@agent-native/core 0.4.5 → 0.6.1

package/dist/server/auth.js

@@ -1,116 +1,156 @@
 import crypto from "node:crypto";
-import fs from "node:fs";
 import path from "node:path";
-import { defineEventHandler, readBody, getMethod, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, } from "h3";
-import { createClient } from "@libsql/client";
+// Lazy fs — loaded via dynamic import() on first use.
+// Avoids static require() which crashes on CF Workers.
+let _fs;
+async function getFs() {
+    if (!_fs) {
+        _fs = await import("node:fs");
+    }
+    return _fs;
+}
+import { defineEventHandler, getMethod, getQuery, setResponseHeader, setResponseStatus, getCookie, setCookie, deleteCookie, } from "h3";
+// In h3 v2, `event.req` IS the web Request — no conversion needed.
+function toWebRequest(event) {
+    return event.req;
+}
+import { getDbExec, isPostgres, intType } from "../db/client.js";
+import { getBetterAuth, getBetterAuthSync } from "./better-auth-instance.js";
+import { getOnboardingHtml } from "./onboarding-html.js";
+import { migrateLocalUserData } from "./local-migration.js";
+import { readBody } from "../server/h3-helpers.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
 const COOKIE_NAME = "an_session";
 const DEFAULT_MAX_AGE = 60 * 60 * 24 * 30; // 30 days
 // ---------------------------------------------------------------------------
-// Session store — SQL-backed
+// AUTH_MODE detection
 // ---------------------------------------------------------------------------
-let _sessionClient;
-let _sessionTableReady = false;
-let sessionMaxAge = DEFAULT_MAX_AGE;
-function getSessionClient() {
-    if (!_sessionClient) {
-        // Check for Cloudflare D1 binding
-        const d1 = globalThis.__cf_env?.DB;
-        if (d1) {
-            _sessionClient = {
-                async execute(sql) {
-                    if (typeof sql === "string") {
-                        const r = await d1.prepare(sql).all();
-                        return {
-                            rows: r.results || [],
-                            rowsAffected: r.meta?.changes ?? 0,
-                        };
-                    }
-                    const r = await d1
-                        .prepare(sql.sql)
-                        .bind(...sql.args)
-                        .all();
-                    return { rows: r.results || [], rowsAffected: r.meta?.changes ?? 0 };
-                },
-            };
-            return _sessionClient;
+/**
+ * Check if the app is in local-only mode (no auth).
+ *
+ * Returns true when:
+ * - AUTH_MODE=local is explicitly set (escape hatch)
+ * - In dev environment (NODE_ENV=development) with no explicit auth token
+ *   configured (no ACCESS_TOKEN, no BYOA). This makes dev "just work"
+ *   without requiring auth setup, while still respecting auth when configured.
+ *
+ * NOTE: GOOGLE_CLIENT_ID is intentionally NOT checked here — it is used for
+ * Google Calendar / Gmail API access as well as Google Sign-In, and its
+ * presence alone should not force authentication. Only ACCESS_TOKEN/ACCESS_TOKENS
+ * (explicit token-based auth) or a custom getSession (BYOA) signal that the
+ * developer has explicitly opted into requiring authentication.
+ *
+ * BYOA (customGetSession) opts out of dev auto-local — templates that provide
+ * their own auth (e.g. Supabase) shouldn't be silently bypassed in dev.
+ */
+function isLocalMode() {
+    if (process.env.AUTH_MODE === "local")
+        return true;
+    // Default to local mode in dev when no explicit auth is configured
+    if (isDevEnvironment() &&
+        !process.env.ACCESS_TOKEN &&
+        !process.env.ACCESS_TOKENS &&
+        !customGetSession) {
+        return true;
+    }
+    return false;
+}
+/**
+ * Check if we're in a development/test environment.
+ * Used for cookie security settings, not for auth bypass.
+ */
+function isDevEnvironment() {
+    const env = process.env.NODE_ENV;
+    return env === "development" || env === "test";
+}
+// ---------------------------------------------------------------------------
+// ACCESS_TOKEN resolution
+// ---------------------------------------------------------------------------
+function getAccessTokens() {
+    const single = process.env.ACCESS_TOKEN;
+    const multi = process.env.ACCESS_TOKENS;
+    const tokens = [];
+    if (single)
+        tokens.push(single);
+    if (multi) {
+        for (const t of multi.split(",")) {
+            const trimmed = t.trim();
+            if (trimmed && !tokens.includes(trimmed))
+                tokens.push(trimmed);
         }
-        // Fall back to libsql
-        const url = process.env.DATABASE_URL || "file:./data/app.db";
-        if (url.startsWith("file:")) {
-            try {
-                fs.mkdirSync(path.join(process.cwd(), "data"), { recursive: true });
-            }
-            catch {
-                // Edge runtime — no filesystem
-            }
+    }
+    return tokens;
+}
+function safeTokenMatch(input, tokens) {
+    const inputBuf = Buffer.from(input);
+    for (const token of tokens) {
+        const tokenBuf = Buffer.from(token);
+        if (inputBuf.length === tokenBuf.length &&
+            crypto.timingSafeEqual(inputBuf, tokenBuf)) {
+            return true;
         }
-        _sessionClient = createClient({
-            url,
-            authToken: process.env.DATABASE_AUTH_TOKEN,
-        });
     }
-    return _sessionClient;
+    return false;
 }
+// ---------------------------------------------------------------------------
+// Legacy session store — kept for backward compat (addSession/getSessionEmail)
+// Used by google-oauth.ts for mobile deep linking session creation.
+// ---------------------------------------------------------------------------
+let _sessionInitPromise;
+let sessionMaxAge = DEFAULT_MAX_AGE;
 async function ensureSessionTable() {
-    if (_sessionTableReady)
-        return;
-    const client = getSessionClient();
-    await client.execute(`
-    CREATE TABLE IF NOT EXISTS sessions (
-      token TEXT PRIMARY KEY,
-      email TEXT,
-      created_at INTEGER NOT NULL
-    )
-  `);
-    // Migration: add email column to existing tables that lack it
-    try {
-        await client.execute(`ALTER TABLE sessions ADD COLUMN email TEXT`);
-    }
-    catch {
-        // Column already exists — ignore
+    if (!_sessionInitPromise) {
+        _sessionInitPromise = (async () => {
+            const client = getDbExec();
+            await client.execute(`
+        CREATE TABLE IF NOT EXISTS sessions (
+          token TEXT PRIMARY KEY,
+          email TEXT,
+          created_at ${intType()} NOT NULL
+        )
+      `);
+            try {
+                await client.execute(`ALTER TABLE sessions ADD COLUMN email TEXT`);
+            }
+            catch {
+                // Column already exists
+            }
+        })();
     }
-    _sessionTableReady = true;
-}
-async function pruneExpiredSessions() {
-    await ensureSessionTable();
-    const client = getSessionClient();
-    const cutoff = Date.now() - sessionMaxAge * 1000;
-    await client.execute({
-        sql: `DELETE FROM sessions WHERE created_at < ?`,
-        args: [cutoff],
-    });
+    return _sessionInitPromise;
 }
 /**
- * Create a new session. Optionally associate it with an email address
- * (used by Google OAuth and other identity-aware auth providers).
+ * Create a new session in the legacy sessions table.
+ * Used by google-oauth.ts for mobile deep linking.
  */
 export async function addSession(token, email) {
     await ensureSessionTable();
-    const client = getSessionClient();
+    const client = getDbExec();
     await client.execute({
-        sql: `INSERT OR REPLACE INTO sessions (token, email, created_at) VALUES (?, ?, ?)`,
+        sql: isPostgres()
+            ? `INSERT INTO sessions (token, email, created_at) VALUES (?, ?, ?) ON CONFLICT (token) DO UPDATE SET email=EXCLUDED.email, created_at=EXCLUDED.created_at`
+            : `INSERT OR REPLACE INTO sessions (token, email, created_at) VALUES (?, ?, ?)`,
         args: [token, email ?? null, Date.now()],
     });
 }
-/** Remove a session by token. */
+/** Remove a session from the legacy sessions table. */
 export async function removeSession(token) {
     await ensureSessionTable();
-    const client = getSessionClient();
+    const client = getDbExec();
     await client.execute({
         sql: `DELETE FROM sessions WHERE token = ?`,
         args: [token],
     });
 }
 /**
- * Look up the email associated with a session token.
+ * Look up the email associated with a legacy session token.
  * Returns null if the session doesn't exist, is expired, or has no email.
  */
 export async function getSessionEmail(token) {
     await ensureSessionTable();
-    const client = getSessionClient();
+    const client = getDbExec();
     const { rows } = await client.execute({
         sql: `SELECT email, created_at FROM sessions WHERE token = ?`,
         args: [token],
@@ -127,96 +167,209 @@ export async function getSessionEmail(token) {
     }
     return rows[0].email ?? null;
 }
-async function hasSession(token) {
-    await ensureSessionTable();
-    const client = getSessionClient();
-    const { rows } = await client.execute({
-        sql: `SELECT created_at FROM sessions WHERE token = ?`,
-        args: [token],
-    });
-    if (rows.length === 0)
-        return false;
-    const createdAt = rows[0].created_at;
-    if (Date.now() - createdAt > sessionMaxAge * 1000) {
-        await client.execute({
-            sql: `DELETE FROM sessions WHERE token = ?`,
-            args: [token],
-        });
-        return false;
-    }
-    return true;
-}
 // ---------------------------------------------------------------------------
-// Token resolution — supports ACCESS_TOKEN (single) or ACCESS_TOKENS (multi)
+// getSession — the auth contract
 // ---------------------------------------------------------------------------
-function getAccessTokens() {
-    const single = process.env.ACCESS_TOKEN;
-    const multi = process.env.ACCESS_TOKENS;
-    const tokens = [];
-    if (single)
-        tokens.push(single);
-    if (multi) {
-        for (const t of multi.split(",")) {
-            const trimmed = t.trim();
-            if (trimmed && !tokens.includes(trimmed))
-                tokens.push(trimmed);
-        }
-    }
-    return tokens;
+let customGetSession = null;
+let authDisabledMode = false;
+let _authGuardConfig = null;
+/**
+ * Module-level auth guard function. Set by autoMountAuth() when auth is active.
+ * Called by the server middleware to enforce auth on ALL requests (not just
+ * /_agent-native/* routes).
+ */
+let _authGuardFn = null;
+/**
+ * Run the auth guard on an event. Returns a Response/object to block the
+ * request (login page or 401), or undefined to allow it through.
+ *
+ * Called by the default server middleware (server/middleware/auth.ts) to
+ * enforce auth on page routes and API routes — not just framework routes.
+ */
+export async function runAuthGuard(event) {
+    if (!_authGuardFn)
+        return; // Auth not mounted (local mode, etc.)
+    return _authGuardFn(event);
 }
+const LOCAL_SESSION = { email: "local@localhost" };
 // ---------------------------------------------------------------------------
-// Dev mode detection
+// Auth guard factory
 // ---------------------------------------------------------------------------
-function isDevMode() {
-    // On edge runtimes (e.g. CF Workers), NODE_ENV may not be set.
-    // Treat undefined as production — dev mode must be explicitly opted in.
-    const env = process.env.NODE_ENV;
-    return env === "development" || env === "test";
+/**
+ * Create an auth guard function that checks session and blocks
+ * unauthenticated requests. Returns the login HTML for page routes
+ * or a 401 JSON response for API routes.
+ *
+ * Reads loginHtml and publicPaths from _authGuardConfig on every request
+ * so that a custom plugin can update them after the default has already
+ * installed this middleware (the production race condition fix).
+ */
+function createAuthGuardFn() {
+    return async (event) => {
+        const config = _authGuardConfig;
+        if (!config)
+            return;
+        const { loginHtml, publicPaths } = config;
+        const url = event.node?.req?.url ?? event.path ?? "/";
+        const p = url.split("?")[0];
+        // Skip auth routes (all /_agent-native/auth/* and /_agent-native/google/*)
+        if (p.startsWith("/_agent-native/auth/") ||
+            p.startsWith("/_agent-native/google/")) {
+            return;
+        }
+        // Skip static assets (Vite chunks, fonts, images, etc.)
+        if (p.startsWith("/assets/") ||
+            p.startsWith("/_build/") ||
+            p.endsWith(".js") ||
+            p.endsWith(".css") ||
+            p.endsWith(".map") ||
+            p.endsWith(".ico") ||
+            p.endsWith(".png") ||
+            p.endsWith(".svg") ||
+            p.endsWith(".woff2") ||
+            p.endsWith(".woff")) {
+            return;
+        }
+        if (isPublicPath(url, publicPaths))
+            return;
+        const session = await getSession(event);
+        if (session)
+            return;
+        if (p.startsWith("/api/") || p.startsWith("/_agent-native/")) {
+            setResponseStatus(event, 401);
+            return { error: "Unauthorized" };
+        }
+        return new Response(loginHtml, {
+            status: 200,
+            headers: { "Content-Type": "text/html; charset=utf-8" },
+        });
+    };
+}
+/**
+ * Map a Better Auth session to our AuthSession type.
+ */
+function mapBetterAuthSession(baSession) {
+    return {
+        email: baSession.user.email,
+        userId: baSession.user.id,
+        token: baSession.session?.token,
+        orgId: baSession.session?.activeOrganizationId ?? undefined,
+    };
 }
-// ---------------------------------------------------------------------------
-// getSession — the auth contract
-// ---------------------------------------------------------------------------
-let customGetSession = null;
-let authDisabledMode = false;
-const DEV_SESSION = { email: "local@localhost" };
 /**
  * Get the current auth session for a request.
  *
- * - In dev mode: always returns { email: "local@localhost" }
- * - In production with built-in auth: returns session if cookie is valid
- * - With custom auth (BYOA): delegates to the custom getSession
+ * Resolution chain:
+ * 1. AUTH_MODE=local → local@localhost (explicit escape hatch)
+ * 2. AUTH_DISABLED=true → local@localhost (infrastructure auth)
+ * 3. ACCESS_TOKEN → check legacy cookie-based token sessions
+ * 4. BYOA custom getSession → delegate to template callback
+ * 5. Better Auth → check session via Better Auth API (cookie or Bearer)
+ * 6. Legacy cookie → check an_session cookie in legacy sessions table
+ * 7. Mobile _session query param → promote to cookie
  */
 export async function getSession(event) {
-    if (isDevMode())
-        return DEV_SESSION;
-    if (authDisabledMode)
-        return DEV_SESSION;
-    if (customGetSession)
-        return customGetSession(event);
-    const cookie = getCookie(event, COOKIE_NAME);
-    if (cookie && (await hasSession(cookie))) {
-        return { email: "user", token: cookie };
+    // 1. AUTH_MODE=local — explicit local-only mode
+    if (isLocalMode() || authDisabledMode) {
+        // Check for a real session cookie first (e.g. from Google OAuth)
+        try {
+            const cookie = getCookie(event, COOKIE_NAME);
+            if (cookie) {
+                const email = await getSessionEmail(cookie);
+                if (email)
+                    return { email, token: cookie };
+            }
+        }
+        catch {
+            // DB not ready yet
+        }
+        // Also try Better Auth session (for users who created an account then went local)
+        try {
+            const ba = getBetterAuthSync();
+            if (ba) {
+                const baSession = await ba.api.getSession({
+                    headers: event.headers,
+                });
+                if (baSession?.user?.email) {
+                    return mapBetterAuthSession(baSession);
+                }
+            }
+        }
+        catch {
+            // Better Auth not initialized yet
+        }
+        return LOCAL_SESSION;
+    }
+    // 2. ACCESS_TOKEN check (programmatic/agent access)
+    const accessTokens = getAccessTokens();
+    if (accessTokens.length > 0) {
+        const cookie = getCookie(event, COOKIE_NAME);
+        if (cookie) {
+            const email = await getSessionEmail(cookie);
+            if (email)
+                return { email, token: cookie };
+        }
+    }
+    // 3. BYOA custom getSession
+    if (customGetSession) {
+        const session = await customGetSession(event);
+        if (session)
+            return session;
+        // Fall through to mobile _session check
+    }
+    else {
+        // 4. Better Auth session (cookie or Bearer token)
+        try {
+            const ba = getBetterAuthSync();
+            if (ba) {
+                const baSession = await ba.api.getSession({
+                    headers: event.headers,
+                });
+                if (baSession?.user?.email) {
+                    return mapBetterAuthSession(baSession);
+                }
+            }
+        }
+        catch {
+            // Better Auth not ready
+        }
+        // 5. Legacy cookie fallback (for sessions created before migration)
+        const cookie = getCookie(event, COOKIE_NAME);
+        if (cookie) {
+            const email = await getSessionEmail(cookie);
+            if (email)
+                return { email, token: cookie };
+        }
+    }
+    // 6. Mobile WebView bridge — _session query param
+    const qToken = getQuery(event)?._session;
+    if (qToken) {
+        const email = await getSessionEmail(qToken);
+        if (email) {
+            setCookie(event, COOKIE_NAME, qToken, {
+                httpOnly: true,
+                secure: !isDevEnvironment(),
+                sameSite: "lax",
+                path: "/",
+                maxAge: sessionMaxAge,
+            });
+            setResponseHeader(event, "Referrer-Policy", "no-referrer");
+            return { email, token: qToken };
+        }
     }
     return null;
 }
 // ---------------------------------------------------------------------------
-// Constant-time token comparison
+// Public path matching
 // ---------------------------------------------------------------------------
-function safeTokenMatch(input, tokens) {
-    const inputBuf = Buffer.from(input);
-    for (const token of tokens) {
-        const tokenBuf = Buffer.from(token);
-        if (inputBuf.length === tokenBuf.length &&
-            crypto.timingSafeEqual(inputBuf, tokenBuf)) {
-            return true;
-        }
-    }
-    return false;
+function isPublicPath(url, publicPaths) {
+    const p = url.split("?")[0];
+    return publicPaths.some((pp) => p === pp || p.startsWith(pp + "/"));
 }
 // ---------------------------------------------------------------------------
-// Login page HTML
+// Login page HTML (ACCESS_TOKEN mode)
 // ---------------------------------------------------------------------------
-const LOGIN_HTML = `<!DOCTYPE html>
+const TOKEN_LOGIN_HTML = `<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="UTF-8">
@@ -252,7 +405,6 @@ const LOGIN_HTML = `<!DOCTYPE html>
     color: #e5e5e5;
     font-size: 0.9375rem;
     outline: none;
-    transition: border-color 0.15s;
   }
   input:focus { border-color: rgba(255,255,255,0.3); }
   button {
@@ -266,7 +418,6 @@ const LOGIN_HTML = `<!DOCTYPE html>
     font-size: 0.9375rem;
     font-weight: 500;
     cursor: pointer;
-    transition: opacity 0.15s;
   }
   button:hover { opacity: 0.85; }
   .error { margin-top: 0.75rem; font-size: 0.8125rem; color: #f87171; display: none; }
@@ -287,7 +438,7 @@ const LOGIN_HTML = `<!DOCTYPE html>
   document.getElementById('form').addEventListener('submit', async (e) => {
     e.preventDefault();
     const token = document.getElementById('token').value;
-    const res = await fetch('/api/auth/login', {
+    const res = await fetch('/_agent-native/auth/login', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ token }),
@@ -302,25 +453,259 @@ const LOGIN_HTML = `<!DOCTYPE html>
 </body>
 </html>`;
 // ---------------------------------------------------------------------------
-// mountAuthMiddleware — mounts login/logout/session routes + auth guard
+// setAuthModeLocal — write AUTH_MODE=local to .env for the escape hatch
 // ---------------------------------------------------------------------------
-/**
- * Mount auth middleware + login/logout/session routes onto an H3 app.
- *
- * @deprecated Use `autoMountAuth(app, options?)` instead for automatic
- * dev/prod behavior. This function is kept for backwards compatibility
- * when you need explicit control over the access token.
- */
-export function mountAuthMiddleware(app, accessToken) {
-    mountAuthRoutes(app, [accessToken]);
+async function setAuthModeLocal() {
+    try {
+        const fs = await getFs();
+        const envPath = path.resolve(process.cwd(), ".env");
+        let content = "";
+        try {
+            content = fs.readFileSync(envPath, "utf-8");
+        }
+        catch {
+            // .env doesn't exist yet
+        }
+        if (content.includes("AUTH_MODE=")) {
+            content = content.replace(/AUTH_MODE=.*/g, "AUTH_MODE=local");
+        }
+        else {
+            content = content.trimEnd() + "\nAUTH_MODE=local\n";
+        }
+        fs.writeFileSync(envPath, content, "utf-8");
+        process.env.AUTH_MODE = "local";
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
-function isPublicPath(url, publicPaths) {
-    const p = url.split("?")[0];
-    return publicPaths.some((pp) => p === pp || p.startsWith(pp + "/"));
+async function removeAuthModeLocal() {
+    try {
+        const fs = await getFs();
+        const envPath = path.resolve(process.cwd(), ".env");
+        let content = "";
+        try {
+            content = fs.readFileSync(envPath, "utf-8");
+        }
+        catch {
+            return true; // No .env file means nothing to remove
+        }
+        // Remove AUTH_MODE=local line entirely
+        content = content
+            .split("\n")
+            .filter((line) => !line.match(/^\s*AUTH_MODE\s*=/))
+            .join("\n");
+        fs.writeFileSync(envPath, content, "utf-8");
+        delete process.env.AUTH_MODE;
+        return true;
+    }
+    catch {
+        return false;
+    }
 }
-function mountAuthRoutes(app, accessTokens, publicPaths = []) {
-    // POST /api/auth/login
-    app.use("/api/auth/login", defineEventHandler(async (event) => {
+// ---------------------------------------------------------------------------
+// mountBetterAuthRoutes — Better Auth powered auth with backward-compat routes
+// ---------------------------------------------------------------------------
+async function mountBetterAuthRoutes(app, options) {
+    const publicPaths = [...(options.publicPaths ?? [])];
+    // The A2A agent card is part of an open protocol — other agents must be
+    // able to discover it without auth. Same for favicons and similar probes.
+    for (const pp of ["/.well-known", "/favicon.ico", "/favicon.png"]) {
+        if (!publicPaths.includes(pp))
+            publicPaths.push(pp);
+    }
+    // Auto-add Google OAuth routes when credentials are configured
+    if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
+        for (const gp of [
+            "/_agent-native/google/callback",
+            "/_agent-native/google/auth-url",
+        ]) {
+            if (!publicPaths.includes(gp))
+                publicPaths.push(gp);
+        }
+    }
+    const accessTokens = getAccessTokens();
+    // Initialize Better Auth
+    const auth = await getBetterAuth(options.betterAuth);
+    // Mount Better Auth catch-all handler at /_agent-native/auth/ba/*
+    app.use("/_agent-native/auth/ba", defineEventHandler(async (event) => {
+        const response = await auth.handler(toWebRequest(event));
+        return response;
+    }));
+    // POST /_agent-native/auth/local-mode — switch to local mode (onboarding escape hatch)
+    // Only available in dev — production requires real accounts for usage tracking.
+    app.use("/_agent-native/auth/local-mode", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        if (!isDevEnvironment()) {
+            setResponseStatus(event, 403);
+            return {
+                error: "Local mode is not available in production. Create an account to continue.",
+            };
+        }
+        const ok = await setAuthModeLocal();
+        if (!ok) {
+            setResponseStatus(event, 500);
+            return { error: "Failed to set AUTH_MODE=local in .env" };
+        }
+        return { ok: true };
+    }));
+    // POST /_agent-native/auth/exit-local-mode — switch back to real auth
+    app.use("/_agent-native/auth/exit-local-mode", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const ok = await removeAuthModeLocal();
+        if (!ok) {
+            setResponseStatus(event, 500);
+            return { error: "Failed to remove AUTH_MODE from .env" };
+        }
+        return { ok: true };
+    }));
+    // Backward-compat: POST /_agent-native/auth/login
+    app.use("/_agent-native/auth/login", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const body = await readBody(event);
+        // Legacy ACCESS_TOKEN login
+        if (body?.token &&
+            typeof body.token === "string" &&
+            accessTokens.length > 0) {
+            if (!safeTokenMatch(body.token, accessTokens)) {
+                setResponseStatus(event, 401);
+                return { error: "Invalid token" };
+            }
+            const sessionToken = crypto.randomBytes(32).toString("hex");
+            await addSession(sessionToken, "user");
+            setCookie(event, COOKIE_NAME, sessionToken, {
+                httpOnly: true,
+                secure: !isDevEnvironment(),
+                sameSite: "lax",
+                path: "/",
+                maxAge: sessionMaxAge,
+            });
+            return { ok: true };
+        }
+        // Email/password login via Better Auth
+        const email = body?.email?.trim?.()?.toLowerCase?.();
+        const password = body?.password;
+        if (!email || !password) {
+            setResponseStatus(event, 400);
+            return { error: "Email and password are required" };
+        }
+        try {
+            const result = await auth.api.signInEmail({
+                body: { email, password },
+            });
+            if (result?.token) {
+                setCookie(event, COOKIE_NAME, result.token, {
+                    httpOnly: true,
+                    secure: !isDevEnvironment(),
+                    sameSite: "lax",
+                    path: "/",
+                    maxAge: sessionMaxAge,
+                });
+                await addSession(result.token, email);
+            }
+            return { ok: true };
+        }
+        catch (e) {
+            setResponseStatus(event, 401);
+            return { error: e?.message || "Invalid email or password" };
+        }
+    }));
+    // Backward-compat: POST /_agent-native/auth/register
+    app.use("/_agent-native/auth/register", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const body = await readBody(event);
+        const email = body?.email?.trim?.()?.toLowerCase?.();
+        const password = body?.password;
+        if (!email || typeof email !== "string" || !email.includes("@")) {
+            setResponseStatus(event, 400);
+            return { error: "Valid email is required" };
+        }
+        if (!password || typeof password !== "string" || password.length < 8) {
+            setResponseStatus(event, 400);
+            return { error: "Password must be at least 8 characters" };
+        }
+        try {
+            await auth.api.signUpEmail({
+                body: { email, password, name: email.split("@")[0] },
+            });
+            return { ok: true };
+        }
+        catch (e) {
+            setResponseStatus(event, 409);
+            return { error: e?.message || "Registration failed" };
+        }
+    }));
+    // Backward-compat: POST /_agent-native/auth/logout
+    app.use("/_agent-native/auth/logout", defineEventHandler(async (event) => {
+        const cookie = getCookie(event, COOKIE_NAME);
+        if (cookie)
+            await removeSession(cookie);
+        deleteCookie(event, COOKIE_NAME, { path: "/" });
+        try {
+            await auth.api.signOut({ headers: event.headers });
+        }
+        catch {
+            // Ignore if no Better Auth session
+        }
+        return { ok: true };
+    }));
+    // GET /_agent-native/auth/session
+    app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "GET") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const session = await getSession(event);
+        return session ?? { error: "Not authenticated" };
+    }));
+    // POST /_agent-native/auth/migrate-local-data — move local-mode data to
+    // the currently signed-in account. Called by the UI after a user upgrades
+    // from local mode to a real account so they don't lose their data.
+    app.use("/_agent-native/auth/migrate-local-data", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const session = await getSession(event);
+        if (!session?.email || session.email === "local@localhost") {
+            setResponseStatus(event, 401);
+            return { error: "Not authenticated as a real account" };
+        }
+        try {
+            const result = await migrateLocalUserData(session.email);
+            return { ok: true, ...result };
+        }
+        catch (e) {
+            setResponseStatus(event, 500);
+            return { error: e?.message || "Migration failed" };
+        }
+    }));
+    // Auth guard — stored both in framework middleware registry AND in
+    // _authGuardFn so the server middleware can enforce it on ALL routes.
+    const loginHtml = options.loginHtml ?? getOnboardingHtml({ googleOnly: options.googleOnly });
+    _authGuardConfig = { loginHtml, publicPaths };
+    const guardFn = createAuthGuardFn();
+    _authGuardFn = guardFn;
+    app.use(defineEventHandler(guardFn));
+}
+// ---------------------------------------------------------------------------
+// mountTokenOnlyRoutes — ACCESS_TOKEN-only auth (no Better Auth)
+// ---------------------------------------------------------------------------
+function mountTokenOnlyRoutes(app, accessTokens, publicPaths = []) {
+    app.use("/_agent-native/auth/login", defineEventHandler(async (event) => {
         if (getMethod(event) !== "POST") {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
@@ -333,26 +718,24 @@ function mountAuthRoutes(app, accessTokens, publicPaths = []) {
             return { error: "Invalid token" };
         }
         const sessionToken = crypto.randomBytes(32).toString("hex");
-        await addSession(sessionToken);
+        await addSession(sessionToken, "user");
         setCookie(event, COOKIE_NAME, sessionToken, {
             httpOnly: true,
-            secure: true,
+            secure: !isDevEnvironment(),
             sameSite: "lax",
             path: "/",
             maxAge: sessionMaxAge,
         });
         return { ok: true };
     }));
-    // POST /api/auth/logout
-    app.use("/api/auth/logout", defineEventHandler(async (event) => {
+    app.use("/_agent-native/auth/logout", defineEventHandler(async (event) => {
         const cookie = getCookie(event, COOKIE_NAME);
         if (cookie)
             await removeSession(cookie);
         deleteCookie(event, COOKIE_NAME, { path: "/" });
         return { ok: true };
     }));
-    // GET /api/auth/session — client session check
-    app.use("/api/auth/session", defineEventHandler(async (event) => {
+    app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
         if (getMethod(event) !== "GET") {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
@@ -360,68 +743,86 @@ function mountAuthRoutes(app, accessTokens, publicPaths = []) {
         const session = await getSession(event);
         return session ?? { error: "Not authenticated" };
     }));
-    // Auth guard — runs before all other handlers
-    app.use(defineEventHandler(async (event) => {
-        const url = event.node?.req?.url ?? event.path ?? "/";
-        const p = url.split("?")[0];
-        // Skip auth routes
-        if (p === "/api/auth/login" ||
-            p === "/api/auth/logout" ||
-            p === "/api/auth/session") {
-            return;
-        }
-        // Skip public paths
-        if (isPublicPath(url, publicPaths)) {
-            return;
+    _authGuardConfig = { loginHtml: TOKEN_LOGIN_HTML, publicPaths };
+    const guardFn = createAuthGuardFn();
+    _authGuardFn = guardFn;
+    app.use(defineEventHandler(guardFn));
+}
+// ---------------------------------------------------------------------------
+// mountLocalModeRoutes — stub routes for AUTH_MODE=local
+// ---------------------------------------------------------------------------
+function mountLocalModeRoutes(app) {
+    app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "GET") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
         }
-        // Use getSession() so BYOA custom auth is respected
-        const session = await getSession(event);
-        if (session) {
-            return; // Authenticated
+        return await getSession(event);
+    }));
+    app.use("/_agent-native/auth/login", defineEventHandler(() => ({ ok: true })));
+    app.use("/_agent-native/auth/logout", defineEventHandler(() => ({ ok: true })));
+    // Allow exiting local mode to switch to real auth
+    app.use("/_agent-native/auth/exit-local-mode", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
         }
-        // Unauthenticated
-        if (p.startsWith("/api/")) {
-            setResponseStatus(event, 401);
-            return { error: "Unauthorized" };
+        const ok = await removeAuthModeLocal();
+        if (!ok) {
+            setResponseStatus(event, 500);
+            return { error: "Failed to remove AUTH_MODE from .env" };
         }
-        setResponseStatus(event, 200);
-        setResponseHeader(event, "Content-Type", "text/html");
-        return LOGIN_HTML;
+        return { ok: true };
     }));
 }
 // ---------------------------------------------------------------------------
 // autoMountAuth — the recommended entry point
 // ---------------------------------------------------------------------------
 /**
- * Automatically configure auth based on the environment:
+ * Automatically configure auth based on environment and configuration:
  *
- * - **Dev mode** (`NODE_ENV !== "production"`): Auth is skipped entirely.
- *   `getSession()` returns `{ email: "local@localhost" }` for all requests.
- *
- * - **Production with ACCESS_TOKEN/ACCESS_TOKENS set**: Auth middleware is
- *   mounted. Unauthenticated requests see a login page. One env var is all
- *   you need.
- *
- * - **Production without tokens and AUTH_DISABLED !== "true"**: Refuses to
- *   start. Logs a clear error explaining what to do.
- *
- * - **Production with AUTH_DISABLED=true**: Auth is skipped (for apps behind
- *   infrastructure-level auth like Cloudflare Access or a VPN).
+ * - **AUTH_MODE=local**: Auth bypassed. `getSession()` returns `{ email: "local@localhost" }`.
+ *   This is the explicit escape hatch for solo local development.
+ * - **BYOA (custom getSession)**: Template-provided auth callback handles everything.
+ * - **AUTH_DISABLED=true**: Auth bypassed (for infrastructure-level auth like Cloudflare Access).
+ * - **ACCESS_TOKEN/ACCESS_TOKENS**: Simple token-based auth.
+ * - **Default**: Better Auth with email/password, social providers, organizations, and JWT.
+ *   Users see an onboarding page to create an account on first visit.
  *
  * Returns true if auth was mounted, false if skipped.
  */
-export function autoMountAuth(app, options = {}) {
-    // In Nitro 3.0 dev mode, the H3 app may not be available yet.
-    // In dev mode auth is bypassed anyway, so we can safely skip.
+export async function autoMountAuth(app, options = {}) {
+    // If auth is already mounted (e.g., default plugin ran before custom plugin),
+    // don't re-mount routes — but DO update the live config if custom options
+    // like googleOnly or loginHtml were provided. This fixes the production race
+    // where the default plugin (no googleOnly) mounts first, and the template's
+    // custom auth plugin runs later. Because createAuthGuardFn() reads from
+    // _authGuardConfig on every request, updating it here takes effect immediately.
+    if (_authGuardFn) {
+        if (_authGuardConfig) {
+            if (options.googleOnly || options.loginHtml) {
+                _authGuardConfig.loginHtml =
+                    options.loginHtml ??
+                        getOnboardingHtml({ googleOnly: options.googleOnly });
+            }
+            if (options.publicPaths) {
+                _authGuardConfig.publicPaths = [
+                    ...(_authGuardConfig.publicPaths ?? []),
+                    ...options.publicPaths,
+                ];
+            }
+        }
+        return true;
+    }
     if (!app) {
-        if (isDevMode()) {
+        if (isLocalMode() || isDevEnvironment()) {
             authDisabledMode = false;
             customGetSession = null;
             return false;
         }
         throw new Error("autoMountAuth: H3 app is required. In Nitro plugins, pass nitroApp.h3App.");
     }
-    // Reset globals to avoid stale state from prior calls
+    // Reset globals
     customGetSession = null;
     authDisabledMode = false;
     sessionMaxAge = options.maxAge ?? DEFAULT_MAX_AGE;
@@ -429,25 +830,17 @@ export function autoMountAuth(app, options = {}) {
     if (options.getSession) {
         customGetSession = options.getSession;
     }
-    // Dev mode — skip auth entirely
-    if (isDevMode()) {
-        // Mount a session endpoint that returns the dev stub
-        app.use("/api/auth/session", defineEventHandler(async (event) => {
-            if (getMethod(event) !== "GET") {
-                setResponseStatus(event, 405);
-                return { error: "Method not allowed" };
-            }
-            return DEV_SESSION;
-        }));
-        // Mount no-op login/logout so client code doesn't break
-        app.use("/api/auth/login", defineEventHandler(() => ({ ok: true })));
-        app.use("/api/auth/logout", defineEventHandler(() => ({ ok: true })));
+    // AUTH_MODE=local — explicit local-only mode (escape hatch)
+    if (isLocalMode()) {
+        mountLocalModeRoutes(app);
+        // Still init Better Auth in background so users can create accounts later
+        getBetterAuth(options.betterAuth).catch(() => { });
+        console.log("[agent-native] Auth mode: local (no auth required).");
         return false;
     }
-    // BYOA with custom getSession — skip token check, mount session/guard routes
+    // BYOA — custom getSession provider
     if (customGetSession) {
-        // Mount session endpoint
-        app.use("/api/auth/session", defineEventHandler(async (event) => {
+        app.use("/_agent-native/auth/session", defineEventHandler(async (event) => {
             if (getMethod(event) !== "GET") {
                 setResponseStatus(event, 405);
                 return { error: "Method not allowed" };
@@ -455,80 +848,64 @@ export function autoMountAuth(app, options = {}) {
             const session = await getSession(event);
             return session ?? { error: "Not authenticated" };
         }));
-        app.use("/api/auth/login", defineEventHandler(() => ({ ok: true })));
-        app.use("/api/auth/logout", defineEventHandler(async (event) => {
+        app.use("/_agent-native/auth/login", defineEventHandler(() => ({ ok: true })));
+        app.use("/_agent-native/auth/logout", defineEventHandler(async (event) => {
             const cookie = getCookie(event, COOKIE_NAME);
             if (cookie)
                 await removeSession(cookie);
             deleteCookie(event, COOKIE_NAME, { path: "/" });
             return { ok: true };
         }));
-        // Mount auth guard that delegates to custom getSession
-        const byoaLoginHtml = options.loginHtml ?? LOGIN_HTML;
-        app.use(defineEventHandler(async (event) => {
-            // Use H3's getRequestURL for cross-platform compat (Node + Workers)
-            const url = event.node?.req?.url ?? event.path ?? "/";
-            const p = url.split("?")[0];
-            if (p === "/api/auth/login" ||
-                p === "/api/auth/logout" ||
-                p === "/api/auth/session") {
-                return;
-            }
-            // Skip public paths
-            if (isPublicPath(url, publicPaths)) {
-                return;
-            }
-            const session = await getSession(event);
-            if (session)
-                return;
-            if (p.startsWith("/api/")) {
-                setResponseStatus(event, 401);
-                return { error: "Unauthorized" };
-            }
-            setResponseStatus(event, 200);
-            setResponseHeader(event, "Content-Type", "text/html");
-            return byoaLoginHtml;
-        }));
+        const byoaLoginHtml = options.loginHtml ?? TOKEN_LOGIN_HTML;
+        _authGuardConfig = { loginHtml: byoaLoginHtml, publicPaths };
+        const guardFn = createAuthGuardFn();
+        _authGuardFn = guardFn;
+        app.use(defineEventHandler(guardFn));
         console.log("[agent-native] Auth enabled — custom getSession provider.");
         return true;
     }
-    // Production — check for tokens
+    // AUTH_DISABLED — skip auth (infrastructure-level auth)
+    if (process.env.AUTH_DISABLED === "true") {
+        authDisabledMode = true;
+        console.warn("[agent-native] AUTH_DISABLED=true — running without auth. " +
+            "Ensure this app is behind infrastructure-level auth (Cloudflare Access, VPN, etc.).");
+        mountLocalModeRoutes(app);
+        return false;
+    }
+    // ACCESS_TOKEN-only mode
     const tokens = getAccessTokens();
-    if (tokens.length === 0) {
-        // No tokens set — check if auth is explicitly disabled
-        if (process.env.AUTH_DISABLED === "true") {
-            authDisabledMode = true;
-            console.warn("[agent-native] AUTH_DISABLED=true — running in production without auth. " +
-                "Ensure this app is behind infrastructure-level auth (Cloudflare Access, VPN, etc.).");
-            // Mount session endpoint — getSession() will return DEV_SESSION
-            app.use("/api/auth/session", defineEventHandler(async (event) => {
-                if (getMethod(event) !== "GET") {
-                    setResponseStatus(event, 405);
-                    return { error: "Method not allowed" };
-                }
-                return DEV_SESSION;
-            }));
-            app.use("/api/auth/login", defineEventHandler(() => ({ ok: true })));
-            app.use("/api/auth/logout", defineEventHandler(() => ({ ok: true })));
-            return false;
-        }
-        // Refuse to start without auth in production
-        const msg = "\n" +
-            "=".repeat(70) +
-            "\n" +
-            " ERROR: Running in production without authentication.\n\n" +
-            " Set ACCESS_TOKEN=<your-secret> to enable auth, or\n" +
-            " set AUTH_DISABLED=true if this app is behind infrastructure auth.\n\n" +
-            " For multi-user access: ACCESS_TOKENS=token1,token2,token3\n" +
-            "=".repeat(70) +
-            "\n";
-        console.error(msg);
-        process.exit(1);
+    if (tokens.length > 0) {
+        mountTokenOnlyRoutes(app, tokens, publicPaths);
+        console.log(`[agent-native] Auth enabled — ${tokens.length} access token(s) configured.`);
+        return true;
+    }
+    // Default: Better Auth (account-first)
+    try {
+        await mountBetterAuthRoutes(app, options);
+        console.log("[agent-native] Auth enabled — Better Auth (accounts + organizations).");
+    }
+    catch (err) {
+        console.error("[agent-native] Failed to initialize Better Auth:", err);
+        // CRITICAL: Even if Better Auth fails, register the auth guard so
+        // unauthenticated users can't access the app. They'll see the login
+        // page but won't be able to sign in until the DB is available.
+        const loginHtml = options.loginHtml ??
+            getOnboardingHtml({ googleOnly: options.googleOnly });
+        _authGuardConfig = { loginHtml, publicPaths };
+        const guardFn = createAuthGuardFn();
+        _authGuardFn = guardFn;
+        app.use(defineEventHandler(guardFn));
+        console.log("[agent-native] Auth guard registered despite init failure — app is locked.");
     }
-    // Production with tokens — mount auth
-    pruneExpiredSessions().catch(() => { });
-    mountAuthRoutes(app, tokens, publicPaths);
-    console.log(`[agent-native] Auth enabled — ${tokens.length} access token(s) configured.`);
     return true;
 }
+// ---------------------------------------------------------------------------
+// Deprecated — kept for backward compat
+// ---------------------------------------------------------------------------
+/**
+ * @deprecated Use `autoMountAuth(app, options?)` instead.
+ */
+export function mountAuthMiddleware(app, accessToken) {
+    mountTokenOnlyRoutes(app, [accessToken]);
+}
 //# sourceMappingURL=auth.js.map