@agent-native/core 0.4.5 → 0.6.1

package/dist/server/agents-bundle.js

@@ -0,0 +1,231 @@
+/**
+ * Agents bundle — loads AGENTS.md and .agents/skills/ from the template.
+ *
+ * This is the single source of truth the framework's agent uses to mirror what
+ * Claude Code / Codex / any other agent would see when running locally in the
+ * repo. The filesystem is the canonical source; this module is just a loader
+ * that works both in dev (direct fs read) and production (content bundled at
+ * build time via the `virtual:agents-bundle` Vite plugin).
+ *
+ * Resolution order inside `loadAgentsBundle()`:
+ *   1. Virtual module (`virtual:agents-bundle`) — inlined at build time by the
+ *      framework's Vite plugin. This is the ONLY path that works on edge
+ *      runtimes (Cloudflare Workers) where `readFileSync` doesn't exist.
+ *   2. Filesystem fallback — `process.cwd()/AGENTS.md` +
+ *      `process.cwd()/.agents/skills/`. Only reliable in local dev and Node
+ *      production (`agent-native start`); not on Netlify/Vercel/CF at runtime.
+ *   3. Empty bundle — everything silently returns empty strings.
+ *
+ * Result is cached in module scope so it's only computed once per cold start.
+ */
+const EMPTY = { agentsMd: "", skills: {} };
+let cached = null;
+/**
+ * Parse the YAML frontmatter at the top of a skill file.
+ * Only pulls out `name` and `description` — deliberately simple, no YAML lib.
+ * Handles:
+ *   - Inline: `description: Some text`
+ *   - Folded scalar: `description: >-\n  multi\n  line` → "multi line"
+ *   - Literal scalar: `description: |\n  multi\n  line` → "multi\nline"
+ */
+export function parseSkillFrontmatter(content) {
+    const match = content.match(/^---\r?\n([\s\S]+?)\r?\n---/);
+    if (!match)
+        return {};
+    const lines = match[1].split(/\r?\n/);
+    const result = {};
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const keyMatch = line.match(/^([a-zA-Z_][a-zA-Z0-9_-]*):\s*(.*)$/);
+        if (!keyMatch)
+            continue;
+        const [, key, valueRaw] = keyMatch;
+        const trimmed = valueRaw.trim();
+        const isFolded = trimmed === ">" || trimmed === ">-";
+        const isLiteral = trimmed === "|" || trimmed === "|-";
+        let value;
+        if (isFolded || isLiteral) {
+            // Collect subsequent indented lines (at least one leading space).
+            const block = [];
+            let j = i + 1;
+            while (j < lines.length) {
+                const next = lines[j];
+                if (next.length === 0) {
+                    block.push("");
+                    j++;
+                    continue;
+                }
+                if (!/^\s/.test(next))
+                    break;
+                block.push(next.replace(/^\s+/, ""));
+                j++;
+            }
+            // Trim trailing blank lines
+            while (block.length > 0 && block[block.length - 1] === "")
+                block.pop();
+            value = isFolded
+                ? block.filter((l) => l !== "").join(" ")
+                : block.join("\n");
+            i = j - 1;
+        }
+        else {
+            value = trimmed;
+        }
+        if (key === "name" && value)
+            result.name = value;
+        else if (key === "description" && value)
+            result.description = value;
+    }
+    return result;
+}
+import fs from "node:fs";
+import path from "node:path";
+/**
+ * Read AGENTS.md + all skills directly from the filesystem rooted at `cwd`.
+ * Returns an empty bundle if nothing is found. Used by both the Vite plugin
+ * (at build time) and the runtime fallback (in dev / Node prod).
+ *
+ * Synchronous — the Vite plugin's load hook calls it inline during the build.
+ */
+export function readAgentsBundleFromFs(cwd) {
+    let agentsMd = "";
+    try {
+        const agentsMdPath = path.join(cwd, "AGENTS.md");
+        if (fs.existsSync(agentsMdPath)) {
+            agentsMd = fs.readFileSync(agentsMdPath, "utf-8");
+        }
+    }
+    catch { }
+    const skills = {};
+    try {
+        const skillsDir = path.join(cwd, ".agents", "skills");
+        if (fs.existsSync(skillsDir)) {
+            const entries = fs.readdirSync(skillsDir, { withFileTypes: true });
+            for (const entry of entries) {
+                if (!entry.isDirectory() && !entry.isSymbolicLink())
+                    continue;
+                const skillDirAbs = path.join(skillsDir, entry.name);
+                const skillFile = path.join(skillDirAbs, "SKILL.md");
+                try {
+                    // Follow symlinks to a real file — avoids double-counting if a skill
+                    // is symlinked from another location.
+                    const realSkillFile = fs.realpathSync(skillFile);
+                    if (!fs.existsSync(realSkillFile))
+                        continue;
+                    const content = fs.readFileSync(realSkillFile, "utf-8");
+                    const meta = parseSkillFrontmatter(content);
+                    const name = meta.name ?? entry.name;
+                    if (skills[name])
+                        continue; // First one wins
+                    // Walk the skill directory for supporting files (anything alongside
+                    // SKILL.md). Skills are folders — they may include extra markdown,
+                    // images, examples, etc. that the agent can read via shell in dev.
+                    const extraFiles = [];
+                    try {
+                        const walk = (subdir, prefix) => {
+                            for (const e of fs.readdirSync(subdir, { withFileTypes: true })) {
+                                const abs = path.join(subdir, e.name);
+                                const rel = prefix ? `${prefix}/${e.name}` : e.name;
+                                if (e.isDirectory() || e.isSymbolicLink()) {
+                                    try {
+                                        const stat = fs.statSync(abs);
+                                        if (stat.isDirectory())
+                                            walk(abs, rel);
+                                    }
+                                    catch { }
+                                }
+                                else if (e.isFile() && e.name !== "SKILL.md") {
+                                    extraFiles.push(rel);
+                                }
+                            }
+                        };
+                        walk(skillDirAbs, "");
+                    }
+                    catch { }
+                    extraFiles.sort();
+                    skills[name] = {
+                        meta: { name, description: meta.description ?? "" },
+                        content,
+                        dir: path.relative(cwd, skillDirAbs).replace(/\\/g, "/"),
+                        extraFiles,
+                    };
+                }
+                catch {
+                    // Skip unreadable skills
+                }
+            }
+        }
+    }
+    catch { }
+    return { agentsMd, skills };
+}
+/**
+ * Load the agents bundle. Returns a cached result on subsequent calls.
+ * Tries the virtual module first (works everywhere, including edge), then
+ * falls back to filesystem reads from `process.cwd()`.
+ */
+export async function loadAgentsBundle() {
+    if (cached)
+        return cached;
+    // 1. Try the Vite-emitted virtual module. This is the path that works on
+    //    every deployment target because the content is inlined at build time.
+    try {
+        // @ts-expect-error — virtual module is resolved at build time by our
+        // Vite plugin; nothing exists at this path on disk.
+        const mod = await import("virtual:agents-bundle");
+        if (mod && mod.default) {
+            cached = mod.default;
+            return cached;
+        }
+    }
+    catch {
+        // Virtual module not available — fall through to filesystem.
+    }
+    // 2. Filesystem fallback — only works in dev / Node prod.
+    try {
+        cached = readAgentsBundleFromFs(process.cwd());
+        return cached;
+    }
+    catch {
+        cached = EMPTY;
+        return cached;
+    }
+}
+/**
+ * Generate the `<skills>` block to inject into the system prompt.
+ *
+ * Skills are folders at `.agents/skills/<name>/` containing a `SKILL.md` entry
+ * file plus any number of supporting files (additional markdown, examples,
+ * images, scripts). This block lists what's available and how to read them.
+ *
+ * In dev mode the agent has shell access and reads skills via `cat` — exactly
+ * like running `claude` locally in the repo. In production mode the agent has
+ * no shell; templates that need skill content at runtime should inline the
+ * critical parts directly in `AGENTS.md`.
+ */
+export function generateSkillsPromptBlock(bundle) {
+    const entries = Object.values(bundle.skills);
+    if (entries.length === 0)
+        return "";
+    const lines = entries.map((s) => {
+        const extras = s.extraFiles.length > 0
+            ? ` (also contains: ${s.extraFiles.join(", ")})`
+            : "";
+        return `- \`${s.meta.name}\` at \`${s.dir}/\` — ${s.meta.description || "(no description)"}${extras}`;
+    });
+    return `<skills>
+The following skills live in the repo at \`.agents/skills/<name>/\`. Each skill is a folder containing a \`SKILL.md\` entry file and sometimes supporting files. Read a skill BEFORE starting a task it applies to.
+
+To read a skill in dev mode (when you have shell access):
+  \`shell(command="cat .agents/skills/<name>/SKILL.md")\`
+  \`shell(command="ls .agents/skills/<name>/")\` to see all files in the folder
+
+Available skills:
+${lines.join("\n")}
+</skills>`;
+}
+/** For tests — reset the module cache. */
+export function __resetAgentsBundleCache() {
+    cached = null;
+}
+//# sourceMappingURL=agents-bundle.js.map

