feat(den): add email-first sign-in flow

[OmarMcAdam]

Summary

• Adds a public GET /v1/auth/login-options lookup for deterministic auth routing: SSO → Google → password → GitHub compatibility → new account.
• Changes the root Den Web auth screen to start with only email + Next, then render the resolved next step.
• Adds the approved voiceover and fraimz proof flow for the new sign-in experience.

Verification

• ✅ pnpm --filter @openwork-ee/den-api exec bun test test/auth-login-options.test.ts
• ✅ pnpm --filter @openwork-ee/den-api exec tsc -p tsconfig.json
• ✅ pnpm --filter @openwork-ee/den-web exec tsc -p tsconfig.json --noEmit
• ✅ git diff --check
• ✅ OPENWORK_EVAL_DEN_WEB_URL=http://localhost:3005 pnpm fraimz --flow new-signin-flow --cdp-url http://127.0.0.1:9223

Fraimz artifact: evals/results/2026-07-09T16-32-30-282Z/fraimz.html

Note: pnpm --filter @openwork-ee/den-api exec bun test test/route-guard-policy.test.ts currently fails on existing uncovered dev/MCP routes unrelated to this change; this PR adds the login-options public-route exception.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview, Comment	Jul 9, 2026 4:43pm
openwork-den	Ready	Preview, Comment	Jul 9, 2026 4:43pm
openwork-den-worker-proxy	Ready	Preview, Comment	Jul 9, 2026 4:43pm
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 9, 2026 4:43pm

[OmarMcAdam]

fraimz — ❌ FAILED

0 passed · 1 failed · 0 skipped — run 2026-07-09T16-43-11-452Z

Full frame proof with validated screenshots: evals/results/2026-07-09T16-43-11-452Z/fraimz.html (re-run: pnpm fraimz --flow new-signin-flow)

❌ new-signin-flow — Den Web resolves sign-in from email first

User-facing flow demo

1. ❌ The root auth page starts with only email and Next

   🎙 The sign-in screen starts simple: one email address field and one Next button.

   • ❌ Email-first start — Timed out after 30000ms waiting for: email-first auth panel

[OmarMcAdam]

fraimz — ✅ PASSED

1 passed · 0 failed · 0 skipped — run 2026-07-09T16-44-20-461Z

Full frame proof with validated screenshots: evals/results/2026-07-09T16-44-20-461Z/fraimz.html (re-run: pnpm fraimz --flow new-signin-flow)

✅ new-signin-flow — Den Web resolves sign-in from email first

User-facing flow demo

1. The root auth page starts with only email and Next

   🎙 The sign-in screen starts simple: one email address field and one Next button.

   • ✅ Visible text includes "Continue to OpenWork."
   • 📸 new-signin-flow-01-email-first-start.png — 9 validations passed
2. Next calls login-options for the entered email and renders the returned step

   🎙 After entering an email, OpenWork checks the backend and chooses the right next step.

   • 📸 new-signin-flow-02-backend-routes-to-step.png — 10 validations passed
3. An SSO-managed account only sees Sign in with SSO

   🎙 If the email belongs to an org with SSO, the next screen only shows Sign in with SSO.

   • 📸 new-signin-flow-03-sso-only-step.png — 9 validations passed
4. A Google account only sees Sign in with Google

   🎙 If the email uses Google, the next screen only shows Sign in with Google.

   • 📸 new-signin-flow-04-google-only-step.png — 9 validations passed
5. A password account sees the password field and Sign in

   🎙 If the email uses a password, the next screen shows the password field and sign-in button.

   • 📸 new-signin-flow-05-password-step.png — 10 validations passed
6. A new email sees the create-account form with name, Google, password, and Sign up

   🎙 If the email is new, the screen becomes Create an account with email, name, a separator, Sign up with Google, password, and Sign up.

   • 📸 new-signin-flow-06-new-account-step.png — 11 validations passed
   • ✅ Script frame 1 narrated: "The sign-in screen starts simple: one email address field and one Next button."
   • ✅ Script frame 2 narrated: "After entering an email, OpenWork checks the backend and chooses the right next step."
   • ✅ Script frame 3 narrated: "If the email belongs to an org with SSO, the next screen only shows Sign in with SSO"
   • ✅ Script frame 4 narrated: "If the email uses Google, the next screen only shows Sign in with Google."
   • ✅ Script frame 5 narrated: "If the email uses a password, the next screen shows the password field and sign-in butto"
   • ✅ Script frame 6 narrated: "If the email is new, the screen becomes Create an account with email, name, a separa"

(screenshot upload failed: BLOB_READ_WRITE_TOKEN is not set and could not be fetched from Infisical (infisical secrets get BLOB_READ_WRITE_TOKEN --plain --silent) — run infisical login once, or export it: export BLOB_READ_WRITE_TOKEN="$(infisical secrets get BLOB_READ_WRITE_TOKEN --plain --silent)" — images available in the run directory)