@agent-native/core 0.157.16 → 0.157.18

package/corpus/templates/calendar/server/handlers/google-auth.ts

@@ -50,6 +50,7 @@ type CalendarOAuthStateOptions = {
   owner?: string;
   orgId?: string;
   desktop?: boolean;
+  mobile?: boolean;
   addAccount?: boolean;
   app?: string;
   returnUrl?: string;
@@ -245,6 +246,7 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
     const orgId = session?.orgId;
     const desktop =
       isElectron(event) || q.desktop === "1" || q.desktop === "true";
+    const mobile = q.mobile === "1" || q.mobile === "true";
     const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
     const calendarConnect = isCalendarConnectRequest(q, owner);
     const credentials = calendarConnect
@@ -279,6 +281,7 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
       owner,
       orgId,
       desktop,
+      mobile,
       addAccount: calendarConnect,
       app: OAUTH_STATE_APP_ID,
       returnUrl,
@@ -309,6 +312,7 @@ export const getGoogleAuthUrl = defineEventHandler(async (event: H3Event) => {
 export const handleGoogleCallback = defineEventHandler(
   async (event: H3Event) => {
     let desktop = false;
+    let mobile = false;
     let flowId: string | undefined;
     try {
       const query = getQuery(event);
@@ -317,6 +321,7 @@ export const handleGoogleCallback = defineEventHandler(
         getAppUrl(event, "/_agent-native/google/callback"),
       );
       desktop = state.desktop ?? false;
+      mobile = state.mobile ?? false;
       flowId = state.flowId;
 
       const googleError = query.error as string | undefined;
@@ -358,6 +363,7 @@ export const handleGoogleCallback = defineEventHandler(
           {
             hasProductionSession,
             desktop,
+            ...(mobile ? { mobile: true } : {}),
             trackSignup: {
               authProvider: "google",
               authUserId: identity.id,
@@ -373,6 +379,7 @@ export const handleGoogleCallback = defineEventHandler(
         return oauthCallbackResponse(event, identity.email, {
           sessionToken,
           desktop,
+          mobile,
           returnUrl,
           flowId,
           appName: "Calendar",
@@ -398,11 +405,14 @@ export const handleGoogleCallback = defineEventHandler(
         addAccount || (owner !== undefined && email !== owner);
       const sessionOwner = isAddAccount ? (owner ?? email) : email;
       const shouldCreateSession =
-        !isAddAccount || (desktop && flowId && sessionOwner);
+        !isAddAccount ||
+        (desktop && flowId && sessionOwner) ||
+        (mobile && sessionOwner);
       const { sessionToken } = shouldCreateSession
         ? await createOAuthSession(event, sessionOwner, {
             hasProductionSession,
             desktop,
+            ...(mobile ? { mobile: true } : {}),
           })
         : { sessionToken: undefined };
 
@@ -414,6 +424,7 @@ export const handleGoogleCallback = defineEventHandler(
       return oauthCallbackResponse(event, email, {
         sessionToken,
         desktop,
+        mobile,
         addAccount: isAddAccount,
         flowId,
         appName: "Calendar",
@@ -434,6 +445,7 @@ export const getGoogleAddAccountUrl = defineEventHandler(
     const q = getQuery(event);
     const desktop =
       isElectron(event) || q.desktop === "1" || q.desktop === "true";
+    const mobile = q.mobile === "1" || q.mobile === "true";
     const flowId = desktop ? (q.flow_id as string) || undefined : undefined;
     if (!(await resolveCalendarOAuthCredentials(event))) {
       return missingCredentialsResponse(
@@ -456,6 +468,7 @@ export const getGoogleAddAccountUrl = defineEventHandler(
         owner: session.email,
         orgId: session.orgId,
         desktop,
+        mobile,
         addAccount: true,
         app: OAUTH_STATE_APP_ID,
         flowId,
@@ -481,6 +494,7 @@ export const getGoogleAddAccountUrl = defineEventHandler(
 export const handleGoogleAddAccountCallback = defineEventHandler(
   async (event: H3Event) => {
     let desktop = false;
+    let mobile = false;
     let flowId: string | undefined;
     try {
       const session = await getSession(event);
@@ -490,6 +504,7 @@ export const handleGoogleAddAccountCallback = defineEventHandler(
         getAppUrl(event, "/_agent-native/google/add-account/callback"),
       );
       desktop = state.desktop ?? false;
+      mobile = state.mobile ?? false;
       flowId = state.flowId;
 
       const googleError = query.error as string | undefined;
@@ -530,10 +545,11 @@ export const handleGoogleAddAccountCallback = defineEventHandler(
         session?.orgId ?? stateOrgId,
       );
       const { sessionToken } =
-        desktop && flowId
+        (desktop && flowId) || mobile
           ? await createOAuthSession(event, ownerEmail, {
               hasProductionSession: !!session?.email,
               desktop,
+              ...(mobile ? { mobile: true } : {}),
             })
           : { sessionToken: undefined };
 
