@stacksjs/defaults 0.70.229 → 0.70.230

package/views/dashboard/AUDIT.md

@@ -1,904 +1,153 @@
-# Dashboard `.stx` audit — stacksjs/stacks#1838
+# Dashboard audit
 
-_Initial audit 2026-05-04. Refreshed 2026-05-20 (second sweep) with the
-current numbers; the per-area / per-file inventory below still reflects
-the 2026-05-04 snapshot and will be regenerated on the next audit pass._
+Last refreshed: 2026-07-31
 
-## Roll-up — 2026-05-20
+This is the current verification record for `./buddy dev --dashboard`. It
+replaces the May 2026 migration inventory, whose per-file counts no longer
+described the componentized dashboard.
 
-| Metric | 2026-05-04 | 2026-05-20 | Δ |
-|---|---:|---:|---:|
-| Total `.stx` files | 110 | 113 | +3 |
-| `<script server>` blocks | 98 | **0** | −98 |
-| `<script client>` blocks | 78 | 100+ | +22 |
-| Bare `<script>` blocks (no qualifier) | 11 | 9 | −2 |
-| `window.` / `document.` lines | 168 | 78 | −90 |
-| Pages calling `useStore(…)` | 0 | 5 | +5 |
-| Pages importing a composable | 0 | 5 | +5 |
-| Stores defined under `dashboard/stores/` | 1 | 5 | +4 |
-| Composables under `dashboard/composables/` | 0 | 4 | +4 |
+## Current inventory
 
-**`<script server>` migration — complete.** Every dashboard page now
-renders against client-side state or fetches its data from an API
-endpoint. Several pages got new API endpoints in
-`storage/framework/defaults/routes/dashboard-api.ts`:
-
-- `/api/dashboard/commerce/stats` — reuses the existing
-  `CommerceDashboardAction`, exposed without auth middleware so the
-  dev dashboard can reach it
-- `/api/dashboard/models` — walks `app/Models/` + framework defaults,
-  counts rows per model
-- `/api/dashboard/models/{slug}` — first 50 rows of any single model
-
-Auth pages (`login`/`register`/`forgot-password`) also got real bug
-fixes during the conversion — their `<script server>` blocks tried to
-reassign `const` vars (always threw in strict-mode JS) and called
-`useRouter()` (a Nuxt-ism, no-op in stx).
-
-Remaining work for #1838: the 78 in-page `window.`/`document.` lines
-(mostly pre-existing vanilla event wiring under `content/_` and
-`commerce/_`) and deliverable #4 (component lift to
-`@stacksjs/components`) are the open targets.
-
-Three new pages landed since the original audit (kanban index, kanban
-`[id]`, management/permissions — see #1846 and #1845). Net `<script
-server>` count still dropped because the surrounding sweep on the existing
-pages outpaced the new arrivals.
-
-The remaining 78 DOM-access lines cluster in two patterns: pre-existing
-`document.getElementById(...)` event wiring in vanilla `<script>` blocks
-(largely under `content/_`, `commerce/_`), and the layout's own
-import-map / role-filter installer where direct DOM is appropriate. The
-in-page DOM references are the next sweep target.
-
-## Roll-up — 2026-05-04 (initial snapshot)
-
-| Metric | Count |
+| Surface | Count |
 |---|---:|
-| Total `.stx` files | 110 |
-| `<script server>` blocks | 98 |
-| `<script client>` blocks | 78 |
-| Bare `<script>` blocks (no qualifier) | 11 |
-| `window.` / `document.` lines | 168 |
-| Files importing from `stores/` | 0 |
-| Files importing `@stacksjs/components` | 0 |
-
-### Routing setup
-
-Per `dashboard/stx.config.ts`, `pagesDir: 'views'` (with `root: 'resources'`) — meaning every top-level dir under `dashboard/` is a route group. The support dirs (`components/`, `composables/`, `layouts/`, `stores/`) are the only non-routed ones.
-
-## Per-area roll-up
-
-| Area | Files | server | client | bare | DOM lines | uses store | uses components |
-|---|---:|---:|---:|---:|---:|---:|---:|
-| `_root` | 5 | 4 | 0 | 1 | 0 | 0 | 0 |
-| `access-tokens` | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
-| `actions` | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
-| `analytics` | 12 | 12 | 12 | 0 | 22 | 0 | 0 |
-| `buddy` | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
-| `cloud` | 1 | 1 | 1 | 0 | 0 | 0 | 0 |
-| `commands` | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
-| `commerce` | 27 | 25 | 21 | 2 | 18 | 0 | 0 |
-| `components` | 1 | 1 | 1 | 0 | 1 | 0 | 0 |
-| `content` | 9 | 9 | 8 | 0 | 27 | 0 | 0 |
-| `data` | 5 | 5 | 5 | 0 | 21 | 0 | 0 |
-| `dependencies` | 1 | 0 | 0 | 1 | 0 | 0 | 0 |
-| `deployments` | 2 | 2 | 1 | 0 | 0 | 0 | 0 |
-| `dns` | 1 | 1 | 1 | 0 | 1 | 0 | 0 |
-| `environment` | 1 | 0 | 0 | 1 | 2 | 0 | 0 |
-| `errors` | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
-| `functions` | 1 | 1 | 1 | 0 | 1 | 0 | 0 |
-| `health` | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
-| `inbox` | 3 | 3 | 3 | 0 | 7 | 0 | 0 |
-| `insights` | 1 | 1 | 1 | 0 | 4 | 0 | 0 |
-| `jobs` | 3 | 3 | 3 | 0 | 2 | 0 | 0 |
-| `layouts` | 2 | 1 | 2 | 0 | 15 | 0 | 0 |
-| `logs` | 1 | 1 | 1 | 0 | 2 | 0 | 0 |
-| `mailboxes` | 1 | 1 | 1 | 0 | 1 | 0 | 0 |
-| `management` | 1 | 1 | 1 | 0 | 2 | 0 | 0 |
-| `marketing` | 4 | 4 | 1 | 0 | 17 | 0 | 0 |
-| `models` | 2 | 2 | 0 | 0 | 0 | 0 | 0 |
-| `monitoring` | 1 | 1 | 1 | 0 | 0 | 0 | 0 |
-| `notifications` | 4 | 4 | 3 | 0 | 2 | 0 | 0 |
-| `packages` | 1 | 1 | 1 | 0 | 2 | 0 | 0 |
-| `queries` | 4 | 4 | 2 | 0 | 2 | 0 | 0 |
-| `queue` | 1 | 1 | 1 | 0 | 2 | 0 | 0 |
-| `realtime` | 1 | 1 | 1 | 0 | 1 | 0 | 0 |
-| `releases` | 1 | 0 | 1 | 1 | 2 | 0 | 0 |
-| `requests` | 1 | 1 | 1 | 0 | 4 | 0 | 0 |
-| `serverless` | 1 | 1 | 1 | 0 | 10 | 0 | 0 |
-| `servers` | 2 | 2 | 1 | 0 | 0 | 0 | 0 |
-| `settings` | 2 | 1 | 1 | 1 | 0 | 0 | 0 |
-| `teams` | 1 | 1 | 0 | 0 | 0 | 0 | 0 |
-
-## Per-file inventory
-
-Columns: file → `<script server>` count, `<script client>` count, bare `<script>` count, `window.`/`document.` lines, store import (✓), `@stacksjs/components` import (✓).
-
-### `_root/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `[...all].stx` | 0 | 0 | 1 | 0 |  |  |
-| `forgot-password.stx` | 1 | 0 | 0 | 0 |  |  |
-| `index.stx` | 1 | 0 | 0 | 0 |  |  |
-| `login.stx` | 1 | 0 | 0 | 0 |  |  |
-| `register.stx` | 1 | 0 | 0 | 0 |  |  |
-
-### `access-tokens/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `access-tokens/index.stx` | 0 | 0 | 1 | 0 |  |  |
-
-### `actions/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `actions/index.stx` | 0 | 0 | 1 | 0 |  |  |
-
-### `analytics/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `analytics/blog/index.stx` | 1 | 1 | 0 | 1 |  |  |
-| `analytics/browsers/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `analytics/commerce/sales/index.stx` | 1 | 1 | 0 | 1 |  |  |
-| `analytics/commerce/web/index.stx` | 1 | 1 | 0 | 1 |  |  |
-| `analytics/countries/index.stx` | 1 | 1 | 0 | 1 |  |  |
-| `analytics/devices/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `analytics/events/index.stx` | 1 | 2 | 0 | 8 |  |  |
-| `analytics/index.stx` | 1 | 0 | 0 | 0 |  |  |
-| `analytics/marketing/index.stx` | 1 | 1 | 0 | 1 |  |  |
-| `analytics/pages/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `analytics/referrers/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `analytics/web/index.stx` | 1 | 1 | 0 | 1 |  |  |
-
-### `buddy/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `buddy/index.stx` | 0 | 0 | 1 | 0 |  |  |
-
-### `cloud/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `cloud/index.stx` | 1 | 1 | 0 | 0 |  |  |
-
-### `commands/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `commands/index.stx` | 0 | 0 | 1 | 0 |  |  |
-
-### `commerce/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `commerce/categories/index.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/coupons/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `commerce/customers/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `commerce/dashboard/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `commerce/delivery/delivery-routes.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/delivery/digital-delivery.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/delivery/drivers.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/delivery/index.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/delivery/license-keys.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/delivery/shipping-methods.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/delivery/shipping-rates.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/delivery/shipping-zones.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/gift-cards/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `commerce/manufacturers/index.stx` | 1 | 0 | 0 | 0 |  |  |
-| `commerce/orders/index.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/payments/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `commerce/pos/index.stx` | 1 | 0 | 0 | 1 |  |  |
-| `commerce/printers/devices/index.stx` | 1 | 1 | 0 | 3 |  |  |
-| `commerce/printers/receipts/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `commerce/products/detail.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/products/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `commerce/reviews/index.stx` | 1 | 0 | 0 | 0 |  |  |
-| `commerce/taxes/index.stx` | 1 | 0 | 0 | 0 |  |  |
-| `commerce/units/index.stx` | 0 | 0 | 1 | 0 |  |  |
-| `commerce/variants/index.stx` | 0 | 0 | 1 | 0 |  |  |
-| `commerce/waitlist/products.stx` | 1 | 1 | 0 | 0 |  |  |
-| `commerce/waitlist/restaurant.stx` | 1 | 1 | 0 | 0 |  |  |
-
-### `components/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `components/index.stx` | 1 | 1 | 0 | 1 |  |  |
-
-### `content/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `content/authors/index.stx` | 1 | 1 | 0 | 8 |  |  |
-| `content/categories/index.stx` | 1 | 1 | 0 | 3 |  |  |
-| `content/comments/index.stx` | 1 | 1 | 0 | 3 |  |  |
-| `content/dashboard.stx` | 1 | 1 | 0 | 2 |  |  |
-| `content/files/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `content/pages/index.stx` | 1 | 1 | 0 | 3 |  |  |
-| `content/posts/index.stx` | 1 | 1 | 0 | 3 |  |  |
-| `content/seo/index.stx` | 1 | 0 | 0 | 0 |  |  |
-| `content/tags/index.stx` | 1 | 1 | 0 | 3 |  |  |
-
-### `data/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `data/activity/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `data/dashboard/index.stx` | 1 | 1 | 0 | 9 |  |  |
-| `data/subscribers.stx` | 1 | 1 | 0 | 1 |  |  |
-| `data/teams.stx` | 1 | 1 | 0 | 1 |  |  |
-| `data/users.stx` | 1 | 1 | 0 | 8 |  |  |
-
-### `dependencies/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `dependencies/index.stx` | 0 | 0 | 1 | 0 |  |  |
-
-### `deployments/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `deployments/[id].stx` | 1 | 1 | 0 | 0 |  |  |
-| `deployments/index.stx` | 1 | 0 | 0 | 0 |  |  |
-
-### `dns/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `dns/index.stx` | 1 | 1 | 0 | 1 |  |  |
-
-### `environment/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `environment/index.stx` | 0 | 0 | 1 | 2 |  |  |
-
-### `errors/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `errors/index.stx` | 1 | 0 | 0 | 0 |  |  |
-
-### `functions/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `functions/index.stx` | 1 | 1 | 0 | 1 |  |  |
-
-### `health/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `health/index.stx` | 1 | 0 | 0 | 0 |  |  |
-
-### `inbox/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `inbox/activity.stx` | 1 | 1 | 0 | 4 |  |  |
-| `inbox/index.stx` | 1 | 1 | 0 | 3 |  |  |
-| `inbox/settings.stx` | 1 | 1 | 0 | 0 |  |  |
-
-### `insights/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `insights/index.stx` | 1 | 1 | 0 | 4 |  |  |
-
-### `jobs/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `jobs/[id].stx` | 1 | 1 | 0 | 0 |  |  |
-| `jobs/history.stx` | 1 | 1 | 0 | 0 |  |  |
-| `jobs/index.stx` | 1 | 1 | 0 | 2 |  |  |
-
-### `layouts/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `layouts/default.stx` | 1 | 2 | 0 | 15 |  |  |
-| `layouts/guest.stx` | 0 | 0 | 0 | 0 |  |  |
-
-### `logs/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `logs/index.stx` | 1 | 1 | 0 | 2 |  |  |
-
-### `mailboxes/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `mailboxes/index.stx` | 1 | 1 | 0 | 1 |  |  |
-
-### `management/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `management/permissions/index.stx` | 1 | 1 | 0 | 2 |  |  |
-
-### `marketing/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `marketing/campaigns/index.stx` | 1 | 0 | 0 | 0 |  |  |
-| `marketing/lists/index.stx` | 1 | 0 | 0 | 0 |  |  |
-| `marketing/reviews/index.stx` | 1 | 1 | 0 | 17 |  |  |
-| `marketing/social-posts/index.stx` | 1 | 0 | 0 | 0 |  |  |
-
-### `models/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `models/[model].stx` | 1 | 0 | 0 | 0 |  |  |
-| `models/index.stx` | 1 | 0 | 0 | 0 |  |  |
-
-### `monitoring/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `monitoring/errors/index.stx` | 1 | 1 | 0 | 0 |  |  |
-
-### `notifications/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `notifications/dashboard.stx` | 1 | 1 | 0 | 2 |  |  |
-| `notifications/email.stx` | 1 | 1 | 0 | 0 |  |  |
-| `notifications/history.stx` | 1 | 0 | 0 | 0 |  |  |
-| `notifications/sms.stx` | 1 | 1 | 0 | 0 |  |  |
-
-### `packages/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `packages/index.stx` | 1 | 1 | 0 | 2 |  |  |
-
-### `queries/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `queries/[id].stx` | 1 | 1 | 0 | 0 |  |  |
-| `queries/history.stx` | 1 | 0 | 0 | 0 |  |  |
-| `queries/index.stx` | 1 | 1 | 0 | 2 |  |  |
-| `queries/slow.stx` | 1 | 0 | 0 | 0 |  |  |
-
-### `queue/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `queue/index.stx` | 1 | 1 | 0 | 2 |  |  |
-
-### `realtime/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `realtime/index.stx` | 1 | 1 | 0 | 1 |  |  |
-
-### `releases/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `releases/index.stx` | 0 | 1 | 1 | 2 |  |  |
-
-### `requests/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `requests/index.stx` | 1 | 1 | 0 | 4 |  |  |
-
-### `serverless/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `serverless/index.stx` | 1 | 1 | 0 | 10 |  |  |
-
-### `servers/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `servers/[id].stx` | 1 | 0 | 0 | 0 |  |  |
-| `servers/index.stx` | 1 | 1 | 0 | 0 |  |  |
-
-### `settings/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `settings/billing.stx` | 1 | 1 | 0 | 0 |  |  |
-| `settings/mail.stx` | 0 | 0 | 1 | 0 |  |  |
-
-### `teams/`
-
-| File | server | client | bare | DOM | store | components |
-|---|---:|---:|---:|---:|:---:|:---:|
-| `teams/[id].stx` | 1 | 0 | 0 | 0 |  |  |
-
-## Vanilla DOM offenders (per-line)
-
-Each line below is a future composable target. Lines truncated to 100 chars.
-
-### `analytics/blog/index.stx`
-
-```
-650: const ctx = document.getElementById('trafficChart')
-```
-
-### `analytics/browsers/index.stx`
-
-```
-281: const distributionCtx = document.getElementById('browserDistributionChart')
-296: const trendCtx = document.getElementById('browserTrendChart')
-```
-
-### `analytics/commerce/sales/index.stx`
-
-```
-425: const ctx = document.getElementById('salesChart')
-```
-
-### `analytics/commerce/web/index.stx`
-
-```
-554: const ctx = document.getElementById('trafficChart')
-```
-
-### `analytics/countries/index.stx`
-
-```
-344: const ctx = document.getElementById('countryChart')
-```
-
-### `analytics/devices/index.stx`
-
-```
-330: const distributionCtx = document.getElementById('deviceDistributionChart')
-345: const trendCtx = document.getElementById('deviceTrendChart')
-```
-
-### `analytics/events/index.stx`
-
-```
-746: window.addEventListener('load', (event) => {
-747: document.getElementById('about-link').addEventListener('click', () => {
-766: window.addEventListener('load', (event) => {
-767: document.getElementById('contact-form').addEventListener('submit', () => {
-780: window.addEventListener('load', (event) => {
-793: window.addEventListener('load', () => {
-794: const path = window.location.pathname;
-1148: const ctx = document.getElementById('eventChart')
-```
-
-### `analytics/marketing/index.stx`
-
-```
-460: const ctx = document.getElementById('marketingChart')
-```
-
-### `analytics/pages/index.stx`
-
-```
-333: const trendCtx = document.getElementById('pageViewsTrendChart')
-352: const topPagesCtx = document.getElementById('topPagesChart')
-```
-
-### `analytics/referrers/index.stx`
-
-```
-368: const typeCtx = document.getElementById('referrerTypeChart')
-407: const trendCtx = document.getElementById('referrerTrendChart')
-```
-
-### `analytics/web/index.stx`
-
-```
-645: const ctx = document.getElementById('trafficChart')
-```
-
-### `commerce/coupons/index.stx`
-
-```
-532: const chart_1_ctx = document.getElementById('chart_1')
-541: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `commerce/customers/index.stx`
-
-```
-101: window.location.href = `/dashboard/commerce/customers/${customer.id}`
-105: window.location.href = `/dashboard/commerce/customers/${customer.id}?edit=true`
-```
-
-### `commerce/dashboard/index.stx`
-
-```
-245: const revenueCtx = document.getElementById('revenueChart')
-254: const ordersCtx = document.getElementById('ordersChart')
-```
-
-### `commerce/gift-cards/index.stx`
-
-```
-627: const chart_1_ctx = document.getElementById('chart_1')
-636: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `commerce/payments/index.stx`
-
-```
-693: const chart_1_ctx = document.getElementById('chart_1')
-702: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `commerce/pos/index.stx`
-
-```
-430: const orderElement = document.getElementById('order-section')
-```
-
-### `commerce/printers/devices/index.stx`
-
-```
-291: const chart_1_ctx = document.getElementById('chart_1')
-300: const chart_2_ctx = document.getElementById('chart_2')
-309: const chart_3_ctx = document.getElementById('chart_3')
-```
-
-### `commerce/printers/receipts/index.stx`
-
-```
-311: const chart_1_ctx = document.getElementById('chart_1')
-320: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `commerce/products/index.stx`
-
-```
-123: window.location.href = `/dashboard/commerce/products/${product.id}`
-127: window.location.href = `/dashboard/commerce/products/${product.id}?edit=true`
-```
-
-### `components/index.stx`
-
-```
-471: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `content/authors/index.stx`
-
-```
-421: const link = document.createElement('a')
-424: document.body.appendChild(link)
-426: document.body.removeChild(link)
-441: const canvas = document.createElement('canvas')
-464: const link = document.createElement('a')
-467: document.body.appendChild(link)
-469: document.body.removeChild(link)
-1494: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `content/categories/index.stx`
-
-```
-995: const chart_1_ctx = document.getElementById('chart_1')
-1004: const chart_2_ctx = document.getElementById('chart_2')
-1013: const chart_3_ctx = document.getElementById('chart_3')
-```
-
-### `content/comments/index.stx`
-
-```
-1173: const chart_1_ctx = document.getElementById('chart_1')
-1182: const chart_2_ctx = document.getElementById('chart_2')
-1191: const chart_3_ctx = document.getElementById('chart_3')
-```
-
-### `content/dashboard.stx`
-
-```
-421: const chart_1_ctx = document.getElementById('chart_1')
-430: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `content/files/index.stx`
-
-```
-1166: const chart_1_ctx = document.getElementById('chart_1')
-1175: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `content/pages/index.stx`
-
-```
-1364: const chart_pages_1_ctx = document.getElementById('chart_pages_1')
-1373: const chart_pages_2_ctx = document.getElementById('chart_pages_2')
-1382: const chart_pages_3_ctx = document.getElementById('chart_pages_3')
-```
-
-### `content/posts/index.stx`
-
-```
-284: const chart_1_ctx = document.getElementById('chart_1')
-293: const chart_2_ctx = document.getElementById('chart_2')
-302: const chart_3_ctx = document.getElementById('chart_3')
-```
-
-### `content/tags/index.stx`
-
-```
-1112: const chart_1_ctx = document.getElementById('chart_1')
-1121: const chart_2_ctx = document.getElementById('chart_2')
-1130: const chart_3_ctx = document.getElementById('chart_3')
-```
-
-### `data/activity/index.stx`
-
-```
-608: refreshInterval = window.setInterval(() => {
-1190: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `data/dashboard/index.stx`
-
-```
-403: const link = document.createElement('a')
-406: document.body.appendChild(link)
-408: document.body.removeChild(link)
-417: const canvas = document.createElement('canvas')
-443: const link = document.createElement('a')
-446: document.body.appendChild(link)
-448: document.body.removeChild(link)
-1082: window.removeEventListener('resize', createDiagram)
-1279: window.addEventListener('resize', createDiagram)
-```
-
-### `data/subscribers.stx`
-
-```
-489: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `data/teams.stx`
-
-```
-515: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `data/users.stx`
-
-```
-528: const link = document.createElement('a')
-531: document.body.appendChild(link)
-533: document.body.removeChild(link)
-548: const canvas = document.createElement('canvas')
-571: const link = document.createElement('a')
-574: document.body.appendChild(link)
-576: document.body.removeChild(link)
-618: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `dns/index.stx`
-
-```
-220: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `environment/index.stx`
-
-```
-22: function isMac() { return (typeof window !== 'undefined' && window.navigator?.platform?.toLowerCase(
-211: window.removeEventListener('keydown', handleKeyboardShortcuts)
-```
-
-### `functions/index.stx`
-
-```
-476: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `inbox/activity.stx`
-
-```
-574: const chart_1_ctx = document.getElementById('chart_1')
-583: const chart_2_ctx = document.getElementById('chart_2')
-592: const chart_3_ctx = document.getElementById('chart_3')
-601: const chart_4_ctx = document.getElementById('chart_4')
-```
-
-### `inbox/index.stx`
-
-```
-437: document.addEventListener('click', handleClickOutside)
-445: document.removeEventListener('click', handleClickOutside)
-451: document.removeEventListener('click', handleClickOutside)
-```
-
-### `insights/index.stx`
-
-```
-854: const cpuCtx = document.getElementById('cpuChart')
-863: const memoryCtx = document.getElementById('memoryChart')
-872: const storageCtx = document.getElementById('storageChart')
-881: document.querySelectorAll('.queue-chart').forEach((canvas) => {
-```
-
-### `jobs/index.stx`
-
-```
-375: const chart_1_ctx = document.getElementById('chart_1')
-384: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `layouts/default.stx`
-
-```
-69: window.craft = window.craft || {}
-70: window.craft._sidebarSelectHandler = (event) => {
-81: // Craft sidebar takes over inside the macOS window. We pick which one
-85: //   2. `window.__craftNativeSidebar` — set by Craft's WKUserScript
-86: //   3. `window.craft.window` — Craft's JS bridge is bound (window mode)
-91: document.documentElement.setAttribute('data-has-stacks-sidebar', 'true')
-92: var hasFlag = Boolean(window.__craftNativeSidebar)
-93: var hasApi = Boolean(window.craft && window.craft.window)
-94: var hasParam = window.location.search.indexOf('native-sidebar=1') !== -1
-96: window.__craftNativeSidebar = true
-97: document.documentElement.setAttribute('data-craft-native-sidebar', 'true')
-102: if (!document.getElementById('stacks-sidebar-globals')) {
-103: var s = document.createElement('style')
-111: document.head.appendChild(s)
-119: var secs = document.querySelectorAll('.sidebar-section[data-section]')
-```
-
-### `logs/index.stx`
-
-```
-366: refreshInterval = window.setInterval(() => {
-960: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `mailboxes/index.stx`
-
-```
-222: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `management/permissions/index.stx`
-
-```
-574: const chart_1_ctx = document.getElementById('chart_1')
-583: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `marketing/reviews/index.stx`
-
-```
-625: const width = document.getElementById('rating-chart')?.clientWidth || 300;
-626: const height = document.getElementById('rating-chart')?.clientHeight || 200;
-657: .style('fill', document.documentElement.classList.contains('dark') ? '#9ca3af' : '#6b7280')
-665: .style('fill', document.documentElement.classList.contains('dark') ? '#9ca3af' : '#6b7280');
-695: .style('fill', document.documentElement.classList.contains('dark') ? '#e5e7eb' : '#374151')
-710: const width = document.getElementById('sentiment-chart')?.clientWidth || 300;
-711: const height = document.getElementById('sentiment-chart')?.clientHeight || 200;
-742: .style('fill', document.documentElement.classList.contains('dark') ? '#9ca3af' : '#6b7280')
-750: .style('fill', document.documentElement.classList.contains('dark') ? '#9ca3af' : '#6b7280');
-780: .style('fill', document.documentElement.classList.contains('dark') ? '#e5e7eb' : '#374151')
-795: const width = document.getElementById('source-chart')?.clientWidth || 300;
-796: const height = document.getElementById('source-chart')?.clientHeight || 200;
-832: .attr('stroke', document.documentElement.classList.contains('dark') ? '#1f2937' : '#ffffff')
-845: .style('fill', document.documentElement.classList.contains('dark') ? '#e5e7eb' : '#374151')
-865: .style('fill', document.documentElement.classList.contains('dark') ? '#e5e7eb' : '#374151')
-1631: window.addEventListener('resize', () => {
-1644: observer.observe(document.documentElement, {
-```
-
-### `notifications/dashboard.stx`
-
-```
-498: const chart_1_ctx = document.getElementById('chart_1')
-507: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `packages/index.stx`
-
-```
-837: const chart_1_ctx = document.getElementById('chart_1')
-846: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `queries/index.stx`
-
-```
-564: const chart_1_ctx = document.getElementById('chart_1')
-573: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `queue/index.stx`
-
-```
-587: const throughputCtx = document.getElementById('throughputChart')
-596: const waitTimeCtx = document.getElementById('waitTimeChart')
-```
-
-### `realtime/index.stx`
-
-```
-584: const chart_1_ctx = document.getElementById('chart_1')
-```
-
-### `releases/index.stx`
-
-```
-608: const chart_1_ctx = document.getElementById('chart_1')
-617: const chart_2_ctx = document.getElementById('chart_2')
-```
-
-### `requests/index.stx`
-
-```
-428: const chart_1_ctx = document.getElementById('chart_1')
-437: const chart_2_ctx = document.getElementById('chart_2')
-446: const chart_3_ctx = document.getElementById('chart_3')
-455: const chart_4_ctx = document.getElementById('chart_4')
-```
-
-### `serverless/index.stx`
-
-```
-490: const headerText = document.querySelector('.text-base.text-gray-900.dark\\:text-gray-100')
-496: const description = document.querySelector('.mt-2.text-sm.text-gray-700.dark\\:text-gray-400')
-542: const link = document.createElement('a')
-545: document.body.appendChild(link)
-547: document.body.removeChild(link)
-562: const canvas = document.createElement('canvas')
-585: const link = document.createElement('a')
-588: document.body.appendChild(link)
-590: document.body.removeChild(link)
-862: const svgRects = document.querySelectorAll('.node svg rect');
-```
-
-## Suggested migration batches
-
-Each batch is one feature area. Anything > ~12 files is split into sub-batches.
-
-- **_root** (4 files): `forgot-password.stx`, `index.stx`, `login.stx`, `register.stx`
-- **analytics** (12 files): `analytics/blog/index.stx`, `analytics/browsers/index.stx`, `analytics/commerce/sales/index.stx`, `analytics/commerce/web/index.stx`, `analytics/countries/index.stx`, `analytics/devices/index.stx`, `analytics/events/index.stx`, `analytics/index.stx`, `analytics/marketing/index.stx`, `analytics/pages/index.stx`, `analytics/referrers/index.stx`, `analytics/web/index.stx`
-- **cloud** (1 files): `cloud/index.stx`
-- **commerce** [1/3] (9 files): `commerce/categories/index.stx`, `commerce/coupons/index.stx`, `commerce/customers/index.stx`, `commerce/dashboard/index.stx`, `commerce/delivery/delivery-routes.stx`, `commerce/delivery/digital-delivery.stx`, `commerce/delivery/drivers.stx`, `commerce/delivery/index.stx`, `commerce/delivery/license-keys.stx`
-- **commerce** [2/3] (9 files): `commerce/delivery/shipping-methods.stx`, `commerce/delivery/shipping-rates.stx`, `commerce/delivery/shipping-zones.stx`, `commerce/gift-cards/index.stx`, `commerce/manufacturers/index.stx`, `commerce/orders/index.stx`, `commerce/payments/index.stx`, `commerce/pos/index.stx`, `commerce/printers/devices/index.stx`
-- **commerce** [3/3] (7 files): `commerce/printers/receipts/index.stx`, `commerce/products/detail.stx`, `commerce/products/index.stx`, `commerce/reviews/index.stx`, `commerce/taxes/index.stx`, `commerce/waitlist/products.stx`, `commerce/waitlist/restaurant.stx`
-- **components** (1 files): `components/index.stx`
-- **content** (9 files): `content/authors/index.stx`, `content/categories/index.stx`, `content/comments/index.stx`, `content/dashboard.stx`, `content/files/index.stx`, `content/pages/index.stx`, `content/posts/index.stx`, `content/seo/index.stx`, `content/tags/index.stx`
-- **data** (5 files): `data/activity/index.stx`, `data/dashboard/index.stx`, `data/subscribers.stx`, `data/teams.stx`, `data/users.stx`
-- **deployments** (2 files): `deployments/[id].stx`, `deployments/index.stx`
-- **dns** (1 files): `dns/index.stx`
-- **environment** (1 files): `environment/index.stx`
-- **errors** (1 files): `errors/index.stx`
-- **functions** (1 files): `functions/index.stx`
-- **health** (1 files): `health/index.stx`
-- **inbox** (3 files): `inbox/activity.stx`, `inbox/index.stx`, `inbox/settings.stx`
-- **insights** (1 files): `insights/index.stx`
-- **jobs** (3 files): `jobs/[id].stx`, `jobs/history.stx`, `jobs/index.stx`
-- **layouts** (1 files): `layouts/default.stx`
-- **logs** (1 files): `logs/index.stx`
-- **mailboxes** (1 files): `mailboxes/index.stx`
-- **management** (1 files): `management/permissions/index.stx`
-- **marketing** (4 files): `marketing/campaigns/index.stx`, `marketing/lists/index.stx`, `marketing/reviews/index.stx`, `marketing/social-posts/index.stx`
-- **models** (2 files): `models/[model].stx`, `models/index.stx`
-- **monitoring** (1 files): `monitoring/errors/index.stx`
-- **notifications** (4 files): `notifications/dashboard.stx`, `notifications/email.stx`, `notifications/history.stx`, `notifications/sms.stx`
-- **packages** (1 files): `packages/index.stx`
-- **queries** (4 files): `queries/[id].stx`, `queries/history.stx`, `queries/index.stx`, `queries/slow.stx`
-- **queue** (1 files): `queue/index.stx`
-- **realtime** (1 files): `realtime/index.stx`
-- **releases** (1 files): `releases/index.stx`
-- **requests** (1 files): `requests/index.stx`
-- **serverless** (1 files): `serverless/index.stx`
-- **servers** (2 files): `servers/[id].stx`, `servers/index.stx`
-- **settings** (1 files): `settings/billing.stx`
-- **teams** (1 files): `teams/[id].stx`
+| Dashboard STX view files | 120 |
+| Dashboard STX components | 283 |
+| Dashboard Actions | 359 |
+| Registered `/api/dashboard/*` routes | 283 |
+| Framework model files | 69 |
+| Framework models declaring `useApi` | 60 |
+| Direct `fetch()` calls in dashboard views, components, functions, and stores | 0 |
+
+The nine models without `useApi` are internal records or relationship-owned
+records: order idempotency keys, order items, errors, jobs, failed jobs, and
+payment-provider records. They are not missing generic CRUD surfaces.
+
+## Verified contracts
+
+### Rendering and navigation
+
+- `./buddy dev --dashboard` starts on port 3002 and renders with STX 0.2.144
+  and Crosswind 0.2.14.
+- 108 static route views render with HTTP 200.
+- Full-page and STX fragment requests render for every static route.
+- STX prewarms the dependency-aware rendered shell cache with four workers.
+  A warm eight-worker crawl measured 4.4 ms p50 and 25.6 ms p95 for full
+  pages, plus 6.2 ms p50 and 11.3 ms p95 for navigation fragments.
+- Editing a watched route invalidates its rendered cache immediately; editing
+  a dashboard composable invalidates the associated client bundle.
+- The componentized catch-all renders the native not-found page with HTTP 404
+  for both full-page and STX fragment requests.
+- 130 distinct rendered local links and assets resolve without a 404 or 5xx.
+- Rendered pages contain no unresolved PascalCase component tags.
+- Rendered pages contain no duplicate emitted IDs or broken
+  `aria-labelledby` references.
+- The live render and navigation audit covers all 108 static destinations,
+  all 69 discovered model destinations, and the remaining eight parameterized
+  route families without a full-page or STX fragment failure.
+- Headless desktop and narrow-viewport visual checks cover the componentized
+  Terms of Service and Privacy Policy routes linked from registration.
+- The fixed desktop sidebar keeps its existing style and content-width
+  contract. Dialogs and drawers use `dashboard-modal-layer`.
+
+### STX and componentization
+
+- All 118 non-layout route views are thin component mounts. Stateful
+  implementations live under `resources/components/Dashboard/`, including
+  guest authentication, legal documents, and not-found pages.
+- Project components under `resources/components/` resolve alongside the
+  explicit framework dashboard component directory.
+- Dashboard templates do not use `window.*`, `document.*`, or page-local DOM
+  event wiring.
+- Dashboard views, components, composables, and stores use `dashboardApi()`
+  instead of direct `fetch()`.
+- Shared STX runtime, router, generated Crosswind CSS, pooled component
+  factories, scoped styles, and fragment scripts are deduplicated.
+- STX dev-server preflight supports GET, HEAD, POST, PUT, PATCH, DELETE, and
+  the Authorization and CSRF headers used by the dashboard and Craft.
+
+### Actions, models, and security
+
+- Every registered dashboard route resolves to an Action source file.
+- Every dashboard Action declares method metadata matching its route.
+- More than 150 direct client calls are checked against route method and path.
+- Generic model writes follow the model's declared `useApi` capabilities.
+- Aggregate and operational endpoints use dashboard-scoped Actions.
+- Unsafe router Actions receive default-on CSRF validation.
+- The direct development config editor calls the same canonical CSRF
+  validator before a write.
+- Password reset uses the registered `POST /password/forgot` route through
+  `dashboardApi()` with `auth: false`, while retaining CSRF protection.
+- Sensitive dashboard reads and writes use the dashboard guard boundary.
+
+### Action controls
+
+- `Dashboard/UI/Button.stx` is the only generic dashboard action component.
+- Its primary variant is the Deployment `Deploy` gradient:
+  `bg-gradient-to-b from-blue-500 to-blue-600`.
+- The Deployment gradient appears nowhere else in dashboard source.
+- Primary, secondary, outline, ghost, danger, success, and warning actions
+  share sizing, focus, loading, disabled, link, and toggle behavior.
+- Remaining native buttons are semantic state controls, table or card
+  selectors, window controls, menu triggers, sort headers, or modal backdrops.
+
+### Data integrity
+
+- The 128 live GET dashboard API routes return JSON or their documented text
+  payload with no hidden HTTP-200 error body.
+- A fresh live crawl returned 117 successful responses and 11 intentional
+  validation, authentication, or missing-resource responses, with no 5xx,
+  method mismatch, transport failure, or HTML fallback.
+- Generic model routes reject malformed slugs with HTTP 400 before deriving
+  an ORM model or SQLite table name.
+- Seeded image factories use stable Picsum sources instead of retired
+  placeholder hosts. The repair migration preserves non-placeholder URLs.
+- `buddy make:migration` generates executable, dialect-aware SQL migrations,
+  matching the migration runner's discovery contract.
+- Dashboard pages do not substitute mock, sample, random, or placeholder rows
+  when an endpoint fails.
+- Commerce, content, delivery, marketing, CI, deployments, models, mail,
+  infrastructure, and settings surfaces use persisted or inspected source
+  data.
+- Deployment mutations reject missing confirmation and invalid environments
+  before starting a process.
+
+## Reproducible checks
+
+```bash
+./buddy dev --dashboard
+bun storage/framework/defaults/ai/skills/stacks-dashboard/scripts/audit.ts
+# Or target a non-default origin:
+bun storage/framework/defaults/ai/skills/stacks-dashboard/scripts/audit.ts --base-url http://127.0.0.1:3002
+bun test tests/unit/dashboard-*.test.ts
+bun test storage/framework/core/actions/tests/dev-csrf.test.ts
+bun run typecheck
+bun run typecheck:app
+bunx --bun pickier .
+```
+
+The focused contracts cover buttons, native STX bindings, route and Action
+method alignment, model reads and writes, commerce mutations, deployment
+guards, navigation source, sidebar behavior, toasts, and skill documentation.
+The 2026-07-31 focused run completed 156 tests with 2,916 assertions and no
+failures, followed by both TypeScript checks and a clean repository lint.
+
+## Remaining verification boundaries
+
+These are environment boundaries, not known source defects:
+
+- Destructive success-path testing for every mutation needs a disposable
+  database and storage fixture. The current project database is not modified
+  merely to prove delete and update controls.
+- Provider success paths for AWS, GitHub Actions, Stripe, mail delivery, DNS,
+  and cloud resources require configured external credentials and isolated
+  test resources. Disabled and error states are rendered and tested locally.
+- Craft desktop window behavior requires the native desktop runtime. The web
+  dashboard uses the same STX views, component library, API client, and
+  sidebar-aware content contract.
+- Production deployment behavior belongs to the build and deploy verification
+  workflow. This audit covers the dashboard development server requested by
+  `./buddy dev --dashboard`.
+
+When one of these environments is available, add an automated fixture-backed
+test or provider sandbox contract. Do not add a fake success response or
+page-local workaround.