@jami-studio/core 0.92.32 → 0.92.34

package/dist/notifications/routes.d.ts

@@ -28,7 +28,7 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/observability/routes.d.ts

@@ -41,28 +41,28 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
-    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -49,8 +49,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,11 +27,11 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};
 //# sourceMappingURL=agent-engine-api-key-route.d.ts.map

package/dist/server/app-base-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-base-path.d.ts","sourceRoot":"","sources":["../../src/server/app-base-path.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAIjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAalD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAA6B,GACpC,MAAM,CAOR;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmBjE"}
+{"version":3,"file":"app-base-path.d.ts","sourceRoot":"","sources":["../../src/server/app-base-path.ts"],"names":[],"mappings":"AAEA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAMtE;AAED,wBAAgB,wBAAwB,IAAI,MAAM,CAajD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAelD;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAA6B,GACpC,MAAM,CAOR;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmBjE"}

package/dist/server/app-base-path.js

@@ -1,3 +1,4 @@
+import { getModuleGraphEnvDefault } from "../shared/global-scope.js";
 export function normalizeAppBasePath(value) {
     if (!value || value === "/")
         return "";
@@ -8,7 +9,16 @@ export function normalizeAppBasePath(value) {
     return normalized ? `/${normalized}` : "";
 }
 export function getConfiguredAppBasePath() {
-    return normalizeAppBasePath(process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH);
+    return normalizeAppBasePath(process.env.VITE_APP_BASE_PATH ||
+        process.env.APP_BASE_PATH ||
+        // Unified workerd deployments deliver per-app config via the module
+        // graph (shared process.env would cross-poison sibling apps). Without
+        // this, the auth guard cannot strip the mount prefix, so app-declared
+        // public paths outside /api and /_agent-native (e.g. analytics
+        // /track) never match on the unified worker. Matches the Netlify
+        // preset, which delivers the same value via per-function env.
+        getModuleGraphEnvDefault("VITE_APP_BASE_PATH") ||
+        getModuleGraphEnvDefault("APP_BASE_PATH"));
 }
 /**
  * SSR-aware variant of getConfiguredAppBasePath.
@@ -27,7 +37,9 @@ export function getAppBasePathFromViteEnv() {
         process.env.APP_BASE_PATH ||
         metaEnv?.VITE_APP_BASE_PATH ||
         metaEnv?.APP_BASE_PATH ||
-        metaEnv?.BASE_URL);
+        metaEnv?.BASE_URL ||
+        getModuleGraphEnvDefault("VITE_APP_BASE_PATH") ||
+        getModuleGraphEnvDefault("APP_BASE_PATH"));
 }
 /**
  * Strip the configured app base path prefix from a pathname.

package/dist/server/app-base-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-base-path.js","sourceRoot":"","sources":["../../src/server/app-base-path.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GACX,OAAO,IAGR,CAAC,GAAG,CAAC;IACN,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC5B,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,QAAQ,CACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,QAAQ,GAAG,wBAAwB,EAAE;IAErC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;AACjC,CAAC","sourcesContent":["export function normalizeAppBasePath(value: string | undefined): string {\r\n  if (!value || value === \"/\") return \"\";\r\n  const trimmed = value.trim();\r\n  if (!trimmed || trimmed === \"/\") return \"\";\r\n  const normalized = trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\r\n  return normalized ? `/${normalized}` : \"\";\r\n}\r\n\r\nexport function getConfiguredAppBasePath(): string {\r\n  return normalizeAppBasePath(\r\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\r\n  );\r\n}\r\n\r\n/**\r\n * SSR-aware variant of getConfiguredAppBasePath.\r\n *\r\n * In SSR builds (Vite's server-side bundle), `process.env` may not carry\r\n * VITE_* variables that were only statically replaced at build time. As a\r\n * fallback this variant also checks `import.meta.env` (available inside a\r\n * Vite SSR build) including `BASE_URL`, which Vite sets from the `base`\r\n * config option. Used by ssr-handler.ts where the Nitro server bundle is\r\n * built with Vite and the env may be delivered via import.meta rather than\r\n * process.env.\r\n */\r\nexport function getAppBasePathFromViteEnv(): string {\r\n  const metaEnv = (\r\n    import.meta as unknown as {\r\n      env?: Record<string, string | undefined>;\r\n    }\r\n  ).env;\r\n  return normalizeAppBasePath(\r\n    process.env.VITE_APP_BASE_PATH ||\r\n      process.env.APP_BASE_PATH ||\r\n      metaEnv?.VITE_APP_BASE_PATH ||\r\n      metaEnv?.APP_BASE_PATH ||\r\n      metaEnv?.BASE_URL,\r\n  );\r\n}\r\n\r\n/**\r\n * Strip the configured app base path prefix from a pathname.\r\n *\r\n * Returns \"/\" when the pathname equals the base path exactly, the suffix\r\n * when it starts with `${basePath}/`, or the original pathname unchanged\r\n * when no prefix match is found.\r\n */\r\nexport function stripAppBasePath(\r\n  pathname: string,\r\n  basePath = getConfiguredAppBasePath(),\r\n): string {\r\n  if (!basePath) return pathname;\r\n  if (pathname === basePath) return \"/\";\r\n  if (pathname.startsWith(`${basePath}/`)) {\r\n    return pathname.slice(basePath.length) || \"/\";\r\n  }\r\n  return pathname;\r\n}\r\n\r\nexport function withConfiguredAppBasePath(baseUrl: string): string {\r\n  const basePath = getConfiguredAppBasePath();\r\n  const trimmed = baseUrl.replace(/\\/$/, \"\");\r\n  if (!basePath) return trimmed;\r\n\r\n  try {\r\n    const url = new URL(trimmed);\r\n    const pathname = normalizeAppBasePath(url.pathname);\r\n    if (pathname === basePath || pathname.startsWith(`${basePath}/`)) {\r\n      return trimmed;\r\n    }\r\n  } catch {\r\n    // Fall through for relative or otherwise non-URL strings.\r\n  }\r\n\r\n  if (trimmed.endsWith(basePath) || trimmed.includes(`${basePath}/`)) {\r\n    return trimmed;\r\n  }\r\n  return `${trimmed}${basePath}`;\r\n}\r\n"]}
+{"version":3,"file":"app-base-path.js","sourceRoot":"","sources":["../../src/server/app-base-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC5B,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,oEAAoE;QACpE,sEAAsE;QACtE,sEAAsE;QACtE,+DAA+D;QAC/D,iEAAiE;QACjE,8DAA8D;QAC9D,wBAAwB,CAAC,oBAAoB,CAAC;QAC9C,wBAAwB,CAAC,eAAe,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB;IACvC,MAAM,OAAO,GACX,OAAO,IAGR,CAAC,GAAG,CAAC;IACN,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC5B,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,QAAQ;QACjB,wBAAwB,CAAC,oBAAoB,CAAC;QAC9C,wBAAwB,CAAC,eAAe,CAAC,CAC5C,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,QAAQ,GAAG,wBAAwB,EAAE;IAErC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAE9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,OAAO,GAAG,QAAQ,EAAE,CAAC;AACjC,CAAC","sourcesContent":["import { getModuleGraphEnvDefault } from \"../shared/global-scope.js\";\r\n\r\nexport function normalizeAppBasePath(value: string | undefined): string {\r\n  if (!value || value === \"/\") return \"\";\r\n  const trimmed = value.trim();\r\n  if (!trimmed || trimmed === \"/\") return \"\";\r\n  const normalized = trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\");\r\n  return normalized ? `/${normalized}` : \"\";\r\n}\r\n\r\nexport function getConfiguredAppBasePath(): string {\r\n  return normalizeAppBasePath(\r\n    process.env.VITE_APP_BASE_PATH ||\r\n      process.env.APP_BASE_PATH ||\r\n      // Unified workerd deployments deliver per-app config via the module\r\n      // graph (shared process.env would cross-poison sibling apps). Without\r\n      // this, the auth guard cannot strip the mount prefix, so app-declared\r\n      // public paths outside /api and /_agent-native (e.g. analytics\r\n      // /track) never match on the unified worker. Matches the Netlify\r\n      // preset, which delivers the same value via per-function env.\r\n      getModuleGraphEnvDefault(\"VITE_APP_BASE_PATH\") ||\r\n      getModuleGraphEnvDefault(\"APP_BASE_PATH\"),\r\n  );\r\n}\r\n\r\n/**\r\n * SSR-aware variant of getConfiguredAppBasePath.\r\n *\r\n * In SSR builds (Vite's server-side bundle), `process.env` may not carry\r\n * VITE_* variables that were only statically replaced at build time. As a\r\n * fallback this variant also checks `import.meta.env` (available inside a\r\n * Vite SSR build) including `BASE_URL`, which Vite sets from the `base`\r\n * config option. Used by ssr-handler.ts where the Nitro server bundle is\r\n * built with Vite and the env may be delivered via import.meta rather than\r\n * process.env.\r\n */\r\nexport function getAppBasePathFromViteEnv(): string {\r\n  const metaEnv = (\r\n    import.meta as unknown as {\r\n      env?: Record<string, string | undefined>;\r\n    }\r\n  ).env;\r\n  return normalizeAppBasePath(\r\n    process.env.VITE_APP_BASE_PATH ||\r\n      process.env.APP_BASE_PATH ||\r\n      metaEnv?.VITE_APP_BASE_PATH ||\r\n      metaEnv?.APP_BASE_PATH ||\r\n      metaEnv?.BASE_URL ||\r\n      getModuleGraphEnvDefault(\"VITE_APP_BASE_PATH\") ||\r\n      getModuleGraphEnvDefault(\"APP_BASE_PATH\"),\r\n  );\r\n}\r\n\r\n/**\r\n * Strip the configured app base path prefix from a pathname.\r\n *\r\n * Returns \"/\" when the pathname equals the base path exactly, the suffix\r\n * when it starts with `${basePath}/`, or the original pathname unchanged\r\n * when no prefix match is found.\r\n */\r\nexport function stripAppBasePath(\r\n  pathname: string,\r\n  basePath = getConfiguredAppBasePath(),\r\n): string {\r\n  if (!basePath) return pathname;\r\n  if (pathname === basePath) return \"/\";\r\n  if (pathname.startsWith(`${basePath}/`)) {\r\n    return pathname.slice(basePath.length) || \"/\";\r\n  }\r\n  return pathname;\r\n}\r\n\r\nexport function withConfiguredAppBasePath(baseUrl: string): string {\r\n  const basePath = getConfiguredAppBasePath();\r\n  const trimmed = baseUrl.replace(/\\/$/, \"\");\r\n  if (!basePath) return trimmed;\r\n\r\n  try {\r\n    const url = new URL(trimmed);\r\n    const pathname = normalizeAppBasePath(url.pathname);\r\n    if (pathname === basePath || pathname.startsWith(`${basePath}/`)) {\r\n      return trimmed;\r\n    }\r\n  } catch {\r\n    // Fall through for relative or otherwise non-URL strings.\r\n  }\r\n\r\n  if (trimmed.endsWith(basePath) || trimmed.includes(`${basePath}/`)) {\r\n    return trimmed;\r\n  }\r\n  return `${trimmed}${basePath}`;\r\n}\r\n"]}

package/dist/shared/global-scope.d.ts

@@ -52,4 +52,8 @@ export declare function scopedGlobalKeyName(base: string): string;
 export declare function getScopedGlobal<T>(base: string, init: () => T): T;
 /** Test helper — delete the pinned singleton for `base` in the ACTIVE scope. */
 export declare function __deleteScopedGlobal(base: string): void;
+/** Set (or clear with `null`) this module graph's baked env defaults. */
+export declare function setModuleGraphEnvDefaults(defaults: Record<string, string> | null): void;
+/** This module graph's baked default for `key`, or undefined. */
+export declare function getModuleGraphEnvDefault(key: string): string | undefined;
 //# sourceMappingURL=global-scope.d.ts.map

package/dist/shared/global-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"global-scope.d.ts","sourceRoot":"","sources":["../../src/shared/global-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAGxD;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAIjE;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvD"}
+{"version":3,"file":"global-scope.d.ts","sourceRoot":"","sources":["../../src/shared/global-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAGxD;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAIjE;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAGvD;AAqBD,yEAAyE;AACzE,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GACtC,IAAI,CAGN;AAED,iEAAiE;AACjE,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE"}

package/dist/shared/global-scope.js

@@ -67,4 +67,31 @@ export function __deleteScopedGlobal(base) {
     const key = Symbol.for(scopedGlobalKeyName(base));
     delete globalThis[key];
 }
+/**
+ * Per-module-graph env defaults for unified workspace deployments.
+ *
+ * workerd has no filesystem and no ambient build env, so per-app workspace
+ * config (app id, base path, audience, public/protected route lists) must be
+ * baked into the artifact. It CANNOT go through `process.env`: the unified
+ * worker shares ONE `process.env` across every app's module graph, so the
+ * first app's baked values would poison every sibling (the exact issue-35
+ * class the scope id above exists for — observed live as every app stripping
+ * paths against dispatch's base path, 401ing all framework routes).
+ *
+ * Instead the generated scope-init module stores this graph's per-app values
+ * here (module scope = per app bundle), and env readers fall back to
+ * `getModuleGraphEnvDefault` when the ambient env lacks the key. Real runtime
+ * env still wins; dev/single-app graphs never set defaults, so behavior is
+ * unchanged there.
+ */
+let moduleGraphEnvDefaults = null;
+/** Set (or clear with `null`) this module graph's baked env defaults. */
+export function setModuleGraphEnvDefaults(defaults) {
+    moduleGraphEnvDefaults =
+        defaults && Object.keys(defaults).length > 0 ? { ...defaults } : null;
+}
+/** This module graph's baked default for `key`, or undefined. */
+export function getModuleGraphEnvDefault(key) {
+    return moduleGraphEnvDefaults?.[key];
+}
 //# sourceMappingURL=global-scope.js.map

package/dist/shared/global-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"global-scope.js","sourceRoot":"","sources":["../../src/shared/global-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAiB;IAChD,MAAM,OAAO,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAI,IAAY,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,UAAsD,CAAC;IACjE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,OAAQ,UAAiD,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC","sourcesContent":["/**\n * Per-module-graph global scope for globalThis-pinned framework registries.\n *\n * Why this exists: several framework registries (file-upload providers,\n * private-blob providers, shareable resources, event bus, notification\n * channels, tracking providers, secrets registry) pin their state on\n * `globalThis` so that multiple ESM graphs of ONE app (Vite dev + Nitro,\n * symlinked node_modules, dist/ vs src/) still share a single registry.\n *\n * On a unified workspace deployment (Cloudflare Pages `_worker.js` dispatcher\n * importing every app's worker into ONE isolate) that pinning goes too far:\n * each app's bundle keeps its own module graph — so module-scope state is\n * correctly per-app — but the `globalThis` pin collapses all apps' registries\n * into one shared map. Real-world failure: an upload POSTed to /assets was\n * served by the clips app's registered S3 provider (wrong object prefix).\n *\n * The fix: each app's generated worker entry calls `setGlobalScopeId(appId)`\n * from a scope-init module evaluated FIRST in the entry's import graph (ESM\n * evaluates imports depth-first in declaration order, so the scope is set\n * before any registry module initializes or registers built-ins). Registries\n * resolve their `globalThis` key LAZILY through `getScopedGlobal`, which\n * namespaces the key by the module graph's scope id. Result:\n *\n * - Unified worker: each app's core copy has its own scope id → per-app keys\n *   → per-app registries. Cross-app state sharing is gone.\n * - Dev / single-app deployments: `setGlobalScopeId` is never called → keys\n *   are unscoped → the original multi-graph dedupe behavior is preserved.\n *\n * This module must stay dependency-free: it is imported by the generated\n * scope-init module before anything else in the app bundle evaluates.\n */\n\nlet moduleGraphScopeId: string | null = null;\n\n/**\n * Set the global-registry scope for THIS module graph (this app's bundle).\n * Called by the generated worker entry's scope-init module on unified\n * workspace deployments. Pass `null` to clear (tests).\n */\nexport function setGlobalScopeId(id: string | null): void {\n  const trimmed = typeof id === \"string\" ? id.trim() : \"\";\n  moduleGraphScopeId = trimmed ? trimmed : null;\n}\n\n/** The active scope id for this module graph, or `null` when unscoped. */\nexport function getGlobalScopeId(): string | null {\n  return moduleGraphScopeId;\n}\n\n/**\n * The fully-qualified global key name for `base` under the active scope.\n * Unscoped graphs get `base` unchanged, so existing dev-mode behavior\n * (one registry across all of an app's ESM graphs) is preserved.\n */\nexport function scopedGlobalKeyName(base: string): string {\n  return moduleGraphScopeId ? `${base}::app:${moduleGraphScopeId}` : base;\n}\n\n/**\n * Lazily resolve (and initialize once) a globalThis-pinned singleton under\n * the scope-aware key for `base`. Registries MUST call this per access —\n * never capture the result in module scope — so a scope id set during\n * entry-module evaluation is honored by every later registration and read.\n */\nexport function getScopedGlobal<T>(base: string, init: () => T): T {\n  const key = Symbol.for(scopedGlobalKeyName(base));\n  const g = globalThis as unknown as Record<symbol, T | undefined>;\n  return (g[key] ??= init());\n}\n\n/** Test helper — delete the pinned singleton for `base` in the ACTIVE scope. */\nexport function __deleteScopedGlobal(base: string): void {\n  const key = Symbol.for(scopedGlobalKeyName(base));\n  delete (globalThis as unknown as Record<symbol, unknown>)[key];\n}\n"]}
+{"version":3,"file":"global-scope.js","sourceRoot":"","sources":["../../src/shared/global-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,IAAI,kBAAkB,GAAkB,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAiB;IAChD,MAAM,OAAO,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,kBAAkB,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAC9B,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,OAAO,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAI,IAAY,EAAE,IAAa;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,GAAG,UAAsD,CAAC;IACjE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,OAAQ,UAAiD,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,IAAI,sBAAsB,GAAkC,IAAI,CAAC;AAEjE,yEAAyE;AACzE,MAAM,UAAU,yBAAyB,CACvC,QAAuC;IAEvC,sBAAsB;QACpB,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1E,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,OAAO,sBAAsB,EAAE,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC","sourcesContent":["/**\n * Per-module-graph global scope for globalThis-pinned framework registries.\n *\n * Why this exists: several framework registries (file-upload providers,\n * private-blob providers, shareable resources, event bus, notification\n * channels, tracking providers, secrets registry) pin their state on\n * `globalThis` so that multiple ESM graphs of ONE app (Vite dev + Nitro,\n * symlinked node_modules, dist/ vs src/) still share a single registry.\n *\n * On a unified workspace deployment (Cloudflare Pages `_worker.js` dispatcher\n * importing every app's worker into ONE isolate) that pinning goes too far:\n * each app's bundle keeps its own module graph — so module-scope state is\n * correctly per-app — but the `globalThis` pin collapses all apps' registries\n * into one shared map. Real-world failure: an upload POSTed to /assets was\n * served by the clips app's registered S3 provider (wrong object prefix).\n *\n * The fix: each app's generated worker entry calls `setGlobalScopeId(appId)`\n * from a scope-init module evaluated FIRST in the entry's import graph (ESM\n * evaluates imports depth-first in declaration order, so the scope is set\n * before any registry module initializes or registers built-ins). Registries\n * resolve their `globalThis` key LAZILY through `getScopedGlobal`, which\n * namespaces the key by the module graph's scope id. Result:\n *\n * - Unified worker: each app's core copy has its own scope id → per-app keys\n *   → per-app registries. Cross-app state sharing is gone.\n * - Dev / single-app deployments: `setGlobalScopeId` is never called → keys\n *   are unscoped → the original multi-graph dedupe behavior is preserved.\n *\n * This module must stay dependency-free: it is imported by the generated\n * scope-init module before anything else in the app bundle evaluates.\n */\n\nlet moduleGraphScopeId: string | null = null;\n\n/**\n * Set the global-registry scope for THIS module graph (this app's bundle).\n * Called by the generated worker entry's scope-init module on unified\n * workspace deployments. Pass `null` to clear (tests).\n */\nexport function setGlobalScopeId(id: string | null): void {\n  const trimmed = typeof id === \"string\" ? id.trim() : \"\";\n  moduleGraphScopeId = trimmed ? trimmed : null;\n}\n\n/** The active scope id for this module graph, or `null` when unscoped. */\nexport function getGlobalScopeId(): string | null {\n  return moduleGraphScopeId;\n}\n\n/**\n * The fully-qualified global key name for `base` under the active scope.\n * Unscoped graphs get `base` unchanged, so existing dev-mode behavior\n * (one registry across all of an app's ESM graphs) is preserved.\n */\nexport function scopedGlobalKeyName(base: string): string {\n  return moduleGraphScopeId ? `${base}::app:${moduleGraphScopeId}` : base;\n}\n\n/**\n * Lazily resolve (and initialize once) a globalThis-pinned singleton under\n * the scope-aware key for `base`. Registries MUST call this per access —\n * never capture the result in module scope — so a scope id set during\n * entry-module evaluation is honored by every later registration and read.\n */\nexport function getScopedGlobal<T>(base: string, init: () => T): T {\n  const key = Symbol.for(scopedGlobalKeyName(base));\n  const g = globalThis as unknown as Record<symbol, T | undefined>;\n  return (g[key] ??= init());\n}\n\n/** Test helper — delete the pinned singleton for `base` in the ACTIVE scope. */\nexport function __deleteScopedGlobal(base: string): void {\n  const key = Symbol.for(scopedGlobalKeyName(base));\n  delete (globalThis as unknown as Record<symbol, unknown>)[key];\n}\n\n/**\n * Per-module-graph env defaults for unified workspace deployments.\n *\n * workerd has no filesystem and no ambient build env, so per-app workspace\n * config (app id, base path, audience, public/protected route lists) must be\n * baked into the artifact. It CANNOT go through `process.env`: the unified\n * worker shares ONE `process.env` across every app's module graph, so the\n * first app's baked values would poison every sibling (the exact issue-35\n * class the scope id above exists for — observed live as every app stripping\n * paths against dispatch's base path, 401ing all framework routes).\n *\n * Instead the generated scope-init module stores this graph's per-app values\n * here (module scope = per app bundle), and env readers fall back to\n * `getModuleGraphEnvDefault` when the ambient env lacks the key. Real runtime\n * env still wins; dev/single-app graphs never set defaults, so behavior is\n * unchanged there.\n */\nlet moduleGraphEnvDefaults: Record<string, string> | null = null;\n\n/** Set (or clear with `null`) this module graph's baked env defaults. */\nexport function setModuleGraphEnvDefaults(\n  defaults: Record<string, string> | null,\n): void {\n  moduleGraphEnvDefaults =\n    defaults && Object.keys(defaults).length > 0 ? { ...defaults } : null;\n}\n\n/** This module graph's baked default for `key`, or undefined. */\nexport function getModuleGraphEnvDefault(key: string): string | undefined {\n  return moduleGraphEnvDefaults?.[key];\n}\n"]}

package/dist/shared/workspace-app-audience.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-app-audience.d.ts","sourceRoot":"","sources":["../../src/shared/workspace-app-audience.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,uBAAuB,YAAI,UAAU,EAAE,QAAQ,CAAU,CAAC;AAEvE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,eAAO,MAAM,8BAA8B,EAAE,oBAAiC,CAAC;AAE/E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,GACb,oBAAoB,CAEtB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAyBtE;AAED,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACvC,oBAAoB,GAAG,SAAS,CAOlC;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACvC,uBAAuB,CAYzB;AAED,wBAAgB,mCAAmC,CACjD,GAAG,EAAE,OAAO,GACX,oBAAoB,GAAG,SAAS,CASlC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAChD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,OAAO,GACX,iCAAiC,CAuBnC"}
+{"version":3,"file":"workspace-app-audience.d.ts","sourceRoot":"","sources":["../../src/shared/workspace-app-audience.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,YAAI,UAAU,EAAE,QAAQ,CAAU,CAAC;AAEvE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,eAAO,MAAM,8BAA8B,EAAE,oBAAiC,CAAC;AAE/E,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,OAAO,GACb,oBAAoB,CAEtB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAyBtE;AAED,wBAAgB,2BAA2B,CACzC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACvC,oBAAoB,GAAG,SAAS,CAYlC;AAED,wBAAgB,8BAA8B,CAC5C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACvC,uBAAuB,CAgBzB;AAED,wBAAgB,mCAAmC,CACjD,GAAG,EAAE,OAAO,GACX,oBAAoB,GAAG,SAAS,CASlC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iCAAiC;IAChD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,wBAAgB,sCAAsC,CACpD,GAAG,EAAE,OAAO,GACX,iCAAiC,CAuBnC"}

package/dist/shared/workspace-app-audience.js

@@ -1,3 +1,4 @@
+import { getModuleGraphEnvDefault } from "./global-scope.js";
 export const WORKSPACE_APP_AUDIENCES = ["internal", "public"];
 export const DEFAULT_WORKSPACE_APP_AUDIENCE = "internal";
 export function normalizeWorkspaceAppAudience(value) {
@@ -32,18 +33,26 @@ export function normalizeWorkspaceAppPathList(value) {
 export function workspaceAppAudienceFromEnv(env) {
     const source = env ?? (typeof process !== "undefined" ? process.env : {});
     const raw = source.AGENT_NATIVE_WORKSPACE_APP_AUDIENCE ??
-        source.VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE;
+        source.VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE ??
+        // Unified workerd deployments deliver per-app config via the module
+        // graph (shared process.env would cross-poison sibling apps).
+        (env === undefined
+            ? getModuleGraphEnvDefault("AGENT_NATIVE_WORKSPACE_APP_AUDIENCE")
+            : undefined);
     if (raw === undefined)
         return undefined;
     return normalizeWorkspaceAppAudience(raw);
 }
 export function workspaceAppRouteAccessFromEnv(env) {
     const source = env ?? (typeof process !== "undefined" ? process.env : {});
+    const moduleGraphFallback = (key) => env === undefined ? getModuleGraphEnvDefault(key) : undefined;
     return {
         publicPaths: normalizeWorkspaceAppPathList(source.AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS ??
-            source.VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS),
+            source.VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS ??
+            moduleGraphFallback("AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS")),
         protectedPaths: normalizeWorkspaceAppPathList(source.AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS ??
-            source.VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS),
+            source.VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS ??
+            moduleGraphFallback("AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS")),
     };
 }
 export function workspaceAppAudienceFromPackageJson(pkg) {

package/dist/shared/workspace-app-audience.js.map

@@ -1 +1 @@
-{"version":3,"file":"workspace-app-audience.js","sourceRoot":"","sources":["../../src/shared/workspace-app-audience.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC;AAIvE,MAAM,CAAC,MAAM,8BAA8B,GAAyB,UAAU,CAAC;AAO/E,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,IAAI,QAAQ,GAAc,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,+DAA+D;YAC/D,kEAAkE;YAClE,2DAA2D;YAC3D,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC/D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACb,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CACrE,CAAC;IACJ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAAwC;IAExC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GACP,MAAM,CAAC,mCAAmC;QAC1C,MAAM,CAAC,wCAAwC,CAAC;IAClD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAAwC;IAExC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,OAAO;QACL,WAAW,EAAE,6BAA6B,CACxC,MAAM,CAAC,uCAAuC;YAC5C,MAAM,CAAC,4CAA4C,CACtD;QACD,cAAc,EAAE,6BAA6B,CAC3C,MAAM,CAAC,0CAA0C;YAC/C,MAAM,CAAC,+CAA+C,CACzD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,GAAY;IAEZ,MAAM,MAAM,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,GAAG,GACP,MAAM,EAAE,YAAY,EAAE,QAAQ;QAC9B,MAAM,EAAE,SAAS,EAAE,QAAQ;QAC3B,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC;IACrC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAcD,MAAM,UAAU,sCAAsC,CACpD,GAAY;IAEZ,MAAM,MAAM,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,SAAS,GACb,MAAM,EAAE,YAAY,EAAE,WAAW;QACjC,MAAM,EAAE,YAAY,EAAE,eAAe;QACrC,MAAM,EAAE,SAAS,EAAE,WAAW;QAC9B,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,IAAI,EAAE,uBAAuB,CAAC;IACxC,MAAM,YAAY,GAChB,MAAM,EAAE,YAAY,EAAE,cAAc;QACpC,MAAM,EAAE,YAAY,EAAE,YAAY;QAClC,MAAM,EAAE,YAAY,EAAE,iBAAiB;QACvC,MAAM,EAAE,SAAS,EAAE,cAAc;QACjC,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,IAAI,EAAE,0BAA0B,CAAC;IAC3C,OAAO;QACL,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC;YACjC,CAAC,CAAC,EAAE,WAAW,EAAE,6BAA6B,CAAC,SAAS,CAAC,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,oBAAoB,CAAC,YAAY,CAAC;YACpC,CAAC,CAAC,EAAE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED,SAAS,iCAAiC,CAAC,GAAY;IAUrD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,GAA0B,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC;IAC5D,MAAM,MAAM,GACV,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAE,MAA8B;QACjC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,YAAY,GAChB,MAAM,CAAC,YAAY;QACnB,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QACjC,CAAC,CAAE,MAAM,CAAC,YAAoC;QAC9C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GACb,MAAM,CAAC,SAAS;QAChB,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC9B,CAAC,CAAE,MAAM,CAAC,SAAiC;QAC3C,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,YAAY;QACZ,SAAS;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC","sourcesContent":["export const WORKSPACE_APP_AUDIENCES = [\"internal\", \"public\"] as const;\r\n\r\nexport type WorkspaceAppAudience = (typeof WORKSPACE_APP_AUDIENCES)[number];\r\n\r\nexport const DEFAULT_WORKSPACE_APP_AUDIENCE: WorkspaceAppAudience = \"internal\";\r\n\r\nexport interface WorkspaceAppRouteAccess {\r\n  publicPaths: string[];\r\n  protectedPaths: string[];\r\n}\r\n\r\nexport function normalizeWorkspaceAppAudience(\r\n  value: unknown,\r\n): WorkspaceAppAudience {\r\n  return value === \"public\" ? \"public\" : DEFAULT_WORKSPACE_APP_AUDIENCE;\r\n}\r\n\r\nexport function normalizeWorkspaceAppPathList(value: unknown): string[] {\r\n  let rawPaths: unknown[] = [];\r\n  if (Array.isArray(value)) {\r\n    rawPaths = value;\r\n  } else if (typeof value === \"string\") {\r\n    const trimmed = value.trim();\r\n    if (!trimmed) return [];\r\n    try {\r\n      const parsed = JSON.parse(trimmed);\r\n      // When JSON parses to a non-array (e.g. a single quoted string\r\n      // `\"/api\"`), use the parsed value, not the original quoted form —\r\n      // otherwise the `/`-prefix filter below silently drops it.\r\n      rawPaths = Array.isArray(parsed) ? parsed : [parsed];\r\n    } catch {\r\n      rawPaths = trimmed.split(\",\");\r\n    }\r\n  }\r\n\r\n  const paths = rawPaths\r\n    .map((entry) => (typeof entry === \"string\" ? entry.trim() : \"\"))\r\n    .filter((entry) => entry.startsWith(\"/\"))\r\n    .map((entry) =>\r\n      entry.length > 1 && entry.endsWith(\"/\") ? entry.slice(0, -1) : entry,\r\n    );\r\n  return Array.from(new Set(paths));\r\n}\r\n\r\nexport function workspaceAppAudienceFromEnv(\r\n  env?: Record<string, string | undefined>,\r\n): WorkspaceAppAudience | undefined {\r\n  const source = env ?? (typeof process !== \"undefined\" ? process.env : {});\r\n  const raw =\r\n    source.AGENT_NATIVE_WORKSPACE_APP_AUDIENCE ??\r\n    source.VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE;\r\n  if (raw === undefined) return undefined;\r\n  return normalizeWorkspaceAppAudience(raw);\r\n}\r\n\r\nexport function workspaceAppRouteAccessFromEnv(\r\n  env?: Record<string, string | undefined>,\r\n): WorkspaceAppRouteAccess {\r\n  const source = env ?? (typeof process !== \"undefined\" ? process.env : {});\r\n  return {\r\n    publicPaths: normalizeWorkspaceAppPathList(\r\n      source.AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS ??\r\n        source.VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS,\r\n    ),\r\n    protectedPaths: normalizeWorkspaceAppPathList(\r\n      source.AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS ??\r\n        source.VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS,\r\n    ),\r\n  };\r\n}\r\n\r\nexport function workspaceAppAudienceFromPackageJson(\r\n  pkg: unknown,\r\n): WorkspaceAppAudience | undefined {\r\n  const config = workspaceAppConfigFromPackageJson(pkg);\r\n  const raw =\r\n    config?.workspaceApp?.audience ??\r\n    config?.workspace?.audience ??\r\n    config?.audience ??\r\n    config?.root?.workspaceAppAudience;\r\n  if (raw === undefined) return undefined;\r\n  return normalizeWorkspaceAppAudience(raw);\r\n}\r\n\r\n/**\r\n * Per-app route-access config read from a `package.json`. Each field is\r\n * `undefined` when the corresponding key is fully absent from every\r\n * supported alias chain — that lets callers distinguish \"user didn't say\"\r\n * from \"user set [] to clear inherited overrides\". `workspaceAppRouteAccess`\r\n * always emits a full `WorkspaceAppRouteAccess` for runtime consumption.\r\n */\r\nexport interface WorkspaceAppRouteAccessFromConfig {\r\n  publicPaths?: string[];\r\n  protectedPaths?: string[];\r\n}\r\n\r\nexport function workspaceAppRouteAccessFromPackageJson(\r\n  pkg: unknown,\r\n): WorkspaceAppRouteAccessFromConfig {\r\n  const config = workspaceAppConfigFromPackageJson(pkg);\r\n  const rawPublic =\r\n    config?.workspaceApp?.publicPaths ??\r\n    config?.workspaceApp?.publicPagePaths ??