@agent-native/core 0.227.0-nightly-20261110032437 → 0.227.0

package/docs/content/agent-web-surfaces.mdx

@@ -17,7 +17,7 @@ The docs site is the reference implementation. Today it ships:
 - JSON-LD for base organization, website, and page metadata.
 - An audit CLI (`npx @agent-native/core@latest audit-agent-web`) that checks all of the above.
 
-Setting `publicMcp: true` additionally exposes opted-in actions as a public MCP endpoint, allowing external agents to call them directly (see [MCP Protocol](/docs/mcp-protocol)).
+Publishing these files never exposes an action. An action reaches external agents only through its own `publicAgent` opt-in; see [Expose to public agents](/docs/actions-access-control#public-agent).
 
 <Diagram id="doc-block-1guzidr" title="What a public route publishes" summary={"A public route fans out into agent-friendly representations. Reading the route is separate from calling tools — tool access stays opt-in."}>
 
@@ -25,7 +25,7 @@ Setting `publicMcp: true` additionally exposes opted-in actions as a public MCP
 <div class="diagram-web">
   <div class="diagram-box" data-rough>
     Public route<br /><small class="diagram-muted"
-      >derived from route access settings</small
+      >from the page list you pass</small
     >
   </div>
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
@@ -40,9 +40,7 @@ Setting `publicMcp: true` additionally exposes opted-in actions as a public MCP
   <div class="diagram-arrow diagram-muted" aria-hidden="true">&rarr;</div>
   <div class="diagram-col gate">
     <span class="diagram-pill warn">Tools stay private</span
-    ><small class="diagram-muted"
-      >publicMcp + publicAgent.expose required</small
-    >
+    ><small class="diagram-muted">publicAgent.expose required</small>
   </div>
 </div>
 ```
@@ -75,45 +73,57 @@ Setting `publicMcp: true` additionally exposes opted-in actions as a public MCP
 
 ## Configuration {#config}
 
-Add `agentWeb` under the existing workspace app config (in your app's `package.json` under the `agent-native` key — or equivalently `workspace.agentWeb`, `agentWeb`, or `root.agentWeb`). The public route list is still derived from the app's route access settings; `agentWeb` controls how that public surface is represented to agents.
-
-```json
-{
-  "agent-native": {
-    "workspaceApp": {
-      "audience": "public",
-      "protectedPaths": ["/admin/*"],
-      "agentWeb": {
-        "discoverable": true,
-        "markdownTwins": true,
-        "llmsTxt": true,
-        "jsonLd": true,
-        "publicAgentCard": true,
-        "publicMcp": false,
-        "crawlerPolicy": "discoverable-no-training",
-        "crawlers": {
-          "training": "disallow",
-          "search": "allow",
-          "userTriggered": "allow",
-          "codingAgents": "allow",
-          "autonomousAgents": "allow"
-        }
-      }
-    }
-  }
-}
+`createAgentWebVitePlugin` from `@agent-native/core/vite` writes these files during a production build. Add it to your Vite config with the pages agents should read:
+
+```ts
+// vite.config.ts
+import { defineConfig } from "vite";
+import { createAgentWebVitePlugin } from "@agent-native/core/vite";
+
+export default defineConfig({
+  plugins: [
+    // ...your existing plugins
+    createAgentWebVitePlugin({
+      siteName: "My Agent-Native App",
+      siteUrl: "https://example.com",
+      pages: [
+        {
+          path: "/pricing",
+          title: "Pricing",
+          description: "Plans and limits.",
+          markdown: "Plans and limits.\n",
+        },
+      ],
+      agentWeb: { crawlerPolicy: "discoverable-no-training" },
+    }),
+  ],
+});
 ```
 
-For most apps, leave the defaults alone. If an app has any public route, `discoverable` defaults on. The default crawler policy is "discoverable, not trainable": search, user-triggered retrieval, coding agents, and autonomous browsing agents are allowed; training crawlers are disallowed.
+The plugin publishes the pages you list and nothing else. It doesn't read your route access settings, and it doesn't read `agentWeb` from `package.json` unless you pass it in. To keep the settings in `package.json` under `agent-native.workspaceApp.agentWeb`, pass `agentWeb: agentWebConfigFromPackageJson(pkg)`, imported from `@agent-native/core/agent-web`.
+
+| Option          | Default                      | What it does                                                                                                                                           |
+| --------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `discoverable`  | On when `pages` isn't empty  | `false` writes no files.                                                                                                                               |
+| `llmsTxt`       | `true`                       | Writes `/llms.txt` and `/llms-full.txt`.                                                                                                               |
+| `markdownTwins` | `true`                       | Writes a `.md` copy of each page that has `markdown`.                                                                                                  |
+| `crawlerPolicy` | `"discoverable-no-training"` | Sets the `robots.txt` rules: `"discoverable-no-training"`, `"allow-all"`, or `"disallow-all"`.                                                         |
+| `crawlers`      | None                         | Overrides individual crawler categories: `training`, `search`, `userTriggered`, `codingAgents`, or `autonomousAgents`, each `"allow"` or `"disallow"`. |
+
+The default crawler policy is "discoverable, not trainable": search, user-triggered retrieval, coding agents, and autonomous browsing agents are allowed; training crawlers are disallowed.
+
+`jsonLd`, `publicAgentCard`, and `publicMcp` are accepted, but nothing reads them yet. For JSON-LD, render `buildBaseJsonLd` and `buildPageJsonLd` from `@agent-native/core/agent-web` into your pages yourself.
 
 ## Route source of truth {#route-source}
 
-Agent Web discovery follows the route access model:
+The page list is the source of truth: agents get the pages you pass, and only those. Build it from pages that are already public:
+
+- In a public app, every route except `protectedPaths`.
+- In an internal app, only `publicPaths`.
+- Public share and form pages that agents should be able to read.
+- Never submitted private data, authenticated dashboards, or user or org state, even when a nearby page is public.
 
-- Public apps expose every route except `protectedPaths`.
-- Internal apps expose only `publicPaths`.
-- Public share and form pages can be readable by agents.
-- Submitted private data, authenticated dashboards, and user/org state are never included just because a nearby page is public.
+To start from your access settings, `deriveAgentWebPublicRoutes` from `@agent-native/core/agent-web` takes your app's `audience`, `publicPaths`, `protectedPaths`, and `routes`, and returns the routes those settings make public. Each page still needs its own title and Markdown.
 
 This keeps mixed apps natural. A forms app can expose a public form page and keep submissions private. A content app can expose published posts and keep the editor private. A docs site can expose everything except admin tools.
 
@@ -123,7 +133,7 @@ Public page access and public tool access are separate. A route being public onl
 
 <Callout id="doc-block-s50w8y" tone="warning">
 
-**A public page is not a public tool.** Making a route crawlable never exposes an action. Tool access requires an explicit `publicAgent.expose` opt-in on the action _and_ `publicMcp: true` on the app.
+**A public page is not a public tool.** Making a route crawlable never exposes an action. Tool access requires an explicit `publicAgent.expose` opt-in on the action.
 
 </Callout>
 
@@ -151,7 +161,7 @@ To expose an action through a public agent protocol, the action must opt in:
   ]}
 />
 
-`agentWeb.publicMcp` stays `false` by default. When public MCP is enabled, the server should expose only actions with `publicAgent.expose === true`, and should still exclude consequential or write actions unless the action and auth policy explicitly allow them.
+No `agentWeb` setting exposes an action, and `publicMcp` has no effect today. See [Expose to public agents](/docs/actions-access-control#public-agent) for what `publicAgent` opts an action into and the checks that still apply.
 
 ## Build-time files {#build-time}
 
@@ -186,7 +196,9 @@ const files = buildAgentWebStaticFiles({
 });
 ```
 
-Vite apps can use `createAgentWebVitePlugin` from `@agent-native/core/vite` to write those files into `public`, `dist`, `dist/client`, `dist/server/public`, or `build/client` during production builds.
+`createAgentWebVitePlugin` calls `buildAgentWebStaticFiles` for you and writes the files into whichever of `public`, `dist`, `dist/client`, `dist/server/public`, and `build/client` exist. With another build tool, call the utilities directly.
+
+Neither one answers `Accept: text/markdown` on a page's own URL: the Markdown copy is only at its `.md` URL. To answer that header, add a server route that returns the page's Markdown with the headers from `buildMarkdownResponseHeaders`, as the docs site does. Without that route, the audit below fails its `Accept: text/markdown` check.
 
 Pass `sitemapGroup` to `buildAgentWebStaticFiles` or `createAgentWebVitePlugin` to split a large sitemap. It maps each page to a group key, such as its locale, and `sitemap.xml` becomes a sitemap index with one `sitemap-<group>.xml` per group.
 
@@ -215,5 +227,5 @@ The audit exits non-zero if a required public surface is missing.
 ## What's next
 
 - [**Actions**](/docs/actions-overview) — how to opt actions into the public agent protocol
-- [**MCP Protocol**](/docs/mcp-protocol) — the MCP surface that `publicMcp: true` enables
+- [**MCP Protocol**](/docs/mcp-protocol) — the MCP server external agents connect to
 - [**Deployment**](/docs/deployment) — where these static files are written during builds

package/docs/content/authentication.mdx

@@ -537,6 +537,20 @@ The default `/_agent-native/google/auth-url` route does this automatically — o
 | `ACCESS_TOKENS`                         | Comma-separated static bearer fallbacks for MCP/connect clients; not browser auth                                                                      |
 | `A2A_SECRET`                            | Shared secret for JWT-signed A2A cross-app identity verification and, when present, MCP OAuth access-token signing                                     |
 
+## Auth page customization
+
+The Chat template sets `marketing: false` in `server/plugins/auth.ts`. Replace it with a marketing object to enable the panel. It appears below the form on mobile. `AuthMarketingProps` describes the rendered page props, while the plugin accepts the `marketing` fields shown below. `authHeadHtml` appends trusted app-authored HTML after the built-in styles. Do not pass user input to it.
+
+```ts filename="server/plugins/auth.ts"
+import { createToolkitAuthPlugin } from "@agent-native/toolkit/app/auth/server";
+
+export default createToolkitAuthPlugin({
+  rootAuth: true,
+  marketing: { appName: "My app", tagline: "Make work easier" },
+  authHeadHtml: "<style>.auth-root { font-family: sans-serif; }</style>",
+});
+```
+
 ## What's next
 
 - [**Organizations, Teams & Permissions**](/docs/organizations-teams-permissions) — the org-role vs. resource-role RBAC model, and a practical multi-user setup sequence

package/docs/content/client-agent-chat.mdx

@@ -202,6 +202,8 @@ sendToAgentChat({
 });
 ```
 
+`sendToAgentChat()` returns a tab ID, not a delivery receipt. For a local submitted message that must be acknowledged, use `sendToAgentChatAndConfirm({ message, chatTarget: "local" })` and handle `delivered: false` and its `reason`. It waits for the local chat to acknowledge submission and cancels a timed-out submission. This helper does not support draft-only or code-target requests.
+
 ### AgentChatMessage {#agentchatmessage}
 
 | Option         | Type       | Description                                                                                     |

package/docs/content/client-routing.mdx

@@ -53,6 +53,8 @@ This page covers client routes, the pages rendered in the browser from `app/rout
 
 </Diagram>
 
+In Chat, `rootAuth: true` can serve the sign-in page at `/` before React Router reaches `_index.tsx`, depending on the configured home path. Change the auth plugin when customizing that response.
+
 ## File-based routing {#file-based-routing}
 
 ### File → URL mapping

package/docs/content/create-with-an-agent.mdx

@@ -34,7 +34,7 @@ it. Use that name wherever a step below says APP_NAME.
     --standalone --template chat
 3. In the new APP_NAME folder, run `pnpm install`.
 4. Read APP_NAME/AGENTS.md so you know how the app is laid out.
-5. Start the app with `pnpm dev` and keep it running in the background.
+5. Start the app with `pnpm dev --no-open` and keep it running in the background.
 6. Read the local URL that `pnpm dev` prints. Check that it responds,
    for example with `curl -I <url>`. Do not open a browser and do not
    use headless browser tools. I will open the app myself.

package/docs/content/environment-variables.mdx

@@ -28,6 +28,8 @@ typed/JSON config and also becomes part of the public browser bundle. Do not
 create another standalone Vite-prefixed or Agent-Native-prefixed variable for
 a public setting already represented by the config guide.
 
+To select OpenRouter explicitly, set `AGENT_ENGINE=ai-sdk:openrouter` and configure its credential through a [workspace connection](/docs/workspace-connections). Model IDs use the provider/model form.
+
 ## Start with Agent-Native app configuration
 
 The typed config is the primary documentation and default source for public

package/docs/content/extensions.mdx

@@ -506,18 +506,17 @@ The gallery above describes _what_ an extension does. Slots describe _where_ it
 
 By default, an extension lives on its own page in the Extensions list — open it like a small app. That's fine for dashboards, calculators, and standalone widgets.
 
-But the most QBO-shaped use case is different: the user wants their widget pinned _inside_ the template's UI — under the contact info in Mail's sidebar, in the corner of an Analytics dashboard, on the right side of a Calendar event. That's what **slots** are for.
+Named slots exist where the host app renders `<ExtensionSlot>` and supplies its current-page context. Slot targets and installs connect extensions to those existing locations. They do not create a panel, tab, or route.
 
-A slot is a named widget area a template ships:
+A slot is a named widget area the host app places in its UI:
 
-| Template      | Example slot                   | Where it shows up                            |
-| ------------- | ------------------------------ | -------------------------------------------- |
-| **Mail**      | `mail.contact-sidebar.bottom`  | Below the contact info on every email thread |
-| **Analytics** | `analytics.dashboard.tiles`    | Alongside the dashboard's built-in panels    |
-| **Calendar**  | `calendar.event-detail.bottom` | Below the open event                         |
-| **Clips**     | `clips.right-panel.tabs`       | A new tab in the clip review panel           |
+| Template     | Example slot                   | Where it shows up                            |
+| ------------ | ------------------------------ | -------------------------------------------- |
+| **Mail**     | `mail.contact-sidebar.bottom`  | Below the contact info on every email thread |
+| **Calendar** | `calendar.event-detail.bottom` | Below the open event                         |
+| **Content**  | `content.sidebar.bottom`       | At the bottom of the document sidebar        |
 
-When an extension is **installed into a slot**, the host pushes the relevant context — the contact's email, the dashboard id, the event id — into the iframe. The extension reads `window.slotContext` to know what the user is looking at.
+When an extension is **installed into a slot**, the host pushes its chosen context, such as a contact email, event id, or document id, into the iframe. The extension reads `window.slotContext` to know what the user is looking at.
 
 <Diagram id="doc-block-18p3btl" title="Slots push context into the widget" summary={"The host template owns named slots; installing an extension into one feeds it window.slotContext for whatever the user is currently viewing."}>
 

package/docs/content/external-agents.mdx

@@ -166,6 +166,14 @@ invalid document ID. Verify the link and connected account's access before
 changing permissions. Reinstalling the connector or changing the public share
 link does not resolve a confirmed account permission denial.
 
+Images uploaded into a private document are stored in its body as
+`/api/private-media/<id>` links, which load only with a Content sign-in.
+When an agent reads the document over MCP, `get-document`, and `pull-document`
+in Markdown, also return `privateMediaLinks`: each stored link paired with a
+URL that opens that one image without signing in, for one hour. One read links
+at most 200 images; `omitted` counts the rest. Read the document again for
+fresh links. Keep the stored links when editing the body.
+
 <a id="access-tab"></a>
 
 ### The in-app MCP setting {#mcp-settings}

package/docs/content/upgrading-core-ui.mdx

@@ -11,6 +11,8 @@ before starting, and check remote deployment settings separately: the CLI can
 read local environment files, but it cannot inspect remote environments or
 database-backed feature settings.
 
+Desktop GitHub releases use their own `v` tags. They do not identify the published `@agent-native/core` npm version. Run `npm view @agent-native/core version` for the latest published Core version and `npm ls @agent-native/core` for the installed version.
+
 ## 1. Preview the upgrade and import codemods
 
 Use the CLI shipped with Core 0.198.0 so it loads that release's migration

package/docs/content/vercel.mdx

@@ -23,6 +23,8 @@ Node.js `22.22+` is required.
 You also need a Vercel account. Run the commands in this guide on your own
 computer. The Vercel CLI uploads the finished build to Vercel for you.
 
+Agent turns are subject to Vercel Function duration limits, including streamed response time. Configure the project’s Function Max Duration and check the effective deployment settings and [Vercel limits](https://vercel.com/docs/functions/configuring-functions/duration). A longer limit does not guarantee a turn completes.
+
 ## Step 1: Create the app
 
 Create your new standalone app. The example below creates an app from the Chat

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.227.0-nightly-20261110032437",
+  "version": "0.227.0",
   "description": "The agentic application framework for building autonomous agents with intuitive UIs",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -769,8 +769,8 @@
     "yaml": "^2.9.0",
     "yjs": "^13.6.33",
     "zod": "^4.3.6",
-    "@agent-native/agentkit": "^0.227.0-nightly-20261110032437",
-    "@agent-native/recap-cli": "^0.5.99"
+    "@agent-native/agentkit": "^0.227.0",
+    "@agent-native/recap-cli": "^0.5.100"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",
@@ -843,7 +843,7 @@
     "xlsx": "^0.18.5"
   },
   "peerDependencies": {
-    "@agent-native/core-corpus": "0.227.0-nightly-20261110032437",
+    "@agent-native/core-corpus": ">=0.196.0",
     "@ai-sdk/anthropic": ">=3",
     "@ai-sdk/cohere": ">=3",
     "@ai-sdk/google": ">=3",

package/src/templates/builder-code-starter/AGENTS.md.patch

@@ -41,7 +41,7 @@
 -Choose the primary workflow and route before editing. Add a domain route under `app/routes/` and set `app.homePath` in `server/plugins/agent-native-email-branding.ts` with `defineAppConfig`. The default Get started page lives at `/home`, and Chat stays at `/chat`; edit `app/routes/home.tsx` when replacing that page with a domain-specific home. Add a static link in `app/components/layout/Sidebar.tsx` before `ChatThreadsSection`; `Header.tsx` uses `APP_TITLE` elsewhere. Shared sidebar and AgentInspector remain.
 +Choose the primary workflow and route before editing. Build on the blank canvas in `app/routes/_index.tsx` or add domain routes under `app/routes/`. This starter has no Chat route, sidebar, header, or agent rail; add only the navigation the product needs. Set `app.homePath` in the existing `defineAppConfig` in `server/plugins/config.ts` as `DEVELOPING.md` describes.
  
--Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here; do not rewrite `README.md` or `DESIGN.md`. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow, including overlap rejection, cancellation freeing the slot, and authenticated landing. Skip production build and extra test suites.
+-Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here; do not rewrite `README.md` or `DESIGN.md`. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow and its authenticated landing. Skip production build and extra test suites.
 +Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here and update `README.md` as `DEVELOPING.md` describes. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow and its authenticated landing. Skip production build and extra test suites.
  
  Before building common workspace or agent UI, read `agent-native-toolkit`; for supported customization, read `customizing-agent-native`.

package/src/templates/builder-code-starter/server/plugins/auth.ts.patch

@@ -1,13 +1,14 @@
 ===================================================================
 --- a/server/plugins/auth.ts
 +++ b/server/plugins/auth.ts
-@@ -1,7 +1,8 @@
+@@ -1,8 +1,8 @@
 -import { createToolkitAuthPlugin } from "@agent-native/toolkit/app/auth/server";
 +import { createAuthPlugin } from "@agent-native/core/server";
  
 -export default createToolkitAuthPlugin({
 -  workspaceAppPublicPaths: ["/"],
 -  rootAuth: true,
+-  // Remove this option to use built-in marketing, or supply an object for custom copy.
 -  marketing: false,
 +// Email/password auth with optional Google OAuth (enabled automatically when
 +// GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET are set). No marketing copy — a

package/src/templates/chat/AGENTS.md

@@ -26,6 +26,6 @@ For custom branding, keep `server/plugins/agent-native-email-branding.ts` aligne
 
 Choose the primary workflow and route before editing. Add a domain route under `app/routes/` and set `app.homePath` in `server/plugins/agent-native-email-branding.ts` with `defineAppConfig`. The default Get started page lives at `/home`, and Chat stays at `/chat`; edit `app/routes/home.tsx` when replacing that page with a domain-specific home. Add a static link in `app/components/layout/Sidebar.tsx` before `ChatThreadsSection`; `Header.tsx` uses `APP_TITLE` elsewhere. Shared sidebar and AgentInspector remain.
 
-Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here; do not rewrite `README.md` or `DESIGN.md`. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow, including overlap rejection, cancellation freeing the slot, and authenticated landing. Skip production build and extra test suites.
+Use `adding-a-feature` for functional parity and `frontend-design` for a user-facing screen. Keep feature guidance here; do not rewrite `README.md` or `DESIGN.md`. After all edits, run one typecheck, one doctor check, and one browser smoke of the primary workflow and its authenticated landing. Skip production build and extra test suites.
 
 Before building common workspace or agent UI, read `agent-native-toolkit`; for supported customization, read `customizing-agent-native`.

package/src/templates/chat/app/components/layout/Sidebar.tsx

@@ -403,7 +403,7 @@ export function Sidebar({
       <nav
         aria-label={t("navigation.navigation")}
         className={cn(
-          "flex min-h-0 flex-1 flex-col",
+          "flex min-h-0 flex-1 flex-col overflow-y-auto",
           collapsed ? "items-center gap-1 px-1 py-2" : "pt-1",
         )}
       >

package/src/templates/chat/scripts/migrate-production.ts

@@ -9,7 +9,7 @@ loadEnv();
 
 async function main(): Promise<void> {
   await withMigrationRuntime(async () => {
-    await runFrameworkReleaseMigrations(null);
+    await runFrameworkReleaseMigrations(null, { requirePostgres: true });
     await runAppReleaseMigrations();
   });
 }

package/src/templates/chat/server/plugins/auth.ts

@@ -3,5 +3,6 @@ import { createToolkitAuthPlugin } from "@agent-native/toolkit/app/auth/server";
 export default createToolkitAuthPlugin({
   workspaceAppPublicPaths: ["/"],
   rootAuth: true,
+  // Remove this option to use built-in marketing, or supply an object for custom copy.
   marketing: false,
 });

package/src/templates/default/pnpm-workspace.yaml

@@ -2,47 +2,6 @@ overrides:
   "@assistant-ui/store": ">=0.2.9 <0.2.14"
   "@assistant-ui/tap": "^0.5.14"
   nf3: "0.3.17"
-  "@tiptap/core": "3.28.0"
-  "@tiptap/extension-blockquote": "3.28.0"
-  "@tiptap/extension-bold": "3.28.0"
-  "@tiptap/extension-bubble-menu": "3.28.0"
-  "@tiptap/extension-bullet-list": "3.28.0"
-  "@tiptap/extension-code": "3.28.0"
-  "@tiptap/extension-code-block": "3.28.0"
-  "@tiptap/extension-code-block-lowlight": "3.28.0"
-  "@tiptap/extension-collaboration": "3.28.0"
-  "@tiptap/extension-collaboration-caret": "3.28.0"
-  "@tiptap/extension-color": "3.28.0"
-  "@tiptap/extension-document": "3.28.0"
-  "@tiptap/extension-dropcursor": "3.28.0"
-  "@tiptap/extension-floating-menu": "3.28.0"
-  "@tiptap/extension-gapcursor": "3.28.0"
-  "@tiptap/extension-hard-break": "3.28.0"
-  "@tiptap/extension-heading": "3.28.0"
-  "@tiptap/extension-horizontal-rule": "3.28.0"
-  "@tiptap/extension-image": "3.28.0"
-  "@tiptap/extension-italic": "3.28.0"
-  "@tiptap/extension-link": "3.28.0"
-  "@tiptap/extension-list": "3.28.0"
-  "@tiptap/extension-list-item": "3.28.0"
-  "@tiptap/extension-list-keymap": "3.28.0"
-  "@tiptap/extension-ordered-list": "3.28.0"
-  "@tiptap/extension-paragraph": "3.28.0"
-  "@tiptap/extension-placeholder": "3.28.0"
-  "@tiptap/extension-strike": "3.28.0"
-  "@tiptap/extension-table": "3.28.0"
-  "@tiptap/extension-table-cell": "3.28.0"
-  "@tiptap/extension-table-header": "3.28.0"
-  "@tiptap/extension-table-row": "3.28.0"
-  "@tiptap/extension-task-item": "3.28.0"
-  "@tiptap/extension-task-list": "3.28.0"
-  "@tiptap/extension-text": "3.28.0"
-  "@tiptap/extension-text-style": "3.28.0"
-  "@tiptap/extension-underline": "3.28.0"
-  "@tiptap/extensions": "3.28.0"
-  "@tiptap/pm": "3.28.0"
-  "@tiptap/react": "3.28.0"
-  "@tiptap/starter-kit": "3.28.0"
 
 allowBuilds:
   esbuild: true

package/src/templates/default/scripts/migrate-production.ts

@@ -9,7 +9,7 @@ loadEnv();
 
 async function main(): Promise<void> {
   await withMigrationRuntime(async () => {
-    await runFrameworkReleaseMigrations(null);
+    await runFrameworkReleaseMigrations(null, { requirePostgres: true });
     await runAppReleaseMigrations();
   });
 }

package/src/templates/workspace-root/pnpm-workspace.yaml

@@ -27,47 +27,6 @@ overrides:
   esbuild: "^0.28.1"
   srvx: "^0.12.4"
   zod: "^4.4.3"
-  "@tiptap/core": "3.28.0"
-  "@tiptap/extension-blockquote": "3.28.0"
-  "@tiptap/extension-bold": "3.28.0"
-  "@tiptap/extension-bubble-menu": "3.28.0"
-  "@tiptap/extension-bullet-list": "3.28.0"
-  "@tiptap/extension-code": "3.28.0"
-  "@tiptap/extension-code-block": "3.28.0"
-  "@tiptap/extension-code-block-lowlight": "3.28.0"
-  "@tiptap/extension-collaboration": "3.28.0"
-  "@tiptap/extension-collaboration-caret": "3.28.0"
-  "@tiptap/extension-color": "3.28.0"
-  "@tiptap/extension-document": "3.28.0"
-  "@tiptap/extension-dropcursor": "3.28.0"
-  "@tiptap/extension-floating-menu": "3.28.0"
-  "@tiptap/extension-gapcursor": "3.28.0"
-  "@tiptap/extension-hard-break": "3.28.0"
-  "@tiptap/extension-heading": "3.28.0"
-  "@tiptap/extension-horizontal-rule": "3.28.0"
-  "@tiptap/extension-image": "3.28.0"
-  "@tiptap/extension-italic": "3.28.0"
-  "@tiptap/extension-link": "3.28.0"
-  "@tiptap/extension-list": "3.28.0"
-  "@tiptap/extension-list-item": "3.28.0"
-  "@tiptap/extension-list-keymap": "3.28.0"
-  "@tiptap/extension-ordered-list": "3.28.0"
-  "@tiptap/extension-paragraph": "3.28.0"
-  "@tiptap/extension-placeholder": "3.28.0"
-  "@tiptap/extension-strike": "3.28.0"
-  "@tiptap/extension-table": "3.28.0"
-  "@tiptap/extension-table-cell": "3.28.0"
-  "@tiptap/extension-table-header": "3.28.0"
-  "@tiptap/extension-table-row": "3.28.0"
-  "@tiptap/extension-task-item": "3.28.0"
-  "@tiptap/extension-task-list": "3.28.0"
-  "@tiptap/extension-text": "3.28.0"
-  "@tiptap/extension-text-style": "3.28.0"
-  "@tiptap/extension-underline": "3.28.0"
-  "@tiptap/extensions": "3.28.0"
-  "@tiptap/pm": "3.28.0"
-  "@tiptap/react": "3.28.0"
-  "@tiptap/starter-kit": "3.28.0"
 
 packageExtensions:
   "node-pty@*":