      const builtin = BUILTIN_AGENTS.find(\n        (agent) => agent.id === withOverride.id,\n      );\n      return {\n        id: withOverride.id,\n        name: withOverride.name,\n        description:\n          withOverride.description ||\n          builtin?.description ||\n          `Workspace app mounted at ${withOverride.path}`,\n        url,\n        color: builtin?.color || \"#6B7280\",\n      } satisfies DiscoveredAgent;\n    })\n    .filter((agent): agent is DiscoveredAgent => !!agent);\n}\n\n/**\n * Like `getBuiltinAgents`, but always returns the production URL — never the\n * env-resolved devUrl. Used by the resource seeder so that a one-time seed\n * (`ON CONFLICT DO NOTHING`) can't permanently bake a localhost URL into the\n * DB, which would override the built-in's prod URL for every later\n * production deploy.\n */\nexport const BUILTIN_AGENTS_FOR_SEEDING: DiscoveredAgent[] =\n  BUILTIN_AGENTS.filter((app) => app.url).map((app) => ({\n    id: app.id,\n    name: app.name,\n    description: app.description,\n    url: app.url, // ALWAYS prod\n    color: app.color,\n  }));\n"]}

package/dist/server/app-url.d.ts

@@ -4,18 +4,24 @@
  * outside the current request context.
  *
  * Resolution order:
- *   1. `APP_URL` env var — explicit override
- *   2. `BETTER_AUTH_URL` env var — Better Auth's canonical URL
- *   3. `WORKSPACE_GATEWAY_URL` — local multi-app workspace gateway
- *   4. First-party template `prodUrl` from the registry (matched by
+ *   1. Explicit public URL env vars (`APP_URL`, workspace OAuth origin,
+ *      `BETTER_AUTH_URL`) — operator overrides
+ *   2. Incoming request's origin (when an H3Event is available)
+ *   3. First-party template `prodUrl` from the registry (matched by
  *      package.json name) — lets deployed first-party apps (mail,
  *      calendar, analytics, …) use e.g. `analytics.agent-native.com`
  *      instead of their Netlify preview hostname.
- *   5. Incoming request's origin (when an H3Event is available)
- *   6. Platform-injected URL (Netlify `URL`, Vercel `VERCEL_URL`) —
+ *   4. Platform-injected URL (Netlify `URL`, Vercel `VERCEL_URL`) —
  *      automatically set by the hosting platform, so user-deployed apps
  *      get a real hostname in emails without needing to set `APP_URL`.
+ *   5. Public `WORKSPACE_GATEWAY_URL` — multi-app workspace gateway
+ *   6. Local `WORKSPACE_GATEWAY_URL` — local multi-app workspace gateway
  *   7. `http://localhost:3000`
+ *
+ * Older versions preferred `WORKSPACE_GATEWAY_URL` before platform URLs.
+ * That is fine for local development, but in hosted Builder Desktop sessions
+ * the gateway can be `127.0.0.1`, which must not become Better Auth's
+ * production base URL.
  */
 import { type H3Event } from "h3";
 /**

package/dist/server/app-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-url.d.ts","sourceRoot":"","sources":["../../src/server/app-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,IAAI,CAAC;AAkCjD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAKzD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CA4C3D"}
+{"version":3,"file":"app-url.d.ts","sourceRoot":"","sources":["../../src/server/app-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,IAAI,CAAC;AAkEjD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAKzD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAsD3D"}

package/dist/server/app-url.js

@@ -4,18 +4,24 @@
  * outside the current request context.
  *
  * Resolution order:
- *   1. `APP_URL` env var — explicit override
- *   2. `BETTER_AUTH_URL` env var — Better Auth's canonical URL
- *   3. `WORKSPACE_GATEWAY_URL` — local multi-app workspace gateway
- *   4. First-party template `prodUrl` from the registry (matched by
+ *   1. Explicit public URL env vars (`APP_URL`, workspace OAuth origin,
+ *      `BETTER_AUTH_URL`) — operator overrides
+ *   2. Incoming request's origin (when an H3Event is available)
+ *   3. First-party template `prodUrl` from the registry (matched by
  *      package.json name) — lets deployed first-party apps (mail,
  *      calendar, analytics, …) use e.g. `analytics.agent-native.com`
  *      instead of their Netlify preview hostname.
- *   5. Incoming request's origin (when an H3Event is available)
- *   6. Platform-injected URL (Netlify `URL`, Vercel `VERCEL_URL`) —
+ *   4. Platform-injected URL (Netlify `URL`, Vercel `VERCEL_URL`) —
  *      automatically set by the hosting platform, so user-deployed apps
  *      get a real hostname in emails without needing to set `APP_URL`.
+ *   5. Public `WORKSPACE_GATEWAY_URL` — multi-app workspace gateway
+ *   6. Local `WORKSPACE_GATEWAY_URL` — local multi-app workspace gateway
  *   7. `http://localhost:3000`
+ *
+ * Older versions preferred `WORKSPACE_GATEWAY_URL` before platform URLs.
+ * That is fine for local development, but in hosted Builder Desktop sessions
+ * the gateway can be `127.0.0.1`, which must not become Better Auth's
+ * production base URL.
  */
 import { getRequestURL } from "h3";
 import path from "node:path";
@@ -49,6 +55,36 @@ function readPackageName() {
 function stripTrailingSlash(u) {
     return u.replace(/\/+$/, "");
 }
+function firstConfiguredUrl(keys) {
+    for (const key of keys) {
+        const value = process.env[key];
+        if (value)
+            return stripTrailingSlash(value);
+    }
+    return undefined;
+}
+function isLoopbackUrl(value) {
+    if (!value)
+        return false;
+    try {
+        const hostname = new URL(value).hostname.toLowerCase();
+        return (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1");
+    }
+    catch {
+        return false;
+    }
+}
+function workspaceGatewayUrl(options) {
+    const url = firstConfiguredUrl([
+        "WORKSPACE_GATEWAY_URL",
+        "VITE_WORKSPACE_GATEWAY_URL",
+    ]);
+    if (!url)
+        return undefined;
+    if (!options.allowLoopback && isLoopbackUrl(url))
+        return undefined;
+    return url;
+}
 /**
  * Look up the first-party template `prodUrl` for the current app based on
  * its `package.json` name. Returns undefined if the app isn't a known
@@ -62,12 +98,15 @@ export function getFirstPartyProdUrl() {
     return t?.prodUrl;
 }
 export function getAppProductionUrl(event) {
-    const envUrl = process.env.APP_URL || process.env.BETTER_AUTH_URL;
+    const envUrl = firstConfiguredUrl([
+        "APP_URL",
+        "WORKSPACE_OAUTH_ORIGIN",
+        "VITE_WORKSPACE_OAUTH_ORIGIN",
+        "BETTER_AUTH_URL",
+        "VITE_BETTER_AUTH_URL",
+    ]);
     if (envUrl)
-        return stripTrailingSlash(envUrl);
-    if (process.env.WORKSPACE_GATEWAY_URL) {
-        return stripTrailingSlash(process.env.WORKSPACE_GATEWAY_URL);
-    }
+        return envUrl;
     // Prefer the incoming request's origin when we have one — for local dev
     // this is `http://localhost:3000`, which keeps Better Auth from setting
     // `Secure` cookies on plain-HTTP dev servers.
@@ -101,7 +140,15 @@ export function getAppProductionUrl(event) {
         const vercelUrl = process.env.VERCEL_PROJECT_PRODUCTION_URL || process.env.VERCEL_URL;
         if (vercelUrl)
             return `https://${stripTrailingSlash(vercelUrl)}`;
+        const publicWorkspaceGateway = workspaceGatewayUrl({
+            allowLoopback: false,
+        });
+        if (publicWorkspaceGateway)
+            return publicWorkspaceGateway;
     }
+    const localWorkspaceGateway = workspaceGatewayUrl({ allowLoopback: true });
+    if (localWorkspaceGateway)
+        return localWorkspaceGateway;
     return "http://localhost:3000";
 }
 //# sourceMappingURL=app-url.js.map

package/dist/server/app-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-url.js","sourceRoot":"","sources":["../../src/server/app-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,aAAa,EAAgB,MAAM,IAAI,CAAC;AACjD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,IAAI,aAAa,GAA8B,IAAI,CAAC;AAEpD;;;;;;GAMG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,aAAa,IAAI,SAAS,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC/D,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,OAAO,aAAa,IAAI,SAAS,CAAC;AACpC,CAAC;AAED,+DAA+D;AAC/D,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,OAAO,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAe;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAClE,IAAI,MAAM;QAAE,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAE9C,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/D,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,8CAA8C;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;QAC1C,IAAI,UAAU;YAAE,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEtD,uEAAuE;QACvE,mEAAmE;QACnE,mDAAmD;QACnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7D,IAAI,UAAU;YAAE,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEtD,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACtE,IAAI,SAAS;YAAE,OAAO,WAAW,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,OAAO,uBAAuB,CAAC;AACjC,CAAC","sourcesContent":["/**\n * Resolve the canonical URL of this app — used in transactional emails,\n * invite links, and anywhere we need an absolute URL that remains valid\n * outside the current request context.\n *\n * Resolution order:\n *   1. `APP_URL` env var — explicit override\n *   2. `BETTER_AUTH_URL` env var — Better Auth's canonical URL\n *   3. `WORKSPACE_GATEWAY_URL` — local multi-app workspace gateway\n *   4. First-party template `prodUrl` from the registry (matched by\n *      package.json name) — lets deployed first-party apps (mail,\n *      calendar, analytics, …) use e.g. `analytics.agent-native.com`\n *      instead of their Netlify preview hostname.\n *   5. Incoming request's origin (when an H3Event is available)\n *   6. Platform-injected URL (Netlify `URL`, Vercel `VERCEL_URL`) —\n *      automatically set by the hosting platform, so user-deployed apps\n *      get a real hostname in emails without needing to set `APP_URL`.\n *   7. `http://localhost:3000`\n */\nimport { getRequestURL, type H3Event } from \"h3\";\nimport path from \"node:path\";\nimport fs from \"node:fs\";\nimport { TEMPLATES } from \"../cli/templates-meta.js\";\nimport { isLocalDatabase } from \"../db/client.js\";\n\nlet cachedPkgName: string | undefined | null = null;\n\n/**\n * Read the app's package name, validated against the first-party template\n * registry. On serverless runtimes (Netlify Functions, Cloudflare Workers),\n * `process.cwd()` may point at a bundler-generated package.json with a\n * bogus name (e.g. Nitro's \"traced-node-modules\"). Only trust the name if\n * it matches a known template.\n */\nfunction readPackageName(): string | undefined {\n  if (cachedPkgName !== null) return cachedPkgName ?? undefined;\n  try {\n    const pkgPath = path.join(process.cwd(), \"package.json\");\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf8\"));\n    const name = typeof pkg?.name === \"string\" ? pkg.name : undefined;\n    const isKnown = name && TEMPLATES.some((t) => t.name === name);\n    cachedPkgName = isKnown ? name : undefined;\n  } catch {\n    cachedPkgName = undefined;\n  }\n  return cachedPkgName ?? undefined;\n}\n\n/** Strip trailing slashes for consistent URL concatenation. */\nfunction stripTrailingSlash(u: string): string {\n  return u.replace(/\\/+$/, \"\");\n}\n\n/**\n * Look up the first-party template `prodUrl` for the current app based on\n * its `package.json` name. Returns undefined if the app isn't a known\n * first-party template or the template has no `prodUrl`.\n */\nexport function getFirstPartyProdUrl(): string | undefined {\n  const name = readPackageName();\n  if (!name) return undefined;\n  const t = TEMPLATES.find((t) => t.name === name);\n  return t?.prodUrl;\n}\n\nexport function getAppProductionUrl(event?: H3Event): string {\n  const envUrl = process.env.APP_URL || process.env.BETTER_AUTH_URL;\n  if (envUrl) return stripTrailingSlash(envUrl);\n\n  if (process.env.WORKSPACE_GATEWAY_URL) {\n    return stripTrailingSlash(process.env.WORKSPACE_GATEWAY_URL);\n  }\n\n  // Prefer the incoming request's origin when we have one — for local dev\n  // this is `http://localhost:3000`, which keeps Better Auth from setting\n  // `Secure` cookies on plain-HTTP dev servers.\n  if (event) {\n    try {\n      const url = getRequestURL(event);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      // fall through\n    }\n  }\n\n  // Fall back to a first-party template's hard-coded prod URL when we're\n  // running in production OR on a remote database (Neon/Postgres/Turso).\n  // A remote DB means we're deployed even if NODE_ENV isn't explicitly\n  // \"production\" (e.g. Netlify Functions). In local dev with SQLite, skip\n  // this — the hard-coded URL breaks auth via Secure cookies on HTTP.\n  if (process.env.NODE_ENV === \"production\" || !isLocalDatabase()) {\n    const firstParty = getFirstPartyProdUrl();\n    if (firstParty) return stripTrailingSlash(firstParty);\n\n    // Netlify injects `URL` (main site URL, always https) and `DEPLOY_URL`\n    // (deploy-specific URL). Prefer `URL` so emails always link to the\n    // primary domain rather than a preview branch URL.\n    const netlifyUrl = process.env.URL || process.env.DEPLOY_URL;\n    if (netlifyUrl) return stripTrailingSlash(netlifyUrl);\n\n    // Vercel injects `VERCEL_PROJECT_PRODUCTION_URL` (custom/primary domain,\n    // no protocol) and `VERCEL_URL` (ephemeral deployment hostname). Prefer\n    // the production URL so emails use the real domain, not *.vercel.app.\n    const vercelUrl =\n      process.env.VERCEL_PROJECT_PRODUCTION_URL || process.env.VERCEL_URL;\n    if (vercelUrl) return `https://${stripTrailingSlash(vercelUrl)}`;\n  }\n\n  return \"http://localhost:3000\";\n}\n"]}
+{"version":3,"file":"app-url.js","sourceRoot":"","sources":["../../src/server/app-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,aAAa,EAAgB,MAAM,IAAI,CAAC;AACjD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,IAAI,aAAa,GAA8B,IAAI,CAAC;AAEpD;;;;;;GAMG;AACH,SAAS,eAAe;IACtB,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,aAAa,IAAI,SAAS,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,MAAM,OAAO,GAAG,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC/D,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,SAAS,CAAC;IAC5B,CAAC;IACD,OAAO,aAAa,IAAI,SAAS,CAAC;AACpC,CAAC;AAED,+DAA+D;AAC/D,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAuB;IACjD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK;YAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,CACL,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,OAE5B;IACC,MAAM,GAAG,GAAG,kBAAkB,CAAC;QAC7B,uBAAuB;QACvB,4BAA4B;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,aAAa,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,OAAO,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAe;IACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAChC,SAAS;QACT,wBAAwB;QACxB,6BAA6B;QAC7B,iBAAiB;QACjB,sBAAsB;KACvB,CAAC,CAAC;IACH,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,wEAAwE;IACxE,wEAAwE;IACxE,8CAA8C;IAC9C,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACjC,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAChE,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;QAC1C,IAAI,UAAU;YAAE,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEtD,uEAAuE;QACvE,mEAAmE;QACnE,mDAAmD;QACnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7D,IAAI,UAAU;YAAE,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAEtD,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QACtE,IAAI,SAAS;YAAE,OAAO,WAAW,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QAEjE,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;YACjD,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,IAAI,sBAAsB;YAAE,OAAO,sBAAsB,CAAC;IAC5D,CAAC;IAED,MAAM,qBAAqB,GAAG,mBAAmB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IAExD,OAAO,uBAAuB,CAAC;AACjC,CAAC","sourcesContent":["/**\n * Resolve the canonical URL of this app — used in transactional emails,\n * invite links, and anywhere we need an absolute URL that remains valid\n * outside the current request context.\n *\n * Resolution order:\n *   1. Explicit public URL env vars (`APP_URL`, workspace OAuth origin,\n *      `BETTER_AUTH_URL`) — operator overrides\n *   2. Incoming request's origin (when an H3Event is available)\n *   3. First-party template `prodUrl` from the registry (matched by\n *      package.json name) — lets deployed first-party apps (mail,\n *      calendar, analytics, …) use e.g. `analytics.agent-native.com`\n *      instead of their Netlify preview hostname.\n *   4. Platform-injected URL (Netlify `URL`, Vercel `VERCEL_URL`) —\n *      automatically set by the hosting platform, so user-deployed apps\n *      get a real hostname in emails without needing to set `APP_URL`.\n *   5. Public `WORKSPACE_GATEWAY_URL` — multi-app workspace gateway\n *   6. Local `WORKSPACE_GATEWAY_URL` — local multi-app workspace gateway\n *   7. `http://localhost:3000`\n *\n * Older versions preferred `WORKSPACE_GATEWAY_URL` before platform URLs.\n * That is fine for local development, but in hosted Builder Desktop sessions\n * the gateway can be `127.0.0.1`, which must not become Better Auth's\n * production base URL.\n */\nimport { getRequestURL, type H3Event } from \"h3\";\nimport path from \"node:path\";\nimport fs from \"node:fs\";\nimport { TEMPLATES } from \"../cli/templates-meta.js\";\nimport { isLocalDatabase } from \"../db/client.js\";\n\nlet cachedPkgName: string | undefined | null = null;\n\n/**\n * Read the app's package name, validated against the first-party template\n * registry. On serverless runtimes (Netlify Functions, Cloudflare Workers),\n * `process.cwd()` may point at a bundler-generated package.json with a\n * bogus name (e.g. Nitro's \"traced-node-modules\"). Only trust the name if\n * it matches a known template.\n */\nfunction readPackageName(): string | undefined {\n  if (cachedPkgName !== null) return cachedPkgName ?? undefined;\n  try {\n    const pkgPath = path.join(process.cwd(), \"package.json\");\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf8\"));\n    const name = typeof pkg?.name === \"string\" ? pkg.name : undefined;\n    const isKnown = name && TEMPLATES.some((t) => t.name === name);\n    cachedPkgName = isKnown ? name : undefined;\n  } catch {\n    cachedPkgName = undefined;\n  }\n  return cachedPkgName ?? undefined;\n}\n\n/** Strip trailing slashes for consistent URL concatenation. */\nfunction stripTrailingSlash(u: string): string {\n  return u.replace(/\\/+$/, \"\");\n}\n\nfunction firstConfiguredUrl(keys: readonly string[]): string | undefined {\n  for (const key of keys) {\n    const value = process.env[key];\n    if (value) return stripTrailingSlash(value);\n  }\n  return undefined;\n}\n\nfunction isLoopbackUrl(value: string | undefined): boolean {\n  if (!value) return false;\n  try {\n    const hostname = new URL(value).hostname.toLowerCase();\n    return (\n      hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction workspaceGatewayUrl(options: {\n  allowLoopback: boolean;\n}): string | undefined {\n  const url = firstConfiguredUrl([\n    \"WORKSPACE_GATEWAY_URL\",\n    \"VITE_WORKSPACE_GATEWAY_URL\",\n  ]);\n  if (!url) return undefined;\n  if (!options.allowLoopback && isLoopbackUrl(url)) return undefined;\n  return url;\n}\n\n/**\n * Look up the first-party template `prodUrl` for the current app based on\n * its `package.json` name. Returns undefined if the app isn't a known\n * first-party template or the template has no `prodUrl`.\n */\nexport function getFirstPartyProdUrl(): string | undefined {\n  const name = readPackageName();\n  if (!name) return undefined;\n  const t = TEMPLATES.find((t) => t.name === name);\n  return t?.prodUrl;\n}\n\nexport function getAppProductionUrl(event?: H3Event): string {\n  const envUrl = firstConfiguredUrl([\n    \"APP_URL\",\n    \"WORKSPACE_OAUTH_ORIGIN\",\n    \"VITE_WORKSPACE_OAUTH_ORIGIN\",\n    \"BETTER_AUTH_URL\",\n    \"VITE_BETTER_AUTH_URL\",\n  ]);\n  if (envUrl) return envUrl;\n\n  // Prefer the incoming request's origin when we have one — for local dev\n  // this is `http://localhost:3000`, which keeps Better Auth from setting\n  // `Secure` cookies on plain-HTTP dev servers.\n  if (event) {\n    try {\n      const url = getRequestURL(event);\n      return `${url.protocol}//${url.host}`;\n    } catch {\n      // fall through\n    }\n  }\n\n  // Fall back to a first-party template's hard-coded prod URL when we're\n  // running in production OR on a remote database (Neon/Postgres/Turso).\n  // A remote DB means we're deployed even if NODE_ENV isn't explicitly\n  // \"production\" (e.g. Netlify Functions). In local dev with SQLite, skip\n  // this — the hard-coded URL breaks auth via Secure cookies on HTTP.\n  if (process.env.NODE_ENV === \"production\" || !isLocalDatabase()) {\n    const firstParty = getFirstPartyProdUrl();\n    if (firstParty) return stripTrailingSlash(firstParty);\n\n    // Netlify injects `URL` (main site URL, always https) and `DEPLOY_URL`\n    // (deploy-specific URL). Prefer `URL` so emails always link to the\n    // primary domain rather than a preview branch URL.\n    const netlifyUrl = process.env.URL || process.env.DEPLOY_URL;\n    if (netlifyUrl) return stripTrailingSlash(netlifyUrl);\n\n    // Vercel injects `VERCEL_PROJECT_PRODUCTION_URL` (custom/primary domain,\n    // no protocol) and `VERCEL_URL` (ephemeral deployment hostname). Prefer\n    // the production URL so emails use the real domain, not *.vercel.app.\n    const vercelUrl =\n      process.env.VERCEL_PROJECT_PRODUCTION_URL || process.env.VERCEL_URL;\n    if (vercelUrl) return `https://${stripTrailingSlash(vercelUrl)}`;\n\n    const publicWorkspaceGateway = workspaceGatewayUrl({\n      allowLoopback: false,\n    });\n    if (publicWorkspaceGateway) return publicWorkspaceGateway;\n  }\n\n  const localWorkspaceGateway = workspaceGatewayUrl({ allowLoopback: true });\n  if (localWorkspaceGateway) return localWorkspaceGateway;\n\n  return \"http://localhost:3000\";\n}\n"]}

package/dist/server/auth.d.ts

@@ -3,6 +3,7 @@ import type { H3AppShim } from "./framework-request-handler.js";
 type H3App = H3AppShim;
 import type { BetterAuthConfig } from "./better-auth-instance.js";
 import type { GoogleAuthMode } from "./google-auth-mode.js";
+import { type WorkspaceAppAudience } from "../shared/workspace-app-audience.js";
 /**
  * Get the configured session max age. Desktop SSO broker writes from
  * OAuth flows read this so expiration stays consistent with the cookie.
@@ -33,6 +34,27 @@ export interface AuthOptions {
      * Both page routes and API routes can be made public.
      */
     publicPaths?: string[];
+    /**
+     * Workspace-level audience for the app.
+     *
+     * "internal" keeps the existing behavior: every app page requires an
+     * authenticated workspace member unless listed in publicPaths.
+     *
+     * "public" lets unauthenticated visitors load page routes, while framework
+     * and API routes remain protected unless explicitly listed in publicPaths.
+     */
+    workspaceAppAudience?: WorkspaceAppAudience;
+    /**
+     * Workspace app page paths that anonymous visitors can load.
+     * Uses the same prefix matching as publicPaths, but only for page routes:
+     * framework, API, and .well-known routes stay protected.
+     */
+    workspaceAppPublicPaths?: string[];
+    /**
+     * Workspace app page paths that still require auth when the app audience is
+     * public. Useful for public sites with login-only admin/management pages.
+     */
+    workspaceAppProtectedPaths?: string[];
     /**
      * Custom login page HTML. When provided, this HTML is served to
      * unauthenticated page requests instead of the built-in login form.