@agent-native/core 0.165.4 → 0.167.0

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/config.d.ts

@@ -101,6 +101,17 @@ export type AgentNativeConfigInput = AgentNativeConfig | AgentNativeConfigFactor
  * phase, while the browser only receives the resolved serializable result.
  */
 export declare function defineAgentNativeConfig(config: AgentNativeConfigInput): AgentNativeConfigInput;
+export declare const AGENT_NATIVE_CONFIG_ENV_PREFIX: "AGENT_NATIVE_CONFIG";
+/** Convert a config path such as `runtime.auth.enabled` to its env name. */
+export declare function agentNativeConfigEnvName(path: readonly string[]): string;
+/**
+ * Reads the public config's deterministic environment aliases.
+ *
+ * `AGENT_NATIVE_CONFIG` contains a complete JSON object. A suffixed name
+ * contains a JSON fragment at that config path, or a typed scalar at a leaf.
+ * Nodes are applied from shallowest to deepest so a more specific path wins.
+ */
+export declare function readAgentNativeConfigEnv(env: Record<string, string | undefined>): AgentNativeConfig;
 export declare function normalizeAgentNativeConfig(input: unknown, source?: string): AgentNativeConfig;
 export declare function mergeAgentNativeConfigs(base: AgentNativeConfig, override: AgentNativeConfig): AgentNativeConfig;
 export declare function resolveAgentNativeConfig(input: AgentNativeConfigInput | undefined, context: AgentNativeConfigContext): AgentNativeConfig;

