@agent-native/core 0.14.8 → 0.15.0

package/dist/templates/workspace-core/.agents/skills/voice-transcription/SKILL.md

@@ -0,0 +1,124 @@
+---
+name: voice-transcription
+description: >-
+  Framework-wide voice dictation in the agent sidebar composer. Use when
+  changing composer microphone UX, the transcribe-voice route, or the
+  Voice Transcription settings section. Covers transcription-source routing,
+  cleanup routing, Google realtime gating, and the voice transcription
+  application-state keys.
+---
+
+# Voice Transcription
+
+Click-to-toggle microphone inside the sidebar composer turns speech into
+text. Users configure live transcription separately from AI cleanup in
+Settings → Voice Transcription. The feature is available in every template
+that renders `TiptapComposer`.
+
+## UX rules
+
+- **Always show the mic alongside the send button.** Cursor replaces send
+  with mic when the composer is empty; their users complain. We keep both
+  visible — Lovable does the same.
+- **Click-to-toggle, not push-to-talk.** More forgiving in a sidebar, avoids
+  host-app hotkey clashes. Keyboard shortcut is `Cmd/Ctrl+Shift+M` and
+  `Escape` cancels mid-recording.
+- **Transcript lands in the composer, editable, never auto-sent.** Insert at
+  the caret via `editor.chain().focus().insertContent(text).run()`.
+- **No CSS transitions for the recording state.** Framework rule; use static
+  brand color (`#625DF5`) instead of pulses.
+- **Icon:** Tabler `IconMicrophone` (idle) / `IconPlayerStopFilled` (recording).
+  Never use a sparkle or robot icon.
+- **Errors via inline alert or toast, never `window.alert`.**
+
+## Source And Cleanup
+
+Settings must keep these as separate choices:
+
+- **Live transcription source**: `mac-native`, `google-realtime`, or `batch`.
+- **AI cleanup**: independent off/on toggle. Cleanup uses Builder Gemini first
+  when hosted Gemini is configured, then BYOK Gemini (`GEMINI_API_KEY`).
+  Gemini cleanup/title/summary generation is not a live STT source.
+
+`application_state["voice-transcription-prefs"]` stores
+`{ transcriptionMode, provider, instructions }`. The legacy `provider` field
+is still written for old clients and batch provider preferences:
+
+| Value             | Meaning                                                        | Needs key                    |
+| ----------------- | -------------------------------------------------------------- | ---------------------------- |
+| `mac-native`      | Native macOS/Tauri speech path; web clients normalize to browser-native where needed | No                           |
+| `google-realtime` | Dedicated WebSocket → Google Speech-to-Text gRPC `StreamingRecognize` path | `GOOGLE_APPLICATION_CREDENTIALS` |
+| `batch`           | Upload audio after stop through the existing batch route       | Builder/Gemini/Groq/OpenAI depending on fallback |
+| `auto` provider   | Existing batch fallback chain                                  | Any configured batch provider |
+| `builder-gemini`  | Builder Gemini Flash-Lite batch/cleanup preference             | hosted Gemini provider connected |
+| `gemini`          | Direct Google Gemini BYOK batch/cleanup preference             | `GEMINI_API_KEY`             |
+| `groq`            | Groq Whisper batch preference                                  | `GROQ_API_KEY`               |
+| `openai`          | OpenAI Whisper batch preference                                | `OPENAI_API_KEY`             |
+| `browser`         | Legacy native/browser live speech preference                   | No                           |
+
+Default behavior:
+
+- The shared web settings/composer default to Batch / `auto`.
+- Dedicated macOS Tauri-native surfaces may save `mac-native`, but do not
+  assume the shared React settings default to it.
+- Old stored `builder` values are treated as `builder-gemini`.
+- Old stored `browser` values are treated as `mac-native`.
+- Saved `google-realtime` preferences must never hit `/_agent-native/transcribe-voice`. They go through the dedicated session bridge `POST /_agent-native/transcribe-stream/session`, which mints an opaque ai-services websocket session and keeps the Google service-account JSON off the client.
+- In the current bridge, the Google option is only actually ready when both the user's `GOOGLE_APPLICATION_CREDENTIALS` secret exists and Builder is connected, because the framework mints the managed ai-services session with Builder auth before streaming begins.
+
+## Where the pieces live
+
+| File                                                                  | Purpose                                             |
+| --------------------------------------------------------------------- | --------------------------------------------------- |
+| `packages/core/src/client/composer/useVoiceDictation.ts`              | Provider-routing hook (MediaRecorder / Web Speech)  |
+| `packages/core/src/client/composer/VoiceButton.tsx`                   | Mic button + live amplitude + cancel overlay        |
+| `packages/core/src/client/composer/TiptapComposer.tsx`                | Wires the hook, insertion, and keyboard shortcut    |
+| `packages/core/src/client/settings/VoiceTranscriptionSection.tsx`     | Live source + cleanup controls in sidebar settings  |
+| `packages/core/src/client/transcription/BuilderTranscriptionCta.tsx`  | CTA shown when Builder account isn't connected      |
+| `packages/core/src/client/transcription/use-live-transcription.ts`    | Web Speech live-transcription hook for recordings   |
+| `packages/core/src/server/transcribe-voice.ts`                        | Route handler (routes to Builder/Gemini/Groq/Whisper) |
+| `packages/core/src/transcription/builder-transcription.ts`            | Builder proxy transcription client                  |
+| `packages/core/src/secrets/register-framework-secrets.ts`             | Framework-level provider key registration           |
+
+## Key resolution (server)
+
+`transcribe-voice.ts` is batch-only. Do not add realtime streaming to this
+route. Google Speech-to-Text realtime uses a dedicated audio-frame protocol:
+client audio frames → `/_agent-native/transcribe-stream/session` →
+ai-services WebSocket → Google gRPC `StreamingRecognize` → partial / final
+transcript events. Use the canonical docs URL:
+https://cloud.google.com/speech-to-text/v2/docs/streaming-recognize
+
+Batch routing is based on the user's provider preference:
+
+1. If `builder-gemini` and `resolveHasBuilderPrivateKey()` → calls `transcribeWithBuilder({ model: "gemini-3-1-flash-lite" })` via Builder proxy, or uses Builder Gemini Flash-Lite to clean up a live native/browser transcript when the desktop client sends text instead of audio.
+2. If `builder` and `resolveHasBuilderPrivateKey()` → legacy alias; prefer `builder-gemini`.
+3. If `gemini` → resolves `GEMINI_API_KEY` and calls the direct Google Gemini path.
+4. If `groq` → resolves `GROQ_API_KEY` and calls Groq's Whisper-compatible endpoint.
+5. If `openai` → resolves `OPENAI_API_KEY`:
+   - `readAppSecret({ key: "OPENAI_API_KEY", scope: "user", scopeId: session.email })` — user's encrypted secret.
+   - `resolveCredential("OPENAI_API_KEY")` — env var + SQL settings fallback.
+
+In auto mode / no preference, the route tries Builder Gemini Flash-Lite first
+when Builder is connected, then Gemini BYOK, Groq, and OpenAI.
+When a request includes `instructions`, pass them through to the selected LLM
+provider. Gemini uses them in the transcription prompt, Builder receives them
+as transcription/cleanup instructions, and Whisper-compatible providers receive
+them as provider prompt/context.
+
+Never hardcode a shared key. Never log the value. Never echo it back to the
+client.
+
+## Overriding per-template
+
+Templates can:
+- **Disable the mic**: pass `voiceEnabled={false}` to `TiptapComposer`.
+- **Replace the button**: wrap `TiptapComposer` and render your own `extraActionButton` (the framework mic sits between `extraActionButton` and the send button).
+- **Pre-register provider keys as `required: true`**: call `registerRequiredSecret(...)` from your own server plugin when a template needs a specific BYOK provider in onboarding.
+
+## Don'ts
+
+- Don't call transcription providers from the client — go through `/_agent-native/transcribe-voice` so the user's secret stays server-side.
+- Don't remove the cancel affordance — mic permission abuse paranoia is real.
+- Don't auto-submit the transcript — users always edit before sending.
+- Don't copy Cursor's "hide send when empty" pattern — it confuses users.

package/dist/templates/workspace-core/AGENTS.md

@@ -11,12 +11,22 @@ agent should know.
 
