@agent-native/core 0.176.4-nightly-20260902022549 → 0.176.4-nightly-20260902024948

package/dist/client/EnvironmentBadge.d.ts

@@ -1,5 +1,5 @@
 import type { AgentNativeDeploymentEnvironment, AgentNativeConfig } from "../config.js";
-export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, buildEnvironmentOptOutUrl, buildEnvironmentUrl, resolveEnvironmentTargets, type EnvironmentBadgeTargets, } from "../shared/environment-lanes.js";
+export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, BETA_REDIRECT_DURATION_MS, BETA_REDIRECT_STORAGE_KEY, buildEnvironmentOptOutUrl, buildEnvironmentUrl, resolveEnvironmentTargets, type EnvironmentBadgeTargets, } from "../shared/environment-lanes.js";
 export declare function isBuilderIoEmployee(email: string | null | undefined): boolean;
 export declare function isAgentNativeDesktopUserAgent(userAgent: string | undefined): boolean;
 export declare function resolveEnvironmentChannel(config: AgentNativeConfig, hostname: string | undefined): Extract<AgentNativeDeploymentEnvironment, "local" | "beta" | "production"> | null;

package/dist/client/EnvironmentBadge.js

@@ -2,12 +2,12 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Button } from "@agent-native/toolkit/ui/button";
 import { Popover, PopoverContent, PopoverTrigger, } from "@agent-native/toolkit/ui/popover";
 import { useEffect, useMemo, useRef, useState } from "react";
-import { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, buildEnvironmentOptOutUrl, buildEnvironmentUrl, resolveEnvironmentTargets, } from "../shared/environment-lanes.js";
+import { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, BETA_REDIRECT_DURATION_MS, BETA_REDIRECT_STORAGE_KEY, buildEnvironmentOptOutUrl, buildEnvironmentUrl, resolveEnvironmentTargets, } from "../shared/environment-lanes.js";
 import { trackEvent } from "./analytics.js";
 import { injectedAgentNativeConfig } from "./app-config.js";
 import { useSession } from "./use-session.js";
 import { cn } from "./utils.js";
-export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, buildEnvironmentOptOutUrl, buildEnvironmentUrl, resolveEnvironmentTargets, } from "../shared/environment-lanes.js";
+export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, BETA_REDIRECT_DURATION_MS, BETA_REDIRECT_STORAGE_KEY, buildEnvironmentOptOutUrl, buildEnvironmentUrl, resolveEnvironmentTargets, } from "../shared/environment-lanes.js";
 export function isBuilderIoEmployee(email) {
     return email?.trim().toLowerCase().endsWith("@builder.io") ?? false;
 }
@@ -50,6 +50,16 @@ function readBetaOptOutUntil(now = Date.now()) {
     }
     return null;
 }
+function rememberBetaRedirectPreference() {
+    if (typeof window === "undefined")
+        return;
+    try {
+        window.localStorage.setItem(BETA_REDIRECT_STORAGE_KEY, String(Date.now() + BETA_REDIRECT_DURATION_MS));
+    }
+    catch {
+        // coercion-ok: the marker is only a performance hint; session auth remains authoritative.
+    }
+}
 function rememberForcedProductionSession(sourceHref) {
     let forcedByQuery = false;
     try {
@@ -90,6 +100,7 @@ function consumeBetaOptOutQueryParam(sourceHref, now = Date.now()) {
     try {
         if (active) {
             window.localStorage.setItem(BETA_OPT_OUT_STORAGE_KEY, String(Number(rawExpiry)));
+            window.localStorage.removeItem(BETA_REDIRECT_STORAGE_KEY);
         }
         window.history.replaceState(null, "", target.toString());
     }
@@ -151,6 +162,7 @@ function ProductionEnvironmentBadge({ targets, }) {
         const betaHref = buildEnvironmentUrl(window.location.href, targets.betaHost);
         if (!betaHref || typeof window.location.replace !== "function")
             return;
+        rememberBetaRedirectPreference();
         didAutoRedirect.current = true;
         trackEvent("environment switched", {
             from_environment: "production",

package/dist/client/analytics.d.ts

@@ -23,6 +23,7 @@ declare global {
             workspaceGatewayUrl?: string;
             workspaceOAuthOrigin?: string;
             workspaceRuntime?: boolean;
+            workspaceAppMountPaths?: string[];
             sentryDsn?: string;
             sentryEnvironment?: string;
             deploymentEnvironment?: string;

