@agent-native/core-corpus 0.212.0 → 0.213.1

package/corpus/README.md

@@ -32,4 +32,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core-corpus/corpu
 
 ## Generated Counts
 
-- template files: 13642
+- template files: 13662

package/corpus/templates/analytics/.agents/skills/onboarding-journeys/SKILL.md

@@ -31,12 +31,18 @@ The pipeline runs without a UI. Codex does all four steps from the terminal:
 
 `estimate-onboarding-journey-cost` dry-runs the same access-scoped BigQuery
 event-page SQL as `get-onboarding-journey`. Pass matching dates, app,
-email filter, follow-up mode, and event row budget. It returns estimated bytes
-per possible page, their sum in `possiblePagesEstimatedBytes`, the unchanged
-per-query cap, and `within_cap` or `over_cap`. Page two is estimated when the
-row budget permits it; production reads it only when page one fills. The sum
-is a possible-pages estimate, not executed or billed bytes. Data-dependent
-follow-up queries are excluded. An unavailable estimate fails explicitly.
+email filter, follow-up mode, event row budget, and `maxTotalBytesBilled`. It
+reports requested and allowed page counts, then dry-runs each allowed 4,000-row
+page, including the one-row overflow check when within budget. `maxTotalBytesBilled`
+defaults to 275 GB, reserving the full 25 GB per-query cap for each of 11 pages;
+raise it deliberately to allow more pages, up to 1.275 TB and 51 pages. Match
+this value when calling `get-onboarding-journey`. A 45-second deadline or a
+per-page dry-run timeout can return `status: "incomplete"`, the count of
+unestimated allowed pages, and `possiblePagesEstimatedBytes: null`. Read
+`pageBudgetLimited` and the requested/allowed counts before interpreting an
+estimate. The sum is a possible-pages estimate, not executed or billed bytes.
+Data-dependent follow-up queries are excluded. An unavailable estimate fails
+explicitly.
 
 `get-onboarding-journey` returns `JourneyTree`; `format: "summary"` returns the
 same event-derived journey and follow-up counts as an indented `outline` with no
@@ -48,12 +54,12 @@ To include the bounded cross-session estimate from the repository root, run:
 `pnpm --filter analytics action get-onboarding-journey --dateFrom=2026-08-01 --dateTo=2026-08-31 --app=all --emailFilter=exclude_builder --followUpMode=person --format=summary`.
 
 ```ts
-type JourneyExample = { sessionId: string; recordingId: string | null; ts: string; offsetMs: number | null; viewport: { width: number; height: number } | null; viewportReason?: string; replayUrl?: string };
+type JourneyExample = { sessionId: string; recordingId?: string | null; ts: string; offsetMs: number | null; viewport: { width: number; height: number } | null; viewportReason?: string; replayUrl?: string };
 type JourneyNode = { key: string; keyTruncated?: boolean; label: string; labelTruncated?: boolean; parentKey: string | null; depth: number; kind: "step" | "other"; n: number; pctOfRoot: number; pctOfParent: number; dropoffN: number; dropoffPct: number; deeperN: number; examples: JourneyExample[]; otherBranchCount?: number; otherBranchSummariesPartial?: true; otherBranches?: { path: string[]; pathTruncated?: boolean; key: string; keyTruncated?: boolean; sourceStepKey?: string; sourceStepKeyTruncated?: boolean; n: number; pctOfParent: number }[] };
 type JourneyFollowup = { status: "complete" | "incomplete"; incompleteReason?: "journey_event_read_truncated" | "journey_event_read_invalid" | "journey_event_read_may_have_shifted" | "terminal_cohort_query_too_large" | "followup_aggregate_truncated" | "followup_aggregate_invalid" | "followup_aggregate_cost_limited" | "followup_aggregate_query_timeout" | "followup_aggregate_query_failed" | "terminal_cohort_mismatch"; observationCutoff: string; observationFollowupDurationMs: { min: number; max: number; mean: number } | null; rightCensoredAtWindowEnd: true; coverage: { journeyEventRead: { rows: number; pages: number; truncated: boolean; paginationConsistency: "stable" | "may_have_shifted" }; followupAggregateRead: { rows: number | null; queries: number; truncated: boolean; status?: "incomplete"; backendStatus?: number | null; backendReason?: string | null; backendOperation?: "submit" | "poll" | "job" | null }; cohortSessions: number | null }; laterRecordedActivityWithinWindow: { total: number | null; byTerminalStepKey: Record<string, number> | null }; noLaterRecordedActivityWithinWindow: { total: number | null; byTerminalStepKey: Record<string, number> | null } };
 type JourneyPersonFollowupCounts = { canonicalPeople: number; laterActivityInSelectedSession: number; laterActivityOutsideSelectedSessionOrApp: number; laterActivityInBothSelectedAndOutside: number; laterActivityObservedAnywhere: number; noActivityObservedWithinHorizon: number; rightCensoredHorizon: number; fullyObservedCanonicalPeople: number; noActivityObservedWithinHorizonPctOfFullyObservedCanonicalPeople: number | null; identityUnavailableSessions: number; identityUnavailableSessionEvidence: { laterActivityInSelectedSession: number; laterActivityOutsideSelectedSessionOrApp: number } };
 type JourneyPersonFollowup = { status: "complete" | "incomplete"; incompleteReason?: "journey_event_read_truncated" | "journey_event_read_invalid" | "journey_event_read_may_have_shifted" | "terminal_cohort_too_large" | "terminal_cohort_invalid" | "person_followup_aggregate_truncated" | "person_followup_query_cost_limited" | "person_followup_query_timeout" | "person_followup_query_failed" | "person_followup_aggregate_invalid" | "person_followup_terminal_cohort_mismatch"; horizonDays: 30; horizonMs: number; observationWatermark: string; observationFollowupDurationMs: { min: number; max: number; mean: number } | null; coverage: { journeyEventRead: { rows: number; pages: number; truncated: boolean; paginationConsistency: "stable" | "may_have_shifted" }; followupAggregateRead: { status: "complete" | "truncated" | "incomplete" | "not_run"; rows: number | null; queries: number; truncated: boolean; backendStatus?: number | null; backendReason?: string | null; backendOperation?: "submit" | "poll" | "job" | null }; terminalSessions: number | null; sessionsWithoutSelectedStep: number | null; identityJoin: { status: "complete" | "partial" | "unavailable" | "not_applicable" | "unknown"; terminalSessions: number | null; sessionsWithCanonicalIdentity: number | null; sessionsWithoutCanonicalIdentity: number | null; uniqueCanonicalPeople: number | null; coveragePct: number | null } }; total: JourneyPersonFollowupCounts | null; byTerminalStepKey: Record<string, JourneyPersonFollowupCounts> | null };
-type JourneyTree = { window: { from: string; to: string }; app: string; rootN: number; coverage: { sessionsWithEvents: number; sessionsWithReplay: number; truncated: boolean }; nodes: JourneyNode[]; followUp: JourneyFollowup; personFollowUp?: JourneyPersonFollowup; standaloneSetup?: { rootN: number; coverage: { sessionsWithEvents: number; sessionsWithReplay: number; truncated: boolean }; nodes: JourneyNode[] }; notes?: string[] };
+type JourneyTree = { window: { from: string; to: string }; app: string; rootN: number; coverage: { sessionsWithEvents: number; sessionsWithReplay: number | null; truncated: boolean }; nodes: JourneyNode[]; followUp: JourneyFollowup; personFollowUp?: JourneyPersonFollowup; standaloneSetup?: { rootN: number; coverage: { sessionsWithEvents: number; sessionsWithReplay: number | null; truncated: boolean }; nodes: JourneyNode[] }; notes?: string[] };
 ```
 
 Analytics returns cohort nodes with counts. When extending a Design storyboard
@@ -132,8 +138,15 @@ top-level tree to `journey:capture`; the capture CLI reads top-level `nodes`.
   session IDs or member identity keys used internally. The consistency field
   reports `may_have_shifted` when the event read uses multiple `OFFSET` pages;
   a late-arriving event can change page membership inside a historical window
-  too. The action caps event reads at two 4,000-row BigQuery pages to bound
-  total query cost. If either read truncates, page boundaries may have shifted,
+  too. The action reads 4,000-row pages up to `maxEventRows` (at most 200,000),
+  plus one overflow row to detect truncation. Each BigQuery page keeps a 25 GB
+  billed-byte cap; by default, `maxTotalBytesBilled` reserves that cap for 11
+  pages (275 GB), and can be raised deliberately to 1.275 TB (51 pages). Event
+  page reads also stop at a 45-second deadline. If the aggregate budget or
+  deadline cuts a read, `coverage.truncated` and `notes` identify why; read them
+  before interpreting counts. A truncated event sample skips replay reads and
+  returns `sessionsWithReplay: null` because replay availability is unknown. If
+  a read truncates, page boundaries may have shifted,
   or the terminal cohort cannot be covered in one query under the
   800,000-character SQL limit or 50,000-token parser limit, `status` is
   `incomplete` and all new cohort counts and follow-up duration are `null`;
@@ -191,15 +204,17 @@ top-level tree to `journey:capture`; the capture CLI reads top-level `nodes`.
 - A session is an analytics session id. One that began before `dateFrom`
   starts mid-journey, so start the window a day early.
 - Read `coverage` before using the numbers. `truncated: true` means the event
-  read hit `maxEventRows`, a session went past `maxDepth`, or the node list hit
-  `maxNodes`; `notes` says which.
+  read hit `maxEventRows`, `maxTotalBytesBilled`, or its 45-second deadline, a
+  session went past `maxDepth`, or the node list hit `maxNodes`; `notes` says
+  which.
   Never report a truncated tree as the whole window.
 - The event row cap is shared by onboarding and standalone setup. If it is hit,
   `standaloneSetup` may be an empty, truncated tree because standalone events
   were beyond the read boundary; do not interpret that as zero standalone use.
-- An example with `recordingId: null` has no replay the caller can open, and
+- An example with `recordingId: null` has no replay the caller can open; an
+  omitted `recordingId` means replay availability was not checked. Its
   `viewportReason` says why the viewport is unknown (`no_recording`,
-  `not_captured` for recordings before viewport capture, `unreadable`).
+  `recording_unknown`, `not_captured`, `unreadable`).
 - `offsetMs` is milliseconds from the recording's `startedAt`, not the first
   rrweb event.
 - `replayUrl` uses that same offset in `atMs`; the session page converts it to

package/corpus/templates/analytics/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable user-facing changes to Agent-Native Analytics are documented here. Open it any
 time from the command menu (Cmd+K → "What's new") or from Settings.
 
+## 2026-10-21
+
+### Improved
+
+- Analytics recognizes questions about connected data, product analytics, sessions, dashboards, and charts.
+- Onboarding journeys honor larger event row budgets with aggregate cost limits, a read deadline, and clear partial-coverage reporting.
+
+### Fixed
+
+- Preserve unknown replay availability in partial journeys
+
 ## 2026-10-20
 
 ### Fixed

package/corpus/templates/analytics/actions/estimate-onboarding-journey-cost.ts

@@ -14,10 +14,16 @@ import {
   estimateOnboardingJourneyEventQueryCost,
   OnboardingJourneyCostError,
 } from "../server/lib/onboarding-journey-cost.js";
-import { freezeOnboardingJourneyObservationWindow } from "../server/lib/onboarding-journey.js";
+import {
+  DEFAULT_ONBOARDING_EVENT_ROW_BUDGET,
+  freezeOnboardingJourneyObservationWindow,
+  MAX_ONBOARDING_EVENT_ROW_BUDGET,
+  ONBOARDING_EVENTS_DEFAULT_MAX_TOTAL_BYTES_BILLED,
+  ONBOARDING_EVENTS_MAX_BYTES_BILLED,
+  ONBOARDING_EVENTS_MAX_TOTAL_BYTES_BILLED,
+} from "../server/lib/onboarding-journey.js";
 
 const MAX_WINDOW_DAYS = 90;
-const MAX_JOURNEY_EVENT_ROWS = 200_000;
 
 const isoDate = z
   .string()
@@ -26,7 +32,7 @@ const isoDate = z
 
 export default defineAction({
   description:
-    "Dry-run the caller-scoped BigQuery event-page queries for an onboarding journey and return each possible page's estimated bytes, their total if all pages run, the existing per-query bytes-billed cap, and cap status.",
+    "Dry-run the caller-scoped BigQuery event-page queries for an onboarding journey. Returns requested and budget-allowed page counts, estimated bytes per page, and total possible bytes when every allowed page is estimated. Each page reserves the 25 GB per-query cap against maxTotalBytesBilled. Estimates stop after 45 seconds and explicitly report unestimated pages.",
   schema: z.object({
     dateFrom: isoDate.describe(
       "Inclusive UTC start date, YYYY-MM-DD. Use the same dateFrom as get-onboarding-journey.",
@@ -59,11 +65,21 @@ export default defineAction({
       .number()
       .int()
       .min(1000)
-      .max(MAX_JOURNEY_EVENT_ROWS)
+      .max(MAX_ONBOARDING_EVENT_ROW_BUDGET)
+      .optional()
+      .default(DEFAULT_ONBOARDING_EVENT_ROW_BUDGET)
+      .describe(
+        `Event row budget, matching get-onboarding-journey. Defaults to ${DEFAULT_ONBOARDING_EVENT_ROW_BUDGET}; at most ${MAX_ONBOARDING_EVENT_ROW_BUDGET}. Estimates include the one-row overflow check; the journey reads each page only when the previous page is full.`,
+      ),
+    maxTotalBytesBilled: z.coerce
+      .number()
+      .int()
+      .min(ONBOARDING_EVENTS_MAX_BYTES_BILLED)
+      .max(ONBOARDING_EVENTS_MAX_TOTAL_BYTES_BILLED)
       .optional()
-      .default(40000)
+      .default(ONBOARDING_EVENTS_DEFAULT_MAX_TOTAL_BYTES_BILLED)
       .describe(
-        `Event row budget, matching get-onboarding-journey. Defaults to 40000; at most ${MAX_JOURNEY_EVENT_ROWS}. The second page is estimated when this budget allows it, but the journey reads it only if the first page is full.`,
+        "Aggregate cap for event-page queries, in bytes billed. Each allowed BigQuery page reserves its full 25 GB per-query cap. Defaults to 275 GB (11 pages); set a higher value deliberately to allow more pages, up to 1.275 TB (51 pages). Match get-onboarding-journey.",
       ),
   }),
   http: { method: "GET" },
@@ -102,6 +118,7 @@ export default defineAction({
         freezeOnboardingJourneyObservationWindow(filters),
         args.followUpMode === "person",
         context?.signal,
+        args.maxTotalBytesBilled,
       );
     } catch (error) {
       if (

package/corpus/templates/analytics/actions/get-onboarding-journey.ts

@@ -11,14 +11,18 @@ import {
   isCalendarDate,
 } from "../server/lib/first-party-metric-catalog.js";
 import {
+  DEFAULT_ONBOARDING_EVENT_ROW_BUDGET,
   getOnboardingJourney,
+  MAX_ONBOARDING_EVENT_ROW_BUDGET,
+  ONBOARDING_EVENTS_DEFAULT_MAX_TOTAL_BYTES_BILLED,
+  ONBOARDING_EVENTS_MAX_BYTES_BILLED,
+  ONBOARDING_EVENTS_MAX_TOTAL_BYTES_BILLED,
   OnboardingJourneyReadError,
   JourneyRecordingsError,
 } from "../server/lib/onboarding-journey.js";
 
 const MAX_WINDOW_DAYS = 90;
 const MAX_DEPTH = 40;
-const MAX_JOURNEY_EVENT_ROWS = 200_000;
 
 function resolveScope() {
   const userEmail = getRequestUserEmail();
@@ -37,7 +41,7 @@ const isoDate = z
 
 export default defineAction({
   description:
-    'Return an access-scoped per-session onboarding tree through explicit saved-output events, preserving session counts and direct-parent denominators. An aggregated `other` node includes up to 20 root-to-branch label paths, source step keys for identical paths, session counts, and direct-parent percentages; branch summaries are capped at 200 per tree and 64 KiB of serialized detail. `otherBranchCount` gives the full number of branches, and `otherBranchSummariesPartial: true` marks summaries omitted by those bounds. Labels/path segments longer than 300 characters and keys longer than 2,048 characters are visibly shortened with stable hash suffixes and truncation flags so the tree stays within the Design input contract. Journey counts stay bounded by the 200,000-event read cap. followUpMode "session" keeps existing bounded same-session counts. "person" adds aggregate-only activity joined by direct canonical auth_user_id across first-party sessions and apps over a fixed 30-day horizon. It separates selected-session activity, outside-session/app activity and their overlap, no activity after a fully observed horizon, right-censoring, unknown identity, identity coverage, and read completeness. Its minute-aligned observationWatermark freezes event and receive time. Unknown identity and sessions without a selected step never count as inactive; no-activity is window-bounded evidence, not permanent churn. Output and attempt IDs are never returned. Incomplete follow-up counts are null. If an event or follow-up query fails, the action returns a stage-specific error with safe BigQuery status/reason when available; an unreadable query never becomes zero counts or an empty-tree substitute.',
+    'Return an access-scoped per-session onboarding tree through explicit saved-output events, preserving session counts and direct-parent denominators. An aggregated `other` node includes up to 20 root-to-branch label paths, source step keys for identical paths, session counts, and direct-parent percentages; branch summaries are capped at 200 per tree and 64 KiB of serialized detail. `otherBranchCount` gives the full number of branches, and `otherBranchSummariesPartial: true` marks summaries omitted by those bounds. Labels/path segments longer than 300 characters and keys longer than 2,048 characters are visibly shortened with stable hash suffixes and truncation flags so the tree stays within the Design input contract. Journey counts stay bounded by the 200,000-event read cap. BigQuery pages have a 25 GB per-query cap, and maxTotalBytesBilled bounds how many pages one event read may run; it defaults to 275 GB. Reads also stop at a 45-second event-read deadline, with coverage.truncated and notes identifying partial counts. Raise maxTotalBytesBilled deliberately to read more pages, up to 1.275 TB. When event coverage is truncated, replay reads are skipped, coverage.sessionsWithReplay is null, and examples omit recordingId with viewportReason "recording_unknown"; recordingId null means a completed lookup found no replay. followUpMode "session" keeps existing bounded same-session counts. "person" adds aggregate-only activity joined by direct canonical auth_user_id across first-party sessions and apps over a fixed 30-day horizon. It separates selected-session activity, outside-session/app activity and their overlap, no activity after a fully observed horizon, right-censoring, unknown identity, identity coverage, and read completeness. Its minute-aligned observationWatermark freezes event and receive time. Unknown identity and sessions without a selected step never count as inactive; no-activity is window-bounded evidence, not permanent churn. Output and attempt IDs are never returned. Incomplete follow-up counts are null. A query that fails for a backend, cost, or per-query timeout reason returns a stage-specific error with safe BigQuery status/reason when available; an internal event-read deadline instead returns completed pages with truncated coverage. An unreadable query never becomes zero counts or an empty-tree substitute.',
   schema: z.object({
     dateFrom: isoDate.describe(
       "Inclusive UTC start date, YYYY-MM-DD. Sessions that began earlier appear mid-journey, so start a day before the period you care about.",
@@ -114,11 +118,21 @@ export default defineAction({
       .number()
       .int()
       .min(1000)
-      .max(MAX_JOURNEY_EVENT_ROWS)
+      .max(MAX_ONBOARDING_EVENT_ROW_BUDGET)
       .optional()
-      .default(40000)
+      .default(DEFAULT_ONBOARDING_EVENT_ROW_BUDGET)
       .describe(
-        "Event rows to read before stopping and reporting coverage.truncated. Each 4,000 rows is one query; raise it only for a wide window. Defaults to 40000.",
+        `Event rows to read, plus one extra row to detect truncation. Each query reads at most 4,000 rows and has a 25 GB BigQuery bytes-billed cap. The aggregate page budget and 45-second deadline can stop the read earlier; coverage.truncated and notes say when counts are partial. Defaults to ${DEFAULT_ONBOARDING_EVENT_ROW_BUDGET}.`,
+      ),
+    maxTotalBytesBilled: z.coerce
+      .number()
+      .int()
+      .min(ONBOARDING_EVENTS_MAX_BYTES_BILLED)
+      .max(ONBOARDING_EVENTS_MAX_TOTAL_BYTES_BILLED)
+      .optional()
+      .default(ONBOARDING_EVENTS_DEFAULT_MAX_TOTAL_BYTES_BILLED)
+      .describe(
+        "Aggregate cap for event-page queries, in bytes billed. Each allowed BigQuery page reserves its full 25 GB per-query cap. Defaults to 275 GB (11 pages); set a higher value deliberately to allow more pages, up to 1.275 TB (51 pages).",
       ),
     recency: z
       .enum(["newest", "none"])
@@ -203,6 +217,7 @@ export default defineAction({
           minNodeSessions: args.minNodeSessions,
           examplesPerNode: args.examplesPerNode,
           maxEventRows: args.maxEventRows,
+          maxTotalBytesBilled: args.maxTotalBytesBilled,
           settleMs: args.settleMs,
           recency: args.recency,
           viewport: Object.keys(viewport).length ? viewport : undefined,

package/corpus/templates/analytics/actions/provider-api-register.ts

@@ -1,19 +1,14 @@
-import { getDbExec } from "@agent-native/core/db";
 import {
   createCustomProviderRegistrationAction,
   CustomProviderRegistrationSchema,
 } from "@agent-native/core/provider-api/actions/custom-provider-registration";
+import { readOrgMemberRole } from "@agent-native/core/server";
 import { getCredentialContext } from "@agent-native/core/server/request-context";
 import { z } from "zod";
 
 async function resolveCallerOrgRole(orgId: string, email: string) {
   try {
-    const { rows } = await getDbExec().execute({
-      sql: `SELECT role FROM org_members WHERE org_id = $1 AND LOWER(email) = $2 LIMIT 1`,
-      args: [orgId, email.toLowerCase()],
-    });
-    const role = (rows[0] as { role?: unknown } | undefined)?.role;
-    return typeof role === "string" && role ? role : null;
+    return await readOrgMemberRole(orgId, email);
   } catch {
     return null;
   }

package/corpus/templates/analytics/changelog/2026-10-21-analytics-recognizes-questions-about-connected-data-product-.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-10-21
+---
+
+Analytics recognizes questions about connected data, product analytics, sessions, dashboards, and charts.

package/corpus/templates/analytics/changelog/2026-10-21-onboarding-journeys-now-honor-larger-event-row-budgets.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-10-21
+---
+
+Onboarding journeys honor larger event row budgets with aggregate cost limits, a read deadline, and clear partial-coverage reporting.

package/corpus/templates/analytics/changelog/2026-10-21-preserve-unknown-replay-availability-in-partial-journeys.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-10-21
+---
+
+Preserve unknown replay availability in partial journeys

package/corpus/templates/analytics/package.json

@@ -2,6 +2,7 @@
   "name": "analytics",
   "displayName": "Analytics",
   "private": true,
+  "description": "Connect data sources and warehouses, including BigQuery, to explore product and event analytics, session data, dashboards, and charts.",
   "type": "module",
   "scripts": {
     "dev": "DATABASE_URL=${ANALYTICS_DATABASE_URL:-pglite:./data/pglite} agent-native dev",
@@ -115,6 +116,11 @@
     "vitest": "catalog:"
   },
   "packageManager": "pnpm@10.14.0+sha512.ad27a79641b49c3e481a16a805baa71817a04bbe06a38d17e60e2eaee83f6a146c6a688125f5792e48dd5ba30e7da52a5cda4c3992b9ccf333f9ce223af84748",
+  "agent-native": {
+    "whenToUse": [
+      "Use Analytics for connected data sources and warehouses, including BigQuery, product and event analytics, session data, dashboards, and charts."
+    ]
+  },
   "pkg": {
     "assets": [
       "dist/spa/*"

package/corpus/templates/analytics/scripts/journey-capture-plan.ts

@@ -15,7 +15,7 @@ export const DEFAULT_APP_URL = "https://analytics.agent-native.com";
 
 export interface TreeExample {
   sessionId: string;
-  recordingId: string | null;
+  recordingId?: string | null;
   ts: string;
   offsetMs: number | null;
   viewport: { width: number; height: number } | null;
@@ -53,7 +53,11 @@ export function parseTree(raw: unknown): { nodes: TreeNode[] } {
       if (!e || typeof e.sessionId !== "string") {
         fail(`${at}.sessionId`, "must be a string");
       }
-      if (e.recordingId !== null && typeof e.recordingId !== "string") {
+      if (
+        e.recordingId !== undefined &&
+        e.recordingId !== null &&
+        typeof e.recordingId !== "string"
+      ) {
         fail(`${at}.recordingId`, "must be a string or null");
       }
       if (
@@ -74,9 +78,10 @@ export function parseTree(raw: unknown): { nodes: TreeNode[] } {
       ) {
         fail(`${at}.viewport`, "must be { width, height } or null");
       }
+      const recordingId = e.recordingId as string | null | undefined;
       return {
         sessionId: e.sessionId as string,
-        recordingId: e.recordingId as string | null,
+        ...(recordingId !== undefined ? { recordingId } : {}),
         ts: typeof e.ts === "string" ? e.ts : "",
         offsetMs: e.offsetMs as number | null,
         viewport: v
@@ -107,7 +112,11 @@ export interface PlanItem {
 export interface SkippedExample {
   nodeKey: string;
   exampleIndex: number;
-  reason: "no_recording" | "no_offset" | "aspect_out_of_range";
+  reason:
+    | "no_recording"
+    | "replay_unknown"
+    | "no_offset"
+    | "aspect_out_of_range";
 }
 
 export function aspectInRange(
@@ -124,9 +133,10 @@ export function aspectInRange(
 
 /**
  * Up to `perNode` renderable examples per node, in the tree's order. An
- * example with no recording or offset, or a known viewport outside the aspect
- * range, is listed as skipped. An unknown viewport is rendered and checked on
- * the captured size instead.
+ * example with unknown replay availability, a completed lookup with no
+ * recording, no offset, or a known viewport outside the aspect range is listed
+ * as skipped. An unknown viewport is rendered and checked on the captured size
+ * instead.
  */
 export function planCapture(
   tree: { nodes: TreeNode[] },
@@ -139,6 +149,7 @@ export function planCapture(
     node.examples.forEach((example, exampleIndex) => {
       const skip = (reason: SkippedExample["reason"]) =>
         skipped.push({ nodeKey: node.key, exampleIndex, reason });
+      if (example.recordingId === undefined) return skip("replay_unknown");
       if (!example.recordingId) return skip("no_recording");
       if (example.offsetMs === null || example.offsetMs < 0) {
         return skip("no_offset");

package/corpus/templates/analytics/scripts/journey-capture.ts

@@ -2170,7 +2170,9 @@ async function main(argv: string[]): Promise<number> {
       );
     }
     console.error(
-      `Nothing to render: no example has a recording and an offset (see "skipped" in ${manifestPath}). Re-run get-onboarding-journey with a window that has replays.`,
+      skipped.some((example) => example.reason === "replay_unknown")
+        ? `Nothing to render: replay lookup was skipped for some examples because the journey read was truncated (see "skipped" in ${manifestPath}). Re-run get-onboarding-journey with a narrower window or a larger event budget.`
+        : `Nothing to render: no example has a recording and an offset (see "skipped" in ${manifestPath}). Re-run get-onboarding-journey with a window that has replays.`,
     );
     return 1;
   }

package/corpus/templates/analytics/server/lib/db-admin-connections.ts

@@ -12,7 +12,9 @@ import {
 import {
   getRequestOrgId,
   getRequestUserEmail,
+  getRequestContext,
   getSession,
+  readOrgMemberRole,
   runWithRequestContext,
 } from "@agent-native/core/server";
 import type { H3Event } from "h3";
@@ -68,18 +70,23 @@ export async function resolveOrgRole(
   userEmail: string,
   orgId: string,
 ): Promise<string | null> {
-  const { rows } = await getDbExec()
-    .execute({
-      sql: `SELECT role FROM org_members WHERE org_id = $1 AND LOWER(email) = $2 AND federation_removal_pending_at IS NULL LIMIT 1`,
-      args: [orgId, userEmail.toLowerCase()],
-    })
-    .catch((error: unknown) => {
-      throw new DbAdminConnectionError(
-        503,
-        `Couldn't verify your organization role: ${redactDbAdminError(error)}`,
-      );
-    });
-  return readString((rows[0] ?? {}) as Record<string, unknown>, "role");
+  const request = getRequestContext();
+  if (
+    request?.a2aIdentityAssurance === "org-member" &&
+    (request.orgId?.trim() !== orgId.trim() ||
+      request.userEmail?.trim().toLowerCase() !==
+        userEmail.trim().toLowerCase())
+  ) {
+    return null;
+  }
+  try {
+    return await readOrgMemberRole(orgId, userEmail);
+  } catch (error) {
+    throw new DbAdminConnectionError(
+      503,
+      `Couldn't verify your organization role: ${redactDbAdminError(error)}`,
+    );
+  }
 }
 
 export async function requireAnalyticsAdminContext(input?: {

package/corpus/templates/analytics/server/lib/journey-tree.ts

@@ -48,20 +48,23 @@ export interface BuildJourneyTreeOptions {
 
 /**
  * Why an example has no viewport. `no_recording`: no accessible recording
- * covers the step. `not_captured`: the recording predates viewport capture.
- * `unreadable`: its metadata could not be parsed.
+ * covers the step. `recording_unknown`: replay lookup was skipped.
+ * `not_captured`: the recording predates viewport capture. `unreadable`: its
+ * metadata could not be parsed.
  */
 export type ViewportUnknownReason =
   | "no_recording"
+  | "recording_unknown"
   | "not_captured"
   | "unreadable";
 
 export interface JourneyExample {
   sessionId: string;
-  recordingId: string | null;
+  /** Omitted when replay lookup was skipped; null means lookup found no replay. */
+  recordingId?: string | null;
   /** ISO time of the step in this session. */
   ts: string;
-  /** Milliseconds from recording.startedAt to the step; null without a recording. */
+  /** Milliseconds from recording.startedAt to the step; null when no offset is known. */
   offsetMs: number | null;
   viewport: { width: number; height: number } | null;
   /** Present exactly when `viewport` is null. */
@@ -225,14 +228,17 @@ function hasViewportConstraints(constraints: ViewportConstraints | undefined) {
 interface Candidate {
   sessionId: string;
   tsMs: number;
-  recording: JourneyRecording | null;
+  recording: JourneyRecording | null | undefined;
 }
 
 function chooseCandidate(
   ref: { sessionId: string; tsMs: number },
-  recordings: readonly JourneyRecording[],
+  recordings: readonly JourneyRecording[] | null,
   constraints: ViewportConstraints | undefined,
 ): Candidate | null {
+  if (recordings === null) {
+    return constraints?.requireKnown ? null : { ...ref, recording: undefined };
+  }
   const constrained = hasViewportConstraints(constraints);
   const usable = recordings
     .filter((recording) => covers(recording, ref.tsMs))
@@ -268,6 +274,15 @@ function exampleFrom(
 ): JourneyExample {
   const { recording } = candidate;
   const ts = new Date(candidate.tsMs).toISOString();
+  if (recording === undefined) {
+    return {
+      sessionId: candidate.sessionId,
+      ts,
+      offsetMs: null,
+      viewport: null,
+      viewportReason: "recording_unknown",
+    };
+  }
   if (!recording) {
     return {
       sessionId: candidate.sessionId,
@@ -305,7 +320,7 @@ function exampleFrom(
 
 function pickExamples(
   refs: ReadonlyArray<{ sessionId: string; tsMs: number }>,
-  recordings: ReadonlyMap<string, readonly JourneyRecording[]>,
+  recordings: ReadonlyMap<string, readonly JourneyRecording[]> | null,
   options: BuildJourneyTreeOptions,
 ): JourneyExample[] {
   if (options.examplesPerNode === 0) return [];
@@ -314,7 +329,7 @@ function pickExamples(
   for (const ref of refs) {
     const candidate = chooseCandidate(
       ref,
-      recordings.get(ref.sessionId) ?? [],
+      recordings === null ? null : (recordings.get(ref.sessionId) ?? []),
       options.viewport,
     );
     if (candidate) candidates.push(candidate);
@@ -354,7 +369,7 @@ const compareKeys = (a: string, b: string) => (a < b ? -1 : a > b ? 1 : 0);
  */
 export function buildJourneyTree(
   sessions: readonly JourneySession[],
-  recordings: ReadonlyMap<string, readonly JourneyRecording[]>,
+  recordings: ReadonlyMap<string, readonly JourneyRecording[]> | null,
   options: BuildJourneyTreeOptions,
 ): { rootN: number; nodes: JourneyNode[] } {
   const root = trieNode("root", "All sessions", "root", 0);