create-objectstack 17.1.0 → 17.3.0

package/dist/templates/blank/README.md

@@ -9,6 +9,11 @@ pnpm install
 pnpm dev
 ```
 
+After editing any metadata (an object, view, flow, …), run `pnpm validate` —
+see [Verify your changes](#verify-your-changes) below. It is the one command
+this project's `AGENTS.md` calls unskippable: it catches mistakes that
+otherwise fail silently at runtime.
+
 The REST API is served at `http://localhost:3000/api/v1`. Data endpoints
 require a session — the dev server seeds a login-ready admin
 (`admin@objectos.ai` / `admin123`) on an empty database:
@@ -21,6 +26,23 @@ curl -c cookies.txt -X POST http://localhost:3000/api/v1/auth/sign-in/email \
 curl -b cookies.txt "http://localhost:3000/api/v1/data/<your_object>"
 ```
 
+## The Console — this starter ships no app
+
+`pnpm dev` also serves the admin Console at `http://localhost:3000/_console/`,
+and prints the link on boot. Open it and you will see the platform's own apps
+(Setup, Account) and **not** the object in `src/objects/` — this starter ships
+objects only, with no app and no views.
+
+That is the intended starting point, not a broken install. The object is live
+the whole time — the `curl` above returns it, and an MCP client can read and
+write it. What it has no route into is the Console's navigation.
+
+**An object appears in Console navigation only when an app lists it.** Add an
+`*.app.ts` under `src/apps/` (plus the views it points at), and the Console
+renders it after the next `pnpm dev` rebuild. The `objectstack-ui` skill covers
+the shape; describing the app you want to your coding agent is the intended
+path.
+
 ## Your app is an MCP server
 
 Every ObjectStack app is itself a
@@ -36,7 +58,7 @@ claude mcp add --transport http my-app http://localhost:3000/api/v1/mcp
 
 Set `OS_MCP_SERVER_ENABLED=false` to turn it off. This is the *serve* side — the
 reverse of the `mcp` connector below (which lets your app *call* other MCP
-servers). See [Connect an MCP Client](https://docs.objectstack.ai/docs/ai/connect-mcp)
+servers). See [Connect an MCP Client](https://objectstack.ai/docs/ai/connect-mcp)
 for OAuth, API keys, and which objects/actions become tools.
 
 ## Layout
@@ -57,9 +79,11 @@ can call an external system from a flow as pure metadata — no host code:
 
 Add a `connectors:` entry that names one of these `provider`s and the
 `automation` capability materializes it into a live, dispatchable connector at
-boot (ADR-0097); a flow's `connector_action` node then calls it. To add a brand
-connector (e.g. Slack), install its package and add `new ConnectorSlackPlugin()`
-to `plugins:`; to drop a provider, remove its plugin.
+boot — see [Automation → Connectors](https://objectstack.ai/docs/automation/connectors)
+for how that materialization works; a flow's `connector_action` node then
+calls it. To add a brand connector (e.g. Slack), install its package and add
+`new ConnectorSlackPlugin()` to `plugins:`; to drop a provider, remove its
+plugin.
 
 > **Security — declarative MCP over stdio.** An `mcp` connector whose transport
 > spawns a local process (`stdio`) is denied by default, because the command
@@ -67,7 +91,7 @@ to `plugins:`; to drop a provider, remove its plugin.
 > `new ConnectorMcpPlugin({ declarativeStdio: ['node'] })`; `http` transports
 > need no opt-in.
 
-See [Automation → Flows](https://docs.objectstack.ai/docs/automation/flows) for
+See [Automation → Flows](https://objectstack.ai/docs/automation/flows) for
 the full connector and `connector_action` guide.
 
 ## Verify your changes
@@ -105,7 +129,7 @@ curl -fsS http://localhost:8080/api/v1/health
 ```
 
 Bare Node, Kubernetes, reverse-proxy wiring, and the required secrets are
-covered in [Self-Hosted Deployment](https://docs.objectstack.ai/docs/deployment/self-hosting).
+covered in [Self-Hosted Deployment](https://objectstack.ai/docs/deployment/self-hosting).
 
 ## Next steps
 
@@ -114,5 +138,5 @@ covered in [Self-Hosted Deployment](https://docs.objectstack.ai/docs/deployment/
 - Add a flow or automation: see `objectstack-automation`.
 - Add an AI agent: see `objectstack-ai`.
 
-Skills live in `skills/` in the ObjectStack framework repo and in the in-IDE
-assistant catalog.
+Skills are installed with `npx skills add objectstack-ai/objectstack/skills`
+(see `AGENTS.md`) and also show up in the in-IDE assistant catalog.

package/dist/templates/blank/docker-compose.yml

@@ -4,7 +4,7 @@
 # POSTGRES_PASSWORD / OS_AUTH_SECRET / OS_SECRET_KEY (generate secrets with
 # `openssl rand -hex 32`), then `docker compose up -d`.
 #
-# Docs: https://docs.objectstack.ai/docs/deployment/self-hosting
+# Docs: https://objectstack.ai/docs/deployment/self-hosting
 
 services:
   app:

package/dist/templates/blank/objectstack.config.ts

@@ -12,27 +12,31 @@ export default defineStack({
     type: 'app',
     name: 'Blank Starter',
     description: 'Minimal ObjectStack environment — a clean slate for building.',
-    // Protocol compatibility range (ADR-0087 D1): lets an incompatible runtime
-    // refuse this package at the boundary with the exact migration command,
-    // instead of crashing later. Kept in lockstep with releases by
-    // scripts/sync-template-versions.mjs.
+    // Protocol compatibility range: the metadata-protocol major this app is
+    // authored against. The runtime checks it before it loads anything, so a
+    // runtime outside the range refuses this app at the boundary with the exact
+    // migration command instead of crashing later. Scaffolding stamped it to
+    // match the ObjectStack version you installed — change it when you
+    // deliberately move to a new protocol major, not to silence a mismatch.
+    // Guide: https://objectstack.ai/docs/upgrading
     engines: { protocol: '^17' },
   },
 
-  // `automation` backs flow execution and, per ADR-0097, materializes any
-  // declarative `connectors:` entry into a live, dispatchable connector at boot.
-  // The connector executors below register their provider factories with it —
-  // without `automation` loaded they have nowhere to register and boot fails, so
-  // keep this capability whenever `plugins:` lists a connector.
+  // `automation` backs flow execution and materializes any declarative
+  // `connectors:` entry into a live, dispatchable connector at boot. The
+  // connector executors below register their provider factories with it —
+  // without `automation` loaded they have nowhere to register and boot fails,
+  // so keep this capability whenever `plugins:` lists a connector.
   requires: ['automation'],
 
-  // Generic connector executors (ADR-0022/0023/0024 + ADR-0097), default-present
-  // so you can add a `connectors:` entry naming `provider: 'rest' | 'openapi' |
-  // 'mcp'` and have it materialize with zero host code. Zero-arg = contribute the
-  // provider factory only. Brand connectors (Slack, …) stay marketplace/opt-in.
-  // Security (#3055): a declarative `mcp` stdio transport spawns a local process
-  // from metadata and is denied by default — opt in per host with
+  // Generic connector executors, default-present so you can add a `connectors:`
+  // entry naming `provider: 'rest' | 'openapi' | 'mcp'` and have it materialize
+  // with zero host code. Zero-arg = contribute the provider factory only. Brand
+  // connectors (Slack, …) stay marketplace/opt-in.
+  // Security: a declarative `mcp` stdio transport spawns a local process from
+  // metadata, so it is denied by default — opt in per host with
   // `new ConnectorMcpPlugin({ declarativeStdio: ['<trusted-command>'] })`.
+  // Authoring guide: https://objectstack.ai/docs/automation/connectors
   plugins: [
     new ConnectorRestPlugin(),
     new ConnectorOpenApiPlugin(),

package/dist/templates/blank/package.json

@@ -3,6 +3,9 @@
   "version": "0.1.0",
   "private": true,
   "type": "module",
+  "engines": {
+    "pnpm": ">=10.15"
+  },
   "scripts": {
     "dev": "objectstack dev",
     "start": "objectstack start",

package/dist/templates/blank/pnpm-workspace.yaml

@@ -1,11 +1,20 @@
+# An explicit EMPTY workspace: this project has no member packages, so
+# this file is settings-only. The key is not decoration — pnpm 9.x and
+# 10.0–10.4 parse this file BEFORE they read `engines`, and refuse a file
+# without a `packages:` key outright ("ERROR packages field missing or
+# empty") before resolving a single dependency.
+# Not `packages: ['.']`: that would declare this project a workspace
+# MEMBER — a monorepo root, which it is not.
+packages: []
+
 # pnpm does not run dependency install scripts unless they are approved here.
 # Without this file a fresh `pnpm install` on pnpm 11 exits 1 with
 # ERR_PNPM_IGNORED_BUILDS — pnpm 10 only warned, pnpm 11 made it a hard error.
 #
 # Both keys are needed; they are read by different pnpm versions:
-#   allowBuilds             pnpm >= 10.31 and pnpm 11+. pnpm 11 reads ONLY this
+#   allowBuilds             pnpm >= 10.26 and pnpm 11+. pnpm 11 reads ONLY this
 #                           one — onlyBuiltDependencies alone still errors.
-#   onlyBuiltDependencies   pnpm 10.0–10.30, which do not understand allowBuilds.
+#   onlyBuiltDependencies   pnpm 10.0–10.25, which do not understand allowBuilds.
 #
 # better-sqlite3 is the native sqlite driver (@objectstack/driver-sql's optional
 # dependency); esbuild compiles objectstack.config.ts. Both ship prebuilt
@@ -21,3 +30,49 @@ onlyBuiltDependencies:
 allowBuilds:
   better-sqlite3: true
   esbuild: true
+
+# Some third-party peer ranges resolve outside what their declaring package
+# states. `pnpm install` reports each one as an unmet peer — which would be the
+# first thing a brand-new project shows you — and none is a real
+# incompatibility:
+#
+#   better-auth peers better-sqlite3 ^12.0.0 while the tree resolves 13.x. That
+#   peer is optional and covers handing better-auth a raw better-sqlite3
+#   `Database`; ObjectStack hands it an ObjectQL adapter instead, so nothing
+#   here goes down that path. Measured on the configuration the range does
+#   cover — better-auth's own Kysely dialect, running its migrations, sign-up,
+#   sign-in and adapter find/update/delete — 1.7.1 behaves identically on
+#   better-sqlite3 13.0.3 and on 12.11.1. The upstream range is stale.
+#
+#   (The '@better-auth/scim>better-call' entry that used to sit here retired
+#   with the scim release-candidate pin — stable @better-auth/scim 1.7.1 peers
+#   better-call 1.4.0 exactly, so the skew it declared away is gone.)
+#
+#   @better-auth/core, @better-auth/oauth-provider, @better-auth/scim and
+#   @better-auth/sso each peer an exact @better-auth/utils 0.4.2, while the
+#   tree hands them 0.5.0 — because better-call, better-auth's own HTTP layer,
+#   depends on ^0.5.0, and that is the copy your project's plugins resolve
+#   their peer against. Measured on the surface the range governs: those four
+#   import three symbols in total (base64/base64Url, createHash and, in core,
+#   createRandomStringGenerator), 0.5.0 declares all three unchanged, and on
+#   the inputs those call sites pass the two versions return identical values —
+#   checked again end to end through better-auth with the sso, oauth-provider
+#   and scim plugins, where both resolutions produce the same sign-up, sign-in,
+#   session, OAuth metadata, PKCE challenge and SCIM/SSO responses. Forcing
+#   utils back to 0.4.2 instead would push better-call off its own declared
+#   ^0.5.0 — trading four reported skews for one real one.
+#   Reported by pnpm 10.15–10.30; pnpm 10.31 changed peer resolution so all
+#   four land on 0.4.2 on their own. These four entries retire when the pnpm
+#   floor reaches 10.31, or when the four packages accept 0.5.0 upstream —
+#   NOT with the SCIM rc pin above, which the utils skew outlives.
+#
+# These suppress the report only: no resolution moves, and the lockfile is
+# byte-identical with and without this block.
+
+peerDependencyRules:
+  allowedVersions:
+    'better-auth>better-sqlite3': '13'
+    '@better-auth/core>@better-auth/utils': '0.5.0'
+    '@better-auth/oauth-provider>@better-auth/utils': '0.5.0'
+    '@better-auth/scim>@better-auth/utils': '0.5.0'
+    '@better-auth/sso>@better-auth/utils': '0.5.0'

package/dist/templates/blank/src/objects/note.object.ts

@@ -21,8 +21,12 @@ export const Note = ObjectSchema.create({
     }),
   },
 
-  // Org-wide default (OWD): who can see records they don't own. The security
-  // posture gate (ADR-0090) requires an explicit, authored decision here.
+  // Org-wide default (OWD): who can see records they don't own. `private` is
+  // owner-only until access is widened by a permission grant or a sharing rule.
+  // Declaring it is required, deliberately: `objectstack build` refuses an
+  // object that declares no OWD, so the baseline is always an authored decision
+  // rather than an accident. The other values, and how to widen access safely:
+  // https://objectstack.ai/docs/permissions/sharing-rules
   sharingModel: 'private',
 
   enable: {

package/package.json

@@ -1,10 +1,16 @@
 {
   "name": "create-objectstack",
-  "version": "17.1.0",
+  "version": "17.3.0",
   "description": "Create a new ObjectStack project — npx create-objectstack",
   "bin": {
     "create-objectstack": "./bin/create-objectstack.js"
   },
+  "exports": {
+    "./created-summary": {
+      "types": "./dist/created-summary.d.ts",
+      "import": "./dist/created-summary.js"
+    }
+  },
   "keywords": [
     "objectstack",
     "create",
@@ -43,7 +49,7 @@
     "node": ">=22.0.0"
   },
   "scripts": {
-    "build": "tsup",
+    "build": "tsup && node ../../scripts/check-dts-emitted.mjs",
     "typecheck": "tsc --noEmit",
     "dev": "tsup --watch",
     "test": "vitest run"