@agent-native/core 0.146.8 → 0.148.0

package/corpus/templates/analytics/server/lib/gcloud.ts

@@ -25,6 +25,122 @@ const MAX_CACHE = 120;
 // Token cache, scoped by caller credential context.
 const tokenCache = new Map<string, { token: string; expiresAt: number }>();
 
+const GOOGLE_REQUEST_MAX_ATTEMPTS = 4;
+const GOOGLE_REQUEST_TIMEOUT_MS = 30_000;
+const GOOGLE_REQUEST_RETRY_DELAY_MS = 100;
+
+function isRetryableGoogleStatus(status: number): boolean {
+  return status === 408 || status === 429 || status >= 500;
+}
+
+function errorCode(error: unknown): string | null {
+  if (!error || typeof error !== "object") return null;
+  const code = (error as { code?: unknown }).code;
+  return typeof code === "string" ? code : null;
+}
+
+function errorCause(error: unknown): unknown {
+  if (!error || typeof error !== "object") return undefined;
+  return (error as { cause?: unknown }).cause;
+}
+
+function createGoogleError(message: string, cause: unknown): Error {
+  const error = new Error(message);
+  Object.defineProperty(error, "cause", {
+    configurable: true,
+    value: cause,
+  });
+  return error;
+}
+
+function describeGoogleError(error: unknown): string {
+  if (error instanceof Error) {
+    const code = errorCode(error) ?? errorCode(errorCause(error));
+    return `${error.name}: ${error.message}${code ? ` (code ${code})` : ""}`;
+  }
+  return String(error);
+}
+
+function isRetryableGoogleError(error: unknown, timedOut: boolean): boolean {
+  if (timedOut) return true;
+  const code = errorCode(error) ?? errorCode(errorCause(error));
+  if (
+    code &&
+    ["ECONNRESET", "EAI_AGAIN", "ETIMEDOUT", "UND_ERR"].includes(code)
+  ) {
+    return true;
+  }
+  const message = describeGoogleError(error).toLowerCase();
+  return (
+    error instanceof TypeError || /fetch failed|network|socket/.test(message)
+  );
+}
+
+function retryDelayMs(attempt: number): number {
+  return GOOGLE_REQUEST_RETRY_DELAY_MS * 2 ** (attempt - 1);
+}
+
+async function waitForGoogleRetry(attempt: number): Promise<void> {
+  await new Promise<void>((resolve) => {
+    setTimeout(resolve, retryDelayMs(attempt));
+  });
+}
+
+/**
+ * Keep transient Google network failures from killing long-running jobs while
+ * preserving a hard bound on attempts and request duration.
+ */
+export async function fetchGoogleWithRetry(
+  url: string,
+  init: RequestInit,
+  operation: string,
+): Promise<Response> {
+  let lastError: unknown;
+
+  for (let attempt = 1; attempt <= GOOGLE_REQUEST_MAX_ATTEMPTS; attempt += 1) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, GOOGLE_REQUEST_TIMEOUT_MS);
+
+    try {
+      const response = await fetch(url, {
+        ...init,
+        signal: controller.signal,
+      });
+      if (
+        isRetryableGoogleStatus(response.status) &&
+        attempt < GOOGLE_REQUEST_MAX_ATTEMPTS
+      ) {
+        await waitForGoogleRetry(attempt);
+        continue;
+      }
+      return response;
+    } catch (error) {
+      lastError = error;
+      if (
+        attempt >= GOOGLE_REQUEST_MAX_ATTEMPTS ||
+        !isRetryableGoogleError(error, timedOut)
+      ) {
+        throw createGoogleError(
+          `Google ${operation} failed after ${attempt} attempt(s): ${describeGoogleError(error)}`,
+          error,
+        );
+      }
+      await waitForGoogleRetry(attempt);
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+
+  throw createGoogleError(
+    `Google ${operation} failed after ${GOOGLE_REQUEST_MAX_ATTEMPTS} attempt(s): ${describeGoogleError(lastError)}`,
+    lastError,
+  );
+}
+
 async function getServiceAccountCredentials() {
   const ctx = requireRequestCredentialContext(
     "GOOGLE_APPLICATION_CREDENTIALS_JSON",
@@ -101,14 +217,18 @@ export async function getAccessToken(): Promise<string> {
   const jwt = await signRs256Jwt(jwtPayload, creds.private_key);
 
   const tokenUri = creds.token_uri || "https://oauth2.googleapis.com/token";
-  const res = await fetch(tokenUri, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({
-      grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
-      assertion: jwt,
-    }),
-  });
+  const res = await fetchGoogleWithRetry(
+    tokenUri,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+        assertion: jwt,
+      }),
+    },
+    "OAuth token exchange",
+  );
 
   if (!res.ok) {
     const text = await res.text();
@@ -146,12 +266,16 @@ async function apiGet<T>(url: string, cacheKey?: string): Promise<T> {
   }
 
   const token = await getAccessToken();
-  const res = await fetch(url, {
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
+  const res = await fetchGoogleWithRetry(
+    url,
+    {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+      },
     },
-  });
+    "Cloud API GET",
+  );
 
   if (!res.ok) {
     const text = await res.text();
@@ -178,14 +302,18 @@ async function apiPost<T>(
   }
 
   const token = await getAccessToken();
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      "Content-Type": "application/json",
+  const res = await fetchGoogleWithRetry(
+    url,
+    {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json",
+      },
+      body: JSON.stringify(body),
     },
-    body: JSON.stringify(body),
-  });
+    "Cloud API POST",
+  );
 
   if (!res.ok) {
     const text = await res.text();

package/corpus/templates/analytics/server/plugins/db.ts

@@ -1534,6 +1534,48 @@ export const runAnalyticsMigrations = runMigrations(
       ON analytics_bigquery_backfill_jobs (status, next_run_at, lease_expires_at, updated_at)`,
       },
     },
+    {
+      version: 140,
+      name: "analytics-events-backfill-filtered-cursor-indexes",
+      sql: {
+        postgres: `CREATE INDEX CONCURRENTLY IF NOT EXISTS analytics_events_org_received_id_non_http_idx ON analytics_events (org_id, received_at, id) WHERE event_name IS DISTINCT FROM 'http.response'; CREATE INDEX CONCURRENTLY IF NOT EXISTS analytics_events_owner_received_id_non_http_idx ON analytics_events (owner_email, received_at, id) WHERE org_id IS NULL AND event_name IS DISTINCT FROM 'http.response'`,
+        sqlite: `CREATE INDEX IF NOT EXISTS analytics_events_org_received_id_non_http_idx ON analytics_events (org_id, received_at, id) WHERE event_name IS NOT 'http.response'; CREATE INDEX IF NOT EXISTS analytics_events_owner_received_id_non_http_idx ON analytics_events (owner_email, received_at, id) WHERE org_id IS NULL AND event_name IS NOT 'http.response'`,
+      },
+    },
+    {
+      version: 141,
+      name: "analytics-event-volume-usage",
+      sql: {
+        postgres: `CREATE TABLE IF NOT EXISTS analytics_event_volume_usage (
+      id TEXT PRIMARY KEY,
+      tenant_key TEXT NOT NULL,
+      owner_email TEXT NOT NULL,
+      org_id TEXT,
+      window_start TEXT NOT NULL,
+      event_count INTEGER NOT NULL DEFAULT 0,
+      event_limit INTEGER NOT NULL,
+      updated_at TEXT NOT NULL DEFAULT (now()::text)
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS analytics_event_volume_usage_tenant_window_idx
+      ON analytics_event_volume_usage (tenant_key, window_start);
+    CREATE INDEX IF NOT EXISTS analytics_event_volume_usage_updated_at_idx
+      ON analytics_event_volume_usage (updated_at)`,
+        sqlite: `CREATE TABLE IF NOT EXISTS analytics_event_volume_usage (
+      id TEXT PRIMARY KEY,
+      tenant_key TEXT NOT NULL,
+      owner_email TEXT NOT NULL,
+      org_id TEXT,
+      window_start TEXT NOT NULL,
+      event_count INTEGER NOT NULL DEFAULT 0,
+      event_limit INTEGER NOT NULL,
+      updated_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE UNIQUE INDEX IF NOT EXISTS analytics_event_volume_usage_tenant_window_idx
+      ON analytics_event_volume_usage (tenant_key, window_start);
+    CREATE INDEX IF NOT EXISTS analytics_event_volume_usage_updated_at_idx
+      ON analytics_event_volume_usage (updated_at)`,
+      },
+    },
   ],
   { table: "analytics_migrations" },
 );

