@stacksjs/defaults 0.75.229 → 0.75.231

package/ai/skills/stacks-dashboard/SKILL.md

@@ -652,3 +652,18 @@ or a fake success response.
 - Preserve the existing sidebar information architecture and styling when redesigning page content
 - Use `dashboard-modal-layer` for every fixed dashboard dialog or drawer
 - The live terminal component polls real deployment output and pauses while the document is hidden
+
+## Generic model exposure
+
+Set `dashboard: { access: false }` on a model to exclude it server-side from
+the generic model catalog and its totals, legacy highlighted model counts,
+User/Subscriber count Actions, global model search, and generic model-browser
+read/store/update/destroy Actions. Direct model-browser requests return 404
+before row queries. Omission preserves existing exposure.
+
+`dashboard.enabled: false` only hides a sidebar row and still permits generic
+model access. `access` does not disable direct ORM calls, named domain Actions,
+or separate routes generated by `useApi`. Configure `security.api.models` or
+`STACKS_MODEL_APIS`, middleware, ownership and policies for those APIs. The
+new boundary does not provide row ownership or permission checks for models
+that remain exposed.

package/ai/skills/stacks-dependencies/SKILL.md

@@ -104,13 +104,19 @@ A Stacks project commits two lockfiles, and they describe one tree:
   **and** every npm package, which `pantry/` holds and the framework source
   resolves from.
 
-Since pantry 0.11.65 an npm range resolves to `bun.lock`'s pin whenever that
-pin satisfies it, so the two agree on every package they both name. Since
-0.11.60 the file is platform-independent: `pantry install` on macOS writes what
-CI writes on Linux, foreign-platform records included.
+Pantry follows `bun.lock`'s pin when it satisfies the declared npm range, so
+shared npm records must agree. Native platform records can differ between
+hosts. Review the generated difference and use the repository's lock guards:
+an allowed platform addition does not excuse a missing or changed declared
+dependency, stale workspace ranges, or a lost system-toolchain block.
+
+**Regenerating.** Use the repository's declared, Pantry-managed Bun. Change the
+ranges, run `bun install`, then `pantry install --ignore-scripts --quiet`, and
+commit both lockfiles with the manifests. This is the metadata-only mode the
+framework release action uses. A plain `pantry install` can activate project
+services and run `postDatabaseSetup` or `postSetup` hooks, including migrations
+and seeding; those are separate from maintaining dependency locks.
 
-**Regenerating.** Change the ranges, run `bun install`, then `pantry install`,
-on any platform, and commit `bun.lock` and `pantry.lock` with the manifests.
 Check `head -2 bun.lock` says `lockfileVersion: 2`; an older Bun on PATH
 downgrades it.
 

package/ai/skills/stacks-models/SKILL.md

@@ -123,7 +123,12 @@ of forcing a cast. See `orm/tests/inference-attributes.test-d.ts`.
 
 Also at the top level: `indexes: [{ name, columns, unique?, where? }]` for
 composite and partial-unique indexes, and `dashboard: { highlight: true }` to
-feature the model in the admin UI.
+feature the model in the admin UI. Use `dashboard: { access: false }` to
+exclude a model from generic dashboard catalogs/counts/search and the generic
+model-browser CRUD Actions before database work. Its default is `true`;
+`dashboard.enabled: false` still only hides the sidebar row. `access` leaves
+direct ORM calls, named domain Actions and generated `useApi` routes available.
+Those APIs require their own route selection, middleware, ownership and policies.
 
 `useApi` is an API capability, not a dashboard-view generator. Its generated
 routes are registered from the merged model registry. Framework defaults are

package/ai/skills/stacks-native/CATALOG.md

@@ -11,7 +11,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | Package | Task guidance | Source entry | Retained tests |
 |---|---|---|---|
 | `@stacksjs/action-runner` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/action-runner/src/index.ts) | 1 |
-| `@stacksjs/actions` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts) | 72 |
+| `@stacksjs/actions` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts) | 73 |
 | `@stacksjs/ai` | [`stacks-ai`](../stacks-ai/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/index.ts) | 17 |
 | `@stacksjs/alias` | [`stacks-alias`](../stacks-alias/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/alias/src/index.ts) | 1 |
 | `@stacksjs/analytics` | [`stacks-analytics`](../stacks-analytics/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/analytics/src/index.ts) | 6 |
@@ -21,7 +21,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 118 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
 | `@stacksjs/browser-extension` | [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/index.ts) | 7 |
-| `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 150 |
+| `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 151 |
 | `@stacksjs/build` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/build/src/index.ts) | 2 |
 | `@stacksjs/cache` | [`stacks-cache`](../stacks-cache/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/index.ts) | 11 |
 | `@stacksjs/calendar-api` | [`stacks-calendar`](../stacks-calendar/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/index.ts) | 2 |
@@ -119,7 +119,7 @@ Declared runtime exports: `BlogAdminError`, `DEFAULT_IOS_DEPENDENCIES`, `DEFAULT
 
 Local source modules: [src/action.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/action.ts), [src/add.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/add.ts), [src/blog-admin.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/blog-admin.ts), [src/build/ios-toolchain.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/build/ios-toolchain.ts), [src/commit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/commit.ts), [src/dev/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/dev/index.ts), [src/discover-packages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/discover-packages.ts), [src/generate/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/generate/index.ts), [src/github-release.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/github-release.ts), [src/helpers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/helpers/index.ts), [src/library/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/library/index.ts), [src/lint/lint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/lint.ts), [src/lint/stx-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/stx-gate.ts), [src/make-command.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-command.ts), [src/make-job.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-job.ts), [src/make-policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-policy.ts), [src/make-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-resource.ts), [src/make.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make.ts), [src/scaffold-crud.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/scaffold-crud.ts), [src/setup/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/setup/index.ts), [src/stacks.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stacks.ts), [src/upgrade/package-project.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/package-project.ts), [src/upgrade/route-actions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/route-actions.ts).
 
-Evidence directory: [72 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [73 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/ai
 
@@ -215,7 +215,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/commands/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/commands/index.ts).
 
-Evidence directory: [150 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [151 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/build
 

package/app/Actions/Dashboard/Models/GetModels.ts

@@ -3,6 +3,7 @@ import { Glob } from 'bun'
 import { Action } from '@stacksjs/actions/runtime'
 import { path } from '@stacksjs/path'
 import { countRows } from '../../../../resources/functions/dashboard/data'
+import { resolveDashboardModel } from '../../../../resources/functions/dashboard/model-access'
 import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
@@ -16,23 +17,27 @@ export default new Action({
       const scanOptions = { cwd: path.userModelsPath(), onlyFiles: true }
       const displayModels: Model[] = []
 
-    for await (const file of glob.scan(scanOptions)) {
-      const model = (await import(path.userModelsPath(file))).default as Model
-      if (model.dashboard?.highlight !== undefined && model.dashboard?.highlight !== false)
-        displayModels.push(model)
-    }
-
-    if (!displayModels.length) {
-      // If no models should be highlighted, we can just return up to 8 models in alphabetical order
       for await (const file of glob.scan(scanOptions)) {
-        const model = (await import(path.userModelsPath(file))).default as Model
-        displayModels.push(model)
+        const candidate = (await import(path.userModelsPath(file))).default as Model
+        const model = await resolveDashboardModel(candidate.name || '', candidate)
+        if (!model) continue
+        if (model.dashboard?.highlight !== undefined && model.dashboard?.highlight !== false)
+          displayModels.push(model)
+      }
+
+      if (!displayModels.length) {
+        // If no models should be highlighted, return up to 8 accessible models.
+        for await (const file of glob.scan(scanOptions)) {
+          const candidate = (await import(path.userModelsPath(file))).default as Model
+          const model = await resolveDashboardModel(candidate.name || '', candidate)
+          if (!model) continue
+          displayModels.push(model)
+        }
       }
-    }
 
-    if (displayModels.length > 8)
-      displayModels.length = 8
-    displayModels.sort((a, b) => (a.name || '').localeCompare(b.name || ''))
+      if (displayModels.length > 8)
+        displayModels.length = 8
+      displayModels.sort((a, b) => (a.name || '').localeCompare(b.name || ''))
 
       return await Promise.all(displayModels.map(async model => ({
         model: model.name,

package/app/Actions/Dashboard/Models/GetSubscriberCount.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions/runtime'
-import { Subscriber } from '@stacksjs/orm'
+import { response } from '@stacksjs/router'
+import { resolveDashboardModel } from '../../../../resources/functions/dashboard/model-access'
 import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
@@ -10,7 +11,9 @@ export default new Action({
 
   async handle() {
     try {
-      return await Subscriber.count()
+      const Model = await resolveDashboardModel('Subscriber')
+      if (!Model) return response.json({ message: 'Model not found.' }, 404)
+      return await Model.count()
     }
     catch (error) {
       return dashboardOperationalError(error, 'Subscriber total could not be loaded.', 'GetSubscriberCount')

package/app/Actions/Dashboard/Models/GetUserCount.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions/runtime'
-import { User } from '@stacksjs/orm'
+import { response } from '@stacksjs/router'
+import { resolveDashboardModel } from '../../../../resources/functions/dashboard/model-access'
 import { dashboardOperationalError } from '../dashboard-response'
 
 export default new Action({
@@ -10,7 +11,9 @@ export default new Action({
 
   async handle() {
     try {
-      return await User.count()
+      const Model = await resolveDashboardModel('User')
+      if (!Model) return response.json({ message: 'Model not found.' }, 404)
+      return await Model.count()
     }
     catch (error) {
       return dashboardOperationalError(error, 'User total could not be loaded.', 'GetUserCount')

package/app/Actions/Dashboard/Models/ModelShowAction.ts

@@ -1,7 +1,8 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions/runtime'
 import { response as routerResponse } from '@stacksjs/router'
-import { loadModelIfExists, safeGet } from '../../../../resources/functions/dashboard/data'
+import { safeGet } from '../../../../resources/functions/dashboard/data'
+import { resolveDashboardModel } from '../../../../resources/functions/dashboard/model-access'
 import { dashboardOperationalError } from '../dashboard-response'
 import { isValidModelSlug, type ModelCreateField, type ModelWriteCapabilities, modelCreateFields, modelSchemaColumns, modelWritableColumns, modelWriteCapabilities, slugToPascal } from './model-write'
 
@@ -159,15 +160,6 @@ export function parseFilters(raw: string | null): Record<string, string> {
   return out
 }
 
-function resolveOrmModel(modelName: string): any {
-  const injected = (globalThis as Record<string, any>)[modelName]
-  // The ORM injects Proxies that answer `undefined` for every property
-  // until their deferred load lands, so probe for a real query method
-  // rather than trusting the name to be bound.
-  if (injected && typeof injected.where === 'function') return injected
-  return null
-}
-
 export default new Action({
   name: 'Dashboard Model Show',
   description: 'Queries a single model by URL slug with paging, sorting, search and column filters.',
@@ -221,7 +213,7 @@ export default new Action({
 
     let Model: any
     try {
-      Model = resolveOrmModel(modelName) ?? await loadModelIfExists(modelName)
+      Model = await resolveDashboardModel(modelName)
     }
     catch (error) {
       return dashboardOperationalError(error, `${modelName} could not be loaded.`, 'ModelShowAction.resolve')

package/app/Actions/Dashboard/Models/ModelsIndexAction.ts

@@ -4,6 +4,7 @@ import { join } from 'node:path'
 import process from 'node:process'
 import { countRows } from '../../../../resources/functions/dashboard/data'
 import { dashboardOperationalError, dashboardOperationalIssue } from '../dashboard-response'
+import { resolveDashboardModel } from '../../../../resources/functions/dashboard/model-access'
 import { modelApiConfiguration } from './model-api'
 
 /**
@@ -127,7 +128,7 @@ export default new Action({
     let userland: Array<Omit<DiscoveredModel, 'source'>>
     let defaults: Array<Omit<DiscoveredModel, 'source'>>
     try {
-      userland = walkModels(userlandDir, false)
+      userland = walkModels(userlandDir, true)
       defaults = walkModels(defaultsDir, true)
     }
     catch (error) {
@@ -144,11 +145,12 @@ export default new Action({
       }
     }
 
-    const enriched = await Promise.all(merged.map(async (m): Promise<ModelRow> => {
+    const candidates = await Promise.all(merged.map(async (m): Promise<ModelRow | null> => {
       let Model: any
       try {
         const module = await import(m.file)
-        Model = module.default ?? module
+        Model = await resolveDashboardModel(m.name, module.default ?? module)
+        if (!Model) return null
       }
       catch (error) {
         return unavailableModelRow(
@@ -190,6 +192,7 @@ export default new Action({
       }
     }))
 
+    const enriched = candidates.filter((model): model is ModelRow => model !== null)
     enriched.sort((a, b) => a.name.localeCompare(b.name))
 
     const totalModels = enriched.length

package/app/Actions/Dashboard/Models/model-write.ts

@@ -6,7 +6,7 @@
  * casts and no observers; writing to it from a generic admin screen would
  * bypass every guarantee the ORM makes. Those rows stay read-only.
  */
-import { loadModelIfExists } from '../../../../resources/functions/dashboard/data'
+import { resolveDashboardModel } from '../../../../resources/functions/dashboard/model-access'
 import { dashboardOperationalIssue } from '../dashboard-response'
 import { modelApiConfiguration } from './model-api'
 
@@ -301,10 +301,9 @@ export async function resolveWritableModel(slug: string, operation?: ModelWriteO
     return { error: 'Model slug must be lowercase kebab-case.', status: 400 }
 
   const modelName = slugToPascal(slug)
-  const injected = (globalThis as Record<string, any>)[modelName]
   let Model: any
   try {
-    Model = (injected && typeof injected.where === 'function') ? injected : await loadModelIfExists(modelName)
+    Model = await resolveDashboardModel(modelName)
   }
   catch (error) {
     return {

package/app/Actions/Dashboard/Search/GlobalSearchAction.ts

@@ -4,6 +4,7 @@ import { env } from '@stacksjs/env'
 import { readdirSync } from 'node:fs'
 import { basename, extname, join } from 'node:path'
 import process from 'node:process'
+import { resolveDashboardModel } from '../../../../resources/functions/dashboard/model-access'
 import { dashboardOperationalError } from '../dashboard-response'
 
 interface SearchableModel {
@@ -126,7 +127,8 @@ async function loadSearchableModels(): Promise<SearchableModel[]> {
   for (const [fallbackName, file] of merged) {
     try {
       const module = await import(file)
-      const definition = module.default ?? module
+      const definition = await resolveDashboardModel(fallbackName, module.default ?? module)
+      if (!definition) continue
       const name = String(definition.name || fallbackName)
       const search = definition.traits?.useSearch
       if (!search || typeof search !== 'object' || !Array.isArray(search.searchable)) continue
@@ -197,13 +199,15 @@ export default new Action({
     if (!q) return { results: {} }
 
     try {
+      const models = await catalog()
+      if (models.length === 0) return { results: {}, unavailable: [] }
       const { Database } = await import('bun:sqlite')
       const db = new Database(env.DB_DATABASE_PATH || 'database/stacks.sqlite', { readonly: true })
       const results: Record<string, SearchResult[]> = {}
       const unavailable: SearchUnavailable[] = []
 
       try {
-        for (const model of await catalog()) {
+        for (const model of models) {
           if (Object.keys(results).length >= MAX_GROUPS) break
 
           const columns = db.query(`PRAGMA table_info(${model.table})`).all() as Array<{ name: string }>

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.229",
+  "version": "0.75.231",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.229",
+  "version": "0.75.231",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -44,7 +44,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.229",
+    "@stacksjs/mobile": "0.75.231",
     "@stacksjs/sanitizer": "^0.2.534",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",

package/resources/functions/dashboard/model-access.ts

@@ -0,0 +1,15 @@
+/** Server-side exposure boundary for the generic dashboard model surfaces. */
+import type { DashboardModelOptions } from '@stacksjs/types'
+import { loadModelIfExists } from './data'
+
+/** Omission preserves the existing dashboard exposure. `enabled` only controls navigation. */
+export function hasDashboardModelAccess(Model: { dashboard?: DashboardModelOptions } | null | undefined): boolean {
+  return Model?.dashboard?.access !== false
+}
+
+/** Resolve the native model, then exclude it before callers inspect metadata or query rows. */
+export async function resolveDashboardModel(name: string, candidate?: any): Promise<any | null> {
+  const injected = (globalThis as Record<string, any>)[name]
+  const Model = (injected && typeof injected.where === 'function') ? injected : (candidate ?? await loadModelIfExists(name))
+  return Model && hasDashboardModelAccess(Model) ? Model : null
+}

package/resources/plugins/preloader.ts

@@ -60,6 +60,9 @@ const fastCommands = [
   'build',
   'test',
   'lint',
+  // Repository documentation tools inspect source without application globals.
+  'docs',
+  'release',
   '--version',
   '-v',
   'version',