@agent-native/core 0.165.3 → 0.167.0

package/dist/agent/engine/registry.js

@@ -552,26 +552,36 @@ async function resolveProviderBaseUrl(envVar) {
         })
         : undefined;
 }
+/**
+ * `null` means no custody — fall through to keys. Must mirror
+ * `BuilderGatewayEngine.stream`'s auth choice exactly: a preflight stricter
+ * than the engine rejects turns the engine would have served.
+ */
+async function builderOAuthLaneUsable(identity) {
+    const ownerEmail = identity?.userEmail?.trim().toLowerCase() || getRequestUserEmail();
+    if (!ownerEmail || !(await hasBuilderOAuthSession(ownerEmail)))
+        return null;
+    try {
+        return Boolean(await resolveBuilderOAuthRequestAccess({
+            ownerEmail,
+            requiredScope: BUILDER_OAUTH_SCOPE,
+        }));
+    }
+    catch {
+        // coercion-ok: custody present but unusable is "not usable", not absent;
+        // reconnect UX is owned by /builder/status, not this boolean probe.
+        return false;
+    }
+}
 /**
  * A Builder connection we could not read is not a missing connection. Throwing
  * keeps that distinction instead of reporting "connect a provider" to a user
  * whose org-shared keys exist but were unreadable.
  */
 async function hasUsableBuilderConnection(identity) {
-    const ownerEmail = identity?.userEmail?.trim().toLowerCase() || getRequestUserEmail();
-    if (ownerEmail && (await hasBuilderOAuthSession(ownerEmail))) {
-        try {
-            return Boolean(await resolveBuilderOAuthRequestAccess({
-                ownerEmail,
-                requiredScope: BUILDER_OAUTH_SCOPE,
-            }));
-        }
-        catch {
-            // coercion-ok: custody present but unusable is "not usable", not absent;
-            // reconnect UX is owned by /builder/status, not this boolean probe.
-            return false;
-        }
-    }
+    const oauthLane = await builderOAuthLaneUsable(identity);
+    if (oauthLane !== null)
+        return oauthLane;
     const creds = await resolveBuilderCredentialsDetailed(identity);
     assertCredentialStoreReadable(creds);
     return Boolean(creds.privateKey && creds.publicKey);
@@ -581,6 +591,9 @@ async function hasUsableBuilderConnection(identity) {
  * "did this user connect Builder" and is false on every credits-only site.
  */
 async function canRunBuilderEngine(identity) {
+    const oauthLane = await builderOAuthLaneUsable(identity);
+    if (oauthLane !== null)
+        return oauthLane;
     const creds = await resolveBuilderGatewayCredentialsDetailed(identity);
     assertCredentialStoreReadable(creds);
     return Boolean(creds.privateKey && creds.publicKey);

package/dist/agent/index.d.ts

@@ -1,4 +1,4 @@
-export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type AgentActionSurface, type AgentActionSurfaceDetails, type AgentLoopFinalResponseGuard, type AgentLoopFinalResponseGuardContext, type AgentLoopFinalResponseGuardResult, type AgentLoopToolCallSummary, type AgentLoopToolResultSummary, } from "./production-agent.js";
+export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type AgentActionSurface, type DefaultAgentActionSurface, type AgentActionSurfaceResolution, type AgentActionSurfaceDetails, type AgentLoopFinalResponseGuard, type AgentLoopFinalResponseGuardContext, type AgentLoopFinalResponseGuardResult, type AgentLoopToolCallSummary, type AgentLoopToolResultSummary, } from "./production-agent.js";
 export { type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, type AgentChatReference, type MentionProvider, type MentionProviderItem, } from "./types.js";
 export { TripWire, type Processor, type ProcessorState, type ProcessorAbort, type ProcessOutputStreamArgs, type ProcessOutputStepArgs, type ProcessOutputResultArgs, } from "./processors.js";
 export { DEFAULT_MODEL } from "./default-model.js";

