narrow to showcase demo + dogfood proof — template preset waits for the 15.1.0 publish

The scaffold-e2e job installs the generated app from the npm REGISTRY, and
ConnectorOpenApiPlugin (and the #3055 declarativeStdio option) only exist in
the unpublished 15.1.0 (queued in the Changesets release PR). A template must
not reference unpublished APIs — the same failure would hit real
'npm create objectstack' users. Reverted the template files + changeset;
once 15.1.0 publishes, the template's ^15.0.0 pins resolve to it and the
preset piece lands as a small follow-up. flows.mdx reworded to describe the
mechanism without the scaffold claim.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Pbmw3pMqNJfPbkvwh9Fkjs

Author: claude

.changeset/adr-0097-default-preset.md

@@ -117,7 +117,7 @@ Each node performs a specific action in the flow.
 | `map` | Sequential multi-instance — run a per-item subflow for each element, one at a time (each may pause); batch approval (ADR-0039) |
 | `connector_action` | Execute an external connector action |
 
-`connector_action` dispatches against the runtime **connector registry**, which connector plugins populate. Scaffolded apps ship the three **generic executors** — `rest`, `openapi`, and `mcp` — in their default `plugins:` (remove any you don't want), so a declarative `connectors:` entry that names a `provider` is materialized into a live, dispatchable connector at boot with no plugin code (ADR-0097). Brand connectors (Slack, …) are installed separately. One security note: a declarative `mcp` instance using a **stdio** transport spawns a local process from metadata and is therefore denied by default — the host opts in with `new ConnectorMcpPlugin({ declarativeStdio: ['<trusted-command>'] })`; `http` transports need no opt-in.
+`connector_action` dispatches against the runtime **connector registry**, which connector plugins populate. The three **generic executors** — `rest`, `openapi`, and `mcp` — double as provider factories: with them in your app's `plugins:`, a declarative `connectors:` entry that names a `provider` is materialized into a live, dispatchable connector at boot with no plugin code (ADR-0097; the showcase example wires all three). Brand connectors (Slack, …) are installed separately. One security note: a declarative `mcp` instance using a **stdio** transport spawns a local process from metadata and is therefore denied by default — the host opts in with `new ConnectorMcpPlugin({ declarativeStdio: ['<trusted-command>'] })`; `http` transports need no opt-in.
 
 ### Node Structure
 

content/docs/automation/flows.mdx

@@ -26,27 +26,6 @@ curl -b cookies.txt "http://localhost:3000/api/v1/data/<your_object>"
 - `objectstack.config.ts` — environment manifest (objects, API, plugins)
 - `src/objects/` — object definitions (one file per object)
 
-## Connectors (default providers)
-
-The template ships the three generic connector executors — `rest`, `openapi`,
-and `mcp` — in `plugins:`. With them installed, a declarative `connectors:`
-entry that names a `provider` becomes a live, dispatchable connector at boot
-(pure metadata, no plugin code):
-
-```ts
-connectors: [{
-  name: 'billing',
-  provider: 'openapi',
-  providerConfig: { spec: './specs/billing-openapi.json', baseUrl: 'https://billing.example.com' },
-  auth: { type: 'bearer', credentialRef: 'BILLING_API_TOKEN' },  // env var name — never an inline secret
-}]
-```
-
-Remove executors you don't want from `plugins:`. Note: a declarative `mcp`
-instance over a **stdio** transport spawns a local process from metadata and is
-denied by default — opt in with
-`new ConnectorMcpPlugin({ declarativeStdio: ['<trusted-command>'] })`.
-
 ## Verify your changes
 
 After editing any metadata, run:

packages/create-objectstack/src/templates/blank/README.md

@@ -1,7 +1,4 @@
 import { defineStack } from '@objectstack/spec';
-import { ConnectorMcpPlugin } from '@objectstack/connector-mcp';
-import { ConnectorOpenApiPlugin } from '@objectstack/connector-openapi';
-import { ConnectorRestPlugin } from '@objectstack/connector-rest';
 import * as objects from './src/objects/index.js';
 
 export default defineStack({
@@ -19,19 +16,4 @@ export default defineStack({
     engines: { protocol: '^15' },
   },
   objects: Object.values(objects),
-
-  // The three GENERIC connector executors (rest / openapi / mcp) ship in the
-  // default preset (#3056, ADR-0097): with them installed, a declarative
-  // `connectors:` entry that names a `provider` materializes into a live,
-  // dispatchable connector at boot — integrations stay pure metadata, no
-  // plugin code required. Zero-arg = each contributes only its provider
-  // factory (an unused factory costs nothing at runtime). Remove any you
-  // don't want; brand connectors (Slack, …) are installed separately.
-  //
-  // Security note (#3055): a declarative `mcp` instance with a STDIO
-  // transport spawns a local process from metadata, so it is denied by
-  // default — opt in per host with
-  // `new ConnectorMcpPlugin({ declarativeStdio: ['<trusted-command>'] })`.
-  // http transports need no opt-in.
-  plugins: [new ConnectorRestPlugin(), new ConnectorOpenApiPlugin(), new ConnectorMcpPlugin()],
 });

packages/create-objectstack/src/templates/blank/objectstack.config.ts

@@ -12,9 +12,6 @@
   },
   "dependencies": {
     "@objectstack/spec": "^15.0.0",
-    "@objectstack/connector-mcp": "^15.0.0",
-    "@objectstack/connector-openapi": "^15.0.0",
-    "@objectstack/connector-rest": "^15.0.0",
     "@objectstack/runtime": "^15.0.0",
     "@objectstack/driver-memory": "^15.0.0",
     "@objectstack/plugin-hono-server": "^15.0.0"