package/dist/client/app-providers.js

@@ -56,6 +56,8 @@ import { ThemeProvider, useTheme } from "next-themes";
 import { useEffect, useRef } from "react";
 import { useInRouterContext } from "react-router";
 import { isHumanReadableDocumentTitle, normalizeDocumentTitle, } from "../shared/document-title.js";
+import { getSsrBetaRedirectScriptBody } from "../shared/ssr-beta-redirect.js";
+import { agentNativePath } from "./api-path.js";
 import { ClientOnly } from "./ClientOnly.js";
 import { DefaultSpinner } from "./DefaultSpinner.js";
 import { EnvironmentBadge } from "./EnvironmentBadge.js";
@@ -68,6 +70,11 @@ import { RuntimeConfigNotice } from "./RuntimeConfigNotice.js";
 import { EMBEDDED_THEME_CHANGE_EVENT, applyEmbeddedThemeUpdate, parseEmbeddedThemeUpdate, } from "./theme.js";
 import { createAgentNativeServerActionWebMcpRegistration } from "./webmcp.js";
 const DEFAULT_TOASTER = (_jsx(Toaster, { richColors: true, position: "bottom-left", offset: { bottom: 44, left: 32 }, mobileOffset: { bottom: 44, left: 16 } }));
+function EarlyBetaRedirectScript() {
+    return (_jsx("script", { "data-agent-native-beta-redirect": "1", dangerouslySetInnerHTML: {
+            __html: getSsrBetaRedirectScriptBody(agentNativePath("/_agent-native/auth/session")),
+        } }));
+}
 function RoutedAppEnhancements() {
     const isInRouter = useInRouterContext();
     if (!isInRouter)
@@ -165,5 +172,7 @@ export function AppProviders({ queryClient, isPublicPath = false, clientOnlyFall
     if (isPublicPath) {
         return (_jsx(ProvidersInner, { queryClient: queryClient, defaultTheme: defaultTheme, themeAttribute: themeAttribute, tooltipDelayDuration: tooltipDelayDuration, toaster: toaster, disableThemeTransitions: disableThemeTransitions, i18n: i18n, documentTitleFallback: documentTitleFallback, showProductionEnvironmentBadge: false, children: children }));
     }
-    return (_jsx(ClientOnly, { fallback: fallback, children: _jsx(ProvidersInner, { queryClient: queryClient, defaultTheme: defaultTheme, themeAttribute: themeAttribute, tooltipDelayDuration: tooltipDelayDuration, toaster: toaster, disableThemeTransitions: disableThemeTransitions, i18n: i18n, documentTitleFallback: documentTitleFallback, showProductionEnvironmentBadge: !sessionBypass, children: _jsx(RequireSession, { bypass: sessionBypass, fallback: fallback, children: sessionBypass ? (children) : (_jsxs(FirstRunOnboardingStartupGate, { children: [_jsx(AutomaticWebMcpActionRegistration, {}), children] })) }) }) }));
+    // Keep the bootstrap outside ClientOnly so the HTML parser can run it before
+    // the authenticated client bundle starts.
+    return (_jsxs(_Fragment, { children: [!sessionBypass && _jsx(EarlyBetaRedirectScript, {}), _jsx(ClientOnly, { fallback: fallback, children: _jsx(ProvidersInner, { queryClient: queryClient, defaultTheme: defaultTheme, themeAttribute: themeAttribute, tooltipDelayDuration: tooltipDelayDuration, toaster: toaster, disableThemeTransitions: disableThemeTransitions, i18n: i18n, documentTitleFallback: documentTitleFallback, showProductionEnvironmentBadge: !sessionBypass, children: _jsx(RequireSession, { bypass: sessionBypass, fallback: fallback, children: sessionBypass ? (children) : (_jsxs(FirstRunOnboardingStartupGate, { children: [_jsx(AutomaticWebMcpActionRegistration, {}), children] })) }) }) })] }));
 }

