@agent-native/core 0.22.32 → 0.22.34

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (54) hide show
  1. package/dist/action.d.ts +7 -0
  2. package/dist/action.d.ts.map +1 -1
  3. package/dist/action.js.map +1 -1
  4. package/dist/client/extensions/ExtensionViewer.d.ts.map +1 -1
  5. package/dist/client/extensions/ExtensionViewer.js +26 -1
  6. package/dist/client/extensions/ExtensionViewer.js.map +1 -1
  7. package/dist/client/extensions/ExtensionViewer.spec.d.ts +2 -0
  8. package/dist/client/extensions/ExtensionViewer.spec.d.ts.map +1 -0
  9. package/dist/client/extensions/ExtensionViewer.spec.js +94 -0
  10. package/dist/client/extensions/ExtensionViewer.spec.js.map +1 -0
  11. package/dist/deploy/build.d.ts.map +1 -1
  12. package/dist/deploy/build.js +5 -50
  13. package/dist/deploy/build.js.map +1 -1
  14. package/dist/mcp/build-server.d.ts +8 -0
  15. package/dist/mcp/build-server.d.ts.map +1 -1
  16. package/dist/mcp/build-server.js +55 -13
  17. package/dist/mcp/build-server.js.map +1 -1
  18. package/dist/mcp/embed-app.d.ts.map +1 -1
  19. package/dist/mcp/embed-app.js +19 -0
  20. package/dist/mcp/embed-app.js.map +1 -1
  21. package/dist/mcp/server.d.ts.map +1 -1
  22. package/dist/mcp/server.js +13 -1
  23. package/dist/mcp/server.js.map +1 -1
  24. package/dist/mcp/stdio.d.ts.map +1 -1
  25. package/dist/mcp/stdio.js +9 -2
  26. package/dist/mcp/stdio.js.map +1 -1
  27. package/dist/scripts/dev-session.d.ts +9 -13
  28. package/dist/scripts/dev-session.d.ts.map +1 -1
  29. package/dist/scripts/dev-session.js +28 -18
  30. package/dist/scripts/dev-session.js.map +1 -1
  31. package/dist/scripts/runner.js +1 -1
  32. package/dist/scripts/runner.js.map +1 -1
  33. package/dist/server/auth-marketing.d.ts +14 -0
  34. package/dist/server/auth-marketing.d.ts.map +1 -0
  35. package/dist/server/auth-marketing.js +268 -0
  36. package/dist/server/auth-marketing.js.map +1 -0
  37. package/dist/server/auth.d.ts.map +1 -1
  38. package/dist/server/auth.js +34 -25
  39. package/dist/server/auth.js.map +1 -1
  40. package/dist/server/embed-route.d.ts.map +1 -1
  41. package/dist/server/embed-route.js +39 -1
  42. package/dist/server/embed-route.js.map +1 -1
  43. package/dist/server/onboarding-html.d.ts +6 -0
  44. package/dist/server/onboarding-html.d.ts.map +1 -1
  45. package/dist/server/onboarding-html.js +6 -1
  46. package/dist/server/onboarding-html.js.map +1 -1
  47. package/dist/server/ssr-handler.d.ts +0 -1
  48. package/dist/server/ssr-handler.d.ts.map +1 -1
  49. package/dist/server/ssr-handler.js +6 -7
  50. package/dist/server/ssr-handler.js.map +1 -1
  51. package/docs/content/actions.md +1 -1
  52. package/docs/content/external-agents.md +43 -10
  53. package/docs/content/mcp-protocol.md +18 -1
  54. package/package.json +1 -1
package/dist/server/embed-route.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"embed-route.d.ts","sourceRoot":"","sources":["../../src/server/embed-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAclC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AA8G7C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG1D;AAUD,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACtE;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,sBAA2B,2FAiErC"}
1
+ {"version":3,"file":"embed-route.d.ts","sourceRoot":"","sources":["../../src/server/embed-route.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAclC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAwJ7C,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG1D;AAUD,MAAM,WAAW,sBAAsB;IACrC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;CACtE;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,GAAE,sBAA2B,2FAiErC"}
package/dist/server/embed-route.js CHANGED
@@ -73,6 +73,44 @@ function textResponse(event, message, status) {
73
73
  }),
74
74
  });
75
75
  }
76
+ function expiredEmbedSessionResponse(event) {
77
+ setEmbedStartResponseHeaders(event);
78
+ return new Response(`<!doctype html>
79
+ <html lang="en">
80
+ <head>
81
+ <meta charset="utf-8">
82
+ <meta name="viewport" content="width=device-width, initial-scale=1">
83
+ <title>Embedded app session expired</title>
84
+ <style>
85
+ :root { color-scheme: light dark; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif; background: Canvas; color: CanvasText; }
86
+ * { box-sizing: border-box; }
87
+ body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px; }
88
+ main { max-width: 520px; text-align: center; }
89
+ h1 { margin: 0 0 8px; font-size: 16px; line-height: 1.25; }
90
+ p { margin: 0; color: color-mix(in srgb, CanvasText 64%, Canvas); font-size: 13px; line-height: 1.5; }
91
+ </style>
92
+ </head>
93
+ <body>
94
+ <main>
95
+ <h1>Embedded app session expired</h1>
96
+ <p>This chat preview is refreshing. If it does not reload, ask the chat to open the app again.</p>
97
+ </main>
98
+ <script>
99
+ try {
100
+ if (window.parent && window.parent !== window) {
101
+ window.parent.postMessage({ type: "agentNative.embedSessionExpired" }, "*");
102
+ }
103
+ } catch {}
104
+ </script>
105
+ </body>
106
+ </html>`, {
107
+ status: 401,
108
+ headers: embedStartResponseHeaders(event, {
109
+ "Content-Type": "text/html; charset=utf-8",
110
+ "Cache-Control": "no-store",
111
+ }),
112
+ });
113
+ }
76
114
  export function buildEmbedStartPath(ticket) {
77
115
  const qs = new URLSearchParams({ ticket });
78
116
  return `${getConfiguredAppBasePath()}${EMBED_START_PATH}?${qs}`;
@@ -118,7 +156,7 @@ export function createEmbedStartRouteHandler(options = {}) {
118
156
  expectedOrgId: existingSession?.orgId ?? null,
119
157
  });
120
158
  if (!consumed) {
121
- return textResponse(event, "Invalid or expired embed session.", 401);
159
+ return expiredEmbedSessionResponse(event);
122
160
  }
123
161
  const target = normalizeEmbedTargetPath(consumed.targetPath);
124
162
  if (!target) {
package/dist/server/embed-route.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"embed-route.js","sourceRoot":"","sources":["../../src/server/embed-route.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,iBAAiB,GAClB,MAAM,IAAI,CAAC;AACZ,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,KAAa,EACb,gBAAgB,GAAG,KAAK;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,gBAAgB,EAAE,CAAC;QACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,QAAgB,EAChB,MAAM,GAAG,GAAG;IAEZ,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAC;IACzE,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC;IACtE,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAChE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,kBAAkB,CACnB,CAAC;QACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,+BAA+B,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,OAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,8BAA8B,EAAE,cAAc;QAC9C,4BAA4B,EAAE,aAAa;QAC3C,8BAA8B,EAAE,cAAc;QAC9C,GAAG,IAAI;KACR,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,OAAe,EACf,MAAc;IAEd,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC3B,MAAM;QACN,OAAO,EAAE,yBAAyB,CAAC,KAAK,EAAE;YACxC,cAAc,EAAE,2BAA2B;SAC5C,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,GAAG,wBAAwB,EAAE,GAAG,gBAAgB,IAAI,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;YACpD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACV,CAAC,CAAC,EAAE,CAAC;AACX,CAAC;AAMD,MAAM,UAAU,4BAA4B,CAC1C,UAAkC,EAAE;IAEpC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,yBAAyB,CAAC,KAAK,EAAE;oBACxC,eAAe,EAAE,UAAU;iBAC5B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,yBAAyB,CAAC,KAAK,EAAE;oBACxC,eAAe,EAAE,UAAU;iBAC5B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,YAAY,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,eAAe,GAAG,MAAM,OAAO;aAClC,kBAAkB,EAAE,CAAC,KAAK,CAAC;aAC3B,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE;YACvD,aAAa,EAAE,eAAe,EAAE,KAAK,IAAI,IAAI;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,KAAK,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;QACH,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAE3D,MAAM,gBAAgB,GACpB,eAAe,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,KAAK,GAAG;YAC/D,eAAe,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,KAAK,MAAM,CAAC;QACrE,MAAM,QAAQ,GAAG,sBAAsB,CACrC,8BAA8B,CAC5B,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CACnD,CACF,CAAC;QACF,OAAO,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport {\n defineEventHandler,\n getHeader,\n getMethod,\n getQuery,\n setResponseHeader,\n} from \"h3\";\nimport {\n consumeEmbedSessionTicket,\n normalizeEmbedTargetPath,\n setEmbedSessionCookie,\n signEmbedSessionToken,\n} from \"./embed-session.js\";\nimport type { AuthSession } from \"./auth.js\";\nimport { getConfiguredAppBasePath } from \"./app-base-path.js\";\nimport {\n EMBED_MODE_QUERY_PARAM,\n EMBED_START_PATH,\n EMBED_TOKEN_QUERY_PARAM,\n MCP_APP_CHAT_BRIDGE_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\nimport {\n isMcpEmbedCorsOrigin,\n MCP_EMBED_CORS_ALLOW_HEADERS,\n} from \"../shared/mcp-embed-headers.js\";\nimport { withCollapsedAgentSidebarParam } from \"../shared/agent-sidebar-url.js\";\n\nfunction withConfiguredBasePath(path: string): string {\n const base = getConfiguredAppBasePath();\n if (!base) return path;\n if (path === base || path.startsWith(`${base}/`)) return path;\n return `${base}${path}`;\n}\n\nfunction appendEmbedParams(\n target: string,\n token: string,\n chatBridgeActive = false,\n): string {\n const url = new URL(target, \"http://agent-native.invalid\");\n url.searchParams.set(EMBED_MODE_QUERY_PARAM, \"1\");\n url.searchParams.set(EMBED_TOKEN_QUERY_PARAM, token);\n if (chatBridgeActive) {\n url.searchParams.set(MCP_APP_CHAT_BRIDGE_QUERY_PARAM, \"1\");\n }\n return `${url.pathname}${url.search}${url.hash}`;\n}\n\nfunction redirectWithStagedCookies(\n event: H3Event,\n location: string,\n status = 302,\n): Response {\n setEmbedStartResponseHeaders(event);\n const headers = embedStartResponseHeaders(event, { Location: location });\n const staged = event.res?.headers?.getSetCookie?.() ?? [];\n for (const cookie of staged) headers.append(\"set-cookie\", cookie);\n headers.set(\"Referrer-Policy\", \"no-referrer\");\n return new Response(\"\", { status, headers });\n}\n\nfunction setEmbedStartResponseHeaders(event: H3Event): void {\n setResponseHeader(event, \"Cross-Origin-Embedder-Policy\", \"require-corp\");\n setResponseHeader(event, \"Cross-Origin-Opener-Policy\", \"same-origin\");\n setResponseHeader(event, \"Cross-Origin-Resource-Policy\", \"cross-origin\");\n const origin = embedStartCorsOrigin(event);\n if (origin) {\n setResponseHeader(event, \"Access-Control-Allow-Origin\", origin);\n setResponseHeader(event, \"Vary\", \"Origin\");\n setResponseHeader(\n event,\n \"Access-Control-Allow-Methods\",\n \"GET,HEAD,OPTIONS\",\n );\n setResponseHeader(\n event,\n \"Access-Control-Allow-Headers\",\n MCP_EMBED_CORS_ALLOW_HEADERS,\n );\n setResponseHeader(event, \"Access-Control-Expose-Headers\", \"Location\");\n }\n}\n\nfunction embedStartCorsOrigin(event: H3Event): string | null {\n const origin = getHeader(event, \"origin\");\n return isMcpEmbedCorsOrigin(origin) ? origin : null;\n}\n\nfunction embedStartResponseHeaders(\n event: H3Event,\n init: Record<string, string> = {},\n): Headers {\n const headers = new Headers({\n \"Cross-Origin-Embedder-Policy\": \"require-corp\",\n \"Cross-Origin-Opener-Policy\": \"same-origin\",\n \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n ...init,\n });\n const origin = embedStartCorsOrigin(event);\n if (origin) {\n headers.set(\"Access-Control-Allow-Origin\", origin);\n headers.set(\"Vary\", \"Origin\");\n headers.set(\"Access-Control-Allow-Methods\", \"GET,HEAD,OPTIONS\");\n headers.set(\"Access-Control-Allow-Headers\", MCP_EMBED_CORS_ALLOW_HEADERS);\n headers.set(\"Access-Control-Expose-Headers\", \"Location\");\n }\n return headers;\n}\n\nfunction textResponse(\n event: H3Event,\n message: string,\n status: number,\n): Response {\n setEmbedStartResponseHeaders(event);\n return new Response(message, {\n status,\n headers: embedStartResponseHeaders(event, {\n \"Content-Type\": \"text/plain; charset=utf-8\",\n }),\n });\n}\n\nexport function buildEmbedStartPath(ticket: string): string {\n const qs = new URLSearchParams({ ticket });\n return `${getConfiguredAppBasePath()}${EMBED_START_PATH}?${qs}`;\n}\n\nfunction firstQueryValue(value: unknown): string {\n return typeof value === \"string\"\n ? value\n : Array.isArray(value) && typeof value[0] === \"string\"\n ? value[0]\n : \"\";\n}\n\nexport interface EmbedStartRouteOptions {\n getExistingSession?: (event: H3Event) => Promise<AuthSession | null>;\n}\n\nexport function createEmbedStartRouteHandler(\n options: EmbedStartRouteOptions = {},\n) {\n return defineEventHandler(async (event: H3Event) => {\n const method = getMethod(event);\n if (method === \"OPTIONS\") {\n setEmbedStartResponseHeaders(event);\n return new Response(null, {\n status: 204,\n headers: embedStartResponseHeaders(event, {\n \"Cache-Control\": \"no-store\",\n }),\n });\n }\n\n if (method === \"HEAD\") {\n setEmbedStartResponseHeaders(event);\n return new Response(null, {\n status: 204,\n headers: embedStartResponseHeaders(event, {\n \"Cache-Control\": \"no-store\",\n }),\n });\n }\n\n if (method !== \"GET\") {\n return textResponse(event, \"Method not allowed\", 405);\n }\n\n const query = getQuery(event) ?? {};\n const rawTicket = query.ticket;\n const ticket = Array.isArray(rawTicket) ? rawTicket[0] : rawTicket;\n const existingSession = await options\n .getExistingSession?.(event)\n .catch(() => null);\n const consumed = await consumeEmbedSessionTicket(ticket, {\n expectedOrgId: existingSession?.orgId ?? null,\n });\n if (!consumed) {\n return textResponse(event, \"Invalid or expired embed session.\", 401);\n }\n\n const target = normalizeEmbedTargetPath(consumed.targetPath);\n if (!target) {\n return textResponse(event, \"Invalid embed target.\", 400);\n }\n\n const token = signEmbedSessionToken({\n ownerEmail: consumed.ownerEmail,\n orgId: consumed.orgId,\n targetPath: target,\n scope: consumed.scope,\n });\n setEmbedSessionCookie(event, token);\n setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n\n const chatBridgeActive =\n firstQueryValue(query[MCP_APP_CHAT_BRIDGE_QUERY_PARAM]) === \"1\" ||\n firstQueryValue(query[MCP_APP_CHAT_BRIDGE_QUERY_PARAM]) === \"true\";\n const location = withConfiguredBasePath(\n withCollapsedAgentSidebarParam(\n appendEmbedParams(target, token, chatBridgeActive),\n ),\n );\n return redirectWithStagedCookies(event, location);\n });\n}\n"]}
1
+ {"version":3,"file":"embed-route.js","sourceRoot":"","sources":["../../src/server/embed-route.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,iBAAiB,GAClB,MAAM,IAAI,CAAC;AACZ,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAEhF,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAc,EACd,KAAa,EACb,gBAAgB,GAAG,KAAK;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,gBAAgB,EAAE,CAAC;QACrB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,QAAgB,EAChB,MAAM,GAAG,GAAG;IAEZ,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1D,KAAK,MAAM,MAAM,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc;IAClD,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAC;IACzE,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC;IACtE,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAChE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,kBAAkB,CACnB,CAAC;QACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,+BAA+B,EAAE,UAAU,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,yBAAyB,CAChC,KAAc,EACd,OAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,8BAA8B,EAAE,cAAc;QAC9C,4BAA4B,EAAE,aAAa;QAC3C,8BAA8B,EAAE,cAAc;QAC9C,GAAG,IAAI;KACR,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CACnB,KAAc,EACd,OAAe,EACf,MAAc;IAEd,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC3B,MAAM;QACN,OAAO,EAAE,yBAAyB,CAAC,KAAK,EAAE;YACxC,cAAc,EAAE,2BAA2B;SAC5C,