package/dist/agent/production-agent.d.ts

@@ -259,6 +259,14 @@ export type AgentExecutionMode = "act" | "plan";
 export interface AgentActionSurface {
     allowedActionNames: readonly string[];
 }
+export interface DefaultAgentActionSurface {
+    mode: "default";
+}
+export type AgentActionSurfaceResolution = AgentActionSurface | DefaultAgentActionSurface;
+type NormalizedAgentActionSurface = DefaultAgentActionSurface | {
+    mode: "allowlist";
+    allowedActionNames: string[];
+};
 export interface AgentActionSurfaceDetails {
     event: any;
     ownerEmail: string | null;
@@ -271,10 +279,14 @@ export interface AgentActionSurfaceDetails {
 /** Read a persisted allowlist while preserving legacy absence and failing
  * closed when the field is present but malformed. */
 export declare function readPersistedAllowedActionNames(value: unknown): string[] | undefined;
-export interface PersistedActionSurface {
+export declare function normalizeAgentActionSurfaceResolution(value: unknown): NormalizedAgentActionSurface;
+export type PersistedActionSurface = {
     orgId: string | null;
     allowedActionNames: string[];
-}
+} | {
+    orgId: string | null;
+    mode: "default";
+};
 /** Read a nested persisted action surface. An absent envelope is legacy;
  * a present but invalid envelope is an explicit org-less, empty surface. */
 export declare function readPersistedActionSurface(value: unknown, propertyName: string): PersistedActionSurface | undefined;
@@ -342,11 +354,12 @@ export interface ProductionAgentOptions {
     }>;
     /**
      * Resolve the exact action registry exposed to one interactive agent-chat
-     * request. Returned names are a hard allowlist: omitted actions are absent
-     * from both the provider schemas and the searchable registry. When set, all
-     * allowed actions are loaded directly on the first model request.
+     * request. Return an allowlist to remove omitted actions from both provider
+     * schemas and the searchable registry, or `{ mode: "default" }` to preserve
+     * the normal initial-tool and discovery behavior for that request. Every
+     * allowlisted action is loaded directly on the first model request.
      */
-    resolveActionSurface?: (details: AgentActionSurfaceDetails) => AgentActionSurface | Promise<AgentActionSurface>;
+    resolveActionSurface?: (details: AgentActionSurfaceDetails) => AgentActionSurfaceResolution | Promise<AgentActionSurfaceResolution>;
     /** Optional per-app agent run chunk budget in milliseconds. Defaults to
      *  AGENT_RUN_SOFT_TIMEOUT_MS when set, otherwise no framework-imposed
      *  timeout. When reached, the client receives an internal auto-continuation

package/dist/agent/production-agent.js

@@ -411,13 +411,32 @@ export function readPersistedAllowedActionNames(value) {
     }
     return [...new Set(names)];
 }
+export function normalizeAgentActionSurfaceResolution(value) {
+    if (hasOwn(value, "mode")) {
+        if (value.mode === "default" && !hasOwn(value, "allowedActionNames")) {
+            return { mode: "default" };
+        }
+        throw new Error("resolveActionSurface returned an invalid default surface");
+    }
+    if (!hasOwn(value, "allowedActionNames")) {
+        throw new Error("resolveActionSurface returned an invalid action surface");
+    }
+    const allowedActionNames = value.allowedActionNames;
+    if (!Array.isArray(allowedActionNames) ||
+        !allowedActionNames.every((name) => typeof name === "string")) {
+        throw new Error("resolveActionSurface returned an invalid action surface");
+    }
+    return {
+        mode: "allowlist",
+        allowedActionNames: [...new Set(allowedActionNames)],
+    };
+}
 /** Read a nested persisted action surface. An absent envelope is legacy;
  * a present but invalid envelope is an explicit org-less, empty surface. */
 export function readPersistedActionSurface(value, propertyName) {
     if (!hasOwn(value, propertyName))
         return undefined;
     const surface = value[propertyName];
-    const allowedActionNames = readPersistedAllowedActionNames(surface) ?? [];
     if (!hasOwn(surface, "orgId")) {
         return { orgId: null, allowedActionNames: [] };
     }
@@ -426,6 +445,13 @@ export function readPersistedActionSurface(value, propertyName) {
         (typeof orgId !== "string" || orgId.trim().length === 0)) {
         return { orgId: null, allowedActionNames: [] };
     }
+    if (hasOwn(surface, "mode")) {
+        if (surface.mode === "default" && !hasOwn(surface, "allowedActionNames")) {
+            return { orgId, mode: "default" };
+        }
+        return { orgId: null, allowedActionNames: [] };
+    }
+    const allowedActionNames = readPersistedAllowedActionNames(surface) ?? [];
     return { orgId, allowedActionNames };
 }
 export function filterActionsByAllowedNames(actions, allowedActionNames) {
@@ -6560,6 +6586,7 @@ export function createProductionAgentHandler(options) {
             availableRequestActions = filterActionsByAllowedNames(availableRequestActions, filterHostedHarnessToolNames(Object.keys(availableRequestActions)));
         }
         let surfacedRequestActions = availableRequestActions;
+        let useDefaultRequestActionSurface = !options.resolveActionSurface;
         if (options.resolveActionSurface) {
             const persistedSurface = isBackgroundWorker
                 ? readPersistedActionSurface(body, "__resolvedActionSurface")
@@ -6575,19 +6602,33 @@ export function createProductionAgentHandler(options) {
                     internalContinuation: Boolean(internalContinuation),
                     availableActionNames: Object.keys(availableRequestActions),
                 });
-            surfacedRequestActions = filterActionsByAllowedNames(availableRequestActions, surface.allowedActionNames);
-            if (requestedHostedHarness) {
-                surfacedRequestActions = filterActionsByAllowedNames(surfacedRequestActions, filterHostedHarnessToolNames(Object.keys(surfacedRequestActions)));
-            }
-            const allowedNames = Object.keys(surfacedRequestActions);
+            const normalizedSurface = normalizeAgentActionSurfaceResolution(surface);
             const runCtx = ensureRequestRunContext();
-            if (runCtx)
-                runCtx.allowedActionNames = allowedNames;
-            if (!isBackgroundWorker) {
-                body.__resolvedActionSurface = {
-                    orgId: getRequestOrgId() ?? null,
-                    allowedActionNames: allowedNames,
-                };
+            if (normalizedSurface.mode === "default") {
+                useDefaultRequestActionSurface = true;
+                if (runCtx)
+                    delete runCtx.allowedActionNames;
+                if (!isBackgroundWorker) {
+                    body.__resolvedActionSurface = {
+                        orgId: getRequestOrgId() ?? null,
+                        mode: "default",
+                    };
+                }
+            }
+            else {
+                surfacedRequestActions = filterActionsByAllowedNames(availableRequestActions, normalizedSurface.allowedActionNames);
+                if (requestedHostedHarness) {
+                    surfacedRequestActions = filterActionsByAllowedNames(surfacedRequestActions, filterHostedHarnessToolNames(Object.keys(surfacedRequestActions)));
+                }
+                const allowedNames = Object.keys(surfacedRequestActions);
+                if (runCtx)
+                    runCtx.allowedActionNames = allowedNames;
+                if (!isBackgroundWorker) {
+                    body.__resolvedActionSurface = {
+                        orgId: getRequestOrgId() ?? null,
+                        allowedActionNames: allowedNames,
+                    };
+                }
             }
         }
         // DIAGNOSTIC-ONLY: owner/request context prep (resolveAgentOwnerEmail +
@@ -7075,9 +7116,9 @@ export function createProductionAgentHandler(options) {
             ? createPlanModeActionRegistry(surfacedRequestActions)
             : surfacedRequestActions;
         const availableRequestTools = getEngineTools(requestActions);
-        const initialRequestTools = options.resolveActionSurface
-            ? availableRequestTools
-            : filterInitialEngineTools(availableRequestTools, options.initialToolNames);
+        const initialRequestTools = useDefaultRequestActionSurface
+            ? filterInitialEngineTools(availableRequestTools, options.initialToolNames)
+            : availableRequestTools;
         const requestTools = requestMode === "plan"
             ? preloadPlanModeEngineTools({
                 request: requestMessage,

package/dist/agent/types.d.ts

@@ -208,6 +208,9 @@ export interface AgentChatRequest {
     __resolvedActionSurface?: {
         orgId: string | null;
         allowedActionNames: string[];
+    } | {
+        orgId: string | null;
+        mode: "default";
     };
     /**
      * Stable identity for the logical assistant turn this request belongs to.

package/dist/changelog/parse.d.ts

@@ -34,8 +34,8 @@ export interface PendingChangelogEntry {
     text: string;
 }
 export type ChangelogChangeType = "added" | "improved" | "fixed" | "changed" | "removed" | "security";
-export declare const DEFAULT_CHANGELOG_RELEASE_LIMIT = 5;
-export declare const CHANGELOG_ARCHIVE_NOTE = "Older updates live in [the changelog folder](./changelog/) and are included in the in-app \"What's new\" view.";
+export declare const DEFAULT_CHANGELOG_RELEASE_LIMIT = 100;
+export declare const CHANGELOG_ARCHIVE_NOTE = "For the full list of updates, see the [changelog folder](./changelog/).";
 /**
  * Order changes are grouped under a release heading. Anything not listed here
  * falls back to the "changed" group, then renders in insertion order.
@@ -78,7 +78,7 @@ export declare function rollupChangelog(existing: string, pending: PendingChange
  */
 export declare function mergePendingChangelog(existing: string, pending: PendingChangelogEntry[]): string;
 /**
- * Keep a short, human-readable release window in `CHANGELOG.md` while the
+ * Keep a bounded, human-readable release window in `CHANGELOG.md` while the
  * dated `changelog/*.md` files remain the complete source for app history.
  * The Vite raw-import path can still expand the full folder-backed history.
  */