package/dist/config.js

@@ -16,6 +16,254 @@ export const AGENT_NATIVE_CONFIG_VERSION = 1;
 export function defineAgentNativeConfig(config) {
     return config;
 }
+export const AGENT_NATIVE_CONFIG_ENV_PREFIX = "AGENT_NATIVE_CONFIG";
+/**
+ * Serializable public config nodes that may be initialized from the
+ * deployment environment. Object nodes accept JSON fragments, which lets a
+ * deploy set a whole section without requiring a separate alias for every
+ * leaf. Dynamic keys in the onboarding mode map stay JSON-only at the union
+ * node because they are not part of the fixed config shape.
+ */
+const AGENT_NATIVE_CONFIG_ENV_NODES = [
+    { path: [], kind: "object" },
+    { path: ["version"], kind: "number" },
+    { path: ["onboarding"], kind: "object" },
+    {
+        path: ["onboarding", "firstRun"],
+        kind: "union",
+        dynamicObjectKeys: true,
+    },
+    { path: ["runtime"], kind: "object" },
+    { path: ["runtime", "auth"], kind: "object" },
+    { path: ["runtime", "auth", "enabled"], kind: "boolean" },
+    { path: ["runtime", "database"], kind: "object" },
+    { path: ["runtime", "database", "required"], kind: "boolean" },
+    { path: ["runtime", "environment"], kind: "object" },
+    {
+        path: ["runtime", "environment", "required"],
+        kind: "array",
+    },
+    { path: ["deployment"], kind: "object" },
+    {
+        path: ["deployment", "environment"],
+        kind: "deployment-environment",
+    },
+    { path: ["diagnostics"], kind: "object" },
+    { path: ["diagnostics", "failOnBuild"], kind: "boolean" },
+    { path: ["instructions"], kind: "object" },
+    { path: ["instructions", "runtime"], kind: "string" },
+    { path: ["instructions", "development"], kind: "string" },
+    { path: ["translations"], kind: "object" },
+    { path: ["translations", "locales"], kind: "array" },
+    { path: ["changelog"], kind: "object" },
+    { path: ["changelog", "enabled"], kind: "boolean" },
+    { path: ["harness"], kind: "union" },
+    { path: ["harness", "runtimes"], kind: "array" },
+];
+function agentNativeConfigEnvSegment(segment) {
+    return segment
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .replace(/[^A-Za-z0-9]+/g, "_")
+        .replace(/_+/g, "_")
+        .replace(/^_|_$/g, "")
+        .toUpperCase();
+}
+/** Convert a config path such as `runtime.auth.enabled` to its env name. */
+export function agentNativeConfigEnvName(path) {
+    if (path.length === 0)
+        return AGENT_NATIVE_CONFIG_ENV_PREFIX;
+    return `${AGENT_NATIVE_CONFIG_ENV_PREFIX}_${path
+        .map(agentNativeConfigEnvSegment)
+        .join("_")}`;
+}
+function agentNativeConfigEnvKeys(node) {
+    return [agentNativeConfigEnvName(node.path), ...(node.aliases ?? [])];
+}
+function isAgentNativeConfigEnvKey(key) {
+    return (key === AGENT_NATIVE_CONFIG_ENV_PREFIX ||
+        key.startsWith(`${AGENT_NATIVE_CONFIG_ENV_PREFIX}_`));
+}
+function parseAgentNativeConfigJson(raw, key) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`${key} must contain valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function parseAgentNativeConfigEnvValue(raw, key, kind) {
+    const value = raw.trim();
+    switch (kind) {
+        case "object": {
+            const parsed = parseAgentNativeConfigJson(value, key);
+            if (!isRecord(parsed)) {
+                throw new Error(`${key} must contain a JSON object`);
+            }
+            return parsed;
+        }
+        case "array": {
+            const parsed = parseAgentNativeConfigJson(value, key);
+            if (!Array.isArray(parsed)) {
+                throw new Error(`${key} must contain a JSON array`);
+            }
+            return parsed;
+        }
+        case "boolean": {
+            const normalized = value.toLowerCase();
+            if (["1", "true", "yes", "on"].includes(normalized))
+                return true;
+            if (["0", "false", "no", "off"].includes(normalized))
+                return false;
+            throw new Error(`${key} must be a boolean`);
+        }
+        case "number": {
+            const parsed = Number(value);
+            if (!Number.isFinite(parsed))
+                throw new Error(`${key} must be a number`);
+            return parsed;
+        }
+        case "deployment-environment":
+            return value.toLowerCase();
+        case "string": {
+            if (value.startsWith('"')) {
+                const parsed = parseAgentNativeConfigJson(value, key);
+                if (typeof parsed !== "string") {
+                    throw new Error(`${key} must contain a string`);
+                }
+                return parsed;
+            }
+            return value;
+        }
+        case "union": {
+            if (value.startsWith("{") || value.startsWith("[")) {
+                return parseAgentNativeConfigJson(value, key);
+            }
+            const normalized = value.toLowerCase();
+            if (["1", "true", "yes", "on"].includes(normalized))
+                return true;
+            if (["0", "false", "no", "off"].includes(normalized))
+                return false;
+            if (value.startsWith('"')) {
+                const parsed = parseAgentNativeConfigJson(value, key);
+                if (typeof parsed !== "string") {
+                    throw new Error(`${key} must contain a string or JSON object`);
+                }
+                return parsed;
+            }
+            return value;
+        }
+    }
+}
+function agentNativeConfigEnvNodeForPath(path) {
+    return AGENT_NATIVE_CONFIG_ENV_NODES.find((node) => node.path.length === path.length &&
+        node.path.every((segment, index) => segment === path[index]));
+}
+function agentNativeConfigEnvChildren(path) {
+    return AGENT_NATIVE_CONFIG_ENV_NODES.filter((node) => node.path.length === path.length + 1 &&
+        path.every((segment, index) => node.path[index] === segment));
+}
+function validateAgentNativeConfigEnvFragment(value, path, key) {
+    const node = agentNativeConfigEnvNodeForPath(path);
+    if (!node)
+        return;
+    if (node.kind === "object") {
+        if (!isRecord(value)) {
+            throw new Error(`${key} must contain a JSON object`);
+        }
+    }
+    else if (node.kind !== "union" || !isRecord(value)) {
+        return;
+    }
+    if (node.dynamicObjectKeys)
+        return;
+    const children = new Map(agentNativeConfigEnvChildren(path).map((child) => [
+        child.path[child.path.length - 1],
+        child,
+    ]));
+    for (const [childKey, childValue] of Object.entries(value)) {
+        const child = children.get(childKey);
+        if (!child) {
+            const childPath = [...path, childKey].join(".");
+            throw new Error(`${key} contains unsupported Agent-Native config path ${childPath}`);
+        }
+        validateAgentNativeConfigEnvFragment(childValue, child.path, key);
+    }
+}
+function mergeAgentNativeConfigEnvFragments(base, override) {
+    const result = { ...base };
+    for (const [key, value] of Object.entries(override)) {
+        const existing = result[key];
+        result[key] =
+            isRecord(existing) && isRecord(value)
+                ? mergeAgentNativeConfigEnvFragments(existing, value)
+                : value;
+    }
+    return result;
+}
+function assignAgentNativeConfigEnvFragment(target, path, value, key) {
+    if (path.length === 0) {
+        if (!isRecord(value)) {
+            throw new Error(`${key} must contain a JSON object`);
+        }
+        Object.assign(target, mergeAgentNativeConfigEnvFragments(target, value));
+        return;
+    }
+    let node = target;
+    for (const segment of path.slice(0, -1)) {
+        const existing = node[segment];
+        if (existing === undefined) {
+            node[segment] = {};
+        }
+        else if (!isRecord(existing)) {
+            node[segment] = {};
+        }
+        node = node[segment];
+    }
+    const leaf = path[path.length - 1];
+    const existing = node[leaf];
+    node[leaf] =
+        isRecord(existing) && isRecord(value)
+            ? mergeAgentNativeConfigEnvFragments(existing, value)
+            : value;
+}
+/**
+ * Reads the public config's deterministic environment aliases.
+ *
+ * `AGENT_NATIVE_CONFIG` contains a complete JSON object. A suffixed name
+ * contains a JSON fragment at that config path, or a typed scalar at a leaf.
+ * Nodes are applied from shallowest to deepest so a more specific path wins.
+ */
+export function readAgentNativeConfigEnv(env) {
+    const known = new Map();
+    for (const node of AGENT_NATIVE_CONFIG_ENV_NODES) {
+        for (const key of agentNativeConfigEnvKeys(node)) {
+            const previous = known.get(key);
+            if (previous && previous.path.join(".") !== node.path.join(".")) {
+                throw new Error(`Duplicate Agent-Native config environment key ${key}`);
+            }
+            known.set(key, node);
+        }
+    }
+    for (const key of Object.keys(env)) {
+        if (isAgentNativeConfigEnvKey(key) && !known.has(key)) {
+            throw new Error(`${key} is not a supported Agent-Native config path. Use agent-native.config.ts or a documented config env alias.`);
+        }
+    }
+    const layer = {};
+    const nodes = [...AGENT_NATIVE_CONFIG_ENV_NODES].sort((left, right) => left.path.length - right.path.length);
+    for (const node of nodes) {
+        for (const key of agentNativeConfigEnvKeys(node)) {
+            const raw = env[key];
+            if (raw === undefined || raw.trim() === "")
+                continue;
+            const value = parseAgentNativeConfigEnvValue(raw, key, node.kind);
+            validateAgentNativeConfigEnvFragment(value, node.path, key);
+            assignAgentNativeConfigEnvFragment(layer, node.path, value, key);
+            break;
+        }
+    }
+    return normalizeAgentNativeConfig(layer, "Agent-Native config environment");
+}
 export function normalizeAgentNativeConfig(input, source = "agent-native config") {
     if (!isRecord(input)) {
         throw new Error(`${source} must export an object`);

