@stacksjs/defaults 0.70.293 → 0.70.296

package/app/Models/commerce/Manufacturer.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'product-manufacturers',
     },
 

package/app/Models/commerce/Order.ts

@@ -29,7 +29,7 @@ export default defineModel({
     observe: true,
   },
 
-  hasMany: ['OrderItem', 'Payment', 'LicenseKey'],
+  hasMany: ['OrderItem', 'Payment', 'LicenseKey', 'DeliveryStop'],
   belongsTo: ['Customer', 'Coupon'],
 
   attributes: {
@@ -39,7 +39,18 @@ export default defineModel({
       validation: {
         rule: schema.string().required(),
       },
-      factory: faker => faker.helpers.arrayElement(['PENDING', 'PREPARING', 'READY', 'DELIVERED', 'CANCELED']),
+      /*
+       * The canonical vocabulary is `OrderStatus` in
+       * `commerce/src/orders/events.ts`, which is what `canTransition` and
+       * `emitForStatus` are keyed on. The factory used to generate
+       * PREPARING / READY / CANCELED, none of which are in that union, so
+       * seeded orders could not legally transition anywhere.
+       *
+       * The column stays a free string rather than an enum: existing
+       * databases hold the old spellings, and adding a CHECK constraint here
+       * would fail their next migration rather than fix their data.
+       */
+      factory: faker => faker.helpers.arrayElement(['PENDING', 'PROCESSING', 'SHIPPED', 'OUT_FOR_DELIVERY', 'DELIVERED']),
     },
 
     totalAmount: {
@@ -141,8 +152,38 @@ export default defineModel({
       },
     },
 
-    appliedCouponId: {
+    /**
+     * Unguessable handle for the customer-facing tracking page.
+     *
+     * A tracking URL is opened from an SMS, on a phone, by someone who is not
+     * signed in, so it authorises on possession of this token. Sequential
+     * order ids would let anyone walk the table.
+     */
+    trackingToken: {
       order: 13,
+      unique: true,
+      fillable: true,
+      validation: { rule: schema.string().max(64) },
+      factory: faker => faker.string.alphanumeric({ length: 32 }),
+    },
+
+    /** Geocoded delivery destination, so the map has somewhere to point. */
+    deliveryLatitude: {
+      order: 14,
+      fillable: true,
+      validation: { rule: schema.number().min(-90).max(90) },
+      factory: faker => faker.location.latitude(),
+    },
+
+    deliveryLongitude: {
+      order: 15,
+      fillable: true,
+      validation: { rule: schema.number().min(-180).max(180) },
+      factory: faker => faker.location.longitude(),
+    },
+
+    appliedCouponId: {
+      order: 16,
       fillable: true,
       validation: {
         rule: schema.string(),

package/app/Models/commerce/Product.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'products',
     },
 

package/app/Models/commerce/ProductUnit.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'product-units',
     },
 

package/app/Models/commerce/ProductVariant.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'product-variants',
     },
 

package/app/Models/commerce/ShippingMethod.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'shipping-methods',
     },
 

package/app/Models/commerce/ShippingRate.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'shipping-rates',
     },
 

package/app/Models/commerce/ShippingZone.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'shipping-zones',
     },
 

package/app/Models/commerce/TaxRate.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
 
     useApi: {
+      // Public catalog: anyone may browse, only authenticated callers may
+      // write. Declared explicitly because the trait now defaults BOTH sides to
+      // `auth` — an undeclared read route is how a customer list leaks
+      // (stacksjs/stacks#2224). Behaviour here is unchanged.
+      middleware: { read: [], write: ['auth'] },
       uri: 'tax-rates',
     },
 