package/dist/client/sign-out.js

@@ -1,3 +1,4 @@
+import { BETA_REDIRECT_SIGN_OUT_STORAGE_KEY, BETA_REDIRECT_STORAGE_KEY, } from "../shared/environment-lanes.js";
 /**
  * The one client-side sign-out.
  *
@@ -27,6 +28,34 @@ import { beginSignOut, completeSignOut } from "./use-session.js";
 const LOGOUT_PATH = "/_agent-native/auth/logout";
 const SIGN_OUT_REQUEST_TIMEOUT_MS = 15_000;
 let signOutOperation = null;
+function setBetaRedirectSignOutSignal() {
+    const signOutWindow = window;
+    signOutWindow.__agentNativeBetaRedirectSignOutStarted = true;
+    try {
+        window.sessionStorage.setItem(BETA_REDIRECT_SIGN_OUT_STORAGE_KEY, "1");
+    }
+    catch {
+        // coercion-ok: the in-memory signal still protects this document when storage is unavailable.
+    }
+}
+function clearBetaRedirectSignOutSignal() {
+    const signOutWindow = window;
+    signOutWindow.__agentNativeBetaRedirectSignOutStarted = false;
+    try {
+        window.sessionStorage.removeItem(BETA_REDIRECT_SIGN_OUT_STORAGE_KEY);
+    }
+    catch {
+        // coercion-ok: sign-out navigation must not depend on optional storage.
+    }
+}
+function clearBetaRedirectMarker() {
+    try {
+        window.localStorage.removeItem(BETA_REDIRECT_STORAGE_KEY);
+    }
+    catch {
+        // coercion-ok: local storage is optional; sign-out must still complete.
+    }
+}
 /**
  * Sign the current user out and leave for the sign-in page when revocation
  * succeeds. A failed revoke reloads the current document instead.
@@ -41,6 +70,7 @@ export function signOut(options = {}) {
     return signOutOperation;
 }
 async function signOutFlow(options) {
+    setBetaRedirectSignOutSignal();
     beginSignOut();
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), SIGN_OUT_REQUEST_TIMEOUT_MS);
@@ -69,6 +99,8 @@ async function signOutFlow(options) {
     if (!revoked) {
         // Do not send an unrevoked session through sign-in's continuation, which
         // can immediately authenticate it again.
+        clearBetaRedirectSignOutSignal();
+        clearBetaRedirectMarker();
         window.location.reload();
         return;
     }
@@ -78,5 +110,7 @@ async function signOutFlow(options) {
     completeSignOut();
     // `replace`, not `assign`: the dead authenticated URL must not stay in
     // history, or Back lands on a shell with no session.
+    clearBetaRedirectSignOutSignal();
+    clearBetaRedirectMarker();
     window.location.replace(options.redirectTo ?? buildSignInReturnHref());
 }

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/deploy/build.js

@@ -1363,6 +1363,43 @@ function getAppOriginClientConfigScript() {
         env.VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON,
       ),
     );
+  const workspaceAppMountPaths = (() => {
+    const raw = firstNonEmpty(
+      env.AGENT_NATIVE_WORKSPACE_APPS_JSON,
+      env.VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON,
+    );
+    if (!raw) return;
+    try {
+      const parsed = JSON.parse(raw);
+      const entries = Array.isArray(parsed)
+        ? parsed
+        : parsed && typeof parsed === "object" && "apps" in parsed
+          ? parsed.apps
+          : null;
+      if (!Array.isArray(entries)) return;
+      const paths = Array.from(
+        new Set(
+          entries
+            .map((entry) => {
+              if (!entry || typeof entry !== "object") return null;
+              const rawPath =
+                typeof entry.path === "string"
+                  ? entry.path
+                  : typeof entry.id === "string"
+                    ? "/" + entry.id
+                    : null;
+              if (!rawPath) return null;
+              const normalized = normalizeAppBasePath(rawPath);
+              return normalized || null;
+            })
+            .filter(Boolean),
+        ),
+      );
+      return paths.length ? paths : undefined;
+    } catch {
+      return;
+    }
+  })();
   const appHomePath = resolveAgentNativeAppHomePath(getAgentNativeAppConfig().app);
   const config = {
     appHomePath,
@@ -1370,6 +1407,7 @@ function getAppOriginClientConfigScript() {
     ...(workspaceGatewayUrl ? { workspaceGatewayUrl } : {}),
     ...(workspaceOAuthOrigin ? { workspaceOAuthOrigin } : {}),
     ...(workspaceRuntime ? { workspaceRuntime: true } : {}),
+    ...(workspaceAppMountPaths ? { workspaceAppMountPaths } : {}),
   };
   if (Object.keys(config).length === 0) return null;
   return (

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
+    error?: undefined;
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,8 +26,8 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
+    error?: undefined;
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
+    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,9 +59,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,9 +75,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
+    deleted?: undefined;
     id?: undefined;
+    found?: undefined;
     message?: undefined;
-    deleted?: undefined;
     providers: {
         id: string;
         label: string;
@@ -89,13 +90,12 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     }[];
     count: number;
     provider?: undefined;
-    found?: undefined;
     registered?: undefined;
     label?: undefined;
 } | {
+    deleted?: undefined;
     id?: undefined;
     message?: undefined;
-    deleted?: undefined;
     providers?: undefined;
     count?: undefined;
     found: boolean;
@@ -103,8 +103,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
-    message?: undefined;
     deleted?: undefined;
+    message?: undefined;
     providers?: undefined;
     count?: undefined;
     provider?: undefined;
@@ -113,21 +113,21 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     label?: undefined;
 } | {
+    found?: undefined;
     message?: undefined;
     providers?: undefined;
     count?: undefined;
     provider?: undefined;
-    found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
 } | {
     deleted?: undefined;
+    found?: undefined;
     providers?: undefined;
     count?: undefined;
     provider?: undefined;
-    found?: undefined;
     registered: boolean;
     id: string;
     label: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,9 +311,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        deleted?: undefined;
         id?: undefined;
-        provider?: undefined;
+        deleted?: undefined;
+        found?: undefined;
         providers: {
             id: string;
             label: string;
@@ -324,13 +324,13 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
-        found?: undefined;
+        provider?: undefined;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
-        deleted?: undefined;
         id?: undefined;
+        deleted?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;
@@ -340,19 +340,19 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         message?: undefined;
     } | {
         deleted?: undefined;
-        provider?: undefined;
         providers?: undefined;
         count?: undefined;
+        provider?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
         message?: undefined;
     } | {
-        provider?: undefined;
+        found?: undefined;
         providers?: undefined;
         count?: undefined;
-        found?: undefined;
+        provider?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
@@ -360,10 +360,10 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         message?: undefined;
     } | {
         deleted?: undefined;
-        provider?: undefined;
+        found?: undefined;
         providers?: undefined;
         count?: undefined;
-        found?: undefined;
+        provider?: undefined;
         registered: boolean;
         id: string;
         label: string;

package/dist/provider-api/corpus-jobs.d.ts

@@ -73,6 +73,7 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     offset?: unknown;
     limit?: unknown;
 }, {
+    deleted?: undefined;
     jobs: {
         id: string;
         name: string;
@@ -83,7 +84,6 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
         updatedAt: string;
     }[];
     total: number;
-    deleted?: undefined;
     jobId?: undefined;
 } | {
     jobs?: undefined;
@@ -91,9 +91,9 @@ export declare function createProviderCorpusJobAction(options: CreateProviderCor
     deleted: boolean;
     jobId: string;
 } | {
+    deleted?: undefined;
     jobs?: undefined;
     total?: undefined;
-    deleted?: undefined;
     jobId?: undefined;
     hits: Record<string, unknown>[];
     offset: number;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -34,10 +34,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/app-origin-config.d.ts

@@ -21,5 +21,6 @@ export declare function resolvePublicAppOriginConfig(): {
     workspaceGatewayUrl?: string;
     workspaceOAuthOrigin?: string;
     workspaceRuntime?: boolean;
+    workspaceAppMountPaths?: string[];
 } | null;
 export declare function getAppOriginClientConfigScript(): string | null;

package/dist/server/app-origin-config.js

@@ -1,4 +1,38 @@
 import { getAppConfig, resolveAppHomePath } from "../app-config/index.js";
+import { normalizeAppBasePath } from "./app-base-path.js";
+function workspaceAppMountPathsFromJson(value) {
+    if (!value?.trim())
+        return undefined;
+    try {
+        const parsed = JSON.parse(value);
+        const entries = Array.isArray(parsed)
+            ? parsed
+            : parsed && typeof parsed === "object" && "apps" in parsed
+                ? parsed.apps
+                : null;
+        if (!Array.isArray(entries))
+            return undefined;
+        const paths = entries
+            .map((entry) => {
+            if (!entry || typeof entry !== "object")
+                return null;
+            const record = entry;
+            const rawPath = typeof record.path === "string"
+                ? record.path
+                : typeof record.id === "string"
+                    ? `/${record.id}`
+                    : undefined;
+            const normalized = normalizeAppBasePath(rawPath);
+            return normalized || null;
+        })
+            .filter((path) => Boolean(path));
+        return paths.length ? Array.from(new Set(paths)) : undefined;
+    }
+    catch {
+        // coercion-ok: malformed manifests omit optional mount hints; the browser falls back to the live segment.
+        return undefined;
+    }
+}
 /**
  * Project this app's origins into the client shell.
  *
@@ -20,6 +54,7 @@ export function resolvePublicAppOriginConfig() {
     const config = getAppConfig();
     const workspaceRuntime = config.workspace.isWorkspace === true ||
         typeof config.workspace.appsJson === "string";
+    const workspaceAppMountPaths = workspaceAppMountPathsFromJson(config.workspace.appsJson);
     const resolved = {
         appHomePath: resolveAppHomePath(config.app),
         ...(config.app.url ? { appUrl: config.app.url } : {}),
@@ -30,6 +65,7 @@ export function resolvePublicAppOriginConfig() {
             ? { workspaceOAuthOrigin: config.workspace.oauthOrigin }
             : {}),
         ...(workspaceRuntime ? { workspaceRuntime: true } : {}),
+        ...(workspaceAppMountPaths ? { workspaceAppMountPaths } : {}),
     };
     return Object.keys(resolved).length > 0 ? resolved : null;
 }