\r\n    config?.workspace?.publicPaths ??\r\n    config?.publicPaths ??\r\n    config?.root?.workspaceAppPublicPaths;\r\n  const rawProtected =\r\n    config?.workspaceApp?.protectedPaths ??\r\n    config?.workspaceApp?.privatePaths ??\r\n    config?.workspaceApp?.authRequiredPaths ??\r\n    config?.workspace?.protectedPaths ??\r\n    config?.protectedPaths ??\r\n    config?.root?.workspaceAppProtectedPaths;\r\n  return {\r\n    ...(isPathConfigValueSet(rawPublic)\r\n      ? { publicPaths: normalizeWorkspaceAppPathList(rawPublic) }\r\n      : {}),\r\n    ...(isPathConfigValueSet(rawProtected)\r\n      ? { protectedPaths: normalizeWorkspaceAppPathList(rawProtected) }\r\n      : {}),\r\n  };\r\n}\r\n\r\n/**\r\n * Only treat a package.json field as \"explicitly set\" when its raw value is a\r\n * supported type — an array, a string, or explicit null. Garbage types like\r\n * `false`, `0`, or `{}` are ignored (left as undefined) so a typo such as\r\n * `\"publicPaths\": false` doesn't silently clear an inherited manifest\r\n * override. (`normalizeWorkspaceAppPathList` happily turns those into `[]`,\r\n * which without this guard would be indistinguishable from a deliberate\r\n * empty array.)\r\n */\r\nfunction isPathConfigValueSet(value: unknown): boolean {\r\n  if (value === undefined) return false;\r\n  if (value === null) return true;\r\n  if (Array.isArray(value)) return true;\r\n  return typeof value === \"string\";\r\n}\r\n\r\nfunction workspaceAppConfigFromPackageJson(pkg: unknown):\r\n  | {\r\n      root: Record<string, any>;\r\n      workspaceApp?: Record<string, any>;\r\n      workspace?: Record<string, any>;\r\n      audience?: unknown;\r\n      publicPaths?: unknown;\r\n      protectedPaths?: unknown;\r\n    }\r\n  | undefined {\r\n  if (!pkg || typeof pkg !== \"object\" || Array.isArray(pkg)) return undefined;\r\n  const record = pkg as Record<string, any>;\r\n  const config = record[\"agent-native\"] ?? record.agentNative;\r\n  const nested =\r\n    config && typeof config === \"object\" && !Array.isArray(config)\r\n      ? (config as Record<string, any>)\r\n      : {};\r\n  const workspaceApp =\r\n    nested.workspaceApp &&\r\n    typeof nested.workspaceApp === \"object\" &&\r\n    !Array.isArray(nested.workspaceApp)\r\n      ? (nested.workspaceApp as Record<string, any>)\r\n      : undefined;\r\n  const workspace =\r\n    nested.workspace &&\r\n    typeof nested.workspace === \"object\" &&\r\n    !Array.isArray(nested.workspace)\r\n      ? (nested.workspace as Record<string, any>)\r\n      : undefined;\r\n  return {\r\n    root: record,\r\n    workspaceApp,\r\n    workspace,\r\n    audience: nested.audience,\r\n    publicPaths: nested.publicPaths,\r\n    protectedPaths: nested.protectedPaths,\r\n  };\r\n}\r\n"]}
+{"version":3,"file":"workspace-app-audience.js","sourceRoot":"","sources":["../../src/shared/workspace-app-audience.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAU,CAAC;AAIvE,MAAM,CAAC,MAAM,8BAA8B,GAAyB,UAAU,CAAC;AAO/E,MAAM,UAAU,6BAA6B,CAC3C,KAAc;IAEd,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,8BAA8B,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,IAAI,QAAQ,GAAc,EAAE,CAAC;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,GAAG,KAAK,CAAC;IACnB,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,+DAA+D;YAC/D,kEAAkE;YAClE,2DAA2D;YAC3D,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SAC/D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACxC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACb,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CACrE,CAAC;IACJ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAAwC;IAExC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GACP,MAAM,CAAC,mCAAmC;QAC1C,MAAM,CAAC,wCAAwC;QAC/C,oEAAoE;QACpE,8DAA8D;QAC9D,CAAC,GAAG,KAAK,SAAS;YAChB,CAAC,CAAC,wBAAwB,CAAC,qCAAqC,CAAC;YACjE,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,GAAwC;IAExC,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,EAAE,CAC1C,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,OAAO;QACL,WAAW,EAAE,6BAA6B,CACxC,MAAM,CAAC,uCAAuC;YAC5C,MAAM,CAAC,4CAA4C;YACnD,mBAAmB,CAAC,yCAAyC,CAAC,CACjE;QACD,cAAc,EAAE,6BAA6B,CAC3C,MAAM,CAAC,0CAA0C;YAC/C,MAAM,CAAC,+CAA+C;YACtD,mBAAmB,CAAC,4CAA4C,CAAC,CACpE;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,GAAY;IAEZ,MAAM,MAAM,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,GAAG,GACP,MAAM,EAAE,YAAY,EAAE,QAAQ;QAC9B,MAAM,EAAE,SAAS,EAAE,QAAQ;QAC3B,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC;IACrC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAcD,MAAM,UAAU,sCAAsC,CACpD,GAAY;IAEZ,MAAM,MAAM,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,SAAS,GACb,MAAM,EAAE,YAAY,EAAE,WAAW;QACjC,MAAM,EAAE,YAAY,EAAE,eAAe;QACrC,MAAM,EAAE,SAAS,EAAE,WAAW;QAC9B,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,IAAI,EAAE,uBAAuB,CAAC;IACxC,MAAM,YAAY,GAChB,MAAM,EAAE,YAAY,EAAE,cAAc;QACpC,MAAM,EAAE,YAAY,EAAE,YAAY;QAClC,MAAM,EAAE,YAAY,EAAE,iBAAiB;QACvC,MAAM,EAAE,SAAS,EAAE,cAAc;QACjC,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,IAAI,EAAE,0BAA0B,CAAC;IAC3C,OAAO;QACL,GAAG,CAAC,oBAAoB,CAAC,SAAS,CAAC;YACjC,CAAC,CAAC,EAAE,WAAW,EAAE,6BAA6B,CAAC,SAAS,CAAC,EAAE;YAC3D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,oBAAoB,CAAC,YAAY,CAAC;YACpC,CAAC,CAAC,EAAE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,EAAE;YACjE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AACnC,CAAC;AAED,SAAS,iCAAiC,CAAC,GAAY;IAUrD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,GAA0B,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC;IAC5D,MAAM,MAAM,GACV,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAE,MAA8B;QACjC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,YAAY,GAChB,MAAM,CAAC,YAAY;QACnB,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QACjC,CAAC,CAAE,MAAM,CAAC,YAAoC;QAC9C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,SAAS,GACb,MAAM,CAAC,SAAS;QAChB,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAC9B,CAAC,CAAE,MAAM,CAAC,SAAiC;QAC3C,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,YAAY;QACZ,SAAS;QACT,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;KACtC,CAAC;AACJ,CAAC","sourcesContent":["import { getModuleGraphEnvDefault } from \"./global-scope.js\";\r\n\r\nexport const WORKSPACE_APP_AUDIENCES = [\"internal\", \"public\"] as const;\r\n\r\nexport type WorkspaceAppAudience = (typeof WORKSPACE_APP_AUDIENCES)[number];\r\n\r\nexport const DEFAULT_WORKSPACE_APP_AUDIENCE: WorkspaceAppAudience = \"internal\";\r\n\r\nexport interface WorkspaceAppRouteAccess {\r\n  publicPaths: string[];\r\n  protectedPaths: string[];\r\n}\r\n\r\nexport function normalizeWorkspaceAppAudience(\r\n  value: unknown,\r\n): WorkspaceAppAudience {\r\n  return value === \"public\" ? \"public\" : DEFAULT_WORKSPACE_APP_AUDIENCE;\r\n}\r\n\r\nexport function normalizeWorkspaceAppPathList(value: unknown): string[] {\r\n  let rawPaths: unknown[] = [];\r\n  if (Array.isArray(value)) {\r\n    rawPaths = value;\r\n  } else if (typeof value === \"string\") {\r\n    const trimmed = value.trim();\r\n    if (!trimmed) return [];\r\n    try {\r\n      const parsed = JSON.parse(trimmed);\r\n      // When JSON parses to a non-array (e.g. a single quoted string\r\n      // `\"/api\"`), use the parsed value, not the original quoted form —\r\n      // otherwise the `/`-prefix filter below silently drops it.\r\n      rawPaths = Array.isArray(parsed) ? parsed : [parsed];\r\n    } catch {\r\n      rawPaths = trimmed.split(\",\");\r\n    }\r\n  }\r\n\r\n  const paths = rawPaths\r\n    .map((entry) => (typeof entry === \"string\" ? entry.trim() : \"\"))\r\n    .filter((entry) => entry.startsWith(\"/\"))\r\n    .map((entry) =>\r\n      entry.length > 1 && entry.endsWith(\"/\") ? entry.slice(0, -1) : entry,\r\n    );\r\n  return Array.from(new Set(paths));\r\n}\r\n\r\nexport function workspaceAppAudienceFromEnv(\r\n  env?: Record<string, string | undefined>,\r\n): WorkspaceAppAudience | undefined {\r\n  const source = env ?? (typeof process !== \"undefined\" ? process.env : {});\r\n  const raw =\r\n    source.AGENT_NATIVE_WORKSPACE_APP_AUDIENCE ??\r\n    source.VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE ??\r\n    // Unified workerd deployments deliver per-app config via the module\r\n    // graph (shared process.env would cross-poison sibling apps).\r\n    (env === undefined\r\n      ? getModuleGraphEnvDefault(\"AGENT_NATIVE_WORKSPACE_APP_AUDIENCE\")\r\n      : undefined);\r\n  if (raw === undefined) return undefined;\r\n  return normalizeWorkspaceAppAudience(raw);\r\n}\r\n\r\nexport function workspaceAppRouteAccessFromEnv(\r\n  env?: Record<string, string | undefined>,\r\n): WorkspaceAppRouteAccess {\r\n  const source = env ?? (typeof process !== \"undefined\" ? process.env : {});\r\n  const moduleGraphFallback = (key: string) =>\r\n    env === undefined ? getModuleGraphEnvDefault(key) : undefined;\r\n  return {\r\n    publicPaths: normalizeWorkspaceAppPathList(\r\n      source.AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS ??\r\n        source.VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS ??\r\n        moduleGraphFallback(\"AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS\"),\r\n    ),\r\n    protectedPaths: normalizeWorkspaceAppPathList(\r\n      source.AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS ??\r\n        source.VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS ??\r\n        moduleGraphFallback(\"AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS\"),\r\n    ),\r\n  };\r\n}\r\n\r\nexport function workspaceAppAudienceFromPackageJson(\r\n  pkg: unknown,\r\n): WorkspaceAppAudience | undefined {\r\n  const config = workspaceAppConfigFromPackageJson(pkg);\r\n  const raw =\r\n    config?.workspaceApp?.audience ??\r\n    config?.workspace?.audience ??\r\n    config?.audience ??\r\n    config?.root?.workspaceAppAudience;\r\n  if (raw === undefined) return undefined;\r\n  return normalizeWorkspaceAppAudience(raw);\r\n}\r\n\r\n/**\r\n * Per-app route-access config read from a `package.json`. Each field is\r\n * `undefined` when the corresponding key is fully absent from every\r\n * supported alias chain — that lets callers distinguish \"user didn't say\"\r\n * from \"user set [] to clear inherited overrides\". `workspaceAppRouteAccess`\r\n * always emits a full `WorkspaceAppRouteAccess` for runtime consumption.\r\n */\r\nexport interface WorkspaceAppRouteAccessFromConfig {\r\n  publicPaths?: string[];\r\n  protectedPaths?: string[];\r\n}\r\n\r\nexport function workspaceAppRouteAccessFromPackageJson(\r\n  pkg: unknown,\r\n): WorkspaceAppRouteAccessFromConfig {\r\n  const config = workspaceAppConfigFromPackageJson(pkg);\r\n  const rawPublic =\r\n    config?.workspaceApp?.publicPaths ??\r\n    config?.workspaceApp?.publicPagePaths ??\r\n    config?.workspace?.publicPaths ??\r\n    config?.publicPaths ??\r\n    config?.root?.workspaceAppPublicPaths;\r\n  const rawProtected =\r\n    config?.workspaceApp?.protectedPaths ??\r\n    config?.workspaceApp?.privatePaths ??\r\n    config?.workspaceApp?.authRequiredPaths ??\r\n    config?.workspace?.protectedPaths ??\r\n    config?.protectedPaths ??\r\n    config?.root?.workspaceAppProtectedPaths;\r\n  return {\r\n    ...(isPathConfigValueSet(rawPublic)\r\n      ? { publicPaths: normalizeWorkspaceAppPathList(rawPublic) }\r\n      : {}),\r\n    ...(isPathConfigValueSet(rawProtected)\r\n      ? { protectedPaths: normalizeWorkspaceAppPathList(rawProtected) }\r\n      : {}),\r\n  };\r\n}\r\n\r\n/**\r\n * Only treat a package.json field as \"explicitly set\" when its raw value is a\r\n * supported type — an array, a string, or explicit null. Garbage types like\r\n * `false`, `0`, or `{}` are ignored (left as undefined) so a typo such as\r\n * `\"publicPaths\": false` doesn't silently clear an inherited manifest\r\n * override. (`normalizeWorkspaceAppPathList` happily turns those into `[]`,\r\n * which without this guard would be indistinguishable from a deliberate\r\n * empty array.)\r\n */\r\nfunction isPathConfigValueSet(value: unknown): boolean {\r\n  if (value === undefined) return false;\r\n  if (value === null) return true;\r\n  if (Array.isArray(value)) return true;\r\n  return typeof value === \"string\";\r\n}\r\n\r\nfunction workspaceAppConfigFromPackageJson(pkg: unknown):\r\n  | {\r\n      root: Record<string, any>;\r\n      workspaceApp?: Record<string, any>;\r\n      workspace?: Record<string, any>;\r\n      audience?: unknown;\r\n      publicPaths?: unknown;\r\n      protectedPaths?: unknown;\r\n    }\r\n  | undefined {\r\n  if (!pkg || typeof pkg !== \"object\" || Array.isArray(pkg)) return undefined;\r\n  const record = pkg as Record<string, any>;\r\n  const config = record[\"agent-native\"] ?? record.agentNative;\r\n  const nested =\r\n    config && typeof config === \"object\" && !Array.isArray(config)\r\n      ? (config as Record<string, any>)\r\n      : {};\r\n  const workspaceApp =\r\n    nested.workspaceApp &&\r\n    typeof nested.workspaceApp === \"object\" &&\r\n    !Array.isArray(nested.workspaceApp)\r\n      ? (nested.workspaceApp as Record<string, any>)\r\n      : undefined;\r\n  const workspace =\r\n    nested.workspace &&\r\n    typeof nested.workspace === \"object\" &&\r\n    !Array.isArray(nested.workspace)\r\n      ? (nested.workspace as Record<string, any>)\r\n      : undefined;\r\n  return {\r\n    root: record,\r\n    workspaceApp,\r\n    workspace,\r\n    audience: nested.audience,\r\n    publicPaths: nested.publicPaths,\r\n    protectedPaths: nested.protectedPaths,\r\n  };\r\n}\r\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jami-studio/core",
-  "version": "0.92.32",
+  "version": "0.92.34",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/studio-jami/jami-studio#readme",
   "bugs": {