feat: add AI chatbot building blocks

Add Vercel AI SDK, AI Elements, and Cloudflare Kumo UI modules so teams can install chatbot and UI building blocks as owned source.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: jesseoue

.github/ISSUE_TEMPLATE/module_request.yml

@@ -26,9 +26,9 @@ body:
     id: readiness
     attributes:
       label: Expected readiness
-      description: Is this a roadmap stub or an installable source module?
+      description: Is this a proposal or an installable source module?
       options:
-        - stub
+        - proposal
         - experimental
         - ready
         - stable

.github/ISSUE_TEMPLATE/provider_request.yml

@@ -43,7 +43,7 @@ body:
     attributes:
       label: Expected readiness
       options:
-        - stub
+        - proposal
         - experimental
         - ready
         - stable

.github/PULL_REQUEST_TEMPLATE.md

@@ -11,7 +11,7 @@
 
 ## Registry Changes
 
-- [ ] Module status is honest (`ready` has files, `stub` has no source payload)
+- [ ] Module status is honest (`ready` has installable source; source-empty ideas stay as proposals)
 - [ ] Recipe or preset install order updated if this changes a workflow
 - [ ] Shared provider skill referenced when provider SDK/API behavior is involved
 - [ ] Generated registry output updated if manifests changed

AGENTS.md

@@ -4,17 +4,19 @@ StackFoundry is a public source registry for production SaaS modules.
 
 ## Product Rules
 
-1. The registry is the product. Presets are only bundles of modules.
-2. Every module must include source files, docs, env notes, tests/checklist, and maintenance instructions.
+1. The registry is the product. Modules are source-delivered capabilities; presets install bundles; recipes explain complete workflow paths and install order.
+2. Published modules must include source files, docs, env notes when needed, tests/checklist, and maintenance skills. Proposal ideas belong in requests or roadmap docs until source exists.
 3. Base scaffolds must stay small. Optional providers are adapters, not hard dependencies.
 4. Do not introduce public-facing references to how the project was authored.
 5. Never commit secrets, `.env.local`, provider credentials, private customer data, local caches, or generated machine metadata.
 
-## Initial Modules
+## Core Registry Concepts
 
-- `drizzle-postgres`
-- `api-keys`
-- `stripe-billing`
+- Readiness statuses: `ready`, `planned`, `experimental`, `stable`, `deprecated`.
+- Current source shape: `registry/modules`, `registry/presets`, `registry/recipes`, and `registry/skills`.
+- Public generated output lives in `public/r` and `apps/web/public/r`; never edit generated registry output by hand.
+- Shared provider/framework/database/platform guidance belongs in `registry/skills/<name>/SKILL.md` and is installed to `.stackfoundry/skills/<name>/SKILL.md`.
+- The hosted web app is Next.js on Vercel. Cloudflare support is an installable registry starter for consuming apps, not this repo's default deployment path.
 
 ## Quality Gates
 
@@ -23,8 +25,10 @@ Before moving to a new phase:
 - `git status` is clean except intentional changes.
 - Docs are updated.
 - Module manifests validate.
-- The demo path works from a fresh checkout.
-- Changed modules include skill guidance.
+- Generated registry output is rebuilt when source registry files change.
+- Recipes, presets, and install order are updated when a workflow changes.
+- Changed modules include maintenance skills and checklist updates.
+- `pnpm check` passes before release or handoff.
 
 ## Public Voice
 

CHANGELOG.md

@@ -2,16 +2,34 @@
 
 ## Unreleased
 
+### Added
+
+- Added SaaS recipes, readiness statuses, stricter validation, and a proposal path for future complete product workflows.
+- Added recipe commands and install paths, including `api-saas-starter`, `enterprise-saas`, `ai-saas-starter`, `cloudflare-saas`, `support-ops`, `security-center`, `integration-marketplace`, and `customer-intelligence`.
+- Added an installable `cloudflare-next-starter` module for consuming apps while keeping StackFoundry itself on the standard Next.js/Vercel path.
+- Added Vercel AI building blocks: `ai-sdk`, `ai-elements`, and `ai-chatbot-sdk`.
+- Added `cloudflare-kumo-ui` as an optional Cloudflare UI building-block module.
+- Added docs for recipes, install order, readiness, conventions, and a mirrored docs changelog.
+- Added OpenSSF Scorecard scanning and private vulnerability reporting links.
+
+### Changed
+
 - Pointed module maintenance skills to installed shared provider, framework, database, SDK, and platform skills.
 - Standardized provider adapter registry language and replaced legacy provider wording/paths.
 - Renamed public command examples to `stackfoundry`.
-- Added SaaS recipes, readiness statuses, stricter validation, and high-priority stub modules for complete product workflows.
-- Polished registry docs for recipes, readiness, install order, conventions, and current registry scale.
-- Added an installable Cloudflare Next.js starter module for consuming apps while keeping StackFoundry hosted on Vercel.
-- Improved README badges, contribution controls, provider request templates, and repo topics for public discovery.
-- Hardened public repository security posture with private vulnerability reporting, safer checkout settings, OpenSSF Scorecard, dependency review, CodeQL, and clearer public-safety rules.
+- Updated AGENTS.md to match the current recipes, readiness, generated-output, and maintenance-skill model.
+- Improved README badges, contribution controls, provider request templates, repo topics, and docs navigation for public discovery.
 - Updated GitHub Actions dependencies for checkout, Node setup, pnpm setup, and dependency review.
 
+### Security
+
+- Hardened public repository security posture with private vulnerability reporting, safer checkout settings, OpenSSF Scorecard, dependency review, CodeQL, Dependabot vulnerability alerts, and clearer public-safety rules.
+
+### Fixed
+
+- Fixed GitHub integration private-key newline handling in the installable source template.
+- Resolved the `next-saas` module/preset ambiguity by renaming the source shell module to `next-saas-shell`.
+
 ## 1.0.0
 
 - Released StackFoundry as a public source registry for production SaaS modules.

CONTRIBUTING.md

@@ -32,7 +32,7 @@ A module should include:
 - `skill/SKILL.md`
 - `tests/checklist.md`
 
-Use `stub` for modules that document a real SaaS capability but do not install source yet. Use `ready` only when the module has installable source files and passes registry validation.
+Use GitHub module/provider requests for proposed capabilities that do not install source yet. Use `ready` only when the module has installable source files and passes registry validation.
 
 ## Provider Adapters
 
@@ -55,7 +55,7 @@ Good public PR shapes:
 
 - one new provider adapter
 - one ready module implementation
-- one stub-to-ready promotion
+- one proposal-to-ready module promotion
 - one recipe/preset update with generated registry output
 - one docs-only clarification
 

README.md

@@ -9,7 +9,7 @@ Install production SaaS modules as editable source code.
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
 ![Next.js](https://img.shields.io/badge/Next.js-16-black)
 ![Vercel](https://img.shields.io/badge/deploy-Vercel-black)
-![Modules](https://img.shields.io/badge/modules-294-orange)
+![Modules](https://img.shields.io/badge/modules-155-orange)
 ![Recipes](https://img.shields.io/badge/recipes-9-purple)
 ![Presets](https://img.shields.io/badge/presets-13-teal)
 ![Inspired by shadcn](https://img.shields.io/badge/inspired%20by-shadcn-111111)
@@ -85,12 +85,12 @@ Current source registry coverage:
 | Docs and SEO | `docs-fumadocs`, `docs-mintlify`, `docs-help-center`, `seo`, `ai-seo` |
 | Security | `arcjet-security`, `security-headers`, `csrf-protection`, `input-validation`, `secrets-management` |
 | Storage and infra | `vercel-blob`, `vercel-edge-config`, `cloudflare-r2`, `upstash-redis`, `docker-compose-local` |
-| Optional AI | `ai-chat`, `model-router`, `ai-tools`, `rag-starter`, `evals`, `cloudflare-agents-sdk` |
+| Optional AI | `ai-sdk`, `ai-elements`, `ai-chat`, `ai-chatbot-sdk`, `cloudflare-agents-sdk`, `cloudflare-kumo-ui` |
 
 <details>
 <summary>Current scale</summary>
 
-- 294 module manifests
+- 155 ready module manifests
 - 36 canonical categories
 - 13 preset bundles
 - 9 architecture recipes
@@ -105,15 +105,15 @@ Current source registry coverage:
 | `next-saas` | Broad app foundation with database, billing, account surfaces, docs, ops, security, and growth modules |
 | `b2b-saas` | Team workspaces, tenant controls, RBAC, auditability, SSO, and SCIM |
 | `developer-platform` | API keys, public APIs, webhooks, docs, SDK snippets, and developer portal modules |
-| `ai-saas` | Optional AI product modules for chat, model routing, prompts, quotas, RAG, and metering |
+| `ai-saas` | Optional AI product modules for Vercel AI SDK chat, AI Elements, quotas, Cloudflare AI building blocks, and metering |
 | `internal-admin` | Operator consoles, support, health, incidents, jobs, backup, and maintenance controls |
 | `free-tier-saas` | Practical baseline for a free-tier product launch |
 | `vercel-native` | Vercel deployment, storage, workflows, edge config, and observability path |
 | `cloudflare-native` | Workers, D1, R2, KV, Queues, Workflows, Turnstile, and Cloudflare-native adapters |
 | `provider-adapters` | Concrete optional provider adapter examples |
 | `api-saas-starter` | API-first SaaS workflow with keys, usage, rate limits, billing, webhooks, docs, and observability |
 | `enterprise-saas` | Enterprise layer with SSO, SCIM, audit, access review, security, SLA, and support workflows |
-| `ai-saas-starter` | AI SaaS workflow with chat, model routing, prompts, evals, RAG, usage metering, and billing |
+| `ai-saas-starter` | AI SaaS workflow with Vercel AI SDK chat, AI Elements, usage metering, quotas, and billing |
 
 ```bash
 pnpm registry:presets
@@ -284,7 +284,7 @@ See [`docs/repository.md`](./docs/repository.md) for ownership rules.
 
 ## Where This Is Going
 
-- More stub modules graduating to ready installable source payloads
+- More proposed modules graduating to ready installable source payloads
 - Better diff/update workflows for installed modules
 - More provider adapters without making providers base dependencies
 - More production smoke paths for presets and recipes

apps/cli/src/cli.mjs

@@ -207,7 +207,7 @@ async function validateModule(moduleDir) {
     errors.push(`category must be one of: ${[...validModuleCategories].sort().join(", ")}`);
   }
   if (!validModuleStatuses.has(manifest.status)) {
-    errors.push("status must be ready, stub, planned, experimental, stable, or deprecated");
+    errors.push("status must be ready, planned, experimental, stable, or deprecated");
   }
   if (!Array.isArray(manifest.files)) errors.push("files must be an array");
   if (!Array.isArray(manifest.dependencies)) errors.push("dependencies must be an array");
@@ -219,9 +219,6 @@ async function validateModule(moduleDir) {
   if (installableStatuses.has(manifest.status) && manifest.files.length === 0) {
     errors.push(`${manifest.status} module must include at least one installable file`);
   }
-  if (manifest.status === "stub" && manifest.files.length > 0) {
-    errors.push("stub module should not include installable files; use experimental or ready");
-  }
   for (const key of manifest.env ?? []) {
     if (!isEnvVarName(key)) errors.push(`env var must be SCREAMING_SNAKE_CASE: ${key}`);
     if (isUnsafePublicEnvName(key)) {
@@ -447,7 +444,7 @@ async function validateRegistry(flags = {}) {
         errors.push(`${file}: recipe category must be one of: ${[...validModuleCategories].sort().join(", ")}`);
       }
       if (!validModuleStatuses.has(recipe.status)) {
-        errors.push(`${file}: recipe status must be ready, stub, planned, experimental, stable, or deprecated`);
+        errors.push(`${file}: recipe status must be ready, planned, experimental, stable, or deprecated`);
       }
       if (!Array.isArray(recipe.modules)) errors.push(`${file}: modules must be an array`);
       if (!Array.isArray(recipe.stages)) errors.push(`${file}: stages must be an array`);
@@ -706,6 +703,56 @@ async function saveInstallManifest(target, manifest) {
   await writeFile(path.join(dir, "installed.json"), `${JSON.stringify(manifest, null, 2)}\n`);
 }
 
+async function mergePackageScripts({ target, packageScripts, flags, installedFiles }) {
+  if (!packageScripts || typeof packageScripts !== "object") return;
+
+  for (const [relative, scripts] of Object.entries(packageScripts)) {
+    if (!isSafeRelativePath(relative) || !relative.endsWith("package.json")) {
+      throw new Error(`packageScripts target must be a safe package.json path: ${relative}`);
+    }
+    if (!scripts || typeof scripts !== "object" || Array.isArray(scripts)) {
+      throw new Error(`${relative}: packageScripts value must be an object`);
+    }
+
+    const packagePath = path.join(target, relative);
+    if (!existsSync(packagePath)) {
+      console.log(`${flags.dryRun ? "would skip" : "skipped"} ${relative} packageScripts; file does not exist`);
+      continue;
+    }
+
+    const packageJson = await readJson(packagePath);
+    const nextScripts = { ...(packageJson.scripts ?? {}), ...scripts };
+    const nextPackageJson = { ...packageJson, scripts: nextScripts };
+    const content = `${JSON.stringify(nextPackageJson, null, 2)}\n`;
+
+    if (!flags.dryRun) await writeFile(packagePath, content);
+    installedFiles[relative] = hashContent(content);
+    console.log(`${flags.dryRun ? "would update" : "updated"} ${relative} scripts`);
+  }
+}
+
+async function mergeGitignoreEntries({ target, entries, flags, installedFiles }) {
+  if (!entries?.length) return;
+
+  const relative = ".gitignore";
+  const gitignorePath = path.join(target, relative);
+  const existing = existsSync(gitignorePath) ? await readFile(gitignorePath, "utf8") : "";
+  const lines = existing.split(/\r?\n/);
+  const existingEntries = new Set(lines.map((line) => line.trim()).filter(Boolean));
+  const missing = entries.filter((entry) => !existingEntries.has(entry));
+
+  if (missing.length === 0) {
+    installedFiles[relative] = hashContent(existing);
+    return;
+  }
+
+  const prefix = existing.trimEnd();
+  const content = `${prefix ? `${prefix}\n\n` : ""}# StackFoundry generated build output\n${missing.join("\n")}\n`;
+  if (!flags.dryRun) await writeFile(gitignorePath, content);
+  installedFiles[relative] = hashContent(content);
+  console.log(`${flags.dryRun ? "would update" : "updated"} ${relative}`);
+}
+
 async function addModule(name, flags, visited = new Set(), context = {}) {
   if (visited.has(name)) return;
   visited.add(name);
@@ -745,6 +792,19 @@ async function addModule(name, flags, visited = new Set(), context = {}) {
     installedFiles[normalized] = sourceHash;
   }
 
+  await mergePackageScripts({
+    target: flags.target,
+    packageScripts: manifest.packageScripts,
+    flags,
+    installedFiles,
+  });
+  await mergeGitignoreEntries({
+    target: flags.target,
+    entries: manifest.gitignore,
+    flags,
+    installedFiles,
+  });
+
   for (const skill of maintenanceSkills) {
     const sourceHash = hashContent(skill.content);
     await writeFileWithSafety({
@@ -858,6 +918,19 @@ async function addRegistryItem(specifier, flags, visited = new Set()) {
     installedFiles[relative] = sourceHash;
   }
 
+  await mergePackageScripts({
+    target: flags.target,
+    packageScripts: item.meta?.packageScripts,
+    flags,
+    installedFiles,
+  });
+  await mergeGitignoreEntries({
+    target: flags.target,
+    entries: item.meta?.gitignore,
+    flags,
+    installedFiles,
+  });
+
   for (const skill of item.maintenanceSkills ?? []) {
     if (!skill.content)
       throw new Error(
@@ -1036,6 +1109,8 @@ async function buildRegistry() {
       meta: {
         category: manifest.category,
         group: manifest.group,
+        gitignore: manifest.gitignore,
+        packageScripts: manifest.packageScripts,
         status: manifest.status,
         maturity: manifest.status,
         recommendedFor: manifest.recommendedFor ?? [],
@@ -1140,6 +1215,8 @@ async function buildRegistry() {
         category: manifest.category,
         group: manifest.group,
         env: manifest.env,
+        gitignore: manifest.gitignore,
+        packageScripts: manifest.packageScripts,
         status: manifest.status,
         maturity: manifest.status,
         drizzle: manifest.drizzle,

apps/web/app/docs/page.tsx

@@ -197,16 +197,16 @@ const moduleGroups = [
   },
   {
     category: "Optional AI",
-    summary: "AI modules are categories in the registry, not the product identity.",
+    summary: "Vercel AI SDK, AI Elements, and Cloudflare AI modules are optional building blocks.",
     modules: [
+      "ai-sdk",
+      "ai-elements",
       "ai-chat",
-      "model-router",
-      "prompt-library",
-      "rag-starter",
+      "ai-chatbot-sdk",
       "cloudflare-agents-sdk",
       "cloudflare-mcp-server",
       "cloudflare-vectorize",
-      "evals",
+      "cloudflare-kumo-ui",
     ],
   },
   {

apps/web/app/page.tsx

@@ -22,9 +22,9 @@ type LandingModuleCard = {
 };
 
 const stats = [
-  { value: "160+", label: "Modules" },
-  { value: "9", label: "Presets" },
-  { value: "12", label: "Categories" },
+  { value: "155", label: "Modules" },
+  { value: "13", label: "Presets" },
+  { value: "36", label: "Categories" },
   { value: "MIT", label: "License" },
 ];
 
@@ -127,6 +127,25 @@ const moduleCards: LandingModuleCard[] = [
       actions: [{ label: "json", href: "/r/webhook-inbox.json" }],
     },
   },
+  {
+    name: "ai-chatbot-sdk",
+    title: "AI Chatbot SDK",
+    category: "optional AI",
+    variant: "featured",
+    version: "v0.1.0",
+    description:
+      "Vercel AI SDK chat, AI Elements primitives, gateway-ready model routing, and a source-owned chatbot shell.",
+    tags: [
+      { label: "ai" },
+      { label: "Vercel AI SDK", tone: "provider" },
+      { label: "deps: ai-elements", tone: "dependency" },
+      { label: "maintenance skill", tone: "skill" },
+    ],
+    footer: {
+      summary: "2 files · 2 deps · 1 skill",
+      actions: [{ label: "json", href: "/r/ai-chatbot-sdk.json" }],
+    },
+  },
   {
     name: "resend-email",
     title: "Resend Email",
@@ -250,7 +269,7 @@ const presetRows = [
 const assuranceRows = [
   {
     title: "What installs?",
-    body: "Source files, route shells, helpers, schema slices, docs, skill guidance, and verification checklists.",
+    body: "Source files, route shells, helpers, schema slices, docs, maintenance skills, and verification checklists.",
   },
   {
     title: "What stays out?",