@agent-native/core 0.172.6 → 0.172.9

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 8594
+- template files: 8596

package/corpus/templates/analytics/changelog/2026-08-24-chat-draft-preservation.md

@@ -0,0 +1,5 @@
+---
+type: fixed
+date: 2026-08-24
+---
+Analytics chat drafts now stay in place while a new chat finishes loading.

package/corpus/templates/clips/changelog/2026-08-24-muted-microphone-start-guidance.md

@@ -0,0 +1,5 @@
+---
+type: fixed
+date: 2026-08-24
+---
+Muted microphone alerts now return you to recording setup before recording starts.

package/corpus/templates/clips/desktop/src/app.tsx

@@ -1087,8 +1087,6 @@ export function App({
   );
   const [micOn, setMicOn] = useState<boolean>(() => loadBool(MIC_ON_KEY, true));
   const [micOffConfirmOpen, setMicOffConfirmOpen] = useState(false);
-  const pendingStartOptionsRef =
-    useRef<Parameters<typeof handleStartRecording>[0]>(undefined);
   const [systemAudioOn, setSystemAudioOn] = useState<boolean>(() =>
     loadBool(SYSTEM_AUDIO_KEY, true),
   );
@@ -3591,16 +3589,14 @@ export function App({
   }, []);
 
   // Gates every start-recording gesture (button, global shortcut, permission
-  // retry) on the mic toggle. When the mic is off we hold the actual
-  // getDisplayMedia/getUserMedia call until the user confirms in
-  // micOffConfirmOpen — the confirm button's own click supplies the user
-  // activation handleStartRecording needs, same as the direct gesture would.
+  // retry) on the mic toggle. When the mic is off we show the informational
+  // mic-off screen and wait for the user to go back and change that setting
+  // before the actual getDisplayMedia/getUserMedia call runs.
   function beginRecording(
     options?: Parameters<typeof handleStartRecording>[0],
     beginOptions?: { revealPopoverIfMicOff?: boolean },
   ) {
     if (!micOn) {
-      pendingStartOptionsRef.current = options;
       if (beginOptions?.revealPopoverIfMicOff) {
         invoke("show_popover").catch(() => {});
       }
@@ -3611,21 +3607,9 @@ export function App({
   }
 
   function closeMicOffConfirmation() {
-    pendingStartOptionsRef.current = undefined;
     setMicOffConfirmOpen(false);
   }
 
-  function unmuteFromConfirmation() {
-    setMicOn(true);
-    closeMicOffConfirmation();
-  }
-
-  function continueWithoutMic() {
-    const options = pendingStartOptionsRef.current;
-    closeMicOffConfirmation();
-    void handleStartRecording(options);
-  }
-
   recordShortcutHandlerRef.current = () => {
     if (recorder) {
       emit("clips:recorder-stop").catch(() => {});
@@ -4319,11 +4303,7 @@ export function App({
   return (
     <div className="app app-recorder" ref={appRef}>
       {micOffConfirmOpen ? (
-        <MicOffConfirmation
-          onBack={closeMicOffConfirmation}
-          onUnmute={unmuteFromConfirmation}
-          onContinue={continueWithoutMic}
-        />
+        <MicOffConfirmation onBack={closeMicOffConfirmation} />
       ) : null}
 
       <div

package/corpus/templates/clips/desktop/src/components/MicOffConfirmation.tsx

@@ -1,14 +1,6 @@
 import { IconArrowLeft, IconMicrophone2 } from "@tabler/icons-react";
 
-export function MicOffConfirmation({
-  onBack,
-  onUnmute,
-  onContinue,
-}: {
-  onBack: () => void;
-  onUnmute: () => void;
-  onContinue: () => void;
-}) {
+export function MicOffConfirmation({ onBack }: { onBack: () => void }) {
   return (
     <section className="mic-off-confirmation" aria-labelledby="mic-off-title">
       <header className="mic-off-confirmation-header">
@@ -29,19 +21,10 @@ export function MicOffConfirmation({
         </div>
         <h2 id="mic-off-title">Your mic is muted</h2>
         <p>
-          To have sound in your video, you&apos;ll need to unmute your
-          microphone.
+          You can change your microphone setting and then come back to start
+          recording.
         </p>
       </div>
-
-      <footer className="mic-off-confirmation-actions">
-        <button type="button" className="secondary" onClick={onUnmute}>
-          Unmute
-        </button>
-        <button type="button" className="primary" onClick={onContinue}>
-          Continue
-        </button>
-      </footer>
     </section>
   );
 }

package/corpus/templates/clips/desktop/src/styles.css

@@ -2177,26 +2177,6 @@ body[data-clips-route="recording-pill"] #root {
   line-height: 1.55;
 }
 
-.mic-off-confirmation-actions {
-  display: grid;
-  grid-template-columns: repeat(2, minmax(0, 1fr));
-  gap: 10px;
-  padding: 16px 18px 18px;
-  border-top: 1px solid var(--border);
-  background: var(--surface);
-}
-
-.mic-off-confirmation-actions .primary,
-.mic-off-confirmation-actions .secondary {
-  width: auto;
-  min-width: 0;
-  height: 42px;
-  padding: 0 12px;
-  border-radius: var(--radius);
-  font-size: 13px;
-  white-space: nowrap;
-}
-
 /* ------------------------------------------------------------------------- */
 /* Alert dialog                                                              */
 /* ------------------------------------------------------------------------- */

package/dist/client/AssistantChat.js

@@ -1458,7 +1458,7 @@ const AssistantChatInner = forwardRef(function AssistantChatInner({ emptyStateTe
     // Cleared on the next message send.
     const [composerError, setComposerError] = useState(null);
     const [composerText, setComposerText] = useState("");
-    const composerDraftScope = threadId || tabId;
+    const composerDraftScope = tabId || threadId;
     const initialComposerText = useMemo(() => readAssistantChatComposerDraft(composerDraftScope), [composerDraftScope]);
     const handleComposerTextChange = useCallback((text) => {
         setComposerText(text);

package/dist/client/org/workspace-app-links.d.ts

@@ -20,6 +20,7 @@ export declare function isWorkspaceAppEnvironment(env?: RuntimeEnv): boolean;
 export declare function dispatchOverviewHref(apps: OrgSwitcherAppLink[], env?: RuntimeEnv): string;
 export declare function dispatchAppsHref(apps: OrgSwitcherAppLink[], env?: RuntimeEnv): string;
 export declare function visibleOrgAppLinks(apps: OrgSwitcherAppLink[], max?: number): VisibleOrgAppLinks;
+export declare function workspaceAppFetchUrls(env: RuntimeEnv): string[];
 export interface UseOrgSwitcherAppLinksResult {
     apps: OrgSwitcherAppLink[];
     isWorkspace: boolean;

package/dist/client/org/workspace-app-links.js

@@ -203,7 +203,7 @@ export function visibleOrgAppLinks(apps, max = ORG_SWITCHER_MAX_APP_LINKS) {
     };
 }
 function initialWorkspaceLinks(env) {
-    return (parseWorkspaceAppLinksJson(envString(env, "VITE_AGENT_NATIVE_WORKSPACE_APPS_JSON"), env) ?? [
+    return [
         {
             id: DISPATCH_ID,
             name: "Dispatch",
@@ -213,20 +213,31 @@ function initialWorkspaceLinks(env) {
             isDispatch: true,
             status: "ready",
         },
-    ]);
+    ];
 }
-function workspaceAppFetchUrls(env) {
-    const urls = [];
+export function workspaceAppFetchUrls(env) {
+    const urls = [
+        "/_agent-native/actions/list-workspace-apps?includeAgentCards=false",
+    ];
     const gatewayUrl = envString(env, "VITE_WORKSPACE_GATEWAY_URL");
     if (gatewayUrl) {
         try {
-            urls.push(new URL("/_workspace/apps", `${stripTrailingSlash(gatewayUrl)}/`).toString());
+            const gateway = new URL(gatewayUrl);
+            const localGateway = [
+                "localhost",
+                "127.0.0.1",
+                "0.0.0.0",
+                "::1",
+            ].includes(gateway.hostname.replace(/^\[|\]$/g, "").toLowerCase());
+            if (localGateway) {
+                urls.push(new URL("/_workspace/apps", `${stripTrailingSlash(gatewayUrl)}/`).toString());
+            }
         }
         catch {
-            // Fall through to the same-origin Dispatch action below.
+            // coercion-ok: malformed gateway URL leaves the authenticated action as
+            // the only hosted source.
         }
     }
-    urls.push("/_agent-native/actions/list-workspace-apps?includeAgentCards=false");
     return urls;
 }
 export function useOrgSwitcherAppLinks(enabled) {

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
+    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
-    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
+    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
-    error?: undefined;
 }>>;

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,9 +59,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/secrets/routes.d.ts

@@ -37,17 +37,17 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     ok?: undefined;
     status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
     ok?: undefined;
     error: string;
     removed?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
@@ -58,13 +58,13 @@ export declare function createTestSecretHandler(): import("h3").EventHandlerWith
     error: string;
     note?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/attribution.d.ts

@@ -35,6 +35,21 @@ export interface FirstTouchAttribution {
     /** ISO timestamp of when the visitor first landed. */
     landed_at?: string;
 }
+/**
+ * Which flow created the account, as opposed to which credential it uses.
+ *
+ * Better Auth fires its `user.create.after` hook on every `user` row insert,
+ * but only some inserts are a person signing up in a browser. Every emitted
+ * `signup` event names its origin so a campaign report can select the ones
+ * that are acquisitions instead of counting row inserts.
+ */
+export type SignupOrigin = 
+/** A person completed a signup form or magic link in a browser. */
+"browser_signup"
+/** The framework's Google OAuth callback owns this event. */
+ | "google_oauth"
+/** Federated SSO provisioning an identity into a sibling app. */
+ | "sso_jit";
 /**
  * Request-scoped browser attribution captured at the signup boundary.
  * Better Auth may create the user in a later async callback where the
@@ -103,8 +118,15 @@ export declare function signupAttributionFromCookieHeader(cookieHeader: string |
  * Capture all browser attribution needed by the server-side signup event.
  * Keep this as one boundary helper so every signup entry point carries the
  * same values into Better Auth's user-create hook.
+ *
+ * Returns `undefined` when the request carried neither cookie. A browser that
+ * ran our client script always has `an_ft`, so "no cookies at all" means no
+ * browser — a server-side backfill or provisioning call. Reporting that as
+ * `referral_source: "direct"` is the coercion that made this metric unusable:
+ * it renders "we never saw a visitor" identical to "a visitor arrived with no
+ * campaign", and only the second one is direct traffic.
  */
-export declare function signupAttributionContextFromCookieHeader(cookieHeader: string | null | undefined): SignupAttributionContext;
+export declare function signupAttributionContextFromCookieHeader(cookieHeader: string | null | undefined): SignupAttributionContext | undefined;
 /** Serialize the bounded attribution handoff for a Better Auth request. */
 export declare function encodeSignupAttributionContext(context: SignupAttributionContext): string;
 /**
@@ -112,7 +134,15 @@ export declare function encodeSignupAttributionContext(context: SignupAttributio
  * attribution, so the caller can safely fall back to the request cookie.
  */
 export declare function decodeSignupAttributionContext(value: string | null | undefined): SignupAttributionContext | undefined;
-/** Add the explicit handoff to a Better Auth request/API header set. */
-export declare function addSignupAttributionHeader(headers: HeadersInit | undefined, context: SignupAttributionContext): Headers;
+/**
+ * Stamp the explicit handoff onto a Better Auth request/API header set.
+ *
+ * This is the only writer of the handoff header, and it always writes: with a
+ * context it sets ours, without one it deletes whatever was there. The header
+ * is unsigned and outranks the request cookie when the hook reads it, so an
+ * inbound copy from the public internet is an attacker-supplied `anonymous_id`
+ * and campaign for someone else's signup row. Never merge — replace.
+ */
+export declare function addSignupAttributionHeader(headers: HeadersInit | undefined, context: SignupAttributionContext | undefined): Headers;
 /** Read the explicit handoff from Better Auth's request context headers. */
 export declare function signupAttributionContextFromHeaders(headers: Headers | null | undefined): SignupAttributionContext | undefined;

package/dist/server/attribution.js

@@ -185,11 +185,21 @@ export function signupAttributionFromCookieHeader(cookieHeader) {
  * Capture all browser attribution needed by the server-side signup event.
  * Keep this as one boundary helper so every signup entry point carries the
  * same values into Better Auth's user-create hook.
+ *
+ * Returns `undefined` when the request carried neither cookie. A browser that
+ * ran our client script always has `an_ft`, so "no cookies at all" means no
+ * browser — a server-side backfill or provisioning call. Reporting that as
+ * `referral_source: "direct"` is the coercion that made this metric unusable:
+ * it renders "we never saw a visitor" identical to "a visitor arrived with no
+ * campaign", and only the second one is direct traffic.
  */
 export function signupAttributionContextFromCookieHeader(cookieHeader) {
+    const firstTouch = readFirstTouchAttribution(cookieHeader);
     const anonymousId = readAnalyticsAnonymousId(cookieHeader);
+    if (!firstTouch && !anonymousId)
+        return undefined;
     return {
-        attribution: signupAttributionFromCookieHeader(cookieHeader),
+        attribution: deriveSignupAttribution(firstTouch),
         ...(anonymousId ? { anonymousId } : {}),
     };
 }
@@ -236,9 +246,21 @@ export function decodeSignupAttributionContext(value) {
         return undefined;
     }
 }
-/** Add the explicit handoff to a Better Auth request/API header set. */
+/**
+ * Stamp the explicit handoff onto a Better Auth request/API header set.
+ *
+ * This is the only writer of the handoff header, and it always writes: with a
+ * context it sets ours, without one it deletes whatever was there. The header
+ * is unsigned and outranks the request cookie when the hook reads it, so an
+ * inbound copy from the public internet is an attacker-supplied `anonymous_id`
+ * and campaign for someone else's signup row. Never merge — replace.
+ */
 export function addSignupAttributionHeader(headers, context) {
     const result = new Headers(headers);
+    if (!context) {
+        result.delete(SIGNUP_ATTRIBUTION_HEADER_NAME);
+        return result;
+    }
     result.set(SIGNUP_ATTRIBUTION_HEADER_NAME, encodeSignupAttributionContext(context));
     return result;
 }

package/dist/server/auth.js

@@ -61,7 +61,7 @@ import { getAppProductionUrl } from "./app-url.js";
 import { addSignupAttributionHeader, readAnalyticsAnonymousId, readFirstTouchAttribution, signupAttributionContextFromCookieHeader, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getAuthLoginMode } from "./auth-login-mode.js";
 import { injectBetaOptOutPersistence } from "./beta-opt-out-html.js";
-import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getAuthSecret, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
+import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getBetterAuthUserIdForEmail, getAuthSecret, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
 import { BUILDER_CONNECT_PARAM, BUILDER_RELAY_PATH, BUILDER_RELAY_STATE_PARAM, verifyBuilderConnectTokenAndGetOwner, verifyBuilderPreviewRelayStateForCallback, } from "./builder-browser.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getAllowedCorsOrigin, readCorsAllowedOrigins, } from "./cors-origins.js";
@@ -93,6 +93,13 @@ function withSignupAttributionContext(cookieHeader, fn) {
         signupAttribution,
     }, fn);
 }
+/**
+ * Replace the internal attribution handoff on a request bound for Better
+ * Auth. Call this on every such request, including the ones with no
+ * attribution to add — the header is unsigned and outranks the request cookie
+ * inside the user-create hook, so an inbound copy is a stranger writing the
+ * `anonymous_id` and campaign of somebody else's signup.
+ */
 function requestWithSignupAttribution(request, signupAttribution) {
     return new Request(request, {
         headers: addSignupAttributionHeader(request.headers, signupAttribution),
@@ -3357,10 +3364,20 @@ async function mountBetterAuthRoutes(app, options) {
                     mobile,
                     trackSignup: {
                         authProvider: "google",
-                        authUserId: typeof user.id === "string" ? user.id : undefined,
+                        // The signup event joins to `referrer_user` in the virality
+                        // panels, which is always a Better Auth id — the Google profile
+                        // id that used to go here joined to nothing. Only looked up when
+                        // the event will actually be emitted.
+                        authUserId: isNewGoogleUser
+                            ? await getBetterAuthUserIdForEmail(email)
+                            : undefined,
                         name: typeof user.name === "string" ? user.name : undefined,
                         attribution: signupAttribution,
                         signupAnonymousId,
+                        // `ensureGoogleAuthIdentity` above already wrote the canonical
+                        // row, so this callback is the only thing that still knows
+                        // whether the person is new.
+                        isNewUser: isNewGoogleUser,
                     },
                 });
                 logGoogleOAuthDebug(event, "callback-session-created", {
@@ -3859,9 +3876,7 @@ async function mountBetterAuthRoutes(app, options) {
                 // validation error.
             }
         }
-        if (signupAttribution) {
-            requestForAuth = requestWithSignupAttribution(requestForAuth, signupAttribution);
-        }
+        requestForAuth = requestWithSignupAttribution(requestForAuth, signupAttribution);
         let response;
         try {
             response = await (isEmailSignup

package/dist/server/better-auth-instance.d.ts

@@ -6,12 +6,62 @@
  * implementation detail behind those interfaces.
  */
 import { type BetterAuthOptions } from "better-auth";
+import { type SignupOrigin } from "./attribution.js";
 export { getAuthLoginMode, resolveAuthLoginMode, resolveAuthLoginModeFromReadiness, type AuthLoginMode, } from "./auth-login-mode.js";
 export declare function hasBetterAuthUserEmail(email: string): Promise<boolean>;
+/**
+ * The canonical Better Auth user id for an email, or `undefined` when there
+ * is no row (or the adapter is unavailable).
+ *
+ * Signup events must carry this id, not the identity provider's subject id:
+ * the virality panels self-join `auth_user_id` against `referrer_user`, and
+ * `referrer_user` is always a Better Auth id, so a Google profile id in that
+ * column silently joins to nothing.
+ */
+export declare function getBetterAuthUserIdForEmail(email: string): Promise<string | undefined>;
+/**
+ * The endpoint context Better Auth (1.6.x) hands to `user.create.after`. It is
+ * `null` for any row created through `internalAdapter` outside an endpoint —
+ * see `emitSignupEventForCreatedUser`.
+ */
+export interface BetterAuthUserCreateContext {
+    headers?: Headers | null;
+    request?: {
+        headers?: Headers | null;
+        url?: string;
+    } | null;
+}
+/**
+ * Emit the `signup` event for a freshly created Better Auth `user` row — but
+ * only when that row is an actual person signing up.
+ *
+ * Better Auth runs its create hook on every `user` insert. Only inserts made
+ * through one of its HTTP endpoints carry the originating request; everything
+ * that reaches the row through `internalAdapter` directly gets a null context,
+ * because `getCurrentAuthContext()` throws outside an endpoint. Two production
+ * paths do exactly that, and neither is an acquisition:
+ *
+ *   - `ensureCanonicalUserForLegacySession` backfills a canonical row for
+ *     someone who signed up long ago, on an ordinary authenticated request.
+ *   - `ensureGoogleAuthIdentity` provisions the canonical row during the Google
+ *     callback, whose own attributed event `createOAuthSession` emits.
+ *
+ * Emitting for those is what broke campaign reporting: they arrived with no
+ * browser context and were recorded as `referral_source: "direct"`, so ~94% of
+ * `better-auth` signups were unattributable rows that were never signups, and
+ * one person provisioned across sibling apps counted as a dozen. A row insert
+ * is not an acquisition, so a context-free insert emits nothing at all.
+ */
+export declare function emitSignupEventForCreatedUser(user: {
+    id?: string;
+    email?: string;
+    name?: string | null;
+}, context?: BetterAuthUserCreateContext | null): Promise<void>;
 /** Return whether the canonical user has a verified Google account link. */
 export declare function hasGoogleAuthIdentity(email: string): Promise<boolean | undefined>;
-export declare function trackSignupEvent({ authProvider, authUserId, email, name, attribution, anonymousId, }: {
+export declare function trackSignupEvent({ authProvider, origin, authUserId, email, name, attribution, anonymousId, }: {
     authProvider: string;
+    origin: SignupOrigin;
     authUserId?: string;
     email: string;
     name?: string | null;
@@ -20,7 +70,9 @@ export declare function trackSignupEvent({ authProvider, authUserId, email, name
      * cookie (see `server/attribution.ts`). Snake_case keys such as
      * `referral_source`, `referrer_user`, and the UTM passthrough are merged
      * into the `signup` event so we can measure where new users came from.
-     * `undefined` values are dropped; a missing object is a clean no-op.
+     * `undefined` values are dropped; a missing object is a clean no-op — and
+     * it must stay a no-op rather than defaulting to `direct`, so a signup we
+     * could not attribute stays visibly different from an unattributed visit.
      */
     attribution?: Record<string, string | undefined>;
     anonymousId?: string;

package/dist/server/better-auth-instance.js

@@ -56,6 +56,95 @@ export async function hasBetterAuthUserEmail(email) {
         .catch(() => null);
     return !!existing?.user?.email;
 }
+/**
+ * The canonical Better Auth user id for an email, or `undefined` when there
+ * is no row (or the adapter is unavailable).
+ *
+ * Signup events must carry this id, not the identity provider's subject id:
+ * the virality panels self-join `auth_user_id` against `referrer_user`, and
+ * `referrer_user` is always a Better Auth id, so a Google profile id in that
+ * column silently joins to nothing.
+ */
+export async function getBetterAuthUserIdForEmail(email) {
+    const adapter = await getBetterAuthInternalAdapter();
+    if (!adapter)
+        return undefined;
+    try {
+        const existing = await adapter.findUserByEmail(email.trim().toLowerCase(), {
+            includeAccounts: false,
+        });
+        return existing?.user?.id || undefined;
+    }
+    catch (error) {
+        // coercion-ok: this is analytics enrichment on the sign-in path. Failing
+        // the sign-in over it would be worse, and the only consequence is one
+        // event missing `auth_user_id` — never a wrong id. Logged, not swallowed.
+        console.error("[auth] failed to resolve the canonical user id for a signup event", error);
+        return undefined;
+    }
+}
+/**
+ * Emit the `signup` event for a freshly created Better Auth `user` row — but
+ * only when that row is an actual person signing up.
+ *
+ * Better Auth runs its create hook on every `user` insert. Only inserts made
+ * through one of its HTTP endpoints carry the originating request; everything
+ * that reaches the row through `internalAdapter` directly gets a null context,
+ * because `getCurrentAuthContext()` throws outside an endpoint. Two production
+ * paths do exactly that, and neither is an acquisition:
+ *
+ *   - `ensureCanonicalUserForLegacySession` backfills a canonical row for
+ *     someone who signed up long ago, on an ordinary authenticated request.
+ *   - `ensureGoogleAuthIdentity` provisions the canonical row during the Google
+ *     callback, whose own attributed event `createOAuthSession` emits.
+ *
+ * Emitting for those is what broke campaign reporting: they arrived with no
+ * browser context and were recorded as `referral_source: "direct"`, so ~94% of
+ * `better-auth` signups were unattributable rows that were never signups, and
+ * one person provisioned across sibling apps counted as a dozen. A row insert
+ * is not an acquisition, so a context-free insert emits nothing at all.
+ */
+export async function emitSignupEventForCreatedUser(user, context) {
+    const email = user?.email;
+    if (!email)
+        return;
+    const requestHeaders = context?.headers ?? context?.request?.headers ?? null;
+    if (!requestHeaders)
+        return;
+    const scoped = hasContinuationLocalRequestContext()
+        ? getRequestContext()
+        : undefined;
+    let attribution;
+    let anonymousId;
+    try {
+        const browser = 
+        // The signed magic-link token is the only source that survives the link
+        // being opened in a different browser than the one that requested it.
+        (context?.request?.url?.includes("newUserCallbackURL")
+            ? readMagicLinkSignupAttribution(context.request.url, getAuthSecret())
+            : undefined) ??
+            scoped?.signupAttribution ??
+            signupAttributionContextFromHeaders(requestHeaders) ??
+            signupAttributionContextFromCookieHeader(requestHeaders.get("cookie"));
+        attribution = browser?.attribution;
+        anonymousId = browser?.anonymousId;
+    }
+    catch (err) {
+        // Analytics must never block signup, but a parse failure is not "this
+        // visitor came direct" — leave both unset so the event shows the gap
+        // instead of inventing a source for it.
+        console.error("[auth] failed to derive signup attribution", err);
+    }
+    await trackSignupEvent({
+        authProvider: "better-auth",
+        origin: scoped?.signupOrigin ?? "browser_signup",
+        authUserId: user.id,
+        email,
+        name: user.name,
+        attribution,
+        anonymousId,
+    });
+}
 /** Return whether the canonical user has a verified Google account link. */
 export async function hasGoogleAuthIdentity(email) {
     const adapter = await getBetterAuthInternalAdapter();
@@ -67,7 +156,7 @@ export async function hasGoogleAuthIdentity(email) {
     return (existing?.accounts.some((account) => account.providerId === "google") ??
         false);
 }
-export async function trackSignupEvent({ authProvider, authUserId, email, name, attribution, anonymousId, }) {
+export async function trackSignupEvent({ authProvider, origin, authUserId, email, name, attribution, anonymousId, }) {
     identify(email, {
         email,
         name: name ?? undefined,
@@ -84,6 +173,7 @@ export async function trackSignupEvent({ authProvider, authUserId, email, name,
     track("signup", {
         ...resolveSignupTrackingProperties(),
         auth_provider: authProvider,
+        signup_origin: origin,
         ...(authUserId ? { auth_user_id: authUserId } : {}),
         ...cleanAttribution,
     }, { userId: email, ...(anonymousId ? { anonymousId } : {}) });
@@ -1064,54 +1154,12 @@ async function createBetterAuthInstance(config) {
                     // signups the callback request's headers), which is where the
                     // browser's `an_ft` first-touch cookie rides in.
                     context) => {
-                        // When a newly-created user's email has pending org invitations
-                        // (common when someone is invited *before* they've signed up),
-                        // auto-accept them so the user lands in the org on their very
-                        // first page load instead of a blank-slate workspace.
                         const email = user?.email;
                         if (!email)
                             return;
-                        // Derive first-touch referral attribution from the request's
-                        // cookie header. Never let attribution parsing throw or block
-                        // signup — on any error fall back to `direct`.
-                        let attribution;
-                        let anonymousId;
-                        try {
-                            const cookieHeader = context?.headers?.get("cookie") ??
-                                context?.request?.headers?.get("cookie") ??
-                                null;
-                            const scopedSignupAttribution = hasContinuationLocalRequestContext()
-                                ? getRequestContext()?.signupAttribution
-                                : undefined;
-                            const requestSignupAttribution = signupAttributionContextFromCookieHeader(cookieHeader);
-                            const headerSignupAttribution = signupAttributionContextFromHeaders(context?.headers) ??
-                                signupAttributionContextFromHeaders(context?.request?.headers);
-                            const magicLinkAttribution = context?.request?.url?.includes("newUserCallbackURL")
-                                ? readMagicLinkSignupAttribution(context.request.url, getAuthSecret())
-                                : undefined;
-                            attribution =
-                                magicLinkAttribution?.attribution ??
-                                    scopedSignupAttribution?.attribution ??
-                                    headerSignupAttribution?.attribution ??
-                                    requestSignupAttribution.attribution;
-                            anonymousId =
-                                magicLinkAttribution?.anonymousId ??
-                                    scopedSignupAttribution?.anonymousId ??
-                                    headerSignupAttribution?.anonymousId ??
-                                    requestSignupAttribution.anonymousId;
-                        }
-                        catch (err) {
-                            console.error("[auth] failed to derive signup attribution", err);
-                            attribution = undefined;
-                        }
-                        await trackSignupEvent({
-                            authProvider: "better-auth",
-                            authUserId: user.id,
-                            email,
-                            name: user.name,
-                            attribution,
-                            anonymousId,
-                        });
+                        await emitSignupEventForCreatedUser(user, context);
+                        // Invitations and domain auto-join are about the row existing, not
+                        // about how it got here, so they run for backfills too.
                         try {
                             await acceptPendingInvitationsForEmail(email);
                         }

package/dist/server/google-oauth.d.ts

@@ -192,6 +192,15 @@ export declare function createOAuthSession(event: H3Event, email: string, opts:
         name?: string | null;
         attribution?: Record<string, string | undefined>;
         signupAnonymousId?: string;
+        /**
+         * Whether this callback created the account, decided by the caller at
+         * the moment it created it. Callers that provision the canonical user
+         * before getting here MUST pass this: the `hasBetterAuthUserEmail`
+         * probe below then reads the row they just wrote and concludes the
+         * person is an existing user, which silently deleted the only
+         * attributed signup event Google sign-in produces.
+         */
+        isNewUser?: boolean;
     };
 }): Promise<OAuthSessionResult>;
 /**

package/dist/server/google-oauth.js

@@ -562,11 +562,12 @@ export async function createOAuthSession(event, email, opts) {
     let shouldTrackSignup = false;
     if (!opts.hasProductionSession || needsDeepLink) {
         if (opts.trackSignup && !opts.hasProductionSession) {
-            const [hasLegacySession, hasBetterAuthUser] = await Promise.all([
-                hasLegacySessionForEmail(email).catch(() => true),
-                hasBetterAuthUserEmail(email).catch(() => true),
-            ]);
-            shouldTrackSignup = !hasLegacySession && !hasBetterAuthUser;
+            shouldTrackSignup =
+                opts.trackSignup.isNewUser ??
+                    (await Promise.all([
+                        hasLegacySessionForEmail(email).catch(() => true),
+                        hasBetterAuthUserEmail(email).catch(() => true),
+                    ]).then(([hasLegacySession, hasUser]) => !hasLegacySession && !hasUser));
         }
         sessionToken = crypto.randomBytes(32).toString("hex");
         await addSession(sessionToken, email);
@@ -578,6 +579,7 @@ export async function createOAuthSession(event, email, opts) {
                 readAnalyticsAnonymousId(getHeader(event, "cookie") ?? null);
             await trackSignupEvent({
                 authProvider: opts.trackSignup.authProvider,
+                origin: "google_oauth",
                 authUserId: opts.trackSignup.authUserId,
                 email,
                 name: opts.trackSignup.name,

package/dist/server/identity-sso.js

@@ -474,6 +474,10 @@ export async function handleIdentitySso(event, subpath) {
                 ? runWithRequestContext({
                     ...(getRequestContext() ?? {}),
                     signupAttribution,
+                    // This person already signed up somewhere; we are provisioning
+                    // them into this app. Counting it as an acquisition is how one
+                    // human became a dozen "signups" across sibling apps.
+                    signupOrigin: "sso_jit",
                 }, linkIdentity)
                 : linkIdentity());
         }

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/dist/server/request-context.d.ts

@@ -115,6 +115,12 @@ export interface RequestContext {
      * async user-create hook. Analytics-only; never used for authorization.
      */
     signupAttribution?: SignupAttributionContext;
+    /**
+     * Which flow is creating a user row on this request. Set by callers that
+     * provision an identity rather than acquire a new person, so the signup
+     * event they trigger says so instead of impersonating a browser signup.
+     */
+    signupOrigin?: import("./attribution.js").SignupOrigin;
     /** Canonical client surface for analytics attribution. */
     clientPlatform?: import("../shared/analytics-platform.js").AnalyticsClientPlatform;
     /**

package/dist/server/transcribe-voice.d.ts

@@ -20,6 +20,6 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    text: string;
     error?: undefined;
+    text: string;
 }>>;

package/dist/tracking/providers.js

@@ -324,6 +324,9 @@ function createWebhookProvider(url, authHeader) {
                 event: event.name,
                 properties: event.properties,
                 userId: event.userId,
+                // Without this a webhook consumer cannot join a signup back to the
+                // anonymous pageviews that preceded it — the whole point of the id.
+                anonymousId: event.anonymousId,
                 sessionId: event.sessionId,
                 timestamp: event.timestamp,
             }), extra);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.172.6",
+  "version": "0.172.9",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {