@agent-native/core 0.192.0-nightly-20260926081002 → 0.192.0

package/dist/cli/design-connect.js

@@ -70,7 +70,7 @@ async function persistBridgeToken(rootPath, token) {
     await fs.chmod(temporaryPath, 0o600);
     await fs.rename(temporaryPath, absolutePath);
 }
-async function resolveBridgeToken(rootPath, configuredToken) {
+async function resolveBridgeToken(rootPath, configuredToken, persist = true) {
     const persistedToken = await readPersistedBridgeToken(rootPath);
     const bridgeToken = configuredToken ||
         process.env["AGENT_NATIVE_BRIDGE_TOKEN"] ||
@@ -80,10 +80,9 @@ async function resolveBridgeToken(rootPath, configuredToken) {
         throw new Error("AGENT_NATIVE_BRIDGE_TOKEN is a localhost connection ID, not a bridge token. " +
             "Start visual-edit with the bridgeToken returned by open-visual-edit, then restart the bridge.");
     }
-    // Keep the durable daemon restart path paired with the connection row. An
-    // explicit token wins so the server-minted token from open-visual-edit can
-    // replace an older local credential before the first browser registration.
-    if (configuredToken || !persistedToken) {
+    // The daemon path persists only after it proves the running or newly-started
+    // bridge accepted this token. A rejected token must not replace recovery data.
+    if (persist && (configuredToken || !persistedToken)) {
         await persistBridgeToken(rootPath, bridgeToken);
     }
     return bridgeToken;
@@ -443,28 +442,39 @@ function isDesignConnectManifest(value) {
 }
 async function fetchRunningBridgeManifest(bridgeUrl, previewToken) {
     const manifestUrl = new URL("/manifest.json", bridgeUrl);
-    if (previewToken) {
-        manifestUrl.searchParams.set("previewToken", previewToken);
-    }
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 800);
     try {
         const response = await fetch(manifestUrl, {
             method: "GET",
+            headers: { "x-design-preview-token": previewToken },
             signal: controller.signal,
         });
         if (!response.ok)
-            return null;
+            return { manifest: null, status: response.status };
         const body = (await response.json());
-        return isDesignConnectManifest(body) ? body : null;
+        return {
+            manifest: isDesignConnectManifest(body) ? body : null,
+            status: response.status,
+        };
     }
     catch {
-        return null;
+        return { manifest: null, status: null };
     }
     finally {
         clearTimeout(timeout);
     }
 }
+async function inspectRunningBridge(manifest, bridgeToken) {
+    const [manifestResult, runningFingerprint] = await Promise.all([
+        fetchRunningBridgeManifest(manifest.bridgeUrl, deriveDesignPreviewToken(bridgeToken)),
+        fetchRunningBridgeFingerprint(manifest.bridgeUrl),
+    ]);
+    return {
+        ...manifestResult,
+        fingerprintMatches: runningFingerprint === designConnectAppFingerprint(manifest),
+    };
+}
 export function designConnectManifestsTargetSameApp(running, requested) {
     let runningUrl = running.devServerUrl;
     let requestedUrl = requested.devServerUrl;
@@ -2201,14 +2211,18 @@ export async function startDesignConnectBridge(manifest, seedOrOptions) {
         ? { bridgeToken: seedOrOptions }
         : (seedOrOptions ?? {});
     const configuredBridgeToken = options.bridgeToken || process.env["AGENT_NATIVE_BRIDGE_TOKEN"];
-    const bridgeToken = await resolveBridgeToken(manifest.rootPath, configuredBridgeToken);
-    const configuredPreviewToken = options.previewToken || process.env["AGENT_NATIVE_PREVIEW_TOKEN"];
+    const bridgeToken = await resolveBridgeToken(manifest.rootPath, configuredBridgeToken, false);
+    const configuredPreviewToken = options.previewToken;
     const derivedPreviewToken = deriveDesignPreviewToken(bridgeToken);
     if (configuredPreviewToken &&
         configuredPreviewToken !== derivedPreviewToken) {
         throw new Error("previewToken must match the deterministic token derived from bridgeToken");
     }
-    const previewToken = configuredPreviewToken || derivedPreviewToken;
+    if (process.env["AGENT_NATIVE_PREVIEW_TOKEN"] &&
+        process.env["AGENT_NATIVE_PREVIEW_TOKEN"] !== derivedPreviewToken) {
+        console.warn("Ignoring stale AGENT_NATIVE_PREVIEW_TOKEN; the current bridge token determines the preview token.");
+    }
+    const previewToken = derivedPreviewToken;
     const configuredOrigins = new Set((options.allowedOrigins ?? []).flatMap((raw) => {
         try {
             return [new URL(raw).origin];
@@ -3197,6 +3211,15 @@ export async function startDesignConnectBridge(manifest, seedOrOptions) {
             resolve();
         });
     });
+    if (options.persistBridgeToken !== false) {
+        try {
+            await persistBridgeToken(manifest.rootPath, bridgeToken);
+        }
+        catch (error) {
+            await new Promise((resolve) => server.close(() => resolve()));
+            throw error;
+        }
+    }
     return { server, manifest, bridgeToken, previewToken, bridgeInstanceId };
 }
 /**
@@ -3319,7 +3342,7 @@ Options:
   --preview-token <token> Adopt the paired read-only browser preview token.
                           Optional when --bridge-token is present: compatible
                           clients derive the same one-way token automatically.
-                          (also reads AGENT_NATIVE_PREVIEW_TOKEN env)
+                          (stale AGENT_NATIVE_PREVIEW_TOKEN values are ignored)
   --daemon                Start the bridge detached, wait for /health, then exit
   --json                  Print the manifest JSON and exit
   --once                  Prepare/scaffold the manifest and exit
@@ -3372,20 +3395,33 @@ function resolveCurrentCliInvocation(argv) {
         args: [...cliPrefix, "design", ...removeDaemonFlag(argv)],
     };
 }
-async function startDetachedDesignBridge(argv, manifest, previewToken) {
+async function startDetachedDesignBridge(argv, manifest, bridgeToken) {
     if (await waitForBridgeHealth(manifest.bridgeUrl, 800)) {
-        const [runningManifest, runningFingerprint] = await Promise.all([
-            fetchRunningBridgeManifest(manifest.bridgeUrl, previewToken),
-            fetchRunningBridgeFingerprint(manifest.bridgeUrl),
-        ]);
-        const fingerprintMatches = runningFingerprint === designConnectAppFingerprint(manifest);
-        if ((runningManifest &&
-            designConnectManifestsTargetSameApp(runningManifest, manifest)) ||
-            fingerprintMatches) {
+        const manifestResult = await inspectRunningBridge(manifest, bridgeToken);
+        const runningManifest = manifestResult.manifest;
+        const { fingerprintMatches } = manifestResult;
+        if (runningManifest &&
+            designConnectManifestsTargetSameApp(runningManifest, manifest)) {
+            await persistBridgeToken(manifest.rootPath, bridgeToken);
             console.error(`Design localhost bridge already running at ${manifest.bridgeUrl}`);
-            console.log(JSON.stringify(runningManifest ?? manifest, null, 2));
+            console.log(JSON.stringify(runningManifest, null, 2));
             return 0;
         }
+        if (fingerprintMatches && !runningManifest) {
+            const errorMessage = manifestResult.status === 401
+                ? "A Design localhost bridge for this app is already running, but it rejected the current bridge token (HTTP 401)."
+                : "A Design localhost bridge for this app is already running, but its authenticated manifest could not be verified.";
+            console.error([
+                errorMessage,
+                ...(manifestResult.status === 401
+                    ? [
+                        "If the token changed, stop only the bridge process you started, then rerun design connect with the bridgeToken returned by open-visual-edit via --bridge-token (or AGENT_NATIVE_BRIDGE_TOKEN).",
+                    ]
+                    : ["Retry after confirming the bridge is healthy."]),
+                "The existing process was left running.",
+            ].join("\n"));
+            return 1;
+        }
         console.error([
             `Design localhost bridge already running at ${manifest.bridgeUrl} for a different app.`,
             runningManifest
@@ -3406,17 +3442,35 @@ async function startDetachedDesignBridge(argv, manifest, previewToken) {
     const child = spawn(invocation.command, invocation.args, {
         cwd: process.cwd(),
         detached: true,
-        env: process.env,
+        env: {
+            ...process.env,
+            AGENT_NATIVE_BRIDGE_TOKEN: bridgeToken,
+        },
         stdio: ["ignore", logFd.fd, logFd.fd],
         shell: process.platform === "win32",
     });
     child.unref();
     if (await waitForBridgeHealth(manifest.bridgeUrl)) {
+        const running = await inspectRunningBridge(manifest, bridgeToken);
+        if (running.manifest &&
+            designConnectManifestsTargetSameApp(running.manifest, manifest)) {
+            await persistBridgeToken(manifest.rootPath, bridgeToken);
+            await logFd.close();
+            console.error(`Design localhost bridge running at ${manifest.bridgeUrl}`);
+            console.error(`Bridge log: ${logPath}`);
+            console.log(JSON.stringify(running.manifest, null, 2));
+            return 0;
+        }
         await logFd.close();
-        console.error(`Design localhost bridge running at ${manifest.bridgeUrl}`);
-        console.error(`Bridge log: ${logPath}`);
-        console.log(JSON.stringify(manifest, null, 2));
-        return 0;
+        const authenticationFailed = running.fingerprintMatches && !running.manifest;
+        console.error([
+            authenticationFailed
+                ? `A Design localhost bridge for this app became available at ${manifest.bridgeUrl}, but it rejected this invocation's bridge token (HTTP ${running.status ?? "unknown"}).`
+                : `A Design localhost bridge became available at ${manifest.bridgeUrl} for a different app or could not be verified.`,
+            "No bridge token was persisted; the running process was left untouched.",
+            `Bridge log: ${logPath}`,
+        ].join("\n"));
+        return 1;
     }
     const tail = await readDaemonLogTail(logPath);
     await logFd.close();
@@ -3499,11 +3553,19 @@ export async function runDesign(argv) {
     const manifest = await prepareDesignConnectManifest(parsed);
     const seedBridgeToken = parsed.bridgeToken || process.env["AGENT_NATIVE_BRIDGE_TOKEN"] || undefined;
     const seedPreviewToken = parsed.previewToken ||
-        process.env["AGENT_NATIVE_PREVIEW_TOKEN"] ||
         (seedBridgeToken ? deriveDesignPreviewToken(seedBridgeToken) : undefined);
     const appUrl = resolveAppUrl(parsed.appUrl);
     if (parsed.daemon) {
-        return startDetachedDesignBridge(argv, manifest, seedPreviewToken);
+        const bridgeToken = await resolveBridgeToken(manifest.rootPath, seedBridgeToken, false);
+        const derivedPreviewToken = deriveDesignPreviewToken(bridgeToken);
+        if (parsed.previewToken && parsed.previewToken !== derivedPreviewToken) {
+            throw new Error("previewToken must match the deterministic token derived from bridgeToken");
+        }
+        if (process.env["AGENT_NATIVE_PREVIEW_TOKEN"] &&
+            process.env["AGENT_NATIVE_PREVIEW_TOKEN"] !== derivedPreviewToken) {
+            console.warn("Ignoring stale AGENT_NATIVE_PREVIEW_TOKEN; the current bridge token determines the preview token.");
+        }
+        return startDetachedDesignBridge(argv, manifest, bridgeToken);
     }
     if (parsed.json || parsed.once || parsed.dryRun) {
         console.log(JSON.stringify(manifest, null, 2));

package/dist/client/auth/AuthPage.d.ts

@@ -1,18 +1,6 @@
 /** @jsxRuntime classic */
 import * as React from "react";
 export type AuthView = "signup" | "login" | "forgot" | "twoFactor" | "verification" | "magicLink" | "magicLinkSent" | "googleOnly";
-export interface AuthMarketingProps {
-    appName: string;
-    tagline?: string;
-    description?: string;
-    features?: string[];
-    authHeadline?: string;
-    authDescription?: string;
-    screenshotSrc?: string;
-    screenshotWidth?: number;
-    screenshotHeight?: number;
-    learnMoreUrl?: string;
-}
 export interface AuthLocaleOption {
     value: string;
     label: string;
@@ -43,11 +31,7 @@ export interface AuthPageProps {
         dir?: string;
     }>;
     localeOptions: AuthLocaleOption[];
-    marketing?: AuthMarketingProps;
-    marketingLocales: Record<string, AuthMarketingProps>;
-    brandMarkSrc: string;
-    brandMarkLightSrc?: string;
-    githubUrl: string;
+    appName?: string;
     showGoogle: boolean;
     /** Show the organization SSO email-to-provider entry point. */
     organizationSsoEnabled?: boolean;

package/dist/client/auth/AuthPage.js

@@ -1,10 +1,8 @@
 /** @jsxRuntime classic */
-import { MarketingHome } from "@agent-native/toolkit/marketing";
 import { AuthForm } from "@agent-native/toolkit/onboarding";
 import * as React from "react";
 import { normalizeLocaleCode } from "../../localization/shared.js";
 import { canonicalTrackingEvent } from "../../shared/analytics-events.js";
-import { getAppStatus } from "../../shared/app-status.js";
 import { AUTH_SIGNUP_INVITE_ONLY_CODE } from "../../shared/auth-copy.js";
 import { toPublicFrameworkPath } from "../../shared/framework-route-prefix.js";
 import { isQaTestEmail } from "../../shared/qa-test-email.js";
@@ -12,7 +10,6 @@ import { signInJourney, } from "../../shared/sign-in-journey.js";
 import { isSyntheticTrafficValue } from "../../shared/test-traffic.js";
 import { frameworkRoutePrefix } from "../api-path.js";
 import { openOAuthPopup } from "../oauth-popup.js";
-import { OceanBackground } from "../ocean/OceanBackground.js";
 const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 const TAB_STORAGE_KEY = "an.onboarding.tab";
 const PENDING_SIGNUP_EMAIL_STORAGE_KEY = "an.onboarding.pendingSignupEmail";
@@ -483,7 +480,7 @@ export function shouldStartWithLocalDev(pathname, search) {
         !path.endsWith("/sign-in"));
 }
 export function AuthPage(props) {
-    const { authMode, googleOnly, initialPrompt, appBasePath, homePath, initialResumeHref, workspaceRuntime, trackingApp, defaultLocale, localeStorageKey, locales, localeMetadata, localeOptions, marketing, marketingLocales, brandMarkSrc, brandMarkLightSrc, githubUrl, showGoogle, organizationSsoEnabled = false, googleViaIdentitySso = false, signupLegalNotice, signupLocalModeNote, docsAuthUrl, identitySsoEnabled = false, identitySsoAuto = false, publicOAuthOrigin, workspaceGatewayReturnOrigin, googleAuthMode, builderPreviewLocalDevEnabled, } = props;
+    const { authMode, googleOnly, appBasePath, homePath, initialResumeHref, workspaceRuntime, trackingApp, defaultLocale, localeStorageKey, locales, localeMetadata, localeOptions, appName, showGoogle, organizationSsoEnabled = false, googleViaIdentitySso = false, signupLegalNotice, signupLocalModeNote, docsAuthUrl, identitySsoEnabled = false, identitySsoAuto = false, publicOAuthOrigin, workspaceGatewayReturnOrigin, googleAuthMode, builderPreviewLocalDevEnabled, } = props;
     const [localePreference, setLocalePreference] = React.useState("system");
     const [locale, setLocale] = React.useState(defaultLocale);
     const [browserLocationReady, setBrowserLocationReady] = React.useState(false);
@@ -629,14 +626,14 @@ export function AuthPage(props) {
         };
     }, []);
     React.useEffect(() => {
-        const nextTitle = marketing?.appName
-            ? `${marketing.appName} — ${t("pageTitleSignIn")}`
+        const nextTitle = appName
+            ? `${appName} — ${t("pageTitleSignIn")}`
             : t("pageTitleWelcome");
         document.title = nextTitle;
         document.documentElement.lang = locale;
         document.documentElement.dir = localeMetadata[locale]?.dir || "ltr";
         document.documentElement.dataset.locale = locale;
-    }, [locale, localeMetadata, marketing?.appName, t]);
+    }, [appName, locale, localeMetadata, t]);
     React.useEffect(() => {
         if (googleOnly)
             return;
@@ -1885,16 +1882,6 @@ export function AuthPage(props) {
         }
     }, [signupLocalModeNote]);
     const keys = headingKeys(view);
-    const marketingCopy = marketing
-        ? { ...marketing, ...(marketingLocales[locale] ?? {}) }
-        : undefined;
-    const marketingAppName = marketingCopy?.appName.replace(/^Agent-Native\s+/i, "") ?? "";
-    const marketingStatus = getAppStatus(trackingApp || marketingAppName);
-    const usesMarketingWelcome = !!marketingCopy &&
-        (view === "signup" ||
-            view === "login" ||
-            view === "magicLink" ||
-            view === "googleOnly");
     const cardClassName = [
         "card",
         view === "verification" ? "verifying" : "",
@@ -1972,12 +1959,8 @@ export function AuthPage(props) {
             legalNote,
             localModeNote), messageId: "s-msg", messageClassName: `msg ${messages.signup ? `${messages.signup.kind} show` : ""}`, message: messages.signup?.text }));
     const authCard = (React.createElement("div", { className: cardClassName },
-        React.createElement("h1", { id: "heading", "data-i18n": usesMarketingWelcome ? "welcomeToApp" : keys.heading, "data-auth-marketing-title": usesMarketingWelcome ? "true" : undefined }, usesMarketingWelcome
-            ? t("welcomeToApp").replace("{appName}", marketingAppName)
-            : t(keys.heading)),
-        React.createElement("p", { id: "subtitle", className: "subtitle", "data-i18n": usesMarketingWelcome ? undefined : keys.subtitle, "data-auth-marketing-subtitle": usesMarketingWelcome ? "true" : undefined, hidden: usesMarketingWelcome
-                ? false
-                : shouldHideAuthSubtitle(view, localDevAvailable) }, usesMarketingWelcome ? t("welcomeSubtitle") : t(keys.subtitle)),
+        React.createElement("h1", { id: "heading", "data-i18n": keys.heading }, t(keys.heading)),
+        React.createElement("p", { id: "subtitle", className: "subtitle", "data-i18n": keys.subtitle, hidden: shouldHideAuthSubtitle(view, localDevAvailable) }, t(keys.subtitle)),
         React.createElement("p", { className: `upgrade-note ${upgradeVisible ? "show" : ""}`, id: "upgrade-note", "data-upgrade-copy": t("upgradeCopy"), "data-i18n-data-upgrade-copy": "upgradeCopy" }, upgradeVisible ? t("upgradeCopy") : null),
         identitySsoEnabled && !googleOnly ? (React.createElement("div", { className: "identity-sso-entry", id: "identity-sso-entry" },
             React.createElement("a", { className: "btn-primary btn-identity-sso", id: "identity-sso-btn", href: identityLoginHref, "aria-describedby": "identity-sso-hint", "data-i18n": "continueWithAgentNative" }, t("continueWithAgentNative")),
@@ -2131,32 +2114,7 @@ export function AuthPage(props) {
             localeOptions.map((option) => (React.createElement("button", { type: "button", className: "locale-menu-item", role: "menuitemradio", "aria-checked": localePreference === option.value, "data-locale-value": option.value, key: option.value, onClick: () => selectLocale(option.value) },
                 React.createElement("span", { className: "locale-menu-check", "aria-hidden": "true" }, "\u2713"),
                 React.createElement("span", null, option.label)))))));
-    const marketingContent = marketingCopy ? (React.createElement("div", { className: "marketing-content" },
-        React.createElement("h2", { className: "app-name" },
-            React.createElement("picture", null,
-                brandMarkLightSrc ? (React.createElement("source", { media: "(prefers-color-scheme: light)", srcSet: brandMarkLightSrc })) : null,
-                React.createElement("img", { className: "brand-mark", src: brandMarkSrc, alt: "", "aria-hidden": "true" })),
-            React.createElement("span", { className: "app-name-label" }, marketingAppName),
-            React.createElement("span", { className: "app-status-badge" }, marketingStatus)),
-        React.createElement("div", { className: "marketing-copy" },
-            React.createElement("p", { className: "auth-marketing-headline", "data-marketing-field": "headline" }, marketingCopy.authHeadline ?? marketingCopy.tagline),
-            (marketingCopy.authDescription ?? marketingCopy.description) ||
-                marketingCopy.learnMoreUrl ? (React.createElement("p", { className: "auth-marketing-description", "data-marketing-field": "description" },
-                marketingCopy.authDescription ?? marketingCopy.description,
-                marketingCopy.learnMoreUrl ? (React.createElement(React.Fragment, null,
-                    " ",
-                    React.createElement("a", { className: "auth-marketing-description-link", href: marketingCopy.learnMoreUrl, target: "_blank", rel: "noreferrer" }, t("learnMore")))) : null)) : null,
-            React.createElement("div", { className: "marketing-actions" },
-                React.createElement("a", { className: "oss-badge", href: githubUrl, target: "_blank", rel: "noreferrer" },
-                    React.createElement("svg", { "aria-hidden": "true", viewBox: "0 0 24 24", width: 16, height: 16, fill: "none", stroke: "currentColor", strokeWidth: 2, strokeLinecap: "round", strokeLinejoin: "round" },
-                        React.createElement("path", { d: "M9 19c-4.3 1.4 -4.3 -2.5 -6 -3m12 5v-3.5c0 -1 .1 -1.4 -.5 -2c2.8 -.3 5.5 -1.4 5.5 -6a4.6 4.6 0 0 0 -1.3 -3.2a4.2 4.2 0 0 0 -.1 -3.2s-1.1 -.3 -3.5 1.3a12.3 12.3 0 0 0 -6.2 0c-2.4 -1.6 -3.5 -1.3 -3.5 -1.3a4.2 4.2 0 0 0 -.1 3.2a4.6 4.6 0 0 0 -1.3 3.2c0 4.6 2.7 5.7 5.5 6c-.6 .6 -.6 1.2 -.5 2v3.5" })),
-                    React.createElement("span", { "data-i18n": "openSource" }, t("openSource"))))))) : null;
-    const marketingSurface = marketingCopy ? (React.createElement(MarketingHome, { appName: marketingAppName, variant: "auth", background: null, auth: authCard, className: "auth-marketing-home" },
-        React.createElement("div", { className: "auth-marketing-visual" },
-            React.createElement("div", { className: "auth-marketing-screenshot-wrap" },
-                React.createElement(OceanBackground, { className: "auth-marketing-screenshot" })),
-            marketingContent))) : (React.createElement("div", { className: "auth-centered" }, authCard));
     return (React.createElement(React.Fragment, null,
         localePicker,
-        initialPrompt ? (React.createElement("div", { className: "auth-centered" }, authCard)) : (marketingSurface)));
+        React.createElement("div", { className: "auth-centered" }, authCard)));
 }

package/dist/client/observability/OutputPreview.js

@@ -59,7 +59,11 @@ function ReviewPreviewFrame({ url, artifactAppId, artifactId, previewLabel, comp
     const [safePreview, setSafePreview] = useState();
     const [rejectedPreviewSource, setRejectedPreviewSource] = useState();
     const [selectedSlideId, setSelectedSlideId] = useState(null);
-    const designQuery = useActionQuery("get-design", { id: artifactId ?? "", includeFileContent: false }, {
+    const designQuery = useActionQuery("get-design", {
+        id: artifactId ?? "",
+        includeFileContent: false,
+        reviewPreview: true,
+    }, {
         enabled: mounted && artifactAppId === "design" && Boolean(artifactId),
         staleTime: 5 * 60_000,
     });
@@ -77,13 +81,14 @@ function ReviewPreviewFrame({ url, artifactAppId, artifactId, previewLabel, comp
         id: artifactId ?? "",
         fileId: designFileId ?? "",
         includeFileContent: true,
+        reviewPreview: true,
     }, {
         enabled: mounted &&
             artifactAppId === "design" &&
             Boolean(artifactId && designFileId),
         staleTime: 5 * 60_000,
     });
-    const deckQuery = useActionQuery("get-deck", { id: artifactId ?? "", compact: "true" }, {
+    const deckQuery = useActionQuery("get-deck", { id: artifactId ?? "", compact: "true", reviewPreview: true }, {
         enabled: mounted && artifactAppId === "slides" && Boolean(artifactId),
         staleTime: 5 * 60_000,
     });
@@ -104,6 +109,7 @@ function ReviewPreviewFrame({ url, artifactAppId, artifactId, previewLabel, comp
         id: artifactId ?? "",
         slideId: activeSlideId ?? "",
         compact: "false",
+        reviewPreview: true,
     }, {
         enabled: mounted && artifactAppId === "slides" && Boolean(activeSlideId),
         staleTime: 5 * 60_000,

package/dist/client/sign-in-landing.d.ts

@@ -0,0 +1 @@
+export declare function signInLandingLoader(homePath?: string): Response | null;

package/dist/client/sign-in-landing.js

@@ -0,0 +1,8 @@
+import { redirectDocument } from "react-router";
+import { SIGN_IN_ENTRY_PATH } from "../shared/sign-in-journey.js";
+import { appPath } from "./api-path.js";
+export function signInLandingLoader(homePath) {
+    if (homePath === "/")
+        return null;
+    return redirectDocument(appPath(SIGN_IN_ENTRY_PATH));
+}

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/deploy/workspace-deploy.js

@@ -67,6 +67,7 @@ const NETLIFY_PUBLIC_ASSET_EXTENSIONS = new Set([
 const WORKSPACE_APPS_ENV_KEY = "AGENT_NATIVE_WORKSPACE_APPS_JSON";
 const WORKSPACE_APPS_MANIFEST_DIR = ".agent-native";
 const WORKSPACE_APPS_MANIFEST_FILE = "workspace-apps.json";
+const WORKSPACE_ROOT_GOOGLE_CALLBACK_PATH = "/_agent-native/google/callback";
 const VERCEL_OUTPUT_DIR = ".vercel/output";
 const WORKSPACE_DIRECTORY_ENV_SNIPPET = `
   const directoryOrigin =
@@ -135,11 +136,11 @@ export async function runWorkspaceDeploy(opts = {}) {
         writeWorkspaceDirectoryPage(preset === "vercel" ? path.join(vercelOutputDir, "static") : distDir, workspaceApps);
     }
     if (preset === "netlify") {
-        writeNetlifyRedirects(distDir, apps, workspaceRootPage);
+        writeNetlifyRedirects(distDir, apps, workspaceApps, workspaceRootPage);
         writeNetlifyHeaders(distDir, apps);
     }
     else {
-        writeVercelBuildConfig(vercelOutputDir, apps, workspaceRootPage);
+        writeVercelBuildConfig(vercelOutputDir, apps, workspaceApps, workspaceRootPage);
     }
     if (buildOnly) {
         const outputDir = preset === "vercel" ? vercelOutputDir : distDir;
@@ -292,7 +293,10 @@ function workspaceOAuthDiscoveryRoutes(app) {
         },
     ];
 }
-function writeNetlifyRedirects(distDir, apps, rootPage) {
+function workspaceOAuthCallbackApp(workspaceApps) {
+    return (workspaceApps.find((entry) => entry.isDispatch)?.id ?? workspaceApps[0]?.id);
+}
+function writeNetlifyRedirects(distDir, apps, workspaceApps, rootPage) {
     const lines = [
         "# Generated by agent-native deploy --preset netlify",
         "# Static app assets are stored under a safe namespace; dynamic app routes are handled by function route config.",
@@ -327,8 +331,14 @@ function writeNetlifyRedirects(distDir, apps, rootPage) {
         }
         lines.push("/apps/* /dispatch/apps/:splat 302");
     }
-    else if (rootPage !== "directory") {
-        lines.push(`/ /${apps[0]}/ 302`);
+    else {
+        const callbackApp = workspaceOAuthCallbackApp(workspaceApps);
+        if (callbackApp) {
+            lines.push(`${WORKSPACE_ROOT_GOOGLE_CALLBACK_PATH} /.netlify/functions/${callbackApp}-server 200`);
+        }
+        if (rootPage !== "directory") {
+            lines.push(`/ /${apps[0]}/ 302`);
+        }
     }
     fs.writeFileSync(path.join(distDir, "_redirects"), lines.join("\n") + "\n");
 }
@@ -350,7 +360,7 @@ function netlifyHeaderBlock(pathname) {
         ...Object.entries(IMMUTABLE_ASSET_CACHE_HEADERS).map(([name, value]) => `  ${name}: ${value}`),
     ].join("\n");
 }
-function writeVercelBuildConfig(outputDir, apps, rootPage) {
+function writeVercelBuildConfig(outputDir, apps, workspaceApps, rootPage) {
     const routes = [
         ...vercelImmutableAssetHeaderRoutes(outputDir, apps),
         { handle: "filesystem" },
@@ -379,8 +389,17 @@ function writeVercelBuildConfig(outputDir, apps, rootPage) {
         }
         routes.push(vercelRedirect("/apps/(.*)", "/dispatch/apps/$1"));
     }
-    else if (rootPage !== "directory") {
-        routes.push(vercelRedirect("/", `/${apps[0]}/`));
+    else {
+        const callbackApp = workspaceOAuthCallbackApp(workspaceApps);
+        if (callbackApp) {
+            routes.push({
+                src: vercelRouteSrc(WORKSPACE_ROOT_GOOGLE_CALLBACK_PATH),
+                dest: `/${callbackApp}-server`,
+            });
+        }
+        if (rootPage !== "directory") {
+            routes.push(vercelRedirect("/", `/${apps[0]}/`));
+        }
     }
     for (const app of apps) {
         if (app !== "dispatch") {
@@ -862,6 +881,10 @@ function patchNetlifyFunctionEntry(functionDir, app, workspaceApps, staticDir, w
     const basePath = `/${app}`;
     const workspaceAppAudience = workspaceAppAudienceForApp(workspaceApps, app);
     const workspaceAppRouteAccess = workspaceAppRouteAccessForApp(workspaceApps, app);
+    const callbackApp = workspaceOAuthCallbackApp(workspaceApps);
+    const rootGoogleCallbackPath = app === callbackApp && app !== "dispatch"
+        ? [WORKSPACE_ROOT_GOOGLE_CALLBACK_PATH]
+        : [];
     const pathConfig = app === "dispatch"
         ? [
             `${workspaceFrameworkRoutePrefix()}/*`,
@@ -876,6 +899,7 @@ function patchNetlifyFunctionEntry(functionDir, app, workspaceApps, staticDir, w
                 path,
                 ...(descendants ? [`${path}/*`] : []),
             ]),
+            ...rootGoogleCallbackPath,
         ];
     const normalizeBasePathHelper = app === "dispatch"
         ? ""

package/dist/file-upload/actions/upload-image.d.ts

@@ -44,9 +44,9 @@ declare const _default: import("../../action.js").ActionDefinition<{
     url: string;
     id: string;
     provider: string;
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
+    error?: undefined;
 } | {
     url?: undefined;
     id?: undefined;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,10 +75,9 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    message?: undefined;
     id?: undefined;
-    provider?: undefined;
     deleted?: undefined;
+    provider?: undefined;
     providers: {
         id: string;
         label: string;
@@ -92,8 +91,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     found?: undefined;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     id?: undefined;
     deleted?: undefined;
     count?: undefined;
@@ -102,18 +101,18 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
-    provider?: undefined;
+} | {
     deleted?: undefined;
+    provider?: undefined;
     count?: undefined;
     providers?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     provider?: undefined;
     count?: undefined;
     providers?: undefined;
@@ -122,9 +121,10 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     id: string;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
-    provider?: undefined;
     deleted?: undefined;
+    provider?: undefined;
     count?: undefined;
     providers?: undefined;
     found?: undefined;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,9 +311,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
+        provider?: undefined;
         id?: undefined;
         deleted?: undefined;
-        provider?: undefined;
         providers: {
             id: string;
             label: string;
@@ -339,8 +339,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        deleted?: undefined;
         provider?: undefined;
+        deleted?: undefined;
         providers?: undefined;
         count?: undefined;
         found: boolean;
@@ -359,8 +359,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        deleted?: undefined;
         provider?: undefined;
+        deleted?: undefined;
         providers?: undefined;
         count?: undefined;
         found?: undefined;

package/dist/server/auth-marketing.d.ts

@@ -5,14 +5,7 @@ export interface AuthMarketingContent {
     tagline: string;
     description?: string;
     features?: string[];
-    authHeadline?: string;
-    authDescription?: string;
-    screenshotPath?: string;
-    screenshotWidth?: number;
-    screenshotHeight?: number;
     learnMoreUrl?: string;
-    /** @deprecated Local execution is no longer offered from auth pages. */
-    runLocalCommand?: string;
     signupLocalModeNote?: {
         text: string;
         command: string;