@agent-native/core 0.14.3 → 0.14.5

package/dist/server/google-auth-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-auth-plugin.d.ts","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AA0TD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,uBAAuB,GAChC,cAAc,CAYhB"}
+{"version":3,"file":"google-auth-plugin.d.ts","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAE/B,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AA0UD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,uBAAuB,GAChC,cAAc,CAYhB"}

package/dist/server/google-auth-plugin.js

@@ -100,7 +100,23 @@ function getGoogleLoginHtml(googleAuthMode) {
     var origin = __anIsBuilderPreview() ? __anConfiguredOAuthOrigin() : '';
     return origin ? origin + path : __anPath(path);
   }
+  function __anBuilderPreviewReturnOrigin() {
+    try {
+      var url = new URL(window.location.href);
+      var host = url.hostname.toLowerCase();
+      var isPreviewHost =
+        host === 'builderio.xyz' || host.slice(-14) === '.builderio.xyz' ||
+        host === 'builderio.dev' || host.slice(-14) === '.builderio.dev' ||
+        host === 'builder.codes' || host.slice(-14) === '.builder.codes' ||
+        host === 'builder.my' || host.slice(-11) === '.builder.my';
+      return url.protocol === 'https:' && isPreviewHost ? url.origin : '';
+    } catch(e) {
+      return '';
+    }
+  }
   function __anWorkspaceGatewayReturnOrigin() {
+    var previewOrigin = __anBuilderPreviewReturnOrigin();
+    if (previewOrigin) return previewOrigin;
     if (__AN_WORKSPACE_GATEWAY_RETURN_ORIGIN) return __AN_WORKSPACE_GATEWAY_RETURN_ORIGIN;
     return __anIsBuilderDesktop() ? 'http://127.0.0.1:8080' : '';
   }
@@ -143,7 +159,7 @@ function getGoogleLoginHtml(googleAuthMode) {
     } catch(e) {}
     try {
       var ref = document.referrer || '';
-      return ref.indexOf('builder.io') !== -1 || ref.indexOf('builder.my') !== -1 || ref.indexOf('builderio.xyz') !== -1;
+      return ref.indexOf('builder.io') !== -1 || ref.indexOf('builder.my') !== -1 || ref.indexOf('builderio.xyz') !== -1 || ref.indexOf('builderio.dev') !== -1 || ref.indexOf('builder.codes') !== -1;
     } catch(e) {
       return false;
     }

package/dist/server/google-auth-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-auth-plugin.js","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EACL,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAe/B,SAAS,kBAAkB,CAAC,cAA8B;IACxD,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAC;IACjD,MAAM,4BAA4B,GAAG,+BAA+B,EAAE,CAAC;IACvE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA+E0B,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;+CACrB,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC;gCAC3D,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiOtD,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiC;IAEjC,OAAO,gBAAgB,CAAC;QACtB,WAAW,EAAE;YACX,gCAAgC;YAChC,gCAAgC;YAChC,wBAAwB;YACxB,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;SAChC;QACD,SAAS,EAAE,kBAAkB,CAC3B,qBAAqB,CAAC,OAAO,EAAE,cAAc,CAAC,CAC/C;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createAuthPlugin } from \"./auth-plugin.js\";\nimport { getPublicOAuthOrigin } from \"./oauth-public-origin.js\";\nimport { getWorkspaceGatewayReturnOrigin } from \"./oauth-return-url.js\";\nimport {\n  resolveGoogleAuthMode,\n  type GoogleAuthMode,\n} from \"./google-auth-mode.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface GoogleAuthPluginOptions {\n  /** Additional paths accessible without authentication */\n  publicPaths?: string[];\n  /**\n   * Google sign-in flow: `'popup'`, `'redirect'`, or `'auto'` (default).\n   * Falls back to `GOOGLE_AUTH_MODE` env var, then `'auto'`. The Builder.io\n   * browser iframe always uses popup regardless (Google blocks framing).\n   */\n  googleAuthMode?: GoogleAuthMode;\n}\n\nfunction getGoogleLoginHtml(googleAuthMode: GoogleAuthMode): string {\n  const publicOAuthOrigin = getPublicOAuthOrigin();\n  const workspaceGatewayReturnOrigin = getWorkspaceGatewayReturnOrigin();\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\">\n<title>Sign in</title>\n<style>\n  *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }\n  body {\n    font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n    background: #0a0a0a;\n    color: #e5e5e5;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    min-height: 100vh;\n  }\n  .card {\n    width: 100%;\n    max-width: 360px;\n    padding: 2rem;\n    background: #141414;\n    border: 1px solid rgba(255,255,255,0.08);\n    border-radius: 12px;\n    text-align: center;\n  }\n  h1 { font-size: 1.125rem; font-weight: 600; margin-bottom: 0.5rem; color: #fff; }\n  .subtitle { font-size: 0.8125rem; color: #888; margin-bottom: 1.5rem; }\n  button {\n    width: 100%;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    gap: 0.625rem;\n    padding: 0.625rem;\n    background: #fff;\n    color: #000;\n    border: none;\n    border-radius: 8px;\n    font-size: 0.9375rem;\n    font-weight: 500;\n    cursor: pointer;\n  }\n  button:hover { opacity: 0.85; }\n  button:disabled { opacity: 0.5; cursor: wait; }\n  .error { margin-top: 0.75rem; font-size: 0.8125rem; color: #f87171; display: none; }\n  .error.show { display: block; }\n  .debug {\n    display: none;\n    margin-top: 0.625rem;\n    font-size: 0.6875rem;\n    line-height: 1.45;\n    color: #777;\n    word-break: break-word;\n  }\n  .debug.show { display: block; }\n  svg { width: 18px; height: 18px; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n  <h1>Sign in</h1>\n  <p class=\"subtitle\">Continue with your Google account</p>\n  <button id=\"btn\" onclick=\"signIn()\">\n    <svg viewBox=\"0 0 24 24\"><path fill=\"#4285F4\" d=\"M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z\"/><path fill=\"#34A853\" d=\"M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z\"/><path fill=\"#FBBC05\" d=\"M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z\"/><path fill=\"#EA4335\" d=\"M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z\"/></svg>\n    Sign in with Google\n  </button>\n  <p class=\"error\" id=\"err\"></p>\n  <p class=\"debug\" id=\"debug\"></p>\n</div>\n<script>\n  function __anBasePath() {\n    var marker = '/_agent-native';\n    var idx = window.location.pathname.indexOf(marker);\n    return idx > 0 ? window.location.pathname.slice(0, idx) : '';\n  }\n  function __anPath(path) {\n    return __anBasePath() + path;\n  }\n  var __AN_PUBLIC_OAUTH_ORIGIN = ${JSON.stringify(publicOAuthOrigin)};\n  var __AN_WORKSPACE_GATEWAY_RETURN_ORIGIN = ${JSON.stringify(workspaceGatewayReturnOrigin)};\n  var __AN_GOOGLE_AUTH_MODE = ${JSON.stringify(googleAuthMode)};\n  function __anConfiguredOAuthOrigin() {\n    if (!__AN_PUBLIC_OAUTH_ORIGIN) return '';\n    try {\n      var origin = new URL(__AN_PUBLIC_OAUTH_ORIGIN).origin;\n      return origin && origin !== window.location.origin ? origin : '';\n    } catch(e) {\n      return '';\n    }\n  }\n  function __anAuthPath(path) {\n    var origin = __anIsBuilderPreview() ? __anConfiguredOAuthOrigin() : '';\n    return origin ? origin + path : __anPath(path);\n  }\n  function __anWorkspaceGatewayReturnOrigin() {\n    if (__AN_WORKSPACE_GATEWAY_RETURN_ORIGIN) return __AN_WORKSPACE_GATEWAY_RETURN_ORIGIN;\n    return __anIsBuilderDesktop() ? 'http://127.0.0.1:8080' : '';\n  }\n  function __anNormalizeWorkspaceReturnPath(ret) {\n    try {\n      var url = new URL(ret || '/', window.location.origin);\n      var path = url.pathname || '/';\n      if (path === '/dispatch/dispatch') {\n        path = '/dispatch';\n      } else if (path.indexOf('/dispatch/') === 0) {\n        var rest = path.slice('/dispatch/'.length);\n        var first = rest.split('/')[0];\n        var dispatchRoutes = {\n          overview: true, apps: true, metrics: true, vault: true,\n          integrations: true, messaging: true, workspace: true,\n          agents: true, destinations: true, identities: true,\n          approvals: true, audit: true, team: true, 'thread-debug': true,\n          'new-app': true\n        };\n        if (first === 'dispatch') {\n          path = '/dispatch' + rest.slice(first.length);\n        } else if (first && !dispatchRoutes[first]) {\n          path = '/' + rest;\n        }\n      }\n      return path + url.search + url.hash;\n    } catch(e) {\n      return ret || '/';\n    }\n  }\n  function __anOAuthReturnTarget(ret) {\n    var path = __anNormalizeWorkspaceReturnPath(ret);\n    var origin = __anWorkspaceGatewayReturnOrigin();\n    return origin ? origin + path : path;\n  }\n  function __anIsBuilderPreview() {\n    try {\n      var params = new URLSearchParams(window.location.search);\n      if (params.has('builder.preview') || params.has('builder.frameEditing') || params.has('__builder_editing__')) return true;\n    } catch(e) {}\n    try {\n      var ref = document.referrer || '';\n      return ref.indexOf('builder.io') !== -1 || ref.indexOf('builder.my') !== -1 || ref.indexOf('builderio.xyz') !== -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anIsBuilderDesktop() {\n    try {\n      var ua = navigator.userAgent || '';\n      return ua.indexOf('Electron') !== -1 && ua.indexOf('AgentNativeDesktop') === -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anIsElectron() {\n    try {\n      return (navigator.userAgent || '').indexOf('Electron') !== -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anResolveAuthFlow() {\n    if (__anIsBuilderPreview() && !__anIsBuilderDesktop()) return 'popup';\n    var mode = __AN_GOOGLE_AUTH_MODE || 'auto';\n    if (mode === 'popup') return 'popup';\n    if (mode === 'redirect') return 'redirect';\n    return __anIsElectron() ? 'redirect' : 'popup';\n  }\n  var __anOAuthPollTimer = null;\n  var __anOAuthPollCount = 0;\n  function __anNewOAuthFlowId() {\n    try {\n      if (window.crypto && typeof window.crypto.randomUUID === 'function') {\n        return window.crypto.randomUUID();\n      }\n    } catch(e) {}\n    return 'builder-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2);\n  }\n  function __anFlowDebugId(flowId) {\n    return flowId ? String(flowId).slice(-10) : '';\n  }\n  function __anSetOAuthDebug(message, flowId) {\n    var text = message + (flowId ? ' (flow ' + __anFlowDebugId(flowId) + ')' : '');\n    try {\n      console.info('[agent-native][google-oauth]', { message: message, flow: __anFlowDebugId(flowId) || undefined });\n    } catch(e) {}\n    var debug = document.getElementById('debug');\n    if (debug) {\n      debug.textContent = text;\n      debug.classList.add('show');\n    }\n  }\n  function __anShowOAuthError(err, btn, message) {\n    if (__anOAuthPollTimer) {\n      clearInterval(__anOAuthPollTimer);\n      __anOAuthPollTimer = null;\n    }\n    err.textContent = message;\n    err.classList.add('show');\n    btn.disabled = false;\n  }\n  function __anWaitForOAuthExchange(flowId, ret, btn, err) {\n    var started = Date.now();\n    var timeoutMs = 5 * 60 * 1000;\n    __anOAuthPollCount = 0;\n    async function check() {\n      __anOAuthPollCount++;\n      try {\n        var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + '?flow_id=' + encodeURIComponent(flowId), { credentials: 'include' });\n        var data = await res.json().catch(function() { return {}; });\n        if (data && (data.email || data.token)) {\n          if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n          __anOAuthPollTimer = null;\n          __anSetOAuthDebug('OAuth exchange redeemed; returning to the app', flowId);\n          window.location.href = ret || '/';\n          return;\n        }\n        if (data && data.error) {\n          __anSetOAuthDebug('OAuth exchange returned an error: ' + (data.message || data.error), flowId);\n          __anShowOAuthError(err, btn, data.message || data.error);\n          return;\n        }\n        if (data && data.pending && (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0)) {\n          __anSetOAuthDebug('Waiting for the Google callback; polling attempt ' + __anOAuthPollCount, flowId);\n        }\n      } catch(e) {\n        if (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0) {\n          __anSetOAuthDebug('Could not reach the OAuth exchange endpoint: ' + (e && e.message ? e.message : 'network error'), flowId);\n        }\n      }\n      if (Date.now() - started > timeoutMs) {\n        __anShowOAuthError(err, btn, 'Google sign-in did not finish. Flow ' + __anFlowDebugId(flowId) + ' never redeemed; check server logs for [agent-native][google-oauth].');\n      }\n    }\n    if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n    __anOAuthPollTimer = setInterval(check, 1000);\n    setTimeout(check, 500);\n  }\n  function __anStartPopupOAuth(ret, btn, err) {\n    var flowId = __anNewOAuthFlowId();\n    var params = new URLSearchParams();\n    if (ret) params.set('return', ret);\n    params.set('desktop', '1');\n    params.set('flow_id', flowId);\n    params.set('redirect', '1');\n    var url = __anPath('/_agent-native/google/auth-url') + '?' + params.toString();\n    try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n    __anSetOAuthDebug('Opening Google sign-in popup', flowId);\n    try {\n      var popup = window.open('', '_blank', 'width=640,height=760');\n      if (!popup) {\n        __anShowOAuthError(err, btn, 'Google popup was blocked. Allow popups for this site and try again (flow ' + __anFlowDebugId(flowId) + ').');\n        return;\n      }\n      try { popup.opener = null; } catch(e) {}\n      try {\n        popup.location.href = url;\n      } catch(e) {\n        try { popup.close(); } catch(closeErr) {}\n        __anShowOAuthError(err, btn, 'Could not navigate Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));\n        return;\n      }\n      __anSetOAuthDebug('Google popup opened; waiting for callback', flowId);\n    } catch(e) {\n      __anShowOAuthError(err, btn, 'Could not open Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));\n      return;\n    }\n    __anWaitForOAuthExchange(flowId, ret, btn, err);\n  }\n  function __anOpenOAuthUrl(url) {\n    try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n    window.location.href = url;\n  }\n  async function signIn() {\n    var btn = document.getElementById('btn');\n    var err = document.getElementById('err');\n    var ret = window.location.pathname + window.location.search;\n    btn.disabled = true;\n    err.classList.remove('show');\n    if (__anResolveAuthFlow() === 'popup') {\n      __anStartPopupOAuth(ret, btn, err);\n      return;\n    }\n    if (__anIsBuilderPreview()) {\n      var params = new URLSearchParams();\n      if (ret) params.set('return', __anOAuthReturnTarget(ret));\n      params.set('redirect', '1');\n      __anSetOAuthDebug('Opening Google sign-in redirect');\n      __anOpenOAuthUrl(__anAuthPath('/_agent-native/google/auth-url') + '?' + params.toString());\n      return;\n    }\n    try {\n      var res = await fetch(__anPath('/_agent-native/google/auth-url') + '?return=' + encodeURIComponent(ret));\n      var data = await res.json();\n      if (data.url) {\n        __anOpenOAuthUrl(data.url);\n      } else {\n        err.textContent = data.message || 'Google OAuth is not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.';\n        err.classList.add('show');\n        btn.disabled = false;\n      }\n    } catch (e) {\n      err.textContent = 'Failed to connect. Please try again.';\n      err.classList.add('show');\n      btn.disabled = false;\n    }\n  }\n</script>\n</body>\n</html>`;\n}\n\n/**\n * Create an auth plugin that uses Google OAuth for authentication.\n *\n * When a user visits the app unauthenticated, they see a \"Sign in with Google\"\n * page. The Google OAuth callback (handled by the template) creates a session\n * tied to the user's Google email. `getSession()` then returns `{ email }` for\n * all subsequent requests.\n *\n * Better Auth handles Google OAuth internally when GOOGLE_CLIENT_ID and\n * GOOGLE_CLIENT_SECRET are set. The template's callback route at\n * /_agent-native/google/callback handles mobile deep linking.\n *\n * Usage in a template's `server/plugins/auth.ts`:\n * ```ts\n * import { createGoogleAuthPlugin } from \"@agent-native/core/server\";\n * export default createGoogleAuthPlugin();\n * ```\n */\nexport function createGoogleAuthPlugin(\n  options?: GoogleAuthPluginOptions,\n): NitroPluginDef {\n  return createAuthPlugin({\n    publicPaths: [\n      \"/_agent-native/google/callback\",\n      \"/_agent-native/google/auth-url\",\n      \"/_agent-native/auth/ba\",\n      ...(options?.publicPaths ?? []),\n    ],\n    loginHtml: getGoogleLoginHtml(\n      resolveGoogleAuthMode(options?.googleAuthMode),\n    ),\n  });\n}\n"]}
+{"version":3,"file":"google-auth-plugin.js","sourceRoot":"","sources":["../../src/server/google-auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EACL,qBAAqB,GAEtB,MAAM,uBAAuB,CAAC;AAe/B,SAAS,kBAAkB,CAAC,cAA8B;IACxD,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,CAAC;IACjD,MAAM,4BAA4B,GAAG,+BAA+B,EAAE,CAAC;IACvE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCA+E0B,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;+CACrB,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC;gCAC3D,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiPtD,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAiC;IAEjC,OAAO,gBAAgB,CAAC;QACtB,WAAW,EAAE;YACX,gCAAgC;YAChC,gCAAgC;YAChC,wBAAwB;YACxB,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,CAAC;SAChC;QACD,SAAS,EAAE,kBAAkB,CAC3B,qBAAqB,CAAC,OAAO,EAAE,cAAc,CAAC,CAC/C;KACF,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { createAuthPlugin } from \"./auth-plugin.js\";\nimport { getPublicOAuthOrigin } from \"./oauth-public-origin.js\";\nimport { getWorkspaceGatewayReturnOrigin } from \"./oauth-return-url.js\";\nimport {\n  resolveGoogleAuthMode,\n  type GoogleAuthMode,\n} from \"./google-auth-mode.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\nexport interface GoogleAuthPluginOptions {\n  /** Additional paths accessible without authentication */\n  publicPaths?: string[];\n  /**\n   * Google sign-in flow: `'popup'`, `'redirect'`, or `'auto'` (default).\n   * Falls back to `GOOGLE_AUTH_MODE` env var, then `'auto'`. The Builder.io\n   * browser iframe always uses popup regardless (Google blocks framing).\n   */\n  googleAuthMode?: GoogleAuthMode;\n}\n\nfunction getGoogleLoginHtml(googleAuthMode: GoogleAuthMode): string {\n  const publicOAuthOrigin = getPublicOAuthOrigin();\n  const workspaceGatewayReturnOrigin = getWorkspaceGatewayReturnOrigin();\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"UTF-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\">\n<title>Sign in</title>\n<style>\n  *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }\n  body {\n    font-family: -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;\n    background: #0a0a0a;\n    color: #e5e5e5;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    min-height: 100vh;\n  }\n  .card {\n    width: 100%;\n    max-width: 360px;\n    padding: 2rem;\n    background: #141414;\n    border: 1px solid rgba(255,255,255,0.08);\n    border-radius: 12px;\n    text-align: center;\n  }\n  h1 { font-size: 1.125rem; font-weight: 600; margin-bottom: 0.5rem; color: #fff; }\n  .subtitle { font-size: 0.8125rem; color: #888; margin-bottom: 1.5rem; }\n  button {\n    width: 100%;\n    display: flex;\n    align-items: center;\n    justify-content: center;\n    gap: 0.625rem;\n    padding: 0.625rem;\n    background: #fff;\n    color: #000;\n    border: none;\n    border-radius: 8px;\n    font-size: 0.9375rem;\n    font-weight: 500;\n    cursor: pointer;\n  }\n  button:hover { opacity: 0.85; }\n  button:disabled { opacity: 0.5; cursor: wait; }\n  .error { margin-top: 0.75rem; font-size: 0.8125rem; color: #f87171; display: none; }\n  .error.show { display: block; }\n  .debug {\n    display: none;\n    margin-top: 0.625rem;\n    font-size: 0.6875rem;\n    line-height: 1.45;\n    color: #777;\n    word-break: break-word;\n  }\n  .debug.show { display: block; }\n  svg { width: 18px; height: 18px; }\n</style>\n</head>\n<body>\n<div class=\"card\">\n  <h1>Sign in</h1>\n  <p class=\"subtitle\">Continue with your Google account</p>\n  <button id=\"btn\" onclick=\"signIn()\">\n    <svg viewBox=\"0 0 24 24\"><path fill=\"#4285F4\" d=\"M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z\"/><path fill=\"#34A853\" d=\"M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z\"/><path fill=\"#FBBC05\" d=\"M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z\"/><path fill=\"#EA4335\" d=\"M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z\"/></svg>\n    Sign in with Google\n  </button>\n  <p class=\"error\" id=\"err\"></p>\n  <p class=\"debug\" id=\"debug\"></p>\n</div>\n<script>\n  function __anBasePath() {\n    var marker = '/_agent-native';\n    var idx = window.location.pathname.indexOf(marker);\n    return idx > 0 ? window.location.pathname.slice(0, idx) : '';\n  }\n  function __anPath(path) {\n    return __anBasePath() + path;\n  }\n  var __AN_PUBLIC_OAUTH_ORIGIN = ${JSON.stringify(publicOAuthOrigin)};\n  var __AN_WORKSPACE_GATEWAY_RETURN_ORIGIN = ${JSON.stringify(workspaceGatewayReturnOrigin)};\n  var __AN_GOOGLE_AUTH_MODE = ${JSON.stringify(googleAuthMode)};\n  function __anConfiguredOAuthOrigin() {\n    if (!__AN_PUBLIC_OAUTH_ORIGIN) return '';\n    try {\n      var origin = new URL(__AN_PUBLIC_OAUTH_ORIGIN).origin;\n      return origin && origin !== window.location.origin ? origin : '';\n    } catch(e) {\n      return '';\n    }\n  }\n  function __anAuthPath(path) {\n    var origin = __anIsBuilderPreview() ? __anConfiguredOAuthOrigin() : '';\n    return origin ? origin + path : __anPath(path);\n  }\n  function __anBuilderPreviewReturnOrigin() {\n    try {\n      var url = new URL(window.location.href);\n      var host = url.hostname.toLowerCase();\n      var isPreviewHost =\n        host === 'builderio.xyz' || host.slice(-14) === '.builderio.xyz' ||\n        host === 'builderio.dev' || host.slice(-14) === '.builderio.dev' ||\n        host === 'builder.codes' || host.slice(-14) === '.builder.codes' ||\n        host === 'builder.my' || host.slice(-11) === '.builder.my';\n      return url.protocol === 'https:' && isPreviewHost ? url.origin : '';\n    } catch(e) {\n      return '';\n    }\n  }\n  function __anWorkspaceGatewayReturnOrigin() {\n    var previewOrigin = __anBuilderPreviewReturnOrigin();\n    if (previewOrigin) return previewOrigin;\n    if (__AN_WORKSPACE_GATEWAY_RETURN_ORIGIN) return __AN_WORKSPACE_GATEWAY_RETURN_ORIGIN;\n    return __anIsBuilderDesktop() ? 'http://127.0.0.1:8080' : '';\n  }\n  function __anNormalizeWorkspaceReturnPath(ret) {\n    try {\n      var url = new URL(ret || '/', window.location.origin);\n      var path = url.pathname || '/';\n      if (path === '/dispatch/dispatch') {\n        path = '/dispatch';\n      } else if (path.indexOf('/dispatch/') === 0) {\n        var rest = path.slice('/dispatch/'.length);\n        var first = rest.split('/')[0];\n        var dispatchRoutes = {\n          overview: true, apps: true, metrics: true, vault: true,\n          integrations: true, messaging: true, workspace: true,\n          agents: true, destinations: true, identities: true,\n          approvals: true, audit: true, team: true, 'thread-debug': true,\n          'new-app': true\n        };\n        if (first === 'dispatch') {\n          path = '/dispatch' + rest.slice(first.length);\n        } else if (first && !dispatchRoutes[first]) {\n          path = '/' + rest;\n        }\n      }\n      return path + url.search + url.hash;\n    } catch(e) {\n      return ret || '/';\n    }\n  }\n  function __anOAuthReturnTarget(ret) {\n    var path = __anNormalizeWorkspaceReturnPath(ret);\n    var origin = __anWorkspaceGatewayReturnOrigin();\n    return origin ? origin + path : path;\n  }\n  function __anIsBuilderPreview() {\n    try {\n      var params = new URLSearchParams(window.location.search);\n      if (params.has('builder.preview') || params.has('builder.frameEditing') || params.has('__builder_editing__')) return true;\n    } catch(e) {}\n    try {\n      var ref = document.referrer || '';\n      return ref.indexOf('builder.io') !== -1 || ref.indexOf('builder.my') !== -1 || ref.indexOf('builderio.xyz') !== -1 || ref.indexOf('builderio.dev') !== -1 || ref.indexOf('builder.codes') !== -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anIsBuilderDesktop() {\n    try {\n      var ua = navigator.userAgent || '';\n      return ua.indexOf('Electron') !== -1 && ua.indexOf('AgentNativeDesktop') === -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anIsElectron() {\n    try {\n      return (navigator.userAgent || '').indexOf('Electron') !== -1;\n    } catch(e) {\n      return false;\n    }\n  }\n  function __anResolveAuthFlow() {\n    if (__anIsBuilderPreview() && !__anIsBuilderDesktop()) return 'popup';\n    var mode = __AN_GOOGLE_AUTH_MODE || 'auto';\n    if (mode === 'popup') return 'popup';\n    if (mode === 'redirect') return 'redirect';\n    return __anIsElectron() ? 'redirect' : 'popup';\n  }\n  var __anOAuthPollTimer = null;\n  var __anOAuthPollCount = 0;\n  function __anNewOAuthFlowId() {\n    try {\n      if (window.crypto && typeof window.crypto.randomUUID === 'function') {\n        return window.crypto.randomUUID();\n      }\n    } catch(e) {}\n    return 'builder-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2);\n  }\n  function __anFlowDebugId(flowId) {\n    return flowId ? String(flowId).slice(-10) : '';\n  }\n  function __anSetOAuthDebug(message, flowId) {\n    var text = message + (flowId ? ' (flow ' + __anFlowDebugId(flowId) + ')' : '');\n    try {\n      console.info('[agent-native][google-oauth]', { message: message, flow: __anFlowDebugId(flowId) || undefined });\n    } catch(e) {}\n    var debug = document.getElementById('debug');\n    if (debug) {\n      debug.textContent = text;\n      debug.classList.add('show');\n    }\n  }\n  function __anShowOAuthError(err, btn, message) {\n    if (__anOAuthPollTimer) {\n      clearInterval(__anOAuthPollTimer);\n      __anOAuthPollTimer = null;\n    }\n    err.textContent = message;\n    err.classList.add('show');\n    btn.disabled = false;\n  }\n  function __anWaitForOAuthExchange(flowId, ret, btn, err) {\n    var started = Date.now();\n    var timeoutMs = 5 * 60 * 1000;\n    __anOAuthPollCount = 0;\n    async function check() {\n      __anOAuthPollCount++;\n      try {\n        var res = await fetch(__anPath('/_agent-native/auth/desktop-exchange') + '?flow_id=' + encodeURIComponent(flowId), { credentials: 'include' });\n        var data = await res.json().catch(function() { return {}; });\n        if (data && (data.email || data.token)) {\n          if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n          __anOAuthPollTimer = null;\n          __anSetOAuthDebug('OAuth exchange redeemed; returning to the app', flowId);\n          window.location.href = ret || '/';\n          return;\n        }\n        if (data && data.error) {\n          __anSetOAuthDebug('OAuth exchange returned an error: ' + (data.message || data.error), flowId);\n          __anShowOAuthError(err, btn, data.message || data.error);\n          return;\n        }\n        if (data && data.pending && (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0)) {\n          __anSetOAuthDebug('Waiting for the Google callback; polling attempt ' + __anOAuthPollCount, flowId);\n        }\n      } catch(e) {\n        if (__anOAuthPollCount === 1 || __anOAuthPollCount % 5 === 0) {\n          __anSetOAuthDebug('Could not reach the OAuth exchange endpoint: ' + (e && e.message ? e.message : 'network error'), flowId);\n        }\n      }\n      if (Date.now() - started > timeoutMs) {\n        __anShowOAuthError(err, btn, 'Google sign-in did not finish. Flow ' + __anFlowDebugId(flowId) + ' never redeemed; check server logs for [agent-native][google-oauth].');\n      }\n    }\n    if (__anOAuthPollTimer) clearInterval(__anOAuthPollTimer);\n    __anOAuthPollTimer = setInterval(check, 1000);\n    setTimeout(check, 500);\n  }\n  function __anStartPopupOAuth(ret, btn, err) {\n    var flowId = __anNewOAuthFlowId();\n    var params = new URLSearchParams();\n    if (ret) params.set('return', ret);\n    params.set('desktop', '1');\n    params.set('flow_id', flowId);\n    params.set('redirect', '1');\n    var url = __anPath('/_agent-native/google/auth-url') + '?' + params.toString();\n    try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n    __anSetOAuthDebug('Opening Google sign-in popup', flowId);\n    try {\n      var popup = window.open('', '_blank', 'width=640,height=760');\n      if (!popup) {\n        __anShowOAuthError(err, btn, 'Google popup was blocked. Allow popups for this site and try again (flow ' + __anFlowDebugId(flowId) + ').');\n        return;\n      }\n      try { popup.opener = null; } catch(e) {}\n      try {\n        popup.location.href = url;\n      } catch(e) {\n        try { popup.close(); } catch(closeErr) {}\n        __anShowOAuthError(err, btn, 'Could not navigate Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));\n        return;\n      }\n      __anSetOAuthDebug('Google popup opened; waiting for callback', flowId);\n    } catch(e) {\n      __anShowOAuthError(err, btn, 'Could not open Google popup for flow ' + __anFlowDebugId(flowId) + ': ' + (e && e.message ? e.message : 'unknown error'));\n      return;\n    }\n    __anWaitForOAuthExchange(flowId, ret, btn, err);\n  }\n  function __anOpenOAuthUrl(url) {\n    try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}\n    window.location.href = url;\n  }\n  async function signIn() {\n    var btn = document.getElementById('btn');\n    var err = document.getElementById('err');\n    var ret = window.location.pathname + window.location.search;\n    btn.disabled = true;\n    err.classList.remove('show');\n    if (__anResolveAuthFlow() === 'popup') {\n      __anStartPopupOAuth(ret, btn, err);\n      return;\n    }\n    if (__anIsBuilderPreview()) {\n      var params = new URLSearchParams();\n      if (ret) params.set('return', __anOAuthReturnTarget(ret));\n      params.set('redirect', '1');\n      __anSetOAuthDebug('Opening Google sign-in redirect');\n      __anOpenOAuthUrl(__anAuthPath('/_agent-native/google/auth-url') + '?' + params.toString());\n      return;\n    }\n    try {\n      var res = await fetch(__anPath('/_agent-native/google/auth-url') + '?return=' + encodeURIComponent(ret));\n      var data = await res.json();\n      if (data.url) {\n        __anOpenOAuthUrl(data.url);\n      } else {\n        err.textContent = data.message || 'Google OAuth is not configured. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.';\n        err.classList.add('show');\n        btn.disabled = false;\n      }\n    } catch (e) {\n      err.textContent = 'Failed to connect. Please try again.';\n      err.classList.add('show');\n      btn.disabled = false;\n    }\n  }\n</script>\n</body>\n</html>`;\n}\n\n/**\n * Create an auth plugin that uses Google OAuth for authentication.\n *\n * When a user visits the app unauthenticated, they see a \"Sign in with Google\"\n * page. The Google OAuth callback (handled by the template) creates a session\n * tied to the user's Google email. `getSession()` then returns `{ email }` for\n * all subsequent requests.\n *\n * Better Auth handles Google OAuth internally when GOOGLE_CLIENT_ID and\n * GOOGLE_CLIENT_SECRET are set. The template's callback route at\n * /_agent-native/google/callback handles mobile deep linking.\n *\n * Usage in a template's `server/plugins/auth.ts`:\n * ```ts\n * import { createGoogleAuthPlugin } from \"@agent-native/core/server\";\n * export default createGoogleAuthPlugin();\n * ```\n */\nexport function createGoogleAuthPlugin(\n  options?: GoogleAuthPluginOptions,\n): NitroPluginDef {\n  return createAuthPlugin({\n    publicPaths: [\n      \"/_agent-native/google/callback\",\n      \"/_agent-native/google/auth-url\",\n      \"/_agent-native/auth/ba\",\n      ...(options?.publicPaths ?? []),\n    ],\n    loginHtml: getGoogleLoginHtml(\n      resolveGoogleAuthMode(options?.googleAuthMode),\n    ),\n  });\n}\n"]}

package/dist/server/google-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAwDZ;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAyFD;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgChD;AASD,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,MAAM,CAG5D;AAgED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,GACb,OAAO,CAqCT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,SAAmC,GAC7C,MAAM,GAAG,IAAI,CAMf;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA6CD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC;AACxE,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;AA0CV;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAqCnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,CAgGpE;AAED;;;kEAGkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAMxD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,SAA4B,GAClC,QAAQ,CAKV"}
+{"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAwDZ;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AA6FD;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgChD;AASD,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,MAAM,CAG5D;AAgED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,GACb,OAAO,CAqCT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,SAAmC,GAC7C,MAAM,GAAG,IAAI,CAMf;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA6CD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC;AACxE,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;AA0CV;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAqCnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,CAgGpE;AAED;;;kEAGkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAMxD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,SAA4B,GAClC,QAAQ,CAKV"}

package/dist/server/google-oauth.js

@@ -144,6 +144,10 @@ function isBuilderPreviewHost(host) {
         const hostname = parsed.hostname.toLowerCase();
         return (hostname === "builderio.xyz" ||
             hostname.endsWith(".builderio.xyz") ||
+            hostname === "builderio.dev" ||
+            hostname.endsWith(".builderio.dev") ||
+            hostname === "builder.codes" ||
+            hostname.endsWith(".builder.codes") ||
             hostname === "builder.io" ||
             hostname.endsWith(".builder.io") ||
             hostname === "builder.my" ||

package/dist/server/google-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,+EAA+E;AAE/E;;oDAEoD;AACpD,SAAS,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;gCAGgC;AAChC,SAAS,gBAAgB,CAAC,MAAe;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,KAAK,GAAG,WAAW;QACvB,CAAC,CAAC,sEAAsE,UAAU,CAAC,WAAW,CAAC,MAAM;QACrG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,4hBAA4hB,QAAQ,qDAAqD,QAAQ,OAAO,KAAK,iFAAiF,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,qFAAqF,CAAC;AACh0B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAuB;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,qBAAqB;KAClC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,CAAC,GAAG,4BAA4B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,gBAAgB,GACpB,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACpC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzE,IAAI,aAAa,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,aAAa,CAAC;IAE5E,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,KAAK;YACzB,MAAM,CAAC,QAAQ,KAAK,OAAO,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CACL,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,UAAU,GACd,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,WAAW,GACf,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,uBAAuB,GAAG,oCAAoC,EAAE;QACpE,CAAC,CAAC,0BAA0B,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEd,IACE,uBAAuB;QACvB,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC,EAChE,CAAC;QACD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,4BAA4B,EAAE,CAAC;QAC7C,yEAAyE;QACzE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAClD,mEAAmE;YACnE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,kEAAkE;QAClE,+DAA+D;QAC/D,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc;IAC5B,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACpD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAI,KAAa,CAAC,GAAG,EAAE,QAAQ,CAAC;IACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAI,KAAa,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,CACL,WAAW,KAAK,GAAG,QAAQ,gBAAgB;QAC3C,WAAW,CAAC,UAAU,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,IAAY;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,IACE,oCAAoC,EAAE;QACtC,4BAA4B,CAAC,SAAS,CAAC,EACvC,CAAC;QACD,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,QAAQ,GAAG,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,KAAc;IAEd,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qCAAqC;IACrC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,eAAe,GACnB,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC;YACE,GAAG,QAAQ,iBAAiB;YAC5B,GAAG,CAAC,oCAAoC,EAAE;gBAC1C,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACrB,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,WAAW,GAAG,gCAAgC;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,0BAA0B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AAqBD;;;;;GAKG;AACH,IAAI,mBAAuC,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,SAAS,kBAAkB;IACzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gDAAgD;YAC9C,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AA0CD,MAAM,UAAU,gBAAgB,CAC9B,iBAAmD,EACnD,KAAc,EACd,OAAiB,EACjB,UAAoB,EACpB,GAAY,EACZ,SAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GACR,OAAO,iBAAiB,KAAK,QAAQ;QACnC,CAAC,CAAC;YACE,WAAW,EAAE,iBAAiB;YAC9B,KAAK;YACL,OAAO;YACP,UAAU;YACV,GAAG;YACH,SAAS;YACT,MAAM;SACP;QACH,CAAC,CAAC,iBAAiB,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAqC;QAChD,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,IAAI,CAAC,WAAW;KACpB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM;SACf,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;SAC1C,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA8B,EAC9B,WAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YAEvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM;iBACpB,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;iBAC1C,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvB,IACE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAC9B,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,WAAW;gBACpC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;gBAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC5D,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,4CAA4C;gBAC5C,SAAS,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;aAC9B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,UAAmB;IAEnB,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,oBAAoB,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,oBAAoB;QAChC,CAAC,CAAC,eAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC;IAE5B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAMD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,KAAa,EACb,IAGC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QAChD,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtC,yBAAyB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/C,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,gEAAgE;QAChE,iCAAiC;QACjC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,eAAe,CAAC;gBACpB,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAa,EACb,IAaC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,SAAS,CAAC;IAEhB,uCAAuC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,0BAA0B,CACzC,IAAI,CAAC,YAAY,EACjB,aAAa,CACd,CAAC;QACF,OAAO,YAAY,CACjB,sYAAsY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,+EAA+E,CAC9e,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACjE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;;;;yCAIiB,SAAS;;8BAEpB,CAAC,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,iBAAiB,CACf,KAAK,EACL,UAAU,EACV,6BAA6B,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CACjE,CAAC;IACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;kEAGkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,ilBAAilB,IAAI,0KAA0K,EAC/vB,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAO,GAAG,yBAAyB;IAEnC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,yPAAyP,IAAI,mDAAmD,CACjT,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,MAAM,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,IAAI,cAAc,CAAC;IACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3C,OAAO,GAAG;SACP,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CACjC,YAAqB,EACrB,KAAc;IAEd,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,MAAM;QACX,CAAC,CAAC,gCAAgC,MAAM,EAAE;QAC1C,CAAC,CAAC,8BAA8B,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAe,EACf,KAAc,EACd,YAAqB,EACrB,KAAc;IAEd,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,OAAO,YAAY,CACjB,isBAAisB,GAAG,2FAA2F,YAAY,2bAA2b,YAAY,4KAA4K,CAC/5C,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,oDAAoD,CACrD,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared Google OAuth utilities for all templates.\n *\n * Handles platform detection (desktop/mobile), state encoding,\n * session token creation, and deep-link responses — the logic\n * that was previously copy-pasted across every template's\n * google-auth.ts handler.\n */\n\nimport crypto from \"node:crypto\";\nimport {\n  getHeader,\n  getQuery,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport {\n  addSession,\n  getSession,\n  getSessionMaxAge,\n  setFrameworkSessionCookie,\n} from \"./auth.js\";\nimport { getAppName } from \"./app-name.js\";\nimport { writeDesktopSso } from \"./desktop-sso.js\";\nimport { appendSessionToOAuthReturnUrl } from \"./oauth-return-url.js\";\n\n// ─── Platform Detection ─────────────────────────────────────────────────────\n\n/** Return an HTML response with the correct Content-Type.\n *  Uses a web-standard Response to ensure the header survives\n *  Nitro dev mode's mock-node-response pipeline. */\nfunction htmlResponse(html: string, status = 200): Response {\n  return new Response(html, {\n    status,\n    headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n  });\n}\n\n/** Shared markup for OAuth success \"close this tab\" pages. Renders a green\n *  check icon above the message, with a little breathing room between the\n *  headline and secondary line. Used by every template that goes through the\n *  shared Google OAuth flow. */\nfunction oauthDebugFlowId(flowId?: string): string | undefined {\n  return flowId ? flowId.slice(-10) : undefined;\n}\n\nfunction oauthSuccessCloseTabHtml(\n  headline: string,\n  footnote: string,\n  debugFlowId?: string,\n): string {\n  const debug = debugFlowId\n    ? `<p style=\"font-size:11px;color:#555;margin:12px 0 0 0\">Debug flow: ${escapeHtml(debugFlowId)}</p>`\n    : \"\";\n  return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#22c55e\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M9 12l2 2l4 -4\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0\">${headline}</p><p style=\"font-size:13px;color:#888;margin:0\">${footnote}</p>${debug}<script>console.info(\"[agent-native][google-oauth] success page loaded\",{flow:${JSON.stringify(debugFlowId || null)}});setTimeout(function(){try{window.close()}catch(e){}},250)</script></body></html>`;\n}\n\n/**\n * HTML escape — minimal but covers the cases that matter when interpolating\n * user-controlled values into our OAuth callback HTML. Mirrors the helper in\n * email-template.ts; kept inline here to avoid a circular import.\n */\nfunction escapeHtml(s: string): string {\n  return String(s ?? \"\")\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * Detect requests from the Agent Native desktop app specifically.\n *\n * The desktop app appends `AgentNativeDesktop/<version>` to its user-agent\n * (see `packages/desktop-app/src/main/index.ts`). We check for that marker\n * rather than matching generic `Electron`, which would also match other\n * Electron-based webviews like Builder.io's Fusion, Slack desktop, Discord,\n * etc. Falsely treating those as \"the desktop app\" sends users to the\n * `agentnative://oauth-complete` deep-link success page after Google sign-in,\n * where the protocol handler can't fire and the \"Open Agent Native\" button\n * does nothing.\n *\n * Kept exported as `isElectron` for backwards compatibility with consumers.\n */\nexport function isElectron(event: H3Event): boolean {\n  return /AgentNativeDesktop/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/** Detect requests from a mobile browser (iOS/Android). */\nexport function isMobile(event: H3Event): boolean {\n  return /iPhone|iPad|iPod|Android/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/**\n * Build the static allowlist of origins we trust for `getOrigin`. Reads\n * deployment-known public URLs (`APP_URL`, `BETTER_AUTH_URL`, and the\n * workspace gateway). Each entry is normalised to `${proto}://${host}` (no\n * path). Duplicates collapse, invalid entries are dropped silently.\n */\nfunction normalizeOrigin(raw: string | undefined): string | undefined {\n  if (!raw) return undefined;\n  try {\n    const u = new URL(raw);\n    return `${u.protocol}//${u.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction getConfiguredOriginAllowlist(): Set<string> {\n  const out = new Set<string>();\n  for (const raw of [\n    process.env.APP_URL,\n    process.env.BETTER_AUTH_URL,\n    process.env.WORKSPACE_GATEWAY_URL,\n  ]) {\n    const origin = normalizeOrigin(raw);\n    if (origin) out.add(origin);\n  }\n  return out;\n}\n\nfunction firstConfiguredOrigin(): string | undefined {\n  return [...getConfiguredOriginAllowlist()][0];\n}\n\nfunction getWorkspaceCallbackOrigin(): string | undefined {\n  const publicAuthOrigin =\n    normalizeOrigin(process.env.APP_URL) ??\n    normalizeOrigin(process.env.BETTER_AUTH_URL);\n  if (publicAuthOrigin) return publicAuthOrigin;\n\n  const gatewayOrigin = normalizeOrigin(process.env.WORKSPACE_GATEWAY_URL);\n  if (gatewayOrigin && !isLoopbackOrigin(gatewayOrigin)) return gatewayOrigin;\n\n  return firstConfiguredOrigin();\n}\n\nfunction isLoopbackHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    return (\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\" ||\n      parsed.hostname === \"::1\" ||\n      parsed.hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    return isLoopbackHost(new URL(origin).host);\n  } catch {\n    return false;\n  }\n}\n\nfunction isBuilderPreviewHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    const hostname = parsed.hostname.toLowerCase();\n    return (\n      hostname === \"builderio.xyz\" ||\n      hostname.endsWith(\".builderio.xyz\") ||\n      hostname === \"builder.io\" ||\n      hostname.endsWith(\".builder.io\") ||\n      hostname === \"builder.my\" ||\n      hostname.endsWith(\".builder.my\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Get the origin from forwarded headers or Host.\n *\n * Defends against Host-header injection: in production we require the resolved\n * origin to match `APP_URL` / `BETTER_AUTH_URL` / `WORKSPACE_GATEWAY_URL`,\n * falling back to those values when inbound headers are missing or don't match.\n * In dev we accept inbound `Host` so localhost / ngrok / preview hosts keep\n * working without configuration, except workspace OAuth requests from loopback\n * or Builder preview hosts use the configured gateway origin when one exists.\n * The protocol defaults to `https` in production (so a TLS-terminating proxy\n * that drops `x-forwarded-proto` doesn't downgrade us to plain HTTP).\n */\nexport function getOrigin(event: H3Event): string {\n  const headerHost =\n    getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const isProd = process.env.NODE_ENV === \"production\";\n  const headerProto =\n    getHeader(event, \"x-forwarded-proto\") || (isProd ? \"https\" : \"http\");\n  const workspaceCallbackOrigin = isWorkspaceOAuthCallbackRelayEnabled()\n    ? getWorkspaceCallbackOrigin()\n    : undefined;\n\n  if (\n    workspaceCallbackOrigin &&\n    (isLoopbackHost(headerHost) || isBuilderPreviewHost(headerHost))\n  ) {\n    return workspaceCallbackOrigin;\n  }\n\n  if (isProd) {\n    const allow = getConfiguredOriginAllowlist();\n    // If the deploy declares its public URL, prefer it over inbound headers.\n    if (allow.size > 0) {\n      const inbound = headerHost ? `${headerProto}://${headerHost}` : \"\";\n      if (inbound && allow.has(inbound)) return inbound;\n      // Inbound didn't match — fall back to the first configured origin.\n      return [...allow][0];\n    }\n    // No allowlist configured: still default to https, but accept the\n    // inbound Host (best we can do without a configured base URL).\n    return `${headerProto}://${headerHost ?? \"\"}`;\n  }\n\n  return `${headerProto}://${headerHost ?? \"localhost\"}`;\n}\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\n/** App mount prefix, if the template is served under APP_BASE_PATH. */\nexport function getAppBasePath(): string {\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n}\n\n/** Build an absolute same-origin URL that preserves APP_BASE_PATH. */\nexport function getAppUrl(event: H3Event, path = \"/\"): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${getOrigin(event)}${getAppBasePath()}${cleanPath}`;\n}\n\nfunction isWorkspaceOAuthCallbackRelayEnabled(): boolean {\n  return (\n    process.env.AGENT_NATIVE_WORKSPACE === \"1\" ||\n    process.env.VITE_AGENT_NATIVE_WORKSPACE === \"1\"\n  );\n}\n\nfunction isFrameworkOAuthCallbackPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/_agent-native/\") &&\n    (pathname.endsWith(\"/callback\") || pathname.includes(\"/callback/\"))\n  );\n}\n\nfunction getOriginalRequestPath(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return mountedPathname;\n  }\n\n  const urlPathname = (event as any).url?.pathname;\n  if (typeof urlPathname === \"string\" && urlPathname) return urlPathname;\n\n  const nodeUrl = event.node?.req?.url;\n  if (typeof nodeUrl === \"string\" && nodeUrl) {\n    const queryStart = nodeUrl.indexOf(\"?\");\n    return queryStart >= 0 ? nodeUrl.slice(0, queryStart) : nodeUrl;\n  }\n\n  const eventPath = (event as any).path;\n  if (typeof eventPath === \"string\" && eventPath) {\n    const queryStart = eventPath.indexOf(\"?\");\n    return queryStart >= 0 ? eventPath.slice(0, queryStart) : eventPath;\n  }\n\n  return \"/\";\n}\n\nfunction isRequestUnderAppBasePath(event: H3Event): boolean {\n  const basePath = getAppBasePath();\n  if (!basePath) return false;\n  const requestPath = getOriginalRequestPath(event);\n  return (\n    requestPath === `${basePath}/_agent-native` ||\n    requestPath.startsWith(`${basePath}/_agent-native/`)\n  );\n}\n\nfunction getDefaultOAuthRedirectUrl(event: H3Event, path: string): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  if (\n    isWorkspaceOAuthCallbackRelayEnabled() &&\n    isFrameworkOAuthCallbackPath(cleanPath)\n  ) {\n    return `${getOrigin(event)}${cleanPath}`;\n  }\n  const basePath = isRequestUnderAppBasePath(event) ? getAppBasePath() : \"\";\n  return `${getOrigin(event)}${basePath}${cleanPath}`;\n}\n\n// ─── redirect_uri Allowlist ──────────────────────────────────────────────────\n\n/**\n * Validate a user-supplied `redirect_uri` for OAuth flows.\n *\n * Defends against authorization-code interception (RFC 6819 §4.4.1.7):\n * even though the upstream provider (Google/Atlassian/Zoom) refuses\n * unregistered redirect URIs, prefix-style registrations and side\n * registrations on the same host let a malicious caller swap in an\n * attacker-controlled URI that the provider still accepts. We reject any\n * candidate that isn't on this server's own origin AND under the\n * framework's `/_agent-native/` namespace. Returns the validated URI on\n * success, or `undefined` on rejection — callers must treat `undefined`\n * as a 400.\n *\n * The intentional shape is exact-prefix:\n *   - Origin must equal `getOrigin(event)` — no Host-header injection\n *     reusing somebody else's registered redirect URI.\n *   - Path must start with `${appBasePath}/_agent-native/` so we never\n *     hand auth codes to a public marketing or open-redirect endpoint\n *     on the same registered host.\n *\n * For desktop / native flows that need ephemeral `http://127.0.0.1:<port>`\n * loopback URIs, callers should validate those at the template level\n * with a dedicated allowlist — this helper rejects them by design.\n */\nexport function isAllowedOAuthRedirectUri(\n  candidate: string,\n  event: H3Event,\n): boolean {\n  if (typeof candidate !== \"string\" || candidate.length === 0) return false;\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    return false;\n  }\n  // Must be same origin as our server.\n  const expectedOrigin = getOrigin(event);\n  let expectedUrl: URL;\n  try {\n    expectedUrl = new URL(expectedOrigin);\n  } catch {\n    return false;\n  }\n  if (url.protocol !== expectedUrl.protocol) return false;\n  if (url.host !== expectedUrl.host) return false;\n  // Must live under the framework's namespace. Workspace deploys can route\n  // root /_agent-native/* to Dispatch even when Dispatch itself is mounted at\n  // /dispatch, but app-prefixed requests should not be able to swap their\n  // callback to that root namespace.\n  const basePath = getAppBasePath();\n  const allowedPrefixes =\n    basePath && isRequestUnderAppBasePath(event)\n      ? [\n          `${basePath}/_agent-native/`,\n          ...(isWorkspaceOAuthCallbackRelayEnabled() &&\n          isFrameworkOAuthCallbackPath(url.pathname)\n            ? [\"/_agent-native/\"]\n            : []),\n        ]\n      : [\"/_agent-native/\"];\n  if (!allowedPrefixes.some((prefix) => url.pathname.startsWith(prefix))) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the `redirect_uri` for an outbound OAuth `auth-url` request.\n *\n * Reads `?redirect_uri=` from the query and validates it via\n * `isAllowedOAuthRedirectUri`. Returns:\n *   - the validated URI when supplied and allowed, OR\n *   - the framework default when no override was supplied, OR\n *   - `null` when an override was supplied but rejected — callers must\n *     respond with 400 in that case.\n *\n * Templates that need a non-default redirect path can pass it via\n * `defaultPath` (e.g. `\"/_agent-native/google/desktop-callback\"` for\n * desktop flows).\n */\nexport function resolveOAuthRedirectUri(\n  event: H3Event,\n  defaultPath = \"/_agent-native/google/callback\",\n): string | null {\n  const supplied = getQuery(event).redirect_uri;\n  if (typeof supplied === \"string\" && supplied.length > 0) {\n    return isAllowedOAuthRedirectUri(supplied, event) ? supplied : null;\n  }\n  return getDefaultOAuthRedirectUrl(event, defaultPath);\n}\n\n// ─── OAuth State ─────────────────────────────────────────────────────────────\n\nexport interface OAuthStatePayload {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  /**\n   * Same-origin path to redirect to after a successful web-flow sign-in.\n   * Threaded through the (HMAC-signed) state so it survives the round trip\n   * to Google. Validated again on decode via safeReturnPath as defence in\n   * depth. Has no effect on desktop / mobile / add-account flows, which\n   * use their own deep-link / close-tab handling.\n   */\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Ephemeral in-memory state-signing key for development. Generated lazily\n * on first read so dev sessions don't depend on filesystem writability or\n * env-var configuration. Sessions reset on each restart, which is fine\n * for dev — no real users / production data are involved.\n */\nlet _devStateSigningKey: string | undefined;\n\n/**\n * Derive a server-only signing key for HMAC verification of OAuth state.\n *\n * Uses a dedicated secret — never an OAuth client secret. Reusing a\n * client_secret (which is shared with Google / GitHub / Atlassian) as our\n * own HMAC key conflates two trust domains: rotating the client secret\n * silently invalidates every in-flight OAuth state, and any leak of the\n * client secret also lets an attacker forge our state envelopes.\n *\n * Resolution order:\n *   1. OAUTH_STATE_SECRET (preferred — dedicated to this purpose)\n *   2. BETTER_AUTH_SECRET (already used by Better Auth as a server secret)\n *   3. In dev only, an ephemeral random key (per-process)\n *\n * In production, throws if neither secret is set.\n */\nfunction getStateSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET || process.env.BETTER_AUTH_SECRET;\n  if (secret) return secret;\n\n  const isProd = process.env.NODE_ENV === \"production\";\n  if (isProd) {\n    throw new Error(\n      \"OAuth state signing requires a server secret. \" +\n        \"Set OAUTH_STATE_SECRET or BETTER_AUTH_SECRET in production.\",\n    );\n  }\n\n  if (!_devStateSigningKey) {\n    _devStateSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devStateSigningKey;\n}\n\n/**\n * Options for the named-argument form of {@link encodeOAuthState}.\n * Prefer this form — the positional overload is easy to misuse (the mail\n * and calendar templates historically passed `flowId` in the `returnUrl`\n * slot, smuggling state into a defence-in-depth path).\n */\nexport interface EncodeOAuthStateOptions {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Encode OAuth state into a signed base64url string.\n * The state is HMAC-signed so the callback can verify it wasn't forged,\n * preventing CSRF attacks on the OAuth flow.\n *\n * Two call shapes are supported:\n *   - Recommended: pass an options object — clear, mismatch-proof.\n *     `encodeOAuthState({ redirectUri, owner, desktop, ... })`\n *   - Legacy positional form (kept working for backward compatibility):\n *     `encodeOAuthState(redirectUri, owner, desktop, addAccount, app, returnUrl, flowId)`.\n *     Callers should migrate to the options form — see the audit on\n *     templates/mail and templates/calendar where the positional shape\n *     led to `flowId` being smuggled in via the `returnUrl` slot.\n */\nexport function encodeOAuthState(opts: EncodeOAuthStateOptions): string;\nexport function encodeOAuthState(\n  redirectUri: string,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string;\nexport function encodeOAuthState(\n  redirectUriOrOpts: string | EncodeOAuthStateOptions,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string {\n  const opts: EncodeOAuthStateOptions =\n    typeof redirectUriOrOpts === \"string\"\n      ? {\n          redirectUri: redirectUriOrOpts,\n          owner,\n          desktop,\n          addAccount,\n          app,\n          returnUrl,\n          flowId,\n        }\n      : redirectUriOrOpts;\n\n  const nonce = crypto.randomBytes(8).toString(\"hex\");\n  const payload: Record<string, string | boolean> = {\n    n: nonce,\n    r: opts.redirectUri,\n  };\n  if (opts.owner) payload.o = opts.owner;\n  if (opts.desktop) payload.d = true;\n  if (opts.addAccount) payload.a = true;\n  if (opts.app) payload.app = opts.app;\n  if (opts.returnUrl) payload.r2 = opts.returnUrl;\n  if (opts.flowId) payload.f = opts.flowId;\n  const data = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  const sig = crypto\n    .createHmac(\"sha256\", getStateSigningKey())\n    .update(data)\n    .digest(\"base64url\");\n  return `${data}.${sig}`;\n}\n\n/**\n * Decode and verify OAuth state from the callback's state query parameter.\n * Rejects forged or tampered state by checking the HMAC signature.\n * Falls back to the provided URI if decoding or verification fails.\n */\nexport function decodeOAuthState(\n  stateParam: string | undefined,\n  fallbackUri: string,\n): OAuthStatePayload {\n  if (stateParam) {\n    try {\n      const dotIdx = stateParam.lastIndexOf(\".\");\n      if (dotIdx === -1) return { redirectUri: fallbackUri };\n\n      const data = stateParam.slice(0, dotIdx);\n      const sig = stateParam.slice(dotIdx + 1);\n      const expected = crypto\n        .createHmac(\"sha256\", getStateSigningKey())\n        .update(data)\n        .digest(\"base64url\");\n\n      if (\n        sig.length !== expected.length ||\n        !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))\n      ) {\n        return { redirectUri: fallbackUri };\n      }\n\n      const parsed = JSON.parse(Buffer.from(data, \"base64url\").toString());\n      return {\n        redirectUri: parsed.r || fallbackUri,\n        owner: parsed.o || undefined,\n        desktop: !!parsed.d,\n        addAccount: !!parsed.a,\n        app: typeof parsed.app === \"string\" ? parsed.app : undefined,\n        // Pass returnUrl through as-is — same-origin validation runs at the\n        // consumer (oauthCallbackResponse → safeReturnPath). The state is\n        // HMAC-signed, but we still validate at consumption as defence in\n        // depth in case the signing key ever leaks.\n        returnUrl: typeof parsed.r2 === \"string\" ? parsed.r2 : undefined,\n        flowId: parsed.f || undefined,\n      };\n    } catch {}\n  }\n  return { redirectUri: fallbackUri };\n}\n\n// ─── Session Creation ────────────────────────────────────────────────────────\n\nexport interface OAuthOwnerResult {\n  owner: string | undefined;\n  hasProductionSession: boolean;\n}\n\n/**\n * Determine the token owner from the current session and OAuth state.\n * Call this BEFORE exchangeCode to get the owner parameter.\n */\nexport async function resolveOAuthOwner(\n  event: H3Event,\n  stateOwner?: string,\n): Promise<OAuthOwnerResult> {\n  const existingSession = await getSession(event);\n  const hasProductionSession = !!existingSession?.email;\n  const owner = hasProductionSession\n    ? existingSession!.email\n    : stateOwner || undefined;\n\n  return { owner, hasProductionSession };\n}\n\nexport interface OAuthSessionResult {\n  sessionToken: string | undefined;\n}\n\n/**\n * Create a session token after a successful OAuth exchange.\n *\n * Desktop and mobile apps have separate cookie jars from the system\n * browser, so they always get a fresh session token (even if the browser\n * already has one). The token is then passed via deep link so the native\n * app can inject it.\n */\nexport async function createOAuthSession(\n  event: H3Event,\n  email: string,\n  opts: {\n    hasProductionSession: boolean;\n    desktop?: boolean;\n  },\n): Promise<OAuthSessionResult> {\n  const mobile = isMobile(event);\n  const needsDeepLink = opts.desktop || mobile;\n  const maxAge = getSessionMaxAge();\n\n  let sessionToken: string | undefined;\n  if (!opts.hasProductionSession || needsDeepLink) {\n    sessionToken = crypto.randomBytes(32).toString(\"hex\");\n    await addSession(sessionToken, email);\n    setFrameworkSessionCookie(event, sessionToken);\n    // Desktop SSO: record this session in the home-dir broker file so\n    // sibling templates (each with its own database) can resolve the\n    // same token without a DB row of their own. Only the PRIMARY\n    // sign-in writes the broker — if a production session already\n    // exists, this is an add-account flow (connecting a secondary\n    // Google account for scraping) and must never switch the active\n    // user across sibling templates.\n    if (opts.desktop && !opts.hasProductionSession) {\n      await writeDesktopSso({\n        email,\n        token: sessionToken,\n        expiresAt: Date.now() + maxAge * 1000,\n      });\n    }\n  }\n\n  return { sessionToken };\n}\n\n// ─── Callback Responses ──────────────────────────────────────────────────────\n\n/**\n * Return the appropriate response after a successful OAuth callback.\n *\n * Handles mobile deep links, desktop deep links, add-account close-tab\n * pages, and plain web redirects — so templates don't have to.\n */\nexport function oauthCallbackResponse(\n  event: H3Event,\n  email: string,\n  opts: {\n    sessionToken?: string;\n    desktop?: boolean;\n    addAccount?: boolean;\n    /**\n     * Same-origin path to return the viewer to after a successful web\n     * sign-in. Validated via safeReturnPath; falls back to \"/\" for any\n     * shape that escapes same-origin. Has no effect on desktop / mobile\n     * / add-account flows — those use their own deep-link handling.\n     */\n    returnUrl?: string;\n    flowId?: string;\n    appName?: string;\n  },\n): Response | string | unknown | Promise<Response | string | unknown> {\n  const mobile = isMobile(event);\n  const query = getQuery(event);\n  const callbackState =\n    typeof query.state === \"string\" && query.state.length > 0\n      ? query.state\n      : undefined;\n\n  // Mobile: deep link back to native app\n  if (mobile) {\n    const deepLink = buildOAuthCompleteDeepLink(\n      opts.sessionToken,\n      callbackState,\n    );\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\"><title>Connected</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p>Connected! Returning to app…</p><script>window.location.href=${JSON.stringify(deepLink)};setTimeout(function(){window.location.href=\"/\"},1500)</script></body></html>`,\n    );\n  }\n\n  // Desktop add-account: close-tab page (must come before general desktop check\n  // to ensure no deep link fires and the existing session is never switched).\n  if (opts.desktop && opts.addAccount) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Electron desktop exchange flow: mail/calendar still pass a flow id so the\n  // renderer can poll as a fallback, but the main handoff should use the\n  // protocol deep link so the popup returns focus to the desktop app.\n  if (opts.desktop && opts.flowId && isElectron(event) && opts.sessionToken) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Desktop exchange flow (non-Electron tray app): the tray app polls the\n  // desktop-exchange endpoint for the token — no deep link needed.\n  if (opts.desktop && opts.flowId) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Signed in as ${safeEmail}!` : \"Signed in!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Desktop login: deep link back to Electron app — only when the callback\n  // request actually carries the AgentNativeDesktop UA marker. Without this\n  // check, any client whose OAuth state was minted with `desktop=true` (e.g.\n  // a stale link, or an upstream that wrongly set `?desktop=1`) would land\n  // on the `agentnative://` page where the deep link can't fire and the\n  // \"Open Agent Native\" button does nothing — surfaces inside Builder.io's\n  // Fusion webview hit this exact dead-end. Fall through to the web flow\n  // for non-Agent-Native-Desktop clients so they get a real redirect.\n  if (opts.desktop && isElectron(event)) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Add-account web flow: close-tab page. The email is rendered into the\n  // page via DOM `textContent` (safe), but we still JSON-stringify so a\n  // payload containing `</script>` can't break out of the script tag —\n  // and explicitly assert it's a string so a callbacks like `null` or\n  // an object won't end up serialised into the page.\n  if (opts.addAccount) {\n    const safeEmail = JSON.stringify(typeof email === \"string\" ? email : \"\");\n    return htmlResponse(`<!DOCTYPE html><html><body><script>\n        window.close();\n        var p = document.createElement('p');\n        p.style.cssText = 'font-family:system-ui;text-align:center;margin-top:40vh';\n        p.textContent = 'Connected ' + ${safeEmail} + '! You can close this tab.';\n        document.body.appendChild(p);\n      </script></body></html>`);\n  }\n\n  // Web: redirect to the requested return target. Path-only returns stay\n  // same-origin; Builder desktop workspace returns may point back to the\n  // local loopback gateway and carry the short-lived `_session` bridge so\n  // the local app can promote the newly created hosted OAuth session.\n  setResponseStatus(event, 302);\n  setResponseHeader(\n    event,\n    \"Location\",\n    appendSessionToOAuthReturnUrl(opts.returnUrl, opts.sessionToken),\n  );\n  setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n  return \"\";\n}\n\n/** HTML error page for OAuth failures. The message is HTML-escaped — most\n *  callers pass `error.message` from a token-exchange or userinfo failure,\n *  which can echo upstream provider strings (and historically attacker-\n *  controlled query params via the `error_description` field). */\nexport function oauthErrorPage(message: string): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connection failed</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;text-align:center\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ef4444\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M15 9l-6 6\"/><path d=\"M9 9l6 6\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0;color:#ddd\">${safe}</p><p style=\"font-size:13px;color:#888;margin:0\"><a href=\"/\" style=\"color:#888;text-decoration:underline;text-underline-offset:3px\">Back to login</a></p></body></html>`,\n    400,\n  );\n}\n\nexport function oauthDesktopExchangePage(\n  message = \"Returning to the app...\",\n): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Returning</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p style=\"font-size:14px\">${safe}</p><script>window.close()</script></body></html>`,\n  );\n}\n\n// ─── Internal ────────────────────────────────────────────────────────────────\n\nfunction resolveOAuthAppName(explicit?: string): string {\n  const raw = explicit || getAppName() || \"Agent Native\";\n  if (!/^[a-z0-9_-]+$/.test(raw)) return raw;\n  return raw\n    .split(/[-_]+/)\n    .filter(Boolean)\n    .map((word) => word[0].toUpperCase() + word.slice(1))\n    .join(\" \");\n}\n\nfunction buildOAuthCompleteDeepLink(\n  sessionToken?: string,\n  state?: string,\n): string {\n  const params = new URLSearchParams();\n  if (sessionToken) params.set(\"token\", sessionToken);\n  if (state) params.set(\"state\", state);\n  const suffix = params.toString();\n  return suffix\n    ? `agentnative://oauth-complete?${suffix}`\n    : \"agentnative://oauth-complete\";\n}\n\nfunction desktopSuccessPage(\n  _event: H3Event,\n  email?: string,\n  sessionToken?: string,\n  state?: string,\n): Response {\n  const safeEmail = email ? escapeHtml(email) : \"\";\n  const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n  if (sessionToken) {\n    const deepLink = buildOAuthCompleteDeepLink(sessionToken, state);\n    const deepLinkJson = JSON.stringify(deepLink);\n    // Defence in depth: if this page somehow gets served to a UA that isn't\n    // the Agent Native desktop app (server gate bypassed, stale link, etc.),\n    // skip the `agentnative://` deep link entirely and bounce to the app\n    // root. The deep link silently fails outside the desktop app and the\n    // \"Open Agent Native\" button is a dead end in a generic browser/webview.\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title><style>@keyframes spin{to{transform:rotate(360deg)}}@keyframes fadeIn{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}.spinner{width:28px;height:28px;border:2px solid #333;border-top-color:#fff;border-radius:50%;animation:spin .8s linear infinite}.fallback{display:none;flex-direction:column;align-items:center;gap:8px;animation:fadeIn .2s ease-out}.fallback.show{display:flex}</style></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:16px\"><p style=\"font-size:16px;margin:0\">${msg}</p><div id=\"loading\" class=\"spinner\"></div><div id=\"fallback\" class=\"fallback\"><a href=${deepLinkJson} style=\"display:inline-block;padding:10px 24px;background:#fff;color:#000;border-radius:8px;text-decoration:none;font-size:14px;font-weight:500\">Open Agent Native</a><p style=\"font-size:12px;color:#666;margin:0\">If the app didn\\u2019t open automatically, click the button above.</p></div><script>(function(){var ua=(navigator.userAgent||\"\");if(ua.indexOf(\"AgentNativeDesktop\")===-1){window.location.replace(\"/\");return}window.location.href=${deepLinkJson};setTimeout(function(){document.getElementById(\"loading\").style.display=\"none\";document.getElementById(\"fallback\").classList.add(\"show\")},3000)})()</script></body></html>`,\n    );\n  }\n  return htmlResponse(\n    oauthSuccessCloseTabHtml(\n      msg,\n      \"You can close this tab and return to Agent Native.\",\n    ),\n  );\n}\n"]}
