@agent-native/core 0.204.1-nightly-20261008153353 → 0.205.0

package/dist/observability/routes.d.ts

@@ -27,43 +27,43 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    ok?: undefined;
     error: string;
     message: string;
     summary?: undefined;
     spans?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     message?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     traceMissing: true;
     id: string;
     error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     traceMissing?: undefined;
     id: string;
     error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
     error: any;
-    ok?: undefined;
 } | {
     message?: undefined;
     summary?: undefined;
     spans?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/observability/sentiment.d.ts

@@ -15,7 +15,7 @@ export declare function shouldInferSentimentForTurn(args: {
     hasUserText: boolean;
 }): boolean;
 export declare function parseInferredSentiment(output: string): InferredSentiment | null;
-export declare const INFERRED_SENTIMENT_FAILURE_REASONS: readonly ["engine_unavailable", "timeout", "parse_failed", "empty"];
+export declare const INFERRED_SENTIMENT_FAILURE_REASONS: readonly ["engine_unavailable", "model_unsupported", "timeout", "parse_failed", "empty"];
 export type InferredSentimentFailureReason = (typeof INFERRED_SENTIMENT_FAILURE_REASONS)[number];
 export declare function inferAndTrackSentiment(args: {
     /** Explicit engine override; wins over `runEngine`. */

package/dist/observability/sentiment.js

@@ -101,6 +101,7 @@ function truncateInput(text) {
 }
 export const INFERRED_SENTIMENT_FAILURE_REASONS = [
     "engine_unavailable",
+    "model_unsupported",
     "timeout",
     "parse_failed",
     "empty",
@@ -110,9 +111,32 @@ function engineCanRun(engine, model) {
         engine.supportedModels.length === 0 ||
         engine.supportedModels.includes(model));
 }
+// Codes an engine puts on a stop event or EngineError when the gateway or
+// provider refuses the model itself. `builder_model_unauthorized` is
+// BUILDER_MODEL_UNAUTHORIZED_ERROR_CODE; builder-engine is imported lazily here.
+const MODEL_REJECTION_ERROR_CODES = new Set([
+    "builder_model_unauthorized",
+    "model_not_found",
+    "not_found_error",
+]);
+// A rejected model is a configuration error to fix, not an outage to retry, so
+// it must not be counted as `engine_unavailable`.
+function engineFailureReason(errorCode) {
+    return typeof errorCode === "string" &&
+        MODEL_REJECTION_ERROR_CODES.has(errorCode.trim().toLowerCase())
+        ? "model_unsupported"
+        : "engine_unavailable";
+}
+function thrownErrorCode(error) {
+    return typeof error === "object" && error !== null && "errorCode" in error
+        ? error.errorCode
+        : undefined;
+}
 async function classifySentiment(args) {
+    // The engine is up but does not list the model: a configuration error, not
+    // an outage, so it must not read as `engine_unavailable`.
     if (!engineCanRun(args.engine, args.model)) {
-        return { failure: "engine_unavailable" };
+        return { failure: "model_unsupported" };
     }
     const input = truncateInput(args.text);
     if (!input)
@@ -125,8 +149,8 @@ async function classifySentiment(args) {
     }, INFERRED_SENTIMENT_TIMEOUT_MS);
     let output = "";
     let finalOutput = "";
-    const interrupted = () => ({
-        failure: timedOut ? "timeout" : "engine_unavailable",
+    const interrupted = (errorCode) => ({
+        failure: timedOut ? "timeout" : engineFailureReason(errorCode),
     });
     try {
         for await (const event of args.engine.stream({
@@ -149,12 +173,12 @@ async function classifySentiment(args) {
                     .join("");
             }
             if (typedEvent.type === "stop" && typedEvent.reason === "error") {
-                return interrupted();
+                return interrupted(typedEvent.errorCode);
             }
         }
     }
-    catch {
-        return interrupted();
+    catch (error) {
+        return interrupted(thrownErrorCode(error));
     }
     finally {
         clearTimeout(timeout);

package/dist/org/index.d.ts

@@ -177,9 +177,9 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     soloDeploymentAdmin: boolean | undefined;
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    id?: undefined;
     name?: undefined;
     success: boolean;
+    id?: undefined;
     role?: undefined;
 } | {
     success?: undefined;

package/dist/progress/routes.d.ts

@@ -2,6 +2,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/secrets/routes.d.ts

@@ -58,47 +58,47 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     error: string;
     errorCode?: undefined;
     retryable?: undefined;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable?: undefined;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
     error: string;
     errorCode: string;
     retryable: boolean;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     errorCode?: undefined;
     retryable?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -126,11 +126,11 @@ export declare function createAdHocSecretHandler(): import("h3").EventHandlerWit
 } | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;

package/dist/server/agent-engine-api-key-route.d.ts

@@ -66,12 +66,12 @@ export declare function createAgentEngineApiKeyHandler(): import("h3").EventHand
     code: any;
 } | {
     errorCode?: undefined;
-    error?: undefined;
     code?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
     defaultModel?: import("./agent-engine-default-model-route.js").SavedKeyDefaultModelOutcome;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/agent-engine-ollama-models-route.d.ts

@@ -1,6 +1,6 @@
 export declare function createAgentEngineOllamaModelsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
     models?: undefined;
 } | {
     error?: undefined;

package/dist/server/attribution.d.ts

@@ -68,6 +68,7 @@ export type SignupOrigin = "browser_signup"
 export interface SignupAttributionContext {
     attribution: Record<string, string>;
     anonymousId?: string;
+    sessionId?: string;
 }
 export declare const SIGNUP_ATTRIBUTION_HEADER_NAME = "x-agent-native-signup-attribution";
 export declare const FIRST_TOUCH_COOKIE_NAME = "an_ft";
@@ -90,6 +91,7 @@ export declare function readFirstTouchAttribution(cookieHeader: string | null |
  */
 export declare function readLastTouchAttribution(cookieHeader: string | null | undefined): LastTouchAttribution | null;
 export declare function readAnalyticsAnonymousId(cookieHeader: string | null | undefined): string | undefined;
+export declare function readAnalyticsSessionId(cookieHeader: string | null | undefined): string | undefined;
 export declare function deriveReferralSource(ft: FirstTouchAttribution | LastTouchAttribution | null): string;
 export declare function deriveSignupAttribution(ft: FirstTouchAttribution | null): Record<string, string>;
 export declare function deriveLastTouchAttribution(lt: LastTouchAttribution | null): Record<string, string>;
@@ -104,12 +106,8 @@ export declare function signupAttributionFromCookieHeader(cookieHeader: string |
  * Keep this as one boundary helper so every signup entry point carries the
  * same values into Better Auth's user-create hook.
  *
- * Returns `undefined` when the request carried neither cookie. A browser that
- * ran our client script always has `an_ft`, so "no cookies at all" means no
- * browser — a server-side backfill or provisioning call. Reporting that as
- * `referral_source: "direct"` is the coercion that made this metric unusable:
- * it renders "we never saw a visitor" identical to "a visitor arrived with no
- * campaign", and only the second one is direct traffic.
+ * Returns `undefined` when no attribution or anonymous ID identifies a signup
+ * context. A session ID alone cannot establish direct traffic.
  */
 export declare function signupAttributionContextFromCookieHeader(cookieHeader: string | null | undefined): SignupAttributionContext | undefined;
 export declare function encodeSignupAttributionContext(context: SignupAttributionContext): string;

package/dist/server/attribution.js

@@ -1,4 +1,5 @@
 import { ANALYTICS_ANONYMOUS_ID_COOKIE_NAME, ANALYTICS_ANONYMOUS_ID_MAX_LENGTH, normalizeAnalyticsAnonymousId, } from "../shared/analytics-anonymous-id.js";
+import { ANALYTICS_SESSION_ID_COOKIE_NAME, normalizeAnalyticsSessionId, } from "../shared/analytics-session-id.js";
 import { isSourceReferrerHost, shareLandingSource, } from "../shared/attribution-source.js";
 export const SIGNUP_ATTRIBUTION_HEADER_NAME = "x-agent-native-signup-attribution";
 const SIGNUP_ATTRIBUTION_HEADER_MAX_LENGTH = 4096;
@@ -127,6 +128,19 @@ export function readAnalyticsAnonymousId(cookieHeader) {
         return normalizeAnalyticsAnonymousId(parseCookieHeader(cookieHeader)[ANALYTICS_ANONYMOUS_ID_COOKIE_NAME]);
     }
     catch {
+        // coercion-ok: malformed anonymous id cookies are absent analytics context.
+        return undefined;
+    }
+}
+export function readAnalyticsSessionId(cookieHeader) {
+    try {
+        const value = parseCookieHeader(cookieHeader)[ANALYTICS_SESSION_ID_COOKIE_NAME];
+        if (!value)
+            return undefined;
+        return normalizeAnalyticsSessionId(decodeURIComponent(value));
+    }
+    catch {
+        // coercion-ok: malformed session cookie input is absent analytics context.
         return undefined;
     }
 }
@@ -238,22 +252,20 @@ export function signupAttributionFromCookieHeader(cookieHeader) {
  * Keep this as one boundary helper so every signup entry point carries the
  * same values into Better Auth's user-create hook.
  *
- * Returns `undefined` when the request carried neither cookie. A browser that
- * ran our client script always has `an_ft`, so "no cookies at all" means no
- * browser — a server-side backfill or provisioning call. Reporting that as
- * `referral_source: "direct"` is the coercion that made this metric unusable:
- * it renders "we never saw a visitor" identical to "a visitor arrived with no
- * campaign", and only the second one is direct traffic.
+ * Returns `undefined` when no attribution or anonymous ID identifies a signup
+ * context. A session ID alone cannot establish direct traffic.
  */
 export function signupAttributionContextFromCookieHeader(cookieHeader) {
     const firstTouch = readFirstTouchAttribution(cookieHeader);
     const lastTouch = readLastTouchAttribution(cookieHeader);
     const anonymousId = readAnalyticsAnonymousId(cookieHeader);
+    const sessionId = readAnalyticsSessionId(cookieHeader);
     if (!firstTouch && !lastTouch && !anonymousId)
         return undefined;
     return {
         attribution: withLastTouchAttribution(deriveSignupAttribution(firstTouch), lastTouch),
         ...(anonymousId ? { anonymousId } : {}),
+        ...(sessionId ? { sessionId } : {}),
     };
 }
 export function encodeSignupAttributionContext(context) {
@@ -283,9 +295,11 @@ export function decodeSignupAttributionContext(value) {
         if (Object.keys(attribution).length === 0)
             return undefined;
         const anonymousId = normalizeAnalyticsAnonymousId(parsed?.anonymousId);
+        const sessionId = normalizeAnalyticsSessionId(parsed?.sessionId);
         return {
             attribution,
             ...(anonymousId ? { anonymousId } : {}),
+            ...(sessionId ? { sessionId } : {}),
         };
     }
     catch (error) {

package/dist/server/better-auth-instance.d.ts

@@ -27,7 +27,7 @@ export declare function emitSignupEventForCreatedUser(user: {
     name?: string | null;
 }, context?: BetterAuthUserCreateContext | null): Promise<void>;
 export declare function hasGoogleAuthIdentity(email: string): Promise<boolean | undefined>;
-export declare function trackSignupEvent({ authProvider, origin, signupMethod, authUserId, email, name, attribution, anonymousId, }: {
+export declare function trackSignupEvent({ authProvider, origin, signupMethod, authUserId, email, name, attribution, anonymousId, sessionId, }: {
     authProvider: string;
     origin: SignupOrigin;
     signupMethod?: "google" | "magic_link" | "password";
@@ -45,6 +45,7 @@ export declare function trackSignupEvent({ authProvider, origin, signupMethod, a
      */
     attribution?: Record<string, string | undefined>;
     anonymousId?: string;
+    sessionId?: string;
 }): Promise<void>;
 export declare const DEV_AUTH_SECRET_PATH: string;
 /**

package/dist/server/better-auth-instance.js

@@ -136,6 +136,7 @@ export async function emitSignupEventForCreatedUser(user, context) {
         : undefined;
     let attribution;
     let anonymousId;
+    let sessionId;
     try {
         const browser = (context?.request?.url?.includes("newUserCallbackURL")
             ? readMagicLinkSignupAttribution(context.request.url, getAuthSecret())
@@ -145,6 +146,7 @@ export async function emitSignupEventForCreatedUser(user, context) {
             signupAttributionContextFromCookieHeader(requestHeaders.get("cookie"));
         attribution = browser?.attribution;
         anonymousId = browser?.anonymousId;
+        sessionId = browser?.sessionId;
     }
     catch (err) {
         console.error("[auth] failed to derive signup attribution", err);
@@ -177,6 +179,7 @@ export async function emitSignupEventForCreatedUser(user, context) {
         name: user.name,
         attribution,
         anonymousId,
+        sessionId,
     });
 }
 export async function hasGoogleAuthIdentity(email) {
@@ -189,7 +192,7 @@ export async function hasGoogleAuthIdentity(email) {
     return (existing?.accounts.some((account) => account.providerId === "google") ??
         false);
 }
-export async function trackSignupEvent({ authProvider, origin, signupMethod, authUserId, email, name, attribution, anonymousId, }) {
+export async function trackSignupEvent({ authProvider, origin, signupMethod, authUserId, email, name, attribution, anonymousId, sessionId, }) {
     identify(email, {
         email,
         name: name ?? undefined,
@@ -214,6 +217,7 @@ export async function trackSignupEvent({ authProvider, origin, signupMethod, aut
         userId: email,
         authUserId,
         ...(anonymousId ? { anonymousId } : {}),
+        ...(sessionId ? { sessionId } : {}),
     });
     await flushSignupTracking();
 }

package/dist/server/magic-link-attribution.d.ts

@@ -2,6 +2,7 @@ export declare const MAGIC_LINK_ATTRIBUTION_PARAM = "signup_attribution";
 export interface MagicLinkSignupAttribution {
     attribution?: Record<string, string>;
     anonymousId?: string;
+    sessionId?: string;
 }
 /**
  * Sign the attribution captured when a magic link is requested. The token is

package/dist/server/magic-link-attribution.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import { normalizeAnalyticsAnonymousId } from "../shared/analytics-anonymous-id.js";
+import { normalizeAnalyticsSessionId } from "../shared/analytics-session-id.js";
 export const MAGIC_LINK_ATTRIBUTION_PARAM = "signup_attribution";
 const MAGIC_LINK_ATTRIBUTION_TTL_SECONDS = 10 * 60;
 // A signup carries up to 17 first-touch and 16 last-touch properties.
@@ -33,12 +34,14 @@ export function encodeMagicLinkSignupAttribution(value, secret, now = Date.now()
         return undefined;
     const attribution = sanitizeAttribution(value.attribution);
     const anonymousId = normalizeAnalyticsAnonymousId(value.anonymousId);
+    const sessionId = normalizeAnalyticsSessionId(value.sessionId);
     if (!attribution && !anonymousId)
         return undefined;
     const payload = {
         exp: Math.floor(now / 1000) + MAGIC_LINK_ATTRIBUTION_TTL_SECONDS,
         ...(attribution ? { attribution } : {}),
         ...(anonymousId ? { anonymousId } : {}),
+        ...(sessionId ? { sessionId } : {}),
     };
     const data = encodePayload(payload);
     const signature = crypto
@@ -73,11 +76,13 @@ export function decodeMagicLinkSignupAttribution(token, secret, now = Date.now()
         }
         const attribution = sanitizeAttribution(payload.attribution);
         const anonymousId = normalizeAnalyticsAnonymousId(payload.anonymousId);
+        const sessionId = normalizeAnalyticsSessionId(payload.sessionId);
         if (!attribution && !anonymousId)
             return undefined;
         return {
             ...(attribution ? { attribution } : {}),
             ...(anonymousId ? { anonymousId } : {}),
+            ...(sessionId ? { sessionId } : {}),
         };
     }
     catch {

package/dist/shared/analytics-session-id.d.ts

@@ -0,0 +1,5 @@
+export declare const ANALYTICS_SESSION_ID_COOKIE_NAME = "an_sid";
+export declare const ANALYTICS_SESSION_ID_COOKIE_MAX_AGE_SECONDS: number;
+export declare const ANALYTICS_SESSION_ID_MAX_LENGTH = 127;
+export declare function normalizeAnalyticsSessionId(value: unknown): string | undefined;
+export declare function serializeAnalyticsSessionIdCookie(value: unknown): string | undefined;

package/dist/shared/analytics-session-id.js

@@ -0,0 +1,21 @@
+export const ANALYTICS_SESSION_ID_COOKIE_NAME = "an_sid";
+export const ANALYTICS_SESSION_ID_COOKIE_MAX_AGE_SECONDS = 30 * 60;
+export const ANALYTICS_SESSION_ID_MAX_LENGTH = 127;
+const ANALYTICS_SESSION_ID_PATTERN = /^[!-~]+$/;
+export function normalizeAnalyticsSessionId(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    if (!trimmed ||
+        trimmed.length > ANALYTICS_SESSION_ID_MAX_LENGTH ||
+        !ANALYTICS_SESSION_ID_PATTERN.test(trimmed)) {
+        return undefined;
+    }
+    return trimmed;
+}
+export function serializeAnalyticsSessionIdCookie(value) {
+    const sessionId = normalizeAnalyticsSessionId(value);
+    if (!sessionId)
+        return undefined;
+    return `${ANALYTICS_SESSION_ID_COOKIE_NAME}=${encodeURIComponent(sessionId)}; path=/; max-age=${ANALYTICS_SESSION_ID_COOKIE_MAX_AGE_SECONDS}; SameSite=Lax`;
+}

package/dist/triggers/actions/manage-automation.d.ts

@@ -14,6 +14,7 @@ declare const _default: import("../../action.js").ActionDefinition<{
     executionCwd?: string;
 }, {
     deleted?: undefined;
+    enabled?: undefined;
     created: boolean;
     name: string;
     scope: "organization" | "personal";
@@ -24,25 +25,24 @@ declare const _default: import("../../action.js").ActionDefinition<{
     reasoningEffort: "auto" | "high" | "low" | "max" | "medium" | "minimal" | "none" | "xhigh";
     webhookPath: string;
     nextRun: string;
-    enabled?: undefined;
     executionHostId?: undefined;
     executionEngine?: undefined;
     executionCwd?: undefined;
 } | {
+    enabled?: undefined;
+    nextRun?: undefined;
     created?: undefined;
     scope?: undefined;
     triggerType?: undefined;
     event?: undefined;
     deleted: boolean;
     name: string;
-    enabled?: undefined;
     schedule?: undefined;
     timezone?: undefined;
     reasoningEffort?: undefined;
     executionHostId?: undefined;
     executionEngine?: undefined;
     executionCwd?: undefined;
-    nextRun?: undefined;
     webhookPath?: undefined;
 } | {
     deleted?: undefined;

package/dist/vite/sentry-source-maps.d.ts

@@ -11,5 +11,6 @@ export interface SentrySourceMapUploadConfig extends SentrySourceMapUploadCreden
 }
 export declare function resolveSentrySourceMapUploadConfig(env?: Record<string, string | undefined>): SentrySourceMapUploadConfig | null;
 export declare function isSentrySourceMapUploadEnabled(env?: Record<string, string | undefined>): boolean;
+export declare function createSentryServerSourceMapUploadPlugins(env?: Record<string, string | undefined>): Promise<Plugin[]>;
 export declare function createSentrySourceMapUploadPlugin(env?: Record<string, string | undefined>): Plugin[];
 export {};

package/dist/vite/sentry-source-maps.js

@@ -68,6 +68,47 @@ function resolvedClientBuildId(config) {
     const buildId = JSON.parse(definedBuildId);
     return typeof buildId === "string" && buildId.trim() ? buildId.trim() : null;
 }
+async function loadSentryUploadPlugin(uploadConfig) {
+    const { sentryVitePlugin } = await loadOptionalPeer("@sentry/vite-plugin", () => import("@sentry/vite-plugin"));
+    const sentryPlugin = sentryVitePlugin({
+        org: uploadConfig.org,
+        project: uploadConfig.project,
+        authToken: uploadConfig.authToken,
+        url: uploadConfig.url,
+        telemetry: false,
+        release: {
+            name: uploadConfig.release,
+            inject: false,
+        },
+        // A source-map upload is optional observability work. The cleanup plugin
+        // still removes maps when this handler returns, so a bad token cannot
+        // block the deploy or publish source contents.
+        errorHandler: (error) => {
+            const message = (error instanceof Error ? error.message : String(error)).replaceAll(uploadConfig.authToken, "[redacted]");
+            console.warn(`Sentry source map upload failed; continuing without publishing source maps: ${message}`);
+        },
+    });
+    return Array.isArray(sentryPlugin) ? sentryPlugin[0] : sentryPlugin;
+}
+// Nitro bundles the server in its own rolldown pass after Vite, so the client
+// plugins never see the deployed server chunks. Callers must enable server
+// source maps exactly when this returns plugins, or the upload has no maps and
+// the cleanup has nothing to remove.
+export async function createSentryServerSourceMapUploadPlugins(env = process.env) {
+    const credentials = resolveSentrySourceMapUploadCredentials(env);
+    if (!credentials)
+        return [];
+    const buildId = resolveAgentNativeBuildId(env, "");
+    if (!buildId) {
+        console.warn("Sentry server source map upload skipped because the build ID is missing.");
+        return [];
+    }
+    const { enforce: _enforce, ...uploadPlugin } = await loadSentryUploadPlugin({
+        ...credentials,
+        release: `agent-native-server@${buildId}`,
+    });
+    return [uploadPlugin, createUploadedSourceMapCleanupPlugin()];
+}
 export function createSentrySourceMapUploadPlugin(env = process.env) {
     const credentials = resolveSentrySourceMapUploadCredentials(env);
     if (!credentials)
@@ -76,6 +117,12 @@ export function createSentrySourceMapUploadPlugin(env = process.env) {
     const proxyPlugin = {
         name: "sentry-vite-plugin",
         enforce: "pre",
+        // The SSR bundle is re-bundled by Nitro, which injects its own debug IDs.
+        // A second snippet inlined from SSR output would point server frames at a
+        // map whose positions no longer match.
+        applyToEnvironment(environment) {
+            return environment.name === "client";
+        },
         async configResolved(config) {
             if (config.command !== "build")
                 return;
@@ -88,28 +135,7 @@ export function createSentrySourceMapUploadPlugin(env = process.env) {
                 ...credentials,
                 release: `agent-native-client@${buildId}`,
             };
-            const { sentryVitePlugin } = await loadOptionalPeer("@sentry/vite-plugin", () => import("@sentry/vite-plugin"));
-            const sentryPlugin = sentryVitePlugin({
-                org: uploadConfig.org,
-                project: uploadConfig.project,
-                authToken: uploadConfig.authToken,
-                url: uploadConfig.url,
-                telemetry: false,
-                release: {
-                    name: uploadConfig.release,
-                    inject: false,
-                },
-                // A source-map upload is optional observability work. The cleanup plugin
-                // still removes maps when this handler returns, so a bad token cannot
-                // block the deploy or publish source contents.
-                errorHandler: (error) => {
-                    const message = (error instanceof Error ? error.message : String(error)).replaceAll(uploadConfig.authToken, "[redacted]");
-                    console.warn(`Sentry source map upload failed; continuing without publishing source maps: ${message}`);
-                },
-            });
-            uploadPlugin = Array.isArray(sentryPlugin)
-                ? sentryPlugin[0]
-                : sentryPlugin;
+            uploadPlugin = await loadSentryUploadPlugin(uploadConfig);
         },
         buildStart(options) {
             const hook = uploadPlugin?.buildStart;