The shape of a visit,
captured — not replayed.
next-story is a lite, self-hosted journey recorder for Next.js. It reads navigation paths, rage-clicks, dead-clicks and conversions — no DOM snapshots, no video, no session replay. Query strings, raw IPs and the labels of password and card fields are never stored.
Requires Next.js ≥15.1.0 (App Router)
For agent & control-plane builders
Not a dashboard. A structured signal an agent can read.
Every session collapses into four typed events — page_view, rage_click, dead_click, and conversion — no page content, no screenshots. apps/agent-api exposes exactly three fixed, scoped endpoints on top of that data. No ad-hoc SQL, no arbitrary filters — a bounded surface a control-plane agent can query without guessing what it's allowed to ask.
GET /sites/:site_id/sessionsLLM-shaped session summariesGET /sites/:site_id/rollupDaily rollups with baseline columnsGET /sites/:site_id/comparePeriod-over-period deltas by route
What it actually does
Six things, done deliberately. Nothing else.
Rage & dead-click detection
A MutationObserver answers one boolean question — did anything happen? — plus a latency number. It never records what changed, and disconnects after every window.
Conversion tracking
Exactly two mechanisms: an explicit track('conversion', { name }) call, or one declarative conversion_route_pattern per site. No rule engine, no funnel builder.
Multi-tenant by design
Every event, token, and query is scoped to a site. Built to sit behind many properties from day one, not bolted on later.
Privacy invariants
URLs store as route_pattern only — never a query string or hash. Raw IP is never stored, only a daily-rotating-salt hash for bot detection.
Offline queue & batching
Client-side events wait in an IndexedDB queue through drops in connectivity and flush in batches, capped at 200 events per session.
Edge-safe collector
The server entrypoint is Web-Crypto-only — no Buffer, no node:crypto — so the collect handler can run on the Edge runtime.
See exactly what it records
Every field, cookie and retention rule, taken from the code.