@agent-native/core 0.152.1 → 0.153.1

package/dist/localization/default-messages.js

@@ -315,7 +315,7 @@ const messages = {
             appBuildingPrefix: "This app is being created. It will be available at",
             appBuildingSuffix: "after its branch is merged and the workspace deploy finishes.",
             branch: "Branch: {{branch}}",
-            openBuilderBranch: "Open Builder branch",
+            openBuilderBranch: "Open in Builder",
             openingApp: "Opening {{name}}",
             redirectingTo: "Redirecting to",
             openApp: "Open app",
@@ -704,6 +704,8 @@ const messages = {
         publicDescription: "Anyone signed in with the link can view",
         viewer: "Viewer",
         viewerDescription: "Can view",
+        commenter: "Commenter",
+        commenterDescription: "Can view and add comments",
         editor: "Editor",
         editorDescription: "Can edit",
         admin: "Admin",
@@ -889,6 +891,31 @@ const messages = {
         nextMemberPage: "Go to next member page",
         memberPageStatus: "Page {{page}} of {{totalPages}}",
         youAreRole: "You are {{role}}",
+        editGroup: "Edit group",
+        createGroup: "Create group",
+        groupName: "Group name",
+        groupMembers: "People",
+        searchPeople: "Search people",
+        loadingPeople: "Loading people…",
+        noPeopleFound: "No people found",
+        loadMorePeople: "Load more",
+        saveGroup: "Save group",
+        groups: "Groups",
+        newGroup: "New group",
+        editGroupAria: "Edit group {{name}}",
+        deleteGroupAria: "Delete group {{name}}",
+        deleteGroup: "Delete group?",
+        deleteGroupConfirm: "Type {{name}} to confirm.",
+        deleting: "Deleting…",
+        delete: "Delete",
+        noGroups: "No groups yet",
+        selectPage: "Select page",
+        selectedMembers: "Selected members ({{count}})",
+        selectMembers: "Select members",
+        addToGroup: "Add to group",
+        removeFromGroup: "Remove from group",
+        clearSelection: "Clear",
+        createGroupForBulk: "Create group",
         changeRole: "Change role",
         removeMember: "Remove member",
         cancel: "Cancel",

package/dist/notifications/routes.d.ts

@@ -13,21 +13,21 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
+    count?: undefined;
     updated: number;
-    ok?: undefined;
     error?: undefined;
-    count?: undefined;
+    ok?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error: string;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
-    count?: undefined;
+    ok: boolean;
 }>>;

package/dist/onboarding/plugin.js

@@ -11,10 +11,11 @@
  */
 import { deleteCookie, defineEventHandler, getCookie, getMethod, getQuery, setResponseStatus, } from "h3";
 import { appStateGet, appStatePut } from "../application-state/store.js";
+import { getOrgContext } from "../org/context.js";
 import { getSession } from "../server/auth.js";
 import { awaitBootstrap, getH3App, markDefaultPluginProvided, } from "../server/framework-request-handler.js";
 import { runWithRequestContext } from "../server/request-context.js";
-import { FIRST_RUN_ONBOARDING_COMPLETED_KEY, FIRST_RUN_ONBOARDING_COOKIE, } from "../shared/first-run-onboarding.js";
+import { FIRST_RUN_ONBOARDING_COMPLETED_KEY, FIRST_RUN_ONBOARDING_COOKIE, FIRST_RUN_ONBOARDING_ELIGIBLE_KEY, } from "../shared/first-run-onboarding.js";
 import { getOnboardingAppProfile } from "./app-profile.js";
 import { registerDefaultOnboardingSteps } from "./default-steps.js";
 import { listOnboardingSteps } from "./registry.js";
@@ -205,8 +206,22 @@ export function createOnboardingPlugin(options = {}) {
                 return { firstRun: false };
             return withOnboardingRequestContext(context, async () => {
                 const completed = await appStateGet(context.sessionId, FIRST_RUN_ONBOARDING_COMPLETED_KEY);
+                if (completed?.completed === true) {
+                    deleteCookie(event, FIRST_RUN_ONBOARDING_COOKIE, { path: "/" });
+                    return { firstRun: false };
+                }
+                // Signup alone is not enough to qualify. Resolve the real org path
+                // first so invite/domain members cannot race this check before their
+                // existing membership is visible, while a true first user causes the
+                // default org to be created and marked eligible.
+                const orgContext = await getOrgContext(event);
+                const eligible = await appStateGet(context.sessionId, FIRST_RUN_ONBOARDING_ELIGIBLE_KEY);
+                const firstRun = orgContext.orgId !== null && eligible?.orgId === orgContext.orgId;
+                if (!firstRun) {
+                    deleteCookie(event, FIRST_RUN_ONBOARDING_COOKIE, { path: "/" });
+                }
                 return {
-                    firstRun: completed?.completed !== true,
+                    firstRun,
                 };
             });
         }));

package/dist/org/context.js

@@ -1,8 +1,10 @@
 import { warnAgent } from "../agent/action-warnings.js";
+import { appStatePut } from "../application-state/store.js";
 import { getDbExec, isTransientDatabaseError } from "../db/client.js";
 import { getSession } from "../server/auth.js";
 import { getSetting } from "../settings/store.js";
 import { getUserSetting } from "../settings/user-settings.js";
+import { FIRST_RUN_ONBOARDING_ELIGIBLE_KEY } from "../shared/first-run-onboarding.js";
 import { setActiveOrgId } from "./active-org.js";
 import { autoJoinDomainMatchingOrgs } from "./auto-join-domain.js";
 import { isFreeEmailProvider } from "./free-email-providers.js";
@@ -569,6 +571,20 @@ async function tryCreateDefaultOrg(exec, email, session) {
         });
         invalidateMemberOrgCaches();
         await setActiveOrgId(email, orgId, "auto-created default organization");
+        try {
+            await appStatePut(email, FIRST_RUN_ONBOARDING_ELIGIBLE_KEY, { orgId, at: new Date(now).toISOString() }, { requestSource: "org-auto-create" });
+        }
+        catch (error) {
+            // The safe failure mode is to omit first-run onboarding. The org itself
+            // already exists, so do not turn a marker-write failure into a false
+            // zero-membership result or retry that creates another org.
+            warnAgent({
+                severity: "advisory",
+                code: "first-run-onboarding-eligibility-unreadable",
+                message: `Auto-created organization ${orgId} for ${email}, but could not persist ` +
+                    `the first-run onboarding eligibility marker: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        }
         return { email, orgId, orgName, role: "owner" };
     }
     catch {

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -77,7 +77,7 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
 }, z.core.$strip>>, {
     id?: undefined;
     deleted?: undefined;
-    message?: undefined;
+    provider?: undefined;
     providers: {
         id: string;
         label: string;
@@ -88,45 +88,45 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         updatedAt: number;
     }[];
     count: number;
-    provider?: undefined;
     found?: undefined;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
-    count?: undefined;
     id?: undefined;
     deleted?: undefined;
-    message?: undefined;
     providers?: undefined;
+    count?: undefined;
     found: boolean;
     provider: import("../custom-registry.js").CustomProviderConfig;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
-    count?: undefined;
     deleted?: undefined;
-    message?: undefined;
-    providers?: undefined;
     provider?: undefined;
+    providers?: undefined;
+    count?: undefined;
     found: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
-} | {
-    count?: undefined;
     message?: undefined;
-    providers?: undefined;
+} | {
     provider?: undefined;
+    providers?: undefined;
+    count?: undefined;
     found?: undefined;
     deleted: boolean;
     id: string;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
-    count?: undefined;
     deleted?: undefined;
-    providers?: undefined;
     provider?: undefined;
+    providers?: undefined;
+    count?: undefined;
     found?: undefined;
     registered: boolean;
     id: string;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,8 +311,8 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
+        message?: undefined;
         id?: undefined;
-        provider?: undefined;
         deleted?: undefined;
         providers: {
             id: string;
@@ -324,11 +324,12 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
             updatedAt: number;
         }[];
         count: number;
+        provider?: undefined;
         found?: undefined;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        message?: undefined;
         count?: undefined;
         id?: undefined;
         deleted?: undefined;
@@ -337,32 +338,31 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         provider: import("../custom-registry.js").CustomProviderConfig;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        message?: undefined;
         count?: undefined;
-        provider?: undefined;
         deleted?: undefined;
         providers?: undefined;
+        provider?: undefined;
         found: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
+        message?: undefined;
         count?: undefined;
-        provider?: undefined;
         providers?: undefined;
+        provider?: undefined;
         found?: undefined;
         deleted: boolean;
         id: string;
         registered?: undefined;
         label?: undefined;
-        message?: undefined;
     } | {
         count?: undefined;
-        provider?: undefined;
         deleted?: undefined;
         providers?: undefined;
+        provider?: undefined;
         found?: undefined;
         registered: boolean;
         id: string;

package/dist/review/actions/create-review-comment.js

@@ -36,7 +36,7 @@ export default defineAction({
     schema,
     run: async (args, ctx) => {
         const actionCtx = ctx;
-        const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "viewer");
+        const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "commenter");
         const mentions = normalizeReviewMentions([
             ...normalizeReviewMentions(args.mentions),
             ...extractReviewMentions(args.body),

package/dist/review/actions/delete-review-comment.js

@@ -30,7 +30,10 @@ export default defineAction({
         const isAuthor = Boolean(actionCtx?.userEmail) &&
             normalizeEmail(comment.authorEmail) ===
                 normalizeEmail(actionCtx?.userEmail);
-        if (!isAuthor && (!access || !roleSatisfies(access.role, "editor"))) {
+        if (!access || !roleSatisfies(access.role, "commenter")) {
+            throw new ForbiddenError("Not allowed to delete this review comment");
+        }
+        if (!isAuthor && !roleSatisfies(access.role, "editor")) {
             throw new ForbiddenError("Not allowed to delete this review comment");
         }
         const updatedCount = await deleteReviewComment(comment.id, actionCtx?.userEmail ?? null);

package/dist/review/actions/list-review-comments.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { defineAction } from "../../action.js";
+import { roleSatisfies } from "../../sharing/schema.js";
 import { redactPublicReviewCommentIdentity, redactPublicReviewStatusIdentity, shouldRedactReviewIdentity, } from "../identity.js";
 import { assertReviewableResourceAccess } from "../registry.js";
 import { getReviewStatus, getReviewThreadSummary, queryReviewComments, } from "../store.js";
@@ -50,8 +51,9 @@ export default defineAction({
         const redactIdentity = shouldRedactReviewIdentity(actionCtx, access);
         const commentsWithCapabilities = comments.map((comment) => ({
             ...comment,
-            canDelete: access.role !== "viewer" ||
-                Boolean(actionCtx?.userEmail && comment.authorEmail === actionCtx.userEmail),
+            canDelete: roleSatisfies(access.role, "commenter") &&
+                (roleSatisfies(access.role, "editor") ||
+                    Boolean(actionCtx?.userEmail && comment.authorEmail === actionCtx.userEmail)),
         }));
         return redactIdentity
             ? {

package/dist/review/actions/reply-review-comment.js

@@ -29,7 +29,7 @@ export default defineAction({
             userEmail: actionCtx?.userEmail ?? null,
             orgId: actionCtx?.orgId ?? null,
         };
-        const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "viewer");
+        const access = await assertReviewableResourceAccess(args.resourceType, args.resourceId, actionCtx, "commenter");
         const parent = await getReviewCommentById(args.commentId, scope, {
             bypassScope: true,
         });

package/dist/review/types.d.ts

@@ -1,5 +1,5 @@
 import type { Visibility } from "../sharing/schema.js";
-export type ReviewResourceRole = "viewer" | "editor" | "admin" | "owner";
+export type ReviewResourceRole = "viewer" | "commenter" | "editor" | "admin" | "owner";
 export type ReviewCommentKind = "comment" | "annotation" | "correction" | "question" | "decision" | "review";
 export type ReviewCommentStatus = "open" | "resolved" | "deleted";
 export type ReviewResolutionTarget = "agent" | "human";

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;

package/dist/server/action-discovery.js

@@ -513,6 +513,10 @@ export { CORE_ACTION_GROUPS };
  */
 export const ALWAYS_ON_CORE_ACTIONS = new Set([
     "upload-image",
+    "list-workspace-user-groups",
+    "upsert-workspace-user-group",
+    "bulk-update-workspace-user-groups",
+    "delete-workspace-user-group",
     "list-transactional-emails",
     "render-transactional-email-preview",
     "list-email-log",
@@ -544,6 +548,22 @@ export async function mergeCoreSharingActions(registry) {
             () => import("../sharing/actions/create-agent-resource-link.js"),
         ],
         ["upload-image", () => import("../file-upload/actions/upload-image.js")],
+        [
+            "list-workspace-user-groups",
+            () => import("../workspace-connections/actions/list-workspace-user-groups.js"),
+        ],
+        [
+            "upsert-workspace-user-group",
+            () => import("../workspace-connections/actions/upsert-workspace-user-group.js"),
+        ],
+        [
+            "bulk-update-workspace-user-groups",
+            () => import("../workspace-connections/actions/bulk-update-workspace-user-groups.js"),
+        ],
+        [
+            "delete-workspace-user-group",
+            () => import("../workspace-connections/actions/delete-workspace-user-group.js"),
+        ],
         // Transactional email catalog - mounted everywhere so Dispatch can ask any
         // app what it sends without that app opting in.
         [
@@ -605,6 +625,15 @@ export async function mergeCoreSharingActions(registry) {
             "manage-automation",
             () => import("../triggers/actions/manage-automation.js"),
         ],
+        ["get-usage-alerts", () => import("../usage/actions/get-usage-alerts.js")],
+        [
+            "manage-usage-alert",
+            () => import("../usage/actions/manage-usage-alert.js"),
+        ],
+        [
+            "get-usage-metrics",
+            () => import("../usage/actions/get-usage-metrics.js"),
+        ],
         [
             "context-manifest-get",
             () => import("../agent/context-xray/actions/context-manifest-get.js"),

package/dist/server/agent-chat/plugin-options.d.ts

@@ -52,6 +52,13 @@ export interface AgentChatPluginOptions {
     mentionProviders?: Record<string, MentionProvider> | (() => Record<string, MentionProvider> | Promise<Record<string, MentionProvider>>);
     /** App ID used to exclude self from agent discovery (e.g., "mail", "calendar") */
     appId?: string;
+    /**
+     * Controls connected MCP tools available to unattended recurring and trigger
+     * runs. "requested" only loads tools named by a job; "all" loads every
+     * tool visible to this app's current workspace context and still enforces
+     * the per-request scope gate when a tool is called.
+     */
+    backgroundMcpTools?: "requested" | "all";
     /**
      * Everything about this app's MCP mount — whether it is mounted, which tools
      * external callers see, and the branding sent during the `initialize`

package/dist/server/agent-chat-plugin.d.ts

@@ -1,4 +1,5 @@
 import type { Message as A2AMessage } from "../a2a/types.js";
+import { type ActionEntry } from "../agent/production-agent.js";
 import type { ResolvedKeyReference } from "../secrets/substitution.js";
 import { handleSharedThreadRequest, type SharedThreadRouteDependencies } from "./agent-chat/shared-thread.js";
 export { handleSharedThreadRequest };
@@ -62,6 +63,7 @@ export declare function resolveFetchToolKeyAllowlist(keyName: string, resolvedKe
     getKeyAllowlist: (name: string, scope: "user", scopeId: string) => Promise<string[] | null>;
     getResolvedKeyAllowlist: (ref: ResolvedKeyReference) => Promise<string[] | null>;
 }): Promise<string[] | null>;
+export declare function resolveHostedBuilderHandoff(browserTools: Record<string, ActionEntry>, canToggle: boolean): Record<string, ActionEntry>;
 export declare function createAgentChatPlugin(options?: AgentChatPluginOptions): NitroPluginDef;
 /**
  * Default agent chat plugin with no template-specific actions.

package/dist/server/agent-chat-plugin.js

@@ -240,6 +240,12 @@ export async function resolveFetchToolKeyAllowlist(keyName, resolvedKeys, owner,
         return deps.getResolvedKeyAllowlist(ref);
     return deps.getKeyAllowlist(keyName, "user", owner);
 }
+export function resolveHostedBuilderHandoff(browserTools, canToggle) {
+    if (canToggle)
+        return {};
+    const connectBuilder = browserTools["connect-builder"];
+    return connectBuilder ? { "connect-builder": connectBuilder } : {};
+}
 export function createAgentChatPlugin(options) {
     return (nitroApp) => {
         markDefaultPluginProvided(nitroApp, "agent-chat");
@@ -292,6 +298,7 @@ export function createAgentChatPlugin(options) {
             // `externalAgents` into `mcp`. A2A reads the same object, so the
             // connector policy cannot diverge between the two external surfaces.
             const mcpOptions = resolveAgentChatMcpOptions(options);
+            const backgroundMcpTools = options?.backgroundMcpTools ?? "requested";
             // Build the four assembled system prompt strings. These are static for the
             // lifetime of this plugin instance — examples come from options once at
             // startup, not per-request.
@@ -340,15 +347,13 @@ export function createAgentChatPlugin(options) {
             };
             const getJobMcpActionEntries = async (job) => {
                 const requested = job?.meta.mcpTools ?? [];
-                if (requested.length === 0)
+                if (requested.length === 0 && backgroundMcpTools !== "all")
                     return {};
                 // Background action suppliers may be async so event-triggered and
                 // scheduled runs can await lazy MCP hydration on serverless cold
                 // starts. Runs without requested MCP tools still skip this work.
                 await ensureMcpInitialized();
-                const entries = mcpToolsToActionEntries(mcpManager, {
-                    toolNames: requested,
-                });
+                const entries = mcpToolsToActionEntries(mcpManager, backgroundMcpTools === "all" ? {} : { toolNames: requested });
                 const missing = requested.filter((toolName) => !entries[toolName]);
                 if (missing.length > 0) {
                     throw new Error(`Configured MCP tools are unavailable in this run: ${missing.join(", ")}. Reconnect the MCP server or update the automation's capability list.`);
@@ -470,6 +475,7 @@ export function createAgentChatPlugin(options) {
                 getOwner: () => getRequestRunContext()?.owner ?? getRequestUserEmail(),
                 extensionTools: extensionToolsEnabled,
             });
+            const hostedBuilderHandoff = resolveHostedBuilderHandoff(browserTools, canToggle);
             // Auto-mount A2A protocol endpoints so every app is discoverable
             // and callable by other agents via the standard protocol.
             // In dev mode, include dev scripts (filesystem-discovered) so the A2A agent
@@ -961,6 +967,7 @@ export function createAgentChatPlugin(options) {
                     ...(browserTools["connect-file-storage"]
                         ? ["connect-file-storage"]
                         : []),
+                    ...Object.keys(hostedBuilderHandoff),
                 ]),
             ];
             const resolveExtraContext = async (event, owner) => {
@@ -2283,6 +2290,7 @@ export function createAgentChatPlugin(options) {
                 ...chatScripts,
                 ...(a2aAgentDelegationEnabled ? callAgentScript : {}),
                 ...toolActions,
+                ...hostedBuilderHandoff,
             };
             const anonymousReadOnlyActions = attachToolSearch(filterReadOnlyActions(templateScripts));
             // Full-database admin tools. Gated on NODE_ENV=development to match the

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.js

@@ -56,9 +56,9 @@ import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
 import { injectAnalyticsIntoHtml } from "./analytics.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { getAppProductionUrl } from "./app-url.js";
-import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { readAnalyticsAnonymousId, readFirstTouchAttribution, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getAuthLoginMode } from "./auth-login-mode.js";
-import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
+import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getAuthSecret, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
 import { BUILDER_CONNECT_OWNER_COOKIE, BUILDER_CONNECT_PARAM, BUILDER_RELAY_PATH, BUILDER_RELAY_STATE_PARAM, BUILDER_STATE_PARAM, verifyBuilderCallbackStateAndGetOwner, verifyBuilderConnectTokenAndGetOwner, verifyBuilderPreviewRelayStateForCallback, } from "./builder-browser.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
@@ -67,6 +67,7 @@ import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import { isElectron as isElectronRequest, getAppBasePath, getAppUrl, getOrigin, encodeOAuthState, decodeOAuthState, createOAuthSession, oauthCallbackResponse, oauthDesktopExchangePage, oauthErrorPage, resolveOAuthRedirectUri, isAllowedOAuthRedirectUri, } from "./google-oauth.js";
 import { isCanonicalAgentNativeAppRequest, isDesktopSsoCanaryUserAgent, isIdentitySsoEnabled, } from "./identity-sso-store.js";
 import { ensureCanonicalUserForLegacySession } from "./legacy-auth-migration.js";
+import { encodeMagicLinkSignupAttribution, MAGIC_LINK_ATTRIBUTION_PARAM, } from "./magic-link-attribution.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
 import { captureAuthError } from "./sentry.js";
@@ -3333,12 +3334,25 @@ async function mountBetterAuthRoutes(app, options) {
                 callbackPath = withDesktopMagicLinkFlow(callbackPath, desktopFlow);
             }
             const callbackURL = betterAuthCallbackURL(callbackPath, true, event);
-            const newUserCallbackPath = `${getAppBasePath()}/_agent-native/auth/magic-link/new-user?return=${encodeURIComponent(callbackPath)}`;
+            const cookieHeader = getHeader(event, "cookie") ?? null;
+            const signupAttribution = signupAttributionFromCookieHeader(cookieHeader);
+            const signupAnonymousId = readAnalyticsAnonymousId(cookieHeader);
+            const hasSignupAttribution = !!readFirstTouchAttribution(cookieHeader) || !!signupAnonymousId;
+            const attributionToken = hasSignupAttribution
+                ? encodeMagicLinkSignupAttribution({
+                    attribution: signupAttribution,
+                    anonymousId: signupAnonymousId,
+                }, getAuthSecret())
+                : undefined;
+            const newUserCallbackUrl = new URL(`${getAppBasePath()}/_agent-native/auth/magic-link/new-user?return=${encodeURIComponent(callbackPath)}`, getOrigin(event));
+            if (attributionToken) {
+                newUserCallbackUrl.searchParams.set(MAGIC_LINK_ATTRIBUTION_PARAM, attributionToken);
+            }
             await auth.api.signInMagicLink({
                 body: {
                     email,
                     callbackURL,
-                    newUserCallbackURL: betterAuthCallbackURL(newUserCallbackPath, true, event),
+                    newUserCallbackURL: betterAuthCallbackURL(`${newUserCallbackUrl.pathname}${newUserCallbackUrl.search}`, true, event),
                 },
                 headers: event.headers,
             });

package/dist/server/better-auth-instance.js

@@ -32,6 +32,7 @@ import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { renderMagicLinkEmail, renderResetPasswordEmail, renderVerifySignupEmail, } from "./email-templates.js";
 import { getEmailReadiness, sendEmail } from "./email.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
+import { readMagicLinkSignupAttribution } from "./magic-link-attribution.js";
 export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, } from "./auth-login-mode.js";
 async function flushSignupTracking() {
     try {
@@ -982,8 +983,14 @@ async function createBetterAuthInstance(config) {
                             const cookieHeader = context?.headers?.get("cookie") ??
                                 context?.request?.headers?.get("cookie") ??
                                 null;
+                            const magicLinkAttribution = context?.request?.url?.includes("newUserCallbackURL")
+                                ? readMagicLinkSignupAttribution(context.request.url, getAuthSecret())
+                                : undefined;
                             attribution = signupAttributionFromCookieHeader(cookieHeader);
-                            anonymousId = readAnalyticsAnonymousId(cookieHeader);
+                            attribution = magicLinkAttribution?.attribution ?? attribution;
+                            anonymousId =
+                                magicLinkAttribution?.anonymousId ??
+                                    readAnalyticsAnonymousId(cookieHeader);
                         }
                         catch (err) {
                             console.error("[auth] failed to derive signup attribution", err);