@agent-native/core 0.22.2 → 0.22.4

package/dist/server/derived-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-secret.d.ts","sourceRoot":"","sources":["../../src/server/derived-secret.ts"],"names":[],"mappings":"AAWA,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,MAAM,CAKR;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,aAAa,GAAG,aAAa,GAAG,mBAAmB,GAC3D,MAAM,GAAG,SAAS,CAIpB"}

package/dist/server/derived-secret.js

@@ -0,0 +1,19 @@
+import crypto from "node:crypto";
+const DERIVED_SECRET_PREFIX = "agent-native:derived-secret:v1";
+function isWorkspaceRuntime() {
+    return (process.env.AGENT_NATIVE_WORKSPACE === "1" ||
+        process.env.VITE_AGENT_NATIVE_WORKSPACE === "1");
+}
+export function deriveServerSecret(rootSecret, purpose) {
+    return crypto
+        .createHmac("sha256", rootSecret)
+        .update(`${DERIVED_SECRET_PREFIX}:${purpose}`)
+        .digest("hex");
+}
+export function getWorkspaceA2ADerivedSecret(purpose) {
+    if (!isWorkspaceRuntime())
+        return undefined;
+    const rootSecret = process.env.A2A_SECRET?.trim();
+    return rootSecret ? deriveServerSecret(rootSecret, purpose) : undefined;
+}
+//# sourceMappingURL=derived-secret.js.map

package/dist/server/derived-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derived-secret.js","sourceRoot":"","sources":["../../src/server/derived-secret.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,qBAAqB,GAAG,gCAAgC,CAAC;AAE/D,SAAS,kBAAkB;IACzB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAChD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAkB,EAClB,OAAe;IAEf,OAAO,MAAM;SACV,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;SAChC,MAAM,CAAC,GAAG,qBAAqB,IAAI,OAAO,EAAE,CAAC;SAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,OAA4D;IAE5D,IAAI,CAAC,kBAAkB,EAAE;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,OAAO,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nconst DERIVED_SECRET_PREFIX = \"agent-native:derived-secret:v1\";\n\nfunction isWorkspaceRuntime(): boolean {\n  return (\n    process.env.AGENT_NATIVE_WORKSPACE === \"1\" ||\n    process.env.VITE_AGENT_NATIVE_WORKSPACE === \"1\"\n  );\n}\n\nexport function deriveServerSecret(\n  rootSecret: string,\n  purpose: string,\n): string {\n  return crypto\n    .createHmac(\"sha256\", rootSecret)\n    .update(`${DERIVED_SECRET_PREFIX}:${purpose}`)\n    .digest(\"hex\");\n}\n\nexport function getWorkspaceA2ADerivedSecret(\n  purpose: \"better-auth\" | \"oauth-state\" | \"short-lived-token\",\n): string | undefined {\n  if (!isWorkspaceRuntime()) return undefined;\n  const rootSecret = process.env.A2A_SECRET?.trim();\n  return rootSecret ? deriveServerSecret(rootSecret, purpose) : undefined;\n}\n"]}

package/dist/server/google-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAwDZ;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAkID;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgChD;AASD,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,MAAM,CAG5D;AAgED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,GACb,OAAO,CAqCT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,SAAmC,GAC7C,MAAM,GAAG,IAAI,CAMf;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA6CD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC;AACxE,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;AA0CV;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAqCnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,CAgGpE;AAED;;;kEAGkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAMxD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,SAA4B,GAClC,QAAQ,CAKV"}
+{"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAyDZ;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAkID;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgChD;AASD,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,MAAM,CAG5D;AAgED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,GACb,OAAO,CAqCT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,SAAmC,GAC7C,MAAM,GAAG,IAAI,CAMf;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgDD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC;AACxE,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;AA0CV;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAqCnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,CAgGpE;AAED;;;kEAGkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAMxD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,SAA4B,GAClC,QAAQ,CAKV"}

package/dist/server/google-oauth.js

@@ -10,6 +10,7 @@ import crypto from "node:crypto";
 import { getHeader, getQuery, setResponseStatus, setResponseHeader, } from "h3";
 import { addSession, getSession, getSessionMaxAge, setFrameworkSessionCookie, } from "./auth.js";
 import { getAppName } from "./app-name.js";
+import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { writeDesktopSso } from "./desktop-sso.js";
 import { appendSessionToOAuthReturnUrl } from "./oauth-return-url.js";
 // ─── Platform Detection ─────────────────────────────────────────────────────
@@ -395,18 +396,21 @@ let _devStateSigningKey;
  * Resolution order:
  *   1. OAUTH_STATE_SECRET (preferred — dedicated to this purpose)
  *   2. BETTER_AUTH_SECRET (already used by Better Auth as a server secret)
- *   3. In dev only, an ephemeral random key (per-process)
+ *   3. Hosted workspace deploys derive a per-purpose key from A2A_SECRET
+ *   4. In dev only, an ephemeral random key (per-process)
  *
- * In production, throws if neither secret is set.
+ * In production, throws if no usable server secret is set.
  */
 function getStateSigningKey() {
-    const secret = process.env.OAUTH_STATE_SECRET || process.env.BETTER_AUTH_SECRET;
+    const secret = process.env.OAUTH_STATE_SECRET ||
+        process.env.BETTER_AUTH_SECRET ||
+        getWorkspaceA2ADerivedSecret("oauth-state");
     if (secret)
         return secret;
     const isProd = process.env.NODE_ENV === "production";
     if (isProd) {
         throw new Error("OAuth state signing requires a server secret. " +
-            "Set OAUTH_STATE_SECRET or BETTER_AUTH_SECRET in production.");
+            "Set OAUTH_STATE_SECRET, BETTER_AUTH_SECRET, or A2A_SECRET in production workspace deploys.");
     }
     if (!_devStateSigningKey) {
         _devStateSigningKey = crypto.randomBytes(32).toString("hex");

package/dist/server/google-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,+EAA+E;AAE/E;;oDAEoD;AACpD,SAAS,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;gCAGgC;AAChC,SAAS,gBAAgB,CAAC,MAAe;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,KAAK,GAAG,WAAW;QACvB,CAAC,CAAC,sEAAsE,UAAU,CAAC,WAAW,CAAC,MAAM;QACrG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,4hBAA4hB,QAAQ,qDAAqD,QAAQ,OAAO,KAAK,iFAAiF,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,qFAAqF,CAAC;AACh0B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,+BAA+B,GAAG;IACtC,wBAAwB;IACxB,6BAA6B;IAC7B,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,KAAK;IACL,YAAY;CACJ,CAAC;AAEX,MAAM,iCAAiC,GAAG;IACxC,uBAAuB;IACvB,4BAA4B;CACpB,CAAC;AAEX,SAAS,eAAe,CAAC,GAAuB;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAgB,EAChB,GAAuB,EACvB,OAAmC;IAEnC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAuB,EACvB,OAAmC;IAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,MAAM,CAAC;YAAE,SAAS;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,+BAA+B,EAAE,CAAC;QAClD,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,iCAAiC,EAAE,CAAC;QACpD,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,CAAC,GAAG,4BAA4B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,+BAA+B,EAAE;QAC3E,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,OAAO,kBAAkB,CAAC,iCAAiC,EAAE;QAC3D,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,KAAK;YACzB,MAAM,CAAC,QAAQ,KAAK,OAAO,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CACL,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,UAAU,GACd,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,WAAW,GACf,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,uBAAuB,GAAG,oCAAoC,EAAE;QACpE,CAAC,CAAC,0BAA0B,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEd,IACE,uBAAuB;QACvB,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC,EAChE,CAAC;QACD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,4BAA4B,EAAE,CAAC;QAC7C,yEAAyE;QACzE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAClD,mEAAmE;YACnE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,kEAAkE;QAClE,+DAA+D;QAC/D,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc;IAC5B,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACpD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAI,KAAa,CAAC,GAAG,EAAE,QAAQ,CAAC;IACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAI,KAAa,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,CACL,WAAW,KAAK,GAAG,QAAQ,gBAAgB;QAC3C,WAAW,CAAC,UAAU,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,IAAY;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,IACE,oCAAoC,EAAE;QACtC,4BAA4B,CAAC,SAAS,CAAC,EACvC,CAAC;QACD,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,QAAQ,GAAG,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,KAAc;IAEd,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qCAAqC;IACrC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,eAAe,GACnB,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC;YACE,GAAG,QAAQ,iBAAiB;YAC5B,GAAG,CAAC,oCAAoC,EAAE;gBAC1C,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACrB,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,WAAW,GAAG,gCAAgC;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,0BAA0B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AAqBD;;;;;GAKG;AACH,IAAI,mBAAuC,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,SAAS,kBAAkB;IACzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gDAAgD;YAC9C,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AA0CD,MAAM,UAAU,gBAAgB,CAC9B,iBAAmD,EACnD,KAAc,EACd,OAAiB,EACjB,UAAoB,EACpB,GAAY,EACZ,SAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GACR,OAAO,iBAAiB,KAAK,QAAQ;QACnC,CAAC,CAAC;YACE,WAAW,EAAE,iBAAiB;YAC9B,KAAK;YACL,OAAO;YACP,UAAU;YACV,GAAG;YACH,SAAS;YACT,MAAM;SACP;QACH,CAAC,CAAC,iBAAiB,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAqC;QAChD,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,IAAI,CAAC,WAAW;KACpB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM;SACf,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;SAC1C,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA8B,EAC9B,WAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YAEvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM;iBACpB,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;iBAC1C,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvB,IACE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAC9B,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,WAAW;gBACpC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;gBAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC5D,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,4CAA4C;gBAC5C,SAAS,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;aAC9B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,UAAmB;IAEnB,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,oBAAoB,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,oBAAoB;QAChC,CAAC,CAAC,eAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC;IAE5B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAMD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,KAAa,EACb,IAGC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QAChD,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtC,yBAAyB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/C,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,gEAAgE;QAChE,iCAAiC;QACjC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,eAAe,CAAC;gBACpB,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAa,EACb,IAaC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,SAAS,CAAC;IAEhB,uCAAuC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,0BAA0B,CACzC,IAAI,CAAC,YAAY,EACjB,aAAa,CACd,CAAC;QACF,OAAO,YAAY,CACjB,sYAAsY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,+EAA+E,CAC9e,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACjE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;;;;yCAIiB,SAAS;;8BAEpB,CAAC,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,iBAAiB,CACf,KAAK,EACL,UAAU,EACV,6BAA6B,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CACjE,CAAC;IACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;kEAGkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,ilBAAilB,IAAI,0KAA0K,EAC/vB,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAO,GAAG,yBAAyB;IAEnC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,yPAAyP,IAAI,mDAAmD,CACjT,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,MAAM,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,IAAI,cAAc,CAAC;IACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3C,OAAO,GAAG;SACP,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CACjC,YAAqB,EACrB,KAAc;IAEd,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,MAAM;QACX,CAAC,CAAC,gCAAgC,MAAM,EAAE;QAC1C,CAAC,CAAC,8BAA8B,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAe,EACf,KAAc,EACd,YAAqB,EACrB,KAAc;IAEd,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,OAAO,YAAY,CACjB,isBAAisB,GAAG,2FAA2F,YAAY,2bAA2b,YAAY,4KAA4K,CAC/5C,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,oDAAoD,CACrD,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared Google OAuth utilities for all templates.\n *\n * Handles platform detection (desktop/mobile), state encoding,\n * session token creation, and deep-link responses — the logic\n * that was previously copy-pasted across every template's\n * google-auth.ts handler.\n */\n\nimport crypto from \"node:crypto\";\nimport {\n  getHeader,\n  getQuery,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport {\n  addSession,\n  getSession,\n  getSessionMaxAge,\n  setFrameworkSessionCookie,\n} from \"./auth.js\";\nimport { getAppName } from \"./app-name.js\";\nimport { writeDesktopSso } from \"./desktop-sso.js\";\nimport { appendSessionToOAuthReturnUrl } from \"./oauth-return-url.js\";\n\n// ─── Platform Detection ─────────────────────────────────────────────────────\n\n/** Return an HTML response with the correct Content-Type.\n *  Uses a web-standard Response to ensure the header survives\n *  Nitro dev mode's mock-node-response pipeline. */\nfunction htmlResponse(html: string, status = 200): Response {\n  return new Response(html, {\n    status,\n    headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n  });\n}\n\n/** Shared markup for OAuth success \"close this tab\" pages. Renders a green\n *  check icon above the message, with a little breathing room between the\n *  headline and secondary line. Used by every template that goes through the\n *  shared Google OAuth flow. */\nfunction oauthDebugFlowId(flowId?: string): string | undefined {\n  return flowId ? flowId.slice(-10) : undefined;\n}\n\nfunction oauthSuccessCloseTabHtml(\n  headline: string,\n  footnote: string,\n  debugFlowId?: string,\n): string {\n  const debug = debugFlowId\n    ? `<p style=\"font-size:11px;color:#555;margin:12px 0 0 0\">Debug flow: ${escapeHtml(debugFlowId)}</p>`\n    : \"\";\n  return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#22c55e\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M9 12l2 2l4 -4\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0\">${headline}</p><p style=\"font-size:13px;color:#888;margin:0\">${footnote}</p>${debug}<script>console.info(\"[agent-native][google-oauth] success page loaded\",{flow:${JSON.stringify(debugFlowId || null)}});setTimeout(function(){try{window.close()}catch(e){}},250)</script></body></html>`;\n}\n\n/**\n * HTML escape — minimal but covers the cases that matter when interpolating\n * user-controlled values into our OAuth callback HTML. Mirrors the helper in\n * email-template.ts; kept inline here to avoid a circular import.\n */\nfunction escapeHtml(s: string): string {\n  return String(s ?? \"\")\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * Detect requests from the Agent Native desktop app specifically.\n *\n * The desktop app appends `AgentNativeDesktop/<version>` to its user-agent\n * (see `packages/desktop-app/src/main/index.ts`). We check for that marker\n * rather than matching generic `Electron`, which would also match other\n * Electron-based webviews like Builder.io's Fusion, Slack desktop, Discord,\n * etc. Falsely treating those as \"the desktop app\" sends users to the\n * `agentnative://oauth-complete` deep-link success page after Google sign-in,\n * where the protocol handler can't fire and the \"Open Agent Native\" button\n * does nothing.\n *\n * Kept exported as `isElectron` for backwards compatibility with consumers.\n */\nexport function isElectron(event: H3Event): boolean {\n  return /AgentNativeDesktop/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/** Detect requests from a mobile browser (iOS/Android). */\nexport function isMobile(event: H3Event): boolean {\n  return /iPhone|iPad|iPod|Android/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/**\n * Build the static allowlist of origins we trust for `getOrigin`. Reads\n * deployment-known public URLs. Each entry is normalised to\n * `${proto}://${host}` (no path). Duplicates collapse, invalid entries are\n * dropped silently.\n */\nconst EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS = [\n  \"WORKSPACE_OAUTH_ORIGIN\",\n  \"VITE_WORKSPACE_OAUTH_ORIGIN\",\n  \"APP_URL\",\n  \"VITE_APP_URL\",\n  \"BETTER_AUTH_URL\",\n  \"VITE_BETTER_AUTH_URL\",\n  \"URL\",\n  \"DEPLOY_URL\",\n] as const;\n\nconst WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS = [\n  \"WORKSPACE_GATEWAY_URL\",\n  \"VITE_WORKSPACE_GATEWAY_URL\",\n] as const;\n\nfunction normalizeOrigin(raw: string | undefined): string | undefined {\n  if (!raw) return undefined;\n  try {\n    const u = new URL(raw);\n    return `${u.protocol}//${u.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction addNormalizedOrigin(\n  out: Set<string>,\n  raw: string | undefined,\n  options: { allowLoopback: boolean },\n): void {\n  const origin = normalizeOrigin(raw);\n  if (!origin) return;\n  if (!options.allowLoopback && isLoopbackOrigin(origin)) return;\n  out.add(origin);\n}\n\nfunction firstOriginFromEnv(\n  keys: readonly string[],\n  options: { allowLoopback: boolean },\n): string | undefined {\n  for (const key of keys) {\n    const origin = normalizeOrigin(process.env[key]);\n    if (!origin) continue;\n    if (!options.allowLoopback && isLoopbackOrigin(origin)) continue;\n    return origin;\n  }\n  return undefined;\n}\n\nfunction getConfiguredOriginAllowlist(): Set<string> {\n  const out = new Set<string>();\n  for (const key of EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS) {\n    addNormalizedOrigin(out, process.env[key], { allowLoopback: true });\n  }\n  for (const key of WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS) {\n    addNormalizedOrigin(out, process.env[key], { allowLoopback: false });\n  }\n  return out;\n}\n\nfunction firstConfiguredOrigin(): string | undefined {\n  return [...getConfiguredOriginAllowlist()][0];\n}\n\nfunction getWorkspaceCallbackOrigin(): string | undefined {\n  const publicAuthOrigin = firstOriginFromEnv(EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS, {\n    allowLoopback: true,\n  });\n  if (publicAuthOrigin) return publicAuthOrigin;\n\n  return firstOriginFromEnv(WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS, {\n    allowLoopback: false,\n  });\n}\n\nfunction isLoopbackHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    return (\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\" ||\n      parsed.hostname === \"::1\" ||\n      parsed.hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    return isLoopbackHost(new URL(origin).host);\n  } catch {\n    return false;\n  }\n}\n\nfunction isBuilderPreviewHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    const hostname = parsed.hostname.toLowerCase();\n    return (\n      hostname === \"builderio.xyz\" ||\n      hostname.endsWith(\".builderio.xyz\") ||\n      hostname === \"builderio.dev\" ||\n      hostname.endsWith(\".builderio.dev\") ||\n      hostname === \"builder.codes\" ||\n      hostname.endsWith(\".builder.codes\") ||\n      hostname === \"builder.io\" ||\n      hostname.endsWith(\".builder.io\") ||\n      hostname === \"builder.my\" ||\n      hostname.endsWith(\".builder.my\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Get the origin from forwarded headers or Host.\n *\n * Defends against Host-header injection: in production we require the resolved\n * origin to match `APP_URL` / `BETTER_AUTH_URL` / `WORKSPACE_GATEWAY_URL`,\n * falling back to those values when inbound headers are missing or don't match.\n * In dev we accept inbound `Host` so localhost / ngrok / preview hosts keep\n * working without configuration, except workspace OAuth requests from loopback\n * or Builder preview hosts use the configured gateway origin when one exists.\n * The protocol defaults to `https` in production (so a TLS-terminating proxy\n * that drops `x-forwarded-proto` doesn't downgrade us to plain HTTP).\n */\nexport function getOrigin(event: H3Event): string {\n  const headerHost =\n    getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const isProd = process.env.NODE_ENV === \"production\";\n  const headerProto =\n    getHeader(event, \"x-forwarded-proto\") || (isProd ? \"https\" : \"http\");\n  const workspaceCallbackOrigin = isWorkspaceOAuthCallbackRelayEnabled()\n    ? getWorkspaceCallbackOrigin()\n    : undefined;\n\n  if (\n    workspaceCallbackOrigin &&\n    (isLoopbackHost(headerHost) || isBuilderPreviewHost(headerHost))\n  ) {\n    return workspaceCallbackOrigin;\n  }\n\n  if (isProd) {\n    const allow = getConfiguredOriginAllowlist();\n    // If the deploy declares its public URL, prefer it over inbound headers.\n    if (allow.size > 0) {\n      const inbound = headerHost ? `${headerProto}://${headerHost}` : \"\";\n      if (inbound && allow.has(inbound)) return inbound;\n      // Inbound didn't match — fall back to the first configured origin.\n      return [...allow][0];\n    }\n    // No allowlist configured: still default to https, but accept the\n    // inbound Host (best we can do without a configured base URL).\n    return `${headerProto}://${headerHost ?? \"\"}`;\n  }\n\n  return `${headerProto}://${headerHost ?? \"localhost\"}`;\n}\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\n/** App mount prefix, if the template is served under APP_BASE_PATH. */\nexport function getAppBasePath(): string {\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n}\n\n/** Build an absolute same-origin URL that preserves APP_BASE_PATH. */\nexport function getAppUrl(event: H3Event, path = \"/\"): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${getOrigin(event)}${getAppBasePath()}${cleanPath}`;\n}\n\nfunction isWorkspaceOAuthCallbackRelayEnabled(): boolean {\n  return (\n    process.env.AGENT_NATIVE_WORKSPACE === \"1\" ||\n    process.env.VITE_AGENT_NATIVE_WORKSPACE === \"1\"\n  );\n}\n\nfunction isFrameworkOAuthCallbackPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/_agent-native/\") &&\n    (pathname.endsWith(\"/callback\") || pathname.includes(\"/callback/\"))\n  );\n}\n\nfunction getOriginalRequestPath(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return mountedPathname;\n  }\n\n  const urlPathname = (event as any).url?.pathname;\n  if (typeof urlPathname === \"string\" && urlPathname) return urlPathname;\n\n  const nodeUrl = event.node?.req?.url;\n  if (typeof nodeUrl === \"string\" && nodeUrl) {\n    const queryStart = nodeUrl.indexOf(\"?\");\n    return queryStart >= 0 ? nodeUrl.slice(0, queryStart) : nodeUrl;\n  }\n\n  const eventPath = (event as any).path;\n  if (typeof eventPath === \"string\" && eventPath) {\n    const queryStart = eventPath.indexOf(\"?\");\n    return queryStart >= 0 ? eventPath.slice(0, queryStart) : eventPath;\n  }\n\n  return \"/\";\n}\n\nfunction isRequestUnderAppBasePath(event: H3Event): boolean {\n  const basePath = getAppBasePath();\n  if (!basePath) return false;\n  const requestPath = getOriginalRequestPath(event);\n  return (\n    requestPath === `${basePath}/_agent-native` ||\n    requestPath.startsWith(`${basePath}/_agent-native/`)\n  );\n}\n\nfunction getDefaultOAuthRedirectUrl(event: H3Event, path: string): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  if (\n    isWorkspaceOAuthCallbackRelayEnabled() &&\n    isFrameworkOAuthCallbackPath(cleanPath)\n  ) {\n    return `${getOrigin(event)}${cleanPath}`;\n  }\n  const basePath = isRequestUnderAppBasePath(event) ? getAppBasePath() : \"\";\n  return `${getOrigin(event)}${basePath}${cleanPath}`;\n}\n\n// ─── redirect_uri Allowlist ──────────────────────────────────────────────────\n\n/**\n * Validate a user-supplied `redirect_uri` for OAuth flows.\n *\n * Defends against authorization-code interception (RFC 6819 §4.4.1.7):\n * even though the upstream provider (Google/Atlassian/Zoom) refuses\n * unregistered redirect URIs, prefix-style registrations and side\n * registrations on the same host let a malicious caller swap in an\n * attacker-controlled URI that the provider still accepts. We reject any\n * candidate that isn't on this server's own origin AND under the\n * framework's `/_agent-native/` namespace. Returns the validated URI on\n * success, or `undefined` on rejection — callers must treat `undefined`\n * as a 400.\n *\n * The intentional shape is exact-prefix:\n *   - Origin must equal `getOrigin(event)` — no Host-header injection\n *     reusing somebody else's registered redirect URI.\n *   - Path must start with `${appBasePath}/_agent-native/` so we never\n *     hand auth codes to a public marketing or open-redirect endpoint\n *     on the same registered host.\n *\n * For desktop / native flows that need ephemeral `http://127.0.0.1:<port>`\n * loopback URIs, callers should validate those at the template level\n * with a dedicated allowlist — this helper rejects them by design.\n */\nexport function isAllowedOAuthRedirectUri(\n  candidate: string,\n  event: H3Event,\n): boolean {\n  if (typeof candidate !== \"string\" || candidate.length === 0) return false;\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    return false;\n  }\n  // Must be same origin as our server.\n  const expectedOrigin = getOrigin(event);\n  let expectedUrl: URL;\n  try {\n    expectedUrl = new URL(expectedOrigin);\n  } catch {\n    return false;\n  }\n  if (url.protocol !== expectedUrl.protocol) return false;\n  if (url.host !== expectedUrl.host) return false;\n  // Must live under the framework's namespace. Workspace deploys can route\n  // root /_agent-native/* to Dispatch even when Dispatch itself is mounted at\n  // /dispatch, but app-prefixed requests should not be able to swap their\n  // callback to that root namespace.\n  const basePath = getAppBasePath();\n  const allowedPrefixes =\n    basePath && isRequestUnderAppBasePath(event)\n      ? [\n          `${basePath}/_agent-native/`,\n          ...(isWorkspaceOAuthCallbackRelayEnabled() &&\n          isFrameworkOAuthCallbackPath(url.pathname)\n            ? [\"/_agent-native/\"]\n            : []),\n        ]\n      : [\"/_agent-native/\"];\n  if (!allowedPrefixes.some((prefix) => url.pathname.startsWith(prefix))) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the `redirect_uri` for an outbound OAuth `auth-url` request.\n *\n * Reads `?redirect_uri=` from the query and validates it via\n * `isAllowedOAuthRedirectUri`. Returns:\n *   - the validated URI when supplied and allowed, OR\n *   - the framework default when no override was supplied, OR\n *   - `null` when an override was supplied but rejected — callers must\n *     respond with 400 in that case.\n *\n * Templates that need a non-default redirect path can pass it via\n * `defaultPath` (e.g. `\"/_agent-native/google/desktop-callback\"` for\n * desktop flows).\n */\nexport function resolveOAuthRedirectUri(\n  event: H3Event,\n  defaultPath = \"/_agent-native/google/callback\",\n): string | null {\n  const supplied = getQuery(event).redirect_uri;\n  if (typeof supplied === \"string\" && supplied.length > 0) {\n    return isAllowedOAuthRedirectUri(supplied, event) ? supplied : null;\n  }\n  return getDefaultOAuthRedirectUrl(event, defaultPath);\n}\n\n// ─── OAuth State ─────────────────────────────────────────────────────────────\n\nexport interface OAuthStatePayload {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  /**\n   * Same-origin path to redirect to after a successful web-flow sign-in.\n   * Threaded through the (HMAC-signed) state so it survives the round trip\n   * to Google. Validated again on decode via safeReturnPath as defence in\n   * depth. Has no effect on desktop / mobile / add-account flows, which\n   * use their own deep-link / close-tab handling.\n   */\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Ephemeral in-memory state-signing key for development. Generated lazily\n * on first read so dev sessions don't depend on filesystem writability or\n * env-var configuration. Sessions reset on each restart, which is fine\n * for dev — no real users / production data are involved.\n */\nlet _devStateSigningKey: string | undefined;\n\n/**\n * Derive a server-only signing key for HMAC verification of OAuth state.\n *\n * Uses a dedicated secret — never an OAuth client secret. Reusing a\n * client_secret (which is shared with Google / GitHub / Atlassian) as our\n * own HMAC key conflates two trust domains: rotating the client secret\n * silently invalidates every in-flight OAuth state, and any leak of the\n * client secret also lets an attacker forge our state envelopes.\n *\n * Resolution order:\n *   1. OAUTH_STATE_SECRET (preferred — dedicated to this purpose)\n *   2. BETTER_AUTH_SECRET (already used by Better Auth as a server secret)\n *   3. In dev only, an ephemeral random key (per-process)\n *\n * In production, throws if neither secret is set.\n */\nfunction getStateSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET || process.env.BETTER_AUTH_SECRET;\n  if (secret) return secret;\n\n  const isProd = process.env.NODE_ENV === \"production\";\n  if (isProd) {\n    throw new Error(\n      \"OAuth state signing requires a server secret. \" +\n        \"Set OAUTH_STATE_SECRET or BETTER_AUTH_SECRET in production.\",\n    );\n  }\n\n  if (!_devStateSigningKey) {\n    _devStateSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devStateSigningKey;\n}\n\n/**\n * Options for the named-argument form of {@link encodeOAuthState}.\n * Prefer this form — the positional overload is easy to misuse (the mail\n * and calendar templates historically passed `flowId` in the `returnUrl`\n * slot, smuggling state into a defence-in-depth path).\n */\nexport interface EncodeOAuthStateOptions {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Encode OAuth state into a signed base64url string.\n * The state is HMAC-signed so the callback can verify it wasn't forged,\n * preventing CSRF attacks on the OAuth flow.\n *\n * Two call shapes are supported:\n *   - Recommended: pass an options object — clear, mismatch-proof.\n *     `encodeOAuthState({ redirectUri, owner, desktop, ... })`\n *   - Legacy positional form (kept working for backward compatibility):\n *     `encodeOAuthState(redirectUri, owner, desktop, addAccount, app, returnUrl, flowId)`.\n *     Callers should migrate to the options form — see the audit on\n *     templates/mail and templates/calendar where the positional shape\n *     led to `flowId` being smuggled in via the `returnUrl` slot.\n */\nexport function encodeOAuthState(opts: EncodeOAuthStateOptions): string;\nexport function encodeOAuthState(\n  redirectUri: string,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string;\nexport function encodeOAuthState(\n  redirectUriOrOpts: string | EncodeOAuthStateOptions,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string {\n  const opts: EncodeOAuthStateOptions =\n    typeof redirectUriOrOpts === \"string\"\n      ? {\n          redirectUri: redirectUriOrOpts,\n          owner,\n          desktop,\n          addAccount,\n          app,\n          returnUrl,\n          flowId,\n        }\n      : redirectUriOrOpts;\n\n  const nonce = crypto.randomBytes(8).toString(\"hex\");\n  const payload: Record<string, string | boolean> = {\n    n: nonce,\n    r: opts.redirectUri,\n  };\n  if (opts.owner) payload.o = opts.owner;\n  if (opts.desktop) payload.d = true;\n  if (opts.addAccount) payload.a = true;\n  if (opts.app) payload.app = opts.app;\n  if (opts.returnUrl) payload.r2 = opts.returnUrl;\n  if (opts.flowId) payload.f = opts.flowId;\n  const data = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  const sig = crypto\n    .createHmac(\"sha256\", getStateSigningKey())\n    .update(data)\n    .digest(\"base64url\");\n  return `${data}.${sig}`;\n}\n\n/**\n * Decode and verify OAuth state from the callback's state query parameter.\n * Rejects forged or tampered state by checking the HMAC signature.\n * Falls back to the provided URI if decoding or verification fails.\n */\nexport function decodeOAuthState(\n  stateParam: string | undefined,\n  fallbackUri: string,\n): OAuthStatePayload {\n  if (stateParam) {\n    try {\n      const dotIdx = stateParam.lastIndexOf(\".\");\n      if (dotIdx === -1) return { redirectUri: fallbackUri };\n\n      const data = stateParam.slice(0, dotIdx);\n      const sig = stateParam.slice(dotIdx + 1);\n      const expected = crypto\n        .createHmac(\"sha256\", getStateSigningKey())\n        .update(data)\n        .digest(\"base64url\");\n\n      if (\n        sig.length !== expected.length ||\n        !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))\n      ) {\n        return { redirectUri: fallbackUri };\n      }\n\n      const parsed = JSON.parse(Buffer.from(data, \"base64url\").toString());\n      return {\n        redirectUri: parsed.r || fallbackUri,\n        owner: parsed.o || undefined,\n        desktop: !!parsed.d,\n        addAccount: !!parsed.a,\n        app: typeof parsed.app === \"string\" ? parsed.app : undefined,\n        // Pass returnUrl through as-is — same-origin validation runs at the\n        // consumer (oauthCallbackResponse → safeReturnPath). The state is\n        // HMAC-signed, but we still validate at consumption as defence in\n        // depth in case the signing key ever leaks.\n        returnUrl: typeof parsed.r2 === \"string\" ? parsed.r2 : undefined,\n        flowId: parsed.f || undefined,\n      };\n    } catch {}\n  }\n  return { redirectUri: fallbackUri };\n}\n\n// ─── Session Creation ────────────────────────────────────────────────────────\n\nexport interface OAuthOwnerResult {\n  owner: string | undefined;\n  hasProductionSession: boolean;\n}\n\n/**\n * Determine the token owner from the current session and OAuth state.\n * Call this BEFORE exchangeCode to get the owner parameter.\n */\nexport async function resolveOAuthOwner(\n  event: H3Event,\n  stateOwner?: string,\n): Promise<OAuthOwnerResult> {\n  const existingSession = await getSession(event);\n  const hasProductionSession = !!existingSession?.email;\n  const owner = hasProductionSession\n    ? existingSession!.email\n    : stateOwner || undefined;\n\n  return { owner, hasProductionSession };\n}\n\nexport interface OAuthSessionResult {\n  sessionToken: string | undefined;\n}\n\n/**\n * Create a session token after a successful OAuth exchange.\n *\n * Desktop and mobile apps have separate cookie jars from the system\n * browser, so they always get a fresh session token (even if the browser\n * already has one). The token is then passed via deep link so the native\n * app can inject it.\n */\nexport async function createOAuthSession(\n  event: H3Event,\n  email: string,\n  opts: {\n    hasProductionSession: boolean;\n    desktop?: boolean;\n  },\n): Promise<OAuthSessionResult> {\n  const mobile = isMobile(event);\n  const needsDeepLink = opts.desktop || mobile;\n  const maxAge = getSessionMaxAge();\n\n  let sessionToken: string | undefined;\n  if (!opts.hasProductionSession || needsDeepLink) {\n    sessionToken = crypto.randomBytes(32).toString(\"hex\");\n    await addSession(sessionToken, email);\n    setFrameworkSessionCookie(event, sessionToken);\n    // Desktop SSO: record this session in the home-dir broker file so\n    // sibling templates (each with its own database) can resolve the\n    // same token without a DB row of their own. Only the PRIMARY\n    // sign-in writes the broker — if a production session already\n    // exists, this is an add-account flow (connecting a secondary\n    // Google account for scraping) and must never switch the active\n    // user across sibling templates.\n    if (opts.desktop && !opts.hasProductionSession) {\n      await writeDesktopSso({\n        email,\n        token: sessionToken,\n        expiresAt: Date.now() + maxAge * 1000,\n      });\n    }\n  }\n\n  return { sessionToken };\n}\n\n// ─── Callback Responses ──────────────────────────────────────────────────────\n\n/**\n * Return the appropriate response after a successful OAuth callback.\n *\n * Handles mobile deep links, desktop deep links, add-account close-tab\n * pages, and plain web redirects — so templates don't have to.\n */\nexport function oauthCallbackResponse(\n  event: H3Event,\n  email: string,\n  opts: {\n    sessionToken?: string;\n    desktop?: boolean;\n    addAccount?: boolean;\n    /**\n     * Same-origin path to return the viewer to after a successful web\n     * sign-in. Validated via safeReturnPath; falls back to \"/\" for any\n     * shape that escapes same-origin. Has no effect on desktop / mobile\n     * / add-account flows — those use their own deep-link handling.