@nitrostack/cli 1.0.14 → 1.0.16

package/dist/pack/zipper.js

@@ -0,0 +1,121 @@
+import path from 'path';
+import fs from 'fs';
+import { createWriteStream } from 'fs';
+import archiver from 'archiver';
+import { isPathIgnored } from './gitignore.js';
+/** True when realPath is the root or a descendant of rootReal. */
+function isInsideRoot(realPath, rootReal) {
+    const relative = path.relative(rootReal, realPath);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+/**
+ * Collect relative file paths that should be included, and pruned excluded roots.
+ * Excluded directories are recorded once and not descended into.
+ * Symlinks are resolved via stat/realpath so:
+ * - symlink-to-directory is walked (not archived as a file)
+ * - cycles and targets outside the project root are skipped
+ */
+export async function collectFilesToPack(projectRoot, matcher) {
+    const includedPaths = [];
+    const excludedPaths = [];
+    const visitedDirs = new Set();
+    let projectRootReal;
+    try {
+        projectRootReal = await fs.promises.realpath(projectRoot);
+    }
+    catch {
+        projectRootReal = path.resolve(projectRoot);
+    }
+    async function walk(currentDir) {
+        let currentReal;
+        try {
+            currentReal = await fs.promises.realpath(currentDir);
+        }
+        catch {
+            return;
+        }
+        if (visitedDirs.has(currentReal)) {
+            return;
+        }
+        if (!isInsideRoot(currentReal, projectRootReal)) {
+            return;
+        }
+        visitedDirs.add(currentReal);
+        let entries;
+        try {
+            entries = await fs.promises.readdir(currentDir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            const absolutePath = path.join(currentDir, entry.name);
+            const relativePath = path.relative(projectRoot, absolutePath).split(path.sep).join('/');
+            let isDirectory = entry.isDirectory();
+            let isFile = entry.isFile();
+            if (entry.isSymbolicLink()) {
+                try {
+                    const realTarget = await fs.promises.realpath(absolutePath);
+                    if (!isInsideRoot(realTarget, projectRootReal)) {
+                        // Symlink escapes the project — skip
+                        continue;
+                    }
+                    const stats = await fs.promises.stat(absolutePath);
+                    isDirectory = stats.isDirectory();
+                    isFile = stats.isFile();
+                }
+                catch {
+                    // Broken symlink — skip
+                    continue;
+                }
+            }
+            if (isPathIgnored(matcher, projectRoot, absolutePath, isDirectory)) {
+                const displayPath = isDirectory ? `${relativePath}/` : relativePath;
+                excludedPaths.push(displayPath);
+                continue;
+            }
+            if (isDirectory) {
+                await walk(absolutePath);
+                continue;
+            }
+            if (isFile) {
+                includedPaths.push(relativePath);
+            }
+        }
+    }
+    await walk(projectRoot);
+    includedPaths.sort();
+    excludedPaths.sort();
+    return {
+        filesIncluded: includedPaths.length,
+        includedPaths,
+        excludedPaths,
+    };
+}
+/**
+ * Create an optimized zip archive from the project directory.
+ */
+export async function createOptimizedZip(projectRoot, outputPath, matcher) {
+    const collection = await collectFilesToPack(projectRoot, matcher);
+    const outputDir = path.dirname(outputPath);
+    await fs.promises.mkdir(outputDir, { recursive: true });
+    await new Promise((resolve, reject) => {
+        const output = createWriteStream(outputPath);
+        const archive = archiver('zip', { zlib: { level: 9 } });
+        output.on('close', () => resolve());
+        output.on('error', reject);
+        archive.on('error', reject);
+        archive.pipe(output);
+        for (const relativePath of collection.includedPaths) {
+            const absolutePath = path.join(projectRoot, relativePath);
+            archive.file(absolutePath, { name: relativePath });
+        }
+        void archive.finalize();
+    });
+    return collection;
+}
+export async function getZipSizeBytes(outputPath) {
+    const stats = await fs.promises.stat(outputPath);
+    return stats.size;
+}

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@nitrostack/cli",
-  "version": "1.0.14",
+  "version": "1.0.16",
   "description": "CLI for NitroStack - Create and manage MCP server projects",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
     "nitrostack-cli": "dist/index.js",
-    "@nitrostack/cli": "dist/index.js"
+    "@nitrostack/cli": "dist/index.js",
+    "nitrostack-pack": "dist/pack/standalone.js"
   },
   "exports": {
     ".": {
@@ -23,7 +24,7 @@
     "assets"
   ],
   "scripts": {
-    "build": "tsc && chmod +x dist/index.js",
+    "build": "tsc && chmod +x dist/index.js dist/pack/standalone.js",
     "dev": "tsc --watch",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "test:coverage": "NODE_OPTIONS=--experimental-vm-modules jest --coverage",
@@ -40,6 +41,7 @@
   "author": "Nitrostack Inc <hello@nitrostack.ai>",
   "license": "Apache-2.0",
   "dependencies": {
+    "archiver": "^7.0.1",
     "chalk": "^5.3.0",
     "chokidar": "^3.6.0",
     "commander": "^12.1.0",
@@ -51,6 +53,7 @@
     "posthog-node": "^5.21.2"
   },
   "devDependencies": {
+    "@types/archiver": "^6.0.3",
     "@types/fs-extra": "^11.0.4",
     "@types/inquirer": "^9.0.9",
     "@types/jest": "^29.5.14",

package/templates/typescript-oauth/.env.example

@@ -1,6 +1,6 @@
 # NitroStack Configuration
 NITRO_LOG_LEVEL=info
-NITROSTACK_APP_MODE=openai
+NITROSTACK_APP_MODE=universal
 
 # Server Transport Configuration (Optional)
 # =============================================================================
@@ -12,6 +12,19 @@ NITROSTACK_APP_MODE=openai
 # HOST=localhost
 # ENABLE_CORS=true
 
+# MCP Protocol Version (Optional)
+# =============================================================================
+# NITRO_MCP_PROTOCOL_VERSION selects which MCP wire revision NitroStack speaks.
+# Unset (default) defaults to 'auto' (serves 2026-07-28 stateless with legacy fallback).
+#   - auto       : serve both eras from one process (default).
+#   - 2026-07-28 : the new stateless spec (server/discover, per-request _meta,
+#                  Mcp-Method/Mcp-Name headers, cache hints, MRTR, extensions).
+#   - 2025-06-18 : the legacy 2025 sessionful spec.
+# On 2026, Dynamic Client Registration (below) is deprecated in favor of CIMD.
+# Your @Tool/@Resource/@Prompt/@Widget code is identical either way.
+# =============================================================================
+# NITRO_MCP_PROTOCOL_VERSION=auto
+
 # Streamable HTTP Session Limits (Optional)
 # =============================================================================
 # Bounds memory against unauthenticated initialize floods. Defaults: 1000 sessions,

package/templates/typescript-oauth/README.md

@@ -41,6 +41,26 @@ Use NitroStudio to test auth flows, inspect tool requests, and validate behavior
 - Download: <https://nitrostack.ai/studio>
 - Studio: <https://nitrostack.ai/studio>
 
+## MCP protocol version (optional)
+
+This server runs in **`auto` mode by default**, dynamically serving both the new
+**2026-07-28** stateless spec and legacy 2025 JSON-RPC clients from a single endpoint.
+You can customize the wire revision via environment variable — no code changes are needed:
+
+```bash
+# default (when unset): serve both modern and legacy statelessly
+NITRO_MCP_PROTOCOL_VERSION=auto
+
+# new stateless spec only (strict mode)
+NITRO_MCP_PROTOCOL_VERSION=2026-07-28
+
+# legacy 2025 sessionful wire
+NITRO_MCP_PROTOCOL_VERSION=2025-06-18
+```
+
+On 2026, Dynamic Client Registration is deprecated in favor of Client ID Metadata
+Documents (CIMD). See `.env.example` for details.
+
 ## Links
 
 - Docs: <https://docs.nitrostack.ai>

package/templates/typescript-oauth/_gitignore

@@ -0,0 +1,57 @@
+# Dependencies
+node_modules/
+src/widgets/node_modules/
+
+# Build outputs
+dist/
+src/widgets/.next/
+src/widgets/out/
+
+# Environment files
+.env
+.env.local
+.env.*.local
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Runtime data
+pids/
+*.pid
+*.seed
+*.pid.lock
+
+# Coverage
+coverage/
+.nyc_output/
+
+# Uploads
+uploads/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache
+.npm/
+
+# Optional eslint cache
+.eslintcache
+
+# OAuth tokens/secrets (never commit these!)
+*.pem
+*.key
+tokens.json

package/templates/typescript-pizzaz/.env.example

@@ -1,6 +1,6 @@
 # NitroStack Configuration
 NITRO_LOG_LEVEL=info
-NITROSTACK_APP_MODE=openai
+NITROSTACK_APP_MODE=universal
 
 # Server Transport Configuration (Optional)
 # =============================================================================
@@ -12,6 +12,18 @@ NITROSTACK_APP_MODE=openai
 # HOST=localhost
 # ENABLE_CORS=true
 
+# MCP Protocol Version (Optional)
+# =============================================================================
+# NITRO_MCP_PROTOCOL_VERSION selects which MCP wire revision NitroStack speaks.
+# Unset (default) defaults to 'auto' (serves 2026-07-28 stateless with legacy fallback).
+#   - auto       : serve both eras from one process (default).
+#   - 2026-07-28 : the new stateless spec (server/discover, per-request _meta,
+#                  Mcp-Method/Mcp-Name headers, cache hints, MRTR, extensions).
+#   - 2025-06-18 : the legacy 2025 sessionful spec.
+# Your @Tool/@Resource/@Prompt/@Widget code is identical either way.
+# =============================================================================
+# NITRO_MCP_PROTOCOL_VERSION=auto
+
 # Mapbox Configuration (Optional)
 # =============================================================================
 # The map widget uses Mapbox GL for interactive maps. 

package/templates/typescript-pizzaz/README.md

@@ -39,6 +39,25 @@ NitroStudio is the fastest way to test and debug interactive widget output.
 - Download: <https://nitrostack.ai/studio>
 - Studio: <https://nitrostack.ai/studio>
 
+## MCP protocol version (optional)
+
+This server runs in **`auto` mode by default**, dynamically serving both the new
+**2026-07-28** stateless spec and legacy 2025 JSON-RPC clients from a single endpoint.
+You can customize the wire revision via environment variable — no code changes are needed:
+
+```bash
+# default (when unset): serve both modern and legacy statelessly
+NITRO_MCP_PROTOCOL_VERSION=auto
+
+# new stateless spec only (strict mode)
+NITRO_MCP_PROTOCOL_VERSION=2026-07-28
+
+# legacy 2025 sessionful wire
+NITRO_MCP_PROTOCOL_VERSION=2025-06-18
+```
+
+See `.env.example` for details.
+
 ## Links
 
 - Docs: <https://docs.nitrostack.ai>

package/templates/typescript-pizzaz/_gitignore

@@ -0,0 +1,57 @@
+# Dependencies
+node_modules/
+src/widgets/node_modules/
+
+# Build outputs
+dist/
+src/widgets/.next/
+src/widgets/out/
+
+# Environment files
+.env
+.env.local
+.env.*.local
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Runtime data
+pids/
+*.pid
+*.seed
+*.pid.lock
+
+# Coverage
+coverage/
+.nyc_output/
+
+# Uploads
+uploads/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache
+.npm/
+
+# Optional eslint cache
+.eslintcache
+
+# OAuth tokens/secrets (never commit these!)
+*.pem
+*.key
+tokens.json

package/templates/typescript-starter/.env.example

@@ -1,6 +1,6 @@
 # NitroStack Configuration
 NITRO_LOG_LEVEL=info
-NITROSTACK_APP_MODE=openai
+NITROSTACK_APP_MODE=universal
 
 # Server Transport Configuration (Optional)
 # =============================================================================
@@ -11,3 +11,15 @@ NITROSTACK_APP_MODE=openai
 # PORT=3000
 # HOST=localhost
 # ENABLE_CORS=true
+
+# MCP Protocol Version (Optional)
+# =============================================================================
+# NITRO_MCP_PROTOCOL_VERSION selects which MCP wire revision NitroStack speaks.
+# Unset (default) defaults to 'auto' (serves 2026-07-28 stateless with legacy fallback).
+#   - auto       : serve both eras from one process (default).
+#   - 2026-07-28 : the new stateless spec (server/discover, per-request _meta,
+#                  Mcp-Method/Mcp-Name headers, cache hints, MRTR, extensions).
+#   - 2025-06-18 : the legacy 2025 sessionful spec.
+# Your @Tool/@Resource/@Prompt/@Widget code is identical either way.
+# =============================================================================
+# NITRO_MCP_PROTOCOL_VERSION=auto

package/templates/typescript-starter/README.md

@@ -34,6 +34,25 @@ development.
 - Download: <https://nitrostack.ai/studio>
 - Studio: <https://nitrostack.ai/studio>
 
+## MCP protocol version (optional)
+
+This server runs in **`auto` mode by default**, dynamically serving both the new
+**2026-07-28** stateless spec and legacy 2025 JSON-RPC clients from a single endpoint.
+You can customize the wire revision via environment variable — no code changes are needed:
+
+```bash
+# default (when unset): serve both modern and legacy statelessly
+NITRO_MCP_PROTOCOL_VERSION=auto
+
+# new stateless spec only (strict mode)
+NITRO_MCP_PROTOCOL_VERSION=2026-07-28
+
+# legacy 2025 sessionful wire
+NITRO_MCP_PROTOCOL_VERSION=2025-06-18
+```
+
+See `.env.example` for details.
+
 ## Links
 
 - Docs: <https://docs.nitrostack.ai>

package/templates/typescript-starter/_gitignore

@@ -0,0 +1,57 @@
+# Dependencies
+node_modules/
+src/widgets/node_modules/
+
+# Build outputs
+dist/
+src/widgets/.next/
+src/widgets/out/
+
+# Environment files
+.env
+.env.local
+.env.*.local
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Runtime data
+pids/
+*.pid
+*.seed
+*.pid.lock
+
+# Coverage
+coverage/
+.nyc_output/
+
+# Uploads
+uploads/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache
+.npm/
+
+# Optional eslint cache
+.eslintcache
+
+# OAuth tokens/secrets (never commit these!)
+*.pem
+*.key
+tokens.json