@agent-native/core 0.84.20 → 0.84.22

package/corpus/core/src/mcp/org-directory.ts

@@ -146,6 +146,15 @@ function scopedCacheKey(
   ].join("|");
 }
 
+function authTokenAttempts(auth: {
+  apiKey?: string;
+  apiKeyFallbacks?: string[];
+}): string[] {
+  return [auth.apiKey, ...(auth.apiKeyFallbacks ?? [])].filter(
+    (token): token is string => typeof token === "string" && token.length > 0,
+  );
+}
+
 function serviceScopedCacheKey(origin: string, orgId: string): string {
   return [origin, `service-org:${orgId}`].join("|");
 }
@@ -200,7 +209,8 @@ export async function fetchOrgApps(opts?: {
     const auth = serviceOrgId
       ? await resolveOrgDirectoryServiceAuth(serviceOrgId)
       : await resolveOrgDirectoryCallerAuth();
-    if (!auth.apiKey) {
+    const attempts = authTokenAttempts(auth);
+    if (attempts.length === 0) {
       // No signed token available (no A2A secret / no caller identity) — the
       // directory requires the org bearer, so degrade silently to local-only.
       return [];
@@ -215,19 +225,23 @@ export async function fetchOrgApps(opts?: {
       }
     }
 
-    const res = await fetch(`${origin}/_agent-native/org/apps`, {
-      method: "GET",
-      headers: {
-        Authorization: `Bearer ${auth.apiKey}`,
-        Accept: "application/json",
-      },
-      signal: AbortSignal.timeout(4000),
-    });
-    if (res.ok) {
-      const json = (await res.json()) as { apps?: unknown };
-      const list = Array.isArray(json?.apps) ? json.apps : [];
-      apps = list.map(normalizeApp).filter((a): a is OrgApp => a !== null);
-      ttl = SUCCESS_TTL_MS;
+    for (let i = 0; i < attempts.length; i++) {
+      const res = await fetch(`${origin}/_agent-native/org/apps`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${attempts[i]}`,
+          Accept: "application/json",
+        },
+        signal: AbortSignal.timeout(4000),
+      });
+      if (res.ok) {
+        const json = (await res.json()) as { apps?: unknown };
+        const list = Array.isArray(json?.apps) ? json.apps : [];
+        apps = list.map(normalizeApp).filter((a): a is OrgApp => a !== null);
+        ttl = SUCCESS_TTL_MS;
+        break;
+      }
+      if (res.status !== 401 || i >= attempts.length - 1) break;
     }
     // Non-2xx ⇒ leave apps=[] with the short EMPTY_TTL (silent degrade).
   } catch {
@@ -252,6 +266,7 @@ export function _resetOrgDirectoryCache(): void {
 
 async function resolveOrgDirectoryCallerAuth(): Promise<{
   apiKey?: string;
+  apiKeyFallbacks?: string[];
   userEmail?: string;
   orgId?: string;
   orgDomain?: string;
@@ -266,6 +281,7 @@ async function resolveOrgDirectoryCallerAuth(): Promise<{
 
 async function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{
   apiKey?: string;
+  apiKeyFallbacks?: string[];
   userEmail?: string;
   orgId?: string;
   orgDomain?: string;
@@ -285,12 +301,42 @@ async function resolveOrgDirectoryServiceAuth(orgId: string): Promise<{
       import("./connect-store.js"),
     ]);
     const userEmail = serviceIdentityEmail("mcp-client", trimmedOrgId);
-    const apiKey = await signA2AToken(userEmail, orgDomain, orgSecret, {
-      expiresIn: "5m",
-      preferGlobalSecret: !orgSecret,
-      extraClaims: { org_id: trimmedOrgId },
-    });
-    return { apiKey, userEmail, orgId: trimmedOrgId, orgDomain };
+    const apiKeyAttempts: string[] = [];
+    const addApiKeyAttempt = (token: string | undefined) => {
+      if (!token || apiKeyAttempts.includes(token)) return;
+      apiKeyAttempts.push(token);
+    };
+    if (process.env.A2A_SECRET?.trim()) {
+      try {
+        addApiKeyAttempt(
+          await signA2AToken(userEmail, orgDomain, orgSecret, {
+            expiresIn: "5m",
+            preferGlobalSecret: true,
+            extraClaims: { org_id: trimmedOrgId },
+          }),
+        );
+      } catch {}
+    }
+    if (orgSecret) {
+      try {
+        addApiKeyAttempt(
+          await signA2AToken(userEmail, orgDomain, orgSecret, {
+            expiresIn: "5m",
+            preferGlobalSecret: false,
+            extraClaims: { org_id: trimmedOrgId },
+          }),
+        );
+      } catch {}
+    }
+    return {
+      apiKey: apiKeyAttempts[0],
+      ...(apiKeyAttempts.length > 1
+        ? { apiKeyFallbacks: apiKeyAttempts.slice(1) }
+        : {}),
+      userEmail,
+      orgId: trimmedOrgId,
+      orgDomain,
+    };
   } catch {
     return { orgId: trimmedOrgId, orgDomain };
   }

package/corpus/core/src/notifications/channels.ts

@@ -10,6 +10,16 @@
  *                              value never enters the agent context.
  * NOTIFICATIONS_WEBHOOK_AUTH → optional `Authorization` header value (also
  *                              supports `${keys.NAME}`).
+ * NOTIFICATIONS_SLACK_WEBHOOK_URL
+ *                            → POST notifications to a Slack incoming webhook.
+ *                              Supports `${keys.NAME}` substitution.
+ * NOTIFICATIONS_EMAIL_CHANNEL=1
+ *                            → enable the built-in email channel for
+ *                              per-notification recipients.
+ * NOTIFICATIONS_EMAIL_RECIPIENTS
+ *                            → comma-separated fallback recipients for email
+ *                              notifications that do not pass
+ *                              `metadata.emailRecipients`.
  */
 
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
@@ -18,6 +28,7 @@ import {
   validateUrlAllowlist,
   getKeyAllowlist,
 } from "../secrets/substitution.js";
+import { sendEmail } from "../server/email.js";
 import { registerNotificationChannel } from "./registry.js";
 import type { NotificationChannel } from "./types.js";
 
@@ -31,6 +42,16 @@ export function registerBuiltinNotificationChannels(): void {
   if (url) {
     registerNotificationChannel(createWebhookChannel(url));
   }
+
+  const slackUrl = process.env.NOTIFICATIONS_SLACK_WEBHOOK_URL;
+  if (slackUrl) {
+    registerNotificationChannel(createSlackWebhookChannel(slackUrl));
+  }
+
+  const emailRecipients = process.env.NOTIFICATIONS_EMAIL_RECIPIENTS?.trim();
+  if (process.env.NOTIFICATIONS_EMAIL_CHANNEL === "1" || emailRecipients) {
+    registerNotificationChannel(createEmailChannel());
+  }
 }
 
 function createWebhookChannel(urlTemplate: string): NotificationChannel {
@@ -38,47 +59,12 @@ function createWebhookChannel(urlTemplate: string): NotificationChannel {
   return {
     name: "webhook",
     async deliver(input, meta) {
-      // Resolve `${keys.NAME}` references against the owner's user-scope
-      // secrets. Missing keys throw — the error surfaces in logs and the
-      // channel is marked un-delivered, but other channels still run.
-      const { resolved: url } = await resolveKeyReferences(
+      const { url, headers } = await resolveWebhookRequest(
         urlTemplate,
-        "user",
+        authTemplate,
         meta.owner,
+        "webhook",
       );
-      const headers: Record<string, string> = {
-        "Content-Type": "application/json",
-      };
-      if (authTemplate) {
-        const { resolved: auth } = await resolveKeyReferences(
-          authTemplate,
-          "user",
-          meta.owner,
-        );
-        headers.Authorization = auth;
-      }
-
-      // If the user set an allowlist on a referenced key, enforce it here —
-      // origin-level check, same rule the automations fetch-tool applies.
-      const keyNames = Array.from(
-        new Set(
-          Array.from(
-            urlTemplate.matchAll(/\$\{keys\.([A-Za-z0-9_-]+)\}/g),
-            (m) => m[1],
-          ),
-        ),
-      );
-      const allowlists = await Promise.all(
-        keyNames.map((name) => getKeyAllowlist(name, "user", meta.owner)),
-      );
-      keyNames.forEach((name, i) => {
-        if (!validateUrlAllowlist(url, allowlists[i])) {
-          throw new Error(
-            `[notifications] webhook URL ${new URL(url).origin} is not in the allowlist for key "${name}"`,
-          );
-        }
-      });
-
       const res = await ssrfSafeFetch(
         url,
         {
@@ -106,6 +92,217 @@ function createWebhookChannel(urlTemplate: string): NotificationChannel {
   };
 }
 
+function createSlackWebhookChannel(urlTemplate: string): NotificationChannel {
+  const authTemplate = process.env.NOTIFICATIONS_SLACK_WEBHOOK_AUTH;
+  return {
+    name: "slack",
+    async deliver(input, meta) {
+      const { url, headers } = await resolveWebhookRequest(
+        urlTemplate,
+        authTemplate,
+        meta.owner,
+        "Slack webhook",
+      );
+      const res = await ssrfSafeFetch(
+        url,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            text: slackText(input.severity, input.title, input.body),
+            blocks: [
+              {
+                type: "section",
+                text: {
+                  type: "mrkdwn",
+                  text: `*${escapeSlack(input.title)}*`,
+                },
+              },
+              ...(input.body
+                ? [
+                    {
+                      type: "section",
+                      text: {
+                        type: "mrkdwn",
+                        text: escapeSlack(input.body),
+                      },
+                    },
+                  ]
+                : []),
+              {
+                type: "context",
+                elements: [
+                  {
+                    type: "mrkdwn",
+                    text: `Severity: \`${input.severity}\`  Owner: ${escapeSlack(meta.owner)}`,
+                  },
+                ],
+              },
+            ],
+          }),
+        },
+        { maxRedirects: 3 },
+      );
+      if (!res.ok) {
+        throw new Error(
+          `[notifications] Slack webhook ${new URL(url).origin} returned ${res.status}${
+            (await readErrorSnippet(res)) || ""
+          }`,
+        );
+      }
+    },
+  };
+}
+
+function createEmailChannel(): NotificationChannel {
+  return {
+    name: "email",
+    async deliver(input) {
+      const recipients = notificationEmailRecipients(input.metadata);
+      if (recipients.length === 0) return;
+      const subject =
+        typeof input.metadata?.emailSubject === "string" &&
+        input.metadata.emailSubject.trim()
+          ? input.metadata.emailSubject.trim()
+          : `[${input.severity}] ${input.title}`;
+      const metadata = scrubEmailMetadata(input.metadata);
+      const metadataText = metadata
+        ? `\n\nMetadata:\n${JSON.stringify(metadata, null, 2)}`
+        : "";
+      const text = `${input.title}\n\n${input.body ?? ""}${metadataText}`;
+      const html = [
+        `<p><strong>${escapeHtml(input.title)}</strong></p>`,
+        input.body ? `<p>${escapeHtml(input.body)}</p>` : "",
+        metadata
+          ? `<pre>${escapeHtml(JSON.stringify(metadata, null, 2))}</pre>`
+          : "",
+      ].join("");
+
+      await Promise.all(
+        recipients.map((to) =>
+          sendEmail({
+            to,
+            subject,
+            text,
+            html,
+          }),
+        ),
+      );
+    },
+  };
+}
+
+async function resolveWebhookRequest(
+  urlTemplate: string,
+  authTemplate: string | undefined,
+  owner: string,
+  label: string,
+): Promise<{ url: string; headers: Record<string, string> }> {
+  // Resolve `${keys.NAME}` references against the owner's user-scope secrets.
+  // Missing keys throw — the error surfaces in logs and the channel is marked
+  // un-delivered, but other channels still run.
+  const { resolved: url } = await resolveKeyReferences(
+    urlTemplate,
+    "user",
+    owner,
+  );
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+  if (authTemplate) {
+    const { resolved: auth } = await resolveKeyReferences(
+      authTemplate,
+      "user",
+      owner,
+    );
+    headers.Authorization = auth;
+  }
+
+  // If the user set an allowlist on a referenced key, enforce it here —
+  // origin-level check, same rule the automations fetch-tool applies.
+  const keyNames = Array.from(
+    new Set(
+      Array.from(urlTemplate.matchAll(/\$\{keys\.([A-Za-z0-9_-]+)\}/g), (m) =>
+        String(m[1]),
+      ),
+    ),
+  );
+  const allowlists = await Promise.all(
+    keyNames.map((name) => getKeyAllowlist(name, "user", owner)),
+  );
+  keyNames.forEach((name, i) => {
+    if (!validateUrlAllowlist(url, allowlists[i])) {
+      throw new Error(
+        `[notifications] ${label} URL ${new URL(url).origin} is not in the allowlist for key "${name}"`,
+      );
+    }
+  });
+  return { url, headers };
+}
+
+function notificationEmailRecipients(
+  metadata: Record<string, unknown> | undefined,
+): string[] {
+  const fromMetadata = stringArray(metadata?.emailRecipients);
+  const fromEnv = commaList(process.env.NOTIFICATIONS_EMAIL_RECIPIENTS);
+  const seen = new Set<string>();
+  const recipients: string[] = [];
+  for (const raw of [...fromMetadata, ...fromEnv]) {
+    const email = raw.trim().toLowerCase();
+    if (!email || seen.has(email)) continue;
+    seen.add(email);
+    recipients.push(email);
+  }
+  return recipients;
+}
+
+function stringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) return [];
+  return value.filter((item): item is string => typeof item === "string");
+}
+
+function commaList(value: string | undefined): string[] {
+  return value
+    ? value
+        .split(",")
+        .map((item) => item.trim())
+        .filter(Boolean)
+    : [];
+}
+
+function scrubEmailMetadata(
+  metadata: Record<string, unknown> | undefined,
+): Record<string, unknown> | null {
+  if (!metadata) return null;
+  const entries = Object.entries(metadata).filter(
+    ([key]) => key !== "emailRecipients" && key !== "emailSubject",
+  );
+  return entries.length ? Object.fromEntries(entries) : null;
+}
+
+function slackText(
+  severity: string,
+  title: string,
+  body: string | undefined,
+): string {
+  return `[${severity}] ${title}${body ? `\n${body}` : ""}`;
+}
+
+function escapeSlack(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
 /**
  * Read up to ~1 KB from the body for error context. Streams chunks so a
  * misbehaving endpoint returning a large error page doesn't pin that whole

package/corpus/core/src/scripts/call-agent.ts

@@ -1,6 +1,11 @@
 import { createHash } from "node:crypto";
 
-import { A2ATaskTimeoutError, callAgent, signA2AToken } from "../a2a/client.js";
+import {
+  A2ATaskTimeoutError,
+  callAgent,
+  shouldPreferGlobalA2ASecret,
+  signA2AToken,
+} from "../a2a/client.js";
 import {
   formatLlmCredentialErrorMessage,
   isLlmCredentialError,
@@ -162,7 +167,7 @@ export async function run(
             callerOrgSecret,
             {
               expiresIn: INTEGRATION_A2A_TOKEN_TTL,
-              preferGlobalSecret: !callerOrgSecret,
+              preferGlobalSecret: shouldPreferGlobalA2ASecret(callerOrgSecret),
             },
           );
         } catch {}

package/corpus/core/src/server/analytics.ts

@@ -39,14 +39,30 @@ function getGaMeasurementId(): string | null {
   );
 }
 
-function getGaScript(): string | null {
+/**
+ * Script hosts the injected GA loader pulls executable code from. Google Tag
+ * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from
+ * `www.google-analytics.com`. These must be listed in the document `script-src`
+ * so the CSP reflects the code the framework itself injects (see
+ * `applyDocumentCsp` in `ssr-handler.ts`).
+ */
+export const GA_CSP_SCRIPT_HOSTS = [
+  "https://www.googletagmanager.com",
+  "https://www.google-analytics.com",
+] as const;
+
+/**
+ * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
+ * block injected next to the gtag.js loader. Returned so the SSR handler can
+ * hash it for the `script-src` CSP directive — the hash must be computed from
+ * the identical string that `getGaScript()` embeds, so both call this helper.
+ * Returns `null` when GA is not configured.
+ */
+export function getGaInlineConfigScriptBody(): string | null {
   const id = getGaMeasurementId();
   if (!id) return null;
-  const srcId = encodeURIComponent(id);
   const jsId = JSON.stringify(id);
   return (
-    `<script async src="https://www.googletagmanager.com/gtag/js?id=${srcId}"></script>` +
-    `<script>` +
     `window.dataLayer=window.dataLayer||[];` +
     `function gtag(){dataLayer.push(arguments);}` +
     `gtag('js',new Date());` +
@@ -54,8 +70,18 @@ function getGaScript(): string | null {
     `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +
     `sessionStorage.removeItem('__an_signin');` +
     `gtag('event','sign_in');` +
-    `}` +
-    `</script>`
+    `}`
+  );
+}
+
+function getGaScript(): string | null {
+  const id = getGaMeasurementId();
+  if (!id) return null;
+  const srcId = encodeURIComponent(id);
+  const inlineBody = getGaInlineConfigScriptBody();
+  return (
+    `<script async src="https://www.googletagmanager.com/gtag/js?id=${srcId}"></script>` +
+    `<script>${inlineBody}</script>`
   );
 }
 

package/corpus/core/src/server/ssr-handler.ts

@@ -30,6 +30,10 @@ import {
   AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,
   withAgentNativeSocialImageCacheBuster,
 } from "../shared/social-meta.js";
+import {
+  GA_CSP_SCRIPT_HOSTS,
+  getGaInlineConfigScriptBody,
+} from "./analytics.js";
 import {
   getAppBasePathFromViteEnv,
   stripAppBasePath as canonicalStripAppBasePath,
@@ -278,13 +282,18 @@ function extractScriptBody(scriptTag: string | null): string | null {
  *     user-controlled content reaches the HTML).
  *
  * A third directive, `script-src`, is emitted via `Content-Security-Policy-
- * Report-Only` rather than enforced. The framework injects one deterministic
- * inline script per process (the Sentry config block — its hash is computed
- * once at process startup from the resolved env vars). Templates additionally
- * render a theme-init inline script whose exact content varies by template
- * (default theme param, custom docs variant, etc.) and which is rendered by
- * React Router, not this handler, so its hash is not available here. Shipping
- * script-src as Report-Only surfaces violations without breaking template
+ * Report-Only` rather than enforced. The framework injects deterministic inline
+ * scripts (the Sentry config block, whose hash is computed once at process
+ * startup from the resolved env vars, and — when `GA_MEASUREMENT_ID` is set —
+ * the gtag config block, whose hash is derived from the same string
+ * `wrapWithAnalytics` embeds). It also loads Google Tag Manager / GA4 from
+ * `GA_CSP_SCRIPT_HOSTS`. All of those are listed here so the report-only policy
+ * reflects the code the framework itself injects instead of reporting a
+ * violation on every page load. Templates additionally render a theme-init
+ * inline script whose exact content varies by template (default theme param,
+ * custom docs variant, etc.) and which is rendered by React Router, not this
+ * handler, so its hash is not available here. Shipping script-src as
+ * Report-Only surfaces the remaining violations without breaking template
  * customisations; teams can graduate to enforcement once their hashes are
  * enumerated.
  *
@@ -306,13 +315,23 @@ function applyDocumentCsp(headers: Headers, sentryScript: string | null): void {
     );
   }
 
-  // script-src as Report-Only: list 'self' plus the hash for the Sentry config
-  // script the SSR handler injects into every HTML response (the hash is
-  // computed once from the resolved env vars at process startup). Template
-  // theme-init hashes are NOT included here — see function comment above.
+  // script-src as Report-Only: list 'self', the framework-injected inline
+  // script hashes (Sentry config + gtag config), and the Google Analytics /
+  // Tag Manager loader hosts. These are exactly the scripts the framework
+  // itself injects, so listing them keeps the report-only policy from flagging
+  // GA on every page load (and keeps it safe to graduate to enforcement).
+  // Template theme-init hashes are NOT included here — see function comment.
   const sentryBody = extractScriptBody(sentryScript);
   const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;
-  const scriptSrcTokens = ["'self'", ...(sentryHash ? [sentryHash] : [])];
+  const gaInlineBody = getGaInlineConfigScriptBody();
+  const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;
+  const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];
+  const scriptSrcTokens = [
+    "'self'",
+    ...(sentryHash ? [sentryHash] : []),
+    ...(gaHash ? [gaHash] : []),
+    ...gaHosts,
+  ];
   const scriptSrc = `script-src ${scriptSrcTokens.join(" ")}`;
 
   const existingRo = headers.get("content-security-policy-report-only") ?? "";

package/corpus/templates/analytics/AGENTS.md

@@ -107,6 +107,27 @@ details live in `.agents/skills/`.
   `@sparticuz/chromium-min` in serverless runtimes; set
   `DASHBOARD_REPORT_CHROMIUM_PACK_URL` only when overriding the default
   Chromium pack location.
+- Analytics alert rules live in SQL via the `analytics-alert-rules` actions.
+  Use `save-analytics-alert-rule`, `list-analytics-alert-rules`,
+  `delete-analytics-alert-rule`, and `run-analytics-alerts`; do not hardcode
+  one-off alert checks in product code. Rules are generic over first-party
+  analytics events: set `eventName` for an exact event name, then filter on
+  columns like `event_name`, `app`, `template`, `user_key`, `session_id`,
+  `path`, or nested JSON fields like `properties.stage` and
+  `context.referrer`. `thresholdMode: "event_count"` counts matching events;
+  `thresholdMode: "distinct_count"` counts unique values from `distinctBy`.
+  Alert notifications use the shared notification channel registry, so
+  `channels` can include `inbox`, `email`, `slack`, `webhook`, or any custom
+  registered channel. Configure Slack with `NOTIFICATIONS_SLACK_WEBHOOK_URL`
+  and optional `NOTIFICATIONS_SLACK_WEBHOOK_AUTH`; configure email with
+  `NOTIFICATIONS_EMAIL_CHANNEL=1`, existing `RESEND_API_KEY` or
+  `SENDGRID_API_KEY` plus `EMAIL_FROM`, and pass per-rule `emailRecipients` or
+  the fallback `NOTIFICATIONS_EMAIL_RECIPIENTS`.
+  Netlify builds emit an alert cron trigger plus background worker from
+  `scripts/emit-netlify-dashboard-report-cron.ts` every five minutes; long-lived
+  runtimes use the in-process scheduler unless `ANALYTICS_ALERT_JOBS=0` is set.
+  External cron callers can POST `/api/analytics-alerts/run` with
+  `Authorization: Bearer $ANALYTICS_ALERTS_CRON_SECRET`.
 
 ## Application State
 

package/corpus/templates/analytics/README.md

@@ -0,0 +1,35 @@
+# Analytics
+
+An open-source, agent-native alternative to Amplitude, Mixpanel, and Looker. Ask
+analytics questions in plain English and get charts, dashboards, and re-runnable
+investigations back — you own the code, the queries, and the data.
+
+**Live app: [analytics.agent-native.com](https://analytics.agent-native.com)**
+
+The agent connects to your data, writes and validates the SQL for you, and
+renders the answer as a chart, table, metric, or saved dashboard panel. Anything
+you can do in the UI, the agent can do through the same actions.
+
+## Features
+
+- Ask data questions in plain English and get charts, tables, or metrics back.
+- Connect BigQuery, GA4, Mixpanel, Amplitude, PostHog, HubSpot, Jira, and more,
+  plus a built-in first-party event collector.
+- Build reusable SQL dashboards with filters, saved views, and parametric queries.
+- Save ad-hoc analyses as re-runnable investigations with question, instructions,
+  and findings.
+- Maintain a living data dictionary so the agent uses real warehouse column names.
+- Share dashboards per-user or per-org with viewer / editor / admin roles.
+
+## Develop locally
+
+Scaffold your own copy and run it:
+
+```bash
+npx @agent-native/core@latest create my-analytics --standalone --template analytics
+cd my-analytics
+pnpm install
+pnpm dev
+```
+
+Full docs: [agent-native.com/docs/template-analytics](https://agent-native.com/docs/template-analytics).

package/corpus/templates/analytics/actions/delete-analytics-alert-rule.ts

@@ -0,0 +1,23 @@
+import { defineAction } from "@agent-native/core";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+import { z } from "zod";
+
+import { deleteAnalyticsAlertRule } from "../server/lib/analytics-alerts";
+
+export default defineAction({
+  description: "Delete a reusable first-party analytics alert rule.",
+  schema: z.object({
+    id: z.string().describe("Alert rule ID"),
+  }),
+  http: { method: "POST" },
+  run: async ({ id }) => {
+    const email = getRequestUserEmail();
+    if (!email) throw new Error("no authenticated user");
+    const orgId = getRequestOrgId() || null;
+    await deleteAnalyticsAlertRule(id, { email, orgId });
+    return { ok: true };
+  },
+});