@agent-native/core 0.167.1 → 0.168.0

package/dist/server/auth.js

@@ -58,7 +58,7 @@ import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
 import { injectAnalyticsIntoHtml } from "./analytics.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { getAppProductionUrl } from "./app-url.js";
-import { readAnalyticsAnonymousId, readFirstTouchAttribution, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { addSignupAttributionHeader, readAnalyticsAnonymousId, readFirstTouchAttribution, signupAttributionContextFromCookieHeader, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getAuthLoginMode } from "./auth-login-mode.js";
 import { injectBetaOptOutPersistence } from "./beta-opt-out-html.js";
 import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getAuthSecret, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
@@ -73,6 +73,7 @@ import { ensureCanonicalUserForLegacySession } from "./legacy-auth-migration.js"
 import { encodeMagicLinkSignupAttribution, MAGIC_LINK_ATTRIBUTION_PARAM, } from "./magic-link-attribution.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
+import { getRequestContext, hasContinuationLocalRequestContext, runWithRequestContext, } from "./request-context.js";
 import { captureAuthError } from "./sentry.js";
 import { forgetCachedSessionEmail, getCachedSessionEmail, invalidateSessionEmailCache, setCachedSessionEmail, } from "./session-email-cache.js";
 import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
@@ -83,6 +84,23 @@ import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
 export function getSessionMaxAge() {
     return sessionMaxAge;
 }
+function withSignupAttributionContext(cookieHeader, fn) {
+    const signupAttribution = signupAttributionContextFromCookieHeader(cookieHeader);
+    if (!hasContinuationLocalRequestContext())
+        return fn();
+    return runWithRequestContext({
+        ...(getRequestContext() ?? {}),
+        signupAttribution,
+    }, fn);
+}
+function requestWithSignupAttribution(request, signupAttribution) {
+    return new Request(request, {
+        headers: addSignupAttributionHeader(request.headers, signupAttribution),
+    });
+}
+function headersWithSignupAttribution(headers, cookieHeader) {
+    return addSignupAttributionHeader(headers, signupAttributionContextFromCookieHeader(cookieHeader));
+}
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -416,6 +434,9 @@ async function readDesktopSsoSafely(event) {
         return null;
     return await readDesktopSso();
 }
+function isDesktopSessionCookieOnlyCheck(event) {
+    return getHeader(event, "x-agent-native-session-check") === "cookie-only";
+}
 /**
  * Extract the framework session token from a Better Auth response's
  * Set-Cookie headers, if any. Used by the password-reset path to skip
@@ -2688,6 +2709,7 @@ export async function getSession(event) {
     })());
 }
 async function resolveSessionUncached(event) {
+    const cookieOnlyDesktopCheck = isDesktopSessionCookieOnlyCheck(event);
     // 1. MCP App embed session. This is a short-lived browser session minted
     // from a one-time ticket that was scoped to the authenticated MCP caller.
     // It lets an inline MCP App iframe load the real app without reusing the
@@ -2724,9 +2746,11 @@ async function resolveSessionUncached(event) {
         // templates too. Gated on `readDesktopSsoSafely` so a non-loopback
         // request that spoofs `User-Agent: ... Electron/...` cannot read the
         // home-dir broker file (and so production builds never consult it).
-        const sso = await readDesktopSsoSafely(event);
-        if (sso?.email)
-            return { email: sso.email, token: sso.token };
+        if (!cookieOnlyDesktopCheck) {
+            const sso = await readDesktopSsoSafely(event);
+            if (sso?.email)
+                return { email: sso.email, token: sso.token };
+        }
         // Fall through to mobile _session check
     }
     else {