package/dist/deploy/build.js

@@ -18,10 +18,12 @@ import fs from "fs";
 import { createRequire } from "module";
 import path from "path";
 import { fileURLToPath } from "url";
+import { loadEnv } from "vite";
 import { AGENT_BACKGROUND_FUNCTION_NAME, AGENT_BACKGROUND_FUNCTION_URL_PATH, AGENT_BACKGROUND_PROCESSOR_A2A, AGENT_BACKGROUND_PROCESSOR_FIELD, AGENT_BACKGROUND_PROCESSOR_INTEGRATION, AGENT_BACKGROUND_PROCESSOR_ROUTE, AGENT_BACKGROUND_PROCESSOR_ROUTE_FIELD, AGENT_CHAT_PROCESS_RUN_PATH, isDurableBackgroundFlagExplicitlyDisabled, } from "../agent/durable-background.js";
 import { INTEGRATION_RECOVERY_RUNTIME_MARKER, INTEGRATION_RETRY_SWEEP_PATH, INTEGRATION_RETRY_SWEEP_TOKEN_SUBJECT, isIntegrationDurableDispatchConfigured, } from "../integrations/integration-durable-dispatch-config.js";
 import { isValidCron } from "../jobs/cron.js";
 import { RECURRING_JOBS_SWEEP_PATH, RECURRING_JOBS_SWEEP_TOKEN_SUBJECT, } from "../jobs/scheduler-dispatch.js";
+import { findWorkspaceRoot as findAgentNativeWorkspaceRoot } from "../scripts/utils.js";
 import { normalizeAppBasePath } from "../server/app-base-path.js";
 import { DEFAULT_SPECULATION_RULES_PATH, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_QUERY_CACHE_KEY_HEADER, } from "../shared/cache-control.js";
 import { mcpEmbedStaticAssetRouteRules } from "../shared/mcp-embed-headers.js";
@@ -3922,7 +3924,16 @@ async function buildWithNitro() {
     // own virtual module registration. Both paths reuse `readAgentsBundleFromFs`
     // from `server/agents-bundle.ts` to guarantee identical content.
     const { readAgentsBundleFromFs } = await import("../server/agents-bundle.js");
-    const nitroAgentConfig = await loadResolvedAgentNativeConfig(cwd, createAgentNativeConfigContext("build", process.env.NODE_ENV === "development" ? "development" : "production"));
+    const nitroMode = process.env.NODE_ENV === "development" ? "development" : "production";
+    const agentNativeWorkspaceRoot = findAgentNativeWorkspaceRoot(cwd);
+    const nitroEnvironment = {
+        ...(agentNativeWorkspaceRoot && agentNativeWorkspaceRoot !== cwd
+            ? loadEnv(nitroMode, agentNativeWorkspaceRoot, "")
+            : {}),
+        ...loadEnv(nitroMode, cwd, ""),
+        ...process.env,
+    };
+    const nitroAgentConfig = await loadResolvedAgentNativeConfig(cwd, createAgentNativeConfigContext("build", nitroMode), { environment: nitroEnvironment });
     // Resolve the workspace core (if present) up front so the bundle embeds
     // enterprise-wide AGENTS.md + skills alongside the template's.
     const nitroWorkspaceCore = await getWorkspaceCoreExports(cwd);

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export * from "./config.js";
-export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type AgentActionSurface, type AgentActionSurfaceDetails, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, DEFAULT_MODEL, TripWire, type Processor, type ProcessorState, type ProcessorAbort, } from "./agent/index.js";
+export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type AgentActionSurface, type DefaultAgentActionSurface, type AgentActionSurfaceResolution, type AgentActionSurfaceDetails, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, DEFAULT_MODEL, TripWire, type Processor, type ProcessorState, type ProcessorAbort, } from "./agent/index.js";
 export { defineAction, ActionContractError, isActionContractError, type ActionContractErrorOptions, AgentActionStopError, isAgentActionStopError, type ActionDefinition, type ActionHttpConfig, type AgentActionStopOptions, type PublicAgentActionConfig, type ActionDeepLink, type ActionLinkBuilder, MCP_APP_EXTENSION_ID, MCP_APP_MIME_TYPE, MCP_APP_RESOURCE_URI_META_KEY, type ActionMcpAppConfig, type ActionMcpAppCsp, type ActionMcpAppCspBuilder, type ActionMcpAppHtmlBuilder, type ActionMcpAppPermissions, type ActionMcpAppResourceConfig, type ActionMcpAppResourceMeta, } from "./action.js";
 export * from "./user-profile/index.js";
 export { embedApp, MCP_APP_REQUEST_ORIGIN_CSP_SOURCE, type EmbedAppOptions, } from "./mcp/embed-app.js";

