@agent-native/core-corpus 0.201.0-nightly-20261005153421 → 0.201.0

package/corpus/README.md

@@ -32,4 +32,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core-corpus/corpu
 
 ## Generated Counts
 
-- template files: 11091
+- template files: 11150

package/corpus/templates/analytics/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/corpus/templates/analytics/.agents/skills/session-replay/SKILL.md

@@ -88,10 +88,20 @@ agent answers about browser recordings in the Analytics template.
   The catalog keeps the 1,000 most recently seen events, sorted by volume, and
   sets `truncated` when it cut the list; its app flags still count every event
   in the range.
-- Unique indexes hold caller text raw, so it must stay short enough for an
-  index entry: index rows use hashed ids, event names and apps are cut to 200
-  and 100 characters, and a session id over 256 characters skips the index.
-  Bound any new caller value before it reaches a key.
+- Indexes hold caller text raw, and one entry over Postgres's limit fails the
+  whole batch. Ingest cuts every indexed value with
+  `server/lib/indexed-text.ts` (event name, app, template, path) before any
+  table sees it. A long user key keeps a prefix plus a hash of the whole value
+  (`boundedIdentity`), so two users never merge into one. Row ids built from
+  caller text go through `indexedRowId`, which hashes an id that
+  percent-encoding made too long. Session and recording ids are never cut,
+  because a cut id could merge two sessions: replay ingest rejects session and
+  recording ids over 256 characters, and an event's longer session id skips the
+  session index. Bound any new indexed caller value there.
+- Public ingest (`/track`, `/api/analytics/replay`) returns a thrown message
+  only for an error built with `requestError` (a numeric `statusCode`). Any
+  other failure is logged and answered with a generic 500, because its message
+  can quote internal database details.
 - Event filters exclude a session if any of its recordings started before the
   tenant's coverage start, because one analytics session can span tabs.
   Coverage starts only after a session write succeeds, and the reported start

package/corpus/templates/analytics/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/corpus/templates/analytics/CHANGELOG.md

@@ -7,8 +7,14 @@ time from the command menu (Cmd+K → "What's new") or from Settings.
 
 ### Improved
 
+- Builder.io setup now explains free credits and the existing-account option.
+- Owners and admins can save data source credentials for the whole organization or just for themselves.
 - Retention reports now compare returns from paid and untagged signups.
 
+### Fixed
+
+- Events with a very long name, app, or page path no longer cause the rest of their batch to be lost
+
 ## 2026-10-01
 
 ### Improved

package/corpus/templates/analytics/README.md

@@ -4,7 +4,7 @@ An open-source, agent-native alternative to Amplitude and FullStory. Ask
 analytics questions in plain English and get charts, dashboards, and re-runnable
 investigations back — you own the code, the queries, and the data.
 
-**Live app: [analytics.agent-native.com](https://analytics.agent-native.com)**
+**Live app: [analytics.agent-native.com](https://analytics.agent-native.com?utm_source=github&utm_medium=referral&utm_content=analytics-readme)**
 
 The agent connects to your data, writes and validates the SQL for you, and
 renders the answer as a chart, table, metric, or saved dashboard panel. Anything
@@ -32,4 +32,4 @@ pnpm install
 pnpm dev
 ```
 
-Full docs: [agent-native.com/docs/template-analytics](https://agent-native.com/docs/template-analytics).
+Full docs: [agent-native.com/docs/template-analytics](https://agent-native.com/docs/template-analytics?utm_source=github&utm_medium=referral&utm_content=analytics-readme).

package/corpus/templates/analytics/changelog/2026-10-02-events-with-a-very-long-name-app-or-page-path-no-longer-caus.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-10-02
+---
+
+Events with a very long name, app, or page path no longer cause the rest of their batch to be lost

package/corpus/templates/analytics/package.json

@@ -18,6 +18,7 @@
   "dependencies": {
     "@agent-native/core": "workspace:*",
     "@agent-native/creative-context": "workspace:*",
+    "@agent-native/otel": "workspace:*",
     "@agent-native/toolkit": "workspace:*",
     "@ai-sdk/openai": "^4.0.51",
     "@dnd-kit/core": "^6.3.1",

package/corpus/templates/analytics/server/handlers/first-party-analytics.ts

@@ -14,6 +14,7 @@ import {
   parseAnalyticsTrackPayload,
   recordAnalyticsEvents,
 } from "../lib/first-party-analytics.js";
+import { errorReply } from "../lib/request-errors.js";
 
 function setCors(event: any): void {
   setResponseHeader(event, "Access-Control-Allow-Origin", "*");
@@ -39,18 +40,10 @@ export const handleAnalyticsTrack = defineEventHandler(async (event) => {
     return { success: true, accepted: 0 };
   }
   try {
-    const headerKey = getHeader(event, "x-agent-native-analytics-key");
-    let body = await readBody(event);
-    if (headerKey) {
-      if (typeof body === "string" && body.trim()) {
-        body = { ...JSON.parse(body), publicKey: headerKey };
-      } else if (body && typeof body === "object" && !Array.isArray(body)) {
-        body = { ...(body as Record<string, unknown>), publicKey: headerKey };
-      } else {
-        body = { publicKey: headerKey };
-      }
-    }
-    const parsed = parseAnalyticsTrackPayload(body);
+    const parsed = parseAnalyticsTrackPayload(
+      await readBody(event),
+      getHeader(event, "x-agent-native-analytics-key"),
+    );
     const result = await recordAnalyticsEvents(parsed.publicKey, parsed.events);
     setResponseStatus(event, 202);
     return {
@@ -58,12 +51,9 @@ export const handleAnalyticsTrack = defineEventHandler(async (event) => {
       accepted: result.accepted,
       suppressedTestIdentity: result.suppressedTestIdentity,
     };
-  } catch (err: any) {
-    const message = err?.message || String(err);
-    const invalidKey = /invalid analytics public key/i.test(message);
-    const statusCode =
-      typeof err?.statusCode === "number" ? err.statusCode : undefined;
-    setResponseStatus(event, invalidKey ? 401 : (statusCode ?? 400));
-    return { error: message };
+  } catch (err) {
+    const reply = errorReply(err, "[first-party-analytics]");
+    setResponseStatus(event, reply.statusCode);
+    return { error: reply.error };
   }
 });

package/corpus/templates/analytics/server/handlers/session-replay.ts

@@ -15,6 +15,11 @@ import {
 } from "h3";
 
 import { runApiHandlerWithContext } from "../lib/credentials";
+import {
+  errorReply,
+  parseJsonBody,
+  requestError,
+} from "../lib/request-errors.js";
 import {
   resolveSessionReplayAgentAccess,
   SESSION_REPLAY_AGENT_ACCESS_PARAM,
@@ -68,10 +73,6 @@ function setCors(event: any): void {
   setResponseHeader(event, "Access-Control-Expose-Headers", "retry-after");
 }
 
-function statusFromError(error: any): number {
-  return typeof error?.statusCode === "number" ? error.statusCode : 400;
-}
-
 function retryAfterFromError(error: any): number | null {
   const seconds = error?.retryAfterSeconds;
   return typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0
@@ -79,8 +80,10 @@ function retryAfterFromError(error: any): number | null {
     : null;
 }
 
-function messageFromError(error: any): string {
-  return error?.message || String(error);
+function replyWithError(event: any, error: unknown): { error: string } {
+  const reply = errorReply(error, "[session-replay]");
+  setResponseStatus(event, reply.statusCode);
+  return { error: reply.error };
 }
 
 function hasQueryKey(query: Record<string, unknown>): boolean {
@@ -90,7 +93,7 @@ function hasQueryKey(query: Record<string, unknown>): boolean {
 function injectHeaderKey(body: unknown, headerKey?: string): unknown {
   if (!headerKey) return body;
   if (typeof body === "string" && body.trim()) {
-    return { ...JSON.parse(body), publicKey: headerKey };
+    return { ...(parseJsonBody(body) as object), publicKey: headerKey };
   }
   if (body && typeof body === "object" && !Array.isArray(body)) {
     return { ...(body as Record<string, unknown>), publicKey: headerKey };
@@ -98,10 +101,6 @@ function injectHeaderKey(body: unknown, headerKey?: string): unknown {
   return { publicKey: headerKey };
 }
 
-function statusError(message: string, statusCode: number): Error {
-  return Object.assign(new Error(message), { statusCode });
-}
-
 function looksLikeDecodedJson(bytes: Buffer): boolean {
   const first = bytes.toString("utf8").trimStart()[0];
   return first === "{" || first === "[";
@@ -156,12 +155,12 @@ export function decodeSessionReplayRequestBody(
           decoded = textWrappedGzip.decoded;
           requestBytes = textWrappedGzip.requestBytes;
         } else {
-          throw statusError("Invalid gzip-compressed replay body", 400);
+          throw requestError("Invalid gzip-compressed replay body", 400);
         }
       }
     }
   } else if (encoding && encoding !== "identity") {
-    throw statusError(
+    throw requestError(
       `Unsupported replay request content-encoding: ${encoding}`,
       415,
     );
@@ -289,11 +288,9 @@ export const handleSessionReplayIngest = defineEventHandler(async (event) => {
   try {
     const query = getQuery(event);
     if (hasQueryKey(query)) {
-      throw Object.assign(
-        new Error(
-          "Analytics public keys must be sent in the request body or x-agent-native-analytics-key header, not the query string",
-        ),
-        { statusCode: 400 },
+      throw requestError(
+        "Analytics public keys must be sent in the request body or x-agent-native-analytics-key header, not the query string",
+        400,
       );
     }
 
@@ -313,8 +310,7 @@ export const handleSessionReplayIngest = defineEventHandler(async (event) => {
     if (retryAfter !== null) {
       setResponseHeader(event, "Retry-After", String(retryAfter));
     }
-    setResponseStatus(event, statusFromError(error));
-    return { error: messageFromError(error) };
+    return replyWithError(event, error);
   }
 });
 
@@ -326,9 +322,8 @@ export const handleSessionReplayList = defineEventHandler(async (event) => {
         listFiltersFromQuery(getQuery(event)),
       );
       return { recordings };
-    } catch (error: any) {
-      setResponseStatus(event, statusFromError(error));
-      return { error: messageFromError(error) };
+    } catch (error) {
+      return replyWithError(event, error);
     }
   });
 });
@@ -347,9 +342,8 @@ export const handleSessionReplaySummary = defineEventHandler(async (event) => {
         orgId: ctx.orgId ?? null,
       });
       return { recording };
-    } catch (error: any) {
-      setResponseStatus(event, statusFromError(error));
-      return { error: messageFromError(error) };
+    } catch (error) {
+      return replyWithError(event, error);
     }
   });
 });
@@ -373,9 +367,8 @@ export const handleSessionReplayEvents = defineEventHandler(async (event) => {
           limit: asInt(query.limit),
         },
       );
-    } catch (error: any) {
-      setResponseStatus(event, statusFromError(error));
-      return { error: messageFromError(error) };
+    } catch (error) {
+      return replyWithError(event, error);
     }
   });
 });
@@ -409,9 +402,8 @@ export const handleSessionReplayManifest = defineEventHandler(async (event) => {
           ),
         })),
       };
-    } catch (error: any) {
-      setResponseStatus(event, statusFromError(error));
-      return { error: messageFromError(error) };
+    } catch (error) {
+      return replyWithError(event, error);
     }
   }
 
@@ -421,9 +413,8 @@ export const handleSessionReplayManifest = defineEventHandler(async (event) => {
         userEmail: ctx.userEmail,
         orgId: ctx.orgId ?? null,
       });
-    } catch (error: any) {
-      setResponseStatus(event, statusFromError(error));
-      return { error: messageFromError(error) };
+    } catch (error) {
+      return replyWithError(event, error);
     }
   });
 });
@@ -454,9 +445,8 @@ export const handleSessionReplayChunkBytes = defineEventHandler(
         setResponseHeader(event, "X-Session-Replay-Seq", String(result.seq));
         setResponseHeader(event, "X-Session-Replay-Checksum", result.checksum);
         return result.json;
-      } catch (error: any) {
-        setResponseStatus(event, statusFromError(error));
-        return { error: messageFromError(error) };
+      } catch (error) {
+        return replyWithError(event, error);
       }
     }
 
@@ -471,9 +461,8 @@ export const handleSessionReplayChunkBytes = defineEventHandler(
         setResponseHeader(event, "X-Session-Replay-Seq", String(result.seq));
         setResponseHeader(event, "X-Session-Replay-Checksum", result.checksum);
         return result.json;
-      } catch (error: any) {
-        setResponseStatus(event, statusFromError(error));
-        return { error: messageFromError(error) };
+      } catch (error) {
+        return replyWithError(event, error);
       }
     });
   },
@@ -502,9 +491,8 @@ export const handleSessionReplayChunkBatch = defineEventHandler(
         applyAgentReplayReadHeaders(event);
         setResponseHeader(event, "Content-Type", "application/json");
         return result;
-      } catch (error: any) {
-        setResponseStatus(event, statusFromError(error));
-        return { error: messageFromError(error) };
+      } catch (error) {
+        return replyWithError(event, error);
       }
     }
 
@@ -517,9 +505,8 @@ export const handleSessionReplayChunkBatch = defineEventHandler(
         setResponseHeader(event, "Content-Type", "application/json");
         setResponseHeader(event, "Cache-Control", "no-store");
         return result;
-      } catch (error: any) {
-        setResponseStatus(event, statusFromError(error));
-        return { error: messageFromError(error) };
+      } catch (error) {
+        return replyWithError(event, error);
       }
     });
   },

package/corpus/templates/analytics/server/lib/first-party-analytics-rollups.ts

@@ -1,6 +1,7 @@
 import { sql } from "@agent-native/core/db/schema";
 
 import { getDb, schema } from "../db/index.js";
+import { indexedRowId } from "./indexed-text.js";
 
 export interface NormalizedFirstPartyAnalyticsEventRow {
   eventName: string;
@@ -63,10 +64,6 @@ function compositeKey(parts: readonly string[]): string {
   return JSON.stringify(parts);
 }
 
-function stableId(prefix: string, parts: readonly string[]): string {
-  return `${prefix}_${parts.map((part) => encodeURIComponent(part)).join("|")}`;
-}
-
 export async function upsertFirstPartyAnalyticsRollups(
   rows: readonly NormalizedFirstPartyAnalyticsEventRow[],
   transaction?: any,
@@ -96,7 +93,13 @@ export async function upsertFirstPartyAnalyticsRollups(
       existingDaily.eventCount += 1;
     } else {
       dailyRollups.set(dailyKey, {
-        id: stableId("aedr", [scopeKey, eventDate, eventName, app, template]),
+        id: indexedRowId("aedr", [
+          scopeKey,
+          eventDate,
+          eventName,
+          app,
+          template,
+        ]),
         tenantKey: scopeKey,
         ownerEmail,
         orgId,
@@ -112,7 +115,7 @@ export async function upsertFirstPartyAnalyticsRollups(
       const userDayKey = compositeKey([scopeKey, eventDate, userKey]);
       if (!userDays.has(userDayKey)) {
         userDays.set(userDayKey, {
-          id: stableId("aud", [scopeKey, eventDate, userKey]),
+          id: indexedRowId("aud", [scopeKey, eventDate, userKey]),
           tenantKey: scopeKey,
           ownerEmail,
           orgId,

package/corpus/templates/analytics/server/lib/first-party-analytics.ts

@@ -39,6 +39,15 @@ import {
 } from "./first-party-analytics-health.js";
 import { upsertFirstPartyAnalyticsRollups } from "./first-party-analytics-rollups.js";
 import { reserveFirstPartyPostgresEventVolume } from "./first-party-analytics-volume.js";
+import {
+  MAX_APP_LENGTH,
+  MAX_EVENT_NAME_LENGTH,
+  MAX_PATH_LENGTH,
+  MAX_USER_KEY_LENGTH,
+  boundedIdentity,
+  boundedText,
+} from "./indexed-text.js";
+import { parseIngestBody, requestError } from "./request-errors.js";
 import {
   recordEventCatalog,
   recordSessionEventIndex,
@@ -488,14 +497,9 @@ function asRecord(value: unknown): Record<string, unknown> {
     : {};
 }
 
-const LONE_SURROGATE =
-  /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
-
-// Rollup and index ids encode these values with encodeURIComponent, which
-// throws on a lone surrogate and would reject the batch on every retry.
 function asString(value: unknown): string | null {
   if (typeof value === "string" && value.trim()) {
-    return value.trim().replace(LONE_SURROGATE, "\uFFFD");
+    return value.trim();
   }
   if (typeof value === "number" || typeof value === "boolean") {
     return String(value);
@@ -564,29 +568,35 @@ export function resolveAnalyticsEventDimensions({
   context: Record<string, unknown>;
   hostname: string | null;
 }): { app: string | null; template: string | null } {
-  const app =
+  const app = boundedDimension(
     asString(properties.app_name) ||
-    asString(properties.app) ||
-    asString((properties as any).agent_native_app) ||
-    asString((properties as any).agentNativeApp) ||
-    asString((context as any).app) ||
-    asString((context as any).agent_native_app) ||
-    asString((context as any).agentNativeApp) ||
-    (hostname ? hostname.split(".")[0] : null);
+      asString(properties.app) ||
+      asString((properties as any).agent_native_app) ||
+      asString((properties as any).agentNativeApp) ||
+      asString((context as any).app) ||
+      asString((context as any).agent_native_app) ||
+      asString((context as any).agentNativeApp) ||
+      (hostname ? hostname.split(".")[0] : null),
+  );
   const template =
-    asString(properties.template_name) ||
-    asString(properties.template) ||
-    asString((properties as any).templateId) ||
-    asString((properties as any).agent_native_template) ||
-    asString((properties as any).agentNativeTemplate) ||
-    asString((context as any).template) ||
-    asString((context as any).templateId) ||
-    asString((context as any).agent_native_template) ||
-    asString((context as any).agentNativeTemplate) ||
-    app;
+    boundedDimension(
+      asString(properties.template_name) ||
+        asString(properties.template) ||
+        asString((properties as any).templateId) ||
+        asString((properties as any).agent_native_template) ||
+        asString((properties as any).agentNativeTemplate) ||
+        asString((context as any).template) ||
+        asString((context as any).templateId) ||
+        asString((context as any).agent_native_template) ||
+        asString((context as any).agentNativeTemplate),
+    ) || app;
   return { app, template };
 }
 
+function boundedDimension(value: string | null): string | null {
+  return value && boundedText(value, MAX_APP_LENGTH);
+}
+
 export function isMarketingWebsiteSessionEvent({
   eventName,
   hostname,
@@ -616,35 +626,43 @@ export function isMarketingWebsiteSessionEvent({
   );
 }
 
-export function parseAnalyticsTrackPayload(raw: unknown): {
+export function parseAnalyticsTrackPayload(
+  raw: unknown,
+  headerKey?: string | null,
+): {
   publicKey: string;
   events: IncomingAnalyticsEvent[];
 } {
-  const body =
-    typeof raw === "string" && raw.trim() ? JSON.parse(raw) : asRecord(raw);
+  const body = asRecord(parseIngestBody(raw));
   const publicKey =
+    asString(headerKey) ||
     asString((body as any).publicKey) ||
     asString((body as any).writeKey) ||
     asString((body as any).apiKey);
   if (!publicKey) {
-    throw new Error("Missing publicKey");
+    throw requestError("Missing publicKey", 400);
   }
 
   const rawEvents = Array.isArray((body as any).events)
     ? (body as any).events
     : [body];
   if (rawEvents.length === 0) {
-    throw new Error("No events provided");
+    throw requestError("No events provided", 400);
   }
   if (rawEvents.length > MAX_EVENTS_PER_REQUEST) {
-    throw new Error(`At most ${MAX_EVENTS_PER_REQUEST} events are accepted`);
+    throw requestError(
+      `At most ${MAX_EVENTS_PER_REQUEST} events are accepted`,
+      400,
+    );
   }
 
   const events = rawEvents.map((rawEvent: unknown) => {
     const obj = asRecord(rawEvent);
     const eventName =
       asString((obj as any).event) || asString((obj as any).name);
-    if (!eventName) throw new Error("Each event requires an event name");
+    if (!eventName) {
+      throw requestError("Each event requires an event name", 400);
+    }
     return {
       event: eventName,
       properties: asRecord((obj as any).properties),
@@ -713,7 +731,7 @@ export async function recordAnalyticsEvents(
     )
     .limit(1);
   if (!key) {
-    throw new Error("Invalid analytics public key");
+    throw requestError("Invalid analytics public key", 401);
   }
 
   const receivedAt = nowIso();
@@ -752,7 +770,9 @@ export async function recordAnalyticsEvents(
       event.anonymousId ??
       asString((properties as any).anonymousId) ??
       asString((properties as any).distinctId);
-    const userKey = userId || anonymousId;
+    const rawUserKey = userId || anonymousId;
+    const userKey =
+      rawUserKey && boundedIdentity(rawUserKey, MAX_USER_KEY_LENGTH);
     const timestamp = normalizeAnalyticsTimestamp(event.timestamp, receivedAt);
     const sessionId =
       event.sessionId ??
@@ -775,7 +795,7 @@ export async function recordAnalyticsEvents(
           app,
           template,
           url: parts.url,
-          userId,
+          userId: userId && boundedIdentity(userId, MAX_USER_KEY_LENGTH),
           anonymousId,
           userKey,
           sessionId,
@@ -789,10 +809,11 @@ export async function recordAnalyticsEvents(
       return [];
     }
 
+    const path = parts.path ?? asString(properties.path);
     return {
       id: id("evt"),
       publicKeyId: key.id,
-      eventName: event.event,
+      eventName: boundedText(event.event, MAX_EVENT_NAME_LENGTH),
       userId,
       anonymousId,
       userKey,
@@ -801,7 +822,7 @@ export async function recordAnalyticsEvents(
       eventDate: eventDateFromTimestamp(timestamp),
       receivedAt,
       url: parts.url,
-      path: parts.path ?? asString(properties.path),
+      path: path && boundedText(path, MAX_PATH_LENGTH),
       hostname,
       referrer:
         asString(properties.referrer) || asString((context as any).referrer),