@agent-native/core 0.118.0 → 0.118.1

package/src/mcp-client/oauth-routes.ts

@@ -4,10 +4,11 @@ import type { OAuthClientInformationMixed } from "@modelcontextprotocol/sdk/shar
 import {
   deleteCookie,
   defineEventHandler,
+  getChunkedCookie,
   getCookie,
   getMethod,
   getQuery,
-  setCookie,
+  setChunkedCookie,
   setResponseStatus,
   type H3Event,
 } from "h3";
@@ -32,6 +33,9 @@ import {
 
 const FLOW_COOKIE = "an_mcp_oauth_flow";
 const FLOW_TTL_SECONDS = 10 * 60;
+const FLOW_COOKIE_CHUNK_SIZE = 2_800;
+const FLOW_COOKIE_MAX_CHUNKS = 8;
+const CHUNKED_COOKIE_PREFIX = "__chunked__";
 
 export interface McpOAuthFlow {
   name: string;
@@ -189,13 +193,7 @@ async function handleMcpOAuthStart(
       ...(safeReturnUrl ? { returnUrl: safeReturnUrl } : {}),
       expiresAt: Date.now() + FLOW_TTL_SECONDS * 1_000,
     };
-    setCookie(event, FLOW_COOKIE, encryptSecretValue(JSON.stringify(flow)), {
-      httpOnly: true,
-      secure: redirectUri.startsWith("https://"),
-      sameSite: "lax",
-      path: "/",
-      maxAge: FLOW_TTL_SECONDS,
-    });
+    setMcpOAuthFlowCookie(event, flow, redirectUri.startsWith("https://"));
     return redirectWithStagedCookies(event, started.authorizationUrl.href);
   } catch {
     setResponseStatus(event, 400);
@@ -217,8 +215,8 @@ async function handleMcpOAuthCallback(
   const code = text(query.code);
   const state = text(query.state);
   const providerError = text(query.error);
-  const flow = readFlow(event);
-  deleteCookie(event, FLOW_COOKIE, { path: "/" });
+  const flow = readMcpOAuthFlowCookie(event);
+  clearMcpOAuthFlowCookies(event);
   if (providerError || !code || !state) {
     setResponseStatus(event, 400);
     return { error: "MCP OAuth authorization was not completed." };
@@ -275,8 +273,36 @@ async function handleMcpOAuthCallback(
   }
 }
 
-function readFlow(event: H3Event): McpOAuthFlow | null {
-  const encrypted = getCookie(event, FLOW_COOKIE);
+export function setMcpOAuthFlowCookie(
+  event: H3Event,
+  flow: McpOAuthFlow,
+  secure: boolean,
+): void {
+  const encrypted = encryptSecretValue(JSON.stringify(flow));
+  const chunkCount = Math.ceil(encrypted.length / FLOW_COOKIE_CHUNK_SIZE);
+  if (chunkCount > FLOW_COOKIE_MAX_CHUNKS) {
+    throw new Error("MCP OAuth flow state exceeds the cookie size limit.");
+  }
+  setChunkedCookie(event, FLOW_COOKIE, encrypted, {
+    httpOnly: true,
+    secure,
+    sameSite: "lax",
+    path: "/",
+    maxAge: FLOW_TTL_SECONDS,
+    chunkMaxLength: FLOW_COOKIE_CHUNK_SIZE,
+  });
+}
+
+export function readMcpOAuthFlowCookie(event: H3Event): McpOAuthFlow | null {
+  const primaryCookie = getCookie(event, FLOW_COOKIE);
+  if (!primaryCookie) return null;
+  if (primaryCookie.startsWith(CHUNKED_COOKIE_PREFIX)) {
+    const rawCount = primaryCookie.slice(CHUNKED_COOKIE_PREFIX.length);
+    if (!/^\d+$/.test(rawCount)) return null;
+    const chunkCount = Number(rawCount);
+    if (chunkCount < 2 || chunkCount > FLOW_COOKIE_MAX_CHUNKS) return null;
+  }
+  const encrypted = getChunkedCookie(event, FLOW_COOKIE);
   if (!encrypted) return null;
   try {
     const parsed = JSON.parse(decryptSecretValue(encrypted)) as McpOAuthFlow;
@@ -286,6 +312,13 @@ function readFlow(event: H3Event): McpOAuthFlow | null {
   }
 }
 
+export function clearMcpOAuthFlowCookies(event: H3Event): void {
+  deleteCookie(event, FLOW_COOKIE, { path: "/" });
+  for (let index = 1; index <= FLOW_COOKIE_MAX_CHUNKS; index += 1) {
+    deleteCookie(event, `${FLOW_COOKIE}.${index}`, { path: "/" });
+  }
+}
+
 export function isValidMcpOAuthFlow(
   flow: McpOAuthFlow,
   email: string,

package/src/server/realtime-voice.ts

@@ -201,7 +201,10 @@ export function resolveRealtimeVoiceReasoningEffort(
 ): "minimal" | "low" | "medium" {
   const normalized = value?.trim().toLowerCase();
   return normalized &&
-    Object.hasOwn(REALTIME_VOICE_REASONING_EFFORT, normalized)
+    Object.prototype.hasOwnProperty.call(
+      REALTIME_VOICE_REASONING_EFFORT,
+      normalized,
+    )
     ? REALTIME_VOICE_REASONING_EFFORT[
         normalized as keyof typeof REALTIME_VOICE_REASONING_EFFORT
       ]

package/src/templates/workspace-core/.agents/skills/voice-transcription/SKILL.md

@@ -57,11 +57,13 @@ action before requesting microphone permission.
   controls contain only settings and the separate end-session action.
 - The orb's compact waveform stays visible for the full session and reflects
   actual microphone or assistant audio activity. At silence it rests at its
-  baseline instead of turning into a loading spinner. While connecting, show a
-  distinct compact spinner; when the session becomes live, the assistant gives
-  one brief spoken greeting so readiness is unambiguous. Do not apply a
-  text-sized `max_output_tokens` cap to that audio greeting because audio tokens
-  can truncate it mid-sentence.
+  baseline instead of turning into a loading spinner. Once connected, a soft,
+  slowly rotating blue glow marks the live session; brighten and speed up the
+  glow while the agent is working, and keep it static under reduced motion.
+  While connecting, show a distinct compact spinner; when the session becomes
+  live, the assistant gives one brief spoken greeting so readiness is
+  unambiguous. Do not apply a text-sized `max_output_tokens` cap to that audio
+  greeting because audio tokens can truncate it mid-sentence.
 - The orb settings cog opens in place without ending voice mode or navigating
   away. Nested pickers must not dismiss the settings popover. Language and
   intelligence update the active Realtime session; the microphone picker swaps

package/src/terminal/cli-registry.ts

@@ -42,7 +42,7 @@ export const CLI_REGISTRY: Record<string, CliEntry> = {
 
 /** Check if a command name is in the CLI_REGISTRY allowlist */
 export function isAllowedCommand(cmd: string): boolean {
-  return Object.hasOwn(CLI_REGISTRY, cmd);
+  return Object.prototype.hasOwnProperty.call(CLI_REGISTRY, cmd);
 }
 
 /** Check if a CLI command exists on PATH (safe — no shell interpolation) */

package/src/vite/client.ts

@@ -732,7 +732,6 @@ function findCorePackageRoot(cwd: string): string | null {
   const candidates = [
     path.resolve(cwd, "../../packages/core"), // templates/<name>/
     path.resolve(cwd, "../core"), // packages/<name>/
-    path.resolve(cwd, "node_modules/@agent-native/core"),
   ];
   for (const candidate of candidates) {
     try {
@@ -2315,6 +2314,165 @@ function portExposer(): Plugin {
   };
 }
 
+function isNitroEnvironmentUnavailable(error: unknown): boolean {
+  const candidate = error as {
+    name?: unknown;
+    status?: unknown;
+    statusCode?: unknown;
+    message?: unknown;
+  };
+  return (
+    candidate?.name === "NitroViteError" &&
+    (candidate.status === 503 || candidate.statusCode === 503) &&
+    typeof candidate.message === "string" &&
+    /Vite environment .+ is unavailable/.test(candidate.message)
+  );
+}
+
+type NitroModuleNode = {
+  id: string | null;
+  ssrError?: Error | null;
+  transformResult: unknown | null;
+};
+
+type NitroModuleGraph = {
+  idToModuleMap: Map<string, NitroModuleNode>;
+};
+
+const NITRO_STARTUP_SETTLE_MS = 1_000;
+const NITRO_STARTUP_TIMEOUT_MS = 30_000;
+
+function nitroModuleGraphSignature(environment: unknown): string | null {
+  const graph = (environment as { moduleGraph?: NitroModuleGraph } | undefined)
+    ?.moduleGraph;
+  if (!graph) return null;
+
+  const modules = [...graph.idToModuleMap.values()];
+  const entry = modules.find((module) =>
+    module.id
+      ?.replaceAll("\\", "/")
+      .endsWith("/nitro/dist/runtime/internal/vite/dev-entry.mjs"),
+  );
+  if (!entry?.transformResult && !entry?.ssrError) return null;
+
+  let transformed = 0;
+  let errors = 0;
+  for (const module of modules) {
+    if (module.transformResult) transformed += 1;
+    if (module.ssrError) errors += 1;
+  }
+  return `${modules.length}:${transformed}:${errors}`;
+}
+
+function isHtmlDocumentRequest(req: IncomingMessage): boolean {
+  return (
+    (req.method === "GET" || req.method === "HEAD") &&
+    (req.headers.accept ?? "").includes("text/html")
+  );
+}
+
+function sendNitroStartingResponse(
+  req: IncomingMessage,
+  res: ServerResponse,
+): void {
+  res.statusCode = 503;
+  res.setHeader("cache-control", "no-store");
+  res.setHeader("content-type", "text/html; charset=utf-8");
+  res.setHeader("retry-after", "1");
+  if (req.method === "HEAD") {
+    res.end();
+    return;
+  }
+  res.end(
+    '<!doctype html><html><head><meta charset="utf-8"><meta http-equiv="refresh" content="0.25"><title>Starting…</title></head><body></body></html>',
+  );
+}
+
+function nitroStartupGate(
+  options: {
+    now?: () => number;
+    settleMs?: number;
+    timeoutMs?: number;
+  } = {},
+): Plugin {
+  return {
+    name: "agent-native-nitro-startup-gate",
+    apply: "serve",
+    enforce: "pre",
+    configureServer(server) {
+      const now = options.now ?? Date.now;
+      const settleMs = options.settleMs ?? NITRO_STARTUP_SETTLE_MS;
+      const timeoutMs = options.timeoutMs ?? NITRO_STARTUP_TIMEOUT_MS;
+      const startedAt = now();
+      let graphSignature: string | null = null;
+      let graphStableAt: number | undefined;
+      let startupComplete = false;
+
+      server.middlewares.use((req, res, next) => {
+        if (startupComplete || !isHtmlDocumentRequest(req)) {
+          next();
+          return;
+        }
+
+        const timestamp = now();
+        if (timestamp - startedAt >= timeoutMs) {
+          startupComplete = true;
+          next();
+          return;
+        }
+
+        const nextGraphSignature = nitroModuleGraphSignature(
+          server.environments?.nitro,
+        );
+        if (nextGraphSignature) {
+          if (nextGraphSignature !== graphSignature) {
+            graphSignature = nextGraphSignature;
+            graphStableAt = timestamp;
+          } else if (
+            graphStableAt !== undefined &&
+            timestamp - graphStableAt >= settleMs
+          ) {
+            startupComplete = true;
+            next();
+            return;
+          }
+        } else {
+          graphSignature = null;
+          graphStableAt = undefined;
+        }
+
+        sendNitroStartingResponse(req, res);
+      });
+    },
+  };
+}
+
+function nitroStartupRecovery(): Plugin {
+  return {
+    name: "agent-native-nitro-startup-recovery",
+    apply: "serve",
+    configureServer(server) {
+      server.middlewares.use(function nitroStartupErrorRecovery(
+        error: unknown,
+        req: IncomingMessage,
+        res: ServerResponse,
+        next: (error?: unknown) => void,
+      ) {
+        if (
+          !isNitroEnvironmentUnavailable(error) ||
+          !isHtmlDocumentRequest(req) ||
+          res.headersSent
+        ) {
+          next(error);
+          return;
+        }
+
+        sendNitroStartingResponse(req, res);
+      });
+    },
+  };
+}
+
 /**
  * Silence benign connection-reset noise from Vite's dev middleware.
  * Fires when a browser closes/reloads/navigates mid-request — the peer has
@@ -2693,6 +2851,7 @@ function createAgentNativePlugins(
     embedDevFrameHeaders(),
     baseRedirectGuard(),
     portExposer(),
+    nitroStartupGate(),
     silenceConnectionResets(),
     rolldownInputFix(),
     // Nitro Vite plugin for dev-mode API route serving and HMR.
@@ -2702,6 +2861,9 @@ function createAgentNativePlugins(
       : includeNitro
         ? [nitroPlugin]
         : []),
+    // Nitro can reject the first document request while its Vite environment
+    // is still importing. This error handler must follow Nitro's middleware.
+    nitroStartupRecovery(),
     includeReactTransform ? createReactTransformPlugin() : null,
     createDesignSystemThemePlugin(options.designSystemTheme),
     createTailwindPlugin(options),
@@ -3096,5 +3258,8 @@ export {
   getDefaultOptimizeDeps as _getDefaultOptimizeDeps,
   findCorePackageRoot as _findCorePackageRoot,
   getReactRouterAliases as _getReactRouterAliases,
+  nitroStartupGate as _nitroStartupGate,
+  nitroStartupRecovery as _nitroStartupRecovery,
+  nitroModuleGraphSignature as _nitroModuleGraphSignature,
   debounceNitroFullReloadHotUpdate as _debounceNitroFullReloadHotUpdate,
 };

package/corpus/templates/crm/.agents/skills/agent-native-docs/SKILL.md

@@ -1,115 +0,0 @@
----
-name: agent-native-docs
-description: >-
-  How to find version-matched Agent Native framework docs and source bundled in
-  node_modules. Use before implementing or answering questions about
-  @agent-native/core APIs, generated apps, workspaces, templates, or advanced
-  features.
-scope: dev
-metadata:
-  internal: true
----
-
-# Agent Native Docs Lookup
-
-## Rule
-
-Before implementing or explaining non-trivial Agent Native behavior, read the
-version-matched docs installed with `@agent-native/core`. When examples,
-imports, or implementation details matter, inspect the packaged source corpus
-too.
-
-## Why
-
-Generated apps and workspaces may be on a different framework version than the
-public docs or model memory. The installed package is the source that matches
-the app in front of you. It also includes a source-only corpus of core and
-first-party templates so agents can replicate current best-practice patterns
-without needing the framework monorepo checkout.
-
-## How
-
-From a generated app directory:
-
-```bash
-pnpm action docs-search --query "<feature>"
-pnpm action docs-search --slug <slug>
-pnpm action docs-search --list
-pnpm action source-search --query "<pattern>"
-pnpm action source-search --path templates/plan/AGENTS.md
-pnpm action source-search --path toolkit/src/index.ts
-pnpm action source-search --list
-```
-
-The headless `pnpm agent` loop and built-in app agent also expose a read-only
-`docs-search` tool with the same `query`, `slug`, and `list` options, plus a
-read-only `source-search` tool with `query`, `path`, and `list`.
-
-If the action runner is unavailable, search the package directly:
-
-```bash
-rg -n "actions|automations|a2a|sharing" node_modules/@agent-native/core/docs
-rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
-```
-
-Then read `node_modules/@agent-native/core/docs/AGENTS.md` or the matching file
-under `node_modules/@agent-native/core/docs/content/`. For source examples,
-read files under `node_modules/@agent-native/core/corpus/core/` or
-`node_modules/@agent-native/core/corpus/templates/`.
-
-Toolkit source is searchable at `toolkit/` in the Core corpus and also ships as
-readable TypeScript under `node_modules/@agent-native/toolkit/src/`. Read
-`customizing-agent-native` before taking ownership of a shared component: inspect package
-source as a read-only reference, then configure, compose, or eject the smallest
-supported unit into app-owned source. Preserve public actions, application
-state, auth, and agent-chat runtime contracts. Never edit `node_modules` or
-deep-import its private source. Manual copying is only the fallback described by
-an unknown third-party package's add-style blueprint.
-
-## Reuse Proven Patterns (rg + cp)
-
-Version-matched installed source outranks web docs or memory: it is the exact
-code shipping with this app. `node_modules/@agent-native/core/corpus/templates/`
-holds source for every first-party template, not just the one this app started
-from, so a pattern from the mail template is fair game for a tasks app. Grep
-across it, then copy a whole file as a starting point instead of writing the
-pattern from scratch:
-
-```bash
-# Find how other templates solved a similar problem
-rg -n "drag.*drop|reorder" node_modules/@agent-native/core/corpus/templates
-
-# Grab a proven action file as a starting point, then adapt names/schema
-cp node_modules/@agent-native/core/corpus/templates/mail/actions/archive-email.ts \
-   actions/archive-item.ts
-
-# Read the full framework source behind an API, not just the corpus copy
-rg -n "defineAction" node_modules/@agent-native/core/src/action.ts
-```
-
-Copying template-level app code (actions, components, skill files) is the
-expected reuse path — templates exist to be forked. This is different from
-copying `core`/`toolkit` **runtime internals**: for those, follow
-`customizing-agent-native`'s configure/compose/eject ladder instead of
-hand-duplicating framework logic.
-
-## Useful Slugs
-
-| Need                           | Slugs                                                         |
-| ------------------------------ | ------------------------------------------------------------- |
-| Actions and typed client calls | `actions`, `client`                                           |
-| SQL, auth, access, sharing     | `database`, `authentication`, `security`, `sharing`           |
-| UI state visible to the agent  | `context-awareness`                                           |
-| Headless and chat-first apps   | `pure-agent-apps`, `agent-surfaces`, `using-your-agent`       |
-| Automations and schedules      | `automations`, `recurring-jobs`                               |
-| Cross-app and external agents  | `a2a-protocol`, `external-agents`, `mcp-protocol`, `mcp-apps` |
-| Skills and instructions        | `skills-guide`, `writing-agent-instructions`                  |
-
-## Don't
-
-- Do not rely on memory for framework APIs when package docs are present.
-- Do not add custom REST wrappers for app data before reading `actions`.
-- Do not add inline LLM calls before reading `using-your-agent` and
-  `agent-surfaces`.
-- Do not copy framework runtime internals when a public API or narrow UI copy
-  will do; read `customizing-agent-native` for the supported override ladder.

package/corpus/templates/crm/.agents/skills/agent-native-toolkit/SKILL.md

@@ -1,177 +0,0 @@
----
-name: agent-native-toolkit
-description: >-
-  Inventory and ownership rules for shared Agent Native workspace UI. Use
-  before building app chrome, settings, navigation, sharing, collaboration,
-  setup, history, comments, chat rails, agent UX, or repeated workspace behavior.
-scope: dev
-metadata:
-  internal: true
----
-
-# Agent-Native Toolkit
-
-Use this skill when deciding whether app chrome, settings, collaboration,
-sharing, navigation, organization, setup, history, comments, or agent UX should
-be built app-locally or moved into reusable framework/toolkit pieces.
-
-## Core Rule
-
-Apps own domain models, domain actions, and product-specific workflows. The
-framework and `@agent-native/toolkit` own repeated workspace behavior users
-expect to work the same everywhere.
-
-Move behavior into shared toolkit primitives when it is:
-
-- workspace-wide, such as settings, nav, search, org membership, or setup
-- agent-visible, such as context, actions, run progress, or proof-of-done
-- governed, such as secrets, permissions, sharing, audit, or billing
-- repeated by two or more apps
-- not tied to one domain model
-
-Keep behavior app-local when the abstraction would hide important domain
-language or make a simple app-specific workflow harder to understand.
-
-## Discover Before Building
-
-Before creating an app-local version of repeated workspace or agent UI:
-
-1. Check the reusable kits below and the installed package documentation.
-2. Search installed public components and source with `docs-search` and
-   `source-search`.
-3. Run `agent-native eject --list` to see the version-matched units published
-   by the packages installed in this app.
-4. Read `customizing-agent-native` and configure, compose, or eject the
-   smallest unit instead of recreating shared behavior from memory.
-
-Use public package exports at runtime. Published source and ejection manifests
-are discovery and ownership-transfer mechanisms, not private runtime APIs.
-
-## Design-System Boundary
-
-Every app keeps an explicit design-system seam in `app/design-system.ts` using
-`defineDesignSystem` from `@agent-native/toolkit/design-system`, and supplies it
-to `ToolkitProvider`. The semantic contract contains:
-
-- nine leaf components: `ActionButton`, `IconButton`, `TextField`, `TextArea`,
-  `Spinner`, `Skeleton`, `Status`, `Surface`, and `Avatar`
-- eight behavior components: `Tooltip`, `Menu`, `Popover`, `Dialog`, `Picker`,
-  `Checkbox`, `Switch`, and `Tabs`
-
-These are semantic contracts, not styling contracts. An adapter may use
-Tailwind/shadcn, MUI-style theme providers, React Aria, CSS modules, CSS-in-JS,
-or another React design system. Do not assume CVA, utility classes, or even a
-`className`; behavior adapters may supply their overlay and focus
-implementation wholesale while honoring portal, focus-restoration, keyboard,
-dismissal, ARIA, and z-index interoperability.
-
-Pages, routes, and domain components import ordinary controls through the app's
-local adapter layer, usually `@/components/ui/*`. They must not import
-`@agent-native/toolkit/ui/*` directly. Toolkit feature exports are still the
-right home for shared workspace behavior; their presentation flows through the
-registered semantic components, feature controller, and product-level slots.
-
-Customer adapter packages are normal npm packages imported explicitly by the
-app. Never auto-detect them or load React components from JSON. Run the adapter
-against `@agent-native/toolkit/conformance` in customer CI before adopting it.
-
-## Settings Direction
-
-Durable settings belong in the Settings app or a registered settings route. The
-agent sidebar should not become a second settings app. It can show contextual
-quick controls and deep links such as:
-
-- `/settings/ai`
-- `/settings/connections`
-- `/settings/secrets`
-- `/settings/usage`
-- `/settings/apps/:appId`
-
-The shared Account section is the canonical profile surface at
-`/settings#account`. It owns the editable display name and existing avatar
-control through the authenticated `get-user-profile` and `update-user-profile`
-actions. Shared workspace chrome such as `OrgSwitcher` should link to this
-surface rather than creating an app-local profile page.
-
-When adding a new API key, OAuth grant, provider connection, model selector, app
-preference, notification preference, or usage/billing surface, register it as a
-settings tab or app settings panel first. Only add sidebar UI when it is needed
-in the moment of agent use.
-
-## Reusable Kits
-
-- **Settings kit**: a searchable settings page with account, workspace, AI
-  models, LLM keys, connections, secrets, usage, notifications, changelog, and
-  app-specific panels. Search is on by default; register a `SettingsSearchEntry`
-  per control so users find settings by name across tabs.
-- **Collaboration kit**: Yjs docs, presence, agent presence, live cursors,
-  remote selections, recent edit highlights, real-time sync indicators, and
-  undo/redo grouping.
-- **Sharing kit**: private/workspace/org/public-link access, invites, roles,
-  expirations, agent-readable links, and resource registration.
-- **Navigation and command kit**: app shell, side nav, breadcrumbs, app switcher,
-  command palette entries, recent resources, pinned resources, and global search.
-- **Organization kit**: folders, tags, favorites, archive, trash, ownership,
-  membership, and common resource metadata.
-- **Setup and connections kit**: declarative setup requirements, model readiness,
-  missing-secret states, OAuth grants, and provider connection health.
-- **Agent UX kit**: sidebar, composer, staged context, mentions, voice, human
-  approval, generative UI, progress, and screen-state exposure.
-- **Chat history kit**: presentational chat lists and recent-chat rails belong
-  in Toolkit; Core keeps thread persistence, agent execution, transport, and
-  page-to-sidebar handoff. Use Toolkit's `ChatHistoryRail` for the standard
-  five-item sidebar preview and a footer row with New chat followed by an
-  ellipsis disclosure up to fifteen. Apps inject routing, labels, and domain
-  actions.
-- **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
-  `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
-  Access tabs plus a Personal/Organization scope toggle. The canonical home
-  for context transparency, MCP servers, A2A remote agents, recurring
-  jobs/automations, and external-client connect flows. See the `agent-page`
-  skill.
-- **History and recovery kit**: audit log, activity feed, version history,
-  checkpoints, undo, redo, restore, and proof-of-done.
-- **Comments and review kit**: anchored comments, pins, mentions, review
-  requests, resolved threads, agent follow-up tasks, and notifications.
-- **Workflow and observability kit**: notifications, approvals, scheduled work,
-  background runs, recurring jobs, traces, evals, feedback, and run timelines.
-
-## Implementation Checklist
-
-When adding or refactoring one of these areas:
-
-1. Search existing framework and template code for duplicated UI or actions.
-2. Decide the shared contract: data shape, action API, feature-level headless
-   controller, default view, semantic components, and product-level render
-   slots.
-3. Keep shared data provider-agnostic and scoped by auth/sharing rules.
-4. Expose the same capability to the UI and agent through actions or documented
-   client helpers.
-5. Register app-specific labels, routes, resource adapters, and settings panels
-   instead of hardcoding app names in core UI.
-6. Update docs and relevant skills so future apps discover the shared path.
-7. Keep the component easy to adopt piecemeal: expose props/slots first and
-   ship readable source plus a complete ejection unit so apps can take ownership
-   of the smallest feature when needed. See `customizing-agent-native` for the
-   configure → compose → eject → propose seam ladder.
-8. Keep one controller as the source of truth for the default and custom render
-   paths. A custom design must not fork actions, analytics, async state, or
-   accessibility behavior.
-9. Verify the default adapter and at least one non-Tailwind adapter with the
-   conformance kit, including focus and portal stacking across mixed overlay
-   implementations.
-
-## Related Skills
-
-Read these alongside this skill when the work touches the specific area:
-
-- `sharing`
-- `real-time-collab`
-- `real-time-sync`
-- `client-side-routing`
-- `context-awareness`
-- `onboarding`
-- `secrets`
-- `audit-log`
-- `observability`
-- `frontend-design`