@agent-native/core 0.141.7 → 0.144.0

package/dist/server/onboarding-html.js

@@ -8,6 +8,7 @@
  */
 import { getLocaleInitScript } from "../localization/server.js";
 import { DEFAULT_LOCALE, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, } from "../localization/shared.js";
+import { PASSWORD_MIN_LENGTH } from "../shared/password-policy.js";
 import { signInJourneyInlineScript } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { normalizeAppBasePath } from "./app-base-path.js";
@@ -69,7 +70,7 @@ const EN_AUTH_COPY = {
     email: "Email",
     password: "Password",
     confirmPassword: "Confirm password",
-    passwordMinPlaceholder: "At least 8 characters",
+    passwordMinPlaceholder: `At least ${PASSWORD_MIN_LENGTH} characters`,
     confirmPasswordPlaceholder: "Confirm password",
     enterPasswordPlaceholder: "Enter password",
     magicLinkTitle: "Welcome",
@@ -165,7 +166,7 @@ const AUTH_LOCALE_COPY = {
         email: "电子邮箱",
         password: "密码",
         confirmPassword: "确认密码",
-        passwordMinPlaceholder: "至少 8 个字符",
+        passwordMinPlaceholder: `至少 ${PASSWORD_MIN_LENGTH} 个字符`,
         confirmPasswordPlaceholder: "确认密码",
         enterPasswordPlaceholder: "输入密码",
         magicLinkTitle: "欢迎",
@@ -259,7 +260,7 @@ const AUTH_LOCALE_COPY = {
         email: "電子郵件",
         password: "密碼",
         confirmPassword: "確認密碼",
-        passwordMinPlaceholder: "至少 8 個字元",
+        passwordMinPlaceholder: `至少 ${PASSWORD_MIN_LENGTH} 個字元`,
         confirmPasswordPlaceholder: "確認密碼",
         enterPasswordPlaceholder: "輸入密碼",
         magicLinkTitle: "歡迎",
@@ -353,7 +354,7 @@ const AUTH_LOCALE_COPY = {
         email: "Email",
         password: "Contraseña",
         confirmPassword: "Confirmar contraseña",
-        passwordMinPlaceholder: "Al menos 8 caracteres",
+        passwordMinPlaceholder: `Al menos ${PASSWORD_MIN_LENGTH} caracteres`,
         confirmPasswordPlaceholder: "Confirmar contraseña",
         enterPasswordPlaceholder: "Introduce la contraseña",
         magicLinkTitle: "Bienvenido",
@@ -447,7 +448,7 @@ const AUTH_LOCALE_COPY = {
         email: "E-mail",
         password: "Mot de passe",
         confirmPassword: "Confirmer le mot de passe",
-        passwordMinPlaceholder: "Au moins 8 caractères",
+        passwordMinPlaceholder: `Au moins ${PASSWORD_MIN_LENGTH} caractères`,
         confirmPasswordPlaceholder: "Confirmer le mot de passe",
         enterPasswordPlaceholder: "Saisir le mot de passe",
         magicLinkTitle: "Bienvenue",
@@ -541,7 +542,7 @@ const AUTH_LOCALE_COPY = {
         email: "E-Mail",
         password: "Passwort",
         confirmPassword: "Passwort bestätigen",
-        passwordMinPlaceholder: "Mindestens 8 Zeichen",
+        passwordMinPlaceholder: `Mindestens ${PASSWORD_MIN_LENGTH} Zeichen`,
         confirmPasswordPlaceholder: "Passwort bestätigen",
         enterPasswordPlaceholder: "Passwort eingeben",
         magicLinkTitle: "Willkommen",
@@ -635,7 +636,7 @@ const AUTH_LOCALE_COPY = {
         email: "メール",
         password: "パスワード",
         confirmPassword: "パスワードを確認",
-        passwordMinPlaceholder: "8 文字以上",
+        passwordMinPlaceholder: `${PASSWORD_MIN_LENGTH} 文字以上`,
         confirmPasswordPlaceholder: "パスワードを確認",
         enterPasswordPlaceholder: "パスワードを入力",
         magicLinkTitle: "ようこそ",
@@ -729,7 +730,7 @@ const AUTH_LOCALE_COPY = {
         email: "이메일",
         password: "비밀번호",
         confirmPassword: "비밀번호 확인",
-        passwordMinPlaceholder: "8자 이상",
+        passwordMinPlaceholder: `${PASSWORD_MIN_LENGTH}자 이상`,
         confirmPasswordPlaceholder: "비밀번호 확인",
         enterPasswordPlaceholder: "비밀번호 입력",
         magicLinkTitle: "환영합니다",
@@ -823,7 +824,7 @@ const AUTH_LOCALE_COPY = {
         email: "Email",
         password: "Senha",
         confirmPassword: "Confirmar senha",
-        passwordMinPlaceholder: "Pelo menos 8 caracteres",
+        passwordMinPlaceholder: `Pelo menos ${PASSWORD_MIN_LENGTH} caracteres`,
         confirmPasswordPlaceholder: "Confirmar senha",
         enterPasswordPlaceholder: "Digite a senha",
         magicLinkTitle: "Bem-vindo",
@@ -917,7 +918,7 @@ const AUTH_LOCALE_COPY = {
         email: "ईमेल",
         password: "पासवर्ड",
         confirmPassword: "पासवर्ड की पुष्टि करें",
-        passwordMinPlaceholder: "कम से कम 8 अक्षर",
+        passwordMinPlaceholder: `कम से कम ${PASSWORD_MIN_LENGTH} अक्षर`,
         confirmPasswordPlaceholder: "पासवर्ड की पुष्टि करें",
         enterPasswordPlaceholder: "पासवर्ड दर्ज करें",
         magicLinkTitle: "स्वागत है",
@@ -1011,7 +1012,7 @@ const AUTH_LOCALE_COPY = {
         email: "البريد الإلكتروني",
         password: "كلمة المرور",
         confirmPassword: "تأكيد كلمة المرور",
-        passwordMinPlaceholder: "8 أحرف على الأقل",
+        passwordMinPlaceholder: `${PASSWORD_MIN_LENGTH} أحرف على الأقل`,
         confirmPasswordPlaceholder: "تأكيد كلمة المرور",
         enterPasswordPlaceholder: "أدخل كلمة المرور",
         magicLinkTitle: "مرحبًا",
@@ -1216,6 +1217,7 @@ export function getOnboardingHtml(opts = {}) {
     const googleOnly = !!opts.googleOnly;
     const authMode = opts.authMode ?? "password";
     const magicLinkMode = authMode === "magic-link";
+    const simplifiedAuth = opts.initialPrompt === true;
     // In a Google-only app, Google is the sole sign-in method, so always render
     // a working button — never gate it on env vars detected at render time. The
     // login page is a public, CDN-cacheable shell served to everyone (per-user
@@ -1234,7 +1236,7 @@ export function getOnboardingHtml(opts = {}) {
             requestHost: opts.requestHost,
             requestPath: opts.requestPath,
         });
-    const hasMarketing = !!marketing;
+    const hasMarketing = !!marketing && !simplifiedAuth;
     const marketingSlug = resolveBuiltInMarketingSlug(marketing);
     const defaultMarketingCopy = marketing
         ? {
@@ -1313,6 +1315,13 @@ ${localeMenuItemsHtml}
     const signupLegalNoteHtml = signupLegalNotice
         ? `      <p class="legal-note">${localizedValue(signupLegalNotice.prefix, "legalPrefix")} <a href="${esc(signupLegalNotice.termsUrl)}" target="_blank" rel="noreferrer"${localizedAnchorLabel(signupLegalNotice.termsLabel, "legalTerms")}</a> ${localizedValue(signupLegalNotice.connector, "legalConnector")} <a href="${esc(signupLegalNotice.privacyUrl)}" target="_blank" rel="noreferrer"${localizedAnchorLabel(signupLegalNotice.privacyLabel, "legalPrivacy")}</a>${localizedValue(signupLegalNotice.suffix, "legalSuffix")}</p>`
         : "";
+    const magicLinkSuccessHtml = magicLinkMode
+        ? `    <div class="magic-link-success" id="magic-link-success" aria-live="polite" hidden>
+      <p class="magic-link-success-copy"><span${i18nAttr("magicLinkSentCopy")}>${esc(t("magicLinkSentCopy"))}</span> <strong id="magic-link-success-email"></strong>.</p>
+      <button type="button" class="link-button magic-link-back" id="magic-link-back"${i18nAttr("back")}>${esc(t("back"))}</button>
+    </div>
+`
+        : "";
     const signupLocalModeNoteHtml = signupLocalModeNote
         ? `      <div class="signup-local-mode-note" id="signup-local-mode-note" data-command="${esc(signupLocalModeNote.command)}">
         <p>${esc(signupLocalModeNote.text)}</p>
@@ -1371,6 +1380,9 @@ ${googleNoticeRunLocalPanelHtml}
   </div>`
         : "";
     const identitySsoHtml = identitySsoLoginButtonHtml();
+    const identitySsoMagicLinkSelector = identitySsoHtml
+        ? "  .card.magic-link-complete #identity-sso-btn,\n"
+        : "";
     const identitySsoScript = identitySsoHtml
         ? `
     function __anIdentitySsoUrl() {
@@ -1982,11 +1994,12 @@ ${hasMarketing
   }
   .btn-secondary:hover { color: #bbb; border-color: rgba(255,255,255,0.2); }
   .legal-note {
-    margin-top: 0.625rem;
+    margin-top: 0.375rem;
+    margin-bottom: 0.875rem;
     color: #666;
     font-size: 0.6875rem;
     line-height: 1.45;
-    text-align: center;
+    text-align: start;
   }
   .legal-note a {
     color: #777;
@@ -2130,6 +2143,40 @@ ${hasMarketing
   .link-button:disabled { cursor: wait; opacity: 0.5; }
   .magic-link-submit { display: none; }
   .magic-link-submit.is-visible { display: block; }
+  .magic-link-success { display: none; }
+  .magic-link-success.is-visible { display: block; }
+  .magic-link-success-copy {
+    margin: 0;
+    color: rgba(255,255,255,0.62); /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+    font-size: 0.875rem;
+    line-height: 1.5;
+  }
+  .magic-link-success-copy strong {
+    color: inherit;
+    font-weight: 600;
+    overflow-wrap: anywhere;
+  }
+  .magic-link-back {
+    margin-top: 1.5rem;
+    text-decoration: none;
+  }
+  .btn-google.magic-link-secondary {
+    background: transparent;
+    color: inherit;
+    border: 1px solid rgba(255,255,255,0.16); /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  }
+  .btn-google.magic-link-secondary:hover {
+    background: rgba(255,255,255,0.05); /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  }
+  .card.magic-link-complete .subtitle,
+  .card.magic-link-complete #google-signin,
+${identitySsoMagicLinkSelector}
+  .card.magic-link-complete #auth-divider,
+  .card.magic-link-complete #auth-tabs,
+  .card.magic-link-complete #upgrade-note,
+  .card.magic-link-complete .form {
+    display: none;
+  }
   .divider {
     display: flex;
     align-items: center;
@@ -2327,14 +2374,18 @@ ${hasMarketing
   .local-note a { color: #888; text-decoration: none; }
   .local-note a:hover { color: #bbb; }
 ${marketingStyles}
+  /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  body.simplified-auth { background: #141414; }
+  body.simplified-auth .card { border-color: transparent; box-shadow: none; }
+  body.simplified-auth .local-note { display: none !important; }
 </style>
 </head>
-<body${hasMarketing ? ' class="has-marketing"' : ""}>
+<body${simplifiedAuth ? ' class="simplified-auth"' : hasMarketing ? ' class="has-marketing"' : ""}>
 ${localePickerHtml}
 ${marketingPanelHtml}
 <div class="card">
-  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle"))}</h1>
-  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle"))}</p>
+  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : "welcomeTitle"))}</h1>
+  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle"))}</p>
   <p
     class="upgrade-note"
     id="upgrade-note"
@@ -2358,7 +2409,7 @@ ${googleOnly ? "" : `\n  <div class="divider" id="auth-divider"${i18nAttr("divid
         : ""}
 ${googleOnly
         ? ""
-        : `${magicLinkMode ? '\n    <form id="magic-link-form" class="form">\n      <label for="m-email"' + i18nAttr("email") + ">" + esc(t("email")) + '</label>\n      <input id="m-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />\n      <button type="submit" id="magic-link-submit" class="magic-link-submit"' + i18nAttr("sendMagicLink") + ">" + esc(t("sendMagicLink")) + '</button>\n      <p class="msg" id="m-msg"></p>\n' + signupLegalNoteHtml + '\n      <p style="margin-top:0.75rem;font-size:0.75rem;text-align:center">\n        <a href="#" id="use-password-link" class="link-button auth-mode-link"' + i18nAttr("usePasswordInstead") + ">" + esc(t("usePasswordInstead")) + "</a>\n      </p>\n    </form>\n" : ""}  <div class="tabs" id="auth-tabs"${magicLinkMode ? " hidden" : ""}>
+        : `${magicLinkMode ? '\n    <form id="magic-link-form" class="form">\n      <label for="m-email"' + i18nAttr("email") + ">" + esc(t("email")) + '</label>\n      <input id="m-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />\n      <button type="submit" id="magic-link-submit" class="magic-link-submit"' + i18nAttr("sendMagicLink") + ">" + esc(t("sendMagicLink")) + '</button>\n      <p class="msg" id="m-msg"></p>\n' + signupLegalNoteHtml + '\n      <p style="margin-top:0.75rem;font-size:0.75rem;text-align:start">\n        <a href="#" id="use-password-link" class="link-button auth-mode-link"' + i18nAttr("usePasswordInstead") + ">" + esc(t("usePasswordInstead")) + "</a>\n      </p>\n    </form>\n" : ""}${magicLinkSuccessHtml}  <div class="tabs" id="auth-tabs">
     <button class="tab" data-tab="signup"${i18nAttr("createAccount")}>${esc(t("createAccount"))}</button>
     <button class="tab" data-tab="login"${i18nAttr("signIn")}>${esc(t("signIn"))}</button>
   </div>
@@ -2367,9 +2418,9 @@ ${googleOnly
       <label for="s-email"${i18nAttr("email")}>${esc(t("email"))}</label>
       <input id="s-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />
     <label for="s-pass"${i18nAttr("password")}>${esc(t("password"))}</label>
-    <input id="s-pass" type="password" autocomplete="new-password" placeholder="${esc(t("passwordMinPlaceholder"))}"${i18nPlaceholderAttr("passwordMinPlaceholder")} required minlength="8" />
+    <input id="s-pass" type="password" autocomplete="new-password" placeholder="${esc(t("passwordMinPlaceholder"))}"${i18nPlaceholderAttr("passwordMinPlaceholder")} required minlength="${PASSWORD_MIN_LENGTH}" />
     <label for="s-pass2"${i18nAttr("confirmPassword")}>${esc(t("confirmPassword"))}</label>
-    <input id="s-pass2" type="password" autocomplete="new-password" placeholder="${esc(t("confirmPasswordPlaceholder"))}"${i18nPlaceholderAttr("confirmPasswordPlaceholder")} required minlength="8" />
+    <input id="s-pass2" type="password" autocomplete="new-password" placeholder="${esc(t("confirmPasswordPlaceholder"))}"${i18nPlaceholderAttr("confirmPasswordPlaceholder")} required minlength="${PASSWORD_MIN_LENGTH}" />
       <button type="submit"${i18nAttr("createAccount")}>${esc(t("createAccount"))}</button>
 ${signupLegalNoteHtml}
 ${signupLocalModeNoteHtml}
@@ -2457,7 +2508,7 @@ ${signInJourneyInlineScript()}
     var __anAuthLocale = __AN_AUTH_DEFAULT_LOCALE;
     var __anAuthLocalePreference = 'system';
     var __AN_AUTH_MODE = ${JSON.stringify(authMode)};
-    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : magicLinkMode ? "magicLink" : "signup")};
+    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : "signup")};
     function __anAuthLocaleIsSupported(value) {
       return __AN_AUTH_SUPPORTED_LOCALES.indexOf(value) !== -1;
     }
@@ -2525,6 +2576,7 @@ ${signInJourneyInlineScript()}
       if (view === 'forgot') return { heading: 'resetPasswordTitle', subtitle: 'resetPasswordSubtitle' };
       if (view === 'verification') return { heading: 'checkEmailTitle', subtitle: 'finishAccountSubtitle' };
       if (view === 'googleOnly') return { heading: 'signInTitle', subtitle: 'googleOnlySubtitle' };
+      if (view === 'magicLinkSent') return { heading: 'magicLinkSent', subtitle: 'magicLinkSentCopy' };
       if (view === 'magicLink') return { heading: 'magicLinkTitle', subtitle: 'magicLinkSubtitle' };
       return { heading: 'welcomeTitle', subtitle: 'createAccountSubtitle' };
     }
@@ -3146,9 +3198,34 @@ ${googleOnly
 	    function clearRememberedPendingSignupEmail() {
 	      rememberPendingSignupEmail('');
 	    }
+    function hideMagicLinkSuccess() {
+      var card = document.querySelector('.card');
+      if (card) card.classList.remove('magic-link-complete');
+      var success = document.getElementById('magic-link-success');
+      if (success) {
+        success.classList.remove('is-visible');
+        success.setAttribute('hidden', '');
+      }
+    }
+    function showMagicLinkSuccess(email) {
+      var card = document.querySelector('.card');
+      if (card) card.classList.add('magic-link-complete');
+      var success = document.getElementById('magic-link-success');
+      var successEmail = document.getElementById('magic-link-success-email');
+      if (successEmail && typeof email === 'string') successEmail.textContent = email;
+      if (success) {
+        success.removeAttribute('hidden');
+        success.classList.add('is-visible');
+      }
+      forms.forEach(function(x) { x.classList.remove('active'); });
+      var authTabs = document.getElementById('auth-tabs');
+      if (authTabs) authTabs.hidden = true;
+      __anSetAuthView('magicLinkSent');
+    }
     function showMagicLinkForm() {
       var form = document.getElementById('magic-link-form');
       if (!form) return;
+      hideMagicLinkSuccess();
       forms.forEach(function(x) { x.classList.remove('active'); });
       form.classList.add('active');
       var authTabs = document.getElementById('auth-tabs');
@@ -3163,6 +3240,8 @@ ${googleOnly
       var isValid = __anIsValidAuthEmail(emailInput.value);
       button.classList.toggle('is-visible', isValid);
       button.setAttribute('aria-hidden', isValid ? 'false' : 'true');
+      var googleButton = document.getElementById('google-btn');
+      if (googleButton) googleButton.classList.toggle('magic-link-secondary', isValid);
     }
     function setActiveTab(name, opts) {
 	      if (name !== 'signup' && name !== 'login') return;
@@ -3419,7 +3498,7 @@ ${googleOnly
       }
     }
     (function initActiveTab() {
-    var initial = __AN_AUTH_MODE === 'magic-link' ? 'magicLink' : 'signup';
+    var initial = 'signup';
     try {
       var params = new URLSearchParams(location.search);
       var qp = params.get('tab');
@@ -3438,8 +3517,7 @@ ${googleOnly
         if (stored === 'login' || stored === 'signup') initial = stored;
       }
     } catch (e) {}
-    if (initial === 'magicLink') showMagicLinkForm();
-    else setActiveTab(initial, { persist: false });
+    setActiveTab(initial, { persist: false });
 	      try {
 	        if (__anIsVerifiedRedirectSuccess()) {
 	          var rememberedEmail = readRememberedPendingSignupEmail();
@@ -3472,6 +3550,14 @@ ${googleOnly
     e.preventDefault();
     showMagicLinkForm();
   });
+  var magicLinkBack = document.getElementById('magic-link-back');
+  if (magicLinkBack) magicLinkBack.addEventListener('click', function(e) {
+    e.preventDefault();
+    var magicLinkEmailInput = document.getElementById('m-email');
+    if (magicLinkEmailInput) magicLinkEmailInput.value = '';
+    showMagicLinkForm();
+    if (magicLinkEmailInput) magicLinkEmailInput.focus();
+  });
 
   var magicLinkForm = document.getElementById('magic-link-form');
   var magicLinkEmail = document.getElementById('m-email');
@@ -3505,9 +3591,9 @@ ${googleOnly
         return null;
       });
       if (res.ok) {
-        msg.textContent = __anT('magicLinkSent') + '. ' + __anT('magicLinkSentCopy') + ' ' + email + '.';
-        msg.classList.add('show', 'success');
-        btn.textContent = __anT('sent');
+        btn.disabled = false;
+        btn.textContent = originalLabel;
+        showMagicLinkSuccess(email);
         return;
       }
       msg.textContent = (data && (data.error || data.message)) || __anT('magicLinkFailed');
@@ -3918,9 +4004,9 @@ export function getResetPasswordHtml() {
   <p class="subtitle">Set a new password for your account.</p>
   <form id="reset-form">
     <label for="p1">New password</label>
-    <input id="p1" type="password" autocomplete="new-password" autofocus placeholder="At least 8 characters" required minlength="8" />
+    <input id="p1" type="password" autocomplete="new-password" autofocus placeholder="At least ${PASSWORD_MIN_LENGTH} characters" required minlength="${PASSWORD_MIN_LENGTH}" />
     <label for="p2">Confirm password</label>
-    <input id="p2" type="password" autocomplete="new-password" placeholder="Confirm password" required minlength="8" />
+    <input id="p2" type="password" autocomplete="new-password" placeholder="Confirm password" required minlength="${PASSWORD_MIN_LENGTH}" />
     <button type="submit">Save new password</button>
     <p class="msg" id="msg"></p>
   </form>

package/dist/server/self-dispatch.d.ts

@@ -7,10 +7,11 @@
  */
 export declare const DEFAULT_DISPATCH_SETTLE_MS = 250;
 /**
- * Resolve the base URL to fire a self-dispatch request at. Prefers explicit env
- * vars (most reliable on serverless, where inbound host headers can be the
- * platform's internal hostname), falling back to the inbound request headers
- * and finally localhost in dev.
+ * Resolve the base URL to fire a self-dispatch request at. Prefer the URL for
+ * this exact deploy before stable app URLs: a preview or in-flight deploy must
+ * not send a token minted by its function fleet to a different deploy that
+ * happens to serve the same public hostname. Fall back to the inbound request
+ * headers and finally localhost in dev.
  *
  * Throws in production / shared deployments when no env var is set — a silent
  * fallback to a bad host there would drop background work invisibly.

package/dist/server/self-dispatch.js

@@ -47,23 +47,26 @@ function readHeader(event, name) {
     }
 }
 /**
- * Resolve the base URL to fire a self-dispatch request at. Prefers explicit env
- * vars (most reliable on serverless, where inbound host headers can be the
- * platform's internal hostname), falling back to the inbound request headers
- * and finally localhost in dev.
+ * Resolve the base URL to fire a self-dispatch request at. Prefer the URL for
+ * this exact deploy before stable app URLs: a preview or in-flight deploy must
+ * not send a token minted by its function fleet to a different deploy that
+ * happens to serve the same public hostname. Fall back to the inbound request
+ * headers and finally localhost in dev.
  *
  * Throws in production / shared deployments when no env var is set — a silent
  * fallback to a bad host there would drop background work invisibly.
  */
 export function resolveSelfDispatchBaseUrl(event) {
-    const fromEnv = process.env.APP_URL ||
-        process.env.URL ||
+    const fromEnv = process.env.DEPLOY_PRIME_URL ||
         process.env.DEPLOY_URL ||
+        process.env.URL ||
+        process.env.APP_URL ||
         process.env.BETTER_AUTH_URL;
     if (fromEnv)
         return withConfiguredAppBasePath(String(fromEnv));
     if (process.env.NODE_ENV === "production" || !isLocalDatabase()) {
-        throw new Error("Self-dispatch requires APP_URL, URL, DEPLOY_URL, or BETTER_AUTH_URL in " +
+        throw new Error("Self-dispatch requires DEPLOY_PRIME_URL, DEPLOY_URL, URL, APP_URL, or " +
+            "BETTER_AUTH_URL in " +
             "production/shared deployments so background work can reach this " +
             "deployment's own URL.");
     }
@@ -88,9 +91,10 @@ async function dispatchResponseError(path, res) {
  * may take minutes); it is only raced against a short settle timer so the
  * request reliably leaves a serverless box before it freezes.
  *
- * When `A2A_SECRET` is unset (local dev), the request is sent unsigned — the
- * processor accepts unsigned dispatches in dev and relies on the SQL atomic
- * claim for double-processing protection, mirroring the A2A/webhook flow.
+ * When `A2A_SECRET` is unset in local SQLite development, the request is sent
+ * unsigned — the processor accepts unsigned dispatches in dev and relies on
+ * the SQL atomic claim for double-processing protection. Shared and production
+ * dispatches fail before sending an unauthenticated request.
  */
 /**
  * For host-root dispatch targets (`/.netlify/functions/*`), strip the configured
@@ -127,10 +131,17 @@ export async function fireInternalDispatch(options) {
         headers["Authorization"] = `Bearer ${signInternalToken(options.taskId)}`;
     }
     catch (err) {
-        // Distinguish the documented "no A2A_SECRET in dev" path from a real
-        // signing failure, so a malformed secret doesn't fail invisibly.
-        if (err instanceof Error && !/A2A_SECRET/i.test(err.message)) {
-            console.error(`[self-dispatch] signInternalToken failed unexpectedly for ${options.taskId}:`, err);
+        const detail = err instanceof Error ? err.message : String(err);
+        // Only local SQLite development has the loopback/unsigned exception. A
+        // shared database or production deployment must never turn a signing
+        // failure into an unauthenticated processor request.
+        if (process.env.NODE_ENV !== "production" &&
+            isLocalDatabase() &&
+            /A2A_SECRET/i.test(detail)) {
+            // The processor applies the matching trusted-local policy.
+        }
+        else {
+            throw new Error(`[self-dispatch] Cannot sign processor handoff for ${options.taskId}: ${detail}`, { cause: err });
         }
     }
     const awaitResponse = options.awaitResponse === true;

package/dist/server/ssr-handler.d.ts

@@ -1,4 +1,4 @@
-export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
+export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
 /**
  * Create an h3 catch-all that hands page routes to React Router and
  * returns 404 for framework / asset paths that React Router doesn't own.

package/dist/server/ssr-handler.js

@@ -25,7 +25,7 @@ import { captureError } from "./capture-error.js";
 import { getPostHogClientConfigScript } from "./posthog-config.js";
 import { runWithRequestContext } from "./request-context.js";
 import { getRealtimeClientConfigScript, getSentryClientConfigScript, } from "./sentry-config.js";
-export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
+export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
 function getAppBasePath() {
     return getAppBasePathFromViteEnv();
 }

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;

package/dist/shared/cache-control.d.ts

@@ -1,11 +1,11 @@
 export declare const DEFAULT_PUBLIC_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export declare const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export declare const DEFAULT_SSR_CDN_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
-export declare const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
+export declare const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export declare const DEFAULT_SSR_CACHE_HEADERS: {
     readonly "cache-control": "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
     readonly "cdn-cache-control": "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
-    readonly "netlify-cdn-cache-control": "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
+    readonly "netlify-cdn-cache-control": "public, durable, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 };
 /**
  * Deployment-wide override for the SSR shell cache policy.
@@ -58,6 +58,30 @@ export declare function ssrCacheHeadersForPolicy(policy: SsrCachePolicy): SsrCac
  * response — copy it before mutating.
  */
 export declare function resolveSsrCacheHeaders(env?: Record<string, string | undefined>): Readonly<SsrCacheHeaders>;
+/**
+ * Provider-specific cache-KEY headers, emitted only on the provider that
+ * understands them.
+ *
+ * Netlify keys its durable cache on the FULL query string by default, so every
+ * `?fbclid=`, `?gclid=` and `?utm_source=` mints a separate entry. On a
+ * marketing URL that fan-out is unbounded: measured on www.agent-native.com,
+ * every ad or social click was a guaranteed cold render (~4.5s) that could
+ * never be reused. `netlify-vary` narrows the key to the params that actually
+ * change the response.
+ *
+ * `_routes` is react-router's partial-payload param and DOES change the body —
+ * `.data` is ~45KB while `.data?_routes=root` is ~108 bytes — so it must stay
+ * in the key. (Remix v2's `_data` is inert here; naming it instead collapses
+ * those two into one entry and serves the wrong payload.)
+ *
+ * This lives in core, gated by runtime, for two reasons. It was written once
+ * before — `DEFAULT_SSR_NETLIFY_VARY`, added 2026-07-11 in PR #2026 and deleted
+ * 2h09m later in PR #2031 — and then independently re-derived inside an app,
+ * where the next person cannot find it. And a header no other provider
+ * understands should not be on every response everywhere: on anything but
+ * Netlify this returns {}.
+ */
+export declare function resolveSsrCacheKeyHeaders(env?: Record<string, string | undefined>): Readonly<Record<string, string>>;
 export declare function isSsrCacheEnabled(env?: Record<string, string | undefined>): boolean;
 export declare const DEFAULT_SPECULATION_RULES_PATH = "/_agent-native/speculation-rules.json";
 export declare const DEFAULT_SPECULATION_RULES_HEADER = "\"/_agent-native/speculation-rules.json\"";

package/dist/shared/cache-control.js

@@ -1,7 +1,7 @@
 export const DEFAULT_PUBLIC_CACHE_CONTROL = "public, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export const DEFAULT_SSR_CACHE_CONTROL = DEFAULT_PUBLIC_CACHE_CONTROL;
 export const DEFAULT_SSR_CDN_CACHE_CONTROL = DEFAULT_SSR_CACHE_CONTROL;
-export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = DEFAULT_PUBLIC_CACHE_CONTROL;
+export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = "public, durable, max-age=600, stale-while-revalidate=604800, stale-if-error=3600";
 export const DEFAULT_SSR_CACHE_HEADERS = {
     "cache-control": DEFAULT_SSR_CACHE_CONTROL,
     "cdn-cache-control": DEFAULT_SSR_CDN_CACHE_CONTROL,
@@ -85,10 +85,12 @@ export function ssrCacheHeadersForPolicy(policy) {
     // the 7-day default SWR here would hand back the staleness they opted out of.
     const control = `public, max-age=${policy.seconds}, ` +
         `stale-while-revalidate=${policy.seconds}, stale-if-error=3600`;
+    const netlifyControl = `public, durable, max-age=${policy.seconds}, ` +
+        `stale-while-revalidate=${policy.seconds}, stale-if-error=3600`;
     return {
         "cache-control": control,
         "cdn-cache-control": control,
-        "netlify-cdn-cache-control": control,
+        "netlify-cdn-cache-control": netlifyControl,
     };
 }
 let memoizedRaw;
@@ -109,6 +111,45 @@ export function resolveSsrCacheHeaders(env = typeof process === "undefined"
     memoizedHeaders = Object.freeze(ssrCacheHeadersForPolicy(parseSsrCacheSetting(raw)));
     return memoizedHeaders;
 }
+/**
+ * Provider-specific cache-KEY headers, emitted only on the provider that
+ * understands them.
+ *
+ * Netlify keys its durable cache on the FULL query string by default, so every
+ * `?fbclid=`, `?gclid=` and `?utm_source=` mints a separate entry. On a
+ * marketing URL that fan-out is unbounded: measured on www.agent-native.com,
+ * every ad or social click was a guaranteed cold render (~4.5s) that could
+ * never be reused. `netlify-vary` narrows the key to the params that actually
+ * change the response.
+ *
+ * `_routes` is react-router's partial-payload param and DOES change the body —
+ * `.data` is ~45KB while `.data?_routes=root` is ~108 bytes — so it must stay
+ * in the key. (Remix v2's `_data` is inert here; naming it instead collapses
+ * those two into one entry and serves the wrong payload.)
+ *
+ * This lives in core, gated by runtime, for two reasons. It was written once
+ * before — `DEFAULT_SSR_NETLIFY_VARY`, added 2026-07-11 in PR #2026 and deleted
+ * 2h09m later in PR #2031 — and then independently re-derived inside an app,
+ * where the next person cannot find it. And a header no other provider
+ * understands should not be on every response everywhere: on anything but
+ * Netlify this returns {}.
+ */
+export function resolveSsrCacheKeyHeaders(env = typeof process === "undefined"
+    ? {}
+    : process.env) {
+    // NETLIFY is the build-time marker; deployed functions expose SITE_ID at
+    // runtime. An explicit "false"/local override means we are not really hosted.
+    const explicitlyNotNetlify = env.NETLIFY_LOCAL === "true" || env.NETLIFY === "false";
+    const onNetlify = !explicitlyNotNetlify && (Boolean(env.NETLIFY) || Boolean(env.SITE_ID)); // guard:allow-env-credential -- Netlify's public runtime host marker, not a credential.
+    const none = Object.freeze({});
+    if (!onNetlify)
+        return none;
+    // This NARROWS the cache key rather than splitting it per user: it removes
+    // utm/fbclid/gclid so one entry serves everyone. The shapes the guard exists
+    // to stop are `private`, `no-store` and `Vary: Cookie`, none of which this is.
+    // guard:allow-ssr-shell-exception — narrows the shared key, never splits it
+    return Object.freeze({ "netlify-vary": "query=_routes|index" });
+}
 export function isSsrCacheEnabled(env = typeof process === "undefined"
     ? {}
     : process.env) {

package/dist/shared/password-policy.d.ts

@@ -0,0 +1,3 @@
+export declare const PASSWORD_MIN_LENGTH = 12;
+export declare const PASSWORD_MAX_LENGTH = 128;
+export declare const PASSWORD_MIN_LENGTH_MESSAGE = "Password must be at least 12 characters";

package/dist/shared/password-policy.js

@@ -0,0 +1,3 @@
+export const PASSWORD_MIN_LENGTH = 12;
+export const PASSWORD_MAX_LENGTH = 128;
+export const PASSWORD_MIN_LENGTH_MESSAGE = `Password must be at least ${PASSWORD_MIN_LENGTH} characters`;

package/dist/sharing/actions/set-resource-visibility.js

@@ -52,10 +52,22 @@ export default defineAction({
             }
         }
         const beforeExtensionTargets = await getExtensionShareChangeTargets(args.resourceType, args.resourceId);
-        await db
-            .update(reg.resourceTable)
-            .set(update)
-            .where(eq(reg.resourceTable.id, args.resourceId));
+        if (reg.persistVisibilityChange) {
+            await reg.persistVisibilityChange({
+                resource: access.resource,
+                resourceId: args.resourceId,
+                visibility: args.visibility,
+                update,
+                userEmail: rawAccess.userEmail,
+                orgId: currentOrgId,
+            });
+        }
+        else {
+            await db
+                .update(reg.resourceTable)
+                .set(update)
+                .where(eq(reg.resourceTable.id, args.resourceId));
+        }
         invalidateCollabAccessCache(args.resourceType, args.resourceId);
         await notifyExtensionShareChanged(args.resourceType, args.resourceId, beforeExtensionTargets);
         return { ok: true, visibility: args.visibility };