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
+    error?: undefined;
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,14 +41,14 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
 } | {
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/resources/handlers.d.ts

@@ -51,8 +51,8 @@ export declare function handleDeleteResource(event: any): Promise<{
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,10 +73,10 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
+    error?: undefined;
     url: string;
     provider: string;
     storageSetupRequired?: undefined;
-    error?: undefined;
 } | {
     error: string;
     storageSetupRequired: boolean;

package/dist/server/agent-chat/plugin-options.d.ts

@@ -171,8 +171,9 @@ export interface AgentChatPluginOptions {
     }>;
     /**
      * Resolve the exact native action surface for each interactive chat request.
-     * Omitted names are not sent to the model and are not discoverable through
-     * tool-search. When configured, every allowed action is loaded directly.
+     * Omitted allowlist names are not sent to the model or discoverable through
+     * tool-search. Return `{ mode: "default" }` to keep the normal initial-tool
+     * and discovery behavior for a request instead.
      */
     resolveActionSurface?: ProductionAgentOptions["resolveActionSurface"];
     /**

package/dist/server/agent-chat-plugin.js

@@ -13,7 +13,7 @@ import { resolveEngine, createAnthropicEngine, getStoredModelForEngine, normaliz
 import { SYSTEM_PROMPT_CACHE_SPLIT } from "../agent/engine/prompt-cache.js";
 import { PROVIDER_TO_ENV } from "../agent/engine/provider-env-vars.js";
 import { hostedHarnessSystemPrompt } from "../agent/harness/hosted.js";
-import { createProductionAgentHandler, actionsToEngineTools, executeAgentToolCall, filterActionsByAllowedNames, readPersistedActionSurface, toolCallCacheKey, getActiveRunForThreadAsync, abortRunDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
+import { createProductionAgentHandler, actionsToEngineTools, executeAgentToolCall, filterActionsByAllowedNames, normalizeAgentActionSurfaceResolution, readPersistedActionSurface, toolCallCacheKey, getActiveRunForThreadAsync, abortRunDurably, abortTurnDurably, subscribeToRun, } from "../agent/production-agent.js";
 import { callerHasRunAccess, callerHasThreadAccess, } from "../agent/run-ownership.js";
 import { markTurnAborted, readBackgroundRunClaim } from "../agent/run-store.js";
 import { buildCurrentTimeUserContext, buildRuntimeContextPrompt, } from "../agent/runtime-context.js";
@@ -2974,11 +2974,14 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             ...details,
                             availableActionNames: appActionNames,
                         });
+                        const normalizedSurface = normalizeAgentActionSurfaceResolution(surface);
+                        if (normalizedSurface.mode === "default")
+                            return surface;
                         const localActionNames = details.availableActionNames.filter((name) => localDevActionNames.has(name));
                         return {
                             allowedActionNames: [
                                 ...new Set([
-                                    ...surface.allowedActionNames,
+                                    ...normalizedSurface.allowedActionNames,
                                     ...localActionNames,
                                 ]),
                             ],

