@agent-native/core 0.84.65 → 0.84.67

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;
@@ -41,8 +41,8 @@ export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import
  * Body: { text: string, fieldName?: string, requestSource?: string }
  */
 export declare const postCollabText: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    text?: undefined;
     ok?: undefined;
+    text?: undefined;
     error: string;
 } | {
     error?: undefined;

package/dist/file-upload/actions/upload-image.d.ts

@@ -3,18 +3,18 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url?: string;
     filename?: string;
 }, {
+    id?: undefined;
     error: string;
     configured?: undefined;
     connectPath?: undefined;
     url?: undefined;
-    id?: undefined;
     provider?: undefined;
 } | {
+    id?: undefined;
     error: string;
     configured: boolean;
     connectPath: string;
     url?: undefined;
-    id?: undefined;
     provider?: undefined;
 } | {
     error?: undefined;

package/dist/notifications/routes.d.ts

@@ -13,13 +13,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;

package/dist/observability/routes.d.ts

@@ -41,28 +41,28 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    ok?: undefined;
     error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-} | {
     ok?: undefined;
+} | {
     error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
-    error: any;
     id?: undefined;
+    error: any;
+    ok?: undefined;
 } | {
     error?: undefined;
     summary?: undefined;
     spans?: undefined;
-    ok: boolean;
     id?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -49,8 +49,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/server/analytics.d.ts

@@ -20,27 +20,9 @@
  * return new Response(wrapWithAnalytics(body), { ... });
  * ```
  */
-/**
- * Script hosts the injected GA loader pulls executable code from. Google Tag
- * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from
- * `www.google-analytics.com`. These must be listed in the document `script-src`
- * so the CSP reflects the code the framework itself injects (see
- * `applyDocumentCsp` in `ssr-handler.ts`).
- */
-export declare const GA_CSP_SCRIPT_HOSTS: readonly ["https://www.googletagmanager.com", "https://www.google-analytics.com"];
-/**
- * Network/image hosts used by the GA4 loader when it sends page-view and event
- * beacons. These are separate from `script-src`: a stricter deployment CSP with
- * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all
- * analytics events unless these hosts are present too.
- */
-export declare const GA_CSP_CONNECT_HOSTS: readonly ["https://www.google-analytics.com", "https://analytics.google.com", "https://stats.g.doubleclick.net", "https://region1.google-analytics.com"];
-export declare const GA_CSP_IMG_HOSTS: readonly ["https://www.google-analytics.com", "https://www.googletagmanager.com", "https://stats.g.doubleclick.net"];
 /**
  * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
- * block injected next to the gtag.js loader. Returned so the SSR handler can
- * hash it for the `script-src` CSP directive — the hash must be computed from
- * the identical string that `getGaScript()` embeds, so both call this helper.
+ * block injected next to the gtag.js loader.
  * Returns `null` when GA is not configured.
  */
 export declare function getGaInlineConfigScriptBody(): string | null;

package/dist/server/analytics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAuBH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,YAC9B,kCAAkC,EAClC,kCAAkC,CAC1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,YAC/B,kCAAkC,EAClC,8BAA8B,EAC9B,iCAAiC,EACjC,sCAAsC,CAC9B,CAAC;AAEX,eAAO,MAAM,gBAAgB,YAC3B,kCAAkC,EAClC,kCAAkC,EAClC,iCAAiC,CACzB,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAc3D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CA4BtE"}
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAuBH;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAc3D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CA4BtE"}

package/dist/server/analytics.js

@@ -34,39 +34,9 @@ function getGaMeasurementId() {
         normalizeMeasurementId(process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID) ||
         normalizeMeasurementId(getViteBakedGaMeasurementId()));
 }
-/**
- * Script hosts the injected GA loader pulls executable code from. Google Tag
- * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from
- * `www.google-analytics.com`. These must be listed in the document `script-src`
- * so the CSP reflects the code the framework itself injects (see
- * `applyDocumentCsp` in `ssr-handler.ts`).
- */
-export const GA_CSP_SCRIPT_HOSTS = [
-    "https://www.googletagmanager.com",
-    "https://www.google-analytics.com",
-];
-/**
- * Network/image hosts used by the GA4 loader when it sends page-view and event
- * beacons. These are separate from `script-src`: a stricter deployment CSP with
- * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all
- * analytics events unless these hosts are present too.
- */
-export const GA_CSP_CONNECT_HOSTS = [
-    "https://www.google-analytics.com",
-    "https://analytics.google.com",
-    "https://stats.g.doubleclick.net",
-    "https://region1.google-analytics.com",
-];
-export const GA_CSP_IMG_HOSTS = [
-    "https://www.google-analytics.com",
-    "https://www.googletagmanager.com",
-    "https://stats.g.doubleclick.net",
-];
 /**
  * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
- * block injected next to the gtag.js loader. Returned so the SSR handler can
- * hash it for the `script-src` CSP directive — the hash must be computed from
- * the identical string that `getGaScript()` embeds, so both call this helper.
+ * block injected next to the gtag.js loader.
  * Returns `null` when GA is not configured.
  */
 export function getGaInlineConfigScriptBody() {

package/dist/server/analytics.js.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,SAAS,sBAAsB,CAAC,KAAyB;IACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,OAAO,wCAAwC,KAAK,QAAQ;QACjE,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,CACL,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACrD,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QACxE,sBAAsB,CAAC,2BAA2B,EAAE,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kCAAkC;IAClC,kCAAkC;CAC1B,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,kCAAkC;IAClC,8BAA8B;IAC9B,iCAAiC;IACjC,sCAAsC;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,kCAAkC;IAClC,kCAAkC;IAClC,iCAAiC;CACzB,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,CACL,wCAAwC;QACxC,6CAA6C;QAC7C,wBAAwB;QACxB,iBAAiB,IAAI,IAAI;QACzB,iFAAiF;QACjF,2CAA2C;QAC3C,0BAA0B;QAC1B,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,CACL,kEAAkE,KAAK,aAAa;QACpF,WAAW,UAAU,WAAW,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO,IAAI,CAAC,WAAW,CACrB,IAAI,eAAe,CAAC;QAClB,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,IAAI,QAAQ,EAAE,CAAC;gBACb,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,MAAM,QAAQ,GACZ,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACnE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Opt-in analytics injection for SSR streams.\n * Supported environment variables:\n * - `GA_MEASUREMENT_ID` — Google Analytics 4 measurement ID\n *\n * Netlify configuration-file env vars are build-time only for serverless\n * functions, so the Vite/Nitro build paths also bake this public value into\n * SSR bundles.\n *\n * Amplitude and Sentry are initialized client-side via their npm packages\n * (see `packages/core/src/client/analytics.ts`). Only GA requires script\n * tag injection because the gtag.js loader must be a `<script src>`.\n *\n * When set, the corresponding script tags are injected before `</head>`.\n * When not set, the stream passes through untouched (zero overhead).\n *\n * Usage in entry.server.tsx:\n * ```ts\n * import { wrapWithAnalytics } from \"@agent-native/core/server\";\n * return new Response(wrapWithAnalytics(body), { ... });\n * ```\n */\n\ndeclare const __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: string | undefined;\n\nfunction normalizeMeasurementId(value: string | undefined): string | null {\n  const trimmed = value?.trim();\n  return trimmed ? trimmed : null;\n}\n\nfunction getViteBakedGaMeasurementId(): string | undefined {\n  return typeof __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__ === \"string\"\n    ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__\n    : undefined;\n}\n\nfunction getGaMeasurementId(): string | null {\n  return (\n    normalizeMeasurementId(process.env.GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(getViteBakedGaMeasurementId())\n  );\n}\n\n/**\n * Script hosts the injected GA loader pulls executable code from. Google Tag\n * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from\n * `www.google-analytics.com`. These must be listed in the document `script-src`\n * so the CSP reflects the code the framework itself injects (see\n * `applyDocumentCsp` in `ssr-handler.ts`).\n */\nexport const GA_CSP_SCRIPT_HOSTS = [\n  \"https://www.googletagmanager.com\",\n  \"https://www.google-analytics.com\",\n] as const;\n\n/**\n * Network/image hosts used by the GA4 loader when it sends page-view and event\n * beacons. These are separate from `script-src`: a stricter deployment CSP with\n * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all\n * analytics events unless these hosts are present too.\n */\nexport const GA_CSP_CONNECT_HOSTS = [\n  \"https://www.google-analytics.com\",\n  \"https://analytics.google.com\",\n  \"https://stats.g.doubleclick.net\",\n  \"https://region1.google-analytics.com\",\n] as const;\n\nexport const GA_CSP_IMG_HOSTS = [\n  \"https://www.google-analytics.com\",\n  \"https://www.googletagmanager.com\",\n  \"https://stats.g.doubleclick.net\",\n] as const;\n\n/**\n * The exact JS body (no surrounding `<script>` tags) of the inline gtag config\n * block injected next to the gtag.js loader. Returned so the SSR handler can\n * hash it for the `script-src` CSP directive — the hash must be computed from\n * the identical string that `getGaScript()` embeds, so both call this helper.\n * Returns `null` when GA is not configured.\n */\nexport function getGaInlineConfigScriptBody(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const jsId = JSON.stringify(id);\n  return (\n    `window.dataLayer=window.dataLayer||[];` +\n    `function gtag(){dataLayer.push(arguments);}` +\n    `gtag('js',new Date());` +\n    `gtag('config',${jsId});` +\n    `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +\n    `sessionStorage.removeItem('__an_signin');` +\n    `gtag('event','sign_in');` +\n    `}`\n  );\n}\n\nfunction getGaScript(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const srcId = encodeURIComponent(id);\n  const inlineBody = getGaInlineConfigScriptBody();\n  return (\n    `<script async src=\"https://www.googletagmanager.com/gtag/js?id=${srcId}\"></script>` +\n    `<script>${inlineBody}</script>`\n  );\n}\n\nexport function wrapWithAnalytics(body: ReadableStream): ReadableStream {\n  const scripts = [getGaScript()].filter(Boolean).join(\"\");\n  if (!scripts) return body;\n\n  const decoder = new TextDecoder();\n  const encoder = new TextEncoder();\n  let injected = false;\n\n  return body.pipeThrough(\n    new TransformStream({\n      transform(chunk, controller) {\n        if (injected) {\n          controller.enqueue(chunk);\n          return;\n        }\n        const text = decoder.decode(chunk, { stream: true });\n        const headCloseIdx = text.indexOf(\"</head>\");\n        if (headCloseIdx !== -1) {\n          const modified =\n            text.slice(0, headCloseIdx) + scripts + text.slice(headCloseIdx);\n          controller.enqueue(encoder.encode(modified));\n          injected = true;\n        } else {\n          controller.enqueue(chunk);\n        }\n      },\n    }),\n  );\n}\n"]}
+{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,SAAS,sBAAsB,CAAC,KAAyB;IACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,OAAO,wCAAwC,KAAK,QAAQ;QACjE,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,CACL,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACrD,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QACxE,sBAAsB,CAAC,2BAA2B,EAAE,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,CACL,wCAAwC;QACxC,6CAA6C;QAC7C,wBAAwB;QACxB,iBAAiB,IAAI,IAAI;QACzB,iFAAiF;QACjF,2CAA2C;QAC3C,0BAA0B;QAC1B,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,CACL,kEAAkE,KAAK,aAAa;QACpF,WAAW,UAAU,WAAW,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO,IAAI,CAAC,WAAW,CACrB,IAAI,eAAe,CAAC;QAClB,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,IAAI,QAAQ,EAAE,CAAC;gBACb,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,MAAM,QAAQ,GACZ,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACnE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Opt-in analytics injection for SSR streams.\n * Supported environment variables:\n * - `GA_MEASUREMENT_ID` — Google Analytics 4 measurement ID\n *\n * Netlify configuration-file env vars are build-time only for serverless\n * functions, so the Vite/Nitro build paths also bake this public value into\n * SSR bundles.\n *\n * Amplitude and Sentry are initialized client-side via their npm packages\n * (see `packages/core/src/client/analytics.ts`). Only GA requires script\n * tag injection because the gtag.js loader must be a `<script src>`.\n *\n * When set, the corresponding script tags are injected before `</head>`.\n * When not set, the stream passes through untouched (zero overhead).\n *\n * Usage in entry.server.tsx:\n * ```ts\n * import { wrapWithAnalytics } from \"@agent-native/core/server\";\n * return new Response(wrapWithAnalytics(body), { ... });\n * ```\n */\n\ndeclare const __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: string | undefined;\n\nfunction normalizeMeasurementId(value: string | undefined): string | null {\n  const trimmed = value?.trim();\n  return trimmed ? trimmed : null;\n}\n\nfunction getViteBakedGaMeasurementId(): string | undefined {\n  return typeof __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__ === \"string\"\n    ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__\n    : undefined;\n}\n\nfunction getGaMeasurementId(): string | null {\n  return (\n    normalizeMeasurementId(process.env.GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(getViteBakedGaMeasurementId())\n  );\n}\n\n/**\n * The exact JS body (no surrounding `<script>` tags) of the inline gtag config\n * block injected next to the gtag.js loader.\n * Returns `null` when GA is not configured.\n */\nexport function getGaInlineConfigScriptBody(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const jsId = JSON.stringify(id);\n  return (\n    `window.dataLayer=window.dataLayer||[];` +\n    `function gtag(){dataLayer.push(arguments);}` +\n    `gtag('js',new Date());` +\n    `gtag('config',${jsId});` +\n    `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +\n    `sessionStorage.removeItem('__an_signin');` +\n    `gtag('event','sign_in');` +\n    `}`\n  );\n}\n\nfunction getGaScript(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const srcId = encodeURIComponent(id);\n  const inlineBody = getGaInlineConfigScriptBody();\n  return (\n    `<script async src=\"https://www.googletagmanager.com/gtag/js?id=${srcId}\"></script>` +\n    `<script>${inlineBody}</script>`\n  );\n}\n\nexport function wrapWithAnalytics(body: ReadableStream): ReadableStream {\n  const scripts = [getGaScript()].filter(Boolean).join(\"\");\n  if (!scripts) return body;\n\n  const decoder = new TextDecoder();\n  const encoder = new TextEncoder();\n  let injected = false;\n\n  return body.pipeThrough(\n    new TransformStream({\n      transform(chunk, controller) {\n        if (injected) {\n          controller.enqueue(chunk);\n          return;\n        }\n        const text = decoder.decode(chunk, { stream: true });\n        const headCloseIdx = text.indexOf(\"</head>\");\n        if (headCloseIdx !== -1) {\n          const modified =\n            text.slice(0, headCloseIdx) + scripts + text.slice(headCloseIdx);\n          controller.enqueue(encoder.encode(modified));\n          injected = true;\n        } else {\n          controller.enqueue(chunk);\n        }\n      },\n    }),\n  );\n}\n"]}

package/dist/server/ssr-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AA8CA,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAooBpC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAgE5E"}
+{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAuCA,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAoSpC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAgE5E"}

package/dist/server/ssr-handler.js

@@ -19,10 +19,8 @@ import { defineEventHandler } from "h3";
 import { createRequestHandler } from "react-router";
 import { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_PATH, } from "../shared/cache-control.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
-import { GA_CSP_CONNECT_HOSTS, GA_CSP_IMG_HOSTS, GA_CSP_SCRIPT_HOSTS, getGaInlineConfigScriptBody, } from "./analytics.js";
 import { getAppBasePathFromViteEnv, stripAppBasePath as canonicalStripAppBasePath, } from "./app-base-path.js";
 import { runWithRequestContext } from "./request-context.js";
-import { computeInlineScriptHash } from "./security-headers.js";
 import { getSentryClientConfigScript } from "./sentry-config.js";
 export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, } from "../shared/cache-control.js";
 function getAppBasePath() {
@@ -192,275 +190,17 @@ function applyDefaultSpeculationRulesHeader(headers, status, basePath) {
     headers.set("speculation-rules", `"${rulesPath}"`);
 }
 /**
- * Extract the plain JS body from a `<script ...>body</script>` string.
- * Returns `null` if the input is falsy or has no recognisable `</script>` end.
- * Used to compute the sha256 hash of framework-injected inline scripts so the
- * hash can be listed in app-owned `script-src` CSP directives.
- */
-function extractScriptBody(scriptTag) {
-    if (!scriptTag)
-        return null;
-    const start = scriptTag.indexOf(">") + 1;
-    const end = scriptTag.lastIndexOf("</script>");
-    if (start <= 0 || end < start)
-        return null;
-    return scriptTag.slice(start, end);
-}
-const CSP_DIRECTIVES_WITH_VALUE_TOKENS = new Set([
-    "base-uri",
-    "block-all-mixed-content",
-    "child-src",
-    "connect-src",
-    "default-src",
-    "fenced-frame-src",
-    "font-src",
-    "form-action",
-    "frame-ancestors",
-    "frame-src",
-    "img-src",
-    "manifest-src",
-    "media-src",
-    "navigate-to",
-    "object-src",
-    "plugin-types",
-    "prefetch-src",
-    "referrer",
-    "reflected-xss",
-    "require-sri-for",
-    "require-trusted-types-for",
-    "report-to",
-    "report-uri",
-    "sandbox",
-    "script-src",
-    "script-src-attr",
-    "script-src-elem",
-    "style-src",
-    "style-src-attr",
-    "style-src-elem",
-    "trusted-types",
-    "upgrade-insecure-requests",
-    "webrtc",
-    "worker-src",
-]);
-function hasCommaJoinedCspPolicies(policy) {
-    let commaIndex = policy.indexOf(",");
-    while (commaIndex !== -1) {
-        const afterComma = policy.slice(commaIndex + 1);
-        const directive = /^\s+([a-z][a-z0-9-]*)(?=\s|;|$)/i.exec(afterComma)?.[1];
-        if (directive &&
-            CSP_DIRECTIVES_WITH_VALUE_TOKENS.has(directive.toLowerCase())) {
-            return true;
-        }
-        commaIndex = policy.indexOf(",", commaIndex + 1);
-    }
-    return false;
-}
-function parseCsp(policy) {
-    return policy
-        .split(";")
-        .map((part) => part.trim())
-        .filter(Boolean)
-        .map((part) => {
-        const [name = "", ...tokens] = part.split(/\s+/);
-        return { name: name.toLowerCase(), tokens };
-    })
-        .filter((directive) => directive.name);
-}
-function serializeCsp(directives) {
-    return directives
-        .map((directive) => [directive.name, ...directive.tokens].filter(Boolean).join(" "))
-        .join("; ");
-}
-function appendCspTokens(tokens, additions) {
-    if (!additions.length)
-        return tokens;
-    const next = tokens.filter((token) => token !== "'none'");
-    const seen = new Set(next);
-    for (const token of additions) {
-        if (!token || seen.has(token))
-            continue;
-        next.push(token);
-        seen.add(token);
-    }
-    return next;
-}
-function findCspDirective(directives, name) {
-    return directives.find((directive) => directive.name === name);
-}
-function appendToExistingOrDefaultCspDirective(directives, name, additions) {
-    if (!additions.length)
-        return;
-    const existing = findCspDirective(directives, name);
-    if (existing) {
-        existing.tokens = appendCspTokens(existing.tokens, additions);
-        return;
-    }
-    const defaultSrc = findCspDirective(directives, "default-src");
-    if (!defaultSrc)
-        return;
-    directives.push({
-        name,
-        tokens: appendCspTokens([...defaultSrc.tokens], additions),
-    });
-}
-function appendToExistingCspDirective(directives, name, additions) {
-    const existing = findCspDirective(directives, name);
-    if (!existing)
-        return;
-    existing.tokens = appendCspTokens(existing.tokens, additions);
-}
-function ensureCspDirective(directives, name, tokens) {
-    if (findCspDirective(directives, name))
-        return;
-    directives.push({ name, tokens: [...tokens] });
-}
-function hasStrictNonceScriptPolicy(tokens) {
-    return tokens.some((token) => token === "'strict-dynamic'" || token.startsWith("'nonce-"));
-}
-function appendToScriptCspDirective(directives, name, additions) {
-    const existing = findCspDirective(directives, name);
-    if (existing) {
-        if (hasStrictNonceScriptPolicy(existing.tokens))
-            return false;
-        existing.tokens = appendCspTokens(existing.tokens, additions);
-        return true;
-    }
-    const defaultSrc = findCspDirective(directives, "default-src");
-    if (!defaultSrc || hasStrictNonceScriptPolicy(defaultSrc.tokens)) {
-        return false;
-    }
-    directives.push({
-        name,
-        tokens: appendCspTokens([...defaultSrc.tokens], additions),
-    });
-    return true;
-}
-function appendToEffectiveScriptElementCspDirective(directives, additions) {
-    const scriptSrcElem = findCspDirective(directives, "script-src-elem");
-    if (scriptSrcElem) {
-        if (hasStrictNonceScriptPolicy(scriptSrcElem.tokens))
-            return false;
-        scriptSrcElem.tokens = appendCspTokens(scriptSrcElem.tokens, additions);
-        return true;
-    }
-    return appendToScriptCspDirective(directives, "script-src", additions);
-}
-function augmentExistingEnforcedCspForFrameworkScripts(policy, options) {
-    // Multiple CSP headers are surfaced by Headers.get() as one comma-joined
-    // string. CSP is not a comma-list header, so serializing a parsed combined
-    // value would turn two policies into one invalid policy. Leave those headers
-    // app-owned; a comma inside a source/report URL is still safe to parse.
-    if (hasCommaJoinedCspPolicies(policy))
-        return policy;
-    const directives = parseCsp(policy);
-    if (!directives.length)
-        return policy;
-    if (options.gaEnabled) {
-        const addedScriptElement = appendToEffectiveScriptElementCspDirective(directives, options.gaScriptSrcTokens);
-        if (addedScriptElement) {
-            appendToExistingOrDefaultCspDirective(directives, "connect-src", GA_CSP_CONNECT_HOSTS);
-            appendToExistingOrDefaultCspDirective(directives, "img-src", GA_CSP_IMG_HOSTS);
-        }
-    }
-    ensureCspDirective(directives, "object-src", ["'none'"]);
-    ensureCspDirective(directives, "base-uri", ["'self'"]);
-    return serializeCsp(directives);
-}
-function augmentExistingReportOnlyCspForFrameworkScripts(policy, options) {
-    if (hasCommaJoinedCspPolicies(policy))
-        return policy;
-    const directives = parseCsp(policy);
-    if (!directives.length)
-        return policy;
-    appendToExistingOrDefaultCspDirective(directives, "script-src", options.scriptSrcTokens);
-    appendToExistingCspDirective(directives, "script-src-elem", options.scriptSrcTokens);
-    if (options.gaEnabled) {
-        appendToExistingOrDefaultCspDirective(directives, "connect-src", GA_CSP_CONNECT_HOSTS);
-        appendToExistingOrDefaultCspDirective(directives, "img-src", GA_CSP_IMG_HOSTS);
-    }
-    return serializeCsp(directives);
-}
-/**
- * Apply a Content-Security-Policy header to HTML document responses.
- *
- * Two directives are always enforced in production:
- *
- *   - `object-src 'none'`  — disables Flash / Java / PDF plugin execution,
- *     which are a reliable code-execution vector even in modern browsers.
- *   - `base-uri 'self'`    — prevents a `<base href="...">` injection from
- *     hijacking all relative URLs in the document (a common attack target when
- *     user-controlled content reaches the HTML).
- *
- * A third directive, `script-src`, is emitted via `Content-Security-Policy-
- * Report-Only` rather than enforced when the app has no existing document CSP.
- * The framework injects inline scripts for analytics, Sentry, and template
- * setup, and hosted apps need Google Tag Manager to load without noisy CSP
- * diagnostics. The report-only policy is intentionally permissive for scripts:
- * it includes `'unsafe-inline'` plus the known GA/GTM loader hosts.
- *
- * If an app or host already sends an enforced CSP with `script-src`,
- * `script-src-elem`, `connect-src`, `img-src`, or `default-src`, we merge only
- * GA-specific allowances into existing host/hash policies. Strict nonce or
- * `strict-dynamic` script policies stay app-owned because blindly appending
- * hashes or hosts would widen the policy without reliably loading our injected
- * scripts.
- *
- * Templates additionally render a theme-init inline script whose exact content
- * varies by template (default theme param, custom docs variant, etc.) and which
- * is rendered by React Router, not this handler, so its hash is not available
- * here. Shipping script-src as Report-Only surfaces the remaining violations
- * without breaking template customisations; teams can graduate to enforcement
- * once their hashes are enumerated.
+ * Strip document-level CSP from app HTML responses.
  *
- * Skipped in development (`NODE_ENV !== 'production'`) so HMR eval and Vite
- * dev-server injects are never blocked. Set `AGENT_NATIVE_DISABLE_DOC_CSP=1`
- * to opt out in production for a template with exotic needs.
+ * Hosted templates inject framework bootstrap scripts, analytics, Sentry config,
+ * and app-owned inline scripts whose exact bytes vary by build/template. Any
+ * shared CSP header, even Report-Only, can block or noisily report Google Tag
+ * Manager and those bootstraps. Extension iframes and webviews keep their own
+ * route-specific sandboxes; normal app documents deliberately do not emit CSP.
  */
-function applyDocumentCsp(headers, sentryScript) {
-    if (process.env.NODE_ENV !== "production")
-        return;
-    if (process.env.AGENT_NATIVE_DISABLE_DOC_CSP === "1")
-        return;
-    // script-src as Report-Only: keep this deliberately loose so the framework's
-    // injected analytics and template bootstrap scripts do not look blocked in
-    // browser diagnostics.
-    const sentryBody = extractScriptBody(sentryScript);
-    const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;
-    const gaInlineBody = getGaInlineConfigScriptBody();
-    const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;
-    const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];
-    const gaScriptSrcTokens = [
-        "'unsafe-inline'",
-        ...(gaHash ? [gaHash] : []),
-        ...gaHosts,
-    ];
-    const scriptSrcTokens = [
-        "'self'",
-        "'unsafe-inline'",
-        ...(sentryHash ? [sentryHash] : []),
-        ...(gaHash ? [gaHash] : []),
-        ...gaHosts,
-    ];
-    const cspAugmentOptions = {
-        scriptSrcTokens,
-        gaScriptSrcTokens,
-        gaEnabled: Boolean(gaInlineBody),
-    };
-    const existing = headers.get("content-security-policy") ?? "";
-    if (!existing) {
-        headers.set("content-security-policy", "object-src 'none'; base-uri 'self'");
-    }
-    else {
-        headers.set("content-security-policy", augmentExistingEnforcedCspForFrameworkScripts(existing, cspAugmentOptions));
-    }
-    const scriptSrc = `script-src ${scriptSrcTokens.join(" ")}`;
-    const existingRo = headers.get("content-security-policy-report-only") ?? "";
-    if (!existingRo) {
-        headers.set("content-security-policy-report-only", scriptSrc);
-    }
-    else {
-        headers.set("content-security-policy-report-only", augmentExistingReportOnlyCspForFrameworkScripts(existingRo, cspAugmentOptions));
-    }
+function removeDocumentCsp(headers) {
+    headers.delete("content-security-policy");
+    headers.delete("content-security-policy-report-only");
 }
 function isFrameworkOrAssetPath(pathname) {
     return (pathname.startsWith("/.well-known/") ||
@@ -487,7 +227,15 @@ async function rewriteMountedResponse(response, basePath, pathname, requestUrl)
         headers.set("location", prefixMountedPath(location, basePath));
     }
     const contentType = headers.get("content-type") ?? "";
-    if (!contentType.toLowerCase().includes("text/html") || !response.body) {
+    if (!contentType.toLowerCase().includes("text/html")) {
+        return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+        });
+    }
+    removeDocumentCsp(headers);
+    if (!response.body) {
         return new Response(response.body, {
             status: response.status,
             statusText: response.statusText,
@@ -496,7 +244,6 @@ async function rewriteMountedResponse(response, basePath, pathname, requestUrl)
     }
     const html = await response.text();
     headers.delete("content-length");
-    applyDocumentCsp(headers, sentryClientConfigScript);
     return new Response(injectHeadScript(injectDefaultSocialImageMeta(prefixMountedHtml(html, basePath), defaultSocialImageUrl(requestUrl, basePath)), sentryClientConfigScript), {
         status: response.status,
         statusText: response.statusText,