@@ -2765,9 +2789,11 @@ async function resolveSessionUncached(event) {
         // a loopback (127.0.0.1 / ::1) source IP, and a non-production NODE_ENV
         // — anything else is rejected so a hostile network request cannot
         // impersonate whichever email last signed into the desktop app.
-        const sso = await readDesktopSsoSafely(event);
-        if (sso?.email) {
-            return { email: sso.email, token: sso.token };
+        if (!cookieOnlyDesktopCheck) {
+            const sso = await readDesktopSsoSafely(event);
+            if (sso?.email) {
+                return { email: sso.email, token: sso.token };
+            }
         }
     }
     // 8. Mobile WebView bridge — _session query param
@@ -3699,11 +3725,18 @@ async function mountBetterAuthRoutes(app, options) {
             getMethod(event) === "POST";
         const isMagicLinkRequest = reqPath.includes("/sign-in/magic-link") && getMethod(event) === "POST";
         const isMagicLinkVerification = reqPath.includes("/magic-link/verify") && getMethod(event) === "GET";
+        const isEmailSignup = reqPath.includes("/sign-up/email") && getMethod(event) === "POST";
         const isSignOut = reqPath.includes("sign-out") && getMethod(event) === "POST";
         if (isSignOut)
             optOutOfAuthDisabledSession(event);
         const authRequest = toWebRequest(event);
         let requestForAuth = authRequest;
+        const signupCookieHeader = isEmailSignup
+            ? authRequest.headers.get("cookie")
+            : undefined;
+        const signupAttribution = isEmailSignup
+            ? signupAttributionContextFromCookieHeader(signupCookieHeader)
+            : undefined;
         let magicLinkPreConsume;
         if (isMagicLinkVerification) {
             const verificationURL = new URL(authRequest.url);
@@ -3820,9 +3853,14 @@ async function mountBetterAuthRoutes(app, options) {
                 // validation error.
             }
         }
+        if (signupAttribution) {
+            requestForAuth = requestWithSignupAttribution(requestForAuth, signupAttribution);
+        }
         let response;
         try {
-            response = await auth.handler(requestForAuth);
+            response = await (isEmailSignup
+                ? withSignupAttributionContext(signupCookieHeader, () => auth.handler(requestForAuth))
+                : auth.handler(requestForAuth));
         }
         catch (error) {
             if (isMagicLinkVerification) {
@@ -4127,10 +4165,15 @@ async function mountBetterAuthRoutes(app, options) {
             return { error: GOOGLE_AUTH_REQUIRED_MESSAGE };
         }
         try {
-            await auth.api.signUpEmail({
-                body: { email, password, name: email.split("@")[0], callbackURL },
-                headers: event.headers,
-            });
+            await withSignupAttributionContext(getHeader(event, "cookie") ?? null, () => auth.api.signUpEmail({
+                body: {
+                    email,
+                    password,
+                    name: email.split("@")[0],
+                    callbackURL,
+                },
+                headers: headersWithSignupAttribution(event.headers, getHeader(event, "cookie") ?? null),
+            }));
             setFirstRunOnboardingCookie(event);
             return { ok: true };
         }
@@ -4384,10 +4427,10 @@ function mountAuthFallbackRoutes(app) {
         }
         try {
             const auth = await getBetterAuth();
-            await auth.api.signUpEmail({
+            await withSignupAttributionContext(getHeader(event, "cookie") ?? null, () => auth.api.signUpEmail({
                 body: { email, password, name: email.split("@")[0] },
-                headers: event.headers,
-            });
+                headers: headersWithSignupAttribution(event.headers, getHeader(event, "cookie") ?? null),
+            }));
             setFirstRunOnboardingCookie(event);
             return { ok: true };
         }

package/dist/server/better-auth-instance.js

@@ -26,13 +26,14 @@ import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from "../shared/password-po
 import { formatRuntimeConfigReport, getRuntimeConfigReport, } from "../shared/runtime-config.js";
 import { flushTracking, identify, track } from "../tracking/index.js";
 import { getAppProductionUrl } from "./app-url.js";
-import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { signupAttributionContextFromCookieHeader, signupAttributionContextFromHeaders, } from "./attribution.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { renderMagicLinkEmail, renderResetPasswordEmail, renderVerifySignupEmail, } from "./email-templates.js";
 import { getEmailReadiness, sendEmail } from "./email.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import { readMagicLinkSignupAttribution } from "./magic-link-attribution.js";
+import { getRequestContext, hasContinuationLocalRequestContext, } from "./request-context.js";
 export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, } from "./auth-login-mode.js";
 async function flushSignupTracking() {
     try {
@@ -1045,14 +1046,25 @@ async function createBetterAuthInstance(config) {
                             const cookieHeader = context?.headers?.get("cookie") ??
                                 context?.request?.headers?.get("cookie") ??
                                 null;
+                            const scopedSignupAttribution = hasContinuationLocalRequestContext()
+                                ? getRequestContext()?.signupAttribution
+                                : undefined;
+                            const requestSignupAttribution = signupAttributionContextFromCookieHeader(cookieHeader);
+                            const headerSignupAttribution = signupAttributionContextFromHeaders(context?.headers) ??
+                                signupAttributionContextFromHeaders(context?.request?.headers);
                             const magicLinkAttribution = context?.request?.url?.includes("newUserCallbackURL")
                                 ? readMagicLinkSignupAttribution(context.request.url, getAuthSecret())
                                 : undefined;
-                            attribution = signupAttributionFromCookieHeader(cookieHeader);
-                            attribution = magicLinkAttribution?.attribution ?? attribution;
+                            attribution =
+                                magicLinkAttribution?.attribution ??
+                                    scopedSignupAttribution?.attribution ??
+                                    headerSignupAttribution?.attribution ??
+                                    requestSignupAttribution.attribution;
                             anonymousId =
                                 magicLinkAttribution?.anonymousId ??
-                                    readAnalyticsAnonymousId(cookieHeader);
+                                    scopedSignupAttribution?.anonymousId ??
+                                    headerSignupAttribution?.anonymousId ??
+                                    requestSignupAttribution.anonymousId;
                         }
                         catch (err) {
                             console.error("[auth] failed to derive signup attribution", err);

package/dist/server/identity-sso.js

@@ -19,10 +19,12 @@ import { getAppConfig } from "../app-config/index.js";
 import { GOOGLE_AUTH_REQUIRED_MESSAGE, isGoogleSignInRequiredForEmail, } from "../org/auth-policy.js";
 import { SIGN_IN_ENTRY_PATH } from "../shared/sign-in-journey.js";
 import { getAppName } from "./app-name.js";
+import { addSignupAttributionHeader, signupAttributionContextFromCookieHeader, } from "./attribution.js";
 import { getSession, isExpectedAuthFailure, safeReturnPath } from "./auth.js";
 import { getBetterAuth, getBetterAuthInternalAdapter, } from "./better-auth-instance.js";
 import { createOAuthSession, getOrigin } from "./google-oauth.js";
 import { consumeSsoState, createSsoState, CANONICAL_IDENTITY_SSO_HUB_URL, getIdentityHubUrl, identitySsoLoginButtonHtml, isCanonicalIdentitySsoClientRequest, isDesktopSsoUserAgent, isIdentitySsoExplicitlyEnabled, isIdentitySsoEnabled, isJtiReplayed, SSO_STATE_TTL_MS, } from "./identity-sso-store.js";
+import { getRequestContext, hasContinuationLocalRequestContext, runWithRequestContext, } from "./request-context.js";
 export { getIdentityHubUrl, identitySsoLoginButtonHtml, isIdentitySsoEnabled };
 export const IDENTITY_SSO_PROVIDER_ID = "agent-native";
 export const IDENTITY_SSO_SCOPE = "identity";
@@ -269,7 +271,7 @@ async function exchangeIdentityCode(hub, binding, input) {
         return null;
     }
 }
-async function jitLinkIdentity(identity) {
+async function jitLinkIdentity(identity, signupHeaders) {
     const adapter = await getBetterAuthInternalAdapter();
     let existing = adapter
         ? await adapter
@@ -288,6 +290,7 @@ async function jitLinkIdentity(identity) {
                     password: createUnusableSsoCredential(),
                     name: identity.name || identity.email.split("@")[0] || "User",
                 },
+                ...(signupHeaders ? { headers: signupHeaders } : {}),
             });
         }
         catch (error) {
@@ -463,7 +466,16 @@ export async function handleIdentitySso(event, subpath) {
             return errorPage(GOOGLE_AUTH_REQUIRED_MESSAGE, loginPath);
         }
         try {
-            await jitLinkIdentity(identity);
+            const signupCookieHeader = getHeader(event, "cookie") ?? null;
+            const signupAttribution = signupAttributionContextFromCookieHeader(signupCookieHeader);
+            const signupHeaders = addSignupAttributionHeader(event.headers, signupAttribution);
+            const linkIdentity = () => jitLinkIdentity(identity, signupHeaders);
+            await (hasContinuationLocalRequestContext()
+                ? runWithRequestContext({
+                    ...(getRequestContext() ?? {}),
+                    signupAttribution,
+                }, linkIdentity)
+                : linkIdentity());
         }
         catch {
             return errorPage("Could not finish linking your account. Please try again.", loginPath);