package/dist/server/index.d.ts

@@ -15,7 +15,7 @@ export { requireEnvKey, type MissingKeyResponse } from "./missing-key.js";
 export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";
 export { verifyCaptcha, type CaptchaVerifyResult } from "./captcha.js";
 export { getLocaleInitScript, parseAcceptLanguage, resolveLocaleFromRequest, type LocaleInitScriptOptions, type ResolveLocaleFromRequestOptions, type ResolvedRequestLocale, } from "../localization/server.js";
-export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type AgentActionSurface, type AgentActionSurfaceDetails, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, type AgentChatReference, type MentionProvider, type MentionProviderItem, type AgentLoopFinalResponseGuard, type AgentLoopFinalResponseGuardContext, type AgentLoopFinalResponseGuardResult, type AgentLoopToolCallSummary, type AgentLoopToolResultSummary, } from "../agent/index.js";
+export { createProductionAgentHandler, type ActionEntry, type ScriptEntry, type ProductionAgentOptions, type AgentActionSurface, type DefaultAgentActionSurface, type AgentActionSurfaceResolution, type AgentActionSurfaceDetails, type ActionTool, type ScriptTool, type AgentMessage, type AgentChatRequest, type AgentChatEvent, type AgentChatAttachment, type AgentChatReference, type MentionProvider, type MentionProviderItem, type AgentLoopFinalResponseGuard, type AgentLoopFinalResponseGuardContext, type AgentLoopFinalResponseGuardResult, type AgentLoopToolCallSummary, type AgentLoopToolResultSummary, } from "../agent/index.js";
 export { actionsToEngineTools, executeAgentToolCall, getOwnerActiveApiKey, getOwnerApiKeyForEngine, resolveOwnerEngineApiKey, runAgentLoop, type AgentToolCallExecutionResult, type ExecuteAgentToolCallOptions, type ResolvedOwnerApiKey, } from "../agent/production-agent.js";
 export { mountRealtimeVoiceRoutes, realtimeVoiceSafetyIdentifier, REALTIME_VOICE_MAX_SDP_BYTES, REALTIME_VOICE_MAX_TOOL_BODY_BYTES, REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS, REALTIME_VOICE_SESSION_PATH, REALTIME_VOICE_TOOL_PATH, type MountRealtimeVoiceRoutesOptions, type RealtimeVoiceRequestContext, type RealtimeVoiceToolExecutionRequest, type RealtimeVoiceToolExecutionResult, } from "./realtime-voice.js";
 export { getStoredModelForEngine, resolveEngine, } from "../agent/engine/index.js";

package/dist/templates/chat/.agents/skills/secrets/SKILL.md

@@ -38,7 +38,11 @@ connection exists:
   register a `kind: "oauth"` entry so the shared UI renders Connect and the
   runtime owns status, refresh, and reauthorization.
 - **Deploy- or app-level configuration** - use deployment/runtime
-  configuration, not a per-user secret row.
+  configuration, not a per-user secret row. For a non-secret public setting
+  already represented by `AgentNativeConfig`, put the default in
+  `agent-native.config.ts` and use its `AGENT_NATIVE_CONFIG_<PATH>` alias only
+  for a deployment override. Never put a credential or provider key in that
+  public namespace.
 - **Account, customer, manager, or other non-secret identifier** - store it as
   scoped connection metadata or app data, not as a masked secret field.
 

package/dist/templates/chat/.agents/skills/workspace-conventions/SKILL.md

@@ -55,7 +55,10 @@ Preview before `--apply`, commit `agent-native.ejections.json`, and never edit
   ZIPs, screenshots, thumbnails, session replay chunks) in configured file/blob
   storage and persist only URLs, ids, or handles.
 - Store shared runtime configuration in the workspace root `.env`; use
-  `apps/<app>/.env` only for app-specific overrides. Never hardcode API keys,
+  `apps/<app>/.env` only for app-specific overrides. For public app behavior,
+  prefer the default in `agent-native.config.ts` and use the deterministic
+  `AGENT_NATIVE_CONFIG_<UPPER_SNAKE_PATH>` alias only when a non-secret value
+  needs a deployment override. Never hardcode API keys,
   tokens, webhook URLs, signing secrets, private Builder/internal data, customer
   data, or credential-looking literals in source, docs, prompts, fixtures,
   application state, action responses, or generated app content. Use

