@agent-native/core 0.4.5 → 0.6.1

package/dist/server/local-migration.js

@@ -0,0 +1,205 @@
+/**
+ * Migrate data owned by `local@localhost` to a real account.
+ *
+ * When a user starts an app in local mode and later signs in to create a real
+ * account, this function moves all of their existing data over to the new
+ * account so they don't lose anything.
+ *
+ * Scope of the migration:
+ *   - `application_state`: rows with `session_id = 'local'`
+ *   - `settings`: keys prefixed with `u:local@localhost:`
+ *   - `oauth_tokens`: rows with `owner = 'local@localhost'`
+ *   - Any template table that has an `owner_email` column: rows with
+ *     `owner_email = 'local@localhost'`
+ *
+ * The operation is a no-op if the target email is itself `local@localhost`,
+ * empty, or if there is nothing to migrate.
+ */
+import { getDbExec, isPostgres } from "../db/client.js";
+const LOCAL_EMAIL = "local@localhost";
+const LOCAL_SESSION_ID = "local";
+const OWNER_COLUMN = "owner_email";
+/** Discover every table that has an `owner_email` column. */
+async function discoverOwnerEmailTables() {
+    const client = getDbExec();
+    if (isPostgres()) {
+        const { rows } = await client.execute({
+            sql: `SELECT table_name
+              FROM information_schema.columns
+             WHERE table_schema = 'public'
+               AND column_name = $1`,
+            args: [OWNER_COLUMN],
+        });
+        return rows.map((r) => r.table_name ?? r[0]).filter(Boolean);
+    }
+    // SQLite path: iterate tables and inspect columns via PRAGMA
+    const tablesRes = await client.execute(`SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'`);
+    const tables = tablesRes.rows
+        .map((r) => (r.name ?? r[0]))
+        .filter(Boolean);
+    const withOwner = [];
+    for (const table of tables) {
+        const escaped = table.replace(/"/g, '""');
+        const colsRes = await client.execute(`PRAGMA table_info("${escaped}")`);
+        const hasOwner = colsRes.rows.some((row) => (row.name ?? row[1]) === OWNER_COLUMN);
+        if (hasOwner)
+            withOwner.push(table);
+    }
+    return withOwner;
+}
+/** Replace `?` placeholders with `$1`, `$2`, … for Postgres. */
+function sqlWithParams(sql) {
+    if (!isPostgres())
+        return sql;
+    let i = 0;
+    return sql.replace(/\?/g, () => `$${++i}`);
+}
+/**
+ * Rename `settings` keys so a user's config carries over. Keys are prefixed
+ * with `u:<email>:` — moving from one email to another is a prefix swap.
+ *
+ * If a destination key already exists (unlikely but possible if the user had
+ * previously signed in with the same email) we leave the destination alone
+ * and drop the local row, so we never clobber real-account state.
+ */
+async function migrateSettings(targetEmail) {
+    const client = getDbExec();
+    const oldPrefix = `u:${LOCAL_EMAIL}:`;
+    const newPrefix = `u:${targetEmail}:`;
+    const { rows } = await client.execute({
+        sql: sqlWithParams(`SELECT key FROM settings WHERE key LIKE ? ESCAPE '\\'`),
+        args: [oldPrefix.replace(/([\\%_])/g, "\\$1") + "%"],
+    });
+    let updated = 0;
+    for (const row of rows) {
+        const oldKey = (row.key ?? row[0]);
+        if (!oldKey.startsWith(oldPrefix))
+            continue;
+        const newKey = newPrefix + oldKey.slice(oldPrefix.length);
+        // Skip if the destination already exists — don't overwrite real data.
+        const existsRes = await client.execute({
+            sql: sqlWithParams(`SELECT 1 FROM settings WHERE key = ?`),
+            args: [newKey],
+        });
+        if (existsRes.rows.length > 0) {
+            await client.execute({
+                sql: sqlWithParams(`DELETE FROM settings WHERE key = ?`),
+                args: [oldKey],
+            });
+            continue;
+        }
+        await client.execute({
+            sql: sqlWithParams(`UPDATE settings SET key = ? WHERE key = ?`),
+            args: [newKey, oldKey],
+        });
+        updated++;
+    }
+    return updated;
+}
+/**
+ * Move application_state rows from `session_id='local'` to the target email.
