npm - @agent-native/core - Versions diffs - 0.96.0 → 0.98.0 - Mend

@agent-native/core 0.96.0 → 0.98.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1241) hide show

package/dist/server/realtime-voice.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"realtime-voice.js","sourceRoot":"","sources":["../../src/server/realtime-voice.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,CAAC,MAAM,2BAA2B,GACtC,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,oCAAoC,CAAC;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5D,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC;AAE3D,MAAM,yBAAyB,GAAG,0CAA0C,CAAC;AAC7E,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,oBAAoB,GACxB,wVAAwV,CAAC;AAC3V,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA4D/C,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAyB,EACzB,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAgB;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC;AACzD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,UAAU;YACR,OAAO,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CACrD,IAAI,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,8BAA8B,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAkB,EAClB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAIpB,CAAC;YACF,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;iBAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5D,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,UAAU,CACvD,MAAM,EACN,YAAY,CACb,CAAC;IACF,OAAO,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAoC;IAEpC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,QAAQ,CACnB,qBAAqB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAC7C,0BAA0B,CAC3B;YACD,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,QAAQ;QAAE,OAAO,UAAU,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAiB,CAAC,CAAC;IAC9E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ;QACzD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY;QACxC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAClB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC5E,MAAM,YAAY,GAChB,eAAe,IAAI,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC;QACrD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,KAAK;QACxB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAoC,EACpC,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;IACxD,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE;QAAE,OAAO,oBAAoB,CAAC;IAC1D,OAAO,QAAQ,CACb,qBAAqB,CACnB,GAAG,oBAAoB,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CACvD,EACD,sBAAsB,CACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,gBAAgB,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACjD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CACnC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA6B,EAC7B,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,EACL,4BAA4B,CAC7B,CAAC;QACF,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+BAA+B,4BAA4B,SAAS;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,YAAY;gBACpB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;gBACrC,CAAC,CAAC,SAAS;SACd,EACD,KAAK,IAAI,EAAE;YACT,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,EAAE,CAAC;YAC7D,MAAM,iBAAiB,GAAG,OAAO,CAC/B,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE;gBACrC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,CACrC,CAAC;YACF,MAAM,MAAM,GAAG,iBAAiB;gBAC9B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAC;gBAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,uEAAuE;oBACzE,IAAI,EAAE,+BAA+B;iBACtC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG;gBACd,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;gBACzD,YAAY;gBACZ,iBAAiB,EAAE,CAAC,OAAO,CAAC;gBAC5B,KAAK,EAAE;oBACL,KAAK,EAAE;wBACL,aAAa,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE;wBAClD,cAAc,EAAE;4BACd,IAAI,EAAE,cAAc;4BACpB,eAAe,EAAE,IAAI;4BACrB,kBAAkB,EAAE,IAAI;4BACxB,SAAS,EAAE,MAAM;yBAClB;qBACF;oBACD,MAAM,EAAE;wBACN,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;qBAC1D;iBACF;gBACD,KAAK;gBACL,WAAW,EAAE,MAAM;aACpB,CAAC;YAEF,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,gBAAgB,EAChB,wBAAwB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;wBACtC,CAAC,CAAC,wBAAwB,EAAE;wBAC5B,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,CACrC,CAAC;oBACF,UAAU,CAAC,YAAY,CAAC,GAAG,CACzB,QAAQ,EACR,kBAAkB,CAAC,SAAU,CAAC,IAAI,EAAE,CACrC,CAAC;oBACF,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE;wBAC5C,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,UAAU,kBAAkB,CAAC,UAAW,CAAC,IAAI,EAAE,EAAE;4BAChE,mBAAmB,EAAE,kBAAkB,CAAC,SAAU,CAAC,IAAI,EAAE;4BACzD,GAAG,+BAA+B,EAAE;4BACpC,GAAG,CAAC,kBAAkB,CAAC,MAAM;gCAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,MAAM,EAAE;gCACpD,CAAC,CAAC,EAAE,CAAC;yBACR;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;qBACvC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBACrB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC7C,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,EAAE;wBAChD,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,MAAM,EAAE;4BACjC,0BAA0B,EAAE,MAAM,6BAA6B,CAC7D,IAAI,CAAC,SAAS,CACf;yBACF;wBACD,IAAI,EAAE,IAAI;qBACX,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,iBAAiB;wBACtB,CAAC,CAAC,oDAAoD;wBACtD,CAAC,CAAC,yCAAyC;iBAC9C,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,QAAQ,EACR,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAW,CAAC,CAAC,CAAC,MAAO,CAC7D,CAAC;gBACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACpE,OAAO;oBACL,KAAK,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,mCAAmC,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBACtI,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,4CAA4C;iBAC/F,CAAC;YACJ,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;YAC5D,OAAO,SAAS,CAAC;QACnB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IAOtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC9D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IACE,SAAS,KAAK,SAAS;QACvB,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAwC;IAExC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,IACE,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,mBAAmB,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,CAAC,MAAM,EACb,oCAAoC,CACrC,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,mBAAmB;YAClC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC7B,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,sBAAsB;YACjD,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,gBAAqC,EACrC,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAClC,KAAK,EACL,kCAAkC,CACnC,CAAC;QACF,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,kCAAkC,kCAAkC,SAAS;aACrF,CAAC;QACJ,CAAC;QAED,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;YAChC,CAAC,CAAC,YAAY,OAAO,CAAC,SAAS,EAAE;YACjC,CAAC,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE;gBACH,QAAQ;gBACR,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C;SACF,EACD,KAAK,IAAI,EAAE;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,wBAAwB,CACrC,MAAM,OAAO,CAAC,WAAW,CAAC;oBACxB,KAAK;oBACL,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,GAAG,OAAO;iBACX,CAAC,CACH,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,QAAiB;oBACzB,MAAM,EAAE,QAAQ,CACd,sBAAsB,CAAC,KAAK,CAAC,IAAI,uBAAuB,EACxD,oCAAoC,CACrC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CACtC,QAAa,EACb,OAAoC,EACpC,OAAwC;IAExC,IAAI,OAAO,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,GAAG,CACL,wBAAwB,EACxB,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAC7C,CAAC;IACF,OAAO;QACL,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,wBAAwB;KACnC,CAAC;AACJ,CAAC","sourcesContent":["import {\n defineEventHandler,\n getHeader,\n getMethod,\n readRawBody,\n setResponseHeader,\n setResponseStatus,\n type H3Event,\n} from \"h3\";\n\nimport { getBuilderGatewayRequestHeaders } from \"../agent/engine/builder-gateway-headers.js\";\nimport {\n actionsToEngineTools,\n type ActionEntry,\n} from \"../agent/production-agent.js\";\nimport {\n redactSensitiveFields,\n sanitizeToolErrorText,\n sanitizeToolErrorValue,\n} from \"../agent/tool-error-redaction.js\";\nimport { getSession } from \"./auth.js\";\nimport {\n getBuilderGatewayBaseUrl,\n resolveBuilderCredentials,\n resolveSecret,\n} from \"./credential-provider.js\";\nimport { getH3App } from \"./framework-request-handler.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\n\nexport const REALTIME_VOICE_SESSION_PATH =\n \"/_agent-native/realtime-voice/session\";\nexport const REALTIME_VOICE_TOOL_PATH = \"/_agent-native/realtime-voice/tool\";\nexport const REALTIME_VOICE_MAX_SDP_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_BODY_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS = 16_000;\n\nconst OPENAI_REALTIME_CALLS_URL = \"https://api.openai.com/v1/realtime/calls\";\nconst DEFAULT_MODEL = \"gpt-realtime-2.1\";\nconst DEFAULT_VOICE = \"marin\";\nconst DEFAULT_INSTRUCTIONS =\n \"You are the live voice interface for this Agent Native app. Speak naturally, briefly, and conversationally. Use the available function tools when the user asks you to navigate or take an action. Never claim an action succeeded until its tool result confirms success. If a tool requires approval, explain that the user must approve it in chat.\";\nconst MAX_INSTRUCTIONS_CHARS = 16_000;\nconst MAX_TOOL_DESCRIPTION_CHARS = 2_000;\nconst MAX_TOOL_SCHEMA_CHARS = 64 * 1024;\nconst MAX_APPROVAL_KEY_CHARS = 1_024;\nconst REALTIME_TOOL_NAME = /^[A-Za-z0-9_-]{1,64}$/;\nconst CALL_ID = /^[A-Za-z0-9_-]{1,256}$/;\nconst SESSION_ID = /^[A-Za-z0-9_.:-]{1,256}$/;\nconst BROWSER_TAB_ID = /^[A-Za-z0-9_-]{1,96}$/;\n\nexport interface RealtimeVoiceRequestContext {\n event: H3Event;\n userEmail: string;\n orgId?: string;\n browserTabId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionRequest extends RealtimeVoiceRequestContext {\n name: string;\n args: Record<string, unknown>;\n callId: string;\n sessionId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionResult {\n status: \"completed\" \| \"failed\" \| \"approval_required\";\n output: string;\n approvalKey?: string;\n}\n\nexport interface MountRealtimeVoiceRoutesOptions {\n /** Server-controlled model. Defaults to gpt-realtime-2.1. /\n model?: string;\n /* Server-controlled output voice. Defaults to marin. /\n voice?: string;\n /* Static app guidance appended to the safe default voice instructions. /\n instructions?: string;\n /* Per-request app/navigation guidance. It is sent only to OpenAI. /\n getInstructions?: (\n context: RealtimeVoiceRequestContext,\n ) => string \| null \| undefined \| Promise<string \| null \| undefined>;\n /* Optional app-specific active-organization resolver. /\n resolveOrgId?: (\n event: H3Event,\n ) => string \| null \| undefined \| Promise<string \| null \| undefined>;\n /\n Central agent tool executor supplied by the agent-chat plugin. The executor\n * owns validation, approval, journaling, timeout, mutation notification, and\n * action-result normalization; this transport must not call ActionEntry.run.\n /\n executeTool: (\n request: RealtimeVoiceToolExecutionRequest,\n ) =>\n \| RealtimeVoiceToolExecutionResult\n \| Promise<RealtimeVoiceToolExecutionResult>;\n}\n\ninterface RealtimeFunctionTool {\n type: \"function\";\n name: string;\n description: string;\n parameters: Record<string, unknown>;\n}\n\ninterface AuthenticatedVoiceContext extends RealtimeVoiceRequestContext {\n timezone?: string;\n}\n\nfunction readSafeHeader(event: H3Event, name: string): string \| undefined {\n const value = getHeader(event, name);\n if (typeof value !== \"string\") return undefined;\n const trimmed = value.trim();\n return trimmed \|\| undefined;\n}\n\nfunction configuredIdentifier(\n value: string \| undefined,\n fallback: string,\n): string {\n const trimmed = value?.trim();\n return trimmed && /^[A-Za-z0-9_.:-]{1,128}$/.test(trimmed)\n ? trimmed\n : fallback;\n}\n\nfunction truncate(value: string, maxChars: number): string {\n if (value.length <= maxChars) return value;\n return `${value.slice(0, maxChars)}\\n\\n...[truncated]`;\n}\n\nfunction sanitizeOutput(value: unknown, maxChars: number): string {\n let serialized: string;\n try {\n const redacted = redactSensitiveFields(value);\n serialized =\n typeof redacted === \"string\"\n ? redacted\n : (JSON.stringify(redacted, (_key, entry) =>\n typeof entry === \"bigint\" ? entry.toString() : entry,\n ) ?? \"null\");\n } catch {\n serialized = \"[Unserializable tool result]\";\n }\n return truncate(sanitizeToolErrorText(serialized), maxChars);\n}\n\nasync function safeOpenAiErrorDetail(\n response: Response,\n apiKey: string,\n): Promise<string \| null> {\n const raw = await response.text().catch(() => \"\");\n if (!raw) return null;\n let detail = raw;\n try {\n const parsed = JSON.parse(raw) as {\n error?: { message?: unknown; code?: unknown; type?: unknown } \| unknown;\n };\n if (parsed.error && typeof parsed.error === \"object\") {\n const error = parsed.error as {\n message?: unknown;\n code?: unknown;\n type?: unknown;\n };\n detail = [error.message, error.code, error.type]\n .filter((value) => typeof value === \"string\" && value.trim())\n .join(\" · \");\n }\n } catch {\n // Plain-text upstream errors are sanitized below.\n }\n const redacted = sanitizeToolErrorText(detail).replaceAll(\n apiKey,\n \"[REDACTED]\",\n );\n return truncate(redacted, 500) \|\| null;\n}\n\nfunction normalizeToolSchema(\n inputSchema: unknown,\n): Record<string, unknown> \| null {\n try {\n const serialized = JSON.stringify(inputSchema);\n if (!serialized \|\| serialized.length > MAX_TOOL_SCHEMA_CHARS) return null;\n const parsed = JSON.parse(serialized) as unknown;\n if (!parsed \|\| typeof parsed !== \"object\" \|\| Array.isArray(parsed)) {\n return null;\n }\n return parsed as Record<string, unknown>;\n } catch {\n return null;\n }\n}\n\nfunction buildRealtimeTools(\n actions: Record<string, ActionEntry>,\n): RealtimeFunctionTool[] {\n const tools: RealtimeFunctionTool[] = [];\n for (const tool of actionsToEngineTools(actions)) {\n if (!REALTIME_TOOL_NAME.test(tool.name)) continue;\n const parameters = normalizeToolSchema(tool.inputSchema);\n if (!parameters) continue;\n tools.push({\n type: \"function\",\n name: tool.name,\n description: truncate(\n sanitizeToolErrorText(tool.description \|\| \"\"),\n MAX_TOOL_DESCRIPTION_CHARS,\n ),\n parameters,\n });\n }\n return tools;\n}\n\nfunction declaredBodyBytes(event: H3Event): number \| undefined {\n const raw = readSafeHeader(event, \"content-length\");\n if (!raw) return undefined;\n const parsed = Number.parseInt(raw, 10);\n return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;\n}\n\nasync function readLimitedRawBody(\n event: H3Event,\n maxBytes: number,\n): Promise<string \| null \| \"oversize\"> {\n const declared = declaredBodyBytes(event);\n if (declared !== undefined && declared > maxBytes) return \"oversize\";\n\n const raw = await readRawBody(event, \"utf8\").catch(() => undefined);\n if (raw == null) return null;\n const text =\n typeof raw === \"string\" ? raw : new TextDecoder().decode(raw as Uint8Array);\n return new TextEncoder().encode(text).byteLength > maxBytes\n ? \"oversize\"\n : text;\n}\n\nasync function authenticateVoiceRequest(\n event: H3Event,\n options: MountRealtimeVoiceRoutesOptions,\n): Promise<AuthenticatedVoiceContext \| null> {\n const session = await getSession(event).catch(() => null);\n if (!session?.email) return null;\n const resolvedOrgId = options.resolveOrgId\n ? await options.resolveOrgId(event)\n : session.orgId;\n const timezone = readSafeHeader(event, \"x-user-timezone\");\n const rawBrowserTabId = readSafeHeader(event, \"x-agent-native-browser-tab\");\n const browserTabId =\n rawBrowserTabId && BROWSER_TAB_ID.test(rawBrowserTabId)\n ? rawBrowserTabId\n : undefined;\n return {\n event,\n userEmail: session.email,\n ...(resolvedOrgId ? { orgId: resolvedOrgId } : {}),\n ...(timezone && timezone.length < 64 ? { timezone } : {}),\n ...(browserTabId ? { browserTabId } : {}),\n };\n}\n\nasync function buildInstructions(\n context: RealtimeVoiceRequestContext,\n options: MountRealtimeVoiceRoutesOptions,\n): Promise<string> {\n const dynamic = await options.getInstructions?.(context);\n const appInstructions = dynamic ?? options.instructions;\n if (!appInstructions?.trim()) return DEFAULT_INSTRUCTIONS;\n return truncate(\n sanitizeToolErrorText(\n `${DEFAULT_INSTRUCTIONS}\\n\\n${appInstructions.trim()}`,\n ),\n MAX_INSTRUCTIONS_CHARS,\n );\n}\n\n/\n Hash the authenticated identity before sending it to OpenAI. The stable\n * digest is useful for abuse detection without disclosing the user's email.\n /\nexport async function realtimeVoiceSafetyIdentifier(\n userEmail: string,\n): Promise<string> {\n const input = new TextEncoder().encode(\n `agent-native:${userEmail.trim().toLowerCase()}`,\n );\n const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", input);\n return Array.from(new Uint8Array(digest), (byte) =>\n byte.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\n\nfunction invalidMethod(event: H3Event): { error: string } {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n}\n\nfunction createSessionHandler(\n tools: RealtimeFunctionTool[],\n options: MountRealtimeVoiceRoutesOptions,\n) {\n return defineEventHandler(async (event: H3Event) => {\n if (getMethod(event) !== \"POST\") return invalidMethod(event);\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n const auth = await authenticateVoiceRequest(event, options);\n if (!auth) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n }\n\n const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n if (!contentType?.includes(\"application/sdp\")) {\n setResponseStatus(event, 415);\n return { error: \"Expected Content-Type: application/sdp\" };\n }\n\n const rawSdp = await readLimitedRawBody(\n event,\n REALTIME_VOICE_MAX_SDP_BYTES,\n );\n if (rawSdp === \"oversize\") {\n setResponseStatus(event, 413);\n return {\n error: `SDP offer is too large (max ${REALTIME_VOICE_MAX_SDP_BYTES} bytes)`,\n };\n }\n const sdp = rawSdp ?? \"\";\n if (!sdp.trim()) {\n setResponseStatus(event, 400);\n return { error: \"SDP offer is required\" };\n }\n\n return runWithRequestContext(\n {\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n timezone: auth.timezone,\n run: auth.browserTabId\n ? { browserTabId: auth.browserTabId }\n : undefined,\n },\n async () => {\n const builderCredentials = await resolveBuilderCredentials();\n const builderConfigured = Boolean(\n builderCredentials.privateKey?.trim() &&\n builderCredentials.publicKey?.trim(),\n );\n const apiKey = builderConfigured\n ? null\n : (await resolveSecret(\"OPENAI_API_KEY\"))?.trim();\n if (!builderConfigured && !apiKey) {\n setResponseStatus(event, 409);\n return {\n error:\n \"Connect Builder or configure an OpenAI API key to use realtime voice.\",\n code: \"realtime_voice_setup_required\",\n };\n }\n\n const instructions = await buildInstructions(auth, options);\n const session = {\n type: \"realtime\",\n model: configuredIdentifier(options.model, DEFAULT_MODEL),\n instructions,\n output_modalities: [\"audio\"],\n audio: {\n input: {\n transcription: { model: \"gpt-4o-mini-transcribe\" },\n turn_detection: {\n type: \"semantic_vad\",\n create_response: true,\n interrupt_response: true,\n eagerness: \"auto\",\n },\n },\n output: {\n voice: configuredIdentifier(options.voice, DEFAULT_VOICE),\n },\n },\n tools,\n tool_choice: \"auto\",\n };\n\n let upstream: Response;\n try {\n if (builderConfigured) {\n const gatewayUrl = new URL(\n \"realtime/calls\",\n getBuilderGatewayBaseUrl().endsWith(\"/\")\n ? getBuilderGatewayBaseUrl()\n : `${getBuilderGatewayBaseUrl()}/`,\n );\n gatewayUrl.searchParams.set(\n \"apiKey\",\n builderCredentials.publicKey!.trim(),\n );\n upstream = await fetch(gatewayUrl.toString(), {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: `Bearer ${builderCredentials.privateKey!.trim()}`,\n \"x-builder-api-key\": builderCredentials.publicKey!.trim(),\n ...getBuilderGatewayRequestHeaders(),\n ...(builderCredentials.userId\n ? { \"x-builder-user-id\": builderCredentials.userId }\n : {}),\n },\n body: JSON.stringify({ sdp, session }),\n });\n } else {\n const form = new FormData();\n form.set(\"sdp\", sdp);\n form.set(\"session\", JSON.stringify(session));\n upstream = await fetch(OPENAI_REALTIME_CALLS_URL, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"OpenAI-Safety-Identifier\": await realtimeVoiceSafetyIdentifier(\n auth.userEmail,\n ),\n },\n body: form,\n });\n }\n } catch {\n setResponseStatus(event, 502);\n return {\n error: builderConfigured\n ? \"Could not reach the Builder realtime voice gateway\"\n : \"Could not reach the OpenAI Realtime API\",\n };\n }\n\n if (!upstream.ok) {\n const detail = await safeOpenAiErrorDetail(\n upstream,\n builderConfigured ? builderCredentials.privateKey! : apiKey!,\n );\n setResponseStatus(event, builderConfigured ? upstream.status : 502);\n return {\n error: `${builderConfigured ? \"Builder\" : \"OpenAI\"} rejected the realtime session (${upstream.status})${detail ? `: ${detail}` : \"\"}`,\n };\n }\n\n const answerSdp = await upstream.text().catch(() => \"\");\n if (!answerSdp.trim()) {\n setResponseStatus(event, 502);\n return {\n error: `${builderConfigured ? \"Builder\" : \"OpenAI\"} returned an empty realtime session answer`,\n };\n }\n\n setResponseStatus(event, upstream.status);\n setResponseHeader(event, \"Content-Type\", \"application/sdp\");\n return answerSdp;\n },\n );\n });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction parseToolRequest(value: unknown): {\n name: string;\n args: Record<string, unknown>;\n callId: string;\n sessionId?: string;\n browserTabId?: string;\n} \| null {\n if (!isRecord(value)) return null;\n const { name, args, callId, sessionId, browserTabId } = value;\n if (typeof name !== \"string\" \|\| !REALTIME_TOOL_NAME.test(name)) return null;\n if (typeof callId !== \"string\" \|\| !CALL_ID.test(callId)) return null;\n if (!isRecord(args)) return null;\n if (\n sessionId !== undefined &&\n (typeof sessionId !== \"string\" \|\| !SESSION_ID.test(sessionId))\n ) {\n return null;\n }\n if (\n browserTabId !== undefined &&\n (typeof browserTabId !== \"string\" \|\| !BROWSER_TAB_ID.test(browserTabId))\n ) {\n return null;\n }\n return {\n name,\n args,\n callId,\n ...(sessionId ? { sessionId } : {}),\n ...(browserTabId ? { browserTabId } : {}),\n };\n}\n\nfunction normalizeExecutionResult(\n result: RealtimeVoiceToolExecutionResult,\n): RealtimeVoiceToolExecutionResult {\n const status = result?.status;\n if (\n status !== \"completed\" &&\n status !== \"failed\" &&\n status !== \"approval_required\"\n ) {\n throw new Error(\"Invalid realtime tool execution status\");\n }\n const output = sanitizeOutput(\n result.output,\n REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n );\n return {\n status,\n output,\n ...(status === \"approval_required\" &&\n typeof result.approvalKey === \"string\" &&\n result.approvalKey.length > 0 &&\n result.approvalKey.length <= MAX_APPROVAL_KEY_CHARS\n ? { approvalKey: result.approvalKey }\n : {}),\n };\n}\n\nfunction createToolHandler(\n allowedToolNames: ReadonlySet<string>,\n options: MountRealtimeVoiceRoutesOptions,\n) {\n return defineEventHandler(async (event: H3Event) => {\n if (getMethod(event) !== \"POST\") return invalidMethod(event);\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n const auth = await authenticateVoiceRequest(event, options);\n if (!auth) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n }\n\n const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n if (!contentType?.includes(\"application/json\")) {\n setResponseStatus(event, 415);\n return { error: \"Expected Content-Type: application/json\" };\n }\n\n const raw = await readLimitedRawBody(\n event,\n REALTIME_VOICE_MAX_TOOL_BODY_BYTES,\n );\n if (raw === \"oversize\") {\n setResponseStatus(event, 413);\n return {\n error: `Tool request is too large (max ${REALTIME_VOICE_MAX_TOOL_BODY_BYTES} bytes)`,\n };\n }\n\n let parsedBody: unknown;\n try {\n parsedBody = JSON.parse(raw ?? \"\");\n } catch {\n setResponseStatus(event, 400);\n return { error: \"Invalid realtime tool request\" };\n }\n const request = parseToolRequest(parsedBody);\n if (!request) {\n setResponseStatus(event, 400);\n return { error: \"Invalid realtime tool request\" };\n }\n if (!allowedToolNames.has(request.name)) {\n setResponseStatus(event, 404);\n return { error: \"Unknown realtime voice tool\" };\n }\n\n const browserTabId = request.browserTabId ?? auth.browserTabId;\n const threadId = request.sessionId\n ? `realtime:${request.sessionId}`\n : `realtime:${request.callId}`;\n return runWithRequestContext(\n {\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n timezone: auth.timezone,\n run: {\n threadId,\n ...(browserTabId ? { browserTabId } : {}),\n },\n },\n async () => {\n try {\n const result = normalizeExecutionResult(\n await options.executeTool({\n event,\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n ...request,\n }),\n );\n return { callId: request.callId, ...result };\n } catch (error) {\n setResponseStatus(event, 500);\n return {\n callId: request.callId,\n status: \"failed\" as const,\n output: truncate(\n sanitizeToolErrorValue(error) \|\| \"Tool execution failed\",\n REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n ),\n };\n }\n },\n );\n });\n}\n\n/* Mount the authenticated OpenAI Realtime WebRTC and tool bridge routes. */\nexport function mountRealtimeVoiceRoutes(\n nitroApp: any,\n actions: Record<string, ActionEntry>,\n options: MountRealtimeVoiceRoutesOptions,\n): { sessionPath: string; toolPath: string } {\n if (typeof options?.executeTool !== \"function\") {\n throw new Error(\"mountRealtimeVoiceRoutes requires executeTool\");\n }\n\n const tools = buildRealtimeTools(actions);\n const allowedToolNames = new Set(tools.map((tool) => tool.name));\n const app = getH3App(nitroApp);\n app.use(REALTIME_VOICE_SESSION_PATH, createSessionHandler(tools, options));\n app.use(\n REALTIME_VOICE_TOOL_PATH,\n createToolHandler(allowedToolNames, options),\n );\n return {\n sessionPath: REALTIME_VOICE_SESSION_PATH,\n toolPath: REALTIME_VOICE_TOOL_PATH,\n };\n}\n"]}
1	+ {"version":3,"file":"realtime-voice.js","sourceRoot":"","sources":["../../src/server/realtime-voice.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,IAAI,CAAC;AAEZ,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,MAAM,CAAC,MAAM,2BAA2B,GACtC,uCAAuC,CAAC;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,oCAAoC,CAAC;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5D,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,oCAAoC,GAAG,MAAM,CAAC;AAC3D,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAEvD,MAAM,yBAAyB,GAAG,0CAA0C,CAAC;AAC7E,MAAM,aAAa,GAAG,kBAAkB,CAAC;AACzC,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,oBAAoB,GACxB,wVAAwV,CAAC;AAC3V,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AACzC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AACnD,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,MAAM,UAAU,GAAG,0BAA0B,CAAC;AAC9C,MAAM,cAAc,GAAG,uBAAuB,CAAC;AA4D/C,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAyB,EACzB,QAAgB;IAEhB,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAgB;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC;AACzD,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC9C,UAAU;YACR,OAAO,QAAQ,KAAK,QAAQ;gBAC1B,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACxC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CACrD,IAAI,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,UAAU,GAAG,8BAA8B,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC,qBAAqB,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAkB,EAClB,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAC;QACF,IAAI,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAIpB,CAAC;YACF,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;iBAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5D,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC,UAAU,CACvD,MAAM,EACN,YAAY,CACb,CAAC;IACF,OAAO,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,mBAAmB,CAC1B,WAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,IACE,CAAC,UAAU;YACX,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC;gBACnC,oCAAoC,EACtC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAY,CAAC;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAoC;IAEpC,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClD,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU;YAAE,SAAS;QAC1B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,QAAQ,CACnB,qBAAqB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,EAC7C,0BAA0B,CAC3B;YACD,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAgC,EAChC,aAAqC;IAErC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,EAAE,CAAC;QACpE,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;QACpC,MAAM,gBAAgB,GAAG;YACvB,GAAG,OAAO;YACV,KAAK,EAAE,SAAS;YAChB,WAAW,EAAE,MAAM;SACpB,CAAC;QACF,IACE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC3D,gCAAgC,EAChC,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,KAAc,EACd,QAAgB;IAEhB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,GAAG,QAAQ;QAAE,OAAO,UAAU,CAAC;IAErE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GACR,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAiB,CAAC,CAAC;IAC9E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ;QACzD,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,KAAc,EACd,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,aAAa,GAAG,OAAO,CAAC,YAAY;QACxC,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;QACnC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAClB,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,cAAc,CAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IAC5E,MAAM,YAAY,GAChB,eAAe,IAAI,cAAc,CAAC,IAAI,CAAC,eAAe,CAAC;QACrD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,KAAK;QACL,SAAS,EAAE,OAAO,CAAC,KAAK;QACxB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,OAAoC,EACpC,OAAwC;IAExC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,eAAe,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;IACxD,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE;QAAE,OAAO,oBAAoB,CAAC;IAC1D,OAAO,QAAQ,CACb,qBAAqB,CACnB,GAAG,oBAAoB,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,CACvD,EACD,sBAAsB,CACvB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,SAAiB;IAEjB,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACpC,gBAAgB,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACjD,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CACnC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA6B,EAC7B,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAC9C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,KAAK,EACL,4BAA4B,CAC7B,CAAC;QACF,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,+BAA+B,4BAA4B,SAAS;aAC5E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC5C,CAAC;QAED,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,YAAY;gBACpB,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;gBACrC,CAAC,CAAC,SAAS;SACd,EACD,KAAK,IAAI,EAAE;YACT,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,EAAE,CAAC;YAC7D,MAAM,iBAAiB,GAAG,OAAO,CAC/B,kBAAkB,CAAC,UAAU,EAAE,IAAI,EAAE;gBACrC,kBAAkB,CAAC,SAAS,EAAE,IAAI,EAAE,CACrC,CAAC;YACF,MAAM,MAAM,GAAG,iBAAiB;gBAC9B,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACpD,IAAI,CAAC,iBAAiB,IAAI,CAAC,MAAM,EAAE,CAAC;gBAClC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EACH,uEAAuE;oBACzE,IAAI,EAAE,+BAA+B;iBACtC,CAAC;YACJ,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,WAAW,GAAG;gBAClB,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;gBACzD,YAAY;gBACZ,iBAAiB,EAAE,CAAC,OAAO,CAAC;gBAC5B,KAAK,EAAE;oBACL,KAAK,EAAE;wBACL,aAAa,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE;wBAClD,cAAc,EAAE;4BACd,IAAI,EAAE,cAAc;4BACpB,eAAe,EAAE,IAAI;4BACrB,kBAAkB,EAAE,IAAI;4BACxB,SAAS,EAAE,MAAM;yBAClB;qBACF;oBACD,MAAM,EAAE;wBACN,KAAK,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC;qBAC1D;iBACF;aACF,CAAC;YACF,MAAM,OAAO,GAAG;gBACd,GAAG,WAAW;gBACd,KAAK,EAAE,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC;gBAC5C,WAAW,EAAE,MAAM;aACpB,CAAC;YAEF,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,gBAAgB,EAChB,wBAAwB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;wBACtC,CAAC,CAAC,wBAAwB,EAAE;wBAC5B,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,CACrC,CAAC;oBACF,UAAU,CAAC,YAAY,CAAC,GAAG,CACzB,QAAQ,EACR,kBAAkB,CAAC,SAAU,CAAC,IAAI,EAAE,CACrC,CAAC;oBACF,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE;wBAC5C,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,cAAc,EAAE,kBAAkB;4BAClC,aAAa,EAAE,UAAU,kBAAkB,CAAC,UAAW,CAAC,IAAI,EAAE,EAAE;4BAChE,mBAAmB,EAAE,kBAAkB,CAAC,SAAU,CAAC,IAAI,EAAE;4BACzD,GAAG,+BAA+B,EAAE;4BACpC,GAAG,CAAC,kBAAkB,CAAC,MAAM;gCAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,MAAM,EAAE;gCACpD,CAAC,CAAC,EAAE,CAAC;yBACR;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;qBACvC,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBACrB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC7C,QAAQ,GAAG,MAAM,KAAK,CAAC,yBAAyB,EAAE;wBAChD,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,MAAM,EAAE;4BACjC,0BAA0B,EAAE,MAAM,6BAA6B,CAC7D,IAAI,CAAC,SAAS,CACf;yBACF;wBACD,IAAI,EAAE,IAAI;qBACX,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,iBAAiB;wBACtB,CAAC,CAAC,oDAAoD;wBACtD,CAAC,CAAC,yCAAyC;iBAC9C,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,QAAQ,EACR,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAW,CAAC,CAAC,CAAC,MAAO,CAC7D,CAAC;gBACF,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACpE,OAAO;oBACL,KAAK,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,mCAAmC,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBACtI,CAAC;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,KAAK,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,4CAA4C;iBAC/F,CAAC;YACJ,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC1C,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;YAC5D,OAAO,SAAS,CAAC;QACnB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IAOtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC9D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,IACE,SAAS,KAAK,SAAS;QACvB,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAC9D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,YAAY,KAAK,SAAS;QAC1B,CAAC,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EACxE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAAwC;IAExC,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC;IAC9B,IACE,MAAM,KAAK,WAAW;QACtB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,mBAAmB,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,CAAC,MAAM,EACb,oCAAoC,CACrC,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM;QACN,GAAG,CAAC,MAAM,KAAK,mBAAmB;YAClC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAC7B,MAAM,CAAC,WAAW,CAAC,MAAM,IAAI,sBAAsB;YACjD,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE;YACrC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,gBAAqC,EACrC,OAAwC;IAExC,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAc,EAAE,EAAE;QACjD,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,CAAC;QACzE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/C,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,yCAAyC,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAClC,KAAK,EACL,kCAAkC,CACnC,CAAC;QACF,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,kCAAkC,kCAAkC,SAAS;aACrF,CAAC;QACJ,CAAC;QAED,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QAClD,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC;QAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;YAChC,CAAC,CAAC,YAAY,OAAO,CAAC,SAAS,EAAE;YACjC,CAAC,CAAC,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,qBAAqB,CAC1B;YACE,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE;gBACH,QAAQ;gBACR,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C;SACF,EACD,KAAK,IAAI,EAAE;YACT,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,wBAAwB,CACrC,MAAM,OAAO,CAAC,WAAW,CAAC;oBACxB,KAAK;oBACL,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,GAAG,OAAO;iBACX,CAAC,CACH,CAAC;gBACF,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YAC/C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC9B,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,QAAiB;oBACzB,MAAM,EAAE,QAAQ,CACd,sBAAsB,CAAC,KAAK,CAAC,IAAI,uBAAuB,EACxD,oCAAoC,CACrC;iBACF,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CACtC,QAAa,EACb,OAAoC,EACpC,OAAwC;IAExC,IAAI,OAAO,OAAO,EAAE,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAClE,CAAC;IACF,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,GAAG,CAAC,GAAG,CACL,wBAAwB,EACxB,iBAAiB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAC7C,CAAC;IACF,OAAO;QACL,WAAW,EAAE,2BAA2B;QACxC,QAAQ,EAAE,wBAAwB;KACnC,CAAC;AACJ,CAAC","sourcesContent":["import {\n defineEventHandler,\n getHeader,\n getMethod,\n readRawBody,\n setResponseHeader,\n setResponseStatus,\n type H3Event,\n} from \"h3\";\n\nimport { getBuilderGatewayRequestHeaders } from \"../agent/engine/builder-gateway-headers.js\";\nimport {\n actionsToEngineTools,\n type ActionEntry,\n} from \"../agent/production-agent.js\";\nimport {\n redactSensitiveFields,\n sanitizeToolErrorText,\n sanitizeToolErrorValue,\n} from \"../agent/tool-error-redaction.js\";\nimport { getSession } from \"./auth.js\";\nimport {\n getBuilderGatewayBaseUrl,\n resolveBuilderCredentials,\n resolveSecret,\n} from \"./credential-provider.js\";\nimport { getH3App } from \"./framework-request-handler.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { isSameOriginRequest } from \"./request-origin.js\";\n\nexport const REALTIME_VOICE_SESSION_PATH =\n \"/_agent-native/realtime-voice/session\";\nexport const REALTIME_VOICE_TOOL_PATH = \"/_agent-native/realtime-voice/tool\";\nexport const REALTIME_VOICE_MAX_SDP_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_BODY_BYTES = 64 * 1024;\nexport const REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS = 16_000;\nexport const REALTIME_VOICE_MAX_TOOLS = 32;\nexport const REALTIME_VOICE_MAX_TOOL_SCHEMA_BYTES = 32_000;\nexport const REALTIME_VOICE_MAX_SESSION_BYTES = 64_000;\n\nconst OPENAI_REALTIME_CALLS_URL = \"https://api.openai.com/v1/realtime/calls\";\nconst DEFAULT_MODEL = \"gpt-realtime-2.1\";\nconst DEFAULT_VOICE = \"marin\";\nconst DEFAULT_INSTRUCTIONS =\n \"You are the live voice interface for this Agent Native app. Speak naturally, briefly, and conversationally. Use the available function tools when the user asks you to navigate or take an action. Never claim an action succeeded until its tool result confirms success. If a tool requires approval, explain that the user must approve it in chat.\";\nconst MAX_INSTRUCTIONS_CHARS = 16_000;\nconst MAX_TOOL_DESCRIPTION_CHARS = 2_000;\nconst MAX_APPROVAL_KEY_CHARS = 1_024;\nconst REALTIME_TOOL_NAME = /^[A-Za-z0-9_-]{1,64}$/;\nconst CALL_ID = /^[A-Za-z0-9_-]{1,256}$/;\nconst SESSION_ID = /^[A-Za-z0-9_.:-]{1,256}$/;\nconst BROWSER_TAB_ID = /^[A-Za-z0-9_-]{1,96}$/;\n\nexport interface RealtimeVoiceRequestContext {\n event: H3Event;\n userEmail: string;\n orgId?: string;\n browserTabId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionRequest extends RealtimeVoiceRequestContext {\n name: string;\n args: Record<string, unknown>;\n callId: string;\n sessionId?: string;\n}\n\nexport interface RealtimeVoiceToolExecutionResult {\n status: \"completed\" \| \"failed\" \| \"approval_required\";\n output: string;\n approvalKey?: string;\n}\n\nexport interface MountRealtimeVoiceRoutesOptions {\n /** Server-controlled model. Defaults to gpt-realtime-2.1. /\n model?: string;\n /* Server-controlled output voice. Defaults to marin. /\n voice?: string;\n /* Static app guidance appended to the safe default voice instructions. /\n instructions?: string;\n /* Per-request app/navigation guidance. It is sent only to OpenAI. /\n getInstructions?: (\n context: RealtimeVoiceRequestContext,\n ) => string \| null \| undefined \| Promise<string \| null \| undefined>;\n /* Optional app-specific active-organization resolver. /\n resolveOrgId?: (\n event: H3Event,\n ) => string \| null \| undefined \| Promise<string \| null \| undefined>;\n /\n Central agent tool executor supplied by the agent-chat plugin. The executor\n * owns validation, approval, journaling, timeout, mutation notification, and\n * action-result normalization; this transport must not call ActionEntry.run.\n /\n executeTool: (\n request: RealtimeVoiceToolExecutionRequest,\n ) =>\n \| RealtimeVoiceToolExecutionResult\n \| Promise<RealtimeVoiceToolExecutionResult>;\n}\n\ninterface RealtimeFunctionTool {\n type: \"function\";\n name: string;\n description: string;\n parameters: Record<string, unknown>;\n}\n\ninterface AuthenticatedVoiceContext extends RealtimeVoiceRequestContext {\n timezone?: string;\n}\n\nfunction readSafeHeader(event: H3Event, name: string): string \| undefined {\n const value = getHeader(event, name);\n if (typeof value !== \"string\") return undefined;\n const trimmed = value.trim();\n return trimmed \|\| undefined;\n}\n\nfunction configuredIdentifier(\n value: string \| undefined,\n fallback: string,\n): string {\n const trimmed = value?.trim();\n return trimmed && /^[A-Za-z0-9_.:-]{1,128}$/.test(trimmed)\n ? trimmed\n : fallback;\n}\n\nfunction truncate(value: string, maxChars: number): string {\n if (value.length <= maxChars) return value;\n return `${value.slice(0, maxChars)}\\n\\n...[truncated]`;\n}\n\nfunction sanitizeOutput(value: unknown, maxChars: number): string {\n let serialized: string;\n try {\n const redacted = redactSensitiveFields(value);\n serialized =\n typeof redacted === \"string\"\n ? redacted\n : (JSON.stringify(redacted, (_key, entry) =>\n typeof entry === \"bigint\" ? entry.toString() : entry,\n ) ?? \"null\");\n } catch {\n serialized = \"[Unserializable tool result]\";\n }\n return truncate(sanitizeToolErrorText(serialized), maxChars);\n}\n\nasync function safeOpenAiErrorDetail(\n response: Response,\n apiKey: string,\n): Promise<string \| null> {\n const raw = await response.text().catch(() => \"\");\n if (!raw) return null;\n let detail = raw;\n try {\n const parsed = JSON.parse(raw) as {\n error?: { message?: unknown; code?: unknown; type?: unknown } \| unknown;\n };\n if (parsed.error && typeof parsed.error === \"object\") {\n const error = parsed.error as {\n message?: unknown;\n code?: unknown;\n type?: unknown;\n };\n detail = [error.message, error.code, error.type]\n .filter((value) => typeof value === \"string\" && value.trim())\n .join(\" · \");\n }\n } catch {\n // Plain-text upstream errors are sanitized below.\n }\n const redacted = sanitizeToolErrorText(detail).replaceAll(\n apiKey,\n \"[REDACTED]\",\n );\n return truncate(redacted, 500) \|\| null;\n}\n\nfunction normalizeToolSchema(\n inputSchema: unknown,\n): Record<string, unknown> \| null {\n try {\n const serialized = JSON.stringify(inputSchema);\n if (\n !serialized \|\|\n Buffer.byteLength(serialized, \"utf8\") >\n REALTIME_VOICE_MAX_TOOL_SCHEMA_BYTES\n ) {\n return null;\n }\n const parsed = JSON.parse(serialized) as unknown;\n if (!parsed \|\| typeof parsed !== \"object\" \|\| Array.isArray(parsed)) {\n return null;\n }\n return parsed as Record<string, unknown>;\n } catch {\n return null;\n }\n}\n\nfunction buildRealtimeTools(\n actions: Record<string, ActionEntry>,\n): RealtimeFunctionTool[] {\n const tools: RealtimeFunctionTool[] = [];\n for (const tool of actionsToEngineTools(actions)) {\n if (!REALTIME_TOOL_NAME.test(tool.name)) continue;\n const parameters = normalizeToolSchema(tool.inputSchema);\n if (!parameters) continue;\n tools.push({\n type: \"function\",\n name: tool.name,\n description: truncate(\n sanitizeToolErrorText(tool.description \|\| \"\"),\n MAX_TOOL_DESCRIPTION_CHARS,\n ),\n parameters,\n });\n }\n return tools;\n}\n\nfunction packRealtimeTools(\n session: Record<string, unknown>,\n eligibleTools: RealtimeFunctionTool[],\n): RealtimeFunctionTool[] {\n const packed: RealtimeFunctionTool[] = [];\n for (const tool of eligibleTools.slice(0, REALTIME_VOICE_MAX_TOOLS)) {\n const candidate = [...packed, tool];\n const candidateSession = {\n ...session,\n tools: candidate,\n tool_choice: \"auto\",\n };\n if (\n Buffer.byteLength(JSON.stringify(candidateSession), \"utf8\") <=\n REALTIME_VOICE_MAX_SESSION_BYTES\n ) {\n packed.push(tool);\n }\n }\n return packed;\n}\n\nfunction declaredBodyBytes(event: H3Event): number \| undefined {\n const raw = readSafeHeader(event, \"content-length\");\n if (!raw) return undefined;\n const parsed = Number.parseInt(raw, 10);\n return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;\n}\n\nasync function readLimitedRawBody(\n event: H3Event,\n maxBytes: number,\n): Promise<string \| null \| \"oversize\"> {\n const declared = declaredBodyBytes(event);\n if (declared !== undefined && declared > maxBytes) return \"oversize\";\n\n const raw = await readRawBody(event, \"utf8\").catch(() => undefined);\n if (raw == null) return null;\n const text =\n typeof raw === \"string\" ? raw : new TextDecoder().decode(raw as Uint8Array);\n return new TextEncoder().encode(text).byteLength > maxBytes\n ? \"oversize\"\n : text;\n}\n\nasync function authenticateVoiceRequest(\n event: H3Event,\n options: MountRealtimeVoiceRoutesOptions,\n): Promise<AuthenticatedVoiceContext \| null> {\n const session = await getSession(event).catch(() => null);\n if (!session?.email) return null;\n const resolvedOrgId = options.resolveOrgId\n ? await options.resolveOrgId(event)\n : session.orgId;\n const timezone = readSafeHeader(event, \"x-user-timezone\");\n const rawBrowserTabId = readSafeHeader(event, \"x-agent-native-browser-tab\");\n const browserTabId =\n rawBrowserTabId && BROWSER_TAB_ID.test(rawBrowserTabId)\n ? rawBrowserTabId\n : undefined;\n return {\n event,\n userEmail: session.email,\n ...(resolvedOrgId ? { orgId: resolvedOrgId } : {}),\n ...(timezone && timezone.length < 64 ? { timezone } : {}),\n ...(browserTabId ? { browserTabId } : {}),\n };\n}\n\nasync function buildInstructions(\n context: RealtimeVoiceRequestContext,\n options: MountRealtimeVoiceRoutesOptions,\n): Promise<string> {\n const dynamic = await options.getInstructions?.(context);\n const appInstructions = dynamic ?? options.instructions;\n if (!appInstructions?.trim()) return DEFAULT_INSTRUCTIONS;\n return truncate(\n sanitizeToolErrorText(\n `${DEFAULT_INSTRUCTIONS}\\n\\n${appInstructions.trim()}`,\n ),\n MAX_INSTRUCTIONS_CHARS,\n );\n}\n\n/\n Hash the authenticated identity before sending it to OpenAI. The stable\n * digest is useful for abuse detection without disclosing the user's email.\n /\nexport async function realtimeVoiceSafetyIdentifier(\n userEmail: string,\n): Promise<string> {\n const input = new TextEncoder().encode(\n `agent-native:${userEmail.trim().toLowerCase()}`,\n );\n const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", input);\n return Array.from(new Uint8Array(digest), (byte) =>\n byte.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\n\nfunction invalidMethod(event: H3Event): { error: string } {\n setResponseStatus(event, 405);\n return { error: \"Method not allowed\" };\n}\n\nfunction createSessionHandler(\n tools: RealtimeFunctionTool[],\n options: MountRealtimeVoiceRoutesOptions,\n) {\n return defineEventHandler(async (event: H3Event) => {\n if (getMethod(event) !== \"POST\") return invalidMethod(event);\n if (!isSameOriginRequest(event)) {\n setResponseStatus(event, 403);\n return { error: \"Cross-origin request rejected\" };\n }\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n const auth = await authenticateVoiceRequest(event, options);\n if (!auth) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n }\n\n const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n if (!contentType?.includes(\"application/sdp\")) {\n setResponseStatus(event, 415);\n return { error: \"Expected Content-Type: application/sdp\" };\n }\n\n const rawSdp = await readLimitedRawBody(\n event,\n REALTIME_VOICE_MAX_SDP_BYTES,\n );\n if (rawSdp === \"oversize\") {\n setResponseStatus(event, 413);\n return {\n error: `SDP offer is too large (max ${REALTIME_VOICE_MAX_SDP_BYTES} bytes)`,\n };\n }\n const sdp = rawSdp ?? \"\";\n if (!sdp.trim()) {\n setResponseStatus(event, 400);\n return { error: \"SDP offer is required\" };\n }\n\n return runWithRequestContext(\n {\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n timezone: auth.timezone,\n run: auth.browserTabId\n ? { browserTabId: auth.browserTabId }\n : undefined,\n },\n async () => {\n const builderCredentials = await resolveBuilderCredentials();\n const builderConfigured = Boolean(\n builderCredentials.privateKey?.trim() &&\n builderCredentials.publicKey?.trim(),\n );\n const apiKey = builderConfigured\n ? null\n : (await resolveSecret(\"OPENAI_API_KEY\"))?.trim();\n if (!builderConfigured && !apiKey) {\n setResponseStatus(event, 409);\n return {\n error:\n \"Connect Builder or configure an OpenAI API key to use realtime voice.\",\n code: \"realtime_voice_setup_required\",\n };\n }\n\n const instructions = await buildInstructions(auth, options);\n const sessionBase = {\n type: \"realtime\",\n model: configuredIdentifier(options.model, DEFAULT_MODEL),\n instructions,\n output_modalities: [\"audio\"],\n audio: {\n input: {\n transcription: { model: \"gpt-4o-mini-transcribe\" },\n turn_detection: {\n type: \"semantic_vad\",\n create_response: true,\n interrupt_response: true,\n eagerness: \"auto\",\n },\n },\n output: {\n voice: configuredIdentifier(options.voice, DEFAULT_VOICE),\n },\n },\n };\n const session = {\n ...sessionBase,\n tools: packRealtimeTools(sessionBase, tools),\n tool_choice: \"auto\",\n };\n\n let upstream: Response;\n try {\n if (builderConfigured) {\n const gatewayUrl = new URL(\n \"realtime/calls\",\n getBuilderGatewayBaseUrl().endsWith(\"/\")\n ? getBuilderGatewayBaseUrl()\n : `${getBuilderGatewayBaseUrl()}/`,\n );\n gatewayUrl.searchParams.set(\n \"apiKey\",\n builderCredentials.publicKey!.trim(),\n );\n upstream = await fetch(gatewayUrl.toString(), {\n method: \"POST\",\n headers: {\n \"Content-Type\": \"application/json\",\n Authorization: `Bearer ${builderCredentials.privateKey!.trim()}`,\n \"x-builder-api-key\": builderCredentials.publicKey!.trim(),\n ...getBuilderGatewayRequestHeaders(),\n ...(builderCredentials.userId\n ? { \"x-builder-user-id\": builderCredentials.userId }\n : {}),\n },\n body: JSON.stringify({ sdp, session }),\n });\n } else {\n const form = new FormData();\n form.set(\"sdp\", sdp);\n form.set(\"session\", JSON.stringify(session));\n upstream = await fetch(OPENAI_REALTIME_CALLS_URL, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${apiKey}`,\n \"OpenAI-Safety-Identifier\": await realtimeVoiceSafetyIdentifier(\n auth.userEmail,\n ),\n },\n body: form,\n });\n }\n } catch {\n setResponseStatus(event, 502);\n return {\n error: builderConfigured\n ? \"Could not reach the Builder realtime voice gateway\"\n : \"Could not reach the OpenAI Realtime API\",\n };\n }\n\n if (!upstream.ok) {\n const detail = await safeOpenAiErrorDetail(\n upstream,\n builderConfigured ? builderCredentials.privateKey! : apiKey!,\n );\n setResponseStatus(event, builderConfigured ? upstream.status : 502);\n return {\n error: `${builderConfigured ? \"Builder\" : \"OpenAI\"} rejected the realtime session (${upstream.status})${detail ? `: ${detail}` : \"\"}`,\n };\n }\n\n const answerSdp = await upstream.text().catch(() => \"\");\n if (!answerSdp.trim()) {\n setResponseStatus(event, 502);\n return {\n error: `${builderConfigured ? \"Builder\" : \"OpenAI\"} returned an empty realtime session answer`,\n };\n }\n\n setResponseStatus(event, upstream.status);\n setResponseHeader(event, \"Content-Type\", \"application/sdp\");\n return answerSdp;\n },\n );\n });\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction parseToolRequest(value: unknown): {\n name: string;\n args: Record<string, unknown>;\n callId: string;\n sessionId?: string;\n browserTabId?: string;\n} \| null {\n if (!isRecord(value)) return null;\n const { name, args, callId, sessionId, browserTabId } = value;\n if (typeof name !== \"string\" \|\| !REALTIME_TOOL_NAME.test(name)) return null;\n if (typeof callId !== \"string\" \|\| !CALL_ID.test(callId)) return null;\n if (!isRecord(args)) return null;\n if (\n sessionId !== undefined &&\n (typeof sessionId !== \"string\" \|\| !SESSION_ID.test(sessionId))\n ) {\n return null;\n }\n if (\n browserTabId !== undefined &&\n (typeof browserTabId !== \"string\" \|\| !BROWSER_TAB_ID.test(browserTabId))\n ) {\n return null;\n }\n return {\n name,\n args,\n callId,\n ...(sessionId ? { sessionId } : {}),\n ...(browserTabId ? { browserTabId } : {}),\n };\n}\n\nfunction normalizeExecutionResult(\n result: RealtimeVoiceToolExecutionResult,\n): RealtimeVoiceToolExecutionResult {\n const status = result?.status;\n if (\n status !== \"completed\" &&\n status !== \"failed\" &&\n status !== \"approval_required\"\n ) {\n throw new Error(\"Invalid realtime tool execution status\");\n }\n const output = sanitizeOutput(\n result.output,\n REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n );\n return {\n status,\n output,\n ...(status === \"approval_required\" &&\n typeof result.approvalKey === \"string\" &&\n result.approvalKey.length > 0 &&\n result.approvalKey.length <= MAX_APPROVAL_KEY_CHARS\n ? { approvalKey: result.approvalKey }\n : {}),\n };\n}\n\nfunction createToolHandler(\n allowedToolNames: ReadonlySet<string>,\n options: MountRealtimeVoiceRoutesOptions,\n) {\n return defineEventHandler(async (event: H3Event) => {\n if (getMethod(event) !== \"POST\") return invalidMethod(event);\n if (!isSameOriginRequest(event)) {\n setResponseStatus(event, 403);\n return { error: \"Cross-origin request rejected\" };\n }\n setResponseHeader(event, \"Cache-Control\", \"no-store\");\n\n const auth = await authenticateVoiceRequest(event, options);\n if (!auth) {\n setResponseStatus(event, 401);\n return { error: \"Authentication required\" };\n }\n\n const contentType = readSafeHeader(event, \"content-type\")?.toLowerCase();\n if (!contentType?.includes(\"application/json\")) {\n setResponseStatus(event, 415);\n return { error: \"Expected Content-Type: application/json\" };\n }\n\n const raw = await readLimitedRawBody(\n event,\n REALTIME_VOICE_MAX_TOOL_BODY_BYTES,\n );\n if (raw === \"oversize\") {\n setResponseStatus(event, 413);\n return {\n error: `Tool request is too large (max ${REALTIME_VOICE_MAX_TOOL_BODY_BYTES} bytes)`,\n };\n }\n\n let parsedBody: unknown;\n try {\n parsedBody = JSON.parse(raw ?? \"\");\n } catch {\n setResponseStatus(event, 400);\n return { error: \"Invalid realtime tool request\" };\n }\n const request = parseToolRequest(parsedBody);\n if (!request) {\n setResponseStatus(event, 400);\n return { error: \"Invalid realtime tool request\" };\n }\n if (!allowedToolNames.has(request.name)) {\n setResponseStatus(event, 404);\n return { error: \"Unknown realtime voice tool\" };\n }\n\n const browserTabId = request.browserTabId ?? auth.browserTabId;\n const threadId = request.sessionId\n ? `realtime:${request.sessionId}`\n : `realtime:${request.callId}`;\n return runWithRequestContext(\n {\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n timezone: auth.timezone,\n run: {\n threadId,\n ...(browserTabId ? { browserTabId } : {}),\n },\n },\n async () => {\n try {\n const result = normalizeExecutionResult(\n await options.executeTool({\n event,\n userEmail: auth.userEmail,\n orgId: auth.orgId,\n ...request,\n }),\n );\n return { callId: request.callId, ...result };\n } catch (error) {\n setResponseStatus(event, 500);\n return {\n callId: request.callId,\n status: \"failed\" as const,\n output: truncate(\n sanitizeToolErrorValue(error) \|\| \"Tool execution failed\",\n REALTIME_VOICE_MAX_TOOL_OUTPUT_CHARS,\n ),\n };\n }\n },\n );\n });\n}\n\n/* Mount the authenticated OpenAI Realtime WebRTC and tool bridge routes. */\nexport function mountRealtimeVoiceRoutes(\n nitroApp: any,\n actions: Record<string, ActionEntry>,\n options: MountRealtimeVoiceRoutesOptions,\n): { sessionPath: string; toolPath: string } {\n if (typeof options?.executeTool !== \"function\") {\n throw new Error(\"mountRealtimeVoiceRoutes requires executeTool\");\n }\n\n const tools = buildRealtimeTools(actions);\n const allowedToolNames = new Set(\n tools.slice(0, REALTIME_VOICE_MAX_TOOLS).map((tool) => tool.name),\n );\n const app = getH3App(nitroApp);\n app.use(REALTIME_VOICE_SESSION_PATH, createSessionHandler(tools, options));\n app.use(\n REALTIME_VOICE_TOOL_PATH,\n createToolHandler(allowedToolNames, options),\n );\n return {\n sessionPath: REALTIME_VOICE_SESSION_PATH,\n toolPath: REALTIME_VOICE_TOOL_PATH,\n };\n}\n"]}

package/dist/server/request-origin.d.ts ADDED Viewed

@@ -0,0 +1,10 @@
+import { type H3Event } from "h3";
+/**
+ * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so
+ * the browser would otherwise attach the session to a forged form submission
+ * from evil.com, causing us to spend provider credits on the user's behalf.
+ * Same-origin browsers always send `Origin` on POST; if it's missing we fall
+ * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.
+ */
+export declare function isSameOriginRequest(event: H3Event): boolean;
+//# sourceMappingURL=request-origin.d.ts.map

package/dist/server/request-origin.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"request-origin.d.ts","sourceRoot":"","sources":["../../src/server/request-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,OAAO,EAAE,MAAM,IAAI,CAAC;AAMpD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAqD3D"}

package/dist/server/request-origin.js ADDED Viewed

@@ -0,0 +1,63 @@
+import { getRequestHeader } from "h3";
+function isLoopbackHost(host) {
+    return host.startsWith("localhost:") || host.startsWith("127.0.0.1:");
+}
+/**
+ * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so
+ * the browser would otherwise attach the session to a forged form submission
+ * from evil.com, causing us to spend provider credits on the user's behalf.
+ * Same-origin browsers always send `Origin` on POST; if it's missing we fall
+ * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.
+ */
+export function isSameOriginRequest(event) {
+    // Fetch metadata is browser-controlled and describes the relationship
+    // before a reverse proxy rewrites Host (dev-lazy maps :8080 to :8088).
+    // Reject an explicit cross-site signal before consulting forgeable headers.
+    const fetchSite = getRequestHeader(event, "sec-fetch-site");
+    if (fetchSite)
+        return fetchSite === "same-origin" || fetchSite === "none";
+    const host = getRequestHeader(event, "host");
+    const origin = getRequestHeader(event, "origin");
+    if (origin && host) {
+        try {
+            const parsed = new URL(origin);
+            const forwardedProto = getRequestHeader(event, "x-forwarded-proto");
+            const forwardedProtocol = forwardedProto === "https" || forwardedProto === "http"
+                ? `${forwardedProto}:`
+                : null;
+            const matchesScheme = forwardedProtocol
+                ? parsed.protocol === forwardedProtocol
+                : parsed.protocol === "https:" ||
+                    (parsed.protocol === "http:" && isLoopbackHost(host));
+            if (parsed.host === host && matchesScheme)
+                return true;
+            // Tauri desktop dev serves the tray WebView from localhost:1420 while
+            // the app server lives on the template dev port. Production Tauri
+            // WebViews can also send a tauri://localhost origin. Trust that custom
+            // scheme, while limiting the web-scheme desktop origins below to a
+            // loopback app server so arbitrary websites still fail the CSRF check.
+            if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
+                return true;
+            }
+            if ((parsed.protocol === "http:" || parsed.protocol === "https:") &&
+                parsed.hostname === "tauri.localhost" &&
+                isLoopbackHost(host)) {
+                return true;
+            }
+            if (parsed.protocol === "http:" &&
+                (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
+                parsed.port === "1420" &&
+                isLoopbackHost(host)) {
+                return true;
+            }
+            return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    // No Origin and no Sec-Fetch-Site: likely a non-browser client (curl,
+    // server-side) — safe to allow, CSRF requires a browser with ambient cookies.
+    return true;
+}
+//# sourceMappingURL=request-origin.js.map

package/dist/server/request-origin.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"request-origin.js","sourceRoot":"","sources":["../../src/server/request-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAgB,MAAM,IAAI,CAAC;AAEpD,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC5D,IAAI,SAAS;QAAE,OAAO,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,MAAM,CAAC;IAE1E,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACpE,MAAM,iBAAiB,GACrB,cAAc,KAAK,OAAO,IAAI,cAAc,KAAK,MAAM;gBACrD,CAAC,CAAC,GAAG,cAAc,GAAG;gBACtB,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,aAAa,GAAG,iBAAiB;gBACrC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,iBAAiB;gBACvC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;oBAC5B,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,aAAa;gBAAE,OAAO,IAAI,CAAC;YACvD,sEAAsE;YACtE,kEAAkE;YAClE,uEAAuE;YACvE,mEAAmE;YACnE,uEAAuE;YACvE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;gBAC7D,MAAM,CAAC,QAAQ,KAAK,iBAAiB;gBACrC,cAAc,CAAC,IAAI,CAAC,EACpB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IACE,MAAM,CAAC,QAAQ,KAAK,OAAO;gBAC3B,CAAC,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC;gBACpE,MAAM,CAAC,IAAI,KAAK,MAAM;gBACtB,cAAc,CAAC,IAAI,CAAC,EACpB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,8EAA8E;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { getRequestHeader, type H3Event } from \"h3\";\n\nfunction isLoopbackHost(host: string): boolean {\n return host.startsWith(\"localhost:\") || host.startsWith(\"127.0.0.1:\");\n}\n\n/**\n * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so\n * the browser would otherwise attach the session to a forged form submission\n * from evil.com, causing us to spend provider credits on the user's behalf.\n * Same-origin browsers always send `Origin` on POST; if it's missing we fall\n * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.\n */\nexport function isSameOriginRequest(event: H3Event): boolean {\n // Fetch metadata is browser-controlled and describes the relationship\n // before a reverse proxy rewrites Host (dev-lazy maps :8080 to :8088).\n // Reject an explicit cross-site signal before consulting forgeable headers.\n const fetchSite = getRequestHeader(event, \"sec-fetch-site\");\n if (fetchSite) return fetchSite === \"same-origin\" || fetchSite === \"none\";\n\n const host = getRequestHeader(event, \"host\");\n const origin = getRequestHeader(event, \"origin\");\n if (origin && host) {\n try {\n const parsed = new URL(origin);\n const forwardedProto = getRequestHeader(event, \"x-forwarded-proto\");\n const forwardedProtocol =\n forwardedProto === \"https\" || forwardedProto === \"http\"\n ? `${forwardedProto}:`\n : null;\n const matchesScheme = forwardedProtocol\n ? parsed.protocol === forwardedProtocol\n : parsed.protocol === \"https:\" ||\n (parsed.protocol === \"http:\" && isLoopbackHost(host));\n if (parsed.host === host && matchesScheme) return true;\n // Tauri desktop dev serves the tray WebView from localhost:1420 while\n // the app server lives on the template dev port. Production Tauri\n // WebViews can also send a tauri://localhost origin. Trust that custom\n // scheme, while limiting the web-scheme desktop origins below to a\n // loopback app server so arbitrary websites still fail the CSRF check.\n if (parsed.protocol === \"tauri:\" && parsed.hostname === \"localhost\") {\n return true;\n }\n if (\n (parsed.protocol === \"http:\" || parsed.protocol === \"https:\") &&\n parsed.hostname === \"tauri.localhost\" &&\n isLoopbackHost(host)\n ) {\n return true;\n }\n if (\n parsed.protocol === \"http:\" &&\n (parsed.hostname === \"localhost\" || parsed.hostname === \"127.0.0.1\") &&\n parsed.port === \"1420\" &&\n isLoopbackHost(host)\n ) {\n return true;\n }\n return false;\n } catch {\n return false;\n }\n }\n // No Origin and no Sec-Fetch-Site: likely a non-browser client (curl,\n // server-side) — safe to allow, CSRF requires a browser with ambient cookies.\n return true;\n}\n"]}

package/dist/server/ssr-handler.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAwCA,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;~~AAoSpC~~;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,~~2FAsE5E~~"}
1	+ {"version":3,"file":"ssr-handler.d.ts","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAwCA,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAuVpC;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,2FAwE5E"}

package/dist/server/ssr-handler.js CHANGED Viewed

@@ -73,6 +73,21 @@ function requestWithPathname(request, pathname, basePath) {
     }
     return new Request(url, init);
 }
+function requestForAnonymousSsr(request) {
+    const headers = new Headers(request.headers);
+    headers.delete("cookie");
+    headers.delete("authorization");
+    const init = {
+        method: request.method,
+        headers,
+        signal: request.signal,
+    };
+    if (request.body && !["GET", "HEAD"].includes(request.method.toUpperCase())) {
+        init.body = request.body;
+        init.duplex = "half";
+    }
+    return new Request(request.url, init);
+}
 function prefixMountedPath(path, basePath) {
     if (!basePath || !path.startsWith("/") || path.startsWith("//"))
         return path;
@@ -83,12 +98,22 @@ function prefixMountedPath(path, basePath) {
 function prefixMountedHtml(html, basePath) {
     if (!basePath)
         return html;
-    return html
+    const prefixedHtml = html
         .replace(/\b(href|src|action|formaction|poster)=(["'])(\/(?!\/)[^"']*)\2/g, (_match, attr, quote, path) => `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`)
         .replace(/url\((["']?)(\/(?!\/)[^)'" ]+)\1\)/g, (_match, quote, path) => {
         const q = quote || "";
         return `url(${q}${prefixMountedPath(path, basePath)}${q})`;
     });
+    // React Router serializes the server-side basename into its hydration
+    // context. The request above is deliberately rendered mount-relative, so
+    // that value is normally "/" even though the browser URL is mounted at a
+    // workspace prefix such as "/analytics". If the client hydrates that
+    // context unchanged, the mounted pathname no longer matches the route tree:
+    // index redirects can stall and child pages can fall through to the 404.
+    // Keep the serialized router state consistent with the URLs we just
+    // prefixed. Template entry clients also set this defensively for older
+    // responses, but the initial hydration state must be correct at the source.
+    return prefixedHtml.replace(/(window\.__reactRouterContext\s*=\s*\{\s*"basename"\s*:\s*)"(?:\\.|[^"\\])*"/, `$1${JSON.stringify(basePath)}`);
 }
 function injectHeadScript(html, script) {
     if (!script)
@@ -163,6 +188,26 @@ function isSsrHtmlOrDataResponse(headers, status, pathname) {
 function applyDefaultSsrCacheHeader(headers, status, pathname) {
     if (!isSsrHtmlOrDataResponse(headers, status, pathname))
         return;
+    // A public shell must never set a viewer cookie or vary by credentials.
+    // Preserve harmless content-negotiation dimensions such as Accept-Encoding.
+    headers.delete("set-cookie");
+    const vary = headers.get("vary");
+    if (vary) {
+        const publicVary = vary
+            .split(",")
+            .map((value) => value.trim())
+            .filter((value) => {
+            const normalized = value.toLowerCase();
+            return (normalized &&
+                normalized !== "*" &&
+                normalized !== "cookie" &&
+                normalized !== "authorization");
+        });
+        if (publicVary.length > 0)
+            headers.set("vary", publicVary.join(", "));
+        else
+            headers.delete("vary");
+    }
     // Netlify Functions/proxies are not cached by default. Set all three cache
     // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,
     // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache
@@ -264,7 +309,7 @@ export function createH3SSRHandler(getBuild) {
             return new Response(null, { status: 404 });
         }
         try {
-            const request = requestWithPathname(event.req, p, basePath);
+            const request = requestForAnonymousSsr(requestWithPathname(event.req, p, basePath));
             // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the
             // request's session/cookies here, and pin an explicitly anonymous request
             // context. That keeps the SSR HTML/.data identical for every visitor so it

package/dist/server/ssr-handler.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACxC;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,SAAS,cAAc;IACrB,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,yBAAyB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,IAAI;SACR,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,qCAAqC,CAC1C,IAAI,GAAG,CACL,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,EAC3D,UAAU,CACX,CAAC,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,sCAAsC,QAAQ,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,iDAAiD,QAAQ,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CACP,2CAA2C,8BAA8B,IAAI,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,CACP,4CAA4C,+BAA+B,IAAI,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,6CAA6C,gCAAgC,IAAI,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,0CAA0C,6BAA6B,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,uCAAuC,QAAQ,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CACP,2CAA2C,6BAA6B,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,0BAA0B,CACjC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO;IAEhE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/C,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,UAAkB;IAElB,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,kCAAkC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAC1B,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACjC,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC5C,EACD,wBAAwB,CACzB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;YACvE,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,+EAA+E;YAC/E,EAAE;YACF,gFAAgF;YAChF,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,YAAY,CAAC,GAAG,EAAE;gBAChB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;gBACxB,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC3D,IAAI,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE;aACzD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { defineEventHandler } from \"h3\";\n/*\n Shared SSR catch-all handler for React Router framework mode.\n \n Templates wire this up via:\n \n // server/routes/[...page].get.ts\n * import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n * export default createH3SSRHandler(\n * () => import(\"virtual:react-router/server-build\"),\n * );\n \n The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n /\nimport { createRequestHandler } from \"react-router\";\n\nimport {\n DEFAULT_SSR_CACHE_HEADERS,\n DEFAULT_SPECULATION_RULES_PATH,\n} from \"../shared/cache-control.js\";\nimport {\n AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n withAgentNativeSocialImageCacheBuster,\n} from \"../shared/social-meta.js\";\nimport {\n getAppBasePathFromViteEnv,\n stripAppBasePath as canonicalStripAppBasePath,\n} from \"./app-base-path.js\";\nimport { captureError } from \"./capture-error.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { getSentryClientConfigScript } from \"./sentry-config.js\";\n\nexport {\n DEFAULT_SSR_CACHE_HEADERS,\n DEFAULT_SPECULATION_RULES_HEADER,\n DEFAULT_SSR_CACHE_CONTROL,\n} from \"../shared/cache-control.js\";\n\nfunction getAppBasePath(): string {\n return getAppBasePathFromViteEnv();\n}\n\nfunction stripAppBasePath(pathname: string): string {\n return canonicalStripAppBasePath(pathname, getAppBasePath());\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n if (!basePath) return pathname;\n if (pathname === basePath) return \"/\";\n if (pathname.startsWith(`${basePath}/`)) {\n return pathname.slice(basePath.length) \|\| \"/\";\n }\n return pathname;\n}\n\nfunction requestWithPathname(\n request: Request,\n pathname: string,\n basePath: string,\n): Request {\n const url = new URL(request.url);\n let changed = false;\n if (basePath && pathname === \"/__manifest\") {\n const paths = url.searchParams.get(\"paths\");\n if (paths) {\n const strippedPaths = paths\n .split(\",\")\n .map((path) => stripBasePath(path, basePath))\n .join(\",\");\n if (strippedPaths !== paths) {\n url.searchParams.set(\"paths\", strippedPaths);\n changed = true;\n }\n }\n }\n if (url.pathname !== pathname) {\n url.pathname = pathname;\n changed = true;\n }\n if (!changed) return request;\n const init: RequestInit & { duplex?: \"half\" } = {\n method: request.method,\n headers: request.headers,\n signal: request.signal,\n };\n if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n init.body = request.body;\n init.duplex = \"half\";\n }\n return new Request(url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n if (!basePath \|\| !path.startsWith(\"/\") \|\| path.startsWith(\"//\")) return path;\n if (path === basePath \|\| path.startsWith(`${basePath}/`)) return path;\n return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n if (!basePath) return html;\n return html\n .replace(\n /\\b(href\|src\|action\|formaction\|poster)=([\"'])(\\/(?!\\/)[^\"'])\\2/g,\n (_match, attr: string, quote: string, path: string) =>\n `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n )\n .replace(/url\$([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\$/g, (_match, quote, path) => {\n const q = quote \|\| \"\";\n return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n });\n}\n\nfunction injectHeadScript(html: string, script: string \| null): string {\n if (!script) return html;\n const headCloseIdx = html.indexOf(\"</head>\");\n if (headCloseIdx === -1) return html;\n return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]\\bproperty=([\"'])og:image\\1)[^>]>/i;\nconst TWITTER_CARD_META_RE =\n /<meta\\b(?=[^>]\\bname=([\"'])twitter:card\\1)[^>]>/i;\nconst TWITTER_IMAGE_META_RE =\n /<meta\\b(?=[^>]\\bname=([\"'])twitter:image\\1)[^>]>/i;\n\nfunction defaultSocialImageUrl(requestUrl: string, basePath: string): string {\n return withAgentNativeSocialImageCacheBuster(\n new URL(\n prefixMountedPath(AGENT_NATIVE_SOCIAL_IMAGE_PATH, basePath),\n requestUrl,\n ).toString(),\n );\n}\n\nfunction injectDefaultSocialImageMeta(html: string, imageUrl: string): string {\n const headCloseIdx = html.indexOf(\"</head>\");\n if (headCloseIdx === -1) return html;\n\n const hasAnySocialImage =\n OG_IMAGE_META_RE.test(html) \|\| TWITTER_IMAGE_META_RE.test(html);\n const tags: string[] = [];\n\n if (!hasAnySocialImage) {\n tags.push(`<meta property=\"og:image\" content=\"${imageUrl}\">`);\n tags.push(`<meta property=\"og:image:secure_url\" content=\"${imageUrl}\">`);\n tags.push(\n `<meta property=\"og:image:type\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_TYPE}\">`,\n );\n tags.push(\n `<meta property=\"og:image:width\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_WIDTH}\">`,\n );\n tags.push(\n `<meta property=\"og:image:height\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT}\">`,\n );\n tags.push(\n `<meta property=\"og:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n );\n }\n if (!TWITTER_CARD_META_RE.test(html)) {\n tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n }\n if (!hasAnySocialImage) {\n tags.push(`<meta name=\"twitter:image\" content=\"${imageUrl}\">`);\n tags.push(\n `<meta name=\"twitter:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n );\n }\n\n if (tags.length === 0) return html;\n return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction isSsrHtmlOrDataResponse(\n headers: Headers,\n status: number,\n pathname: string,\n): boolean {\n if (status < 200 \|\| status >= 400) return false;\n const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n if (contentType.includes(\"text/html\")) return true;\n return pathname.endsWith(\".data\") && contentType.includes(\"text/x-script\");\n}\n\n/*\n Apply the SSR cache policy to the response headers.\n \n ┌──────────────────────────────────────────────────────────────────────────┐\n * │ SSR IS A PUBLIC, HARD-CDN-CACHED SHELL — SERVED IDENTICALLY TO EVERYONE. │\n * │ │\n * │ Every SSR HTML / React Router `.data` response gets the same public │\n * │ stale-while-revalidate policy for ALL visitors, authenticated or not, so │\n * │ the edge serves one shared copy and never stampedes origin. │\n * │ │\n * │ DO NOT reintroduce per-user / cookie-based cache variation here (no │\n * │ `private`, no `no-store`, no `Vary: Cookie`, no \"authenticated → don't │\n * │ cache\" branch). That makes pages uncacheable for every logged-in visitor, │\n * │ which is slow and expensive — exactly the regression this guardrail │\n * │ prevents. The reason it is SAFE to hard-cache is that the SSR response is │\n * │ impersonal: `createH3SSRHandler` renders without reading the request's │\n * │ session/cookies, so there is no per-user data baked into the HTML. ALL │\n * │ per-user state (who's logged in, private records, access checks) is │\n * │ resolved CLIENT-SIDE after load. Keep it that way: if you need the SSR │\n * │ output to differ per user, the fix is to move that work client-side, not │\n * │ to disable caching here. │\n * └──────────────────────────────────────────────────────────────────────────┘\n /\nfunction applyDefaultSsrCacheHeader(\n headers: Headers,\n status: number,\n pathname: string,\n) {\n if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;\n\n // Netlify Functions/proxies are not cached by default. Set all three cache\n // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,\n // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache\n // actually serves SSR HTML/.data from the edge instead of forwarding every\n // request to origin — for every visitor, authenticated or not.\n for (const [name, value] of Object.entries(DEFAULT_SSR_CACHE_HEADERS)) {\n headers.set(name, value);\n }\n}\n\nfunction applyDefaultSpeculationRulesHeader(\n headers: Headers,\n status: number,\n basePath: string,\n) {\n if (status < 200 \|\| status >= 400) return;\n if (headers.has(\"speculation-rules\")) return;\n\n const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n if (!contentType.includes(\"text/html\")) return;\n\n // Cloudflare Speed Brain injects its own Speculation-Rules header when the\n // origin omits one. Those browser prefetches carry `Sec-Purpose: prefetch`,\n // and Cloudflare refuses cache-ineligible dynamic pages with a 503 before\n // the request can reach Netlify/origin. We publish an explicit no-op ruleset\n // by default so Cloudflare does not inject its edge prefetch rules. Preserve\n // an app-provided Speculation-Rules header above if a template deliberately\n // owns this behavior.\n const rulesPath = prefixMountedPath(DEFAULT_SPECULATION_RULES_PATH, basePath);\n headers.set(\"speculation-rules\", `\"${rulesPath}\"`);\n}\n\n/\n Strip document-level CSP from app HTML responses.\n \n Hosted templates inject framework bootstrap scripts, analytics, Sentry config,\n * and app-owned inline scripts whose exact bytes vary by build/template. Any\n * shared CSP header, even Report-Only, can block or noisily report Google Tag\n * Manager and those bootstraps. Extension iframes and webviews keep their own\n * route-specific sandboxes; normal app documents deliberately do not emit CSP.\n /\nfunction removeDocumentCsp(headers: Headers): void {\n headers.delete(\"content-security-policy\");\n headers.delete(\"content-security-policy-report-only\");\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n return (\n pathname.startsWith(\"/.well-known/\") \|\|\n pathname.startsWith(\"/_agent_native/\") \|\|\n pathname.startsWith(\"/_agent-native/\") \|\|\n pathname.startsWith(\"/api/\") \|\|\n pathname.startsWith(\"/@vite/\") \|\|\n pathname.startsWith(\"/@id/\") \|\|\n pathname.startsWith(\"/@fs/\") \|\|\n pathname === \"/@react-refresh\" \|\|\n pathname === \"/__vite_ping\" \|\|\n pathname === \"/__open-in-editor\" \|\|\n pathname === \"/favicon.ico\" \|\|\n pathname === \"/favicon.png\" \|\|\n (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n );\n}\n\nasync function rewriteMountedResponse(\n response: Response,\n basePath: string,\n pathname: string,\n requestUrl: string,\n): Promise<Response> {\n const sentryClientConfigScript = getSentryClientConfigScript();\n const headers = new Headers(response.headers);\n applyDefaultSsrCacheHeader(headers, response.status, pathname);\n applyDefaultSpeculationRulesHeader(headers, response.status, basePath);\n\n const location = headers.get(\"location\");\n if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n headers.set(\"location\", prefixMountedPath(location, basePath));\n }\n\n const contentType = headers.get(\"content-type\") ?? \"\";\n if (!contentType.toLowerCase().includes(\"text/html\")) {\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n });\n }\n removeDocumentCsp(headers);\n if (!response.body) {\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n });\n }\n\n const html = await response.text();\n headers.delete(\"content-length\");\n return new Response(\n injectHeadScript(\n injectDefaultSocialImageMeta(\n prefixMountedHtml(html, basePath),\n defaultSocialImageUrl(requestUrl, basePath),\n ),\n sentryClientConfigScript,\n ),\n {\n status: response.status,\n statusText: response.statusText,\n headers,\n },\n );\n}\n\n/\n Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> \| unknown) {\n const handler = createRequestHandler(getBuild as any);\n return defineEventHandler(async (event) => {\n const basePath = getAppBasePath();\n const p = stripAppBasePath(event.url.pathname);\n if (isFrameworkOrAssetPath(p)) {\n return new Response(null, { status: 404 });\n }\n try {\n const request = requestWithPathname(event.req as Request, p, basePath);\n // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the\n // request's session/cookies here, and pin an explicitly anonymous request\n // context. That keeps the SSR HTML/.data identical for every visitor so it\n // can be hard-cached at the CDN for everyone (see applyDefaultSsrCacheHeader).\n //\n // Consequence: SSR loaders that call `getRequestUserEmail()` / `accessFilter()`\n // always see the unauthenticated branch and render public content only. Any\n // per-user view (private records, share-grant access, who's logged in) MUST\n // be resolved CLIENT-SIDE after load, never baked into SSR. Do not re-pin the\n // session here to \"fix\" a per-user page — that silently makes the page\n // uncacheable and/or leaks one user's data into another's cached copy.\n const ctx = { userEmail: undefined, orgId: undefined };\n if (request.method === \"HEAD\") {\n const getRequest = new Request(request.url, {\n method: \"GET\",\n headers: request.headers,\n signal: request.signal,\n });\n const response = await runWithRequestContext(ctx, () =>\n handler(getRequest),\n );\n return await rewriteMountedResponse(\n new Response(null, {\n status: response.status,\n statusText: response.statusText,\n headers: response.headers,\n }),\n basePath,\n p,\n request.url,\n );\n }\n return await rewriteMountedResponse(\n await runWithRequestContext(ctx, () => handler(request)),\n basePath,\n p,\n request.url,\n );\n } catch (err) {\n // Log the full stack server-side, but never leak it to the client.\n // Stack traces expose file paths, library versions, and code structure\n // that aid reconnaissance attacks. In dev we surface the message text\n // so devtools shows something useful; in prod we return a bare 500.\n console.error(\"[ssr-handler] SSR error:\", err);\n captureError(err, {\n route: p,\n method: event.req.method,\n userAgent: event.req.headers.get(\"user-agent\") ?? undefined,\n tags: { renderMode: \"anonymous-public\", surface: \"ssr\" },\n });\n const isProd = process.env.NODE_ENV === \"production\";\n const body = isProd\n ? \"Internal Server Error\"\n : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n return new Response(body, {\n status: 500,\n headers: { \"content-type\": \"text/plain\" },\n });\n }\n });\n}\n"]}
1	+ {"version":3,"file":"ssr-handler.js","sourceRoot":"","sources":["../../src/server/ssr-handler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,IAAI,CAAC;AACxC;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,6BAA6B,EAC7B,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,EAC9B,+BAA+B,EAC/B,qCAAqC,GACtC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,gBAAgB,IAAI,yBAAyB,GAC9C,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EACL,yBAAyB,EACzB,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,SAAS,cAAc;IACrB,OAAO,yBAAyB,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,yBAAyB,CAAC,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/B,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACtC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,aAAa,GAAG,KAAK;iBACxB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC5C,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;gBAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBAC7C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACxB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAgB;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAChC,MAAM,IAAI,GAAsC;QAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IACvD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,YAAY,GAAG,IAAI;SACtB,OAAO,CACN,iEAAiE,EACjE,CAAC,MAAM,EAAE,IAAY,EAAE,KAAa,EAAE,IAAY,EAAE,EAAE,CACpD,GAAG,IAAI,IAAI,KAAK,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,KAAK,EAAE,CACjE;SACA,OAAO,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtE,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEL,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,4EAA4E;IAC5E,yEAAyE;IACzE,oEAAoE;IACpE,uEAAuE;IACvE,4EAA4E;IAC5E,OAAO,YAAY,CAAC,OAAO,CACzB,8EAA8E,EAC9E,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAqB;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,MAAM,oBAAoB,GACxB,oDAAoD,CAAC;AACvD,MAAM,qBAAqB,GACzB,qDAAqD,CAAC;AAExD,SAAS,qBAAqB,CAAC,UAAkB,EAAE,QAAgB;IACjE,OAAO,qCAAqC,CAC1C,IAAI,GAAG,CACL,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,EAC3D,UAAU,CACX,CAAC,QAAQ,EAAE,CACb,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,QAAgB;IAClE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7C,IAAI,YAAY,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,iBAAiB,GACrB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAa,EAAE,CAAC;IAE1B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,sCAAsC,QAAQ,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,CAAC,iDAAiD,QAAQ,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,CACP,2CAA2C,8BAA8B,IAAI,CAC9E,CAAC;QACF,IAAI,CAAC,IAAI,CACP,4CAA4C,+BAA+B,IAAI,CAChF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,6CAA6C,gCAAgC,IAAI,CAClF,CAAC;QACF,IAAI,CAAC,IAAI,CACP,0CAA0C,6BAA6B,IAAI,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,uCAAuC,QAAQ,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CACP,2CAA2C,6BAA6B,IAAI,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,0BAA0B,CACjC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC;QAAE,OAAO;IAEhE,wEAAwE;IACxE,4EAA4E;IAC5E,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,UAAU,GAAG,IAAI;aACpB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAChB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YACvC,OAAO,CACL,UAAU;gBACV,UAAU,KAAK,GAAG;gBAClB,UAAU,KAAK,QAAQ;gBACvB,UAAU,KAAK,eAAe,CAC/B,CAAC;QACJ,CAAC,CAAC,CAAC;QACL,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;;YACjE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,kCAAkC,CACzC,OAAgB,EAChB,MAAc,EACd,QAAgB;IAEhB,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO;IAC1C,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAAE,OAAO;IAE7C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACrE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO;IAE/C,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,sBAAsB;IACtB,MAAM,SAAS,GAAG,iBAAiB,CAAC,8BAA8B,EAAE,QAAQ,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1C,OAAO,CAAC,MAAM,CAAC,qCAAqC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;QACpC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC;QACtC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;QAC5B,QAAQ,KAAK,iBAAiB;QAC9B,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,cAAc;QAC3B,QAAQ,KAAK,cAAc;QAC3B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,QAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,UAAkB;IAElB,MAAM,wBAAwB,GAAG,2BAA2B,EAAE,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/D,kCAAkC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEvE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjC,OAAO,IAAI,QAAQ,CACjB,gBAAgB,CACd,4BAA4B,CAC1B,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,EACjC,qBAAqB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAC5C,EACD,wBAAwB,CACzB,EACD;QACE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA0C;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAe,CAAC,CAAC;IACtD,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,sBAAsB,CACpC,mBAAmB,CAAC,KAAK,CAAC,GAAc,EAAE,CAAC,EAAE,QAAQ,CAAC,CACvD,CAAC;YACF,2EAA2E;YAC3E,0EAA0E;YAC1E,2EAA2E;YAC3E,+EAA+E;YAC/E,EAAE;YACF,gFAAgF;YAChF,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YACvD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;oBAC1C,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CACrD,OAAO,CAAC,UAAU,CAAC,CACpB,CAAC;gBACF,OAAO,MAAM,sBAAsB,CACjC,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,EACF,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,sBAAsB,CACjC,MAAM,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EACxD,QAAQ,EACR,CAAC,EACD,OAAO,CAAC,GAAG,CACZ,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YAC/C,YAAY,CAAC,GAAG,EAAE;gBAChB,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM;gBACxB,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,SAAS;gBAC3D,IAAI,EAAE,EAAE,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE;aACzD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM;gBACjB,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,0BAA2B,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;YAC/D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { defineEventHandler } from \"h3\";\n/*\n Shared SSR catch-all handler for React Router framework mode.\n \n Templates wire this up via:\n \n // server/routes/[...page].get.ts\n * import { createH3SSRHandler } from \"@agent-native/core/server/ssr-handler\";\n * export default createH3SSRHandler(\n * () => import(\"virtual:react-router/server-build\"),\n * );\n \n The `getBuild` callback MUST live in the template's own source so Vite's\n * @react-router/dev plugin can resolve the `virtual:` module. Pulling the\n * import into core (e.g. via a re-export) puts it in node_modules where\n * Vite's SSR externalizer leaves it untouched and Node's ESM loader rejects\n * the unknown scheme — silently 302'ing every request to \"/\".\n /\nimport { createRequestHandler } from \"react-router\";\n\nimport {\n DEFAULT_SSR_CACHE_HEADERS,\n DEFAULT_SPECULATION_RULES_PATH,\n} from \"../shared/cache-control.js\";\nimport {\n AGENT_NATIVE_SOCIAL_IMAGE_ALT,\n AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT,\n AGENT_NATIVE_SOCIAL_IMAGE_PATH,\n AGENT_NATIVE_SOCIAL_IMAGE_TYPE,\n AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,\n withAgentNativeSocialImageCacheBuster,\n} from \"../shared/social-meta.js\";\nimport {\n getAppBasePathFromViteEnv,\n stripAppBasePath as canonicalStripAppBasePath,\n} from \"./app-base-path.js\";\nimport { captureError } from \"./capture-error.js\";\nimport { runWithRequestContext } from \"./request-context.js\";\nimport { getSentryClientConfigScript } from \"./sentry-config.js\";\n\nexport {\n DEFAULT_SSR_CACHE_HEADERS,\n DEFAULT_SPECULATION_RULES_HEADER,\n DEFAULT_SSR_CACHE_CONTROL,\n} from \"../shared/cache-control.js\";\n\nfunction getAppBasePath(): string {\n return getAppBasePathFromViteEnv();\n}\n\nfunction stripAppBasePath(pathname: string): string {\n return canonicalStripAppBasePath(pathname, getAppBasePath());\n}\n\nfunction stripBasePath(pathname: string, basePath: string): string {\n if (!basePath) return pathname;\n if (pathname === basePath) return \"/\";\n if (pathname.startsWith(`${basePath}/`)) {\n return pathname.slice(basePath.length) \|\| \"/\";\n }\n return pathname;\n}\n\nfunction requestWithPathname(\n request: Request,\n pathname: string,\n basePath: string,\n): Request {\n const url = new URL(request.url);\n let changed = false;\n if (basePath && pathname === \"/__manifest\") {\n const paths = url.searchParams.get(\"paths\");\n if (paths) {\n const strippedPaths = paths\n .split(\",\")\n .map((path) => stripBasePath(path, basePath))\n .join(\",\");\n if (strippedPaths !== paths) {\n url.searchParams.set(\"paths\", strippedPaths);\n changed = true;\n }\n }\n }\n if (url.pathname !== pathname) {\n url.pathname = pathname;\n changed = true;\n }\n if (!changed) return request;\n const init: RequestInit & { duplex?: \"half\" } = {\n method: request.method,\n headers: request.headers,\n signal: request.signal,\n };\n if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n init.body = request.body;\n init.duplex = \"half\";\n }\n return new Request(url, init);\n}\n\nfunction requestForAnonymousSsr(request: Request): Request {\n const headers = new Headers(request.headers);\n headers.delete(\"cookie\");\n headers.delete(\"authorization\");\n const init: RequestInit & { duplex?: \"half\" } = {\n method: request.method,\n headers,\n signal: request.signal,\n };\n if (request.body && ![\"GET\", \"HEAD\"].includes(request.method.toUpperCase())) {\n init.body = request.body;\n init.duplex = \"half\";\n }\n return new Request(request.url, init);\n}\n\nfunction prefixMountedPath(path: string, basePath: string): string {\n if (!basePath \|\| !path.startsWith(\"/\") \|\| path.startsWith(\"//\")) return path;\n if (path === basePath \|\| path.startsWith(`${basePath}/`)) return path;\n return `${basePath}${path}`;\n}\n\nfunction prefixMountedHtml(html: string, basePath: string): string {\n if (!basePath) return html;\n const prefixedHtml = html\n .replace(\n /\\b(href\|src\|action\|formaction\|poster)=([\"'])(\\/(?!\\/)[^\"'])\\2/g,\n (_match, attr: string, quote: string, path: string) =>\n `${attr}=${quote}${prefixMountedPath(path, basePath)}${quote}`,\n )\n .replace(/url\$([\"']?)(\\/(?!\\/)[^)'\" ]+)\\1\$/g, (_match, quote, path) => {\n const q = quote \|\| \"\";\n return `url(${q}${prefixMountedPath(path, basePath)}${q})`;\n });\n\n // React Router serializes the server-side basename into its hydration\n // context. The request above is deliberately rendered mount-relative, so\n // that value is normally \"/\" even though the browser URL is mounted at a\n // workspace prefix such as \"/analytics\". If the client hydrates that\n // context unchanged, the mounted pathname no longer matches the route tree:\n // index redirects can stall and child pages can fall through to the 404.\n // Keep the serialized router state consistent with the URLs we just\n // prefixed. Template entry clients also set this defensively for older\n // responses, but the initial hydration state must be correct at the source.\n return prefixedHtml.replace(\n /(window\\.__reactRouterContext\\s=\\s\\{\\s\"basename\"\\s:\\s)\"(?:\\\\.\|[^\"\\\\])\"/,\n `$1${JSON.stringify(basePath)}`,\n );\n}\n\nfunction injectHeadScript(html: string, script: string \| null): string {\n if (!script) return html;\n const headCloseIdx = html.indexOf(\"</head>\");\n if (headCloseIdx === -1) return html;\n return html.slice(0, headCloseIdx) + script + html.slice(headCloseIdx);\n}\n\nconst OG_IMAGE_META_RE = /<meta\\b(?=[^>]\\bproperty=([\"'])og:image\\1)[^>]>/i;\nconst TWITTER_CARD_META_RE =\n /<meta\\b(?=[^>]\\bname=([\"'])twitter:card\\1)[^>]>/i;\nconst TWITTER_IMAGE_META_RE =\n /<meta\\b(?=[^>]\\bname=([\"'])twitter:image\\1)[^>]>/i;\n\nfunction defaultSocialImageUrl(requestUrl: string, basePath: string): string {\n return withAgentNativeSocialImageCacheBuster(\n new URL(\n prefixMountedPath(AGENT_NATIVE_SOCIAL_IMAGE_PATH, basePath),\n requestUrl,\n ).toString(),\n );\n}\n\nfunction injectDefaultSocialImageMeta(html: string, imageUrl: string): string {\n const headCloseIdx = html.indexOf(\"</head>\");\n if (headCloseIdx === -1) return html;\n\n const hasAnySocialImage =\n OG_IMAGE_META_RE.test(html) \|\| TWITTER_IMAGE_META_RE.test(html);\n const tags: string[] = [];\n\n if (!hasAnySocialImage) {\n tags.push(`<meta property=\"og:image\" content=\"${imageUrl}\">`);\n tags.push(`<meta property=\"og:image:secure_url\" content=\"${imageUrl}\">`);\n tags.push(\n `<meta property=\"og:image:type\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_TYPE}\">`,\n );\n tags.push(\n `<meta property=\"og:image:width\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_WIDTH}\">`,\n );\n tags.push(\n `<meta property=\"og:image:height\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT}\">`,\n );\n tags.push(\n `<meta property=\"og:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n );\n }\n if (!TWITTER_CARD_META_RE.test(html)) {\n tags.push(`<meta name=\"twitter:card\" content=\"summary_large_image\">`);\n }\n if (!hasAnySocialImage) {\n tags.push(`<meta name=\"twitter:image\" content=\"${imageUrl}\">`);\n tags.push(\n `<meta name=\"twitter:image:alt\" content=\"${AGENT_NATIVE_SOCIAL_IMAGE_ALT}\">`,\n );\n }\n\n if (tags.length === 0) return html;\n return html.slice(0, headCloseIdx) + tags.join(\"\") + html.slice(headCloseIdx);\n}\n\nfunction isSsrHtmlOrDataResponse(\n headers: Headers,\n status: number,\n pathname: string,\n): boolean {\n if (status < 200 \|\| status >= 400) return false;\n const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n if (contentType.includes(\"text/html\")) return true;\n return pathname.endsWith(\".data\") && contentType.includes(\"text/x-script\");\n}\n\n/*\n Apply the SSR cache policy to the response headers.\n \n ┌──────────────────────────────────────────────────────────────────────────┐\n * │ SSR IS A PUBLIC, HARD-CDN-CACHED SHELL — SERVED IDENTICALLY TO EVERYONE. │\n * │ │\n * │ Every SSR HTML / React Router `.data` response gets the same public │\n * │ stale-while-revalidate policy for ALL visitors, authenticated or not, so │\n * │ the edge serves one shared copy and never stampedes origin. │\n * │ │\n * │ DO NOT reintroduce per-user / cookie-based cache variation here (no │\n * │ `private`, no `no-store`, no `Vary: Cookie`, no \"authenticated → don't │\n * │ cache\" branch). That makes pages uncacheable for every logged-in visitor, │\n * │ which is slow and expensive — exactly the regression this guardrail │\n * │ prevents. The reason it is SAFE to hard-cache is that the SSR response is │\n * │ impersonal: `createH3SSRHandler` renders without reading the request's │\n * │ session/cookies, so there is no per-user data baked into the HTML. ALL │\n * │ per-user state (who's logged in, private records, access checks) is │\n * │ resolved CLIENT-SIDE after load. Keep it that way: if you need the SSR │\n * │ output to differ per user, the fix is to move that work client-side, not │\n * │ to disable caching here. │\n * └──────────────────────────────────────────────────────────────────────────┘\n /\nfunction applyDefaultSsrCacheHeader(\n headers: Headers,\n status: number,\n pathname: string,\n) {\n if (!isSsrHtmlOrDataResponse(headers, status, pathname)) return;\n\n // A public shell must never set a viewer cookie or vary by credentials.\n // Preserve harmless content-negotiation dimensions such as Accept-Encoding.\n headers.delete(\"set-cookie\");\n const vary = headers.get(\"vary\");\n if (vary) {\n const publicVary = vary\n .split(\",\")\n .map((value) => value.trim())\n .filter((value) => {\n const normalized = value.toLowerCase();\n return (\n normalized &&\n normalized !== \"\" &&\n normalized !== \"cookie\" &&\n normalized !== \"authorization\"\n );\n });\n if (publicVary.length > 0) headers.set(\"vary\", publicVary.join(\", \"));\n else headers.delete(\"vary\");\n }\n\n // Netlify Functions/proxies are not cached by default. Set all three cache\n // headers: Cache-Control for browsers, CDN-Cache-Control for generic CDNs,\n // and Netlify-CDN-Cache-Control (with durable) so Netlify's shared cache\n // actually serves SSR HTML/.data from the edge instead of forwarding every\n // request to origin — for every visitor, authenticated or not.\n for (const [name, value] of Object.entries(DEFAULT_SSR_CACHE_HEADERS)) {\n headers.set(name, value);\n }\n}\n\nfunction applyDefaultSpeculationRulesHeader(\n headers: Headers,\n status: number,\n basePath: string,\n) {\n if (status < 200 \|\| status >= 400) return;\n if (headers.has(\"speculation-rules\")) return;\n\n const contentType = headers.get(\"content-type\")?.toLowerCase() ?? \"\";\n if (!contentType.includes(\"text/html\")) return;\n\n // Cloudflare Speed Brain injects its own Speculation-Rules header when the\n // origin omits one. Those browser prefetches carry `Sec-Purpose: prefetch`,\n // and Cloudflare refuses cache-ineligible dynamic pages with a 503 before\n // the request can reach Netlify/origin. We publish an explicit no-op ruleset\n // by default so Cloudflare does not inject its edge prefetch rules. Preserve\n // an app-provided Speculation-Rules header above if a template deliberately\n // owns this behavior.\n const rulesPath = prefixMountedPath(DEFAULT_SPECULATION_RULES_PATH, basePath);\n headers.set(\"speculation-rules\", `\"${rulesPath}\"`);\n}\n\n/*\n Strip document-level CSP from app HTML responses.\n \n Hosted templates inject framework bootstrap scripts, analytics, Sentry config,\n * and app-owned inline scripts whose exact bytes vary by build/template. Any\n * shared CSP header, even Report-Only, can block or noisily report Google Tag\n * Manager and those bootstraps. Extension iframes and webviews keep their own\n * route-specific sandboxes; normal app documents deliberately do not emit CSP.\n /\nfunction removeDocumentCsp(headers: Headers): void {\n headers.delete(\"content-security-policy\");\n headers.delete(\"content-security-policy-report-only\");\n}\n\nfunction isFrameworkOrAssetPath(pathname: string): boolean {\n return (\n pathname.startsWith(\"/.well-known/\") \|\|\n pathname.startsWith(\"/_agent_native/\") \|\|\n pathname.startsWith(\"/_agent-native/\") \|\|\n pathname.startsWith(\"/api/\") \|\|\n pathname.startsWith(\"/@vite/\") \|\|\n pathname.startsWith(\"/@id/\") \|\|\n pathname.startsWith(\"/@fs/\") \|\|\n pathname === \"/@react-refresh\" \|\|\n pathname === \"/__vite_ping\" \|\|\n pathname === \"/__open-in-editor\" \|\|\n pathname === \"/favicon.ico\" \|\|\n pathname === \"/favicon.png\" \|\|\n (/\\.\\w+$/.test(pathname) && !pathname.endsWith(\".data\"))\n );\n}\n\nasync function rewriteMountedResponse(\n response: Response,\n basePath: string,\n pathname: string,\n requestUrl: string,\n): Promise<Response> {\n const sentryClientConfigScript = getSentryClientConfigScript();\n const headers = new Headers(response.headers);\n applyDefaultSsrCacheHeader(headers, response.status, pathname);\n applyDefaultSpeculationRulesHeader(headers, response.status, basePath);\n\n const location = headers.get(\"location\");\n if (location?.startsWith(\"/\") && !location.startsWith(\"//\")) {\n headers.set(\"location\", prefixMountedPath(location, basePath));\n }\n\n const contentType = headers.get(\"content-type\") ?? \"\";\n if (!contentType.toLowerCase().includes(\"text/html\")) {\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n });\n }\n removeDocumentCsp(headers);\n if (!response.body) {\n return new Response(response.body, {\n status: response.status,\n statusText: response.statusText,\n headers,\n });\n }\n\n const html = await response.text();\n headers.delete(\"content-length\");\n return new Response(\n injectHeadScript(\n injectDefaultSocialImageMeta(\n prefixMountedHtml(html, basePath),\n defaultSocialImageUrl(requestUrl, basePath),\n ),\n sentryClientConfigScript,\n ),\n {\n status: response.status,\n statusText: response.statusText,\n headers,\n },\n );\n}\n\n/\n Create an h3 catch-all that hands page routes to React Router and\n * returns 404 for framework / asset paths that React Router doesn't own.\n */\nexport function createH3SSRHandler(getBuild: () => Promise<unknown> \| unknown) {\n const handler = createRequestHandler(getBuild as any);\n return defineEventHandler(async (event) => {\n const basePath = getAppBasePath();\n const p = stripAppBasePath(event.url.pathname);\n if (isFrameworkOrAssetPath(p)) {\n return new Response(null, { status: 404 });\n }\n try {\n const request = requestForAnonymousSsr(\n requestWithPathname(event.req as Request, p, basePath),\n );\n // SSR renders an IMPERSONAL public shell — we deliberately do NOT read the\n // request's session/cookies here, and pin an explicitly anonymous request\n // context. That keeps the SSR HTML/.data identical for every visitor so it\n // can be hard-cached at the CDN for everyone (see applyDefaultSsrCacheHeader).\n //\n // Consequence: SSR loaders that call `getRequestUserEmail()` / `accessFilter()`\n // always see the unauthenticated branch and render public content only. Any\n // per-user view (private records, share-grant access, who's logged in) MUST\n // be resolved CLIENT-SIDE after load, never baked into SSR. Do not re-pin the\n // session here to \"fix\" a per-user page — that silently makes the page\n // uncacheable and/or leaks one user's data into another's cached copy.\n const ctx = { userEmail: undefined, orgId: undefined };\n if (request.method === \"HEAD\") {\n const getRequest = new Request(request.url, {\n method: \"GET\",\n headers: request.headers,\n signal: request.signal,\n });\n const response = await runWithRequestContext(ctx, () =>\n handler(getRequest),\n );\n return await rewriteMountedResponse(\n new Response(null, {\n status: response.status,\n statusText: response.statusText,\n headers: response.headers,\n }),\n basePath,\n p,\n request.url,\n );\n }\n return await rewriteMountedResponse(\n await runWithRequestContext(ctx, () => handler(request)),\n basePath,\n p,\n request.url,\n );\n } catch (err) {\n // Log the full stack server-side, but never leak it to the client.\n // Stack traces expose file paths, library versions, and code structure\n // that aid reconnaissance attacks. In dev we surface the message text\n // so devtools shows something useful; in prod we return a bare 500.\n console.error(\"[ssr-handler] SSR error:\", err);\n captureError(err, {\n route: p,\n method: event.req.method,\n userAgent: event.req.headers.get(\"user-agent\") ?? undefined,\n tags: { renderMode: \"anonymous-public\", surface: \"ssr\" },\n });\n const isProd = process.env.NODE_ENV === \"production\";\n const body = isProd\n ? \"Internal Server Error\"\n : `Internal Server Error: ${(err as Error)?.message ?? err}`;\n return new Response(body, {\n status: 500,\n headers: { \"content-type\": \"text/plain\" },\n });\n }\n });\n}\n"]}

package/dist/server/transcribe-voice.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;~~AA8IH~~,wBAAgB,4BAA4B;;;;;;IAkY3C"}
1	+ {"version":3,"file":"transcribe-voice.d.ts","sourceRoot":"","sources":["../../src/server/transcribe-voice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA6FH,wBAAgB,4BAA4B;;;;;;IAkY3C"}

package/dist/server/transcribe-voice.js CHANGED Viewed

@@ -16,7 +16,7 @@
  * audio bodies aren't a clean fit for the action contract (actions are
  * typed JSON-in / JSON-out).
  */
-import { defineEventHandler, getMethod, getRequestHeader, readMultipartFormData, setResponseStatus, } from "h3";
+import { defineEventHandler, getMethod, readMultipartFormData, setResponseStatus, } from "h3";
 import { createBuilderEngine } from "../agent/engine/builder-engine.js";
 import { appStateGet } from "../application-state/store.js";
 import { getOrgContext } from "../org/context.js";
@@ -25,6 +25,7 @@ import { applyVoiceContextReplacements, buildVoiceGuidanceBlock, parseVoiceConte
 import { getSession } from "./auth.js";
 import { resolveHasBuilderPrivateKey, resolveSecret, } from "./credential-provider.js";
 import { runWithRequestContext } from "./request-context.js";
+import { isSameOriginRequest } from "./request-origin.js";
 const WHISPER_URL = "https://api.openai.com/v1/audio/transcriptions";
 const GROQ_URL = "https://api.groq.com/openai/v1/audio/transcriptions";
 const GROQ_CHAT_URL = "https://api.groq.com/openai/v1/chat/completions";
@@ -54,53 +55,6 @@ const BUILDER_GEMINI_TRANSCRIPTION_MODEL = "gemini-3-1-flash-lite";
 // managed provider above handles the newer Gemini 3.1 Flash-Lite preview.
 const GEMINI_MODEL = "gemini-2.0-flash-lite";
 const GEMINI_URL = `https://generativelanguage.googleapis.com/v1beta/models/${GEMINI_MODEL}:generateContent`;
-/**
- * Reject cross-site POSTs. Cookies are `SameSite=None; Secure` over HTTPS so
- * the browser would otherwise attach the session to a forged form submission
- * from evil.com, causing us to spend OpenAI credits on the user's behalf.
- * Same-origin browsers always send `Origin` on POST; if it's missing we fall
- * back to `Sec-Fetch-Site` so Safari's fetch-spec behavior still works.
- */
-function isSameOriginRequest(event) {
-    const host = getRequestHeader(event, "host");
-    const origin = getRequestHeader(event, "origin");
-    if (origin && host) {
-        try {
-            const parsed = new URL(origin);
-            if (parsed.host === host)
-                return true;
-            // Tauri desktop dev serves the tray WebView from localhost:1420 while
-            // the app server lives on the template dev port. Production Tauri
-            // WebViews can also send a tauri://localhost origin. Treat only those
-            // desktop origins as trusted cross-origin callers; arbitrary websites
-            // still fail the CSRF check.
-            if (parsed.protocol === "tauri:" && parsed.hostname === "localhost") {
-                return true;
-            }
-            if ((parsed.protocol === "http:" || parsed.protocol === "https:") &&
-                parsed.hostname === "tauri.localhost" &&
-                (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))) {
-                return true;
-            }
-            if (parsed.protocol === "http:" &&
-                (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") &&
-                parsed.port === "1420" &&
-                (host.startsWith("localhost:") || host.startsWith("127.0.0.1:"))) {
-                return true;
-            }
-            return false;
-        }
-        catch {
-            return false;
-        }
-    }
-    const fetchSite = getRequestHeader(event, "sec-fetch-site");
-    if (fetchSite)
-        return fetchSite === "same-origin" || fetchSite === "none";
-    // No Origin and no Sec-Fetch-Site: likely a non-browser client (curl,
-    // server-side) — safe to allow, CSRF requires a browser with ambient cookies.
-    return true;
-}
 /**
  * Derive an AbortSignal that fires when the client disconnects mid-request
  * (e.g. the desktop client's own 8s ceiling firing before a provider call's