@agent-native/core 0.137.7 → 0.138.0

package/dist/server/action-change.d.ts

@@ -26,4 +26,10 @@ export interface NotifyActionChangeOptions {
 }
 export declare function writeActionChangeMarker(options: NotifyActionChangeOptions): Promise<void>;
 export declare function notifyActionChange(options: NotifyActionChangeOptions): Promise<void>;
+/**
+ * Publish the fast in-memory invalidation without holding a user-visible run
+ * on the durable marker write. The marker remains scheduled for other
+ * processes and its failure is logged instead of becoming an invisible gap.
+ */
+export declare function notifyActionChangeInBackground(options: NotifyActionChangeOptions): void;
 //# sourceMappingURL=action-change.d.ts.map

package/dist/server/action-change.js

@@ -40,6 +40,23 @@ function actionChangeTarget(options) {
         requestSource: options.requestSource,
     };
 }
+function recordActionChange(options) {
+    const target = actionChangeTarget(options);
+    recordChange({
+        source: "action",
+        type: "change",
+        key: target.actionName,
+        ...(target.owner ? { owner: target.owner } : {}),
+        ...(target.orgId ? { orgId: target.orgId } : {}),
+        ...(target.requestSource ? { requestSource: target.requestSource } : {}),
+    });
+    return {
+        actionName: options.actionName,
+        ...(target.owner ? { owner: target.owner } : {}),
+        ...(target.orgId ? { orgId: target.orgId } : {}),
+        ...(target.requestSource ? { requestSource: target.requestSource } : {}),
+    };
+}
 export async function writeActionChangeMarker(options) {
     const target = actionChangeTarget(options);
     const sessionId = actionChangeMarkerSession(target);
@@ -51,20 +68,17 @@ export async function writeActionChangeMarker(options) {
     }, { requestSource: options.requestSource ?? "agent" });
 }
 export async function notifyActionChange(options) {
-    const target = actionChangeTarget(options);
-    recordChange({
-        source: "action",
-        type: "change",
-        key: options.actionName,
-        ...(target.owner ? { owner: target.owner } : {}),
-        ...(target.orgId ? { orgId: target.orgId } : {}),
-        ...(options.requestSource ? { requestSource: options.requestSource } : {}),
-    });
-    await writeActionChangeMarker({
-        actionName: options.actionName,
-        ...(target.owner ? { owner: target.owner } : {}),
-        ...(target.orgId ? { orgId: target.orgId } : {}),
-        ...(options.requestSource ? { requestSource: options.requestSource } : {}),
+    await writeActionChangeMarker(recordActionChange(options));
+}
+/**
+ * Publish the fast in-memory invalidation without holding a user-visible run
+ * on the durable marker write. The marker remains scheduled for other
+ * processes and its failure is logged instead of becoming an invisible gap.
+ */
+export function notifyActionChangeInBackground(options) {
+    const normalizedOptions = recordActionChange(options);
+    void writeActionChangeMarker(normalizedOptions).catch((error) => {
+        console.warn("[action-change] durable marker write failed:", error instanceof Error ? error.message : String(error));
     });
 }
 //# sourceMappingURL=action-change.js.map

package/dist/server/action-discovery.js

@@ -596,6 +596,15 @@ export async function mergeCoreSharingActions(registry) {
             "update-user-profile",
             () => import("../user-profile/actions/update-user-profile.js"),
         ],
+        [
+            "get-auth-methods",
+            () => import("../user-profile/actions/get-auth-methods.js"),
+        ],
+        ["set-password", () => import("../user-profile/actions/set-password.js")],
+        [
+            "change-password",
+            () => import("../user-profile/actions/change-password.js"),
+        ],
         [
             "change-appearance",
             () => import("../appearance/actions/change-appearance.js"),

package/dist/server/action-routes.js

@@ -422,6 +422,7 @@ export function mountActionRoutes(nitroApp, actions, options) {
                         userEmail,
                         orgId: orgId ?? null,
                         caller,
+                        requestHeaders: event.headers,
                         actionName: name,
                         ...(resolvedCaller?.delegationJti
                             ? {

package/dist/server/agent-chat/browser-team-tools.js

@@ -228,7 +228,7 @@ export function createBuilderBrowserTool(deps) {
         },
         "activate-browser": {
             tool: {
-                description: "Activate browser automation tools. Call this when you need to interact with a real browser — e.g. to extract design tokens from a rendered page, take screenshots, read computed styles from JS-heavy sites, or test a live URL. After activation, chrome-devtools MCP tools (navigate, click, evaluate_script, take_screenshot, etc.) become available on your next action. Requires Builder.io connection.",
+                description: "Activate browser automation tools. Call this when you need to interact with a real browser — e.g. to extract design tokens from a rendered page, take screenshots, read computed styles from JS-heavy sites, or test a live URL. After activation, chrome-devtools MCP tools (navigate, click, evaluate_script, take_screenshot, etc.) become available on your next action. Requires a Builder.io connection (free tier available).",
                 parameters: {
                     type: "object",
                     properties: {

package/dist/server/agent-chat/script-entries.js

@@ -3,7 +3,7 @@ import { dbExecToolParameters } from "../../scripts/db/tool-schemas.js";
 import { captureCliOutput } from "../cli-capture.js";
 import { getAmbientUserEmail, getRequestOrgId, getRequestRunContext, getRequestUserEmail, } from "../request-context.js";
 // ---------------------------------------------------------------------------
-// CLI-script-backed action entries: db-*, docs-search/source-search,
+// CLI-script-backed action entries: db-*, framework-search/docs-search/source-search,
 // resources/save-memory/delete-memory, chat-history, manage-agent-engine,
 // manage-agent-loop-settings, and call-agent. Each wraps a core CLI script
 // (that writes to console.log) as an ActionEntry via `wrapCliScript`.
@@ -174,6 +174,47 @@ export async function createDbScriptEntries(mode = "read", options = {}) {
  */
 export async function createDocsScriptEntries() {
     const entries = {};
+    try {
+        const mod = await import("../../scripts/docs/framework-search.js");
+        entries["framework-search"] = wrapCliScript({
+            description: "Search the version-matched Agent Native docs and readable Core, Toolkit, and first-party template source in one bounded read-only call. Use this first when a docs answer may require implementation evidence.",
+            parameters: {
+                type: "object",
+                properties: {
+                    pattern: {
+                        type: "string",
+                        description: "Text pattern to search across docs and source. Use normal text by default, or use glob (* and ?) / SQL-like (% and _) / regex mode for broader or more precise matching.",
+                    },
+                    scope: {
+                        type: "string",
+                        description: "Search corpus: all, docs, or source (default: all).",
+                        enum: ["all", "docs", "source"],
+                    },
+                    mode: {
+                        type: "string",
+                        description: "Match mode: substring, glob, sql-like, or safe regex (default: substring).",
+                        enum: ["substring", "glob", "sql-like", "regex"],
+                    },
+                    path: {
+                        type: "string",
+                        description: "Optional glob path filter such as templates/*/actions/*.ts or core/src/server/*.",
+                    },
+                    limit: {
+                        type: "string",
+                        description: "Maximum matching files to return, from 1 to 50.",
+                    },
+                    list: {
+                        type: "string",
+                        description: 'Set to "true" to list searchable docs and source roots.',
+                        enum: ["true"],
+                    },
+                },
+            },
+        }, mod.default, { readOnly: true });
+    }
+    catch (error) {
+        console.warn("[agent-chat] framework-search unavailable; keeping the older lookup tools:", error instanceof Error ? error.message : String(error));
+    }
     try {
         const mod = await import("../../scripts/docs/search.js");
         entries["docs-search"] = wrapCliScript({
@@ -207,7 +248,7 @@ export async function createDocsScriptEntries() {
             return entries;
         }
         entries["source-search"] = wrapCliScript({
-            description: "Search and read the packaged Agent Native first-party template corpus under node_modules/@agent-native/core/corpus. Use --list for sections, --query to search template source, and --path to read a file.",
+            description: "Search and read readable version-matched Core, Toolkit, and first-party template source. Use framework-search for one combined docs/source search with glob, SQL-like, or regex matching; use --list, --query, or --path for focused source lookup.",
             parameters: {
                 type: "object",
                 properties: {

package/dist/server/auth-login-mode.d.ts

@@ -0,0 +1,8 @@
+import { type EmailReadiness } from "./email.js";
+export type AuthLoginMode = "magic-link" | "password";
+/** Magic link is the frictionless default only when outbound email is ready. */
+export declare function resolveAuthLoginMode(emailReady: boolean): AuthLoginMode;
+export declare function resolveAuthLoginModeFromReadiness(emailReadiness: EmailReadiness): AuthLoginMode;
+/** Resolve the browser mode from the same scoped email transport used to send. */
+export declare function getAuthLoginMode(): Promise<AuthLoginMode>;
+//# sourceMappingURL=auth-login-mode.d.ts.map

package/dist/server/auth-login-mode.js

@@ -0,0 +1,17 @@
+import { getEmailReadiness } from "./email.js";
+/** Magic link is the frictionless default only when outbound email is ready. */
+export function resolveAuthLoginMode(emailReady) {
+    const optOut = process.env.AUTH_MAGIC_LINK?.trim().toLowerCase();
+    if (optOut === "0" || optOut === "false" || optOut === "off") {
+        return "password";
+    }
+    return emailReady ? "magic-link" : "password";
+}
+export function resolveAuthLoginModeFromReadiness(emailReadiness) {
+    return resolveAuthLoginMode(emailReadiness.status === "ready");
+}
+/** Resolve the browser mode from the same scoped email transport used to send. */
+export async function getAuthLoginMode() {
+    return resolveAuthLoginModeFromReadiness(await getEmailReadiness());
+}
+//# sourceMappingURL=auth-login-mode.js.map

package/dist/server/auth.js

@@ -54,6 +54,7 @@ import { normalizeWorkspaceAppAudience, workspaceAppAudienceFromEnv, workspaceAp
 import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
 import { injectAnalyticsIntoHtml } from "./analytics.js";
 import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { getAuthLoginMode } from "./auth-login-mode.js";
 import { ensureGoogleAuthIdentity, getBetterAuth, getBetterAuthSync, } from "./better-auth-instance.js";
 import { BUILDER_CONNECT_OWNER_COOKIE, BUILDER_CONNECT_PARAM, BUILDER_RELAY_PATH, BUILDER_RELAY_STATE_PARAM, BUILDER_STATE_PARAM, verifyBuilderCallbackStateAndGetOwner, verifyBuilderConnectTokenAndGetOwner, verifyBuilderPreviewRelayStateForCallback, } from "./builder-browser.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
@@ -791,8 +792,9 @@ function getRequestHost(event) {
         getHeader(event, "host") ??
         undefined);
 }
-function getOnboardingHtmlOptions(options, event, rawPath) {
+function getOnboardingHtmlOptions(options, event, rawPath, authMode) {
     return {
+        authMode,
         googleOnly: options.googleOnly,
         marketing: options.marketing,
         googleSignInNotice: options.googleSignInNotice,
@@ -803,15 +805,16 @@ function getOnboardingHtmlOptions(options, event, rawPath) {
         requestOrigin: event ? getOrigin(event) : undefined,
     };
 }
-function getAuthOnboardingHtml(options, event, rawPath) {
-    return getOnboardingHtml(getOnboardingHtmlOptions(options, event, rawPath));
+function getAuthOnboardingHtml(options, event, rawPath, authMode) {
+    return getOnboardingHtml(getOnboardingHtmlOptions(options, event, rawPath, authMode));
 }
-function getOnboardingLoginHtmlConfig(options) {
+function getOnboardingLoginHtmlConfig(options, authMode) {
     if (options.loginHtml)
-        return { loginHtml: options.loginHtml };
+        return { loginHtml: options.loginHtml, authMode };
     return {
-        loginHtml: getAuthOnboardingHtml(options),
-        getLoginHtml: (event, rawPath) => getAuthOnboardingHtml(options, event, rawPath),
+        authMode,
+        loginHtml: getAuthOnboardingHtml(options, undefined, undefined, authMode),
+        getLoginHtml: (event, rawPath) => getAuthOnboardingHtml(options, event, rawPath, authMode),
     };
 }
 function resolveWorkspaceAppAudience(options = {}) {
@@ -1899,6 +1902,12 @@ function setFirstRunOnboardingCookie(event) {
         maxAge: FIRST_RUN_ONBOARDING_MAX_AGE,
     });
 }
+function clearFirstRunOnboardingCookie(event) {
+    deleteCookie(event, FIRST_RUN_ONBOARDING_COOKIE, {
+        ...crossSiteCookieAttrs(event),
+        path: "/",
+    });
+}
 export function setFrameworkSessionCookie(event, token) {
     clearFrameworkSessionCookies(event);
     setCookie(event, COOKIE_NAME, token, {
@@ -2456,12 +2465,16 @@ async function mountBetterAuthRoutes(app, options) {
         ...(options.googleScopes ? { googleScopes: options.googleScopes } : {}),
     };
     const auth = await getBetterAuth(betterAuthConfig);
+    const authLoginMode = typeof getAuthLoginMode === "function"
+        ? await getAuthLoginMode()
+        : "password";
     // Mount Better Auth catch-all handler at /_agent-native/auth/ba/*
     app.use("/_agent-native/auth/ba", defineEventHandler(async (event) => {
         const reqPath = event.url?.pathname ?? event.path ?? "";
         const isResetPassword = reqPath.includes("reset-password") && getMethod(event) === "POST";
         const isSendVerificationEmail = reqPath.includes("send-verification-email") &&
             getMethod(event) === "POST";
+        const isMagicLinkRequest = reqPath.includes("/sign-in/magic-link") && getMethod(event) === "POST";
         const isSignOut = reqPath.includes("sign-out") && getMethod(event) === "POST";
         if (isSignOut)
             optOutOfAuthDisabledSession(event);
@@ -2471,7 +2484,8 @@ async function mountBetterAuthRoutes(app, options) {
         // wrapper. Check its password endpoints before handing the request to
         // Better Auth so an org policy cannot be bypassed through the raw API.
         if (reqPath.includes("/sign-in/email") ||
-            reqPath.includes("/sign-up/email")) {
+            reqPath.includes("/sign-up/email") ||
+            isMagicLinkRequest) {
             const body = (await authRequest
                 .clone()
                 .json()
@@ -2525,22 +2539,35 @@ async function mountBetterAuthRoutes(app, options) {
         // but the resend endpoint is exposed directly so users can request a
         // fresh link while unauthenticated. Keep that path equally strict:
         // only same-origin relative return paths survive into the email.
-        if (isSendVerificationEmail) {
+        if (isSendVerificationEmail || isMagicLinkRequest) {
             try {
                 const body = (await authRequest
                     .clone()
                     .json()
                     .catch(() => undefined));
-                if (body && typeof body.callbackURL === "string") {
-                    const callbackURL = safeReturnPath(body.callbackURL);
-                    if (callbackURL !== body.callbackURL) {
+                if (body) {
+                    const callbackKeys = isMagicLinkRequest
+                        ? ["callbackURL", "newUserCallbackURL", "errorCallbackURL"]
+                        : ["callbackURL"];
+                    const sanitizedBody = { ...body };
+                    let changed = false;
+                    for (const key of callbackKeys) {
+                        if (typeof body[key] !== "string")
+                            continue;
+                        const callbackURL = safeReturnPath(body[key]);
+                        if (callbackURL !== body[key]) {
+                            sanitizedBody[key] = callbackURL;
+                            changed = true;
+                        }
+                    }
+                    if (changed) {
                         const headers = new Headers(authRequest.headers);
                         headers.delete("content-length");
                         headers.set("content-type", "application/json");
                         requestForAuth = new Request(authRequest.url, {
                             method: authRequest.method,
                             headers,
-                            body: JSON.stringify({ ...body, callbackURL }),
+                            body: JSON.stringify(sanitizedBody),
                             duplex: "half",
                         });
                     }
@@ -2719,6 +2746,46 @@ async function mountBetterAuthRoutes(app, options) {
             return { error: authError.message };
         }
     }));
+    // Passwordless login via Better Auth's rate-limited magic-link plugin.
+    app.use("/_agent-native/auth/magic-link", defineEventHandler(async (event) => {
+        if (getMethod(event) !== "POST") {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const body = await readBody(event);
+        const rawEmail = typeof body?.email === "string" ? body.email : "";
+        const email = normalizeAuthEmail(rawEmail);
+        const callbackURL = typeof body?.callbackURL === "string"
+            ? safeReturnPath(body.callbackURL)
+            : "/";
+        if (!email) {
+            setResponseStatus(event, 400);
+            return { error: VALID_AUTH_EMAIL_MESSAGE };
+        }
+        if (await isGoogleSignInRequiredForEmail(email)) {
+            setResponseStatus(event, 403);
+            return { error: GOOGLE_AUTH_REQUIRED_MESSAGE };
+        }
+        try {
+            await auth.api.signInMagicLink({
+                body: {
+                    email,
+                    callbackURL,
+                    newUserCallbackURL: `${getAppBasePath()}/_agent-native/auth/magic-link/new-user?return=${encodeURIComponent(callbackURL)}`,
+                },
+                headers: event.headers,
+            });
+            return { ok: true };
+        }
+        catch (e) {
+            if (!isExpectedAuthFailure(e)) {
+                captureAuthError(e, { route: "magic-link", email });
+            }
+            const authError = publicAuthError(e, "Unable to send sign-in link");
+            setResponseStatus(event, authError.statusCode ?? 400);
+            return { error: authError.message };
+        }
+    }));
     // Backward-compat: POST /_agent-native/auth/register
     app.use("/_agent-native/auth/register", defineEventHandler(async (event) => {
         if (getMethod(event) !== "POST") {
@@ -2770,6 +2837,7 @@ async function mountBetterAuthRoutes(app, options) {
         if (bearerToken)
             await removeSession(bearerToken);
         clearFrameworkSessionCookies(event);
+        clearFirstRunOnboardingCookie(event);
         optOutOfAuthDisabledSession(event);
         try {
             const result = await auth.api.signOut({
@@ -2838,6 +2906,7 @@ async function mountBetterAuthRoutes(app, options) {
             // 3. Drop the current request's cookie and best-effort sign out
             // of Better Auth (so the response sets the proper expiry header).
             clearFrameworkSessionCookies(event);
+            clearFirstRunOnboardingCookie(event);
             optOutOfAuthDisabledSession(event);
             try {
                 const result = await auth.api.signOut({
@@ -2879,9 +2948,23 @@ async function mountBetterAuthRoutes(app, options) {
             headers: { "Content-Type": "text/html; charset=utf-8" },
         });
     }));
+    // Better Auth redirects new magic-link users through this small public
+    // callback so first-run onboarding is marked only for newly created users.
+    app.use("/_agent-native/auth/magic-link/new-user", defineEventHandler(async (event) => {
+        if (!isReadMethod(event)) {
+            setResponseStatus(event, 405);
+            return { error: "Method not allowed" };
+        }
+        const query = getQuery(event);
+        const rawReturn = Array.isArray(query.return)
+            ? query.return[0]
+            : query.return;
+        setFirstRunOnboardingCookie(event);
+        return redirectWithStagedCookies(event, safeReturnPath(rawReturn), 302);
+    }));
     // Auth guard — stored both in framework middleware registry AND in
     // _authGuardFn so the server middleware can enforce it on ALL routes.
-    const loginHtmlConfig = getOnboardingLoginHtmlConfig(options);
+    const loginHtmlConfig = getOnboardingLoginHtmlConfig(options, authLoginMode);
     _authGuardConfig = {
         ...loginHtmlConfig,
         publicPaths,
@@ -2996,6 +3079,7 @@ function mountAuthFallbackRoutes(app) {
         if (bearerToken)
             await removeSession(bearerToken);
         clearFrameworkSessionCookies(event);
+        clearFirstRunOnboardingCookie(event);
         optOutOfAuthDisabledSession(event);
         try {
             const auth = await getBetterAuth();
@@ -3064,7 +3148,7 @@ export async function autoMountAuth(app, options = {}) {
                 options.loginHtml ||
                 options.marketing ||
                 options.googleSignInNotice) {
-                const loginHtmlConfig = getOnboardingLoginHtmlConfig(options);
+                const loginHtmlConfig = getOnboardingLoginHtmlConfig(options, _authGuardConfig.authMode);
                 _authGuardConfig.loginHtml = loginHtmlConfig.loginHtml;
                 _authGuardConfig.getLoginHtml = loginHtmlConfig.getLoginHtml;
             }
@@ -3130,6 +3214,7 @@ export async function autoMountAuth(app, options = {}) {
             if (bearerToken)
                 await removeSession(bearerToken);
             clearFrameworkSessionCookies(event);
+            clearFirstRunOnboardingCookie(event);
             optOutOfAuthDisabledSession(event);
             if (isElectronRequest(event))
                 await clearDesktopSso();

package/dist/server/better-auth-instance.d.ts

@@ -6,6 +6,7 @@
  * implementation detail behind those interfaces.
  */
 import { type BetterAuthOptions } from "better-auth";
+export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, type AuthLoginMode, } from "./auth-login-mode.js";
 export declare function hasBetterAuthUserEmail(email: string): Promise<boolean>;
 export declare function trackSignupEvent({ authProvider, authUserId, email, name, attribution, anonymousId, }: {
     authProvider: string;
@@ -64,6 +65,41 @@ export interface BetterAuthInstance {
             token?: string;
             user?: any;
         } | null>;
+        signInMagicLink: (opts: {
+            body: {
+                email: string;
+                name?: string;
+                callbackURL?: string;
+                newUserCallbackURL?: string;
+                errorCallbackURL?: string;
+                metadata?: Record<string, unknown>;
+            };
+            headers: Headers;
+        }) => Promise<{
+            status: boolean;
+        }>;
+        listUserAccounts: (opts: {
+            headers: Headers;
+        }) => Promise<Array<{
+            providerId: string;
+        }>>;
+        setPassword: (opts: {
+            body: {
+                newPassword: string;
+            };
+            headers: Headers;
+        }) => Promise<{
+            status: boolean;
+        }>;
+        changePassword: (opts: {
+            body: {
+                currentPassword: string;
+                newPassword: string;
+            };
+            headers: Headers;
+        }) => Promise<{
+            status: boolean;
+        }>;
         signUpEmail: (opts: {
             body: {
                 email: string;

package/dist/server/better-auth-instance.js

@@ -11,6 +11,7 @@ import path from "node:path";
 import { betterAuth } from "better-auth";
 import { bearer } from "better-auth/plugins/bearer";
 import { jwt } from "better-auth/plugins/jwt";
+import { magicLink } from "better-auth/plugins/magic-link";
 import { pgTable, text as pgText, timestamp as pgTimestamp, boolean as pgBoolean, } from "drizzle-orm/pg-core";
 import { sqliteTable, text as sqliteText, integer as sqliteInteger, } from "drizzle-orm/sqlite-core";
 import { TEMPLATES } from "../cli/templates-meta.js";
@@ -26,9 +27,10 @@ import { getAppProductionUrl } from "./app-url.js";
 import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
-import { renderResetPasswordEmail, renderVerifySignupEmail, } from "./email-templates.js";
-import { sendEmail, isEmailConfigured } from "./email.js";
+import { renderMagicLinkEmail, renderResetPasswordEmail, renderVerifySignupEmail, } from "./email-templates.js";
+import { getEmailReadiness, sendEmail } from "./email.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
+export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, } from "./auth-login-mode.js";
 async function flushSignupTracking() {
     try {
         await Promise.race([
@@ -889,7 +891,8 @@ async function createBetterAuthInstance(config) {
     const secret = resolveAuthSecret();
     const appUrl = getAppProductionUrl();
     const cookieNamespace = resolveAuthCookieNamespace();
-    const { requireEmailVerification, disableSignUp } = resolveEmailPasswordAuthPolicy(await isEmailConfigured());
+    const emailReadiness = await getEmailReadiness();
+    const { requireEmailVerification, disableSignUp } = resolveEmailPasswordAuthPolicy(emailReadiness.status === "ready");
     const shouldMirrorGoogleAccountTokens = (config?.googleScopes?.length ?? 0) > 0;
     const auth = betterAuth({
         basePath,
@@ -1111,6 +1114,25 @@ async function createBetterAuthInstance(config) {
                 : {}),
         },
         plugins: [
+            magicLink({
+                expiresIn: 60 * 5,
+                storeToken: "hashed",
+                rateLimit: { window: 60, max: 5 },
+                disableSignUp,
+                sendMagicLink: async ({ email, url }) => {
+                    const appBasePath = (process.env.VITE_APP_BASE_PATH ||
+                        process.env.APP_BASE_PATH ||
+                        "").replace(/\/$/, "");
+                    const magicLinkUrl = appBasePath
+                        ? url.replace(/(\/\/[^/]+)(\/)/, `$1${appBasePath}$2`)
+                        : url;
+                    const { subject, html, text, appSender } = renderMagicLinkEmail({
+                        email,
+                        magicLinkUrl,
+                    });
+                    await sendEmail({ to: email, subject, html, text, appSender });
+                },
+            }),
             // JWT: issue tokens for A2A calls, JWKS endpoint for verification
             jwt({
                 jwt: {

package/dist/server/builder-design-systems.js

@@ -112,7 +112,7 @@ async function resolveBuilderDesignSystemCredentials() {
     if (!credentials.privateKey || !credentials.publicKey) {
         throw new FeatureNotConfiguredError({
             requiredCredential: "BUILDER_PRIVATE_KEY",
-            message: "Connect Builder.io before indexing a design system from Figma or code.",
+            message: "Connect Builder.io (free tier available) before indexing a design system from Figma or code.",
             builderConnectUrl: "/_agent-native/builder/connect",
         });
     }

package/dist/server/core-routes-plugin.js

@@ -856,6 +856,21 @@ export function createCoreRoutesPlugin(options = {}) {
             paths: [FRAMEWORK_ROUTE_PREFIX, "/mcp", "/.well-known"],
         });
         try {
+            const P = FRAMEWORK_ROUTE_PREFIX;
+            // This response is a side-effect-free static contract used by the SSR
+            // shell. Mount it before optional default-plugin/bootstrap work so a
+            // browser's automatic rules fetch cannot inherit the cold-start wait.
+            getH3App(nitroApp).use(`${P}/speculation-rules.json`, defineEventHandler((event) => {
+                // `createH3SSRHandler` points the Speculation-Rules response header
+                // here to prevent Cloudflare Speed Brain from injecting its own
+                // edge prefetch rules. Keep this route public and side-effect free:
+                // browsers may request it while parsing any SSR HTML document.
+                setResponseHeader(event, "content-type", "application/speculationrules+json; charset=utf-8");
+                for (const [name, value] of Object.entries(resolveSsrCacheHeaders())) {
+                    setResponseHeader(event, name, value);
+                }
+                return EMPTY_SPECULATION_RULES;
+            }));
             await awaitBootstrap(nitroApp);
             const { persistedEnvVars, builderDisconnected } = await readLegacyCoreRouteInitSettings();
             // Legacy cleanup: key saves now go to scoped app_secrets rows. Do not
@@ -959,7 +974,6 @@ export function createCoreRoutesPlugin(options = {}) {
             catch {
                 // Audit module not available — skip
             }
-            const P = FRAMEWORK_ROUTE_PREFIX;
             for (const provider of [
                 "figma",
                 "google_drive",
@@ -1281,17 +1295,6 @@ export function createCoreRoutesPlugin(options = {}) {
                     schema,
                 };
             }));
-            getH3App(nitroApp).use(`${P}/speculation-rules.json`, defineEventHandler((event) => {
-                // `createH3SSRHandler` points the Speculation-Rules response header
-                // here to prevent Cloudflare Speed Brain from injecting its own
-                // edge prefetch rules. Keep this route public and side-effect free:
-                // browsers may request it while parsing any SSR HTML document.
-                setResponseHeader(event, "content-type", "application/speculationrules+json; charset=utf-8");
-                for (const [name, value] of Object.entries(resolveSsrCacheHeaders())) {
-                    setResponseHeader(event, name, value);
-                }
-                return EMPTY_SPECULATION_RULES;
-            }));
             {
                 const { createAgentNativeOgImageHandler } = await import("./social-og-image.js");
                 getH3App(nitroApp).use(`${P}/og-image.png`, createAgentNativeOgImageHandler());
@@ -2339,7 +2342,7 @@ export function createCoreRoutesPlugin(options = {}) {
                     if (!creds.privateKey || !creds.publicKey) {
                         setResponseStatus(event, 400);
                         return {
-                            error: "Builder not connected. Connect Builder in Setup to use background agent.",
+                            error: "Builder not connected. Connect Builder (free tier available) in Setup to use background agent.",
                         };
                     }
                     const body = (await readBody(event));
@@ -2743,7 +2746,7 @@ export function createCoreRoutesPlugin(options = {}) {
                 }
                 setResponseStatus(event, 503);
                 return {
-                    error: "No file upload provider configured. Connect Builder.io in Settings → File uploads, or register a provider.",
+                    error: "No file upload provider configured. Connect Builder.io (free tier available) in Settings → File uploads, or register a provider.",
                 };
             }));
             // ─── Voice transcription (Whisper) ───────────────────────────────

package/dist/server/credential-provider.js

@@ -42,7 +42,7 @@ export class FeatureNotConfiguredError extends Error {
     byokDocsUrl;
     constructor(opts) {
         super(opts.message ??
-            `Feature requires credential "${opts.requiredCredential}". Connect Builder or set your own key.`);
+            `Feature requires credential "${opts.requiredCredential}". Connect Builder (free tier available) or set your own key.`);
         this.name = "FeatureNotConfiguredError";
         this.requiredCredential = opts.requiredCredential;
         this.builderConnectUrl = opts.builderConnectUrl;
@@ -692,7 +692,7 @@ export async function getBuilderCredentialAuthFailure(creds = {}) {
             fingerprint,
             message: typeof row.message === "string" && row.message
                 ? row.message
-                : "Builder rejected the connected credentials. Reconnect Builder.io.",
+                : "Builder rejected the connected credentials. Reconnect Builder.io (free tier available).",
             status: typeof row.status === "number" ? row.status : undefined,
             code: typeof row.code === "string" ? row.code : undefined,
             at,
@@ -714,7 +714,7 @@ export async function recordBuilderCredentialAuthFailure(details) {
         await putSetting(builderAuthFailureSettingKey(fingerprint), {
             fingerprint,
             message: details?.message ||
-                "Builder rejected the connected credentials. Reconnect Builder.io.",
+                "Builder rejected the connected credentials. Reconnect Builder.io (free tier available).",
             ...(typeof details?.status === "number" && { status: details.status }),
             ...(details?.code && { code: details.code }),
             at: Date.now(),