@stacksjs/defaults 0.75.390 → 0.75.398

package/ai/skills/stacks-actions/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: stacks-actions
-description: Use when working with Stacks server actions - creating actions in app/Actions/, auto-generated API actions from the useApi model trait, the 673 default framework actions (auth, dashboard, commerce, content, deployment, jobs), action request/response handling, or action registration. Covers @stacksjs/actions and storage/framework/defaults/app/Actions/.
+description: Use when working with Stacks server actions - creating actions in app/Actions/, auto-generated API actions from the useApi model trait, the 675 default framework actions (auth, dashboard, commerce, content, deployment, jobs), action request/response handling, or action registration. Covers @stacksjs/actions and storage/framework/defaults/app/Actions/.
 license: MIT
 compatibility: Bun >= 1.3.0, TypeScript
 allowed-tools: Read Edit Write Bash Grep Glob

package/ai/skills/stacks-ai/SKILL.md

@@ -22,6 +22,7 @@ ai/src/
 │   ├── openai/index.ts    # GPT + image + transcription + TTS
 │   ├── ollama/index.ts    # Local LLM driver
 │   └── bedrock/          # Amazon Bedrock, through the Converse API
+├── complete.ts           # complete()/completeStream(): inline ghost-text completions
 ├── image.ts              # Image generation & vision
 ├── speech.ts             # Provider-neutral text-to-speech & speech-to-text
 ├── search.ts             # RAG, embeddings, vector index
@@ -341,6 +342,66 @@ const sessionId = driver.getLastSessionId()
 await driver.resumeSession(sessionId, 'Add validation')
 ```
 
+## Inline completions (ghost text)
+
+`complete()` is the continuation at the cursor, for editors that show grey text
+after the caret and accept it with Tab. It uses the app's configured default
+driver (any of the four) and that driver's fast model class, asks for ONLY the
+continuation, and cleans the answer: the echoed prefix, the model's markup,
+chatter and refusals (to `''`), everything past the first sentence or line, and
+anything that runs into the text after the cursor.
+
+```typescript
+import { complete, completeStream } from '@stacksjs/ai'
+
+const { completion } = await complete({
+  before: 'Remember to buy milk, eggs and ', // the last 2000 chars are sent
+  after: '',                                 // the first 500 chars are sent
+  kind: 'todo',                              // 'note' | 'prompt' | 'todo' | 'text'
+  context: 'Groceries',                      // note title, library description
+  maxTokens: 48,                             // default 48
+  signal: controller.signal,                 // abort: rejects with an AbortError
+  driver: 'bedrock',                         // default: ai.completion.driver, then ai.default
+})
+
+for await (const { completion } of completeStream({ before })) paint(completion) // the whole suggestion so far
+```
+
+- `{ completion: '' }` is "no suggestion", never an error: nothing to continue,
+  `ai.completion.enabled: false`, no driver configured, or the model declined. A
+  real driver failure throws.
+- The model is, in order: `input.model`, `ai.completion.model`, a Haiku (Anthropic,
+  Bedrock) or Nova Micro/Lite found in `ai.models`, then the fast defaults in
+  `models.ts` (`DEFAULT_ANTHROPIC_FAST_MODEL`, `DEFAULT_BEDROCK_FAST_MODEL`); on
+  OpenAI and Ollama it is the driver's configured model. Bedrock Claude needs the
+  account's Anthropic use-case form submitted, otherwise list a Nova model in
+  `ai.models` (or set `ai.completion.model`) and completions use that.
+- A small LRU keyed on the tail of `before` (plus kind, model and the head of
+  `after`) makes retyping free; `completionCache.clear()` empties it.
+- Requests carry `maxRetries: 0` and the abort `signal` reaches the HTTP drivers
+  (Bedrock rejects at once and drops the late response), and each reports
+  `recordUsage` with `metadata: { feature: 'completion', kind }`, so `onUsage`
+  can price them separately. `ChatCompletionOptions` gained `signal`,
+  `maxRetries` and `usageMetadata` for this; Ollama now honours `maxTokens`
+  (`num_predict`) and reports usage like the other drivers.
+- `completionStatus(config)` says whether a driver can answer, without a call;
+  `postProcessCompletion(raw, { before, after, kind })` is the cleanup, reusable
+  with your own model call.
+
+`POST /ai/complete` (default `Actions/AI/CompleteAction`, in the guarded `/ai`
+route group of the dashboard bundle) takes `{ before, after?, kind?, context? }`
+and answers `{ completion }`: 401 when signed out, 422 for a bad body, a 90 per
+minute per-user rate limit (429), `''` when no driver is configured, 502 when the
+provider fails. To mount it elsewhere, one line in `routes/api.ts`:
+
+```typescript
+route.post('/complete', 'Actions/AI/CompleteAction').middleware('auth') // POST /api/complete
+```
+
+The client half is `useCompletion()` and `<AiTextarea>` in stx
+(`stacks-stx`, `stacks-composables/BROWSER.md`): `<AiTextarea kind="note" fetcher="/api/complete" v-model:value="body" />`.
+Tests: `core/ai/tests/complete.test.ts`, `defaults/app/Actions/AI/complete-request.test.ts`.
+
 ## config/ai.ts
 
 ```typescript
@@ -352,6 +413,7 @@ await driver.resumeSession(sessionId, 'Add validation')
     anthropic: { model: 'claude-sonnet-5-5' },
     bedrock: { model: 'global.anthropic.claude-sonnet-5-5' },
   },
+  completion: { enabled: true, maxTokens: 48 }, // optional: driver, model for inline completions
 }
 ```
 

package/ai/skills/stacks-buddy/SKILL.md

@@ -129,6 +129,7 @@ buddy dev -i/--interactive   # interactive server selection menu
 buddy dev -l/--with-localhost # include localhost URL in output
 buddy dev --browser          # open the browser app instead of a configured native window
 buddy dev --site             # open the marketing site instead of the detected app entry
+buddy dev --detach           # outlive the shell: nohup ./buddy dev --frontend --detach &
 buddy dev -p/--project [name]
 buddy dev --verbose
 ```

package/ai/skills/stacks-composables/BROWSER.md

@@ -23,6 +23,14 @@ implementation rather than a newer docs list. Demand legacy helpers commonly
 expose getters, `get()`, `subscribe()`, and `stop()`. Their getters are not
 automatically signal-tracked template values.
 
+STX 0.2.762 adds demand-delivered `useCompletion` for inline ghost text:
+`useCompletion({ fetch: (ctx, signal) => Promise<string>, debounceMs = 250, minChars = 12, enabled })`
+returns signals `ghost` and `pending` (plus `error`) and `update(before, after, caret, meta?)`,
+`accept()`, `acceptWord()`, `dismiss()`, `destroy()`. It debounces, aborts the previous request,
+discards stale answers, asks nothing during IME composition, a selection (`meta.selecting`), mid-word
+or below `minChars`, and typing the start of a suggestion consumes it. `<AiTextarea>` from
+`@stacksjs/components` is the textarea built on it (`kind`, `context`, `fetcher` URL or function).
+
 STX 0.2.628 adds demand-delivered `useAnimationFrame` for canvas and simulations.
 Imported TypeScript controllers use an explicit
 `import { useAnimationFrame } from '@stacksjs/stx/composables'` and declare

package/ai/skills/stacks-desktop/SKILL.md

@@ -252,9 +252,94 @@ Two things that bite, both silently:
 `buddy build:dmg` warns when a finished bundle contains more than one
 Bun-compiled executable, naming them and what the repetition costs.
 
+## Native macOS apps (`config/desktop.ts`)
+
+A project whose app is a client of an HTTP API (a hosted service, not a local server) declares it in
+`config/desktop.ts`, the way `config/mobile.ts` declares a phone app, and `buddy build:desktop` builds a
+native AppKit app from its stx screens: no web view, no launcher.
+
+```ts
+import type { DesktopConfig } from '@stacksjs/types'
+
+export default {
+  macos: {
+    appName: 'Library',
+    bundleId: 'com.example.library',
+    teamId: '3JJRNQW6B7',                 // not a secret
+    url: process.env.LIBRARY_API_URL || 'http://127.0.0.1:3408',
+    nativeScreens: ['Main', 'Settings'],   // resources/native/<name>.stx
+    shareStorage: { auth_token: 'auth.token' },
+    window: { width: 1180, height: 760, minWidth: 860, minHeight: 540 },
+    icon: 'resources/native/icon/AppIcon-1024.png',
+    privacy: { tracking: false, collectedDataTypes: [] },
+  },
+} satisfies DesktopConfig
+```
+
+- `buddy build:desktop` compiles the screens (`compileNativeBundle`), builds Craft's AppKit host
+  (`craft-native/macos`, cached per Craft revision), lays out `<App>.app` and signs it ad hoc. `buddy dev:desktop`
+  does the same and opens it. Output: `storage/framework/desktop/macos/`.
+- The toolchain is not the app's business: Craft resolves the pinned Zig through Pantry and fetches and builds the pinned
+  zig-js into `~/.cache/craft/toolchain` (`CRAFT_TOOLCHAIN_DIR` moves it, `CRAFT_ZIG` overrides the compiler).
+- The host reads `Contents/Resources/craft-app.json` (written by the build) when Finder launches it, so the app has no
+  arguments. The API origin is `url`, and `craft.secureStorage` is the Keychain (`craft.session` is the `auth.token` item).
+- `buddy desktop:apple:package` and `publish` build the same bundle for the Mac App Store (sandbox, network client,
+  application identifier, Keychain group, embedded profile). Name, bundle id, team, version, category and icon come
+  from `config/desktop.ts`; only the credentials (identities, profile, API key) are Apple variables. `--universal` is not
+  supported for native apps yet.
+- A `macos` section in `config/desktop.ts` switches `build:desktop` and `dev:desktop` to this path; without one they
+  build the Craft web-view app as before.
+- One set of views can be both: the web server resolves the native primitives (`View`, `Text`, `ScrollView`, ...) as
+  components of last resort (stx config `nativePrimitives`), so `resources/views` pages written with them are also native
+  screens. Menus, windows and the Keychain are the screen's `craft.desktop` and `craft.secureStorage`.
+
+### An app that runs its own API (`macos.agent`)
+
+A local-first app (a browser, an inbox, anything whose data is this Mac) runs the project's routes inside the
+app instead of talking to a hosted server. `buddy new <name> --desktop` scaffolds one (combinable with
+`--minimal`, and happy to scaffold into a directory that holds only `.git`):
+
+```ts
+export default {
+  macos: {
+    appName: 'Browser',
+    bundleId: 'com.example.browser',
+    agent: true,                     // or { port, entry, appRoutes, staticDir }
+    nativeScreens: ['Main'],
+    webkit: true,                    // link WebKit into the host, for <WebView>
+    defaultBrowser: true,            // http/https URL types, HTML/XHTML/webarchive/PDF document types
+    permissions: { camera: true, microphone: 'For calls in web pages.', location: true, downloads: true, printing: true },
+    dockMenu: [{ title: 'New Window', action: 'new-window' }],
+  },
+} satisfies DesktopConfig
+```
+
+- The agent (`@stacksjs/desktop-build` `startDesktopAgent`, `src/agent.ts`) is `Bun.serve` on 127.0.0.1, on the
+  port remembered in `~/Library/Application Support/<App>/agent.port` (any free port when it is taken). The host fetches
+  `GET /native/session` and gets an HttpOnly, SameSite=Strict cookie holding a token minted for this launch; every other
+  request needs that cookie and a Host header of `127.0.0.1:<port>` or `localhost:<port>`, so a DNS-rebinding page
+  cannot call it. `url` is not needed.
+- It serves the app's routes in process: `routes/` as `app/Routes.ts` mounts them, plus the agent's own module
+  (`app/Desktop/Agent.ts` by convention, `agent.entry` otherwise). Routes the agent module adds are not prefixed. A
+  default-exported `(request) => Response` there replaces the router entirely.
+- `buddy dev:desktop` runs the launcher from source in the project (`bun`, no bundle), which boots the routes as
+  `buddy dev:api` does. `buddy build:desktop` compiles the launcher into `<App>.app/Contents/MacOS/<App>`, with the host
+  beside it as `craft-runtime` and `desktop-agent.json` in Resources. A compiled binary cannot import route files off
+  disk (the router refuses), so the build imports the registry's route files, the agent module and every
+  `'Actions/...'` they name statically (`provideActions`); what they import travels inside the app.
+- The launcher (`src/agent-launcher.ts`) holds a single-instance lock (`agent.pid`), logs to
+  `~/Library/Logs/<App>.log` when launched without a terminal, and quits with the window.
+- Entitlements: the Bun executable gets `allow-jit`, `allow-unsigned-executable-memory` and
+  `disable-library-validation`; in the sandbox the agent adds `network.server`, and the host is signed with only
+  `app-sandbox` and `inherit`. `permissions` adds each device entitlement and its `NS*UsageDescription` (an explicit
+  `usageDescriptions` entry wins).
+- `webkit` needs a craft-native whose `buildMacOSNative` takes `webkit`; the build checks Craft's source and fails by
+  name rather than building a host with blank web views. `dockMenu` reaches the host through `craft-app.json`.
+
 ## CLI Commands
 
 ```bash
+buddy new <name> --desktop     # a Stacks app that is also a native Mac app, API inside (macos.agent)
 buddy dev:desktop              # start the desktop development server
 buddy build:desktop            # build the launcher + Craft runtime payload
 buddy desktop:apple:init       # generate the reusable GitHub Actions caller

package/ai/skills/stacks-native/CATALOG.md

@@ -11,8 +11,8 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | Package | Task guidance | Source entry | Retained tests |
 |---|---|---|---|
 | `@stacksjs/action-runner` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/action-runner/src/index.ts) | 1 |
-| `@stacksjs/actions` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts) | 94 |
-| `@stacksjs/ai` | [`stacks-ai`](../stacks-ai/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/index.ts) | 20 |
+| `@stacksjs/actions` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts) | 95 |
+| `@stacksjs/ai` | [`stacks-ai`](../stacks-ai/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/index.ts) | 21 |
 | `@stacksjs/alias` | [`stacks-alias`](../stacks-alias/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/alias/src/index.ts) | 1 |
 | `@stacksjs/analytics` | [`stacks-analytics`](../stacks-analytics/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/analytics/src/index.ts) | 6 |
 | `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 9 |
@@ -21,7 +21,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 124 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
 | `@stacksjs/browser-extension` | [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/index.ts) | 7 |
-| `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 174 |
+| `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 176 |
 | `@stacksjs/build` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/build/src/index.ts) | 4 |
 | `@stacksjs/cache` | [`stacks-cache`](../stacks-cache/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/index.ts) | 18 |
 | `@stacksjs/calendar-api` | [`stacks-calendar`](../stacks-calendar/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/index.ts) | 2 |
@@ -39,7 +39,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/datetime` | [`stacks-datetime`](../stacks-datetime/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/index.ts) | 13 |
 | `@stacksjs/defaults` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/defaults/package.json) | 2 |
 | `@stacksjs/deploy` | [`stacks-deploy`](../stacks-deploy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/deploy/package.json) | 1 |
-| `@stacksjs/desktop-build` | [`stacks-desktop`](../stacks-desktop/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/index.ts) | 12 |
+| `@stacksjs/desktop-build` | [`stacks-desktop`](../stacks-desktop/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/index.ts) | 15 |
 | `@stacksjs/development` | [`stacks-development`](../stacks-development/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/development/package.json) | 1 |
 | `@stacksjs/dns` | [`stacks-dns`](../stacks-dns/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/dns/src/index.ts) | 3 |
 | `@stacksjs/docs` | [`stacks-docs`](../stacks-docs/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/docs/src/index.ts) | 2 |
@@ -78,7 +78,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/router` | [`stacks-router`](../stacks-router/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/index.ts) | 99 |
 | `@stacksjs/scheduler` | [`stacks-scheduler`](../stacks-scheduler/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/scheduler/src/index.ts) | 15 |
 | `@stacksjs/search-engine` | [`stacks-search-engine`](../stacks-search-engine/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/search-engine/src/index.ts) | 11 |
-| `@stacksjs/security` | [`stacks-security`](../stacks-security/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/index.ts) | 11 |
+| `@stacksjs/security` | [`stacks-security`](../stacks-security/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/index.ts) | 12 |
 | `@stacksjs/server` | [`stacks-server`](../stacks-server/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/server/src/index.ts) | 28 |
 | `@stacksjs/shell` | [`stacks-shell`](../stacks-shell/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/shell/src/index.ts) | 1 |
 | `@stacksjs/sites` | [`stacks-sites`](../stacks-sites/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sites/src/index.ts) | 3 |
@@ -115,11 +115,11 @@ Evidence directory: [1 retained tests](https://github.com/stacksjs/stacks/blob/m
 
 Guidance: [`stacks-actions`](../stacks-actions/SKILL.md). Source: [storage/framework/core/actions/src/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts).
 
-Declared runtime exports: `BlogAdminError`, `DEFAULT_IOS_DEPENDENCIES`, `DEFAULT_STX_LINT_CONFIG`, `IosToolchainError`, `PUBLICATION_CHECK_SCRIPT`, `XCODE_NOTE`, `assertPublicationAllowed`, `blogSlugify`, `createComponent`, `createDatabase`, `createFactory`, `createFunction`, `createLanguage`, `createMail`, `createMiddleware`, `createMigration`, `createModel`, `createNotification`, `createPage`, `deleteBlogPost`, `describeDanglingRouteActions`, `describeGitHubRelease`, `discoverPackages`, `ensureDiscoveredPackages`, `findDanglingRouteActions`, `formatProject`, `getBlogPost`, `installStack`, `isDryRunActive`, `lintFix`, `lintProject`, `listBlogPosts`, `listStacks`, `loadIosDependencies`, `loadStxLintConfig`, `makeAction`, `makeCertificate`, `makeCommand`, `makeComponent`, `makeDatabase`, `makeFunction`, `makeJob`, `makeLanguage`, `makeMail`, `makeNotification`, `makePage`, `makePolicy`, `makeQueueTable`, `makeResource`, `makeStack`, `measureDefaultsDrift`, `pantryExecutable`, `pantryInstallArgs`, `parseFields`, `parseGitHubRemote`, `publicationChannels`, `publishGitHubRelease`, `resolveStxSource`, `resolveXcodegen`, `runAdd`, `runCommit`, `runMake`, `runStxLint`, `saveBlogPost`, `scaffoldCrud`, `setDryRun`, `summarizeStructureChanges`, `uninstallStack`, `validateReleaseEvidencePlan`, `verifyReleaseEvidence`, `xcodeDeveloperDir`.
+Declared runtime exports: `BlogAdminError`, `DEFAULT_IOS_DEPENDENCIES`, `DEFAULT_STX_LINT_CONFIG`, `IosToolchainError`, `PUBLICATION_CHECK_SCRIPT`, `XCODE_NOTE`, `assertPublicationAllowed`, `blogSlugify`, `craftSupportsWebkit`, `createComponent`, `createDatabase`, `createFactory`, `createFunction`, `createLanguage`, `createMail`, `createMiddleware`, `createMigration`, `createModel`, `createNotification`, `createPage`, `deleteBlogPost`, `describeDanglingRouteActions`, `describeGitHubRelease`, `discoverPackages`, `ensureDiscoveredPackages`, `findDanglingRouteActions`, `formatProject`, `getBlogPost`, `installStack`, `isDryRunActive`, `lintFix`, `lintProject`, `listBlogPosts`, `listStacks`, `loadIosDependencies`, `loadStxLintConfig`, `macosAgentActionFiles`, `macosAgentDevFiles`, `macosAgentDevManifest`, `macosAgentEntry`, `macosAgentRouteFiles`, `makeAction`, `makeCertificate`, `makeCommand`, `makeComponent`, `makeDatabase`, `makeFunction`, `makeJob`, `makeLanguage`, `makeMail`, `makeNotification`, `makePage`, `makePolicy`, `makeQueueTable`, `makeResource`, `makeStack`, `measureDefaultsDrift`, `pantryExecutable`, `pantryInstallArgs`, `parseFields`, `parseGitHubRemote`, `prepareMacosAgent`, `prepareMacosNative`, `publicationChannels`, `publishGitHubRelease`, `resolveStxSource`, `resolveXcodegen`, `runAdd`, `runCommit`, `runMake`, `runStxLint`, `saveBlogPost`, `scaffoldCrud`, `setDryRun`, `summarizeStructureChanges`, `uninstallStack`, `validateReleaseEvidencePlan`, `verifyReleaseEvidence`, `xcodeDeveloperDir`.
 
-Local source modules: [src/action.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/action.ts), [src/add.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/add.ts), [src/blog-admin.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/blog-admin.ts), [src/build/ios-toolchain.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/build/ios-toolchain.ts), [src/commit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/commit.ts), [src/dev/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/dev/index.ts), [src/discover-packages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/discover-packages.ts), [src/generate/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/generate/index.ts), [src/github-release.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/github-release.ts), [src/helpers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/helpers/index.ts), [src/library/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/library/index.ts), [src/lint/lint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/lint.ts), [src/lint/stx-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/stx-gate.ts), [src/make-command.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-command.ts), [src/make-job.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-job.ts), [src/make-policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-policy.ts), [src/make-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-resource.ts), [src/make.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make.ts), [src/publication-preflight.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/publication-preflight.ts), [src/release-evidence.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/release-evidence.ts), [src/scaffold-crud.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/scaffold-crud.ts), [src/setup/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/setup/index.ts), [src/stacks.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stacks.ts), [src/stx-source.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stx-source.ts), [src/upgrade/package-project.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/package-project.ts), [src/upgrade/route-actions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/route-actions.ts).
+Local source modules: [src/action.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/action.ts), [src/add.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/add.ts), [src/blog-admin.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/blog-admin.ts), [src/build/ios-toolchain.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/build/ios-toolchain.ts), [src/build/macos-native.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/build/macos-native.ts), [src/commit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/commit.ts), [src/dev/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/dev/index.ts), [src/discover-packages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/discover-packages.ts), [src/generate/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/generate/index.ts), [src/github-release.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/github-release.ts), [src/helpers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/helpers/index.ts), [src/library/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/library/index.ts), [src/lint/lint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/lint.ts), [src/lint/stx-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/stx-gate.ts), [src/make-command.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-command.ts), [src/make-job.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-job.ts), [src/make-policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-policy.ts), [src/make-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-resource.ts), [src/make.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make.ts), [src/publication-preflight.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/publication-preflight.ts), [src/release-evidence.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/release-evidence.ts), [src/scaffold-crud.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/scaffold-crud.ts), [src/setup/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/setup/index.ts), [src/stacks.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stacks.ts), [src/stx-source.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stx-source.ts), [src/upgrade/package-project.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/package-project.ts), [src/upgrade/route-actions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/route-actions.ts).
 
-Evidence directory: [94 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [95 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/ai
 
@@ -127,9 +127,9 @@ Guidance: [`stacks-ai`](../stacks-ai/SKILL.md). Source: [storage/framework/core/
 
 Declared runtime exports: `assistantTurn`, `buildMessageWithImages`, `clearUsageReporters`, `estimateMessageTokens`, `estimateTokens`, `fetchWithRetry`, `listUsageReporters`, `normalizeMessagesForProvider`, `onUsage`, `recordUsage`, `sanitizePrompt`, `toolResultsTurn`.
 
-Local source modules: [src/agents/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/agents/index.ts), [src/buddy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/buddy.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/client.ts), [src/context.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/context.ts), [src/documents.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/documents.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/drivers/index.ts), [src/image.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/image.ts), [src/mcp-server.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/mcp-server.ts), [src/mcp.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/mcp.ts), [src/models.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/models.ts), [src/personalization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/personalization.ts), [src/search.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/search.ts), [src/speech.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/speech.ts), [src/text.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/text.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/types.ts), [src/utils/client-bedrock-runtime.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/client-bedrock-runtime.ts), [src/utils/client-bedrock.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/client-bedrock.ts), [src/utils/model-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/model-access.ts), [src/utils/retry.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/retry.ts), [src/utils/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/tokens.ts), [src/utils/tools.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/tools.ts), [src/utils/usage.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/usage.ts), [src/utils/vision.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/vision.ts).
+Local source modules: [src/agents/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/agents/index.ts), [src/buddy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/buddy.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/client.ts), [src/complete.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/complete.ts), [src/context.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/context.ts), [src/documents.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/documents.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/drivers/index.ts), [src/image.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/image.ts), [src/mcp-server.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/mcp-server.ts), [src/mcp.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/mcp.ts), [src/models.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/models.ts), [src/personalization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/personalization.ts), [src/search.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/search.ts), [src/speech.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/speech.ts), [src/text.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/text.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/types.ts), [src/utils/client-bedrock-runtime.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/client-bedrock-runtime.ts), [src/utils/client-bedrock.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/client-bedrock.ts), [src/utils/model-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/model-access.ts), [src/utils/retry.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/retry.ts), [src/utils/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/tokens.ts), [src/utils/tools.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/tools.ts), [src/utils/usage.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/usage.ts), [src/utils/vision.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/utils/vision.ts).
 
-Evidence directory: [20 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [21 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/alias
 
@@ -217,7 +217,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/commands/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/commands/index.ts).
 
-Evidence directory: [174 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [176 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/build
 
@@ -387,9 +387,9 @@ Guidance: [`stacks-desktop`](../stacks-desktop/SKILL.md). Source: [storage/frame
 
 Declared runtime exports: `BUN_EXECUTABLE_MARKER`, `RESERVED_PLIST_KEYS`, `USERLAND_LAUNCHER`, `bundleDirectoryFor`, `codesignArgs`, `craftDevCommand`, `createUpdateManifestUrl`, `describeRuntimeDuplication`, `desktopAppVersion`, `desktopLauncherCompileArgs`, `dmgVolumeName`, `hasUserlandDesktopLauncher`, `isMachO`, `looksLikeBunExecutable`, `openDevWindow`, `plistValue`, `renderInfoPlist`, `renderUserlandPlistEntries`, `resolveCraftBinary`, `resolveCraftExecutable`, `resolveDesktopLauncher`, `resolveDevWindowUrl`, `resolveDmgPackaging`, `xmlEscape`.
 
-Local source modules: [src/invites.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/invites.ts), [src/support.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/support.ts), [src/updater.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/updater.ts).
+Local source modules: [src/agent-launcher.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/agent-launcher.ts), [src/agent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/agent.ts), [src/invites.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/invites.ts), [src/macos-app.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/macos-app.ts), [src/macos-bundle.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/macos-bundle.ts), [src/support.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/support.ts), [src/updater.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/updater.ts).
 
-Evidence directory: [12 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [15 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/development
 
@@ -721,7 +721,7 @@ Evidence directory: [2 retained tests](https://github.com/stacksjs/stacks/blob/m
 
 Guidance: [`stacks-router`](../stacks-router/SKILL.md). Source: [storage/framework/core/router/src/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/index.ts).
 
-Declared runtime exports: `DASHBOARD_ROUTE_GROUPS`, `DEFAULT_ROUTE_BUNDLE_FEATURES`, `DEFAULT_ROUTE_REGISTRY`, `DatabaseSessionStore`, `EncryptedSessionStore`, `FileSessionStore`, `JSON_CONTENT_TYPE`, `MemorySessionStore`, `Middleware`, `PathParamError`, `RedisSessionStore`, `RequestBodyError`, `appRouteRegistry`, `assertRouteMiddlewareResolvable`, `bundleMounts`, `cacheRedisConnection`, `cacheRequestQuery`, `checkApplicationHealth`, `clearCsrfModuleCache`, `clearCurrentRequest`, `clearMiddlewareCache`, `clearRateLimit`, `clearRouteModelBindings`, `clearTrackedQueries`, `clientAddress`, `configureViewDirectories`, `createErrorResponse`, `createMiddlewareErrorResponse`, `createNotFoundResponse`, `createSessionStore`, `createStacksRouter`, `createStacksSessionStore`, `createTypedRouter`, `createValidationErrorResponse`, `dashboardGroupMiddleware`, `defineMiddleware`, `defineRouteModelBinding`, `describeUnknownDashboardGroups`, `disableViewRouting`, `enhanceRequest`, `fallbackStorage`, `findUnresolvableRouteMiddleware`, `getCurrentRequest`, `getQueryShapeCounts`, `getTraceId`, `installMiddlewareHotReload`, `isApiRequest`, `isRouterAction`, `listNamedRoutes`, `listRedirectRoutes`, `listRegisteredRoutes`, `listRootMountedAppRoutes`, `loadMiddlewareHandlers`, `loadRoutes`, `mountedDefaultRouteBundles`, `parseJsonText`, `rateLimit`, `rateLimitScale`, `rateLimitStatus`, `readJsonBody`, `readTextBody`, `request`, `resetBootHooks`, `resetRateLimiters`, `resetSharedRateLimitStorage`, `resetShutdownHooks`, `resolveDashboardAccess`, `resolveRouteModel`, `route`, `routeModelBindings`, `routeParams`, `runBootHooks`, `runHealthProbes`, `runShutdownHooks`, `runWithRequest`, `safePathParam`, `sanitizePathParam`, `scaledLimit`, `serve`, `serverResponse`, `setCurrentRequest`, `setRouteModelFallback`, `sharedRateLimitStorage`, `signUrl`, `signedUrl`, `stream`, `trackQuery`, `trustedProxies`, `url`, `useRateLimitStorage`, `verifySignedUrl`, `verifySignedUrlMiddleware`, `warnOnMultipleRouterInstances`, `withRouteAdmission`, `withTraceId`, `wrapAction`.
+Declared runtime exports: `DASHBOARD_ROUTE_GROUPS`, `DEFAULT_ROUTE_BUNDLE_FEATURES`, `DEFAULT_ROUTE_REGISTRY`, `DatabaseSessionStore`, `EncryptedSessionStore`, `FileSessionStore`, `JSON_CONTENT_TYPE`, `MemorySessionStore`, `Middleware`, `PathParamError`, `RedisSessionStore`, `RequestBodyError`, `appRouteRegistry`, `assertRouteMiddlewareResolvable`, `bundleMounts`, `cacheRedisConnection`, `cacheRequestQuery`, `checkApplicationHealth`, `clearCsrfModuleCache`, `clearCurrentRequest`, `clearMiddlewareCache`, `clearRateLimit`, `clearRouteModelBindings`, `clearTrackedQueries`, `clientAddress`, `configureViewDirectories`, `createErrorResponse`, `createMiddlewareErrorResponse`, `createNotFoundResponse`, `createSessionStore`, `createStacksRouter`, `createStacksSessionStore`, `createTypedRouter`, `createValidationErrorResponse`, `dashboardGroupMiddleware`, `defineMiddleware`, `defineRouteModelBinding`, `describeUnknownDashboardGroups`, `disableViewRouting`, `enhanceRequest`, `fallbackStorage`, `findUnresolvableRouteMiddleware`, `getCurrentRequest`, `getQueryShapeCounts`, `getTraceId`, `installMiddlewareHotReload`, `isApiRequest`, `isRouterAction`, `listNamedRoutes`, `listRedirectRoutes`, `listRegisteredRoutes`, `listRootMountedAppRoutes`, `loadMiddlewareHandlers`, `loadRoutes`, `mountedDefaultRouteBundles`, `parseJsonText`, `provideActions`, `rateLimit`, `rateLimitScale`, `rateLimitStatus`, `readJsonBody`, `readTextBody`, `request`, `resetBootHooks`, `resetRateLimiters`, `resetSharedRateLimitStorage`, `resetShutdownHooks`, `resolveDashboardAccess`, `resolveRouteModel`, `route`, `routeModelBindings`, `routeParams`, `runBootHooks`, `runHealthProbes`, `runShutdownHooks`, `runWithRequest`, `safePathParam`, `sanitizePathParam`, `scaledLimit`, `serve`, `serverResponse`, `setCurrentRequest`, `setRouteModelFallback`, `sharedRateLimitStorage`, `signUrl`, `signedUrl`, `stream`, `trackQuery`, `trustedProxies`, `url`, `useRateLimitStorage`, `verifySignedUrl`, `verifySignedUrlMiddleware`, `warnOnMultipleRouterInstances`, `withRouteAdmission`, `withTraceId`, `wrapAction`.
 
 Local source modules: [src/api-shape.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/api-shape.ts), [src/body.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/body.ts), [src/dashboard-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/dashboard-access.ts), [src/encrypted-session-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/encrypted-session-store.ts), [src/error-handler.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/error-handler.ts), [src/health.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/health.ts), [src/json.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/json.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/middleware.ts), [src/path-sanitize.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/path-sanitize.ts), [src/rate-limit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/rate-limit.ts), [src/request-augmentation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/request-augmentation.ts), [src/request-context.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/request-context.ts), [src/route-loader.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/route-loader.ts), [src/route-model-binding.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/route-model-binding.ts), [src/security-settings.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/security-settings.ts), [src/session-factory.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/session-factory.ts), [src/signed-url.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/signed-url.ts), [src/stacks-router.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/stacks-router.ts), [src/typed-router.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/typed-router.ts).
 
@@ -755,7 +755,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/api-key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/api-key.ts), [src/crypt.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/crypt.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/hash.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/key.ts), [src/outbound.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/outbound.ts), [src/regex.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/regex.ts), [src/webhook.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/webhook.ts).
 
-Evidence directory: [11 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [12 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/server
 
@@ -879,7 +879,7 @@ Guidance: [`stacks-types`](../stacks-types/SKILL.md). Source: [storage/framework
 
 Read the entrypoint and package export map for re-exported or type-only surfaces.
 
-Local source modules: [src/ai.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/ai.ts), [src/analytics.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/analytics.ts), [src/api.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/api.ts), [src/app.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/app.ts), [src/auction.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/auction.ts), [src/auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/auth.ts), [src/auto-imports.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/auto-imports.ts), [src/binary.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/binary.ts), [src/cache.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cache.ts), [src/cdn.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cdn.ts), [src/chat.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/chat.ts), [src/cli.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cli.ts), [src/cloud.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cloud.ts), [src/cms.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cms.ts), [src/commands.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/commands.ts), [src/commerce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/commerce.ts), [src/components.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/components.ts), [src/configure.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/configure.ts), [src/cors.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cors.ts), [src/cron-jobs.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cron-jobs.ts), [src/dashboard.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/dashboard.ts), [src/database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/database.ts), [src/dependencies.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/dependencies.ts), [src/deploy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/deploy.ts), [src/dns.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/dns.ts), [src/docs.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/docs.ts), [src/email.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/email.ts), [src/env.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/env.ts), [src/errors.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/errors.ts), [src/events.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/events.ts), [src/exit-code.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/exit-code.ts), [src/feature-flags.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/feature-flags.ts), [src/file-systems.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/file-systems.ts), [src/forms.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/forms.ts), [src/git.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/git.ts), [src/hashing.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/hashing.ts), [src/helpers.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/helpers.ts), [src/i18n.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/i18n.ts), [src/images.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/images.ts), [src/library.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/library.ts), [src/lint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/lint.ts), [src/logging.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/logging.ts), [src/manifest.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/manifest.ts), [src/marketing.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/marketing.ts), [src/mobile.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/mobile.ts), [src/model-dashboard-augmentation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/model-dashboard-augmentation.ts), [src/model-names.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/model-names.ts), [src/model.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/model.ts), [src/monitoring.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/monitoring.ts), [src/notifications.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/notifications.ts), [src/oauth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/oauth.ts), [src/pages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/pages.ts), [src/payments.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/payments.ts), [src/phone.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/phone.ts), [src/ports.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/ports.ts), [src/promise.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/promise.ts), [src/push.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/push.ts), [src/queue.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/queue.ts), [src/reactivity.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/reactivity.ts), [src/realtime.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/realtime.ts), [src/request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/request.ts), [src/response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/response.ts), [src/router.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/router.ts), [src/saas.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/saas.ts), [src/scheduler.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/scheduler.ts), [src/search-engine.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/search-engine.ts), [src/security.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/security.ts), [src/seo.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/seo.ts), [src/server.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/server.ts), [src/services.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/services.ts), [src/settings-config.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/settings-config.ts), [src/sites.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/sites.ts), [src/sms.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/sms.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/socials.ts), [src/stack-extensions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/stack-extensions.ts), [src/stacks.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/stacks.ts), [src/storage.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/storage.ts), [src/table-names.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/table-names.ts), [src/tables.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/tables.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/team.ts), [src/ui.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/ui.ts), [src/utils.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/utils.ts).
+Local source modules: [src/ai.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/ai.ts), [src/analytics.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/analytics.ts), [src/api.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/api.ts), [src/app.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/app.ts), [src/auction.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/auction.ts), [src/auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/auth.ts), [src/auto-imports.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/auto-imports.ts), [src/binary.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/binary.ts), [src/cache.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cache.ts), [src/cdn.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cdn.ts), [src/chat.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/chat.ts), [src/cli.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cli.ts), [src/cloud.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cloud.ts), [src/cms.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cms.ts), [src/commands.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/commands.ts), [src/commerce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/commerce.ts), [src/components.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/components.ts), [src/configure.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/configure.ts), [src/cors.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cors.ts), [src/cron-jobs.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/cron-jobs.ts), [src/dashboard.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/dashboard.ts), [src/database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/database.ts), [src/dependencies.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/dependencies.ts), [src/deploy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/deploy.ts), [src/desktop.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/desktop.ts), [src/dns.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/dns.ts), [src/docs.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/docs.ts), [src/email.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/email.ts), [src/env.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/env.ts), [src/errors.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/errors.ts), [src/events.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/events.ts), [src/exit-code.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/exit-code.ts), [src/feature-flags.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/feature-flags.ts), [src/file-systems.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/file-systems.ts), [src/forms.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/forms.ts), [src/git.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/git.ts), [src/hashing.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/hashing.ts), [src/helpers.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/helpers.ts), [src/i18n.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/i18n.ts), [src/images.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/images.ts), [src/library.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/library.ts), [src/lint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/lint.ts), [src/logging.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/logging.ts), [src/manifest.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/manifest.ts), [src/marketing.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/marketing.ts), [src/mobile.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/mobile.ts), [src/model-dashboard-augmentation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/model-dashboard-augmentation.ts), [src/model-names.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/model-names.ts), [src/model.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/model.ts), [src/monitoring.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/monitoring.ts), [src/notifications.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/notifications.ts), [src/oauth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/oauth.ts), [src/pages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/pages.ts), [src/payments.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/payments.ts), [src/phone.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/phone.ts), [src/ports.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/ports.ts), [src/promise.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/promise.ts), [src/push.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/push.ts), [src/queue.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/queue.ts), [src/reactivity.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/reactivity.ts), [src/realtime.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/realtime.ts), [src/request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/request.ts), [src/response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/response.ts), [src/router.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/router.ts), [src/saas.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/saas.ts), [src/scheduler.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/scheduler.ts), [src/search-engine.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/search-engine.ts), [src/security.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/security.ts), [src/seo.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/seo.ts), [src/server.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/server.ts), [src/services.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/services.ts), [src/settings-config.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/settings-config.ts), [src/sites.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/sites.ts), [src/sms.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/sms.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/socials.ts), [src/stack-extensions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/stack-extensions.ts), [src/stacks.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/stacks.ts), [src/storage.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/storage.ts), [src/table-names.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/table-names.ts), [src/tables.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/tables.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/team.ts), [src/ui.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/ui.ts), [src/utils.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/utils.ts).
 
 Evidence directory: [2 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 

package/ai/skills/stacks-security/SKILL.md

@@ -22,6 +22,32 @@ security/src/
 └── hash.ts     # password hashing (bcrypt/argon2)
 ```
 
+## Scanning a project: `buddy security:scan`
+
+`buddy security:scan` (alias `buddy audit`) checks a project for security problems and exits non-zero on findings at or above `--fail-on` (default `high`), so it drops into CI. Five checks, each runnable alone with `--only` or left out with `--skip`:
+
+| Check | Finds |
+|---|---|
+| `dependencies` | Known vulnerabilities in the lockfile (`bun audit`; needs the network, skipped with `--offline`) |
+| `secrets` | Committed credentials: private keys, AWS/Stripe/GitHub/Anthropic/OpenAI/Slack/Google/Twilio/SendGrid/npm tokens, database URLs with passwords, `secret = "high-entropy value"` |
+| `code` | `eval` / `new Function`, shell commands built from strings, SQL built with interpolation, disabled TLS verification, `alg: none`, `innerHTML`, `Math.random()` for tokens, MD5/SHA-1, CORS `*` with credentials |
+| `workflows` | GitHub Actions that paste untrusted text into `run:`, check out a pull request under `pull_request_target`, echo secrets, or follow a branch |
+| `hygiene` | Committed `.env` files with readable secrets (encrypted values are fine), key files, a `.gitignore` without `.env`, no lockfile |
+
+```bash
+buddy security:scan                          # everything, fail on high or worse
+buddy security:scan --only dependencies,secrets --fail-on medium
+buddy security:scan --json                   # the report, for tooling
+buddy security:scan --show-ignored           # what exceptions set aside
+```
+
+A finding that is fine is set aside with a reason, never silently:
+
+- On the line (or the line above): `// security-ignore: code/inner-html the HTML is sanitized by sanitize()`
+- In `.security-ignore.json`: `{ "ignore": [{ "rule": "code/sql-interpolation", "path": "database/seed.ts", "reason": "ids from rows it just selected", "expires": "2027-06-30" }] }`. `rule` takes `code/*`; `path` is a file or a directory ending in `/`; for an advisory use `"reference": "GHSA-…"` or the package name. An entry without a reason, or past its `expires`, is reported and no longer applies.
+
+A check that cannot run (offline, no `bun.lock`) is listed under "not checked", never reported as clean. Programmatic use: `import { runSecurityScan } from '@stacksjs/security/scan'`.
+
 ## App Key Generation
 
 ```typescript

package/ai/skills/stacks-security-audit/SKILL.md

@@ -10,6 +10,10 @@ allowed-tools: Read Edit Write Bash Grep Glob
 
 You are performing a security analysis for a Stacks application. Be concrete — every finding must include a realistic exploit scenario. Vague warnings are worthless.
 
+## Step 0: Run the scanner
+
+Run `buddy security:scan --show-ignored` first (see the `stacks-security` skill). It already covers vulnerable dependencies, committed secrets, dangerous calls, risky GitHub workflows and repository hygiene, so do not repeat those by hand: verify each finding it reports (read the code, confirm it is reachable) and spend your own effort on what a pattern scan cannot see: authorization gaps, business-logic abuse, trust boundaries and data exposure. Treat every `security-ignore` reason as a claim to check.
+
 ## Determine Scope
 
 1. If the user specifies files or a feature, analyze that scope

package/ai/skills/stacks-stx/SKILL.md

@@ -185,7 +185,8 @@ through STX's asynchronous render boundary. Pair tenant features with
 `stacks-sites`.
 
 The browser has both eagerly delivered and demand-bundled composables.
-Observers, motion helpers and STX `useForm` are usable client primitives in
+Observers, motion helpers, STX `useForm` and `useCompletion` (inline AI ghost
+text; `<AiTextarea>` is the ready-made textarea) are usable client primitives in
 current STX, even when they are not explicit `window.name` aliases. Read
 `stacks-composables/BROWSER.md` before choosing a signature or mixing the
 browser signal API with explicit module Refs.

package/app/Actions/AI/CompleteAction.ts

@@ -0,0 +1,50 @@
+import type { ConfiguredAIOptions } from '@stacksjs/ai'
+import type { RequestInstance } from '@stacksjs/types'
+import { Action } from '@stacksjs/actions/runtime'
+import { complete, completionStatus } from '@stacksjs/ai'
+import { resolveAuthenticatedUser } from '@stacksjs/auth'
+import { config } from '@stacksjs/config'
+import { log } from '@stacksjs/logging'
+import type { ResponseStatus } from '@stacksjs/router'
+import { rateLimit, response } from '@stacksjs/router'
+import { COMPLETE_RATE_PER_MINUTE, handleCompleteRequest } from './complete-request'
+
+/**
+ * `POST /ai/complete`: the ghost text behind an editor's Tab-to-accept.
+ *
+ * Body `{ before, after?, kind?: 'note' | 'prompt' | 'todo' | 'text', context? }`,
+ * answer `{ completion }`. `''` means "no suggestion", including when the app
+ * has no AI driver configured; a provider failure is a 502.
+ *
+ * Needs a signed-in user and is rate limited per user. Mount it under another
+ * path with `route.post('/complete', 'Actions/AI/CompleteAction').middleware('auth')`.
+ */
+export default new Action({
+  name: 'AiCompleteAction',
+  description: 'Complete the text at the cursor with the configured AI driver',
+  method: 'POST',
+  apiResponse: true,
+
+  async handle(request: RequestInstance) {
+    const aiConfig = (config.ai || {}) as ConfiguredAIOptions
+    const body = {
+      before: request.get('before'),
+      after: request.get('after'),
+      kind: request.get('kind'),
+      context: request.get('context'),
+    }
+
+    const result = await handleCompleteRequest({
+      body,
+      config: aiConfig,
+      authenticate: () => resolveAuthenticatedUser(request as any),
+      limit: userId => rateLimit('ai-complete', COMPLETE_RATE_PER_MINUTE, { identity: `user:${userId}` }).per('minute'),
+      available: cfg => completionStatus(cfg).available,
+      complete: input => complete(input, { config: aiConfig }),
+      signal: (request as { signal?: AbortSignal }).signal,
+      log: (message, context) => void log.error(message, context),
+    })
+
+    return response.json(result.body, result.status as ResponseStatus)
+  },
+})

package/app/Actions/AI/complete-action.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, test } from 'bun:test'
+import { readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+describe('CompleteAction wiring', () => {
+  test('is a POST action the default /ai route group mounts', () => {
+    const routes = readFileSync(join(import.meta.dir, '../../../routes/dashboard.ts'), 'utf8')
+    expect(routes).toContain('route.post(\'/complete\', \'Actions/AI/CompleteAction\')')
+    // Inside the guarded `/ai` group, so it is mounted at /ai/complete behind auth.
+    const group = routes.slice(routes.indexOf('route.group({ prefix: \'/ai\''))
+    expect(group.indexOf('/complete')).toBeGreaterThan(0)
+    expect(group.indexOf('/complete')).toBeLessThan(group.indexOf('})'))
+  })
+
+  test('loads and declares POST', async () => {
+    const action = (await import('./CompleteAction')).default as { name?: string, method?: string }
+    expect(action.method).toBe('POST')
+    expect(action.name).toBe('AiCompleteAction')
+  })
+})

package/app/Actions/AI/complete-request.test.ts

@@ -0,0 +1,91 @@
+import type { CompleteRequestDeps } from './complete-request'
+import { describe, expect, test } from 'bun:test'
+import { COMPLETE_MAX_BEFORE, handleCompleteRequest, parseCompleteBody } from './complete-request'
+
+function deps(overrides: Partial<CompleteRequestDeps> = {}): CompleteRequestDeps & { calls: unknown[], limited: Array<number | string> } {
+  const calls: unknown[] = []
+  const limited: Array<number | string> = []
+  return {
+    calls,
+    limited,
+    body: { before: 'Remember to buy ', kind: 'todo' },
+    config: { default: 'anthropic' },
+    authenticate: async () => ({ id: 7 }),
+    limit: async (id) => { limited.push(id) },
+    available: () => true,
+    complete: async (input) => {
+      calls.push(input)
+      return { completion: 'milk' }
+    },
+    ...overrides,
+  }
+}
+
+describe('POST /ai/complete', () => {
+  test('requires a signed-in user', async () => {
+    const d = deps({ authenticate: async () => undefined })
+    const result = await handleCompleteRequest(d)
+    expect(result.status).toBe(401)
+    expect(d.calls).toHaveLength(0)
+    expect(d.limited).toHaveLength(0)
+  })
+
+  test('an auth backend failure is a 503, not a silent pass', async () => {
+    const result = await handleCompleteRequest(deps({ authenticate: async () => { throw new Error('db down') } }))
+    expect(result.status).toBe(503)
+  })
+
+  test('validates the body', async () => {
+    expect((await handleCompleteRequest(deps({ body: {} }))).status).toBe(422)
+    expect((await handleCompleteRequest(deps({ body: { before: 5 } }))).status).toBe(422)
+    expect((await handleCompleteRequest(deps({ body: { before: 'x', kind: 'poem' } }))).status).toBe(422)
+    expect((await handleCompleteRequest(deps({ body: { before: 'x', after: 5 } }))).status).toBe(422)
+    expect((await handleCompleteRequest(deps({ body: { before: 'x'.repeat(COMPLETE_MAX_BEFORE + 1) } }))).status).toBe(422)
+    expect(parseCompleteBody({ before: 'x' })).toEqual({ ok: true, value: { before: 'x', after: '', kind: 'text', context: '' } })
+  })
+
+  test('returns the completion and spends one slot of that user\'s budget', async () => {
+    const d = deps({ body: { before: 'Remember to buy ', after: '', kind: 'todo', context: 'Groceries' } })
+    const result = await handleCompleteRequest(d)
+    expect(result).toEqual({ status: 200, body: { completion: 'milk' } })
+    expect(d.limited).toEqual([7])
+    expect(d.calls[0]).toMatchObject({ before: 'Remember to buy ', kind: 'todo', context: 'Groceries' })
+  })
+
+  test('answers an empty completion, not an error, when no AI driver is configured', async () => {
+    const d = deps({ available: () => false })
+    const result = await handleCompleteRequest(d)
+    expect(result).toEqual({ status: 200, body: { completion: '' } })
+    expect(d.calls).toHaveLength(0)
+    expect(d.limited).toHaveLength(0)
+  })
+
+  test('nothing to continue is an empty completion without a model call', async () => {
+    const d = deps({ body: { before: '  \n' } })
+    expect(await handleCompleteRequest(d)).toEqual({ status: 200, body: { completion: '' } })
+    expect(d.calls).toHaveLength(0)
+  })
+
+  test('a provider failure is a 502 with a clear message', async () => {
+    const logged: string[] = []
+    const result = await handleCompleteRequest(deps({
+      complete: async () => { throw new Error('Claude API error: overloaded') },
+      log: message => void logged.push(message),
+    }))
+    expect(result.status).toBe(502)
+    expect(result.body).toEqual({ message: 'The AI provider could not complete the text.' })
+    expect(logged).toHaveLength(1)
+  })
+
+  test('an aborted request is not reported as a failure', async () => {
+    const abort = Object.assign(new Error('aborted'), { name: 'AbortError' })
+    const result = await handleCompleteRequest(deps({ complete: async () => { throw abort } }))
+    expect(result).toEqual({ status: 200, body: { completion: '' } })
+  })
+
+  test('the rate limit rejection propagates for the framework to turn into a 429', async () => {
+    const d = deps({ limit: async () => { throw Object.assign(new Error('Too many requests'), { status: 429 }) } })
+    await expect(handleCompleteRequest(d)).rejects.toMatchObject({ status: 429 })
+    expect(d.calls).toHaveLength(0)
+  })
+})

package/app/Actions/AI/complete-request.ts

@@ -0,0 +1,119 @@
+import type { CompleteInput, CompletionKind, ConfiguredAIOptions } from '@stacksjs/ai'
+
+/**
+ * The testable core of `POST /ai/complete`. The Action reads the request and
+ * hands this its parts; everything decided here is a status and a body.
+ *
+ * Two answers matter to an editor drawing ghost text:
+ *   - `200 { completion: '' }` is "no suggestion", and it covers a missing or
+ *     disabled AI driver, so an app without AI keys never shows an error while
+ *     someone types.
+ *   - `502` is a real provider failure, with a message worth logging.
+ */
+
+export const COMPLETE_MAX_BEFORE = 20_000
+export const COMPLETE_MAX_AFTER = 5_000
+export const COMPLETE_MAX_CONTEXT = 2_000
+/** Suggestions per user per minute. The client debounces; this is the backstop. */
+export const COMPLETE_RATE_PER_MINUTE = 90
+
+const KINDS: readonly CompletionKind[] = ['note', 'prompt', 'todo', 'text']
+
+export interface CompleteRequestBody {
+  before?: unknown
+  after?: unknown
+  kind?: unknown
+  context?: unknown
+}
+
+export interface ParsedCompleteBody {
+  before: string
+  after: string
+  kind: CompletionKind
+  context: string
+}
+
+export function parseCompleteBody(body: CompleteRequestBody): { ok: true, value: ParsedCompleteBody } | { ok: false, message: string } {
+  if (typeof body.before !== 'string')
+    return { ok: false, message: 'The before field must be the text before the cursor.' }
+  if (body.before.length > COMPLETE_MAX_BEFORE)
+    return { ok: false, message: `The before field must be ${COMPLETE_MAX_BEFORE} characters or fewer.` }
+
+  if (body.after !== undefined && body.after !== null && typeof body.after !== 'string')
+    return { ok: false, message: 'The after field must be the text after the cursor.' }
+  if (typeof body.after === 'string' && body.after.length > COMPLETE_MAX_AFTER)
+    return { ok: false, message: `The after field must be ${COMPLETE_MAX_AFTER} characters or fewer.` }
+
+  if (body.kind !== undefined && body.kind !== null && !KINDS.includes(body.kind as CompletionKind))
+    return { ok: false, message: `The kind field must be one of ${KINDS.join(', ')}.` }
+
+  if (body.context !== undefined && body.context !== null && typeof body.context !== 'string')
+    return { ok: false, message: 'The context field must be text.' }
+  if (typeof body.context === 'string' && body.context.length > COMPLETE_MAX_CONTEXT)
+    return { ok: false, message: `The context field must be ${COMPLETE_MAX_CONTEXT} characters or fewer.` }
+
+  return {
+    ok: true,
+    value: {
+      before: body.before,
+      after: typeof body.after === 'string' ? body.after : '',
+      kind: (body.kind as CompletionKind | undefined | null) ?? 'text',
+      context: typeof body.context === 'string' ? body.context : '',
+    },
+  }
+}
+
+export interface CompleteRequestDeps {
+  body: CompleteRequestBody
+  /** Resolves the signed-in user, or undefined. Throws when auth itself broke. */
+  authenticate: () => Promise<{ id: number | string } | undefined>
+  /** Consumes one slot of the user's budget; throws an HttpError(429) when spent. */
+  limit: (userId: number | string) => Promise<void>
+  config: ConfiguredAIOptions
+  complete: (input: CompleteInput) => Promise<{ completion: string }>
+  /** Whether a driver can answer at all; false answers `''` without a call. */
+  available: (config: ConfiguredAIOptions) => boolean
+  signal?: AbortSignal
+  log?: (message: string, context: Record<string, unknown>) => void
+}
+
+export interface CompleteRequestResult {
+  status: number
+  body: { completion: string } | { message: string }
+}
+
+export async function handleCompleteRequest(deps: CompleteRequestDeps): Promise<CompleteRequestResult> {
+  let user
+  try {
+    user = await deps.authenticate()
+  }
+  catch (error) {
+    deps.log?.('[ai] Completion auth failed', { error })
+    return { status: 503, body: { message: 'Authentication could not be verified.' } }
+  }
+  if (!user?.id)
+    return { status: 401, body: { message: 'Sign in to use completions.' } }
+
+  const parsed = parseCompleteBody(deps.body)
+  if (!parsed.ok)
+    return { status: 422, body: { message: parsed.message } }
+
+  // Nothing to continue, or nowhere to ask: the same quiet answer, and no
+  // budget spent.
+  if (!parsed.value.before.trim() || !deps.available(deps.config))
+    return { status: 200, body: { completion: '' } }
+
+  await deps.limit(user.id)
+
+  try {
+    const { completion } = await deps.complete({ ...parsed.value, signal: deps.signal })
+    return { status: 200, body: { completion } }
+  }
+  catch (error) {
+    // The client moved on (aborted its request): not a failure to report.
+    if ((error as Error)?.name === 'AbortError')
+      return { status: 200, body: { completion: '' } }
+    deps.log?.('[ai] Completion request failed', { error })
+    return { status: 502, body: { message: 'The AI provider could not complete the text.' } }
+  }
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.390",
+  "version": "0.75.398",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.390",
+  "version": "0.75.398",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -45,9 +45,9 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.390",
-    "@stacksjs/sanitizer": "0.2.752",
-    "@stacksjs/stx": "0.2.752",
+    "@stacksjs/mobile": "0.75.398",
+    "@stacksjs/sanitizer": "0.2.775",
+    "@stacksjs/stx": "0.2.775",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "ts-qr-codes": "^0.1.8"

package/resources/components/Dashboard/Auth/AuthCard.stx

@@ -12,14 +12,21 @@
  */
 const title = useReactiveProp('title', '')
 const subtitle = useReactiveProp('subtitle', '')
+// The mark above the heading. An app brands it with an Iconify class, a short line above the title, or its own
+// markup in the `brand` slot, without forking the four pages that sit in this card (stacksjs/stacks#3086).
+const icon = useReactiveProp('icon', 'i-hugeicons-cube')
+const eyebrow = useReactiveProp('eyebrow', '')
 </script>
 
 <div class="flex items-center justify-center px-4 py-12 min-h-screen">
   <div class="max-w-sm w-full">
     <div class="mb-8 text-center">
-      <div class="inline-flex items-center justify-center mb-4 h-12 w-12 bg-gradient-to-br from-blue-500 to-blue-600 rounded-xl shadow-blue-500/25 shadow-lg">
-        <span class="h-7 w-7 text-white i-hugeicons-cube"></span>
-      </div>
+      <slot name="brand">
+        <div class="inline-flex items-center justify-center mb-4 h-12 w-12 bg-gradient-to-br from-blue-500 to-blue-600 rounded-xl shadow-blue-500/25 shadow-lg">
+          <span class="h-7 w-7 text-white" :class="icon()"></span>
+        </div>
+      </slot>
+      <p :if="eyebrow()" class="mb-1 font-semibold text-blue-600 text-xs tracking-widest uppercase dark:text-blue-400">{{ eyebrow() }}</p>
       <h1 class="font-semibold text-2xl text-neutral-900 dark:text-white">{{ title() }}</h1>
       <p class="mt-2 text-neutral-500 text-sm dark:text-neutral-400">{{ subtitle() }}</p>
     </div>

package/resources/components/Dashboard/Auth/ForgotPassword.stx

@@ -4,6 +4,8 @@
 const emit = defineEmits(['submit', 'retry'])
 const title = useReactiveProp<string>('title', 'Forgot password?')
 const subtitle = useReactiveProp<string>('subtitle', 'Enter your email and we\'ll send you a reset link')
+const icon = useReactiveProp<string>('icon', 'i-hugeicons-cube')
+const eyebrow = useReactiveProp<string>('eyebrow', '')
 const isLoading = useReactiveProp<boolean>('isLoading', false)
 const error = useReactiveProp<string>('error', '')
 const success = useReactiveProp<boolean>('success', false)
@@ -19,7 +21,7 @@ function retry(): void {
   emit('retry')
 }
 </script>
-<AuthCard :title="title()" :subtitle="subtitle()">
+<AuthCard :title="title()" :subtitle="subtitle()" :icon="icon()" :eyebrow="eyebrow()">
 
   <!-- Form Card -->
   <div class="p-6 bg-white dark:bg-neutral-900 border border-neutral-200/60 rounded-2xl dark:border-neutral-800 shadow-black/5 shadow-xl dark:shadow-black/20">

package/resources/components/Dashboard/Auth/ForgotPasswordDashboard.stx

@@ -6,6 +6,9 @@
 // "dashboardApi is not defined", which the catch below then showed to the
 // visitor as the reason their reset link could not be sent.
 import { dashboardApi } from '../../../../functions/dashboard-api'
+// Branding passes through to the card: an Iconify class for the mark and a short line above the title (stacksjs/stacks#3086).
+const icon = useReactiveProp<string>('icon', 'i-hugeicons-cube')
+const eyebrow = useReactiveProp<string>('eyebrow', '')
 
 const isLoading = state(false)
 const error = state('')
@@ -39,6 +42,8 @@ function handleRetry(): void {
 
 <template>
   <ForgotPassword
+    :icon="icon()"
+    :eyebrow="eyebrow()"
     @submit="handleForgotPassword"
     @retry="handleRetry"
     :isLoading="isLoading()"

package/resources/components/Dashboard/Auth/Login.stx

@@ -4,6 +4,8 @@
 const emit = defineEmits(['submit'])
 const title = useReactiveProp<string>('title', 'Welcome back')
 const subtitle = useReactiveProp<string>('subtitle', 'Sign in to your account')
+const icon = useReactiveProp<string>('icon', 'i-hugeicons-cube')
+const eyebrow = useReactiveProp<string>('eyebrow', '')
 const isLoading = useReactiveProp<boolean>('isLoading', false)
 const error = useReactiveProp<string>('error', '')
 const showRememberMe = useReactiveProp<boolean>('showRememberMe', true)
@@ -56,7 +58,7 @@ function handleSubmit(): void {
 }
 </script>
 
-<AuthCard :title="title()" :subtitle="subtitle()">
+<AuthCard :title="title()" :subtitle="subtitle()" :icon="icon()" :eyebrow="eyebrow()">
 
   <div class="p-6 bg-white dark:bg-neutral-900 border border-neutral-200/60 rounded-2xl dark:border-neutral-800 shadow-black/5 shadow-xl dark:shadow-black/20">
     <div :if="error()" role="alert" class="mb-4 p-3 bg-red-50 dark:bg-red-900/20 border border-red-200 rounded-lg dark:border-red-800">

package/resources/components/Dashboard/Auth/LoginDashboard.stx

@@ -1,6 +1,9 @@
 <script client>
 import type { AuthUser } from '../../../../types/dashboard'
 import { describeAuthError, isLoginResponse, isTwoFactorChallenge, safeAuthRedirect, useAuth } from '../../../../functions/auth'
+// Branding passes through to the card: an Iconify class for the mark and a short line above the title (stacksjs/stacks#3086).
+const icon = useReactiveProp<string>('icon', 'i-hugeicons-cube')
+const eyebrow = useReactiveProp<string>('eyebrow', '')
 
 const { login, verifyTwoFactorLogin } = useAuth()
 const route = useRoute()
@@ -71,6 +74,8 @@ function restartLogin(): void {
 
 <template>
   <Login
+    :icon="icon()"
+    :eyebrow="eyebrow()"
     :if="!challengeToken()"
     @submit="handleLogin"
     :isLoading="isLoading()"

package/resources/components/Dashboard/Auth/Register.stx

@@ -4,6 +4,8 @@
 const emit = defineEmits(['submit'])
 const title = useReactiveProp<string>('title', 'Create an account')
 const subtitle = useReactiveProp<string>('subtitle', 'Get started with your free account')
+const icon = useReactiveProp<string>('icon', 'i-hugeicons-cube')
+const eyebrow = useReactiveProp<string>('eyebrow', '')
 const isLoading = useReactiveProp<boolean>('isLoading', false)
 const error = useReactiveProp<string>('error', '')
 const showLogin = useReactiveProp<boolean>('showLogin', true)
@@ -98,7 +100,7 @@ function handleSubmit(): void {
   })
 }
 </script>
-<AuthCard :title="title()" :subtitle="subtitle()">
+<AuthCard :title="title()" :subtitle="subtitle()" :icon="icon()" :eyebrow="eyebrow()">
 
   <!-- Register Form -->
   <div class="p-6 bg-white dark:bg-neutral-900 border border-neutral-200/60 rounded-2xl dark:border-neutral-800 shadow-black/5 shadow-xl dark:shadow-black/20">

package/resources/components/Dashboard/Auth/RegisterDashboard.stx

@@ -1,6 +1,9 @@
 <script client>
 import type { RegisterCredentials } from '../../../../types/dashboard'
 import { describeAuthError, safeAuthRedirect, useAuth } from '../../../../functions/auth'
+// Branding passes through to the card: an Iconify class for the mark and a short line above the title (stacksjs/stacks#3086).
+const icon = useReactiveProp<string>('icon', 'i-hugeicons-cube')
+const eyebrow = useReactiveProp<string>('eyebrow', '')
 
 const { register } = useAuth()
 const route = useRoute()
@@ -38,6 +41,8 @@ async function handleRegister(credentials: RegisterCredentials): Promise<void> {
 
 <template>
   <Register
+    :icon="icon()"
+    :eyebrow="eyebrow()"
     @submit="handleRegister"
     :isLoading="isLoading()"
     :error="error()"

package/resources/components/Dashboard/Auth/ResetPassword.stx

@@ -16,6 +16,8 @@
 const emit = defineEmits(['submit'])
 const title = useReactiveProp<string>('title', 'Choose a new password')
 const subtitle = useReactiveProp<string>('subtitle', 'Set the password you will use to sign in')
+const icon = useReactiveProp<string>('icon', 'i-hugeicons-cube')
+const eyebrow = useReactiveProp<string>('eyebrow', '')
 const isLoading = useReactiveProp<boolean>('isLoading', false)
 const error = useReactiveProp<string>('error', '')
 const success = useReactiveProp<boolean>('success', false)
@@ -43,7 +45,7 @@ function handleSubmit(): void {
 }
 </script>
 
-<AuthCard :title="title()" :subtitle="subtitle()">
+<AuthCard :title="title()" :subtitle="subtitle()" :icon="icon()" :eyebrow="eyebrow()">
 
   <!-- Form Card -->
   <div class="p-6 bg-white dark:bg-neutral-900 border border-neutral-200/60 rounded-2xl dark:border-neutral-800 shadow-black/5 shadow-xl dark:shadow-black/20">

package/resources/components/Dashboard/Auth/ResetPasswordDashboard.stx

@@ -12,6 +12,9 @@
  * instead of after someone has chosen and typed a new password twice.
  */
 import { dashboardApi } from '../../../../functions/dashboard-api'
+// Branding passes through to the card: an Iconify class for the mark and a short line above the title (stacksjs/stacks#3086).
+const icon = useReactiveProp<string>('icon', 'i-hugeicons-cube')
+const eyebrow = useReactiveProp<string>('eyebrow', '')
 
 const route = useRoute()
 
@@ -85,6 +88,8 @@ effect(() => {
 
 <template>
   <ResetPassword
+    :icon="icon()"
+    :eyebrow="eyebrow()"
     @submit="handleReset"
     :checking="checking()"
     :invalid="invalid()"

package/routes/dashboard.ts

@@ -182,6 +182,8 @@ route.get('/robots.txt', 'Actions/RobotsAction')
 route.group({ prefix: '/ai', middleware: guarded('/ai') }, () => {
   route.post('/ask', 'Actions/AI/AskAction')
   route.post('/summary', 'Actions/AI/SummaryAction')
+  // Ghost-text completions for editors: `{ before, after?, kind?, context? }` -> `{ completion }`.
+  route.post('/complete', 'Actions/AI/CompleteAction')
 })
 
 // ============================================================================