@stacksjs/defaults 0.70.293 → 0.70.296

package/ai/skills/stacks-auth/SKILL.md

@@ -333,7 +333,7 @@ await authUser.authorize('edit-post', post)  // throws if denied
   tokenExpiry: 30,         // days, AUTH_TOKEN_EXPIRY env
   tokenRotation: 7,        // days, AUTH_TOKEN_ROTATION env
   defaultAbilities: ['*'],
-  defaultTokenName: 'auth_token',
+  defaultTokenName: 'auth-token',
   passwordReset: { expire: 60, throttle: 60 }
 }
 ```

package/ai/skills/stacks-development/SKILL.md

@@ -279,9 +279,9 @@ Default configurations provided at `storage/framework/defaults/ide/`:
 
 ```typescript
 {
-  componentsDir: 'resources/components',
-  layoutsDir: 'resources/layouts',
-  partialsDir: 'resources/partials',
+  componentsDir: 'components',
+  layoutsDir: 'layouts',
+  partialsDir: 'partials',
 }
 ```
 

package/ai/skills/stacks-stx/SKILL.md

@@ -127,9 +127,9 @@ dedicated signal for each binding. Arbitrary expressions such as
 import type { StxOptions } from '@stacksjs/stx'
 
 export default {
-  componentsDir: 'resources/components',
-  layoutsDir: 'resources/layouts',
-  partialsDir: 'resources/partials',
+  componentsDir: 'components',
+  layoutsDir: 'layouts',
+  partialsDir: 'partials',
 } satisfies StxOptions
 ```
 

package/ai/skills/stacks-ui/SKILL.md

@@ -179,9 +179,9 @@ export default {
 
 ```typescript
 export default {
-  componentsDir: 'resources/components',
-  layoutsDir: 'resources/layouts',
-  partialsDir: 'resources/partials',
+  componentsDir: 'components',
+  layoutsDir: 'layouts',
+  partialsDir: 'partials',
 } satisfies StxOptions
 ```
 

package/app/Actions/Auth/LoginAction.ts

@@ -3,6 +3,7 @@ import { Auth, createTwoFactorChallenge, getTwoFactorState } from '@stacksjs/aut
 import { User } from '@stacksjs/orm'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
+import { PASSWORD_MAX_LENGTH, PASSWORD_PRESENCE_MESSAGE } from '../../password-policy'
 
 export default new Action({
   name: 'LoginAction',
@@ -14,9 +15,14 @@ export default new Action({
       rule: schema.string().email(),
       message: 'Email must be a valid email address.',
     },
+    // Presence only, NOT the creation policy. Enforcing a minimum length on
+    // sign-in locks out every account created under a shorter one: the user is
+    // told their own password is too short, with a 422 raised before the
+    // credentials are ever checked. The policy belongs on the paths that SET a
+    // password (#2226).
     password: {
-      rule: schema.string().min(6).max(255),
-      message: 'Password must be between 6 and 255 characters.',
+      rule: schema.string().min(1).max(PASSWORD_MAX_LENGTH),
+      message: PASSWORD_PRESENCE_MESSAGE,
     },
   },
 

package/app/Actions/Auth/RegisterAction.ts

@@ -3,6 +3,7 @@ import { Auth, register } from '@stacksjs/auth'
 import { dispatch } from '@stacksjs/events'
 import { response } from '@stacksjs/router'
 import { schema } from '@stacksjs/validation'
+import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PASSWORD_POLICY_MESSAGE } from '../../password-policy'
 
 export default new Action({
   name: 'RegisterAction',
@@ -15,8 +16,8 @@ export default new Action({
       message: 'Email must be a valid email address.',
     },
     password: {
-      rule: schema.string().min(6).max(255),
-      message: 'Password must be between 6 and 255 characters.',
+      rule: schema.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),
+      message: PASSWORD_POLICY_MESSAGE,
     },
     name: {
       rule: schema.string().min(2).max(255),

package/app/Actions/Auth/SocialCallbackAction.ts

@@ -0,0 +1,75 @@
+import { Action } from '@stacksjs/actions'
+import { Auth, authCookie, resolveSocialSignIn, SocialSignInRefusedError } from '@stacksjs/auth'
+import { log } from '@stacksjs/logging'
+import { response } from '@stacksjs/router'
+import { isSocialProviderConfigured, socialHandoffFailureRedirect, socialHandoffRedirect, socialProvider } from '@stacksjs/socials'
+
+/**
+ * `GET|POST /auth/{provider}/callback` — complete a social sign-in
+ * (stacksjs/stacks#2276).
+ *
+ * The provider redirects back here with a `code`. The driver exchanges it for
+ * the provider's user, `resolveSocialSignIn` decides which local user that is
+ * (find-or-create, with the unverified-email takeover guard), and the session
+ * is handed to the browser twice over: the auth cookie for server-rendered
+ * pages, and the fragment handoff `useAuth().completeSocialLogin()` reads for
+ * the SPA side. POST as well as GET because Apple mandates
+ * `response_mode=form_post` whenever scopes are requested.
+ *
+ * A refused sign-in redirects to /login with a `social_error` the page can
+ * render; it is a policy decision, not an exception. Provider/exchange
+ * failures land there too, with the detail in the log rather than the URL.
+ */
+export default new Action({
+  name: 'SocialCallbackAction',
+  description: 'Completes a social provider OAuth flow and signs the browser in.',
+  method: 'GET',
+
+  async handle(request: RequestInstance) {
+    const provider = String(request.getParam('provider') ?? '').toLowerCase()
+
+    if (!isSocialProviderConfigured(provider))
+      return response.notFound(`Social provider "${provider}" is not configured.`)
+
+    const driver = socialProvider(provider)
+    if (!driver)
+      return response.notFound(`Social provider "${provider}" is not configured.`)
+
+    const code = String(request.get('code') ?? '')
+    if (!code)
+      return socialHandoffFailureRedirect(`${provider} did not return an authorization code.`)
+
+    try {
+      const accessToken = await driver.getAccessToken(code)
+      const identity = await driver.getUserByToken(accessToken)
+
+      const { userId } = await resolveSocialSignIn(provider, identity)
+
+      const session = await Auth.loginUsingId(userId)
+      if (!session?.token)
+        return socialHandoffFailureRedirect('Sign-in could not be completed. Please try again.')
+
+      const redirect = socialHandoffRedirect({
+        token: session.token,
+        ...(session.refreshToken && { refreshToken: session.refreshToken }),
+        ...(session.expiresIn !== undefined && { expiresIn: session.expiresIn }),
+        user: {
+          id: userId,
+          email: identity.email ?? null,
+          name: identity.name ?? identity.nickname ?? null,
+        },
+      })
+
+      // The cookie signs server-rendered pages in; the fragment pack the SPA.
+      redirect.headers.append('Set-Cookie', authCookie(session.token))
+      return redirect
+    }
+    catch (error) {
+      if (error instanceof SocialSignInRefusedError)
+        return socialHandoffFailureRedirect(error.message)
+
+      log.error(`[socials] ${provider} callback failed: ${(error as Error).message}`)
+      return socialHandoffFailureRedirect('Sign-in could not be completed. Please try again.')
+    }
+  },
+})

package/app/Actions/Auth/SocialRedirectAction.ts

@@ -0,0 +1,37 @@
+import { Action } from '@stacksjs/actions'
+import { response } from '@stacksjs/router'
+import { isSocialProviderConfigured, socialProvider } from '@stacksjs/socials'
+
+/**
+ * `GET /auth/{provider}` — send the browser to the provider's consent page
+ * (stacksjs/stacks#2276).
+ *
+ * A provider that is not fully configured 404s rather than redirecting into a
+ * half-built OAuth flow: the sign-in page renders its buttons from
+ * `configuredSocialProviders()`, so a visitor only reaches this with a name
+ * that works — anything else is URL guessing.
+ */
+export default new Action({
+  name: 'SocialRedirectAction',
+  description: 'Redirects the browser to a social provider\'s OAuth consent page.',
+  method: 'GET',
+
+  async handle(request: RequestInstance) {
+    const provider = String(request.getParam('provider') ?? '').toLowerCase()
+
+    if (!isSocialProviderConfigured(provider))
+      return response.notFound(`Social provider "${provider}" is not configured.`)
+
+    const driver = socialProvider(provider)
+    if (!driver)
+      return response.notFound(`Social provider "${provider}" is not configured.`)
+
+    return new Response(null, {
+      status: 302,
+      headers: {
+        'Location': await driver.getAuthUrl(),
+        'Cache-Control': 'no-store',
+      },
+    })
+  },
+})

package/app/Actions/Dashboard/Analytics/request-analytics.ts

@@ -105,7 +105,12 @@ export function requestAnalyticsRow(record: AnalyticsModelRecord): RequestAnalyt
   if (durationMs < 0)
     throw new TypeError('Request.duration_ms cannot be negative.')
 
-  const createdAt = requiredRecordString(record, 'created_at')
+  // Postgres and MySQL drivers return Date instances for timestamp columns;
+  // SQLite stores TEXT and returns strings.
+  const createdAtValue = record.get('created_at')
+  const createdAt = createdAtValue instanceof Date
+    ? createdAtValue.toISOString()
+    : requiredRecordString(record, 'created_at')
   if (!Number.isFinite(timestamp(createdAt)))
     throw new TypeError('Request.created_at must be a valid timestamp.')
 

package/app/Actions/Dashboard/Commerce/CommercePosCheckoutAction.ts

@@ -79,6 +79,13 @@ function receiptOptionalText(input: unknown, source: string, fieldName: string):
 }
 
 function receiptTimestamp(input: unknown, source: string, fieldName: string): string {
+  // Postgres and MySQL drivers return Date instances for timestamp columns;
+  // SQLite stores TEXT and returns strings. Accept both.
+  if (input instanceof Date) {
+    if (!Number.isFinite(input.getTime()))
+      throw receiptError(source, fieldName, 'a valid timestamp')
+    return input.toISOString()
+  }
   const raw = receiptText(input, source, fieldName)
   const date = new Date(/^\d{4}-\d{2}-\d{2} \d/.test(raw) ? `${raw.replace(' ', 'T')}Z` : raw)
   if (!Number.isFinite(date.getTime()))

package/app/Actions/Dashboard/Commerce/commerce-product-records.ts

@@ -1,3 +1,5 @@
+import { commerceTimestamp } from './commerce-record'
+
 export interface CommerceProductRecord {
   id: string
   name: string
@@ -230,7 +232,7 @@ export function normalizeCommerceProductRecord(
     variantCount: variantCounts.get(id) || 0,
     unitCount: unitCounts.get(id) || 0,
     reviewCount: reviewCounts.get(id) || 0,
-    createdAt: requiredText(value(product, 'created_at', 'createdAt'), source, 'created_at'),
+    createdAt: commerceTimestamp(value(product, 'created_at', 'createdAt'), source, 'created_at'),
   }
 }
 

package/app/Actions/Dashboard/Commerce/commerce-record.ts

@@ -174,6 +174,13 @@ export function commerceUrl(input: unknown, source: string, field: string): stri
 }
 
 export function commerceTimestamp(input: unknown, source: string, field = 'created_at'): string {
+  // Postgres and MySQL drivers return Date instances for timestamp columns;
+  // SQLite stores TEXT and returns strings. Accept both.
+  if (input instanceof Date) {
+    if (!Number.isFinite(input.getTime()))
+      throw commerceRecordError(source, field, 'a valid timestamp')
+    return input.toISOString()
+  }
   const raw = typeof input === 'number'
     ? String(input)
     : commerceRequiredString(input, source, field)
@@ -197,6 +204,12 @@ export function commerceOptionalTimestamp(input: unknown, source: string, field:
 }
 
 export function commerceDate(input: unknown, source: string, field: string): string {
+  // Postgres and MySQL drivers return Date instances for date columns.
+  if (input instanceof Date) {
+    if (!Number.isFinite(input.getTime()))
+      throw commerceRecordError(source, field, 'a valid YYYY-MM-DD date')
+    return input.toISOString().slice(0, 10)
+  }
   const raw = commerceRequiredString(input, source, field)
   if (!/^\d{4}-\d{2}-\d{2}$/.test(raw))
     throw commerceRecordError(source, field, 'a valid YYYY-MM-DD date')

package/app/Actions/Dashboard/Infrastructure/InsightsAction.ts

@@ -56,20 +56,20 @@ export default new Action({
         db.fn.max('duration_ms').as('maximum'),
         db.fn.max('created_at').as('latest'),
       ])
-      .where('deleted_at', 'is', null)
+      .whereNull('deleted_at')
       .executeTakeFirst() as Promise<NumericSummaryRow | undefined>
 
     const requestSuccessQuery = db
       .selectFrom('requests')
       .select(db.fn.count('id').as('count'))
-      .where('deleted_at', 'is', null)
+      .whereNull('deleted_at')
       .where('status_code', '<', 400)
       .executeTakeFirst() as Promise<{ count: number | string } | undefined>
 
     const slowRequestsQuery = db
       .selectFrom('requests')
       .select(['id', 'method', 'path', 'status_code', 'duration_ms', 'created_at'])
-      .where('deleted_at', 'is', null)
+      .whereNull('deleted_at')
       .orderBy('duration_ms', 'desc')
       .orderBy('id', 'desc')
       .limit(5)

package/app/Actions/Dashboard/Jobs/job-records.ts

@@ -98,7 +98,11 @@ function timestampValue(
     return undefined
 
   let time = Number.NaN
-  if (typeof value === 'number' && Number.isInteger(value) && value >= 0)
+  // Postgres and MySQL drivers return Date instances for timestamp columns;
+  // SQLite stores TEXT and returns strings.
+  if (value instanceof Date)
+    time = value.getTime()
+  else if (typeof value === 'number' && Number.isInteger(value) && value >= 0)
     time = value * 1000
   else if (typeof value === 'string' && value.trim())
     time = new Date(/^\d{4}-\d{2}-\d{2} \d/.test(value) ? `${value.replace(' ', 'T')}Z` : value).getTime()

package/app/Actions/Dashboard/Kanban/BoardShowAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
+import { modelBoolean } from './kanban-model'
 import { kanbanError } from './kanban-response'
 
 interface BoardRow {
@@ -10,7 +11,8 @@ interface BoardRow {
   icon: string
   color: string
   position: number
-  archived: number
+  // SQLite stores booleans as 0/1 INTEGER columns; Postgres returns real booleans.
+  archived: number | boolean
   created_at: string | null
   updated_at: string | null
 }
@@ -37,7 +39,7 @@ interface CardRow {
   position: number
   created_by_user_id: number | null
   due_date: string | null
-  archived: number
+  archived: number | boolean
   created_at: string | null
   updated_at: string | null
 }
@@ -103,7 +105,7 @@ export default new Action({
           [id],
         ).execute() as Promise<ColumnRow[]>,
         db.unsafe(
-          'SELECT * FROM cards WHERE board_id = ? AND archived = 0 ORDER BY column_id ASC, position ASC, id ASC',
+          'SELECT * FROM cards WHERE board_id = ? AND archived = false ORDER BY column_id ASC, position ASC, id ASC',
           [id],
         ).execute() as Promise<CardRow[]>,
         db.unsafe(
@@ -121,7 +123,7 @@ export default new Action({
           `SELECT cl.card_id, l.id, l.name, l.color
           FROM card_labels cl
           JOIN labels l ON l.id = cl.label_id
-          WHERE cl.card_id IN (SELECT id FROM cards WHERE board_id = ? AND archived = 0)
+          WHERE cl.card_id IN (SELECT id FROM cards WHERE board_id = ? AND archived = false)
           ORDER BY l.name ASC`,
           [id],
         ).execute() as Promise<Array<{ card_id: number, id: number, name: string, color: string }>>,
@@ -129,7 +131,7 @@ export default new Action({
           `SELECT ca.card_id, ca.user_id, u.name, u.email
           FROM card_assignees ca
           LEFT JOIN users u ON u.id = ca.user_id
-          WHERE ca.card_id IN (SELECT id FROM cards WHERE board_id = ? AND archived = 0)`,
+          WHERE ca.card_id IN (SELECT id FROM cards WHERE board_id = ? AND archived = false)`,
           [id],
         ).execute() as Promise<Array<{ card_id: number, user_id: number, name: string | null, email: string | null }>>,
       ])
@@ -175,7 +177,7 @@ export default new Action({
           position: c.position,
           createdByUserId: c.created_by_user_id,
           dueDate: c.due_date,
-          archived: c.archived === 1,
+          archived: modelBoolean(c, 'archived'),
           createdAt: c.created_at,
           updatedAt: c.updated_at,
           labels: labelsByCard.get(c.id) ?? [],
@@ -192,7 +194,7 @@ export default new Action({
           icon: board.icon,
           color: board.color,
           position: board.position,
-          archived: board.archived === 1,
+          archived: modelBoolean(board, 'archived'),
           createdAt: board.created_at,
           updatedAt: board.updated_at,
         },

package/app/Actions/Dashboard/Kanban/BoardStoreAction.ts

@@ -46,7 +46,7 @@ export default new Action({
       // is a sort hint, not a unique key. Reorder via /boards/reorder
       // restores tight ordering when the user cares.
       const maxRow = await db.unsafe(
-        'SELECT COALESCE(MAX(position), -1) AS m FROM boards WHERE archived = 0',
+        'SELECT COALESCE(MAX(position), -1) AS m FROM boards WHERE archived = false',
       ).execute() as Array<{ m: number }>
       const nextPosition = (Number(maxRow?.[0]?.m ?? -1) + 1) || 0
 

package/app/Actions/Dashboard/Kanban/BoardsIndexAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
+import { modelBoolean } from './kanban-model'
 import { kanbanError } from './kanban-response'
 
 interface BoardRow {
@@ -10,7 +11,8 @@ interface BoardRow {
   icon: string
   color: string
   position: number
-  archived: number
+  // SQLite stores booleans as 0/1 INTEGER columns; Postgres returns real booleans.
+  archived: number | boolean
   created_at: string | null
   updated_at: string | null
   card_count?: number
@@ -46,9 +48,9 @@ export default new Action({
         SELECT
           b.id, b.uuid, b.name, b.description, b.icon, b.color,
           b.position, b.archived, b.created_at, b.updated_at,
-          (SELECT COUNT(*) FROM cards c WHERE c.board_id = b.id AND c.archived = 0) AS card_count
+          (SELECT COUNT(*) FROM cards c WHERE c.board_id = b.id AND c.archived = false) AS card_count
         FROM boards b
-        WHERE b.archived = 0
+        WHERE b.archived = false
         ORDER BY b.position ASC, b.id ASC
       `).execute() as BoardRow[]
 
@@ -60,7 +62,7 @@ export default new Action({
         icon: r.icon,
         color: r.color,
         position: r.position,
-        archived: r.archived === 1,
+        archived: modelBoolean(r, 'archived'),
         cardCount: Number(r.card_count ?? 0),
         createdAt: r.created_at,
         updatedAt: r.updated_at,

package/app/Actions/Dashboard/Kanban/CardShowAction.ts

@@ -1,5 +1,6 @@
 import { Action } from '@stacksjs/actions'
 import { db } from '@stacksjs/database'
+import { modelBoolean } from './kanban-model'
 import { kanbanError } from './kanban-response'
 
 interface CardRow {
@@ -12,7 +13,8 @@ interface CardRow {
   position: number
   created_by_user_id: number | null
   due_date: string | null
-  archived: number
+  // SQLite stores booleans as 0/1 INTEGER columns; Postgres returns real booleans.
+  archived: number | boolean
   created_at: string | null
   updated_at: string | null
 }
@@ -91,7 +93,7 @@ export default new Action({
           position: card.position,
           createdByUserId: card.created_by_user_id,
           dueDate: card.due_date,
-          archived: card.archived === 1,
+          archived: modelBoolean(card, 'archived'),
           createdAt: card.created_at,
           updatedAt: card.updated_at,
         },

package/app/Actions/Dashboard/Library/GetAverageReleaseTime.ts

@@ -10,7 +10,7 @@ export default new Action({
     const rows = await db
       .selectFrom('releases')
       .select(['created_at'])
-      .where('created_at', 'is not', null)
+      .whereNotNull('created_at')
       .orderBy('created_at')
       .execute() as unknown as Array<{ created_at: string }>
 

package/app/Actions/Dashboard/Marketing/CampaignIndexAction.ts

@@ -35,13 +35,13 @@ export default new Action({
       db
         .selectFrom('campaign_sends')
         .select(['campaign_id', db.fn.count('id').as('count')])
-        .where('opened_at', 'is not', null)
+        .whereNotNull('opened_at')
         .groupBy('campaign_id')
         .execute(),
       db
         .selectFrom('campaign_sends')
         .select(['campaign_id', db.fn.count('id').as('count')])
-        .where('clicked_at', 'is not', null)
+        .whereNotNull('clicked_at')
         .groupBy('campaign_id')
         .execute(),
     ])

package/app/Actions/Dashboard/Marketing/ListIndexAction.ts

@@ -36,7 +36,7 @@ export default new Action({
           db.fn.count('id').as('count'),
           db.fn.max('sent_at').as('last_sent_at'),
         ])
-        .where('email_list_id', 'is not', null)
+        .whereNotNull('email_list_id')
         .groupBy('email_list_id')
         .execute(),
     ])

package/app/Actions/Dashboard/Queries/query-dashboard.ts

@@ -6,7 +6,8 @@ export interface QueryLogSourceRow {
   connection?: string | null
   status?: string | null
   error?: string | null
-  executed_at: string
+  // SQLite returns timestamp columns as TEXT; Postgres and MySQL drivers return Date instances.
+  executed_at: string | Date
   model?: string | null
   method?: string | null
   rows_affected?: number | null
@@ -89,7 +90,8 @@ export function mapDashboardQueryLog(row: QueryLogSourceRow): DashboardQueryLog
   const status = queryStatus(row.status, label)
   if (typeof row.query !== 'string' || !row.query.trim())
     throw new TypeError(`${label} query must be a non-empty string`)
-  if (typeof row.executed_at !== 'string' || !row.executed_at.trim())
+  const executedAt = row.executed_at instanceof Date ? row.executed_at.toISOString() : row.executed_at
+  if (typeof executedAt !== 'string' || !executedAt.trim())
     throw new TypeError(`${label} executed_at must be a non-empty string`)
 
   return {
@@ -101,7 +103,7 @@ export function mapDashboardQueryLog(row: QueryLogSourceRow): DashboardQueryLog
     connection: row.connection || 'unknown',
     status,
     error: row.error || '',
-    executedAt: row.executed_at,
+    executedAt,
     model: row.model || '',
     method: row.method || '',
     rowsAffected: nullableFiniteNumber(row.rows_affected, `${label} rows_affected`),

package/app/Actions/Password/PasswordResetAction.ts

@@ -1,32 +1,54 @@
 import { Action } from '@stacksjs/actions'
 import { passwordResets, RateLimiter } from '@stacksjs/auth'
 import { response } from '@stacksjs/router'
+import { schema } from '@stacksjs/validation'
+import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH, PASSWORD_POLICY_MESSAGE } from '../../password-policy'
 
 export default new Action({
   name: 'PasswordResetAction',
   description: 'Password Reset',
   method: 'POST',
+
+  // Declared rather than hand-checked (#2226). `password.length < 8` inside
+  // handle() was invisible to everything that reads `validations:` — the
+  // client could not ask for it, and it drifted from the six every other
+  // password declaration used. Declaring it also means this endpoint answers a
+  // precognition probe, so a reset form can check the field on blur without
+  // spending a reset token to find out.
+  validations: {
+    email: {
+      rule: schema.string().required().email(),
+      message: 'Email must be a valid email address.',
+    },
+    token: {
+      rule: schema.string().required().min(1),
+      message: 'A reset token is required.',
+    },
+    password: {
+      rule: schema.string().required().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),
+      message: PASSWORD_POLICY_MESSAGE,
+    },
+  },
+
   async handle(request) {
     const token = request.get('token')
     const password = request.get('password')
     const passwordConfirmation = request.get('password_confirmation')
     const email = request.get('email')
 
-    // Validate required fields
+    // Kept as a floor for direct invocation: `validations:` only runs when this
+    // action is reached through the router, and a test or a queued job calling
+    // handle() straight would otherwise pass undefined into resetPassword.
     if (!token || !password || !email) {
       return response.error('Missing required fields', 422)
     }
 
-    // Validate password confirmation
+    // Cross-field, so it cannot live in `validations:` — those rules see one
+    // field at a time. Length and format are declared up there instead.
     if (password !== passwordConfirmation) {
       return response.error('Password confirmation does not match', 422)
     }
 
-    // Validate password strength (minimum 8 characters)
-    if (password.length < 8) {
-      return response.error('Password must be at least 8 characters', 422)
-    }
-
     // Rate limit password reset attempts by email
     const rateLimitKey = `password_reset_attempt:${email.toLowerCase()}`
     if (await RateLimiter.isRateLimited(rateLimitKey)) {

package/app/Middleware/Auth.ts

@@ -1,4 +1,4 @@
-import { Auth, sessionUser } from '@stacksjs/auth'
+import { Auth, authCookieName, sessionUser } from '@stacksjs/auth'
 import { config } from '@stacksjs/config'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
@@ -40,7 +40,9 @@ export default new Middleware({
       return
     }
 
-    const tokenCookieName = config.auth?.defaultTokenName || 'auth-token'
+    // One resolver, so the name a cookie is written under is the name it is
+    // read under (stacksjs/stacks#2236).
+    const tokenCookieName = authCookieName()
     const cookieToken = request.cookie?.(tokenCookieName)
     if (cookieToken) {
       await stampTokenUser(request, cookieToken)