package/app/password-policy.ts

@@ -0,0 +1,46 @@
+/**
+ * One password policy, in one place (stacksjs/stacks#2226).
+ *
+ * The framework shipped three numbers for one product concept: `RegisterAction`
+ * and `LoginAction` accepted six characters, the `User` model declared six, and
+ * `PasswordResetAction` hand-checked eight with `password.length < 8` — not in a
+ * `validations:` block at all, so it could not even be read by the machinery
+ * that reads the others.
+ *
+ * Apps then retyped the rule again in the browser, because an Action's
+ * `validations:` was unreachable from a template. That is how a real app ended
+ * up refusing a 7-character password in the browser that `POST /register` would
+ * have accepted.
+ *
+ * Change the policy here and every declaration follows. An app that wants a
+ * different one edits this file, which is scaffolded into it.
+ */
+
+/**
+ * Minimum length for a NEW password.
+ *
+ * Eight, because that is what the password-reset path already enforced and it
+ * is the weaker of the two that was actually protecting anything. Raising the
+ * registration minimum only affects accounts created from now on.
+ */
+export const PASSWORD_MIN_LENGTH = 8
+
+/**
+ * Maximum length. Also the `varchar` width the User model's column derives
+ * from, so lowering it is a migration, not just a rule change.
+ */
+export const PASSWORD_MAX_LENGTH = 255
+
+export const PASSWORD_POLICY_MESSAGE
+  = `Password must be between ${PASSWORD_MIN_LENGTH} and ${PASSWORD_MAX_LENGTH} characters.`
+
+/**
+ * What a sign-in must require: that a password was supplied, and nothing more.
+ *
+ * Deliberately NOT the policy above. Applying a creation rule to authentication
+ * locks out every account created under a previous, shorter policy — they would
+ * get a 422 before their credentials were ever checked, with a message telling
+ * them their own password is too short. The policy belongs on the paths that
+ * SET a password.
+ */
+export const PASSWORD_PRESENCE_MESSAGE = 'Password is required.'

package/bootstrap.ts

@@ -76,26 +76,58 @@ route.use(MaintenanceMiddleware.toRouterHandler() as any)
 // Overridable by registering the same path in app routes first.
 await route.register(frameworkPath('defaults/routes/core.ts'))
 
-// Feature-gated route registration. The dashboard.ts file currently bundles
-// ~687 lines covering auth, password reset, email subscribe, storefront
-// cart/checkout, reviews, sitemap, AI, voice, and the admin dashboard's
-// REST surface. Until that file is split per-feature (auth.ts, marketing.ts,
-// commerce.ts, monitoring.ts), the whole thing loads when `dashboard` is
-// activated and stays inert otherwise.
+// Which default route bundles this app mounts. The route loader resolves the
+// selection (STACKS_DEFAULT_ROUTES, or the legacy STACKS_SKIP_DEFAULT_ROUTES)
+// and leaves it here; see `resolveDefaultRouteBundles` in
+// `core/router/src/route-loader.ts`. Absent when bootstrap is imported by
+// something other than the loader, in which case every bundle is eligible and
+// the feature gates below decide, exactly as before.
+const selection = (globalThis as Record<string, unknown>).__stacksDefaultRouteBundles as
+  { bundles: Set<string>, explicit: boolean } | undefined
+
+/**
+ * Whether a bundle mounts.
+ *
+ * An app that NAMED its bundles has already answered the question, so the
+ * feature flag does not get a second veto - otherwise `STACKS_DEFAULT_ROUTES=auth`
+ * would still be withheld from an app running with `dashboard` off, which is
+ * the exact case this exists for. When nothing was named, the flags gate
+ * precisely as they did before.
+ */
+function mounts(bundle: string, featureEnabled: boolean): boolean {
+  if (selection && !selection.bundles.has(bundle))
+    return false
+  return selection?.explicit ? true : featureEnabled
+}
+
+// Auth: login, registration, logout, refresh/revoke, passkeys, TOTP 2FA and
+// password reset. Split out of dashboard.ts so it can be mounted on its own
+// (stacksjs/stacks#2229) — previously the only way to get `/login` was to
+// activate `dashboard` and take the storefront, reviews, AI and voice surface
+// with it.
+//
+// Registered BEFORE dashboard.ts, which is where these lived, so the
+// first-registration-wins order among framework routes is unchanged.
 //
-// Apps that need only a slice — e.g. a marketing site that wants
-// `/api/email/subscribe` and `/api/contact` but not the rest — can either
-//   1. Activate `dashboard` and live with the over-broad register; the
-//      action handlers for routes you don't hit never fire, and their
-//      models stay un-loaded as long as the corresponding feature flag
-//      (`commerce`, `cms`, `monitoring`) is off, so there's no hidden
-//      cost beyond the bun-router route-table entries.
-//   2. Define the routes they want directly in `routes/api.ts` —
-//      first-registration-wins means the user version takes priority.
+// Deliberately NOT gated on `feature('auth')`, despite the issue asking for
+// it: `config/auth.ts` ships in every app with `enabled: true`, so that gate
+// is true everywhere and would mount the auth surface — including
+// `/generate-two-factor-secret`, `/logout-all` and `/auth/tokens` — in apps
+// currently running with `dashboard` off. Widening an app's public surface on
+// upgrade is not something a refactor gets to do silently.
+if (mounts('auth', feature('dashboard')))
+  await route.register(frameworkPath('defaults/routes/auth.ts'))
+
+// The rest of dashboard.ts: email subscribe, storefront cart/checkout,
+// reviews, sitemap, AI, voice, and the admin dashboard's REST surface. Still
+// one file and still one gate — splitting auth out was the case with a
+// reporter behind it; marketing.ts / commerce.ts / monitoring.ts remain the
+// obvious next cuts.
 //
-// Once the per-feature route split lands, each `if (feature('X'))` block
-// below registers just the X-specific routes file.
-if (feature('dashboard')) {
+// Apps that need only a slice can also define the routes they want directly
+// in `routes/api.ts` — first-registration-wins means the user version takes
+// priority.
+if (mounts('dashboard', feature('dashboard'))) {
   await route.register(frameworkPath('defaults/routes/dashboard.ts'))
   // JSON endpoints for the dev dashboard UI. Kept separate from the view
   // routes above so the data layer is one obvious file to grep.
@@ -112,6 +144,22 @@ if (feature('dashboard')) {
 // non-default mount path register their own routes in `routes/api.ts`
 // and the framework's mount silently no-ops since user routes
 // register first.
-if (feature('email')) {
+if (mounts('email', feature('email'))) {
   await route.register(frameworkPath('defaults/routes/email.ts'))
 }
+
+// Social sign-in: `/auth/{provider}` + `/auth/{provider}/callback`
+// (stacksjs/stacks#2276). An opt-in bundle, NOT part of the implicit default
+// set or `all` — OAuth callback URLs in an app that configured no provider
+// are surface for nothing. So `mounts()` does not apply here: an app that
+// NAMED its bundles decides outright (`social` listed → on, absent → off),
+// and an app that said nothing gets it exactly when a provider is actually
+// configured in config/services.ts — configuring GitHub and finding
+// /auth/github dead would be the puzzle, not the mount.
+const { configuredSocialProviders } = await import('@stacksjs/socials')
+const mountSocial = selection?.explicit
+  ? selection.bundles.has('social')
+  : configuredSocialProviders().length > 0
+if (mountSocial) {
+  await route.register(frameworkPath('defaults/routes/socials.ts'))
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.293",
+  "version": "0.70.296",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.293",
+  "version": "0.70.296",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",

