@agent-native/core 0.137.7 → 0.138.0

package/dist/server/email-templates.d.ts

@@ -45,6 +45,13 @@ export interface RenderVerifySignupEmailArgs {
     verifyUrl: string;
 }
 export declare function renderVerifySignupEmail(args: RenderVerifySignupEmailArgs): RenderedEmailMessage;
+export interface RenderMagicLinkEmailArgs {
+    /** The account email receiving the one-time sign-in link. */
+    email: string;
+    /** The full Better Auth URL containing the one-time token. */
+    magicLinkUrl: string;
+}
+export declare function renderMagicLinkEmail(args: RenderMagicLinkEmailArgs): RenderedEmailMessage;
 export interface RenderResetPasswordEmailArgs {
     /** The account email the reset is for. */
     email: string;

package/dist/server/email-templates.js

@@ -103,6 +103,30 @@ export function renderVerifySignupEmail(args) {
             : undefined,
     };
 }
+export function renderMagicLinkEmail(args) {
+    const email = stripCrlf(args.email);
+    const slug = getAppSlug();
+    const brand = resolveBrand(slug);
+    const { html, text } = renderEmail({
+        brandName: brand,
+        preheader: `Sign in to ${brand} with your secure one-time link.`,
+        heading: `Sign in to ${brand}`,
+        paragraphs: [
+            `Use the button below to sign in as ${emailStrong(email)}. This link expires in 5 minutes and can only be used once.`,
+            `If you didn't request this email, you can safely ignore it.`,
+        ],
+        cta: { label: "Sign in securely", url: args.magicLinkUrl },
+        footer: `For your security, never forward this email or share the link.`,
+    });
+    return {
+        subject: `Your sign-in link for ${brand}`,
+        html,
+        text,
+        appSender: slug
+            ? { name: brand, slug, replyTo: AGENT_NATIVE_REPLY_TO }
+            : undefined,
+    };
+}
 export function renderResetPasswordEmail(args) {
     const email = stripCrlf(args.email);
     // Match the verification email branding so password resets are clearly tied

package/dist/server/email.d.ts

@@ -10,6 +10,16 @@
  * so the reset-password flow still works end-to-end for local development.
  */
 export type EmailProvider = "resend" | "sendgrid" | "dev";
+export type EmailReadiness = {
+    status: "ready";
+    provider: Exclude<EmailProvider, "dev">;
+} | {
+    status: "not-configured";
+    provider: "dev";
+} | {
+    status: "misconfigured" | "unavailable";
+    provider: EmailProvider | "unknown";
+};
 export interface EmailAttachment {
     filename: string;
     content: string | Buffer;
@@ -50,6 +60,13 @@ export interface SendEmailArgs {
     timeoutMs?: number;
 }
 export declare function isEmailConfigured(): Promise<boolean>;
+/**
+ * Auth must only offer magic links when sending can succeed. In particular,
+ * SendGrid needs EMAIL_FROM while Resend can use its sandbox sender. Keep
+ * unreadable credential stores distinct from an unconfigured deployment so
+ * callers can fail closed without claiming setup is absent.
+ */
+export declare function getEmailReadiness(): Promise<EmailReadiness>;
 export declare function getEmailProvider(): Promise<EmailProvider>;
 export declare function sendEmail(args: SendEmailArgs): Promise<void>;
 //# sourceMappingURL=email.d.ts.map

package/dist/server/email.js

@@ -56,7 +56,28 @@ async function resolveEmailTransport() {
     return { provider: "dev", from: resolvedFrom };
 }
 export async function isEmailConfigured() {
-    return (await resolveEmailTransport()).provider !== "dev";
+    return (await getEmailReadiness()).status === "ready";
+}
+/**
+ * Auth must only offer magic links when sending can succeed. In particular,
+ * SendGrid needs EMAIL_FROM while Resend can use its sandbox sender. Keep
+ * unreadable credential stores distinct from an unconfigured deployment so
+ * callers can fail closed without claiming setup is absent.
+ */
+export async function getEmailReadiness() {
+    try {
+        const config = await resolveEmailTransport();
+        if (config.provider === "dev") {
+            return { status: "not-configured", provider: "dev" };
+        }
+        if (config.provider === "sendgrid" && !config.from) {
+            return { status: "misconfigured", provider: "sendgrid" };
+        }
+        return { status: "ready", provider: config.provider };
+    }
+    catch {
+        return { status: "unavailable", provider: "unknown" };
+    }
 }
 export async function getEmailProvider() {
     return (await resolveEmailTransport()).provider;

package/dist/server/framework-request-handler.js

@@ -265,6 +265,12 @@ export async function awaitBootstrap(nitroApp) {
 async function awaitFrameworkRoutesReadyForRequest(nitroApp, reqPath) {
     if (!nitroApp)
         return true;
+    // This route is mounted synchronously by core-routes before bootstrap. It
+    // must not wait on optional plugins or a database just because the browser
+    // asks for the SSR shell's empty speculation rules during a cold start.
+    if (resolveMountMatch(reqPath, `${FRAMEWORK_PREFIX}/speculation-rules.json`)) {
+        return true;
+    }
     let timer;
     try {
         return await Promise.race([

package/dist/server/onboarding-html.d.ts

@@ -23,6 +23,8 @@ export interface OnboardingHtmlOptions {
      * If Google OAuth env vars are not configured, an error message is shown.
      */
     googleOnly?: boolean;
+    /** Authentication surface to render. Defaults to the existing password flow. */
+    authMode?: "magic-link" | "password";
     /**
      * Product marketing content shown alongside the sign-in form.
      * When provided, the page uses a split layout: marketing on the left,

package/dist/server/onboarding-html.js

@@ -72,6 +72,14 @@ const EN_AUTH_COPY = {
     passwordMinPlaceholder: "At least 8 characters",
     confirmPasswordPlaceholder: "Confirm password",
     enterPasswordPlaceholder: "Enter password",
+    magicLinkTitle: "Sign in with a link",
+    magicLinkSubtitle: "Enter your email and we'll send you a secure sign-in link",
+    sendMagicLink: "Email me a sign-in link",
+    magicLinkSent: "Check your email",
+    magicLinkSentCopy: "We sent a secure sign-in link to",
+    magicLinkFailed: "Could not send sign-in link.",
+    usePasswordInstead: "Use a password instead",
+    backToMagicLink: "Use a sign-in link instead",
     signupProgress: "Signup progress",
     progressAccount: "Account",
     progressVerify: "Verify",
@@ -160,6 +168,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "至少 8 个字符",
         confirmPasswordPlaceholder: "确认密码",
         enterPasswordPlaceholder: "输入密码",
+        magicLinkTitle: "使用链接登录",
+        magicLinkSubtitle: "输入邮箱，我们会发送安全登录链接",
+        sendMagicLink: "发送登录链接到邮箱",
+        magicLinkSent: "检查你的邮箱",
+        magicLinkSentCopy: "我们已向以下邮箱发送安全登录链接：",
+        magicLinkFailed: "无法发送登录链接。",
+        usePasswordInstead: "改用密码",
+        backToMagicLink: "改用登录链接",
         signupProgress: "注册进度",
         progressAccount: "账户",
         progressVerify: "验证",
@@ -246,6 +262,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "至少 8 個字元",
         confirmPasswordPlaceholder: "確認密碼",
         enterPasswordPlaceholder: "輸入密碼",
+        magicLinkTitle: "使用連結登入",
+        magicLinkSubtitle: "輸入電子郵件，我們會寄送安全登入連結",
+        sendMagicLink: "寄送登入連結",
+        magicLinkSent: "檢查你的電子郵件",
+        magicLinkSentCopy: "我們已向以下電子郵件寄送安全登入連結：",
+        magicLinkFailed: "無法寄送登入連結。",
+        usePasswordInstead: "改用密碼",
+        backToMagicLink: "改用登入連結",
         signupProgress: "註冊進度",
         progressAccount: "帳號",
         progressVerify: "驗證",
@@ -332,6 +356,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "Al menos 8 caracteres",
         confirmPasswordPlaceholder: "Confirmar contraseña",
         enterPasswordPlaceholder: "Introduce la contraseña",
+        magicLinkTitle: "Inicia sesión con un enlace",
+        magicLinkSubtitle: "Introduce tu email y te enviaremos un enlace seguro",
+        sendMagicLink: "Enviarme un enlace de inicio de sesión",
+        magicLinkSent: "Revisa tu email",
+        magicLinkSentCopy: "Enviamos un enlace seguro a",
+        magicLinkFailed: "No se pudo enviar el enlace de inicio de sesión.",
+        usePasswordInstead: "Usar una contraseña",
+        backToMagicLink: "Usar un enlace de inicio de sesión",
         signupProgress: "Progreso de registro",
         progressAccount: "Cuenta",
         progressVerify: "Verificar",
@@ -418,6 +450,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "Au moins 8 caractères",
         confirmPasswordPlaceholder: "Confirmer le mot de passe",
         enterPasswordPlaceholder: "Saisir le mot de passe",
+        magicLinkTitle: "Se connecter avec un lien",
+        magicLinkSubtitle: "Saisissez votre e-mail et nous vous enverrons un lien sécurisé",
+        sendMagicLink: "M'envoyer un lien de connexion",
+        magicLinkSent: "Vérifiez votre e-mail",
+        magicLinkSentCopy: "Nous avons envoyé un lien sécurisé à",
+        magicLinkFailed: "Impossible d'envoyer le lien de connexion.",
+        usePasswordInstead: "Utiliser un mot de passe",
+        backToMagicLink: "Utiliser un lien de connexion",
         signupProgress: "Progression de l'inscription",
         progressAccount: "Compte",
         progressVerify: "Vérifier",
@@ -504,6 +544,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "Mindestens 8 Zeichen",
         confirmPasswordPlaceholder: "Passwort bestätigen",
         enterPasswordPlaceholder: "Passwort eingeben",
+        magicLinkTitle: "Mit einem Link anmelden",
+        magicLinkSubtitle: "Gib deine E-Mail ein und wir senden dir einen sicheren Anmeldelink",
+        sendMagicLink: "Anmeldelink per E-Mail senden",
+        magicLinkSent: "Prüfe deine E-Mail",
+        magicLinkSentCopy: "Wir haben einen sicheren Anmeldelink gesendet an",
+        magicLinkFailed: "Anmeldelink konnte nicht gesendet werden.",
+        usePasswordInstead: "Stattdessen Passwort verwenden",
+        backToMagicLink: "Stattdessen Anmeldelink verwenden",
         signupProgress: "Registrierungsfortschritt",
         progressAccount: "Konto",
         progressVerify: "Prüfen",
@@ -590,6 +638,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "8 文字以上",
         confirmPasswordPlaceholder: "パスワードを確認",
         enterPasswordPlaceholder: "パスワードを入力",
+        magicLinkTitle: "リンクでサインイン",
+        magicLinkSubtitle: "メールアドレスを入力すると、安全なサインインリンクを送信します",
+        sendMagicLink: "サインインリンクをメールで送信",
+        magicLinkSent: "メールを確認してください",
+        magicLinkSentCopy: "安全なサインインリンクを送信しました：",
+        magicLinkFailed: "サインインリンクを送信できませんでした。",
+        usePasswordInstead: "パスワードを使用する",
+        backToMagicLink: "サインインリンクを使用する",
         signupProgress: "登録の進行状況",
         progressAccount: "アカウント",
         progressVerify: "確認",
@@ -676,6 +732,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "8자 이상",
         confirmPasswordPlaceholder: "비밀번호 확인",
         enterPasswordPlaceholder: "비밀번호 입력",
+        magicLinkTitle: "링크로 로그인",
+        magicLinkSubtitle: "이메일을 입력하면 안전한 로그인 링크를 보내드립니다",
+        sendMagicLink: "로그인 링크 이메일 받기",
+        magicLinkSent: "이메일을 확인하세요",
+        magicLinkSentCopy: "안전한 로그인 링크를 보냈습니다:",
+        magicLinkFailed: "로그인 링크를 보낼 수 없습니다.",
+        usePasswordInstead: "비밀번호 사용",
+        backToMagicLink: "로그인 링크 사용",
         signupProgress: "가입 진행 상황",
         progressAccount: "계정",
         progressVerify: "확인",
@@ -762,6 +826,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "Pelo menos 8 caracteres",
         confirmPasswordPlaceholder: "Confirmar senha",
         enterPasswordPlaceholder: "Digite a senha",
+        magicLinkTitle: "Entrar com um link",
+        magicLinkSubtitle: "Digite seu email e enviaremos um link seguro de acesso",
+        sendMagicLink: "Enviar link de acesso por email",
+        magicLinkSent: "Confira seu email",
+        magicLinkSentCopy: "Enviamos um link seguro para",
+        magicLinkFailed: "Não foi possível enviar o link de acesso.",
+        usePasswordInstead: "Usar uma senha",
+        backToMagicLink: "Usar um link de acesso",
         signupProgress: "Progresso do cadastro",
         progressAccount: "Conta",
         progressVerify: "Verificar",
@@ -848,6 +920,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "कम से कम 8 अक्षर",
         confirmPasswordPlaceholder: "पासवर्ड की पुष्टि करें",
         enterPasswordPlaceholder: "पासवर्ड दर्ज करें",
+        magicLinkTitle: "लिंक से साइन इन करें",
+        magicLinkSubtitle: "अपना ईमेल दर्ज करें और हम सुरक्षित साइन-इन लिंक भेजेंगे",
+        sendMagicLink: "मुझे साइन-इन लिंक ईमेल करें",
+        magicLinkSent: "अपना ईमेल देखें",
+        magicLinkSentCopy: "हमने सुरक्षित साइन-इन लिंक यहां भेजा है:",
+        magicLinkFailed: "साइन-इन लिंक नहीं भेजा जा सका।",
+        usePasswordInstead: "पासवर्ड का उपयोग करें",
+        backToMagicLink: "साइन-इन लिंक का उपयोग करें",
         signupProgress: "साइनअप प्रगति",
         progressAccount: "खाता",
         progressVerify: "सत्यापित करें",
@@ -934,6 +1014,14 @@ const AUTH_LOCALE_COPY = {
         passwordMinPlaceholder: "8 أحرف على الأقل",
         confirmPasswordPlaceholder: "تأكيد كلمة المرور",
         enterPasswordPlaceholder: "أدخل كلمة المرور",
+        magicLinkTitle: "تسجيل الدخول باستخدام رابط",
+        magicLinkSubtitle: "أدخل بريدك الإلكتروني وسنرسل لك رابط تسجيل دخول آمنًا",
+        sendMagicLink: "إرسال رابط تسجيل الدخول إلى بريدي",
+        magicLinkSent: "تحقق من بريدك الإلكتروني",
+        magicLinkSentCopy: "أرسلنا رابط تسجيل دخول آمنًا إلى",
+        magicLinkFailed: "تعذر إرسال رابط تسجيل الدخول.",
+        usePasswordInstead: "استخدام كلمة مرور بدلًا من ذلك",
+        backToMagicLink: "استخدام رابط تسجيل الدخول بدلًا من ذلك",
         signupProgress: "تقدم التسجيل",
         progressAccount: "الحساب",
         progressVerify: "التحقق",
@@ -1126,6 +1214,8 @@ function isAgentNativeHostedHost(host) {
 export function getOnboardingHtml(opts = {}) {
     const showGoogle = hasGoogleOAuth();
     const googleOnly = !!opts.googleOnly;
+    const authMode = opts.authMode ?? "password";
+    const magicLinkMode = authMode === "magic-link";
     // In a Google-only app, Google is the sole sign-in method, so always render
     // a working button — never gate it on env vars detected at render time. The
     // login page is a public, CDN-cacheable shell served to everyone (per-user
@@ -2239,8 +2329,8 @@ ${marketingStyles}
 ${localePickerHtml}
 ${marketingPanelHtml}
 <div class="card">
-  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : "welcomeTitle"))}</h1>
-  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle"))}</p>
+  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle"))}</h1>
+  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle"))}</p>
   <p
     class="upgrade-note"
     id="upgrade-note"
@@ -2264,7 +2354,7 @@ ${googleOnly ? "" : `\n  <div class="divider" id="auth-divider"${i18nAttr("divid
         : ""}
 ${googleOnly
         ? ""
-        : `  <div class="tabs">
+        : `${magicLinkMode ? '\n    <form id="magic-link-form" class="form">\n      <label for="m-email"' + i18nAttr("email") + ">" + esc(t("email")) + '</label>\n      <input id="m-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />\n      <button type="submit"' + i18nAttr("sendMagicLink") + ">" + esc(t("sendMagicLink")) + '</button>\n      <p class="msg" id="m-msg"></p>\n      <p style="margin-top:0.75rem;font-size:0.75rem;text-align:center">\n        <a href="#" id="use-password-link" class="link-button"' + i18nAttr("usePasswordInstead") + ">" + esc(t("usePasswordInstead")) + "</a>\n      </p>\n    </form>\n" : ""}  <div class="tabs"${magicLinkMode ? " hidden" : ""}>
     <button class="tab" data-tab="signup"${i18nAttr("createAccount")}>${esc(t("createAccount"))}</button>
     <button class="tab" data-tab="login"${i18nAttr("signIn")}>${esc(t("signIn"))}</button>
   </div>
@@ -2311,6 +2401,7 @@ ${signupLocalModeNoteHtml}
     <p style="margin-top:0.75rem;font-size:0.75rem;text-align:right">
       <a href="#" id="forgot-link" style="color:#888;text-decoration:underline;text-underline-offset:2px"${i18nAttr("forgotPassword")}>${esc(t("forgotPassword"))}</a>
     </p>
+    ${magicLinkMode ? `<p style="margin-top:0.5rem;font-size:0.75rem;text-align:center"><a href="#" id="back-to-magic-link" class="link-button"${i18nAttr("backToMagicLink")}>${esc(t("backToMagicLink"))}</a></p>` : ""}
   </form>
 
   <form id="forgot-form" class="form">
@@ -2361,7 +2452,8 @@ ${signInJourneyInlineScript()}
     var __AN_AUTH_MARKETING_LOCALES = ${JSON.stringify(AUTH_MARKETING_LOCALE_COPY)};
     var __anAuthLocale = __AN_AUTH_DEFAULT_LOCALE;
     var __anAuthLocalePreference = 'system';
-    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : "signup")};
+    var __AN_AUTH_MODE = ${JSON.stringify(authMode)};
+    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : magicLinkMode ? "magicLink" : "signup")};
     function __anAuthLocaleIsSupported(value) {
       return __AN_AUTH_SUPPORTED_LOCALES.indexOf(value) !== -1;
     }
@@ -2429,6 +2521,7 @@ ${signInJourneyInlineScript()}
       if (view === 'forgot') return { heading: 'resetPasswordTitle', subtitle: 'resetPasswordSubtitle' };
       if (view === 'verification') return { heading: 'checkEmailTitle', subtitle: 'finishAccountSubtitle' };
       if (view === 'googleOnly') return { heading: 'signInTitle', subtitle: 'googleOnlySubtitle' };
+      if (view === 'magicLink') return { heading: 'magicLinkTitle', subtitle: 'magicLinkSubtitle' };
       return { heading: 'welcomeTitle', subtitle: 'createAccountSubtitle' };
     }
     function __anRefreshAuthViewCopy() {
@@ -3049,7 +3142,14 @@ ${googleOnly
 	    function clearRememberedPendingSignupEmail() {
 	      rememberPendingSignupEmail('');
 	    }
-	    function setActiveTab(name, opts) {
+    function showMagicLinkForm() {
+      var form = document.getElementById('magic-link-form');
+      if (!form) return;
+      forms.forEach(function(x) { x.classList.remove('active'); });
+      form.classList.add('active');
+      __anSetAuthView('magicLink');
+    }
+    function setActiveTab(name, opts) {
 	      if (name !== 'signup' && name !== 'login') return;
 	      var form = document.getElementById(name + '-form');
 	      if (!form) return;
@@ -3156,7 +3256,10 @@ ${googleOnly
         __anRedirectToSignedInApp();
         return { ok: true };
       }
-      var data = await res.json().catch(function() { return {}; });
+      var data = await res.json().catch(function(error) {
+        console.warn('[auth] Could not parse sign-in response', error);
+        return null;
+      });
       var error = (data && (data.error || data.message)) || __anT('finishSignInFailed');
       return {
         ok: false,
@@ -3299,7 +3402,7 @@ ${googleOnly
       }
     }
     (function initActiveTab() {
-    var initial = 'signup';
+    var initial = __AN_AUTH_MODE === 'magic-link' ? 'magicLink' : 'signup';
     try {
       var params = new URLSearchParams(location.search);
       var qp = params.get('tab');
@@ -3318,7 +3421,8 @@ ${googleOnly
         if (stored === 'login' || stored === 'signup') initial = stored;
       }
     } catch (e) {}
-    setActiveTab(initial, { persist: false });
+    if (initial === 'magicLink') showMagicLinkForm();
+    else setActiveTab(initial, { persist: false });
 	      try {
 	        if (__anIsVerifiedRedirectSuccess()) {
 	          var rememberedEmail = readRememberedPendingSignupEmail();
@@ -3338,6 +3442,63 @@ ${googleOnly
     setActiveTab(t.dataset.tab, { persist: true });
   }); });
 
+  var usePasswordLink = document.getElementById('use-password-link');
+  if (usePasswordLink) usePasswordLink.addEventListener('click', function(e) {
+    e.preventDefault();
+    setActiveTab('login', { persist: false });
+    var magicEmail = document.getElementById('m-email');
+    var loginEmail = document.getElementById('l-email');
+    if (magicEmail && loginEmail && magicEmail.value) loginEmail.value = magicEmail.value;
+  });
+  var backToMagicLink = document.getElementById('back-to-magic-link');
+  if (backToMagicLink) backToMagicLink.addEventListener('click', function(e) {
+    e.preventDefault();
+    showMagicLinkForm();
+  });
+
+  var magicLinkForm = document.getElementById('magic-link-form');
+  if (magicLinkForm) magicLinkForm.addEventListener('submit', async function(e) {
+    e.preventDefault();
+    var btn = magicLinkForm.querySelector('button[type="submit"]');
+    var msg = document.getElementById('m-msg');
+    var emailInput = document.getElementById('m-email');
+    var email = __anNormalizeAuthEmail(emailInput && emailInput.value);
+    msg.classList.remove('show', 'error', 'success');
+    if (!__anIsValidAuthEmail(email)) {
+      __anShowEmailValidationError(emailInput, msg);
+      return;
+    }
+    var originalLabel = btn.textContent;
+    btn.disabled = true;
+    btn.textContent = __anT('sending');
+    try {
+      var res = await fetch(__anPath('/_agent-native/auth/magic-link'), {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: email, callbackURL: __anResumeHref() }),
+      });
+      var data = await res.json().catch(function(error) {
+        console.warn('[auth] Could not parse magic-link response', error);
+        return null;
+      });
+      if (res.ok) {
+        msg.textContent = __anT('magicLinkSent') + '. ' + __anT('magicLinkSentCopy') + ' ' + email + '.';
+        msg.classList.add('show', 'success');
+        btn.textContent = __anT('sent');
+        return;
+      }
+      msg.textContent = (data && (data.error || data.message)) || __anT('magicLinkFailed');
+      msg.classList.add('show', 'error');
+      btn.disabled = false;
+      btn.textContent = originalLabel;
+    } catch (err) {
+      msg.textContent = __anT('networkErrorDashRetry');
+      msg.classList.add('show', 'error');
+      btn.disabled = false;
+      btn.textContent = originalLabel;
+    }
+  });
+
   document.getElementById('signup-form').addEventListener('submit', async function(e) {
     e.preventDefault();
     var form = e.currentTarget;

package/dist/server/realtime-token.d.ts

@@ -26,9 +26,9 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=realtime-token.d.ts.map

package/dist/server/realtime-voice.js

@@ -412,7 +412,7 @@ function createSessionHandler(tools, capabilities, options) {
             if (!builderConfigured && !apiKey) {
                 setResponseStatus(event, 409);
                 return {
-                    error: "Connect Builder or configure an OpenAI API key to use realtime voice.",
+                    error: "Connect Builder (free tier available) or configure an OpenAI API key to use realtime voice.",
                     code: "realtime_voice_setup_required",
                 };
             }

package/dist/server/sentry.d.ts

@@ -57,7 +57,7 @@ export declare function setSentryRequestContext(ctx: {
  * this just records the error for observability.
  */
 export declare function captureAuthError(error: unknown, context: {
-    route: "login" | "signup" | "logout";
+    route: "login" | "signup" | "logout" | "magic-link";
     email?: string;
 }): string | undefined;
 export interface RouteErrorContext {

package/dist/server/transcribe-voice.js

@@ -269,7 +269,7 @@ export function createTranscribeVoiceHandler() {
             if (!(await hasBuilderPrivateKey())) {
                 setResponseStatus(event, 400);
                 return {
-                    error: `${label} is selected but Builder.io is not connected. Connect Builder.io in Settings, or change the provider preference.`,
+                    error: `${label} is selected but Builder.io is not connected. Connect Builder.io (free tier available) in Settings, or change the provider preference.`,
                 };
             }
             try {
@@ -403,7 +403,7 @@ export function createTranscribeVoiceHandler() {
             return {
                 error: builderError
                     ? `Builder transcription failed: ${builderError}. Add GEMINI_API_KEY, GROQ_API_KEY, or OPENAI_API_KEY in Settings → API Keys to enable a fallback provider.`
-                    : "No voice transcription provider configured. Connect Builder.io or add GEMINI_API_KEY / GROQ_API_KEY / OPENAI_API_KEY in Settings → API Keys.",
+                    : "No voice transcription provider configured. Connect Builder.io (free tier available) or add GEMINI_API_KEY / GROQ_API_KEY / OPENAI_API_KEY in Settings → API Keys.",
             };
         }
         return await callWhisperCompat({
@@ -489,7 +489,7 @@ async function cleanupTranscriptText({ event, text, instructions, contextPack, p
         if (!(await hasBuilderPrivateKey())) {
             setResponseStatus(event, 400);
             return {
-                error: "Builder.io cleanup is selected but Builder.io is not connected. Connect Builder.io in Settings, or change the provider preference.",
+                error: "Builder.io cleanup is selected but Builder.io is not connected. Connect Builder.io (free tier available) in Settings, or change the provider preference.",
             };
         }
         try {

package/dist/shared/first-run-onboarding.d.ts

@@ -1,3 +1,4 @@
 export declare const FIRST_RUN_ONBOARDING_COOKIE = "agent-native-first-run";
 export declare const FIRST_RUN_ONBOARDING_MAX_AGE: number;
+export declare const FIRST_RUN_ONBOARDING_COMPLETED_KEY = "onboarding:first-run-completed";
 //# sourceMappingURL=first-run-onboarding.d.ts.map

package/dist/shared/first-run-onboarding.js

@@ -1,3 +1,4 @@
 export const FIRST_RUN_ONBOARDING_COOKIE = "agent-native-first-run";
 export const FIRST_RUN_ONBOARDING_MAX_AGE = 24 * 60 * 60;
+export const FIRST_RUN_ONBOARDING_COMPLETED_KEY = "onboarding:first-run-completed";
 //# sourceMappingURL=first-run-onboarding.js.map

package/dist/templates/chat/.agents/skills/agent-native-docs/SKILL.md

@@ -31,6 +31,26 @@ the framework monorepo checkout.
 
 From a generated app directory:
 
+```bash
+pnpm action framework-search --pattern "defineAction"
+pnpm action framework-search --pattern "templates/*/actions/*.ts" --mode glob --scope source
+pnpm action framework-search --pattern "Agent(?:Panel|Sidebar)" --mode regex --scope source
+```
+
+Use `framework-search` first when a question may cross the docs and source
+boundary. It searches the version-matched framework docs, runtime-visible
+skills, readable Core or Toolkit package source, and first-party template
+corpus in one bounded read-only call. Use `scope: docs` or `scope: source` to
+narrow it, then use the existing focused readers for the page or file you need.
+
+The same tool is available in the headless `pnpm agent` loop and every built-in
+app agent. Its default substring mode is safest for ordinary questions; use
+`glob` for wildcard paths, `sql-like` for `%` and `_` wildcards, and `regex`
+for precise structural matches. Results are bounded, so refine the pattern or
+path instead of treating a truncated result as exhaustive.
+
+From a generated app directory, the lower-level readers remain available:
+
 ```bash
 pnpm action docs-search --query "<feature>"
 pnpm action docs-search --slug <slug>
@@ -41,9 +61,9 @@ pnpm action source-search --path templates/chat/actions/hello.ts
 pnpm action source-search --list
 ```
 
-The headless `pnpm agent` loop and built-in app agent also expose a read-only
-`docs-search` tool with the same `query`, `slug`, and `list` options, plus a
-read-only `source-search` tool with `query`, `path`, and `list`.
+The headless `pnpm agent` loop and built-in app agent also expose read-only
+`framework-search`, `docs-search`, and `source-search` tools. Use the unified
+tool for discovery, then the focused tools for full page or file reads.
 
 If the action runner is unavailable, search the package directly:
 

package/dist/templates/chat/.agents/skills/agent-native-toolkit/SKILL.md

@@ -65,6 +65,22 @@ Contextual agent UI is not a reason to expose every option at once. Start with
 the domain task's primary action, reveal review or configuration only when the
 current state needs it, and let the sidebar carry conversational depth.
 
+## Visual Direction And Workspace Variety
+
+Shared workspace behavior should be consistent without forcing every app into
+the same visual skin. Keep shell and component tokens semantic, then let each
+app declare a named direction in `DESIGN.md` before styling. A new app should
+choose its palette family and composition from the product context, compare
+nearby apps, and avoid inheriting their accent by default. Use the
+`frontend-design` visual-direction reference for mode, palette, type, density,
+shape, anti-references, and the `distill` / `typeset` / `colorize` / `layout` /
+`polish` / `audit` review vocabulary.
+
+Do not make warm beige plus terracotta the workspace fallback. Preserve a
+workspace-level brand when one exists; otherwise keep shared chrome neutral and
+allow app-owned accents to distinguish products while retaining accessible
+semantic states and the shared AgentSidebar contract.
+
 ## Discover Before Building
 
 Before creating an app-local version of repeated workspace or agent UI: