@agent-native/core 0.84.66 → 0.85.0

package/dist/server/ssr-handler.js

@@ -19,10 +19,8 @@ import { defineEventHandler } from "h3";
 import { createRequestHandler } from "react-router";
 import { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_PATH, } from "../shared/cache-control.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
-import { GA_CSP_CONNECT_HOSTS, GA_CSP_IMG_HOSTS, GA_CSP_SCRIPT_HOSTS, getGaInlineConfigScriptBody, } from "./analytics.js";
 import { getAppBasePathFromViteEnv, stripAppBasePath as canonicalStripAppBasePath, } from "./app-base-path.js";
 import { runWithRequestContext } from "./request-context.js";
-import { computeInlineScriptHash } from "./security-headers.js";
 import { getSentryClientConfigScript } from "./sentry-config.js";
 export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, } from "../shared/cache-control.js";
 function getAppBasePath() {
@@ -192,275 +190,17 @@ function applyDefaultSpeculationRulesHeader(headers, status, basePath) {
     headers.set("speculation-rules", `"${rulesPath}"`);
 }
 /**
- * Extract the plain JS body from a `<script ...>body</script>` string.
- * Returns `null` if the input is falsy or has no recognisable `</script>` end.
- * Used to compute the sha256 hash of framework-injected inline scripts so the
- * hash can be listed in app-owned `script-src` CSP directives.
- */
-function extractScriptBody(scriptTag) {
-    if (!scriptTag)
-        return null;
-    const start = scriptTag.indexOf(">") + 1;
-    const end = scriptTag.lastIndexOf("</script>");
-    if (start <= 0 || end < start)
-        return null;
-    return scriptTag.slice(start, end);
-}
-const CSP_DIRECTIVES_WITH_VALUE_TOKENS = new Set([
-    "base-uri",
-    "block-all-mixed-content",
-    "child-src",
-    "connect-src",
-    "default-src",
-    "fenced-frame-src",
-    "font-src",
-    "form-action",
-    "frame-ancestors",
-    "frame-src",
-    "img-src",
-    "manifest-src",
-    "media-src",
-    "navigate-to",
-    "object-src",
-    "plugin-types",
-    "prefetch-src",
-    "referrer",
-    "reflected-xss",
-    "require-sri-for",
-    "require-trusted-types-for",
-    "report-to",
-    "report-uri",
-    "sandbox",
-    "script-src",
-    "script-src-attr",
-    "script-src-elem",
-    "style-src",
-    "style-src-attr",
-    "style-src-elem",
-    "trusted-types",
-    "upgrade-insecure-requests",
-    "webrtc",
-    "worker-src",
-]);
-function hasCommaJoinedCspPolicies(policy) {
-    let commaIndex = policy.indexOf(",");
-    while (commaIndex !== -1) {
-        const afterComma = policy.slice(commaIndex + 1);
-        const directive = /^\s+([a-z][a-z0-9-]*)(?=\s|;|$)/i.exec(afterComma)?.[1];
-        if (directive &&
-            CSP_DIRECTIVES_WITH_VALUE_TOKENS.has(directive.toLowerCase())) {
-            return true;
-        }
-        commaIndex = policy.indexOf(",", commaIndex + 1);
-    }
-    return false;
-}
-function parseCsp(policy) {
-    return policy
-        .split(";")
-        .map((part) => part.trim())
-        .filter(Boolean)
-        .map((part) => {
-        const [name = "", ...tokens] = part.split(/\s+/);
-        return { name: name.toLowerCase(), tokens };
-    })
-        .filter((directive) => directive.name);
-}
-function serializeCsp(directives) {
-    return directives
-        .map((directive) => [directive.name, ...directive.tokens].filter(Boolean).join(" "))
-        .join("; ");
-}
-function appendCspTokens(tokens, additions) {
-    if (!additions.length)
-        return tokens;
-    const next = tokens.filter((token) => token !== "'none'");
-    const seen = new Set(next);
-    for (const token of additions) {
-        if (!token || seen.has(token))
-            continue;
-        next.push(token);
-        seen.add(token);
-    }
-    return next;
-}
-function findCspDirective(directives, name) {
-    return directives.find((directive) => directive.name === name);
-}
-function appendToExistingOrDefaultCspDirective(directives, name, additions) {
-    if (!additions.length)
-        return;
-    const existing = findCspDirective(directives, name);
-    if (existing) {
-        existing.tokens = appendCspTokens(existing.tokens, additions);
-        return;
-    }
-    const defaultSrc = findCspDirective(directives, "default-src");
-    if (!defaultSrc)
-        return;
-    directives.push({
-        name,
-        tokens: appendCspTokens([...defaultSrc.tokens], additions),
-    });
-}
-function appendToExistingCspDirective(directives, name, additions) {
-    const existing = findCspDirective(directives, name);
-    if (!existing)
-        return;
-    existing.tokens = appendCspTokens(existing.tokens, additions);
-}
-function ensureCspDirective(directives, name, tokens) {
-    if (findCspDirective(directives, name))
-        return;
-    directives.push({ name, tokens: [...tokens] });
-}
-function hasStrictNonceScriptPolicy(tokens) {
-    return tokens.some((token) => token === "'strict-dynamic'" || token.startsWith("'nonce-"));
-}
-function appendToScriptCspDirective(directives, name, additions) {
-    const existing = findCspDirective(directives, name);
-    if (existing) {
-        if (hasStrictNonceScriptPolicy(existing.tokens))
-            return false;
-        existing.tokens = appendCspTokens(existing.tokens, additions);
-        return true;
-    }
-    const defaultSrc = findCspDirective(directives, "default-src");
-    if (!defaultSrc || hasStrictNonceScriptPolicy(defaultSrc.tokens)) {
-        return false;
-    }
-    directives.push({
-        name,
-        tokens: appendCspTokens([...defaultSrc.tokens], additions),
-    });
-    return true;
-}
-function appendToEffectiveScriptElementCspDirective(directives, additions) {
-    const scriptSrcElem = findCspDirective(directives, "script-src-elem");
-    if (scriptSrcElem) {
-        if (hasStrictNonceScriptPolicy(scriptSrcElem.tokens))
-            return false;
-        scriptSrcElem.tokens = appendCspTokens(scriptSrcElem.tokens, additions);
-        return true;
-    }
-    return appendToScriptCspDirective(directives, "script-src", additions);
-}
-function augmentExistingEnforcedCspForFrameworkScripts(policy, options) {
-    // Multiple CSP headers are surfaced by Headers.get() as one comma-joined
-    // string. CSP is not a comma-list header, so serializing a parsed combined
-    // value would turn two policies into one invalid policy. Leave those headers
-    // app-owned; a comma inside a source/report URL is still safe to parse.
-    if (hasCommaJoinedCspPolicies(policy))
-        return policy;
-    const directives = parseCsp(policy);
-    if (!directives.length)
-        return policy;
-    if (options.gaEnabled) {
-        const addedScriptElement = appendToEffectiveScriptElementCspDirective(directives, options.gaScriptSrcTokens);
-        if (addedScriptElement) {
-            appendToExistingOrDefaultCspDirective(directives, "connect-src", GA_CSP_CONNECT_HOSTS);
-            appendToExistingOrDefaultCspDirective(directives, "img-src", GA_CSP_IMG_HOSTS);
-        }
-    }
-    ensureCspDirective(directives, "object-src", ["'none'"]);
-    ensureCspDirective(directives, "base-uri", ["'self'"]);
-    return serializeCsp(directives);
-}
-function augmentExistingReportOnlyCspForFrameworkScripts(policy, options) {
-    if (hasCommaJoinedCspPolicies(policy))
-        return policy;
-    const directives = parseCsp(policy);
-    if (!directives.length)
-        return policy;
-    appendToExistingOrDefaultCspDirective(directives, "script-src", options.scriptSrcTokens);
-    appendToExistingCspDirective(directives, "script-src-elem", options.scriptSrcTokens);
-    if (options.gaEnabled) {
-        appendToExistingOrDefaultCspDirective(directives, "connect-src", GA_CSP_CONNECT_HOSTS);
-        appendToExistingOrDefaultCspDirective(directives, "img-src", GA_CSP_IMG_HOSTS);
-    }
-    return serializeCsp(directives);
-}
-/**
- * Apply a Content-Security-Policy header to HTML document responses.
- *
- * Two directives are always enforced in production:
- *
- *   - `object-src 'none'`  — disables Flash / Java / PDF plugin execution,
- *     which are a reliable code-execution vector even in modern browsers.
- *   - `base-uri 'self'`    — prevents a `<base href="...">` injection from
- *     hijacking all relative URLs in the document (a common attack target when
- *     user-controlled content reaches the HTML).
- *
- * A third directive, `script-src`, is emitted via `Content-Security-Policy-
- * Report-Only` rather than enforced when the app has no existing document CSP.
- * The framework injects inline scripts for analytics, Sentry, and template
- * setup, and hosted apps need Google Tag Manager to load without noisy CSP
- * diagnostics. The report-only policy is intentionally permissive for scripts:
- * it includes `'unsafe-inline'` plus the known GA/GTM loader hosts.
- *
- * If an app or host already sends an enforced CSP with `script-src`,
- * `script-src-elem`, `connect-src`, `img-src`, or `default-src`, we merge only
- * GA-specific allowances into existing host/hash policies. Strict nonce or
- * `strict-dynamic` script policies stay app-owned because blindly appending
- * hashes or hosts would widen the policy without reliably loading our injected
- * scripts.
- *
- * Templates additionally render a theme-init inline script whose exact content
- * varies by template (default theme param, custom docs variant, etc.) and which
- * is rendered by React Router, not this handler, so its hash is not available
- * here. Shipping script-src as Report-Only surfaces the remaining violations
- * without breaking template customisations; teams can graduate to enforcement
- * once their hashes are enumerated.
+ * Strip document-level CSP from app HTML responses.
  *
- * Skipped in development (`NODE_ENV !== 'production'`) so HMR eval and Vite
- * dev-server injects are never blocked. Set `AGENT_NATIVE_DISABLE_DOC_CSP=1`
- * to opt out in production for a template with exotic needs.
+ * Hosted templates inject framework bootstrap scripts, analytics, Sentry config,
+ * and app-owned inline scripts whose exact bytes vary by build/template. Any
+ * shared CSP header, even Report-Only, can block or noisily report Google Tag
+ * Manager and those bootstraps. Extension iframes and webviews keep their own
+ * route-specific sandboxes; normal app documents deliberately do not emit CSP.
  */
-function applyDocumentCsp(headers, sentryScript) {
-    if (process.env.NODE_ENV !== "production")
-        return;
-    if (process.env.AGENT_NATIVE_DISABLE_DOC_CSP === "1")
-        return;
-    // script-src as Report-Only: keep this deliberately loose so the framework's
-    // injected analytics and template bootstrap scripts do not look blocked in
-    // browser diagnostics.
-    const sentryBody = extractScriptBody(sentryScript);
-    const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;
-    const gaInlineBody = getGaInlineConfigScriptBody();
-    const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;
-    const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];
-    const gaScriptSrcTokens = [
-        "'unsafe-inline'",
-        ...(gaHash ? [gaHash] : []),
-        ...gaHosts,
-    ];
-    const scriptSrcTokens = [
-        "'self'",
-        "'unsafe-inline'",
-        ...(sentryHash ? [sentryHash] : []),
-        ...(gaHash ? [gaHash] : []),
-        ...gaHosts,
-    ];
-    const cspAugmentOptions = {
-        scriptSrcTokens,
-        gaScriptSrcTokens,
-        gaEnabled: Boolean(gaInlineBody),
-    };
-    const existing = headers.get("content-security-policy") ?? "";
-    if (!existing) {
-        headers.set("content-security-policy", "object-src 'none'; base-uri 'self'");
-    }
-    else {
-        headers.set("content-security-policy", augmentExistingEnforcedCspForFrameworkScripts(existing, cspAugmentOptions));
-    }
-    const scriptSrc = `script-src ${scriptSrcTokens.join(" ")}`;
-    const existingRo = headers.get("content-security-policy-report-only") ?? "";
-    if (!existingRo) {
-        headers.set("content-security-policy-report-only", scriptSrc);
-    }
-    else {
-        headers.set("content-security-policy-report-only", augmentExistingReportOnlyCspForFrameworkScripts(existingRo, cspAugmentOptions));
-    }
+function removeDocumentCsp(headers) {
+    headers.delete("content-security-policy");
+    headers.delete("content-security-policy-report-only");
 }
 function isFrameworkOrAssetPath(pathname) {
     return (pathname.startsWith("/.well-known/") ||
@@ -487,7 +227,15 @@ async function rewriteMountedResponse(response, basePath, pathname, requestUrl)
         headers.set("location", prefixMountedPath(location, basePath));
     }
     const contentType = headers.get("content-type") ?? "";
-    if (!contentType.toLowerCase().includes("text/html") || !response.body) {
+    if (!contentType.toLowerCase().includes("text/html")) {
+        return new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers,
+        });
+    }
+    removeDocumentCsp(headers);
+    if (!response.body) {
         return new Response(response.body, {
             status: response.status,
             statusText: response.statusText,
@@ -496,7 +244,6 @@ async function rewriteMountedResponse(response, basePath, pathname, requestUrl)
     }
     const html = await response.text();
     headers.delete("content-length");
-    applyDocumentCsp(headers, sentryClientConfigScript);
     return new Response(injectHeadScript(injectDefaultSocialImageMeta(prefixMountedHtml(html, basePath), defaultSocialImageUrl(requestUrl, basePath)), sentryClientConfigScript), {
         status: response.status,
         statusText: response.statusText,

