@agent-native/core 0.130.1 → 0.131.2

package/dist/server/attribution.d.ts

@@ -54,6 +54,12 @@ export declare function decodeFirstTouchValue(value: string | null | undefined):
  * Returns `null` when the cookie is absent or unparseable. Never throws.
  */
 export declare function readFirstTouchAttribution(cookieHeader: string | null | undefined): FirstTouchAttribution | null;
+/**
+ * Read the browser identity handoff used to link anonymous pageviews to the
+ * signup event. This is analytics-only and intentionally does not authorize
+ * or identify a user.
+ */
+export declare function readAnalyticsAnonymousId(cookieHeader: string | null | undefined): string | undefined;
 /**
  * Derive the `referral_source` bucket from first-touch attribution per the
  * contract:

package/dist/server/attribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/server/attribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAe/C;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,qBAAqB,GAAG,IAAI,CA8B9B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,qBAAqB,GAAG,IAAI,CAO9B;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,qBAAqB,GAAG,IAAI,GAAG,MAAM,CAe7E;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,qBAAqB,GAAG,IAAI,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBxB;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB"}
+{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/server/attribution.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;GAaG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAe/C;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,qBAAqB,GAAG,IAAI,CA8B9B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,qBAAqB,GAAG,IAAI,CAO9B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,GAAG,SAAS,CAQpB;AAOD;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,qBAAqB,GAAG,IAAI,GAAG,MAAM,CAe7E;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,qBAAqB,GAAG,IAAI,GAC/B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBxB;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB"}

package/dist/server/attribution.js

@@ -1,17 +1,4 @@
-/**
- * First-touch referral attribution — server side.
- *
- * The browser captures an anonymous visitor's *first* landing context (referral
- * source, UTM params, referring host, landing path) and persists it across the
- * signup boundary in a first-party cookie named `an_ft` (see
- * `client/analytics.ts`). On signup, the auth hook reads that cookie off the
- * request and enriches the canonical server-side `signup` event so we can
- * measure where new users came from and how apps spread (virality).
- *
- * This module is intentionally pure and dependency-free so it is trivially
- * unit-testable and can never throw into the signup path. The single hard rule:
- * parsing untrusted cookie input must NEVER throw — every accessor is defensive.
- */
+import { ANALYTICS_ANONYMOUS_ID_COOKIE_NAME, normalizeAnalyticsAnonymousId, } from "../shared/analytics-anonymous-id.js";
 /** Cookie name written by the client (non-HttpOnly; non-sensitive). */
 export const FIRST_TOUCH_COOKIE_NAME = "an_ft";
 const STRING_FIELDS = [
@@ -102,6 +89,19 @@ export function readFirstTouchAttribution(cookieHeader) {
         return null;
     }
 }
+/**
+ * Read the browser identity handoff used to link anonymous pageviews to the
+ * signup event. This is analytics-only and intentionally does not authorize
+ * or identify a user.
+ */
+export function readAnalyticsAnonymousId(cookieHeader) {
+    try {
+        return normalizeAnalyticsAnonymousId(parseCookieHeader(cookieHeader)[ANALYTICS_ANONYMOUS_ID_COOKIE_NAME]);
+    }
+    catch {
+        return undefined;
+    }
+}
 function isExternalReferrerHost(host) {
     const trimmed = host?.trim();
     return !!trimmed && trimmed.length > 0;

package/dist/server/attribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"attribution.js","sourceRoot":"","sources":["../../src/server/attribution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA0BH,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAE/C,MAAM,aAAa,GAAuC;IACxD,KAAK;IACL,KAAK;IACL,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,aAAa;IACb,UAAU;IACV,cAAc;IACd,kBAAkB;IAClB,WAAW;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAuC;IAEvC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,uEAAuE;QACvE,IAAI,IAAI,IAAI,GAAG;YAAE,SAAS;QAC1B,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAgC;IAEhC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,0CAA0C;QAC1C,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAClC,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAAuC;IAEvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,qBAAqB,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAwB;IACtD,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7B,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAgC;IACnE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,EAAE,EAAE,YAAY,IAAI,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IACpD,IACE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAC7B,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,sBAAsB,CAAC,EAAE,EAAE,gBAAgB,CAAC;QAAE,OAAO,UAAU,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAgC;IAEhC,MAAM,GAAG,GAA2B;QAClC,eAAe,EAAE,oBAAoB,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,KAAyB,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IAClC,CAAC,CAAC;IAEF,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACxC,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IAC5C,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACnC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACnC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IACvC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;IACrC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IAC3C,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAE/C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,YAAuC;IAEvC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["/**\n * First-touch referral attribution — server side.\n *\n * The browser captures an anonymous visitor's *first* landing context (referral\n * source, UTM params, referring host, landing path) and persists it across the\n * signup boundary in a first-party cookie named `an_ft` (see\n * `client/analytics.ts`). On signup, the auth hook reads that cookie off the\n * request and enriches the canonical server-side `signup` event so we can\n * measure where new users came from and how apps spread (virality).\n *\n * This module is intentionally pure and dependency-free so it is trivially\n * unit-testable and can never throw into the signup path. The single hard rule:\n * parsing untrusted cookie input must NEVER throw — every accessor is defensive.\n */\n\n/**\n * The decoded first-touch attribution object. Mirrors the compact JSON the\n * client writes into the `an_ft` cookie / `an_attribution` localStorage key.\n * Every field is optional — the client omits empty fields to keep the cookie\n * small, and a malformed/absent cookie yields `null`.\n */\nexport interface FirstTouchAttribution {\n  /** Referral source bucket, e.g. \"clip_share\", \"plan_share\". */\n  ref?: string;\n  /** Referrer's stable user id (the clip/plan owner who shared the link). */\n  via?: string;\n  utm_source?: string;\n  utm_medium?: string;\n  utm_campaign?: string;\n  utm_content?: string;\n  utm_term?: string;\n  /** `window.location.pathname` of the first page the visitor landed on. */\n  landing_path?: string;\n  /** Host of `document.referrer` (scrubbed; host only, never a full URL). */\n  landing_referrer?: string;\n  /** ISO timestamp of when the visitor first landed. */\n  landed_at?: string;\n}\n\n/** Cookie name written by the client (non-HttpOnly; non-sensitive). */\nexport const FIRST_TOUCH_COOKIE_NAME = \"an_ft\";\n\nconst STRING_FIELDS: Array<keyof FirstTouchAttribution> = [\n  \"ref\",\n  \"via\",\n  \"utm_source\",\n  \"utm_medium\",\n  \"utm_campaign\",\n  \"utm_content\",\n  \"utm_term\",\n  \"landing_path\",\n  \"landing_referrer\",\n  \"landed_at\",\n];\n\n/**\n * Parse a raw `Cookie:` header into a flat name→value map. Tolerates missing\n * input, extra whitespace, `=` inside values, and malformed pairs. Never throws.\n */\nexport function parseCookieHeader(\n  cookieHeader: string | null | undefined,\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!cookieHeader || typeof cookieHeader !== \"string\") return out;\n  for (const part of cookieHeader.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    const name = part.slice(0, eq).trim();\n    if (!name) continue;\n    const rawValue = part.slice(eq + 1).trim();\n    // First write wins so a duplicate cookie name can't clobber the first.\n    if (name in out) continue;\n    out[name] = rawValue;\n  }\n  return out;\n}\n\n/**\n * Decode a single cookie value into a `FirstTouchAttribution`. The value is the\n * URL-encoded compact JSON written by the client. Returns `null` for empty,\n * malformed, or non-object input. Only known string fields are copied through,\n * each clamped to a sane max length as a defense against an oversized cookie.\n */\nexport function decodeFirstTouchValue(\n  value: string | null | undefined,\n): FirstTouchAttribution | null {\n  if (!value || typeof value !== \"string\") return null;\n  let decoded = value;\n  try {\n    decoded = decodeURIComponent(value);\n  } catch {\n    // Not valid percent-encoding — fall back to the raw value and let the JSON\n    // parse below decide whether it's usable.\n    decoded = value;\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(decoded);\n  } catch {\n    return null;\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return null;\n  }\n  const source = parsed as Record<string, unknown>;\n  const result: FirstTouchAttribution = {};\n  let any = false;\n  for (const field of STRING_FIELDS) {\n    const raw = source[field];\n    if (typeof raw === \"string\" && raw.length > 0) {\n      result[field] = raw.slice(0, 120);\n      any = true;\n    }\n  }\n  return any ? result : null;\n}\n\n/**\n * Read the `an_ft` first-touch attribution out of a raw `Cookie:` header.\n * Returns `null` when the cookie is absent or unparseable. Never throws.\n */\nexport function readFirstTouchAttribution(\n  cookieHeader: string | null | undefined,\n): FirstTouchAttribution | null {\n  try {\n    const cookies = parseCookieHeader(cookieHeader);\n    return decodeFirstTouchValue(cookies[FIRST_TOUCH_COOKIE_NAME]);\n  } catch {\n    return null;\n  }\n}\n\nfunction isExternalReferrerHost(host: string | undefined): boolean {\n  const trimmed = host?.trim();\n  return !!trimmed && trimmed.length > 0;\n}\n\n/**\n * Derive the `referral_source` bucket from first-touch attribution per the\n * contract:\n *   1. explicit `ref` wins;\n *   2. landing path under `/share/` => \"clip_share\";\n *   3. landing path that looks like a public plan page\n *      (`/p/`, `/plan/`, `/plans/`, `/recaps/`, or `/share-plan/`) =>\n *      \"plan_share\";\n *   4. a non-empty external referring host => \"external\";\n *   5. otherwise => \"direct\".\n */\nexport function deriveReferralSource(ft: FirstTouchAttribution | null): string {\n  if (ft?.ref && ft.ref.trim()) return ft.ref.trim();\n  const path = ft?.landing_path ?? \"\";\n  if (path.startsWith(\"/share/\")) return \"clip_share\";\n  if (\n    path.includes(\"/p/\") ||\n    path.includes(\"/plan/\") ||\n    path.includes(\"/plans/\") ||\n    path.includes(\"/recaps/\") ||\n    path.includes(\"/share-plan/\")\n  ) {\n    return \"plan_share\";\n  }\n  if (isExternalReferrerHost(ft?.landing_referrer)) return \"external\";\n  return \"direct\";\n}\n\n/**\n * Compute the snake_case signup-event properties from first-touch attribution.\n * Returns a clean object with `undefined` values omitted, ready to merge into\n * the `signup` track call. Always sets `referral_source` (defaults to \"direct\").\n *\n * Pure and total — given any (or no) input it returns a well-formed object and\n * never throws.\n */\nexport function deriveSignupAttribution(\n  ft: FirstTouchAttribution | null,\n): Record<string, string> {\n  const out: Record<string, string> = {\n    referral_source: deriveReferralSource(ft),\n  };\n  if (!ft) return out;\n\n  const setIf = (key: string, value: string | undefined) => {\n    const trimmed = value?.trim();\n    if (trimmed) out[key] = trimmed;\n  };\n\n  setIf(\"referrer_user\", ft.via);\n  setIf(\"referral_medium\", ft.utm_medium);\n  setIf(\"referral_campaign\", ft.utm_campaign);\n  setIf(\"utm_source\", ft.utm_source);\n  setIf(\"utm_medium\", ft.utm_medium);\n  setIf(\"utm_campaign\", ft.utm_campaign);\n  setIf(\"utm_content\", ft.utm_content);\n  setIf(\"utm_term\", ft.utm_term);\n  setIf(\"first_touch_path\", ft.landing_path);\n  setIf(\"landing_referrer\", ft.landing_referrer);\n\n  return out;\n}\n\n/**\n * Convenience: read the cookie header and derive signup attribution in one\n * call. Never throws; falls back to `{ referral_source: \"direct\" }` on any\n * error.\n */\nexport function signupAttributionFromCookieHeader(\n  cookieHeader: string | null | undefined,\n): Record<string, string> {\n  try {\n    return deriveSignupAttribution(readFirstTouchAttribution(cookieHeader));\n  } catch {\n    return { referral_source: \"direct\" };\n  }\n}\n"]}
+{"version":3,"file":"attribution.js","sourceRoot":"","sources":["../../src/server/attribution.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,EAClC,6BAA6B,GAC9B,MAAM,qCAAqC,CAAC;AAyC7C,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAE/C,MAAM,aAAa,GAAuC;IACxD,KAAK;IACL,KAAK;IACL,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,aAAa;IACb,UAAU;IACV,cAAc;IACd,kBAAkB;IAClB,WAAW;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,YAAuC;IAEvC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAClE,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,uEAAuE;QACvE,IAAI,IAAI,IAAI,GAAG;YAAE,SAAS;QAC1B,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAgC;IAEhC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,0CAA0C;QAC1C,OAAO,GAAG,KAAK,CAAC;IAClB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,MAAM,GAA0B,EAAE,CAAC;IACzC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAClC,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAAuC;IAEvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAChD,OAAO,qBAAqB,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAuC;IAEvC,IAAI,CAAC;QACH,OAAO,6BAA6B,CAClC,iBAAiB,CAAC,YAAY,CAAC,CAAC,kCAAkC,CAAC,CACpE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAwB;IACtD,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7B,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,EAAgC;IACnE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,IAAI,GAAG,EAAE,EAAE,YAAY,IAAI,EAAE,CAAC;IACpC,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,YAAY,CAAC;IACpD,IACE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAC7B,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,sBAAsB,CAAC,EAAE,EAAE,gBAAgB,CAAC;QAAE,OAAO,UAAU,CAAC;IACpE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAgC;IAEhC,MAAM,GAAG,GAA2B;QAClC,eAAe,EAAE,oBAAoB,CAAC,EAAE,CAAC;KAC1C,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,KAAyB,EAAE,EAAE;QACvD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;IAClC,CAAC,CAAC;IAEF,KAAK,CAAC,eAAe,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;IAC/B,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACxC,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IAC5C,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACnC,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC;IACnC,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IACvC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC;IACrC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IAC3C,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC;IAE/C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,YAAuC;IAEvC,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC;IACvC,CAAC;AACH,CAAC","sourcesContent":["import {\n  ANALYTICS_ANONYMOUS_ID_COOKIE_NAME,\n  normalizeAnalyticsAnonymousId,\n} from \"../shared/analytics-anonymous-id.js\";\n\n/**\n * First-touch referral attribution — server side.\n *\n * The browser captures an anonymous visitor's *first* landing context (referral\n * source, UTM params, referring host, landing path) and persists it across the\n * signup boundary in a first-party cookie named `an_ft` (see\n * `client/analytics.ts`). On signup, the auth hook reads that cookie off the\n * request and enriches the canonical server-side `signup` event so we can\n * measure where new users came from and how apps spread (virality).\n *\n * This module is intentionally pure and dependency-free so it is trivially\n * unit-testable and can never throw into the signup path. The single hard rule:\n * parsing untrusted cookie input must NEVER throw — every accessor is defensive.\n */\n\n/**\n * The decoded first-touch attribution object. Mirrors the compact JSON the\n * client writes into the `an_ft` cookie / `an_attribution` localStorage key.\n * Every field is optional — the client omits empty fields to keep the cookie\n * small, and a malformed/absent cookie yields `null`.\n */\nexport interface FirstTouchAttribution {\n  /** Referral source bucket, e.g. \"clip_share\", \"plan_share\". */\n  ref?: string;\n  /** Referrer's stable user id (the clip/plan owner who shared the link). */\n  via?: string;\n  utm_source?: string;\n  utm_medium?: string;\n  utm_campaign?: string;\n  utm_content?: string;\n  utm_term?: string;\n  /** `window.location.pathname` of the first page the visitor landed on. */\n  landing_path?: string;\n  /** Host of `document.referrer` (scrubbed; host only, never a full URL). */\n  landing_referrer?: string;\n  /** ISO timestamp of when the visitor first landed. */\n  landed_at?: string;\n}\n\n/** Cookie name written by the client (non-HttpOnly; non-sensitive). */\nexport const FIRST_TOUCH_COOKIE_NAME = \"an_ft\";\n\nconst STRING_FIELDS: Array<keyof FirstTouchAttribution> = [\n  \"ref\",\n  \"via\",\n  \"utm_source\",\n  \"utm_medium\",\n  \"utm_campaign\",\n  \"utm_content\",\n  \"utm_term\",\n  \"landing_path\",\n  \"landing_referrer\",\n  \"landed_at\",\n];\n\n/**\n * Parse a raw `Cookie:` header into a flat name→value map. Tolerates missing\n * input, extra whitespace, `=` inside values, and malformed pairs. Never throws.\n */\nexport function parseCookieHeader(\n  cookieHeader: string | null | undefined,\n): Record<string, string> {\n  const out: Record<string, string> = {};\n  if (!cookieHeader || typeof cookieHeader !== \"string\") return out;\n  for (const part of cookieHeader.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    const name = part.slice(0, eq).trim();\n    if (!name) continue;\n    const rawValue = part.slice(eq + 1).trim();\n    // First write wins so a duplicate cookie name can't clobber the first.\n    if (name in out) continue;\n    out[name] = rawValue;\n  }\n  return out;\n}\n\n/**\n * Decode a single cookie value into a `FirstTouchAttribution`. The value is the\n * URL-encoded compact JSON written by the client. Returns `null` for empty,\n * malformed, or non-object input. Only known string fields are copied through,\n * each clamped to a sane max length as a defense against an oversized cookie.\n */\nexport function decodeFirstTouchValue(\n  value: string | null | undefined,\n): FirstTouchAttribution | null {\n  if (!value || typeof value !== \"string\") return null;\n  let decoded = value;\n  try {\n    decoded = decodeURIComponent(value);\n  } catch {\n    // Not valid percent-encoding — fall back to the raw value and let the JSON\n    // parse below decide whether it's usable.\n    decoded = value;\n  }\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(decoded);\n  } catch {\n    return null;\n  }\n  if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n    return null;\n  }\n  const source = parsed as Record<string, unknown>;\n  const result: FirstTouchAttribution = {};\n  let any = false;\n  for (const field of STRING_FIELDS) {\n    const raw = source[field];\n    if (typeof raw === \"string\" && raw.length > 0) {\n      result[field] = raw.slice(0, 120);\n      any = true;\n    }\n  }\n  return any ? result : null;\n}\n\n/**\n * Read the `an_ft` first-touch attribution out of a raw `Cookie:` header.\n * Returns `null` when the cookie is absent or unparseable. Never throws.\n */\nexport function readFirstTouchAttribution(\n  cookieHeader: string | null | undefined,\n): FirstTouchAttribution | null {\n  try {\n    const cookies = parseCookieHeader(cookieHeader);\n    return decodeFirstTouchValue(cookies[FIRST_TOUCH_COOKIE_NAME]);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Read the browser identity handoff used to link anonymous pageviews to the\n * signup event. This is analytics-only and intentionally does not authorize\n * or identify a user.\n */\nexport function readAnalyticsAnonymousId(\n  cookieHeader: string | null | undefined,\n): string | undefined {\n  try {\n    return normalizeAnalyticsAnonymousId(\n      parseCookieHeader(cookieHeader)[ANALYTICS_ANONYMOUS_ID_COOKIE_NAME],\n    );\n  } catch {\n    return undefined;\n  }\n}\n\nfunction isExternalReferrerHost(host: string | undefined): boolean {\n  const trimmed = host?.trim();\n  return !!trimmed && trimmed.length > 0;\n}\n\n/**\n * Derive the `referral_source` bucket from first-touch attribution per the\n * contract:\n *   1. explicit `ref` wins;\n *   2. landing path under `/share/` => \"clip_share\";\n *   3. landing path that looks like a public plan page\n *      (`/p/`, `/plan/`, `/plans/`, `/recaps/`, or `/share-plan/`) =>\n *      \"plan_share\";\n *   4. a non-empty external referring host => \"external\";\n *   5. otherwise => \"direct\".\n */\nexport function deriveReferralSource(ft: FirstTouchAttribution | null): string {\n  if (ft?.ref && ft.ref.trim()) return ft.ref.trim();\n  const path = ft?.landing_path ?? \"\";\n  if (path.startsWith(\"/share/\")) return \"clip_share\";\n  if (\n    path.includes(\"/p/\") ||\n    path.includes(\"/plan/\") ||\n    path.includes(\"/plans/\") ||\n    path.includes(\"/recaps/\") ||\n    path.includes(\"/share-plan/\")\n  ) {\n    return \"plan_share\";\n  }\n  if (isExternalReferrerHost(ft?.landing_referrer)) return \"external\";\n  return \"direct\";\n}\n\n/**\n * Compute the snake_case signup-event properties from first-touch attribution.\n * Returns a clean object with `undefined` values omitted, ready to merge into\n * the `signup` track call. Always sets `referral_source` (defaults to \"direct\").\n *\n * Pure and total — given any (or no) input it returns a well-formed object and\n * never throws.\n */\nexport function deriveSignupAttribution(\n  ft: FirstTouchAttribution | null,\n): Record<string, string> {\n  const out: Record<string, string> = {\n    referral_source: deriveReferralSource(ft),\n  };\n  if (!ft) return out;\n\n  const setIf = (key: string, value: string | undefined) => {\n    const trimmed = value?.trim();\n    if (trimmed) out[key] = trimmed;\n  };\n\n  setIf(\"referrer_user\", ft.via);\n  setIf(\"referral_medium\", ft.utm_medium);\n  setIf(\"referral_campaign\", ft.utm_campaign);\n  setIf(\"utm_source\", ft.utm_source);\n  setIf(\"utm_medium\", ft.utm_medium);\n  setIf(\"utm_campaign\", ft.utm_campaign);\n  setIf(\"utm_content\", ft.utm_content);\n  setIf(\"utm_term\", ft.utm_term);\n  setIf(\"first_touch_path\", ft.landing_path);\n  setIf(\"landing_referrer\", ft.landing_referrer);\n\n  return out;\n}\n\n/**\n * Convenience: read the cookie header and derive signup attribution in one\n * call. Never throws; falls back to `{ referral_source: \"direct\" }` on any\n * error.\n */\nexport function signupAttributionFromCookieHeader(\n  cookieHeader: string | null | undefined,\n): Record<string, string> {\n  try {\n    return deriveSignupAttribution(readFirstTouchAttribution(cookieHeader));\n  } catch {\n    return { referral_source: \"direct\" };\n  }\n}\n"]}

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAelC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAsChE,KAAK,KAAK,GAAG,SAAS,CAAC;AAiCvB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAK7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAqBlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAoB5D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mNAAmN;IACnN,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC/D;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAoCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAEpD;AAED,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,yBAAyB,QACQ,CAAC;AAG/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AAmCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAExE;AAgCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIjE;AAkGD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAErE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQzD;AA4TD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AA8ED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AAkHD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAqBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAiKD,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,EACd,CAAC,EAAE,MAAM,GACR,OAAO,CAoDT;AAusBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAY5E;AA4ID,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAS7E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,SAAM,GACX,QAAQ,CAOV;AA0nCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAsKlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAMzE"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAelC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAsChE,KAAK,KAAK,GAAG,SAAS,CAAC;AAiCvB,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAQ7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAqBlE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAoB5D,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAMD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mNAAmN;IACnN,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF;;;OAGG;IACH,kBAAkB,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IAC/D;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;OAEG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AAoCD;;;;GAIG;AACH,wBAAgB,eAAe,IAAI,MAAM,GAAG,SAAS,CAEpD;AAED,eAAO,MAAM,WAAW,QAA4C,CAAC;AACrE,eAAO,MAAM,yBAAyB,QACQ,CAAC;AAG/C;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAGvD;AAmCD,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAExE;AAgCD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIjE;AAkGD;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAG1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAErE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CASpE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQzD;AA4TD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAI7D;AA8ED;;;GAGG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAW7E;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED,uDAAuD;AACvD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAShE;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmB3E;AAkHD,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAqBD,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,QAWd;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,2BAA2B,QAOnC;AAmGD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,CAG5C;AAiKD,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,EACd,CAAC,EAAE,MAAM,GACR,OAAO,CAoDT;AAusBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAY5E;AA4ID,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAS7E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,SAAM,GACX,QAAQ,CAOV;AAqoCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,GAAG,EAAE,KAAK,EACV,OAAO,GAAE,WAAgB,GACxB,OAAO,CAAC,OAAO,CAAC,CAsKlB;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,CAMzE"}

package/dist/server/auth.js

@@ -51,7 +51,7 @@ import { AGENT_NATIVE_SOCIAL_IMAGE_ALT, AGENT_NATIVE_SOCIAL_IMAGE_HEIGHT, AGENT_
 import { normalizeWorkspaceAppAudience, workspaceAppAudienceFromEnv, workspaceAppRouteAccessFromEnv, } from "../shared/workspace-app-audience.js";
 import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
 import { injectAnalyticsIntoHtml } from "./analytics.js";
-import { signupAttributionFromCookieHeader } from "./attribution.js";
+import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getBetterAuth, getBetterAuthSync } from "./better-auth-instance.js";
 import { BUILDER_CONNECT_OWNER_COOKIE, BUILDER_CONNECT_PARAM, BUILDER_RELAY_PATH, BUILDER_RELAY_STATE_PARAM, BUILDER_STATE_PARAM, verifyBuilderCallbackStateAndGetOwner, verifyBuilderConnectTokenAndGetOwner, verifyBuilderPreviewRelayStateForCallback, } from "./builder-browser.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
@@ -2137,6 +2137,7 @@ async function mountBetterAuthRoutes(app, options) {
                 : "/";
             const returnUrl = validated !== "/" ? validated : undefined;
             const signupAttribution = signupAttributionFromCookieHeader(getHeader(event, "cookie") ?? null);
+            const signupAnonymousId = readAnalyticsAnonymousId(getHeader(event, "cookie") ?? null);
             const state = encodeOAuthState({
                 redirectUri,
                 desktop,
@@ -2145,6 +2146,7 @@ async function mountBetterAuthRoutes(app, options) {
                 returnUrl,
                 flowId,
                 signupAttribution,
+                signupAnonymousId,
             });
             logGoogleOAuthDebug(event, "auth-url", {
                 flowId,
@@ -2196,7 +2198,7 @@ async function mountBetterAuthRoutes(app, options) {
             try {
                 const query = getQuery(event);
                 const code = query.code;
-                const { redirectUri, desktop, returnUrl, flowId, signupAttribution } = decodeOAuthState(query.state, getAppUrl(event, "/_agent-native/google/callback"));
+                const { redirectUri, desktop, returnUrl, flowId, signupAttribution, signupAnonymousId, } = decodeOAuthState(query.state, getAppUrl(event, "/_agent-native/google/callback"));
                 callbackFlowId = flowId;
                 callbackDesktop = desktop ?? false;
                 logGoogleOAuthDebug(event, "callback-start", {
@@ -2301,6 +2303,7 @@ async function mountBetterAuthRoutes(app, options) {
                         authUserId: typeof user.id === "string" ? user.id : undefined,
                         name: typeof user.name === "string" ? user.name : undefined,
                         attribution: signupAttribution,
+                        signupAnonymousId,
                     },
                 });
                 logGoogleOAuthDebug(event, "callback-session-created", {