@agent-native/core 0.7.13 → 0.7.15

package/dist/server/request-context.js

@@ -16,7 +16,12 @@
  * continue to work.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
-const als = new AsyncLocalStorage();
+const GLOBAL_KEY = "__agentNativeRequestContextAls";
+const globalRef = globalThis;
+if (!globalRef[GLOBAL_KEY]) {
+    globalRef[GLOBAL_KEY] = new AsyncLocalStorage();
+}
+const als = globalRef[GLOBAL_KEY];
 /**
  * Run a callback within a per-request context. The context is available to all
  * async operations spawned from `fn` via `getRequestUserEmail()` / `getRequestOrgId()`.
@@ -24,28 +29,116 @@ const als = new AsyncLocalStorage();
 export function runWithRequestContext(ctx, fn) {
     return als.run(ctx, fn);
 }
+/**
+ * Return the active request context, if this call chain is running under one.
+ *
+ * This is intentionally distinct from `getRequestUserEmail()`: callers that
+ * have an active context with no authenticated user must not fall through to
+ * process-wide CLI fallbacks such as `AGENT_USER_EMAIL` or "latest session".
+ */
+export function getRequestContext() {
+    return als.getStore();
+}
+/**
+ * True when AsyncLocalStorage has an active context for this call chain.
+ * Useful for helpers that support both HTTP requests and standalone CLI runs.
+ */
+export function hasRequestContext() {
+    return als.getStore() !== undefined;
+}
 /**
  * Get the current request's user email.
- * Falls back to `process.env.AGENT_USER_EMAIL` for CLI scripts.
+ *
+ * - If a request context exists (HTTP/A2A path), returns its `userEmail` —
+ *   even when that value is `undefined`. The env fallback MUST NOT fire here:
+ *   a stale process-wide `AGENT_USER_EMAIL` from a CLI run or previous bug
+ *   would leak into an unauthenticated A2A/API call (e.g. unsigned or API-key
+ *   modes where `runWithRequestContext({ userEmail: undefined })` is used).
+ * - Only when there is NO request context (CLI scripts) do we fall back to
+ *   `process.env.AGENT_USER_EMAIL`.
  */
 export function getRequestUserEmail() {
-    return als.getStore()?.userEmail ?? process.env.AGENT_USER_EMAIL;
+    const store = als.getStore();
+    if (store !== undefined)
+        return store.userEmail;
+    return process.env.AGENT_USER_EMAIL;
 }
 /**
  * Get the current request's org ID.
- * Falls back to `process.env.AGENT_ORG_ID` for CLI scripts.
+ *
+ * Same store-aware semantics as `getRequestUserEmail()` — env fallback is
+ * CLI-only, so a request that explicitly has no org doesn't inherit a stale
+ * `process.env.AGENT_ORG_ID` from a prior request on the same Lambda instance.
  */
 export function getRequestOrgId() {
-    return als.getStore()?.orgId ?? process.env.AGENT_ORG_ID;
+    const store = als.getStore();
+    if (store !== undefined)
+        return store.orgId;
+    return process.env.AGENT_ORG_ID;
 }
 /**
  * Get the current request's IANA timezone (e.g. "America/Los_Angeles").
  * The UI sends this via the `x-user-timezone` header on every action call, and
  * the agent chat plugin propagates it into the request context so that
  * agent-initiated tool calls also see the user's timezone. Falls back to
- * `process.env.AGENT_USER_TIMEZONE` for CLI scripts, and undefined if unset.
+ * `process.env.AGENT_USER_TIMEZONE` only for CLI scripts (no request context).
  */
 export function getRequestTimezone() {
-    return als.getStore()?.timezone ?? process.env.AGENT_USER_TIMEZONE;
+    const store = als.getStore();
+    if (store !== undefined)
+        return store.timezone;
+    return process.env.AGENT_USER_TIMEZONE;
+}
+/**
+ * Returns true when this request is on an integration-platform path (Slack,
+ * Telegram, etc.) — i.e. we're inside the integration plugin's processor
+ * function and the platform's deliver-by deadline plus the host's function
+ * timeout are the binding budget. Non-integration callers (CLI, normal
+ * agent chat) should treat this as `false`.
+ */
+export function isIntegrationCallerRequest() {
+    return als.getStore()?.isIntegrationCaller === true;
+}
+/**
+ * Convenience: returns `{ userEmail, orgId }` from the active request context,
+ * suitable for passing to `resolveCredential(key, ctx)`. Returns `null` when
+ * no user is associated with the call (e.g. an unauthenticated public route).
+ *
+ * For framework actions auto-mounted at `/_agent-native/actions/...` this is
+ * always populated because action-routes wraps every invocation in
+ * `runWithRequestContext`. For hand-written `/api/*` routes the calling code
+ * is responsible for setting up the context (see `runWithRequestContext`).
+ */
+export function getCredentialContext() {
+    const userEmail = getRequestUserEmail();
+    if (!userEmail)
+        return null;
+    return { userEmail, orgId: getRequestOrgId() ?? null };
+}
+/**
+ * Get the active request's mutable agent-run state. Returns `undefined` when
+ * called outside an agent run (e.g. before `prepareRun` or in a non-agent
+ * code path). Callers must tolerate the field absence; use the helper
+ * `requireRequestRunContext()` if missing context is a programming error.
+ */
+export function getRequestRunContext() {
+    const store = als.getStore();
+    if (!store)
+        return undefined;
+    return store.run;
+}
+/**
+ * Ensure a `RequestRunContext` exists on the active request store and
+ * return it. Used by the agent-chat handler to attach run state once it
+ * starts processing a chat request. Returns `undefined` if there is no
+ * active request store (caller should not be invoking this outside ALS).
+ */
+export function ensureRequestRunContext() {
+    const store = als.getStore();
+    if (!store)
+        return undefined;
+    if (!store.run)
+        store.run = {};
+    return store.run;
 }
 //# sourceMappingURL=request-context.js.map

package/dist/server/request-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAQrD,MAAM,GAAG,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEpD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAmB,EACnB,EAAwB;IAExB,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACrE,CAAC"}
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/server/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAiDrD,MAAM,UAAU,GAAG,gCAAyC,CAAC;AAI7D,MAAM,SAAS,GAAG,UAAsC,CAAC;AACzD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;IAC3B,SAAS,CAAC,UAAU,CAAC,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAClE,CAAC;AACD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,CAAE,CAAC;AAEnC;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAmB,EACnB,EAAwB;IAExB,OAAO,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC;AACtC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,SAAS,CAAC;IAChD,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC;IAC5C,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,GAAG,CAAC,QAAQ,EAAE,EAAE,mBAAmB,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB;IAIlC,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC;IAC/B,OAAO,KAAK,CAAC,GAAG,CAAC;AACnB,CAAC"}

package/dist/server/security-headers.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Security response headers middleware.
+ *
+ * Sets a baseline set of "no-brainer" security headers on every framework HTTP
+ * response. These headers are layered defenses: each one mitigates a specific
+ * class of attack, and together they harden the surface against clickjacking,
+ * MIME-sniffing, referrer leakage, mixed-content downgrades, and cross-origin
+ * window/embed access.
+ *
+ * The headers we emit:
+ *
+ *   - `Strict-Transport-Security` — forces HTTPS for the browser's lifetime
+ *     of the cached value, preventing SSL-strip MITM. Only emitted when the
+ *     request scheme is `https` (we don't want to break local-dev HTTP, and
+ *     emitting HSTS over HTTP is a no-op per the spec but causes confusion).
+ *   - `X-Content-Type-Options: nosniff` — disables browser MIME sniffing so
+ *     a tool /render route serving user-authored HTML can't be misinterpreted
+ *     as some other content type by a clever Accept header.
+ *   - `X-Frame-Options: DENY` — prevents the entire app from being iframed by
+ *     other origins (clickjacking the agent chat, booking pages, etc.). The
+ *     tool /render endpoint and any other route that legitimately needs to be
+ *     embedded in the same-origin app shell can opt out by setting its own
+ *     header inside the route handler — h3's `setResponseHeader` overwrites,
+ *     so a route emitting `SAMEORIGIN` wins over our middleware default.
+ *   - `Referrer-Policy: strict-origin-when-cross-origin` — strips path/query
+ *     from outbound Referer headers when the request crosses origin, so a
+ *     public-share viewer's outbound link clicks never leak the share token.
+ *   - `Permissions-Policy: camera=(), microphone=(), geolocation=(),
+ *     screen-wake-lock=()` — blocks iframed children from inheriting camera
+ *     / mic / location grants. Templates that need camera/mic for recording
+ *     UI override this on their own routes.
+ *   - `Cross-Origin-Opener-Policy: same-origin` — isolates window.opener so
+ *     a popup-window opener reference can't read or modify our document.
+ *   - `Cross-Origin-Resource-Policy: same-site` — prevents other origins from
+ *     embedding our endpoints as `<img>` / `<script>` / `<audio>`, blocking
+ *     the simplest data-leak chain when combined with auth cookies.
+ *
+ * NOTE: We don't set `Cross-Origin-Embedder-Policy` because it requires every
+ * embedded subresource to opt in via CORP/CORS, which would break Builder's
+ * iframe editor and template embed use cases. COOP + CORP without COEP gives
+ * us most of the protection.
+ */
+/**
+ * Create the security-headers h3 middleware. Mount this BEFORE other route
+ * handlers so the headers are present on every response (including 4xx/5xx
+ * error pages). Route handlers that need to relax a specific header (e.g.
+ * `X-Frame-Options: SAMEORIGIN` on the tool render route) can call
+ * `setResponseHeader` after this runs — the latest write wins.
+ */
+export declare function createSecurityHeadersMiddleware(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, any>;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/server/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/server/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AA6BH;;;;;;GAMG;AACH,wBAAgB,+BAA+B,8EAkB9C"}

package/dist/server/security-headers.js

@@ -0,0 +1,90 @@
+/**
+ * Security response headers middleware.
+ *
+ * Sets a baseline set of "no-brainer" security headers on every framework HTTP
+ * response. These headers are layered defenses: each one mitigates a specific
+ * class of attack, and together they harden the surface against clickjacking,
+ * MIME-sniffing, referrer leakage, mixed-content downgrades, and cross-origin
+ * window/embed access.
+ *
+ * The headers we emit:
+ *
+ *   - `Strict-Transport-Security` — forces HTTPS for the browser's lifetime
+ *     of the cached value, preventing SSL-strip MITM. Only emitted when the
+ *     request scheme is `https` (we don't want to break local-dev HTTP, and
+ *     emitting HSTS over HTTP is a no-op per the spec but causes confusion).
+ *   - `X-Content-Type-Options: nosniff` — disables browser MIME sniffing so
+ *     a tool /render route serving user-authored HTML can't be misinterpreted
+ *     as some other content type by a clever Accept header.
+ *   - `X-Frame-Options: DENY` — prevents the entire app from being iframed by
+ *     other origins (clickjacking the agent chat, booking pages, etc.). The
+ *     tool /render endpoint and any other route that legitimately needs to be
+ *     embedded in the same-origin app shell can opt out by setting its own
+ *     header inside the route handler — h3's `setResponseHeader` overwrites,
+ *     so a route emitting `SAMEORIGIN` wins over our middleware default.
+ *   - `Referrer-Policy: strict-origin-when-cross-origin` — strips path/query
+ *     from outbound Referer headers when the request crosses origin, so a
+ *     public-share viewer's outbound link clicks never leak the share token.
+ *   - `Permissions-Policy: camera=(), microphone=(), geolocation=(),
+ *     screen-wake-lock=()` — blocks iframed children from inheriting camera
+ *     / mic / location grants. Templates that need camera/mic for recording
+ *     UI override this on their own routes.
+ *   - `Cross-Origin-Opener-Policy: same-origin` — isolates window.opener so
+ *     a popup-window opener reference can't read or modify our document.
+ *   - `Cross-Origin-Resource-Policy: same-site` — prevents other origins from
+ *     embedding our endpoints as `<img>` / `<script>` / `<audio>`, blocking
+ *     the simplest data-leak chain when combined with auth cookies.
+ *
+ * NOTE: We don't set `Cross-Origin-Embedder-Policy` because it requires every
+ * embedded subresource to opt in via CORP/CORS, which would break Builder's
+ * iframe editor and template embed use cases. COOP + CORP without COEP gives
+ * us most of the protection.
+ */
+import { defineEventHandler, setResponseHeader } from "h3";
+const HSTS = "max-age=31536000; includeSubDomains; preload";
+const PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=(), screen-wake-lock=()";
+/**
+ * Returns true when the request was received over HTTPS. We trust both the
+ * underlying connection (when the server is terminating TLS itself) and the
+ * `x-forwarded-proto` header (set by Netlify, Vercel, Cloudflare, and any
+ * other reverse proxy that fronts the framework).
+ */
+function isHttpsRequest(event) {
+    const xfp = event?.node?.req?.headers?.["x-forwarded-proto"] ??
+        event?.headers?.get?.("x-forwarded-proto");
+    if (typeof xfp === "string" && xfp.split(",")[0].trim() === "https")
+        return true;
+    if (Array.isArray(xfp) && xfp[0] === "https")
+        return true;
+    // h3 sets `event.url.protocol` to "http:" or "https:".
+    const proto = event?.url?.protocol;
+    if (proto === "https:")
+        return true;
+    // Direct Node `req.connection.encrypted` (older runtimes).
+    if (event?.node?.req?.connection?.encrypted)
+        return true;
+    return false;
+}
+/**
+ * Create the security-headers h3 middleware. Mount this BEFORE other route
+ * handlers so the headers are present on every response (including 4xx/5xx
+ * error pages). Route handlers that need to relax a specific header (e.g.
+ * `X-Frame-Options: SAMEORIGIN` on the tool render route) can call
+ * `setResponseHeader` after this runs — the latest write wins.
+ */
+export function createSecurityHeadersMiddleware() {
+    return defineEventHandler((event) => {
+        setResponseHeader(event, "X-Content-Type-Options", "nosniff");
+        setResponseHeader(event, "X-Frame-Options", "DENY");
+        setResponseHeader(event, "Referrer-Policy", "strict-origin-when-cross-origin");
+        setResponseHeader(event, "Permissions-Policy", PERMISSIONS_POLICY);
+        setResponseHeader(event, "Cross-Origin-Opener-Policy", "same-origin");
+        setResponseHeader(event, "Cross-Origin-Resource-Policy", "same-site");
+        if (isHttpsRequest(event)) {
+            setResponseHeader(event, "Strict-Transport-Security", HSTS);
+        }
+        // Continue to the next handler — we only set headers, don't return a body.
+        return undefined;
+    });
+}
+//# sourceMappingURL=security-headers.js.map

package/dist/server/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/server/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAE3D,MAAM,IAAI,GAAG,8CAA8C,CAAC;AAC5D,MAAM,kBAAkB,GACtB,+DAA+D,CAAC;AAElE;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAU;IAChC,MAAM,GAAG,GACP,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAChD,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO;QACjE,OAAO,IAAI,CAAC;IACd,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1D,uDAAuD;IACvD,MAAM,KAAK,GAAG,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;IACnC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,2DAA2D;IAC3D,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B;IAC7C,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9D,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACpD,iBAAiB,CACf,KAAK,EACL,iBAAiB,EACjB,iCAAiC,CAClC,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QACnE,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC;QACtE,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,WAAW,CAAC,CAAC;QACtE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,iBAAiB,CAAC,KAAK,EAAE,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,2EAA2E;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/ssr-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAgC5E"}
+{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAiHA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAkD5E"}

package/dist/server/ssr-handler.js

@@ -17,6 +17,85 @@
  */
 import { createRequestHandler } from "react-router";
 import { defineEventHandler } from "h3";
+function normalizeAppBasePath(value) {
+    if (!value || value === "/")
+        return "";
+    const trimmed = value.trim();
+    if (!trimmed || trimmed === "/")
+        return "";
+    return `/${trimmed.replace(/^\/+/, "").replace(/\/+$/, "")}`;
+}
+function getAppBasePath() {
+    const metaEnv = import.meta.env;
+    return normalizeAppBasePath(process.env.VITE_APP_BASE_PATH ||
+        process.env.APP_BASE_PATH ||
+        metaEnv?.VITE_APP_BASE_PATH ||
+        metaEnv?.APP_BASE_PATH ||
+        metaEnv?.BASE_URL);
+}
+function stripAppBasePath(pathname) {
+    const basePath = getAppBasePath();
+    if (!basePath)
+        return pathname;
+    if (pathname === basePath)
+        return "/";
+    if (pathname.startsWith(`${basePath}/`)) {
+        return pathname.slice(basePath.length) || "/";
+    }
+    return pathname;
+}
+function requestWithPathname(request, pathname) {
+    const url = new URL(request.url);
+    if (url.pathname === pathname)
+        return request;
+    url.pathname = pathname;
+    return new Request(url, {
+        method: request.method,
+        headers: request.headers,
+        signal: request.signal,
+    });
+}
+function prefixMountedPath(path, basePath) {
+    if (!basePath || !path.startsWith("/") || path.startsWith("//"))
+        return path;
+    if (path === basePath || path.startsWith(`${basePath}/`))
+        return path;
+    return `${basePath}${path}`;
+}
+function prefixMountedHtml(html, basePath) {
+    if (!basePath)
+        return html;
+    return html
+        .replace(/\b(href|src|action|formaction|poster)=(["'])(\/(?!\/)[^"']*)\2/g, (_match, attr, quote, path) => `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`)
+        .replace(/url\((["']?)(\/(?!\/)[^)'" ]+)\1\)/g, (_match, quote, path) => {
+        const q = quote || "";
+        return `url(${q}${prefixMountedPath(path, basePath)}${q})`;
+    });
+}
+async function rewriteMountedResponse(response, basePath) {
+    if (!basePath)
+        return response;
+    const headers = new Headers(response.headers);
+    const location = headers.get("location");
+    if (location?.startsWith("/") && !location.startsWith("//")) {
+        headers.set("location", prefixMountedPath(location, basePath));
+    }
+    const contentType = headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("text/html") || !response.body) {
+        return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+        });
+    }
+    const html = await response.text();
+    headers.delete("content-length");
+    return new Response(prefixMountedHtml(html, basePath), {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
 /**
  * Create an h3 catch-all that hands page routes to React Router and
  * returns 404 for framework / asset paths that React Router doesn't own.
@@ -24,7 +103,8 @@ import { defineEventHandler } from "h3";
 export function createH3SSRHandler(getBuild) {
     const handler = createRequestHandler(getBuild);
     return defineEventHandler(async (event) => {
-        const p = event.url.pathname;
+        const basePath = getAppBasePath();
+        const p = stripAppBasePath(event.url.pathname);
         if (p.startsWith("/.well-known/") ||
             p.startsWith("/_agent-native/") ||
             p.startsWith("/api/") ||
@@ -34,7 +114,21 @@ export function createH3SSRHandler(getBuild) {
             return new Response(null, { status: 404 });
         }
         try {
-            return await handler(event.req);
+            const request = requestWithPathname(event.req, p);
+            if (request.method === "HEAD") {
+                const getRequest = new Request(request.url, {
+                    method: "GET",
+                    headers: request.headers,
+                    signal: request.signal,
+                });
+                const response = await handler(getRequest);
+                return await rewriteMountedResponse(new Response(null, {
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: response.headers,
+                }), basePath);
+            }
+            return await rewriteMountedResponse(await handler(request), basePath);
         }
         catch (err) {
             // Log the full stack server-side, but never leak it to the client.

package/dist/server/ssr-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7B,IACE,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;YAC7B,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAC/B,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YACrB,CAAC,KAAK,cAAc;YACpB,CAAC,KAAK,cAAc;YACpB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAC1C,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,GAAc,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AAExC,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,OAAO,GACX,MAAM,CAAC,IAGR,CAAC,GAAG,CAAC;IACN,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC5B,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,QAAQ,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,QAAgB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACxB,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI;SACR,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB;IAEhB,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE/B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE;QACrD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IACE,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;YAC7B,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAC/B,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YACrB,CAAC,KAAK,cAAc;YACpB,CAAC,KAAK,cAAc;YACpB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAC1C,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,CAAC,CAAC;YAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC3C,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/transcribe-voice.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA4CH,wBAAgB,4BAA4B;;;;;;IAgI3C"}
+{"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAkFH,wBAAgB,4BAA4B;;;;;;IAqT3C"}