@lightsage/mcp 0.4.16 → 0.4.18

package/src/models/v2taskscreateop.ts

@@ -0,0 +1,34 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 858a2209718a
+ */
+
+import * as z from "zod";
+import {
+  HTTPValidationError,
+  HTTPValidationError$zodSchema,
+} from "./httpvalidationerror.js";
+import { V2PublicTask, V2PublicTask$zodSchema } from "./v2publictask.js";
+
+/**
+ * The assignee is not a member of your organization.
+ */
+export type V2TasksCreateResponseBody = { detail: string };
+
+export const V2TasksCreateResponseBody$zodSchema: z.ZodType<
+  V2TasksCreateResponseBody
+> = z.object({
+  detail: z.string(),
+}).describe("The assignee is not a member of your organization.");
+
+export type V2TasksCreateResponse =
+  | V2PublicTask
+  | V2TasksCreateResponseBody
+  | HTTPValidationError;
+
+export const V2TasksCreateResponse$zodSchema: z.ZodType<V2TasksCreateResponse> =
+  z.union([
+    V2PublicTask$zodSchema,
+    z.lazy(() => V2TasksCreateResponseBody$zodSchema),
+    HTTPValidationError$zodSchema,
+  ]);

package/src/models/v2visibilitycitationslistop.ts

@@ -35,6 +35,7 @@ export type V2VisibilityCitationsListRequest = {
   platform?: string | undefined;
   source_type?: V2VisibilityCitationsListSourceType | undefined;
   limit?: number | undefined;
+  period?: string | undefined;
 };
 
 export const V2VisibilityCitationsListRequest$zodSchema: z.ZodType<
@@ -44,6 +45,9 @@ export const V2VisibilityCitationsListRequest$zodSchema: z.ZodType<
     "Inclusive range end; defaults to today.",
   ).optional(),
   limit: z.int().default(20),
+  period: z.string().describe(
+    "Named period, resolved in UTC by the server: `last_7_days`, `last_14_days`, `last_30_days`, `last_90_days` (N days ending today), `this_week`, `last_week`, an ISO week such as `2026-W43` (Monday to Sunday), `this_month`, `last_month`, a month such as `2026-10`, `this_quarter`, `last_quarter`, or a quarter such as `2026Q4`. A current week, month, or quarter ends today. The response's `period` gives the resolved dates and the matching previous period. Do not combine with `start_date` or `end_date`.",
+  ).optional(),
   platform: z.string().describe("Optional answer-platform ID, name, or slug.")
     .optional(),
   source_type: V2VisibilityCitationsListSourceType$zodSchema.default("all"),

