npm - @agent-native/core - Versions diffs - 0.133.2 → 0.134.0 - Mend

@agent-native/core 0.133.2 → 0.134.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (213) hide show

package/corpus/README.md +2 -2
package/corpus/core/CHANGELOG.md +62 -0
package/corpus/core/docs/content/observability.mdx +41 -1
package/corpus/core/docs/content/tracking.mdx +25 -0
package/corpus/core/package.json +1 -1
package/corpus/core/src/agent/run-manager.ts +7 -0
package/corpus/core/src/client/agent-chat-adapter.ts +10 -0
package/corpus/core/src/client/analytics.ts +105 -1
package/corpus/core/src/client/use-action.ts +6 -0
package/corpus/core/src/deploy/build.ts +38 -1
package/corpus/core/src/observability/posthog-ai.ts +294 -0
package/corpus/core/src/observability/routes.ts +29 -6
package/corpus/core/src/observability/traces.ts +287 -12
package/corpus/core/src/observability/types.ts +11 -0
package/corpus/core/src/secrets/register-framework-secrets.ts +16 -0
package/corpus/core/src/server/agent-run-context.ts +21 -0
package/corpus/core/src/server/capture-error.ts +8 -0
package/corpus/core/src/server/core-routes-plugin.ts +75 -4
package/corpus/core/src/server/deploy-environment.ts +57 -0
package/corpus/core/src/server/error-noise-filter.ts +268 -0
package/corpus/core/src/server/posthog-config.ts +75 -0
package/corpus/core/src/server/request-context.ts +6 -0
package/corpus/core/src/server/sentry-config.ts +4 -8
package/corpus/core/src/server/sentry-plugin.ts +13 -29
package/corpus/core/src/server/sentry.ts +13 -156
package/corpus/core/src/server/ssr-handler.ts +6 -1
package/corpus/core/src/shared/mcp-embed-headers.ts +1 -1
package/corpus/core/src/templates/workspace-core/.agents/skills/observability/SKILL.md +36 -10
package/corpus/core/src/templates/workspace-core/.agents/skills/tracking/SKILL.md +55 -1
package/corpus/core/src/tracking/error-capture.ts +44 -109
package/corpus/core/src/tracking/index.ts +11 -0
package/corpus/core/src/tracking/posthog-exception.ts +305 -0
package/corpus/core/src/tracking/providers.ts +91 -14
package/corpus/core/src/tracking/redaction.ts +105 -0
package/corpus/templates/content/actions/_batch-utils.ts +33 -0
package/corpus/templates/content/actions/_builder-cms-read-client.ts +173 -81
package/corpus/templates/content/actions/_content-files.ts +31 -21
package/corpus/templates/content/actions/_database-source-utils.ts +653 -155
package/corpus/templates/content/actions/_database-utils.ts +535 -41
package/corpus/templates/content/actions/add-content-database-source-field-property.ts +291 -240
package/corpus/templates/content/actions/add-database-item.ts +15 -1
package/corpus/templates/content/actions/attach-content-database-source.ts +156 -58
package/corpus/templates/content/actions/bind-content-database-source-field.ts +2 -2
package/corpus/templates/content/actions/cancel-prepared-builder-source-update.ts +4 -1
package/corpus/templates/content/actions/delete-database-items.ts +8 -2
package/corpus/templates/content/actions/disconnect-content-database-source.ts +2 -2
package/corpus/templates/content/actions/duplicate-database-item.ts +15 -1
package/corpus/templates/content/actions/duplicate-database-items.ts +19 -1
package/corpus/templates/content/actions/execute-builder-source-execution.ts +2 -1
package/corpus/templates/content/actions/get-content-database.ts +12 -64
package/corpus/templates/content/actions/move-database-item.ts +4 -1
package/corpus/templates/content/actions/prepare-builder-source-execution.ts +1 -1
package/corpus/templates/content/actions/prepare-builder-source-review.ts +4 -8
package/corpus/templates/content/actions/preview-content-database-source-attach.ts +92 -0
package/corpus/templates/content/actions/process-builder-body-hydration.ts +2 -1
package/corpus/templates/content/actions/query-content-database-items.ts +64 -0
package/corpus/templates/content/actions/refresh-content-database-source.ts +7 -0
package/corpus/templates/content/actions/review-content-database-source-change-set.ts +1 -1
package/corpus/templates/content/actions/set-content-database-source-write-mode.ts +1 -1
package/corpus/templates/content/actions/stage-builder-revision.ts +1 -1
package/corpus/templates/content/actions/update-content-database-personal-view.ts +29 -3
package/corpus/templates/content/actions/update-content-database-view.ts +1 -1
package/corpus/templates/content/actions/validate-builder-source-execution.ts +1 -1
package/corpus/templates/content/app/components/editor/DocumentProperties.tsx +3 -22
package/corpus/templates/content/app/components/editor/database/DatabaseView.tsx +267 -105
package/corpus/templates/content/app/components/sidebar/DocumentSidebar.tsx +82 -1
package/corpus/templates/content/app/hooks/use-content-database.ts +285 -24
package/corpus/templates/content/app/hooks/use-document-properties.ts +7 -6
package/corpus/templates/content/app/i18n-data.ts +10 -0
package/corpus/templates/content/changelog/2026-07-29-large-databases-keep-useful-rows-visible.md +6 -0
package/corpus/templates/content/changelog/2026-07-30-builder-source-columns-now-appear-immediately-when-connected.md +6 -0
package/corpus/templates/content/changelog/2026-07-30-large-builder-backed-tables-show-useful-rows-sooner-and-fini.md +6 -0
package/corpus/templates/content/changelog/2026-08-01-large-builder-databases-now-show-rows-immediately-and-finish.md +6 -0
package/corpus/templates/content/parity/matrix.md +2 -1
package/corpus/templates/content/parity/matrix.ts +25 -0
package/corpus/templates/content/shared/api.ts +54 -4
package/corpus/templates/content/shared/database-query.ts +359 -0
package/dist/agent/run-manager.d.ts.map +1 -1
package/dist/agent/run-manager.js +7 -0
package/dist/agent/run-manager.js.map +1 -1
package/dist/client/agent-chat-adapter.d.ts.map +1 -1
package/dist/client/agent-chat-adapter.js +12 -0
package/dist/client/agent-chat-adapter.js.map +1 -1
package/dist/client/analytics.d.ts +8 -0
package/dist/client/analytics.d.ts.map +1 -1
package/dist/client/analytics.js +95 -1
package/dist/client/analytics.js.map +1 -1
package/dist/client/use-action.d.ts.map +1 -1
package/dist/client/use-action.js +6 -0
package/dist/client/use-action.js.map +1 -1
package/dist/collab/routes.d.ts +1 -1
package/dist/collab/struct-routes.d.ts +1 -1
package/dist/deploy/build.d.ts.map +1 -1
package/dist/deploy/build.js +38 -1
package/dist/deploy/build.js.map +1 -1
package/dist/file-upload/actions/upload-image.d.ts +1 -1
package/dist/notifications/routes.d.ts +3 -3
package/dist/observability/posthog-ai.d.ts +126 -0
package/dist/observability/posthog-ai.d.ts.map +1 -0
package/dist/observability/posthog-ai.js +190 -0
package/dist/observability/posthog-ai.js.map +1 -0
package/dist/observability/routes.d.ts +1 -1
package/dist/observability/routes.d.ts.map +1 -1
package/dist/observability/routes.js +26 -6
package/dist/observability/routes.js.map +1 -1
package/dist/observability/traces.d.ts +9 -0
package/dist/observability/traces.d.ts.map +1 -1
package/dist/observability/traces.js +219 -10
package/dist/observability/traces.js.map +1 -1
package/dist/observability/types.d.ts +10 -0
package/dist/observability/types.d.ts.map +1 -1
package/dist/observability/types.js +1 -0
package/dist/observability/types.js.map +1 -1
package/dist/secrets/register-framework-secrets.d.ts.map +1 -1
package/dist/secrets/register-framework-secrets.js +14 -0
package/dist/secrets/register-framework-secrets.js.map +1 -1
package/dist/server/agent-run-context.d.ts +8 -0
package/dist/server/agent-run-context.d.ts.map +1 -1
package/dist/server/agent-run-context.js +18 -0
package/dist/server/agent-run-context.js.map +1 -1
package/dist/server/capture-error.d.ts +8 -0
package/dist/server/capture-error.d.ts.map +1 -1
package/dist/server/capture-error.js.map +1 -1
package/dist/server/core-routes-plugin.d.ts +0 -23
package/dist/server/core-routes-plugin.d.ts.map +1 -1
package/dist/server/core-routes-plugin.js +71 -7
package/dist/server/core-routes-plugin.js.map +1 -1
package/dist/server/deploy-environment.d.ts +17 -0
package/dist/server/deploy-environment.d.ts.map +1 -0
package/dist/server/deploy-environment.js +47 -0
package/dist/server/deploy-environment.js.map +1 -0
package/dist/server/error-noise-filter.d.ts +80 -0
package/dist/server/error-noise-filter.d.ts.map +1 -0
package/dist/server/error-noise-filter.js +173 -0
package/dist/server/error-noise-filter.js.map +1 -0
package/dist/server/posthog-config.d.ts +28 -0
package/dist/server/posthog-config.d.ts.map +1 -0
package/dist/server/posthog-config.js +53 -0
package/dist/server/posthog-config.js.map +1 -0
package/dist/server/request-context.d.ts +6 -0
package/dist/server/request-context.d.ts.map +1 -1
package/dist/server/request-context.js.map +1 -1
package/dist/server/sentry-config.d.ts +1 -0
package/dist/server/sentry-config.d.ts.map +1 -1
package/dist/server/sentry-config.js +3 -1
package/dist/server/sentry-config.js.map +1 -1
package/dist/server/sentry-plugin.d.ts.map +1 -1
package/dist/server/sentry-plugin.js +12 -27
package/dist/server/sentry-plugin.js.map +1 -1
package/dist/server/sentry.d.ts.map +1 -1
package/dist/server/sentry.js +8 -124
package/dist/server/sentry.js.map +1 -1
package/dist/server/ssr-handler.d.ts.map +1 -1
package/dist/server/ssr-handler.js +6 -1
package/dist/server/ssr-handler.js.map +1 -1
package/dist/shared/mcp-embed-headers.d.ts +1 -1
package/dist/shared/mcp-embed-headers.d.ts.map +1 -1
package/dist/shared/mcp-embed-headers.js +1 -1
package/dist/shared/mcp-embed-headers.js.map +1 -1
package/dist/templates/workspace-core/.agents/skills/observability/SKILL.md +36 -10
package/dist/templates/workspace-core/.agents/skills/tracking/SKILL.md +55 -1
package/dist/tracking/error-capture.d.ts +7 -0
package/dist/tracking/error-capture.d.ts.map +1 -1
package/dist/tracking/error-capture.js +10 -73
package/dist/tracking/error-capture.js.map +1 -1
package/dist/tracking/index.d.ts +1 -0
package/dist/tracking/index.d.ts.map +1 -1
package/dist/tracking/index.js +1 -0
package/dist/tracking/index.js.map +1 -1
package/dist/tracking/posthog-exception.d.ts +103 -0
package/dist/tracking/posthog-exception.d.ts.map +1 -0
package/dist/tracking/posthog-exception.js +181 -0
package/dist/tracking/posthog-exception.js.map +1 -0
package/dist/tracking/providers.d.ts +14 -0
package/dist/tracking/providers.d.ts.map +1 -1
package/dist/tracking/providers.js +63 -11
package/dist/tracking/providers.js.map +1 -1
package/dist/tracking/redaction.d.ts +25 -0
package/dist/tracking/redaction.d.ts.map +1 -0
package/dist/tracking/redaction.js +85 -0
package/dist/tracking/redaction.js.map +1 -0
package/docs/content/observability.mdx +41 -1
package/docs/content/tracking.mdx +25 -0
package/package.json +1 -1
package/src/agent/run-manager.ts +7 -0
package/src/client/agent-chat-adapter.ts +10 -0
package/src/client/analytics.ts +105 -1
package/src/client/use-action.ts +6 -0
package/src/deploy/build.ts +38 -1
package/src/observability/posthog-ai.ts +294 -0
package/src/observability/routes.ts +29 -6
package/src/observability/traces.ts +287 -12
package/src/observability/types.ts +11 -0
package/src/secrets/register-framework-secrets.ts +16 -0
package/src/server/agent-run-context.ts +21 -0
package/src/server/capture-error.ts +8 -0
package/src/server/core-routes-plugin.ts +75 -4
package/src/server/deploy-environment.ts +57 -0
package/src/server/error-noise-filter.ts +268 -0
package/src/server/posthog-config.ts +75 -0
package/src/server/request-context.ts +6 -0
package/src/server/sentry-config.ts +4 -8
package/src/server/sentry-plugin.ts +13 -29
package/src/server/sentry.ts +13 -156
package/src/server/ssr-handler.ts +6 -1
package/src/shared/mcp-embed-headers.ts +1 -1
package/src/templates/workspace-core/.agents/skills/observability/SKILL.md +36 -10
package/src/templates/workspace-core/.agents/skills/tracking/SKILL.md +55 -1
package/src/tracking/error-capture.ts +44 -109
package/src/tracking/index.ts +11 -0
package/src/tracking/posthog-exception.ts +305 -0
package/src/tracking/providers.ts +91 -14
package/src/tracking/redaction.ts +105 -0

