@agent-native/core 0.158.9 → 0.159.0

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,11 +311,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
+        deleted?: undefined;
         id?: undefined;
         provider?: undefined;
-        deleted?: undefined;
-        found?: undefined;
-        message?: undefined;
         providers: {
             id: string;
             label: string;
@@ -326,44 +324,46 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
+        found?: undefined;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        id?: undefined;
         deleted?: undefined;
-        message?: undefined;
+        id?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        provider?: undefined;
         deleted?: undefined;
-        message?: undefined;
+        provider?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
         provider?: undefined;
-        found?: undefined;
-        message?: undefined;
         providers?: undefined;
         count?: undefined;
+        found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
+        message?: undefined;
     } | {
-        provider?: undefined;
         deleted?: undefined;
-        found?: undefined;
+        provider?: undefined;
         providers?: undefined;
         count?: undefined;
+        found?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/provider-api/corpus-jobs.d.ts

@@ -73,6 +73,7 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     offset?: unknown;
     limit?: unknown;
 }, {
+    deleted?: undefined;
     jobs: {
         id: string;
         name: string;
@@ -83,7 +84,6 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
         updatedAt: string;
     }[];
     total: number;
-    deleted?: undefined;
     jobId?: undefined;
 } | {
     jobs?: undefined;
@@ -91,9 +91,9 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     deleted: boolean;
     jobId: string;
 } | {
+    deleted?: undefined;
     jobs?: undefined;
     total?: undefined;
-    deleted?: undefined;
     jobId?: undefined;
     hits: Record<string, unknown>[];
     offset: number;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/scripts/agent-engines/list-agent-engines.js

@@ -4,6 +4,7 @@
 import { getAgentAppModelDefaultForCurrentRequest } from "../../agent/app-model-defaults.js";
 import { DEFAULT_MODEL } from "../../agent/default-model.js";
 import { listAgentEngines, registerBuiltinEngines, detectEngineFromEnv, detectEngineFromUserSecrets, getAgentEngineEntry, isAgentEnginePackageInstalled, isStoredEngineUsableForRequest, normalizeModelForEngine, resolveEnginePreservesCustomModels, } from "../../agent/engine/index.js";
+import { getAppConfig } from "../../app-config/index.js";
 import { getSetting } from "../../settings/index.js";
 export const tool = {
     description: 'List all available AI agent engines (Anthropic, OpenAI, Gemini, Groq, etc.) and the currently selected engine. Use this to check what engines are available before calling manage-agent-engine with action="set".',
@@ -37,8 +38,9 @@ export async function run(args = {}) {
         !!appDefaultEntry &&
         (await isStoredEngineUsableForRequest(appDefault, appDefaultEntry));
     const detectedFromUser = await detectEngineFromUserSecrets();
-    const envEntry = process.env.AGENT_ENGINE
-        ? getAgentEngineEntry(process.env.AGENT_ENGINE)
+    const configuredEngine = getAppConfig().agent.engine;
+    const envEntry = configuredEngine
+        ? getAgentEngineEntry(configuredEngine)
         : undefined;
     const envUsable = !!envEntry &&
         (await isStoredEngineUsableForRequest({ engine: envEntry.name }, envEntry));

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-chat/action-filters-a2a.js

@@ -5,6 +5,7 @@ import { resolveMainChatMaxOutputTokens } from "../../agent/engine/output-tokens
 import { filterInitialEngineTools, resolveAgentRequestReasoningEffort, } from "../../agent/production-agent.js";
 import { runAgentLoopDirectWithSoftTimeout } from "../../agent/run-loop-with-resume.js";
 import { resolveRunSoftTimeoutMs } from "../../agent/run-manager.js";
+import { getAppConfig } from "../../app-config/index.js";
 import { isFrameworkGroupedAction } from "../../framework-tools.js";
 import { isAuthenticatedReadAction, isAutoReadExcludedActionName, } from "../../mcp/build-server.js";
 import { withConfiguredAppBasePath } from "../app-base-path.js";
@@ -173,10 +174,10 @@ export function buildAuthenticatedAgentA2ASkills(actions, options) {
     });
 }
 export function resolveArtifactBaseUrl(event) {
-    const fromEnv = process.env.APP_URL ||
-        process.env.URL ||
-        process.env.DEPLOY_URL ||
-        process.env.BETTER_AUTH_URL;
+    // An artifact link is user-facing, so the canonical URL wins; the platform's
+    // per-deploy URLs are the fallback, not the other way round (that ordering
+    // belongs to self-dispatch, which has to reach *this* deploy).
+    const fromEnv = getAppConfig().app.url ?? process.env.URL ?? process.env.DEPLOY_URL;
     if (fromEnv)
         return withConfiguredAppBasePath(String(fromEnv));
     try {

package/dist/server/agent-chat/run-code-tools.js

@@ -1,3 +1,4 @@
+import { getAppConfig } from "../../app-config/index.js";
 /**
  * Load the sandboxed code-execution tool entries for one action registry:
  * `run-code`, bounded `tool-orchestration`, plus its `get-code-execution` poll companion. The poll tool is
@@ -49,8 +50,6 @@ export async function loadRunCodeToolEntries(supplier, runCodeOptions) {
  * persisted resource scoped to "this app deployment".
  */
 function resolveDataProgramsAppId() {
-    return (process.env.AGENT_NATIVE_APP_ID?.trim() ||
-        process.env.APP_ID?.trim() ||
-        process.env.APP_NAME?.trim() ||
-        "app");
+    const app = getAppConfig().app;
+    return app.id ?? app.name ?? "app";
 }

package/dist/server/agent-chat-plugin.js

@@ -20,6 +20,7 @@ import { buildCurrentTimeUserContext, buildRuntimeContextPrompt, } from "../agen
 import { buildAssistantMessage, buildUserMessage, claimQueuedMessage, extractThreadMeta, foldAssistantTurn, hasClaimedQueuedMessage, mergeThreadDataForClientSave, upsertUserMessage, } from "../agent/thread-data-builder.js";
 import { appendThreadDebugHistory } from "../agent/thread-debug-history.js";
 import { attachToolSearch } from "../agent/tool-search.js";
+import { getAppConfig } from "../app-config/index.js";
 import { readAppStateForCurrentTab } from "../application-state/script-helpers.js";
 import { runChatThreadDataMigrations } from "../chat-threads/migrations.js";
 import { adoptThreadScopeIfUnscoped, createThread, forkThread, getThread, registerChatThreadsShareable, resolveRunThreadScope, resolveThreadAccess, listThreads, searchThreads, renameThread, createThreadShareLink, getThreadByShareToken, getThreadShareState, revokeThreadShareLink, setThreadArchived, setThreadPinned, setThreadScope, updateThreadData, withThreadDataLock, deleteThread, setThreadQueuedMessages, setThreadSourceIfMissing, } from "../chat-threads/store.js";
@@ -315,7 +316,7 @@ export function createAgentChatPlugin(options) {
             const hostedHarnessConfig = await loadHostedHarnessConfig();
             // AGENT_MODE=production forces production agent constraints even in dev
             const canToggle = (env === "development" || env === "test") &&
-                process.env.AGENT_MODE !== "production";
+                getAppConfig().agent.mode !== "production";
             const routePath = options?.path ?? "/_agent-native/agent-chat";
             const a2aAgentDelegationEnabled = resolveA2AAgentDelegationEnabled(options);
             // Mutable mode flag — persisted to the `settings` table so a user who
@@ -3222,8 +3223,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 }
             }));
             const modelDefaultsAppId = normalizeAgentAppModelDefaultAppId(options?.appId ??
-                process.env.AGENT_NATIVE_APP_ID ??
-                process.env.VITE_AGENT_NATIVE_TEMPLATE ??
+                getAppConfig().app.id ??
+                getAppConfig().app.template ??
                 "app") ?? "app";
             const resolveModelDefaultsContext = async (event) => {
                 const session = await getSession(event).catch(() => null);

package/dist/server/agent-discovery.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { getAppConfig } from "../app-config/index.js";
 import { TEMPLATES } from "../cli/templates-meta.js";
 import { DEFAULT_WORKSPACE_APP_AUDIENCE, normalizeWorkspaceAppAudience, normalizeWorkspaceAppPathList, workspaceAppAudienceFromPackageJson, workspaceAppRouteAccessFromPackageJson, } from "../shared/workspace-app-audience.js";
 import { getRequestOrgId, getRequestUserEmail } from "./request-context.js";
@@ -519,11 +520,12 @@ function readWorkspaceAppsFromFilesystem() {
     return apps.length ? apps : null;
 }
 function workspaceBaseUrl() {
-    return (process.env.WORKSPACE_GATEWAY_URL ||
-        process.env.APP_URL ||
-        process.env.URL ||
-        process.env.DEPLOY_URL ||
-        process.env.BETTER_AUTH_URL ||
+    const config = getAppConfig();
+    // `URL` / `DEPLOY_URL` stay raw: they are platform facts, not app config.
+    return (config.workspace.gatewayUrl ??
+        config.app.url ??
+        process.env.URL ??
+        process.env.DEPLOY_URL ??
         null);
 }
 function workspaceAppUrl(app, hostedLoopbackFallbackUrl) {

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/app-origin-config.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Project this app's origins into the client shell.
+ *
+ * The browser needs these to build cross-frame and workspace-relative URLs.
+ * Historically that was done by mirroring each key with a `VITE_` twin, because
+ * Vite only inlines `VITE_`-prefixed variables into the bundle — so every
+ * consumer ended up writing both spellings, and half of each chain was dead on
+ * whichever side it happened to run.
+ *
+ * The mirror answered "how does this value reach the browser", never "what is
+ * this value". This is that answer instead: one declared field on the server,
+ * delivered through the same shell script Sentry and PostHog already use.
+ *
+ * Every value here is impersonal and identical for every visitor, which is what
+ * makes it safe inside the CDN-cached SSR shell (`guard:ssr-cache-shell`).
+ * Never add a per-user or per-request value to this object.
+ */
+export declare function resolvePublicAppOriginConfig(): {
+    appUrl?: string;
+    workspaceGatewayUrl?: string;
+    workspaceOAuthOrigin?: string;
+} | null;
+export declare function getAppOriginClientConfigScript(): string | null;

package/dist/server/app-origin-config.js

@@ -0,0 +1,43 @@
+import { getAppConfig } from "../app-config/index.js";
+/**
+ * Project this app's origins into the client shell.
+ *
+ * The browser needs these to build cross-frame and workspace-relative URLs.
+ * Historically that was done by mirroring each key with a `VITE_` twin, because
+ * Vite only inlines `VITE_`-prefixed variables into the bundle — so every
+ * consumer ended up writing both spellings, and half of each chain was dead on
+ * whichever side it happened to run.
+ *
+ * The mirror answered "how does this value reach the browser", never "what is
+ * this value". This is that answer instead: one declared field on the server,
+ * delivered through the same shell script Sentry and PostHog already use.
+ *
+ * Every value here is impersonal and identical for every visitor, which is what
+ * makes it safe inside the CDN-cached SSR shell (`guard:ssr-cache-shell`).
+ * Never add a per-user or per-request value to this object.
+ */
+export function resolvePublicAppOriginConfig() {
+    const config = getAppConfig();
+    const resolved = {
+        ...(config.app.url ? { appUrl: config.app.url } : {}),
+        ...(config.workspace.gatewayUrl
+            ? { workspaceGatewayUrl: config.workspace.gatewayUrl }
+            : {}),
+        ...(config.workspace.oauthOrigin
+            ? { workspaceOAuthOrigin: config.workspace.oauthOrigin }
+            : {}),
+    };
+    return Object.keys(resolved).length > 0 ? resolved : null;
+}
+export function getAppOriginClientConfigScript() {
+    const config = resolvePublicAppOriginConfig();
+    if (!config)
+        return null;
+    return [
+        "<script data-agent-native-app-origin-config>",
+        "window.__AGENT_NATIVE_CONFIG__=Object.assign({},window.__AGENT_NATIVE_CONFIG__,",
+        JSON.stringify(config),
+        ");",
+        "</script>",
+    ].join("");
+}

package/dist/server/auth.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { defineEventHandler, getMethod, getQuery, getRequestIP, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, getHeader, } from "h3";
+import { getAppConfig } from "../app-config/index.js";
 import { EMBED_START_PATH } from "../shared/embed-auth.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import { FIRST_RUN_ONBOARDING_COOKIE, FIRST_RUN_ONBOARDING_MAX_AGE, } from "../shared/first-run-onboarding.js";
@@ -425,6 +426,17 @@ function getSetCookieHeaders(headers) {
             .map((value) => value.trim())
             .filter(Boolean);
 }
+function cookieNames(header) {
+    return (header ?? "")
+        .split(";")
+        .map((part) => part.split("=", 1)[0]?.trim() ?? "")
+        .filter(Boolean);
+}
+function setCookieNames(headers) {
+    return getSetCookieHeaders(headers)
+        .map((cookie) => cookie.split("=", 1)[0]?.trim() ?? "")
+        .filter(Boolean);
+}
 function extractSessionTokenFromSetCookies(response) {
     try {
         for (const sc of getSetCookieHeaders(response.headers)) {
@@ -1683,6 +1695,9 @@ function logMagicLinkVerificationResponse(event, source, response, preConsume) {
         responseLocation: redactMagicLinkUrl(response.headers.get("location") || "", getOrigin(event)),
         producer: invalidToken ? "better-auth.magic-link.verify" : undefined,
         reason: invalidToken ? "consumeVerificationValue returned null" : undefined,
+        requestCookieNames: cookieNames(getHeader(event, "cookie")),
+        responseSetCookieCount: getSetCookieHeaders(response.headers).length,
+        responseSetCookieNames: setCookieNames(response.headers),
         preConsume,
         classification: invalidToken
             ? preConsume?.lookup === "present" && preConsume.expiryState === "valid"
@@ -2694,7 +2709,7 @@ function isHttpsRequest(event) {
         const url = req?.url;
         if (typeof url === "string" && url.startsWith("https://"))
             return true;
-        const appUrl = process.env.APP_URL || process.env.BETTER_AUTH_URL || "";
+        const appUrl = getAppConfig().app.url ?? "";
         if (appUrl.startsWith("https://"))
             return true;
     }
@@ -3361,6 +3376,11 @@ async function mountBetterAuthRoutes(app, options) {
             });
             return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
         }
+        logMagicLinkDebug(event, "callback-session-lookup", {
+            source: "desktop-callback",
+            flow: oauthDebugFlowId(flowId),
+            requestCookieNames: cookieNames(getHeader(event, "cookie")),
+        });
         const session = await getSession(event);
         if (!session?.email || !session.token) {
             setDesktopExchangeError(flowId, {

package/dist/server/core-routes-plugin.js

@@ -5,6 +5,7 @@ import { registerBuiltinEngines } from "../agent/engine/builtin.js";
 import { OPENAI_BASE_URL_ENV_VAR, PROVIDER_ENV_META, } from "../agent/engine/provider-env-vars.js";
 import { isAgentEngineSettingConfigured, getAgentEngineEntry, detectEngineFromEnv, detectEngineFromUserSecrets, isStoredEngineUsableForRequest, normalizeModelForEngine, } from "../agent/engine/registry.js";
 import { canUpdateAgentLoopSettings, readAgentLoopSettings, resetAgentLoopSettings, validateMaxIterationsInput, writeAgentLoopSettings, } from "../agent/loop-settings.js";
+import { getAppConfig } from "../app-config/index.js";
 import { getState, putState, deleteState, listComposeDrafts, getComposeDraft, putComposeDraft, deleteComposeDraft, deleteAllComposeDrafts, getStateMany, } from "../application-state/handlers.js";
 import { mountBrowserSessionRoutes } from "../browser-sessions/routes.js";
 import { mountDbAdminRoutes } from "../db-admin/routes.js";
@@ -102,9 +103,8 @@ export async function resolveAgentEngineStatus(deps) {
             openAiBaseUrlConfigured,
         };
     }
-    const envEntry = process.env.AGENT_ENGINE
-        ? lookupEntry(process.env.AGENT_ENGINE)
-        : undefined;
+    const configuredEngine = getAppConfig().agent.engine;
+    const envEntry = configuredEngine ? lookupEntry(configuredEngine) : undefined;
     if (envEntry) {
         if (!(await deps.isStoredEngineUsable({ engine: envEntry.name }, envEntry)))
             return { configured: false, openAiBaseUrlConfigured };

package/dist/server/credential-provider.js

@@ -19,6 +19,7 @@
  */
 import { createHash } from "node:crypto";
 import { CREDENTIAL_STORE_UNAVAILABLE_ERROR_CODE } from "../agent/engine/credential-errors.js";
+import { getAppConfig } from "../app-config/index.js";
 import { getDbExec, isLocalDatabase, isTransientDatabaseError, } from "../db/client.js";
 import { getOrgSetting } from "../settings/org-settings.js";
 import { getRequestUserEmail, getRequestOrgId } from "./request-context.js";
@@ -35,14 +36,12 @@ async function canReadDesignatedVaultFallback(vaultOrgId, credentialKey) {
     // Manual mode is still usable across a Dispatch vault org and a separate
     // app org, but only for this app's explicit active grant. The app identity
     // comes from deployment configuration, never from request input.
-    const appId = [
-        process.env.AGENT_NATIVE_WORKSPACE_APP_ID,
-        process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID,
-        process.env.AGENT_NATIVE_APP_ID,
-        process.env.APP_NAME,
-    ]
-        .find((value) => value?.trim())
-        ?.trim();
+    //
+    // `workspaceId` first is load-bearing: `vault_grants` rows are written with
+    // the id a workspace deploy assigns, so preferring the generic `id` would
+    // look grants up under a name nobody granted.
+    const app = getAppConfig().app;
+    const appId = app.workspaceId ?? app.id ?? app.name;
     if (!appId) {
         return { status: "denied", reason: "missing-app-id" };
     }

package/dist/server/embed-session.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { getCookie, getHeader, getQuery, setCookie, setResponseHeader, } from "h3";
+import { getAppConfig } from "../app-config/index.js";
 import { getDbExec, intType, isPostgres } from "../db/client.js";
 import { ensureTableExists } from "../db/ddl-guard.js";
 import { EMBED_MODE_QUERY_PARAM, EMBED_SESSION_COOKIE, EMBED_TARGET_HEADER, EMBED_TARGET_QUERY_PARAM, EMBED_TOKEN_QUERY_PARAM, } from "../shared/embed-auth.js";
@@ -651,7 +652,7 @@ function isHttpsRequest(event) {
         const url = event.url?.toString?.() ?? "";
         if (url.startsWith("https://"))
             return true;
-        const appUrl = process.env.APP_URL || process.env.BETTER_AUTH_URL || "";
+        const appUrl = getAppConfig().app.url ?? "";
         if (appUrl.startsWith("https://"))
             return true;
     }

package/dist/server/identity-sso.js

@@ -15,6 +15,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import { deleteCookie, getCookie, getHeader, getMethod, setCookie } from "h3";
 import * as jose from "jose";
+import { getAppConfig } from "../app-config/index.js";
 import { GOOGLE_AUTH_REQUIRED_MESSAGE, isGoogleSignInRequiredForEmail, } from "../org/auth-policy.js";
 import { SIGN_IN_ENTRY_PATH } from "../shared/sign-in-journey.js";
 import { getAppName } from "./app-name.js";
@@ -98,8 +99,11 @@ function normalizeAuthority(raw) {
     }
 }
 function resolveAppId(event) {
-    const configured = process.env.AGENT_NATIVE_APP_ID?.trim() ||
-        process.env.AGENT_NATIVE_WORKSPACE_APP_ID?.trim();
+    // Generic id first here, unlike credential scoping: SSO identifies this app
+    // instance to an authority, it does not look up a row keyed by the id a
+    // workspace deploy assigned.
+    const app = getAppConfig().app;
+    const configured = app.id ?? app.workspaceId;
     if (configured)
         return configured;
     const name = getAppName();

package/dist/server/index.d.ts

@@ -1,3 +1,4 @@
+export { defineAppConfig, getAppConfig, resetAppConfigForTests, appConfigSchema, type AppConfig, type AppConfigInput, } from "../app-config/index.js";
 export { createServer, type CreateServerOptions, type EnvKeyConfig, } from "./create-server.js";
 export { startIntervalJob, type IntervalJobOptions, type IntervalJobHandle, } from "./interval-job.js";
 export { AGENT_BACKGROUND_PROCESSOR_FIELD, AGENT_BACKGROUND_PROCESSOR_ROUTE, AGENT_BACKGROUND_PROCESSOR_ROUTE_FIELD, dispatchPathTargetsNetlifyBackgroundFunction, isInBackgroundFunctionRuntime, resolveDurableBackgroundDispatchPath, } from "../agent/durable-background.js";

package/dist/server/index.js

@@ -1,3 +1,4 @@
+export { defineAppConfig, getAppConfig, resetAppConfigForTests, appConfigSchema, } from "../app-config/index.js";
 export { createServer, } from "./create-server.js";
 export { startIntervalJob, } from "./interval-job.js";
 export { AGENT_BACKGROUND_PROCESSOR_FIELD, AGENT_BACKGROUND_PROCESSOR_ROUTE, AGENT_BACKGROUND_PROCESSOR_ROUTE_FIELD, dispatchPathTargetsNetlifyBackgroundFunction, isInBackgroundFunctionRuntime, resolveDurableBackgroundDispatchPath, } from "../agent/durable-background.js";

package/dist/server/oauth-public-origin.js

@@ -1,3 +1,4 @@
+import { getAppConfig } from "../app-config/index.js";
 function normalizeOrigin(raw) {
     if (!raw)
         return "";
@@ -21,21 +22,16 @@ function isLoopbackOrigin(origin) {
     }
 }
 export function getPublicOAuthOrigin() {
+    const config = getAppConfig();
+    // An OAuth callback has to be publicly reachable, so a loopback origin is
+    // useless and we keep looking. This used to walk eight env keys — each
+    // canonical spelling followed by its `VITE_` mirror — so a loopback
+    // `APP_URL` could still fall through to a public `BETTER_AUTH_URL`. Those
+    // are one declared value now, so the skip is per concept, not per spelling.
     for (const raw of [
-        process.env.WORKSPACE_OAUTH_ORIGIN,
-        process.env.VITE_WORKSPACE_OAUTH_ORIGIN,
-        process.env.APP_URL,
-        process.env.VITE_APP_URL,
-        process.env.BETTER_AUTH_URL,
-        process.env.VITE_BETTER_AUTH_URL,
-    ]) {
-        const origin = normalizeOrigin(raw);
-        if (origin && !isLoopbackOrigin(origin))
-            return origin;
-    }
-    for (const raw of [
-        process.env.WORKSPACE_GATEWAY_URL,
-        process.env.VITE_WORKSPACE_GATEWAY_URL,
+        config.workspace.oauthOrigin,
+        config.app.url,
+        config.workspace.gatewayUrl,
     ]) {
         const origin = normalizeOrigin(raw);
         if (origin && !isLoopbackOrigin(origin))

package/dist/server/oauth-return-url.js

@@ -1,3 +1,4 @@
+import { getAppConfig } from "../app-config/index.js";
 function normalizeOrigin(raw) {
     if (!raw)
         return "";
@@ -39,15 +40,10 @@ function isBuilderPreviewOrigin(origin) {
     }
 }
 export function getWorkspaceGatewayReturnOrigin() {
-    for (const raw of [
-        process.env.WORKSPACE_GATEWAY_URL,
-        process.env.VITE_WORKSPACE_GATEWAY_URL,
-    ]) {
-        const origin = normalizeOrigin(raw);
-        if (origin && isLoopbackOrigin(origin))
-            return origin;
-    }
-    return "";
+    // Loopback-only, inverted from getPublicOAuthOrigin: this is the local-dev
+    // gateway a return URL may point back at.
+    const origin = normalizeOrigin(getAppConfig().workspace.gatewayUrl);
+    return origin && isLoopbackOrigin(origin) ? origin : "";
 }
 function allowedOAuthReturnOrigins(allowDefaultLoopback) {
     const out = new Set();

package/dist/server/self-dispatch.js

@@ -1,3 +1,4 @@
+import { getAppConfig } from "../app-config/index.js";
 import { isLocalDatabase } from "../db/client.js";
 import { signInternalToken } from "../integrations/internal-token.js";
 /**
@@ -57,11 +58,13 @@ function readHeader(event, name) {
  * fallback to a bad host there would drop background work invisibly.
  */
 export function resolveSelfDispatchBaseUrl(event) {
+    // The first three are platform facts — Netlify sets them per deploy, and
+    // they are what makes this resolve to *this* deployment rather than the
+    // canonical one. `app.url` is the last rung, not the first, for that reason.
     const fromEnv = process.env.DEPLOY_PRIME_URL ||
         process.env.DEPLOY_URL ||
         process.env.URL ||
-        process.env.APP_URL ||
-        process.env.BETTER_AUTH_URL;
+        getAppConfig().app.url;
     if (fromEnv)
         return withConfiguredAppBasePath(String(fromEnv));
     if (process.env.NODE_ENV === "production" || !isLocalDatabase()) {

package/dist/server/ssr-handler.js

@@ -21,6 +21,7 @@ import { isMcpPublicPath } from "../mcp/route-paths.js";
 import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, } from "../shared/cache-control.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { getAppBasePathFromViteEnv, stripAppBasePath as canonicalStripAppBasePath, } from "./app-base-path.js";
+import { getAppOriginClientConfigScript } from "./app-origin-config.js";
 import { captureError } from "./capture-error.js";
 import { getPostHogClientConfigScript } from "./posthog-config.js";
 import { runWithRequestContext } from "./request-context.js";
@@ -307,6 +308,7 @@ async function rewriteMountedResponse(response, basePath, pathname, requestUrl)
         getSentryClientConfigScript(),
         getPostHogClientConfigScript(),
         getRealtimeClientConfigScript(),
+        getAppOriginClientConfigScript(),
     ]
         .filter(Boolean)
         .join("") || null;

package/dist/server/workspace-provider-oauth.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { deleteCookie, defineEventHandler, getCookie, getMethod, getQuery, setCookie, setResponseStatus, } from "h3";
+import { getAppConfig } from "../app-config/index.js";
 import { getWorkspaceConnectionProvider, } from "../connections/catalog.js";
 import { saveOAuthTokens, setOAuthDisplayName } from "../oauth-tokens/store.js";
 import { getRegisteredAppRoles, resolveAppRole } from "../org/app-roles.js";
@@ -44,10 +45,7 @@ export async function handleWorkspaceProviderOAuthStart(event, providerId) {
     if (!session?.email)
         return unauthorized(event);
     const query = getQuery(event);
-    const appId = normalizeAppId(text(query.appId) ??
-        process.env.AGENT_NATIVE_WORKSPACE_APP_ID ??
-        process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID ??
-        "creative-context");
+    const appId = normalizeAppId(text(query.appId) ?? getAppConfig().app.workspaceId ?? "creative-context");
     const orgContext = await requireWorkspaceProviderOAuthAdmin(event, appId);
     if (!orgContext) {
         return { error: WORKSPACE_OAUTH_ADMIN_ERROR };