package/routes/auth.ts

@@ -0,0 +1,83 @@
+/**
+ * Framework Default Routes - Auth
+ *
+ * Login, registration, logout, token refresh and revocation, passkeys, TOTP
+ * 2FA, and password reset.
+ *
+ * Split out of `dashboard.ts` for stacksjs/stacks#2229. That file bundles the
+ * auth surface together with storefront cart/checkout, reviews, sitemap, AI
+ * and voice, and the only gate over the whole thing is `feature('dashboard')`
+ * - so an app that wanted `/login` and 2FA but ships no `Product` or `Coupon`
+ * had to either mount the commerce demo surface or set
+ * `STACKS_SKIP_DEFAULT_ROUTES=1` and re-declare every auth route by hand, rate
+ * limits included. One reporting app did the latter and permanently gave up
+ * 2FA, sign-out-everywhere and API token management, because re-registering
+ * those was not worth the maintenance.
+ *
+ * Mounted by `defaults/bootstrap.ts` as the `auth` bundle; see
+ * `resolveDefaultRouteBundles` in `core/router/src/route-loader.ts` for how an
+ * app selects bundles.
+ *
+ * Users should NOT edit this file. To override any route here, define the same
+ * method + path in your `routes/api.ts`: bun-router is first-registration-wins
+ * and user routes load first, so your handler always takes priority.
+ */
+
+import { route } from '@stacksjs/router'
+
+// Rate limits on token-issuance + password-reset endpoints
+// (stacksjs/stacks#1921). `Auth.attempt()` already has a per-email
+// lockout but it doesn't stop credential-stuffing across many emails
+// from one IP, and the token endpoints have no upstream brake at all
+// — a leaked refresh token could be hammered for unlimited access
+// tokens until the row TTL. Userland that overrides any of these in
+// `routes/api.ts` (user routes win) gets to pick its own limits.
+route.post('/login', 'Actions/Auth/LoginAction').rateLimit(5, 'minute')
+route.post('/register', 'Actions/Auth/RegisterAction').rateLimit(3, 'minute')
+// Passkey ENROLLMENT (attaching a new credential to an account) must be
+// auth-gated — it's not a login flow, it's a logged-in user adding a
+// second factor to their own account. Previously unauthenticated and
+// keyed off a client-supplied `email` field: anyone who knew a victim's
+// email could register a passkey against that account and log in as
+// them, no password required. GenerateRegistrationAction/
+// VerifyRegistrationAction now derive identity from request.user().
+route.get('/generate-registration-options', 'Actions/Auth/GenerateRegistrationAction').middleware('auth').rateLimit(10, 'minute')
+route.post('/verify-registration', 'Actions/Auth/VerifyRegistrationAction').middleware('auth').rateLimit(5, 'minute')
+// Passkey AUTHENTICATION (logging in) is correctly unauthenticated —
+// the caller doesn't have a session yet, that's the point.
+route.get('/generate-authentication-options', 'Actions/Auth/GenerateAuthenticationAction').rateLimit(10, 'minute')
+route.get('/verify-authentication', 'Actions/Auth/VerifyAuthenticationAction').rateLimit(10, 'minute')
+
+// TOTP 2FA. Setup/enable/disable act on the caller's own authenticated
+// account (auth-gated, same identity rule as passkey enrollment above).
+// verify-two-factor-login is the second step of LoginAction's flow and
+// is correctly unauthenticated — the caller only has a short-lived
+// challenge token at that point, not a session yet.
+route.post('/generate-two-factor-secret', 'Actions/Auth/GenerateTwoFactorSecretAction').middleware('auth').rateLimit(10, 'minute')
+route.post('/enable-two-factor', 'Actions/Auth/EnableTwoFactorAction').middleware('auth').rateLimit(10, 'minute')
+route.post('/disable-two-factor', 'Actions/Auth/DisableTwoFactorAction').middleware('auth').rateLimit(10, 'minute')
+route.post('/verify-two-factor-login', 'Actions/Auth/VerifyTwoFactorLoginAction').rateLimit(10, 'minute')
+
+route.group({ prefix: '/auth' }, () => {
+  route.post('/refresh', 'Actions/Auth/RefreshTokenAction').rateLimit(10, 'minute')
+  route.get('/tokens', 'Actions/Auth/ListTokensAction').middleware('auth')
+  route.post('/token', 'Actions/Auth/CreateTokenAction').middleware('auth').rateLimit(10, 'minute')
+  route.delete('/tokens/{id}', 'Actions/Auth/RevokeTokenAction').middleware('auth')
+  route.get('/abilities', 'Actions/Auth/TestAbilitiesAction').middleware('auth')
+})
+
+route.group({ middleware: 'auth' }, () => {
+  route.get('/me', 'Actions/Auth/AuthUserAction')
+  route.post('/logout', 'Actions/Auth/LogoutAction')
+  // Sign out everywhere: revoke every access/refresh token AND destroy
+  // every session for the authenticated user (stacksjs/stacks#1957).
+  route.post('/logout-all', 'Actions/Auth/LogoutAllAction')
+})
+
+// Password Reset. `/forgot` triggers a mailer hop so it's the most
+// abuse-prone — keep that tighter than the verification endpoints.
+route.group({ prefix: '/password' }, () => {
+  route.post('/forgot', 'Actions/Password/SendPasswordResetEmailAction').rateLimit(3, 'minute')
+  route.post('/reset', 'Actions/Password/PasswordResetAction').rateLimit(5, 'minute')
+  route.post('/verify-token', 'Actions/Password/VerifyResetTokenAction').rateLimit(10, 'minute')
+})

package/routes/dashboard.ts

@@ -18,67 +18,6 @@
 import process from 'node:process'
 import { response, route } from '@stacksjs/router'
 