package/src/models/v2visibilitycitationssummaryretrieveop.ts

@@ -0,0 +1,113 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ * @generated-id: 704776418479
+ */
+
+import * as z from "zod";
+import { ClosedEnum } from "../types/enums.js";
+import {
+  HTTPValidationError,
+  HTTPValidationError$zodSchema,
+} from "./httpvalidationerror.js";
+import {
+  PublicCitationSummaryResponse,
+  PublicCitationSummaryResponse$zodSchema,
+} from "./publiccitationsummaryresponse.js";
+
+/**
+ * How to group citations.
+ */
+export const V2VisibilityCitationsSummaryRetrieveGroupBy = {
+  UrlPrefix: "url_prefix",
+  Url: "url",
+  Domain: "domain",
+  Day: "day",
+} as const;
+/**
+ * How to group citations.
+ */
+export type V2VisibilityCitationsSummaryRetrieveGroupBy = ClosedEnum<
+  typeof V2VisibilityCitationsSummaryRetrieveGroupBy
+>;
+
+export const V2VisibilityCitationsSummaryRetrieveGroupBy$zodSchema = z.enum([
+  "url_prefix",
+  "url",
+  "domain",
+  "day",
+]).describe("How to group citations.");
+
+/**
+ * All citations, only owned company domains, or only external ones.
+ */
+export const V2VisibilityCitationsSummaryRetrieveSourceType = {
+  All: "all",
+  Owned: "owned",
+  External: "external",
+} as const;
+/**
+ * All citations, only owned company domains, or only external ones.
+ */
+export type V2VisibilityCitationsSummaryRetrieveSourceType = ClosedEnum<
+  typeof V2VisibilityCitationsSummaryRetrieveSourceType
+>;
+
+export const V2VisibilityCitationsSummaryRetrieveSourceType$zodSchema = z.enum([
+  "all",
+  "owned",
+  "external",
+]).describe(
+  "All citations, only owned company domains, or only external ones.",
+);
+
+export type V2VisibilityCitationsSummaryRetrieveRequest = {
+  period?: string | undefined;
+  start_date?: string | undefined;
+  end_date?: string | undefined;
+  group_by?: V2VisibilityCitationsSummaryRetrieveGroupBy | undefined;
+  url_prefix?: string | undefined;
+  source_type?: V2VisibilityCitationsSummaryRetrieveSourceType | undefined;
+  platform?: string | undefined;
+  limit?: number | undefined;
+};
+
+export const V2VisibilityCitationsSummaryRetrieveRequest$zodSchema: z.ZodType<
+  V2VisibilityCitationsSummaryRetrieveRequest
+> = z.object({
+  end_date: z.string().date().describe(
+    "Inclusive range end; defaults to today.",
+  ).optional(),
+  group_by: V2VisibilityCitationsSummaryRetrieveGroupBy$zodSchema.default(
+    "url_prefix",
+  ).describe("How to group citations."),
+  limit: z.int().default(20).describe(
+    "Groups to return; `day` groups return every day.",
+  ),
+  period: z.string().describe(
+    "Named period, resolved in UTC by the server: `last_7_days`, `last_14_days`, `last_30_days`, `last_90_days` (N days ending today), `this_week`, `last_week`, an ISO week such as `2026-W43` (Monday to Sunday), `this_month`, `last_month`, a month such as `2026-10`, `this_quarter`, `last_quarter`, or a quarter such as `2026Q4`. A current week, month, or quarter ends today. The response's `period` gives the resolved dates and the matching previous period. Do not combine with `start_date` or `end_date`.",
+  ).optional(),
+  platform: z.string().describe("Optional answer-platform ID, name, or slug.")
+    .optional(),
+  source_type: V2VisibilityCitationsSummaryRetrieveSourceType$zodSchema.default(
+    "all",
+  ).describe(
+    "All citations, only owned company domains, or only external ones.",
+  ),
+  start_date: z.string().date().describe(
+    "Inclusive range start; defaults to 30 days before the end date. The range may span at most 90 days.",
+  ).optional(),
+  url_prefix: z.string().describe(
+    "Only citations under this URL prefix, such as `https://example.com/blog/`. Scheme and `www.` are ignored.",
+  ).optional(),
+});
+
+export type V2VisibilityCitationsSummaryRetrieveResponse =
+  | PublicCitationSummaryResponse
+  | HTTPValidationError;
+
+export const V2VisibilityCitationsSummaryRetrieveResponse$zodSchema: z.ZodType<
+  V2VisibilityCitationsSummaryRetrieveResponse
+> = z.union([
+  PublicCitationSummaryResponse$zodSchema,
+  HTTPValidationError$zodSchema,
+]);

package/src/models/v2visibilitycurrentretrieveop.ts

@@ -16,6 +16,7 @@ import {
 export type V2VisibilityCurrentRetrieveRequest = {
   start_date?: string | undefined;
   end_date?: string | undefined;
+  period?: string | undefined;
 };
 
 export const V2VisibilityCurrentRetrieveRequest$zodSchema: z.ZodType<
@@ -24,6 +25,9 @@ export const V2VisibilityCurrentRetrieveRequest$zodSchema: z.ZodType<
   end_date: z.string().date().describe(
     "Inclusive range end; defaults to today.",
   ).optional(),
+  period: z.string().describe(
+    "Named period, resolved in UTC by the server: `last_7_days`, `last_14_days`, `last_30_days`, `last_90_days` (N days ending today), `this_week`, `last_week`, an ISO week such as `2026-W43` (Monday to Sunday), `this_month`, `last_month`, a month such as `2026-10`, `this_quarter`, `last_quarter`, or a quarter such as `2026Q4`. A current week, month, or quarter ends today. The response's `period` gives the resolved dates and the matching previous period. Do not combine with `start_date` or `end_date`.",
+  ).optional(),
   start_date: z.string().date().describe(
     "Inclusive range start; defaults to 30 days before the end date. The range may span at most 90 days.",
   ).optional(),

package/src/models/v2visibilityoverviewretrieveop.ts

@@ -16,6 +16,7 @@ import {
 export type V2VisibilityOverviewRetrieveRequest = {
   start_date?: string | undefined;
   end_date?: string | undefined;
+  period?: string | undefined;
 };
 
 export const V2VisibilityOverviewRetrieveRequest$zodSchema: z.ZodType<
@@ -24,6 +25,9 @@ export const V2VisibilityOverviewRetrieveRequest$zodSchema: z.ZodType<
   end_date: z.string().date().describe(
     "Inclusive range end; defaults to today.",
   ).optional(),
+  period: z.string().describe(
+    "Named period, resolved in UTC by the server: `last_7_days`, `last_14_days`, `last_30_days`, `last_90_days` (N days ending today), `this_week`, `last_week`, an ISO week such as `2026-W43` (Monday to Sunday), `this_month`, `last_month`, a month such as `2026-10`, `this_quarter`, `last_quarter`, or a quarter such as `2026Q4`. A current week, month, or quarter ends today. The response's `period` gives the resolved dates and the matching previous period. Do not combine with `start_date` or `end_date`.",
+  ).optional(),
   start_date: z.string().date().describe(
     "Inclusive range start; defaults to 30 days before the end date. The range may span at most 90 days.",
   ).optional(),

package/src/models/v2visibilitypromptsretrieveop.ts

@@ -16,6 +16,7 @@ import {
 export type V2VisibilityPromptsRetrieveRequest = {
   start_date?: string | undefined;
   end_date?: string | undefined;
+  period?: string | undefined;
 };
 
 export const V2VisibilityPromptsRetrieveRequest$zodSchema: z.ZodType<
@@ -24,6 +25,9 @@ export const V2VisibilityPromptsRetrieveRequest$zodSchema: z.ZodType<
   end_date: z.string().date().describe(
     "Inclusive range end; defaults to today.",
   ).optional(),
+  period: z.string().describe(
+    "Named period, resolved in UTC by the server: `last_7_days`, `last_14_days`, `last_30_days`, `last_90_days` (N days ending today), `this_week`, `last_week`, an ISO week such as `2026-W43` (Monday to Sunday), `this_month`, `last_month`, a month such as `2026-10`, `this_quarter`, `last_quarter`, or a quarter such as `2026Q4`. A current week, month, or quarter ends today. The response's `period` gives the resolved dates and the matching previous period. Do not combine with `start_date` or `end_date`.",
+  ).optional(),
   start_date: z.string().date().describe(
     "Inclusive range start; defaults to 30 days before the end date. The range may span at most 90 days.",
   ).optional(),

package/src/tool-names.ts

@@ -10,20 +10,24 @@ export const toolNames: Array<{ name: string; description: string }>= [
   },
   {
     "name": "visibility-current-retrieve",
-    "description": "Retrieve Current Visibility\n\nReturns recommendation score, visibility score, ranks, and date-range metadata for the configured primary company. Metrics are computed from active prompts only; when no data exists, values are `null`."
+    "description": "Retrieve Current Visibility\n\nReturns recommendation score, visibility score, ranks, and date-range metadata for the configured primary company, with the same metrics for the previous period, run coverage, and per-run rates. Metrics are computed from active prompts only; when no data exists, values are `null`. Pass `period` (for example `last_30_days` or `2026Q4`) instead of computing dates."
   },
   {
     "name": "visibility-overview-retrieve",
-    "description": "Retrieve Visibility Overview\n\nReturns aggregate snapshot, daily trends, per-platform breakdowns, and competitor comparison. Calculated from active prompts only."
+    "description": "Retrieve Visibility Overview\n\nReturns aggregate snapshot, daily trends, per-platform breakdowns, and competitor comparison, with run coverage and per-run rates against the previous period. Calculated from active prompts only."
   },
   {
     "name": "visibility-citations-list",
-    "description": "List Top Cited Urls\n\nReturns URL-level citation counts ranked from most to least cited. Results can be filtered by platform and to owned or external sources."
+    "description": "List Top Cited Urls\n\nReturns URL-level citation counts ranked from most to least cited. Results can be filtered by platform and to owned or external sources. For totals by URL prefix, domain, or day compared with the previous period, use the citations summary."
   },
   {
     "name": "visibility-prompts-retrieve",
     "description": "Retrieve Prompt Visibility Report\n\nReturns per-topic and per-prompt visibility metrics including recommendation score, rank, visibility score, average position, and citation counts."
   },
+  {
+    "name": "visibility-citations-summary-retrieve",
+    "description": "Retrieve Citation Summary\n\nReturns citation totals grouped by URL prefix (domain and first path segment, such as `example.com/blog`), URL, domain, or day, each compared with the previous period, with per-run rates and run coverage. Filter to one section of a site with `url_prefix`, for example `https://example.com/blog/`. Aggregated in one call; use it instead of paging the citations list."
+  },
   {
     "name": "prompts-list",
     "description": "List Prompts\n\nReturns active and inactive prompts by default. Set `include_archived` to include archived prompts."
@@ -70,12 +74,16 @@ export const toolNames: Array<{ name: string; description: string }>= [
   },
   {
     "name": "prompts-run",
-    "description": "Run Prompts\n\nQueue saved prompts using the organization's configured targets.\n\nProvide `prompt_ids` to run selected prompts, or omit them to run all active\nprompts. Saved prompt run settings apply to coding-agent targets. The\nresponse returns a run ID to poll with\n`GET /v2/prompts/runs/{run_id}/status`."
+    "description": "Run Prompts\n\nQueue saved prompts on answer engines and coding agents.\n\nProvide `prompt_ids` to run selected prompts, or omit them to run all active\nprompts. By default the run uses the organization's configured targets.\nProvide `agent` with IDs from `GET /v2/agents` to run the prompts on\nspecific coding-agent harnesses and models instead, for example to compare\nhow several coding tools answer the same developer question. Results\ninclude mentions and citations. Saved prompt run settings apply to\ncoding-agent targets. The response returns a run ID to poll with\n`GET /v2/prompts/runs/{run_id}/status`."
   },
   {
     "name": "prompts-run-status",
     "description": "Get Prompt Run Status\n\nReturn status and progress for a queued prompt run.\n\nPoll this endpoint until `status` is `completed`, `failed`, or `cancelled`.\nIndividual stored results are available from `GET /v2/prompts/runs`."
   },
+  {
+    "name": "prompts-run-cancel",
+    "description": "Cancel a prompt run\n\nMarks an active prompt run as cancelled and prevents queued prompts from starting. Running coding-agent attempts are stopped asynchronously. Requests already sent to an answer platform cannot be recalled, so prompts already in progress may still finish and store their results, but the run stays cancelled. Prompts that never start use no usage-based credits. The response has the same shape as the status operation, with cancelled prompts counted in `progress.cancelled`. Repeating this request for an already-cancelled run is safe."
+  },
   {
     "name": "opportunities-list",
     "description": "List Opportunities\n\nReturns ranked opportunities computed from stored prompt visibility results. Each includes an `execution_prompt` with context for an AI agent. Default window is 30 days."
@@ -88,6 +96,10 @@ export const toolNames: Array<{ name: string; description: string }>= [
     "name": "tasks-list",
     "description": "List Tasks\n\nReturns persisted daily tasks with execution instructions. Includes per-status counts not narrowed by the `status` filter."
   },
+  {
+    "name": "tasks-create",
+    "description": "Create Task\n\nAdds a task to today's queue and returns it with its execution prompt. New tasks start as `new`."
+  },
   {
     "name": "tasks-retrieve",
     "description": "Retrieve Task\n\nReturns one persisted task and its execution prompt."
@@ -104,13 +116,37 @@ export const toolNames: Array<{ name: string; description: string }>= [
     "name": "site-audits-retrieve",
     "description": "Retrieve Site Audit\n\nReturns one audited page with its score, priority, supporting evidence, and recommended fixes."
   },
+  {
+    "name": "agent-analytics-sites-list",
+    "description": "List Agent Analytics Sites\n\nReturns every site with tracked visits. Use a `site_id` from this list to read that site's agent traffic."
+  },
+  {
+    "name": "agent-analytics-summary-retrieve",
+    "description": "Retrieve Agent Analytics Summary\n\nReturns a site's visits by traffic type (coding agents, user-requested AI fetches, AI search, AI training, other bots, and people) for the date range and for the previous period (the same number of days before it, or the previous calendar week, month, or quarter for a named `period`)."
+  },
+  {
+    "name": "agent-analytics-sources-list",
+    "description": "List Agent Analytics Sources\n\nReturns every coding agent and bot that visited a site in the date range, with its traffic type and visit count, most visits first. Human visits are one `people` row."
+  },
+  {
+    "name": "agent-analytics-pages-list",
+    "description": "List Agent Analytics Pages\n\nReturns the pages AI agents and bots read on a site in the date range, with visits per traffic type. Sorted by AI visits unless `sort` is set. With `type`, returns only pages that traffic type visited. With `agent`, returns only the pages that one coding agent read."
+  },
+  {
+    "name": "agent-analytics-error-pages-list",
+    "description": "List Agent Analytics Error Pages\n\nReturns the pages on a site that returned an error status (400 and up) in the date range, most error requests first, with the agents, bots, and people that got each error. Set `status` to 404 for pages that were not found. Needs server-side tracking that records status codes; `status_codes_tracked` says whether the site has any."
+  },
+  {
+    "name": "agent-analytics-countries-list",
+    "description": "List Agent Analytics Countries\n\nReturns a site's visits from coding agents and AI assistants per country in the date range, most visits first."
+  },
   {
     "name": "evals-list",
     "description": "List Evals\n\nReturns all active eval definitions owned by the organization. Agent Preference evals are not included; list them with `GET /v2/agent-preference/evals`."
   },
   {
     "name": "evals-create",
-    "description": "Create Eval\n\nCreates a reusable simulation definition with one or more task prompts and judges. Optional agents, persona, CLI installations, MCP servers, setup commands, cleanup commands, grounding policy, repeat count, and tags are saved with the eval. `search_grounding` supports `disabled`, `enabled`, and `default`; `default` preserves normal platform behavior. Creating the eval does not start a run and does not accept secret environment values."
+    "description": "Create Eval\n\nCreates a reusable simulation definition with one or more task prompts and judges. Optional agents, persona, CLI installations, MCP servers, setup commands, cleanup commands, grounding policy, repeat count, and tags are saved with the eval. `search_grounding` supports `disabled`, `enabled`, and `default`; `default` preserves normal platform behavior. Creating the eval does not start a run and does not accept secret environment values.\n\nEvals measure how well agents complete tasks with your product. To track how agents and answer engines answer research questions, including which brands they mention and cite, run prompts with `POST /v2/prompts/runs` instead."
   },
   {
     "name": "evals-batch-create",
@@ -150,7 +186,7 @@ export const toolNames: Array<{ name: string; description: string }>= [
   },
   {
     "name": "evals-run",
-    "description": "Start an eval run\n\nQueues a durable eval job and returns immediately with a polling ID. Poll `GET /v2/eval-runs/{run_id}` until its status reaches a terminal value; once finished it also returns the results and analysis. Follow a run live with the monitor operation.\n\nSend one of these flat request forms:\n\n- **Saved eval:** provide `eval_id`; optionally replace its prompts, persona, agents, CLIs, MCPs, setup commands, cleanup commands, or runs for this launch. A saved configuration can still provide repository, environment, skills, and legacy tool selections.\n- **Direct create-and-run:** provide `prompts`, `judges`, and `agent`. You may also provide a persona, tags, repository, write-only environment variables, saved or inline CLIs and MCP servers, skills, setup commands, and cleanup commands.\n\nThe run fans out across prompts × agents × runs. Persona is shared metadata and does not multiply attempts. No separate `mode` field is required. If the organization lacks the estimated credits, the request fails with `402` before dispatching work.\n\nA saved or inline environment containing an empty or placeholder credential is rejected with `400` before any evaluation is dispatched."
+    "description": "Start an eval run\n\nQueues a durable eval job and returns immediately with a polling ID. Poll `GET /v2/eval-runs/{run_id}` until its status reaches a terminal value; once finished it also returns the results and analysis. Follow a run live with the monitor operation.\n\nEval runs measure how well agents complete tasks with your product. To compare how coding agents and answer engines answer the same research question, with mentions and citations, use `POST /v2/prompts/runs` with `agent` instead.\n\nSend one of these flat request forms:\n\n- **Saved eval:** provide `eval_id`; optionally replace its prompts, persona, agents, CLIs, MCPs, setup commands, cleanup commands, or runs for this launch. A saved configuration can still provide repository, environment, skills, and legacy tool selections.\n- **Direct create-and-run:** provide `prompts`, `judges`, and `agent`. You may also provide a persona, tags, repository, write-only environment variables, saved or inline CLIs and MCP servers, skills, setup commands, and cleanup commands.\n\nThe run fans out across prompts × agents × runs. Persona is shared metadata and does not multiply attempts. No separate `mode` field is required. If the organization lacks the estimated credits, the request fails with `402` before dispatching work.\n\nA saved or inline environment containing an empty or placeholder credential is rejected with `400` before any evaluation is dispatched."
   },
   {
     "name": "evals-cancel",
@@ -222,7 +258,7 @@ export const toolNames: Array<{ name: string; description: string }>= [
   },
   {
     "name": "agents-list",
-    "description": "List Agents\n\nReturns the harness-and-model combinations your plan can run, as single agent IDs for use in eval runs."
+    "description": "List Agents\n\nReturns the coding-agent harness-and-model combinations your plan can run, as single agent IDs. Pass them as `agent` to `POST /v2/prompts/runs` to see how coding agents answer your prompts, with mentions and citations; to `POST /v2/agent-preference/evals` to see whether agents recommend your company over one competitor; or to `POST /v2/evals` and `POST /v2/eval-runs` to measure how well agents complete tasks with your product."
   },
   {
     "name": "repositories-list",

package/test/tracker.test.js

@@ -0,0 +1,323 @@
+import assert from "node:assert/strict";
+import http from "node:http";
+import test from "node:test";
+
+process.env.MCP_OAUTH_ENABLED = "false";
+process.env.LIGHTSAGE_MCP_TRACKER_API_KEY = "lsmcp_test_key";
+
+// Capture analytics batches instead of sending them.
+const batches = [];
+const authChecks = [];
+let analyticsHangs = false;
+const realFetch = globalThis.fetch;
+globalThis.fetch = async (url, init) => {
+  if (String(url).includes("/v2/auth/status")) {
+    authChecks.push(init.headers["X-Lightsage-Api-Key"]);
+    const valid = !String(init.headers["X-Lightsage-Api-Key"]).startsWith("ls_bad");
+    return new Response("{}", { status: valid ? 200 : 401 });
+  }
+  if (String(url).includes("mcp-analytics")) {
+    // Never settles and ignores the abort signal.
+    if (analyticsHangs) return new Promise(() => {});
+    batches.push({ headers: init.headers, body: JSON.parse(init.body) });
+    return new Response("{}", { status: 200 });
+  }
+  return realFetch(url, init);
+};
+
+const { default: handler } = await import("../api/mcp.js");
+const { Client } = await import(
+  "@modelcontextprotocol/sdk/client/index.js"
+);
+const { StreamableHTTPClientTransport } = await import(
+  "@modelcontextprotocol/sdk/client/streamableHttp.js"
+);
+
+function createServer() {
+  return http.createServer(async (req, res) => {
+    res.status = (code) => {
+      res.statusCode = code;
+      return res;
+    };
+    res.json = (value) => {
+      res.setHeader("content-type", "application/json");
+      res.end(JSON.stringify(value));
+    };
+
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    const body = Buffer.concat(chunks).toString("utf8");
+    req.body = body ? JSON.parse(body) : undefined;
+    await handler(req, res);
+  });
+}
+
+function initializeRequest(url) {
+  return realFetch(url, {
+    method: "POST",
+    headers: {
+      accept: "application/json, text/event-stream",
+      "content-type": "application/json",
+      "lightsage-api-key-auth": "ls_test_key",
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "initialize",
+      params: {
+        protocolVersion: "2025-11-25",
+        capabilities: {},
+        clientInfo: { name: "tracker-test", version: "1.0.0" },
+      },
+    }),
+  });
+}
+
+function sentEvents() {
+  return batches.flatMap((batch) =>
+    batch.body.events ?? [batch.body]
+  );
+}
+
+test("tracks the handshake and tool calls and flushes before the handler returns", async () => {
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  const url = new URL(`http://127.0.0.1:${address.port}/mcp`);
+  const client = new Client({ name: "tracker-test", version: "1.0.0" });
+
+  try {
+    await client.connect(
+      new StreamableHTTPClientTransport(url, {
+        fetch: realFetch,
+        requestInit: { headers: { "lightsage-api-key-auth": "ls_test_key" } },
+      }),
+    );
+    await client.listTools();
+    await client.callTool({ name: "list_tools", arguments: {} });
+
+    const events = sentEvents();
+    const initialize = events.find((e) => e.event === "$mcp_initialize");
+    assert.equal(initialize?.client_name, "tracker-test");
+    assert.equal(initialize?.server_name, "LightsageMcp");
+    assert.ok(events.some((e) => e.event === "$mcp_tools_list"));
+    assert.ok(
+      events.some((e) =>
+        e.event === "$mcp_tool_call" && e.tool_name === "list_tools"
+      ),
+    );
+    assert.ok(
+      JSON.stringify(batches[0].headers).includes("lsmcp_test_key"),
+    );
+
+    // Each request is a new stateless server, so these only line up because
+    // the session comes from the caller's credential.
+    const toolCall = events.find((e) => e.event === "$mcp_tool_call");
+    assert.match(toolCall.session_id, /^mcp_caller_[0-9a-f]{32}$/);
+    assert.ok(events.every((e) => e.session_id === toolCall.session_id));
+    assert.equal(toolCall.client_name, "tracker-test");
+    assert.ok(!JSON.stringify(events).includes("ls_test_key"));
+  } finally {
+    await client.close();
+    await new Promise((resolve) => server.close(resolve));
+  }
+});
+
+test("caller sessions are stable per credential and client, and never contain the credential", async () => {
+  const { callerSessionId } = await import("../lib/tracker.js");
+  const alice = callerSessionId({
+    headers: { "x-lightsage-api-key": "ls_alice", "user-agent": "claude-code/2.1.3" },
+  });
+  assert.equal(
+    alice,
+    callerSessionId({
+      headers: { "x-lightsage-api-key": "ls_alice", "user-agent": "claude-code/2.1.3" },
+    }),
+  );
+  assert.notEqual(
+    alice,
+    callerSessionId({ headers: { "x-lightsage-api-key": "ls_bob", "user-agent": "claude-code/2.1.3" } }),
+  );
+  assert.notEqual(
+    alice,
+    callerSessionId({ headers: { "x-lightsage-api-key": "ls_alice", "user-agent": "cursor/1.0" } }),
+  );
+  assert.ok(!alice.includes("ls_alice"));
+  assert.match(
+    callerSessionId({ headers: { authorization: "Bearer oauth_token" } }),
+    /^mcp_caller_/,
+  );
+  assert.equal(callerSessionId({ headers: {} }), undefined);
+});
+
+test("a stalled analytics request does not hold the handler open", async () => {
+  analyticsHangs = true;
+  let handlerMs;
+  const server = http.createServer(async (req, res) => {
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    req.body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    const started = Date.now();
+    await handler(req, res);
+    handlerMs = Date.now() - started;
+  });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+
+  try {
+    const response = await initializeRequest(
+      `http://127.0.0.1:${address.port}/mcp`,
+    );
+    assert.equal(response.status, 200);
+    await response.text();
+    await new Promise((resolve) => setTimeout(resolve, 3500));
+    assert.ok(handlerMs !== undefined && handlerMs < 3500, `handler took ${handlerMs}ms`);
+  } finally {
+    analyticsHangs = false;
+    await new Promise((resolve) => server.close(resolve));
+  }
+});
+
+test("on Vercel the analytics flush is registered with waitUntil", async () => {
+  // Vercel exposes the request context on this symbol; @vercel/functions reads it.
+  const contextSymbol = Symbol.for("@vercel/request-context");
+  const registered = [];
+  globalThis[contextSymbol] = {
+    get: () => ({ waitUntil: (promise) => registered.push(promise) }),
+  };
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+
+  try {
+    const response = await initializeRequest(
+      `http://127.0.0.1:${address.port}/mcp`,
+    );
+    assert.equal(response.status, 200);
+    await response.text();
+    await Promise.all(registered);
+    assert.equal(registered.length, 1);
+  } finally {
+    delete globalThis[contextSymbol];
+    await new Promise((resolve) => server.close(resolve));
+  }
+});
+
+
+async function postJsonRpc(url, headers, method, params, id = 1) {
+  const response = await realFetch(url, {
+    method: "POST",
+    headers: {
+      accept: "application/json, text/event-stream",
+      "content-type": "application/json",
+      ...headers,
+    },
+    body: JSON.stringify({ jsonrpc: "2.0", id, method, params }),
+  });
+  await response.text();
+  return response.status;
+}
+
+async function withServer(fn) {
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  try {
+    await fn(`http://127.0.0.1:${server.address().port}/mcp`);
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+}
+
+test("calls with a made-up API key are served but not recorded, even with a forged caller header", async () => {
+  await withServer(async (url) => {
+    const before = sentEvents().length;
+    const status = await postJsonRpc(
+      url,
+      {
+        "x-lightsage-api-key": "ls_bad_made_up",
+        "x-lightsage-verified-caller": "oauth:someone_else",
+      },
+      "tools/call",
+      { name: "list_tools", arguments: {} },
+    );
+    assert.equal(status, 200);
+    assert.equal(sentEvents().length, before);
+    assert.ok(authChecks.includes("ls_bad_made_up"));
+  });
+});
+
+test("the in-app agent's headers attribute the user, run and request, and search results are kept", async () => {
+  await withServer(async (url) => {
+    const before = sentEvents().length;
+    await postJsonRpc(
+      url,
+      {
+        "x-lightsage-api-key": "ls_agent_key",
+        "user-agent": "Lightsage-Agent/1.0",
+        "x-lightsage-agent-user": "user_123",
+        "x-lightsage-agent-run": "run_9",
+        "x-lightsage-agent-intent": encodeURIComponent("What's my visibility — today?"),
+      },
+      "tools/call",
+      { name: "list_tools", arguments: { search_terms: ["visibility"] } },
+    );
+    const call = sentEvents().slice(before).find((e) => e.event === "$mcp_tool_call");
+    assert.equal(call.client_name, "Lightsage-Agent");
+    assert.equal(call.distinct_id, "user_123");
+    assert.equal(call.conversation_id, "run_9");
+    assert.equal(call.intent, "What's my visibility — today?");
+    assert.deepEqual(call.properties, { auth: "api_key" });
+    // A catalog search result is kept: it is how empty searches are detected
+    assert.ok(call.response?.content?.length);
+    assert.match(call.session_id, /^mcp_caller_/);
+  });
+});
+
+test("an API key is checked once and then cached", async () => {
+  const { isTrackedApiKey } = await import("../lib/tracker.js");
+  let checks = 0;
+  const fakeFetch = async () => {
+    checks += 1;
+    return new Response("{}", { status: 200 });
+  };
+  assert.equal(await isTrackedApiKey("ls_cached", "https://api.example.test", fakeFetch), true);
+  assert.equal(await isTrackedApiKey("ls_cached", "https://api.example.test", fakeFetch), true);
+  assert.equal(checks, 1);
+
+  const failing = async () => {
+    throw new Error("network down");
+  };
+  // An unreachable API does not lose analytics, and is not cached
+  assert.equal(await isTrackedApiKey("ls_unknown", "https://api.example.test", failing), true);
+  const rejecting = async () => new Response("{}", { status: 401 });
+  assert.equal(await isTrackedApiKey("ls_unknown", "https://api.example.test", rejecting), false);
+});
+
+test("OAuth sessions follow the user, not the token", async () => {
+  const { callerSessionId } = await import("../lib/tracker.js");
+  const first = callerSessionId({
+    headers: {
+      authorization: "Bearer token_a",
+      "x-lightsage-verified-caller": "oauth:user_1",
+      "user-agent": "claude-code/2.1.3",
+    },
+  });
+  const refreshed = callerSessionId({
+    headers: {
+      authorization: "Bearer token_b",
+      "x-lightsage-verified-caller": "oauth:user_1",
+      "user-agent": "claude-code/2.1.3",
+    },
+  });
+  assert.equal(first, refreshed);
+});
+
+
+test("only failed calls and catalog tool results are stored", async () => {
+  const { shouldStoreResponse } = await import("../lib/tracker.js");
+  assert.equal(shouldStoreResponse({ toolName: "list_tools", isError: false }), true);
+  assert.equal(shouldStoreResponse({ toolName: "describe_tool_input", isError: false }), true);
+  assert.equal(shouldStoreResponse({ toolName: "execute_tool", isError: false }), false);
+  assert.equal(shouldStoreResponse({ toolName: "get_profile", isError: false }), false);
+  assert.equal(shouldStoreResponse({ toolName: "execute_tool", isError: true }), true);
+});