Pure, dependency-free secret/credential redaction for the broberg.ai fleet — redactSecrets / hasSecret over a curated, ordered SECRET_PATTERNS set. Redact at write + egress boundaries so keys never land in a DB, chat, or KB. Lifted from broberg/trail F197

Thin fleet wrapper around Better Auth — one createAuth() for email+password, magic-link (via @broberg/mail), social login (Google/Apple/GitHub/Microsoft/LinkedIn/Facebook) and passkey/WebAuthn, with dark-ship provider guards and Hono + Next mount helpers.

Branded HTML email shell + primitives for the broberg.ai fleet — renderShell, heading/paragraph/cta/factBox/signOff, eyebrow/noteBox, a three-tier signOff, and a CID logo-attachment helper. No sending (@broberg/mail) and no template storage (that lives in

The fleet's server-side image-transform primitive — one transformImage() that decodes iPhone HEIC/HEIF → JPEG, auto-orients from EXIF, strips metadata and emits responsive WebP/JPEG derivatives. The companion to @broberg/media (storage): transform returns

Fleet server logging that cannot leak a secret: four levels, one-line JSON in production or readable text locally, env-driven level, nesting child bindings — and every message and metadata value run through @broberg/secret-scan before it leaves the proces

Shared zod contracts + types for the broberg fleet HTTP API (buddy + cardmem). Single source of truth — servers validate against it, clients get their types from it.

The fleet's thin Resend send primitive — one dependency-free way to send transactional mail (raw REST, runs in Node/Bun/edge), with a dev kill-switch + recipient allowlist so test sends never reach real users and a typed {ok,id?,error?} return that never

Typed client + frame-merge engine + Preact <SetiChat> component for buddycloud.cc SET/SETI live streaming chat (consumed through a host-app proxy from @broberg/seti-server).

Copy-owned browser client for the @webhouse/cms chat — quick-action cache (peek/warm). Grows into the full chat client, paired with @broberg/cms-chat-server.

Dark-ship team-chat webhook notifications for the broberg.ai fleet — createNotifier({ discord, slack }).send(msg) fans one message out to every configured incoming-webhook channel. Chat only (email → @broberg/mail, browser push → @broberg/webpush). Zero r

The fleet's AI-chat core: a conversation loop with a tool registry where a tool without a declared permission is DENIED, streaming typed frames, and the model injected rather than imported — so it carries no dependency it can silently outgrow.

Unified AI/LLM SDK — one facade, all providers, all capabilities, first-class cost control on every call.

Provider-agnostic SMS send primitive for the broberg.ai fleet — Danish/EU-hosted gateways, swap by config. Ship-dark, allowlist-gated, typed result, and segment/cost estimation before you pay.

Interactive body pain-map: a body a patient clicks to mark where it hurts, producing a structured PainReport (bodymap/v1). Framework-neutral core (region taxonomy + zod PainReport model + selection) + a 2D SVG React renderer + a rotatable 3D renderer (van

Spam-protected public form primitives for the broberg.ai fleet: honeypot detection, an in-process IP rate limiter, and Cloudflare Turnstile server-side verification. Headless core + a widget hook for React and Preact + a Hono middleware.

Find the tracked text files your grep silently skips. A cc session's grep is ugrep with -I: on a file with a NUL byte or invalid UTF-8 it prints nothing and exits 1, so every grep-based sweep over that file is falsely green. Zero deps, one bin, runs in an

The shared Playwright capture + flow engine for the cardmem-lens fleet — capture(opts)→artifact and runFlow(opts)→report with self-healing locators (DOM layers + Set-of-Marks vision) and a frozen Zod flow grammar, plus token-frugal page-READ primitives (r

Framework-agnostic inbound API-key primitives for the broberg.ai fleet: mint prefixed keys, timing-safe verify (hashed or plaintext), sliding-window rate-limit over a pluggable store, a Cloudflare-style authorization cascade (permission × resource-filter

Fleet PWA primitive: a framework-agnostic service-worker update-detection controller (new-version-available lifecycle) + a React hook and unstyled banner skeleton + a service-worker skip-waiting helper. Zero runtime deps; ship-dark.

Storage-agnostic Web Push (PWA) core for the broberg.ai fleet — a VAPID sender that returns dead endpoints to prune + shapes a declarative + classic payload, browser subscribe/unsubscribe/badge helpers, and service-worker handlers. Web Push only (VAPID ·