+{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,+EAA+E;AAE/E;;oDAEoD;AACpD,SAAS,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;gCAGgC;AAChC,SAAS,gBAAgB,CAAC,MAAe;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,KAAK,GAAG,WAAW;QACvB,CAAC,CAAC,sEAAsE,UAAU,CAAC,WAAW,CAAC,MAAM;QACrG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,4hBAA4hB,QAAQ,qDAAqD,QAAQ,OAAO,KAAK,iFAAiF,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,qFAAqF,CAAC;AACh0B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,GAAuB;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,OAAO,CAAC,GAAG,CAAC,qBAAqB;KAClC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,CAAC,GAAG,4BAA4B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,gBAAgB,GACpB,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACpC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACzE,IAAI,aAAa,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC;QAAE,OAAO,aAAa,CAAC;IAE5E,OAAO,qBAAqB,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,KAAK;YACzB,MAAM,CAAC,QAAQ,KAAK,OAAO,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CACL,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,UAAU,GACd,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,WAAW,GACf,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,uBAAuB,GAAG,oCAAoC,EAAE;QACpE,CAAC,CAAC,0BAA0B,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEd,IACE,uBAAuB;QACvB,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC,EAChE,CAAC;QACD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,4BAA4B,EAAE,CAAC;QAC7C,yEAAyE;QACzE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAClD,mEAAmE;YACnE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,kEAAkE;QAClE,+DAA+D;QAC/D,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc;IAC5B,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACpD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAI,KAAa,CAAC,GAAG,EAAE,QAAQ,CAAC;IACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAI,KAAa,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,CACL,WAAW,KAAK,GAAG,QAAQ,gBAAgB;QAC3C,WAAW,CAAC,UAAU,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,IAAY;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,IACE,oCAAoC,EAAE;QACtC,4BAA4B,CAAC,SAAS,CAAC,EACvC,CAAC;QACD,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,QAAQ,GAAG,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,KAAc;IAEd,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qCAAqC;IACrC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,eAAe,GACnB,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC;YACE,GAAG,QAAQ,iBAAiB;YAC5B,GAAG,CAAC,oCAAoC,EAAE;gBAC1C,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACrB,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,WAAW,GAAG,gCAAgC;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,0BAA0B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AAqBD;;;;;GAKG;AACH,IAAI,mBAAuC,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,SAAS,kBAAkB;IACzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gDAAgD;YAC9C,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AA0CD,MAAM,UAAU,gBAAgB,CAC9B,iBAAmD,EACnD,KAAc,EACd,OAAiB,EACjB,UAAoB,EACpB,GAAY,EACZ,SAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GACR,OAAO,iBAAiB,KAAK,QAAQ;QACnC,CAAC,CAAC;YACE,WAAW,EAAE,iBAAiB;YAC9B,KAAK;YACL,OAAO;YACP,UAAU;YACV,GAAG;YACH,SAAS;YACT,MAAM;SACP;QACH,CAAC,CAAC,iBAAiB,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAqC;QAChD,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,IAAI,CAAC,WAAW;KACpB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM;SACf,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;SAC1C,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA8B,EAC9B,WAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YAEvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM;iBACpB,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;iBAC1C,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvB,IACE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAC9B,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,WAAW;gBACpC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;gBAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC5D,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,4CAA4C;gBAC5C,SAAS,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;aAC9B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,UAAmB;IAEnB,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,oBAAoB,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,oBAAoB;QAChC,CAAC,CAAC,eAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC;IAE5B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAMD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,KAAa,EACb,IAGC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QAChD,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtC,yBAAyB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/C,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,gEAAgE;QAChE,iCAAiC;QACjC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,eAAe,CAAC;gBACpB,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAa,EACb,IAaC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,SAAS,CAAC;IAEhB,uCAAuC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,0BAA0B,CACzC,IAAI,CAAC,YAAY,EACjB,aAAa,CACd,CAAC;QACF,OAAO,YAAY,CACjB,sYAAsY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,+EAA+E,CAC9e,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACjE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;;;;yCAIiB,SAAS;;8BAEpB,CAAC,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,iBAAiB,CACf,KAAK,EACL,UAAU,EACV,6BAA6B,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CACjE,CAAC;IACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;kEAGkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,ilBAAilB,IAAI,0KAA0K,EAC/vB,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAO,GAAG,yBAAyB;IAEnC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,yPAAyP,IAAI,mDAAmD,CACjT,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,MAAM,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,IAAI,cAAc,CAAC;IACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3C,OAAO,GAAG;SACP,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CACjC,YAAqB,EACrB,KAAc;IAEd,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,MAAM;QACX,CAAC,CAAC,gCAAgC,MAAM,EAAE;QAC1C,CAAC,CAAC,8BAA8B,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAe,EACf,KAAc,EACd,YAAqB,EACrB,KAAc;IAEd,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,OAAO,YAAY,CACjB,isBAAisB,GAAG,2FAA2F,YAAY,2bAA2b,YAAY,4KAA4K,CAC/5C,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,oDAAoD,CACrD,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared Google OAuth utilities for all templates.\n *\n * Handles platform detection (desktop/mobile), state encoding,\n * session token creation, and deep-link responses — the logic\n * that was previously copy-pasted across every template's\n * google-auth.ts handler.\n */\n\nimport crypto from \"node:crypto\";\nimport {\n  getHeader,\n  getQuery,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport {\n  addSession,\n  getSession,\n  getSessionMaxAge,\n  setFrameworkSessionCookie,\n} from \"./auth.js\";\nimport { getAppName } from \"./app-name.js\";\nimport { writeDesktopSso } from \"./desktop-sso.js\";\nimport { appendSessionToOAuthReturnUrl } from \"./oauth-return-url.js\";\n\n// ─── Platform Detection ─────────────────────────────────────────────────────\n\n/** Return an HTML response with the correct Content-Type.\n *  Uses a web-standard Response to ensure the header survives\n *  Nitro dev mode's mock-node-response pipeline. */\nfunction htmlResponse(html: string, status = 200): Response {\n  return new Response(html, {\n    status,\n    headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n  });\n}\n\n/** Shared markup for OAuth success \"close this tab\" pages. Renders a green\n *  check icon above the message, with a little breathing room between the\n *  headline and secondary line. Used by every template that goes through the\n *  shared Google OAuth flow. */\nfunction oauthDebugFlowId(flowId?: string): string | undefined {\n  return flowId ? flowId.slice(-10) : undefined;\n}\n\nfunction oauthSuccessCloseTabHtml(\n  headline: string,\n  footnote: string,\n  debugFlowId?: string,\n): string {\n  const debug = debugFlowId\n    ? `<p style=\"font-size:11px;color:#555;margin:12px 0 0 0\">Debug flow: ${escapeHtml(debugFlowId)}</p>`\n    : \"\";\n  return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#22c55e\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M9 12l2 2l4 -4\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0\">${headline}</p><p style=\"font-size:13px;color:#888;margin:0\">${footnote}</p>${debug}<script>console.info(\"[agent-native][google-oauth] success page loaded\",{flow:${JSON.stringify(debugFlowId || null)}});setTimeout(function(){try{window.close()}catch(e){}},250)</script></body></html>`;\n}\n\n/**\n * HTML escape — minimal but covers the cases that matter when interpolating\n * user-controlled values into our OAuth callback HTML. Mirrors the helper in\n * email-template.ts; kept inline here to avoid a circular import.\n */\nfunction escapeHtml(s: string): string {\n  return String(s ?? \"\")\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * Detect requests from the Agent Native desktop app specifically.\n *\n * The desktop app appends `AgentNativeDesktop/<version>` to its user-agent\n * (see `packages/desktop-app/src/main/index.ts`). We check for that marker\n * rather than matching generic `Electron`, which would also match other\n * Electron-based webviews like Builder.io's Fusion, Slack desktop, Discord,\n * etc. Falsely treating those as \"the desktop app\" sends users to the\n * `agentnative://oauth-complete` deep-link success page after Google sign-in,\n * where the protocol handler can't fire and the \"Open Agent Native\" button\n * does nothing.\n *\n * Kept exported as `isElectron` for backwards compatibility with consumers.\n */\nexport function isElectron(event: H3Event): boolean {\n  return /AgentNativeDesktop/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/** Detect requests from a mobile browser (iOS/Android). */\nexport function isMobile(event: H3Event): boolean {\n  return /iPhone|iPad|iPod|Android/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/**\n * Build the static allowlist of origins we trust for `getOrigin`. Reads\n * deployment-known public URLs (`APP_URL`, `BETTER_AUTH_URL`, and the\n * workspace gateway). Each entry is normalised to `${proto}://${host}` (no\n * path). Duplicates collapse, invalid entries are dropped silently.\n */\nfunction normalizeOrigin(raw: string | undefined): string | undefined {\n  if (!raw) return undefined;\n  try {\n    const u = new URL(raw);\n    return `${u.protocol}//${u.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction getConfiguredOriginAllowlist(): Set<string> {\n  const out = new Set<string>();\n  for (const raw of [\n    process.env.APP_URL,\n    process.env.BETTER_AUTH_URL,\n    process.env.WORKSPACE_GATEWAY_URL,\n  ]) {\n    const origin = normalizeOrigin(raw);\n    if (origin) out.add(origin);\n  }\n  return out;\n}\n\nfunction firstConfiguredOrigin(): string | undefined {\n  return [...getConfiguredOriginAllowlist()][0];\n}\n\nfunction getWorkspaceCallbackOrigin(): string | undefined {\n  const publicAuthOrigin =\n    normalizeOrigin(process.env.APP_URL) ??\n    normalizeOrigin(process.env.BETTER_AUTH_URL);\n  if (publicAuthOrigin) return publicAuthOrigin;\n\n  const gatewayOrigin = normalizeOrigin(process.env.WORKSPACE_GATEWAY_URL);\n  if (gatewayOrigin && !isLoopbackOrigin(gatewayOrigin)) return gatewayOrigin;\n\n  return firstConfiguredOrigin();\n}\n\nfunction isLoopbackHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    return (\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\" ||\n      parsed.hostname === \"::1\" ||\n      parsed.hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    return isLoopbackHost(new URL(origin).host);\n  } catch {\n    return false;\n  }\n}\n\nfunction isBuilderPreviewHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    const hostname = parsed.hostname.toLowerCase();\n    return (\n      hostname === \"builderio.xyz\" ||\n      hostname.endsWith(\".builderio.xyz\") ||\n      hostname === \"builderio.dev\" ||\n      hostname.endsWith(\".builderio.dev\") ||\n      hostname === \"builder.codes\" ||\n      hostname.endsWith(\".builder.codes\") ||\n      hostname === \"builder.io\" ||\n      hostname.endsWith(\".builder.io\") ||\n      hostname === \"builder.my\" ||\n      hostname.endsWith(\".builder.my\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Get the origin from forwarded headers or Host.\n *\n * Defends against Host-header injection: in production we require the resolved\n * origin to match `APP_URL` / `BETTER_AUTH_URL` / `WORKSPACE_GATEWAY_URL`,\n * falling back to those values when inbound headers are missing or don't match.\n * In dev we accept inbound `Host` so localhost / ngrok / preview hosts keep\n * working without configuration, except workspace OAuth requests from loopback\n * or Builder preview hosts use the configured gateway origin when one exists.\n * The protocol defaults to `https` in production (so a TLS-terminating proxy\n * that drops `x-forwarded-proto` doesn't downgrade us to plain HTTP).\n */\nexport function getOrigin(event: H3Event): string {\n  const headerHost =\n    getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const isProd = process.env.NODE_ENV === \"production\";\n  const headerProto =\n    getHeader(event, \"x-forwarded-proto\") || (isProd ? \"https\" : \"http\");\n  const workspaceCallbackOrigin = isWorkspaceOAuthCallbackRelayEnabled()\n    ? getWorkspaceCallbackOrigin()\n    : undefined;\n\n  if (\n    workspaceCallbackOrigin &&\n    (isLoopbackHost(headerHost) || isBuilderPreviewHost(headerHost))\n  ) {\n    return workspaceCallbackOrigin;\n  }\n\n  if (isProd) {\n    const allow = getConfiguredOriginAllowlist();\n    // If the deploy declares its public URL, prefer it over inbound headers.\n    if (allow.size > 0) {\n      const inbound = headerHost ? `${headerProto}://${headerHost}` : \"\";\n      if (inbound && allow.has(inbound)) return inbound;\n      // Inbound didn't match — fall back to the first configured origin.\n      return [...allow][0];\n    }\n    // No allowlist configured: still default to https, but accept the\n    // inbound Host (best we can do without a configured base URL).\n    return `${headerProto}://${headerHost ?? \"\"}`;\n  }\n\n  return `${headerProto}://${headerHost ?? \"localhost\"}`;\n}\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\n/** App mount prefix, if the template is served under APP_BASE_PATH. */\nexport function getAppBasePath(): string {\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n}\n\n/** Build an absolute same-origin URL that preserves APP_BASE_PATH. */\nexport function getAppUrl(event: H3Event, path = \"/\"): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${getOrigin(event)}${getAppBasePath()}${cleanPath}`;\n}\n\nfunction isWorkspaceOAuthCallbackRelayEnabled(): boolean {\n  return (\n    process.env.AGENT_NATIVE_WORKSPACE === \"1\" ||\n    process.env.VITE_AGENT_NATIVE_WORKSPACE === \"1\"\n  );\n}\n\nfunction isFrameworkOAuthCallbackPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/_agent-native/\") &&\n    (pathname.endsWith(\"/callback\") || pathname.includes(\"/callback/\"))\n  );\n}\n\nfunction getOriginalRequestPath(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return mountedPathname;\n  }\n\n  const urlPathname = (event as any).url?.pathname;\n  if (typeof urlPathname === \"string\" && urlPathname) return urlPathname;\n\n  const nodeUrl = event.node?.req?.url;\n  if (typeof nodeUrl === \"string\" && nodeUrl) {\n    const queryStart = nodeUrl.indexOf(\"?\");\n    return queryStart >= 0 ? nodeUrl.slice(0, queryStart) : nodeUrl;\n  }\n\n  const eventPath = (event as any).path;\n  if (typeof eventPath === \"string\" && eventPath) {\n    const queryStart = eventPath.indexOf(\"?\");\n    return queryStart >= 0 ? eventPath.slice(0, queryStart) : eventPath;\n  }\n\n  return \"/\";\n}\n\nfunction isRequestUnderAppBasePath(event: H3Event): boolean {\n  const basePath = getAppBasePath();\n  if (!basePath) return false;\n  const requestPath = getOriginalRequestPath(event);\n  return (\n    requestPath === `${basePath}/_agent-native` ||\n    requestPath.startsWith(`${basePath}/_agent-native/`)\n  );\n}\n\nfunction getDefaultOAuthRedirectUrl(event: H3Event, path: string): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  if (\n    isWorkspaceOAuthCallbackRelayEnabled() &&\n    isFrameworkOAuthCallbackPath(cleanPath)\n  ) {\n    return `${getOrigin(event)}${cleanPath}`;\n  }\n  const basePath = isRequestUnderAppBasePath(event) ? getAppBasePath() : \"\";\n  return `${getOrigin(event)}${basePath}${cleanPath}`;\n}\n\n// ─── redirect_uri Allowlist ──────────────────────────────────────────────────\n\n/**\n * Validate a user-supplied `redirect_uri` for OAuth flows.\n *\n * Defends against authorization-code interception (RFC 6819 §4.4.1.7):\n * even though the upstream provider (Google/Atlassian/Zoom) refuses\n * unregistered redirect URIs, prefix-style registrations and side\n * registrations on the same host let a malicious caller swap in an\n * attacker-controlled URI that the provider still accepts. We reject any\n * candidate that isn't on this server's own origin AND under the\n * framework's `/_agent-native/` namespace. Returns the validated URI on\n * success, or `undefined` on rejection — callers must treat `undefined`\n * as a 400.\n *\n * The intentional shape is exact-prefix:\n *   - Origin must equal `getOrigin(event)` — no Host-header injection\n *     reusing somebody else's registered redirect URI.\n *   - Path must start with `${appBasePath}/_agent-native/` so we never\n *     hand auth codes to a public marketing or open-redirect endpoint\n *     on the same registered host.\n *\n * For desktop / native flows that need ephemeral `http://127.0.0.1:<port>`\n * loopback URIs, callers should validate those at the template level\n * with a dedicated allowlist — this helper rejects them by design.\n */\nexport function isAllowedOAuthRedirectUri(\n  candidate: string,\n  event: H3Event,\n): boolean {\n  if (typeof candidate !== \"string\" || candidate.length === 0) return false;\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    return false;\n  }\n  // Must be same origin as our server.\n  const expectedOrigin = getOrigin(event);\n  let expectedUrl: URL;\n  try {\n    expectedUrl = new URL(expectedOrigin);\n  } catch {\n    return false;\n  }\n  if (url.protocol !== expectedUrl.protocol) return false;\n  if (url.host !== expectedUrl.host) return false;\n  // Must live under the framework's namespace. Workspace deploys can route\n  // root /_agent-native/* to Dispatch even when Dispatch itself is mounted at\n  // /dispatch, but app-prefixed requests should not be able to swap their\n  // callback to that root namespace.