@agent-native/core 0.141.7 → 0.144.1

package/dist/server/credential-provider.js

@@ -19,8 +19,56 @@
  */
 import { createHash } from "node:crypto";
 import { CREDENTIAL_STORE_UNAVAILABLE_ERROR_CODE } from "../agent/engine/credential-errors.js";
-import { isLocalDatabase, isTransientDatabaseError } from "../db/client.js";
+import { getDbExec, isLocalDatabase, isTransientDatabaseError, } from "../db/client.js";
+import { getOrgSetting } from "../settings/org-settings.js";
 import { getRequestUserEmail, getRequestOrgId } from "./request-context.js";
+const DISPATCH_VAULT_ACCESS_SETTINGS_KEY = "dispatch-vault-access-settings";
+/**
+ * The designated vault fallback is an all-apps compatibility path. Manual
+ * mode must use the per-app sync path instead, or a known key name would be
+ * enough to read the whole vault from an ungranted workspace app.
+ */
+async function canReadDesignatedVaultFallback(vaultOrgId, credentialKey) {
+    const access = await getOrgSetting(vaultOrgId, DISPATCH_VAULT_ACCESS_SETTINGS_KEY);
+    if (access?.mode !== "manual")
+        return { status: "allowed" };
+    // Manual mode is still usable across a Dispatch vault org and a separate
+    // app org, but only for this app's explicit active grant. The app identity
+    // comes from deployment configuration, never from request input.
+    const appId = [
+        process.env.AGENT_NATIVE_WORKSPACE_APP_ID,
+        process.env.VITE_AGENT_NATIVE_WORKSPACE_APP_ID,
+        process.env.AGENT_NATIVE_APP_ID,
+        process.env.APP_NAME,
+    ]
+        .find((value) => value?.trim())
+        ?.trim();
+    if (!appId) {
+        return { status: "denied", reason: "missing-app-id" };
+    }
+    try {
+        const result = await getDbExec().execute({
+            sql: `SELECT 1
+        FROM vault_grants AS grants
+        INNER JOIN vault_secrets AS secrets ON secrets.id = grants.secret_id
+        WHERE grants.org_id = ?
+          AND grants.app_id = ?
+          AND grants.status = 'active'
+          AND secrets.org_id = grants.org_id
+          AND secrets.credential_key = ?
+        LIMIT 1`,
+            args: [vaultOrgId, appId, credentialKey],
+        });
+        return result.rows.length > 0
+            ? { status: "allowed" }
+            : { status: "denied", reason: "no-active-grant" };
+    }
+    catch (cause) {
+        // A missing/unreadable grant table must fail closed. The app can still
+        // resolve a locally scoped credential or retry after the store recovers.
+        return { status: "unavailable", cause };
+    }
+}
 /**
  * Decide which `app_secrets` scope a Builder/credential write should use.
  *
@@ -998,9 +1046,9 @@ export async function prefetchSecrets(keys) {
 }
 /**
  * Resolve a request-scoped secret. Reads from `app_secrets` first (current
- * user override, active org, workspace row for that org, then the solo
- * workspace row); falls back to `process.env` only when the deploy fallback
- * policy allows it.
+ * user override, active org, workspace row for that org, the solo workspace
+ * row, then the explicitly designated workspace vault organization); falls
+ * back to `process.env` only when the deploy fallback policy allows it.
  *
  * Resolving several keys in one request? Call `prefetchSecrets` first.
  */
@@ -1100,6 +1148,44 @@ export async function resolveSecretDetailed(key) {
                 }
                 return { value: soloWorkspaceSecret.value, lookupFailed: false };
             }
+            // Dispatch's workspace vault is stored under the organization that
+            // performed the sync. AGENT_VAULT_ORG_ID is an explicit single-workspace
+            // deployment assertion; without it, never guess which other tenant owns
+            // a shared key. This fallback keeps workspace apps from requiring every
+            // builder to copy a vault key into app-local settings.
+            const vaultOrgId = process.env.AGENT_VAULT_ORG_ID?.trim();
+            if (vaultOrgId && vaultOrgId !== orgId) {
+                const designatedVaultAccess = await canReadDesignatedVaultFallback(vaultOrgId, key);
+                if (designatedVaultAccess.status === "unavailable") {
+                    lookupFailed = true;
+                    cause = designatedVaultAccess.cause;
+                }
+                if (designatedVaultAccess.status === "allowed") {
+                    const [vaultOrgRead, vaultWorkspaceRead] = await Promise.allSettled([
+                        readAppSecret({ key, scope: "org", scopeId: vaultOrgId }),
+                        readAppSecret({ key, scope: "workspace", scopeId: vaultOrgId }),
+                    ]);
+                    const unwrap = (settled) => {
+                        if (settled.status === "rejected")
+                            throw settled.reason;
+                        return settled.value;
+                    };
+                    const vaultOrgSecret = unwrap(vaultOrgRead);
+                    if (vaultOrgSecret?.value) {
+                        if (traceLookup) {
+                            console.log(`[resolve-secret] key=${key} email=${email} vaultOrgId=${vaultOrgId} scope=org-vault hit=true`);
+                        }
+                        return { value: vaultOrgSecret.value, lookupFailed: false };
+                    }
+                    const vaultWorkspaceSecret = unwrap(vaultWorkspaceRead);
+                    if (vaultWorkspaceSecret?.value) {
+                        if (traceLookup) {
+                            console.log(`[resolve-secret] key=${key} email=${email} vaultOrgId=${vaultOrgId} scope=workspace-vault hit=true`);
+                        }
+                        return { value: vaultWorkspaceSecret.value, lookupFailed: false };
+                    }
+                }
+            }
         }
         catch (err) {
             if (traceLookup) {

package/dist/server/onboarding-html.d.ts

@@ -25,6 +25,8 @@ export interface OnboardingHtmlOptions {
     googleOnly?: boolean;
     /** Authentication surface to render. Defaults to the existing password flow. */
     authMode?: "magic-link" | "password";
+    /** Render the quiet, centered auth surface used when the app has an initial prompt. */
+    initialPrompt?: boolean;
     /**
      * Product marketing content shown alongside the sign-in form.
      * When provided, the page uses a split layout: marketing on the left,

package/dist/server/onboarding-html.js

@@ -8,6 +8,7 @@
  */
 import { getLocaleInitScript } from "../localization/server.js";
 import { DEFAULT_LOCALE, LOCALE_METADATA, LOCALE_STORAGE_KEY, SUPPORTED_LOCALES, } from "../localization/shared.js";
+import { PASSWORD_MIN_LENGTH } from "../shared/password-policy.js";
 import { signInJourneyInlineScript } from "../shared/sign-in-journey.js";
 import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_NATIVE_SOCIAL_IMAGE_PATH, AGENT_NATIVE_SOCIAL_IMAGE_TYPE, AGENT_NATIVE_SOCIAL_IMAGE_WIDTH, withAgentNativeSocialImageCacheBuster, } from "../shared/social-meta.js";
 import { normalizeAppBasePath } from "./app-base-path.js";
@@ -69,7 +70,7 @@ const EN_AUTH_COPY = {
     email: "Email",
     password: "Password",
     confirmPassword: "Confirm password",
-    passwordMinPlaceholder: "At least 8 characters",
+    passwordMinPlaceholder: `At least ${PASSWORD_MIN_LENGTH} characters`,
     confirmPasswordPlaceholder: "Confirm password",
     enterPasswordPlaceholder: "Enter password",
     magicLinkTitle: "Welcome",
@@ -165,7 +166,7 @@ const AUTH_LOCALE_COPY = {
         email: "电子邮箱",
         password: "密码",
         confirmPassword: "确认密码",
-        passwordMinPlaceholder: "至少 8 个字符",
+        passwordMinPlaceholder: `至少 ${PASSWORD_MIN_LENGTH} 个字符`,
         confirmPasswordPlaceholder: "确认密码",
         enterPasswordPlaceholder: "输入密码",
         magicLinkTitle: "欢迎",
@@ -259,7 +260,7 @@ const AUTH_LOCALE_COPY = {
         email: "電子郵件",
         password: "密碼",
         confirmPassword: "確認密碼",
-        passwordMinPlaceholder: "至少 8 個字元",
+        passwordMinPlaceholder: `至少 ${PASSWORD_MIN_LENGTH} 個字元`,
         confirmPasswordPlaceholder: "確認密碼",
         enterPasswordPlaceholder: "輸入密碼",
         magicLinkTitle: "歡迎",
@@ -353,7 +354,7 @@ const AUTH_LOCALE_COPY = {
         email: "Email",
         password: "Contraseña",
         confirmPassword: "Confirmar contraseña",
-        passwordMinPlaceholder: "Al menos 8 caracteres",
+        passwordMinPlaceholder: `Al menos ${PASSWORD_MIN_LENGTH} caracteres`,
         confirmPasswordPlaceholder: "Confirmar contraseña",
         enterPasswordPlaceholder: "Introduce la contraseña",
         magicLinkTitle: "Bienvenido",
@@ -447,7 +448,7 @@ const AUTH_LOCALE_COPY = {
         email: "E-mail",
         password: "Mot de passe",
         confirmPassword: "Confirmer le mot de passe",
-        passwordMinPlaceholder: "Au moins 8 caractères",
+        passwordMinPlaceholder: `Au moins ${PASSWORD_MIN_LENGTH} caractères`,
         confirmPasswordPlaceholder: "Confirmer le mot de passe",
         enterPasswordPlaceholder: "Saisir le mot de passe",
         magicLinkTitle: "Bienvenue",
@@ -541,7 +542,7 @@ const AUTH_LOCALE_COPY = {
         email: "E-Mail",
         password: "Passwort",
         confirmPassword: "Passwort bestätigen",
-        passwordMinPlaceholder: "Mindestens 8 Zeichen",
+        passwordMinPlaceholder: `Mindestens ${PASSWORD_MIN_LENGTH} Zeichen`,
         confirmPasswordPlaceholder: "Passwort bestätigen",
         enterPasswordPlaceholder: "Passwort eingeben",
         magicLinkTitle: "Willkommen",
@@ -635,7 +636,7 @@ const AUTH_LOCALE_COPY = {
         email: "メール",
         password: "パスワード",
         confirmPassword: "パスワードを確認",
-        passwordMinPlaceholder: "8 文字以上",
+        passwordMinPlaceholder: `${PASSWORD_MIN_LENGTH} 文字以上`,
         confirmPasswordPlaceholder: "パスワードを確認",
         enterPasswordPlaceholder: "パスワードを入力",
         magicLinkTitle: "ようこそ",
@@ -729,7 +730,7 @@ const AUTH_LOCALE_COPY = {
         email: "이메일",
         password: "비밀번호",
         confirmPassword: "비밀번호 확인",
-        passwordMinPlaceholder: "8자 이상",
+        passwordMinPlaceholder: `${PASSWORD_MIN_LENGTH}자 이상`,
         confirmPasswordPlaceholder: "비밀번호 확인",
         enterPasswordPlaceholder: "비밀번호 입력",
         magicLinkTitle: "환영합니다",
@@ -823,7 +824,7 @@ const AUTH_LOCALE_COPY = {
         email: "Email",
         password: "Senha",
         confirmPassword: "Confirmar senha",
-        passwordMinPlaceholder: "Pelo menos 8 caracteres",
+        passwordMinPlaceholder: `Pelo menos ${PASSWORD_MIN_LENGTH} caracteres`,
         confirmPasswordPlaceholder: "Confirmar senha",
         enterPasswordPlaceholder: "Digite a senha",
         magicLinkTitle: "Bem-vindo",
@@ -917,7 +918,7 @@ const AUTH_LOCALE_COPY = {
         email: "ईमेल",
         password: "पासवर्ड",
         confirmPassword: "पासवर्ड की पुष्टि करें",
-        passwordMinPlaceholder: "कम से कम 8 अक्षर",
+        passwordMinPlaceholder: `कम से कम ${PASSWORD_MIN_LENGTH} अक्षर`,
         confirmPasswordPlaceholder: "पासवर्ड की पुष्टि करें",
         enterPasswordPlaceholder: "पासवर्ड दर्ज करें",
         magicLinkTitle: "स्वागत है",
@@ -1011,7 +1012,7 @@ const AUTH_LOCALE_COPY = {
         email: "البريد الإلكتروني",
         password: "كلمة المرور",
         confirmPassword: "تأكيد كلمة المرور",
-        passwordMinPlaceholder: "8 أحرف على الأقل",
+        passwordMinPlaceholder: `${PASSWORD_MIN_LENGTH} أحرف على الأقل`,
         confirmPasswordPlaceholder: "تأكيد كلمة المرور",
         enterPasswordPlaceholder: "أدخل كلمة المرور",
         magicLinkTitle: "مرحبًا",
@@ -1216,6 +1217,7 @@ export function getOnboardingHtml(opts = {}) {
     const googleOnly = !!opts.googleOnly;
     const authMode = opts.authMode ?? "password";
     const magicLinkMode = authMode === "magic-link";
+    const simplifiedAuth = opts.initialPrompt === true;
     // In a Google-only app, Google is the sole sign-in method, so always render
     // a working button — never gate it on env vars detected at render time. The
     // login page is a public, CDN-cacheable shell served to everyone (per-user
@@ -1234,7 +1236,7 @@ export function getOnboardingHtml(opts = {}) {
             requestHost: opts.requestHost,
             requestPath: opts.requestPath,
         });
-    const hasMarketing = !!marketing;
+    const hasMarketing = !!marketing && !simplifiedAuth;
     const marketingSlug = resolveBuiltInMarketingSlug(marketing);
     const defaultMarketingCopy = marketing
         ? {
@@ -1313,6 +1315,13 @@ ${localeMenuItemsHtml}
     const signupLegalNoteHtml = signupLegalNotice
         ? `      <p class="legal-note">${localizedValue(signupLegalNotice.prefix, "legalPrefix")} <a href="${esc(signupLegalNotice.termsUrl)}" target="_blank" rel="noreferrer"${localizedAnchorLabel(signupLegalNotice.termsLabel, "legalTerms")}</a> ${localizedValue(signupLegalNotice.connector, "legalConnector")} <a href="${esc(signupLegalNotice.privacyUrl)}" target="_blank" rel="noreferrer"${localizedAnchorLabel(signupLegalNotice.privacyLabel, "legalPrivacy")}</a>${localizedValue(signupLegalNotice.suffix, "legalSuffix")}</p>`
         : "";
+    const magicLinkSuccessHtml = magicLinkMode
+        ? `    <div class="magic-link-success" id="magic-link-success" aria-live="polite" hidden>
+      <p class="magic-link-success-copy"><span${i18nAttr("magicLinkSentCopy")}>${esc(t("magicLinkSentCopy"))}</span> <strong id="magic-link-success-email"></strong>.</p>
