feat(analytics): add Freebuff Ads conversion tracking

[waleedlatif1]

Summary

• Load the Freebuff Ads conversion tag (freebuff-tag.js) through the consent runtime under the marketing category, on every route so the ?bfcid= click id captured on a landing page is still available at /signup
• Report signup_completed from the email signup form (marketing consent only) with the new user's id as eventId
• Send the same conversion server-to-server from databaseHooks.user.create.after when a bfcid cookie is present, covering OAuth/SSO signups and blocked or not-yet-loaded tags; same eventId, so Freebuff dedupes the two reports into one
• Postback retries network failures and 5xx with the same eventId/occurredAt, treats every 4xx as terminal, is never awaited, and is disabled unless FREEBUFF_API_KEY is set
• Allow https://freebuff.com in hosted script-src and connect-src

Type of Change

• New feature

Testing

• bun run type-check (apps/sim)
• bun run test lib/consent lib/core/security lib/auth app/(auth)/signup: 62 files, 1,013 tests passing
• bun run lint, block-registry check, bun run check:audits (52 audits), docs-manifest:check
• Not yet verified end to end against Freebuff: that needs a campaign with conversion tracking and a signed test click id

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Oct 1, 2026 12:41am UTC

[cubic-dev-ai]

All reported issues were addressed across 7 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 4/5

[Medium risk] Adds third-party ad conversion tracking to signup flow.

The PR needs the new component brought into compliance with the repository’s explicit component rule before merging.

Findings

1.  Missing component props interface ▶

Summary

The PR adds consent-gated Freebuff conversion tracking through a browser tag and a server postback, with click-ID cleanup when marketing consent is absent.

• The follow-up change adds the cleanup component and mounts it across routes.
• The new component does not meet the repository’s props-interface requirement.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Marketing consent] -->|granted| B[Freebuff tag stores click ID]
  A -->|absent or withdrawn| C[Click-ID guard clears cookie]
  B --> D[Signup]
  D --> E[Browser conversion]
  D --> F[Server postback when cookie exists]
  E --> G[Freebuff deduplicates by event ID]
  F --> G

Loading

_{Reviews (2) · Last reviewed commit: "fix(analytics): drop the Freebuff click ..."}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 9 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}