@stacksjs/defaults 0.70.294 → 0.70.297

package/app/password-policy.ts

@@ -0,0 +1,46 @@
+/**
+ * One password policy, in one place (stacksjs/stacks#2226).
+ *
+ * The framework shipped three numbers for one product concept: `RegisterAction`
+ * and `LoginAction` accepted six characters, the `User` model declared six, and
+ * `PasswordResetAction` hand-checked eight with `password.length < 8` — not in a
+ * `validations:` block at all, so it could not even be read by the machinery
+ * that reads the others.
+ *
+ * Apps then retyped the rule again in the browser, because an Action's
+ * `validations:` was unreachable from a template. That is how a real app ended
+ * up refusing a 7-character password in the browser that `POST /register` would
+ * have accepted.
+ *
+ * Change the policy here and every declaration follows. An app that wants a
+ * different one edits this file, which is scaffolded into it.
+ */
+
+/**
+ * Minimum length for a NEW password.
+ *
+ * Eight, because that is what the password-reset path already enforced and it
+ * is the weaker of the two that was actually protecting anything. Raising the
+ * registration minimum only affects accounts created from now on.
+ */
+export const PASSWORD_MIN_LENGTH = 8
+
+/**
+ * Maximum length. Also the `varchar` width the User model's column derives
+ * from, so lowering it is a migration, not just a rule change.
+ */
+export const PASSWORD_MAX_LENGTH = 255
+
+export const PASSWORD_POLICY_MESSAGE
+  = `Password must be between ${PASSWORD_MIN_LENGTH} and ${PASSWORD_MAX_LENGTH} characters.`
+
+/**
+ * What a sign-in must require: that a password was supplied, and nothing more.
+ *
+ * Deliberately NOT the policy above. Applying a creation rule to authentication
+ * locks out every account created under a previous, shorter policy — they would
+ * get a 422 before their credentials were ever checked, with a message telling
+ * them their own password is too short. The policy belongs on the paths that
+ * SET a password.
+ */
+export const PASSWORD_PRESENCE_MESSAGE = 'Password is required.'

package/bootstrap.ts

@@ -76,26 +76,58 @@ route.use(MaintenanceMiddleware.toRouterHandler() as any)
 // Overridable by registering the same path in app routes first.
 await route.register(frameworkPath('defaults/routes/core.ts'))
 
