@agent-native/core 0.77.7 → 0.77.10

package/dist/server/embed-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"embed-session.js","sourceRoot":"","sources":["../../src/server/embed-session.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,iBAAiB,GAClB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEnE,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAChD,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,CAAC;AAC1C,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,CAAC;AAC1C,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAC7D,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,qBAAqB,GAA2B;IACpD,GAAG,EAAE,GAAG;IACR,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,YAAY;IACvB,IAAI,EAAE,GAAG;IACT,GAAG,EAAE,MAAM;IACX,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,UAAU;IACnB,QAAQ,EAAE,WAAW;CACtB,CAAC;AACF,MAAM,mBAAmB,GAA6B;IACpD,2EAA2E;IAC3E,wEAAwE;IACxE,iCAAiC;IACjC,GAAG,EAAE,CAAC,WAAW,CAAC;IAClB,YAAY,EAAE,CAAC,2CAA2C,CAAC;IAC3D,aAAa,EAAE,CAAC,2CAA2C,CAAC;IAC5D,UAAU,EAAE,CAAC,2CAA2C,CAAC;IACzD,oBAAoB,EAAE,CAAC,2CAA2C,CAAC;CACpE,CAAC;AAEF,IAAI,YAAuC,CAAC;AAC5C,IAAI,cAAkC,CAAC;AAkDvC,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;;;;;;uBAOJ,OAAO,EAAE;uBACT,OAAO,EAAE;wBACR,OAAO,EAAE;;OAE1B,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,4IAA4I,CAC7I,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC;SACL,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,eAAe,CACpB,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QACjC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC,QAAQ,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAgC;IACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EACrB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAoB,EACpB,IAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAkB;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,eAAe,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,GAAG,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAChD,wBAAwB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAChD,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/D,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,OAAO,IAAI,WAAW,EAAE,CAAC;QACpC,wBAAwB,CACtB,OAAO,EACP,UAAU,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,UAAU,IAAI,UAAU,EAAE,CAAC;QACtC,wBAAwB,CACtB,OAAO,EACP,aAAa,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,YAAY,IAAI,WAAW,EAAE,CAAC;QACzC,wBAAwB,CACtB,OAAO,EACP,eAAe,kBAAkB,CAAC,WAAW,CAAC,EAAE,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,EAAE,CAAC;QACb,wBAAwB,CACtB,OAAO,EACP,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE;YAC5C,CAAC,CAAC,WAAW,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACvE,IAAI,UAAU,EAAE,CAAC;QACf,wBAAwB,CACtB,OAAO,EACP,SAAS,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,EAAE,CAAC;QACX,wBAAwB,CACtB,OAAO,EACP,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,UAAU;YAC/C,CAAC,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,IACE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACpD,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EACjD,CAAC;QACD,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IACE,IAAI,KAAK,UAAU;QACnB,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EACxD,CAAC;QACD,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC7B,wBAAwB,CACtB,OAAO,EACP,GAAG,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAkB;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,KAAK,MAAM,WAAW,IAAI,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,wBAAwB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,GAAG,eAAe,GAAI,KAAa,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,CACJ,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;QAC3B,KAAa,CAAC,GAAG,EAAE,GAA0B;QAC7C,KAAa,CAAC,OAAO,EAAE,GAA0B;QAClD,KAAa,CAAC,IAAI;QAClB,KAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;QAChC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC,QAAQ,CAAC;QACtE,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GACT,KAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC;QAC1D,KAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC;QACjD,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC;QACvD,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAClD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,MAAM,GACT,KAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;QAC7C,KAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;QACpC,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,GAAG,GACJ,KAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC;QAChD,KAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;QACjD,KAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC;QACvC,KAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;QACxC,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO;QACzC,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ;QAC3C,IAAI,CAAC;IACP,IAAI,CAAC;QACH,GAAG;YACD,GAAG;gBACH,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;gBAC3B,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;gBAC5B,IAAI,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,gBAAgB,CAAC,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,UAAkB;IAElB,MAAM,OAAO,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,CACL,CAAC,CAAC,QAAQ;QACV,CAAC,QAAQ,KAAK,MAAM;YAClB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YACzB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACrC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;YACjC,QAAQ,KAAK,gBAAgB;YAC7B,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,GAA8B,EAC9B,aAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;gBACxC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;YACrD,CAAC;YACD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YACxC,IACE,IAAI;gBACJ,MAAM,CAAC,QAAQ,KAAK,IAAI;gBACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAA8B;IAE9B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU;QACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAEhE,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,0BAA0B,CAAC;IAClE,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;IACvD,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EACD,yCAAyC;YACzC,8FAA8F;YAC9F,iCAAiC;QACnC,IAAI,EAAE;YACJ,UAAU;YACV,UAAU;YACV,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,UAAU;YACV,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,GAAG;YACH,SAAS;YACT,IAAI;SACL;KACF,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAiC,EACjC,OAAO,GAAqC,EAAE;IAE9C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EACD,uFAAuF;YACvF,uDAAuD;QACzD,IAAI,EAAE,CAAC,UAAU,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,aAAa,IAAI,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACvC,GAAG,EACD,wDAAwD;YACxD,+CAA+C;QACjD,IAAI,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,UAAU,GAAG,wBAAwB,CACzC,iBAAiB,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,CACrD,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,OAAO;QACL,UAAU;QACV,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,UAAU;QACV,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAMrC;IACC,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,IAAI,yBAAyB,CAAC,CAAC;IACvE,MAAM,MAAM,GAA4B;QACtC,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU;QACV,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,GAAG;KACf,CAAC;IACF,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,OAAO,GAAG,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAgC;IAEhC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IAED,IACE,CAAC,MAAM;QACP,MAAM,CAAC,IAAI,KAAK,UAAU;QAC1B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,CAAC,MAAM,CAAC,UAAU;QAClB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAC5B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,CAAC,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;IACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACtD,IAAI,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QACxE,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAK1C,OAAO,cAAc,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;QACvD,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,KAAa;IACjE,SAAS,CAAC,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE;QAC5C,QAAQ,EAAE,IAAI;QACd,GAAG,oBAAoB,CAAC,KAAK,CAAC;QAC9B,GAAG,iBAAiB,EAAE;QACtB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,CACL,IAAI,GAAG,CACL,mBAAmB,CAAC,KAAK,CAAC,EAC1B,6BAA6B,CAC9B,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,SAAS,CACzD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAc;IAEd,MAAM,UAAU,GAAG;QACjB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE;QAC7C,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC/C,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE;KACpE,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,SAAS;QAC3B,MAAM,aAAa,GAAG,yBAAyB,CAC7C,KAAK,EACL,QAAQ,CAAC,MAAM,CAAC,UAAU,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,sBAAsB,GAC1B,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,gBAAgB,CAAC;QACpD,MAAM,qBAAqB,GACzB,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,gBAAgB,CAAC;QACnD,IAAI,CAAC,aAAa,IAAI,CAAC,sBAAsB,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC9C,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,sDAAsD;YACxD,CAAC;QACH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;YACjC,KAAK,EAAE,SAAS,CAAC,KAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;YACtC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC1D,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC/B,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG;YACjB,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE;YACzC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE;YAClD,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE;SAC3C,CAAC;QACF,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1D,IACE,QAAQ,CAAC,EAAE;gBACX,CAAC,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC3D,CAAC,SAAS,CAAC,YAAY,IAAI,cAAc,CAAC,CAAC,EAC7C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,CACL,CAAC,CAAC,sBAAsB,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport type { H3Event } from \"h3\";\nimport {\n  getCookie,\n  getHeader,\n  getQuery,\n  setCookie,\n  setResponseHeader,\n} from \"h3\";\n\nimport { getDbExec, intType } from \"../db/client.js\";\nimport {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_SESSION_COOKIE,\n  EMBED_TARGET_HEADER,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\nimport { getConfiguredAppBasePath } from \"./app-base-path.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\n\nconst TOKEN_KIND = \"agent-native-embed-session\";\nconst DEFAULT_TOKEN_TTL_SECONDS = 60 * 60;\nconst DEFAULT_TICKET_TTL_SECONDS = 5 * 60;\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\nconst OPEN_ROUTE_PATH = \"/_agent-native/open\";\nconst OPEN_ROUTE_VIEW_PATHS: Record<string, string> = {\n  ask: \"/\",\n  calendar: \"/\",\n  capture: \"/search\",\n  knowledge: \"/knowledge\",\n  list: \"/\",\n  ops: \"/ops\",\n  proposals: \"/review\",\n  review: \"/review\",\n  search: \"/search\",\n  source: \"/sources\",\n  sources: \"/sources\",\n  settings: \"/settings\",\n};\nconst EMBED_ROUTE_ALIASES: Record<string, string[]> = {\n  // Dispatch's app root redirects to /overview. A ticket minted for the root\n  // should survive that first-hop redirect instead of falling back to the\n  // private deployment token gate.\n  \"/\": [\"/overview\"],\n  \"/dashboard\": [\"/adhoc/agent-native-templates-first-party\"],\n  \"/dashboards\": [\"/adhoc/agent-native-templates-first-party\"],\n  \"/traffic\": [\"/adhoc/agent-native-templates-first-party\"],\n  \"/traffic-dashboard\": [\"/adhoc/agent-native-templates-first-party\"],\n};\n\nlet _initPromise: Promise<void> | undefined;\nlet _devSigningKey: string | undefined;\n\nexport interface EmbedSessionTicketInput {\n  ownerEmail: string;\n  orgId?: string | null;\n  targetPath: string;\n  scope?: string | null;\n  ttlSeconds?: number;\n}\n\nexport interface EmbedSessionTicket {\n  ticket: string;\n  ticketHash: string;\n  expiresAt: number;\n}\n\nexport interface ConsumeEmbedSessionTicketOptions {\n  expectedOrgId?: string | null;\n}\n\nexport interface ConsumedEmbedSessionTicket {\n  ownerEmail: string;\n  orgId?: string;\n  targetPath: string;\n  scope?: string;\n  expiresAt: number;\n}\n\nexport interface EmbedSessionTokenClaims {\n  kind: typeof TOKEN_KIND;\n  ownerEmail: string;\n  orgId?: string;\n  targetPath: string;\n  scope?: string;\n  iat: number;\n  exp: number;\n}\n\nexport type VerifyEmbedSessionTokenResult =\n  | { ok: true; claims: EmbedSessionTokenClaims }\n  | { ok: false; reason: string };\n\nexport type ResolvedEmbedSession = {\n  email: string;\n  orgId?: string;\n  token: string;\n  targetPath: string;\n  scope?: string;\n};\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS agent_native_embed_tickets (\n          ticket_hash TEXT PRIMARY KEY,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          target_path TEXT NOT NULL,\n          scope TEXT,\n          created_at ${intType()} NOT NULL,\n          expires_at ${intType()} NOT NULL,\n          consumed_at ${intType()}\n        )\n      `);\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nfunction getSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET ||\n    process.env.BETTER_AUTH_SECRET ||\n    getWorkspaceA2ADerivedSecret(\"short-lived-token\");\n  if (secret) return secret;\n\n  if (process.env.NODE_ENV === \"production\") {\n    throw new Error(\n      \"Embed session signing requires a server secret. Set OAUTH_STATE_SECRET, BETTER_AUTH_SECRET, or A2A_SECRET in production workspace deploys.\",\n    );\n  }\n\n  if (!_devSigningKey) {\n    _devSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devSigningKey;\n}\n\nfunction base64UrlEncode(buf: Buffer | string): string {\n  const b = typeof buf === \"string\" ? Buffer.from(buf, \"utf8\") : buf;\n  return b\n    .toString(\"base64\")\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\");\n}\n\nfunction base64UrlDecode(input: string): Buffer {\n  const padded = input + \"=\".repeat((4 - (input.length % 4)) % 4);\n  return Buffer.from(padded.replace(/-/g, \"+\").replace(/_/g, \"/\"), \"base64\");\n}\n\nfunction signPayload(payload: string): string {\n  return base64UrlEncode(\n    crypto.createHmac(\"sha256\", getSigningKey()).update(payload).digest(),\n  );\n}\n\nfunction hashTicket(ticket: string): string {\n  return crypto.createHash(\"sha256\").update(ticket).digest(\"hex\");\n}\n\nfunction numberOrNull(value: unknown): number | null {\n  if (value == null) return null;\n  const n = Number(value);\n  return Number.isFinite(n) ? n : null;\n}\n\nfunction stringOrUndefined(value: unknown): string | undefined {\n  return typeof value === \"string\" && value ? value : undefined;\n}\n\nfunction stripConfiguredBasePath(pathname: string): string {\n  const base = getConfiguredAppBasePath();\n  if (!base) return pathname;\n  if (pathname === base) return \"/\";\n  if (pathname.startsWith(`${base}/`))\n    return pathname.slice(base.length) || \"/\";\n  return pathname;\n}\n\nfunction pathnameFromPath(path: string): string | null {\n  const normalized = normalizeEmbedTargetPath(path);\n  if (!normalized) return null;\n  try {\n    return new URL(normalized, \"http://agent-native.invalid\").pathname;\n  } catch {\n    return null;\n  }\n}\n\nfunction safePathSegment(value: string | null | undefined): string | null {\n  const segment = value?.trim();\n  if (!segment || CONTROL_CHARS.test(segment)) return null;\n  if (segment === \".\" || segment === \"..\") return null;\n  if (\n    segment.includes(\"/\") ||\n    segment.includes(\"\\\\\") ||\n    segment.includes(\"?\")\n  ) {\n    return null;\n  }\n  if (segment.includes(\"#\")) return null;\n  return segment;\n}\n\nfunction addResolvedOpenRoutePath(\n  targets: Set<string>,\n  path: string | null | undefined,\n): void {\n  if (!path) return;\n  const pathname = pathnameFromPath(path);\n  if (pathname) targets.add(pathname);\n}\n\nfunction openRouteTargetPathnames(targetPath: string): Set<string> {\n  const targets = new Set<string>();\n  let url: URL;\n  try {\n    url = new URL(targetPath, \"http://agent-native.invalid\");\n  } catch {\n    return targets;\n  }\n  if (stripConfiguredBasePath(url.pathname) !== OPEN_ROUTE_PATH) {\n    return targets;\n  }\n\n  const to = normalizeEmbedTargetPath(url.searchParams.get(\"to\"));\n  addResolvedOpenRoutePath(targets, to);\n\n  const view = url.searchParams.get(\"view\")?.trim();\n  if (!view || CONTROL_CHARS.test(view)) return targets;\n  const viewPath = view.startsWith(\"/\") ? view : `/${view}`;\n  const viewPathname = pathnameFromPath(viewPath);\n  addResolvedOpenRoutePath(targets, viewPathname);\n  addResolvedOpenRoutePath(targets, OPEN_ROUTE_VIEW_PATHS[view]);\n\n  const dashboardId = safePathSegment(url.searchParams.get(\"dashboardId\"));\n  if (view === \"adhoc\" && dashboardId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `/adhoc/${encodeURIComponent(dashboardId)}`,\n    );\n  }\n  const analysisId = safePathSegment(url.searchParams.get(\"analysisId\"));\n  if (view === \"analyses\" && analysisId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `/analyses/${encodeURIComponent(analysisId)}`,\n    );\n  }\n  const extensionId = safePathSegment(url.searchParams.get(\"extensionId\"));\n  if (view === \"extensions\" && extensionId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `/extensions/${encodeURIComponent(extensionId)}`,\n    );\n  }\n  const designId = safePathSegment(url.searchParams.get(\"designId\"));\n  if (designId) {\n    addResolvedOpenRoutePath(\n      targets,\n      view === \"present\"\n        ? `/present/${encodeURIComponent(designId)}`\n        : `/design/${encodeURIComponent(designId)}`,\n    );\n  }\n  const documentId = safePathSegment(url.searchParams.get(\"documentId\"));\n  if (documentId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `/page/${encodeURIComponent(documentId)}`,\n    );\n  }\n  const deckId = safePathSegment(url.searchParams.get(\"deckId\"));\n  if (deckId) {\n    addResolvedOpenRoutePath(\n      targets,\n      view === \"present\"\n        ? `/deck/${encodeURIComponent(deckId)}/present`\n        : `/deck/${encodeURIComponent(deckId)}`,\n    );\n  }\n  if (\n    safePathSegment(url.searchParams.get(\"captureId\")) ||\n    safePathSegment(url.searchParams.get(\"knowledgeId\")) ||\n    safePathSegment(url.searchParams.get(\"sourceId\"))\n  ) {\n    addResolvedOpenRoutePath(targets, OPEN_ROUTE_VIEW_PATHS[view]);\n  }\n  if (\n    view === \"calendar\" &&\n    (safePathSegment(url.searchParams.get(\"eventId\")) ||\n      safePathSegment(url.searchParams.get(\"eventDraftId\")))\n  ) {\n    addResolvedOpenRoutePath(targets, \"/\");\n  }\n  const threadId = safePathSegment(url.searchParams.get(\"threadId\"));\n  if (viewPathname && threadId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `${viewPathname}/${encodeURIComponent(threadId)}`,\n    );\n  }\n\n  return targets;\n}\n\nfunction allowedEmbedTargetPathnames(targetPath: string): Set<string> {\n  const allowed = new Set<string>();\n  const direct = pathnameFromPath(targetPath);\n  if (direct) {\n    allowed.add(direct);\n    for (const aliasTarget of EMBED_ROUTE_ALIASES[direct] ?? []) {\n      allowed.add(aliasTarget);\n    }\n  }\n  for (const openTarget of openRouteTargetPathnames(targetPath)) {\n    allowed.add(openTarget);\n  }\n  return allowed;\n}\n\nfunction requestUrlFromEvent(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return `${mountedPathname}${(event as any).url?.search ?? \"\"}`;\n  }\n  return (\n    (event as any).node?.req?.url ??\n    ((event as any).req?.url as string | undefined) ??\n    ((event as any).request?.url as string | undefined) ??\n    (event as any).path ??\n    (event as any).url?.toString?.() ??\n    \"/\"\n  );\n}\n\nfunction requestPathname(event: H3Event): string | null {\n  const raw = requestUrlFromEvent(event);\n  try {\n    const pathname = new URL(raw, \"http://agent-native.invalid\").pathname;\n    return stripConfiguredBasePath(pathname);\n  } catch {\n    return null;\n  }\n}\n\nfunction headerTargetPathname(event: H3Event): string | null {\n  const direct =\n    (event as any).request?.headers?.get?.(EMBED_TARGET_HEADER) ??\n    (event as any).headers?.get?.(EMBED_TARGET_HEADER) ??\n    (event as any).node?.req?.headers?.[EMBED_TARGET_HEADER] ??\n    (event as any).node?.req?.headers?.[EMBED_TARGET_HEADER.toLowerCase()];\n  if (typeof direct === \"string\") return pathnameFromPath(direct);\n  try {\n    const raw = getHeader(event, EMBED_TARGET_HEADER);\n    return typeof raw === \"string\" ? pathnameFromPath(raw) : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction requestHost(event: H3Event): string | null {\n  const direct =\n    (event as any).request?.headers?.get?.(\"host\") ??\n    (event as any).headers?.get?.(\"host\") ??\n    (event as any).node?.req?.headers?.host;\n  if (typeof direct === \"string\" && direct.trim()) return direct.trim();\n  try {\n    return getHeader(event, \"host\") ?? null;\n  } catch {\n    return null;\n  }\n}\n\nfunction referrerTargetPathname(event: H3Event): string | null {\n  let raw: string | null =\n    (event as any).request?.headers?.get?.(\"referer\") ??\n    (event as any).request?.headers?.get?.(\"referrer\") ??\n    (event as any).headers?.get?.(\"referer\") ??\n    (event as any).headers?.get?.(\"referrer\") ??\n    (event as any).node?.req?.headers?.referer ??\n    (event as any).node?.req?.headers?.referrer ??\n    null;\n  try {\n    raw =\n      raw ??\n      getHeader(event, \"referer\") ??\n      getHeader(event, \"referrer\") ??\n      null;\n  } catch {\n    raw = raw ?? null;\n  }\n  if (!raw) return null;\n  try {\n    const referrer = new URL(raw);\n    const host = requestHost(event);\n    if (host && referrer.host !== host) return null;\n    return pathnameFromPath(`${referrer.pathname}${referrer.search}`);\n  } catch {\n    return pathnameFromPath(raw);\n  }\n}\n\nexport function requestMatchesEmbedTarget(\n  event: H3Event,\n  targetPath: string,\n): boolean {\n  const allowed = allowedEmbedTargetPathnames(targetPath);\n  if (allowed.size === 0) return false;\n\n  const current = requestPathname(event);\n  if (current && allowed.has(current)) return true;\n\n  const headerTarget = headerTargetPathname(event);\n  if (headerTarget && allowed.has(headerTarget)) return true;\n\n  const referrerTarget = referrerTargetPathname(event);\n  return !!referrerTarget && allowed.has(referrerTarget);\n}\n\nfunction isEmbedRuntimeRequest(event: H3Event): boolean {\n  const pathname = requestPathname(event);\n  return (\n    !!pathname &&\n    (pathname === \"/api\" ||\n      pathname.startsWith(\"/api/\") ||\n      pathname.startsWith(\"/@\") ||\n      pathname.startsWith(\"/app/\") ||\n      pathname.startsWith(\"/node_modules/\") ||\n      pathname.startsWith(\"/packages/\") ||\n      pathname === \"/_agent-native\" ||\n      pathname.startsWith(\"/_agent-native/\"))\n  );\n}\n\nexport function normalizeEmbedTargetPath(\n  raw: string | undefined | null,\n  requestOrigin?: string,\n): string | null {\n  const value = String(raw ?? \"\").trim();\n  if (!value || CONTROL_CHARS.test(value)) return null;\n\n  let path = value;\n  try {\n    if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)) {\n      const parsed = new URL(value);\n      if (requestOrigin) {\n        const expected = new URL(requestOrigin);\n        if (parsed.origin !== expected.origin) return null;\n      }\n      const base = getConfiguredAppBasePath();\n      if (\n        base &&\n        parsed.pathname !== base &&\n        !parsed.pathname.startsWith(`${base}/`)\n      ) {\n        return null;\n      }\n      path = `${parsed.pathname}${parsed.search}${parsed.hash}`;\n    }\n  } catch {\n    return null;\n  }\n\n  if (!path.startsWith(\"/\")) path = `/${path}`;\n  if (path.startsWith(\"//\") || path.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(path)) return null;\n  return stripConfiguredBasePath(path);\n}\n\nexport async function createEmbedSessionTicket(\n  input: EmbedSessionTicketInput,\n): Promise<EmbedSessionTicket> {\n  const ownerEmail = input.ownerEmail.trim();\n  if (!ownerEmail) throw new Error(\"Embed session ticket requires ownerEmail.\");\n  const targetPath = normalizeEmbedTargetPath(input.targetPath);\n  if (!targetPath)\n    throw new Error(\"Embed session ticket requires a safe path.\");\n\n  await ensureTable();\n  const ticket = crypto.randomBytes(32).toString(\"base64url\");\n  const ticketHash = hashTicket(ticket);\n  const now = Date.now();\n  const ttlSeconds = input.ttlSeconds ?? DEFAULT_TICKET_TTL_SECONDS;\n  const expiresAt = now + Math.max(1, ttlSeconds) * 1000;\n  await getDbExec().execute({\n    sql:\n      \"INSERT INTO agent_native_embed_tickets \" +\n      \"(ticket_hash, owner_email, org_id, target_path, scope, created_at, expires_at, consumed_at) \" +\n      \"VALUES (?, ?, ?, ?, ?, ?, ?, ?)\",\n    args: [\n      ticketHash,\n      ownerEmail,\n      input.orgId ?? null,\n      targetPath,\n      input.scope ?? null,\n      now,\n      expiresAt,\n      null,\n    ],\n  });\n  return { ticket, ticketHash, expiresAt };\n}\n\nexport async function consumeEmbedSessionTicket(\n  ticket: string | undefined | null,\n  options: ConsumeEmbedSessionTicketOptions = {},\n): Promise<ConsumedEmbedSessionTicket | null> {\n  if (!ticket) return null;\n  await ensureTable();\n  const ticketHash = hashTicket(ticket);\n  const now = Date.now();\n  const { rows } = await getDbExec().execute({\n    sql:\n      \"SELECT ticket_hash, owner_email, org_id, target_path, scope, expires_at, consumed_at \" +\n      \"FROM agent_native_embed_tickets WHERE ticket_hash = ?\",\n    args: [ticketHash],\n  });\n  if (rows.length === 0) return null;\n  const row: any = rows[0];\n  const expiresAt = numberOrNull(row.expires_at ?? row.expiresAt);\n  const consumedAt = numberOrNull(row.consumed_at ?? row.consumedAt);\n  const orgId = stringOrUndefined(row.org_id ?? row.orgId);\n  if (consumedAt != null) return null;\n  if (expiresAt != null && expiresAt < now) return null;\n  if (options.expectedOrgId && orgId && orgId !== options.expectedOrgId) {\n    return null;\n  }\n\n  const result = await getDbExec().execute({\n    sql:\n      \"UPDATE agent_native_embed_tickets SET consumed_at = ? \" +\n      \"WHERE ticket_hash = ? AND consumed_at IS NULL\",\n    args: [now, ticketHash],\n  });\n  if (result.rowsAffected === 0) return null;\n\n  const targetPath = normalizeEmbedTargetPath(\n    stringOrUndefined(row.target_path ?? row.targetPath),\n  );\n  const ownerEmail = stringOrUndefined(row.owner_email ?? row.ownerEmail);\n  if (!targetPath || !ownerEmail || expiresAt == null) return null;\n\n  return {\n    ownerEmail,\n    ...(orgId ? { orgId } : {}),\n    targetPath,\n    ...(stringOrUndefined(row.scope)\n      ? { scope: stringOrUndefined(row.scope) }\n      : {}),\n    expiresAt,\n  };\n}\n\nexport function signEmbedSessionToken(input: {\n  ownerEmail: string;\n  orgId?: string | null;\n  targetPath: string;\n  scope?: string | null;\n  ttlSeconds?: number;\n}): string {\n  const targetPath = normalizeEmbedTargetPath(input.targetPath) ?? \"/\";\n  const now = Math.floor(Date.now() / 1000);\n  const ttl = Math.max(1, input.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS);\n  const claims: EmbedSessionTokenClaims = {\n    kind: TOKEN_KIND,\n    ownerEmail: input.ownerEmail,\n    targetPath,\n    iat: now,\n    exp: now + ttl,\n  };\n  if (input.orgId) claims.orgId = input.orgId;\n  if (input.scope) claims.scope = input.scope;\n  const payload = base64UrlEncode(JSON.stringify(claims));\n  return `${payload}.${signPayload(payload)}`;\n}\n\nexport function verifyEmbedSessionToken(\n  token: string | undefined | null,\n): VerifyEmbedSessionTokenResult {\n  if (!token || typeof token !== \"string\") {\n    return { ok: false, reason: \"missing\" };\n  }\n  const parts = token.split(\".\");\n  if (parts.length !== 2 || !parts[0] || !parts[1]) {\n    return { ok: false, reason: \"shape\" };\n  }\n  const [payload, signature] = parts;\n  const expected = signPayload(payload);\n  const sig = Buffer.from(signature);\n  const exp = Buffer.from(expected);\n  if (sig.length !== exp.length || !crypto.timingSafeEqual(sig, exp)) {\n    return { ok: false, reason: \"signature\" };\n  }\n\n  let claims: EmbedSessionTokenClaims;\n  try {\n    claims = JSON.parse(base64UrlDecode(payload).toString(\"utf8\"));\n  } catch {\n    return { ok: false, reason: \"payload\" };\n  }\n\n  if (\n    !claims ||\n    claims.kind !== TOKEN_KIND ||\n    typeof claims.ownerEmail !== \"string\" ||\n    !claims.ownerEmail ||\n    typeof claims.exp !== \"number\" ||\n    !Number.isFinite(claims.exp)\n  ) {\n    return { ok: false, reason: \"claims\" };\n  }\n  if (claims.exp < Math.floor(Date.now() / 1000)) {\n    return { ok: false, reason: \"expired\" };\n  }\n  claims.targetPath = normalizeEmbedTargetPath(claims.targetPath) ?? \"/\";\n  return { ok: true, claims };\n}\n\nfunction isHttpsRequest(event: H3Event): boolean {\n  try {\n    const xfProto = getHeader(event, \"x-forwarded-proto\");\n    if (xfProto && String(xfProto).split(\",\")[0].trim() === \"https\") {\n      return true;\n    }\n    const url = event.url?.toString?.() ?? \"\";\n    if (url.startsWith(\"https://\")) return true;\n    const appUrl = process.env.APP_URL || process.env.BETTER_AUTH_URL || \"\";\n    if (appUrl.startsWith(\"https://\")) return true;\n  } catch {\n    // ignore\n  }\n  return false;\n}\n\nfunction cookieDomainAttrs(): { domain?: string } {\n  const domain = process.env.COOKIE_DOMAIN?.trim();\n  return domain ? { domain } : {};\n}\n\nfunction crossSiteCookieAttrs(event: H3Event): {\n  sameSite: \"lax\" | \"none\";\n  secure: boolean;\n  partitioned?: boolean;\n} {\n  return isHttpsRequest(event)\n    ? { sameSite: \"none\", secure: true, partitioned: true }\n    : { sameSite: \"lax\", secure: false };\n}\n\nexport function setEmbedSessionCookie(event: H3Event, token: string): void {\n  setCookie(event, EMBED_SESSION_COOKIE, token, {\n    httpOnly: true,\n    ...crossSiteCookieAttrs(event),\n    ...cookieDomainAttrs(),\n    path: \"/\",\n    maxAge: DEFAULT_TOKEN_TTL_SECONDS,\n  });\n}\n\nfunction bearerToken(event: H3Event): string | undefined {\n  const auth = getHeader(event, \"authorization\");\n  if (!auth) return undefined;\n  const match = /^Bearer\\s+(.+)$/i.exec(String(auth).trim());\n  return match?.[1]?.trim();\n}\n\nfunction queryToken(event: H3Event): string | undefined {\n  const raw = getQuery(event)?.[EMBED_TOKEN_QUERY_PARAM];\n  const value = Array.isArray(raw) ? raw[0] : raw;\n  if (value) return value;\n  try {\n    return (\n      new URL(\n        requestUrlFromEvent(event),\n        \"http://agent-native.invalid\",\n      ).searchParams.get(EMBED_TOKEN_QUERY_PARAM) ?? undefined\n    );\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function resolveEmbedSessionFromRequest(\n  event: H3Event,\n): Promise<ResolvedEmbedSession | null> {\n  const candidates = [\n    { token: queryToken(event), source: \"query\" },\n    { token: bearerToken(event), source: \"bearer\" },\n    { token: getCookie(event, EMBED_SESSION_COOKIE), source: \"cookie\" },\n  ];\n  for (const candidate of candidates) {\n    const verified = verifyEmbedSessionToken(candidate.token);\n    if (!verified.ok) continue;\n    const matchesTarget = requestMatchesEmbedTarget(\n      event,\n      verified.claims.targetPath,\n    );\n    const isRuntimeRequest = isEmbedRuntimeRequest(event);\n    const isRuntimeCookieRequest =\n      candidate.source === \"cookie\" && isRuntimeRequest;\n    const isRuntimeQueryRequest =\n      candidate.source === \"query\" && isRuntimeRequest;\n    if (!matchesTarget && !isRuntimeCookieRequest && !isRuntimeQueryRequest) {\n      continue;\n    }\n    if (candidate.source === \"query\" && candidate.token) {\n      try {\n        setEmbedSessionCookie(event, candidate.token);\n        setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n      } catch {\n        // Some tests and edge runtimes expose read-only request shims. The\n        // query token itself is still valid for this request.\n      }\n    }\n    return {\n      email: verified.claims.ownerEmail,\n      token: candidate.token!,\n      targetPath: verified.claims.targetPath,\n      ...(verified.claims.orgId ? { orgId: verified.claims.orgId } : {}),\n      ...(verified.claims.scope ? { scope: verified.claims.scope } : {}),\n    };\n  }\n  return null;\n}\n\nexport function requestHasEmbedAuthMarker(event: H3Event): boolean {\n  try {\n    const q = getQuery(event) ?? {};\n    const queryToken = Array.isArray(q[EMBED_TOKEN_QUERY_PARAM])\n      ? q[EMBED_TOKEN_QUERY_PARAM][0]\n      : q[EMBED_TOKEN_QUERY_PARAM];\n    const cookieToken = getCookie(event, EMBED_SESSION_COOKIE);\n    const candidates = [\n      { token: queryToken, allowRuntime: true },\n      { token: bearerToken(event), allowRuntime: false },\n      { token: cookieToken, allowRuntime: true },\n    ];\n    const runtimeRequest = isEmbedRuntimeRequest(event);\n    for (const candidate of candidates) {\n      const verified = verifyEmbedSessionToken(candidate.token);\n      if (\n        verified.ok &&\n        (requestMatchesEmbedTarget(event, verified.claims.targetPath) ||\n          (candidate.allowRuntime && runtimeRequest))\n      ) {\n        return true;\n      }\n    }\n  } catch {\n    // ignore\n  }\n  return false;\n}\n\nexport function isEmbedModeRequest(event: H3Event): boolean {\n  try {\n    const q = getQuery(event) ?? {};\n    return (\n      q[EMBED_MODE_QUERY_PARAM] === \"1\" || q[EMBED_MODE_QUERY_PARAM] === \"true\"\n    );\n  } catch {\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"embed-session.js","sourceRoot":"","sources":["../../src/server/embed-session.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EACL,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,iBAAiB,GAClB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEnE,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAChD,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,CAAC;AAC1C,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,CAAC;AAC1C,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAC7D,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAC9C,MAAM,qBAAqB,GAA2B;IACpD,GAAG,EAAE,GAAG;IACR,QAAQ,EAAE,GAAG;IACb,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,YAAY;IACvB,IAAI,EAAE,GAAG;IACT,GAAG,EAAE,MAAM;IACX,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,UAAU;IACnB,QAAQ,EAAE,WAAW;CACtB,CAAC;AACF,MAAM,mBAAmB,GAA6B;IACpD,2EAA2E;IAC3E,wEAAwE;IACxE,iCAAiC;IACjC,GAAG,EAAE,CAAC,WAAW,CAAC;IAClB,YAAY,EAAE,CAAC,2CAA2C,CAAC;IAC3D,aAAa,EAAE,CAAC,2CAA2C,CAAC;IAC5D,UAAU,EAAE,CAAC,2CAA2C,CAAC;IACzD,oBAAoB,EAAE,CAAC,2CAA2C,CAAC;CACpE,CAAC;AAEF,IAAI,YAAuC,CAAC;AAC5C,IAAI,cAAkC,CAAC;AAkDvC,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,uEAAuE;YACvE,2EAA2E;YAC3E,6DAA6D;YAC7D,MAAM,qBAAqB,GAAG;;;;;;;uBAOb,OAAO,EAAE;uBACT,OAAO,EAAE;wBACR,OAAO,EAAE;;OAE1B,CAAC;YACF,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,gFAAgF;gBAChF,MAAM,iBAAiB,CACrB,4BAA4B,EAC5B,qBAAqB,CACtB,CAAC;gBACF,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,OAAO,CAAC,GAAG,CAAC,kBAAkB;QAC9B,4BAA4B,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,4IAA4I,CAC7I,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB;IAC3C,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnE,OAAO,CAAC;SACL,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,eAAe,CACpB,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAClC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;QACjC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC,QAAQ,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAgC;IACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,OAAO,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EACrB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,wBAAwB,CAC/B,OAAoB,EACpB,IAA+B;IAE/B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAkB;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,6BAA6B,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,eAAe,EAAE,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,EAAE,GAAG,wBAAwB,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,wBAAwB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAC1D,MAAM,YAAY,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAChD,wBAAwB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAChD,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/D,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,OAAO,IAAI,WAAW,EAAE,CAAC;QACpC,wBAAwB,CACtB,OAAO,EACP,UAAU,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAC5C,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACvE,IAAI,IAAI,KAAK,UAAU,IAAI,UAAU,EAAE,CAAC;QACtC,wBAAwB,CACtB,OAAO,EACP,aAAa,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,KAAK,YAAY,IAAI,WAAW,EAAE,CAAC;QACzC,wBAAwB,CACtB,OAAO,EACP,eAAe,kBAAkB,CAAC,WAAW,CAAC,EAAE,CACjD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,IAAI,QAAQ,EAAE,CAAC;QACb,wBAAwB,CACtB,OAAO,EACP,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,YAAY,kBAAkB,CAAC,QAAQ,CAAC,EAAE;YAC5C,CAAC,CAAC,WAAW,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IACvE,IAAI,UAAU,EAAE,CAAC;QACf,wBAAwB,CACtB,OAAO,EACP,SAAS,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,EAAE,CAAC;QACX,wBAAwB,CACtB,OAAO,EACP,IAAI,KAAK,SAAS;YAChB,CAAC,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,UAAU;YAC/C,CAAC,CAAC,SAAS,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,IACE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClD,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACpD,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EACjD,CAAC;QACD,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IACE,IAAI,KAAK,UAAU;QACnB,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EACxD,CAAC;QACD,wBAAwB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACnE,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC7B,wBAAwB,CACtB,OAAO,EACP,GAAG,YAAY,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,2BAA2B,CAAC,UAAkB;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,KAAK,MAAM,WAAW,IAAI,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,wBAAwB,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,eAAe,GAAI,KAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACjE,IAAI,OAAO,eAAe,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC3D,OAAO,GAAG,eAAe,GAAI,KAAa,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,CACJ,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG;QAC3B,KAAa,CAAC,GAAG,EAAE,GAA0B;QAC7C,KAAa,CAAC,OAAO,EAAE,GAA0B;QAClD,KAAa,CAAC,IAAI;QAClB,KAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE;QAChC,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC,QAAQ,CAAC;QACtE,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,MAAM,GACT,KAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC;QAC1D,KAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC;QACjD,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC;QACvD,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QAClD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,MAAM,GACT,KAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;QAC7C,KAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;QACpC,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc;IAC5C,IAAI,GAAG,GACJ,KAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC;QAChD,KAAa,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;QACjD,KAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC;QACvC,KAAa,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC;QACxC,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO;QACzC,KAAa,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ;QAC3C,IAAI,CAAC;IACP,IAAI,CAAC;QACH,GAAG;YACD,GAAG;gBACH,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;gBAC3B,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;gBAC5B,IAAI,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,gBAAgB,CAAC,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAc,EACd,UAAkB;IAElB,MAAM,OAAO,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEjD,MAAM,YAAY,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3D,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,CAAC,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO,CACL,CAAC,CAAC,QAAQ;QACV,CAAC,QAAQ,KAAK,MAAM;YAClB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YACzB,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;YAC5B,QAAQ,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACrC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;YACjC,QAAQ,KAAK,gBAAgB;YAC7B,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,GAA8B,EAC9B,aAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;gBACxC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;YACrD,CAAC;YACD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;YACxC,IACE,IAAI;gBACJ,MAAM,CAAC,QAAQ,KAAK,IAAI;gBACxB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAA8B;IAE9B,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU;QACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAEhE,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,0BAA0B,CAAC;IAClE,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,IAAI,CAAC;IACvD,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACxB,GAAG,EACD,yCAAyC;YACzC,8FAA8F;YAC9F,iCAAiC;QACnC,IAAI,EAAE;YACJ,UAAU;YACV,UAAU;YACV,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,UAAU;YACV,KAAK,CAAC,KAAK,IAAI,IAAI;YACnB,GAAG;YACH,SAAS;YACT,IAAI;SACL;KACF,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAiC,EACjC,OAAO,GAAqC,EAAE;IAE9C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EACD,uFAAuF;YACvF,uDAAuD;QACzD,IAAI,EAAE,CAAC,UAAU,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,GAAG,GAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,OAAO,CAAC,aAAa,IAAI,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACvC,GAAG,EACD,wDAAwD;YACxD,+CAA+C;QACjD,IAAI,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3C,MAAM,UAAU,GAAG,wBAAwB,CACzC,iBAAiB,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,CACrD,CAAC;IACF,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACxE,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,IAAI,SAAS,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEjE,OAAO;QACL,UAAU;QACV,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,UAAU;QACV,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;YAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YACzC,CAAC,CAAC,EAAE,CAAC;QACP,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAMrC;IACC,MAAM,UAAU,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,IAAI,yBAAyB,CAAC,CAAC;IACvE,MAAM,MAAM,GAA4B;QACtC,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU;QACV,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,GAAG;KACf,CAAC;IACF,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC5C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,OAAO,GAAG,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAgC;IAEhC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACxC,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IAED,IACE,CAAC,MAAM;QACP,MAAM,CAAC,IAAI,KAAK,UAAU;QAC1B,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QACrC,CAAC,MAAM,CAAC,UAAU;QAClB,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAC5B,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,CAAC,UAAU,GAAG,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;IACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;QACtD,IAAI,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1C,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;QACxE,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAK1C,OAAO,cAAc,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;QACvD,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,KAAa;IACjE,SAAS,CAAC,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE;QAC5C,QAAQ,EAAE,IAAI;QACd,GAAG,oBAAoB,CAAC,KAAK,CAAC;QAC9B,GAAG,iBAAiB,EAAE;QACtB,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,yBAAyB;KAClC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,CACL,IAAI,GAAG,CACL,mBAAmB,CAAC,KAAK,CAAC,EAC1B,6BAA6B,CAC9B,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,SAAS,CACzD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,KAAc;IAEd,MAAM,UAAU,GAAG;QACjB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE;QAC7C,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC/C,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE;KACpE,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,SAAS;QAC3B,MAAM,aAAa,GAAG,yBAAyB,CAC7C,KAAK,EACL,QAAQ,CAAC,MAAM,CAAC,UAAU,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,sBAAsB,GAC1B,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,gBAAgB,CAAC;QACpD,MAAM,qBAAqB,GACzB,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,gBAAgB,CAAC;QACnD,IAAI,CAAC,aAAa,IAAI,CAAC,sBAAsB,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACxE,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC9C,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;gBACnE,sDAAsD;YACxD,CAAC;QACH,CAAC;QACD,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;YACjC,KAAK,EAAE,SAAS,CAAC,KAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU;YACtC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;YAC1D,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC/B,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG;YACjB,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE;YACzC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE;YAClD,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE;SAC3C,CAAC;QACF,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1D,IACE,QAAQ,CAAC,EAAE;gBACX,CAAC,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC3D,CAAC,SAAS,CAAC,YAAY,IAAI,cAAc,CAAC,CAAC,EAC7C,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,CACL,CAAC,CAAC,sBAAsB,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,sBAAsB,CAAC,KAAK,MAAM,CAC1E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport type { H3Event } from \"h3\";\nimport {\n  getCookie,\n  getHeader,\n  getQuery,\n  setCookie,\n  setResponseHeader,\n} from \"h3\";\n\nimport { getDbExec, intType, isPostgres } from \"../db/client.js\";\nimport { ensureTableExists } from \"../db/ddl-guard.js\";\nimport {\n  EMBED_MODE_QUERY_PARAM,\n  EMBED_SESSION_COOKIE,\n  EMBED_TARGET_HEADER,\n  EMBED_TOKEN_QUERY_PARAM,\n} from \"../shared/embed-auth.js\";\nimport { getConfiguredAppBasePath } from \"./app-base-path.js\";\nimport { getWorkspaceA2ADerivedSecret } from \"./derived-secret.js\";\n\nconst TOKEN_KIND = \"agent-native-embed-session\";\nconst DEFAULT_TOKEN_TTL_SECONDS = 60 * 60;\nconst DEFAULT_TICKET_TTL_SECONDS = 5 * 60;\nconst CONTROL_CHARS = new RegExp(\"[\\\\u0000-\\\\u001f\\\\u007f]\");\nconst OPEN_ROUTE_PATH = \"/_agent-native/open\";\nconst OPEN_ROUTE_VIEW_PATHS: Record<string, string> = {\n  ask: \"/\",\n  calendar: \"/\",\n  capture: \"/search\",\n  knowledge: \"/knowledge\",\n  list: \"/\",\n  ops: \"/ops\",\n  proposals: \"/review\",\n  review: \"/review\",\n  search: \"/search\",\n  source: \"/sources\",\n  sources: \"/sources\",\n  settings: \"/settings\",\n};\nconst EMBED_ROUTE_ALIASES: Record<string, string[]> = {\n  // Dispatch's app root redirects to /overview. A ticket minted for the root\n  // should survive that first-hop redirect instead of falling back to the\n  // private deployment token gate.\n  \"/\": [\"/overview\"],\n  \"/dashboard\": [\"/adhoc/agent-native-templates-first-party\"],\n  \"/dashboards\": [\"/adhoc/agent-native-templates-first-party\"],\n  \"/traffic\": [\"/adhoc/agent-native-templates-first-party\"],\n  \"/traffic-dashboard\": [\"/adhoc/agent-native-templates-first-party\"],\n};\n\nlet _initPromise: Promise<void> | undefined;\nlet _devSigningKey: string | undefined;\n\nexport interface EmbedSessionTicketInput {\n  ownerEmail: string;\n  orgId?: string | null;\n  targetPath: string;\n  scope?: string | null;\n  ttlSeconds?: number;\n}\n\nexport interface EmbedSessionTicket {\n  ticket: string;\n  ticketHash: string;\n  expiresAt: number;\n}\n\nexport interface ConsumeEmbedSessionTicketOptions {\n  expectedOrgId?: string | null;\n}\n\nexport interface ConsumedEmbedSessionTicket {\n  ownerEmail: string;\n  orgId?: string;\n  targetPath: string;\n  scope?: string;\n  expiresAt: number;\n}\n\nexport interface EmbedSessionTokenClaims {\n  kind: typeof TOKEN_KIND;\n  ownerEmail: string;\n  orgId?: string;\n  targetPath: string;\n  scope?: string;\n  iat: number;\n  exp: number;\n}\n\nexport type VerifyEmbedSessionTokenResult =\n  | { ok: true; claims: EmbedSessionTokenClaims }\n  | { ok: false; reason: string };\n\nexport type ResolvedEmbedSession = {\n  email: string;\n  orgId?: string;\n  token: string;\n  targetPath: string;\n  scope?: string;\n};\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      // Build the CREATE SQL here (not at module scope) so intType() runs at\n      // RUNTIME, not import time — a module-scope call breaks any consumer whose\n      // db/client mock doesn't stub intType (e.g. db-admin specs).\n      const embedTicketsCreateSql = `\n        CREATE TABLE IF NOT EXISTS agent_native_embed_tickets (\n          ticket_hash TEXT PRIMARY KEY,\n          owner_email TEXT NOT NULL,\n          org_id TEXT,\n          target_path TEXT NOT NULL,\n          scope TEXT,\n          created_at ${intType()} NOT NULL,\n          expires_at ${intType()} NOT NULL,\n          consumed_at ${intType()}\n        )\n      `;\n      if (isPostgres()) {\n        // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path\n        await ensureTableExists(\n          \"agent_native_embed_tickets\",\n          embedTicketsCreateSql,\n        );\n        return;\n      }\n\n      // SQLite (local dev): no lock problem — keep the original behaviour.\n      const client = getDbExec();\n      await client.execute(embedTicketsCreateSql);\n    })().catch((err) => {\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nfunction getSigningKey(): string {\n  const secret =\n    process.env.OAUTH_STATE_SECRET ||\n    process.env.BETTER_AUTH_SECRET ||\n    getWorkspaceA2ADerivedSecret(\"short-lived-token\");\n  if (secret) return secret;\n\n  if (process.env.NODE_ENV === \"production\") {\n    throw new Error(\n      \"Embed session signing requires a server secret. Set OAUTH_STATE_SECRET, BETTER_AUTH_SECRET, or A2A_SECRET in production workspace deploys.\",\n    );\n  }\n\n  if (!_devSigningKey) {\n    _devSigningKey = crypto.randomBytes(32).toString(\"hex\");\n  }\n  return _devSigningKey;\n}\n\nfunction base64UrlEncode(buf: Buffer | string): string {\n  const b = typeof buf === \"string\" ? Buffer.from(buf, \"utf8\") : buf;\n  return b\n    .toString(\"base64\")\n    .replace(/\\+/g, \"-\")\n    .replace(/\\//g, \"_\")\n    .replace(/=+$/g, \"\");\n}\n\nfunction base64UrlDecode(input: string): Buffer {\n  const padded = input + \"=\".repeat((4 - (input.length % 4)) % 4);\n  return Buffer.from(padded.replace(/-/g, \"+\").replace(/_/g, \"/\"), \"base64\");\n}\n\nfunction signPayload(payload: string): string {\n  return base64UrlEncode(\n    crypto.createHmac(\"sha256\", getSigningKey()).update(payload).digest(),\n  );\n}\n\nfunction hashTicket(ticket: string): string {\n  return crypto.createHash(\"sha256\").update(ticket).digest(\"hex\");\n}\n\nfunction numberOrNull(value: unknown): number | null {\n  if (value == null) return null;\n  const n = Number(value);\n  return Number.isFinite(n) ? n : null;\n}\n\nfunction stringOrUndefined(value: unknown): string | undefined {\n  return typeof value === \"string\" && value ? value : undefined;\n}\n\nfunction stripConfiguredBasePath(pathname: string): string {\n  const base = getConfiguredAppBasePath();\n  if (!base) return pathname;\n  if (pathname === base) return \"/\";\n  if (pathname.startsWith(`${base}/`))\n    return pathname.slice(base.length) || \"/\";\n  return pathname;\n}\n\nfunction pathnameFromPath(path: string): string | null {\n  const normalized = normalizeEmbedTargetPath(path);\n  if (!normalized) return null;\n  try {\n    return new URL(normalized, \"http://agent-native.invalid\").pathname;\n  } catch {\n    return null;\n  }\n}\n\nfunction safePathSegment(value: string | null | undefined): string | null {\n  const segment = value?.trim();\n  if (!segment || CONTROL_CHARS.test(segment)) return null;\n  if (segment === \".\" || segment === \"..\") return null;\n  if (\n    segment.includes(\"/\") ||\n    segment.includes(\"\\\\\") ||\n    segment.includes(\"?\")\n  ) {\n    return null;\n  }\n  if (segment.includes(\"#\")) return null;\n  return segment;\n}\n\nfunction addResolvedOpenRoutePath(\n  targets: Set<string>,\n  path: string | null | undefined,\n): void {\n  if (!path) return;\n  const pathname = pathnameFromPath(path);\n  if (pathname) targets.add(pathname);\n}\n\nfunction openRouteTargetPathnames(targetPath: string): Set<string> {\n  const targets = new Set<string>();\n  let url: URL;\n  try {\n    url = new URL(targetPath, \"http://agent-native.invalid\");\n  } catch {\n    return targets;\n  }\n  if (stripConfiguredBasePath(url.pathname) !== OPEN_ROUTE_PATH) {\n    return targets;\n  }\n\n  const to = normalizeEmbedTargetPath(url.searchParams.get(\"to\"));\n  addResolvedOpenRoutePath(targets, to);\n\n  const view = url.searchParams.get(\"view\")?.trim();\n  if (!view || CONTROL_CHARS.test(view)) return targets;\n  const viewPath = view.startsWith(\"/\") ? view : `/${view}`;\n  const viewPathname = pathnameFromPath(viewPath);\n  addResolvedOpenRoutePath(targets, viewPathname);\n  addResolvedOpenRoutePath(targets, OPEN_ROUTE_VIEW_PATHS[view]);\n\n  const dashboardId = safePathSegment(url.searchParams.get(\"dashboardId\"));\n  if (view === \"adhoc\" && dashboardId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `/adhoc/${encodeURIComponent(dashboardId)}`,\n    );\n  }\n  const analysisId = safePathSegment(url.searchParams.get(\"analysisId\"));\n  if (view === \"analyses\" && analysisId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `/analyses/${encodeURIComponent(analysisId)}`,\n    );\n  }\n  const extensionId = safePathSegment(url.searchParams.get(\"extensionId\"));\n  if (view === \"extensions\" && extensionId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `/extensions/${encodeURIComponent(extensionId)}`,\n    );\n  }\n  const designId = safePathSegment(url.searchParams.get(\"designId\"));\n  if (designId) {\n    addResolvedOpenRoutePath(\n      targets,\n      view === \"present\"\n        ? `/present/${encodeURIComponent(designId)}`\n        : `/design/${encodeURIComponent(designId)}`,\n    );\n  }\n  const documentId = safePathSegment(url.searchParams.get(\"documentId\"));\n  if (documentId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `/page/${encodeURIComponent(documentId)}`,\n    );\n  }\n  const deckId = safePathSegment(url.searchParams.get(\"deckId\"));\n  if (deckId) {\n    addResolvedOpenRoutePath(\n      targets,\n      view === \"present\"\n        ? `/deck/${encodeURIComponent(deckId)}/present`\n        : `/deck/${encodeURIComponent(deckId)}`,\n    );\n  }\n  if (\n    safePathSegment(url.searchParams.get(\"captureId\")) ||\n    safePathSegment(url.searchParams.get(\"knowledgeId\")) ||\n    safePathSegment(url.searchParams.get(\"sourceId\"))\n  ) {\n    addResolvedOpenRoutePath(targets, OPEN_ROUTE_VIEW_PATHS[view]);\n  }\n  if (\n    view === \"calendar\" &&\n    (safePathSegment(url.searchParams.get(\"eventId\")) ||\n      safePathSegment(url.searchParams.get(\"eventDraftId\")))\n  ) {\n    addResolvedOpenRoutePath(targets, \"/\");\n  }\n  const threadId = safePathSegment(url.searchParams.get(\"threadId\"));\n  if (viewPathname && threadId) {\n    addResolvedOpenRoutePath(\n      targets,\n      `${viewPathname}/${encodeURIComponent(threadId)}`,\n    );\n  }\n\n  return targets;\n}\n\nfunction allowedEmbedTargetPathnames(targetPath: string): Set<string> {\n  const allowed = new Set<string>();\n  const direct = pathnameFromPath(targetPath);\n  if (direct) {\n    allowed.add(direct);\n    for (const aliasTarget of EMBED_ROUTE_ALIASES[direct] ?? []) {\n      allowed.add(aliasTarget);\n    }\n  }\n  for (const openTarget of openRouteTargetPathnames(targetPath)) {\n    allowed.add(openTarget);\n  }\n  return allowed;\n}\n\nfunction requestUrlFromEvent(event: H3Event): string {\n  const mountedPathname = (event as any).context?._mountedPathname;\n  if (typeof mountedPathname === \"string\" && mountedPathname) {\n    return `${mountedPathname}${(event as any).url?.search ?? \"\"}`;\n  }\n  return (\n    (event as any).node?.req?.url ??\n    ((event as any).req?.url as string | undefined) ??\n    ((event as any).request?.url as string | undefined) ??\n    (event as any).path ??\n    (event as any).url?.toString?.() ??\n    \"/\"\n  );\n}\n\nfunction requestPathname(event: H3Event): string | null {\n  const raw = requestUrlFromEvent(event);\n  try {\n    const pathname = new URL(raw, \"http://agent-native.invalid\").pathname;\n    return stripConfiguredBasePath(pathname);\n  } catch {\n    return null;\n  }\n}\n\nfunction headerTargetPathname(event: H3Event): string | null {\n  const direct =\n    (event as any).request?.headers?.get?.(EMBED_TARGET_HEADER) ??\n    (event as any).headers?.get?.(EMBED_TARGET_HEADER) ??\n    (event as any).node?.req?.headers?.[EMBED_TARGET_HEADER] ??\n    (event as any).node?.req?.headers?.[EMBED_TARGET_HEADER.toLowerCase()];\n  if (typeof direct === \"string\") return pathnameFromPath(direct);\n  try {\n    const raw = getHeader(event, EMBED_TARGET_HEADER);\n    return typeof raw === \"string\" ? pathnameFromPath(raw) : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction requestHost(event: H3Event): string | null {\n  const direct =\n    (event as any).request?.headers?.get?.(\"host\") ??\n    (event as any).headers?.get?.(\"host\") ??\n    (event as any).node?.req?.headers?.host;\n  if (typeof direct === \"string\" && direct.trim()) return direct.trim();\n  try {\n    return getHeader(event, \"host\") ?? null;\n  } catch {\n    return null;\n  }\n}\n\nfunction referrerTargetPathname(event: H3Event): string | null {\n  let raw: string | null =\n    (event as any).request?.headers?.get?.(\"referer\") ??\n    (event as any).request?.headers?.get?.(\"referrer\") ??\n    (event as any).headers?.get?.(\"referer\") ??\n    (event as any).headers?.get?.(\"referrer\") ??\n    (event as any).node?.req?.headers?.referer ??\n    (event as any).node?.req?.headers?.referrer ??\n    null;\n  try {\n    raw =\n      raw ??\n      getHeader(event, \"referer\") ??\n      getHeader(event, \"referrer\") ??\n      null;\n  } catch {\n    raw = raw ?? null;\n  }\n  if (!raw) return null;\n  try {\n    const referrer = new URL(raw);\n    const host = requestHost(event);\n    if (host && referrer.host !== host) return null;\n    return pathnameFromPath(`${referrer.pathname}${referrer.search}`);\n  } catch {\n    return pathnameFromPath(raw);\n  }\n}\n\nexport function requestMatchesEmbedTarget(\n  event: H3Event,\n  targetPath: string,\n): boolean {\n  const allowed = allowedEmbedTargetPathnames(targetPath);\n  if (allowed.size === 0) return false;\n\n  const current = requestPathname(event);\n  if (current && allowed.has(current)) return true;\n\n  const headerTarget = headerTargetPathname(event);\n  if (headerTarget && allowed.has(headerTarget)) return true;\n\n  const referrerTarget = referrerTargetPathname(event);\n  return !!referrerTarget && allowed.has(referrerTarget);\n}\n\nfunction isEmbedRuntimeRequest(event: H3Event): boolean {\n  const pathname = requestPathname(event);\n  return (\n    !!pathname &&\n    (pathname === \"/api\" ||\n      pathname.startsWith(\"/api/\") ||\n      pathname.startsWith(\"/@\") ||\n      pathname.startsWith(\"/app/\") ||\n      pathname.startsWith(\"/node_modules/\") ||\n      pathname.startsWith(\"/packages/\") ||\n      pathname === \"/_agent-native\" ||\n      pathname.startsWith(\"/_agent-native/\"))\n  );\n}\n\nexport function normalizeEmbedTargetPath(\n  raw: string | undefined | null,\n  requestOrigin?: string,\n): string | null {\n  const value = String(raw ?? \"\").trim();\n  if (!value || CONTROL_CHARS.test(value)) return null;\n\n  let path = value;\n  try {\n    if (/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)) {\n      const parsed = new URL(value);\n      if (requestOrigin) {\n        const expected = new URL(requestOrigin);\n        if (parsed.origin !== expected.origin) return null;\n      }\n      const base = getConfiguredAppBasePath();\n      if (\n        base &&\n        parsed.pathname !== base &&\n        !parsed.pathname.startsWith(`${base}/`)\n      ) {\n        return null;\n      }\n      path = `${parsed.pathname}${parsed.search}${parsed.hash}`;\n    }\n  } catch {\n    return null;\n  }\n\n  if (!path.startsWith(\"/\")) path = `/${path}`;\n  if (path.startsWith(\"//\") || path.startsWith(\"/\\\\\")) return null;\n  if (/^\\/[a-z][a-z0-9+.-]*:/i.test(path)) return null;\n  return stripConfiguredBasePath(path);\n}\n\nexport async function createEmbedSessionTicket(\n  input: EmbedSessionTicketInput,\n): Promise<EmbedSessionTicket> {\n  const ownerEmail = input.ownerEmail.trim();\n  if (!ownerEmail) throw new Error(\"Embed session ticket requires ownerEmail.\");\n  const targetPath = normalizeEmbedTargetPath(input.targetPath);\n  if (!targetPath)\n    throw new Error(\"Embed session ticket requires a safe path.\");\n\n  await ensureTable();\n  const ticket = crypto.randomBytes(32).toString(\"base64url\");\n  const ticketHash = hashTicket(ticket);\n  const now = Date.now();\n  const ttlSeconds = input.ttlSeconds ?? DEFAULT_TICKET_TTL_SECONDS;\n  const expiresAt = now + Math.max(1, ttlSeconds) * 1000;\n  await getDbExec().execute({\n    sql:\n      \"INSERT INTO agent_native_embed_tickets \" +\n      \"(ticket_hash, owner_email, org_id, target_path, scope, created_at, expires_at, consumed_at) \" +\n      \"VALUES (?, ?, ?, ?, ?, ?, ?, ?)\",\n    args: [\n      ticketHash,\n      ownerEmail,\n      input.orgId ?? null,\n      targetPath,\n      input.scope ?? null,\n      now,\n      expiresAt,\n      null,\n    ],\n  });\n  return { ticket, ticketHash, expiresAt };\n}\n\nexport async function consumeEmbedSessionTicket(\n  ticket: string | undefined | null,\n  options: ConsumeEmbedSessionTicketOptions = {},\n): Promise<ConsumedEmbedSessionTicket | null> {\n  if (!ticket) return null;\n  await ensureTable();\n  const ticketHash = hashTicket(ticket);\n  const now = Date.now();\n  const { rows } = await getDbExec().execute({\n    sql:\n      \"SELECT ticket_hash, owner_email, org_id, target_path, scope, expires_at, consumed_at \" +\n      \"FROM agent_native_embed_tickets WHERE ticket_hash = ?\",\n    args: [ticketHash],\n  });\n  if (rows.length === 0) return null;\n  const row: any = rows[0];\n  const expiresAt = numberOrNull(row.expires_at ?? row.expiresAt);\n  const consumedAt = numberOrNull(row.consumed_at ?? row.consumedAt);\n  const orgId = stringOrUndefined(row.org_id ?? row.orgId);\n  if (consumedAt != null) return null;\n  if (expiresAt != null && expiresAt < now) return null;\n  if (options.expectedOrgId && orgId && orgId !== options.expectedOrgId) {\n    return null;\n  }\n\n  const result = await getDbExec().execute({\n    sql:\n      \"UPDATE agent_native_embed_tickets SET consumed_at = ? \" +\n      \"WHERE ticket_hash = ? AND consumed_at IS NULL\",\n    args: [now, ticketHash],\n  });\n  if (result.rowsAffected === 0) return null;\n\n  const targetPath = normalizeEmbedTargetPath(\n    stringOrUndefined(row.target_path ?? row.targetPath),\n  );\n  const ownerEmail = stringOrUndefined(row.owner_email ?? row.ownerEmail);\n  if (!targetPath || !ownerEmail || expiresAt == null) return null;\n\n  return {\n    ownerEmail,\n    ...(orgId ? { orgId } : {}),\n    targetPath,\n    ...(stringOrUndefined(row.scope)\n      ? { scope: stringOrUndefined(row.scope) }\n      : {}),\n    expiresAt,\n  };\n}\n\nexport function signEmbedSessionToken(input: {\n  ownerEmail: string;\n  orgId?: string | null;\n  targetPath: string;\n  scope?: string | null;\n  ttlSeconds?: number;\n}): string {\n  const targetPath = normalizeEmbedTargetPath(input.targetPath) ?? \"/\";\n  const now = Math.floor(Date.now() / 1000);\n  const ttl = Math.max(1, input.ttlSeconds ?? DEFAULT_TOKEN_TTL_SECONDS);\n  const claims: EmbedSessionTokenClaims = {\n    kind: TOKEN_KIND,\n    ownerEmail: input.ownerEmail,\n    targetPath,\n    iat: now,\n    exp: now + ttl,\n  };\n  if (input.orgId) claims.orgId = input.orgId;\n  if (input.scope) claims.scope = input.scope;\n  const payload = base64UrlEncode(JSON.stringify(claims));\n  return `${payload}.${signPayload(payload)}`;\n}\n\nexport function verifyEmbedSessionToken(\n  token: string | undefined | null,\n): VerifyEmbedSessionTokenResult {\n  if (!token || typeof token !== \"string\") {\n    return { ok: false, reason: \"missing\" };\n  }\n  const parts = token.split(\".\");\n  if (parts.length !== 2 || !parts[0] || !parts[1]) {\n    return { ok: false, reason: \"shape\" };\n  }\n  const [payload, signature] = parts;\n  const expected = signPayload(payload);\n  const sig = Buffer.from(signature);\n  const exp = Buffer.from(expected);\n  if (sig.length !== exp.length || !crypto.timingSafeEqual(sig, exp)) {\n    return { ok: false, reason: \"signature\" };\n  }\n\n  let claims: EmbedSessionTokenClaims;\n  try {\n    claims = JSON.parse(base64UrlDecode(payload).toString(\"utf8\"));\n  } catch {\n    return { ok: false, reason: \"payload\" };\n  }\n\n  if (\n    !claims ||\n    claims.kind !== TOKEN_KIND ||\n    typeof claims.ownerEmail !== \"string\" ||\n    !claims.ownerEmail ||\n    typeof claims.exp !== \"number\" ||\n    !Number.isFinite(claims.exp)\n  ) {\n    return { ok: false, reason: \"claims\" };\n  }\n  if (claims.exp < Math.floor(Date.now() / 1000)) {\n    return { ok: false, reason: \"expired\" };\n  }\n  claims.targetPath = normalizeEmbedTargetPath(claims.targetPath) ?? \"/\";\n  return { ok: true, claims };\n}\n\nfunction isHttpsRequest(event: H3Event): boolean {\n  try {\n    const xfProto = getHeader(event, \"x-forwarded-proto\");\n    if (xfProto && String(xfProto).split(\",\")[0].trim() === \"https\") {\n      return true;\n    }\n    const url = event.url?.toString?.() ?? \"\";\n    if (url.startsWith(\"https://\")) return true;\n    const appUrl = process.env.APP_URL || process.env.BETTER_AUTH_URL || \"\";\n    if (appUrl.startsWith(\"https://\")) return true;\n  } catch {\n    // ignore\n  }\n  return false;\n}\n\nfunction cookieDomainAttrs(): { domain?: string } {\n  const domain = process.env.COOKIE_DOMAIN?.trim();\n  return domain ? { domain } : {};\n}\n\nfunction crossSiteCookieAttrs(event: H3Event): {\n  sameSite: \"lax\" | \"none\";\n  secure: boolean;\n  partitioned?: boolean;\n} {\n  return isHttpsRequest(event)\n    ? { sameSite: \"none\", secure: true, partitioned: true }\n    : { sameSite: \"lax\", secure: false };\n}\n\nexport function setEmbedSessionCookie(event: H3Event, token: string): void {\n  setCookie(event, EMBED_SESSION_COOKIE, token, {\n    httpOnly: true,\n    ...crossSiteCookieAttrs(event),\n    ...cookieDomainAttrs(),\n    path: \"/\",\n    maxAge: DEFAULT_TOKEN_TTL_SECONDS,\n  });\n}\n\nfunction bearerToken(event: H3Event): string | undefined {\n  const auth = getHeader(event, \"authorization\");\n  if (!auth) return undefined;\n  const match = /^Bearer\\s+(.+)$/i.exec(String(auth).trim());\n  return match?.[1]?.trim();\n}\n\nfunction queryToken(event: H3Event): string | undefined {\n  const raw = getQuery(event)?.[EMBED_TOKEN_QUERY_PARAM];\n  const value = Array.isArray(raw) ? raw[0] : raw;\n  if (value) return value;\n  try {\n    return (\n      new URL(\n        requestUrlFromEvent(event),\n        \"http://agent-native.invalid\",\n      ).searchParams.get(EMBED_TOKEN_QUERY_PARAM) ?? undefined\n    );\n  } catch {\n    return undefined;\n  }\n}\n\nexport async function resolveEmbedSessionFromRequest(\n  event: H3Event,\n): Promise<ResolvedEmbedSession | null> {\n  const candidates = [\n    { token: queryToken(event), source: \"query\" },\n    { token: bearerToken(event), source: \"bearer\" },\n    { token: getCookie(event, EMBED_SESSION_COOKIE), source: \"cookie\" },\n  ];\n  for (const candidate of candidates) {\n    const verified = verifyEmbedSessionToken(candidate.token);\n    if (!verified.ok) continue;\n    const matchesTarget = requestMatchesEmbedTarget(\n      event,\n      verified.claims.targetPath,\n    );\n    const isRuntimeRequest = isEmbedRuntimeRequest(event);\n    const isRuntimeCookieRequest =\n      candidate.source === \"cookie\" && isRuntimeRequest;\n    const isRuntimeQueryRequest =\n      candidate.source === \"query\" && isRuntimeRequest;\n    if (!matchesTarget && !isRuntimeCookieRequest && !isRuntimeQueryRequest) {\n      continue;\n    }\n    if (candidate.source === \"query\" && candidate.token) {\n      try {\n        setEmbedSessionCookie(event, candidate.token);\n        setResponseHeader(event, \"Referrer-Policy\", \"no-referrer\");\n      } catch {\n        // Some tests and edge runtimes expose read-only request shims. The\n        // query token itself is still valid for this request.\n      }\n    }\n    return {\n      email: verified.claims.ownerEmail,\n      token: candidate.token!,\n      targetPath: verified.claims.targetPath,\n      ...(verified.claims.orgId ? { orgId: verified.claims.orgId } : {}),\n      ...(verified.claims.scope ? { scope: verified.claims.scope } : {}),\n    };\n  }\n  return null;\n}\n\nexport function requestHasEmbedAuthMarker(event: H3Event): boolean {\n  try {\n    const q = getQuery(event) ?? {};\n    const queryToken = Array.isArray(q[EMBED_TOKEN_QUERY_PARAM])\n      ? q[EMBED_TOKEN_QUERY_PARAM][0]\n      : q[EMBED_TOKEN_QUERY_PARAM];\n    const cookieToken = getCookie(event, EMBED_SESSION_COOKIE);\n    const candidates = [\n      { token: queryToken, allowRuntime: true },\n      { token: bearerToken(event), allowRuntime: false },\n      { token: cookieToken, allowRuntime: true },\n    ];\n    const runtimeRequest = isEmbedRuntimeRequest(event);\n    for (const candidate of candidates) {\n      const verified = verifyEmbedSessionToken(candidate.token);\n      if (\n        verified.ok &&\n        (requestMatchesEmbedTarget(event, verified.claims.targetPath) ||\n          (candidate.allowRuntime && runtimeRequest))\n      ) {\n        return true;\n      }\n    }\n  } catch {\n    // ignore\n  }\n  return false;\n}\n\nexport function isEmbedModeRequest(event: H3Event): boolean {\n  try {\n    const q = getQuery(event) ?? {};\n    return (\n      q[EMBED_MODE_QUERY_PARAM] === \"1\" || q[EMBED_MODE_QUERY_PARAM] === \"true\"\n    );\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/server/identity-sso-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-sso-store.d.ts","sourceRoot":"","sources":["../../src/server/identity-sso-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAgBH;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAUtD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAWnD;AAED,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,eAAO,MAAM,mBAAmB,QAAS,CAAC;AA0C1C;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAMD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CA6B7E"}
+{"version":3,"file":"identity-sso-store.d.ts","sourceRoot":"","sources":["../../src/server/identity-sso-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAsBH;;;;;GAKG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAUtD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAWnD;AAED,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,QAAc,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,KAAK,CAAC;AAChC,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAiE1C;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC,CAgChC;AAMD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CA6B7E"}

package/dist/server/identity-sso-store.js

@@ -22,7 +22,8 @@
  * Node-only (crypto), bundled alongside the other framework auth modules.
  */
 import { randomBytes } from "node:crypto";
-import { getDbExec, isConnectionError, intType } from "../db/client.js";
+import { getDbExec, isConnectionError, intType, isPostgres, } from "../db/client.js";
+import { ensureTableExists } from "../db/ddl-guard.js";
 let _initPromise;
 // ---------------------------------------------------------------------------
 // Feature switch — the SINGLE source of truth for whether the federated-SSO
@@ -90,13 +91,11 @@ export const SSO_STATE_TTL_MS = 10 * 60_000;
  */
 export const SSO_LOGIN_MAX = 60;
 export const SSO_LOGIN_WINDOW_MS = 60_000;
-async function ensureTable() {
-    if (!_initPromise) {
-        _initPromise = (async () => {
-            const client = getDbExec();
-            // Additive only. Never DROP / ALTER — this DB is shared across every
-            // deploy context (preview/branch/prod) for hosted templates.
-            await client.execute(`
+// Build the CREATE SQL lazily (not at module scope) so intType() runs at
+// RUNTIME, not import time — a module-scope call breaks any consumer whose
+// db/client mock doesn't stub intType (e.g. db-admin specs).
+function buildIdentitySsoStateCreateSql() {
+    return `
         CREATE TABLE IF NOT EXISTS identity_sso_state (
           state TEXT PRIMARY KEY,
           return_path TEXT,
@@ -104,13 +103,33 @@ async function ensureTable() {
           expires_at ${intType()},
           consumed_at ${intType()}
         )
-      `);
-            await client.execute(`
+      `;
+}
+function buildIdentitySsoJtiCreateSql() {
+    return `
         CREATE TABLE IF NOT EXISTS identity_sso_jti (
           jti TEXT PRIMARY KEY,
           seen_at ${intType()}
         )
-      `);
+      `;
+}
+async function ensureTable() {
+    if (!_initPromise) {
+        _initPromise = (async () => {
+            const client = getDbExec();
+            const identitySsoStateCreateSql = buildIdentitySsoStateCreateSql();
+            const identitySsoJtiCreateSql = buildIdentitySsoJtiCreateSql();
+            // Additive only. Never DROP / ALTER — this DB is shared across every
+            // deploy context (preview/branch/prod) for hosted templates.
+            if (isPostgres()) {
+                // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path
+                await ensureTableExists("identity_sso_state", identitySsoStateCreateSql);
+                await ensureTableExists("identity_sso_jti", identitySsoJtiCreateSql);
+                return;
+            }
+            // SQLite (local dev): no lock problem — keep the original behaviour.
+            await client.execute(identitySsoStateCreateSql);
+            await client.execute(identitySsoJtiCreateSql);
         })().catch((err) => {
             // Don't cache a rejection — let the next caller retry a fresh init.
             _initPromise = undefined;

package/dist/server/identity-sso-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-sso-store.js","sourceRoot":"","sources":["../../src/server/identity-sso-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAExE,IAAI,YAAuC,CAAC;AAE5C,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,oEAAoE;AACpE,2EAA2E;AAC3E,YAAY;AACZ,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACxE,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,CAAC,CAAC,iBAAiB,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,CAAC,oBAAoB,EAAE;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,CACL,wDAAwD;QACxD,uCAAuC;QACvC,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,kEAAkE;QAClE,iDAAiD,CAClD,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,qEAAqE;YACrE,6DAA6D;YAC7D,MAAM,MAAM,CAAC,OAAO,CAAC;;;;uBAIJ,OAAO,EAAE;uBACT,OAAO,EAAE;wBACR,OAAO,EAAE;;OAE1B,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC;;;oBAGP,OAAO,EAAE;;OAEtB,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,oEAAoE;YACpE,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAyB;IAEzB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,mEAAmE;YACxE,IAAI,EAAE,CAAC,GAAG,GAAG,mBAAmB,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,aAAa,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc;YAAE,MAAM,GAAG,CAAC;QAC/C,iEAAiE;QACjE,uDAAuD;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,GAAG,GAAG,gBAAgB,CAAC;IACzC,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iHAAiH;QACtH,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC;KACxD,CAAC,CAAC;IACH,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,MAAM;SACR,OAAO,CAAC;QACP,GAAG,EAAE,qDAAqD;QAC1D,IAAI,EAAE,CAAC,GAAG,CAAC;KACZ,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,4FAA4F;QACjG,IAAI,EAAE,CAAC,KAAK,CAAC;KACd,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,GAAG,GAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,uEAAuE;IACvE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,uFAAuF;QAC5F,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,sEAAsE;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,CAErD,CAAC;IACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0DAA0D;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAE,GAAW,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,IACE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Framework-table store for the cross-app SSO (\"Sign in with Agent-Native\")\n * CLIENT side. Backs two pieces of the federated login round-trip:\n *\n *   - `identity_sso_state` — short-lived (10 min), single-use, crypto-random\n *     CSRF `state` values. Minted at `/_agent-native/identity/login`,\n *     consumed exactly once at `/_agent-native/identity/callback`. Carries an\n *     optional same-origin `return` path so the user lands back where they\n *     started after federated sign-in.\n *   - `identity_sso_jti` — replayed-token guard. The hub-issued identity JWT\n *     carries a random `jti`; the first callback that verifies a given `jti`\n *     records it here, and any later callback that presents the same `jti`\n *     is rejected. Best-effort: a DB blip never widens the trust boundary\n *     (signature + exp + scope + single-use state are still enforced), it\n *     only relaxes the extra replay gate.\n *\n * Mirrors `mcp/connect-store.ts`: lazy `ensureTable()`, `getDbExec()`,\n * dialect-agnostic SQL via `intType()`, `isConnectionError()` swallow so a\n * transient Neon WS drop never 500s. `CREATE TABLE IF NOT EXISTS` only —\n * strictly additive, never DROP / ALTER (shared prod DB rule).\n *\n * Node-only (crypto), bundled alongside the other framework auth modules.\n */\n\nimport { randomBytes } from \"node:crypto\";\n\nimport { getDbExec, isConnectionError, intType } from \"../db/client.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\n// ---------------------------------------------------------------------------\n// Feature switch — the SINGLE source of truth for whether the federated-SSO\n// client is active. Lives here (a leaf module with no dependency on auth.ts)\n// so BOTH the auth guard and the route handler import the identical\n// validator and can never drift. Pure env read, no I/O — safe on the guard\n// hot path.\n// ---------------------------------------------------------------------------\n\n/**\n * Read + normalise `AGENT_NATIVE_IDENTITY_HUB_URL`. Returns `undefined`\n * (feature OFF) unless it is set to a syntactically valid http(s) URL. A\n * malformed value is treated as OFF rather than throwing, so a typo can\n * never brick an app's login — it just behaves as if SSO were unconfigured.\n */\nexport function getIdentityHubUrl(): string | undefined {\n  const raw = process.env.AGENT_NATIVE_IDENTITY_HUB_URL?.trim();\n  if (!raw) return undefined;\n  try {\n    const u = new URL(raw);\n    if (u.protocol !== \"https:\" && u.protocol !== \"http:\") return undefined;\n    return `${u.protocol}//${u.host}${u.pathname}`.replace(/\\/+$/, \"\");\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether the federated-SSO client is active. When false, NOTHING in the\n * SSO module has any effect: the route 404s, the guard bypass is inert, the\n * login button is not rendered. This is the single switch the\n * env-unset-no-op invariant is asserted against.\n */\nexport function isIdentitySsoEnabled(): boolean {\n  return !!getIdentityHubUrl();\n}\n\n/**\n * The conditional \"Sign in with Agent-Native\" entry injected into the login\n * page — ONLY when the feature is enabled. Returns an empty string when\n * disabled so the login HTML is byte-for-byte identical to today's output\n * with the env unset (asserted by the env-unset-no-op regression test). Pure\n * string builder, no I/O — safe to call during HTML render. Lives in this\n * leaf module so `onboarding-html.ts` can import it without creating an\n * `auth.ts` ↔ `identity-sso.ts` import cycle.\n */\nexport function identitySsoLoginButtonHtml(): string {\n  if (!isIdentitySsoEnabled()) return \"\";\n  return (\n    `\\n  <a class=\"btn-identity-sso\" id=\"identity-sso-btn\" ` +\n    `href=\"/_agent-native/identity/login\" ` +\n    `style=\"display:flex;align-items:center;justify-content:center;gap:0.5rem;` +\n    `width:100%;padding:0.7rem 1rem;margin-bottom:0.75rem;border-radius:8px;` +\n    `border:1px solid rgba(255,255,255,0.18);background:transparent;` +\n    `color:inherit;font:inherit;font-weight:600;text-decoration:none;` +\n    `cursor:pointer\">Sign in with Agent-Native</a>\\n`\n  );\n}\n\n/** CSRF state values are valid for 10 minutes. */\nexport const SSO_STATE_TTL_MS = 10 * 60_000;\n\n/**\n * Rate limit for `identity/login`: at most this many state rows may be\n * created within `SSO_LOGIN_WINDOW_MS`. The endpoint is reachable without a\n * session (it's the entry point), so keep a coarse global cap to stop table\n * flooding without per-IP plumbing.\n */\nexport const SSO_LOGIN_MAX = 60;\nexport const SSO_LOGIN_WINDOW_MS = 60_000;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      // Additive only. Never DROP / ALTER — this DB is shared across every\n      // deploy context (preview/branch/prod) for hosted templates.\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS identity_sso_state (\n          state TEXT PRIMARY KEY,\n          return_path TEXT,\n          created_at ${intType()},\n          expires_at ${intType()},\n          consumed_at ${intType()}\n        )\n      `);\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS identity_sso_jti (\n          jti TEXT PRIMARY KEY,\n          seen_at ${intType()}\n        )\n      `);\n    })().catch((err) => {\n      // Don't cache a rejection — let the next caller retry a fresh init.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nfunction numOrNull(v: unknown): number | null {\n  if (v == null) return null;\n  const n = Number(v);\n  return Number.isFinite(n) ? n : null;\n}\n\n// ---------------------------------------------------------------------------\n// CSRF state\n// ---------------------------------------------------------------------------\n\n/**\n * Mint a fresh crypto-random `state` value, persist it with an optional\n * same-origin return path, and return it. Rate-limited at creation: at most\n * `SSO_LOGIN_MAX` rows within `SSO_LOGIN_WINDOW_MS`. Throws `RATE_LIMITED`\n * when the cap is exceeded so the route can map it to a 429.\n */\nexport async function createSsoState(\n  returnPath: string | null,\n): Promise<string> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT COUNT(*) AS n FROM identity_sso_state WHERE created_at > ?`,\n      args: [now - SSO_LOGIN_WINDOW_MS],\n    });\n    const n = Number(rows[0]?.n ?? rows[0]?.[\"COUNT(*)\"] ?? 0);\n    if (Number.isFinite(n) && n >= SSO_LOGIN_MAX) {\n      throw new Error(\"RATE_LIMITED\");\n    }\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") throw err;\n    // A read failure must not block legitimate logins — single-use +\n    // short-TTL state is the primary protection. Continue.\n  }\n\n  const state = randomBytes(32).toString(\"base64url\");\n  const expiresAt = now + SSO_STATE_TTL_MS;\n  await client.execute({\n    sql: `INSERT INTO identity_sso_state (state, return_path, created_at, expires_at, consumed_at) VALUES (?, ?, ?, ?, ?)`,\n    args: [state, returnPath ?? null, now, expiresAt, null],\n  });\n  // Fire-and-forget: prune fully-expired rows (consumed or abandoned). Without\n  // this the table grows unbounded and the rate-limit COUNT(*) above slows down.\n  void client\n    .execute({\n      sql: `DELETE FROM identity_sso_state WHERE expires_at < ?`,\n      args: [now],\n    })\n    .catch(() => {});\n  return state;\n}\n\nexport interface SsoStateConsumeResult {\n  ok: boolean;\n  returnPath: string | null;\n}\n\n/**\n * Atomically consume a `state` value. Returns `{ ok: true, returnPath }` only\n * when the state existed, had not expired, and had not been consumed before —\n * and this call is the one that transitioned it to consumed (single-use,\n * enforced via a conditional UPDATE so a double callback can't both pass).\n * Any other condition returns `{ ok: false }`.\n */\nexport async function consumeSsoState(\n  state: string,\n): Promise<SsoStateConsumeResult> {\n  if (!state) return { ok: false, returnPath: null };\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n\n  const { rows } = await client.execute({\n    sql: `SELECT state, return_path, expires_at, consumed_at FROM identity_sso_state WHERE state = ?`,\n    args: [state],\n  });\n  if (rows.length === 0) return { ok: false, returnPath: null };\n  const row: any = rows[0];\n  const expiresAt = numOrNull(row.expires_at ?? row.expiresAt);\n  const consumedAt = numOrNull(row.consumed_at ?? row.consumedAt);\n  if (consumedAt != null) return { ok: false, returnPath: null };\n  if (expiresAt != null && expiresAt < now) {\n    return { ok: false, returnPath: null };\n  }\n\n  // Single-use: only the caller that flips `consumed_at` from NULL wins.\n  const result = await client.execute({\n    sql: `UPDATE identity_sso_state SET consumed_at = ? WHERE state = ? AND consumed_at IS NULL`,\n    args: [now, state],\n  });\n  if (result.rowsAffected === 0) {\n    // Lost the race to a concurrent callback — treat as already consumed.\n    return { ok: false, returnPath: null };\n  }\n  const returnPath = (row.return_path ?? row.returnPath ?? null) as\n    | string\n    | null;\n  return { ok: true, returnPath };\n}\n\n// ---------------------------------------------------------------------------\n// Replay (jti) guard\n// ---------------------------------------------------------------------------\n\n/**\n * Returns true when the given identity-token `jti` has already been seen\n * (i.e. this is a replay). On the first sighting, records the `jti` and\n * returns false. Best-effort: a store/DB error returns `false` (not a\n * replay) so a transient Neon WS drop never blocks a legitimate first-time\n * sign-in — signature + exp + scope + single-use CSRF state remain the hard\n * gates; this only adds defence in depth against token replay.\n */\nexport async function isJtiReplayed(jti: string | undefined): Promise<boolean> {\n  if (!jti) return false;\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    await client.execute({\n      sql: `INSERT INTO identity_sso_jti (jti, seen_at) VALUES (?, ?)`,\n      args: [jti, Date.now()],\n    });\n    // The INSERT completed without throwing → this jti was never seen → not a\n    // replay. (A replay manifests as a PK-conflict *exception*, handled below.)\n    // Don't key off rowsAffected: some drivers report 0 for a successful insert,\n    // which would wrongly flag a legitimate first-time sign-in as a replay.\n    return false;\n  } catch (err) {\n    // Primary-key conflict = the jti already exists = replay.\n    const msg = String((err as any)?.message ?? \"\").toLowerCase();\n    if (\n      msg.includes(\"unique\") ||\n      msg.includes(\"duplicate\") ||\n      msg.includes(\"constraint\")\n    ) {\n      return true;\n    }\n    // Any other error (incl. connection blips): fail open — do not block a\n    // legitimate first sign-in over a transient DB issue.\n    if (isConnectionError(err)) return false;\n    return false;\n  }\n}\n"]}
+{"version":3,"file":"identity-sso-store.js","sourceRoot":"","sources":["../../src/server/identity-sso-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,OAAO,EACP,UAAU,GACX,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,IAAI,YAAuC,CAAC;AAE5C,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,oEAAoE;AACpE,2EAA2E;AAC3E,YAAY;AACZ,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACxE,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,CAAC,CAAC,iBAAiB,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,CAAC,oBAAoB,EAAE;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,CACL,wDAAwD;QACxD,uCAAuC;QACvC,2EAA2E;QAC3E,yEAAyE;QACzE,iEAAiE;QACjE,kEAAkE;QAClE,iDAAiD,CAClD,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAChC,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C,yEAAyE;AACzE,2EAA2E;AAC3E,6DAA6D;AAC7D,SAAS,8BAA8B;IACrC,OAAO;;;;uBAIc,OAAO,EAAE;uBACT,OAAO,EAAE;wBACR,OAAO,EAAE;;OAE1B,CAAC;AACR,CAAC;AACD,SAAS,4BAA4B;IACnC,OAAO;;;oBAGW,OAAO,EAAE;;OAEtB,CAAC;AACR,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,yBAAyB,GAAG,8BAA8B,EAAE,CAAC;YACnE,MAAM,uBAAuB,GAAG,4BAA4B,EAAE,CAAC;YAC/D,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,gFAAgF;gBAChF,MAAM,iBAAiB,CACrB,oBAAoB,EACpB,yBAAyB,CAC1B,CAAC;gBACF,MAAM,iBAAiB,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;YAChD,MAAM,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAChD,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,oEAAoE;YACpE,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAyB;IAEzB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE,mEAAmE;YACxE,IAAI,EAAE,CAAC,GAAG,GAAG,mBAAmB,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,aAAa,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,OAAO,KAAK,cAAc;YAAE,MAAM,GAAG,CAAC;QAC/C,iEAAiE;QACjE,uDAAuD;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,GAAG,GAAG,gBAAgB,CAAC;IACzC,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,iHAAiH;QACtH,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,IAAI,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC;KACxD,CAAC,CAAC;IACH,6EAA6E;IAC7E,+EAA+E;IAC/E,KAAK,MAAM;SACR,OAAO,CAAC;QACP,GAAG,EAAE,qDAAqD;QAC1D,IAAI,EAAE,CAAC,GAAG,CAAC;KACZ,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa;IAEb,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,4FAA4F;QACjG,IAAI,EAAE,CAAC,KAAK,CAAC;KACd,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC9D,MAAM,GAAG,GAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAChE,IAAI,UAAU,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,uEAAuE;IACvE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,uFAAuF;QAC5F,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC;KACnB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAC9B,sEAAsE;QACtE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,UAAU,IAAI,IAAI,CAErD,CAAC;IACT,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAuB;IACzD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,2DAA2D;YAChE,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;SACxB,CAAC,CAAC;QACH,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,wEAAwE;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0DAA0D;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAE,GAAW,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,IACE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAC1B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,iBAAiB,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC","sourcesContent":["/**\n * Framework-table store for the cross-app SSO (\"Sign in with Agent-Native\")\n * CLIENT side. Backs two pieces of the federated login round-trip:\n *\n *   - `identity_sso_state` — short-lived (10 min), single-use, crypto-random\n *     CSRF `state` values. Minted at `/_agent-native/identity/login`,\n *     consumed exactly once at `/_agent-native/identity/callback`. Carries an\n *     optional same-origin `return` path so the user lands back where they\n *     started after federated sign-in.\n *   - `identity_sso_jti` — replayed-token guard. The hub-issued identity JWT\n *     carries a random `jti`; the first callback that verifies a given `jti`\n *     records it here, and any later callback that presents the same `jti`\n *     is rejected. Best-effort: a DB blip never widens the trust boundary\n *     (signature + exp + scope + single-use state are still enforced), it\n *     only relaxes the extra replay gate.\n *\n * Mirrors `mcp/connect-store.ts`: lazy `ensureTable()`, `getDbExec()`,\n * dialect-agnostic SQL via `intType()`, `isConnectionError()` swallow so a\n * transient Neon WS drop never 500s. `CREATE TABLE IF NOT EXISTS` only —\n * strictly additive, never DROP / ALTER (shared prod DB rule).\n *\n * Node-only (crypto), bundled alongside the other framework auth modules.\n */\n\nimport { randomBytes } from \"node:crypto\";\n\nimport {\n  getDbExec,\n  isConnectionError,\n  intType,\n  isPostgres,\n} from \"../db/client.js\";\nimport { ensureTableExists } from \"../db/ddl-guard.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\n// ---------------------------------------------------------------------------\n// Feature switch — the SINGLE source of truth for whether the federated-SSO\n// client is active. Lives here (a leaf module with no dependency on auth.ts)\n// so BOTH the auth guard and the route handler import the identical\n// validator and can never drift. Pure env read, no I/O — safe on the guard\n// hot path.\n// ---------------------------------------------------------------------------\n\n/**\n * Read + normalise `AGENT_NATIVE_IDENTITY_HUB_URL`. Returns `undefined`\n * (feature OFF) unless it is set to a syntactically valid http(s) URL. A\n * malformed value is treated as OFF rather than throwing, so a typo can\n * never brick an app's login — it just behaves as if SSO were unconfigured.\n */\nexport function getIdentityHubUrl(): string | undefined {\n  const raw = process.env.AGENT_NATIVE_IDENTITY_HUB_URL?.trim();\n  if (!raw) return undefined;\n  try {\n    const u = new URL(raw);\n    if (u.protocol !== \"https:\" && u.protocol !== \"http:\") return undefined;\n    return `${u.protocol}//${u.host}${u.pathname}`.replace(/\\/+$/, \"\");\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Whether the federated-SSO client is active. When false, NOTHING in the\n * SSO module has any effect: the route 404s, the guard bypass is inert, the\n * login button is not rendered. This is the single switch the\n * env-unset-no-op invariant is asserted against.\n */\nexport function isIdentitySsoEnabled(): boolean {\n  return !!getIdentityHubUrl();\n}\n\n/**\n * The conditional \"Sign in with Agent-Native\" entry injected into the login\n * page — ONLY when the feature is enabled. Returns an empty string when\n * disabled so the login HTML is byte-for-byte identical to today's output\n * with the env unset (asserted by the env-unset-no-op regression test). Pure\n * string builder, no I/O — safe to call during HTML render. Lives in this\n * leaf module so `onboarding-html.ts` can import it without creating an\n * `auth.ts` ↔ `identity-sso.ts` import cycle.\n */\nexport function identitySsoLoginButtonHtml(): string {\n  if (!isIdentitySsoEnabled()) return \"\";\n  return (\n    `\\n  <a class=\"btn-identity-sso\" id=\"identity-sso-btn\" ` +\n    `href=\"/_agent-native/identity/login\" ` +\n    `style=\"display:flex;align-items:center;justify-content:center;gap:0.5rem;` +\n    `width:100%;padding:0.7rem 1rem;margin-bottom:0.75rem;border-radius:8px;` +\n    `border:1px solid rgba(255,255,255,0.18);background:transparent;` +\n    `color:inherit;font:inherit;font-weight:600;text-decoration:none;` +\n    `cursor:pointer\">Sign in with Agent-Native</a>\\n`\n  );\n}\n\n/** CSRF state values are valid for 10 minutes. */\nexport const SSO_STATE_TTL_MS = 10 * 60_000;\n\n/**\n * Rate limit for `identity/login`: at most this many state rows may be\n * created within `SSO_LOGIN_WINDOW_MS`. The endpoint is reachable without a\n * session (it's the entry point), so keep a coarse global cap to stop table\n * flooding without per-IP plumbing.\n */\nexport const SSO_LOGIN_MAX = 60;\nexport const SSO_LOGIN_WINDOW_MS = 60_000;\n\n// Build the CREATE SQL lazily (not at module scope) so intType() runs at\n// RUNTIME, not import time — a module-scope call breaks any consumer whose\n// db/client mock doesn't stub intType (e.g. db-admin specs).\nfunction buildIdentitySsoStateCreateSql(): string {\n  return `\n        CREATE TABLE IF NOT EXISTS identity_sso_state (\n          state TEXT PRIMARY KEY,\n          return_path TEXT,\n          created_at ${intType()},\n          expires_at ${intType()},\n          consumed_at ${intType()}\n        )\n      `;\n}\nfunction buildIdentitySsoJtiCreateSql(): string {\n  return `\n        CREATE TABLE IF NOT EXISTS identity_sso_jti (\n          jti TEXT PRIMARY KEY,\n          seen_at ${intType()}\n        )\n      `;\n}\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const identitySsoStateCreateSql = buildIdentitySsoStateCreateSql();\n      const identitySsoJtiCreateSql = buildIdentitySsoJtiCreateSql();\n      // Additive only. Never DROP / ALTER — this DB is shared across every\n      // deploy context (preview/branch/prod) for hosted templates.\n      if (isPostgres()) {\n        // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path\n        await ensureTableExists(\n          \"identity_sso_state\",\n          identitySsoStateCreateSql,\n        );\n        await ensureTableExists(\"identity_sso_jti\", identitySsoJtiCreateSql);\n        return;\n      }\n\n      // SQLite (local dev): no lock problem — keep the original behaviour.\n      await client.execute(identitySsoStateCreateSql);\n      await client.execute(identitySsoJtiCreateSql);\n    })().catch((err) => {\n      // Don't cache a rejection — let the next caller retry a fresh init.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nfunction numOrNull(v: unknown): number | null {\n  if (v == null) return null;\n  const n = Number(v);\n  return Number.isFinite(n) ? n : null;\n}\n\n// ---------------------------------------------------------------------------\n// CSRF state\n// ---------------------------------------------------------------------------\n\n/**\n * Mint a fresh crypto-random `state` value, persist it with an optional\n * same-origin return path, and return it. Rate-limited at creation: at most\n * `SSO_LOGIN_MAX` rows within `SSO_LOGIN_WINDOW_MS`. Throws `RATE_LIMITED`\n * when the cap is exceeded so the route can map it to a 429.\n */\nexport async function createSsoState(\n  returnPath: string | null,\n): Promise<string> {\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n\n  try {\n    const { rows } = await client.execute({\n      sql: `SELECT COUNT(*) AS n FROM identity_sso_state WHERE created_at > ?`,\n      args: [now - SSO_LOGIN_WINDOW_MS],\n    });\n    const n = Number(rows[0]?.n ?? rows[0]?.[\"COUNT(*)\"] ?? 0);\n    if (Number.isFinite(n) && n >= SSO_LOGIN_MAX) {\n      throw new Error(\"RATE_LIMITED\");\n    }\n  } catch (err: any) {\n    if (err?.message === \"RATE_LIMITED\") throw err;\n    // A read failure must not block legitimate logins — single-use +\n    // short-TTL state is the primary protection. Continue.\n  }\n\n  const state = randomBytes(32).toString(\"base64url\");\n  const expiresAt = now + SSO_STATE_TTL_MS;\n  await client.execute({\n    sql: `INSERT INTO identity_sso_state (state, return_path, created_at, expires_at, consumed_at) VALUES (?, ?, ?, ?, ?)`,\n    args: [state, returnPath ?? null, now, expiresAt, null],\n  });\n  // Fire-and-forget: prune fully-expired rows (consumed or abandoned). Without\n  // this the table grows unbounded and the rate-limit COUNT(*) above slows down.\n  void client\n    .execute({\n      sql: `DELETE FROM identity_sso_state WHERE expires_at < ?`,\n      args: [now],\n    })\n    .catch(() => {});\n  return state;\n}\n\nexport interface SsoStateConsumeResult {\n  ok: boolean;\n  returnPath: string | null;\n}\n\n/**\n * Atomically consume a `state` value. Returns `{ ok: true, returnPath }` only\n * when the state existed, had not expired, and had not been consumed before —\n * and this call is the one that transitioned it to consumed (single-use,\n * enforced via a conditional UPDATE so a double callback can't both pass).\n * Any other condition returns `{ ok: false }`.\n */\nexport async function consumeSsoState(\n  state: string,\n): Promise<SsoStateConsumeResult> {\n  if (!state) return { ok: false, returnPath: null };\n  await ensureTable();\n  const client = getDbExec();\n  const now = Date.now();\n\n  const { rows } = await client.execute({\n    sql: `SELECT state, return_path, expires_at, consumed_at FROM identity_sso_state WHERE state = ?`,\n    args: [state],\n  });\n  if (rows.length === 0) return { ok: false, returnPath: null };\n  const row: any = rows[0];\n  const expiresAt = numOrNull(row.expires_at ?? row.expiresAt);\n  const consumedAt = numOrNull(row.consumed_at ?? row.consumedAt);\n  if (consumedAt != null) return { ok: false, returnPath: null };\n  if (expiresAt != null && expiresAt < now) {\n    return { ok: false, returnPath: null };\n  }\n\n  // Single-use: only the caller that flips `consumed_at` from NULL wins.\n  const result = await client.execute({\n    sql: `UPDATE identity_sso_state SET consumed_at = ? WHERE state = ? AND consumed_at IS NULL`,\n    args: [now, state],\n  });\n  if (result.rowsAffected === 0) {\n    // Lost the race to a concurrent callback — treat as already consumed.\n    return { ok: false, returnPath: null };\n  }\n  const returnPath = (row.return_path ?? row.returnPath ?? null) as\n    | string\n    | null;\n  return { ok: true, returnPath };\n}\n\n// ---------------------------------------------------------------------------\n// Replay (jti) guard\n// ---------------------------------------------------------------------------\n\n/**\n * Returns true when the given identity-token `jti` has already been seen\n * (i.e. this is a replay). On the first sighting, records the `jti` and\n * returns false. Best-effort: a store/DB error returns `false` (not a\n * replay) so a transient Neon WS drop never blocks a legitimate first-time\n * sign-in — signature + exp + scope + single-use CSRF state remain the hard\n * gates; this only adds defence in depth against token replay.\n */\nexport async function isJtiReplayed(jti: string | undefined): Promise<boolean> {\n  if (!jti) return false;\n  try {\n    await ensureTable();\n    const client = getDbExec();\n    await client.execute({\n      sql: `INSERT INTO identity_sso_jti (jti, seen_at) VALUES (?, ?)`,\n      args: [jti, Date.now()],\n    });\n    // The INSERT completed without throwing → this jti was never seen → not a\n    // replay. (A replay manifests as a PK-conflict *exception*, handled below.)\n    // Don't key off rowsAffected: some drivers report 0 for a successful insert,\n    // which would wrongly flag a legitimate first-time sign-in as a replay.\n    return false;\n  } catch (err) {\n    // Primary-key conflict = the jti already exists = replay.\n    const msg = String((err as any)?.message ?? \"\").toLowerCase();\n    if (\n      msg.includes(\"unique\") ||\n      msg.includes(\"duplicate\") ||\n      msg.includes(\"constraint\")\n    ) {\n      return true;\n    }\n    // Any other error (incl. connection blips): fail open — do not block a\n    // legitimate first sign-in over a transient DB issue.\n    if (isConnectionError(err)) return false;\n    return false;\n  }\n}\n"]}

package/dist/server/recap-image-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recap-image-store.d.ts","sourceRoot":"","sources":["../../src/server/recap-image-store.ts"],"names":[],"mappings":"AAuBA,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,QAAkB,CAAC;AAErD,iDAAiD;AACjD,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAA2B,CAAC;AAW3D,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAuB3D;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,0FAA0F;AAC1F,wBAAgB,uBAAuB,CAAC,UAAU,SAAK,GAAG,MAAM,CAE/D;AAED,uFAAuF;AACvF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAC/B,OAAO,CAET;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAC3C,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB5B;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC"}
+{"version":3,"file":"recap-image-store.d.ts","sourceRoot":"","sources":["../../src/server/recap-image-store.ts"],"names":[],"mappings":"AA6BA,0DAA0D;AAC1D,eAAO,MAAM,qBAAqB,QAAkB,CAAC;AAErD,iDAAiD;AACjD,eAAO,MAAM,wBAAwB,cAAc,CAAC;AAEpD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAA2B,CAAC;AA2B3D,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAoB3D;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,GAAE,MAAmB,GACvB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,0FAA0F;AAC1F,wBAAgB,uBAAuB,CAAC,UAAU,SAAK,GAAG,MAAM,CAE/D;AAED,uFAAuF;AACvF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAC/B,OAAO,CAET;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GAC3C,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwB5B;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC"}

package/dist/server/recap-image-store.js

@@ -18,7 +18,8 @@
  * libSQL/Turso, and D1 without per-dialect blob/bytea handling.
  */
 import { randomBytes } from "node:crypto";
-import { getDbExec, intType, retryOnDdlRace } from "../db/client.js";
+import { getDbExec, intType, isPostgres, retryOnDdlRace, } from "../db/client.js";
+import { ensureTableExists } from "../db/ddl-guard.js";
 /** Maximum stored image size (~5 MB of raw PNG bytes). */
 export const RECAP_IMAGE_MAX_BYTES = 5 * 1024 * 1024;
 /** Only `image/png` is ever stored or served. */
@@ -37,11 +38,11 @@ export const RECAP_IMAGE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
  */
 const TOKEN_PATTERN = /^[0-9a-f]{32,128}$/;
 let _initPromise;
-export async function ensureRecapImageTable() {
-    if (!_initPromise) {
-        _initPromise = (async () => {
-            const client = getDbExec();
-            await retryOnDdlRace(() => client.execute(`
+// Build the CREATE SQL lazily (not at module scope) so intType() runs at
+// RUNTIME, not import time — a module-scope call breaks any consumer whose
+// db/client mock doesn't stub intType (e.g. db-admin specs).
+function buildRecapImagesCreateSql() {
+    return `
         CREATE TABLE IF NOT EXISTS recap_images (
           token TEXT PRIMARY KEY,
           png_base64 TEXT NOT NULL,
@@ -50,7 +51,20 @@ export async function ensureRecapImageTable() {
           owner_email TEXT,
           created_at ${intType()} NOT NULL
         )
-      `));
+      `;
+}
+export async function ensureRecapImageTable() {
+    if (!_initPromise) {
+        _initPromise = (async () => {
+            const recapImagesCreateSql = buildRecapImagesCreateSql();
+            if (isPostgres()) {
+                // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path
+                await ensureTableExists("recap_images", recapImagesCreateSql);
+                return;
+            }
+            // SQLite (local dev): no lock problem — keep the original behaviour.
+            const client = getDbExec();
+            await retryOnDdlRace(() => client.execute(recapImagesCreateSql));
         })().catch((error) => {
             // Allow a later call to retry if the first init lost a DDL race.
             _initPromise = undefined;

package/dist/server/recap-image-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"recap-image-store.js","sourceRoot":"","sources":["../../src/server/recap-image-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAErE,0DAA0D;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,iDAAiD;AACjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;;;GAIG;AACH,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,IAAI,YAAuC,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,cAAc,CAAC,GAAG,EAAE,CACxB,MAAM,CAAC,OAAO,CAAC;;;;gDAIyB,wBAAwB;wBAChD,OAAO,EAAE;;uBAEV,OAAO,EAAE;;OAEzB,CAAC,CACD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnB,iEAAiE;YACjE,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,+CAA+C;QACpD,IAAI,EAAE,CAAC,GAAG,GAAG,kBAAkB,CAAC;KACjC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,uBAAuB,CAAC,UAAU,GAAG,EAAE;IACrD,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CACpC,KAAgC;IAEhC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,OAAO,GAAmC,EAAE;IAE5C,IAAI,GAAG,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAC;IACxC,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;gCAEuB;QAC5B,IAAI,EAAE;YACJ,KAAK;YACL,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,wBAAwB;YACxB,GAAG,CAAC,UAAU;YACd,OAAO,CAAC,UAAU,IAAI,IAAI;YAC1B,IAAI,CAAC,GAAG,EAAE;SACX;KACF,CAAC,CAAC;IACH,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,uBAAuB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa;IAEb,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,2EAA2E;QAChF,IAAI,EAAE,CAAC,KAAK,CAAC;KACd,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAEL,CAAC;IACd,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC5C,uEAAuE;QACvE,yEAAyE;QACzE,WAAW,EACT,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YAClC,CAAC,CAAC,GAAG,CAAC,YAAY;YAClB,CAAC,CAAC,wBAAwB;KAC/B,CAAC;AACJ,CAAC","sourcesContent":["/**\n * SQL persistence for signed, content-only recap PNG images.\n *\n * The PR visual-recap GitHub Action renders a recap plan to a PNG and uploads\n * it through `POST /_agent-native/recap-image` (authenticated with the same\n * `agent-native connect` bearer token the MCP / action surface accepts). The\n * stored bytes are then served anonymously from\n * `GET /_agent-native/recap-image/<token>.png` so GitHub's camo image proxy can\n * fetch them into a (private-repo) PR comment without a login. The interactive\n * plan itself stays login-gated; this store only ever holds opaque image bytes\n * keyed by a long, unguessable token.\n *\n * Follows the same raw-SQL pattern as observability/store.ts and usage/store.ts\n * — framework-owned tables use `getDbExec()` with dialect-agnostic\n * `CREATE TABLE IF NOT EXISTS` DDL (additive only; never drops/renames/alters)\n * rather than Drizzle ORM, which is reserved for template-level schemas. The\n * PNG is stored as base64 TEXT so it is portable across SQLite, Neon/Postgres,\n * libSQL/Turso, and D1 without per-dialect blob/bytea handling.\n */\nimport { randomBytes } from \"node:crypto\";\n\nimport { getDbExec, intType, retryOnDdlRace } from \"../db/client.js\";\n\n/** Maximum stored image size (~5 MB of raw PNG bytes). */\nexport const RECAP_IMAGE_MAX_BYTES = 5 * 1024 * 1024;\n\n/** Only `image/png` is ever stored or served. */\nexport const RECAP_IMAGE_CONTENT_TYPE = \"image/png\";\n\n/**\n * Stored recap images older than this are pruned on the next write (30 days).\n * Each PR push uploads a fresh screenshot under a new token; without expiry the\n * table — and the set of anonymously-fetchable image URLs — would grow without\n * bound. 30 days comfortably outlives any PR's review window.\n */\nexport const RECAP_IMAGE_TTL_MS = 30 * 24 * 60 * 60 * 1000;\n\n/**\n * Token format for the public `<token>.png` path. Hex-only so it can never\n * contain a path separator, `.`, or `..` — no directory traversal is possible\n * via the token path param.\n */\nconst TOKEN_PATTERN = /^[0-9a-f]{32,128}$/;\n\nlet _initPromise: Promise<void> | undefined;\n\nexport async function ensureRecapImageTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await retryOnDdlRace(() =>\n        client.execute(`\n        CREATE TABLE IF NOT EXISTS recap_images (\n          token TEXT PRIMARY KEY,\n          png_base64 TEXT NOT NULL,\n          content_type TEXT NOT NULL DEFAULT '${RECAP_IMAGE_CONTENT_TYPE}',\n          byte_length ${intType()} NOT NULL DEFAULT 0,\n          owner_email TEXT,\n          created_at ${intType()} NOT NULL\n        )\n      `),\n      );\n    })().catch((error) => {\n      // Allow a later call to retry if the first init lost a DDL race.\n      _initPromise = undefined;\n      throw error;\n    });\n  }\n  return _initPromise;\n}\n\n/**\n * Delete recap images older than {@link RECAP_IMAGE_TTL_MS}. Called best-effort\n * after each write so the table stays bounded. Returns the number of rows\n * removed. Dialect-agnostic (a plain `DELETE ... WHERE created_at < ?`).\n */\nexport async function pruneExpiredRecapImages(\n  now: number = Date.now(),\n): Promise<number> {\n  await ensureRecapImageTable();\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM recap_images WHERE created_at < ?`,\n    args: [now - RECAP_IMAGE_TTL_MS],\n  });\n  return rowsAffected;\n}\n\n/** Generate a long, unguessable lowercase-hex token (default 32 bytes → 64 hex chars). */\nexport function generateRecapImageToken(byteLength = 32): string {\n  return randomBytes(byteLength).toString(\"hex\");\n}\n\n/** True when `token` matches the strict hex token format (no traversal characters). */\nexport function isValidRecapImageToken(\n  token: string | undefined | null,\n): boolean {\n  return typeof token === \"string\" && TOKEN_PATTERN.test(token);\n}\n\nexport interface StoredRecapImage {\n  bytes: Buffer;\n  contentType: string;\n}\n\n/**\n * Store PNG bytes and return the freshly minted token. Caller is responsible\n * for enforcing the size cap before calling (we re-check defensively here too).\n */\nexport async function saveRecapImage(\n  png: Buffer,\n  options: { ownerEmail?: string | null } = {},\n): Promise<{ token: string }> {\n  if (png.byteLength > RECAP_IMAGE_MAX_BYTES) {\n    throw new Error(\"recap image exceeds maximum size\");\n  }\n  await ensureRecapImageTable();\n  const client = getDbExec();\n  const token = generateRecapImageToken();\n  await client.execute({\n    sql: `INSERT INTO recap_images\n      (token, png_base64, content_type, byte_length, owner_email, created_at)\n      VALUES (?, ?, ?, ?, ?, ?)`,\n    args: [\n      token,\n      png.toString(\"base64\"),\n      RECAP_IMAGE_CONTENT_TYPE,\n      png.byteLength,\n      options.ownerEmail ?? null,\n      Date.now(),\n    ],\n  });\n  // Best-effort retention: expire old images so the table and the set of public\n  // image URLs stay bounded. Never let a cleanup failure fail the upload.\n  await pruneExpiredRecapImages().catch(() => {});\n  return { token };\n}\n\n/**\n * Load a stored image by token. Returns `null` for an unknown or malformed\n * token. Never returns anything but the opaque image bytes — no plan data.\n */\nexport async function getRecapImage(\n  token: string,\n): Promise<StoredRecapImage | null> {\n  if (!isValidRecapImageToken(token)) return null;\n  await ensureRecapImageTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT png_base64, content_type FROM recap_images WHERE token = ? LIMIT 1`,\n    args: [token],\n  });\n  const row = rows[0] as\n    | { png_base64?: unknown; content_type?: unknown }\n    | undefined;\n  if (!row || typeof row.png_base64 !== \"string\") return null;\n  return {\n    bytes: Buffer.from(row.png_base64, \"base64\"),\n    // Stored content type is always image/png; never trust it for response\n    // headers — the route hard-codes image/png — but surface it for callers.\n    contentType:\n      typeof row.content_type === \"string\"\n        ? row.content_type\n        : RECAP_IMAGE_CONTENT_TYPE,\n  };\n}\n"]}
+{"version":3,"file":"recap-image-store.js","sourceRoot":"","sources":["../../src/server/recap-image-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,SAAS,EACT,OAAO,EACP,UAAU,EACV,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD,iDAAiD;AACjD,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D;;;;GAIG;AACH,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAE3C,IAAI,YAAuC,CAAC;AAE5C,yEAAyE;AACzE,2EAA2E;AAC3E,6DAA6D;AAC7D,SAAS,yBAAyB;IAChC,OAAO;;;;gDAIuC,wBAAwB;wBAChD,OAAO,EAAE;;uBAEV,OAAO,EAAE;;OAEzB,CAAC;AACR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,oBAAoB,GAAG,yBAAyB,EAAE,CAAC;YACzD,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,gFAAgF;gBAChF,MAAM,iBAAiB,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,qEAAqE;YACrE,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnB,iEAAiE;YACjE,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC5C,GAAG,EAAE,+CAA+C;QACpD,IAAI,EAAE,CAAC,GAAG,GAAG,kBAAkB,CAAC;KACjC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,uBAAuB,CAAC,UAAU,GAAG,EAAE;IACrD,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,sBAAsB,CACpC,KAAgC;IAEhC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,OAAO,GAAmC,EAAE;IAE5C,IAAI,GAAG,CAAC,UAAU,GAAG,qBAAqB,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,uBAAuB,EAAE,CAAC;IACxC,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;gCAEuB;QAC5B,IAAI,EAAE;YACJ,KAAK;YACL,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACtB,wBAAwB;YACxB,GAAG,CAAC,UAAU;YACd,OAAO,CAAC,UAAU,IAAI,IAAI;YAC1B,IAAI,CAAC,GAAG,EAAE;SACX;KACF,CAAC,CAAC;IACH,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,uBAAuB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa;IAEb,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,qBAAqB,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,2EAA2E;QAChF,IAAI,EAAE,CAAC,KAAK,CAAC;KACd,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAEL,CAAC;IACd,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC;QAC5C,uEAAuE;QACvE,yEAAyE;QACzE,WAAW,EACT,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YAClC,CAAC,CAAC,GAAG,CAAC,YAAY;YAClB,CAAC,CAAC,wBAAwB;KAC/B,CAAC;AACJ,CAAC","sourcesContent":["/**\n * SQL persistence for signed, content-only recap PNG images.\n *\n * The PR visual-recap GitHub Action renders a recap plan to a PNG and uploads\n * it through `POST /_agent-native/recap-image` (authenticated with the same\n * `agent-native connect` bearer token the MCP / action surface accepts). The\n * stored bytes are then served anonymously from\n * `GET /_agent-native/recap-image/<token>.png` so GitHub's camo image proxy can\n * fetch them into a (private-repo) PR comment without a login. The interactive\n * plan itself stays login-gated; this store only ever holds opaque image bytes\n * keyed by a long, unguessable token.\n *\n * Follows the same raw-SQL pattern as observability/store.ts and usage/store.ts\n * — framework-owned tables use `getDbExec()` with dialect-agnostic\n * `CREATE TABLE IF NOT EXISTS` DDL (additive only; never drops/renames/alters)\n * rather than Drizzle ORM, which is reserved for template-level schemas. The\n * PNG is stored as base64 TEXT so it is portable across SQLite, Neon/Postgres,\n * libSQL/Turso, and D1 without per-dialect blob/bytea handling.\n */\nimport { randomBytes } from \"node:crypto\";\n\nimport {\n  getDbExec,\n  intType,\n  isPostgres,\n  retryOnDdlRace,\n} from \"../db/client.js\";\nimport { ensureTableExists } from \"../db/ddl-guard.js\";\n\n/** Maximum stored image size (~5 MB of raw PNG bytes). */\nexport const RECAP_IMAGE_MAX_BYTES = 5 * 1024 * 1024;\n\n/** Only `image/png` is ever stored or served. */\nexport const RECAP_IMAGE_CONTENT_TYPE = \"image/png\";\n\n/**\n * Stored recap images older than this are pruned on the next write (30 days).\n * Each PR push uploads a fresh screenshot under a new token; without expiry the\n * table — and the set of anonymously-fetchable image URLs — would grow without\n * bound. 30 days comfortably outlives any PR's review window.\n */\nexport const RECAP_IMAGE_TTL_MS = 30 * 24 * 60 * 60 * 1000;\n\n/**\n * Token format for the public `<token>.png` path. Hex-only so it can never\n * contain a path separator, `.`, or `..` — no directory traversal is possible\n * via the token path param.\n */\nconst TOKEN_PATTERN = /^[0-9a-f]{32,128}$/;\n\nlet _initPromise: Promise<void> | undefined;\n\n// Build the CREATE SQL lazily (not at module scope) so intType() runs at\n// RUNTIME, not import time — a module-scope call breaks any consumer whose\n// db/client mock doesn't stub intType (e.g. db-admin specs).\nfunction buildRecapImagesCreateSql(): string {\n  return `\n        CREATE TABLE IF NOT EXISTS recap_images (\n          token TEXT PRIMARY KEY,\n          png_base64 TEXT NOT NULL,\n          content_type TEXT NOT NULL DEFAULT '${RECAP_IMAGE_CONTENT_TYPE}',\n          byte_length ${intType()} NOT NULL DEFAULT 0,\n          owner_email TEXT,\n          created_at ${intType()} NOT NULL\n        )\n      `;\n}\n\nexport async function ensureRecapImageTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const recapImagesCreateSql = buildRecapImagesCreateSql();\n      if (isPostgres()) {\n        // PG guard: probe → guarded DDL → re-probe; skips lock on already-migrated path\n        await ensureTableExists(\"recap_images\", recapImagesCreateSql);\n        return;\n      }\n\n      // SQLite (local dev): no lock problem — keep the original behaviour.\n      const client = getDbExec();\n      await retryOnDdlRace(() => client.execute(recapImagesCreateSql));\n    })().catch((error) => {\n      // Allow a later call to retry if the first init lost a DDL race.\n      _initPromise = undefined;\n      throw error;\n    });\n  }\n  return _initPromise;\n}\n\n/**\n * Delete recap images older than {@link RECAP_IMAGE_TTL_MS}. Called best-effort\n * after each write so the table stays bounded. Returns the number of rows\n * removed. Dialect-agnostic (a plain `DELETE ... WHERE created_at < ?`).\n */\nexport async function pruneExpiredRecapImages(\n  now: number = Date.now(),\n): Promise<number> {\n  await ensureRecapImageTable();\n  const client = getDbExec();\n  const { rowsAffected } = await client.execute({\n    sql: `DELETE FROM recap_images WHERE created_at < ?`,\n    args: [now - RECAP_IMAGE_TTL_MS],\n  });\n  return rowsAffected;\n}\n\n/** Generate a long, unguessable lowercase-hex token (default 32 bytes → 64 hex chars). */\nexport function generateRecapImageToken(byteLength = 32): string {\n  return randomBytes(byteLength).toString(\"hex\");\n}\n\n/** True when `token` matches the strict hex token format (no traversal characters). */\nexport function isValidRecapImageToken(\n  token: string | undefined | null,\n): boolean {\n  return typeof token === \"string\" && TOKEN_PATTERN.test(token);\n}\n\nexport interface StoredRecapImage {\n  bytes: Buffer;\n  contentType: string;\n}\n\n/**\n * Store PNG bytes and return the freshly minted token. Caller is responsible\n * for enforcing the size cap before calling (we re-check defensively here too).\n */\nexport async function saveRecapImage(\n  png: Buffer,\n  options: { ownerEmail?: string | null } = {},\n): Promise<{ token: string }> {\n  if (png.byteLength > RECAP_IMAGE_MAX_BYTES) {\n    throw new Error(\"recap image exceeds maximum size\");\n  }\n  await ensureRecapImageTable();\n  const client = getDbExec();\n  const token = generateRecapImageToken();\n  await client.execute({\n    sql: `INSERT INTO recap_images\n      (token, png_base64, content_type, byte_length, owner_email, created_at)\n      VALUES (?, ?, ?, ?, ?, ?)`,\n    args: [\n      token,\n      png.toString(\"base64\"),\n      RECAP_IMAGE_CONTENT_TYPE,\n      png.byteLength,\n      options.ownerEmail ?? null,\n      Date.now(),\n    ],\n  });\n  // Best-effort retention: expire old images so the table and the set of public\n  // image URLs stay bounded. Never let a cleanup failure fail the upload.\n  await pruneExpiredRecapImages().catch(() => {});\n  return { token };\n}\n\n/**\n * Load a stored image by token. Returns `null` for an unknown or malformed\n * token. Never returns anything but the opaque image bytes — no plan data.\n */\nexport async function getRecapImage(\n  token: string,\n): Promise<StoredRecapImage | null> {\n  if (!isValidRecapImageToken(token)) return null;\n  await ensureRecapImageTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT png_base64, content_type FROM recap_images WHERE token = ? LIMIT 1`,\n    args: [token],\n  });\n  const row = rows[0] as\n    | { png_base64?: unknown; content_type?: unknown }\n    | undefined;\n  if (!row || typeof row.png_base64 !== \"string\") return null;\n  return {\n    bytes: Buffer.from(row.png_base64, \"base64\"),\n    // Stored content type is always image/png; never trust it for response\n    // headers — the route hard-codes image/png — but surface it for callers.\n    contentType:\n      typeof row.content_type === \"string\"\n        ? row.content_type\n        : RECAP_IMAGE_CONTENT_TYPE,\n  };\n}\n"]}

package/dist/server/transcribe-voice.d.ts

@@ -20,7 +20,7 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=transcribe-voice.d.ts.map

package/dist/settings/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/settings/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAStC,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AA0CD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAUzC;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,wBAAsB,cAAc,IAAI,OAAO,CAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CACxC,CAUA"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/settings/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAUtC,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAsED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAUzC;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,wBAAsB,cAAc,IAAI,OAAO,CAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CACxC,CAUA"}

package/dist/settings/store.js

@@ -1,5 +1,6 @@
 import { EventEmitter } from "events";
 import { getDbExec, isPostgres, intType } from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 let _initPromise;
 const _emitter = new EventEmitter();
@@ -14,17 +15,40 @@ async function ensureTable() {
         _initPromise = (async () => {
             const client = getDbExec();
             const table = settingsTable();
-            await client.execute(`
+            const createSql = `
         CREATE TABLE IF NOT EXISTS ${table} (
           key TEXT PRIMARY KEY,
           value TEXT NOT NULL,
           updated_at ${intType()} NOT NULL
         )
-      `);
-            // Older deployments (pre BIGINT-compat) have a 32-bit `updated_at`; on
-            // Postgres the `Date.now()` written on every setSetting overflows int4.
-            // Widen in place (no-op once done / on fresh DBs). Pass the unqualified
-            // name — the helper scopes to the `public` schema.
+      `;
+            if (isPostgres()) {
+                // Hot path: the `settings` table and its poll index are virtually
+                // always already present in production. Issuing `CREATE TABLE`/
+                // `CREATE INDEX` still takes a lock that, in a fresh background-worker
+                // process behind a concurrent connection on the shared Neon DB, can
+                // block ~indefinitely (ACCESS EXCLUSIVE for CREATE TABLE; a write-
+                // blocking SHARE lock for CREATE INDEX). `ensureTableExists` /
+                // `ensureIndexExists` probe `information_schema`/`pg_indexes` first
+                // (plain reads, no lock) and run DDL ONLY for what is actually missing,
+                // bounding any DDL with a transaction-scoped `lock_timeout`. They also
+                // re-probe after a swallowed lock-timeout and THROW if the schema is
+                // still missing, so a timed-out DDL never poisons this init memo with
+                // missing schema. `settingsTable()` is `public.settings` on Postgres;
+                // the existence checks use the unqualified table name.
+                await ensureTableExists("settings", createSql);
+                // Older deployments (pre BIGINT-compat) have a 32-bit `updated_at`; on
+                // Postgres the `Date.now()` written on every setSetting overflows int4.
+                // widenIntColumnsToBigInt already probes information_schema and only
+                // ALTERs columns that are still int4 — a no-op on fresh/widened DBs.
+                await widenIntColumnsToBigInt("settings", ["updated_at"]);
+                // Index for the poll watermark query: `SELECT MAX(updated_at)`.
+                await ensureIndexExists("settings_updated_at_idx", `CREATE INDEX IF NOT EXISTS settings_updated_at_idx ON ${table} (updated_at)`);
+                return;
+            }
+            // SQLite (local dev): no lock problem — keep the original behaviour.
+            await client.execute(createSql);
+            // No-op on SQLite (INTEGER is already 64-bit).
             await widenIntColumnsToBigInt("settings", ["updated_at"]);
             // Index for the poll watermark query: `SELECT MAX(updated_at) FROM settings`.
             // MAX on an indexed column avoids a full-table scan on every poll cycle.