@agent-native/core 0.86.1 → 0.87.0

package/docs/content/locales/hi-IN/creating-templates.mdx

@@ -7,6 +7,8 @@ description: "अपने स्वयं के एजेंट-नेटि
 
 टेम्प्लेट पूर्ण, फोर्केबल एजेंट-नेटिव ऐप्स हैं जो वास्तविक वर्कफ़्लो को हल करते हैं। प्रथम-पक्ष टेम्पलेट आपके द्वारा उपयोग की जाने वाली समान फ़्रेमवर्क सतह के साथ बनाए गए हैं: UI के लिए React रूट, डेटा के लिए Drizzle SQL, संचालन के लिए actions, एजेंट व्यवहार के लिए कार्यक्षेत्र संसाधन, और पोलिंग सिंक ताकि एजेंट और UI संरेखित रहें।
 
+`@agent-native/core` का उपयोग runtime contract के लिए करें: actions, server plugins, database helpers, app state, routing helpers, और agent chat. `@agent-native/toolkit` का उपयोग reusable app-building UI और helpers के लिए करें, जैसे shared primitives, toast/mobile hooks, date pickers, और simple app shell slots. जब variants product behavior या visual identity encode करते हैं, तो उन्हें template-local रखें.
+
 एक अच्छा टेम्पलेट:
 
 - उपयोगी बीज डेटा या खाली-अवस्था प्रवाह के साथ एक वर्कफ़्लो को शुरू से अंत तक हल करता है।

package/docs/content/locales/hi-IN/template-analytics.mdx

@@ -149,6 +149,12 @@ CLI स्थानीय डेव URL प्रिंट करता है
 
 **Session replay agent handoff.** Session recordings stay private, but the session detail page can mint a temporary **Copy for agent** link. The two-hour `agent_access` URL lets an external agent read replay summaries, timelines, and bounded event details without exposing blob/provider URLs or making the recording public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep replay chunk authorization, diagnostics payloads, and the
+session detail UI local to Analytics.
+
 ### एजेंट के साथ काम करना
 
 एजेंट को हमेशा पता होता है कि आप क्या देख रहे हैं। वर्तमान स्क्रीन स्थिति को प्रत्येक संदेश में `<current-screen>` ब्लॉक के रूप में इंजेक्ट किया जाता है - इसमें सक्रिय दृश्य, खुला डैशबोर्ड या विश्लेषण और कोई भी चयनित फ़िल्टर शामिल होता है।

package/docs/content/locales/hi-IN/template-clips.mdx

@@ -133,6 +133,13 @@ APIs, इसलिए मॉडल जो केवल पाठ या स्
 
 Temporary private agent links are also supported: the Share dialog can mint a two-hour `agent_access` URL for any recording the viewer can access. Agents use that token with the share page and JSON APIs, and the clip does not become public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep Clips-specific visibility checks, transcript/frame payloads,
+and player UI local. New links use `agent_access`; routes should continue
+accepting the legacy `t` query where existing agent API URLs may already use it.
+
 एंडपॉइंट शेयर पेज के समान सार्वजनिक/पासवर्ड/समाप्ति नियमों का पालन करते हैं।
 पासवर्ड-सुरक्षित क्लिप को एक बार पासवर्ड की आवश्यकता होती है; सफल प्रत्युत्तर वापस आते हैं
 अल्पकालिक टोकनयुक्त लिंक ताकि डाउनस्ट्रीम एजेंटों को प्लेनटेक्स्ट की आवश्यकता न हो

package/docs/content/locales/hi-IN/tracking.mdx

@@ -241,6 +241,12 @@ Analytics टेम्पलेट replay मेटाडेटा को SQL (`
 
 जब आपको किसी बाहरी एजेंट को एक प्राइवेट रिकॉर्डिंग सौंपने की आवश्यकता हो, तो session डिटेल पेज के **Copy for agent** नियंत्रण का उपयोग करें। यह एक दो-घंटे का, रिकॉर्डिंग-स्कोप्ड `agent_access` लिंक बनाता है, `/sessions/:recordingId` पर एक छोटा डिस्कवरी पेलोड SSR करता है, और केवल एजेंट context/events JSON APIs को एक्सपोज़ करता है। रिकॉर्डिंग की visibility नहीं बदलती।
 
+Implementation note: the reusable layer is the core agent-access URL contract,
+not a replay-specific UI abstraction. Use `createScopedAgentAccessGrant`,
+`verifyScopedAgentAccessToken`, `buildAgentAccessUrl`, and
+`buildAgentAccessApiUrl` for scoped SSR and JSON API links; keep replay storage,
+diagnostics shaping, and access policy inside the Analytics template.
+
 केवल स्थानीय विकास के लिए, Analytics प्राइवेट blob storage उपलब्ध न होने पर capped SQL inline chunks पर फ़ॉलबैक कर सकता है। प्रोडक्शन डिप्लॉयमेंट्स को replay payloads के लिए Postgres पर निर्भर रहने के बजाय प्राइवेट या एन्क्रिप्टेड blob storage कॉन्फ़िगर करना चाहिए।
 
 ## उन्नत: कस्टम प्रदाता और आंतरिक {#advanced}

package/docs/content/locales/ja-JP/components.mdx

@@ -25,6 +25,15 @@ import { ResourcesPanel } from "@agent-native/core/client/resources";
 `@agent-native/core/client` またはフォーカスされた `@agent-native/core/client/*` サブパス
 そのため、バンドラーはブラウザーセーフなエントリを選択します。
 
+`@agent-native/toolkit` は、基盤ランタイム契約ではない再利用可能なアプリ構築部品に使用します: shadcn 風 UI プリミティブ、共有 hooks、シンプルなアプリ shell ヘルパー、その他のテンプレート合成モジュールです。移行中、Core は互換性 re-export を保持しますが、新しいテンプレートとアプリのコードは toolkit モジュールを直接 import してください:
+
+```tsx
+import { Button } from "@agent-native/toolkit/ui/button";
+import { Toaster } from "@agent-native/toolkit/ui/sonner";
+import { useToast } from "@agent-native/toolkit/hooks/use-toast";
+import { useSetHeaderActions } from "@agent-native/toolkit/app-shell";
+```
+
 <Diagram id="doc-block-9epcij" title={"フレームワークの外ではなく、レイヤーをドロップダウンします"} summary={"各レイヤーは同じランタイム (アクション、スレッド状態、SQL-backed 同期) を維持しながら、クロムをより詳細に制御できます。"}>
 
 ```html

package/docs/content/locales/ja-JP/creating-templates.mdx

@@ -7,6 +7,8 @@ description: "独自のエージェント ネイティブ アプリ テンプレ
 
 テンプレートは、実際のワークフローを解決する完全なフォーク可能なエージェント ネイティブ アプリです。ファーストパーティ テンプレートは、使用するのと同じフレームワーク サーフェスを使用して構築されます。UI の React ルート、データの Drizzle SQL、操作の actions、エージェントの動作のワークスペース リソース、およびエージェントと UI の連携を維持するためのポーリング同期です。
 
+`@agent-native/core` は runtime contract に使用します: actions、server plugins、database helpers、app state、routing helpers、agent chat です。`@agent-native/toolkit` は shared primitives、toast/mobile hooks、date pickers、simple app shell slots などの再利用可能な app-building UI と helpers に使用します。製品動作や visual identity を表す template-specific variants はローカルに保持してください。
+
 良いテンプレート:
 
 - 有用なシード データまたは空の状態のフローを使用して、1 つのワークフローをエンドツーエンドで解決します。

package/docs/content/locales/ja-JP/template-analytics.mdx

@@ -149,6 +149,12 @@ CLI はローカル開発 URL を出力します。 Google でログインし、
 
 **Session replay agent handoff.** Session recordings stay private, but the session detail page can mint a temporary **Copy for agent** link. The two-hour `agent_access` URL lets an external agent read replay summaries, timelines, and bounded event details without exposing blob/provider URLs or making the recording public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep replay chunk authorization, diagnostics payloads, and the
+session detail UI local to Analytics.
+
 ### エージェントとの連携
 
 エージェントは、あなたが何を見ているのかを常に知っています。現在の画面状態は、`<current-screen>` ブロックとしてすべてのメッセージに挿入されます。これには、アクティブなビュー、開いているダッシュボードまたは分析、選択したフィルターが含まれます。

package/docs/content/locales/ja-JP/template-clips.mdx

@@ -133,6 +133,13 @@ API なので、テキストまたは静止画像のみを受け入れるモデ
 
 Temporary private agent links are also supported: the Share dialog can mint a two-hour `agent_access` URL for any recording the viewer can access. Agents use that token with the share page and JSON APIs, and the clip does not become public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep Clips-specific visibility checks, transcript/frame payloads,
+and player UI local. New links use `agent_access`; routes should continue
+accepting the legacy `t` query where existing agent API URLs may already use it.
+
 エンドポイントは、共有ページと同じパブリック/パスワード/有効期限ルールに従います。
 パスワードで保護されたクリップでは、パスワードが 1 回必要になります。成功した応答が返されます
 トークン化されたリンクは有効期間が短いため、ダウンストリーム エージェントはプレーンテキストを必要としません

package/docs/content/locales/ja-JP/tracking.mdx

@@ -241,6 +241,12 @@ Analytics テンプレートは、リプレイ メタデータを SQL (`session_
 
 プライベートな記録を外部エージェントに渡す必要がある場合は、セッション詳細ページの **Copy for agent** コントロールを使用します。これにより、2 時間有効で記録にスコープされた `agent_access` リンクが発行され、`/sessions/:recordingId` で小さなディスカバリー ペイロードが SSR され、エージェント コンテキスト/イベントの JSON API のみが公開されます。記録の可視性は変更されません。
 
+Implementation note: the reusable layer is the core agent-access URL contract,
+not a replay-specific UI abstraction. Use `createScopedAgentAccessGrant`,
+`verifyScopedAgentAccessToken`, `buildAgentAccessUrl`, and
+`buildAgentAccessApiUrl` for scoped SSR and JSON API links; keep replay storage,
+diagnostics shaping, and access policy inside the Analytics template.
+
 ローカル開発でのみ、Analytics はプライベートな blob ストレージが利用できない場合に、上限付きの SQL インライン チャンクにフォールバックできます。本番デプロイでは、リプレイ ペイロードを Postgres に依存するのではなく、プライベートまたは暗号化された blob ストレージを設定する必要があります。
 
 ## 上級: カスタムプロバイダーと内部 {#advanced}

package/docs/content/locales/ko-KR/components.mdx

@@ -25,6 +25,15 @@ import { ResourcesPanel } from "@agent-native/core/client/resources";
 `@agent-native/core/client` 또는 집중된 `@agent-native/core/client/*` 하위 경로
 따라서 번들러는 브라우저 안전 항목을 선택합니다.
 
+`@agent-native/toolkit`은 기본 런타임 계약에 속하지 않는 재사용 가능한 앱 구축 요소에 사용하세요: shadcn 스타일 UI primitives, 공유 hooks, 단순 app shell helpers, 기타 template composition modules입니다. 전환 기간 동안 Core는 호환성 re-export를 유지하지만, 새 템플릿과 앱 코드는 toolkit modules를 직접 가져와야 합니다:
+
+```tsx
+import { Button } from "@agent-native/toolkit/ui/button";
+import { Toaster } from "@agent-native/toolkit/ui/sonner";
+import { useToast } from "@agent-native/toolkit/hooks/use-toast";
+import { useSetHeaderActions } from "@agent-native/toolkit/app-shell";
+```
+
 <Diagram id="doc-block-wyryue" title={"프레임워크 외부가 아닌 레이어를 드롭다운하세요."} summary={"각 레이어는 동일한 런타임(작업, 스레드 상태, SQL-backed 동기화)을 유지하면서 크롬에 대한 더 많은 제어권을 제공합니다."}>
 
 ```html

package/docs/content/locales/ko-KR/creating-templates.mdx

@@ -7,6 +7,8 @@ description: "자신만의 에이전트 기반 앱 템플릿을 만들고 게시
 
 템플릿은 실제 워크플로를 해결하는 완전하고 포크 가능한 에이전트 기반 앱입니다. 자사 템플릿은 귀하가 사용하는 것과 동일한 프레임워크 표면으로 구축됩니다. UI용 React 경로, 데이터용 Drizzle SQL, 작업용 actions, 에이전트 동작용 작업 공간 리소스, 에이전트와 UI가 정렬 상태를 유지하도록 폴링 동기화합니다.
 
+`@agent-native/core`는 runtime contract에 사용하세요: actions, server plugins, database helpers, app state, routing helpers, agent chat입니다. `@agent-native/toolkit`은 shared primitives, toast/mobile hooks, date pickers, simple app shell slots 같은 reusable app-building UI와 helpers에 사용하세요. 제품 동작이나 visual identity를 담는 template-specific variants는 로컬에 유지하세요.
+
 좋은 템플릿:
 
 - 유용한 시드 데이터 또는 빈 상태 흐름을 사용하여 하나의 워크플로를 엔드 투 엔드로 해결합니다.

package/docs/content/locales/ko-KR/template-analytics.mdx

@@ -149,6 +149,12 @@ CLI는 로컬 개발자 URL를 인쇄합니다. Google에 로그인한 다음 **
 
 **Session replay agent handoff.** Session recordings stay private, but the session detail page can mint a temporary **Copy for agent** link. The two-hour `agent_access` URL lets an external agent read replay summaries, timelines, and bounded event details without exposing blob/provider URLs or making the recording public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep replay chunk authorization, diagnostics payloads, and the
+session detail UI local to Analytics.
+
 ### 에이전트와 협력하기
 
 에이전트는 항상 귀하가 무엇을 보고 있는지 알고 있습니다. 현재 화면 상태는 모든 메시지에 `<current-screen>` 블록으로 삽입됩니다. 여기에는 활성 보기, 열려 있는 대시보드 또는 분석, 선택한 필터가 포함됩니다.

package/docs/content/locales/ko-KR/template-clips.mdx

@@ -133,6 +133,13 @@ API, 텍스트나 정지 이미지만 허용하는 모델도 여전히 무엇을
 
 Temporary private agent links are also supported: the Share dialog can mint a two-hour `agent_access` URL for any recording the viewer can access. Agents use that token with the share page and JSON APIs, and the clip does not become public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep Clips-specific visibility checks, transcript/frame payloads,
+and player UI local. New links use `agent_access`; routes should continue
+accepting the legacy `t` query where existing agent API URLs may already use it.
+
 엔드포인트는 공유 페이지와 동일한 공개/비밀번호/만료 규칙을 따릅니다.
 비밀번호로 보호된 클립에는 비밀번호가 한 번만 필요합니다. 성공적인 응답 반환
 다운스트림 에이전트에 일반 텍스트가 필요하지 않도록 단기 토큰화된 링크

package/docs/content/locales/ko-KR/tracking.mdx

@@ -241,6 +241,12 @@ Analytics 템플릿은 리플레이 메타데이터를 SQL(`session_recordings`)
 
 프라이빗 녹화를 외부 에이전트에게 전달해야 할 때는 세션 상세 페이지의 **Copy for agent** 컨트롤을 사용하세요. 이는 두 시간 동안 유효한 녹화 범위의 `agent_access` 링크를 발급하고, `/sessions/:recordingId`에서 작은 디스커버리 페이로드를 SSR하며, 에이전트 컨텍스트/이벤트 JSON API만 노출합니다. 녹화의 공개 범위는 변경되지 않습니다.
 
+Implementation note: the reusable layer is the core agent-access URL contract,
+not a replay-specific UI abstraction. Use `createScopedAgentAccessGrant`,
+`verifyScopedAgentAccessToken`, `buildAgentAccessUrl`, and
+`buildAgentAccessApiUrl` for scoped SSR and JSON API links; keep replay storage,
+diagnostics shaping, and access policy inside the Analytics template.
+
 로컬 개발 환경에서만 Analytics는 프라이빗 blob 스토리지를 사용할 수 없을 때 용량이 제한된 SQL 인라인 청크로 대체할 수 있습니다. 프로덕션 배포에서는 리플레이 페이로드를 Postgres에 의존하기보다 프라이빗 또는 암호화된 blob 스토리지를 구성해야 합니다.
 
 ## 고급: 맞춤형 공급자 및 내부 {#advanced}

package/docs/content/locales/pt-BR/components.mdx

@@ -25,6 +25,15 @@ Evite importar componentes UI do pacote `@agent-native/core` simples. Usar
 `@agent-native/core/client` ou um subcaminho `@agent-native/core/client/*` em foco
 para que os empacotadores escolham a entrada segura para o navegador.
 
+Use `@agent-native/toolkit` para peças reutilizáveis de construção de aplicativos que não fazem parte do contrato fundamental do runtime: primitivas UI no estilo shadcn, hooks compartilhados, helpers simples de shell do app e outros módulos de composição de templates. Core mantém reexports de compatibilidade durante a transição, mas novo código de templates e apps deve importar módulos do toolkit diretamente:
+
+```tsx
+import { Button } from "@agent-native/toolkit/ui/button";
+import { Toaster } from "@agent-native/toolkit/ui/sonner";
+import { useToast } from "@agent-native/toolkit/hooks/use-toast";
+import { useSetHeaderActions } from "@agent-native/toolkit/app-shell";
+```
+
 <Diagram id="doc-block-smqhxh" title={"Desça uma camada, não fora da estrutura"} summary={"Cada camada mantém o mesmo tempo de execução – ações, estado do thread e sincronização SQL-backed – enquanto oferece mais controle sobre o cromo."}>
 
 ```html

package/docs/content/locales/pt-BR/creating-templates.mdx

@@ -7,6 +7,8 @@ description: "Como criar e publicar seus próprios modelos de aplicativos nativo
 
 Os modelos são aplicativos nativos do agente completos e bifurcáveis que resolvem um fluxo de trabalho real. Os modelos primários são criados com a mesma superfície de estrutura que você usa: rotas React para UI, Drizzle SQL para dados, actions para operações, recursos de espaço de trabalho para comportamento do agente e sincronização de sondagem para que o agente e UI permaneçam alinhados.
 
+Use `@agent-native/core` para o contrato de runtime: actions, plugins de servidor, helpers de banco de dados, estado do app, helpers de rotas e chat do agente. Use `@agent-native/toolkit` para UI reutilizável e helpers de construção de apps, como primitivas compartilhadas, hooks de toast/mobile, seletores de data e slots simples de shell do app. Mantenha variantes específicas do template locais quando elas codificarem comportamento de produto ou identidade visual.
+
 Um bom modelo:
 
 - Resolve um fluxo de trabalho de ponta a ponta, com dados iniciais úteis ou um fluxo de estado vazio.

package/docs/content/locales/pt-BR/template-analytics.mdx

@@ -149,6 +149,12 @@ O CLI imprime o dev local URL. Faça login com o Google e abra a página **Fonte
 
 **Session replay agent handoff.** Session recordings stay private, but the session detail page can mint a temporary **Copy for agent** link. The two-hour `agent_access` URL lets an external agent read replay summaries, timelines, and bounded event details without exposing blob/provider URLs or making the recording public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep replay chunk authorization, diagnostics payloads, and the
+session detail UI local to Analytics.
+
 ### Trabalhando com o agente
 
 O agente sempre sabe o que você está vendo. O estado atual da tela é injetado em cada mensagem como um bloco `<current-screen>` — ele contém a visualização ativa, o painel ou análise aberta e quaisquer filtros selecionados.

package/docs/content/locales/pt-BR/template-clips.mdx

@@ -133,6 +133,13 @@ agente.
 
 Temporary private agent links are also supported: the Share dialog can mint a two-hour `agent_access` URL for any recording the viewer can access. Agents use that token with the share page and JSON APIs, and the clip does not become public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep Clips-specific visibility checks, transcript/frame payloads,
+and player UI local. New links use `agent_access`; routes should continue
+accepting the legacy `t` query where existing agent API URLs may already use it.
+
 Os endpoints seguem as mesmas regras de público/senha/expiração da página de compartilhamento.
 Clipes protegidos por senha exigem a senha uma vez; retorno de respostas bem-sucedidas
 links tokenizados de curta duração para que os agentes downstream não precisem do texto simples

package/docs/content/locales/pt-BR/tracking.mdx

@@ -241,6 +241,12 @@ O modelo Analytics armazena os metadados de replay em SQL (`session_recordings`)
 
 Quando você precisar entregar uma gravação privada a um agente externo, use o controle **Copy for agent** da página de detalhes da sessão. Ele emite um link `agent_access` com escopo de gravação e validade de duas horas, renderiza via SSR um pequeno payload de descoberta em `/sessions/:recordingId`, e expõe apenas as APIs JSON de contexto/eventos do agente. A visibilidade da gravação não muda.
 
+Implementation note: the reusable layer is the core agent-access URL contract,
+not a replay-specific UI abstraction. Use `createScopedAgentAccessGrant`,
+`verifyScopedAgentAccessToken`, `buildAgentAccessUrl`, and
+`buildAgentAccessApiUrl` for scoped SSR and JSON API links; keep replay storage,
+diagnostics shaping, and access policy inside the Analytics template.
+
 Apenas para desenvolvimento local, o Analytics pode recorrer a blocos embutidos em SQL com limite de tamanho quando o armazenamento privado de blob não estiver disponível. As implantações de produção devem configurar armazenamento de blob privado ou criptografado, em vez de depender do Postgres para os payloads de replay.
 
 ## Avançado: provedores personalizados e internos {#advanced}

package/docs/content/locales/zh-CN/components.mdx

@@ -25,6 +25,15 @@ import { ResourcesPanel } from "@agent-native/core/client/resources";
 `@agent-native/core/client` 或聚焦的 `@agent-native/core/client/*` 子路径
 因此捆绑商选择浏览器安全的条目。
 
+将 `@agent-native/toolkit` 用于不属于基础运行时契约的可复用应用构建部件：shadcn 风格 UI primitives、共享 hooks、简单应用 shell helpers，以及其他模板组合模块。迁移期间 Core 会保留兼容 re-export，但新的模板和应用代码应直接导入 toolkit 模块：
+
+```tsx
+import { Button } from "@agent-native/toolkit/ui/button";
+import { Toaster } from "@agent-native/toolkit/ui/sonner";
+import { useToast } from "@agent-native/toolkit/hooks/use-toast";
+import { useSetHeaderActions } from "@agent-native/toolkit/app-shell";
+```
+
 <Diagram id="doc-block-1tquzyh" title={"下拉一层，不脱离框架"} summary={"每个层都保持相同的运行时 - 操作、线程状态和 SQL-backed 同步 - 同时让您更好地控制镶边。"}>
 
 ```html

package/docs/content/locales/zh-CN/creating-templates.mdx

@@ -7,6 +7,8 @@ description: "如何创建和发布您自己的代理本机应用模板。"
 
 模板是完整的、可分叉的代理本机应用程序，可解决实际工作流程。第一方模板使用您使用的相同框架表面构建：用于 UI 的 React 路由、用于数据的 Drizzle SQL、用于操作的 actions、用于代理行为的工作区资源以及轮询同步，以便代理和 UI 保持一致。
 
+将 `@agent-native/core` 用于运行时契约：actions、server plugins、database helpers、app state、routing helpers 和 agent chat。将 `@agent-native/toolkit` 用于可复用的应用构建 UI 和 helpers，例如共享 primitives、toast/mobile hooks、date pickers 和简单 app shell slots。当变体承载产品行为或视觉身份时，请保留在模板本地。
+
 一个好的模板：
 
 - 使用有用的种子数据或空状态流端到端地解决一个工作流。

package/docs/content/locales/zh-CN/template-analytics.mdx

@@ -149,6 +149,12 @@ CLI 打印本地开发 URL。使用 Google 登录，然后打开 **数据源**
 
 **Session replay agent handoff.** Session recordings stay private, but the session detail page can mint a temporary **Copy for agent** link. The two-hour `agent_access` URL lets an external agent read replay summaries, timelines, and bounded event details without exposing blob/provider URLs or making the recording public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep replay chunk authorization, diagnostics payloads, and the
+session detail UI local to Analytics.
+
 ### 与代理合作
 
 代理始终知道您在看什么。当前屏幕状态作为 `<current-screen>` 块注入到每条消息中 - 它包含活动视图、打开的仪表板或分析以及任何选定的过滤器。

package/docs/content/locales/zh-CN/template-clips.mdx

@@ -133,6 +133,13 @@ APIs，因此仅接受文本或静态图像的模型仍然可以理解内容
 
 Temporary private agent links are also supported: the Share dialog can mint a two-hour `agent_access` URL for any recording the viewer can access. Agents use that token with the share page and JSON APIs, and the clip does not become public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep Clips-specific visibility checks, transcript/frame payloads,
+and player UI local. New links use `agent_access`; routes should continue
+accepting the legacy `t` query where existing agent API URLs may already use it.
+
 端点遵循与共享页面相同的公共/密码/过期规则。
 受密码保护的剪辑需要密码一次；成功响应返回
 短暂的标记化链接，因此下游代理不需要明文

package/docs/content/locales/zh-CN/tracking.mdx

@@ -241,6 +241,12 @@ Analytics 模板将重放元数据存储在 SQL（`session_recordings`）中，
 
 当需要将私有录制内容提供给外部代理时，可使用会话详情页面的**复制给代理**控件。它会生成一个两小时有效期、仅限该录制的 `agent_access` 链接，在 `/sessions/:recordingId` 上以服务器端渲染方式生成一个小型发现载荷，并只暴露代理上下文/事件的 JSON API。该录制本身的可见性不会改变。
 
+Implementation note: the reusable layer is the core agent-access URL contract,
+not a replay-specific UI abstraction. Use `createScopedAgentAccessGrant`,
+`verifyScopedAgentAccessToken`, `buildAgentAccessUrl`, and
+`buildAgentAccessApiUrl` for scoped SSR and JSON API links; keep replay storage,
+diagnostics shaping, and access policy inside the Analytics template.
+
 仅在本地开发环境下，当私有 blob 存储不可用时，Analytics 可以回退为使用有上限的 SQL 内联数据块。生产部署应配置私有或加密的 blob 存储，而不是依赖 Postgres 来存放重放数据。
 
 ## 高级：自定义提供程序和内部结构 {#advanced}

package/docs/content/locales/zh-TW/components.mdx

@@ -25,6 +25,15 @@ import { ResourcesPanel } from "@agent-native/core/client/resources";
 `@agent-native/core/client` 或聚焦的 `@agent-native/core/client/*` 子路徑
 因此捆綁商選取瀏覽器安全的條目。
 
+將 `@agent-native/toolkit` 用於不屬於基礎執行階段合約的可重用應用程式建構部件：shadcn 風格 UI primitives、共享 hooks、簡單應用程式 shell helpers，以及其他範本組合模組。遷移期間 Core 會保留相容 re-export，但新的範本和應用程式程式碼應直接匯入 toolkit 模組：
+
+```tsx
+import { Button } from "@agent-native/toolkit/ui/button";
+import { Toaster } from "@agent-native/toolkit/ui/sonner";
+import { useToast } from "@agent-native/toolkit/hooks/use-toast";
+import { useSetHeaderActions } from "@agent-native/toolkit/app-shell";
+```
+
 <Diagram id="doc-block-174p2n3" title={"下拉一層，不脫離框架"} summary={"每個層都保持相同的執行時 - 操作、對話串狀態和 SQL-backed 同步 - 同時讓您更好地控制鑲邊。"}>
 
 ```html

package/docs/content/locales/zh-TW/creating-templates.mdx

@@ -7,6 +7,8 @@ description: "如何建立和發布您自己的 Agent-Native 應用範本。"
 
 範本是完整的、可分叉的 Agent-Native 應用程式，可解決實際工作流程。第一方範本使用您使用的相同框架表面建置：用於 UI 的 React 路由、用於資料的 Drizzle SQL、用於操作的 actions、用於代理行為的工作區資源以及輪詢同步，以便代理和 UI 保持一致。
 
+將 `@agent-native/core` 用於執行階段合約：actions、server plugins、database helpers、app state、routing helpers 和 agent chat。將 `@agent-native/toolkit` 用於可重用的應用程式建構 UI 和 helpers，例如共享 primitives、toast/mobile hooks、date pickers 和簡單 app shell slots。當變體承載產品行為或視覺識別時，請保留在範本本地。
+
 一個好的範本：
 
 - 使用有用的種子資料或空狀態流端對端地解決一個工作流。

package/docs/content/locales/zh-TW/template-analytics.mdx

@@ -149,6 +149,12 @@ CLI 列印本機開發 URL。使用 Google 登入，然後開啟 **資料來源*
 
 **Session replay agent handoff.** Session recordings stay private, but the session detail page can mint a temporary **Copy for agent** link. The two-hour `agent_access` URL lets an external agent read replay summaries, timelines, and bounded event details without exposing blob/provider URLs or making the recording public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep replay chunk authorization, diagnostics payloads, and the
+session detail UI local to Analytics.
+
 ### 與代理合作
 
 代理始終知道您在看什麼。目前螢幕狀態作為 `<current-screen>` 塊注入到每條訊息中 - 它包含活動檢視、開啟的儀表板或分析以及任何選定的過濾器。

package/docs/content/locales/zh-TW/template-clips.mdx

@@ -133,6 +133,13 @@ APIs，因此僅接受文字或靜態圖片的模型仍然可以理解內容
 
 Temporary private agent links are also supported: the Share dialog can mint a two-hour `agent_access` URL for any recording the viewer can access. Agents use that token with the share page and JSON APIs, and the clip does not become public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep Clips-specific visibility checks, transcript/frame payloads,
+and player UI local. New links use `agent_access`; routes should continue
+accepting the legacy `t` query where existing agent API URLs may already use it.
+
 端點遵循與共用頁面相同的公開/密碼/過期規則。
 受密碼保護的剪輯需要密碼一次；成功回應返回
 短暫的標記化連結，因此下游代理不需要明文

package/docs/content/locales/zh-TW/tracking.mdx

@@ -241,6 +241,12 @@ Analytics 範本將重播中繼資料儲存在 SQL（`session_recordings`）中
 
 當您需要將私人錄製內容交給外部代理時，請使用工作階段詳細資料頁面的**複製給代理**控制項。它會產生一個兩小時、僅限該筆錄製的 `agent_access` 連結，在 `/sessions/:recordingId` 上以伺服器端轉譯（SSR）一個小型探索酬載，並僅公開代理內容/事件 JSON API。該筆錄製的可見性不會改變。
 
+Implementation note: the reusable layer is the core agent-access URL contract,
+not a replay-specific UI abstraction. Use `createScopedAgentAccessGrant`,
+`verifyScopedAgentAccessToken`, `buildAgentAccessUrl`, and
+`buildAgentAccessApiUrl` for scoped SSR and JSON API links; keep replay storage,
+diagnostics shaping, and access policy inside the Analytics template.
+
 僅在本機開發時，Analytics 可以在私有 blob 儲存體無法使用時，回退到有上限的 SQL 內嵌區塊。正式環境部署應設定私有或加密的 blob 儲存體，而不是依賴 Postgres 來儲存重播酬載。
 
 ## 進階：自訂提供者和內部結構 {#advanced}

package/docs/content/template-analytics.mdx

@@ -154,6 +154,12 @@ The CLI prints the local dev URL. Sign in with Google, then open the **Data Sour
 
 **Session replay agent handoff.** Session recordings stay private, but the session detail page can mint a temporary **Copy for agent** link. The two-hour `agent_access` URL lets an external agent read replay summaries, timelines, and bounded event details without exposing blob/provider URLs or making the recording public.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep replay chunk authorization, diagnostics payloads, and the
+session detail UI local to Analytics.
+
 ### Working with the agent
 
 The agent always knows what you're looking at. The current screen state is injected into every message as a `<current-screen>` block — it contains the active view, the open dashboard or analysis, and any selected filters.

package/docs/content/template-clips.mdx

@@ -185,6 +185,13 @@ Password-protected clips require the password once; successful responses return
 short-lived tokenized links so downstream agents do not need the plaintext
 password.
 
+Implementation note: use the shared core agent-access helpers
+(`createScopedAgentAccessGrant`, `verifyScopedAgentAccessToken`,
+`buildAgentAccessUrl`, and `buildAgentAccessApiUrl`) for the SSR/bot-visible
+URL contract. Keep Clips-specific visibility checks, transcript/frame payloads,
+and player UI local. New links use `agent_access`; routes should continue
+accepting the legacy `t` query where existing agent API URLs may already use it.
+
 When `transcript.status` is `pending`, agents should wait 15-30 seconds and
 retry the context or transcript URL a few times before falling back to frames or
 reporting that no transcript is available. Long recordings can take several

package/docs/content/tracking.mdx

@@ -241,6 +241,12 @@ The Analytics template stores replay metadata in SQL (`session_recordings`) and
 
 When you need to hand a private recording to an external agent, use the session detail page's **Copy for agent** control. It mints a two-hour, recording-scoped `agent_access` link, SSRs a small discovery payload on `/sessions/:recordingId`, and exposes only the agent context/events JSON APIs. The recording's visibility does not change.
 
+Implementation note: the reusable layer is the core agent-access URL contract,
+not a replay-specific UI abstraction. Use `createScopedAgentAccessGrant`,
+`verifyScopedAgentAccessToken`, `buildAgentAccessUrl`, and
+`buildAgentAccessApiUrl` for scoped SSR and JSON API links; keep replay storage,
+diagnostics shaping, and access policy inside the Analytics template.
+
 For local development only, Analytics can fall back to capped SQL inline chunks when private blob storage is unavailable. Production deployments should configure private or encrypted blob storage rather than relying on Postgres for replay payloads.
 
 ## Advanced: custom providers & internals {#advanced}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.86.1",
+  "version": "0.87.0",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -73,6 +73,12 @@
     "./client/conversation": "./dist/client/conversation/index.js",
     "./client/editor": "./dist/client/editor/index.js",
     "./client/resources": "./dist/client/resources/index.js",
+    "./client/components/ui/dialog": "./dist/client/components/ui/dialog.js",
+    "./client/components/ui/dropdown-menu": "./dist/client/components/ui/dropdown-menu.js",
+    "./client/components/ui/hover-card": "./dist/client/components/ui/hover-card.js",
+    "./client/components/ui/popover": "./dist/client/components/ui/popover.js",
+    "./client/components/ui/sheet": "./dist/client/components/ui/sheet.js",
+    "./client/components/ui/tooltip": "./dist/client/components/ui/tooltip.js",
     "./blocks": "./dist/client/blocks/index.js",
     "./blocks/server": "./dist/client/blocks/server.js",
     "./client/AgentPanel": "./dist/client/AgentPanel.js",
@@ -268,7 +274,8 @@
     "tw-animate-css": "1.4.0",
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
-    "zod": "^4.3.6"
+    "zod": "^4.3.6",
+    "@agent-native/toolkit": "0.2.0"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",

package/corpus/templates/analytics/app/components/ui/accordion.tsx

@@ -1,56 +0,0 @@
-import * as AccordionPrimitive from "@radix-ui/react-accordion";
-import { IconChevronDown } from "@tabler/icons-react";
-import * as React from "react";
-
-import { cn } from "@/lib/utils";
-
-const Accordion = AccordionPrimitive.Root;
-
-const AccordionItem = React.forwardRef<
-  React.ElementRef<typeof AccordionPrimitive.Item>,
-  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Item>
->(({ className, ...props }, ref) => (
-  <AccordionPrimitive.Item
-    ref={ref}
-    className={cn("border-b", className)}
-    {...props}
-  />
-));
-AccordionItem.displayName = "AccordionItem";
-
-const AccordionTrigger = React.forwardRef<
-  React.ElementRef<typeof AccordionPrimitive.Trigger>,
-  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Trigger>
->(({ className, children, ...props }, ref) => (
-  <AccordionPrimitive.Header className="flex">
-    <AccordionPrimitive.Trigger
-      ref={ref}
-      className={cn(
-        "flex flex-1 items-center justify-between py-4 font-medium transition-all hover:underline [&[data-state=open]>svg]:rotate-180",
-        className,
-      )}
-      {...props}
-    >
-      {children}
-      <IconChevronDown className="h-4 w-4 shrink-0 transition-transform duration-200" />
-    </AccordionPrimitive.Trigger>
-  </AccordionPrimitive.Header>
-));
-AccordionTrigger.displayName = AccordionPrimitive.Trigger.displayName;
-
-const AccordionContent = React.forwardRef<
-  React.ElementRef<typeof AccordionPrimitive.Content>,
-  React.ComponentPropsWithoutRef<typeof AccordionPrimitive.Content>
->(({ className, children, ...props }, ref) => (
-  <AccordionPrimitive.Content
-    ref={ref}
-    className="overflow-hidden text-sm transition-all data-[state=closed]:animate-accordion-up data-[state=open]:animate-accordion-down"
-    {...props}
-  >
-    <div className={cn("pb-4 pt-0", className)}>{children}</div>
-  </AccordionPrimitive.Content>
-));
-
-AccordionContent.displayName = AccordionPrimitive.Content.displayName;
-
-export { Accordion, AccordionItem, AccordionTrigger, AccordionContent };