-// Feature-gated route registration. The dashboard.ts file currently bundles
-// ~687 lines covering auth, password reset, email subscribe, storefront
-// cart/checkout, reviews, sitemap, AI, voice, and the admin dashboard's
-// REST surface. Until that file is split per-feature (auth.ts, marketing.ts,
-// commerce.ts, monitoring.ts), the whole thing loads when `dashboard` is
-// activated and stays inert otherwise.
+// Which default route bundles this app mounts. The route loader resolves the
+// selection (STACKS_DEFAULT_ROUTES, or the legacy STACKS_SKIP_DEFAULT_ROUTES)
+// and leaves it here; see `resolveDefaultRouteBundles` in
+// `core/router/src/route-loader.ts`. Absent when bootstrap is imported by
+// something other than the loader, in which case every bundle is eligible and
+// the feature gates below decide, exactly as before.
+const selection = (globalThis as Record<string, unknown>).__stacksDefaultRouteBundles as
+  { bundles: Set<string>, explicit: boolean } | undefined
+
+/**
+ * Whether a bundle mounts.
+ *
+ * An app that NAMED its bundles has already answered the question, so the
+ * feature flag does not get a second veto - otherwise `STACKS_DEFAULT_ROUTES=auth`
+ * would still be withheld from an app running with `dashboard` off, which is
+ * the exact case this exists for. When nothing was named, the flags gate
+ * precisely as they did before.
+ */
+function mounts(bundle: string, featureEnabled: boolean): boolean {
+  if (selection && !selection.bundles.has(bundle))
+    return false
+  return selection?.explicit ? true : featureEnabled
+}
+
+// Auth: login, registration, logout, refresh/revoke, passkeys, TOTP 2FA and
+// password reset. Split out of dashboard.ts so it can be mounted on its own
+// (stacksjs/stacks#2229) — previously the only way to get `/login` was to
+// activate `dashboard` and take the storefront, reviews, AI and voice surface
+// with it.
+//
+// Registered BEFORE dashboard.ts, which is where these lived, so the
+// first-registration-wins order among framework routes is unchanged.
 //
-// Apps that need only a slice — e.g. a marketing site that wants
-// `/api/email/subscribe` and `/api/contact` but not the rest — can either
-//   1. Activate `dashboard` and live with the over-broad register; the
-//      action handlers for routes you don't hit never fire, and their
-//      models stay un-loaded as long as the corresponding feature flag
-//      (`commerce`, `cms`, `monitoring`) is off, so there's no hidden
-//      cost beyond the bun-router route-table entries.
-//   2. Define the routes they want directly in `routes/api.ts` —
-//      first-registration-wins means the user version takes priority.
+// Deliberately NOT gated on `feature('auth')`, despite the issue asking for
+// it: `config/auth.ts` ships in every app with `enabled: true`, so that gate
+// is true everywhere and would mount the auth surface — including
+// `/generate-two-factor-secret`, `/logout-all` and `/auth/tokens` — in apps
+// currently running with `dashboard` off. Widening an app's public surface on
+// upgrade is not something a refactor gets to do silently.
+if (mounts('auth', feature('dashboard')))
+  await route.register(frameworkPath('defaults/routes/auth.ts'))
+
+// The rest of dashboard.ts: email subscribe, storefront cart/checkout,
+// reviews, sitemap, AI, voice, and the admin dashboard's REST surface. Still
+// one file and still one gate — splitting auth out was the case with a
+// reporter behind it; marketing.ts / commerce.ts / monitoring.ts remain the
+// obvious next cuts.
 //
-// Once the per-feature route split lands, each `if (feature('X'))` block
-// below registers just the X-specific routes file.
-if (feature('dashboard')) {
+// Apps that need only a slice can also define the routes they want directly
+// in `routes/api.ts` — first-registration-wins means the user version takes
+// priority.
+if (mounts('dashboard', feature('dashboard'))) {
   await route.register(frameworkPath('defaults/routes/dashboard.ts'))
   // JSON endpoints for the dev dashboard UI. Kept separate from the view
   // routes above so the data layer is one obvious file to grep.
@@ -112,6 +144,22 @@ if (feature('dashboard')) {
 // non-default mount path register their own routes in `routes/api.ts`
 // and the framework's mount silently no-ops since user routes
 // register first.
-if (feature('email')) {
+if (mounts('email', feature('email'))) {
   await route.register(frameworkPath('defaults/routes/email.ts'))
 }
+
+// Social sign-in: `/auth/{provider}` + `/auth/{provider}/callback`
+// (stacksjs/stacks#2276). An opt-in bundle, NOT part of the implicit default
+// set or `all` — OAuth callback URLs in an app that configured no provider
+// are surface for nothing. So `mounts()` does not apply here: an app that
+// NAMED its bundles decides outright (`social` listed → on, absent → off),
+// and an app that said nothing gets it exactly when a provider is actually
+// configured in config/services.ts — configuring GitHub and finding
+// /auth/github dead would be the puzzle, not the mount.
+const { configuredSocialProviders } = await import('@stacksjs/socials')
+const mountSocial = selection?.explicit
+  ? selection.bundles.has('social')
+  : configuredSocialProviders().length > 0
+if (mountSocial) {
+  await route.register(frameworkPath('defaults/routes/socials.ts'))
+}

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.70.294",
+  "version": "0.70.297",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.294",
+  "version": "0.70.297",
   "description": "The complete managed Stacks application scaffold, including runtime defaults, AI guidance, editor metadata, and npm-backed project support files.",
   "author": "Chris Breuer",
   "license": "MIT",

