ugly-app 0.1.460 → 0.1.463

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ugly-app",
-  "version": "0.1.460",
+  "version": "0.1.463",
   "type": "module",
   "main": "./dist/server/index.js",
   "exports": {

package/src/cli/deployTar.ts

@@ -12,10 +12,13 @@ export function createTarGz(sourceDir: string, outPath: string): void {
 
 export function createServerTarGz(projectRoot: string, outPath: string): void {
   // Include dist/server, dist/client/index.html (SPA template), package.json,
-  // and server/migrations/ (needed for db:migrate at deploy time)
+  // server/migrations/ (needed for db:migrate at deploy time), and data/
+  // (project-level seed/asset data that migrations or runtime code may
+  // reference via fs reads).
   const migrationsDir = path.join(projectRoot, 'server', 'migrations');
-  const hasMigrations = fs.existsSync(migrationsDir);
+  const dataDir = path.join(projectRoot, 'data');
   const paths = ['dist/server', 'dist/client/index.html', 'package.json'];
-  if (hasMigrations) paths.push('server/migrations');
+  if (fs.existsSync(migrationsDir)) paths.push('server/migrations');
+  if (fs.existsSync(dataDir)) paths.push('data');
   execSync(`tar ${TAR_FLAGS} -czf ${outPath} -C ${projectRoot} ${paths.join(' ')}`);
 }

package/src/cli/version.ts

@@ -1,2 +1,2 @@
 // Auto-generated by prebuild — do not edit manually
-export const CLI_VERSION = "0.1.460";
+export const CLI_VERSION = "0.1.463";

package/src/server/App.ts

@@ -38,6 +38,7 @@ import {
 } from "./EventCounter.js";
 import {
   createAuthRoutes,
+  getRequestUser,
   uglyBotAuthProvider,
   verifyToken,
   type AuthProvider,
@@ -85,7 +86,7 @@ import {
   type Experiment,
 } from "../shared/Experiment.js";
 
-export { verifyToken };
+export { getRequestUser, verifyToken };
 
 function validateEnv(): void {
   // All tokens are issued and verified by ugly.bot — no local secrets needed
@@ -652,6 +653,19 @@ export function createApp<
     storeHandlers,
   );
 
+  // Track timestamp of last user-facing request. Used by ugly.bot's
+  // orchestrator to drive scale-to-zero: /health responses include
+  // `lastRequestAt`, and the orchestrator sleeps the instance once it
+  // exceeds the configured idle timeout. We deliberately exclude
+  // /health and /_* paths so internal probes don't keep the app awake.
+  let lastRequestAt = Date.now();
+  expressApp.use((req, _res, next) => {
+    if (req.path !== "/health" && !req.path.startsWith("/_")) {
+      lastRequestAt = Date.now();
+    }
+    next();
+  });
+
   // Health endpoint — registered before auth middleware.
   // If the app provides a custom handler via setHealthHandler(), it takes precedence.
   expressApp.get("/health", (req, res) => {
@@ -659,7 +673,11 @@ export function createApp<
       void Promise.resolve(healthHandler(req, res));
       return;
     }
-    res.json({ status: "ok", timestamp: new Date().toISOString() });
+    res.json({
+      status: "ok",
+      timestamp: new Date().toISOString(),
+      lastRequestAt,
+    });
   });
 
   // ─── Worker endpoints ─────────────────────────────────────────────────────

package/src/server/Auth.ts

@@ -1,5 +1,6 @@
 import type { Request, Response } from 'express';
 import express from 'express';
+import jwt from 'jsonwebtoken';
 import type { TypedDB, UserHelper } from '../shared/DB.js';
 import { AuthError } from '../shared/Errors.js';
 import { getUglyBotUrl } from '../shared/uglyBotUrl.js';
@@ -22,6 +23,54 @@ export async function verifyToken(token: string): Promise<string> {
   return data.userId;
 }
 
+const PROJECT_COOKIE_NAME = 'UGLY_PROJECT_TOKEN';
+
+interface ProjectTokenPayload {
+  userId: string;
+  projectId: string;
+}
+
+/**
+ * Decode the per-project session token that ugly.bot's wake-on-traffic
+ * gate sets when a logged-in visitor first reaches a deployed app.
+ * Returns `{ userId }` on success, `null` when the cookie is missing,
+ * the signature is bad, the token has expired, or the embedded
+ * `projectId` doesn't match the current project. Synchronous — no
+ * roundtrip to ugly.bot — because the orchestrator and the deployed
+ * app share `JWT_SECRET`.
+ *
+ * Use this as the primary auth source in deployed-app handlers; it
+ * lets you trust the visitor's identity without proxying anything.
+ * Falls back to null in dev (no cookie set) so callers can decide
+ * whether to require auth.
+ */
+export function getRequestUser(req: Request): { userId: string } | null {
+  const cookieHeader = req.headers.cookie;
+  if (!cookieHeader) return null;
+  const token = cookieHeader
+    .split(';')
+    .map((c) => c.trim())
+    .find((c) => c.startsWith(`${PROJECT_COOKIE_NAME}=`))
+    ?.slice(PROJECT_COOKIE_NAME.length + 1);
+  if (!token) return null;
+
+  const secret = process.env.JWT_SECRET;
+  const projectId = process.env.NATS_PREFIX ?? process.env.APP_DOMAIN;
+  if (!secret || !projectId) return null;
+
+  try {
+    const decoded = jwt.verify(token, secret) as ProjectTokenPayload & {
+      iat?: number;
+      exp?: number;
+    };
+    if (decoded.projectId !== projectId) return null;
+    if (typeof decoded.userId !== 'string' || !decoded.userId) return null;
+    return { userId: decoded.userId };
+  } catch {
+    return null;
+  }
+}
+
 export interface AuthProvider {
   // Called by server when client submits an auth code.
   // Returns a provider-issued `token` from ugly.bot OAuth.

package/src/server/ai/TextGenBase.ts

@@ -218,11 +218,29 @@ export interface MessageContentToolResult {
   content: string;
 }
 
+/**
+ * Anthropic-style reasoning block on an assistant message. Carried in
+ * history so providers that require thinking-block round-trip on
+ * follow-up turns (DeepSeek's /anthropic/v1/messages gateway, Anthropic
+ * direct, Kimi) can re-emit them. Plaintext `thinking` carries an
+ * optional `signature` (Anthropic mints these so the gateway can verify
+ * the block round-tripped unchanged); `redacted_data` carries an opaque
+ * payload that the gateway expects echoed verbatim. Providers without a
+ * round-trip requirement ignore the block.
+ */
+export interface MessageContentThinking {
+  type: 'thinking';
+  thinking?: string;
+  signature?: string;
+  redacted_data?: string;
+}
+
 export type MessageContentDetail =
   | MessageContentTextDetail
   | MessageContentImageDetail
   | MessageContentToolUse
-  | MessageContentToolResult;
+  | MessageContentToolResult
+  | MessageContentThinking;
 
 export type MessageContent = string | MessageContentDetail[];
 

package/src/server/index.ts

@@ -69,7 +69,7 @@ export {
   stringsVersion,
 } from './Strings.js';
 export type { StringsServerConfig } from './Strings.js';
-export { createApp, verifyToken } from './App.js';
+export { createApp, getRequestUser, verifyToken } from './App.js';
 export type { App, AppConfigurator, PageServerOptions, WorkerQueue } from './App.js';
 export { checkSchemas, updateAllSnapshots } from './SchemaCheck.js';
 export type { SchemaCheckResult, CollectionCheckResult } from './SchemaCheck.js';

package/src/shared/AiProxy.ts

@@ -45,6 +45,30 @@ export const cacheControlSchema = z.object({
 });
 export type CacheControl = z.infer<typeof cacheControlSchema>;
 
+/**
+ * Anthropic-style reasoning block emitted by a thinking-capable
+ * upstream and round-tripped on subsequent assistant turns. DeepSeek's
+ * /anthropic/v1/messages gateway 400s on multi-turn requests when an
+ * assistant message in history is missing the `thinking` block from
+ * the response that produced it ("The `content[].thinking` in the
+ * thinking mode must be passed back to the API"). Anthropic and Kimi
+ * have similar requirements when thinking is on. Carrying these on
+ * the wire lets the studio persist + re-emit them on follow-up turns.
+ *
+ * Exactly one of `thinking` or `redacted_data` is set:
+ *   - `thinking` : plaintext reasoning body. `signature` is the
+ *     opaque token Anthropic mints to verify it round-tripped
+ *     unchanged; pass-through providers leave `signature` undefined.
+ *   - `redacted_data` : opaque payload from a `redacted_thinking`
+ *     block — the gateway expects it echoed verbatim.
+ */
+export const reasoningBlockSchema = z.object({
+  thinking: z.string().optional(),
+  signature: z.string().optional(),
+  redacted_data: z.string().optional(),
+});
+export type ReasoningBlockWire = z.infer<typeof reasoningBlockSchema>;
+
 export const aiProxyMessageSchema = z.object({
   role: z.enum(['system', 'user', 'assistant', 'tool']),
   content: z
@@ -71,6 +95,14 @@ export const aiProxyMessageSchema = z.object({
    * unaware providers ignore the field.
    */
   cache_control: cacheControlSchema.optional(),
+  /**
+   * Provider-emitted reasoning blocks, in order, for assistant
+   * messages produced under thinking mode. Forwarded to providers
+   * that require round-trip (DeepSeek's Anthropic gateway, Kimi,
+   * Anthropic direct). Cache-aware providers without a round-trip
+   * requirement ignore the field; OpenAI-format paths drop it.
+   */
+  reasoning_content: z.array(reasoningBlockSchema).optional(),
 });
 export type AiProxyMessage = z.infer<typeof aiProxyMessageSchema>;
 

package/src/shared/TextGen.ts

@@ -1287,7 +1287,22 @@ export type ContentPart =
     }
   | { type: 'image_url'; image_url?: { url: string } }
   | { type: 'tool_use'; id: string; name: string; input: unknown }
-  | { type: 'tool_result'; tool_use_id: string; content: string };
+  | { type: 'tool_result'; tool_use_id: string; content: string }
+  /**
+   * Provider-emitted reasoning block round-tripped on assistant
+   * messages. Required by gateways that reject multi-turn requests
+   * when the assistant message in history is missing the thinking
+   * content from the response that produced it (DeepSeek's
+   * /anthropic/v1/messages, Anthropic direct, Kimi). Exactly one of
+   * `thinking` or `redacted_data` is set; cache-aware non-thinking
+   * providers ignore the type entirely.
+   */
+  | {
+      type: 'thinking';
+      thinking?: string;
+      signature?: string;
+      redacted_data?: string;
+    };
 
 export interface Message {
   role: 'system' | 'user' | 'assistant';

package/dist/cli/authCommands.d.ts

@@ -1,9 +0,0 @@
-export declare function createAccount(email: string, name?: string): Promise<{
-    userId: string;
-    email: string;
-}>;
-export declare function createBot(slug: string, name: string): Promise<{
-    userId: string;
-    token: string;
-}>;
-//# sourceMappingURL=authCommands.d.ts.map

package/dist/cli/authCommands.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authCommands.d.ts","sourceRoot":"","sources":["../../src/cli/authCommands.ts"],"names":[],"mappings":"AAKA,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqC5C;AAED,wBAAsB,SAAS,CAC7B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwD5C"}

package/dist/cli/authCommands.js

@@ -1,86 +0,0 @@
-import { nanoid } from 'nanoid';
-import { getUglyBotUrl } from '../shared/uglyBotUrl.js';
-import { initDataProxy, pgQuery, stopDataProxy, ensureTable } from '../server/DataProxyClient.js';
-import { migrateTokensFromUglyApp, readAuthToken } from './authStore.js';
-export async function createAccount(email, name) {
-    const proxyUrl = process.env['DATA_PROXY_URL'] ?? 'ws://localhost:4200';
-    const proxyToken = process.env['DATA_PROXY_TOKEN'] ?? '';
-    await initDataProxy(proxyUrl, proxyToken);
-    try {
-        await ensureTable('user');
-        // Check for existing user
-        const existing = await pgQuery(`SELECT data FROM "user" WHERE data->>'email' = $1 LIMIT 1`, [email]);
-        if (existing.rows.length > 0) {
-            const userData = existing.rows[0].data;
-            return { userId: String(userData['id']), email };
-        }
-        const now = Date.now();
-        const userId = nanoid();
-        const userData = {
-            id: userId,
-            email,
-            name: name ?? email.split('@')[0],
-            version: 1,
-            created: now,
-            updated: now,
-        };
-        await pgQuery(`INSERT INTO "user" (_id, data, created) VALUES ($1, $2, to_timestamp($3 / 1000.0))`, [userId, JSON.stringify(userData), now]);
-        return { userId, email };
-    }
-    finally {
-        stopDataProxy();
-    }
-}
-export async function createBot(slug, name) {
-    const fs = await import('fs');
-    let projectToken = '';
-    let projectId = '';
-    // Migrate any legacy .uglyapp tokens into ~/.ugly-bot/ first.
-    migrateTokensFromUglyApp(process.cwd());
-    // Read projectId (and any leftover inline token) from .uglyapp.
-    try {
-        const config = JSON.parse(fs.readFileSync('.uglyapp', 'utf-8'));
-        if (typeof config.projectId === 'string')
-            projectId = config.projectId;
-        if (typeof config.uglyBotToken === 'string')
-            projectToken = config.uglyBotToken;
-    }
-    catch { /* no .uglyapp */ }
-    // Primary source: ~/.ugly-bot/ auth store (where `npx ugly-app login` writes tokens).
-    if (!projectToken && projectId) {
-        const stored = readAuthToken(projectId);
-        if (stored)
-            projectToken = stored;
-    }
-    // Fall back to .env for backwards compatibility
-    if (!projectToken) {
-        try {
-            const envContent = fs.readFileSync('.env', 'utf-8');
-            const tokenMatch = /^UGLY_BOT_TOKEN=(.+)$/m.exec(envContent);
-            if (tokenMatch?.[1])
-                projectToken = tokenMatch[1];
-        }
-        catch { /* no .env either */ }
-    }
-    if (!projectToken) {
-        throw new Error('No project auth token found. Run "npx ugly-app login" in this project to authenticate.');
-    }
-    const serverUrl = getUglyBotUrl();
-    const res = await fetch(`${serverUrl}/request`, {
-        method: 'POST',
-        headers: {
-            'Authorization': `Bearer ${projectToken}`,
-            'Content-Type': 'application/json',
-        },
-        body: JSON.stringify({
-            op: 'appBotAccountCreate',
-            input: { slug, name },
-        }),
-    });
-    if (!res.ok) {
-        const body = await res.text().catch(() => '');
-        throw new Error(`Failed to create bot account: ${res.status} ${body}`);
-    }
-    return (await res.json());
-}
-//# sourceMappingURL=authCommands.js.map

package/dist/cli/authCommands.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authCommands.js","sourceRoot":"","sources":["../../src/cli/authCommands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEzE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,IAAa;IAEb,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,qBAAqB,CAAC;IACxE,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QAE1B,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,2DAA2D,EAC3D,CAAC,KAAK,CAAC,CACR,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG;YACf,EAAE,EAAE,MAAM;YACV,KAAK;YACL,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC;YACV,OAAO,EAAE,GAAG;YACZ,OAAO,EAAE,GAAG;SACb,CAAC;QAEF,MAAM,OAAO,CACX,oFAAoF,EACpF,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CACxC,CAAC;QAEF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,aAAa,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,IAAY;IAEZ,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,SAAS,GAAG,EAAE,CAAC;IAEnB,8DAA8D;IAC9D,wBAAwB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAExC,gEAAgE;IAChE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC3F,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACvE,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YAAE,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAE7B,sFAAsF;IACtF,IAAI,CAAC,YAAY,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,YAAY,GAAG,MAAM,CAAC;IACpC,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACpD,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC7D,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC;gBAAE,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;IAElC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,SAAS,UAAU,EAAE;QAC9C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,eAAe,EAAE,UAAU,YAAY,EAAE;YACzC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;SACtB,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;AACjE,CAAC"}

package/dist/cli/authStore.d.ts

@@ -1,13 +0,0 @@
-export declare function readAuthToken(projectId: string): string | undefined;
-export declare function writeAuthToken(projectId: string, token: string): void;
-export declare function readLocalToken(projectId: string): string | undefined;
-export declare function writeLocalToken(projectId: string, token: string): void;
-/**
- * Migrate tokens from .uglyapp to ~/.ugly-bot/ auth store.
- * Called on first read — if .uglyapp contains tokens, moves them to the new location
- * and strips them from .uglyapp.
- */
-export declare function migrateTokensFromUglyApp(cwd: string): void;
-/** Test hook: re-arm migration on the next call. */
-export declare function __resetMigrationForTest(): void;
-//# sourceMappingURL=authStore.d.ts.map

package/dist/cli/authStore.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"authStore.d.ts","sourceRoot":"","sources":["../../src/cli/authStore.ts"],"names":[],"mappings":"AA+DA,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnE;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAErE;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAEtE;AAmDD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAkC1D;AAED,oDAAoD;AACpD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C"}

package/dist/cli/authStore.js

@@ -1,154 +0,0 @@
-/**
- * Per-project auth tokens, one file per project.
- *
- *   ~/.ugly-bot/auth.json           — global user identity only
- *                                     ({ token, userId, serverUrl }, see uglyBotAuth.ts)
- *   ~/.ugly-bot/<projectId>.json    — cloud project token  ({ token })
- *   ~/.ugly-bot/<projectId>.local.json — local project token  ({ token })
- *
- * One file per project keeps `auth.json` strictly global so the studio
- * sandbox can seed it into the per-project sandbox HOME without leaking
- * other projects' tokens.
- *
- * Legacy layout (single `auth.json` / `local.json` with a `projects`
- * map) is migrated on first read.
- */
-import fs from 'node:fs';
-import path from 'node:path';
-import os from 'node:os';
-const AUTH_DIR = path.join(os.homedir(), '.ugly-bot');
-const AUTH_FILE = path.join(AUTH_DIR, 'auth.json');
-const LOCAL_FILE = path.join(AUTH_DIR, 'local.json');
-function projectFile(projectId, mode) {
-    const suffix = mode === 'local' ? '.local.json' : '.json';
-    return path.join(AUTH_DIR, `${projectId}${suffix}`);
-}
-function readJson(filePath) {
-    try {
-        const raw = fs.readFileSync(filePath, 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (parsed && typeof parsed === 'object')
-            return parsed;
-    }
-    catch {
-        // File doesn't exist or is malformed
-    }
-    return null;
-}
-function readProjectToken(projectId, mode) {
-    ensureMigrated();
-    const data = readJson(projectFile(projectId, mode));
-    if (data && typeof data.token === 'string')
-        return data.token;
-    return undefined;
-}
-function writeProjectToken(projectId, mode, token) {
-    ensureMigrated();
-    fs.mkdirSync(AUTH_DIR, { recursive: true });
-    fs.writeFileSync(projectFile(projectId, mode), JSON.stringify({ token }, null, 2) + '\n', 'utf-8');
-}
-export function readAuthToken(projectId) {
-    return readProjectToken(projectId, 'cloud');
-}
-export function writeAuthToken(projectId, token) {
-    writeProjectToken(projectId, 'cloud', token);
-}
-export function readLocalToken(projectId) {
-    return readProjectToken(projectId, 'local');
-}
-export function writeLocalToken(projectId, token) {
-    writeProjectToken(projectId, 'local', token);
-}
-let migrationChecked = false;
-/**
- * Idempotent. Splits legacy `auth.json.projects` / `local.json.projects`
- * into per-project files and strips the `projects` key from `auth.json`
- * (deletes `local.json` outright since it had no global data). Runs at
- * most once per process, gated by a module-local flag — repeated reads
- * don't re-stat every file.
- */
-function ensureMigrated() {
-    if (migrationChecked)
-        return;
-    migrationChecked = true;
-    migrateLegacyFile(AUTH_FILE, 'cloud');
-    migrateLegacyFile(LOCAL_FILE, 'local');
-}
-function migrateLegacyFile(filePath, mode) {
-    const data = readJson(filePath);
-    if (!data)
-        return;
-    const projects = data.projects;
-    if (!projects || typeof projects !== 'object')
-        return;
-    fs.mkdirSync(AUTH_DIR, { recursive: true });
-    for (const [projectId, entry] of Object.entries(projects)) {
-        if (!entry || typeof entry !== 'object')
-            continue;
-        const token = entry.token;
-        if (typeof token !== 'string')
-            continue;
-        const target = projectFile(projectId, mode);
-        // Don't clobber a per-project file the user may already have written.
-        if (fs.existsSync(target))
-            continue;
-        fs.writeFileSync(target, JSON.stringify({ token }, null, 2) + '\n', 'utf-8');
-    }
-    if (mode === 'cloud') {
-        // auth.json keeps its global fields (token, userId, serverUrl) — just drop `projects`.
-        delete data.projects;
-        fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
-    }
-    else {
-        // local.json had no global data — remove it entirely.
-        try {
-            fs.unlinkSync(filePath);
-        }
-        catch {
-            /* already gone */
-        }
-    }
-}
-/**
- * Migrate tokens from .uglyapp to ~/.ugly-bot/ auth store.
- * Called on first read — if .uglyapp contains tokens, moves them to the new location
- * and strips them from .uglyapp.
- */
-export function migrateTokensFromUglyApp(cwd) {
-    const configPath = path.join(cwd, '.uglyapp');
-    try {
-        const raw = fs.readFileSync(configPath, 'utf-8');
-        const config = JSON.parse(raw);
-        if (!config.projectId || typeof config.projectId !== 'string')
-            return;
-        let changed = false;
-        if (typeof config.uglyBotToken === 'string') {
-            const existing = readAuthToken(config.projectId);
-            if (!existing) {
-                writeAuthToken(config.projectId, config.uglyBotToken);
-            }
-            delete config.uglyBotToken;
-            changed = true;
-        }
-        if (typeof config.localToken === 'string') {
-            const existing = readLocalToken(config.projectId);
-            if (!existing) {
-                writeLocalToken(config.projectId, config.localToken);
-            }
-            delete config.localToken;
-            changed = true;
-        }
-        if (changed) {
-            fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', 'utf-8');
-            console.log('[uglyapp] Migrated tokens from .uglyapp to ~/.ugly-bot/');
-        }
-    }
-    catch {
-        // .uglyapp doesn't exist or is malformed — skip migration
-    }
-}
-/** Test hook: re-arm migration on the next call. */
-export function __resetMigrationForTest() {
-    migrationChecked = false;
-}
-//# sourceMappingURL=authStore.js.map

package/dist/cli/authStore.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"authStore.js","sourceRoot":"","sources":["../../src/cli/authStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAErD,SAAS,WAAW,CAAC,SAAiB,EAAE,IAAuB;IAC7D,MAAM,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,SAAiB,EACjB,IAAuB;IAEvB,cAAc,EAAE,CAAC;IACjB,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IACpD,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,iBAAiB,CACxB,SAAiB,EACjB,IAAuB,EACvB,KAAa;IAEb,cAAc,EAAE,CAAC;IACjB,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,EAAE,CAAC,aAAa,CACd,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACzC,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,KAAa;IAC7D,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,OAAO,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,KAAa;IAC9D,iBAAiB,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,IAAI,gBAAgB,GAAG,KAAK,CAAC;AAE7B;;;;;;GAMG;AACH,SAAS,cAAc;IACrB,IAAI,gBAAgB;QAAE,OAAO;IAC7B,gBAAgB,GAAG,IAAI,CAAC;IACxB,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtC,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,IAAuB;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO;IAEtD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAC7C,QAAmC,CACpC,EAAE,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,KAAK,GAAI,KAA6B,CAAC,KAAK,CAAC;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC5C,sEAAsE;QACtE,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QACpC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,uFAAuF;QACvF,OAAO,IAAI,CAAC,QAAQ,CAAC;QACrB,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,sDAAsD;QACtD,IAAI,CAAC;YACH,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO;QAEtE,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,MAAM,CAAC,YAAY,CAAC;YAC3B,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,uBAAuB;IACrC,gBAAgB,GAAG,KAAK,CAAC;AAC3B,CAAC"}

package/dist/cli/bootstrapMigration.d.ts

@@ -1,18 +0,0 @@
-interface CollectionBootstrapConfig {
-    indexes?: {
-        fields: Record<string, 1 | -1>;
-        unique?: boolean;
-        ttl?: number;
-    }[];
-    search?: {
-        fields: string[];
-        language?: string;
-    };
-    vector?: {
-        dimensions: number;
-        source: string;
-    };
-}
-export declare function generateBootstrapMigration(collections: Record<string, CollectionBootstrapConfig>): string;
-export {};
-//# sourceMappingURL=bootstrapMigration.d.ts.map

package/dist/cli/bootstrapMigration.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootstrapMigration.d.ts","sourceRoot":"","sources":["../../src/cli/bootstrapMigration.ts"],"names":[],"mappings":"AAAA,UAAU,yBAAyB;IACjC,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC/E,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,MAAM,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjD;AAED,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,yBAAyB,CAAC,GACrD,MAAM,CAyDR"}

package/dist/cli/bootstrapMigration.js

@@ -1,44 +0,0 @@
-export function generateBootstrapMigration(collections) {
-    // Sort collection names for deterministic output
-    const tableNames = Object.keys(collections).sort();
-    // Build CREATE TABLE statements
-    const createTableStatements = tableNames.map((name) => `  await query(\`CREATE TABLE IF NOT EXISTS "${name}" (\n` +
-        `    _id      TEXT PRIMARY KEY,\n` +
-        `    data     JSONB NOT NULL,\n` +
-        `    created  TIMESTAMPTZ NOT NULL DEFAULT now(),\n` +
-        `    updated  TIMESTAMPTZ NOT NULL DEFAULT now(),\n` +
-        `    version  INTEGER NOT NULL DEFAULT 1\n` +
-        `  )\`);` +
-        `\n  await query(\`CREATE INDEX IF NOT EXISTS "idx_${name}_data" ON "${name}" USING GIN (data)\`);`);
-    // Build per-collection index SQL statements
-    const indexStatements = [];
-    for (const name of tableNames) {
-        const config = collections[name];
-        for (const idx of config.indexes ?? []) {
-            const fields = Object.keys(idx.fields);
-            if (idx.unique && fields.length === 1) {
-                const field = fields[0];
-                indexStatements.push(`  await query(\`CREATE UNIQUE INDEX IF NOT EXISTS "idx_${name}_${field}_unique" ON "${name}" ((data->>'${field}'))\`);`);
-            }
-            if (idx.ttl !== undefined) {
-                const field = fields[0];
-                indexStatements.push(`  await query(\`CREATE INDEX IF NOT EXISTS "idx_${name}_${field}" ON "${name}" ((data->>'${field}'))\`);`);
-            }
-        }
-        if (config.search) {
-            indexStatements.push(`  await query(\`ALTER TABLE "${name}" ADD COLUMN IF NOT EXISTS search TSVECTOR\`);`);
-            indexStatements.push(`  await query(\`CREATE INDEX IF NOT EXISTS "idx_${name}_search" ON "${name}" USING GIN (search)\`);`);
-        }
-    }
-    const allStatements = [...createTableStatements, ...indexStatements];
-    return `import type { query as pgQuery } from 'ugly-app/server';
-
-// Bootstrap migration — creates all tables and indexes.
-// Generated automatically. Safe to run on existing databases.
-
-export async function up(query: typeof pgQuery): Promise<void> {
-${allStatements.join('\n')}
-}
-`;
-}
-//# sourceMappingURL=bootstrapMigration.js.map

package/dist/cli/bootstrapMigration.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"bootstrapMigration.js","sourceRoot":"","sources":["../../src/cli/bootstrapMigration.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,0BAA0B,CACxC,WAAsD;IAEtD,iDAAiD;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAEnD,gCAAgC;IAChC,MAAM,qBAAqB,GAAG,UAAU,CAAC,GAAG,CAC1C,CAAC,IAAI,EAAE,EAAE,CACP,+CAA+C,IAAI,OAAO;QAC1D,kCAAkC;QAClC,gCAAgC;QAChC,oDAAoD;QACpD,oDAAoD;QACpD,2CAA2C;QAC3C,SAAS;QACT,qDAAqD,IAAI,cAAc,IAAI,wBAAwB,CACtG,CAAC;IAEF,4CAA4C;IAC5C,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxB,eAAe,CAAC,IAAI,CAClB,0DAA0D,IAAI,IAAI,KAAK,gBAAgB,IAAI,eAAe,KAAK,SAAS,CACzH,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACxB,eAAe,CAAC,IAAI,CAClB,mDAAmD,IAAI,IAAI,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,CAC3G,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,eAAe,CAAC,IAAI,CAClB,gCAAgC,IAAI,gDAAgD,CACrF,CAAC;YACF,eAAe,CAAC,IAAI,CAClB,mDAAmD,IAAI,gBAAgB,IAAI,0BAA0B,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,GAAG,qBAAqB,EAAE,GAAG,eAAe,CAAC,CAAC;IAErE,OAAO;;;;;;EAMP,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;;CAEzB,CAAC;AACF,CAAC"}

package/dist/cli/build.d.ts

@@ -1,2 +0,0 @@
-export declare function runBuild(): Promise<void>;
-//# sourceMappingURL=build.d.ts.map

package/dist/cli/build.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/cli/build.ts"],"names":[],"mappings":"AAOA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CA4F9C"}