@agent-native/core 0.30.6 → 0.31.0

package/dist/server/create-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EAOb,MAAM,IAAI,CAAC;AAkBZ,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACvC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uHAAuH;IACvH,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AA0BD;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAoDf;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;IAClC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CAyMpB"}
+{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EAOb,MAAM,IAAI,CAAC;AAkBZ,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACvC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uHAAuH;IACvH,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAoDf;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;IAClC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CAyMpB"}

package/dist/server/create-server.js

@@ -7,29 +7,6 @@ import { isEnvVarWriteAllowed } from "./env-var-writes.js";
 import { EMBED_TARGET_HEADER } from "../shared/embed-auth.js";
 import { EMBED_TRANSPLANT_HEADER, isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, shouldAllowMcpEmbedCredentials, } from "../shared/mcp-embed-headers.js";
 import { BUILDER_ENV_KEYS } from "./builder-browser.js";
-/**
- * Parse a .env file into key-value pairs, preserving comments and empty lines for roundtrip.
- */
-function parseEnvFile(content) {
-    const vars = new Map();
-    for (const line of content.split("\n")) {
-        const trimmed = line.trim();
-        if (!trimmed || trimmed.startsWith("#"))
-            continue;
-        const eqIndex = trimmed.indexOf("=");
-        if (eqIndex === -1)
-            continue;
-        const key = trimmed.slice(0, eqIndex).trim();
-        let value = trimmed.slice(eqIndex + 1).trim();
-        // Strip surrounding quotes
-        if ((value.startsWith('"') && value.endsWith('"')) ||
-            (value.startsWith("'") && value.endsWith("'"))) {
-            value = value.slice(1, -1);
-        }
-        vars.set(key, value);
-    }
-    return vars;
-}
 /**
  * Upsert vars into a .env file, preserving existing structure.
  */

package/dist/server/create-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-server.js","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA0BxD;;GAEG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,2BAA2B;QAC3B,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,IAA2C;IAE3C,gEAAgE;IAChE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,mDAAmD,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7D,iCAAiC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAClC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,IAAI,CAAC;IAE3C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;AACH,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,OAAO,CAAC,KAAK,EAAE,KAAK;YAClB,yFAAyF;YACzF,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAK,GAAG,EAAE,KAA+B,EAAE,IAAI,CAAC;YACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO;YAC7D,IAAI,GAAG,EAAE,OAAO,KAAK,SAAS;gBAAE,OAAO;YACvC,OAAO,CAAC,KAAK,CACX,gCAAgC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAC5D,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,kBAAkB;IAClB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,sBAAsB,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAE3D;;;;WAIG;QACH,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,gBAAgB,GAAG,MAAM,CAC7B,gBAAgB,CAAC,KAAK,EAAE,gCAAgC,CAAC,IAAI,EAAE,CAChE;iBACE,WAAW,EAAE;iBACb,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,MAAM,gBAAgB,GACpB,oBAAoB,CAAC,aAAa,CAAC;gBACnC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;oBAC3D,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC;oBAClD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;oBACrD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;oBACzD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;YAEvD;;;;;;;eAOG;YACH,MAAM,aAAa,GAAG,gBAAgB;gBACpC,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,oBAAoB,CAAC,aAAa,EAAE;oBAClC,cAAc;oBACd,6BAA6B,EAAE,CAAC,YAAY;oBAC5C,6BAA6B,EAAE,IAAI;iBACpC,CAAC,CAAC;YACP,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YAEnE,IAAI,aAAa,EAAE,CAAC;gBAClB,iBAAiB,CACf,KAAK,EACL,6BAA6B,EAC7B,aAAa,CACd,CAAC;gBACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3C,6DAA6D;gBAC7D,8DAA8D;gBAC9D,4DAA4D;gBAC5D,8DAA8D;gBAC9D,iDAAiD;gBACjD,IAAI,8BAA8B,CAAC,aAAa,CAAC,EAAE,CAAC;oBAClD,iBAAiB,CACf,KAAK,EACL,kCAAkC,EAClC,MAAM,CACP,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1B,kEAAkE;gBAClE,gEAAgE;gBAChE,2CAA2C;gBAC3C,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;YAED,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;YACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;YAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,+DAA+D;gBAC/D,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,IAAI,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhB,eAAe;IACf,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CACR,qBAAqB,EACrB,kBAAkB,CAAC,GAAG,EAAE;YACtB,MAAM,OAAO,GACX,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAEhC,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,kBAAkB,CAAC,GAAG,EAAE;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC3B,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;gBAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;gBAClC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,0JAA0J;iBAC7J,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,IAEhB,CAAC;YAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAC1C,CAAC;YAED,6CAA6C;YAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBACzB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACtB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CACrC,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACxD,CAAC;YAED,qBAAqB;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAEvC,oEAAoE;YACpE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAED,mDAAmD;YACnD,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE3B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC","sourcesContent":["import {\n  createApp,\n  createRouter,\n  defineEventHandler,\n  getMethod,\n  getRequestHeader,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport path from \"path\";\nimport { agentEnv } from \"../shared/agent-env.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  getAllowedCorsOrigin,\n  readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\nimport { isEnvVarWriteAllowed } from \"./env-var-writes.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n  EMBED_TRANSPLANT_HEADER,\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n  shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\nimport { BUILDER_ENV_KEYS } from \"./builder-browser.js\";\n\nexport interface EnvKeyConfig {\n  /** Environment variable name (e.g. \"HUBSPOT_ACCESS_TOKEN\") */\n  key: string;\n  /** Human-readable label (e.g. \"HubSpot\") */\n  label: string;\n  /** Whether this key is required for the app to function */\n  required?: boolean;\n  /** Optional UI hint shown next to the field describing where to find this value. */\n  helpText?: string;\n}\n\nexport interface CreateServerOptions {\n  /** CORS options. Ignored (H3 handles CORS via middleware). Default: enabled. */\n  cors?: Record<string, unknown> | false;\n  /** JSON body parser limit. Kept for API compatibility (H3 uses readBody). */\n  jsonLimit?: string;\n  /** Custom ping message. Default: reads PING_MESSAGE env var, falls back to \"pong\" */\n  pingMessage?: string;\n  /** Disable the /_agent-native/ping health check. Default: false */\n  disablePing?: boolean;\n  /** Env key configuration for the settings UI. Enables /_agent-native/env-status and /_agent-native/env-vars routes. */\n  envKeys?: EnvKeyConfig[];\n}\n\n/**\n * Parse a .env file into key-value pairs, preserving comments and empty lines for roundtrip.\n */\nfunction parseEnvFile(content: string): Map<string, string> {\n  const vars = new Map<string, string>();\n  for (const line of content.split(\"\\n\")) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    // Strip surrounding quotes\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n    vars.set(key, value);\n  }\n  return vars;\n}\n\n/**\n * Upsert vars into a .env file, preserving existing structure.\n */\nexport async function upsertEnvFile(\n  envPath: string,\n  vars: Array<{ key: string; value: string }>,\n): Promise<void> {\n  // Sanitize: reject values that could inject additional env vars\n  for (const { key, value } of vars) {\n    if (/[\\n\\r\\0]/.test(value)) {\n      throw new Error(\n        `Invalid env var value for ${key}: must not contain newlines or control characters`,\n      );\n    }\n  }\n\n  const fs = await import(\"fs\");\n\n  let content = \"\";\n  try {\n    content = fs.readFileSync(envPath, \"utf-8\");\n  } catch {\n    // File doesn't exist yet\n  }\n\n  const lines = content.split(\"\\n\");\n  const remaining = new Map(vars.map((v) => [v.key, v.value]));\n\n  // Update existing lines in place\n  const updated = lines.map((line) => {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) return line;\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) return line;\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (remaining.has(key)) {\n      const value = remaining.get(key)!;\n      remaining.delete(key);\n      return `${key}=${value}`;\n    }\n    return line;\n  });\n\n  // Append new vars\n  for (const [key, value] of remaining) {\n    updated.push(`${key}=${value}`);\n  }\n\n  // Ensure trailing newline\n  let result = updated.join(\"\\n\");\n  if (!result.endsWith(\"\\n\")) result += \"\\n\";\n\n  try {\n    fs.mkdirSync(path.dirname(envPath), { recursive: true });\n    fs.writeFileSync(envPath, result);\n  } catch {\n    // Edge runtimes don't have writable filesystem — skip silently\n  }\n}\n\nexport interface CreateServerResult {\n  app: ReturnType<typeof createApp>;\n  router: ReturnType<typeof createRouter>;\n}\n\n/**\n * Create a pre-configured H3 app with standard agent-native setup:\n * - CORS headers via middleware\n * - /_agent-native/ping health check\n * - /_agent-native/env-status and /_agent-native/env-vars (when envKeys is provided)\n *\n * Returns { app, router } — mount routes on `router`.\n */\nexport function createServer(\n  options: CreateServerOptions = {},\n): CreateServerResult {\n  const app = createApp({\n    onError(error, event) {\n      // Suppress connection-reset errors — client disconnected mid-request (tab close, reload)\n      const err = error as NodeJS.ErrnoException;\n      const code = err?.code || (err?.cause as NodeJS.ErrnoException)?.code;\n      if (code === \"ECONNRESET\" || code === \"ECONNABORTED\") return;\n      if (err?.message === \"aborted\") return;\n      console.error(\n        `[agent-native] Server error: ${event.method} ${event.path}`,\n        error,\n      );\n    },\n  });\n\n  // CORS middleware\n  if (options.cors !== false) {\n    const allowedOrigins = readCorsAllowedOrigins();\n    const isProduction = process.env.NODE_ENV === \"production\";\n\n    /**\n     * When CORS_ALLOWED_ORIGINS is unset, production only allows trusted\n     * localhost/native desktop origins. Development keeps the legacy \"echo\n     * any origin\" behavior so local tools and docs previews keep working.\n     */\n    app.use(\n      defineEventHandler((event) => {\n        const requestOrigin = getRequestHeader(event, \"origin\");\n        const method = getMethod(event);\n        const requestedHeaders = String(\n          getRequestHeader(event, \"access-control-request-headers\") ?? \"\",\n        )\n          .toLowerCase()\n          .split(\",\")\n          .map((header) => header.trim());\n        const embedCorsRequest =\n          isMcpEmbedCorsOrigin(requestOrigin) &&\n          (requestedHeaders.includes(EMBED_TARGET_HEADER.toLowerCase()) ||\n            requestedHeaders.includes(EMBED_TRANSPLANT_HEADER) ||\n            Boolean(getRequestHeader(event, EMBED_TARGET_HEADER)) ||\n            Boolean(getRequestHeader(event, EMBED_TRANSPLANT_HEADER)) ||\n            Boolean(getRequestHeader(event, \"authorization\")));\n\n        /**\n         * Decide whether the requesting origin is allowed. We never fall back\n         * to \"the first allowlist entry\" when the origin isn't in the list —\n         * that previously sent `Access-Control-Allow-Origin: <other-origin>`\n         * with credentials enabled to attacker-controlled origins, which was\n         * permissive enough that some clients followed through with the\n         * credentialed request.\n         */\n        const allowedOrigin = embedCorsRequest\n          ? requestOrigin\n          : getAllowedCorsOrigin(requestOrigin, {\n              allowedOrigins,\n              allowAnyOriginWhenNoAllowlist: !isProduction,\n              allowLocalhostWhenNoAllowlist: true,\n            });\n        // No origin header at all (same-origin fetch, server-to-server) and\n        // no allowlist → fall through with `*`-equivalent behaviour: omit\n        // ACAO entirely and let the browser apply its same-origin default.\n\n        if (allowedOrigin) {\n          setResponseHeader(\n            event,\n            \"Access-Control-Allow-Origin\",\n            allowedOrigin,\n          );\n          setResponseHeader(event, \"Vary\", \"Origin\");\n          // A specific origin means we can honor credentialed requests\n          // (fetch with `credentials: \"include\"` — used by desktop tray\n          // apps that share a same-site cookie with the web app). The\n          // wildcard `*` is spec-incompatible with credentials, so only\n          // set this when we're echoing a concrete origin.\n          if (shouldAllowMcpEmbedCredentials(allowedOrigin)) {\n            setResponseHeader(\n              event,\n              \"Access-Control-Allow-Credentials\",\n              \"true\",\n            );\n          }\n        } else if (!requestOrigin) {\n          // No origin header — preserve the legacy permissive behaviour for\n          // tools/scripts that hit the API directly (no credentialed CORS\n          // semantics apply when there's no Origin).\n          setResponseHeader(event, \"Access-Control-Allow-Origin\", \"*\");\n        }\n\n        setResponseHeader(\n          event,\n          \"Access-Control-Allow-Methods\",\n          \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n        );\n        setResponseHeader(\n          event,\n          \"Access-Control-Allow-Headers\",\n          MCP_EMBED_CORS_ALLOW_HEADERS,\n        );\n\n        if (method === \"OPTIONS\") {\n          // Reject preflights from disallowed cross-origin callers. We only\n          // 204 if either (a) there was no Origin header (same-origin or\n          // direct script invocation) or (b) the origin was in the allowlist\n          // / dev fallback above. Otherwise we 403 so the browser surfaces\n          // a hard CORS failure rather than blindly retrying with credentials.\n          if (requestOrigin && !allowedOrigin) {\n            return new Response(null, { status: 403 });\n          }\n          return new Response(null, { status: 204 });\n        }\n      }),\n    );\n  }\n\n  const router = createRouter();\n  app.use(router);\n\n  // Health check\n  if (!options.disablePing) {\n    router.get(\n      \"/_agent-native/ping\",\n      defineEventHandler(() => {\n        const message =\n          options.pingMessage ?? process.env.PING_MESSAGE ?? \"pong\";\n        return { message };\n      }),\n    );\n  }\n\n  // Env key management routes\n  if (options.envKeys) {\n    const envKeys = options.envKeys;\n\n    router.get(\n      \"/_agent-native/env-status\",\n      defineEventHandler(() => {\n        return envKeys.map((cfg) => ({\n          key: cfg.key,\n          label: cfg.label,\n          required: cfg.required ?? false,\n          configured: !!process.env[cfg.key],\n          ...(cfg.helpText ? { helpText: cfg.helpText } : {}),\n        }));\n      }),\n    );\n\n    router.post(\n      \"/_agent-native/env-vars\",\n      defineEventHandler(async (event: H3Event) => {\n        // Env vars are deployment-wide globals — see isEnvVarWriteAllowed\n        // above. Disable the endpoint on any multi-tenant deploy.\n        if (!isEnvVarWriteAllowed()) {\n          setResponseStatus(event, 403);\n          return {\n            error:\n              \"env-vars endpoint disabled on multi-tenant deployments. Use saveCredential(key, value, { userEmail, orgId, scope: 'org' }) to store per-org credentials.\",\n          };\n        }\n\n        const body = await readBody(event);\n        const { vars } = body as {\n          vars?: Array<{ key: string; value: string }>;\n        };\n\n        if (!Array.isArray(vars) || vars.length === 0) {\n          setResponseStatus(event, 400);\n          return { error: \"vars array required\" };\n        }\n\n        // Only allow keys that are in the env config\n        const allowedKeys = new Set(envKeys.map((k) => k.key));\n        const blockedEnvVarWriteKeys = new Set<string>(BUILDER_ENV_KEYS);\n        const filtered = vars.filter(\n          (v) =>\n            typeof v.key === \"string\" &&\n            allowedKeys.has(v.key) &&\n            !blockedEnvVarWriteKeys.has(v.key),\n        );\n        if (filtered.length === 0) {\n          setResponseStatus(event, 400);\n          return { error: \"No recognized env keys in request\" };\n        }\n\n        // Write to .env file\n        const envPath = path.join(process.cwd(), \".env\");\n        await upsertEnvFile(envPath, filtered);\n\n        // Update process.env so the app picks up the new values immediately\n        for (const { key, value } of filtered) {\n          process.env[key] = value;\n        }\n\n        // Notify parent (Builder or frame) via postMessage\n        agentEnv.setVars(filtered);\n\n        return { saved: filtered.map((v) => v.key) };\n      }),\n    );\n  }\n\n  return { app, router };\n}\n"]}
+{"version":3,"file":"create-server.js","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,GAC/B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AA0BxD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,IAA2C;IAE3C,gEAAgE;IAChE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,mDAAmD,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7D,iCAAiC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAClC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,IAAI,CAAC;IAE3C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;AACH,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,OAAO,CAAC,KAAK,EAAE,KAAK;YAClB,yFAAyF;YACzF,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAK,GAAG,EAAE,KAA+B,EAAE,IAAI,CAAC;YACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO;YAC7D,IAAI,GAAG,EAAE,OAAO,KAAK,SAAS;gBAAE,OAAO;YACvC,OAAO,CAAC,KAAK,CACX,gCAAgC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAC5D,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,kBAAkB;IAClB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,sBAAsB,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAE3D;;;;WAIG;QACH,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,gBAAgB,GAAG,MAAM,CAC7B,gBAAgB,CAAC,KAAK,EAAE,gCAAgC,CAAC,IAAI,EAAE,CAChE;iBACE,WAAW,EAAE;iBACb,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAClC,MAAM,gBAAgB,GACpB,oBAAoB,CAAC,aAAa,CAAC;gBACnC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC;oBAC3D,gBAAgB,CAAC,QAAQ,CAAC,uBAAuB,CAAC;oBAClD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;oBACrD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;oBACzD,OAAO,CAAC,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;YAEvD;;;;;;;eAOG;YACH,MAAM,aAAa,GAAG,gBAAgB;gBACpC,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,oBAAoB,CAAC,aAAa,EAAE;oBAClC,cAAc;oBACd,6BAA6B,EAAE,CAAC,YAAY;oBAC5C,6BAA6B,EAAE,IAAI;iBACpC,CAAC,CAAC;YACP,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YAEnE,IAAI,aAAa,EAAE,CAAC;gBAClB,iBAAiB,CACf,KAAK,EACL,6BAA6B,EAC7B,aAAa,CACd,CAAC;gBACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3C,6DAA6D;gBAC7D,8DAA8D;gBAC9D,4DAA4D;gBAC5D,8DAA8D;gBAC9D,iDAAiD;gBACjD,IAAI,8BAA8B,CAAC,aAAa,CAAC,EAAE,CAAC;oBAClD,iBAAiB,CACf,KAAK,EACL,kCAAkC,EAClC,MAAM,CACP,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1B,kEAAkE;gBAClE,gEAAgE;gBAChE,2CAA2C;gBAC3C,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;YAED,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;YACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;YAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,+DAA+D;gBAC/D,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,IAAI,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhB,eAAe;IACf,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CACR,qBAAqB,EACrB,kBAAkB,CAAC,GAAG,EAAE;YACtB,MAAM,OAAO,GACX,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAEhC,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,kBAAkB,CAAC,GAAG,EAAE;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC3B,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;gBAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;gBAClC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,0JAA0J;iBAC7J,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,IAEhB,CAAC;YAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAC1C,CAAC;YAED,6CAA6C;YAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;gBACzB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACtB,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CACrC,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACxD,CAAC;YAED,qBAAqB;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAEvC,oEAAoE;YACpE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAED,mDAAmD;YACnD,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE3B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC","sourcesContent":["import {\n  createApp,\n  createRouter,\n  defineEventHandler,\n  getMethod,\n  getRequestHeader,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport path from \"path\";\nimport { agentEnv } from \"../shared/agent-env.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  getAllowedCorsOrigin,\n  readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\nimport { isEnvVarWriteAllowed } from \"./env-var-writes.js\";\nimport { EMBED_TARGET_HEADER } from \"../shared/embed-auth.js\";\nimport {\n  EMBED_TRANSPLANT_HEADER,\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n  shouldAllowMcpEmbedCredentials,\n} from \"../shared/mcp-embed-headers.js\";\nimport { BUILDER_ENV_KEYS } from \"./builder-browser.js\";\n\nexport interface EnvKeyConfig {\n  /** Environment variable name (e.g. \"HUBSPOT_ACCESS_TOKEN\") */\n  key: string;\n  /** Human-readable label (e.g. \"HubSpot\") */\n  label: string;\n  /** Whether this key is required for the app to function */\n  required?: boolean;\n  /** Optional UI hint shown next to the field describing where to find this value. */\n  helpText?: string;\n}\n\nexport interface CreateServerOptions {\n  /** CORS options. Ignored (H3 handles CORS via middleware). Default: enabled. */\n  cors?: Record<string, unknown> | false;\n  /** JSON body parser limit. Kept for API compatibility (H3 uses readBody). */\n  jsonLimit?: string;\n  /** Custom ping message. Default: reads PING_MESSAGE env var, falls back to \"pong\" */\n  pingMessage?: string;\n  /** Disable the /_agent-native/ping health check. Default: false */\n  disablePing?: boolean;\n  /** Env key configuration for the settings UI. Enables /_agent-native/env-status and /_agent-native/env-vars routes. */\n  envKeys?: EnvKeyConfig[];\n}\n\n/**\n * Upsert vars into a .env file, preserving existing structure.\n */\nexport async function upsertEnvFile(\n  envPath: string,\n  vars: Array<{ key: string; value: string }>,\n): Promise<void> {\n  // Sanitize: reject values that could inject additional env vars\n  for (const { key, value } of vars) {\n    if (/[\\n\\r\\0]/.test(value)) {\n      throw new Error(\n        `Invalid env var value for ${key}: must not contain newlines or control characters`,\n      );\n    }\n  }\n\n  const fs = await import(\"fs\");\n\n  let content = \"\";\n  try {\n    content = fs.readFileSync(envPath, \"utf-8\");\n  } catch {\n    // File doesn't exist yet\n  }\n\n  const lines = content.split(\"\\n\");\n  const remaining = new Map(vars.map((v) => [v.key, v.value]));\n\n  // Update existing lines in place\n  const updated = lines.map((line) => {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) return line;\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) return line;\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (remaining.has(key)) {\n      const value = remaining.get(key)!;\n      remaining.delete(key);\n      return `${key}=${value}`;\n    }\n    return line;\n  });\n\n  // Append new vars\n  for (const [key, value] of remaining) {\n    updated.push(`${key}=${value}`);\n  }\n\n  // Ensure trailing newline\n  let result = updated.join(\"\\n\");\n  if (!result.endsWith(\"\\n\")) result += \"\\n\";\n\n  try {\n    fs.mkdirSync(path.dirname(envPath), { recursive: true });\n    fs.writeFileSync(envPath, result);\n  } catch {\n    // Edge runtimes don't have writable filesystem — skip silently\n  }\n}\n\nexport interface CreateServerResult {\n  app: ReturnType<typeof createApp>;\n  router: ReturnType<typeof createRouter>;\n}\n\n/**\n * Create a pre-configured H3 app with standard agent-native setup:\n * - CORS headers via middleware\n * - /_agent-native/ping health check\n * - /_agent-native/env-status and /_agent-native/env-vars (when envKeys is provided)\n *\n * Returns { app, router } — mount routes on `router`.\n */\nexport function createServer(\n  options: CreateServerOptions = {},\n): CreateServerResult {\n  const app = createApp({\n    onError(error, event) {\n      // Suppress connection-reset errors — client disconnected mid-request (tab close, reload)\n      const err = error as NodeJS.ErrnoException;\n      const code = err?.code || (err?.cause as NodeJS.ErrnoException)?.code;\n      if (code === \"ECONNRESET\" || code === \"ECONNABORTED\") return;\n      if (err?.message === \"aborted\") return;\n      console.error(\n        `[agent-native] Server error: ${event.method} ${event.path}`,\n        error,\n      );\n    },\n  });\n\n  // CORS middleware\n  if (options.cors !== false) {\n    const allowedOrigins = readCorsAllowedOrigins();\n    const isProduction = process.env.NODE_ENV === \"production\";\n\n    /**\n     * When CORS_ALLOWED_ORIGINS is unset, production only allows trusted\n     * localhost/native desktop origins. Development keeps the legacy \"echo\n     * any origin\" behavior so local tools and docs previews keep working.\n     */\n    app.use(\n      defineEventHandler((event) => {\n        const requestOrigin = getRequestHeader(event, \"origin\");\n        const method = getMethod(event);\n        const requestedHeaders = String(\n          getRequestHeader(event, \"access-control-request-headers\") ?? \"\",\n        )\n          .toLowerCase()\n          .split(\",\")\n          .map((header) => header.trim());\n        const embedCorsRequest =\n          isMcpEmbedCorsOrigin(requestOrigin) &&\n          (requestedHeaders.includes(EMBED_TARGET_HEADER.toLowerCase()) ||\n            requestedHeaders.includes(EMBED_TRANSPLANT_HEADER) ||\n            Boolean(getRequestHeader(event, EMBED_TARGET_HEADER)) ||\n            Boolean(getRequestHeader(event, EMBED_TRANSPLANT_HEADER)) ||\n            Boolean(getRequestHeader(event, \"authorization\")));\n\n        /**\n         * Decide whether the requesting origin is allowed. We never fall back\n         * to \"the first allowlist entry\" when the origin isn't in the list —\n         * that previously sent `Access-Control-Allow-Origin: <other-origin>`\n         * with credentials enabled to attacker-controlled origins, which was\n         * permissive enough that some clients followed through with the\n         * credentialed request.\n         */\n        const allowedOrigin = embedCorsRequest\n          ? requestOrigin\n          : getAllowedCorsOrigin(requestOrigin, {\n              allowedOrigins,\n              allowAnyOriginWhenNoAllowlist: !isProduction,\n              allowLocalhostWhenNoAllowlist: true,\n            });\n        // No origin header at all (same-origin fetch, server-to-server) and\n        // no allowlist → fall through with `*`-equivalent behaviour: omit\n        // ACAO entirely and let the browser apply its same-origin default.\n\n        if (allowedOrigin) {\n          setResponseHeader(\n            event,\n            \"Access-Control-Allow-Origin\",\n            allowedOrigin,\n          );\n          setResponseHeader(event, \"Vary\", \"Origin\");\n          // A specific origin means we can honor credentialed requests\n          // (fetch with `credentials: \"include\"` — used by desktop tray\n          // apps that share a same-site cookie with the web app). The\n          // wildcard `*` is spec-incompatible with credentials, so only\n          // set this when we're echoing a concrete origin.\n          if (shouldAllowMcpEmbedCredentials(allowedOrigin)) {\n            setResponseHeader(\n              event,\n              \"Access-Control-Allow-Credentials\",\n              \"true\",\n            );\n          }\n        } else if (!requestOrigin) {\n          // No origin header — preserve the legacy permissive behaviour for\n          // tools/scripts that hit the API directly (no credentialed CORS\n          // semantics apply when there's no Origin).\n          setResponseHeader(event, \"Access-Control-Allow-Origin\", \"*\");\n        }\n\n        setResponseHeader(\n          event,\n          \"Access-Control-Allow-Methods\",\n          \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n        );\n        setResponseHeader(\n          event,\n          \"Access-Control-Allow-Headers\",\n          MCP_EMBED_CORS_ALLOW_HEADERS,\n        );\n\n        if (method === \"OPTIONS\") {\n          // Reject preflights from disallowed cross-origin callers. We only\n          // 204 if either (a) there was no Origin header (same-origin or\n          // direct script invocation) or (b) the origin was in the allowlist\n          // / dev fallback above. Otherwise we 403 so the browser surfaces\n          // a hard CORS failure rather than blindly retrying with credentials.\n          if (requestOrigin && !allowedOrigin) {\n            return new Response(null, { status: 403 });\n          }\n          return new Response(null, { status: 204 });\n        }\n      }),\n    );\n  }\n\n  const router = createRouter();\n  app.use(router);\n\n  // Health check\n  if (!options.disablePing) {\n    router.get(\n      \"/_agent-native/ping\",\n      defineEventHandler(() => {\n        const message =\n          options.pingMessage ?? process.env.PING_MESSAGE ?? \"pong\";\n        return { message };\n      }),\n    );\n  }\n\n  // Env key management routes\n  if (options.envKeys) {\n    const envKeys = options.envKeys;\n\n    router.get(\n      \"/_agent-native/env-status\",\n      defineEventHandler(() => {\n        return envKeys.map((cfg) => ({\n          key: cfg.key,\n          label: cfg.label,\n          required: cfg.required ?? false,\n          configured: !!process.env[cfg.key],\n          ...(cfg.helpText ? { helpText: cfg.helpText } : {}),\n        }));\n      }),\n    );\n\n    router.post(\n      \"/_agent-native/env-vars\",\n      defineEventHandler(async (event: H3Event) => {\n        // Env vars are deployment-wide globals — see isEnvVarWriteAllowed\n        // above. Disable the endpoint on any multi-tenant deploy.\n        if (!isEnvVarWriteAllowed()) {\n          setResponseStatus(event, 403);\n          return {\n            error:\n              \"env-vars endpoint disabled on multi-tenant deployments. Use saveCredential(key, value, { userEmail, orgId, scope: 'org' }) to store per-org credentials.\",\n          };\n        }\n\n        const body = await readBody(event);\n        const { vars } = body as {\n          vars?: Array<{ key: string; value: string }>;\n        };\n\n        if (!Array.isArray(vars) || vars.length === 0) {\n          setResponseStatus(event, 400);\n          return { error: \"vars array required\" };\n        }\n\n        // Only allow keys that are in the env config\n        const allowedKeys = new Set(envKeys.map((k) => k.key));\n        const blockedEnvVarWriteKeys = new Set<string>(BUILDER_ENV_KEYS);\n        const filtered = vars.filter(\n          (v) =>\n            typeof v.key === \"string\" &&\n            allowedKeys.has(v.key) &&\n            !blockedEnvVarWriteKeys.has(v.key),\n        );\n        if (filtered.length === 0) {\n          setResponseStatus(event, 400);\n          return { error: \"No recognized env keys in request\" };\n        }\n\n        // Write to .env file\n        const envPath = path.join(process.cwd(), \".env\");\n        await upsertEnvFile(envPath, filtered);\n\n        // Update process.env so the app picks up the new values immediately\n        for (const { key, value } of filtered) {\n          process.env[key] = value;\n        }\n\n        // Notify parent (Builder or frame) via postMessage\n        agentEnv.setVars(filtered);\n\n        return { saved: filtered.map((v) => v.key) };\n      }),\n    );\n  }\n\n  return { app, router };\n}\n"]}