package/dist/server/agents-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents-bundle.js","sourceRoot":"","sources":["../../src/server/agents-bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiCH,MAAM,KAAK,GAAiB,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEzD,IAAI,MAAM,GAAwB,IAAI,CAAC;AAEvC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACnE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC;QACnC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAEtD,IAAI,KAAa,CAAC;QAClB,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC1B,kEAAkE;YAClE,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACtB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACf,CAAC,EAAE,CAAC;oBACJ,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM;gBAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;gBACrC,CAAC,EAAE,CAAC;YACN,CAAC;YACD,4BAA4B;YAC5B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;gBAAE,KAAK,CAAC,GAAG,EAAE,CAAC;YACvE,KAAK,GAAG,QAAQ;gBACd,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QAED,IAAI,GAAG,KAAK,MAAM,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC;aAC5C,IAAI,GAAG,KAAK,aAAa,IAAI,KAAK;YAAE,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;IACtE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAChC,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;oBAAE,SAAS;gBAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;gBACrD,IAAI,CAAC;oBACH,qEAAqE;oBACrE,sCAAsC;oBACtC,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;oBACjD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;wBAAE,SAAS;oBAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;oBACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;oBAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;oBACrC,IAAI,MAAM,CAAC,IAAI,CAAC;wBAAE,SAAS,CAAC,iBAAiB;oBAE7C,oEAAoE;oBACpE,mEAAmE;oBACnE,mEAAmE;oBACnE,MAAM,UAAU,GAAa,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,MAAc,EAAE,EAAE;4BAC9C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gCAChE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gCACtC,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gCACpD,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;oCAC1C,IAAI,CAAC;wCACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;wCAC9B,IAAI,IAAI,CAAC,WAAW,EAAE;4CAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oCACzC,CAAC;oCAAC,MAAM,CAAC,CAAA,CAAC;gCACZ,CAAC;qCAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oCAC/C,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gCACvB,CAAC;4BACH,CAAC;wBACH,CAAC,CAAC;wBACF,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;oBACxB,CAAC;oBAAC,MAAM,CAAC,CAAA,CAAC;oBACV,UAAU,CAAC,IAAI,EAAE,CAAC;oBAElB,MAAM,CAAC,IAAI,CAAC,GAAG;wBACb,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE;wBACnD,OAAO;wBACP,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;wBACxD,UAAU;qBACX,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,yBAAyB;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,CAAC;QACH,qEAAqE;QACrE,oDAAoD;QACpD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAClD,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,OAAuB,CAAC;YACrC,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC;QACH,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,KAAK,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAoB;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,MAAM,GACV,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChD,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,GAAG,MAAM,EAAE,CAAC;IACxG,CAAC,CAAC,CAAC;IAEH,OAAO;;;;;;;;EAQP,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;UACR,CAAC;AACX,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,wBAAwB;IACtC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}

package/dist/server/auth-plugin.d.ts

@@ -1,6 +1,11 @@
 import type { AuthOptions } from "./auth.js";
 type NitroPluginDef = (nitroApp: any) => void | Promise<void>;
 export declare function createAuthPlugin(options?: AuthOptions): NitroPluginDef;
+/**
+ * Default auth plugin — email/password auth with optional Google OAuth.
+ * Google sign-in button appears automatically on the login page when
+ * GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET env vars are set.
+ */
 export declare const defaultAuthPlugin: NitroPluginDef;
 export {};
 //# sourceMappingURL=auth-plugin.d.ts.map

package/dist/server/auth-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-plugin.d.ts","sourceRoot":"","sources":["../../src/server/auth-plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAItE;AAED,eAAO,MAAM,iBAAiB,EAAE,cAAmC,CAAC"}
+{"version":3,"file":"auth-plugin.d.ts","sourceRoot":"","sources":["../../src/server/auth-plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9D,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc,CAMtE;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,cAE/B,CAAC"}

package/dist/server/auth-plugin.js

@@ -1,8 +1,18 @@
+import { getH3App, awaitBootstrap } from "./framework-request-handler.js";
 import { autoMountAuth } from "./auth.js";
 export function createAuthPlugin(options) {
-    return (nitroApp) => {
-        autoMountAuth(nitroApp.h3App, options);
+    return async (nitroApp) => {
+        // Wait for any other default plugins to finish mounting first.
+        await awaitBootstrap(nitroApp);
+        await autoMountAuth(getH3App(nitroApp), options);
     };
 }
-export const defaultAuthPlugin = createAuthPlugin();
+/**
+ * Default auth plugin — email/password auth with optional Google OAuth.
+ * Google sign-in button appears automatically on the login page when
+ * GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET env vars are set.
+ */
+export const defaultAuthPlugin = async (nitroApp) => {
+    return createAuthPlugin()(nitroApp);
+};
 //# sourceMappingURL=auth-plugin.js.map

package/dist/server/auth-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-plugin.js","sourceRoot":"","sources":["../../src/server/auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAK1C,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,OAAO,CAAC,QAAa,EAAE,EAAE;QACvB,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAmB,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"auth-plugin.js","sourceRoot":"","sources":["../../src/server/auth-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAK1C,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,OAAO,KAAK,EAAE,QAAa,EAAE,EAAE;QAC7B,+DAA+D;QAC/D,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAmB,KAAK,EAAE,QAAa,EAAE,EAAE;IACvE,OAAO,gBAAgB,EAAE,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC,CAAC"}

package/dist/server/auth.d.ts

@@ -1,15 +1,22 @@
-import type { App as H3App, H3Event } from "h3";
+import type { H3Event } from "h3";
+import type { H3AppShim } from "./framework-request-handler.js";
+type H3App = H3AppShim;
+import type { BetterAuthConfig } from "./better-auth-instance.js";
 export interface AuthSession {
     email: string;
     userId?: string;
     token?: string;
+    /** Active organization ID (from Better Auth organization plugin) */
+    orgId?: string;
+    /** User's role in the active organization (owner/admin/member) */
+    orgRole?: string;
 }
 export interface AuthOptions {
     /** Session max age in seconds. Default: 30 days */
     maxAge?: number;
     /**
      * Custom getSession implementation (for BYOA — Auth.js, Clerk, etc.).
-     * When provided, the built-in token auth is bypassed entirely.
+     * When provided, Better Auth is bypassed entirely.
      */
     getSession?: (event: H3Event) => Promise<AuthSession | null>;
     /**
@@ -20,56 +27,72 @@ export interface AuthOptions {
     publicPaths?: string[];
     /**
      * Custom login page HTML. When provided, this HTML is served to
-     * unauthenticated page requests instead of the built-in token login form.
+     * unauthenticated page requests instead of the built-in login form.
      * Use this for custom login flows (e.g., "Sign in with Google" button).
      */
     loginHtml?: string;
+    /**
+     * Hide email/password forms on the built-in login page and show only the
+     * Google sign-in button. Use this for templates (mail, calendar) where
+     * Google connection is required anyway. Has no effect when `loginHtml`
+     * is provided.
+     */
+    googleOnly?: boolean;
+    /**
+     * Additional Better Auth configuration (social providers, plugins, etc.)
+     */
+    betterAuth?: BetterAuthConfig;
 }
 /**
- * Create a new session. Optionally associate it with an email address
- * (used by Google OAuth and other identity-aware auth providers).
+ * Create a new session in the legacy sessions table.
+ * Used by google-oauth.ts for mobile deep linking.
  */
 export declare function addSession(token: string, email?: string): Promise<void>;
-/** Remove a session by token. */
+/** Remove a session from the legacy sessions table. */
 export declare function removeSession(token: string): Promise<void>;
 /**
- * Look up the email associated with a session token.
+ * Look up the email associated with a legacy session token.
  * Returns null if the session doesn't exist, is expired, or has no email.
  */
 export declare function getSessionEmail(token: string): Promise<string | null>;
 /**
- * Get the current auth session for a request.
+ * Run the auth guard on an event. Returns a Response/object to block the
+ * request (login page or 401), or undefined to allow it through.
  *
- * - In dev mode: always returns { email: "local@localhost" }
- * - In production with built-in auth: returns session if cookie is valid
- * - With custom auth (BYOA): delegates to the custom getSession
+ * Called by the default server middleware (server/middleware/auth.ts) to
+ * enforce auth on page routes and API routes — not just framework routes.
  */
-export declare function getSession(event: H3Event): Promise<AuthSession | null>;
+export declare function runAuthGuard(event: H3Event): Promise<Response | object | string | void>;
 /**
- * Mount auth middleware + login/logout/session routes onto an H3 app.
+ * Get the current auth session for a request.
  *
- * @deprecated Use `autoMountAuth(app, options?)` instead for automatic
- * dev/prod behavior. This function is kept for backwards compatibility
- * when you need explicit control over the access token.
+ * Resolution chain:
+ * 1. AUTH_MODE=local → local@localhost (explicit escape hatch)
+ * 2. AUTH_DISABLED=true → local@localhost (infrastructure auth)
+ * 3. ACCESS_TOKEN → check legacy cookie-based token sessions
+ * 4. BYOA custom getSession → delegate to template callback
+ * 5. Better Auth → check session via Better Auth API (cookie or Bearer)
+ * 6. Legacy cookie → check an_session cookie in legacy sessions table
+ * 7. Mobile _session query param → promote to cookie
  */
-export declare function mountAuthMiddleware(app: H3App, accessToken: string): void;
+export declare function getSession(event: H3Event): Promise<AuthSession | null>;
 /**
- * Automatically configure auth based on the environment:
- *
- * - **Dev mode** (`NODE_ENV !== "production"`): Auth is skipped entirely.
- *   `getSession()` returns `{ email: "local@localhost" }` for all requests.
- *
- * - **Production with ACCESS_TOKEN/ACCESS_TOKENS set**: Auth middleware is
- *   mounted. Unauthenticated requests see a login page. One env var is all
- *   you need.
- *
- * - **Production without tokens and AUTH_DISABLED !== "true"**: Refuses to
- *   start. Logs a clear error explaining what to do.
+ * Automatically configure auth based on environment and configuration:
  *
- * - **Production with AUTH_DISABLED=true**: Auth is skipped (for apps behind
- *   infrastructure-level auth like Cloudflare Access or a VPN).
+ * - **AUTH_MODE=local**: Auth bypassed. `getSession()` returns `{ email: "local@localhost" }`.
+ *   This is the explicit escape hatch for solo local development.
+ * - **BYOA (custom getSession)**: Template-provided auth callback handles everything.
+ * - **AUTH_DISABLED=true**: Auth bypassed (for infrastructure-level auth like Cloudflare Access).
+ * - **ACCESS_TOKEN/ACCESS_TOKENS**: Simple token-based auth.
+ * - **Default**: Better Auth with email/password, social providers, organizations, and JWT.
+ *   Users see an onboarding page to create an account on first visit.
  *
  * Returns true if auth was mounted, false if skipped.
  */
-export declare function autoMountAuth(app: H3App, options?: AuthOptions): boolean;
+export declare function autoMountAuth(app: H3App, options?: AuthOptions): Promise<boolean>;
+/**
+ * @deprecated Use `autoMountAuth(app, options?)` instead.
+ */
+export declare function mountAuthMiddleware(app: H3App, accessToken: string): void;
+export {};
 //# sourceMappingURL=auth.d.ts.map

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,GAAG,IAAI,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAOhD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAuFD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO7E;AAED,iCAAiC;AACjC,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiB3E;AA4DD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAW5E;AAkHD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzE;AA6GD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CA2K5E"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAOhE,KAAK,KAAK,GAAG,SAAS,CAAC;AAGvB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AASlE,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAmHD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS7E;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiB3E;AAgCD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAkFD;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAyF5E;AA6fD;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAuIlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAEzE"}