fixed auth

.env.example

@@ -8,7 +8,13 @@ INTERNAL_TOKEN=replace-with-random-token
 BILLING_ENABLED=false
 
 # ---- Google sign in (OAuth client, type Web; add http://localhost:5173 to authorized JS origins)
+# Client ID only: popup sign in (Google Identity Services), no redirect URIs needed.
+# Client ID + secret: redirect flow with server side code exchange. Add the redirect URI
+# (default {API_URL}/api/auth/google/callback, e.g. http://localhost:8000/api/auth/google/callback)
+# to "Authorized redirect URIs" on the OAuth client. Never prefix the secret with VITE_.
 GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+GOOGLE_REDIRECT_URI=
 
 # ---- Email (Resend). EMAIL_PROVIDER=console prints emails to the API log instead.
 EMAIL_PROVIDER=console

backend/app/auth.py

@@ -32,6 +32,19 @@ def create_refresh_token(user_id: uuid.UUID, token_version: int) -> str:
     return _encode(user_id, token_version, "refresh", timedelta(days=settings.jwt_refresh_expiration_days))
 
 
+def create_login_ticket(user_id: uuid.UUID, token_version: int, created: bool) -> str:
+    """Short lived handoff from the OAuth callback redirect to the SPA, swapped for real tokens."""
+    now = datetime.now(UTC)
+    payload = {"sub": str(user_id), "tv": token_version, "typ": "ticket", "new": created, "iat": now,
+               "exp": now + timedelta(seconds=60)}
+    return jwt.encode(payload, settings.jwt_secret, algorithm=settings.jwt_algorithm)
+
+
+def encode_signed(payload: dict, ttl: timedelta) -> str:
+    return jwt.encode({**payload, "exp": datetime.now(UTC) + ttl}, settings.jwt_secret,
+                      algorithm=settings.jwt_algorithm)
+
+
 def decode_token_full(token: str, expected_type: str = "access") -> dict:
     try:
         payload = jwt.decode(token, settings.jwt_secret, algorithms=[settings.jwt_algorithm])

backend/app/config.py

@@ -30,6 +30,10 @@ class Settings(BaseSettings):
     jwt_expiration_hours: int = 72
     jwt_refresh_expiration_days: int = 30
     google_client_id: str = ""
+    # Setting the secret switches Google sign in from the GIS popup to the redirect flow
+    # (server side code exchange). The redirect URI must be listed on the OAuth client.
+    google_client_secret: str = ""
+    google_redirect_uri: str = ""  # defaults to {api_url}/api/auth/google/callback
 
     # Email (Resend)
     email_provider: str = "console"  # resend | console
@@ -80,6 +84,10 @@ class Settings(BaseSettings):
             return self.r2_endpoint_url
         return f"https://{self.r2_account_id}.r2.cloudflarestorage.com"
 
+    @property
+    def google_redirect_url(self) -> str:
+        return self.google_redirect_uri or f"{self.api_url.rstrip('/')}/api/auth/google/callback"
+
     @property
     def cors_origin_list(self) -> list[str]:
         return [o.strip() for o in self.cors_origins.split(",") if o.strip()]

backend/app/routers/auth.py

@@ -1,12 +1,24 @@
-from datetime import UTC, datetime
+import secrets
+from datetime import UTC, datetime, timedelta
+from urllib.parse import urlencode
 
-from fastapi import APIRouter, Depends, HTTPException
+import httpx
+from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import RedirectResponse
 from google.auth.transport import requests as google_requests
 from google.oauth2 import id_token as google_id_token
 from pydantic import BaseModel, EmailStr
 from sqlalchemy.orm import Session
 
-from app.auth import create_access_token, create_refresh_token, get_current_user, load_user_from_token
+from app.auth import (
+    create_access_token,
+    create_login_ticket,
+    create_refresh_token,
+    decode_token_full,
+    encode_signed,
+    get_current_user,
+    load_user_from_token,
+)
 from app.config import settings
 from app.db import get_db
 from app.models import AuthProvider, User, VerificationPurpose
@@ -32,12 +44,15 @@ def _serialize_user(user: User) -> dict:
     }
 
 
-def _finalize_login(db: Session, user: User, created: bool) -> dict:
+def _record_login(db: Session, user: User, created: bool) -> None:
     user.last_login_at = datetime.now(UTC)
     if created and not user.welcome_email_sent_at:
         if email_service.send_welcome(user.email, user.name, str(user.id)):
             user.welcome_email_sent_at = datetime.now(UTC)
     db.commit()
+
+
+def _login_result(user: User, created: bool) -> dict:
     return {
         "access_token": create_access_token(user.id, user.token_version),
         "refresh_token": create_refresh_token(user.id, user.token_version),
@@ -46,6 +61,11 @@ def _finalize_login(db: Session, user: User, created: bool) -> dict:
     }
 
 
+def _finalize_login(db: Session, user: User, created: bool) -> dict:
+    _record_login(db, user, created)
+    return _login_result(user, created)
+
+
 # Google
 
 
@@ -74,6 +94,141 @@ def google_login(body: GoogleIn, db: Session = Depends(get_db)):
     return _finalize_login(db, resolved.user, resolved.created)
 
 
+def _safe_next(path: str | None) -> str:
+    """Only same site paths, so the redirect flow cannot be turned into an open redirect."""
+    if not path or not path.startswith("/") or path.startswith("//") or "\\" in path:
+        return "/app"
+    return path
+
+
+@router.get("/providers")
+def providers():
+    """Which Google flow the auth page should render: 'redirect', 'popup', or null when off."""
+    if not settings.google_client_id:
+        return {"google": None}
+    return {"google": "redirect" if settings.google_client_secret else "popup"}
+
+
+# Google redirect flow (authorization code, exchanged server side)
+
+GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth"
+GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token"
+STATE_COOKIE = "ns_oauth_state"
+STATE_TTL = timedelta(minutes=10)
+
+
+def _frontend(path: str, **fragment: str) -> RedirectResponse:
+    url = f"{settings.frontend_url.rstrip('/')}{path}"
+    if fragment:
+        url += "#" + urlencode(fragment)
+    response = RedirectResponse(url, status_code=302)
+    response.delete_cookie(STATE_COOKIE, path="/api/auth/google")
+    return response
+
+
+def _auth_error(message: str) -> RedirectResponse:
+    return _frontend("/auth", error=message)
+
+
+def exchange_google_code(code: str) -> dict:
+    """Trade the authorization code for tokens and return the verified ID token claims."""
+    res = httpx.post(
+        GOOGLE_TOKEN_URL,
+        data={
+            "code": code,
+            "client_id": settings.google_client_id,
+            "client_secret": settings.google_client_secret,
+            "redirect_uri": settings.google_redirect_url,
+            "grant_type": "authorization_code",
+        },
+        timeout=10,
+    )
+    res.raise_for_status()
+    return google_id_token.verify_oauth2_token(
+        res.json()["id_token"], google_requests.Request(), settings.google_client_id
+    )
+
+
+@router.get("/google/start")
+def google_start(next: str | None = None):
+    if not (settings.google_client_id and settings.google_client_secret):
+        return _auth_error("Google sign in is not configured.")
+    nonce = secrets.token_urlsafe(24)
+    state = encode_signed({"typ": "oauth_state", "nonce": nonce, "next": _safe_next(next)}, STATE_TTL)
+    params = {
+        "client_id": settings.google_client_id,
+        "redirect_uri": settings.google_redirect_url,
+        "response_type": "code",
+        "scope": "openid email profile",
+        "state": state,
+        "nonce": nonce,
+        "prompt": "select_account",
+    }
+    response = RedirectResponse(f"{GOOGLE_AUTH_URL}?{urlencode(params)}", status_code=302)
+    # Binds the state to this browser (login CSRF). Lax so it survives the top level return from Google.
+    response.set_cookie(
+        STATE_COOKIE,
+        nonce,
+        max_age=int(STATE_TTL.total_seconds()),
+        path="/api/auth/google",
+        httponly=True,
+        secure=settings.env != "development",
+        samesite="lax",
+    )
+    return response
+
+
+@router.get("/google/callback")
+def google_callback(
+    request: Request,
+    code: str | None = None,
+    state: str | None = None,
+    error: str | None = None,
+    db: Session = Depends(get_db),
+):
+    if error:
+        return _auth_error("Google sign in was cancelled." if error == "access_denied" else "Google sign in failed.")
+    if not code or not state:
+        return _auth_error("Google sign in failed. Try again.")
+    try:
+        saved = decode_token_full(state, expected_type="oauth_state")
+    except HTTPException:
+        return _auth_error("Google sign in expired. Try again.")
+    cookie = request.cookies.get(STATE_COOKIE)
+    if not cookie or not secrets.compare_digest(cookie, saved.get("nonce", "")):
+        return _auth_error("Google sign in expired. Try again.")
+    try:
+        info = exchange_google_code(code)
+    except (httpx.HTTPError, KeyError, ValueError):
+        return _auth_error("Google sign in failed. Try again.")
+    if info.get("nonce") != saved["nonce"]:
+        return _auth_error("Google sign in failed. Try again.")
+    if not info.get("email_verified"):
+        return _auth_error("Google email is not verified.")
+    try:
+        resolved = ident.resolve_or_create_google_user(
+            db, email=info["email"], google_id=info["sub"], name=info.get("name"), avatar_url=info.get("picture")
+        )
+    except ident.IdentityError as exc:
+        db.rollback()
+        return _auth_error(exc.message)
+    _record_login(db, resolved.user, resolved.created)
+    ticket = create_login_ticket(resolved.user.id, resolved.user.token_version, resolved.created)
+    # Fragment, not query: it never reaches servers or referrers, and the ticket dies in 60s.
+    return _frontend("/auth/callback", ticket=ticket, next=saved["next"])
+
+
+class TicketIn(BaseModel):
+    ticket: str
+
+
+@router.post("/ticket")
+def redeem_ticket(body: TicketIn, db: Session = Depends(get_db)):
+    user = load_user_from_token(db, body.ticket, expected_type="ticket")
+    created = bool(decode_token_full(body.ticket, expected_type="ticket").get("new"))
+    return _login_result(user, created)
+
+
 # Email signup (6 digit code)
 
 

backend/tests/test_auth.py

@@ -78,3 +78,66 @@ def test_delete_account(client):
     assert client.post("/api/auth/delete-account", headers=headers).status_code == 200
     r = client.post("/api/auth/email/login", json={"email": "writer@example.com", "password": "stardust-42"})
     assert r.status_code == 403
+
+
+def _google_redirect(client, monkeypatch, claims: dict, next_path="/app/notebooks"):
+    from urllib.parse import parse_qs, urlparse
+
+    from app.config import settings
+    from app.routers import auth as auth_router
+
+    monkeypatch.setattr(settings, "google_client_id", "cid")
+    monkeypatch.setattr(settings, "google_client_secret", "secret")
+    assert client.get("/api/auth/providers").json() == {"google": "redirect"}
+
+    r = client.get("/api/auth/google/start", params={"next": next_path}, follow_redirects=False)
+    assert r.status_code == 302
+    q = parse_qs(urlparse(r.headers["location"]).query)
+    assert q["redirect_uri"] == ["http://localhost:8000/api/auth/google/callback"]
+    monkeypatch.setattr(auth_router, "exchange_google_code", lambda code: {"nonce": q["nonce"][0], **claims})
+    r = client.get("/api/auth/google/callback", params={"code": "abc", "state": q["state"][0]},
+                   follow_redirects=False)
+    assert r.status_code == 302
+    location = urlparse(r.headers["location"])
+    return location, parse_qs(location.fragment)
+
+
+def test_google_redirect_flow(client, monkeypatch):
+    claims = {"email": "Star@Example.com", "email_verified": True, "sub": "g-1", "name": "Star"}
+    location, frag = _google_redirect(client, monkeypatch, claims)
+    assert location.path == "/auth/callback"
+    assert frag["next"] == ["/app/notebooks"]
+    r = client.post("/api/auth/ticket", json={"ticket": frag["ticket"][0]})
+    assert r.status_code == 200
+    data = r.json()
+    assert data["created"] is True and data["user"]["email"] == "star@example.com"
+    me = client.get("/api/auth/me", headers={"Authorization": f"Bearer {data['access_token']}"})
+    assert me.json()["auth_provider"] == "google"
+    # A ticket is not a session token.
+    assert client.get("/api/auth/me", headers={"Authorization": f"Bearer {frag['ticket'][0]}"}).status_code == 401
+
+
+def test_google_redirect_rejects_open_redirect_and_email_accounts(client, monkeypatch):
+    _signup(client, email="taken@example.com")
+    claims = {"email": "taken@example.com", "email_verified": True, "sub": "g-2"}
+    location, frag = _google_redirect(client, monkeypatch, claims, next_path="//evil.example")
+    assert location.path == "/auth"
+    assert "password" in frag["error"][0]
+
+
+def test_google_callback_requires_state_cookie(client, monkeypatch):
+    from datetime import timedelta
+
+    from app.auth import encode_signed
+
+    state = encode_signed({"typ": "oauth_state", "nonce": "n", "next": "/app"}, timedelta(minutes=5))
+    r = client.get("/api/auth/google/callback", params={"code": "abc", "state": state}, follow_redirects=False)
+    assert r.headers["location"].startswith("http://localhost:5173/auth#error=")
+
+
+def test_safe_next():
+    from app.routers.auth import _safe_next
+
+    assert _safe_next("/app/notebooks/1?x=1") == "/app/notebooks/1?x=1"
+    for bad in (None, "", "https://evil.example", "//evil.example", r"/\evil.example"):
+        assert _safe_next(bad) == "/app"

docker-compose.yml

@@ -30,6 +30,8 @@ services:
       R2_ENDPOINT_URL: ${R2_ENDPOINT_URL:-http://minio:9000}
       RENDERER_URL: http://renderer:3100
       API_URL: http://api:8000
+      # API_URL above is the in-network name; Google must redirect the browser to the published port.
+      GOOGLE_REDIRECT_URI: ${GOOGLE_REDIRECT_URI:-http://localhost:8000/api/auth/google/callback}
       CORPUS_CACHE_DIR: /cache/corpus
     volumes: [apicache:/cache]
     ports: ["8000:8000"]

frontend/src/App.tsx

@@ -3,6 +3,7 @@ import AppShell, { ComingSoon } from "./components/AppShell";
 import { PublicFooter, PublicNav } from "./components/PublicChrome";
 import PricingTiers from "./components/PricingTiers";
 import SkyCanvas from "./components/SkyCanvas";
+import AuthCallback from "./pages/AuthCallback";
 import AuthPage from "./pages/AuthPage";
 import { Blog, BlogPostPage } from "./pages/Blog";
 import Landing from "./pages/Landing";
@@ -32,6 +33,7 @@ export default function App() {
       <Route path="/blogs" element={<Blog />} />
       <Route path="/blogs/:slug" element={<BlogPostPage />} />
       <Route path="/auth" element={<AuthPage />} />
+      <Route path="/auth/callback" element={<AuthCallback />} />
       <Route path="/app" element={<AppShell />}>
         <Route index element={<MissionControl />} />
         <Route path="notebooks" element={<MissionControl />} />

frontend/src/api/auth.ts

@@ -1,4 +1,4 @@
-import { api, post } from "./client";
+import { api, BASE, post } from "./client";
 
 export type User = {
   id: string;
@@ -10,9 +10,21 @@ export type User = {
 
 export type LoginResult = { access_token: string; refresh_token: string; user: User; created: boolean };
 
+export type Providers = { google: "redirect" | "popup" | null };
+
+/** Only same site paths, mirroring the backend check, so `next` cannot become an open redirect. */
+export function safeNext(path: string | null | undefined): string {
+  if (!path || !path.startsWith("/") || path.startsWith("//") || path.includes("\\")) return "/app";
+  return path;
+}
+
 export const authApi = {
   me: () => api<User>("/api/auth/me"),
+  providers: () => api<Providers>("/api/auth/providers"),
   google: (credential: string) => post<LoginResult>("/api/auth/google", { credential }),
+  /** Full page navigation target for the redirect flow (server side code exchange). */
+  googleStartUrl: (next: string) => `${BASE}/api/auth/google/start?${new URLSearchParams({ next })}`,
+  redeemTicket: (ticket: string) => post<LoginResult>("/api/auth/ticket", { ticket }),
   registerStart: (email: string, password: string, name?: string) =>
     post<{ ok: true }>("/api/auth/email/register/start", { email, password, name }),
   registerVerify: (email: string, code: string) =>

frontend/src/api/client.ts

@@ -1,4 +1,4 @@
-const BASE = import.meta.env.VITE_API_URL ?? "";
+export const BASE = import.meta.env.VITE_API_URL ?? "";
 const ACCESS = "ns_access";
 const REFRESH = "ns_refresh";
 

frontend/src/components/AppShell.tsx

@@ -1,4 +1,4 @@
-import { NavLink, Outlet, Navigate } from "react-router-dom";
+import { NavLink, Outlet, Navigate, useLocation } from "react-router-dom";
 import { useAuth } from "../hooks/useAuth";
 import Logo from "./Logo";
 import SkyCanvas from "./SkyCanvas";
@@ -33,8 +33,12 @@ const NAV = [
 
 export default function AppShell() {
   const { user, loading, logout } = useAuth();
+  const location = useLocation();
   if (loading) return <div className="boot"><div className="orbit-loader"><span /></div></div>;
-  if (!user) return <Navigate to="/auth" replace />;
+  if (!user) {
+    const next = new URLSearchParams({ next: location.pathname + location.search });
+    return <Navigate to={`/auth?${next}`} replace />;
+  }
 
   return (
     <div className="shell">

frontend/src/pages/AuthCallback.tsx

@@ -0,0 +1,42 @@
+import { useEffect, useRef } from "react";
+import { useNavigate } from "react-router-dom";
+import { authApi, safeNext } from "../api/auth";
+import { useAuth } from "../hooks/useAuth";
+
+/** Landing spot for the Google redirect flow: swaps the one minute ticket in the URL fragment for a session. */
+export default function AuthCallback() {
+  const { complete } = useAuth();
+  const navigate = useNavigate();
+  const started = useRef(false);
+
+  useEffect(() => {
+    if (started.current) return; // StrictMode runs effects twice; redeem once
+    started.current = true;
+    const fragment = new URLSearchParams(window.location.hash.slice(1));
+    const ticket = fragment.get("ticket");
+    const next = safeNext(fragment.get("next"));
+    window.history.replaceState(null, "", window.location.pathname); // keep the ticket out of history
+    if (!ticket) {
+      navigate("/auth", { replace: true });
+      return;
+    }
+    authApi
+      .redeemTicket(ticket)
+      .then((result) => {
+        complete(result);
+        navigate(next, { replace: true });
+      })
+      .catch(() => {
+        const error = new URLSearchParams({ error: "Google sign in expired. Try again." });
+        navigate(`/auth#${error}`, { replace: true });
+      });
+  }, [complete, navigate]);
+
+  return (
+    <div className="boot">
+      <div className="orbit-loader">
+        <span />
+      </div>
+    </div>
+  );
+}

frontend/src/pages/AuthPage.tsx

@@ -1,6 +1,6 @@
 import { useEffect, useRef, useState, type FormEvent } from "react";
 import { Link, useNavigate, useSearchParams } from "react-router-dom";
-import { authApi, type LoginResult } from "../api/auth";
+import { authApi, safeNext, type LoginResult, type Providers } from "../api/auth";
 import { ApiError } from "../api/client";
 import Logo from "../components/Logo";
 import SkyCanvas from "../components/SkyCanvas";
@@ -25,6 +25,20 @@ const GOOGLE_CLIENT_ID = (import.meta.env.VITE_GOOGLE_CLIENT_ID || import.meta.e
   | string
   | undefined;
 
+function GoogleRedirectButton({ next }: { next: string }) {
+  return (
+    <a className="btn google-redirect-btn" href={authApi.googleStartUrl(next)}>
+      <svg width="18" height="18" viewBox="0 0 48 48" aria-hidden="true">
+        <path fill="#FFC107" d="M43.6 20.5H42V20H24v8h11.3C33.7 32.7 29.2 36 24 36c-6.6 0-12-5.4-12-12s5.4-12 12-12c3.1 0 5.8 1.2 7.9 3.1l5.7-5.7C34 6.1 29.3 4 24 4 12.9 4 4 12.9 4 24s8.9 20 20 20 20-8.9 20-20c0-1.3-.1-2.4-.4-3.5z" />
+        <path fill="#FF3D00" d="M6.3 14.7l6.6 4.8C14.7 15.1 19 12 24 12c3.1 0 5.8 1.2 7.9 3.1l5.7-5.7C34 6.1 29.3 4 24 4 16.3 4 9.7 8.3 6.3 14.7z" />
+        <path fill="#4CAF50" d="M24 44c5.2 0 9.9-2 13.4-5.2l-6.2-5.2C29.2 35.1 26.7 36 24 36c-5.2 0-9.6-3.3-11.3-8l-6.5 5C9.5 39.6 16.2 44 24 44z" />
+        <path fill="#1976D2" d="M43.6 20.5H42V20H24v8h11.3c-.8 2.2-2.2 4.2-4.1 5.6l6.2 5.2C37 39.2 44 34 44 24c0-1.3-.1-2.4-.4-3.5z" />
+      </svg>
+      Continue with Google
+    </a>
+  );
+}
+
 function GoogleButton({ onCredential }: { onCredential: (c: string) => void }) {
   const ref = useRef<HTMLDivElement>(null);
   useEffect(() => {
@@ -64,12 +78,29 @@ export default function AuthPage() {
   const [error, setError] = useState<string | null>(null);
   const [notice, setNotice] = useState<string | null>(null);
   const [busy, setBusy] = useState(false);
+  const [providers, setProviders] = useState<Providers | null>(null);
   const { complete, user } = useAuth();
   const navigate = useNavigate();
+  const next = safeNext(params.get("next"));
+
+  useEffect(() => {
+    if (user) navigate(next, { replace: true });
+  }, [user, navigate, next]);
+
+  useEffect(() => {
+    authApi
+      .providers()
+      .then(setProviders)
+      .catch(() => setProviders({ google: GOOGLE_CLIENT_ID ? "popup" : null }));
+  }, []);
 
+  // The Google redirect flow lands back here with #error=... when it fails.
   useEffect(() => {
-    if (user) navigate("/app", { replace: true });
-  }, [user, navigate]);
+    const failure = new URLSearchParams(window.location.hash.slice(1)).get("error");
+    if (!failure) return;
+    setError(failure);
+    window.history.replaceState(null, "", window.location.pathname + window.location.search);
+  }, []);
 
   const run = async (fn: () => Promise<LoginResult | void>) => {
     setBusy(true);
@@ -133,7 +164,12 @@ export default function AuthPage() {
 
           {(mode === "signin" || mode === "signup") && (
             <>
-              <GoogleButton onCredential={onGoogle} />
+              {providers?.google === "redirect" && <GoogleRedirectButton next={next} />}
+              {providers?.google === "popup" && <GoogleButton onCredential={onGoogle} />}
+              {providers && !providers.google && (
+                <p className="mono muted auth-hint">Set GOOGLE_CLIENT_ID in .env to enable Google sign in.</p>
+              )}
+              {!providers && <div className="google-btn" />}
               <div className="auth-divider mono">
                 <span>or with email</span>
               </div>

frontend/src/styles/app.css

@@ -726,6 +726,18 @@
   min-height: 44px;
 }
 
+.google-redirect-btn {
+  width: 100%;
+  min-height: 44px;
+  background: var(--white);
+  color: var(--black);
+  border-color: var(--white);
+}
+
+.google-redirect-btn:hover {
+  box-shadow: var(--glow-md);
+}
+
 .auth-hint {
   text-align: center;
 }

frontend/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/app.tsx","./src/main.tsx","./src/api/auth.ts","./src/api/client.ts","./src/api/stream.ts","./src/components/appshell.tsx","./src/components/logo.tsx","./src/components/pricingtiers.tsx","./src/components/publicchrome.tsx","./src/components/skycanvas.tsx","./src/components/icons/icons.tsx","./src/content/blogposts.ts","./src/content/seotypes.ts","./src/hooks/useauth.tsx","./src/pages/authpage.tsx","./src/pages/blog.tsx","./src/pages/landing.tsx","./src/pages/missioncontrol.tsx","./src/pages/notebookview.tsx"],"version":"5.6.3"}
+{"root":["./src/app.tsx","./src/main.tsx","./src/api/auth.ts","./src/api/client.ts","./src/api/stream.ts","./src/components/appshell.tsx","./src/components/logo.tsx","./src/components/pricingtiers.tsx","./src/components/publicchrome.tsx","./src/components/skycanvas.tsx","./src/components/icons/icons.tsx","./src/content/blogposts.ts","./src/content/seotypes.ts","./src/hooks/useauth.tsx","./src/pages/authcallback.tsx","./src/pages/authpage.tsx","./src/pages/blog.tsx","./src/pages/landing.tsx","./src/pages/missioncontrol.tsx","./src/pages/notebookview.tsx"],"version":"5.6.3"}