@agent-native/core 0.201.1 → 0.201.2-nightly-20261006010750

package/dist/automation/index.d.ts

@@ -139,8 +139,8 @@ export declare function createAutomationCallbackHandler(runtime: AutomationRunti
     duplicate?: undefined;
     eventId?: undefined;
 } | {
+    error?: undefined;
     accepted: boolean;
     duplicate: boolean;
     eventId: string;
-    error?: undefined;
 }>;

package/dist/client/analytics/index.d.ts

@@ -1,2 +1,2 @@
-export { AGENT_NATIVE_EXCEPTION_EVENT_NAME, addErrorBreadcrumb, captureAttribution, captureClientException, captureError, captureException, captureMessage, clearAnalyticsSessionId, configureTracking, getAnalyticsAnonymousId, getAnalyticsSessionId, getFirstTouchAttribution, getSessionReplayContext, getSessionReplayUrl, isErrorCaptureInstalled, maybeStartSessionReplay, setAnalyticsSessionId, setSentryUser, setTrackingContentCaptureEnabled, setTrackingIdentity, startSessionReplay, stopSessionReplay, trackAgentChatLifecycle, trackAnonymousEvent, trackEvent, trackLifecycleEvent, trackSessionStatus, type AgentChatLifecycleEvent, type CaptureExceptionContext, type CapturedExceptionEvent, type ClientCaptureContext, type ConfigureTrackingOptions, type ErrorCaptureConfigOptions, type ExceptionBreadcrumb, type ExceptionLevel, type FirstTouchAttribution, type SessionReplayContext, type SessionReplayLinkOptions, type SessionReplayOptions, type SessionReplayStartResult, type SessionReplayUrlMatcher, type TrackingIdentityUser, } from "../analytics.js";
+export { AGENT_NATIVE_EXCEPTION_EVENT_NAME, addErrorBreadcrumb, captureAttribution, captureClientException, captureError, captureException, captureMessage, clearAnalyticsSessionId, configureTracking, getAnalyticsAnonymousId, getAnalyticsSessionId, getFirstTouchAttribution, getLastTouchAttribution, getSessionReplayContext, getSessionReplayUrl, isErrorCaptureInstalled, maybeStartSessionReplay, setAnalyticsSessionId, setSentryUser, setTrackingContentCaptureEnabled, setTrackingIdentity, startSessionReplay, stopSessionReplay, trackAgentChatLifecycle, trackAnonymousEvent, trackEvent, trackLifecycleEvent, trackSessionStatus, type AgentChatLifecycleEvent, type CaptureExceptionContext, type CapturedExceptionEvent, type ClientCaptureContext, type ConfigureTrackingOptions, type ErrorCaptureConfigOptions, type ExceptionBreadcrumb, type ExceptionLevel, type FirstTouchAttribution, type LastTouchAttribution, type SessionReplayContext, type SessionReplayLinkOptions, type SessionReplayOptions, type SessionReplayStartResult, type SessionReplayUrlMatcher, type TrackingIdentityUser, } from "../analytics.js";
 export { track } from "../track.js";

package/dist/client/analytics/index.js

@@ -1,2 +1,2 @@
-export { AGENT_NATIVE_EXCEPTION_EVENT_NAME, addErrorBreadcrumb, captureAttribution, captureClientException, captureError, captureException, captureMessage, clearAnalyticsSessionId, configureTracking, getAnalyticsAnonymousId, getAnalyticsSessionId, getFirstTouchAttribution, getSessionReplayContext, getSessionReplayUrl, isErrorCaptureInstalled, maybeStartSessionReplay, setAnalyticsSessionId, setSentryUser, setTrackingContentCaptureEnabled, setTrackingIdentity, startSessionReplay, stopSessionReplay, trackAgentChatLifecycle, trackAnonymousEvent, trackEvent, trackLifecycleEvent, trackSessionStatus, } from "../analytics.js";
+export { AGENT_NATIVE_EXCEPTION_EVENT_NAME, addErrorBreadcrumb, captureAttribution, captureClientException, captureError, captureException, captureMessage, clearAnalyticsSessionId, configureTracking, getAnalyticsAnonymousId, getAnalyticsSessionId, getFirstTouchAttribution, getLastTouchAttribution, getSessionReplayContext, getSessionReplayUrl, isErrorCaptureInstalled, maybeStartSessionReplay, setAnalyticsSessionId, setSentryUser, setTrackingContentCaptureEnabled, setTrackingIdentity, startSessionReplay, stopSessionReplay, trackAgentChatLifecycle, trackAnonymousEvent, trackEvent, trackLifecycleEvent, trackSessionStatus, } from "../analytics.js";
 export { track } from "../track.js";

package/dist/client/analytics.d.ts

@@ -86,14 +86,34 @@ export interface FirstTouchAttribution {
     landed_at?: string;
     capture_truncated?: string;
 }
+/** The latest visit that had a source; see `captureLastTouchAttribution`. */
+export interface LastTouchAttribution {
+    ref?: string;
+    via?: string;
+    utm_source?: string;
+    utm_medium?: string;
+    utm_campaign?: string;
+    utm_content?: string;
+    utm_term?: string;
+    gclid?: string;
+    msclkid?: string;
+    vector_source?: string;
+    landing_referrer?: string;
+    site_referrer?: string;
+    site_landing_path?: string;
+    landing_path?: string;
+    touched_at?: string;
+    capture_truncated?: string;
+}
 export declare function getAnalyticsIdentityKey(): string | undefined;
 export declare function getAnalyticsAnonymousId(): string | undefined;
 export declare function getAnalyticsSessionId(): string | undefined;
 export declare function getFirstTouchAttribution(): FirstTouchAttribution | null;
+export declare function getLastTouchAttribution(): LastTouchAttribution | null;
 /**
- * Store the visitor's first touch now instead of in `configureTracking()`,
- * for a page that reads it before tracking starts. It runs once per page
- * load, so tracking's own capture is then a no-op.
+ * Store the visitor's first and last touch now instead of in
+ * `configureTracking()`, for a page that reads them before tracking starts.
+ * It runs once per page load, so tracking's own capture is then a no-op.
  */
 export declare function captureAttribution(): void;
 export declare function setSentryUser(user: TrackingIdentityUser | null, orgId?: string | null): void;

package/dist/client/analytics.js

@@ -1,6 +1,7 @@
 import { recordTrackingEvent } from "../observability/tracing.js";
 import { AGENT_NATIVE_LIFECYCLE_EVENTS, canonicalTrackingEvent, legacyLifecycleEvent, normalizeTrackingDimension, withCanonicalTrackingProperties, } from "../shared/analytics-events.js";
 import { ANALYTICS_CLIENT_PLATFORM_PROPERTY, } from "../shared/analytics-platform.js";
+import { hasAttributionSource } from "../shared/attribution-source.js";
 import { resolveLaneEndpoint } from "../shared/environment-lanes.js";
 import { classifyErrorNoise, } from "../shared/error-noise.js";
 import { llmConnectionTrackingProperties, } from "../shared/llm-connection.js";
@@ -101,6 +102,72 @@ const FIRST_TOUCH_COOKIE_FIELD_PRIORITY = [
     "site_landing_path",
     "landed_at",
 ];
+const LAST_TOUCH_STORAGE_KEY = "an_last_touch";
+const LAST_TOUCH_COOKIE_NAME = "an_lt";
+// Small enough that both cookies still fit the signup handoff header.
+const LAST_TOUCH_MAX_COOKIE_BYTES = 700;
+// What a sourced visit keeps as last touch, besides its path and time.
+const LAST_TOUCH_SOURCE_FIELDS = [
+    "ref",
+    "via",
+    "utm_source",
+    "utm_medium",
+    "utm_campaign",
+    "utm_content",
+    "utm_term",
+    "gclid",
+    "msclkid",
+    "vector_source",
+    "landing_referrer",
+    "site_referrer",
+];
+// Which fields the cookie keeps first when they don't all fit.
+const LAST_TOUCH_COOKIE_FIELD_PRIORITY = [
+    "ref",
+    "gclid",
+    "msclkid",
+    "vector_source",
+    "utm_source",
+    "utm_medium",
+    "utm_campaign",
+    "via",
+    "utm_content",
+    "utm_term",
+    "landing_referrer",
+    "site_referrer",
+    "landing_path",
+    "touched_at",
+    "site_landing_path",
+];
+// The marketing site forwards its own last touch under these names when it
+// differs from the first touch it forwards as plain campaign params.
+const FORWARDED_LAST_TOUCH_FIELDS = {
+    last_ref: "ref",
+    last_via: "via",
+    last_utm_source: "utm_source",
+    last_utm_medium: "utm_medium",
+    last_utm_campaign: "utm_campaign",
+    last_utm_content: "utm_content",
+    last_utm_term: "utm_term",
+    last_gclid: "gclid",
+    last_msclkid: "msclkid",
+    last_vector_source: "vector_source",
+    last_referrer: "site_referrer",
+    last_landing_path: "site_landing_path",
+};
+// When the site's latest sourced visit happened, so an older site visit can't
+// replace a newer one the app already has.
+const FORWARDED_LAST_TOUCH_AT_PARAM = "last_at";
+const FIRST_TOUCH_COOKIE = {
+    name: FIRST_TOUCH_COOKIE_NAME,
+    maxBytes: FIRST_TOUCH_MAX_COOKIE_BYTES,
+    priority: FIRST_TOUCH_COOKIE_FIELD_PRIORITY,
+};
+const LAST_TOUCH_COOKIE = {
+    name: LAST_TOUCH_COOKIE_NAME,
+    maxBytes: LAST_TOUCH_MAX_COOKIE_BYTES,
+    priority: LAST_TOUCH_COOKIE_FIELD_PRIORITY,
+};
 let _firstTouchCaptured = false;
 function safeStorageGet(key) {
     try {
@@ -390,7 +457,7 @@ function buildFirstTouchAttribution() {
     attribution.landed_at = new Date().toISOString();
     return attribution;
 }
-function readFirstTouchCookie() {
+function readAttributionCookie(cookieName) {
     if (typeof document === "undefined")
         return null;
     try {
@@ -400,7 +467,7 @@ function readFirstTouchCookie() {
             if (eq === -1)
                 continue;
             const name = part.slice(0, eq).trim();
-            if (name === FIRST_TOUCH_COOKIE_NAME) {
+            if (name === cookieName) {
                 return part.slice(eq + 1).trim();
             }
         }
@@ -410,15 +477,16 @@ function readFirstTouchCookie() {
     }
     return null;
 }
-function firstTouchCookieAssignment(encodedValue) {
-    return (`${FIRST_TOUCH_COOKIE_NAME}=${encodedValue}; path=/; ` +
+function attributionCookieAssignment(cookieName, encodedValue) {
+    return (`${cookieName}=${encodedValue}; path=/; ` +
         `max-age=${FIRST_TOUCH_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax`);
 }
-function fitFirstTouchCookieValue(value) {
+function fitAttributionCookieValue(value, spec) {
     const source = JSON.parse(value);
     const compact = {};
     let truncated = false;
-    for (const field of FIRST_TOUCH_COOKIE_FIELD_PRIORITY) {
+    const fits = (encoded) => attributionCookieAssignment(spec.name, encoded).length <= spec.maxBytes;
+    for (const field of spec.priority) {
         const rawValue = source[field];
         if (typeof rawValue !== "string" || !rawValue)
             continue;
@@ -426,9 +494,8 @@ function fitFirstTouchCookieValue(value) {
             ...compact,
             [field]: rawValue.slice(0, FIRST_TOUCH_MAX_FIELD_LENGTH),
         };
-        const encoded = encodeURIComponent(JSON.stringify(candidate));
-        if (firstTouchCookieAssignment(encoded).length <= FIRST_TOUCH_MAX_COOKIE_BYTES) {
-            Object.assign(compact, { [field]: candidate[field] });
+        if (fits(encodeURIComponent(JSON.stringify(candidate)))) {
+            compact[field] = candidate[field];
         }
         else {
             truncated = true;
@@ -437,38 +504,63 @@ function fitFirstTouchCookieValue(value) {
     if (truncated) {
         compact.capture_truncated = "1";
         // Keep the auth handoff under its 4 KB header limit after re-encoding.
-        for (const field of [...FIRST_TOUCH_COOKIE_FIELD_PRIORITY].reverse()) {
+        for (const field of [...spec.priority].reverse()) {
             const encoded = encodeURIComponent(JSON.stringify(compact));
-            if (firstTouchCookieAssignment(encoded).length <=
-                FIRST_TOUCH_MAX_COOKIE_BYTES) {
+            if (fits(encoded))
                 return encoded;
-            }
             delete compact[field];
         }
     }
     const encoded = encodeURIComponent(JSON.stringify(compact));
-    if (firstTouchCookieAssignment(encoded).length > FIRST_TOUCH_MAX_COOKIE_BYTES) {
-        throw new Error("First-touch attribution exceeded the cookie budget");
+    if (!fits(encoded)) {
+        throw new Error(`Attribution exceeded the ${spec.name} cookie budget`);
     }
     return encoded;
 }
-function writeFirstTouchCookie(value) {
+function writeAttributionCookie(value, spec) {
     if (typeof document === "undefined")
         return;
-    const encodedValue = fitFirstTouchCookieValue(value);
+    const encodedValue = fitAttributionCookieValue(value, spec);
     try {
-        document.cookie = firstTouchCookieAssignment(encodedValue);
+        document.cookie = attributionCookieAssignment(spec.name, encodedValue);
     }
     catch {
         // best-effort
     }
 }
+function storeAttribution(storageKey, spec, attribution) {
+    const json = JSON.stringify(attribution);
+    safeStorageSet(storageKey, json);
+    writeAttributionCookie(json, spec);
+}
+/**
+ * Restore a cookie that expired or was cleared from its stored value, so the
+ * signup boundary still sees it.
+ */
+function backfillAttributionCookie(storageKey, spec) {
+    if (readAttributionCookie(spec.name))
+        return;
+    const stored = safeStorageGet(storageKey);
+    if (!stored)
+        return;
+    try {
+        writeAttributionCookie(stored, spec);
+    }
+    catch {
+        // coercion-ok: localStorage still holds the value; only this page's
+        // signup handoff goes without it.
+    }
+}
 /**
- * Capture the visitor's first-touch referral attribution exactly once. Reads
- * the current URL query params + landing info and, IF no attribution is
- * already stored (first-write-wins), persists it to both `localStorage`
- * (`an_attribution`) and the first-party `an_ft` cookie. Fully defensive and
- * SSR-safe — any failure is swallowed so it can never break app boot.
+ * Capture the visitor's referral attribution once per page load, into both
+ * `localStorage` and a first-party cookie the signup boundary reads. Fully
+ * defensive and SSR-safe — any failure is swallowed so it can never break app
+ * boot.
+ *
+ * First touch (`an_attribution` / `an_ft`) is first-write-wins, except over a
+ * visit that had no source: the first visit that says where this person came
+ * from replaces it. Without that, an untagged first visit would hide every
+ * tagged visit after it.
  */
 function captureFirstTouchAttribution() {
     if (_firstTouchCaptured)
@@ -477,35 +569,80 @@ function captureFirstTouchAttribution() {
     if (typeof window === "undefined")
         return;
     try {
-        const existing = safeStorageGet(FIRST_TOUCH_STORAGE_KEY);
-        if (existing) {
-            // Already captured in a prior visit. Backfill the cookie if it expired
-            // or was cleared so the signup boundary still sees first-touch data, but
-            // never overwrite the stored value itself (first-write-wins).
-            if (!readFirstTouchCookie()) {
-                try {
-                    writeFirstTouchCookie(existing);
-                }
-                catch {
-                    // ignore
-                }
-            }
-            return;
+        const current = buildFirstTouchAttribution();
+        const existing = getFirstTouchAttribution();
+        if (existing &&
+            (hasAttributionSource(existing) || !hasAttributionSource(current))) {
+            backfillAttributionCookie(FIRST_TOUCH_STORAGE_KEY, FIRST_TOUCH_COOKIE);
+        }
+        else {
+            storeAttribution(FIRST_TOUCH_STORAGE_KEY, FIRST_TOUCH_COOKIE, current);
         }
-        const attribution = buildFirstTouchAttribution();
-        const json = JSON.stringify(attribution);
-        safeStorageSet(FIRST_TOUCH_STORAGE_KEY, json);
-        writeFirstTouchCookie(json);
+        captureLastTouchAttribution(current);
     }
     catch {
         // Attribution is best-effort telemetry; never let it break boot.
     }
 }
-export function getFirstTouchAttribution() {
+/**
+ * Last touch (`an_last_touch` / `an_lt`) is the latest visit that had a
+ * source. When the marketing site forwards its own last touch, that visit is
+ * the one to keep, not the site's first touch riding on the same link. A site
+ * visit keeps the time it happened, and loses to a newer visit the app has
+ * already recorded.
+ */
+function captureLastTouchAttribution(current) {
+    const forwarded = readForwardedLastTouch();
+    const source = forwarded ?? (hasAttributionSource(current) ? current : null);
+    const forwardedAt = readForwardedLastTouchAt();
+    const existing = getLastTouchAttribution();
+    const existingAt = Date.parse(existing?.touched_at ?? "");
+    if (!source ||
+        (forwardedAt &&
+            hasAttributionSource(existing) &&
+            existingAt > Date.parse(forwardedAt))) {
+        backfillAttributionCookie(LAST_TOUCH_STORAGE_KEY, LAST_TOUCH_COOKIE);
+        return;
+    }
+    const lastTouch = {};
+    for (const field of LAST_TOUCH_SOURCE_FIELDS) {
+        const value = source[field];
+        if (value)
+            lastTouch[field] = value;
+    }
+    // As for first touch, `landing_path` is where the visitor entered this app
+    // and `site_landing_path` the marketing-site page the touch landed on.
+    if (current.landing_path)
+        lastTouch.landing_path = current.landing_path;
+    if (source.site_landing_path) {
+        lastTouch.site_landing_path = source.site_landing_path;
+    }
+    lastTouch.touched_at = forwardedAt ?? current.landed_at;
+    storeAttribution(LAST_TOUCH_STORAGE_KEY, LAST_TOUCH_COOKIE, lastTouch);
+}
+function readForwardedLastTouchAt() {
+    const raw = new URLSearchParams(window.location.search).get(FORWARDED_LAST_TOUCH_AT_PARAM);
+    const time = Date.parse(raw ?? "");
+    // A visit can't be in the future; a bad clock or value means "now".
+    if (!Number.isFinite(time) || time > Date.now())
+        return undefined;
+    return new Date(time).toISOString();
+}
+function readForwardedLastTouch() {
+    const params = new URLSearchParams(window.location.search);
+    const forwarded = {};
+    for (const [param, field] of Object.entries(FORWARDED_LAST_TOUCH_FIELDS)) {
+        const value = truncateFirstTouchField(params.get(param));
+        if (value)
+            forwarded[field] = value;
+    }
+    return hasAttributionSource(forwarded) ? forwarded : null;
+}
+function readStoredAttribution(storageKey) {
     if (typeof window === "undefined")
         return null;
     try {
-        const raw = safeStorageGet(FIRST_TOUCH_STORAGE_KEY);
+        const raw = safeStorageGet(storageKey);
         if (!raw)
             return null;
         const parsed = JSON.parse(raw);
@@ -518,10 +655,16 @@ export function getFirstTouchAttribution() {
         return null;
     }
 }
+export function getFirstTouchAttribution() {
+    return readStoredAttribution(FIRST_TOUCH_STORAGE_KEY);
+}
+export function getLastTouchAttribution() {
+    return readStoredAttribution(LAST_TOUCH_STORAGE_KEY);
+}
 /**
- * Store the visitor's first touch now instead of in `configureTracking()`,
- * for a page that reads it before tracking starts. It runs once per page
- * load, so tracking's own capture is then a no-op.
+ * Store the visitor's first and last touch now instead of in
+ * `configureTracking()`, for a page that reads them before tracking starts.
+ * It runs once per page load, so tracking's own capture is then a no-op.
  */
 export function captureAttribution() {
     if (isSyntheticBrowserTraffic())

package/dist/collab/struct-routes.d.ts

@@ -1,6 +1,6 @@
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/mcp/screen-memory-stdio.d.ts

@@ -140,13 +140,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
-            count?: undefined;
         };
         required?: undefined;
     };
@@ -171,13 +171,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
-            count?: undefined;
         };
         required?: undefined;
     };
@@ -196,13 +196,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
-            count?: undefined;
         };
         required?: undefined;
     };
@@ -231,13 +231,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
-            count?: undefined;
         };
     };
 } | {
@@ -260,12 +260,12 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;
             requestId?: undefined;
-            count?: undefined;
         };
     };
 } | {
@@ -317,6 +317,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -336,7 +337,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 type: string;
             };
             requestId?: undefined;
-            count?: undefined;
         };
     };
 } | {
@@ -352,6 +352,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -360,7 +361,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             requestId: {
                 type: string;
             };
-            count?: undefined;
         };
     };
 })[];

package/dist/notifications/routes.d.ts

@@ -1,13 +1,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;
@@ -16,6 +16,6 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
 } | {
     count?: undefined;
     updated?: undefined;
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/observability/routes.d.ts

@@ -27,38 +27,38 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
     error: string;
     message: string;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
+    ok?: undefined;
     message?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/resources/handlers.d.ts

@@ -39,8 +39,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
     error: string;
 }>;
 export declare function handleDeleteResource(event: any): Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -58,47 +58,47 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     error: string;
     errorCode?: undefined;
     retryable?: undefined;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable?: undefined;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable: boolean;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-access.js

@@ -1,8 +1,8 @@
 import { DEFAULT_AGENT_ACCESS_TTL_SECONDS, scopedAgentAccessResourceId, } from "../shared/agent-access.js";
-import { signShortLivedToken, verifyShortLivedToken, } from "./short-lived-token.js";
+import { signCompactShortLivedToken, verifyCompactShortLivedToken, verifyShortLivedToken, } from "./short-lived-token.js";
 export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, toAgentAccessUrl, } from "../shared/agent-access.js";
 export function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEmail, agentLabel, ttlSeconds = DEFAULT_AGENT_ACCESS_TTL_SECONDS, }) {
-    return signShortLivedToken({
+    return signCompactShortLivedToken({
         resourceId: scopedAgentAccessResourceId(resourceKind, resourceId),
         viewerEmail,
         agentLabel,
@@ -12,7 +12,11 @@ export function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEma
 export function verifyScopedAgentAccessToken(token, scope) {
     if (!token)
         return { ok: false, reason: "missing" };
-    return verifyShortLivedToken(token, scopedAgentAccessResourceId(scope.resourceKind, scope.resourceId));
+    const resourceId = scopedAgentAccessResourceId(scope.resourceKind, scope.resourceId);
+    const compact = verifyCompactShortLivedToken(token, resourceId);
+    if (compact.ok || compact.reason !== "bad_signature")
+        return compact;
+    return verifyShortLivedToken(token, resourceId);
 }
 export function createScopedAgentAccessGrant(options) {
     const ttlSeconds = options.ttlSeconds ?? DEFAULT_AGENT_ACCESS_TTL_SECONDS;

package/dist/server/agent-engine-default-model-route.d.ts

@@ -16,9 +16,9 @@ export declare function createAgentEngineDisconnectHandler(): import("h3").Event
     error: any;
     scope?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     scope: "org" | "user";
-    error?: undefined;
 }>>;
 export interface DefaultModelSelectionRequest {
     engine: string;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,9 +1,9 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    models?: undefined;
     ok?: undefined;
+    models?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     models: string[];
-    error?: undefined;
 }>>;

package/dist/server/attribution.d.ts

@@ -8,6 +8,11 @@
  * request and enriches the canonical server-side `signup` event so we can
  * measure where new users came from and how apps spread (virality).
  *
+ * The browser also keeps the visitor's *last* visit that had a source in an
+ * `an_lt` cookie. First touch answers "how did they find us?" and credits
+ * acquisition; last touch answers "what brought them to sign up?" and credits
+ * the post, video, or person that converted them.
+ *
  * This module is intentionally pure and dependency-free so it is trivially
  * unit-testable and can never throw into the signup path. The single hard rule:
  * parsing untrusted cookie input must NEVER throw — every accessor is defensive.
@@ -36,6 +41,25 @@ export interface FirstTouchAttribution {
     landed_at?: string;
     capture_truncated?: string;
 }
+/** The decoded `an_lt` cookie: the latest visit that had a source. */
+export interface LastTouchAttribution {
+    ref?: string;
+    via?: string;
+    utm_source?: string;
+    utm_medium?: string;
+    utm_campaign?: string;
+    utm_content?: string;
+    utm_term?: string;
+    gclid?: string;
+    msclkid?: string;
+    vector_source?: string;
+    landing_referrer?: string;
+    site_referrer?: string;
+    site_landing_path?: string;
+    landing_path?: string;
+    touched_at?: string;
+    capture_truncated?: string;
+}
 export type SignupOrigin = "browser_signup"
 /** The framework's Google OAuth callback owns this event. */
  | "google_oauth"
@@ -47,20 +71,28 @@ export interface SignupAttributionContext {
 }
 export declare const SIGNUP_ATTRIBUTION_HEADER_NAME = "x-agent-native-signup-attribution";
 export declare const FIRST_TOUCH_COOKIE_NAME = "an_ft";
+export declare const LAST_TOUCH_COOKIE_NAME = "an_lt";
 /**
  * Parse a raw `Cookie:` header into a flat name→value map. Tolerates missing
  * input, extra whitespace, `=` inside values, and malformed pairs. Never throws.
  */
 export declare function parseCookieHeader(cookieHeader: string | null | undefined): Record<string, string>;
 export declare function decodeFirstTouchValue(value: string | null | undefined): FirstTouchAttribution | null;
+export declare function decodeLastTouchValue(value: string | null | undefined): LastTouchAttribution | null;
 /**
  * Read the `an_ft` first-touch attribution out of a raw `Cookie:` header.
  * Returns `null` when the cookie is absent or unparseable. Never throws.
  */
 export declare function readFirstTouchAttribution(cookieHeader: string | null | undefined): FirstTouchAttribution | null;
+/**
+ * Read the `an_lt` last-touch attribution out of a raw `Cookie:` header.
+ * Returns `null` when the cookie is absent or unparseable. Never throws.
+ */
+export declare function readLastTouchAttribution(cookieHeader: string | null | undefined): LastTouchAttribution | null;
 export declare function readAnalyticsAnonymousId(cookieHeader: string | null | undefined): string | undefined;
-export declare function deriveReferralSource(ft: FirstTouchAttribution | null): string;
+export declare function deriveReferralSource(ft: FirstTouchAttribution | LastTouchAttribution | null): string;
 export declare function deriveSignupAttribution(ft: FirstTouchAttribution | null): Record<string, string>;
+export declare function deriveLastTouchAttribution(lt: LastTouchAttribution | null): Record<string, string>;
 /**
  * Convenience: read the cookie header and derive signup attribution in one
  * call. Never throws; falls back to `{ referral_source: "direct" }` on any

package/dist/server/attribution.js

@@ -1,7 +1,9 @@
-import { ANALYTICS_ANONYMOUS_ID_COOKIE_NAME, normalizeAnalyticsAnonymousId, } from "../shared/analytics-anonymous-id.js";
+import { ANALYTICS_ANONYMOUS_ID_COOKIE_NAME, ANALYTICS_ANONYMOUS_ID_MAX_LENGTH, normalizeAnalyticsAnonymousId, } from "../shared/analytics-anonymous-id.js";
+import { isSourceReferrerHost, shareLandingSource, } from "../shared/attribution-source.js";
 export const SIGNUP_ATTRIBUTION_HEADER_NAME = "x-agent-native-signup-attribution";
 const SIGNUP_ATTRIBUTION_HEADER_MAX_LENGTH = 4096;
 export const FIRST_TOUCH_COOKIE_NAME = "an_ft";
+export const LAST_TOUCH_COOKIE_NAME = "an_lt";
 const STRING_FIELDS = [
     "ref",
     "via",
@@ -20,6 +22,24 @@ const STRING_FIELDS = [
     "landed_at",
     "capture_truncated",
 ];
+const LAST_TOUCH_STRING_FIELDS = [
+    "ref",
+    "via",
+    "utm_source",
+    "utm_medium",
+    "utm_campaign",
+    "utm_content",
+    "utm_term",
+    "gclid",
+    "msclkid",
+    "vector_source",
+    "landing_referrer",
+    "site_referrer",
+    "site_landing_path",
+    "landing_path",
+    "touched_at",
+    "capture_truncated",
+];
 /**
  * Parse a raw `Cookie:` header into a flat name→value map. Tolerates missing
  * input, extra whitespace, `=` inside values, and malformed pairs. Never throws.
@@ -44,6 +64,12 @@ export function parseCookieHeader(cookieHeader) {
     return out;
 }
 export function decodeFirstTouchValue(value) {
+    return decodeAttributionCookieValue(value, STRING_FIELDS);
+}
+export function decodeLastTouchValue(value) {
+    return decodeAttributionCookieValue(value, LAST_TOUCH_STRING_FIELDS);
+}
+function decodeAttributionCookieValue(value, fields) {
     if (!value || typeof value !== "string")
         return null;
     let decoded = value;
@@ -66,7 +92,7 @@ export function decodeFirstTouchValue(value) {
     const source = parsed;
     const result = {};
     let any = false;
-    for (const field of STRING_FIELDS) {
+    for (const field of fields) {
         const raw = source[field];
         if (typeof raw === "string" && raw.length > 0) {
             result[field] = raw.slice(0, 120);
@@ -88,6 +114,14 @@ export function readFirstTouchAttribution(cookieHeader) {
         return null;
     }
 }
+/**
+ * Read the `an_lt` last-touch attribution out of a raw `Cookie:` header.
+ * Returns `null` when the cookie is absent or unparseable. Never throws.
+ */
+export function readLastTouchAttribution(cookieHeader) {
+    const cookies = parseCookieHeader(cookieHeader);
+    return decodeLastTouchValue(cookies[LAST_TOUCH_COOKIE_NAME]);
+}
 export function readAnalyticsAnonymousId(cookieHeader) {
     try {
         return normalizeAnalyticsAnonymousId(parseCookieHeader(cookieHeader)[ANALYTICS_ANONYMOUS_ID_COOKIE_NAME]);
@@ -96,25 +130,14 @@ export function readAnalyticsAnonymousId(cookieHeader) {
         return undefined;
     }
 }
-function isExternalReferrerHost(host) {
-    const trimmed = host?.trim();
-    return !!trimmed && trimmed.length > 0;
-}
 export function deriveReferralSource(ft) {
     if (ft?.ref && ft.ref.trim())
         return ft.ref.trim();
-    const path = ft?.landing_path ?? "";
-    if (path.startsWith("/share/"))
-        return "clip_share";
-    if (path.includes("/p/") ||
-        path.includes("/plan/") ||
-        path.includes("/plans/") ||
-        path.includes("/recaps/") ||
-        path.includes("/share-plan/")) {
-        return "plan_share";
-    }
-    if (isExternalReferrerHost(ft?.landing_referrer) ||
-        isExternalReferrerHost(ft?.site_referrer)) {
+    const shareSource = shareLandingSource(ft?.landing_path);
+    if (shareSource)
+        return shareSource;
+    if (isSourceReferrerHost(ft?.landing_referrer) ||
+        isSourceReferrerHost(ft?.site_referrer)) {
         return "external";
     }
     return "direct";
@@ -149,6 +172,54 @@ export function deriveSignupAttribution(ft) {
         out.attribution_truncated = "true";
     return out;
 }
+export function deriveLastTouchAttribution(lt) {
+    if (!lt)
+        return {};
+    const out = {
+        last_touch_source: deriveReferralSource(lt),
+    };
+    const setIf = (key, value) => {
+        const trimmed = value?.trim();
+        if (trimmed)
+            out[key] = trimmed;
+    };
+    setIf("last_touch_ref", lt.ref);
+    setIf("last_touch_via", lt.via);
+    setIf("last_touch_utm_source", lt.utm_source);
+    setIf("last_touch_utm_medium", lt.utm_medium);
+    setIf("last_touch_utm_campaign", lt.utm_campaign);
+    setIf("last_touch_utm_content", lt.utm_content);
+    setIf("last_touch_utm_term", lt.utm_term);
+    setIf("last_touch_gclid", lt.gclid);
+    setIf("last_touch_msclkid", lt.msclkid);
+    setIf("last_touch_vector_source", lt.vector_source);
+    setIf("last_touch_referrer", lt.landing_referrer);
+    setIf("last_touch_site_referrer", lt.site_referrer);
+    setIf("last_touch_path", lt.landing_path);
+    setIf("last_touch_site_path", lt.site_landing_path);
+    setIf("last_touch_at", lt.touched_at);
+    // The browser dropped fields to fit the cookie.
+    if (lt.capture_truncated === "1")
+        out.last_touch_truncated = "true";
+    return out;
+}
+/**
+ * Add last touch only while the handoff still fits its header. An oversized
+ * header is dropped whole, which would lose first touch with it.
+ */
+function withLastTouchAttribution(attribution, lt) {
+    const lastTouch = deriveLastTouchAttribution(lt);
+    if (Object.keys(lastTouch).length === 0)
+        return attribution;
+    const merged = { ...attribution, ...lastTouch };
+    const largest = encodeSignupAttributionContext({
+        attribution: merged,
+        anonymousId: "a".repeat(ANALYTICS_ANONYMOUS_ID_MAX_LENGTH),
+    });
+    if (largest.length <= SIGNUP_ATTRIBUTION_HEADER_MAX_LENGTH)
+        return merged;
+    return { ...attribution, last_touch_truncated: "true" };
+}
 /**
  * Convenience: read the cookie header and derive signup attribution in one
  * call. Never throws; falls back to `{ referral_source: "direct" }` on any
@@ -156,7 +227,7 @@ export function deriveSignupAttribution(ft) {
  */
 export function signupAttributionFromCookieHeader(cookieHeader) {
     try {
-        return deriveSignupAttribution(readFirstTouchAttribution(cookieHeader));
+        return withLastTouchAttribution(deriveSignupAttribution(readFirstTouchAttribution(cookieHeader)), readLastTouchAttribution(cookieHeader));
     }
     catch {
         return { referral_source: "direct" };
@@ -176,11 +247,12 @@ export function signupAttributionFromCookieHeader(cookieHeader) {
  */
 export function signupAttributionContextFromCookieHeader(cookieHeader) {
     const firstTouch = readFirstTouchAttribution(cookieHeader);
+    const lastTouch = readLastTouchAttribution(cookieHeader);
     const anonymousId = readAnalyticsAnonymousId(cookieHeader);
-    if (!firstTouch && !anonymousId)
+    if (!firstTouch && !lastTouch && !anonymousId)
         return undefined;
     return {
-        attribution: deriveSignupAttribution(firstTouch),
+        attribution: withLastTouchAttribution(deriveSignupAttribution(firstTouch), lastTouch),
         ...(anonymousId ? { anonymousId } : {}),
     };
 }

package/dist/server/auth.js

@@ -62,7 +62,7 @@ import { injectAnalyticsIntoHtml } from "./analytics.js";
 import { getConfiguredAppBasePath, stripAppBasePath as stripConfiguredAppBasePath, } from "./app-base-path.js";
 import { getAppOriginClientConfigScript } from "./app-origin-config.js";
 import { getAppProductionUrl } from "./app-url.js";
-import { addSignupAttributionHeader, readAnalyticsAnonymousId, readFirstTouchAttribution, signupAttributionContextFromCookieHeader, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { addSignupAttributionHeader, readAnalyticsAnonymousId, signupAttributionContextFromCookieHeader, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getAuthLoginMode } from "./auth-login-mode.js";
 import { injectBetaOptOutPersistence } from "./beta-opt-out-html.js";
 import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getBetterAuthInternalAdapter, getBetterAuthUserIdForEmail, getAuthSecret, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
@@ -4948,15 +4948,9 @@ async function mountBetterAuthRoutes(app, options) {
                 callbackPath = withDesktopMagicLinkFlow(callbackPath, desktopFlow);
             }
             const callbackURL = betterAuthCallbackURL(callbackPath, true, event);
-            const cookieHeader = getHeader(event, "cookie") ?? null;
-            const signupAttribution = signupAttributionFromCookieHeader(cookieHeader);
-            const signupAnonymousId = readAnalyticsAnonymousId(cookieHeader);
-            const hasSignupAttribution = !!readFirstTouchAttribution(cookieHeader) || !!signupAnonymousId;
-            const attributionToken = hasSignupAttribution
-                ? encodeMagicLinkSignupAttribution({
-                    attribution: signupAttribution,
-                    anonymousId: signupAnonymousId,
-                }, getAuthSecret())
+            const signupContext = signupAttributionContextFromCookieHeader(getHeader(event, "cookie") ?? null);
+            const attributionToken = signupContext
+                ? encodeMagicLinkSignupAttribution(signupContext, getAuthSecret())
                 : undefined;
             const newUserCallbackUrl = new URL(`${getAppBasePath()}${publicFrameworkPath("/_agent-native/auth/magic-link/new-user")}?return=${encodeURIComponent(callbackPath)}`, getOrigin(event));
             if (attributionToken) {

package/dist/server/magic-link-attribution.js

@@ -2,7 +2,8 @@ import crypto from "node:crypto";
 import { normalizeAnalyticsAnonymousId } from "../shared/analytics-anonymous-id.js";
 export const MAGIC_LINK_ATTRIBUTION_PARAM = "signup_attribution";
 const MAGIC_LINK_ATTRIBUTION_TTL_SECONDS = 10 * 60;
-const MAX_ATTRIBUTION_FIELDS = 32;
+// A signup carries up to 17 first-touch and 16 last-touch properties.
+const MAX_ATTRIBUTION_FIELDS = 48;
 const MAX_ATTRIBUTION_VALUE_LENGTH = 200;
 function sanitizeAttribution(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {

package/dist/server/short-lived-token.d.ts

@@ -31,6 +31,13 @@ export declare function signShortLivedToken(claims: ShortLivedTokenClaims): stri
  * not surface the reason to viewers (it's useful for server-side logs only).
  */
 export declare function verifyShortLivedToken(token: string, expectedResourceId: string): VerifyResult;
+export declare function signCompactShortLivedToken(claims: ShortLivedTokenClaims): string;
+/**
+ * Verify a token produced by {@link signCompactShortLivedToken}. A token for a
+ * different resource, and any legacy token, fails as `bad_signature` — the id
+ * is not in the payload, so a mismatch is indistinguishable from tampering.
+ */
+export declare function verifyCompactShortLivedToken(token: string, expectedResourceId: string): VerifyResult;
 /** Payload `typ` discriminator for realtime subscribe tokens. */
 export declare const REALTIME_SUBSCRIBE_TOKEN_TYPE = "rt-subscribe";
 export interface RealtimeSubscribeClaims {

package/dist/server/short-lived-token.js

@@ -94,6 +94,53 @@ export function verifyShortLivedToken(token, expectedResourceId) {
         agentLabel: claims.agentLabel,
     };
 }
+function compactSignature(resourceId, payloadStr) {
+    return hmacB64(`agent-access\n${resourceId}\n${payloadStr}`, getSigningKey());
+}
+export function signCompactShortLivedToken(claims) {
+    const ttl = claims.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+    const payload = {
+        e: Math.floor(Date.now() / 1000) + ttl,
+    };
+    if (claims.viewerEmail)
+        payload.v = claims.viewerEmail;
+    if (claims.agentLabel)
+        payload.l = claims.agentLabel;
+    const payloadStr = base64UrlEncode(JSON.stringify(payload));
+    return `${payloadStr}.${compactSignature(claims.resourceId, payloadStr)}`;
+}
+/**
+ * Verify a token produced by {@link signCompactShortLivedToken}. A token for a
+ * different resource, and any legacy token, fails as `bad_signature` — the id
+ * is not in the payload, so a mismatch is indistinguishable from tampering.
+ */
+export function verifyCompactShortLivedToken(token, expectedResourceId) {
+    if (typeof token !== "string" || !token.includes(".")) {
+        return { ok: false, reason: "malformed" };
+    }
+    const [payloadStr, sig] = token.split(".", 2);
+    if (!payloadStr || !sig)
+        return { ok: false, reason: "malformed" };
+    if (!timingSafeEqualB64(sig, compactSignature(expectedResourceId, payloadStr))) {
+        return { ok: false, reason: "bad_signature" };
+    }
+    let claims;
+    try {
+        claims = JSON.parse(base64UrlDecode(payloadStr).toString("utf8"));
+    }
+    catch {
+        return { ok: false, reason: "bad_payload" };
+    }
+    if (typeof claims.e !== "number")
+        return { ok: false, reason: "bad_payload" };
+    if ((claims.v !== undefined && typeof claims.v !== "string") ||
+        (claims.l !== undefined && typeof claims.l !== "string")) {
+        return { ok: false, reason: "bad_payload" };
+    }
+    if (claims.e * 1000 < Date.now())
+        return { ok: false, reason: "expired" };
+    return { ok: true, viewerEmail: claims.v, agentLabel: claims.l };
+}
 // ── Realtime subscribe tokens ────────────────────────────────────────────────
 //
 // An identity-bearing extension of the same HMAC discipline, used by the hosted

package/dist/shared/analytics-anonymous-id.d.ts

@@ -1,4 +1,5 @@
 export declare const ANALYTICS_ANONYMOUS_ID_COOKIE_NAME = "an_aid";
 export declare const ANALYTICS_ANONYMOUS_ID_COOKIE_MAX_AGE_SECONDS: number;
+export declare const ANALYTICS_ANONYMOUS_ID_MAX_LENGTH = 128;
 export declare function normalizeAnalyticsAnonymousId(value: unknown): string | undefined;
 export declare function serializeAnalyticsAnonymousIdCookie(value: unknown): string | undefined;

package/dist/shared/analytics-anonymous-id.js

@@ -1,6 +1,6 @@
 export const ANALYTICS_ANONYMOUS_ID_COOKIE_NAME = "an_aid";
 export const ANALYTICS_ANONYMOUS_ID_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
-const ANALYTICS_ANONYMOUS_ID_MAX_LENGTH = 128;
+export const ANALYTICS_ANONYMOUS_ID_MAX_LENGTH = 128;
 const ANALYTICS_ANONYMOUS_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
 export function normalizeAnalyticsAnonymousId(value) {
     if (typeof value !== "string")

package/dist/shared/attribution-source.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Whether a visit says where the person came from. The browser uses this to
+ * decide which visits to keep as first and last touch, and the server uses the
+ * same share-link rules to derive `referral_source`, so the two can't drift.
+ */
+export interface AttributionTouch {
+    ref?: string;
+    via?: string;
+    utm_source?: string;
+    utm_medium?: string;
+    utm_campaign?: string;
+    utm_content?: string;
+    utm_term?: string;
+    gclid?: string;
+    msclkid?: string;
+    vector_source?: string;
+    landing_path?: string;
+    landing_referrer?: string;
+    site_referrer?: string;
+}
+export declare function shareLandingSource(path: string | undefined): "clip_share" | "plan_share" | undefined;
+export declare function isFirstPartyHost(host: string | undefined): boolean;
+/**
+ * Whether a referrer host says where someone came from. Moving between our own
+ * apps and the marketing site, a local dev server, or returning from Google
+ * sign-in is navigation, not a source. The browser and the server both use
+ * this, so capture and `referral_source` agree.
+ */
+export declare function isSourceReferrerHost(host: string | undefined): boolean;
+export declare function hasAttributionSource(touch: AttributionTouch | null | undefined): boolean;

package/dist/shared/attribution-source.js

@@ -0,0 +1,65 @@
+const TAG_FIELDS = [
+    "ref",
+    "via",
+    "utm_source",
+    "utm_medium",
+    "utm_campaign",
+    "utm_content",
+    "utm_term",
+    "gclid",
+    "msclkid",
+    "vector_source",
+];
+const PLAN_SHARE_PATH_SEGMENTS = [
+    "/p/",
+    "/plan/",
+    "/plans/",
+    "/recaps/",
+    "/share-plan/",
+];
+export function shareLandingSource(path) {
+    if (!path)
+        return undefined;
+    if (path.startsWith("/share/"))
+        return "clip_share";
+    if (PLAN_SHARE_PATH_SEGMENTS.some((segment) => path.includes(segment))) {
+        return "plan_share";
+    }
+    return undefined;
+}
+export function isFirstPartyHost(host) {
+    const normalized = host?.trim().toLowerCase().replace(/\.$/, "") ?? "";
+    return (normalized === "agent-native.com" ||
+        normalized.endsWith(".agent-native.com"));
+}
+// Coming back from Google sign-in sends this referrer. It's a step in signing
+// in, never where someone heard about us.
+const SIGN_IN_HOSTS = new Set(["accounts.google.com"]);
+// A developer's own machine, with or without a port.
+const LOCAL_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]", "0.0.0.0"]);
+/**
+ * Whether a referrer host says where someone came from. Moving between our own
+ * apps and the marketing site, a local dev server, or returning from Google
+ * sign-in is navigation, not a source. The browser and the server both use
+ * this, so capture and `referral_source` agree.
+ */
+export function isSourceReferrerHost(host) {
+    const normalized = host?.trim().toLowerCase().replace(/\.$/, "") ?? "";
+    if (!normalized)
+        return false;
+    const hostname = normalized.startsWith("[")
+        ? normalized.slice(0, normalized.indexOf("]") + 1)
+        : normalized.split(":")[0];
+    return (!isFirstPartyHost(hostname) &&
+        !LOCAL_HOSTS.has(hostname) &&
+        !SIGN_IN_HOSTS.has(hostname));
+}
+export function hasAttributionSource(touch) {
+    if (!touch)
+        return false;
+    if (TAG_FIELDS.some((field) => !!touch[field]?.trim()))
+        return true;
+    if (shareLandingSource(touch.landing_path))
+        return true;
+    return [touch.landing_referrer, touch.site_referrer].some(isSourceReferrerHost);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.201.1",
+  "version": "0.201.2-nightly-20261006010750",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -671,7 +671,7 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.201.1",
+    "@agent-native/agentkit": "^0.201.2-nightly-20261006010750",
     "@agent-native/recap-cli": "^0.5.62"
   },
   "devDependencies": {
@@ -742,7 +742,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": ">=0.196.0",
+    "@agent-native/core-corpus": "0.201.2-nightly-20261006010750",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",