@agent-native/core 0.7.14 → 0.7.16

package/docs/content/template-mail.md

@@ -1,26 +1,79 @@
 ---
-title: "Mail Template"
-description: "An agent-native email client. A Gmail and Superhuman alternative you own."
+title: "Mail"
+description: "An agent-powered email client. Connect your Gmail and the agent can read, draft, send, and organize email for you."
 ---
 
-# Mail Template
+# Mail
 
-Mail is an agent-native email client built on `@agent-native/core`. It reads from your real Gmail when you connect a Google account, and works as a local mailbox when you don't — with an AI agent that can triage, search, draft, and send on your behalf.
+An agent-powered email client. Connect your Gmail account and the agent can read, draft, send, and organize email for you — alongside a fast, keyboard-first inbox you can drive yourself. Think Superhuman, but the agent is a first-class citizen and the codebase is yours to own.
 
-## Overview {#overview}
+When you open the app, you'll see your inbox on the left, the open thread in the middle, and the agent in the sidebar on the right. The agent always knows which view you're in and which thread you have open, so you can say "archive this" or "draft a friendly decline" without explaining what "this" is.
 
-Mail is a drop-in replacement for Gmail and Superhuman. The UI is keyboard-first: a thread list on the left, the open thread in the middle, and a compose panel that opens as tabs on the right. The agent sits alongside in the sidebar and has the same powers the UI has — read, search, archive, label, star, draft, and send — via actions in `templates/mail/actions/`.
+## What you can do with it
 
-Use it if you want:
+- **Read and triage email** with keyboard shortcuts (`J`/`K` to move, `E` to archive, `R` to reply, `C` to compose).
+- **Connect multiple Gmail accounts** — personal and work in one inbox.
+- **Ask the agent to do anything you can do.** "Summarize my unread emails." "Draft a reply that politely declines." "Archive all Netlify bot emails older than a week."
+- **Auto-triage with rules.** Set up automation rules in plain English ("from a newsletter") with actions (label, archive, mark read, star, trash).
+- **Track opens and clicks** on the emails you send.
+- **Search across every connected inbox** with one query.
+- **Bulk archive, export, and label** — useful for inbox cleanup.
 
-- An email client where an AI agent can actually work on your mail, not just suggest.
-- Superhuman-style keyboard shortcuts without the subscription.
-- Multi-account Gmail support (personal + work in one inbox).
-- Your own codebase. Fork it, change anything, own the data.
+## Getting started
 
-The agent always knows which view, thread, and message you're looking at because the UI writes that state into SQL (`application_state`) where the agent can read it.
+Live demo: [mail.agent-native.com](https://mail.agent-native.com).
 
-## Quick start {#quick-start}
+When you first open the app:
+
+1. Click **Settings** in the sidebar.
+2. Click **Connect Google account**, sign in to Gmail, and approve.
+3. (Optional) Connect a second Google account for work + personal.
+4. Head back to the inbox — your real Gmail will sync in.
+
+Without a Google account connected, the app runs against an empty local mailbox (useful for screenshots and demos, not much else).
+
+## Talking to the agent
+
+The agent reads `application_state.navigation` on every turn, so it already knows which view you're in, which thread is open, and which message is focused — you don't have to tell it. You can just say things like:
+
+- "Summarize my unread emails."
+- "Find the latest thread from Alice about the budget."
+- "Draft a reply that politely declines."
+- "Archive all Netlify bot emails older than a week."
+- "Open my starred emails."
+- "Make this draft more formal."
+- "Did they open my email?"
+
+If you select text and hit Cmd+I, that selection travels with your next message — so "make this punchier" operates on exactly what you highlighted.
+
+## Keyboard shortcuts
+
+| Key       | Action                      |
+| --------- | --------------------------- |
+| `J`       | Next email                  |
+| `K`       | Previous email              |
+| `Up/Down` | Same as J/K                 |
+| `Enter`   | Open focused email          |
+| `E`       | Archive email or thread     |
+| `D`       | Trash email or thread       |
+| `S`       | Star or unstar              |
+| `R`       | Reply                       |
+| `U`       | Toggle read/unread          |
+| `C`       | Compose new email           |
+| `/`       | Focus search bar            |
+| `Cmd+K`   | Open command palette        |
+| `G I`     | Go to Inbox                 |
+| `G S`     | Go to Starred               |
+| `G T`     | Go to Sent                  |
+| `G D`     | Go to Drafts                |
+| `G A`     | Go to Archive               |
+| `Esc`     | Close thread / clear search |
+
+## For developers
+
+The rest of this doc is for anyone forking the Mail template or extending it.
+
+### Quick start
 
