@agent-native/core 0.84.21 → 0.84.23

package/corpus/core/src/server/ssr-handler.ts

@@ -30,6 +30,10 @@ import {
   AGENT_NATIVE_SOCIAL_IMAGE_WIDTH,
   withAgentNativeSocialImageCacheBuster,
 } from "../shared/social-meta.js";
+import {
+  GA_CSP_SCRIPT_HOSTS,
+  getGaInlineConfigScriptBody,
+} from "./analytics.js";
 import {
   getAppBasePathFromViteEnv,
   stripAppBasePath as canonicalStripAppBasePath,
@@ -278,13 +282,18 @@ function extractScriptBody(scriptTag: string | null): string | null {
  *     user-controlled content reaches the HTML).
  *
  * A third directive, `script-src`, is emitted via `Content-Security-Policy-
- * Report-Only` rather than enforced. The framework injects one deterministic
- * inline script per process (the Sentry config block — its hash is computed
- * once at process startup from the resolved env vars). Templates additionally
- * render a theme-init inline script whose exact content varies by template
- * (default theme param, custom docs variant, etc.) and which is rendered by
- * React Router, not this handler, so its hash is not available here. Shipping
- * script-src as Report-Only surfaces violations without breaking template
+ * Report-Only` rather than enforced. The framework injects deterministic inline
+ * scripts (the Sentry config block, whose hash is computed once at process
+ * startup from the resolved env vars, and — when `GA_MEASUREMENT_ID` is set —
+ * the gtag config block, whose hash is derived from the same string
+ * `wrapWithAnalytics` embeds). It also loads Google Tag Manager / GA4 from
+ * `GA_CSP_SCRIPT_HOSTS`. All of those are listed here so the report-only policy
+ * reflects the code the framework itself injects instead of reporting a
+ * violation on every page load. Templates additionally render a theme-init
+ * inline script whose exact content varies by template (default theme param,
+ * custom docs variant, etc.) and which is rendered by React Router, not this
+ * handler, so its hash is not available here. Shipping script-src as
+ * Report-Only surfaces the remaining violations without breaking template
  * customisations; teams can graduate to enforcement once their hashes are
  * enumerated.
  *
@@ -306,13 +315,23 @@ function applyDocumentCsp(headers: Headers, sentryScript: string | null): void {
     );
   }
 
-  // script-src as Report-Only: list 'self' plus the hash for the Sentry config
-  // script the SSR handler injects into every HTML response (the hash is
-  // computed once from the resolved env vars at process startup). Template
-  // theme-init hashes are NOT included here — see function comment above.
+  // script-src as Report-Only: list 'self', the framework-injected inline
+  // script hashes (Sentry config + gtag config), and the Google Analytics /
+  // Tag Manager loader hosts. These are exactly the scripts the framework
+  // itself injects, so listing them keeps the report-only policy from flagging
+  // GA on every page load (and keeps it safe to graduate to enforcement).
+  // Template theme-init hashes are NOT included here — see function comment.
   const sentryBody = extractScriptBody(sentryScript);
   const sentryHash = sentryBody ? computeInlineScriptHash(sentryBody) : null;
-  const scriptSrcTokens = ["'self'", ...(sentryHash ? [sentryHash] : [])];
+  const gaInlineBody = getGaInlineConfigScriptBody();
+  const gaHash = gaInlineBody ? computeInlineScriptHash(gaInlineBody) : null;
+  const gaHosts = gaInlineBody ? [...GA_CSP_SCRIPT_HOSTS] : [];
+  const scriptSrcTokens = [
+    "'self'",
+    ...(sentryHash ? [sentryHash] : []),
+    ...(gaHash ? [gaHash] : []),
+    ...gaHosts,
+  ];
   const scriptSrc = `script-src ${scriptSrcTokens.join(" ")}`;
 
   const existingRo = headers.get("content-security-policy-report-only") ?? "";

package/corpus/core/src/templates/default/.agents/skills/frontend-design/SKILL.md

@@ -53,6 +53,8 @@ Default to Apple/Linear-level restraint: make the primary workflow obvious, then
 - **Visual assets**: Websites, games, and object-focused pages need real or generated media when images help users understand the subject.
 - **Responsive fit**: Text must not overflow buttons, cards, tabs, sidebars, or fixed-format tools. Use stable dimensions for boards, grids, toolbars, and counters.
 
+**Beat convergence, not just defaults.** You sample toward the "on-distribution" center, so naming what to avoid is not enough: every "don't" needs a "do", or you converge on the next safe option (ban Inter and you reach for Roboto; ban purple gradients and you reach for Space Grotesk + a teal accent on every screen). Commit to one named direction, pair any reference with the reason it fits ("Linear: the quiet confidence of its spacing" — a bare "Linear" collapses back to the average), and match implementation effort to the vision: maximalist wants elaborate motion and effects, minimal wants restraint and precise spacing. When building on an existing app, inspect its tokens/type/components first and treat any drift back to a default as a missing token to pin, not something to re-prompt.
+
 ## Agent-Native UI Rules
 
 - Agent-native apps use React, Vite, Tailwind CSS, shadcn/ui, and `@tabler/icons-react`.

package/corpus/core/src/templates/workspace-core/.agents/skills/frontend-design/SKILL.md

@@ -53,6 +53,8 @@ Default to Apple/Linear-level restraint: make the primary workflow obvious, then
 - **Visual assets**: Websites, games, and object-focused pages need real or generated media when images help users understand the subject.
 - **Responsive fit**: Text must not overflow buttons, cards, tabs, sidebars, or fixed-format tools. Use stable dimensions for boards, grids, toolbars, and counters.
 
+**Beat convergence, not just defaults.** You sample toward the "on-distribution" center, so naming what to avoid is not enough: every "don't" needs a "do", or you converge on the next safe option (ban Inter and you reach for Roboto; ban purple gradients and you reach for Space Grotesk + a teal accent on every screen). Commit to one named direction, pair any reference with the reason it fits ("Linear: the quiet confidence of its spacing" — a bare "Linear" collapses back to the average), and match implementation effort to the vision: maximalist wants elaborate motion and effects, minimal wants restraint and precise spacing. When building on an existing app, inspect its tokens/type/components first and treat any drift back to a default as a missing token to pin, not something to re-prompt.
+
 ## Agent-Native UI Rules
 
 - Agent-native apps use React, Vite, Tailwind CSS, shadcn/ui, and `@tabler/icons-react`.

package/corpus/templates/analytics/.agents/skills/frontend-design/SKILL.md

@@ -53,6 +53,8 @@ Default to Apple/Linear-level restraint: make the primary workflow obvious, then
 - **Visual assets**: Websites, games, and object-focused pages need real or generated media when images help users understand the subject.
 - **Responsive fit**: Text must not overflow buttons, cards, tabs, sidebars, or fixed-format tools. Use stable dimensions for boards, grids, toolbars, and counters.
 
+**Beat convergence, not just defaults.** You sample toward the "on-distribution" center, so naming what to avoid is not enough: every "don't" needs a "do", or you converge on the next safe option (ban Inter and you reach for Roboto; ban purple gradients and you reach for Space Grotesk + a teal accent on every screen). Commit to one named direction, pair any reference with the reason it fits ("Linear: the quiet confidence of its spacing" — a bare "Linear" collapses back to the average), and match implementation effort to the vision: maximalist wants elaborate motion and effects, minimal wants restraint and precise spacing. When building on an existing app, inspect its tokens/type/components first and treat any drift back to a default as a missing token to pin, not something to re-prompt.
+
 ## Agent-Native UI Rules
 
 - Agent-native apps use React, Vite, Tailwind CSS, shadcn/ui, and `@tabler/icons-react`.

