@agent-native/core 0.84.28 → 0.84.30

package/dist/file-upload/actions/upload-image.d.ts

@@ -3,18 +3,18 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url?: string;
     filename?: string;
 }, {
+    id?: undefined;
     error: string;
     configured?: undefined;
     connectPath?: undefined;
     url?: undefined;
-    id?: undefined;
     provider?: undefined;
 } | {
+    id?: undefined;
     error: string;
     configured: boolean;
     connectPath: string;
     url?: undefined;
-    id?: undefined;
     provider?: undefined;
 } | {
     error?: undefined;

package/dist/notifications/routes.d.ts

@@ -13,13 +13,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;

package/dist/observability/routes.d.ts

@@ -41,28 +41,28 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    ok?: undefined;
-    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-} | {
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
+    error?: undefined;
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
-    error: any;
     id?: undefined;
+    error: any;
+    ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
-    ok: boolean;
     id?: undefined;
+    error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,11 +27,11 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};
 //# sourceMappingURL=agent-engine-api-key-route.d.ts.map

package/dist/server/analytics.d.ts

@@ -4,8 +4,8 @@
  * - `GA_MEASUREMENT_ID` — Google Analytics 4 measurement ID
  *
  * Netlify configuration-file env vars are build-time only for serverless
- * functions, so the Vite plugin also bakes this public value into SSR bundles
- * as `__AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__`.
+ * functions, so the Vite/Nitro build paths also bake this public value into
+ * SSR bundles.
  *
  * Amplitude and Sentry are initialized client-side via their npm packages
  * (see `packages/core/src/client/analytics.ts`). Only GA requires script
@@ -28,6 +28,14 @@
  * `applyDocumentCsp` in `ssr-handler.ts`).
  */
 export declare const GA_CSP_SCRIPT_HOSTS: readonly ["https://www.googletagmanager.com", "https://www.google-analytics.com"];
+/**
+ * Network/image hosts used by the GA4 loader when it sends page-view and event
+ * beacons. These are separate from `script-src`: a stricter deployment CSP with
+ * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all
+ * analytics events unless these hosts are present too.
+ */
+export declare const GA_CSP_CONNECT_HOSTS: readonly ["https://www.google-analytics.com", "https://analytics.google.com", "https://stats.g.doubleclick.net", "https://region1.google-analytics.com"];
+export declare const GA_CSP_IMG_HOSTS: readonly ["https://www.google-analytics.com", "https://www.googletagmanager.com", "https://stats.g.doubleclick.net"];
 /**
  * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
  * block injected next to the gtag.js loader. Returned so the SSR handler can

package/dist/server/analytics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAoBH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,YAC9B,kCAAkC,EAClC,kCAAkC,CAC1B,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAc3D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CA4BtE"}
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAuBH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,YAC9B,kCAAkC,EAClC,kCAAkC,CAC1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,YAC/B,kCAAkC,EAClC,8BAA8B,EAC9B,iCAAiC,EACjC,sCAAsC,CAC9B,CAAC;AAEX,eAAO,MAAM,gBAAgB,YAC3B,kCAAkC,EAClC,kCAAkC,EAClC,iCAAiC,CACzB,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAc3D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CA4BtE"}

package/dist/server/analytics.js

@@ -4,8 +4,8 @@
  * - `GA_MEASUREMENT_ID` — Google Analytics 4 measurement ID
  *
  * Netlify configuration-file env vars are build-time only for serverless
- * functions, so the Vite plugin also bakes this public value into SSR bundles
- * as `__AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__`.
+ * functions, so the Vite/Nitro build paths also bake this public value into
+ * SSR bundles.
  *
  * Amplitude and Sentry are initialized client-side via their npm packages
  * (see `packages/core/src/client/analytics.ts`). Only GA requires script
@@ -24,11 +24,15 @@ function normalizeMeasurementId(value) {
     const trimmed = value?.trim();
     return trimmed ? trimmed : null;
 }
+function getViteBakedGaMeasurementId() {
+    return typeof __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__ === "string"
+        ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__
+        : undefined;
+}
 function getGaMeasurementId() {
     return (normalizeMeasurementId(process.env.GA_MEASUREMENT_ID) ||
-        normalizeMeasurementId(typeof __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__ === "string"
-            ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__
-            : undefined));
+        normalizeMeasurementId(process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID) ||
+        normalizeMeasurementId(getViteBakedGaMeasurementId()));
 }
 /**
  * Script hosts the injected GA loader pulls executable code from. Google Tag
@@ -41,6 +45,23 @@ export const GA_CSP_SCRIPT_HOSTS = [
     "https://www.googletagmanager.com",
     "https://www.google-analytics.com",
 ];
+/**
+ * Network/image hosts used by the GA4 loader when it sends page-view and event
+ * beacons. These are separate from `script-src`: a stricter deployment CSP with
+ * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all
+ * analytics events unless these hosts are present too.
+ */
+export const GA_CSP_CONNECT_HOSTS = [
+    "https://www.google-analytics.com",
+    "https://analytics.google.com",
+    "https://stats.g.doubleclick.net",
+    "https://region1.google-analytics.com",
+];
+export const GA_CSP_IMG_HOSTS = [
+    "https://www.google-analytics.com",
+    "https://www.googletagmanager.com",
+    "https://stats.g.doubleclick.net",
+];
 /**
  * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
  * block injected next to the gtag.js loader. Returned so the SSR handler can

package/dist/server/analytics.js.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,SAAS,sBAAsB,CAAC,KAAyB;IACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,CACL,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACrD,sBAAsB,CACpB,OAAO,wCAAwC,KAAK,QAAQ;YAC1D,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,SAAS,CACd,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kCAAkC;IAClC,kCAAkC;CAC1B,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,CACL,wCAAwC;QACxC,6CAA6C;QAC7C,wBAAwB;QACxB,iBAAiB,IAAI,IAAI;QACzB,iFAAiF;QACjF,2CAA2C;QAC3C,0BAA0B;QAC1B,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,CACL,kEAAkE,KAAK,aAAa;QACpF,WAAW,UAAU,WAAW,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO,IAAI,CAAC,WAAW,CACrB,IAAI,eAAe,CAAC;QAClB,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,IAAI,QAAQ,EAAE,CAAC;gBACb,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,MAAM,QAAQ,GACZ,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACnE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Opt-in analytics injection for SSR streams.\n * Supported environment variables:\n * - `GA_MEASUREMENT_ID` — Google Analytics 4 measurement ID\n *\n * Netlify configuration-file env vars are build-time only for serverless\n * functions, so the Vite plugin also bakes this public value into SSR bundles\n * as `__AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__`.\n *\n * Amplitude and Sentry are initialized client-side via their npm packages\n * (see `packages/core/src/client/analytics.ts`). Only GA requires script\n * tag injection because the gtag.js loader must be a `<script src>`.\n *\n * When set, the corresponding script tags are injected before `</head>`.\n * When not set, the stream passes through untouched (zero overhead).\n *\n * Usage in entry.server.tsx:\n * ```ts\n * import { wrapWithAnalytics } from \"@agent-native/core/server\";\n * return new Response(wrapWithAnalytics(body), { ... });\n * ```\n */\n\ndeclare const __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: string | undefined;\n\nfunction normalizeMeasurementId(value: string | undefined): string | null {\n  const trimmed = value?.trim();\n  return trimmed ? trimmed : null;\n}\n\nfunction getGaMeasurementId(): string | null {\n  return (\n    normalizeMeasurementId(process.env.GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(\n      typeof __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__ === \"string\"\n        ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__\n        : undefined,\n    )\n  );\n}\n\n/**\n * Script hosts the injected GA loader pulls executable code from. Google Tag\n * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from\n * `www.google-analytics.com`. These must be listed in the document `script-src`\n * so the CSP reflects the code the framework itself injects (see\n * `applyDocumentCsp` in `ssr-handler.ts`).\n */\nexport const GA_CSP_SCRIPT_HOSTS = [\n  \"https://www.googletagmanager.com\",\n  \"https://www.google-analytics.com\",\n] as const;\n\n/**\n * The exact JS body (no surrounding `<script>` tags) of the inline gtag config\n * block injected next to the gtag.js loader. Returned so the SSR handler can\n * hash it for the `script-src` CSP directive — the hash must be computed from\n * the identical string that `getGaScript()` embeds, so both call this helper.\n * Returns `null` when GA is not configured.\n */\nexport function getGaInlineConfigScriptBody(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const jsId = JSON.stringify(id);\n  return (\n    `window.dataLayer=window.dataLayer||[];` +\n    `function gtag(){dataLayer.push(arguments);}` +\n    `gtag('js',new Date());` +\n    `gtag('config',${jsId});` +\n    `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +\n    `sessionStorage.removeItem('__an_signin');` +\n    `gtag('event','sign_in');` +\n    `}`\n  );\n}\n\nfunction getGaScript(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const srcId = encodeURIComponent(id);\n  const inlineBody = getGaInlineConfigScriptBody();\n  return (\n    `<script async src=\"https://www.googletagmanager.com/gtag/js?id=${srcId}\"></script>` +\n    `<script>${inlineBody}</script>`\n  );\n}\n\nexport function wrapWithAnalytics(body: ReadableStream): ReadableStream {\n  const scripts = [getGaScript()].filter(Boolean).join(\"\");\n  if (!scripts) return body;\n\n  const decoder = new TextDecoder();\n  const encoder = new TextEncoder();\n  let injected = false;\n\n  return body.pipeThrough(\n    new TransformStream({\n      transform(chunk, controller) {\n        if (injected) {\n          controller.enqueue(chunk);\n          return;\n        }\n        const text = decoder.decode(chunk, { stream: true });\n        const headCloseIdx = text.indexOf(\"</head>\");\n        if (headCloseIdx !== -1) {\n          const modified =\n            text.slice(0, headCloseIdx) + scripts + text.slice(headCloseIdx);\n          controller.enqueue(encoder.encode(modified));\n          injected = true;\n        } else {\n          controller.enqueue(chunk);\n        }\n      },\n    }),\n  );\n}\n"]}
+{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,SAAS,sBAAsB,CAAC,KAAyB;IACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,OAAO,wCAAwC,KAAK,QAAQ;QACjE,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,CACL,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACrD,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QACxE,sBAAsB,CAAC,2BAA2B,EAAE,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kCAAkC;IAClC,kCAAkC;CAC1B,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,kCAAkC;IAClC,8BAA8B;IAC9B,iCAAiC;IACjC,sCAAsC;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,kCAAkC;IAClC,kCAAkC;IAClC,iCAAiC;CACzB,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,CACL,wCAAwC;QACxC,6CAA6C;QAC7C,wBAAwB;QACxB,iBAAiB,IAAI,IAAI;QACzB,iFAAiF;QACjF,2CAA2C;QAC3C,0BAA0B;QAC1B,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,CACL,kEAAkE,KAAK,aAAa;QACpF,WAAW,UAAU,WAAW,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO,IAAI,CAAC,WAAW,CACrB,IAAI,eAAe,CAAC;QAClB,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,IAAI,QAAQ,EAAE,CAAC;gBACb,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,MAAM,QAAQ,GACZ,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACnE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Opt-in analytics injection for SSR streams.\n * Supported environment variables:\n * - `GA_MEASUREMENT_ID` — Google Analytics 4 measurement ID\n *\n * Netlify configuration-file env vars are build-time only for serverless\n * functions, so the Vite/Nitro build paths also bake this public value into\n * SSR bundles.\n *\n * Amplitude and Sentry are initialized client-side via their npm packages\n * (see `packages/core/src/client/analytics.ts`). Only GA requires script\n * tag injection because the gtag.js loader must be a `<script src>`.\n *\n * When set, the corresponding script tags are injected before `</head>`.\n * When not set, the stream passes through untouched (zero overhead).\n *\n * Usage in entry.server.tsx:\n * ```ts\n * import { wrapWithAnalytics } from \"@agent-native/core/server\";\n * return new Response(wrapWithAnalytics(body), { ... });\n * ```\n */\n\ndeclare const __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: string | undefined;\n\nfunction normalizeMeasurementId(value: string | undefined): string | null {\n  const trimmed = value?.trim();\n  return trimmed ? trimmed : null;\n}\n\nfunction getViteBakedGaMeasurementId(): string | undefined {\n  return typeof __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__ === \"string\"\n    ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__\n    : undefined;\n}\n\nfunction getGaMeasurementId(): string | null {\n  return (\n    normalizeMeasurementId(process.env.GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(getViteBakedGaMeasurementId())\n  );\n}\n\n/**\n * Script hosts the injected GA loader pulls executable code from. Google Tag\n * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from\n * `www.google-analytics.com`. These must be listed in the document `script-src`\n * so the CSP reflects the code the framework itself injects (see\n * `applyDocumentCsp` in `ssr-handler.ts`).\n */\nexport const GA_CSP_SCRIPT_HOSTS = [\n  \"https://www.googletagmanager.com\",\n  \"https://www.google-analytics.com\",\n] as const;\n\n/**\n * Network/image hosts used by the GA4 loader when it sends page-view and event\n * beacons. These are separate from `script-src`: a stricter deployment CSP with\n * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all\n * analytics events unless these hosts are present too.\n */\nexport const GA_CSP_CONNECT_HOSTS = [\n  \"https://www.google-analytics.com\",\n  \"https://analytics.google.com\",\n  \"https://stats.g.doubleclick.net\",\n  \"https://region1.google-analytics.com\",\n] as const;\n\nexport const GA_CSP_IMG_HOSTS = [\n  \"https://www.google-analytics.com\",\n  \"https://www.googletagmanager.com\",\n  \"https://stats.g.doubleclick.net\",\n] as const;\n\n/**\n * The exact JS body (no surrounding `<script>` tags) of the inline gtag config\n * block injected next to the gtag.js loader. Returned so the SSR handler can\n * hash it for the `script-src` CSP directive — the hash must be computed from\n * the identical string that `getGaScript()` embeds, so both call this helper.\n * Returns `null` when GA is not configured.\n */\nexport function getGaInlineConfigScriptBody(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const jsId = JSON.stringify(id);\n  return (\n    `window.dataLayer=window.dataLayer||[];` +\n    `function gtag(){dataLayer.push(arguments);}` +\n    `gtag('js',new Date());` +\n    `gtag('config',${jsId});` +\n    `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +\n    `sessionStorage.removeItem('__an_signin');` +\n    `gtag('event','sign_in');` +\n    `}`\n  );\n}\n\nfunction getGaScript(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const srcId = encodeURIComponent(id);\n  const inlineBody = getGaInlineConfigScriptBody();\n  return (\n    `<script async src=\"https://www.googletagmanager.com/gtag/js?id=${srcId}\"></script>` +\n    `<script>${inlineBody}</script>`\n  );\n}\n\nexport function wrapWithAnalytics(body: ReadableStream): ReadableStream {\n  const scripts = [getGaScript()].filter(Boolean).join(\"\");\n  if (!scripts) return body;\n\n  const decoder = new TextDecoder();\n  const encoder = new TextEncoder();\n  let injected = false;\n\n  return body.pipeThrough(\n    new TransformStream({\n      transform(chunk, controller) {\n        if (injected) {\n          controller.enqueue(chunk);\n          return;\n        }\n        const text = decoder.decode(chunk, { stream: true });\n        const headCloseIdx = text.indexOf(\"</head>\");\n        if (headCloseIdx !== -1) {\n          const modified =\n            text.slice(0, headCloseIdx) + scripts + text.slice(headCloseIdx);\n          controller.enqueue(encoder.encode(modified));\n          injected = true;\n        } else {\n          controller.enqueue(chunk);\n        }\n      },\n    }),\n  );\n}\n"]}

package/dist/server/ssr-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AA4CA,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAoWpC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAgE5E"}
+{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AA8CA,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AA0nBpC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAgE5E"}

package/dist/server/ssr-handler.js

@@ -19,7 +19,7 @@ import { defineEventHandler } from "h3";
 import { createRequestHandler } from "react-router";
 import { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_PATH, } from "../shared/cache-control.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
-import { GA_CSP_SCRIPT_HOSTS, getGaInlineConfigScriptBody, } from "./analytics.js";
+import { GA_CSP_CONNECT_HOSTS, GA_CSP_IMG_HOSTS, GA_CSP_SCRIPT_HOSTS, getGaInlineConfigScriptBody, } from "./analytics.js";
 import { getAppBasePathFromViteEnv, stripAppBasePath as canonicalStripAppBasePath, } from "./app-base-path.js";
 import { runWithRequestContext } from "./request-context.js";
 import { computeInlineScriptHash } from "./security-headers.js";
@@ -207,6 +207,173 @@ function extractScriptBody(scriptTag) {
         return null;
     return scriptTag.slice(start, end);
 }
+const CSP_DIRECTIVES_WITH_VALUE_TOKENS = new Set([
+    "base-uri",
+    "block-all-mixed-content",
+    "child-src",
+    "connect-src",
+    "default-src",
+    "fenced-frame-src",
+    "font-src",
+    "form-action",
+    "frame-ancestors",
+    "frame-src",
+    "img-src",
+    "manifest-src",
+    "media-src",
+    "navigate-to",
+    "object-src",
+    "plugin-types",
+    "prefetch-src",
+    "referrer",
+    "reflected-xss",
+    "require-sri-for",
+    "require-trusted-types-for",
+    "report-to",
+    "report-uri",
+    "sandbox",
+    "script-src",
+    "script-src-attr",
+    "script-src-elem",
+    "style-src",
+    "style-src-attr",
+    "style-src-elem",
+    "trusted-types",
+    "upgrade-insecure-requests",
+    "webrtc",
+    "worker-src",
+]);
+function hasCommaJoinedCspPolicies(policy) {
+    let commaIndex = policy.indexOf(",");
+    while (commaIndex !== -1) {
+        const afterComma = policy.slice(commaIndex + 1);
+        const directive = /^\s+([a-z][a-z0-9-]*)(?=\s|;|$)/i.exec(afterComma)?.[1];
+        if (directive &&
+            CSP_DIRECTIVES_WITH_VALUE_TOKENS.has(directive.toLowerCase())) {
+            return true;
+        }
+        commaIndex = policy.indexOf(",", commaIndex + 1);
+    }
+    return false;
+}
+function parseCsp(policy) {
+    return policy
+        .split(";")
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .map((part) => {
+        const [name = "", ...tokens] = part.split(/\s+/);
+        return { name: name.toLowerCase(), tokens };
+    })
+        .filter((directive) => directive.name);
+}
+function serializeCsp(directives) {
+    return directives
+        .map((directive) => [directive.name, ...directive.tokens].filter(Boolean).join(" "))
+        .join("; ");
+}
+function appendCspTokens(tokens, additions) {
+    if (!additions.length)
+        return tokens;
+    const next = tokens.filter((token) => token !== "'none'");
+    const seen = new Set(next);
+    for (const token of additions) {
+        if (!token || seen.has(token))
+            continue;
+        next.push(token);
+        seen.add(token);
+    }
+    return next;
+}
+function findCspDirective(directives, name) {
+    return directives.find((directive) => directive.name === name);
+}
+function appendToExistingOrDefaultCspDirective(directives, name, additions) {
+    if (!additions.length)
+        return;
+    const existing = findCspDirective(directives, name);
+    if (existing) {
+        existing.tokens = appendCspTokens(existing.tokens, additions);
+        return;
+    }
+    const defaultSrc = findCspDirective(directives, "default-src");
+    if (!defaultSrc)
+        return;
+    directives.push({
+        name,
+        tokens: appendCspTokens([...defaultSrc.tokens], additions),
+    });
+}
+function appendToExistingCspDirective(directives, name, additions) {
+    const existing = findCspDirective(directives, name);
+    if (!existing)
+        return;
+    existing.tokens = appendCspTokens(existing.tokens, additions);
+}
+function hasStrictNonceScriptPolicy(tokens) {
+    return tokens.some((token) => token === "'strict-dynamic'" || token.startsWith("'nonce-"));
+}
+function appendToScriptCspDirective(directives, name, additions) {
+    const existing = findCspDirective(directives, name);
+    if (existing) {
+        if (hasStrictNonceScriptPolicy(existing.tokens))
+            return false;
+        existing.tokens = appendCspTokens(existing.tokens, additions);
+        return true;
+    }
+    const defaultSrc = findCspDirective(directives, "default-src");
+    if (!defaultSrc || hasStrictNonceScriptPolicy(defaultSrc.tokens)) {
+        return false;
+    }
+    directives.push({
+        name,
+        tokens: appendCspTokens([...defaultSrc.tokens], additions),
+    });
+    return true;
+}
+function appendToEffectiveScriptElementCspDirective(directives, additions) {
+    const scriptSrcElem = findCspDirective(directives, "script-src-elem");
+    if (scriptSrcElem) {
+        if (hasStrictNonceScriptPolicy(scriptSrcElem.tokens))
+            return false;
+        scriptSrcElem.tokens = appendCspTokens(scriptSrcElem.tokens, additions);
+        return true;
+    }
+    return appendToScriptCspDirective(directives, "script-src", additions);
+}
+function augmentExistingEnforcedCspForFrameworkScripts(policy, options) {
+    // Multiple CSP headers are surfaced by Headers.get() as one comma-joined
+    // string. CSP is not a comma-list header, so serializing a parsed combined
+    // value would turn two policies into one invalid policy. Leave those headers
+    // app-owned; a comma inside a source/report URL is still safe to parse.
+    if (hasCommaJoinedCspPolicies(policy))
+        return policy;
+    const directives = parseCsp(policy);
+    if (!directives.length)
+        return policy;
+    if (options.gaEnabled) {
+        const addedScriptElement = appendToEffectiveScriptElementCspDirective(directives, options.gaScriptSrcTokens);
+        if (addedScriptElement) {
+            appendToExistingOrDefaultCspDirective(directives, "connect-src", GA_CSP_CONNECT_HOSTS);
+            appendToExistingOrDefaultCspDirective(directives, "img-src", GA_CSP_IMG_HOSTS);
+        }
+    }
+    return serializeCsp(directives);
+}
+function augmentExistingReportOnlyCspForFrameworkScripts(policy, options) {
+    if (hasCommaJoinedCspPolicies(policy))
+        return policy;
+    const directives = parseCsp(policy);
+    if (!directives.length)
+        return policy;
+    appendToExistingOrDefaultCspDirective(directives, "script-src", options.scriptSrcTokens);
+    appendToExistingCspDirective(directives, "script-src-elem", options.scriptSrcTokens);
+    if (options.gaEnabled) {
+        appendToExistingOrDefaultCspDirective(directives, "connect-src", GA_CSP_CONNECT_HOSTS);
+        appendToExistingOrDefaultCspDirective(directives, "img-src", GA_CSP_IMG_HOSTS);
+    }
+    return serializeCsp(directives);
+}
 /**
  * Apply a Content-Security-Policy header to HTML document responses.
  *
@@ -219,20 +386,28 @@ function extractScriptBody(scriptTag) {
  *     user-controlled content reaches the HTML).
  *
  * A third directive, `script-src`, is emitted via `Content-Security-Policy-
- * Report-Only` rather than enforced. The framework injects deterministic inline
- * scripts (the Sentry config block, whose hash is computed once at process
- * startup from the resolved env vars, and — when `GA_MEASUREMENT_ID` is set —
- * the gtag config block, whose hash is derived from the same string
- * `wrapWithAnalytics` embeds). It also loads Google Tag Manager / GA4 from
- * `GA_CSP_SCRIPT_HOSTS`. All of those are listed here so the report-only policy
- * reflects the code the framework itself injects instead of reporting a
- * violation on every page load. Templates additionally render a theme-init
- * inline script whose exact content varies by template (default theme param,
- * custom docs variant, etc.) and which is rendered by React Router, not this
- * handler, so its hash is not available here. Shipping script-src as
- * Report-Only surfaces the remaining violations without breaking template
- * customisations; teams can graduate to enforcement once their hashes are
- * enumerated.
+ * Report-Only` rather than enforced when the app has no existing document CSP.
+ * The framework injects deterministic inline scripts (the Sentry config block,
+ * whose hash is computed once at process startup from the resolved env vars,
+ * and — when `GA_MEASUREMENT_ID` is set — the gtag config block, whose hash is
+ * derived from the same string `wrapWithAnalytics` embeds). It also loads
+ * Google Tag Manager / GA4 from `GA_CSP_SCRIPT_HOSTS`. All of those are listed
+ * here so the report-only policy reflects the code the framework itself injects
+ * instead of reporting a violation on every page load.
+ *
+ * If an app or host already sends an enforced CSP with `script-src`,
+ * `script-src-elem`, `connect-src`, `img-src`, or `default-src`, we merge only
+ * GA-specific allowances into existing host/hash policies. Strict nonce or
+ * `strict-dynamic` script policies stay app-owned because blindly appending
+ * hashes or hosts would widen the policy without reliably loading our injected
+ * scripts.
+ *
+ * Templates additionally render a theme-init inline script whose exact content
+ * varies by template (default theme param, custom docs variant, etc.) and which
+ * is rendered by React Router, not this handler, so its hash is not available
+ * here. Shipping script-src as Report-Only surfaces the remaining violations
+ * without breaking template customisations; teams can graduate to enforcement
+ * once their hashes are enumerated.
  *
  * Skipped in development (`NODE_ENV !== 'production'`) so HMR eval and Vite
  * dev-server injects are never blocked. Set `AGENT_NATIVE_DISABLE_DOC_CSP=1`
@@ -243,12 +418,6 @@ function applyDocumentCsp(headers, sentryScript) {
         return;
     if (process.env.AGENT_NATIVE_DISABLE_DOC_CSP === "1")
         return;
-    // object-src / base-uri: enforced; neither directive mentions scripts, so
-    // they are safe even when a template's inline script hashes are unknown.
-    const existing = headers.get("content-security-policy") ?? "";
-    if (!existing) {
-        headers.set("content-security-policy", "object-src 'none'; base-uri 'self'");
-    }
     // script-src as Report-Only: list 'self', the framework-injected inline
     // script hashes (Sentry config + gtag config), and the Google Analytics /
     // Tag Manager loader hosts. These are exactly the scripts the framework
@@ -260,17 +429,33 @@ function applyDocumentCsp(headers, sentryScript) {
     const gaInlineBody = getGaInlineConfigScriptBody();
     const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;
     const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];
+    const gaScriptSrcTokens = [...(gaHash ? [gaHash] : []), ...gaHosts];
     const scriptSrcTokens = [
         "'self'",
         ...(sentryHash ? [sentryHash] : []),
         ...(gaHash ? [gaHash] : []),
         ...gaHosts,
     ];
+    const cspAugmentOptions = {
+        scriptSrcTokens,
+        gaScriptSrcTokens,
+        gaEnabled: Boolean(gaInlineBody),
+    };
+    const existing = headers.get("content-security-policy") ?? "";
+    if (!existing) {
+        headers.set("content-security-policy", "object-src 'none'; base-uri 'self'");
+    }
+    else {
+        headers.set("content-security-policy", augmentExistingEnforcedCspForFrameworkScripts(existing, cspAugmentOptions));
+    }
     const scriptSrc = `script-src ${scriptSrcTokens.join(" ")}`;
     const existingRo = headers.get("content-security-policy-report-only") ?? "";
     if (!existingRo) {
         headers.set("content-security-policy-report-only", scriptSrc);
     }
+    else {
+        headers.set("content-security-policy-report-only", augmentExistingReportOnlyCspForFrameworkScripts(existingRo, cspAugmentOptions));
+    }
 }
 function isFrameworkOrAssetPath(pathname) {
     return (pathname.startsWith("/.well-known/") ||