@agent-native/core 0.149.1 → 0.149.3

package/dist/server/agents-bundle.js

@@ -20,7 +20,8 @@
  *
  * Result is cached in module scope so it's only computed once per cold start.
  */
-export const DEFAULT_SKILL_SCOPE = "both";
+import { DEFAULT_SKILL_SCOPE, isRuntimeVisibleScope, normalizeSkillScope, } from "./agent-chat/skill-frontmatter.js";
+export { DEFAULT_SKILL_SCOPE, isRuntimeVisibleScope, normalizeSkillScope, };
 const DEFAULT_AGENT_INSTRUCTIONS_PATH = "AGENTS.md";
 export function resolveAgentInstructionPaths(instructions) {
     return {
@@ -29,26 +30,6 @@ export function resolveAgentInstructionPaths(instructions) {
     };
 }
 let cached = null;
-/**
- * Coerce a raw frontmatter `scope` value into a known `SkillScope`. Unknown,
- * empty, or malformed values fall back to the default (`both`) so a typo never
- * silently hides a skill from the runtime agent. Optionally warns once per
- * distinct bad value to aid debugging without spamming logs.
- */
-const warnedBadScopes = new Set();
-export function normalizeSkillScope(raw) {
-    if (!raw)
-        return DEFAULT_SKILL_SCOPE;
-    const value = raw.trim().toLowerCase();
-    if (value === "runtime" || value === "dev" || value === "both") {
-        return value;
-    }
-    if (value && !warnedBadScopes.has(value)) {
-        warnedBadScopes.add(value);
-        console.warn(`[agents-bundle] Unknown skill scope "${raw}" — treating as "${DEFAULT_SKILL_SCOPE}". Valid values: runtime, dev, both.`);
-    }
-    return DEFAULT_SKILL_SCOPE;
-}
 /**
  * Parse the YAML frontmatter at the top of a skill file.
  * Only pulls out `name`, `description`, and `scope` — deliberately simple, no
@@ -57,8 +38,11 @@ export function normalizeSkillScope(raw) {
  *   - Inline: `description: Some text`
  *   - Folded scalar: `description: >-\n  multi\n  line` → "multi line"
  *   - Literal scalar: `description: |\n  multi\n  line` → "multi\nline"
+ *
+ * `sourceLabel` only names the file in the invalid-scope log; pass it wherever
+ * a path is known so a typo is traceable to the SKILL.md that carries it.
  */
-export function parseSkillFrontmatter(content) {
+export function parseSkillFrontmatter(content, sourceLabel) {
     const match = content.match(/^---\r?\n([\s\S]+?)\r?\n---/);
     if (!match)
         return {};
@@ -106,7 +90,7 @@ export function parseSkillFrontmatter(content) {
         else if (key === "description" && value)
             result.description = value;
         else if (key === "scope" && value)
-            result.scope = normalizeSkillScope(value);
+            result.scope = normalizeSkillScope(value, sourceLabel ?? result.name);
     }
     return result;
 }
@@ -170,7 +154,7 @@ function readSkillsDir(skillsDir, rootForRelative, out, skipExistingNames) {
             if (!fs.existsSync(realSkillFile))
                 continue;
             const content = fs.readFileSync(realSkillFile, "utf-8");
-            const meta = parseSkillFrontmatter(content);
+            const meta = parseSkillFrontmatter(content, path.relative(rootForRelative, skillFile).replace(/\\/g, "/"));
             const name = meta.name ?? entry.name;
             if (skipExistingNames && out[name])
                 continue; // Template wins
@@ -375,17 +359,19 @@ export async function loadAgentsBundle() {
  */
 /**
  * Skills visible to the agent-native RUNTIME agent. Excludes `scope: dev`
- * skills (those are for the human's coding agent only). Skills with no scope,
- * `scope: runtime`, or `scope: both` are all included. Use this anywhere the
- * runtime agent's view of skills is built (prompt block + docs-search) so a
- * dev-scoped skill is invisible to the runtime agent everywhere.
+ * skills (those are for the human's coding agent only) and skills whose scope
+ * could not be read. Skills with no scope, `scope: runtime`, or `scope: both`
+ * are all included. Use this anywhere the runtime agent's view of skills is
+ * built (prompt block + docs-search) so a dev-scoped skill is invisible to the
+ * runtime agent everywhere.
