@agent-native/core 0.7.14 → 0.7.16

package/dist/server/security-headers.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Security response headers middleware.
+ *
+ * Sets a baseline set of "no-brainer" security headers on every framework HTTP
+ * response. These headers are layered defenses: each one mitigates a specific
+ * class of attack, and together they harden the surface against clickjacking,
+ * MIME-sniffing, referrer leakage, mixed-content downgrades, and cross-origin
+ * window/embed access.
+ *
+ * The headers we emit:
+ *
+ *   - `Strict-Transport-Security` — forces HTTPS for the browser's lifetime
+ *     of the cached value, preventing SSL-strip MITM. Only emitted when the
+ *     request scheme is `https` (we don't want to break local-dev HTTP, and
+ *     emitting HSTS over HTTP is a no-op per the spec but causes confusion).
+ *   - `X-Content-Type-Options: nosniff` — disables browser MIME sniffing so
+ *     a tool /render route serving user-authored HTML can't be misinterpreted
+ *     as some other content type by a clever Accept header.
+ *   - `X-Frame-Options: DENY` — prevents the entire app from being iframed by
+ *     other origins (clickjacking the agent chat, booking pages, etc.). The
+ *     tool /render endpoint and any other route that legitimately needs to be
+ *     embedded in the same-origin app shell can opt out by setting its own
+ *     header inside the route handler — h3's `setResponseHeader` overwrites,
+ *     so a route emitting `SAMEORIGIN` wins over our middleware default.
+ *   - `Referrer-Policy: strict-origin-when-cross-origin` — strips path/query
+ *     from outbound Referer headers when the request crosses origin, so a
+ *     public-share viewer's outbound link clicks never leak the share token.
+ *   - `Permissions-Policy: camera=(), microphone=(), geolocation=(),
+ *     screen-wake-lock=()` — blocks iframed children from inheriting camera
+ *     / mic / location grants. Templates that need camera/mic for recording
+ *     UI override this on their own routes.
+ *   - `Cross-Origin-Opener-Policy: same-origin` — isolates window.opener so
+ *     a popup-window opener reference can't read or modify our document.
+ *   - `Cross-Origin-Resource-Policy: same-site` — prevents other origins from
+ *     embedding our endpoints as `<img>` / `<script>` / `<audio>`, blocking
+ *     the simplest data-leak chain when combined with auth cookies.
+ *
+ * NOTE: We don't set `Cross-Origin-Embedder-Policy` because it requires every
+ * embedded subresource to opt in via CORP/CORS, which would break Builder's
+ * iframe editor and template embed use cases. COOP + CORP without COEP gives
+ * us most of the protection.
+ */
+/**
+ * Create the security-headers h3 middleware. Mount this BEFORE other route
+ * handlers so the headers are present on every response (including 4xx/5xx
+ * error pages). Route handlers that need to relax a specific header (e.g.
+ * `X-Frame-Options: SAMEORIGIN` on the tool render route) can call
+ * `setResponseHeader` after this runs — the latest write wins.
+ */
+export declare function createSecurityHeadersMiddleware(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, any>;
+//# sourceMappingURL=security-headers.d.ts.map

package/dist/server/security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/server/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AA6BH;;;;;;GAMG;AACH,wBAAgB,+BAA+B,8EAkB9C"}

package/dist/server/security-headers.js

@@ -0,0 +1,90 @@
+/**
+ * Security response headers middleware.
+ *
+ * Sets a baseline set of "no-brainer" security headers on every framework HTTP
+ * response. These headers are layered defenses: each one mitigates a specific
+ * class of attack, and together they harden the surface against clickjacking,
+ * MIME-sniffing, referrer leakage, mixed-content downgrades, and cross-origin
+ * window/embed access.
+ *
+ * The headers we emit:
+ *
+ *   - `Strict-Transport-Security` — forces HTTPS for the browser's lifetime
+ *     of the cached value, preventing SSL-strip MITM. Only emitted when the
+ *     request scheme is `https` (we don't want to break local-dev HTTP, and
+ *     emitting HSTS over HTTP is a no-op per the spec but causes confusion).
+ *   - `X-Content-Type-Options: nosniff` — disables browser MIME sniffing so
+ *     a tool /render route serving user-authored HTML can't be misinterpreted
+ *     as some other content type by a clever Accept header.
+ *   - `X-Frame-Options: DENY` — prevents the entire app from being iframed by
+ *     other origins (clickjacking the agent chat, booking pages, etc.). The
+ *     tool /render endpoint and any other route that legitimately needs to be
+ *     embedded in the same-origin app shell can opt out by setting its own
+ *     header inside the route handler — h3's `setResponseHeader` overwrites,
+ *     so a route emitting `SAMEORIGIN` wins over our middleware default.
+ *   - `Referrer-Policy: strict-origin-when-cross-origin` — strips path/query
+ *     from outbound Referer headers when the request crosses origin, so a
+ *     public-share viewer's outbound link clicks never leak the share token.
+ *   - `Permissions-Policy: camera=(), microphone=(), geolocation=(),
+ *     screen-wake-lock=()` — blocks iframed children from inheriting camera
+ *     / mic / location grants. Templates that need camera/mic for recording
+ *     UI override this on their own routes.
+ *   - `Cross-Origin-Opener-Policy: same-origin` — isolates window.opener so
+ *     a popup-window opener reference can't read or modify our document.
+ *   - `Cross-Origin-Resource-Policy: same-site` — prevents other origins from
+ *     embedding our endpoints as `<img>` / `<script>` / `<audio>`, blocking
+ *     the simplest data-leak chain when combined with auth cookies.
+ *
+ * NOTE: We don't set `Cross-Origin-Embedder-Policy` because it requires every
+ * embedded subresource to opt in via CORP/CORS, which would break Builder's
+ * iframe editor and template embed use cases. COOP + CORP without COEP gives
+ * us most of the protection.
+ */
+import { defineEventHandler, setResponseHeader } from "h3";
+const HSTS = "max-age=31536000; includeSubDomains; preload";
+const PERMISSIONS_POLICY = "camera=(), microphone=(), geolocation=(), screen-wake-lock=()";
+/**
+ * Returns true when the request was received over HTTPS. We trust both the
+ * underlying connection (when the server is terminating TLS itself) and the
+ * `x-forwarded-proto` header (set by Netlify, Vercel, Cloudflare, and any
+ * other reverse proxy that fronts the framework).
+ */
+function isHttpsRequest(event) {
+    const xfp = event?.node?.req?.headers?.["x-forwarded-proto"] ??
+        event?.headers?.get?.("x-forwarded-proto");
+    if (typeof xfp === "string" && xfp.split(",")[0].trim() === "https")
+        return true;
+    if (Array.isArray(xfp) && xfp[0] === "https")
+        return true;
+    // h3 sets `event.url.protocol` to "http:" or "https:".
+    const proto = event?.url?.protocol;
+    if (proto === "https:")
+        return true;
+    // Direct Node `req.connection.encrypted` (older runtimes).
+    if (event?.node?.req?.connection?.encrypted)
+        return true;
+    return false;
+}
+/**
+ * Create the security-headers h3 middleware. Mount this BEFORE other route
+ * handlers so the headers are present on every response (including 4xx/5xx
+ * error pages). Route handlers that need to relax a specific header (e.g.
+ * `X-Frame-Options: SAMEORIGIN` on the tool render route) can call
+ * `setResponseHeader` after this runs — the latest write wins.
+ */
+export function createSecurityHeadersMiddleware() {
+    return defineEventHandler((event) => {
+        setResponseHeader(event, "X-Content-Type-Options", "nosniff");
+        setResponseHeader(event, "X-Frame-Options", "DENY");
+        setResponseHeader(event, "Referrer-Policy", "strict-origin-when-cross-origin");
+        setResponseHeader(event, "Permissions-Policy", PERMISSIONS_POLICY);
+        setResponseHeader(event, "Cross-Origin-Opener-Policy", "same-origin");
+        setResponseHeader(event, "Cross-Origin-Resource-Policy", "same-site");
+        if (isHttpsRequest(event)) {
+            setResponseHeader(event, "Strict-Transport-Security", HSTS);
+        }
+        // Continue to the next handler — we only set headers, don't return a body.
+        return undefined;
+    });
+}
+//# sourceMappingURL=security-headers.js.map

package/dist/server/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/server/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAE3D,MAAM,IAAI,GAAG,8CAA8C,CAAC;AAC5D,MAAM,kBAAkB,GACtB,+DAA+D,CAAC;AAElE;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAU;IAChC,MAAM,GAAG,GACP,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAChD,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO;QACjE,OAAO,IAAI,CAAC;IACd,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1D,uDAAuD;IACvD,MAAM,KAAK,GAAG,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;IACnC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,2DAA2D;IAC3D,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,+BAA+B;IAC7C,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9D,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACpD,iBAAiB,CACf,KAAK,EACL,iBAAiB,EACjB,iCAAiC,CAClC,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QACnE,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC;QACtE,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,WAAW,CAAC,CAAC;QACtE,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,iBAAiB,CAAC,KAAK,EAAE,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,2EAA2E;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/short-lived-token.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Short-lived HMAC-signed access tokens for media URLs.
+ *
+ * Used by clips and calls to mint a single-use bearer token after a password
+ * gate passes, then bake `?t=<token>` into the video/blob URL handed to the
+ * `<video>` element — instead of `?password=<plaintext>` (which ends up in
+ * browser history, CDN logs, and Referer headers).
+ *
+ * Token shape: `<payloadB64Url>.<sigB64Url>`
+ *   payload = base64url(JSON.stringify({ resourceId, viewerEmail?, exp }))
+ *   sig     = base64url(HMAC-SHA256(payload, key))
+ *
+ * Key resolution mirrors `google-oauth.ts:getStateSigningKey`:
+ *   1. OAUTH_STATE_SECRET (preferred — dedicated to short-lived signing)
+ *   2. BETTER_AUTH_SECRET (already used as a server secret)
+ *   3. In dev only, an ephemeral random key (per-process)
+ *
+ * In production, throws if neither secret is set.
+ */
+/**
+ * Inputs for {@link signShortLivedToken}.
+ */
+export interface ShortLivedTokenClaims {
+    /** Resource id the token authorises (recording id, call id, snippet id, …). */
+    resourceId: string;
+    /** Optional viewer email for audit / analytics — not used for authorisation. */
+    viewerEmail?: string;
+    /** Override default TTL (seconds). */
+    ttlSeconds?: number;
+}
+/**
+ * Result of {@link verifyShortLivedToken}. Discriminated by the literal
+ * `ok` field so callers can `if (!result.ok) return …`.
+ */
+export type VerifyResult = {
+    ok: true;
+    viewerEmail?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Mint a signed token authorising read access to `claims.resourceId` until
+ * `exp = now + ttl`. The result is safe to drop into a query string —
+ * `?t=<token>` — and verified by {@link verifyShortLivedToken} on the
+ * downstream route.
+ */
+export declare function signShortLivedToken(claims: ShortLivedTokenClaims): string;
+/**
+ * Verify a token previously produced by {@link signShortLivedToken}.
+ *
+ * Returns `{ ok: true, viewerEmail? }` only when:
+ *  - the token has the expected shape (`<payload>.<sig>`),
+ *  - the signature matches via constant-time comparison,
+ *  - the token has not expired,
+ *  - the embedded `resourceId` matches `expectedResourceId`.
+ *
+ * Otherwise returns `{ ok: false, reason: <error string> }`. Callers should
+ * not surface the reason to viewers (it's useful for server-side logs only).
+ */
+export declare function verifyShortLivedToken(token: string, expectedResourceId: string): VerifyResult;
+//# sourceMappingURL=short-lived-token.d.ts.map

package/dist/server/short-lived-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"short-lived-token.d.ts","sourceRoot":"","sources":["../../src/server/short-lived-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAqClC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAazE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,kBAAkB,EAAE,MAAM,GACzB,YAAY,CA0Cd"}

package/dist/server/short-lived-token.js

@@ -0,0 +1,118 @@
+/**
+ * Short-lived HMAC-signed access tokens for media URLs.
+ *
+ * Used by clips and calls to mint a single-use bearer token after a password
+ * gate passes, then bake `?t=<token>` into the video/blob URL handed to the
+ * `<video>` element — instead of `?password=<plaintext>` (which ends up in
+ * browser history, CDN logs, and Referer headers).
+ *
+ * Token shape: `<payloadB64Url>.<sigB64Url>`
+ *   payload = base64url(JSON.stringify({ resourceId, viewerEmail?, exp }))
+ *   sig     = base64url(HMAC-SHA256(payload, key))
+ *
+ * Key resolution mirrors `google-oauth.ts:getStateSigningKey`:
+ *   1. OAUTH_STATE_SECRET (preferred — dedicated to short-lived signing)
+ *   2. BETTER_AUTH_SECRET (already used as a server secret)
+ *   3. In dev only, an ephemeral random key (per-process)
+ *
+ * In production, throws if neither secret is set.
+ */
+import crypto from "node:crypto";
+/** Default token TTL, in seconds. 10 minutes covers a typical video session. */
+const DEFAULT_TTL_SECONDS = 600;
+let _devSigningKey;
+function getSigningKey() {
+    const secret = process.env.OAUTH_STATE_SECRET || process.env.BETTER_AUTH_SECRET;
+    if (secret)
+        return secret;
+    if (process.env.NODE_ENV === "production") {
+        throw new Error("Short-lived token signing requires a server secret. " +
+            "Set OAUTH_STATE_SECRET or BETTER_AUTH_SECRET in production.");
+    }
+    if (!_devSigningKey) {
+        _devSigningKey = crypto.randomBytes(32).toString("hex");
+    }
+    return _devSigningKey;
+}
+function base64UrlEncode(buf) {
+    const b = typeof buf === "string" ? Buffer.from(buf, "utf8") : buf;
+    return b
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/g, "");
+}
+function base64UrlDecode(s) {
+    // Re-pad to a multiple of 4 so Buffer.from('base64') decodes cleanly.
+    const padded = s + "=".repeat((4 - (s.length % 4)) % 4);
+    return Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+}
+/**
+ * Mint a signed token authorising read access to `claims.resourceId` until
+ * `exp = now + ttl`. The result is safe to drop into a query string —
+ * `?t=<token>` — and verified by {@link verifyShortLivedToken} on the
+ * downstream route.
+ */
+export function signShortLivedToken(claims) {
+    const ttl = claims.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+    const payload = {
+        resourceId: claims.resourceId,
+        exp: Math.floor(Date.now() / 1000) + ttl,
+    };
+    if (claims.viewerEmail)
+        payload.viewerEmail = claims.viewerEmail;
+    const payloadStr = base64UrlEncode(JSON.stringify(payload));
+    const sig = base64UrlEncode(crypto.createHmac("sha256", getSigningKey()).update(payloadStr).digest());
+    return `${payloadStr}.${sig}`;
+}
+/**
+ * Verify a token previously produced by {@link signShortLivedToken}.
+ *
+ * Returns `{ ok: true, viewerEmail? }` only when:
+ *  - the token has the expected shape (`<payload>.<sig>`),
+ *  - the signature matches via constant-time comparison,
+ *  - the token has not expired,
+ *  - the embedded `resourceId` matches `expectedResourceId`.
+ *
+ * Otherwise returns `{ ok: false, reason: <error string> }`. Callers should
+ * not surface the reason to viewers (it's useful for server-side logs only).
+ */
+export function verifyShortLivedToken(token, expectedResourceId) {
+    if (typeof token !== "string" || !token.includes(".")) {
+        return { ok: false, reason: "malformed" };
+    }
+    const [payloadStr, sig] = token.split(".", 2);
+    if (!payloadStr || !sig)
+        return { ok: false, reason: "malformed" };
+    const expected = base64UrlEncode(crypto.createHmac("sha256", getSigningKey()).update(payloadStr).digest());
+    // Constant-time compare. Length-mismatched inputs would throw under
+    // `crypto.timingSafeEqual`, so we check length first and fall back to a
+    // dummy compare to keep timing roughly constant on the failure path.
+    const sigBuf = Buffer.from(sig, "utf8");
+    const expBuf = Buffer.from(expected, "utf8");
+    if (sigBuf.length !== expBuf.length) {
+        crypto.timingSafeEqual(expBuf, expBuf); // burn ~equal cycles
+        return { ok: false, reason: "bad_signature" };
+    }
+    if (!crypto.timingSafeEqual(sigBuf, expBuf)) {
+        return { ok: false, reason: "bad_signature" };
+    }
+    let claims;
+    try {
+        claims = JSON.parse(base64UrlDecode(payloadStr).toString("utf8"));
+    }
+    catch {
+        return { ok: false, reason: "bad_payload" };
+    }
+    if (typeof claims.exp !== "number") {
+        return { ok: false, reason: "bad_payload" };
+    }
+    if (claims.exp * 1000 < Date.now()) {
+        return { ok: false, reason: "expired" };
+    }
+    if (claims.resourceId !== expectedResourceId) {
+        return { ok: false, reason: "wrong_resource" };
+    }
+    return { ok: true, viewerEmail: claims.viewerEmail };
+}
+//# sourceMappingURL=short-lived-token.js.map

package/dist/server/short-lived-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"short-lived-token.js","sourceRoot":"","sources":["../../src/server/short-lived-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,GAAG,CAAC;AA4BhC,IAAI,cAAkC,CAAC;AAEvC,SAAS,aAAa;IACpB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACnE,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,sDAAsD;YACpD,6DAA6D,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC;SACL,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,sEAAsE;IACtE,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA6B;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACrD,MAAM,OAAO,GAAkB;QAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG;KACzC,CAAC;IACF,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAEjE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,eAAe,CACzB,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CACzE,CAAC;IACF,OAAO,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,kBAA0B;IAE1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEnE,MAAM,QAAQ,GAAG,eAAe,CAC9B,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CACzE,CAAC;IAEF,oEAAoE;IACpE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC"}

package/dist/server/ssr-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAgC5E"}
+{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAiHA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAkD5E"}

package/dist/server/ssr-handler.js

@@ -17,6 +17,85 @@
  */
 import { createRequestHandler } from "react-router";
 import { defineEventHandler } from "h3";
+function normalizeAppBasePath(value) {
+    if (!value || value === "/")
+        return "";
+    const trimmed = value.trim();
+    if (!trimmed || trimmed === "/")
+        return "";
+    return `/${trimmed.replace(/^\/+/, "").replace(/\/+$/, "")}`;
+}
+function getAppBasePath() {
+    const metaEnv = import.meta.env;
+    return normalizeAppBasePath(process.env.VITE_APP_BASE_PATH ||
+        process.env.APP_BASE_PATH ||
+        metaEnv?.VITE_APP_BASE_PATH ||
+        metaEnv?.APP_BASE_PATH ||
+        metaEnv?.BASE_URL);
+}
+function stripAppBasePath(pathname) {
+    const basePath = getAppBasePath();
+    if (!basePath)
+        return pathname;
+    if (pathname === basePath)
+        return "/";
+    if (pathname.startsWith(`${basePath}/`)) {
+        return pathname.slice(basePath.length) || "/";
+    }
+    return pathname;
+}
+function requestWithPathname(request, pathname) {
+    const url = new URL(request.url);
+    if (url.pathname === pathname)
+        return request;
+    url.pathname = pathname;
+    return new Request(url, {
+        method: request.method,
+        headers: request.headers,
+        signal: request.signal,
+    });
+}
+function prefixMountedPath(path, basePath) {
+    if (!basePath || !path.startsWith("/") || path.startsWith("//"))
+        return path;
+    if (path === basePath || path.startsWith(`${basePath}/`))
+        return path;
+    return `${basePath}${path}`;
+}
+function prefixMountedHtml(html, basePath) {
+    if (!basePath)
+        return html;
+    return html
+        .replace(/\b(href|src|action|formaction|poster)=(["'])(\/(?!\/)[^"']*)\2/g, (_match, attr, quote, path) => `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`)
+        .replace(/url\((["']?)(\/(?!\/)[^)'" ]+)\1\)/g, (_match, quote, path) => {
+        const q = quote || "";
+        return `url(${q}${prefixMountedPath(path, basePath)}${q})`;
+    });
+}
+async function rewriteMountedResponse(response, basePath) {
+    if (!basePath)
+        return response;
+    const headers = new Headers(response.headers);
+    const location = headers.get("location");
+    if (location?.startsWith("/") && !location.startsWith("//")) {
+        headers.set("location", prefixMountedPath(location, basePath));
+    }
+    const contentType = headers.get("content-type") ?? "";
+    if (!contentType.toLowerCase().includes("text/html") || !response.body) {
+        return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+        });
+    }
+    const html = await response.text();
+    headers.delete("content-length");
+    return new Response(prefixMountedHtml(html, basePath), {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
 /**
  * Create an h3 catch-all that hands page routes to React Router and
  * returns 404 for framework / asset paths that React Router doesn't own.
@@ -24,7 +103,8 @@ import { defineEventHandler } from "h3";
 export function createH3SSRHandler(getBuild) {
     const handler = createRequestHandler(getBuild);
     return defineEventHandler(async (event) => {
-        const p = event.url.pathname;
+        const basePath = getAppBasePath();
+        const p = stripAppBasePath(event.url.pathname);
         if (p.startsWith("/.well-known/") ||
             p.startsWith("/_agent-native/") ||
             p.startsWith("/api/") ||
@@ -34,7 +114,21 @@ export function createH3SSRHandler(getBuild) {
             return new Response(null, { status: 404 });
         }
         try {
-            return await handler(event.req);
+            const request = requestWithPathname(event.req, p);
+            if (request.method === "HEAD") {
+                const getRequest = new Request(request.url, {
+                    method: "GET",
+                    headers: request.headers,
+                    signal: request.signal,
+                });
+                const response = await handler(getRequest);
+                return await rewriteMountedResponse(new Response(null, {
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: response.headers,
+                }), basePath);
+            }
+            return await rewriteMountedResponse(await handler(request), basePath);
         }
         catch (err) {
             // Log the full stack server-side, but never leak it to the client.

package/dist/server/ssr-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7B,IACE,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;YAC7B,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAC/B,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YACrB,CAAC,KAAK,cAAc;YACpB,CAAC,KAAK,cAAc;YACpB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAC1C,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,GAAc,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AAExC,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,OAAO,GACX,MAAM,CAAC,IAGR,CAAC,GAAG,CAAC;IACN,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC5B,OAAO,CAAC,GAAG,CAAC,aAAa;QACzB,OAAO,EAAE,kBAAkB;QAC3B,OAAO,EAAE,aAAa;QACtB,OAAO,EAAE,QAAQ,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB,EAAE,QAAgB;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC9C,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACxB,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI;SACR,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB;IAEhB,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE/B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE;QACrD,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IACE,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;YAC7B,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC;YAC/B,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YACrB,CAAC,KAAK,cAAc;YACpB,CAAC,KAAK,cAAc;YACpB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAC1C,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,CAAC,CAAC;YAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC3C,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,CACT,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server/transcribe-voice.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAwEH,wBAAgB,4BAA4B;;;;;;IAkL3C"}
+{"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAkFH,wBAAgB,4BAA4B;;;;;;IAqT3C"}