@agent-native/core 0.84.21 → 0.84.22

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2043
-- template files: 4941
+- template files: 4962

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @agent-native/core
 
+## 0.84.22
+
+### Patch Changes
+
+- 72d6a3e: Add built-in Slack webhook and email notification channels, keep chat status visible through auto-continuation handoffs, and make guided-question option values authoritative in follow-up context.
+- 72d6a3e: Send both Builder upload compression-skip query params for compatibility with the production upload API rollout.
+- 72d6a3e: Make the document Report-Only script-src CSP account for the framework-injected Google Analytics / Tag Manager loader and inline gtag config script, so GA no longer triggers a CSP violation on every page load (it was Report-Only, so GA was never actually blocked) and the policy stays safe to graduate to enforcement.
+
 ## 0.84.21
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.84.21",
+  "version": "0.84.22",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/client/AssistantChat.tsx

@@ -233,6 +233,7 @@ const PENDING_SELECTION_KEY = "pending-selection-context";
 const ACTIVE_RUN_CLEAR_TIMEOUT_MS = 5_000;
 const ACTIVE_RUN_STUCK_THRESHOLD_MS = 90_000;
 const ACTIVE_RUN_POLL_INTERVAL_MS = 150;
+const AUTO_RESUME_STATUS_TIMEOUT_MS = 30_000;
 // How long a single activity (model call, tool prep, long tool) must stay
 // in-flight before its label is surfaced in the running indicator. Below this
 // the indicator stays a steady "Thinking" so normal fast turns don't flicker
@@ -1410,6 +1411,7 @@ const AssistantChatInner = forwardRef<
   // True during the 250ms continuation window and startup of the next chunk
   // (adapter's auto-continue delay before POSTing the next chunk).
   const [isAutoResuming, setIsAutoResuming] = useState(false);
+  const autoResumeTimerRef = useRef<number | null>(null);
   const [optimisticRunning, setOptimisticRunning] = useState(false);
   const [runningActivityLabel, setRunningActivityLabel] = useState<
     string | null
@@ -2491,20 +2493,41 @@ const AssistantChatInner = forwardRef<
     const handler = (e: Event) => {
       const detail = (e as CustomEvent).detail as { tabId?: string };
       if (tabId && detail?.tabId && detail.tabId !== tabId) return;
+      if (autoResumeTimerRef.current !== null) {
+        window.clearTimeout(autoResumeTimerRef.current);
+      }
       setIsAutoResuming(true);
+      autoResumeTimerRef.current = window.setTimeout(() => {
+        autoResumeTimerRef.current = null;
+        setIsAutoResuming(false);
+      }, AUTO_RESUME_STATUS_TIMEOUT_MS);
     };
     window.addEventListener("agent-chat:auto-continue", handler);
-    return () =>
+    return () => {
+      if (autoResumeTimerRef.current !== null) {
+        window.clearTimeout(autoResumeTimerRef.current);
+        autoResumeTimerRef.current = null;
+      }
       window.removeEventListener("agent-chat:auto-continue", handler);
+    };
   }, [tabId]);
 
-  // Clear auto-resume state when the run stops.
+  // Clear auto-resume once the next chunk has visibly started or the user stops.
+  // Do not clear solely because `isRunning` is false: auto-resume intentionally
+  // covers that between-chunk gap so the chat never looks idle while work is
+  // still scheduled.
   useEffect(() => {
-    if (!isRunning) {
+    if (isRunning || forceStopped) {
+      if (autoResumeTimerRef.current !== null) {
+        window.clearTimeout(autoResumeTimerRef.current);
+        autoResumeTimerRef.current = null;
+      }
       setIsAutoResuming(false);
+    }
+    if (!isRunning && !isAutoResuming) {
       resetRunningActivity();
     }
-  }, [isRunning, resetRunningActivity]);
+  }, [forceStopped, isAutoResuming, isRunning, resetRunningActivity]);
 
   // Auto-dequeue: when the agent is idle, send the next queued message. This
   // intentionally does not depend on observing the running -> idle transition:

package/corpus/core/src/client/guided-questions.tsx

@@ -150,6 +150,16 @@ export function formatGuidedAnswersForAgent(
     .join("\n");
 }
 
+function defaultGuidedSubmitContext(formattedAnswers: string): string {
+  return [
+    "The user answered the guided questions.",
+    "Use the selected option values below as authoritative. If an answer includes exact ids, file names, or action instructions, follow those exact details instead of inferring them.",
+    "",
+    "Answers:",
+    formattedAnswers,
+  ].join("\n");
+}
+
 /** A single option for {@link askUserQuestion}. Mirrors the agent `ask-question`
  *  tool and Claude Code's AskUserQuestion option shape. */
 export interface AskUserQuestionOption {
@@ -1080,12 +1090,7 @@ export function useGuidedQuestionFlow({
       const resolvedSubmitMessage = payload?.submitMessage ?? submitMessage;
       const context =
         buildSubmitContext?.({ answers, formattedAnswers }) ??
-        [
-          "The user answered the pre-generation questions.",
-          "",
-          "Answers:",
-          formattedAnswers,
-        ].join("\n");
+        defaultGuidedSubmitContext(formattedAnswers);
       sendToAgentChat({
         message: resolvedSubmitMessage,
         context,

package/corpus/core/src/client/tool-display.ts

@@ -1,6 +1,14 @@
+const TOOL_DISPLAY_NAMES: Record<string, string> = {
+  "delete-file": "delete screen",
+  "get-design-snapshot": "get screen snapshot",
+  "edit-design": "edit screen",
+};
+
 export function humanizeToolName(toolName: string | undefined): string {
   const raw = (toolName ?? "").trim();
   if (!raw) return "tool";
+  const displayName = TOOL_DISPLAY_NAMES[raw];
+  if (displayName) return displayName;
 
   let name = raw;
   if (name.startsWith("mcp__")) {

package/corpus/core/src/file-upload/builder.ts

@@ -44,6 +44,11 @@ function fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {
   );
 }
 
+function setSkipCompressionQueryParams(url: URL): void {
+  url.searchParams.set("skipCompressionWait", "true");
+  url.searchParams.set("skipCompression", "true");
+}
+
 async function assertOk(res: Response, label: string): Promise<void> {
   if (!res.ok) {
     const body = await res.text().catch(() => "");
@@ -154,7 +159,7 @@ async function completeBuilderUpload(
   const host = builderUploadHost();
   const url = new URL("/api/v1/upload/complete", host);
   if (options?.skipCompressionWait) {
-    url.searchParams.set("skipCompressionWait", "true");
+    setSkipCompressionQueryParams(url);
   }
   const res = await fetchWithTimeout(url.toString(), {
     method: "POST",
@@ -255,7 +260,7 @@ export const builderFileUploadProvider: FileUploadProvider = {
     const url = new URL("/api/v1/upload", builderUploadHost());
     if (filename) url.searchParams.set("name", filename);
     if (input.skipCompressionWait) {
-      url.searchParams.set("skipCompressionWait", "true");
+      setSkipCompressionQueryParams(url);
     }
 
     const response = await uploadSmallFile(url, {

package/corpus/core/src/notifications/channels.ts

@@ -10,6 +10,16 @@
  *                              value never enters the agent context.
  * NOTIFICATIONS_WEBHOOK_AUTH → optional `Authorization` header value (also
  *                              supports `${keys.NAME}`).
+ * NOTIFICATIONS_SLACK_WEBHOOK_URL
+ *                            → POST notifications to a Slack incoming webhook.
+ *                              Supports `${keys.NAME}` substitution.
+ * NOTIFICATIONS_EMAIL_CHANNEL=1
+ *                            → enable the built-in email channel for
+ *                              per-notification recipients.
+ * NOTIFICATIONS_EMAIL_RECIPIENTS
+ *                            → comma-separated fallback recipients for email
+ *                              notifications that do not pass
+ *                              `metadata.emailRecipients`.
  */
 
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
@@ -18,6 +28,7 @@ import {
   validateUrlAllowlist,
   getKeyAllowlist,
 } from "../secrets/substitution.js";
+import { sendEmail } from "../server/email.js";
 import { registerNotificationChannel } from "./registry.js";
 import type { NotificationChannel } from "./types.js";
 
@@ -31,6 +42,16 @@ export function registerBuiltinNotificationChannels(): void {
   if (url) {
     registerNotificationChannel(createWebhookChannel(url));
   }
+
+  const slackUrl = process.env.NOTIFICATIONS_SLACK_WEBHOOK_URL;
+  if (slackUrl) {
+    registerNotificationChannel(createSlackWebhookChannel(slackUrl));
+  }
+
+  const emailRecipients = process.env.NOTIFICATIONS_EMAIL_RECIPIENTS?.trim();
+  if (process.env.NOTIFICATIONS_EMAIL_CHANNEL === "1" || emailRecipients) {
+    registerNotificationChannel(createEmailChannel());
+  }
 }
 
 function createWebhookChannel(urlTemplate: string): NotificationChannel {
@@ -38,47 +59,12 @@ function createWebhookChannel(urlTemplate: string): NotificationChannel {
   return {
     name: "webhook",
     async deliver(input, meta) {
-      // Resolve `${keys.NAME}` references against the owner's user-scope
-      // secrets. Missing keys throw — the error surfaces in logs and the
-      // channel is marked un-delivered, but other channels still run.
-      const { resolved: url } = await resolveKeyReferences(
+      const { url, headers } = await resolveWebhookRequest(
         urlTemplate,
-        "user",
+        authTemplate,
         meta.owner,
+        "webhook",
       );
-      const headers: Record<string, string> = {
-        "Content-Type": "application/json",
-      };
-      if (authTemplate) {
-        const { resolved: auth } = await resolveKeyReferences(
-          authTemplate,
-          "user",
-          meta.owner,
-        );
-        headers.Authorization = auth;
-      }
-
-      // If the user set an allowlist on a referenced key, enforce it here —
-      // origin-level check, same rule the automations fetch-tool applies.
-      const keyNames = Array.from(
-        new Set(
-          Array.from(
-            urlTemplate.matchAll(/\$\{keys\.([A-Za-z0-9_-]+)\}/g),
-            (m) => m[1],
-          ),
-        ),
-      );
-      const allowlists = await Promise.all(
-        keyNames.map((name) => getKeyAllowlist(name, "user", meta.owner)),
-      );
-      keyNames.forEach((name, i) => {
-        if (!validateUrlAllowlist(url, allowlists[i])) {
-          throw new Error(
-            `[notifications] webhook URL ${new URL(url).origin} is not in the allowlist for key "${name}"`,
-          );
-        }
-      });
-
       const res = await ssrfSafeFetch(
         url,
         {
@@ -106,6 +92,217 @@ function createWebhookChannel(urlTemplate: string): NotificationChannel {
   };
 }
 
+function createSlackWebhookChannel(urlTemplate: string): NotificationChannel {
+  const authTemplate = process.env.NOTIFICATIONS_SLACK_WEBHOOK_AUTH;
+  return {
+    name: "slack",
+    async deliver(input, meta) {
+      const { url, headers } = await resolveWebhookRequest(
+        urlTemplate,
+        authTemplate,
+        meta.owner,
+        "Slack webhook",
+      );
+      const res = await ssrfSafeFetch(
+        url,
+        {
+          method: "POST",
+          headers,
+          body: JSON.stringify({
+            text: slackText(input.severity, input.title, input.body),
+            blocks: [
+              {
+                type: "section",
+                text: {
+                  type: "mrkdwn",
+                  text: `*${escapeSlack(input.title)}*`,
+                },
+              },
+              ...(input.body
+                ? [
+                    {
+                      type: "section",
+                      text: {
+                        type: "mrkdwn",
+                        text: escapeSlack(input.body),
+                      },
+                    },
+                  ]
+                : []),
+              {
+                type: "context",
+                elements: [
+                  {
+                    type: "mrkdwn",
+                    text: `Severity: \`${input.severity}\`  Owner: ${escapeSlack(meta.owner)}`,
+                  },
+                ],
+              },
+            ],
+          }),
+        },
+        { maxRedirects: 3 },
+      );
+      if (!res.ok) {
+        throw new Error(
+          `[notifications] Slack webhook ${new URL(url).origin} returned ${res.status}${
+            (await readErrorSnippet(res)) || ""
+          }`,
+        );
+      }
+    },
+  };
+}
+
+function createEmailChannel(): NotificationChannel {
+  return {
+    name: "email",
+    async deliver(input) {
+      const recipients = notificationEmailRecipients(input.metadata);
+      if (recipients.length === 0) return;
+      const subject =
+        typeof input.metadata?.emailSubject === "string" &&
+        input.metadata.emailSubject.trim()
+          ? input.metadata.emailSubject.trim()
+          : `[${input.severity}] ${input.title}`;
+      const metadata = scrubEmailMetadata(input.metadata);
+      const metadataText = metadata
+        ? `\n\nMetadata:\n${JSON.stringify(metadata, null, 2)}`
+        : "";
+      const text = `${input.title}\n\n${input.body ?? ""}${metadataText}`;
+      const html = [
+        `<p><strong>${escapeHtml(input.title)}</strong></p>`,
+        input.body ? `<p>${escapeHtml(input.body)}</p>` : "",
+        metadata
+          ? `<pre>${escapeHtml(JSON.stringify(metadata, null, 2))}</pre>`
+          : "",
+      ].join("");
+
+      await Promise.all(
+        recipients.map((to) =>
+          sendEmail({
+            to,
+            subject,
+            text,
+            html,
+          }),
+        ),
+      );
+    },
+  };
+}
+
+async function resolveWebhookRequest(
+  urlTemplate: string,
+  authTemplate: string | undefined,
+  owner: string,
+  label: string,
+): Promise<{ url: string; headers: Record<string, string> }> {
+  // Resolve `${keys.NAME}` references against the owner's user-scope secrets.
+  // Missing keys throw — the error surfaces in logs and the channel is marked
+  // un-delivered, but other channels still run.
+  const { resolved: url } = await resolveKeyReferences(
+    urlTemplate,
+    "user",
+    owner,
+  );
+  const headers: Record<string, string> = {
+    "Content-Type": "application/json",
+  };
+  if (authTemplate) {
+    const { resolved: auth } = await resolveKeyReferences(
+      authTemplate,
+      "user",
+      owner,
+    );
+    headers.Authorization = auth;
+  }
+
+  // If the user set an allowlist on a referenced key, enforce it here —
+  // origin-level check, same rule the automations fetch-tool applies.
+  const keyNames = Array.from(
+    new Set(
+      Array.from(urlTemplate.matchAll(/\$\{keys\.([A-Za-z0-9_-]+)\}/g), (m) =>
+        String(m[1]),
+      ),
+    ),
+  );
+  const allowlists = await Promise.all(
+    keyNames.map((name) => getKeyAllowlist(name, "user", owner)),
+  );
+  keyNames.forEach((name, i) => {
+    if (!validateUrlAllowlist(url, allowlists[i])) {
+      throw new Error(
+        `[notifications] ${label} URL ${new URL(url).origin} is not in the allowlist for key "${name}"`,
+      );
+    }
+  });
+  return { url, headers };
+}
+
+function notificationEmailRecipients(
+  metadata: Record<string, unknown> | undefined,
+): string[] {
+  const fromMetadata = stringArray(metadata?.emailRecipients);
+  const fromEnv = commaList(process.env.NOTIFICATIONS_EMAIL_RECIPIENTS);
+  const seen = new Set<string>();
+  const recipients: string[] = [];
+  for (const raw of [...fromMetadata, ...fromEnv]) {
+    const email = raw.trim().toLowerCase();
+    if (!email || seen.has(email)) continue;
+    seen.add(email);
+    recipients.push(email);
+  }
+  return recipients;
+}
+
+function stringArray(value: unknown): string[] {
+  if (!Array.isArray(value)) return [];
+  return value.filter((item): item is string => typeof item === "string");
+}
+
+function commaList(value: string | undefined): string[] {
+  return value
+    ? value
+        .split(",")
+        .map((item) => item.trim())
+        .filter(Boolean)
+    : [];
+}
+
+function scrubEmailMetadata(
+  metadata: Record<string, unknown> | undefined,
+): Record<string, unknown> | null {
+  if (!metadata) return null;
+  const entries = Object.entries(metadata).filter(
+    ([key]) => key !== "emailRecipients" && key !== "emailSubject",
+  );
+  return entries.length ? Object.fromEntries(entries) : null;
+}
+
+function slackText(
+  severity: string,
+  title: string,
+  body: string | undefined,
+): string {
+  return `[${severity}] ${title}${body ? `\n${body}` : ""}`;
+}
+
+function escapeSlack(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;");
+}
+
 /**
  * Read up to ~1 KB from the body for error context. Streams chunks so a
  * misbehaving endpoint returning a large error page doesn't pin that whole

package/corpus/core/src/server/analytics.ts

@@ -39,14 +39,30 @@ function getGaMeasurementId(): string | null {
   );
 }
 
-function getGaScript(): string | null {
+/**
+ * Script hosts the injected GA loader pulls executable code from. Google Tag
+ * Manager serves `gtag/js`, and GA4 can lazy-load additional collectors from
+ * `www.google-analytics.com`. These must be listed in the document `script-src`
+ * so the CSP reflects the code the framework itself injects (see
+ * `applyDocumentCsp` in `ssr-handler.ts`).
+ */
+export const GA_CSP_SCRIPT_HOSTS = [
+  "https://www.googletagmanager.com",
+  "https://www.google-analytics.com",
+] as const;
+
+/**
+ * The exact JS body (no surrounding `<script>` tags) of the inline gtag config
+ * block injected next to the gtag.js loader. Returned so the SSR handler can
+ * hash it for the `script-src` CSP directive — the hash must be computed from
+ * the identical string that `getGaScript()` embeds, so both call this helper.
+ * Returns `null` when GA is not configured.
+ */
+export function getGaInlineConfigScriptBody(): string | null {
   const id = getGaMeasurementId();
   if (!id) return null;
-  const srcId = encodeURIComponent(id);
   const jsId = JSON.stringify(id);
   return (
-    `<script async src="https://www.googletagmanager.com/gtag/js?id=${srcId}"></script>` +
-    `<script>` +
     `window.dataLayer=window.dataLayer||[];` +
     `function gtag(){dataLayer.push(arguments);}` +
     `gtag('js',new Date());` +
@@ -54,8 +70,18 @@ function getGaScript(): string | null {
     `if(typeof sessionStorage!=='undefined'&&sessionStorage.getItem('__an_signin')){` +
     `sessionStorage.removeItem('__an_signin');` +
     `gtag('event','sign_in');` +
-    `}` +
-    `</script>`
+    `}`
+  );
+}
+
+function getGaScript(): string | null {
+  const id = getGaMeasurementId();
+  if (!id) return null;
+  const srcId = encodeURIComponent(id);
+  const inlineBody = getGaInlineConfigScriptBody();
+  return (
+    `<script async src="https://www.googletagmanager.com/gtag/js?id=${srcId}"></script>` +
+    `<script>${inlineBody}</script>`
   );
 }
 

package/corpus/core/src/server/ssr-handler.ts

@@ -30,6 +30,10 @@ import {
   AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,
   withAgentNativeSocialImageCacheBuster,
 } from "../shared/social-meta.js";
+import {
+  GA_CSP_SCRIPT_HOSTS,
+  getGaInlineConfigScriptBody,
+} from "./analytics.js";
 import {
   getAppBasePathFromViteEnv,
   stripAppBasePath as canonicalStripAppBasePath,
@@ -278,13 +282,18 @@ function extractScriptBody(scriptTag: string | null): string | null {
  *     user-controlled content reaches the HTML).
  *
  * A third directive, `script-src`, is emitted via `Content-Security-Policy-
- * Report-Only` rather than enforced. The framework injects one deterministic
- * inline script per process (the Sentry config block — its hash is computed
- * once at process startup from the resolved env vars). Templates additionally
- * render a theme-init inline script whose exact content varies by template
- * (default theme param, custom docs variant, etc.) and which is rendered by
- * React Router, not this handler, so its hash is not available here. Shipping
- * script-src as Report-Only surfaces violations without breaking template
+ * Report-Only` rather than enforced. The framework injects deterministic inline
+ * scripts (the Sentry config block, whose hash is computed once at process
+ * startup from the resolved env vars, and — when `GA_MEASUREMENT_ID` is set —
+ * the gtag config block, whose hash is derived from the same string
+ * `wrapWithAnalytics` embeds). It also loads Google Tag Manager / GA4 from
+ * `GA_CSP_SCRIPT_HOSTS`. All of those are listed here so the report-only policy
+ * reflects the code the framework itself injects instead of reporting a
+ * violation on every page load. Templates additionally render a theme-init
+ * inline script whose exact content varies by template (default theme param,
+ * custom docs variant, etc.) and which is rendered by React Router, not this
+ * handler, so its hash is not available here. Shipping script-src as
+ * Report-Only surfaces the remaining violations without breaking template
  * customisations; teams can graduate to enforcement once their hashes are
  * enumerated.
  *
@@ -306,13 +315,23 @@ function applyDocumentCsp(headers: Headers, sentryScript: string | null): void {
     );
   }
 
-  // script-src as Report-Only: list 'self' plus the hash for the Sentry config
-  // script the SSR handler injects into every HTML response (the hash is
-  // computed once from the resolved env vars at process startup). Template
-  // theme-init hashes are NOT included here — see function comment above.
+  // script-src as Report-Only: list 'self', the framework-injected inline
+  // script hashes (Sentry config + gtag config), and the Google Analytics /
+  // Tag Manager loader hosts. These are exactly the scripts the framework
+  // itself injects, so listing them keeps the report-only policy from flagging
+  // GA on every page load (and keeps it safe to graduate to enforcement).
+  // Template theme-init hashes are NOT included here — see function comment.
   const sentryBody = extractScriptBody(sentryScript);
   const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;
-  const scriptSrcTokens = ["'self'", ...(sentryHash ? [sentryHash] : [])];
+  const gaInlineBody = getGaInlineConfigScriptBody();
+  const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;
+  const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];
+  const scriptSrcTokens = [
+    "'self'",
+    ...(sentryHash ? [sentryHash] : []),
+    ...(gaHash ? [gaHash] : []),
+    ...gaHosts,
+  ];
   const scriptSrc = `script-src ${scriptSrcTokens.join(" ")}`;
 
   const existingRo = headers.get("content-security-policy-report-only") ?? "";

package/corpus/templates/analytics/AGENTS.md

@@ -107,6 +107,27 @@ details live in `.agents/skills/`.
   `@sparticuz/chromium-min` in serverless runtimes; set
   `DASHBOARD_REPORT_CHROMIUM_PACK_URL` only when overriding the default
   Chromium pack location.
+- Analytics alert rules live in SQL via the `analytics-alert-rules` actions.
+  Use `save-analytics-alert-rule`, `list-analytics-alert-rules`,
+  `delete-analytics-alert-rule`, and `run-analytics-alerts`; do not hardcode
+  one-off alert checks in product code. Rules are generic over first-party
+  analytics events: set `eventName` for an exact event name, then filter on
+  columns like `event_name`, `app`, `template`, `user_key`, `session_id`,
+  `path`, or nested JSON fields like `properties.stage` and
+  `context.referrer`. `thresholdMode: "event_count"` counts matching events;
+  `thresholdMode: "distinct_count"` counts unique values from `distinctBy`.
+  Alert notifications use the shared notification channel registry, so
+  `channels` can include `inbox`, `email`, `slack`, `webhook`, or any custom
+  registered channel. Configure Slack with `NOTIFICATIONS_SLACK_WEBHOOK_URL`
+  and optional `NOTIFICATIONS_SLACK_WEBHOOK_AUTH`; configure email with
+  `NOTIFICATIONS_EMAIL_CHANNEL=1`, existing `RESEND_API_KEY` or
+  `SENDGRID_API_KEY` plus `EMAIL_FROM`, and pass per-rule `emailRecipients` or
+  the fallback `NOTIFICATIONS_EMAIL_RECIPIENTS`.
+  Netlify builds emit an alert cron trigger plus background worker from
+  `scripts/emit-netlify-dashboard-report-cron.ts` every five minutes; long-lived
+  runtimes use the in-process scheduler unless `ANALYTICS_ALERT_JOBS=0` is set.
+  External cron callers can POST `/api/analytics-alerts/run` with
+  `Authorization: Bearer $ANALYTICS_ALERTS_CRON_SECRET`.
 
 ## Application State
 

package/corpus/templates/analytics/README.md

@@ -0,0 +1,35 @@
+# Analytics
+
+An open-source, agent-native alternative to Amplitude, Mixpanel, and Looker. Ask
+analytics questions in plain English and get charts, dashboards, and re-runnable
+investigations back — you own the code, the queries, and the data.
+
+**Live app: [analytics.agent-native.com](https://analytics.agent-native.com)**
+
+The agent connects to your data, writes and validates the SQL for you, and
+renders the answer as a chart, table, metric, or saved dashboard panel. Anything
+you can do in the UI, the agent can do through the same actions.
+
+## Features
+
+- Ask data questions in plain English and get charts, tables, or metrics back.
+- Connect BigQuery, GA4, Mixpanel, Amplitude, PostHog, HubSpot, Jira, and more,
+  plus a built-in first-party event collector.
+- Build reusable SQL dashboards with filters, saved views, and parametric queries.
+- Save ad-hoc analyses as re-runnable investigations with question, instructions,
+  and findings.
+- Maintain a living data dictionary so the agent uses real warehouse column names.
+- Share dashboards per-user or per-org with viewer / editor / admin roles.
+
+## Develop locally
+
+Scaffold your own copy and run it:
+
+```bash
+npx @agent-native/core@latest create my-analytics --standalone --template analytics
+cd my-analytics
+pnpm install
+pnpm dev
+```
+
+Full docs: [agent-native.com/docs/template-analytics](https://agent-native.com/docs/template-analytics).