package/dist/server/google-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAyDZ;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AAkID;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgChD;AASD,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,MAAM,CAG5D;AAgED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,GACb,OAAO,CAqCT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,SAAmC,GAC7C,MAAM,GAAG,IAAI,CAMf;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgDD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC;AACxE,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;AA0CV;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAqCnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,CAgGpE;AAED;;;kEAGkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAMxD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,SAA4B,GAClC,QAAQ,CAKV"}
+{"version":3,"file":"google-oauth.d.ts","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,IAAI,CAAC;AAyDZ;;;;;;;;;;;;;GAaG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAElD;AAED,2DAA2D;AAC3D,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEhD;AA8HD;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAgChD;AASD,uEAAuE;AACvE,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAM,GAAG,MAAM,CAG5D;AAgED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,OAAO,GACb,OAAO,CAqCT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,WAAW,SAAmC,GAC7C,MAAM,GAAG,IAAI,CAMf;AAID,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAgDD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAAC;AACxE,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,OAAO,EACjB,UAAU,CAAC,EAAE,OAAO,EACpB,GAAG,CAAC,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAAC;AA0CV;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAqCnB;AAID,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAQ3B;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,oBAAoB,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GACA,OAAO,CAAC,kBAAkB,CAAC,CA2B7B;AAID;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GACA,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC,CAgGpE;AAED;;;kEAGkE;AAClE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAMxD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,SAA4B,GAClC,QAAQ,CAKV"}

package/dist/server/google-oauth.js

@@ -130,9 +130,6 @@ function getConfiguredOriginAllowlist() {
     }
     return out;
 }
-function firstConfiguredOrigin() {
-    return [...getConfiguredOriginAllowlist()][0];
-}
 function getWorkspaceCallbackOrigin() {
     const publicAuthOrigin = firstOriginFromEnv(EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS, {
         allowLoopback: true,

package/dist/server/google-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,+EAA+E;AAE/E;;oDAEoD;AACpD,SAAS,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;gCAGgC;AAChC,SAAS,gBAAgB,CAAC,MAAe;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,KAAK,GAAG,WAAW;QACvB,CAAC,CAAC,sEAAsE,UAAU,CAAC,WAAW,CAAC,MAAM;QACrG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,4hBAA4hB,QAAQ,qDAAqD,QAAQ,OAAO,KAAK,iFAAiF,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,qFAAqF,CAAC;AACh0B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,+BAA+B,GAAG;IACtC,wBAAwB;IACxB,6BAA6B;IAC7B,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,KAAK;IACL,YAAY;CACJ,CAAC;AAEX,MAAM,iCAAiC,GAAG;IACxC,uBAAuB;IACvB,4BAA4B;CACpB,CAAC;AAEX,SAAS,eAAe,CAAC,GAAuB;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAgB,EAChB,GAAuB,EACvB,OAAmC;IAEnC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAuB,EACvB,OAAmC;IAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,MAAM,CAAC;YAAE,SAAS;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,+BAA+B,EAAE,CAAC;QAClD,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,iCAAiC,EAAE,CAAC;QACpD,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,CAAC,GAAG,4BAA4B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,+BAA+B,EAAE;QAC3E,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,OAAO,kBAAkB,CAAC,iCAAiC,EAAE;QAC3D,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,KAAK;YACzB,MAAM,CAAC,QAAQ,KAAK,OAAO,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CACL,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,UAAU,GACd,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,WAAW,GACf,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,uBAAuB,GAAG,oCAAoC,EAAE;QACpE,CAAC,CAAC,0BAA0B,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEd,IACE,uBAAuB;QACvB,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC,EAChE,CAAC;QACD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,4BAA4B,EAAE,CAAC;QAC7C,yEAAyE;QACzE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAClD,mEAAmE;YACnE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,kEAAkE;QAClE,+DAA+D;QAC/D,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc;IAC5B,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACpD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAI,KAAa,CAAC,GAAG,EAAE,QAAQ,CAAC;IACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAI,KAAa,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,CACL,WAAW,KAAK,GAAG,QAAQ,gBAAgB;QAC3C,WAAW,CAAC,UAAU,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,IAAY;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,IACE,oCAAoC,EAAE;QACtC,4BAA4B,CAAC,SAAS,CAAC,EACvC,CAAC;QACD,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,QAAQ,GAAG,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,KAAc;IAEd,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qCAAqC;IACrC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,eAAe,GACnB,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC;YACE,GAAG,QAAQ,iBAAiB;YAC5B,GAAG,CAAC,oCAAoC,EAAE;gBAC1C,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACrB,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,WAAW,GAAG,gCAAgC;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,0BAA0B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AAqBD;;;;;GAKG;AACH,IAAI,mBAAuC,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,kBAAkB;IACzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gDAAgD;YAC9C,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AA0CD,MAAM,UAAU,gBAAgB,CAC9B,iBAAmD,EACnD,KAAc,EACd,OAAiB,EACjB,UAAoB,EACpB,GAAY,EACZ,SAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GACR,OAAO,iBAAiB,KAAK,QAAQ;QACnC,CAAC,CAAC;YACE,WAAW,EAAE,iBAAiB;YAC9B,KAAK;YACL,OAAO;YACP,UAAU;YACV,GAAG;YACH,SAAS;YACT,MAAM;SACP;QACH,CAAC,CAAC,iBAAiB,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAqC;QAChD,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,IAAI,CAAC,WAAW;KACpB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM;SACf,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;SAC1C,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA8B,EAC9B,WAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YAEvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM;iBACpB,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;iBAC1C,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvB,IACE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAC9B,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,WAAW;gBACpC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;gBAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC5D,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,4CAA4C;gBAC5C,SAAS,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;aAC9B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,UAAmB;IAEnB,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,oBAAoB,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,oBAAoB;QAChC,CAAC,CAAC,eAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC;IAE5B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAMD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,KAAa,EACb,IAGC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QAChD,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtC,yBAAyB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/C,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,gEAAgE;QAChE,iCAAiC;QACjC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,eAAe,CAAC;gBACpB,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAa,EACb,IAaC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,SAAS,CAAC;IAEhB,uCAAuC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,0BAA0B,CACzC,IAAI,CAAC,YAAY,EACjB,aAAa,CACd,CAAC;QACF,OAAO,YAAY,CACjB,sYAAsY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,+EAA+E,CAC9e,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACjE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;;;;yCAIiB,SAAS;;8BAEpB,CAAC,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,iBAAiB,CACf,KAAK,EACL,UAAU,EACV,6BAA6B,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CACjE,CAAC;IACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;kEAGkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,ilBAAilB,IAAI,0KAA0K,EAC/vB,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAO,GAAG,yBAAyB;IAEnC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,yPAAyP,IAAI,mDAAmD,CACjT,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,MAAM,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,IAAI,cAAc,CAAC;IACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3C,OAAO,GAAG;SACP,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CACjC,YAAqB,EACrB,KAAc;IAEd,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,MAAM;QACX,CAAC,CAAC,gCAAgC,MAAM,EAAE;QAC1C,CAAC,CAAC,8BAA8B,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAe,EACf,KAAc,EACd,YAAqB,EACrB,KAAc;IAEd,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,OAAO,YAAY,CACjB,isBAAisB,GAAG,2FAA2F,YAAY,2bAA2b,YAAY,4KAA4K,CAC/5C,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,oDAAoD,CACrD,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared Google OAuth utilities for all templates.\n *\n * Handles platform detection (desktop/mobile), state encoding,\n * session token creation, and deep-link responses — the logic\n * that was previously copy-pasted across every template's\n * google-auth.ts handler.\n */\n\nimport crypto from \"node:crypto\";\nimport {\n  getHeader,\n  getQuery,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport {\n  addSession,\n  getSession,\n  getSessionMaxAge,\n  setFrameworkSessionCookie,\n} from \"./auth.js\";\nimport { getAppName } from \"./app-name.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\nimport { writeDesktopSso } from \"./desktop-sso.js\";\nimport { appendSessionToOAuthReturnUrl } from \"./oauth-return-url.js\";\n\n// ─── Platform Detection ─────────────────────────────────────────────────────\n\n/** Return an HTML response with the correct Content-Type.\n *  Uses a web-standard Response to ensure the header survives\n *  Nitro dev mode's mock-node-response pipeline. */\nfunction htmlResponse(html: string, status = 200): Response {\n  return new Response(html, {\n    status,\n    headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n  });\n}\n\n/** Shared markup for OAuth success \"close this tab\" pages. Renders a green\n *  check icon above the message, with a little breathing room between the\n *  headline and secondary line. Used by every template that goes through the\n *  shared Google OAuth flow. */\nfunction oauthDebugFlowId(flowId?: string): string | undefined {\n  return flowId ? flowId.slice(-10) : undefined;\n}\n\nfunction oauthSuccessCloseTabHtml(\n  headline: string,\n  footnote: string,\n  debugFlowId?: string,\n): string {\n  const debug = debugFlowId\n    ? `<p style=\"font-size:11px;color:#555;margin:12px 0 0 0\">Debug flow: ${escapeHtml(debugFlowId)}</p>`\n    : \"\";\n  return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#22c55e\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M9 12l2 2l4 -4\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0\">${headline}</p><p style=\"font-size:13px;color:#888;margin:0\">${footnote}</p>${debug}<script>console.info(\"[agent-native][google-oauth] success page loaded\",{flow:${JSON.stringify(debugFlowId || null)}});setTimeout(function(){try{window.close()}catch(e){}},250)</script></body></html>`;\n}\n\n/**\n * HTML escape — minimal but covers the cases that matter when interpolating\n * user-controlled values into our OAuth callback HTML. Mirrors the helper in\n * email-template.ts; kept inline here to avoid a circular import.\n */\nfunction escapeHtml(s: string): string {\n  return String(s ?? \"\")\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * Detect requests from the Agent Native desktop app specifically.\n *\n * The desktop app appends `AgentNativeDesktop/<version>` to its user-agent\n * (see `packages/desktop-app/src/main/index.ts`). We check for that marker\n * rather than matching generic `Electron`, which would also match other\n * Electron-based webviews like Builder.io's Fusion, Slack desktop, Discord,\n * etc. Falsely treating those as \"the desktop app\" sends users to the\n * `agentnative://oauth-complete` deep-link success page after Google sign-in,\n * where the protocol handler can't fire and the \"Open Agent Native\" button\n * does nothing.\n *\n * Kept exported as `isElectron` for backwards compatibility with consumers.\n */\nexport function isElectron(event: H3Event): boolean {\n  return /AgentNativeDesktop/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/** Detect requests from a mobile browser (iOS/Android). */\nexport function isMobile(event: H3Event): boolean {\n  return /iPhone|iPad|iPod|Android/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/**\n * Build the static allowlist of origins we trust for `getOrigin`. Reads\n * deployment-known public URLs. Each entry is normalised to\n * `${proto}://${host}` (no path). Duplicates collapse, invalid entries are\n * dropped silently.\n */\nconst EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS = [\n  \"WORKSPACE_OAUTH_ORIGIN\",\n  \"VITE_WORKSPACE_OAUTH_ORIGIN\",\n  \"APP_URL\",\n  \"VITE_APP_URL\",\n  \"BETTER_AUTH_URL\",\n  \"VITE_BETTER_AUTH_URL\",\n  \"URL\",\n  \"DEPLOY_URL\",\n] as const;\n\nconst WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS = [\n  \"WORKSPACE_GATEWAY_URL\",\n  \"VITE_WORKSPACE_GATEWAY_URL\",\n] as const;\n\nfunction normalizeOrigin(raw: string | undefined): string | undefined {\n  if (!raw) return undefined;\n  try {\n    const u = new URL(raw);\n    return `${u.protocol}//${u.