@@ -544,6 +560,7 @@ export const handleGoogleAddAccountCallback = defineEventHandler(
       return oauthCallbackResponse(event, addedEmail, {
         sessionToken,
         desktop,
+        mobile,
         addAccount: true,
         flowId,
         appName: "Calendar",

package/corpus/templates/dispatch/server/plugins/identity-sso.ts

@@ -21,7 +21,11 @@ import {
   isFeatureFlagEnabled,
 } from "@agent-native/core/feature-flags";
 import { getOrgDomain } from "@agent-native/core/org";
-import { getH3App, getSession } from "@agent-native/core/server";
+import {
+  getH3App,
+  getSession,
+  hasGoogleAuthIdentity,
+} from "@agent-native/core/server";
 import { signInJourney } from "@agent-native/core/shared";
 import { defineEventHandler, getHeader, getMethod, readBody } from "h3";
 import type { H3Event } from "h3";
@@ -324,6 +328,9 @@ export const tokenHandler = defineEventHandler(
       name: identity.name,
       orgDomain: identity.orgDomain,
     });
+    const identityAuthProvider = (await hasGoogleAuthIdentity(identity.email))
+      ? "google"
+      : undefined;
     let assertion: string;
     try {
       assertion = await signA2AToken(
@@ -337,6 +344,9 @@ export const tokenHandler = defineEventHandler(
           extraClaims: {
             email: claims.email,
             ...(claims.name ? { name: claims.name } : {}),
+            ...(identityAuthProvider
+              ? { identity_auth_provider: identityAuthProvider }
+              : {}),
             scope: IDENTITY_SCOPE,
             jti: identity.jti,
             redirect_uri: redirectUri,

package/corpus/templates/dispatch/shared/feature-flags.ts

@@ -2,9 +2,12 @@ import {
   defineFeatureFlag,
   defineFeatureFlags,
 } from "@agent-native/core/feature-flags";
-import { DISPATCH_WORKSPACE_SSO_FLAG } from "@agent-native/dispatch/shared/feature-flags";
+import {
+  DISPATCH_WORKSPACE_APP_LIST_FLAG,
+  DISPATCH_WORKSPACE_SSO_FLAG,
+} from "@agent-native/dispatch/shared/feature-flags";
 
-export { DISPATCH_WORKSPACE_SSO_FLAG };
+export { DISPATCH_WORKSPACE_APP_LIST_FLAG, DISPATCH_WORKSPACE_SSO_FLAG };
 
 export const DESKTOP_WORKSPACE_SSO_FLAG = defineFeatureFlag({
   key: "desktop.workspace-sso",
@@ -16,4 +19,5 @@ export const DESKTOP_WORKSPACE_SSO_FLAG = defineFeatureFlag({
 export const DISPATCH_FEATURE_FLAGS = defineFeatureFlags([
   DESKTOP_WORKSPACE_SSO_FLAG,
   DISPATCH_WORKSPACE_SSO_FLAG,
+  DISPATCH_WORKSPACE_APP_LIST_FLAG,
 ]);

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/secrets/routes.d.ts

@@ -34,16 +34,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     ok: boolean;
     status: string;
     error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
     ok: boolean;
     removed: boolean;
@@ -54,9 +54,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
     ok: boolean;
     note?: undefined;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
-    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.js

@@ -564,7 +564,8 @@ function shouldExposeSessionTokenInBody(event) {
     // X-Request-Source; browsers can only use that cross-origin after our CORS
     // allowlist has approved the origin, and same-origin pages already receive
     // an equivalent httpOnly session cookie on successful login.
-    return !origin && getHeader(event, "x-request-source") === "clips-desktop";
+    const requestSource = getHeader(event, "x-request-source");
+    return (!origin && (requestSource === "clips-desktop" || requestSource === "mobile"));
 }
 function authLoginResponse(event, token, email) {
     if (!shouldExposeSessionTokenInBody(event))
@@ -2683,6 +2684,7 @@ async function mountBetterAuthRoutes(app, options) {
             }
             const q = getQuery(event);
             const desktop = isElectronRequest(event) || q.desktop === "1" || q.desktop === "true";
+            const mobile = q.mobile === "1" || q.mobile === "true";
             const flowId = desktop ? q.flow_id || undefined : undefined;
             // Validate the caller's return param up front and only embed it
             // into the OAuth state when it normalises to a non-root path —
@@ -2701,6 +2703,7 @@ async function mountBetterAuthRoutes(app, options) {
             const state = encodeOAuthState({
                 redirectUri,
                 desktop,
+                mobile,
                 addAccount: false,
                 app: getOAuthStateAppId(),
                 returnUrl,
@@ -2711,6 +2714,7 @@ async function mountBetterAuthRoutes(app, options) {
             logGoogleOAuthDebug(event, "auth-url", {
                 flowId,
                 desktop,
+                mobile,
                 redirectPath: oauthDebugUrlPath(redirectUri),
                 returnUrl,
                 redirect: q.redirect === "1",
@@ -2755,15 +2759,18 @@ async function mountBetterAuthRoutes(app, options) {
                 return callbackRelay;
             let callbackFlowId;
             let callbackDesktop = false;
+            let callbackMobile = false;
             try {
                 const query = getQuery(event);
                 const code = query.code;
-                const { redirectUri, desktop, returnUrl, flowId, signupAttribution, signupAnonymousId, } = decodeOAuthState(query.state, getAppUrl(event, "/_agent-native/google/callback"));
+                const { redirectUri, desktop, mobile, returnUrl, flowId, signupAttribution, signupAnonymousId, } = decodeOAuthState(query.state, getAppUrl(event, "/_agent-native/google/callback"));
                 callbackFlowId = flowId;
                 callbackDesktop = desktop ?? false;
+                callbackMobile = mobile ?? false;
                 logGoogleOAuthDebug(event, "callback-start", {
                     flowId,
                     desktop,
+                    mobile,
                     redirectPath: oauthDebugUrlPath(redirectUri),
                     hasCode: !!code,
                     returnUrl,
@@ -2870,6 +2877,7 @@ async function mountBetterAuthRoutes(app, options) {
                 const { sessionToken } = await createOAuthSession(event, email, {
                     hasProductionSession: false,
                     desktop,
+                    mobile,
                     trackSignup: {
                         authProvider: "google",
                         authUserId: typeof user.id === "string" ? user.id : undefined,
@@ -2881,6 +2889,7 @@ async function mountBetterAuthRoutes(app, options) {
                 logGoogleOAuthDebug(event, "callback-session-created", {
                     flowId,
                     desktop,
+                    mobile,
                     hasSessionToken: !!sessionToken,
                     emailDomain: email.split("@")[1] || "",
                 });
@@ -2894,6 +2903,7 @@ async function mountBetterAuthRoutes(app, options) {
                 return oauthCallbackResponse(event, email, {
                     sessionToken,
                     desktop,
+                    mobile,
                     returnUrl,
                     flowId,
                 });
@@ -2909,6 +2919,7 @@ async function mountBetterAuthRoutes(app, options) {
                 logGoogleOAuthDebug(event, "callback-error", {
                     flowId: callbackFlowId,
                     desktop: callbackDesktop,
+                    mobile: callbackMobile,
                     message: msg,
                 });
                 return oauthErrorPage(AUTH_GOOGLE_FALLBACK);

package/dist/server/better-auth-instance.d.ts

@@ -8,6 +8,8 @@
 import { type BetterAuthOptions } from "better-auth";
 export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, type AuthLoginMode, } from "./auth-login-mode.js";
 export declare function hasBetterAuthUserEmail(email: string): Promise<boolean>;
+/** Return whether the canonical user has a verified Google account link. */
+export declare function hasGoogleAuthIdentity(email: string): Promise<boolean | undefined>;
 export declare function trackSignupEvent({ authProvider, authUserId, email, name, attribution, anonymousId, }: {
     authProvider: string;
     authUserId?: string;

package/dist/server/better-auth-instance.js

@@ -54,6 +54,17 @@ export async function hasBetterAuthUserEmail(email) {
         .catch(() => null);
     return !!existing?.user?.email;
 }
+/** Return whether the canonical user has a verified Google account link. */
+export async function hasGoogleAuthIdentity(email) {
+    const adapter = await getBetterAuthInternalAdapter();
+    if (!adapter)
+        return undefined;
+    const existing = await adapter.findUserByEmail(email.trim().toLowerCase(), {
+        includeAccounts: true,
+    });
+    return (existing?.accounts.some((account) => account.providerId === "google") ??
+        false);
+}
 export async function trackSignupEvent({ authProvider, authUserId, email, name, attribution, anonymousId, }) {
     identify(email, {
         email,

package/dist/server/google-oauth.d.ts

@@ -88,6 +88,13 @@ export interface OAuthStatePayload {
     owner?: string;
     orgId?: string;
     desktop?: boolean;
+    /**
+     * Explicit native-mobile intent from an embedded app. The callback may be
+     * served by a browser with a non-mobile user-agent, so relying on
+     * `isMobile(event)` alone can strand the native client on the web sign-in
+     * page.
+     */
+    mobile?: boolean;
     addAccount?: boolean;
     app?: string;
     /**
@@ -113,6 +120,7 @@ export interface EncodeOAuthStateOptions {
     owner?: string;
     orgId?: string;
     desktop?: boolean;
+    mobile?: boolean;
     addAccount?: boolean;
     app?: string;
     returnUrl?: string;
@@ -165,6 +173,7 @@ export interface OAuthSessionResult {
 export declare function createOAuthSession(event: H3Event, email: string, opts: {
     hasProductionSession: boolean;
     desktop?: boolean;
+    mobile?: boolean;
     trackSignup?: {
         authProvider: string;
         authUserId?: string;
@@ -182,6 +191,7 @@ export declare function createOAuthSession(event: H3Event, email: string, opts:
 export declare function oauthCallbackResponse(event: H3Event, email: string, opts: {
     sessionToken?: string;
     desktop?: boolean;
+    mobile?: boolean;
     addAccount?: boolean;
     /**
      * Same-origin path to return the viewer to after a successful web

package/dist/server/google-oauth.js

@@ -453,6 +453,8 @@ export function encodeOAuthState(redirectUriOrOpts, owner, desktop, addAccount,
         payload.g = opts.orgId;
     if (opts.desktop)
         payload.d = true;
+    if (opts.mobile)
+        payload.m = true;
     if (opts.addAccount)
         payload.a = true;
     if (opts.app)
@@ -500,6 +502,7 @@ export function decodeOAuthState(stateParam, fallbackUri) {
                 owner: parsed.o || undefined,
                 orgId: typeof parsed.g === "string" ? parsed.g : undefined,
                 desktop: !!parsed.d,
+                mobile: !!parsed.m,
                 addAccount: !!parsed.a,
                 app: typeof parsed.app === "string" ? parsed.app : undefined,
                 // Pass returnUrl through as-is — same-origin validation runs at the
@@ -537,7 +540,10 @@ export async function resolveOAuthOwner(event, stateOwner) {
  * app can inject it.
  */
 export async function createOAuthSession(event, email, opts) {
-    const mobile = isMobile(event);
+    // A native callback can arrive through a browser whose callback request
+    // user-agent does not identify as mobile. Prefer the signed flow intent and
+    // retain UA detection for ordinary mobile web sign-ins.
+    const mobile = opts.mobile || isMobile(event);
     const needsDeepLink = opts.desktop || mobile;
     const maxAge = getSessionMaxAge();
     let sessionToken;
@@ -592,7 +598,9 @@ export async function createOAuthSession(event, email, opts) {
  * pages, and plain web redirects — so templates don't have to.
  */
 export function oauthCallbackResponse(event, email, opts) {
-    const mobile = isMobile(event);
+    // The mobile flag is carried inside HMAC-signed OAuth state by native
+    // clients. UA detection remains the fallback for ordinary mobile browsers.
+    const mobile = opts.mobile || isMobile(event);
     const query = getQuery(event);
     const callbackState = typeof query.state === "string" && query.state.length > 0
         ? query.state

package/dist/server/identity-sso.js

@@ -218,6 +218,7 @@ async function verifyIdentityAssertion(assertion, binding) {
             orgDomain: typeof payload.org_domain === "string" && payload.org_domain
                 ? payload.org_domain
                 : undefined,
+            authProvider: payload.identity_auth_provider === "google" ? "google" : undefined,
             sub: typeof payload.sub === "string" && payload.sub ? payload.sub : email,
             jti,
         };
@@ -416,7 +417,8 @@ export async function handleIdentitySso(event, subpath) {
         if (!identity || (await isJtiReplayed(identity.jti))) {
             return errorPage("We could not verify the sign-in response. Please try again.", loginPath);
         }
-        if (await isGoogleSignInRequiredForEmail(identity.email)) {
+        if ((await isGoogleSignInRequiredForEmail(identity.email)) &&
+            identity.authProvider !== "google") {
             return errorPage(GOOGLE_AUTH_REQUIRED_MESSAGE, loginPath);
         }
         try {

package/dist/server/index.d.ts

@@ -9,6 +9,7 @@ export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTarg
 export { createSSEHandler, type SSEHandlerOptions } from "./sse.js";
 export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, type DesktopExchangeErrorPayload, type AuthSession, type AuthOptions, } from "./auth.js";
 export { handleIdentitySso, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
+export { hasGoogleAuthIdentity } from "./better-auth-instance.js";
 export { requireEnvKey, type MissingKeyResponse } from "./missing-key.js";
 export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";
 export { verifyCaptcha, type CaptchaVerifyResult } from "./captcha.js";

package/dist/server/index.js

@@ -9,6 +9,7 @@ export { createEmbedSessionTicket, consumeEmbedSessionTicket, normalizeEmbedTarg
 export { createSSEHandler } from "./sse.js";
 export { mountAuthMiddleware, autoMountAuth, registerAuthPublicPaths, getSession, COOKIE_NAME, addSession, removeSession, getSessionEmail, getFrameworkSessionCookieValues, setFrameworkSessionCookie, clearFrameworkSessionCookies, runAuthGuard, setDesktopExchange, setDesktopExchangeError, safeReturnPath, } from "./auth.js";
 export { handleIdentitySso, getIdentityHubUrl, isIdentitySsoEnabled, isIdentitySsoBypassPath, identitySsoLoginButtonHtml, IDENTITY_SSO_PROVIDER_ID, IDENTITY_SSO_SCOPE, IDENTITY_SSO_DESKTOP_COMPLETE_PATH, } from "./identity-sso.js";
+export { hasGoogleAuthIdentity } from "./better-auth-instance.js";
 export { requireEnvKey } from "./missing-key.js";
 export { assertCurrentRequestUserIsOrgAdmin, currentRequestUserIsOrgAdmin, } from "./org-admin.js";
 export { verifyCaptcha } from "./captcha.js";

package/dist/server/onboarding-html.js

@@ -1299,6 +1299,16 @@ export function getOnboardingHtml(opts = {}) {
     const googleAuthMode = resolveGoogleAuthMode(opts.googleAuthMode);
     const builderPreviewLocalDevEnabled = isBuilderPreviewLocalDevEnabled();
     const localeInitScript = getLocaleInitScript();
+    const embeddedAuthInitScript = `(function() {
+  try {
+    var params = new URLSearchParams(window.location.search || "");
+    if (params.get("embedded") === "1" || window.self !== window.top) {
+      document.documentElement.setAttribute("data-agent-native-embedded", "1");
+    }
+  } catch (error) {
+    void error;
+  }
+})();`;
     const marketing = opts.marketing ??
         resolveBuiltInAuthMarketing({
             requestHost: opts.requestHost,
@@ -1397,6 +1407,9 @@ ${localeMenuItemsHtml}
       </div>`
         : "";
     const identitySsoHtml = identitySsoLoginButtonHtml();
+    const embeddedAuthCss = identitySsoHtml
+        ? '  html[data-agent-native-embedded="1"] #identity-sso-btn { display: none !important; }\n'
+        : "";
     const localDevHtml = `
   <div class="local-dev-signin" id="local-dev-signin" hidden>
     <button type="button" class="btn-local-dev btn-primary" id="local-dev-btn" title="${esc(t("localDevDescription"))}"${i18nAttr("localDevButton")} data-i18n-title="localDevDescription" aria-describedby="local-dev-description">${esc(t("localDevButton"))}</button>
@@ -1758,6 +1771,7 @@ ${marketing.description ? `      <p class="app-desc" data-marketing-field="descr
 <head>
 <meta charset="UTF-8">
 <script data-agent-native-locale-init>${localeInitScript}</script>
+<script data-agent-native-embedded-init>${embeddedAuthInitScript}</script>
 <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no">
 <title>${hasMarketing ? esc(marketing.appName) + " — " + esc(t("pageTitleSignIn")) : esc(t("pageTitleWelcome"))}</title>
 <link rel="icon" type="image/svg+xml" href="${withAppBasePath("/favicon.svg")}">
@@ -2305,6 +2319,7 @@ ${marketingStyles}
   body.simplified-auth { background: #141414; }
   body.simplified-auth .card { border-color: transparent; box-shadow: none; }
   body.simplified-auth .local-note { display: none !important; }
+${embeddedAuthCss}
 </style>
 </head>
 <body${simplifiedAuth ? ' class="simplified-auth"' : hasMarketing ? ' class="has-marketing"' : ""}>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.157.16",
+  "version": "0.157.18",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {