@agent-native/core 0.37.3 → 0.39.0

package/dist/styles/rich-markdown-editor.css

@@ -0,0 +1,439 @@
+.an-rich-md-wrapper {
+  min-height: 100%;
+  position: relative;
+  cursor: text;
+}
+
+.an-rich-md-wrapper--readonly {
+  cursor: default;
+}
+
+.an-rich-md-loading {
+  min-height: 7rem;
+}
+
+.an-rich-md-prose {
+  outline: none;
+  color: hsl(var(--foreground));
+  line-height: 1.65;
+  font-size: 0.95rem;
+  min-height: 1.65em;
+}
+
+.an-rich-md-prose > *:first-child {
+  margin-top: 0;
+}
+
+.an-rich-md-prose h1 {
+  font-size: 1.85em;
+  font-weight: 700;
+  margin: 1em 0 0.3em;
+  line-height: 1.18;
+}
+
+.an-rich-md-prose h2 {
+  font-size: 1.45em;
+  font-weight: 650;
+  margin: 0.9em 0 0.25em;
+  line-height: 1.25;
+}
+
+.an-rich-md-prose h3 {
+  font-size: 1.18em;
+  font-weight: 650;
+  margin: 0.75em 0 0.2em;
+  line-height: 1.32;
+}
+
+.an-rich-md-prose h4 {
+  font-size: 1em;
+  font-weight: 650;
+  margin: 0.65em 0 0.15em;
+  line-height: 1.35;
+}
+
+.an-rich-md-prose p {
+  margin: 0.45em 0;
+  min-height: 1.65em;
+}
+
+.an-rich-md-prose ul:not(.an-rich-md-task-list),
+.an-rich-md-prose ol {
+  padding-left: 1.45em;
+  margin: 0.35em 0;
+}
+
+.an-rich-md-prose ul:not(.an-rich-md-task-list) {
+  list-style-type: disc;
+}
+
+.an-rich-md-prose ol {
+  list-style-type: decimal;
+}
+
+.an-rich-md-prose li {
+  margin: 0.12em 0;
+}
+
+.an-rich-md-prose li p {
+  margin: 0;
+}
+
+.an-rich-md-task-list {
+  list-style: none;
+  margin: 0.35em 0;
+  padding-left: 0;
+}
+
+.an-rich-md-task-list li {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.45em;
+  margin: 0.18em 0;
+}
+
+.an-rich-md-task-list li label {
+  display: inline-flex;
+  align-items: center;
+  height: 1.65em;
+}
+
+.an-rich-md-task-list li input[type="checkbox"] {
+  width: 0.95em;
+  height: 0.95em;
+  accent-color: hsl(var(--primary));
+}
+
+.an-rich-md-task-list li > div {
+  flex: 1;
+}
+
+.an-rich-md-prose blockquote {
+  border-left: 2px solid hsl(var(--border));
+  padding-left: 0.9em;
+  margin: 0.45em 0;
+  color: hsl(var(--muted-foreground));
+}
+
+.an-rich-md-prose code {
+  font-family:
+    ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
+  font-size: 0.88em;
+  background: hsl(var(--muted));
+  padding: 0.12em 0.32em;
+  border-radius: 4px;
+}
+
+.an-rich-md-prose pre {
+  font-family:
+    ui-monospace, SFMono-Regular, "SF Mono", Menlo, Consolas, monospace;
+  font-size: 0.86em;
+  /* Fixed dark code surface (theme-independent) so the github-dark token palette
+     below stays legible — matches the read-side Shiki convention. */
+  background: hsl(220 13% 11%);
+  color: hsl(220 14% 90%);
+  border-radius: 6px;
+  padding: 0.8em 1em;
+  margin: 0.55em 0;
+  overflow-x: auto;
+  line-height: 1.5;
+}
+
+.an-rich-md-prose pre code {
+  background: none;
+  border: none;
+  padding: 0;
+  font-size: inherit;
+  color: inherit;
+}
+
+/* highlight.js (lowlight) token palette — github-dark. Scoped to block code so
+   inline `code` keeps its own background. No highlight.js base theme is imported;
+   these rules are the entire theme, so the dark `pre` surface above is safe. */
+.an-rich-md-prose pre code .hljs-comment,
+.an-rich-md-prose pre code .hljs-quote {
+  color: #8b949e;
+  font-style: italic;
+}
+.an-rich-md-prose pre code .hljs-keyword,
+.an-rich-md-prose pre code .hljs-selector-tag,
+.an-rich-md-prose pre code .hljs-literal,
+.an-rich-md-prose pre code .hljs-doctag,
+.an-rich-md-prose pre code .hljs-deletion {
+  color: #ff7b72;
+}
+.an-rich-md-prose pre code .hljs-string,
+.an-rich-md-prose pre code .hljs-regexp,
+.an-rich-md-prose pre code .hljs-addition {
+  color: #a5d6ff;
+}
+.an-rich-md-prose pre code .hljs-number,
+.an-rich-md-prose pre code .hljs-symbol,
+.an-rich-md-prose pre code .hljs-meta {
+  color: #79c0ff;
+}
+.an-rich-md-prose pre code .hljs-title,
+.an-rich-md-prose pre code .hljs-title.function_,
+.an-rich-md-prose pre code .hljs-section {
+  color: #d2a8ff;
+}
+.an-rich-md-prose pre code .hljs-built_in,
+.an-rich-md-prose pre code .hljs-type,
+.an-rich-md-prose pre code .hljs-title.class_,
+.an-rich-md-prose pre code .hljs-variable.language_ {
+  color: #ffa657;
+}
+.an-rich-md-prose pre code .hljs-attr,
+.an-rich-md-prose pre code .hljs-attribute,
+.an-rich-md-prose pre code .hljs-property,
+.an-rich-md-prose pre code .hljs-params {
+  color: #79c0ff;
+}
+.an-rich-md-prose pre code .hljs-name,
+.an-rich-md-prose pre code .hljs-tag,
+.an-rich-md-prose pre code .hljs-selector-id,
+.an-rich-md-prose pre code .hljs-selector-class {
+  color: #7ee787;
+}
+.an-rich-md-prose pre code .hljs-emphasis {
+  font-style: italic;
+}
+.an-rich-md-prose pre code .hljs-strong {
+  font-weight: 600;
+}
+
+.an-rich-md-prose hr {
+  border: none;
+  border-top: 1px solid hsl(var(--border));
+  margin: 1.1em 0;
+}
+
+.an-rich-md-table {
+  width: 100%;
+  border-collapse: collapse;
+  margin: 0.7em 0;
+  table-layout: fixed;
+}
+
+.an-rich-md-table td,
+.an-rich-md-table th {
+  border: 1px solid hsl(var(--border));
+  padding: 0.45em 0.55em;
+  vertical-align: top;
+}
+
+.an-rich-md-table th {
+  background: hsl(var(--muted) / 0.6);
+  font-weight: 650;
+}
+
+.an-rich-md-table p {
+  margin: 0;
+}
+
+.an-rich-md-prose strong {
+  font-weight: 650;
+}
+
+.an-rich-md-prose em {
+  font-style: italic;
+}
+
+.an-rich-md-prose s {
+  text-decoration: line-through;
+}
+
+.an-rich-md-link {
+  color: hsl(var(--foreground));
+  text-decoration: underline;
+  text-underline-offset: 2px;
+  text-decoration-color: hsl(var(--muted-foreground));
+  cursor: pointer;
+}
+
+.an-rich-md-link:hover {
+  text-decoration-color: hsl(var(--foreground));
+}
+
+.an-rich-md-prose p.is-editor-empty:first-child::before,
+.an-rich-md-prose p.is-empty::before,
+.an-rich-md-prose h1.is-empty::before,
+.an-rich-md-prose h2.is-empty::before,
+.an-rich-md-prose h3.is-empty::before,
+.an-rich-md-prose h4.is-empty::before {
+  content: attr(data-placeholder);
+  float: left;
+  color: hsl(var(--muted-foreground));
+  opacity: 0.55;
+  pointer-events: none;
+  height: 0;
+}
+
+.an-rich-md-prose ::selection {
+  background: hsl(var(--ring) / 0.22);
+}
+
+.an-rich-md-bubble-toolbar {
+  z-index: 9999;
+  display: flex;
+  align-items: center;
+  border-radius: 6px;
+  background: hsl(0 0% 15%);
+  padding: 3px;
+  box-shadow:
+    0 4px 16px rgb(0 0 0 / 0.25),
+    0 0 0 1px rgb(255 255 255 / 0.06);
+}
+
+.an-rich-md-bubble-items,
+.an-rich-md-link-editor {
+  display: flex;
+  align-items: center;
+  gap: 2px;
+}
+
+.an-rich-md-bubble-button {
+  padding: 3px 6px;
+  border-radius: 4px;
+  font-size: 12px;
+  color: rgb(255 255 255 / 0.76);
+  background: none;
+  border: none;
+  cursor: pointer;
+  line-height: 1;
+}
+
+.an-rich-md-bubble-button:hover {
+  background: rgb(255 255 255 / 0.12);
+  color: white;
+}
+
+.an-rich-md-bubble-button--active {
+  background: rgb(255 255 255 / 0.18);
+  color: white;
+}
+
+.an-rich-md-bubble-divider {
+  width: 1px;
+  height: 16px;
+  margin: 0 2px;
+  background: rgb(255 255 255 / 0.2);
+}
+
+.an-rich-md-link-editor {
+  padding: 4px;
+}
+
+.an-rich-md-link-editor input {
+  width: 10rem;
+  border: none;
+  outline: none;
+  background: transparent;
+  color: white;
+  font-size: 12px;
+  padding: 2px 4px;
+}
+
+.an-rich-md-link-editor button {
+  border: none;
+  background: none;
+  color: #60a5fa;
+  cursor: pointer;
+  font-size: 11px;
+  font-weight: 500;
+  padding: 2px 6px;
+}
+
+.an-rich-md-slash-menu {
+  z-index: 9999;
+  min-width: 230px;
+  max-height: 320px;
+  overflow-y: auto;
+  color: hsl(var(--foreground));
+  background: hsl(var(--popover));
+  border: 1px solid hsl(var(--border));
+  border-radius: 7px;
+  box-shadow:
+    0 4px 20px rgb(0 0 0 / 0.12),
+    0 0 0 1px rgb(0 0 0 / 0.04);
+  padding: 4px 0;
+}
+
+.an-rich-md-slash-heading {
+  padding: 4px 10px;
+  font-size: 10px;
+  font-weight: 650;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: hsl(var(--muted-foreground));
+}
+
+.an-rich-md-slash-item {
+  width: 100%;
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 6px 10px;
+  text-align: left;
+  background: none;
+  border: none;
+  cursor: pointer;
+  color: hsl(var(--foreground));
+  font-size: 13px;
+}
+
+.an-rich-md-slash-item:hover,
+.an-rich-md-slash-item--active {
+  background: hsl(var(--accent));
+}
+
+.an-rich-md-slash-icon {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  width: 28px;
+  height: 28px;
+  border-radius: 4px;
+  border: 1px solid hsl(var(--border));
+  background: hsl(var(--background));
+  font-size: 11px;
+  font-weight: 650;
+  color: hsl(var(--muted-foreground));
+  flex-shrink: 0;
+}
+
+.an-rich-md-slash-title {
+  display: block;
+  font-weight: 500;
+  font-size: 13px;
+}
+
+.an-rich-md-slash-description {
+  display: block;
+  font-size: 11px;
+  color: hsl(var(--muted-foreground));
+}
+
+/* Shared block-level image node (the editor's `.an-rich-md-image` and the
+   read-only markdown renderer's <img>). Constrained to the prose width and
+   responsive; a still-uploading placeholder (empty src) shows a subtle frame. */
+.an-rich-md-prose img,
+.an-rich-md-image {
+  display: block;
+  max-width: 100%;
+  height: auto;
+  margin: 12px 0;
+  border-radius: 8px;
+}
+
+.an-rich-md-image[src=""],
+.an-rich-md-image:not([src]) {
+  min-height: 64px;
+  background: hsl(var(--muted));
+  border: 1px dashed hsl(var(--border));
+}
+
+.ProseMirror-selectednode.an-rich-md-image {
+  outline: 2px solid hsl(var(--ring));
+  outline-offset: 2px;
+}

package/dist/templates/default/.agents/skills/actions/SKILL.md

@@ -171,6 +171,7 @@ Older actions use a bare async function export with `parseArgs`:
 import { parseArgs, loadEnv, fail } from "@agent-native/core";
 
 export default async function myAction(args: string[]) {
+  // Only for deploy-level runtime config. User/org credentials use secrets/OAuth.
   loadEnv();
   const parsed = parseArgs(args);
   // ...
@@ -185,7 +186,9 @@ This still works but is not auto-exposed as HTTP. Prefer `defineAction` for all
 - **Return structured data.** Return objects/arrays, not `JSON.stringify()`.
 - **Use `http: { method: "GET" }`** for read-only actions. Default is POST.
 - **Use `http: false`** for agent-only actions (`navigate`, `view-screen`).
-- **Use `loadEnv()`** if the action needs environment variables (API keys, etc.).
+- **Use `loadEnv()`** only for deploy-level configuration. User/org/workspace
+  credentials belong in the encrypted secrets/credential/OAuth stores, never as
+  hardcoded literals, shared env fallbacks, logs, or action responses.
 - **Use `fail()`** for user-friendly error messages (exits with message, no stack trace).
 - **Import from `@agent-native/core`** — Don't redefine `parseArgs()` or other utilities locally.
 

package/dist/templates/default/.agents/skills/security/SKILL.md

@@ -82,9 +82,16 @@ new Function(userInput);                                   // NEVER
 
 ## Secrets Management
 
+Never hardcode credential values or real private data. Source, docs, tests,
+fixtures, prompts, screenshots, seed data, application state, action responses,
+and generated app/extension content may name credential keys, but must never
+contain API key values, tokens, webhook URLs, signing secrets, private
+Builder/internal data, or customer data.
+
 | Secret type | Where to store | Why |
-|-------------|---------------|-----|
-| API keys (OpenAI, Stripe, etc.) | `.env` file (gitignored) | Never committed, server-side only |
+|-------------|----------------|-----|
+| User/org/workspace API keys, service tokens, webhook secrets | Secrets registry / `app_secrets` vault or `saveCredential` / `resolveCredential` | Encrypted, scoped, never sent to the client |
+| Deploy-only infrastructure secrets | Deployment env vars (`.env` only for local dev) | Server-side runtime configuration |
 | OAuth tokens (Google, GitHub) | `oauth_tokens` store | Per-user, per-provider, server-side |
 | App configuration | `settings` store | OK for non-secret config (themes, preferences) |
 | Session tokens | Framework handles | Automatic via Better Auth |
@@ -94,6 +101,8 @@ new Function(userInput);                                   // NEVER
 - Never return secrets in action responses — they may appear in agent chat or client UI
 - Never log secrets (tokens, keys, passwords)
 - Never commit `.env` files — they're gitignored by default
+- Use env vars only for deploy-level secrets. User/org/workspace credentials
+  must use the encrypted secrets/credential/OAuth stores.
 - Access env vars via `process.env` in actions/server code, never send them to the client
 
 ## Auth Patterns
@@ -193,7 +202,7 @@ A2A_SECRET=your-shared-secret-at-least-32-chars
 ```
 
 **How it works:**
-1. App A signs a JWT with `A2A_SECRET` containing `sub: "steve@builder.io"`
+1. App A signs a JWT with `A2A_SECRET` containing `sub: "user@example.com"`
 2. App B receives the call, verifies the JWT signature
 3. App B sets `AGENT_USER_EMAIL` from the verified `sub` claim
 4. Data scoping applies — App B only shows steve's data
@@ -206,7 +215,7 @@ Without `A2A_SECRET`, A2A calls are unauthenticated (fine for local dev, not pro
 2. **Always use `defineAction` with a Zod `schema:`** for input validation on user-facing actions.
 3. **Never concatenate user input into SQL** — use parameterized queries or Drizzle ORM.
 4. **Never use `dangerouslySetInnerHTML`** or `innerHTML` with user-controlled content.
-5. **Never store secrets outside `.env` or `oauth_tokens`** — no settings, no source code, no responses.
+5. **Never hardcode or expose secrets** — no settings, application state, source code, fixtures, logs, or responses. Use the secrets registry / vault, scoped credentials, OAuth stores, or deploy-level env vars as appropriate.
 6. **Never bypass scoping** — don't raw-query tables without going through `db-query`/`db-exec`.
 7. **Never create unprotected routes that modify data** — use `defineAction` or check `getSession()`.
 8. **Don't hardcode emails** — use `AGENT_USER_EMAIL` environment variable.

package/dist/templates/default/.agents/skills/storing-data/SKILL.md

@@ -16,7 +16,7 @@ There are three storage layers, each for a different kind of data:
 
 ### 1. Settings — app configuration
 
-Key-value store for persistent config that the user or agent can change. Theme, preferences, integration API keys, availability schedules.
+Key-value store for persistent non-secret config that the user or agent can change. Theme, preferences, integration settings, availability schedules.
 
 ```ts
 import { getSetting, putSetting } from "@agent-native/core/settings";
@@ -88,6 +88,15 @@ const tokens = await getOAuthTokens("google", "user@gmail.com");
 const accounts = await listOAuthAccounts("google");
 ```
 
+### 5. Secrets / Credentials — encrypted values
+
+For API keys, service tokens, webhook secrets, and user/org/workspace
+credentials. Register user-facing secrets with the secrets registry and read
+them server-side with `readAppSecret`, or use `saveCredential` /
+`resolveCredential` for scoped credential lookup. Never store these values in
+settings, application state, source code, docs, examples, logs, or action
+responses.
+
 ## Which Layer to Use
 
 | Data | Layer | Why |
@@ -96,6 +105,7 @@ const accounts = await listOAuthAccounts("google");
 | What the user sees on screen | Application State | Ephemeral, real-time sync, agent ↔ UI bridge |
 | Compose drafts, wizard steps | Application State | Temporary, deleted when done |
 | Domain records (forms, bookings) | Drizzle table | Needs schema, queries, relationships |
+| API keys, service tokens, webhook secrets | Secrets / credentials | Encrypted and scoped; never client-readable |
 | OAuth refresh tokens | OAuth Tokens | Secure, per-provider, per-account |
 
 ## Environment Variables
@@ -107,10 +117,12 @@ Infrastructure config stays in `.env` — these differ per deployment:
 - `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET` — OAuth app credentials
 - `ACCESS_TOKEN` — production auth token
 
-Everything else (user settings, tokens, app state) goes in SQL.
+Everything else (user settings, app state, domain data) goes in SQL through the
+appropriate store. User/org/workspace credential values go in the encrypted
+secrets/credential stores, not plain settings rows.
 
 ## Security Rules
 
-- **Never store API keys or secrets in Settings or Application State** — use `.env` for API keys (gitignored) and the `oauth_tokens` store for OAuth credentials. Settings and application state are readable by the client.
+- **Never store API keys or secrets in Settings or Application State** — use the secrets registry / vault or `saveCredential` / `resolveCredential` for API keys and service tokens, deploy env vars only for deploy-level secrets, and `oauth_tokens` for OAuth credentials. Settings and application state are readable by the client.
 - **Every Drizzle table with user data must have `owner_email`** — the framework auto-scopes queries in production so users only see their own data. Run `pnpm action db-check-scoping` to verify. See the `security` skill for the full model.
 - **Never return secrets in action responses** — action responses may be visible in the agent chat or sent to the client. Keep credentials server-side only.

package/dist/templates/default/AGENTS.md

@@ -11,6 +11,7 @@ This is an **@agent-native/core** application -- the AI agent and UI share state
 3. **Actions for app operations** -- `pnpm action <name>` dispatches to callable action files in `actions/`; `defineAction` also auto-exposes those operations at `/_agent-native/actions/:name` for the UI. Do not create custom REST routes that re-export actions.
 4. **Live sync keeps the UI current** -- Database writes stream over `/_agent-native/events` first, with `/_agent-native/poll` as the fallback. **When you (the agent) write data, the UI must reflect the change without a manual refresh.** This is non-negotiable. Use `useActionQuery` / `useActionMutation` for action-backed data (preferred). If you use raw `useQuery`, fold `useChangeVersions([<source>, "action"])` into the key for targeted refreshes. See the `real-time-sync` and `adding-a-feature` skills.
 5. **Agent can update code** -- The agent can modify this app's source code directly.
+6. **No hardcoded secrets or private data** -- Never put API keys, tokens, webhook URLs, signing secrets, private Builder/internal data, customer data, or credential-looking literals in source, docs, tests, fixtures, prompts, screenshots, application state, action responses, or generated content. Use secrets/OAuth/runtime configuration and obvious placeholders in examples.
 
 ### Database Code
 

package/dist/templates/default/DEVELOPING.md

@@ -120,6 +120,8 @@ agentChat.submit("Generate something");
 
 Local development defaults to a SQLite file at `data/app.db`. That local file is for development; containers, previews, and serverless deploys can reset their filesystem. For production/cloud deployment, set `DATABASE_URL` to point to a persistent SQL database. Turso is optional, not required; common choices include Neon, Supabase, Turso/libSQL, plain Postgres, durable SQLite, D1 bindings, and Builder.io-managed environments when available.
 
+Real credential values belong only in local `.env` files, deployment configuration, or registered secrets/settings UI. Never commit, document, log, return, paste, or include real keys, tokens, webhook URLs, signing secrets, or private data in examples; use empty values or obvious placeholders.
+
 When adding app data, define tables with `@agent-native/core/db/schema` helpers and use Drizzle's query builder for reads/writes. Do not import dialect-specific schema helpers from `drizzle-orm/sqlite-core` or `drizzle-orm/pg-core`, and do not write raw SQL in normal actions or handlers when Drizzle can express the query. Raw SQL belongs in additive migrations, health checks, or carefully scoped maintenance.
 
 | Variable              | Required                        | Description                                                                |

package/dist/templates/workspace-core/.agents/skills/a2a-protocol/SKILL.md

@@ -4,6 +4,8 @@ description: >-
   How agents call other agents via the A2A (agent-to-agent) JSON-RPC protocol.
   Use when enabling inter-agent communication, exposing agent skills to other
   agents, or calling external agents from scripts.
+metadata:
+  internal: true
 ---
 
 # A2A Protocol (Agent-to-Agent)
@@ -175,10 +177,15 @@ submitted → working → completed
 
 A2A uses bearer token auth. The server reads the token from the environment variable specified by `apiKeyEnv`:
 
-- Set `A2A_API_KEY=my-secret-token` in the server's environment
-- Callers pass it as `Authorization: Bearer my-secret-token`
+- Set `A2A_API_KEY=<A2A_API_KEY_VALUE>` in the server's deployment environment
+- Callers pass it as `Authorization: Bearer <A2A_API_KEY_VALUE>`
 - The agent card endpoint (`/.well-known/agent-card.json`) is public — no auth needed for discovery
 
+Never hardcode the bearer token in source, docs, prompts, app state, action
+descriptions, client bundles, or examples. A2A tokens are deploy-level secrets
+unless a specific app designs a scoped credential flow; read them from secure
+runtime configuration and never log or return them.
+
 ## Message Parts
 
 Messages contain typed parts:
@@ -247,5 +254,5 @@ import type {
 ## Related Skills
 
 - **delegate-to-agent** — For work the local agent handles. Use A2A when the work goes to a different agent.
-- **scripts** — A2A calls typically happen in scripts
+- **actions** — A2A calls typically happen inside actions
 - **storing-data** — Results from A2A calls are stored in SQL like any other data