 Create a new workspace with the Mail template:
 
@@ -37,94 +90,39 @@ Or add Mail to an existing agent-native workspace:
 agent-native add-app
 ```
 
-Live demo: [mail.agent-native.com](https://mail.agent-native.com)
-
-On first run, connect a Google account from Settings to sync real Gmail. Without a Google account, the app runs against an empty local email store (useful for screenshots or demos).
-
-## Key features {#key-features}
+### Key features (technical)
 
-### Gmail sync (multi-account)
+**Gmail sync (multi-account).** Connect one or many Google accounts via OAuth. List and search actions query all connected inboxes by default; results carry an `accountEmail` field so you can tell which inbox each thread came from. Scope to a single account with `--account=user@example.com`. OAuth tokens are stored via `@agent-native/core/oauth-tokens` under the `"google"` provider.
 
-Connect one or many Google accounts via OAuth. List and search actions query all connected inboxes by default; results carry an `accountEmail` field so you can tell which inbox each thread came from. Scope to a single account with `--account=user@example.com`. OAuth tokens are stored via `@agent-native/core/oauth-tokens` under the `"google"` provider.
+**Multiple compose drafts.** The compose panel supports multiple draft tabs at once. Each draft is stored as an `application_state` entry at `compose-{id}` and syncs live between the agent and the UI. The agent can create a new draft with `manage-draft --action=create`, edit your in-progress draft with `--action=update`, or close tabs with `--action=delete`. Drafts use markdown in the body field; the TipTap editor renders it as rich text and converts to HTML on send.
 
-### Keyboard-first navigation
+**AI triage via automations.** Mail supports automation rules that run against new inbox email using AI. A rule has a natural-language condition (for example, `"from a newsletter"` or `"subject contains invoice"`) and a list of actions (`label`, `archive`, `mark_read`, `star`, `trash`). Manage them via `pnpm action manage-automations --action=create|list|update|delete|enable|disable`, or through the Settings page. Rules fire automatically and can be triggered manually with `pnpm action trigger-automations`.
 
-The app is designed to run without a mouse. `J`/`K` move between threads, `E` archives, `R` replies, `C` composes, `/` focuses search, and `G` begins a "go to" chord (`G I` for Inbox, `G S` for Starred, etc.). See the [full list below](#keyboard-shortcuts).
+**Send tracking.** Sent messages get open-pixel and link-click tracking injected automatically. Settings live under `mail-settings.tracking` with `tracking.opens` and `tracking.clicks` (both default `true`). Only links in the new portion of a reply or forward are rewritten — quoted content is left alone. Pull stats for any sent message with `pnpm action get-tracking --id=<message-id>`, or from `GET /api/emails/:id/tracking`. Open and click events are stored in the `email_tracking` and `email_link_tracking` tables.
 
-### Multiple compose drafts
+**Search.** `pnpm action search-emails --q=<term>` searches across all views and all connected accounts. The UI search bar maps to the same action. Both `search-emails` and `list-emails` take `--compact` for shorter output and `--fields=from,subject,date` to limit returned fields.
 
-The compose panel supports multiple draft tabs at once. Each draft is stored as an `application_state` entry at `compose-{id}` and syncs live between the agent and the UI. The agent can create a new draft with `manage-draft --action=create`, edit your in-progress draft with `--action=update`, or close tabs with `--action=delete`. Drafts use markdown in the body field; the TipTap editor renders it as rich text and converts to HTML on send.
-
-### AI triage via automations
-
-Mail supports automation rules that run against new inbox email using AI. A rule has a natural-language condition (for example, `"from a newsletter"` or `"subject contains invoice"`) and a list of actions (`label`, `archive`, `mark_read`, `star`, `trash`). Manage them via `pnpm action manage-automations --action=create|list|update|delete|enable|disable`, or through the Settings page. Rules fire automatically and can be triggered manually with `pnpm action trigger-automations`.
-
-### Send tracking
-
-Sent messages get open-pixel and link-click tracking injected automatically. Settings live under `mail-settings.tracking` with `tracking.opens` and `tracking.clicks` (both default `true`). Only links in the new portion of a reply or forward are rewritten — quoted content is left alone. Pull stats for any sent message with `pnpm action get-tracking --id=<message-id>`, or from `GET /api/emails/:id/tracking`. Open and click events are stored in the `email_tracking` and `email_link_tracking` tables.
-
-### Search
-
-`pnpm action search-emails --q=<term>` searches across all views and all connected accounts. The UI search bar maps to the same action. Both `search-emails` and `list-emails` take `--compact` for shorter output and `--fields=from,subject,date` to limit returned fields.
-
-### Bulk operations and export
+**Bulk operations and export.**
 
 - `pnpm action bulk-archive --older-than=30` archives everything older than N days.
 - `pnpm action export-emails --view=inbox --output=file.json` dumps a view to JSON.
 - Archive, trash, mark-read, and star all accept comma-separated IDs (`--id=id1,id2,id3`) for bulk changes.
 
-### Inline thread previews in agent chat
-
-When the agent answers a question about a specific thread, it can embed a live preview of the thread directly in the chat message via an `embed` code fence. The preview is a sandboxed iframe that shows the full conversation without leaving the chat, with an "Open in app" button that navigates the main window to that thread.
+**Inline thread previews in agent chat.** When the agent answers a question about a specific thread, it can embed a live preview of the thread directly in the chat message via an `embed` code fence. The preview is a sandboxed iframe that shows the full conversation without leaving the chat, with an "Open in app" button that navigates the main window to that thread.
 
-## Working with the agent {#working-with-the-agent}
-
-The agent reads `application_state.navigation` on every turn, so it already knows which view you're in, which thread is open, and which message is focused — you don't have to tell it. You can just say things like:
-
-- "Summarize my unread emails."
-- "Find the latest thread from Alice about the budget."
-- "Draft a reply that politely declines."
-- "Archive all Netlify bot emails older than a week."
-- "Open my starred emails."
-- "Make this draft more formal."
-- "Did they open my email?"
-
-How the agent sees your context:
+### How the agent sees your context
 
 - **Current view and thread** — the UI writes `navigation` (view, threadId, focusedEmailId, search, label) whenever you navigate. The agent reads it via `readAppState("navigation")` or `pnpm action view-screen`.
 - **Open draft** — if you're composing a reply and ask "help me word this", the agent reads the matching `compose-{id}` entry to see your current subject and body, then writes an updated draft back. The UI picks up the edit live.
 - **Thread history** — for context mid-reply, the agent fetches the full thread with `pnpm action get-thread --id=<threadId>`.
 
-How the agent takes action:
+### How the agent takes action
 
 - **Mail operations** — archive, trash, star, mark read, send, draft — all run as `pnpm action <name>` scripts under `templates/mail/actions/`.
 - **Navigation** — to open a thread or switch views for you, the agent writes `application_state.navigate`, which the UI consumes and deletes. The `pnpm action navigate` script wraps this.
 - **Refresh** — after any change, the agent runs `pnpm action refresh-list` so the UI refetches.
 
-## Keyboard shortcuts {#keyboard-shortcuts}
-
-| Key       | Action                      |
-| --------- | --------------------------- |
-| `J`       | Next email                  |
-| `K`       | Previous email              |
-| `Up/Down` | Same as J/K                 |
-| `Enter`   | Open focused email          |
-| `E`       | Archive email or thread     |
-| `D`       | Trash email or thread       |
-| `S`       | Star or unstar              |
-| `R`       | Reply                       |
-| `U`       | Toggle read/unread          |
-| `C`       | Compose new email           |
-| `/`       | Focus search bar            |
-| `Cmd+K`   | Open command palette        |
-| `G I`     | Go to Inbox                 |
-| `G S`     | Go to Starred               |
-| `G T`     | Go to Sent                  |
-| `G D`     | Go to Drafts                |
-| `G A`     | Go to Archive               |
-| `Esc`     | Close thread / clear search |
-
-## Data model {#data-model}
+### Data model
 
 When a Google account is connected, email lives in Gmail — the app is a view on top. When no account is connected, emails live in the SQL settings store under `getSetting("local-emails")` (empty by default).
 
@@ -150,7 +148,7 @@ Routes in the UI:
 - `/settings` — account connections, tracking, automations.
 - `/team` — team members and shared resources.
 
-## Customizing it {#customizing-it}
+### Customizing it
 
 Mail is yours to change. Everything important lives in a handful of places — start there.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.7.14",
+  "version": "0.7.16",
   "type": "module",
   "description": "Framework for agent-native application development — where AI agents and UI share state via files",
   "license": "MIT",
@@ -41,6 +41,7 @@
     "./credentials": "./dist/credentials/index.js",
     "./event-bus": "./dist/event-bus/index.js",
     "./fetch-tool": "./dist/tools/fetch-tool.js",
+    "./tools/url-safety": "./dist/tools/url-safety.js",
     "./file-upload": "./dist/file-upload/index.js",
     "./resources": "./dist/resources/index.js",
     "./resources/store": "./dist/resources/store.js",
@@ -96,6 +97,8 @@
   "dependencies": {
     "@amplitude/analytics-browser": "^2.41.1",
     "@anthropic-ai/sdk": "^0.90.0",
+    "@assistant-ui/react": "^0.12.19",
+    "@assistant-ui/react-markdown": "^0.12.6",
     "@clack/prompts": "^1.2.0",
     "@libsql/client": "^0.15.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
@@ -149,8 +152,6 @@
     "@ai-sdk/groq": ">=3",
     "@ai-sdk/mistral": ">=3",
     "@ai-sdk/openai": ">=3",
-    "@assistant-ui/react": ">=0.12",
-    "@assistant-ui/react-markdown": ">=0.12",
     "@openrouter/ai-sdk-provider": ">=2",
     "@supabase/supabase-js": ">=2",
     "@tabler/icons-react": ">=3",

package/src/templates/default/.agents/skills/delegate-to-agent/SKILL.md

@@ -70,6 +70,59 @@ sendToAgentChat({
 });
 ```
 
+## Capture user input first when generating from a prompt
+
+Buttons that produce new content ("New Design", "Create Dashboard", "Make Deck", "Generate Form") need the user's prompt as input. **Never hardcode a generic message** — the result will be a generic generation the user didn't actually ask for.
+
+**Bad** — auto-submits a placeholder message; the user never said what they wanted:
+
+```tsx
+<Button
+  onClick={() =>
+    sendToAgentChat({ message: "make a design", submit: true })
+  }
+>
+  New Design
+</Button>
+```
+
+**Good** — Popover anchored to the button captures the prompt, then submits it:
+
+```tsx
+<Popover open={open} onOpenChange={setOpen}>
+  <PopoverTrigger asChild>
+    <Button>New Design</Button>
+  </PopoverTrigger>
+  <PopoverContent className="w-96">
+    <Textarea
+      autoFocus
+      value={prompt}
+      onChange={(e) => setPrompt(e.target.value)}
+      placeholder="What do you want to design?"
+    />
+    <Button
+      onClick={() => {
+        sendToAgentChat({ message: prompt, submit: true });
+        setOpen(false);
+        setPrompt("");
+      }}
+    >
+      Create
+    </Button>
+  </PopoverContent>
+</Popover>
+```
+
+**Always ask for input first when** the output depends on a prompt the user must provide — "design what?", "deck about what?", "dashboard for which metric?", "form for which use case?".
+
+**Auto-submit without input is fine when intent is unambiguous:**
+
+- "Try to fix" on a tool error — submits the error details with a clear fix instruction
+- "Retry the last operation" after a transient failure
+- Single-purpose buttons where there is nothing meaningful for the user to add
+
+If you find yourself writing `submit: true` with a hardcoded creative verb (`"design a..."`, `"write a..."`, `"build a..."`), stop and add a Popover.
+
 ## Don't
 
 - Don't `import Anthropic from "@anthropic-ai/sdk"` in client or server code
@@ -77,6 +130,7 @@ sendToAgentChat({
 - Don't make direct API calls to any LLM provider
 - Don't use AI SDK functions like `generateText()`, `streamText()`, etc.
 - Don't build "AI features" that bypass the agent chat
+- Don't auto-submit a hardcoded prompt for generative actions — capture user input first (see above)
 
 ## Exception
 

package/src/templates/default/app/root.tsx

@@ -76,7 +76,7 @@ export default function Root() {
         <QueryClientProvider client={queryClient}>
           <DbSyncSetup />
           <Outlet />
-          <Toaster />
+          <Toaster richColors position="bottom-left" />
         </QueryClientProvider>
       </ThemeProvider>
     </ClientOnly>

package/src/templates/default/app/routes/_index.tsx

@@ -1,4 +1,5 @@
 import { useTheme } from "next-themes";
+import { IconLoader2 } from "@tabler/icons-react";
 
 export function meta() {
   return [{ title: "{{APP_TITLE}}" }];
@@ -7,7 +8,11 @@ export function meta() {
 export function HydrateFallback() {
   return (
     <div className="flex items-center justify-center h-screen">
-      <div className="animate-spin rounded-full h-8 w-8 border-b-2 border-foreground" />
+      <IconLoader2
+        className="size-8 animate-spin text-foreground"
+        role="status"
+        aria-label="Loading"
+      />
     </div>
   );
 }

package/src/templates/default/package.json

@@ -11,7 +11,7 @@
     "script": "agent-native script"
   },
   "dependencies": {
-    "@agent-native/core": "^0.6.0",
+    "@agent-native/core": "latest",
     "@assistant-ui/react": "^0.12.19",
     "@assistant-ui/react-markdown": "^0.12.6",
     "@tabler/icons-react": "^3.40.0",

package/src/templates/default/public/favicon.svg

@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 1024 1024" fill="none">
+  <rect x="100" y="100" width="824" height="824" rx="185" fill="#000000"/>
+  <g transform="translate(198.5 330.5) scale(5.5)">
+    <path d="M24.5537 65.7695H0L15.0859 39.4619L37.708 0L60.4912 39.4619H39.6396L24.5537 65.7695Z" fill="white"/>
+    <path d="M89.446 0H114L76.2921 65.7704H51.7383L89.446 0Z" fill="url(#favicon_grad)"/>
+    <defs>
+      <linearGradient id="favicon_grad" x1="101.702" y1="67.4791" x2="113.672" y2="-37.4275" gradientUnits="userSpaceOnUse">
+        <stop stop-color="#00B5FF"/>
+        <stop offset="1" stop-color="#48FFE4"/>
+      </linearGradient>
+    </defs>
+  </g>
+</svg>

package/src/templates/default/public/icon-180.svg

@@ -1,4 +1,13 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="180" height="180" viewBox="0 0 180 180">
-  <rect width="180" height="180" rx="36" fill="#111111"/>
-  <text x="50%" y="50%" dominant-baseline="central" text-anchor="middle" font-size="99">⚡</text>
+<svg xmlns="http://www.w3.org/2000/svg" width="180" height="180" viewBox="0 0 1024 1024" fill="none">
+  <rect x="100" y="100" width="824" height="824" rx="185" fill="#000000"/>
+  <g transform="translate(198.5 330.5) scale(5.5)">
+    <path d="M24.5537 65.7695H0L15.0859 39.4619L37.708 0L60.4912 39.4619H39.6396L24.5537 65.7695Z" fill="white"/>
+    <path d="M89.446 0H114L76.2921 65.7704H51.7383L89.446 0Z" fill="url(#favicon_grad)"/>
+    <defs>
+      <linearGradient id="favicon_grad" x1="101.702" y1="67.4791" x2="113.672" y2="-37.4275" gradientUnits="userSpaceOnUse">
+        <stop stop-color="#00B5FF"/>
+        <stop offset="1" stop-color="#48FFE4"/>
+      </linearGradient>
+    </defs>
+  </g>
 </svg>

package/src/templates/default/public/icon-192.svg

@@ -1,4 +1,13 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="192" height="192" viewBox="0 0 192 192">
-  <rect width="192" height="192" rx="38" fill="#111111"/>
-  <text x="50%" y="50%" dominant-baseline="central" text-anchor="middle" font-size="105">⚡</text>
+<svg xmlns="http://www.w3.org/2000/svg" width="192" height="192" viewBox="0 0 1024 1024" fill="none">
+  <rect x="100" y="100" width="824" height="824" rx="185" fill="#000000"/>
+  <g transform="translate(198.5 330.5) scale(5.5)">
+    <path d="M24.5537 65.7695H0L15.0859 39.4619L37.708 0L60.4912 39.4619H39.6396L24.5537 65.7695Z" fill="white"/>
+    <path d="M89.446 0H114L76.2921 65.7704H51.7383L89.446 0Z" fill="url(#favicon_grad)"/>
+    <defs>
+      <linearGradient id="favicon_grad" x1="101.702" y1="67.4791" x2="113.672" y2="-37.4275" gradientUnits="userSpaceOnUse">
+        <stop stop-color="#00B5FF"/>
+        <stop offset="1" stop-color="#48FFE4"/>
+      </linearGradient>
+    </defs>
+  </g>
 </svg>

package/src/templates/default/public/icon-512.svg

@@ -1,4 +1,13 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 512 512">
-  <rect width="512" height="512" rx="102" fill="#111111"/>
-  <text x="50%" y="50%" dominant-baseline="central" text-anchor="middle" font-size="281">⚡</text>
+<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 1024 1024" fill="none">
+  <rect x="100" y="100" width="824" height="824" rx="185" fill="#000000"/>
+  <g transform="translate(198.5 330.5) scale(5.5)">
+    <path d="M24.5537 65.7695H0L15.0859 39.4619L37.708 0L60.4912 39.4619H39.6396L24.5537 65.7695Z" fill="white"/>
+    <path d="M89.446 0H114L76.2921 65.7704H51.7383L89.446 0Z" fill="url(#favicon_grad)"/>
+    <defs>
+      <linearGradient id="favicon_grad" x1="101.702" y1="67.4791" x2="113.672" y2="-37.4275" gradientUnits="userSpaceOnUse">
+        <stop stop-color="#00B5FF"/>
+        <stop offset="1" stop-color="#48FFE4"/>
+      </linearGradient>
+    </defs>
+  </g>
 </svg>

package/src/templates/workspace-core/package.json

@@ -6,26 +6,44 @@
   "exports": {
     ".": {
       "types": "./src/index.ts",
-      "default": "./src/index.ts"
+      "development": "./src/index.ts",
+      "default": "./dist/index.js"
     },
     "./server": {
       "types": "./src/server/index.ts",
-      "default": "./src/server/index.ts"
+      "development": "./src/server/index.ts",
+      "default": "./dist/server/index.js"
     },
     "./client": {
       "types": "./src/client/index.ts",
-      "default": "./src/client/index.ts"
+      "development": "./src/client/index.ts",
+      "default": "./dist/client/index.js"
     },
     "./credentials": {
       "types": "./src/credentials.ts",
-      "default": "./src/credentials.ts"
+      "development": "./src/credentials.ts",
+      "default": "./dist/credentials.js"
     },
     "./styles/tokens.css": "./styles/tokens.css"
   },
+  "files": [
+    "dist",
+    "src",
+    "styles",
+    "actions",
+    "AGENTS.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch --preserveWatchOutput",
+    "typecheck": "tsc --noEmit",
+    "prepare": "tsc"
+  },
   "dependencies": {
-    "@agent-native/core": "^0.7.10"
+    "@agent-native/core": "latest"
   },
   "devDependencies": {
+    "@types/node": "^24.2.1",
     "@types/react": "^19.2.14",
     "react": "^19.2.5",
     "typescript": "^6.0.3"

package/src/templates/workspace-core/src/credentials.ts

@@ -7,13 +7,33 @@
  * them here so there's a single place to update when a key rotates.
  *
  * Under the hood this is a thin wrapper over @agent-native/core's
- * `resolveCredential()`, which reads `process.env.<KEY>` first and
- * falls back to `credential:<KEY>` in the shared settings table.
- * Apps inside the workspace share the same DATABASE_URL by default,
- * so storing a credential once makes it available everywhere.
+ * `resolveCredential()`, which reads per-user / per-org rows in the
+ * shared SQL settings table. Apps inside the workspace share the same
+ * DATABASE_URL by default, so storing a credential once makes it
+ * available everywhere.
+ *
+ * Once @agent-native/core publishes the upcoming 2-arg signature you can
+ * extend this to take a `{ userEmail, orgId }` context and pass it through
+ * for per-user / per-org scoping. The current shape works against both
+ * versions — the published 1-arg signature ignores the second argument.
  */
 import { resolveCredential } from "@agent-native/core/credentials";
 
+/**
+ * Optional context for scoping a credential lookup to a specific user or
+ * org. Forward-compatible with the upcoming 2-arg @agent-native/core
+ * signature; ignored by the current 1-arg published one.
+ */
+export interface CompanyCredentialContext {
+  userEmail?: string;
+  orgId?: string | null;
+}
+
+type ResolveCredentialFn = (
+  key: string,
+  ctx?: CompanyCredentialContext,
+) => Promise<string | undefined>;
+
 /**
  * Resolve a company-wide credential. Prefer this over `resolveCredential()`
  * directly — it keeps your keys organized under a workspace namespace and
@@ -21,9 +41,16 @@ import { resolveCredential } from "@agent-native/core/credentials";
  *
  * Example:
  *   const slackToken = await resolveCompanyCredential("SLACK_BOT_TOKEN");
+ *
+ * With per-user scoping (after upgrading @agent-native/core):
+ *   const slackToken = await resolveCompanyCredential("SLACK_BOT_TOKEN", {
+ *     userEmail: session.email,
+ *     orgId: session.orgId ?? null,
+ *   });
  */
 export async function resolveCompanyCredential(
   key: string,
+  ctx?: CompanyCredentialContext,
 ): Promise<string | undefined> {
-  return await resolveCredential(key);
+  return await (resolveCredential as ResolveCredentialFn)(key, ctx);
 }

package/src/templates/workspace-core/tsconfig.json

@@ -3,7 +3,10 @@
   "compilerOptions": {
     "rootDir": "src",
     "outDir": "dist",
-    "noEmit": true
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "composite": false
   },
   "include": ["src/**/*"]
 }