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/request-context.d.ts

@@ -15,6 +15,7 @@
  * process.env so existing `AGENT_USER_EMAIL=x pnpm action foo` invocations
  * continue to work.
  */
+import type { SignupAttributionContext } from "./attribution.js";
 /**
  * Per-request agent-run state. Lives on `RequestContext.run` so the
  * agent-chat plugin can populate fields as the run progresses (owner,
@@ -109,6 +110,11 @@ export interface RequestContext {
      * replay; never used for authorization.
      */
     browserSessionId?: string;
+    /**
+     * Browser attribution captured before a Better Auth signup crosses into its
+     * async user-create hook. Analytics-only; never used for authorization.
+     */
+    signupAttribution?: SignupAttributionContext;
     /** Canonical client surface for analytics attribution. */
     clientPlatform?: import("../shared/analytics-platform.js").AnalyticsClientPlatform;
     /**
@@ -188,6 +194,8 @@ type RequestContextObserver = (ctx: RequestContext) => void;
  * overlapping async requests are only isolated by native AsyncLocalStorage.
  */
 export declare function assertRequestActionSurfaceIsolation(): void;
+/** Whether request context values are isolated across overlapping promises. */
+export declare function hasContinuationLocalRequestContext(): boolean;
 /**
  * Register a callback fired every time `runWithRequestContext` enters a new
  * scope. The hook runs INSIDE the AsyncLocalStorage scope, so observability

package/dist/server/request-context.js

@@ -80,6 +80,10 @@ export function assertRequestActionSurfaceIsolation() {
     throw new Error("Request-scoped action surfaces require continuation-local request context storage; " +
         "this runtime only provides the non-isolated fallback.");
 }
+/** Whether request context values are isolated across overlapping promises. */
+export function hasContinuationLocalRequestContext() {
+    return globalRef[CONTINUATION_LOCAL_KEY] === true;
+}
 /**
  * Register a callback fired every time `runWithRequestContext` enters a new
  * scope. The hook runs INSIDE the AsyncLocalStorage scope, so observability

package/dist/templates/chat/.agents/skills/agent-native-docs/SKILL.md

@@ -134,3 +134,14 @@ hand-duplicating framework logic.
   `agent-surfaces`.
 - Do not copy framework runtime internals when a public API or narrow UI copy
   will do; read `customizing-agent-native` for the supported override ladder.
+
+## Authoring visual docs blocks
+
+Treat the shared `Diagram` block as a renderer, not as a reason to style every
+docs UI as a sketch. Use the hand-drawn font and Rough.js only for actual
+diagrams or wireframes that communicate structure, flow, or a design draft.
+For polished UI-like content - cards, logo walls, tables, controls, or product
+shells — set `renderMode="design"` (and usually `frame="hide"` when the block
+is the content itself). Design mode preserves normal docs typography and
+disables the Rough.js overlay. Keep `data-rough` only on elements intentionally
+sketched inside a real diagram.

package/dist/templates/default/.agents/skills/agent-native-docs/SKILL.md

@@ -134,3 +134,14 @@ hand-duplicating framework logic.
   `agent-surfaces`.
 - Do not copy framework runtime internals when a public API or narrow UI copy
   will do; read `customizing-agent-native` for the supported override ladder.
+
+## Authoring visual docs blocks
+
+Treat the shared `Diagram` block as a renderer, not as a reason to style every
+docs UI as a sketch. Use the hand-drawn font and Rough.js only for actual
+diagrams or wireframes that communicate structure, flow, or a design draft.
+For polished UI-like content - cards, logo walls, tables, controls, or product
+shells — set `renderMode="design"` (and usually `frame="hide"` when the block
+is the content itself). Design mode preserves normal docs typography and
+disables the Rough.js overlay. Keep `data-rough` only on elements intentionally
+sketched inside a real diagram.

package/dist/templates/headless/.agents/skills/agent-native-docs/SKILL.md

@@ -134,3 +134,14 @@ hand-duplicating framework logic.
   `agent-surfaces`.
 - Do not copy framework runtime internals when a public API or narrow UI copy
   will do; read `customizing-agent-native` for the supported override ladder.
+
+## Authoring visual docs blocks
+
+Treat the shared `Diagram` block as a renderer, not as a reason to style every
+docs UI as a sketch. Use the hand-drawn font and Rough.js only for actual
+diagrams or wireframes that communicate structure, flow, or a design draft.
+For polished UI-like content - cards, logo walls, tables, controls, or product
+shells — set `renderMode="design"` (and usually `frame="hide"` when the block
+is the content itself). Design mode preserves normal docs typography and
+disables the Rough.js overlay. Keep `data-rough` only on elements intentionally
+sketched inside a real diagram.

package/dist/templates/workspace-core/.agents/skills/agent-native-docs/SKILL.md

@@ -134,3 +134,14 @@ hand-duplicating framework logic.
   `agent-surfaces`.
 - Do not copy framework runtime internals when a public API or narrow UI copy
   will do; read `customizing-agent-native` for the supported override ladder.
+
+## Authoring visual docs blocks
+
+Treat the shared `Diagram` block as a renderer, not as a reason to style every
+docs UI as a sketch. Use the hand-drawn font and Rough.js only for actual
+diagrams or wireframes that communicate structure, flow, or a design draft.
+For polished UI-like content - cards, logo walls, tables, controls, or product
+shells — set `renderMode="design"` (and usually `frame="hide"` when the block
+is the content itself). Design mode preserves normal docs typography and
+disables the Rough.js overlay. Keep `data-rough` only on elements intentionally
+sketched inside a real diagram.

package/dist/vite/agent-native-config-loader.js

@@ -81,7 +81,7 @@ export async function loadResolvedAgentNativeConfig(cwd, context, options = {})
             : await loadAgentNativeConfigFile(cwd));
     return resolveAgentNativeConfig(mergeAgentNativeConfigs(mergeAgentNativeConfigs(mergeAgentNativeConfigs(workspaceConfig
         ? resolveAgentNativeConfig(workspaceConfig, context)
-        : {}, readAgentNativeJsonConfig(cwd)), readAgentNativeConfigEnv(options.environment ?? process.env)), projectConfig ? resolveAgentNativeConfig(projectConfig, context) : {}), context);
+        : {}, readAgentNativeJsonConfig(cwd)), projectConfig ? resolveAgentNativeConfig(projectConfig, context) : {}), readAgentNativeConfigEnv(options.environment ?? process.env), { arrayStrategy: "replace" }), context);
 }
 function findConfigPath(cwd) {
     return AGENT_NATIVE_CONFIG_FILE_CANDIDATES.map((filename) => path.join(cwd, filename)).find((candidate) => fs.existsSync(candidate));

package/dist/vite/client.js

@@ -10,6 +10,7 @@ import { getViteDevRecoveryScript } from "../client/vite-dev-recovery-script.js"
 import { inferAgentNativeDeploymentEnvironment, mergeAgentNativeConfigs, readAgentNativeConfigEnv, resolveAgentNativeConfig, } from "../config.js";
 import { writeAgentNativeNitroPresetMarker } from "../deploy/nitro-preset.js";
 import { findWorkspaceRoot } from "../scripts/utils.js";
+import { RECURRING_JOBS_BUILD_MARKER_ENV_VAR, resolveRecurringJobsBuildMarker, } from "../server/agent-chat/recurring-jobs-runtime.js";
 import { verifyEmbedSessionToken } from "../server/embed-session.js";
 import { EMBED_SESSION_COOKIE, EMBED_TOKEN_QUERY_PARAM, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, } from "../shared/embed-auth.js";
 import { isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, MCP_EMBED_STATIC_ASSET_HEADERS, mcpEmbedStaticAssetRouteRules, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
@@ -19,6 +20,7 @@ import { formatRuntimeConfigReport, getRuntimeConfigReport, isTruthyRuntimeValue
 import { actionTypesPlugin } from "./action-types-plugin.js";
 import { createAgentNativeConfigContext, loadAgentNativeConfigFile, loadWorkspaceAgentNativeConfigFile, readAgentNativeJsonConfig, } from "./agent-native-config-loader.js";
 import { agentsBundlePlugin } from "./agents-bundle-plugin.js";
+import { resolveAgentNativePackageVersions } from "./package-versions.js";
 const require = createRequire(import.meta.url);
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 let nitroFsWatchGuardInstalled = false;
@@ -2561,6 +2563,10 @@ function createNitroDevPlugin(options, appBasePath) {
             // injected into deployed Functions. Nitro is a separate server build,
             // so it needs the release ownership decision in its own replacement map.
             "process.env.AGENT_NATIVE_RELEASE_MIGRATIONS": JSON.stringify(process.env.AGENT_NATIVE_RELEASE_MIGRATIONS?.trim() || ""),
+            // Same reason as the release owner above: the recurring-jobs decision
+            // belongs to the build env, and Nitro is a separate server build with its
+            // own replacement map.
+            [`process.env.${RECURRING_JOBS_BUILD_MARKER_ENV_VAR}`]: JSON.stringify(resolveRecurringJobsBuildMarker(process.env)),
         },
         // Never auto-load test files as server handlers/plugins/middleware.
         // Nitro scans server/{plugins,middleware,routes,api}/*; a co-located
@@ -2801,7 +2807,7 @@ function reportRuntimeConfigDiagnostics(appConfig, context, mode, env = process.
     }
     console.warn(message);
 }
-function createAgentNativeConfig(options = {}, command, userConfig = {}, mode = process.env.NODE_ENV === "production" ? "production" : "development", projectConfig) {
+function createAgentNativeConfig(options = {}, command, userConfig = {}, mode = process.env.NODE_ENV === "production" ? "production" : "development", projectConfig, workspaceConfig) {
     const cwd = process.cwd();
     const configContext = createAgentNativeConfigContext(command, mode);
     const projectConfigInput = projectConfig ?? options.agentNativeConfig;
@@ -2817,9 +2823,11 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
         ...loadEnv(mode, cwd, ""),
         ...process.env,
     };
-    const appConfig = resolveAgentNativeConfig(mergeAgentNativeConfigs(mergeAgentNativeConfigs(readAgentNativeJsonConfig(cwd), readAgentNativeConfigEnv(runtimeEnv)), projectConfigInput
+    const appConfig = resolveAgentNativeConfig(mergeAgentNativeConfigs(mergeAgentNativeConfigs(mergeAgentNativeConfigs(workspaceConfig
+        ? resolveAgentNativeConfig(workspaceConfig, configContext)
+        : {}, readAgentNativeJsonConfig(cwd)), projectConfigInput
         ? resolveAgentNativeConfig(projectConfigInput, configContext)
-        : {}), configContext);
+        : {}), readAgentNativeConfigEnv(runtimeEnv), { arrayStrategy: "replace" }), configContext);
     const inferredDeploymentEnvironment = appConfig.deployment?.environment ??
         inferAgentNativeDeploymentEnvironment(process.env, mode);
     const resolvedAppConfig = appConfig.deployment?.environment === undefined &&
@@ -2835,6 +2843,7 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
         process.env.CF_PAGES_COMMIT_SHA?.trim() ||
         process.env.AGENT_NATIVE_BUILD_SHA?.trim() ||
         "development";
+    const packageVersions = resolveAgentNativePackageVersions(cwd);
     // Preload workspace-root .env into process.env so Nitro server code sees
     // shared keys during dev (Nitro reads process.env, not vite's envDir).
     if (workspaceRoot && workspaceRoot !== cwd) {
@@ -2905,6 +2914,7 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
             ...(userConfig.define ?? {}),
             ...(options.define ?? {}),
             __AGENT_NATIVE_BUILD_ID__: JSON.stringify(buildId),
+            __AGENT_NATIVE_PACKAGE_VERSIONS__: JSON.stringify(packageVersions),
             __AGENT_NATIVE_CLIENT_COMPATIBILITY_VERSION__: JSON.stringify(options.clientCompatibilityVersion?.trim() || ""),
             __AGENT_NATIVE_APP_CONFIG__: JSON.stringify(resolvedAppConfig),
             __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: JSON.stringify(process.env.GA_MEASUREMENT_ID?.trim() || ""),
@@ -2913,6 +2923,11 @@ function createAgentNativeConfig(options = {}, command, userConfig = {}, mode =
             // netlify.toml environment is available to the build but not injected
             // into deployed Functions, so embed the decision in the server bundle.
             "process.env.AGENT_NATIVE_RELEASE_MIGRATIONS": JSON.stringify(process.env.AGENT_NATIVE_RELEASE_MIGRATIONS?.trim() || ""),
+            // Recurring jobs are turned off (and their platform scheduled trigger
+            // omitted) by the BUILD environment, which a deployed serverless runtime
+            // never sees. Embed the decision so the Automations page reports what
+            // will actually fire instead of inferring it from runtime-only markers.
+            [`process.env.${RECURRING_JOBS_BUILD_MARKER_ENV_VAR}`]: JSON.stringify(resolveRecurringJobsBuildMarker(process.env)),
             ...(resolvedAppConfig.deployment?.environment
                 ? {
                     "process.env.AGENT_NATIVE_DEPLOYMENT_ENVIRONMENT": JSON.stringify(resolvedAppConfig.deployment.environment),
@@ -3129,14 +3144,10 @@ function createAgentNativeConfigPlugin(options) {
         name: "agent-native-config",
         enforce: "pre",
         async config(config, env) {
-            const context = createAgentNativeConfigContext(env.command, env.mode);
             const workspaceConfig = await loadWorkspaceAgentNativeConfigFile(process.cwd());
             const projectConfig = options.agentNativeConfig ??
                 (await loadAgentNativeConfigFile(process.cwd()));
-            const resolvedConfig = mergeAgentNativeConfigs(workspaceConfig
-                ? resolveAgentNativeConfig(workspaceConfig, context)
-                : {}, projectConfig ? resolveAgentNativeConfig(projectConfig, context) : {});
-            return createAgentNativeConfig(options, env.command, config, env.mode, resolvedConfig);
+            return createAgentNativeConfig(options, env.command, config, env.mode, projectConfig, workspaceConfig);
         },
     };
 }

package/dist/vite/package-versions.d.ts

@@ -0,0 +1 @@
+export declare function resolveAgentNativePackageVersions(cwd: string): Record<string, string>;

package/dist/vite/package-versions.js

@@ -0,0 +1,97 @@
+import fs from "fs";
+import { createRequire } from "module";
+import path from "path";
+import { fileURLToPath } from "url";
+const AGENT_NATIVE_PACKAGE_PREFIX = "@agent-native/";
+function readPackageManifest(manifestPath) {
+    try {
+        const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+        return manifest && typeof manifest === "object"
+            ? manifest
+            : null;
+    }
+    catch {
+        // coercion-ok: missing or malformed manifests are typed absence from the optional version inventory.
+        return null;
+    }
+}
+function dependencyNames(manifest, includeDevDependencies = false) {
+    if (!manifest) {
+        return [];
+    }
+    return [
+        ...Object.keys(manifest.dependencies ?? {}),
+        ...Object.keys(manifest.optionalDependencies ?? {}),
+        ...Object.keys(manifest.peerDependencies ?? {}),
+        ...(includeDevDependencies
+            ? Object.keys(manifest.devDependencies ?? {})
+            : []),
+    ];
+}
+function resolvePackageManifest(packageName, resolutionBase) {
+    let entryPath;
+    const packageRequire = createRequire(path.join(resolutionBase, "package.json"));
+    try {
+        entryPath = packageRequire.resolve(packageName);
+    }
+    catch {
+        if (packageName !== "@agent-native/core") {
+            return null;
+        }
+        const coreManifestPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../package.json");
+        const coreManifest = readPackageManifest(coreManifestPath);
+        return coreManifest?.name === packageName
+            ? { manifest: coreManifest, manifestPath: coreManifestPath }
+            : null;
+    }
+    let directory = path.dirname(entryPath);
+    for (let depth = 0; depth < 20; depth += 1) {
+        const manifestPath = path.join(directory, "package.json");
+        const manifest = readPackageManifest(manifestPath);
+        if (manifest?.name === packageName) {
+            return { manifest, manifestPath };
+        }
+        const parent = path.dirname(directory);
+        if (parent === directory) {
+            break;
+        }
+        directory = parent;
+    }
+    return null;
+}
+export function resolveAgentNativePackageVersions(cwd) {
+    const appManifest = readPackageManifest(path.join(cwd, "package.json"));
+    const packageNames = new Set([
+        "@agent-native/core",
+        ...dependencyNames(appManifest, true).filter((name) => name.startsWith(AGENT_NATIVE_PACKAGE_PREFIX)),
+    ]);
+    const resolvedVersions = new Map();
+    const queuedPackages = [...packageNames].map((packageName) => ({
+        packageName,
+        resolutionBase: cwd,
+    }));
+    while (queuedPackages.length > 0) {
+        const queuedPackage = queuedPackages.shift();
+        if (!queuedPackage)
+            continue;
+        const resolvedPackage = resolvePackageManifest(queuedPackage.packageName, queuedPackage.resolutionBase);
+        if (!resolvedPackage) {
+            continue;
+        }
+        const { manifest } = resolvedPackage;
+        if (typeof manifest.version === "string" && manifest.version.trim()) {
+            resolvedVersions.set(queuedPackage.packageName, manifest.version.trim());
+        }
+        for (const dependencyName of dependencyNames(manifest)) {
+            if (dependencyName.startsWith(AGENT_NATIVE_PACKAGE_PREFIX) &&
+                !packageNames.has(dependencyName)) {
+                packageNames.add(dependencyName);
+                queuedPackages.push({
+                    packageName: dependencyName,
+                    resolutionBase: path.dirname(resolvedPackage.manifestPath),
+                });
+            }
+        }
+    }
+    return Object.fromEntries([...resolvedVersions.entries()].sort(([left], [right]) => left.localeCompare(right)));
+}