  */
 export function getRuntimeSkills(bundle) {
-    return Object.values(bundle.skills).filter((skill) => skill.meta.scope !== "dev");
+    return Object.values(bundle.skills).filter((skill) => isRuntimeVisibleScope(skill.meta.scope));
 }
 /**
  * Skills visible to development/coding agents. Excludes `scope: runtime`
- * skills that are intended only for the deployed in-app agent.
+ * skills that are intended only for the deployed in-app agent. An `invalid`
+ * scope stays visible here on purpose — this is the audience that can fix it.
  */
 export function getDevelopmentSkills(bundle) {
     return Object.values(bundle.skills).filter((skill) => skill.meta.scope !== "runtime");
@@ -437,14 +423,12 @@ function generateSkillsPromptBlockForEntries(entries, mode) {
                 extras = ` (also contains: ${s.extraFiles.join(", ")})`;
             }
         }
-        const runtimeHint = mode === "runtime"
-            ? ` Read with \`docs-search --slug "${skillDocsSlug(s.meta.name)}"\` before starting a task it applies to.`
-            : "";
+        const runtimeHint = mode === "runtime" ? ` [${skillDocsSlug(s.meta.name)}]` : "";
         return `- \`${s.meta.name}\` at \`${s.dir}/\` — ${s.meta.description || "(no description)"}${extras}${runtimeHint}`;
     });
     const readHint = mode === "runtime"
-        ? `To read a skill in the in-app runtime agent:
-  \`docs-search --slug "skill-<skill-name>"\`
+        ? `To read a skill in the in-app runtime agent, before starting a task it applies to:
+  \`docs-search --slug "<slug>"\` — each skill's slug is the [bracketed] token ending its line
   \`docs-search --query "<topic>"\` to discover matching docs/skills`
         : `To read a skill in dev mode (when you have bash access):
   \`bash(command="cat <skill-dir>/SKILL.md")\`

package/dist/server/auth.js

@@ -63,7 +63,7 @@ import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
 import { readDesktopSso, writeDesktopSso, clearDesktopSso, } from "./desktop-sso.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
-import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
+import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthDesktopExchangePage, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
 // Pure env-read feature switch from a leaf module (no dependency back on
 // auth.ts), so the guard and the SSO route handler share one validator and
 // can never disagree about whether federated SSO is enabled.
@@ -1025,6 +1025,8 @@ function areGenericGoogleOAuthRoutesEnabled(app) {
 }
 const _desktopExchanges = new Map();
 const DESKTOP_EXCHANGE_ERROR_PREFIX = "__error__::";
+const DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX = "__magic-link-challenge__::";
+const DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX = "__magic-link-exchange__::";
 const DESKTOP_AUTH_TOKEN_BODY_ORIGINS = new Set([
     "tauri://localhost",
     "http://tauri.localhost",
@@ -1033,6 +1035,90 @@ const DESKTOP_AUTH_TOKEN_BODY_ORIGINS = new Set([
 ]);
 // 5-minute TTL for exchange entries (short — single-use tokens).
 const DESKTOP_EXCHANGE_TTL_MS = 5 * 60 * 1000;
+function normalizeDesktopFlowId(value) {
+    if (typeof value !== "string")
+        return null;
+    const flowId = value.trim();
+    return /^[A-Za-z0-9_-]{1,128}$/.test(flowId) ? flowId : null;
+}
+function normalizeDesktopFlowVerifier(value) {
+    if (typeof value !== "string")
+        return null;
+    const verifier = value.trim();
+    return /^[A-Za-z0-9_-]{32,128}$/.test(verifier) ? verifier : null;
+}
+function desktopFlowVerifierHash(verifier) {
+    return crypto.createHash("sha256").update(verifier).digest("base64url");
+}
+function matchesDesktopFlowVerifier(verifier, expectedHash) {
+    const actual = Buffer.from(desktopFlowVerifierHash(verifier));
+    const expected = Buffer.from(expectedHash);
+    return (actual.length === expected.length &&
+        crypto.timingSafeEqual(actual, expected));
+}
+function parseDesktopExchangeStoredEntry(packed) {
+    if (packed.startsWith(DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX)) {
+        const verifierHash = packed.slice(DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX.length);
+        return verifierHash ? { challenge: true, verifierHash } : null;
+    }
+    if (packed.startsWith(DESKTOP_EXCHANGE_ERROR_PREFIX)) {
+        const raw = packed.slice(DESKTOP_EXCHANGE_ERROR_PREFIX.length);
+        return {
+            error: JSON.parse(Buffer.from(raw, "base64url").toString()),
+        };
+    }
+    const isMagicLinkExchange = packed.startsWith(DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX);
+    const encoded = isMagicLinkExchange
+        ? packed.slice(DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX.length)
+        : packed;
+    const verifierSeparator = isMagicLinkExchange ? encoded.indexOf("::") : -1;
+    const verifierHash = verifierSeparator >= 0 ? encoded.slice(0, verifierSeparator) : undefined;
+    const tokenAndEmail = verifierSeparator >= 0 ? encoded.slice(verifierSeparator + 2) : encoded;
+    const sepIdx = tokenAndEmail.indexOf("::");
+    if (sepIdx === -1)
+        return null;
+    return {
+        token: tokenAndEmail.slice(0, sepIdx),
+        email: tokenAndEmail.slice(sepIdx + 2),
+        ...(verifierHash ? { verifierHash } : {}),
+    };
+}
+function isDesktopMagicLinkCallbackPath(value) {
+    try {
+        return new URL(value, "http://agent-native.invalid").pathname.endsWith("/_agent-native/auth/magic-link/desktop-callback");
+    }
+    catch {
+        // coercion-ok: malformed callback URLs are treated as non-desktop callbacks.
+        return false;
+    }
+}
+function withDesktopMagicLinkFlow(callbackURL, flow) {
+    const url = new URL(callbackURL, "http://agent-native.invalid");
+    url.searchParams.set("flow_id", flow.flowId);
+    url.searchParams.set("verifier", flow.verifier);
+    return `${url.pathname}${url.search}${url.hash}`;
+}
+async function persistDesktopMagicLinkChallenge(flowId, verifierHash) {
+    await addSession(`dex:${flowId}`, `${DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX}${verifierHash}`);
+}
+async function issueDesktopMagicLinkFlow() {
+    const flowId = crypto.randomBytes(32).toString("base64url");
+    const verifier = crypto.randomBytes(32).toString("base64url");
+    const verifierHash = desktopFlowVerifierHash(verifier);
+    _desktopExchanges.set(flowId, {
+        challenge: true,
+        verifierHash,
+        expiresAt: Date.now() + DESKTOP_EXCHANGE_TTL_MS,
+    });
+    try {
+        await persistDesktopMagicLinkChallenge(flowId, verifierHash);
+    }
+    catch (error) {
+        _desktopExchanges.delete(flowId);
+        throw error;
+    }
+    return { flowId, verifier };
+}
 export function setDesktopExchange(flowId, token, email) {
     _desktopExchanges.set(flowId, {
         token,
@@ -1059,9 +1145,12 @@ export function setDesktopExchangeError(flowId, error) {
  * Non-fatal — if the DB isn't ready yet the in-memory Map still works for
  * same-instance requests.
  */
-async function persistDesktopExchangeToDB(flowId, token, email) {
+async function persistDesktopExchangeToDB(flowId, token, email, verifierHash) {
     try {
-        await addSession(`dex:${flowId}`, `${token}::${email}`);
+        const packed = verifierHash
+            ? `${DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX}${verifierHash}::${token}::${email}`
+            : `${token}::${email}`;
+        await addSession(`dex:${flowId}`, packed);
     }
     catch {
         // non-fatal — in-memory Map is the primary path
@@ -1090,8 +1179,12 @@ async function consumeDesktopExchangeFromDB(flowId) {
         // redeemed with the session table's default 30-day TTL.
         const client = getDbExec();
         const { rows } = await client.execute({
-            sql: `DELETE FROM sessions WHERE token = ? AND created_at > ? RETURNING email`,
-            args: [`dex:${flowId}`, Date.now() - DESKTOP_EXCHANGE_TTL_MS],
+            sql: `DELETE FROM sessions WHERE token = ? AND created_at > ? AND email NOT LIKE ? RETURNING email`,
+            args: [
+                `dex:${flowId}`,
+                Date.now() - DESKTOP_EXCHANGE_TTL_MS,
+                `${DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX}%`,
+            ],
         });
         forgetCachedSessionEmail(`dex:${flowId}`);
         if (rows.length === 0)
@@ -1099,21 +1192,72 @@ async function consumeDesktopExchangeFromDB(flowId) {
         const packed = (rows[0].email ?? rows[0][0]);
         if (!packed)
             return null;
-        if (packed.startsWith(DESKTOP_EXCHANGE_ERROR_PREFIX)) {
-            const raw = packed.slice(DESKTOP_EXCHANGE_ERROR_PREFIX.length);
-            return {
-                error: JSON.parse(Buffer.from(raw, "base64url").toString()),
-            };
-        }
-        const sepIdx = packed.indexOf("::");
-        if (sepIdx === -1)
+        return parseDesktopExchangeStoredEntry(packed);
+    }
+    catch {
+        // coercion-ok: a DB fallback outage leaves the exchange pending so polling can retry without consuming a token.
+        return null;
+    }
+}
+async function readDesktopMagicLinkChallengeFromDB(flowId) {
+    try {
+        const client = getDbExec();
+        const { rows } = await client.execute({
+            sql: `SELECT email FROM sessions WHERE token = ? AND created_at > ? LIMIT 1`,
+            args: [`dex:${flowId}`, Date.now() - DESKTOP_EXCHANGE_TTL_MS],
+        });
+        if (rows.length === 0)
+            return null;
+        const packed = (rows[0].email ?? rows[0][0]);
+        if (!packed)
             return null;
-        return { token: packed.slice(0, sepIdx), email: packed.slice(sepIdx + 2) };
+        const entry = parseDesktopExchangeStoredEntry(packed);
+        return entry && "challenge" in entry
+            ? { verifierHash: entry.verifierHash }
+            : null;
     }
     catch {
         return null;
     }
 }
+async function claimDesktopMagicLinkFlow(flowId, verifier, token, email) {
+    const verifierHash = desktopFlowVerifierHash(verifier);
+    const entry = _desktopExchanges.get(flowId);
+    if (entry) {
+        if (!("challenge" in entry) ||
+            entry.expiresAt < Date.now() ||
+            !matchesDesktopFlowVerifier(verifier, entry.verifierHash)) {
+            return false;
+        }
+        _desktopExchanges.set(flowId, {
+            token,
+            email,
+            verifierHash,
+            expiresAt: Date.now() + DESKTOP_EXCHANGE_TTL_MS,
+        });
+        await persistDesktopExchangeToDB(flowId, token, email, verifierHash);
+        return true;
+    }
+    try {
+        const client = getDbExec();
+        const packed = `${DESKTOP_MAGIC_LINK_EXCHANGE_PREFIX}${verifierHash}::${token}::${email}`;
+        const { rows } = await client.execute({
+            sql: `UPDATE sessions SET email = ?, created_at = ? WHERE token = ? AND created_at > ? AND email = ? RETURNING email`,
+            args: [
+                packed,
+                Date.now(),
+                `dex:${flowId}`,
+                Date.now() - DESKTOP_EXCHANGE_TTL_MS,
+                `${DESKTOP_MAGIC_LINK_CHALLENGE_PREFIX}${verifierHash}`,
+            ],
+        });
+        return rows.length > 0;
+    }
+    catch {
+        // coercion-ok: a failed DB claim must not issue a native session token.
+        return false;
+    }
+}
 setInterval(() => {
     const now = Date.now();
     for (const [k, v] of _desktopExchanges) {
@@ -2640,15 +2784,7 @@ async function mountBetterAuthRoutes(app, options) {
                     emailDomain: email.split("@")[1] || "",
                 });
                 if (flowId && sessionToken) {
-                    _desktopExchanges.set(flowId, {
-                        token: sessionToken,
-                        email,
-                        expiresAt: Date.now() + DESKTOP_EXCHANGE_TTL_MS,
-                    });
-                    // Also persist to DB for cross-instance durability (Cloudflare
-                    // Workers, multi-region). Fire-and-forget — in-memory Map is
-                    // still the primary fast path for same-instance requests.
-                    void persistDesktopExchangeToDB(flowId, sessionToken, email);
+                    setDesktopExchange(flowId, sessionToken, email);
                     logGoogleOAuthDebug(event, "callback-exchange-stored", {
                         flowId,
                         desktop,
@@ -2687,13 +2823,23 @@ async function mountBetterAuthRoutes(app, options) {
             return { error: "Method not allowed" };
         }
         const query = getQuery(event);
-        const flowId = query.flow_id;
+        const flowId = normalizeDesktopFlowId(query.flow_id);
         if (!flowId) {
             setResponseStatus(event, 400);
             return { error: "Missing flow_id" };
         }
+        const verifier = normalizeDesktopFlowVerifier(getQuery(event).verifier);
         let entry = _desktopExchanges.get(flowId);
         if (!entry || entry.expiresAt < Date.now()) {
+            const challenge = await readDesktopMagicLinkChallengeFromDB(flowId);
+            if (challenge) {
+                if (!verifier ||
+                    !matchesDesktopFlowVerifier(verifier, challenge.verifierHash)) {
+                    setResponseStatus(event, 403);
+                    return { error: "Invalid desktop exchange verifier." };
+                }
+                return { pending: true, flow: oauthDebugFlowId(flowId) };
+            }
             // In-memory miss — fall back to the DB-persisted entry. This handles
             // cross-instance routing (Cloudflare Workers, multi-region) where the
             // OAuth callback and the polling request may hit different isolates.
@@ -2709,11 +2855,35 @@ async function mountBetterAuthRoutes(app, options) {
             entry =
                 "error" in fromDb
                     ? { error: fromDb.error, expiresAt: Date.now() + 1 }
-                    : {
-                        token: fromDb.token,
-                        email: fromDb.email,
-                        expiresAt: Date.now() + 1,
-                    };
+                    : "challenge" in fromDb
+                        ? {
+                            challenge: true,
+                            verifierHash: fromDb.verifierHash,
+                            expiresAt: Date.now() + 1,
+                        }
+                        : {
+                            token: fromDb.token,
+                            email: fromDb.email,
+                            ...(fromDb.verifierHash
+                                ? { verifierHash: fromDb.verifierHash }
+                                : {}),
+                            expiresAt: Date.now() + 1,
+                        };
+        }
+        if ("challenge" in entry) {
+            if (!verifier ||
+                !matchesDesktopFlowVerifier(verifier, entry.verifierHash)) {
+                setResponseStatus(event, 403);
+                return { error: "Invalid desktop exchange verifier." };
+            }
+            return { pending: true, flow: oauthDebugFlowId(flowId) };
+        }
+        if ("token" in entry && entry.verifierHash) {
+            if (!verifier ||
+                !matchesDesktopFlowVerifier(verifier, entry.verifierHash)) {
+                setResponseStatus(event, 403);
+                return { error: "Invalid desktop exchange verifier." };
+            }
         }
         _desktopExchanges.delete(flowId);
         // Also wipe the DB-persisted entry so it cannot be replayed via the
@@ -2735,6 +2905,13 @@ async function mountBetterAuthRoutes(app, options) {
         // still make a follow-up /auth/session?_session=... request, but the
         // OAuth handoff should not depend on that second request succeeding.
         setFrameworkSessionCookie(event, entry.token);
+        if (isElectronRequest(event)) {
+            await writeDesktopSso({
+                email: entry.email,
+                token: entry.token,
+                expiresAt: Date.now() + sessionMaxAge * 1000,
+            });
+        }
         setResponseHeader(event, "Referrer-Policy", "no-referrer");
         logGoogleOAuthDebug(event, "exchange-success", {
             flowId,
@@ -2742,6 +2919,52 @@ async function mountBetterAuthRoutes(app, options) {
         });
         return { token: entry.token, email: entry.email };
     }));
+    // Magic-link verification happens in the system browser, so native shells
+    // need the verified browser session copied into the same one-time exchange
+    // used by Google OAuth before they can establish their own WebView session.
+    app.use("/_agent-native/auth/magic-link/desktop-callback", defineEventHandler(async (event) => {
+        if (!isReadMethod(event)) {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const flowId = normalizeDesktopFlowId(getQuery(event).flow_id);
+        const verifier = normalizeDesktopFlowVerifier(getQuery(event).verifier);
+        if (!flowId) {
+            setResponseStatus(event, 400);
+            return { error: "Missing flow_id" };
+        }
+        if (!verifier) {
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        const session = await getSession(event);
+        if (!session?.email || !session.token) {
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: "callback_error",
+            });
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        try {
+            // Better Auth owns the browser cookie, while native clients resolve
+            // the exchanged token through the framework session table.
+            await addSession(session.token, session.email);
+        }
+        catch (error) {
+            captureAuthError(error, {
+                route: "magic-link",
+                email: session.email,
+            });
+            setDesktopExchangeError(flowId, {
+                message: AUTH_MAGIC_LINK_FALLBACK,
+                code: "callback_error",
+            });
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        if (!(await claimDesktopMagicLinkFlow(flowId, verifier, session.token, session.email))) {
+            return oauthErrorPage(AUTH_MAGIC_LINK_FALLBACK);
+        }
+        return oauthDesktopExchangePage("Sign-in complete. You can return to the app.");
+    }));
     // Initialize Better Auth. Forward `googleScopes` into the BetterAuthConfig
     // so the social provider requests the broader product scopes (Gmail,
     // Calendar, etc.) up front during the primary sign-in — eliminating the
@@ -3050,9 +3273,10 @@ async function mountBetterAuthRoutes(app, options) {
         const body = await readBody(event);
         const rawEmail = typeof body?.email === "string" ? body.email : "";
         const email = normalizeAuthEmail(rawEmail);
-        const callbackURL = typeof body?.callbackURL === "string"
+        let callbackURL = typeof body?.callbackURL === "string"
             ? safeReturnPath(body.callbackURL)
             : "/";
+        let desktopFlow;
         if (!email) {
             setResponseStatus(event, 400);
             return { error: VALID_AUTH_EMAIL_MESSAGE };
@@ -3062,6 +3286,10 @@ async function mountBetterAuthRoutes(app, options) {
             return { error: GOOGLE_AUTH_REQUIRED_MESSAGE };
         }
         try {
+            if (isDesktopMagicLinkCallbackPath(callbackURL)) {
+                desktopFlow = await issueDesktopMagicLinkFlow();
+                callbackURL = withDesktopMagicLinkFlow(callbackURL, desktopFlow);
+            }
             await auth.api.signInMagicLink({
                 body: {
                     email,
@@ -3070,7 +3298,10 @@ async function mountBetterAuthRoutes(app, options) {
                 },
                 headers: event.headers,
             });
-            return { ok: true };
+            return {
+                ok: true,
+                ...(desktopFlow ?? {}),
+            };
         }
         catch (e) {
             if (!isExpectedAuthFailure(e)) {

package/dist/server/better-auth-instance.d.ts

@@ -253,3 +253,4 @@ export declare function resetBetterAuth(): Promise<void>;
 export declare function configureLocalSqlite(sqlite: {
     pragma(statement: string): unknown;
 }): void;
+export declare function buildDatabaseConfig(dialect: string): Promise<BetterAuthOptions["database"]>;

package/dist/server/better-auth-instance.js

@@ -16,7 +16,7 @@ import { pgTable, text as pgText, timestamp as pgTimestamp, boolean as pgBoolean
 import { sqliteTable, text as sqliteText, integer as sqliteInteger, } from "drizzle-orm/sqlite-core";
 import { TEMPLATES } from "../cli/templates-meta.js";
 import { getDbExec, isPostgres } from "../db/client.js";
-import { getDialect, getDatabaseUrl, getDatabaseAuthToken, closePgliteClients, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgPoolOptions, neonPoolOptions, guardNeonPool, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, } from "../db/client.js";
+import { getDialect, getCloudflareD1Binding, getDatabaseUrl, getDatabaseAuthToken, closePgliteClients, getPgliteClient, isPgliteUrl, loadPgliteDrizzle, pgPoolOptions, neonPoolOptions, guardNeonPool, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, } from "../db/client.js";
 import { CORE_RESET_PASSWORD_EMAIL_ID, CORE_VERIFY_SIGNUP_EMAIL_ID, } from "../email-catalog/system-emails.js";
 import { saveOAuthTokens } from "../oauth-tokens/store.js";
 import { acceptPendingInvitationsForEmail } from "../org/accept-pending.js";
@@ -1126,7 +1126,7 @@ export function configureLocalSqlite(sqlite) {
     sqlite.pragma("busy_timeout = 10000");
     sqlite.pragma("journal_mode = WAL");
 }
-async function buildDatabaseConfig(dialect) {
+export async function buildDatabaseConfig(dialect) {
     if (dialect === "postgres") {
         const url = getDatabaseUrl();
         const { buildResilientNeonPool, buildResilientPostgresJsClient, isNeonUrl, } = await import("../db/create-get-db.js");
@@ -1180,6 +1180,21 @@ async function buildDatabaseConfig(dialect) {
             schema: pgAuthSchema,
         });
     }
+    if (dialect === "d1") {
+        const d1 = getCloudflareD1Binding();
+        if (!d1) {
+            throw new Error("Cloudflare D1 database binding is unavailable; configure the DB binding before initializing Better Auth.");
+        }
+        const { drizzle } = await import("drizzle-orm/d1");
+        const db = drizzle(d1, {
+            schema: sqliteAuthSchema,
+        });
+        const { drizzleAdapter } = await import("better-auth/adapters/drizzle");
+        return drizzleAdapter(db, {
+            provider: "sqlite",
+            schema: sqliteAuthSchema,
+        });
+    }
     // SQLite / libsql
     const url = getDatabaseUrl("file:./data/app.db");
     if (url.startsWith("file:") || !url.includes("://")) {