\n  const basePath = getAppBasePath();\n  const allowedPrefixes =\n    basePath && isRequestUnderAppBasePath(event)\n      ? [\n          `${basePath}/_agent-native/`,\n          ...(isWorkspaceOAuthCallbackRelayEnabled() &&\n          isFrameworkOAuthCallbackPath(url.pathname)\n            ? [\"/_agent-native/\"]\n            : []),\n        ]\n      : [\"/_agent-native/\"];\n  if (!allowedPrefixes.some((prefix) => url.pathname.startsWith(prefix))) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the `redirect_uri` for an outbound OAuth `auth-url` request.\n *\n * Reads `?redirect_uri=` from the query and validates it via\n * `isAllowedOAuthRedirectUri`. Returns:\n *   - the validated URI when supplied and allowed, OR\n *   - the framework default when no override was supplied, OR\n *   - `null` when an override was supplied but rejected — callers must\n *     respond with 400 in that case.\n *\n * Templates that need a non-default redirect path can pass it via\n * `defaultPath` (e.g. `\"/_agent-native/google/desktop-callback\"` for\n * desktop flows).\n */\nexport function resolveOAuthRedirectUri(\n  event: H3Event,\n  defaultPath = \"/_agent-native/google/callback\",\n): string | null {\n  const supplied = getQuery(event).redirect_uri;\n  if (typeof supplied === \"string\" && supplied.length > 0) {\n    return isAllowedOAuthRedirectUri(supplied, event) ? supplied : null;\n  }\n  return getDefaultOAuthRedirectUrl(event, defaultPath);\n}\n\n// ─── OAuth State ─────────────────────────────────────────────────────────────\n\nexport interface OAuthStatePayload {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  /**\n   * Same-origin path to redirect to after a successful web-flow sign-in.\n   * Threaded through the (HMAC-signed) state so it survives the round trip\n   * to Google. Validated again on decode via safeReturnPath as defence in\n   * depth. Has no effect on desktop / mobile / add-account flows, which\n   * use their own deep-link / close-tab handling.\n   */\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Ephemeral in-memory state-signing key for development. Generated lazily\n * on first read so dev sessions don't depend on filesystem writability or\n * env-var configuration. Sessions reset on each restart, which is fine\n * for dev — no real users / production data are involved.\n */\nlet _devStateSigningKey: string | undefined;\n\n/**\n * Derive a server-only signing key for HMAC verification of OAuth state.\n *\n * Uses a dedicated secret — never an OAuth client secret. Reusing a\n * client_secret (which is shared with Google / GitHub / Atlassian) as our\n * own HMAC key conflates two trust domains: rotating the client secret\n * silently invalidates every in-flight OAuth state, and any leak of the\n * client secret also lets an attacker forge our state envelopes.\n *\n * Resolution order:\n *   1. OAUTH_STATE_SECRET (preferred — dedicated to this purpose)\n *   2. BETTER_AUTH_SECRET (already used by Better Auth as a server secret)\n *   3. In dev only, an ephemeral random key (per-process)\n *\n * In production, throws if neither secret is set.\n */\nfunction getStateSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET || process.env.BETTER_AUTH_SECRET;\n  if (secret) return secret;\n\n  const isProd = process.env.NODE_ENV === \"production\";\n  if (isProd) {\n    throw new Error(\n      \"OAuth state signing requires a server secret. \" +\n        \"Set OAUTH_STATE_SECRET or BETTER_AUTH_SECRET in production.\",\n    );\n  }\n\n  if (!_devStateSigningKey) {\n    _devStateSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devStateSigningKey;\n}\n\n/**\n * Options for the named-argument form of {@link encodeOAuthState}.\n * Prefer this form — the positional overload is easy to misuse (the mail\n * and calendar templates historically passed `flowId` in the `returnUrl`\n * slot, smuggling state into a defence-in-depth path).\n */\nexport interface EncodeOAuthStateOptions {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Encode OAuth state into a signed base64url string.\n * The state is HMAC-signed so the callback can verify it wasn't forged,\n * preventing CSRF attacks on the OAuth flow.\n *\n * Two call shapes are supported:\n *   - Recommended: pass an options object — clear, mismatch-proof.\n *     `encodeOAuthState({ redirectUri, owner, desktop, ... })`\n *   - Legacy positional form (kept working for backward compatibility):\n *     `encodeOAuthState(redirectUri, owner, desktop, addAccount, app, returnUrl, flowId)`.\n *     Callers should migrate to the options form — see the audit on\n *     templates/mail and templates/calendar where the positional shape\n *     led to `flowId` being smuggled in via the `returnUrl` slot.\n */\nexport function encodeOAuthState(opts: EncodeOAuthStateOptions): string;\nexport function encodeOAuthState(\n  redirectUri: string,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string;\nexport function encodeOAuthState(\n  redirectUriOrOpts: string | EncodeOAuthStateOptions,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string {\n  const opts: EncodeOAuthStateOptions =\n    typeof redirectUriOrOpts === \"string\"\n      ? {\n          redirectUri: redirectUriOrOpts,\n          owner,\n          desktop,\n          addAccount,\n          app,\n          returnUrl,\n          flowId,\n        }\n      : redirectUriOrOpts;\n\n  const nonce = crypto.randomBytes(8).toString(\"hex\");\n  const payload: Record<string, string | boolean> = {\n    n: nonce,\n    r: opts.redirectUri,\n  };\n  if (opts.owner) payload.o = opts.owner;\n  if (opts.desktop) payload.d = true;\n  if (opts.addAccount) payload.a = true;\n  if (opts.app) payload.app = opts.app;\n  if (opts.returnUrl) payload.r2 = opts.returnUrl;\n  if (opts.flowId) payload.f = opts.flowId;\n  const data = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  const sig = crypto\n    .createHmac(\"sha256\", getStateSigningKey())\n    .update(data)\n    .digest(\"base64url\");\n  return `${data}.${sig}`;\n}\n\n/**\n * Decode and verify OAuth state from the callback's state query parameter.\n * Rejects forged or tampered state by checking the HMAC signature.\n * Falls back to the provided URI if decoding or verification fails.\n */\nexport function decodeOAuthState(\n  stateParam: string | undefined,\n  fallbackUri: string,\n): OAuthStatePayload {\n  if (stateParam) {\n    try {\n      const dotIdx = stateParam.lastIndexOf(\".\");\n      if (dotIdx === -1) return { redirectUri: fallbackUri };\n\n      const data = stateParam.slice(0, dotIdx);\n      const sig = stateParam.slice(dotIdx + 1);\n      const expected = crypto\n        .createHmac(\"sha256\", getStateSigningKey())\n        .update(data)\n        .digest(\"base64url\");\n\n      if (\n        sig.length !== expected.length ||\n        !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))\n      ) {\n        return { redirectUri: fallbackUri };\n      }\n\n      const parsed = JSON.parse(Buffer.from(data, \"base64url\").toString());\n      return {\n        redirectUri: parsed.r || fallbackUri,\n        owner: parsed.o || undefined,\n        desktop: !!parsed.d,\n        addAccount: !!parsed.a,\n        app: typeof parsed.app === \"string\" ? parsed.app : undefined,\n        // Pass returnUrl through as-is — same-origin validation runs at the\n        // consumer (oauthCallbackResponse → safeReturnPath). The state is\n        // HMAC-signed, but we still validate at consumption as defence in\n        // depth in case the signing key ever leaks.\n        returnUrl: typeof parsed.r2 === \"string\" ? parsed.r2 : undefined,\n        flowId: parsed.f || undefined,\n      };\n    } catch {}\n  }\n  return { redirectUri: fallbackUri };\n}\n\n// ─── Session Creation ────────────────────────────────────────────────────────\n\nexport interface OAuthOwnerResult {\n  owner: string | undefined;\n  hasProductionSession: boolean;\n}\n\n/**\n * Determine the token owner from the current session and OAuth state.\n * Call this BEFORE exchangeCode to get the owner parameter.\n */\nexport async function resolveOAuthOwner(\n  event: H3Event,\n  stateOwner?: string,\n): Promise<OAuthOwnerResult> {\n  const existingSession = await getSession(event);\n  const hasProductionSession = !!existingSession?.email;\n  const owner = hasProductionSession\n    ? existingSession!.email\n    : stateOwner || undefined;\n\n  return { owner, hasProductionSession };\n}\n\nexport interface OAuthSessionResult {\n  sessionToken: string | undefined;\n}\n\n/**\n * Create a session token after a successful OAuth exchange.\n *\n * Desktop and mobile apps have separate cookie jars from the system\n * browser, so they always get a fresh session token (even if the browser\n * already has one). The token is then passed via deep link so the native\n * app can inject it.\n */\nexport async function createOAuthSession(\n  event: H3Event,\n  email: string,\n  opts: {\n    hasProductionSession: boolean;\n    desktop?: boolean;\n  },\n): Promise<OAuthSessionResult> {\n  const mobile = isMobile(event);\n  const needsDeepLink = opts.desktop || mobile;\n  const maxAge = getSessionMaxAge();\n\n  let sessionToken: string | undefined;\n  if (!opts.hasProductionSession || needsDeepLink) {\n    sessionToken = crypto.randomBytes(32).toString(\"hex\");\n    await addSession(sessionToken, email);\n    setFrameworkSessionCookie(event, sessionToken);\n    // Desktop SSO: record this session in the home-dir broker file so\n    // sibling templates (each with its own database) can resolve the\n    // same token without a DB row of their own. Only the PRIMARY\n    // sign-in writes the broker — if a production session already\n    // exists, this is an add-account flow (connecting a secondary\n    // Google account for scraping) and must never switch the active\n    // user across sibling templates.\n    if (opts.desktop && !opts.hasProductionSession) {\n      await writeDesktopSso({\n        email,\n        token: sessionToken,\n        expiresAt: Date.now() + maxAge * 1000,\n      });\n    }\n  }\n\n  return { sessionToken };\n}\n\n// ─── Callback Responses ──────────────────────────────────────────────────────\n\n/**\n * Return the appropriate response after a successful OAuth callback.\n *\n * Handles mobile deep links, desktop deep links, add-account close-tab\n * pages, and plain web redirects — so templates don't have to.\n */\nexport function oauthCallbackResponse(\n  event: H3Event,\n  email: string,\n  opts: {\n    sessionToken?: string;\n    desktop?: boolean;\n    addAccount?: boolean;\n    /**\n     * Same-origin path to return the viewer to after a successful web\n     * sign-in. Validated via safeReturnPath; falls back to \"/\" for any\n     * shape that escapes same-origin. Has no effect on desktop / mobile\n     * / add-account flows — those use their own deep-link handling.\n     */\n    returnUrl?: string;\n    flowId?: string;\n    appName?: string;\n  },\n): Response | string | unknown | Promise<Response | string | unknown> {\n  const mobile = isMobile(event);\n  const query = getQuery(event);\n  const callbackState =\n    typeof query.state === \"string\" && query.state.length > 0\n      ? query.state\n      : undefined;\n\n  // Mobile: deep link back to native app\n  if (mobile) {\n    const deepLink = buildOAuthCompleteDeepLink(\n      opts.sessionToken,\n      callbackState,\n    );\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\"><title>Connected</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p>Connected! Returning to app…</p><script>window.location.href=${JSON.stringify(deepLink)};setTimeout(function(){window.location.href=\"/\"},1500)</script></body></html>`,\n    );\n  }\n\n  // Desktop add-account: close-tab page (must come before general desktop check\n  // to ensure no deep link fires and the existing session is never switched).\n  if (opts.desktop && opts.addAccount) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Electron desktop exchange flow: mail/calendar still pass a flow id so the\n  // renderer can poll as a fallback, but the main handoff should use the\n  // protocol deep link so the popup returns focus to the desktop app.\n  if (opts.desktop && opts.flowId && isElectron(event) && opts.sessionToken) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Desktop exchange flow (non-Electron tray app): the tray app polls the\n  // desktop-exchange endpoint for the token — no deep link needed.\n  if (opts.desktop && opts.flowId) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Signed in as ${safeEmail}!` : \"Signed in!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Desktop login: deep link back to Electron app — only when the callback\n  // request actually carries the AgentNativeDesktop UA marker. Without this\n  // check, any client whose OAuth state was minted with `desktop=true` (e.g.\n  // a stale link, or an upstream that wrongly set `?desktop=1`) would land\n  // on the `agentnative://` page where the deep link can't fire and the\n  // \"Open Agent Native\" button does nothing — surfaces inside Builder.io's\n  // Fusion webview hit this exact dead-end. Fall through to the web flow\n  // for non-Agent-Native-Desktop clients so they get a real redirect.\n  if (opts.desktop && isElectron(event)) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Add-account web flow: close-tab page. The email is rendered into the\n  // page via DOM `textContent` (safe), but we still JSON-stringify so a\n  // payload containing `</script>` can't break out of the script tag —\n  // and explicitly assert it's a string so a callbacks like `null` or\n  // an object won't end up serialised into the page.\n  if (opts.addAccount) {\n    const safeEmail = JSON.stringify(typeof email === \"string\" ? email : \"\");\n    return htmlResponse(`<!DOCTYPE html><html><body><script>\n        window.close();\n        var p = document.createElement('p');\n        p.style.cssText = 'font-family:system-ui;text-align:center;margin-top:40vh';\n        p.textContent = 'Connected ' + ${safeEmail} + '! You can close this tab.';\n        document.body.appendChild(p);\n      </script></body></html>`);\n  }\n\n  // Web: redirect to the requested return target. Path-only returns stay\n  // same-origin; Builder desktop workspace returns may point back to the\n  // local loopback gateway and carry the short-lived `_session` bridge so\n  // the local app can promote the newly created hosted OAuth session.\n  setResponseStatus(event, 302);\n  setResponseHeader(\n    event,\n    \"Location\",\n    appendSessionToOAuthReturnUrl(opts.returnUrl, opts.sessionToken),\n  );\n  setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n  return \"\";\n}\n\n/** HTML error page for OAuth failures. The message is HTML-escaped — most\n *  callers pass `error.message` from a token-exchange or userinfo failure,\n *  which can echo upstream provider strings (and historically attacker-\n *  controlled query params via the `error_description` field). */\nexport function oauthErrorPage(message: string): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connection failed</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;text-align:center\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ef4444\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M15 9l-6 6\"/><path d=\"M9 9l6 6\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0;color:#ddd\">${safe}</p><p style=\"font-size:13px;color:#888;margin:0\"><a href=\"/\" style=\"color:#888;text-decoration:underline;text-underline-offset:3px\">Back to login</a></p></body></html>`,\n    400,\n  );\n}\n\nexport function oauthDesktopExchangePage(\n  message = \"Returning to the app...\",\n): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Returning</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p style=\"font-size:14px\">${safe}</p><script>window.close()</script></body></html>`,\n  );\n}\n\n// ─── Internal ────────────────────────────────────────────────────────────────\n\nfunction resolveOAuthAppName(explicit?: string): string {\n  const raw = explicit || getAppName() || \"Agent Native\";\n  if (!/^[a-z0-9_-]+$/.test(raw)) return raw;\n  return raw\n    .split(/[-_]+/)\n    .filter(Boolean)\n    .map((word) => word[0].toUpperCase() + word.slice(1))\n    .join(\" \");\n}\n\nfunction buildOAuthCompleteDeepLink(\n  sessionToken?: string,\n  state?: string,\n): string {\n  const params = new URLSearchParams();\n  if (sessionToken) params.set(\"token\", sessionToken);\n  if (state) params.set(\"state\", state);\n  const suffix = params.toString();\n  return suffix\n    ? `agentnative://oauth-complete?${suffix}`\n    : \"agentnative://oauth-complete\";\n}\n\nfunction desktopSuccessPage(\n  _event: H3Event,\n  email?: string,\n  sessionToken?: string,\n  state?: string,\n): Response {\n  const safeEmail = email ? escapeHtml(email) : \"\";\n  const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n  if (sessionToken) {\n    const deepLink = buildOAuthCompleteDeepLink(sessionToken, state);\n    const deepLinkJson = JSON.stringify(deepLink);\n    // Defence in depth: if this page somehow gets served to a UA that isn't\n    // the Agent Native desktop app (server gate bypassed, stale link, etc.),\n    // skip the `agentnative://` deep link entirely and bounce to the app\n    // root. The deep link silently fails outside the desktop app and the\n    // \"Open Agent Native\" button is a dead end in a generic browser/webview.\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title><style>@keyframes spin{to{transform:rotate(360deg)}}@keyframes fadeIn{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}.spinner{width:28px;height:28px;border:2px solid #333;border-top-color:#fff;border-radius:50%;animation:spin .8s linear infinite}.fallback{display:none;flex-direction:column;align-items:center;gap:8px;animation:fadeIn .2s ease-out}.fallback.show{display:flex}</style></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:16px\"><p style=\"font-size:16px;margin:0\">${msg}</p><div id=\"loading\" class=\"spinner\"></div><div id=\"fallback\" class=\"fallback\"><a href=${deepLinkJson} style=\"display:inline-block;padding:10px 24px;background:#fff;color:#000;border-radius:8px;text-decoration:none;font-size:14px;font-weight:500\">Open Agent Native</a><p style=\"font-size:12px;color:#666;margin:0\">If the app didn\\u2019t open automatically, click the button above.</p></div><script>(function(){var ua=(navigator.userAgent||\"\");if(ua.indexOf(\"AgentNativeDesktop\")===-1){window.location.replace(\"/\");return}window.location.href=${deepLinkJson};setTimeout(function(){document.getElementById(\"loading\").style.display=\"none\";document.getElementById(\"fallback\").classList.add(\"show\")},3000)})()</script></body></html>`,\n    );\n  }\n  return htmlResponse(\n    oauthSuccessCloseTabHtml(\n      msg,\n      \"You can close this tab and return to Agent Native.\",\n    ),\n  );\n}\n"]}

package/dist/server/oauth-return-url.d.ts

@@ -1,6 +1,7 @@
 export declare function getWorkspaceGatewayReturnOrigin(): string;
 export declare function safeOAuthReturnUrl(raw: string | null | undefined, opts?: {
     allowDefaultLoopback?: boolean;
+    allowedOrigins?: Iterable<string | undefined>;
 }): string;
 export declare function appendSessionToOAuthReturnUrl(raw: string | null | undefined, sessionToken: string | undefined): string;
 //# sourceMappingURL=oauth-return-url.d.ts.map

package/dist/server/oauth-return-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-return-url.d.ts","sourceRoot":"","sources":["../../src/server/oauth-return-url.ts"],"names":[],"mappings":"AAuBA,wBAAgB,+BAA+B,IAAI,MAAM,CASxD;AAUD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,IAAI,GAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC5C,MAAM,CAkBR;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAWR"}
+{"version":3,"file":"oauth-return-url.d.ts","sourceRoot":"","sources":["../../src/server/oauth-return-url.ts"],"names":[],"mappings":"AA2CA,wBAAgB,+BAA+B,IAAI,MAAM,CASxD;AAUD,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,IAAI,GAAE;IACJ,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C,GACL,MAAM,CAsBR;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,MAAM,CAwBR"}

package/dist/server/oauth-return-url.js

@@ -20,6 +20,24 @@ function isLoopbackOrigin(origin) {
         return false;
     }
 }
+function isBuilderPreviewOrigin(origin) {
+    try {
+        const url = new URL(origin);
+        const hostname = url.hostname.toLowerCase();
+        return (url.protocol === "https:" &&
+            (hostname === "builderio.xyz" ||
+                hostname.endsWith(".builderio.xyz") ||
+                hostname === "builderio.dev" ||
+                hostname.endsWith(".builderio.dev") ||
+                hostname === "builder.codes" ||
+                hostname.endsWith(".builder.codes") ||
+                hostname === "builder.my" ||
+                hostname.endsWith(".builder.my")));
+    }
+    catch {
+        return false;
+    }
+}
 export function getWorkspaceGatewayReturnOrigin() {
     for (const raw of [
         process.env.WORKSPACE_GATEWAY_URL,
@@ -51,6 +69,11 @@ export function safeOAuthReturnUrl(raw, opts = {}) {
             return parsed.pathname + parsed.search + parsed.hash;
         }
         const allowedOrigins = allowedOAuthReturnOrigins(opts.allowDefaultLoopback === true);
+        for (const origin of opts.allowedOrigins ?? []) {
+            const normalized = normalizeOrigin(origin);
+            if (normalized)
+                allowedOrigins.add(normalized);
+        }
         if (allowedOrigins.has(parsed.origin)) {
             return parsed.toString();
         }
@@ -61,13 +84,24 @@ export function safeOAuthReturnUrl(raw, opts = {}) {
     return "/";
 }
 export function appendSessionToOAuthReturnUrl(raw, sessionToken) {
-    const safe = safeOAuthReturnUrl(raw, { allowDefaultLoopback: true });
+    let safe = safeOAuthReturnUrl(raw, { allowDefaultLoopback: true });
+    if (safe === "/" && raw && !/[\x00-\x1f]/.test(raw)) {
+        try {
+            const parsed = new URL(raw);
+            if (isBuilderPreviewOrigin(parsed.origin)) {
+                safe = parsed.toString();
+            }
+        }
+        catch { }
+    }
     if (!sessionToken)
         return safe;
     try {
         const parsed = new URL(safe);
-        if (!allowedOAuthReturnOrigins(true).has(parsed.origin))
+        if (!allowedOAuthReturnOrigins(true).has(parsed.origin) &&
+            !isBuilderPreviewOrigin(parsed.origin)) {
             return safe;
+        }
         parsed.searchParams.set("_session", sessionToken);
         return parsed.toString();
     }

package/dist/server/oauth-return-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-return-url.js","sourceRoot":"","sources":["../../src/server/oauth-return-url.ts"],"names":[],"mappings":"AAAA,SAAS,eAAe,CAAC,GAAuB;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC1C,OAAO,CACL,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,KAAK;YAClB,QAAQ,KAAK,OAAO,CACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,KAAK,MAAM,GAAG,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,0BAA0B;KACvC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,yBAAyB,CAAC,oBAA6B;IAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,UAAU,GAAG,+BAA+B,EAAE,CAAC;IACrD,IAAI,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,oBAAoB;QAAE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAA8B,EAC9B,OAA2C,EAAE;IAE7C,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QACvD,CAAC;QACD,MAAM,cAAc,GAAG,yBAAyB,CAC9C,IAAI,CAAC,oBAAoB,KAAK,IAAI,CACnC,CAAC;QACF,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAA8B,EAC9B,YAAgC;IAEhC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["function normalizeOrigin(raw: string | undefined): string {\n  if (!raw) return \"\";\n  try {\n    return new URL(raw).origin;\n  } catch {\n    return \"\";\n  }\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    const hostname = new URL(origin).hostname;\n    return (\n      hostname === \"localhost\" ||\n      hostname === \"127.0.0.1\" ||\n      hostname === \"::1\" ||\n      hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function getWorkspaceGatewayReturnOrigin(): string {\n  for (const raw of [\n    process.env.WORKSPACE_GATEWAY_URL,\n    process.env.VITE_WORKSPACE_GATEWAY_URL,\n  ]) {\n    const origin = normalizeOrigin(raw);\n    if (origin && isLoopbackOrigin(origin)) return origin;\n  }\n  return \"\";\n}\n\nfunction allowedOAuthReturnOrigins(allowDefaultLoopback: boolean): Set<string> {\n  const out = new Set<string>();\n  const configured = getWorkspaceGatewayReturnOrigin();\n  if (configured) out.add(configured);\n  if (allowDefaultLoopback) out.add(\"http://127.0.0.1:8080\");\n  return out;\n}\n\nexport function safeOAuthReturnUrl(\n  raw: string | null | undefined,\n  opts: { allowDefaultLoopback?: boolean } = {},\n): string {\n  if (!raw) return \"/\";\n  if (/[\\x00-\\x1f]/.test(raw)) return \"/\";\n  try {\n    const parsed = new URL(raw, \"http://safe-base.invalid\");\n    if (parsed.origin === \"http://safe-base.invalid\") {\n      return parsed.pathname + parsed.search + parsed.hash;\n    }\n    const allowedOrigins = allowedOAuthReturnOrigins(\n      opts.allowDefaultLoopback === true,\n    );\n    if (allowedOrigins.has(parsed.origin)) {\n      return parsed.toString();\n    }\n  } catch {\n    return \"/\";\n  }\n  return \"/\";\n}\n\nexport function appendSessionToOAuthReturnUrl(\n  raw: string | null | undefined,\n  sessionToken: string | undefined,\n): string {\n  const safe = safeOAuthReturnUrl(raw, { allowDefaultLoopback: true });\n  if (!sessionToken) return safe;\n  try {\n    const parsed = new URL(safe);\n    if (!allowedOAuthReturnOrigins(true).has(parsed.origin)) return safe;\n    parsed.searchParams.set(\"_session\", sessionToken);\n    return parsed.toString();\n  } catch {\n    return safe;\n  }\n}\n"]}
+{"version":3,"file":"oauth-return-url.js","sourceRoot":"","sources":["../../src/server/oauth-return-url.ts"],"names":[],"mappings":"AAAA,SAAS,eAAe,CAAC,GAAuB;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC1C,OAAO,CACL,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,KAAK;YAClB,QAAQ,KAAK,OAAO,CACrB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAc;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,QAAQ,KAAK,eAAe;gBAC3B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,KAAK,eAAe;gBAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,KAAK,eAAe;gBAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;gBACnC,QAAQ,KAAK,YAAY;gBACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,KAAK,MAAM,GAAG,IAAI;QAChB,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,0BAA0B;KACvC,EAAE,CAAC;QACF,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,yBAAyB,CAAC,oBAA6B;IAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,UAAU,GAAG,+BAA+B,EAAE,CAAC;IACrD,IAAI,UAAU;QAAE,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,oBAAoB;QAAE,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC3D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAA8B,EAC9B,OAGI,EAAE;IAEN,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,KAAK,0BAA0B,EAAE,CAAC;YACjD,OAAO,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QACvD,CAAC;QACD,MAAM,cAAc,GAAG,yBAAyB,CAC9C,IAAI,CAAC,oBAAoB,KAAK,IAAI,CACnC,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;YAC/C,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,UAAU;gBAAE,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,GAA8B,EAC9B,YAAgC;IAEhC,IAAI,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,IAAI,IAAI,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1C,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IACE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;YACnD,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EACtC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["function normalizeOrigin(raw: string | undefined): string {\n  if (!raw) return \"\";\n  try {\n    return new URL(raw).origin;\n  } catch {\n    return \"\";\n  }\n}\n\nfunction isLoopbackOrigin(origin: string): boolean {\n  try {\n    const hostname = new URL(origin).hostname;\n    return (\n      hostname === \"localhost\" ||\n      hostname === \"127.0.0.1\" ||\n      hostname === \"::1\" ||\n      hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isBuilderPreviewOrigin(origin: string): boolean {\n  try {\n    const url = new URL(origin);\n    const hostname = url.hostname.toLowerCase();\n    return (\n      url.protocol === \"https:\" &&\n      (hostname === \"builderio.xyz\" ||\n        hostname.endsWith(\".builderio.xyz\") ||\n        hostname === \"builderio.dev\" ||\n        hostname.endsWith(\".builderio.dev\") ||\n        hostname === \"builder.codes\" ||\n        hostname.endsWith(\".builder.codes\") ||\n        hostname === \"builder.my\" ||\n        hostname.endsWith(\".builder.my\"))\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function getWorkspaceGatewayReturnOrigin(): string {\n  for (const raw of [\n    process.env.WORKSPACE_GATEWAY_URL,\n    process.env.VITE_WORKSPACE_GATEWAY_URL,\n  ]) {\n    const origin = normalizeOrigin(raw);\n    if (origin && isLoopbackOrigin(origin)) return origin;\n  }\n  return \"\";\n}\n\nfunction allowedOAuthReturnOrigins(allowDefaultLoopback: boolean): Set<string> {\n  const out = new Set<string>();\n  const configured = getWorkspaceGatewayReturnOrigin();\n  if (configured) out.add(configured);\n  if (allowDefaultLoopback) out.add(\"http://127.0.0.1:8080\");\n  return out;\n}\n\nexport function safeOAuthReturnUrl(\n  raw: string | null | undefined,\n  opts: {\n    allowDefaultLoopback?: boolean;\n    allowedOrigins?: Iterable<string | undefined>;\n  } = {},\n): string {\n  if (!raw) return \"/\";\n  if (/[\\x00-\\x1f]/.test(raw)) return \"/\";\n  try {\n    const parsed = new URL(raw, \"http://safe-base.invalid\");\n    if (parsed.origin === \"http://safe-base.invalid\") {\n      return parsed.pathname + parsed.search + parsed.hash;\n    }\n    const allowedOrigins = allowedOAuthReturnOrigins(\n      opts.allowDefaultLoopback === true,\n    );\n    for (const origin of opts.allowedOrigins ?? []) {\n      const normalized = normalizeOrigin(origin);\n      if (normalized) allowedOrigins.add(normalized);\n    }\n    if (allowedOrigins.has(parsed.origin)) {\n      return parsed.toString();\n    }\n  } catch {\n    return \"/\";\n  }\n  return \"/\";\n}\n\nexport function appendSessionToOAuthReturnUrl(\n  raw: string | null | undefined,\n  sessionToken: string | undefined,\n): string {\n  let safe = safeOAuthReturnUrl(raw, { allowDefaultLoopback: true });\n  if (safe === \"/\" && raw && !/[\\x00-\\x1f]/.test(raw)) {\n    try {\n      const parsed = new URL(raw);\n      if (isBuilderPreviewOrigin(parsed.origin)) {\n        safe = parsed.toString();\n      }\n    } catch {}\n  }\n  if (!sessionToken) return safe;\n  try {\n    const parsed = new URL(safe);\n    if (\n      !allowedOAuthReturnOrigins(true).has(parsed.origin) &&\n      !isBuilderPreviewOrigin(parsed.origin)\n    ) {\n      return safe;\n    }\n    parsed.searchParams.set(\"_session\", sessionToken);\n    return parsed.toString();\n  } catch {\n    return safe;\n  }\n}\n"]}

package/dist/server/onboarding-html.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding-html.d.ts","sourceRoot":"","sources":["../../src/server/onboarding-html.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAmC/B,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,qBAA0B,GAAG,MAAM,CAqjD1E;AAED,kDAAkD;AAClD,eAAO,MAAM,eAAe,QAAsB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAwG7C"}
+{"version":3,"file":"onboarding-html.d.ts","sourceRoot":"","sources":["../../src/server/onboarding-html.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAmC/B,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,qBAA0B,GAAG,MAAM,CAqkD1E;AAED,kDAAkD;AAClD,eAAO,MAAM,eAAe,QAAsB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAwG7C"}

package/dist/server/onboarding-html.js

@@ -854,7 +854,23 @@ ${googleOnly
       var origin = __anIsBuilderPreview() ? __anConfiguredOAuthOrigin() : '';
       return origin ? origin + path : __anPath(path);
     }
+    function __anBuilderPreviewReturnOrigin() {
+      try {
+        var url = new URL(window.location.href);
+        var host = url.hostname.toLowerCase();
+        var isPreviewHost =
+          host === 'builderio.xyz' || host.slice(-14) === '.builderio.xyz' ||
+          host === 'builderio.dev' || host.slice(-14) === '.builderio.dev' ||
+          host === 'builder.codes' || host.slice(-14) === '.builder.codes' ||
+          host === 'builder.my' || host.slice(-11) === '.builder.my';
+        return url.protocol === 'https:' && isPreviewHost ? url.origin : '';
+      } catch(e) {
+        return '';
+      }
+    }
     function __anWorkspaceGatewayReturnOrigin() {
+      var previewOrigin = __anBuilderPreviewReturnOrigin();
+      if (previewOrigin) return previewOrigin;
       if (__AN_WORKSPACE_GATEWAY_RETURN_ORIGIN) return __AN_WORKSPACE_GATEWAY_RETURN_ORIGIN;
       return __anIsBuilderDesktop() ? 'http://127.0.0.1:8080' : '';
     }
@@ -904,7 +920,7 @@ ${googleOnly
       } catch(e) {}
       try {
         var ref = document.referrer || '';
-        return ref.indexOf('builder.io') !== -1 || ref.indexOf('builder.my') !== -1 || ref.indexOf('builderio.xyz') !== -1;
+        return ref.indexOf('builder.io') !== -1 || ref.indexOf('builder.my') !== -1 || ref.indexOf('builderio.xyz') !== -1 || ref.indexOf('builderio.dev') !== -1 || ref.indexOf('builder.codes') !== -1;
       } catch(e) {
         return false;
       }