+ * Rows that already exist for the destination session are left alone.
+ */
+async function migrateApplicationState(targetEmail) {
+    const client = getDbExec();
+    // Only migrate keys that don't already exist under the destination session.
+    const { rows } = await client.execute({
+        sql: sqlWithParams(`SELECT key FROM application_state WHERE session_id = ?`),
+        args: [LOCAL_SESSION_ID],
+    });
+    let updated = 0;
+    for (const row of rows) {
+        const key = (row.key ?? row[0]);
+        const existsRes = await client.execute({
+            sql: sqlWithParams(`SELECT 1 FROM application_state WHERE session_id = ? AND key = ?`),
+            args: [targetEmail, key],
+        });
+        if (existsRes.rows.length > 0) {
+            await client.execute({
+                sql: sqlWithParams(`DELETE FROM application_state WHERE session_id = ? AND key = ?`),
+                args: [LOCAL_SESSION_ID, key],
+            });
+            continue;
+        }
+        await client.execute({
+            sql: sqlWithParams(`UPDATE application_state SET session_id = ? WHERE session_id = ? AND key = ?`),
+            args: [targetEmail, LOCAL_SESSION_ID, key],
+        });
+        updated++;
+    }
+    return updated;
+}
+/** Move oauth_tokens rows. `owner` is the user's email in core tables. */
+async function migrateOauthTokens(targetEmail) {
+    const client = getDbExec();
+    const res = await client.execute({
+        sql: sqlWithParams(`UPDATE oauth_tokens SET owner = ? WHERE owner = ?`),
+        args: [targetEmail, LOCAL_EMAIL],
+    });
+    return res.rowsAffected ?? 0;
+}
+/** Move rows in a template table that uses the `owner_email` convention. */
+async function migrateOwnerEmailTable(table, targetEmail) {
+    const client = getDbExec();
+    const escaped = table.replace(/"/g, '""');
+    const res = await client.execute({
+        sql: sqlWithParams(`UPDATE "${escaped}" SET owner_email = ? WHERE owner_email = ?`),
+        args: [targetEmail, LOCAL_EMAIL],
+    });
+    return res.rowsAffected ?? 0;
+}
+/**
+ * Migrate every piece of local-mode data to the given real account email.
+ * Safe to call multiple times — it only touches rows that are still attached
+ * to `local@localhost`.
+ */
+export async function migrateLocalUserData(targetEmail) {
+    const email = targetEmail?.trim().toLowerCase();
+    if (!email || email === LOCAL_EMAIL) {
+        return { migrated: false, tables: {}, targetEmail: email || "" };
+    }
+    const tables = {};
+    // Core tables — best-effort. A missing table just means the feature isn't
+    // enabled in this app (e.g. an app that doesn't use oauth_tokens).
+    const coreSteps = [
+        ["settings", () => migrateSettings(email)],
+        ["application_state", () => migrateApplicationState(email)],
+        ["oauth_tokens", () => migrateOauthTokens(email)],
+    ];
+    for (const [name, fn] of coreSteps) {
+        try {
+            const count = await fn();
+            if (count > 0)
+                tables[name] = count;
+        }
+        catch (err) {
+            // Missing table or column — skip silently.
+            if (!/no such table|does not exist|undefined table/i.test(String(err))) {
+                throw err;
+            }
+        }
+    }
+    // Template tables — discovered dynamically.
+    let templateTables = [];
+    try {
+        templateTables = await discoverOwnerEmailTables();
+    }
+    catch {
+        templateTables = [];
+    }
+    for (const table of templateTables) {
+        try {
+            const count = await migrateOwnerEmailTable(table, email);
+            if (count > 0)
+                tables[table] = count;
+        }
+        catch (err) {
+            if (!/no such table|does not exist|undefined table/i.test(String(err))) {
+                throw err;
+            }
+        }
+    }
+    const migrated = Object.values(tables).some((n) => n > 0);
+    return { migrated, tables, targetEmail: email };
+}
+//# sourceMappingURL=local-migration.js.map

package/dist/server/local-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-migration.js","sourceRoot":"","sources":["../../src/server/local-migration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,WAAW,GAAG,iBAAiB,CAAC;AACtC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACjC,MAAM,YAAY,GAAG,aAAa,CAAC;AAWnC,6DAA6D;AAC7D,KAAK,UAAU,wBAAwB;IACrC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACpC,GAAG,EAAE;;;oCAGyB;YAC9B,IAAI,EAAE,CAAC,YAAY,CAAC;SACrB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,6DAA6D;IAC7D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CACpC,gFAAgF,CACjF,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI;SAC1B,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAW,CAAC;SAC3C,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,sBAAsB,OAAO,IAAI,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAChC,CAAC,GAAQ,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,CACpD,CAAC;QACF,IAAI,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC,UAAU,EAAE;QAAE,OAAO,GAAG,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,WAAmB;IAChD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,KAAK,WAAW,GAAG,CAAC;IACtC,MAAM,SAAS,GAAG,KAAK,WAAW,GAAG,CAAC;IAEtC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,aAAa,CAAC,uDAAuD,CAAC;QAC3E,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC;KACrD,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,IAAK,GAAW,CAAC,CAAC,CAAC,CAAW,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QAC5C,MAAM,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAE1D,sEAAsE;QACtE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACrC,GAAG,EAAE,aAAa,CAAC,sCAAsC,CAAC;YAC1D,IAAI,EAAE,CAAC,MAAM,CAAC;SACf,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,CAAC,OAAO,CAAC;gBACnB,GAAG,EAAE,aAAa,CAAC,oCAAoC,CAAC;gBACxD,IAAI,EAAE,CAAC,MAAM,CAAC;aACf,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,aAAa,CAAC,2CAA2C,CAAC;YAC/D,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,uBAAuB,CAAC,WAAmB;IACxD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,aAAa,CAChB,wDAAwD,CACzD;QACD,IAAI,EAAE,CAAC,gBAAgB,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,IAAK,GAAW,CAAC,CAAC,CAAC,CAAW,CAAC;QACnD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;YACrC,GAAG,EAAE,aAAa,CAChB,kEAAkE,CACnE;YACD,IAAI,EAAE,CAAC,WAAW,EAAE,GAAG,CAAC;SACzB,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,CAAC,OAAO,CAAC;gBACnB,GAAG,EAAE,aAAa,CAChB,gEAAgE,CACjE;gBACD,IAAI,EAAE,CAAC,gBAAgB,EAAE,GAAG,CAAC;aAC9B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,aAAa,CAChB,8EAA8E,CAC/E;YACD,IAAI,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,CAAC;SAC3C,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,kBAAkB,CAAC,WAAmB;IACnD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,aAAa,CAAC,mDAAmD,CAAC;QACvE,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;KACjC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,sBAAsB,CACnC,KAAa,EACb,WAAmB;IAEnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAC/B,GAAG,EAAE,aAAa,CAChB,WAAW,OAAO,6CAA6C,CAChE;QACD,IAAI,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;KACjC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmB;IAEnB,MAAM,KAAK,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,0EAA0E;IAC1E,mEAAmE;IACnE,MAAM,SAAS,GAA2C;QACxD,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAC3D,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;KAClD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;YACzB,IAAI,KAAK,GAAG,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACtC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,2CAA2C;YAC3C,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,cAAc,GAAa,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,wBAAwB,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,cAAc,GAAG,EAAE,CAAC;IACtB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzD,IAAI,KAAK,GAAG,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QACvC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACvE,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAClD,CAAC"}

package/dist/server/oauth-helpers.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Check if any OAuth tokens exist for a provider, scoped to the given owner.
+ * Always scopes by owner email — never returns tokens across users.
+ */
+export declare function isOAuthConnected(provider: string, forEmail?: string): Promise<boolean>;
+/**
+ * Get OAuth accounts for a provider, scoped to the given owner.
+ * Always scopes by owner email — never returns tokens across users.
+ */
+export declare function getOAuthAccounts(provider: string, forEmail?: string): Promise<Array<{
+    accountId: string;
+    tokens: Record<string, unknown>;
+}>>;
+//# sourceMappingURL=oauth-helpers.d.ts.map

package/dist/server/oauth-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-helpers.d.ts","sourceRoot":"","sources":["../../src/server/oauth-helpers.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAAC,CAKxE"}

package/dist/server/oauth-helpers.js

@@ -0,0 +1,23 @@
+import { hasOAuthTokens, listOAuthAccountsByOwner, listOAuthAccounts, } from "../oauth-tokens/index.js";
+/**
+ * Check if any OAuth tokens exist for a provider, scoped to the given owner.
+ * Always scopes by owner email — never returns tokens across users.
+ */
+export async function isOAuthConnected(provider, forEmail) {
+    if (forEmail) {
+        const accounts = await listOAuthAccountsByOwner(provider, forEmail);
+        return accounts.length > 0;
+    }
+    return hasOAuthTokens(provider);
+}
+/**
+ * Get OAuth accounts for a provider, scoped to the given owner.
+ * Always scopes by owner email — never returns tokens across users.
+ */
+export async function getOAuthAccounts(provider, forEmail) {
+    if (forEmail) {
+        return listOAuthAccountsByOwner(provider, forEmail);
+    }
+    return listOAuthAccounts(provider);
+}
+//# sourceMappingURL=oauth-helpers.js.map

package/dist/server/oauth-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-helpers.js","sourceRoot":"","sources":["../../src/server/oauth-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAElC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,QAAiB;IAEjB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,QAAiB;IAEjB,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC"}

package/dist/server/onboarding-html.d.ts

@@ -0,0 +1,24 @@
+/**
+ * First-run onboarding page for agent-native apps.
+ *
+ * Shown when Better Auth is active and the user isn't signed in.
+ * Provides two paths:
+ * 1. Create account (email/password) — real identity from day one
+ * 2. Use locally — sets AUTH_MODE=local for offline/solo dev (dev only)
+ *
+ * After first account exists, this page acts as a normal login page.
+ * The "Use locally" escape hatch is hidden in production to ensure
+ * real accounts are used (needed for per-user usage tracking/limits).
+ */
+export interface OnboardingHtmlOptions {
+    /**
+     * Hide email/password forms and show ONLY the Google sign-in button.
+     * Useful for templates (mail, calendar) where Google is required anyway.
+     * If Google OAuth env vars are not configured, an error message is shown.
+     */
+    googleOnly?: boolean;
+}
+export declare function getOnboardingHtml(opts?: OnboardingHtmlOptions): string;
+/** @deprecated Use getOnboardingHtml() instead */
+export declare const ONBOARDING_HTML: string;
+//# sourceMappingURL=onboarding-html.d.ts.map

package/dist/server/onboarding-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-html.d.ts","sourceRoot":"","sources":["../../src/server/onboarding-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,qBAA0B,GAAG,MAAM,CA8U1E;AAED,kDAAkD;AAClD,eAAO,MAAM,eAAe,QAAsB,CAAC"}

package/dist/server/onboarding-html.js

@@ -0,0 +1,347 @@
+/**
+ * First-run onboarding page for agent-native apps.
+ *
+ * Shown when Better Auth is active and the user isn't signed in.
+ * Provides two paths:
+ * 1. Create account (email/password) — real identity from day one
+ * 2. Use locally — sets AUTH_MODE=local for offline/solo dev (dev only)
+ *
+ * After first account exists, this page acts as a normal login page.
+ * The "Use locally" escape hatch is hidden in production to ensure
+ * real accounts are used (needed for per-user usage tracking/limits).
+ */
+function isProductionEnv() {
+    const env = process.env.NODE_ENV;
+    return env !== "development" && env !== "test";
+}
+function hasGoogleOAuth() {
+    return !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
+}
+export function getOnboardingHtml(opts = {}) {
+    const showLocalMode = !isProductionEnv() && !opts.googleOnly;
+    const showGoogle = hasGoogleOAuth();
+    const googleOnly = !!opts.googleOnly;
+    const localModeBlock = showLocalMode
+        ? `
+  <div class="divider">or</div>
+
+  <button class="btn-secondary" id="local-btn" onclick="useLocally()">Use locally without an account</button>
+  <p class="local-info">Skip auth for solo local development. You can create an account later.</p>`
+        : "";
+    const localModeScript = showLocalMode
+        ? `
+  async function useLocally() {
+    var btn = document.getElementById('local-btn');
+    btn.disabled = true;
+    btn.textContent = 'Setting up...';
+    try {
+      var res = await fetch('/_agent-native/auth/local-mode', { method: 'POST' });
+      if (res.ok) {
+        window.location.reload();
+      } else {
+        btn.textContent = 'Failed — try again';
+        btn.disabled = false;
+      }
+    } catch(e) {
+      btn.textContent = 'Failed — try again';
+      btn.disabled = false;
+    }
+  }`
+        : "";
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>Welcome</title>
+<style>
+  *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+  body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+    background: #0a0a0a;
+    color: #e5e5e5;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    min-height: 100vh;
+  }
+  .card {
+    width: 100%;
+    max-width: 400px;
+    padding: 2rem;
+    background: #141414;
+    border: 1px solid rgba(255,255,255,0.08);
+    border-radius: 12px;
+  }
+  h1 { font-size: 1.25rem; font-weight: 600; margin-bottom: 0.25rem; color: #fff; }
+  .subtitle { font-size: 0.8125rem; color: #888; margin-bottom: 1.5rem; }
+  .tabs {
+    display: inline-flex;
+    width: 100%;
+    padding: 4px;
+    margin-bottom: 1.5rem;
+    background: rgba(255,255,255,0.06);
+    border-radius: 8px;
+  }
+  .tab {
+    flex: 1;
+    padding: 0.5rem 0.75rem;
+    background: none;
+    border: none;
+    color: #888;
+    font-size: 0.8125rem;
+    font-weight: 500;
+    cursor: pointer;
+    border-radius: 6px;
+  }
+  .tab.active {
+    background: #1e1e1e;
+    color: #fff;
+    box-shadow: 0 1px 2px rgba(0,0,0,0.3);
+  }
+  .tab:hover:not(.active) { color: #bbb; }
+  .form { display: none; }
+  .form.active { display: block; }
+  label { display: block; font-size: 0.8125rem; color: #888; margin-bottom: 0.375rem; }
+  input {
+    width: 100%;
+    padding: 0.5rem 0.75rem;
+    background: transparent;
+    border: 1px solid rgba(255,255,255,0.12);
+    border-radius: 6px;
+    color: #e5e5e5;
+    font-size: 0.875rem;
+    outline: none;
+    margin-bottom: 0.875rem;
+  }
+  input:focus { border-color: rgba(255,255,255,0.3); box-shadow: 0 0 0 1px rgba(255,255,255,0.1); }
+  input::placeholder { color: #555; }
+  button[type="submit"], .btn-primary {
+    width: 100%;
+    margin-top: 0.25rem;
+    padding: 0.5rem;
+    background: #fff;
+    color: #000;
+    border: none;
+    border-radius: 6px;
+    font-size: 0.875rem;
+    font-weight: 500;
+    cursor: pointer;
+  }
+  button[type="submit"]:hover, .btn-primary:hover { background: #e5e5e5; }
+  button[type="submit"]:disabled { opacity: 0.5; cursor: not-allowed; }
+  .btn-secondary {
+    width: 100%;
+    margin-top: 0.75rem;
+    padding: 0.5rem;
+    background: transparent;
+    color: #888;
+    border: 1px solid rgba(255,255,255,0.1);
+    border-radius: 6px;
+    font-size: 0.8125rem;
+    cursor: pointer;
+  }
+  .btn-secondary:hover { color: #bbb; border-color: rgba(255,255,255,0.2); }
+  .msg { margin-top: 0.75rem; font-size: 0.8125rem; display: none; }
+  .msg.error { color: #f87171; }
+  .msg.success { color: #4ade80; }
+  .msg.show { display: block; }
+  .divider {
+    display: flex;
+    align-items: center;
+    gap: 0.75rem;
+    margin: 1.25rem 0;
+    font-size: 0.75rem;
+    color: #555;
+  }
+  .divider::before, .divider::after {
+    content: '';
+    flex: 1;
+    height: 1px;
+    background: rgba(255,255,255,0.08);
+  }
+  .local-info {
+    font-size: 0.75rem;
+    color: #666;
+    margin-top: 0.5rem;
+    line-height: 1.4;
+  }
+  .btn-google {
+    width: 100%;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.625rem;
+    padding: 0.5rem;
+    background: #fff;
+    color: #000;
+    border: none;
+    border-radius: 6px;
+    font-size: 0.875rem;
+    font-weight: 500;
+    cursor: pointer;
+  }
+  .btn-google:hover { background: #e5e5e5; }
+  .btn-google:disabled { opacity: 0.5; cursor: wait; }
+  .btn-google svg { width: 18px; height: 18px; flex-shrink: 0; }
+  .google-error { margin-top: 0.5rem; font-size: 0.8125rem; color: #f87171; display: none; }
+  .google-error.show { display: block; }
+</style>
+</head>
+<body>
+<div class="card">
+  <h1>Welcome</h1>
+  <p class="subtitle">Create an account to get started</p>
+
+${showGoogle
+        ? `
+  <button class="btn-google" id="google-btn" onclick="signInWithGoogle()">
+    <svg viewBox="0 0 24 24"><path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z"/><path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/><path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/><path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/></svg>
+    Sign in with Google
+  </button>
+  <p class="google-error" id="google-err"></p>
+${googleOnly ? "" : `\n  <div class="divider">or</div>\n`}
+`
+        : googleOnly
+            ? `
+  <p style="color:#f87171;font-size:0.875rem;text-align:center;padding:1rem 0">
+    Google sign-in is not configured. Set <code>GOOGLE_CLIENT_ID</code> and
+    <code>GOOGLE_CLIENT_SECRET</code> environment variables to enable login.
+  </p>
+`
+            : ""}
+${googleOnly
+        ? ""
+        : `  <div class="tabs">
+    <button class="tab active" data-tab="signup">Create account</button>
+    <button class="tab" data-tab="login">Sign in</button>
+  </div>
+
+  <form id="signup-form" class="form active">
+    <label for="s-email">Email</label>
+    <input id="s-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />
+    <label for="s-pass">Password</label>
+    <input id="s-pass" type="password" autocomplete="new-password" placeholder="At least 8 characters" required minlength="8" />
+    <label for="s-pass2">Confirm password</label>
+    <input id="s-pass2" type="password" autocomplete="new-password" placeholder="Confirm password" required minlength="8" />
+    <button type="submit">Create account</button>
+    <p class="msg" id="s-msg"></p>
+  </form>
+
+  <form id="login-form" class="form">
+    <label for="l-email">Email</label>
+    <input id="l-email" type="email" autocomplete="email" placeholder="you@example.com" required />
+    <label for="l-pass">Password</label>
+    <input id="l-pass" type="password" autocomplete="current-password" placeholder="Enter password" required />
+    <button type="submit">Sign in</button>
+    <p class="msg error" id="l-msg"></p>
+  </form>`}
+${localModeBlock}
+</div>
+<script>
+${googleOnly
+        ? ""
+        : `  var tabs = document.querySelectorAll('.tab');
+  var forms = document.querySelectorAll('.form');
+  tabs.forEach(function(t) { t.addEventListener('click', function() {
+    tabs.forEach(function(x) { x.classList.remove('active'); });
+    forms.forEach(function(x) { x.classList.remove('active'); });
+    t.classList.add('active');
+    document.getElementById(t.dataset.tab + '-form').classList.add('active');
+  }); });
+
+  document.getElementById('signup-form').addEventListener('submit', async function(e) {
+    e.preventDefault();
+    var msg = document.getElementById('s-msg');
+    msg.classList.remove('show', 'error', 'success');
+    var pass = document.getElementById('s-pass').value;
+    var pass2 = document.getElementById('s-pass2').value;
+    if (pass !== pass2) {
+      msg.textContent = 'Passwords do not match';
+      msg.classList.add('show', 'error');
+      return;
+    }
+    var email = document.getElementById('s-email').value;
+    var res = await fetch('/_agent-native/auth/register', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email: email, password: pass }),
+    });
+    var data = await res.json().catch(function() { return {}; });
+    if (res.ok) {
+      msg.textContent = 'Account created — signing you in...';
+      msg.classList.add('show', 'success');
+      var loginRes = await fetch('/_agent-native/auth/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: email, password: pass }),
+      });
+      if (loginRes.ok) {
+        window.location.reload();
+      }
+    } else {
+      msg.textContent = data.error || 'Registration failed';
+      msg.classList.add('show', 'error');
+    }
+  });
+
+  document.getElementById('login-form').addEventListener('submit', async function(e) {
+    e.preventDefault();
+    var msg = document.getElementById('l-msg');
+    msg.classList.remove('show');
+    var res = await fetch('/_agent-native/auth/login', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        email: document.getElementById('l-email').value,
+        password: document.getElementById('l-pass').value,
+      }),
+    });
+    if (res.ok) {
+      window.location.reload();
+    } else {
+      var data = await res.json().catch(function() { return {}; });
+      msg.textContent = data.error || 'Invalid email or password';
+      msg.classList.add('show');
+    }
+  });
+`}${localModeScript}
+${showGoogle
+        ? `
+  async function signInWithGoogle() {
+    var btn = document.getElementById('google-btn');
+    var err = document.getElementById('google-err');
+    btn.disabled = true;
+    err.classList.remove('show');
+    try {
+      var res = await fetch('/_agent-native/google/auth-url');
+      var data = await res.json();
+      if (data.url) {
+        try { sessionStorage.setItem('__an_signin', '1'); } catch(e) {}
+        window.open(data.url, '_blank');
+        btn.disabled = false;
+        btn.textContent = 'Waiting for sign-in…';
+        var poll = setInterval(function() {
+          fetch('/_agent-native/auth/session').then(function(r) { return r.json(); }).then(function(s) {
+            if (s && s.email) { clearInterval(poll); window.location.reload(); }
+          }).catch(function() {});
+        }, 1500);
+      } else {
+        err.textContent = data.message || 'Google OAuth is not configured.';
+        err.classList.add('show');
+        btn.disabled = false;
+      }
+    } catch (e) {
+      err.textContent = 'Failed to connect. Please try again.';
+      err.classList.add('show');
+      btn.disabled = false;
+    }
+  }`
+        : ""}
+</script>
+</body>
+</html>`;
+}
+/** @deprecated Use getOnboardingHtml() instead */
+export const ONBOARDING_HTML = getOnboardingHtml();
+//# sourceMappingURL=onboarding-html.js.map

package/dist/server/onboarding-html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-html.js","sourceRoot":"","sources":["../../src/server/onboarding-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IACjC,OAAO,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,MAAM,CAAC;AACjD,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AAC9E,CAAC;AAWD,MAAM,UAAU,iBAAiB,CAAC,OAA8B,EAAE;IAChE,MAAM,aAAa,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC;IAC7D,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IACrC,MAAM,cAAc,GAAG,aAAa;QAClC,CAAC,CAAC;;;;mGAI6F;QAC/F,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,eAAe,GAAG,aAAa;QACnC,CAAC,CAAC;;;;;;;;;;;;;;;;;IAiBF;QACA,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkJP,UAAU;QACR,CAAC,CAAC;;;;;;EAMJ,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qCAAqC;CACxD;QACG,CAAC,CAAC,UAAU;YACV,CAAC,CAAC;;;;;CAKP;YACK,CAAC,CAAC,EACR;EAEE,UAAU;QACR,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;UAwBN;EACE,cAAc;;;EAId,UAAU;QACR,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiEN,GAAG,eAAe;EAEhB,UAAU;QACR,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA6BF;QACA,CAAC,CAAC,EACN;;;QAGQ,CAAC;AACT,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC"}