@agent-native/core 0.84.66 → 0.84.67

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @agent-native/core
 
+## 0.84.67
+
+### Patch Changes
+
+- 171f6e6: Remove app document CSP headers so hosted Google Tag Manager and framework inline bootstrap scripts are not blocked or reported by a shared policy.
+
 ## 0.84.66
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.84.66",
+  "version": "0.84.67",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/server/analytics.ts

@@ -42,42 +42,9 @@ function getGaMeasurementId(): string | null {
   );
 }
 
-/**
- * Script hosts the injected GA loader pulls executable code from. Google Tag
- * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from
- * `www.google-analytics.com`. These must be listed in the document `script-src`
- * so the CSP reflects the code the framework itself injects (see
- * `applyDocumentCsp` in `ssr-handler.ts`).
- */
-export const GA_CSP_SCRIPT_HOSTS = [
-  "https://www.googletagmanager.com",
-  "https://www.google-analytics.com",
-] as const;
-
-/**
- * Network/image hosts used by the GA4 loader when it sends page-view and event
- * beacons. These are separate from `script-src`: a stricter deployment CSP with
- * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all
- * analytics events unless these hosts are present too.
- */
-export const GA_CSP_CONNECT_HOSTS = [
-  "https://www.google-analytics.com",
-  "https://analytics.google.com",
-  "https://stats.g.doubleclick.net",
-  "https://region1.google-analytics.com",
-] as const;
-
-export const GA_CSP_IMG_HOSTS = [
-  "https://www.google-analytics.com",
-  "https://www.googletagmanager.com",
-  "https://stats.g.doubleclick.net",
-] as const;
-
 /**
  * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
- * block injected next to the gtag.js loader. Returned so the SSR handler can
- * hash it for the `script-src` CSP directive — the hash must be computed from
- * the identical string that `getGaScript()` embeds, so both call this helper.
+ * block injected next to the gtag.js loader.
  * Returns `null` when GA is not configured.
  */
 export function getGaInlineConfigScriptBody(): string | null {

package/corpus/core/src/server/ssr-handler.ts

@@ -30,18 +30,11 @@ import {
   AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,
   withAgentNativeSocialImageCacheBuster,
 } from "../shared/social-meta.js";
-import {
-  GA_CSP_CONNECT_HOSTS,
-  GA_CSP_IMG_HOSTS,
-  GA_CSP_SCRIPT_HOSTS,
-  getGaInlineConfigScriptBody,
-} from "./analytics.js";
 import {
   getAppBasePathFromViteEnv,
   stripAppBasePath as canonicalStripAppBasePath,
 } from "./app-base-path.js";
 import { runWithRequestContext } from "./request-context.js";
-import { computeInlineScriptHash } from "./security-headers.js";
 import { getSentryClientConfigScript } from "./sentry-config.js";
 
 export {
@@ -258,376 +251,17 @@ function applyDefaultSpeculationRulesHeader(
 }
 
 /**
- * Extract the plain JS body from a `<script ...>body</script>` string.
- * Returns `null` if the input is falsy or has no recognisable `</script>` end.
- * Used to compute the sha256 hash of framework-injected inline scripts so the
- * hash can be listed in app-owned `script-src` CSP directives.
- */
-function extractScriptBody(scriptTag: string | null): string | null {
-  if (!scriptTag) return null;
-  const start = scriptTag.indexOf(">") + 1;
-  const end = scriptTag.lastIndexOf("</script>");
-  if (start <= 0 || end < start) return null;
-  return scriptTag.slice(start, end);
-}
-
-type CspDirective = {
-  name: string;
-  tokens: string[];
-};
-
-const CSP_DIRECTIVES_WITH_VALUE_TOKENS = new Set([
-  "base-uri",
-  "block-all-mixed-content",
-  "child-src",
-  "connect-src",
-  "default-src",
-  "fenced-frame-src",
-  "font-src",
-  "form-action",
-  "frame-ancestors",
-  "frame-src",
-  "img-src",
-  "manifest-src",
-  "media-src",
-  "navigate-to",
-  "object-src",
-  "plugin-types",
-  "prefetch-src",
-  "referrer",
-  "reflected-xss",
-  "require-sri-for",
-  "require-trusted-types-for",
-  "report-to",
-  "report-uri",
-  "sandbox",
-  "script-src",
-  "script-src-attr",
-  "script-src-elem",
-  "style-src",
-  "style-src-attr",
-  "style-src-elem",
-  "trusted-types",
-  "upgrade-insecure-requests",
-  "webrtc",
-  "worker-src",
-]);
-
-function hasCommaJoinedCspPolicies(policy: string): boolean {
-  let commaIndex = policy.indexOf(",");
-  while (commaIndex !== -1) {
-    const afterComma = policy.slice(commaIndex + 1);
-    const directive = /^\s+([a-z][a-z0-9-]*)(?=\s|;|$)/i.exec(afterComma)?.[1];
-    if (
-      directive &&
-      CSP_DIRECTIVES_WITH_VALUE_TOKENS.has(directive.toLowerCase())
-    ) {
-      return true;
-    }
-    commaIndex = policy.indexOf(",", commaIndex + 1);
-  }
-  return false;
-}
-
-function parseCsp(policy: string): CspDirective[] {
-  return policy
-    .split(";")
-    .map((part) => part.trim())
-    .filter(Boolean)
-    .map((part) => {
-      const [name = "", ...tokens] = part.split(/\s+/);
-      return { name: name.toLowerCase(), tokens };
-    })
-    .filter((directive) => directive.name);
-}
-
-function serializeCsp(directives: CspDirective[]): string {
-  return directives
-    .map((directive) =>
-      [directive.name, ...directive.tokens].filter(Boolean).join(" "),
-    )
-    .join("; ");
-}
-
-function appendCspTokens(
-  tokens: string[],
-  additions: readonly string[],
-): string[] {
-  if (!additions.length) return tokens;
-  const next = tokens.filter((token) => token !== "'none'");
-  const seen = new Set(next);
-  for (const token of additions) {
-    if (!token || seen.has(token)) continue;
-    next.push(token);
-    seen.add(token);
-  }
-  return next;
-}
-
-function findCspDirective(
-  directives: CspDirective[],
-  name: string,
-): CspDirective | undefined {
-  return directives.find((directive) => directive.name === name);
-}
-
-function appendToExistingOrDefaultCspDirective(
-  directives: CspDirective[],
-  name: string,
-  additions: readonly string[],
-): void {
-  if (!additions.length) return;
-  const existing = findCspDirective(directives, name);
-  if (existing) {
-    existing.tokens = appendCspTokens(existing.tokens, additions);
-    return;
-  }
-
-  const defaultSrc = findCspDirective(directives, "default-src");
-  if (!defaultSrc) return;
-  directives.push({
-    name,
-    tokens: appendCspTokens([...defaultSrc.tokens], additions),
-  });
-}
-
-function appendToExistingCspDirective(
-  directives: CspDirective[],
-  name: string,
-  additions: readonly string[],
-): void {
-  const existing = findCspDirective(directives, name);
-  if (!existing) return;
-  existing.tokens = appendCspTokens(existing.tokens, additions);
-}
-
-function ensureCspDirective(
-  directives: CspDirective[],
-  name: string,
-  tokens: readonly string[],
-): void {
-  if (findCspDirective(directives, name)) return;
-  directives.push({ name, tokens: [...tokens] });
-}
-
-function hasStrictNonceScriptPolicy(tokens: readonly string[]): boolean {
-  return tokens.some(
-    (token) => token === "'strict-dynamic'" || token.startsWith("'nonce-"),
-  );
-}
-
-function appendToScriptCspDirective(
-  directives: CspDirective[],
-  name: string,
-  additions: readonly string[],
-): boolean {
-  const existing = findCspDirective(directives, name);
-  if (existing) {
-    if (hasStrictNonceScriptPolicy(existing.tokens)) return false;
-    existing.tokens = appendCspTokens(existing.tokens, additions);
-    return true;
-  }
-
-  const defaultSrc = findCspDirective(directives, "default-src");
-  if (!defaultSrc || hasStrictNonceScriptPolicy(defaultSrc.tokens)) {
-    return false;
-  }
-  directives.push({
-    name,
-    tokens: appendCspTokens([...defaultSrc.tokens], additions),
-  });
-  return true;
-}
-
-function appendToEffectiveScriptElementCspDirective(
-  directives: CspDirective[],
-  additions: readonly string[],
-): boolean {
-  const scriptSrcElem = findCspDirective(directives, "script-src-elem");
-  if (scriptSrcElem) {
-    if (hasStrictNonceScriptPolicy(scriptSrcElem.tokens)) return false;
-    scriptSrcElem.tokens = appendCspTokens(scriptSrcElem.tokens, additions);
-    return true;
-  }
-
-  return appendToScriptCspDirective(directives, "script-src", additions);
-}
-
-function augmentExistingEnforcedCspForFrameworkScripts(
-  policy: string,
-  options: {
-    gaScriptSrcTokens: readonly string[];
-    gaEnabled: boolean;
-  },
-): string {
-  // Multiple CSP headers are surfaced by Headers.get() as one comma-joined
-  // string. CSP is not a comma-list header, so serializing a parsed combined
-  // value would turn two policies into one invalid policy. Leave those headers
-  // app-owned; a comma inside a source/report URL is still safe to parse.
-  if (hasCommaJoinedCspPolicies(policy)) return policy;
-
-  const directives = parseCsp(policy);
-  if (!directives.length) return policy;
-
-  if (options.gaEnabled) {
-    const addedScriptElement = appendToEffectiveScriptElementCspDirective(
-      directives,
-      options.gaScriptSrcTokens,
-    );
-    if (addedScriptElement) {
-      appendToExistingOrDefaultCspDirective(
-        directives,
-        "connect-src",
-        GA_CSP_CONNECT_HOSTS,
-      );
-      appendToExistingOrDefaultCspDirective(
-        directives,
-        "img-src",
-        GA_CSP_IMG_HOSTS,
-      );
-    }
-  }
-
-  ensureCspDirective(directives, "object-src", ["'none'"]);
-  ensureCspDirective(directives, "base-uri", ["'self'"]);
-
-  return serializeCsp(directives);
-}
-
-function augmentExistingReportOnlyCspForFrameworkScripts(
-  policy: string,
-  options: {
-    scriptSrcTokens: readonly string[];
-    gaEnabled: boolean;
-  },
-): string {
-  if (hasCommaJoinedCspPolicies(policy)) return policy;
-
-  const directives = parseCsp(policy);
-  if (!directives.length) return policy;
-
-  appendToExistingOrDefaultCspDirective(
-    directives,
-    "script-src",
-    options.scriptSrcTokens,
-  );
-  appendToExistingCspDirective(
-    directives,
-    "script-src-elem",
-    options.scriptSrcTokens,
-  );
-
-  if (options.gaEnabled) {
-    appendToExistingOrDefaultCspDirective(
-      directives,
-      "connect-src",
-      GA_CSP_CONNECT_HOSTS,
-    );
-    appendToExistingOrDefaultCspDirective(
-      directives,
-      "img-src",
-      GA_CSP_IMG_HOSTS,
-    );
-  }
-
-  return serializeCsp(directives);
-}
-
-/**
- * Apply a Content-Security-Policy header to HTML document responses.
+ * Strip document-level CSP from app HTML responses.
  *
- * Two directives are always enforced in production:
- *
- *   - `object-src 'none'`  — disables Flash / Java / PDF plugin execution,
- *     which are a reliable code-execution vector even in modern browsers.
- *   - `base-uri 'self'`    — prevents a `<base href="...">` injection from
- *     hijacking all relative URLs in the document (a common attack target when
- *     user-controlled content reaches the HTML).
- *
- * A third directive, `script-src`, is emitted via `Content-Security-Policy-
- * Report-Only` rather than enforced when the app has no existing document CSP.
- * The framework injects inline scripts for analytics, Sentry, and template
- * setup, and hosted apps need Google Tag Manager to load without noisy CSP
- * diagnostics. The report-only policy is intentionally permissive for scripts:
- * it includes `'unsafe-inline'` plus the known GA/GTM loader hosts.
- *
- * If an app or host already sends an enforced CSP with `script-src`,
- * `script-src-elem`, `connect-src`, `img-src`, or `default-src`, we merge only
- * GA-specific allowances into existing host/hash policies. Strict nonce or
- * `strict-dynamic` script policies stay app-owned because blindly appending
- * hashes or hosts would widen the policy without reliably loading our injected
- * scripts.
- *
- * Templates additionally render a theme-init inline script whose exact content
- * varies by template (default theme param, custom docs variant, etc.) and which
- * is rendered by React Router, not this handler, so its hash is not available
- * here. Shipping script-src as Report-Only surfaces the remaining violations
- * without breaking template customisations; teams can graduate to enforcement
- * once their hashes are enumerated.
- *
- * Skipped in development (`NODE_ENV !== 'production'`) so HMR eval and Vite
- * dev-server injects are never blocked. Set `AGENT_NATIVE_DISABLE_DOC_CSP=1`
- * to opt out in production for a template with exotic needs.
+ * Hosted templates inject framework bootstrap scripts, analytics, Sentry config,
+ * and app-owned inline scripts whose exact bytes vary by build/template. Any
+ * shared CSP header, even Report-Only, can block or noisily report Google Tag
+ * Manager and those bootstraps. Extension iframes and webviews keep their own
+ * route-specific sandboxes; normal app documents deliberately do not emit CSP.
  */
-function applyDocumentCsp(headers: Headers, sentryScript: string | null): void {
-  if (process.env.NODE_ENV !== "production") return;
-  if (process.env.AGENT_NATIVE_DISABLE_DOC_CSP === "1") return;
-
-  // script-src as Report-Only: keep this deliberately loose so the framework's
-  // injected analytics and template bootstrap scripts do not look blocked in
-  // browser diagnostics.
-  const sentryBody = extractScriptBody(sentryScript);
-  const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;
-  const gaInlineBody = getGaInlineConfigScriptBody();
-  const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;
-  const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];
-  const gaScriptSrcTokens = [
-    "'unsafe-inline'",
-    ...(gaHash ? [gaHash] : []),
-    ...gaHosts,
-  ];
-  const scriptSrcTokens = [
-    "'self'",
-    "'unsafe-inline'",
-    ...(sentryHash ? [sentryHash] : []),
-    ...(gaHash ? [gaHash] : []),
-    ...gaHosts,
-  ];
-
-  const cspAugmentOptions = {
-    scriptSrcTokens,
-    gaScriptSrcTokens,
-    gaEnabled: Boolean(gaInlineBody),
-  };
-  const existing = headers.get("content-security-policy") ?? "";
-  if (!existing) {
-    headers.set(
-      "content-security-policy",
-      "object-src 'none'; base-uri 'self'",
-    );
-  } else {
-    headers.set(
-      "content-security-policy",
-      augmentExistingEnforcedCspForFrameworkScripts(
-        existing,
-        cspAugmentOptions,
-      ),
-    );
-  }
-
-  const scriptSrc = `script-src ${scriptSrcTokens.join(" ")}`;
-  const existingRo = headers.get("content-security-policy-report-only") ?? "";
-  if (!existingRo) {
-    headers.set("content-security-policy-report-only", scriptSrc);
-  } else {
-    headers.set(
-      "content-security-policy-report-only",
-      augmentExistingReportOnlyCspForFrameworkScripts(
-        existingRo,
-        cspAugmentOptions,
-      ),
-    );
-  }
+function removeDocumentCsp(headers: Headers): void {
+  headers.delete("content-security-policy");
+  headers.delete("content-security-policy-report-only");
 }
 
 function isFrameworkOrAssetPath(pathname: string): boolean {
@@ -665,7 +299,15 @@ async function rewriteMountedResponse(
   }
 
   const contentType = headers.get("content-type") ?? "";
-  if (!contentType.toLowerCase().includes("text/html") || !response.body) {
+  if (!contentType.toLowerCase().includes("text/html")) {
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    });
+  }
+  removeDocumentCsp(headers);
+  if (!response.body) {
     return new Response(response.body, {
       status: response.status,
       statusText: response.statusText,
@@ -675,7 +317,6 @@ async function rewriteMountedResponse(
 
   const html = await response.text();
   headers.delete("content-length");
-  applyDocumentCsp(headers, sentryClientConfigScript);
   return new Response(
     injectHeadScript(
       injectDefaultSocialImageMeta(

package/corpus/templates/clips/server/routes/api/video/[recordingId].get.ts

@@ -349,8 +349,6 @@ function loomEmbedResponse(embedUrl: string): Response {
       "Cache-Control": "private, max-age=0, no-store",
       "Referrer-Policy": "no-referrer",
       "X-Content-Type-Options": "nosniff",
-      "Content-Security-Policy":
-        "default-src 'none'; frame-src https://www.loom.com; style-src 'unsafe-inline'",
     },
   });
 }

package/corpus/templates/forms/server/lib/public-form-ssr.ts

@@ -279,7 +279,6 @@ export async function renderPublicForm(event: H3Event) {
 
   const headers: Record<string, string> = {
     "Content-Type": "text/html; charset=utf-8",
-    "Content-Security-Policy": "frame-ancestors *",
   };
   if (status === 200) {
     // Public form SSR is anonymous HTML and follows the same framework-level

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;
@@ -42,8 +42,8 @@ export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import
  */
 export declare const postCollabText: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     ok?: undefined;
-    error: string;
     text?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/notifications/routes.d.ts

@@ -28,7 +28,7 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/observability/routes.d.ts

@@ -42,22 +42,22 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     avgEvalScore: number;
 } | {
     error?: undefined;
-    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+    ok?: undefined;
 } | {
     error?: undefined;
-    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
+    ok?: undefined;
 } | {
     error?: undefined;
     summary?: undefined;

package/dist/progress/routes.d.ts

@@ -15,7 +15,7 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -49,11 +49,11 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>;
 /** POST /_agent-native/resources/upload — upload a file as a resource */
 export declare function handleUploadResource(event: any): Promise<import("./store.js").Resource | {
@@ -73,9 +73,9 @@ export declare function handleUploadResource(event: any): Promise<import("./stor
     runId: string | null;
     expiresAt: number | null;
     metadata: string | null;
+    error?: undefined;
     url: string;
     provider: string;
-    error?: undefined;
 }>;
 export {};
 //# sourceMappingURL=handlers.d.ts.map

package/dist/server/analytics.d.ts

@@ -20,27 +20,9 @@
  * return new Response(wrapWithAnalytics(body), { ... });
  * ```
  */
-/**
- * Script hosts the injected GA loader pulls executable code from. Google Tag
- * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from
- * `www.google-analytics.com`. These must be listed in the document `script-src`
- * so the CSP reflects the code the framework itself injects (see
- * `applyDocumentCsp` in `ssr-handler.ts`).
- */
-export declare const GA_CSP_SCRIPT_HOSTS: readonly ["https://www.googletagmanager.com", "https://www.google-analytics.com"];
-/**
- * Network/image hosts used by the GA4 loader when it sends page-view and event
- * beacons. These are separate from `script-src`: a stricter deployment CSP with
- * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all
- * analytics events unless these hosts are present too.
- */
-export declare const GA_CSP_CONNECT_HOSTS: readonly ["https://www.google-analytics.com", "https://analytics.google.com", "https://stats.g.doubleclick.net", "https://region1.google-analytics.com"];
-export declare const GA_CSP_IMG_HOSTS: readonly ["https://www.google-analytics.com", "https://www.googletagmanager.com", "https://stats.g.doubleclick.net"];
 /**
  * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
- * block injected next to the gtag.js loader. Returned so the SSR handler can
- * hash it for the `script-src` CSP directive — the hash must be computed from
- * the identical string that `getGaScript()` embeds, so both call this helper.
+ * block injected next to the gtag.js loader.
  * Returns `null` when GA is not configured.
  */
 export declare function getGaInlineConfigScriptBody(): string | null;

package/dist/server/analytics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAuBH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,YAC9B,kCAAkC,EAClC,kCAAkC,CAC1B,CAAC;AAEX;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,YAC/B,kCAAkC,EAClC,8BAA8B,EAC9B,iCAAiC,EACjC,sCAAsC,CAC9B,CAAC;AAEX,eAAO,MAAM,gBAAgB,YAC3B,kCAAkC,EAClC,kCAAkC,EAClC,iCAAiC,CACzB,CAAC;AAEX;;;;;;GAMG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAc3D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CA4BtE"}
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAuBH;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,GAAG,IAAI,CAc3D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CA4BtE"}

package/dist/server/analytics.js

@@ -34,39 +34,9 @@ function getGaMeasurementId() {
         normalizeMeasurementId(process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID) ||
         normalizeMeasurementId(getViteBakedGaMeasurementId()));
 }
-/**
- * Script hosts the injected GA loader pulls executable code from. Google Tag
- * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from
- * `www.google-analytics.com`. These must be listed in the document `script-src`
- * so the CSP reflects the code the framework itself injects (see
- * `applyDocumentCsp` in `ssr-handler.ts`).
- */
-export const GA_CSP_SCRIPT_HOSTS = [
-    "https://www.googletagmanager.com",
-    "https://www.google-analytics.com",
-];
-/**
- * Network/image hosts used by the GA4 loader when it sends page-view and event
- * beacons. These are separate from `script-src`: a stricter deployment CSP with
- * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all
- * analytics events unless these hosts are present too.
- */
-export const GA_CSP_CONNECT_HOSTS = [
-    "https://www.google-analytics.com",
-    "https://analytics.google.com",
-    "https://stats.g.doubleclick.net",
-    "https://region1.google-analytics.com",
-];
-export const GA_CSP_IMG_HOSTS = [
-    "https://www.google-analytics.com",
-    "https://www.googletagmanager.com",
-    "https://stats.g.doubleclick.net",
-];
 /**
  * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
- * block injected next to the gtag.js loader. Returned so the SSR handler can
- * hash it for the `script-src` CSP directive — the hash must be computed from
- * the identical string that `getGaScript()` embeds, so both call this helper.
+ * block injected next to the gtag.js loader.
  * Returns `null` when GA is not configured.
  */
 export function getGaInlineConfigScriptBody() {

package/dist/server/analytics.js.map

@@ -1 +1 @@
-{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,SAAS,sBAAsB,CAAC,KAAyB;IACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,OAAO,wCAAwC,KAAK,QAAQ;QACjE,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,CACL,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACrD,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QACxE,sBAAsB,CAAC,2BAA2B,EAAE,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,kCAAkC;IAClC,kCAAkC;CAC1B,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,kCAAkC;IAClC,8BAA8B;IAC9B,iCAAiC;IACjC,sCAAsC;CAC9B,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,kCAAkC;IAClC,kCAAkC;IAClC,iCAAiC;CACzB,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,CACL,wCAAwC;QACxC,6CAA6C;QAC7C,wBAAwB;QACxB,iBAAiB,IAAI,IAAI;QACzB,iFAAiF;QACjF,2CAA2C;QAC3C,0BAA0B;QAC1B,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,CACL,kEAAkE,KAAK,aAAa;QACpF,WAAW,UAAU,WAAW,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO,IAAI,CAAC,WAAW,CACrB,IAAI,eAAe,CAAC;QAClB,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,IAAI,QAAQ,EAAE,CAAC;gBACb,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,MAAM,QAAQ,GACZ,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACnE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Opt-in analytics injection for SSR streams.\n * Supported environment variables:\n * - `GA_MEASUREMENT_ID` — Google Analytics 4 measurement ID\n *\n * Netlify configuration-file env vars are build-time only for serverless\n * functions, so the Vite/Nitro build paths also bake this public value into\n * SSR bundles.\n *\n * Amplitude and Sentry are initialized client-side via their npm packages\n * (see `packages/core/src/client/analytics.ts`). Only GA requires script\n * tag injection because the gtag.js loader must be a `<script src>`.\n *\n * When set, the corresponding script tags are injected before `</head>`.\n * When not set, the stream passes through untouched (zero overhead).\n *\n * Usage in entry.server.tsx:\n * ```ts\n * import { wrapWithAnalytics } from \"@agent-native/core/server\";\n * return new Response(wrapWithAnalytics(body), { ... });\n * ```\n */\n\ndeclare const __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: string | undefined;\n\nfunction normalizeMeasurementId(value: string | undefined): string | null {\n  const trimmed = value?.trim();\n  return trimmed ? trimmed : null;\n}\n\nfunction getViteBakedGaMeasurementId(): string | undefined {\n  return typeof __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__ === \"string\"\n    ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__\n    : undefined;\n}\n\nfunction getGaMeasurementId(): string | null {\n  return (\n    normalizeMeasurementId(process.env.GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(getViteBakedGaMeasurementId())\n  );\n}\n\n/**\n * Script hosts the injected GA loader pulls executable code from. Google Tag\n * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from\n * `www.google-analytics.com`. These must be listed in the document `script-src`\n * so the CSP reflects the code the framework itself injects (see\n * `applyDocumentCsp` in `ssr-handler.ts`).\n */\nexport const GA_CSP_SCRIPT_HOSTS = [\n  \"https://www.googletagmanager.com\",\n  \"https://www.google-analytics.com\",\n] as const;\n\n/**\n * Network/image hosts used by the GA4 loader when it sends page-view and event\n * beacons. These are separate from `script-src`: a stricter deployment CSP with\n * `connect-src 'self'` or `img-src 'self'` can load gtag.js but still drop all\n * analytics events unless these hosts are present too.\n */\nexport const GA_CSP_CONNECT_HOSTS = [\n  \"https://www.google-analytics.com\",\n  \"https://analytics.google.com\",\n  \"https://stats.g.doubleclick.net\",\n  \"https://region1.google-analytics.com\",\n] as const;\n\nexport const GA_CSP_IMG_HOSTS = [\n  \"https://www.google-analytics.com\",\n  \"https://www.googletagmanager.com\",\n  \"https://stats.g.doubleclick.net\",\n] as const;\n\n/**\n * The exact JS body (no surrounding `<script>` tags) of the inline gtag config\n * block injected next to the gtag.js loader. Returned so the SSR handler can\n * hash it for the `script-src` CSP directive — the hash must be computed from\n * the identical string that `getGaScript()` embeds, so both call this helper.\n * Returns `null` when GA is not configured.\n */\nexport function getGaInlineConfigScriptBody(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const jsId = JSON.stringify(id);\n  return (\n    `window.dataLayer=window.dataLayer||[];` +\n    `function gtag(){dataLayer.push(arguments);}` +\n    `gtag('js',new Date());` +\n    `gtag('config',${jsId});` +\n    `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +\n    `sessionStorage.removeItem('__an_signin');` +\n    `gtag('event','sign_in');` +\n    `}`\n  );\n}\n\nfunction getGaScript(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const srcId = encodeURIComponent(id);\n  const inlineBody = getGaInlineConfigScriptBody();\n  return (\n    `<script async src=\"https://www.googletagmanager.com/gtag/js?id=${srcId}\"></script>` +\n    `<script>${inlineBody}</script>`\n  );\n}\n\nexport function wrapWithAnalytics(body: ReadableStream): ReadableStream {\n  const scripts = [getGaScript()].filter(Boolean).join(\"\");\n  if (!scripts) return body;\n\n  const decoder = new TextDecoder();\n  const encoder = new TextEncoder();\n  let injected = false;\n\n  return body.pipeThrough(\n    new TransformStream({\n      transform(chunk, controller) {\n        if (injected) {\n          controller.enqueue(chunk);\n          return;\n        }\n        const text = decoder.decode(chunk, { stream: true });\n        const headCloseIdx = text.indexOf(\"</head>\");\n        if (headCloseIdx !== -1) {\n          const modified =\n            text.slice(0, headCloseIdx) + scripts + text.slice(headCloseIdx);\n          controller.enqueue(encoder.encode(modified));\n          injected = true;\n        } else {\n          controller.enqueue(chunk);\n        }\n      },\n    }),\n  );\n}\n"]}
+{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../../src/server/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,SAAS,sBAAsB,CAAC,KAAyB;IACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,OAAO,wCAAwC,KAAK,QAAQ;QACjE,CAAC,CAAC,wCAAwC;QAC1C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,CACL,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACrD,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QACxE,sBAAsB,CAAC,2BAA2B,EAAE,CAAC,CACtD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,CACL,wCAAwC;QACxC,6CAA6C;QAC7C,wBAAwB;QACxB,iBAAiB,IAAI,IAAI;QACzB,iFAAiF;QACjF,2CAA2C;QAC3C,0BAA0B;QAC1B,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAChC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,KAAK,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,OAAO,CACL,kEAAkE,KAAK,aAAa;QACpF,WAAW,UAAU,WAAW,CACjC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,OAAO,IAAI,CAAC,WAAW,CACrB,IAAI,eAAe,CAAC;QAClB,SAAS,CAAC,KAAK,EAAE,UAAU;YACzB,IAAI,QAAQ,EAAE,CAAC;gBACb,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC7C,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;gBACxB,MAAM,QAAQ,GACZ,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACnE,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC7C,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Opt-in analytics injection for SSR streams.\n * Supported environment variables:\n * - `GA_MEASUREMENT_ID` — Google Analytics 4 measurement ID\n *\n * Netlify configuration-file env vars are build-time only for serverless\n * functions, so the Vite/Nitro build paths also bake this public value into\n * SSR bundles.\n *\n * Amplitude and Sentry are initialized client-side via their npm packages\n * (see `packages/core/src/client/analytics.ts`). Only GA requires script\n * tag injection because the gtag.js loader must be a `<script src>`.\n *\n * When set, the corresponding script tags are injected before `</head>`.\n * When not set, the stream passes through untouched (zero overhead).\n *\n * Usage in entry.server.tsx:\n * ```ts\n * import { wrapWithAnalytics } from \"@agent-native/core/server\";\n * return new Response(wrapWithAnalytics(body), { ... });\n * ```\n */\n\ndeclare const __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__: string | undefined;\n\nfunction normalizeMeasurementId(value: string | undefined): string | null {\n  const trimmed = value?.trim();\n  return trimmed ? trimmed : null;\n}\n\nfunction getViteBakedGaMeasurementId(): string | undefined {\n  return typeof __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__ === \"string\"\n    ? __AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID__\n    : undefined;\n}\n\nfunction getGaMeasurementId(): string | null {\n  return (\n    normalizeMeasurementId(process.env.GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(process.env.AGENT_NATIVE_BUILD_GA_MEASUREMENT_ID) ||\n    normalizeMeasurementId(getViteBakedGaMeasurementId())\n  );\n}\n\n/**\n * The exact JS body (no surrounding `<script>` tags) of the inline gtag config\n * block injected next to the gtag.js loader.\n * Returns `null` when GA is not configured.\n */\nexport function getGaInlineConfigScriptBody(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const jsId = JSON.stringify(id);\n  return (\n    `window.dataLayer=window.dataLayer||[];` +\n    `function gtag(){dataLayer.push(arguments);}` +\n    `gtag('js',new Date());` +\n    `gtag('config',${jsId});` +\n    `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +\n    `sessionStorage.removeItem('__an_signin');` +\n    `gtag('event','sign_in');` +\n    `}`\n  );\n}\n\nfunction getGaScript(): string | null {\n  const id = getGaMeasurementId();\n  if (!id) return null;\n  const srcId = encodeURIComponent(id);\n  const inlineBody = getGaInlineConfigScriptBody();\n  return (\n    `<script async src=\"https://www.googletagmanager.com/gtag/js?id=${srcId}\"></script>` +\n    `<script>${inlineBody}</script>`\n  );\n}\n\nexport function wrapWithAnalytics(body: ReadableStream): ReadableStream {\n  const scripts = [getGaScript()].filter(Boolean).join(\"\");\n  if (!scripts) return body;\n\n  const decoder = new TextDecoder();\n  const encoder = new TextEncoder();\n  let injected = false;\n\n  return body.pipeThrough(\n    new TransformStream({\n      transform(chunk, controller) {\n        if (injected) {\n          controller.enqueue(chunk);\n          return;\n        }\n        const text = decoder.decode(chunk, { stream: true });\n        const headCloseIdx = text.indexOf(\"</head>\");\n        if (headCloseIdx !== -1) {\n          const modified =\n            text.slice(0, headCloseIdx) + scripts + text.slice(headCloseIdx);\n          controller.enqueue(encoder.encode(modified));\n          injected = true;\n        } else {\n          controller.enqueue(chunk);\n        }\n      },\n    }),\n  );\n}\n"]}

package/dist/server/ssr-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AA8CA,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAooBpC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAgE5E"}
+{"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAuCA,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAoSpC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAgE5E"}

package/dist/server/ssr-handler.js

@@ -19,10 +19,8 @@ import { defineEventHandler } from "h3";
 import { createRequestHandler } from "react-router";
 import { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_PATH, } from "../shared/cache-control.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
-import { GA_CSP_CONNECT_HOSTS, GA_CSP_IMG_HOSTS, GA_CSP_SCRIPT_HOSTS, getGaInlineConfigScriptBody, } from "./analytics.js";
 import { getAppBasePathFromViteEnv, stripAppBasePath as canonicalStripAppBasePath, } from "./app-base-path.js";
 import { runWithRequestContext } from "./request-context.js";
-import { computeInlineScriptHash } from "./security-headers.js";
 import { getSentryClientConfigScript } from "./sentry-config.js";
 export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, } from "../shared/cache-control.js";
 function getAppBasePath() {
@@ -192,275 +190,17 @@ function applyDefaultSpeculationRulesHeader(headers, status, basePath) {
     headers.set("speculation-rules", `"${rulesPath}"`);
 }
 /**
- * Extract the plain JS body from a `<script ...>body</script>` string.
- * Returns `null` if the input is falsy or has no recognisable `</script>` end.
- * Used to compute the sha256 hash of framework-injected inline scripts so the
- * hash can be listed in app-owned `script-src` CSP directives.
- */
-function extractScriptBody(scriptTag) {
-    if (!scriptTag)
-        return null;
-    const start = scriptTag.indexOf(">") + 1;
-    const end = scriptTag.lastIndexOf("</script>");
-    if (start <= 0 || end < start)
-        return null;
-    return scriptTag.slice(start, end);
-}
-const CSP_DIRECTIVES_WITH_VALUE_TOKENS = new Set([
-    "base-uri",
-    "block-all-mixed-content",
-    "child-src",
-    "connect-src",
-    "default-src",
-    "fenced-frame-src",
-    "font-src",
-    "form-action",
-    "frame-ancestors",
-    "frame-src",
-    "img-src",
-    "manifest-src",
-    "media-src",
-    "navigate-to",
-    "object-src",
-    "plugin-types",
-    "prefetch-src",
-    "referrer",
-    "reflected-xss",
-    "require-sri-for",
-    "require-trusted-types-for",
-    "report-to",
-    "report-uri",
-    "sandbox",
-    "script-src",
-    "script-src-attr",
-    "script-src-elem",
-    "style-src",
-    "style-src-attr",
-    "style-src-elem",
-    "trusted-types",
-    "upgrade-insecure-requests",
-    "webrtc",
-    "worker-src",
-]);
-function hasCommaJoinedCspPolicies(policy) {
-    let commaIndex = policy.indexOf(",");
-    while (commaIndex !== -1) {
-        const afterComma = policy.slice(commaIndex + 1);
-        const directive = /^\s+([a-z][a-z0-9-]*)(?=\s|;|$)/i.exec(afterComma)?.[1];
-        if (directive &&
-            CSP_DIRECTIVES_WITH_VALUE_TOKENS.has(directive.toLowerCase())) {
-            return true;
-        }
-        commaIndex = policy.indexOf(",", commaIndex + 1);
-    }
-    return false;
-}
-function parseCsp(policy) {
-    return policy
-        .split(";")
-        .map((part) => part.trim())
-        .filter(Boolean)
-        .map((part) => {
-        const [name = "", ...tokens] = part.split(/\s+/);
-        return { name: name.toLowerCase(), tokens };
-    })
-        .filter((directive) => directive.name);
-}
-function serializeCsp(directives) {
-    return directives
-        .map((directive) => [directive.name, ...directive.tokens].filter(Boolean).join(" "))
-        .join("; ");
-}
-function appendCspTokens(tokens, additions) {
-    if (!additions.length)
-        return tokens;
-    const next = tokens.filter((token) => token !== "'none'");
-    const seen = new Set(next);
-    for (const token of additions) {
-        if (!token || seen.has(token))
-            continue;
-        next.push(token);
-        seen.add(token);
-    }
-    return next;
-}
-function findCspDirective(directives, name) {
-    return directives.find((directive) => directive.name === name);
-}
-function appendToExistingOrDefaultCspDirective(directives, name, additions) {
-    if (!additions.length)
-        return;
-    const existing = findCspDirective(directives, name);
-    if (existing) {
-        existing.tokens = appendCspTokens(existing.tokens, additions);
-        return;
-    }
-    const defaultSrc = findCspDirective(directives, "default-src");
-    if (!defaultSrc)
-        return;
-    directives.push({
-        name,
-        tokens: appendCspTokens([...defaultSrc.tokens], additions),
-    });
-}
-function appendToExistingCspDirective(directives, name, additions) {
-    const existing = findCspDirective(directives, name);
-    if (!existing)
-        return;
-    existing.tokens = appendCspTokens(existing.tokens, additions);
-}
-function ensureCspDirective(directives, name, tokens) {
-    if (findCspDirective(directives, name))
-        return;
-    directives.push({ name, tokens: [...tokens] });
-}
-function hasStrictNonceScriptPolicy(tokens) {
-    return tokens.some((token) => token === "'strict-dynamic'" || token.startsWith("'nonce-"));
-}
-function appendToScriptCspDirective(directives, name, additions) {
-    const existing = findCspDirective(directives, name);
-    if (existing) {
-        if (hasStrictNonceScriptPolicy(existing.tokens))
-            return false;
-        existing.tokens = appendCspTokens(existing.tokens, additions);
-        return true;
-    }
-    const defaultSrc = findCspDirective(directives, "default-src");
-    if (!defaultSrc || hasStrictNonceScriptPolicy(defaultSrc.tokens)) {
-        return false;
-    }
-    directives.push({
-        name,
-        tokens: appendCspTokens([...defaultSrc.tokens], additions),
-    });
-    return true;
-}
-function appendToEffectiveScriptElementCspDirective(directives, additions) {
-    const scriptSrcElem = findCspDirective(directives, "script-src-elem");
-    if (scriptSrcElem) {
-        if (hasStrictNonceScriptPolicy(scriptSrcElem.tokens))
-            return false;
-        scriptSrcElem.tokens = appendCspTokens(scriptSrcElem.tokens, additions);
-        return true;
-    }
-    return appendToScriptCspDirective(directives, "script-src", additions);
-}
-function augmentExistingEnforcedCspForFrameworkScripts(policy, options) {
-    // Multiple CSP headers are surfaced by Headers.get() as one comma-joined
-    // string. CSP is not a comma-list header, so serializing a parsed combined
-    // value would turn two policies into one invalid policy. Leave those headers
-    // app-owned; a comma inside a source/report URL is still safe to parse.
-    if (hasCommaJoinedCspPolicies(policy))
-        return policy;
-    const directives = parseCsp(policy);
-    if (!directives.length)
-        return policy;
-    if (options.gaEnabled) {
-        const addedScriptElement = appendToEffectiveScriptElementCspDirective(directives, options.gaScriptSrcTokens);
-        if (addedScriptElement) {
-            appendToExistingOrDefaultCspDirective(directives, "connect-src", GA_CSP_CONNECT_HOSTS);
-            appendToExistingOrDefaultCspDirective(directives, "img-src", GA_CSP_IMG_HOSTS);
-        }
-    }
-    ensureCspDirective(directives, "object-src", ["'none'"]);
-    ensureCspDirective(directives, "base-uri", ["'self'"]);
-    return serializeCsp(directives);
-}
-function augmentExistingReportOnlyCspForFrameworkScripts(policy, options) {
-    if (hasCommaJoinedCspPolicies(policy))
-        return policy;
-    const directives = parseCsp(policy);
-    if (!directives.length)
-        return policy;
-    appendToExistingOrDefaultCspDirective(directives, "script-src", options.scriptSrcTokens);
-    appendToExistingCspDirective(directives, "script-src-elem", options.scriptSrcTokens);
-    if (options.gaEnabled) {
-        appendToExistingOrDefaultCspDirective(directives, "connect-src", GA_CSP_CONNECT_HOSTS);
-        appendToExistingOrDefaultCspDirective(directives, "img-src", GA_CSP_IMG_HOSTS);
-    }
-    return serializeCsp(directives);
-}
-/**
- * Apply a Content-Security-Policy header to HTML document responses.
- *
- * Two directives are always enforced in production:
- *
- *   - `object-src 'none'`  — disables Flash / Java / PDF plugin execution,
- *     which are a reliable code-execution vector even in modern browsers.
- *   - `base-uri 'self'`    — prevents a `<base href="...">` injection from
- *     hijacking all relative URLs in the document (a common attack target when
- *     user-controlled content reaches the HTML).
- *
- * A third directive, `script-src`, is emitted via `Content-Security-Policy-
- * Report-Only` rather than enforced when the app has no existing document CSP.
- * The framework injects inline scripts for analytics, Sentry, and template
- * setup, and hosted apps need Google Tag Manager to load without noisy CSP
- * diagnostics. The report-only policy is intentionally permissive for scripts:
- * it includes `'unsafe-inline'` plus the known GA/GTM loader hosts.
- *
- * If an app or host already sends an enforced CSP with `script-src`,
- * `script-src-elem`, `connect-src`, `img-src`, or `default-src`, we merge only
- * GA-specific allowances into existing host/hash policies. Strict nonce or
- * `strict-dynamic` script policies stay app-owned because blindly appending
- * hashes or hosts would widen the policy without reliably loading our injected
- * scripts.
- *
- * Templates additionally render a theme-init inline script whose exact content
- * varies by template (default theme param, custom docs variant, etc.) and which
- * is rendered by React Router, not this handler, so its hash is not available
- * here. Shipping script-src as Report-Only surfaces the remaining violations
- * without breaking template customisations; teams can graduate to enforcement
- * once their hashes are enumerated.
+ * Strip document-level CSP from app HTML responses.
  *
- * Skipped in development (`NODE_ENV !== 'production'`) so HMR eval and Vite
- * dev-server injects are never blocked. Set `AGENT_NATIVE_DISABLE_DOC_CSP=1`
- * to opt out in production for a template with exotic needs.
+ * Hosted templates inject framework bootstrap scripts, analytics, Sentry config,
+ * and app-owned inline scripts whose exact bytes vary by build/template. Any
+ * shared CSP header, even Report-Only, can block or noisily report Google Tag
+ * Manager and those bootstraps. Extension iframes and webviews keep their own
+ * route-specific sandboxes; normal app documents deliberately do not emit CSP.
  */
-function applyDocumentCsp(headers, sentryScript) {
-    if (process.env.NODE_ENV !== "production")
-        return;
-    if (process.env.AGENT_NATIVE_DISABLE_DOC_CSP === "1")
-        return;
-    // script-src as Report-Only: keep this deliberately loose so the framework's
-    // injected analytics and template bootstrap scripts do not look blocked in
-    // browser diagnostics.
-    const sentryBody = extractScriptBody(sentryScript);
-    const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;
-    const gaInlineBody = getGaInlineConfigScriptBody();
-    const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;
-    const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];
-    const gaScriptSrcTokens = [
-        "'unsafe-inline'",
-        ...(gaHash ? [gaHash] : []),
-        ...gaHosts,
-    ];
-    const scriptSrcTokens = [
-        "'self'",
-        "'unsafe-inline'",
-        ...(sentryHash ? [sentryHash] : []),
-        ...(gaHash ? [gaHash] : []),
-        ...gaHosts,
-    ];
-    const cspAugmentOptions = {
-        scriptSrcTokens,
-        gaScriptSrcTokens,
-        gaEnabled: Boolean(gaInlineBody),
-    };
-    const existing = headers.get("content-security-policy") ?? "";
-    if (!existing) {
-        headers.set("content-security-policy", "object-src 'none'; base-uri 'self'");
-    }
-    else {
-        headers.set("content-security-policy", augmentExistingEnforcedCspForFrameworkScripts(existing, cspAugmentOptions));
-    }
-    const scriptSrc = `script-src ${scriptSrcTokens.join(" ")}`;
-    const existingRo = headers.get("content-security-policy-report-only") ?? "";
-    if (!existingRo) {
-        headers.set("content-security-policy-report-only", scriptSrc);
-    }
-    else {
-        headers.set("content-security-policy-report-only", augmentExistingReportOnlyCspForFrameworkScripts(existingRo, cspAugmentOptions));
-    }
+function removeDocumentCsp(headers) {
+    headers.delete("content-security-policy");
+    headers.delete("content-security-policy-report-only");
 }
 function isFrameworkOrAssetPath(pathname) {
     return (pathname.startsWith("/.well-known/") ||
@@ -487,7 +227,15 @@ async function rewriteMountedResponse(response, basePath, pathname, requestUrl)
         headers.set("location", prefixMountedPath(location, basePath));
     }
     const contentType = headers.get("content-type") ?? "";
-    if (!contentType.toLowerCase().includes("text/html") || !response.body) {
+    if (!contentType.toLowerCase().includes("text/html")) {
+        return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+        });
+    }
+    removeDocumentCsp(headers);
+    if (!response.body) {
         return new Response(response.body, {
             status: response.status,
             statusText: response.statusText,
@@ -496,7 +244,6 @@ async function rewriteMountedResponse(response, basePath, pathname, requestUrl)
     }
     const html = await response.text();
     headers.delete("content-length");
-    applyDocumentCsp(headers, sentryClientConfigScript);
     return new Response(injectHeadScript(injectDefaultSocialImageMeta(prefixMountedHtml(html, basePath), defaultSocialImageUrl(requestUrl, basePath)), sentryClientConfigScript), {
         status: response.status,
         statusText: response.statusText,

package/dist/server/ssr-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACxC;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,SAAS,cAAc;IACrB,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,yBAAyB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI;SACR,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,qCAAqC,CAC1C,IAAI,GAAG,CACL,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,EAC3D,UAAU,CACX,CAAC,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,sCAAsC,QAAQ,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,iDAAiD,QAAQ,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CACP,2CAA2C,8BAA8B,IAAI,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,CACP,4CAA4C,+BAA+B,IAAI,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,6CAA6C,gCAAgC,IAAI,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,0CAA0C,6BAA6B,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,uCAAuC,QAAQ,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CACP,2CAA2C,6BAA6B,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,0BAA0B,CACjC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO;IAEhE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/C,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,SAAwB;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAOD,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAC/C,UAAU;IACV,yBAAyB;IACzB,WAAW;IACX,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,UAAU;IACV,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,SAAS;IACT,cAAc;IACd,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,cAAc;IACd,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,2BAA2B;IAC3B,WAAW;IACX,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,2BAA2B;IAC3B,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,MAAc;IAC/C,IAAI,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,kCAAkC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,IACE,SAAS;YACT,gCAAgC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAC7D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,MAAM;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,UAA0B;IAC9C,OAAO,UAAU;SACd,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACjB,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAChE;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,MAAgB,EAChB,SAA4B;IAE5B,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,UAA0B,EAC1B,IAAY;IAEZ,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,qCAAqC,CAC5C,UAA0B,EAC1B,IAAY,EACZ,SAA4B;IAE5B,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO;IAC9B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,UAAU,CAAC,IAAI,CAAC;QACd,IAAI;QACJ,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,4BAA4B,CACnC,UAA0B,EAC1B,IAAY,EACZ,SAA4B;IAE5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,UAA0B,EAC1B,IAAY,EACZ,MAAyB;IAEzB,IAAI,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC;QAAE,OAAO;IAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAyB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,kBAAkB,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,UAA0B,EAC1B,IAAY,EACZ,SAA4B;IAE5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,IAAI,0BAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,IAAI,CAAC;QACd,IAAI;QACJ,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;KAC3D,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0CAA0C,CACjD,UAA0B,EAC1B,SAA4B;IAE5B,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACtE,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,0BAA0B,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,aAAa,CAAC,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,0BAA0B,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,6CAA6C,CACpD,MAAc,EACd,OAGC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,IAAI,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAErD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEtC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,kBAAkB,GAAG,0CAA0C,CACnE,UAAU,EACV,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,IAAI,kBAAkB,EAAE,CAAC;YACvB,qCAAqC,CACnC,UAAU,EACV,aAAa,EACb,oBAAoB,CACrB,CAAC;YACF,qCAAqC,CACnC,UAAU,EACV,SAAS,EACT,gBAAgB,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEvD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,+CAA+C,CACtD,MAAc,EACd,OAGC;IAED,IAAI,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAErD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEtC,qCAAqC,CACnC,UAAU,EACV,YAAY,EACZ,OAAO,CAAC,eAAe,CACxB,CAAC;IACF,4BAA4B,CAC1B,UAAU,EACV,iBAAiB,EACjB,OAAO,CAAC,eAAe,CACxB,CAAC;IAEF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,qCAAqC,CACnC,UAAU,EACV,aAAa,EACb,oBAAoB,CACrB,CAAC;QACF,qCAAqC,CACnC,UAAU,EACV,SAAS,EACT,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAS,gBAAgB,CAAC,OAAgB,EAAE,YAA2B;IACrE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,GAAG;QAAE,OAAO;IAE7D,6EAA6E;IAC7E,2EAA2E;IAC3E,uBAAuB;IACvB,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,YAAY,GAAG,2BAA2B,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,iBAAiB,GAAG;QACxB,iBAAiB;QACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,OAAO;KACX,CAAC;IACF,MAAM,eAAe,GAAG;QACtB,QAAQ;QACR,iBAAiB;QACjB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,OAAO;KACX,CAAC;IAEF,MAAM,iBAAiB,GAAG;QACxB,eAAe;QACf,iBAAiB;QACjB,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;KACjC,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACT,yBAAyB,EACzB,oCAAoC,CACrC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,yBAAyB,EACzB,6CAA6C,CAC3C,QAAQ,EACR,iBAAiB,CAClB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,qCAAqC,EACrC,+CAA+C,CAC7C,UAAU,EACV,iBAAiB,CAClB,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,UAAkB;IAElB,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,kCAAkC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,gBAAgB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACpD,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAC1B,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACjC,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC5C,EACD,wBAAwB,CACzB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,+EAA+E;YAC/E,EAAE;YACF,gFAAgF;YAChF,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { defineEventHandler } from \"h3\";\n/**\n * Shared SSR catch-all handler for React Router framework mode.\n *\n * Templates wire this up via:\n *\n *   // server/routes/[...page].get.ts\n *   import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n *   export default createH3SSRHandler(\n *     () => import(\"virtual:react-router/server-build\"),\n *   );\n *\n * The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n */\nimport { createRequestHandler } from \"react-router\";\n\nimport {\n  DEFAULT_SSR_CACHE_HEADERS,\n  DEFAULT_SPECULATION_RULES_PATH,\n} from \"../shared/cache-control.js\";\nimport {\n  AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n  AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n  AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n  AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n  AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n  withAgentNativeSocialImageCacheBuster,\n} from \"../shared/social-meta.js\";\nimport {\n  GA_CSP_CONNECT_HOSTS,\n  GA_CSP_IMG_HOSTS,\n  GA_CSP_SCRIPT_HOSTS,\n  getGaInlineConfigScriptBody,\n} from \"./analytics.js\";\nimport {\n  getAppBasePathFromViteEnv,\n  stripAppBasePath as canonicalStripAppBasePath,\n} from \"./app-base-path.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { computeInlineScriptHash } from \"./security-headers.js\";\nimport { getSentryClientConfigScript } from \"./sentry-config.js\";\n\nexport {\n  DEFAULT_SSR_CACHE_HEADERS,\n  DEFAULT_SPECULATION_RULES_HEADER,\n  DEFAULT_SSR_CACHE_CONTROL,\n} from \"../shared/cache-control.js\";\n\nfunction getAppBasePath(): string {\n  return getAppBasePathFromViteEnv();\n}\n\nfunction stripAppBasePath(pathname: string): string {\n  return canonicalStripAppBasePath(pathname, getAppBasePath());\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n  if (!basePath) return pathname;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) {\n    return pathname.slice(basePath.length) || \"/\";\n  }\n  return pathname;\n}\n\nfunction requestWithPathname(\n  request: Request,\n  pathname: string,\n  basePath: string,\n): Request {\n  const url = new URL(request.url);\n  let changed = false;\n  if (basePath && pathname === \"/__manifest\") {\n    const paths = url.searchParams.get(\"paths\");\n    if (paths) {\n      const strippedPaths = paths\n        .split(\",\")\n        .map((path) => stripBasePath(path, basePath))\n        .join(\",\");\n      if (strippedPaths !== paths) {\n        url.searchParams.set(\"paths\", strippedPaths);\n        changed = true;\n      }\n    }\n  }\n  if (url.pathname !== pathname) {\n    url.pathname = pathname;\n    changed = true;\n  }\n  if (!changed) return request;\n  const init: RequestInit & { duplex?: \"half\" } = {\n    method: request.method,\n    headers: request.headers,\n    signal: request.signal,\n  };\n  if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n    init.body = request.body;\n    init.duplex = \"half\";\n  }\n  return new Request(url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n  if (!basePath || !path.startsWith(\"/\") || path.startsWith(\"//\")) return path;\n  if (path === basePath || path.startsWith(`${basePath}/`)) return path;\n  return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n  if (!basePath) return html;\n  return html\n    .replace(\n      /\\b(href|src|action|formaction|poster)=([\"'])(\\/(?!\\/)[^\"']*)\\2/g,\n      (_match, attr: string, quote: string, path: string) =>\n        `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n    )\n    .replace(/url\\(([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\\)/g, (_match, quote, path) => {\n      const q = quote || \"\";\n      return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n    });\n}\n\nfunction injectHeadScript(html: string, script: string | null): string {\n  if (!script) return html;\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n  return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]*\\bproperty=([\"'])og:image\\1)[^>]*>/i;\nconst TWITTER_CARD_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:card\\1)[^>]*>/i;\nconst TWITTER_IMAGE_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:image\\1)[^>]*>/i;\n\nfunction defaultSocialImageUrl(requestUrl: string, basePath: string): string {\n  return withAgentNativeSocialImageCacheBuster(\n    new URL(\n      prefixMountedPath(AGENT_NATIVE_SOCIAL_IMAGE_PATH, basePath),\n      requestUrl,\n    ).toString(),\n  );\n}\n\nfunction injectDefaultSocialImageMeta(html: string, imageUrl: string): string {\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n\n  const hasAnySocialImage =\n    OG_IMAGE_META_RE.test(html) || TWITTER_IMAGE_META_RE.test(html);\n  const tags: string[] = [];\n\n  if (!hasAnySocialImage) {\n    tags.push(`<meta property=\"og:image\" content=\"${imageUrl}\">`);\n    tags.push(`<meta property=\"og:image:secure_url\" content=\"${imageUrl}\">`);\n    tags.push(\n      `<meta property=\"og:image:type\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_TYPE}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:width\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_WIDTH}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:height\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n    );\n  }\n  if (!TWITTER_CARD_META_RE.test(html)) {\n    tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n  }\n  if (!hasAnySocialImage) {\n    tags.push(`<meta name=\"twitter:image\" content=\"${imageUrl}\">`);\n    tags.push(\n      `<meta name=\"twitter:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n    );\n  }\n\n  if (tags.length === 0) return html;\n  return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction isSsrHtmlOrDataResponse(\n  headers: Headers,\n  status: number,\n  pathname: string,\n): boolean {\n  if (status < 200 || status >= 400) return false;\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (contentType.includes(\"text/html\")) return true;\n  return pathname.endsWith(\".data\") && contentType.includes(\"text/x-script\");\n}\n\n/**\n * Apply the SSR cache policy to the response headers.\n *\n * ┌──────────────────────────────────────────────────────────────────────────┐\n * │ SSR IS A PUBLIC, HARD-CDN-CACHED SHELL — SERVED IDENTICALLY TO EVERYONE.   │\n * │                                                                            │\n * │ Every SSR HTML / React Router `.data` response gets the same public        │\n * │ stale-while-revalidate policy for ALL visitors, authenticated or not, so   │\n * │ the edge serves one shared copy and never stampedes origin.                │\n * │                                                                            │\n * │ DO NOT reintroduce per-user / cookie-based cache variation here (no        │\n * │ `private`, no `no-store`, no `Vary: Cookie`, no \"authenticated → don't     │\n * │ cache\" branch). That makes pages uncacheable for every logged-in visitor,  │\n * │ which is slow and expensive — exactly the regression this guardrail        │\n * │ prevents. The reason it is SAFE to hard-cache is that the SSR response is  │\n * │ impersonal: `createH3SSRHandler` renders without reading the request's     │\n * │ session/cookies, so there is no per-user data baked into the HTML. ALL     │\n * │ per-user state (who's logged in, private records, access checks) is        │\n * │ resolved CLIENT-SIDE after load. Keep it that way: if you need the SSR     │\n * │ output to differ per user, the fix is to move that work client-side, not   │\n * │ to disable caching here.                                                   │\n * └──────────────────────────────────────────────────────────────────────────┘\n */\nfunction applyDefaultSsrCacheHeader(\n  headers: Headers,\n  status: number,\n  pathname: string,\n) {\n  if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;\n\n  // Netlify Functions/proxies are not cached by default. Set all three cache\n  // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,\n  // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache\n  // actually serves SSR HTML/.data from the edge instead of forwarding every\n  // request to origin — for every visitor, authenticated or not.\n  for (const [name, value] of Object.entries(DEFAULT_SSR_CACHE_HEADERS)) {\n    headers.set(name, value);\n  }\n}\n\nfunction applyDefaultSpeculationRulesHeader(\n  headers: Headers,\n  status: number,\n  basePath: string,\n) {\n  if (status < 200 || status >= 400) return;\n  if (headers.has(\"speculation-rules\")) return;\n\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (!contentType.includes(\"text/html\")) return;\n\n  // Cloudflare Speed Brain injects its own Speculation-Rules header when the\n  // origin omits one. Those browser prefetches carry `Sec-Purpose: prefetch`,\n  // and Cloudflare refuses cache-ineligible dynamic pages with a 503 before\n  // the request can reach Netlify/origin. We publish an explicit no-op ruleset\n  // by default so Cloudflare does not inject its edge prefetch rules. Preserve\n  // an app-provided Speculation-Rules header above if a template deliberately\n  // owns this behavior.\n  const rulesPath = prefixMountedPath(DEFAULT_SPECULATION_RULES_PATH, basePath);\n  headers.set(\"speculation-rules\", `\"${rulesPath}\"`);\n}\n\n/**\n * Extract the plain JS body from a `<script ...>body</script>` string.\n * Returns `null` if the input is falsy or has no recognisable `</script>` end.\n * Used to compute the sha256 hash of framework-injected inline scripts so the\n * hash can be listed in app-owned `script-src` CSP directives.\n */\nfunction extractScriptBody(scriptTag: string | null): string | null {\n  if (!scriptTag) return null;\n  const start = scriptTag.indexOf(\">\") + 1;\n  const end = scriptTag.lastIndexOf(\"</script>\");\n  if (start <= 0 || end < start) return null;\n  return scriptTag.slice(start, end);\n}\n\ntype CspDirective = {\n  name: string;\n  tokens: string[];\n};\n\nconst CSP_DIRECTIVES_WITH_VALUE_TOKENS = new Set([\n  \"base-uri\",\n  \"block-all-mixed-content\",\n  \"child-src\",\n  \"connect-src\",\n  \"default-src\",\n  \"fenced-frame-src\",\n  \"font-src\",\n  \"form-action\",\n  \"frame-ancestors\",\n  \"frame-src\",\n  \"img-src\",\n  \"manifest-src\",\n  \"media-src\",\n  \"navigate-to\",\n  \"object-src\",\n  \"plugin-types\",\n  \"prefetch-src\",\n  \"referrer\",\n  \"reflected-xss\",\n  \"require-sri-for\",\n  \"require-trusted-types-for\",\n  \"report-to\",\n  \"report-uri\",\n  \"sandbox\",\n  \"script-src\",\n  \"script-src-attr\",\n  \"script-src-elem\",\n  \"style-src\",\n  \"style-src-attr\",\n  \"style-src-elem\",\n  \"trusted-types\",\n  \"upgrade-insecure-requests\",\n  \"webrtc\",\n  \"worker-src\",\n]);\n\nfunction hasCommaJoinedCspPolicies(policy: string): boolean {\n  let commaIndex = policy.indexOf(\",\");\n  while (commaIndex !== -1) {\n    const afterComma = policy.slice(commaIndex + 1);\n    const directive = /^\\s+([a-z][a-z0-9-]*)(?=\\s|;|$)/i.exec(afterComma)?.[1];\n    if (\n      directive &&\n      CSP_DIRECTIVES_WITH_VALUE_TOKENS.has(directive.toLowerCase())\n    ) {\n      return true;\n    }\n    commaIndex = policy.indexOf(\",\", commaIndex + 1);\n  }\n  return false;\n}\n\nfunction parseCsp(policy: string): CspDirective[] {\n  return policy\n    .split(\";\")\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .map((part) => {\n      const [name = \"\", ...tokens] = part.split(/\\s+/);\n      return { name: name.toLowerCase(), tokens };\n    })\n    .filter((directive) => directive.name);\n}\n\nfunction serializeCsp(directives: CspDirective[]): string {\n  return directives\n    .map((directive) =>\n      [directive.name, ...directive.tokens].filter(Boolean).join(\" \"),\n    )\n    .join(\"; \");\n}\n\nfunction appendCspTokens(\n  tokens: string[],\n  additions: readonly string[],\n): string[] {\n  if (!additions.length) return tokens;\n  const next = tokens.filter((token) => token !== \"'none'\");\n  const seen = new Set(next);\n  for (const token of additions) {\n    if (!token || seen.has(token)) continue;\n    next.push(token);\n    seen.add(token);\n  }\n  return next;\n}\n\nfunction findCspDirective(\n  directives: CspDirective[],\n  name: string,\n): CspDirective | undefined {\n  return directives.find((directive) => directive.name === name);\n}\n\nfunction appendToExistingOrDefaultCspDirective(\n  directives: CspDirective[],\n  name: string,\n  additions: readonly string[],\n): void {\n  if (!additions.length) return;\n  const existing = findCspDirective(directives, name);\n  if (existing) {\n    existing.tokens = appendCspTokens(existing.tokens, additions);\n    return;\n  }\n\n  const defaultSrc = findCspDirective(directives, \"default-src\");\n  if (!defaultSrc) return;\n  directives.push({\n    name,\n    tokens: appendCspTokens([...defaultSrc.tokens], additions),\n  });\n}\n\nfunction appendToExistingCspDirective(\n  directives: CspDirective[],\n  name: string,\n  additions: readonly string[],\n): void {\n  const existing = findCspDirective(directives, name);\n  if (!existing) return;\n  existing.tokens = appendCspTokens(existing.tokens, additions);\n}\n\nfunction ensureCspDirective(\n  directives: CspDirective[],\n  name: string,\n  tokens: readonly string[],\n): void {\n  if (findCspDirective(directives, name)) return;\n  directives.push({ name, tokens: [...tokens] });\n}\n\nfunction hasStrictNonceScriptPolicy(tokens: readonly string[]): boolean {\n  return tokens.some(\n    (token) => token === \"'strict-dynamic'\" || token.startsWith(\"'nonce-\"),\n  );\n}\n\nfunction appendToScriptCspDirective(\n  directives: CspDirective[],\n  name: string,\n  additions: readonly string[],\n): boolean {\n  const existing = findCspDirective(directives, name);\n  if (existing) {\n    if (hasStrictNonceScriptPolicy(existing.tokens)) return false;\n    existing.tokens = appendCspTokens(existing.tokens, additions);\n    return true;\n  }\n\n  const defaultSrc = findCspDirective(directives, \"default-src\");\n  if (!defaultSrc || hasStrictNonceScriptPolicy(defaultSrc.tokens)) {\n    return false;\n  }\n  directives.push({\n    name,\n    tokens: appendCspTokens([...defaultSrc.tokens], additions),\n  });\n  return true;\n}\n\nfunction appendToEffectiveScriptElementCspDirective(\n  directives: CspDirective[],\n  additions: readonly string[],\n): boolean {\n  const scriptSrcElem = findCspDirective(directives, \"script-src-elem\");\n  if (scriptSrcElem) {\n    if (hasStrictNonceScriptPolicy(scriptSrcElem.tokens)) return false;\n    scriptSrcElem.tokens = appendCspTokens(scriptSrcElem.tokens, additions);\n    return true;\n  }\n\n  return appendToScriptCspDirective(directives, \"script-src\", additions);\n}\n\nfunction augmentExistingEnforcedCspForFrameworkScripts(\n  policy: string,\n  options: {\n    gaScriptSrcTokens: readonly string[];\n    gaEnabled: boolean;\n  },\n): string {\n  // Multiple CSP headers are surfaced by Headers.get() as one comma-joined\n  // string. CSP is not a comma-list header, so serializing a parsed combined\n  // value would turn two policies into one invalid policy. Leave those headers\n  // app-owned; a comma inside a source/report URL is still safe to parse.\n  if (hasCommaJoinedCspPolicies(policy)) return policy;\n\n  const directives = parseCsp(policy);\n  if (!directives.length) return policy;\n\n  if (options.gaEnabled) {\n    const addedScriptElement = appendToEffectiveScriptElementCspDirective(\n      directives,\n      options.gaScriptSrcTokens,\n    );\n    if (addedScriptElement) {\n      appendToExistingOrDefaultCspDirective(\n        directives,\n        \"connect-src\",\n        GA_CSP_CONNECT_HOSTS,\n      );\n      appendToExistingOrDefaultCspDirective(\n        directives,\n        \"img-src\",\n        GA_CSP_IMG_HOSTS,\n      );\n    }\n  }\n\n  ensureCspDirective(directives, \"object-src\", [\"'none'\"]);\n  ensureCspDirective(directives, \"base-uri\", [\"'self'\"]);\n\n  return serializeCsp(directives);\n}\n\nfunction augmentExistingReportOnlyCspForFrameworkScripts(\n  policy: string,\n  options: {\n    scriptSrcTokens: readonly string[];\n    gaEnabled: boolean;\n  },\n): string {\n  if (hasCommaJoinedCspPolicies(policy)) return policy;\n\n  const directives = parseCsp(policy);\n  if (!directives.length) return policy;\n\n  appendToExistingOrDefaultCspDirective(\n    directives,\n    \"script-src\",\n    options.scriptSrcTokens,\n  );\n  appendToExistingCspDirective(\n    directives,\n    \"script-src-elem\",\n    options.scriptSrcTokens,\n  );\n\n  if (options.gaEnabled) {\n    appendToExistingOrDefaultCspDirective(\n      directives,\n      \"connect-src\",\n      GA_CSP_CONNECT_HOSTS,\n    );\n    appendToExistingOrDefaultCspDirective(\n      directives,\n      \"img-src\",\n      GA_CSP_IMG_HOSTS,\n    );\n  }\n\n  return serializeCsp(directives);\n}\n\n/**\n * Apply a Content-Security-Policy header to HTML document responses.\n *\n * Two directives are always enforced in production:\n *\n *   - `object-src 'none'`  — disables Flash / Java / PDF plugin execution,\n *     which are a reliable code-execution vector even in modern browsers.\n *   - `base-uri 'self'`    — prevents a `<base href=\"...\">` injection from\n *     hijacking all relative URLs in the document (a common attack target when\n *     user-controlled content reaches the HTML).\n *\n * A third directive, `script-src`, is emitted via `Content-Security-Policy-\n * Report-Only` rather than enforced when the app has no existing document CSP.\n * The framework injects inline scripts for analytics, Sentry, and template\n * setup, and hosted apps need Google Tag Manager to load without noisy CSP\n * diagnostics. The report-only policy is intentionally permissive for scripts:\n * it includes `'unsafe-inline'` plus the known GA/GTM loader hosts.\n *\n * If an app or host already sends an enforced CSP with `script-src`,\n * `script-src-elem`, `connect-src`, `img-src`, or `default-src`, we merge only\n * GA-specific allowances into existing host/hash policies. Strict nonce or\n * `strict-dynamic` script policies stay app-owned because blindly appending\n * hashes or hosts would widen the policy without reliably loading our injected\n * scripts.\n *\n * Templates additionally render a theme-init inline script whose exact content\n * varies by template (default theme param, custom docs variant, etc.) and which\n * is rendered by React Router, not this handler, so its hash is not available\n * here. Shipping script-src as Report-Only surfaces the remaining violations\n * without breaking template customisations; teams can graduate to enforcement\n * once their hashes are enumerated.\n *\n * Skipped in development (`NODE_ENV !== 'production'`) so HMR eval and Vite\n * dev-server injects are never blocked. Set `AGENT_NATIVE_DISABLE_DOC_CSP=1`\n * to opt out in production for a template with exotic needs.\n */\nfunction applyDocumentCsp(headers: Headers, sentryScript: string | null): void {\n  if (process.env.NODE_ENV !== \"production\") return;\n  if (process.env.AGENT_NATIVE_DISABLE_DOC_CSP === \"1\") return;\n\n  // script-src as Report-Only: keep this deliberately loose so the framework's\n  // injected analytics and template bootstrap scripts do not look blocked in\n  // browser diagnostics.\n  const sentryBody = extractScriptBody(sentryScript);\n  const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;\n  const gaInlineBody = getGaInlineConfigScriptBody();\n  const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;\n  const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];\n  const gaScriptSrcTokens = [\n    \"'unsafe-inline'\",\n    ...(gaHash ? [gaHash] : []),\n    ...gaHosts,\n  ];\n  const scriptSrcTokens = [\n    \"'self'\",\n    \"'unsafe-inline'\",\n    ...(sentryHash ? [sentryHash] : []),\n    ...(gaHash ? [gaHash] : []),\n    ...gaHosts,\n  ];\n\n  const cspAugmentOptions = {\n    scriptSrcTokens,\n    gaScriptSrcTokens,\n    gaEnabled: Boolean(gaInlineBody),\n  };\n  const existing = headers.get(\"content-security-policy\") ?? \"\";\n  if (!existing) {\n    headers.set(\n      \"content-security-policy\",\n      \"object-src 'none'; base-uri 'self'\",\n    );\n  } else {\n    headers.set(\n      \"content-security-policy\",\n      augmentExistingEnforcedCspForFrameworkScripts(\n        existing,\n        cspAugmentOptions,\n      ),\n    );\n  }\n\n  const scriptSrc = `script-src ${scriptSrcTokens.join(\" \")}`;\n  const existingRo = headers.get(\"content-security-policy-report-only\") ?? \"\";\n  if (!existingRo) {\n    headers.set(\"content-security-policy-report-only\", scriptSrc);\n  } else {\n    headers.set(\n      \"content-security-policy-report-only\",\n      augmentExistingReportOnlyCspForFrameworkScripts(\n        existingRo,\n        cspAugmentOptions,\n      ),\n    );\n  }\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/.well-known/\") ||\n    pathname.startsWith(\"/_agent_native/\") ||\n    pathname.startsWith(\"/_agent-native/\") ||\n    pathname.startsWith(\"/api/\") ||\n    pathname.startsWith(\"/@vite/\") ||\n    pathname.startsWith(\"/@id/\") ||\n    pathname.startsWith(\"/@fs/\") ||\n    pathname === \"/@react-refresh\" ||\n    pathname === \"/__vite_ping\" ||\n    pathname === \"/__open-in-editor\" ||\n    pathname === \"/favicon.ico\" ||\n    pathname === \"/favicon.png\" ||\n    (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n  );\n}\n\nasync function rewriteMountedResponse(\n  response: Response,\n  basePath: string,\n  pathname: string,\n  requestUrl: string,\n): Promise<Response> {\n  const sentryClientConfigScript = getSentryClientConfigScript();\n  const headers = new Headers(response.headers);\n  applyDefaultSsrCacheHeader(headers, response.status, pathname);\n  applyDefaultSpeculationRulesHeader(headers, response.status, basePath);\n\n  const location = headers.get(\"location\");\n  if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n    headers.set(\"location\", prefixMountedPath(location, basePath));\n  }\n\n  const contentType = headers.get(\"content-type\") ?? \"\";\n  if (!contentType.toLowerCase().includes(\"text/html\") || !response.body) {\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  const html = await response.text();\n  headers.delete(\"content-length\");\n  applyDocumentCsp(headers, sentryClientConfigScript);\n  return new Response(\n    injectHeadScript(\n      injectDefaultSocialImageMeta(\n        prefixMountedHtml(html, basePath),\n        defaultSocialImageUrl(requestUrl, basePath),\n      ),\n      sentryClientConfigScript,\n    ),\n    {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    },\n  );\n}\n\n/**\n * Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> | unknown) {\n  const handler = createRequestHandler(getBuild as any);\n  return defineEventHandler(async (event) => {\n    const basePath = getAppBasePath();\n    const p = stripAppBasePath(event.url.pathname);\n    if (isFrameworkOrAssetPath(p)) {\n      return new Response(null, { status: 404 });\n    }\n    try {\n      const request = requestWithPathname(event.req as Request, p, basePath);\n      // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the\n      // request's session/cookies here, and pin an explicitly anonymous request\n      // context. That keeps the SSR HTML/.data identical for every visitor so it\n      // can be hard-cached at the CDN for everyone (see applyDefaultSsrCacheHeader).\n      //\n      // Consequence: SSR loaders that call `getRequestUserEmail()` / `accessFilter()`\n      // always see the unauthenticated branch and render public content only. Any\n      // per-user view (private records, share-grant access, who's logged in) MUST\n      // be resolved CLIENT-SIDE after load, never baked into SSR. Do not re-pin the\n      // session here to \"fix\" a per-user page — that silently makes the page\n      // uncacheable and/or leaks one user's data into another's cached copy.\n      const ctx = { userEmail: undefined, orgId: undefined };\n      if (request.method === \"HEAD\") {\n        const getRequest = new Request(request.url, {\n          method: \"GET\",\n          headers: request.headers,\n          signal: request.signal,\n        });\n        const response = await runWithRequestContext(ctx, () =>\n          handler(getRequest),\n        );\n        return await rewriteMountedResponse(\n          new Response(null, {\n            status: response.status,\n            statusText: response.statusText,\n            headers: response.headers,\n          }),\n          basePath,\n          p,\n          request.url,\n        );\n      }\n      return await rewriteMountedResponse(\n        await runWithRequestContext(ctx, () => handler(request)),\n        basePath,\n        p,\n        request.url,\n      );\n    } catch (err) {\n      // Log the full stack server-side, but never leak it to the client.\n      // Stack traces expose file paths, library versions, and code structure\n      // that aid reconnaissance attacks. In dev we surface the message text\n      // so devtools shows something useful; in prod we return a bare 500.\n      console.error(\"[ssr-handler] SSR error:\", err);\n      const isProd = process.env.NODE_ENV === \"production\";\n      const body = isProd\n        ? \"Internal Server Error\"\n        : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n      return new Response(body, {\n        status: 500,\n        headers: { \"content-type\": \"text/plain\" },\n      });\n    }\n  });\n}\n"]}
+{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACxC;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,SAAS,cAAc;IACrB,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,yBAAyB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI;SACR,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,qCAAqC,CAC1C,IAAI,GAAG,CACL,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,EAC3D,UAAU,CACX,CAAC,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,sCAAsC,QAAQ,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,iDAAiD,QAAQ,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CACP,2CAA2C,8BAA8B,IAAI,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,CACP,4CAA4C,+BAA+B,IAAI,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,6CAA6C,gCAAgC,IAAI,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,0CAA0C,6BAA6B,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,uCAAuC,QAAQ,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CACP,2CAA2C,6BAA6B,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,0BAA0B,CACjC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO;IAEhE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/C,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,UAAkB;IAElB,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,kCAAkC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAC1B,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACjC,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC5C,EACD,wBAAwB,CACzB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,+EAA+E;YAC/E,EAAE;YACF,gFAAgF;YAChF,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { defineEventHandler } from \"h3\";\n/**\n * Shared SSR catch-all handler for React Router framework mode.\n *\n * Templates wire this up via:\n *\n *   // server/routes/[...page].get.ts\n *   import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n *   export default createH3SSRHandler(\n *     () => import(\"virtual:react-router/server-build\"),\n *   );\n *\n * The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n */\nimport { createRequestHandler } from \"react-router\";\n\nimport {\n  DEFAULT_SSR_CACHE_HEADERS,\n  DEFAULT_SPECULATION_RULES_PATH,\n} from \"../shared/cache-control.js\";\nimport {\n  AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n  AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n  AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n  AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n  AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n  withAgentNativeSocialImageCacheBuster,\n} from \"../shared/social-meta.js\";\nimport {\n  getAppBasePathFromViteEnv,\n  stripAppBasePath as canonicalStripAppBasePath,\n} from \"./app-base-path.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { getSentryClientConfigScript } from \"./sentry-config.js\";\n\nexport {\n  DEFAULT_SSR_CACHE_HEADERS,\n  DEFAULT_SPECULATION_RULES_HEADER,\n  DEFAULT_SSR_CACHE_CONTROL,\n} from \"../shared/cache-control.js\";\n\nfunction getAppBasePath(): string {\n  return getAppBasePathFromViteEnv();\n}\n\nfunction stripAppBasePath(pathname: string): string {\n  return canonicalStripAppBasePath(pathname, getAppBasePath());\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n  if (!basePath) return pathname;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) {\n    return pathname.slice(basePath.length) || \"/\";\n  }\n  return pathname;\n}\n\nfunction requestWithPathname(\n  request: Request,\n  pathname: string,\n  basePath: string,\n): Request {\n  const url = new URL(request.url);\n  let changed = false;\n  if (basePath && pathname === \"/__manifest\") {\n    const paths = url.searchParams.get(\"paths\");\n    if (paths) {\n      const strippedPaths = paths\n        .split(\",\")\n        .map((path) => stripBasePath(path, basePath))\n        .join(\",\");\n      if (strippedPaths !== paths) {\n        url.searchParams.set(\"paths\", strippedPaths);\n        changed = true;\n      }\n    }\n  }\n  if (url.pathname !== pathname) {\n    url.pathname = pathname;\n    changed = true;\n  }\n  if (!changed) return request;\n  const init: RequestInit & { duplex?: \"half\" } = {\n    method: request.method,\n    headers: request.headers,\n    signal: request.signal,\n  };\n  if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n    init.body = request.body;\n    init.duplex = \"half\";\n  }\n  return new Request(url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n  if (!basePath || !path.startsWith(\"/\") || path.startsWith(\"//\")) return path;\n  if (path === basePath || path.startsWith(`${basePath}/`)) return path;\n  return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n  if (!basePath) return html;\n  return html\n    .replace(\n      /\\b(href|src|action|formaction|poster)=([\"'])(\\/(?!\\/)[^\"']*)\\2/g,\n      (_match, attr: string, quote: string, path: string) =>\n        `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n    )\n    .replace(/url\\(([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\\)/g, (_match, quote, path) => {\n      const q = quote || \"\";\n      return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n    });\n}\n\nfunction injectHeadScript(html: string, script: string | null): string {\n  if (!script) return html;\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n  return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]*\\bproperty=([\"'])og:image\\1)[^>]*>/i;\nconst TWITTER_CARD_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:card\\1)[^>]*>/i;\nconst TWITTER_IMAGE_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:image\\1)[^>]*>/i;\n\nfunction defaultSocialImageUrl(requestUrl: string, basePath: string): string {\n  return withAgentNativeSocialImageCacheBuster(\n    new URL(\n      prefixMountedPath(AGENT_NATIVE_SOCIAL_IMAGE_PATH, basePath),\n      requestUrl,\n    ).toString(),\n  );\n}\n\nfunction injectDefaultSocialImageMeta(html: string, imageUrl: string): string {\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n\n  const hasAnySocialImage =\n    OG_IMAGE_META_RE.test(html) || TWITTER_IMAGE_META_RE.test(html);\n  const tags: string[] = [];\n\n  if (!hasAnySocialImage) {\n    tags.push(`<meta property=\"og:image\" content=\"${imageUrl}\">`);\n    tags.push(`<meta property=\"og:image:secure_url\" content=\"${imageUrl}\">`);\n    tags.push(\n      `<meta property=\"og:image:type\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_TYPE}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:width\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_WIDTH}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:height\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n    );\n  }\n  if (!TWITTER_CARD_META_RE.test(html)) {\n    tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n  }\n  if (!hasAnySocialImage) {\n    tags.push(`<meta name=\"twitter:image\" content=\"${imageUrl}\">`);\n    tags.push(\n      `<meta name=\"twitter:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n    );\n  }\n\n  if (tags.length === 0) return html;\n  return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction isSsrHtmlOrDataResponse(\n  headers: Headers,\n  status: number,\n  pathname: string,\n): boolean {\n  if (status < 200 || status >= 400) return false;\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (contentType.includes(\"text/html\")) return true;\n  return pathname.endsWith(\".data\") && contentType.includes(\"text/x-script\");\n}\n\n/**\n * Apply the SSR cache policy to the response headers.\n *\n * ┌──────────────────────────────────────────────────────────────────────────┐\n * │ SSR IS A PUBLIC, HARD-CDN-CACHED SHELL — SERVED IDENTICALLY TO EVERYONE.   │\n * │                                                                            │\n * │ Every SSR HTML / React Router `.data` response gets the same public        │\n * │ stale-while-revalidate policy for ALL visitors, authenticated or not, so   │\n * │ the edge serves one shared copy and never stampedes origin.                │\n * │                                                                            │\n * │ DO NOT reintroduce per-user / cookie-based cache variation here (no        │\n * │ `private`, no `no-store`, no `Vary: Cookie`, no \"authenticated → don't     │\n * │ cache\" branch). That makes pages uncacheable for every logged-in visitor,  │\n * │ which is slow and expensive — exactly the regression this guardrail        │\n * │ prevents. The reason it is SAFE to hard-cache is that the SSR response is  │\n * │ impersonal: `createH3SSRHandler` renders without reading the request's     │\n * │ session/cookies, so there is no per-user data baked into the HTML. ALL     │\n * │ per-user state (who's logged in, private records, access checks) is        │\n * │ resolved CLIENT-SIDE after load. Keep it that way: if you need the SSR     │\n * │ output to differ per user, the fix is to move that work client-side, not   │\n * │ to disable caching here.                                                   │\n * └──────────────────────────────────────────────────────────────────────────┘\n */\nfunction applyDefaultSsrCacheHeader(\n  headers: Headers,\n  status: number,\n  pathname: string,\n) {\n  if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;\n\n  // Netlify Functions/proxies are not cached by default. Set all three cache\n  // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,\n  // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache\n  // actually serves SSR HTML/.data from the edge instead of forwarding every\n  // request to origin — for every visitor, authenticated or not.\n  for (const [name, value] of Object.entries(DEFAULT_SSR_CACHE_HEADERS)) {\n    headers.set(name, value);\n  }\n}\n\nfunction applyDefaultSpeculationRulesHeader(\n  headers: Headers,\n  status: number,\n  basePath: string,\n) {\n  if (status < 200 || status >= 400) return;\n  if (headers.has(\"speculation-rules\")) return;\n\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (!contentType.includes(\"text/html\")) return;\n\n  // Cloudflare Speed Brain injects its own Speculation-Rules header when the\n  // origin omits one. Those browser prefetches carry `Sec-Purpose: prefetch`,\n  // and Cloudflare refuses cache-ineligible dynamic pages with a 503 before\n  // the request can reach Netlify/origin. We publish an explicit no-op ruleset\n  // by default so Cloudflare does not inject its edge prefetch rules. Preserve\n  // an app-provided Speculation-Rules header above if a template deliberately\n  // owns this behavior.\n  const rulesPath = prefixMountedPath(DEFAULT_SPECULATION_RULES_PATH, basePath);\n  headers.set(\"speculation-rules\", `\"${rulesPath}\"`);\n}\n\n/**\n * Strip document-level CSP from app HTML responses.\n *\n * Hosted templates inject framework bootstrap scripts, analytics, Sentry config,\n * and app-owned inline scripts whose exact bytes vary by build/template. Any\n * shared CSP header, even Report-Only, can block or noisily report Google Tag\n * Manager and those bootstraps. Extension iframes and webviews keep their own\n * route-specific sandboxes; normal app documents deliberately do not emit CSP.\n */\nfunction removeDocumentCsp(headers: Headers): void {\n  headers.delete(\"content-security-policy\");\n  headers.delete(\"content-security-policy-report-only\");\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/.well-known/\") ||\n    pathname.startsWith(\"/_agent_native/\") ||\n    pathname.startsWith(\"/_agent-native/\") ||\n    pathname.startsWith(\"/api/\") ||\n    pathname.startsWith(\"/@vite/\") ||\n    pathname.startsWith(\"/@id/\") ||\n    pathname.startsWith(\"/@fs/\") ||\n    pathname === \"/@react-refresh\" ||\n    pathname === \"/__vite_ping\" ||\n    pathname === \"/__open-in-editor\" ||\n    pathname === \"/favicon.ico\" ||\n    pathname === \"/favicon.png\" ||\n    (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n  );\n}\n\nasync function rewriteMountedResponse(\n  response: Response,\n  basePath: string,\n  pathname: string,\n  requestUrl: string,\n): Promise<Response> {\n  const sentryClientConfigScript = getSentryClientConfigScript();\n  const headers = new Headers(response.headers);\n  applyDefaultSsrCacheHeader(headers, response.status, pathname);\n  applyDefaultSpeculationRulesHeader(headers, response.status, basePath);\n\n  const location = headers.get(\"location\");\n  if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n    headers.set(\"location\", prefixMountedPath(location, basePath));\n  }\n\n  const contentType = headers.get(\"content-type\") ?? \"\";\n  if (!contentType.toLowerCase().includes(\"text/html\")) {\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n  removeDocumentCsp(headers);\n  if (!response.body) {\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  const html = await response.text();\n  headers.delete(\"content-length\");\n  return new Response(\n    injectHeadScript(\n      injectDefaultSocialImageMeta(\n        prefixMountedHtml(html, basePath),\n        defaultSocialImageUrl(requestUrl, basePath),\n      ),\n      sentryClientConfigScript,\n    ),\n    {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    },\n  );\n}\n\n/**\n * Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> | unknown) {\n  const handler = createRequestHandler(getBuild as any);\n  return defineEventHandler(async (event) => {\n    const basePath = getAppBasePath();\n    const p = stripAppBasePath(event.url.pathname);\n    if (isFrameworkOrAssetPath(p)) {\n      return new Response(null, { status: 404 });\n    }\n    try {\n      const request = requestWithPathname(event.req as Request, p, basePath);\n      // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the\n      // request's session/cookies here, and pin an explicitly anonymous request\n      // context. That keeps the SSR HTML/.data identical for every visitor so it\n      // can be hard-cached at the CDN for everyone (see applyDefaultSsrCacheHeader).\n      //\n      // Consequence: SSR loaders that call `getRequestUserEmail()` / `accessFilter()`\n      // always see the unauthenticated branch and render public content only. Any\n      // per-user view (private records, share-grant access, who's logged in) MUST\n      // be resolved CLIENT-SIDE after load, never baked into SSR. Do not re-pin the\n      // session here to \"fix\" a per-user page — that silently makes the page\n      // uncacheable and/or leaks one user's data into another's cached copy.\n      const ctx = { userEmail: undefined, orgId: undefined };\n      if (request.method === \"HEAD\") {\n        const getRequest = new Request(request.url, {\n          method: \"GET\",\n          headers: request.headers,\n          signal: request.signal,\n        });\n        const response = await runWithRequestContext(ctx, () =>\n          handler(getRequest),\n        );\n        return await rewriteMountedResponse(\n          new Response(null, {\n            status: response.status,\n            statusText: response.statusText,\n            headers: response.headers,\n          }),\n          basePath,\n          p,\n          request.url,\n        );\n      }\n      return await rewriteMountedResponse(\n        await runWithRequestContext(ctx, () => handler(request)),\n        basePath,\n        p,\n        request.url,\n      );\n    } catch (err) {\n      // Log the full stack server-side, but never leak it to the client.\n      // Stack traces expose file paths, library versions, and code structure\n      // that aid reconnaissance attacks. In dev we surface the message text\n      // so devtools shows something useful; in prod we return a bare 500.\n      console.error(\"[ssr-handler] SSR error:\", err);\n      const isProd = process.env.NODE_ENV === \"production\";\n      const body = isProd\n        ? \"Internal Server Error\"\n        : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n      return new Response(body, {\n        status: 500,\n        headers: { \"content-type\": \"text/plain\" },\n      });\n    }\n  });\n}\n"]}

package/dist/server/transcribe-voice.d.ts

@@ -20,7 +20,7 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;
 //# sourceMappingURL=transcribe-voice.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.84.66",
+  "version": "0.84.67",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {