@agent-native/core 0.146.2 → 0.146.4

package/dist/triggers/actions.js

@@ -41,9 +41,9 @@ async function handleListEvents() {
     });
     return lines.join("\n");
 }
-async function handleList(args, getCurrentUser) {
+async function handleList(args, getCurrentUser, appId) {
     const scope = automationScope(args.scope);
-    const definitions = await listAutomationDefinitions({ userEmail: getCurrentUser(), orgId: getRequestOrgId() }, scope);
+    const definitions = await listAutomationDefinitions({ userEmail: getCurrentUser(), orgId: getRequestOrgId(), appId }, scope);
     const automations = definitions
         .filter(({ meta }) => !args.domain || meta.domain === args.domain)
         .filter(({ meta }) => args.enabled_only !== "true" || meta.enabled)
@@ -60,6 +60,7 @@ async function handleList(args, getCurrentUser) {
         condition: meta.condition ?? null,
         mode: meta.mode,
         domain: meta.domain ?? null,
+        appId: meta.appId ?? null,
         enabled: meta.enabled,
         lastRun: meta.lastRun ?? null,
         lastStatus: meta.lastStatus ?? null,
@@ -91,7 +92,7 @@ function automationTriggerType(value) {
         return value;
     throw new Error('trigger_type must be "schedule" or "event".');
 }
-async function handleDefine(args, getCurrentUser) {
+async function handleDefine(args, getCurrentUser, appId) {
     if (args.mode === "deterministic") {
         return ("Error: Deterministic mode was removed — it was never implemented and " +
             "automations that set it never fired. Create the automation without " +
@@ -99,7 +100,11 @@ async function handleDefine(args, getCurrentUser) {
     }
     const integration = getIntegrationRequestContext();
     try {
-        const definition = await defineAutomation({ userEmail: getCurrentUser(), orgId: getRequestOrgId() }, {
+        const definition = await defineAutomation({
+            userEmail: getCurrentUser(),
+            orgId: getRequestOrgId(),
+            appId,
+        }, {
             name: typeof args.name === "string" ? args.name : "",
             scope: automationScope(args.scope),
             triggerType: automationTriggerType(args.trigger_type),
@@ -154,9 +159,9 @@ async function handleDefine(args, getCurrentUser) {
         return `Error: ${error.message}`;
     }
 }
-async function handleUpdate(args, getCurrentUser) {
+async function handleUpdate(args, getCurrentUser, appId) {
     try {
-        const definition = await updateAutomation({ userEmail: getCurrentUser(), orgId: getRequestOrgId() }, {
+        const definition = await updateAutomation({ userEmail: getCurrentUser(), orgId: getRequestOrgId(), appId }, {
             name: typeof args.name === "string" ? args.name : "",
             scope: automationScope(args.scope),
             enabled: args.enabled === undefined
@@ -207,10 +212,10 @@ async function handleUpdate(args, getCurrentUser) {
         return `Error: ${error.message}`;
     }
 }
-async function handleDelete(args, getCurrentUser) {
+async function handleDelete(args, getCurrentUser, appId) {
     const name = typeof args.name === "string" ? args.name : "";
     try {
-        await deleteAutomation({ userEmail: getCurrentUser(), orgId: getRequestOrgId() }, automationScope(args.scope), name);
+        await deleteAutomation({ userEmail: getCurrentUser(), orgId: getRequestOrgId(), appId }, automationScope(args.scope), name);
         await refreshEventSubscriptions();
         return JSON.stringify({ deleted: true, name });
     }
@@ -236,7 +241,7 @@ async function handleFireTest(args, getCurrentUser) {
     emit("test.event.fired", { data }, { owner });
     return `Test event fired with payload: ${JSON.stringify({ data })}. Any automations subscribed to "test.event.fired" will be evaluated.`;
 }
-async function handleRunNow(args, getCurrentUser, context) {
+async function handleRunNow(args, getCurrentUser, appId, context) {
     if (context?.caller === "automation") {
         return "Error: an automation cannot run another automation.";
     }
@@ -244,6 +249,7 @@ async function handleRunNow(args, getCurrentUser, context) {
         const result = await queueAutomationRunNow({
             userEmail: getCurrentUser(),
             orgId: getRequestOrgId(),
+            appId,
             scope: automationScope(args.scope),
             name: typeof args.name === "string" ? args.name : "",
         });
@@ -265,7 +271,7 @@ const VALID_ACTIONS = [
     "fire-test",
     "run-now",
 ];
-export function createAutomationToolEntries(getCurrentUser) {
+export function createAutomationToolEntries(getCurrentUser, appId) {
     return {
         "manage-automations": {
             tool: {
@@ -371,17 +377,17 @@ export function createAutomationToolEntries(getCurrentUser) {
                     case "list-events":
                         return handleListEvents();
                     case "list":
-                        return handleList(args, getCurrentUser);
+                        return handleList(args, getCurrentUser, appId);
                     case "define":
-                        return handleDefine(args, getCurrentUser);
+                        return handleDefine(args, getCurrentUser, appId);
                     case "update":
-                        return handleUpdate(args, getCurrentUser);
+                        return handleUpdate(args, getCurrentUser, appId);
                     case "delete":
-                        return handleDelete(args, getCurrentUser);
+                        return handleDelete(args, getCurrentUser, appId);
                     case "fire-test":
                         return handleFireTest(args, getCurrentUser);
                     case "run-now":
-                        return handleRunNow(args, getCurrentUser, context);
+                        return handleRunNow(args, getCurrentUser, appId, context);
                     default:
                         return `Error: unknown action "${action}". Valid actions: ${VALID_ACTIONS.join(", ")}.`;
                 }

package/dist/triggers/dispatcher.js

@@ -39,6 +39,13 @@ const _eventSubscriptions = new Map();
 // deployments; multi-instance would need a conditional DB update.
 const _dispatchingTriggers = new Set();
 let _deps = null;
+function jobBelongsToApp(meta, appId) {
+    const ownerAppId = meta.appId?.trim();
+    if (!ownerAppId)
+        return true;
+    const dispatcherAppId = appId?.trim();
+    return Boolean(dispatcherAppId && ownerAppId === dispatcherAppId);
+}
 /**
  * Record that a tick evaluated this trigger and declined to dispatch it.
  * `lastRun` stays untouched — nothing ran — and an unchanged outcome is not
@@ -106,6 +113,8 @@ export async function refreshEventSubscriptions() {
             if (!resource.path.endsWith(".md"))
                 continue;
             const { meta } = parseTriggerFrontmatter(resource.content);
+            if (!jobBelongsToApp(meta, _deps?.appId))
+                continue;
             if (meta.triggerType === "event" && meta.event && meta.enabled) {
                 eventNames.add(meta.event);
             }
@@ -129,7 +138,8 @@ export async function refreshEventSubscriptions() {
     }
 }
 async function handleEvent(eventName, payload, eventMeta) {
-    if (!_deps)
+    const deps = _deps;
+    if (!deps)
         return;
     try {
         const jobResources = await resourceListAllOwners("jobs/");
@@ -140,6 +150,7 @@ async function handleEvent(eventName, payload, eventMeta) {
             return (meta.triggerType === "event" &&
                 meta.event === eventName &&
                 meta.enabled &&
+                jobBelongsToApp(meta, deps.appId) &&
                 !isBackgroundAutomationRunActive(meta));
         });
         for (const resource of matchingTriggers) {
@@ -178,7 +189,7 @@ async function handleEvent(eventName, payload, eventMeta) {
             // Resolve API key for condition evaluation
             const owner = identity.userEmail;
             const userApiKey = await getOwnerActiveApiKey(owner);
-            const apiKey = userApiKey || _deps.apiKey;
+            const apiKey = userApiKey || deps.apiKey;
             if (!apiKey) {
                 await recordTriggerSkip(resource, "error", "No API key is available for this automation");
                 console.warn(`[triggers] ${meta.lastError}: "${resource.path}"`);
@@ -227,6 +238,10 @@ async function dispatchAgentic(resource, payload, eventMeta, identity) {
         return;
     }
     const latestTrigger = parseTriggerFrontmatter(latest.content);
+    if (!jobBelongsToApp(latestTrigger.meta, _deps.appId)) {
+        console.log(`[triggers] "${resource.path}" belongs to a different app; dropping the event.`);
+        return;
+    }
     const runningMeta = {
         ...latestTrigger.meta,
         lastRun: now.toISOString(),

package/dist/triggers/routes.d.ts

@@ -5,6 +5,7 @@ export interface AutomationRouteItem {
     name: string;
     path: string;
     owner: string;
+    appId?: string;
     scope: "personal" | "organization";
     canUpdate: boolean;
     triggerType: TriggerFrontmatter["triggerType"];

package/dist/triggers/routes.js

@@ -122,6 +122,7 @@ async function resourceToAutomationItem(event, userEmail, resource) {
         name: automationName(resource.path),
         path: resource.path,
         owner: resource.owner,
+        appId: meta.appId,
         scope: resource.owner === userEmail && !meta.orgId ? "personal" : "organization",
         canUpdate: await currentUserCanUpdateAutomation(event, userEmail, resource, meta),
         triggerType: meta.triggerType,

package/docs/content/docs-components.mdx

@@ -191,6 +191,113 @@ Each card is a `###` heading (optionally linked) followed by the description. Ca
 
 ---
 
+## Notice
+
+<Notice tone="risk" title="Bold, not subtle">
+
+Use `Notice` when a `Callout` would be too easy to skim past — something the reader must not miss, like a destructive action or a hard requirement. It shares the same five tones as `Callout` (`info`, `decision`, `risk`, `warning`, `success`) but renders as a filled card with an icon and optional title instead of a left-border note.
+
+</Notice>
+
+```mdx
+<Notice tone="risk" title="Bold, not subtle">
+
+Use `Notice` when a `Callout` would be too easy to skim past — something the reader must not miss, like a destructive action or a hard requirement.
+
+</Notice>
+```
+
+`title` is optional — omit it for a shorter card with just the icon and body. Leave a blank line between the opening tag and the body, same as `Callout`. Reach for `Callout` first; use `Notice` only when a subtle left-border note isn't enough attention.
+
+---
+
+## Banner
+
+<Banner
+  tone="warning"
+  body="This page describes the v9 API. See [Migrating to v10](/docs/migrating-v10) for what changed."
+/>
+
+```mdx
+<Banner
+  tone="warning"
+  body="This page describes the v9 API. See [Migrating to v10](/docs/migrating-v10) for what changed."
+/>
+```
+
+`Banner` is self-closing — `body` is a flat attribute (kept short and single-purpose on purpose), not markdown children. Place it right under a page's title or a section heading — deprecated, beta, moved, version-scoped. For content the reader needs to actually read (not just notice), use `Notice` or `Callout` instead.
+
+---
+
+## Accordion
+
+<Accordion>
+
+### Do I need Toolkit to use Core?
+
+No. Toolkit is optional shared UI — Core works standalone.
+
+### Can I mix Templates and Toolkit?
+
+Yes, most first-party templates already do.
+
+### Where do I ask questions?
+
+The `#agent-native` Discord channel, linked in the site header.
+
+</Accordion>
+
+```mdx
+<Accordion>
+
+### Do I need Toolkit to use Core?
+
+No. Toolkit is optional shared UI — Core works standalone.
+
+### Can I mix Templates and Toolkit?
+
+Yes, most first-party templates already do.
+
+</Accordion>
+```
+
+Same authoring shape as `Steps`/`Cards` — a `### Question` heading per item followed by its answer — but each item renders collapsed behind native `<details>`. Best for FAQ-style content where most readers only need one or two entries, not a full top-to-bottom read.
+
+---
+
+## Badge
+
+<Badge label="Beta" color="orange" icon="rocket" />
+
+<Badge label="Deprecated" color="red" />
+
+<Badge label="v9.1+" color="blue" shape="pill" />
+
+<Badge label="Server-only" color="gray" stroke />
+
+```mdx
+<Badge label="Beta" color="orange" icon="rocket" />
+
+<Badge label="Deprecated" color="red" />
+
+<Badge label="v9.1+" color="blue" shape="pill" />
+
+<Badge label="Server-only" color="gray" stroke />
+```
+
+A small status chip for the top of a page or section. Self-closing, block-level only — **not** embeddable mid-sentence (the docs MDX pipeline only recognizes a custom component when its tag opens its own line, so `text <Badge label="x"/> more text` renders as literal text, not a chip). Place it on its own line, typically right after a heading. Leave a blank line between adjacent Badges (or any two block components) — without one, the scanner can't tell where one ends and the next begins and falls back to rendering literal text.
+
+| Prop       | Values                                                                                                                                                 |
+| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `color`    | `gray` · `blue` · `green` · `yellow` · `orange` · `red` · `purple` · `white` · `surface` · `white-destructive` · `surface-destructive`                 |
+| `size`     | `xs` · `sm` · `md` · `lg`                                                                                                                              |
+| `shape`    | `rounded` (default) · `pill`                                                                                                                           |
+| `icon`     | one of a curated set — `circle-check`, `circle-info`, `alert-triangle`, `alert-octagon`, `ban`, `clock`, `star`, `flame`, `sparkles`, `lock`, `rocket` |
+| `stroke`   | `true` for an outlined, transparent-background variant                                                                                                 |
+| `disabled` | `true` to dim it for an inactive/unavailable state                                                                                                     |
+
+---
+
 ## Comparison
 
 <Comparison>
@@ -478,14 +585,18 @@ Like `TabsBlock`, `Columns` is self-closing with a single JSON `columns` attribu
 
 ## When to use which component
 
-| Situation                                 | Component                            |
-| ----------------------------------------- | ------------------------------------ |
-| Reader must not miss something            | `Callout` (warning / info / success) |
-| Sequential procedure with titled steps    | `Steps`                              |
-| Navigation or feature overview grid       | `Cards`                              |
-| Before vs. after, old vs. new (prose)     | `Comparison`                         |
-| Same task in multiple tools or frameworks | `Tabs`                               |
-| Side-by-side code (labeled columns)       | `Columns`                            |
-| Project directory structure               | `FileTree`                           |
-| Inline keyboard shortcut                  | `[[Key]]`                            |
-| Architecture or flow diagram              | Mermaid fence                        |
+| Situation                                             | Component                            |
+| ----------------------------------------------------- | ------------------------------------ |
+| Reader must not miss something, inline in prose       | `Callout` (warning / info / success) |
+| Reader must not miss something, standalone            | `Notice`                             |
+| Deprecated/beta/version notice at page or section top | `Banner`                             |
+| Status or version tag at page or section top          | `Badge`                              |
+| Sequential procedure with titled steps                | `Steps`                              |
+| FAQ-style content, one answer at a time               | `Accordion`                          |
+| Navigation or feature overview grid                   | `Cards`                              |
+| Before vs. after, old vs. new (prose)                 | `Comparison`                         |
+| Same task in multiple tools or frameworks             | `Tabs`                               |
+| Side-by-side code (labeled columns)                   | `Columns`                            |
+| Project directory structure                           | `FileTree`                           |
+| Inline keyboard shortcut                              | `[[Key]]`                            |
+| Architecture or flow diagram                          | Mermaid fence                        |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.146.2",
+  "version": "0.146.4",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/src/templates/chat/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/src/templates/chat/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/src/templates/chat/netlify.toml

@@ -1,6 +1,6 @@
 [build]
 ignore = "node ./scripts/netlify-ignore-build.mjs chat"
-command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter chat build"
+command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter chat build && if [ \"${CONTEXT:-}\" = \"production\" ]; then pnpm --filter chat migrate:production; fi"
 publish = "templates/chat/dist"
 functions = "templates/chat/.netlify/functions-internal"
 

package/src/templates/chat/package.json

@@ -5,6 +5,7 @@
   "description": "Minimal chat-first agent-native app template.",
   "type": "module",
   "scripts": {
+    "migrate:production": "tsx scripts/migrate-production.ts",
     "dev": "agent-native dev --open",
     "build": "agent-native build",
     "start": "agent-native start",

package/src/templates/chat/scripts/migrate-production.ts

@@ -0,0 +1,31 @@
+import { closeDbExec, withMigrationRuntime } from "@agent-native/core/db";
+import { runFrameworkReleaseMigrations } from "@agent-native/core/server";
+
+/**
+ * Release-time schema entrypoint.
+ *
+ * Every deploy runs this once, and request functions never touch schema. That
+ * ordering is not an optimization: on serverless, "migrate on first use" means
+ * migrate on EVERY cold start, and a production incident traced a multi-hour
+ * outage to schema introspection running 4-6 times concurrently on the request
+ * path.
+ *
+ * `withMigrationRuntime()` is load-bearing. The Netlify BUILD environment sets
+ * NETLIFY=true, so this script looks like a serverless request to the guard in
+ * `runMigrations` — it is allowed to migrate only because it claims duty here.
+ * A release entrypoint that forgets the wrapper silently does nothing.
+ *
+ * If this app owns tables of its own, export its migration runner from
+ * `server/plugins/db.ts` and call it inside the same block.
+ */
+async function main(): Promise<void> {
+  await withMigrationRuntime(async () => {
+    await runFrameworkReleaseMigrations(null);
+  });
+}
+
+try {
+  await main();
+} finally {
+  await closeDbExec();
+}

package/src/templates/chat/tsconfig.json

@@ -13,6 +13,7 @@
     "app/**/*",
     "server/**/*",
     "shared/**/*",
+    "scripts/**/*",
     "vite.config.ts",
     "react-router.config.ts",
     ".react-router/types/**/*",

package/src/templates/default/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/src/templates/default/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/src/templates/default/package.json

@@ -11,6 +11,7 @@
     "agent-native:doctor": "agent-native doctor",
     "action": "agent-native action",
     "script": "agent-native script",
+    "migrate:production": "tsx scripts/migrate-production.ts",
     "skills:update": "agent-native skills update scaffold --project",
     "upgrade:agent-native": "agent-native upgrade"
   },

package/src/templates/default/scripts/migrate-production.ts

@@ -0,0 +1,31 @@
+import { closeDbExec, withMigrationRuntime } from "@agent-native/core/db";
+import { runFrameworkReleaseMigrations } from "@agent-native/core/server";
+
+/**
+ * Release-time schema entrypoint.
+ *
+ * Every deploy runs this once, and request functions never touch schema. That
+ * ordering is not an optimization: on serverless, "migrate on first use" means
+ * migrate on EVERY cold start, and a production incident traced a multi-hour
+ * outage to schema introspection running 4-6 times concurrently on the request
+ * path.
+ *
+ * `withMigrationRuntime()` is load-bearing. The Netlify BUILD environment sets
+ * NETLIFY=true, so this script looks like a serverless request to the guard in
+ * `runMigrations` — it is allowed to migrate only because it claims duty here.
+ * A release entrypoint that forgets the wrapper silently does nothing.
+ *
+ * If this app owns tables of its own, export its migration runner from
+ * `server/plugins/db.ts` and call it inside the same block.
+ */
+async function main(): Promise<void> {
+  await withMigrationRuntime(async () => {
+    await runFrameworkReleaseMigrations(null);
+  });
+}
+
+try {
+  await main();
+} finally {
+  await closeDbExec();
+}

package/src/templates/default/tsconfig.json

@@ -4,6 +4,7 @@
     "app/**/*",
     "server/**/*",
     "shared/**/*",
+    "scripts/**/*",
     "vite.config.ts",
     "react-router.config.ts",
     ".react-router/types/**/*",

package/src/templates/headless/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/src/templates/workspace-core/.agents/skills/self-modifying-code/SKILL.md

@@ -36,8 +36,10 @@ Tier 4 includes **all** of the following — not only editing package source:
 - Files under `node_modules/@agent-native/*` (core, dispatch, scheduling, …)
 - `pnpm.overrides`, `overrides`, `resolutions`, or `patchedDependencies` that
   target any `@agent-native/*` package
-- Local package patches or invented "dispatch/core behavior" shims meant to
-  paper over a version skew or failed upgrade
+- `pnpm patch`, `pnpm patch-commit`, or local package patch artifacts for any
+  dependency
+- Invented "dispatch/core behavior" shims meant to paper over a version skew
+  or failed upgrade
 
 This does not prohibit intentional app-owned UI customization. When public
 props and composition are insufficient, the `customizing-agent-native` skill
@@ -100,8 +102,10 @@ inline strings in components.
 - Don't confuse readable package source with app-owned code: use
   `customizing-agent-native` and `agent-native eject` for supported ownership
   transfer
+- Don't use `pnpm patch` / `pnpm patch-commit`, commit `patches/` artifacts, or
+  add `pnpm.patchedDependencies` to "make the app run" after a version bump
 - Don't add `pnpm.overrides` / `patchedDependencies` / `resolutions` for
-  `@agent-native/*` to "make the app run" after a version bump
+  `@agent-native/*` to paper over a broken upgrade
 - Don't invent local dispatch/core behavior overrides when upgrade fails —
   run `npx @agent-native/core@latest upgrade`, then fix app-level errors only
 - Don't modify `.agents/skills/` or `AGENTS.md` unless explicitly requested

package/src/templates/workspace-core/.agents/skills/upgrade-agent-native/SKILL.md

@@ -15,8 +15,9 @@ metadata:
 
 When an older Agent Native app/branch needs to run on current packages, use
 `agent-native upgrade`. Never "fix" upgrade breakage with
-`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patches, or
-edits under `node_modules/@agent-native/*` — especially not against
+`pnpm patch`, `pnpm patch-commit`, `pnpm.patchedDependencies`,
+`pnpm.overrides`, `patchedDependencies`, `resolutions`, local patch artifacts,
+or edits under `node_modules/@agent-native/*` — especially not against
 `@agent-native/core` or `@agent-native/dispatch`.
 
 ## Why
@@ -109,6 +110,8 @@ install → refresh scaffold skills → verify, then fix **app** code only.
 
 - Don't add `pnpm.overrides`, `overrides`, `resolutions`, or
   `patchedDependencies` for any `@agent-native/*` package
+- Don't run `pnpm patch` or `pnpm patch-commit`, or commit files under
+  `patches/`, for any dependency
 - Don't edit `node_modules/@agent-native/core` or
   `node_modules/@agent-native/dispatch`
 - Don't invent local "dispatch behavior" shims to paper over version skew

package/src/templates/workspace-root/AGENTS.md

@@ -36,7 +36,8 @@ Preview before `--apply`, commit `agent-native.ejections.json`, and never edit
 To bring an older workspace current, run `pnpm upgrade:agent-native` or
 `npx @agent-native/core@latest upgrade` from the workspace root. That bumps
 `@agent-native/*` deps, installs, refreshes scaffold skills, and typechecks.
-Do **not** add `pnpm.overrides` / patches against `@agent-native/*` or edit
+Do **not** run `pnpm patch` / `pnpm patch-commit`, add
+`pnpm.patchedDependencies`, commit dependency patches, or edit
 `node_modules/@agent-native/*` when an upgrade fails — fix app code or ask.
 See the `upgrade-agent-native` and `self-modifying-code` skills.
 After a manual core bump only, `pnpm skills:update` (or