@agent-native/core 0.201.1 → 0.202.0-nightly-20261006033736

package/dist/review/suggestions/store.d.ts

@@ -39,7 +39,6 @@ export declare function recordDecision(client: DbExec, input: Omit<SuggestionDec
 }>;
 export declare function getDecision(client: DbExec, idempotencyKey: string): Promise<SuggestionDecisionRecord | null>;
 export declare function updateSuggestionStatus(client: DbExec, suggestionId: string, status: SuggestionStatus, observedRevision?: number): Promise<boolean>;
-export declare function replaceSuggestionStatus(client: DbExec, suggestionId: string, from: SuggestionStatus, to: SuggestionStatus): Promise<boolean>;
 export declare function getSuggestionProposal(client: DbExec, id: string): Promise<ResourceSuggestionProposal | null>;
 export declare function insertSuggestionProposal(client: DbExec, input: Omit<ResourceSuggestionProposal, "id" | "createdAt">): Promise<ResourceSuggestionProposal>;
 export declare function listProposalSuggestions(client: DbExec, proposalId: string): Promise<ResourceSuggestion[]>;

package/dist/review/suggestions/store.js

@@ -387,13 +387,6 @@ export async function updateSuggestionStatus(client, suggestionId, status, obser
     });
     return result.rowsAffected === 1;
 }
-export async function replaceSuggestionStatus(client, suggestionId, from, to) {
-    const result = await client.execute({
-        sql: "UPDATE agent_review_suggestions SET status = ?, updated_at = ? WHERE id = ? AND status = ?",
-        args: [to, new Date().toISOString(), suggestionId, from],
-    });
-    return result.rowsAffected === 1;
-}
 export async function getSuggestionProposal(client, id) {
     const row = (await client.execute({
         sql: "SELECT * FROM agent_review_suggestion_proposals WHERE id = ?",

package/dist/secrets/routes.d.ts

@@ -58,47 +58,47 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     error: string;
     errorCode?: undefined;
     retryable?: undefined;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable?: undefined;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable: boolean;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/action-discovery.js

@@ -423,6 +423,30 @@ export async function mergeCoreSharingActions(registry) {
             "list-resource-shares",
             () => import("../sharing/actions/list-resource-shares.js"),
         ],
+        [
+            "get-resource-access-status",
+            () => import("../sharing/actions/get-resource-access-status.js"),
+        ],
+        [
+            "request-resource-access",
+            () => import("../sharing/actions/request-resource-access.js"),
+        ],
+        [
+            "get-resource-access-request",
+            () => import("../sharing/actions/get-resource-access-request.js"),
+        ],
+        [
+            "list-resource-access-requests",
+            () => import("../sharing/actions/list-resource-access-requests.js"),
+        ],
+        [
+            "approve-resource-access-request",
+            () => import("../sharing/actions/approve-resource-access-request.js"),
+        ],
+        [
+            "decline-resource-access-request",
+            () => import("../sharing/actions/decline-resource-access-request.js"),
+        ],
         [
             "set-resource-visibility",
             () => import("../sharing/actions/set-resource-visibility.js"),

package/dist/server/agent-access.js

@@ -1,8 +1,8 @@
 import { DEFAULT_AGENT_ACCESS_TTL_SECONDS, scopedAgentAccessResourceId, } from "../shared/agent-access.js";
-import { signShortLivedToken, verifyShortLivedToken, } from "./short-lived-token.js";
+import { signCompactShortLivedToken, verifyCompactShortLivedToken, verifyShortLivedToken, } from "./short-lived-token.js";
 export { AGENT_ACCESS_PARAM, DEFAULT_AGENT_ACCESS_TTL_SECONDS, appendAgentAccessParam, buildAgentAccessApiUrl, buildAgentAccessUrl, normalizeAgentAccessBasePath, normalizeAgentAccessOrigin, scopedAgentAccessResourceId, toAgentAccessUrl, } from "../shared/agent-access.js";
 export function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEmail, agentLabel, ttlSeconds = DEFAULT_AGENT_ACCESS_TTL_SECONDS, }) {
-    return signShortLivedToken({
+    return signCompactShortLivedToken({
         resourceId: scopedAgentAccessResourceId(resourceKind, resourceId),
         viewerEmail,
         agentLabel,
@@ -12,7 +12,11 @@ export function signScopedAgentAccessToken({ resourceKind, resourceId, viewerEma
 export function verifyScopedAgentAccessToken(token, scope) {
     if (!token)
         return { ok: false, reason: "missing" };
-    return verifyShortLivedToken(token, scopedAgentAccessResourceId(scope.resourceKind, scope.resourceId));
+    const resourceId = scopedAgentAccessResourceId(scope.resourceKind, scope.resourceId);
+    const compact = verifyCompactShortLivedToken(token, resourceId);
+    if (compact.ok || compact.reason !== "bad_signature")
+        return compact;
+    return verifyShortLivedToken(token, resourceId);
 }
 export function createScopedAgentAccessGrant(options) {
     const ttlSeconds = options.ttlSeconds ?? DEFAULT_AGENT_ACCESS_TTL_SECONDS;

package/dist/server/agent-chat/mcp-options.d.ts

@@ -12,6 +12,7 @@ export interface AgentChatMcpOptions {
     directoryProfile?: {
         connectorCatalog: string[];
         instructions?: string;
+        widgets?: boolean;
         keyToolNames?: readonly string[];
         toolDescriptions?: Record<string, string>;
         toolParameterDescriptions?: Record<string, Record<string, string>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -65,8 +65,8 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     error: any;
     code: any;
 } | {
-    error?: undefined;
     errorCode?: undefined;
+    error?: undefined;
     code?: undefined;
     ok: boolean;
     key: string;

package/dist/server/agent-engine-default-model-route.d.ts

@@ -8,9 +8,9 @@ export declare const AGENT_ENGINE_API_KEY_ACTION_NAME = "agent-engine-api-key";
  * resolveEngine's credential detection.
  */
 export declare function createAgentEngineDisconnectHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     scope?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     error: any;

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -3,7 +3,7 @@ export declare function createAgentEngineOllamaModelsHandler(): import("h3").Eve
     models?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     models: string[];
-    error?: undefined;
 }>>;

package/dist/server/attribution.d.ts

@@ -8,6 +8,11 @@
  * request and enriches the canonical server-side `signup` event so we can
  * measure where new users came from and how apps spread (virality).
  *
+ * The browser also keeps the visitor's *last* visit that had a source in an
+ * `an_lt` cookie. First touch answers "how did they find us?" and credits
+ * acquisition; last touch answers "what brought them to sign up?" and credits
+ * the post, video, or person that converted them.
+ *
  * This module is intentionally pure and dependency-free so it is trivially
  * unit-testable and can never throw into the signup path. The single hard rule:
  * parsing untrusted cookie input must NEVER throw — every accessor is defensive.
@@ -36,6 +41,25 @@ export interface FirstTouchAttribution {
     landed_at?: string;
     capture_truncated?: string;
 }
+/** The decoded `an_lt` cookie: the latest visit that had a source. */
+export interface LastTouchAttribution {
+    ref?: string;
+    via?: string;
+    utm_source?: string;
+    utm_medium?: string;
+    utm_campaign?: string;
+    utm_content?: string;
+    utm_term?: string;
+    gclid?: string;
+    msclkid?: string;
+    vector_source?: string;
+    landing_referrer?: string;
+    site_referrer?: string;
+    site_landing_path?: string;
+    landing_path?: string;
+    touched_at?: string;
+    capture_truncated?: string;
+}
 export type SignupOrigin = "browser_signup"
 /** The framework's Google OAuth callback owns this event. */
  | "google_oauth"
@@ -47,20 +71,28 @@ export interface SignupAttributionContext {
 }
 export declare const SIGNUP_ATTRIBUTION_HEADER_NAME = "x-agent-native-signup-attribution";
 export declare const FIRST_TOUCH_COOKIE_NAME = "an_ft";
+export declare const LAST_TOUCH_COOKIE_NAME = "an_lt";
 /**
  * Parse a raw `Cookie:` header into a flat name→value map. Tolerates missing
  * input, extra whitespace, `=` inside values, and malformed pairs. Never throws.
  */
 export declare function parseCookieHeader(cookieHeader: string | null | undefined): Record<string, string>;
 export declare function decodeFirstTouchValue(value: string | null | undefined): FirstTouchAttribution | null;
+export declare function decodeLastTouchValue(value: string | null | undefined): LastTouchAttribution | null;
 /**
  * Read the `an_ft` first-touch attribution out of a raw `Cookie:` header.
  * Returns `null` when the cookie is absent or unparseable. Never throws.
  */
 export declare function readFirstTouchAttribution(cookieHeader: string | null | undefined): FirstTouchAttribution | null;
+/**
+ * Read the `an_lt` last-touch attribution out of a raw `Cookie:` header.
+ * Returns `null` when the cookie is absent or unparseable. Never throws.
+ */
+export declare function readLastTouchAttribution(cookieHeader: string | null | undefined): LastTouchAttribution | null;
 export declare function readAnalyticsAnonymousId(cookieHeader: string | null | undefined): string | undefined;
-export declare function deriveReferralSource(ft: FirstTouchAttribution | null): string;
+export declare function deriveReferralSource(ft: FirstTouchAttribution | LastTouchAttribution | null): string;
 export declare function deriveSignupAttribution(ft: FirstTouchAttribution | null): Record<string, string>;
+export declare function deriveLastTouchAttribution(lt: LastTouchAttribution | null): Record<string, string>;
 /**
  * Convenience: read the cookie header and derive signup attribution in one
  * call. Never throws; falls back to `{ referral_source: "direct" }` on any

package/dist/server/attribution.js

@@ -1,7 +1,9 @@
-import { ANALYTICS_ANONYMOUS_ID_COOKIE_NAME, normalizeAnalyticsAnonymousId, } from "../shared/analytics-anonymous-id.js";
+import { ANALYTICS_ANONYMOUS_ID_COOKIE_NAME, ANALYTICS_ANONYMOUS_ID_MAX_LENGTH, normalizeAnalyticsAnonymousId, } from "../shared/analytics-anonymous-id.js";
+import { isSourceReferrerHost, shareLandingSource, } from "../shared/attribution-source.js";
 export const SIGNUP_ATTRIBUTION_HEADER_NAME = "x-agent-native-signup-attribution";
 const SIGNUP_ATTRIBUTION_HEADER_MAX_LENGTH = 4096;
 export const FIRST_TOUCH_COOKIE_NAME = "an_ft";
+export const LAST_TOUCH_COOKIE_NAME = "an_lt";
 const STRING_FIELDS = [
     "ref",
     "via",
@@ -20,6 +22,24 @@ const STRING_FIELDS = [
     "landed_at",
     "capture_truncated",
 ];
+const LAST_TOUCH_STRING_FIELDS = [
+    "ref",
+    "via",
+    "utm_source",
+    "utm_medium",
+    "utm_campaign",
+    "utm_content",
+    "utm_term",
+    "gclid",
+    "msclkid",
+    "vector_source",
+    "landing_referrer",
+    "site_referrer",
+    "site_landing_path",
+    "landing_path",
+    "touched_at",
+    "capture_truncated",
+];
 /**
  * Parse a raw `Cookie:` header into a flat name→value map. Tolerates missing
  * input, extra whitespace, `=` inside values, and malformed pairs. Never throws.
@@ -44,6 +64,12 @@ export function parseCookieHeader(cookieHeader) {
     return out;
 }
 export function decodeFirstTouchValue(value) {
+    return decodeAttributionCookieValue(value, STRING_FIELDS);
+}
+export function decodeLastTouchValue(value) {
+    return decodeAttributionCookieValue(value, LAST_TOUCH_STRING_FIELDS);
+}
+function decodeAttributionCookieValue(value, fields) {
     if (!value || typeof value !== "string")
         return null;
     let decoded = value;
@@ -66,7 +92,7 @@ export function decodeFirstTouchValue(value) {
     const source = parsed;
     const result = {};
     let any = false;
-    for (const field of STRING_FIELDS) {
+    for (const field of fields) {
         const raw = source[field];
         if (typeof raw === "string" && raw.length > 0) {
             result[field] = raw.slice(0, 120);
@@ -88,6 +114,14 @@ export function readFirstTouchAttribution(cookieHeader) {
         return null;
     }
 }
+/**
+ * Read the `an_lt` last-touch attribution out of a raw `Cookie:` header.
+ * Returns `null` when the cookie is absent or unparseable. Never throws.
+ */
+export function readLastTouchAttribution(cookieHeader) {
+    const cookies = parseCookieHeader(cookieHeader);
+    return decodeLastTouchValue(cookies[LAST_TOUCH_COOKIE_NAME]);
+}
 export function readAnalyticsAnonymousId(cookieHeader) {
     try {
         return normalizeAnalyticsAnonymousId(parseCookieHeader(cookieHeader)[ANALYTICS_ANONYMOUS_ID_COOKIE_NAME]);
@@ -96,25 +130,14 @@ export function readAnalyticsAnonymousId(cookieHeader) {
         return undefined;
     }
 }
-function isExternalReferrerHost(host) {
-    const trimmed = host?.trim();
-    return !!trimmed && trimmed.length > 0;
-}
 export function deriveReferralSource(ft) {
     if (ft?.ref && ft.ref.trim())
         return ft.ref.trim();
-    const path = ft?.landing_path ?? "";
-    if (path.startsWith("/share/"))
-        return "clip_share";
-    if (path.includes("/p/") ||
-        path.includes("/plan/") ||
-        path.includes("/plans/") ||
-        path.includes("/recaps/") ||
-        path.includes("/share-plan/")) {
-        return "plan_share";
-    }
-    if (isExternalReferrerHost(ft?.landing_referrer) ||
-        isExternalReferrerHost(ft?.site_referrer)) {
+    const shareSource = shareLandingSource(ft?.landing_path);
+    if (shareSource)
+        return shareSource;
+    if (isSourceReferrerHost(ft?.landing_referrer) ||
+        isSourceReferrerHost(ft?.site_referrer)) {
         return "external";
     }
     return "direct";
@@ -149,6 +172,54 @@ export function deriveSignupAttribution(ft) {
         out.attribution_truncated = "true";
     return out;
 }
+export function deriveLastTouchAttribution(lt) {
+    if (!lt)
+        return {};
+    const out = {
+        last_touch_source: deriveReferralSource(lt),
+    };
+    const setIf = (key, value) => {
+        const trimmed = value?.trim();
+        if (trimmed)
+            out[key] = trimmed;
+    };
+    setIf("last_touch_ref", lt.ref);
+    setIf("last_touch_via", lt.via);
+    setIf("last_touch_utm_source", lt.utm_source);
+    setIf("last_touch_utm_medium", lt.utm_medium);
+    setIf("last_touch_utm_campaign", lt.utm_campaign);
+    setIf("last_touch_utm_content", lt.utm_content);
+    setIf("last_touch_utm_term", lt.utm_term);
+    setIf("last_touch_gclid", lt.gclid);
+    setIf("last_touch_msclkid", lt.msclkid);
+    setIf("last_touch_vector_source", lt.vector_source);
+    setIf("last_touch_referrer", lt.landing_referrer);
+    setIf("last_touch_site_referrer", lt.site_referrer);
+    setIf("last_touch_path", lt.landing_path);
+    setIf("last_touch_site_path", lt.site_landing_path);
+    setIf("last_touch_at", lt.touched_at);
+    // The browser dropped fields to fit the cookie.
+    if (lt.capture_truncated === "1")
+        out.last_touch_truncated = "true";
+    return out;
+}
+/**
+ * Add last touch only while the handoff still fits its header. An oversized
+ * header is dropped whole, which would lose first touch with it.
+ */
+function withLastTouchAttribution(attribution, lt) {
+    const lastTouch = deriveLastTouchAttribution(lt);
+    if (Object.keys(lastTouch).length === 0)
+        return attribution;
+    const merged = { ...attribution, ...lastTouch };
+    const largest = encodeSignupAttributionContext({
+        attribution: merged,
+        anonymousId: "a".repeat(ANALYTICS_ANONYMOUS_ID_MAX_LENGTH),
+    });
+    if (largest.length <= SIGNUP_ATTRIBUTION_HEADER_MAX_LENGTH)
+        return merged;
+    return { ...attribution, last_touch_truncated: "true" };
+}
 /**
  * Convenience: read the cookie header and derive signup attribution in one
  * call. Never throws; falls back to `{ referral_source: "direct" }` on any
@@ -156,7 +227,7 @@ export function deriveSignupAttribution(ft) {
  */
 export function signupAttributionFromCookieHeader(cookieHeader) {
     try {
-        return deriveSignupAttribution(readFirstTouchAttribution(cookieHeader));
+        return withLastTouchAttribution(deriveSignupAttribution(readFirstTouchAttribution(cookieHeader)), readLastTouchAttribution(cookieHeader));
     }
     catch {
         return { referral_source: "direct" };
@@ -176,11 +247,12 @@ export function signupAttributionFromCookieHeader(cookieHeader) {
  */
 export function signupAttributionContextFromCookieHeader(cookieHeader) {
     const firstTouch = readFirstTouchAttribution(cookieHeader);
+    const lastTouch = readLastTouchAttribution(cookieHeader);
     const anonymousId = readAnalyticsAnonymousId(cookieHeader);
-    if (!firstTouch && !anonymousId)
+    if (!firstTouch && !lastTouch && !anonymousId)
         return undefined;
     return {
-        attribution: deriveSignupAttribution(firstTouch),
+        attribution: withLastTouchAttribution(deriveSignupAttribution(firstTouch), lastTouch),
         ...(anonymousId ? { anonymousId } : {}),
     };
 }

package/dist/server/auth.js

@@ -44,7 +44,7 @@ import { ensureColumnExists, ensureTableExists } from "../db/ddl-guard.js";
 import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 import { resolveLocaleFromRequest } from "../localization/server.js";
 import { readMcpOAuthFlowCookiePayload } from "../mcp-client/oauth-flow-cookie.js";
-import { MCP_LEGACY_ROUTE_PREFIX, MCP_PUBLIC_ROUTE_PREFIX, isMcpProtocolPath, } from "../mcp/route-paths.js";
+import { MCP_DIRECTORY_ROUTE_PREFIX, MCP_LEGACY_ROUTE_PREFIX, MCP_PUBLIC_ROUTE_PREFIX, isMcpProtocolPath, } from "../mcp/route-paths.js";
 import { authProviderRequiredMessage, getRequiredAuthProviderForEmail, isGoogleSignInRequiredForEmail, } from "../org/auth-policy.js";
 import { readBody } from "../server/h3-helpers.js";
 import { putSetting } from "../settings/store.js";
@@ -62,7 +62,7 @@ import { injectAnalyticsIntoHtml } from "./analytics.js";
 import { getConfiguredAppBasePath, stripAppBasePath as stripConfiguredAppBasePath, } from "./app-base-path.js";
 import { getAppOriginClientConfigScript } from "./app-origin-config.js";
 import { getAppProductionUrl } from "./app-url.js";
-import { addSignupAttributionHeader, readAnalyticsAnonymousId, readFirstTouchAttribution, signupAttributionContextFromCookieHeader, signupAttributionFromCookieHeader, } from "./attribution.js";
+import { addSignupAttributionHeader, readAnalyticsAnonymousId, signupAttributionContextFromCookieHeader, signupAttributionFromCookieHeader, } from "./attribution.js";
 import { getAuthLoginMode } from "./auth-login-mode.js";
 import { injectBetaOptOutPersistence } from "./beta-opt-out-html.js";
 import { createBetterAuthSessionForEmail, ensureGoogleAuthIdentity, getBetterAuthInternalAdapter, getBetterAuthUserIdForEmail, getAuthSecret, getBetterAuth, getBetterAuthSync, isDeployPreview, } from "./better-auth-instance.js";
@@ -2115,6 +2115,13 @@ export async function runAuthGuard(event) {
         return;
     return _authGuardFn(event);
 }
+const MCP_DIRECTORY_CORS_ORIGINS = new Set([
+    "https://chatgpt.com",
+    "https://chat.openai.com",
+    "https://platform.openai.com",
+]);
+const MCP_DIRECTORY_CORS_METHODS = "POST, GET, DELETE, OPTIONS";
+const MCP_DIRECTORY_CORS_HEADERS = "Authorization, Content-Type, Accept, MCP-Protocol-Version, MCP-Session-Id, Last-Event-Id";
 function applyCorsHeaders(event, publicCorsPaths = [], requestPath) {
     const origin = getHeader(event, "origin");
     if (!origin)
@@ -2717,6 +2724,29 @@ function createAuthGuardFn(app) {
         const callbackRelay = workspaceOAuthCallbackRelayResponse(event);
         if (callbackRelay)
             return callbackRelay;
+        const isDirectoryMcpPath = p === MCP_DIRECTORY_ROUTE_PREFIX ||
+            p === `${MCP_DIRECTORY_ROUTE_PREFIX}/`;
+        const directoryPreflightOrigin = getMethod(event) === "OPTIONS" && isDirectoryMcpPath
+            ? getHeader(event, "origin")
+            : undefined;
+        if (directoryPreflightOrigin) {
+            if (!MCP_DIRECTORY_CORS_ORIGINS.has(directoryPreflightOrigin)) {
+                setResponseStatus(event, 403);
+                return "";
+            }
+            setResponseHeader(event, "Access-Control-Allow-Origin", directoryPreflightOrigin);
+            setResponseHeader(event, "Vary", "Origin");
+            setResponseHeader(event, "Access-Control-Allow-Methods", MCP_DIRECTORY_CORS_METHODS);
+            setResponseHeader(event, "Access-Control-Allow-Headers", MCP_DIRECTORY_CORS_HEADERS);
+            setResponseStatus(event, 204);
+            return "";
+        }
+        const directoryResponseOrigin = isDirectoryMcpPath && getHeader(event, "origin");
+        if (directoryResponseOrigin &&
+            MCP_DIRECTORY_CORS_ORIGINS.has(directoryResponseOrigin)) {
+            setResponseHeader(event, "Access-Control-Allow-Origin", directoryResponseOrigin);
+            setResponseHeader(event, "Vary", "Origin");
+        }
         const cors = applyCorsHeaders(event, config.publicCorsPaths, p);
         if (getMethod(event) === "OPTIONS") {
             if (cors.hasOrigin && !cors.allowed) {
@@ -4948,15 +4978,9 @@ async function mountBetterAuthRoutes(app, options) {
                 callbackPath = withDesktopMagicLinkFlow(callbackPath, desktopFlow);
             }
             const callbackURL = betterAuthCallbackURL(callbackPath, true, event);
-            const cookieHeader = getHeader(event, "cookie") ?? null;
-            const signupAttribution = signupAttributionFromCookieHeader(cookieHeader);
-            const signupAnonymousId = readAnalyticsAnonymousId(cookieHeader);
-            const hasSignupAttribution = !!readFirstTouchAttribution(cookieHeader) || !!signupAnonymousId;
-            const attributionToken = hasSignupAttribution
-                ? encodeMagicLinkSignupAttribution({
-                    attribution: signupAttribution,
-                    anonymousId: signupAnonymousId,
-                }, getAuthSecret())
+            const signupContext = signupAttributionContextFromCookieHeader(getHeader(event, "cookie") ?? null);
+            const attributionToken = signupContext
+                ? encodeMagicLinkSignupAttribution(signupContext, getAuthSecret())
                 : undefined;
             const newUserCallbackUrl = new URL(`${getAppBasePath()}${publicFrameworkPath("/_agent-native/auth/magic-link/new-user")}?return=${encodeURIComponent(callbackPath)}`, getOrigin(event));
             if (attributionToken) {

package/dist/server/email-templates.d.ts

@@ -73,3 +73,37 @@ export interface RenderResourceSharedEmailArgs {
     extras?: ShareEmailExtras;
 }
 export declare function renderResourceSharedEmail(args: RenderResourceSharedEmailArgs): RenderedEmailMessage;
+export interface RenderAccessRequestedEmailArgs {
+    recipientEmail: string;
+    requester: {
+        name: string;
+        email: string;
+    };
+    resource: {
+        type: string;
+        label: string;
+        title: string;
+        url: string;
+    };
+    /** The page where someone who manages access allows or declines. */
+    reviewUrl: string;
+    note?: string;
+    app: EmailTemplateApp;
+}
+export declare function renderAccessRequestedEmail(args: RenderAccessRequestedEmailArgs): RenderedEmailMessage;
+export interface RenderAccessGrantedEmailArgs {
+    recipientEmail: string;
+    approver: {
+        name: string;
+        email: string;
+    };
+    resource: {
+        type: string;
+        label: string;
+        title: string;
+        url: string;
+    };
+    role: "viewer" | "commenter" | "editor" | "admin";
+    app: EmailTemplateApp;
+}
+export declare function renderAccessGrantedEmail(args: RenderAccessGrantedEmailArgs): RenderedEmailMessage;

package/dist/server/email-templates.js

@@ -286,3 +286,43 @@ export function renderResourceSharedEmail(args) {
     });
     return { subject, html, text };
 }
+export function renderAccessRequestedEmail(args) {
+    const requesterName = stripCrlf(args.requester.name);
+    const resourceTitle = stripCrlf(args.resource.title);
+    const resourceLabel = args.resource.label.toLowerCase();
+    const subject = `${requesterName} is asking for access to "${resourceTitle}"`;
+    const { html, text } = renderEmail({
+        brandName: args.app.name,
+        brandLogoUrl: args.app.logoUrl,
+        preheader: subject,
+        heading: `${requesterName} is asking for access`,
+        paragraphs: [
+            `${emailStrong(requesterName)} (${emailStrong(args.requester.email)}) is asking to open this ${resourceLabel}:`,
+            ...(args.note?.trim() ? [emailQuote(args.note)] : []),
+        ],
+        resourceBlock: { name: resourceTitle },
+        cta: { label: "Review request", url: args.reviewUrl },
+        closingParagraphs: [
+            `You're getting this because you can manage access to this ${resourceLabel}.`,
+        ],
+    });
+    return { subject, html, text };
+}
+export function renderAccessGrantedEmail(args) {
+    const approverName = stripCrlf(args.approver.name);
+    const resourceTitle = stripCrlf(args.resource.title);
+    const resourceLabel = args.resource.label.toLowerCase();
+    const subject = `You can now open "${resourceTitle}"`;
+    const { html, text } = renderEmail({
+        brandName: args.app.name,
+        brandLogoUrl: args.app.logoUrl,
+        preheader: subject,
+        heading: `${approverName} approved your request`,
+        paragraphs: [
+            `${emailStrong(approverName)} (${emailStrong(args.approver.email)}) gave you access to ${SHARE_ROLE_VERBS[args.role]} this ${resourceLabel}:`,
+        ],
+        resourceBlock: { name: resourceTitle },
+        cta: { label: "Open", url: args.resource.url },
+    });
+    return { subject, html, text };
+}

package/dist/server/magic-link-attribution.js

@@ -2,7 +2,8 @@ import crypto from "node:crypto";
 import { normalizeAnalyticsAnonymousId } from "../shared/analytics-anonymous-id.js";
 export const MAGIC_LINK_ATTRIBUTION_PARAM = "signup_attribution";
 const MAGIC_LINK_ATTRIBUTION_TTL_SECONDS = 10 * 60;
-const MAX_ATTRIBUTION_FIELDS = 32;
+// A signup carries up to 17 first-touch and 16 last-touch properties.
+const MAX_ATTRIBUTION_FIELDS = 48;
 const MAX_ATTRIBUTION_VALUE_LENGTH = 200;
 function sanitizeAttribution(value) {
     if (!value || typeof value !== "object" || Array.isArray(value)) {