package/corpus/templates/assets/.agents/skills/frontend-design/SKILL.md

@@ -2,16 +2,19 @@
 name: frontend-design
 description: >-
   Sets the visual direction for a new or redesigned surface, with production
-  quality that avoids generic AI aesthetics. Use when building a new page,
-  app, or marketing surface, defining visual identity, or doing a design pass
-  ("make this look good"). Do not load it for routine UI edits: adding a field
-  to an existing form, fixing spacing, wiring a button, or changing copy.
+  quality that avoids generic AI aesthetics. Use when building, redesigning, or
+  cleaning up any user-facing UI, including screenshot-driven feedback, copy or
+  density reduction, settings, control placement, or a design pass ("make this
+  look good"). Do not load it only for purely mechanical wiring or formatting.
 scope: dev
 license: Complete terms in LICENSE.txt
 source: https://github.com/anthropics/skills/blob/main/skills/frontend-design/SKILL.md
 local-changes: >-
-  Description narrowed and Verification rescoped deliberately; an upstream sync
-  must not restore the broad auto-load triggers or screenshot-everything step.
+  Description deliberately widened on 2026-08-09 because the previous narrow
+  trigger excluded routine UI edits, including screenshot-driven cleanup, copy
+  and density changes, settings, and control placement. An upstream sync must
+  not re-narrow it. Verification remains deliberately rescoped; an upstream
+  sync must not restore screenshot-everything or broad browser-automation steps.
 metadata:
   internal: true
 ---
@@ -26,10 +29,12 @@ The user may ask for a component, page, full app, dashboard, marketing surface,
 
 Before coding, decide:
 
-- **Purpose**: What workflow does this surface make easier? What is the primary action?
+- **Purpose**: What workflow does this surface make easier? What does the user
+  need to understand, decide, or do next?
 - **Audience**: Who will use it repeatedly, and what should feel fast, calm, playful, premium, editorial, technical, or utilitarian?
 - **Tone**: Choose a concrete aesthetic direction: refined minimal, dense operations console, editorial, playful, industrial, warm handmade, high-contrast data tool, etc.
-- **Information hierarchy**: What must be visible in the first five seconds, and what should be progressively disclosed?
+- **Information hierarchy**: What must be visible to orient and act, and what
+  can wait until context or intent makes it relevant?
 - **Differentiation**: What makes this feel designed for this exact domain?
 
 Then implement working code that is cohesive, accessible, responsive, and polished in small details: typography, spacing, copy, motion, empty states, loading states, focus states, and error states.
@@ -50,46 +55,80 @@ before selecting its accent family. Shared behavior and semantic token names
 should stay consistent; palette, density, composition, type contrast, and
 shape language should not be identical by default.
 
-## Minimalism And Progressive Disclosure
-
-Default to Apple/Linear-level restraint: make the primary workflow obvious, then remove everything that does not help that workflow right now. A polished UI often has fewer visible controls, fewer borders, fewer labels, and fewer explanatory surfaces than the first reasonable implementation.
-
-### Progressive Disclosure Is A Design Requirement
-
-Treat an all-at-once interface as a defect to fix during design, not as a
-styling preference. Before coding, inventory every piece of content and action
-on the surface, then assign each one to the smallest useful visibility level:
-
-1. **Immediate** — the page title, current state, one primary action, and the
-   compact context needed to choose what to do next.
-2. **Expanded** — the details needed for the selected item or active workflow.
-3. **On demand** — advanced settings, diagnostics, credentials, metadata,
-   destructive actions, documentation, and rarely used tools.
-
-Use single-select accordions or simple disclosure rows for sibling panels when
-the user is choosing one item at a time. Inside an expanded panel, keep another
-layer for independent concerns instead of dumping every form, explanation, and
-secondary action into the first reveal. Prefer one flat panel with alignment,
-dividers, and whitespace over nested cards; provider or product icons should
-not receive decorative borders or containers unless the container communicates
-state or interaction. A collapsed row should still show the item name, status,
-and a concise summary so the user can scan the whole surface without opening
-everything.
-
-Before shipping, ask: “What can disappear until the user asks for it?” Then
-verify collapsed, expanded, loading, empty, error, and narrow-width states.
-If the first viewport contains multiple forms, repeated explanatory copy,
-documentation links, and controls for unrelated tasks, the surface has not
-passed this requirement yet.
-
-- **Start by subtracting**: Before adding a visible control, banner, toolbar row, card, or explanatory block, ask what can be removed, merged, renamed, or moved into an existing affordance.
-- **One primary action**: Each surface should have one dominant next action. Secondary actions belong in menus, popovers, command palettes, disclosure rows, or contextual hover/focus states unless they are used constantly.
-- **Progressively disclose rare work**: Advanced options, diagnostics, metadata, settings, import/export, destructive actions, and inspection tools should stay tucked away until requested. Prefer small icon triggers with tooltips, popovers, drawers, or detail panels over permanent chrome.
-- **Keep chrome quiet**: Avoid new always-visible bars, badges, callouts, helper text, and counters unless they prevent mistakes or are central to repeated use. Status can often be a dot, ring, muted count, or tooltip.
-- **Favor content over containers**: Do not wrap every section in a card. Use whitespace, alignment, typography, dividers, and full-width bands before adding boxes.
-- **Design for repeated use**: Production app UI should feel calm after the hundredth use. If a control shouts, animates, explains itself, or occupies a full row for an occasional action, hide or compress it.
-- **Make absence intentional**: Empty states should be sparse and action-oriented. Do not fill blank space with marketing copy, decorative art, or lists of features just because the screen feels empty.
-- **Use familiar primitives**: Icon buttons need clear tooltips. Menus, popovers, tabs, switches, and segmented controls should carry complexity instead of exposing every option at once.
+## High-Signal Minimalism And Progressive Disclosure
+
+Minimalism means fewer competing kinds of UI, not less useful information. Keep
+surfaces dense and scannable: reduce redundant prose, decorative containers,
+borders, badges, accent colors, and persistent controls before removing content
+that helps the user orient, compare, decide, or recover. The reference class is
+calm productivity software such as ChatGPT/Codex, Linear, and Vercel, not empty
+whitespace.
+
+### Product UX Philosophy
+
+Apply these principles as binding decision rules:
+
+- **Purpose over presence**: Every visible element must support orientation,
+  state comprehension, a decision, an action, or recovery. Before adding one,
+  name which; if it supports none or duplicates another element, remove or
+  defer it.
+- **Clarity over cleverness**: Use plain language, familiar patterns, explicit
+  hierarchy, and visible state. Do not make decoration or invented terminology
+  carry meaning. Preserve the labels, hit targets, focus states, and recovery
+  paths required for accessible use.
+- **Simple first, powerful on demand**: Keep the current task and state in the
+  default presentation. Put advanced, rare, diagnostic, and secondary work
+  behind contextual disclosure, menus, or Settings. Do not turn a discoverability
+  concern into permanent chrome, and do not hide information needed for the
+  current decision.
+- **Hierarchy over chrome**: Use typography, spacing, alignment, and restrained
+  emphasis to organize information. Treat prose, controls, borders, cards,
+  badges, and accent colors as a competition budget: reduce competing kinds of
+  elements before reducing useful information. When a surface has one clear
+  next decision, give it dominant emphasis and move secondary actions out of
+  the default path. Do not wrap every section in a card or add borders for
+  grouping alone; use spacing, alignment, typography, or dividers first. A
+  container must communicate grouping, state, or interaction.
+- **Coherence over novelty**: Reuse the product's primitives, interaction
+  patterns, and language. When given a screenshot or reference product, match
+  its underlying hierarchy, density, and behavior; do not copy decoration or
+  introduce a second visual language without a product reason.
+- **Quiet continuity**: Feedback must be immediate, contextual, and honest.
+  Preserve the user's place and layout, make loading, empty, and error states
+  understandable, and use motion only to explain a change.
+- **Respect repeated use**: Optimize for the hundredth use, not the first
+  impression. If a control repeats an explanation, occupies persistent space
+  for an occasional task, or turns routine work into ceremony, remove it or
+  move it to the contextual surface that owns it.
+
+### Progressive Disclosure And Information Timing
+
+Expose information and controls according to relevance, frequency, and
+consequence. Before coding, inventory the content and actions and assign them to
+the smallest useful visibility layer:
+
+1. **Orient and act**: location, current state, and context needed for the next
+   meaningful choice.
+2. **Support active work**: details and controls for the selected item or
+   current workflow.
+3. **Available on demand**: advanced settings, diagnostics, credentials,
+   metadata, destructive actions, documentation, and rare tools.
+
+Use a disclosure pattern that matches the task. Keep independent concerns easy
+to scan inside an expanded area instead of dumping every form, explanation,
+and secondary action into the first reveal. A collapsed row must retain its
+label and essential state; remove explanatory subtext unless it changes the
+next decision. For configuration with a known current state, show that state
+first and expose editing contextually instead of defaulting to a full form.
+
+Before shipping, verify collapsed, expanded, loading, empty, error, and
+narrow-width states. The default state fails review when its first viewport
+contains multiple unrelated forms, repeated explanatory copy, documentation
+links, or controls for unrelated tasks. It also fails when useful information
+has been replaced with empty whitespace or extra clicks solely to look minimal.
+The default state passes when users can identify their location, current state,
+current task, and relevant next choice without reading documentation, while
+the useful information remains dense and scannable.
 
 ## Aesthetic Guidelines
 
@@ -166,26 +205,28 @@ passed this requirement yet.
 
 ### Product Surface Review
 
-Before shipping a new app or a substantial redesign, review the first viewport
-as an operator would use it repeatedly:
-
-- Show one clear job title, the current state, and one primary next action.
-- Put optional inputs, provider choices, diagnostics, long explanations, and
-  secondary actions behind a disclosure, a later step, a menu, or the agent
-  sidebar. Do not put multiple unrelated forms side by side by default.
-- Prefer a short step flow or a focused page per domain job over one giant
-  dashboard. A route can have several states, but it should reveal one state
-  at a time and preserve the user's progress.
+Before shipping a new app or a substantial redesign, review the surface as an
+operator would use it repeatedly:
+
+- Can users identify where they are, what state they are in, and what
+  meaningful choices or next steps are available?
+- Remove competing or redundant elements, then place optional inputs, provider
+  choices, diagnostics, long explanations, and secondary actions where they
+  remain discoverable without crowding the current task.
+- Match the composition to the workflow. Use a focused page or step flow when
+  the work is sequential; use an overview when comparing or monitoring several
+  things is genuinely the job. Preserve the user's progress in either case.
 - Remove generic hero copy, feature tours, repeated helper text, nested cards,
   status-chip soup, and decorative AI treatment before adding more styling.
-- For review flows, stack the source/original first and the generated or safe
-  result second by default. Use side-by-side comparison only when the content
-  is short enough to scan without excessive horizontal reading.
+- For review flows, choose stacking, side-by-side comparison, or another
+  composition based on content length, scanability, and the user's comparison
+  task.
 - Compare the result with sibling apps. Shared toolkit behavior should feel
   consistent, but a repeated palette, hero composition, type pairing, and
   radius language without a product reason is visual drift, not consistency.
-- Check the result at the target desktop width and a narrow width. If the first
-  viewport feels like documentation instead of a tool, subtract again.
+- Check the result with realistic content at the target desktop width and a
+  narrow width. If it feels like documentation instead of a tool, reduce noise
+  or clarify the hierarchy.
 
 ## shadcn/ui Design Rules
 
@@ -203,18 +244,24 @@ as an operator would use it repeatedly:
   not show generic "Loading..." text for content loads; reserve `Spinner` for
   brief mutations, uploads, and progress actions. Use the app's existing
   loading primitive when it is a genuine design-system adapter. Empty states
-  should have one clear next action.
+  should communicate the state and offer the appropriate next step or small set
+  of choices.
 
 ## Anti-Patterns
 
-Avoid:
+Avoid patterns that add visual noise, obscure state, or compete with the user's
+task without a clear product reason:
 
 - Generic AI aesthetics: purple gradients, glassy cards everywhere, vague sparkle language, decorative blobs, and context-free hero sections.
 - Custom reimplementations of shadcn primitives.
 - Raw color overrides on shared components when semantic tokens or variants would work.
-- New always-visible controls for rare actions. Prefer menus, popovers, sheets, tabs, collapsibles, or advanced sections.
-- Full-width banners, persistent helper rows, decorative cards, or explanatory chrome for status that could be a compact affordance.
-- Treating progressive disclosure as optional. If a control is not part of the main daily workflow, hide it until context, hover, focus, or explicit user intent makes it relevant.
+- New always-visible controls for rare actions when a contextual surface would
+  preserve discoverability and reduce noise.
+- Full-width banners, persistent helper rows, decorative cards, or explanatory
+  chrome for status that could be communicated more clearly with less weight.
+- Hiding essential meaning or operability behind progressive disclosure. Defer
+  complexity when it is contextual or infrequent, but preserve labels, focus,
+  hit targets, accessibility, and recovery paths.
 - UI cards nested inside other cards.
 - Text or icons that resize or shift fixed-format UI on hover/loading.
 

package/corpus/templates/assets/.agents/skills/turn-into-app/SKILL.md

@@ -3,8 +3,9 @@ name: turn-into-app
 description: >-
   Turn visible project context, a proven thread, skill, or workflow into a
   runnable Agent-Native app with simple buttons, visible agent steps, preview,
-  and deployment handoff. Use when a user invokes `/turn-into-app` or asks to
-  make a workflow into an app, including from Claude or ChatGPT on the web.
+  and deployment handoff. Use when a user invokes `/turn-into-app`,
+  `/make-into-app`, or asks to make a workflow into an app, including from
+  Claude or ChatGPT on the web.
 user-invocable: true
 scope: both
 metadata:
@@ -38,6 +39,15 @@ The build location depends on the host. Treat this as a hard routing rule:
   workspace, follow the local implementation steps below. The local agent may
   scaffold, edit, run, and verify the app there.
 
+Once the source brief is sufficient to identify a repeatable workflow, the
+handoff is non-interactive. Do not ask the user for visual, product, copy,
+layout, template, integration, or implementation choices that can be resolved
+from the source. Select the source's recommended option; otherwise choose the
+most direct conventional default and record the assumption for later review.
+Only stop for a genuine hard blocker such as missing authorization, a
+destructive external action, an ambiguous target workspace, or no identifiable
+workflow at all.
+
 ## Default behavior
 
 For a local code-agent runtime this is an end-to-end build skill, not a request
@@ -104,14 +114,16 @@ before creating the app. Read the host-provided context in this order:
 Record the brief with these headings before handoff: source and provenance,
 project goal, configuration and constraints, knowledge sources, repeatable
 workflow, inputs and outputs, judgment and review points, representative runs,
-integrations and permissions, and unknowns. This is the compact contract for
+integrations and permissions, and unknowns and assumptions. This is the compact contract for
 the app. It keeps the new app useful without pretending that hidden Project
 history was imported. See [the fresh Project reference](references/fresh-project.md)
 for the host setup and brief template.
 
-If the visible Project context has no concrete repeatable job, ask for one
-focused clarification or a representative artifact. Do not fall back to a
-generic “what app do you want to make?” builder.
+If the visible Project context has no concrete repeatable job and no primary
+goal can be inferred, ask for one focused clarification or a representative
+artifact. Otherwise use the project's primary goal and source conventions; do
+not ask a questionnaire and do not fall back to a generic “what app do you
+want to make?” builder.
 
 ## Source selection guard
 

package/corpus/templates/assets/.agents/skills/turn-into-app/references/fresh-project.md

@@ -36,7 +36,7 @@ Inputs and outputs:
 Judgment and review points:
 Representative runs: none, or 1-3 selected examples
 Integrations and permissions:
-Unknowns and follow-up:
+Unknowns and assumptions:
 ```
 
 Keep source references bounded. Prefer a file name, URL, resource ID, or short
@@ -69,6 +69,13 @@ do not fall back to a local sandbox build. Claude Code and Codex Code are the
 local-agent exception and may follow the implementation steps in the main
 skill.
 
+The brief is an implementation authorization, not a questionnaire. After a
+repeatable workflow is identifiable, choose any source-recommended option
+automatically. For unresolved non-blocking choices, use the most direct
+conventional default, record it under assumptions, and continue. Ask only when
+there is no identifiable workflow, no authorized target workspace, or a
+destructive/credential boundary genuinely prevents the handoff.
+
 In a new Project chat, say:
 
 ```text

package/corpus/templates/assets/app/i18n/index.ts

@@ -1,34 +1,19 @@
-import { type AgentNativeI18nCatalog } from "@agent-native/core/client/i18n";
+import { createAgentNativeI18nCatalog } from "@agent-native/core/client/i18n";
 
 import enUS from "./en-US";
 
-export const i18nCatalog = {
-  sourceLocale: "en-US",
+export const i18nCatalog = createAgentNativeI18nCatalog({
   messages: enUS,
-  loadMessages: async (locale) => {
-    switch (locale) {
-      case "zh-CN":
-        return (await import("./zh-CN")).default;
-      case "zh-TW":
-        return (await import("./zh-TW")).default;
-      case "es-ES":
-        return (await import("./es-ES")).default;
-      case "fr-FR":
-        return (await import("./fr-FR")).default;
-      case "de-DE":
-        return (await import("./de-DE")).default;
-      case "ja-JP":
-        return (await import("./ja-JP")).default;
-      case "ko-KR":
-        return (await import("./ko-KR")).default;
-      case "pt-BR":
-        return (await import("./pt-BR")).default;
-      case "hi-IN":
-        return (await import("./hi-IN")).default;
-      case "ar-SA":
-        return (await import("./ar-SA")).default;
-      default:
-        return null;
-    }
+  localeLoaders: {
+    "zh-CN": () => import("./zh-CN"),
+    "zh-TW": () => import("./zh-TW"),
+    "es-ES": () => import("./es-ES"),
+    "fr-FR": () => import("./fr-FR"),
+    "de-DE": () => import("./de-DE"),
+    "ja-JP": () => import("./ja-JP"),
+    "ko-KR": () => import("./ko-KR"),
+    "pt-BR": () => import("./pt-BR"),
+    "hi-IN": () => import("./hi-IN"),
+    "ar-SA": () => import("./ar-SA"),
   },
-} satisfies AgentNativeI18nCatalog;
+});

package/corpus/templates/brain/.agents/skills/adding-a-feature/SKILL.md

@@ -81,6 +81,13 @@ or other file-like payloads, design the upload path in the same change:
 provider upload first, then URL/id/blob handle in SQL. Do not add base64/binary
 columns or stuff files into `application_state`.
 
+If the feature adds a server-side dependency carrying a native binary or heavy
+runtime — headless browser, ffmpeg, image/video processing, ML runtime — read
+the `performance` skill §9 before adding it. A deployed app has one `/*` page
+function that every visitor's cache miss wakes, and it ships whatever the server
+bundle depends on. Run that work from a background function or a job so the page
+function never carries the weight.
+
 **If the action produces or lists a navigable resource**, add a `link` builder that returns `{ url: buildDeepLink({ app, view, params }), label }`. External coding agents and MCP hosts (Claude / ChatGPT / Claude Code / Cowork / Codex, over MCP/A2A) then surface an "Open in … →" deep link that drops the user back into the running UI focused on the record — for free. If a compatible MCP host should render an inline review/edit surface, also add `mcpApp` with `embedApp()` so the action embeds the real React app route instead of a one-off HTML UI. The `link` builder and `mcpApp` metadata must be pure and synchronous (no I/O). Any external-agent read/ingest action must be `http: { method: "GET" }` + `readOnly: true` + `publicAgent: { expose: true, readOnly: true, requiresAuth: true }`. See the `external-agents` skill.
 
 ### 3. Skills / Instructions
@@ -195,4 +202,6 @@ TL;DR: declare the vocabulary once with `defineAppRoles({ appId, roles, defaultR
 - **create-skill** — How to create skills for new patterns (area 3 in detail)
 - **storing-data** — Where to store the feature's data
 - **real-time-sync** — How the UI stays in sync when the agent writes data
+- **performance** — Query/load cost, and (§9) cold-start artifact size when a
+  feature adds a server-side dependency
 - **internationalization** — How to update localized UI copy and catalogs