@agent-native/core 0.201.0-nightly-20261005153421 → 0.201.0

package/dist/shared/environment-lanes.js

@@ -41,6 +41,32 @@ export function resolveEnvironmentTargets(hostname) {
         productionHost,
     };
 }
+/**
+ * Moves an endpoint on a production lane host to that host's beta lane when
+ * the calling app is itself served from beta, so beta apps report to beta
+ * Analytics. Both lanes share one database: this picks which build ingests an
+ * event, not where the event is stored. Endpoints on any other host are an
+ * explicit choice and pass through unchanged.
+ */
+export function resolveLaneEndpoint(endpoint, appHostname) {
+    const appHost = appHostname?.trim().toLowerCase().replace(/\.$/, "");
+    if (!appHost || resolveEnvironmentTargets(appHost)?.betaHost !== appHost) {
+        return endpoint;
+    }
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        // coercion-ok: A relative endpoint already targets the app's own lane.
+        return endpoint;
+    }
+    const betaHost = ENVIRONMENT_BETA_HOSTS[url.hostname];
+    if (!betaHost)
+        return endpoint;
+    url.hostname = betaHost;
+    return url.toString();
+}
 export function buildEnvironmentUrl(sourceHref, targetHost) {
     try {
         const target = new URL(sourceHref);

package/dist/templates/chat/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/dist/templates/chat/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/dist/templates/chat/README.md

@@ -5,7 +5,7 @@ the center, durable threads, standard app navigation, auth, live sync, and
 actions. Start here when you want a real browser app to build on without
 committing to a domain template.
 
-**Live app: [chat.agent-native.com](https://chat.agent-native.com)**
+**Live app: [chat.agent-native.com](https://chat.agent-native.com?utm_source=github&utm_medium=referral&utm_content=chat-readme)**
 
 Chat is the basic agent-native app starting point. It gives you the app-agent
 loop wired end to end and one example action, so you can add your own UI, data,
@@ -30,4 +30,4 @@ pnpm install
 pnpm dev
 ```
 
-Full docs: [agent-native.com/docs/template-chat](https://agent-native.com/docs/template-chat).
+Full docs: [agent-native.com/docs/template-chat](https://agent-native.com/docs/template-chat?utm_source=github&utm_medium=referral&utm_content=chat-readme).

package/dist/templates/default/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/dist/templates/default/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/dist/templates/default/app/routes/home.tsx

@@ -47,7 +47,11 @@ export default function HomePage() {
 
         <div className="grid grid-cols-2 gap-3 text-left">
           <a
-            href={docsUrl("getting-started")}
+            href={docsUrl("getting-started", {
+              source: "app",
+              campaign: null,
+              content: "docs-card",
+            })}
             target="_blank"
             rel="noopener noreferrer"
             className="group rounded-lg border border-border/50 px-4 py-3 hover:bg-accent/50 transition-colors"

package/dist/templates/headless/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/dist/templates/headless/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/dist/templates/workspace-core/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/dist/templates/workspace-core/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/dist/tracking/providers.js

@@ -1,6 +1,7 @@
 import { getAppConfig } from "../app-config/index.js";
 import { getRequestContext } from "../server/request-context.js";
 import { isTestIdentity } from "../server/test-identity.js";
+import { resolveLaneEndpoint } from "../shared/environment-lanes.js";
 import { reshapeTrackedExceptionProperties } from "./posthog-exception.js";
 import { registerTrackingProvider } from "./registry.js";
 const POSTHOG_DEFAULT_HOST = "https://us.i.posthog.com";
@@ -73,6 +74,17 @@ function isLocalhostUrl(value) {
         return false;
     }
 }
+function hostnameOf(url) {
+    if (!url)
+        return undefined;
+    try {
+        return new URL(url).hostname;
+    }
+    catch {
+        // coercion-ok: An unparseable app URL names no lane, so the endpoint stays as configured.
+        return undefined;
+    }
+}
 function shouldSkipAgentNativeAnalyticsForLocalhost() {
     if (process.env.AGENT_NATIVE_ANALYTICS_ALLOW_LOCALHOST === "true") {
         return false;
@@ -358,7 +370,7 @@ export function registerBuiltinProviders() {
     }
     const { agentNativePublicKey, agentNativeEndpoint } = getAppConfig().analytics;
     if (agentNativePublicKey && !shouldSkipAgentNativeAnalyticsForLocalhost()) {
-        registerTrackingProvider(createAgentNativeAnalyticsProvider(agentNativePublicKey, (agentNativeEndpoint || AGENT_NATIVE_ANALYTICS_DEFAULT_ENDPOINT).replace(/\/+$/, "")));
+        registerTrackingProvider(createAgentNativeAnalyticsProvider(agentNativePublicKey, resolveLaneEndpoint((agentNativeEndpoint || AGENT_NATIVE_ANALYTICS_DEFAULT_ENDPOINT).replace(/\/+$/, ""), hostnameOf(getAppConfig().app.url))));
     }
     const webhookUrl = process.env.TRACKING_WEBHOOK_URL;
     if (webhookUrl) {

package/docs/content/authentication.mdx

@@ -369,7 +369,11 @@ Unauthenticated MCP requests return a `WWW-Authenticate` challenge pointing at `
 
 </Diagram>
 
-Access tokens are signed with `A2A_SECRET` when set, otherwise `BETTER_AUTH_SECRET`. They carry the signed user/org identity and the `mcp:read`, `mcp:write`, `mcp:apps`, and/or `offline_access` scopes, and are audience-bound to the exact MCP resource URL. `offline_access` is advertised for hosts such as ChatGPT that require it before retaining refresh access. Refresh tokens are stored only as hashes and rotate on every refresh. Tool calls and MCP Apps resource reads run inside the same request context as the signed-in user; the embedded MCP App iframe never receives raw OAuth tokens.
+Access tokens are signed with `A2A_SECRET` when set, otherwise `BETTER_AUTH_SECRET`. They carry the signed user/org identity and the `mcp:read`, `mcp:write`, `mcp:apps`, and/or `offline_access` scopes, and are audience-bound to the exact MCP resource URL. `offline_access` is advertised for hosts such as ChatGPT that require it before retaining refresh access. Refresh tokens are stored only as hashes and are not rotated: a refresh returns the same token and resets its expiry to 365 days out. Every request and every refresh re-checks that the user still belongs to the token's organization, so a removed member loses MCP access on their next request. Tool calls and MCP Apps resource reads run inside the same request context as the signed-in user; the embedded MCP App iframe never receives raw OAuth tokens.
+
+New MCP authorization codes and refresh tokens record their owner at issuance. Token exchanges reject unbound legacy grants or an owner-binding mismatch with `invalid_grant`, without inferring a legacy owner. An intentional email rekey updates the issuance identity. It also retires the old address: access and Connect tokens signed for it before the rekey are refused, and no new ones are issued for it unless an account registers that address again. OAuth clients get tokens for the new address on their next refresh. Offboarding revokes or deletes grants without transferring the issuance binding.
+
+The OAuth owner-binding update requires every existing OAuth connection to [reconnect once](/docs/external-agents#reconnect). Old OAuth access tokens are refused after rollout. Unbound legacy refresh tokens return `invalid_grant`, and pending old authorization codes must restart consent. Newly issued access tokens use their configured lifetime and live membership checks. Legacy A2A-format `mcp-connect` credentials and cross-app A2A tokens are unchanged by this cutover. Connections using old OAuth-format Connect tokens must reconnect too.
 
 `npx @agent-native/core@latest connect <url> --client claude-code` writes the URL-only MCP entry for this standard flow. For clients that cannot perform remote MCP OAuth, use the Connect page or `npx @agent-native/core@latest connect --token <token>` fallback to write an explicit bearer-token entry.
 

package/docs/content/durable-background-runs.mdx

@@ -16,7 +16,7 @@ framework — there is no app code to write.
 </Callout>
 
 A normal hosted agent turn runs inside the synchronous request function, which
-is capped by the platform's request timeout (~10s on Netlify's free tier, and
+is capped by the platform's request timeout (60s on Netlify, and
 the framework's ~40s soft-timeout before it has to hand back to the client and
 "continue from where you left off"). That is fine for quick answers, but a long
 agentic turn — many tool calls, large analyses — ends up bouncing through
@@ -45,7 +45,7 @@ the first one. Only the dispatched agent turn runs on the second.
       <small class="diagram-muted">decides + dispatches</small>
     </div>
     <small class="diagram-muted"
-      >~10s timeout &middot; nearly every request</small
+      >60s timeout &middot; nearly every request</small
     >
   </div>
   <div class="diagram-arrow diagram-muted" aria-hidden="true">
@@ -205,12 +205,21 @@ The foreground returns a working turn either way: the background worker when it
 
 ## Cost and tradeoffs {#cost}
 
-Netlify background functions are a **paid-plan** feature (Personal / Pro, not
-the free tier) and are billed by compute time (GB-hour). A multi-minute agent
-turn therefore costs more compute than a short synchronous call — but it largely
-**replaces** the old pattern, where the turn hit the ~40s wall and the client
-re-issued several continuation requests. It is the same work consolidated into
-one long invocation, not purely additive.
+Netlify background functions are available on every credit-based Netlify plan,
+including Free, and on Enterprise. They bill as functions compute, the same
+meter as the synchronous function: 10 credits per GB-hour of runtime at the
+function's memory size (1 GB by default). The Free plan's 300 monthly credits
+are a hard cap, and Netlify pauses the team's projects when they run out.
+Legacy plans (accounts created before September 4, 2025) bill functions per
+request, and Legacy Free and Starter don't include background functions; see
+Netlify's
+[functions usage and billing](https://docs.netlify.com/build/functions/usage-and-billing/)
+page.
+
+A multi-minute agent turn therefore costs more compute than a short synchronous
+call — but it largely **replaces** the old pattern, where the turn hit the ~40s
+wall and the client re-issued several continuation requests. It is the same
+work consolidated into one long invocation, not purely additive.
 
 <Callout id="doc-block-gjoj2d" tone="info">
 

package/docs/content/external-agents.mdx

@@ -299,6 +299,8 @@ The connection is **per-user, scoped, and revocable**. In the OAuth path, the ho
 
 ### Re-authenticating after a 401 {#reconnect}
 
+The OAuth owner-binding update requires every existing OAuth connection to [reconnect once](/docs/external-agents#reconnect). Old OAuth access tokens are refused after rollout. Unbound legacy refresh tokens return `invalid_grant`, and pending old authorization codes must restart consent. Newly issued access tokens use their configured lifetime and live membership checks. Legacy A2A-format `mcp-connect` credentials and cross-app A2A tokens are unchanged by this cutover. Connections using old OAuth-format Connect tokens must reconnect too.
+
 Once connected, auth should persist long-term — access tokens last 30 days by default (override with `MCP_OAUTH_ACCESS_TOKEN_TTL` on the server, e.g. `7d` or `12h`) with a sliding 365-day refresh window, so random 401s should be rare. When one does happen, use the lightweight reconnect command rather than reinstalling:
 
 ```bash
@@ -347,7 +349,7 @@ This is the same URL-only entry that `npx @agent-native/core@latest connect http
 https://dispatch.agent-native.com/mcp
 ```
 
-The OAuth flow is authorization-code + PKCE with refresh-token rotation. Access tokens are audience-bound to the exact MCP resource URL and carry the signed user/org identity, so tool calls, `resources/read`, and MCP App iframe-initiated `tools/call` all run through the same `runWithRequestContext` tenant scoping as the existing connect-minted JWT path. The iframe never receives raw OAuth tokens; the host mediates calls through the authenticated MCP connection.
+The OAuth flow is authorization-code + PKCE with refresh tokens, which are not rotated. Access tokens are audience-bound to the exact MCP resource URL and carry the signed user/org identity, so tool calls, `resources/read`, and MCP App iframe-initiated `tools/call` all run through the same `runWithRequestContext` tenant scoping as the existing connect-minted JWT path. The iframe never receives raw OAuth tokens; the host mediates calls through the authenticated MCP connection.
 
 Current scopes are:
 

package/docs/content/mcp-protocol.mdx

@@ -28,7 +28,7 @@ Key concepts:
 - **Same actions** — the exact same action registry that powers agent chat and A2A
 - **`ask-agent` tool** — a meta-tool that delegates to the full agent loop for complex tasks
 - **MCP Apps** — actions can advertise interactive UI resources through the official `io.modelcontextprotocol/ui` extension
-- **Standard remote MCP OAuth** — OAuth 2.1 discovery, dynamic client registration, authorization-code + PKCE, refresh-token rotation
+- **Standard remote MCP OAuth** — OAuth 2.1 discovery, dynamic client registration, authorization-code + PKCE, refresh tokens
 - **Bearer auth fallback** — uses `ACCESS_TOKEN`, `ACCESS_TOKENS`, or connect-minted JWTs for clients that cannot run OAuth
 
 ## Fetch-first discovery {#fetch-first-discovery}
@@ -380,7 +380,11 @@ Access tokens are signed JWTs whose audience is the exact MCP resource URL. The
 | `mcp:write` | mutating actions and `ask-agent`            |
 | `mcp:apps`  | MCP Apps resources (`ui://` HTML resources) |
 
-Refresh tokens are stored only as hashes and are rotated on every refresh. `npx @agent-native/core@latest connect` writes this URL-only OAuth entry for Claude Code clients by default; keep the Connect page, `npx @agent-native/core@latest connect --token <token>`, and static bearer config for local stdio proxying, older clients, and emergency/debug flows.
+Refresh tokens are stored only as hashes and are not rotated: a refresh returns the same token and resets its expiry to 365 days out. Every request and every refresh re-checks that the user still belongs to the token's organization, so a removed member loses MCP access on their next request. `npx @agent-native/core@latest connect` writes this URL-only OAuth entry for Claude Code clients by default; keep the Connect page, `npx @agent-native/core@latest connect --token <token>`, and static bearer config for local stdio proxying, older clients, and emergency/debug flows.
+
+New authorization codes and refresh tokens retain their issuance owner binding. Unbound legacy grants and owner mismatches return `invalid_grant`. Renewing a revoked or deleted grant returns `invalid_grant` even when the update affects no rows. A failed renewal write returns retryable HTTP 503 with `Retry-After: 5`. Neither failure issues an access token.
+
+The OAuth owner-binding update requires every existing OAuth connection to [reconnect once](/docs/external-agents#reconnect). Old OAuth access tokens are refused after rollout. Unbound legacy refresh tokens return `invalid_grant`, and pending old authorization codes must restart consent. Newly issued access tokens use their configured lifetime and live membership checks. Legacy A2A-format `mcp-connect` credentials and cross-app A2A tokens are unchanged by this cutover. Connections using old OAuth-format Connect tokens must reconnect too.
 
 ## Custom MCP setup {#custom-setup}
 

package/docs/content/security.mdx

@@ -244,7 +244,7 @@ CREATE TEMPORARY VIEW "notes" AS
 
 INSERT statements get `owner_email` auto-injected when the column isn't already present.
 
-The `db-query` / `db-exec` tools reject schema-qualified table references (`public.<table>`) — a qualified name resolves to the base table and would bypass the temporary view above. Agents use bare table names; scoping is applied automatically.
+The `db-query`, `db-exec`, and `db-patch` tools check SQL token boundaries and verify, inside the transaction, that each relation name resolves to one of the temporary views above. They refuse schema- or database-qualified names (`public.<table>`), relations the views do not cover, names matching functions or operators outside `pg_catalog` (including extensions), and selected built-ins that execute SQL text or access server, session, or sequence state. PostgreSQL escape-string continuation is unsupported and refused. `db-query` runs read-only. Agents use bare table names. Scoping is applied automatically. These guards scope direct SQL reads and writes and reject unapproved explicit routines and type conversions; reviewed schema defaults, constraints, triggers, casts and type I/O remain trusted database behavior. Apps can reuse these checks through `@agent-native/core/agent-sql`. Its `readAgentSqlQuery()` identifies table sources and their exact text spans in supported `SELECT`/`WITH` queries, and `rewriteAgentSqlQuerySources()` replaces those spans. Callers must enforce allowed sources and read-only execution.
 
 ### Per-Org Scoping (`org_id`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.201.0-nightly-20261005153421",
+  "version": "0.201.0",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -141,6 +141,7 @@
       "types": "./dist/config.d.ts",
       "default": "./dist/config.js"
     },
+    "./agent-sql": "./dist/agent-sql/index.js",
     "./agent-web": "./dist/agent-web/index.js",
     "./db": "./dist/db/index.js",
     "./db-admin": "./dist/db-admin/index.js",
@@ -668,8 +669,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.201.0-nightly-20261005153421",
-    "@agent-native/recap-cli": "^0.5.61-nightly-20261005153421"
+    "@agent-native/agentkit": "^0.201.0",
+    "@agent-native/recap-cli": "^0.5.61"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",
@@ -739,7 +740,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": "0.201.0-nightly-20261005153421",
+    "@agent-native/core-corpus": ">=0.196.0",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",

package/src/templates/chat/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)
 

package/src/templates/chat/.agents/skills/storing-data/SKILL.md

@@ -75,10 +75,11 @@ state their PostgreSQL types directly.
 
 Member offboarding and email changes refuse to run while any column named
 `email`, `*_email`, `*scope_id`, `created_by`, `updated_by`, `invited_by`,
-`owner`, `principal_id`, `session_id`, or `user_id` has no policy. `owner_email`
-and `createSharesTable()` tables are handled for you. Declare every other one,
-including columns that are not member identities, from the app's database
-plugin graph (Clips does it in `server/db/index.ts`):
+`owner`, `principal_id`, `session_id`, or `user_id` has no policy.
+`createSharesTable()` tables are handled for you, and undeclared `owner_email`
+columns transfer to the successor, which is right only for owned content.
+Declare every other one, including columns that are not member identities, from
+the app's database plugin graph (Clips does it in `server/db/index.ts`):
 
 ```ts
 import { registerIdentityColumns } from "@agent-native/core/org";
@@ -88,13 +89,17 @@ registerIdentityColumns([
   { table: "space_members", column: "email", emailChange: "rekey", offboard: "delete", orgScope: { column: "space_id", references: { table: "spaces", column: "id", orgColumn: "org_id" } }, reason: "Space membership grants access." },
   // Someone else's address: never rewritten.
   { table: "meeting_participants", column: "email", emailChange: "retain", offboard: "retain", reason: "Attendee address from the calendar provider." },
+  // A credential in an owner_email table: never handed to the successor.
+  { table: "api_keys", column: "owner_email", emailChange: "rekey", offboard: "revoke", reason: "Bearer keys act as their owner." },
 ]);
 ```
 
-Choose `delete` for grants, credentials, and pending tokens; `retain` for
+Choose `delete` for grants, credentials, and pending tokens, or `revoke` (sets
+`revoked_at`) when a reader treats a missing row as "not revoked"; `retain` for
 attribution, history, and third-party addresses; `transfer` only for owned
-data. A table without `org_id` needs `orgScope` or an organization-scoped
-removal leaves its rows alone.
+data. Declare `owner_email` tables that hold credentials or grants, or
+offboarding hands them to the successor. A table without `org_id` needs
+`orgScope` or an organization-scoped removal leaves its rows alone.
 
 | Template     | Tables                                        |
 | ------------ | --------------------------------------------- |

package/src/templates/chat/README.md

@@ -5,7 +5,7 @@ the center, durable threads, standard app navigation, auth, live sync, and
 actions. Start here when you want a real browser app to build on without
 committing to a domain template.
 
-**Live app: [chat.agent-native.com](https://chat.agent-native.com)**
+**Live app: [chat.agent-native.com](https://chat.agent-native.com?utm_source=github&utm_medium=referral&utm_content=chat-readme)**
 
 Chat is the basic agent-native app starting point. It gives you the app-agent
 loop wired end to end and one example action, so you can add your own UI, data,
@@ -30,4 +30,4 @@ pnpm install
 pnpm dev
 ```
 
-Full docs: [agent-native.com/docs/template-chat](https://agent-native.com/docs/template-chat).
+Full docs: [agent-native.com/docs/template-chat](https://agent-native.com/docs/template-chat?utm_source=github&utm_medium=referral&utm_content=chat-readme).

package/src/templates/default/.agents/skills/security/SKILL.md

@@ -290,9 +290,16 @@ export default defineEventHandler(async (event) => {
 
 ## Data Scoping
 
-In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views. This is enforced at the SQL level — the agent cannot bypass it.
+In production, the framework automatically restricts all agent SQL queries to the current user's data using temporary views, and checks every statement before it runs so it can only reach those views.
 
-The `db-query` / `db-exec` tools (and the extension SQL bridge, which shares the same path) reject schema-qualified table references like `public.<table>` — a qualified name resolves to the base table and would skip the temp view. Use bare table names; scoping is applied automatically.
+The `db-query` / `db-exec` / `db-patch` tools (and the extension SQL bridge, which shares the same path) read each statement the way Postgres does and refuse anything that could reach data around the temp views:
+
+- schema- or database-qualified names like `public.<table>`, which resolve to the base table;
+- names that resolve to anything other than the current user's temp views, such as materialized views or tables the scoping does not cover;
+- app-defined SQL or PL/pgSQL functions and operators, whose bodies read tables without the views;
+- built-ins that run SQL text, change session settings, or reach outside the database (`query_to_xml`, `set_config`, `dblink`, most `pg_*` functions).
+
+`db-query` runs in a read-only transaction, and an `INSERT` must list its columns when the table has access-control columns. Use bare table names and plain expressions; scoping is applied automatically. When the agent needs data the views do not expose, add an app action with its own access checks.
 
 ### Per-User Scoping (`owner_email`)