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAc;IACjD,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,IAAI,QAAQ,CACjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4BI,EACJ;QACE,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,yBAAyB,CAAC,KAAK,EAAE;YACxC,cAAc,EAAE,0BAA0B;YAC1C,eAAe,EAAE,UAAU;SAC5B,CAAC;KACH,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,GAAG,wBAAwB,EAAE,GAAG,gBAAgB,IAAI,EAAE,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;YACpD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACV,CAAC,CAAC,EAAE,CAAC;AACX,CAAC;AAMD,MAAM,UAAU,4BAA4B,CAC1C,UAAkC,EAAE;IAEpC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,yBAAyB,CAAC,KAAK,EAAE;oBACxC,eAAe,EAAE,UAAU;iBAC5B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,yBAAyB,CAAC,KAAK,EAAE;oBACxC,eAAe,EAAE,UAAU;iBAC5B,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,YAAY,CAAC,KAAK,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;QAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,eAAe,GAAG,MAAM,OAAO;aAClC,kBAAkB,EAAE,CAAC,KAAK,CAAC;aAC3B,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,MAAM,EAAE;YACvD,aAAa,EAAE,eAAe,EAAE,KAAK,IAAI,IAAI;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,KAAK,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,KAAK,GAAG,qBAAqB,CAAC;YAClC,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,UAAU,EAAE,MAAM;YAClB,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;QACH,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACpC,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAE3D,MAAM,gBAAgB,GACpB,eAAe,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,KAAK,GAAG;YAC/D,eAAe,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,KAAK,MAAM,CAAC;QACrE,MAAM,QAAQ,GAAG,sBAAsB,CACrC,8BAA8B,CAC5B,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,CAAC,CACnD,CACF,CAAC;QACF,OAAO,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport {\n defineEventHandler,\n getHeader,\n getMethod,\n getQuery,\n setResponseHeader,\n} from \"h3\";\nimport {\n consumeEmbedSessionTicket,\n normalizeEmbedTargetPath,\n setEmbedSessionCookie,\n signEmbedSessionToken,\n} from \"./embed-session.js\";\nimport type { AuthSession } from \"./auth.js\";\nimport { getConfiguredAppBasePath } from \"./app-base-path.js\";\nimport {\n EMBED_MODE_QUERY_PARAM,\n EMBED_START_PATH,\n EMBED_TOKEN_QUERY_PARAM,\n MCP_APP_CHAT_BRIDGE_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\nimport {\n isMcpEmbedCorsOrigin,\n MCP_EMBED_CORS_ALLOW_HEADERS,\n} from \"../shared/mcp-embed-headers.js\";\nimport { withCollapsedAgentSidebarParam } from \"../shared/agent-sidebar-url.js\";\n\nfunction withConfiguredBasePath(path: string): string {\n const base = getConfiguredAppBasePath();\n if (!base) return path;\n if (path === base || path.startsWith(`${base}/`)) return path;\n return `${base}${path}`;\n}\n\nfunction appendEmbedParams(\n target: string,\n token: string,\n chatBridgeActive = false,\n): string {\n const url = new URL(target, \"http://agent-native.invalid\");\n url.searchParams.set(EMBED_MODE_QUERY_PARAM, \"1\");\n url.searchParams.set(EMBED_TOKEN_QUERY_PARAM, token);\n if (chatBridgeActive) {\n url.searchParams.set(MCP_APP_CHAT_BRIDGE_QUERY_PARAM, \"1\");\n }\n return `${url.pathname}${url.search}${url.hash}`;\n}\n\nfunction redirectWithStagedCookies(\n event: H3Event,\n location: string,\n status = 302,\n): Response {\n setEmbedStartResponseHeaders(event);\n const headers = embedStartResponseHeaders(event, { Location: location });\n const staged = event.res?.headers?.getSetCookie?.() ?? [];\n for (const cookie of staged) headers.append(\"set-cookie\", cookie);\n headers.set(\"Referrer-Policy\", \"no-referrer\");\n return new Response(\"\", { status, headers });\n}\n\nfunction setEmbedStartResponseHeaders(event: H3Event): void {\n setResponseHeader(event, \"Cross-Origin-Embedder-Policy\", \"require-corp\");\n setResponseHeader(event, \"Cross-Origin-Opener-Policy\", \"same-origin\");\n setResponseHeader(event, \"Cross-Origin-Resource-Policy\", \"cross-origin\");\n const origin = embedStartCorsOrigin(event);\n if (origin) {\n setResponseHeader(event, \"Access-Control-Allow-Origin\", origin);\n setResponseHeader(event, \"Vary\", \"Origin\");\n setResponseHeader(\n event,\n \"Access-Control-Allow-Methods\",\n \"GET,HEAD,OPTIONS\",\n );\n setResponseHeader(\n event,\n \"Access-Control-Allow-Headers\",\n MCP_EMBED_CORS_ALLOW_HEADERS,\n );\n setResponseHeader(event, \"Access-Control-Expose-Headers\", \"Location\");\n }\n}\n\nfunction embedStartCorsOrigin(event: H3Event): string | null {\n const origin = getHeader(event, \"origin\");\n return isMcpEmbedCorsOrigin(origin) ? origin : null;\n}\n\nfunction embedStartResponseHeaders(\n event: H3Event,\n init: Record<string, string> = {},\n): Headers {\n const headers = new Headers({\n \"Cross-Origin-Embedder-Policy\": \"require-corp\",\n \"Cross-Origin-Opener-Policy\": \"same-origin\",\n \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n ...init,\n });\n const origin = embedStartCorsOrigin(event);\n if (origin) {\n headers.set(\"Access-Control-Allow-Origin\", origin);\n headers.set(\"Vary\", \"Origin\");\n headers.set(\"Access-Control-Allow-Methods\", \"GET,HEAD,OPTIONS\");\n headers.set(\"Access-Control-Allow-Headers\", MCP_EMBED_CORS_ALLOW_HEADERS);\n headers.set(\"Access-Control-Expose-Headers\", \"Location\");\n }\n return headers;\n}\n\nfunction textResponse(\n event: H3Event,\n message: string,\n status: number,\n): Response {\n setEmbedStartResponseHeaders(event);\n return new Response(message, {\n status,\n headers: embedStartResponseHeaders(event, {\n \"Content-Type\": \"text/plain; charset=utf-8\",\n }),\n });\n}\n\nfunction expiredEmbedSessionResponse(event: H3Event): Response {\n setEmbedStartResponseHeaders(event);\n return new Response(\n `<!doctype html>\n<html lang=\"en\">\n<head>\n <meta charset=\"utf-8\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n <title>Embedded app session expired</title>\n <style>\n :root { color-scheme: light dark; font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif; background: Canvas; color: CanvasText; }\n * { box-sizing: border-box; }\n body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px; }\n main { max-width: 520px; text-align: center; }\n h1 { margin: 0 0 8px; font-size: 16px; line-height: 1.25; }\n p { margin: 0; color: color-mix(in srgb, CanvasText 64%, Canvas); font-size: 13px; line-height: 1.5; }\n </style>\n</head>\n<body>\n <main>\n <h1>Embedded app session expired</h1>\n <p>This chat preview is refreshing. If it does not reload, ask the chat to open the app again.</p>\n </main>\n <script>\n try {\n if (window.parent && window.parent !== window) {\n window.parent.postMessage({ type: \"agentNative.embedSessionExpired\" }, \"*\");\n }\n } catch {}\n </script>\n</body>\n</html>`,\n {\n status: 401,\n headers: embedStartResponseHeaders(event, {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n }),\n },\n );\n}\n\nexport function buildEmbedStartPath(ticket: string): string {\n const qs = new URLSearchParams({ ticket });\n return `${getConfiguredAppBasePath()}${EMBED_START_PATH}?${qs}`;\n}\n\nfunction firstQueryValue(value: unknown): string {\n return typeof value === \"string\"\n ? value\n : Array.isArray(value) && typeof value[0] === \"string\"\n ? value[0]\n : \"\";\n}\n\nexport interface EmbedStartRouteOptions {\n getExistingSession?: (event: H3Event) => Promise<AuthSession | null>;\n}\n\nexport function createEmbedStartRouteHandler(\n options: EmbedStartRouteOptions = {},\n) {\n return defineEventHandler(async (event: H3Event) => {\n const method = getMethod(event);\n if (method === \"OPTIONS\") {\n setEmbedStartResponseHeaders(event);\n return new Response(null, {\n status: 204,\n headers: embedStartResponseHeaders(event, {\n \"Cache-Control\": \"no-store\",\n }),\n });\n }\n\n if (method === \"HEAD\") {\n setEmbedStartResponseHeaders(event);\n return new Response(null, {\n status: 204,\n headers: embedStartResponseHeaders(event, {\n \"Cache-Control\": \"no-store\",\n }),\n });\n }\n\n if (method !== \"GET\") {\n return textResponse(event, \"Method not allowed\", 405);\n }\n\n const query = getQuery(event) ?? {};\n const rawTicket = query.ticket;\n const ticket = Array.isArray(rawTicket) ? rawTicket[0] : rawTicket;\n const existingSession = await options\n .getExistingSession?.(event)\n .catch(() => null);\n const consumed = await consumeEmbedSessionTicket(ticket, {\n expectedOrgId: existingSession?.orgId ?? null,\n });\n if (!consumed) {\n return expiredEmbedSessionResponse(event);\n }\n\n const target = normalizeEmbedTargetPath(consumed.targetPath);\n if (!target) {\n return textResponse(event, \"Invalid embed target.\", 400);\n }\n\n const token = signEmbedSessionToken({\n ownerEmail: consumed.ownerEmail,\n orgId: consumed.orgId,\n targetPath: target,\n scope: consumed.scope,\n });\n setEmbedSessionCookie(event, token);\n setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n\n const chatBridgeActive =\n firstQueryValue(query[MCP_APP_CHAT_BRIDGE_QUERY_PARAM]) === \"1\" ||\n firstQueryValue(query[MCP_APP_CHAT_BRIDGE_QUERY_PARAM]) === \"true\";\n const location = withConfiguredBasePath(\n withCollapsedAgentSidebarParam(\n appendEmbedParams(target, token, chatBridgeActive),\n ),\n );\n return redirectWithStagedCookies(event, location);\n });\n}\n"]}
package/dist/server/onboarding-html.d.ts CHANGED
@@ -26,6 +26,12 @@ export interface OnboardingHtmlOptions {
26
26
  features?: string[];
27
27
  runLocalCommand?: string;
28
28
  };
29
+ /**
30
+ * Request context used only to recover branded first-party marketing when a
31
+ * default auth guard serves before a template-specific auth plugin.
32
+ */
33
+ requestHost?: string;
34
+ requestPath?: string;
29
35
  /**
30
36
  * Optional preflight copy shown before redirecting through Google sign-in.
31
37
  * Use this when a hosted app needs to warn about provider-specific consent
package/dist/server/onboarding-html.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"onboarding-html.d.ts","sourceRoot":"","sources":["../../src/server/onboarding-html.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAoC/B,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;;OAIG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,qBAA0B,GAAG,MAAM,CAquD1E;AAED,kDAAkD;AAClD,eAAO,MAAM,eAAe,QAAsB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CA0G7C"}
1
+ {"version":3,"file":"onboarding-html.d.ts","sourceRoot":"","sources":["../../src/server/onboarding-html.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAwC/B,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,qBAA0B,GAAG,MAAM,CA0uD1E;AAED,kDAAkD;AAClD,eAAO,MAAM,eAAe,QAAsB,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CA0G7C"}
package/dist/server/onboarding-html.js CHANGED
@@ -10,6 +10,7 @@ import { getPublicOAuthOrigin } from "./oauth-public-origin.js";
10
10
  import { resolveGoogleAuthMode, } from "./google-auth-mode.js";
11
11
  import { getWorkspaceGatewayReturnOrigin } from "./oauth-return-url.js";
12
12
  import { identitySsoLoginButtonHtml } from "./identity-sso-store.js";
13
+ import { resolveBuiltInAuthMarketing, } from "./auth-marketing.js";
13
14
  function hasGoogleOAuth() {
14
15
  return !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
15
16
  }
@@ -50,7 +51,11 @@ export function getOnboardingHtml(opts = {}) {
50
51
  const publicOAuthOrigin = getPublicOAuthOrigin();
51
52
  const workspaceGatewayReturnOrigin = getWorkspaceGatewayReturnOrigin();
52
53
  const googleAuthMode = resolveGoogleAuthMode(opts.googleAuthMode);
53
- const marketing = opts.marketing;
54
+ const marketing = opts.marketing ??
55
+ resolveBuiltInAuthMarketing({
56
+ requestHost: opts.requestHost,
57
+ requestPath: opts.requestPath,
58
+ });
54
59
  const hasMarketing = !!marketing;
55
60
  const runLocalCommand = marketing?.runLocalCommand?.trim();
56
61
  const brandMarkSrc = withAppBasePath("/agent-native-icon-dark.svg");