package/dist/server/ssr-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACxC;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,2BAA2B,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,SAAS,cAAc;IACrB,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,yBAAyB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI;SACR,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,qCAAqC,CAC1C,IAAI,GAAG,CACL,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,EAC3D,UAAU,CACX,CAAC,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,sCAAsC,QAAQ,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,iDAAiD,QAAQ,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CACP,2CAA2C,8BAA8B,IAAI,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,CACP,4CAA4C,+BAA+B,IAAI,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,6CAA6C,gCAAgC,IAAI,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,0CAA0C,6BAA6B,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,uCAAuC,QAAQ,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CACP,2CAA2C,6BAA6B,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,0BAA0B,CACjC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO;IAEhE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/C,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,SAAwB;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACrC,CAAC;AAOD,MAAM,gCAAgC,GAAG,IAAI,GAAG,CAAC;IAC/C,UAAU;IACV,yBAAyB;IACzB,WAAW;IACX,aAAa;IACb,aAAa;IACb,kBAAkB;IAClB,UAAU;IACV,aAAa;IACb,iBAAiB;IACjB,WAAW;IACX,SAAS;IACT,cAAc;IACd,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,cAAc;IACd,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,2BAA2B;IAC3B,WAAW;IACX,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,iBAAiB;IACjB,WAAW;IACX,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;IACf,2BAA2B;IAC3B,QAAQ;IACR,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,MAAc;IAC/C,IAAI,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,kCAAkC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3E,IACE,SAAS;YACT,gCAAgC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,EAC7D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,MAAM;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,UAA0B;IAC9C,OAAO,UAAU;SACd,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACjB,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAChE;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CACtB,MAAgB,EAChB,SAA4B;IAE5B,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,UAA0B,EAC1B,IAAY;IAEZ,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,qCAAqC,CAC5C,UAA0B,EAC1B,IAAY,EACZ,SAA4B;IAE5B,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO;IAC9B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,UAAU,CAAC,IAAI,CAAC;QACd,IAAI;QACJ,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,4BAA4B,CACnC,UAA0B,EAC1B,IAAY,EACZ,SAA4B;IAE5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,UAA0B,EAC1B,IAAY,EACZ,MAAyB;IAEzB,IAAI,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC;QAAE,OAAO;IAC/C,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAyB;IAC3D,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,kBAAkB,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,UAA0B,EAC1B,IAAY,EACZ,SAA4B;IAE5B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,IAAI,0BAA0B,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,IAAI,CAAC;QACd,IAAI;QACJ,MAAM,EAAE,eAAe,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;KAC3D,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0CAA0C,CACjD,UAA0B,EAC1B,SAA4B;IAE5B,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACtE,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,0BAA0B,CAAC,aAAa,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,aAAa,CAAC,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,0BAA0B,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,6CAA6C,CACpD,MAAc,EACd,OAGC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,IAAI,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAErD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEtC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,kBAAkB,GAAG,0CAA0C,CACnE,UAAU,EACV,OAAO,CAAC,iBAAiB,CAC1B,CAAC;QACF,IAAI,kBAAkB,EAAE,CAAC;YACvB,qCAAqC,CACnC,UAAU,EACV,aAAa,EACb,oBAAoB,CACrB,CAAC;YACF,qCAAqC,CACnC,UAAU,EACV,SAAS,EACT,gBAAgB,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,kBAAkB,CAAC,UAAU,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEvD,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,+CAA+C,CACtD,MAAc,EACd,OAGC;IAED,IAAI,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAErD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAEtC,qCAAqC,CACnC,UAAU,EACV,YAAY,EACZ,OAAO,CAAC,eAAe,CACxB,CAAC;IACF,4BAA4B,CAC1B,UAAU,EACV,iBAAiB,EACjB,OAAO,CAAC,eAAe,CACxB,CAAC;IAEF,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,qCAAqC,CACnC,UAAU,EACV,aAAa,EACb,oBAAoB,CACrB,CAAC;QACF,qCAAqC,CACnC,UAAU,EACV,SAAS,EACT,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,SAAS,gBAAgB,CAAC,OAAgB,EAAE,YAA2B;IACrE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO;IAClD,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,GAAG;QAAE,OAAO;IAE7D,6EAA6E;IAC7E,2EAA2E;IAC3E,uBAAuB;IACvB,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,YAAY,GAAG,2BAA2B,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,iBAAiB,GAAG;QACxB,iBAAiB;QACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,OAAO;KACX,CAAC;IACF,MAAM,eAAe,GAAG;QACtB,QAAQ;QACR,iBAAiB;QACjB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,OAAO;KACX,CAAC;IAEF,MAAM,iBAAiB,GAAG;QACxB,eAAe;QACf,iBAAiB;QACjB,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;KACjC,CAAC;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACT,yBAAyB,EACzB,oCAAoC,CACrC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,yBAAyB,EACzB,6CAA6C,CAC3C,QAAQ,EACR,iBAAiB,CAClB,CACF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,IAAI,EAAE,CAAC;IAC5E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,EAAE,SAAS,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,qCAAqC,EACrC,+CAA+C,CAC7C,UAAU,EACV,iBAAiB,CAClB,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,UAAkB;IAElB,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,kCAAkC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,gBAAgB,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IACpD,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAC1B,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACjC,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC5C,EACD,wBAAwB,CACzB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,+EAA+E;YAC/E,EAAE;YACF,gFAAgF;YAChF,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { defineEventHandler } from \"h3\";\n/**\n * Shared SSR catch-all handler for React Router framework mode.\n *\n * Templates wire this up via:\n *\n *   // server/routes/[...page].get.ts\n *   import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n *   export default createH3SSRHandler(\n *     () => import(\"virtual:react-router/server-build\"),\n *   );\n *\n * The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n */\nimport { createRequestHandler } from \"react-router\";\n\nimport {\n  DEFAULT_SSR_CACHE_HEADERS,\n  DEFAULT_SPECULATION_RULES_PATH,\n} from \"../shared/cache-control.js\";\nimport {\n  AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n  AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n  AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n  AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n  AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n  withAgentNativeSocialImageCacheBuster,\n} from \"../shared/social-meta.js\";\nimport {\n  GA_CSP_CONNECT_HOSTS,\n  GA_CSP_IMG_HOSTS,\n  GA_CSP_SCRIPT_HOSTS,\n  getGaInlineConfigScriptBody,\n} from \"./analytics.js\";\nimport {\n  getAppBasePathFromViteEnv,\n  stripAppBasePath as canonicalStripAppBasePath,\n} from \"./app-base-path.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { computeInlineScriptHash } from \"./security-headers.js\";\nimport { getSentryClientConfigScript } from \"./sentry-config.js\";\n\nexport {\n  DEFAULT_SSR_CACHE_HEADERS,\n  DEFAULT_SPECULATION_RULES_HEADER,\n  DEFAULT_SSR_CACHE_CONTROL,\n} from \"../shared/cache-control.js\";\n\nfunction getAppBasePath(): string {\n  return getAppBasePathFromViteEnv();\n}\n\nfunction stripAppBasePath(pathname: string): string {\n  return canonicalStripAppBasePath(pathname, getAppBasePath());\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n  if (!basePath) return pathname;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) {\n    return pathname.slice(basePath.length) || \"/\";\n  }\n  return pathname;\n}\n\nfunction requestWithPathname(\n  request: Request,\n  pathname: string,\n  basePath: string,\n): Request {\n  const url = new URL(request.url);\n  let changed = false;\n  if (basePath && pathname === \"/__manifest\") {\n    const paths = url.searchParams.get(\"paths\");\n    if (paths) {\n      const strippedPaths = paths\n        .split(\",\")\n        .map((path) => stripBasePath(path, basePath))\n        .join(\",\");\n      if (strippedPaths !== paths) {\n        url.searchParams.set(\"paths\", strippedPaths);\n        changed = true;\n      }\n    }\n  }\n  if (url.pathname !== pathname) {\n    url.pathname = pathname;\n    changed = true;\n  }\n  if (!changed) return request;\n  const init: RequestInit & { duplex?: \"half\" } = {\n    method: request.method,\n    headers: request.headers,\n    signal: request.signal,\n  };\n  if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n    init.body = request.body;\n    init.duplex = \"half\";\n  }\n  return new Request(url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n  if (!basePath || !path.startsWith(\"/\") || path.startsWith(\"//\")) return path;\n  if (path === basePath || path.startsWith(`${basePath}/`)) return path;\n  return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n  if (!basePath) return html;\n  return html\n    .replace(\n      /\\b(href|src|action|formaction|poster)=([\"'])(\\/(?!