artifactpass 0.1.11-rc.2 → 0.1.12-rc.1

package/dist/cli.mjs

@@ -18419,7 +18419,7 @@ var cloudflareTokenPattern = /\bcfut_[A-Za-z0-9_-]{20,}\b/gu;
 var shareUrlPattern = /https:\/\/[^\s/]+\/a\/[A-Za-z0-9_-]{32,256}(?:\/[^\s]*)?/gu;
 var redactSensitiveText = (value2) => value2.replace(bearerPattern, "Bearer [REDACTED]").replace(agentTokenPattern2, "[REDACTED]").replace(cloudflareTokenPattern, "[REDACTED]").replace(shareUrlPattern, "[REDACTED SHARE URL]");
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create2 = Object.create;
 var __defProp2 = Object.defineProperty;
 var __getOwnPropDesc2 = Object.getOwnPropertyDescriptor;
@@ -18459,7 +18459,7 @@ var __toESM2 = (mod, isNodeMode, target) => (target = mod != null ? __create2(__
   enumerable: true
 }) : target, mod));
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
 var DRAFT_2020_12_URIS = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2020-12/schema", "http://json-schema.org/draft/2020-12/schema"]);
 var DRAFT_2019_09_URIS = /* @__PURE__ */ new Set(["https://json-schema.org/draft/2019-09/schema", "http://json-schema.org/draft/2019-09/schema"]);
 var DRAFT_07_URIS = /* @__PURE__ */ new Set(["https://json-schema.org/draft-07/schema", "http://json-schema.org/draft-07/schema"]);
@@ -18476,7 +18476,7 @@ function declaredDialect(schema, remedy) {
   throw new Error(`JSON Schema declares an unsupported dialect ("$schema": "${schema.$schema.slice(0, 200)}"). The default validator supports JSON Schema 2020-12, 2019-09, draft-07, and draft-06; ${remedy}`);
 }
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+core@2.0.0/node_modules/@modelcontextprotocol/core/dist/auth-CUe6YdwF.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+core@2.3.1/node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
 var LATEST_PROTOCOL_VERSION = "2025-11-25";
 var SUPPORTED_PROTOCOL_VERSIONS = [
   LATEST_PROTOCOL_VERSION,
@@ -19313,7 +19313,8 @@ var OAuthMetadataSchema = looseObject({
   introspection_endpoint_auth_signing_alg_values_supported: array(string2()).optional(),
   code_challenge_methods_supported: array(string2()).optional(),
   client_id_metadata_document_supported: boolean2().optional(),
-  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0)
+  authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0),
+  dpop_signing_alg_values_supported: array(string2()).optional()
 });
 var OpenIdProviderMetadataSchema = looseObject({
   issuer: string2(),
@@ -19364,7 +19365,8 @@ var OAuthTokensSchema = object({
   token_type: string2(),
   expires_in: coerce_exports.number().optional(),
   scope: string2().optional(),
-  refresh_token: string2().optional()
+  refresh_token: string2().optional(),
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var IdJagTokenExchangeResponseSchema = object({
   issued_token_type: literal("urn:ietf:params:oauth:token-type:id-jag"),
@@ -19402,7 +19404,8 @@ var OAuthClientInformationSchema = object({
   client_id: string2(),
   client_secret: string2().optional(),
   client_id_issued_at: number2().optional(),
-  client_secret_expires_at: number2().optional()
+  client_secret_expires_at: number2().optional(),
+  issuer: string2().optional().catch(void 0)
 }).strip();
 var OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
 var OAuthClientRegistrationErrorSchema = object({
@@ -19414,7 +19417,7 @@ var OAuthTokenRevocationRequestSchema = object({
   token_type_hint: string2().optional()
 }).strip();
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs
 var BRANDS = /* @__PURE__ */ Symbol.for("mcp.sdk.errorBrands");
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
@@ -19528,8 +19531,18 @@ var SdkError = class extends Error {
     if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
     return brandedHasInstance(this, value2);
   }
-  constructor(code, message, data) {
-    super(message);
+  /**
+  * @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+  * @param message - Human-readable description.
+  * @param data - Optional structured payload (for example the HTTP status carried by
+  * {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+  * promoted to `Error.cause`.
+  * @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+  * failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+  * loggers and error trackers walk.
+  */
+  constructor(code, message, data, options) {
+    super(message, options);
     this.code = code;
     this.data = data;
     this.name = "SdkError";
@@ -19540,8 +19553,11 @@ var SdkHttpError = class extends SdkError {
   static {
     Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
   }
-  constructor(code, message, data) {
-    super(code, message, data);
+  /**
+  * @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+  */
+  constructor(code, message, data, options) {
+    super(code, message, data, options);
     this.name = "SdkHttpError";
   }
   get status() {
@@ -21643,7 +21659,8 @@ function build() {
     ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
     ReadResourceResultResponseSchema: wireResultResponse(union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
     CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+    SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
   };
 }
 var memo;
@@ -22071,6 +22088,8 @@ var rev2026Codec = {
       const rawInputRequests = raw["inputRequests"];
       const inputRequests = isPlainObject$4(rawInputRequests) ? rawInputRequests : {};
       const requestState = raw["requestState"];
+      const metaParse = raw["_meta"] === void 0 ? void 0 : buildSchemas2026().ResultMetaSchema.safeParse(raw["_meta"]);
+      const meta3 = metaParse?.success ? metaParse.data : void 0;
       if (Object.keys(inputRequests).length === 0 && typeof requestState !== "string") return {
         kind: "invalid",
         error: new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${method}: input_required carries neither inputRequests nor requestState (every input_required result must include at least one of the two)`, {
@@ -22081,7 +22100,8 @@ var rev2026Codec = {
       return {
         kind: "input_required",
         inputRequests,
-        ...typeof requestState === "string" && { requestState }
+        ...typeof requestState === "string" && { requestState },
+        ...meta3 !== void 0 && { _meta: meta3 }
       };
     }
     if (rawResultType !== "complete") return {
@@ -22148,6 +22168,9 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
   return ALL_CODECS.some((codec2) => codec2.hasNotificationMethod(method));
 }
+function isExtensionReusedRequestMethod(method) {
+  return method === "tasks/get" || method === "tasks/cancel";
+}
 var ALL_CODECS = [rev2025Codec, rev2026Codec];
 var schemas_exports3 = /* @__PURE__ */ __exportAll({
   AnnotationsSchema: () => AnnotationsSchema,
@@ -22382,7 +22405,7 @@ var INBOUND_VALIDATION_LADDER = [
     evaluatedAt: "pre-dispatch",
     codes: [HEADER_MISMATCH_ERROR_CODE],
     conformance: ["http-header-validation"],
-    rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
+    rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half \u2014 including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
   },
   {
     rung: "client-capabilities",
@@ -22964,6 +22987,8 @@ var Protocol = class {
   _transport;
   _requestMessageId = 0;
   _requestHandlers = /* @__PURE__ */ new Map();
+  /** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+  _customSchemaRequestMethods = /* @__PURE__ */ new Set();
   _requestHandlerAbortControllers = /* @__PURE__ */ new Map();
   _notificationHandlers = /* @__PURE__ */ new Map();
   _responseHandlers = /* @__PURE__ */ new Map();
@@ -23100,7 +23125,7 @@ var Protocol = class {
     return this._requestHandlers.get(method);
   }
   async _oncancel(notification) {
-    if (!notification.params.requestId) return;
+    if (notification.params.requestId === void 0) return;
     this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
   }
   _setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -23247,7 +23272,7 @@ var Protocol = class {
         return;
       }
     }
-    if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method)) {
+    if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
       sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
       return;
     }
@@ -23380,8 +23405,11 @@ var Protocol = class {
   }
   request(request, schemaOrOptions, maybeOptions) {
     const codec2 = this._resolveOutboundCodec(request.method);
+    if (isStandardSchema(schemaOrOptions)) {
+      if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec2, request.method);
+      return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
+    }
     this._assertOutboundRequestInEra(codec2, request.method);
-    if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
     const validate = codecResultValidator(codec2, request.method);
     if (validate === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
     return this._requestWithSchemaViaCodec(codec2, request, validate, schemaOrOptions);
@@ -23499,19 +23527,20 @@ var Protocol = class {
       const cancel2 = (reason) => {
         if (responseReceived) return;
         this._progressHandlers.delete(messageId);
-        if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-          jsonrpc: "2.0",
-          method: "notifications/cancelled",
-          params: {
-            requestId: messageId,
-            reason: String(reason)
-          }
-        }), {
-          relatedRequestId,
-          resumptionToken,
-          onresumptiontoken
-        }).catch((error51) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error51}`)));
-        else requestAbort.abort();
+        if (requestAbort === void 0) {
+          if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+            jsonrpc: "2.0",
+            method: "notifications/cancelled",
+            params: {
+              requestId: messageId,
+              reason: String(reason)
+            }
+          }), {
+            relatedRequestId,
+            resumptionToken,
+            onresumptiontoken
+          }).catch((error51) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error51}`)));
+        } else requestAbort.abort();
         reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
       };
       this._responseHandlers.set(messageId, (response) => {
@@ -23573,7 +23602,7 @@ var Protocol = class {
   * Emits a notification, which is a one-way message that does not expect a response.
   */
   async notification(notification, options) {
-    return this._notificationViaCodec(this._resolveOutboundCodec(notification.method), notification, options);
+    return await this._notificationViaCodec(this._resolveOutboundCodec(notification.method), notification, options);
   }
   /**
   * The notification funnel proper, keyed by the resolved era codec —
@@ -23591,7 +23620,7 @@ var Protocol = class {
       jsonrpc: "2.0",
       ...notification
     });
-    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+    if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
       if (this._pendingDebouncedNotifications.has(notification.method)) return;
       this._pendingDebouncedNotifications.add(notification.method);
       Promise.resolve().then(() => {
@@ -23624,6 +23653,8 @@ var Protocol = class {
       return maybeHandler(parsed.data, ctx);
     };
     else throw new TypeError("setRequestHandler: handler is required");
+    if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+    else this._customSchemaRequestMethods.add(method);
     this._requestHandlers.set(method, this._wrapHandler(method, stored));
   }
   /**
@@ -23653,6 +23684,7 @@ var Protocol = class {
   */
   removeRequestHandler(method) {
     this._requestHandlers.delete(method);
+    this._customSchemaRequestMethods.delete(method);
   }
   /**
   * Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -23730,7 +23762,8 @@ function manualInputRequiredValue(decoded) {
   return {
     resultType: "input_required",
     inputRequests: decoded.inputRequests,
-    ...decoded.requestState !== void 0 && { requestState: decoded.requestState }
+    ...decoded.requestState !== void 0 && { requestState: decoded.requestState },
+    ...decoded._meta !== void 0 && { _meta: decoded._meta }
   };
 }
 var require_content_type = /* @__PURE__ */ __commonJSMin(((exports) => {
@@ -23781,7 +23814,7 @@ var require_content_type = /* @__PURE__ */ __commonJSMin(((exports) => {
 var import_content_type = /* @__PURE__ */ __toESM2(require_content_type(), 1);
 var STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = void 0;
@@ -30791,7 +30824,7 @@ var AjvJsonSchemaValidator = class {
 };
 var Ajv = import_ajv.Ajv;
 
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.0.0/node_modules/@modelcontextprotocol/server/dist/mcp-DXXb3Vv3.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs
 var MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
 var DEFAULT_LEGACY_SHIM_MAX_ROUNDS = 8;
 var DEFAULT_LEGACY_SHIM_ROUND_TIMEOUT_MS = 6e5;
@@ -30988,6 +31021,11 @@ var Server = class extends Protocol {
     if (modernProtocolVersions(this._supportedProtocolVersions).length > 0) this.setRequestHandler("server/discover", () => this._ondiscover());
     if (this._capabilities.logging) this._registerLoggingHandler();
   }
+  /** Attaches to the given transport; rejects while this instance is connected to another one. */
+  async connect(transport) {
+    if (this.transport !== void 0) throw new SdkError(SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+    await super.connect(transport);
+  }
   /**
   * Registers the built-in `logging/setLevel` request handler.
   *
@@ -31542,6 +31580,9 @@ function discoverAdvertisedCapabilities(capabilities) {
   return { ...capabilities };
 }
 
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/index.mjs
+var DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+
 // ../agent-bridge/src/connection/device-authorization.ts
 import { createHash, generateKeyPairSync, randomBytes } from "node:crypto";
 var base64Url = (value2) => Buffer.from(value2).toString("base64url");
@@ -36585,7 +36626,7 @@ var runDoctor = async (deploymentRoot2, runner = runProcess) => {
 // package.json
 var package_default = {
   name: "artifactpass",
-  version: "0.1.11-rc.2",
+  version: "0.1.12-rc.1",
   description: "Install and connect ArtifactPass for compatible AI agent systems.",
   homepage: "https://artifactpass.com",
   keywords: [
@@ -40049,7 +40090,7 @@ Resume: ${resumeCommand2}
 });
 /*! Bundled license information:
 
-@modelcontextprotocol/server/dist/src-CX2iR2pK.mjs:
+@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson

package/dist/deployment/client/upload.html

@@ -7,8 +7,8 @@
     <meta name="theme-color" content="#0b0c0e" />
     <link rel="icon" href="/artifactpass-logo.svg" type="image/svg+xml" />
     <title>ArtifactPass</title>
-    <script type="module" crossorigin src="/assets/main-5JyN21kZ.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/main-BUhxWqWm.css">
+    <script type="module" crossorigin src="/assets/main-5JyN21kZ.js?v=2026-10-14"></script>
+    <link rel="stylesheet" crossorigin href="/assets/main-BUhxWqWm.css?v=2026-10-14">
   </head>
   <body>
     <div id="root"></div>

package/dist/deployment/index.js

@@ -6240,7 +6240,7 @@ var Hono = class extends Hono$1 {
 };
 var package_default = {
 	name: "artifactpass",
-	version: "0.1.11-rc.2",
+	version: "0.1.12-rc.1",
 	"private": true,
 	type: "module",
 	packageManager: "pnpm@10.11.0",
@@ -16913,13 +16913,13 @@ var parseApprovalBody = async (request) => {
 	if (request.headers.get("content-type")?.startsWith("application/x-www-form-urlencoded") === true) return { user_code: (await request.formData()).get("user_code") };
 	return parseJson(request);
 };
-var escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+var escapeHtml$1 = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
 var approvalPage = (userCode, nonce, approved = false, authorization, deploymentHostname) => `<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <title>${approved ? "Connection approved" : "Approve ArtifactPass"}</title>
 <link rel="icon" href="/artifactpass-logo.svg" type="image/svg+xml">
 <style nonce="${nonce}">html{color:#24241f;background:#f7f5ef;font-family:Avenir,"Helvetica Neue",sans-serif}body{margin:0;min-height:100vh;display:grid;place-items:center}.card{width:min(520px,calc(100% - 36px));padding:42px;background:#fffefa;border:1px solid #d8d5ca;border-radius:8px}.brand{display:flex;align-items:center;margin:0 0 24px;font-size:.92rem;font-weight:700}.brand-mark{display:block;width:22px;height:22px;margin-right:9px;color:#24241f;flex:none}h1{margin:0 0 14px;font:400 2.8rem/1 Georgia,serif;letter-spacing:-.04em}p{color:#66645e;line-height:1.6}.details{margin:22px 0;padding:16px;border:1px solid #d8d5ca;border-radius:6px;background:#f7f5ef}.details div{display:grid;grid-template-columns:110px 1fr;gap:10px;padding:5px 0;color:#66645e;font-size:.86rem}.details strong{color:#24241f}.code{display:block;margin:24px 0;padding:14px;background:#f1efe8;border:1px solid #d8d5ca;font:700 1rem/1.2 ui-monospace,monospace;letter-spacing:.08em;text-align:center}button{width:100%;padding:14px;border:0;border-radius:5px;background:#24241f;color:white;font:700 .9rem Avenir,sans-serif;cursor:pointer}button:focus-visible{outline:3px solid #1f6c9f;outline-offset:3px}</style></head>
-<body><main class="card"><div class="brand">${artifactPassIconMarkup$1}ArtifactPass</div><h1>${approved ? "Connected." : "Approve this agent?"}</h1><p>${approved ? "The one-time code has been approved. Return to your agent; the scoped token and device key will be stored only on that device." : "Only approve a code you just requested from your own agent. This grants artifact:create access for 30 days."}</p>${approved ? "" : `<div class="details"><div><strong>Deployment</strong><span>${escapeHtml(deploymentHostname ?? "ArtifactPass")}</span></div><div><strong>Agent</strong><span>${escapeHtml(authorization?.agent_name ?? "ArtifactPass agent")}</span></div><div><strong>Workspace</strong><span>${escapeHtml(authorization?.workspace_identity ?? "Current workspace")}</span></div><div><strong>Scope</strong><span>artifact:create</span></div>${authorization?.device_key_id === null || authorization?.device_key_id === void 0 ? "" : `<div><strong>Device key</strong><span>${escapeHtml(authorization.device_key_id.slice(0, 18))}…</span></div>`}</div><span class="code">${userCode}</span><form method="post" action="/connect/approve"><input type="hidden" name="user_code" value="${userCode}"><button type="submit">Approve connection</button></form>`}</main></body></html>`;
+<body><main class="card"><div class="brand">${artifactPassIconMarkup$1}ArtifactPass</div><h1>${approved ? "Connected." : "Approve this agent?"}</h1><p>${approved ? "The one-time code has been approved. Return to your agent; the scoped token and device key will be stored only on that device." : "Only approve a code you just requested from your own agent. This grants artifact:create access for 30 days."}</p>${approved ? "" : `<div class="details"><div><strong>Deployment</strong><span>${escapeHtml$1(deploymentHostname ?? "ArtifactPass")}</span></div><div><strong>Agent</strong><span>${escapeHtml$1(authorization?.agent_name ?? "ArtifactPass agent")}</span></div><div><strong>Workspace</strong><span>${escapeHtml$1(authorization?.workspace_identity ?? "Current workspace")}</span></div><div><strong>Scope</strong><span>artifact:create</span></div>${authorization?.device_key_id === null || authorization?.device_key_id === void 0 ? "" : `<div><strong>Device key</strong><span>${escapeHtml$1(authorization.device_key_id.slice(0, 18))}…</span></div>`}</div><span class="code">${userCode}</span><form method="post" action="/connect/approve"><input type="hidden" name="user_code" value="${userCode}"><button type="submit">Approve connection</button></form>`}</main></body></html>`;
 var approvalHeaders = (nonce) => ({
 	...RESPONSE_HEADERS$1,
 	"Referrer-Policy": "same-origin",
@@ -17706,7 +17706,7 @@ const chooseFile=()=>{if(authBusy)return;input.value="";input.click();};
 const selectFile=async(file)=>{if(!file)return false;const run=++validationRun;openDialog();setAuthBusy(true,"Checking document");setStatus("Checking this document in your browser.");try{const{state,validator}=await loadPreflight();const prepared=await validator.prepareBrowserFile(file,state.policy.max_artifact_bytes);if(run!==validationRun)return false;if(prepared.error||!prepared.file){setAuthBusy(false,continuationLabel());setStatus(prepared.error||"This document could not be validated.","error");input.value="";return false;}selectedFile=prepared.file;sessionAuthenticated=state.authenticated===true;deploymentMode=state.deployment_mode==="private"?"private":"public";const extension=(selectedFile.name.split(".").pop()||"file").toUpperCase();document.querySelector("#file-kind").textContent=extension==="MARKDOWN"?"MD":extension==="HTM"?"HTML":extension;document.querySelector("#file-name").textContent=selectedFile.name;document.querySelector("#file-details").textContent=formatBytes(selectedFile.size)+" · one document selected";dropZone.hidden=true;preview.hidden=false;config.hidden=false;note.hidden=false;description.textContent="One document selected. Nothing uploads until you continue.";authCopy.textContent=sessionAuthenticated?"Continue to create the temporary link.":"Sign in, then ArtifactPass creates the temporary link.";setAuthBusy(false,continuationLabel());setStatus("");return true;}catch{if(run!==validationRun)return false;setAuthBusy(false,continuationLabel());setStatus("Document validation is unavailable. Try again.","error");input.value="";return false;}};
 document.querySelector("#open-upload").addEventListener("click",openDialog);closeButton.addEventListener("click",()=>{if(!authBusy)dialog.close();});dropZone.addEventListener("click",chooseFile);dropZone.addEventListener("keydown",event=>{if(event.key==="Enter"||event.key===" "){event.preventDefault();chooseFile();}});input.addEventListener("change",()=>{void selectFile(input.files&&input.files[0]);});changeButton.addEventListener("click",chooseFile);
 const pageParameters=new URLSearchParams(window.location.search);if(pageParameters.get("upload")==="1")openDialog();if(pageParameters.get("auth")==="cancelled"){const restoreRequest=indexedDB.open("artifactpass-pending-upload",1);restoreRequest.addEventListener("upgradeneeded",()=>{if(!restoreRequest.result.objectStoreNames.contains("uploads"))restoreRequest.result.createObjectStore("uploads",{keyPath:"key"});});restoreRequest.addEventListener("success",()=>{const db=restoreRequest.result;const readRequest=db.transaction("uploads","readonly").objectStore("uploads").get("homepage");readRequest.addEventListener("success",()=>{const record=readRequest.result;db.close();if(!record||(record.version!==1&&record.version!==2)||typeof record.name!=="string"||!(record.bytes instanceof ArrayBuffer)||record.bytes.byteLength===0||Date.now()-record.createdAt>3600000){setStatus("Sign-in cancelled. Choose your document again.","error");return;}const expiry=expiryInputs.find(option=>Number(option.value)===record.expiresInSeconds);if(expiry)expiry.checked=true;void selectFile(new File([record.bytes],record.name,{type:record.type,lastModified:record.lastModified})).then(selected=>{if(selected)setStatus("Sign-in cancelled. Your document is still selected.","info");});});readRequest.addEventListener("error",()=>{db.close();setStatus("Sign-in cancelled. Choose your document again.","error");});});restoreRequest.addEventListener("error",()=>setStatus("Sign-in cancelled. Choose your document again.","error"));}
-let authWindow=null;let authPoll=null;let authCloseGrace=null;let authFlow=null;const finishAuthWindow=()=>{if(authPoll!==null)window.clearInterval(authPoll);if(authCloseGrace!==null)window.clearTimeout(authCloseGrace);authPoll=null;authCloseGrace=null;authWindow=null;authFlow=null;};const resetAuthButton=(message,tone="error")=>{setAuthBusy(false,continuationLabel());setStatus(message,tone);};const finishAuthCancellation=()=>{if(!authBusy)return;finishAuthWindow();resetAuthButton("Sign-in cancelled. Your document is still selected.","info");};const finishAuthCompletion=()=>{if(!authBusy)return;authBusy=false;finishAuthWindow();continueButton.textContent="Creating link";setStatus("Signed in. Creating the temporary link.");window.location.assign(publishPath);};let authChannel=null;if("BroadcastChannel" in window){try{authChannel=new BroadcastChannel("artifactpass-auth");authChannel.addEventListener("message",event=>{if(typeof event.data!=="object"||event.data===null||event.data.flow!==authFlow)return;if(event.data.type==="artifactpass:auth-cancelled"){finishAuthCancellation();return;}if(event.data.type==="artifactpass:auth-complete")finishAuthCompletion();});window.addEventListener("pagehide",()=>authChannel.close(),{once:true});}catch{authChannel=null;}}const watchAuthWindow=()=>{if(authPoll!==null)window.clearInterval(authPoll);const startedAt=Date.now();authPoll=window.setInterval(()=>{if(authWindow!==null&&authWindow.closed){window.clearInterval(authPoll);authPoll=null;if(authCloseGrace===null)authCloseGrace=window.setTimeout(()=>{authCloseGrace=null;finishAuthWindow();resetAuthButton("Sign-in was closed. Your document is still selected.");},1000);return;}if(Date.now()-startedAt>=600000){try{authWindow?.close();}catch{}finishAuthWindow();resetAuthButton("Sign-in took too long. Your document is still selected.");}},500);};
+let authWindow=null;let authPoll=null;let authCloseGrace=null;let authFlow=null;const finishAuthWindow=()=>{if(authPoll!==null)window.clearInterval(authPoll);if(authCloseGrace!==null)window.clearTimeout(authCloseGrace);authPoll=null;authCloseGrace=null;authWindow=null;authFlow=null;};const resetAuthButton=(message,tone="error")=>{setAuthBusy(false,continuationLabel());setStatus(message,tone);};const finishAuthCancellation=()=>{if(!authBusy)return;finishAuthWindow();resetAuthButton("Sign-in cancelled. Your document is still selected.","info");};const finishAuthCompletion=()=>{if(!authBusy)return;authBusy=false;finishAuthWindow();continueButton.textContent="Creating link";setStatus("Signed in. Creating the temporary link.");window.location.assign(publishPath);};const reconcileClosedAuth=async()=>{authCloseGrace=null;try{const latest=await fetchPreflight();sessionAuthenticated=latest.authenticated===true;deploymentMode=latest.deployment_mode==="private"?"private":"public";if(sessionAuthenticated){finishAuthCompletion();return;}}catch{}finishAuthWindow();resetAuthButton("Sign-in was closed. Your document is still selected.");};let authChannel=null;if("BroadcastChannel" in window){try{authChannel=new BroadcastChannel("artifactpass-auth");authChannel.addEventListener("message",event=>{if(typeof event.data!=="object"||event.data===null||event.data.flow!==authFlow)return;if(event.data.type==="artifactpass:auth-cancelled"){finishAuthCancellation();return;}if(event.data.type==="artifactpass:auth-complete")finishAuthCompletion();});window.addEventListener("pagehide",()=>authChannel.close(),{once:true});}catch{authChannel=null;}}const watchAuthWindow=()=>{if(authPoll!==null)window.clearInterval(authPoll);const startedAt=Date.now();authPoll=window.setInterval(()=>{if(authWindow!==null&&authWindow.closed){window.clearInterval(authPoll);authPoll=null;if(authCloseGrace===null)authCloseGrace=window.setTimeout(()=>{void reconcileClosedAuth();},1000);return;}if(Date.now()-startedAt>=600000){try{authWindow?.close();}catch{}finishAuthWindow();resetAuthButton("Sign-in took too long. Your document is still selected.");}},500);};
 const storePending=async(popup)=>{if(!selectedFile)return;setAuthBusy(true,sessionAuthenticated?"Creating link":"Preparing sign-in");setStatus(sessionAuthenticated?"Preparing the document for its temporary link.":"Keeping this document in your browser while sign-in opens.");const fail=()=>{popup?.close();finishAuthWindow();resetAuthButton("This browser could not keep the document for continuation. Try again.");};try{const bytes=await selectedFile.arrayBuffer();const expiry=Number(document.querySelector('input[name="expiry"]:checked').value);const request=indexedDB.open("artifactpass-pending-upload",1);request.addEventListener("upgradeneeded",()=>{if(!request.result.objectStoreNames.contains("uploads"))request.result.createObjectStore("uploads",{keyPath:"key"});});request.addEventListener("success",()=>{const db=request.result;const transaction=db.transaction("uploads","readwrite");transaction.objectStore("uploads").put({key:"homepage",version:1,name:selectedFile.name,type:selectedFile.type,lastModified:selectedFile.lastModified,bytes,expiresInSeconds:expiry,createdAt:Date.now()});transaction.addEventListener("complete",async()=>{db.close();sessionStorage.setItem("artifactpass-pending-upload","1");try{const latest=await fetchPreflight();sessionAuthenticated=latest.authenticated===true;deploymentMode=latest.deployment_mode==="private"?"private":"public";}catch{sessionAuthenticated=false;}if(sessionAuthenticated||deploymentMode==="private"){try{popup?.close();}catch{}finishAuthWindow();window.location.assign(publishPath);return;}const theme=document.documentElement.dataset.theme==="light"?"light":"dark";if(popup===null){window.location.assign("/auth/sign-in?return_to="+encodeURIComponent(publishPath)+"&theme="+theme);return;}if(popup.closed){finishAuthWindow();resetAuthButton("Sign-in was closed. Your document is still selected.");return;}const completion="/auth/popup/complete?theme="+theme+"&flow="+encodeURIComponent(authFlow);popup.location.assign("/auth/sign-in?return_to="+encodeURIComponent(completion)+"&theme="+theme);continueButton.textContent="Finish sign-in in the popup";setStatus("Finish signing in in the popup. This page will create the link automatically.");watchAuthWindow();});transaction.addEventListener("error",()=>{db.close();fail();});});request.addEventListener("error",fail);}catch{fail();}};
 continueButton.addEventListener("click",()=>{if(authBusy||!selectedFile)return;if(sessionAuthenticated||deploymentMode==="private"){void storePending(null);return;}if(window.matchMedia("(max-width: 640px), (pointer: coarse)").matches){void storePending(null);return;}const popup=window.open("","artifactpass-auth-"+Date.now(),"popup,width=540,height=700");if(popup===null){resetAuthButton("Allow popups for ArtifactPass, then try again. Nothing has been uploaded.");return;}authWindow=popup;authFlow=Array.from(crypto.getRandomValues(new Uint8Array(16)),byte=>byte.toString(16).padStart(2,"0")).join("");popup.document.title="ArtifactPass sign-in";popup.document.body.textContent="Preparing secure sign-in…";void storePending(popup);});
 window.addEventListener("message",event=>{if(event.origin!==window.location.origin||event.source!==authWindow||typeof event.data!=="object"||event.data===null||("flow" in event.data&&event.data.flow!==authFlow))return;if(event.data.type==="artifactpass:auth-cancelled"){finishAuthCancellation();return;}if(event.data.type==="artifactpass:auth-complete")finishAuthCompletion();});
@@ -17930,6 +17930,76 @@ var renderSharePage = ({ manifest, nonce, representation, sharePath }) => {
 		})]
 	}))}`;
 };
+var renderUnavailableSharePage = (nonce) => {
+	return `<!doctype html>${(0, import_server_edge.renderToStaticMarkup)(/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("html", {
+		lang: "en",
+		children: [/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("head", { children: [
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("meta", { charSet: "utf-8" }),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("meta", {
+				name: "viewport",
+				content: "width=device-width, initial-scale=1"
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("meta", {
+				name: "referrer",
+				content: "no-referrer"
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("meta", {
+				name: "theme-color",
+				content: "#0b0c0e"
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("link", {
+				rel: "icon",
+				href: "/artifactpass-logo.svg",
+				type: "image/svg+xml"
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("title", { children: "Artifact unavailable · ArtifactPass" }),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("script", {
+				nonce,
+				dangerouslySetInnerHTML: { __html: homepageBootScript }
+			}),
+			/* @__PURE__ */ (0, import_jsx_runtime.jsx)("style", {
+				nonce,
+				dangerouslySetInnerHTML: { __html: pageStyles }
+			})
+		] }), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("body", { children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)("main", {
+			className: "expired-shell",
+			children: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("section", {
+				className: "expired",
+				"aria-labelledby": "unavailable-title",
+				children: [
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+						className: "expired-label",
+						children: "Temporary artifact"
+					}),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)("h1", {
+						id: "unavailable-title",
+						children: "This artifact does not exist or has expired."
+					}),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+						className: "expired-copy",
+						children: "The link may be incorrect, revoked, or past its cutoff. Ask the sender for a new link if you still need the file."
+					}),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", {
+						className: "expired-actions",
+						children: [/* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", {
+							className: "expired-action expired-action--primary",
+							href: publicSiteUrl(),
+							children: "Go to ArtifactPass"
+						}), /* @__PURE__ */ (0, import_jsx_runtime.jsx)("a", {
+							className: "expired-action",
+							href: "/upload",
+							children: "Share a document"
+						})]
+					}),
+					/* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", {
+						className: "expired-note",
+						children: "For privacy, ArtifactPass does not reveal whether an unavailable link previously existed."
+					})
+				]
+			})
+		}) })]
+	}))}`;
+};
 //#endregion
 //#region ../../node_modules/.pnpm/property-information@7.2.0/node_modules/property-information/lib/util/schema.js
 /**
@@ -32026,7 +32096,7 @@ var createNonce = () => {
 	for (const byte of bytes) binary += String.fromCharCode(byte);
 	return btoa(binary);
 };
-var viewerHeaders = (nonce) => ({
+var viewerHeaders = (nonce, allowEmbedding = false) => ({
 	...PUBLIC_RESPONSE_HEADERS,
 	"Content-Security-Policy": [
 		"default-src 'none'",
@@ -32039,10 +32109,17 @@ var viewerHeaders = (nonce) => ({
 		"object-src 'none'",
 		"base-uri 'none'",
 		"form-action 'none'",
-		"frame-ancestors 'none'"
+		`frame-ancestors '${allowEmbedding ? "self" : "none"}'`
 	].join("; "),
 	"Content-Type": "text/html; charset=utf-8"
 });
+var unavailableShareResponse = (allowEmbedding = false) => {
+	const nonce = createNonce();
+	return new Response(renderUnavailableSharePage(nonce), {
+		status: 404,
+		headers: viewerHeaders(nonce, allowEmbedding)
+	});
+};
 var representationFor = async (service, artifact, sharePath) => {
 	if (artifact.mimeType === "application/pdf") return {
 		kind: "pdf",
@@ -32398,6 +32475,82 @@ var R2ArtifactObjectStore = class {
 var capabilityPath = /^\/a\/[A-Za-z0-9_-]{32,256}(?=\/|$)/u;
 var redactRequestPath = (pathname) => pathname.replace(capabilityPath, "/a/:capability");
 //#endregion
+//#region src/server/browser-error-page.ts
+var browserSurface = (pathname) => {
+	if (pathname === "/connect/approve") return "approval";
+	if (/^\/auth\/(?:sign-in|login\/[^/]+|callback\/[^/]+|popup\/[^/]+)\/?$/u.test(pathname)) return "auth";
+	if (pathname === "/upload") return "upload";
+	if (/^\/a\/[^/]+(?:\/[^/]+)?\/?$/u.test(pathname)) return "share";
+	return null;
+};
+var isBrowserNavigation = (request) => {
+	const url = new URL(request.url);
+	if (browserSurface(url.pathname) === null) return false;
+	if (url.pathname === "/connect/approve" && request.method === "GET" && url.searchParams.get("format") === "html") return true;
+	if (url.pathname === "/connect/approve" && request.method === "POST" && request.headers.get("content-type")?.startsWith("application/x-www-form-urlencoded") === true) return true;
+	if (request.headers.get("sec-fetch-mode") === "navigate") return true;
+	return request.headers.get("accept")?.includes("text/html") === true;
+};
+var escapeHtml = (value) => value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#39;");
+var pageContent = (surface, status) => {
+	if (surface === "approval") return status >= 500 || status === 429 ? {
+		title: status === 429 ? "Too many approval attempts." : "Approval is temporarily unavailable.",
+		detail: "Check whether your agent connected. If it did not, wait a moment and open its approval link again. If the link no longer works, start a new connection from your agent.",
+		action: "Go to ArtifactPass",
+		href: "/upload"
+	} : {
+		title: "This approval link is no longer available.",
+		detail: "It may have expired or already been used. Check whether your agent connected. If it did not, start a new connection from your agent and open the new approval link.",
+		action: "Go to ArtifactPass",
+		href: "/upload"
+	};
+	if (surface === "auth") return {
+		title: status >= 500 ? "Sign-in is temporarily unavailable." : "Sign-in could not be completed.",
+		detail: status >= 500 ? "Please try again in a moment. If this keeps happening, contact the ArtifactPass team." : "The sign-in link may have expired, been used, or could not be verified. Start sign-in again. If you were approving an agent, return to it and open a fresh approval link afterward.",
+		action: "Start sign-in again",
+		href: "/auth/sign-in"
+	};
+	if (surface === "share") return status === 404 || status === 410 ? {
+		title: "This artifact does not exist or has expired.",
+		detail: "The link may be incorrect, revoked, or past its cutoff. Ask the sender for a new link if you still need the file.",
+		action: "Share a document",
+		href: "/upload"
+	} : {
+		title: status === 429 ? "Too many requests right now." : "This artifact could not be opened right now.",
+		detail: status === 429 ? "Wait a few minutes, then open the link again." : "Try opening the link again. If it still fails, ask the sender for a new link.",
+		action: "ArtifactPass home",
+		href: "/upload"
+	};
+	return {
+		title: status >= 500 ? "ArtifactPass is temporarily unavailable." : "The upload page is unavailable.",
+		detail: status >= 500 ? "Your file has not been uploaded. Try again in a moment; if this continues, contact the ArtifactPass team." : "Your file has not been uploaded. If this is a private deployment, ask its administrator to check the app assets. Otherwise, contact the ArtifactPass team.",
+		action: status >= 500 ? "Try the upload page again" : "Open setup guides",
+		href: status >= 500 ? "/upload" : "https://artifactpass.com/guides"
+	};
+};
+var browserErrorResponse = (request, status, requestId) => {
+	if (!isBrowserNavigation(request)) return null;
+	const surface = browserSurface(new URL(request.url).pathname);
+	if (surface === null) return null;
+	const content = pageContent(surface, status);
+	const nonce = crypto.randomUUID();
+	const reference = requestId === void 0 ? "" : `<p class="reference">Reference: ${escapeHtml(requestId)}</p>`;
+	const html = `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${content.title} · ArtifactPass</title><link rel="icon" href="/artifactpass-logo.svg" type="image/svg+xml"><style nonce="${nonce}">:root{font-family:Avenir,"Helvetica Neue",sans-serif;color:#24241f;background:#f7f5ef}*{box-sizing:border-box}body{margin:0;min-height:100vh;display:grid;place-items:center;padding:18px}.card{width:min(520px,100%);padding:clamp(26px,5vw,42px);background:#fffefa;border:1px solid #d8d5ca;border-radius:10px}.brand{font-size:.94rem;font-weight:700;letter-spacing:-.02em}h1{margin:36px 0 16px;font:400 clamp(2rem,7vw,2.8rem)/1.08 Georgia,serif;letter-spacing:-.04em}p{color:#66645e;line-height:1.6}.action{display:inline-block;margin-top:18px;padding:13px 18px;border-radius:5px;background:#24241f;color:#fff;text-decoration:none;font-size:.9rem;font-weight:700}.action:focus-visible{outline:3px solid #1f6c9f;outline-offset:3px}.reference{margin-top:24px;font:12px ui-monospace,monospace;overflow-wrap:anywhere}</style></head><body><main class="card"><div class="brand">ArtifactPass</div><h1>${content.title}</h1><p>${content.detail}</p><a class="action" href="${content.href}">${content.action}</a>${reference}</main></body></html>`;
+	return new Response(html, {
+		status,
+		headers: {
+			"Cache-Control": "private, no-store, max-age=0",
+			"Content-Type": "text/html; charset=utf-8",
+			"Content-Security-Policy": `default-src 'none'; style-src 'nonce-${nonce}'; img-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors ${surface === "share" ? "'self'" : "'none'"}`,
+			"Referrer-Policy": "no-referrer",
+			"X-Content-Type-Options": "nosniff",
+			"X-Robots-Tag": "noindex, nofollow, noarchive",
+			...requestId === void 0 ? {} : { "X-ArtifactPass-Request-Id": requestId },
+			...status === 429 ? { "Retry-After": "60" } : {}
+		}
+	});
+};
+//#endregion
 //#region src/server/index.ts
 var createService = (bindings, options) => new ArtifactApplicationService({
 	repository: new D1ArtifactRepository(bindings.ARTIFACT_DB),
@@ -32517,13 +32670,31 @@ var createArtifactApplication = (options = {}) => {
 		...options.publicReadMaximumRequests === void 0 ? {} : { maximumRequests: options.publicReadMaximumRequests }
 	}));
 	app.onError((error, context) => {
-		if (error instanceof ArtifactError) return context.json({
-			protocol_version: 1,
-			error: {
-				code: error.code,
-				message: error.message
+		if (error instanceof ArtifactError) {
+			const pathname = new URL(context.req.url).pathname;
+			const acceptsHtml = context.req.header("accept")?.includes("text/html") === true;
+			if (error.code === "not_found" && context.req.method === "GET" && /^\/a\/[^/]+(?:\/[^/]+)?\/?$/u.test(pathname) && (acceptsHtml || context.req.header("sec-fetch-mode") === "navigate")) return unavailableShareResponse(/^\/a\/[^/]+\/[^/]+\/?$/u.test(pathname));
+			const requestId = context.req.header("cf-ray") ?? crypto.randomUUID();
+			const browserResponse = browserErrorResponse(context.req.raw, error.status, requestId);
+			if (browserResponse !== null) {
+				if (pathname === "/connect/approve" || pathname.startsWith("/auth/")) console.warn(JSON.stringify({
+					event: "artifactpass.browser_navigation_failed",
+					request_id: requestId,
+					method: context.req.method,
+					path: redactRequestPath(pathname),
+					error_code: error.code,
+					status: error.status
+				}));
+				return browserResponse;
 			}
-		}, error.status, PUBLIC_RESPONSE_HEADERS);
+			return context.json({
+				protocol_version: 1,
+				error: {
+					code: error.code,
+					message: error.message
+				}
+			}, error.status, PUBLIC_RESPONSE_HEADERS);
+		}
 		const requestId = context.req.header("cf-ray") ?? crypto.randomUUID();
 		console.error(JSON.stringify({
 			event: "artifactpass.request_failed",
@@ -32534,6 +32705,8 @@ var createArtifactApplication = (options = {}) => {
 			error_message: error instanceof Error ? error.message : String(error),
 			...error instanceof Error && error.stack !== void 0 ? { stack: error.stack } : {}
 		}));
+		const browserResponse = browserErrorResponse(context.req.raw, 500, requestId);
+		if (browserResponse !== null) return browserResponse;
 		return context.json({
 			protocol_version: 1,
 			error: {