@agent-native/core 0.7.23 → 0.7.25

package/dist/templates/workspace-root/README.md

@@ -1,23 +1,21 @@
 # {{APP_TITLE}} — Agent-Native Workspace
 
 A monorepo hosting multiple agent-native apps that all inherit from a single
-private **workspace core** package. The core module provides shared auth,
-agent instructions, skills, components, and plugins; each app just ships its
-own screens and template-specific actions.
+private **shared** package. The framework provides the defaults; this package
+is only for code, instructions, and policies that are genuinely shared by more
+than one app.
 
 ## Layout
 
 ```
 {{APP_NAME}}/
 ├── packages/
-│   └── core-module/          # @{{APP_NAME}}/core-module — the shared mid-layer
-│       ├── src/server/       # Auth / org / agent-chat plugin overrides
-│       ├── src/client/       # Shared React components (org switcher, layouts…)
-│       ├── actions/          # Shared agent-callable actions
-│       ├── skills/           # Shared .agents skills baked into every app
-│       └── AGENTS.md         # Enterprise-wide agent instructions
+│   └── shared/               # @{{APP_NAME}}/shared — optional shared code
+│       ├── src/server/       # Add plugin overrides only when needed
+│       ├── src/client/       # Add shared React code only when needed
+│       └── AGENTS.md         # Workspace-wide agent instructions
 └── apps/
-    └── example/              # Sample app demonstrating inheritance
+    └── example/              # App-specific routes, actions, and state
 ```
 
 ## Three-layer inheritance
@@ -26,14 +24,14 @@ Every app in this workspace inherits cross-cutting behavior automatically:
 
 1. **App local** (highest priority) — anything under `apps/<name>/server/plugins/`,
    `apps/<name>/actions/`, `apps/<name>/.agents/skills/`, `apps/<name>/AGENTS.md`.
-2. **Workspace core** (middle) — `packages/core-module/src/server/`,
-   `packages/core-module/actions/`, `packages/core-module/skills/`,
-   `packages/core-module/AGENTS.md`.
+2. **Workspace shared** (middle) — `packages/shared/src/server/`,
+   `packages/shared/src/client/`, `packages/shared/actions/`,
+   `packages/shared/.agents/skills/`, `packages/shared/AGENTS.md`.
 3. **Framework** (lowest) — `@agent-native/core` defaults.
 
 Apps don't need any configuration to opt in. Discovery happens via the
 `agent-native.workspaceCore` field in this root `package.json`, which names
-the workspace core package (`@{{APP_NAME}}/core-module`).
+the shared package (`@{{APP_NAME}}/shared`).
 