package/routes/auth.ts

@@ -0,0 +1,83 @@
+/**
+ * Framework Default Routes - Auth
+ *
+ * Login, registration, logout, token refresh and revocation, passkeys, TOTP
+ * 2FA, and password reset.
+ *
+ * Split out of `dashboard.ts` for stacksjs/stacks#2229. That file bundles the
+ * auth surface together with storefront cart/checkout, reviews, sitemap, AI
+ * and voice, and the only gate over the whole thing is `feature('dashboard')`
+ * - so an app that wanted `/login` and 2FA but ships no `Product` or `Coupon`
+ * had to either mount the commerce demo surface or set
+ * `STACKS_SKIP_DEFAULT_ROUTES=1` and re-declare every auth route by hand, rate
+ * limits included. One reporting app did the latter and permanently gave up
+ * 2FA, sign-out-everywhere and API token management, because re-registering
+ * those was not worth the maintenance.
+ *
+ * Mounted by `defaults/bootstrap.ts` as the `auth` bundle; see
+ * `resolveDefaultRouteBundles` in `core/router/src/route-loader.ts` for how an
+ * app selects bundles.
+ *
+ * Users should NOT edit this file. To override any route here, define the same
+ * method + path in your `routes/api.ts`: bun-router is first-registration-wins
+ * and user routes load first, so your handler always takes priority.
+ */
+
+import { route } from '@stacksjs/router'
+
+// Rate limits on token-issuance + password-reset endpoints
+// (stacksjs/stacks#1921). `Auth.attempt()` already has a per-email
+// lockout but it doesn't stop credential-stuffing across many emails
+// from one IP, and the token endpoints have no upstream brake at all
+// — a leaked refresh token could be hammered for unlimited access
+// tokens until the row TTL. Userland that overrides any of these in
+// `routes/api.ts` (user routes win) gets to pick its own limits.
+route.post('/login', 'Actions/Auth/LoginAction').rateLimit(5, 'minute')
+route.post('/register', 'Actions/Auth/RegisterAction').rateLimit(3, 'minute')
+// Passkey ENROLLMENT (attaching a new credential to an account) must be
+// auth-gated — it's not a login flow, it's a logged-in user adding a
+// second factor to their own account. Previously unauthenticated and
+// keyed off a client-supplied `email` field: anyone who knew a victim's
+// email could register a passkey against that account and log in as
+// them, no password required. GenerateRegistrationAction/
+// VerifyRegistrationAction now derive identity from request.user().
+route.get('/generate-registration-options', 'Actions/Auth/GenerateRegistrationAction').middleware('auth').rateLimit(10, 'minute')
+route.post('/verify-registration', 'Actions/Auth/VerifyRegistrationAction').middleware('auth').rateLimit(5, 'minute')
+// Passkey AUTHENTICATION (logging in) is correctly unauthenticated —
+// the caller doesn't have a session yet, that's the point.
+route.get('/generate-authentication-options', 'Actions/Auth/GenerateAuthenticationAction').rateLimit(10, 'minute')
+route.get('/verify-authentication', 'Actions/Auth/VerifyAuthenticationAction').rateLimit(10, 'minute')
+
+// TOTP 2FA. Setup/enable/disable act on the caller's own authenticated
+// account (auth-gated, same identity rule as passkey enrollment above).
+// verify-two-factor-login is the second step of LoginAction's flow and
+// is correctly unauthenticated — the caller only has a short-lived
+// challenge token at that point, not a session yet.
+route.post('/generate-two-factor-secret', 'Actions/Auth/GenerateTwoFactorSecretAction').middleware('auth').rateLimit(10, 'minute')
+route.post('/enable-two-factor', 'Actions/Auth/EnableTwoFactorAction').middleware('auth').rateLimit(10, 'minute')
+route.post('/disable-two-factor', 'Actions/Auth/DisableTwoFactorAction').middleware('auth').rateLimit(10, 'minute')
+route.post('/verify-two-factor-login', 'Actions/Auth/VerifyTwoFactorLoginAction').rateLimit(10, 'minute')
+
+route.group({ prefix: '/auth' }, () => {
+  route.post('/refresh', 'Actions/Auth/RefreshTokenAction').rateLimit(10, 'minute')
+  route.get('/tokens', 'Actions/Auth/ListTokensAction').middleware('auth')
+  route.post('/token', 'Actions/Auth/CreateTokenAction').middleware('auth').rateLimit(10, 'minute')
+  route.delete('/tokens/{id}', 'Actions/Auth/RevokeTokenAction').middleware('auth')
+  route.get('/abilities', 'Actions/Auth/TestAbilitiesAction').middleware('auth')
+})
+
+route.group({ middleware: 'auth' }, () => {
+  route.get('/me', 'Actions/Auth/AuthUserAction')
+  route.post('/logout', 'Actions/Auth/LogoutAction')
+  // Sign out everywhere: revoke every access/refresh token AND destroy
+  // every session for the authenticated user (stacksjs/stacks#1957).
+  route.post('/logout-all', 'Actions/Auth/LogoutAllAction')
+})
+
+// Password Reset. `/forgot` triggers a mailer hop so it's the most
+// abuse-prone — keep that tighter than the verification endpoints.
+route.group({ prefix: '/password' }, () => {
+  route.post('/forgot', 'Actions/Password/SendPasswordResetEmailAction').rateLimit(3, 'minute')
+  route.post('/reset', 'Actions/Password/PasswordResetAction').rateLimit(5, 'minute')
+  route.post('/verify-token', 'Actions/Password/VerifyResetTokenAction').rateLimit(10, 'minute')
+})