 ## Shared Conventions
 
+- All AI/LLM behavior goes through the app's agent chat. UI and server code
+  must not call model providers, AI SDK `generateText()` / `streamText()`, or
+  other inline LLM APIs directly. Use `sendToAgentChat()` for local app-agent
+  work, and read `.agents/skills/delegate-to-agent/SKILL.md` before building
+  agent-driven UI or "AI" features.
 - Put shared code in `packages/shared` only when multiple apps need it.
 - Keep app-specific screens, actions, state, and skills inside `apps/<app>`.
 - Store shared runtime configuration in the workspace root `.env`; use
   `apps/<app>/.env` only for app-specific overrides.
 - Prefer framework defaults until the workspace has a real custom rule,
   component, plugin, action, or skill to share.
+- Keep the Workspace files view for user-authored or user-requested resources.
+  Agents may create hidden `agent_scratch` resources for temporary working
+  notes, scripts, task plans, or intermediate outputs, but should promote them
+  to normal workspace visibility only when the user explicitly asks to keep or
+  manage the file.
 
 ## Adding Apps
 
@@ -33,6 +43,10 @@ Do not implement a new app by adding a route, page, component, or file to
 `apps/starter` or another existing app unless the user explicitly asks to modify
 that existing app.
 
+Dispatch vault access is workspace-wide by default: every saved vault key is
+available to every workspace app. Only create or request per-app vault grants
+when Dispatch's vault access setting is switched to manual mode.
+
 Workspace apps are discovered from `apps/<app-name>/package.json`. There is no
 separate workspace app registry to edit for Dispatch to list the app. Use
 relative workspace links like `/<app-name>` and never hardcode `localhost`,
@@ -42,7 +56,8 @@ port. React Router apps must preserve `APP_BASE_PATH` / `VITE_APP_BASE_PATH` in
 `app/entry.client.tsx` via `appBasePath()` so the app hydrates correctly when
 mounted at `/<app-name>`. Use the framework/template UI stack for standard UI:
 shadcn/ui components and `@tabler/icons-react`. Do not add `lucide-react` or
-another icon library.
+another icon library. Read `.agents/skills/shadcn-ui/SKILL.md` before adding,
+updating, or debugging shadcn components.
 
 In local development, run
 `pnpm exec agent-native create <app-name> --template=<template>` from the

package/dist/templates/workspace-root/AGENTS.md

@@ -3,6 +3,27 @@
 These instructions apply at the workspace root. App-specific behavior belongs
 in `apps/<app>/AGENTS.md`; shared cross-app behavior belongs in
 `packages/shared/AGENTS.md` or `packages/shared/.agents/skills/`.
+The root `.agents/skills` path points at the shared package's skills so local
+coding agents can discover the same workspace-wide guidance from the root.
+
+## Core Agent Rule
+
+- All AI/LLM behavior goes through the app's agent chat. UI and server code
+  must not call model providers, AI SDK `generateText()` / `streamText()`, or
+  other inline LLM APIs directly. Use `sendToAgentChat()` for local app-agent
+  work, and read `packages/shared/.agents/skills/delegate-to-agent/SKILL.md`
+  before building agent-driven UI or "AI" features.
+
+## Workspace Resources
+
+- The Workspace files view is for user-authored or user-requested resources
+  they intentionally add, edit, or manage.
+- Agents may use hidden `agent_scratch` resources for temporary working notes,
+  scripts, task plans, or intermediate outputs. Keep those scratch files hidden
+  by default and promote them only when the user explicitly asks to keep or
+  manage the file.
+- Durable instructions, skills, jobs, memories, custom agents, and files the
+  user explicitly asked to save belong in normal workspace visibility.
 
 ## Workspace Scope
 
@@ -26,6 +47,9 @@ in `apps/<app>/AGENTS.md`; shared cross-app behavior belongs in
   `/<app-id>`.
 - When a user explicitly asks for a new app or workspace app, create the
   separate workspace app.
+- Dispatch vault access is workspace-wide by default: every saved vault key is
+  available to every workspace app. Only create or request per-app vault grants
+  when Dispatch's vault access setting is switched to manual mode.
 - Do not satisfy a new-app request by adding a route, page, component, or file
   to `apps/starter` or another existing app unless the user explicitly asks to
   modify that existing app.
@@ -44,6 +68,15 @@ in `apps/<app>/AGENTS.md`; shared cross-app behavior belongs in
   base template improvements continue to flow automatically.
 - Workspace apps are discovered from `apps/<app-id>/package.json`. There is no
   separate workspace app registry to edit for Dispatch to list the app.
+- Always save a concise, human-readable `description` in the generated app's
+  `apps/<app-id>/package.json`. Dispatch lists and A2A connected-agent context
+  use the app name plus this description so other agents understand what the app
+  does. Dispatch users can later edit the displayed name/description from the
+  Apps page without changing source.
+- All sibling workspace apps are accessible by default over A2A through
+  `call-agent`. Agents receive a compact list of available app names and
+  descriptions in prompt context; use tool search or app-specific actions only
+  when more detail is needed.
 - Use relative workspace links like `/<app-id>`. Never hardcode
   `localhost`, `127.0.0.1`, `8080`, `8100`, or any dev port in app cards,
   instructions, redirects, or navigation; the active workspace gateway/browser
@@ -53,6 +86,8 @@ in `apps/<app>/AGENTS.md`; shared cross-app behavior belongs in
   when mounted at `/<app-id>`.
 - Use the framework/template UI stack for standard UI: shadcn/ui components and
   `@tabler/icons-react`. Do not add `lucide-react` or another icon library.
+  Read `packages/shared/.agents/skills/shadcn-ui/SKILL.md` before adding,
+  updating, or debugging shadcn components.
 - In local development, scaffold the app from the workspace root with
   `pnpm exec agent-native create <app-id> --template=<template>`. In production
   Dispatch posts the request to Builder branch creation; the Builder branch

package/dist/templates/workspace-root/README.md

@@ -33,6 +33,9 @@ Apps don't need any configuration to opt in. Discovery happens via the
 `agent-native.workspaceCore` field in this root `package.json`, which names
 the shared package (`@{{APP_NAME}}/shared`).
 
+The workspace root also links `.agents/skills` to the shared package so coding
+agents launched from the root can discover the same workspace-wide skills.
+
 ## Getting started
 
 ```bash
@@ -49,6 +52,10 @@ watches `apps/`, so newly-created apps are detected without restarting
 links should stay relative, such as `/starter` or `/<app-id>`; do not hardcode
 localhost or dev ports because the active gateway origin owns the port.
 
+Dispatch vault keys are workspace-wide by default: every saved vault key is
+available to every workspace app and can be synced from Dispatch. Switch the
+Vault page to manual access only when you need explicit per-app key grants.
+
 ## Workspace org identity
 
 Set these root `.env` values before production deploys or when repairing

package/dist/vite/action-types-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"action-types-plugin.d.ts","sourceRoot":"","sources":["../../src/vite/action-types-plugin.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AA6RnC;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAuC1C;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAG1E"}
+{"version":3,"file":"action-types-plugin.d.ts","sourceRoot":"","sources":["../../src/vite/action-types-plugin.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAiSnC;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAuC1C;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAG1E"}

package/dist/vite/action-types-plugin.js

@@ -50,6 +50,10 @@ const CORE_SHARING_ACTIONS = [
         name: "set-resource-visibility",
         specifier: "@agent-native/core/sharing/actions/set-resource-visibility",
     },
+    {
+        name: "upload-image",
+        specifier: "@agent-native/core/file-upload/actions/upload-image",
+    },
 ];
 function scanActionFiles(actionsDir) {
     let files;

package/dist/vite/action-types-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-types-plugin.js","sourceRoot":"","sources":["../../src/vite/action-types-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,oEAAoE;AACpE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,SAAS;IACT,KAAK;IACL,YAAY;IACZ,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAA+C;IACvE;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,mDAAmD;KAC/D;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,qDAAqD;KACjE;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,yDAAyD;KACrE;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,4DAA4D;KACxE;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,mEAAmE;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,8BAA8B;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,sBAAsB,GAC1B,oDAAoD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACjE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,OAAe;IACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;QACnC,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,WAAmB;IACtD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;gBACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxD,aAAa,GAAG,GAAG,CAAC;oBACpB,WAAW,GAAG,QAAQ,CAAC;oBACvB,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACjE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7D,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpD,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;oBACpE,IAAI,GAAG,CAAC,WAAW,EAAE;wBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACnD,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,UAAkB,EAClB,WAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE5E,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,oBAAoB,GAAG,mBAAmB;QAC9C,CAAC,CAAC,eAAe,CAAC,mBAAmB,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;IAEP,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAE3D,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,GAAG,aAAa,IAAI,IAAI,EAAE;SACpC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,mBAAmB,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9C,MAAM,OAAO,GAAG,IAAI;iBACjB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;iBACtD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACtC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1D,OAAO,QAAQ,IAAI,iCAAiC,OAAO,MAAM,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0EAA0E;IAC1E,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACpD,WAAW,CAAC,IAAI,CACd,QAAQ,KAAK,CAAC,IAAI,iCAAiC,KAAK,CAAC,SAAS,MAAM,CACzE,CAAC;QACF,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;EAerB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;CAKvB,CAAC;IAEA,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC,CAAC;IAErE,2EAA2E;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,UAAU,OAAO,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;QACrD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,wDAAwD;IACxD,iEAAiE;IACjE,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,UAAU,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;QAC3D,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,eAAe,GAAG;;;;EAIxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;;EAGlB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;;;CAInB,CAAC;IAEA,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC;IAE1E,sCAAsC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,mBAAmB,GAAkB,IAAI,CAAC;IAE9C,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,cAAc,CAAC,MAAM;YACnB,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;YAC1B,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAClD,mBAAmB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;QACjE,CAAC;QACD,UAAU;YACR,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,eAAe,CAAC,MAAM;YACpB,sBAAsB;YACtB,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAEjD,gCAAgC;YAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE;gBACpC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBACjD,MAAM,kBAAkB,GAAG,mBAAmB;oBAC5C,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;oBACtC,CAAC,CAAC,KAAK,CAAC;gBACV,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpE,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxB,IAAI,mBAAmB;gBAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACnC,qEAAqE;YACrE,uEAAuE;YACvE,6CAA6C;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxD,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC","sourcesContent":["/**\n * Vite plugin that generates end-to-end type-safe action types AND a runtime\n * registry of static imports so bundlers (Nitro on Netlify/Vercel/AWS-Lambda,\n * Rolldown, etc.) include every action file in the server bundle.\n *\n * Watches the `actions/` directory and emits:\n *   - `.generated/action-types.d.ts` — type-only module that augments the\n *     `ActionRegistry` interface in `@agent-native/core/client`, giving\n *     `useActionQuery`/`useActionMutation` full inference.\n *   - `.generated/actions-registry.ts` — runtime registry keyed by action\n *     name, with static `import` statements for every action. Templates\n *     import this file from their `server/plugins/agent-chat.ts` so Nitro\n *     bundles the actions into the server function; without it the runtime\n *     `fs.readdirSync` inside `autoDiscoverActions` finds nothing in a\n *     bundled serverless function and every action route 404s.\n */\nimport path from \"path\";\nimport fs from \"fs\";\nimport type { Plugin } from \"vite\";\n\n/** Files to skip during discovery (matches action-discovery.ts). */\nconst SKIP_FILES = new Set([\n  \"helpers\",\n  \"run\",\n  \"db-connect\",\n  \"db-status\",\n  \"registry\",\n]);\n\n/**\n * Framework-level sharing actions that must ALWAYS be in the generated\n * registry, even when the template's `actions/` directory doesn't contain\n * them. Each entry maps the action name to the bare-specifier import path so\n * bundlers see a static import and pull the module into the server bundle.\n *\n * Order matters: templates can override by defining a same-named file in\n * their own `actions/` directory — the merge below is skip-existing.\n */\nconst CORE_SHARING_ACTIONS: Array<{ name: string; specifier: string }> = [\n  {\n    name: \"share-resource\",\n    specifier: \"@agent-native/core/sharing/actions/share-resource\",\n  },\n  {\n    name: \"unshare-resource\",\n    specifier: \"@agent-native/core/sharing/actions/unshare-resource\",\n  },\n  {\n    name: \"list-resource-shares\",\n    specifier: \"@agent-native/core/sharing/actions/list-resource-shares\",\n  },\n  {\n    name: \"set-resource-visibility\",\n    specifier: \"@agent-native/core/sharing/actions/set-resource-visibility\",\n  },\n];\n\nfunction scanActionFiles(actionsDir: string): string[] {\n  let files: string[];\n  try {\n    files = fs.readdirSync(actionsDir);\n  } catch {\n    return [];\n  }\n  return files.filter((f) => {\n    if (!f.endsWith(\".ts\") && !f.endsWith(\".js\")) return false;\n    const name = f.replace(/\\.(ts|js)$/, \"\");\n    if (name.startsWith(\"_\")) return false;\n    if (SKIP_FILES.has(name)) return false;\n    // Only include files that actually call defineAction or explicitly\n    // re-export a package action. CLI scripts or example templates that live\n    // in actions/ but don't export an action would otherwise drag their own\n    // (often app/, browser-only, or fs-only) imports into the serverless\n    // bundle and fail to resolve.\n    try {\n      const content = fs.readFileSync(path.join(actionsDir, f), \"utf-8\");\n      const reexportsDefaultAction =\n        /export\\s*\\{\\s*default\\s*\\}\\s*from\\s*[\"'][^\"']+[\"']/.test(content);\n      if (!content.includes(\"defineAction\") && !reexportsDefaultAction) {\n        return false;\n      }\n    } catch {\n      return false;\n    }\n    return true;\n  });\n}\n\nfunction toIdent(name: string): string {\n  return \"a_\" + name.replace(/[^a-zA-Z0-9_]/g, \"_\");\n}\n\nfunction writeIfChanged(outFile: string, content: string): void {\n  const existing = fs.existsSync(outFile)\n    ? fs.readFileSync(outFile, \"utf-8\")\n    : \"\";\n  if (existing !== content) {\n    fs.mkdirSync(path.dirname(outFile), { recursive: true });\n    fs.writeFileSync(outFile, content);\n  }\n}\n\nfunction findWorkspaceCoreActionsDir(projectRoot: string): string | null {\n  let dir = path.resolve(projectRoot);\n  let workspaceRoot: string | null = null;\n  let packageName: string | null = null;\n\n  for (let i = 0; i < 20; i++) {\n    const pkgPath = path.join(dir, \"package.json\");\n    if (fs.existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n        const declared = pkg?.[\"agent-native\"]?.workspaceCore;\n        if (typeof declared === \"string\" && declared.length > 0) {\n          workspaceRoot = dir;\n          packageName = declared;\n          break;\n        }\n      } catch {\n        // Keep walking on malformed package.json.\n      }\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n\n  if (!workspaceRoot || !packageName) return null;\n\n  const nm = path.join(workspaceRoot, \"node_modules\", packageName);\n  if (fs.existsSync(path.join(nm, \"package.json\"))) {\n    const actionsDir = path.join(fs.realpathSync(nm), \"actions\");\n    return fs.existsSync(actionsDir) ? actionsDir : null;\n  }\n\n  const packagesDir = path.join(workspaceRoot, \"packages\");\n  const candidates: string[] = [];\n  if (fs.existsSync(packagesDir)) {\n    for (const entry of fs.readdirSync(packagesDir, { withFileTypes: true })) {\n      if (!entry.isDirectory()) continue;\n      candidates.push(path.join(packagesDir, entry.name));\n      if (entry.name.startsWith(\"@\")) {\n        const scopeDir = path.join(packagesDir, entry.name);\n        for (const sub of fs.readdirSync(scopeDir, { withFileTypes: true })) {\n          if (sub.isDirectory()) candidates.push(path.join(scopeDir, sub.name));\n        }\n      }\n    }\n  }\n\n  for (const candidate of candidates) {\n    const pkgPath = path.join(candidate, \"package.json\");\n    if (!fs.existsSync(pkgPath)) continue;\n    try {\n      const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n      if (pkg?.name === packageName) {\n        const actionsDir = path.join(candidate, \"actions\");\n        return fs.existsSync(actionsDir) ? actionsDir : null;\n      }\n    } catch {\n      // Ignore malformed package.json.\n    }\n  }\n\n  return null;\n}\n\n/**\n * Scan the actions directory and emit the types + runtime registry files.\n * Only writes files whose content has changed, to avoid triggering rebuilds.\n */\nfunction generateActionArtifacts(\n  actionsDir: string,\n  projectRoot: string,\n): void {\n  const outDir = path.resolve(projectRoot, \".generated\");\n  const relActionsDir = path.relative(outDir, actionsDir).replace(/\\\\/g, \"/\");\n\n  const actionFiles = scanActionFiles(actionsDir);\n  const workspaceActionsDir = findWorkspaceCoreActionsDir(projectRoot);\n  const workspaceActionFiles = workspaceActionsDir\n    ? scanActionFiles(workspaceActionsDir)\n    : [];\n\n  // Pre-compute template action names — used for skip-existing logic in both\n  // the type declarations and the runtime registry below.\n  const templateActionNames = new Set<string>(\n    actionFiles.map((f) => f.replace(/\\.(ts|js)$/, \"\")),\n  );\n  const registeredActionNames = new Set(templateActionNames);\n\n  const actionSources = actionFiles.map((f) => {\n    const name = f.replace(/\\.(ts|js)$/, \"\");\n    return {\n      name,\n      relPath: `${relActionsDir}/${name}`,\n    };\n  });\n\n  if (workspaceActionsDir) {\n    for (const f of workspaceActionFiles) {\n      const name = f.replace(/\\.(ts|js)$/, \"\");\n      if (registeredActionNames.has(name)) continue;\n      const relPath = path\n        .relative(outDir, path.join(workspaceActionsDir, name))\n        .replace(/\\\\/g, \"/\");\n      actionSources.push({ name, relPath });\n      registeredActionNames.add(name);\n    }\n  }\n\n  // --- types file ---------------------------------------------------------\n  const typeEntries = actionSources.map(({ name, relPath }) => {\n    return `    \"${name}\": ActionEntry<typeof import(\"${relPath}\")>;`;\n  });\n\n  // Also declare types for framework-level sharing actions so callers don't\n  // need `as any` casts (same skip-existing logic as the runtime registry).\n  for (const entry of CORE_SHARING_ACTIONS) {\n    if (registeredActionNames.has(entry.name)) continue;\n    typeEntries.push(\n      `    \"${entry.name}\": ActionEntry<typeof import(\"${entry.specifier}\")>;`,\n    );\n    registeredActionNames.add(entry.name);\n  }\n\n  const typesContent = `// AUTO-GENERATED by @agent-native/core — do not edit manually.\n// Regenerated when files in actions/ change.\n// This file augments the ActionRegistry interface so that useActionQuery and\n// useActionMutation infer the correct types from your action definitions.\n\n/** Extract the return type and parameter type from a defineAction module. */\ntype ActionEntry<T> = T extends { default: { run: (...args: infer A) => infer R } }\n  ? {\n      result: Awaited<R>;\n      params: A extends [infer P, ...any[]] ? P : Record<string, any>;\n    }\n  : { result: any; params: Record<string, any> };\n\ndeclare module \"@agent-native/core/client\" {\n  interface ActionRegistry {\n${typeEntries.join(\"\\n\")}\n  }\n}\n\nexport {};\n`;\n\n  writeIfChanged(path.join(outDir, \"action-types.d.ts\"), typesContent);\n\n  // --- runtime registry ---------------------------------------------------\n  // Static imports of each action's default export so bundlers see every\n  // action and include it in the server bundle. Normalization matches\n  // `loadActionsIntoRegistry` in server/action-discovery.ts.\n  const imports: string[] = [];\n  const entries: string[] = [];\n  const runtimeActionNames = new Set<string>();\n  for (const { name, relPath } of actionSources) {\n    const ident = toIdent(name);\n    imports.push(`import * as ${ident} from \"${relPath}\";`);\n    entries.push(`  ${JSON.stringify(name)}: ${ident},`);\n    runtimeActionNames.add(name);\n  }\n  // Framework-level sharing actions — only added when the template hasn't\n  // provided a same-named file (skip-existing merge). Static imports ensure\n  // bundlers pull these modules into the server bundle so\n  // `/_agent-native/actions/share-resource` (etc.) always resolve.\n  for (const entry of CORE_SHARING_ACTIONS) {\n    if (runtimeActionNames.has(entry.name)) continue;\n    const ident = toIdent(entry.name);\n    imports.push(`import * as ${ident} from \"${entry.specifier}\";`);\n    entries.push(`  ${JSON.stringify(entry.name)}: ${ident},`);\n    runtimeActionNames.add(entry.name);\n  }\n\n  const registryContent = `// AUTO-GENERATED by @agent-native/core — do not edit manually.\n// Static-import registry of every action file. Bundlers (Nitro, Rolldown)\n// see these imports and include the action modules in the server bundle.\n// The agent-chat plugin normalizes each module into an ActionEntry shape.\n${imports.join(\"\\n\")}\n\nconst modules: Record<string, unknown> = {\n${entries.join(\"\\n\")}\n};\n\nexport default modules;\n`;\n\n  // Always write the registry — even when the template has no actions/ files\n  // we still emit imports for the framework-level sharing actions so they get\n  // mounted on every template that consumes the registry.\n  writeIfChanged(path.join(outDir, \"actions-registry.ts\"), registryContent);\n\n  // Ensure .generated/ is in .gitignore\n  const gitignorePath = path.join(projectRoot, \".gitignore\");\n  if (fs.existsSync(gitignorePath)) {\n    const gitignore = fs.readFileSync(gitignorePath, \"utf-8\");\n    if (!gitignore.includes(\".generated\")) {\n      fs.appendFileSync(gitignorePath, \"\\n.generated/\\n\");\n    }\n  }\n}\n\n/**\n * Vite plugin that watches `actions/` and generates type-safe action types.\n *\n * Add to your Vite config (auto-included by `defineConfig` from `@agent-native/core`):\n *\n * ```ts\n * import { actionTypesPlugin } from \"@agent-native/core/vite/action-types-plugin\";\n * plugins: [actionTypesPlugin()]\n * ```\n */\nexport function actionTypesPlugin(): Plugin {\n  let projectRoot = \"\";\n  let actionsDir = \"\";\n  let workspaceActionsDir: string | null = null;\n\n  return {\n    name: \"agent-native-action-types\",\n    configResolved(config) {\n      projectRoot = config.root;\n      actionsDir = path.resolve(projectRoot, \"actions\");\n      workspaceActionsDir = findWorkspaceCoreActionsDir(projectRoot);\n    },\n    buildStart() {\n      generateActionArtifacts(actionsDir, projectRoot);\n    },\n    configureServer(server) {\n      // Generate on startup\n      generateActionArtifacts(actionsDir, projectRoot);\n\n      // Watch for changes in actions/\n      const watcher = server.watcher;\n      const handleChange = (file: string) => {\n        const inAppActions = file.startsWith(actionsDir);\n        const inWorkspaceActions = workspaceActionsDir\n          ? file.startsWith(workspaceActionsDir)\n          : false;\n        if ((inAppActions || inWorkspaceActions) && /\\.(ts|js)$/.test(file)) {\n          generateActionArtifacts(actionsDir, projectRoot);\n        }\n      };\n      watcher.add(actionsDir);\n      if (workspaceActionsDir) watcher.add(workspaceActionsDir);\n      watcher.on(\"add\", handleChange);\n      watcher.on(\"unlink\", handleChange);\n      // Don't regenerate on content changes — only file additions/removals\n      // affect the registry. Return type changes are picked up by TypeScript\n      // from the source files via typeof import().\n    },\n  };\n}\n\n/**\n * Public helper to regenerate the types + registry from a non-Vite context\n * (e.g. the Nitro deploy build, where Vite plugins don't run).\n */\nexport function generateActionRegistryForProject(projectRoot: string): void {\n  const actionsDir = path.resolve(projectRoot, \"actions\");\n  generateActionArtifacts(actionsDir, projectRoot);\n}\n"]}
+{"version":3,"file":"action-types-plugin.js","sourceRoot":"","sources":["../../src/vite/action-types-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AAGpB,oEAAoE;AACpE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,SAAS;IACT,KAAK;IACL,YAAY;IACZ,WAAW;IACX,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,oBAAoB,GAA+C;IACvE;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,mDAAmD;KAC/D;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,qDAAqD;KACjE;IACD;QACE,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,yDAAyD;KACrE;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,4DAA4D;KACxE;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,qDAAqD;KACjE;CACF,CAAC;AAEF,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,mEAAmE;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,8BAA8B;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACnE,MAAM,sBAAsB,GAC1B,oDAAoD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACjE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,cAAc,CAAC,OAAe,EAAE,OAAe;IACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;QACrC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC;QACnC,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,WAAmB;IACtD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,WAAW,GAAkB,IAAI,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1D,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;gBACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxD,aAAa,GAAG,GAAG,CAAC;oBACpB,WAAW,GAAG,QAAQ,CAAC;oBACvB,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IAED,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACjE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7D,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACzD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpD,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;oBACpE,IAAI,GAAG,CAAC,WAAW,EAAE;wBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBACxE,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACnD,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAC9B,UAAkB,EAClB,WAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE5E,MAAM,WAAW,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,mBAAmB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,oBAAoB,GAAG,mBAAmB;QAC9C,CAAC,CAAC,eAAe,CAAC,mBAAmB,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;IAEP,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CACpD,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAE3D,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO;YACL,IAAI;YACJ,OAAO,EAAE,GAAG,aAAa,IAAI,IAAI,EAAE;SACpC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,mBAAmB,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,oBAAoB,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC9C,MAAM,OAAO,GAAG,IAAI;iBACjB,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;iBACtD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACvB,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACtC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QAC1D,OAAO,QAAQ,IAAI,iCAAiC,OAAO,MAAM,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,0EAA0E;IAC1E,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACpD,WAAW,CAAC,IAAI,CACd,QAAQ,KAAK,CAAC,IAAI,iCAAiC,KAAK,CAAC,SAAS,MAAM,CACzE,CAAC;QACF,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;EAerB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;CAKvB,CAAC;IAEA,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAAE,YAAY,CAAC,CAAC;IAErE,2EAA2E;IAC3E,uEAAuE;IACvE,oEAAoE;IACpE,2DAA2D;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,aAAa,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,UAAU,OAAO,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;QACrD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,wDAAwD;IACxD,iEAAiE;IACjE,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,eAAe,KAAK,UAAU,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;QAC3D,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,eAAe,GAAG;;;;EAIxB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;;EAGlB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;;;;CAInB,CAAC;IAEA,2EAA2E;IAC3E,4EAA4E;IAC5E,wDAAwD;IACxD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAAE,eAAe,CAAC,CAAC;IAE1E,sCAAsC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,mBAAmB,GAAkB,IAAI,CAAC;IAE9C,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,cAAc,CAAC,MAAM;YACnB,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;YAC1B,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAClD,mBAAmB,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;QACjE,CAAC;QACD,UAAU;YACR,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,eAAe,CAAC,MAAM;YACpB,sBAAsB;YACtB,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;YAEjD,gCAAgC;YAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAC/B,MAAM,YAAY,GAAG,CAAC,IAAY,EAAE,EAAE;gBACpC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;gBACjD,MAAM,kBAAkB,GAAG,mBAAmB;oBAC5C,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;oBACtC,CAAC,CAAC,KAAK,CAAC;gBACV,IAAI,CAAC,YAAY,IAAI,kBAAkB,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpE,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxB,IAAI,mBAAmB;gBAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAC1D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACnC,qEAAqE;YACrE,uEAAuE;YACvE,6CAA6C;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,WAAmB;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACxD,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACnD,CAAC","sourcesContent":["/**\n * Vite plugin that generates end-to-end type-safe action types AND a runtime\n * registry of static imports so bundlers (Nitro on Netlify/Vercel/AWS-Lambda,\n * Rolldown, etc.) include every action file in the server bundle.\n *\n * Watches the `actions/` directory and emits:\n *   - `.generated/action-types.d.ts` — type-only module that augments the\n *     `ActionRegistry` interface in `@agent-native/core/client`, giving\n *     `useActionQuery`/`useActionMutation` full inference.\n *   - `.generated/actions-registry.ts` — runtime registry keyed by action\n *     name, with static `import` statements for every action. Templates\n *     import this file from their `server/plugins/agent-chat.ts` so Nitro\n *     bundles the actions into the server function; without it the runtime\n *     `fs.readdirSync` inside `autoDiscoverActions` finds nothing in a\n *     bundled serverless function and every action route 404s.\n */\nimport path from \"path\";\nimport fs from \"fs\";\nimport type { Plugin } from \"vite\";\n\n/** Files to skip during discovery (matches action-discovery.ts). */\nconst SKIP_FILES = new Set([\n  \"helpers\",\n  \"run\",\n  \"db-connect\",\n  \"db-status\",\n  \"registry\",\n]);\n\n/**\n * Framework-level sharing actions that must ALWAYS be in the generated\n * registry, even when the template's `actions/` directory doesn't contain\n * them. Each entry maps the action name to the bare-specifier import path so\n * bundlers see a static import and pull the module into the server bundle.\n *\n * Order matters: templates can override by defining a same-named file in\n * their own `actions/` directory — the merge below is skip-existing.\n */\nconst CORE_SHARING_ACTIONS: Array<{ name: string; specifier: string }> = [\n  {\n    name: \"share-resource\",\n    specifier: \"@agent-native/core/sharing/actions/share-resource\",\n  },\n  {\n    name: \"unshare-resource\",\n    specifier: \"@agent-native/core/sharing/actions/unshare-resource\",\n  },\n  {\n    name: \"list-resource-shares\",\n    specifier: \"@agent-native/core/sharing/actions/list-resource-shares\",\n  },\n  {\n    name: \"set-resource-visibility\",\n    specifier: \"@agent-native/core/sharing/actions/set-resource-visibility\",\n  },\n  {\n    name: \"upload-image\",\n    specifier: \"@agent-native/core/file-upload/actions/upload-image\",\n  },\n];\n\nfunction scanActionFiles(actionsDir: string): string[] {\n  let files: string[];\n  try {\n    files = fs.readdirSync(actionsDir);\n  } catch {\n    return [];\n  }\n  return files.filter((f) => {\n    if (!f.endsWith(\".ts\") && !f.endsWith(\".js\")) return false;\n    const name = f.replace(/\\.(ts|js)$/, \"\");\n    if (name.startsWith(\"_\")) return false;\n    if (SKIP_FILES.has(name)) return false;\n    // Only include files that actually call defineAction or explicitly\n    // re-export a package action. CLI scripts or example templates that live\n    // in actions/ but don't export an action would otherwise drag their own\n    // (often app/, browser-only, or fs-only) imports into the serverless\n    // bundle and fail to resolve.\n    try {\n      const content = fs.readFileSync(path.join(actionsDir, f), \"utf-8\");\n      const reexportsDefaultAction =\n        /export\\s*\\{\\s*default\\s*\\}\\s*from\\s*[\"'][^\"']+[\"']/.test(content);\n      if (!content.includes(\"defineAction\") && !reexportsDefaultAction) {\n        return false;\n      }\n    } catch {\n      return false;\n    }\n    return true;\n  });\n}\n\nfunction toIdent(name: string): string {\n  return \"a_\" + name.replace(/[^a-zA-Z0-9_]/g, \"_\");\n}\n\nfunction writeIfChanged(outFile: string, content: string): void {\n  const existing = fs.existsSync(outFile)\n    ? fs.readFileSync(outFile, \"utf-8\")\n    : \"\";\n  if (existing !== content) {\n    fs.mkdirSync(path.dirname(outFile), { recursive: true });\n    fs.writeFileSync(outFile, content);\n  }\n}\n\nfunction findWorkspaceCoreActionsDir(projectRoot: string): string | null {\n  let dir = path.resolve(projectRoot);\n  let workspaceRoot: string | null = null;\n  let packageName: string | null = null;\n\n  for (let i = 0; i < 20; i++) {\n    const pkgPath = path.join(dir, \"package.json\");\n    if (fs.existsSync(pkgPath)) {\n      try {\n        const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n        const declared = pkg?.[\"agent-native\"]?.workspaceCore;\n        if (typeof declared === \"string\" && declared.length > 0) {\n          workspaceRoot = dir;\n          packageName = declared;\n          break;\n        }\n      } catch {\n        // Keep walking on malformed package.json.\n      }\n    }\n    const parent = path.dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n\n  if (!workspaceRoot || !packageName) return null;\n\n  const nm = path.join(workspaceRoot, \"node_modules\", packageName);\n  if (fs.existsSync(path.join(nm, \"package.json\"))) {\n    const actionsDir = path.join(fs.realpathSync(nm), \"actions\");\n    return fs.existsSync(actionsDir) ? actionsDir : null;\n  }\n\n  const packagesDir = path.join(workspaceRoot, \"packages\");\n  const candidates: string[] = [];\n  if (fs.existsSync(packagesDir)) {\n    for (const entry of fs.readdirSync(packagesDir, { withFileTypes: true })) {\n      if (!entry.isDirectory()) continue;\n      candidates.push(path.join(packagesDir, entry.name));\n      if (entry.name.startsWith(\"@\")) {\n        const scopeDir = path.join(packagesDir, entry.name);\n        for (const sub of fs.readdirSync(scopeDir, { withFileTypes: true })) {\n          if (sub.isDirectory()) candidates.push(path.join(scopeDir, sub.name));\n        }\n      }\n    }\n  }\n\n  for (const candidate of candidates) {\n    const pkgPath = path.join(candidate, \"package.json\");\n    if (!fs.existsSync(pkgPath)) continue;\n    try {\n      const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n      if (pkg?.name === packageName) {\n        const actionsDir = path.join(candidate, \"actions\");\n        return fs.existsSync(actionsDir) ? actionsDir : null;\n      }\n    } catch {\n      // Ignore malformed package.json.\n    }\n  }\n\n  return null;\n}\n\n/**\n * Scan the actions directory and emit the types + runtime registry files.\n * Only writes files whose content has changed, to avoid triggering rebuilds.\n */\nfunction generateActionArtifacts(\n  actionsDir: string,\n  projectRoot: string,\n): void {\n  const outDir = path.resolve(projectRoot, \".generated\");\n  const relActionsDir = path.relative(outDir, actionsDir).replace(/\\\\/g, \"/\");\n\n  const actionFiles = scanActionFiles(actionsDir);\n  const workspaceActionsDir = findWorkspaceCoreActionsDir(projectRoot);\n  const workspaceActionFiles = workspaceActionsDir\n    ? scanActionFiles(workspaceActionsDir)\n    : [];\n\n  // Pre-compute template action names — used for skip-existing logic in both\n  // the type declarations and the runtime registry below.\n  const templateActionNames = new Set<string>(\n    actionFiles.map((f) => f.replace(/\\.(ts|js)$/, \"\")),\n  );\n  const registeredActionNames = new Set(templateActionNames);\n\n  const actionSources = actionFiles.map((f) => {\n    const name = f.replace(/\\.(ts|js)$/, \"\");\n    return {\n      name,\n      relPath: `${relActionsDir}/${name}`,\n    };\n  });\n\n  if (workspaceActionsDir) {\n    for (const f of workspaceActionFiles) {\n      const name = f.replace(/\\.(ts|js)$/, \"\");\n      if (registeredActionNames.has(name)) continue;\n      const relPath = path\n        .relative(outDir, path.join(workspaceActionsDir, name))\n        .replace(/\\\\/g, \"/\");\n      actionSources.push({ name, relPath });\n      registeredActionNames.add(name);\n    }\n  }\n\n  // --- types file ---------------------------------------------------------\n  const typeEntries = actionSources.map(({ name, relPath }) => {\n    return `    \"${name}\": ActionEntry<typeof import(\"${relPath}\")>;`;\n  });\n\n  // Also declare types for framework-level sharing actions so callers don't\n  // need `as any` casts (same skip-existing logic as the runtime registry).\n  for (const entry of CORE_SHARING_ACTIONS) {\n    if (registeredActionNames.has(entry.name)) continue;\n    typeEntries.push(\n      `    \"${entry.name}\": ActionEntry<typeof import(\"${entry.specifier}\")>;`,\n    );\n    registeredActionNames.add(entry.name);\n  }\n\n  const typesContent = `// AUTO-GENERATED by @agent-native/core — do not edit manually.\n// Regenerated when files in actions/ change.\n// This file augments the ActionRegistry interface so that useActionQuery and\n// useActionMutation infer the correct types from your action definitions.\n\n/** Extract the return type and parameter type from a defineAction module. */\ntype ActionEntry<T> = T extends { default: { run: (...args: infer A) => infer R } }\n  ? {\n      result: Awaited<R>;\n      params: A extends [infer P, ...any[]] ? P : Record<string, any>;\n    }\n  : { result: any; params: Record<string, any> };\n\ndeclare module \"@agent-native/core/client\" {\n  interface ActionRegistry {\n${typeEntries.join(\"\\n\")}\n  }\n}\n\nexport {};\n`;\n\n  writeIfChanged(path.join(outDir, \"action-types.d.ts\"), typesContent);\n\n  // --- runtime registry ---------------------------------------------------\n  // Static imports of each action's default export so bundlers see every\n  // action and include it in the server bundle. Normalization matches\n  // `loadActionsIntoRegistry` in server/action-discovery.ts.\n  const imports: string[] = [];\n  const entries: string[] = [];\n  const runtimeActionNames = new Set<string>();\n  for (const { name, relPath } of actionSources) {\n    const ident = toIdent(name);\n    imports.push(`import * as ${ident} from \"${relPath}\";`);\n    entries.push(`  ${JSON.stringify(name)}: ${ident},`);\n    runtimeActionNames.add(name);\n  }\n  // Framework-level sharing actions — only added when the template hasn't\n  // provided a same-named file (skip-existing merge). Static imports ensure\n  // bundlers pull these modules into the server bundle so\n  // `/_agent-native/actions/share-resource` (etc.) always resolve.\n  for (const entry of CORE_SHARING_ACTIONS) {\n    if (runtimeActionNames.has(entry.name)) continue;\n    const ident = toIdent(entry.name);\n    imports.push(`import * as ${ident} from \"${entry.specifier}\";`);\n    entries.push(`  ${JSON.stringify(entry.name)}: ${ident},`);\n    runtimeActionNames.add(entry.name);\n  }\n\n  const registryContent = `// AUTO-GENERATED by @agent-native/core — do not edit manually.\n// Static-import registry of every action file. Bundlers (Nitro, Rolldown)\n// see these imports and include the action modules in the server bundle.\n// The agent-chat plugin normalizes each module into an ActionEntry shape.\n${imports.join(\"\\n\")}\n\nconst modules: Record<string, unknown> = {\n${entries.join(\"\\n\")}\n};\n\nexport default modules;\n`;\n\n  // Always write the registry — even when the template has no actions/ files\n  // we still emit imports for the framework-level sharing actions so they get\n  // mounted on every template that consumes the registry.\n  writeIfChanged(path.join(outDir, \"actions-registry.ts\"), registryContent);\n\n  // Ensure .generated/ is in .gitignore\n  const gitignorePath = path.join(projectRoot, \".gitignore\");\n  if (fs.existsSync(gitignorePath)) {\n    const gitignore = fs.readFileSync(gitignorePath, \"utf-8\");\n    if (!gitignore.includes(\".generated\")) {\n      fs.appendFileSync(gitignorePath, \"\\n.generated/\\n\");\n    }\n  }\n}\n\n/**\n * Vite plugin that watches `actions/` and generates type-safe action types.\n *\n * Add to your Vite config (auto-included by `defineConfig` from `@agent-native/core`):\n *\n * ```ts\n * import { actionTypesPlugin } from \"@agent-native/core/vite/action-types-plugin\";\n * plugins: [actionTypesPlugin()]\n * ```\n */\nexport function actionTypesPlugin(): Plugin {\n  let projectRoot = \"\";\n  let actionsDir = \"\";\n  let workspaceActionsDir: string | null = null;\n\n  return {\n    name: \"agent-native-action-types\",\n    configResolved(config) {\n      projectRoot = config.root;\n      actionsDir = path.resolve(projectRoot, \"actions\");\n      workspaceActionsDir = findWorkspaceCoreActionsDir(projectRoot);\n    },\n    buildStart() {\n      generateActionArtifacts(actionsDir, projectRoot);\n    },\n    configureServer(server) {\n      // Generate on startup\n      generateActionArtifacts(actionsDir, projectRoot);\n\n      // Watch for changes in actions/\n      const watcher = server.watcher;\n      const handleChange = (file: string) => {\n        const inAppActions = file.startsWith(actionsDir);\n        const inWorkspaceActions = workspaceActionsDir\n          ? file.startsWith(workspaceActionsDir)\n          : false;\n        if ((inAppActions || inWorkspaceActions) && /\\.(ts|js)$/.test(file)) {\n          generateActionArtifacts(actionsDir, projectRoot);\n        }\n      };\n      watcher.add(actionsDir);\n      if (workspaceActionsDir) watcher.add(workspaceActionsDir);\n      watcher.on(\"add\", handleChange);\n      watcher.on(\"unlink\", handleChange);\n      // Don't regenerate on content changes — only file additions/removals\n      // affect the registry. Return type changes are picked up by TypeScript\n      // from the source files via typeof import().\n    },\n  };\n}\n\n/**\n * Public helper to regenerate the types + registry from a non-Vite context\n * (e.g. the Nitro deploy build, where Vite plugins don't run).\n */\nexport function generateActionRegistryForProject(projectRoot: string): void {\n  const actionsDir = path.resolve(projectRoot, \"actions\");\n  generateActionArtifacts(actionsDir, projectRoot);\n}\n"]}

package/docs/content/authentication.md

@@ -124,6 +124,42 @@ export default createAuthPlugin({
 });
 ```
 
+## Public Workspace Apps {#public-workspace-apps}
+
+Workspace apps are internal by default. To let anonymous visitors load a public
+site while keeping management pages behind auth, declare route access in
+`apps/<id>/package.json`:
+
+```json
+{
+  "agent-native": {
+    "workspaceApp": {
+      "audience": "public",
+      "protectedPaths": ["/admin"]
+    }
+  }
+}
+```
+
+For the inverse shape, keep the default internal audience and expose only
+specific public pages:
+
+```json
+{
+  "agent-native": {
+    "workspaceApp": {
+      "publicPaths": ["/", "/share"]
+    }
+  }
+}
+```
+
+`publicPaths` and `protectedPaths` use prefix matching, so `"/admin"` also
+covers `"/admin/users"`. These settings open page navigation only. Framework
+routes (`/_agent-native/*`) and custom API routes (`/api/*`) still require auth
+unless the app explicitly adds those prefixes to
+`createAuthPlugin({ publicPaths: [...] })`.
+
 ## Session API {#session-api}
 
 The session object returned by `getSession(event)` has this shape:

package/docs/content/creating-templates.md

@@ -191,6 +191,21 @@ export function AppSync() {
 }
 ```
 
+**The agent-native promise: agent writes show up in the UI without a manual refresh.** `useActionQuery` is the easy path — every hook is auto-refetched on every change event the framework sees. If you reach for raw `useQuery` with a custom key (e.g. for a non-action HTTP endpoint, integration status, etc.), you must fold the per-source counter into the queryKey or agent writes will be silently invisible:
+
+```tsx
+import { useChangeVersions } from "@agent-native/core/client";
+
+const v = useChangeVersions(["dashboards", "action"]);
+useQuery({
+  queryKey: ["dashboard", id, v],
+  queryFn: () => fetchDashboard(id),
+  placeholderData: (prev) => prev, // no flicker on refetch
+});
+```
+
+Common sources: `"action"` (every successful agent action — the reliable fallback), `"app-state"`, `"settings"`, plus any custom resource source your store emits via `recordChange`. See the `real-time-sync` skill for the full pattern.
+
 ## Add Application State {#application-state}
 
 Application state is how the agent knows what the user is seeing. At minimum, add:

package/docs/content/dispatch.md

@@ -17,7 +17,7 @@ Reach for Dispatch when any of these are true:
 
 - You're running a [multi-app workspace](/docs/multi-app-workspace) — mail, calendar, analytics, content, recruiting — and you don't want one Slack bot per app.
 - You want **one inbox for "the agent"** so users DM a single bot and the right specialist app picks up the work behind the scenes.
-- You have **workspace-wide secrets** (Stripe key, OpenAI key, third-party API tokens) that several apps need but you'd rather grant per-app than copy into every `.env`.
+- You have **workspace-wide secrets** (Stripe key, OpenAI key, third-party API tokens) that several apps need and you want one vault instead of copying values into every `.env`.
 - You want a **runtime approval flow** in front of sensitive changes (saved destinations, policy edits) so non-admins can request and admins can sign off without a code deploy.
 - You want **shared skills, instructions, and agent profiles** that every app in the workspace inherits — change once, reach all.
 
@@ -35,7 +35,7 @@ See [Messaging](/docs/messaging) for the credentials and webhook URLs for each p
 
 ### Secret vault
 
-Store credentials once in Dispatch's vault and grant them to the apps that need them. Non-admins can **request** a secret for an app; admins **approve**, which creates the secret + grant in one step. Every read, grant, sync, and rotation is captured in an audit log. `sync-vault-to-app` pushes granted secrets into the target app's env so you don't have to redeploy or re-paste anything.
+Store credentials once in Dispatch's vault. By default, vault access is **all apps**: every saved key is available to every workspace app, and `sync-vault-to-app` pushes the full vault to the target app. Workspaces that need stricter separation can switch the vault to **manual** mode, where explicit per-app grants are required before sync. Non-admins can **request** a secret for an app; admins **approve**, which creates the secret and, in manual workflows, the grant. Every read, grant, sync, and rotation is captured in an audit log.
 
 This is what makes "rotate the OpenAI key" a one-click operation across ten apps instead of ten PRs.
 
@@ -83,7 +83,7 @@ Three short steps:
 2. **Connect messaging.** Open **Settings → Messaging** in Dispatch and click connect for Slack, Email, Telegram, or WhatsApp. The form fields match the env vars in the [Messaging](/docs/messaging) doc — refer there for what each platform needs.
 3. **Add other apps.** Run `npx @agent-native/core add-app` from the workspace root for each domain app. They auto-appear as A2A peers in Dispatch's `list-workspace-apps` — no manual registration, no agent-card editing. Dispatch will start delegating to them as soon as their agent cards are reachable.
 
-Then add credentials to the vault, grant them to the apps that need them, and (optionally) author workspace skills under **Resources** and sync them out.
+Then add credentials to the vault, sync them to apps, and (optionally) author workspace skills under **Resources** and sync them out. If you need per-app secret isolation, switch the vault access setting to manual before granting individual apps.
 
 ## See also {#see-also}
 

package/docs/content/multi-app-workspace.md

@@ -146,6 +146,11 @@ Active organization flows automatically: `session.orgId` → `AGENT_ORG_ID` →
 
 The workspace root `.env` is loaded into every app automatically. Put shared keys once at the root — `ANTHROPIC_API_KEY`, `A2A_SECRET`, `BETTER_AUTH_SECRET`, `DATABASE_URL`, `BUILDER_PRIVATE_KEY`, etc. — and every app picks them up. Per-app overrides go in `apps/<name>/.env` and win on conflict.
 
+For runtime app credentials, prefer the Dispatch vault over hand-editing `.env`
+files. The vault defaults to all-apps access, so every saved vault key is
+available to every workspace app and can be pushed with `sync-vault-to-app`.
+Switch the vault to manual mode only when apps need explicit per-key grants.
+
 ```text
 my-company-platform/
 ├── .env                           # shared: ANTHROPIC_API_KEY=... , A2A_SECRET=... , ...

package/docs/content/tracking.md

@@ -130,6 +130,18 @@ Only `name` and `track` are required. `identify` and `flush` are optional — im
 - **Best-effort delivery** — provider errors are caught and logged. A failing analytics integration never crashes the caller or blocks request handling.
 - **Global singleton** — the registry uses a `Symbol.for` key on `globalThis` so multiple ESM graph instances (dev-mode Vite + Nitro, symlinks) share one provider set.
 
+## Browser defaults {#browser-defaults}
+
+Template roots call `configureTracking()` once at startup. Browser events sent with `trackEvent()` automatically include app/template context plus the current LLM connection when the app can resolve it:
+
+- `llm_connection` — normalized provider label such as `builder`, `anthropic`, `openai`, `google`, or `none`
+- `llm_engine` — the engine id, for example `builder` or `ai-sdk:openai`
+- `llm_model` — the selected/default model when known
+- `llm_connection_source` — `app_secrets`, `settings`, or `env`
+- `llm_connection_configured` — whether an LLM connection is available
+
+The framework also tracks `builder connect clicked` from Connect Builder CTAs, and the server-side Builder connect routes track started/succeeded/failed lifecycle events.
+
 ## Using track() in templates {#templates}
 
 Call `track()` from action handlers to record user or agent activity:

package/docs/content/workspace-management.md

@@ -184,7 +184,7 @@ The [Dispatch](/docs/dispatch) app is the workspace's runtime control plane. It
 | Concern                         | Git / GitHub                  | Dispatch                                   |
 | ------------------------------- | ----------------------------- | ------------------------------------------ |
 | Who can change code             | CODEOWNERS, branch protection | —                                          |
-| Who can access secrets          | —                             | Vault grants + request workflow            |
+| Who can access secrets          | —                             | Vault policy, grants, request workflow     |
 | What instructions agents follow | —                             | Workspace resources (skills, instructions) |
 | Which agents are shared         | —                             | Workspace agent profiles                   |
 | Integration inventory           | —                             | Integrations catalog                       |
@@ -196,12 +196,47 @@ The [Dispatch](/docs/dispatch) app is the workspace's runtime control plane. It
 
 ### What Dispatch Manages
 
-- **Vault** — store credentials centrally, grant them to specific apps, sync on demand. Non-admins can request access; admins approve.
+- **Vault** — store credentials centrally and sync on demand. The default policy makes all vault keys available to all workspace apps; manual mode requires specific app grants. Non-admins can request access; admins approve.
 - **Integrations catalog** — see which credentials each app needs, what's configured, what's missing, what's granted from the vault.
 - **Workspace resources** — share skills, behavioral instructions, and reusable agent profiles across apps. Scope to all apps or grant per-app.
 - **Approvals** — require review before runtime changes (destinations, settings) take effect.
 - **Audit** — full history of secret access, grants, syncs, and changes.
 
+### Public App Routes
+
+Workspace apps are internal by default. For a public site with login-only admin
+pages, set a public audience and protect the admin prefix in that app's
+`package.json`:
+
+```json
+{
+  "agent-native": {
+    "workspaceApp": {
+      "audience": "public",
+      "protectedPaths": ["/admin"]
+    }
+  }
+}
+```
+
+For mostly internal apps with a few public pages, leave the audience internal and
+list page prefixes:
+
+```json
+{
+  "agent-native": {
+    "workspaceApp": {
+      "publicPaths": ["/", "/share"]
+    }
+  }
+}
+```
+
+These settings only affect read-only page navigation. Framework tools, agent
+chat, A2A, vault access, and arbitrary APIs stay authenticated unless the app
+explicitly declares public prefixes with
+`createAuthPlugin({ publicPaths: [...] })`.
+
 ## Setup Checklist
 
 For a new workspace, after running `agent-native create`:
@@ -216,8 +251,8 @@ For a new workspace, after running `agent-native create`:
 **Dispatch:**
 
 - [ ] Add shared secrets to the vault (API keys, OAuth credentials, etc.)
-- [ ] Grant secrets to the apps that need them
-- [ ] Sync granted secrets to push them to apps
+- [ ] Keep the default all-apps vault policy or switch to manual per-app grants
+- [ ] Sync vault secrets to push them to apps
 - [ ] Add workspace-wide skills and instructions via the Resources page
 - [ ] Configure the approval policy and approver emails
 - [ ] Set up SendGrid (`SENDGRID_API_KEY`, `SENDGRID_FROM_EMAIL`) for admin notifications