package/dist/server/auth.js

@@ -419,12 +419,10 @@ export function getConfiguredLoginHtml(event) {
     const config = _authGuardConfig;
     if (!config)
         return null;
-    const url = event.node?.req?.url ?? event.path ?? "/";
-    const queryStart = url.indexOf("?");
-    const rawPath = queryStart >= 0 ? url.slice(0, queryStart) : url;
+    const { rawPath } = getRequestPathAndSearch(event);
     const loginHtml = config.getLoginHtml?.(event, rawPath) ?? config.loginHtml ?? null;
     return loginHtml
-        ? injectLoginSocialImageMeta(injectBetaOptOutPersistence(loginHtml), event)
+        ? injectLoginSocialImageMeta(injectBetaOptOutPersistence(loginHtml, rawPath), event)
         : null;
 }
 /**
@@ -2273,7 +2271,7 @@ function injectHeadScript(html, script) {
     return `<!doctype html><html><head>${script}</head><body>${html}</body></html>`;
 }
 function loginHtmlResponse(loginHtml, event, options = {}) {
-    let html = injectLoginSocialImageMeta(injectBetaOptOutPersistence(loginHtml), options.requestIndependent ? undefined : event);
+    let html = injectLoginSocialImageMeta(injectBetaOptOutPersistence(loginHtml, getRequestPathAndSearch(event).rawPath), options.requestIndependent ? undefined : event);
     if (options.includeRootAuthRedirect) {
         html = injectHeadScript(html, getSsrAuthRedirectScript(SESSION_HINT_COOKIE, resolveAppHomePath(getAppConfig().app)));
     }

package/dist/server/beta-opt-out-html.d.ts

@@ -4,4 +4,4 @@ export declare const BETA_OPT_OUT_PERSISTENCE_MARKER = "Persist the beta opt-out
  * Keep the production switcher's one-time opt-out behavior at the shared auth
  * response boundary so those pages cannot drop the handoff before sign-in.
  */
-export declare function injectBetaOptOutPersistence(loginHtml: string): string;
+export declare function injectBetaOptOutPersistence(loginHtml: string, requestPath?: string): string;

package/dist/server/beta-opt-out-html.js

@@ -1,4 +1,7 @@
-import { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
+import { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, BETA_REDIRECT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "../shared/environment-lanes.js";
+import { getSsrBetaRedirectScript, SSR_BETA_REDIRECT_MARKER, } from "../shared/ssr-beta-redirect.js";
+import { getAppBasePathFromViteEnv } from "./app-base-path.js";
+import { workspaceBasePathFromRequest } from "./onboarding-html.js";
 export const BETA_OPT_OUT_PERSISTENCE_MARKER = "Persist the beta opt-out before authentication";
 const ENVIRONMENT_SWITCHER_MARKER = 'data-agent-native-environment-switcher="1"';
 const ENVIRONMENT_SWITCHER_STYLE_MARKER = 'data-agent-native-environment-switcher-style="1"';
@@ -190,6 +193,7 @@ const betaOptOutPersistenceScript = `<script data-agent-native-beta-opt-out>
           ${JSON.stringify(BETA_OPT_OUT_STORAGE_KEY)},
           String(optOutExpiry),
         );
+        window.localStorage.removeItem(${JSON.stringify(BETA_REDIRECT_STORAGE_KEY)});
       }
       optOutStorageReady = true;
     } catch (error) {
@@ -209,8 +213,12 @@ const betaOptOutPersistenceScript = `<script data-agent-native-beta-opt-out>
  * Keep the production switcher's one-time opt-out behavior at the shared auth
  * response boundary so those pages cannot drop the handoff before sign-in.
  */
-export function injectBetaOptOutPersistence(loginHtml) {
+export function injectBetaOptOutPersistence(loginHtml, requestPath) {
     let html = loginHtml;
+    if (!html.includes(SSR_BETA_REDIRECT_MARKER)) {
+        const appBasePath = workspaceBasePathFromRequest(requestPath) || getAppBasePathFromViteEnv();
+        html = insertBeforeClosingTag(html, getSsrBetaRedirectScript(`${appBasePath}/_agent-native/auth/session`), "</head>");
+    }
     if (!html.includes(BETA_OPT_OUT_PERSISTENCE_MARKER)) {
         html = insertBeforeClosingTag(html, betaOptOutPersistenceScript, "</body>");
     }

package/dist/server/onboarding-html.d.ts

@@ -1,4 +1,5 @@
 import { type GoogleAuthMode } from "./google-auth-mode.js";
+export declare function workspaceBasePathFromRequest(requestPath: string | undefined): string;
 export interface SignupLegalNoticeOptions {
     termsUrl: string;
     privacyUrl: string;

package/dist/server/onboarding-html.js

@@ -52,7 +52,7 @@ function isWorkspaceRuntime() {
     const workspace = getAppConfig().workspace;
     return (workspace.isWorkspace === true || typeof workspace.appsJson === "string");
 }
-function workspaceBasePathFromRequest(requestPath) {
+export function workspaceBasePathFromRequest(requestPath) {
     if (!isWorkspaceRuntime() || !requestPath)
         return "";
     const pathname = requestPath.split(/[?#]/, 1)[0] || "/";