\\/)[^\"']*)\\2/g,\n      (_match, attr: string, quote: string, path: string) =>\n        `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n    )\n    .replace(/url\\(([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\\)/g, (_match, quote, path) => {\n      const q = quote || \"\";\n      return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n    });\n}\n\nfunction injectHeadScript(html: string, script: string | null): string {\n  if (!script) return html;\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n  return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]*\\bproperty=([\"'])og:image\\1)[^>]*>/i;\nconst TWITTER_CARD_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:card\\1)[^>]*>/i;\nconst TWITTER_IMAGE_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:image\\1)[^>]*>/i;\n\nfunction defaultSocialImageUrl(requestUrl: string, basePath: string): string {\n  return withAgentNativeSocialImageCacheBuster(\n    new URL(\n      prefixMountedPath(AGENT_NATIVE_SOCIAL_IMAGE_PATH, basePath),\n      requestUrl,\n    ).toString(),\n  );\n}\n\nfunction injectDefaultSocialImageMeta(html: string, imageUrl: string): string {\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n\n  const hasAnySocialImage =\n    OG_IMAGE_META_RE.test(html) || TWITTER_IMAGE_META_RE.test(html);\n  const tags: string[] = [];\n\n  if (!hasAnySocialImage) {\n    tags.push(`<meta property=\"og:image\" content=\"${imageUrl}\">`);\n    tags.push(`<meta property=\"og:image:secure_url\" content=\"${imageUrl}\">`);\n    tags.push(\n      `<meta property=\"og:image:type\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_TYPE}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:width\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_WIDTH}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:height\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n    );\n  }\n  if (!TWITTER_CARD_META_RE.test(html)) {\n    tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n  }\n  if (!hasAnySocialImage) {\n    tags.push(`<meta name=\"twitter:image\" content=\"${imageUrl}\">`);\n    tags.push(\n      `<meta name=\"twitter:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n    );\n  }\n\n  if (tags.length === 0) return html;\n  return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction isSsrHtmlOrDataResponse(\n  headers: Headers,\n  status: number,\n  pathname: string,\n): boolean {\n  if (status < 200 || status >= 400) return false;\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (contentType.includes(\"text/html\")) return true;\n  return pathname.endsWith(\".data\") && contentType.includes(\"text/x-script\");\n}\n\n/**\n * Apply the SSR cache policy to the response headers.\n *\n * ┌──────────────────────────────────────────────────────────────────────────┐\n * │ SSR IS A PUBLIC, HARD-CDN-CACHED SHELL — SERVED IDENTICALLY TO EVERYONE.   │\n * │                                                                            │\n * │ Every SSR HTML / React Router `.data` response gets the same public        │\n * │ stale-while-revalidate policy for ALL visitors, authenticated or not, so   │\n * │ the edge serves one shared copy and never stampedes origin.                │\n * │                                                                            │\n * │ DO NOT reintroduce per-user / cookie-based cache variation here (no        │\n * │ `private`, no `no-store`, no `Vary: Cookie`, no \"authenticated → don't     │\n * │ cache\" branch). That makes pages uncacheable for every logged-in visitor,  │\n * │ which is slow and expensive — exactly the regression this guardrail        │\n * │ prevents. The reason it is SAFE to hard-cache is that the SSR response is  │\n * │ impersonal: `createH3SSRHandler` renders without reading the request's     │\n * │ session/cookies, so there is no per-user data baked into the HTML. ALL     │\n * │ per-user state (who's logged in, private records, access checks) is        │\n * │ resolved CLIENT-SIDE after load. Keep it that way: if you need the SSR     │\n * │ output to differ per user, the fix is to move that work client-side, not   │\n * │ to disable caching here.                                                   │\n * └──────────────────────────────────────────────────────────────────────────┘\n */\nfunction applyDefaultSsrCacheHeader(\n  headers: Headers,\n  status: number,\n  pathname: string,\n) {\n  if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;\n\n  // Netlify Functions/proxies are not cached by default. Set all three cache\n  // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,\n  // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache\n  // actually serves SSR HTML/.data from the edge instead of forwarding every\n  // request to origin — for every visitor, authenticated or not.\n  for (const [name, value] of Object.entries(DEFAULT_SSR_CACHE_HEADERS)) {\n    headers.set(name, value);\n  }\n}\n\nfunction applyDefaultSpeculationRulesHeader(\n  headers: Headers,\n  status: number,\n  basePath: string,\n) {\n  if (status < 200 || status >= 400) return;\n  if (headers.has(\"speculation-rules\")) return;\n\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (!contentType.includes(\"text/html\")) return;\n\n  // Cloudflare Speed Brain injects its own Speculation-Rules header when the\n  // origin omits one. Those browser prefetches carry `Sec-Purpose: prefetch`,\n  // and Cloudflare refuses cache-ineligible dynamic pages with a 503 before\n  // the request can reach Netlify/origin. We publish an explicit no-op ruleset\n  // by default so Cloudflare does not inject its edge prefetch rules. Preserve\n  // an app-provided Speculation-Rules header above if a template deliberately\n  // owns this behavior.\n  const rulesPath = prefixMountedPath(DEFAULT_SPECULATION_RULES_PATH, basePath);\n  headers.set(\"speculation-rules\", `\"${rulesPath}\"`);\n}\n\n/**\n * Extract the plain JS body from a `<script ...>body</script>` string.\n * Returns `null` if the input is falsy or has no recognisable `</script>` end.\n * Used to compute the sha256 hash of framework-injected inline scripts so the\n * hash can be listed in app-owned `script-src` CSP directives.\n */\nfunction extractScriptBody(scriptTag: string | null): string | null {\n  if (!scriptTag) return null;\n  const start = scriptTag.indexOf(\">\") + 1;\n  const end = scriptTag.lastIndexOf(\"</script>\");\n  if (start <= 0 || end < start) return null;\n  return scriptTag.slice(start, end);\n}\n\ntype CspDirective = {\n  name: string;\n  tokens: string[];\n};\n\nconst CSP_DIRECTIVES_WITH_VALUE_TOKENS = new Set([\n  \"base-uri\",\n  \"block-all-mixed-content\",\n  \"child-src\",\n  \"connect-src\",\n  \"default-src\",\n  \"fenced-frame-src\",\n  \"font-src\",\n  \"form-action\",\n  \"frame-ancestors\",\n  \"frame-src\",\n  \"img-src\",\n  \"manifest-src\",\n  \"media-src\",\n  \"navigate-to\",\n  \"object-src\",\n  \"plugin-types\",\n  \"prefetch-src\",\n  \"referrer\",\n  \"reflected-xss\",\n  \"require-sri-for\",\n  \"require-trusted-types-for\",\n  \"report-to\",\n  \"report-uri\",\n  \"sandbox\",\n  \"script-src\",\n  \"script-src-attr\",\n  \"script-src-elem\",\n  \"style-src\",\n  \"style-src-attr\",\n  \"style-src-elem\",\n  \"trusted-types\",\n  \"upgrade-insecure-requests\",\n  \"webrtc\",\n  \"worker-src\",\n]);\n\nfunction hasCommaJoinedCspPolicies(policy: string): boolean {\n  let commaIndex = policy.indexOf(\",\");\n  while (commaIndex !== -1) {\n    const afterComma = policy.slice(commaIndex + 1);\n    const directive = /^\\s+([a-z][a-z0-9-]*)(?=\\s|;|$)/i.exec(afterComma)?.[1];\n    if (\n      directive &&\n      CSP_DIRECTIVES_WITH_VALUE_TOKENS.has(directive.toLowerCase())\n    ) {\n      return true;\n    }\n    commaIndex = policy.indexOf(\",\", commaIndex + 1);\n  }\n  return false;\n}\n\nfunction parseCsp(policy: string): CspDirective[] {\n  return policy\n    .split(\";\")\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .map((part) => {\n      const [name = \"\", ...tokens] = part.split(/\\s+/);\n      return { name: name.toLowerCase(), tokens };\n    })\n    .filter((directive) => directive.name);\n}\n\nfunction serializeCsp(directives: CspDirective[]): string {\n  return directives\n    .map((directive) =>\n      [directive.name, ...directive.tokens].filter(Boolean).join(\" \"),\n    )\n    .join(\"; \");\n}\n\nfunction appendCspTokens(\n  tokens: string[],\n  additions: readonly string[],\n): string[] {\n  if (!additions.length) return tokens;\n  const next = tokens.filter((token) => token !