@agent-native/core 0.158.10 → 0.159.1

package/dist/app-config/workspace.d.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+/**
+ * Workspace gateway.
+ *
+ * A workspace deploy puts one gateway in front of N apps, so these are a
+ * *different host* from this app's own URL — not another spelling of it.
+ * `deploy/workspace-deploy.ts` sets them on each app it launches.
+ *
+ * Each field lists the plain and `VITE_` spelling as aliases of one value. The
+ * prefix only ever meant "inline this into the browser bundle", which is a
+ * delivery question, not a second setting — the shell projection in
+ * `server/app-origin-config.ts` answers that now.
+ *
+ * Length-checked but not `.url()`-validated, for the same reason as `app.url`:
+ * a malformed value should fail where it is used, not take every config read
+ * in the process down with it.
+ */
+export declare const workspaceConfig: z.ZodObject<{
+    gatewayUrl: z.ZodOptional<z.ZodString>;
+    oauthOrigin: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;

package/dist/app-config/workspace.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+/**
+ * Workspace gateway.
+ *
+ * A workspace deploy puts one gateway in front of N apps, so these are a
+ * *different host* from this app's own URL — not another spelling of it.
+ * `deploy/workspace-deploy.ts` sets them on each app it launches.
+ *
+ * Each field lists the plain and `VITE_` spelling as aliases of one value. The
+ * prefix only ever meant "inline this into the browser bundle", which is a
+ * delivery question, not a second setting — the shell projection in
+ * `server/app-origin-config.ts` answers that now.
+ *
+ * Length-checked but not `.url()`-validated, for the same reason as `app.url`:
+ * a malformed value should fail where it is used, not take every config read
+ * in the process down with it.
+ */
+export const workspaceConfig = z.object({
+    gatewayUrl: z
+        .string()
+        .min(1)
+        .optional()
+        .meta({
+        env: ["WORKSPACE_GATEWAY_URL", "VITE_WORKSPACE_GATEWAY_URL"],
+        doc: "URL of the workspace gateway fronting this app.",
+    }),
+    oauthOrigin: z
+        .string()
+        .min(1)
+        .optional()
+        .meta({
+        env: ["WORKSPACE_OAUTH_ORIGIN", "VITE_WORKSPACE_OAUTH_ORIGIN"],
+        doc: "Shared origin workspace apps complete OAuth against.",
+    }),
+});

package/dist/cli/agent.js

@@ -4,6 +4,7 @@ import { DEFAULT_MODEL } from "../agent/default-model.js";
 import { registerBuiltinEngines, resolveEngine, } from "../agent/engine/index.js";
 import { actionsToEngineTools, } from "../agent/production-agent.js";
 import { runAgentLoopDirectWithSoftTimeout } from "../agent/run-loop-with-resume.js";
+import { getAppConfig } from "../app-config/index.js";
 import { createGitHubRepoToolEntries } from "../provider-api/github-repo.js";
 import { resolveDevUserEmail } from "../scripts/dev-session.js";
 import { loadEnv } from "../scripts/utils.js";
@@ -143,7 +144,7 @@ async function runLocalAgentLoop(parsed) {
     const localActions = await autoDiscoverActions("auto");
     const builtinActions = await createHeadlessBuiltinActions();
     const repoActions = createGitHubRepoToolEntries({
-        appId: process.env.AGENT_NATIVE_APP_ID ?? process.env.APP_ID ?? "app",
+        appId: getAppConfig().app.id ?? "app",
     });
     const actions = { ...builtinActions, ...localActions, ...repoActions };
     const tools = actionsToEngineTools(actions);

package/dist/cli/code-agent-executor.js

@@ -7,6 +7,7 @@ import { PROVIDER_ENV_VARS } from "../agent/engine/provider-env-vars.js";
 import { DEFAULT_AGENT_MAX_ITERATIONS } from "../agent/loop-settings.js";
 import { actionsToEngineTools, runAgentLoop, } from "../agent/production-agent.js";
 import { createToolSearchEntry, TOOL_SEARCH_ACTION_NAME, } from "../agent/tool-search.js";
+import { getAppConfig } from "../app-config/index.js";
 import { formatPromptWithAttachments, } from "../code-agents/prompt-attachments.js";
 import { createCodingToolRegistry, isReadOnlyShellCommand, runCodingCommand, truncateBashOutput, truncateCodingOutput, } from "../coding-tools/index.js";
 import { buildMergedConfig, McpClientManager, mcpToolsToActionEntries, } from "../mcp-client/index.js";
@@ -103,7 +104,7 @@ export async function executeCodeAgentRun(options) {
     // Fall back to AGENT_ENGINE here too, mirroring resolveExecutorEngine below.
     // Without it, `AGENT_ENGINE=codex-cli` skips this Codex branch and is handed
     // to resolveEngine (LLM providers only), which throws `Unknown engine`.
-    const requestedEngine = normalizeRequestedEngine(metadataString(existing, "engine") ?? process.env.AGENT_ENGINE);
+    const requestedEngine = normalizeRequestedEngine(metadataString(existing, "engine") ?? getAppConfig().agent.engine);
     if (requestedEngine === CODEX_CLI_ENGINE_NAME) {
         return executeCodexCliRun({
             run: existing,
@@ -178,7 +179,7 @@ export async function executeCodeAgentRun(options) {
     }
     const modelCandidate = options.model ??
         metadataString(existing, "model") ??
-        process.env.AGENT_MODEL ??
+        getAppConfig().agent.model ??
         (await getStoredModelForEngine(engine).catch(() => undefined)) ??
         engine.defaultModel;
     const model = normalizeModelForEngine(engine, modelCandidate);
@@ -1794,11 +1795,11 @@ async function resolveExecutorEngine(requestedEngine) {
     if (!hasAnyProviderCredential())
         return null;
     return resolveEngine({
-        engineOption: requestedEngine ?? process.env.AGENT_ENGINE,
+        engineOption: requestedEngine ?? getAppConfig().agent.engine,
     });
 }
 function hasAnyProviderCredential() {
-    if (process.env.AGENT_ENGINE)
+    if (getAppConfig().agent.engine)
         return true;
     if (PROVIDER_ENV_VARS.some((key) => Boolean(process.env[key])))
         return true;

package/dist/client/analytics.d.ts

@@ -9,6 +9,15 @@ declare global {
     interface Window {
         gtag?: (...args: any[]) => void;
         __AGENT_NATIVE_CONFIG__?: {
+            /**
+             * This app's origins, projected by server/app-origin-config.ts. These
+             * replace the `VITE_` mirrors of APP_URL / WORKSPACE_* — the prefix only
+             * ever answered "how does this reach the browser", which the shell
+             * answers better. Impersonal, so safe in the CDN-cached shell.
+             */
+            appUrl?: string;
+            workspaceGatewayUrl?: string;
+            workspaceOAuthOrigin?: string;
             sentryDsn?: string;
             sentryEnvironment?: string;
             /**

package/dist/client/frame.js

@@ -186,7 +186,17 @@ function runtimeEnvValue(name) {
         : undefined;
 }
 function workspaceOAuthOrigin() {
-    const raw = runtimeEnvValue("VITE_WORKSPACE_OAUTH_ORIGIN") ||
+    // The shell carries the server's declared values, so it answers first. The
+    // env lookups below are the pre-shell fallback and are kept for deployments
+    // built before the projection existed: in a browser only the `VITE_`
+    // spellings can ever resolve, and on the server only the plain ones are
+    // guaranteed — which is why the chain lists both and why it is not the
+    // primary path any more.
+    const shell = typeof window !== "undefined" ? window.__AGENT_NATIVE_CONFIG__ : undefined;
+    const raw = shell?.workspaceOAuthOrigin ||
+        shell?.appUrl ||
+        shell?.workspaceGatewayUrl ||
+        runtimeEnvValue("VITE_WORKSPACE_OAUTH_ORIGIN") ||
         runtimeEnvValue("WORKSPACE_OAUTH_ORIGIN") ||
         runtimeEnvValue("VITE_APP_URL") ||
         runtimeEnvValue("APP_URL") ||

package/dist/deploy/build.js

@@ -964,6 +964,41 @@ function getRealtimeClientConfigScript() {
   );
 }
 
+function getAppOriginClientConfigScript() {
+  // MUST stay consistent with resolvePublicAppOriginConfig in
+  // server/app-origin-config.ts, and with the alias order declared on
+  // app.url / workspace.* in app-config (worker bundles a string copy; it
+  // can't import them). Impersonal values only — this ships into the
+  // CDN-cached shell.
+  const env = globalThis.process?.env || {};
+  const appUrl = firstNonEmpty(
+    env.APP_URL,
+    env.VITE_APP_URL,
+    env.BETTER_AUTH_URL,
+    env.VITE_BETTER_AUTH_URL,
+  );
+  const workspaceGatewayUrl = firstNonEmpty(
+    env.WORKSPACE_GATEWAY_URL,
+    env.VITE_WORKSPACE_GATEWAY_URL,
+  );
+  const workspaceOAuthOrigin = firstNonEmpty(
+    env.WORKSPACE_OAUTH_ORIGIN,
+    env.VITE_WORKSPACE_OAUTH_ORIGIN,
+  );
+  const config = {
+    ...(appUrl ? { appUrl } : {}),
+    ...(workspaceGatewayUrl ? { workspaceGatewayUrl } : {}),
+    ...(workspaceOAuthOrigin ? { workspaceOAuthOrigin } : {}),
+  };
+  if (Object.keys(config).length === 0) return null;
+  return (
+    '<script data-agent-native-app-origin-config>' +
+    'window.__AGENT_NATIVE_CONFIG__=Object.assign({},window.__AGENT_NATIVE_CONFIG__,' +
+    JSON.stringify(config) +
+    ");</script>"
+  );
+}
+
 function injectHeadScript(html, script) {
   if (!script) return html;
   const headCloseIdx = html.indexOf("</head>");
@@ -1105,6 +1140,7 @@ async function rewriteMountedResponse(response, basePath, pathname, request) {
       getSentryClientConfigScript(),
       getPostHogClientConfigScript(),
       getRealtimeClientConfigScript(),
+      getAppOriginClientConfigScript(),
     ]
       .filter(Boolean)
       .join("") || null;

package/dist/integrations/a2a-continuation-processor.js

@@ -3,8 +3,10 @@ import { A2AClient, signA2AToken } from "../a2a/client.js";
 import { formatLlmCredentialErrorMessage, isLlmCredentialError, LLM_MISSING_CREDENTIALS_ERROR_CODE, } from "../agent/engine/credential-errors.js";
 import { extractThreadMeta } from "../agent/thread-data-builder.js";
 import { getThread, updateThreadData } from "../chat-threads/store.js";
+import { resolveArtifactBaseUrl } from "../server/agent-chat/action-filters-a2a.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { FRAMEWORK_ROUTE_PREFIX } from "../server/core-routes-plugin.js";
+import { resolveSelfDispatchBaseUrl } from "../server/self-dispatch.js";
 import { claimA2AContinuation, claimA2AContinuationDelivery, claimDueA2AContinuations, failA2AContinuationsForIntegrationTask, failA2AContinuation, finalizeA2ATerminalHistory, getA2AContinuation, getA2AContinuationTaskOutcome, hasOnlyLegacyFailedA2AContinuationsForIntegrationTask, hasPendingConfirmedA2ADeliveryForIntegrationTask, listRecoverableA2AIntegrationTasks, recoverDueA2AContinuationIds, recordA2ATerminalDeliveryReceipt, retainA2AUnconfirmedDeliveryClaim, rescheduleA2AContinuation, saveA2AVerifiedArtifactCheckpoint, } from "./a2a-continuations-store.js";
 import { completeIntegrationCampaignTaskAfterA2A, failDisabledIntegrationCampaignTask, failIntegrationCampaignTaskDeliveryContainment, getIntegrationCampaignForTask, } from "./integration-campaigns-store.js";
 import { dispatchPendingIntegrationTask, isIntegrationDurableDispatchEnabledForTask, } from "./integration-durable-dispatch.js";
@@ -37,12 +39,17 @@ function logA2AContinuationTransition(event, continuation) {
     });
 }
 export async function dispatchA2AContinuation(continuationId, webhookBaseUrl) {
+    // Self-dispatch: this POST has to land on the deployment that enqueued the
+    // continuation. It used to carry its own chain, which omitted
+    // DEPLOY_PRIME_URL — so a deploy preview dispatched to production — and
+    // silently fell back to localhost in production, where the request simply
+    // never arrives and the continuation is dropped with no error.
+    // `WEBHOOK_BASE_URL` stays ahead of it: this runs from a retry job with no
+    // inbound request, and a dev tunnel is reachable where the app's own address
+    // is not.
     const baseUrl = webhookBaseUrl ||
         process.env.WEBHOOK_BASE_URL ||
-        process.env.APP_URL ||
-        process.env.URL ||
-        process.env.DEPLOY_URL ||
-        `http://localhost:${process.env.PORT || 3000}`;
+        resolveSelfDispatchBaseUrl();
     const url = `${withConfiguredAppBasePath(baseUrl)}${PROCESSOR_PATH}`;
     const headers = {
         "Content-Type": "application/json",
@@ -897,11 +904,7 @@ function formatRecoverableArtifactFallbackText(text) {
 }
 function formatContinuationArtifactText(text, agentUrl) {
     const expandedText = expandRelativeUrls(text, agentUrl);
-    return appendA2AArtifactLinks(expandedText, [{ tool: "call-agent", result: expandedText }], { baseUrl: resolveArtifactBaseUrl() });
-}
-function resolveArtifactBaseUrl() {
-    const baseUrl = process.env.APP_URL || process.env.URL || process.env.DEPLOY_URL;
-    return baseUrl ? withConfiguredAppBasePath(baseUrl) : undefined;
+    return appendA2AArtifactLinks(expandedText, [{ tool: "call-agent", result: expandedText }], { baseUrl: resolveArtifactBaseUrl(undefined) });
 }
 function expandRelativeUrls(text, agentUrl) {
     if (!text || !agentUrl)

package/dist/integrations/adapters/email.js

@@ -1,5 +1,6 @@
 import { timingSafeEqual } from "node:crypto";
 import { getHeader, readRawBody as h3ReadRawBody } from "h3";
+import { getAppConfig } from "../../app-config/index.js";
 import { getDbExec } from "../../db/client.js";
 import { resolveSecret } from "../../server/credential-provider.js";
 import { sendEmail, isEmailConfigured, getEmailProvider, } from "../../server/email.js";
@@ -30,7 +31,7 @@ function escapeLike(value) {
  * webhook security audit).
  */
 function shouldRefuseWhenSecretMissing() {
-    if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === "1")
+    if (getAppConfig().integrations.allowUnverifiedWebhooks)
         return false;
     return process.env.NODE_ENV === "production";
 }

package/dist/integrations/adapters/telegram.js

@@ -1,4 +1,5 @@
 import { getHeader } from "h3";
+import { getAppConfig } from "../../app-config/index.js";
 import { resolveSecret } from "../../server/credential-provider.js";
 import { readBody } from "../../server/h3-helpers.js";
 /** Telegram's max message length */
@@ -16,7 +17,7 @@ let _telegramUnverifiedWarned = false;
  * messages (C2 in the webhook security audit).
  */
 function shouldRefuseWhenSecretMissing() {
-    if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === "1")
+    if (getAppConfig().integrations.allowUnverifiedWebhooks)
         return false;
     return process.env.NODE_ENV === "production";
 }

package/dist/integrations/adapters/whatsapp.js

@@ -1,4 +1,5 @@
 import { getQuery, getHeader, readRawBody as h3ReadRawBody } from "h3";
+import { getAppConfig } from "../../app-config/index.js";
 import { resolveSecret } from "../../server/credential-provider.js";
 /** WhatsApp's max message length */
 const WHATSAPP_MAX_LENGTH = 4096;
@@ -15,7 +16,7 @@ let _whatsappUnverifiedWarned = false;
  * be verified (C2 in the webhook security audit).
  */
 function shouldRefuseWhenSecretMissing() {
-    if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === "1")
+    if (getAppConfig().integrations.allowUnverifiedWebhooks)
         return false;
     return process.env.NODE_ENV === "production";
 }

package/dist/integrations/webhook-handler.d.ts

@@ -109,8 +109,13 @@ export declare function handleWebhook(event: H3Event, options: WebhookHandlerOpt
 }>;
 /**
  * Resolve the base URL we should dispatch the processor request to.
- * Prefers explicit env vars (most reliable on serverless), falls back to the
- * inbound request's headers.
+ *
+ * This is self-dispatch — the request has to land on *this* deployment — so it
+ * shares one resolver with the rest of the framework rather than keeping its
+ * own copy. The copy that used to live here preferred `APP_URL` over the
+ * platform's own deploy URLs and did not consult `DEPLOY_PRIME_URL` at all, so
+ * on a Netlify deploy preview it dispatched integration work to production
+ * while agent background work correctly stayed on the preview.
  */
 export declare function resolveBaseUrl(event: H3Event): string;
 /**

package/dist/integrations/webhook-handler.js

@@ -12,10 +12,10 @@ import { buildAssistantMessage, extractThreadMeta, threadDataToEngineMessages, }
 import { attachToolSearch } from "../agent/tool-search.js";
 import { createThread, getThread, grantThreadUserShare, setThreadSourceIfMissing, } from "../chat-threads/store.js";
 import { updateThreadData } from "../chat-threads/store.js";
-import { isLocalDatabase } from "../db/client.js";
 import { getOrgA2ASecret, resolveOrgIdForEmail } from "../org/context.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { runWithRequestContext } from "../server/request-context.js";
+import { resolveSelfDispatchBaseUrl } from "../server/self-dispatch.js";
 import { normalizeReasoningEffortForRequest } from "../shared/reasoning-effort.js";
 import { A2A_CONTINUATION_QUEUED_MARKER } from "./a2a-continuation-marker.js";
 import { reconcileTerminalA2AParentIfDisabled } from "./a2a-continuation-processor.js";
@@ -360,38 +360,16 @@ async function enqueueAndDispatch(event, incoming, options, handlerStartedAt = D
 }
 /**
  * Resolve the base URL we should dispatch the processor request to.
- * Prefers explicit env vars (most reliable on serverless), falls back to the
- * inbound request's headers.
+ *
+ * This is self-dispatch — the request has to land on *this* deployment — so it
+ * shares one resolver with the rest of the framework rather than keeping its
+ * own copy. The copy that used to live here preferred `APP_URL` over the
+ * platform's own deploy URLs and did not consult `DEPLOY_PRIME_URL` at all, so
+ * on a Netlify deploy preview it dispatched integration work to production
+ * while agent background work correctly stayed on the preview.
  */
 export function resolveBaseUrl(event) {
-    const fromEnv = process.env.APP_URL ||
-        process.env.URL ||
-        process.env.DEPLOY_URL ||
-        process.env.BETTER_AUTH_URL;
-    if (fromEnv)
-        return withConfiguredAppBasePath(fromEnv);
-    if (process.env.NODE_ENV === "production" || !isLocalDatabase()) {
-        throw new Error("Integration self-dispatch requires APP_URL, URL, DEPLOY_URL, or BETTER_AUTH_URL in production/shared deployments.");
-    }
-    try {
-        const headers = event.node?.req?.headers ?? event.headers;
-        const get = (name) => {
-            if (!headers)
-                return undefined;
-            if (typeof headers.get === "function") {
-                return headers.get(name) ?? undefined;
-            }
-            const lower = String(name).toLowerCase();
-            const map = headers;
-            return map[name] ?? map[lower];
-        };
-        const proto = get("x-forwarded-proto") || "http";
-        const host = get("host") || `localhost:${process.env.PORT || 3000}`;
-        return withConfiguredAppBasePath(`${proto}://${host}`);
-    }
-    catch {
-        return withConfiguredAppBasePath(`http://localhost:${process.env.PORT || 3000}`);
-    }
+    return resolveSelfDispatchBaseUrl(event);
 }
 /**
  * Run the actual agent loop for a previously-enqueued task. Called by the

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,6 +159,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -174,7 +175,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,6 +190,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -199,7 +200,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,6 +216,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -234,7 +235,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,6 +250,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -263,7 +264,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -16,18 +16,18 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error?: undefined;
     ok?: undefined;
 } | {
+    count?: undefined;
     updated: number;
     error?: undefined;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error: string;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error?: undefined;
     ok: boolean;
-    count?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    ok?: undefined;
-    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-} | {
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
+    error?: undefined;
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
+    ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;

package/dist/onboarding/app-profile.js

@@ -1,3 +1,4 @@
+import { getAppConfig } from "../app-config/index.js";
 const LLM_CAPABILITY = {
     id: "llm",
     label: "AI model",
@@ -382,10 +383,7 @@ function normalizeAppId(value) {
         .replace(/^-|-$/g, "") || "app");
 }
 export function resolveOnboardingAppId(explicit) {
-    return normalizeAppId(explicit ??
-        process.env.AGENT_NATIVE_APP_ID ??
-        process.env.APP_ID ??
-        process.env.npm_package_name);
+    return normalizeAppId(explicit ?? getAppConfig().app.id ?? getAppConfig().app.packageName);
 }
 export function getOnboardingAppProfile(appId) {
     const resolvedId = resolveOnboardingAppId(appId);

package/dist/onboarding/default-steps.js

@@ -7,6 +7,7 @@
  */
 import { PROVIDER_ENV_META, PROVIDER_ENV_VARS, } from "../agent/engine/provider-env-vars.js";
 import { detectEngineFromUserSecrets, isAgentEngineSettingConfigured, } from "../agent/engine/registry.js";
+import { getAppConfig } from "../app-config/index.js";
 import { getActiveFileUploadProviderForRequest, registerFileUploadProvider, } from "../file-upload/registry.js";
 import { s3FileUploadProvider } from "../file-upload/s3.js";
 import { canUseDeployCredentialFallbackForRequest, readDeployCredentialEnv, resolveSecret, } from "../server/credential-provider.js";
@@ -323,10 +324,9 @@ const githubRepositoryStep = {
             try {
                 const { resolveWorkspaceConnectionCredentialForApp } = await import("../workspace-connections/index.js");
                 const result = await resolveWorkspaceConnectionCredentialForApp({
-                    appId: process.env.AGENT_NATIVE_APP_ID ||
-                        process.env.APP_ID ||
-                        process.env.npm_package_name ||
-                        "app",
+                    // Deliberately not `resolveOnboardingAppId()` — that normalizes, and
+                    // this id is matched against a stored workspace connection grant.
+                    appId: getAppConfig().app.id ?? getAppConfig().app.packageName ?? "app",
                     provider: "github",
                     key: "GITHUB_TOKEN",
                     userEmail,

package/dist/private-blob/registry.d.ts

@@ -3,6 +3,11 @@ export declare function registerPrivateBlobProvider(provider: PrivateBlobProvide
 export declare function unregisterPrivateBlobProvider(id: string): void;
 export declare function listPrivateBlobProviders(): PrivateBlobProvider[];
 export declare function getActivePrivateBlobProvider(): PrivateBlobProvider | null;
+/**
+ * @deprecated Use `defineAppConfig({ privateBlob: { publicUploadFallback } })`
+ * instead. This writes the same value into the deprecated layer of the config
+ * ladder, so an explicit `defineAppConfig` call now wins over it.
+ */
 export declare function setPrivateBlobPublicUploadFallbackEnabled(enabled: boolean): void;
 export declare function putPrivateBlob(input: PrivateBlobPutInput): Promise<PrivateBlobHandle | null>;
 export declare function readPrivateBlob(handle: PrivateBlobHandle): Promise<PrivateBlobReadResult>;

package/dist/private-blob/registry.js

@@ -1,13 +1,12 @@
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { getAppConfig } from "../app-config/index.js";
+import { setAppConfigLayer } from "../app-config/store.js";
 import { uploadFile } from "../file-upload/index.js";
 import { decryptSecretValue, encryptSecretValue, getSecretEncryptionKey, } from "../secrets/crypto.js";
 const PUBLIC_UPLOAD_HANDLE_PREFIX = "public-upload:v1:";
 const PUBLIC_UPLOAD_READ_RETRY_DELAYS_MS = [100, 250, 500];
 const globals = globalThis;
 const providers = (globals.__agentNativePrivateBlobProviders ??= new Map());
-const publicUploadFallbackRef = (globals.__agentNativePrivateBlobPublicUploadFallback ??= {
-    enabled: true,
-});
 function toBytes(data) {
     return data instanceof Uint8Array ? data : new Uint8Array(data);
 }
@@ -171,24 +170,36 @@ export function listPrivateBlobProviders() {
     return [...providers.values()];
 }
 export function getActivePrivateBlobProvider() {
+    const selected = getAppConfig().privateBlob.provider;
+    if (selected) {
+        const provider = providers.get(selected);
+        if (!provider) {
+            throw new Error(`Private blob provider "${selected}" is selected in app config but no provider with that id is registered`);
+        }
+        return provider;
+    }
     for (const provider of providers.values()) {
         if (provider.isConfigured())
             return provider;
     }
     return null;
 }
+/**
+ * @deprecated Use `defineAppConfig({ privateBlob: { publicUploadFallback } })`
+ * instead. This writes the same value into the deprecated layer of the config
+ * ladder, so an explicit `defineAppConfig` call now wins over it.
+ */
 export function setPrivateBlobPublicUploadFallbackEnabled(enabled) {
-    publicUploadFallbackRef.enabled = enabled;
+    setAppConfigLayer("legacy", {
+        privateBlob: { publicUploadFallback: enabled },
+    });
 }
 export async function putPrivateBlob(input) {
     const provider = getActivePrivateBlobProvider();
     if (provider)
         return provider.put(input);
-    if (!publicUploadFallbackRef.enabled)
+    if (!getAppConfig().privateBlob.publicUploadFallback)
         return null;
-    if (process.env.AGENT_NATIVE_PRIVATE_BLOB_PUBLIC_UPLOAD_FALLBACK === "0") {
-        return null;
-    }
     return putViaEncryptedPublicUpload(input);
 }
 export async function readPrivateBlob(handle) {