package/dist/changelog/parse.js

@@ -11,8 +11,9 @@
  * markdown shape is the conventional "Keep a Changelog" layout — a top-level
  * `# Changelog` heading followed by one `## <release>` section per release.
  */
-export const DEFAULT_CHANGELOG_RELEASE_LIMIT = 5;
-export const CHANGELOG_ARCHIVE_NOTE = 'Older updates live in [the changelog folder](./changelog/) and are included in the in-app "What\'s new" view.';
+export const DEFAULT_CHANGELOG_RELEASE_LIMIT = 100;
+export const CHANGELOG_ARCHIVE_NOTE = "For the full list of updates, see the [changelog folder](./changelog/).";
+const LEGACY_CHANGELOG_ARCHIVE_NOTE = 'Older updates live in [the changelog folder](./changelog/) and are included in the in-app "What\'s new" view.';
 /**
  * Order changes are grouped under a release heading. Anything not listed here
  * falls back to the "changed" group, then renders in insertion order.
@@ -34,6 +35,9 @@ const GROUP_LABELS = {
     security: "Security",
 };
 const ISO_DATE = /(\d{4}-\d{2}-\d{2})/;
+function cleanChangelogBody(value) {
+    return value.trim();
+}
 /** Lowercase, hyphenate, and strip to a URL/id-safe slug. */
 export function changelogSlug(value) {
     return value
@@ -154,7 +158,7 @@ export function parsePendingEntry(content, fallbackDate) {
 export function renderReleaseBody(entries) {
     const groups = new Map();
     for (const entry of entries) {
-        const text = entry.text.trim();
+        const text = cleanChangelogBody(entry.text);
         if (!text)
             continue;
         const bullet = text.includes("\n")
@@ -206,6 +210,13 @@ function changelogHeader(markdown) {
     const header = (firstRelease === -1 ? doc : doc.slice(0, firstRelease)).replace(/\s+$/, "") || CHANGELOG_HEADER.trim();
     return header;
 }
+function stripChangelogArchiveNotes(markdown) {
+    return markdown
+        .replace(CHANGELOG_ARCHIVE_NOTE, "")
+        .replace(LEGACY_CHANGELOG_ARCHIVE_NOTE, "")
+        .replace(/\n{3,}/g, "\n\n")
+        .replace(/\s+$/, "");
+}
 function pendingSectionTitle(entry) {
     return entry.date?.match(ISO_DATE)?.[1] ?? "Unreleased";
 }
@@ -233,7 +244,8 @@ function normalizedChangelogText(value) {
  * without moving or deleting the conflict-free entry files.
  */
 export function mergePendingChangelog(existing, pending) {
-    const existingEntries = parseChangelog(existing);
+    const cleanExisting = stripChangelogArchiveNotes(existing);
+    const existingEntries = parseChangelog(cleanExisting);
     const pendingWithText = pending.filter((entry) => {
         const text = entry.text.trim();
         if (!text)
@@ -247,8 +259,12 @@ export function mergePendingChangelog(existing, pending) {
             return normalizedChangelogText(existingEntry.body).includes(normalizedChangelogText(text));
         });
     });
-    if (pendingWithText.length === 0)
-        return existing || CHANGELOG_HEADER;
+    if (pendingWithText.length === 0) {
+        const sections = existingEntries
+            .map((entry) => `## ${entry.title}\n\n${cleanChangelogBody(entry.body)}`)
+            .join("\n\n");
+        return `${changelogHeader(cleanExisting)}${sections ? `\n\n${sections}` : ""}\n\n${CHANGELOG_ARCHIVE_NOTE}\n`;
+    }
     const pendingByTitle = new Map();
     for (const entry of pendingWithText) {
         const title = pendingSectionTitle(entry);
@@ -257,7 +273,7 @@ export function mergePendingChangelog(existing, pending) {
     const sections = existingEntries.map((entry) => ({
         title: entry.title,
         date: entry.date,
-        body: entry.body,
+        body: cleanChangelogBody(entry.body),
     }));
     for (const title of [...pendingByTitle.keys()].sort(pendingSectionSort)) {
         const body = renderReleaseBody(pendingByTitle.get(title) ?? []);
@@ -267,7 +283,10 @@ export function mergePendingChangelog(existing, pending) {
             return entry.date === title || entry.title === title;
         });
         if (existingIndex !== -1) {
-            sections[existingIndex].body = [body, sections[existingIndex].body]
+            sections[existingIndex].body = [
+                body,
+                cleanChangelogBody(sections[existingIndex].body),
+            ]
                 .filter(Boolean)
                 .join("\n\n");
             continue;
@@ -278,26 +297,26 @@ export function mergePendingChangelog(existing, pending) {
             : 0;
         sections.splice(insertAt === -1 ? sections.length : insertAt, 0, newSection);
     }
-    return `${changelogHeader(existing)}\n\n${sections
-        .map((entry) => `## ${entry.title}\n\n${entry.body}`)
-        .join("\n\n")}\n`;
+    return `${changelogHeader(cleanExisting)}\n\n${sections
+        .map((entry) => `## ${entry.title}\n\n${cleanChangelogBody(entry.body)}`)
+        .join("\n\n")}\n\n${CHANGELOG_ARCHIVE_NOTE}\n`;
 }
 /**
- * Keep a short, human-readable release window in `CHANGELOG.md` while the
+ * Keep a bounded, human-readable release window in `CHANGELOG.md` while the
  * dated `changelog/*.md` files remain the complete source for app history.
  * The Vite raw-import path can still expand the full folder-backed history.
  */
 export function compactChangelog(existing, folderEntries, releaseLimit = DEFAULT_CHANGELOG_RELEASE_LIMIT) {
     const merged = mergePendingChangelog(existing, folderEntries);
-    const entries = parseChangelog(merged).slice(0, Math.max(1, releaseLimit));
-    const header = changelogHeader(merged)
-        .replace(CHANGELOG_ARCHIVE_NOTE, "")
+    const cleanMerged = stripChangelogArchiveNotes(merged);
+    const entries = parseChangelog(cleanMerged).slice(0, Math.max(1, releaseLimit));
+    const header = changelogHeader(cleanMerged)
         .replace(/\n{3,}/g, "\n\n")
         .trim();
     const sections = entries.map((entry) => `## ${entry.title}\n\n${entry.body}`);
     if (sections.length === 0) {
         return `${header || CHANGELOG_HEADER.trim()}\n\n${CHANGELOG_ARCHIVE_NOTE}\n`;
     }
-    return `${header || CHANGELOG_HEADER.trim()}\n\n${CHANGELOG_ARCHIVE_NOTE}\n\n${sections.join("\n\n")}\n`;
+    return `${header || CHANGELOG_HEADER.trim()}\n\n${sections.join("\n\n")}\n\n${CHANGELOG_ARCHIVE_NOTE}\n`;
 }
 export { CHANGELOG_HEADER, GROUP_LABELS };