-// ============================================================================
-// Auth Routes
-// ============================================================================
-
-// Rate limits on token-issuance + password-reset endpoints
-// (stacksjs/stacks#1921). `Auth.attempt()` already has a per-email
-// lockout but it doesn't stop credential-stuffing across many emails
-// from one IP, and the token endpoints have no upstream brake at all
-// — a leaked refresh token could be hammered for unlimited access
-// tokens until the row TTL. Userland that overrides any of these in
-// `routes/api.ts` (user routes win) gets to pick its own limits.
-route.post('/login', 'Actions/Auth/LoginAction').rateLimit(5, 'minute')
-route.post('/register', 'Actions/Auth/RegisterAction').rateLimit(3, 'minute')
-// Passkey ENROLLMENT (attaching a new credential to an account) must be
-// auth-gated — it's not a login flow, it's a logged-in user adding a
-// second factor to their own account. Previously unauthenticated and
-// keyed off a client-supplied `email` field: anyone who knew a victim's
-// email could register a passkey against that account and log in as
-// them, no password required. GenerateRegistrationAction/
-// VerifyRegistrationAction now derive identity from request.user().
-route.get('/generate-registration-options', 'Actions/Auth/GenerateRegistrationAction').middleware('auth').rateLimit(10, 'minute')
-route.post('/verify-registration', 'Actions/Auth/VerifyRegistrationAction').middleware('auth').rateLimit(5, 'minute')
-// Passkey AUTHENTICATION (logging in) is correctly unauthenticated —
-// the caller doesn't have a session yet, that's the point.
-route.get('/generate-authentication-options', 'Actions/Auth/GenerateAuthenticationAction').rateLimit(10, 'minute')
-route.get('/verify-authentication', 'Actions/Auth/VerifyAuthenticationAction').rateLimit(10, 'minute')
-
-// TOTP 2FA. Setup/enable/disable act on the caller's own authenticated
-// account (auth-gated, same identity rule as passkey enrollment above).
-// verify-two-factor-login is the second step of LoginAction's flow and
-// is correctly unauthenticated — the caller only has a short-lived
-// challenge token at that point, not a session yet.
-route.post('/generate-two-factor-secret', 'Actions/Auth/GenerateTwoFactorSecretAction').middleware('auth').rateLimit(10, 'minute')
-route.post('/enable-two-factor', 'Actions/Auth/EnableTwoFactorAction').middleware('auth').rateLimit(10, 'minute')
-route.post('/disable-two-factor', 'Actions/Auth/DisableTwoFactorAction').middleware('auth').rateLimit(10, 'minute')
-route.post('/verify-two-factor-login', 'Actions/Auth/VerifyTwoFactorLoginAction').rateLimit(10, 'minute')
-
-route.group({ prefix: '/auth' }, () => {
-  route.post('/refresh', 'Actions/Auth/RefreshTokenAction').rateLimit(10, 'minute')
-  route.get('/tokens', 'Actions/Auth/ListTokensAction').middleware('auth')
-  route.post('/token', 'Actions/Auth/CreateTokenAction').middleware('auth').rateLimit(10, 'minute')
-  route.delete('/tokens/{id}', 'Actions/Auth/RevokeTokenAction').middleware('auth')
-  route.get('/abilities', 'Actions/Auth/TestAbilitiesAction').middleware('auth')
-})
-
-route.group({ middleware: 'auth' }, () => {
-  route.get('/me', 'Actions/Auth/AuthUserAction')
-  route.post('/logout', 'Actions/Auth/LogoutAction')
-  // Sign out everywhere: revoke every access/refresh token AND destroy
-  // every session for the authenticated user (stacksjs/stacks#1957).
-  route.post('/logout-all', 'Actions/Auth/LogoutAllAction')
-})
-
-// Password Reset. `/forgot` triggers a mailer hop so it's the most
-// abuse-prone — keep that tighter than the verification endpoints.
-route.group({ prefix: '/password' }, () => {
-  route.post('/forgot', 'Actions/Password/SendPasswordResetEmailAction').rateLimit(3, 'minute')
-  route.post('/reset', 'Actions/Password/PasswordResetAction').rateLimit(5, 'minute')
-  route.post('/verify-token', 'Actions/Password/VerifyResetTokenAction').rateLimit(10, 'minute')
-})
-
 // ============================================================================
 // Email
 // ============================================================================

package/routes/socials.ts

@@ -0,0 +1,32 @@
+/**
+ * Framework Default Routes - Social sign-in (stacksjs/stacks#2276)
+ *
+ * `GET /auth/{provider}` sends the browser to the provider's consent page;
+ * `/auth/{provider}/callback` completes the exchange, resolves the local user
+ * through the find-or-create policy in `@stacksjs/auth` (with its
+ * unverified-email takeover guard), and hands the session to the browser.
+ *
+ * Mounted by `defaults/bootstrap.ts` as the `social` bundle. Unlike the other
+ * bundles it is NOT part of the implicit default set: it mounts only when the
+ * app names it in `STACKS_DEFAULT_ROUTES`, or when at least one provider is
+ * actually configured in `config/services.ts` — a callback URL for a provider
+ * nobody configured is surface for nothing. The actions themselves 404 for
+ * unconfigured provider names either way.
+ *
+ * The callback is registered for POST as well as GET because Apple mandates
+ * `response_mode=form_post` whenever scopes are requested — a GET-only
+ * callback answers Apple's redirect with a 404.
+ *
+ * Users should NOT edit this file. To override any route here, define the
+ * same method + path in your `routes/api.ts`: user routes load first and
+ * first registration wins.
+ */
+
+import { route } from '@stacksjs/router'
+
+// Rate-limited like the other token-issuance endpoints (#1921): the callback
+// mints a session, and the redirect endpoint is a cheap way to hammer a
+// provider's authorize page with this app's client id.
+route.get('/auth/{provider}', 'Actions/Auth/SocialRedirectAction').rateLimit(10, 'minute')
+route.get('/auth/{provider}/callback', 'Actions/Auth/SocialCallbackAction').rateLimit(10, 'minute')
+route.post('/auth/{provider}/callback', 'Actions/Auth/SocialCallbackAction').rateLimit(10, 'minute')

package/vcs/github/CONTRIBUTING.md

@@ -147,7 +147,7 @@ buddy test:types # runs typecheck
 
 ## 🧪 Testing
 
-All of the framework tests are stored within within the `./storage/framework/tests` project folder. When adding or updating functionality, please ensure it is covered through our test suite. Ensure so by running `buddy test`.
+All of this project's tests are stored within the `./tests` project folder. When adding or updating functionality, please ensure it is covered through our test suite. Ensure so by running `buddy test`.
 
 When working on an individual Stack, tests are stored within the `./tests` project folder & it is recommended to write tests (when useful). Bu
 

package/vcs/github/workflows/README.md

@@ -2,15 +2,14 @@
 
 This folder contains the following GitHub Actions:
 
-- [CI][CI] - all CI jobs for the project
+- [CI][CI] — all CI jobs for the project
   - lints the code
   - `typecheck`s the code
-  - automatically fixes & applies code style updates
-  - runs tests (unit, end-to-end)
-  - runs on `ubuntu-latest` with `bun-versions` set to `[x]`
-- [Release][Release] - automates the release process & changelog generation
-- [Lock Closed Issues][Lock Closed Issues] - Locks all closed issues after 14 days of being closed
+  - runs the test suite
+  - runs on `ubuntu-latest`
+- [Release][Release] — on a `v*` tag, generates the changelog and creates the GitHub release
+- [Labeler][Labeler] — labels pull requests from `.github/labeler.yml`
 
-[CI]: ./workflows/ci.yml
-[Release]: ./workflows/release.yml
-[Lock Closed Issues]: ./workflows/lock-closed-issues.yml
+[CI]: ./ci.yml
+[Release]: ./release.yml
+[Labeler]: ./labeler.yml