@agent-native/core 0.115.3 → 0.116.0

package/dist/templates/headless/.agents/skills/agent-native-toolkit/SKILL.md

@@ -85,7 +85,10 @@ in the moment of agent use.
   approval, generative UI, progress, and screen-state exposure.
 - **Chat history kit**: presentational chat lists and recent-chat rails belong
   in Toolkit; Core keeps thread persistence, agent execution, transport, and
-  page-to-sidebar handoff. Apps inject routing, labels, and domain actions.
+  page-to-sidebar handoff. Use Toolkit's `ChatHistoryRail` for the standard
+  five-item sidebar preview and a footer row with New chat followed by an
+  ellipsis disclosure up to fifteen. Apps inject routing, labels, and domain
+  actions.
 - **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
   `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
   Access tabs plus a Personal/Organization scope toggle. The canonical home

package/dist/templates/workspace-core/.agents/skills/agent-native-toolkit/SKILL.md

@@ -85,7 +85,10 @@ in the moment of agent use.
   approval, generative UI, progress, and screen-state exposure.
 - **Chat history kit**: presentational chat lists and recent-chat rails belong
   in Toolkit; Core keeps thread persistence, agent execution, transport, and
-  page-to-sidebar handoff. Apps inject routing, labels, and domain actions.
+  page-to-sidebar handoff. Use Toolkit's `ChatHistoryRail` for the standard
+  five-item sidebar preview and a footer row with New chat followed by an
+  ellipsis disclosure up to fifteen. Apps inject routing, labels, and domain
+  actions.
 - **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
   `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
   Access tabs plus a Personal/Organization scope toggle. The canonical home

package/dist/templates/workspace-core/.agents/skills/real-time-collab/SKILL.md

@@ -16,7 +16,7 @@ metadata:
 
 Collaborative editing uses Yjs CRDT via TipTap. The agent and human users are
 equal participants — both edit the same Y.Doc and changes merge cleanly without
-conflicts. Always set `resourceType` on `createCollabPlugin`.
+conflicts. Always choose an explicit `access` mode on `createCollabPlugin`.
 
 ## How It Works
 
@@ -104,7 +104,16 @@ in **different** regions merge fine through the CRDT.
 
 ## Security
 
-### Always set `resourceType`
+### Always choose an explicit access mode
+
+Inspect the schema and sharing registration before configuring collaboration:
+
+- For owned or shareable records, use `mode: "resource"` and the resource type
+  registered through `registerShareableResource`.
+- For records deliberately visible to every authenticated user on the
+  deployment, use `mode: "all-authenticated"`.
+- Never invent a `resourceType` merely to silence a warning. Resource mode is
+  correct only when the matching ownership and sharing model exists.
 
 ```ts
 // server/plugins/collab.ts
@@ -114,14 +123,23 @@ export default createCollabPlugin({
   table: "documents",
   contentColumn: "content",
   idColumn: "id",
-  resourceType: "document", // required
+  access: { mode: "resource", resourceType: "document" },
 });
 ```
 
-Without `resourceType`, the server logs a one-time warning and collab push
-events are delivered to **all authenticated users** without document-level
-scoping. Set it to the resource type name registered via
-`registerShareableResource`.
+For intentionally deployment-wide authenticated collaboration:
+
+```ts
+createCollabPlugin({
+  table: "todos",
+  contentColumn: "content",
+  access: { mode: "all-authenticated" },
+});
+```
+
+Omitting `access` is supported only for legacy compatibility and is deprecated.
+It behaves like `all-authenticated`, logs a warning, and is flagged by Doctor.
+Choose the mode explicitly so access intent is reviewable.
 
 Non-owner sharees who have explicit access fall back to state-vector catch-up
 (safe, slightly higher latency). Awareness routes require the same viewer
@@ -133,7 +151,10 @@ Write routes reject payloads exceeding `maxPayloadBytes` (default 2 MB) with
 HTTP 413. Override:
 
 ```ts
-createCollabPlugin({ resourceType: "document", maxPayloadBytes: 512 * 1024 });
+createCollabPlugin({
+  access: { mode: "resource", resourceType: "document" },
+  maxPayloadBytes: 512 * 1024,
+});
 ```
 
 ## Enabling Collaboration
@@ -144,7 +165,7 @@ createCollabPlugin({ resourceType: "document", maxPayloadBytes: 512 * 1024 });
 pnpm add @tiptap/extension-collaboration @tiptap/extension-collaboration-caret @tiptap/y-tiptap @tiptap/core
 ```
 
-### 2. Add collab server plugin (with `resourceType`)
+### 2. Add collab server plugin (with explicit access)
 
 ```ts
 // server/plugins/collab.ts
@@ -154,7 +175,7 @@ export default createCollabPlugin({
   table: "documents",
   contentColumn: "content",
   idColumn: "id",
-  resourceType: "document",
+  access: { mode: "resource", resourceType: "document" },
 });
 ```
 
@@ -343,9 +364,10 @@ the whole history — external/agent edits must not wipe the user's undo stack.
 
 ## Common Pitfalls
 
-- **Missing `resourceType`** — The server logs a warning on startup and
-  delivers collab events to all authenticated users without access scoping.
-  Always set `resourceType`.
+- **Missing `access`** — Legacy omission behaves like `all-authenticated`, logs
+  a startup warning, and is flagged by Doctor. Choose `resource` for records
+  backed by ownership/sharing, or explicit `all-authenticated` for intentionally
+  deployment-wide records. Never invent a resource type to silence the warning.
 - **Don't pass `content` as a TipTap prop** when Collaboration is enabled —
   Yjs owns the content. Seed via `editor.commands.setContent()` only when the
   Y.XmlFragment is empty.

package/dist/templates/workspace-core/.agents/skills/real-time-sync/SKILL.md

@@ -72,7 +72,7 @@ The agent modifies data in SQL, but the UI runs in the browser. SSE bridges same
   });
   ```
 
-  `useDbSync` and every `subscribeSyncEvents` subscriber share one `EventSource` and one fallback poll loop per tab — this is how collaborative documents receive doc updates and cursor/awareness events.
+  `useDbSync` and every `subscribeSyncEvents` subscriber share one `EventSource` and one fallback poll loop per tab — this is how collaborative documents receive doc updates and cursor/awareness events. Hidden tabs keep that shared transport alive by default: SSE stays connected and active fallback polling relaxes to a 10-second floor (idle polling remains once per minute). Pass `pauseWhenHidden: true` only for a consumer that explicitly must stop all hidden-tab sync.
 
 ## Which sources to depend on
 

package/dist/templates/workspace-core/.agents/skills/voice-transcription/SKILL.md

@@ -24,9 +24,10 @@ shared agent sidebar.
 - **Always show the mic alongside the send button.** Cursor replaces send
   with mic when the composer is empty; their users complain. We keep both
   visible — Lovable does the same.
-- **Ask before switching modes.** The mic opens a shadcn popover offering
-  **Start voice mode** and **Keep dictating**; never silently replace the
-  established dictation behavior.
+- **Ask before switching modes.** The mic opens a compact shadcn popover with
+  **Real-time voice** as the primary action and **Dictate** as the secondary;
+  never silently replace the established dictation behavior. Users can choose
+  **Remember my preference** to skip the chooser on later clicks.
 - **Dictation is click-to-toggle, not push-to-talk.** More forgiving in a sidebar, avoids
   host-app hotkey clashes. Keyboard shortcut is `Cmd/Ctrl+Shift+M` and
   `Escape` cancels mid-recording.
@@ -100,6 +101,9 @@ action before requesting microphone permission.
   `application_state["realtime-voice-prefs"]`. Keep this separate from
   `voice-transcription-prefs`, which configures editable dictation rather than
   the speech-to-speech session.
+- Store the optional remembered chooser selection at
+  `application_state["voice-input-preference"]`. Keep it separate from both
+  mode-specific preference objects.
 - Missing-key failures should open Settings focused on the user-scoped
   `OPENAI_API_KEY` field. Never send, log, or echo the key to the browser.
 
@@ -147,11 +151,11 @@ Default behavior:
 
 | File                                                                  | Purpose                                             |
 | --------------------------------------------------------------------- | --------------------------------------------------- |
-| `packages/core/src/client/composer/useVoiceDictation.ts`              | Provider-routing hook (MediaRecorder / Web Speech)  |
-| `packages/core/src/client/composer/VoiceButton.tsx`                   | Mic button + live amplitude + cancel overlay        |
-| `packages/core/src/client/composer/RealtimeVoiceMode.tsx`            | Opt-in popover + persistent speech orb              |
-| `packages/core/src/client/composer/useRealtimeVoiceMode.tsx`         | WebRTC lifecycle, provider events, and tool bridge  |
-| `packages/core/src/client/composer/TiptapComposer.tsx`                | Wires the hook, insertion, and keyboard shortcut    |
+| `packages/toolkit/src/composer/useVoiceDictation.ts`                  | Provider-routing hook (MediaRecorder / Web Speech)  |
+| `packages/toolkit/src/composer/VoiceButton.tsx`                       | Mic button + live amplitude + cancel overlay        |
+| `packages/toolkit/src/composer/RealtimeVoiceMode.tsx`                | Opt-in popover + persistent speech orb              |
+| `packages/toolkit/src/composer/useRealtimeVoiceMode.tsx`             | WebRTC lifecycle, provider events, and tool bridge  |
+| `packages/toolkit/src/composer/TiptapComposer.tsx`                    | Wires the hook, insertion, and keyboard shortcut    |
 | `packages/core/src/client/settings/VoiceTranscriptionSection.tsx`     | Live source + cleanup controls in sidebar settings  |
 | `packages/core/src/client/transcription/BuilderTranscriptionCta.tsx`  | CTA shown when Builder account isn't connected      |
 | `packages/core/src/client/transcription/use-live-transcription.ts`    | Web Speech live-transcription hook for recordings   |

package/docs/AGENTS.md

@@ -59,7 +59,7 @@ preserve public action, state, auth, and agent-chat runtime contracts.
 | Localize UI copy and language choices | `content/internationalization.md`, `content/client.md`                                                   |
 | Build headless or chat-first apps     | `content/pure-agent-apps.md`, `content/agent-surfaces.md`, `content/using-your-agent.md`                 |
 | Add automations or scheduled work     | `content/automations.md`, `content/recurring-jobs.md`                                                    |
-| Compose apps or call sibling agents   | `content/a2a-protocol.md`, `content/multi-app-workspace.md`, `content/workspace.md`                      |
+| Compose apps or call sibling agents   | `content/a2a-protocol.md`, `content/multi-app-workspace.md`, `content/agent-resources.mdx`               |
 | Expose tools to external agents       | `content/external-agents.md`, `content/mcp-protocol.md`, `content/mcp-apps.md`, `content/mcp-clients.md` |
 | Add integrations, setup, or secrets   | `content/onboarding.md`, `content/workspace-connections.md`, `content/security.md`                       |
 | Build extensions or custom widgets    | `content/extensions.md`, `content/agent-web-surfaces.md`                                                 |

package/docs/content/agent-mentions.mdx

@@ -154,7 +154,7 @@ model: inherit
 You are a focused design agent.
 ```
 
-See [Agent Resources — Custom Agents](/docs/workspace#custom-agents) for the full format (including `tools`, `delegate-default`, and model overrides).
+See [Agent Resources — Custom Agents](/docs/agent-resources#custom-agents) for the full format (including `tools`, `delegate-default`, and model overrides).
 
 You can create them from the Resources tab using:
 
@@ -240,4 +240,4 @@ Custom mention providers appear alongside the built-in agent and file providers
 - [**A2A Protocol**](/docs/a2a-protocol) — how connected-agent mentions are resolved over the wire
 - [**Agent Teams**](/docs/agent-teams) — spawn sub-agents and pass the `agent` profile parameter
 - [**Skills Guide**](/docs/skills-guide) — author the skills referenced with `/`
-- [**Agent Resources**](/docs/workspace#custom-agents) — the full custom-agent profile format
+- [**Agent Resources**](/docs/agent-resources#custom-agents) — the full custom-agent profile format

package/docs/content/{workspace.mdx → agent-resources.mdx}

@@ -5,12 +5,6 @@ description: "Claude-Code-level customization per user — skills, memory, instr
 
 # Agent Resources
 
-<Callout tone="info">
-
-**Which workspace doc?** This page covers **Agent Resources** — the agent customization layer. For the deployment shape (one monorepo, many apps) see [Multi-App Workspaces](/docs/multi-app-workspace); for governance (who reviews, approves, and owns what) see [Workspace Governance](/docs/workspace-management).
-
-</Callout>
-
 Every agent-native app ships with **agent resources**: the customization layer that makes the agent yours. It contains team instructions (`AGENTS.md`), shared learnings (`LEARNINGS.md`), personal structured memory (`memory/MEMORY.md`), skills the agent pulls in on demand, custom sub-agents, scheduled jobs, and connected MCP servers — everything you'd expect from a Claude Code / Codex setup.
 
 The twist: **it's SQL rows, not filesystem files.** Each user gets their own set of agent resources stored in the database. There's no dev-box to spin up, no container per user, no files to mount. A multi-tenant SaaS can give every user a fully-customizable agent for essentially free, because all of it is rows — personal memory, personal MCP servers, personal skills, personal sub-agents — and the shared codebase hosts all of them at once.
@@ -233,7 +227,7 @@ For example:
 - Avoid: unsupported superlatives and vague AI claims
 ```
 
-## Resources Tab {#workspace-panel}
+## Resources Tab {#resources-tab}
 
 The agent panel includes a **Resources** tab alongside Chat and CLI. It shows a folder-organized tree of all resources, an inline editor for any text file (Markdown, JSON, YAML, plain text), and the `+` menu's typed creation flows (Files, Skills, Agents, Scheduled Tasks). Users can browse inherited workspace defaults and create/edit/delete personal or organization resources.
 

package/docs/content/agent-teams.mdx

@@ -14,7 +14,7 @@ Agent Teams runs on the core run-manager: events stream and persist, aborts prop
 ## The mental model {#mental-model}
 
 - **Main chat** — the orchestrator. Reads your request, delegates. Rarely does heavy work itself.
-- **Sub-agents** — run with their own thread, their own system prompt, their own tool set. Each maps to a "custom agent" profile in [Agent Resources](/docs/workspace).
+- **Sub-agents** — run with their own thread, their own system prompt, their own tool set. Each maps to a "custom agent" profile in [Agent Resources](/docs/agent-resources).
 - **Chips** — the rich preview card that appears inline in the main chat, showing the sub-agent's current step, streaming output, and final summary. Collapsed by default; expands to the full conversation on click.
 - **Bidirectional messaging** — the main agent can send follow-ups to a running sub-agent; a sub-agent can message back when it hits an ambiguous point.
 
@@ -105,7 +105,7 @@ Three ways to kick off a sub-agent, from least to most explicit:
 
 The user types `@agent-name` in the chat composer. A dropdown of workspace sub-agents appears. Selecting one inserts a chip; on submit the main agent delegates the message to that sub-agent.
 
-Custom agents live in agent resources at `agents/<slug>.md` — a Markdown file with YAML frontmatter. See [Custom Agents](/docs/workspace#custom-agents) for the format.
+Custom agents live in agent resources at `agents/<slug>.md` — a Markdown file with YAML frontmatter. See [Custom Agents](/docs/agent-resources#custom-agents) for the format.
 
 ### 2. The main agent delegates automatically {#auto-delegate}
 
@@ -247,7 +247,7 @@ interface AgentTask {
 
 ## Custom agent profiles {#profiles}
 
-Sub-agents map to custom agent profiles — Markdown files at `agents/<slug>.md` in agent resources that appear in the `@mention` dropdown and serve as delegation targets. [Agent Resources — Custom Agents](/docs/workspace#custom-agents) owns the full format (frontmatter, `tools`, `delegate-default`, model overrides).
+Sub-agents map to custom agent profiles — Markdown files at `agents/<slug>.md` in agent resources that appear in the `@mention` dropdown and serve as delegation targets. [Agent Resources — Custom Agents](/docs/agent-resources#custom-agents) owns the full format (frontmatter, `tools`, `delegate-default`, model overrides).
 
 ## Delegation depth guard {#depth-guard}
 
@@ -326,6 +326,6 @@ When a sub-agent is at or below the cap, the framework injects a line into its r
 
 ## What's next
 
-- [**Agent Resources — Custom Agents**](/docs/workspace#custom-agents) — the profile format
+- [**Agent Resources — Custom Agents**](/docs/agent-resources#custom-agents) — the profile format
 - [**A2A Protocol**](/docs/a2a-protocol) — when the "sub-agent" lives in a different app entirely
 - [**Actions**](/docs/actions) — the tools a sub-agent calls

package/docs/content/dispatch.mdx

@@ -91,15 +91,15 @@ If you're running a single template standalone, you don't need Dispatch — each
 
 Seven capabilities, all sitting on top of the same workspace database the other apps use:
 
-| Capability               | What it gives you                                                               | Set it up                                                           |
-| ------------------------ | ------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
-| **Central inbox**        | Slack, email, Telegram, WhatsApp all reach one agent with shared memory + tools | **Settings → Messaging** ([Messaging](/docs/messaging))             |
-| **Secret vault**         | Store each credential once; rotate in one place across every app                | **Vault** + access mode (all-apps or manual)                        |
-| **Cross-app delegation** | Routes a request to the right specialist app over A2A and replies in-thread     | Automatic ([A2A](/docs/a2a-protocol))                               |
-| **Unified MCP gateway**  | One MCP connector for external agents reaches every granted workspace app       | [External Agents](/docs/external-agents)                            |
-| **Workspace resources**  | Author skills/instructions/profiles once; apps inherit them at runtime          | **Resources** ([Agent Resources](/docs/workspace#global-resources)) |
-| **Dreams**               | Reviews past runs/feedback and proposes durable improvements for you to approve | **Dreams** tab                                                      |
-| **Approval flow**        | Gate sensitive runtime changes behind inline admin review                       | **dispatch approval policy**                                        |
+| Capability               | What it gives you                                                               | Set it up                                                                 |
+| ------------------------ | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
+| **Central inbox**        | Slack, email, Telegram, WhatsApp all reach one agent with shared memory + tools | **Settings → Messaging** ([Messaging](/docs/messaging))                   |
+| **Secret vault**         | Store each credential once; rotate in one place across every app                | **Vault** + access mode (all-apps or manual)                              |
+| **Cross-app delegation** | Routes a request to the right specialist app over A2A and replies in-thread     | Automatic ([A2A](/docs/a2a-protocol))                                     |
+| **Unified MCP gateway**  | One MCP connector for external agents reaches every granted workspace app       | [External Agents](/docs/external-agents)                                  |
+| **Workspace resources**  | Author skills/instructions/profiles once; apps inherit them at runtime          | **Resources** ([Agent Resources](/docs/agent-resources#global-resources)) |
+| **Dreams**               | Reviews past runs/feedback and proposes durable improvements for you to approve | **Dreams** tab                                                            |
+| **Approval flow**        | Gate sensitive runtime changes behind inline admin review                       | **dispatch approval policy**                                              |
 
 Each is detailed below.
 
@@ -134,7 +134,7 @@ The single MCP connector URL external agents add (e.g. `https://dispatch.agent-n
 
 Skills, guardrail instructions, agent profiles, and reference resources can be authored once in Dispatch and inherited by the rest of the workspace. Resources with **All apps** scope are global: Dispatch stores them once at workspace scope, and every app agent reads them at runtime. They are not copied into each app, and there is no manual workspace-resource sync step. App shared resources and personal resources can override or narrow the workspace defaults locally.
 
-See [Agent Resources — Global resources](/docs/workspace#global-resources) for the canonical path table, starter pack, and override model.
+See [Agent Resources — Global resources](/docs/agent-resources#global-resources) for the canonical path table, starter pack, and override model.
 
 MCP server resources use JSON and are intentionally HTTP-only. Store tokens in
 Dispatch Vault, grant or sync those keys to the target apps, and reference them

package/docs/content/drop-in-agent.mdx

@@ -1,6 +1,6 @@
 ---
 title: "Drop-in Agent"
-description: "Mount the agent chat + workspace into any React app with <AgentPanel>, <AgentSidebar>, and sendToAgentChat()."
+description: "Mount the agent chat + resources into any React app with <AgentPanel>, <AgentSidebar>, and sendToAgentChat()."
 ---
 
 # Drop-in Agent
@@ -47,7 +47,7 @@ All of these are exported from `@agent-native/core/client`.
       </div>
       <div class="diagram-node panel">
         Agent panel<br /><small class="diagram-muted"
-          >chat &middot; CLI &middot; workspace</small
+          >chat &middot; CLI &middot; resources</small
         >
       </div>
     </div>
@@ -170,7 +170,7 @@ export default function AgentRoute() {
 }
 ```
 
-`<AgentPanel>` gives you the raw tabs (Chat / CLI / Workspace) without the sidebar wrapper, the collapse button, or any state persistence. Put it wherever you want; you handle the layout.
+`<AgentPanel>` gives you the raw tabs (Chat / CLI / Resources) without the sidebar wrapper, the collapse button, or any state persistence. Put it wherever you want; you handle the layout.
 
 ### Selected props
 
@@ -337,5 +337,5 @@ The user sees a chat button in the header, can open it, and can talk to the agen
 
 - [**Actions**](/docs/actions) — `defineAction()` and `useActionMutation()`
 - [**Context Awareness**](/docs/context-awareness) — selection, navigation, view-screen
-- [**Agent Resources**](/docs/workspace) — what the Resources tab contains (skills, memory, MCP servers, scheduled jobs)
+- [**Agent Resources**](/docs/agent-resources) — what the Resources tab contains (skills, memory, MCP servers, scheduled jobs)
 - [**Voice Input**](/docs/voice-input) — the microphone in the chat composer

package/docs/content/external-agents.mdx

@@ -90,7 +90,7 @@ The identity rule is the safety hinge: the link is just `view` + record ids + fi
 - **Your own runtime behind Agent-Native chat:** see [Agent Surfaces](/docs/agent-surfaces#byo-agent) and [Native Chat UI](/docs/native-chat-ui#byo-agent-runtimes) when an agent built with another framework should power `<AssistantChat runtime={...}>`.
 - **Your app consuming MCP tools:** see [MCP Clients](/docs/mcp-clients) when an agent-native app needs to call tools exposed by another MCP server.
 - **Another app or agent via A2A:** use [Agent Mentions](/docs/agent-mentions) and [A2A](/docs/a2a-protocol) when agent-native apps should discover and delegate to each other.
-- **Local custom sub-agents:** use [Agent Resources](/docs/workspace) when you want custom agent profiles inside the app's own agent resources.
+- **Local custom sub-agents:** use [Agent Resources](/docs/agent-resources) when you want custom agent profiles inside the app's own agent resources.
 
 ## Easy setup {#easy-setup}
 

package/docs/content/frames.mdx

@@ -79,7 +79,7 @@ component in dev and prod.
 
 - Exported as `AgentPanel` from `@agent-native/core/client`, with a
   production-only variant `ProductionAgentPanel`.
-- Provides the full Chat / CLI / Workspace surface, so the agent input stays on
+- Provides the full Chat / CLI / Resources surface, so the agent input stays on
   the shared composer stack used everywhere else in the framework.
 - Reads `application_state.navigation` every turn, so it already knows which
   view you're in and what's selected — you don't have to re-explain "this".

package/docs/content/integrations.mdx

@@ -7,7 +7,7 @@ search: "integrations directory MCP connectors OAuth manual setup restricted pro
 # Connect your stack
 
 Agent-Native apps can use the tools your team already works in. This directory
-mirrors the framework's current remote MCP catalog: 25 provider presets that
+mirrors the framework's current remote MCP catalog: 26 provider presets that
 can be discovered from the composer and Workspace Resources surfaces. It also
 explains the separate reusable workspace-connection and provider-API layers so
 you can choose the connection path that matches your product.
@@ -39,7 +39,7 @@ These self-hosted provider marks keep the directory fast and deployable
 without a third-party logo CDN. Connection details and status categories remain
 in the directory table below.
 
-<Diagram id="doc-block-integrations-wall" title="Remote MCP integrations" summary="A self-hosted logo wall of the 25 remote MCP presets currently shipped in the Agent-Native framework." frame="hide" renderMode="design">
+<Diagram id="doc-block-integrations-wall" title="Remote MCP integrations" summary="A self-hosted logo wall of the 26 remote MCP presets currently shipped in the Agent-Native framework." frame="hide" renderMode="design">
 
 ```html
 <div class="integration-wall">
@@ -67,6 +67,16 @@ in the directory table below.
       <div><strong>Notion</strong><small>Knowledge &amp; docs</small></div>
     </div>
   </div>
+  <div class="integration-card">
+    <div class="integration-head">
+      <span class="integration-mark"
+        ><img src="/integration-logos/granola.svg" alt=""
+      /></span>
+      <div>
+        <strong>Granola</strong><small>Meetings &amp; transcripts</small>
+      </div>
+    </div>
+  </div>
   <div class="integration-card">
     <div class="integration-head">
       <span class="integration-mark"
@@ -327,6 +337,7 @@ but need provider or administrator setup before a generic connection can work.
 | [Context7](https://context7.com/)                                                                                                                                       | No auth                | Ready · verified                   | `https://mcp.context7.com/mcp`            | Fetch current library and framework docs.                                                                                                                                                                                         |
 | [Sentry](https://docs.sentry.io/product/sentry-mcp/)                                                                                                                    | Header / token         | Ready · preflight only             | `https://mcp.sentry.dev/mcp`              | Add a Sentry bearer token as the `Authorization` header.                                                                                                                                                                          |
 | [Notion](https://developers.notion.com/guides/mcp/get-started-with-mcp)                                                                                                 | OAuth                  | Ready · preflight only             | `https://mcp.notion.com/mcp`              | User OAuth; enterprise admins can audit or restrict MCP clients.                                                                                                                                                                  |
+| [Granola](https://docs.granola.ai/help-center/sharing/integrations/mcp)                                                                                                 | OAuth                  | Ready · preflight only             | `https://mcp.granola.ai/mcp`              | Browser OAuth; review the meeting notes and transcripts the connected Granola account makes available.                                                                                                                            |
 | [Semgrep](https://github.com/semgrep/mcp#readme)                                                                                                                        | No auth                | Ready · preflight only             | `https://mcp.semgrep.ai/mcp`              | Scan code for security findings.                                                                                                                                                                                                  |
 | [Linear](https://linear.app/docs/mcp)                                                                                                                                   | OAuth                  | Ready · preflight only             | `https://mcp.linear.app/mcp`              | Authorize the workspace and issue permissions required by the workflow.                                                                                                                                                           |
 | [Atlassian Rovo MCP](https://developer.atlassian.com/cloud/rovo-mcp/guides/getting-started/)                                                                            | OAuth + provider setup | Restricted                         | `https://mcp.atlassian.com/v1/mcp/authv2` | Admins may need to trust the app origin and enable Rovo Read, Write, and Search permissions.                                                                                                                                      |

package/docs/content/key-concepts.mdx

@@ -418,7 +418,7 @@ Two architectural rules keep apps portable across databases and hosts:
 
 ## Agent Resources {#workspace}
 
-Every user gets a personal set of **agent resources** — instructions, skills, memory, custom sub-agents, scheduled jobs, and connected MCP servers — all stored in SQL rather than files. That makes Claude-Code-level customization viable inside multi-tenant SaaS without spinning up a container per user. See [Agent Resources](/docs/workspace).
+Every user gets a personal set of **agent resources** — instructions, skills, memory, custom sub-agents, scheduled jobs, and connected MCP servers — all stored in SQL rather than files. That makes Claude-Code-level customization viable inside multi-tenant SaaS without spinning up a container per user. See [Agent Resources](/docs/agent-resources).
 
 ## Related building blocks {#building-blocks}
 
@@ -433,7 +433,7 @@ These sit on top of the same contract and have their own deep dives:
 Adopting the framework is valuable mostly because of what you stop having to build. The moment your app follows the six rules, you inherit:
 
 - **One action = every surface.** Every action defined with `defineAction()` is simultaneously an agent tool, a typesafe frontend hook (`useActionQuery` / `useActionMutation`), a framework-owned HTTP transport, a CLI command, an MCP tool for external clients, and an A2A tool for other agent-native apps. Optional `link` and `mcpApp` metadata add deep links and MCP Apps UI without a second implementation.
-- **A full set of agent resources per user.** Skills, shared `LEARNINGS.md`, personal `memory/MEMORY.md`, `AGENTS.md`, custom sub-agents, scheduled jobs, connected MCP servers — all SQL-backed, no dev-box required. See [Agent Resources](/docs/workspace).
+- **A full set of agent resources per user.** Skills, shared `LEARNINGS.md`, personal `memory/MEMORY.md`, `AGENTS.md`, custom sub-agents, scheduled jobs, connected MCP servers — all SQL-backed, no dev-box required. See [Agent Resources](/docs/agent-resources).
 - **Drop-in React components.** `<AgentPanel />` and `<AgentSidebar />` render chat + resources anywhere in your app. See [Drop-in Agent](/docs/drop-in-agent).
 - **BYO agent chat runtimes.** The same chat UI can sit on top of OpenAI Agents, OpenAI Responses, Claude Agent SDK, Vercel AI SDK, AG-UI, or your own normalized HTTP stream. See [Native Chat UI](/docs/native-chat-ui#byo-agent-runtimes).
 - **Live sync between agent and UI.** Same-process writes stream immediately over `/_agent-native/events`; a lightweight poll keeps serverless, cron, and cross-process writes convergent. Mutating actions invalidate action-backed queries automatically, so agent-created records appear without a manual refresh. See [Live Sync](#polling-sync) below.

package/docs/content/mcp-clients.mdx

@@ -275,7 +275,7 @@ export default {
 };
 ```
 
-Preset ids are `context7`, `sentry`, `notion`, `semgrep`, `linear`,
+Preset ids are `context7`, `sentry`, `notion`, `granola`, `semgrep`, `linear`,
 `atlassian`, `supabase`, `neon`, `stripe`, `cloudflare`, `gitlab`, `figma`,
 `vercel`, `github`, `slack`, `asana`, `hubspot`, `intercom`, `monday`,
 `webflow`, `paypal`, `box`, `netlify`, and `zapier`.
@@ -287,6 +287,12 @@ link to their official setup instructions, but do not show a misleading
 one-click connect button. Provider restrictions change over time, so verify
 the vendor setup note before enabling one in a production catalog.
 
+When a chat request clearly names an unconnected catalog provider, the
+composer and relevant completed responses can show an inline **Connect**
+suggestion. OAuth and direct connections preserve that request in the current
+tab and resume it after setup completes; long or abandoned requests expire
+automatically.
+
 ### Atlassian / Jira
 
 The Atlassian preset uses Atlassian Rovo MCP's OAuth 2.1 endpoint,

package/docs/content/multi-app-workspace.mdx

@@ -7,7 +7,7 @@ description: "Host many agent-native apps in one monorepo with shared auth, RBAC
 
 <Callout tone="info">
 
-**Which workspace doc?** This page covers the **deployment shape** — one monorepo, many apps, shared auth and a unified deploy. For the agent customization layer (Agent Resources: `AGENTS.md`, memory, skills, custom agents) see [Agent Resources](/docs/workspace); for governance (who reviews, approves, and owns what) see [Workspace Governance](/docs/workspace-management).
+**Which workspace doc?** This page covers the **deployment shape** — one monorepo, many apps, shared auth and a unified deploy. For the agent customization layer (Agent Resources: `AGENTS.md`, memory, skills, custom agents) see [Agent Resources](/docs/agent-resources); for governance (who reviews, approves, and owns what) see [Workspace Governance](/docs/workspace-management).
 
 </Callout>
 
@@ -222,7 +222,7 @@ Because the shared package is a `workspace:*` dependency, pnpm symlinks it into
 
 Use `packages/shared` for code-level defaults that should ship with the repo: plugins, shared actions, shared React code, filesystem `AGENTS.md`, and filesystem skills. Use Dispatch workspace resources for runtime-editable global context that admins want to manage without a code change.
 
-Dispatch resources are scoped **All apps** (every app inherits them at runtime, no copy or sync step) or **Selected apps** (granted per app for app-specific context). See [Agent Resources](/docs/workspace#global-resources) for the full resource-model table, path conventions, and the recommended starter pack.
+Dispatch resources are scoped **All apps** (every app inherits them at runtime, no copy or sync step) or **Selected apps** (granted per app for app-specific context). See [Agent Resources](/docs/agent-resources#global-resources) for the full resource-model table, path conventions, and the recommended starter pack.
 
 ## Authentication and RBAC {#auth-and-rbac}
 
@@ -332,7 +332,7 @@ The workspace pattern is intentionally narrow. A few things it deliberately does
 
 ## What's next {#whats-next}
 
-- [Agent Resources](/docs/workspace) — the customization layer (`AGENTS.md`, `LEARNINGS.md`, personal memory, skills, custom agents) every app in the workspace shares.
+- [Agent Resources](/docs/agent-resources) — the customization layer (`AGENTS.md`, `LEARNINGS.md`, personal memory, skills, custom agents) every app in the workspace shares.
 - [Workspace Governance](/docs/workspace-management) — branching, CODEOWNERS, PR review across many apps in one repo.
 - [Multi-Tenancy](/docs/multi-tenancy) — organizations, roles, and per-org data isolation.
 - [Cross-App SSO](/docs/cross-app-sso) — identity federation for separate-domain deploys.

package/docs/content/real-time-collaboration.mdx

@@ -240,10 +240,11 @@ export default defineConfig({
 
 ### 3. Add the collab server plugin
 
-Always set `resourceType` to the name of the shareable resource registered
-via `registerShareableResource`. Without it, collab push events are delivered
-to all authenticated users without document-level scoping, and the server
-logs a one-time warning.
+Choose the access mode that matches the data model. Owned or shareable records
+use `mode: "resource"` with the type registered via
+`registerShareableResource`. Records deliberately shared with every
+authenticated user on the deployment use explicit `mode: "all-authenticated"`.
+Never invent a resource type merely to silence a warning.
 
 ```ts
 // server/plugins/collab.ts
@@ -253,10 +254,13 @@ export default createCollabPlugin({
   table: "documents",
   contentColumn: "content",
   idColumn: "id",
-  resourceType: "document", // required for access-scoped event delivery
+  access: { mode: "resource", resourceType: "document" },
 });
 ```
 
+Omitting `access` is a deprecated legacy behavior. It behaves like
+`all-authenticated`, logs a warning, and is flagged by Doctor.
+
 ### 4. Use the client hook
 
 ```ts
@@ -590,23 +594,37 @@ plugin:
 
 ## Security {#security}
 
-### Always set `resourceType`
+### Choose the access model explicitly
+
+For owned or shareable resources, use the resource type registered through
+`registerShareableResource`:
 
 ```ts
 createCollabPlugin({
-  resourceType: "document", // the name passed to registerShareableResource
+  access: { mode: "resource", resourceType: "document" },
 });
 ```
 
-Without `resourceType` the plugin logs a warning and broadcasts collab push
-events to all authenticated users on the deployment without document-level
-scoping. Non-owners fall back to state-vector catch-up (safe but higher
-latency) regardless of whether `resourceType` is set.
+For a resource intentionally shared deployment-wide, say so explicitly:
+
+```ts
+createCollabPlugin({
+  access: { mode: "all-authenticated" },
+});
+```
+
+Do not invent a `resourceType` to make a warning disappear: resource mode is
+valid only when the corresponding ownership and sharing model exists. Omitting
+`access` is supported for legacy compatibility, behaves like
+`all-authenticated`, logs a warning, and is flagged by Doctor.
+
+Non-owner sharees with explicit access use state-vector catch-up through the
+poll path (safe, higher latency).
 
 ### Access checks
 
-All collab routes require authentication. When `resourceType` is set, reads
-require at least viewer access and writes require editor access, using the
+All collab routes require authentication. In resource mode, reads require at
+least viewer access and writes require editor access, using the
 same `resolveAccess` / `assertAccess` helpers as the sharing system. A 404
 (not 403) is returned on access failures to avoid leaking document existence.
 
@@ -618,7 +636,7 @@ Override per-plugin:
 
 ```ts
 createCollabPlugin({
-  resourceType: "document",
+  access: { mode: "resource", resourceType: "document" },
   maxPayloadBytes: 512 * 1024, // 512 KB
 });
 ```
@@ -726,7 +744,7 @@ Key properties:
 - [Real-Time Sync](/docs/client#usedbsync) — the `useDbSync` + `useChangeVersion`
   system that delivers the `updatedAt` bump driving editor reconciliation.
 - [Security](/docs/security) — `registerShareableResource`, `resolveAccess`,
-  and `assertAccess` for the access model referenced by `resourceType`.
+  and `assertAccess` for resource-scoped collaboration.
 - [Sharing](/docs/sharing) — how documents are shared and how access is granted.
 - [Template: Content](/docs/template-content) — reference implementation of
   collaborative rich-text editing.