@agent-native/core 0.7.50 → 0.7.52

package/dist/server/cors-origins.d.ts

@@ -0,0 +1,10 @@
+export interface CorsOriginOptions {
+    allowedOrigins?: string[];
+    allowAnyOriginWhenNoAllowlist?: boolean;
+    allowLocalhostWhenNoAllowlist?: boolean;
+}
+export declare function readCorsAllowedOrigins(): string[];
+export declare function isTrustedNativeAppOrigin(origin: string): boolean;
+export declare function isLocalhostOrigin(origin: string): boolean;
+export declare function getAllowedCorsOrigin(origin: string | undefined, options?: CorsOriginOptions): string | null;
+//# sourceMappingURL=cors-origins.d.ts.map

package/dist/server/cors-origins.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-origins.d.ts","sourceRoot":"","sources":["../../src/server/cors-origins.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,6BAA6B,CAAC,EAAE,OAAO,CAAC;IACxC,6BAA6B,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAKjD;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,OAAO,GAAE,iBAAsB,GAC9B,MAAM,GAAG,IAAI,CAoBf"}

package/dist/server/cors-origins.js

@@ -0,0 +1,34 @@
+const LOCALHOST_ORIGIN_RE = /^https?:\/\/(localhost|127\.0\.0\.1|tauri\.localhost)(:\d+)?$/;
+const NATIVE_APP_ORIGIN_RE = /^(tauri:\/\/(localhost|tauri\.localhost)|https?:\/\/tauri\.localhost(:\d+)?)$/;
+export function readCorsAllowedOrigins() {
+    return (process.env.CORS_ALLOWED_ORIGINS ?? "")
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+export function isTrustedNativeAppOrigin(origin) {
+    return NATIVE_APP_ORIGIN_RE.test(origin);
+}
+export function isLocalhostOrigin(origin) {
+    return LOCALHOST_ORIGIN_RE.test(origin);
+}
+export function getAllowedCorsOrigin(origin, options = {}) {
+    if (!origin)
+        return null;
+    // Tauri's production WebView uses a private app origin. It is not a
+    // deploy-configured website origin, so keep it reachable even when an app
+    // also has CORS_ALLOWED_ORIGINS for browser embeds or previews.
+    if (isTrustedNativeAppOrigin(origin))
+        return origin;
+    const allowedOrigins = options.allowedOrigins ?? readCorsAllowedOrigins();
+    if (allowedOrigins.length > 0) {
+        return allowedOrigins.includes(origin) ? origin : null;
+    }
+    if (options.allowAnyOriginWhenNoAllowlist)
+        return origin;
+    if (options.allowLocalhostWhenNoAllowlist !== false) {
+        return isLocalhostOrigin(origin) ? origin : null;
+    }
+    return null;
+}
+//# sourceMappingURL=cors-origins.js.map

package/dist/server/cors-origins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors-origins.js","sourceRoot":"","sources":["../../src/server/cors-origins.ts"],"names":[],"mappings":"AAAA,MAAM,mBAAmB,GACvB,+DAA+D,CAAC;AAElE,MAAM,oBAAoB,GACxB,+EAA+E,CAAC;AAQlF,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;SAC5C,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,OAAO,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,OAAO,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAA0B,EAC1B,UAA6B,EAAE;IAE/B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,oEAAoE;IACpE,0EAA0E;IAC1E,gEAAgE;IAChE,IAAI,wBAAwB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAEpD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,sBAAsB,EAAE,CAAC;IAC1E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IAED,IAAI,OAAO,CAAC,6BAA6B;QAAE,OAAO,MAAM,CAAC;IAEzD,IAAI,OAAO,CAAC,6BAA6B,KAAK,KAAK,EAAE,CAAC;QACpD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["const LOCALHOST_ORIGIN_RE =\n  /^https?:\\/\\/(localhost|127\\.0\\.0\\.1|tauri\\.localhost)(:\\d+)?$/;\n\nconst NATIVE_APP_ORIGIN_RE =\n  /^(tauri:\\/\\/(localhost|tauri\\.localhost)|https?:\\/\\/tauri\\.localhost(:\\d+)?)$/;\n\nexport interface CorsOriginOptions {\n  allowedOrigins?: string[];\n  allowAnyOriginWhenNoAllowlist?: boolean;\n  allowLocalhostWhenNoAllowlist?: boolean;\n}\n\nexport function readCorsAllowedOrigins(): string[] {\n  return (process.env.CORS_ALLOWED_ORIGINS ?? \"\")\n    .split(\",\")\n    .map((s) => s.trim())\n    .filter(Boolean);\n}\n\nexport function isTrustedNativeAppOrigin(origin: string): boolean {\n  return NATIVE_APP_ORIGIN_RE.test(origin);\n}\n\nexport function isLocalhostOrigin(origin: string): boolean {\n  return LOCALHOST_ORIGIN_RE.test(origin);\n}\n\nexport function getAllowedCorsOrigin(\n  origin: string | undefined,\n  options: CorsOriginOptions = {},\n): string | null {\n  if (!origin) return null;\n\n  // Tauri's production WebView uses a private app origin. It is not a\n  // deploy-configured website origin, so keep it reachable even when an app\n  // also has CORS_ALLOWED_ORIGINS for browser embeds or previews.\n  if (isTrustedNativeAppOrigin(origin)) return origin;\n\n  const allowedOrigins = options.allowedOrigins ?? readCorsAllowedOrigins();\n  if (allowedOrigins.length > 0) {\n    return allowedOrigins.includes(origin) ? origin : null;\n  }\n\n  if (options.allowAnyOriginWhenNoAllowlist) return origin;\n\n  if (options.allowLocalhostWhenNoAllowlist !== false) {\n    return isLocalhostOrigin(origin) ? origin : null;\n  }\n\n  return null;\n}\n"]}

package/dist/server/create-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EAOb,MAAM,IAAI,CAAC;AAMZ,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACvC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uHAAuH;IACvH,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AA0BD;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAoDf;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;IAClC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CAkMpB"}
+{"version":3,"file":"create-server.d.ts","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EAOb,MAAM,IAAI,CAAC;AAUZ,MAAM,WAAW,YAAY;IAC3B,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACvC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uHAAuH;IACvH,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;CAC1B;AA0BD;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAC1C,OAAO,CAAC,IAAI,CAAC,CAoDf;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;IAClC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CA8KpB"}

package/dist/server/create-server.js

@@ -2,6 +2,7 @@ import { createApp, createRouter, defineEventHandler, getMethod, getRequestHeade
 import path from "path";
 import { agentEnv } from "../shared/agent-env.js";
 import { readBody } from "../server/h3-helpers.js";
+import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
 import { isEnvVarWriteAllowed } from "./env-var-writes.js";
 /**
  * Parse a .env file into key-value pairs, preserving comments and empty lines for roundtrip.
@@ -101,17 +102,13 @@ export function createServer(options = {}) {
     });
     // CORS middleware
     if (options.cors !== false) {
-        const allowedOrigins = process.env.CORS_ALLOWED_ORIGINS
-            ? process.env.CORS_ALLOWED_ORIGINS.split(",").map((o) => o.trim())
-            : null;
+        const allowedOrigins = readCorsAllowedOrigins();
         const isProduction = process.env.NODE_ENV === "production";
         /**
-         * Localhost-style origins that we treat as same-trust in development.
-         * When CORS_ALLOWED_ORIGINS is unset we still allow these (desktop tray
-         * windows on a sibling port, the docs site at localhost:5173, etc.) but
-         * in production an unset allowlist means no cross-origin credentials.
+         * When CORS_ALLOWED_ORIGINS is unset, production only allows trusted
+         * localhost/native desktop origins. Development keeps the legacy "echo
+         * any origin" behavior so local tools and docs previews keep working.
          */
-        const LOCALHOST_RE = /^https?:\/\/(localhost|127\.0\.0\.1|tauri\.localhost)(:\d+)?$/;
         app.use(defineEventHandler((event) => {
             const requestOrigin = getRequestHeader(event, "origin");
             const method = getMethod(event);
@@ -123,27 +120,11 @@ export function createServer(options = {}) {
              * permissive enough that some clients followed through with the
              * credentialed request.
              */
-            let allowedOrigin = null;
-            if (allowedOrigins && allowedOrigins.length > 0) {
-                if (requestOrigin && allowedOrigins.includes(requestOrigin)) {
-                    allowedOrigin = requestOrigin;
-                }
-                // Origin not in the explicit allowlist — emit no ACAO header.
-            }
-            else if (requestOrigin) {
-                // No allowlist configured. In production we refuse credentialed
-                // cross-origin requests except from localhost (desktop tray app
-                // dev usage); in dev we allow any origin echo.
-                if (isProduction) {
-                    if (LOCALHOST_RE.test(requestOrigin)) {
-                        allowedOrigin = requestOrigin;
-                    }
-                    // else: production + no allowlist + non-localhost origin → no ACAO
-                }
-                else {
-                    allowedOrigin = requestOrigin;
-                }
-            }
+            const allowedOrigin = getAllowedCorsOrigin(requestOrigin, {
+                allowedOrigins,
+                allowAnyOriginWhenNoAllowlist: !isProduction,
+                allowLocalhostWhenNoAllowlist: true,
+            });
             // No origin header at all (same-origin fetch, server-to-server) and
             // no allowlist → fall through with `*`-equivalent behaviour: omit
             // ACAO entirely and let the browser apply its same-origin default.

package/dist/server/create-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-server.js","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AA0B3D;;GAEG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,2BAA2B;QAC3B,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,IAA2C;IAE3C,gEAAgE;IAChE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,mDAAmD,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7D,iCAAiC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAClC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,IAAI,CAAC;IAE3C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;AACH,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,OAAO,CAAC,KAAK,EAAE,KAAK;YAClB,yFAAyF;YACzF,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAK,GAAG,EAAE,KAA+B,EAAE,IAAI,CAAC;YACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO;YAC7D,IAAI,GAAG,EAAE,OAAO,KAAK,SAAS;gBAAE,OAAO;YACvC,OAAO,CAAC,KAAK,CACX,gCAAgC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAC5D,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,kBAAkB;IAClB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;YACrD,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClE,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAE3D;;;;;WAKG;QACH,MAAM,YAAY,GAChB,+DAA+D,CAAC;QAElE,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAEhC;;;;;;;eAOG;YACH,IAAI,aAAa,GAAkB,IAAI,CAAC;YACxC,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,IAAI,aAAa,IAAI,cAAc,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;oBAC5D,aAAa,GAAG,aAAa,CAAC;gBAChC,CAAC;gBACD,8DAA8D;YAChE,CAAC;iBAAM,IAAI,aAAa,EAAE,CAAC;gBACzB,gEAAgE;gBAChE,gEAAgE;gBAChE,+CAA+C;gBAC/C,IAAI,YAAY,EAAE,CAAC;oBACjB,IAAI,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;wBACrC,aAAa,GAAG,aAAa,CAAC;oBAChC,CAAC;oBACD,mEAAmE;gBACrE,CAAC;qBAAM,CAAC;oBACN,aAAa,GAAG,aAAa,CAAC;gBAChC,CAAC;YACH,CAAC;YACD,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YAEnE,IAAI,aAAa,EAAE,CAAC;gBAClB,iBAAiB,CACf,KAAK,EACL,6BAA6B,EAC7B,aAAa,CACd,CAAC;gBACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3C,6DAA6D;gBAC7D,8DAA8D;gBAC9D,4DAA4D;gBAC5D,8DAA8D;gBAC9D,iDAAiD;gBACjD,iBAAiB,CAAC,KAAK,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACvE,CAAC;iBAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1B,kEAAkE;gBAClE,gEAAgE;gBAChE,2CAA2C;gBAC3C,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;YAED,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;YACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,kFAAkF,CACnF,CAAC;YAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,+DAA+D;gBAC/D,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,IAAI,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhB,eAAe;IACf,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CACR,qBAAqB,EACrB,kBAAkB,CAAC,GAAG,EAAE;YACtB,MAAM,OAAO,GACX,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAEhC,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,kBAAkB,CAAC,GAAG,EAAE;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC3B,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;gBAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;gBAClC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,0JAA0J;iBAC7J,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,IAEhB,CAAC;YAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAC1C,CAAC;YAED,6CAA6C;YAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACxD,CAAC;YAED,qBAAqB;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAEvC,oEAAoE;YACpE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAED,mDAAmD;YACnD,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE3B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC","sourcesContent":["import {\n  createApp,\n  createRouter,\n  defineEventHandler,\n  getMethod,\n  getRequestHeader,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport path from \"path\";\nimport { agentEnv } from \"../shared/agent-env.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport { isEnvVarWriteAllowed } from \"./env-var-writes.js\";\n\nexport interface EnvKeyConfig {\n  /** Environment variable name (e.g. \"HUBSPOT_ACCESS_TOKEN\") */\n  key: string;\n  /** Human-readable label (e.g. \"HubSpot\") */\n  label: string;\n  /** Whether this key is required for the app to function */\n  required?: boolean;\n  /** Optional UI hint shown next to the field describing where to find this value. */\n  helpText?: string;\n}\n\nexport interface CreateServerOptions {\n  /** CORS options. Ignored (H3 handles CORS via middleware). Default: enabled. */\n  cors?: Record<string, unknown> | false;\n  /** JSON body parser limit. Kept for API compatibility (H3 uses readBody). */\n  jsonLimit?: string;\n  /** Custom ping message. Default: reads PING_MESSAGE env var, falls back to \"pong\" */\n  pingMessage?: string;\n  /** Disable the /_agent-native/ping health check. Default: false */\n  disablePing?: boolean;\n  /** Env key configuration for the settings UI. Enables /_agent-native/env-status and /_agent-native/env-vars routes. */\n  envKeys?: EnvKeyConfig[];\n}\n\n/**\n * Parse a .env file into key-value pairs, preserving comments and empty lines for roundtrip.\n */\nfunction parseEnvFile(content: string): Map<string, string> {\n  const vars = new Map<string, string>();\n  for (const line of content.split(\"\\n\")) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    // Strip surrounding quotes\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n    vars.set(key, value);\n  }\n  return vars;\n}\n\n/**\n * Upsert vars into a .env file, preserving existing structure.\n */\nexport async function upsertEnvFile(\n  envPath: string,\n  vars: Array<{ key: string; value: string }>,\n): Promise<void> {\n  // Sanitize: reject values that could inject additional env vars\n  for (const { key, value } of vars) {\n    if (/[\\n\\r\\0]/.test(value)) {\n      throw new Error(\n        `Invalid env var value for ${key}: must not contain newlines or control characters`,\n      );\n    }\n  }\n\n  const fs = await import(\"fs\");\n\n  let content = \"\";\n  try {\n    content = fs.readFileSync(envPath, \"utf-8\");\n  } catch {\n    // File doesn't exist yet\n  }\n\n  const lines = content.split(\"\\n\");\n  const remaining = new Map(vars.map((v) => [v.key, v.value]));\n\n  // Update existing lines in place\n  const updated = lines.map((line) => {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) return line;\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) return line;\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (remaining.has(key)) {\n      const value = remaining.get(key)!;\n      remaining.delete(key);\n      return `${key}=${value}`;\n    }\n    return line;\n  });\n\n  // Append new vars\n  for (const [key, value] of remaining) {\n    updated.push(`${key}=${value}`);\n  }\n\n  // Ensure trailing newline\n  let result = updated.join(\"\\n\");\n  if (!result.endsWith(\"\\n\")) result += \"\\n\";\n\n  try {\n    fs.mkdirSync(path.dirname(envPath), { recursive: true });\n    fs.writeFileSync(envPath, result);\n  } catch {\n    // Edge runtimes don't have writable filesystem — skip silently\n  }\n}\n\nexport interface CreateServerResult {\n  app: ReturnType<typeof createApp>;\n  router: ReturnType<typeof createRouter>;\n}\n\n/**\n * Create a pre-configured H3 app with standard agent-native setup:\n * - CORS headers via middleware\n * - /_agent-native/ping health check\n * - /_agent-native/env-status and /_agent-native/env-vars (when envKeys is provided)\n *\n * Returns { app, router } — mount routes on `router`.\n */\nexport function createServer(\n  options: CreateServerOptions = {},\n): CreateServerResult {\n  const app = createApp({\n    onError(error, event) {\n      // Suppress connection-reset errors — client disconnected mid-request (tab close, reload)\n      const err = error as NodeJS.ErrnoException;\n      const code = err?.code || (err?.cause as NodeJS.ErrnoException)?.code;\n      if (code === \"ECONNRESET\" || code === \"ECONNABORTED\") return;\n      if (err?.message === \"aborted\") return;\n      console.error(\n        `[agent-native] Server error: ${event.method} ${event.path}`,\n        error,\n      );\n    },\n  });\n\n  // CORS middleware\n  if (options.cors !== false) {\n    const allowedOrigins = process.env.CORS_ALLOWED_ORIGINS\n      ? process.env.CORS_ALLOWED_ORIGINS.split(\",\").map((o) => o.trim())\n      : null;\n    const isProduction = process.env.NODE_ENV === \"production\";\n\n    /**\n     * Localhost-style origins that we treat as same-trust in development.\n     * When CORS_ALLOWED_ORIGINS is unset we still allow these (desktop tray\n     * windows on a sibling port, the docs site at localhost:5173, etc.) but\n     * in production an unset allowlist means no cross-origin credentials.\n     */\n    const LOCALHOST_RE =\n      /^https?:\\/\\/(localhost|127\\.0\\.0\\.1|tauri\\.localhost)(:\\d+)?$/;\n\n    app.use(\n      defineEventHandler((event) => {\n        const requestOrigin = getRequestHeader(event, \"origin\");\n        const method = getMethod(event);\n\n        /**\n         * Decide whether the requesting origin is allowed. We never fall back\n         * to \"the first allowlist entry\" when the origin isn't in the list —\n         * that previously sent `Access-Control-Allow-Origin: <other-origin>`\n         * with credentials enabled to attacker-controlled origins, which was\n         * permissive enough that some clients followed through with the\n         * credentialed request.\n         */\n        let allowedOrigin: string | null = null;\n        if (allowedOrigins && allowedOrigins.length > 0) {\n          if (requestOrigin && allowedOrigins.includes(requestOrigin)) {\n            allowedOrigin = requestOrigin;\n          }\n          // Origin not in the explicit allowlist — emit no ACAO header.\n        } else if (requestOrigin) {\n          // No allowlist configured. In production we refuse credentialed\n          // cross-origin requests except from localhost (desktop tray app\n          // dev usage); in dev we allow any origin echo.\n          if (isProduction) {\n            if (LOCALHOST_RE.test(requestOrigin)) {\n              allowedOrigin = requestOrigin;\n            }\n            // else: production + no allowlist + non-localhost origin → no ACAO\n          } else {\n            allowedOrigin = requestOrigin;\n          }\n        }\n        // No origin header at all (same-origin fetch, server-to-server) and\n        // no allowlist → fall through with `*`-equivalent behaviour: omit\n        // ACAO entirely and let the browser apply its same-origin default.\n\n        if (allowedOrigin) {\n          setResponseHeader(\n            event,\n            \"Access-Control-Allow-Origin\",\n            allowedOrigin,\n          );\n          setResponseHeader(event, \"Vary\", \"Origin\");\n          // A specific origin means we can honor credentialed requests\n          // (fetch with `credentials: \"include\"` — used by desktop tray\n          // apps that share a same-site cookie with the web app). The\n          // wildcard `*` is spec-incompatible with credentials, so only\n          // set this when we're echoing a concrete origin.\n          setResponseHeader(event, \"Access-Control-Allow-Credentials\", \"true\");\n        } else if (!requestOrigin) {\n          // No origin header — preserve the legacy permissive behaviour for\n          // tools/scripts that hit the API directly (no credentialed CORS\n          // semantics apply when there's no Origin).\n          setResponseHeader(event, \"Access-Control-Allow-Origin\", \"*\");\n        }\n\n        setResponseHeader(\n          event,\n          \"Access-Control-Allow-Methods\",\n          \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n        );\n        setResponseHeader(\n          event,\n          \"Access-Control-Allow-Headers\",\n          \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF\",\n        );\n\n        if (method === \"OPTIONS\") {\n          // Reject preflights from disallowed cross-origin callers. We only\n          // 204 if either (a) there was no Origin header (same-origin or\n          // direct script invocation) or (b) the origin was in the allowlist\n          // / dev fallback above. Otherwise we 403 so the browser surfaces\n          // a hard CORS failure rather than blindly retrying with credentials.\n          if (requestOrigin && !allowedOrigin) {\n            return new Response(null, { status: 403 });\n          }\n          return new Response(null, { status: 204 });\n        }\n      }),\n    );\n  }\n\n  const router = createRouter();\n  app.use(router);\n\n  // Health check\n  if (!options.disablePing) {\n    router.get(\n      \"/_agent-native/ping\",\n      defineEventHandler(() => {\n        const message =\n          options.pingMessage ?? process.env.PING_MESSAGE ?? \"pong\";\n        return { message };\n      }),\n    );\n  }\n\n  // Env key management routes\n  if (options.envKeys) {\n    const envKeys = options.envKeys;\n\n    router.get(\n      \"/_agent-native/env-status\",\n      defineEventHandler(() => {\n        return envKeys.map((cfg) => ({\n          key: cfg.key,\n          label: cfg.label,\n          required: cfg.required ?? false,\n          configured: !!process.env[cfg.key],\n          ...(cfg.helpText ? { helpText: cfg.helpText } : {}),\n        }));\n      }),\n    );\n\n    router.post(\n      \"/_agent-native/env-vars\",\n      defineEventHandler(async (event: H3Event) => {\n        // Env vars are deployment-wide globals — see isEnvVarWriteAllowed\n        // above. Disable the endpoint on any multi-tenant deploy.\n        if (!isEnvVarWriteAllowed()) {\n          setResponseStatus(event, 403);\n          return {\n            error:\n              \"env-vars endpoint disabled on multi-tenant deployments. Use saveCredential(key, value, { userEmail, orgId, scope: 'org' }) to store per-org credentials.\",\n          };\n        }\n\n        const body = await readBody(event);\n        const { vars } = body as {\n          vars?: Array<{ key: string; value: string }>;\n        };\n\n        if (!Array.isArray(vars) || vars.length === 0) {\n          setResponseStatus(event, 400);\n          return { error: \"vars array required\" };\n        }\n\n        // Only allow keys that are in the env config\n        const allowedKeys = new Set(envKeys.map((k) => k.key));\n        const filtered = vars.filter((v) => allowedKeys.has(v.key));\n        if (filtered.length === 0) {\n          setResponseStatus(event, 400);\n          return { error: \"No recognized env keys in request\" };\n        }\n\n        // Write to .env file\n        const envPath = path.join(process.cwd(), \".env\");\n        await upsertEnvFile(envPath, filtered);\n\n        // Update process.env so the app picks up the new values immediately\n        for (const { key, value } of filtered) {\n          process.env[key] = value;\n        }\n\n        // Notify parent (Builder or frame) via postMessage\n        agentEnv.setVars(filtered);\n\n        return { saved: filtered.map((v) => v.key) };\n      }),\n    );\n  }\n\n  return { app, router };\n}\n"]}
+{"version":3,"file":"create-server.js","sourceRoot":"","sources":["../../src/server/create-server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AACZ,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EACL,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AA0B3D;;GAEG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,2BAA2B;QAC3B,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,IAA2C;IAE3C,gEAAgE;IAChE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,mDAAmD,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAE9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE7D,iCAAiC;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAClC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,kBAAkB;IAClB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,IAAI,CAAC;IAE3C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;IACjE,CAAC;AACH,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,UAA+B,EAAE;IAEjC,MAAM,GAAG,GAAG,SAAS,CAAC;QACpB,OAAO,CAAC,KAAK,EAAE,KAAK;YAClB,yFAAyF;YACzF,MAAM,GAAG,GAAG,KAA8B,CAAC;YAC3C,MAAM,IAAI,GAAG,GAAG,EAAE,IAAI,IAAK,GAAG,EAAE,KAA+B,EAAE,IAAI,CAAC;YACtE,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,cAAc;gBAAE,OAAO;YAC7D,IAAI,GAAG,EAAE,OAAO,KAAK,SAAS;gBAAE,OAAO;YACvC,OAAO,CAAC,KAAK,CACX,gCAAgC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAC5D,KAAK,CACN,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,kBAAkB;IAClB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,MAAM,cAAc,GAAG,sBAAsB,EAAE,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAE3D;;;;WAIG;QACH,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAEhC;;;;;;;eAOG;YACH,MAAM,aAAa,GAAG,oBAAoB,CAAC,aAAa,EAAE;gBACxD,cAAc;gBACd,6BAA6B,EAAE,CAAC,YAAY;gBAC5C,6BAA6B,EAAE,IAAI;aACpC,CAAC,CAAC;YACH,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YAEnE,IAAI,aAAa,EAAE,CAAC;gBAClB,iBAAiB,CACf,KAAK,EACL,6BAA6B,EAC7B,aAAa,CACd,CAAC;gBACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3C,6DAA6D;gBAC7D,8DAA8D;gBAC9D,4DAA4D;gBAC5D,8DAA8D;gBAC9D,iDAAiD;gBACjD,iBAAiB,CAAC,KAAK,EAAE,kCAAkC,EAAE,MAAM,CAAC,CAAC;YACvE,CAAC;iBAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1B,kEAAkE;gBAClE,gEAAgE;gBAChE,2CAA2C;gBAC3C,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;YAED,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;YACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,kFAAkF,CACnF,CAAC;YAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,kEAAkE;gBAClE,+DAA+D;gBAC/D,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,IAAI,aAAa,IAAI,CAAC,aAAa,EAAE,CAAC;oBACpC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEhB,eAAe;IACf,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CACR,qBAAqB,EACrB,kBAAkB,CAAC,GAAG,EAAE;YACtB,MAAM,OAAO,GACX,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAEhC,MAAM,CAAC,GAAG,CACR,2BAA2B,EAC3B,kBAAkB,CAAC,GAAG,EAAE;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC3B,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK;gBAC/B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;gBAClC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpD,CAAC,CAAC,CAAC;QACN,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC1C,kEAAkE;YAClE,0DAA0D;YAC1D,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;gBAC5B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,0JAA0J;iBAC7J,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,GAAG,IAEhB,CAAC;YAEF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAC1C,CAAC;YAED,6CAA6C;YAC7C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;YACxD,CAAC;YAED,qBAAqB;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAEvC,oEAAoE;YACpE,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;YAED,mDAAmD;YACnD,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAE3B,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC","sourcesContent":["import {\n  createApp,\n  createRouter,\n  defineEventHandler,\n  getMethod,\n  getRequestHeader,\n  setResponseHeader,\n  setResponseStatus,\n  type H3Event,\n} from \"h3\";\nimport path from \"path\";\nimport { agentEnv } from \"../shared/agent-env.js\";\nimport { readBody } from \"../server/h3-helpers.js\";\nimport {\n  getAllowedCorsOrigin,\n  readCorsAllowedOrigins,\n} from \"./cors-origins.js\";\nimport { isEnvVarWriteAllowed } from \"./env-var-writes.js\";\n\nexport interface EnvKeyConfig {\n  /** Environment variable name (e.g. \"HUBSPOT_ACCESS_TOKEN\") */\n  key: string;\n  /** Human-readable label (e.g. \"HubSpot\") */\n  label: string;\n  /** Whether this key is required for the app to function */\n  required?: boolean;\n  /** Optional UI hint shown next to the field describing where to find this value. */\n  helpText?: string;\n}\n\nexport interface CreateServerOptions {\n  /** CORS options. Ignored (H3 handles CORS via middleware). Default: enabled. */\n  cors?: Record<string, unknown> | false;\n  /** JSON body parser limit. Kept for API compatibility (H3 uses readBody). */\n  jsonLimit?: string;\n  /** Custom ping message. Default: reads PING_MESSAGE env var, falls back to \"pong\" */\n  pingMessage?: string;\n  /** Disable the /_agent-native/ping health check. Default: false */\n  disablePing?: boolean;\n  /** Env key configuration for the settings UI. Enables /_agent-native/env-status and /_agent-native/env-vars routes. */\n  envKeys?: EnvKeyConfig[];\n}\n\n/**\n * Parse a .env file into key-value pairs, preserving comments and empty lines for roundtrip.\n */\nfunction parseEnvFile(content: string): Map<string, string> {\n  const vars = new Map<string, string>();\n  for (const line of content.split(\"\\n\")) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n    const key = trimmed.slice(0, eqIndex).trim();\n    let value = trimmed.slice(eqIndex + 1).trim();\n    // Strip surrounding quotes\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n    vars.set(key, value);\n  }\n  return vars;\n}\n\n/**\n * Upsert vars into a .env file, preserving existing structure.\n */\nexport async function upsertEnvFile(\n  envPath: string,\n  vars: Array<{ key: string; value: string }>,\n): Promise<void> {\n  // Sanitize: reject values that could inject additional env vars\n  for (const { key, value } of vars) {\n    if (/[\\n\\r\\0]/.test(value)) {\n      throw new Error(\n        `Invalid env var value for ${key}: must not contain newlines or control characters`,\n      );\n    }\n  }\n\n  const fs = await import(\"fs\");\n\n  let content = \"\";\n  try {\n    content = fs.readFileSync(envPath, \"utf-8\");\n  } catch {\n    // File doesn't exist yet\n  }\n\n  const lines = content.split(\"\\n\");\n  const remaining = new Map(vars.map((v) => [v.key, v.value]));\n\n  // Update existing lines in place\n  const updated = lines.map((line) => {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) return line;\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) return line;\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (remaining.has(key)) {\n      const value = remaining.get(key)!;\n      remaining.delete(key);\n      return `${key}=${value}`;\n    }\n    return line;\n  });\n\n  // Append new vars\n  for (const [key, value] of remaining) {\n    updated.push(`${key}=${value}`);\n  }\n\n  // Ensure trailing newline\n  let result = updated.join(\"\\n\");\n  if (!result.endsWith(\"\\n\")) result += \"\\n\";\n\n  try {\n    fs.mkdirSync(path.dirname(envPath), { recursive: true });\n    fs.writeFileSync(envPath, result);\n  } catch {\n    // Edge runtimes don't have writable filesystem — skip silently\n  }\n}\n\nexport interface CreateServerResult {\n  app: ReturnType<typeof createApp>;\n  router: ReturnType<typeof createRouter>;\n}\n\n/**\n * Create a pre-configured H3 app with standard agent-native setup:\n * - CORS headers via middleware\n * - /_agent-native/ping health check\n * - /_agent-native/env-status and /_agent-native/env-vars (when envKeys is provided)\n *\n * Returns { app, router } — mount routes on `router`.\n */\nexport function createServer(\n  options: CreateServerOptions = {},\n): CreateServerResult {\n  const app = createApp({\n    onError(error, event) {\n      // Suppress connection-reset errors — client disconnected mid-request (tab close, reload)\n      const err = error as NodeJS.ErrnoException;\n      const code = err?.code || (err?.cause as NodeJS.ErrnoException)?.code;\n      if (code === \"ECONNRESET\" || code === \"ECONNABORTED\") return;\n      if (err?.message === \"aborted\") return;\n      console.error(\n        `[agent-native] Server error: ${event.method} ${event.path}`,\n        error,\n      );\n    },\n  });\n\n  // CORS middleware\n  if (options.cors !== false) {\n    const allowedOrigins = readCorsAllowedOrigins();\n    const isProduction = process.env.NODE_ENV === \"production\";\n\n    /**\n     * When CORS_ALLOWED_ORIGINS is unset, production only allows trusted\n     * localhost/native desktop origins. Development keeps the legacy \"echo\n     * any origin\" behavior so local tools and docs previews keep working.\n     */\n    app.use(\n      defineEventHandler((event) => {\n        const requestOrigin = getRequestHeader(event, \"origin\");\n        const method = getMethod(event);\n\n        /**\n         * Decide whether the requesting origin is allowed. We never fall back\n         * to \"the first allowlist entry\" when the origin isn't in the list —\n         * that previously sent `Access-Control-Allow-Origin: <other-origin>`\n         * with credentials enabled to attacker-controlled origins, which was\n         * permissive enough that some clients followed through with the\n         * credentialed request.\n         */\n        const allowedOrigin = getAllowedCorsOrigin(requestOrigin, {\n          allowedOrigins,\n          allowAnyOriginWhenNoAllowlist: !isProduction,\n          allowLocalhostWhenNoAllowlist: true,\n        });\n        // No origin header at all (same-origin fetch, server-to-server) and\n        // no allowlist → fall through with `*`-equivalent behaviour: omit\n        // ACAO entirely and let the browser apply its same-origin default.\n\n        if (allowedOrigin) {\n          setResponseHeader(\n            event,\n            \"Access-Control-Allow-Origin\",\n            allowedOrigin,\n          );\n          setResponseHeader(event, \"Vary\", \"Origin\");\n          // A specific origin means we can honor credentialed requests\n          // (fetch with `credentials: \"include\"` — used by desktop tray\n          // apps that share a same-site cookie with the web app). The\n          // wildcard `*` is spec-incompatible with credentials, so only\n          // set this when we're echoing a concrete origin.\n          setResponseHeader(event, \"Access-Control-Allow-Credentials\", \"true\");\n        } else if (!requestOrigin) {\n          // No origin header — preserve the legacy permissive behaviour for\n          // tools/scripts that hit the API directly (no credentialed CORS\n          // semantics apply when there's no Origin).\n          setResponseHeader(event, \"Access-Control-Allow-Origin\", \"*\");\n        }\n\n        setResponseHeader(\n          event,\n          \"Access-Control-Allow-Methods\",\n          \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n        );\n        setResponseHeader(\n          event,\n          \"Access-Control-Allow-Headers\",\n          \"Content-Type,Authorization,X-Requested-With,X-Request-Source,X-Agent-Native-CSRF\",\n        );\n\n        if (method === \"OPTIONS\") {\n          // Reject preflights from disallowed cross-origin callers. We only\n          // 204 if either (a) there was no Origin header (same-origin or\n          // direct script invocation) or (b) the origin was in the allowlist\n          // / dev fallback above. Otherwise we 403 so the browser surfaces\n          // a hard CORS failure rather than blindly retrying with credentials.\n          if (requestOrigin && !allowedOrigin) {\n            return new Response(null, { status: 403 });\n          }\n          return new Response(null, { status: 204 });\n        }\n      }),\n    );\n  }\n\n  const router = createRouter();\n  app.use(router);\n\n  // Health check\n  if (!options.disablePing) {\n    router.get(\n      \"/_agent-native/ping\",\n      defineEventHandler(() => {\n        const message =\n          options.pingMessage ?? process.env.PING_MESSAGE ?? \"pong\";\n        return { message };\n      }),\n    );\n  }\n\n  // Env key management routes\n  if (options.envKeys) {\n    const envKeys = options.envKeys;\n\n    router.get(\n      \"/_agent-native/env-status\",\n      defineEventHandler(() => {\n        return envKeys.map((cfg) => ({\n          key: cfg.key,\n          label: cfg.label,\n          required: cfg.required ?? false,\n          configured: !!process.env[cfg.key],\n          ...(cfg.helpText ? { helpText: cfg.helpText } : {}),\n        }));\n      }),\n    );\n\n    router.post(\n      \"/_agent-native/env-vars\",\n      defineEventHandler(async (event: H3Event) => {\n        // Env vars are deployment-wide globals — see isEnvVarWriteAllowed\n        // above. Disable the endpoint on any multi-tenant deploy.\n        if (!isEnvVarWriteAllowed()) {\n          setResponseStatus(event, 403);\n          return {\n            error:\n              \"env-vars endpoint disabled on multi-tenant deployments. Use saveCredential(key, value, { userEmail, orgId, scope: 'org' }) to store per-org credentials.\",\n          };\n        }\n\n        const body = await readBody(event);\n        const { vars } = body as {\n          vars?: Array<{ key: string; value: string }>;\n        };\n\n        if (!Array.isArray(vars) || vars.length === 0) {\n          setResponseStatus(event, 400);\n          return { error: \"vars array required\" };\n        }\n\n        // Only allow keys that are in the env config\n        const allowedKeys = new Set(envKeys.map((k) => k.key));\n        const filtered = vars.filter((v) => allowedKeys.has(v.key));\n        if (filtered.length === 0) {\n          setResponseStatus(event, 400);\n          return { error: \"No recognized env keys in request\" };\n        }\n\n        // Write to .env file\n        const envPath = path.join(process.cwd(), \".env\");\n        await upsertEnvFile(envPath, filtered);\n\n        // Update process.env so the app picks up the new values immediately\n        for (const { key, value } of filtered) {\n          process.env[key] = value;\n        }\n\n        // Notify parent (Builder or frame) via postMessage\n        agentEnv.setVars(filtered);\n\n        return { saved: filtered.map((v) => v.key) };\n      }),\n    );\n  }\n\n  return { app, router };\n}\n"]}

package/dist/server/framework-request-handler.d.ts

@@ -21,6 +21,17 @@ export interface H3AppShim {
     use(path: string, handler: EventHandler): void;
     use(handler: EventHandler): void;
 }
+/**
+ * Mark a default plugin slot as supplied by the app/template before the
+ * framework default bootstrap runs.
+ *
+ * Bundled serverless functions often don't have the original
+ * `server/plugins/*.ts` tree on disk at runtime, so filesystem route discovery
+ * can falsely conclude a template plugin is missing. Explicit plugin factories
+ * call this synchronously before awaiting bootstrap so the framework does not
+ * auto-mount a generic default over the app's custom implementation.
+ */
+export declare function markDefaultPluginProvided(nitroApp: any, stem: string): void;
 /**
  * Get (or create) the shared H3 app wrapper for a nitroApp. Plugins use this
  * to register routes via `.use(path, handler)`.

package/dist/server/framework-request-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"framework-request-handler.d.ts","sourceRoot":"","sources":["../../src/server/framework-request-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,IAAI,CAAC;AAMhD,QAAA,MAAM,gBAAgB,mBAAmB,CAAC;AAiD1C;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,GAAG,GAAG,SAAS,CA6CjD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAiB3E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpE;AAgQD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAyBd;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"framework-request-handler.d.ts","sourceRoot":"","sources":["../../src/server/framework-request-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,YAAY,EAAW,MAAM,IAAI,CAAC;AAMhD,QAAA,MAAM,gBAAgB,mBAAmB,CAAC;AAkD1C;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAQ3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,GAAG,GAAG,SAAS,CA6CjD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAOjE;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAiB3E;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAMpE;AAsQD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,GAAG,CAAC,CAyBd;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/server/framework-request-handler.js

@@ -7,6 +7,7 @@ const WELL_KNOWN_PREFIX = "/.well-known";
 const APP_SHIM_KEY = "_agentNativeH3Shim";
 const BOOTSTRAP_PROMISE_KEY = "_agentNativeBootstrapPromise";
 const PLUGIN_READY_KEY = "_agentNativePluginReadyPromise";
+const PROVIDED_PLUGIN_STEMS_KEY = "_agentNativeProvidedPluginStems";
 function normalizeAppBasePath(value) {
     if (!value || value === "/")
         return "";
@@ -40,6 +41,24 @@ function resolveMountMatch(reqPath, path) {
         strippedPath: reqPath.slice(prefixedPath.length) || "/",
     };
 }
+/**
+ * Mark a default plugin slot as supplied by the app/template before the
+ * framework default bootstrap runs.
+ *
+ * Bundled serverless functions often don't have the original
+ * `server/plugins/*.ts` tree on disk at runtime, so filesystem route discovery
+ * can falsely conclude a template plugin is missing. Explicit plugin factories
+ * call this synchronously before awaiting bootstrap so the framework does not
+ * auto-mount a generic default over the app's custom implementation.
+ */
+export function markDefaultPluginProvided(nitroApp, stem) {
+    if (!nitroApp || !stem)
+        return;
+    const existing = nitroApp[PROVIDED_PLUGIN_STEMS_KEY];
+    const provided = existing ?? new Set();
+    provided.add(stem);
+    nitroApp[PROVIDED_PLUGIN_STEMS_KEY] = provided;
+}
 /**
  * Get (or create) the shared H3 app wrapper for a nitroApp. Plugins use this
  * to register routes via `.use(path, handler)`.
@@ -307,7 +326,11 @@ async function bootstrapDefaultPlugins(nitroApp) {
     IN_BOOTSTRAP.add(nitroApp);
     try {
         const cwd = process.cwd();
-        const missing = await getMissingDefaultPlugins(cwd);
+        const discoveredMissing = await getMissingDefaultPlugins(cwd);
+        const provided = nitroApp[PROVIDED_PLUGIN_STEMS_KEY];
+        const missing = provided
+            ? discoveredMissing.filter((stem) => !provided.has(stem))
+            : discoveredMissing;
         if (missing.length === 0)
             return;
         // Lazy import to avoid circular dependency at module load time

package/dist/server/framework-request-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"framework-request-handler.js","sourceRoot":"","sources":["../../src/server/framework-request-handler.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAC3C,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAC3C,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAC7D,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAE1D,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,MAAc;IACxD,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,OAAO,CACL,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC;QACzC,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAe,EACf,IAAY;IAEZ,IAAI,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,IAAI,CAAC,WAAW,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,YAAY,GAAG,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO;QACL,SAAS,EAAE,YAAY;QACvB,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,GAAG;KACxD,CAAC;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAa;IACpC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAEjE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAA0B,CAAC;IAC/D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAc;QACtB,GAAG,CAAC,IAA2B,EAAE,IAAmB;YAClD,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAiB,CAAC;YACzE,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;IAEF,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;IAE9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,QAAQ,CAAC,qBAAqB,CAAC,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC,KAAK,CACvE,CAAC,GAAG,EAAE,EAAE;YACN,OAAO,CAAC,IAAI,CACV,sDAAsD,EACrD,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,kEAAkE;QAClE,iEAAiE;QACjE,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC9C,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YAC1C,qDAAqD;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAiB,CAAC;QACnB,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAC9D,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAa;IAChD,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACpD,qEAAqE;IACrE,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CAAC,QAAa;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,gBAAgB,GAAG,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACzD,IAAI,gBAAgB;QAAE,MAAM,gBAAgB,CAAC;IAC7C,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,QAAa,EAAE,OAAsB;IACnE,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACjC,OAAO,CAAC,KAAK,CACX,oCAAoC,EACnC,GAAa,CAAC,OAAO,IAAI,GAAG,CAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,CAAgC,CAAC;IAC3E,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAa;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,CAAgC,CAAC;IAC3E,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,QAAa,EACb,IAAY,EACZ,OAAqB;IAErB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,KAAc,EAAE,IAAe,EAAE,EAAE;QAC3D,IAAI,gBAAoC,CAAC;QACzC,IAAI,iBAAqC,CAAC;QAC1C,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,mBAAmB,GAAG,GAAG,EAAE;YAC/B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,gBAAgB,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,gBAAgB,GAAG,SAAS,CAAC;YAC/B,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACF,KAAa,CAAC,IAAI,GAAG,iBAAiB,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,OAAQ,KAAa,CAAC,IAAI,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,sCAAsC;YACtC,MAAM,QAAQ,GAAG,KAAY,CAAC;YAC9B,YAAY,GAAG,MAAM,IAAI,QAAQ,CAAC;YAClC,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC;YAClC,IAAI,CAAC;gBACH,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACtC,uEAAuE;gBACvE,iEAAiE;gBACjE,kDAAkD;gBAClD,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1C,QAAQ,CAAC,OAAO,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;gBACrD,QAAQ,CAAC,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;gBAChD,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC;gBACxC,QAAQ,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,mEAAmE;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,oEAAoE;gBACpE,uEAAuE;gBACvE,mEAAmE;gBACnE,4DAA4D;gBAC5D,mBAAmB,EAAE,CAAC;gBACtB,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,0BAA0B;YAC1B,MAAM,OAAO,GAAG,gBAAgB,IAAI,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,GAAU,CAAC;YACrB,MAAM,MAAM,GACV,OAAO,CAAC,EAAE,UAAU,KAAK,QAAQ;gBAC/B,CAAC,CAAC,CAAC,CAAC,UAAU;gBACd,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ;oBAC7B,CAAC,CAAC,CAAC,CAAC,MAAM;oBACV,CAAC,CAAC,GAAG,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,kBAAkB,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,IAAI,EACrE,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,CAC5B,CAAC;YACF,IAAI,CAAC;gBACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,CAAC,EAAE,OAAO,IAAI,uBAAuB;gBAC5C,6DAA6D;gBAC7D,+DAA+D;gBAC/D,gEAAgE;gBAChE,0DAA0D;gBAC1D,+DAA+D;gBAC/D,oDAAoD;gBACpD,GAAG,CAAC,MAAM,IAAI,GAAG;oBACjB,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;oBAC7C,CAAC,EAAE,KAAK;oBACN,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;oBACpB,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,kEAAkE;YAClE,YAAY;YACZ,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IAEF,EAAE,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAAa;IAClD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,+DAA+D;QAC/D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAEjE,MAAM,cAAc,GAGhB;YACF,YAAY,EAAG,YAAoB,CAAC,sBAAsB;YAC1D,IAAI,EAAG,YAAoB,CAAC,iBAAiB;YAC7C,aAAa,EAAG,YAAoB,CAAC,uBAAuB;YAC5D,YAAY,EAAG,kBAA0B,CAAC,yBAAyB;YACnE,UAAU,EAAG,gBAAwB,CAAC,uBAAuB;YAC7D,GAAG,EAAG,SAAiB,CAAC,gBAAgB;YACxC,SAAS,EAAG,YAAoB,CAAC,sBAAsB;YACvD,QAAQ,EAAG,cAAsB,CAAC,qBAAqB;SACxD,CAAC;QAEF,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,qCAAqC;QACrC,IAAI,cAAc,GAGd,EAAE,CAAC;QACP,IAAI,CAAC;YACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,MAAM,uBAAuB,CAClD,EAAE,CAAC,WAAW,EACd,EAAE,CAAC,UAAU,CACd,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC5D,IAAI,CAAC,UAAU;4BAAE,SAAS;wBAC1B,MAAM,IAAI,GAAI,cAAsB,CAAC,UAAU,CAAC,CAAC;wBACjD,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC/B,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;wBAC9B,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;wBACtB,OAAO,CAAC,GAAG,CACT,iCAAiC,EAAE,CAAC,WAAW,2BAA2B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnH,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,GAAI,CAAW,CAAC,OAAO,IAAI,EAAE,CAAC;oBACvC,gEAAgE;oBAChE,6DAA6D;oBAC7D,gEAAgE;oBAChE,iEAAiE;oBACjE,wBAAwB;oBACxB,MAAM,UAAU,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC;wBACvD,CAAC,CAAC,gEAAgE;4BAChE,qBAAqB;4BACrB,EAAE,CAAC,WAAW;4BACd,kEAAkE;wBACpE,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,CAAC,IAAI,CACV,gDAAgD,EAAE,CAAC,WAAW,YAAY,GAAG,GAAG,UAAU,EAAE,CAC7F,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,oEAAoE;QACtE,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;YACnB,OAAO,CAAC,GAAG,CACT,gCAAgC,OAAO,CAAC,MAAM,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;QAEJ,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,qEAAqE;YACrE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CACV,sDAAsD,IAAI,GAAG,EAC5D,CAAW,CAAC,OAAO,CACrB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,UAAkB;IAElB,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,kBAAkB,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,sEAAsE;QACtE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,MAAM,GAAG,aAAa,CAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CACtC,CAAC,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QACjB,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,QAAQ,IAAI,OAAO,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC","sourcesContent":["/**\n * Framework request handler — registers framework routes on Nitro's h3 instance.\n *\n * Nitro 3 exposes its h3 app as `nitroApp.h3`. We register framework routes\n * directly on it as middleware (`nitroApp.h3[\"~middleware\"]`), giving each\n * plugin a path-prefix-matched handler that runs before any file-based route.\n *\n * Plugins call `getH3App(nitroApp).use(path, handler)` exactly like h3 v1's\n * `app.use()` — the wrapper translates that into v2 middleware registration.\n *\n * Default plugins that the template doesn't provide are auto-mounted on the\n * first call to `getH3App()` per nitroApp instance.\n */\nimport type { EventHandler, H3Event } from \"h3\";\nimport { setResponseHeader, setResponseStatus } from \"h3\";\nimport { getMissingDefaultPlugins } from \"../deploy/route-discovery.js\";\n\nconst BOOTSTRAPPED = new WeakSet<object>();\nconst IN_BOOTSTRAP = new WeakSet<object>();\nconst FRAMEWORK_PREFIX = \"/_agent-native\";\nconst WELL_KNOWN_PREFIX = \"/.well-known\";\nconst APP_SHIM_KEY = \"_agentNativeH3Shim\";\nconst BOOTSTRAP_PROMISE_KEY = \"_agentNativeBootstrapPromise\";\nconst PLUGIN_READY_KEY = \"_agentNativePluginReadyPromise\";\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\nfunction getAppBasePath(): string {\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n}\n\nfunction pathMatchesPrefix(reqPath: string, prefix: string): boolean {\n  return reqPath === prefix || reqPath.startsWith(prefix + \"/\");\n}\n\nfunction supportsAppBasePathMount(path: string): boolean {\n  return (\n    pathMatchesPrefix(path, FRAMEWORK_PREFIX) ||\n    pathMatchesPrefix(path, WELL_KNOWN_PREFIX)\n  );\n}\n\nfunction resolveMountMatch(\n  reqPath: string,\n  path: string,\n): { mountPath: string; strippedPath: string } | null {\n  if (pathMatchesPrefix(reqPath, path)) {\n    return { mountPath: path, strippedPath: reqPath.slice(path.length) || \"/\" };\n  }\n\n  const appBasePath = getAppBasePath();\n  if (!appBasePath || !supportsAppBasePathMount(path)) return null;\n\n  const prefixedPath = `${appBasePath}${path}`;\n  if (!pathMatchesPrefix(reqPath, prefixedPath)) return null;\n  return {\n    mountPath: prefixedPath,\n    strippedPath: reqPath.slice(prefixedPath.length) || \"/\",\n  };\n}\n\n/**\n * Wrapper around Nitro's h3 instance that exposes a v1-style `.use()` API\n * for registering path-prefix middleware.\n */\nexport interface H3AppShim {\n  use(path: string, handler: EventHandler): void;\n  use(handler: EventHandler): void;\n}\n\n/**\n * Get (or create) the shared H3 app wrapper for a nitroApp. Plugins use this\n * to register routes via `.use(path, handler)`.\n *\n * On the first call per nitroApp, we kick off auto-mounting any missing\n * default plugins. User-facing plugin factories (createAgentChatPlugin,\n * createAuthPlugin, etc.) await this bootstrap via `awaitBootstrap()` so the\n * default plugins finish registering middleware before requests arrive.\n */\nexport function getH3App(nitroApp: any): H3AppShim {\n  if (!nitroApp) throw new Error(\"getH3App: nitroApp is required\");\n\n  // Reuse the cached shim if we've wrapped this nitroApp before\n  const cached = nitroApp[APP_SHIM_KEY] as H3AppShim | undefined;\n  if (cached) return cached;\n\n  const shim: H3AppShim = {\n    use(arg1: string | EventHandler, arg2?: EventHandler) {\n      const path = typeof arg1 === \"string\" ? arg1 : \"\";\n      const handler = (typeof arg1 === \"string\" ? arg2 : arg1) as EventHandler;\n      if (typeof handler !== \"function\") {\n        throw new Error(\"getH3App.use: handler must be a function\");\n      }\n      registerMiddleware(nitroApp, path, handler);\n    },\n  };\n\n  nitroApp[APP_SHIM_KEY] = shim;\n\n  if (!BOOTSTRAPPED.has(nitroApp)) {\n    BOOTSTRAPPED.add(nitroApp);\n    nitroApp[BOOTSTRAP_PROMISE_KEY] = bootstrapDefaultPlugins(nitroApp).catch(\n      (err) => {\n        console.warn(\n          \"[agent-native] Failed to auto-mount default plugins:\",\n          (err as Error).message,\n        );\n      },\n    );\n\n    // Readiness gate: Nitro v3 doesn't await async plugins, so routes\n    // registered inside an async plugin may not exist when the first\n    // request arrives. These middleware entries hold framework routes\n    // until default-plugin bootstrap and tracked plugin inits complete.\n    const readinessGate = (async (event: H3Event) => {\n      await awaitFrameworkRoutesReady(nitroApp);\n      // Fall through — the actual route handler runs next.\n      return undefined;\n    }) as EventHandler;\n    registerMiddleware(nitroApp, FRAMEWORK_PREFIX, readinessGate);\n    registerMiddleware(nitroApp, WELL_KNOWN_PREFIX, readinessGate);\n  }\n\n  return shim;\n}\n\n/**\n * Wait for the framework's default-plugin bootstrap to complete.\n *\n * Called by user-facing plugin factories (`createAgentChatPlugin`, etc.) at\n * the top of their plugin function, so that by the time the function returns\n * — and Nitro starts accepting requests — all default plugins have finished\n * registering their middleware.\n *\n * No-op when called from inside the bootstrap itself (avoids deadlock when a\n * default plugin happens to be running as part of bootstrap).\n */\nexport async function awaitBootstrap(nitroApp: any): Promise<void> {\n  if (!nitroApp || IN_BOOTSTRAP.has(nitroApp)) return;\n  // Trigger bootstrap if it hasn't been already (idempotent — getH3App\n  // creates the shim and kicks off bootstrap on first call).\n  getH3App(nitroApp);\n  const promise = nitroApp[BOOTSTRAP_PROMISE_KEY];\n  if (promise) await promise;\n}\n\n/**\n * Wait until framework routes are safe to dispatch.\n *\n * Request-time gates must wait for both phases:\n *   1. default-plugin bootstrap, which discovers and starts missing plugins\n *   2. async plugin init promises, which register routes such as A2A cards\n */\nasync function awaitFrameworkRoutesReady(nitroApp: any): Promise<void> {\n  if (!nitroApp) return;\n  const bootstrapPromise = nitroApp[BOOTSTRAP_PROMISE_KEY];\n  if (bootstrapPromise) await bootstrapPromise;\n  await awaitPluginsReady(nitroApp);\n}\n\n/**\n * Track an async plugin's initialization promise. Nitro v3 calls plugins\n * synchronously and doesn't await async return values, so routes registered\n * inside an async plugin may not be ready when the first request arrives.\n *\n * Call this from the TOP of any async plugin so that the readiness gate\n * (installed by getH3App) can hold /_agent-native requests until the plugin\n * finishes mounting its routes.\n */\nexport function trackPluginInit(nitroApp: any, promise: Promise<void>): void {\n  if (!nitroApp) return;\n  // Attach a no-op catch so the promise doesn't surface as an unhandled\n  // rejection when Nitro v3 drops the async return value. The actual error\n  // is still observable when awaitPluginsReady() re-awaits the promise.\n  const safe = promise.catch((err) => {\n    console.error(\n      \"[agent-native] Plugin init failed:\",\n      (err as Error).message || err,\n    );\n  });\n  const existing = nitroApp[PLUGIN_READY_KEY] as Promise<void>[] | undefined;\n  if (existing) {\n    existing.push(safe);\n  } else {\n    nitroApp[PLUGIN_READY_KEY] = [safe];\n  }\n}\n\n/**\n * Await all tracked plugin initializations. Called by the readiness gate\n * middleware before dispatching framework routes.\n */\nexport async function awaitPluginsReady(nitroApp: any): Promise<void> {\n  const promises = nitroApp[PLUGIN_READY_KEY] as Promise<void>[] | undefined;\n  if (promises?.length) {\n    await Promise.all(promises);\n    nitroApp[PLUGIN_READY_KEY] = [];\n  }\n}\n\n/**\n * Register a path-prefix middleware on Nitro's h3 instance.\n *\n * The middleware:\n *   - Returns `next()` (continues) if the request path doesn't match.\n *   - Otherwise dispatches to the handler. If the handler returns a value,\n *     it short-circuits the request. If it returns undefined, next() runs.\n *\n * Path matching emulates h3 v1's `app.use(path, ...)` behavior:\n *   - Exact-match prefix: `/foo` matches `/foo`, `/foo/bar`, but not `/foobar`\n *   - Empty path: middleware runs on every request\n */\nfunction registerMiddleware(\n  nitroApp: any,\n  path: string,\n  handler: EventHandler,\n) {\n  const h3 = nitroApp.h3;\n  if (!h3 || !Array.isArray(h3[\"~middleware\"])) {\n    throw new Error(\n      \"[agent-native] Cannot register route: nitroApp.h3 is not available. \" +\n        \"Make sure you're calling getH3App() from inside a Nitro plugin.\",\n    );\n  }\n\n  const middleware = async (event: H3Event, next: () => any) => {\n    let originalPathname: string | undefined;\n    let originalEventPath: string | undefined;\n    let hadEventPath = false;\n    const restoreOriginalPath = () => {\n      if (originalPathname !== undefined) {\n        try {\n          event.url.pathname = originalPathname;\n        } catch {\n          // ignore\n        }\n        originalPathname = undefined;\n      }\n      if (hadEventPath) {\n        try {\n          (event as any).path = originalEventPath;\n        } catch {\n          // ignore\n        }\n      } else {\n        try {\n          delete (event as any).path;\n        } catch {\n          // ignore\n        }\n      }\n    };\n    if (path) {\n      const reqPath = event.url?.pathname ?? \"\";\n      const match = resolveMountMatch(reqPath, path);\n      if (!match) {\n        return next();\n      }\n      // Strip the mount prefix from event.url.pathname so handlers that\n      // dispatch sub-routes can read `event.path` (or `event.url.pathname`)\n      // and see the path RELATIVE to their mount point — matching h3 v1's\n      // `app.use(path, handler)` semantics.\n      const eventAny = event as any;\n      hadEventPath = \"path\" in eventAny;\n      originalEventPath = eventAny.path;\n      try {\n        originalPathname = event.url.pathname;\n        // Save the full path in context so handlers that need the original URL\n        // (e.g. Better Auth, which extracts its own basePath prefix) can\n        // reconstruct a Request with the un-stripped URL.\n        eventAny.context = eventAny.context ?? {};\n        eventAny.context._mountedPathname = originalPathname;\n        eventAny.context._mountPrefix = match.mountPath;\n        event.url.pathname = match.strippedPath;\n        eventAny.path = `${match.strippedPath}${event.url.search || \"\"}`;\n      } catch {\n        // event.url is read-only on some runtimes — fall through. Handlers\n        // that don't depend on prefix stripping (most of them) still work.\n      }\n    }\n    try {\n      const result = await handler(event);\n      if (result === undefined) {\n        // Restore the original pathname BEFORE calling next() so downstream\n        // middleware sees the full URL — not the stripped mount-relative path.\n        // Matches h3 v2's own sub-app middleware pattern where the restore\n        // happens inside the next() callback, not after it returns.\n        restoreOriginalPath();\n        return next();\n      }\n      return result;\n    } catch (err) {\n      // Log 500s to the server console so they're debuggable, and respond\n      // with JSON instead of the default HTML error page so clients can\n      // surface error messages. This only applies to routes mounted under\n      // the framework prefix (or middleware mounted at `/`, for which we\n      // still want visibility).\n      const reqPath = originalPathname ?? event.url?.pathname ?? \"\";\n      const e = err as any;\n      const status =\n        typeof e?.statusCode === \"number\"\n          ? e.statusCode\n          : typeof e?.status === \"number\"\n            ? e.status\n            : 500;\n      console.error(\n        `[agent-native] ${event.method ?? \"\"} ${reqPath} failed (${status}):`,\n        e?.stack || e?.message || e,\n      );\n      try {\n        setResponseStatus(event, status);\n        setResponseHeader(event, \"content-type\", \"application/json\");\n      } catch {\n        // Response already sent — best effort.\n      }\n      return {\n        error: e?.message || \"Internal server error\",\n        // Only surface the stack to clients when explicitly enabled.\n        // `NODE_ENV !== \"production\"` was unsafe — preview deploys and\n        // any host that forgets to set NODE_ENV=production leaked stack\n        // traces (file paths, dependency versions, internal route\n        // topology) to anonymous callers. Operators who want stacks in\n        // dev set `AGENT_NATIVE_DEBUG_ERRORS=1` explicitly.\n        ...(status >= 500 &&\n        process.env.AGENT_NATIVE_DEBUG_ERRORS === \"1\" &&\n        e?.stack\n          ? { stack: e.stack }\n          : {}),\n      };\n    } finally {\n      // Restore the original pathname so downstream middleware sees the\n      // full URL.\n      restoreOriginalPath();\n    }\n  };\n\n  h3[\"~middleware\"].push(middleware);\n}\n\n/**\n * Auto-mount any default framework plugins that the template doesn't provide.\n *\n * Runs once per nitroApp on the first `getH3App()` call. Uses route-discovery\n * to find which default plugin stems are missing from `server/plugins/`, then\n * dynamically imports and mounts them. If a workspace core is present in the\n * ancestor chain, plugin slots the workspace core exports are mounted from\n * there instead of from @agent-native/core — this is the middle layer of the\n * three-layer inheritance model (app local > workspace core > framework).\n */\nasync function bootstrapDefaultPlugins(nitroApp: any): Promise<void> {\n  IN_BOOTSTRAP.add(nitroApp);\n  try {\n    const cwd = process.cwd();\n    const missing = await getMissingDefaultPlugins(cwd);\n    if (missing.length === 0) return;\n\n    // Lazy import to avoid circular dependency at module load time\n    const serverModule = await import(\"./index.js\");\n    const terminalModule = await import(\"../terminal/terminal-plugin.js\");\n    const integrationsModule = await import(\"../integrations/plugin.js\");\n    const orgModule = await import(\"../org/plugin.js\");\n    const onboardingModule = await import(\"../onboarding/plugin.js\");\n\n    const frameworkImpls: Record<\n      string,\n      ((nitroApp: any) => void | Promise<void>) | undefined\n    > = {\n      \"agent-chat\": (serverModule as any).defaultAgentChatPlugin,\n      auth: (serverModule as any).defaultAuthPlugin,\n      \"core-routes\": (serverModule as any).defaultCoreRoutesPlugin,\n      integrations: (integrationsModule as any).defaultIntegrationsPlugin,\n      onboarding: (onboardingModule as any).defaultOnboardingPlugin,\n      org: (orgModule as any).defaultOrgPlugin,\n      resources: (serverModule as any).defaultResourcesPlugin,\n      terminal: (terminalModule as any).defaultTerminalPlugin,\n    };\n\n    // Workspace core layer: if the app is inside an enterprise monorepo with\n    // `agent-native.workspaceCore` configured, pull in any plugin slots the\n    // workspace core exports from its server entry. We dynamically import the\n    // workspace core package at runtime.\n    let workspaceImpls: Record<\n      string,\n      ((nitroApp: any) => void | Promise<void>) | undefined\n    > = {};\n    try {\n      const { getWorkspaceCoreExports } =\n        await import(\"../deploy/workspace-core.js\");\n      const ws = await getWorkspaceCoreExports(cwd);\n      if (ws && Object.keys(ws.plugins).length > 0) {\n        try {\n          const wsServerModule = await loadWorkspaceCoreServer(\n            ws.packageName,\n            ws.packageDir,\n          );\n          for (const [slot, exportName] of Object.entries(ws.plugins)) {\n            if (!exportName) continue;\n            const impl = (wsServerModule as any)[exportName];\n            if (typeof impl === \"function\") {\n              workspaceImpls[slot] = impl;\n            }\n          }\n          if (process.env.DEBUG) {\n            console.log(\n              `[agent-native] Workspace core ${ws.packageName} provides plugin slots: ${Object.keys(workspaceImpls).join(\", \")}`,\n            );\n          }\n        } catch (e) {\n          const msg = (e as Error).message ?? \"\";\n          // Common cause: workspace-core's package.json points \"./server\"\n          // at a TS source file (the scaffold default), but Node can't\n          // resolve relative `.js` imports inside it without a TS loader.\n          // Tell the user to compile to dist/ rather than just dumping the\n          // raw resolution error.\n          const tsLoadHint = /\\.js' imported from .*\\.ts/.test(msg)\n            ? \" — workspace-core src is TypeScript but isn't being compiled. \" +\n              \"Run `pnpm --filter \" +\n              ws.packageName +\n              \" build` and point its `./server` export at dist/server/index.js.\"\n            : \"\";\n          console.warn(\n            `[agent-native] Failed to load workspace core ${ws.packageName}/server: ${msg}${tsLoadHint}`,\n          );\n        }\n      }\n    } catch {\n      // Workspace shared package isn't available (e.g. running on an edge\n      // runtime without fs). Silently fall through to framework defaults.\n    }\n\n    if (process.env.DEBUG)\n      console.log(\n        `[agent-native] Auto-mounting ${missing.length} default plugin(s): ${missing.join(\", \")}`,\n      );\n\n    for (const stem of missing) {\n      // Prefer workspace-core impl over framework default when both exist.\n      const impl = workspaceImpls[stem] ?? frameworkImpls[stem];\n      if (typeof impl === \"function\") {\n        try {\n          await impl(nitroApp);\n        } catch (e) {\n          console.warn(\n            `[agent-native] Failed to auto-mount default plugin ${stem}:`,\n            (e as Error).message,\n          );\n        }\n      }\n    }\n  } finally {\n    IN_BOOTSTRAP.delete(nitroApp);\n  }\n}\n\n/**\n * Load a workspace-core's `/server` entry, transparently handling TS source.\n *\n * The scaffolded workspace-core template ships TS sources without a build\n * step (exports point at `./src/server/index.ts`), so plain `await import()`\n * blows up the moment Node hits a relative `.js` import inside (the standard\n * TS ESM convention) — and even before that, Node may resolve the package\n * relative to the framework's own location rather than the user's monorepo.\n *\n * We try Node's plain `import()` first (fastest path when the user has\n * compiled to dist/) and fall through to jiti on any error. jiti is anchored\n * to a real file inside the workspace-core's directory, so its module\n * resolution starts in the right node_modules tree (handles pnpm hoisting\n * and linked workspaces) AND handles TS source files + `.js` → `.ts` ESM\n * extension remapping.\n *\n * Edge runtimes without `fs` won't be able to load jiti at all; the outer\n * try/catch silently falls through to framework defaults in that case.\n */\nexport async function loadWorkspaceCoreServer(\n  packageName: string,\n  packageDir: string,\n): Promise<any> {\n  let firstErr: unknown;\n  try {\n    return await import(/* @vite-ignore */ `${packageName}/server`);\n  } catch (e) {\n    firstErr = e;\n  }\n\n  try {\n    const { createJiti } = await import(\"jiti\");\n    const { pathToFileURL } = await import(\"node:url\");\n    const path = await import(\"node:path\");\n    // Anchor jiti to a real file inside the workspace-core package so its\n    // module resolution starts in the right node_modules tree (handles pnpm\n    // hoisting and linked workspaces).\n    const anchor = pathToFileURL(\n      path.join(packageDir, \"package.json\"),\n    ).toString();\n    const jiti = createJiti(anchor, { interopDefault: true });\n    return await jiti.import(`${packageName}/server`);\n  } catch (jitiErr) {\n    // jiti also failed — rethrow the original Node error since it's usually\n    // more informative about *why* the package wasn't resolvable.\n    throw firstErr ?? jitiErr;\n  }\n}\n\nexport { FRAMEWORK_PREFIX };\n"]}
+{"version":3,"file":"framework-request-handler.js","sourceRoot":"","sources":["../../src/server/framework-request-handler.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAC3C,MAAM,YAAY,GAAG,IAAI,OAAO,EAAU,CAAC;AAC3C,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,qBAAqB,GAAG,8BAA8B,CAAC;AAC7D,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AAC1D,MAAM,yBAAyB,GAAG,iCAAiC,CAAC;AAEpE,SAAS,oBAAoB,CAAC,KAAyB;IACrD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,oBAAoB,CACzB,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAC5D,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,MAAc;IACxD,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,OAAO,CACL,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,CAAC;QACzC,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAe,EACf,IAAY;IAEZ,IAAI,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,IAAI,CAAC,WAAW,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjE,MAAM,YAAY,GAAG,GAAG,WAAW,GAAG,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO;QACL,SAAS,EAAE,YAAY;QACvB,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,GAAG;KACxD,CAAC;AACJ,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAa,EAAE,IAAY;IACnE,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,yBAAyB,CAEtC,CAAC;IACd,MAAM,QAAQ,GAAG,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;IAC/C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,yBAAyB,CAAC,GAAG,QAAQ,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAa;IACpC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAEjE,8DAA8D;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAA0B,CAAC;IAC/D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAc;QACtB,GAAG,CAAC,IAA2B,EAAE,IAAmB;YAClD,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAiB,CAAC;YACzE,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;IAEF,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC;IAE9B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3B,QAAQ,CAAC,qBAAqB,CAAC,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC,KAAK,CACvE,CAAC,GAAG,EAAE,EAAE;YACN,OAAO,CAAC,IAAI,CACV,sDAAsD,EACrD,GAAa,CAAC,OAAO,CACvB,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,kEAAkE;QAClE,iEAAiE;QACjE,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;YAC9C,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;YAC1C,qDAAqD;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC,CAAiB,CAAC;QACnB,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAC9D,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAa;IAChD,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO;IACpD,qEAAqE;IACrE,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAChD,IAAI,OAAO;QAAE,MAAM,OAAO,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,yBAAyB,CAAC,QAAa;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,MAAM,gBAAgB,GAAG,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACzD,IAAI,gBAAgB;QAAE,MAAM,gBAAgB,CAAC;IAC7C,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,QAAa,EAAE,OAAsB;IACnE,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,sEAAsE;IACtE,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACjC,OAAO,CAAC,KAAK,CACX,oCAAoC,EACnC,GAAa,CAAC,OAAO,IAAI,GAAG,CAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,CAAgC,CAAC;IAC3E,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAa;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,CAAgC,CAAC;IAC3E,IAAI,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,QAAa,EACb,IAAY,EACZ,OAAqB;IAErB,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,sEAAsE;YACpE,iEAAiE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,KAAc,EAAE,IAAe,EAAE,EAAE;QAC3D,IAAI,gBAAoC,CAAC;QACzC,IAAI,iBAAqC,CAAC;QAC1C,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,mBAAmB,GAAG,GAAG,EAAE;YAC/B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,gBAAgB,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,gBAAgB,GAAG,SAAS,CAAC;YAC/B,CAAC;YACD,IAAI,YAAY,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACF,KAAa,CAAC,IAAI,GAAG,iBAAiB,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,OAAQ,KAAa,CAAC,IAAI,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,kEAAkE;YAClE,sEAAsE;YACtE,oEAAoE;YACpE,sCAAsC;YACtC,MAAM,QAAQ,GAAG,KAAY,CAAC;YAC9B,YAAY,GAAG,MAAM,IAAI,QAAQ,CAAC;YAClC,iBAAiB,GAAG,QAAQ,CAAC,IAAI,CAAC;YAClC,IAAI,CAAC;gBACH,gBAAgB,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACtC,uEAAuE;gBACvE,iEAAiE;gBACjE,kDAAkD;gBAClD,QAAQ,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC1C,QAAQ,CAAC,OAAO,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;gBACrD,QAAQ,CAAC,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;gBAChD,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC,YAAY,CAAC;gBACxC,QAAQ,CAAC,IAAI,GAAG,GAAG,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACnE,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,mEAAmE;YACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,oEAAoE;gBACpE,uEAAuE;gBACvE,mEAAmE;gBACnE,4DAA4D;gBAC5D,mBAAmB,EAAE,CAAC;gBACtB,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,mEAAmE;YACnE,0BAA0B;YAC1B,MAAM,OAAO,GAAG,gBAAgB,IAAI,KAAK,CAAC,GAAG,EAAE,QAAQ,IAAI,EAAE,CAAC;YAC9D,MAAM,CAAC,GAAG,GAAU,CAAC;YACrB,MAAM,MAAM,GACV,OAAO,CAAC,EAAE,UAAU,KAAK,QAAQ;gBAC/B,CAAC,CAAC,CAAC,CAAC,UAAU;gBACd,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,QAAQ;oBAC7B,CAAC,CAAC,CAAC,CAAC,MAAM;oBACV,CAAC,CAAC,GAAG,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,kBAAkB,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,OAAO,YAAY,MAAM,IAAI,EACrE,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,OAAO,IAAI,CAAC,CAC5B,CAAC;YACF,IAAI,CAAC;gBACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,uCAAuC;YACzC,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,CAAC,EAAE,OAAO,IAAI,uBAAuB;gBAC5C,6DAA6D;gBAC7D,+DAA+D;gBAC/D,gEAAgE;gBAChE,0DAA0D;gBAC1D,+DAA+D;gBAC/D,oDAAoD;gBACpD,GAAG,CAAC,MAAM,IAAI,GAAG;oBACjB,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG;oBAC7C,CAAC,EAAE,KAAK;oBACN,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;oBACpB,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,kEAAkE;YAClE,YAAY;YACZ,mBAAmB,EAAE,CAAC;QACxB,CAAC;IACH,CAAC,CAAC;IAEF,EAAE,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,uBAAuB,CAAC,QAAa;IAClD,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,iBAAiB,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,QAAQ,CAAC,yBAAyB,CAEtC,CAAC;QACd,MAAM,OAAO,GAAG,QAAQ;YACtB,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzD,CAAC,CAAC,iBAAiB,CAAC;QACtB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,+DAA+D;QAC/D,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,kBAAkB,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,gBAAgB,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAEjE,MAAM,cAAc,GAGhB;YACF,YAAY,EAAG,YAAoB,CAAC,sBAAsB;YAC1D,IAAI,EAAG,YAAoB,CAAC,iBAAiB;YAC7C,aAAa,EAAG,YAAoB,CAAC,uBAAuB;YAC5D,YAAY,EAAG,kBAA0B,CAAC,yBAAyB;YACnE,UAAU,EAAG,gBAAwB,CAAC,uBAAuB;YAC7D,GAAG,EAAG,SAAiB,CAAC,gBAAgB;YACxC,SAAS,EAAG,YAAoB,CAAC,sBAAsB;YACvD,QAAQ,EAAG,cAAsB,CAAC,qBAAqB;SACxD,CAAC;QAEF,yEAAyE;QACzE,wEAAwE;QACxE,0EAA0E;QAC1E,qCAAqC;QACrC,IAAI,cAAc,GAGd,EAAE,CAAC;QACP,IAAI,CAAC;YACH,MAAM,EAAE,uBAAuB,EAAE,GAC/B,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;YAC9C,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC;oBACH,MAAM,cAAc,GAAG,MAAM,uBAAuB,CAClD,EAAE,CAAC,WAAW,EACd,EAAE,CAAC,UAAU,CACd,CAAC;oBACF,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC5D,IAAI,CAAC,UAAU;4BAAE,SAAS;wBAC1B,MAAM,IAAI,GAAI,cAAsB,CAAC,UAAU,CAAC,CAAC;wBACjD,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;4BAC/B,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;wBAC9B,CAAC;oBACH,CAAC;oBACD,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;wBACtB,OAAO,CAAC,GAAG,CACT,iCAAiC,EAAE,CAAC,WAAW,2BAA2B,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnH,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,MAAM,GAAG,GAAI,CAAW,CAAC,OAAO,IAAI,EAAE,CAAC;oBACvC,gEAAgE;oBAChE,6DAA6D;oBAC7D,gEAAgE;oBAChE,iEAAiE;oBACjE,wBAAwB;oBACxB,MAAM,UAAU,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC;wBACvD,CAAC,CAAC,gEAAgE;4BAChE,qBAAqB;4BACrB,EAAE,CAAC,WAAW;4BACd,kEAAkE;wBACpE,CAAC,CAAC,EAAE,CAAC;oBACP,OAAO,CAAC,IAAI,CACV,gDAAgD,EAAE,CAAC,WAAW,YAAY,GAAG,GAAG,UAAU,EAAE,CAC7F,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;YACpE,oEAAoE;QACtE,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK;YACnB,OAAO,CAAC,GAAG,CACT,gCAAgC,OAAO,CAAC,MAAM,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1F,CAAC;QAEJ,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,qEAAqE;YACrE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACvB,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CACV,sDAAsD,IAAI,GAAG,EAC5D,CAAW,CAAC,OAAO,CACrB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,UAAkB;IAElB,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,kBAAkB,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,QAAQ,GAAG,CAAC,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,sEAAsE;QACtE,wEAAwE;QACxE,mCAAmC;QACnC,MAAM,MAAM,GAAG,aAAa,CAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CACtC,CAAC,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QACjB,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,QAAQ,IAAI,OAAO,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC","sourcesContent":["/**\n * Framework request handler — registers framework routes on Nitro's h3 instance.\n *\n * Nitro 3 exposes its h3 app as `nitroApp.h3`. We register framework routes\n * directly on it as middleware (`nitroApp.h3[\"~middleware\"]`), giving each\n * plugin a path-prefix-matched handler that runs before any file-based route.\n *\n * Plugins call `getH3App(nitroApp).use(path, handler)` exactly like h3 v1's\n * `app.use()` — the wrapper translates that into v2 middleware registration.\n *\n * Default plugins that the template doesn't provide are auto-mounted on the\n * first call to `getH3App()` per nitroApp instance.\n */\nimport type { EventHandler, H3Event } from \"h3\";\nimport { setResponseHeader, setResponseStatus } from \"h3\";\nimport { getMissingDefaultPlugins } from \"../deploy/route-discovery.js\";\n\nconst BOOTSTRAPPED = new WeakSet<object>();\nconst IN_BOOTSTRAP = new WeakSet<object>();\nconst FRAMEWORK_PREFIX = \"/_agent-native\";\nconst WELL_KNOWN_PREFIX = \"/.well-known\";\nconst APP_SHIM_KEY = \"_agentNativeH3Shim\";\nconst BOOTSTRAP_PROMISE_KEY = \"_agentNativeBootstrapPromise\";\nconst PLUGIN_READY_KEY = \"_agentNativePluginReadyPromise\";\nconst PROVIDED_PLUGIN_STEMS_KEY = \"_agentNativeProvidedPluginStems\";\n\nfunction normalizeAppBasePath(value: string | undefined): string {\n  if (!value || value === \"/\") return \"\";\n  const trimmed = value.trim();\n  if (!trimmed || trimmed === \"/\") return \"\";\n  return `/${trimmed.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\")}`;\n}\n\nfunction getAppBasePath(): string {\n  return normalizeAppBasePath(\n    process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH,\n  );\n}\n\nfunction pathMatchesPrefix(reqPath: string, prefix: string): boolean {\n  return reqPath === prefix || reqPath.startsWith(prefix + \"/\");\n}\n\nfunction supportsAppBasePathMount(path: string): boolean {\n  return (\n    pathMatchesPrefix(path, FRAMEWORK_PREFIX) ||\n    pathMatchesPrefix(path, WELL_KNOWN_PREFIX)\n  );\n}\n\nfunction resolveMountMatch(\n  reqPath: string,\n  path: string,\n): { mountPath: string; strippedPath: string } | null {\n  if (pathMatchesPrefix(reqPath, path)) {\n    return { mountPath: path, strippedPath: reqPath.slice(path.length) || \"/\" };\n  }\n\n  const appBasePath = getAppBasePath();\n  if (!appBasePath || !supportsAppBasePathMount(path)) return null;\n\n  const prefixedPath = `${appBasePath}${path}`;\n  if (!pathMatchesPrefix(reqPath, prefixedPath)) return null;\n  return {\n    mountPath: prefixedPath,\n    strippedPath: reqPath.slice(prefixedPath.length) || \"/\",\n  };\n}\n\n/**\n * Wrapper around Nitro's h3 instance that exposes a v1-style `.use()` API\n * for registering path-prefix middleware.\n */\nexport interface H3AppShim {\n  use(path: string, handler: EventHandler): void;\n  use(handler: EventHandler): void;\n}\n\n/**\n * Mark a default plugin slot as supplied by the app/template before the\n * framework default bootstrap runs.\n *\n * Bundled serverless functions often don't have the original\n * `server/plugins/*.ts` tree on disk at runtime, so filesystem route discovery\n * can falsely conclude a template plugin is missing. Explicit plugin factories\n * call this synchronously before awaiting bootstrap so the framework does not\n * auto-mount a generic default over the app's custom implementation.\n */\nexport function markDefaultPluginProvided(nitroApp: any, stem: string): void {\n  if (!nitroApp || !stem) return;\n  const existing = nitroApp[PROVIDED_PLUGIN_STEMS_KEY] as\n    | Set<string>\n    | undefined;\n  const provided = existing ?? new Set<string>();\n  provided.add(stem);\n  nitroApp[PROVIDED_PLUGIN_STEMS_KEY] = provided;\n}\n\n/**\n * Get (or create) the shared H3 app wrapper for a nitroApp. Plugins use this\n * to register routes via `.use(path, handler)`.\n *\n * On the first call per nitroApp, we kick off auto-mounting any missing\n * default plugins. User-facing plugin factories (createAgentChatPlugin,\n * createAuthPlugin, etc.) await this bootstrap via `awaitBootstrap()` so the\n * default plugins finish registering middleware before requests arrive.\n */\nexport function getH3App(nitroApp: any): H3AppShim {\n  if (!nitroApp) throw new Error(\"getH3App: nitroApp is required\");\n\n  // Reuse the cached shim if we've wrapped this nitroApp before\n  const cached = nitroApp[APP_SHIM_KEY] as H3AppShim | undefined;\n  if (cached) return cached;\n\n  const shim: H3AppShim = {\n    use(arg1: string | EventHandler, arg2?: EventHandler) {\n      const path = typeof arg1 === \"string\" ? arg1 : \"\";\n      const handler = (typeof arg1 === \"string\" ? arg2 : arg1) as EventHandler;\n      if (typeof handler !== \"function\") {\n        throw new Error(\"getH3App.use: handler must be a function\");\n      }\n      registerMiddleware(nitroApp, path, handler);\n    },\n  };\n\n  nitroApp[APP_SHIM_KEY] = shim;\n\n  if (!BOOTSTRAPPED.has(nitroApp)) {\n    BOOTSTRAPPED.add(nitroApp);\n    nitroApp[BOOTSTRAP_PROMISE_KEY] = bootstrapDefaultPlugins(nitroApp).catch(\n      (err) => {\n        console.warn(\n          \"[agent-native] Failed to auto-mount default plugins:\",\n          (err as Error).message,\n        );\n      },\n    );\n\n    // Readiness gate: Nitro v3 doesn't await async plugins, so routes\n    // registered inside an async plugin may not exist when the first\n    // request arrives. These middleware entries hold framework routes\n    // until default-plugin bootstrap and tracked plugin inits complete.\n    const readinessGate = (async (event: H3Event) => {\n      await awaitFrameworkRoutesReady(nitroApp);\n      // Fall through — the actual route handler runs next.\n      return undefined;\n    }) as EventHandler;\n    registerMiddleware(nitroApp, FRAMEWORK_PREFIX, readinessGate);\n    registerMiddleware(nitroApp, WELL_KNOWN_PREFIX, readinessGate);\n  }\n\n  return shim;\n}\n\n/**\n * Wait for the framework's default-plugin bootstrap to complete.\n *\n * Called by user-facing plugin factories (`createAgentChatPlugin`, etc.) at\n * the top of their plugin function, so that by the time the function returns\n * — and Nitro starts accepting requests — all default plugins have finished\n * registering their middleware.\n *\n * No-op when called from inside the bootstrap itself (avoids deadlock when a\n * default plugin happens to be running as part of bootstrap).\n */\nexport async function awaitBootstrap(nitroApp: any): Promise<void> {\n  if (!nitroApp || IN_BOOTSTRAP.has(nitroApp)) return;\n  // Trigger bootstrap if it hasn't been already (idempotent — getH3App\n  // creates the shim and kicks off bootstrap on first call).\n  getH3App(nitroApp);\n  const promise = nitroApp[BOOTSTRAP_PROMISE_KEY];\n  if (promise) await promise;\n}\n\n/**\n * Wait until framework routes are safe to dispatch.\n *\n * Request-time gates must wait for both phases:\n *   1. default-plugin bootstrap, which discovers and starts missing plugins\n *   2. async plugin init promises, which register routes such as A2A cards\n */\nasync function awaitFrameworkRoutesReady(nitroApp: any): Promise<void> {\n  if (!nitroApp) return;\n  const bootstrapPromise = nitroApp[BOOTSTRAP_PROMISE_KEY];\n  if (bootstrapPromise) await bootstrapPromise;\n  await awaitPluginsReady(nitroApp);\n}\n\n/**\n * Track an async plugin's initialization promise. Nitro v3 calls plugins\n * synchronously and doesn't await async return values, so routes registered\n * inside an async plugin may not be ready when the first request arrives.\n *\n * Call this from the TOP of any async plugin so that the readiness gate\n * (installed by getH3App) can hold /_agent-native requests until the plugin\n * finishes mounting its routes.\n */\nexport function trackPluginInit(nitroApp: any, promise: Promise<void>): void {\n  if (!nitroApp) return;\n  // Attach a no-op catch so the promise doesn't surface as an unhandled\n  // rejection when Nitro v3 drops the async return value. The actual error\n  // is still observable when awaitPluginsReady() re-awaits the promise.\n  const safe = promise.catch((err) => {\n    console.error(\n      \"[agent-native] Plugin init failed:\",\n      (err as Error).message || err,\n    );\n  });\n  const existing = nitroApp[PLUGIN_READY_KEY] as Promise<void>[] | undefined;\n  if (existing) {\n    existing.push(safe);\n  } else {\n    nitroApp[PLUGIN_READY_KEY] = [safe];\n  }\n}\n\n/**\n * Await all tracked plugin initializations. Called by the readiness gate\n * middleware before dispatching framework routes.\n */\nexport async function awaitPluginsReady(nitroApp: any): Promise<void> {\n  const promises = nitroApp[PLUGIN_READY_KEY] as Promise<void>[] | undefined;\n  if (promises?.length) {\n    await Promise.all(promises);\n    nitroApp[PLUGIN_READY_KEY] = [];\n  }\n}\n\n/**\n * Register a path-prefix middleware on Nitro's h3 instance.\n *\n * The middleware:\n *   - Returns `next()` (continues) if the request path doesn't match.\n *   - Otherwise dispatches to the handler. If the handler returns a value,\n *     it short-circuits the request. If it returns undefined, next() runs.\n *\n * Path matching emulates h3 v1's `app.use(path, ...)` behavior:\n *   - Exact-match prefix: `/foo` matches `/foo`, `/foo/bar`, but not `/foobar`\n *   - Empty path: middleware runs on every request\n */\nfunction registerMiddleware(\n  nitroApp: any,\n  path: string,\n  handler: EventHandler,\n) {\n  const h3 = nitroApp.h3;\n  if (!h3 || !Array.isArray(h3[\"~middleware\"])) {\n    throw new Error(\n      \"[agent-native] Cannot register route: nitroApp.h3 is not available. \" +\n        \"Make sure you're calling getH3App() from inside a Nitro plugin.\",\n    );\n  }\n\n  const middleware = async (event: H3Event, next: () => any) => {\n    let originalPathname: string | undefined;\n    let originalEventPath: string | undefined;\n    let hadEventPath = false;\n    const restoreOriginalPath = () => {\n      if (originalPathname !== undefined) {\n        try {\n          event.url.pathname = originalPathname;\n        } catch {\n          // ignore\n        }\n        originalPathname = undefined;\n      }\n      if (hadEventPath) {\n        try {\n          (event as any).path = originalEventPath;\n        } catch {\n          // ignore\n        }\n      } else {\n        try {\n          delete (event as any).path;\n        } catch {\n          // ignore\n        }\n      }\n    };\n    if (path) {\n      const reqPath = event.url?.pathname ?? \"\";\n      const match = resolveMountMatch(reqPath, path);\n      if (!match) {\n        return next();\n      }\n      // Strip the mount prefix from event.url.pathname so handlers that\n      // dispatch sub-routes can read `event.path` (or `event.url.pathname`)\n      // and see the path RELATIVE to their mount point — matching h3 v1's\n      // `app.use(path, handler)` semantics.\n      const eventAny = event as any;\n      hadEventPath = \"path\" in eventAny;\n      originalEventPath = eventAny.path;\n      try {\n        originalPathname = event.url.pathname;\n        // Save the full path in context so handlers that need the original URL\n        // (e.g. Better Auth, which extracts its own basePath prefix) can\n        // reconstruct a Request with the un-stripped URL.\n        eventAny.context = eventAny.context ?? {};\n        eventAny.context._mountedPathname = originalPathname;\n        eventAny.context._mountPrefix = match.mountPath;\n        event.url.pathname = match.strippedPath;\n        eventAny.path = `${match.strippedPath}${event.url.search || \"\"}`;\n      } catch {\n        // event.url is read-only on some runtimes — fall through. Handlers\n        // that don't depend on prefix stripping (most of them) still work.\n      }\n    }\n    try {\n      const result = await handler(event);\n      if (result === undefined) {\n        // Restore the original pathname BEFORE calling next() so downstream\n        // middleware sees the full URL — not the stripped mount-relative path.\n        // Matches h3 v2's own sub-app middleware pattern where the restore\n        // happens inside the next() callback, not after it returns.\n        restoreOriginalPath();\n        return next();\n      }\n      return result;\n    } catch (err) {\n      // Log 500s to the server console so they're debuggable, and respond\n      // with JSON instead of the default HTML error page so clients can\n      // surface error messages. This only applies to routes mounted under\n      // the framework prefix (or middleware mounted at `/`, for which we\n      // still want visibility).\n      const reqPath = originalPathname ?? event.url?.pathname ?? \"\";\n      const e = err as any;\n      const status =\n        typeof e?.statusCode === \"number\"\n          ? e.statusCode\n          : typeof e?.status === \"number\"\n            ? e.status\n            : 500;\n      console.error(\n        `[agent-native] ${event.method ?? \"\"} ${reqPath} failed (${status}):`,\n        e?.stack || e?.message || e,\n      );\n      try {\n        setResponseStatus(event, status);\n        setResponseHeader(event, \"content-type\", \"application/json\");\n      } catch {\n        // Response already sent — best effort.\n      }\n      return {\n        error: e?.message || \"Internal server error\",\n        // Only surface the stack to clients when explicitly enabled.\n        // `NODE_ENV !== \"production\"` was unsafe — preview deploys and\n        // any host that forgets to set NODE_ENV=production leaked stack\n        // traces (file paths, dependency versions, internal route\n        // topology) to anonymous callers. Operators who want stacks in\n        // dev set `AGENT_NATIVE_DEBUG_ERRORS=1` explicitly.\n        ...(status >= 500 &&\n        process.env.AGENT_NATIVE_DEBUG_ERRORS === \"1\" &&\n        e?.stack\n          ? { stack: e.stack }\n          : {}),\n      };\n    } finally {\n      // Restore the original pathname so downstream middleware sees the\n      // full URL.\n      restoreOriginalPath();\n    }\n  };\n\n  h3[\"~middleware\"].push(middleware);\n}\n\n/**\n * Auto-mount any default framework plugins that the template doesn't provide.\n *\n * Runs once per nitroApp on the first `getH3App()` call. Uses route-discovery\n * to find which default plugin stems are missing from `server/plugins/`, then\n * dynamically imports and mounts them. If a workspace core is present in the\n * ancestor chain, plugin slots the workspace core exports are mounted from\n * there instead of from @agent-native/core — this is the middle layer of the\n * three-layer inheritance model (app local > workspace core > framework).\n */\nasync function bootstrapDefaultPlugins(nitroApp: any): Promise<void> {\n  IN_BOOTSTRAP.add(nitroApp);\n  try {\n    const cwd = process.cwd();\n    const discoveredMissing = await getMissingDefaultPlugins(cwd);\n    const provided = nitroApp[PROVIDED_PLUGIN_STEMS_KEY] as\n      | Set<string>\n      | undefined;\n    const missing = provided\n      ? discoveredMissing.filter((stem) => !provided.has(stem))\n      : discoveredMissing;\n    if (missing.length === 0) return;\n\n    // Lazy import to avoid circular dependency at module load time\n    const serverModule = await import(\"./index.js\");\n    const terminalModule = await import(\"../terminal/terminal-plugin.js\");\n    const integrationsModule = await import(\"../integrations/plugin.js\");\n    const orgModule = await import(\"../org/plugin.js\");\n    const onboardingModule = await import(\"../onboarding/plugin.js\");\n\n    const frameworkImpls: Record<\n      string,\n      ((nitroApp: any) => void | Promise<void>) | undefined\n    > = {\n      \"agent-chat\": (serverModule as any).defaultAgentChatPlugin,\n      auth: (serverModule as any).defaultAuthPlugin,\n      \"core-routes\": (serverModule as any).defaultCoreRoutesPlugin,\n      integrations: (integrationsModule as any).defaultIntegrationsPlugin,\n      onboarding: (onboardingModule as any).defaultOnboardingPlugin,\n      org: (orgModule as any).defaultOrgPlugin,\n      resources: (serverModule as any).defaultResourcesPlugin,\n      terminal: (terminalModule as any).defaultTerminalPlugin,\n    };\n\n    // Workspace core layer: if the app is inside an enterprise monorepo with\n    // `agent-native.workspaceCore` configured, pull in any plugin slots the\n    // workspace core exports from its server entry. We dynamically import the\n    // workspace core package at runtime.\n    let workspaceImpls: Record<\n      string,\n      ((nitroApp: any) => void | Promise<void>) | undefined\n    > = {};\n    try {\n      const { getWorkspaceCoreExports } =\n        await import(\"../deploy/workspace-core.js\");\n      const ws = await getWorkspaceCoreExports(cwd);\n      if (ws && Object.keys(ws.plugins).length > 0) {\n        try {\n          const wsServerModule = await loadWorkspaceCoreServer(\n            ws.packageName,\n            ws.packageDir,\n          );\n          for (const [slot, exportName] of Object.entries(ws.plugins)) {\n            if (!exportName) continue;\n            const impl = (wsServerModule as any)[exportName];\n            if (typeof impl === \"function\") {\n              workspaceImpls[slot] = impl;\n            }\n          }\n          if (process.env.DEBUG) {\n            console.log(\n              `[agent-native] Workspace core ${ws.packageName} provides plugin slots: ${Object.keys(workspaceImpls).join(\", \")}`,\n            );\n          }\n        } catch (e) {\n          const msg = (e as Error).message ?? \"\";\n          // Common cause: workspace-core's package.json points \"./server\"\n          // at a TS source file (the scaffold default), but Node can't\n          // resolve relative `.js` imports inside it without a TS loader.\n          // Tell the user to compile to dist/ rather than just dumping the\n          // raw resolution error.\n          const tsLoadHint = /\\.js' imported from .*\\.ts/.test(msg)\n            ? \" — workspace-core src is TypeScript but isn't being compiled. \" +\n              \"Run `pnpm --filter \" +\n              ws.packageName +\n              \" build` and point its `./server` export at dist/server/index.js.\"\n            : \"\";\n          console.warn(\n            `[agent-native] Failed to load workspace core ${ws.packageName}/server: ${msg}${tsLoadHint}`,\n          );\n        }\n      }\n    } catch {\n      // Workspace shared package isn't available (e.g. running on an edge\n      // runtime without fs). Silently fall through to framework defaults.\n    }\n\n    if (process.env.DEBUG)\n      console.log(\n        `[agent-native] Auto-mounting ${missing.length} default plugin(s): ${missing.join(\", \")}`,\n      );\n\n    for (const stem of missing) {\n      // Prefer workspace-core impl over framework default when both exist.\n      const impl = workspaceImpls[stem] ?? frameworkImpls[stem];\n      if (typeof impl === \"function\") {\n        try {\n          await impl(nitroApp);\n        } catch (e) {\n          console.warn(\n            `[agent-native] Failed to auto-mount default plugin ${stem}:`,\n            (e as Error).message,\n          );\n        }\n      }\n    }\n  } finally {\n    IN_BOOTSTRAP.delete(nitroApp);\n  }\n}\n\n/**\n * Load a workspace-core's `/server` entry, transparently handling TS source.\n *\n * The scaffolded workspace-core template ships TS sources without a build\n * step (exports point at `./src/server/index.ts`), so plain `await import()`\n * blows up the moment Node hits a relative `.js` import inside (the standard\n * TS ESM convention) — and even before that, Node may resolve the package\n * relative to the framework's own location rather than the user's monorepo.\n *\n * We try Node's plain `import()` first (fastest path when the user has\n * compiled to dist/) and fall through to jiti on any error. jiti is anchored\n * to a real file inside the workspace-core's directory, so its module\n * resolution starts in the right node_modules tree (handles pnpm hoisting\n * and linked workspaces) AND handles TS source files + `.js` → `.ts` ESM\n * extension remapping.\n *\n * Edge runtimes without `fs` won't be able to load jiti at all; the outer\n * try/catch silently falls through to framework defaults in that case.\n */\nexport async function loadWorkspaceCoreServer(\n  packageName: string,\n  packageDir: string,\n): Promise<any> {\n  let firstErr: unknown;\n  try {\n    return await import(/* @vite-ignore */ `${packageName}/server`);\n  } catch (e) {\n    firstErr = e;\n  }\n\n  try {\n    const { createJiti } = await import(\"jiti\");\n    const { pathToFileURL } = await import(\"node:url\");\n    const path = await import(\"node:path\");\n    // Anchor jiti to a real file inside the workspace-core package so its\n    // module resolution starts in the right node_modules tree (handles pnpm\n    // hoisting and linked workspaces).\n    const anchor = pathToFileURL(\n      path.join(packageDir, \"package.json\"),\n    ).toString();\n    const jiti = createJiti(anchor, { interopDefault: true });\n    return await jiti.import(`${packageName}/server`);\n  } catch (jitiErr) {\n    // jiti also failed — rethrow the original Node error since it's usually\n    // more informative about *why* the package wasn't resolvable.\n    throw firstErr ?? jitiErr;\n  }\n}\n\nexport { FRAMEWORK_PREFIX };\n"]}

package/dist/server/resources-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources-plugin.d.ts","sourceRoot":"","sources":["../../src/server/resources-plugin.ts"],"names":[],"mappings":"AAYA,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CA0DtD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC"}
+{"version":3,"file":"resources-plugin.d.ts","sourceRoot":"","sources":["../../src/server/resources-plugin.ts"],"names":[],"mappings":"AAeA,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CA2DtD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,EAAE,cAAwC,CAAC"}

package/dist/server/resources-plugin.js

@@ -1,4 +1,4 @@
-import { getH3App } from "./framework-request-handler.js";
+import { getH3App, markDefaultPluginProvided, } from "./framework-request-handler.js";
 import { defineEventHandler, setResponseStatus, getMethod } from "h3";
 import { handleListResources, handleGetResourceTree, handleGetResource, handleCreateResource, handleUpdateResource, handleDeleteResource, handleUploadResource, } from "../resources/handlers.js";
 /**
@@ -15,6 +15,7 @@ import { handleListResources, handleGetResourceTree, handleGetResource, handleCr
  */
 export function createResourcesPlugin() {
     return async (nitroApp) => {
+        markDefaultPluginProvided(nitroApp, "resources");
         // Mount specific sub-routes BEFORE the catch-all
         getH3App(nitroApp).use("/_agent-native/resources/tree", defineEventHandler(async (event) => {
             if (getMethod(event) !== "GET") {

package/dist/server/resources-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources-plugin.js","sourceRoot":"","sources":["../../src/server/resources-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAIlC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,EAAE,QAAa,EAAE,EAAE;QAC7B,iDAAiD;QAEjD,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,+BAA+B,EAC/B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CACH,CAAC;QAEF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,iCAAiC,EACjC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;gBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,0BAA0B,EAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,6DAA6D;YAC7D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAEvC,yDAAyD;YACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBAC/B,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAC1D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,4CAA4C;YAC5C,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ;gBAAE,OAAO;YAEvD,qDAAqD;YACrD,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;YAEhE,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE5D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB,qBAAqB,EAAE,CAAC","sourcesContent":["import { getH3App } from \"./framework-request-handler.js\";\nimport { defineEventHandler, setResponseStatus, getMethod } from \"h3\";\nimport {\n  handleListResources,\n  handleGetResourceTree,\n  handleGetResource,\n  handleCreateResource,\n  handleUpdateResource,\n  handleDeleteResource,\n  handleUploadResource,\n} from \"../resources/handlers.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\n/**\n * Creates a Nitro plugin that mounts all resource CRUD routes.\n *\n * Routes:\n *   GET    /_agent-native/resources          — list resources\n *   POST   /_agent-native/resources          — create resource\n *   GET    /_agent-native/resources/tree     — get resource tree\n *   POST   /_agent-native/resources/upload   — upload file\n *   GET    /_agent-native/resources/:id      — get resource by ID\n *   PUT    /_agent-native/resources/:id      — update resource\n *   DELETE /_agent-native/resources/:id      — delete resource\n */\nexport function createResourcesPlugin(): NitroPluginDef {\n  return async (nitroApp: any) => {\n    // Mount specific sub-routes BEFORE the catch-all\n\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources/tree\",\n      defineEventHandler(async (event) => {\n        if (getMethod(event) !== \"GET\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n        return handleGetResourceTree(event);\n      }),\n    );\n\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources/upload\",\n      defineEventHandler(async (event) => {\n        if (getMethod(event) !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n        return handleUploadResource(event);\n      }),\n    );\n\n    // Catch-all for /_agent-native/resources and /_agent-native/resources/:id\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources\",\n      defineEventHandler(async (event) => {\n        const method = getMethod(event);\n        // h3 strips the mount prefix, so event.path is \"/\" or \"/:id\"\n        const raw = (event.path || \"/\").split(\"?\")[0];\n        const subPath = raw.replace(/^\\//, \"\");\n\n        // No sub-path: /_agent-native/resources — list or create\n        if (!subPath || subPath === \"\") {\n          if (method === \"GET\") return handleListResources(event);\n          if (method === \"POST\") return handleCreateResource(event);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // Already handled by dedicated routes above\n        if (subPath === \"tree\" || subPath === \"upload\") return;\n\n        // /_agent-native/resources/:id — get, update, delete\n        event.context.params = { ...event.context.params, id: subPath };\n\n        if (method === \"GET\") return handleGetResource(event);\n        if (method === \"PUT\") return handleUpdateResource(event);\n        if (method === \"DELETE\") return handleDeleteResource(event);\n\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }),\n    );\n  };\n}\n\n/**\n * Default resources plugin — mount with no configuration needed.\n *\n * Usage in templates:\n * ```ts\n * // server/plugins/resources.ts\n * import { defaultResourcesPlugin } from \"@agent-native/core/server\";\n * export default defaultResourcesPlugin;\n * ```\n */\nexport const defaultResourcesPlugin: NitroPluginDef = createResourcesPlugin();\n"]}
+{"version":3,"file":"resources-plugin.js","sourceRoot":"","sources":["../../src/server/resources-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,yBAAyB,GAC1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACtE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAIlC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,KAAK,EAAE,QAAa,EAAE,EAAE;QAC7B,yBAAyB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACjD,iDAAiD;QAEjD,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,+BAA+B,EAC/B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC/B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC,CAAC,CACH,CAAC;QAEF,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,iCAAiC,EACjC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM,EAAE,CAAC;gBAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CACH,CAAC;QAEF,0EAA0E;QAC1E,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CACpB,0BAA0B,EAC1B,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAChC,6DAA6D;YAC7D,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAEvC,yDAAyD;YACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBAC/B,IAAI,MAAM,KAAK,KAAK;oBAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;gBACxD,IAAI,MAAM,KAAK,MAAM;oBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBAC1D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACzC,CAAC;YAED,4CAA4C;YAC5C,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ;gBAAE,OAAO;YAEvD,qDAAqD;YACrD,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;YAEhE,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;YAE5D,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACzC,CAAC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAmB,qBAAqB,EAAE,CAAC","sourcesContent":["import {\n  getH3App,\n  markDefaultPluginProvided,\n} from \"./framework-request-handler.js\";\nimport { defineEventHandler, setResponseStatus, getMethod } from \"h3\";\nimport {\n  handleListResources,\n  handleGetResourceTree,\n  handleGetResource,\n  handleCreateResource,\n  handleUpdateResource,\n  handleDeleteResource,\n  handleUploadResource,\n} from \"../resources/handlers.js\";\n\ntype NitroPluginDef = (nitroApp: any) => void | Promise<void>;\n\n/**\n * Creates a Nitro plugin that mounts all resource CRUD routes.\n *\n * Routes:\n *   GET    /_agent-native/resources          — list resources\n *   POST   /_agent-native/resources          — create resource\n *   GET    /_agent-native/resources/tree     — get resource tree\n *   POST   /_agent-native/resources/upload   — upload file\n *   GET    /_agent-native/resources/:id      — get resource by ID\n *   PUT    /_agent-native/resources/:id      — update resource\n *   DELETE /_agent-native/resources/:id      — delete resource\n */\nexport function createResourcesPlugin(): NitroPluginDef {\n  return async (nitroApp: any) => {\n    markDefaultPluginProvided(nitroApp, \"resources\");\n    // Mount specific sub-routes BEFORE the catch-all\n\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources/tree\",\n      defineEventHandler(async (event) => {\n        if (getMethod(event) !== \"GET\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n        return handleGetResourceTree(event);\n      }),\n    );\n\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources/upload\",\n      defineEventHandler(async (event) => {\n        if (getMethod(event) !== \"POST\") {\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n        return handleUploadResource(event);\n      }),\n    );\n\n    // Catch-all for /_agent-native/resources and /_agent-native/resources/:id\n    getH3App(nitroApp).use(\n      \"/_agent-native/resources\",\n      defineEventHandler(async (event) => {\n        const method = getMethod(event);\n        // h3 strips the mount prefix, so event.path is \"/\" or \"/:id\"\n        const raw = (event.path || \"/\").split(\"?\")[0];\n        const subPath = raw.replace(/^\\//, \"\");\n\n        // No sub-path: /_agent-native/resources — list or create\n        if (!subPath || subPath === \"\") {\n          if (method === \"GET\") return handleListResources(event);\n          if (method === \"POST\") return handleCreateResource(event);\n          setResponseStatus(event, 405);\n          return { error: \"Method not allowed\" };\n        }\n\n        // Already handled by dedicated routes above\n        if (subPath === \"tree\" || subPath === \"upload\") return;\n\n        // /_agent-native/resources/:id — get, update, delete\n        event.context.params = { ...event.context.params, id: subPath };\n\n        if (method === \"GET\") return handleGetResource(event);\n        if (method === \"PUT\") return handleUpdateResource(event);\n        if (method === \"DELETE\") return handleDeleteResource(event);\n\n        setResponseStatus(event, 405);\n        return { error: \"Method not allowed\" };\n      }),\n    );\n  };\n}\n\n/**\n * Default resources plugin — mount with no configuration needed.\n *\n * Usage in templates:\n * ```ts\n * // server/plugins/resources.ts\n * import { defaultResourcesPlugin } from \"@agent-native/core/server\";\n * export default defaultResourcesPlugin;\n * ```\n */\nexport const defaultResourcesPlugin: NitroPluginDef = createResourcesPlugin();\n"]}

package/dist/terminal/terminal-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"terminal-plugin.d.ts","sourceRoot":"","sources":["../../src/terminal/terminal-plugin.ts"],"names":[],"mappings":"AA0DA,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yDAAyD;IACzD,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD;AASD,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,IACxD,UAAU,GAAG,mBAgL5B;AAED,mDAAmD;AACnD,eAAO,MAAM,qBAAqB,aAnLR,GAAG,kBAmL8B,CAAC"}
+{"version":3,"file":"terminal-plugin.d.ts","sourceRoot":"","sources":["../../src/terminal/terminal-plugin.ts"],"names":[],"mappings":"AA6DA,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yDAAyD;IACzD,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD;AASD,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,qBAA0B,IACxD,UAAU,GAAG,mBAiL5B;AAED,mDAAmD;AACnD,eAAO,MAAM,qBAAqB,aApLR,GAAG,kBAoL8B,CAAC"}

package/dist/terminal/terminal-plugin.js

@@ -1,4 +1,4 @@
-import { getH3App } from "../server/framework-request-handler.js";
+import { getH3App, markDefaultPluginProvided, } from "../server/framework-request-handler.js";
 import { isNodeRuntime } from "../shared/runtime.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -54,6 +54,7 @@ let _disabledLogged = false;
 let _frameDetectedLogged = false;
 export function createTerminalPlugin(options = {}) {
     return async (nitroApp) => {
+        markDefaultPluginProvided(nitroApp, "terminal");
         // Terminal requires Node.js (PTY, child_process) — skip on edge runtimes
         if (!isNodeRuntime())
             return;