Route Flows sign-in into Cloud onboarding

AGENTS.md

@@ -42,7 +42,7 @@ These rules are repository law for every agent session in this checkout.
 ## Working discipline
 
 - For paired local Flows onboarding, Google sign-in, and dashboard tests, use
-  `npm run dev:flows` from the sibling `../cloud` repo root. Cloud owns the
+  `npm run dev:onboarding` from the sibling `../cloud` repo root. Cloud owns the
   paired launcher; read `../cloud/README.md`'s Local Setup section first. Do not start
   the two Next apps separately or use `dev:teams` for the Flows journey. Use
   the printed local URL exactly. Identify occupied ports and their owning

web/app/flows/FlowLandingAnalytics.tsx

@@ -18,7 +18,7 @@ export function FlowLandingAnalytics() {
       const link = (event.target as Element).closest?.('a[href]');
       if (!(link instanceof HTMLAnchorElement)) return;
       const url = new URL(link.href);
-      if (url.origin !== window.location.origin || url.pathname !== '/flows/onboarding') return;
+      if (!url.pathname.endsWith('/api/auth/google/start') || url.searchParams.get('source') !== 'flows') return;
       const placement = url.searchParams.get('utm_content');
       capture('flows_onboarding_entry_clicked', { placement: ['hero', 'nav', 'mobile_nav'].includes(placement ?? '') ? placement : 'other' });
     };

web/app/flows/page.tsx

@@ -13,6 +13,7 @@ import { SiteFooter } from '../../components/SiteFooter';
 import { SiteNav } from '../../components/SiteNav';
 import { FLOWS_OG_ALT, FLOWS_OG_IMAGE_PATH, ogImage } from '../../lib/og-meta';
 import { absoluteUrl, SITE_NAME } from '../../lib/site';
+import { flowsGoogleAuthHref } from '../../lib/flows-cloud';
 import home from '../landing.module.css';
 import s from './flows.module.css';
 import { FlowExamples } from './FlowExamples';
@@ -42,10 +43,6 @@ export const metadata: Metadata = {
   },
 };
 
-function flowsSignInHref(utmContent: string) {
-  return `/flows/onboarding?ref=flows&utm_source=agentrelay.com&utm_medium=flows_landing&utm_campaign=flows&utm_content=${utmContent}`;
-}
-
 function WaveBreak({ tone = 'blue' }: { tone?: 'blue' | 'orange' }) {
   return (
     <div className={`${s.waveBreak} ${tone === 'orange' ? s.waveBreakOrange : s.waveBreakBlue}`} aria-hidden="true">
@@ -61,12 +58,12 @@ function WaveBreak({ tone = 'blue' }: { tone?: 'blue' | 'orange' }) {
 
 export default function FlowsPage() {
   const navGetStartedLink = (
-    <a href={flowsSignInHref('nav')} className={`${home.ctaPrimary} ${home.homeNavAction}`}>
+    <a href={flowsGoogleAuthHref('nav')} className={`${home.ctaPrimary} ${home.homeNavAction}`}>
       Try Free with Cloud
     </a>
   );
   const mobileGetStartedLink = (
-    <a href={flowsSignInHref('mobile_nav')} className={`${home.ctaPrimary} ${home.homeNavAction}`}>
+    <a href={flowsGoogleAuthHref('mobile_nav')} className={`${home.ctaPrimary} ${home.homeNavAction}`}>
       Try Free with Cloud
     </a>
   );
@@ -90,7 +87,7 @@ export default function FlowsPage() {
               Predictable, auditable and dependable.
             </p>
             <div className={s.ctaRow}>
-              <a href={flowsSignInHref('hero')} className={s.ctaPrimary}>
+              <a href={flowsGoogleAuthHref('hero')} className={s.ctaPrimary}>
                 Try Free with Cloud
                 <ArrowRight aria-hidden="true" size={17} strokeWidth={2} />
               </a>

web/lib/flows-cloud.ts

@@ -0,0 +1,11 @@
+const DEFAULT_CLOUD_URL = '/cloud';
+
+export function flowsGoogleAuthHref(placement?: string) {
+  const cloudUrl = (process.env.NEXT_PUBLIC_CLOUD_URL || DEFAULT_CLOUD_URL).replace(/\/$/, '');
+  const params = new URLSearchParams({
+    source: 'flows',
+    next: '/flows/deploy',
+  });
+  if (placement) params.set('utm_content', placement);
+  return `${cloudUrl}/api/auth/google/start?${params.toString()}`;
+}

web/lib/test/flows-cloud.test.ts

@@ -0,0 +1,25 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { flowsGoogleAuthHref } from '../flows-cloud';
+
+describe('flowsGoogleAuthHref', () => {
+  const originalCloudUrl = process.env.NEXT_PUBLIC_CLOUD_URL;
+
+  afterEach(() => {
+    if (originalCloudUrl === undefined) delete process.env.NEXT_PUBLIC_CLOUD_URL;
+    else process.env.NEXT_PUBLIC_CLOUD_URL = originalCloudUrl;
+  });
+
+  it('starts Google auth directly with the trusted Flows destination', () => {
+    delete process.env.NEXT_PUBLIC_CLOUD_URL;
+    expect(flowsGoogleAuthHref('hero')).toBe(
+      '/cloud/api/auth/google/start?source=flows&next=%2Fflows%2Fdeploy&utm_content=hero',
+    );
+  });
+
+  it('uses the configured Cloud origin without a duplicate slash', () => {
+    process.env.NEXT_PUBLIC_CLOUD_URL = 'https://cloud.example.test/cloud/';
+    expect(flowsGoogleAuthHref()).toBe(
+      'https://cloud.example.test/cloud/api/auth/google/start?source=flows&next=%2Fflows%2Fdeploy',
+    );
+  });
+});