package/corpus/templates/analytics/AGENTS.md

@@ -107,6 +107,27 @@ details live in `.agents/skills/`.
   `@sparticuz/chromium-min` in serverless runtimes; set
   `DASHBOARD_REPORT_CHROMIUM_PACK_URL` only when overriding the default
   Chromium pack location.
+- Analytics alert rules live in SQL via the `analytics-alert-rules` actions.
+  Use `save-analytics-alert-rule`, `list-analytics-alert-rules`,
+  `delete-analytics-alert-rule`, and `run-analytics-alerts`; do not hardcode
+  one-off alert checks in product code. Rules are generic over first-party
+  analytics events: set `eventName` for an exact event name, then filter on
+  columns like `event_name`, `app`, `template`, `user_key`, `session_id`,
+  `path`, or nested JSON fields like `properties.stage` and
+  `context.referrer`. `thresholdMode: "event_count"` counts matching events;
+  `thresholdMode: "distinct_count"` counts unique values from `distinctBy`.
+  Alert notifications use the shared notification channel registry, so
+  `channels` can include `inbox`, `email`, `slack`, `webhook`, or any custom
+  registered channel. Configure Slack with `NOTIFICATIONS_SLACK_WEBHOOK_URL`
+  and optional `NOTIFICATIONS_SLACK_WEBHOOK_AUTH`; configure email with
+  `NOTIFICATIONS_EMAIL_CHANNEL=1`, existing `RESEND_API_KEY` or
+  `SENDGRID_API_KEY` plus `EMAIL_FROM`, and pass per-rule `emailRecipients` or
+  the fallback `NOTIFICATIONS_EMAIL_RECIPIENTS`.
+  Netlify builds emit an alert cron trigger plus background worker from
+  `scripts/emit-netlify-dashboard-report-cron.ts` every five minutes; long-lived
+  runtimes use the in-process scheduler unless `ANALYTICS_ALERT_JOBS=0` is set.
+  External cron callers can POST `/api/analytics-alerts/run` with
+  `Authorization: Bearer $ANALYTICS_ALERTS_CRON_SECRET`.
 
 ## Application State
 

package/corpus/templates/analytics/README.md

@@ -0,0 +1,35 @@
+# Analytics
+
+An open-source, agent-native alternative to Amplitude, Mixpanel, and Looker. Ask
+analytics questions in plain English and get charts, dashboards, and re-runnable
+investigations back — you own the code, the queries, and the data.
+
+**Live app: [analytics.agent-native.com](https://analytics.agent-native.com)**
+
+The agent connects to your data, writes and validates the SQL for you, and
+renders the answer as a chart, table, metric, or saved dashboard panel. Anything
+you can do in the UI, the agent can do through the same actions.
+
+## Features
+
+- Ask data questions in plain English and get charts, tables, or metrics back.
+- Connect BigQuery, GA4, Mixpanel, Amplitude, PostHog, HubSpot, Jira, and more,
+  plus a built-in first-party event collector.
+- Build reusable SQL dashboards with filters, saved views, and parametric queries.
+- Save ad-hoc analyses as re-runnable investigations with question, instructions,
+  and findings.
+- Maintain a living data dictionary so the agent uses real warehouse column names.
+- Share dashboards per-user or per-org with viewer / editor / admin roles.
+
+## Develop locally
+
+Scaffold your own copy and run it:
+
+```bash
+npx @agent-native/core@latest create my-analytics --standalone --template analytics
+cd my-analytics
+pnpm install
+pnpm dev
+```
+
+Full docs: [agent-native.com/docs/template-analytics](https://agent-native.com/docs/template-analytics).

package/corpus/templates/analytics/actions/delete-analytics-alert-rule.ts

@@ -0,0 +1,23 @@
+import { defineAction } from "@agent-native/core";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+import { z } from "zod";
+
+import { deleteAnalyticsAlertRule } from "../server/lib/analytics-alerts";
+
+export default defineAction({
+  description: "Delete a reusable first-party analytics alert rule.",
+  schema: z.object({
+    id: z.string().describe("Alert rule ID"),
+  }),
+  http: { method: "POST" },
+  run: async ({ id }) => {
+    const email = getRequestUserEmail();
+    if (!email) throw new Error("no authenticated user");
+    const orgId = getRequestOrgId() || null;
+    await deleteAnalyticsAlertRule(id, { email, orgId });
+    return { ok: true };
+  },
+});

package/corpus/templates/analytics/actions/list-analytics-alert-rules.ts

@@ -0,0 +1,20 @@
+import { defineAction } from "@agent-native/core";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+import { z } from "zod";
+
+import { listAnalyticsAlertRules } from "../server/lib/analytics-alerts";
+
+export default defineAction({
+  description: "List reusable alert rules over first-party analytics events.",
+  schema: z.object({}),
+  http: { method: "GET" },
+  run: async () => {
+    const email = getRequestUserEmail();
+    if (!email) throw new Error("no authenticated user");
+    const orgId = getRequestOrgId() || null;
+    return listAnalyticsAlertRules({ email, orgId });
+  },
+});

package/corpus/templates/analytics/actions/run-analytics-alerts.ts

@@ -0,0 +1,23 @@
+import { defineAction } from "@agent-native/core";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+import { z } from "zod";
+
+import { runAnalyticsAlertsOnce } from "../server/jobs/analytics-alerts";
+
+export default defineAction({
+  description:
+    "Run one alert sweep for the current user's first-party analytics alert rules.",
+  schema: z.object({
+    limit: z.number().int().min(1).max(500).optional(),
+  }),
+  http: { method: "POST" },
+  run: async ({ limit }) => {
+    const email = getRequestUserEmail();
+    if (!email) throw new Error("no authenticated user");
+    const orgId = getRequestOrgId() || null;
+    return runAnalyticsAlertsOnce({ ownerEmail: email, orgId, limit });
+  },
+});

package/corpus/templates/analytics/actions/save-analytics-alert-rule.ts

@@ -0,0 +1,69 @@
+import { defineAction } from "@agent-native/core";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+import { z } from "zod";
+
+import { saveAnalyticsAlertRule } from "../server/lib/analytics-alerts";
+
+const filterSchema = z.object({
+  field: z
+    .string()
+    .describe(
+      "Analytics field path, e.g. event_name, app, template, properties.error_code, or context.url.",
+    ),
+  op: z
+    .enum(["equals", "not_equals", "contains", "in", "exists"])
+    .optional()
+    .describe("Filter operator; defaults to equals."),
+  value: z.unknown().optional().describe("Value to compare against."),
+});
+
+export default defineAction({
+  description:
+    "Create or update a reusable alert rule over first-party analytics events.",
+  schema: z.object({
+    id: z.string().optional().describe("Existing alert rule ID to update"),
+    name: z.string().describe("Human-readable alert name"),
+    description: z.string().optional(),
+    eventName: z
+      .string()
+      .optional()
+      .nullable()
+      .describe("Optional exact event name to target before filters run."),
+    filters: z
+      .array(filterSchema)
+      .optional()
+      .describe("Generic event filters evaluated over columns/properties."),
+    thresholdMode: z
+      .enum(["event_count", "distinct_count"])
+      .optional()
+      .describe("Count matching events or distinct values."),
+    distinctBy: z
+      .string()
+      .optional()
+      .nullable()
+      .describe("Field path used when thresholdMode is distinct_count."),
+    threshold: z.number().int().min(1),
+    windowMinutes: z.number().int().min(1).max(1440),
+    cooldownMinutes: z.number().int().min(0).max(1440).optional(),
+    severity: z.enum(["warning", "critical"]).optional(),
+    channels: z
+      .array(z.string())
+      .optional()
+      .describe("Notification channels, e.g. inbox, email, slack, webhook."),
+    emailRecipients: z
+      .array(z.string().email())
+      .optional()
+      .describe("Email recipients passed to the generic email channel."),
+    enabled: z.boolean().optional(),
+  }),
+  http: { method: "POST" },
+  run: async (args) => {
+    const email = getRequestUserEmail();
+    if (!email) throw new Error("no authenticated user");
+    const orgId = getRequestOrgId() || null;
+    return saveAnalyticsAlertRule(args, { email, orgId });
+  },
+});

package/corpus/templates/analytics/changelog/2026-07-01-analytics-can-alert-when-first-party-events-spike.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-07-01
+---
+
+Analytics can now notify inbox, email, Slack, or webhook channels when first-party events spike.

package/corpus/templates/analytics/changelog/2026-07-01-session-replays-play-back-in-production-instead-of-showing.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-01
+---
+
+Session replays now play back in production instead of showing a blank recording, because chunk downloads no longer rely on a manual gzip content-encoding that serverless hosts corrupted.

package/corpus/templates/analytics/netlify.toml

@@ -20,3 +20,6 @@ timeout = 75
 [functions.dashboard-report-sweep-background]
 timeout = 300
 memory = "2gb"
+
+[functions.analytics-alert-sweep-background]
+timeout = 120

package/corpus/templates/analytics/scripts/emit-netlify-dashboard-report-cron.ts

@@ -12,6 +12,10 @@ const SCHEDULED_NAME = "dashboard-report-cron";
 const WORKER_NAME = "dashboard-report-sweep-background";
 const ROUTE_PATH = "/api/dashboard-reports/run";
 const SCHEDULE = "*/15 * * * *";
+const ALERT_SCHEDULED_NAME = "analytics-alert-cron";
+const ALERT_WORKER_NAME = "analytics-alert-sweep-background";
+const ALERT_ROUTE_PATH = "/api/analytics-alerts/run";
+const ALERT_SCHEDULE = "*/5 * * * *";
 
 function ensureDir(dir: string) {
   mkdirSync(dir, { recursive: true });
@@ -116,6 +120,122 @@ export const config = {
   writeFileSync(path.join(dest, `${WORKER_NAME}.mjs`), source);
 }
 
+function emitAlertScheduledTrigger(token: string) {
+  const dest = path.join(FUNCTIONS_DIR, ALERT_SCHEDULED_NAME);
+  rmSync(dest, { recursive: true, force: true });
+  ensureDir(dest);
+
+  const source = `const WORKER_PATH = "/.netlify/functions/${ALERT_WORKER_NAME}";
+const CRON_TOKEN = ${JSON.stringify(token)};
+
+function siteOrigin(request) {
+  const configured = process.env.URL || process.env.DEPLOY_URL;
+  if (configured) return configured;
+  const url = new URL(request.url);
+  return url.origin;
+}
+
+async function readScheduledInvocation(request) {
+  if (request.method !== "POST") return null;
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return null;
+  }
+  const nextRun = typeof body?.next_run === "string" ? body.next_run : "";
+  return nextRun && Number.isFinite(Date.parse(nextRun))
+    ? { nextRun }
+    : null;
+}
+
+export default async function handler(request) {
+  const scheduled = await readScheduledInvocation(request);
+  if (!scheduled) return new Response("Not Found", { status: 404 });
+
+  const url = new URL(WORKER_PATH, siteOrigin(request));
+  const response = await fetch(url.toString(), {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      "x-agent-native-analytics-alert-cron": CRON_TOKEN,
+    },
+    body: JSON.stringify({ scheduled: true, next_run: scheduled.nextRun }),
+  });
+
+  if (!response.ok && response.status !== 202) {
+    console.error(
+      "[analytics-alert-cron] Background sweep trigger failed:",
+      response.status,
+      await response.text().catch(() => ""),
+    );
+  }
+}
+
+export const config = {
+  name: "analytics alert cron trigger",
+  generator: "agent-native analytics build",
+  schedule: ${JSON.stringify(ALERT_SCHEDULE)},
+};
+`;
+
+  writeFileSync(path.join(dest, `${ALERT_SCHEDULED_NAME}.mjs`), source);
+}
+
+function emitAlertBackgroundWorker(token: string) {
+  const dest = path.join(FUNCTIONS_DIR, ALERT_WORKER_NAME);
+  rmSync(dest, { recursive: true, force: true });
+  cpSync(SERVER_DIR, dest, { recursive: true });
+  rmSync(path.join(dest, "server.mjs"), { force: true });
+
+  const source = `globalThis.__AGENT_NATIVE_ANALYTICS_ALERT_SCHEDULED_RUNTIME__ = true;
+
+const CRON_TOKEN = ${JSON.stringify(token)};
+const ROUTE_PATH = ${JSON.stringify(ALERT_ROUTE_PATH)};
+let cachedHandler;
+
+function timingSafeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) {
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
+export default async function handler(request, context) {
+  const token = request.headers.get("x-agent-native-analytics-alert-cron") || "";
+  if (!timingSafeEquals(token, CRON_TOKEN)) {
+    return new Response("Unauthorized", { status: 401 });
+  }
+
+  cachedHandler ??= (await import("./main.mjs")).default;
+  const url = new URL(request.url);
+  url.pathname = ROUTE_PATH;
+  url.search = "";
+
+  const rewritten = new Request(url.toString(), {
+    method: "POST",
+    headers: new Headers({ "content-type": "application/json" }),
+    body: JSON.stringify({ scheduled: true }),
+  });
+
+  return await cachedHandler(rewritten, context);
+}
+
+export const config = {
+  name: "analytics alert background sweep",
+  generator: "agent-native analytics build",
+  background: true,
+  nodeBundler: "none",
+  includedFiles: ["**"],
+  preferStatic: false,
+};
+`;
+
+  writeFileSync(path.join(dest, `${ALERT_WORKER_NAME}.mjs`), source);
+}
+
 function isDirectRun(): boolean {
   const entrypoint = process.argv[1];
   return Boolean(
@@ -133,11 +253,17 @@ function main(): void {
   }
 
   const token = randomBytes(32).toString("hex");
+  const alertToken = randomBytes(32).toString("hex");
   emitScheduledTrigger(token);
   emitBackgroundWorker(token);
+  emitAlertScheduledTrigger(alertToken);
+  emitAlertBackgroundWorker(alertToken);
   console.log(
     `[dashboard-report-cron] Emitted Netlify scheduled trigger "${SCHEDULED_NAME}" (${SCHEDULE}) and background worker "${WORKER_NAME}".`,
   );
+  console.log(
+    `[analytics-alert-cron] Emitted Netlify scheduled trigger "${ALERT_SCHEDULED_NAME}" (${ALERT_SCHEDULE}) and background worker "${ALERT_WORKER_NAME}".`,
+  );
 }
 
 if (isDirectRun()) {

package/corpus/templates/analytics/server/db/schema.ts

@@ -179,6 +179,61 @@ export const analyticsEvents = table("analytics_events", {
   orgId: text("org_id"),
 });
 
+/**
+ * Generic alert rules over first-party analytics events. Rules are owned by a
+ * user/org but can target any app, template, event name, or event property.
+ */
+export const analyticsAlertRules = table("analytics_alert_rules", {
+  id: text("id").primaryKey(),
+  name: text("name").notNull(),
+  description: text("description").notNull().default(""),
+  eventName: text("event_name"),
+  filters: text("filters").notNull().default("[]"),
+  thresholdMode: text("threshold_mode", {
+    enum: ["event_count", "distinct_count"],
+  })
+    .notNull()
+    .default("event_count"),
+  distinctBy: text("distinct_by"),
+  threshold: integer("threshold").notNull().default(1),
+  windowMinutes: integer("window_minutes").notNull().default(10),
+  cooldownMinutes: integer("cooldown_minutes").notNull().default(30),
+  severity: text("severity", { enum: ["warning", "critical"] })
+    .notNull()
+    .default("warning"),
+  channels: text("channels").notNull().default('["inbox"]'),
+  emailRecipients: text("email_recipients").notNull().default("[]"),
+  enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
+  lastEvaluatedAt: text("last_evaluated_at"),
+  lastTriggeredAt: text("last_triggered_at"),
+  lastStatus: text("last_status", {
+    enum: ["ok", "triggered", "cooldown", "error", "running"],
+  }),
+  lastError: text("last_error"),
+  createdAt: text("created_at").notNull().default(now()),
+  updatedAt: text("updated_at").notNull().default(now()),
+  ownerEmail: text("owner_email").notNull().default("local@localhost"),
+  orgId: text("org_id"),
+});
+
+export const analyticsAlertIncidents = table("analytics_alert_incidents", {
+  id: text("id").primaryKey(),
+  ruleId: text("rule_id").notNull(),
+  triggeredAt: text("triggered_at").notNull(),
+  windowStart: text("window_start").notNull(),
+  windowEnd: text("window_end").notNull(),
+  threshold: integer("threshold").notNull(),
+  observedValue: integer("observed_value").notNull(),
+  eventCount: integer("event_count").notNull(),
+  severity: text("severity", { enum: ["warning", "critical"] }).notNull(),
+  channels: text("channels").notNull().default("[]"),
+  sampleEvents: text("sample_events").notNull().default("[]"),
+  notificationId: text("notification_id"),
+  createdAt: text("created_at").notNull().default(now()),
+  ownerEmail: text("owner_email").notNull().default("local@localhost"),
+  orgId: text("org_id"),
+});
+
 /**
  * Session replay summaries recorded through the first-party analytics replay
  * endpoint. Raw replay chunks live in session_replay_chunks and are only read

package/corpus/templates/analytics/server/handlers/session-replay.ts

@@ -355,12 +355,15 @@ export const handleSessionReplayChunkBytes = defineEventHandler(
           userEmail: ctx.userEmail,
           orgId: ctx.orgId ?? null,
         });
+        // Serve decompressed JSON and let the platform negotiate wire
+        // compression. Manually returning a pre-gzipped body with a
+        // `Content-Encoding: gzip` header corrupted replay downloads on
+        // serverless hosts and left playback blank in production.
         setResponseHeader(event, "Content-Type", "application/json");
-        setResponseHeader(event, "Content-Encoding", "gzip");
         setResponseHeader(event, "Cache-Control", "no-store");
         setResponseHeader(event, "X-Session-Replay-Seq", String(result.seq));
         setResponseHeader(event, "X-Session-Replay-Checksum", result.checksum);
-        return result.data;
+        return result.json;
       } catch (error: any) {
         setResponseStatus(event, statusFromError(error));
         return { error: messageFromError(error) };

package/corpus/templates/analytics/server/jobs/analytics-alerts.ts

@@ -0,0 +1,74 @@
+import {
+  claimAnalyticsAlertRuleEvaluation,
+  evaluateAndNotifyAnalyticsAlertRule,
+  listEnabledAnalyticsAlertRules,
+  markAnalyticsAlertRuleError,
+} from "../lib/analytics-alerts";
+
+let running = false;
+const DEFAULT_MAX_RULES_PER_SWEEP = 100;
+
+function maxRulesPerSweep(input?: number): number {
+  if (input) return Math.max(1, Math.min(500, Math.floor(input)));
+  const raw = process.env.ANALYTICS_ALERT_SWEEP_LIMIT?.trim();
+  if (!raw) return DEFAULT_MAX_RULES_PER_SWEEP;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) && parsed > 0
+    ? parsed
+    : DEFAULT_MAX_RULES_PER_SWEEP;
+}
+
+/**
+ * Run one analytics alert sweep. Exported for deployment-specific scheduled
+ * functions that should not rely on a long-lived Node process.
+ */
+export async function runAnalyticsAlertsOnce(
+  options: {
+    ownerEmail?: string;
+    orgId?: string | null;
+    limit?: number;
+  } = {},
+): Promise<{
+  processed: number;
+  triggered: number;
+  failed: number;
+  remaining: number;
+}> {
+  if (running) return { processed: 0, triggered: 0, failed: 0, remaining: 0 };
+  running = true;
+  let processed = 0;
+  let triggered = 0;
+  let failed = 0;
+  let remaining = 0;
+
+  try {
+    const sweepLimit = maxRulesPerSweep(options.limit);
+    const rules = await listEnabledAnalyticsAlertRules({
+      limit: sweepLimit,
+      ownerEmail: options.ownerEmail,
+      orgId: options.orgId,
+    });
+    remaining = rules.length >= sweepLimit ? 1 : 0;
+
+    for (const rule of rules) {
+      try {
+        const claimed = await claimAnalyticsAlertRuleEvaluation(rule);
+        if (!claimed) continue;
+        processed++;
+        const result = await evaluateAndNotifyAnalyticsAlertRule(rule);
+        if (result.status === "triggered") triggered++;
+      } catch (err) {
+        failed++;
+        await markAnalyticsAlertRuleError(rule.id, err).catch(() => {});
+        console.error(
+          `[analytics-alerts] Rule ${rule.id} (${rule.name}) failed:`,
+          err,
+        );
+      }
+    }
+  } finally {
+    running = false;
+  }
+
+  return { processed, triggered, failed, remaining };
+}