== \"'none'\");\n  const seen = new Set(next);\n  for (const token of additions) {\n    if (!token || seen.has(token)) continue;\n    next.push(token);\n    seen.add(token);\n  }\n  return next;\n}\n\nfunction findCspDirective(\n  directives: CspDirective[],\n  name: string,\n): CspDirective | undefined {\n  return directives.find((directive) => directive.name === name);\n}\n\nfunction appendToExistingOrDefaultCspDirective(\n  directives: CspDirective[],\n  name: string,\n  additions: readonly string[],\n): void {\n  if (!additions.length) return;\n  const existing = findCspDirective(directives, name);\n  if (existing) {\n    existing.tokens = appendCspTokens(existing.tokens, additions);\n    return;\n  }\n\n  const defaultSrc = findCspDirective(directives, \"default-src\");\n  if (!defaultSrc) return;\n  directives.push({\n    name,\n    tokens: appendCspTokens([...defaultSrc.tokens], additions),\n  });\n}\n\nfunction appendToExistingCspDirective(\n  directives: CspDirective[],\n  name: string,\n  additions: readonly string[],\n): void {\n  const existing = findCspDirective(directives, name);\n  if (!existing) return;\n  existing.tokens = appendCspTokens(existing.tokens, additions);\n}\n\nfunction ensureCspDirective(\n  directives: CspDirective[],\n  name: string,\n  tokens: readonly string[],\n): void {\n  if (findCspDirective(directives, name)) return;\n  directives.push({ name, tokens: [...tokens] });\n}\n\nfunction hasStrictNonceScriptPolicy(tokens: readonly string[]): boolean {\n  return tokens.some(\n    (token) => token === \"'strict-dynamic'\" || token.startsWith(\"'nonce-\"),\n  );\n}\n\nfunction appendToScriptCspDirective(\n  directives: CspDirective[],\n  name: string,\n  additions: readonly string[],\n): boolean {\n  const existing = findCspDirective(directives, name);\n  if (existing) {\n    if (hasStrictNonceScriptPolicy(existing.tokens)) return false;\n    existing.tokens = appendCspTokens(existing.tokens, additions);\n    return true;\n  }\n\n  const defaultSrc = findCspDirective(directives, \"default-src\");\n  if (!defaultSrc || hasStrictNonceScriptPolicy(defaultSrc.tokens)) {\n    return false;\n  }\n  directives.push({\n    name,\n    tokens: appendCspTokens([...defaultSrc.tokens], additions),\n  });\n  return true;\n}\n\nfunction appendToEffectiveScriptElementCspDirective(\n  directives: CspDirective[],\n  additions: readonly string[],\n): boolean {\n  const scriptSrcElem = findCspDirective(directives, \"script-src-elem\");\n  if (scriptSrcElem) {\n    if (hasStrictNonceScriptPolicy(scriptSrcElem.tokens)) return false;\n    scriptSrcElem.tokens = appendCspTokens(scriptSrcElem.tokens, additions);\n    return true;\n  }\n\n  return appendToScriptCspDirective(directives, \"script-src\", additions);\n}\n\nfunction augmentExistingEnforcedCspForFrameworkScripts(\n  policy: string,\n  options: {\n    gaScriptSrcTokens: readonly string[];\n    gaEnabled: boolean;\n  },\n): string {\n  // Multiple CSP headers are surfaced by Headers.get() as one comma-joined\n  // string. CSP is not a comma-list header, so serializing a parsed combined\n  // value would turn two policies into one invalid policy. Leave those headers\n  // app-owned; a comma inside a source/report URL is still safe to parse.\n  if (hasCommaJoinedCspPolicies(policy)) return policy;\n\n  const directives = parseCsp(policy);\n  if (!directives.length) return policy;\n\n  if (options.gaEnabled) {\n    const addedScriptElement = appendToEffectiveScriptElementCspDirective(\n      directives,\n      options.gaScriptSrcTokens,\n    );\n    if (addedScriptElement) {\n      appendToExistingOrDefaultCspDirective(\n        directives,\n        \"connect-src\",\n        GA_CSP_CONNECT_HOSTS,\n      );\n      appendToExistingOrDefaultCspDirective(\n        directives,\n        \"img-src\",\n        GA_CSP_IMG_HOSTS,\n      );\n    }\n  }\n\n  ensureCspDirective(directives, \"object-src\", [\"'none'\"]);\n  ensureCspDirective(directives, \"base-uri\", [\"'self'\"]);\n\n  return serializeCsp(directives);\n}\n\nfunction augmentExistingReportOnlyCspForFrameworkScripts(\n  policy: string,\n  options: {\n    scriptSrcTokens: readonly string[];\n    gaEnabled: boolean;\n  },\n): string {\n  if (hasCommaJoinedCspPolicies(policy)) return policy;\n\n  const directives = parseCsp(policy);\n  if (!directives.length) return policy;\n\n  appendToExistingOrDefaultCspDirective(\n    directives,\n    \"script-src\",\n    options.scriptSrcTokens,\n  );\n  appendToExistingCspDirective(\n    directives,\n    \"script-src-elem\",\n    options.scriptSrcTokens,\n  );\n\n  if (options.gaEnabled) {\n    appendToExistingOrDefaultCspDirective(\n      directives,\n      \"connect-src\",\n      GA_CSP_CONNECT_HOSTS,\n    );\n    appendToExistingOrDefaultCspDirective(\n      directives,\n      \"img-src\",\n      GA_CSP_IMG_HOSTS,\n    );\n  }\n\n  return serializeCsp(directives);\n}\n\n/**\n * Apply a Content-Security-Policy header to HTML document responses.\n *\n * Two directives are always enforced in production:\n *\n *   - `object-src 'none'`  — disables Flash / Java / PDF plugin execution,\n *     which are a reliable code-execution vector even in modern browsers.\n *   - `base-uri 'self'`    — prevents a `<base href=\"...\">` injection from\n *     hijacking all relative URLs in the document (a common attack target when\n *     user-controlled content reaches the HTML).\n *\n * A third directive, `script-src`, is emitted via `Content-Security-Policy-\n * Report-Only` rather than enforced when the app has no existing document CSP.\n * The framework injects inline scripts for analytics, Sentry, and template\n * setup, and hosted apps need Google Tag Manager to load without noisy CSP\n * diagnostics. The report-only policy is intentionally permissive for scripts:\n * it includes `'unsafe-inline'` plus the known GA/GTM loader hosts.\n *\n * If an app or host already sends an enforced CSP with `script-src`,\n * `script-src-elem`, `connect-src`, `img-src`, or `default-src`, we merge only\n * GA-specific allowances into existing host/hash policies. Strict nonce or\n * `strict-dynamic` script policies stay app-owned because blindly appending\n * hashes or hosts would widen the policy without reliably loading our injected\n * scripts.\n *\n * Templates additionally render a theme-init inline script whose exact content\n * varies by template (default theme param, custom docs variant, etc.) and which\n * is rendered by React Router, not this handler, so its hash is not available\n * here. Shipping script-src as Report-Only surfaces the remaining violations\n * without breaking template customisations; teams can graduate to enforcement\n * once their hashes are enumerated.\n *\n * Skipped in development (`NODE_ENV !== 'production'`) so HMR eval and Vite\n * dev-server injects are never blocked. Set `AGENT_NATIVE_DISABLE_DOC_CSP=1`\n * to opt out in production for a template with exotic needs.\n */\nfunction applyDocumentCsp(headers: Headers, sentryScript: string | null): void {\n  if (process.env.NODE_ENV !== \"production\") return;\n  if (process.env.AGENT_NATIVE_DISABLE_DOC_CSP === \"1\") return;\n\n  // script-src as Report-Only: keep this deliberately loose so the framework's\n  // injected analytics and template bootstrap scripts do not look blocked in\n  // browser diagnostics.\n  const sentryBody = extractScriptBody(sentryScript);\n  const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;\n  const gaInlineBody = getGaInlineConfigScriptBody();\n  const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;\n  const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];\n  const gaScriptSrcTokens = [\n    \"'unsafe-inline'\",\n    ...(gaHash ? [gaHash] : []),\n    ...gaHosts,\n  ];\n  const scriptSrcTokens = [\n    \"'self'\",\n    \"'unsafe-inline'\",\n    ...(sentryHash ? [sentryHash] : []),\n    ...(gaHash ? [gaHash] : []),\n    ...gaHosts,\n  ];\n\n  const cspAugmentOptions = {\n    scriptSrcTokens,\n    gaScriptSrcTokens,\n    gaEnabled: Boolean(gaInlineBody),\n  };\n  const existing = headers.get(\"content-security-policy\") ?? \"\";\n  if (!existing) {\n    headers.set(\n      \"content-security-policy\",\n      \"object-src 'none'; base-uri 'self'\",\n    );\n  } else {\n    headers.set(\n      \"content-security-policy\",\n      augmentExistingEnforcedCspForFrameworkScripts(\n        existing,\n        cspAugmentOptions,\n      ),\n    );\n  }\n\n  const scriptSrc = `script-src ${scriptSrcTokens.join(\" \")}`;\n  const existingRo = headers.get(\"content-security-policy-report-only\") ?? \"\";\n  if (!existingRo) {\n    headers.set(\"content-security-policy-report-only\", scriptSrc);\n  } else {\n    headers.set(\n      \"content-security-policy-report-only\",\n      augmentExistingReportOnlyCspForFrameworkScripts(\n        existingRo,\n        cspAugmentOptions,\n      ),\n    );\n  }\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/.well-known/\") ||\n    pathname.startsWith(\"/_agent_native/\") ||\n    pathname.startsWith(\"/_agent-native/\") ||\n    pathname.startsWith(\"/api/\") ||\n    pathname.startsWith(\"/@vite/\") ||\n    pathname.startsWith(\"/@id/\") ||\n    pathname.startsWith(\"/@fs/\") ||\n    pathname === \"/@react-refresh\" ||\n    pathname === \"/__vite_ping\" ||\n    pathname === \"/__open-in-editor\" ||\n    pathname === \"/favicon.ico\" ||\n    pathname === \"/favicon.png\" ||\n    (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n  );\n}\n\nasync function rewriteMountedResponse(\n  response: Response,\n  basePath: string,\n  pathname: string,\n  requestUrl: string,\n): Promise<Response> {\n  const sentryClientConfigScript = getSentryClientConfigScript();\n  const headers = new Headers(response.headers);\n  applyDefaultSsrCacheHeader(headers, response.status, pathname);\n  applyDefaultSpeculationRulesHeader(headers, response.status, basePath);\n\n  const location = headers.get(\"location\");\n  if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n    headers.set(\"location\", prefixMountedPath(location, basePath));\n  }\n\n  const contentType = headers.get(\"content-type\") ?? \"\";\n  if (!contentType.toLowerCase().includes(\"text/html\") || !response.body) {\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  const html = await response.text();\n  headers.delete(\"content-length\");\n  applyDocumentCsp(headers, sentryClientConfigScript);\n  return new Response(\n    injectHeadScript(\n      injectDefaultSocialImageMeta(\n        prefixMountedHtml(html, basePath),\n        defaultSocialImageUrl(requestUrl, basePath),\n      ),\n      sentryClientConfigScript,\n    ),\n    {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    },\n  );\n}\n\n/**\n * Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> | unknown) {\n  const handler = createRequestHandler(getBuild as any);\n  return defineEventHandler(async (event) => {\n    const basePath = getAppBasePath();\n    const p = stripAppBasePath(event.url.pathname);\n    if (isFrameworkOrAssetPath(p)) {\n      return new Response(null, { status: 404 });\n    }\n    try {\n      const request = requestWithPathname(event.req as Request, p, basePath);\n      // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the\n      // request's session/cookies here, and pin an explicitly anonymous request\n      // context. That keeps the SSR HTML/.data identical for every visitor so it\n      // can be hard-cached at the CDN for everyone (see applyDefaultSsrCacheHeader).\n      //\n      // Consequence: SSR loaders that call `getRequestUserEmail()` / `accessFilter()`\n      // always see the unauthenticated branch and render public content only. Any\n      // per-user view (private records, share-grant access, who's logged in) MUST\n      // be resolved CLIENT-SIDE after load, never baked into SSR. Do not re-pin the\n      // session here to \"fix\" a per-user page — that silently makes the page\n      // uncacheable and/or leaks one user's data into another's cached copy.\n      const ctx = { userEmail: undefined, orgId: undefined };\n      if (request.method === \"HEAD\") {\n        const getRequest = new Request(request.url, {\n          method: \"GET\",\n          headers: request.headers,\n          signal: request.signal,\n        });\n        const response = await runWithRequestContext(ctx, () =>\n          handler(getRequest),\n        );\n        return await rewriteMountedResponse(\n          new Response(null, {\n            status: response.status,\n            statusText: response.statusText,\n            headers: response.headers,\n          }),\n          basePath,\n          p,\n          request.url,\n        );\n      }\n      return await rewriteMountedResponse(\n        await runWithRequestContext(ctx, () => handler(request)),\n        basePath,\n        p,\n        request.url,\n      );\n    } catch (err) {\n      // Log the full stack server-side, but never leak it to the client.\n      // Stack traces expose file paths, library versions, and code structure\n      // that aid reconnaissance attacks. In dev we surface the message text\n      // so devtools shows something useful; in prod we return a bare 500.\n      console.error(\"[ssr-handler] SSR error:\", err);\n      const isProd = process.env.NODE_ENV === \"production\";\n      const body = isProd\n        ? \"Internal Server Error\"\n        : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n      return new Response(body, {\n        status: 500,\n        headers: { \"content-type\": \"text/plain\" },\n      });\n    }\n  });\n}\n"]}
+{"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACxC;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,SAAS,cAAc;IACrB,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,yBAAyB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI;SACR,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,qCAAqC,CAC1C,IAAI,GAAG,CACL,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,EAC3D,UAAU,CACX,CAAC,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,sCAAsC,QAAQ,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,iDAAiD,QAAQ,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CACP,2CAA2C,8BAA8B,IAAI,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,CACP,4CAA4C,+BAA+B,IAAI,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,6CAA6C,gCAAgC,IAAI,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,0CAA0C,6BAA6B,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,uCAAuC,QAAQ,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CACP,2CAA2C,6BAA6B,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,0BAA0B,CACjC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO;IAEhE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/C,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,UAAkB;IAElB,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,kCAAkC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAC1B,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACjC,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC5C,EACD,wBAAwB,CACzB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,+EAA+E;YAC/E,EAAE;YACF,gFAAgF;YAChF,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { defineEventHandler } from \"h3\";\n/**\n * Shared SSR catch-all handler for React Router framework mode.\n *\n * Templates wire this up via:\n *\n *   // server/routes/[...page].get.ts\n *   import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n *   export default createH3SSRHandler(\n *     () => import(\"virtual:react-router/server-build\"),\n *   );\n *\n * The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n */\nimport { createRequestHandler } from \"react-router\";\n\nimport {\n  DEFAULT_SSR_CACHE_HEADERS,\n  DEFAULT_SPECULATION_RULES_PATH,\n} from \"../shared/cache-control.js\";\nimport {\n  AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n  AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n  AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n  AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n  AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n  withAgentNativeSocialImageCacheBuster,\n} from \"../shared/social-meta.js\";\nimport {\n  getAppBasePathFromViteEnv,\n  stripAppBasePath as canonicalStripAppBasePath,\n} from \"./app-base-path.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { getSentryClientConfigScript } from \"./sentry-config.js\";\n\nexport {\n  DEFAULT_SSR_CACHE_HEADERS,\n  DEFAULT_SPECULATION_RULES_HEADER,\n  DEFAULT_SSR_CACHE_CONTROL,\n} from \"../shared/cache-control.js\";\n\nfunction getAppBasePath(): string {\n  return getAppBasePathFromViteEnv();\n}\n\nfunction stripAppBasePath(pathname: string): string {\n  return canonicalStripAppBasePath(pathname, getAppBasePath());\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n  if (!basePath) return pathname;\n  if (pathname === basePath) return \"/\";\n  if (pathname.startsWith(`${basePath}/`)) {\n    return pathname.slice(basePath.length) || \"/\";\n  }\n  return pathname;\n}\n\nfunction requestWithPathname(\n  request: Request,\n  pathname: string,\n  basePath: string,\n): Request {\n  const url = new URL(request.url);\n  let changed = false;\n  if (basePath && pathname === \"/__manifest\") {\n    const paths = url.searchParams.get(\"paths\");\n    if (paths) {\n      const strippedPaths = paths\n        .split(\",\")\n        .map((path) => stripBasePath(path, basePath))\n        .join(\",\");\n      if (strippedPaths !== paths) {\n        url.searchParams.set(\"paths\", strippedPaths);\n        changed = true;\n      }\n    }\n  }\n  if (url.pathname !== pathname) {\n    url.pathname = pathname;\n    changed = true;\n  }\n  if (!changed) return request;\n  const init: RequestInit & { duplex?: \"half\" } = {\n    method: request.method,\n    headers: request.headers,\n    signal: request.signal,\n  };\n  if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n    init.body = request.body;\n    init.duplex = \"half\";\n  }\n  return new Request(url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n  if (!basePath || !path.startsWith(\"/\") || path.startsWith(\"//\")) return path;\n  if (path === basePath || path.startsWith(`${basePath}/`)) return path;\n  return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n  if (!basePath) return html;\n  return html\n    .replace(\n      /\\b(href|src|action|formaction|poster)=([\"'])(\\/(?!\\/)[^\"']*)\\2/g,\n      (_match, attr: string, quote: string, path: string) =>\n        `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n    )\n    .replace(/url\\(([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\\)/g, (_match, quote, path) => {\n      const q = quote || \"\";\n      return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n    });\n}\n\nfunction injectHeadScript(html: string, script: string | null): string {\n  if (!script) return html;\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n  return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]*\\bproperty=([\"'])og:image\\1)[^>]*>/i;\nconst TWITTER_CARD_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:card\\1)[^>]*>/i;\nconst TWITTER_IMAGE_META_RE =\n  /<meta\\b(?=[^>]*\\bname=([\"'])twitter:image\\1)[^>]*>/i;\n\nfunction defaultSocialImageUrl(requestUrl: string, basePath: string): string {\n  return withAgentNativeSocialImageCacheBuster(\n    new URL(\n      prefixMountedPath(AGENT_NATIVE_SOCIAL_IMAGE_PATH, basePath),\n      requestUrl,\n    ).toString(),\n  );\n}\n\nfunction injectDefaultSocialImageMeta(html: string, imageUrl: string): string {\n  const headCloseIdx = html.indexOf(\"</head>\");\n  if (headCloseIdx === -1) return html;\n\n  const hasAnySocialImage =\n    OG_IMAGE_META_RE.test(html) || TWITTER_IMAGE_META_RE.test(html);\n  const tags: string[] = [];\n\n  if (!hasAnySocialImage) {\n    tags.push(`<meta property=\"og:image\" content=\"${imageUrl}\">`);\n    tags.push(`<meta property=\"og:image:secure_url\" content=\"${imageUrl}\">`);\n    tags.push(\n      `<meta property=\"og:image:type\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_TYPE}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:width\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_WIDTH}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:height\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT}\">`,\n    );\n    tags.push(\n      `<meta property=\"og:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n    );\n  }\n  if (!TWITTER_CARD_META_RE.test(html)) {\n    tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n  }\n  if (!hasAnySocialImage) {\n    tags.push(`<meta name=\"twitter:image\" content=\"${imageUrl}\">`);\n    tags.push(\n      `<meta name=\"twitter:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n    );\n  }\n\n  if (tags.length === 0) return html;\n  return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction isSsrHtmlOrDataResponse(\n  headers: Headers,\n  status: number,\n  pathname: string,\n): boolean {\n  if (status < 200 || status >= 400) return false;\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (contentType.includes(\"text/html\")) return true;\n  return pathname.endsWith(\".data\") && contentType.includes(\"text/x-script\");\n}\n\n/**\n * Apply the SSR cache policy to the response headers.\n *\n * ┌──────────────────────────────────────────────────────────────────────────┐\n * │ SSR IS A PUBLIC, HARD-CDN-CACHED SHELL — SERVED IDENTICALLY TO EVERYONE.   │\n * │                                                                            │\n * │ Every SSR HTML / React Router `.data` response gets the same public        │\n * │ stale-while-revalidate policy for ALL visitors, authenticated or not, so   │\n * │ the edge serves one shared copy and never stampedes origin.                │\n * │                                                                            │\n * │ DO NOT reintroduce per-user / cookie-based cache variation here (no        │\n * │ `private`, no `no-store`, no `Vary: Cookie`, no \"authenticated → don't     │\n * │ cache\" branch). That makes pages uncacheable for every logged-in visitor,  │\n * │ which is slow and expensive — exactly the regression this guardrail        │\n * │ prevents. The reason it is SAFE to hard-cache is that the SSR response is  │\n * │ impersonal: `createH3SSRHandler` renders without reading the request's     │\n * │ session/cookies, so there is no per-user data baked into the HTML. ALL     │\n * │ per-user state (who's logged in, private records, access checks) is        │\n * │ resolved CLIENT-SIDE after load. Keep it that way: if you need the SSR     │\n * │ output to differ per user, the fix is to move that work client-side, not   │\n * │ to disable caching here.                                                   │\n * └──────────────────────────────────────────────────────────────────────────┘\n */\nfunction applyDefaultSsrCacheHeader(\n  headers: Headers,\n  status: number,\n  pathname: string,\n) {\n  if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;\n\n  // Netlify Functions/proxies are not cached by default. Set all three cache\n  // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,\n  // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache\n  // actually serves SSR HTML/.data from the edge instead of forwarding every\n  // request to origin — for every visitor, authenticated or not.\n  for (const [name, value] of Object.entries(DEFAULT_SSR_CACHE_HEADERS)) {\n    headers.set(name, value);\n  }\n}\n\nfunction applyDefaultSpeculationRulesHeader(\n  headers: Headers,\n  status: number,\n  basePath: string,\n) {\n  if (status < 200 || status >= 400) return;\n  if (headers.has(\"speculation-rules\")) return;\n\n  const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n  if (!contentType.includes(\"text/html\")) return;\n\n  // Cloudflare Speed Brain injects its own Speculation-Rules header when the\n  // origin omits one. Those browser prefetches carry `Sec-Purpose: prefetch`,\n  // and Cloudflare refuses cache-ineligible dynamic pages with a 503 before\n  // the request can reach Netlify/origin. We publish an explicit no-op ruleset\n  // by default so Cloudflare does not inject its edge prefetch rules. Preserve\n  // an app-provided Speculation-Rules header above if a template deliberately\n  // owns this behavior.\n  const rulesPath = prefixMountedPath(DEFAULT_SPECULATION_RULES_PATH, basePath);\n  headers.set(\"speculation-rules\", `\"${rulesPath}\"`);\n}\n\n/**\n * Strip document-level CSP from app HTML responses.\n *\n * Hosted templates inject framework bootstrap scripts, analytics, Sentry config,\n * and app-owned inline scripts whose exact bytes vary by build/template. Any\n * shared CSP header, even Report-Only, can block or noisily report Google Tag\n * Manager and those bootstraps. Extension iframes and webviews keep their own\n * route-specific sandboxes; normal app documents deliberately do not emit CSP.\n */\nfunction removeDocumentCsp(headers: Headers): void {\n  headers.delete(\"content-security-policy\");\n  headers.delete(\"content-security-policy-report-only\");\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n  return (\n    pathname.startsWith(\"/.well-known/\") ||\n    pathname.startsWith(\"/_agent_native/\") ||\n    pathname.startsWith(\"/_agent-native/\") ||\n    pathname.startsWith(\"/api/\") ||\n    pathname.startsWith(\"/@vite/\") ||\n    pathname.startsWith(\"/@id/\") ||\n    pathname.startsWith(\"/@fs/\") ||\n    pathname === \"/@react-refresh\" ||\n    pathname === \"/__vite_ping\" ||\n    pathname === \"/__open-in-editor\" ||\n    pathname === \"/favicon.ico\" ||\n    pathname === \"/favicon.png\" ||\n    (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n  );\n}\n\nasync function rewriteMountedResponse(\n  response: Response,\n  basePath: string,\n  pathname: string,\n  requestUrl: string,\n): Promise<Response> {\n  const sentryClientConfigScript = getSentryClientConfigScript();\n  const headers = new Headers(response.headers);\n  applyDefaultSsrCacheHeader(headers, response.status, pathname);\n  applyDefaultSpeculationRulesHeader(headers, response.status, basePath);\n\n  const location = headers.get(\"location\");\n  if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n    headers.set(\"location\", prefixMountedPath(location, basePath));\n  }\n\n  const contentType = headers.get(\"content-type\") ?? \"\";\n  if (!contentType.toLowerCase().includes(\"text/html\")) {\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n  removeDocumentCsp(headers);\n  if (!response.body) {\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  const html = await response.text();\n  headers.delete(\"content-length\");\n  return new Response(\n    injectHeadScript(\n      injectDefaultSocialImageMeta(\n        prefixMountedHtml(html, basePath),\n        defaultSocialImageUrl(requestUrl, basePath),\n      ),\n      sentryClientConfigScript,\n    ),\n    {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    },\n  );\n}\n\n/**\n * Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> | unknown) {\n  const handler = createRequestHandler(getBuild as any);\n  return defineEventHandler(async (event) => {\n    const basePath = getAppBasePath();\n    const p = stripAppBasePath(event.url.pathname);\n    if (isFrameworkOrAssetPath(p)) {\n      return new Response(null, { status: 404 });\n    }\n    try {\n      const request = requestWithPathname(event.req as Request, p, basePath);\n      // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the\n      // request's session/cookies here, and pin an explicitly anonymous request\n      // context. That keeps the SSR HTML/.data identical for every visitor so it\n      // can be hard-cached at the CDN for everyone (see applyDefaultSsrCacheHeader).\n      //\n      // Consequence: SSR loaders that call `getRequestUserEmail()` / `accessFilter()`\n      // always see the unauthenticated branch and render public content only. Any\n      // per-user view (private records, share-grant access, who's logged in) MUST\n      // be resolved CLIENT-SIDE after load, never baked into SSR. Do not re-pin the\n      // session here to \"fix\" a per-user page — that silently makes the page\n      // uncacheable and/or leaks one user's data into another's cached copy.\n      const ctx = { userEmail: undefined, orgId: undefined };\n      if (request.method === \"HEAD\") {\n        const getRequest = new Request(request.url, {\n          method: \"GET\",\n          headers: request.headers,\n          signal: request.signal,\n        });\n        const response = await runWithRequestContext(ctx, () =>\n          handler(getRequest),\n        );\n        return await rewriteMountedResponse(\n          new Response(null, {\n            status: response.status,\n            statusText: response.statusText,\n            headers: response.headers,\n          }),\n          basePath,\n          p,\n          request.url,\n        );\n      }\n      return await rewriteMountedResponse(\n        await runWithRequestContext(ctx, () => handler(request)),\n        basePath,\n        p,\n        request.url,\n      );\n    } catch (err) {\n      // Log the full stack server-side, but never leak it to the client.\n      // Stack traces expose file paths, library versions, and code structure\n      // that aid reconnaissance attacks. In dev we surface the message text\n      // so devtools shows something useful; in prod we return a bare 500.\n      console.error(\"[ssr-handler] SSR error:\", err);\n      const isProd = process.env.NODE_ENV === \"production\";\n      const body = isProd\n        ? \"Internal Server Error\"\n        : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n      return new Response(body, {\n        status: 500,\n        headers: { \"content-type\": \"text/plain\" },\n      });\n    }\n  });\n}\n"]}

package/dist/server/transcribe-voice.d.ts

@@ -20,7 +20,7 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;
 //# sourceMappingURL=transcribe-voice.d.ts.map

package/docs/content/locales/ar-SA/tracking.mdx

@@ -188,6 +188,61 @@ track("checkout.completed", { total: 49.99, items: 3 });
 
 يختلف هذا عن القياس عن بعد للمتصفح الداخلي لإطار العمل (`trackEvent()` / مشاهدات الصفحة التلقائية - راجع [Browser defaults](#browser-defaults) أدناه), والذي يدعم تحليلات المنتج الخاصة بـ Agent Native. استخدم `track()` لأحداث التحليلات الخاصة بتطبيقك والتي يجب أن تصل إلى مقدمي الخدمة الذين تم تكوينهم.
 
+## إعادة تشغيل الجلسة {#session-replay}
+
+يمكن لتطبيقات Agent Native الاشتراك في إعادة تشغيل جلسة المتصفح من الطرف الأول دون إضافة SDK تحليلات ثانٍ. استدعِ `configureTracking()` مرة واحدة في جذر المتصفح ومرر مفتاح Analytics العام بالإضافة إلى نقطة نهاية المُجمِّع:
+
+```ts
+import { configureTracking } from "@agent-native/core/client";
+
+configureTracking({
+  key: "anpk_...",
+  endpoint: "https://analytics.example.com/api/analytics/track",
+  sessionReplay: {
+    enabled: true,
+    sampleRate: 0.1,
+  },
+  getDefaultProps: (_event, props) => ({
+    ...props,
+    app: "my-app",
+    template: "my-template",
+  }),
+});
+```
+
+عندما يكون `sessionReplay.enabled` صادقًا (truthy)، يقوم العميل باستيراد `@rrweb/record` ديناميكيًا بعد بدء التشغيل وينشر أجزاء إعادة التشغيل إلى نقطة نهاية إعادة التشغيل. إذا كانت `endpoint` تنتهي بـ `/api/analytics/track` أو `/track`، يتم اشتقاق نقطة نهاية إعادة التشغيل تلقائيًا كـ `/api/analytics/replay`. تجاوز ذلك صراحةً باستخدام `sessionReplay.endpoint` عندما يكون مُجمِّع إعادة التشغيل موجودًا في مكان آخر.
+
+تستدعي جذور قوالب Agent Native بالفعل `configureTracking()`. يمكن لعمليات نشر القوالب المستضافة تفعيل إعادة التشغيل باستخدام متغيرات بيئة Vite/Netlify، بينما يجب أن يُفضّل مستهلكو المكتبة الصيغة الصريحة `configureTracking({ key, endpoint, sessionReplay })` أعلاه:
+
+```bash
+VITE_AGENT_NATIVE_ANALYTICS_PUBLIC_KEY=anpk_...
+VITE_AGENT_NATIVE_ANALYTICS_ENDPOINT=https://analytics.example.com/api/analytics/track
+VITE_AGENT_NATIVE_SESSION_REPLAY_ENABLED=true
+VITE_AGENT_NATIVE_SESSION_REPLAY_SAMPLE_RATE=0.1
+```
+
+يقوم مساعد المتصفح أيضًا بإجراء قراءة غير محظِّرة وبأفضل جهد ممكن لجلسة مصادقة Agent Native الحالية. إعادة التشغيل مخصصة لتسجيل الدخول فقط بشكل افتراضي: عندما يكون `sessionReplay` مفعّلاً، لا يبدأ التسجيل ما لم تُحلّ الجلسة إلى عنوان بريد إلكتروني لمستخدم. تتضمن إعادة تشغيل الجلسات المسجَّلة `userId`/`userEmail` المدعومين بالبريد الإلكتروني بالإضافة إلى `orgId`.
+
+اضبط `sessionReplay.requireSignedInUser: false` أو `VITE_AGENT_NATIVE_SESSION_REPLAY_REQUIRE_AUTH=false` فقط من أجل نشر إعادة تشغيل مجهولة الهوية مقصود. عندما يتم تعطيل تحكم المصادقة، تظل التسجيلات المجهولة قابلة للاستعلام حسب الزائر المجهول، والجلسة، والتطبيق/القالب، واسم المضيف، والمسار.
+
+يتم أخذ عينات من إعادة تشغيل الجلسة بشكل حتمي لكل جلسة متصفح. يقوم `sampleRate` بقيمة `0.1` بتسجيل حوالي 10% من الجلسات المؤهلة؛ استخدم `1` عندما تكون المجموعة المؤهلة صغيرة عن قصد، مثل اختبار الاستخدام الداخلي لتسجيل الدخول فقط.
+
+إعدادات الخصوصية الافتراضية متحفظة عن قصد لكنها لا تزال مفيدة لإعادة التشغيل:
+
+- يتم إخفاء المدخلات بشكل افتراضي (`maskAllInputs: true`).
+- يظل نص الصفحة مرئيًا ما لم يتم تمييز عنصر بـ `.an-mask` أو `data-an-mask`.
+- يتم حظر المناطق الحساسة بمحددات مثل `[data-sensitive]`، و`.an-block`، و`.an-private`، و`data-an-block`، و`data-an-private`، والحقول الشبيهة ببطاقات الائتمان/كلمات المرور/أرقام الضمان الاجتماعي.
+- يتم تنظيف عناوين URL باستخدام نفس مساعد `scrubUrl()` المستخدم بواسطة تحليلات المتصفح.
+- التقاط إعادة التشغيل مخصص للويب فقط وباختيار المستخدم؛ فهو لا يسجل شاشات سطح المكتب الأصلية.
+
+أثناء التسجيل، تلتقط إعادة تشغيل الجلسة أيضًا مخرجات وحدة تحكم المتصفح (`log`، و`info`، و`warn`، و`error`، و`debug`، بالإضافة إلى `error` / `unhandledrejection` الخاصة بالنافذة) وبيانات وصفية لطلبات الشبكة (`fetch` و XHR) كأحداث rrweb مخصصة موسومة، بحيث يمكن للوكلاء وعارض إعادة التشغيل تصحيح المشكلات التي يبلغ عنها المستخدمون. الالتقاط مفعّل افتراضيًا عند تفعيل إعادة التشغيل؛ اضبطه أو عطّله باستخدام خياري `sessionReplay.console` و`sessionReplay.network`، حيث يقبل كل منهما قيمة منطقية (boolean) أو كائن خيارات. لا يتم التقاط نصوص/رؤوس الطلبات والاستجابات مطلقًا، ويتم تنظيف عناوين URL، ويتم اقتطاع الرسائل، ويُستثنى حركة استيعاب/تتبع المسجِّل نفسه، وتضيف ميزانيات كل جلسة (1000 حدث وحدة تحكم / 2000 حدث شبكة) إشعار اقتطاع عند تجاوزها.
+
+يخزّن قالب Analytics بيانات إعادة التشغيل الوصفية في SQL (`session_recordings`) ويخزّن الأجزاء عبر مراجع blob خاصة (`session_replay_chunks`). لا تتلقى المتصفحات والوكلاء أبدًا عناوين URL الخاصة بالموفر. تمر إعادة التشغيل عبر مسارات خادم محددة النطاق، وتُرجع أدوات الوكيل الافتراضية ملخصات أو أحداث إعادة تشغيل محدودة، وليس وصولاً خامًا إلى جدول الأجزاء.
+
+عندما تحتاج إلى تسليم تسجيل خاص إلى وكيل خارجي، استخدم عنصر التحكم **نسخ للوكيل** في صفحة تفاصيل الجلسة. فهو يُنشئ رابط `agent_access` محدد النطاق بالتسجيل ومدته ساعتان، ويقوم بعرض SSR لحمولة اكتشاف صغيرة على `/sessions/:recordingId`، ولا يكشف إلا عن واجهات برمجة تطبيقات JSON الخاصة بسياق/أحداث الوكيل. لا تتغير رؤية التسجيل.
+
+للتطوير المحلي فقط، يمكن لـ Analytics الرجوع إلى أجزاء SQL مضمّنة محدودة السعة عندما يكون تخزين blob الخاص غير متاح. يجب أن تُهيّئ عمليات النشر في الإنتاج تخزين blob خاصًا أو مشفّرًا بدلاً من الاعتماد على Postgres لحمولات إعادة التشغيل.
+
 ## متقدم: الموفرون المخصصون والداخليون {#advanced}
 
 تحتاج معظم التطبيقات فقط إلى `track()` / `identify()` وموفر مدمج. بقية السطح - تسجيل موفري الخدمة المخصصين، واجهة `TrackingProvider`، الأجزاء الداخلية المجمعة، والقياس عن بعد للمتصفح الخاص بإطار العمل - موجود أدناه.

package/docs/content/locales/de-DE/tracking.mdx

@@ -188,6 +188,61 @@ Hauptunterschiede zum [server `track()`](#track):
 
 Dies unterscheidet sich von der internen Browser-Telemetrie des Frameworks (`trackEvent()` / automatische Seitenaufrufe – siehe [Browser defaults](#browser-defaults) unten), die die eigene Produktanalyse von Agent Native unterstützt. Verwenden Sie `track()` für die eigenen Analyseereignisse Ihrer App, die Ihre konfigurierten Anbieter erreichen sollen.
 
+## Session Replay {#session-replay}
+
+Agent-Native-Apps können sich für erstklassiges browserseitiges Session Replay entscheiden, ohne ein zweites Analytics-SDK hinzuzufügen. Rufen Sie `configureTracking()` einmal im Browser-Root auf und übergeben Sie den öffentlichen Analytics-Schlüssel sowie den Collector-Endpunkt:
+
+```ts
+import { configureTracking } from "@agent-native/core/client";
+
+configureTracking({
+  key: "anpk_...",
+  endpoint: "https://analytics.example.com/api/analytics/track",
+  sessionReplay: {
+    enabled: true,
+    sampleRate: 0.1,
+  },
+  getDefaultProps: (_event, props) => ({
+    ...props,
+    app: "my-app",
+    template: "my-template",
+  }),
+});
+```
+
+Wenn `sessionReplay.enabled` einen truthy Wert hat, importiert der Client nach dem Start dynamisch `@rrweb/record` und sendet Replay-Chunks an den Replay-Endpunkt. Wenn `endpoint` auf `/api/analytics/track` oder `/track` endet, wird der Replay-Endpunkt automatisch als `/api/analytics/replay` abgeleitet. Überschreiben Sie ihn explizit mit `sessionReplay.endpoint`, wenn der Replay-Collector an anderer Stelle liegt.
+
+Agent-Native-Template-Roots rufen `configureTracking()` bereits auf. Gehostete Template-Deployments können Replay über Vite-/Netlify-Umgebungsvariablen aktivieren, während Bibliotheks-Konsumenten die explizite Form `configureTracking({ key, endpoint, sessionReplay })` von oben bevorzugen sollten:
+
+```bash
+VITE_AGENT_NATIVE_ANALYTICS_PUBLIC_KEY=anpk_...
+VITE_AGENT_NATIVE_ANALYTICS_ENDPOINT=https://analytics.example.com/api/analytics/track
+VITE_AGENT_NATIVE_SESSION_REPLAY_ENABLED=true
+VITE_AGENT_NATIVE_SESSION_REPLAY_SAMPLE_RATE=0.1
+```
+
+Der Browser-Helfer führt außerdem einen nach bestem Bemühen erfolgenden, nicht blockierenden Lesevorgang der aktuellen Agent-Native-Auth-Sitzung durch. Replay ist standardmäßig nur für angemeldete Benutzer verfügbar: Wenn `sessionReplay` aktiviert ist, startet die Aufzeichnung nur, wenn die Sitzung zu einer Benutzer-E-Mail-Adresse aufgelöst werden kann. Replays angemeldeter Benutzer enthalten E-Mail-basierte `userId`/`userEmail` sowie `orgId`.
+
+Setzen Sie `sessionReplay.requireSignedInUser: false` oder `VITE_AGENT_NATIVE_SESSION_REPLAY_REQUIRE_AUTH=false` nur für ein absichtlich anonymes Replay-Deployment. Wenn die Auth-Prüfung deaktiviert ist, bleiben anonyme Aufzeichnungen nach anonymem Besucher, Sitzung, App/Template, Hostname und Pfad abfragbar.
+
+Session Replay wird deterministisch pro Browser-Sitzung gesampelt. Eine `sampleRate` von `0.1` zeichnet etwa 10 % der infrage kommenden Sitzungen auf; verwenden Sie `1`, wenn die infrage kommende Population absichtlich klein ist, etwa beim Dogfooding nur für angemeldete Benutzer.
+
+Die Datenschutz-Standardeinstellungen sind bewusst konservativ, aber für die Wiedergabe weiterhin nützlich:
+
+- Eingaben werden standardmäßig maskiert (`maskAllInputs: true`).
+- Seitentext bleibt sichtbar, sofern ein Element nicht mit `.an-mask` oder `data-an-mask` markiert ist.
+- Sensible Bereiche werden mit Selektoren wie `[data-sensitive]`, `.an-block`, `.an-private`, `data-an-block`, `data-an-private` sowie kreditkarten-/passwort-/sozialversicherungsnummerähnlichen Feldern blockiert.
+- URLs werden mit demselben `scrubUrl()`-Helfer bereinigt, der auch von der Browser-Analyse verwendet wird.
+- Die Replay-Aufzeichnung ist ausschließlich webbasiert und opt-in; native Desktop-Bildschirme werden nicht aufgezeichnet.
+
+Während der Aufzeichnung erfasst Session Replay außerdem die Browser-Konsolenausgabe (`log`, `info`, `warn`, `error`, `debug`, sowie die Fenster-Ereignisse `error` / `unhandledrejection`) und Netzwerkanfrage-Metadaten (`fetch` und XHR) als getaggte rrweb-Custom-Events, damit Agenten und der Replay-Viewer von Nutzern gemeldete Probleme debuggen können. Die Erfassung ist standardmäßig aktiviert, wenn Replay aktiviert ist; passen Sie sie mit den Optionen `sessionReplay.console` und `sessionReplay.network` an oder deaktivieren Sie sie, wobei jede Option entweder einen booleschen Wert oder ein Optionsobjekt akzeptiert. Request-/Response-Bodies und -Header werden nie erfasst, URLs werden bereinigt, Nachrichten werden gekürzt, der eigene Ingest-/Tracking-Traffic des Recorders wird ausgeschlossen, und sitzungsbezogene Budgets (1000 Konsolen- / 2000 Netzwerkereignisse) fügen bei Überschreitung einen Kürzungshinweis hinzu.
+
+Das Analytics-Template speichert Replay-Metadaten in SQL (`session_recordings`) und Chunks über private Blob-Referenzen (`session_replay_chunks`). Browser und Agenten erhalten niemals Anbieter-URLs. Die Wiedergabe läuft über zugriffsbeschränkte Server-Routen, und die Standard-Agent-Tools liefern Zusammenfassungen oder begrenzte Replay-Ereignisse zurück, keinen Rohzugriff auf die Chunk-Tabelle.
+
+Wenn Sie eine private Aufzeichnung an einen externen Agenten übergeben müssen, verwenden Sie auf der Sitzungsdetailseite die Funktion **Copy for agent**. Sie erzeugt einen zwei Stunden gültigen, aufzeichnungsgebundenen `agent_access`-Link, rendert eine kleine Discovery-Payload per SSR unter `/sessions/:recordingId` und stellt ausschließlich die JSON-APIs für Agent-Kontext/-Ereignisse bereit. Die Sichtbarkeit der Aufzeichnung ändert sich dadurch nicht.
+
+Nur für die lokale Entwicklung kann Analytics auf begrenzte SQL-Inline-Chunks zurückgreifen, wenn kein privater Blob-Speicher verfügbar ist. Produktions-Deployments sollten privaten oder verschlüsselten Blob-Speicher konfigurieren, anstatt sich für Replay-Payloads auf Postgres zu verlassen.
+
 ## Erweitert: benutzerdefinierte Anbieter und Interna {#advanced}
 
 Die meisten Apps benötigen nur `track()` / `identify()` und einen integrierten Anbieter. Der Rest der Oberfläche – Registrierung benutzerdefinierter Anbieter, die `TrackingProvider`-Schnittstelle, Batch-Interna und die eigene Browser-Telemetrie des Frameworks – finden Sie unten.