+      <button type="button" class="link-button magic-link-back" id="magic-link-back"${i18nAttr("back")}>${esc(t("back"))}</button>
+    </div>
+`
+        : "";
     const signupLocalModeNoteHtml = signupLocalModeNote
         ? `      <div class="signup-local-mode-note" id="signup-local-mode-note" data-command="${esc(signupLocalModeNote.command)}">
         <p>${esc(signupLocalModeNote.text)}</p>
@@ -1371,6 +1380,9 @@ ${googleNoticeRunLocalPanelHtml}
   </div>`
         : "";
     const identitySsoHtml = identitySsoLoginButtonHtml();
+    const identitySsoMagicLinkSelector = identitySsoHtml
+        ? "  .card.magic-link-complete #identity-sso-btn,\n"
+        : "";
     const identitySsoScript = identitySsoHtml
         ? `
     function __anIdentitySsoUrl() {
@@ -1982,11 +1994,12 @@ ${hasMarketing
   }
   .btn-secondary:hover { color: #bbb; border-color: rgba(255,255,255,0.2); }
   .legal-note {
-    margin-top: 0.625rem;
+    margin-top: 0.375rem;
+    margin-bottom: 0.875rem;
     color: #666;
     font-size: 0.6875rem;
     line-height: 1.45;
-    text-align: center;
+    text-align: start;
   }
   .legal-note a {
     color: #777;
@@ -2130,6 +2143,40 @@ ${hasMarketing
   .link-button:disabled { cursor: wait; opacity: 0.5; }
   .magic-link-submit { display: none; }
   .magic-link-submit.is-visible { display: block; }
+  .magic-link-success { display: none; }
+  .magic-link-success.is-visible { display: block; }
+  .magic-link-success-copy {
+    margin: 0;
+    color: rgba(255,255,255,0.62); /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+    font-size: 0.875rem;
+    line-height: 1.5;
+  }
+  .magic-link-success-copy strong {
+    color: inherit;
+    font-weight: 600;
+    overflow-wrap: anywhere;
+  }
+  .magic-link-back {
+    margin-top: 1.5rem;
+    text-decoration: none;
+  }
+  .btn-google.magic-link-secondary {
+    background: transparent;
+    color: inherit;
+    border: 1px solid rgba(255,255,255,0.16); /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  }
+  .btn-google.magic-link-secondary:hover {
+    background: rgba(255,255,255,0.05); /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  }
+  .card.magic-link-complete .subtitle,
+  .card.magic-link-complete #google-signin,
+${identitySsoMagicLinkSelector}
+  .card.magic-link-complete #auth-divider,
+  .card.magic-link-complete #auth-tabs,
+  .card.magic-link-complete #upgrade-note,
+  .card.magic-link-complete .form {
+    display: none;
+  }
   .divider {
     display: flex;
     align-items: center;
@@ -2327,14 +2374,18 @@ ${hasMarketing
   .local-note a { color: #888; text-decoration: none; }
   .local-note a:hover { color: #bbb; }
 ${marketingStyles}
+  /* guard:allow-raw-color - standalone auth HTML has no app theme token layer */
+  body.simplified-auth { background: #141414; }
+  body.simplified-auth .card { border-color: transparent; box-shadow: none; }
+  body.simplified-auth .local-note { display: none !important; }
 </style>
 </head>
-<body${hasMarketing ? ' class="has-marketing"' : ""}>
+<body${simplifiedAuth ? ' class="simplified-auth"' : hasMarketing ? ' class="has-marketing"' : ""}>
 ${localePickerHtml}
 ${marketingPanelHtml}
 <div class="card">
-  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : magicLinkMode ? "magicLinkTitle" : "welcomeTitle"))}</h1>
-  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : magicLinkMode ? "magicLinkSubtitle" : "createAccountSubtitle"))}</p>
+  <h1 id="heading"${i18nAttr(googleOnly ? "signInTitle" : "welcomeTitle")}>${esc(t(googleOnly ? "signInTitle" : "welcomeTitle"))}</h1>
+  <p class="subtitle" id="subtitle"${i18nAttr(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle")}>${esc(t(googleOnly ? "googleOnlySubtitle" : "createAccountSubtitle"))}</p>
   <p
     class="upgrade-note"
     id="upgrade-note"
@@ -2358,7 +2409,7 @@ ${googleOnly ? "" : `\n  <div class="divider" id="auth-divider"${i18nAttr("divid
         : ""}
 ${googleOnly
         ? ""
-        : `${magicLinkMode ? '\n    <form id="magic-link-form" class="form">\n      <label for="m-email"' + i18nAttr("email") + ">" + esc(t("email")) + '</label>\n      <input id="m-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />\n      <button type="submit" id="magic-link-submit" class="magic-link-submit"' + i18nAttr("sendMagicLink") + ">" + esc(t("sendMagicLink")) + '</button>\n      <p class="msg" id="m-msg"></p>\n' + signupLegalNoteHtml + '\n      <p style="margin-top:0.75rem;font-size:0.75rem;text-align:center">\n        <a href="#" id="use-password-link" class="link-button auth-mode-link"' + i18nAttr("usePasswordInstead") + ">" + esc(t("usePasswordInstead")) + "</a>\n      </p>\n    </form>\n" : ""}  <div class="tabs" id="auth-tabs"${magicLinkMode ? " hidden" : ""}>
+        : `${magicLinkMode ? '\n    <form id="magic-link-form" class="form">\n      <label for="m-email"' + i18nAttr("email") + ">" + esc(t("email")) + '</label>\n      <input id="m-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />\n      <button type="submit" id="magic-link-submit" class="magic-link-submit"' + i18nAttr("sendMagicLink") + ">" + esc(t("sendMagicLink")) + '</button>\n      <p class="msg" id="m-msg"></p>\n' + signupLegalNoteHtml + '\n      <p style="margin-top:0.75rem;font-size:0.75rem;text-align:start">\n        <a href="#" id="use-password-link" class="link-button auth-mode-link"' + i18nAttr("usePasswordInstead") + ">" + esc(t("usePasswordInstead")) + "</a>\n      </p>\n    </form>\n" : ""}${magicLinkSuccessHtml}  <div class="tabs" id="auth-tabs">
     <button class="tab" data-tab="signup"${i18nAttr("createAccount")}>${esc(t("createAccount"))}</button>
     <button class="tab" data-tab="login"${i18nAttr("signIn")}>${esc(t("signIn"))}</button>
   </div>
@@ -2367,9 +2418,9 @@ ${googleOnly
       <label for="s-email"${i18nAttr("email")}>${esc(t("email"))}</label>
       <input id="s-email" type="email" autocomplete="email" autofocus placeholder="you@example.com" required />
     <label for="s-pass"${i18nAttr("password")}>${esc(t("password"))}</label>
-    <input id="s-pass" type="password" autocomplete="new-password" placeholder="${esc(t("passwordMinPlaceholder"))}"${i18nPlaceholderAttr("passwordMinPlaceholder")} required minlength="8" />
+    <input id="s-pass" type="password" autocomplete="new-password" placeholder="${esc(t("passwordMinPlaceholder"))}"${i18nPlaceholderAttr("passwordMinPlaceholder")} required minlength="${PASSWORD_MIN_LENGTH}" />
     <label for="s-pass2"${i18nAttr("confirmPassword")}>${esc(t("confirmPassword"))}</label>
-    <input id="s-pass2" type="password" autocomplete="new-password" placeholder="${esc(t("confirmPasswordPlaceholder"))}"${i18nPlaceholderAttr("confirmPasswordPlaceholder")} required minlength="8" />
+    <input id="s-pass2" type="password" autocomplete="new-password" placeholder="${esc(t("confirmPasswordPlaceholder"))}"${i18nPlaceholderAttr("confirmPasswordPlaceholder")} required minlength="${PASSWORD_MIN_LENGTH}" />
       <button type="submit"${i18nAttr("createAccount")}>${esc(t("createAccount"))}</button>
 ${signupLegalNoteHtml}
 ${signupLocalModeNoteHtml}
@@ -2457,7 +2508,7 @@ ${signInJourneyInlineScript()}
     var __anAuthLocale = __AN_AUTH_DEFAULT_LOCALE;
     var __anAuthLocalePreference = 'system';
     var __AN_AUTH_MODE = ${JSON.stringify(authMode)};
-    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : magicLinkMode ? "magicLink" : "signup")};
+    var __anAuthView = ${JSON.stringify(googleOnly ? "googleOnly" : "signup")};
     function __anAuthLocaleIsSupported(value) {
       return __AN_AUTH_SUPPORTED_LOCALES.indexOf(value) !== -1;
     }
@@ -2525,6 +2576,7 @@ ${signInJourneyInlineScript()}
       if (view === 'forgot') return { heading: 'resetPasswordTitle', subtitle: 'resetPasswordSubtitle' };
       if (view === 'verification') return { heading: 'checkEmailTitle', subtitle: 'finishAccountSubtitle' };
       if (view === 'googleOnly') return { heading: 'signInTitle', subtitle: 'googleOnlySubtitle' };
+      if (view === 'magicLinkSent') return { heading: 'magicLinkSent', subtitle: 'magicLinkSentCopy' };
       if (view === 'magicLink') return { heading: 'magicLinkTitle', subtitle: 'magicLinkSubtitle' };
       return { heading: 'welcomeTitle', subtitle: 'createAccountSubtitle' };
     }
@@ -3146,9 +3198,34 @@ ${googleOnly
 	    function clearRememberedPendingSignupEmail() {
 	      rememberPendingSignupEmail('');
 	    }
+    function hideMagicLinkSuccess() {
+      var card = document.querySelector('.card');
+      if (card) card.classList.remove('magic-link-complete');
+      var success = document.getElementById('magic-link-success');
+      if (success) {
+        success.classList.remove('is-visible');
+        success.setAttribute('hidden', '');
+      }
+    }
+    function showMagicLinkSuccess(email) {
+      var card = document.querySelector('.card');
+      if (card) card.classList.add('magic-link-complete');
+      var success = document.getElementById('magic-link-success');
+      var successEmail = document.getElementById('magic-link-success-email');
+      if (successEmail && typeof email === 'string') successEmail.textContent = email;
+      if (success) {
+        success.removeAttribute('hidden');
+        success.classList.add('is-visible');
+      }
+      forms.forEach(function(x) { x.classList.remove('active'); });
+      var authTabs = document.getElementById('auth-tabs');
+      if (authTabs) authTabs.hidden = true;
+      __anSetAuthView('magicLinkSent');
+    }
     function showMagicLinkForm() {
       var form = document.getElementById('magic-link-form');
       if (!form) return;
+      hideMagicLinkSuccess();
       forms.forEach(function(x) { x.classList.remove('active'); });
       form.classList.add('active');
       var authTabs = document.getElementById('auth-tabs');
@@ -3163,6 +3240,8 @@ ${googleOnly
       var isValid = __anIsValidAuthEmail(emailInput.value);
       button.classList.toggle('is-visible', isValid);
       button.setAttribute('aria-hidden', isValid ? 'false' : 'true');
+      var googleButton = document.getElementById('google-btn');
+      if (googleButton) googleButton.classList.toggle('magic-link-secondary', isValid);
     }
     function setActiveTab(name, opts) {
 	      if (name !== 'signup' && name !== 'login') return;
@@ -3419,7 +3498,7 @@ ${googleOnly
       }
     }
     (function initActiveTab() {
-    var initial = __AN_AUTH_MODE === 'magic-link' ? 'magicLink' : 'signup';
+    var initial = 'signup';
     try {
       var params = new URLSearchParams(location.search);
       var qp = params.get('tab');
@@ -3438,8 +3517,7 @@ ${googleOnly
         if (stored === 'login' || stored === 'signup') initial = stored;
       }
     } catch (e) {}
-    if (initial === 'magicLink') showMagicLinkForm();
-    else setActiveTab(initial, { persist: false });
+    setActiveTab(initial, { persist: false });
 	      try {
 	        if (__anIsVerifiedRedirectSuccess()) {
 	          var rememberedEmail = readRememberedPendingSignupEmail();
@@ -3472,6 +3550,14 @@ ${googleOnly
     e.preventDefault();
     showMagicLinkForm();
   });
+  var magicLinkBack = document.getElementById('magic-link-back');
+  if (magicLinkBack) magicLinkBack.addEventListener('click', function(e) {
+    e.preventDefault();
+    var magicLinkEmailInput = document.getElementById('m-email');
+    if (magicLinkEmailInput) magicLinkEmailInput.value = '';
+    showMagicLinkForm();
+    if (magicLinkEmailInput) magicLinkEmailInput.focus();
+  });
 
   var magicLinkForm = document.getElementById('magic-link-form');
   var magicLinkEmail = document.getElementById('m-email');
@@ -3505,9 +3591,9 @@ ${googleOnly
         return null;
       });
       if (res.ok) {
-        msg.textContent = __anT('magicLinkSent') + '. ' + __anT('magicLinkSentCopy') + ' ' + email + '.';
-        msg.classList.add('show', 'success');
-        btn.textContent = __anT('sent');
+        btn.disabled = false;
+        btn.textContent = originalLabel;
+        showMagicLinkSuccess(email);
         return;
       }
       msg.textContent = (data && (data.error || data.message)) || __anT('magicLinkFailed');
@@ -3918,9 +4004,9 @@ export function getResetPasswordHtml() {
   <p class="subtitle">Set a new password for your account.</p>
   <form id="reset-form">
     <label for="p1">New password</label>
-    <input id="p1" type="password" autocomplete="new-password" autofocus placeholder="At least 8 characters" required minlength="8" />
+    <input id="p1" type="password" autocomplete="new-password" autofocus placeholder="At least ${PASSWORD_MIN_LENGTH} characters" required minlength="${PASSWORD_MIN_LENGTH}" />
     <label for="p2">Confirm password</label>
-    <input id="p2" type="password" autocomplete="new-password" placeholder="Confirm password" required minlength="8" />
+    <input id="p2" type="password" autocomplete="new-password" placeholder="Confirm password" required minlength="${PASSWORD_MIN_LENGTH}" />
     <button type="submit">Save new password</button>
     <p class="msg" id="msg"></p>
   </form>

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/server/self-dispatch.d.ts

@@ -7,10 +7,11 @@
  */
 export declare const DEFAULT_DISPATCH_SETTLE_MS = 250;
 /**
- * Resolve the base URL to fire a self-dispatch request at. Prefers explicit env
- * vars (most reliable on serverless, where inbound host headers can be the
- * platform's internal hostname), falling back to the inbound request headers
- * and finally localhost in dev.
+ * Resolve the base URL to fire a self-dispatch request at. Prefer the URL for
+ * this exact deploy before stable app URLs: a preview or in-flight deploy must
+ * not send a token minted by its function fleet to a different deploy that
+ * happens to serve the same public hostname. Fall back to the inbound request
+ * headers and finally localhost in dev.
  *
  * Throws in production / shared deployments when no env var is set — a silent
  * fallback to a bad host there would drop background work invisibly.

package/dist/server/self-dispatch.js

@@ -47,23 +47,26 @@ function readHeader(event, name) {
     }
 }
 /**
- * Resolve the base URL to fire a self-dispatch request at. Prefers explicit env
- * vars (most reliable on serverless, where inbound host headers can be the
- * platform's internal hostname), falling back to the inbound request headers
- * and finally localhost in dev.
+ * Resolve the base URL to fire a self-dispatch request at. Prefer the URL for
+ * this exact deploy before stable app URLs: a preview or in-flight deploy must
+ * not send a token minted by its function fleet to a different deploy that
+ * happens to serve the same public hostname. Fall back to the inbound request
+ * headers and finally localhost in dev.
  *
  * Throws in production / shared deployments when no env var is set — a silent
  * fallback to a bad host there would drop background work invisibly.
  */
 export function resolveSelfDispatchBaseUrl(event) {
-    const fromEnv = process.env.APP_URL ||
-        process.env.URL ||
+    const fromEnv = process.env.DEPLOY_PRIME_URL ||
         process.env.DEPLOY_URL ||
+        process.env.URL ||
+        process.env.APP_URL ||
         process.env.BETTER_AUTH_URL;
     if (fromEnv)
         return withConfiguredAppBasePath(String(fromEnv));
     if (process.env.NODE_ENV === "production" || !isLocalDatabase()) {
-        throw new Error("Self-dispatch requires APP_URL, URL, DEPLOY_URL, or BETTER_AUTH_URL in " +
+        throw new Error("Self-dispatch requires DEPLOY_PRIME_URL, DEPLOY_URL, URL, APP_URL, or " +
+            "BETTER_AUTH_URL in " +
             "production/shared deployments so background work can reach this " +
             "deployment's own URL.");
     }
@@ -88,9 +91,10 @@ async function dispatchResponseError(path, res) {
  * may take minutes); it is only raced against a short settle timer so the
  * request reliably leaves a serverless box before it freezes.
  *
- * When `A2A_SECRET` is unset (local dev), the request is sent unsigned — the
- * processor accepts unsigned dispatches in dev and relies on the SQL atomic
- * claim for double-processing protection, mirroring the A2A/webhook flow.
+ * When `A2A_SECRET` is unset in local SQLite development, the request is sent
+ * unsigned — the processor accepts unsigned dispatches in dev and relies on
+ * the SQL atomic claim for double-processing protection. Shared and production
+ * dispatches fail before sending an unauthenticated request.
  */
 /**
  * For host-root dispatch targets (`/.netlify/functions/*`), strip the configured
@@ -127,10 +131,17 @@ export async function fireInternalDispatch(options) {
         headers["Authorization"] = `Bearer ${signInternalToken(options.taskId)}`;
     }
     catch (err) {
-        // Distinguish the documented "no A2A_SECRET in dev" path from a real
-        // signing failure, so a malformed secret doesn't fail invisibly.
-        if (err instanceof Error && !/A2A_SECRET/i.test(err.message)) {
-            console.error(`[self-dispatch] signInternalToken failed unexpectedly for ${options.taskId}:`, err);
+        const detail = err instanceof Error ? err.message : String(err);
+        // Only local SQLite development has the loopback/unsigned exception. A
+        // shared database or production deployment must never turn a signing
+        // failure into an unauthenticated processor request.
+        if (process.env.NODE_ENV !== "production" &&
+            isLocalDatabase() &&
+            /A2A_SECRET/i.test(detail)) {
+            // The processor applies the matching trusted-local policy.
+        }
+        else {
+            throw new Error(`[self-dispatch] Cannot sign processor handoff for ${options.taskId}: ${detail}`, { cause: err });
         }
     }
     const awaitResponse = options.awaitResponse === true;

package/dist/server/ssr-handler.d.ts

@@ -1,4 +1,4 @@
-export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
+export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
 /**
  * Create an h3 catch-all that hands page routes to React Router and
  * returns 404 for framework / asset paths that React Router doesn't own.

package/dist/server/ssr-handler.js

@@ -25,7 +25,7 @@ import { captureError } from "./capture-error.js";
 import { getPostHogClientConfigScript } from "./posthog-config.js";
 import { runWithRequestContext } from "./request-context.js";
 import { getRealtimeClientConfigScript, getSentryClientConfigScript, } from "./sentry-config.js";
-export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
+export { DEFAULT_SSR_CACHE_HEADERS, DEFAULT_SPECULATION_RULES_HEADER, DEFAULT_SSR_CACHE_CONTROL, DISABLED_SSR_CACHE_HEADERS, isSsrCacheEnabled, resolveSsrCacheHeaders, resolveSsrCacheKeyHeaders, SSR_CACHE_ENV_VAR, } from "../shared/cache-control.js";
 function getAppBasePath() {
     return getAppBasePathFromViteEnv();
 }

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;