create-objectstack 17.1.0 → 17.2.0

package/CHANGELOG.md

@@ -1,5 +1,361 @@
 # create-objectstack
 
+## 17.2.0
+
+### Minor Changes
+
+- 5a616d5: `create-objectstack` now closes with a "Created files" summary derived from a
+  walk of the finished project directory, so it names everything the run wrote —
+  including the files written after the template copy (#10323).
+  
+  The old summary was the template copy's own list, printed before
+  `<pm> install` and before `npx skills add`. Measured against published
+  `create-objectstack@17.1.0` (`create-objectstack demo-app`, then a full walk of
+  the result): 12 entries printed, 18,045 paths on disk, **18,033 of them
+  unreachable from the summary** — `AGENTS.md`, `.github/copilot-instructions.md`,
+  `pnpm-lock.yaml`, `skills-lock.json`, `node_modules/`, and two ~968 KB trees of
+  agent instructions at `.agents/skills/` and `agent/skills/`.
+  
+  That mattered because the same run ends with the `skills` CLI printing *"Review
+  skills before use; they run with full agent permissions."* Advice to review
+  files the run never named, at paths it never showed, is advice a newcomer
+  cannot act on — the wrong failure direction for a security-flavoured warning.
+  
+  The list could not have been correct where it stood: two of the three write
+  phases belong to other processes, and the `skills` installer's destination set
+  moves with **its** releases, not ours. Reading the directory afterwards makes
+  the summary self-correcting instead. Large directories collapse to one line
+  carrying their path, entry count and size, so the bulk stays reviewable without
+  18,000 lines of output, and the paths the skills installer created are marked
+  `⚠ skills` with the permissions warning tied to them.
+  
+  Same run, after the change: 20 entries printed, **0 written paths unreachable**.
+
+### Patch Changes
+
+- cec9d23: Fix `create-objectstack`'s startup banner hardcoding `◆ Create ObjectStack v6.x`
+  regardless of the package's real, released version — eleven majors stale, on
+  the first line of output a newcomer ever sees (#10325). The banner now calls
+  `readCliVersion()`, the same reader `.version()` already used, instead of a
+  literal string.
+  
+  Dropping the real version in without recomputing the box's padding would have
+  reintroduced the same defect one line later — the border is a fixed run of
+  `═` computed for the 4-character `v6.x`, and a longer real version (`v17.1.0`
+  is 7 characters) would push the right border out of alignment (the sibling
+  bug fixed in #10322, one function away in the same file). The box now derives
+  its width from the version string's plain length and widens the frame — never
+  truncates — for a version long enough to need more room; ordinary versions
+  still render at the historical box size.
+  
+  No behaviour change beyond the printed banner.
+- 3a3f209: Tell a newcomer that the `blank` starter ships no app, so an empty Console
+  reads as the intended starting point rather than a broken install (#10317).
+  
+  Measured on a real scaffold-and-boot (`create-objectstack my-app -t blank`,
+  published 17.1.0 packages, `objectstack dev --ui`): `GET /api/v1/meta/app`
+  returns the two platform apps (Setup, Account) and nothing of the project's
+  own, while `GET /api/v1/data/my_app_note` serves the scaffolded object the
+  whole time. The template ships `src/objects/` only — deliberately, as every
+  scaffolder template in this repo does — but nothing the newcomer could reach
+  said so, and `pnpm dev` advertises the Console URL on every boot.
+  
+  Documentation only: a new "The Console" section in the generated `README.md`
+  naming the Console path, the consequence, and `src/apps/*.app.ts` as the
+  remedy. No change to what the scaffolder writes into `src/`.
+- 7bf3fb7: Point every documentation link in these packages' published READMEs — and in
+  the project `create-objectstack` scaffolds — at the canonical docs origin
+  `https://objectstack.ai`, replacing the `docs.objectstack.ai` spelling.
+  
+  Both spellings reach the same pages (the alias redirects to the apex,
+  path-preserving), so no link was broken. The reason it needs a release rather
+  than an in-repo fix alone: a README ships inside the npm tarball, so the
+  version already on npm keeps showing the old host to every reader of the
+  package page until a new one is published.
+- 675ab57: **First-run polish:** a brand-new scaffold's very first `pnpm install` no longer reports two unmet peer dependencies (#10326).
+  
+  Reproduced on a clean scaffold from published `create-objectstack@17.1.0` — no lockfile, `node_modules` removed, nothing configured by the user — and again on the second scaffold path, `objectstack init`. Both printed the same two:
+  
+  ```
+  ✕ unmet peer better-call
+    Installed: 1.4.0
+    Wanted:
+      1.3.7:
+        @better-auth/scim@1.7.0-rc.1
+  
+  ✕ unmet peer better-sqlite3
+    Installed: 13.0.3
+    Wanted:
+      ^12.0.0:
+        better-auth@1.7.1
+  ```
+  
+  Nothing was broken — but it is the first screen a newcomer sees, and there is nothing they did to cause it or can do about it.
+  
+  **`better-sqlite3`: the pin is right and the upstream range is stale — so it is widened, not corrected.** better-auth 1.7.1 declares `better-sqlite3` as an **optional** peer at `^12.0.0`, and it governs exactly one configuration: a raw better-sqlite3 `Database` handed to better-auth's `database` option, which its Kysely dialect then drives. ObjectStack never takes that path — `AuthManager.createDatabaseConfig()` returns `createObjectQLAdapterFactory(dataEngine)`, and every `better-sqlite3` use under `plugin-auth` is knex's `client: 'better-sqlite3'` beneath ObjectQL. Measured anyway on the configuration the range *does* govern: better-auth 1.7.1 with `database: new Database(':memory:')`, running `getMigrations().runMigrations()`, `signUpEmail`, `signInEmail` and adapter `findOne`/`update`/`delete`, is green on **better-sqlite3 13.0.3** and byte-for-byte equivalent on **12.11.1**. The same probe with `Database.prototype.prepare` neutered fails, so that green is the driver's and not an unexercised path. Pinning our own `^13.0.3` declarations back to `^12` would downgrade a native module across the platform to satisfy a range measurement shows is simply behind.
+  
+  **`@better-auth/scim`: the rc pin stays, and one `better-call` copy is the correct tree.** `npm view @better-auth/scim dist-tags` reads `latest: '1.7.1'`, but stable 1.7.x ships the rc.2 whole-model rewrite, so adopting it is a separate migration rather than a version bump; the exact `1.7.0-rc.1` pin is deliberate. The rc peers an exact `better-call@1.3.7` while better-auth 1.7.1 depends on `1.4.0` — and a better-auth plugin has to share the **host's** better-call instance, so the single 1.4.0 copy every install already resolves is right, not a skew to repair. This declaration retires together with the rc pin.
+  
+  **What changed, and what deliberately did not.** Both remedies are pnpm `peerDependencyRules.allowedVersions` entries, scoped `<declaring package>><peer>` so each widens exactly one declaration. They ship *inside* the scaffold — the bundled `pnpm-workspace.yaml` template and the one `objectstack init` renders — because a block in this repo's own workspace file does not travel with published packages. `allowedVersions` changes what pnpm **reports**, never what it resolves: measured on both scaffold paths, the lockfile is byte-identical with and without it (0 lines of diff), and no dependency version, range or resolution moved anywhere. This repo's own resolutions are untouched.
+- e85182d: Converge the blank scaffold template's `README.md` docs links on the ruled
+  canonical origin, `https://objectstack.ai` (maintainer ruling, 2026-08-21:
+  「这个仓的文档站规范 URL 是 https://objectstack.ai」; enforced by
+  `CANONICAL_DOCS_ORIGIN` in `scripts/check-published-readme-links.mjs`). The
+  template previously linked the accepted-but-unratified `docs.objectstack.ai`
+  alias in three places, which disagreed with the root `README.md`'s already-
+  canonical spelling — so a single `npm create objectstack@latest` run handed
+  the user two different hostnames for the same docs site.
+- aea1e64: Fix the declared bin (`bin/create-objectstack.js`) being tracked non-executable
+  in git. It carries a `#!/usr/bin/env node` shebang and is pnpm's link target
+  for the `create-objectstack` command, but was committed `100644` instead of
+  `100755` — matching the sibling declared bin `packages/cli/bin/run.js`, which
+  was already tracked executable.
+  
+  Patch bump: this is a packaging-mode correction with no content, API or
+  behavior change (the blob hash is identical) — it only fixes how the file is
+  tracked in git and therefore how it is packed for npm.
+- 818e027: Fix `objectstack init`'s closing "Created files" summary omitting `pnpm-lock.yaml` / `package-lock.json` and `node_modules/` (#10557).
+  
+  The summary used to be printed from a list accumulated while the template
+  files were written — before `<pm> install` ran — so it could never name what
+  the package manager wrote. `init` now prints it after the install attempt
+  (succeeded or failed) from a walk of the finished project directory, reusing
+  `create-objectstack`'s `created-summary.ts` (now published as the
+  `create-objectstack/created-summary` subpath) instead of a second copy of the
+  same renderer.
+- afe1c4e: fix(cli): declare the four `@better-auth/utils` peer skews a freshly scaffolded project reports (#10931)
+  
+  Both scaffold paths emit a `peerDependencyRules.allowedVersions` block whose
+  stated purpose is that a brand-new project's first `pnpm install` does not open
+  with a peer-skew report. It declared two skews and left four showing:
+  
+  ```
+  ├─┬ @better-auth/core 1.7.1
+  │ └── ✕ unmet peer @better-auth/utils@0.4.2: found 0.5.0
+          ├─┬ @better-auth/scim 1.7.0-rc.1
+          │ └── ✕ unmet peer @better-auth/utils@0.4.2: found 0.5.0
+          ├─┬ @better-auth/oauth-provider 1.7.1
+          │ └── ✕ unmet peer @better-auth/utils@0.4.2: found 0.5.0
+          └─┬ @better-auth/sso 1.7.1
+            └── ✕ unmet peer @better-auth/utils@0.4.2: found 0.5.0
+  ```
+  
+  `@better-auth/core`, `/oauth-provider`, `/scim` and `/sso` each peer an **exact**
+  `@better-auth/utils@0.4.2`. The 0.5.0 they are handed comes from
+  `better-call@1.4.0` — better-auth's own HTTP layer — which *depends* on
+  `^0.5.0`; `@objectstack/plugin-auth` names the four as direct dependencies
+  without naming utils, so pnpm satisfies their peer from better-call's copy
+  instead of better-auth's own exact 0.4.2 dependency.
+  
+  **Measured compatible before widening, not assumed.** Those four import three
+  symbols in total: `base64`/`base64Url` (`@better-auth/utils/base64`),
+  `createHash` (`/hash`) and, in core only, `createRandomStringGenerator`
+  (`/random`). 0.5.0 declares all three with identical signatures; `/random` is
+  unchanged apart from formatting, `/base64` swaps `new Uint8Array(data)` for a
+  helper that *is* `new Uint8Array(data)` on non-strings, and `/hash` only widens
+  its input coercion for views not backed by a plain `ArrayBuffer`. Run against
+  the input shapes those call sites actually pass, the two versions agree on every
+  value; run end to end — better-auth with the `sso`, `oauth-provider` and `scim`
+  plugins — a tree where the four resolve 0.5.0 and one where they resolve 0.4.2
+  produce the same transcript: sign-up, sign-in, session, both OAuth metadata
+  documents, the RFC 7636 PKCE challenge, and the SCIM and SSO endpoint outcomes.
+  
+  A resolution change was measured too, and rejected: pinning utils back to 0.4.2
+  clears the four lines only by dragging `better-call@1.4.0` off its own declared
+  `^0.5.0` — manufacturing one real range violation to silence four benign ones.
+  
+  Four scoped entries, one per declaring package, matching the block's convention
+  that each rule widens exactly one declaration. `allowedVersions` suppresses the
+  report only: the lockfile a scaffold resolves is byte-identical with and without
+  the block. The version is spelled `0.5.0` exactly rather than `0.5`, so a future
+  `0.6.0` reports again instead of inheriting this finding.
+  
+  Both scaffold paths — `objectstack init` (rendered by the CLI) and
+  `npx create-objectstack` (a copied template file) — are changed together, and
+  `packages/cli/test/scaffold-workspace-consistency.test.ts` gains a limb that
+  compares the peer maps the two produce, so they cannot drift apart again.
+- 21756b3: fix(create-objectstack): converge scaffold docs on the canonical host and drop the last two dead monorepo references (#10990, #11022)
+  
+  A freshly scaffolded project shipped a handful of text lines a reader with
+  only their own project — no monorepo, no `docs/adr/`, no issue tracker —
+  could not follow:
+  
+  - `templates/AGENTS.md` linked `https://objectstack.com/docs`, a domain that
+    is not this project's docs site at all (not even a redirecting alias).
+  - `templates/blank/Dockerfile` and `templates/blank/docker-compose.yml` both
+    linked `https://docs.objectstack.ai/...`, an accepted-but-unratified alias.
+    All three now point at the ruled canonical origin, `https://objectstack.ai`
+    (maintainer ruling, 2026-08-21).
+  - `templates/blank/README.md` cited `ADR-0097` and named "the ObjectStack
+    framework repo" as the home of `skills/` — both rewritten self-contained,
+    keeping the fact each was carrying: the connector-materialization line now
+    links the public [Automation → Connectors](https://objectstack.ai/docs/automation/connectors)
+    page, and the skills line now names the followable
+    `npx skills add objectstack-ai/objectstack/skills` install the scaffolder's
+    own closing output already uses.
+  
+  `packages/create-objectstack/src/starter-comments-self-contained.test.ts`
+  (#10324) gains two pin obligations these two fixes call for: a host-convergence
+  assertion driven by the same `shippedFiles()` walker that already enumerates
+  everything a scaffold ships (no other repo gate's population reaches these
+  template files — `check:published-readme-links` reads publishable packages'
+  published markdown only), and a fifth `MONOREPO_ONLY` pattern that catches a
+  prose-shaped reference to this repo ("the ObjectStack framework repo") the
+  first four, syntax-shaped patterns could not. The self-retiring `EXCLUDED`
+  entry for `blank/README.md` is removed now that the file cites nothing
+  monorepo-only.
+- 568de19: Scaffolded projects declare an explicit empty `packages: []` in their
+  `pnpm-workspace.yaml` (#10933). Both scaffold paths render it —
+  `renderPnpmWorkspaceYaml` in `objectstack init`, and the bundled `blank`
+  template `npx create-objectstack` copies.
+  
+  The file was deliberately keyless so it would act purely as a settings file.
+  That intent is now written down rather than inferred from a missing key, and
+  writing it down is what fixes a first-command failure: pnpm 9.x and 10.0–10.4
+  parse `pnpm-workspace.yaml` **before** they read `engines`, so they refused a
+  brand-new project outright with
+  
+  ```
+   ERROR  packages field missing or empty
+  ```
+  
+  naming a file the user never wrote and giving no hint that the cause is their
+  pnpm version — and no `engines.pnpm` floor could reach them, because they never
+  got as far as the engines check. Measured, one clean install per pnpm version,
+  each with its own store:
+  
+  | pnpm | before | after |
+  |---|---|---|
+  | 9.15.9, 10.0.0, 10.4.0 | `ERROR packages field missing or empty` | `ERR_PNPM_UNSUPPORTED_ENGINE`, naming `>=10.15` |
+  | 10.5.0–10.14.0 | `ERR_PNPM_UNSUPPORTED_ENGINE` | unchanged |
+  | 10.15.0, 10.34.5, 11.22.0 | installs | installs, byte-identical `pnpm-lock.yaml` |
+  
+  So every unsupported pnpm now reports the same actionable cause, and supported
+  pnpm is unaffected: the empty key was measured equivalent to omission on
+  10.15.0, 10.34.5 and 11.22.0 — identical lockfile bytes, identical
+  `node_modules/.modules.yaml` once the run-local `prunedAt`/`storeDir` fields are
+  dropped, identical `pnpm ls -r --depth -1`, and an identical second-install
+  "Already up to date".
+  
+  The declaration is an **empty** list on purpose. `packages: ['.']` satisfies the
+  same parsers but declares the project root a workspace *member* — a monorepo
+  root — which a single-package scaffold is not, and which reads to the next
+  author (human or AI) as an invitation to add member packages to an app.
+  
+  `engines.pnpm` is unchanged at `>=10.15`.
+- 8d21f7a: Fix `create-objectstack`'s closing "Next steps" and install-failure remedy
+  hardcoding `npm` regardless of which package manager the run actually used
+  (#10322). `detectPackageManager()` already prefers `pnpm` and falls back to
+  `npm` only when `pnpm` is unreachable — confirmed still true at HEAD, and
+  confirmed empirically: a real run with `pnpm` on `PATH` installs with `pnpm`
+  (`pnpm-lock.yaml`, "Done in … using pnpm vX") and then told the newcomer to
+  run `npm run dev` / `npm run validate` next, a package manager the run never
+  touched. The detected package manager is now read once, up front, and reused
+  consistently for the install command, the install-failure remedy, and every
+  line of "Next steps" — so the printed guidance always names the tool the run
+  actually used, in both the `pnpm` and the `npm`-fallback case.
+  
+  Also names `validate` — the step the generated `AGENTS.md` calls
+  unskippable — in the "Getting started" section of the generated `blank`
+  template's README, not only in its later "Verify your changes" section, so a
+  newcomer reading top-to-bottom sees it at first touch.
+  
+  No install behaviour changes: the scaffolder still installs by default and
+  still supports `--skip-install`; this is a messaging-only fix.
+- 9d101d2: Declare a pnpm floor (`engines.pnpm: ">=10.15"`) in the `package.json` both
+  scaffolders write, so an unsupported pnpm reports its own version instead of an
+  error about a file the user never wrote.
+  
+  Both scaffold paths emit a settings-only `pnpm-workspace.yaml` with no
+  `packages:` key. Early pnpm 10 refuses that file outright — `pnpm install` exits
+  1 with `ERROR packages field missing or empty` before resolving a single
+  dependency, so a brand-new project could not be installed at all. Measured on
+  the rendered shape, one clean install per pnpm version, each with its own store:
+  
+  | pnpm | before | after |
+  | --- | --- | --- |
+  | 10.0.0 – 10.4.0 | `packages field missing or empty` | unchanged — see below |
+  | 10.5.0 – 10.14.0 | `packages field missing or empty` | `ERR_PNPM_UNSUPPORTED_ENGINE`, naming the expected range |
+  | >= 10.15.0 | installs | installs |
+  
+  The floor is a diagnosis, not a repair: pnpm 10.0.0–10.4.0 parse
+  `pnpm-workspace.yaml` *before* they read `engines`, so they still print the raw
+  workspace error. Closing that remaining sliver requires deciding what a
+  single-package scaffold should declare under `packages:`, which is tracked
+  separately and deliberately not decided here.
+  
+  `engines.pnpm` rather than a `packageManager` stamp: npm, yarn and bun ignore
+  `engines.pnpm` entirely, so the scaffold keeps working for all four package
+  managers `objectstack init` hands off to. A `packageManager: "pnpm@x.y.z"` stamp
+  would declare the project pnpm-only (corepack-driven yarn refuses to run in such
+  a project) and pin one exact version that goes stale on every pnpm release — and
+  it buys nothing on 10.0–10.4, which reach the workspace error before reading
+  that field either.
+  
+  No existing project is affected; this only changes what a newly scaffolded
+  `package.json` contains.
+- 6d441e4: Correct the pnpm boundary the blank template states for `allowBuilds`, and gate
+  the two scaffold paths against each other (#10498, #10499).
+  
+  `packages/create-objectstack/src/templates/blank/pnpm-workspace.yaml` is copied
+  verbatim into every scaffolded project, so its header comment is prose that
+  ships **inside the user's own repository**. It said `allowBuilds` needs
+  pnpm >= 10.31 and that `onlyBuiltDependencies` covers pnpm 10.0–10.30. Measured
+  on a probe depending on `esbuild@0.28.2`, with a workspace file carrying only
+  `allowBuilds`, one clean install per pnpm version and each with its own
+  `--store-dir` (isolation matters — pnpm's side-effects cache will otherwise hand
+  a later run a build an earlier run performed, and it reads as "the key worked"):
+  
+  | pnpm | `allowBuilds` alone |
+  |:--|:--|
+  | 10.15.0 – 10.25.0 | ignored — build not run |
+  | **10.26.0** | **honoured — build ran** |
+  | 10.28.0 – 10.33.0 | honoured — build ran |
+  
+  So the floor is 10.26.0 and the older-key band is 10.0–10.25. A user on pnpm
+  10.28 was being told by the file in front of them that their pnpm cannot read
+  the key it is in fact reading. Both load-bearing claims in that comment were
+  correct and are unchanged: both keys are needed, and pnpm 11 reads only
+  `allowBuilds`. No setting, no assertion and no install behaviour changes — the
+  rendered `onlyBuiltDependencies` / `allowBuilds` values are byte-identical.
+  
+  The reason it was wrong for so long is the second half of this change.
+  `objectstack init` renders the same file from `renderPnpmWorkspaceYaml()` in
+  `packages/cli`, it was corrected to the measured numbers separately, and each
+  package's ratchets are package-local — so neither could ever fail for the other
+  file's regression, and the two scaffold paths shipped contradictory prose about
+  the same rule with every gate green. `packages/cli/test/scaffold-workspace-consistency.test.ts`
+  now compares the two **rendered outputs**: the packages each key actually grants
+  a build to, and the pnpm versions each file actually names for each key. It was
+  confirmed failing against the live divergence before this correction landed.
+  
+  Bumped `patch` rather than left out: the corrected text is user-visible — it is
+  delivered into every new project — while nothing executable moves.
+- ecd06f6: Rewrite the scaffolded project's starter comments so a newcomer can actually
+  follow them (#10324). `objectstack.config.ts` and `src/objects/note.object.ts`
+  are the first two files opened after scaffolding, and between them they cited
+  four ADR identifiers, one bare issue number and the path of a release-time
+  script in this monorepo — none of which ship in, or are linked from, a
+  scaffolded project. `// per ADR-0097` read as a reference the reader was
+  failing to follow rather than as the context it was meant to be.
+  
+  The explanations are kept and made self-contained; only the dead ends are
+  gone. Each now states the fact the identifier stood for — the protocol range
+  is checked before anything loads and was stamped to match the installed
+  version rather than hand-tuned; `automation` must stay whenever `plugins:`
+  lists a connector or the executors have nowhere to register; a declarative
+  `mcp` stdio transport is denied by default; the org-wide default is required
+  so the baseline is an authored decision — and points at the public docs page
+  that covers it in full. The blank `Dockerfile` likewise stops pointing at a
+  file in this repo and points at the self-hosting guide it already links.
+  
+  A pin (`starter-comments-self-contained.test.ts`) keeps it that way from both
+  sides: no shipped template file may cite an ADR identifier, a bare issue
+  number or a repo script path, and the facts those references carried must
+  still be stated — so the comments cannot be "fixed" by deleting them. It also
+  resolves every canonical-origin docs URL in the shipped tree against
+  `content/docs`, because a link that 404s is the same defect one level out.
+
 ## 17.1.0
 
 ### Minor Changes

package/README.md

@@ -87,7 +87,7 @@ npm run validate   # verify metadata: schema + predicates + bindings
 ```
 
 See the docs:
-[Your First Project](https://docs.objectstack.ai/docs/getting-started/your-first-project).
+[Your First Project](https://objectstack.ai/docs/getting-started/your-first-project).
 
 ## License
 

package/dist/chunk-ZIUW7UEA.js

@@ -0,0 +1,112 @@
+// src/created-summary.ts
+import fs from "fs";
+import path from "path";
+var COLLAPSE_AT = 10;
+var MEASURE_BUDGET = 2e3;
+function scan(abs, name, budget) {
+  let st;
+  try {
+    st = fs.lstatSync(abs);
+  } catch {
+    return { name, dir: false, entries: 0, bytes: 0, truncated: false, children: [] };
+  }
+  if (!st.isDirectory()) {
+    budget.left -= 1;
+    return { name, dir: false, entries: 1, bytes: st.size, truncated: false, children: [] };
+  }
+  const node = { name, dir: true, entries: 0, bytes: 0, truncated: false, children: [] };
+  let dirents;
+  try {
+    dirents = fs.readdirSync(abs, { withFileTypes: true });
+  } catch {
+    return node;
+  }
+  for (const entry of dirents) {
+    if (budget.left <= 0) {
+      node.truncated = true;
+      break;
+    }
+    const child = scan(path.join(abs, entry.name), entry.name, budget);
+    node.entries += child.entries;
+    node.bytes += child.bytes;
+    if (child.truncated) node.truncated = true;
+    node.children.push(child);
+  }
+  return node;
+}
+function byName(a, b) {
+  return a.name.localeCompare(b.name, "en");
+}
+function flatten(node, prefix, out) {
+  for (const child of [...node.children].sort(byName)) {
+    const rel = prefix + child.name;
+    if (!child.dir) {
+      out.push({ path: rel, kind: "file", entries: 1, bytes: child.bytes, truncated: false });
+      continue;
+    }
+    if (!child.truncated && child.entries <= COLLAPSE_AT) {
+      flatten(child, `${rel}/`, out);
+      continue;
+    }
+    let deepest = child;
+    let shown = rel;
+    while (deepest.children.length === 1 && deepest.children[0].dir) {
+      deepest = deepest.children[0];
+      shown = `${shown}/${deepest.name}`;
+    }
+    out.push({
+      path: `${shown}/`,
+      kind: "dir",
+      entries: deepest.entries,
+      bytes: deepest.bytes,
+      truncated: deepest.truncated
+    });
+  }
+}
+function summarizeTree(root) {
+  let dirents;
+  try {
+    dirents = fs.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const top = { name: "", dir: true, entries: 0, bytes: 0, truncated: false, children: [] };
+  for (const entry of dirents) {
+    top.children.push(scan(path.join(root, entry.name), entry.name, { left: MEASURE_BUDGET }));
+  }
+  const out = [];
+  flatten(top, "", out);
+  return [
+    ...out.filter((e) => e.kind === "file"),
+    ...out.filter((e) => e.kind === "dir")
+  ];
+}
+function formatBytes(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  const kb = bytes / 1024;
+  if (kb < 1024) return `${kb < 10 ? kb.toFixed(1) : Math.round(kb)} KB`;
+  const mb = kb / 1024;
+  return `${mb < 10 ? mb.toFixed(1) : Math.round(mb)} MB`;
+}
+function describeEntry(entry) {
+  if (entry.kind === "file") return "";
+  const noun = entry.entries === 1 ? "file" : "files";
+  if (entry.truncated) return `over ${entry.entries.toLocaleString("en-US")} ${noun}`;
+  return `${entry.entries.toLocaleString("en-US")} ${noun}, ${formatBytes(entry.bytes)}`;
+}
+function unreachablePaths(entries, written) {
+  const named = new Set(entries.filter((e) => e.kind === "file").map((e) => e.path));
+  const dirs = entries.filter((e) => e.kind === "dir").map((e) => e.path);
+  return written.filter(
+    (p) => !named.has(p) && !dirs.some((d) => `${p}/`.startsWith(d))
+  );
+}
+
+export {
+  COLLAPSE_AT,
+  MEASURE_BUDGET,
+  summarizeTree,
+  formatBytes,
+  describeEntry,
+  unreachablePaths
+};

package/dist/created-summary.d.ts

@@ -0,0 +1,48 @@
+/** A directory holding more than this many entries is collapsed to one line. */
+declare const COLLAPSE_AT = 10;
+/**
+ * Entries this module is willing to `lstat` per top-level entry before it
+ * stops counting and reports a lower bound.
+ *
+ * The budget is PER TOP-LEVEL ENTRY, not global, and that is load-bearing:
+ * with one shared budget, `node_modules/` (17,920 paths in the measurement
+ * above) exhausts it before the walk reaches the project's own files, and the
+ * summary silently truncates the very content it exists to disclose. Whether
+ * that happened would depend on `readdir` order.
+ */
+declare const MEASURE_BUDGET = 2000;
+interface SummaryEntry {
+    /** Project-relative path. Directories carry a trailing `/`. */
+    path: string;
+    kind: 'file' | 'dir';
+    /** Files and symlinks in the subtree (always 1 for a file). */
+    entries: number;
+    /** Total size in bytes. Meaningless when `truncated`. */
+    bytes: number;
+    /** Measurement stopped at the budget — `entries` and `bytes` are lower bounds. */
+    truncated: boolean;
+}
+/**
+ * Summarize everything under `root`, collapsing large directories.
+ *
+ * Returns files first (alphabetical), then collapsed directories
+ * (alphabetical), so the enumerated content reads as a list and the bulk
+ * trees read as a block with their sizes.
+ */
+declare function summarizeTree(root: string): SummaryEntry[];
+/** Human-readable byte count. */
+declare function formatBytes(bytes: number): string;
+/** The measurement note that follows a collapsed directory's path. */
+declare function describeEntry(entry: SummaryEntry): string;
+/**
+ * The property this module exists to hold: every path in `written` is either
+ * named outright by a summary entry, or lies beneath a directory entry that
+ * is. Returns the paths that are NOT reachable — empty means the summary is
+ * complete.
+ *
+ * Exported because it is the assertion, and an assertion that lives only in a
+ * test file cannot be run against a real scaffold from anywhere else.
+ */
+declare function unreachablePaths(entries: SummaryEntry[], written: string[]): string[];
+
+export { COLLAPSE_AT, MEASURE_BUDGET, type SummaryEntry, describeEntry, formatBytes, summarizeTree, unreachablePaths };

package/dist/created-summary.js

@@ -0,0 +1,16 @@
+import {
+  COLLAPSE_AT,
+  MEASURE_BUDGET,
+  describeEntry,
+  formatBytes,
+  summarizeTree,
+  unreachablePaths
+} from "./chunk-ZIUW7UEA.js";
+export {
+  COLLAPSE_AT,
+  MEASURE_BUDGET,
+  describeEntry,
+  formatBytes,
+  summarizeTree,
+  unreachablePaths
+};

package/dist/index.js

@@ -1,6 +1,11 @@
+import {
+  describeEntry,
+  summarizeTree
+} from "./chunk-ZIUW7UEA.js";
+
 // src/index.ts
 import { Command } from "commander";
-import chalk from "chalk";
+import chalk2 from "chalk";
 import fs4 from "fs";
 import path4 from "path";
 import { execSync } from "child_process";
@@ -192,6 +197,26 @@ function pinRuntimeImage(targetDir, version) {
   return { pinned: true, tag: version };
 }
 
+// src/banner.ts
+import chalk from "chalk";
+var PREFIX = "   \u25C6 Create ObjectStack ";
+var MIN_INNER_WIDTH = 35;
+var MIN_TRAILING_PAD = 3;
+function renderVersionBanner(version) {
+  const versionLabel = `v${version}`;
+  const innerWidth = Math.max(
+    MIN_INNER_WIDTH,
+    PREFIX.length + versionLabel.length + MIN_TRAILING_PAD
+  );
+  const trailingPad = innerWidth - PREFIX.length - versionLabel.length;
+  const border = "\u2550".repeat(innerWidth);
+  return [
+    chalk.bold.cyan(`  \u2554${border}\u2557`),
+    chalk.bold.cyan("  \u2551") + chalk.bold(PREFIX) + chalk.dim(versionLabel) + chalk.bold.cyan(`${" ".repeat(trailingPad)}\u2551`),
+    chalk.bold.cyan(`  \u255A${border}\u255D`)
+  ];
+}
+
 // src/index.ts
 var __filename2 = fileURLToPath(import.meta.url);
 var __dirname2 = path4.dirname(__filename2);
@@ -220,24 +245,24 @@ function readCliVersion() {
   }
 }
 function printHeader(title) {
-  console.log(chalk.bold(`
+  console.log(chalk2.bold(`
 \u25C6 ${title}`));
-  console.log(chalk.dim("\u2500".repeat(40)));
+  console.log(chalk2.dim("\u2500".repeat(40)));
 }
 function printKV(key, value) {
-  console.log(`  ${chalk.dim(key + ":")} ${chalk.white(value)}`);
+  console.log(`  ${chalk2.dim(key + ":")} ${chalk2.white(value)}`);
 }
 function printSuccess(msg) {
-  console.log(chalk.green(`  \u2713 ${msg}`));
+  console.log(chalk2.green(`  \u2713 ${msg}`));
 }
 function printError(msg) {
-  console.log(chalk.red(`  \u2717 ${msg}`));
+  console.log(chalk2.red(`  \u2717 ${msg}`));
 }
 function printStep(msg) {
-  console.log(chalk.yellow(`  \u2192 ${msg}`));
+  console.log(chalk2.yellow(`  \u2192 ${msg}`));
 }
 function printWarning(msg) {
-  console.log(chalk.yellow(`  \u26A0 ${msg}`));
+  console.log(chalk2.yellow(`  \u26A0 ${msg}`));
 }
 function detectPackageManager() {
   try {
@@ -328,6 +353,49 @@ function writeAgentGuides(targetDir, title, projectName) {
   fs4.mkdirSync(path4.dirname(copilotPath), { recursive: true });
   writeIfAbsent(copilotPath, rendered);
 }
+function topLevelNames(dir) {
+  try {
+    return new Set(fs4.readdirSync(dir));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function printCreatedSummary(targetDir, opts) {
+  const entries = summarizeTree(targetDir);
+  if (entries.length === 0) return;
+  console.log(
+    chalk2.bold(opts.wasEmpty ? "  Created files:" : "  Project contents:")
+  );
+  if (!opts.wasEmpty) {
+    console.log(
+      chalk2.dim("    (the directory already had contents; this lists all of it)")
+    );
+  }
+  const isSkillPath = (p) => opts.skillPaths.has(p.split("/")[0]);
+  const width = Math.min(
+    44,
+    Math.max(...entries.map((e) => e.path.length)) + 2
+  );
+  let flagged = false;
+  for (const entry of entries) {
+    const note = describeEntry(entry);
+    const flag = isSkillPath(entry.path);
+    if (flag) flagged = true;
+    const pad = note || flag ? entry.path.padEnd(width) : entry.path;
+    const line = `    + ${pad}${note ? chalk2.dim(note) : ""}`;
+    console.log(chalk2.green(line) + (flag ? chalk2.yellow("  \u26A0 skills") : ""));
+  }
+  if (flagged) {
+    console.log("");
+    console.log(
+      chalk2.yellow("  \u26A0 Skill files run with your coding agent's full permissions.")
+    );
+    console.log(
+      chalk2.dim("    Review the paths marked \u26A0 above before letting an agent use them.")
+    );
+  }
+  console.log("");
+}
 function writeIfAbsent(filePath, contents) {
   try {
     fs4.writeFileSync(filePath, contents, { flag: "wx" });
@@ -341,23 +409,21 @@ var program = new Command().name("create-objectstack").description("Create a new
   "blank"
 ).option("--skip-install", "Skip dependency installation").option("--skip-skills", "Skip installing ObjectStack AI skills").action((name, options) => {
   console.log("");
-  console.log(chalk.bold.cyan("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-  console.log(chalk.bold.cyan("  \u2551") + chalk.bold("   \u25C6 Create ObjectStack ") + chalk.dim("v6.x") + chalk.bold.cyan("       \u2551"));
-  console.log(chalk.bold.cyan("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+  for (const line of renderVersionBanner(readCliVersion())) console.log(line);
   printHeader("New Environment");
   const lookup = lookupTemplate(options.template);
   if (lookup.kind !== "found") {
     if (lookup.kind === "retired") {
       printError(`Template "${lookup.name}" has been retired and is no longer available.`);
       console.log(
-        chalk.dim(
+        chalk2.dim(
           "  It was delisted from the ObjectStack template marketplace and is no longer maintained."
         )
       );
     } else {
       printError(`Unknown template: ${lookup.name}`);
     }
-    console.log(chalk.dim(`  Available: ${templateNames().join(", ")}`));
+    console.log(chalk2.dim(`  Available: ${templateNames().join(", ")}`));
     process.exit(1);
   }
   const template = lookup.template;
@@ -366,6 +432,7 @@ var program = new Command().name("create-objectstack").description("Create a new
   const namespace = sanitizeNamespace(projectName);
   const targetDir = name ? path4.resolve(cwd, name) : cwd;
   const isCurrentDir = targetDir === cwd;
+  const pm = detectPackageManager();
   printKV("Environment", projectName);
   printKV("Namespace", namespace);
   printKV("Template", `${options.template} \u2014 ${template.description}`);
@@ -378,28 +445,22 @@ var program = new Command().name("create-objectstack").description("Create a new
       process.exit(1);
     }
   }
+  const targetWasEmpty = topLevelNames(targetDir).size === 0;
   try {
     fs4.mkdirSync(targetDir, { recursive: true });
     const createdFiles = loadBundled(template.source.dir, targetDir);
     rewriteProjectIdentity(targetDir, projectName, namespace);
-    console.log(chalk.bold("  Created files:"));
-    for (const f of createdFiles.slice(0, 20)) {
-      console.log(chalk.green(`    + ${f}`));
-    }
-    if (createdFiles.length > 20) {
-      console.log(chalk.dim(`    \u2026 and ${createdFiles.length - 20} more`));
-    }
+    printSuccess(`Template files written (${createdFiles.length})`);
     console.log("");
     if (!options.skipInstall) {
       printStep("Installing dependencies...");
       let installed = false;
       try {
-        const pm = detectPackageManager();
         execSync(`${pm} install`, { stdio: "inherit", cwd: targetDir });
         installed = true;
         console.log("");
       } catch {
-        printWarning("Dependency installation failed. Run `npm install` manually.");
+        printWarning(`Dependency installation failed. Run \`${pm} install\` manually.`);
         console.log("");
       }
       if (installed) {
@@ -417,6 +478,7 @@ var program = new Command().name("create-objectstack").description("Create a new
         }
       }
     }
+    const beforeSkills = topLevelNames(targetDir);
     if (!options.skipInstall && !options.skipSkills) {
       printStep("Installing AI skills for your coding agent...");
       try {
@@ -432,22 +494,29 @@ var program = new Command().name("create-objectstack").description("Create a new
         console.log("");
       }
     }
+    const skillPaths = new Set(
+      [...topLevelNames(targetDir)].filter((p) => !beforeSkills.has(p))
+    );
+    printCreatedSummary(targetDir, { wasEmpty: targetWasEmpty, skillPaths });
     printSuccess("Environment created!");
     console.log("");
-    console.log(chalk.bold("  Next steps:"));
+    console.log(chalk2.bold("  Next steps:"));
     if (!isCurrentDir) {
-      console.log(chalk.dim(`    cd ${name}`));
+      console.log(chalk2.dim(`    cd ${name}`));
     }
     if (options.skipInstall) {
-      console.log(chalk.dim("    npm install"));
+      console.log(chalk2.dim(`    ${pm} install`));
     }
-    console.log(chalk.dim("    npm run dev           # Start development server"));
-    console.log(chalk.dim("    npm run validate      # Verify metadata: schema + predicates + bindings"));
-    console.log(chalk.dim("                          # (run after every metadata edit \u2014 see AGENTS.md)"));
+    const devLabel = `${pm} run dev`;
+    const validateLabel = `${pm} run validate`;
+    const labelWidth = Math.max(devLabel.length, validateLabel.length) + 3;
+    console.log(chalk2.dim(`    ${devLabel.padEnd(labelWidth)}# Start development server`));
+    console.log(chalk2.dim(`    ${validateLabel.padEnd(labelWidth)}# Verify metadata: schema + predicates + bindings`));
+    console.log(chalk2.dim(`    ${" ".repeat(labelWidth)}# (run after every metadata edit \u2014 see AGENTS.md)`));
     if (options.skipInstall || options.skipSkills) {
       console.log("");
-      console.log(chalk.bold("  AI Skills (recommended):"));
-      console.log(chalk.dim("    npx skills add objectstack-ai/objectstack/skills"));
+      console.log(chalk2.bold("  AI Skills (recommended):"));
+      console.log(chalk2.dim("    npx skills add objectstack-ai/objectstack/skills"));
     }
     console.log("");
   } catch (error) {

package/dist/templates/AGENTS.md

@@ -96,6 +96,6 @@ Skills are triggered automatically based on task context:
 
 ## Learn More
 
-- [ObjectStack Documentation](https://objectstack.com/docs)
+- [ObjectStack Documentation](https://objectstack.ai/docs)
 - [GitHub: objectstack-ai/objectstack](https://github.com/objectstack-ai/objectstack)
 - [Skills CLI](https://skills.sh/) — Manage AI skills across agents

package/dist/templates/blank/Dockerfile

@@ -7,7 +7,7 @@
 #     my-app
 #
 # Or run the full app + Postgres stack: see docker-compose.yml.
-# Docs: https://docs.objectstack.ai/docs/deployment/self-hosting
+# Docs: https://objectstack.ai/docs/deployment/self-hosting
 
 # ── Build stage: compile TypeScript metadata to the artifact ─────────
 FROM node:22-slim AS build
@@ -20,7 +20,7 @@ RUN npx os build              # → dist/objectstack.json
 # ── Runtime: the official ObjectStack runtime image ──────────────────
 # Ships Node + @objectstack/cli with `os start`, a non-root user, the
 # /api/v1/health HEALTHCHECK, and OS_ARTIFACT_PATH/OS_PORT preset (port 8080)
-# — see docker/README.md in the framework repo.
+# — see the self-hosting guide linked above.
 #
 # Dependencies were not installed while scaffolding, so the tag below could
 # not be resolved for you. `latest` floats to whatever release is newest,

package/dist/templates/blank/README.md

@@ -9,6 +9,11 @@ pnpm install
 pnpm dev
 ```
 
+After editing any metadata (an object, view, flow, …), run `pnpm validate` —
+see [Verify your changes](#verify-your-changes) below. It is the one command
+this project's `AGENTS.md` calls unskippable: it catches mistakes that
+otherwise fail silently at runtime.
+
 The REST API is served at `http://localhost:3000/api/v1`. Data endpoints
 require a session — the dev server seeds a login-ready admin
 (`admin@objectos.ai` / `admin123`) on an empty database:
@@ -21,6 +26,23 @@ curl -c cookies.txt -X POST http://localhost:3000/api/v1/auth/sign-in/email \
 curl -b cookies.txt "http://localhost:3000/api/v1/data/<your_object>"
 ```
 
+## The Console — this starter ships no app
+
+`pnpm dev` also serves the admin Console at `http://localhost:3000/_console/`,
+and prints the link on boot. Open it and you will see the platform's own apps
+(Setup, Account) and **not** the object in `src/objects/` — this starter ships
+objects only, with no app and no views.
+
+That is the intended starting point, not a broken install. The object is live
+the whole time — the `curl` above returns it, and an MCP client can read and
+write it. What it has no route into is the Console's navigation.
+
+**An object appears in Console navigation only when an app lists it.** Add an
+`*.app.ts` under `src/apps/` (plus the views it points at), and the Console
+renders it after the next `pnpm dev` rebuild. The `objectstack-ui` skill covers
+the shape; describing the app you want to your coding agent is the intended
+path.
+
 ## Your app is an MCP server
 
 Every ObjectStack app is itself a
@@ -36,7 +58,7 @@ claude mcp add --transport http my-app http://localhost:3000/api/v1/mcp
 
 Set `OS_MCP_SERVER_ENABLED=false` to turn it off. This is the *serve* side — the
 reverse of the `mcp` connector below (which lets your app *call* other MCP
-servers). See [Connect an MCP Client](https://docs.objectstack.ai/docs/ai/connect-mcp)
+servers). See [Connect an MCP Client](https://objectstack.ai/docs/ai/connect-mcp)
 for OAuth, API keys, and which objects/actions become tools.
 
 ## Layout
@@ -57,9 +79,11 @@ can call an external system from a flow as pure metadata — no host code:
 
 Add a `connectors:` entry that names one of these `provider`s and the
 `automation` capability materializes it into a live, dispatchable connector at
-boot (ADR-0097); a flow's `connector_action` node then calls it. To add a brand
-connector (e.g. Slack), install its package and add `new ConnectorSlackPlugin()`
-to `plugins:`; to drop a provider, remove its plugin.
+boot — see [Automation → Connectors](https://objectstack.ai/docs/automation/connectors)
+for how that materialization works; a flow's `connector_action` node then
+calls it. To add a brand connector (e.g. Slack), install its package and add
+`new ConnectorSlackPlugin()` to `plugins:`; to drop a provider, remove its
+plugin.
 
 > **Security — declarative MCP over stdio.** An `mcp` connector whose transport
 > spawns a local process (`stdio`) is denied by default, because the command
@@ -67,7 +91,7 @@ to `plugins:`; to drop a provider, remove its plugin.
 > `new ConnectorMcpPlugin({ declarativeStdio: ['node'] })`; `http` transports
 > need no opt-in.
 
-See [Automation → Flows](https://docs.objectstack.ai/docs/automation/flows) for
+See [Automation → Flows](https://objectstack.ai/docs/automation/flows) for
 the full connector and `connector_action` guide.
 
 ## Verify your changes
@@ -105,7 +129,7 @@ curl -fsS http://localhost:8080/api/v1/health
 ```
 
 Bare Node, Kubernetes, reverse-proxy wiring, and the required secrets are
-covered in [Self-Hosted Deployment](https://docs.objectstack.ai/docs/deployment/self-hosting).
+covered in [Self-Hosted Deployment](https://objectstack.ai/docs/deployment/self-hosting).
 
 ## Next steps
 
@@ -114,5 +138,5 @@ covered in [Self-Hosted Deployment](https://docs.objectstack.ai/docs/deployment/
 - Add a flow or automation: see `objectstack-automation`.
 - Add an AI agent: see `objectstack-ai`.
 
-Skills live in `skills/` in the ObjectStack framework repo and in the in-IDE
-assistant catalog.
+Skills are installed with `npx skills add objectstack-ai/objectstack/skills`
+(see `AGENTS.md`) and also show up in the in-IDE assistant catalog.

package/dist/templates/blank/docker-compose.yml

@@ -4,7 +4,7 @@
 # POSTGRES_PASSWORD / OS_AUTH_SECRET / OS_SECRET_KEY (generate secrets with
 # `openssl rand -hex 32`), then `docker compose up -d`.
 #
-# Docs: https://docs.objectstack.ai/docs/deployment/self-hosting
+# Docs: https://objectstack.ai/docs/deployment/self-hosting
 
 services:
   app:

package/dist/templates/blank/objectstack.config.ts

@@ -12,27 +12,31 @@ export default defineStack({
     type: 'app',
     name: 'Blank Starter',
     description: 'Minimal ObjectStack environment — a clean slate for building.',
-    // Protocol compatibility range (ADR-0087 D1): lets an incompatible runtime
-    // refuse this package at the boundary with the exact migration command,
-    // instead of crashing later. Kept in lockstep with releases by
-    // scripts/sync-template-versions.mjs.
+    // Protocol compatibility range: the metadata-protocol major this app is
+    // authored against. The runtime checks it before it loads anything, so a
+    // runtime outside the range refuses this app at the boundary with the exact
+    // migration command instead of crashing later. Scaffolding stamped it to
+    // match the ObjectStack version you installed — change it when you
+    // deliberately move to a new protocol major, not to silence a mismatch.
+    // Guide: https://objectstack.ai/docs/upgrading
     engines: { protocol: '^17' },
   },
 
-  // `automation` backs flow execution and, per ADR-0097, materializes any
-  // declarative `connectors:` entry into a live, dispatchable connector at boot.
-  // The connector executors below register their provider factories with it —
-  // without `automation` loaded they have nowhere to register and boot fails, so
-  // keep this capability whenever `plugins:` lists a connector.
+  // `automation` backs flow execution and materializes any declarative
+  // `connectors:` entry into a live, dispatchable connector at boot. The
+  // connector executors below register their provider factories with it —
+  // without `automation` loaded they have nowhere to register and boot fails,
+  // so keep this capability whenever `plugins:` lists a connector.
   requires: ['automation'],
 
-  // Generic connector executors (ADR-0022/0023/0024 + ADR-0097), default-present
-  // so you can add a `connectors:` entry naming `provider: 'rest' | 'openapi' |
-  // 'mcp'` and have it materialize with zero host code. Zero-arg = contribute the
-  // provider factory only. Brand connectors (Slack, …) stay marketplace/opt-in.
-  // Security (#3055): a declarative `mcp` stdio transport spawns a local process
-  // from metadata and is denied by default — opt in per host with
+  // Generic connector executors, default-present so you can add a `connectors:`
+  // entry naming `provider: 'rest' | 'openapi' | 'mcp'` and have it materialize
+  // with zero host code. Zero-arg = contribute the provider factory only. Brand
+  // connectors (Slack, …) stay marketplace/opt-in.
+  // Security: a declarative `mcp` stdio transport spawns a local process from
+  // metadata, so it is denied by default — opt in per host with
   // `new ConnectorMcpPlugin({ declarativeStdio: ['<trusted-command>'] })`.
+  // Authoring guide: https://objectstack.ai/docs/automation/connectors
   plugins: [
     new ConnectorRestPlugin(),
     new ConnectorOpenApiPlugin(),

package/dist/templates/blank/package.json

@@ -3,6 +3,9 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
+  "engines": {
+    "pnpm": ">=10.15"
+  },
   "scripts": {
     "dev": "objectstack dev",
     "start": "objectstack start",

package/dist/templates/blank/pnpm-workspace.yaml

@@ -1,11 +1,20 @@
+# An explicit EMPTY workspace: this project has no member packages, so
+# this file is settings-only. The key is not decoration — pnpm 9.x and
+# 10.0–10.4 parse this file BEFORE they read `engines`, and refuse a file
+# without a `packages:` key outright ("ERROR packages field missing or
+# empty") before resolving a single dependency.
+# Not `packages: ['.']`: that would declare this project a workspace
+# MEMBER — a monorepo root, which it is not.
+packages: []
+
 # pnpm does not run dependency install scripts unless they are approved here.
 # Without this file a fresh `pnpm install` on pnpm 11 exits 1 with
 # ERR_PNPM_IGNORED_BUILDS — pnpm 10 only warned, pnpm 11 made it a hard error.
 #
 # Both keys are needed; they are read by different pnpm versions:
-#   allowBuilds             pnpm >= 10.31 and pnpm 11+. pnpm 11 reads ONLY this
+#   allowBuilds             pnpm >= 10.26 and pnpm 11+. pnpm 11 reads ONLY this
 #                           one — onlyBuiltDependencies alone still errors.
-#   onlyBuiltDependencies   pnpm 10.0–10.30, which do not understand allowBuilds.
+#   onlyBuiltDependencies   pnpm 10.0–10.25, which do not understand allowBuilds.
 #
 # better-sqlite3 is the native sqlite driver (@objectstack/driver-sql's optional
 # dependency); esbuild compiles objectstack.config.ts. Both ship prebuilt
@@ -21,3 +30,53 @@ onlyBuiltDependencies:
 allowBuilds:
   better-sqlite3: true
   esbuild: true
+
+# Some third-party peer ranges resolve outside what their declaring package
+# states. `pnpm install` reports each one as an unmet peer — which would be the
+# first thing a brand-new project shows you — and none is a real
+# incompatibility:
+#
+#   better-auth peers better-sqlite3 ^12.0.0 while the tree resolves 13.x. That
+#   peer is optional and covers handing better-auth a raw better-sqlite3
+#   `Database`; ObjectStack hands it an ObjectQL adapter instead, so nothing
+#   here goes down that path. Measured on the configuration the range does
+#   cover — better-auth's own Kysely dialect, running its migrations, sign-up,
+#   sign-in and adapter find/update/delete — 1.7.1 behaves identically on
+#   better-sqlite3 13.0.3 and on 12.11.1. The upstream range is stale.
+#
+#   @better-auth/scim (held at a release candidate deliberately, not by
+#   neglect) peers better-call at an exact 1.3.7, while better-auth itself
+#   depends on 1.4.0. A better-auth plugin has to share the host's better-call
+#   instance, so the single 1.4.0 copy is the correct resolution rather than a
+#   skew to repair. This entry retires when SCIM moves off the rc: stable
+#   @better-auth/scim 1.7.1 already peers better-call 1.4.0.
+#
+#   @better-auth/core, @better-auth/oauth-provider, @better-auth/scim and
+#   @better-auth/sso each peer an exact @better-auth/utils 0.4.2, while the
+#   tree hands them 0.5.0 — because better-call, better-auth's own HTTP layer,
+#   depends on ^0.5.0, and that is the copy your project's plugins resolve
+#   their peer against. Measured on the surface the range governs: those four
+#   import three symbols in total (base64/base64Url, createHash and, in core,
+#   createRandomStringGenerator), 0.5.0 declares all three unchanged, and on
+#   the inputs those call sites pass the two versions return identical values —
+#   checked again end to end through better-auth with the sso, oauth-provider
+#   and scim plugins, where both resolutions produce the same sign-up, sign-in,
+#   session, OAuth metadata, PKCE challenge and SCIM/SSO responses. Forcing
+#   utils back to 0.4.2 instead would push better-call off its own declared
+#   ^0.5.0 — trading four reported skews for one real one.
+#   Reported by pnpm 10.15–10.30; pnpm 10.31 changed peer resolution so all
+#   four land on 0.4.2 on their own. These four entries retire when the pnpm
+#   floor reaches 10.31, or when the four packages accept 0.5.0 upstream —
+#   NOT with the SCIM rc pin above, which the utils skew outlives.
+#
+# These suppress the report only: no resolution moves, and the lockfile is
+# byte-identical with and without this block.
+
+peerDependencyRules:
+  allowedVersions:
+    'better-auth>better-sqlite3': '13'
+    '@better-auth/scim>better-call': '1.4.0'
+    '@better-auth/core>@better-auth/utils': '0.5.0'
+    '@better-auth/oauth-provider>@better-auth/utils': '0.5.0'
+    '@better-auth/scim>@better-auth/utils': '0.5.0'
+    '@better-auth/sso>@better-auth/utils': '0.5.0'

package/dist/templates/blank/src/objects/note.object.ts

@@ -21,8 +21,12 @@ export const Note = ObjectSchema.create({
     }),
   },
 
-  // Org-wide default (OWD): who can see records they don't own. The security
-  // posture gate (ADR-0090) requires an explicit, authored decision here.
+  // Org-wide default (OWD): who can see records they don't own. `private` is
+  // owner-only until access is widened by a permission grant or a sharing rule.
+  // Declaring it is required, deliberately: `objectstack build` refuses an
+  // object that declares no OWD, so the baseline is always an authored decision
+  // rather than an accident. The other values, and how to widen access safely:
+  // https://objectstack.ai/docs/permissions/sharing-rules
   sharingModel: 'private',
 
   enable: {

package/package.json

@@ -1,10 +1,16 @@
 {
   "name": "create-objectstack",
-  "version": "17.1.0",
+  "version": "17.2.0",
   "description": "Create a new ObjectStack project — npx create-objectstack",
   "bin": {
     "create-objectstack": "./bin/create-objectstack.js"
   },
+  "exports": {
+    "./created-summary": {
+      "types": "./dist/created-summary.d.ts",
+      "import": "./dist/created-summary.js"
+    }
+  },
   "keywords": [
     "objectstack",
     "create",