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction addNormalizedOrigin(\n  out: Set<string>,\n  raw: string | undefined,\n  options: { allowLoopback: boolean },\n): void {\n  const origin = normalizeOrigin(raw);\n  if (!origin) return;\n  if (!options.allowLoopback && isLoopbackOrigin(origin)) return;\n  out.add(origin);\n}\n\nfunction firstOriginFromEnv(\n  keys: readonly string[],\n  options: { allowLoopback: boolean },\n): string | undefined {\n  for (const key of keys) {\n    const origin = normalizeOrigin(process.env[key]);\n    if (!origin) continue;\n    if (!options.allowLoopback && isLoopbackOrigin(origin)) continue;\n    return origin;\n  }\n  return undefined;\n}\n\nfunction getConfiguredOriginAllowlist(): Set<string> {\n  const out = new Set<string>();\n  for (const key of EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS) {\n    addNormalizedOrigin(out, process.env[key], { allowLoopback: true });\n  }\n  for (const key of WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS) {\n    addNormalizedOrigin(out, process.env[key], { allowLoopback: false });\n  }\n  return out;\n}\n\nfunction firstConfiguredOrigin(): string | undefined {\n  return [...getConfiguredOriginAllowlist()][0];\n}\n\nfunction getWorkspaceCallbackOrigin(): string | undefined {\n  const publicAuthOrigin = firstOriginFromEnv(EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS, {\n    allowLoopback: true,\n  });\n  if (publicAuthOrigin) return publicAuthOrigin;\n\n  return firstOriginFromEnv(WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS, {\n    allowLoopback: false,\n  });\n}\n\nfunction isLoopbackHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    return (\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\" ||\n      parsed.hostname === \"::1\" ||\n      parsed.hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    return isLoopbackHost(new URL(origin).host);\n  } catch {\n    return false;\n  }\n}\n\nfunction isBuilderPreviewHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    const hostname = parsed.hostname.toLowerCase();\n    return (\n      hostname === \"builderio.xyz\" ||\n      hostname.endsWith(\".builderio.xyz\") ||\n      hostname === \"builderio.dev\" ||\n      hostname.endsWith(\".builderio.dev\") ||\n      hostname === \"builder.codes\" ||\n      hostname.endsWith(\".builder.codes\") ||\n      hostname === \"builder.io\" ||\n      hostname.endsWith(\".builder.io\") ||\n      hostname === \"builder.my\" ||\n      hostname.endsWith(\".builder.my\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Get the origin from forwarded headers or Host.\n *\n * Defends against Host-header injection: in production we require the resolved\n * origin to match `APP_URL` / `BETTER_AUTH_URL` / `WORKSPACE_GATEWAY_URL`,\n * falling back to those values when inbound headers are missing or don't match.\n * In dev we accept inbound `Host` so localhost / ngrok / preview hosts keep\n * working without configuration, except workspace OAuth requests from loopback\n * or Builder preview hosts use the configured gateway origin when one exists.\n * The protocol defaults to `https` in production (so a TLS-terminating proxy\n * that drops `x-forwarded-proto` doesn't downgrade us to plain HTTP).\n */\nexport function getOrigin(event: H3Event): string {\n  const headerHost =\n    getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const isProd = process.env.NODE_ENV === \"production\";\n  const headerProto =\n    getHeader(event, \"x-forwarded-proto\") || (isProd ? \"https\" : \"http\");\n  const workspaceCallbackOrigin = isWorkspaceOAuthCallbackRelayEnabled()\n    ? getWorkspaceCallbackOrigin()\n    : undefined;\n\n  if (\n    workspaceCallbackOrigin &&\n    (isLoopbackHost(headerHost) || isBuilderPreviewHost(headerHost))\n  ) {\n    return workspaceCallbackOrigin;\n  }\n\n  if (isProd) {\n    const allow = getConfiguredOriginAllowlist();\n    // If the deploy declares its public URL, prefer it over inbound headers.\n    if (allow.size > 0) {\n      const inbound = headerHost ? `${headerProto}://${headerHost}` : \"\";\n      if (inbound && allow.has(inbound)) return inbound;\n      // Inbound didn't match — fall back to the first configured origin.\n      return [...allow][0];\n    }\n    // No allowlist configured: still default to https, but accept the\n    // inbound Host (best we can do without a configured base URL).\n    return `${headerProto}://${headerHost ?? \"\"}`;\n  }\n\n  return `${headerProto}://${headerHost ?? \"localhost\"}`;\n}\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\n/** App mount prefix, if the template is served under APP_BASE_PATH. */\nexport function getAppBasePath(): string {\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n}\n\n/** Build an absolute same-origin URL that preserves APP_BASE_PATH. */\nexport function getAppUrl(event: H3Event, path = \"/\"): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${getOrigin(event)}${getAppBasePath()}${cleanPath}`;\n}\n\nfunction isWorkspaceOAuthCallbackRelayEnabled(): boolean {\n  return (\n    process.env.AGENT_NATIVE_WORKSPACE === \"1\" ||\n    process.env.VITE_AGENT_NATIVE_WORKSPACE === \"1\"\n  );\n}\n\nfunction isFrameworkOAuthCallbackPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/_agent-native/\") &&\n    (pathname.endsWith(\"/callback\") || pathname.includes(\"/callback/\"))\n  );\n}\n\nfunction getOriginalRequestPath(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return mountedPathname;\n  }\n\n  const urlPathname = (event as any).url?.pathname;\n  if (typeof urlPathname === \"string\" && urlPathname) return urlPathname;\n\n  const nodeUrl = event.node?.req?.url;\n  if (typeof nodeUrl === \"string\" && nodeUrl) {\n    const queryStart = nodeUrl.indexOf(\"?\");\n    return queryStart >= 0 ? nodeUrl.slice(0, queryStart) : nodeUrl;\n  }\n\n  const eventPath = (event as any).path;\n  if (typeof eventPath === \"string\" && eventPath) {\n    const queryStart = eventPath.indexOf(\"?\");\n    return queryStart >= 0 ? eventPath.slice(0, queryStart) : eventPath;\n  }\n\n  return \"/\";\n}\n\nfunction isRequestUnderAppBasePath(event: H3Event): boolean {\n  const basePath = getAppBasePath();\n  if (!basePath) return false;\n  const requestPath = getOriginalRequestPath(event);\n  return (\n    requestPath === `${basePath}/_agent-native` ||\n    requestPath.startsWith(`${basePath}/_agent-native/`)\n  );\n}\n\nfunction getDefaultOAuthRedirectUrl(event: H3Event, path: string): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  if (\n    isWorkspaceOAuthCallbackRelayEnabled() &&\n    isFrameworkOAuthCallbackPath(cleanPath)\n  ) {\n    return `${getOrigin(event)}${cleanPath}`;\n  }\n  const basePath = isRequestUnderAppBasePath(event) ? getAppBasePath() : \"\";\n  return `${getOrigin(event)}${basePath}${cleanPath}`;\n}\n\n// ─── redirect_uri Allowlist ──────────────────────────────────────────────────\n\n/**\n * Validate a user-supplied `redirect_uri` for OAuth flows.\n *\n * Defends against authorization-code interception (RFC 6819 §4.4.1.7):\n * even though the upstream provider (Google/Atlassian/Zoom) refuses\n * unregistered redirect URIs, prefix-style registrations and side\n * registrations on the same host let a malicious caller swap in an\n * attacker-controlled URI that the provider still accepts. We reject any\n * candidate that isn't on this server's own origin AND under the\n * framework's `/_agent-native/` namespace. Returns the validated URI on\n * success, or `undefined` on rejection — callers must treat `undefined`\n * as a 400.\n *\n * The intentional shape is exact-prefix:\n *   - Origin must equal `getOrigin(event)` — no Host-header injection\n *     reusing somebody else's registered redirect URI.\n *   - Path must start with `${appBasePath}/_agent-native/` so we never\n *     hand auth codes to a public marketing or open-redirect endpoint\n *     on the same registered host.\n *\n * For desktop / native flows that need ephemeral `http://127.0.0.1:<port>`\n * loopback URIs, callers should validate those at the template level\n * with a dedicated allowlist — this helper rejects them by design.\n */\nexport function isAllowedOAuthRedirectUri(\n  candidate: string,\n  event: H3Event,\n): boolean {\n  if (typeof candidate !== \"string\" || candidate.length === 0) return false;\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    return false;\n  }\n  // Must be same origin as our server.\n  const expectedOrigin = getOrigin(event);\n  let expectedUrl: URL;\n  try {\n    expectedUrl = new URL(expectedOrigin);\n  } catch {\n    return false;\n  }\n  if (url.protocol !== expectedUrl.protocol) return false;\n  if (url.host !== expectedUrl.host) return false;\n  // Must live under the framework's namespace. Workspace deploys can route\n  // root /_agent-native/* to Dispatch even when Dispatch itself is mounted at\n  // /dispatch, but app-prefixed requests should not be able to swap their\n  // callback to that root namespace.\n  const basePath = getAppBasePath();\n  const allowedPrefixes =\n    basePath && isRequestUnderAppBasePath(event)\n      ? [\n          `${basePath}/_agent-native/`,\n          ...(isWorkspaceOAuthCallbackRelayEnabled() &&\n          isFrameworkOAuthCallbackPath(url.pathname)\n            ? [\"/_agent-native/\"]\n            : []),\n        ]\n      : [\"/_agent-native/\"];\n  if (!allowedPrefixes.some((prefix) => url.pathname.startsWith(prefix))) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the `redirect_uri` for an outbound OAuth `auth-url` request.\n *\n * Reads `?redirect_uri=` from the query and validates it via\n * `isAllowedOAuthRedirectUri`. Returns:\n *   - the validated URI when supplied and allowed, OR\n *   - the framework default when no override was supplied, OR\n *   - `null` when an override was supplied but rejected — callers must\n *     respond with 400 in that case.\n *\n * Templates that need a non-default redirect path can pass it via\n * `defaultPath` (e.g. `\"/_agent-native/google/desktop-callback\"` for\n * desktop flows).\n */\nexport function resolveOAuthRedirectUri(\n  event: H3Event,\n  defaultPath = \"/_agent-native/google/callback\",\n): string | null {\n  const supplied = getQuery(event).redirect_uri;\n  if (typeof supplied === \"string\" && supplied.length > 0) {\n    return isAllowedOAuthRedirectUri(supplied, event) ? supplied : null;\n  }\n  return getDefaultOAuthRedirectUrl(event, defaultPath);\n}\n\n// ─── OAuth State ─────────────────────────────────────────────────────────────\n\nexport interface OAuthStatePayload {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  /**\n   * Same-origin path to redirect to after a successful web-flow sign-in.\n   * Threaded through the (HMAC-signed) state so it survives the round trip\n   * to Google. Validated again on decode via safeReturnPath as defence in\n   * depth. Has no effect on desktop / mobile / add-account flows, which\n   * use their own deep-link / close-tab handling.\n   */\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Ephemeral in-memory state-signing key for development. Generated lazily\n * on first read so dev sessions don't depend on filesystem writability or\n * env-var configuration. Sessions reset on each restart, which is fine\n * for dev — no real users / production data are involved.\n */\nlet _devStateSigningKey: string | undefined;\n\n/**\n * Derive a server-only signing key for HMAC verification of OAuth state.\n *\n * Uses a dedicated secret — never an OAuth client secret. Reusing a\n * client_secret (which is shared with Google / GitHub / Atlassian) as our\n * own HMAC key conflates two trust domains: rotating the client secret\n * silently invalidates every in-flight OAuth state, and any leak of the\n * client secret also lets an attacker forge our state envelopes.\n *\n * Resolution order:\n *   1. OAUTH_STATE_SECRET (preferred — dedicated to this purpose)\n *   2. BETTER_AUTH_SECRET (already used by Better Auth as a server secret)\n *   3. Hosted workspace deploys derive a per-purpose key from A2A_SECRET\n *   4. In dev only, an ephemeral random key (per-process)\n *\n * In production, throws if no usable server secret is set.\n */\nfunction getStateSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET ||\n    process.env.BETTER_AUTH_SECRET ||\n    getWorkspaceA2ADerivedSecret(\"oauth-state\");\n  if (secret) return secret;\n\n  const isProd = process.env.NODE_ENV === \"production\";\n  if (isProd) {\n    throw new Error(\n      \"OAuth state signing requires a server secret. \" +\n        \"Set OAUTH_STATE_SECRET, BETTER_AUTH_SECRET, or A2A_SECRET in production workspace deploys.\",\n    );\n  }\n\n  if (!_devStateSigningKey) {\n    _devStateSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devStateSigningKey;\n}\n\n/**\n * Options for the named-argument form of {@link encodeOAuthState}.\n * Prefer this form — the positional overload is easy to misuse (the mail\n * and calendar templates historically passed `flowId` in the `returnUrl`\n * slot, smuggling state into a defence-in-depth path).\n */\nexport interface EncodeOAuthStateOptions {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Encode OAuth state into a signed base64url string.\n * The state is HMAC-signed so the callback can verify it wasn't forged,\n * preventing CSRF attacks on the OAuth flow.\n *\n * Two call shapes are supported:\n *   - Recommended: pass an options object — clear, mismatch-proof.\n *     `encodeOAuthState({ redirectUri, owner, desktop, ... })`\n *   - Legacy positional form (kept working for backward compatibility):\n *     `encodeOAuthState(redirectUri, owner, desktop, addAccount, app, returnUrl, flowId)`.\n *     Callers should migrate to the options form — see the audit on\n *     templates/mail and templates/calendar where the positional shape\n *     led to `flowId` being smuggled in via the `returnUrl` slot.\n */\nexport function encodeOAuthState(opts: EncodeOAuthStateOptions): string;\nexport function encodeOAuthState(\n  redirectUri: string,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string;\nexport function encodeOAuthState(\n  redirectUriOrOpts: string | EncodeOAuthStateOptions,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string {\n  const opts: EncodeOAuthStateOptions =\n    typeof redirectUriOrOpts === \"string\"\n      ? {\n          redirectUri: redirectUriOrOpts,\n          owner,\n          desktop,\n          addAccount,\n          app,\n          returnUrl,\n          flowId,\n        }\n      : redirectUriOrOpts;\n\n  const nonce = crypto.randomBytes(8).toString(\"hex\");\n  const payload: Record<string, string | boolean> = {\n    n: nonce,\n    r: opts.redirectUri,\n  };\n  if (opts.owner) payload.o = opts.owner;\n  if (opts.desktop) payload.d = true;\n  if (opts.addAccount) payload.a = true;\n  if (opts.app) payload.app = opts.app;\n  if (opts.returnUrl) payload.r2 = opts.returnUrl;\n  if (opts.flowId) payload.f = opts.flowId;\n  const data = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  const sig = crypto\n    .createHmac(\"sha256\", getStateSigningKey())\n    .update(data)\n    .digest(\"base64url\");\n  return `${data}.${sig}`;\n}\n\n/**\n * Decode and verify OAuth state from the callback's state query parameter.\n * Rejects forged or tampered state by checking the HMAC signature.\n * Falls back to the provided URI if decoding or verification fails.\n */\nexport function decodeOAuthState(\n  stateParam: string | undefined,\n  fallbackUri: string,\n): OAuthStatePayload {\n  if (stateParam) {\n    try {\n      const dotIdx = stateParam.lastIndexOf(\".\");\n      if (dotIdx === -1) return { redirectUri: fallbackUri };\n\n      const data = stateParam.slice(0, dotIdx);\n      const sig = stateParam.slice(dotIdx + 1);\n      const expected = crypto\n        .createHmac(\"sha256\", getStateSigningKey())\n        .update(data)\n        .digest(\"base64url\");\n\n      if (\n        sig.length !== expected.length ||\n        !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))\n      ) {\n        return { redirectUri: fallbackUri };\n      }\n\n      const parsed = JSON.parse(Buffer.from(data, \"base64url\").toString());\n      return {\n        redirectUri: parsed.r || fallbackUri,\n        owner: parsed.o || undefined,\n        desktop: !!parsed.d,\n        addAccount: !!parsed.a,\n        app: typeof parsed.app === \"string\" ? parsed.app : undefined,\n        // Pass returnUrl through as-is — same-origin validation runs at the\n        // consumer (oauthCallbackResponse → safeReturnPath). The state is\n        // HMAC-signed, but we still validate at consumption as defence in\n        // depth in case the signing key ever leaks.\n        returnUrl: typeof parsed.r2 === \"string\" ? parsed.r2 : undefined,\n        flowId: parsed.f || undefined,\n      };\n    } catch {}\n  }\n  return { redirectUri: fallbackUri };\n}\n\n// ─── Session Creation ────────────────────────────────────────────────────────\n\nexport interface OAuthOwnerResult {\n  owner: string | undefined;\n  hasProductionSession: boolean;\n}\n\n/**\n * Determine the token owner from the current session and OAuth state.\n * Call this BEFORE exchangeCode to get the owner parameter.\n */\nexport async function resolveOAuthOwner(\n  event: H3Event,\n  stateOwner?: string,\n): Promise<OAuthOwnerResult> {\n  const existingSession = await getSession(event);\n  const hasProductionSession = !!existingSession?.email;\n  const owner = hasProductionSession\n    ? existingSession!.email\n    : stateOwner || undefined;\n\n  return { owner, hasProductionSession };\n}\n\nexport interface OAuthSessionResult {\n  sessionToken: string | undefined;\n}\n\n/**\n * Create a session token after a successful OAuth exchange.\n *\n * Desktop and mobile apps have separate cookie jars from the system\n * browser, so they always get a fresh session token (even if the browser\n * already has one). The token is then passed via deep link so the native\n * app can inject it.\n */\nexport async function createOAuthSession(\n  event: H3Event,\n  email: string,\n  opts: {\n    hasProductionSession: boolean;\n    desktop?: boolean;\n  },\n): Promise<OAuthSessionResult> {\n  const mobile = isMobile(event);\n  const needsDeepLink = opts.desktop || mobile;\n  const maxAge = getSessionMaxAge();\n\n  let sessionToken: string | undefined;\n  if (!opts.hasProductionSession || needsDeepLink) {\n    sessionToken = crypto.randomBytes(32).toString(\"hex\");\n    await addSession(sessionToken, email);\n    setFrameworkSessionCookie(event, sessionToken);\n    // Desktop SSO: record this session in the home-dir broker file so\n    // sibling templates (each with its own database) can resolve the\n    // same token without a DB row of their own. Only the PRIMARY\n    // sign-in writes the broker — if a production session already\n    // exists, this is an add-account flow (connecting a secondary\n    // Google account for scraping) and must never switch the active\n    // user across sibling templates.\n    if (opts.desktop && !opts.hasProductionSession) {\n      await writeDesktopSso({\n        email,\n        token: sessionToken,\n        expiresAt: Date.now() + maxAge * 1000,\n      });\n    }\n  }\n\n  return { sessionToken };\n}\n\n// ─── Callback Responses ──────────────────────────────────────────────────────\n\n/**\n * Return the appropriate response after a successful OAuth callback.\n *\n * Handles mobile deep links, desktop deep links, add-account close-tab\n * pages, and plain web redirects — so templates don't have to.\n */\nexport function oauthCallbackResponse(\n  event: H3Event,\n  email: string,\n  opts: {\n    sessionToken?: string;\n    desktop?: boolean;\n    addAccount?: boolean;\n    /**\n     * Same-origin path to return the viewer to after a successful web\n     * sign-in. Validated via safeReturnPath; falls back to \"/\" for any\n     * shape that escapes same-origin. Has no effect on desktop / mobile\n     * / add-account flows — those use their own deep-link handling.\n     */\n    returnUrl?: string;\n    flowId?: string;\n    appName?: string;\n  },\n): Response | string | unknown | Promise<Response | string | unknown> {\n  const mobile = isMobile(event);\n  const query = getQuery(event);\n  const callbackState =\n    typeof query.state === \"string\" && query.state.length > 0\n      ? query.state\n      : undefined;\n\n  // Mobile: deep link back to native app\n  if (mobile) {\n    const deepLink = buildOAuthCompleteDeepLink(\n      opts.sessionToken,\n      callbackState,\n    );\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\"><title>Connected</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p>Connected! Returning to app…</p><script>window.location.href=${JSON.stringify(deepLink)};setTimeout(function(){window.location.href=\"/\"},1500)</script></body></html>`,\n    );\n  }\n\n  // Desktop add-account: close-tab page (must come before general desktop check\n  // to ensure no deep link fires and the existing session is never switched).\n  if (opts.desktop && opts.addAccount) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Electron desktop exchange flow: mail/calendar still pass a flow id so the\n  // renderer can poll as a fallback, but the main handoff should use the\n  // protocol deep link so the popup returns focus to the desktop app.\n  if (opts.desktop && opts.flowId && isElectron(event) && opts.sessionToken) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Desktop exchange flow (non-Electron tray app): the tray app polls the\n  // desktop-exchange endpoint for the token — no deep link needed.\n  if (opts.desktop && opts.flowId) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Signed in as ${safeEmail}!` : \"Signed in!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Desktop login: deep link back to Electron app — only when the callback\n  // request actually carries the AgentNativeDesktop UA marker. Without this\n  // check, any client whose OAuth state was minted with `desktop=true` (e.g.\n  // a stale link, or an upstream that wrongly set `?desktop=1`) would land\n  // on the `agentnative://` page where the deep link can't fire and the\n  // \"Open Agent Native\" button does nothing — surfaces inside Builder.io's\n  // Fusion webview hit this exact dead-end. Fall through to the web flow\n  // for non-Agent-Native-Desktop clients so they get a real redirect.\n  if (opts.desktop && isElectron(event)) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Add-account web flow: close-tab page. The email is rendered into the\n  // page via DOM `textContent` (safe), but we still JSON-stringify so a\n  // payload containing `</script>` can't break out of the script tag —\n  // and explicitly assert it's a string so a callbacks like `null` or\n  // an object won't end up serialised into the page.\n  if (opts.addAccount) {\n    const safeEmail = JSON.stringify(typeof email === \"string\" ? email : \"\");\n    return htmlResponse(`<!DOCTYPE html><html><body><script>\n        window.close();\n        var p = document.createElement('p');\n        p.style.cssText = 'font-family:system-ui;text-align:center;margin-top:40vh';\n        p.textContent = 'Connected ' + ${safeEmail} + '! You can close this tab.';\n        document.body.appendChild(p);\n      </script></body></html>`);\n  }\n\n  // Web: redirect to the requested return target. Path-only returns stay\n  // same-origin; Builder desktop workspace returns may point back to the\n  // local loopback gateway and carry the short-lived `_session` bridge so\n  // the local app can promote the newly created hosted OAuth session.\n  setResponseStatus(event, 302);\n  setResponseHeader(\n    event,\n    \"Location\",\n    appendSessionToOAuthReturnUrl(opts.returnUrl, opts.sessionToken),\n  );\n  setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n  return \"\";\n}\n\n/** HTML error page for OAuth failures. The message is HTML-escaped — most\n *  callers pass `error.message` from a token-exchange or userinfo failure,\n *  which can echo upstream provider strings (and historically attacker-\n *  controlled query params via the `error_description` field). */\nexport function oauthErrorPage(message: string): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connection failed</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;text-align:center\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ef4444\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M15 9l-6 6\"/><path d=\"M9 9l6 6\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0;color:#ddd\">${safe}</p><p style=\"font-size:13px;color:#888;margin:0\"><a href=\"/\" style=\"color:#888;text-decoration:underline;text-underline-offset:3px\">Back to login</a></p></body></html>`,\n    400,\n  );\n}\n\nexport function oauthDesktopExchangePage(\n  message = \"Returning to the app...\",\n): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Returning</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p style=\"font-size:14px\">${safe}</p><script>window.close()</script></body></html>`,\n  );\n}\n\n// ─── Internal ────────────────────────────────────────────────────────────────\n\nfunction resolveOAuthAppName(explicit?: string): string {\n  const raw = explicit || getAppName() || \"Agent Native\";\n  if (!/^[a-z0-9_-]+$/.test(raw)) return raw;\n  return raw\n    .split(/[-_]+/)\n    .filter(Boolean)\n    .map((word) => word[0].toUpperCase() + word.slice(1))\n    .join(\" \");\n}\n\nfunction buildOAuthCompleteDeepLink(\n  sessionToken?: string,\n  state?: string,\n): string {\n  const params = new URLSearchParams();\n  if (sessionToken) params.set(\"token\", sessionToken);\n  if (state) params.set(\"state\", state);\n  const suffix = params.toString();\n  return suffix\n    ? `agentnative://oauth-complete?${suffix}`\n    : \"agentnative://oauth-complete\";\n}\n\nfunction desktopSuccessPage(\n  _event: H3Event,\n  email?: string,\n  sessionToken?: string,\n  state?: string,\n): Response {\n  const safeEmail = email ? escapeHtml(email) : \"\";\n  const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n  if (sessionToken) {\n    const deepLink = buildOAuthCompleteDeepLink(sessionToken, state);\n    const deepLinkJson = JSON.stringify(deepLink);\n    // Defence in depth: if this page somehow gets served to a UA that isn't\n    // the Agent Native desktop app (server gate bypassed, stale link, etc.),\n    // skip the `agentnative://` deep link entirely and bounce to the app\n    // root. The deep link silently fails outside the desktop app and the\n    // \"Open Agent Native\" button is a dead end in a generic browser/webview.\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title><style>@keyframes spin{to{transform:rotate(360deg)}}@keyframes fadeIn{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}.spinner{width:28px;height:28px;border:2px solid #333;border-top-color:#fff;border-radius:50%;animation:spin .8s linear infinite}.fallback{display:none;flex-direction:column;align-items:center;gap:8px;animation:fadeIn .2s ease-out}.fallback.show{display:flex}</style></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:16px\"><p style=\"font-size:16px;margin:0\">${msg}</p><div id=\"loading\" class=\"spinner\"></div><div id=\"fallback\" class=\"fallback\"><a href=${deepLinkJson} style=\"display:inline-block;padding:10px 24px;background:#fff;color:#000;border-radius:8px;text-decoration:none;font-size:14px;font-weight:500\">Open Agent Native</a><p style=\"font-size:12px;color:#666;margin:0\">If the app didn\\u2019t open automatically, click the button above.</p></div><script>(function(){var ua=(navigator.userAgent||\"\");if(ua.indexOf(\"AgentNativeDesktop\")===-1){window.location.replace(\"/\");return}window.location.href=${deepLinkJson};setTimeout(function(){document.getElementById(\"loading\").style.display=\"none\";document.getElementById(\"fallback\").classList.add(\"show\")},3000)})()</script></body></html>`,\n    );\n  }\n  return htmlResponse(\n    oauthSuccessCloseTabHtml(\n      msg,\n      \"You can close this tab and return to Agent Native.\",\n    ),\n  );\n}\n"]}
+{"version":3,"file":"google-oauth.js","sourceRoot":"","sources":["../../src/server/google-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,EACL,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AAEtE,+EAA+E;AAE/E;;oDAEoD;AACpD,SAAS,YAAY,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;gCAGgC;AAChC,SAAS,gBAAgB,CAAC,MAAe;IACvC,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,wBAAwB,CAC/B,QAAgB,EAChB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,KAAK,GAAG,WAAW;QACvB,CAAC,CAAC,sEAAsE,UAAU,CAAC,WAAW,CAAC,MAAM;QACrG,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,4hBAA4hB,QAAQ,qDAAqD,QAAQ,OAAO,KAAK,iFAAiF,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,qFAAqF,CAAC;AACh0B,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;SACnB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,+BAA+B,GAAG;IACtC,wBAAwB;IACxB,6BAA6B;IAC7B,SAAS;IACT,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,KAAK;IACL,YAAY;CACJ,CAAC;AAEX,MAAM,iCAAiC,GAAG;IACxC,uBAAuB;IACvB,4BAA4B;CACpB,CAAC;AAEX,SAAS,eAAe,CAAC,GAAuB;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAgB,EAChB,GAAuB,EACvB,OAAmC;IAEnC,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO;IAC/D,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAuB,EACvB,OAAmC;IAEnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,gBAAgB,CAAC,MAAM,CAAC;YAAE,SAAS;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,+BAA+B,EAAE,CAAC;QAClD,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,iCAAiC,EAAE,CAAC;QACpD,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,0BAA0B;IACjC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,+BAA+B,EAAE;QAC3E,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,IAAI,gBAAgB;QAAE,OAAO,gBAAgB,CAAC;IAE9C,OAAO,kBAAkB,CAAC,iCAAiC,EAAE;QAC3D,aAAa,EAAE,KAAK;KACrB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CACL,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,WAAW;YAC/B,MAAM,CAAC,QAAQ,KAAK,KAAK;YACzB,MAAM,CAAC,QAAQ,KAAK,OAAO,CAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA0B;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAwB;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,OAAO,CACL,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,eAAe;YAC5B,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACnC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAChC,QAAQ,KAAK,YAAY;YACzB,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC,CACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,MAAM,UAAU,GACd,SAAS,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,MAAM,WAAW,GACf,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACvE,MAAM,uBAAuB,GAAG,oCAAoC,EAAE;QACpE,CAAC,CAAC,0BAA0B,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;IAEd,IACE,uBAAuB;QACvB,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,oBAAoB,CAAC,UAAU,CAAC,CAAC,EAChE,CAAC;QACD,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,4BAA4B,EAAE,CAAC;QAC7C,yEAAyE;QACzE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,MAAM,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAClD,mEAAmE;YACnE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,kEAAkE;QAClE,+DAA+D;QAC/D,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,GAAG,WAAW,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,cAAc;IAC5B,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,IAAI,GAAG,GAAG;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,cAAc,EAAE,GAAG,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,oCAAoC;IAC3C,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,GAAG;QAC1C,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAChD,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACpD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAI,KAAa,CAAC,GAAG,EAAE,QAAQ,CAAC;IACjD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAClE,CAAC;IAED,MAAM,SAAS,GAAI,KAAa,CAAC,IAAI,CAAC;IACtC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc;IAC/C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,WAAW,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,CACL,WAAW,KAAK,GAAG,QAAQ,gBAAgB;QAC3C,WAAW,CAAC,UAAU,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAc,EAAE,IAAY;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC3D,IACE,oCAAoC,EAAE;QACtC,4BAA4B,CAAC,SAAS,CAAC,EACvC,CAAC;QACD,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,SAAS,EAAE,CAAC;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1E,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,QAAQ,GAAG,SAAS,EAAE,CAAC;AACtD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAiB,EACjB,KAAc;IAEd,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qCAAqC;IACrC,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,WAAgB,CAAC;IACrB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,mCAAmC;IACnC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,eAAe,GACnB,QAAQ,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC;YACE,GAAG,QAAQ,iBAAiB;YAC5B,GAAG,CAAC,oCAAoC,EAAE;gBAC1C,4BAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACxC,CAAC,CAAC,CAAC,iBAAiB,CAAC;gBACrB,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC1B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,WAAW,GAAG,gCAAgC;IAE9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC;IAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACtE,CAAC;IACD,OAAO,0BAA0B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACxD,CAAC;AAqBD;;;;;GAKG;AACH,IAAI,mBAAuC,CAAC;AAE5C;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,kBAAkB;IACzB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,4BAA4B,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,gDAAgD;YAC9C,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,mBAAmB,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AA0CD,MAAM,UAAU,gBAAgB,CAC9B,iBAAmD,EACnD,KAAc,EACd,OAAiB,EACjB,UAAoB,EACpB,GAAY,EACZ,SAAkB,EAClB,MAAe;IAEf,MAAM,IAAI,GACR,OAAO,iBAAiB,KAAK,QAAQ;QACnC,CAAC,CAAC;YACE,WAAW,EAAE,iBAAiB;YAC9B,KAAK;YACL,OAAO;YACP,UAAU;YACV,GAAG;YACH,SAAS;YACT,MAAM;SACP;QACH,CAAC,CAAC,iBAAiB,CAAC;IAExB,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAqC;QAChD,CAAC,EAAE,KAAK;QACR,CAAC,EAAE,IAAI,CAAC,WAAW;KACpB,CAAC;IACF,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IACtC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,MAAM;SACf,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;SAC1C,MAAM,CAAC,IAAI,CAAC;SACZ,MAAM,CAAC,WAAW,CAAC,CAAC;IACvB,OAAO,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAA8B,EAC9B,WAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,MAAM,KAAK,CAAC,CAAC;gBAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YAEvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM;iBACpB,UAAU,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;iBAC1C,MAAM,CAAC,IAAI,CAAC;iBACZ,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvB,IACE,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;gBAC9B,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAChE,CAAC;gBACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACrE,OAAO;gBACL,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,WAAW;gBACpC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;gBAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACnB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;gBACtB,GAAG,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC5D,oEAAoE;gBACpE,kEAAkE;gBAClE,kEAAkE;gBAClE,4CAA4C;gBAC5C,SAAS,EAAE,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,SAAS;aAC9B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAc,EACd,UAAmB;IAEnB,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,oBAAoB,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,CAAC;IACtD,MAAM,KAAK,GAAG,oBAAoB;QAChC,CAAC,CAAC,eAAgB,CAAC,KAAK;QACxB,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC;IAE5B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAMD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAc,EACd,KAAa,EACb,IAGC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAElC,IAAI,YAAgC,CAAC;IACrC,IAAI,CAAC,IAAI,CAAC,oBAAoB,IAAI,aAAa,EAAE,CAAC;QAChD,YAAY,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACtC,yBAAyB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAC/C,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,8DAA8D;QAC9D,8DAA8D;QAC9D,gEAAgE;QAChE,iCAAiC;QACjC,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,eAAe,CAAC;gBACpB,KAAK;gBACL,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,KAAa,EACb,IAaC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,aAAa,GACjB,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACvD,CAAC,CAAC,KAAK,CAAC,KAAK;QACb,CAAC,CAAC,SAAS,CAAC;IAEhB,uCAAuC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,0BAA0B,CACzC,IAAI,CAAC,YAAY,EACjB,aAAa,CACd,CAAC;QACF,OAAO,YAAY,CACjB,sYAAsY,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,+EAA+E,CAC9e,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACjE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,WAAW,GAAG,UAAU,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;QACpE,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,wCAAwC,WAAW,GAAG,EACtD,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9B,CACF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,IAAI,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,YAAY,CAAC;;;;yCAIiB,SAAS;;8BAEpB,CAAC,CAAC;IAC9B,CAAC;IAED,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,oEAAoE;IACpE,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,iBAAiB,CACf,KAAK,EACL,UAAU,EACV,6BAA6B,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CACjE,CAAC;IACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC3D,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;kEAGkE;AAClE,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,ilBAAilB,IAAI,0KAA0K,EAC/vB,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAO,GAAG,yBAAyB;IAEnC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,YAAY,CACjB,yPAAyP,IAAI,mDAAmD,CACjT,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,SAAS,mBAAmB,CAAC,QAAiB;IAC5C,MAAM,GAAG,GAAG,QAAQ,IAAI,UAAU,EAAE,IAAI,cAAc,CAAC;IACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAC3C,OAAO,GAAG;SACP,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACpD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,0BAA0B,CACjC,YAAqB,EACrB,KAAc;IAEd,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjC,OAAO,MAAM;QACX,CAAC,CAAC,gCAAgC,MAAM,EAAE;QAC1C,CAAC,CAAC,8BAA8B,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAe,EACf,KAAc,EACd,YAAqB,EACrB,KAAc;IAEd,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IACjE,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,0BAA0B,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC9C,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,qEAAqE;QACrE,yEAAyE;QACzE,OAAO,YAAY,CACjB,isBAAisB,GAAG,2FAA2F,YAAY,2bAA2b,YAAY,4KAA4K,CAC/5C,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CACjB,wBAAwB,CACtB,GAAG,EACH,oDAAoD,CACrD,CACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Shared Google OAuth utilities for all templates.\n *\n * Handles platform detection (desktop/mobile), state encoding,\n * session token creation, and deep-link responses — the logic\n * that was previously copy-pasted across every template's\n * google-auth.ts handler.\n */\n\nimport crypto from \"node:crypto\";\nimport {\n  getHeader,\n  getQuery,\n  setResponseStatus,\n  setResponseHeader,\n  type H3Event,\n} from \"h3\";\nimport {\n  addSession,\n  getSession,\n  getSessionMaxAge,\n  setFrameworkSessionCookie,\n} from \"./auth.js\";\nimport { getAppName } from \"./app-name.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\nimport { writeDesktopSso } from \"./desktop-sso.js\";\nimport { appendSessionToOAuthReturnUrl } from \"./oauth-return-url.js\";\n\n// ─── Platform Detection ─────────────────────────────────────────────────────\n\n/** Return an HTML response with the correct Content-Type.\n *  Uses a web-standard Response to ensure the header survives\n *  Nitro dev mode's mock-node-response pipeline. */\nfunction htmlResponse(html: string, status = 200): Response {\n  return new Response(html, {\n    status,\n    headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n  });\n}\n\n/** Shared markup for OAuth success \"close this tab\" pages. Renders a green\n *  check icon above the message, with a little breathing room between the\n *  headline and secondary line. Used by every template that goes through the\n *  shared Google OAuth flow. */\nfunction oauthDebugFlowId(flowId?: string): string | undefined {\n  return flowId ? flowId.slice(-10) : undefined;\n}\n\nfunction oauthSuccessCloseTabHtml(\n  headline: string,\n  footnote: string,\n  debugFlowId?: string,\n): string {\n  const debug = debugFlowId\n    ? `<p style=\"font-size:11px;color:#555;margin:12px 0 0 0\">Debug flow: ${escapeHtml(debugFlowId)}</p>`\n    : \"\";\n  return `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#22c55e\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M9 12l2 2l4 -4\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0\">${headline}</p><p style=\"font-size:13px;color:#888;margin:0\">${footnote}</p>${debug}<script>console.info(\"[agent-native][google-oauth] success page loaded\",{flow:${JSON.stringify(debugFlowId || null)}});setTimeout(function(){try{window.close()}catch(e){}},250)</script></body></html>`;\n}\n\n/**\n * HTML escape — minimal but covers the cases that matter when interpolating\n * user-controlled values into our OAuth callback HTML. Mirrors the helper in\n * email-template.ts; kept inline here to avoid a circular import.\n */\nfunction escapeHtml(s: string): string {\n  return String(s ?? \"\")\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/'/g, \"&#39;\");\n}\n\n/**\n * Detect requests from the Agent Native desktop app specifically.\n *\n * The desktop app appends `AgentNativeDesktop/<version>` to its user-agent\n * (see `packages/desktop-app/src/main/index.ts`). We check for that marker\n * rather than matching generic `Electron`, which would also match other\n * Electron-based webviews like Builder.io's Fusion, Slack desktop, Discord,\n * etc. Falsely treating those as \"the desktop app\" sends users to the\n * `agentnative://oauth-complete` deep-link success page after Google sign-in,\n * where the protocol handler can't fire and the \"Open Agent Native\" button\n * does nothing.\n *\n * Kept exported as `isElectron` for backwards compatibility with consumers.\n */\nexport function isElectron(event: H3Event): boolean {\n  return /AgentNativeDesktop/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/** Detect requests from a mobile browser (iOS/Android). */\nexport function isMobile(event: H3Event): boolean {\n  return /iPhone|iPad|iPod|Android/i.test(getHeader(event, \"user-agent\") || \"\");\n}\n\n/**\n * Build the static allowlist of origins we trust for `getOrigin`. Reads\n * deployment-known public URLs. Each entry is normalised to\n * `${proto}://${host}` (no path). Duplicates collapse, invalid entries are\n * dropped silently.\n */\nconst EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS = [\n  \"WORKSPACE_OAUTH_ORIGIN\",\n  \"VITE_WORKSPACE_OAUTH_ORIGIN\",\n  \"APP_URL\",\n  \"VITE_APP_URL\",\n  \"BETTER_AUTH_URL\",\n  \"VITE_BETTER_AUTH_URL\",\n  \"URL\",\n  \"DEPLOY_URL\",\n] as const;\n\nconst WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS = [\n  \"WORKSPACE_GATEWAY_URL\",\n  \"VITE_WORKSPACE_GATEWAY_URL\",\n] as const;\n\nfunction normalizeOrigin(raw: string | undefined): string | undefined {\n  if (!raw) return undefined;\n  try {\n    const u = new URL(raw);\n    return `${u.protocol}//${u.host}`;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction addNormalizedOrigin(\n  out: Set<string>,\n  raw: string | undefined,\n  options: { allowLoopback: boolean },\n): void {\n  const origin = normalizeOrigin(raw);\n  if (!origin) return;\n  if (!options.allowLoopback && isLoopbackOrigin(origin)) return;\n  out.add(origin);\n}\n\nfunction firstOriginFromEnv(\n  keys: readonly string[],\n  options: { allowLoopback: boolean },\n): string | undefined {\n  for (const key of keys) {\n    const origin = normalizeOrigin(process.env[key]);\n    if (!origin) continue;\n    if (!options.allowLoopback && isLoopbackOrigin(origin)) continue;\n    return origin;\n  }\n  return undefined;\n}\n\nfunction getConfiguredOriginAllowlist(): Set<string> {\n  const out = new Set<string>();\n  for (const key of EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS) {\n    addNormalizedOrigin(out, process.env[key], { allowLoopback: true });\n  }\n  for (const key of WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS) {\n    addNormalizedOrigin(out, process.env[key], { allowLoopback: false });\n  }\n  return out;\n}\n\nfunction getWorkspaceCallbackOrigin(): string | undefined {\n  const publicAuthOrigin = firstOriginFromEnv(EXPLICIT_PUBLIC_ORIGIN_ENV_KEYS, {\n    allowLoopback: true,\n  });\n  if (publicAuthOrigin) return publicAuthOrigin;\n\n  return firstOriginFromEnv(WORKSPACE_GATEWAY_ORIGIN_ENV_KEYS, {\n    allowLoopback: false,\n  });\n}\n\nfunction isLoopbackHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    return (\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\" ||\n      parsed.hostname === \"::1\" ||\n      parsed.hostname === \"[::1]\"\n    );\n  } catch {\n    return false;\n  }\n}\n\nfunction isLoopbackOrigin(origin: string | undefined): boolean {\n  if (!origin) return false;\n  try {\n    return isLoopbackHost(new URL(origin).host);\n  } catch {\n    return false;\n  }\n}\n\nfunction isBuilderPreviewHost(host: string | undefined): boolean {\n  if (!host) return false;\n  try {\n    const parsed = new URL(`http://${host}`);\n    const hostname = parsed.hostname.toLowerCase();\n    return (\n      hostname === \"builderio.xyz\" ||\n      hostname.endsWith(\".builderio.xyz\") ||\n      hostname === \"builderio.dev\" ||\n      hostname.endsWith(\".builderio.dev\") ||\n      hostname === \"builder.codes\" ||\n      hostname.endsWith(\".builder.codes\") ||\n      hostname === \"builder.io\" ||\n      hostname.endsWith(\".builder.io\") ||\n      hostname === \"builder.my\" ||\n      hostname.endsWith(\".builder.my\")\n    );\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Get the origin from forwarded headers or Host.\n *\n * Defends against Host-header injection: in production we require the resolved\n * origin to match `APP_URL` / `BETTER_AUTH_URL` / `WORKSPACE_GATEWAY_URL`,\n * falling back to those values when inbound headers are missing or don't match.\n * In dev we accept inbound `Host` so localhost / ngrok / preview hosts keep\n * working without configuration, except workspace OAuth requests from loopback\n * or Builder preview hosts use the configured gateway origin when one exists.\n * The protocol defaults to `https` in production (so a TLS-terminating proxy\n * that drops `x-forwarded-proto` doesn't downgrade us to plain HTTP).\n */\nexport function getOrigin(event: H3Event): string {\n  const headerHost =\n    getHeader(event, \"x-forwarded-host\") || getHeader(event, \"host\");\n  const isProd = process.env.NODE_ENV === \"production\";\n  const headerProto =\n    getHeader(event, \"x-forwarded-proto\") || (isProd ? \"https\" : \"http\");\n  const workspaceCallbackOrigin = isWorkspaceOAuthCallbackRelayEnabled()\n    ? getWorkspaceCallbackOrigin()\n    : undefined;\n\n  if (\n    workspaceCallbackOrigin &&\n    (isLoopbackHost(headerHost) || isBuilderPreviewHost(headerHost))\n  ) {\n    return workspaceCallbackOrigin;\n  }\n\n  if (isProd) {\n    const allow = getConfiguredOriginAllowlist();\n    // If the deploy declares its public URL, prefer it over inbound headers.\n    if (allow.size > 0) {\n      const inbound = headerHost ? `${headerProto}://${headerHost}` : \"\";\n      if (inbound && allow.has(inbound)) return inbound;\n      // Inbound didn't match — fall back to the first configured origin.\n      return [...allow][0];\n    }\n    // No allowlist configured: still default to https, but accept the\n    // inbound Host (best we can do without a configured base URL).\n    return `${headerProto}://${headerHost ?? \"\"}`;\n  }\n\n  return `${headerProto}://${headerHost ?? \"localhost\"}`;\n}\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\n/** App mount prefix, if the template is served under APP_BASE_PATH. */\nexport function getAppBasePath(): string {\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n}\n\n/** Build an absolute same-origin URL that preserves APP_BASE_PATH. */\nexport function getAppUrl(event: H3Event, path = \"/\"): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  return `${getOrigin(event)}${getAppBasePath()}${cleanPath}`;\n}\n\nfunction isWorkspaceOAuthCallbackRelayEnabled(): boolean {\n  return (\n    process.env.AGENT_NATIVE_WORKSPACE === \"1\" ||\n    process.env.VITE_AGENT_NATIVE_WORKSPACE === \"1\"\n  );\n}\n\nfunction isFrameworkOAuthCallbackPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/_agent-native/\") &&\n    (pathname.endsWith(\"/callback\") || pathname.includes(\"/callback/\"))\n  );\n}\n\nfunction getOriginalRequestPath(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return mountedPathname;\n  }\n\n  const urlPathname = (event as any).url?.pathname;\n  if (typeof urlPathname === \"string\" && urlPathname) return urlPathname;\n\n  const nodeUrl = event.node?.req?.url;\n  if (typeof nodeUrl === \"string\" && nodeUrl) {\n    const queryStart = nodeUrl.indexOf(\"?\");\n    return queryStart >= 0 ? nodeUrl.slice(0, queryStart) : nodeUrl;\n  }\n\n  const eventPath = (event as any).path;\n  if (typeof eventPath === \"string\" && eventPath) {\n    const queryStart = eventPath.indexOf(\"?\");\n    return queryStart >= 0 ? eventPath.slice(0, queryStart) : eventPath;\n  }\n\n  return \"/\";\n}\n\nfunction isRequestUnderAppBasePath(event: H3Event): boolean {\n  const basePath = getAppBasePath();\n  if (!basePath) return false;\n  const requestPath = getOriginalRequestPath(event);\n  return (\n    requestPath === `${basePath}/_agent-native` ||\n    requestPath.startsWith(`${basePath}/_agent-native/`)\n  );\n}\n\nfunction getDefaultOAuthRedirectUrl(event: H3Event, path: string): string {\n  const cleanPath = path.startsWith(\"/\") ? path : `/${path}`;\n  if (\n    isWorkspaceOAuthCallbackRelayEnabled() &&\n    isFrameworkOAuthCallbackPath(cleanPath)\n  ) {\n    return `${getOrigin(event)}${cleanPath}`;\n  }\n  const basePath = isRequestUnderAppBasePath(event) ? getAppBasePath() : \"\";\n  return `${getOrigin(event)}${basePath}${cleanPath}`;\n}\n\n// ─── redirect_uri Allowlist ──────────────────────────────────────────────────\n\n/**\n * Validate a user-supplied `redirect_uri` for OAuth flows.\n *\n * Defends against authorization-code interception (RFC 6819 §4.4.1.7):\n * even though the upstream provider (Google/Atlassian/Zoom) refuses\n * unregistered redirect URIs, prefix-style registrations and side\n * registrations on the same host let a malicious caller swap in an\n * attacker-controlled URI that the provider still accepts. We reject any\n * candidate that isn't on this server's own origin AND under the\n * framework's `/_agent-native/` namespace. Returns the validated URI on\n * success, or `undefined` on rejection — callers must treat `undefined`\n * as a 400.\n *\n * The intentional shape is exact-prefix:\n *   - Origin must equal `getOrigin(event)` — no Host-header injection\n *     reusing somebody else's registered redirect URI.\n *   - Path must start with `${appBasePath}/_agent-native/` so we never\n *     hand auth codes to a public marketing or open-redirect endpoint\n *     on the same registered host.\n *\n * For desktop / native flows that need ephemeral `http://127.0.0.1:<port>`\n * loopback URIs, callers should validate those at the template level\n * with a dedicated allowlist — this helper rejects them by design.\n */\nexport function isAllowedOAuthRedirectUri(\n  candidate: string,\n  event: H3Event,\n): boolean {\n  if (typeof candidate !== \"string\" || candidate.length === 0) return false;\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    return false;\n  }\n  // Must be same origin as our server.\n  const expectedOrigin = getOrigin(event);\n  let expectedUrl: URL;\n  try {\n    expectedUrl = new URL(expectedOrigin);\n  } catch {\n    return false;\n  }\n  if (url.protocol !== expectedUrl.protocol) return false;\n  if (url.host !== expectedUrl.host) return false;\n  // Must live under the framework's namespace. Workspace deploys can route\n  // root /_agent-native/* to Dispatch even when Dispatch itself is mounted at\n  // /dispatch, but app-prefixed requests should not be able to swap their\n  // callback to that root namespace.\n  const basePath = getAppBasePath();\n  const allowedPrefixes =\n    basePath && isRequestUnderAppBasePath(event)\n      ? [\n          `${basePath}/_agent-native/`,\n          ...(isWorkspaceOAuthCallbackRelayEnabled() &&\n          isFrameworkOAuthCallbackPath(url.pathname)\n            ? [\"/_agent-native/\"]\n            : []),\n        ]\n      : [\"/_agent-native/\"];\n  if (!allowedPrefixes.some((prefix) => url.pathname.startsWith(prefix))) {\n    return false;\n  }\n  return true;\n}\n\n/**\n * Resolve the `redirect_uri` for an outbound OAuth `auth-url` request.\n *\n * Reads `?redirect_uri=` from the query and validates it via\n * `isAllowedOAuthRedirectUri`. Returns:\n *   - the validated URI when supplied and allowed, OR\n *   - the framework default when no override was supplied, OR\n *   - `null` when an override was supplied but rejected — callers must\n *     respond with 400 in that case.\n *\n * Templates that need a non-default redirect path can pass it via\n * `defaultPath` (e.g. `\"/_agent-native/google/desktop-callback\"` for\n * desktop flows).\n */\nexport function resolveOAuthRedirectUri(\n  event: H3Event,\n  defaultPath = \"/_agent-native/google/callback\",\n): string | null {\n  const supplied = getQuery(event).redirect_uri;\n  if (typeof supplied === \"string\" && supplied.length > 0) {\n    return isAllowedOAuthRedirectUri(supplied, event) ? supplied : null;\n  }\n  return getDefaultOAuthRedirectUrl(event, defaultPath);\n}\n\n// ─── OAuth State ─────────────────────────────────────────────────────────────\n\nexport interface OAuthStatePayload {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  /**\n   * Same-origin path to redirect to after a successful web-flow sign-in.\n   * Threaded through the (HMAC-signed) state so it survives the round trip\n   * to Google. Validated again on decode via safeReturnPath as defence in\n   * depth. Has no effect on desktop / mobile / add-account flows, which\n   * use their own deep-link / close-tab handling.\n   */\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Ephemeral in-memory state-signing key for development. Generated lazily\n * on first read so dev sessions don't depend on filesystem writability or\n * env-var configuration. Sessions reset on each restart, which is fine\n * for dev — no real users / production data are involved.\n */\nlet _devStateSigningKey: string | undefined;\n\n/**\n * Derive a server-only signing key for HMAC verification of OAuth state.\n *\n * Uses a dedicated secret — never an OAuth client secret. Reusing a\n * client_secret (which is shared with Google / GitHub / Atlassian) as our\n * own HMAC key conflates two trust domains: rotating the client secret\n * silently invalidates every in-flight OAuth state, and any leak of the\n * client secret also lets an attacker forge our state envelopes.\n *\n * Resolution order:\n *   1. OAUTH_STATE_SECRET (preferred — dedicated to this purpose)\n *   2. BETTER_AUTH_SECRET (already used by Better Auth as a server secret)\n *   3. Hosted workspace deploys derive a per-purpose key from A2A_SECRET\n *   4. In dev only, an ephemeral random key (per-process)\n *\n * In production, throws if no usable server secret is set.\n */\nfunction getStateSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET ||\n    process.env.BETTER_AUTH_SECRET ||\n    getWorkspaceA2ADerivedSecret(\"oauth-state\");\n  if (secret) return secret;\n\n  const isProd = process.env.NODE_ENV === \"production\";\n  if (isProd) {\n    throw new Error(\n      \"OAuth state signing requires a server secret. \" +\n        \"Set OAUTH_STATE_SECRET, BETTER_AUTH_SECRET, or A2A_SECRET in production workspace deploys.\",\n    );\n  }\n\n  if (!_devStateSigningKey) {\n    _devStateSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devStateSigningKey;\n}\n\n/**\n * Options for the named-argument form of {@link encodeOAuthState}.\n * Prefer this form — the positional overload is easy to misuse (the mail\n * and calendar templates historically passed `flowId` in the `returnUrl`\n * slot, smuggling state into a defence-in-depth path).\n */\nexport interface EncodeOAuthStateOptions {\n  redirectUri: string;\n  owner?: string;\n  desktop?: boolean;\n  addAccount?: boolean;\n  app?: string;\n  returnUrl?: string;\n  flowId?: string;\n}\n\n/**\n * Encode OAuth state into a signed base64url string.\n * The state is HMAC-signed so the callback can verify it wasn't forged,\n * preventing CSRF attacks on the OAuth flow.\n *\n * Two call shapes are supported:\n *   - Recommended: pass an options object — clear, mismatch-proof.\n *     `encodeOAuthState({ redirectUri, owner, desktop, ... })`\n *   - Legacy positional form (kept working for backward compatibility):\n *     `encodeOAuthState(redirectUri, owner, desktop, addAccount, app, returnUrl, flowId)`.\n *     Callers should migrate to the options form — see the audit on\n *     templates/mail and templates/calendar where the positional shape\n *     led to `flowId` being smuggled in via the `returnUrl` slot.\n */\nexport function encodeOAuthState(opts: EncodeOAuthStateOptions): string;\nexport function encodeOAuthState(\n  redirectUri: string,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string;\nexport function encodeOAuthState(\n  redirectUriOrOpts: string | EncodeOAuthStateOptions,\n  owner?: string,\n  desktop?: boolean,\n  addAccount?: boolean,\n  app?: string,\n  returnUrl?: string,\n  flowId?: string,\n): string {\n  const opts: EncodeOAuthStateOptions =\n    typeof redirectUriOrOpts === \"string\"\n      ? {\n          redirectUri: redirectUriOrOpts,\n          owner,\n          desktop,\n          addAccount,\n          app,\n          returnUrl,\n          flowId,\n        }\n      : redirectUriOrOpts;\n\n  const nonce = crypto.randomBytes(8).toString(\"hex\");\n  const payload: Record<string, string | boolean> = {\n    n: nonce,\n    r: opts.redirectUri,\n  };\n  if (opts.owner) payload.o = opts.owner;\n  if (opts.desktop) payload.d = true;\n  if (opts.addAccount) payload.a = true;\n  if (opts.app) payload.app = opts.app;\n  if (opts.returnUrl) payload.r2 = opts.returnUrl;\n  if (opts.flowId) payload.f = opts.flowId;\n  const data = Buffer.from(JSON.stringify(payload)).toString(\"base64url\");\n  const sig = crypto\n    .createHmac(\"sha256\", getStateSigningKey())\n    .update(data)\n    .digest(\"base64url\");\n  return `${data}.${sig}`;\n}\n\n/**\n * Decode and verify OAuth state from the callback's state query parameter.\n * Rejects forged or tampered state by checking the HMAC signature.\n * Falls back to the provided URI if decoding or verification fails.\n */\nexport function decodeOAuthState(\n  stateParam: string | undefined,\n  fallbackUri: string,\n): OAuthStatePayload {\n  if (stateParam) {\n    try {\n      const dotIdx = stateParam.lastIndexOf(\".\");\n      if (dotIdx === -1) return { redirectUri: fallbackUri };\n\n      const data = stateParam.slice(0, dotIdx);\n      const sig = stateParam.slice(dotIdx + 1);\n      const expected = crypto\n        .createHmac(\"sha256\", getStateSigningKey())\n        .update(data)\n        .digest(\"base64url\");\n\n      if (\n        sig.length !== expected.length ||\n        !crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))\n      ) {\n        return { redirectUri: fallbackUri };\n      }\n\n      const parsed = JSON.parse(Buffer.from(data, \"base64url\").toString());\n      return {\n        redirectUri: parsed.r || fallbackUri,\n        owner: parsed.o || undefined,\n        desktop: !!parsed.d,\n        addAccount: !!parsed.a,\n        app: typeof parsed.app === \"string\" ? parsed.app : undefined,\n        // Pass returnUrl through as-is — same-origin validation runs at the\n        // consumer (oauthCallbackResponse → safeReturnPath). The state is\n        // HMAC-signed, but we still validate at consumption as defence in\n        // depth in case the signing key ever leaks.\n        returnUrl: typeof parsed.r2 === \"string\" ? parsed.r2 : undefined,\n        flowId: parsed.f || undefined,\n      };\n    } catch {}\n  }\n  return { redirectUri: fallbackUri };\n}\n\n// ─── Session Creation ────────────────────────────────────────────────────────\n\nexport interface OAuthOwnerResult {\n  owner: string | undefined;\n  hasProductionSession: boolean;\n}\n\n/**\n * Determine the token owner from the current session and OAuth state.\n * Call this BEFORE exchangeCode to get the owner parameter.\n */\nexport async function resolveOAuthOwner(\n  event: H3Event,\n  stateOwner?: string,\n): Promise<OAuthOwnerResult> {\n  const existingSession = await getSession(event);\n  const hasProductionSession = !!existingSession?.email;\n  const owner = hasProductionSession\n    ? existingSession!.email\n    : stateOwner || undefined;\n\n  return { owner, hasProductionSession };\n}\n\nexport interface OAuthSessionResult {\n  sessionToken: string | undefined;\n}\n\n/**\n * Create a session token after a successful OAuth exchange.\n *\n * Desktop and mobile apps have separate cookie jars from the system\n * browser, so they always get a fresh session token (even if the browser\n * already has one). The token is then passed via deep link so the native\n * app can inject it.\n */\nexport async function createOAuthSession(\n  event: H3Event,\n  email: string,\n  opts: {\n    hasProductionSession: boolean;\n    desktop?: boolean;\n  },\n): Promise<OAuthSessionResult> {\n  const mobile = isMobile(event);\n  const needsDeepLink = opts.desktop || mobile;\n  const maxAge = getSessionMaxAge();\n\n  let sessionToken: string | undefined;\n  if (!opts.hasProductionSession || needsDeepLink) {\n    sessionToken = crypto.randomBytes(32).toString(\"hex\");\n    await addSession(sessionToken, email);\n    setFrameworkSessionCookie(event, sessionToken);\n    // Desktop SSO: record this session in the home-dir broker file so\n    // sibling templates (each with its own database) can resolve the\n    // same token without a DB row of their own. Only the PRIMARY\n    // sign-in writes the broker — if a production session already\n    // exists, this is an add-account flow (connecting a secondary\n    // Google account for scraping) and must never switch the active\n    // user across sibling templates.\n    if (opts.desktop && !opts.hasProductionSession) {\n      await writeDesktopSso({\n        email,\n        token: sessionToken,\n        expiresAt: Date.now() + maxAge * 1000,\n      });\n    }\n  }\n\n  return { sessionToken };\n}\n\n// ─── Callback Responses ──────────────────────────────────────────────────────\n\n/**\n * Return the appropriate response after a successful OAuth callback.\n *\n * Handles mobile deep links, desktop deep links, add-account close-tab\n * pages, and plain web redirects — so templates don't have to.\n */\nexport function oauthCallbackResponse(\n  event: H3Event,\n  email: string,\n  opts: {\n    sessionToken?: string;\n    desktop?: boolean;\n    addAccount?: boolean;\n    /**\n     * Same-origin path to return the viewer to after a successful web\n     * sign-in. Validated via safeReturnPath; falls back to \"/\" for any\n     * shape that escapes same-origin. Has no effect on desktop / mobile\n     * / add-account flows — those use their own deep-link handling.\n     */\n    returnUrl?: string;\n    flowId?: string;\n    appName?: string;\n  },\n): Response | string | unknown | Promise<Response | string | unknown> {\n  const mobile = isMobile(event);\n  const query = getQuery(event);\n  const callbackState =\n    typeof query.state === \"string\" && query.state.length > 0\n      ? query.state\n      : undefined;\n\n  // Mobile: deep link back to native app\n  if (mobile) {\n    const deepLink = buildOAuthCompleteDeepLink(\n      opts.sessionToken,\n      callbackState,\n    );\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no\"><title>Connected</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p>Connected! Returning to app…</p><script>window.location.href=${JSON.stringify(deepLink)};setTimeout(function(){window.location.href=\"/\"},1500)</script></body></html>`,\n    );\n  }\n\n  // Desktop add-account: close-tab page (must come before general desktop check\n  // to ensure no deep link fires and the existing session is never switched).\n  if (opts.desktop && opts.addAccount) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Electron desktop exchange flow: mail/calendar still pass a flow id so the\n  // renderer can poll as a fallback, but the main handoff should use the\n  // protocol deep link so the popup returns focus to the desktop app.\n  if (opts.desktop && opts.flowId && isElectron(event) && opts.sessionToken) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Desktop exchange flow (non-Electron tray app): the tray app polls the\n  // desktop-exchange endpoint for the token — no deep link needed.\n  if (opts.desktop && opts.flowId) {\n    const safeEmail = email ? escapeHtml(email) : \"\";\n    const safeAppName = escapeHtml(resolveOAuthAppName(opts.appName));\n    const msg = safeEmail ? `Signed in as ${safeEmail}!` : \"Signed in!\";\n    return htmlResponse(\n      oauthSuccessCloseTabHtml(\n        msg,\n        `You can close this tab and return to ${safeAppName}.`,\n        oauthDebugFlowId(opts.flowId),\n      ),\n    );\n  }\n\n  // Desktop login: deep link back to Electron app — only when the callback\n  // request actually carries the AgentNativeDesktop UA marker. Without this\n  // check, any client whose OAuth state was minted with `desktop=true` (e.g.\n  // a stale link, or an upstream that wrongly set `?desktop=1`) would land\n  // on the `agentnative://` page where the deep link can't fire and the\n  // \"Open Agent Native\" button does nothing — surfaces inside Builder.io's\n  // Fusion webview hit this exact dead-end. Fall through to the web flow\n  // for non-Agent-Native-Desktop clients so they get a real redirect.\n  if (opts.desktop && isElectron(event)) {\n    return desktopSuccessPage(event, email, opts.sessionToken, callbackState);\n  }\n\n  // Add-account web flow: close-tab page. The email is rendered into the\n  // page via DOM `textContent` (safe), but we still JSON-stringify so a\n  // payload containing `</script>` can't break out of the script tag —\n  // and explicitly assert it's a string so a callbacks like `null` or\n  // an object won't end up serialised into the page.\n  if (opts.addAccount) {\n    const safeEmail = JSON.stringify(typeof email === \"string\" ? email : \"\");\n    return htmlResponse(`<!DOCTYPE html><html><body><script>\n        window.close();\n        var p = document.createElement('p');\n        p.style.cssText = 'font-family:system-ui;text-align:center;margin-top:40vh';\n        p.textContent = 'Connected ' + ${safeEmail} + '! You can close this tab.';\n        document.body.appendChild(p);\n      </script></body></html>`);\n  }\n\n  // Web: redirect to the requested return target. Path-only returns stay\n  // same-origin; Builder desktop workspace returns may point back to the\n  // local loopback gateway and carry the short-lived `_session` bridge so\n  // the local app can promote the newly created hosted OAuth session.\n  setResponseStatus(event, 302);\n  setResponseHeader(\n    event,\n    \"Location\",\n    appendSessionToOAuthReturnUrl(opts.returnUrl, opts.sessionToken),\n  );\n  setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n  return \"\";\n}\n\n/** HTML error page for OAuth failures. The message is HTML-escaped — most\n *  callers pass `error.message` from a token-exchange or userinfo failure,\n *  which can echo upstream provider strings (and historically attacker-\n *  controlled query params via the `error_description` field). */\nexport function oauthErrorPage(message: string): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connection failed</title></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;text-align:center\"><svg width=\"44\" height=\"44\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ef4444\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" style=\"margin-bottom:14px\" aria-hidden=\"true\"><circle cx=\"12\" cy=\"12\" r=\"10\"/><path d=\"M15 9l-6 6\"/><path d=\"M9 9l6 6\"/></svg><p style=\"font-size:16px;margin:0 0 12px 0;color:#ddd\">${safe}</p><p style=\"font-size:13px;color:#888;margin:0\"><a href=\"/\" style=\"color:#888;text-decoration:underline;text-underline-offset:3px\">Back to login</a></p></body></html>`,\n    400,\n  );\n}\n\nexport function oauthDesktopExchangePage(\n  message = \"Returning to the app...\",\n): Response {\n  const safe = escapeHtml(message);\n  return htmlResponse(\n    `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Returning</title></head><body style=\"background:#111;color:#aaa;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0\"><p style=\"font-size:14px\">${safe}</p><script>window.close()</script></body></html>`,\n  );\n}\n\n// ─── Internal ────────────────────────────────────────────────────────────────\n\nfunction resolveOAuthAppName(explicit?: string): string {\n  const raw = explicit || getAppName() || \"Agent Native\";\n  if (!/^[a-z0-9_-]+$/.test(raw)) return raw;\n  return raw\n    .split(/[-_]+/)\n    .filter(Boolean)\n    .map((word) => word[0].toUpperCase() + word.slice(1))\n    .join(\" \");\n}\n\nfunction buildOAuthCompleteDeepLink(\n  sessionToken?: string,\n  state?: string,\n): string {\n  const params = new URLSearchParams();\n  if (sessionToken) params.set(\"token\", sessionToken);\n  if (state) params.set(\"state\", state);\n  const suffix = params.toString();\n  return suffix\n    ? `agentnative://oauth-complete?${suffix}`\n    : \"agentnative://oauth-complete\";\n}\n\nfunction desktopSuccessPage(\n  _event: H3Event,\n  email?: string,\n  sessionToken?: string,\n  state?: string,\n): Response {\n  const safeEmail = email ? escapeHtml(email) : \"\";\n  const msg = safeEmail ? `Connected ${safeEmail}!` : \"Connected!\";\n  if (sessionToken) {\n    const deepLink = buildOAuthCompleteDeepLink(sessionToken, state);\n    const deepLinkJson = JSON.stringify(deepLink);\n    // Defence in depth: if this page somehow gets served to a UA that isn't\n    // the Agent Native desktop app (server gate bypassed, stale link, etc.),\n    // skip the `agentnative://` deep link entirely and bounce to the app\n    // root. The deep link silently fails outside the desktop app and the\n    // \"Open Agent Native\" button is a dead end in a generic browser/webview.\n    return htmlResponse(\n      `<!DOCTYPE html><html><head><meta charset=\"utf-8\"><title>Connected</title><style>@keyframes spin{to{transform:rotate(360deg)}}@keyframes fadeIn{from{opacity:0;transform:translateY(4px)}to{opacity:1;transform:translateY(0)}}.spinner{width:28px;height:28px;border:2px solid #333;border-top-color:#fff;border-radius:50%;animation:spin .8s linear infinite}.fallback{display:none;flex-direction:column;align-items:center;gap:8px;animation:fadeIn .2s ease-out}.fallback.show{display:flex}</style></head><body style=\"background:#111;color:#ccc;font-family:system-ui;display:flex;align-items:center;justify-content:center;height:100vh;margin:0;flex-direction:column;gap:16px\"><p style=\"font-size:16px;margin:0\">${msg}</p><div id=\"loading\" class=\"spinner\"></div><div id=\"fallback\" class=\"fallback\"><a href=${deepLinkJson} style=\"display:inline-block;padding:10px 24px;background:#fff;color:#000;border-radius:8px;text-decoration:none;font-size:14px;font-weight:500\">Open Agent Native</a><p style=\"font-size:12px;color:#666;margin:0\">If the app didn\\u2019t open automatically, click the button above.</p></div><script>(function(){var ua=(navigator.userAgent||\"\");if(ua.indexOf(\"AgentNativeDesktop\")===-1){window.location.replace(\"/\");return}window.location.href=${deepLinkJson};setTimeout(function(){document.getElementById(\"loading\").style.display=\"none\";document.getElementById(\"fallback\").classList.add(\"show\")},3000)})()</script></body></html>`,\n    );\n  }\n  return htmlResponse(\n    oauthSuccessCloseTabHtml(\n      msg,\n      \"You can close this tab and return to Agent Native.\",\n    ),\n  );\n}\n"]}

package/dist/server/poll.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poll.d.ts","sourceRoot":"","sources":["../../src/server/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAiB3C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAkI/C,8CAA8C;AAC9C,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAgB,cAAc,IAAI,YAAY,CAE7C;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAMT;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB,GAAG,IAAI,CAWP;AA+GD,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB,CAMA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAQ5C;AAqOD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB;aAxPnB,MAAM;YAAU,WAAW,EAAE;;;IAyQ1C"}
+{"version":3,"file":"poll.d.ts","sourceRoot":"","sources":["../../src/server/poll.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAiB3C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB;AAOD,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAsI/C,8CAA8C;AAC9C,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED,wBAAgB,cAAc,IAAI,YAAY,CAE7C;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,WAAW,EAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAMT;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB,GAAG,IAAI,CAWP;AA+GD,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB,CAMA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAQ5C;AAwQD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB;aA3RnB,MAAM;YAAU,WAAW,EAAE;;;IA4S1C"}

package/dist/server/poll.js

@@ -55,6 +55,10 @@ let _lastActionMarkerTs = 0;
  */
 let _lastScreenRefreshTs = 0;
 let _screenRefreshInitialized = false;
+// Per-session high-water marks for `__screen_refresh__`. Each user's row is
+// tracked independently so a refresh triggered by one user only remounts that
+// user's screen (owner-scoped), never every authenticated poller.
+const _lastScreenRefreshTsBySession = new Map();
 const SCREEN_REFRESH_KEY = "__screen_refresh__";
 let _localEmittersWired = false;
 function wireLocalEmitters() {
@@ -286,13 +290,16 @@ async function seedVersionFromDb() {
             readActionMarkerMaxUpdatedAt(db),
             db
                 .execute({
-                sql: "SELECT updated_at FROM application_state WHERE key = ?",
+                sql: "SELECT session_id, updated_at FROM application_state WHERE key = ?",
                 args: [SCREEN_REFRESH_KEY],
             })
                 .catch(() => ({ rows: [] })),
         ]);
         const extensionsTs = timestampValue(extensionsMaxUpdatedAt);
-        const refreshTs = timestampValue(refreshResult.rows[0]?.updated_at);
+        let refreshTs = 0;
+        for (const row of refreshResult.rows) {
+            refreshTs = Math.max(refreshTs, timestampValue(row.updated_at));
+        }
         // Seed version — never decrease an already-set value
         _version = Math.max(_version, appTs, settingsTs, extensionsTs, extensionMarkerTs, actionMarkerTs);
         // Set baselines so checkExternalDbChanges detects future writes
@@ -306,6 +313,12 @@ async function seedVersionFromDb() {
         // marker on cold start, or the first poll after the action will miss it.
         _lastActionMarkerTs = 0;
         _lastScreenRefreshTs = refreshTs;
+        _lastScreenRefreshTsBySession.clear();
+        for (const row of refreshResult.rows) {
+            if (typeof row.session_id === "string") {
+                _lastScreenRefreshTsBySession.set(row.session_id, timestampValue(row.updated_at));
+            }
+        }
         _screenRefreshInitialized = true;
     }
     catch {
@@ -372,31 +385,49 @@ async function checkExternalDbChanges() {
         // updated_at bumps, emit a distinct event so the client invalidates
         // all queries (not just the ones matching its default queryKey prefix).
         const refreshResult = await db.execute({
-            sql: "SELECT updated_at, value FROM application_state WHERE key = ?",
+            sql: "SELECT session_id, updated_at, value FROM application_state WHERE key = ?",
             args: [SCREEN_REFRESH_KEY],
         });
-        const refreshTs = timestampValue(refreshResult.rows[0]?.updated_at);
+        const refreshTs = refreshResult.rows.reduce((max, row) => Math.max(max, timestampValue(row.updated_at)), 0);
         if (!_screenRefreshInitialized) {
             _lastScreenRefreshTs = refreshTs;
+            for (const row of refreshResult.rows) {
+                if (typeof row.session_id === "string") {
+                    _lastScreenRefreshTsBySession.set(row.session_id, timestampValue(row.updated_at));
+                }
+            }
             _screenRefreshInitialized = true;
         }
         else if (refreshTs > _lastScreenRefreshTs) {
-            let scope;
-            try {
-                const raw = refreshResult.rows[0]?.value;
-                if (typeof raw === "string") {
-                    const parsed = JSON.parse(raw);
-                    if (typeof parsed?.scope === "string")
-                        scope = parsed.scope;
+            // Emit a per-user event only for the session(s) whose row actually
+            // advanced, scoped with `owner` so canSeeChangeForUser delivers it only
+            // to that user — not every authenticated poller.
+            for (const row of refreshResult.rows) {
+                const owner = typeof row.session_id === "string" ? row.session_id : undefined;
+                if (!owner)
+                    continue;
+                const rowTs = timestampValue(row.updated_at);
+                if (rowTs <= (_lastScreenRefreshTsBySession.get(owner) ?? 0))
+                    continue;
+                let scope;
+                try {
+                    const raw = row.value;
+                    if (typeof raw === "string") {
+                        const parsed = JSON.parse(raw);
+                        if (typeof parsed?.scope === "string")
+                            scope = parsed.scope;
+                    }
                 }
+                catch { }
+                recordChange({
+                    source: "screen-refresh",
+                    type: "change",
+                    key: SCREEN_REFRESH_KEY,
+                    owner,
+                    ...(scope ? { scope } : {}),
+                });
+                _lastScreenRefreshTsBySession.set(owner, rowTs);
             }
-            catch { }
-            recordChange({
-                source: "screen-refresh",
-                type: "change",
-                key: SCREEN_REFRESH_KEY,
-                ...(scope ? { scope } : {}),
-            });
             _lastScreenRefreshTs = refreshTs;
         }
         // Extension mutations write a durable marker row so delete and hide/unhide