@agent-native/core 0.26.3 → 0.26.6

package/dist/server/ssr-handler.js

@@ -23,7 +23,8 @@ import { runWithRequestContext } from "./request-context.js";
 import { requestHasEmbedAuthMarker } from "./embed-session.js";
 import { EMBED_SESSION_COOKIE, EMBED_TOKEN_QUERY_PARAM, } from "../shared/embed-auth.js";
 import { AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE } from "../shared/social-meta.js";
-export const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+import { DEFAULT_SSR_CACHE_CONTROL } from "../shared/cache-control.js";
+export { DEFAULT_SSR_CACHE_CONTROL } from "../shared/cache-control.js";
 const ANONYMOUS_SESSION_COOKIE_NAMES = new Set(["an_docs_session"]);
 const BETTER_AUTH_SESSION_COOKIE_RE = /\.session_(?:token|data)$/;
 /**
@@ -180,14 +181,26 @@ function isAuthenticatedCookieName(name) {
         bareName === `${BETTER_AUTH_COOKIE_PREFIX}.session_data` ||
         BETTER_AUTH_SESSION_COOKIE_RE.test(bareName));
 }
-function applyDefaultSsrCacheHeader(headers, status) {
-    if (headers.has("cache-control"))
-        return;
+function shouldUseDefaultSsrCacheHeader(headers, status, pathname, hasAuthSignal) {
     if (status < 200 || status >= 400)
-        return;
+        return false;
     const contentType = headers.get("content-type")?.toLowerCase() ?? "";
-    if (!contentType.includes("text/html"))
+    if (contentType.includes("text/html")) {
+        return !headers.has("cache-control");
+    }
+    if (!pathname.endsWith(".data"))
+        return false;
+    if (hasAuthSignal)
+        return false;
+    if (!contentType.includes("text/x-script"))
+        return false;
+    const cacheControl = headers.get("cache-control");
+    return !cacheControl || cacheControl.trim().toLowerCase() === "no-cache";
+}
+function applyDefaultSsrCacheHeader(headers, status, pathname, hasAuthSignal) {
+    if (!shouldUseDefaultSsrCacheHeader(headers, status, pathname, hasAuthSignal)) {
         return;
+    }
     headers.set("cache-control", DEFAULT_SSR_CACHE_CONTROL);
 }
 function isFrameworkOrAssetPath(pathname) {
@@ -205,10 +218,10 @@ function isFrameworkOrAssetPath(pathname) {
         pathname === "/favicon.png" ||
         (/\.\w+$/.test(pathname) && !pathname.endsWith(".data")));
 }
-async function rewriteMountedResponse(response, basePath) {
+async function rewriteMountedResponse(response, basePath, pathname, hasAuthSignal) {
     const sentryClientConfigScript = getSentryClientConfigScript();
     const headers = new Headers(response.headers);
-    applyDefaultSsrCacheHeader(headers, response.status);
+    applyDefaultSsrCacheHeader(headers, response.status, pathname, hasAuthSignal);
     const location = headers.get("location");
     if (location?.startsWith("/") && !location.startsWith("//")) {
         headers.set("location", prefixMountedPath(location, basePath));
@@ -274,9 +287,9 @@ export function createH3SSRHandler(getBuild) {
                     status: response.status,
                     statusText: response.statusText,
                     headers: response.headers,
-                }), basePath);
+                }), basePath, p, hasAuthSignal);
             }
-            return await rewriteMountedResponse(await runWithRequestContext(ctx, () => handler(request)), basePath);
+            return await rewriteMountedResponse(await runWithRequestContext(ctx, () => handler(request)), basePath, p, hasAuthSignal);
         }
         catch (err) {
             // Log the full stack server-side, but never leak it to the client.

package/dist/server/ssr-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAgB,MAAM,IAAI,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAC;AAE7E,MAAM,CAAC,MAAM,yBAAyB,GACpC,uEAAuE,CAAC;AAC1E,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACpE,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAElE;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAc;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,EAAE,KAAK,IAAI,SAAS,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,OAAO,GACX,MAAM,CAAC,IAGR,CAAC,GAAG,CAAC;IACN,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC5B,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,QAAQ,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI;SACR,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,4BAA4B,CAAC,IAAY;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,sCAAsC,iCAAiC,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,uCAAuC,iCAAiC,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;IAClC,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC5B,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACnD,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,yBAAyB,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,YAA2B;IAChE,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,YAAY;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACvD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAC/C,IAAI,CAAC,yBAAyB,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,oBAAoB;QACjC,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,sBAAsB;QACnC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;QAClC,QAAQ,KAAK,GAAG,yBAAyB,gBAAgB;QACzD,QAAQ,KAAK,GAAG,yBAAyB,eAAe;QACxD,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAgB,EAAE,MAAc;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO;IACzC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO;IAE1C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB;IAEhB,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAC/D,wBAAwB,CACzB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,gEAAgE;YAChE,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,OAAO,GAAkD,IAAI,CAAC;YAClE,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,MAAM,GAAG,GAAG;gBACV,SAAS,EAAE,OAAO,EAAE,KAAK,IAAI,SAAS;gBACtC,KAAK;aACN,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,CACT,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Shared SSR catch-all handler for React Router framework mode.\n *\n * Templates wire this up via:\n *\n *   // server/routes/[...page].get.ts\n *   import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n *   export default createH3SSRHandler(\n *     () => import(\"virtual:react-router/server-build\"),\n *   );\n *\n * The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n */\nimport { createRequestHandler } from \"react-router\";\nimport { defineEventHandler, type H3Event } from \"h3\";\nimport { getSentryClientConfigScript } from \"./sentry-config.js\";\nimport { BETTER_AUTH_COOKIE_PREFIX, COOKIE_NAME, getSession } from \"./auth.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { requestHasEmbedAuthMarker } from \"./embed-session.js\";\nimport {\n  EMBED_SESSION_COOKIE,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\nimport { AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE } from \"../shared/social-meta.js\";\n\nexport const DEFAULT_SSR_CACHE_CONTROL =\n  \"public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600\";\nconst ANONYMOUS_SESSION_COOKIE_NAMES = new Set([\"an_docs_session\"]);\nconst BETTER_AUTH_SESSION_COOKIE_RE = /\\.session_(?:token|data)$/;\n\n/**\n * Read the active org for a request without forcing every template to bundle\n * the org module. Mirrors what `core-routes-plugin` does for action handlers.\n */\nasync function readOrgIdForEvent(event: H3Event): Promise<string | undefined> {\n  try {\n    const { getOrgContext } = await import(\"../org/context.js\");\n    const ctx = await getOrgContext(event);\n    return ctx?.orgId ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\nfunction getAppBasePath(): string {\n  const metaEnv = (\n    import.meta as unknown as {\n      env?: Record<string, string | undefined>;\n    }\n  ).env;\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH ||\n      process.env.APP_BASE_PATH ||\n      metaEnv?.VITE_APP_BASE_PATH ||\n      metaEnv?.APP_BASE_PATH ||\n      metaEnv?.BASE_URL,\n  );\n}\n\nfunction stripAppBasePath(pathname: string): string {\n  const basePath = getAppBasePath();\n  return stripBasePath(pathname, basePath);\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n  if (!basePath) return pathname;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) {\n    return pathname.slice(basePath.length) || \"/\";\n  }\n  return pathname;\n}\n\nfunction requestWithPathname(\n  request: Request,\n  pathname: string,\n  basePath: string,\n): Request {\n  const url = new URL(request.url);\n  let changed = false;\n  if (basePath && pathname === \"/__manifest\") {\n    const paths = url.searchParams.get(\"paths\");\n    if (paths) {\n      const strippedPaths = paths\n        .split(\",\")\n        .map((path) => stripBasePath(path, basePath))\n        .join(\",\");\n      if (strippedPaths !== paths) {\n        url.searchParams.set(\"paths\", strippedPaths);\n        changed = true;\n      }\n    }\n  }\n  if (url.pathname !== pathname) {\n    url.pathname = pathname;\n    changed = true;\n  }\n  if (!changed) return request;\n  const init: RequestInit & { duplex?: \"half\" } = {\n    method: request.method,\n    headers: request.headers,\n    signal: request.signal,\n  };\n  if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n    init.body = request.body;\n    init.duplex = \"half\";\n  }\n  return new Request(url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n  if (!basePath || !path.startsWith(\"/\") || path.startsWith(\"//\")) return path;\n  if (path === basePath || path.startsWith(`${basePath}/`)) return path;\n  return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n  if (!basePath) return html;\n  return html\n    .replace(\n      /\\b(href|src|action|formaction|poster)=([\"'])(\\/(?!\\/)[^\"']*)\\2/g,\n      (_match, attr: string, quote: string, path: string) =>\n        `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n    )\n    .replace(/url\\(([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\\)/g, (_match, quote, path) => {\n      const q = quote || \"\";\n      return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n    });\n}\n\nfunction injectHeadScript(html: string, script: string | null): string {\n  if (!script) return html;\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n  return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]*\\bproperty=([\"'])og:image\\1)[^>]*>/i;\nconst TWITTER_CARD_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:card\\1)[^>]*>/i;\nconst TWITTER_IMAGE_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:image\\1)[^>]*>/i;\n\nfunction injectDefaultSocialImageMeta(html: string): string {\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n\n  const hasAnySocialImage =\n    OG_IMAGE_META_RE.test(html) || TWITTER_IMAGE_META_RE.test(html);\n  const tags: string[] = [];\n\n  if (!hasAnySocialImage) {\n    tags.push(\n      `<meta property=\"og:image\" content=\"${AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE}\">`,\n    );\n  }\n  if (!TWITTER_CARD_META_RE.test(html)) {\n    tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n  }\n  if (!hasAnySocialImage) {\n    tags.push(\n      `<meta name=\"twitter:image\" content=\"${AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE}\">`,\n    );\n  }\n\n  if (tags.length === 0) return html;\n  return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction requestHasAuthSignal(event: H3Event): boolean {\n  const headers = event.req.headers;\n  return Boolean(\n    headers.get(\"authorization\") ||\n    requestHasAuthenticatedCookie(headers.get(\"cookie\")) ||\n    event.url.searchParams.has(EMBED_TOKEN_QUERY_PARAM) ||\n    event.url.searchParams.has(\"_session\") ||\n    requestHasEmbedAuthMarker(event),\n  );\n}\n\nfunction requestHasAuthenticatedCookie(cookieHeader: string | null): boolean {\n  if (!cookieHeader) return false;\n  return cookieHeader\n    .split(\";\")\n    .map((cookie) => cookie.trim().split(\"=\", 1)[0]?.trim())\n    .filter((name): name is string => Boolean(name))\n    .some(isAuthenticatedCookieName);\n}\n\nfunction isAuthenticatedCookieName(name: string): boolean {\n  if (ANONYMOUS_SESSION_COOKIE_NAMES.has(name)) return false;\n  const bareName = name.replace(/^__(?:Secure|Host)-/, \"\");\n  return (\n    bareName === COOKIE_NAME ||\n    bareName === EMBED_SESSION_COOKIE ||\n    bareName === \"an_session\" ||\n    bareName === \"an_session_workspace\" ||\n    bareName.startsWith(\"an_session_\") ||\n    bareName === `${BETTER_AUTH_COOKIE_PREFIX}.session_token` ||\n    bareName === `${BETTER_AUTH_COOKIE_PREFIX}.session_data` ||\n    BETTER_AUTH_SESSION_COOKIE_RE.test(bareName)\n  );\n}\n\nfunction applyDefaultSsrCacheHeader(headers: Headers, status: number) {\n  if (headers.has(\"cache-control\")) return;\n  if (status < 200 || status >= 400) return;\n\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (!contentType.includes(\"text/html\")) return;\n\n  headers.set(\"cache-control\", DEFAULT_SSR_CACHE_CONTROL);\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/.well-known/\") ||\n    pathname.startsWith(\"/_agent_native/\") ||\n    pathname.startsWith(\"/_agent-native/\") ||\n    pathname.startsWith(\"/api/\") ||\n    pathname.startsWith(\"/@vite/\") ||\n    pathname.startsWith(\"/@id/\") ||\n    pathname.startsWith(\"/@fs/\") ||\n    pathname === \"/@react-refresh\" ||\n    pathname === \"/__vite_ping\" ||\n    pathname === \"/__open-in-editor\" ||\n    pathname === \"/favicon.ico\" ||\n    pathname === \"/favicon.png\" ||\n    (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n  );\n}\n\nasync function rewriteMountedResponse(\n  response: Response,\n  basePath: string,\n): Promise<Response> {\n  const sentryClientConfigScript = getSentryClientConfigScript();\n  const headers = new Headers(response.headers);\n  applyDefaultSsrCacheHeader(headers, response.status);\n\n  const location = headers.get(\"location\");\n  if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n    headers.set(\"location\", prefixMountedPath(location, basePath));\n  }\n\n  const contentType = headers.get(\"content-type\") ?? \"\";\n  if (!contentType.toLowerCase().includes(\"text/html\") || !response.body) {\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  const html = await response.text();\n  headers.delete(\"content-length\");\n  return new Response(\n    injectHeadScript(\n      injectDefaultSocialImageMeta(prefixMountedHtml(html, basePath)),\n      sentryClientConfigScript,\n    ),\n    {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    },\n  );\n}\n\n/**\n * Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> | unknown) {\n  const handler = createRequestHandler(getBuild as any);\n  return defineEventHandler(async (event) => {\n    const basePath = getAppBasePath();\n    const p = stripAppBasePath(event.url.pathname);\n    if (isFrameworkOrAssetPath(p)) {\n      return new Response(null, { status: 404 });\n    }\n    try {\n      const request = requestWithPathname(event.req as Request, p, basePath);\n      // Pin the active session onto the async request context so React Router\n      // loaders that call `getRequestUserEmail()` / `accessFilter()` see the\n      // signed-in user. Without this, SSR loaders fall through to the\n      // unauthenticated branch even when the user is logged in — which broke\n      // shared-deck \"Presentation link\" access for non-public decks.\n      let session: Awaited<ReturnType<typeof getSession>> | null = null;\n      const hasAuthSignal = requestHasAuthSignal(event);\n      if (hasAuthSignal) {\n        try {\n          session = await getSession(event);\n        } catch {\n          // Auth lookup failures must not break SSR; treat as unauthenticated.\n        }\n      }\n      const orgId = session?.email ? await readOrgIdForEvent(event) : undefined;\n      const ctx = {\n        userEmail: session?.email ?? undefined,\n        orgId,\n      };\n      if (request.method === \"HEAD\") {\n        const getRequest = new Request(request.url, {\n          method: \"GET\",\n          headers: request.headers,\n          signal: request.signal,\n        });\n        const response = await runWithRequestContext(ctx, () =>\n          handler(getRequest),\n        );\n        return await rewriteMountedResponse(\n          new Response(null, {\n            status: response.status,\n            statusText: response.statusText,\n            headers: response.headers,\n          }),\n          basePath,\n        );\n      }\n      return await rewriteMountedResponse(\n        await runWithRequestContext(ctx, () => handler(request)),\n        basePath,\n      );\n    } catch (err) {\n      // Log the full stack server-side, but never leak it to the client.\n      // Stack traces expose file paths, library versions, and code structure\n      // that aid reconnaissance attacks. In dev we surface the message text\n      // so devtools shows something useful; in prod we return a bare 500.\n      console.error(\"[ssr-handler] SSR error:\", err);\n      const isProd = process.env.NODE_ENV === \"production\";\n      const body = isProd\n        ? \"Internal Server Error\"\n        : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n      return new Response(body, {\n        status: 500,\n        headers: { \"content-type\": \"text/plain\" },\n      });\n    }\n  });\n}\n"]}
+{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAgB,MAAM,IAAI,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iCAAiC,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;AACpE,MAAM,6BAA6B,GAAG,2BAA2B,CAAC;AAElE;;;GAGG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAc;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;QACvC,OAAO,GAAG,EAAE,KAAK,IAAI,SAAS,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,OAAO,GACX,MAAM,CAAC,IAGR,CAAC,GAAG,CAAC;IACN,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC5B,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,QAAQ,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,OAAO,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI;SACR,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,4BAA4B,CAAC,IAAY;IAChD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,sCAAsC,iCAAiC,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CACP,uCAAuC,iCAAiC,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;IAClC,OAAO,OAAO,CACZ,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAC5B,6BAA6B,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACnD,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,yBAAyB,CAAC,KAAK,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,YAA2B;IAChE,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,YAAY;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACvD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SAC/C,IAAI,CAAC,yBAAyB,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACzD,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,oBAAoB;QACjC,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,sBAAsB;QACnC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;QAClC,QAAQ,KAAK,GAAG,yBAAyB,gBAAgB;QACzD,QAAQ,KAAK,GAAG,yBAAyB,eAAe;QACxD,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,OAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,aAAsB;IAEtB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAEhD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,aAAa;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAClD,OAAO,CAAC,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;AAC3E,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,aAAsB;IAEtB,IACE,CAAC,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,EACzE,CAAC;QACD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,aAAsB;IAEtB,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAE9E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAC/D,wBAAwB,CACzB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,gEAAgE;YAChE,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,OAAO,GAAkD,IAAI,CAAC;YAClE,MAAM,aAAa,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,MAAM,GAAG,GAAG;gBACV,SAAS,EAAE,OAAO,EAAE,KAAK,IAAI,SAAS;gBACtC,KAAK;aACN,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,EACR,CAAC,EACD,aAAa,CACd,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,EACR,CAAC,EACD,aAAa,CACd,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Shared SSR catch-all handler for React Router framework mode.\n *\n * Templates wire this up via:\n *\n *   // server/routes/[...page].get.ts\n *   import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n *   export default createH3SSRHandler(\n *     () => import(\"virtual:react-router/server-build\"),\n *   );\n *\n * The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n */\nimport { createRequestHandler } from \"react-router\";\nimport { defineEventHandler, type H3Event } from \"h3\";\nimport { getSentryClientConfigScript } from \"./sentry-config.js\";\nimport { BETTER_AUTH_COOKIE_PREFIX, COOKIE_NAME, getSession } from \"./auth.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { requestHasEmbedAuthMarker } from \"./embed-session.js\";\nimport {\n  EMBED_SESSION_COOKIE,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\nimport { AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE } from \"../shared/social-meta.js\";\nimport { DEFAULT_SSR_CACHE_CONTROL } from \"../shared/cache-control.js\";\n\nexport { DEFAULT_SSR_CACHE_CONTROL } from \"../shared/cache-control.js\";\nconst ANONYMOUS_SESSION_COOKIE_NAMES = new Set([\"an_docs_session\"]);\nconst BETTER_AUTH_SESSION_COOKIE_RE = /\\.session_(?:token|data)$/;\n\n/**\n * Read the active org for a request without forcing every template to bundle\n * the org module. Mirrors what `core-routes-plugin` does for action handlers.\n */\nasync function readOrgIdForEvent(event: H3Event): Promise<string | undefined> {\n  try {\n    const { getOrgContext } = await import(\"../org/context.js\");\n    const ctx = await getOrgContext(event);\n    return ctx?.orgId ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\nfunction getAppBasePath(): string {\n  const metaEnv = (\n    import.meta as unknown as {\n      env?: Record<string, string | undefined>;\n    }\n  ).env;\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH ||\n      process.env.APP_BASE_PATH ||\n      metaEnv?.VITE_APP_BASE_PATH ||\n      metaEnv?.APP_BASE_PATH ||\n      metaEnv?.BASE_URL,\n  );\n}\n\nfunction stripAppBasePath(pathname: string): string {\n  const basePath = getAppBasePath();\n  return stripBasePath(pathname, basePath);\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n  if (!basePath) return pathname;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) {\n    return pathname.slice(basePath.length) || \"/\";\n  }\n  return pathname;\n}\n\nfunction requestWithPathname(\n  request: Request,\n  pathname: string,\n  basePath: string,\n): Request {\n  const url = new URL(request.url);\n  let changed = false;\n  if (basePath && pathname === \"/__manifest\") {\n    const paths = url.searchParams.get(\"paths\");\n    if (paths) {\n      const strippedPaths = paths\n        .split(\",\")\n        .map((path) => stripBasePath(path, basePath))\n        .join(\",\");\n      if (strippedPaths !== paths) {\n        url.searchParams.set(\"paths\", strippedPaths);\n        changed = true;\n      }\n    }\n  }\n  if (url.pathname !== pathname) {\n    url.pathname = pathname;\n    changed = true;\n  }\n  if (!changed) return request;\n  const init: RequestInit & { duplex?: \"half\" } = {\n    method: request.method,\n    headers: request.headers,\n    signal: request.signal,\n  };\n  if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n    init.body = request.body;\n    init.duplex = \"half\";\n  }\n  return new Request(url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n  if (!basePath || !path.startsWith(\"/\") || path.startsWith(\"//\")) return path;\n  if (path === basePath || path.startsWith(`${basePath}/`)) return path;\n  return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n  if (!basePath) return html;\n  return html\n    .replace(\n      /\\b(href|src|action|formaction|poster)=([\"'])(\\/(?!\\/)[^\"']*)\\2/g,\n      (_match, attr: string, quote: string, path: string) =>\n        `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n    )\n    .replace(/url\\(([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\\)/g, (_match, quote, path) => {\n      const q = quote || \"\";\n      return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n    });\n}\n\nfunction injectHeadScript(html: string, script: string | null): string {\n  if (!script) return html;\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n  return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]*\\bproperty=([\"'])og:image\\1)[^>]*>/i;\nconst TWITTER_CARD_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:card\\1)[^>]*>/i;\nconst TWITTER_IMAGE_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:image\\1)[^>]*>/i;\n\nfunction injectDefaultSocialImageMeta(html: string): string {\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n\n  const hasAnySocialImage =\n    OG_IMAGE_META_RE.test(html) || TWITTER_IMAGE_META_RE.test(html);\n  const tags: string[] = [];\n\n  if (!hasAnySocialImage) {\n    tags.push(\n      `<meta property=\"og:image\" content=\"${AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE}\">`,\n    );\n  }\n  if (!TWITTER_CARD_META_RE.test(html)) {\n    tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n  }\n  if (!hasAnySocialImage) {\n    tags.push(\n      `<meta name=\"twitter:image\" content=\"${AGENT_NATIVE_DEFAULT_SOCIAL_IMAGE}\">`,\n    );\n  }\n\n  if (tags.length === 0) return html;\n  return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction requestHasAuthSignal(event: H3Event): boolean {\n  const headers = event.req.headers;\n  return Boolean(\n    headers.get(\"authorization\") ||\n    requestHasAuthenticatedCookie(headers.get(\"cookie\")) ||\n    event.url.searchParams.has(EMBED_TOKEN_QUERY_PARAM) ||\n    event.url.searchParams.has(\"_session\") ||\n    requestHasEmbedAuthMarker(event),\n  );\n}\n\nfunction requestHasAuthenticatedCookie(cookieHeader: string | null): boolean {\n  if (!cookieHeader) return false;\n  return cookieHeader\n    .split(\";\")\n    .map((cookie) => cookie.trim().split(\"=\", 1)[0]?.trim())\n    .filter((name): name is string => Boolean(name))\n    .some(isAuthenticatedCookieName);\n}\n\nfunction isAuthenticatedCookieName(name: string): boolean {\n  if (ANONYMOUS_SESSION_COOKIE_NAMES.has(name)) return false;\n  const bareName = name.replace(/^__(?:Secure|Host)-/, \"\");\n  return (\n    bareName === COOKIE_NAME ||\n    bareName === EMBED_SESSION_COOKIE ||\n    bareName === \"an_session\" ||\n    bareName === \"an_session_workspace\" ||\n    bareName.startsWith(\"an_session_\") ||\n    bareName === `${BETTER_AUTH_COOKIE_PREFIX}.session_token` ||\n    bareName === `${BETTER_AUTH_COOKIE_PREFIX}.session_data` ||\n    BETTER_AUTH_SESSION_COOKIE_RE.test(bareName)\n  );\n}\n\nfunction shouldUseDefaultSsrCacheHeader(\n  headers: Headers,\n  status: number,\n  pathname: string,\n  hasAuthSignal: boolean,\n): boolean {\n  if (status < 200 || status >= 400) return false;\n\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (contentType.includes(\"text/html\")) {\n    return !headers.has(\"cache-control\");\n  }\n\n  if (!pathname.endsWith(\".data\")) return false;\n  if (hasAuthSignal) return false;\n  if (!contentType.includes(\"text/x-script\")) return false;\n\n  const cacheControl = headers.get(\"cache-control\");\n  return !cacheControl || cacheControl.trim().toLowerCase() === \"no-cache\";\n}\n\nfunction applyDefaultSsrCacheHeader(\n  headers: Headers,\n  status: number,\n  pathname: string,\n  hasAuthSignal: boolean,\n) {\n  if (\n    !shouldUseDefaultSsrCacheHeader(headers, status, pathname, hasAuthSignal)\n  ) {\n    return;\n  }\n  headers.set(\"cache-control\", DEFAULT_SSR_CACHE_CONTROL);\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/.well-known/\") ||\n    pathname.startsWith(\"/_agent_native/\") ||\n    pathname.startsWith(\"/_agent-native/\") ||\n    pathname.startsWith(\"/api/\") ||\n    pathname.startsWith(\"/@vite/\") ||\n    pathname.startsWith(\"/@id/\") ||\n    pathname.startsWith(\"/@fs/\") ||\n    pathname === \"/@react-refresh\" ||\n    pathname === \"/__vite_ping\" ||\n    pathname === \"/__open-in-editor\" ||\n    pathname === \"/favicon.ico\" ||\n    pathname === \"/favicon.png\" ||\n    (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n  );\n}\n\nasync function rewriteMountedResponse(\n  response: Response,\n  basePath: string,\n  pathname: string,\n  hasAuthSignal: boolean,\n): Promise<Response> {\n  const sentryClientConfigScript = getSentryClientConfigScript();\n  const headers = new Headers(response.headers);\n  applyDefaultSsrCacheHeader(headers, response.status, pathname, hasAuthSignal);\n\n  const location = headers.get(\"location\");\n  if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n    headers.set(\"location\", prefixMountedPath(location, basePath));\n  }\n\n  const contentType = headers.get(\"content-type\") ?? \"\";\n  if (!contentType.toLowerCase().includes(\"text/html\") || !response.body) {\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  const html = await response.text();\n  headers.delete(\"content-length\");\n  return new Response(\n    injectHeadScript(\n      injectDefaultSocialImageMeta(prefixMountedHtml(html, basePath)),\n      sentryClientConfigScript,\n    ),\n    {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    },\n  );\n}\n\n/**\n * Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> | unknown) {\n  const handler = createRequestHandler(getBuild as any);\n  return defineEventHandler(async (event) => {\n    const basePath = getAppBasePath();\n    const p = stripAppBasePath(event.url.pathname);\n    if (isFrameworkOrAssetPath(p)) {\n      return new Response(null, { status: 404 });\n    }\n    try {\n      const request = requestWithPathname(event.req as Request, p, basePath);\n      // Pin the active session onto the async request context so React Router\n      // loaders that call `getRequestUserEmail()` / `accessFilter()` see the\n      // signed-in user. Without this, SSR loaders fall through to the\n      // unauthenticated branch even when the user is logged in — which broke\n      // shared-deck \"Presentation link\" access for non-public decks.\n      let session: Awaited<ReturnType<typeof getSession>> | null = null;\n      const hasAuthSignal = requestHasAuthSignal(event);\n      if (hasAuthSignal) {\n        try {\n          session = await getSession(event);\n        } catch {\n          // Auth lookup failures must not break SSR; treat as unauthenticated.\n        }\n      }\n      const orgId = session?.email ? await readOrgIdForEvent(event) : undefined;\n      const ctx = {\n        userEmail: session?.email ?? undefined,\n        orgId,\n      };\n      if (request.method === \"HEAD\") {\n        const getRequest = new Request(request.url, {\n          method: \"GET\",\n          headers: request.headers,\n          signal: request.signal,\n        });\n        const response = await runWithRequestContext(ctx, () =>\n          handler(getRequest),\n        );\n        return await rewriteMountedResponse(\n          new Response(null, {\n            status: response.status,\n            statusText: response.statusText,\n            headers: response.headers,\n          }),\n          basePath,\n          p,\n          hasAuthSignal,\n        );\n      }\n      return await rewriteMountedResponse(\n        await runWithRequestContext(ctx, () => handler(request)),\n        basePath,\n        p,\n        hasAuthSignal,\n      );\n    } catch (err) {\n      // Log the full stack server-side, but never leak it to the client.\n      // Stack traces expose file paths, library versions, and code structure\n      // that aid reconnaissance attacks. In dev we surface the message text\n      // so devtools shows something useful; in prod we return a bare 500.\n      console.error(\"[ssr-handler] SSR error:\", err);\n      const isProd = process.env.NODE_ENV === \"production\";\n      const body = isProd\n        ? \"Internal Server Error\"\n        : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n      return new Response(body, {\n        status: 500,\n        headers: { \"content-type\": \"text/plain\" },\n      });\n    }\n  });\n}\n"]}

package/dist/shared/cache-control.d.ts

@@ -0,0 +1,2 @@
+export declare const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+//# sourceMappingURL=cache-control.d.ts.map

package/dist/shared/cache-control.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-control.d.ts","sourceRoot":"","sources":["../../src/shared/cache-control.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,yBAAyB,0EACmC,CAAC"}

package/dist/shared/cache-control.js

@@ -0,0 +1,2 @@
+export const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+//# sourceMappingURL=cache-control.js.map

package/dist/shared/cache-control.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-control.js","sourceRoot":"","sources":["../../src/shared/cache-control.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,yBAAyB,GACpC,uEAAuE,CAAC","sourcesContent":["export const DEFAULT_SSR_CACHE_CONTROL =\n  \"public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600\";\n"]}

package/dist/shared/mcp-embed-headers.d.ts

@@ -1,4 +1,5 @@
-export declare const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Embed-Target";
+export declare const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+export declare const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 export declare function isClaudeMcpContentOrigin(origin: string | null | undefined): boolean;
 export declare function isMcpEmbedCorsOrigin(origin: string | null | undefined): boolean;
 export declare function shouldAllowMcpEmbedCredentials(origin: string | null | undefined): boolean;

package/dist/shared/mcp-embed-headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-embed-headers.d.ts","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,iHACuE,CAAC;AAIjH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAET;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAET;AAED,eAAO,MAAM,8BAA8B;;;CAGjC,CAAC;AAmBX,wBAAgB,6BAA6B,CAC3C,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAA;CAAE,CAAC,CAapE"}
+{"version":3,"file":"mcp-embed-headers.d.ts","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,4BAA4B,iKACuH,CAAC;AACjK,eAAO,MAAM,uBAAuB,oCAAoC,CAAC;AAIzE,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAUT;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAET;AAED,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,OAAO,CAET;AAED,eAAO,MAAM,8BAA8B;;;CAGjC,CAAC;AAoBX,wBAAgB,6BAA6B,CAC3C,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,EAAE,OAAO,8BAA8B,CAAA;CAAE,CAAC,CAapE"}

package/dist/shared/mcp-embed-headers.js

@@ -1,4 +1,5 @@
-export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Embed-Target";
+export const MCP_EMBED_CORS_ALLOW_HEADERS = "Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant";
+export const EMBED_TRANSPLANT_HEADER = "x-agent-native-embed-transplant";
 const CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\.claudemcpcontent\.com$/i;
 export function isClaudeMcpContentOrigin(origin) {
     if (!origin)
@@ -28,6 +29,7 @@ const STATIC_ASSET_PATTERNS = [
     "/manifest.json",
     "/icon-*.svg",
     "/agent-native-*.svg",
+    "/library-presets/**",
 ];
 function normalizeBasePath(basePath) {
     const base = (basePath ?? "").trim();

package/dist/shared/mcp-embed-headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-embed-headers.js","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GACvC,8GAA8G,CAAC;AAEjH,MAAM,0BAA0B,GAAG,wCAAwC,CAAC;AAE5E,MAAM,UAAU,wBAAwB,CACtC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAiC;IAEjC,OAAO,MAAM,KAAK,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAiC;IAEjC,OAAO,MAAM,KAAK,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,cAAc;CACtC,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,qBAAqB;CACtB,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAGP,EAAE,CAAC;IACP,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["export const MCP_EMBED_CORS_ALLOW_HEADERS =\n  \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-Agent-Native-Embed-Target\";\n\nconst CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\\.claudemcpcontent\\.com$/i;\n\nexport function isClaudeMcpContentOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" && CLAUDE_MCP_CONTENT_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isMcpEmbedCorsOrigin(\n  origin: string | null | undefined,\n): boolean {\n  return origin === \"null\" || isClaudeMcpContentOrigin(origin);\n}\n\nexport function shouldAllowMcpEmbedCredentials(\n  origin: string | null | undefined,\n): boolean {\n  return origin !== \"null\" && !isClaudeMcpContentOrigin(origin);\n}\n\nexport const MCP_EMBED_STATIC_ASSET_HEADERS = {\n  \"Access-Control-Allow-Origin\": \"*\",\n  \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n} as const;\n\nconst STATIC_ASSET_PATTERNS = [\n  \"/assets/**\",\n  \"/favicon.ico\",\n  \"/favicon.svg\",\n  \"/manifest.json\",\n  \"/icon-*.svg\",\n  \"/agent-native-*.svg\",\n];\n\nfunction normalizeBasePath(basePath: string | undefined): string {\n  const base = (basePath ?? \"\").trim();\n  if (!base || base === \"/\") return \"\";\n  return base.startsWith(\"/\")\n    ? base.replace(/\\/+$/g, \"\")\n    : `/${base.replace(/\\/+$/g, \"\")}`;\n}\n\nexport function mcpEmbedStaticAssetRouteRules(\n  basePath?: string,\n): Record<string, { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }> {\n  const base = normalizeBasePath(basePath);\n  const rules: Record<\n    string,\n    { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }\n  > = {};\n  for (const pattern of STATIC_ASSET_PATTERNS) {\n    rules[pattern] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    if (base) {\n      rules[`${base}${pattern}`] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    }\n  }\n  return rules;\n}\n"]}
+{"version":3,"file":"mcp-embed-headers.js","sourceRoot":"","sources":["../../src/shared/mcp-embed-headers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,4BAA4B,GACvC,8JAA8J,CAAC;AACjK,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAEzE,MAAM,0BAA0B,GAAG,wCAAwC,CAAC;AAE5E,MAAM,UAAU,wBAAwB,CACtC,MAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CACL,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC3E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAiC;IAEjC,OAAO,MAAM,KAAK,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC5C,MAAiC;IAEjC,OAAO,MAAM,KAAK,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,cAAc;CACtC,CAAC;AAEX,MAAM,qBAAqB,GAAG;IAC5B,YAAY;IACZ,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,qBAAqB;IACrB,qBAAqB;CACtB,CAAC;AAEF,SAAS,iBAAiB,CAAC,QAA4B;IACrD,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,KAAK,GAGP,EAAE,CAAC;IACP,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["export const MCP_EMBED_CORS_ALLOW_HEADERS =\n  \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF,X-User-Timezone,X-Agent-Native-Embed-Target,X-Agent-Native-Embed-Transplant\";\nexport const EMBED_TRANSPLANT_HEADER = \"x-agent-native-embed-transplant\";\n\nconst CLAUDE_MCP_CONTENT_HOST_RE = /^[a-f0-9]{32}\\.claudemcpcontent\\.com$/i;\n\nexport function isClaudeMcpContentOrigin(\n  origin: string | null | undefined,\n): boolean {\n  if (!origin) return false;\n  try {\n    const url = new URL(origin);\n    return (\n      url.protocol === \"https:\" && CLAUDE_MCP_CONTENT_HOST_RE.test(url.hostname)\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport function isMcpEmbedCorsOrigin(\n  origin: string | null | undefined,\n): boolean {\n  return origin === \"null\" || isClaudeMcpContentOrigin(origin);\n}\n\nexport function shouldAllowMcpEmbedCredentials(\n  origin: string | null | undefined,\n): boolean {\n  return origin !== \"null\" && !isClaudeMcpContentOrigin(origin);\n}\n\nexport const MCP_EMBED_STATIC_ASSET_HEADERS = {\n  \"Access-Control-Allow-Origin\": \"*\",\n  \"Cross-Origin-Resource-Policy\": \"cross-origin\",\n} as const;\n\nconst STATIC_ASSET_PATTERNS = [\n  \"/assets/**\",\n  \"/favicon.ico\",\n  \"/favicon.svg\",\n  \"/manifest.json\",\n  \"/icon-*.svg\",\n  \"/agent-native-*.svg\",\n  \"/library-presets/**\",\n];\n\nfunction normalizeBasePath(basePath: string | undefined): string {\n  const base = (basePath ?? \"\").trim();\n  if (!base || base === \"/\") return \"\";\n  return base.startsWith(\"/\")\n    ? base.replace(/\\/+$/g, \"\")\n    : `/${base.replace(/\\/+$/g, \"\")}`;\n}\n\nexport function mcpEmbedStaticAssetRouteRules(\n  basePath?: string,\n): Record<string, { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }> {\n  const base = normalizeBasePath(basePath);\n  const rules: Record<\n    string,\n    { headers: typeof MCP_EMBED_STATIC_ASSET_HEADERS }\n  > = {};\n  for (const pattern of STATIC_ASSET_PATTERNS) {\n    rules[pattern] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    if (base) {\n      rules[`${base}${pattern}`] = { headers: MCP_EMBED_STATIC_ASSET_HEADERS };\n    }\n  }\n  return rules;\n}\n"]}

package/dist/templates/workspace-root/package.json

@@ -23,5 +23,10 @@
     "tsx": "catalog:",
     "typescript": "^6.0.3"
   },
+  "pnpm": {
+    "overrides": {
+      "better-auth": "1.6.0"
+    }
+  },
   "packageManager": "pnpm@10.14.0"
 }

package/docs/content/mcp-clients.md

@@ -15,7 +15,11 @@ You can also [connect remote (HTTP) MCP servers at runtime](#remote-via-ui) —
 
 ## Built-in browser and computer-use capabilities {#built-in-capabilities}
 
-Agent-native includes built-in toggles for common local MCP servers. They are off by default and can be enabled per user or per organization:
+Agent-native includes local-development toggles for common stdio MCP servers.
+They are off by default and can be enabled per user or per organization only
+when the app is running locally. Production and hosted serverless runtimes skip
+these built-ins even if old settings rows exist, and the Workspace Resources
+tree does not show them as default `mcp-servers/*.json` resources.
 
 | Capability         | Server id         | Command                                                                 |
 | ------------------ | ----------------- | ----------------------------------------------------------------------- |
@@ -101,13 +105,21 @@ MCP configuration is resolved in this order, first match wins:
 
 ## Production deploys: `MCP_SERVERS` {#mcp-servers-env}
 
-For production deploys set the full config shape (or the inner server map) as an environment variable:
+For production deploys, prefer remote HTTP MCP servers and set the full config
+shape (or the inner server map) as an environment variable:
 
 ```bash
-MCP_SERVERS='{"servers":{"playwright":{"command":"npx","args":["-y","@playwright/mcp@0.0.75"]}}}'
+MCP_SERVERS='{"servers":{"zapier":{"type":"http","url":"https://mcp.example.com/mcp","headers":{"Authorization":"Bearer paste-token-value-here"}}}}'
 ```
 
-MCP tools only activate in Node runtimes — Cloudflare Workers and other edge targets silently skip MCP and continue with the rest of the app working normally.
+`MCP_SERVERS` is parsed as JSON, so `${...}` placeholders are not expanded
+inside the string. If you store the token in another secret, expand it before
+writing the final JSON value.
+
+Stdio MCP servers spawn local binaries and are intended for local development.
+MCP tools only activate in Node runtimes — Cloudflare Workers and other edge
+targets silently skip MCP and continue with the rest of the app working
+normally.
 
 ## Auto-detect: `claude-in-chrome` {#autodetect}
 

package/docs/content/mcp-protocol.md

@@ -238,7 +238,6 @@ Discovery endpoints:
 | ----------------------------------------- | ------------------------------------------- |
 | `/.well-known/oauth-protected-resource`   | RFC 9728 protected-resource metadata        |
 | `/.well-known/oauth-authorization-server` | OAuth authorization server metadata         |
-| `/.well-known/openid-configuration`       | OIDC-compatible metadata alias              |
 | `/_agent-native/mcp/oauth/register`       | Dynamic public-client registration          |
 | `/_agent-native/mcp/oauth/authorize`      | Browser authorization + consent             |
 | `/_agent-native/mcp/oauth/token`          | Authorization-code and refresh-token grants |

package/docs/content/template-assets.md

@@ -96,6 +96,11 @@ for inline hosts. When a user selects an asset, the picker emits `chooseAsset`,
 the legacy `chooseImage` alias for image assets, and updates MCP App model
 context where the host supports it.
 
+For generate-and-choose flows, call `open-asset-picker` with `prompt`,
+`autoGenerate: true`, and `count: 3` (customizable from 1-6). The picker opens
+with candidate images and lets the user adjust count, aspect ratio, or a
+generation preset before choosing the final asset URL.
+
 Use A2A when another agent needs to create, search, or export assets without a
 human picker UI.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.26.3",
+  "version": "0.26.6",
   "type": "module",
   "description": "Framework for agent-native application development — where AI agents and UI share state via files",
   "license": "MIT",
@@ -135,7 +135,7 @@
     "@tiptap/pm": "^3.22.2",
     "@tiptap/react": "^3.22.2",
     "@tiptap/starter-kit": "^3.22.2",
-    "better-auth": "^1.6.0",
+    "better-auth": "1.6.0",
     "better-sqlite3": "^12.8.0",
     "clsx": "^2.1.1",
     "cron-parser": "^5.5.0",

package/src/templates/workspace-root/package.json

@@ -23,5 +23,10 @@
     "tsx": "catalog:",
     "typescript": "^6.0.3"
   },
+  "pnpm": {
+    "overrides": {
+      "better-auth": "1.6.0"
+    }
+  },
   "packageManager": "pnpm@10.14.0"
 }