\n     */\n    returnUrl?: string;\n    flowId?: string;\n    appName?: string;\n  },\n): Response | string | unknown | Promise<Response | string | unknown> {\n  const mobile = isMobile(event);\n  const query = getQuery(event);\n  const callbackState =\n    typeof query.state === \"string\" && query.state.length > 0\n      ? query.state\n      : undefined;\n\n  // Mobile: deep link back to native app\n  if (mobile) {\n    const deepLink = buildOAuthCompleteDeepLink(\n      opts.sessionToken,\n      callbackState,\n    );\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\"><title>Connected</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p>Connected! Returning to app…</p><script>window.location.href=${JSON.stringify(deepLink)};setTimeout(function(){window.location.href=\"/\"},1500)</script></body></html>`,\n    );\n  }\n\n  // Desktop add-account: close-tab page (must come before general desktop check\n  // to ensure no deep link fires and the existing session is never switched).\n  if (opts.desktop && opts.addAccount) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Electron desktop exchange flow: mail/calendar still pass a flow id so the\n  // renderer can poll as a fallback, but the main handoff should use the\n  // protocol deep link so the popup returns focus to the desktop app.\n  if (opts.desktop && opts.flowId && isElectron(event) && opts.sessionToken) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Desktop exchange flow (non-Electron tray app): the tray app polls the\n  // desktop-exchange endpoint for the token — no deep link needed.\n  if (opts.desktop && opts.flowId) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Signed in as ${safeEmail}!` : \"Signed in!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Desktop login: deep link back to Electron app — only when the callback\n  // request actually carries the AgentNativeDesktop UA marker. Without this\n  // check, any client whose OAuth state was minted with `desktop=true` (e.g.\n  // a stale link, or an upstream that wrongly set `?desktop=1`) would land\n  // on the `agentnative://` page where the deep link can't fire and the\n  // \"Open Agent Native\" button does nothing — surfaces inside Builder.io's\n  // Fusion webview hit this exact dead-end. Fall through to the web flow\n  // for non-Agent-Native-Desktop clients so they get a real redirect.\n  if (opts.desktop && isElectron(event)) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Add-account web flow: close-tab page. The email is rendered into the\n  // page via DOM `textContent` (safe), but we still JSON-stringify so a\n  // payload containing `</script>` can't break out of the script tag —\n  // and explicitly assert it's a string so a callbacks like `null` or\n  // an object won't end up serialised into the page.\n  if (opts.addAccount) {\n    const safeEmail = JSON.stringify(typeof email === \"string\" ? email : \"\");\n    return htmlResponse(`<!DOCTYPE html><html><body><script>\n        window.close();\n        var p = document.createElement('p');\n        p.style.cssText = 'font-family:system-ui;text-align:center;margin-top:40vh';\n        p.textContent = 'Connected ' + ${safeEmail} + '! You can close this tab.';\n        document.body.appendChild(p);\n      </script></body></html>`);\n  }\n\n  // Web: redirect to the requested return target. Path-only returns stay\n  // same-origin; Builder desktop workspace returns may point back to the\n  // local loopback gateway and carry the short-lived `_session` bridge so\n  // the local app can promote the newly created hosted OAuth session.\n  setResponseStatus(event, 302);\n  setResponseHeader(\n    event,\n    \"Location\",\n    appendSessionToOAuthReturnUrl(opts.returnUrl, opts.sessionToken),\n  );\n  setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n  return \"\";\n}\n\n/** HTML error page for OAuth failures. The message is HTML-escaped — most\n *  callers pass `error.message` from a token-exchange or userinfo failure,\n *  which can echo upstream provider strings (and historically attacker-\n *  controlled query params via the `error_description` field). */\nexport function oauthErrorPage(message: string): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connection failed</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;text-align:center\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ef4444\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M15 9l-6 6\"/><path d=\"M9 9l6 6\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0;color:#ddd\">${safe}</p><p style=\"font-size:13px;color:#888;margin:0\"><a href=\"/\" style=\"color:#888;text-decoration:underline;text-underline-offset:3px\">Back to login</a></p></body></html>`,\n    400,\n  );\n}\n\nexport function oauthDesktopExchangePage(\n  message = \"Returning to the app...\",\n): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Returning</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p style=\"font-size:14px\">${safe}</p><script>window.close()</script></body></html>`,\n  );\n}\n\n// ─── Internal ────────────────────────────────────────────────────────────────\n\nfunction resolveOAuthAppName(explicit?: string): string {\n  const raw = explicit || getAppName() || \"Agent Native\";\n  if (!/^[a-z0-9_-]+$/.test(raw)) return raw;\n  return raw\n    .split(/[-_]+/)\n    .filter(Boolean)\n    .map((word) => word[0].toUpperCase() + word.slice(1))\n    .join(\" \");\n}\n\nfunction buildOAuthCompleteDeepLink(\n  sessionToken?: string,\n  state?: string,\n): string {\n  const params = new URLSearchParams();\n  if (sessionToken) params.set(\"token\", sessionToken);\n  if (state) params.set(\"state\", state);\n  const suffix = params.toString();\n  return suffix\n    ? `agentnative://oauth-complete?${suffix}`\n    : \"agentnative://oauth-complete\";\n}\n\nfunction desktopSuccessPage(\n  _event: H3Event,\n  email?: string,\n  sessionToken?: string,\n  state?: string,\n): Response {\n  const safeEmail = email ? escapeHtml(email) : \"\";\n  const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n  if (sessionToken) {\n    const deepLink = buildOAuthCompleteDeepLink(sessionToken, state);\n    const deepLinkJson = JSON.stringify(deepLink);\n    // Defence in depth: if this page somehow gets served to a UA that isn't\n    // the Agent Native desktop app (server gate bypassed, stale link, etc.),\n    // skip the `agentnative://` deep link entirely and bounce to the app\n    // root. The deep link silently fails outside the desktop app and the\n    // \"Open Agent Native\" button is a dead end in a generic browser/webview.\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title><style>@keyframes spin{to{transform:rotate(360deg)}}@keyframes fadeIn{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}.spinner{width:28px;height:28px;border:2px solid #333;border-top-color:#fff;border-radius:50%;animation:spin .8s linear infinite}.fallback{display:none;flex-direction:column;align-items:center;gap:8px;animation:fadeIn .2s ease-out}.fallback.show{display:flex}</style></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:16px\"><p style=\"font-size:16px;margin:0\">${msg}</p><div id=\"loading\" class=\"spinner\"></div><div id=\"fallback\" class=\"fallback\"><a href=${deepLinkJson} style=\"display:inline-block;padding:10px 24px;background:#fff;color:#000;border-radius:8px;text-decoration:none;font-size:14px;font-weight:500\">Open Agent Native</a><p style=\"font-size:12px;color:#666;margin:0\">If the app didn\\u2019t open automatically, click the button above.</p></div><script>(function(){var ua=(navigator.userAgent||\"\");if(ua.indexOf(\"AgentNativeDesktop\")===-1){window.location.replace(\"/\");return}window.location.href=${deepLinkJson};setTimeout(function(){document.getElementById(\"loading\").style.display=\"none\";document.getElementById(\"fallback\").classList.add(\"show\")},3000)})()</script></body></html>`,\n    );\n  }\n  return htmlResponse(\n    oauthSuccessCloseTabHtml(\n      msg,\n      \"You can close this tab and return to Agent Native.\",\n    ),\n  );\n}\n"]}
+{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,+EAA+E;AAE/E;;oDAEoD;AACpD,SAAS,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;gCAGgC;AAChC,SAAS,gBAAgB,CAAC,MAAe;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,KAAK,GAAG,WAAW;QACvB,CAAC,CAAC,sEAAsE,UAAU,CAAC,WAAW,CAAC,MAAM;QACrG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,4hBAA4hB,QAAQ,qDAAqD,QAAQ,OAAO,KAAK,iFAAiF,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,qFAAqF,CAAC;AACh0B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,+BAA+B,GAAG;IACtC,wBAAwB;IACxB,6BAA6B;IAC7B,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,KAAK;IACL,YAAY;CACJ,CAAC;AAEX,MAAM,iCAAiC,GAAG;IACxC,uBAAuB;IACvB,4BAA4B;CACpB,CAAC;AAEX,SAAS,eAAe,CAAC,GAAuB;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAgB,EAChB,GAAuB,EACvB,OAAmC;IAEnC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAuB,EACvB,OAAmC;IAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,MAAM,CAAC;YAAE,SAAS;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,+BAA+B,EAAE,CAAC;QAClD,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,iCAAiC,EAAE,CAAC;QACpD,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,CAAC,GAAG,4BAA4B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,+BAA+B,EAAE;QAC3E,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,OAAO,kBAAkB,CAAC,iCAAiC,EAAE;QAC3D,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,KAAK;YACzB,MAAM,CAAC,QAAQ,KAAK,OAAO,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CACL,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,UAAU,GACd,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,WAAW,GACf,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,uBAAuB,GAAG,oCAAoC,EAAE;QACpE,CAAC,CAAC,0BAA0B,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEd,IACE,uBAAuB;QACvB,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC,EAChE,CAAC;QACD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,4BAA4B,EAAE,CAAC;QAC7C,yEAAyE;QACzE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAClD,mEAAmE;YACnE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,kEAAkE;QAClE,+DAA+D;QAC/D,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc;IAC5B,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACpD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAI,KAAa,CAAC,GAAG,EAAE,QAAQ,CAAC;IACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAI,KAAa,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,CACL,WAAW,KAAK,GAAG,QAAQ,gBAAgB;QAC3C,WAAW,CAAC,UAAU,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,IAAY;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,IACE,oCAAoC,EAAE;QACtC,4BAA4B,CAAC,SAAS,CAAC,EACvC,CAAC;QACD,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,QAAQ,GAAG,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,KAAc;IAEd,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qCAAqC;IACrC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,eAAe,GACnB,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC;YACE,GAAG,QAAQ,iBAAiB;YAC5B,GAAG,CAAC,oCAAoC,EAAE;gBAC1C,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACrB,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,WAAW,GAAG,gCAAgC;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,0BAA0B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AAqBD;;;;;GAKG;AACH,IAAI,mBAAuC,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,kBAAkB;IACzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gDAAgD;YAC9C,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AA0CD,MAAM,UAAU,gBAAgB,CAC9B,iBAAmD,EACnD,KAAc,EACd,OAAiB,EACjB,UAAoB,EACpB,GAAY,EACZ,SAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GACR,OAAO,iBAAiB,KAAK,QAAQ;QACnC,CAAC,CAAC;YACE,WAAW,EAAE,iBAAiB;YAC9B,KAAK;YACL,OAAO;YACP,UAAU;YACV,GAAG;YACH,SAAS;YACT,MAAM;SACP;QACH,CAAC,CAAC,iBAAiB,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAqC;QAChD,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,IAAI,CAAC,WAAW;KACpB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM;SACf,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;SAC1C,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA8B,EAC9B,WAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YAEvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM;iBACpB,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;iBAC1C,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvB,IACE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAC9B,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,WAAW;gBACpC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;gBAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC5D,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,4CAA4C;gBAC5C,SAAS,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;aAC9B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,UAAmB;IAEnB,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,oBAAoB,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,oBAAoB;QAChC,CAAC,CAAC,eAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC;IAE5B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAMD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,KAAa,EACb,IAGC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QAChD,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtC,yBAAyB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/C,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,gEAAgE;QAChE,iCAAiC;QACjC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,eAAe,CAAC;gBACpB,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAa,EACb,IAaC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,SAAS,CAAC;IAEhB,uCAAuC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,0BAA0B,CACzC,IAAI,CAAC,YAAY,EACjB,aAAa,CACd,CAAC;QACF,OAAO,YAAY,CACjB,sYAAsY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,+EAA+E,CAC9e,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACjE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;;;;yCAIiB,SAAS;;8BAEpB,CAAC,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,iBAAiB,CACf,KAAK,EACL,UAAU,EACV,6BAA6B,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CACjE,CAAC;IACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;kEAGkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,ilBAAilB,IAAI,0KAA0K,EAC/vB,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAO,GAAG,yBAAyB;IAEnC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,yPAAyP,IAAI,mDAAmD,CACjT,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,MAAM,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,IAAI,cAAc,CAAC;IACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3C,OAAO,GAAG;SACP,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CACjC,YAAqB,EACrB,KAAc;IAEd,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,MAAM;QACX,CAAC,CAAC,gCAAgC,MAAM,EAAE;QAC1C,CAAC,CAAC,8BAA8B,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAe,EACf,KAAc,EACd,YAAqB,EACrB,KAAc;IAEd,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,OAAO,YAAY,CACjB,isBAAisB,GAAG,2FAA2F,YAAY,2bAA2b,YAAY,4KAA4K,CAC/5C,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,oDAAoD,CACrD,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared Google OAuth utilities for all templates.\n *\n * Handles platform detection (desktop/mobile), state encoding,\n * session token creation, and deep-link responses — the logic\n * that was previously copy-pasted across every template's\n * google-auth.ts handler.\n */\n\nimport crypto from \"node:crypto\";\nimport {\n  getHeader,\n  getQuery,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport {\n  addSession,\n  getSession,\n  getSessionMaxAge,\n  setFrameworkSessionCookie,\n} from \"./auth.js\";\nimport { getAppName } from \"./app-name.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\nimport { writeDesktopSso } from \"./desktop-sso.js\";\nimport { appendSessionToOAuthReturnUrl } from \"./oauth-return-url.js\";\n\n// ─── Platform Detection ─────────────────────────────────────────────────────\n\n/** Return an HTML response with the correct Content-Type.\n *  Uses a web-standard Response to ensure the header survives\n *  Nitro dev mode's mock-node-response pipeline. */\nfunction htmlResponse(html: string, status = 200): Response {\n  return new Response(html, {\n    status,\n    headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n  });\n}\n\n/** Shared markup for OAuth success \"close this tab\" pages. Renders a green\n *  check icon above the message, with a little breathing room between the\n *  headline and secondary line. Used by every template that goes through the\n *  shared Google OAuth flow. */\nfunction oauthDebugFlowId(flowId?: string): string | undefined {\n  return flowId ? flowId.slice(-10) : undefined;\n}\n\nfunction oauthSuccessCloseTabHtml(\n  headline: string,\n  footnote: string,\n  debugFlowId?: string,\n): string {\n  const debug = debugFlowId\n    ? `<p style=\"font-size:11px;color:#555;margin:12px 0 0 0\">Debug flow: ${escapeHtml(debugFlowId)}</p>`\n    : \"\";\n  return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#22c55e\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M9 12l2 2l4 -4\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0\">${headline}</p><p style=\"font-size:13px;color:#888;margin:0\">${footnote}</p>${debug}<script>console.info(\"[agent-native][google-oauth] success page loaded\",{flow:${JSON.stringify(debugFlowId || null)}});setTimeout(function(){try{window.close()}catch(e){}},250)</script></body></html>`;\n}\n\n/**\n * HTML escape — minimal but covers the cases that matter when interpolating\n * user-controlled values into our OAuth callback HTML. Mirrors the helper in\n * email-template.ts; kept inline here to avoid a circular import.\n */\nfunction escapeHtml(s: string): string {\n  return String(s ?? \"\")\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * Detect requests from the Agent Native desktop app specifically.\n *\n * The desktop app appends `AgentNativeDesktop/<version>` to its user-agent\n * (see `packages/desktop-app/src/main/index.ts`). We check for that marker\n * rather than matching generic `Electron`, which would also match other\n * Electron-based webviews like Builder.io's Fusion, Slack desktop, Discord,\n * etc. Falsely treating those as \"the desktop app\" sends users to the\n * `agentnative://oauth-complete` deep-link success page after Google sign-in,\n * where the protocol handler can't fire and the \"Open Agent Native\" button\n * does nothing.\n *\n * Kept exported as `isElectron` for backwards compatibility with consumers.\n */\nexport function isElectron(event: H3Event): boolean {\n  return /AgentNativeDesktop/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/** Detect requests from a mobile browser (iOS/Android). */\nexport function isMobile(event: H3Event): boolean {\n  return /iPhone|iPad|iPod|Android/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/**\n * Build the static allowlist of origins we trust for `getOrigin`. Reads\n * deployment-known public URLs. Each entry is normalised to\n * `${proto}://${host}` (no path). Duplicates collapse, invalid entries are\n * dropped silently.\n */\nconst EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS = [\n  \"WORKSPACE_OAUTH_ORIGIN\",\n  \"VITE_WORKSPACE_OAUTH_ORIGIN\",\n  \"APP_URL\",\n  \"VITE_APP_URL\",\n  \"BETTER_AUTH_URL\",\n  \"VITE_BETTER_AUTH_URL\",\n  \"URL\",\n  \"DEPLOY_URL\",\n] as const;\n\nconst WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS = [\n  \"WORKSPACE_GATEWAY_URL\",\n  \"VITE_WORKSPACE_GATEWAY_URL\",\n] as const;\n\nfunction normalizeOrigin(raw: string | undefined): string | undefined {\n  if (!raw) return undefined;\n  try {\n    const u = new URL(raw);\n    return `${u.protocol}//${u.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction addNormalizedOrigin(\n  out: Set<string>,\n  raw: string | undefined,\n  options: { allowLoopback: boolean },\n): void {\n  const origin = normalizeOrigin(raw);\n  if (!origin) return;\n  if (!options.allowLoopback && isLoopbackOrigin(origin)) return;\n  out.add(origin);\n}\n\nfunction firstOriginFromEnv(\n  keys: readonly string[],\n  options: { allowLoopback: boolean },\n): string | undefined {\n  for (const key of keys) {\n    const origin = normalizeOrigin(process.env[key]);\n    if (!origin) continue;\n    if (!options.allowLoopback && isLoopbackOrigin(origin)) continue;\n    return origin;\n  }\n  return undefined;\n}\n\nfunction getConfiguredOriginAllowlist(): Set<string> {\n  const out = new Set<string>();\n  for (const key of EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS) {\n    addNormalizedOrigin(out, process.env[key], { allowLoopback: true });\n  }\n  for (const key of WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS) {\n    addNormalizedOrigin(out, process.env[key], { allowLoopback: false });\n  }\n  return out;\n}\n\nfunction firstConfiguredOrigin(): string | undefined {\n  return [...getConfiguredOriginAllowlist()][0];\n}\n\nfunction getWorkspaceCallbackOrigin(): string | undefined {\n  const publicAuthOrigin = firstOriginFromEnv(EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS, {\n    allowLoopback: true,\n  });\n  if (publicAuthOrigin) return publicAuthOrigin;\n\n  return firstOriginFromEnv(WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS, {\n    allowLoopback: false,\n  });\n}\n\nfunction isLoopbackHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    return (\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\" ||\n      parsed.hostname === \"::1\" ||\n      parsed.hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    return isLoopbackHost(new URL(origin).host);\n  } catch {\n    return false;\n  }\n}\n\nfunction isBuilderPreviewHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    const hostname = parsed.hostname.toLowerCase();\n    return (\n      hostname === \"builderio.xyz\" ||\n      hostname.endsWith(\".builderio.xyz\") ||\n      hostname === \"builderio.dev\" ||\n      hostname.endsWith(\".builderio.dev\") ||\n      hostname === \"builder.codes\" ||\n      hostname.endsWith(\".builder.codes\") ||\n      hostname === \"builder.io\" ||\n      hostname.endsWith(\".builder.io\") ||\n      hostname === \"builder.my\" ||\n      hostname.endsWith(\".builder.my\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Get the origin from forwarded headers or Host.\n *\n * Defends against Host-header injection: in production we require the resolved\n * origin to match `APP_URL` / `BETTER_AUTH_URL` / `WORKSPACE_GATEWAY_URL`,\n * falling back to those values when inbound headers are missing or don't match.\n * In dev we accept inbound `Host` so localhost / ngrok / preview hosts keep\n * working without configuration, except workspace OAuth requests from loopback\n * or Builder preview hosts use the configured gateway origin when one exists.\n * The protocol defaults to `https` in production (so a TLS-terminating proxy\n * that drops `x-forwarded-proto` doesn't downgrade us to plain HTTP).\n */\nexport function getOrigin(event: H3Event): string {\n  const headerHost =\n    getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const isProd = process.env.NODE_ENV === \"production\";\n  const headerProto =\n    getHeader(event, \"x-forwarded-proto\") || (isProd ? \"https\" : \"http\");\n  const workspaceCallbackOrigin = isWorkspaceOAuthCallbackRelayEnabled()\n    ? getWorkspaceCallbackOrigin()\n    : undefined;\n\n  if (\n    workspaceCallbackOrigin &&\n    (isLoopbackHost(headerHost) || isBuilderPreviewHost(headerHost))\n  ) {\n    return workspaceCallbackOrigin;\n  }\n\n  if (isProd) {\n    const allow = getConfiguredOriginAllowlist();\n    // If the deploy declares its public URL, prefer it over inbound headers.\n    if (allow.size > 0) {\n      const inbound = headerHost ? `${headerProto}://${headerHost}` : \"\";\n      if (inbound && allow.has(inbound)) return inbound;\n      // Inbound didn't match — fall back to the first configured origin.\n      return [...allow][0];\n    }\n    // No allowlist configured: still default to https, but accept the\n    // inbound Host (best we can do without a configured base URL).\n    return `${headerProto}://${headerHost ?? \"\"}`;\n  }\n\n  return `${headerProto}://${headerHost ?? \"localhost\"}`;\n}\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\n/** App mount prefix, if the template is served under APP_BASE_PATH. */\nexport function getAppBasePath(): string {\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n}\n\n/** Build an absolute same-origin URL that preserves APP_BASE_PATH. */\nexport function getAppUrl(event: H3Event, path = \"/\"): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${getOrigin(event)}${getAppBasePath()}${cleanPath}`;\n}\n\nfunction isWorkspaceOAuthCallbackRelayEnabled(): boolean {\n  return (\n    process.env.AGENT_NATIVE_WORKSPACE === \"1\" ||\n    process.env.VITE_AGENT_NATIVE_WORKSPACE === \"1\"\n  );\n}\n\nfunction isFrameworkOAuthCallbackPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/_agent-native/\") &&\n    (pathname.endsWith(\"/callback\") || pathname.includes(\"/callback/\"))\n  );\n}\n\nfunction getOriginalRequestPath(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return mountedPathname;\n  }\n\n  const urlPathname = (event as any).url?.pathname;\n  if (typeof urlPathname === \"string\" && urlPathname) return urlPathname;\n\n  const nodeUrl = event.node?.req?.url;\n  if (typeof nodeUrl === \"string\" && nodeUrl) {\n    const queryStart = nodeUrl.indexOf(\"?\");\n    return queryStart >= 0 ? nodeUrl.slice(0, queryStart) : nodeUrl;\n  }\n\n  const eventPath = (event as any).path;\n  if (typeof eventPath === \"string\" && eventPath) {\n    const queryStart = eventPath.indexOf(\"?\");\n    return queryStart >= 0 ? eventPath.slice(0, queryStart) : eventPath;\n  }\n\n  return \"/\";\n}\n\nfunction isRequestUnderAppBasePath(event: H3Event): boolean {\n  const basePath = getAppBasePath();\n  if (!basePath) return false;\n  const requestPath = getOriginalRequestPath(event);\n  return (\n    requestPath === `${basePath}/_agent-native` ||\n    requestPath.startsWith(`${basePath}/_agent-native/`)\n  );\n}\n\nfunction getDefaultOAuthRedirectUrl(event: H3Event, path: string): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  if (\n    isWorkspaceOAuthCallbackRelayEnabled() &&\n    isFrameworkOAuthCallbackPath(cleanPath)\n  ) {\n    return `${getOrigin(event)}${cleanPath}`;\n  }\n  const basePath = isRequestUnderAppBasePath(event) ? getAppBasePath() : \"\";\n  return `${getOrigin(event)}${basePath}${cleanPath}`;\n}\n\n// ─── redirect_uri Allowlist ──────────────────────────────────────────────────\n\n/**\n * Validate a user-supplied `redirect_uri` for OAuth flows.\n *\n * Defends against authorization-code interception (RFC 6819 §4.4.1.7):\n * even though the upstream provider (Google/Atlassian/Zoom) refuses\n * unregistered redirect URIs, prefix-style registrations and side\n * registrations on the same host let a malicious caller swap in an\n * attacker-controlled URI that the provider still accepts. We reject any\n * candidate that isn't on this server's own origin AND under the\n * framework's `/_agent-native/` namespace. Returns the validated URI on\n * success, or `undefined` on rejection — callers must treat `undefined`\n * as a 400.\n *\n * The intentional shape is exact-prefix:\n *   - Origin must equal `getOrigin(event)` — no Host-header injection\n *     reusing somebody else's registered redirect URI.\n *   - Path must start with `${appBasePath}/_agent-native/` so we never\n *     hand auth codes to a public marketing or open-redirect endpoint\n *     on the same registered host.\n *\n * For desktop / native flows that need ephemeral `http://127.0.0.1:<port>`\n * loopback URIs, callers should validate those at the template level\n * with a dedicated allowlist — this helper rejects them by design.\n */\nexport function isAllowedOAuthRedirectUri(\n  candidate: string,\n  event: H3Event,\n): boolean {\n  if (typeof candidate !== \"string\" || candidate.length === 0) return false;\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    return false;\n  }\n  // Must be same origin as our server.\n  const expectedOrigin = getOrigin(event);\n  let expectedUrl: URL;\n  try {\n    expectedUrl = new URL(expectedOrigin);\n  } catch {\n    return false;\n  }\n  if (url.protocol !== expectedUrl.protocol) return false;\n  if (url.host !== expectedUrl.host) return false;\n  // Must live under the framework's namespace. Workspace deploys can route\n  // root /_agent-native/* to Dispatch even when Dispatch itself is mounted at\n  // /dispatch, but app-prefixed requests should not be able to swap their\n  // callback to that root namespace.\n  const basePath = getAppBasePath();\n  const allowedPrefixes =\n    basePath && isRequestUnderAppBasePath(event)\n      ? [\n          `${basePath}/_agent-native/`,\n          ...(isWorkspaceOAuthCallbackRelayEnabled() &&\n          isFrameworkOAuthCallbackPath(url.pathname)\n            ? [\"/_agent-native/\"]\n            : []),\n        ]\n      : [\"/_agent-native/\"];\n  if (!allowedPrefixes.some((prefix) => url.pathname.startsWith(prefix))) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the `redirect_uri` for an outbound OAuth `auth-url` request.\n *\n * Reads `?redirect_uri=` from the query and validates it via\n * `isAllowedOAuthRedirectUri`. Returns:\n *   - the validated URI when supplied and allowed, OR\n *   - the framework default when no override was supplied, OR\n *   - `null` when an override was supplied but rejected — callers must\n *     respond with 400 in that case.\n *\n * Templates that need a non-default redirect path can pass it via\n * `defaultPath` (e.g. `\"/_agent-native/google/desktop-callback\"` for\n * desktop flows).\n */\nexport function resolveOAuthRedirectUri(\n  event: H3Event,\n  defaultPath = \"/_agent-native/google/callback\",\n): string | null {\n  const supplied = getQuery(event).redirect_uri;\n  if (typeof supplied === \"string\" && supplied.length > 0) {\n    return isAllowedOAuthRedirectUri(supplied, event) ? supplied : null;\n  }\n  return getDefaultOAuthRedirectUrl(event, defaultPath);\n}\n\n// ─── OAuth State ─────────────────────────────────────────────────────────────\n\nexport interface OAuthStatePayload {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  /**\n   * Same-origin path to redirect to after a successful web-flow sign-in.\n   * Threaded through the (HMAC-signed) state so it survives the round trip\n   * to Google. Validated again on decode via safeReturnPath as defence in\n   * depth. Has no effect on desktop / mobile / add-account flows, which\n   * use their own deep-link / close-tab handling.\n   */\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Ephemeral in-memory state-signing key for development. Generated lazily\n * on first read so dev sessions don't depend on filesystem writability or\n * env-var configuration. Sessions reset on each restart, which is fine\n * for dev — no real users / production data are involved.\n */\nlet _devStateSigningKey: string | undefined;\n\n/**\n * Derive a server-only signing key for HMAC verification of OAuth state.\n *\n * Uses a dedicated secret — never an OAuth client secret. Reusing a\n * client_secret (which is shared with Google / GitHub / Atlassian) as our\n * own HMAC key conflates two trust domains: rotating the client secret\n * silently invalidates every in-flight OAuth state, and any leak of the\n * client secret also lets an attacker forge our state envelopes.\n *\n * Resolution order:\n *   1. OAUTH_STATE_SECRET (preferred — dedicated to this purpose)\n *   2. BETTER_AUTH_SECRET (already used by Better Auth as a server secret)\n *   3. Hosted workspace deploys derive a per-purpose key from A2A_SECRET\n *   4. In dev only, an ephemeral random key (per-process)\n *\n * In production, throws if no usable server secret is set.\n */\nfunction getStateSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET ||\n    process.env.BETTER_AUTH_SECRET ||\n    getWorkspaceA2ADerivedSecret(\"oauth-state\");\n  if (secret) return secret;\n\n  const isProd = process.env.NODE_ENV === \"production\";\n  if (isProd) {\n    throw new Error(\n      \"OAuth state signing requires a server secret. \" +\n        \"Set OAUTH_STATE_SECRET, BETTER_AUTH_SECRET, or A2A_SECRET in production workspace deploys.\",\n    );\n  }\n\n  if (!_devStateSigningKey) {\n    _devStateSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devStateSigningKey;\n}\n\n/**\n * Options for the named-argument form of {@link encodeOAuthState}.\n * Prefer this form — the positional overload is easy to misuse (the mail\n * and calendar templates historically passed `flowId` in the `returnUrl`\n * slot, smuggling state into a defence-in-depth path).\n */\nexport interface EncodeOAuthStateOptions {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Encode OAuth state into a signed base64url string.\n * The state is HMAC-signed so the callback can verify it wasn't forged,\n * preventing CSRF attacks on the OAuth flow.\n *\n * Two call shapes are supported:\n *   - Recommended: pass an options object — clear, mismatch-proof.\n *     `encodeOAuthState({ redirectUri, owner, desktop, ... })`\n *   - Legacy positional form (kept working for backward compatibility):\n *     `encodeOAuthState(redirectUri, owner, desktop, addAccount, app, returnUrl, flowId)`.\n *     Callers should migrate to the options form — see the audit on\n *     templates/mail and templates/calendar where the positional shape\n *     led to `flowId` being smuggled in via the `returnUrl` slot.\n */\nexport function encodeOAuthState(opts: EncodeOAuthStateOptions): string;\nexport function encodeOAuthState(\n  redirectUri: string,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string;\nexport function encodeOAuthState(\n  redirectUriOrOpts: string | EncodeOAuthStateOptions,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string {\n  const opts: EncodeOAuthStateOptions =\n    typeof redirectUriOrOpts === \"string\"\n      ? {\n          redirectUri: redirectUriOrOpts,\n          owner,\n          desktop,\n          addAccount,\n          app,\n          returnUrl,\n          flowId,\n        }\n      : redirectUriOrOpts;\n\n  const nonce = crypto.randomBytes(8).toString(\"hex\");\n  const payload: Record<string, string | boolean> = {\n    n: nonce,\n    r: opts.redirectUri,\n  };\n  if (opts.owner) payload.o = opts.owner;\n  if (opts.desktop) payload.d = true;\n  if (opts.addAccount) payload.a = true;\n  if (opts.app) payload.app = opts.app;\n  if (opts.returnUrl) payload.r2 = opts.returnUrl;\n  if (opts.flowId) payload.f = opts.flowId;\n  const data = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  const sig = crypto\n    .createHmac(\"sha256\", getStateSigningKey())\n    .update(data)\n    .digest(\"base64url\");\n  return `${data}.${sig}`;\n}\n\n/**\n * Decode and verify OAuth state from the callback's state query parameter.\n * Rejects forged or tampered state by checking the HMAC signature.\n * Falls back to the provided URI if decoding or verification fails.\n */\nexport function decodeOAuthState(\n  stateParam: string | undefined,\n  fallbackUri: string,\n): OAuthStatePayload {\n  if (stateParam) {\n    try {\n      const dotIdx = stateParam.lastIndexOf(\".\");\n      if (dotIdx === -1) return { redirectUri: fallbackUri };\n\n      const data = stateParam.slice(0, dotIdx);\n      const sig = stateParam.slice(dotIdx + 1);\n      const expected = crypto\n        .createHmac(\"sha256\", getStateSigningKey())\n        .update(data)\n        .digest(\"base64url\");\n\n      if (\n        sig.length !== expected.length ||\n        !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))\n      ) {\n        return { redirectUri: fallbackUri };\n      }\n\n      const parsed = JSON.parse(Buffer.from(data, \"base64url\").toString());\n      return {\n        redirectUri: parsed.r || fallbackUri,\n        owner: parsed.o || undefined,\n        desktop: !!parsed.d,\n        addAccount: !!parsed.a,\n        app: typeof parsed.app === \"string\" ? parsed.app : undefined,\n        // Pass returnUrl through as-is — same-origin validation runs at the\n        // consumer (oauthCallbackResponse → safeReturnPath). The state is\n        // HMAC-signed, but we still validate at consumption as defence in\n        // depth in case the signing key ever leaks.\n        returnUrl: typeof parsed.r2 === \"string\" ? parsed.r2 : undefined,\n        flowId: parsed.f || undefined,\n      };\n    } catch {}\n  }\n  return { redirectUri: fallbackUri };\n}\n\n// ─── Session Creation ────────────────────────────────────────────────────────\n\nexport interface OAuthOwnerResult {\n  owner: string | undefined;\n  hasProductionSession: boolean;\n}\n\n/**\n * Determine the token owner from the current session and OAuth state.\n * Call this BEFORE exchangeCode to get the owner parameter.\n */\nexport async function resolveOAuthOwner(\n  event: H3Event,\n  stateOwner?: string,\n): Promise<OAuthOwnerResult> {\n  const existingSession = await getSession(event);\n  const hasProductionSession = !!existingSession?.email;\n  const owner = hasProductionSession\n    ? existingSession!.email\n    : stateOwner || undefined;\n\n  return { owner, hasProductionSession };\n}\n\nexport interface OAuthSessionResult {\n  sessionToken: string | undefined;\n}\n\n/**\n * Create a session token after a successful OAuth exchange.\n *\n * Desktop and mobile apps have separate cookie jars from the system\n * browser, so they always get a fresh session token (even if the browser\n * already has one). The token is then passed via deep link so the native\n * app can inject it.\n */\nexport async function createOAuthSession(\n  event: H3Event,\n  email: string,\n  opts: {\n    hasProductionSession: boolean;\n    desktop?: boolean;\n  },\n): Promise<OAuthSessionResult> {\n  const mobile = isMobile(event);\n  const needsDeepLink = opts.desktop || mobile;\n  const maxAge = getSessionMaxAge();\n\n  let sessionToken: string | undefined;\n  if (!opts.hasProductionSession || needsDeepLink) {\n    sessionToken = crypto.randomBytes(32).toString(\"hex\");\n    await addSession(sessionToken, email);\n    setFrameworkSessionCookie(event, sessionToken);\n    // Desktop SSO: record this session in the home-dir broker file so\n    // sibling templates (each with its own database) can resolve the\n    // same token without a DB row of their own. Only the PRIMARY\n    // sign-in writes the broker — if a production session already\n    // exists, this is an add-account flow (connecting a secondary\n    // Google account for scraping) and must never switch the active\n    // user across sibling templates.\n    if (opts.desktop && !opts.hasProductionSession) {\n      await writeDesktopSso({\n        email,\n        token: sessionToken,\n        expiresAt: Date.now() + maxAge * 1000,\n      });\n    }\n  }\n\n  return { sessionToken };\n}\n\n// ─── Callback Responses ──────────────────────────────────────────────────────\n\n/**\n * Return the appropriate response after a successful OAuth callback.\n *\n * Handles mobile deep links, desktop deep links, add-account close-tab\n * pages, and plain web redirects — so templates don't have to.\n */\nexport function oauthCallbackResponse(\n  event: H3Event,\n  email: string,\n  opts: {\n    sessionToken?: string;\n    desktop?: boolean;\n    addAccount?: boolean;\n    /**\n     * Same-origin path to return the viewer to after a successful web\n     * sign-in. Validated via safeReturnPath; falls back to \"/\" for any\n     * shape that escapes same-origin. Has no effect on desktop / mobile\n     * / add-account flows — those use their own deep-link handling.\n     */\n    returnUrl?: string;\n    flowId?: string;\n    appName?: string;\n  },\n): Response | string | unknown | Promise<Response | string | unknown> {\n  const mobile = isMobile(event);\n  const query = getQuery(event);\n  const callbackState =\n    typeof query.state === \"string\" && query.state.length > 0\n      ? query.state\n      : undefined;\n\n  // Mobile: deep link back to native app\n  if (mobile) {\n    const deepLink = buildOAuthCompleteDeepLink(\n      opts.sessionToken,\n      callbackState,\n    );\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\"><title>Connected</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p>Connected! Returning to app…</p><script>window.location.href=${JSON.stringify(deepLink)};setTimeout(function(){window.location.href=\"/\"},1500)</script></body></html>`,\n    );\n  }\n\n  // Desktop add-account: close-tab page (must come before general desktop check\n  // to ensure no deep link fires and the existing session is never switched).\n  if (opts.desktop && opts.addAccount) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Electron desktop exchange flow: mail/calendar still pass a flow id so the\n  // renderer can poll as a fallback, but the main handoff should use the\n  // protocol deep link so the popup returns focus to the desktop app.\n  if (opts.desktop && opts.flowId && isElectron(event) && opts.sessionToken) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Desktop exchange flow (non-Electron tray app): the tray app polls the\n  // desktop-exchange endpoint for the token — no deep link needed.\n  if (opts.desktop && opts.flowId) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Signed in as ${safeEmail}!` : \"Signed in!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Desktop login: deep link back to Electron app — only when the callback\n  // request actually carries the AgentNativeDesktop UA marker. Without this\n  // check, any client whose OAuth state was minted with `desktop=true` (e.g.\n  // a stale link, or an upstream that wrongly set `?desktop=1`) would land\n  // on the `agentnative://` page where the deep link can't fire and the\n  // \"Open Agent Native\" button does nothing — surfaces inside Builder.io's\n  // Fusion webview hit this exact dead-end. Fall through to the web flow\n  // for non-Agent-Native-Desktop clients so they get a real redirect.\n  if (opts.desktop && isElectron(event)) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Add-account web flow: close-tab page. The email is rendered into the\n  // page via DOM `textContent` (safe), but we still JSON-stringify so a\n  // payload containing `</script>` can't break out of the script tag —\n  // and explicitly assert it's a string so a callbacks like `null` or\n  // an object won't end up serialised into the page.\n  if (opts.addAccount) {\n    const safeEmail = JSON.stringify(typeof email === \"string\" ? email : \"\");\n    return htmlResponse(`<!DOCTYPE html><html><body><script>\n        window.close();\n        var p = document.createElement('p');\n        p.style.cssText = 'font-family:system-ui;text-align:center;margin-top:40vh';\n        p.textContent = 'Connected ' + ${safeEmail} + '! You can close this tab.';\n        document.body.appendChild(p);\n      </script></body></html>`);\n  }\n\n  // Web: redirect to the requested return target. Path-only returns stay\n  // same-origin; Builder desktop workspace returns may point back to the\n  // local loopback gateway and carry the short-lived `_session` bridge so\n  // the local app can promote the newly created hosted OAuth session.\n  setResponseStatus(event, 302);\n  setResponseHeader(\n    event,\n    \"Location\",\n    appendSessionToOAuthReturnUrl(opts.returnUrl, opts.sessionToken),\n  );\n  setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n  return \"\";\n}\n\n/** HTML error page for OAuth failures. The message is HTML-escaped — most\n *  callers pass `error.message` from a token-exchange or userinfo failure,\n *  which can echo upstream provider strings (and historically attacker-\n *  controlled query params via the `error_description` field). */\nexport function oauthErrorPage(message: string): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connection failed</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;text-align:center\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ef4444\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M15 9l-6 6\"/><path d=\"M9 9l6 6\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0;color:#ddd\">${safe}</p><p style=\"font-size:13px;color:#888;margin:0\"><a href=\"/\" style=\"color:#888;text-decoration:underline;text-underline-offset:3px\">Back to login</a></p></body></html>`,\n    400,\n  );\n}\n\nexport function oauthDesktopExchangePage(\n  message = \"Returning to the app...\",\n): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Returning</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p style=\"font-size:14px\">${safe}</p><script>window.close()</script></body></html>`,\n  );\n}\n\n// ─── Internal ────────────────────────────────────────────────────────────────\n\nfunction resolveOAuthAppName(explicit?: string): string {\n  const raw = explicit || getAppName() || \"Agent Native\";\n  if (!/^[a-z0-9_-]+$/.test(raw)) return raw;\n  return raw\n    .split(/[-_]+/)\n    .filter(Boolean)\n    .map((word) => word[0].toUpperCase() + word.slice(1))\n    .join(\" \");\n}\n\nfunction buildOAuthCompleteDeepLink(\n  sessionToken?: string,\n  state?: string,\n): string {\n  const params = new URLSearchParams();\n  if (sessionToken) params.set(\"token\", sessionToken);\n  if (state) params.set(\"state\", state);\n  const suffix = params.toString();\n  return suffix\n    ? `agentnative://oauth-complete?${suffix}`\n    : \"agentnative://oauth-complete\";\n}\n\nfunction desktopSuccessPage(\n  _event: H3Event,\n  email?: string,\n  sessionToken?: string,\n  state?: string,\n): Response {\n  const safeEmail = email ? escapeHtml(email) : \"\";\n  const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n  if (sessionToken) {\n    const deepLink = buildOAuthCompleteDeepLink(sessionToken, state);\n    const deepLinkJson = JSON.stringify(deepLink);\n    // Defence in depth: if this page somehow gets served to a UA that isn't\n    // the Agent Native desktop app (server gate bypassed, stale link, etc.),\n    // skip the `agentnative://` deep link entirely and bounce to the app\n    // root. The deep link silently fails outside the desktop app and the\n    // \"Open Agent Native\" button is a dead end in a generic browser/webview.\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title><style>@keyframes spin{to{transform:rotate(360deg)}}@keyframes fadeIn{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}.spinner{width:28px;height:28px;border:2px solid #333;border-top-color:#fff;border-radius:50%;animation:spin .8s linear infinite}.fallback{display:none;flex-direction:column;align-items:center;gap:8px;animation:fadeIn .2s ease-out}.fallback.show{display:flex}</style></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:16px\"><p style=\"font-size:16px;margin:0\">${msg}</p><div id=\"loading\" class=\"spinner\"></div><div id=\"fallback\" class=\"fallback\"><a href=${deepLinkJson} style=\"display:inline-block;padding:10px 24px;background:#fff;color:#000;border-radius:8px;text-decoration:none;font-size:14px;font-weight:500\">Open Agent Native</a><p style=\"font-size:12px;color:#666;margin:0\">If the app didn\\u2019t open automatically, click the button above.</p></div><script>(function(){var ua=(navigator.userAgent||\"\");if(ua.indexOf(\"AgentNativeDesktop\")===-1){window.location.replace(\"/\");return}window.location.href=${deepLinkJson};setTimeout(function(){document.getElementById(\"loading\").style.display=\"none\";document.getElementById(\"fallback\").classList.add(\"show\")},3000)})()</script></body></html>`,\n    );\n  }\n  return htmlResponse(\n    oauthSuccessCloseTabHtml(\n      msg,\n      \"You can close this tab and return to Agent Native.\",\n    ),\n  );\n}\n"]}

package/dist/server/short-lived-token.d.ts

@@ -13,9 +13,10 @@
  * Key resolution mirrors `google-oauth.ts:getStateSigningKey`:
  *   1. OAUTH_STATE_SECRET (preferred — dedicated to short-lived signing)
  *   2. BETTER_AUTH_SECRET (already used as a server secret)
- *   3. In dev only, an ephemeral random key (per-process)
+ *   3. Hosted workspace deploys derive a per-purpose key from A2A_SECRET
+ *   4. In dev only, an ephemeral random key (per-process)
  *
- * In production, throws if neither secret is set.
+ * In production, throws if no usable server secret is set.
  */
 /**
  * Inputs for {@link signShortLivedToken}.

package/dist/server/short-lived-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"short-lived-token.d.ts","sourceRoot":"","sources":["../../src/server/short-lived-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAqClC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAazE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GACzB,YAAY,CA0Cd"}
+{"version":3,"file":"short-lived-token.d.ts","sourceRoot":"","sources":["../../src/server/short-lived-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAQH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAuClC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAazE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GACzB,YAAY,CA0Cd"}

package/dist/server/short-lived-token.js

@@ -13,21 +13,25 @@
  * Key resolution mirrors `google-oauth.ts:getStateSigningKey`:
  *   1. OAUTH_STATE_SECRET (preferred — dedicated to short-lived signing)
  *   2. BETTER_AUTH_SECRET (already used as a server secret)
- *   3. In dev only, an ephemeral random key (per-process)
+ *   3. Hosted workspace deploys derive a per-purpose key from A2A_SECRET
+ *   4. In dev only, an ephemeral random key (per-process)
  *
- * In production, throws if neither secret is set.
+ * In production, throws if no usable server secret is set.
  */
 import crypto from "node:crypto";
+import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 /** Default token TTL, in seconds. 10 minutes covers a typical video session. */
 const DEFAULT_TTL_SECONDS = 600;
 let _devSigningKey;
 function getSigningKey() {
-    const secret = process.env.OAUTH_STATE_SECRET || process.env.BETTER_AUTH_SECRET;
+    const secret = process.env.OAUTH_STATE_SECRET ||
+        process.env.BETTER_AUTH_SECRET ||
+        getWorkspaceA2ADerivedSecret("short-lived-token");
     if (secret)
         return secret;
     if (process.env.NODE_ENV === "production") {
         throw new Error("Short-lived token signing requires a server secret. " +
-            "Set OAUTH_STATE_SECRET or BETTER_AUTH_SECRET in production.");
+            "Set OAUTH_STATE_SECRET, BETTER_AUTH_SECRET, or A2A_SECRET in production workspace deploys.");
     }
     if (!_devSigningKey) {
         _devSigningKey = crypto.randomBytes(32).toString("hex");

package/dist/server/short-lived-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"short-lived-token.js","sourceRoot":"","sources":["../../src/server/short-lived-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AA4BhC,IAAI,cAAkC,CAAC;AAEvC,SAAS,aAAa;IACpB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,sDAAsD;YACpD,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC;SACL,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,sEAAsE;IACtE,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA6B;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACrD,MAAM,OAAO,GAAkB;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;KACzC,CAAC;IACF,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAEjE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,eAAe,CACzB,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CACzE,CAAC;IACF,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,kBAA0B;IAE1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEnE,MAAM,QAAQ,GAAG,eAAe,CAC9B,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CACzE,CAAC;IAEF,oEAAoE;IACpE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC","sourcesContent":["/**\n * Short-lived HMAC-signed access tokens for media URLs.\n *\n * Used by clips and calls to mint a single-use bearer token after a password\n * gate passes, then bake `?t=<token>` into the video/blob URL handed to the\n * `<video>` element — instead of `?password=<plaintext>` (which ends up in\n * browser history, CDN logs, and Referer headers).\n *\n * Token shape: `<payloadB64Url>.<sigB64Url>`\n *   payload = base64url(JSON.stringify({ resourceId, viewerEmail?, exp }))\n *   sig     = base64url(HMAC-SHA256(payload, key))\n *\n * Key resolution mirrors `google-oauth.ts:getStateSigningKey`:\n *   1. OAUTH_STATE_SECRET (preferred — dedicated to short-lived signing)\n *   2. BETTER_AUTH_SECRET (already used as a server secret)\n *   3. In dev only, an ephemeral random key (per-process)\n *\n * In production, throws if neither secret is set.\n */\n\nimport crypto from \"node:crypto\";\n\n/** Default token TTL, in seconds. 10 minutes covers a typical video session. */\nconst DEFAULT_TTL_SECONDS = 600;\n\n/**\n * Inputs for {@link signShortLivedToken}.\n */\nexport interface ShortLivedTokenClaims {\n  /** Resource id the token authorises (recording id, call id, snippet id, …). */\n  resourceId: string;\n  /** Optional viewer email for audit / analytics — not used for authorisation. */\n  viewerEmail?: string;\n  /** Override default TTL (seconds). */\n  ttlSeconds?: number;\n}\n\ninterface DecodedClaims {\n  resourceId: string;\n  viewerEmail?: string;\n  exp: number;\n}\n\n/**\n * Result of {@link verifyShortLivedToken}. Discriminated by the literal\n * `ok` field so callers can `if (!result.ok) return …`.\n */\nexport type VerifyResult =\n  | { ok: true; viewerEmail?: string }\n  | { ok: false; reason: string };\n\nlet _devSigningKey: string | undefined;\n\nfunction getSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET || process.env.BETTER_AUTH_SECRET;\n  if (secret) return secret;\n\n  if (process.env.NODE_ENV === \"production\") {\n    throw new Error(\n      \"Short-lived token signing requires a server secret. \" +\n        \"Set OAUTH_STATE_SECRET or BETTER_AUTH_SECRET in production.\",\n    );\n  }\n\n  if (!_devSigningKey) {\n    _devSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devSigningKey;\n}\n\nfunction base64UrlEncode(buf: Buffer | string): string {\n  const b = typeof buf === \"string\" ? Buffer.from(buf, \"utf8\") : buf;\n  return b\n    .toString(\"base64\")\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\");\n}\n\nfunction base64UrlDecode(s: string): Buffer {\n  // Re-pad to a multiple of 4 so Buffer.from('base64') decodes cleanly.\n  const padded = s + \"=\".repeat((4 - (s.length % 4)) % 4);\n  return Buffer.from(padded.replace(/-/g, \"+\").replace(/_/g, \"/\"), \"base64\");\n}\n\n/**\n * Mint a signed token authorising read access to `claims.resourceId` until\n * `exp = now + ttl`. The result is safe to drop into a query string —\n * `?t=<token>` — and verified by {@link verifyShortLivedToken} on the\n * downstream route.\n */\nexport function signShortLivedToken(claims: ShortLivedTokenClaims): string {\n  const ttl = claims.ttlSeconds ?? DEFAULT_TTL_SECONDS;\n  const payload: DecodedClaims = {\n    resourceId: claims.resourceId,\n    exp: Math.floor(Date.now() / 1000) + ttl,\n  };\n  if (claims.viewerEmail) payload.viewerEmail = claims.viewerEmail;\n\n  const payloadStr = base64UrlEncode(JSON.stringify(payload));\n  const sig = base64UrlEncode(\n    crypto.createHmac(\"sha256\", getSigningKey()).update(payloadStr).digest(),\n  );\n  return `${payloadStr}.${sig}`;\n}\n\n/**\n * Verify a token previously produced by {@link signShortLivedToken}.\n *\n * Returns `{ ok: true, viewerEmail? }` only when:\n *  - the token has the expected shape (`<payload>.<sig>`),\n *  - the signature matches via constant-time comparison,\n *  - the token has not expired,\n *  - the embedded `resourceId` matches `expectedResourceId`.\n *\n * Otherwise returns `{ ok: false, reason: <error string> }`. Callers should\n * not surface the reason to viewers (it's useful for server-side logs only).\n */\nexport function verifyShortLivedToken(\n  token: string,\n  expectedResourceId: string,\n): VerifyResult {\n  if (typeof token !== \"string\" || !token.includes(\".\")) {\n    return { ok: false, reason: \"malformed\" };\n  }\n  const [payloadStr, sig] = token.split(\".\", 2);\n  if (!payloadStr || !sig) return { ok: false, reason: \"malformed\" };\n\n  const expected = base64UrlEncode(\n    crypto.createHmac(\"sha256\", getSigningKey()).update(payloadStr).digest(),\n  );\n\n  // Constant-time compare. Length-mismatched inputs would throw under\n  // `crypto.timingSafeEqual`, so we check length first and fall back to a\n  // dummy compare to keep timing roughly constant on the failure path.\n  const sigBuf = Buffer.from(sig, \"utf8\");\n  const expBuf = Buffer.from(expected, \"utf8\");\n  if (sigBuf.length !== expBuf.length) {\n    crypto.timingSafeEqual(expBuf, expBuf); // burn ~equal cycles\n    return { ok: false, reason: \"bad_signature\" };\n  }\n  if (!crypto.timingSafeEqual(sigBuf, expBuf)) {\n    return { ok: false, reason: \"bad_signature\" };\n  }\n\n  let claims: DecodedClaims;\n  try {\n    claims = JSON.parse(base64UrlDecode(payloadStr).toString(\"utf8\"));\n  } catch {\n    return { ok: false, reason: \"bad_payload\" };\n  }\n\n  if (typeof claims.exp !== \"number\") {\n    return { ok: false, reason: \"bad_payload\" };\n  }\n  if (claims.exp * 1000 < Date.now()) {\n    return { ok: false, reason: \"expired\" };\n  }\n  if (claims.resourceId !== expectedResourceId) {\n    return { ok: false, reason: \"wrong_resource\" };\n  }\n\n  return { ok: true, viewerEmail: claims.viewerEmail };\n}\n"]}
+{"version":3,"file":"short-lived-token.js","sourceRoot":"","sources":["../../src/server/short-lived-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEnE,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AA4BhC,IAAI,cAAkC,CAAC;AAEvC,SAAS,aAAa;IACpB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,sDAAsD;YACpD,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC;SACL,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,sEAAsE;IACtE,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA6B;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACrD,MAAM,OAAO,GAAkB;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;KACzC,CAAC;IACF,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAEjE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,eAAe,CACzB,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CACzE,CAAC;IACF,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,kBAA0B;IAE1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEnE,MAAM,QAAQ,GAAG,eAAe,CAC9B,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CACzE,CAAC;IAEF,oEAAoE;IACpE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC","sourcesContent":["/**\n * Short-lived HMAC-signed access tokens for media URLs.\n *\n * Used by clips and calls to mint a single-use bearer token after a password\n * gate passes, then bake `?t=<token>` into the video/blob URL handed to the\n * `<video>` element — instead of `?password=<plaintext>` (which ends up in\n * browser history, CDN logs, and Referer headers).\n *\n * Token shape: `<payloadB64Url>.<sigB64Url>`\n *   payload = base64url(JSON.stringify({ resourceId, viewerEmail?, exp }))\n *   sig     = base64url(HMAC-SHA256(payload, key))\n *\n * Key resolution mirrors `google-oauth.ts:getStateSigningKey`:\n *   1. OAUTH_STATE_SECRET (preferred — dedicated to short-lived signing)\n *   2. BETTER_AUTH_SECRET (already used as a server secret)\n *   3. Hosted workspace deploys derive a per-purpose key from A2A_SECRET\n *   4. In dev only, an ephemeral random key (per-process)\n *\n * In production, throws if no usable server secret is set.\n */\n\nimport crypto from \"node:crypto\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\n\n/** Default token TTL, in seconds. 10 minutes covers a typical video session. */\nconst DEFAULT_TTL_SECONDS = 600;\n\n/**\n * Inputs for {@link signShortLivedToken}.\n */\nexport interface ShortLivedTokenClaims {\n  /** Resource id the token authorises (recording id, call id, snippet id, …). */\n  resourceId: string;\n  /** Optional viewer email for audit / analytics — not used for authorisation. */\n  viewerEmail?: string;\n  /** Override default TTL (seconds). */\n  ttlSeconds?: number;\n}\n\ninterface DecodedClaims {\n  resourceId: string;\n  viewerEmail?: string;\n  exp: number;\n}\n\n/**\n * Result of {@link verifyShortLivedToken}. Discriminated by the literal\n * `ok` field so callers can `if (!result.ok) return …`.\n */\nexport type VerifyResult =\n  | { ok: true; viewerEmail?: string }\n  | { ok: false; reason: string };\n\nlet _devSigningKey: string | undefined;\n\nfunction getSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET ||\n    process.env.BETTER_AUTH_SECRET ||\n    getWorkspaceA2ADerivedSecret(\"short-lived-token\");\n  if (secret) return secret;\n\n  if (process.env.NODE_ENV === \"production\") {\n    throw new Error(\n      \"Short-lived token signing requires a server secret. \" +\n        \"Set OAUTH_STATE_SECRET, BETTER_AUTH_SECRET, or A2A_SECRET in production workspace deploys.\",\n    );\n  }\n\n  if (!_devSigningKey) {\n    _devSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devSigningKey;\n}\n\nfunction base64UrlEncode(buf: Buffer | string): string {\n  const b = typeof buf === \"string\" ? Buffer.from(buf, \"utf8\") : buf;\n  return b\n    .toString(\"base64\")\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\");\n}\n\nfunction base64UrlDecode(s: string): Buffer {\n  // Re-pad to a multiple of 4 so Buffer.from('base64') decodes cleanly.\n  const padded = s + \"=\".repeat((4 - (s.length % 4)) % 4);\n  return Buffer.from(padded.replace(/-/g, \"+\").replace(/_/g, \"/\"), \"base64\");\n}\n\n/**\n * Mint a signed token authorising read access to `claims.resourceId` until\n * `exp = now + ttl`. The result is safe to drop into a query string —\n * `?t=<token>` — and verified by {@link verifyShortLivedToken} on the\n * downstream route.\n */\nexport function signShortLivedToken(claims: ShortLivedTokenClaims): string {\n  const ttl = claims.ttlSeconds ?? DEFAULT_TTL_SECONDS;\n  const payload: DecodedClaims = {\n    resourceId: claims.resourceId,\n    exp: Math.floor(Date.now() / 1000) + ttl,\n  };\n  if (claims.viewerEmail) payload.viewerEmail = claims.viewerEmail;\n\n  const payloadStr = base64UrlEncode(JSON.stringify(payload));\n  const sig = base64UrlEncode(\n    crypto.createHmac(\"sha256\", getSigningKey()).update(payloadStr).digest(),\n  );\n  return `${payloadStr}.${sig}`;\n}\n\n/**\n * Verify a token previously produced by {@link signShortLivedToken}.\n *\n * Returns `{ ok: true, viewerEmail? }` only when:\n *  - the token has the expected shape (`<payload>.<sig>`),\n *  - the signature matches via constant-time comparison,\n *  - the token has not expired,\n *  - the embedded `resourceId` matches `expectedResourceId`.\n *\n * Otherwise returns `{ ok: false, reason: <error string> }`. Callers should\n * not surface the reason to viewers (it's useful for server-side logs only).\n */\nexport function verifyShortLivedToken(\n  token: string,\n  expectedResourceId: string,\n): VerifyResult {\n  if (typeof token !== \"string\" || !token.includes(\".\")) {\n    return { ok: false, reason: \"malformed\" };\n  }\n  const [payloadStr, sig] = token.split(\".\", 2);\n  if (!payloadStr || !sig) return { ok: false, reason: \"malformed\" };\n\n  const expected = base64UrlEncode(\n    crypto.createHmac(\"sha256\", getSigningKey()).update(payloadStr).digest(),\n  );\n\n  // Constant-time compare. Length-mismatched inputs would throw under\n  // `crypto.timingSafeEqual`, so we check length first and fall back to a\n  // dummy compare to keep timing roughly constant on the failure path.\n  const sigBuf = Buffer.from(sig, \"utf8\");\n  const expBuf = Buffer.from(expected, \"utf8\");\n  if (sigBuf.length !== expBuf.length) {\n    crypto.timingSafeEqual(expBuf, expBuf); // burn ~equal cycles\n    return { ok: false, reason: \"bad_signature\" };\n  }\n  if (!crypto.timingSafeEqual(sigBuf, expBuf)) {\n    return { ok: false, reason: \"bad_signature\" };\n  }\n\n  let claims: DecodedClaims;\n  try {\n    claims = JSON.parse(base64UrlDecode(payloadStr).toString(\"utf8\"));\n  } catch {\n    return { ok: false, reason: \"bad_payload\" };\n  }\n\n  if (typeof claims.exp !== \"number\") {\n    return { ok: false, reason: \"bad_payload\" };\n  }\n  if (claims.exp * 1000 < Date.now()) {\n    return { ok: false, reason: \"expired\" };\n  }\n  if (claims.resourceId !== expectedResourceId) {\n    return { ok: false, reason: \"wrong_resource\" };\n  }\n\n  return { ok: true, viewerEmail: claims.viewerEmail };\n}\n"]}

package/docs/content/authentication.md

@@ -35,6 +35,27 @@ Better Auth routes are mounted at `/_agent-native/auth/ba/*`. The framework also
 - `POST /_agent-native/auth/register` — create account
 - `POST /_agent-native/auth/logout` — sign out
 
+## Cookie Realms {#cookie-realms}
+
+Standalone apps keep their framework session cookie isolated by app when an
+app slug is available (`APP_NAME`, or the package name in local dev). Better
+Auth keeps its production standalone cookie prefix stable as `an` so existing
+sessions are not renamed casually.
+
+Workspace mode (`AGENT_NATIVE_WORKSPACE=1`) uses one shared session realm
+because workspace apps share an origin and database. Custom same-database
+subdomain deployments can opt into shared cookies with `COOKIE_DOMAIN`.
+
+First-party hosted apps at `*.agent-native.com` are different: each app has its
+own auth database, so `COOKIE_DOMAIN=.agent-native.com` is ignored by default
+and the app uses an isolated cookie namespace instead. Cross-app sign-in for
+those apps should go through [Cross-App SSO](/docs/cross-app-sso). First-party
+deploys must provide `APP_NAME` or a derivable app URL (`APP_URL`, `URL`,
+`DEPLOY_PRIME_URL`, or `DEPLOY_URL`); otherwise startup fails instead of
+falling back to the shared `an_session` name. If a first-party deployment
+intentionally shares one auth database across subdomains, set
+`AGENT_NATIVE_SHARE_COOKIE_DOMAIN=1` alongside `COOKIE_DOMAIN`.
+
 ## QA Accounts {#qa-accounts}
 
 Local development and tests skip signup email verification by default, so you

package/docs/content/external-agents.md

@@ -8,11 +8,85 @@ search: "Claude ChatGPT Claude Code Codex Cursor Claude Cowork MCP Apps agent-na
 
 An agent-native app is reachable by any MCP-compatible host — Claude, Claude Desktop, Claude Code, ChatGPT custom MCP apps, Codex, Cursor, Claude Cowork, VS Code GitHub Copilot, Goose, Postman, MCPJam, and future clients that implement the standard. External agents are great at producing artifacts (a draft, an event, a dashboard) but they often live in a terminal or another app. Without a bridge, the user gets a wall of JSON and has to go find the thing.
 
-The external-agent bridge closes the loop. First you connect your own agent to a **hosted** app — one command writes the local client config, using standard remote MCP OAuth for clients that support it and a browser-authorized bearer fallback for older clients. Then the agent does the work over MCP and hands the user either an inline **MCP App** UI in compatible hosts or a single **"Open in <app> →"** link that opens the real app focused on exactly what was produced. It reuses the existing `navigate` / `application_state` contract the UI already drains every 2s (see [Context Awareness](/docs/context-awareness)) — there is no second navigation mechanism.
+The external-agent bridge closes the loop. First you connect your own agent to a **hosted** app — either by pasting the app's remote MCP URL into a chat host like Claude or ChatGPT, or by running the developer CLI flow for local coding agents. Then the agent does the work over MCP and hands the user either an inline **MCP App** UI in compatible hosts or a single **"Open in <app> →"** link that opens the real app focused on exactly what was produced. It reuses the existing `navigate` / `application_state` contract the UI already drains every 2s (see [Context Awareness](/docs/context-awareness)) — there is no second navigation mechanism.
 
-## Connect Claude Code, Codex, Cursor, and Cowork {#connect}
+## Easy setup {#easy-setup}
 
-The first-party hosted apps live at `mail.agent-native.com`, `calendar.agent-native.com`, `analytics.agent-native.com`, and so on. This flow connects supported local agent clients on your machine — Claude Code, Claude Code CLI, Codex, and Claude Cowork — to a hosted agent-native app over MCP. Cursor can use the same MCP endpoint via the no-CLI/manual config path below.
+Add the hosted app as a remote MCP connector in your chat host, sign in, and enable it in a chat.
+
+**Shortcut:** every hosted agent-native app serves a one-page connect helper at `https://<app>/_agent-native/mcp/connect` (for example [mail.agent-native.com/\_agent-native/mcp/connect](https://mail.agent-native.com/_agent-native/mcp/connect), [analytics.agent-native.com/\_agent-native/mcp/connect](https://analytics.agent-native.com/_agent-native/mcp/connect)). It shows the MCP URL with a one-click copy button and a tab strip — Claude · ChatGPT · Cursor · Claude Code · Codex · Other — each with the exact steps or copy-able command for that host. Bookmark it and share with non-developer teammates; everything below is also reachable from that page.
+
+Use the hosted app's MCP URL:
+
+| App       | Remote MCP URL                                         |
+| --------- | ------------------------------------------------------ |
+| Mail      | `https://mail.agent-native.com/_agent-native/mcp`      |
+| Analytics | `https://analytics.agent-native.com/_agent-native/mcp` |
+| Any app   | `https://<app-host>/_agent-native/mcp`                 |
+
+When the chat host asks you to authorize Agent-Native, sign in with your workspace account and approve the MCP scopes:
+
+| Scope       | What it enables                                      |
+| ----------- | ---------------------------------------------------- |
+| `mcp:read`  | Read-only tools and tool/resource discovery          |
+| `mcp:write` | Drafting, updating, and other mutating actions       |
+| `mcp:apps`  | Inline MCP Apps, charts, dashboards, drafts, and UIs |
+
+Each chat host stores its own authorization, so connect Claude, ChatGPT, and other hosts separately.
+
+### Claude and Claude Desktop {#claude-chat}
+
+1. Open Claude.
+2. Go to **Customize → Connectors**.
+3. Choose **Add custom connector**.
+4. Paste the remote MCP URL for the app.
+5. Click **Connect**.
+6. Sign in with your Agent-Native account, then approve `mcp:read`, `mcp:write`, and `mcp:apps`.
+7. Start a chat and enable the connector from the connector/tools menu.
+
+For Team or Enterprise workspaces, an owner or admin may need to add the connector under organization settings first. Each user still connects their own account once, so tool calls run as the signed-in user.
+
+### ChatGPT web {#chatgpt}
+
+ChatGPT's full MCP connector flow is currently workspace/admin gated. Use ChatGPT web in a workspace where custom MCP connectors are enabled.
+
+1. In ChatGPT, open **Workspace settings**.
+2. Enable the setting that allows custom MCP connectors or developer-mode connectors.
+3. Go to **Apps** or **Connectors**, then choose **Create** or **Add custom connector**.
+4. Paste the remote MCP URL for the app.
+5. Choose OAuth authentication.
+6. Scan or discover tools.
+7. Sign in with your Agent-Native account and approve the MCP scopes.
+8. Create the connector, then select it from a new chat's tools/apps menu.
+
+If the ChatGPT workspace does not expose custom MCP connectors, ask a workspace admin to enable them first.
+
+### Cursor {#cursor}
+
+1. Open Cursor → **Settings → MCP**.
+2. Click **Add MCP Server**.
+3. Paste the remote MCP URL for the app and save.
+4. When Cursor prompts, sign in with your Agent-Native account and approve `mcp:read`, `mcp:write`, and `mcp:apps`.
+
+Cursor supports remote-OAuth MCP servers, so the paste-URL flow works the same as Claude — no terminal involved. Goose, Postman, MCPJam, and VS Code GitHub Copilot accept the same URL through their own MCP-server UIs once OAuth support is enabled in your build.
+
+### Quick test prompt {#quick-test}
+
+After connecting, try one of these:
+
+```text
+Use Agent-Native Analytics to generate a weekly conversion-rate bar chart and show it inline.
+```
+
+```text
+Use Agent-Native Mail to draft a short follow-up email to me, but do not send it.
+```
+
+In hosts that support MCP Apps, Analytics can render charts and dashboards inline, and Mail can render draft-review UI inline. In hosts that do not render MCP Apps, the same tool call still returns a deep link such as **Open draft in Mail →** or **Open chart in Analytics →**.
+
+## Advanced setup: local agents {#connect}
+
+Use this flow for local agent clients on your machine — Claude Code, Claude Code CLI, Codex, and Claude Cowork. (Cursor uses the paste-URL flow above; it does not need this CLI path.)
 
 If you have the Agent-Native CLI installed, run:
 
@@ -38,7 +112,7 @@ If you previously connected Claude Code through the old bearer-token flow, just
 | Codex                         | `~/.codex/config.toml` under `[mcp_servers.<app>]`      | Browser-authorized bearer fallback              |
 | Claude Cowork                 | `~/.cowork/mcp.json` using the Claude Code MCP shape    | Browser-authorized bearer fallback              |
 
-There is no token to copy and no local server to run. Restart the agent client after connecting so it picks up the new MCP server; OAuth-native clients may then prompt you to authenticate from their MCP UI.
+Restart the agent client after connecting so it picks up the new MCP server; OAuth-native clients may then prompt you to authenticate from their MCP UI.
 
 Use `--client codex` (or `--client claude-code`, `--client claude-code-cli`, `--client cowork`, `--client all`) to skip the picker for scripts or one-off installs.
 
@@ -52,9 +126,9 @@ The client picker appears once and the same selection is used for every hosted a
 
 The connection is **per-user, scoped, and revocable**. In the OAuth path, the host stores the tokens after `/mcp` authentication; in the fallback path, the browser session you authorized with is the identity the agent acts as. Nothing exposes the deployment's shared secret.
 
-### No-CLI alternative {#no-cli}
+### Connect page fallback {#connect-page-fallback}
 
-If you'd rather not run a command, open the app in your browser and use its **Connect** affordance (served at `https://<app>/_agent-native/mcp/connect`). While logged in, click **Connect / Authorize**. The page hands you either a one-click deep link that configures a detected agent, or a ready-to-paste `.mcp.json` block:
+For MCP clients that cannot add a remote OAuth URL directly, open the app in your browser and use its **Connect** affordance (served at `https://<app>/_agent-native/mcp/connect`). While logged in, click **Connect / Authorize**. The page hands you either a one-click deep link that configures a detected agent, or a ready-to-paste `.mcp.json` block:
 
 ```jsonc
 // .mcp.json