 ## Getting started
 
@@ -54,12 +52,11 @@ pnpm exec agent-native create crm --template=starter
 ```
 
 The CLI detects the workspace root and scaffolds a minimal app that already
-depends on `@{{APP_NAME}}/core-module`. Edit only the routes you care about;
-auth, org switching, skills, and instructions come from the core module.
+depends on `@{{APP_NAME}}/shared`. Edit only the routes you care about;
+auth, org switching, skills, and instructions come from the shared package.
 
 ## Editing shared behavior
 
-Everything cross-cutting lives in `packages/core-module/`. A change to
-`packages/core-module/src/server/auth-plugin.ts`, for example, is picked up
-by every app in the workspace on the next dev reload — no need to touch any
-individual app.
+Put cross-cutting code in `packages/shared/` when more than one app needs it.
+For example, exporting an `authPlugin` from `packages/shared/src/server/index.ts`
+lets every app use the same auth customization on the next dev reload.

package/dist/templates/workspace-root/_gitignore

@@ -6,6 +6,9 @@ apps/*/build/
 apps/*/.output/
 apps/*/.netlify/
 apps/*/.vercel/
+packages/*/node_modules/
+packages/*/dist/
+packages/*/build/
 .deploy-tmp/
 
 # Env files — never commit secrets

package/dist/templates/workspace-root/package.json

@@ -3,29 +3,22 @@
   "private": true,
   "version": "0.0.0",
   "scripts": {
-    "dev": "tsx scripts/workspace-dev.ts",
+    "dev": "agent-native dev",
     "build": "pnpm -r build",
     "typecheck": "pnpm -r typecheck",
     "fmt:check": "prettier --check .",
     "lint": "pnpm fmt:check"
   },
   "agent-native": {
-    "workspaceCore": "@{{APP_NAME}}/core-module"
+    "workspaceCore": "@{{APP_NAME}}/shared"
+  },
+  "dependencies": {
+    "@agent-native/core": "latest"
   },
   "devDependencies": {
     "@types/node": "^24.2.1",
     "prettier": "^3.6.2",
-    "tsx": "catalog:",
     "typescript": "^6.0.3"
   },
-  "packageManager": "pnpm@10.14.0",
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "better-sqlite3",
-      "esbuild",
-      "lightningcss",
-      "node-pty",
-      "@swc/core"
-    ]
-  }
+  "packageManager": "pnpm@10.14.0"
 }

package/dist/templates/workspace-root/pnpm-workspace.yaml

@@ -3,8 +3,10 @@ packages:
   - "apps/*"
 
 onlyBuiltDependencies:
-  - esbuild
+  - "@swc/core"
   - better-sqlite3
+  - canvas
+  - electron
+  - esbuild
   - lightningcss
   - node-pty
-  - "@swc/core"

package/dist/vite/agents-bundle-plugin.js

@@ -41,7 +41,7 @@ async function emitBundleModule(projectRoot) {
     // analyze and tree-shake if nothing imports it.
     return `// AUTO-GENERATED by @agent-native/core/vite/agents-bundle-plugin
 // Contains the inlined AGENTS.md + .agents/skills/ content from the template,
-// merged with any workspace-core AGENTS.md + skills/ when present.
+// merged with any workspace AGENTS.md + .agents/skills/ when present.
 const bundle = ${JSON.stringify(bundle)};
 export default bundle;
 `;
@@ -68,7 +68,7 @@ export function agentsBundlePlugin() {
         async configureServer(server) {
             // Watch AGENTS.md + any SKILL.md changes and invalidate the virtual
             // module so the next request picks up fresh content. Also watches
-            // the workspace core's AGENTS.md + skills/ directory (if present)
+            // the workspace core's AGENTS.md + skills directory (if present)
             // so edits to the enterprise mid-layer propagate to every app.
             const watcher = server.watcher;
             // Resolve the workspace core up front so we can tell which files

package/dist/vite/agents-bundle-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents-bundle-plugin.js","sourceRoot":"","sources":["../../src/vite/agents-bundle-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,sBAAsB,GAEvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,UAAU,CAAC;AAEtC,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,yEAAyE;IACzE,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,eAAe,GAAiC,IAAI,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,EAAE,EAAE,CAAC;YACP,eAAe,GAAG;gBAChB,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,YAAY,EAAE,EAAE,CAAC,YAAY;gBAC7B,OAAO,EAAE,EAAE,CAAC,UAAU;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,gDAAgD;IAChD,OAAO;;;iBAGQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;;CAEtC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,WAAW,GAAG,EAAE,CAAC;IAErB,OAAO;QACL,IAAI,EAAE,4BAA4B;QAElC,cAAc,CAAC,MAAM;YACnB,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;QAC5B,CAAC;QAED,SAAS,CAAC,EAAE;YACV,IAAI,EAAE,KAAK,UAAU;gBAAE,OAAO,WAAW,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC,WAAW;gBAAE,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC9C,OAAO,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM;YAC1B,oEAAoE;YACpE,kEAAkE;YAClE,kEAAkE;YAClE,+DAA+D;YAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAE/B,iEAAiE;YACjE,mDAAmD;YACnD,IAAI,qBAAqB,GAAkB,IAAI,CAAC;YAChD,IAAI,kBAAkB,GAAkB,IAAI,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;gBACtD,IAAI,EAAE,EAAE,CAAC;oBACP,qBAAqB,GAAG,EAAE,CAAC,YAAY,CAAC;oBACxC,kBAAkB,GAAG,EAAE,CAAC,SAAS,CAAC;gBACpC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAW,EAAE;gBACjD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC7C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,IAAI,GAAG,KAAK,WAAW;wBAAE,OAAO,IAAI,CAAC;oBACrC,IACE,GAAG,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC;wBAC/C,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAExB,OAAO,IAAI,CAAC;gBAChB,CAAC;gBACD,uBAAuB;gBACvB,IAAI,qBAAqB,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC5D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IACE,kBAAkB;oBAClB,IAAI,CAAC,UAAU,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC;oBAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EACzB,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;gBAClC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;oBAAE,OAAO;gBACpC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;gBAC1D,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;oBACzC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC;YAEF,mEAAmE;YACnE,sEAAsE;YACtE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,qBAAqB,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAClE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,kBAAkB,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC5D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAClC,CAAC;YAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACjC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC9B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Vite plugin that resolves `virtual:agents-bundle` to a statically-inlined\n * ES module containing the template's AGENTS.md + .agents/skills/ content.\n *\n * This is how the framework's agent gets its instructions and skills into the\n * system prompt on EVERY deployment target — Node, Netlify Functions, Vercel\n * serverless, and Cloudflare Workers. The content is baked into the server\n * bundle at build time, so nothing needs to exist on the runtime filesystem.\n *\n * In dev mode, the plugin re-reads from disk on each import and triggers HMR\n * when any AGENTS.md or SKILL.md file changes, so edits show up instantly\n * without restarting the server.\n */\nimport path from \"path\";\nimport fs from \"fs\";\nimport type { Plugin } from \"vite\";\nimport {\n  readAgentsBundleFromFs,\n  type WorkspaceAgentsSource,\n} from \"../server/agents-bundle.js\";\nimport { getWorkspaceCoreExports } from \"../deploy/workspace-core.js\";\n\nconst VIRTUAL_ID = \"virtual:agents-bundle\";\nconst RESOLVED_ID = \"\\0\" + VIRTUAL_ID;\n\nasync function emitBundleModule(projectRoot: string): Promise<string> {\n  // If the project is inside an enterprise monorepo with a workspace core,\n  // merge in its AGENTS.md + skills. Template skills override workspace\n  // core skills on name collision.\n  let workspaceSource: WorkspaceAgentsSource | null = null;\n  try {\n    const ws = await getWorkspaceCoreExports(projectRoot);\n    if (ws) {\n      workspaceSource = {\n        skillsDir: ws.skillsDir,\n        agentsMdPath: ws.agentsMdPath,\n        rootDir: ws.packageDir,\n      };\n    }\n  } catch {\n    // fall back to template-only\n  }\n\n  const bundle = readAgentsBundleFromFs(projectRoot, workspaceSource);\n  // Serialize as JSON and wrap in `export default` — this produces a valid\n  // ES module that any bundler (Rollup, esbuild, Rolldown) can statically\n  // analyze and tree-shake if nothing imports it.\n  return `// AUTO-GENERATED by @agent-native/core/vite/agents-bundle-plugin\n// Contains the inlined AGENTS.md + .agents/skills/ content from the template,\n// merged with any workspace-core AGENTS.md + skills/ when present.\nconst bundle = ${JSON.stringify(bundle)};\nexport default bundle;\n`;\n}\n\nexport function agentsBundlePlugin(): Plugin {\n  let projectRoot = \"\";\n\n  return {\n    name: \"agent-native-agents-bundle\",\n\n    configResolved(config) {\n      projectRoot = config.root;\n    },\n\n    resolveId(id) {\n      if (id === VIRTUAL_ID) return RESOLVED_ID;\n      return null;\n    },\n\n    async load(id) {\n      if (id !== RESOLVED_ID) return null;\n      if (!projectRoot) projectRoot = process.cwd();\n      return await emitBundleModule(projectRoot);\n    },\n\n    async configureServer(server) {\n      // Watch AGENTS.md + any SKILL.md changes and invalidate the virtual\n      // module so the next request picks up fresh content. Also watches\n      // the workspace core's AGENTS.md + skills/ directory (if present)\n      // so edits to the enterprise mid-layer propagate to every app.\n      const watcher = server.watcher;\n\n      // Resolve the workspace core up front so we can tell which files\n      // outside projectRoot should trigger invalidation.\n      let workspaceAgentsMdPath: string | null = null;\n      let workspaceSkillsDir: string | null = null;\n      try {\n        const ws = await getWorkspaceCoreExports(projectRoot);\n        if (ws) {\n          workspaceAgentsMdPath = ws.agentsMdPath;\n          workspaceSkillsDir = ws.skillsDir;\n        }\n      } catch {\n        // ignore\n      }\n\n      const shouldInvalidate = (file: string): boolean => {\n        const rel = path.relative(projectRoot, file);\n        if (!rel.startsWith(\"..\")) {\n          if (rel === \"AGENTS.md\") return true;\n          if (\n            rel.startsWith(\".agents\" + path.sep + \"skills\") &&\n            rel.endsWith(\"SKILL.md\")\n          )\n            return true;\n        }\n        // Workspace-core files\n        if (workspaceAgentsMdPath && file === workspaceAgentsMdPath) {\n          return true;\n        }\n        if (\n          workspaceSkillsDir &&\n          file.startsWith(workspaceSkillsDir + path.sep) &&\n          file.endsWith(\"SKILL.md\")\n        ) {\n          return true;\n        }\n        return false;\n      };\n\n      const invalidate = (file: string) => {\n        if (!shouldInvalidate(file)) return;\n        const mod = server.moduleGraph.getModuleById(RESOLVED_ID);\n        if (mod) {\n          server.moduleGraph.invalidateModule(mod);\n          server.ws.send({ type: \"full-reload\" });\n        }\n      };\n\n      // Explicitly add template + workspace-core paths to the watcher so\n      // edits outside the normal Vite watch set still trigger invalidation.\n      const agentsMdPath = path.join(projectRoot, \"AGENTS.md\");\n      const skillsDir = path.join(projectRoot, \".agents\", \"skills\");\n      if (fs.existsSync(agentsMdPath)) watcher.add(agentsMdPath);\n      if (fs.existsSync(skillsDir)) watcher.add(skillsDir);\n      if (workspaceAgentsMdPath && fs.existsSync(workspaceAgentsMdPath)) {\n        watcher.add(workspaceAgentsMdPath);\n      }\n      if (workspaceSkillsDir && fs.existsSync(workspaceSkillsDir)) {\n        watcher.add(workspaceSkillsDir);\n      }\n\n      watcher.on(\"change\", invalidate);\n      watcher.on(\"add\", invalidate);\n      watcher.on(\"unlink\", invalidate);\n    },\n  };\n}\n"]}
+{"version":3,"file":"agents-bundle-plugin.js","sourceRoot":"","sources":["../../src/vite/agents-bundle-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,EACL,sBAAsB,GAEvB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,UAAU,CAAC;AAEtC,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACjD,yEAAyE;IACzE,sEAAsE;IACtE,iCAAiC;IACjC,IAAI,eAAe,GAAiC,IAAI,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,EAAE,EAAE,CAAC;YACP,eAAe,GAAG;gBAChB,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,YAAY,EAAE,EAAE,CAAC,YAAY;gBAC7B,OAAO,EAAE,EAAE,CAAC,UAAU;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IACpE,yEAAyE;IACzE,wEAAwE;IACxE,gDAAgD;IAChD,OAAO;;;iBAGQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;;CAEtC,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,WAAW,GAAG,EAAE,CAAC;IAErB,OAAO;QACL,IAAI,EAAE,4BAA4B;QAElC,cAAc,CAAC,MAAM;YACnB,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC;QAC5B,CAAC;QAED,SAAS,CAAC,EAAE;YACV,IAAI,EAAE,KAAK,UAAU;gBAAE,OAAO,WAAW,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC,WAAW;gBAAE,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YAC9C,OAAO,MAAM,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC;QAED,KAAK,CAAC,eAAe,CAAC,MAAM;YAC1B,oEAAoE;YACpE,kEAAkE;YAClE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAE/B,iEAAiE;YACjE,mDAAmD;YACnD,IAAI,qBAAqB,GAAkB,IAAI,CAAC;YAChD,IAAI,kBAAkB,GAAkB,IAAI,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;gBACtD,IAAI,EAAE,EAAE,CAAC;oBACP,qBAAqB,GAAG,EAAE,CAAC,YAAY,CAAC;oBACxC,kBAAkB,GAAG,EAAE,CAAC,SAAS,CAAC;gBACpC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YAED,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAW,EAAE;gBACjD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC7C,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1B,IAAI,GAAG,KAAK,WAAW;wBAAE,OAAO,IAAI,CAAC;oBACrC,IACE,GAAG,CAAC,UAAU,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAC;wBAC/C,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;wBAExB,OAAO,IAAI,CAAC;gBAChB,CAAC;gBACD,uBAAuB;gBACvB,IAAI,qBAAqB,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC5D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IACE,kBAAkB;oBAClB,IAAI,CAAC,UAAU,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAAG,CAAC;oBAC9C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EACzB,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC;YAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;gBAClC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;oBAAE,OAAO;gBACpC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;gBAC1D,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;oBACzC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;gBAC1C,CAAC;YACH,CAAC,CAAC;YAEF,mEAAmE;YACnE,sEAAsE;YACtE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC3D,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,qBAAqB,IAAI,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAClE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,kBAAkB,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAC5D,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAClC,CAAC;YAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACjC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;YAC9B,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Vite plugin that resolves `virtual:agents-bundle` to a statically-inlined\n * ES module containing the template's AGENTS.md + .agents/skills/ content.\n *\n * This is how the framework's agent gets its instructions and skills into the\n * system prompt on EVERY deployment target — Node, Netlify Functions, Vercel\n * serverless, and Cloudflare Workers. The content is baked into the server\n * bundle at build time, so nothing needs to exist on the runtime filesystem.\n *\n * In dev mode, the plugin re-reads from disk on each import and triggers HMR\n * when any AGENTS.md or SKILL.md file changes, so edits show up instantly\n * without restarting the server.\n */\nimport path from \"path\";\nimport fs from \"fs\";\nimport type { Plugin } from \"vite\";\nimport {\n  readAgentsBundleFromFs,\n  type WorkspaceAgentsSource,\n} from \"../server/agents-bundle.js\";\nimport { getWorkspaceCoreExports } from \"../deploy/workspace-core.js\";\n\nconst VIRTUAL_ID = \"virtual:agents-bundle\";\nconst RESOLVED_ID = \"\\0\" + VIRTUAL_ID;\n\nasync function emitBundleModule(projectRoot: string): Promise<string> {\n  // If the project is inside an enterprise monorepo with a workspace core,\n  // merge in its AGENTS.md + skills. Template skills override workspace\n  // core skills on name collision.\n  let workspaceSource: WorkspaceAgentsSource | null = null;\n  try {\n    const ws = await getWorkspaceCoreExports(projectRoot);\n    if (ws) {\n      workspaceSource = {\n        skillsDir: ws.skillsDir,\n        agentsMdPath: ws.agentsMdPath,\n        rootDir: ws.packageDir,\n      };\n    }\n  } catch {\n    // fall back to template-only\n  }\n\n  const bundle = readAgentsBundleFromFs(projectRoot, workspaceSource);\n  // Serialize as JSON and wrap in `export default` — this produces a valid\n  // ES module that any bundler (Rollup, esbuild, Rolldown) can statically\n  // analyze and tree-shake if nothing imports it.\n  return `// AUTO-GENERATED by @agent-native/core/vite/agents-bundle-plugin\n// Contains the inlined AGENTS.md + .agents/skills/ content from the template,\n// merged with any workspace AGENTS.md + .agents/skills/ when present.\nconst bundle = ${JSON.stringify(bundle)};\nexport default bundle;\n`;\n}\n\nexport function agentsBundlePlugin(): Plugin {\n  let projectRoot = \"\";\n\n  return {\n    name: \"agent-native-agents-bundle\",\n\n    configResolved(config) {\n      projectRoot = config.root;\n    },\n\n    resolveId(id) {\n      if (id === VIRTUAL_ID) return RESOLVED_ID;\n      return null;\n    },\n\n    async load(id) {\n      if (id !== RESOLVED_ID) return null;\n      if (!projectRoot) projectRoot = process.cwd();\n      return await emitBundleModule(projectRoot);\n    },\n\n    async configureServer(server) {\n      // Watch AGENTS.md + any SKILL.md changes and invalidate the virtual\n      // module so the next request picks up fresh content. Also watches\n      // the workspace core's AGENTS.md + skills directory (if present)\n      // so edits to the enterprise mid-layer propagate to every app.\n      const watcher = server.watcher;\n\n      // Resolve the workspace core up front so we can tell which files\n      // outside projectRoot should trigger invalidation.\n      let workspaceAgentsMdPath: string | null = null;\n      let workspaceSkillsDir: string | null = null;\n      try {\n        const ws = await getWorkspaceCoreExports(projectRoot);\n        if (ws) {\n          workspaceAgentsMdPath = ws.agentsMdPath;\n          workspaceSkillsDir = ws.skillsDir;\n        }\n      } catch {\n        // ignore\n      }\n\n      const shouldInvalidate = (file: string): boolean => {\n        const rel = path.relative(projectRoot, file);\n        if (!rel.startsWith(\"..\")) {\n          if (rel === \"AGENTS.md\") return true;\n          if (\n            rel.startsWith(\".agents\" + path.sep + \"skills\") &&\n            rel.endsWith(\"SKILL.md\")\n          )\n            return true;\n        }\n        // Workspace-core files\n        if (workspaceAgentsMdPath && file === workspaceAgentsMdPath) {\n          return true;\n        }\n        if (\n          workspaceSkillsDir &&\n          file.startsWith(workspaceSkillsDir + path.sep) &&\n          file.endsWith(\"SKILL.md\")\n        ) {\n          return true;\n        }\n        return false;\n      };\n\n      const invalidate = (file: string) => {\n        if (!shouldInvalidate(file)) return;\n        const mod = server.moduleGraph.getModuleById(RESOLVED_ID);\n        if (mod) {\n          server.moduleGraph.invalidateModule(mod);\n          server.ws.send({ type: \"full-reload\" });\n        }\n      };\n\n      // Explicitly add template + workspace-core paths to the watcher so\n      // edits outside the normal Vite watch set still trigger invalidation.\n      const agentsMdPath = path.join(projectRoot, \"AGENTS.md\");\n      const skillsDir = path.join(projectRoot, \".agents\", \"skills\");\n      if (fs.existsSync(agentsMdPath)) watcher.add(agentsMdPath);\n      if (fs.existsSync(skillsDir)) watcher.add(skillsDir);\n      if (workspaceAgentsMdPath && fs.existsSync(workspaceAgentsMdPath)) {\n        watcher.add(workspaceAgentsMdPath);\n      }\n      if (workspaceSkillsDir && fs.existsSync(workspaceSkillsDir)) {\n        watcher.add(workspaceSkillsDir);\n      }\n\n      watcher.on(\"change\", invalidate);\n      watcher.on(\"add\", invalidate);\n      watcher.on(\"unlink\", invalidate);\n    },\n  };\n}\n"]}

package/docs/content/authentication.md

@@ -35,22 +35,20 @@ Better Auth routes are mounted at `/_agent-native/auth/ba/*`. The framework also
 
 ## Development Mode {#dev-mode}
 
-In development (`NODE_ENV=development`), auth is automatically bypassed. If no other auth method succeeds (no account, no token, no local mode marker), `getSession()` returns `{ email: "local@localhost" }` so you can use the app immediately without any configuration.
+In development (`NODE_ENV=development`), auth is automatically bypassed. If no other auth method succeeds (no account, no token), `getSession()` returns `{ email: "local@localhost" }` so you can use the app immediately without any configuration.
 
 This means you can run any template app locally and start using it right away — no account creation, no environment variables needed.
 
 ## Local Mode {#local-mode}
 
-For explicit no-auth in any environment (including production), set `AUTH_MODE=local` in your `.env` file. This returns `{ email: "local@localhost" }` for all requests, skipping all other auth checks.
-
-You can also enable local mode from the onboarding page by clicking "Use locally without an account". This writes a marker file that persists across server restarts.
+For explicit no-auth in local development, set `AUTH_MODE=local` in your local shell or `.env` file. This returns `{ email: "local@localhost" }` for all requests, skipping all other auth checks.
 
 ```bash
 # .env
 AUTH_MODE=local
 ```
 
-To switch back to real auth, remove the line from `.env` (or clear the marker file by calling `POST /_agent-native/auth/exit-local-mode`).
+To switch back to real auth, remove the line from `.env` and restart the dev server. The old `.agent-native/auth-mode` marker file is no longer read or generated.
 
 ## QA Accounts {#qa-accounts}
 

package/docs/content/multi-app-workspace.md

@@ -1,6 +1,6 @@
 ---
 title: "Multi-App Workspace"
-description: "Host many agent-native apps in one monorepo with shared auth, RBAC, skills, instructions, components, and credentials."
+description: "Host many agent-native apps in one monorepo with shared auth, RBAC, instructions, skills, components, and credentials."
 ---
 
 # Multi-App Workspace
@@ -9,25 +9,25 @@ When vibe-coding an internal tool takes an afternoon, you don't stop at one. A t
 
 At that point every app has its own `AGENTS.md`, its own auth plugin, its own copy-pasted layout component, its own hard-coded Slack token, its own idea of what an "organization" is. A compliance rule change means ten PRs. Rotating an API key means ten redeployments. A brand refresh means ten different headers drifting out of sync. The thing that made it easy to build them is now making it hard to manage them.
 
-The **multi-app workspace** pattern is how agent-native solves this. You host all your apps in one monorepo alongside a private **workspace core** package. The core owns everything cross-cutting — auth, RBAC, agent skills, `AGENTS.md`, React components, design tokens, shared credentials, shared actions. Each app shrinks down to the handful of screens that make it unique. Change the core once; every app inherits the change on the next dev reload.
+The **multi-app workspace** pattern is how agent-native solves this. You host all your apps in one monorepo alongside a private `packages/shared` package. The framework owns the common defaults; `packages/shared` is only for the code, instructions, skills, components, or plugin overrides that are genuinely custom to your workspace. Each app shrinks down to the handful of screens and actions that make it unique.
 
 ## What gets shared {#what-gets-shared}
 
-Anything every app in your org should agree on lives in the workspace core:
+Anything every app in your org should agree on can live in `packages/shared`:
 
-| Shared thing                  | Where it lives in the core                                                   |
-| ----------------------------- | ---------------------------------------------------------------------------- |
-| Auth (login, session, social) | `src/server/auth-plugin.ts`                                                  |
-| Org / RBAC rules              | Better Auth organizations, optionally wrapped in `src/server/auth-plugin.ts` |
-| Agent chat system prompt      | `src/server/agent-chat-plugin.ts`                                            |
-| Enterprise agent instructions | `AGENTS.md`                                                                  |
-| Agent skills                  | `skills/<skill-name>/SKILL.md`                                               |
-| Shared agent actions          | `actions/*.ts`                                                               |
-| Shared React components       | `src/client/*.tsx` (e.g. `AuthenticatedLayout`)                              |
-| Design tokens / brand         | `styles/tokens.css`                                                          |
-| Shared API credentials        | `src/credentials.ts` → `resolveCompanyCredential()`                          |
+| Shared thing                  | Where it lives                                                                |
+| ----------------------------- | ----------------------------------------------------------------------------- |
+| Auth / SSO override           | Export `authPlugin` from `src/server/index.ts`                                |
+| Org / RBAC rules              | Better Auth organizations, optionally wrapped by that `authPlugin`            |
+| Agent chat override           | Export `agentChatPlugin` from `src/server/index.ts`                           |
+| Enterprise agent instructions | `AGENTS.md`                                                                   |
+| Agent skills                  | `.agents/skills/<skill-name>/SKILL.md`                                        |
+| Shared agent actions          | `actions/*.ts`                                                                |
+| Shared React components       | Export from `src/client/index.ts`                                             |
+| Design tokens / brand         | Add a shared CSS file and import it from each app                             |
+| Shared API credentials        | Prefer framework scoped credentials; add helpers only if you need namespacing |
 
-Each individual app becomes _just a set of screens_ — routes, dashboards, views, domain-specific actions. Everything else is inherited. If you're building ten tools for the same org, nine of them are 80% the same package, and the workspace core is where that 80% lives.
+Each individual app becomes _just a set of screens_ — routes, dashboards, views, domain-specific actions. Framework defaults cover the rest until you add a real workspace customization.
 
 ## Getting started {#getting-started}
 
@@ -37,9 +37,9 @@ Workspace is the default shape of an agent-native project. Scaffold one with:
 pnpm dlx @agent-native/core create my-company-platform
 ```
 
-The CLI shows a multi-select picker of every first-party template. Pick as many as you want — Mail + Calendar + Forms, for example — and they all get scaffolded into the same workspace sharing auth, brand, and agent config.
+The CLI shows a multi-select picker of every first-party template. Pick as many as you want — Mail + Calendar + Forms, for example — and they all get scaffolded into the same workspace sharing auth and database defaults.
 
-You get a pnpm monorepo with the private core package, a root `package.json` that wires up workspace discovery, a shared `.env`, and one sub-directory per app you picked:
+You get a pnpm monorepo with the private shared package, a root `package.json` that wires up workspace discovery, a shared `.env`, and one sub-directory per app you picked:
 
 ```text
 my-company-platform/
@@ -48,15 +48,11 @@ my-company-platform/
 ├── .env.example                 # shared ANTHROPIC_API_KEY, BUILDER_PRIVATE_KEY,
 │                                # A2A_SECRET, DATABASE_URL, ...
 ├── packages/
-│   └── core-module/             # @my-company-platform/core-module
+│   └── shared/             # @my-company-platform/shared
 │       ├── src/
-│       │   ├── server/          # auth / agent-chat plugin overrides
-│       │   ├── client/          # shared React components
-│       │   └── credentials.ts   # resolveCompanyCredential()
-│       ├── actions/             # shared agent-callable actions
-│       ├── skills/              # shared agent skills
-│       ├── AGENTS.md            # enterprise-wide instructions
-│       └── styles/tokens.css    # brand tokens (Tailwind v4 @theme + CSS vars)
+│       │   ├── server/          # plugin overrides only when needed
+│       │   └── client/          # shared React code only when needed
+│       └── AGENTS.md            # workspace-wide instructions
 └── apps/
     ├── mail/
     ├── calendar/
@@ -72,13 +68,13 @@ pnpm install
 pnpm dev                         # runs every app
 ```
 
-Every app renders through `<AuthenticatedLayout>` from the core. Every agent chat already sees the shared `AGENTS.md` and skills. Every app already knows how to log in and can call shared actions. You didn't wire any of that up — the framework auto-discovered the core via the `agent-native.workspaceCore` field in the root `package.json`:
+Every app already knows how to log in, share the same database, and load the workspace `AGENTS.md`. You didn't wire any of that up — the framework auto-discovered the shared package via the `agent-native.workspaceCore` field in the root `package.json`:
 
 ```json
 {
   "name": "my-company-platform",
   "agent-native": {
-    "workspaceCore": "@my-company-platform/core-module"
+    "workspaceCore": "@my-company-platform/shared"
   }
 }
 ```
@@ -97,24 +93,24 @@ The CLI shows the template picker again with apps you've already installed filte
 agent-native add-app crm --template content
 ```
 
-Any first-party template works as a workspace app — the CLI runs a small **workspacify** transform on the template that adds the workspace core as a dep and resolves `workspace:*` references. No parallel "workspace-app" scaffold to maintain.
+Any first-party template works as a workspace app — the CLI runs a small **workspacify** transform on the template that adds the shared package as a dep and resolves `workspace:*` references. No parallel "workspace-app" scaffold to maintain.
 
 ```bash
 pnpm install                     # at the workspace root
-pnpm --filter crm dev
+pnpm dev
 ```
 
-That's it. The new app has the same login as every other app in the workspace, the same agent instructions, the same brand, the same actions, the same shared credentials. All you add is the domain-specific screens.
+That's it. The new app has the same login and workspace instructions as every other app. Add shared brand, actions, or credentials only when the workspace actually needs them.
 
 ## What you override where {#layering}
 
 Agent-native apps inside a workspace resolve cross-cutting behavior from three places, in this order:
 
 1. **App local** — files inside `apps/<name>/` (highest priority)
-2. **Workspace core** — files inside `packages/core-module/` (the shared mid-layer)
+2. **Workspace shared** — files inside `packages/shared/` (the shared mid-layer)
 3. **Framework default** — `@agent-native/core` (lowest)
 
-The merge happens by file name. If an app provides a local file that also exists upstream, the local one wins. If it doesn't, the workspace core's version applies. If the core doesn't provide one either, the framework default kicks in. This applies to plugins, skills, actions, and `AGENTS.md`.
+The merge happens by file name. If an app provides a local file that also exists upstream, the local one wins. If it doesn't, the workspace shared version applies. If shared doesn't provide one either, the framework default kicks in. This applies to plugins, skills, actions, and `AGENTS.md`.
 
 When one app needs something different, drop a local file:
 
@@ -130,15 +126,15 @@ No wiring, no config. Create the file and it takes over.
 
 ## Editing shared behavior {#editing-shared-behavior}
 
-Everything cross-cutting lives in `packages/core-module/`. Change `src/server/auth-plugin.ts` and every app in the workspace picks it up on the next dev reload. Add a new file to `skills/` and every app's agent instantly has access to the new skill. Add an action to `actions/` and every app's agent can call it.
+Everything cross-cutting you customize lives in `packages/shared/`. Export an `authPlugin` from `src/server/index.ts` and every app picks it up on the next dev reload. Add a skill under `.agents/skills/` and every app's agent sees it. Add an action to `actions/` and every app's agent can call it.
 
-Because the core is a `workspace:*` dependency, pnpm symlinks it into each app's `node_modules/`. You never build or publish it — the apps bundle whatever they need from it at build time.
+Because the shared package is a `workspace:*` dependency, pnpm symlinks it into each app's `node_modules/`. You never build or publish it — the apps bundle whatever they need from it at build time.
 
 ## Authentication and RBAC {#auth-and-rbac}
 
 Every agent-native app already ships with [Better Auth](/docs/authentication) and its organizations plugin — users, organizations, members, and the `owner` / `admin` / `member` roles are all first-class, shared across every template. In a workspace, you get that for free in every app, backed by the same database.
 
-For enterprise-specific rules (allow-list domains, SSO enforcement, extra role checks), wrap the framework auth plugin in `src/server/auth-plugin.ts` and re-export it. Every app in the workspace now enforces those rules.
+For enterprise-specific rules (allow-list domains, SSO enforcement, extra role checks), export an `authPlugin` from `packages/shared/src/server/index.ts`. Every app in the workspace now enforces those rules.
 
 Active organization flows automatically: `session.orgId` → `AGENT_ORG_ID` → SQL row scoping, so data tagged with `org_id` is invisible to other orgs even to the agent. See [Security & Data Scoping](/docs/security) for the full model.
 
@@ -169,23 +165,15 @@ See [MCP Clients](/docs/mcp-clients) for the config schema, precedence rules, re
 
 ## Shared credentials {#shared-credentials}
 
-Rotate a third-party API key in one place and every app picks it up:
-
-```ts
-import { resolveCompanyCredential } from "@my-company-platform/core-module/credentials";
-
-const slackToken = await resolveCompanyCredential("SLACK_BOT_TOKEN");
-```
-
-Under the hood this wraps `@agent-native/core`'s `resolveCredential()`, which checks `process.env` first and then falls back to the shared `settings` table. Apps in the same workspace point at the same `DATABASE_URL` by default, so storing a credential in settings once makes it available to every app — no per-app config.
+Apps in the same workspace point at the same `DATABASE_URL` by default, so framework credential storage can make a credential available to every app without per-app config. Use `@agent-native/core/credentials` directly, or add a thin helper in `packages/shared` if your workspace wants a stricter naming convention.
 
 ## Shared design tokens {#design-tokens}
 
-The framework is on Tailwind v4. The core ships a shared CSS file with the standard `@theme` tokens — each app imports it from its `app/global.css`:
+The framework is on Tailwind v4. Add a shared CSS file to `packages/shared` only when the workspace has real brand tokens to share, then import it from each app's `app/global.css`:
 
 ```css
 @import "tailwindcss";
-@import "@my-company-platform/core-module/styles/tokens.css";
+@import "@my-company-platform/shared/styles/tokens.css";
 @source "./**/*.{ts,tsx}";
 
 :root {
@@ -196,7 +184,7 @@ The framework is on Tailwind v4. The core ships a shared CSS file with the stand
 }
 ```
 
-Brand colors, typography, spacing scales, and any shared component classes live in that one CSS file. Update it in the core and every app rebrands on the next build. Shared React components in `src/client/` pick up the same tokens automatically.
+Brand colors, typography, spacing scales, and any shared component classes can live in that one CSS file. Update it in `packages/shared` and every app rebrands on the next build.
 
 ## Deployment {#deployment}
 
@@ -235,7 +223,7 @@ Prefer each app on its own domain (`mail.company.com`, `calendar.company.com`)?
 
 Whatever you pick, point every app at the same `DATABASE_URL` for cross-app state out of the box: one set of user accounts, one set of organizations, one set of shared settings. If each app has its own database, the workspace pattern still works — you just lose that shared-state story.
 
-The workspace core itself is never built or deployed standalone. It's a `workspace:*` dep that pnpm symlinks into each app's `node_modules/`, so every app transparently bundles whatever it needs from the core at build time.
+The shared package itself is never deployed standalone. It's a `workspace:*` dep that pnpm symlinks into each app's `node_modules/`, so every app transparently bundles whatever it needs at build time.
 
 ## Out of scope (for now) {#out-of-scope}
 
@@ -243,5 +231,5 @@ The workspace pattern is intentionally narrow. A few things it deliberately does
 
 - **Cross-domain SSO.** The unified `agent-native deploy` flow solves the common case (one origin, many apps at `/mail`, `/calendar`, …). If you need `mail.company.com` and `calendar.company.com` on _different_ domains to share a session, that requires a shared cookie domain or a central auth app with OAuth redirects — both supported by the underlying stack but neither scaffolded out of the box.
 - **Encrypted credential vault.** Shared credentials live in the `settings` table as plain text today. Rotate responsibly.
-- **Publishing the core to private npm.** The core is `workspace:*` only; multi-repo sharing via a private registry is doable but not scaffolded.
-- **Opinionated component library.** The core is where _you_ put shared components. The framework doesn't force shadcn/ui or any other system into that slot.
+- **Publishing shared code to private npm.** The shared package is `workspace:*` only; multi-repo sharing via a private registry is doable but not scaffolded.
+- **Opinionated component library.** `packages/shared` is where _you_ put shared components. The framework doesn't force shadcn/ui or any other system into that slot.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.7.23",
+  "version": "0.7.25",
   "type": "module",
   "description": "Framework for agent-native application development — where AI agents and UI share state via files",
   "license": "MIT",

package/src/templates/default/_gitignore

@@ -40,3 +40,5 @@ data/.sessions.json
 
 # Learnings (personal preferences and memory — use learnings.defaults.md for tracked defaults)
 learnings.md
+
+.vercel/

package/src/templates/workspace-core/AGENTS.md

@@ -1,78 +1,25 @@
-# {{APP_TITLE}} — Enterprise Agent Instructions
+# {{APP_TITLE}} Workspace Instructions
 
-These instructions apply to **every app** in the {{APP_TITLE}} workspace. The
-framework auto-injects this file into each app's agent system prompt as a
-`<resource name="AGENTS.md" scope="workspace">` block. Individual apps can
-add their own template-specific AGENTS.md on top.
+These instructions apply to every app in the {{APP_TITLE}} workspace. Keep
+only rules that should be shared across all apps here. App-specific behavior
+belongs in that app's own `AGENTS.md` or `.agents/skills/` directory.
 
-## Company context
+## Shared Context
 
-Write a short paragraph here describing your company and what you do. The
-agent reads this first so every response can be grounded in the same
-business context without you having to repeat it per app.
+Add company, product, compliance, or support-context notes that every app
+agent should know.
 
-## Shared conventions
+## Shared Conventions
 
-- **All cross-app state lives in the shared database.** Apps in this
-  workspace share `DATABASE_URL` by default, so a record created by one
-  app can be read by another as long as it respects the `owner_email` and
-  `org_id` scoping conventions.
-- **All API secrets come from scoped credential storage.** Never hardcode a
-  token or read `process.env` for user/org credentials in production. Call
-  `resolveCompanyCredential("KEY", { userEmail, orgId })` from
-  `@{{APP_NAME}}/core-module/credentials`, or omit the context only when the
-  current request/action already has agent-native request context. The helper
-  reads per-user credentials first and org-shared credentials second.
-- **UI chrome comes from the workspace core.** Wrap every screen in
-  `<AuthenticatedLayout>` from `@{{APP_NAME}}/core-module/client`. Don't
-  re-implement the brand header, sidebar, or org switcher per app.
-- **Design system.** If the app needs a button, dialog, or form control,
-  import from our internal design system package (if you have one) or
-  from the shared UI re-exports in `@{{APP_NAME}}/core-module/client`.
+- Put shared code in `packages/shared` only when multiple apps need it.
+- Keep app-specific screens, actions, state, and skills inside `apps/<app>`.
+- Store shared runtime configuration in the workspace root `.env`; use
+  `apps/<app>/.env` only for app-specific overrides.
+- Prefer framework defaults until the workspace has a real custom rule,
+  component, plugin, action, or skill to share.
 
-## Compliance and policy
+## Adding Apps
 
-List any enterprise-wide rules the agent must follow — data handling, PII
-guidelines, approval flows, deployment constraints. The agent will apply
-these to every decision it makes in every app.
-
-Example rules:
-
-- Never expose raw customer email addresses in logs.
-- Any action that modifies data must first be shown to the user with a
-  preview and wait for confirmation.
-- Never make network calls to anything outside `*.{{APP_NAME}}.com` or
-  the approved third-party allowlist.
-
-## How to add a new app
-
-```bash
-pnpm exec agent-native create <app-name> --template=starter
-```
-
-Run this from the workspace root. The CLI detects the workspace and creates
-`apps/<app-name>` with the workspace core module already connected. Use a
-different template when useful, for example `--template=analytics` or
-`--template=forms`.
-
-The workspace dev command is a gateway:
-
-```bash
-pnpm dev
-```
-
-It opens Dispatch at `/dispatch`, serves every app at `/<app-name>`, and
-auto-detects newly-created app directories. After creating an app, do not
-restart the dev server unless the gateway reports an error; wait for it to
-start the new app process, then open `/<app-name>`.
-
-The new app will automatically inherit:
-
-1. The workspace auth plugin (Better Auth + company SSO)
-2. The agent chat plugin with this AGENTS.md pre-loaded
-3. Every skill in `packages/core-module/skills/`
-4. Every action in `packages/core-module/actions/`
-5. The shared Tailwind preset and React components
-
-The only files the new app needs to own are its own routes/screens and any
-template-specific actions.
+Run `pnpm exec agent-native create <app-name> --template=starter` from the
+workspace root. The workspace dev gateway (`pnpm dev`) detects new
+`apps/<app-name>` directories automatically.

package/src/templates/workspace-core/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "@{{APP_NAME}}/core-module",
+  "name": "@{{APP_NAME}}/shared",
   "private": true,
   "version": "0.0.0",
   "type": "module",
@@ -18,19 +18,11 @@
       "types": "./src/client/index.ts",
       "development": "./src/client/index.ts",
       "default": "./dist/client/index.js"
-    },
-    "./credentials": {
-      "types": "./src/credentials.ts",
-      "development": "./src/credentials.ts",
-      "default": "./dist/credentials.js"
-    },
-    "./styles/tokens.css": "./styles/tokens.css"
+    }
   },
   "files": [
     "dist",
     "src",
-    "styles",
-    "actions",
     "AGENTS.md"
   ],
   "scripts": {
@@ -39,17 +31,7 @@
     "typecheck": "tsc --noEmit",
     "prepare": "tsc"
   },
-  "dependencies": {
-    "@agent-native/core": "latest",
-    "zod": "^4.3.6"
-  },
   "devDependencies": {
-    "@types/node": "^24.2.1",
-    "@types/react": "^19.2.14",
-    "react": "^19.2.5",
     "typescript": "^6.0.3"
-  },
-  "peerDependencies": {
-    "react": "^19.2.5"
   }
 }

package/src/templates/workspace-core/src/client/index.ts

@@ -1,26 +1,2 @@
-/**
- * Client-side entry for @{{APP_NAME}}/core-module.
- *
- * This is where shared React components, hooks, and providers that EVERY
- * app in your workspace needs live. Think of it as the "app shell" layer
- * between the framework's primitives (@agent-native/core/client) and the
- * individual app's screens:
- *
- *   - Authenticated layouts (header / sidebar / footer with brand)
- *   - Org switchers wired to your company's org plugin
- *   - Common chrome: loading states, error boundaries, empty states
- *   - Wrappers around @agent-native/core components that apply your
- *     enterprise design tokens
- *
- * Apps import from here instead of re-implementing or copy-pasting:
- *
- *   import { AuthenticatedLayout } from "@{{APP_NAME}}/core-module/client";
- *
- * NOTE: This package does not ship shadcn/ui or a generic design system
- * by default. If you already have an internal `@{{APP_NAME}}/design-system`
- * package, add it as a dep here and re-export from this file. Otherwise
- * you can drop any shadcn components the apps share into `./ui/` and
- * export them from this index.
- */
-
-export { AuthenticatedLayout } from "./AuthenticatedLayout.js";
+// Export shared React components and hooks here when multiple apps need them.
+export {};