package/dist/client/EnvironmentBadge.d.ts

@@ -1,6 +1,7 @@
 import type { AgentNativeDeploymentEnvironment, AgentNativeConfig } from "../config.js";
 export { BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, buildEnvironmentOptOutUrl, buildEnvironmentUrl, resolveEnvironmentTargets, type EnvironmentBadgeTargets, } from "../shared/environment-lanes.js";
 export declare function isBuilderIoEmployee(email: string | null | undefined): boolean;
+export declare function isAgentNativeDesktopUserAgent(userAgent: string | undefined): boolean;
 export declare function resolveEnvironmentChannel(config: AgentNativeConfig, hostname: string | undefined): Extract<AgentNativeDeploymentEnvironment, "beta" | "production"> | null;
 export declare function isBetaOptOutActive(value: string | number | null | undefined, now?: number): boolean;
 /**

package/dist/client/EnvironmentBadge.js

@@ -10,6 +10,9 @@ export { BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAG
 export function isBuilderIoEmployee(email) {
     return email?.trim().toLowerCase().endsWith("@builder.io") ?? false;
 }
+export function isAgentNativeDesktopUserAgent(userAgent) {
+    return /AgentNativeDesktop/i.test(userAgent ?? "");
+}
 export function resolveEnvironmentChannel(config, hostname) {
     const configured = config.deployment?.environment;
     if (configured === "beta" || configured === "production") {
@@ -98,6 +101,10 @@ function ProductionEnvironmentBadge({ targets, }) {
         if (!isEligible || didAutoRedirect.current) {
             return;
         }
+        // Desktop child sessions are minted against their configured production
+        // origin. Do not move that WebView to beta after the session is created.
+        if (isAgentNativeDesktopUserAgent(window.navigator.userAgent))
+            return;
         if (readBetaOptOutUntil() !== null)
             return;
         if (consumeBetaOptOutQueryParam(window.location.href))

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/config.d.ts

@@ -101,6 +101,17 @@ export type AgentNativeConfigInput = AgentNativeConfig | AgentNativeConfigFactor
  * phase, while the browser only receives the resolved serializable result.
  */
 export declare function defineAgentNativeConfig(config: AgentNativeConfigInput): AgentNativeConfigInput;
+export declare const AGENT_NATIVE_CONFIG_ENV_PREFIX: "AGENT_NATIVE_CONFIG";
+/** Convert a config path such as `runtime.auth.enabled` to its env name. */
+export declare function agentNativeConfigEnvName(path: readonly string[]): string;
+/**
+ * Reads the public config's deterministic environment aliases.
+ *
+ * `AGENT_NATIVE_CONFIG` contains a complete JSON object. A suffixed name
+ * contains a JSON fragment at that config path, or a typed scalar at a leaf.
+ * Nodes are applied from shallowest to deepest so a more specific path wins.
+ */
+export declare function readAgentNativeConfigEnv(env: Record<string, string | undefined>): AgentNativeConfig;
 export declare function normalizeAgentNativeConfig(input: unknown, source?: string): AgentNativeConfig;
 export declare function mergeAgentNativeConfigs(base: AgentNativeConfig, override: AgentNativeConfig): AgentNativeConfig;
 export declare function resolveAgentNativeConfig(input: AgentNativeConfigInput | undefined, context: AgentNativeConfigContext): AgentNativeConfig;