@agent-native/core 0.157.8 → 0.157.10

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 8256
+- template files: 8257

package/corpus/templates/analytics/actions/purge-first-party-analytics-postgres.ts

@@ -88,11 +88,20 @@ export default defineAction({
       startReceivedAt,
       startEventDate: startReceivedAt.slice(0, 10),
     };
-    const postgres = await countFirstPartyAnalyticsPostgresRows(
-      scope,
-      includeLegacyOwnerRows,
-      window,
-    );
+    let postgres: Awaited<
+      ReturnType<typeof countFirstPartyAnalyticsPostgresRows>
+    > | null = null;
+    let postgresError: string | null = null;
+    try {
+      postgres = await countFirstPartyAnalyticsPostgresRows(
+        scope,
+        includeLegacyOwnerRows,
+        window,
+      );
+    } catch (error) {
+      if (!dryRun) throw error;
+      postgresError = error instanceof Error ? error.message : String(error);
+    }
     let bigQuery: {
       eventCount: number;
       dailyRollupRows: number;
@@ -115,12 +124,15 @@ export default defineAction({
       }
     }
 
-    const uncopiedEventRows = bigQuery
-      ? Math.max(0, postgres.eventRows - bigQuery.eventCount)
-      : null;
+    const uncopiedEventRows =
+      bigQuery && postgres
+        ? Math.max(0, postgres.eventRows - bigQuery.eventCount)
+        : null;
     const safeToDelete =
       backend.sink === "bigquery" &&
       backend.backfillCompleted === true &&
+      postgresError === null &&
+      postgres !== null &&
       bigQueryError === null &&
       bigQuery !== null &&
       uncopiedEventRows === 0;
@@ -136,6 +148,11 @@ export default defineAction({
           "Postgres purge is blocked until the durable BigQuery backfill reports completed.",
         );
       }
+      if (postgresError || !postgres) {
+        throw new Error(
+          `Postgres purge is blocked because the scoped Postgres inventory could not be verified: ${postgresError ?? "unknown Postgres state"}`,
+        );
+      }
       if (bigQueryError || !bigQuery) {
         throw new Error(
           `Postgres purge is blocked because BigQuery readiness could not be verified: ${bigQueryError ?? "unknown warehouse state"}`,
@@ -179,6 +196,7 @@ export default defineAction({
       sink: backend.sink,
       backfillCompleted: backend.backfillCompleted === true,
       postgres,
+      postgresError,
       bigQuery,
       bigQueryError,
       uncopiedEventRows,

package/corpus/templates/analytics/scripts/first-party-analytics-postgres-retention-dry-run.sql

@@ -0,0 +1,261 @@
+-- FIRST-PARTY ANALYTICS POSTGRES RETENTION PREVIEW - READ ONLY
+--
+-- This file intentionally contains no INSERT, UPDATE, DELETE, TRUNCATE, or DDL.
+-- It reports only rows in the explicitly resolved Builder.io organization and
+-- the exact 60-day window that was copied to BigQuery by the migration.
+--
+-- The candidate set excludes http.response because that event class was
+-- intentionally omitted from the BigQuery backfill. Rows older than the
+-- lookback window and legacy owner-only rows are reported separately and are
+-- never included in the candidate count. Session replay, exception issues,
+-- public-key metadata, rollups, alerts, and pressure data are reported as
+-- preserved SQL rows; they are not deletion candidates.
+-- The organization and owner values below are intentionally fake safe
+-- defaults. Supply scoped values in a local copy or SQL-client parameters;
+-- never commit real organization IDs or employee addresses here.
+
+WITH params AS (
+  SELECT
+    'org-example'::text AS org_id,
+    'owner@example.com'::text AS owner_email,
+    '2026-06-10T18:50:43.370Z'::text AS lookback_start,
+    '2026-08-09T19:11:44.834Z'::text AS cutoff,
+    'http.response'::text AS excluded_event_name
+),
+org_window AS (
+  SELECT e.id, e.event_name, e.received_at
+  FROM analytics_events AS e
+  CROSS JOIN params AS p
+  WHERE e.org_id = p.org_id
+    AND e.received_at >= p.lookback_start
+    AND e.received_at < p.cutoff
+),
+org_older AS (
+  SELECT e.received_at
+  FROM analytics_events AS e
+  CROSS JOIN params AS p
+  WHERE e.org_id = p.org_id
+    AND e.received_at < p.lookback_start
+),
+legacy_window AS (
+  SELECT e.received_at
+  FROM analytics_events AS e
+  CROSS JOIN params AS p
+  WHERE e.org_id IS NULL
+    AND e.owner_email = p.owner_email
+    AND e.received_at >= p.lookback_start
+    AND e.received_at < p.cutoff
+),
+candidate AS (
+  SELECT w.id, w.event_name, w.received_at
+  FROM org_window AS w
+  CROSS JOIN params AS p
+  WHERE w.event_name IS DISTINCT FROM p.excluded_event_name
+),
+metrics AS (
+  SELECT
+    'events'::text AS section,
+    'candidate_non_http_response'::text AS metric,
+    COUNT(*) AS row_count,
+    MIN(received_at) AS first_seen,
+    MAX(received_at) AS last_seen,
+    'Only rows in the copied 60-day org window; not a delete.'::text AS notes
+  FROM candidate
+
+  UNION ALL
+  SELECT
+    'events',
+    'excluded_http_response',
+    COUNT(*),
+    MIN(received_at),
+    MAX(received_at),
+    'Excluded from BigQuery backfill; do not delete without a separate decision.'
+  FROM org_window AS w
+  CROSS JOIN params AS p
+  WHERE w.event_name = p.excluded_event_name
+
+  UNION ALL
+  SELECT
+    'events',
+    'older_than_lookback',
+    COUNT(*),
+    MIN(received_at),
+    MAX(received_at),
+    'Not copied by the 60-day migration; not a delete candidate.'
+  FROM org_older
+
+  UNION ALL
+  SELECT
+    'events',
+    'legacy_owner_only_in_window',
+    COUNT(*),
+    MIN(received_at),
+    MAX(received_at),
+    'org_id IS NULL branch; migration checkpoint copied zero legacy rows.'
+  FROM legacy_window
+
+  UNION ALL
+  SELECT
+    'event_names',
+    event_name,
+    COUNT(*),
+    MIN(received_at),
+    MAX(received_at),
+    'Candidate rows grouped by event name.'
+  FROM candidate
+  GROUP BY event_name
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'analytics_event_daily_rollups',
+    COUNT(*),
+    NULL,
+    NULL,
+    'Preserved derived event counts.'
+  FROM analytics_event_daily_rollups AS r
+  CROSS JOIN params AS p
+  WHERE r.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'analytics_user_days',
+    COUNT(*),
+    NULL,
+    NULL,
+    'Preserved active-user/retention rows.'
+  FROM analytics_user_days AS u
+  CROSS JOIN params AS p
+  WHERE u.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'analytics_event_volume_usage',
+    COUNT(*),
+    NULL,
+    NULL,
+    'Preserved volume-cap state.'
+  FROM analytics_event_volume_usage AS v
+  CROSS JOIN params AS p
+  WHERE v.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'analytics_query_pressure_daily',
+    COUNT(*),
+    NULL,
+    NULL,
+    'Preserved query-pressure diagnostics.'
+  FROM analytics_query_pressure_daily AS q
+  CROSS JOIN params AS p
+  WHERE q.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'analytics_alert_rules',
+    COUNT(*),
+    NULL,
+    NULL,
+    'Preserved alert definitions.'
+  FROM analytics_alert_rules AS a
+  CROSS JOIN params AS p
+  WHERE a.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'analytics_alert_incidents',
+    COUNT(*),
+    NULL,
+    NULL,
+    'Preserved alert history.'
+  FROM analytics_alert_incidents AS i
+  CROSS JOIN params AS p
+  WHERE i.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'session_recordings',
+    COUNT(*),
+    MIN(started_at),
+    MAX(COALESCE(ended_at, started_at)),
+    'Session replay summaries; never delete with event rows.'
+  FROM session_recordings AS s
+  CROSS JOIN params AS p
+  WHERE s.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'session_replay_chunks',
+    COUNT(*),
+    MIN(created_at),
+    MAX(created_at),
+    'Session replay payload references; never delete with event rows.'
+  FROM session_replay_chunks AS c
+  CROSS JOIN params AS p
+  WHERE c.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'session_replay_ingests',
+    COUNT(*),
+    MIN(created_at),
+    MAX(created_at),
+    'Session replay ingest audit rows; never delete with event rows.'
+  FROM session_replay_ingests AS g
+  CROSS JOIN params AS p
+  WHERE g.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'error_issues',
+    COUNT(*),
+    MIN(first_seen_at),
+    MAX(last_seen_at),
+    'Grouped exception issues; preserved separately from analytics_events.'
+  FROM error_issues AS x
+  CROSS JOIN params AS p
+  WHERE x.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'error_events',
+    COUNT(*),
+    MIN(occurred_at),
+    MAX(occurred_at),
+    'Exception occurrences; preserved separately from analytics_events.'
+  FROM error_events AS x
+  CROSS JOIN params AS p
+  WHERE x.org_id = p.org_id
+
+  UNION ALL
+  SELECT
+    'preserved_sql',
+    'analytics_public_keys',
+    COUNT(*),
+    MIN(created_at),
+    MAX(created_at),
+    'Public-key metadata; preserved separately from analytics_events.'
+  FROM analytics_public_keys AS k
+  CROSS JOIN params AS p
+  WHERE k.org_id = p.org_id
+)
+SELECT section, metric, row_count, first_seen, last_seen, notes
+FROM metrics
+ORDER BY
+  CASE section
+    WHEN 'events' THEN 1
+    WHEN 'event_names' THEN 2
+    ELSE 3
+  END,
+  row_count DESC,
+  metric;

package/corpus/templates/analytics/server/lib/first-party-analytics-backend.ts

@@ -1130,7 +1130,9 @@ export async function getFirstPartyAnalyticsBigQueryMetrics(
     WITH scoped_events AS (
       SELECT *
       FROM \`${physical.events}\`
-      WHERE ${tenantFilter}${startDateFilter} AND event_date <= ${today}
+      WHERE ${tenantFilter}${startDateFilter}
+        AND event_name IS DISTINCT FROM 'http.response'
+        AND event_date <= ${today}
     )
     SELECT
       COUNT(*) AS event_count,

package/corpus/templates/analytics/server/lib/first-party-analytics-purge.ts

@@ -1,4 +1,5 @@
-import { and, count, eq, gte, isNull, or } from "drizzle-orm";
+import { getDbExec } from "@agent-native/core/db";
+import { and, eq, gte, isNull, ne, or } from "drizzle-orm";
 
 import { getDb, schema } from "../db/index.js";
 
@@ -46,13 +47,52 @@ function windowPredicate(
     : and(predicate, gte(table.eventDate, window.startEventDate));
 }
 
-async function countScopedRows(table: any, predicate: any): Promise<number> {
-  const [row] = await (getDb() as any)
-    .select({ count: count() })
-    .from(table)
-    .where(predicate);
-  const value = Number(row?.count ?? 0);
-  return Number.isFinite(value) ? value : 0;
+type CountTable =
+  | "analytics_events"
+  | "analytics_event_daily_rollups"
+  | "analytics_user_days";
+
+type CountTimeColumn = "received_at" | "event_date";
+
+async function countScopedRows(
+  table: CountTable,
+  timeColumn: CountTimeColumn,
+  scope: FirstPartyAnalyticsPurgeScope,
+  includeLegacyOwnerRows: boolean,
+  window: FirstPartyAnalyticsPurgeWindow,
+): Promise<number> {
+  const scopeSql = includeLegacyOwnerRows
+    ? "(org_id = ? OR (org_id IS NULL AND owner_email = ?))"
+    : "org_id = ?";
+  const args: unknown[] = includeLegacyOwnerRows
+    ? [scope.orgId, scope.userEmail]
+    : [scope.orgId];
+  const eventFilter =
+    table === "analytics_events"
+      ? "\n             AND event_name IS DISTINCT FROM 'http.response'"
+      : "";
+  args.push(
+    timeColumn === "received_at"
+      ? window.startReceivedAt
+      : window.startEventDate,
+  );
+
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT COUNT(*) AS row_count
+           FROM ${table}
+           WHERE ${scopeSql}
+             ${eventFilter}
+             AND ${timeColumn} >= ?`,
+    args,
+    timeoutMs: 5_000,
+    maxAttempts: 1,
+  });
+  const rawCount = (rows[0] as { row_count?: unknown } | undefined)?.row_count;
+  const value = Number(rawCount);
+  if (!Number.isFinite(value)) {
+    throw new Error(`Postgres count returned an invalid value for ${table}`);
+  }
+  return value;
 }
 
 export async function countFirstPartyAnalyticsPostgresRows(
@@ -60,31 +100,28 @@ export async function countFirstPartyAnalyticsPostgresRows(
   includeLegacyOwnerRows: boolean,
   window: FirstPartyAnalyticsPurgeWindow,
 ): Promise<FirstPartyAnalyticsPostgresPurgeCounts> {
-  const predicates = [
-    windowPredicate(
-      schema.analyticsEvents,
-      scopePredicate(schema.analyticsEvents, scope, includeLegacyOwnerRows),
+  const [eventRows, dailyRollupRows, userDayRows] = await Promise.all([
+    countScopedRows(
+      "analytics_events",
+      "received_at",
+      scope,
+      includeLegacyOwnerRows,
       window,
     ),
-    windowPredicate(
-      schema.analyticsEventDailyRollups,
-      scopePredicate(
-        schema.analyticsEventDailyRollups,
-        scope,
-        includeLegacyOwnerRows,
-      ),
+    countScopedRows(
+      "analytics_event_daily_rollups",
+      "event_date",
+      scope,
+      includeLegacyOwnerRows,
       window,
     ),
-    windowPredicate(
-      schema.analyticsUserDays,
-      scopePredicate(schema.analyticsUserDays, scope, includeLegacyOwnerRows),
+    countScopedRows(
+      "analytics_user_days",
+      "event_date",
+      scope,
+      includeLegacyOwnerRows,
       window,
     ),
-  ];
-  const [eventRows, dailyRollupRows, userDayRows] = await Promise.all([
-    countScopedRows(schema.analyticsEvents, predicates[0]),
-    countScopedRows(schema.analyticsEventDailyRollups, predicates[1]),
-    countScopedRows(schema.analyticsUserDays, predicates[2]),
   ]);
   return { eventRows, dailyRollupRows, userDayRows };
 }
@@ -103,10 +140,17 @@ export async function purgeFirstPartyAnalyticsPostgresRows(
     await tx
       .delete(schema.analyticsEvents)
       .where(
-        windowPredicate(
-          schema.analyticsEvents,
-          scopePredicate(schema.analyticsEvents, scope, includeLegacyOwnerRows),
-          window,
+        and(
+          windowPredicate(
+            schema.analyticsEvents,
+            scopePredicate(
+              schema.analyticsEvents,
+              scope,
+              includeLegacyOwnerRows,
+            ),
+            window,
+          ),
+          ne(schema.analyticsEvents.eventName, "http.response"),
         ),
       );
     await tx

package/corpus/templates/analytics/server/lib/workspace-feature-flags.ts

@@ -68,6 +68,7 @@ export function validateWorkspaceFeatureFlagMutation(
   expected: {
     key: string;
     orgDomain: string;
+    allowExplicitNoOrgTarget?: boolean;
     rules?: Record<string, unknown>;
     enabledForEmail?: string;
   },
@@ -82,7 +83,8 @@ export function validateWorkspaceFeatureFlagMutation(
     !Array.isArray(payload.rules) &&
     !!payload.scope &&
     typeof payload.scope === "object" &&
-    payload.scope.orgDomain === expected.orgDomain;
+    (payload.scope.orgDomain === expected.orgDomain ||
+      (expected.allowExplicitNoOrgTarget && payload.scope.orgDomain === null));
   if (!valid)
     throw new Error(
       "The target app returned an unsupported or unverified feature flag mutation response.",
@@ -360,6 +362,7 @@ export async function setWorkspaceFeatureFlag(
   return validateWorkspaceFeatureFlagMutation(result.body, {
     key: input.key,
     orgDomain,
+    allowExplicitNoOrgTarget: true,
     ...(input.operation === "replace-rules" && input.rules
       ? {
           rules: {

package/corpus/templates/analytics/server/plugins/db.ts

@@ -1,6 +1,11 @@
 import {
+  deferMigration,
   ensureAdditiveColumns,
+  createDbExec,
   getDbExec,
+  getDatabaseUrl,
+  isPostgres,
+  MIGRATION_DEFERRED,
   runMigrations,
   withMigrationRuntime,
 } from "@agent-native/core/db";
@@ -34,6 +39,102 @@ const schemaTables = Object.values(schema).filter(isDrizzleTable);
 // packages/core/src/db/migrations.ts for the full rationale). Version numbers
 // alone are not a safe identity across parallel branches that each extend
 // this list independently — see the v75-v83 incident documented on v75 below.
+const ANALYTICS_EVENT_CURSOR_INDEX_REPAIR_TIMEOUT_MS = 15 * 60 * 1000;
+
+function getAnalyticsMigrationDatabaseUrl(): string {
+  const appName = process.env.APP_NAME?.toUpperCase().replace(/-/g, "_");
+  const directUrl = appName
+    ? process.env[`${appName}_DATABASE_URL_UNPOOLED`]
+    : undefined;
+  const url =
+    directUrl ||
+    process.env.NETLIFY_DATABASE_URL_UNPOOLED ||
+    process.env.DATABASE_URL_UNPOOLED ||
+    getDatabaseUrl();
+  return url.replace(/-pooler(\.[a-z0-9.-]+\.neon\.tech)/, "$1");
+}
+
+const ANALYTICS_EVENT_CURSOR_INDEX_REPAIR_LOCK =
+  "hashtext('agent-native:analytics-event-cursor-index-repair')";
+
+async function repairAnalyticsEventCursorIndexes(): Promise<
+  void | typeof MIGRATION_DEFERRED
+> {
+  if (!isPostgres()) return;
+
+  const repairIndexes = [
+    {
+      name: "analytics_events_org_received_id_non_http_idx",
+      createSql: `CREATE INDEX CONCURRENTLY IF NOT EXISTS analytics_events_org_received_id_non_http_idx
+        ON analytics_events (org_id, received_at, id)
+        WHERE event_name IS DISTINCT FROM 'http.response'`,
+    },
+    {
+      name: "analytics_events_owner_received_id_non_http_idx",
+      createSql: `CREATE INDEX CONCURRENTLY IF NOT EXISTS analytics_events_owner_received_id_non_http_idx
+        ON analytics_events (owner_email, received_at, id)
+        WHERE org_id IS NULL AND event_name IS DISTINCT FROM 'http.response'`,
+    },
+    {
+      name: "analytics_event_daily_rollups_org_event_date_idx",
+      createSql: `CREATE INDEX CONCURRENTLY IF NOT EXISTS analytics_event_daily_rollups_org_event_date_idx
+        ON analytics_event_daily_rollups (org_id, event_date)`,
+    },
+    {
+      name: "analytics_user_days_org_event_date_idx",
+      createSql: `CREATE INDEX CONCURRENTLY IF NOT EXISTS analytics_user_days_org_event_date_idx
+        ON analytics_user_days (org_id, event_date)`,
+    },
+  ];
+
+  const exec = await createDbExec({ url: getAnalyticsMigrationDatabaseUrl() });
+  const query = (sql: string) =>
+    exec.execute({
+      sql,
+      timeoutMs: ANALYTICS_EVENT_CURSOR_INDEX_REPAIR_TIMEOUT_MS,
+      maxAttempts: 1,
+    });
+
+  try {
+    const lockResult = await query(
+      `SELECT pg_try_advisory_lock(${ANALYTICS_EVENT_CURSOR_INDEX_REPAIR_LOCK}) AS acquired`,
+    );
+    if (lockResult.rows[0]?.acquired !== true) return deferMigration();
+
+    let lockHeld = true;
+    try {
+      const { rows } = await query(`
+      SELECT c.relname, i.indisvalid, i.indisready
+      FROM pg_class c
+      JOIN pg_index i ON i.indexrelid = c.oid
+      WHERE c.relname IN (${repairIndexes.map(({ name }) => `'${name}'`).join(", ")})
+    `);
+      const readyIndexes = new Set(
+        rows
+          .filter((row) => row.indisvalid === true && row.indisready === true)
+          .map((row) => String(row.relname)),
+      );
+      const expectedIndexes = repairIndexes.map(({ name }) => name);
+      if (expectedIndexes.every((name) => readyIndexes.has(name))) return;
+
+      for (const { name, createSql } of repairIndexes) {
+        if (readyIndexes.has(name)) continue;
+        await query(`DROP INDEX CONCURRENTLY IF EXISTS ${name}`);
+        await query(createSql);
+      }
+    } finally {
+      if (lockHeld) {
+        await query(
+          `SELECT pg_advisory_unlock(${ANALYTICS_EVENT_CURSOR_INDEX_REPAIR_LOCK})`,
+        );
+        lockHeld = false;
+      }
+    }
+  } finally {
+    await exec.close?.();
+  }
+}
+
 export const runAnalyticsMigrations = runMigrations(
   [
     {
@@ -1660,6 +1761,44 @@ export const runAnalyticsMigrations = runMigrations(
           ON analytics_bigquery_backfill_shards (job_id, status, next_run_at, lease_expires_at, start_at);`,
       },
     },
+    {
+      version: 144,
+      name: "analytics-events-backfill-filtered-cursor-index-repair",
+      sql: {
+        postgres: `DROP INDEX CONCURRENTLY IF EXISTS analytics_events_org_received_id_non_http_idx;
+        CREATE INDEX CONCURRENTLY IF NOT EXISTS analytics_events_org_received_id_non_http_idx
+          ON analytics_events (org_id, received_at, id)
+          WHERE event_name IS DISTINCT FROM 'http.response';
+        DROP INDEX CONCURRENTLY IF EXISTS analytics_events_owner_received_id_non_http_idx;
+        CREATE INDEX CONCURRENTLY IF NOT EXISTS analytics_events_owner_received_id_non_http_idx
+          ON analytics_events (owner_email, received_at, id)
+          WHERE org_id IS NULL AND event_name IS DISTINCT FROM 'http.response';`,
+        sqlite: `CREATE INDEX IF NOT EXISTS analytics_events_org_received_id_non_http_idx
+          ON analytics_events (org_id, received_at, id)
+          WHERE event_name IS NOT 'http.response';
+        CREATE INDEX IF NOT EXISTS analytics_events_owner_received_id_non_http_idx
+          ON analytics_events (owner_email, received_at, id)
+          WHERE org_id IS NULL AND event_name IS NOT 'http.response';`,
+      },
+    },
+    {
+      version: 145,
+      name: "analytics-events-backfill-filtered-cursor-index-direct-repair",
+      run: repairAnalyticsEventCursorIndexes,
+      sql: {
+        postgres: "SELECT 1",
+        sqlite: "SELECT 1",
+      },
+    },
+    {
+      version: 146,
+      name: "analytics-events-purge-inventory-index-direct-repair",
+      run: repairAnalyticsEventCursorIndexes,
+      sql: {
+        postgres: "SELECT 1",
+        sqlite: "SELECT 1",
+      },
+    },
   ],
   { table: "analytics_migrations" },
 );