@agent-native/core 0.167.1 → 0.167.4

package/dist/server/agent-chat-plugin.js

@@ -23,7 +23,7 @@ import { attachToolSearch } from "../agent/tool-search.js";
 import { getAppConfig } from "../app-config/index.js";
 import { readAppStateForCurrentTab } from "../application-state/script-helpers.js";
 import { runChatThreadDataMigrations } from "../chat-threads/migrations.js";
-import { adoptThreadScopeIfUnscoped, createThread, forkThread, getThread, registerChatThreadsShareable, resolveRunThreadScope, resolveThreadAccess, listThreads, searchThreads, renameThread, createThreadShareLink, getThreadByShareToken, getThreadShareState, revokeThreadShareLink, setThreadArchived, setThreadPinned, setThreadScope, updateThreadData, withThreadDataLock, deleteThread, setThreadQueuedMessages, setThreadSourceIfMissing, } from "../chat-threads/store.js";
+import { adoptThreadScopeIfUnscoped, createThread, forkThread, getThread, registerChatThreadsShareable, resolveRunThreadScope, resolveThreadAccess, listThreads, searchThreads, renameThread, createThreadShareLink, getThreadByShareToken, getThreadShareState, revokeThreadShareLink, setThreadArchived, setThreadPinned, setThreadScope, updateThreadData, withThreadDataLock, deleteThread, setThreadQueuedMessages, setThreadSourceIfMissing, isAppOwnedChatScope, threadScopeMismatch, } from "../chat-threads/store.js";
 import { isCheckpointRestorePath } from "../checkpoints/route-match.js";
 import { createDbAdminAgentTools } from "../db-admin/agent-tools.js";
 import { isProductionServerlessFunctionRuntime, isTransientDatabaseError, } from "../db/client.js";
@@ -120,7 +120,7 @@ import { resolveAgentChatMcpOptions } from "./agent-chat/mcp-options.js";
 import { resolveA2AAgentDelegationEnabled, } from "./agent-chat/plugin-options.js";
 import { finalizeClaimedAgentChatProcessRunFailure } from "./agent-chat/process-run-failure.js";
 import { loadResourcesForPrompt, promptResourceManifestSections, resourceScopeForOwner, } from "./agent-chat/prompt-resources.js";
-import { isNetlifyRecurringJobsRuntime, shouldDisableRecurringJobsRuntime, } from "./agent-chat/recurring-jobs-runtime.js";
+import { isNetlifyRecurringJobsRuntime, resolveRecurringJobsBuildMarker, scheduledTriggerAvailability, shouldDisableRecurringJobsRuntime, } from "./agent-chat/recurring-jobs-runtime.js";
 import { isLocalhost, shouldBlockInProductCodeEditingSurface, } from "./agent-chat/request-surface.js";
 import { loadRunCodeToolEntries } from "./agent-chat/run-code-tools.js";
 import { createAgentEngineScriptEntries, createAgentLoopSettingsScriptEntries, createCallAgentScriptEntry, createChatScriptEntries, createDbScriptEntries, createDocsScriptEntries, createResourceScriptEntries, } from "./agent-chat/script-entries.js";
@@ -147,6 +147,8 @@ export { DEFAULT_DELEGATED_MAX_ITERATIONS, DEFAULT_DELEGATED_MAX_RUN_INPUT_TOKEN
 export { shouldBlockInProductCodeEditingSurface };
 export { loadRunCodeToolEntries };
 export { isNetlifyRecurringJobsRuntime };
+export { resolveRecurringJobsBuildMarker };
+export { scheduledTriggerAvailability };
 export { shouldDisableRecurringJobsRuntime };
 export { finalizeClaimedAgentChatProcessRunFailure };
 export function resolveInteractiveAgentRunOptions(options) {
@@ -2288,17 +2290,23 @@ export function createAgentChatPlugin(options) {
                             thread = await getThread(threadId);
                         }
                     }
-                    if (options?.appId) {
-                        await setThreadSourceIfMissing(threadId, {
-                            appId: options.appId,
+                    if (!thread) {
+                        throw createError({
+                            statusCode: 404,
+                            statusMessage: "Thread not found",
                         });
                     }
-                    if (!thread) {
+                    if (threadScopeMismatch(thread.scope, runScope)) {
                         throw createError({
                             statusCode: 404,
                             statusMessage: "Thread not found",
                         });
                     }
+                    if (options?.appId) {
+                        await setThreadSourceIfMissing(threadId, {
+                            appId: options.appId,
+                        });
+                    }
                     const access = await resolveThreadAccess(ownerEmail, threadId, "editor", { orgId: getRequestOrgId() });
                     if (!access) {
                         throw createError({
@@ -2818,6 +2826,12 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     if (details.threadId && details.ownerEmail) {
                         const existingThread = await getThread(details.threadId);
                         if (existingThread) {
+                            if (threadScopeMismatch(existingThread.scope, getRequestRunContext()?.chatScope)) {
+                                throw createError({
+                                    statusCode: 404,
+                                    statusMessage: "Thread not found",
+                                });
+                            }
                             const access = await resolveThreadAccess(details.ownerEmail, details.threadId, "editor", { orgId: await getOrgIdFromEvent(details.event) });
                             if (!access) {
                                 throw createError({
@@ -3094,6 +3108,12 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         if (details.threadId && details.ownerEmail) {
                             const existingThread = await getThread(details.threadId);
                             if (existingThread) {
+                                if (threadScopeMismatch(existingThread.scope, getRequestRunContext()?.chatScope)) {
+                                    throw createError({
+                                        statusCode: 404,
+                                        statusMessage: "Thread not found",
+                                    });
+                                }
                                 const access = await resolveThreadAccess(details.ownerEmail, details.threadId, "editor", { orgId: await getOrgIdFromEvent(details.event) });
                                 if (!access) {
                                     throw createError({
@@ -4471,11 +4491,16 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 const method = getMethod(event);
                 const { threadId, tail: threadTail } = parseThreadRoute(event);
                 const isThreadSubroute = (subroute) => threadTail[0] === subroute;
+                const requestedScope = parseScopeFromQuery(getQuery(event));
+                const scopesMatch = (left, right) => Boolean(left && right && left.type === right.type && left.id === right.id);
+                const threadMatchesRequestedScope = (thread, incomingScope) => !requestedScope ||
+                    scopesMatch(thread.scope, requestedScope) ||
+                    (!thread.scope && scopesMatch(incomingScope, requestedScope));
                 // ── Specific thread: GET/PUT/DELETE /threads/:id ──
                 if (threadId) {
                     if (method === "GET") {
                         const thread = await resolveThreadAccess(owner, threadId, "viewer", { orgId });
-                        if (!thread) {
+                        if (!thread || !threadMatchesRequestedScope(thread)) {
                             setResponseStatus(event, 404);
                             return { error: "Thread not found" };
                         }
@@ -4489,12 +4514,33 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         // run could clobber the assistant message the server just
                         // appended (and vice versa).
                         return await withThreadDataLock(threadId, async () => {
+                            const body = await readBody(event);
+                            const bodyIncludesScope = Boolean(body &&
+                                typeof body === "object" &&
+                                Object.prototype.hasOwnProperty.call(body, "scope"));
+                            const incomingScope = bodyIncludesScope
+                                ? parseScopeFromBody(body.scope)
+                                : undefined;
                             const thread = await resolveThreadAccess(owner, threadId, "editor", { orgId });
-                            if (!thread) {
+                            if (!thread ||
+                                !threadMatchesRequestedScope(thread, incomingScope)) {
+                                setResponseStatus(event, 404);
+                                return { error: "Thread not found" };
+                            }
+                            const bodyScopeMatchesRequestedScope = !requestedScope ||
+                                !incomingScope ||
+                                scopesMatch(incomingScope, requestedScope);
+                            const unauthorizedScopeChange = bodyIncludesScope &&
+                                ((incomingScope !== null &&
+                                    (threadScopeMismatch(thread.scope, incomingScope) ||
+                                        !bodyScopeMatchesRequestedScope)) ||
+                                    (incomingScope === null &&
+                                        isAppOwnedChatScope(thread.scope) &&
+                                        !requestedScope));
+                            if (unauthorizedScopeChange) {
                                 setResponseStatus(event, 404);
                                 return { error: "Thread not found" };
                             }
-                            const body = await readBody(event);
                             let newThreadData = body.threadData || thread.threadData;
                             let newMessageCount = body.messageCount ?? thread.messageCount;
                             let nextTitle = typeof body.title === "string" ? body.title : thread.title;
@@ -4541,9 +4587,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             }
                             await updateThreadData(threadId, newThreadData, nextTitle, nextPreview, newMessageCount, { ignoreConflicts: true });
                             // Scope updates piggyback on the PUT — the client uses this
-                            // path for both "detach" (scope: null) and "retag" flows.
-                            // Send the field as `scope: undefined` (or omit it) when
-                            // you don't want to touch the existing scope.
+                            // path for detach and for claiming a legacy unscoped thread.
+                            // A scoped thread cannot be retagged across resources here.
                             if (Object.prototype.hasOwnProperty.call(body, "scope")) {
                                 const incomingScope = parseScopeFromBody(body.scope);
                                 await setThreadScope(threadId, incomingScope);
@@ -4557,7 +4602,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     // on full-thread saves.
                     if (method === "POST" && isThreadSubroute("queued")) {
                         const thread = await resolveThreadAccess(owner, threadId, "editor", { orgId });
-                        if (!thread) {
+                        if (!thread || !threadMatchesRequestedScope(thread)) {
                             setResponseStatus(event, 404);
                             return { error: "Thread not found" };
                         }
@@ -4574,7 +4619,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     }
                     if (method === "POST" && isThreadSubroute("rename")) {
                         const thread = await resolveThreadAccess(owner, threadId, "editor", { orgId });
-                        if (!thread) {
+                        if (!thread || !threadMatchesRequestedScope(thread)) {
                             setResponseStatus(event, 404);
                             return { error: "Thread not found" };
                         }
@@ -4595,7 +4640,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     }
                     if (method === "POST" && isThreadSubroute("pin")) {
                         const thread = await resolveThreadAccess(owner, threadId, "editor", { orgId });
-                        if (!thread) {
+                        if (!thread || !threadMatchesRequestedScope(thread)) {
                             setResponseStatus(event, 404);
                             return { error: "Thread not found" };
                         }
@@ -4613,7 +4658,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     }
                     if (method === "POST" && isThreadSubroute("archive")) {
                         const thread = await resolveThreadAccess(owner, threadId, "editor", { orgId });
-                        if (!thread) {
+                        if (!thread || !threadMatchesRequestedScope(thread)) {
                             setResponseStatus(event, 404);
                             return { error: "Thread not found" };
                         }
@@ -4632,7 +4677,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     // POST /threads/:id/fork — duplicate a thread with all its messages
                     if (method === "POST" && isThreadSubroute("fork")) {
                         const thread = await resolveThreadAccess(owner, threadId, "viewer", { orgId });
-                        if (!thread) {
+                        if (!thread || !threadMatchesRequestedScope(thread)) {
                             setResponseStatus(event, 404);
                             return { error: "Thread not found" };
                         }
@@ -4650,7 +4695,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     }
                     if (isThreadSubroute("share")) {
                         const thread = await resolveThreadAccess(owner, threadId, "admin", { orgId });
-                        if (!thread) {
+                        if (!thread || !threadMatchesRequestedScope(thread)) {
                             setResponseStatus(event, 404);
                             return { error: "Thread not found" };
                         }
@@ -4684,7 +4729,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     }
                     if (method === "DELETE") {
                         const thread = await getThread(threadId);
-                        if (!thread || thread.ownerEmail !== owner) {
+                        if (!thread ||
+                            thread.ownerEmail !== owner ||
+                            !threadMatchesRequestedScope(thread)) {
                             setResponseStatus(event, 404);
                             return { error: "Thread not found" };
                         }
@@ -4725,6 +4772,46 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 }
                 if (method === "POST") {
                     const body = await readBody(event);
+                    const requestedScope = parseScopeFromQuery(getQuery(event));
+                    const bodyIncludesScope = Boolean(body &&
+                        typeof body === "object" &&
+                        Object.prototype.hasOwnProperty.call(body, "scope"));
+                    const bodyScope = bodyIncludesScope
+                        ? parseScopeFromBody(body.scope)
+                        : undefined;
+                    const bodyScopeMatchesRequestedScope = !requestedScope ||
+                        !bodyIncludesScope ||
+                        (bodyScope !== null && scopesMatch(bodyScope, requestedScope));
+                    if (!bodyScopeMatchesRequestedScope) {
+                        setResponseStatus(event, 404);
+                        return { error: "Thread not found" };
+                    }
+                    const resolveExistingOwnedThread = async (existing) => {
+                        if ((requestedScope &&
+                            threadScopeMismatch(existing.scope, requestedScope)) ||
+                            (bodyIncludesScope &&
+                                threadScopeMismatch(existing.scope, bodyScope))) {
+                            setResponseStatus(event, 404);
+                            return null;
+                        }
+                        const scopeToAdopt = bodyIncludesScope
+                            ? bodyScope
+                            : requestedScope;
+                        if (!existing.scope && scopeToAdopt) {
+                            const adoptedScope = await adoptThreadScopeIfUnscoped(existing.id, scopeToAdopt);
+                            if (!scopesMatch(adoptedScope, scopeToAdopt)) {
+                                setResponseStatus(event, 404);
+                                return null;
+                            }
+                            const adopted = await getThread(existing.id);
+                            if (!adopted) {
+                                setResponseStatus(event, 404);
+                                return null;
+                            }
+                            return adopted;
+                        }
+                        return existing;
+                    };
                     // Idempotent: when the caller supplies an id and a thread with
                     // that id already exists for this owner, return it instead of
                     // 500'ing on the UNIQUE constraint. The client can race with
@@ -4735,8 +4822,10 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     if (body?.id) {
                         const existing = await getThread(body.id);
                         if (existing) {
-                            if (existing.ownerEmail === owner)
-                                return existing;
+                            if (existing.ownerEmail === owner) {
+                                const resolved = await resolveExistingOwnedThread(existing);
+                                return resolved ?? { error: "Thread not found" };
+                            }
                             setResponseStatus(event, 409);
                             return { error: "Thread id already in use" };
                         }
@@ -4745,7 +4834,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         const thread = await createThread(owner, {
                             id: body?.id,
                             title: body?.title ?? "",
-                            scope: parseScopeFromBody(body?.scope),
+                            scope: bodyIncludesScope ? bodyScope : requestedScope,
                             source: options?.appId ? { appId: options.appId } : null,
                         });
                         return thread;
@@ -4756,8 +4845,10 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                         // return the row that actually landed.
                         if (body?.id) {
                             const existing = await getThread(body.id);
-                            if (existing && existing.ownerEmail === owner)
-                                return existing;
+                            if (existing && existing.ownerEmail === owner) {
+                                const resolved = await resolveExistingOwnedThread(existing);
+                                return resolved ?? { error: "Thread not found" };
+                            }
                         }
                         throw err;
                     }

package/dist/server/attribution.d.ts

@@ -35,6 +35,18 @@ export interface FirstTouchAttribution {
     /** ISO timestamp of when the visitor first landed. */
     landed_at?: string;
 }
+/**
+ * Request-scoped browser attribution captured at the signup boundary.
+ * Better Auth may create the user in a later async callback where the
+ * original request headers are no longer available, so the values must be
+ * carried explicitly through that boundary.
+ */
+export interface SignupAttributionContext {
+    attribution: Record<string, string>;
+    anonymousId?: string;
+}
+/** Internal Better Auth handoff header; attribution is analytics-only. */
+export declare const SIGNUP_ATTRIBUTION_HEADER_NAME = "x-agent-native-signup-attribution";
 /** Cookie name written by the client (non-HttpOnly; non-sensitive). */
 export declare const FIRST_TOUCH_COOKIE_NAME = "an_ft";
 /**
@@ -87,3 +99,20 @@ export declare function deriveSignupAttribution(ft: FirstTouchAttribution | null
  * error.
  */
 export declare function signupAttributionFromCookieHeader(cookieHeader: string | null | undefined): Record<string, string>;
+/**
+ * Capture all browser attribution needed by the server-side signup event.
+ * Keep this as one boundary helper so every signup entry point carries the
+ * same values into Better Auth's user-create hook.
+ */
+export declare function signupAttributionContextFromCookieHeader(cookieHeader: string | null | undefined): SignupAttributionContext;
+/** Serialize the bounded attribution handoff for a Better Auth request. */
+export declare function encodeSignupAttributionContext(context: SignupAttributionContext): string;
+/**
+ * Decode the internal handoff header. Invalid input is absent, not a direct
+ * attribution, so the caller can safely fall back to the request cookie.
+ */
+export declare function decodeSignupAttributionContext(value: string | null | undefined): SignupAttributionContext | undefined;
+/** Add the explicit handoff to a Better Auth request/API header set. */
+export declare function addSignupAttributionHeader(headers: HeadersInit | undefined, context: SignupAttributionContext): Headers;
+/** Read the explicit handoff from Better Auth's request context headers. */
+export declare function signupAttributionContextFromHeaders(headers: Headers | null | undefined): SignupAttributionContext | undefined;

package/dist/server/attribution.js

@@ -1,4 +1,7 @@
 import { ANALYTICS_ANONYMOUS_ID_COOKIE_NAME, normalizeAnalyticsAnonymousId, } from "../shared/analytics-anonymous-id.js";
+/** Internal Better Auth handoff header; attribution is analytics-only. */
+export const SIGNUP_ATTRIBUTION_HEADER_NAME = "x-agent-native-signup-attribution";
+const SIGNUP_ATTRIBUTION_HEADER_MAX_LENGTH = 4096;
 /** Cookie name written by the client (non-HttpOnly; non-sensitive). */
 export const FIRST_TOUCH_COOKIE_NAME = "an_ft";
 const STRING_FIELDS = [
@@ -178,3 +181,68 @@ export function signupAttributionFromCookieHeader(cookieHeader) {
         return { referral_source: "direct" };
     }
 }
+/**
+ * Capture all browser attribution needed by the server-side signup event.
+ * Keep this as one boundary helper so every signup entry point carries the
+ * same values into Better Auth's user-create hook.
+ */
+export function signupAttributionContextFromCookieHeader(cookieHeader) {
+    const anonymousId = readAnalyticsAnonymousId(cookieHeader);
+    return {
+        attribution: signupAttributionFromCookieHeader(cookieHeader),
+        ...(anonymousId ? { anonymousId } : {}),
+    };
+}
+/** Serialize the bounded attribution handoff for a Better Auth request. */
+export function encodeSignupAttributionContext(context) {
+    return encodeURIComponent(JSON.stringify(context));
+}
+/**
+ * Decode the internal handoff header. Invalid input is absent, not a direct
+ * attribution, so the caller can safely fall back to the request cookie.
+ */
+export function decodeSignupAttributionContext(value) {
+    if (!value || value.length > SIGNUP_ATTRIBUTION_HEADER_MAX_LENGTH) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(decodeURIComponent(value));
+        const rawAttribution = parsed?.attribution;
+        if (!rawAttribution ||
+            typeof rawAttribution !== "object" ||
+            Array.isArray(rawAttribution)) {
+            return undefined;
+        }
+        const attribution = {};
+        for (const [key, rawValue] of Object.entries(rawAttribution)) {
+            if (/^[A-Za-z0-9_]+$/.test(key) &&
+                key.length <= 64 &&
+                typeof rawValue === "string" &&
+                rawValue.length > 0) {
+                attribution[key] = rawValue.slice(0, 120);
+            }
+        }
+        if (Object.keys(attribution).length === 0)
+            return undefined;
+        const anonymousId = normalizeAnalyticsAnonymousId(parsed?.anonymousId);
+        return {
+            attribution,
+            ...(anonymousId ? { anonymousId } : {}),
+        };
+    }
+    catch (error) {
+        // `undefined` distinguishes an unreadable handoff from direct attribution.
+        void error;
+        return undefined;
+    }
+}
+/** Add the explicit handoff to a Better Auth request/API header set. */
+export function addSignupAttributionHeader(headers, context) {
+    const result = new Headers(headers);
+    result.set(SIGNUP_ATTRIBUTION_HEADER_NAME, encodeSignupAttributionContext(context));
+    return result;
+}
+/** Read the explicit handoff from Better Auth's request context headers. */
+export function signupAttributionContextFromHeaders(headers) {
+    return decodeSignupAttributionContext(headers?.get(SIGNUP_ATTRIBUTION_HEADER_NAME));
+}

package/dist/server/auth.js

@@ -58,7 +58,7 @@ import { isValidWorkspaceAppIdFormat } from "../shared/workspace-app-id.js";
 import { injectAnalyticsIntoHtml } from "./analytics.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
 import { getAppProductionUrl } from "./app-url.js";
-import { readAnalyticsAnonymousId, readFirstTouchAttribution, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { addSignupAttributionHeader, readAnalyticsAnonymousId, readFirstTouchAttribution, signupAttributionContextFromCookieHeader, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getAuthLoginMode } from "./auth-login-mode.js";
 import { injectBetaOptOutPersistence } from "./beta-opt-out-html.js";
 import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getAuthSecret, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
@@ -73,6 +73,7 @@ import { ensureCanonicalUserForLegacySession } from "./legacy-auth-migration.js"
 import { encodeMagicLinkSignupAttribution, MAGIC_LINK_ATTRIBUTION_PARAM, } from "./magic-link-attribution.js";
 import { safeOAuthReturnUrl } from "./oauth-return-url.js";
 import { getOnboardingHtml, getResetPasswordHtml, } from "./onboarding-html.js";
+import { getRequestContext, hasContinuationLocalRequestContext, runWithRequestContext, } from "./request-context.js";
 import { captureAuthError } from "./sentry.js";
 import { forgetCachedSessionEmail, getCachedSessionEmail, invalidateSessionEmailCache, setCachedSessionEmail, } from "./session-email-cache.js";
 import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
@@ -83,6 +84,23 @@ import { isWorkspaceOAuthCallbackRelayEnabled } from "./workspace-oauth.js";
 export function getSessionMaxAge() {
     return sessionMaxAge;
 }
+function withSignupAttributionContext(cookieHeader, fn) {
+    const signupAttribution = signupAttributionContextFromCookieHeader(cookieHeader);
+    if (!hasContinuationLocalRequestContext())
+        return fn();
+    return runWithRequestContext({
+        ...(getRequestContext() ?? {}),
+        signupAttribution,
+    }, fn);
+}
+function requestWithSignupAttribution(request, signupAttribution) {
+    return new Request(request, {
+        headers: addSignupAttributionHeader(request.headers, signupAttribution),
+    });
+}
+function headersWithSignupAttribution(headers, cookieHeader) {
+    return addSignupAttributionHeader(headers, signupAttributionContextFromCookieHeader(cookieHeader));
+}
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -416,6 +434,9 @@ async function readDesktopSsoSafely(event) {
         return null;
     return await readDesktopSso();
 }
+function isDesktopSessionCookieOnlyCheck(event) {
+    return getHeader(event, "x-agent-native-session-check") === "cookie-only";
+}
 /**
  * Extract the framework session token from a Better Auth response's
  * Set-Cookie headers, if any. Used by the password-reset path to skip
@@ -2688,6 +2709,7 @@ export async function getSession(event) {
     })());
 }
 async function resolveSessionUncached(event) {
+    const cookieOnlyDesktopCheck = isDesktopSessionCookieOnlyCheck(event);
     // 1. MCP App embed session. This is a short-lived browser session minted
     // from a one-time ticket that was scoped to the authenticated MCP caller.
     // It lets an inline MCP App iframe load the real app without reusing the
@@ -2724,9 +2746,11 @@ async function resolveSessionUncached(event) {
         // templates too. Gated on `readDesktopSsoSafely` so a non-loopback
         // request that spoofs `User-Agent: ... Electron/...` cannot read the
         // home-dir broker file (and so production builds never consult it).
-        const sso = await readDesktopSsoSafely(event);
-        if (sso?.email)
-            return { email: sso.email, token: sso.token };
+        if (!cookieOnlyDesktopCheck) {
+            const sso = await readDesktopSsoSafely(event);
+            if (sso?.email)
+                return { email: sso.email, token: sso.token };
+        }
         // Fall through to mobile _session check
     }
     else {
@@ -2765,9 +2789,11 @@ async function resolveSessionUncached(event) {
         // a loopback (127.0.0.1 / ::1) source IP, and a non-production NODE_ENV
         // — anything else is rejected so a hostile network request cannot
         // impersonate whichever email last signed into the desktop app.
-        const sso = await readDesktopSsoSafely(event);
-        if (sso?.email) {
-            return { email: sso.email, token: sso.token };
+        if (!cookieOnlyDesktopCheck) {
+            const sso = await readDesktopSsoSafely(event);
+            if (sso?.email) {
+                return { email: sso.email, token: sso.token };
+            }
         }
     }
     // 8. Mobile WebView bridge — _session query param
@@ -3699,11 +3725,18 @@ async function mountBetterAuthRoutes(app, options) {
             getMethod(event) === "POST";
         const isMagicLinkRequest = reqPath.includes("/sign-in/magic-link") && getMethod(event) === "POST";
         const isMagicLinkVerification = reqPath.includes("/magic-link/verify") && getMethod(event) === "GET";
+        const isEmailSignup = reqPath.includes("/sign-up/email") && getMethod(event) === "POST";
         const isSignOut = reqPath.includes("sign-out") && getMethod(event) === "POST";
         if (isSignOut)
             optOutOfAuthDisabledSession(event);
         const authRequest = toWebRequest(event);
         let requestForAuth = authRequest;
+        const signupCookieHeader = isEmailSignup
+            ? authRequest.headers.get("cookie")
+            : undefined;
+        const signupAttribution = isEmailSignup
+            ? signupAttributionContextFromCookieHeader(signupCookieHeader)
+            : undefined;
         let magicLinkPreConsume;
         if (isMagicLinkVerification) {
             const verificationURL = new URL(authRequest.url);
@@ -3820,9 +3853,14 @@ async function mountBetterAuthRoutes(app, options) {
                 // validation error.
             }
         }
+        if (signupAttribution) {
+            requestForAuth = requestWithSignupAttribution(requestForAuth, signupAttribution);
+        }
         let response;
         try {
-            response = await auth.handler(requestForAuth);
+            response = await (isEmailSignup
+                ? withSignupAttributionContext(signupCookieHeader, () => auth.handler(requestForAuth))
+                : auth.handler(requestForAuth));
         }
         catch (error) {
             if (isMagicLinkVerification) {
@@ -4127,10 +4165,15 @@ async function mountBetterAuthRoutes(app, options) {
             return { error: GOOGLE_AUTH_REQUIRED_MESSAGE };
         }
         try {
-            await auth.api.signUpEmail({
-                body: { email, password, name: email.split("@")[0], callbackURL },
-                headers: event.headers,
-            });
+            await withSignupAttributionContext(getHeader(event, "cookie") ?? null, () => auth.api.signUpEmail({
+                body: {
+                    email,
+                    password,
+                    name: email.split("@")[0],
+                    callbackURL,
+                },
+                headers: headersWithSignupAttribution(event.headers, getHeader(event, "cookie") ?? null),
+            }));
             setFirstRunOnboardingCookie(event);
             return { ok: true };
         }
@@ -4384,10 +4427,10 @@ function mountAuthFallbackRoutes(app) {
         }
         try {
             const auth = await getBetterAuth();
-            await auth.api.signUpEmail({
+            await withSignupAttributionContext(getHeader(event, "cookie") ?? null, () => auth.api.signUpEmail({
                 body: { email, password, name: email.split("@")[0] },
-                headers: event.headers,
-            });
+                headers: headersWithSignupAttribution(event.headers, getHeader(event, "cookie") ?? null),
+            }));
             setFirstRunOnboardingCookie(event);
             return { ok: true };
         }

package/dist/server/better-auth-instance.js

@@ -26,13 +26,14 @@ import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, } from "../shared/password-po
 import { formatRuntimeConfigReport, getRuntimeConfigReport, } from "../shared/runtime-config.js";
 import { flushTracking, identify, track } from "../tracking/index.js";
 import { getAppProductionUrl } from "./app-url.js";
-import { readAnalyticsAnonymousId, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { signupAttributionContextFromCookieHeader, signupAttributionContextFromHeaders, } from "./attribution.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
 import { renderMagicLinkEmail, renderResetPasswordEmail, renderVerifySignupEmail, } from "./email-templates.js";
 import { getEmailReadiness, sendEmail } from "./email.js";
 import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import { readMagicLinkSignupAttribution } from "./magic-link-attribution.js";
+import { getRequestContext, hasContinuationLocalRequestContext, } from "./request-context.js";
 export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, } from "./auth-login-mode.js";
 async function flushSignupTracking() {
     try {
@@ -1045,14 +1046,25 @@ async function createBetterAuthInstance(config) {
                             const cookieHeader = context?.headers?.get("cookie") ??
                                 context?.request?.headers?.get("cookie") ??
                                 null;
+                            const scopedSignupAttribution = hasContinuationLocalRequestContext()
+                                ? getRequestContext()?.signupAttribution
+                                : undefined;
+                            const requestSignupAttribution = signupAttributionContextFromCookieHeader(cookieHeader);
+                            const headerSignupAttribution = signupAttributionContextFromHeaders(context?.headers) ??
+                                signupAttributionContextFromHeaders(context?.request?.headers);
                             const magicLinkAttribution = context?.request?.url?.includes("newUserCallbackURL")
                                 ? readMagicLinkSignupAttribution(context.request.url, getAuthSecret())
                                 : undefined;
-                            attribution = signupAttributionFromCookieHeader(cookieHeader);
-                            attribution = magicLinkAttribution?.attribution ?? attribution;
+                            attribution =
+                                magicLinkAttribution?.attribution ??
+                                    scopedSignupAttribution?.attribution ??
+                                    headerSignupAttribution?.attribution ??
+                                    requestSignupAttribution.attribution;
                             anonymousId =
                                 magicLinkAttribution?.anonymousId ??
-                                    readAnalyticsAnonymousId(cookieHeader);
+                                    scopedSignupAttribution?.anonymousId ??
+                                    headerSignupAttribution?.anonymousId ??
+                                    requestSignupAttribution.anonymousId;
                         }
                         catch (err) {
                             console.error("[auth] failed to derive signup attribution", err);