@stacksjs/defaults 0.75.86 → 0.75.87

package/ai/skills/stacks-ai/SKILL.md

@@ -69,7 +69,8 @@ const result = await bedrock.chat([{ role: 'user', content: 'Hello' }], { system
 ```
 
 - Every request goes through Bedrock's Converse API, so one shape serves Nova,
-  Claude and Llama; the model is configuration. No streaming yet.
+  Claude and Llama; the model is configuration. `bedrock.streamChat()` and
+  `streamChatEvents()` stream through `converse-stream` (ts-cloud >= 0.16.44).
 - Credentials come from the AWS credential chain, never config. Region:
   `drivers.bedrock.region`, `AWS_REGION`, `AWS_DEFAULT_REGION`, us-east-1.
 - Default model `amazon.nova-lite-v1:0`: on demand, no profile, no agreement.
@@ -96,7 +97,11 @@ messages.push(assistantTurn(result), toolResultsTurn(
 - The `responseFormat` structured-output tool is internal: its JSON is
   `content`, never a tool call.
 - Ollama refuses `toolChoice: 'required'` / `{ name }`; it cannot force a call.
-- `streamChat()` streams text only.
+- Streaming takes the same `tools`. `streamChat()` yields text and returns the
+  full `AIResult` (with `toolCalls`) when it ends; `streamChatEvents()` yields
+  `{ type: 'text' }`, `{ type: 'tool_call', call }` (whole, once its arguments
+  have streamed) and a final `{ type: 'done', result }`. Every driver,
+  Bedrock included.
 
 ## Provider-Neutral Client
 

package/ai/skills/stacks-api/SKILL.md

@@ -799,6 +799,12 @@ Models with `traits.useApi` automatically get CRUD routes via ORM actions:
 | PUT/PATCH | `/api/{model}/{id}` | Generated update | 200 |
 | DELETE | `/api/{model}/{id}` | Generated destroy | 204 |
 
+Which `useApi` models get these routes is `security.api.models` in
+`config/security.ts` (`'all'` by default, `'own'`, `'none'`, or a list of model
+names that may include `'own'`), overridden by `STACKS_MODEL_APIS`. `'all'`
+includes the ~80 framework models, so an app that does not use commerce or
+CMS should set `'own'`. The OpenAPI schemas follow the same selection.
+
 Generated store and update handlers accept declared `fillable` attributes and
 the foreign-key attributes derived from `belongsTo`. For example,
 `belongsTo: ['Product', 'Customer']` accepts `productId` / `product_id` and

package/ai/skills/stacks-config/SKILL.md

@@ -60,6 +60,23 @@ they name: `defineEvents` and `defineListener` from `@stacksjs/events`,
 - `determineAppEnv(): 'dev' | 'stage' | 'prod' | string`
 - `localUrl(): string` — local development URL
 
+## Feature Flags
+`feature(name)` from `@stacksjs/config` reads `enabled` on `config/<name>.ts`.
+It accepts the installable bundles (`dashboard`, `commerce`, `cms`, `forms`,
+`marketing`, `monitoring`, `realtime`, `queue`) plus two config gates: `auth`
+(whether the ORM loads Team, Referral, Subscriber, Site and the other account
+models; it does not mount the auth routes, `STACKS_DEFAULT_ROUTES` does) and
+`email` (the email webhook route bundle). `./buddy features` lists both groups.
+
+Any other name is a compile error, so a typo cannot silently read `false`. An
+app's own flags are declared first:
+
+```ts
+declare module '@stacksjs/config' {
+  interface AppFeatureFlags { 'new-checkout': true }
+}
+```
+
 ## All 44 Config Files
 
 ### Core App
@@ -104,7 +121,7 @@ they name: `defineEvents` and `defineListener` from `@stacksjs/events`,
 ### Security
 | File | Type | Key Settings |
 |------|------|-------------|
-| `security.ts` | SecurityConfig | firewall (enabled, countryCodes, rateLimitPerMinute:500) |
+| `security.ts` | SecurityConfig | api.rowScoping('deny'), api.models('all' / 'own' / 'none' / names; `STACKS_MODEL_APIS` overrides), firewall (enabled, countryCodes, rateLimitPerMinute) |
 | `hashing.ts` | HashingConfig | driver('bcrypt'), bcrypt.rounds(12), argon2 config |
 
 ### Features

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.86",
+  "version": "0.75.87",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.86",
+  "version": "0.75.87",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "^0.75.86",
+    "@stacksjs/mobile": "^0.75.87",
     "@stacksjs/sanitizer": "^0.2.384",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",