Two layers of Eyepup integration

Layer 2 — deep integration via Claude Code

For OAuth, magic-link, server-side conversions, and any business event the browser can't see. Three new endpoints, one Claude Code prompt. The prompt below tells Claude how to wire everything into your codebase — auth flows, Stripe webhooks, custom events.

How to use

1. Open Claude Code in your project root: claude
2. Paste the prompt below.
3. Approve Claude's diff. Test. Ship.

The prompt

You are integrating Eyepup analytics into this codebase. Eyepup is a privacy-first, AI-powered visitor analytics tool that watches every session and writes a per-visitor verdict.

The user already pasted the Eyepup snippet on their site. Your job is to add the Layer 2 deep integration: explicit identify calls + server-side event tracking. Keep changes minimal and idempotent — don't refactor unrelated code.

## Your task

1. Read the codebase. Identify:
   - Auth flow (signin, signup, OAuth callback, logout)
   - Payment / subscription webhooks (Stripe / Paddle / LemonSqueezy)
   - Key business events the team would care about (signup_completed,
     plan_upgraded, feature_used, etc.)

2. Add the EYEPUP_PROJECT_TOKEN env var to .env.example. The user will
   find their token on https://eyepup.com/sites — it's the same token
   already in their snippet URL (`/t/<TOKEN>.js`).

3. Wire the THREE deep-integration calls:

### A) On signin / signup success (server-side, in the auth callback)

```ts
await fetch("https://eyepup.com/i/identify", {
  method: "POST",
  headers: {
    "content-type": "application/json",
    authorization: `Bearer ${process.env.EYEPUP_PROJECT_TOKEN}`,
  },
  body: JSON.stringify({
    distinct_id: anonymousIdFromCookie, // visitor's pre-auth id
    user_id: user.id,
    email: user.email,
    properties: { plan: user.plan, signup_at: user.createdAt },
  }),
}).catch(() => {});
```

The `distinct_id` is the visitor's pre-signin cookie value. Read it
from the request cookies — look for a cookie matching
`/^ph_phc_[a-z0-9]+_posthog$/`. Parse the JSON value and use
`distinct_id` from there. If the cookie isn't readable (httpOnly,
SSR), pass null — Eyepup falls back to passive detection.

### B) On Stripe / payment webhook (server-side)

```ts
// In the charge.succeeded / invoice.paid handler
await fetch("https://eyepup.com/i/conversion", {
  method: "POST",
  headers: {
    "content-type": "application/json",
    authorization: `Bearer ${process.env.EYEPUP_PROJECT_TOKEN}`,
  },
  body: JSON.stringify({
    distinct_id: customer.metadata.eyepup_distinct_id ?? customer.email,
    name: "subscribed",
    amount: charge.amount / 100,
    currency: charge.currency.toUpperCase(),
    properties: { plan, interval, source: "stripe_webhook" },
  }),
}).catch(() => {});
```

### C) On any meaningful business event (server OR browser)

Server-side:
```ts
fetch("https://eyepup.com/i/event", {
  method: "POST",
  headers: {
    "content-type": "application/json",
    authorization: `Bearer ${process.env.EYEPUP_PROJECT_TOKEN}`,
  },
  body: JSON.stringify({
    distinct_id: user.id,
    event: "feature_used",
    properties: { feature: "export_csv" },
  }),
}).catch(() => {});
```

Browser-side (the snippet exposes these as `window.eyepup.*`):
```ts
window.eyepup.identify(user.email, { plan: user.plan });
window.eyepup.capture("feature_used", { feature: "export_csv" });
```

## Constraints

- ALL fetch calls to eyepup.com MUST be wrapped in .catch(() => {}) —
  analytics MUST NEVER break the user's flow.
- Use `waitUntil()` (Vercel) or fire-and-forget on the runtime if
  available so the response isn't blocked on Eyepup.
- Don't log the project token to any error reporter.
- Don't add any new dependencies — these are fetch() calls.

## After you finish

Run the user's existing test suite. If it passes, summarize:
  1. Which auth flow you wired
  2. Which webhook handlers you hooked
  3. Any custom events you added
  4. Which env var to add to production (EYEPUP_PROJECT_TOKEN)