package/dist/templates/chat/actions/navigate.ts

@@ -14,7 +14,7 @@
  */
 
 import { defineAction } from "@agent-native/core/action";
-import { writeAppState } from "@agent-native/core/application-state";
+import { writeAppStateForCurrentTab } from "@agent-native/core/application-state";
 import { z } from "zod";
 
 export default defineAction({
@@ -35,7 +35,7 @@ export default defineAction({
     if (args.path) nav.path = args.path;
     if (args.threadId) nav.threadId = args.threadId;
     nav._writeId = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-    await writeAppState("navigate", nav);
+    await writeAppStateForCurrentTab("navigate", nav);
     return `Navigating to ${args.view || args.path}`;
   },
 });

package/dist/templates/default/.agents/skills/secrets/SKILL.md

@@ -38,7 +38,11 @@ connection exists:
   register a `kind: "oauth"` entry so the shared UI renders Connect and the
   runtime owns status, refresh, and reauthorization.
 - **Deploy- or app-level configuration** - use deployment/runtime
-  configuration, not a per-user secret row.
+  configuration, not a per-user secret row. For a non-secret public setting
+  already represented by `AgentNativeConfig`, put the default in
+  `agent-native.config.ts` and use its `AGENT_NATIVE_CONFIG_<PATH>` alias only
+  for a deployment override. Never put a credential or provider key in that
+  public namespace.
 - **Account, customer, manager, or other non-secret identifier** - store it as
   scoped connection metadata or app data, not as a masked secret field.
 

package/dist/templates/default/.agents/skills/workspace-conventions/SKILL.md

@@ -55,7 +55,10 @@ Preview before `--apply`, commit `agent-native.ejections.json`, and never edit
   ZIPs, screenshots, thumbnails, session replay chunks) in configured file/blob
   storage and persist only URLs, ids, or handles.
 - Store shared runtime configuration in the workspace root `.env`; use
-  `apps/<app>/.env` only for app-specific overrides. Never hardcode API keys,
+  `apps/<app>/.env` only for app-specific overrides. For public app behavior,
+  prefer the default in `agent-native.config.ts` and use the deterministic
+  `AGENT_NATIVE_CONFIG_<UPPER_SNAKE_PATH>` alias only when a non-secret value
+  needs a deployment override. Never hardcode API keys,
   tokens, webhook URLs, signing secrets, private Builder/internal data, customer
   data, or credential-looking literals in source, docs, prompts, fixtures,
   application state, action responses, or generated app content. Use

package/dist/templates/headless/.agents/skills/secrets/SKILL.md

@@ -38,7 +38,11 @@ connection exists:
   register a `kind: "oauth"` entry so the shared UI renders Connect and the
   runtime owns status, refresh, and reauthorization.
 - **Deploy- or app-level configuration** - use deployment/runtime
-  configuration, not a per-user secret row.
+  configuration, not a per-user secret row. For a non-secret public setting
+  already represented by `AgentNativeConfig`, put the default in
+  `agent-native.config.ts` and use its `AGENT_NATIVE_CONFIG_<PATH>` alias only
+  for a deployment override. Never put a credential or provider key in that
+  public namespace.
 - **Account, customer, manager, or other non-secret identifier** - store it as
   scoped connection metadata or app data, not as a masked secret field.
 

package/dist/templates/workspace-core/.agents/skills/secrets/SKILL.md

@@ -38,7 +38,11 @@ connection exists:
   register a `kind: "oauth"` entry so the shared UI renders Connect and the
   runtime owns status, refresh, and reauthorization.
 - **Deploy- or app-level configuration** - use deployment/runtime
-  configuration, not a per-user secret row.
+  configuration, not a per-user secret row. For a non-secret public setting
+  already represented by `AgentNativeConfig`, put the default in
+  `agent-native.config.ts` and use its `AGENT_NATIVE_CONFIG_<PATH>` alias only
+  for a deployment override. Never put a credential or provider key in that
+  public namespace.
 - **Account, customer, manager, or other non-secret identifier** - store it as
   scoped connection metadata or app data, not as a masked secret field.
 

package/dist/templates/workspace-core/.agents/skills/workspace-conventions/SKILL.md

@@ -55,7 +55,10 @@ Preview before `--apply`, commit `agent-native.ejections.json`, and never edit
   ZIPs, screenshots, thumbnails, session replay chunks) in configured file/blob
   storage and persist only URLs, ids, or handles.
 - Store shared runtime configuration in the workspace root `.env`; use
-  `apps/<app>/.env` only for app-specific overrides. Never hardcode API keys,
+  `apps/<app>/.env` only for app-specific overrides. For public app behavior,
+  prefer the default in `agent-native.config.ts` and use the deterministic
+  `AGENT_NATIVE_CONFIG_<UPPER_SNAKE_PATH>` alias only when a non-secret value
+  needs a deployment override. Never hardcode API keys,
   tokens, webhook URLs, signing secrets, private Builder/internal data, customer
   data, or credential-looking literals in source, docs, prompts, fixtures,
   application state, action responses, or generated app content. Use

package/dist/vite/agent-native-config-loader.d.ts

@@ -11,6 +11,7 @@ export declare function loadAgentNativeConfigFile(cwd: string): Promise<AgentNat
  */
 export declare function loadWorkspaceAgentNativeConfigFile(cwd: string): Promise<AgentNativeConfigInput | undefined>;
 export declare function loadResolvedAgentNativeConfig(cwd: string, context: AgentNativeConfigContext, options?: {
+    environment?: Record<string, string | undefined>;
     loadProjectConfig?: boolean;
     projectConfig?: AgentNativeConfigInput;
 }): Promise<AgentNativeConfig>;

package/dist/vite/agent-native-config-loader.js

@@ -1,7 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
-import { mergeAgentNativeConfigs, normalizeAgentNativeConfig, resolveAgentNativeConfig, } from "../config.js";
+import { mergeAgentNativeConfigs, normalizeAgentNativeConfig, readAgentNativeConfigEnv, resolveAgentNativeConfig, } from "../config.js";
 /** The canonical filename comes first; the remaining names stay compatible. */
 export const AGENT_NATIVE_CONFIG_FILE_CANDIDATES = [
     "agent-native.config.ts",
@@ -79,9 +79,9 @@ export async function loadResolvedAgentNativeConfig(cwd, context, options = {})
         (options.loadProjectConfig === false
             ? undefined
             : await loadAgentNativeConfigFile(cwd));
-    return resolveAgentNativeConfig(mergeAgentNativeConfigs(mergeAgentNativeConfigs(workspaceConfig
+    return resolveAgentNativeConfig(mergeAgentNativeConfigs(mergeAgentNativeConfigs(mergeAgentNativeConfigs(workspaceConfig
         ? resolveAgentNativeConfig(workspaceConfig, context)
-        : {}, readAgentNativeJsonConfig(cwd)), projectConfig ? resolveAgentNativeConfig(projectConfig, context) : {}), context);
+        : {}, readAgentNativeJsonConfig(cwd)), readAgentNativeConfigEnv(options.environment ?? process.env)), projectConfig ? resolveAgentNativeConfig(projectConfig, context) : {}), context);
 }
 function findConfigPath(cwd) {
     return AGENT_NATIVE_CONFIG_FILE_CANDIDATES.map((filename) => path.join(cwd, filename)).find((candidate) => fs.existsSync(candidate));

package/dist/vite/agents-bundle-plugin.d.ts

@@ -1,4 +1,4 @@
-import type { Plugin } from "vite";
+import { type Plugin } from "vite";
 import type { AgentNativeConfigInput } from "../config.js";
 export interface AgentsBundlePluginOptions {
     agentNativeConfig?: AgentNativeConfigInput;