package/dist/server/ssr-handler.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACxC;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,SAAS,cAAc;IACrB,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,yBAAyB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAChC,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,YAAY,GAAG,IAAI;SACtB,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEL,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,4EAA4E;IAC5E,OAAO,YAAY,CAAC,OAAO,CACzB,8EAA8E,EAC9E,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,qCAAqC,CAC1C,IAAI,GAAG,CACL,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,EAC3D,UAAU,CACX,CAAC,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,sCAAsC,QAAQ,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,iDAAiD,QAAQ,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CACP,2CAA2C,8BAA8B,IAAI,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,CACP,4CAA4C,+BAA+B,IAAI,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,6CAA6C,gCAAgC,IAAI,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,0CAA0C,6BAA6B,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,uCAAuC,QAAQ,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CACP,2CAA2C,6BAA6B,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,0BAA0B,CACjC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO;IAEhE,wEAAwE;IACxE,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,UAAU,GAAG,IAAI;aACpB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAChB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACvC,OAAO,CACL,UAAU;gBACV,UAAU,KAAK,GAAG;gBAClB,UAAU,KAAK,QAAQ;gBACvB,UAAU,KAAK,eAAe,CAC/B,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;;YACjE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/C,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,eAAe,CAAC,QAAQ,CAAC;QACzB,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,UAAkB;IAElB,MAAM,kBAAkB,GACtB,CAAC,2BAA2B,EAAE,EAAE,6BAA6B,EAAE,CAAC;SAC7D,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,kCAAkC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAC1B,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACjC,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC5C,EACD,kBAAkB,CACnB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAsB,CACpC,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CACvD,CAAC;YACF,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,+EAA+E;YAC/E,EAAE;YACF,gFAAgF;YAChF,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,YAAY,CAAC,GAAG,EAAE;gBAChB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;gBACxB,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC3D,IAAI,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE;aACzD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { defineEventHandler } from \"h3\";\n/*\n Shared SSR catch-all handler for React Router framework mode.\n \n Templates wire this up via:\n \n // server/routes/[...page].get.ts\n * import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n * export default createH3SSRHandler(\n * () => import(\"virtual:react-router/server-build\"),\n * );\n \n The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n /\nimport { createRequestHandler } from \"react-router\";\n\nimport { isMcpPublicPath } from \"../mcp/route-paths.js\";\nimport {\n DEFAULT_SPECULATION_RULES_PATH,\n resolveSsrCacheHeaders,\n} from \"../shared/cache-control.js\";\nimport {\n AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n withAgentNativeSocialImageCacheBuster,\n} from \"../shared/social-meta.js\";\nimport {\n getAppBasePathFromViteEnv,\n stripAppBasePath as canonicalStripAppBasePath,\n} from \"./app-base-path.js\";\nimport { captureError } from \"./capture-error.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport {\n getRealtimeClientConfigScript,\n getSentryClientConfigScript,\n} from \"./sentry-config.js\";\n\nexport {\n DEFAULT_SSR_CACHE_HEADERS,\n DEFAULT_SPECULATION_RULES_HEADER,\n DEFAULT_SSR_CACHE_CONTROL,\n DISABLED_SSR_CACHE_HEADERS,\n isSsrCacheEnabled,\n resolveSsrCacheHeaders,\n SSR_CACHE_ENV_VAR,\n} from \"../shared/cache-control.js\";\n\nfunction getAppBasePath(): string {\n return getAppBasePathFromViteEnv();\n}\n\nfunction stripAppBasePath(pathname: string): string {\n return canonicalStripAppBasePath(pathname, getAppBasePath());\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n if (!basePath) return pathname;\n if (pathname === basePath) return \"/\";\n if (pathname.startsWith(`${basePath}/`)) {\n return pathname.slice(basePath.length) \|\| \"/\";\n }\n return pathname;\n}\n\nfunction requestWithPathname(\n request: Request,\n pathname: string,\n basePath: string,\n): Request {\n const url = new URL(request.url);\n let changed = false;\n if (basePath && pathname === \"/__manifest\") {\n const paths = url.searchParams.get(\"paths\");\n if (paths) {\n const strippedPaths = paths\n .split(\",\")\n .map((path) => stripBasePath(path, basePath))\n .join(\",\");\n if (strippedPaths !== paths) {\n url.searchParams.set(\"paths\", strippedPaths);\n changed = true;\n }\n }\n }\n if (url.pathname !== pathname) {\n url.pathname = pathname;\n changed = true;\n }\n if (!changed) return request;\n const init: RequestInit & { duplex?: \"half\" } = {\n method: request.method,\n headers: request.headers,\n signal: request.signal,\n };\n if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n init.body = request.body;\n init.duplex = \"half\";\n }\n return new Request(url, init);\n}\n\nfunction requestForAnonymousSsr(request: Request): Request {\n const headers = new Headers(request.headers);\n headers.delete(\"cookie\");\n headers.delete(\"authorization\");\n const init: RequestInit & { duplex?: \"half\" } = {\n method: request.method,\n headers,\n signal: request.signal,\n };\n if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n init.body = request.body;\n init.duplex = \"half\";\n }\n return new Request(request.url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n if (!basePath \|\| !path.startsWith(\"/\") \|\| path.startsWith(\"//\")) return path;\n if (path === basePath \|\| path.startsWith(`${basePath}/`)) return path;\n return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n if (!basePath) return html;\n const prefixedHtml = html\n .replace(\n /\\b(href\|src\|action\|formaction\|poster)=([\"'])(\\/(?!\\/)[^\"'])\\2/g,\n (_match, attr: string, quote: string, path: string) =>\n `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n )\n .replace(/url\$([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\$/g, (_match, quote, path) => {\n const q = quote \|\| \"\";\n return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n });\n\n // React Router serializes the server-side basename into its hydration\n // context. The request above is deliberately rendered mount-relative, so\n // that value is normally \"/\" even though the browser URL is mounted at a\n // workspace prefix such as \"/analytics\". If the client hydrates that\n // context unchanged, the mounted pathname no longer matches the route tree:\n // index redirects can stall and child pages can fall through to the 404.\n // Keep the serialized router state consistent with the URLs we just\n // prefixed. Template entry clients also set this defensively for older\n // responses, but the initial hydration state must be correct at the source.\n return prefixedHtml.replace(\n /(window\\.__reactRouterContext\\s=\\s\\{\\s\"basename\"\\s:\\s)\"(?:\\\\.\|[^\"\\\\])\"/,\n `$1${JSON.stringify(basePath)}`,\n );\n}\n\nfunction injectHeadScript(html: string, script: string \| null): string {\n if (!script) return html;\n const headCloseIdx = html.indexOf(\"</head>\");\n if (headCloseIdx === -1) return html;\n return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]\\bproperty=([\"'])og:image\\1)[^>]>/i;\nconst TWITTER_CARD_META_RE =\n /<meta\\b(?=[^>]\\bname=([\"'])twitter:card\\1)[^>]>/i;\nconst TWITTER_IMAGE_META_RE =\n /<meta\\b(?=[^>]\\bname=([\"'])twitter:image\\1)[^>]>/i;\n\nfunction defaultSocialImageUrl(requestUrl: string, basePath: string): string {\n return withAgentNativeSocialImageCacheBuster(\n new URL(\n prefixMountedPath(AGENT_NATIVE_SOCIAL_IMAGE_PATH, basePath),\n requestUrl,\n ).toString(),\n );\n}\n\nfunction injectDefaultSocialImageMeta(html: string, imageUrl: string): string {\n const headCloseIdx = html.indexOf(\"</head>\");\n if (headCloseIdx === -1) return html;\n\n const hasAnySocialImage =\n OG_IMAGE_META_RE.test(html) \|\| TWITTER_IMAGE_META_RE.test(html);\n const tags: string[] = [];\n\n if (!hasAnySocialImage) {\n tags.push(`<meta property=\"og:image\" content=\"${imageUrl}\">`);\n tags.push(`<meta property=\"og:image:secure_url\" content=\"${imageUrl}\">`);\n tags.push(\n `<meta property=\"og:image:type\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_TYPE}\">`,\n );\n tags.push(\n `<meta property=\"og:image:width\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_WIDTH}\">`,\n );\n tags.push(\n `<meta property=\"og:image:height\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT}\">`,\n );\n tags.push(\n `<meta property=\"og:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n );\n }\n if (!TWITTER_CARD_META_RE.test(html)) {\n tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n }\n if (!hasAnySocialImage) {\n tags.push(`<meta name=\"twitter:image\" content=\"${imageUrl}\">`);\n tags.push(\n `<meta name=\"twitter:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n );\n }\n\n if (tags.length === 0) return html;\n return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction isSsrHtmlOrDataResponse(\n headers: Headers,\n status: number,\n pathname: string,\n): boolean {\n if (status < 200 \|\| status >= 400) return false;\n const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n if (contentType.includes(\"text/html\")) return true;\n return pathname.endsWith(\".data\") && contentType.includes(\"text/x-script\");\n}\n\n/*\n Apply the SSR cache policy to the response headers.\n \n ┌──────────────────────────────────────────────────────────────────────────┐\n * │ SSR IS A PUBLIC, HARD-CDN-CACHED SHELL — SERVED IDENTICALLY TO EVERYONE. │\n * │ │\n * │ Every SSR HTML / React Router `.data` response gets the same public │\n * │ stale-while-revalidate policy for ALL visitors, authenticated or not, so │\n * │ the edge serves one shared copy and never stampedes origin. │\n * │ │\n * │ DO NOT reintroduce per-user / cookie-based cache variation here (no │\n * │ `private`, no `no-store`, no `Vary: Cookie`, no \"authenticated → don't │\n * │ cache\" branch). That makes pages uncacheable for every logged-in visitor, │\n * │ which is slow and expensive — exactly the regression this guardrail │\n * │ prevents. The reason it is SAFE to hard-cache is that the SSR response is │\n * │ impersonal: `createH3SSRHandler` renders without reading the request's │\n * │ session/cookies, so there is no per-user data baked into the HTML. ALL │\n * │ per-user state (who's logged in, private records, access checks) is │\n * │ resolved CLIENT-SIDE after load. Keep it that way: if you need the SSR │\n * │ output to differ per user, the fix is to move that work client-side, not │\n * │ to disable caching here. │\n * │ │\n * │ HOW LONG the shell is cached is deployment-wide and configurable through │\n * │ AGENT_NATIVE_SSR_CACHE (see `resolveSsrCacheHeaders`), for hosts that do │\n * │ not purge their CDN on deploy. What remains forbidden is PER-REQUEST / │\n * │ PER-USER variation — no `private`, no `Vary: Cookie`, no per-route escape │\n * │ hatch — because that is what poisons a shared CDN cache key. A value fixed │\n * │ for the whole deployment cannot. │\n * └──────────────────────────────────────────────────────────────────────────┘\n /\nfunction applyDefaultSsrCacheHeader(\n headers: Headers,\n status: number,\n pathname: string,\n) {\n if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;\n\n // A public shell must never set a viewer cookie or vary by credentials.\n // Preserve harmless content-negotiation dimensions such as Accept-Encoding.\n headers.delete(\"set-cookie\");\n const vary = headers.get(\"vary\");\n if (vary) {\n const publicVary = vary\n .split(\",\")\n .map((value) => value.trim())\n .filter((value) => {\n const normalized = value.toLowerCase();\n return (\n normalized &&\n normalized !== \"\" &&\n normalized !== \"cookie\" &&\n normalized !== \"authorization\"\n );\n });\n if (publicVary.length > 0) headers.set(\"vary\", publicVary.join(\", \"));\n else headers.delete(\"vary\");\n }\n\n // Netlify Functions/proxies are not cached by default. Set all three cache\n // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,\n // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache\n // actually serves SSR HTML/.data from the edge instead of forwarding every\n // request to origin — for every visitor, authenticated or not.\n for (const [name, value] of Object.entries(resolveSsrCacheHeaders())) {\n headers.set(name, value);\n }\n}\n\nfunction applyDefaultSpeculationRulesHeader(\n headers: Headers,\n status: number,\n basePath: string,\n) {\n if (status < 200 \|\| status >= 400) return;\n if (headers.has(\"speculation-rules\")) return;\n\n const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n if (!contentType.includes(\"text/html\")) return;\n\n // Cloudflare Speed Brain injects its own Speculation-Rules header when the\n // origin omits one. Those browser prefetches carry `Sec-Purpose: prefetch`,\n // and Cloudflare refuses cache-ineligible dynamic pages with a 503 before\n // the request can reach Netlify/origin. We publish an explicit no-op ruleset\n // by default so Cloudflare does not inject its edge prefetch rules. Preserve\n // an app-provided Speculation-Rules header above if a template deliberately\n // owns this behavior.\n const rulesPath = prefixMountedPath(DEFAULT_SPECULATION_RULES_PATH, basePath);\n headers.set(\"speculation-rules\", `\"${rulesPath}\"`);\n}\n\n/*\n Strip document-level CSP from app HTML responses.\n \n Hosted templates inject framework bootstrap scripts, analytics, Sentry config,\n * and app-owned inline scripts whose exact bytes vary by build/template. Any\n * shared CSP header, even Report-Only, can block or noisily report Google Tag\n * Manager and those bootstraps. Extension iframes and webviews keep their own\n * route-specific sandboxes; normal app documents deliberately do not emit CSP.\n /\nfunction removeDocumentCsp(headers: Headers): void {\n headers.delete(\"content-security-policy\");\n headers.delete(\"content-security-policy-report-only\");\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n return (\n isMcpPublicPath(pathname) \|\|\n pathname.startsWith(\"/.well-known/\") \|\|\n pathname.startsWith(\"/_agent_native/\") \|\|\n pathname.startsWith(\"/_agent-native/\") \|\|\n pathname.startsWith(\"/api/\") \|\|\n pathname.startsWith(\"/@vite/\") \|\|\n pathname.startsWith(\"/@id/\") \|\|\n pathname.startsWith(\"/@fs/\") \|\|\n pathname === \"/@react-refresh\" \|\|\n pathname === \"/__vite_ping\" \|\|\n pathname === \"/__open-in-editor\" \|\|\n pathname === \"/favicon.ico\" \|\|\n pathname === \"/favicon.png\" \|\|\n (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n );\n}\n\nasync function rewriteMountedResponse(\n response: Response,\n basePath: string,\n pathname: string,\n requestUrl: string,\n): Promise<Response> {\n const clientConfigScript =\n [getSentryClientConfigScript(), getRealtimeClientConfigScript()]\n .filter(Boolean)\n .join(\"\") \|\| null;\n const headers = new Headers(response.headers);\n applyDefaultSsrCacheHeader(headers, response.status, pathname);\n applyDefaultSpeculationRulesHeader(headers, response.status, basePath);\n\n const location = headers.get(\"location\");\n if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n headers.set(\"location\", prefixMountedPath(location, basePath));\n }\n\n const contentType = headers.get(\"content-type\") ?? \"\";\n if (!contentType.toLowerCase().includes(\"text/html\")) {\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n });\n }\n removeDocumentCsp(headers);\n if (!response.body) {\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n });\n }\n\n const html = await response.text();\n headers.delete(\"content-length\");\n return new Response(\n injectHeadScript(\n injectDefaultSocialImageMeta(\n prefixMountedHtml(html, basePath),\n defaultSocialImageUrl(requestUrl, basePath),\n ),\n clientConfigScript,\n ),\n {\n status: response.status,\n statusText: response.statusText,\n headers,\n },\n );\n}\n\n/\n Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> \| unknown) {\n const handler = createRequestHandler(getBuild as any);\n return defineEventHandler(async (event) => {\n const basePath = getAppBasePath();\n const p = stripAppBasePath(event.url.pathname);\n if (isFrameworkOrAssetPath(p)) {\n return new Response(null, { status: 404 });\n }\n try {\n const request = requestForAnonymousSsr(\n requestWithPathname(event.req as Request, p, basePath),\n );\n // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the\n // request's session/cookies here, and pin an explicitly anonymous request\n // context. That keeps the SSR HTML/.data identical for every visitor so it\n // can be hard-cached at the CDN for everyone (see applyDefaultSsrCacheHeader).\n //\n // Consequence: SSR loaders that call `getRequestUserEmail()` / `accessFilter()`\n // always see the unauthenticated branch and render public content only. Any\n // per-user view (private records, share-grant access, who's logged in) MUST\n // be resolved CLIENT-SIDE after load, never baked into SSR. Do not re-pin the\n // session here to \"fix\" a per-user page — that silently makes the page\n // uncacheable and/or leaks one user's data into another's cached copy.\n const ctx = { userEmail: undefined, orgId: undefined };\n if (request.method === \"HEAD\") {\n const getRequest = new Request(request.url, {\n method: \"GET\",\n headers: request.headers,\n signal: request.signal,\n });\n const response = await runWithRequestContext(ctx, () =>\n handler(getRequest),\n );\n return await rewriteMountedResponse(\n new Response(null, {\n status: response.status,\n statusText: response.statusText,\n headers: response.headers,\n }),\n basePath,\n p,\n request.url,\n );\n }\n return await rewriteMountedResponse(\n await runWithRequestContext(ctx, () => handler(request)),\n basePath,\n p,\n request.url,\n );\n } catch (err) {\n // Log the full stack server-side, but never leak it to the client.\n // Stack traces expose file paths, library versions, and code structure\n // that aid reconnaissance attacks. In dev we surface the message text\n // so devtools shows something useful; in prod we return a bare 500.\n console.error(\"[ssr-handler] SSR error:\", err);\n captureError(err, {\n route: p,\n method: event.req.method,\n userAgent: event.req.headers.get(\"user-agent\") ?? undefined,\n tags: { renderMode: \"anonymous-public\", surface: \"ssr\" },\n });\n const isProd = process.env.NODE_ENV === \"production\";\n const body = isProd\n ? \"Internal Server Error\"\n : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n return new Response(body, {\n status: 500,\n headers: { \"content-type\": \"text/plain\" },\n });\n }\n });\n}\n"]}
1	+ {"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACxC;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,EACzB,0BAA0B,EAC1B,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,4BAA4B,CAAC;AAEpC,SAAS,cAAc;IACrB,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,yBAAyB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAChC,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,YAAY,GAAG,IAAI;SACtB,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEL,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,4EAA4E;IAC5E,OAAO,YAAY,CAAC,OAAO,CACzB,8EAA8E,EAC9E,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,qCAAqC,CAC1C,IAAI,GAAG,CACL,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,EAC3D,UAAU,CACX,CAAC,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,sCAAsC,QAAQ,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,iDAAiD,QAAQ,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CACP,2CAA2C,8BAA8B,IAAI,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,CACP,4CAA4C,+BAA+B,IAAI,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,6CAA6C,gCAAgC,IAAI,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,0CAA0C,6BAA6B,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,uCAAuC,QAAQ,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CACP,2CAA2C,6BAA6B,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,0BAA0B,CACjC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO;IAEhE,wEAAwE;IACxE,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,UAAU,GAAG,IAAI;aACpB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAChB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACvC,OAAO,CACL,UAAU;gBACV,UAAU,KAAK,GAAG;gBAClB,UAAU,KAAK,QAAQ;gBACvB,UAAU,KAAK,eAAe,CAC/B,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;;YACjE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/C,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,eAAe,CAAC,QAAQ,CAAC;QACzB,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,UAAkB;IAElB,MAAM,kBAAkB,GACtB;QACE,2BAA2B,EAAE;QAC7B,4BAA4B,EAAE;QAC9B,6BAA6B,EAAE;KAChC;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,kCAAkC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAC1B,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACjC,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC5C,EACD,kBAAkB,CACnB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAsB,CACpC,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CACvD,CAAC;YACF,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,+EAA+E;YAC/E,EAAE;YACF,gFAAgF;YAChF,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,YAAY,CAAC,GAAG,EAAE;gBAChB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;gBACxB,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC3D,IAAI,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE;aACzD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { defineEventHandler } from \"h3\";\n/*\n Shared SSR catch-all handler for React Router framework mode.\n \n Templates wire this up via:\n \n // server/routes/[...page].get.ts\n * import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n * export default createH3SSRHandler(\n * () => import(\"virtual:react-router/server-build\"),\n * );\n \n The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n /\nimport { createRequestHandler } from \"react-router\";\n\nimport { isMcpPublicPath } from \"../mcp/route-paths.js\";\nimport {\n DEFAULT_SPECULATION_RULES_PATH,\n resolveSsrCacheHeaders,\n} from \"../shared/cache-control.js\";\nimport {\n AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n withAgentNativeSocialImageCacheBuster,\n} from \"../shared/social-meta.js\";\nimport {\n getAppBasePathFromViteEnv,\n stripAppBasePath as canonicalStripAppBasePath,\n} from \"./app-base-path.js\";\nimport { captureError } from \"./capture-error.js\";\nimport { getPostHogClientConfigScript } from \"./posthog-config.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport {\n getRealtimeClientConfigScript,\n getSentryClientConfigScript,\n} from \"./sentry-config.js\";\n\nexport {\n DEFAULT_SSR_CACHE_HEADERS,\n DEFAULT_SPECULATION_RULES_HEADER,\n DEFAULT_SSR_CACHE_CONTROL,\n DISABLED_SSR_CACHE_HEADERS,\n isSsrCacheEnabled,\n resolveSsrCacheHeaders,\n SSR_CACHE_ENV_VAR,\n} from \"../shared/cache-control.js\";\n\nfunction getAppBasePath(): string {\n return getAppBasePathFromViteEnv();\n}\n\nfunction stripAppBasePath(pathname: string): string {\n return canonicalStripAppBasePath(pathname, getAppBasePath());\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n if (!basePath) return pathname;\n if (pathname === basePath) return \"/\";\n if (pathname.startsWith(`${basePath}/`)) {\n return pathname.slice(basePath.length) \|\| \"/\";\n }\n return pathname;\n}\n\nfunction requestWithPathname(\n request: Request,\n pathname: string,\n basePath: string,\n): Request {\n const url = new URL(request.url);\n let changed = false;\n if (basePath && pathname === \"/__manifest\") {\n const paths = url.searchParams.get(\"paths\");\n if (paths) {\n const strippedPaths = paths\n .split(\",\")\n .map((path) => stripBasePath(path, basePath))\n .join(\",\");\n if (strippedPaths !== paths) {\n url.searchParams.set(\"paths\", strippedPaths);\n changed = true;\n }\n }\n }\n if (url.pathname !== pathname) {\n url.pathname = pathname;\n changed = true;\n }\n if (!changed) return request;\n const init: RequestInit & { duplex?: \"half\" } = {\n method: request.method,\n headers: request.headers,\n signal: request.signal,\n };\n if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n init.body = request.body;\n init.duplex = \"half\";\n }\n return new Request(url, init);\n}\n\nfunction requestForAnonymousSsr(request: Request): Request {\n const headers = new Headers(request.headers);\n headers.delete(\"cookie\");\n headers.delete(\"authorization\");\n const init: RequestInit & { duplex?: \"half\" } = {\n method: request.method,\n headers,\n signal: request.signal,\n };\n if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n init.body = request.body;\n init.duplex = \"half\";\n }\n return new Request(request.url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n if (!basePath \|\| !path.startsWith(\"/\") \|\| path.startsWith(\"//\")) return path;\n if (path === basePath \|\| path.startsWith(`${basePath}/`)) return path;\n return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n if (!basePath) return html;\n const prefixedHtml = html\n .replace(\n /\\b(href\|src\|action\|formaction\|poster)=([\"'])(\\/(?!\\/)[^\"'])\\2/g,\n (_match, attr: string, quote: string, path: string) =>\n `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n )\n .replace(/url\$([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\$/g, (_match, quote, path) => {\n const q = quote \|\| \"\";\n return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n });\n\n // React Router serializes the server-side basename into its hydration\n // context. The request above is deliberately rendered mount-relative, so\n // that value is normally \"/\" even though the browser URL is mounted at a\n // workspace prefix such as \"/analytics\". If the client hydrates that\n // context unchanged, the mounted pathname no longer matches the route tree:\n // index redirects can stall and child pages can fall through to the 404.\n // Keep the serialized router state consistent with the URLs we just\n // prefixed. Template entry clients also set this defensively for older\n // responses, but the initial hydration state must be correct at the source.\n return prefixedHtml.replace(\n /(window\\.__reactRouterContext\\s=\\s\\{\\s\"basename\"\\s:\\s)\"(?:\\\\.\|[^\"\\\\])\"/,\n `$1${JSON.stringify(basePath)}`,\n );\n}\n\nfunction injectHeadScript(html: string, script: string \| null): string {\n if (!script) return html;\n const headCloseIdx = html.indexOf(\"</head>\");\n if (headCloseIdx === -1) return html;\n return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]\\bproperty=([\"'])og:image\\1)[^>]>/i;\nconst TWITTER_CARD_META_RE =\n /<meta\\b(?=[^>]\\bname=([\"'])twitter:card\\1)[^>]>/i;\nconst TWITTER_IMAGE_META_RE =\n /<meta\\b(?=[^>]\\bname=([\"'])twitter:image\\1)[^>]>/i;\n\nfunction defaultSocialImageUrl(requestUrl: string, basePath: string): string {\n return withAgentNativeSocialImageCacheBuster(\n new URL(\n prefixMountedPath(AGENT_NATIVE_SOCIAL_IMAGE_PATH, basePath),\n requestUrl,\n ).toString(),\n );\n}\n\nfunction injectDefaultSocialImageMeta(html: string, imageUrl: string): string {\n const headCloseIdx = html.indexOf(\"</head>\");\n if (headCloseIdx === -1) return html;\n\n const hasAnySocialImage =\n OG_IMAGE_META_RE.test(html) \|\| TWITTER_IMAGE_META_RE.test(html);\n const tags: string[] = [];\n\n if (!hasAnySocialImage) {\n tags.push(`<meta property=\"og:image\" content=\"${imageUrl}\">`);\n tags.push(`<meta property=\"og:image:secure_url\" content=\"${imageUrl}\">`);\n tags.push(\n `<meta property=\"og:image:type\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_TYPE}\">`,\n );\n tags.push(\n `<meta property=\"og:image:width\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_WIDTH}\">`,\n );\n tags.push(\n `<meta property=\"og:image:height\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT}\">`,\n );\n tags.push(\n `<meta property=\"og:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n );\n }\n if (!TWITTER_CARD_META_RE.test(html)) {\n tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n }\n if (!hasAnySocialImage) {\n tags.push(`<meta name=\"twitter:image\" content=\"${imageUrl}\">`);\n tags.push(\n `<meta name=\"twitter:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n );\n }\n\n if (tags.length === 0) return html;\n return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction isSsrHtmlOrDataResponse(\n headers: Headers,\n status: number,\n pathname: string,\n): boolean {\n if (status < 200 \|\| status >= 400) return false;\n const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n if (contentType.includes(\"text/html\")) return true;\n return pathname.endsWith(\".data\") && contentType.includes(\"text/x-script\");\n}\n\n/*\n Apply the SSR cache policy to the response headers.\n \n ┌──────────────────────────────────────────────────────────────────────────┐\n * │ SSR IS A PUBLIC, HARD-CDN-CACHED SHELL — SERVED IDENTICALLY TO EVERYONE. │\n * │ │\n * │ Every SSR HTML / React Router `.data` response gets the same public │\n * │ stale-while-revalidate policy for ALL visitors, authenticated or not, so │\n * │ the edge serves one shared copy and never stampedes origin. │\n * │ │\n * │ DO NOT reintroduce per-user / cookie-based cache variation here (no │\n * │ `private`, no `no-store`, no `Vary: Cookie`, no \"authenticated → don't │\n * │ cache\" branch). That makes pages uncacheable for every logged-in visitor, │\n * │ which is slow and expensive — exactly the regression this guardrail │\n * │ prevents. The reason it is SAFE to hard-cache is that the SSR response is │\n * │ impersonal: `createH3SSRHandler` renders without reading the request's │\n * │ session/cookies, so there is no per-user data baked into the HTML. ALL │\n * │ per-user state (who's logged in, private records, access checks) is │\n * │ resolved CLIENT-SIDE after load. Keep it that way: if you need the SSR │\n * │ output to differ per user, the fix is to move that work client-side, not │\n * │ to disable caching here. │\n * │ │\n * │ HOW LONG the shell is cached is deployment-wide and configurable through │\n * │ AGENT_NATIVE_SSR_CACHE (see `resolveSsrCacheHeaders`), for hosts that do │\n * │ not purge their CDN on deploy. What remains forbidden is PER-REQUEST / │\n * │ PER-USER variation — no `private`, no `Vary: Cookie`, no per-route escape │\n * │ hatch — because that is what poisons a shared CDN cache key. A value fixed │\n * │ for the whole deployment cannot. │\n * └──────────────────────────────────────────────────────────────────────────┘\n /\nfunction applyDefaultSsrCacheHeader(\n headers: Headers,\n status: number,\n pathname: string,\n) {\n if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;\n\n // A public shell must never set a viewer cookie or vary by credentials.\n // Preserve harmless content-negotiation dimensions such as Accept-Encoding.\n headers.delete(\"set-cookie\");\n const vary = headers.get(\"vary\");\n if (vary) {\n const publicVary = vary\n .split(\",\")\n .map((value) => value.trim())\n .filter((value) => {\n const normalized = value.toLowerCase();\n return (\n normalized &&\n normalized !== \"\" &&\n normalized !== \"cookie\" &&\n normalized !== \"authorization\"\n );\n });\n if (publicVary.length > 0) headers.set(\"vary\", publicVary.join(\", \"));\n else headers.delete(\"vary\");\n }\n\n // Netlify Functions/proxies are not cached by default. Set all three cache\n // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,\n // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache\n // actually serves SSR HTML/.data from the edge instead of forwarding every\n // request to origin — for every visitor, authenticated or not.\n for (const [name, value] of Object.entries(resolveSsrCacheHeaders())) {\n headers.set(name, value);\n }\n}\n\nfunction applyDefaultSpeculationRulesHeader(\n headers: Headers,\n status: number,\n basePath: string,\n) {\n if (status < 200 \|\| status >= 400) return;\n if (headers.has(\"speculation-rules\")) return;\n\n const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n if (!contentType.includes(\"text/html\")) return;\n\n // Cloudflare Speed Brain injects its own Speculation-Rules header when the\n // origin omits one. Those browser prefetches carry `Sec-Purpose: prefetch`,\n // and Cloudflare refuses cache-ineligible dynamic pages with a 503 before\n // the request can reach Netlify/origin. We publish an explicit no-op ruleset\n // by default so Cloudflare does not inject its edge prefetch rules. Preserve\n // an app-provided Speculation-Rules header above if a template deliberately\n // owns this behavior.\n const rulesPath = prefixMountedPath(DEFAULT_SPECULATION_RULES_PATH, basePath);\n headers.set(\"speculation-rules\", `\"${rulesPath}\"`);\n}\n\n/*\n Strip document-level CSP from app HTML responses.\n \n Hosted templates inject framework bootstrap scripts, analytics, Sentry config,\n * and app-owned inline scripts whose exact bytes vary by build/template. Any\n * shared CSP header, even Report-Only, can block or noisily report Google Tag\n * Manager and those bootstraps. Extension iframes and webviews keep their own\n * route-specific sandboxes; normal app documents deliberately do not emit CSP.\n /\nfunction removeDocumentCsp(headers: Headers): void {\n headers.delete(\"content-security-policy\");\n headers.delete(\"content-security-policy-report-only\");\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n return (\n isMcpPublicPath(pathname) \|\|\n pathname.startsWith(\"/.well-known/\") \|\|\n pathname.startsWith(\"/_agent_native/\") \|\|\n pathname.startsWith(\"/_agent-native/\") \|\|\n pathname.startsWith(\"/api/\") \|\|\n pathname.startsWith(\"/@vite/\") \|\|\n pathname.startsWith(\"/@id/\") \|\|\n pathname.startsWith(\"/@fs/\") \|\|\n pathname === \"/@react-refresh\" \|\|\n pathname === \"/__vite_ping\" \|\|\n pathname === \"/__open-in-editor\" \|\|\n pathname === \"/favicon.ico\" \|\|\n pathname === \"/favicon.png\" \|\|\n (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n );\n}\n\nasync function rewriteMountedResponse(\n response: Response,\n basePath: string,\n pathname: string,\n requestUrl: string,\n): Promise<Response> {\n const clientConfigScript =\n [\n getSentryClientConfigScript(),\n getPostHogClientConfigScript(),\n getRealtimeClientConfigScript(),\n ]\n .filter(Boolean)\n .join(\"\") \|\| null;\n const headers = new Headers(response.headers);\n applyDefaultSsrCacheHeader(headers, response.status, pathname);\n applyDefaultSpeculationRulesHeader(headers, response.status, basePath);\n\n const location = headers.get(\"location\");\n if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n headers.set(\"location\", prefixMountedPath(location, basePath));\n }\n\n const contentType = headers.get(\"content-type\") ?? \"\";\n if (!contentType.toLowerCase().includes(\"text/html\")) {\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n });\n }\n removeDocumentCsp(headers);\n if (!response.body) {\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n });\n }\n\n const html = await response.text();\n headers.delete(\"content-length\");\n return new Response(\n injectHeadScript(\n injectDefaultSocialImageMeta(\n prefixMountedHtml(html, basePath),\n defaultSocialImageUrl(requestUrl, basePath),\n ),\n clientConfigScript,\n ),\n {\n status: response.status,\n statusText: response.statusText,\n headers,\n },\n );\n}\n\n/\n Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> \| unknown) {\n const handler = createRequestHandler(getBuild as any);\n return defineEventHandler(async (event) => {\n const basePath = getAppBasePath();\n const p = stripAppBasePath(event.url.pathname);\n if (isFrameworkOrAssetPath(p)) {\n return new Response(null, { status: 404 });\n }\n try {\n const request = requestForAnonymousSsr(\n requestWithPathname(event.req as Request, p, basePath),\n );\n // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the\n // request's session/cookies here, and pin an explicitly anonymous request\n // context. That keeps the SSR HTML/.data identical for every visitor so it\n // can be hard-cached at the CDN for everyone (see applyDefaultSsrCacheHeader).\n //\n // Consequence: SSR loaders that call `getRequestUserEmail()` / `accessFilter()`\n // always see the unauthenticated branch and render public content only. Any\n // per-user view (private records, share-grant access, who's logged in) MUST\n // be resolved CLIENT-SIDE after load, never baked into SSR. Do not re-pin the\n // session here to \"fix\" a per-user page — that silently makes the page\n // uncacheable and/or leaks one user's data into another's cached copy.\n const ctx = { userEmail: undefined, orgId: undefined };\n if (request.method === \"HEAD\") {\n const getRequest = new Request(request.url, {\n method: \"GET\",\n headers: request.headers,\n signal: request.signal,\n });\n const response = await runWithRequestContext(ctx, () =>\n handler(getRequest),\n );\n return await rewriteMountedResponse(\n new Response(null, {\n status: response.status,\n statusText: response.statusText,\n headers: response.headers,\n }),\n basePath,\n p,\n request.url,\n );\n }\n return await rewriteMountedResponse(\n await runWithRequestContext(ctx, () => handler(request)),\n basePath,\n p,\n request.url,\n );\n } catch (err) {\n // Log the full stack server-side, but never leak it to the client.\n // Stack traces expose file paths, library versions, and code structure\n // that aid reconnaissance attacks. In dev we surface the message text\n // so devtools shows something useful; in prod we return a bare 500.\n console.error(\"[ssr-handler] SSR error:\", err);\n captureError(err, {\n route: p,\n method: event.req.method,\n userAgent: event.req.headers.get(\"user-agent\") ?? undefined,\n tags: { renderMode: \"anonymous-public\", surface: \"ssr\" },\n });\n const isProd = process.env.NODE_ENV === \"production\";\n const body = isProd\n ? \"Internal Server Error\"\n : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n return new Response(body, {\n status: 500,\n headers: { \"content-type\": \"text/plain\" },\n });\n }\n });\n}\n"]}

