@agent-native/core 0.122.3 → 0.123.0

package/corpus/templates/analytics/.agents/skills/self-modifying-code/SKILL.md

@@ -1,9 +1,10 @@
 ---
 name: self-modifying-code
 description: >-
-  How the agent can modify the app's own source code. Use when the agent needs
-  to edit components, routes, styles, or scripts, when designing UI for agent
-  editability, or when deciding what the agent should and shouldn't modify.
+  Tiers, checkpoints, and off-limits paths for an agent editing the app's own
+  source. Use when designing UI for agent editability, deciding whether a file
+  is safe for the agent to change, or when tempted to patch config, `.env`, or
+  an `@agent-native/*` package. Do not load it for ordinary source edits.
 scope: dev
 metadata:
   internal: true

package/corpus/templates/analytics/.agents/skills/shadcn-ui/SKILL.md

@@ -1,11 +1,15 @@
 ---
 name: shadcn-ui
 description: >-
-  Use when adding, updating, debugging, styling, or composing shadcn/ui
-  components, forms, dialogs, menus, charts, sidebars, themes, registries, or
-  any project with a components.json file.
+  The shadcn CLI, component composition, theming, and registry workflow. Use
+  when adding, replacing, upgrading, or debugging a shadcn/ui primitive itself,
+  or when changing a theme or registry. Do not load it for ordinary edits to a
+  file that happens to import a shadcn component.
 scope: dev
 source: https://ui.shadcn.com/docs/skills
+local-changes: >-
+  Description narrowed deliberately; an upstream sync must not restore the
+  "any project with a components.json file" trigger.
 metadata:
   internal: true
 ---

package/corpus/templates/analytics/.agents/skills/sharing/SKILL.md

@@ -0,0 +1,228 @@
+---
+name: sharing
+description: >-
+  Framework-level sharing and privacy for user-authored resources
+  (dashboards, documents, forms, decks, etc.). Use when making a resource
+  table ownable, wiring list/read/update access checks, or dropping the
+  standard share dialog into a template.
+scope: dev
+metadata:
+  internal: true
+---
+
+# Sharing — Private by Default, Explicit Share
+
+## Rule
+
+Any resource a user **creates** (dashboards, documents, forms, decks, compositions, booking links, issues, analyses) is **private to the creator** by default and visible to others only when they have been **explicitly shared** with or when the creator changes visibility to `org` or `public`.
+
+This is the framework-level primitive. Every ownable resource gets it for free — same API, same UI, same skill.
+
+## Concepts
+
+### Three visibility levels
+
+- **`private`** — owner + explicit share grants only. Default.
+- **`org`** — owner + explicit grants + anyone in the same org (read-only).
+- **`public`** — owner + explicit grants + **anyone with the link** (read-only). Public docs do NOT appear in other users' list/sidebar/search results — `accessFilter` omits them by default. They're reachable by id (`resolveAccess` admits them) so direct links and SSR routes like `/p/:id` keep working. If a list endpoint legitimately needs cross-user public discovery (a template gallery, etc.), pass `accessFilter(table, shares, ctx, minRole, { includePublic: true })`.
+
+Visibility is coarse. Explicit share grants are fine-grained (per user or per org).
+
+### Roles on a share grant
+
+- **`viewer`** — read only.
+- **`editor`** — read + write.
+- **`admin`** — read + write + manage shares. Does NOT replace the single `owner_email` on the resource.
+
+### Anonymous public URLs stay separate
+
+Form "publish" slugs, booking-link slugs, any feature that exposes a URL to unauthenticated users — these are a different axis and are NOT controlled by the sharing system. Keep them alongside it.
+
+## Make a resource ownable
+
+In your template's `server/db/schema.ts`:
+
+```ts
+import {
+  table,
+  text,
+  integer,
+  now,
+  ownableColumns,
+  createSharesTable,
+} from "@agent-native/core/db/schema";
+
+export const decks = table("decks", {
+  id: text("id").primaryKey(),
+  title: text("title").notNull(),
+  data: text("data").notNull(),
+  createdAt: text("created_at").notNull().default(now()),
+  updatedAt: text("updated_at").notNull().default(now()),
+  ...ownableColumns(), // adds owner_email, org_id, visibility
+});
+
+export const deckShares = createSharesTable("deck_shares");
+```
+
+Then register it **in `server/db/index.ts`** (not the schema file — keeps the schema file free of the `getDb` closure and avoids circular imports):
+
+```ts
+// server/db/index.ts
+import * as schema from "./schema.js";
+import { createGetDb } from "@agent-native/core/db";
+import { registerShareableResource } from "@agent-native/core/sharing";
+
+export const getDb = createGetDb(schema);
+export { schema };
+
+registerShareableResource({
+  type: "deck",
+  resourceTable: schema.decks,
+  sharesTable: schema.deckShares,
+  displayName: "Deck",
+  titleColumn: "title",
+  getResourcePath: (deck) => `/deck/${deck.id}`,
+  getDb,
+});
+```
+
+The `type` string is the stable id the UI and actions use. `getDb` is required — the framework-level share actions use it to reach your template's DB.
+
+### Restricting public visibility and cross-org user shares
+
+Some resources should NOT be reachable by an arbitrary authenticated user even with the link, and should NOT be shareable to an email outside the org. Two optional registration flags lock these axes down:
+
+```ts
+registerShareableResource({
+  type: "extension",
+  // ...
+  allowPublic: false, // hides "Public" in the share dialog and rejects it server-side
+  requireOrgMemberForUserShares: true, // user shares must target an org member or pending invitee
+});
+```
+
+- **`allowPublic: false`** — `set-resource-visibility('public')` throws `ForbiddenError`, `accessFilter` / `resolveAccess` treat any stored `'public'` row as private (defense in depth against bad data), and the share popover hides the "Public" option. `list-resource-shares` returns `policy.allowPublic: false` so the UI follows the server.
+- **`requireOrgMemberForUserShares: true`** — `share-resource` looks up `principalId` in `org_members` and `org_invitations` (pending) for the resource's `orgId` and rejects user shares to anyone else. The same flag also pins `principalType: "org"` shares to the resource's own org — sharing to a *different* org would let that org's members run code in the viewer's auth context (same threat model as a public extension). (The flag name is kept for backward compatibility; treat it as "lock both user and org shares to the resource's org".)
+
+Use both for resources that execute code or expose privileged data with the *viewer's* credentials. Extensions ship with both set: an extension's HTML calls actions / SQL / the secrets-injecting proxy as the viewer, so a public or cross-org-shared extension would let a stranger run arbitrary code with someone else's auth context. `scripts/guard-extension-no-public.mjs` (CI + `pnpm prep`) statically enforces that the extension registration keeps both flags set.
+
+Defaults match historical behaviour: `allowPublic: true`, `requireOrgMemberForUserShares: false`. Resources that don't set the flags work as before.
+
+## Filter list/read queries
+
+```ts
+import { accessFilter } from "@agent-native/core/sharing";
+
+const rows = await db
+  .select()
+  .from(schema.decks)
+  .where(accessFilter(schema.decks, schema.deckShares));
+```
+
+`accessFilter` admits rows the current user owns, has been shared on, or that the user can reach via `org` visibility. `public` rows are NOT admitted by default — see the visibility section above for why and how to opt in.
+
+## Guard write actions
+
+```ts
+import { assertAccess } from "@agent-native/core/sharing";
+
+export default defineAction({
+  schema: z.object({ id: z.string(), title: z.string() }),
+  run: async (args) => {
+    await assertAccess("deck", args.id, "editor");
+    // ...proceed
+  },
+});
+```
+
+For delete actions use `"admin"` (or fold in `"owner"` to require the real owner).
+
+## Create actions must set owner
+
+When inserting a new row, fill `ownerEmail` and `orgId` from the request context:
+
+```ts
+import {
+  getRequestUserEmail,
+  getRequestOrgId,
+} from "@agent-native/core/server/request-context";
+
+const ownerEmail = getRequestUserEmail();
+// Never fall back to a sentinel like "local@localhost" — that pools every
+// unauthenticated write into one shared tenant (see the 2026-04-29 leak and
+// guard-no-localhost-fallback). Throw / 401 when there is no session instead.
+if (!ownerEmail) throw new Error("Not authenticated");
+
+await db.insert(schema.decks).values({
+  id: nanoid(),
+  title,
+  data,
+  ownerEmail,
+  orgId: getRequestOrgId(),
+  // visibility defaults to 'private'
+  // ...
+});
+```
+
+## Drop in the share UI
+
+```tsx
+import { ShareButton } from "@agent-native/core/client/sharing";
+
+// In the resource's header/toolbar:
+<ShareButton
+  resourceType="deck"
+  resourceId={deck.id}
+  resourceTitle={deck.title}
+/>;
+```
+
+For list views, show `<VisibilityBadge visibility={row.visibility} />` next to each resource.
+
+## Actions available everywhere
+
+The framework auto-mounts these actions in every template — no per-template boilerplate:
+
+| Action                     | Args                                                                           | Purpose                                   |
+| -------------------------- | ------------------------------------------------------------------------------ | ----------------------------------------- |
+| `share-resource`           | `resourceType, resourceId, principalType, principalId, role, notify?, resourceUrl?` | Grant a user or org access. `notify` defaults to true for individual user shares; `resourceUrl` can provide the direct app link used in the notification email. |
+| `unshare-resource`         | `resourceType, resourceId, principalType, principalId`                         | Revoke access.                            |
+| `list-resource-shares`     | `resourceType, resourceId`                                                     | Current visibility + all share grants.    |
+| `set-resource-visibility`  | `resourceType, resourceId, visibility`                                         | Change to `private` / `org` / `public`.  |
+
+Both the agent and the UI use these same actions. The agent calls them as tools;
+UI code should use `ShareButton` / `ShareDialog` or the action client hooks
+instead of hand-writing route calls.
+
+## Migration pattern for existing tables
+
+When retrofitting an existing resource table:
+
+1. Add `owner_email`, `org_id`, `visibility` columns (defaults `'local@localhost'`, `NULL`, `'private'`).
+2. Backfill `owner_email` from any prior creator trail; otherwise leave the default.
+3. Add the companion `{type}_shares` table.
+4. Register via `registerShareableResource`.
+5. Update list/read actions to use `accessFilter`.
+6. Update update/delete actions to `assertAccess` with the correct role.
+7. Add `<ShareButton>` to the resource header.
+8. Add `getResourcePath` in the registration so agent-triggered shares can email a direct link even when no UI supplied `resourceUrl`.
+
+## Templates that opt out
+
+Sharing doesn't apply to:
+
+- **Personal-data apps** (mail, macros) — user-scoped by design.
+- **External source-of-truth apps** (issues → Jira, recruiting → Greenhouse) — ACL lives in the upstream system.
+- **Demo/boilerplate** (starter) — no resources.
+
+For these, add a short note to the template's `AGENTS.md` explaining why.
+
+## Analytics (follow-up)
+
+Dashboards and analyses in the `analytics` template currently live in the settings KV store (`u:<email>:dashboard-*` keys), not SQL. Sharing requires either migrating them to SQL tables (then applying this skill) or extending the settings store with a parallel share overlay. This is a tracked follow-up — see the analytics template's `AGENTS.md`.
+
+## Debugging
+
+- `ForbiddenError` from an action means the current user isn't owner / hasn't been shared / can't meet the role bar.
+- If the agent can't see a resource it just created, check that the insert actually set `owner_email` from the request context.
+- If a share doesn't take effect in the UI, confirm the template's `list-*` action uses `accessFilter` — the share rows are there but nothing is reading them yet.

package/corpus/templates/analytics/.builder/skills/charts/SKILL.md

@@ -27,7 +27,7 @@ pnpm action generate-chart --type=bar --title="Title" --labels='["A","B","C"]' -
 | `--labels`             | JSON array of x-axis labels                                                | required               |
 | `--data`               | JSON array of numbers, OR array of `{label, data, color}` for multi-series | required               |
 | `--color`              | Primary hex color                                                          | `#18B4F4`              |
-| `--theme`              | `dark`, `light`                                                            | auto from `/api/theme` |
+| `--theme`              | `dark`, `light`                                                            | auto from `media/theme.json` |
 | `--stacked`            | `true` for stacked bars                                                    | `false`                |
 | `--filename`           | Output filename (no ext)                                                   | auto from title        |
 | `--width` / `--height` | Image dimensions                                                           | 800x400                |
@@ -88,4 +88,4 @@ When using QuickChart (`https://quickchart.io/chart/create`) with Chart.js v2:
 - **Relative paths do NOT work** — chat UI is on a different origin. Always use the fully qualified URL from script output (uses `APP_ORIGIN`)
 - Cache busting (`?v=<timestamp>`) auto-appended
 - `chartjs-node-canvas` depends on `canvas` native module — `pnpm.onlyBuiltDependencies` must include `"canvas"`. If not built, run `pnpm rebuild canvas`
-- Theme auto-detected from `media/theme.json` (set by sidebar toggle via `POST /api/theme`)
+- Theme auto-detected from `media/theme.json` (set by the sidebar toggle via the `set-theme` action)

package/corpus/templates/analytics/actions/delete-dashboard-view.ts

@@ -0,0 +1,24 @@
+import { defineAction } from "@agent-native/core";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+import { z } from "zod";
+
+import { deleteDashboardView } from "../server/lib/dashboards-store";
+
+export default defineAction({
+  agentTool: false,
+  description: "Delete a saved filter view from a dashboard.",
+  schema: z.object({
+    dashboardId: z.string().min(1).describe("The dashboard ID"),
+    viewId: z.string().min(1).describe("The view ID to delete"),
+  }),
+  http: { method: "DELETE" },
+  run: async (args) => {
+    const email = getRequestUserEmail() ?? "";
+    const orgId = getRequestOrgId() || null;
+    await deleteDashboardView(args.dashboardId, args.viewId, { email, orgId });
+    return { success: true };
+  },
+});

package/corpus/templates/analytics/actions/delete-user-pref.ts

@@ -0,0 +1,22 @@
+import { defineAction } from "@agent-native/core";
+import { getRequestUserEmail } from "@agent-native/core/server";
+import { deleteUserSetting } from "@agent-native/core/settings";
+import { z } from "zod";
+
+export default defineAction({
+  agentTool: false,
+  description:
+    "Delete a per-user UI preference record from the settings store.",
+  schema: z.object({
+    key: z.string().min(1).describe("Preference key"),
+  }),
+  http: { method: "DELETE" },
+  run: async (args) => {
+    const email = getRequestUserEmail();
+    if (!email) {
+      throw Object.assign(new Error("Not authenticated"), { statusCode: 401 });
+    }
+    await deleteUserSetting(email, args.key);
+    return { success: true };
+  },
+});

package/corpus/templates/analytics/actions/generate-chart.ts

@@ -7,48 +7,15 @@ import type { ChartJSNodeCanvas as ChartJSNodeCanvasType } from "chartjs-node-ca
 import { z } from "zod";
 
 import { getAnalyticsMediaDir } from "../server/lib/media-dir.js";
+import {
+  CHART_PALETTES,
+  CHART_THEMES,
+  renderStaticChartSvg,
+} from "../server/lib/report-chart-svg.js";
 import { signedSvgMediaUrl } from "../server/lib/signed-media.js";
 import { cliBoolean } from "./schema-helpers";
 
-const THEMES = {
-  dark: {
-    background: "#09090b",
-    gridColor: "#27272a",
-    tickColor: "#a1a1aa",
-    titleColor: "#fafafa",
-    labelColor: "#fafafa",
-  },
-  light: {
-    background: "#ffffff",
-    gridColor: "#d4d4d8",
-    tickColor: "#71717a",
-    titleColor: "#09090b",
-    labelColor: "#09090b",
-  },
-} as const;
-
-const PALETTES = {
-  dark: [
-    "#00B5FF",
-    "#48FFE4",
-    "#22c55e",
-    "#f59e0b",
-    "#0ea5e9",
-    "#ef4444",
-    "#14b8a6",
-    "#f97316",
-  ],
-  light: [
-    "#0284C7",
-    "#0D9488",
-    "#16a34a",
-    "#d97706",
-    "#0369a1",
-    "#dc2626",
-    "#0f766e",
-    "#ea580c",
-  ],
-} as const;
+export { renderStaticChartSvg };
 
 function getTheme(): "dark" | "light" {
   try {
@@ -74,36 +41,6 @@ interface SeriesData {
   color?: string;
 }
 
-function escapeXml(value: unknown): string {
-  return String(value ?? "")
-    .replace(/&/g, "&")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;");
-}
-
-function safeColor(value: string | undefined, fallback: string): string {
-  const candidate = value?.trim();
-  if (candidate && /^#[0-9a-fA-F]{3,8}$/.test(candidate)) {
-    return candidate;
-  }
-  return fallback;
-}
-
-function numeric(value: unknown): number {
-  const number = Number(value);
-  return Number.isFinite(number) ? number : 0;
-}
-
-function formatTick(value: number): string {
-  const abs = Math.abs(value);
-  if (abs >= 1_000_000_000) return `${(value / 1_000_000_000).toFixed(1)}b`;
-  if (abs >= 1_000_000) return `${(value / 1_000_000).toFixed(1)}m`;
-  if (abs >= 1_000) return `${(value / 1_000).toFixed(1)}k`;
-  if (Number.isInteger(value)) return String(value);
-  return value.toFixed(1);
-}
-
 function filenameStem(title: string, explicitFilename?: string): string {
   const stem = slugify(explicitFilename || title) || "chart";
   return explicitFilename ? stem : `${stem}-${Date.now()}`;
@@ -122,180 +59,6 @@ function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
-export function renderStaticChartSvg({
-  title,
-  subtitle,
-  labels,
-  datasets,
-  type,
-  width,
-  height,
-  theme,
-  palette,
-  primaryColor,
-  stacked,
-}: {
-  title: string;
-  subtitle: string;
-  labels: string[];
-  datasets: SeriesData[];
-  type: "bar" | "line" | "area";
-  width: number;
-  height: number;
-  theme: (typeof THEMES)["dark" | "light"];
-  palette: readonly string[];
-  primaryColor: string;
-  stacked: boolean;
-}): string {
-  const safeWidth = Math.max(360, Math.min(2000, Math.round(width)));
-  const safeHeight = Math.max(240, Math.min(1200, Math.round(height)));
-  const chartLeft = 58;
-  const chartRight = safeWidth - 28;
-  const chartTop = subtitle ? 88 : 66;
-  const chartBottom = safeHeight - 48;
-  const plotWidth = Math.max(1, chartRight - chartLeft);
-  const plotHeight = Math.max(1, chartBottom - chartTop);
-  const normalizedLabels = labels.map((label) => String(label ?? ""));
-  const series = datasets.map((dataset, index) => ({
-    label: dataset.label || `Series ${index + 1}`,
-    color: safeColor(
-      dataset.color,
-      index === 0 ? primaryColor : palette[index % palette.length],
-    ),
-    data: normalizedLabels.map((_, dataIndex) =>
-      Math.max(0, numeric(dataset.data?.[dataIndex])),
-    ),
-  }));
-  const usableSeries = series.length
-    ? series
-    : [
-        {
-          label: title,
-          color: safeColor(primaryColor, palette[0]),
-          data: normalizedLabels.map(() => 0),
-        },
-      ];
-
-  const stackedTotals = normalizedLabels.map((_, dataIndex) =>
-    usableSeries.reduce((sum, dataset) => sum + dataset.data[dataIndex], 0),
-  );
-  const maxValue = Math.max(
-    1,
-    ...(stacked && type === "bar"
-      ? stackedTotals
-      : usableSeries.flatMap((dataset) => dataset.data)),
-  );
-  const yFor = (value: number) =>
-    chartBottom - (Math.max(0, value) / maxValue) * plotHeight;
-  const slot = plotWidth / Math.max(normalizedLabels.length, 1);
-  const labelStep = Math.max(1, Math.ceil(normalizedLabels.length / 8));
-
-  const grid = Array.from({ length: 5 }, (_, index) => {
-    const value = (maxValue / 4) * (4 - index);
-    const y = yFor(value);
-    return `<line x1="${chartLeft}" x2="${chartRight}" y1="${y.toFixed(1)}" y2="${y.toFixed(1)}" stroke="${theme.gridColor}" stroke-width="0.8"/><text x="${chartLeft - 10}" y="${(y + 4).toFixed(1)}" text-anchor="end" font-size="11" fill="${theme.tickColor}">${escapeXml(formatTick(value))}</text>`;
-  }).join("");
-
-  const xLabels = normalizedLabels
-    .map((label, index) => {
-      if (index % labelStep !== 0 && index !== normalizedLabels.length - 1) {
-        return "";
-      }
-      const x = chartLeft + slot * index + slot / 2;
-      const text =
-        label.length > 14 ? `${label.slice(0, 12).trimEnd()}...` : label;
-      return `<text x="${x.toFixed(1)}" y="${safeHeight - 18}" text-anchor="middle" font-size="11" fill="${theme.tickColor}">${escapeXml(text)}</text>`;
-    })
-    .join("");
-
-  let marks = "";
-  if (type === "bar") {
-    if (stacked) {
-      marks = normalizedLabels
-        .map((_, labelIndex) => {
-          const x = chartLeft + slot * labelIndex + slot * 0.2;
-          const barWidth = Math.max(5, slot * 0.6);
-          let baseline = chartBottom;
-          return usableSeries
-            .map((dataset) => {
-              const value = dataset.data[labelIndex];
-              const nextY = yFor(
-                chartBottom === baseline
-                  ? value
-                  : ((chartBottom - baseline) / plotHeight) * maxValue + value,
-              );
-              const height = Math.max(0, baseline - nextY);
-              baseline = nextY;
-              return `<rect x="${x.toFixed(1)}" y="${nextY.toFixed(1)}" width="${barWidth.toFixed(1)}" height="${height.toFixed(1)}" rx="4" fill="${dataset.color}"/>`;
-            })
-            .join("");
-        })
-        .join("");
-    } else {
-      const groupWidth = slot * 0.72;
-      const barWidth = Math.max(4, groupWidth / usableSeries.length - 2);
-      marks = normalizedLabels
-        .map((_, labelIndex) =>
-          usableSeries
-            .map((dataset, seriesIndex) => {
-              const value = dataset.data[labelIndex];
-              const x =
-                chartLeft +
-                slot * labelIndex +
-                slot * 0.14 +
-                seriesIndex * (barWidth + 2);
-              const y = yFor(value);
-              const barHeight = Math.max(2, chartBottom - y);
-              return `<rect x="${x.toFixed(1)}" y="${y.toFixed(1)}" width="${barWidth.toFixed(1)}" height="${barHeight.toFixed(1)}" rx="4" fill="${dataset.color}"/>`;
-            })
-            .join(""),
-        )
-        .join("");
-    }
-  } else {
-    marks = usableSeries
-      .map((dataset) => {
-        const points = dataset.data.map((value, index) => {
-          const x = chartLeft + slot * index + slot / 2;
-          return `${x.toFixed(1)},${yFor(value).toFixed(1)}`;
-        });
-        if (!points.length) return "";
-        const path = points
-          .map((point, index) => `${index === 0 ? "M" : "L"} ${point}`)
-          .join(" ");
-        const area =
-          type === "area"
-            ? `<path d="${path} L ${chartLeft + slot * (points.length - 0.5)},${chartBottom} L ${chartLeft + slot / 2},${chartBottom} Z" fill="${dataset.color}" fill-opacity="0.18"/>`
-            : "";
-        return `${area}<path d="${path}" fill="none" stroke="${dataset.color}" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"/>`;
-      })
-      .join("");
-  }
-
-  const legend =
-    usableSeries.length > 1
-      ? `<g transform="translate(${chartLeft},${subtitle ? 58 : 42})">${usableSeries
-          .map((dataset, index) => {
-            const x = index * 148;
-            return `<rect x="${x}" y="0" width="12" height="12" rx="3" fill="${dataset.color}"/><text x="${x + 18}" y="11" font-size="12" fill="${theme.labelColor}">${escapeXml(dataset.label)}</text>`;
-          })
-          .join("")}</g>`
-      : "";
-
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${safeWidth}" height="${safeHeight}" viewBox="0 0 ${safeWidth} ${safeHeight}" role="img" aria-label="${escapeXml(title)}">
-  <rect width="${safeWidth}" height="${safeHeight}" rx="8" fill="${theme.background}"/>
-  <text x="24" y="32" font-family="ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="22" font-weight="700" fill="${theme.titleColor}">${escapeXml(title)}</text>
-  ${subtitle ? `<text x="24" y="54" font-family="ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif" font-size="13" fill="${theme.tickColor}">${escapeXml(subtitle)}</text>` : ""}
-  ${legend}
-  <g font-family="ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, Segoe UI, sans-serif">
-    ${grid}
-    <line x1="${chartLeft}" x2="${chartRight}" y1="${chartBottom}" y2="${chartBottom}" stroke="${theme.gridColor}" stroke-width="1"/>
-    ${marks}
-    ${xLabels}
-  </g>
-</svg>`;
-}
-
 /**
  * Returned alongside any validation `error` so the agent gets an unambiguous
  * recovery path. The previous behavior (a bare error string) led to retry
@@ -369,8 +132,8 @@ export default defineAction({
     const width = args.width ?? 800;
     const height = args.height ?? 400;
     const themeName = args.theme || getTheme();
-    const theme = THEMES[themeName];
-    const palette = PALETTES[themeName];
+    const theme = CHART_THEMES[themeName];
+    const palette = CHART_PALETTES[themeName];
     const primaryColor = args.color || palette[0];
 
     let labels: string[];

package/corpus/templates/analytics/actions/get-theme.ts

@@ -0,0 +1,27 @@
+import { defineAction } from "@agent-native/core";
+import { z } from "zod";
+
+import {
+  getScopedSettingRecord,
+  resolveRequestScope,
+} from "../server/lib/scoped-settings";
+
+export default defineAction({
+  agentTool: false,
+  description: "Get the saved Analytics UI theme for the current scope.",
+  schema: z.object({}),
+  http: { method: "GET" },
+  readOnly: true,
+  run: async () => {
+    // Theme is read during first paint; an unauthenticated or failed lookup
+    // must still resolve to the default rather than break the shell.
+    try {
+      const scope = resolveRequestScope();
+      const data = await getScopedSettingRecord(scope, "analytics-theme");
+      if (data) return data;
+      return { theme: "dark" };
+    } catch {
+      return { theme: "dark" };
+    }
+  },
+});

package/corpus/templates/analytics/actions/get-user-pref.ts

@@ -0,0 +1,22 @@
+import { defineAction } from "@agent-native/core";
+import { getRequestUserEmail } from "@agent-native/core/server";
+import { getUserSetting } from "@agent-native/core/settings";
+import { z } from "zod";
+
+export default defineAction({
+  agentTool: false,
+  description: "Read a per-user UI preference record from the settings store.",
+  schema: z.object({
+    key: z.string().min(1).describe("Preference key"),
+  }),
+  http: { method: "GET" },
+  readOnly: true,
+  run: async (args) => {
+    const email = getRequestUserEmail();
+    if (!email) {
+      throw Object.assign(new Error("Not authenticated"), { statusCode: 401 });
+    }
+    const data = await getUserSetting(email, args.key);
+    return data ?? {};
+  },
+});