@agent-native/core 0.26.8 → 0.27.0

package/dist/server/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAsGH;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,GAAE,MAAyB;;GAqB3C"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AA8GH;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,GAAE,MAAyB;;GAqB3C"}

package/dist/server/csrf.js

@@ -89,10 +89,18 @@ const STATE_CHANGING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
  *
  * We accept ANY of these — the goal is "did the request come through a
  * channel the browser would have preflighted", not a strict-mode token.
+ *
+ * NOTE: `Sec-Fetch-Site: same-site` is deliberately NOT trusted. Under a
+ * shared cookie domain (COOKIE_DOMAIN / crossSubDomainCookies), the browser
+ * labels a request from a SIBLING subdomain (evil.example.com → app.example.com)
+ * as `same-site` even though it is cross-origin and would ride the shared
+ * session cookie — a CSRF vector. Legitimate first-party clients all also send
+ * `X-Agent-Native-CSRF` or `application/json`, so they still pass via those
+ * paths and iframe/embed flows are unaffected.
  */
 function looksFirstParty(event) {
     const sfs = getRequestHeader(event, "sec-fetch-site");
-    if (sfs === "same-origin" || sfs === "same-site" || sfs === "none") {
+    if (sfs === "same-origin" || sfs === "none") {
         return true;
     }
     if (getRequestHeader(event, "x-agent-native-csrf")) {

package/dist/server/csrf.js.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,IAAI,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG;IAC9B,4EAA4E;IAC5E,gBAAgB;IAChB,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM;IACN,sEAAsE;IACtE,0EAA0E;IAC1E,4DAA4D;IAC5D,QAAQ;IACR,8DAA8D;IAC9D,kBAAkB;IAClB,uEAAuE;IACvE,2EAA2E;IAC3E,SAAS;IACT,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,+BAA+B;IAC/B,SAAS;IACT,0EAA0E;IAC1E,uEAAuE;IACvE,mBAAmB;CACpB,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3E;;;;;;;;;;;;;;GAcG;AACH,SAAS,eAAe,CAAC,KAAU;IACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACtD,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5D,IACE,WAAW;QACX,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACtD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAU;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,eAAuB;IAC9D,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,kBAA0B,gBAAgB;IAE1C,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAE1D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5D,IAAI,aAAa,CAAC,QAAQ,EAAE,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAE/D,qEAAqE;QACrE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEhD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE7C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,6IAA6I;SAChJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Defense-in-depth CSRF check for framework state-changing routes.\n *\n * Threat model: action endpoints (`/_agent-native/actions/*`), extension\n * endpoints (`/_agent-native/extensions/*` and the legacy\n * `/_agent-native/tools/*` alias), and a handful of other state-changing\n * `/_agent-native/*` routes use the better-auth session cookie, which is\n * configured with `SameSite=None; Secure; Partitioned` so the iframe editor\n * (and other cross-site embeds) can authenticate. `SameSite=None` means the\n * browser ships the session cookie on top-level form POSTs from any origin —\n * which is exactly the precondition for classic cross-site request forgery.\n *\n * The browser still gates \"non-simple\" requests behind a CORS preflight, so\n * an attacker who has to send `Content-Type: application/json` is forced\n * through OPTIONS, which our CORS middleware (`create-server.ts`) rejects\n * for disallowed origins. But the simple-request bypass (`Content-Type:\n * text/plain` on a `<form enctype=\"text/plain\">` POST, or `multipart/form-data`)\n * never preflights — the browser delivers it cross-origin with cookies.\n *\n * Mitigation: this middleware rejects any state-changing\n * (`POST/PUT/PATCH/DELETE`) request to `/_agent-native/*` that\n *\n *   1. carries the auth-cookie pattern (any cookie at all is a heuristic\n *      good-enough proxy — we don't want to deny anonymous fetches), AND\n *   2. is NOT clearly same-origin / first-party. We trust:\n *      - `Sec-Fetch-Site: same-origin` (sent by every modern browser on\n *        same-origin fetch — Chrome/Firefox/Safari/Edge all support it).\n *      - `X-Agent-Native-CSRF` custom header. Custom headers force a\n *        preflight, so an attacker can't add one cross-origin.\n *      - `Content-Type: application/json` request body. Same logic — JSON\n *        Content-Type is a non-simple request that triggers preflight.\n *\n * Why the existing CORS check isn't enough: a simple-request POST never\n * preflights, so the browser sends it through and only blocks the *response*\n * from being readable cross-origin. The state change (delete-account, write\n * SQL, etc.) happens server-side regardless. We need a server-side check that\n * proves first-party intent before running the action.\n *\n * Opt-out marker: a handful of routes legitimately accept cross-origin POSTs\n * — webhook endpoints (Slack, Telegram, email), the public A2A endpoint\n * (`/_agent-native/a2a`), the integrations process-task self-fire, and so on.\n * Those are listed in `CSRF_ALLOWLIST_PREFIXES` below; if you add a new\n * cross-origin-callable route, add it there.\n */\n\nimport {\n  defineEventHandler,\n  getMethod,\n  getRequestHeader,\n  setResponseStatus,\n} from \"h3\";\n\n/**\n * Path prefixes (relative to the framework prefix `/_agent-native`) that are\n * allowed to receive cross-origin state-changing POSTs without first-party\n * markers. These are signed/authenticated through other mechanisms (HMAC,\n * JWT, internal token) so they don't need cookie-based CSRF protection.\n */\nconst CSRF_ALLOWLIST_PREFIXES = [\n  // Integration webhooks — verified by HMAC against a per-integration secret.\n  \"/integrations/\",\n  // A2A JSON-RPC endpoints — verified by signed JWT (when A2A_SECRET set) or\n  // explicitly opt-in unauthenticated (handled at the A2A layer).\n  \"/a2a\",\n  // Better Auth's own login/sign-in/social-callback routes. Better Auth\n  // ships its own CSRF protection (Origin/Sec-Fetch checks on its handlers)\n  // and cookies are needed for the OAuth callback round-trip.\n  \"/auth/\",\n  // Stripe / Paddle / billing webhooks dropped in by templates.\n  \"/billing/webhook\",\n  // Public share endpoints — read-only and never cookie-driven, but kept\n  // here so a templated POST (e.g. comment-on-public-recording) doesn't 403.\n  \"/share/\",\n  // OAuth callbacks (Builder, Google, Slack, Notion, Zoom). These get a\n  // `code` query param via top-level navigation — they DO ride the session\n  // cookie and they SHOULD validate state, but the framework can't see the\n  // state token. Each callback handler is responsible for its own CSRF\n  // check (signed state tokens).\n  \"/oauth/\",\n  // Builder's CLI-auth callback — uses the BUILDER_STATE_PARAM signed token\n  // to authenticate the round-trip; framework CSRF check would block it.\n  \"/builder/callback\",\n];\n\nconst STATE_CHANGING_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Decide whether a request is \"first-party enough\" to trust as not-CSRF.\n * Any of the following make a request non-CSRF:\n *\n *   - `Sec-Fetch-Site: same-origin` (or `none` for top-level navigations\n *     to our own pages — but state-changing methods don't ship `none`).\n *   - `X-Agent-Native-CSRF` header (any value, even \"1\"). This is a custom\n *     header so the browser forces a preflight cross-origin, which our\n *     CORS layer rejects for disallowed origins.\n *   - `Content-Type: application/json` (case-insensitive). JSON content\n *     type is a non-simple request that triggers preflight.\n *\n * We accept ANY of these — the goal is \"did the request come through a\n * channel the browser would have preflighted\", not a strict-mode token.\n */\nfunction looksFirstParty(event: any): boolean {\n  const sfs = getRequestHeader(event, \"sec-fetch-site\");\n  if (sfs === \"same-origin\" || sfs === \"same-site\" || sfs === \"none\") {\n    return true;\n  }\n  if (getRequestHeader(event, \"x-agent-native-csrf\")) {\n    return true;\n  }\n  const contentType = getRequestHeader(event, \"content-type\");\n  if (\n    contentType &&\n    typeof contentType === \"string\" &&\n    contentType.toLowerCase().includes(\"application/json\")\n  ) {\n    return true;\n  }\n  return false;\n}\n\n/**\n * Returns true when the request carries any cookie. We use \"has any cookie\"\n * as a coarse heuristic for \"the browser is going to attach the session\n * cookie\" — anonymous tools (curl, server-to-server) typically don't send\n * cookies, so they bypass this check entirely.\n */\nfunction requestHasCookies(event: any): boolean {\n  const cookie = getRequestHeader(event, \"cookie\");\n  return typeof cookie === \"string\" && cookie.trim().length > 0;\n}\n\n/**\n * Path passed in is the full request URL pathname (e.g. `/_agent-native/actions/foo`).\n * `frameworkPrefix` should be the framework route prefix without trailing slash,\n * e.g. `/_agent-native`.\n */\nfunction isOnAllowlist(pathname: string, frameworkPrefix: string): boolean {\n  if (!pathname.startsWith(frameworkPrefix)) return false;\n  const sub = pathname.slice(frameworkPrefix.length);\n  for (const allowed of CSRF_ALLOWLIST_PREFIXES) {\n    if (sub.startsWith(allowed)) return true;\n  }\n  return false;\n}\n\n/**\n * Create the framework CSRF middleware.\n *\n * Mount this BEFORE any state-changing route handler. The middleware\n *   - lets every non-state-changing method through (GET/HEAD/OPTIONS).\n *   - lets requests without cookies through (anonymous/server tools).\n *   - lets allowlisted paths through (webhooks, A2A, OAuth callbacks).\n *   - lets first-party-shaped requests through (custom header, JSON\n *     Content-Type, or `Sec-Fetch-Site: same-origin`).\n *   - rejects everything else with 403.\n */\nexport function createCsrfMiddleware(\n  frameworkPrefix: string = \"/_agent-native\",\n) {\n  return defineEventHandler((event) => {\n    const method = getMethod(event);\n    if (!STATE_CHANGING_METHODS.has(method)) return undefined;\n\n    const pathname = event.url?.pathname ?? \"\";\n    if (!pathname.startsWith(frameworkPrefix)) return undefined;\n    if (isOnAllowlist(pathname, frameworkPrefix)) return undefined;\n\n    // No cookie = no risk of confused-deputy CSRF on the session cookie.\n    if (!requestHasCookies(event)) return undefined;\n\n    if (looksFirstParty(event)) return undefined;\n\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"CSRF check failed: state-changing requests must include a same-origin marker. Set Content-Type: application/json or X-Agent-Native-CSRF: 1.\",\n    };\n  });\n}\n"]}
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/server/csrf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,IAAI,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG;IAC9B,4EAA4E;IAC5E,gBAAgB;IAChB,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM;IACN,sEAAsE;IACtE,0EAA0E;IAC1E,4DAA4D;IAC5D,QAAQ;IACR,8DAA8D;IAC9D,kBAAkB;IAClB,uEAAuE;IACvE,2EAA2E;IAC3E,SAAS;IACT,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,+BAA+B;IAC/B,SAAS;IACT,0EAA0E;IAC1E,uEAAuE;IACvE,mBAAmB;CACpB,CAAC;AAEF,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE3E;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,eAAe,CAAC,KAAU;IACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACtD,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IAC5D,IACE,WAAW;QACX,OAAO,WAAW,KAAK,QAAQ;QAC/B,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EACtD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAU;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,eAAuB;IAC9D,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;QAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,kBAA0B,gBAAgB;IAE1C,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAE1D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5D,IAAI,aAAa,CAAC,QAAQ,EAAE,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAE/D,qEAAqE;QACrE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAEhD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE7C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,KAAK,EACH,6IAA6I;SAChJ,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Defense-in-depth CSRF check for framework state-changing routes.\n *\n * Threat model: action endpoints (`/_agent-native/actions/*`), extension\n * endpoints (`/_agent-native/extensions/*` and the legacy\n * `/_agent-native/tools/*` alias), and a handful of other state-changing\n * `/_agent-native/*` routes use the better-auth session cookie, which is\n * configured with `SameSite=None; Secure; Partitioned` so the iframe editor\n * (and other cross-site embeds) can authenticate. `SameSite=None` means the\n * browser ships the session cookie on top-level form POSTs from any origin —\n * which is exactly the precondition for classic cross-site request forgery.\n *\n * The browser still gates \"non-simple\" requests behind a CORS preflight, so\n * an attacker who has to send `Content-Type: application/json` is forced\n * through OPTIONS, which our CORS middleware (`create-server.ts`) rejects\n * for disallowed origins. But the simple-request bypass (`Content-Type:\n * text/plain` on a `<form enctype=\"text/plain\">` POST, or `multipart/form-data`)\n * never preflights — the browser delivers it cross-origin with cookies.\n *\n * Mitigation: this middleware rejects any state-changing\n * (`POST/PUT/PATCH/DELETE`) request to `/_agent-native/*` that\n *\n *   1. carries the auth-cookie pattern (any cookie at all is a heuristic\n *      good-enough proxy — we don't want to deny anonymous fetches), AND\n *   2. is NOT clearly same-origin / first-party. We trust:\n *      - `Sec-Fetch-Site: same-origin` (sent by every modern browser on\n *        same-origin fetch — Chrome/Firefox/Safari/Edge all support it).\n *      - `X-Agent-Native-CSRF` custom header. Custom headers force a\n *        preflight, so an attacker can't add one cross-origin.\n *      - `Content-Type: application/json` request body. Same logic — JSON\n *        Content-Type is a non-simple request that triggers preflight.\n *\n * Why the existing CORS check isn't enough: a simple-request POST never\n * preflights, so the browser sends it through and only blocks the *response*\n * from being readable cross-origin. The state change (delete-account, write\n * SQL, etc.) happens server-side regardless. We need a server-side check that\n * proves first-party intent before running the action.\n *\n * Opt-out marker: a handful of routes legitimately accept cross-origin POSTs\n * — webhook endpoints (Slack, Telegram, email), the public A2A endpoint\n * (`/_agent-native/a2a`), the integrations process-task self-fire, and so on.\n * Those are listed in `CSRF_ALLOWLIST_PREFIXES` below; if you add a new\n * cross-origin-callable route, add it there.\n */\n\nimport {\n  defineEventHandler,\n  getMethod,\n  getRequestHeader,\n  setResponseStatus,\n} from \"h3\";\n\n/**\n * Path prefixes (relative to the framework prefix `/_agent-native`) that are\n * allowed to receive cross-origin state-changing POSTs without first-party\n * markers. These are signed/authenticated through other mechanisms (HMAC,\n * JWT, internal token) so they don't need cookie-based CSRF protection.\n */\nconst CSRF_ALLOWLIST_PREFIXES = [\n  // Integration webhooks — verified by HMAC against a per-integration secret.\n  \"/integrations/\",\n  // A2A JSON-RPC endpoints — verified by signed JWT (when A2A_SECRET set) or\n  // explicitly opt-in unauthenticated (handled at the A2A layer).\n  \"/a2a\",\n  // Better Auth's own login/sign-in/social-callback routes. Better Auth\n  // ships its own CSRF protection (Origin/Sec-Fetch checks on its handlers)\n  // and cookies are needed for the OAuth callback round-trip.\n  \"/auth/\",\n  // Stripe / Paddle / billing webhooks dropped in by templates.\n  \"/billing/webhook\",\n  // Public share endpoints — read-only and never cookie-driven, but kept\n  // here so a templated POST (e.g. comment-on-public-recording) doesn't 403.\n  \"/share/\",\n  // OAuth callbacks (Builder, Google, Slack, Notion, Zoom). These get a\n  // `code` query param via top-level navigation — they DO ride the session\n  // cookie and they SHOULD validate state, but the framework can't see the\n  // state token. Each callback handler is responsible for its own CSRF\n  // check (signed state tokens).\n  \"/oauth/\",\n  // Builder's CLI-auth callback — uses the BUILDER_STATE_PARAM signed token\n  // to authenticate the round-trip; framework CSRF check would block it.\n  \"/builder/callback\",\n];\n\nconst STATE_CHANGING_METHODS = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/**\n * Decide whether a request is \"first-party enough\" to trust as not-CSRF.\n * Any of the following make a request non-CSRF:\n *\n *   - `Sec-Fetch-Site: same-origin` (or `none` for top-level navigations\n *     to our own pages — but state-changing methods don't ship `none`).\n *   - `X-Agent-Native-CSRF` header (any value, even \"1\"). This is a custom\n *     header so the browser forces a preflight cross-origin, which our\n *     CORS layer rejects for disallowed origins.\n *   - `Content-Type: application/json` (case-insensitive). JSON content\n *     type is a non-simple request that triggers preflight.\n *\n * We accept ANY of these — the goal is \"did the request come through a\n * channel the browser would have preflighted\", not a strict-mode token.\n *\n * NOTE: `Sec-Fetch-Site: same-site` is deliberately NOT trusted. Under a\n * shared cookie domain (COOKIE_DOMAIN / crossSubDomainCookies), the browser\n * labels a request from a SIBLING subdomain (evil.example.com → app.example.com)\n * as `same-site` even though it is cross-origin and would ride the shared\n * session cookie — a CSRF vector. Legitimate first-party clients all also send\n * `X-Agent-Native-CSRF` or `application/json`, so they still pass via those\n * paths and iframe/embed flows are unaffected.\n */\nfunction looksFirstParty(event: any): boolean {\n  const sfs = getRequestHeader(event, \"sec-fetch-site\");\n  if (sfs === \"same-origin\" || sfs === \"none\") {\n    return true;\n  }\n  if (getRequestHeader(event, \"x-agent-native-csrf\")) {\n    return true;\n  }\n  const contentType = getRequestHeader(event, \"content-type\");\n  if (\n    contentType &&\n    typeof contentType === \"string\" &&\n    contentType.toLowerCase().includes(\"application/json\")\n  ) {\n    return true;\n  }\n  return false;\n}\n\n/**\n * Returns true when the request carries any cookie. We use \"has any cookie\"\n * as a coarse heuristic for \"the browser is going to attach the session\n * cookie\" — anonymous tools (curl, server-to-server) typically don't send\n * cookies, so they bypass this check entirely.\n */\nfunction requestHasCookies(event: any): boolean {\n  const cookie = getRequestHeader(event, \"cookie\");\n  return typeof cookie === \"string\" && cookie.trim().length > 0;\n}\n\n/**\n * Path passed in is the full request URL pathname (e.g. `/_agent-native/actions/foo`).\n * `frameworkPrefix` should be the framework route prefix without trailing slash,\n * e.g. `/_agent-native`.\n */\nfunction isOnAllowlist(pathname: string, frameworkPrefix: string): boolean {\n  if (!pathname.startsWith(frameworkPrefix)) return false;\n  const sub = pathname.slice(frameworkPrefix.length);\n  for (const allowed of CSRF_ALLOWLIST_PREFIXES) {\n    if (sub.startsWith(allowed)) return true;\n  }\n  return false;\n}\n\n/**\n * Create the framework CSRF middleware.\n *\n * Mount this BEFORE any state-changing route handler. The middleware\n *   - lets every non-state-changing method through (GET/HEAD/OPTIONS).\n *   - lets requests without cookies through (anonymous/server tools).\n *   - lets allowlisted paths through (webhooks, A2A, OAuth callbacks).\n *   - lets first-party-shaped requests through (custom header, JSON\n *     Content-Type, or `Sec-Fetch-Site: same-origin`).\n *   - rejects everything else with 403.\n */\nexport function createCsrfMiddleware(\n  frameworkPrefix: string = \"/_agent-native\",\n) {\n  return defineEventHandler((event) => {\n    const method = getMethod(event);\n    if (!STATE_CHANGING_METHODS.has(method)) return undefined;\n\n    const pathname = event.url?.pathname ?? \"\";\n    if (!pathname.startsWith(frameworkPrefix)) return undefined;\n    if (isOnAllowlist(pathname, frameworkPrefix)) return undefined;\n\n    // No cookie = no risk of confused-deputy CSRF on the session cookie.\n    if (!requestHasCookies(event)) return undefined;\n\n    if (looksFirstParty(event)) return undefined;\n\n    setResponseStatus(event, 403);\n    return {\n      error:\n        \"CSRF check failed: state-changing requests must include a same-origin marker. Set Content-Type: application/json or X-Agent-Native-CSRF: 1.\",\n    };\n  });\n}\n"]}

package/dist/server/design-token-utils.d.ts

@@ -87,7 +87,14 @@ export interface GitHubJsonResult<T = unknown> {
     data: T | null;
     message?: string;
 }
-/** Validate a URL is safe to fetch (blocks localhost, private IPs, metadata endpoints). */
+/**
+ * Cheap synchronous pre-filter for obviously-internal URLs. This is a fast
+ * fail, NOT the real guard: it cannot resolve DNS and does not re-check
+ * redirects. All actual outbound fetches in this module go through
+ * `ssrfSafeFetch`, which performs the DNS-aware check, a connect-time
+ * private-IP guard, and per-redirect re-validation. Keep both: this gives a
+ * clear early error for literal private hosts, ssrfSafeFetch is the backstop.
+ */
 export declare function validateUrl(url: string): void;
 /** Parse a GitHub URL or "org/repo" shorthand into owner + repo. */
 export declare function parseOwnerRepo(raw: string): {

package/dist/server/design-token-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"design-token-utils.d.ts","sourceRoot":"","sources":["../../src/server/design-token-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,kEAAkE;AAClE,eAAO,MAAM,SAAS,KAAK,CAAC;AAE5B,6CAA6C;AAC7C,eAAO,MAAM,aAAa,QAAa,CAAC;AAExC,qDAAqD;AACrD,eAAO,MAAM,aAAa,QAAQ,CAAC;AAEnC,uDAAuD;AACvD,eAAO,MAAM,aAAa,EAAE,MAAM,EAOjC,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,eAAe,EAAE,MAAM,EASnC,CAAC;AAEF,6CAA6C;AAC7C,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,mDAAmD;AACnD,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,yDAAyD;AACzD,eAAO,MAAM,YAAY,QAAkC,CAAC;AAE5D,6CAA6C;AAC7C,eAAO,MAAM,cAAc,QACoM,CAAC;AAEhO,iEAAiE;AACjE,eAAO,MAAM,YAAY,QACma,CAAC;AAE7b,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,QAC0B,CAAC;AAEzD,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAgBhE,CAAC;AAMF,MAAM,MAAM,WAAW,GACnB,cAAc,GACd,UAAU,GACV,aAAa,GACb,KAAK,GACL,OAAO,CAAC;AAEZ,MAAM,WAAW,SAAS;IACxB,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACxD,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IACjE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,OAAO;IAC3C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,2FAA2F;AAC3F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA2B7C;AAMD,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CA2BA;AAcD,6EAA6E;AAC7E,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAuB9B;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,8FAA8F;AAC9F,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAMD,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgE5E;AAMD,oFAAoF;AACpF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CA+BnD;AAMD,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmB1E;AAMD,0DAA0D;AAC1D,wBAAgB,uBAAuB,IAAI,iBAAiB,CAW3D;AAED,yDAAyD;AACzD,wBAAgB,OAAO,CACrB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAKN;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAC5B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,GACd,IAAI,CAoBN;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,GACd,IAAI,CAwBN;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CA0BN;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAC5B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CAKN;AAED,iDAAiD;AACjD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CAmDN;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CA4CN;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CA8BN;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CAgCN;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAC7B,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,IAAI,CA+CN;AAMD,gDAAgD;AAChD,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE9C;AAED,oDAAoD;AACpD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAI5D;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG3D;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAyB1D;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,GACf,MAAM,EAAE,CAoDV;AAMD,yDAAyD;AACzD,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC,CA8G9B"}
+{"version":3,"file":"design-token-utils.d.ts","sourceRoot":"","sources":["../../src/server/design-token-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,kEAAkE;AAClE,eAAO,MAAM,SAAS,KAAK,CAAC;AAE5B,6CAA6C;AAC7C,eAAO,MAAM,aAAa,QAAa,CAAC;AAExC,qDAAqD;AACrD,eAAO,MAAM,aAAa,QAAQ,CAAC;AAEnC,uDAAuD;AACvD,eAAO,MAAM,aAAa,EAAE,MAAM,EAOjC,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,eAAe,EAAE,MAAM,EASnC,CAAC;AAEF,6CAA6C;AAC7C,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,mDAAmD;AACnD,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,yDAAyD;AACzD,eAAO,MAAM,YAAY,QAAkC,CAAC;AAE5D,6CAA6C;AAC7C,eAAO,MAAM,cAAc,QACoM,CAAC;AAEhO,iEAAiE;AACjE,eAAO,MAAM,YAAY,QACma,CAAC;AAE7b,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,QAC0B,CAAC;AAEzD,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAgBhE,CAAC;AAMF,MAAM,MAAM,WAAW,GACnB,cAAc,GACd,UAAU,GACV,aAAa,GACb,KAAK,GACL,OAAO,CAAC;AAEZ,MAAM,WAAW,SAAS;IACxB,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACxD,KAAK,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IACjE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAChD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,OAAO;IAC3C,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CA2B7C;AAMD,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd,CA2BA;AAcD,6EAA6E;AAC7E,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAuB9B;AAED,gFAAgF;AAChF,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,8FAA8F;AAC9F,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAMD,uFAAuF;AACvF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgE5E;AAMD,oFAAoF;AACpF,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CA+BnD;AAMD,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmB1E;AAMD,0DAA0D;AAC1D,wBAAgB,uBAAuB,IAAI,iBAAiB,CAW3D;AAED,yDAAyD;AACzD,wBAAgB,OAAO,CACrB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,IAAI,CAKN;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAC5B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,GACd,IAAI,CAoBN;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,GACd,IAAI,CAwBN;AAED,oFAAoF;AACpF,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CA0BN;AAED,wEAAwE;AACxE,wBAAgB,cAAc,CAC5B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CAKN;AAED,iDAAiD;AACjD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CAmDN;AAED,qEAAqE;AACrE,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CA4CN;AAED,uDAAuD;AACvD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CA8BN;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,iBAAiB,EACxB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI,CAgCN;AAED,8DAA8D;AAC9D,wBAAgB,eAAe,CAC7B,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GACd,IAAI,CA+CN;AAMD,gDAAgD;AAChD,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAE9C;AAED,oDAAoD;AACpD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAI5D;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG3D;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAyB1D;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,WAAW,EACxB,OAAO,EAAE,OAAO,GACf,MAAM,EAAE,CAoDV;AAMD,yDAAyD;AACzD,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,mBAAmB,CAAC,CA8G9B"}

package/dist/server/design-token-utils.js

@@ -8,6 +8,7 @@
  *
  * No framework dependencies — no defineAction, no zod, no drizzle.
  */
+import { ssrfSafeFetch } from "../extensions/url-safety.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -70,7 +71,14 @@ export const FRAMEWORK_DETECTORS = [
 // ---------------------------------------------------------------------------
 // SSRF Guard
 // ---------------------------------------------------------------------------
-/** Validate a URL is safe to fetch (blocks localhost, private IPs, metadata endpoints). */
+/**
+ * Cheap synchronous pre-filter for obviously-internal URLs. This is a fast
+ * fail, NOT the real guard: it cannot resolve DNS and does not re-check
+ * redirects. All actual outbound fetches in this module go through
+ * `ssrfSafeFetch`, which performs the DNS-aware check, a connect-time
+ * private-IP guard, and per-redirect re-validation. Keep both: this gives a
+ * clear early error for literal private hosts, ssrfSafeFetch is the backstop.
+ */
 export function validateUrl(url) {
     const parsed = new URL(url);
     if (!["http:", "https:"].includes(parsed.protocol)) {
@@ -133,7 +141,7 @@ function githubHeaders(accept, options = {}) {
 export async function fetchGitHubJsonResult(owner, repo, path, options = {}) {
     const url = `https://api.github.com/repos/${owner}/${repo}/contents/${path}`;
     validateUrl(url);
-    const res = await fetch(url, {
+    const res = await ssrfSafeFetch(url, {
         headers: githubHeaders("application/vnd.github.v3+json", options),
         signal: AbortSignal.timeout(FETCH_TIMEOUT),
     });
@@ -167,7 +175,7 @@ export async function fetchGitHubJson(owner, repo, path, options = {}) {
 export async function fetchGitHubRaw(owner, repo, path, options = {}) {
     const url = `https://api.github.com/repos/${owner}/${repo}/contents/${path}`;
     validateUrl(url);
-    const res = await fetch(url, {
+    const res = await ssrfSafeFetch(url, {
         headers: githubHeaders("application/vnd.github.v3.raw", options),
         signal: AbortSignal.timeout(FETCH_TIMEOUT),
     });
@@ -659,7 +667,7 @@ export function suggestionsForType(contentType, hasText) {
 export async function extractDesignTokensFromUrl(rawUrl) {
     const url = rawUrl.startsWith("http") ? rawUrl : `https://${rawUrl}`;
     validateUrl(url);
-    const response = await fetch(url, {
+    const response = await ssrfSafeFetch(url, {
         headers: {
             "User-Agent": "Mozilla/5.0 (compatible; AgentNative/1.0; +https://agent-native.com)",
         },

package/dist/server/design-token-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"design-token-utils.js","sourceRoot":"","sources":["../../src/server/design-token-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,kEAAkE;AAClE,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAE5B,6CAA6C;AAC7C,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC;AAExC,qDAAqD;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAEnC,uDAAuD;AACvD,MAAM,CAAC,MAAM,aAAa,GAAa;IACrC,yBAAyB;IACzB,wBAAwB;IACxB,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,QAAQ;CACT,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,YAAY;IACZ,QAAQ;IACR,WAAW;IACX,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,qBAAqB;CACtB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,mDAAmD;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE/C,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAE5D,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GACzB,6NAA6N,CAAC;AAEhO,iEAAiE;AACjE,MAAM,CAAC,MAAM,YAAY,GACvB,0bAA0b,CAAC;AAE7b,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAC5B,sDAAsD,CAAC;AAEzD,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAsC;IACpE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE;IAC1C,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE;IAC/C,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACzD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC5C,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC7C,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;IACrC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;IAC7C,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE;IAC1D,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;IACvC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE;IACzC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE;IAC7C,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE;CACrC,CAAC;AA4DF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,2FAA2F;AAC3F,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IACE,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,OAAO;QACpB,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC9B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,QAAQ,KAAK,0BAA0B;QACvC,QAAQ,KAAK,iBAAiB,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,GAAW;IAIxC,MAAM,OAAO,GAAG,GAAG;SAChB,IAAI,EAAE;SACN,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,+DAA+D,CAChE,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACrE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,sDAAsD,CACvD,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8CAA8C;QAC5C,8FAA8F,CACjG,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CACpB,MAAc,EACd,UAA8B,EAAE;IAEhC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,YAAY,EAAE,iBAAiB;QAC/B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,IAAY,EACZ,IAAY,EACZ,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,gCAAgC,KAAK,IAAI,IAAI,aAAa,IAAI,EAAE,CAAC;IAC7E,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,aAAa,CAAC,gCAAgC,EAAE,OAAO,CAAC;QACjE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;YACzD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,EAAE,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,IAAY,EACZ,IAAY,EACZ,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,IAAY,EACZ,IAAY,EACZ,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,gCAAgC,KAAK,IAAI,IAAI,aAAa,IAAI,EAAE,CAAC;IAC7E,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,aAAa,CAAC,+BAA+B,EAAE,OAAO,CAAC;QAChE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,aAAa;QAAE,OAAO,IAAI,CAAC;IAExD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAC/B,8CAA8C,CAC/C,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CACnC,4CAA4C,CAC7C,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAC7B,kDAAkD,CACnD,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CACjC,kDAAkD,CACnD,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;IAC/D,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAChC,+CAA+C,CAChD,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CACpC,6CAA6C,CAC9C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAChE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAC/B,oDAAoD,CACrD,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CACnC,4CAA4C,CAC7C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC;IACjE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,oFAAoF;AACpF,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,mBAAmB,GAA2B,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IACtE,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACxE,IAAI,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CACpC,qEAAqE,CACtE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,OAAO;QACL,mBAAmB,EACjB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC;YACzC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,SAAS;QACf,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAC1D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,+DAA+D;AAC/D,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG;YACV,GAAG,GAAG,CAAC,YAAY;YACnB,GAAG,GAAG,CAAC,eAAe;SACvB,CAAC;QACF,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC;YAAE,OAAO,aAAa,CAAC;QACxE,IAAI,GAAG,CAAC,mBAAmB,CAAC;YAAE,OAAO,mBAAmB,CAAC;QACzD,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC;YAAE,OAAO,SAAS,CAAC;QACtE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAC/B,IAAI,GAAG,CAAC,sBAAsB,CAAC;YAAE,OAAO,iBAAiB,CAAC;QAC1D,IAAI,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QACvC,IAAI,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,MAAM,EAAE,EAAE;QACV,mBAAmB,EAAE,EAAE;QACvB,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,EAAE;QAChB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,IAAI,GAAG,EAAU;KAC7B,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,OAAO,CACrB,KAAwB,EACxB,MAAc,EACd,MAAe;IAEf,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO;IACzE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAC5B,KAAwB,EACxB,OAAe;IAEf,MAAM,OAAO,GAAG,8BAA8B,CAAC;IAC/C,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAExC,IACE,oFAAoF,CAAC,IAAI,CACvF,KAAK,CAAC,CAAC,CAAC,CACT,EACD,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC7B,CAAC;aAAM,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;aAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,OAAe;IAEf,MAAM,UAAU,GAAG,sBAAsB,CAAC;IAC1C,IAAI,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GACd,2DAA2D,CAAC;IAC9D,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GACd,mEAAmE,CAAC;IACtE,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,YAAY,GAChB,+DAA+D,CAAC;IAClE,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAC9B,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;IACjE,IAAI,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAChD,IACE,OAAO;gBACP,CAAC,2EAA2E,CAAC,IAAI,CAC/E,OAAO,CACR,EACD,CAAC;gBACD,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,2BAA2B,CAAC;IACpD,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAC5B,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/B,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,qBAAqB,CACnC,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,KAAK,CAAC,gBAAgB,GAAG,UAAU,CAAC;IAEpC,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACtE,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,4CAA4C,CAAC;QACjE,IAAI,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9E,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,eAAe,GAAG,kDAAkD,CAAC;QAC3E,IAAI,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACxE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,6CAA6C,CAAC;QAClE,IAAI,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7D,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5E,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,4CAA4C,CAAC;QACjE,IAAI,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAElC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;QACrB,QAAQ;QACR,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE;YACJ,SAAS,EAAE,CAAC,CAAC,gBAAgB;YAC7B,aAAa,EAAE,CAAC,CAAC,oBAAoB;YACrC,UAAU,EAAE,CAAC,CAAC,iBAAiB;YAC/B,eAAe,EAAE,CAAC,CAAC,gBAAgB;SACpC;KACF,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAC9B,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,GAA4B,EAAE,MAAc,EAAE,EAAE;YAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;oBAChC,IACE,mEAAmE,CAAC,IAAI,CACtE,KAAK,CACN;wBACD,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;wBACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBAC7B,CAAC;yBAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC/C,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;oBAClC,CAAC;yBAAM,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC3D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBAC9B,CAAC;yBAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBACnC,CAAC;gBACH,CAAC;qBAAM,IACL,KAAK;oBACL,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACrB,CAAC;oBACD,IAAI,CAAC,KAAgC,EAAE,IAAI,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAChC,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG;YACd,GAAG,IAAI,CAAC,YAAY;YACpB,GAAG,IAAI,CAAC,eAAe;SACxB,CAAC;QAEF,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;YACrC,IAAI,OAAO,IAAI,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;gBACxB,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;oBAC5B,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,KAAK,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,MAAM,eAAe,GACnB,oEAAoE,CAAC;IACvE,IAAI,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,YAAY,GAAG,uDAAuD,CAAC;IAC7E,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,iBAAiB,GACrB,yDAAyD,CAAC;IAC5D,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,cAAc,GAClB,+DAA+D,CAAC;IAClE,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAElC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;QACrB,QAAQ;QACR,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KACvB,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAC7B,KAAwB,EACxB,QAAgB,EAChB,OAAe;IAEf,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAE/C,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3C,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QACvC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;SAAM,IACL,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,aAAa;QAC1B,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EACjC,CAAC;QACD,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;SAAM,IACL,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAClC,CAAC;QACD,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;SAAM,IACL,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EACrB,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3C,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;SAAM,IACL,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC5B,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,gDAAgD;AAChD,MAAM,UAAU,MAAM,CAAC,GAAa;IAClC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClC,IACE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC3B,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QAEtB,OAAO,cAAc,CAAC;IACxB,IACE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAElB,OAAO,UAAU,CAAC;IACpB,IACE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC1B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAElB,OAAO,aAAa,CAAC;IACvB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAChC,WAAwB,EACxB,OAAgB;IAEhB,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,cAAc;YACjB,IAAI,CAAC,IAAI,CACP,qEAAqE,EACrE,4DAA4D,EAC5D,wDAAwD,EACxD,iEAAiE,EACjE,yDAAyD,CAC1D,CAAC;YACF,MAAM;QACR,KAAK,UAAU;YACb,IAAI,CAAC,IAAI,CACP,kEAAkE,EAClE,wDAAwD,EACxD,2DAA2D,EAC3D,wDAAwD,EACxD,4DAA4D,CAC7D,CAAC;YACF,MAAM;QACR,KAAK,aAAa;YAChB,IAAI,CAAC,IAAI,CACP,mDAAmD,EACnD,iEAAiE,EACjE,yDAAyD,EACzD,4DAA4D,CAC7D,CAAC;YACF,MAAM;QACR,KAAK,KAAK;YACR,IAAI,CAAC,IAAI,CACP,0DAA0D,EAC1D,qDAAqD,EACrD,wDAAwD,CACzD,CAAC;YACF,MAAM;QACR,KAAK,OAAO;YACV,IAAI,CAAC,IAAI,CACP,0DAA0D,EAC1D,wDAAwD,CACzD,CAAC;YACF,MAAM;IACV,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CACP,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;IACrE,WAAW,CAAC,GAAG,CAAC,CAAC;IAEjB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,OAAO,EAAE;YACP,YAAY,EACV,sEAAsE;SACzE;QACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAwB,EAAE,GAAG,EAAE,CAAC;IAE5C,QAAQ;IACR,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,mBAAmB;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAC1B,kEAAkE,CACnE,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,mBAAmB;IACnB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,kEAAkE,CACnE,CAAC;IACF,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,CAAC,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,wBAAwB;IACxB,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IACpE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,UAAU,GAAG,sBAAsB,CAAC;IAC1C,IAAI,QAAQ,CAAC;IACb,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,UAAU,GACd,2DAA2D,CAAC;IAC9D,IAAI,QAAQ,CAAC;IACb,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,aAAa;IACb,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IACnE,MAAM,KAAK,GAAwC,EAAE,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YAChC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,eAAe;IACf,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CACrC,2CAA2C,CAC5C,CAAC;IACF,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IAED,WAAW;IACX,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAC7B,mEAAmE,CACpE,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,UAAU;IACV,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAC7B,yEAAyE,CAC1E,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Shared design-token extraction utilities.\n *\n * Pure functions for parsing Tailwind configs, CSS files, package.json,\n * documents, and URLs to extract colors, fonts, spacing, border-radius,\n * and CSS custom properties. Used by the import-* actions across all\n * templates (design, slides, videos).\n *\n * No framework dependencies — no defineAction, no zod, no drizzle.\n */\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Maximum number of files to fetch from a single GitHub repo. */\nexport const MAX_FILES = 10;\n\n/** Maximum individual file size (100 KB). */\nexport const MAX_FILE_SIZE = 100 * 1024;\n\n/** Timeout for GitHub API / URL fetch calls (ms). */\nexport const FETCH_TIMEOUT = 15000;\n\n/** File-name patterns to look for at the repo root. */\nexport const ROOT_PATTERNS: RegExp[] = [\n  /^tailwind\\.config\\.\\w+$/,\n  /^postcss\\.config\\.\\w+$/,\n  /^\\.?theme\\.\\w+$/,\n  /^\\.?tokens\\.\\w+$/,\n  /^package\\.json$/,\n  /\\.css$/,\n];\n\n/** Secondary paths (files and directories) to check for design tokens. */\nexport const SECONDARY_PATHS: string[] = [\n  \"src/styles\",\n  \"styles\",\n  \"src/theme\",\n  \"app/globals.css\",\n  \"src/globals.css\",\n  \"src/index.css\",\n  \"app/layout.tsx\",\n  \"src/app/globals.css\",\n];\n\n/** Maximum files accepted in import-code. */\nexport const CODE_MAX_FILES = 20;\n\n/** Maximum total bytes accepted in import-code. */\nexport const CODE_MAX_TOTAL_BYTES = 500 * 1024;\n\n/** Regex for hex colors (3-8 digit, including alpha). */\nexport const HEX_COLOR_RE = /#(?:[0-9a-fA-F]{3,4}){1,2}\\b/g;\n\n/** Regex for well-known named CSS colors. */\nexport const NAMED_COLOR_RE =\n  /\\b(red|blue|green|yellow|orange|purple|pink|cyan|magenta|teal|navy|maroon|coral|salmon|gold|silver|gray|grey|indigo|violet|lime|olive|aqua|fuchsia|crimson|turquoise|ivory|beige|lavender|tan|khaki|plum|orchid|sienna)\\b/gi;\n\n/** Regex for well-known font family names found in documents. */\nexport const FONT_NAME_RE =\n  /\\b(Helvetica|Arial|Times New Roman|Georgia|Garamond|Futura|Bodoni|Avenir|Proxima Nova|Montserrat|Open Sans|Lato|Poppins|Raleway|Playfair Display|Merriweather|Source Sans|Noto Sans|Work Sans|Nunito|Rubik|Oswald|Roboto|Inter|DM Sans|Space Grotesk|SF Pro|Segoe UI|Calibri|Cambria|Century Gothic|Franklin Gothic|Gill Sans|Fira Sans|Barlow|Manrope|Sora|Plus Jakarta Sans|IBM Plex Sans|IBM Plex Serif|Libre Baskerville|Cormorant|Crimson Text)\\b/gi;\n\n/** Regex matching CSS custom property values that look like colors. */\nexport const COLOR_VAR_PATTERN =\n  /^(#[0-9a-fA-F]{3,8}|rgba?\\(|hsla?\\(|oklch\\(|color\\()/;\n\n/** Well-known styling framework deps to detect in package.json. */\nexport const FRAMEWORK_DETECTORS: { name: string; label: string }[] = [\n  { name: \"tailwindcss\", label: \"tailwind\" },\n  { name: \"@tailwindcss/cli\", label: \"tailwind\" },\n  { name: \"styled-components\", label: \"styled-components\" },\n  { name: \"@emotion/react\", label: \"emotion\" },\n  { name: \"@emotion/styled\", label: \"emotion\" },\n  { name: \"sass\", label: \"sass\" },\n  { name: \"less\", label: \"less\" },\n  { name: \"postcss\", label: \"postcss\" },\n  { name: \"css-modules\", label: \"css-modules\" },\n  { name: \"@vanilla-extract/css\", label: \"vanilla-extract\" },\n  { name: \"stitches\", label: \"stitches\" },\n  { name: \"panda-css\", label: \"panda-css\" },\n  { name: \"@pandacss/dev\", label: \"panda-css\" },\n  { name: \"unocss\", label: \"unocss\" },\n  { name: \"windicss\", label: \"windi\" },\n];\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport type ContentType =\n  | \"presentation\"\n  | \"document\"\n  | \"spreadsheet\"\n  | \"pdf\"\n  | \"other\";\n\nexport interface ParsedCss {\n  cssCustomProperties: Record<string, string> | undefined;\n  fonts: string[] | undefined;\n}\n\nexport interface ParsedTailwindConfig {\n  colors?: Record<string, string>;\n  fontFamily?: Record<string, string>;\n  spacing?: Record<string, string>;\n  borderRadius?: Record<string, string>;\n}\n\nexport interface CodeAnalysisState {\n  colors: Record<string, string>;\n  cssCustomProperties: Record<string, string>;\n  fonts: { family: string; source?: string }[];\n  spacing: Record<string, string>;\n  borderRadius: Record<string, string>;\n  stylingFramework: string | null;\n  rawExtracts: { filename: string; type: string; data: unknown }[];\n  seenFonts: Set<string>;\n}\n\nexport interface UrlExtractionResult {\n  url: string;\n  pageTitle?: string;\n  metaDescription?: string;\n  themeColor?: string;\n  cssCustomProperties?: Record<string, string>;\n  colors?: string[];\n  fontFaces?: { family?: string; src?: string }[];\n  googleFonts?: string[];\n  ogImage?: string;\n  favicon?: string;\n}\n\nexport interface GitHubFetchOptions {\n  token?: string | null;\n}\n\nexport interface GitHubJsonResult<T = unknown> {\n  ok: boolean;\n  status: number;\n  data: T | null;\n  message?: string;\n}\n\n// ---------------------------------------------------------------------------\n// SSRF Guard\n// ---------------------------------------------------------------------------\n\n/** Validate a URL is safe to fetch (blocks localhost, private IPs, metadata endpoints). */\nexport function validateUrl(url: string): void {\n  const parsed = new URL(url);\n  if (![\"http:\", \"https:\"].includes(parsed.protocol)) {\n    throw new Error(\"Only http and https URLs are allowed\");\n  }\n  const hostname = parsed.hostname;\n  if (\n    hostname === \"localhost\" ||\n    hostname === \"127.0.0.1\" ||\n    hostname === \"0.0.0.0\" ||\n    hostname === \"[::1]\" ||\n    hostname.startsWith(\"10.\") ||\n    hostname.startsWith(\"172.16.\") ||\n    hostname.startsWith(\"172.17.\") ||\n    hostname.startsWith(\"172.18.\") ||\n    hostname.startsWith(\"172.19.\") ||\n    hostname.startsWith(\"172.2\") ||\n    hostname.startsWith(\"172.30.\") ||\n    hostname.startsWith(\"172.31.\") ||\n    hostname.startsWith(\"192.168.\") ||\n    hostname.endsWith(\".internal\") ||\n    hostname.endsWith(\".local\") ||\n    hostname === \"metadata.google.internal\" ||\n    hostname === \"169.254.169.254\"\n  ) {\n    throw new Error(\"Internal/private URLs are not allowed\");\n  }\n}\n\n// ---------------------------------------------------------------------------\n// GitHub helpers\n// ---------------------------------------------------------------------------\n\n/** Parse a GitHub URL or \"org/repo\" shorthand into owner + repo. */\nexport function parseOwnerRepo(raw: string): {\n  owner: string;\n  repo: string;\n} {\n  const cleaned = raw\n    .trim()\n    .replace(/[?#].*$/, \"\")\n    .replace(/\\/+$/, \"\");\n\n  const sshMatch = cleaned.match(\n    /^(?:ssh:\\/\\/)?git@github\\.com[:/]([^/]+)\\/([^/]+?)(?:\\.git)?$/,\n  );\n  if (sshMatch) {\n    return { owner: sshMatch[1], repo: sshMatch[2] };\n  }\n\n  const shorthand = cleaned.match(/^([^/\\s]+)\\/([^/\\s]+?)(?:\\.git)?$/);\n  if (shorthand) {\n    return { owner: shorthand[1], repo: shorthand[2] };\n  }\n  const urlMatch = cleaned.match(\n    /github\\.com[:/]([^/]+)\\/([^/]+?)(?:\\.git)?(?:\\/.*)?$/,\n  );\n  if (urlMatch) {\n    return { owner: urlMatch[1], repo: urlMatch[2] };\n  }\n  throw new Error(\n    \"Could not parse GitHub owner/repo from URL. \" +\n      'Expected format: \"https://github.com/org/repo\", \"org/repo\", or \"git@github.com:org/repo.git\"',\n  );\n}\n\n/** Fetch a path from the GitHub Contents API as JSON. Returns null on error. */\nfunction githubHeaders(\n  accept: string,\n  options: GitHubFetchOptions = {},\n): Record<string, string> {\n  return {\n    Accept: accept,\n    \"User-Agent\": \"AgentNative/1.0\",\n    ...(options.token ? { Authorization: `Bearer ${options.token}` } : {}),\n  };\n}\n\n/** Fetch a path from the GitHub Contents API as JSON with status details. */\nexport async function fetchGitHubJsonResult<T = unknown>(\n  owner: string,\n  repo: string,\n  path: string,\n  options: GitHubFetchOptions = {},\n): Promise<GitHubJsonResult<T>> {\n  const url = `https://api.github.com/repos/${owner}/${repo}/contents/${path}`;\n  validateUrl(url);\n  const res = await fetch(url, {\n    headers: githubHeaders(\"application/vnd.github.v3+json\", options),\n    signal: AbortSignal.timeout(FETCH_TIMEOUT),\n  });\n  if (!res.ok) {\n    let message: string | undefined;\n    try {\n      const body = (await res.json()) as { message?: unknown };\n      if (typeof body.message === \"string\") message = body.message;\n    } catch {\n      try {\n        const text = await res.text();\n        if (text) message = text.slice(0, 200);\n      } catch {\n        // Keep the status-only result.\n      }\n    }\n    return { ok: false, status: res.status, data: null, message };\n  }\n  return { ok: true, status: res.status, data: (await res.json()) as T };\n}\n\n/** Fetch a path from the GitHub Contents API as JSON. Returns null on error. */\nexport async function fetchGitHubJson(\n  owner: string,\n  repo: string,\n  path: string,\n  options: GitHubFetchOptions = {},\n): Promise<unknown> {\n  const result = await fetchGitHubJsonResult(owner, repo, path, options);\n  return result.ok ? result.data : null;\n}\n\n/** Fetch raw file content from the GitHub Contents API. Returns null on error or oversize. */\nexport async function fetchGitHubRaw(\n  owner: string,\n  repo: string,\n  path: string,\n  options: GitHubFetchOptions = {},\n): Promise<string | null> {\n  const url = `https://api.github.com/repos/${owner}/${repo}/contents/${path}`;\n  validateUrl(url);\n  const res = await fetch(url, {\n    headers: githubHeaders(\"application/vnd.github.v3.raw\", options),\n    signal: AbortSignal.timeout(FETCH_TIMEOUT),\n  });\n  if (!res.ok) return null;\n\n  const cl = res.headers.get(\"content-length\");\n  if (cl && parseInt(cl, 10) > MAX_FILE_SIZE) return null;\n\n  const text = await res.text();\n  if (text.length > MAX_FILE_SIZE) return null;\n  return text;\n}\n\n// ---------------------------------------------------------------------------\n// Tailwind config parser\n// ---------------------------------------------------------------------------\n\n/** Extract colors, fonts, spacing, borderRadius from a Tailwind config file string. */\nexport function parseTailwindConfig(content: string): Record<string, unknown> {\n  const result: Record<string, unknown> = {};\n\n  const colorsMatch = content.match(\n    /colors\\s*:\\s*(\\{[\\s\\S]*?\\n\\s{4}\\}|\\{[^}]+\\})/,\n  );\n  if (colorsMatch) {\n    try {\n      const colors: Record<string, string> = {};\n      const pairs = colorsMatch[1].matchAll(\n        /['\"]?([\\w-]+)['\"]?\\s*:\\s*['\"]([^'\"]+)['\"]/g,\n      );\n      for (const p of pairs) {\n        colors[p[1]] = p[2];\n      }\n      if (Object.keys(colors).length > 0) result.colors = colors;\n    } catch {\n      // skip\n    }\n  }\n\n  const fontMatch = content.match(\n    /fontFamily\\s*:\\s*(\\{[\\s\\S]*?\\n\\s{4}\\}|\\{[^}]+\\})/,\n  );\n  if (fontMatch) {\n    const fonts: Record<string, string> = {};\n    const pairs = fontMatch[1].matchAll(\n      /['\"]?([\\w-]+)['\"]?\\s*:\\s*\\[?\\s*['\"]([^'\"]+)['\"]/g,\n    );\n    for (const p of pairs) {\n      fonts[p[1]] = p[2];\n    }\n    if (Object.keys(fonts).length > 0) result.fontFamily = fonts;\n  }\n\n  const spacingMatch = content.match(\n    /spacing\\s*:\\s*(\\{[\\s\\S]*?\\n\\s{4}\\}|\\{[^}]+\\})/,\n  );\n  if (spacingMatch) {\n    const spacing: Record<string, string> = {};\n    const pairs = spacingMatch[1].matchAll(\n      /['\"]?([\\w.-]+)['\"]?\\s*:\\s*['\"]([^'\"]+)['\"]/g,\n    );\n    for (const p of pairs) {\n      spacing[p[1]] = p[2];\n    }\n    if (Object.keys(spacing).length > 0) result.spacing = spacing;\n  }\n\n  const radiusMatch = content.match(\n    /borderRadius\\s*:\\s*(\\{[\\s\\S]*?\\n\\s{4}\\}|\\{[^}]+\\})/,\n  );\n  if (radiusMatch) {\n    const radii: Record<string, string> = {};\n    const pairs = radiusMatch[1].matchAll(\n      /['\"]?([\\w-]+)['\"]?\\s*:\\s*['\"]([^'\"]+)['\"]/g,\n    );\n    for (const p of pairs) {\n      radii[p[1]] = p[2];\n    }\n    if (Object.keys(radii).length > 0) result.borderRadius = radii;\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// CSS parser\n// ---------------------------------------------------------------------------\n\n/** Extract CSS custom properties and @font-face / Google Fonts from CSS content. */\nexport function parseCss(content: string): ParsedCss {\n  const cssCustomProperties: Record<string, string> = {};\n  const varMatches = content.matchAll(/--([\\w-]+)\\s*:\\s*([^;}\\n]+)/g);\n  for (const m of varMatches) {\n    cssCustomProperties[`--${m[1]}`] = m[2].trim();\n  }\n\n  const fonts: string[] = [];\n  const fontFaceMatches = content.matchAll(/@font-face\\s*\\{([^}]+)\\}/g);\n  for (const m of fontFaceMatches) {\n    const familyMatch = m[1].match(/font-family\\s*:\\s*[\"']?([^\"';]+)[\"']?/);\n    if (familyMatch) fonts.push(familyMatch[1].trim());\n  }\n\n  const importMatches = content.matchAll(\n    /@import\\s+url\\(\\s*['\"]?(fonts\\.googleapis\\.com[^'\")\\s]+)['\"]?\\s*\\)/g,\n  );\n  for (const m of importMatches) {\n    const familyParam = m[1].match(/family=([^&\"')\\s]+)/);\n    if (familyParam) {\n      fonts.push(decodeURIComponent(familyParam[1]).replace(/\\+/g, \" \"));\n    }\n  }\n\n  return {\n    cssCustomProperties:\n      Object.keys(cssCustomProperties).length > 0\n        ? cssCustomProperties\n        : undefined,\n    fonts: fonts.length > 0 ? [...new Set(fonts)] : undefined,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Styling framework detection\n// ---------------------------------------------------------------------------\n\n/** Detect the styling framework from a package.json string. */\nexport function detectStylingFramework(content: string): string | undefined {\n  try {\n    const pkg = JSON.parse(content);\n    const all = {\n      ...pkg.dependencies,\n      ...pkg.devDependencies,\n    };\n    if (all[\"tailwindcss\"] || all[\"@tailwindcss/cli\"]) return \"tailwindcss\";\n    if (all[\"styled-components\"]) return \"styled-components\";\n    if (all[\"@emotion/react\"] || all[\"@emotion/styled\"]) return \"emotion\";\n    if (all[\"sass\"] || all[\"node-sass\"]) return \"sass\";\n    if (all[\"less\"]) return \"less\";\n    if (all[\"@vanilla-extract/css\"]) return \"vanilla-extract\";\n    if (all[\"windicss\"]) return \"windicss\";\n    if (all[\"unocss\"]) return \"unocss\";\n    return undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Code file analysis helpers (import-code)\n// ---------------------------------------------------------------------------\n\n/** Create a fresh state object for code file analysis. */\nexport function createCodeAnalysisState(): CodeAnalysisState {\n  return {\n    colors: {},\n    cssCustomProperties: {},\n    fonts: [],\n    spacing: {},\n    borderRadius: {},\n    stylingFramework: null,\n    rawExtracts: [],\n    seenFonts: new Set<string>(),\n  };\n}\n\n/** De-duplicate and add a font to the analysis state. */\nexport function addFont(\n  state: CodeAnalysisState,\n  family: string,\n  source?: string,\n): void {\n  const normalized = family.trim().replace(/[\"']/g, \"\");\n  if (!normalized || state.seenFonts.has(normalized.toLowerCase())) return;\n  state.seenFonts.add(normalized.toLowerCase());\n  state.fonts.push({ family: normalized, source });\n}\n\n/** Extract CSS custom properties, classifying them by name into colors/spacing/radius. */\nexport function extractCssVars(\n  state: CodeAnalysisState,\n  content: string,\n): void {\n  const pattern = /--([\\w-]+)\\s*:\\s*([^;}\\n]+)/g;\n  let match;\n  while ((match = pattern.exec(content)) !== null) {\n    const name = `--${match[1]}`;\n    const value = match[2].trim();\n    state.cssCustomProperties[name] = value;\n\n    if (\n      /color|bg|background|text|border|accent|primary|secondary|surface|muted|foreground/i.test(\n        match[1],\n      )\n    ) {\n      state.colors[name] = value;\n    } else if (/spacing|gap|padding|margin|space/i.test(match[1])) {\n      state.spacing[name] = value;\n    } else if (/radius|rounded/i.test(match[1])) {\n      state.borderRadius[name] = value;\n    }\n  }\n}\n\n/** Extract literal color values (hex, rgb, hsl, oklch) from content. */\nexport function extractCodeColors(\n  state: CodeAnalysisState,\n  content: string,\n): void {\n  const hexPattern = /#[0-9a-fA-F]{3,8}\\b/g;\n  let m;\n  while ((m = hexPattern.exec(content)) !== null) {\n    state.colors[m[0]] = m[0];\n  }\n\n  const rgbPattern =\n    /rgba?\\(\\s*\\d+\\s*,\\s*\\d+\\s*,\\s*\\d+(?:\\s*,\\s*[\\d.]+)?\\s*\\)/g;\n  while ((m = rgbPattern.exec(content)) !== null) {\n    state.colors[m[0]] = m[0];\n  }\n\n  const hslPattern =\n    /hsla?\\(\\s*\\d+\\s*,\\s*[\\d.]+%\\s*,\\s*[\\d.]+%(?:\\s*,\\s*[\\d.]+)?\\s*\\)/g;\n  while ((m = hslPattern.exec(content)) !== null) {\n    state.colors[m[0]] = m[0];\n  }\n\n  const oklchPattern =\n    /oklch\\(\\s*[\\d.]+%?\\s+[\\d.]+\\s+[\\d.]+(?:\\s*\\/\\s*[\\d.]+)?\\s*\\)/g;\n  while ((m = oklchPattern.exec(content)) !== null) {\n    state.colors[m[0]] = m[0];\n  }\n}\n\n/** Extract font-family declarations and @font-face blocks from CSS-like content. */\nexport function extractCodeFonts(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  const fontFamilyPattern = /font-family\\s*:\\s*[\"']?([^\"';}\\n]+)/g;\n  let m;\n  while ((m = fontFamilyPattern.exec(content)) !== null) {\n    const families = m[1].split(\",\");\n    for (const fam of families) {\n      const trimmed = fam.trim().replace(/[\"']/g, \"\");\n      if (\n        trimmed &&\n        !/^(sans-serif|serif|monospace|cursive|fantasy|system-ui|inherit|initial)$/i.test(\n          trimmed,\n        )\n      ) {\n        addFont(state, trimmed, filename);\n      }\n    }\n  }\n\n  const fontFacePattern = /@font-face\\s*\\{([^}]+)\\}/g;\n  while ((m = fontFacePattern.exec(content)) !== null) {\n    const block = m[1];\n    const familyMatch = block.match(/font-family\\s*:\\s*[\"']?([^\"';]+)[\"']?/);\n    if (familyMatch) {\n      addFont(state, familyMatch[1], filename);\n    }\n  }\n}\n\n/** Analyze a CSS/SCSS/LESS file, extracting vars, colors, and fonts. */\nexport function analyzeCssFile(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  extractCssVars(state, content);\n  extractCodeColors(state, content);\n  extractCodeFonts(state, content, filename);\n  state.rawExtracts.push({ filename, type: \"css\", data: { parsed: true } });\n}\n\n/** Analyze a Tailwind config file for tokens. */\nexport function analyzeTailwindConfig(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  state.stylingFramework = \"tailwind\";\n\n  const colorsBlockMatch = content.match(/colors\\s*:\\s*\\{([\\s\\S]*?)\\}/);\n  if (colorsBlockMatch) {\n    const pairPattern = /[\"']?([\\w-]+)[\"']?\\s*:\\s*[\"']([^\"']+)[\"']/g;\n    let m;\n    while ((m = pairPattern.exec(colorsBlockMatch[1])) !== null) {\n      state.colors[m[1]] = m[2];\n    }\n  }\n\n  const fontFamilyBlockMatch = content.match(/fontFamily\\s*:\\s*\\{([\\s\\S]*?)\\}/);\n  if (fontFamilyBlockMatch) {\n    const fontPairPattern = /[\"']?([\\w-]+)[\"']?\\s*:\\s*\\[?\\s*[\"']([^\"']+)[\"']/g;\n    let m;\n    while ((m = fontPairPattern.exec(fontFamilyBlockMatch[1])) !== null) {\n      addFont(state, m[2], filename);\n    }\n  }\n\n  const spacingBlockMatch = content.match(/spacing\\s*:\\s*\\{([\\s\\S]*?)\\}/);\n  if (spacingBlockMatch) {\n    const pairPattern = /[\"']?([\\w.-]+)[\"']?\\s*:\\s*[\"']([^\"']+)[\"']/g;\n    let m;\n    while ((m = pairPattern.exec(spacingBlockMatch[1])) !== null) {\n      state.spacing[m[1]] = m[2];\n    }\n  }\n\n  const radiusBlockMatch = content.match(/borderRadius\\s*:\\s*\\{([\\s\\S]*?)\\}/);\n  if (radiusBlockMatch) {\n    const pairPattern = /[\"']?([\\w-]+)[\"']?\\s*:\\s*[\"']([^\"']+)[\"']/g;\n    let m;\n    while ((m = pairPattern.exec(radiusBlockMatch[1])) !== null) {\n      state.borderRadius[m[1]] = m[2];\n    }\n  }\n\n  extractCodeColors(state, content);\n\n  state.rawExtracts.push({\n    filename,\n    type: \"tailwind-config\",\n    data: {\n      hasColors: !!colorsBlockMatch,\n      hasFontFamily: !!fontFamilyBlockMatch,\n      hasSpacing: !!spacingBlockMatch,\n      hasBorderRadius: !!radiusBlockMatch,\n    },\n  });\n}\n\n/** Walk a parsed JSON theme object, extracting tokens into state. */\nexport function analyzeJsonTheme(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  try {\n    const json = JSON.parse(content);\n    const walk = (obj: Record<string, unknown>, prefix: string) => {\n      for (const [key, value] of Object.entries(obj)) {\n        const path = prefix ? `${prefix}.${key}` : key;\n        if (typeof value === \"string\") {\n          const lower = key.toLowerCase();\n          if (\n            /color|bg|background|text|border|accent|primary|secondary|surface/i.test(\n              lower,\n            ) ||\n            /^#[0-9a-fA-F]{3,8}$/.test(value)\n          ) {\n            state.colors[path] = value;\n          } else if (/font|family|typeface/i.test(lower)) {\n            addFont(state, value, filename);\n          } else if (/spacing|gap|padding|margin|space/i.test(lower)) {\n            state.spacing[path] = value;\n          } else if (/radius|rounded/i.test(lower)) {\n            state.borderRadius[path] = value;\n          }\n        } else if (\n          value &&\n          typeof value === \"object\" &&\n          !Array.isArray(value)\n        ) {\n          walk(value as Record<string, unknown>, path);\n        }\n      }\n    };\n    walk(json, \"\");\n    state.rawExtracts.push({\n      filename,\n      type: \"json-theme\",\n      data: { keys: Object.keys(json) },\n    });\n  } catch {\n    state.rawExtracts.push({\n      filename,\n      type: \"json-theme\",\n      data: { parseError: true },\n    });\n  }\n}\n\n/** Analyze package.json for styling framework deps. */\nexport function analyzePackageJson(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  try {\n    const json = JSON.parse(content);\n    const allDeps = {\n      ...json.dependencies,\n      ...json.devDependencies,\n    };\n\n    const detected: string[] = [];\n    for (const fw of FRAMEWORK_DETECTORS) {\n      if (allDeps && fw.name in allDeps) {\n        detected.push(fw.label);\n        if (!state.stylingFramework) {\n          state.stylingFramework = fw.label;\n        }\n      }\n    }\n\n    state.rawExtracts.push({\n      filename,\n      type: \"package-json\",\n      data: { stylingDeps: detected },\n    });\n  } catch {\n    state.rawExtracts.push({\n      filename,\n      type: \"package-json\",\n      data: { parseError: true },\n    });\n  }\n}\n\n/** Analyze a theme source file (theme.ts, tokens.ts) for design tokens. */\nexport function analyzeThemeSourceFile(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  const namedHexPattern =\n    /(?:const|let|var|export)\\s+(\\w+)\\s*=\\s*[\"']?(#[0-9a-fA-F]{3,8})\\b/g;\n  let m;\n  while ((m = namedHexPattern.exec(content)) !== null) {\n    state.colors[m[1]] = m[2];\n  }\n\n  const kvHexPattern = /[\"']?([\\w-]+)[\"']?\\s*:\\s*[\"'](#[0-9a-fA-F]{3,8})[\"']/g;\n  while ((m = kvHexPattern.exec(content)) !== null) {\n    state.colors[m[1]] = m[2];\n  }\n\n  const fontStringPattern =\n    /(?:font|family|typeface)\\w*\\s*[:=]\\s*[\"']([^\"']+)[\"']/gi;\n  while ((m = fontStringPattern.exec(content)) !== null) {\n    addFont(state, m[1], filename);\n  }\n\n  const spacingPattern =\n    /(?:spacing|gap|padding|margin)\\w*\\s*[:=]\\s*[\"']([^\"']+)[\"']/gi;\n  while ((m = spacingPattern.exec(content)) !== null) {\n    state.spacing[m[0].split(/[:=]/)[0].trim()] = m[1];\n  }\n\n  extractCodeColors(state, content);\n\n  state.rawExtracts.push({\n    filename,\n    type: \"theme-source\",\n    data: { parsed: true },\n  });\n}\n\n/** Route a file to the correct analyzer based on filename. */\nexport function analyzeCodeFile(\n  state: CodeAnalysisState,\n  filename: string,\n  content: string,\n): void {\n  const name = filename.toLowerCase();\n  const basename = name.split(\"/\").pop() ?? name;\n\n  if (basename.startsWith(\"tailwind.config\")) {\n    analyzeTailwindConfig(state, content, filename);\n  } else if (basename === \"package.json\") {\n    analyzePackageJson(state, content, filename);\n  } else if (\n    basename === \"theme.json\" ||\n    basename === \"tokens.json\" ||\n    basename.endsWith(\".tokens.json\")\n  ) {\n    analyzeJsonTheme(state, content, filename);\n  } else if (name.endsWith(\".css\")) {\n    analyzeCssFile(state, content, filename);\n  } else if (\n    /^theme\\.(ts|js)$/.test(basename) ||\n    /^tokens\\.(ts|js)$/.test(basename)\n  ) {\n    analyzeThemeSourceFile(state, content, filename);\n  } else if (\n    name.endsWith(\".ts\") ||\n    name.endsWith(\".tsx\") ||\n    name.endsWith(\".js\") ||\n    name.endsWith(\".jsx\")\n  ) {\n    extractCodeColors(state, content);\n    extractCodeFonts(state, content, filename);\n    extractCssVars(state, content);\n    state.rawExtracts.push({\n      filename,\n      type: \"source\",\n      data: { lightPass: true },\n    });\n  } else if (name.endsWith(\".json\")) {\n    analyzeJsonTheme(state, content, filename);\n  } else if (\n    name.endsWith(\".scss\") ||\n    name.endsWith(\".sass\") ||\n    name.endsWith(\".less\")\n  ) {\n    analyzeCssFile(state, content, filename);\n    if (!state.stylingFramework) {\n      state.stylingFramework = name.endsWith(\".less\") ? \"less\" : \"sass\";\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Document analysis helpers (import-document)\n// ---------------------------------------------------------------------------\n\n/** Deduplicate and trim an array of strings. */\nexport function unique(arr: string[]): string[] {\n  return [...new Set(arr.map((s) => s.trim()))];\n}\n\n/** Extract hex and named colors from plain text. */\nexport function extractDocumentColors(text: string): string[] {\n  const hex = text.match(HEX_COLOR_RE) ?? [];\n  const named = text.match(NAMED_COLOR_RE) ?? [];\n  return unique([...hex, ...named.map((n) => n.toLowerCase())]);\n}\n\n/** Extract known font family names from plain text. */\nexport function extractDocumentFonts(text: string): string[] {\n  const matches = text.match(FONT_NAME_RE) ?? [];\n  return unique(matches);\n}\n\n/** Classify a file type string into a content category. */\nexport function classifyFile(fileType: string): ContentType {\n  const ft = fileType.toLowerCase();\n  if (\n    ft.includes(\"pptx\") ||\n    ft.includes(\"ppt\") ||\n    ft.includes(\"presentation\") ||\n    ft.includes(\"keynote\")\n  )\n    return \"presentation\";\n  if (\n    ft.includes(\"docx\") ||\n    ft.includes(\"doc\") ||\n    ft.includes(\"document\") ||\n    ft.includes(\"rtf\")\n  )\n    return \"document\";\n  if (\n    ft.includes(\"xlsx\") ||\n    ft.includes(\"xls\") ||\n    ft.includes(\"spreadsheet\") ||\n    ft.includes(\"csv\")\n  )\n    return \"spreadsheet\";\n  if (ft.includes(\"pdf\")) return \"pdf\";\n  return \"other\";\n}\n\n/** Return per-type suggestions for how to use a document for design extraction. */\nexport function suggestionsForType(\n  contentType: ContentType,\n  hasText: boolean,\n): string[] {\n  const base: string[] = [];\n\n  switch (contentType) {\n    case \"presentation\":\n      base.push(\n        \"Look for slide master/theme colors — these define the brand palette\",\n        \"Check heading fonts on title slides for the brand typeface\",\n        \"Note any accent colors used for callouts or highlights\",\n        \"Slide backgrounds may reveal primary and secondary brand colors\",\n        \"Chart/graph colors often match the brand accent palette\",\n      );\n      break;\n    case \"document\":\n      base.push(\n        \"Heading styles reveal the typographic hierarchy and heading font\",\n        \"Body text font is likely the primary readable typeface\",\n        \"Look for colored headings or accent text for brand colors\",\n        \"Document margins and spacing suggest preferred density\",\n        \"Header/footer formatting may include brand colors or logos\",\n      );\n      break;\n    case \"spreadsheet\":\n      base.push(\n        \"Header row colors often reflect the brand palette\",\n        \"Conditional formatting colors may indicate status/accent colors\",\n        \"Chart and graph colors are strong brand palette signals\",\n        \"Cell background highlighting colors suggest accent palette\",\n      );\n      break;\n    case \"pdf\":\n      base.push(\n        \"PDF may contain embedded brand guidelines or style specs\",\n        \"Look for consistent heading colors and font choices\",\n        \"Background colors and accent bars reveal brand palette\",\n      );\n      break;\n    case \"other\":\n      base.push(\n        \"Examine any visual elements for recurring color patterns\",\n        \"Note any typography that appears intentionally branded\",\n      );\n      break;\n  }\n\n  if (!hasText) {\n    base.push(\n      \"No text content was extracted — ask the user to paste key sections or send the file as a chat attachment for visual analysis\",\n    );\n  }\n\n  return base;\n}\n\n// ---------------------------------------------------------------------------\n// URL scraping helpers (import-from-url)\n// ---------------------------------------------------------------------------\n\n/** Fetch and extract design tokens from a URL's HTML. */\nexport async function extractDesignTokensFromUrl(\n  rawUrl: string,\n): Promise<UrlExtractionResult> {\n  const url = rawUrl.startsWith(\"http\") ? rawUrl : `https://${rawUrl}`;\n  validateUrl(url);\n\n  const response = await fetch(url, {\n    headers: {\n      \"User-Agent\":\n        \"Mozilla/5.0 (compatible; AgentNative/1.0; +https://agent-native.com)\",\n    },\n    signal: AbortSignal.timeout(10000),\n  });\n  const html = await response.text();\n\n  const result: UrlExtractionResult = { url };\n\n  // Title\n  const titleMatch = html.match(/<title[^>]*>([^<]+)<\\/title>/i);\n  if (titleMatch) {\n    result.pageTitle = titleMatch[1].trim();\n  }\n\n  // Meta description\n  const descMatch = html.match(\n    /<meta[^>]*name=[\"']description[\"'][^>]*content=[\"']([^\"']+)[\"']/i,\n  );\n  if (descMatch) {\n    result.metaDescription = descMatch[1];\n  }\n\n  // Meta theme-color\n  const themeColorMatch = html.match(\n    /<meta[^>]*name=[\"']theme-color[\"'][^>]*content=[\"']([^\"']+)[\"']/i,\n  );\n  if (themeColorMatch) {\n    result.themeColor = themeColorMatch[1];\n  }\n\n  // CSS custom properties\n  const cssVarMatches = html.matchAll(/--([\\w-]+)\\s*:\\s*([^;}\\n]+)/g);\n  const cssVars: Record<string, string> = {};\n  for (const match of cssVarMatches) {\n    cssVars[`--${match[1]}`] = match[2].trim();\n  }\n  if (Object.keys(cssVars).length > 0) {\n    const entries = Object.entries(cssVars).slice(0, 50);\n    result.cssCustomProperties = Object.fromEntries(entries);\n  }\n\n  // Inline colors (hex, rgb)\n  const colorMatches = new Set<string>();\n  const hexPattern = /#[0-9a-fA-F]{3,8}\\b/g;\n  let hexMatch;\n  while ((hexMatch = hexPattern.exec(html)) !== null) {\n    colorMatches.add(hexMatch[0]);\n  }\n  const rgbPattern =\n    /rgba?\\(\\s*\\d+\\s*,\\s*\\d+\\s*,\\s*\\d+(?:\\s*,\\s*[\\d.]+)?\\s*\\)/g;\n  let rgbMatch;\n  while ((rgbMatch = rgbPattern.exec(html)) !== null) {\n    colorMatches.add(rgbMatch[0]);\n  }\n  if (colorMatches.size > 0) {\n    result.colors = [...colorMatches].slice(0, 30);\n  }\n\n  // @font-face\n  const fontFaceMatches = html.matchAll(/@font-face\\s*\\{([^}]+)\\}/g);\n  const fonts: { family?: string; src?: string }[] = [];\n  for (const match of fontFaceMatches) {\n    const block = match[1];\n    const familyMatch = block.match(/font-family\\s*:\\s*[\"']?([^\"';]+)[\"']?/);\n    const srcMatch = block.match(/src\\s*:\\s*([^;]+)/);\n    fonts.push({\n      family: familyMatch?.[1]?.trim(),\n      src: srcMatch?.[1]?.trim()?.slice(0, 200),\n    });\n  }\n  if (fonts.length > 0) {\n    result.fontFaces = fonts.slice(0, 20);\n  }\n\n  // Google Fonts\n  const googleFontMatches = html.matchAll(\n    /fonts\\.googleapis\\.com\\/css2?\\?[^\"'>\\s]+/g,\n  );\n  const googleFonts: string[] = [];\n  for (const match of googleFontMatches) {\n    googleFonts.push(match[0]);\n  }\n  if (googleFonts.length > 0) {\n    result.googleFonts = googleFonts;\n  }\n\n  // OG image\n  const ogImageMatch = html.match(\n    /<meta[^>]*property=[\"']og:image[\"'][^>]*content=[\"']([^\"']+)[\"']/i,\n  );\n  if (ogImageMatch) {\n    result.ogImage = ogImageMatch[1];\n  }\n\n  // Favicon\n  const faviconMatch = html.match(\n    /<link[^>]*rel=[\"'](?:icon|shortcut icon)[\"'][^>]*href=[\"']([^\"']+)[\"']/i,\n  );\n  if (faviconMatch) {\n    result.favicon = faviconMatch[1];\n  }\n\n  return result;\n}\n"]}
+{"version":3,"file":"design-token-utils.js","sourceRoot":"","sources":["../../src/server/design-token-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,kEAAkE;AAClE,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC;AAE5B,6CAA6C;AAC7C,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC;AAExC,qDAAqD;AACrD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AAEnC,uDAAuD;AACvD,MAAM,CAAC,MAAM,aAAa,GAAa;IACrC,yBAAyB;IACzB,wBAAwB;IACxB,iBAAiB;IACjB,kBAAkB;IAClB,iBAAiB;IACjB,QAAQ;CACT,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,YAAY;IACZ,QAAQ;IACR,WAAW;IACX,iBAAiB;IACjB,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,qBAAqB;CACtB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,mDAAmD;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAC;AAE/C,yDAAyD;AACzD,MAAM,CAAC,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAE5D,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GACzB,6NAA6N,CAAC;AAEhO,iEAAiE;AACjE,MAAM,CAAC,MAAM,YAAY,GACvB,0bAA0b,CAAC;AAE7b,uEAAuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAC5B,sDAAsD,CAAC;AAEzD,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAsC;IACpE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE;IAC1C,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE;IAC/C,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACzD,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC5C,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE;IAC7C,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC/B,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE;IACrC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;IAC7C,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE;IAC1D,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE;IACvC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE;IACzC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE;IAC7C,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;IACnC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE;CACrC,CAAC;AA4DF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IACE,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,SAAS;QACtB,QAAQ,KAAK,OAAO;QACpB,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC9B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3B,QAAQ,KAAK,0BAA0B;QACvC,QAAQ,KAAK,iBAAiB,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,GAAW;IAIxC,MAAM,OAAO,GAAG,GAAG;SAChB,IAAI,EAAE;SACN,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEvB,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,+DAA+D,CAChE,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACrE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAC5B,sDAAsD,CACvD,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8CAA8C;QAC5C,8FAA8F,CACjG,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CACpB,MAAc,EACd,UAA8B,EAAE;IAEhC,OAAO;QACL,MAAM,EAAE,MAAM;QACd,YAAY,EAAE,iBAAiB;QAC/B,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAa,EACb,IAAY,EACZ,IAAY,EACZ,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,gCAAgC,KAAK,IAAI,IAAI,aAAa,IAAI,EAAE,CAAC;IAC7E,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;QACnC,OAAO,EAAE,aAAa,CAAC,gCAAgC,EAAE,OAAO,CAAC;QACjE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;YACzD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;gBAAE,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC9B,IAAI,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YAAC,MAAM,CAAC;gBACP,+BAA+B;YACjC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,EAAE,CAAC;AACzE,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,IAAY,EACZ,IAAY,EACZ,UAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAa,EACb,IAAY,EACZ,IAAY,EACZ,UAA8B,EAAE;IAEhC,MAAM,GAAG,GAAG,gCAAgC,KAAK,IAAI,IAAI,aAAa,IAAI,EAAE,CAAC;IAC7E,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;QACnC,OAAO,EAAE,aAAa,CAAC,+BAA+B,EAAE,OAAO,CAAC;QAChE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC;KAC3C,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,EAAE,IAAI,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,aAAa;QAAE,OAAO,IAAI,CAAC;IAExD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,uFAAuF;AACvF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAE3C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAC/B,8CAA8C,CAC/C,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CACnC,4CAA4C,CAC7C,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAC7B,kDAAkD,CACnD,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CACjC,kDAAkD,CACnD,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,UAAU,GAAG,KAAK,CAAC;IAC/D,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAChC,+CAA+C,CAChD,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CACpC,6CAA6C,CAC9C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;IAChE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAC/B,oDAAoD,CACrD,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,KAAK,GAA2B,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CACnC,4CAA4C,CAC7C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC;IACjE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,oFAAoF;AACpF,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,MAAM,mBAAmB,GAA2B,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IACtE,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACxE,IAAI,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CACpC,qEAAqE,CACtE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,WAAW,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,OAAO;QACL,mBAAmB,EACjB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,GAAG,CAAC;YACzC,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,SAAS;QACf,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAC1D,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,+DAA+D;AAC/D,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG;YACV,GAAG,GAAG,CAAC,YAAY;YACnB,GAAG,GAAG,CAAC,eAAe;SACvB,CAAC;QACF,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC;YAAE,OAAO,aAAa,CAAC;QACxE,IAAI,GAAG,CAAC,mBAAmB,CAAC;YAAE,OAAO,mBAAmB,CAAC;QACzD,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC;YAAE,OAAO,SAAS,CAAC;QACtE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,MAAM,CAAC;QACnD,IAAI,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAC/B,IAAI,GAAG,CAAC,sBAAsB,CAAC;YAAE,OAAO,iBAAiB,CAAC;QAC1D,IAAI,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QACvC,IAAI,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,0DAA0D;AAC1D,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,MAAM,EAAE,EAAE;QACV,mBAAmB,EAAE,EAAE;QACvB,KAAK,EAAE,EAAE;QACT,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,EAAE;QAChB,gBAAgB,EAAE,IAAI;QACtB,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,IAAI,GAAG,EAAU;KAC7B,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,OAAO,CACrB,KAAwB,EACxB,MAAc,EACd,MAAe;IAEf,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO;IACzE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAC5B,KAAwB,EACxB,OAAe;IAEf,MAAM,OAAO,GAAG,8BAA8B,CAAC;IAC/C,IAAI,KAAK,CAAC;IACV,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAExC,IACE,oFAAoF,CAAC,IAAI,CACvF,KAAK,CAAC,CAAC,CAAC,CACT,EACD,CAAC;YACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC7B,CAAC;aAAM,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC9B,CAAC;aAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,OAAe;IAEf,MAAM,UAAU,GAAG,sBAAsB,CAAC;IAC1C,IAAI,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GACd,2DAA2D,CAAC;IAC9D,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GACd,mEAAmE,CAAC;IACtE,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,YAAY,GAChB,+DAA+D,CAAC;IAClE,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAC9B,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;IACjE,IAAI,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAChD,IACE,OAAO;gBACP,CAAC,2EAA2E,CAAC,IAAI,CAC/E,OAAO,CACR,EACD,CAAC;gBACD,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,2BAA2B,CAAC;IACpD,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAC5B,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/B,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,qBAAqB,CACnC,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,KAAK,CAAC,gBAAgB,GAAG,UAAU,CAAC;IAEpC,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACtE,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,4CAA4C,CAAC;QACjE,IAAI,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,GAAG,OAAO,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC9E,IAAI,oBAAoB,EAAE,CAAC;QACzB,MAAM,eAAe,GAAG,kDAAkD,CAAC;QAC3E,IAAI,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACxE,IAAI,iBAAiB,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,6CAA6C,CAAC;QAClE,IAAI,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7D,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5E,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,4CAA4C,CAAC;QACjE,IAAI,CAAC,CAAC;QACN,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAElC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;QACrB,QAAQ;QACR,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE;YACJ,SAAS,EAAE,CAAC,CAAC,gBAAgB;YAC7B,aAAa,EAAE,CAAC,CAAC,oBAAoB;YACrC,UAAU,EAAE,CAAC,CAAC,iBAAiB;YAC/B,eAAe,EAAE,CAAC,CAAC,gBAAgB;SACpC;KACF,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAC9B,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,GAA4B,EAAE,MAAc,EAAE,EAAE;YAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;gBAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;oBAChC,IACE,mEAAmE,CAAC,IAAI,CACtE,KAAK,CACN;wBACD,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;wBACD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBAC7B,CAAC;yBAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC/C,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;oBAClC,CAAC;yBAAM,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC3D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBAC9B,CAAC;yBAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;oBACnC,CAAC;gBACH,CAAC;qBAAM,IACL,KAAK;oBACL,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACrB,CAAC;oBACD,IAAI,CAAC,KAAgC,EAAE,IAAI,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAChC,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG;YACd,GAAG,IAAI,CAAC,YAAY;YACpB,GAAG,IAAI,CAAC,eAAe;SACxB,CAAC;QAEF,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;YACrC,IAAI,OAAO,IAAI,EAAE,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;gBAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;gBACxB,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;oBAC5B,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,KAAK,CAAC;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAe,EACf,QAAgB;IAEhB,MAAM,eAAe,GACnB,oEAAoE,CAAC;IACvE,IAAI,CAAC,CAAC;IACN,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,YAAY,GAAG,uDAAuD,CAAC;IAC7E,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACjD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,iBAAiB,GACrB,yDAAyD,CAAC;IAC5D,OAAO,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,cAAc,GAClB,+DAA+D,CAAC;IAClE,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAElC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;QACrB,QAAQ;QACR,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;KACvB,CAAC,CAAC;AACL,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAC7B,KAAwB,EACxB,QAAgB,EAChB,OAAe;IAEf,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAE/C,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC3C,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;QACvC,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;SAAM,IACL,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,aAAa;QAC1B,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,EACjC,CAAC;QACD,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;SAAM,IACL,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACjC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAClC,CAAC;QACD,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;SAAM,IACL,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EACrB,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC3C,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;YACrB,QAAQ;YACR,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;SAAM,IACL,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;YAC5B,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACpE,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,gDAAgD;AAChD,MAAM,UAAU,MAAM,CAAC,GAAa;IAClC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAClC,IACE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC3B,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QAEtB,OAAO,cAAc,CAAC;IACxB,IACE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAElB,OAAO,UAAU,CAAC;IACpB,IACE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACnB,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClB,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC1B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAElB,OAAO,aAAa,CAAC;IACvB,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAChC,WAAwB,EACxB,OAAgB;IAEhB,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,QAAQ,WAAW,EAAE,CAAC;QACpB,KAAK,cAAc;YACjB,IAAI,CAAC,IAAI,CACP,qEAAqE,EACrE,4DAA4D,EAC5D,wDAAwD,EACxD,iEAAiE,EACjE,yDAAyD,CAC1D,CAAC;YACF,MAAM;QACR,KAAK,UAAU;YACb,IAAI,CAAC,IAAI,CACP,kEAAkE,EAClE,wDAAwD,EACxD,2DAA2D,EAC3D,wDAAwD,EACxD,4DAA4D,CAC7D,CAAC;YACF,MAAM;QACR,KAAK,aAAa;YAChB,IAAI,CAAC,IAAI,CACP,mDAAmD,EACnD,iEAAiE,EACjE,yDAAyD,EACzD,4DAA4D,CAC7D,CAAC;YACF,MAAM;QACR,KAAK,KAAK;YACR,IAAI,CAAC,IAAI,CACP,0DAA0D,EAC1D,qDAAqD,EACrD,wDAAwD,CACzD,CAAC;YACF,MAAM;QACR,KAAK,OAAO;YACV,IAAI,CAAC,IAAI,CACP,0DAA0D,EAC1D,wDAAwD,CACzD,CAAC;YACF,MAAM;IACV,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CACP,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,yCAAyC;AACzC,8EAA8E;AAE9E,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;IACrE,WAAW,CAAC,GAAG,CAAC,CAAC;IAEjB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;QACxC,OAAO,EAAE;YACP,YAAY,EACV,sEAAsE;SACzE;QACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAEnC,MAAM,MAAM,GAAwB,EAAE,GAAG,EAAE,CAAC;IAE5C,QAAQ;IACR,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,mBAAmB;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAC1B,kEAAkE,CACnE,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,mBAAmB;IACnB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,kEAAkE,CACnE,CAAC;IACF,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,CAAC,UAAU,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,wBAAwB;IACxB,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;IACpE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,2BAA2B;IAC3B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,UAAU,GAAG,sBAAsB,CAAC;IAC1C,IAAI,QAAQ,CAAC;IACb,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,UAAU,GACd,2DAA2D,CAAC;IAC9D,IAAI,QAAQ,CAAC;IACb,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,aAAa;IACb,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC;IACnE,MAAM,KAAK,GAAwC,EAAE,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YAChC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,eAAe;IACf,MAAM,iBAAiB,GAAG,IAAI,CAAC,QAAQ,CACrC,2CAA2C,CAC5C,CAAC;IACF,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,WAAW,GAAG,WAAW,CAAC;IACnC,CAAC;IAED,WAAW;IACX,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAC7B,mEAAmE,CACpE,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,UAAU;IACV,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAC7B,yEAAyE,CAC1E,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Shared design-token extraction utilities.\n *\n * Pure functions for parsing Tailwind configs, CSS files, package.json,\n * documents, and URLs to extract colors, fonts, spacing, border-radius,\n * and CSS custom properties. Used by the import-* actions across all\n * templates (design, slides, videos).\n *\n * No framework dependencies — no defineAction, no zod, no drizzle.\n */\n\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/** Maximum number of files to fetch from a single GitHub repo. */\nexport const MAX_FILES = 10;\n\n/** Maximum individual file size (100 KB). */\nexport const MAX_FILE_SIZE = 100 * 1024;\n\n/** Timeout for GitHub API / URL fetch calls (ms). */\nexport const FETCH_TIMEOUT = 15000;\n\n/** File-name patterns to look for at the repo root. */\nexport const ROOT_PATTERNS: RegExp[] = [\n  /^tailwind\\.config\\.\\w+$/,\n  /^postcss\\.config\\.\\w+$/,\n  /^\\.?theme\\.\\w+$/,\n  /^\\.?tokens\\.\\w+$/,\n  /^package\\.json$/,\n  /\\.css$/,\n];\n\n/** Secondary paths (files and directories) to check for design tokens. */\nexport const SECONDARY_PATHS: string[] = [\n  \"src/styles\",\n  \"styles\",\n  \"src/theme\",\n  \"app/globals.css\",\n  \"src/globals.css\",\n  \"src/index.css\",\n  \"app/layout.tsx\",\n  \"src/app/globals.css\",\n];\n\n/** Maximum files accepted in import-code. */\nexport const CODE_MAX_FILES = 20;\n\n/** Maximum total bytes accepted in import-code. */\nexport const CODE_MAX_TOTAL_BYTES = 500 * 1024;\n\n/** Regex for hex colors (3-8 digit, including alpha). */\nexport const HEX_COLOR_RE = /#(?:[0-9a-fA-F]{3,4}){1,2}\\b/g;\n\n/** Regex for well-known named CSS colors. */\nexport const NAMED_COLOR_RE =\n  /\\b(red|blue|green|yellow|orange|purple|pink|cyan|magenta|teal|navy|maroon|coral|salmon|gold|silver|gray|grey|indigo|violet|lime|olive|aqua|fuchsia|crimson|turquoise|ivory|beige|lavender|tan|khaki|plum|orchid|sienna)\\b/gi;\n\n/** Regex for well-known font family names found in documents. */\nexport const FONT_NAME_RE =\n  /\\b(Helvetica|Arial|Times New Roman|Georgia|Garamond|Futura|Bodoni|Avenir|Proxima Nova|Montserrat|Open Sans|Lato|Poppins|Raleway|Playfair Display|Merriweather|Source Sans|Noto Sans|Work Sans|Nunito|Rubik|Oswald|Roboto|Inter|DM Sans|Space Grotesk|SF Pro|Segoe UI|Calibri|Cambria|Century Gothic|Franklin Gothic|Gill Sans|Fira Sans|Barlow|Manrope|Sora|Plus Jakarta Sans|IBM Plex Sans|IBM Plex Serif|Libre Baskerville|Cormorant|Crimson Text)\\b/gi;\n\n/** Regex matching CSS custom property values that look like colors. */\nexport const COLOR_VAR_PATTERN =\n  /^(#[0-9a-fA-F]{3,8}|rgba?\\(|hsla?\\(|oklch\\(|color\\()/;\n\n/** Well-known styling framework deps to detect in package.json. */\nexport const FRAMEWORK_DETECTORS: { name: string; label: string }[] = [\n  { name: \"tailwindcss\", label: \"tailwind\" },\n  { name: \"@tailwindcss/cli\", label: \"tailwind\" },\n  { name: \"styled-components\", label: \"styled-components\" },\n  { name: \"@emotion/react\", label: \"emotion\" },\n  { name: \"@emotion/styled\", label: \"emotion\" },\n  { name: \"sass\", label: \"sass\" },\n  { name: \"less\", label: \"less\" },\n  { name: \"postcss\", label: \"postcss\" },\n  { name: \"css-modules\", label: \"css-modules\" },\n  { name: \"@vanilla-extract/css\", label: \"vanilla-extract\" },\n  { name: \"stitches\", label: \"stitches\" },\n  { name: \"panda-css\", label: \"panda-css\" },\n  { name: \"@pandacss/dev\", label: \"panda-css\" },\n  { name: \"unocss\", label: \"unocss\" },\n  { name: \"windicss\", label: \"windi\" },\n];\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport type ContentType =\n  | \"presentation\"\n  | \"document\"\n  | \"spreadsheet\"\n  | \"pdf\"\n  | \"other\";\n\nexport interface ParsedCss {\n  cssCustomProperties: Record<string, string> | undefined;\n  fonts: string[] | undefined;\n}\n\nexport interface ParsedTailwindConfig {\n  colors?: Record<string, string>;\n  fontFamily?: Record<string, string>;\n  spacing?: Record<string, string>;\n  borderRadius?: Record<string, string>;\n}\n\nexport interface CodeAnalysisState {\n  colors: Record<string, string>;\n  cssCustomProperties: Record<string, string>;\n  fonts: { family: string; source?: string }[];\n  spacing: Record<string, string>;\n  borderRadius: Record<string, string>;\n  stylingFramework: string | null;\n  rawExtracts: { filename: string; type: string; data: unknown }[];\n  seenFonts: Set<string>;\n}\n\nexport interface UrlExtractionResult {\n  url: string;\n  pageTitle?: string;\n  metaDescription?: string;\n  themeColor?: string;\n  cssCustomProperties?: Record<string, string>;\n  colors?: string[];\n  fontFaces?: { family?: string; src?: string }[];\n  googleFonts?: string[];\n  ogImage?: string;\n  favicon?: string;\n}\n\nexport interface GitHubFetchOptions {\n  token?: string | null;\n}\n\nexport interface GitHubJsonResult<T = unknown> {\n  ok: boolean;\n  status: number;\n  data: T | null;\n  message?: string;\n}\n\n// ---------------------------------------------------------------------------\n// SSRF Guard\n// ---------------------------------------------------------------------------\n\n/**\n * Cheap synchronous pre-filter for obviously-internal URLs. This is a fast\n * fail, NOT the real guard: it cannot resolve DNS and does not re-check\n * redirects. All actual outbound fetches in this module go through\n * `ssrfSafeFetch`, which performs the DNS-aware check, a connect-time\n * private-IP guard, and per-redirect re-validation. Keep both: this gives a\n * clear early error for literal private hosts, ssrfSafeFetch is the backstop.\n */\nexport function validateUrl(url: string): void {\n  const parsed = new URL(url);\n  if (![\"http:\", \"https:\"].includes(parsed.protocol)) {\n    throw new Error(\"Only http and https URLs are allowed\");\n  }\n  const hostname = parsed.hostname;\n  if (\n    hostname === \"localhost\" ||\n    hostname === \"127.0.0.1\" ||\n    hostname === \"0.0.0.0\" ||\n    hostname === \"[::1]\" ||\n    hostname.startsWith(\"10.\") ||\n    hostname.startsWith(\"172.16.\") ||\n    hostname.startsWith(\"172.17.\") ||\n    hostname.startsWith(\"172.18.\") ||\n    hostname.startsWith(\"172.19.\") ||\n    hostname.startsWith(\"172.2\") ||\n    hostname.startsWith(\"172.30.\") ||\n    hostname.startsWith(\"172.31.\") ||\n    hostname.startsWith(\"192.168.\") ||\n    hostname.endsWith(\".internal\") ||\n    hostname.endsWith(\".local\") ||\n    hostname === \"metadata.google.internal\" ||\n    hostname === \"169.254.169.254\"\n  ) {\n    throw new Error(\"Internal/private URLs are not allowed\");\n  }\n}\n\n// ---------------------------------------------------------------------------\n// GitHub helpers\n// ---------------------------------------------------------------------------\n\n/** Parse a GitHub URL or \"org/repo\" shorthand into owner + repo. */\nexport function parseOwnerRepo(raw: string): {\n  owner: string;\n  repo: string;\n} {\n  const cleaned = raw\n    .trim()\n    .replace(/[?#].*$/, \"\")\n    .replace(/\\/+$/, \"\");\n\n  const sshMatch = cleaned.match(\n    /^(?:ssh:\\/\\/)?git@github\\.com[:/]([^/]+)\\/([^/]+?)(?:\\.git)?$/,\n  );\n  if (sshMatch) {\n    return { owner: sshMatch[1], repo: sshMatch[2] };\n  }\n\n  const shorthand = cleaned.match(/^([^/\\s]+)\\/([^/\\s]+?)(?:\\.git)?$/);\n  if (shorthand) {\n    return { owner: shorthand[1], repo: shorthand[2] };\n  }\n  const urlMatch = cleaned.match(\n    /github\\.com[:/]([^/]+)\\/([^/]+?)(?:\\.git)?(?:\\/.*)?$/,\n  );\n  if (urlMatch) {\n    return { owner: urlMatch[1], repo: urlMatch[2] };\n  }\n  throw new Error(\n    \"Could not parse GitHub owner/repo from URL. \" +\n      'Expected format: \"https://github.com/org/repo\", \"org/repo\", or \"git@github.com:org/repo.git\"',\n  );\n}\n\n/** Fetch a path from the GitHub Contents API as JSON. Returns null on error. */\nfunction githubHeaders(\n  accept: string,\n  options: GitHubFetchOptions = {},\n): Record<string, string> {\n  return {\n    Accept: accept,\n    \"User-Agent\": \"AgentNative/1.0\",\n    ...(options.token ? { Authorization: `Bearer ${options.token}` } : {}),\n  };\n}\n\n/** Fetch a path from the GitHub Contents API as JSON with status details. */\nexport async function fetchGitHubJsonResult<T = unknown>(\n  owner: string,\n  repo: string,\n  path: string,\n  options: GitHubFetchOptions = {},\n): Promise<GitHubJsonResult<T>> {\n  const url = `https://api.github.com/repos/${owner}/${repo}/contents/${path}`;\n  validateUrl(url);\n  const res = await ssrfSafeFetch(url, {\n    headers: githubHeaders(\"application/vnd.github.v3+json\", options),\n    signal: AbortSignal.timeout(FETCH_TIMEOUT),\n  });\n  if (!res.ok) {\n    let message: string | undefined;\n    try {\n      const body = (await res.json()) as { message?: unknown };\n      if (typeof body.message === \"string\") message = body.message;\n    } catch {\n      try {\n        const text = await res.text();\n        if (text) message = text.slice(0, 200);\n      } catch {\n        // Keep the status-only result.\n      }\n    }\n    return { ok: false, status: res.status, data: null, message };\n  }\n  return { ok: true, status: res.status, data: (await res.json()) as T };\n}\n\n/** Fetch a path from the GitHub Contents API as JSON. Returns null on error. */\nexport async function fetchGitHubJson(\n  owner: string,\n  repo: string,\n  path: string,\n  options: GitHubFetchOptions = {},\n): Promise<unknown> {\n  const result = await fetchGitHubJsonResult(owner, repo, path, options);\n  return result.ok ? result.data : null;\n}\n\n/** Fetch raw file content from the GitHub Contents API. Returns null on error or oversize. */\nexport async function fetchGitHubRaw(\n  owner: string,\n  repo: string,\n  path: string,\n  options: GitHubFetchOptions = {},\n): Promise<string | null> {\n  const url = `https://api.github.com/repos/${owner}/${repo}/contents/${path}`;\n  validateUrl(url);\n  const res = await ssrfSafeFetch(url, {\n    headers: githubHeaders(\"application/vnd.github.v3.raw\", options),\n    signal: AbortSignal.timeout(FETCH_TIMEOUT),\n  });\n  if (!res.ok) return null;\n\n  const cl = res.headers.get(\"content-length\");\n  if (cl && parseInt(cl, 10) > MAX_FILE_SIZE) return null;\n\n  const text = await res.text();\n  if (text.length > MAX_FILE_SIZE) return null;\n  return text;\n}\n\n// ---------------------------------------------------------------------------\n// Tailwind config parser\n// ---------------------------------------------------------------------------\n\n/** Extract colors, fonts, spacing, borderRadius from a Tailwind config file string. */\nexport function parseTailwindConfig(content: string): Record<string, unknown> {\n  const result: Record<string, unknown> = {};\n\n  const colorsMatch = content.match(\n    /colors\\s*:\\s*(\\{[\\s\\S]*?\\n\\s{4}\\}|\\{[^}]+\\})/,\n  );\n  if (colorsMatch) {\n    try {\n      const colors: Record<string, string> = {};\n      const pairs = colorsMatch[1].matchAll(\n        /['\"]?([\\w-]+)['\"]?\\s*:\\s*['\"]([^'\"]+)['\"]/g,\n      );\n      for (const p of pairs) {\n        colors[p[1]] = p[2];\n      }\n      if (Object.keys(colors).length > 0) result.colors = colors;\n    } catch {\n      // skip\n    }\n  }\n\n  const fontMatch = content.match(\n    /fontFamily\\s*:\\s*(\\{[\\s\\S]*?\\n\\s{4}\\}|\\{[^}]+\\})/,\n  );\n  if (fontMatch) {\n    const fonts: Record<string, string> = {};\n    const pairs = fontMatch[1].matchAll(\n      /['\"]?([\\w-]+)['\"]?\\s*:\\s*\\[?\\s*['\"]([^'\"]+)['\"]/g,\n    );\n    for (const p of pairs) {\n      fonts[p[1]] = p[2];\n    }\n    if (Object.keys(fonts).length > 0) result.fontFamily = fonts;\n  }\n\n  const spacingMatch = content.match(\n    /spacing\\s*:\\s*(\\{[\\s\\S]*?\\n\\s{4}\\}|\\{[^}]+\\})/,\n  );\n  if (spacingMatch) {\n    const spacing: Record<string, string> = {};\n    const pairs = spacingMatch[1].matchAll(\n      /['\"]?([\\w.-]+)['\"]?\\s*:\\s*['\"]([^'\"]+)['\"]/g,\n    );\n    for (const p of pairs) {\n      spacing[p[1]] = p[2];\n    }\n    if (Object.keys(spacing).length > 0) result.spacing = spacing;\n  }\n\n  const radiusMatch = content.match(\n    /borderRadius\\s*:\\s*(\\{[\\s\\S]*?\\n\\s{4}\\}|\\{[^}]+\\})/,\n  );\n  if (radiusMatch) {\n    const radii: Record<string, string> = {};\n    const pairs = radiusMatch[1].matchAll(\n      /['\"]?([\\w-]+)['\"]?\\s*:\\s*['\"]([^'\"]+)['\"]/g,\n    );\n    for (const p of pairs) {\n      radii[p[1]] = p[2];\n    }\n    if (Object.keys(radii).length > 0) result.borderRadius = radii;\n  }\n\n  return result;\n}\n\n// ---------------------------------------------------------------------------\n// CSS parser\n// ---------------------------------------------------------------------------\n\n/** Extract CSS custom properties and @font-face / Google Fonts from CSS content. */\nexport function parseCss(content: string): ParsedCss {\n  const cssCustomProperties: Record<string, string> = {};\n  const varMatches = content.matchAll(/--([\\w-]+)\\s*:\\s*([^;}\\n]+)/g);\n  for (const m of varMatches) {\n    cssCustomProperties[`--${m[1]}`] = m[2].trim();\n  }\n\n  const fonts: string[] = [];\n  const fontFaceMatches = content.matchAll(/@font-face\\s*\\{([^}]+)\\}/g);\n  for (const m of fontFaceMatches) {\n    const familyMatch = m[1].match(/font-family\\s*:\\s*[\"']?([^\"';]+)[\"']?/);\n    if (familyMatch) fonts.push(familyMatch[1].trim());\n  }\n\n  const importMatches = content.matchAll(\n    /@import\\s+url\\(\\s*['\"]?(fonts\\.googleapis\\.com[^'\")\\s]+)['\"]?\\s*\\)/g,\n  );\n  for (const m of importMatches) {\n    const familyParam = m[1].match(/family=([^&\"')\\s]+)/);\n    if (familyParam) {\n      fonts.push(decodeURIComponent(familyParam[1]).replace(/\\+/g, \" \"));\n    }\n  }\n\n  return {\n    cssCustomProperties:\n      Object.keys(cssCustomProperties).length > 0\n        ? cssCustomProperties\n        : undefined,\n    fonts: fonts.length > 0 ? [...new Set(fonts)] : undefined,\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Styling framework detection\n// ---------------------------------------------------------------------------\n\n/** Detect the styling framework from a package.json string. */\nexport function detectStylingFramework(content: string): string | undefined {\n  try {\n    const pkg = JSON.parse(content);\n    const all = {\n      ...pkg.dependencies,\n      ...pkg.devDependencies,\n    };\n    if (all[\"tailwindcss\"] || all[\"@tailwindcss/cli\"]) return \"tailwindcss\";\n    if (all[\"styled-components\"]) return \"styled-components\";\n    if (all[\"@emotion/react\"] || all[\"@emotion/styled\"]) return \"emotion\";\n    if (all[\"sass\"] || all[\"node-sass\"]) return \"sass\";\n    if (all[\"less\"]) return \"less\";\n    if (all[\"@vanilla-extract/css\"]) return \"vanilla-extract\";\n    if (all[\"windicss\"]) return \"windicss\";\n    if (all[\"unocss\"]) return \"unocss\";\n    return undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Code file analysis helpers (import-code)\n// ---------------------------------------------------------------------------\n\n/** Create a fresh state object for code file analysis. */\nexport function createCodeAnalysisState(): CodeAnalysisState {\n  return {\n    colors: {},\n    cssCustomProperties: {},\n    fonts: [],\n    spacing: {},\n    borderRadius: {},\n    stylingFramework: null,\n    rawExtracts: [],\n    seenFonts: new Set<string>(),\n  };\n}\n\n/** De-duplicate and add a font to the analysis state. */\nexport function addFont(\n  state: CodeAnalysisState,\n  family: string,\n  source?: string,\n): void {\n  const normalized = family.trim().replace(/[\"']/g, \"\");\n  if (!normalized || state.seenFonts.has(normalized.toLowerCase())) return;\n  state.seenFonts.add(normalized.toLowerCase());\n  state.fonts.push({ family: normalized, source });\n}\n\n/** Extract CSS custom properties, classifying them by name into colors/spacing/radius. */\nexport function extractCssVars(\n  state: CodeAnalysisState,\n  content: string,\n): void {\n  const pattern = /--([\\w-]+)\\s*:\\s*([^;}\\n]+)/g;\n  let match;\n  while ((match = pattern.exec(content)) !== null) {\n    const name = `--${match[1]}`;\n    const value = match[2].trim();\n    state.cssCustomProperties[name] = value;\n\n    if (\n      /color|bg|background|text|border|accent|primary|secondary|surface|muted|foreground/i.test(\n        match[1],\n      )\n    ) {\n      state.colors[name] = value;\n    } else if (/spacing|gap|padding|margin|space/i.test(match[1])) {\n      state.spacing[name] = value;\n    } else if (/radius|rounded/i.test(match[1])) {\n      state.borderRadius[name] = value;\n    }\n  }\n}\n\n/** Extract literal color values (hex, rgb, hsl, oklch) from content. */\nexport function extractCodeColors(\n  state: CodeAnalysisState,\n  content: string,\n): void {\n  const hexPattern = /#[0-9a-fA-F]{3,8}\\b/g;\n  let m;\n  while ((m = hexPattern.exec(content)) !== null) {\n    state.colors[m[0]] = m[0];\n  }\n\n  const rgbPattern =\n    /rgba?\\(\\s*\\d+\\s*,\\s*\\d+\\s*,\\s*\\d+(?:\\s*,\\s*[\\d.]+)?\\s*\\)/g;\n  while ((m = rgbPattern.exec(content)) !== null) {\n    state.colors[m[0]] = m[0];\n  }\n\n  const hslPattern =\n    /hsla?\\(\\s*\\d+\\s*,\\s*[\\d.]+%\\s*,\\s*[\\d.]+%(?:\\s*,\\s*[\\d.]+)?\\s*\\)/g;\n  while ((m = hslPattern.exec(content)) !== null) {\n    state.colors[m[0]] = m[0];\n  }\n\n  const oklchPattern =\n    /oklch\\(\\s*[\\d.]+%?\\s+[\\d.]+\\s+[\\d.]+(?:\\s*\\/\\s*[\\d.]+)?\\s*\\)/g;\n  while ((m = oklchPattern.exec(content)) !== null) {\n    state.colors[m[0]] = m[0];\n  }\n}\n\n/** Extract font-family declarations and @font-face blocks from CSS-like content. */\nexport function extractCodeFonts(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  const fontFamilyPattern = /font-family\\s*:\\s*[\"']?([^\"';}\\n]+)/g;\n  let m;\n  while ((m = fontFamilyPattern.exec(content)) !== null) {\n    const families = m[1].split(\",\");\n    for (const fam of families) {\n      const trimmed = fam.trim().replace(/[\"']/g, \"\");\n      if (\n        trimmed &&\n        !/^(sans-serif|serif|monospace|cursive|fantasy|system-ui|inherit|initial)$/i.test(\n          trimmed,\n        )\n      ) {\n        addFont(state, trimmed, filename);\n      }\n    }\n  }\n\n  const fontFacePattern = /@font-face\\s*\\{([^}]+)\\}/g;\n  while ((m = fontFacePattern.exec(content)) !== null) {\n    const block = m[1];\n    const familyMatch = block.match(/font-family\\s*:\\s*[\"']?([^\"';]+)[\"']?/);\n    if (familyMatch) {\n      addFont(state, familyMatch[1], filename);\n    }\n  }\n}\n\n/** Analyze a CSS/SCSS/LESS file, extracting vars, colors, and fonts. */\nexport function analyzeCssFile(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  extractCssVars(state, content);\n  extractCodeColors(state, content);\n  extractCodeFonts(state, content, filename);\n  state.rawExtracts.push({ filename, type: \"css\", data: { parsed: true } });\n}\n\n/** Analyze a Tailwind config file for tokens. */\nexport function analyzeTailwindConfig(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  state.stylingFramework = \"tailwind\";\n\n  const colorsBlockMatch = content.match(/colors\\s*:\\s*\\{([\\s\\S]*?)\\}/);\n  if (colorsBlockMatch) {\n    const pairPattern = /[\"']?([\\w-]+)[\"']?\\s*:\\s*[\"']([^\"']+)[\"']/g;\n    let m;\n    while ((m = pairPattern.exec(colorsBlockMatch[1])) !== null) {\n      state.colors[m[1]] = m[2];\n    }\n  }\n\n  const fontFamilyBlockMatch = content.match(/fontFamily\\s*:\\s*\\{([\\s\\S]*?)\\}/);\n  if (fontFamilyBlockMatch) {\n    const fontPairPattern = /[\"']?([\\w-]+)[\"']?\\s*:\\s*\\[?\\s*[\"']([^\"']+)[\"']/g;\n    let m;\n    while ((m = fontPairPattern.exec(fontFamilyBlockMatch[1])) !== null) {\n      addFont(state, m[2], filename);\n    }\n  }\n\n  const spacingBlockMatch = content.match(/spacing\\s*:\\s*\\{([\\s\\S]*?)\\}/);\n  if (spacingBlockMatch) {\n    const pairPattern = /[\"']?([\\w.-]+)[\"']?\\s*:\\s*[\"']([^\"']+)[\"']/g;\n    let m;\n    while ((m = pairPattern.exec(spacingBlockMatch[1])) !== null) {\n      state.spacing[m[1]] = m[2];\n    }\n  }\n\n  const radiusBlockMatch = content.match(/borderRadius\\s*:\\s*\\{([\\s\\S]*?)\\}/);\n  if (radiusBlockMatch) {\n    const pairPattern = /[\"']?([\\w-]+)[\"']?\\s*:\\s*[\"']([^\"']+)[\"']/g;\n    let m;\n    while ((m = pairPattern.exec(radiusBlockMatch[1])) !== null) {\n      state.borderRadius[m[1]] = m[2];\n    }\n  }\n\n  extractCodeColors(state, content);\n\n  state.rawExtracts.push({\n    filename,\n    type: \"tailwind-config\",\n    data: {\n      hasColors: !!colorsBlockMatch,\n      hasFontFamily: !!fontFamilyBlockMatch,\n      hasSpacing: !!spacingBlockMatch,\n      hasBorderRadius: !!radiusBlockMatch,\n    },\n  });\n}\n\n/** Walk a parsed JSON theme object, extracting tokens into state. */\nexport function analyzeJsonTheme(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  try {\n    const json = JSON.parse(content);\n    const walk = (obj: Record<string, unknown>, prefix: string) => {\n      for (const [key, value] of Object.entries(obj)) {\n        const path = prefix ? `${prefix}.${key}` : key;\n        if (typeof value === \"string\") {\n          const lower = key.toLowerCase();\n          if (\n            /color|bg|background|text|border|accent|primary|secondary|surface/i.test(\n              lower,\n            ) ||\n            /^#[0-9a-fA-F]{3,8}$/.test(value)\n          ) {\n            state.colors[path] = value;\n          } else if (/font|family|typeface/i.test(lower)) {\n            addFont(state, value, filename);\n          } else if (/spacing|gap|padding|margin|space/i.test(lower)) {\n            state.spacing[path] = value;\n          } else if (/radius|rounded/i.test(lower)) {\n            state.borderRadius[path] = value;\n          }\n        } else if (\n          value &&\n          typeof value === \"object\" &&\n          !Array.isArray(value)\n        ) {\n          walk(value as Record<string, unknown>, path);\n        }\n      }\n    };\n    walk(json, \"\");\n    state.rawExtracts.push({\n      filename,\n      type: \"json-theme\",\n      data: { keys: Object.keys(json) },\n    });\n  } catch {\n    state.rawExtracts.push({\n      filename,\n      type: \"json-theme\",\n      data: { parseError: true },\n    });\n  }\n}\n\n/** Analyze package.json for styling framework deps. */\nexport function analyzePackageJson(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  try {\n    const json = JSON.parse(content);\n    const allDeps = {\n      ...json.dependencies,\n      ...json.devDependencies,\n    };\n\n    const detected: string[] = [];\n    for (const fw of FRAMEWORK_DETECTORS) {\n      if (allDeps && fw.name in allDeps) {\n        detected.push(fw.label);\n        if (!state.stylingFramework) {\n          state.stylingFramework = fw.label;\n        }\n      }\n    }\n\n    state.rawExtracts.push({\n      filename,\n      type: \"package-json\",\n      data: { stylingDeps: detected },\n    });\n  } catch {\n    state.rawExtracts.push({\n      filename,\n      type: \"package-json\",\n      data: { parseError: true },\n    });\n  }\n}\n\n/** Analyze a theme source file (theme.ts, tokens.ts) for design tokens. */\nexport function analyzeThemeSourceFile(\n  state: CodeAnalysisState,\n  content: string,\n  filename: string,\n): void {\n  const namedHexPattern =\n    /(?:const|let|var|export)\\s+(\\w+)\\s*=\\s*[\"']?(#[0-9a-fA-F]{3,8})\\b/g;\n  let m;\n  while ((m = namedHexPattern.exec(content)) !== null) {\n    state.colors[m[1]] = m[2];\n  }\n\n  const kvHexPattern = /[\"']?([\\w-]+)[\"']?\\s*:\\s*[\"'](#[0-9a-fA-F]{3,8})[\"']/g;\n  while ((m = kvHexPattern.exec(content)) !== null) {\n    state.colors[m[1]] = m[2];\n  }\n\n  const fontStringPattern =\n    /(?:font|family|typeface)\\w*\\s*[:=]\\s*[\"']([^\"']+)[\"']/gi;\n  while ((m = fontStringPattern.exec(content)) !== null) {\n    addFont(state, m[1], filename);\n  }\n\n  const spacingPattern =\n    /(?:spacing|gap|padding|margin)\\w*\\s*[:=]\\s*[\"']([^\"']+)[\"']/gi;\n  while ((m = spacingPattern.exec(content)) !== null) {\n    state.spacing[m[0].split(/[:=]/)[0].trim()] = m[1];\n  }\n\n  extractCodeColors(state, content);\n\n  state.rawExtracts.push({\n    filename,\n    type: \"theme-source\",\n    data: { parsed: true },\n  });\n}\n\n/** Route a file to the correct analyzer based on filename. */\nexport function analyzeCodeFile(\n  state: CodeAnalysisState,\n  filename: string,\n  content: string,\n): void {\n  const name = filename.toLowerCase();\n  const basename = name.split(\"/\").pop() ?? name;\n\n  if (basename.startsWith(\"tailwind.config\")) {\n    analyzeTailwindConfig(state, content, filename);\n  } else if (basename === \"package.json\") {\n    analyzePackageJson(state, content, filename);\n  } else if (\n    basename === \"theme.json\" ||\n    basename === \"tokens.json\" ||\n    basename.endsWith(\".tokens.json\")\n  ) {\n    analyzeJsonTheme(state, content, filename);\n  } else if (name.endsWith(\".css\")) {\n    analyzeCssFile(state, content, filename);\n  } else if (\n    /^theme\\.(ts|js)$/.test(basename) ||\n    /^tokens\\.(ts|js)$/.test(basename)\n  ) {\n    analyzeThemeSourceFile(state, content, filename);\n  } else if (\n    name.endsWith(\".ts\") ||\n    name.endsWith(\".tsx\") ||\n    name.endsWith(\".js\") ||\n    name.endsWith(\".jsx\")\n  ) {\n    extractCodeColors(state, content);\n    extractCodeFonts(state, content, filename);\n    extractCssVars(state, content);\n    state.rawExtracts.push({\n      filename,\n      type: \"source\",\n      data: { lightPass: true },\n    });\n  } else if (name.endsWith(\".json\")) {\n    analyzeJsonTheme(state, content, filename);\n  } else if (\n    name.endsWith(\".scss\") ||\n    name.endsWith(\".sass\") ||\n    name.endsWith(\".less\")\n  ) {\n    analyzeCssFile(state, content, filename);\n    if (!state.stylingFramework) {\n      state.stylingFramework = name.endsWith(\".less\") ? \"less\" : \"sass\";\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Document analysis helpers (import-document)\n// ---------------------------------------------------------------------------\n\n/** Deduplicate and trim an array of strings. */\nexport function unique(arr: string[]): string[] {\n  return [...new Set(arr.map((s) => s.trim()))];\n}\n\n/** Extract hex and named colors from plain text. */\nexport function extractDocumentColors(text: string): string[] {\n  const hex = text.match(HEX_COLOR_RE) ?? [];\n  const named = text.match(NAMED_COLOR_RE) ?? [];\n  return unique([...hex, ...named.map((n) => n.toLowerCase())]);\n}\n\n/** Extract known font family names from plain text. */\nexport function extractDocumentFonts(text: string): string[] {\n  const matches = text.match(FONT_NAME_RE) ?? [];\n  return unique(matches);\n}\n\n/** Classify a file type string into a content category. */\nexport function classifyFile(fileType: string): ContentType {\n  const ft = fileType.toLowerCase();\n  if (\n    ft.includes(\"pptx\") ||\n    ft.includes(\"ppt\") ||\n    ft.includes(\"presentation\") ||\n    ft.includes(\"keynote\")\n  )\n    return \"presentation\";\n  if (\n    ft.includes(\"docx\") ||\n    ft.includes(\"doc\") ||\n    ft.includes(\"document\") ||\n    ft.includes(\"rtf\")\n  )\n    return \"document\";\n  if (\n    ft.includes(\"xlsx\") ||\n    ft.includes(\"xls\") ||\n    ft.includes(\"spreadsheet\") ||\n    ft.includes(\"csv\")\n  )\n    return \"spreadsheet\";\n  if (ft.includes(\"pdf\")) return \"pdf\";\n  return \"other\";\n}\n\n/** Return per-type suggestions for how to use a document for design extraction. */\nexport function suggestionsForType(\n  contentType: ContentType,\n  hasText: boolean,\n): string[] {\n  const base: string[] = [];\n\n  switch (contentType) {\n    case \"presentation\":\n      base.push(\n        \"Look for slide master/theme colors — these define the brand palette\",\n        \"Check heading fonts on title slides for the brand typeface\",\n        \"Note any accent colors used for callouts or highlights\",\n        \"Slide backgrounds may reveal primary and secondary brand colors\",\n        \"Chart/graph colors often match the brand accent palette\",\n      );\n      break;\n    case \"document\":\n      base.push(\n        \"Heading styles reveal the typographic hierarchy and heading font\",\n        \"Body text font is likely the primary readable typeface\",\n        \"Look for colored headings or accent text for brand colors\",\n        \"Document margins and spacing suggest preferred density\",\n        \"Header/footer formatting may include brand colors or logos\",\n      );\n      break;\n    case \"spreadsheet\":\n      base.push(\n        \"Header row colors often reflect the brand palette\",\n        \"Conditional formatting colors may indicate status/accent colors\",\n        \"Chart and graph colors are strong brand palette signals\",\n        \"Cell background highlighting colors suggest accent palette\",\n      );\n      break;\n    case \"pdf\":\n      base.push(\n        \"PDF may contain embedded brand guidelines or style specs\",\n        \"Look for consistent heading colors and font choices\",\n        \"Background colors and accent bars reveal brand palette\",\n      );\n      break;\n    case \"other\":\n      base.push(\n        \"Examine any visual elements for recurring color patterns\",\n        \"Note any typography that appears intentionally branded\",\n      );\n      break;\n  }\n\n  if (!hasText) {\n    base.push(\n      \"No text content was extracted — ask the user to paste key sections or send the file as a chat attachment for visual analysis\",\n    );\n  }\n\n  return base;\n}\n\n// ---------------------------------------------------------------------------\n// URL scraping helpers (import-from-url)\n// ---------------------------------------------------------------------------\n\n/** Fetch and extract design tokens from a URL's HTML. */\nexport async function extractDesignTokensFromUrl(\n  rawUrl: string,\n): Promise<UrlExtractionResult> {\n  const url = rawUrl.startsWith(\"http\") ? rawUrl : `https://${rawUrl}`;\n  validateUrl(url);\n\n  const response = await ssrfSafeFetch(url, {\n    headers: {\n      \"User-Agent\":\n        \"Mozilla/5.0 (compatible; AgentNative/1.0; +https://agent-native.com)\",\n    },\n    signal: AbortSignal.timeout(10000),\n  });\n  const html = await response.text();\n\n  const result: UrlExtractionResult = { url };\n\n  // Title\n  const titleMatch = html.match(/<title[^>]*>([^<]+)<\\/title>/i);\n  if (titleMatch) {\n    result.pageTitle = titleMatch[1].trim();\n  }\n\n  // Meta description\n  const descMatch = html.match(\n    /<meta[^>]*name=[\"']description[\"'][^>]*content=[\"']([^\"']+)[\"']/i,\n  );\n  if (descMatch) {\n    result.metaDescription = descMatch[1];\n  }\n\n  // Meta theme-color\n  const themeColorMatch = html.match(\n    /<meta[^>]*name=[\"']theme-color[\"'][^>]*content=[\"']([^\"']+)[\"']/i,\n  );\n  if (themeColorMatch) {\n    result.themeColor = themeColorMatch[1];\n  }\n\n  // CSS custom properties\n  const cssVarMatches = html.matchAll(/--([\\w-]+)\\s*:\\s*([^;}\\n]+)/g);\n  const cssVars: Record<string, string> = {};\n  for (const match of cssVarMatches) {\n    cssVars[`--${match[1]}`] = match[2].trim();\n  }\n  if (Object.keys(cssVars).length > 0) {\n    const entries = Object.entries(cssVars).slice(0, 50);\n    result.cssCustomProperties = Object.fromEntries(entries);\n  }\n\n  // Inline colors (hex, rgb)\n  const colorMatches = new Set<string>();\n  const hexPattern = /#[0-9a-fA-F]{3,8}\\b/g;\n  let hexMatch;\n  while ((hexMatch = hexPattern.exec(html)) !== null) {\n    colorMatches.add(hexMatch[0]);\n  }\n  const rgbPattern =\n    /rgba?\\(\\s*\\d+\\s*,\\s*\\d+\\s*,\\s*\\d+(?:\\s*,\\s*[\\d.]+)?\\s*\\)/g;\n  let rgbMatch;\n  while ((rgbMatch = rgbPattern.exec(html)) !== null) {\n    colorMatches.add(rgbMatch[0]);\n  }\n  if (colorMatches.size > 0) {\n    result.colors = [...colorMatches].slice(0, 30);\n  }\n\n  // @font-face\n  const fontFaceMatches = html.matchAll(/@font-face\\s*\\{([^}]+)\\}/g);\n  const fonts: { family?: string; src?: string }[] = [];\n  for (const match of fontFaceMatches) {\n    const block = match[1];\n    const familyMatch = block.match(/font-family\\s*:\\s*[\"']?([^\"';]+)[\"']?/);\n    const srcMatch = block.match(/src\\s*:\\s*([^;]+)/);\n    fonts.push({\n      family: familyMatch?.[1]?.trim(),\n      src: srcMatch?.[1]?.trim()?.slice(0, 200),\n    });\n  }\n  if (fonts.length > 0) {\n    result.fontFaces = fonts.slice(0, 20);\n  }\n\n  // Google Fonts\n  const googleFontMatches = html.matchAll(\n    /fonts\\.googleapis\\.com\\/css2?\\?[^\"'>\\s]+/g,\n  );\n  const googleFonts: string[] = [];\n  for (const match of googleFontMatches) {\n    googleFonts.push(match[0]);\n  }\n  if (googleFonts.length > 0) {\n    result.googleFonts = googleFonts;\n  }\n\n  // OG image\n  const ogImageMatch = html.match(\n    /<meta[^>]*property=[\"']og:image[\"'][^>]*content=[\"']([^\"']+)[\"']/i,\n  );\n  if (ogImageMatch) {\n    result.ogImage = ogImageMatch[1];\n  }\n\n  // Favicon\n  const faviconMatch = html.match(\n    /<link[^>]*rel=[\"'](?:icon|shortcut icon)[\"'][^>]*href=[\"']([^\"']+)[\"']/i,\n  );\n  if (faviconMatch) {\n    result.favicon = faviconMatch[1];\n  }\n\n  return result;\n}\n"]}

package/dist/templates/default/AGENTS.md

@@ -21,12 +21,12 @@ This is an **@agent-native/core** application -- the AI agent and UI share state
 
 ### Authentication
 
-Auth is automatic and environment-driven:
+Auth is real Better Auth in every environment — there is **no dev bypass**:
 
-- **Dev mode**: Auth is bypassed. `getSession()` returns `{ email: "local@localhost" }`.
-- **Production** (`ACCESS_TOKEN` set): Auth middleware auto-mounts.
+- **Development**: the same Better Auth flow as production. On first run the framework auto-creates a throwaway dev account and signs you in (so you are not stuck at a login wall). `getSession()` returns the signed-in user or `null` — it never returns a `local@localhost` sentinel.
+- **Production**: Better Auth with email/password + social providers; organizations built in.
 
-Use `getSession(event)` server-side and `useSession()` client-side.
+Use `getSession(event)` server-side and `useSession()` client-side. When there is no session, **throw or return 401** — never fall back to `local@localhost` (that pools every unauthenticated request into one shared tenant).
 
 ## Resources
 

package/dist/templates/default/app/routes/database.tsx

@@ -0,0 +1,13 @@
+import { DbAdminPage } from "@agent-native/core/client/db-admin";
+
+export function meta() {
+  return [{ title: "Database" }];
+}
+
+export default function DatabasePage() {
+  return (
+    <div className="p-6">
+      <DbAdminPage />
+    </div>
+  );
+}

package/dist/templates/workspace-core/.agents/skills/authentication/SKILL.md

@@ -16,14 +16,21 @@ Auth is powered by **Better Auth** with account-first design. Every new user cre
 
 | Mode                      | Behavior                                                                                                                                 |
 | ------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
-| **Development (default)** | Auth is automatically bypassed. `getSession()` falls back to `{ email: "local@localhost" }` when nothing else succeeds. No config.      |
+| **Development (default)** | Real Better Auth — same flow as production. There is **no auth bypass**. On first run the framework auto-creates a throwaway dev account and signs you in (credentials printed once to the console; disable with `AGENT_NATIVE_DISABLE_AUTO_DEV_ACCOUNT=1`), so you are not stuck at a login wall. `getSession()` returns the signed-in user or `null` — it never falls back to a sentinel identity. |
 | **Production (default)**  | Better Auth with email/password + social providers (Google, GitHub). Organizations built in.                                             |
-| **`AUTH_MODE=local`**     | Explicit escape hatch. `getSession()` always returns `{ email: "local@localhost" }`. Set via `.env` or the onboarding page's "Use locally" button. |
+| **`AUTH_MODE=local`**     | **Not** a browser auth bypass, and never returns `local@localhost`. It only affects CLI/agent identity: it lets `pnpm action` / the local agent loop auto-bind to the single real signed-in dev user from the `sessions` table (see `scripts/dev-session.ts`). Browser login is unchanged. |
 | **`AUTH_SKIP_EMAIL_VERIFICATION=1`** | QA/preview escape hatch for real email/password accounts. Signup skips email verification and does not send the signup verification email. Local dev/test skips verification by default; set `AUTH_SKIP_EMAIL_VERIFICATION=0` only when testing verification itself. Use `+qa` emails for test accounts. |
 | **`ACCESS_TOKEN` / `ACCESS_TOKENS`** | Simple token-based auth for production deployments.                                                                           |
 | **`AUTH_DISABLED=true`**  | Skip auth entirely (for apps behind infrastructure-level auth like Cloudflare Access).                                                   |
 | **Custom**                | Pass your own `getSession` to `autoMountAuth(app, { getSession })`.                                                                     |
 
+> **Never** use `local@localhost` as a fallback identity in app code
+> (`getRequestUserEmail() ?? "local@localhost"`, `session?.email ?? "local@localhost"`,
+> etc.). There is no dev auth shim. That pattern pools every unauthenticated
+> request into one shared tenant and caused the 2026-04-29 credentials leak.
+> When there is no session, **throw or return 401** — never substitute a
+> sentinel. Enforced by `scripts/guard-no-localhost-fallback.mjs`.
+
 ## Local → Real Account Migration
 
 Upgrading from `local@localhost` to a real account preserves SQL-backed workspace data. The built-in migration moves `application_state`, user-scoped `settings`, `oauth_tokens`, and any template table that uses `owner_email`.

package/dist/templates/workspace-core/.agents/skills/sharing/SKILL.md

@@ -144,11 +144,17 @@ import {
   getRequestOrgId,
 } from "@agent-native/core/server/request-context";
 
+const ownerEmail = getRequestUserEmail();
+// Never fall back to a sentinel like "local@localhost" — that pools every
+// unauthenticated write into one shared tenant (see the 2026-04-29 leak and
+// guard-no-localhost-fallback). Throw / 401 when there is no session instead.
+if (!ownerEmail) throw new Error("Not authenticated");
+
 await db.insert(schema.decks).values({
   id: nanoid(),
   title,
   data,
-  ownerEmail: getRequestUserEmail() ?? "local@localhost",
+  ownerEmail,
   orgId: getRequestOrgId(),
   // visibility defaults to 'private'
   // ...

package/dist/vite/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/vite/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAU,UAAU,EAAE,MAAM,MAAM,CAAC;AAyZ/C,MAAM,WAAW,YAAY;IAC3B,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,YAAY,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9E,oGAAoG;IACpG,QAAQ,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,8BAA8B;IAC9B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iDAAiD;IACjD,YAAY,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD;AA6XD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAWT;AA6KD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,UAAU,CAkQ1E"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/vite/client.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAU,UAAU,EAAE,MAAM,MAAM,CAAC;AAma/C,MAAM,WAAW,YAAY;IAC3B,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,YAAY,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9E,oGAAoG;IACpG,QAAQ,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;IAClC,8BAA8B;IAC9B,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAChB,iDAAiD;IACjD,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,+BAA+B;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,iDAAiD;IACjD,YAAY,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACvD;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjD;AA6XD,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,GAAG,SAAS,CAMpB;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAWT;AA6KD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,UAAU,CAkQ1E"}

package/dist/vite/client.js

@@ -193,11 +193,13 @@ const CORE_CLIENT_SUBPATHS = [
     "@agent-native/core/client/extensions",
     "@agent-native/core/client/tools", // legacy alias
     "@agent-native/core/client/org",
+    "@agent-native/core/client/db-admin",
     "@agent-native/core/client/observability",
     "@agent-native/core/client/onboarding",
     "@agent-native/core/client/sharing",
     "@agent-native/core/client/notifications",
     "@agent-native/core/client/progress",
+    "@agent-native/core/client/transcription/use-live-transcription",
 ];
 function getDefaultOptimizeDeps(cwd) {
     const inMonorepo = findCoreSrcDir(cwd) !== null;
@@ -296,11 +298,13 @@ function getCoreSourceAliases(cwd) {
         // Legacy alias — see exports map note above.
         "@agent-native/core/client/tools": path.join(coreSrc, "client/extensions/index.ts"),
         "@agent-native/core/client/org": path.join(coreSrc, "client/org/index.ts"),
+        "@agent-native/core/client/db-admin": path.join(coreSrc, "client/db-admin/index.ts"),
         "@agent-native/core/client/observability": path.join(coreSrc, "client/observability/index.ts"),
         "@agent-native/core/client/onboarding": path.join(coreSrc, "client/onboarding/index.ts"),
         "@agent-native/core/client/sharing": path.join(coreSrc, "client/sharing/index.ts"),
         "@agent-native/core/client/notifications": path.join(coreSrc, "client/notifications/index.ts"),
         "@agent-native/core/client/progress": path.join(coreSrc, "client/progress/index.ts"),
+        "@agent-native/core/client/transcription/use-live-transcription": path.join(coreSrc, "client/transcription/use-live-transcription.ts"),
         "@agent-native/core/db": path.join(coreSrc, "db/index.ts"),
         "@agent-native/core/db/schema": path.join(coreSrc, "db/schema.ts"),
         "@agent-native/core/shared": path.join(coreSrc, "shared/index.ts"),