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;

package/dist/shared/environment-lanes.d.ts

@@ -1,6 +1,9 @@
 export declare const BETA_OPT_OUT_QUERY_PARAM = "agentNativeBetaOptOut";
 export declare const BETA_OPT_OUT_DURATION_MS: number;
 export declare const BETA_OPT_OUT_STORAGE_KEY = "agent-native:beta-opt-out-until";
+export declare const BETA_REDIRECT_DURATION_MS: number;
+export declare const BETA_REDIRECT_STORAGE_KEY = "agent-native:beta-redirect-until";
+export declare const BETA_REDIRECT_SIGN_OUT_STORAGE_KEY = "agent-native:beta-redirect-signing-out";
 export declare const BETA_FORCE_QUERY_PARAM = "force";
 export declare const BETA_FORCE_SESSION_STORAGE_KEY = "agent-native:force-production";
 export declare const ENVIRONMENT_BETA_HOSTS: {

package/dist/shared/environment-lanes.js

@@ -1,6 +1,9 @@
 export const BETA_OPT_OUT_QUERY_PARAM = "agentNativeBetaOptOut";
 export const BETA_OPT_OUT_DURATION_MS = 8 * 60 * 60 * 1000;
 export const BETA_OPT_OUT_STORAGE_KEY = "agent-native:beta-opt-out-until";
+export const BETA_REDIRECT_DURATION_MS = 30 * 24 * 60 * 60 * 1000;
+export const BETA_REDIRECT_STORAGE_KEY = "agent-native:beta-redirect-until";
+export const BETA_REDIRECT_SIGN_OUT_STORAGE_KEY = "agent-native:beta-redirect-signing-out";
 export const BETA_FORCE_QUERY_PARAM = "force";
 export const BETA_FORCE_SESSION_STORAGE_KEY = "agent-native:force-production";
 export const ENVIRONMENT_BETA_HOSTS = {

package/dist/shared/index.d.ts

@@ -7,7 +7,7 @@ export { truncate } from "./truncate.js";
 export { isHumanReadableDocumentTitle, normalizeDocumentTitle, } from "./document-title.js";
 export { injectDocumentMarkup } from "./html-document.js";
 export { withBuilderUtmTrackingParams } from "./builder-link-tracking.js";
-export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, resolveEnvironmentTargets, type EnvironmentBadgeTargets, } from "./environment-lanes.js";
+export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_REDIRECT_DURATION_MS, BETA_REDIRECT_STORAGE_KEY, BETA_REDIRECT_SIGN_OUT_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, resolveEnvironmentTargets, type EnvironmentBadgeTargets, } from "./environment-lanes.js";
 export { SSR_HTML_CONTENT_TYPE, SSR_QUERY_CACHE_KEY_HEADER, type SsrHtmlContentTypeOptions, withSsrHtmlContentType, } from "./cache-control.js";
 export { SURFACE_HIDDEN_FLAG, SURFACE_VISIBILITY_EVENT, addSurfaceVisibilityListener, buildSurfaceVisibilityScript, isHostSurfaceHidden, isSurfaceHidden, } from "./surface-visibility.js";
 export { AGENT_NATIVE_DOCS_ORIGIN, docsUrl, type DocsUrlOptions, } from "./docs-url.js";

package/dist/shared/index.js

@@ -7,7 +7,7 @@ export { truncate } from "./truncate.js";
 export { isHumanReadableDocumentTitle, normalizeDocumentTitle, } from "./document-title.js";
 export { injectDocumentMarkup } from "./html-document.js";
 export { withBuilderUtmTrackingParams } from "./builder-link-tracking.js";
-export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, resolveEnvironmentTargets, } from "./environment-lanes.js";
+export { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_REDIRECT_DURATION_MS, BETA_REDIRECT_STORAGE_KEY, BETA_REDIRECT_SIGN_OUT_STORAGE_KEY, BETA_OPT_OUT_DURATION_MS, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, resolveEnvironmentTargets, } from "./environment-lanes.js";
 export { SSR_HTML_CONTENT_TYPE, SSR_QUERY_CACHE_KEY_HEADER, withSsrHtmlContentType, } from "./cache-control.js";
 export { SURFACE_HIDDEN_FLAG, SURFACE_VISIBILITY_EVENT, addSurfaceVisibilityListener, buildSurfaceVisibilityScript, isHostSurfaceHidden, isSurfaceHidden, } from "./surface-visibility.js";
 export { AGENT_NATIVE_DOCS_ORIGIN, docsUrl, } from "./docs-url.js";

package/dist/shared/ssr-beta-redirect.d.ts

@@ -0,0 +1,8 @@
+export declare const SSR_BETA_REDIRECT_MARKER = "data-agent-native-beta-redirect=\"1\"";
+/**
+ * The marker is a performance hint set after the client verifies a Builder
+ * employee session. The browser re-checks the current session before using
+ * it, so it never becomes an authorization check.
+ */
+export declare function getSsrBetaRedirectScriptBody(sessionPath?: string): string;
+export declare function getSsrBetaRedirectScript(sessionPath?: string): string;

package/dist/shared/ssr-beta-redirect.js

@@ -0,0 +1,215 @@
+import { safeJsonForHtml } from "./agent-readable-resource.js";
+import { BETA_FORCE_QUERY_PARAM, BETA_FORCE_SESSION_STORAGE_KEY, BETA_OPT_OUT_QUERY_PARAM, BETA_OPT_OUT_STORAGE_KEY, BETA_REDIRECT_STORAGE_KEY, BETA_REDIRECT_SIGN_OUT_STORAGE_KEY, ENVIRONMENT_BETA_HOSTS, } from "./environment-lanes.js";
+export const SSR_BETA_REDIRECT_MARKER = 'data-agent-native-beta-redirect="1"';
+/**
+ * The marker is a performance hint set after the client verifies a Builder
+ * employee session. The browser re-checks the current session before using
+ * it, so it never becomes an authorization check.
+ */
+export function getSsrBetaRedirectScriptBody(sessionPath = "/_agent-native/auth/session") {
+    return `(function __anEarlyBetaRedirect() {
+  if (window.__agentNativeBetaRedirectStarted) return;
+  window.__agentNativeBetaRedirectStarted = true;
+  if (window.parent !== window) return;
+
+  var betaHosts = ${JSON.stringify(ENVIRONMENT_BETA_HOSTS)};
+  var hostname = (window.location.hostname || '').toLowerCase().replace(/\\.$/, '');
+  var productionHost = hostname.indexOf('beta.') === 0 ? hostname.slice(5) : hostname;
+  var betaHost = betaHosts[productionHost];
+  if (typeof betaHost !== 'string' || betaHost === hostname) return;
+
+  var currentUrl;
+  try {
+    currentUrl = new URL(window.location.href);
+  } catch (error) {
+    void error;
+    return;
+  }
+
+  if (currentUrl.searchParams.get(${JSON.stringify(BETA_FORCE_QUERY_PARAM)}) === 'true') {
+    try {
+      window.sessionStorage.setItem(${JSON.stringify(BETA_FORCE_SESSION_STORAGE_KEY)}, '1');
+    } catch (error) {
+      void error;
+    }
+    return;
+  }
+
+  try {
+    if (window.sessionStorage.getItem(${JSON.stringify(BETA_FORCE_SESSION_STORAGE_KEY)}) === '1') return;
+  } catch (error) {
+    void error;
+  }
+
+  if (/AgentNativeDesktop/i.test((window.navigator && window.navigator.userAgent) || '')) return;
+
+  var optOutValue = currentUrl.searchParams.get(${JSON.stringify(BETA_OPT_OUT_QUERY_PARAM)});
+  if (optOutValue !== null) {
+    var optOutExpiry = Number(optOutValue);
+    if (Number.isFinite(optOutExpiry) && optOutExpiry > Date.now()) {
+      try {
+        window.localStorage.setItem(
+          ${JSON.stringify(BETA_OPT_OUT_STORAGE_KEY)},
+          String(optOutExpiry),
+        );
+        window.localStorage.removeItem(${JSON.stringify(BETA_REDIRECT_STORAGE_KEY)});
+      } catch (error) {
+        void error;
+        return;
+      }
+      currentUrl.searchParams.delete(${JSON.stringify(BETA_OPT_OUT_QUERY_PARAM)});
+      try {
+        window.history.replaceState(null, '', currentUrl.toString());
+      } catch (error) {
+        void error;
+      }
+      return;
+    }
+
+    currentUrl.searchParams.delete(${JSON.stringify(BETA_OPT_OUT_QUERY_PARAM)});
+    try {
+      window.history.replaceState(null, '', currentUrl.toString());
+    } catch (error) {
+      void error;
+    }
+  }
+
+  var storedOptOut;
+  var storedRedirect;
+  try {
+    storedOptOut = window.localStorage.getItem(${JSON.stringify(BETA_OPT_OUT_STORAGE_KEY)});
+    if (storedOptOut !== null) {
+      var storedOptOutExpiry = Number(storedOptOut);
+      if (Number.isFinite(storedOptOutExpiry) && storedOptOutExpiry > Date.now()) return;
+      window.localStorage.removeItem(${JSON.stringify(BETA_OPT_OUT_STORAGE_KEY)});
+    }
+    storedRedirect = window.localStorage.getItem(${JSON.stringify(BETA_REDIRECT_STORAGE_KEY)});
+  } catch (error) {
+    void error;
+    return;
+  }
+
+  var redirectExpiry = Number(storedRedirect);
+  function clearRedirectMarker() {
+    try {
+      window.localStorage.removeItem(${JSON.stringify(BETA_REDIRECT_STORAGE_KEY)});
+    } catch (error) {
+      void error;
+    }
+  }
+
+  function isSignOutStarted() {
+    if (window.__agentNativeBetaRedirectSignOutStarted === true) return true;
+    try {
+      return window.sessionStorage.getItem(${JSON.stringify(BETA_REDIRECT_SIGN_OUT_STORAGE_KEY)}) === '1';
+    } catch (error) {
+      void error;
+      return false;
+    }
+  }
+
+  if (!Number.isFinite(redirectExpiry) || redirectExpiry <= Date.now()) {
+    if (storedRedirect !== null) clearRedirectMarker();
+    return;
+  }
+
+  if (isSignOutStarted()) return;
+
+  if (typeof window.fetch !== 'function') return;
+
+  var sessionProbePath = ${safeJsonForHtml(sessionPath)};
+  var appConfig = window.__AGENT_NATIVE_CONFIG__;
+  if (appConfig && appConfig.workspaceRuntime === true) {
+    var frameworkSessionPath = '/_agent-native/auth/session';
+    var mountSegment = currentUrl.pathname.split('/').find(function (segment) {
+      return segment;
+    });
+    var workspaceMount = mountSegment &&
+      mountSegment !== '_agent-native' &&
+      mountSegment !== 'api' &&
+      mountSegment !== 'sign-in' &&
+      mountSegment !== 'login' &&
+      mountSegment !== 'signup'
+      ? '/' + mountSegment
+      : '';
+    var knownWorkspaceMounts = Array.isArray(appConfig.workspaceAppMountPaths)
+      ? appConfig.workspaceAppMountPaths
+      : null;
+    var knownWorkspaceMount = !knownWorkspaceMounts ||
+      knownWorkspaceMounts.indexOf(workspaceMount) !== -1;
+    if (
+      workspaceMount &&
+      knownWorkspaceMount &&
+      typeof sessionProbePath === 'string' &&
+      sessionProbePath.endsWith(frameworkSessionPath)
+    ) {
+      var configuredWorkspaceMount = sessionProbePath.slice(
+        0,
+        -frameworkSessionPath.length,
+      );
+      if (configuredWorkspaceMount !== workspaceMount) {
+        sessionProbePath = workspaceMount + frameworkSessionPath;
+      }
+    }
+  }
+
+  window.fetch(sessionProbePath, {
+    credentials: 'same-origin',
+    cache: 'no-store',
+    headers: { 'Accept': 'application/json' }
+  }).then(function (response) {
+    if (!response || !response.ok) {
+      if (response && (response.status === 401 || response.status === 403)) {
+        clearRedirectMarker();
+        return null;
+      }
+      return undefined;
+    }
+    return response.json();
+  }).then(function (session) {
+    if (session === undefined) return;
+    var email = session && !session.error && typeof session.email === 'string'
+      ? session.email.trim().toLowerCase()
+      : '';
+    if (!email.endsWith('@builder.io')) {
+      clearRedirectMarker();
+      return;
+    }
+
+    if (isSignOutStarted()) return;
+
+    var latestUrl;
+    try {
+      latestUrl = new URL(window.location.href);
+    } catch (error) {
+      void error;
+      return;
+    }
+    var latestHostname = (latestUrl.hostname || '').toLowerCase().replace(/\\.$/, '');
+    var latestProductionHost = latestHostname.indexOf('beta.') === 0
+      ? latestHostname.slice(5)
+      : latestHostname;
+    if (latestHostname !== hostname || betaHosts[latestProductionHost] !== betaHost) return;
+    if (latestUrl.searchParams.get(${JSON.stringify(BETA_FORCE_QUERY_PARAM)}) === 'true') return;
+    var latestOptOut = latestUrl.searchParams.get(${JSON.stringify(BETA_OPT_OUT_QUERY_PARAM)});
+    if (latestOptOut !== null && Number(latestOptOut) > Date.now()) return;
+
+    latestUrl.protocol = 'https:';
+    latestUrl.hostname = betaHost;
+    latestUrl.port = '';
+    latestUrl.searchParams.delete(${JSON.stringify(BETA_OPT_OUT_QUERY_PARAM)});
+    try {
+      window.location.replace(latestUrl.toString());
+    } catch (error) {
+      void error;
+    }
+  }).catch(function (error) {
+    void error;
+    // A transient session failure must leave production usable; retry the hint
+    // on a later navigation instead of redirecting without a current session.
+  });
+})();`;
+}
+export function getSsrBetaRedirectScript(sessionPath = "/_agent-native/auth/session") {
+    return `<script ${SSR_BETA_REDIRECT_MARKER}>${getSsrBetaRedirectScriptBody(sessionPath)}</script>`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.176.4-nightly-20260902022549",
+  "version": "0.176.4-nightly-20260902024948",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {