@tangle-network/agent-app 0.43.24 → 0.43.26

package/dist/app-auth/index.d.ts

@@ -0,0 +1,163 @@
+import { Session, User, Auth, BetterAuthOptions } from 'better-auth';
+import { A as AuthGuard, T as TangleSsoHandlers, a as TangleSsoAuthClient, b as TangleSsoAccountStore } from '../sso-CNOsARMJ.js';
+
+/**
+ * better-auth config factory for agent products (#188 Phase 1). Every product
+ * hand-rolls the same ~70–150 line setup — drizzle adapter over the standard
+ * users/sessions/accounts/verifications tables, email+password with Resend
+ * reset/verification mail, env-gated GitHub/Google social providers, session
+ * cookie cache, and a per-app cookie prefix — and tax additionally
+ * re-implemented better-auth's cookie signing for its Tangle SSO callback.
+ * `createAppAuth` owns that mechanism once and returns the configured
+ * better-auth instance plus the request guards products actually use.
+ *
+ * Domain stays a parameter: the drizzle db + schema, email client, provider
+ * credentials, and SSO store/client all come from the product. No product
+ * import, no engine re-implementation — the SSO path composes the existing
+ * `platform/sso` cookie minter (`createBetterAuthSessionCookieMinter`), which
+ * is byte-compatible with better-auth's own `makeSignature` contract.
+ *
+ * better-auth is an OPTIONAL peer: only this subpath imports it, so it is
+ * deliberately NOT re-exported from the root barrel.
+ */
+
+/** Structural slice of a Resend-style client — no `resend` import. */
+interface AppAuthEmailClient {
+    emails: {
+        send(message: {
+            from: string;
+            to: string;
+            subject: string;
+            html: string;
+            text?: string;
+        }): Promise<unknown>;
+    };
+}
+interface AppAuthEmailConfig {
+    /** A Resend-style client, or a lazy getter returning null when the API key
+     *  is absent (the products' dev default — mail is skipped with a warning,
+     *  sign-up itself must not crash). */
+    resend: AppAuthEmailClient | (() => AppAuthEmailClient | null);
+    /** RFC 5322 From, e.g. `'Legal Agent <noreply@legal.tangle.tools>'`. */
+    from: string;
+    /** Send a verification email on sign-up and auto-sign-in after verifying
+     *  (the tax/gtm behavior). Default false (the legal behavior). */
+    verifyOnSignUp?: boolean;
+    /** Receives the "email client unavailable" warning. Default console.warn. */
+    warn?: (message: string) => void;
+}
+/** Env-shaped: pass the env vars straight through; the provider is registered
+ *  only when BOTH values are non-empty, so unset env disables it. */
+interface AppAuthSocialProviderConfig {
+    clientId?: string;
+    clientSecret?: string;
+}
+interface AppAuthSocialConfig {
+    github?: AppAuthSocialProviderConfig;
+    google?: AppAuthSocialProviderConfig;
+}
+/** Cross-site Tangle SSO wiring. The factory supplies the better-auth side —
+ *  `setSessionCookie` via `createBetterAuthSessionCookieMinter(auth)` (signed
+ *  `__Secure-`/prefixed cookie that `auth.api.getSession` accepts) — so the
+ *  product no longer touches `better-auth/crypto` itself. */
+interface AppAuthSsoConfig {
+    /** Platform wire client (authorizeUrl + exchange). */
+    client: TangleSsoAuthClient;
+    /** Product persistence: user upsert, session row, platform link. */
+    store: TangleSsoAccountStore;
+    /** Absolute callback URL registered with the platform. */
+    callbackUrl: string;
+    /** Default 'tangle_sso_state'. */
+    stateCookieName?: string;
+    /** HMAC secret for the CSRF state cookie. Default: the auth `secret`. */
+    stateSecret?: string;
+    /** Default: `baseURL` is https. Must match better-auth's own
+     *  secure-cookie decision or the cookie name lookup diverges. */
+    secureCookies?: boolean;
+    sessionTtlSeconds?: number;
+    stateTtlSeconds?: number;
+    /** Post-login redirect fallback. Default '/app'. */
+    defaultRedirectPath?: string;
+    /** Default: the top-level `loginPath`. */
+    loginPath?: string;
+    /** Failure log hook (e.g. console.error). Default no-op. */
+    log?: (message: string, error?: unknown) => void;
+}
+interface AppAuthSchema {
+    users: unknown;
+    sessions: unknown;
+    accounts: unknown;
+    verifications: unknown;
+}
+interface AppAuthConfig {
+    /** Product name — used in email subjects and as the cookie-prefix default. */
+    appName: string;
+    /** Absolute origin better-auth serves from (`BETTER_AUTH_URL`). */
+    baseURL: string;
+    /** better-auth HMAC secret. Optional only because better-auth falls back to
+     *  the BETTER_AUTH_SECRET env var; `sso` needs it explicitly (or
+     *  `sso.stateSecret`). */
+    secret?: string;
+    trustedOrigins?: string[];
+    /**
+     * Session-cookie prefix. Default: slugified `appName`. A per-app prefix is
+     * load-bearing, not cosmetic: the platform (id.tangle.tools) mints its own
+     * better-auth cookie `Domain=.tangle.tools`-wide under the DEFAULT name, and
+     * the platform's (older) cookie wins the Cookie-header order — an app on the
+     * default prefix reads the platform's token, fails its own signature check,
+     * and every fresh login lands back on /login.
+     */
+    cookiePrefix?: string;
+    /** Drizzle database instance; wired through better-auth's drizzle adapter
+     *  together with `schema`. */
+    db?: unknown;
+    /** The product's users/sessions/accounts/verifications tables (mapped to
+     *  better-auth's user/session/account/verification models). */
+    schema?: AppAuthSchema;
+    /** Drizzle dialect. Default 'sqlite' (D1). */
+    provider?: 'sqlite' | 'pg' | 'mysql';
+    /** Escape hatch: a pre-built better-auth database adapter (e.g.
+     *  `memoryAdapter` in tests). Wins over `db`/`schema`. */
+    database?: BetterAuthOptions['database'];
+    /** Email+password sign-in. Default true (all current products enable it). */
+    emailAndPassword?: boolean;
+    /** Reset/verification mail. Omit to disable password reset entirely. */
+    email?: AppAuthEmailConfig;
+    social?: AppAuthSocialConfig;
+    /** Session cookie-cache TTL in seconds; `false` disables the cache.
+     *  Default 300. */
+    sessionCookieCacheSeconds?: number | false;
+    /** Tangle cross-site SSO (start/callback handlers). */
+    sso?: AppAuthSsoConfig;
+    /** Where guards redirect unauthenticated page requests. Default '/login'. */
+    loginPath?: string;
+    /** Merged over the factory's `advanced` block (cookiePrefix stays unless
+     *  overridden here). */
+    advanced?: BetterAuthOptions['advanced'];
+}
+/** The configured better-auth instance, typed at better-auth's base surface
+ *  (`handler`, `api`, `$context`, `$Infer`). */
+type AppAuthInstance = Auth;
+/** What `getSession`/guards resolve: better-auth's base session + user rows. */
+interface AppAuthSession {
+    session: Session;
+    user: User;
+}
+interface AppAuth extends AuthGuard<AppAuthSession> {
+    auth: AppAuthInstance;
+    /** `auth.api.getSession` over a `Request` — the seam the guards consume. */
+    getSession(request: Request): Promise<AppAuthSession | null>;
+    /** Tangle SSO start/callback handlers; null unless `sso` was configured. */
+    sso: TangleSsoHandlers | null;
+}
+/**
+ * Build the product's better-auth instance plus the request-boundary helpers:
+ * `getSession` (Request → session|null), the `createAuthGuard` quartet
+ * (`requireUser` 302, `requireApiUser` JSON 401, `requireSession`,
+ * `getOptionalSession`), and — when `sso` is configured — the Tangle SSO
+ * start/callback handlers with the session cookie minted through better-auth's
+ * own name/attributes/signing (no `better-auth/crypto` in product code).
+ */
+declare function createAppAuth(config: AppAuthConfig): AppAuth;
+
+export { type AppAuth, type AppAuthConfig, type AppAuthEmailClient, type AppAuthEmailConfig, type AppAuthInstance, type AppAuthSchema, type AppAuthSession, type AppAuthSocialConfig, type AppAuthSocialProviderConfig, type AppAuthSsoConfig, createAppAuth };

package/dist/app-auth/index.js

@@ -0,0 +1,166 @@
+import {
+  createAuthGuard,
+  createBetterAuthSessionCookieMinter,
+  createTangleSsoHandlers
+} from "../chunk-TKVJE63N.js";
+import "../chunk-HFC4BTWJ.js";
+import "../chunk-7W5XSTUF.js";
+
+// src/app-auth/index.ts
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+var DEFAULT_STATE_COOKIE = "tangle_sso_state";
+var DEFAULT_SESSION_COOKIE_CACHE_SECONDS = 5 * 60;
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+function resolveEmailClient(email) {
+  return typeof email.resend === "function" ? email.resend() : email.resend;
+}
+async function sendEmail(client, message) {
+  const result = await client.emails.send(message);
+  if (result && typeof result === "object" && result.error) {
+    throw new Error(`[app-auth] email send failed: ${result.error.message ?? "unknown error"}`);
+  }
+}
+function resolveDatabase(config) {
+  if (config.database) return config.database;
+  if (config.db && config.schema) {
+    return drizzleAdapter(config.db, {
+      provider: config.provider ?? "sqlite",
+      schema: {
+        user: config.schema.users,
+        session: config.schema.sessions,
+        account: config.schema.accounts,
+        verification: config.schema.verifications
+      }
+    });
+  }
+  throw new Error(
+    "createAppAuth requires a database: pass `db` + `schema` (drizzle) or `database` (a better-auth adapter)"
+  );
+}
+function resolveSocialProviders(social) {
+  const providers = {};
+  if (social?.github?.clientId && social.github.clientSecret) {
+    providers.github = { clientId: social.github.clientId, clientSecret: social.github.clientSecret };
+  }
+  if (social?.google?.clientId && social.google.clientSecret) {
+    providers.google = { clientId: social.google.clientId, clientSecret: social.google.clientSecret };
+  }
+  return Object.keys(providers).length > 0 ? providers : void 0;
+}
+function emailAndPasswordOptions(config) {
+  const email = config.email;
+  if (!email) return { enabled: true };
+  const warn = email.warn ?? ((message) => console.warn(message));
+  return {
+    enabled: true,
+    sendResetPassword: async ({ user, url }) => {
+      const client = resolveEmailClient(email);
+      if (!client) {
+        warn("[app-auth] email client unavailable \u2014 password reset email not sent");
+        return;
+      }
+      await sendEmail(client, {
+        from: email.from,
+        to: user.email,
+        subject: "Reset your password",
+        html: `<p>Click the link below to reset your password:</p><p><a href="${url}">${url}</a></p><p>This link expires in 1 hour.</p>`,
+        text: `Reset your password:
+
+${url}
+
+This link expires in 1 hour.`
+      });
+    }
+  };
+}
+function emailVerificationOptions(config) {
+  const email = config.email;
+  if (!email?.verifyOnSignUp) return void 0;
+  const warn = email.warn ?? ((message) => console.warn(message));
+  return {
+    sendOnSignUp: true,
+    autoSignInAfterVerification: true,
+    sendVerificationEmail: async ({ user, url }) => {
+      const client = resolveEmailClient(email);
+      if (!client) {
+        warn("[app-auth] email client unavailable \u2014 verification email not sent");
+        return;
+      }
+      await sendEmail(client, {
+        from: email.from,
+        to: user.email,
+        subject: `Verify your ${config.appName} email`,
+        html: `<p>Verify your email to finish accessing ${config.appName}:</p><p><a href="${url}">${url}</a></p><p>This link expires in 1 hour.</p>`,
+        text: `Verify your email to finish accessing ${config.appName}:
+
+${url}
+
+This link expires in 1 hour.`
+      });
+    }
+  };
+}
+function createAppAuth(config) {
+  if (!config.appName) throw new Error("createAppAuth: appName is required");
+  if (!config.baseURL) throw new Error("createAppAuth: baseURL is required");
+  const cookiePrefix = config.cookiePrefix ?? slugify(config.appName);
+  if (!cookiePrefix) throw new Error("createAppAuth: cookiePrefix (or a slugifiable appName) is required");
+  const socialProviders = resolveSocialProviders(config.social);
+  const options = {
+    appName: config.appName,
+    baseURL: config.baseURL,
+    ...config.secret ? { secret: config.secret } : {},
+    ...config.trustedOrigins ? { trustedOrigins: config.trustedOrigins } : {},
+    database: resolveDatabase(config),
+    ...config.emailAndPassword === false ? {} : { emailAndPassword: emailAndPasswordOptions(config) },
+    ...config.email?.verifyOnSignUp ? { emailVerification: emailVerificationOptions(config) } : {},
+    ...socialProviders ? { socialProviders } : {},
+    ...config.sessionCookieCacheSeconds === false ? {} : {
+      session: {
+        cookieCache: {
+          enabled: true,
+          maxAge: config.sessionCookieCacheSeconds ?? DEFAULT_SESSION_COOKIE_CACHE_SECONDS
+        }
+      }
+    },
+    advanced: { cookiePrefix, ...config.advanced }
+  };
+  const auth = betterAuth(options);
+  const getSession = async (request) => {
+    const session = await auth.api.getSession({ headers: request.headers });
+    return session ?? null;
+  };
+  const loginPath = config.loginPath ?? "/login";
+  const guard = createAuthGuard({ getSession, loginPath });
+  let sso = null;
+  if (config.sso) {
+    const stateSecret = config.sso.stateSecret ?? config.secret;
+    if (!stateSecret) {
+      throw new Error(
+        "createAppAuth: sso requires `secret` (or sso.stateSecret) \u2014 the signed-state CSRF cookie needs an HMAC secret"
+      );
+    }
+    sso = createTangleSsoHandlers({
+      auth: config.sso.client,
+      store: config.sso.store,
+      stateSecret,
+      callbackUrl: config.sso.callbackUrl,
+      stateCookieName: config.sso.stateCookieName ?? DEFAULT_STATE_COOKIE,
+      setSessionCookie: createBetterAuthSessionCookieMinter(auth),
+      secureCookies: config.sso.secureCookies ?? config.baseURL.startsWith("https:"),
+      ...config.sso.sessionTtlSeconds !== void 0 ? { sessionTtlSeconds: config.sso.sessionTtlSeconds } : {},
+      ...config.sso.stateTtlSeconds !== void 0 ? { stateTtlSeconds: config.sso.stateTtlSeconds } : {},
+      ...config.sso.defaultRedirectPath ? { defaultRedirectPath: config.sso.defaultRedirectPath } : {},
+      loginPath: config.sso.loginPath ?? loginPath,
+      ...config.sso.log ? { log: config.sso.log } : {}
+    });
+  }
+  return { auth, getSession, ...guard, sso };
+}
+export {
+  createAppAuth
+};
+//# sourceMappingURL=index.js.map

package/dist/app-auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/app-auth/index.ts"],"sourcesContent":["/**\n * better-auth config factory for agent products (#188 Phase 1). Every product\n * hand-rolls the same ~70–150 line setup — drizzle adapter over the standard\n * users/sessions/accounts/verifications tables, email+password with Resend\n * reset/verification mail, env-gated GitHub/Google social providers, session\n * cookie cache, and a per-app cookie prefix — and tax additionally\n * re-implemented better-auth's cookie signing for its Tangle SSO callback.\n * `createAppAuth` owns that mechanism once and returns the configured\n * better-auth instance plus the request guards products actually use.\n *\n * Domain stays a parameter: the drizzle db + schema, email client, provider\n * credentials, and SSO store/client all come from the product. No product\n * import, no engine re-implementation — the SSO path composes the existing\n * `platform/sso` cookie minter (`createBetterAuthSessionCookieMinter`), which\n * is byte-compatible with better-auth's own `makeSignature` contract.\n *\n * better-auth is an OPTIONAL peer: only this subpath imports it, so it is\n * deliberately NOT re-exported from the root barrel.\n */\n\nimport { betterAuth, type Auth, type BetterAuthOptions, type Session, type User } from 'better-auth'\nimport { drizzleAdapter } from 'better-auth/adapters/drizzle'\nimport { createAuthGuard, type AuthGuard } from '../platform/guards'\nimport {\n  createBetterAuthSessionCookieMinter,\n  createTangleSsoHandlers,\n  type TangleSsoAccountStore,\n  type TangleSsoAuthClient,\n  type TangleSsoHandlers,\n} from '../platform/sso'\n\nconst DEFAULT_STATE_COOKIE = 'tangle_sso_state'\nconst DEFAULT_SESSION_COOKIE_CACHE_SECONDS = 5 * 60\n\n/** Structural slice of a Resend-style client — no `resend` import. */\nexport interface AppAuthEmailClient {\n  emails: {\n    send(message: {\n      from: string\n      to: string\n      subject: string\n      html: string\n      text?: string\n    }): Promise<unknown>\n  }\n}\n\nexport interface AppAuthEmailConfig {\n  /** A Resend-style client, or a lazy getter returning null when the API key\n   *  is absent (the products' dev default — mail is skipped with a warning,\n   *  sign-up itself must not crash). */\n  resend: AppAuthEmailClient | (() => AppAuthEmailClient | null)\n  /** RFC 5322 From, e.g. `'Legal Agent <noreply@legal.tangle.tools>'`. */\n  from: string\n  /** Send a verification email on sign-up and auto-sign-in after verifying\n   *  (the tax/gtm behavior). Default false (the legal behavior). */\n  verifyOnSignUp?: boolean\n  /** Receives the \"email client unavailable\" warning. Default console.warn. */\n  warn?: (message: string) => void\n}\n\n/** Env-shaped: pass the env vars straight through; the provider is registered\n *  only when BOTH values are non-empty, so unset env disables it. */\nexport interface AppAuthSocialProviderConfig {\n  clientId?: string\n  clientSecret?: string\n}\n\nexport interface AppAuthSocialConfig {\n  github?: AppAuthSocialProviderConfig\n  google?: AppAuthSocialProviderConfig\n}\n\n/** Cross-site Tangle SSO wiring. The factory supplies the better-auth side —\n *  `setSessionCookie` via `createBetterAuthSessionCookieMinter(auth)` (signed\n *  `__Secure-`/prefixed cookie that `auth.api.getSession` accepts) — so the\n *  product no longer touches `better-auth/crypto` itself. */\nexport interface AppAuthSsoConfig {\n  /** Platform wire client (authorizeUrl + exchange). */\n  client: TangleSsoAuthClient\n  /** Product persistence: user upsert, session row, platform link. */\n  store: TangleSsoAccountStore\n  /** Absolute callback URL registered with the platform. */\n  callbackUrl: string\n  /** Default 'tangle_sso_state'. */\n  stateCookieName?: string\n  /** HMAC secret for the CSRF state cookie. Default: the auth `secret`. */\n  stateSecret?: string\n  /** Default: `baseURL` is https. Must match better-auth's own\n   *  secure-cookie decision or the cookie name lookup diverges. */\n  secureCookies?: boolean\n  sessionTtlSeconds?: number\n  stateTtlSeconds?: number\n  /** Post-login redirect fallback. Default '/app'. */\n  defaultRedirectPath?: string\n  /** Default: the top-level `loginPath`. */\n  loginPath?: string\n  /** Failure log hook (e.g. console.error). Default no-op. */\n  log?: (message: string, error?: unknown) => void\n}\n\nexport interface AppAuthSchema {\n  users: unknown\n  sessions: unknown\n  accounts: unknown\n  verifications: unknown\n}\n\nexport interface AppAuthConfig {\n  /** Product name — used in email subjects and as the cookie-prefix default. */\n  appName: string\n  /** Absolute origin better-auth serves from (`BETTER_AUTH_URL`). */\n  baseURL: string\n  /** better-auth HMAC secret. Optional only because better-auth falls back to\n   *  the BETTER_AUTH_SECRET env var; `sso` needs it explicitly (or\n   *  `sso.stateSecret`). */\n  secret?: string\n  trustedOrigins?: string[]\n  /**\n   * Session-cookie prefix. Default: slugified `appName`. A per-app prefix is\n   * load-bearing, not cosmetic: the platform (id.tangle.tools) mints its own\n   * better-auth cookie `Domain=.tangle.tools`-wide under the DEFAULT name, and\n   * the platform's (older) cookie wins the Cookie-header order — an app on the\n   * default prefix reads the platform's token, fails its own signature check,\n   * and every fresh login lands back on /login.\n   */\n  cookiePrefix?: string\n  /** Drizzle database instance; wired through better-auth's drizzle adapter\n   *  together with `schema`. */\n  db?: unknown\n  /** The product's users/sessions/accounts/verifications tables (mapped to\n   *  better-auth's user/session/account/verification models). */\n  schema?: AppAuthSchema\n  /** Drizzle dialect. Default 'sqlite' (D1). */\n  provider?: 'sqlite' | 'pg' | 'mysql'\n  /** Escape hatch: a pre-built better-auth database adapter (e.g.\n   *  `memoryAdapter` in tests). Wins over `db`/`schema`. */\n  database?: BetterAuthOptions['database']\n  /** Email+password sign-in. Default true (all current products enable it). */\n  emailAndPassword?: boolean\n  /** Reset/verification mail. Omit to disable password reset entirely. */\n  email?: AppAuthEmailConfig\n  social?: AppAuthSocialConfig\n  /** Session cookie-cache TTL in seconds; `false` disables the cache.\n   *  Default 300. */\n  sessionCookieCacheSeconds?: number | false\n  /** Tangle cross-site SSO (start/callback handlers). */\n  sso?: AppAuthSsoConfig\n  /** Where guards redirect unauthenticated page requests. Default '/login'. */\n  loginPath?: string\n  /** Merged over the factory's `advanced` block (cookiePrefix stays unless\n   *  overridden here). */\n  advanced?: BetterAuthOptions['advanced']\n}\n\n/** The configured better-auth instance, typed at better-auth's base surface\n *  (`handler`, `api`, `$context`, `$Infer`). */\nexport type AppAuthInstance = Auth\n\n/** What `getSession`/guards resolve: better-auth's base session + user rows. */\nexport interface AppAuthSession {\n  session: Session\n  user: User\n}\n\nexport interface AppAuth extends AuthGuard<AppAuthSession> {\n  auth: AppAuthInstance\n  /** `auth.api.getSession` over a `Request` — the seam the guards consume. */\n  getSession(request: Request): Promise<AppAuthSession | null>\n  /** Tangle SSO start/callback handlers; null unless `sso` was configured. */\n  sso: TangleSsoHandlers | null\n}\n\n/** Lowercased, non-alphanumerics collapsed to '-': `'Legal Agent'` → `'legal-agent'`. */\nfunction slugify(name: string): string {\n  return name\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, '-')\n    .replace(/^-+|-+$/g, '')\n}\n\nfunction resolveEmailClient(email: AppAuthEmailConfig): AppAuthEmailClient | null {\n  return typeof email.resend === 'function' ? email.resend() : email.resend\n}\n\n/** Resend reports failures in the resolved value, not by rejecting — surface\n *  them loud so better-auth's flow (and the caller's logs) see the failure. */\nasync function sendEmail(\n  client: AppAuthEmailClient,\n  message: { from: string; to: string; subject: string; html: string; text: string },\n): Promise<void> {\n  const result = (await client.emails.send(message)) as { error?: { message?: string } | null } | null | undefined\n  if (result && typeof result === 'object' && result.error) {\n    throw new Error(`[app-auth] email send failed: ${result.error.message ?? 'unknown error'}`)\n  }\n}\n\nfunction resolveDatabase(config: AppAuthConfig): NonNullable<BetterAuthOptions['database']> {\n  if (config.database) return config.database\n  if (config.db && config.schema) {\n    return drizzleAdapter(config.db as Record<string, unknown>, {\n      provider: config.provider ?? 'sqlite',\n      schema: {\n        user: config.schema.users,\n        session: config.schema.sessions,\n        account: config.schema.accounts,\n        verification: config.schema.verifications,\n      } as Record<string, unknown>,\n    })\n  }\n  throw new Error(\n    'createAppAuth requires a database: pass `db` + `schema` (drizzle) or `database` (a better-auth adapter)',\n  )\n}\n\nfunction resolveSocialProviders(social: AppAuthSocialConfig | undefined): BetterAuthOptions['socialProviders'] {\n  const providers: NonNullable<BetterAuthOptions['socialProviders']> = {}\n  if (social?.github?.clientId && social.github.clientSecret) {\n    providers.github = { clientId: social.github.clientId, clientSecret: social.github.clientSecret }\n  }\n  if (social?.google?.clientId && social.google.clientSecret) {\n    providers.google = { clientId: social.google.clientId, clientSecret: social.google.clientSecret }\n  }\n  return Object.keys(providers).length > 0 ? providers : undefined\n}\n\nfunction emailAndPasswordOptions(config: AppAuthConfig): BetterAuthOptions['emailAndPassword'] {\n  const email = config.email\n  if (!email) return { enabled: true }\n  const warn = email.warn ?? ((message: string) => console.warn(message))\n  return {\n    enabled: true,\n    sendResetPassword: async ({ user, url }) => {\n      const client = resolveEmailClient(email)\n      if (!client) {\n        warn('[app-auth] email client unavailable — password reset email not sent')\n        return\n      }\n      await sendEmail(client, {\n        from: email.from,\n        to: user.email,\n        subject: 'Reset your password',\n        html: `<p>Click the link below to reset your password:</p><p><a href=\"${url}\">${url}</a></p><p>This link expires in 1 hour.</p>`,\n        text: `Reset your password:\\n\\n${url}\\n\\nThis link expires in 1 hour.`,\n      })\n    },\n  }\n}\n\nfunction emailVerificationOptions(config: AppAuthConfig): BetterAuthOptions['emailVerification'] {\n  const email = config.email\n  if (!email?.verifyOnSignUp) return undefined\n  const warn = email.warn ?? ((message: string) => console.warn(message))\n  return {\n    sendOnSignUp: true,\n    autoSignInAfterVerification: true,\n    sendVerificationEmail: async ({ user, url }) => {\n      const client = resolveEmailClient(email)\n      if (!client) {\n        warn('[app-auth] email client unavailable — verification email not sent')\n        return\n      }\n      await sendEmail(client, {\n        from: email.from,\n        to: user.email,\n        subject: `Verify your ${config.appName} email`,\n        html: `<p>Verify your email to finish accessing ${config.appName}:</p><p><a href=\"${url}\">${url}</a></p><p>This link expires in 1 hour.</p>`,\n        text: `Verify your email to finish accessing ${config.appName}:\\n\\n${url}\\n\\nThis link expires in 1 hour.`,\n      })\n    },\n  }\n}\n\n/**\n * Build the product's better-auth instance plus the request-boundary helpers:\n * `getSession` (Request → session|null), the `createAuthGuard` quartet\n * (`requireUser` 302, `requireApiUser` JSON 401, `requireSession`,\n * `getOptionalSession`), and — when `sso` is configured — the Tangle SSO\n * start/callback handlers with the session cookie minted through better-auth's\n * own name/attributes/signing (no `better-auth/crypto` in product code).\n */\nexport function createAppAuth(config: AppAuthConfig): AppAuth {\n  if (!config.appName) throw new Error('createAppAuth: appName is required')\n  if (!config.baseURL) throw new Error('createAppAuth: baseURL is required')\n\n  const cookiePrefix = config.cookiePrefix ?? slugify(config.appName)\n  if (!cookiePrefix) throw new Error('createAppAuth: cookiePrefix (or a slugifiable appName) is required')\n\n  const socialProviders = resolveSocialProviders(config.social)\n  const options: BetterAuthOptions = {\n    appName: config.appName,\n    baseURL: config.baseURL,\n    ...(config.secret ? { secret: config.secret } : {}),\n    ...(config.trustedOrigins ? { trustedOrigins: config.trustedOrigins } : {}),\n    database: resolveDatabase(config),\n    ...(config.emailAndPassword === false ? {} : { emailAndPassword: emailAndPasswordOptions(config) }),\n    ...(config.email?.verifyOnSignUp ? { emailVerification: emailVerificationOptions(config) } : {}),\n    ...(socialProviders ? { socialProviders } : {}),\n    ...(config.sessionCookieCacheSeconds === false\n      ? {}\n      : {\n          session: {\n            cookieCache: {\n              enabled: true,\n              maxAge: config.sessionCookieCacheSeconds ?? DEFAULT_SESSION_COOKIE_CACHE_SECONDS,\n            },\n          },\n        }),\n    advanced: { cookiePrefix, ...config.advanced },\n  }\n\n  const auth: AppAuthInstance = betterAuth(options)\n\n  const getSession = async (request: Request): Promise<AppAuthSession | null> => {\n    const session = await auth.api.getSession({ headers: request.headers })\n    return (session as AppAuthSession | null) ?? null\n  }\n\n  const loginPath = config.loginPath ?? '/login'\n  const guard = createAuthGuard<AppAuthSession>({ getSession, loginPath })\n\n  let sso: TangleSsoHandlers | null = null\n  if (config.sso) {\n    const stateSecret = config.sso.stateSecret ?? config.secret\n    if (!stateSecret) {\n      throw new Error(\n        'createAppAuth: sso requires `secret` (or sso.stateSecret) — the signed-state CSRF cookie needs an HMAC secret',\n      )\n    }\n    sso = createTangleSsoHandlers({\n      auth: config.sso.client,\n      store: config.sso.store,\n      stateSecret,\n      callbackUrl: config.sso.callbackUrl,\n      stateCookieName: config.sso.stateCookieName ?? DEFAULT_STATE_COOKIE,\n      setSessionCookie: createBetterAuthSessionCookieMinter(auth),\n      secureCookies: config.sso.secureCookies ?? config.baseURL.startsWith('https:'),\n      ...(config.sso.sessionTtlSeconds !== undefined ? { sessionTtlSeconds: config.sso.sessionTtlSeconds } : {}),\n      ...(config.sso.stateTtlSeconds !== undefined ? { stateTtlSeconds: config.sso.stateTtlSeconds } : {}),\n      ...(config.sso.defaultRedirectPath ? { defaultRedirectPath: config.sso.defaultRedirectPath } : {}),\n      loginPath: config.sso.loginPath ?? loginPath,\n      ...(config.sso.log ? { log: config.sso.log } : {}),\n    })\n  }\n\n  return { auth, getSession, ...guard, sso }\n}\n"],"mappings":";;;;;;;;;AAoBA,SAAS,kBAA8E;AACvF,SAAS,sBAAsB;AAU/B,IAAM,uBAAuB;AAC7B,IAAM,uCAAuC,IAAI;AA8IjD,SAAS,QAAQ,MAAsB;AACrC,SAAO,KACJ,YAAY,EACZ,QAAQ,eAAe,GAAG,EAC1B,QAAQ,YAAY,EAAE;AAC3B;AAEA,SAAS,mBAAmB,OAAsD;AAChF,SAAO,OAAO,MAAM,WAAW,aAAa,MAAM,OAAO,IAAI,MAAM;AACrE;AAIA,eAAe,UACb,QACA,SACe;AACf,QAAM,SAAU,MAAM,OAAO,OAAO,KAAK,OAAO;AAChD,MAAI,UAAU,OAAO,WAAW,YAAY,OAAO,OAAO;AACxD,UAAM,IAAI,MAAM,iCAAiC,OAAO,MAAM,WAAW,eAAe,EAAE;AAAA,EAC5F;AACF;AAEA,SAAS,gBAAgB,QAAmE;AAC1F,MAAI,OAAO,SAAU,QAAO,OAAO;AACnC,MAAI,OAAO,MAAM,OAAO,QAAQ;AAC9B,WAAO,eAAe,OAAO,IAA+B;AAAA,MAC1D,UAAU,OAAO,YAAY;AAAA,MAC7B,QAAQ;AAAA,QACN,MAAM,OAAO,OAAO;AAAA,QACpB,SAAS,OAAO,OAAO;AAAA,QACvB,SAAS,OAAO,OAAO;AAAA,QACvB,cAAc,OAAO,OAAO;AAAA,MAC9B;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,QAA+E;AAC7G,QAAM,YAA+D,CAAC;AACtE,MAAI,QAAQ,QAAQ,YAAY,OAAO,OAAO,cAAc;AAC1D,cAAU,SAAS,EAAE,UAAU,OAAO,OAAO,UAAU,cAAc,OAAO,OAAO,aAAa;AAAA,EAClG;AACA,MAAI,QAAQ,QAAQ,YAAY,OAAO,OAAO,cAAc;AAC1D,cAAU,SAAS,EAAE,UAAU,OAAO,OAAO,UAAU,cAAc,OAAO,OAAO,aAAa;AAAA,EAClG;AACA,SAAO,OAAO,KAAK,SAAS,EAAE,SAAS,IAAI,YAAY;AACzD;AAEA,SAAS,wBAAwB,QAA8D;AAC7F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,MAAO,QAAO,EAAE,SAAS,KAAK;AACnC,QAAM,OAAO,MAAM,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACrE,SAAO;AAAA,IACL,SAAS;AAAA,IACT,mBAAmB,OAAO,EAAE,MAAM,IAAI,MAAM;AAC1C,YAAM,SAAS,mBAAmB,KAAK;AACvC,UAAI,CAAC,QAAQ;AACX,aAAK,0EAAqE;AAC1E;AAAA,MACF;AACA,YAAM,UAAU,QAAQ;AAAA,QACtB,MAAM,MAAM;AAAA,QACZ,IAAI,KAAK;AAAA,QACT,SAAS;AAAA,QACT,MAAM,kEAAkE,GAAG,KAAK,GAAG;AAAA,QACnF,MAAM;AAAA;AAAA,EAA2B,GAAG;AAAA;AAAA;AAAA,MACtC,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,QAA+D;AAC/F,QAAM,QAAQ,OAAO;AACrB,MAAI,CAAC,OAAO,eAAgB,QAAO;AACnC,QAAM,OAAO,MAAM,SAAS,CAAC,YAAoB,QAAQ,KAAK,OAAO;AACrE,SAAO;AAAA,IACL,cAAc;AAAA,IACd,6BAA6B;AAAA,IAC7B,uBAAuB,OAAO,EAAE,MAAM,IAAI,MAAM;AAC9C,YAAM,SAAS,mBAAmB,KAAK;AACvC,UAAI,CAAC,QAAQ;AACX,aAAK,wEAAmE;AACxE;AAAA,MACF;AACA,YAAM,UAAU,QAAQ;AAAA,QACtB,MAAM,MAAM;AAAA,QACZ,IAAI,KAAK;AAAA,QACT,SAAS,eAAe,OAAO,OAAO;AAAA,QACtC,MAAM,4CAA4C,OAAO,OAAO,oBAAoB,GAAG,KAAK,GAAG;AAAA,QAC/F,MAAM,yCAAyC,OAAO,OAAO;AAAA;AAAA,EAAQ,GAAG;AAAA;AAAA;AAAA,MAC1E,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAUO,SAAS,cAAc,QAAgC;AAC5D,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,oCAAoC;AACzE,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,oCAAoC;AAEzE,QAAM,eAAe,OAAO,gBAAgB,QAAQ,OAAO,OAAO;AAClE,MAAI,CAAC,aAAc,OAAM,IAAI,MAAM,oEAAoE;AAEvG,QAAM,kBAAkB,uBAAuB,OAAO,MAAM;AAC5D,QAAM,UAA6B;AAAA,IACjC,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB,GAAI,OAAO,SAAS,EAAE,QAAQ,OAAO,OAAO,IAAI,CAAC;AAAA,IACjD,GAAI,OAAO,iBAAiB,EAAE,gBAAgB,OAAO,eAAe,IAAI,CAAC;AAAA,IACzE,UAAU,gBAAgB,MAAM;AAAA,IAChC,GAAI,OAAO,qBAAqB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,wBAAwB,MAAM,EAAE;AAAA,IACjG,GAAI,OAAO,OAAO,iBAAiB,EAAE,mBAAmB,yBAAyB,MAAM,EAAE,IAAI,CAAC;AAAA,IAC9F,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;AAAA,IAC7C,GAAI,OAAO,8BAA8B,QACrC,CAAC,IACD;AAAA,MACE,SAAS;AAAA,QACP,aAAa;AAAA,UACX,SAAS;AAAA,UACT,QAAQ,OAAO,6BAA6B;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,IACJ,UAAU,EAAE,cAAc,GAAG,OAAO,SAAS;AAAA,EAC/C;AAEA,QAAM,OAAwB,WAAW,OAAO;AAEhD,QAAM,aAAa,OAAO,YAAqD;AAC7E,UAAM,UAAU,MAAM,KAAK,IAAI,WAAW,EAAE,SAAS,QAAQ,QAAQ,CAAC;AACtE,WAAQ,WAAqC;AAAA,EAC/C;AAEA,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,QAAQ,gBAAgC,EAAE,YAAY,UAAU,CAAC;AAEvE,MAAI,MAAgC;AACpC,MAAI,OAAO,KAAK;AACd,UAAM,cAAc,OAAO,IAAI,eAAe,OAAO;AACrD,QAAI,CAAC,aAAa;AAChB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAwB;AAAA,MAC5B,MAAM,OAAO,IAAI;AAAA,MACjB,OAAO,OAAO,IAAI;AAAA,MAClB;AAAA,MACA,aAAa,OAAO,IAAI;AAAA,MACxB,iBAAiB,OAAO,IAAI,mBAAmB;AAAA,MAC/C,kBAAkB,oCAAoC,IAAI;AAAA,MAC1D,eAAe,OAAO,IAAI,iBAAiB,OAAO,QAAQ,WAAW,QAAQ;AAAA,MAC7E,GAAI,OAAO,IAAI,sBAAsB,SAAY,EAAE,mBAAmB,OAAO,IAAI,kBAAkB,IAAI,CAAC;AAAA,MACxG,GAAI,OAAO,IAAI,oBAAoB,SAAY,EAAE,iBAAiB,OAAO,IAAI,gBAAgB,IAAI,CAAC;AAAA,MAClG,GAAI,OAAO,IAAI,sBAAsB,EAAE,qBAAqB,OAAO,IAAI,oBAAoB,IAAI,CAAC;AAAA,MAChG,WAAW,OAAO,IAAI,aAAa;AAAA,MACnC,GAAI,OAAO,IAAI,MAAM,EAAE,KAAK,OAAO,IAAI,IAAI,IAAI,CAAC;AAAA,IAClD,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,MAAM,YAAY,GAAG,OAAO,IAAI;AAC3C;","names":[]}

package/dist/assets/index.d.ts

@@ -276,8 +276,8 @@ declare const ImageContentSchema: z.ZodObject<{
             width: z.ZodOptional<z.ZodNumber>;
             align: z.ZodOptional<z.ZodEnum<{
                 left: "left";
-                center: "center";
                 right: "right";
+                center: "center";
             }>>;
         }, z.core.$strip>, z.ZodObject<{
             type: z.ZodLiteral<"image">;
@@ -371,8 +371,8 @@ declare const VideoContentSchema: z.ZodObject<{
                 width: z.ZodOptional<z.ZodNumber>;
                 align: z.ZodOptional<z.ZodEnum<{
                     left: "left";
-                    center: "center";
                     right: "right";
+                    center: "center";
                 }>>;
             }, z.core.$strip>, z.ZodObject<{
                 type: z.ZodLiteral<"image">;

package/dist/assistant/index.d.ts

@@ -1,12 +1,14 @@
 import * as react from 'react';
 import { ReactNode } from 'react';
 import { ToolDetailRenderers, ChatUiMessage } from '../web-react/index.js';
+import '../contract-DYbTzEDf.js';
 import '@tangle-network/agent-interface';
 import '../agent-activity-C8ZG0F0M.js';
 import '../flow-types-Cb_AblZs.js';
 import '../sandbox-terminal-BIIC__CP.js';
 import '../catalog/index.js';
 import '../harness/index.js';
+import '../wire-BaUF66AS.js';
 
 /**
  * Wire + UI types for the in-app assistant panel. The wire shapes mirror the

package/dist/assistant/index.js

@@ -3,9 +3,11 @@ import {
   ChatMessages,
   ModelPicker,
   ProviderLogo
-} from "../chunk-VMY4TKMN.js";
+} from "../chunk-FCQP75JT.js";
 import "../chunk-65P3HJY3.js";
+import "../chunk-5SV5PSU7.js";
 import "../chunk-2QI7XV2T.js";
+import "../chunk-4TXDD6P2.js";
 import "../chunk-E7QYOOON.js";
 
 // src/assistant/sse.ts