package/dist/shared/mcp-embed-headers.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-export declare const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+export declare const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Session-Id,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export declare const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 export declare function isLocalMcpEmbedOrigin(origin: string | null | undefined): boolean;
 export declare function isClaudeMcpContentOrigin(origin: string | null | undefined): boolean;

package/dist/shared/mcp-embed-headers.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-embed-headers.d.ts","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,~~qPAC2M,~~CAAC;~~AACrP~~,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAYzE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAWT;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAOT;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAgBT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAiBT;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAQT;AAKD,eAAO,MAAM,8BAA8B;aACzC,6BAA6B,EAAE,GAAG;aAClC,8BAA8B,EAAE,cAAc;aAC9C,wBAAwB,EAAE,SAAS;CAC3B,CAAC;AAoBX,wBAAgB,6BAA6B,CAC3C,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAA;CAAE,CAAC,CAapE"}
1	+ {"version":3,"file":"mcp-embed-headers.d.ts","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,+QACqO,CAAC;AAC/Q,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAYzE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAWT;AAED,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAOT;AAED,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAgBT;AAED,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAiBT;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAQT;AAKD,eAAO,MAAM,8BAA8B;aACzC,6BAA6B,EAAE,GAAG;aAClC,8BAA8B,EAAE,cAAc;aAC9C,wBAAwB,EAAE,SAAS;CAC3B,CAAC;AAoBX,wBAAgB,6BAA6B,CAC3C,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAA;CAAE,CAAC,CAapE"}

package/dist/shared/mcp-embed-headers.js CHANGED Viewed

@@ -1,4 +1,4 @@
-export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Session-Id,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
 export const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 const CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\.claudemcpcontent\.com$/i;
 const CHATGPT_MCP_SANDBOX_HOST_RE = /^(?:[^.]+\.)?web-sandbox\.oaiusercontent\.com$/i;

package/dist/shared/mcp-embed-headers.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"mcp-embed-headers.js","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GACvC,~~kPAAkP~~,CAAC;~~AACrP~~,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAEzE,MAAM,0BAA0B,GAAG,wCAAwC,CAAC;AAC5E,MAAM,2BAA2B,GAC/B,iDAAiD,CAAC;AACpD,MAAM,wCAAwC,GAAG,mBAAmB,CAAC;AACrE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,yBAAyB;IACzB,qBAAqB;IACrB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,QAAQ,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAC3D,QAAQ,CAAC,MAAM,GAAG,wCAAwC,CAAC,MAAM,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,QAAQ,KAAK,YAAY;gBACxB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAChC,QAAQ,KAAK,YAAY;gBACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,qBAAqB,CAAC,MAAM,CAAC;QAC7B,wBAAwB,CAAC,MAAM,CAAC;QAChC,yBAAyB,CAAC,MAAM,CAAC;QACjC,sBAAsB,CAAC,MAAM,CAAC;QAC9B,gCAAgC,CAAC,MAAM,CAAC;QACxC,sBAAsB,CAAC,MAAM,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,CAAC,wBAAwB,CAAC,MAAM,CAAC;QACjC,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAClC,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAC/B,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,yCAAyC;AACzC,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,cAAc;IAC9C,wBAAwB,EAAE,SAAS;CAC3B,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAGP,EAAE,CAAC;IACP,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["export const MCP_EMBED_CORS_ALLOW_HEADERS =\n \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant\";\nexport const EMBED_TRANSPLANT_HEADER = \"x-agent-native-embed-transplant\";\n\nconst CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\\.claudemcpcontent\\.com$/i;\nconst CHATGPT_MCP_SANDBOX_HOST_RE =\n /^(?:[^.]+\\.)?web-sandbox\\.oaiusercontent\\.com$/i;\nconst AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX = \".agent-native.com\";\nconst MCP_PRODUCT_HOST_ORIGINS = new Set([\n \"https://chat.openai.com\",\n \"https://chatgpt.com\",\n \"https://claude.ai\",\n]);\n\nexport function isLocalMcpEmbedOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n return (\n url.protocol === \"http:\" &&\n [\"localhost\", \"127.0.0.1\", \"::1\", \"[::1]\"].includes(url.hostname)\n );\n } catch {\n return false;\n }\n}\n\nexport function isClaudeMcpContentOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n return (\n url.protocol === \"https:\" && CLAUDE_MCP_CONTENT_HOST_RE.test(url.hostname)\n );\n } catch {\n return false;\n }\n}\n\nexport function isChatGptMcpSandboxOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n return (\n url.protocol === \"https:\" &&\n CHATGPT_MCP_SANDBOX_HOST_RE.test(url.hostname)\n );\n } catch {\n return false;\n }\n}\n\nexport function isMcpProductHostOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n return MCP_PRODUCT_HOST_ORIGINS.has(new URL(origin).origin);\n } catch {\n return false;\n }\n}\n\nexport function isAgentNativeFirstPartyAppOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n const hostname = url.hostname.toLowerCase();\n return (\n url.protocol === \"https:\" &&\n !url.username &&\n !url.password &&\n !url.port &&\n hostname.endsWith(AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX) &&\n hostname.length > AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX.length\n );\n } catch {\n return false;\n }\n}\n\nexport function isBuilderIoEmbedOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n const hostname = url.hostname.toLowerCase();\n return (\n url.protocol === \"https:\" &&\n !url.username &&\n !url.password &&\n (hostname === \"builder.io\" \|\|\n hostname.endsWith(\".builder.io\") \|\|\n hostname === \"builder.my\" \|\|\n hostname.endsWith(\".builder.my\"))\n );\n } catch {\n return false;\n }\n}\n\nexport function isMcpEmbedCorsOrigin(\n origin: string \| null \| undefined,\n): boolean {\n return (\n origin === \"null\" \|\|\n isLocalMcpEmbedOrigin(origin) \|\|\n isClaudeMcpContentOrigin(origin) \|\|\n isChatGptMcpSandboxOrigin(origin) \|\|\n isMcpProductHostOrigin(origin) \|\|\n isAgentNativeFirstPartyAppOrigin(origin) \|\|\n isBuilderIoEmbedOrigin(origin)\n );\n}\n\nexport function shouldAllowMcpEmbedCredentials(\n origin: string \| null \| undefined,\n): boolean {\n return (\n origin !== \"null\" &&\n !isClaudeMcpContentOrigin(origin) &&\n !isChatGptMcpSandboxOrigin(origin) &&\n !isMcpProductHostOrigin(origin) &&\n !isAgentNativeFirstPartyAppOrigin(origin)\n );\n}\n\n// These paths are served straight off the CDN, so the security-headers h3\n// middleware never runs for them — anything it sets that must also hold for\n// static assets has to be repeated here.\nexport const MCP_EMBED_STATIC_ASSET_HEADERS = {\n \"Access-Control-Allow-Origin\": \"\",\n \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n \"X-Content-Type-Options\": \"nosniff\",\n} as const;\n\nconst STATIC_ASSET_PATTERNS = [\n \"/assets/\",\n \"/favicon.ico\",\n \"/favicon.svg\",\n \"/manifest.json\",\n \"/icon-.svg\",\n \"/agent-native-.svg\",\n \"/library-presets/*\",\n];\n\nfunction normalizeBasePath(basePath: string \| undefined): string {\n const base = (basePath ?? \"\").trim();\n if (!base \|\| base === \"/\") return \"\";\n return base.startsWith(\"/\")\n ? base.replace(/\\/+$/g, \"\")\n : `/${base.replace(/\\/+$/g, \"\")}`;\n}\n\nexport function mcpEmbedStaticAssetRouteRules(\n basePath?: string,\n): Record<string, { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }> {\n const base = normalizeBasePath(basePath);\n const rules: Record<\n string,\n { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }\n > = {};\n for (const pattern of STATIC_ASSET_PATTERNS) {\n rules[pattern] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n if (base) {\n rules[`${base}${pattern}`] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n }\n }\n return rules;\n}\n"]}
1	+ {"version":3,"file":"mcp-embed-headers.js","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GACvC,4QAA4Q,CAAC;AAC/Q,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAEzE,MAAM,0BAA0B,GAAG,wCAAwC,CAAC;AAC5E,MAAM,2BAA2B,GAC/B,iDAAiD,CAAC;AACpD,MAAM,wCAAwC,GAAG,mBAAmB,CAAC;AACrE,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,yBAAyB;IACzB,qBAAqB;IACrB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CACnC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,OAAO;YACxB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC/C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,wBAAwB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,QAAQ,CAAC,QAAQ,CAAC,wCAAwC,CAAC;YAC3D,QAAQ,CAAC,MAAM,GAAG,wCAAwC,CAAC,MAAM,CAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,QAAQ,KAAK,YAAY;gBACxB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAChC,QAAQ,KAAK,YAAY;gBACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,qBAAqB,CAAC,MAAM,CAAC;QAC7B,wBAAwB,CAAC,MAAM,CAAC;QAChC,yBAAyB,CAAC,MAAM,CAAC;QACjC,sBAAsB,CAAC,MAAM,CAAC;QAC9B,gCAAgC,CAAC,MAAM,CAAC;QACxC,sBAAsB,CAAC,MAAM,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAiC;IAEjC,OAAO,CACL,MAAM,KAAK,MAAM;QACjB,CAAC,wBAAwB,CAAC,MAAM,CAAC;QACjC,CAAC,yBAAyB,CAAC,MAAM,CAAC;QAClC,CAAC,sBAAsB,CAAC,MAAM,CAAC;QAC/B,CAAC,gCAAgC,CAAC,MAAM,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,4EAA4E;AAC5E,yCAAyC;AACzC,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,cAAc;IAC9C,wBAAwB,EAAE,SAAS;CAC3B,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAGP,EAAE,CAAC;IACP,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["export const MCP_EMBED_CORS_ALLOW_HEADERS =\n \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Frontend,X-Agent-Native-Client-Compatibility,X-Agent-Native-Build-Id,X-User-Timezone,X-Agent-Native-Session-Id,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant\";\nexport const EMBED_TRANSPLANT_HEADER = \"x-agent-native-embed-transplant\";\n\nconst CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\\.claudemcpcontent\\.com$/i;\nconst CHATGPT_MCP_SANDBOX_HOST_RE =\n /^(?:[^.]+\\.)?web-sandbox\\.oaiusercontent\\.com$/i;\nconst AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX = \".agent-native.com\";\nconst MCP_PRODUCT_HOST_ORIGINS = new Set([\n \"https://chat.openai.com\",\n \"https://chatgpt.com\",\n \"https://claude.ai\",\n]);\n\nexport function isLocalMcpEmbedOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n return (\n url.protocol === \"http:\" &&\n [\"localhost\", \"127.0.0.1\", \"::1\", \"[::1]\"].includes(url.hostname)\n );\n } catch {\n return false;\n }\n}\n\nexport function isClaudeMcpContentOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n return (\n url.protocol === \"https:\" && CLAUDE_MCP_CONTENT_HOST_RE.test(url.hostname)\n );\n } catch {\n return false;\n }\n}\n\nexport function isChatGptMcpSandboxOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n return (\n url.protocol === \"https:\" &&\n CHATGPT_MCP_SANDBOX_HOST_RE.test(url.hostname)\n );\n } catch {\n return false;\n }\n}\n\nexport function isMcpProductHostOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n return MCP_PRODUCT_HOST_ORIGINS.has(new URL(origin).origin);\n } catch {\n return false;\n }\n}\n\nexport function isAgentNativeFirstPartyAppOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n const hostname = url.hostname.toLowerCase();\n return (\n url.protocol === \"https:\" &&\n !url.username &&\n !url.password &&\n !url.port &&\n hostname.endsWith(AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX) &&\n hostname.length > AGENT_NATIVE_FIRST_PARTY_APP_HOST_SUFFIX.length\n );\n } catch {\n return false;\n }\n}\n\nexport function isBuilderIoEmbedOrigin(\n origin: string \| null \| undefined,\n): boolean {\n if (!origin) return false;\n try {\n const url = new URL(origin);\n const hostname = url.hostname.toLowerCase();\n return (\n url.protocol === \"https:\" &&\n !url.username &&\n !url.password &&\n (hostname === \"builder.io\" \|\|\n hostname.endsWith(\".builder.io\") \|\|\n hostname === \"builder.my\" \|\|\n hostname.endsWith(\".builder.my\"))\n );\n } catch {\n return false;\n }\n}\n\nexport function isMcpEmbedCorsOrigin(\n origin: string \| null \| undefined,\n): boolean {\n return (\n origin === \"null\" \|\|\n isLocalMcpEmbedOrigin(origin) \|\|\n isClaudeMcpContentOrigin(origin) \|\|\n isChatGptMcpSandboxOrigin(origin) \|\|\n isMcpProductHostOrigin(origin) \|\|\n isAgentNativeFirstPartyAppOrigin(origin) \|\|\n isBuilderIoEmbedOrigin(origin)\n );\n}\n\nexport function shouldAllowMcpEmbedCredentials(\n origin: string \| null \| undefined,\n): boolean {\n return (\n origin !== \"null\" &&\n !isClaudeMcpContentOrigin(origin) &&\n !isChatGptMcpSandboxOrigin(origin) &&\n !isMcpProductHostOrigin(origin) &&\n !isAgentNativeFirstPartyAppOrigin(origin)\n );\n}\n\n// These paths are served straight off the CDN, so the security-headers h3\n// middleware never runs for them — anything it sets that must also hold for\n// static assets has to be repeated here.\nexport const MCP_EMBED_STATIC_ASSET_HEADERS = {\n \"Access-Control-Allow-Origin\": \"\",\n \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n \"X-Content-Type-Options\": \"nosniff\",\n} as const;\n\nconst STATIC_ASSET_PATTERNS = [\n \"/assets/\",\n \"/favicon.ico\",\n \"/favicon.svg\",\n \"/manifest.json\",\n \"/icon-.svg\",\n \"/agent-native-.svg\",\n \"/library-presets/*\",\n];\n\nfunction normalizeBasePath(basePath: string \| undefined): string {\n const base = (basePath ?? \"\").trim();\n if (!base \|\| base === \"/\") return \"\";\n return base.startsWith(\"/\")\n ? base.replace(/\\/+$/g, \"\")\n : `/${base.replace(/\\/+$/g, \"\")}`;\n}\n\nexport function mcpEmbedStaticAssetRouteRules(\n basePath?: string,\n): Record<string, { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }> {\n const base = normalizeBasePath(basePath);\n const rules: Record<\n string,\n { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }\n > = {};\n for (const pattern of STATIC_ASSET_PATTERNS) {\n rules[pattern] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n if (base) {\n rules[`${base}${pattern}`] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n }\n }\n return rules;\n}\n"]}

package/dist/templates/workspace-core/.agents/skills/observability/SKILL.md CHANGED Viewed

@@ -232,6 +232,7 @@ All tables are dialect-agnostic (SQLite + Postgres) and strictly additive.
 | `packages/core/src/observability/types.ts` | Shared type definitions |
 | `packages/core/src/observability/store.ts` | SQL tables + CRUD |
 | `packages/core/src/observability/traces.ts` | Auto-instrumentation |
+| `packages/core/src/observability/posthog-ai.ts` | `$ai_trace` / `$ai_span` / `survey sent` emission, content bounding, `$ai_error` |
 | `packages/core/src/observability/feedback.ts` | Feedback + Frustration Index |
 | `packages/core/src/observability/evals.ts` | Eval engine (3 layers) |
 | `packages/core/src/observability/experiments.ts` | A/B testing system |
@@ -272,16 +273,17 @@ The loop emits `agent.run` (with `agent.run_id`, `agent.thread_id`, `agent.user_
 ## Tracking Bridge
-Instrumented agent loops also emit one server-side tracking event per completed
-LLM generation:
-- Event name: `$ai_generation`
-- Provider path: `track()` from `@agent-native/core/tracking`, so configured
-  PostHog, Agent Native Analytics, Mixpanel, Amplitude, and webhook providers
-  receive it through the same best-effort fan-out as other tracking events.
-- PostHog shape: uses AI Observability properties such as `$ai_trace_id`,
-  `$ai_session_id`, `$ai_model`, `$ai_provider`, `$ai_input_tokens`,
-  `$ai_output_tokens`, `$ai_latency`, `$ai_total_cost_usd`, and `$ai_is_error`.
+Instrumented agent loops emit server-side tracking events for every run through
+`track()` from `@agent-native/core/tracking`, so configured PostHog, Agent Native
+Analytics, Mixpanel, Amplitude, and webhook providers receive them through the
+same best-effort fan-out as other tracking events.
+- Events: `$ai_trace` per run, `$ai_span` per tool call, and `$ai_generation`
+  per model call. Every node carries the run id as `$ai_trace_id` and links
+  upward through `$ai_parent_id` so a backend can rebuild the tree.
+  `$ai_session_id` is the thread; the browser session is separate and ships as
+  `$session_id`, read from `X-Agent-Native-Session-Id` via
+  `RequestContext.browserSessionId`. Emission lives in `posthog-ai.ts`.
 - Agent Native Analytics shape: the same event lands in `analytics_events` with
   mirrored query-friendly properties such as `run_id`, `thread_id`,
   `cost_cents_x100`, `duration_ms`, `tool_calls`, `successful_tools`,
@@ -293,6 +295,30 @@ LLM generation:
   `parent_run_id` when available. `parent_turn_id` is separate because one
   logical turn may span multiple concrete runs.
+Constraints that are not visible from the emit site:
+- **One generation per run, not per model round-trip.** The engine layer reports
+  aggregate usage through `onUsage` and exposes no per-step hook, so a multi-step
+  run collapses into a single generation carrying the whole message list.
+  Per-round-trip latency and intermediate turns are unavailable without a new
+  seam in `ai-sdk-engine.ts` / `builder-engine.ts`. Do not describe the current
+  output as per-step.
+- **Disabled capture omits the field rather than sending an empty one.** An
+  empty array is indistinguishable from a run that genuinely had no messages.
+  Truncated content is marked, and a run over the span cap stamps
+  `$ai_spans_dropped` — a truncated run must not read as a complete one.
+- **The structural tool-call list ships even when content capture is off.**
+  Backends derive their tool tags from tool-call blocks inside the output
+  choices and from nothing else, so tool names (without arguments) are always
+  emitted. The parallel first-party `tools` array stays because the dashboards
+  read it; that duplication is deliberate, not cleanup.
+- **Only thumbs carry `sentiment`.** All four feedback types are reported, but a
+  category follow-up to a thumbs-down is detail about the same vote — counting
+  it again inflates the metric.
+- **Never invent an external id to make an integration light up.** Survey-based
+  feedback is emitted only when a real survey id is configured, and nothing is
+  sent otherwise.
 Do not build a separate LLM-observability ingestion API unless there is a clear
 reason the tracking provider registry cannot express the use case. Keep prompt,
 tool input, and model output content out of tracking by default; use the existing

package/dist/templates/workspace-core/.agents/skills/tracking/SKILL.md CHANGED Viewed

@@ -79,7 +79,7 @@ Set the env var and the provider auto-registers at startup. No SDK dependencies
 | Provider               | Env vars                                                                                                                                           |
 | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
-| PostHog                | `POSTHOG_API_KEY` (required), `POSTHOG_HOST` (optional, defaults to `https://us.i.posthog.com`)                                                    |
+| PostHog                | `POSTHOG_API_KEY` (required), `POSTHOG_HOST` (optional, defaults to `https://us.i.posthog.com`), `POSTHOG_ERROR_TRACKING=false` (optional opt-out) |
 | Mixpanel               | `MIXPANEL_TOKEN`                                                                                                                                   |
 | Amplitude              | `AMPLITUDE_API_KEY`                                                                                                                                |
 | Agent Native Analytics | `AGENT_NATIVE_ANALYTICS_PUBLIC_KEY` (server), `AGENT_NATIVE_ANALYTICS_ENDPOINT` (optional, defaults to `https://analytics.agent-native.com/track`) |
@@ -89,6 +89,56 @@ Multiple providers can be active simultaneously. All receive every event.
 Browser-side `trackEvent()` also forwards to Agent Native Analytics when `VITE_AGENT_NATIVE_ANALYTICS_PUBLIC_KEY` is present. Use `VITE_AGENT_NATIVE_ANALYTICS_ENDPOINT` to override the default browser endpoint. The built-in Agent Native Analytics sender is quiet on localhost/local dev by default; set `AGENT_NATIVE_ANALYTICS_ALLOW_LOCALHOST=true` only for an intentional local ingestion test.
+## Error Capture
+Exceptions fan out through `server/capture-error.ts` to every registered
+backend — Sentry, PostHog, and the tracking providers — from one `captureError()`
+call. Backends are additive: configuring a second one does not displace the
+first, and no backend is required for the others to work.
+Emit through `captureError()` / `captureException()`. Never hand-roll a
+`track("$exception", …)`: each backend needs its own payload shape and the
+providers build it.
+- **Provider-agnostic wiring must not live in a provider plugin.** The Nitro
+  `error` hook is in `core-routes-plugin.ts`, not `sentry-plugin.ts`, because
+  that plugin returns early when no `SENTRY_DSN` is set — hooking route errors
+  there meant an app on any other backend silently reported none.
+- **Every backend applies `server/error-noise-filter.ts`.** It holds
+  production-tuned drop rules (expected 4xx, access-control rejections, Lambda
+  freeze/thaw `socket hang up`). A backend that skips it receives a firehose;
+  the `socket hang up` rule alone is ~10k events/day.
+- **A backend can accept a malformed payload and still show a count.** PostHog
+  ingested the framework's camelCase `$exception` for a long time and rendered
+  empty, ungroupable issues — which reads as coverage, not as breakage. When
+  adding or changing a backend, check what an event looks like in its UI, not
+  just that the request returned 200.
+- **Attribute the error.** Without a user id, server exceptions land under
+  `anonymous` and split one person in two against their browser events. Pass
+  `aiTraceId` for anything inside an agent run so the issue and the LLM trace
+  resolve to each other.
+Symbolication is per-backend and not automatic: the framework uploads no source
+maps to PostHog, so minified browser stacks stay minified there. Known gap, not
+a bug to re-diagnose.
+### Browser keys and the SSR shell
+Public keys (`POSTHOG_PUBLIC_KEY`, the Sentry client DSN) ship inside the
+CDN-cached SSR shell — publishable and identical for every visitor. Server keys
+never do, and are never a fallback for a public one: `POSTHOG_API_KEY` may be a
+private key and this value lands in public HTML.
+Browser errors post directly to the backend rather than through
+`/_agent-native/track`, because that route requires a resolved session and
+relaying would drop every signed-out crash.
+When adding a client config field, update **both** `server/posthog-config.ts`
+and the mirrored worker emitter in `deploy/build.ts` — the worker bundles a
+string copy and cannot import the module, so a one-sided edit drops the config
+silently in deployed builds. `posthog-config.spec.ts` pins the two outputs
+together.
 ## Default Baseline Events
 Template roots call `configureTracking()` once during app startup. That installs default browser pageview tracking for hosted apps:
@@ -199,6 +249,10 @@ interface TrackingEvent {
 | `packages/core/src/tracking/registry.ts`  | `track()`, `identify()`, `registerTrackingProvider()`, `flushTracking()`                                            |
 | `packages/core/src/tracking/providers.ts` | Built-in providers (PostHog, Mixpanel, Amplitude, Agent Native Analytics, Webhook) and `registerBuiltinProviders()` |
 | `packages/core/src/tracking/types.ts`     | `TrackingEvent` and `TrackingProvider` interfaces                                                                   |
+| `packages/core/src/tracking/posthog-exception.ts` | `$exception_list` builder + stack-frame parser (isomorphic: server and browser)                             |
+| `packages/core/src/tracking/redaction.ts` | Shared bounding/redaction helpers used by every exception emitter                                                   |
+| `packages/core/src/server/error-noise-filter.ts` | Provider-agnostic drop rules, applied by both Sentry `beforeSend` and the route error hook                   |
+| `packages/core/src/server/posthog-config.ts` | Public browser PostHog config (mirrored in `deploy/build.ts`)                                                    |
 ## Related Skills

package/dist/tracking/error-capture.d.ts CHANGED Viewed

@@ -8,6 +8,13 @@ export interface TrackingExceptionContext extends CaptureErrorContext {
     environment?: string;
     runtime?: "node" | "cli";
     source?: "server" | "cli";
+    /**
+     * Who the exception is attributed to. Without it every server exception is
+     * ingested as `anonymous`, which splits one person into two in any backend
+     * that also receives their browser events.
+     */
+    userId?: string;
+    orgId?: string;
 }
 /** Emit a bounded, redacted Node/CLI exception through first-party tracking. */
 export declare function captureException(error: unknown, context?: TrackingExceptionContext): void;

package/dist/tracking/error-capture.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"error-capture.d.ts","sourceRoot":"","sources":["../../src/tracking/error-capture.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;~~AAGtE~~,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,OAAO,GACP,SAAS,GACT,MAAM,GACN,OAAO,CAAC;AAEZ,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;~~CAC3B~~;~~AA2FD~~,gFAAgF;AAChF,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,wBAA6B,GACrC,IAAI,~~CAoCN~~"}
1	+ {"version":3,"file":"error-capture.d.ts","sourceRoot":"","sources":["../../src/tracking/error-capture.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAStE,MAAM,MAAM,sBAAsB,GAC9B,OAAO,GACP,OAAO,GACP,SAAS,GACT,MAAM,GACN,OAAO,CAAC;AAEZ,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,sBAAsB,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,wBAA6B,GACrC,IAAI,CA+CN"}

package/dist/tracking/error-capture.js CHANGED Viewed

@@ -1,76 +1,6 @@
 import { trackingIdentityProperties } from "../observability/tracking-identity.js";
+import { boundedText, exceptionParts, safeTags, safeValue, } from "./redaction.js";
 import { track } from "./registry.js";
-const MAX_MESSAGE_LENGTH = 1000;
-const MAX_STACK_LENGTH = 8000;
-const MAX_TAGS = 30;
-const MAX_EXTRA_KEYS = 30;
-const MAX_EXTRA_VALUE_LENGTH = 1000;
-const SECRET_RE = /\b(?:bearer|basic)\s+[^\s]+/gi;
-const SECRET_KEY_RE = /(?:authorization|cookie|set[-_]?cookie|token|secret|password|passwd|pwd|api[-_]?key|apikey|credential)/i;
-function redact(value) {
-    return value
-        .replace(SECRET_RE, (match) => `${match.split(/\s+/, 1)[0]} <redacted>`)
-        .replace(/([A-Za-z0-9_$.-]*(?:authorization|cookie|token|secret|password|passwd|pwd|api[-_]?key|apikey|credential)[A-Za-z0-9_$.-]*\s*[:=]\s*)([^\s,;}]+)/gi, "$1<redacted>");
-}
-function boundedText(value, max) {
-    const text = typeof value === "string" ? value : String(value ?? "");
-    const safe = redact(text);
-    return safe.length > max ? safe.slice(0, max) : safe;
-}
-function safeValue(value, depth = 2) {
-    if (value == null ||
-        typeof value === "boolean" ||
-        typeof value === "number") {
-        return value;
-    }
-    if (typeof value === "string")
-        return boundedText(value, MAX_EXTRA_VALUE_LENGTH);
-    if (depth <= 0)
-        return boundedText(value, MAX_EXTRA_VALUE_LENGTH);
-    if (Array.isArray(value)) {
-        return value.slice(0, 20).map((item) => safeValue(item, depth - 1));
-    }
-    if (typeof value === "object") {
-        const out = {};
-        for (const [key, child] of Object.entries(value)) {
-            if (Object.keys(out).length >= MAX_EXTRA_KEYS)
-                break;
-            const safeKey = boundedText(key, 100);
-            out[safeKey] = SECRET_KEY_RE.test(safeKey)
-                ? "<redacted>"
-                : safeValue(child, depth - 1);
-        }
-        return out;
-    }
-    return boundedText(value, MAX_EXTRA_VALUE_LENGTH);
-}
-function exceptionParts(error) {
-    if (error instanceof Error) {
-        return {
-            type: boundedText(error.name || "Error", 200),
-            message: boundedText(error.message || error.name || "Error", MAX_MESSAGE_LENGTH),
-            ...(error.stack
-                ? { stack: boundedText(error.stack, MAX_STACK_LENGTH) }
-                : {}),
-        };
-    }
-    return {
-        type: "Error",
-        message: boundedText(error, MAX_MESSAGE_LENGTH),
-    };
-}
-function safeTags(tags) {
-    const out = {};
-    for (const [key, value] of Object.entries(tags ?? {})) {
-        if (Object.keys(out).length >= MAX_TAGS || value == null)
-            break;
-        const safeKey = boundedText(key, 100);
-        out[safeKey] = SECRET_KEY_RE.test(safeKey)
-            ? "<redacted>"
-            : boundedText(value, 200);
-    }
-    return out;
-}
 /** Emit a bounded, redacted Node/CLI exception through first-party tracking. */
 export function captureException(error, context = {}) {
     try {
@@ -102,9 +32,16 @@ export function captureException(error, context = {}) {
             ...(context.environment
                 ? { environment: boundedText(context.environment, 100) }
                 : {}),
+            ...(context.orgId ? { orgId: boundedText(context.orgId, 200) } : {}),
+            // Top-level so error tracking and LLM analytics join on it.
+            ...(context.aiTraceId
+                ? { $ai_trace_id: boundedText(context.aiTraceId, 200) }
+                : {}),
             ...(Object.keys(tags).length ? { exceptionTags: tags } : {}),
-            ...(extra && typeof extra === "object" ? { exceptionExtra: extra } : {}),
-        });
+            ...(extra && typeof extra === "object"
+                ? { exceptionExtra: extra }
+                : {}),
+        }, context.userId ? { userId: context.userId } : undefined);
     }
     catch {
         // Error reporting must never mask the original failure.

package/dist/tracking/error-capture.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"error-capture.js","sourceRoot":"","sources":["../../src/tracking/error-capture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAEnF,OAAO,~~EAAE~~,~~KAAK~~,~~EAAE~~,~~MAAM,eAAe,CAAC;AAmBtC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAChC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,~~cAAc,~~GAAG~~,EAAE,CAAC;AAC1B,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAClD,MAAM,aAAa,GACjB,yGAAyG,CAAC;AAE5G,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;SACvE,OAAO,CACN,kJAAkJ,EAClJ,cAAc,CACf,CAAC;AACN,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,GAAW;IAC9C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,~~CAAC~~,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,SAAS,~~SAAS~~,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC1C,IACE,KAAK,IAAI,IAAI;QACb,OAAO,KAAK,KAAK,SAAS;QAC1B,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAC3B,OAAO,WAAW,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACpD,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc;gBAAE,MAAM;YACrD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACtC,GAAG,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;gBACxC,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IAKpC,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE,GAAG,CAAC;YAC7C,OAAO,EAAE,WAAW,CAClB,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,OAAO,EACtC,kBAAkB,CACnB;YACD,GAAG,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,CAAC~~,EAAE~~;~~gBACvD~~,~~CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IACD,~~OAAO~~;QACL~~,~~IAAI,~~EAAE,~~OAAO;QACb,OAAO,EAAE,WAAW,CAAC,~~KAAK,EAAE,~~kBAAkB,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,IAAoD;IAEpD,~~MAAM,~~GAAG~~,~~GAA2B,EAAE,~~CAAC;~~IACvC~~,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,QAAQ,IAAI,KAAK,IAAI,IAAI;YAAE,MAAM;QAChE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtC,GAAG,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAC9B,KAAc,EACd,OAAO,GAA6B,EAAE;IAEtC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC;YACpB,GAAG,OAAO,CAAC,IAAI;YACf,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,GAAG,OAAO,CAAC,KAAK;YAChB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,KAAK,~~CAAC~~,YAAY,~~EAAE~~;~~YAClB~~,GAAG,0BAA0B,EAAE;YAC/B,aAAa,EAAE,KAAK,CAAC,IAAI;YACzB,gBAAgB,EAAE,KAAK,CAAC,OAAO;YAC/B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;YAC/B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM;YAClC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ;YAClC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,WAAW;gBACrB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,~~CAAC,~~EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC~~;SACzE~~,CAAC,CAAC;~~IACL~~,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;AACH,CAAC","sourcesContent":["import { trackingIdentityProperties } from \"../observability/tracking-identity.js\";\nimport type { CaptureErrorContext } from \"../server/capture-error.js\";\nimport { track } from \"./registry.js\";\n\nexport type TrackingExceptionLevel =\n \| \"fatal\"\n \| \"error\"\n \| \"warning\"\n \| \"info\"\n \| \"debug\";\n\nexport interface TrackingExceptionContext extends CaptureErrorContext {\n /** Whether the caller handled the error. Server error hooks default false. /\n handled?: boolean;\n level?: TrackingExceptionLevel;\n release?: string;\n environment?: string;\n runtime?: \"node\" \| \"cli\";\n source?: \"server\" \| \"cli\";\n}\n\nconst MAX_MESSAGE_LENGTH = 1000;\nconst MAX_STACK_LENGTH = 8000;\nconst MAX_TAGS = 30;\nconst MAX_EXTRA_KEYS = 30;\nconst MAX_EXTRA_VALUE_LENGTH = 1000;\nconst SECRET_RE = /\\b(?:bearer\|basic)\\s+[^\\s]+/gi;\nconst SECRET_KEY_RE =\n ~~/(?:authorization\|cookie\|set[-_]?cookie\|token\|secret\|password\|passwd\|pwd\|api[-_]?key\|apikey\|credential)/i;\~~n~~\nfunction redact(value: string): string {\n return value\n .replace(SECRET_RE, (match) => `${match.split(/\\s+/, 1)[0]} <redacted>`)\n .replace(\n /([A-Za-z0-9_$.-]~~~~(?:authorization\|cookie\|token\|secret\|password\|passwd\|pwd\|api[-_]?key\|apikey\|credential)[A-Za-z0-9_$.-]\\s[:=]\\s)([^\\s,;}]+)/gi,\n \"$1<redacted>\",\n );\n}\n\nfunction~~ ~~boundedText(value:~~ ~~unknown,~~ ~~max:~~ ~~number):~~ ~~string~~ ~~{\n const text = typeof value === \"string\" ? value : String(value ?? \"\");\n const safe = redact(text);\n return safe~~.~~length~~ > ~~max~~ ? ~~safe.slice(0,~~ ~~max)~~ ~~: safe;\n}~~\n~~\nfunction~~ ~~safeValue(value:~~ ~~unknown,~~ ~~depth~~ = ~~2):~~ ~~unknown~~ ~~{\n if~~ ~~(\n value~~ == ~~null~~ ~~\|\|\n typeof~~ ~~value ===~~ \~~"boolean\" \|\|\~~n ~~typeof~~ ~~value~~ ~~===~~ ~~\"number\"\n )~~ ~~{\n return~~ ~~value;\n }\n if~~ ~~(typeof value === \"string\")\~~n ~~return boundedText(value, MAX_EXTRA_VALUE_LENGTH);\~~n if (depth <= 0) return boundedText(value, MAX_EXTRA_VALUE_LENGTH);\n if (Array.isArray(value)) {\n return value.slice(0, 20).map((item) => safeValue(item, depth - 1));\n }\n if (typeof value === \"object\") {\n const out: Record<string~~, unknown> = {}~~;\n for (const [key, child] of Object.entries(value)) {\n if (Object.keys(out).length >= MAX_EXTRA_KEYS) break;\n const safeKey = boundedText(key, 100);\n out[safeKey] = SECRET_KEY_RE.test(safeKey)\n ? \"<redacted>\"\n : safeValue(child, depth - 1);\n }\n return out;\n ~~}\n return boundedText(value, MAX_EXTRA_VALUE_LENGTH);\n}\n\nfunction exceptionParts(error: unknown): {\n type: string;\n message: string;\n stack~~?: string;\n} {\n ~~if (error instanceof Error) {~~\n return {\n type: boundedText(error.name \|\| \"Error\", 200),\n message: boundedText(\n error.message \|\| error.name \|\| \"Error\",\n MAX_MESSAGE_LENGTH,\n ),\n ...(error.stack\n ? { stack: boundedText(error.stack, MAX_STACK_LENGTH) }\n : {}),\n };\n }\n return {\n type: \"Error\",\n message: boundedText(error, MAX_MESSAGE_LENGTH),\n };\n}\n\nfunction safeTags(\n tags: Record<string, string \| undefined> \| undefined,\n): Record<string, string> {\n const out: Record<string, string> = {};\n for (const [key, value] of Object.entries(tags ?? {})) {\n if (Object.keys(out).length >= MAX_TAGS \|\| value == null) break;\n const safeKey = boundedText(key, 100);\n out[safeKey] = SECRET_KEY_RE.test(safeKey)\n ? \"<redacted>\"\n : boundedText(value, 200);\n }\n return out;\n}\n\n/* Emit a bounded, redacted Node/CLI exception through first-party tracking. */\nexport function captureException(\n error: unknown,\n context: TrackingExceptionContext = {},\n): void {\n try {\n const parts = exceptionParts(error);\n const tags = safeTags({\n ...context.tags,\n ...(context.route ? { route: context.route } : {}),\n ...(context.method ? { method: context.method } : {}),\n ...(context.userAgent ? { userAgent: context.userAgent } : {}),\n });\n const extra = safeValue({\n ...context.extra,\n ...(context.contexts ? { contexts: context.contexts } : {}),\n });\n track(\"$exception\", {\n ...trackingIdentityProperties(),\n exceptionType: parts.type,\n exceptionMessage: parts.message,\n ...(parts.stack ? { exceptionStack: parts.stack } : {}),\n handled: context.handled ?? true,\n level: context.level ?? \"error\",\n occurredAt: new Date().toISOString(),\n runtime: context.runtime ?? \"node\",\n source: context.source ?? \"server\",\n ...(context.route ? { url: boundedText(context.route, 500) } : {}),\n ...(context.release\n ? { release: boundedText(context.release, 200) }\n : {}),\n ...(context.environment\n ? { environment: boundedText(context.environment, 100) }\n : {}),\n ...(Object.keys(tags).length ? { exceptionTags: tags } : {}),\n ...(extra && typeof extra === \"object\" ? { exceptionExtra: extra } : {}),\n });\n } catch {\n // Error reporting must never mask the original failure.\n }\n}\n"]}
1	+ {"version":3,"file":"error-capture.js","sourceRoot":"","sources":["../../src/tracking/error-capture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AAEnF,OAAO,EACL,WAAW,EACX,cAAc,EACd,QAAQ,EACR,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AA0BtC,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAC9B,KAAc,EACd,OAAO,GAA6B,EAAE;IAEtC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC;YACpB,GAAG,OAAO,CAAC,IAAI;YACf,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,GAAG,OAAO,CAAC,KAAK;YAChB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,KAAK,CACH,YAAY,EACZ;YACE,GAAG,0BAA0B,EAAE;YAC/B,aAAa,EAAE,KAAK,CAAC,IAAI;YACzB,gBAAgB,EAAE,KAAK,CAAC,OAAO;YAC/B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;YAC/B,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM;YAClC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,QAAQ;YAClC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,WAAW;gBACrB,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,4DAA4D;YAC5D,GAAG,CAAC,OAAO,CAAC,SAAS;gBACnB,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBACpC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE;gBAC3B,CAAC,CAAC,EAAE,CAAC;SACR,EACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CACxD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,wDAAwD;IAC1D,CAAC;AACH,CAAC","sourcesContent":["import { trackingIdentityProperties } from \"../observability/tracking-identity.js\";\nimport type { CaptureErrorContext } from \"../server/capture-error.js\";\nimport {\n boundedText,\n exceptionParts,\n safeTags,\n safeValue,\n} from \"./redaction.js\";\nimport { track } from \"./registry.js\";\n\nexport type TrackingExceptionLevel =\n \| \"fatal\"\n \| \"error\"\n \| \"warning\"\n \| \"info\"\n \| \"debug\";\n\nexport interface TrackingExceptionContext extends CaptureErrorContext {\n /** Whether the caller handled the error. Server error hooks default false. /\n handled?: boolean;\n level?: TrackingExceptionLevel;\n release?: string;\n environment?: string;\n runtime?: \"node\" \| \"cli\";\n source?: \"server\" \| \"cli\";\n /\n Who the exception is attributed to. Without it every server exception is\n * ingested as `anonymous`, which splits one person into two in any backend\n * that also receives their browser events.\n /\n userId?: string;\n orgId?: string;\n}\n\n/* Emit a bounded, redacted Node/CLI exception through first-party tracking. */\nexport function captureException(\n error: unknown,\n context: TrackingExceptionContext = {},\n): void {\n try {\n const parts = exceptionParts(error);\n const tags = safeTags({\n ...context.tags,\n ...(context.route ? { route: context.route } : {}),\n ...(context.method ? { method: context.method } : {}),\n ...(context.userAgent ? { userAgent: context.userAgent } : {}),\n });\n const extra = safeValue({\n ...context.extra,\n ...(context.contexts ? { contexts: context.contexts } : {}),\n });\n track(\n \"$exception\",\n {\n ...trackingIdentityProperties(),\n exceptionType: parts.type,\n exceptionMessage: parts.message,\n ...(parts.stack ? { exceptionStack: parts.stack } : {}),\n handled: context.handled ?? true,\n level: context.level ?? \"error\",\n occurredAt: new Date().toISOString(),\n runtime: context.runtime ?? \"node\",\n source: context.source ?? \"server\",\n ...(context.route ? { url: boundedText(context.route, 500) } : {}),\n ...(context.release\n ? { release: boundedText(context.release, 200) }\n : {}),\n ...(context.environment\n ? { environment: boundedText(context.environment, 100) }\n : {}),\n ...(context.orgId ? { orgId: boundedText(context.orgId, 200) } : {}),\n // Top-level so error tracking and LLM analytics join on it.\n ...(context.aiTraceId\n ? { $ai_trace_id: boundedText(context.aiTraceId, 200) }\n : {}),\n ...(Object.keys(tags).length ? { exceptionTags: tags } : {}),\n ...(extra && typeof extra === \"object\"\n ? { exceptionExtra: extra }\n : {}),\n },\n context.userId ? { userId: context.userId } : undefined,\n );\n } catch {\n // Error reporting must never mask the original failure.\n }\n}\n"]}

package/dist/tracking/index.d.ts CHANGED Viewed

@@ -1,5 +1,6 @@
 export { track, identify, flushTracking, registerTrackingProvider, unregisterTrackingProvider, listTrackingProviders, } from "./registry.js";
 export { registerBuiltinProviders } from "./providers.js";
 export { captureException, type TrackingExceptionContext, type TrackingExceptionLevel, } from "./error-capture.js";
+export { errorToPostHogExceptionProperties, parseStackFrames, reshapeTrackedExceptionProperties, toPostHogExceptionProperties, type PostHogExceptionEntry, type PostHogExceptionInput, type PostHogExceptionLevel, type PostHogExceptionProperties, type PostHogStackFrame, } from "./posthog-exception.js";
 export type { TrackingProvider, TrackingEvent } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/tracking/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tracking/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,aAAa,EACb,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,gBAAgB,EAChB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tracking/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,aAAa,EACb,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,gBAAgB,EAChB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,iCAAiC,EACjC,gBAAgB,EAChB,iCAAiC,EACjC,4BAA4B,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/tracking/index.js CHANGED Viewed

@@ -1,4 +1,5 @@
 export { track, identify, flushTracking, registerTrackingProvider, unregisterTrackingProvider, listTrackingProviders, } from "./registry.js";
 export { registerBuiltinProviders } from "./providers.js";
 export { captureException, } from "./error-capture.js";
+export { errorToPostHogExceptionProperties, parseStackFrames, reshapeTrackedExceptionProperties, toPostHogExceptionProperties, } from "./posthog-exception.js";
 //# sourceMappingURL=index.js.map

package/dist/tracking/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tracking/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,aAAa,EACb,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC","sourcesContent":["export {\n track,\n identify,\n flushTracking,\n registerTrackingProvider,\n unregisterTrackingProvider,\n listTrackingProviders,\n} from \"./registry.js\";\nexport { registerBuiltinProviders } from \"./providers.js\";\nexport {\n captureException,\n type TrackingExceptionContext,\n type TrackingExceptionLevel,\n} from \"./error-capture.js\";\nexport type { TrackingProvider, TrackingEvent } from \"./types.js\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tracking/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,QAAQ,EACR,aAAa,EACb,wBAAwB,EACxB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EACL,gBAAgB,GAGjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,iCAAiC,EACjC,gBAAgB,EAChB,iCAAiC,EACjC,4BAA4B,GAM7B,MAAM,wBAAwB,CAAC","sourcesContent":["export {\n track,\n identify,\n flushTracking,\n registerTrackingProvider,\n unregisterTrackingProvider,\n listTrackingProviders,\n} from \"./registry.js\";\nexport { registerBuiltinProviders } from \"./providers.js\";\nexport {\n captureException,\n type TrackingExceptionContext,\n type TrackingExceptionLevel,\n} from \"./error-capture.js\";\nexport {\n errorToPostHogExceptionProperties,\n parseStackFrames,\n reshapeTrackedExceptionProperties,\n toPostHogExceptionProperties,\n type PostHogExceptionEntry,\n type PostHogExceptionInput,\n type PostHogExceptionLevel,\n type PostHogExceptionProperties,\n type PostHogStackFrame,\n} from \"./posthog-exception.js\";\nexport type { TrackingProvider, TrackingEvent } from \"./types.js\";\n"]}