@agent-native/core 0.141.6 → 0.144.0

package/dist/server/onboarding-html.js

@@ -8,6 +8,7 @@
  */
 import { getLocaleInitScript } from "../localization/server.js";
 import { DEFAULT_LOCALE, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, } from "../localization/shared.js";
+import { PASSWORD_MIN_LENGTH } from "../shared/password-policy.js";
 import { signInJourneyInlineScript } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { normalizeAppBasePath } from "./app-base-path.js";
@@ -69,12 +70,12 @@ const EN_AUTH_COPY = {
     email: "Email",
     password: "Password",
     confirmPassword: "Confirm password",
-    passwordMinPlaceholder: "At least 8 characters",
+    passwordMinPlaceholder: `At least ${PASSWORD_MIN_LENGTH} characters`,
     confirmPasswordPlaceholder: "Confirm password",
     enterPasswordPlaceholder: "Enter password",
-    magicLinkTitle: "Sign in with a link",
-    magicLinkSubtitle: "Enter your email and we'll send you a secure sign-in link",
-    sendMagicLink: "Email me a sign-in link",
+    magicLinkTitle: "Welcome",
+    magicLinkSubtitle: "Create an account or sign in",
+    sendMagicLink: "Continue",
     magicLinkSent: "Check your email",
     magicLinkSentCopy: "We sent a secure sign-in link to",
     magicLinkFailed: "Could not send sign-in link.",
@@ -165,12 +166,12 @@ const AUTH_LOCALE_COPY = {
         email: "电子邮箱",
         password: "密码",
         confirmPassword: "确认密码",
-        passwordMinPlaceholder: "至少 8 个字符",
+        passwordMinPlaceholder: `至少 ${PASSWORD_MIN_LENGTH} 个字符`,
         confirmPasswordPlaceholder: "确认密码",
         enterPasswordPlaceholder: "输入密码",
-        magicLinkTitle: "使用链接登录",
-        magicLinkSubtitle: "输入邮箱，我们会发送安全登录链接",
-        sendMagicLink: "发送登录链接到邮箱",
+        magicLinkTitle: "欢迎",
+        magicLinkSubtitle: "创建账户或登录",
+        sendMagicLink: "继续",
         magicLinkSent: "检查你的邮箱",
         magicLinkSentCopy: "我们已向以下邮箱发送安全登录链接：",
         magicLinkFailed: "无法发送登录链接。",
@@ -259,12 +260,12 @@ const AUTH_LOCALE_COPY = {
         email: "電子郵件",
         password: "密碼",
         confirmPassword: "確認密碼",
-        passwordMinPlaceholder: "至少 8 個字元",
+        passwordMinPlaceholder: `至少 ${PASSWORD_MIN_LENGTH} 個字元`,
         confirmPasswordPlaceholder: "確認密碼",
         enterPasswordPlaceholder: "輸入密碼",
-        magicLinkTitle: "使用連結登入",
-        magicLinkSubtitle: "輸入電子郵件，我們會寄送安全登入連結",
-        sendMagicLink: "寄送登入連結",
+        magicLinkTitle: "歡迎",
+        magicLinkSubtitle: "建立帳戶或登入",
+        sendMagicLink: "繼續",
         magicLinkSent: "檢查你的電子郵件",
         magicLinkSentCopy: "我們已向以下電子郵件寄送安全登入連結：",
         magicLinkFailed: "無法寄送登入連結。",
@@ -353,12 +354,12 @@ const AUTH_LOCALE_COPY = {
         email: "Email",
         password: "Contraseña",
         confirmPassword: "Confirmar contraseña",
-        passwordMinPlaceholder: "Al menos 8 caracteres",
+        passwordMinPlaceholder: `Al menos ${PASSWORD_MIN_LENGTH} caracteres`,
         confirmPasswordPlaceholder: "Confirmar contraseña",
         enterPasswordPlaceholder: "Introduce la contraseña",
-        magicLinkTitle: "Inicia sesión con un enlace",
-        magicLinkSubtitle: "Introduce tu email y te enviaremos un enlace seguro",
-        sendMagicLink: "Enviarme un enlace de inicio de sesión",
+        magicLinkTitle: "Bienvenido",
+        magicLinkSubtitle: "Crea una cuenta o inicia sesión",
+        sendMagicLink: "Continuar",
         magicLinkSent: "Revisa tu email",
         magicLinkSentCopy: "Enviamos un enlace seguro a",
         magicLinkFailed: "No se pudo enviar el enlace de inicio de sesión.",
@@ -447,12 +448,12 @@ const AUTH_LOCALE_COPY = {
         email: "E-mail",
         password: "Mot de passe",
         confirmPassword: "Confirmer le mot de passe",
-        passwordMinPlaceholder: "Au moins 8 caractères",
+        passwordMinPlaceholder: `Au moins ${PASSWORD_MIN_LENGTH} caractères`,
         confirmPasswordPlaceholder: "Confirmer le mot de passe",
         enterPasswordPlaceholder: "Saisir le mot de passe",
-        magicLinkTitle: "Se connecter avec un lien",
-        magicLinkSubtitle: "Saisissez votre e-mail et nous vous enverrons un lien sécurisé",
-        sendMagicLink: "M'envoyer un lien de connexion",
+        magicLinkTitle: "Bienvenue",
+        magicLinkSubtitle: "Créez un compte ou connectez-vous",
+        sendMagicLink: "Continuer",
         magicLinkSent: "Vérifiez votre e-mail",
         magicLinkSentCopy: "Nous avons envoyé un lien sécurisé à",
         magicLinkFailed: "Impossible d'envoyer le lien de connexion.",
@@ -541,12 +542,12 @@ const AUTH_LOCALE_COPY = {
         email: "E-Mail",
         password: "Passwort",
         confirmPassword: "Passwort bestätigen",
-        passwordMinPlaceholder: "Mindestens 8 Zeichen",
+        passwordMinPlaceholder: `Mindestens ${PASSWORD_MIN_LENGTH} Zeichen`,
         confirmPasswordPlaceholder: "Passwort bestätigen",
         enterPasswordPlaceholder: "Passwort eingeben",
-        magicLinkTitle: "Mit einem Link anmelden",
-        magicLinkSubtitle: "Gib deine E-Mail ein und wir senden dir einen sicheren Anmeldelink",
-        sendMagicLink: "Anmeldelink per E-Mail senden",
+        magicLinkTitle: "Willkommen",
+        magicLinkSubtitle: "Konto erstellen oder anmelden",
+        sendMagicLink: "Weiter",
         magicLinkSent: "Prüfe deine E-Mail",
         magicLinkSentCopy: "Wir haben einen sicheren Anmeldelink gesendet an",
         magicLinkFailed: "Anmeldelink konnte nicht gesendet werden.",
@@ -635,12 +636,12 @@ const AUTH_LOCALE_COPY = {
         email: "メール",
         password: "パスワード",
         confirmPassword: "パスワードを確認",
-        passwordMinPlaceholder: "8 文字以上",
+        passwordMinPlaceholder: `${PASSWORD_MIN_LENGTH} 文字以上`,
         confirmPasswordPlaceholder: "パスワードを確認",
         enterPasswordPlaceholder: "パスワードを入力",
-        magicLinkTitle: "リンクでサインイン",
-        magicLinkSubtitle: "メールアドレスを入力すると、安全なサインインリンクを送信します",
-        sendMagicLink: "サインインリンクをメールで送信",
+        magicLinkTitle: "ようこそ",
+        magicLinkSubtitle: "アカウントを作成するかサインインしてください",
+        sendMagicLink: "続行",
         magicLinkSent: "メールを確認してください",
         magicLinkSentCopy: "安全なサインインリンクを送信しました：",
         magicLinkFailed: "サインインリンクを送信できませんでした。",
@@ -729,12 +730,12 @@ const AUTH_LOCALE_COPY = {
         email: "이메일",
         password: "비밀번호",
         confirmPassword: "비밀번호 확인",
-        passwordMinPlaceholder: "8자 이상",
+        passwordMinPlaceholder: `${PASSWORD_MIN_LENGTH}자 이상`,
         confirmPasswordPlaceholder: "비밀번호 확인",
         enterPasswordPlaceholder: "비밀번호 입력",
-        magicLinkTitle: "링크로 로그인",
-        magicLinkSubtitle: "이메일을 입력하면 안전한 로그인 링크를 보내드립니다",
-        sendMagicLink: "로그인 링크 이메일 받기",
+        magicLinkTitle: "환영합니다",
+        magicLinkSubtitle: "계정을 만들거나 로그인하세요",
+        sendMagicLink: "계속",
         magicLinkSent: "이메일을 확인하세요",
         magicLinkSentCopy: "안전한 로그인 링크를 보냈습니다:",
         magicLinkFailed: "로그인 링크를 보낼 수 없습니다.",
@@ -823,12 +824,12 @@ const AUTH_LOCALE_COPY = {
         email: "Email",
         password: "Senha",
         confirmPassword: "Confirmar senha",
-        passwordMinPlaceholder: "Pelo menos 8 caracteres",
+        passwordMinPlaceholder: `Pelo menos ${PASSWORD_MIN_LENGTH} caracteres`,
         confirmPasswordPlaceholder: "Confirmar senha",
         enterPasswordPlaceholder: "Digite a senha",
-        magicLinkTitle: "Entrar com um link",
-        magicLinkSubtitle: "Digite seu email e enviaremos um link seguro de acesso",
-        sendMagicLink: "Enviar link de acesso por email",
+        magicLinkTitle: "Bem-vindo",
+        magicLinkSubtitle: "Crie uma conta ou entre",
+        sendMagicLink: "Continuar",
         magicLinkSent: "Confira seu email",
         magicLinkSentCopy: "Enviamos um link seguro para",
         magicLinkFailed: "Não foi possível enviar o link de acesso.",
@@ -917,12 +918,12 @@ const AUTH_LOCALE_COPY = {
         email: "ईमेल",
         password: "पासवर्ड",
         confirmPassword: "पासवर्ड की पुष्टि करें",
-        passwordMinPlaceholder: "कम से कम 8 अक्षर",
+        passwordMinPlaceholder: `कम से कम ${PASSWORD_MIN_LENGTH} अक्षर`,
         confirmPasswordPlaceholder: "पासवर्ड की पुष्टि करें",
         enterPasswordPlaceholder: "पासवर्ड दर्ज करें",
-        magicLinkTitle: "लिंक से साइन इन करें",
-        magicLinkSubtitle: "अपना ईमेल दर्ज करें और हम सुरक्षित साइन-इन लिंक भेजेंगे",
-        sendMagicLink: "मुझे साइन-इन लिंक ईमेल करें",
+        magicLinkTitle: "स्वागत है",
+        magicLinkSubtitle: "खाता बनाएं या साइन इन करें",
+        sendMagicLink: "जारी रखें",
         magicLinkSent: "अपना ईमेल देखें",
         magicLinkSentCopy: "हमने सुरक्षित साइन-इन लिंक यहां भेजा है:",
         magicLinkFailed: "साइन-इन लिंक नहीं भेजा जा सका।",
@@ -1011,12 +1012,12 @@ const AUTH_LOCALE_COPY = {
         email: "البريد الإلكتروني",
         password: "كلمة المرور",
         confirmPassword: "تأكيد كلمة المرور",
-        passwordMinPlaceholder: "8 أحرف على الأقل",
+        passwordMinPlaceholder: `${PASSWORD_MIN_LENGTH} أحرف على الأقل`,
         confirmPasswordPlaceholder: "تأكيد كلمة المرور",
         enterPasswordPlaceholder: "أدخل كلمة المرور",
-        magicLinkTitle: "تسجيل الدخول باستخدام رابط",
-        magicLinkSubtitle: "أدخل بريدك الإلكتروني وسنرسل لك رابط تسجيل دخول آمنًا",
-        sendMagicLink: "إرسال رابط تسجيل الدخول إلى بريدي",
+        magicLinkTitle: "مرحبًا",
+        magicLinkSubtitle: "أنشئ حسابًا أو سجّل الدخول",
+        sendMagicLink: "متابعة",
         magicLinkSent: "تحقق من بريدك الإلكتروني",
         magicLinkSentCopy: "أرسلنا رابط تسجيل دخول آمنًا إلى",
         magicLinkFailed: "تعذر إرسال رابط تسجيل الدخول.",
@@ -1216,6 +1217,7 @@ export function getOnboardingHtml(opts = {}) {
     const googleOnly = !!opts.googleOnly;
     const authMode = opts.authMode ?? "password";
     const magicLinkMode = authMode === "magic-link";
+    const simplifiedAuth = opts.initialPrompt === true;
     // In a Google-only app, Google is the sole sign-in method, so always render
     // a working button — never gate it on env vars detected at render time. The
     // login page is a public, CDN-cacheable shell served to everyone (per-user
@@ -1234,7 +1236,7 @@ export function getOnboardingHtml(opts = {}) {
             requestHost: opts.requestHost,
             requestPath: opts.requestPath,
         });
-    const hasMarketing = !!marketing;
+    const hasMarketing = !!marketing && !simplifiedAuth;
     const marketingSlug = resolveBuiltInMarketingSlug(marketing);
     const defaultMarketingCopy = marketing
         ? {
@@ -1313,6 +1315,13 @@ ${localeMenuItemsHtml}
     const signupLegalNoteHtml = signupLegalNotice
         ? `      <p class="legal-note">${localizedValue(signupLegalNotice.prefix, "legalPrefix")} <a href="${esc(signupLegalNotice.termsUrl)}" target="_blank" rel="noreferrer"${localizedAnchorLabel(signupLegalNotice.termsLabel, "legalTerms")}</a> ${localizedValue(signupLegalNotice.connector, "legalConnector")} <a href="${esc(signupLegalNotice.privacyUrl)}" target="_blank" rel="noreferrer"${localizedAnchorLabel(signupLegalNotice.privacyLabel, "legalPrivacy")}</a>${localizedValue(signupLegalNotice.suffix, "legalSuffix")}</p>`
         : "";
+    const magicLinkSuccessHtml = magicLinkMode
+        ? `    <div class="magic-link-success" id="magic-link-success" aria-live="polite" hidden>
+      <p class="magic-link-success-copy"><span${i18nAttr("magicLinkSentCopy")}>${esc(t("magicLinkSentCopy"))}</span> <strong id="magic-link-success-email"></strong>.</p>
+      <button type="button" class="link-button magic-link-back" id="magic-link-back"${i18nAttr("back")}>${esc(t("back"))}</button>
+    </div>
+`
+        : "";
     const signupLocalModeNoteHtml = signupLocalModeNote
         ? `      <div class="signup-local-mode-note" id="signup-local-mode-note" data-command="${esc(signupLocalModeNote.command)}">
         <p>${esc(signupLocalModeNote.text)}</p>
@@ -1371,6 +1380,9 @@ ${googleNoticeRunLocalPanelHtml}
   </div>`
         : "";
     const identitySsoHtml = identitySsoLoginButtonHtml();
+    const identitySsoMagicLinkSelector = identitySsoHtml
+        ? "  .card.magic-link-complete #identity-sso-btn,\n"
+        : "";
     const identitySsoScript = identitySsoHtml
         ? `
     function __anIdentitySsoUrl() {
@@ -1914,6 +1926,7 @@ ${hasMarketing
     background: rgba(255,255,255,0.06);
     border-radius: 8px;
   }
+  .tabs[hidden] { display: none; }
   .tab {
     flex: 1;
     padding: 0.5rem 0.75rem;
@@ -1981,11 +1994,12 @@ ${hasMarketing
   }
   .btn-secondary:hover { color: #bbb; border-color: rgba(255,255,255,0.2); }
   .legal-note {
-    margin-top: 0.625rem;
+    margin-top: 0.375rem;
+    margin-bottom: 0.875rem;
     color: #666;
     font-size: 0.6875rem;
     line-height: 1.45;
-    text-align: center;
+    text-align: start;
   }
   .legal-note a {
     color: #777;
@@ -2124,8 +2138,45 @@ ${hasMarketing
     text-decoration: underline;
     text-underline-offset: 2px;
   }
+  .auth-mode-link { text-decoration: none; }
   .link-button:hover { color: #bbb; }
   .link-button:disabled { cursor: wait; opacity: 0.5; }
+  .magic-link-submit { display: none; }
+  .magic-link-submit.is-visible { display: block; }
+  .magic-link-success { display: none; }
+  .magic-link-success.is-visible { display: block; }
+  .magic-link-success-copy {
+    margin: 0;
+    color: rgba(255,255,255,0.62); /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+    font-size: 0.875rem;
+    line-height: 1.5;
+  }
+  .magic-link-success-copy strong {
+    color: inherit;
+    font-weight: 600;
+    overflow-wrap: anywhere;
+  }
+  .magic-link-back {
+    margin-top: 1.5rem;
+    text-decoration: none;
+  }
+  .btn-google.magic-link-secondary {
+    background: transparent;
+    color: inherit;
+    border: 1px solid rgba(255,255,255,0.16); /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  }
+  .btn-google.magic-link-secondary:hover {
+    background: rgba(255,255,255,0.05); /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  }
+  .card.magic-link-complete .subtitle,
+  .card.magic-link-complete #google-signin,
+${identitySsoMagicLinkSelector}
+  .card.magic-link-complete #auth-divider,
+  .card.magic-link-complete #auth-tabs,
+  .card.magic-link-complete #upgrade-note,
+  .card.magic-link-complete .form {
+    display: none;
+  }
   .divider {
     display: flex;
     align-items: center;
@@ -2323,14 +2374,18 @@ ${hasMarketing
   .local-note a { color: #888; text-decoration: none; }
   .local-note a:hover { color: #bbb; }
 ${marketingStyles}
+  /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  body.simplified-auth { background: #141414; }
+  body.simplified-auth .card { border-color: transparent; box-shadow: none; }
+  body.simplified-auth .local-note { display: none !important; }
 </style>
 </head>
-<body${hasMarketing ? ' class="has-marketing"' : ""}>
+<body${simplifiedAuth ? ' class="simplified-auth"' : hasMarketing ? ' class="has-marketing"' : ""}>
 ${localePickerHtml}
 ${marketingPanelHtml}
 <div class="card">
-  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle"))}</h1>
-  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle"))}</p>
+  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : "welcomeTitle"))}</h1>
+  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle"))}</p>
   <p
     class="upgrade-note"
     id="upgrade-note"
@@ -2354,7 +2409,7 @@ ${googleOnly ? "" : `\n  <div class="divider" id="auth-divider"${i18nAttr("divid
         : ""}
 ${googleOnly
         ? ""
-        : `${magicLinkMode ? '\n    <form id="magic-link-form" class="form">\n      <label for="m-email"' + i18nAttr("email") + ">" + esc(t("email")) + '</label>\n      <input id="m-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />\n      <button type="submit"' + i18nAttr("sendMagicLink") + ">" + esc(t("sendMagicLink")) + '</button>\n      <p class="msg" id="m-msg"></p>\n      <p style="margin-top:0.75rem;font-size:0.75rem;text-align:center">\n        <a href="#" id="use-password-link" class="link-button"' + i18nAttr("usePasswordInstead") + ">" + esc(t("usePasswordInstead")) + "</a>\n      </p>\n    </form>\n" : ""}  <div class="tabs"${magicLinkMode ? " hidden" : ""}>
+        : `${magicLinkMode ? '\n    <form id="magic-link-form" class="form">\n      <label for="m-email"' + i18nAttr("email") + ">" + esc(t("email")) + '</label>\n      <input id="m-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />\n      <button type="submit" id="magic-link-submit" class="magic-link-submit"' + i18nAttr("sendMagicLink") + ">" + esc(t("sendMagicLink")) + '</button>\n      <p class="msg" id="m-msg"></p>\n' + signupLegalNoteHtml + '\n      <p style="margin-top:0.75rem;font-size:0.75rem;text-align:start">\n        <a href="#" id="use-password-link" class="link-button auth-mode-link"' + i18nAttr("usePasswordInstead") + ">" + esc(t("usePasswordInstead")) + "</a>\n      </p>\n    </form>\n" : ""}${magicLinkSuccessHtml}  <div class="tabs" id="auth-tabs">
     <button class="tab" data-tab="signup"${i18nAttr("createAccount")}>${esc(t("createAccount"))}</button>
     <button class="tab" data-tab="login"${i18nAttr("signIn")}>${esc(t("signIn"))}</button>
   </div>
@@ -2363,9 +2418,9 @@ ${googleOnly
       <label for="s-email"${i18nAttr("email")}>${esc(t("email"))}</label>
       <input id="s-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />
     <label for="s-pass"${i18nAttr("password")}>${esc(t("password"))}</label>
-    <input id="s-pass" type="password" autocomplete="new-password" placeholder="${esc(t("passwordMinPlaceholder"))}"${i18nPlaceholderAttr("passwordMinPlaceholder")} required minlength="8" />
+    <input id="s-pass" type="password" autocomplete="new-password" placeholder="${esc(t("passwordMinPlaceholder"))}"${i18nPlaceholderAttr("passwordMinPlaceholder")} required minlength="${PASSWORD_MIN_LENGTH}" />
     <label for="s-pass2"${i18nAttr("confirmPassword")}>${esc(t("confirmPassword"))}</label>
-    <input id="s-pass2" type="password" autocomplete="new-password" placeholder="${esc(t("confirmPasswordPlaceholder"))}"${i18nPlaceholderAttr("confirmPasswordPlaceholder")} required minlength="8" />
+    <input id="s-pass2" type="password" autocomplete="new-password" placeholder="${esc(t("confirmPasswordPlaceholder"))}"${i18nPlaceholderAttr("confirmPasswordPlaceholder")} required minlength="${PASSWORD_MIN_LENGTH}" />
       <button type="submit"${i18nAttr("createAccount")}>${esc(t("createAccount"))}</button>
 ${signupLegalNoteHtml}
 ${signupLocalModeNoteHtml}
@@ -2453,7 +2508,7 @@ ${signInJourneyInlineScript()}
     var __anAuthLocale = __AN_AUTH_DEFAULT_LOCALE;
     var __anAuthLocalePreference = 'system';
     var __AN_AUTH_MODE = ${JSON.stringify(authMode)};
-    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : magicLinkMode ? "magicLink" : "signup")};
+    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : "signup")};
     function __anAuthLocaleIsSupported(value) {
       return __AN_AUTH_SUPPORTED_LOCALES.indexOf(value) !== -1;
     }
@@ -2521,6 +2576,7 @@ ${signInJourneyInlineScript()}
       if (view === 'forgot') return { heading: 'resetPasswordTitle', subtitle: 'resetPasswordSubtitle' };
       if (view === 'verification') return { heading: 'checkEmailTitle', subtitle: 'finishAccountSubtitle' };
       if (view === 'googleOnly') return { heading: 'signInTitle', subtitle: 'googleOnlySubtitle' };
+      if (view === 'magicLinkSent') return { heading: 'magicLinkSent', subtitle: 'magicLinkSentCopy' };
       if (view === 'magicLink') return { heading: 'magicLinkTitle', subtitle: 'magicLinkSubtitle' };
       return { heading: 'welcomeTitle', subtitle: 'createAccountSubtitle' };
     }
@@ -3142,19 +3198,59 @@ ${googleOnly
 	    function clearRememberedPendingSignupEmail() {
 	      rememberPendingSignupEmail('');
 	    }
+    function hideMagicLinkSuccess() {
+      var card = document.querySelector('.card');
+      if (card) card.classList.remove('magic-link-complete');
+      var success = document.getElementById('magic-link-success');
+      if (success) {
+        success.classList.remove('is-visible');
+        success.setAttribute('hidden', '');
+      }
+    }
+    function showMagicLinkSuccess(email) {
+      var card = document.querySelector('.card');
+      if (card) card.classList.add('magic-link-complete');
+      var success = document.getElementById('magic-link-success');
+      var successEmail = document.getElementById('magic-link-success-email');
+      if (successEmail && typeof email === 'string') successEmail.textContent = email;
+      if (success) {
+        success.removeAttribute('hidden');
+        success.classList.add('is-visible');
+      }
+      forms.forEach(function(x) { x.classList.remove('active'); });
+      var authTabs = document.getElementById('auth-tabs');
+      if (authTabs) authTabs.hidden = true;
+      __anSetAuthView('magicLinkSent');
+    }
     function showMagicLinkForm() {
       var form = document.getElementById('magic-link-form');
       if (!form) return;
+      hideMagicLinkSuccess();
       forms.forEach(function(x) { x.classList.remove('active'); });
       form.classList.add('active');
+      var authTabs = document.getElementById('auth-tabs');
+      if (authTabs) authTabs.hidden = true;
+      updateMagicLinkSubmitState();
       __anSetAuthView('magicLink');
     }
+    function updateMagicLinkSubmitState() {
+      var emailInput = document.getElementById('m-email');
+      var button = document.getElementById('magic-link-submit');
+      if (!emailInput || !button) return;
+      var isValid = __anIsValidAuthEmail(emailInput.value);
+      button.classList.toggle('is-visible', isValid);
+      button.setAttribute('aria-hidden', isValid ? 'false' : 'true');
+      var googleButton = document.getElementById('google-btn');
+      if (googleButton) googleButton.classList.toggle('magic-link-secondary', isValid);
+    }
     function setActiveTab(name, opts) {
 	      if (name !== 'signup' && name !== 'login') return;
 	      var form = document.getElementById(name + '-form');
 	      if (!form) return;
       var card = document.querySelector('.card');
       if (card) card.classList.remove('verifying');
+      var authTabs = document.getElementById('auth-tabs');
+      if (authTabs) authTabs.hidden = false;
       tabs.forEach(function(x) { x.classList.remove('active'); });
       forms.forEach(function(x) { x.classList.remove('active'); });
     var btn = document.querySelector('.tab[data-tab="' + name + '"]');
@@ -3402,7 +3498,7 @@ ${googleOnly
       }
     }
     (function initActiveTab() {
-    var initial = __AN_AUTH_MODE === 'magic-link' ? 'magicLink' : 'signup';
+    var initial = 'signup';
     try {
       var params = new URLSearchParams(location.search);
       var qp = params.get('tab');
@@ -3421,8 +3517,7 @@ ${googleOnly
         if (stored === 'login' || stored === 'signup') initial = stored;
       }
     } catch (e) {}
-    if (initial === 'magicLink') showMagicLinkForm();
-    else setActiveTab(initial, { persist: false });
+    setActiveTab(initial, { persist: false });
 	      try {
 	        if (__anIsVerifiedRedirectSuccess()) {
 	          var rememberedEmail = readRememberedPendingSignupEmail();
@@ -3455,8 +3550,22 @@ ${googleOnly
     e.preventDefault();
     showMagicLinkForm();
   });
+  var magicLinkBack = document.getElementById('magic-link-back');
+  if (magicLinkBack) magicLinkBack.addEventListener('click', function(e) {
+    e.preventDefault();
+    var magicLinkEmailInput = document.getElementById('m-email');
+    if (magicLinkEmailInput) magicLinkEmailInput.value = '';
+    showMagicLinkForm();
+    if (magicLinkEmailInput) magicLinkEmailInput.focus();
+  });
 
   var magicLinkForm = document.getElementById('magic-link-form');
+  var magicLinkEmail = document.getElementById('m-email');
+  if (magicLinkEmail) {
+    magicLinkEmail.addEventListener('input', updateMagicLinkSubmitState);
+    magicLinkEmail.addEventListener('change', updateMagicLinkSubmitState);
+    updateMagicLinkSubmitState();
+  }
   if (magicLinkForm) magicLinkForm.addEventListener('submit', async function(e) {
     e.preventDefault();
     var btn = magicLinkForm.querySelector('button[type="submit"]');
@@ -3482,9 +3591,9 @@ ${googleOnly
         return null;
       });
       if (res.ok) {
-        msg.textContent = __anT('magicLinkSent') + '. ' + __anT('magicLinkSentCopy') + ' ' + email + '.';
-        msg.classList.add('show', 'success');
-        btn.textContent = __anT('sent');
+        btn.disabled = false;
+        btn.textContent = originalLabel;
+        showMagicLinkSuccess(email);
         return;
       }
       msg.textContent = (data && (data.error || data.message)) || __anT('magicLinkFailed');
@@ -3895,9 +4004,9 @@ export function getResetPasswordHtml() {
   <p class="subtitle">Set a new password for your account.</p>
   <form id="reset-form">
     <label for="p1">New password</label>
-    <input id="p1" type="password" autocomplete="new-password" autofocus placeholder="At least 8 characters" required minlength="8" />
+    <input id="p1" type="password" autocomplete="new-password" autofocus placeholder="At least ${PASSWORD_MIN_LENGTH} characters" required minlength="${PASSWORD_MIN_LENGTH}" />
     <label for="p2">Confirm password</label>
-    <input id="p2" type="password" autocomplete="new-password" placeholder="Confirm password" required minlength="8" />
+    <input id="p2" type="password" autocomplete="new-password" placeholder="Confirm password" required minlength="${PASSWORD_MIN_LENGTH}" />
     <button type="submit">Save new password</button>
     <p class="msg" id="msg"></p>
   </form>

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
-    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
+    error?: undefined;
 }>>;

package/dist/server/self-dispatch.d.ts

@@ -7,10 +7,11 @@
  */
 export declare const DEFAULT_DISPATCH_SETTLE_MS = 250;
 /**
- * Resolve the base URL to fire a self-dispatch request at. Prefers explicit env
- * vars (most reliable on serverless, where inbound host headers can be the
- * platform's internal hostname), falling back to the inbound request headers
- * and finally localhost in dev.
+ * Resolve the base URL to fire a self-dispatch request at. Prefer the URL for
+ * this exact deploy before stable app URLs: a preview or in-flight deploy must
+ * not send a token minted by its function fleet to a different deploy that
+ * happens to serve the same public hostname. Fall back to the inbound request
+ * headers and finally localhost in dev.
  *
  * Throws in production / shared deployments when no env var is set — a silent
  * fallback to a bad host there would drop background work invisibly.

package/dist/server/self-dispatch.js

@@ -47,23 +47,26 @@ function readHeader(event, name) {
     }
 }
 /**
- * Resolve the base URL to fire a self-dispatch request at. Prefers explicit env
- * vars (most reliable on serverless, where inbound host headers can be the
- * platform's internal hostname), falling back to the inbound request headers
- * and finally localhost in dev.
+ * Resolve the base URL to fire a self-dispatch request at. Prefer the URL for
+ * this exact deploy before stable app URLs: a preview or in-flight deploy must
+ * not send a token minted by its function fleet to a different deploy that
+ * happens to serve the same public hostname. Fall back to the inbound request
+ * headers and finally localhost in dev.
  *
  * Throws in production / shared deployments when no env var is set — a silent
  * fallback to a bad host there would drop background work invisibly.
  */
 export function resolveSelfDispatchBaseUrl(event) {
-    const fromEnv = process.env.APP_URL ||
-        process.env.URL ||
+    const fromEnv = process.env.DEPLOY_PRIME_URL ||
         process.env.DEPLOY_URL ||
+        process.env.URL ||
+        process.env.APP_URL ||
         process.env.BETTER_AUTH_URL;
     if (fromEnv)
         return withConfiguredAppBasePath(String(fromEnv));
     if (process.env.NODE_ENV === "production" || !isLocalDatabase()) {
-        throw new Error("Self-dispatch requires APP_URL, URL, DEPLOY_URL, or BETTER_AUTH_URL in " +
+        throw new Error("Self-dispatch requires DEPLOY_PRIME_URL, DEPLOY_URL, URL, APP_URL, or " +
+            "BETTER_AUTH_URL in " +
             "production/shared deployments so background work can reach this " +
             "deployment's own URL.");
     }
@@ -88,9 +91,10 @@ async function dispatchResponseError(path, res) {
  * may take minutes); it is only raced against a short settle timer so the
  * request reliably leaves a serverless box before it freezes.
  *
- * When `A2A_SECRET` is unset (local dev), the request is sent unsigned — the
- * processor accepts unsigned dispatches in dev and relies on the SQL atomic
- * claim for double-processing protection, mirroring the A2A/webhook flow.
+ * When `A2A_SECRET` is unset in local SQLite development, the request is sent
+ * unsigned — the processor accepts unsigned dispatches in dev and relies on
+ * the SQL atomic claim for double-processing protection. Shared and production
+ * dispatches fail before sending an unauthenticated request.
  */
 /**
  * For host-root dispatch targets (`/.netlify/functions/*`), strip the configured
@@ -127,10 +131,17 @@ export async function fireInternalDispatch(options) {
         headers["Authorization"] = `Bearer ${signInternalToken(options.taskId)}`;
     }
     catch (err) {
-        // Distinguish the documented "no A2A_SECRET in dev" path from a real
-        // signing failure, so a malformed secret doesn't fail invisibly.
-        if (err instanceof Error && !/A2A_SECRET/i.test(err.message)) {
-            console.error(`[self-dispatch] signInternalToken failed unexpectedly for ${options.taskId}:`, err);
+        const detail = err instanceof Error ? err.message : String(err);
+        // Only local SQLite development has the loopback/unsigned exception. A
+        // shared database or production deployment must never turn a signing
+        // failure into an unauthenticated processor request.
+        if (process.env.NODE_ENV !== "production" &&
+            isLocalDatabase() &&
+            /A2A_SECRET/i.test(detail)) {
+            // The processor applies the matching trusted-local policy.
+        }
+        else {
+            throw new Error(`[self-dispatch] Cannot sign processor handoff for ${options.taskId}: ${detail}`, { cause: err });
         }
     }
     const awaitResponse = options.awaitResponse === true;

package/dist/server/ssr-handler.d.ts

@@ -1,4 +1,4 @@
-export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
+export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
 /**
  * Create an h3 catch-all that hands page routes to React Router and
  * returns 404 for framework / asset paths that React Router doesn't own.

package/dist/server/ssr-handler.js

@@ -25,7 +25,7 @@ import { captureError } from "./capture-error.js";
 import { getPostHogClientConfigScript } from "./posthog-config.js";
 import { runWithRequestContext } from "./request-context.js";
 import { getRealtimeClientConfigScript, getSentryClientConfigScript, } from "./sentry-config.js";
-export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
+export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
 function getAppBasePath() {
     return getAppBasePathFromViteEnv();
 }

package/dist/server/workspace-provider-oauth.js

@@ -249,7 +249,7 @@ export async function handleWorkspaceProviderOAuthCallback(event, providerId) {
             });
         }
         const returnPath = state.returnUrl ??
-            `/settings?connected=${encodeURIComponent(providerId)}#integrations`;
+            `/settings/integrations?connected=${encodeURIComponent(providerId)}`;
         return Response.redirect(getAppUrl(event, returnPath), 302);
     });
 }

package/dist/setup-connections/onboarding.js

@@ -1,5 +1,5 @@
 import { registerOnboardingStep } from "../onboarding/registry.js";
-export function registerWorkspaceConnectionOnboardingStep({ id, providerId, providerLabel, title, description, order = 50, required = false, settingsUrl = "/settings#integrations", isComplete, }) {
+export function registerWorkspaceConnectionOnboardingStep({ id, providerId, providerLabel, title, description, order = 50, required = false, settingsUrl = "/settings/integrations", isComplete, }) {
     const label = providerLabel ?? providerId;
     registerOnboardingStep({
         id: id ?? `${providerId}-connection`,