create-objectstack 15.1.1 → 16.0.0-rc.0

package/README.md

@@ -59,7 +59,8 @@ offline.
    (`blank_note` → `my_app_note`).
 2. Installs dependencies (pnpm if available, otherwise npm).
 3. Installs the ObjectStack AI skills bundle for coding agents
-   (`npx skills add objectstack-ai/framework --all`).
+   (`npx skills add objectstack-ai/framework/skills --all` — scoped to the
+   curated `skills/` catalog).
 4. Writes `AGENTS.md` and `.github/copilot-instructions.md` with the project
    conventions — unless the template ships its own.
 

package/dist/index.js

@@ -1,8 +1,8 @@
 // src/index.ts
 import { Command } from "commander";
 import chalk from "chalk";
-import fs from "fs";
-import path from "path";
+import fs2 from "fs";
+import path2 from "path";
 import os from "os";
 import { execSync } from "child_process";
 import { fileURLToPath } from "url";
@@ -25,10 +25,32 @@ function syncObjectStackDeps(pkg, version) {
   }
 }
 
+// src/template-copy.ts
+import fs from "fs";
+import path from "path";
+var TEMPLATE_FILE_ALIASES = /* @__PURE__ */ new Map([
+  ["_gitignore", ".gitignore"]
+]);
+function copyDir(src, dest, collected, rel = "") {
+  fs.mkdirSync(dest, { recursive: true });
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path.join(src, entry.name);
+    const outName = entry.isFile() ? TEMPLATE_FILE_ALIASES.get(entry.name) ?? entry.name : entry.name;
+    const destPath = path.join(dest, outName);
+    const relPath = rel ? `${rel}/${outName}` : outName;
+    if (entry.isDirectory()) {
+      copyDir(srcPath, destPath, collected, relPath);
+    } else if (entry.isFile()) {
+      fs.copyFileSync(srcPath, destPath);
+      collected.push(relPath);
+    }
+  }
+}
+
 // src/index.ts
 var __filename2 = fileURLToPath(import.meta.url);
-var __dirname2 = path.dirname(__filename2);
-var BUNDLED_TEMPLATES_DIR = path.resolve(__dirname2, "templates");
+var __dirname2 = path2.dirname(__filename2);
+var BUNDLED_TEMPLATES_DIR = path2.resolve(__dirname2, "templates");
 var REMOTE_REPO = "objectstack-ai/templates";
 var REMOTE_BRANCH = "main";
 var REMOTE_TARBALL_URL = `https://codeload.github.com/${REMOTE_REPO}/tar.gz/refs/heads/${REMOTE_BRANCH}`;
@@ -74,8 +96,8 @@ function sanitizeNamespace(name) {
 }
 function readCliVersion() {
   try {
-    const pkgPath = path.resolve(__dirname2, "..", "package.json");
-    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+    const pkgPath = path2.resolve(__dirname2, "..", "package.json");
+    const pkg = JSON.parse(fs2.readFileSync(pkgPath, "utf8"));
     return String(pkg.version || "0.0.0");
   } catch {
     return "0.0.0";
@@ -109,23 +131,9 @@ function detectPackageManager() {
     return "npm";
   }
 }
-function copyDir(src, dest, collected, rel = "") {
-  fs.mkdirSync(dest, { recursive: true });
-  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path.join(src, entry.name);
-    const destPath = path.join(dest, entry.name);
-    const relPath = rel ? `${rel}/${entry.name}` : entry.name;
-    if (entry.isDirectory()) {
-      copyDir(srcPath, destPath, collected, relPath);
-    } else if (entry.isFile()) {
-      fs.copyFileSync(srcPath, destPath);
-      collected.push(relPath);
-    }
-  }
-}
 function loadBundled(templateDir, targetDir) {
-  const src = path.join(BUNDLED_TEMPLATES_DIR, templateDir);
-  if (!fs.existsSync(src)) {
+  const src = path2.join(BUNDLED_TEMPLATES_DIR, templateDir);
+  if (!fs2.existsSync(src)) {
     throw new Error(`Bundled template missing on disk: ${src}`);
   }
   const collected = [];
@@ -146,12 +154,12 @@ async function downloadTarball(url, destFile) {
   });
 }
 async function loadRemote(pkgName, targetDir) {
-  const tmp = await mkdtemp(path.join(os.tmpdir(), "create-objectstack-"));
+  const tmp = await mkdtemp(path2.join(os.tmpdir(), "create-objectstack-"));
   try {
-    const tarball = path.join(tmp, "templates.tar.gz");
+    const tarball = path2.join(tmp, "templates.tar.gz");
     printStep(`Fetching template "${pkgName}" from ${REMOTE_REPO}@${REMOTE_BRANCH}\u2026`);
     await downloadTarball(REMOTE_TARBALL_URL, tarball);
-    fs.mkdirSync(targetDir, { recursive: true });
+    fs2.mkdirSync(targetDir, { recursive: true });
     const collected = [];
     await pipeline(
       createReadStream(tarball),
@@ -183,57 +191,57 @@ async function loadRemote(pkgName, targetDir) {
   }
 }
 function walkAndRewriteTs(dir, fn) {
-  if (!fs.existsSync(dir)) return;
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const full = path.join(dir, entry.name);
+  if (!fs2.existsSync(dir)) return;
+  for (const entry of fs2.readdirSync(dir, { withFileTypes: true })) {
+    const full = path2.join(dir, entry.name);
     if (entry.isDirectory()) {
       walkAndRewriteTs(full, fn);
     } else if (entry.isFile() && entry.name.endsWith(".ts")) {
-      const before = fs.readFileSync(full, "utf8");
+      const before = fs2.readFileSync(full, "utf8");
       const after = fn(before);
-      if (after !== before) fs.writeFileSync(full, after);
+      if (after !== before) fs2.writeFileSync(full, after);
     }
   }
 }
 function rewriteProjectIdentity(targetDir, projectName, namespace) {
   const title = toTitleCase(projectName);
   let templateNamespace;
-  const manifestPathPre = path.join(targetDir, "objectstack.manifest.json");
-  if (fs.existsSync(manifestPathPre)) {
+  const manifestPathPre = path2.join(targetDir, "objectstack.manifest.json");
+  if (fs2.existsSync(manifestPathPre)) {
     try {
-      const m = JSON.parse(fs.readFileSync(manifestPathPre, "utf8"));
+      const m = JSON.parse(fs2.readFileSync(manifestPathPre, "utf8"));
       if (typeof m.namespace === "string") templateNamespace = m.namespace;
     } catch {
     }
   }
-  const pkgPath = path.join(targetDir, "package.json");
-  if (fs.existsSync(pkgPath)) {
+  const pkgPath = path2.join(targetDir, "package.json");
+  if (fs2.existsSync(pkgPath)) {
     try {
-      const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+      const pkg = JSON.parse(fs2.readFileSync(pkgPath, "utf8"));
       pkg.name = projectName;
       syncObjectStackDeps(pkg, readCliVersion());
-      fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
+      fs2.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
     } catch {
     }
   }
-  const manifestPath = path.join(targetDir, "objectstack.manifest.json");
-  if (fs.existsSync(manifestPath)) {
+  const manifestPath = path2.join(targetDir, "objectstack.manifest.json");
+  if (fs2.existsSync(manifestPath)) {
     try {
-      const m = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+      const m = JSON.parse(fs2.readFileSync(manifestPath, "utf8"));
       m.name = projectName;
       m.displayName = title;
       if ("namespace" in m) m.namespace = namespace;
-      fs.writeFileSync(manifestPath, JSON.stringify(m, null, 2) + "\n");
+      fs2.writeFileSync(manifestPath, JSON.stringify(m, null, 2) + "\n");
     } catch {
     }
   }
-  const configPath = path.join(targetDir, "objectstack.config.ts");
-  if (fs.existsSync(configPath)) {
-    let cfg = fs.readFileSync(configPath, "utf8");
+  const configPath = path2.join(targetDir, "objectstack.config.ts");
+  if (fs2.existsSync(configPath)) {
+    let cfg = fs2.readFileSync(configPath, "utf8");
     cfg = cfg.replace(/(\bid:\s*)(['"`])[^'"`]*\2/, `$1$2${projectName}$2`);
     cfg = cfg.replace(/(\bnamespace:\s*)(['"`])[^'"`]*\2/, `$1$2${namespace}$2`);
     cfg = cfg.replace(/(\bname:\s*)(['"`])[^'"`]*\2/, `$1$2${title}$2`);
-    fs.writeFileSync(configPath, cfg);
+    fs2.writeFileSync(configPath, cfg);
   }
   if (namespace !== templateNamespace && templateNamespace) {
     const prefixRe = new RegExp(
@@ -241,39 +249,39 @@ function rewriteProjectIdentity(targetDir, projectName, namespace) {
       "g"
     );
     walkAndRewriteTs(
-      path.join(targetDir, "src"),
+      path2.join(targetDir, "src"),
       (src) => src.replace(
         prefixRe,
         (_m, prefix, q, rest) => `${prefix}${q}${namespace}_${rest}${q}`
       )
     );
   }
-  const readmePath = path.join(targetDir, "README.md");
-  if (fs.existsSync(readmePath)) {
-    let md = fs.readFileSync(readmePath, "utf8");
+  const readmePath = path2.join(targetDir, "README.md");
+  if (fs2.existsSync(readmePath)) {
+    let md = fs2.readFileSync(readmePath, "utf8");
     md = md.replace(/^#\s+.*$/m, `# ${title}`);
-    fs.writeFileSync(readmePath, md);
+    fs2.writeFileSync(readmePath, md);
   }
   writeAgentGuides(targetDir, title, projectName);
 }
 function writeAgentGuides(targetDir, title, projectName) {
-  const templatePath = path.join(BUNDLED_TEMPLATES_DIR, "AGENTS.md");
+  const templatePath = path2.join(BUNDLED_TEMPLATES_DIR, "AGENTS.md");
   let template;
   try {
-    template = fs.readFileSync(templatePath, "utf8");
+    template = fs2.readFileSync(templatePath, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") return;
     throw err;
   }
   const rendered = template.replace(/\{\{PROJECT_TITLE\}\}/g, title).replace(/\{\{PROJECT_NAME\}\}/g, projectName);
-  writeIfAbsent(path.join(targetDir, "AGENTS.md"), rendered);
-  const copilotPath = path.join(targetDir, ".github", "copilot-instructions.md");
-  fs.mkdirSync(path.dirname(copilotPath), { recursive: true });
+  writeIfAbsent(path2.join(targetDir, "AGENTS.md"), rendered);
+  const copilotPath = path2.join(targetDir, ".github", "copilot-instructions.md");
+  fs2.mkdirSync(path2.dirname(copilotPath), { recursive: true });
   writeIfAbsent(copilotPath, rendered);
 }
 function writeIfAbsent(filePath, contents) {
   try {
-    fs.writeFileSync(filePath, contents, { flag: "wx" });
+    fs2.writeFileSync(filePath, contents, { flag: "wx" });
   } catch (err) {
     if (err?.code !== "EEXIST") throw err;
   }
@@ -295,24 +303,24 @@ var program = new Command().name("create-objectstack").description("Create a new
     process.exit(1);
   }
   const cwd = process.cwd();
-  const projectName = name || path.basename(cwd);
+  const projectName = name || path2.basename(cwd);
   const namespace = sanitizeNamespace(projectName);
-  const targetDir = name ? path.resolve(cwd, name) : cwd;
+  const targetDir = name ? path2.resolve(cwd, name) : cwd;
   const isCurrentDir = targetDir === cwd;
   printKV("Environment", projectName);
   printKV("Namespace", namespace);
   printKV("Template", `${options.template} \u2014 ${template.description}`);
   printKV("Directory", targetDir);
   console.log("");
-  if (!isCurrentDir && fs.existsSync(targetDir)) {
-    const existing = fs.readdirSync(targetDir);
+  if (!isCurrentDir && fs2.existsSync(targetDir)) {
+    const existing = fs2.readdirSync(targetDir);
     if (existing.length > 0) {
       printError(`Directory already exists and is not empty: ${targetDir}`);
       process.exit(1);
     }
   }
   try {
-    fs.mkdirSync(targetDir, { recursive: true });
+    fs2.mkdirSync(targetDir, { recursive: true });
     let createdFiles;
     if (template.source.kind === "bundled") {
       createdFiles = loadBundled(template.source.dir, targetDir);
@@ -342,14 +350,14 @@ var program = new Command().name("create-objectstack").description("Create a new
     if (!options.skipInstall && !options.skipSkills) {
       printStep("Installing AI skills for your coding agent...");
       try {
-        execSync("npx -y skills add objectstack-ai/framework --all", {
+        execSync("npx -y skills add objectstack-ai/framework/skills --all", {
           stdio: "inherit",
           cwd: targetDir
         });
         console.log("");
       } catch {
         printWarning(
-          "Skills installation skipped. Run manually:\n    npx skills add objectstack-ai/framework"
+          "Skills installation skipped. Run manually:\n    npx skills add objectstack-ai/framework/skills"
         );
         console.log("");
       }
@@ -369,7 +377,7 @@ var program = new Command().name("create-objectstack").description("Create a new
     if (options.skipInstall || options.skipSkills) {
       console.log("");
       console.log(chalk.bold("  AI Skills (recommended):"));
-      console.log(chalk.dim("    npx skills add objectstack-ai/framework"));
+      console.log(chalk.dim("    npx skills add objectstack-ai/framework/skills"));
     }
     console.log("");
   } catch (error) {

package/dist/templates/AGENTS.md

@@ -77,7 +77,7 @@ This project uses ObjectStack skills from `objectstack-ai/framework`.
 Install or update skills with the standard [skills CLI](https://skills.sh/):
 
 ```bash
-npx skills add objectstack-ai/framework
+npx skills add objectstack-ai/framework/skills
 ```
 
 Skills are triggered automatically based on task context:

package/dist/templates/blank/README.md

@@ -21,11 +21,55 @@ curl -c cookies.txt -X POST http://localhost:3000/api/v1/auth/sign-in/email \
 curl -b cookies.txt "http://localhost:3000/api/v1/data/<your_object>"
 ```
 
+## Your app is an MCP server
+
+Every ObjectStack app is itself a
+[Model Context Protocol](https://modelcontextprotocol.io) server — **on by
+default**, no plugin to install. `pnpm dev` prints the endpoint and a
+ready-to-paste connect command on boot; point a coding agent (Claude Code,
+Cursor, any MCP client) at it and it can read your schema, query data, and run
+your exposed actions — all under the caller's own permissions and RLS:
+
+```bash
+claude mcp add --transport http my-app http://localhost:3000/api/v1/mcp
+```
+
+Set `OS_MCP_SERVER_ENABLED=false` to turn it off. This is the *serve* side — the
+reverse of the `mcp` connector below (which lets your app *call* other MCP
+servers). See [Connect an MCP Client](https://docs.objectstack.ai/docs/ai/connect-mcp)
+for OAuth, API keys, and which objects/actions become tools.
+
 ## Layout
 
 - `objectstack.config.ts` — environment manifest (objects, API, plugins)
 - `src/objects/` — object definitions (one file per object)
 
+## Connectors (default providers)
+
+`objectstack.config.ts` wires the three **generic connector executors**, so you
+can call an external system from a flow as pure metadata — no host code:
+
+| Provider | Package | Use for |
+|:---|:---|:---|
+| `rest` | `@objectstack/connector-rest` | Any JSON/HTTP REST API |
+| `openapi` | `@objectstack/connector-openapi` | An API described by an OpenAPI document |
+| `mcp` | `@objectstack/connector-mcp` | A Model Context Protocol server |
+
+Add a `connectors:` entry that names one of these `provider`s and the
+`automation` capability materializes it into a live, dispatchable connector at
+boot (ADR-0097); a flow's `connector_action` node then calls it. To add a brand
+connector (e.g. Slack), install its package and add `new ConnectorSlackPlugin()`
+to `plugins:`; to drop a provider, remove its plugin.
+
+> **Security — declarative MCP over stdio.** An `mcp` connector whose transport
+> spawns a local process (`stdio`) is denied by default, because the command
+> comes from metadata. Opt in per host with
+> `new ConnectorMcpPlugin({ declarativeStdio: ['node'] })`; `http` transports
+> need no opt-in.
+
+See [Automation → Flows](https://docs.objectstack.ai/docs/automation/flows) for
+the full connector and `connector_action` guide.
+
 ## Verify your changes
 
 After editing any metadata, run:

package/dist/templates/blank/_gitignore

@@ -0,0 +1,7 @@
+node_modules
+dist
+.objectstack/
+*.log
+.DS_Store
+.env
+.env.*

package/dist/templates/blank/objectstack.config.ts

@@ -1,4 +1,7 @@
 import { defineStack } from '@objectstack/spec';
+import { ConnectorRestPlugin } from '@objectstack/connector-rest';
+import { ConnectorOpenApiPlugin } from '@objectstack/connector-openapi';
+import { ConnectorMcpPlugin } from '@objectstack/connector-mcp';
 import * as objects from './src/objects/index.js';
 
 export default defineStack({
@@ -13,7 +16,28 @@ export default defineStack({
     // refuse this package at the boundary with the exact migration command,
     // instead of crashing later. Kept in lockstep with releases by
     // scripts/sync-template-versions.mjs.
-    engines: { protocol: '^15' },
+    engines: { protocol: '^16' },
   },
+
+  // `automation` backs flow execution and, per ADR-0097, materializes any
+  // declarative `connectors:` entry into a live, dispatchable connector at boot.
+  // The connector executors below register their provider factories with it —
+  // without `automation` loaded they have nowhere to register and boot fails, so
+  // keep this capability whenever `plugins:` lists a connector.
+  requires: ['automation'],
+
+  // Generic connector executors (ADR-0022/0023/0024 + ADR-0097), default-present
+  // so you can add a `connectors:` entry naming `provider: 'rest' | 'openapi' |
+  // 'mcp'` and have it materialize with zero host code. Zero-arg = contribute the
+  // provider factory only. Brand connectors (Slack, …) stay marketplace/opt-in.
+  // Security (#3055): a declarative `mcp` stdio transport spawns a local process
+  // from metadata and is denied by default — opt in per host with
+  // `new ConnectorMcpPlugin({ declarativeStdio: ['<trusted-command>'] })`.
+  plugins: [
+    new ConnectorRestPlugin(),
+    new ConnectorOpenApiPlugin(),
+    new ConnectorMcpPlugin(),
+  ],
+
   objects: Object.values(objects),
 });

package/dist/templates/blank/package.json

@@ -11,13 +11,16 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@objectstack/spec": "^15.0.0",
-    "@objectstack/runtime": "^15.0.0",
-    "@objectstack/driver-memory": "^15.0.0",
-    "@objectstack/plugin-hono-server": "^15.0.0"
+    "@objectstack/spec": "^16.0.0",
+    "@objectstack/runtime": "^16.0.0",
+    "@objectstack/driver-memory": "^16.0.0",
+    "@objectstack/plugin-hono-server": "^16.0.0",
+    "@objectstack/connector-rest": "^16.0.0",
+    "@objectstack/connector-openapi": "^16.0.0",
+    "@objectstack/connector-mcp": "^16.0.0"
   },
   "devDependencies": {
-    "@objectstack/cli": "^15.0.0",
+    "@objectstack/cli": "^16.0.0",
     "typescript": "^6.0.0"
   }
 }

package/dist/templates/blank/pnpm-workspace.yaml

@@ -0,0 +1,23 @@
+# pnpm does not run dependency install scripts unless they are approved here.
+# Without this file a fresh `pnpm install` on pnpm 11 exits 1 with
+# ERR_PNPM_IGNORED_BUILDS — pnpm 10 only warned, pnpm 11 made it a hard error.
+#
+# Both keys are needed; they are read by different pnpm versions:
+#   allowBuilds             pnpm >= 10.31 and pnpm 11+. pnpm 11 reads ONLY this
+#                           one — onlyBuiltDependencies alone still errors.
+#   onlyBuiltDependencies   pnpm 10.0–10.30, which do not understand allowBuilds.
+#
+# better-sqlite3 is the native sqlite driver (@objectstack/driver-sql's optional
+# dependency); esbuild compiles objectstack.config.ts. Both ship prebuilt
+# binaries, so an unapproved build degrades rather than breaks — but pnpm 11
+# fails the install before it gets that far.
+#
+# npm and yarn ignore this file; it costs them nothing.
+
+onlyBuiltDependencies:
+  - better-sqlite3
+  - esbuild
+
+allowBuilds:
+  better-sqlite3: true
+  esbuild: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-objectstack",
-  "version": "15.1.1",
+  "version": "16.0.0-rc.0",
   "description": "Create a new ObjectStack project — npx create-objectstack",
   "bin": {
     "create-objectstack": "./bin/create-objectstack.js"