package/routes/dashboard.ts

@@ -18,67 +18,6 @@
 import process from 'node:process'
 import { response, route } from '@stacksjs/router'
 
-// ============================================================================
-// Auth Routes
-// ============================================================================
-
-// Rate limits on token-issuance + password-reset endpoints
-// (stacksjs/stacks#1921). `Auth.attempt()` already has a per-email
-// lockout but it doesn't stop credential-stuffing across many emails
-// from one IP, and the token endpoints have no upstream brake at all
-// — a leaked refresh token could be hammered for unlimited access
-// tokens until the row TTL. Userland that overrides any of these in
-// `routes/api.ts` (user routes win) gets to pick its own limits.
-route.post('/login', 'Actions/Auth/LoginAction').rateLimit(5, 'minute')
-route.post('/register', 'Actions/Auth/RegisterAction').rateLimit(3, 'minute')
-// Passkey ENROLLMENT (attaching a new credential to an account) must be
-// auth-gated — it's not a login flow, it's a logged-in user adding a
-// second factor to their own account. Previously unauthenticated and
-// keyed off a client-supplied `email` field: anyone who knew a victim's
-// email could register a passkey against that account and log in as
-// them, no password required. GenerateRegistrationAction/
-// VerifyRegistrationAction now derive identity from request.user().
-route.get('/generate-registration-options', 'Actions/Auth/GenerateRegistrationAction').middleware('auth').rateLimit(10, 'minute')
-route.post('/verify-registration', 'Actions/Auth/VerifyRegistrationAction').middleware('auth').rateLimit(5, 'minute')
-// Passkey AUTHENTICATION (logging in) is correctly unauthenticated —
-// the caller doesn't have a session yet, that's the point.
-route.get('/generate-authentication-options', 'Actions/Auth/GenerateAuthenticationAction').rateLimit(10, 'minute')
-route.get('/verify-authentication', 'Actions/Auth/VerifyAuthenticationAction').rateLimit(10, 'minute')
-
-// TOTP 2FA. Setup/enable/disable act on the caller's own authenticated
-// account (auth-gated, same identity rule as passkey enrollment above).
-// verify-two-factor-login is the second step of LoginAction's flow and
-// is correctly unauthenticated — the caller only has a short-lived
-// challenge token at that point, not a session yet.
-route.post('/generate-two-factor-secret', 'Actions/Auth/GenerateTwoFactorSecretAction').middleware('auth').rateLimit(10, 'minute')
-route.post('/enable-two-factor', 'Actions/Auth/EnableTwoFactorAction').middleware('auth').rateLimit(10, 'minute')
-route.post('/disable-two-factor', 'Actions/Auth/DisableTwoFactorAction').middleware('auth').rateLimit(10, 'minute')
-route.post('/verify-two-factor-login', 'Actions/Auth/VerifyTwoFactorLoginAction').rateLimit(10, 'minute')
-
-route.group({ prefix: '/auth' }, () => {
-  route.post('/refresh', 'Actions/Auth/RefreshTokenAction').rateLimit(10, 'minute')
-  route.get('/tokens', 'Actions/Auth/ListTokensAction').middleware('auth')
-  route.post('/token', 'Actions/Auth/CreateTokenAction').middleware('auth').rateLimit(10, 'minute')
-  route.delete('/tokens/{id}', 'Actions/Auth/RevokeTokenAction').middleware('auth')
-  route.get('/abilities', 'Actions/Auth/TestAbilitiesAction').middleware('auth')
-})
-
-route.group({ middleware: 'auth' }, () => {
-  route.get('/me', 'Actions/Auth/AuthUserAction')
-  route.post('/logout', 'Actions/Auth/LogoutAction')
-  // Sign out everywhere: revoke every access/refresh token AND destroy
-  // every session for the authenticated user (stacksjs/stacks#1957).
-  route.post('/logout-all', 'Actions/Auth/LogoutAllAction')
-})
-
-// Password Reset. `/forgot` triggers a mailer hop so it's the most
-// abuse-prone — keep that tighter than the verification endpoints.
-route.group({ prefix: '/password' }, () => {
-  route.post('/forgot', 'Actions/Password/SendPasswordResetEmailAction').rateLimit(3, 'minute')
-  route.post('/reset', 'Actions/Password/PasswordResetAction').rateLimit(5, 'minute')
-  route.post('/verify-token', 'Actions/Password/VerifyResetTokenAction').rateLimit(10, 'minute')
-})
-
 // ============================================================================
 // Email
 // ============================================================================

package/routes/socials.ts

@@ -0,0 +1,32 @@
+/**
+ * Framework Default Routes - Social sign-in (stacksjs/stacks#2276)
+ *
+ * `GET /auth/{provider}` sends the browser to the provider's consent page;
+ * `/auth/{provider}/callback` completes the exchange, resolves the local user
+ * through the find-or-create policy in `@stacksjs/auth` (with its
+ * unverified-email takeover guard), and hands the session to the browser.
+ *
+ * Mounted by `defaults/bootstrap.ts` as the `social` bundle. Unlike the other
+ * bundles it is NOT part of the implicit default set: it mounts only when the
+ * app names it in `STACKS_DEFAULT_ROUTES`, or when at least one provider is
+ * actually configured in `config/services.ts` — a callback URL for a provider
+ * nobody configured is surface for nothing. The actions themselves 404 for
+ * unconfigured provider names either way.
+ *
+ * The callback is registered for POST as well as GET because Apple mandates
+ * `response_mode=form_post` whenever scopes are requested — a GET-only
+ * callback answers Apple's redirect with a 404.
+ *
+ * Users should NOT edit this file. To override any route here, define the
+ * same method + path in your `routes/api.ts`: user routes load first and
+ * first registration wins.
+ */
+
+import { route } from '@stacksjs/router'
+
+// Rate-limited like the other token-issuance endpoints (#1921): the callback
+// mints a session, and the redirect endpoint is a cheap way to hammer a
+// provider's authorize page with this app's client id.
+route.get('/auth/{provider}', 'Actions/Auth/SocialRedirectAction').rateLimit(10, 'minute')
+route.get('/auth/{provider}/callback', 'Actions/Auth/SocialCallbackAction').rateLimit(10, 'minute')
+route.post('/auth/{provider}/callback', 'Actions/Auth/SocialCallbackAction').rateLimit(10, 'minute')

package/vcs/github/CONTRIBUTING.md

@@ -147,7 +147,7 @@ buddy test:types # runs typecheck
 
 ## 🧪 Testing
 
-All of the framework tests are stored within within the `./storage/framework/tests` project folder. When adding or updating functionality, please ensure it is covered through our test suite. Ensure so by running `buddy test`.
+All of this project's tests are stored within the `./tests` project folder. When adding or updating functionality, please ensure it is covered through our test suite. Ensure so by running `buddy test`.
 
 When working on an individual Stack, tests are stored within the `./tests` project folder & it is recommended to write tests (when useful). Bu
 

package/vcs/github/workflows/README.md

@@ -2,15 +2,14 @@
 
 This folder contains the following GitHub Actions:
 
-- [CI][CI] - all CI jobs for the project
+- [CI][CI] — all CI jobs for the project
   - lints the code
   - `typecheck`s the code
-  - automatically fixes & applies code style updates
-  - runs tests (unit, end-to-end)
-  - runs on `ubuntu-latest` with `bun-versions` set to `[x]`
-- [Release][Release] - automates the release process & changelog generation
-- [Lock Closed Issues][Lock Closed Issues] - Locks all closed issues after 14 days of being closed
+  - runs the test suite
+  - runs on `ubuntu-latest`
+- [Release][Release] — on a `v*` tag, generates the changelog and creates the GitHub release
+- [Labeler][Labeler] — labels pull requests from `.github/labeler.yml`
 
-[CI]: ./workflows/ci.yml
-[Release]: ./workflows/release.yml
-[Lock Closed Issues]: ./workflows/lock-closed-issues.yml
+[CI]: ./ci.yml
+[Release]: ./release.yml
+[Labeler]: ./labeler.yml

package/vcs/github/workflows/release.yml

@@ -7,18 +7,17 @@ on:
 
 permissions:
   contents: write
-  packages: write
-  id-token: write
 
 jobs:
-  npm:
+  release:
     runs-on: ubuntu-latest
-    outputs:
-      version: ${{ env.VERSION }}
+
     steps:
       - name: Checkout Code
         uses: actions/checkout@v6
         with:
+          # The changelog is generated from commits since the previous tag, so
+          # the full history has to be present.
           fetch-depth: 0
 
       - name: Setup Pantry
@@ -37,183 +36,7 @@ jobs:
       - name: Install Dependencies
         run: bun install
 
-      - name: Publish Framework
-        run: ./storage/framework/scripts/publish
-        env:
-          BUN_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-
-      - name: Publish Dummy Libraries
-        run: ./storage/framework/scripts/publish-dummy-libs
-        env:
-          BUN_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-
-      - name: Publish VS Code Extension
-        continue-on-error: true
-        run: |
-          cd storage/framework/defaults/ide/vscode
-          bun install
-          bunx --bun vsce publish --no-dependencies
-          cd ../../../../
-        env:
-          VSCE_PAT: ${{ secrets.VSCE_PAT }}
-
-      - name: Extract tag version
-        id: get_version
-        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-
-      - name: Build Buddy Release Assets
-        run: |
-          cd storage/framework/core/buddy
-          bun run compile:all
-          bun run zip:all
-
       - name: Create GitHub Release
         uses: stacksjs/action-releaser@v1.2.9
-        with:
-          files: |
-            storage/framework/core/buddy/bin/buddy-linux-x64
-            storage/framework/core/buddy/bin/buddy-linux-arm64
-            storage/framework/core/buddy/bin/buddy-windows-x64.exe
-            storage/framework/core/buddy/bin/buddy-darwin-x64
-            storage/framework/core/buddy/bin/buddy-darwin-arm64
-            storage/framework/core/buddy/bin/buddy-linux-x64.zip
-            storage/framework/core/buddy/bin/buddy-linux-arm64.zip
-            storage/framework/core/buddy/bin/buddy-windows-x64.zip
-            storage/framework/core/buddy/bin/buddy-darwin-x64.zip
-            storage/framework/core/buddy/bin/buddy-darwin-arm64.zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  homebrew:
-    needs: npm
-    runs-on: macos-latest
-    steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Debug Tag
-        run: |
-          echo "Tag: ${GITHUB_REF#refs/tags/}"
-          echo "Version from previous job: ${{ needs.release.outputs.version }}"
-
-      - name: Generate GitHub App Token
-        id: generate-token
-        uses: actions/create-github-app-token@v2
-        with:
-          app-id: ${{ secrets.GH_APP_ID }}
-          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
-
-      - name: Setup GitHub CLI with PAT
-        run: |
-          echo "${{ secrets.GH_PAT }}" | gh auth login --with-token
-
-      - name: Ensure Homebrew Tap Repository Exists
-        env:
-          GH_TOKEN: ${{ secrets.GH_PAT }}
-        run: |
-          if ! gh repo view stacksjs/homebrew-tap &>/dev/null; then
-            echo "Creating homebrew-tap repository..."
-            gh repo create stacksjs/homebrew-tap --public --description "Homebrew tap for Stacks packages"
-          else
-            echo "homebrew-tap repository already exists"
-          fi
-
-      - name: Authenticate GitHub CLI with App Token
-        run: echo "${{ steps.generate-token.outputs.token }}" | gh auth login --with-token
-
-      - name: Wait for Release Assets
-        run: |
-          VERSION=${GITHUB_REF#refs/tags/}
-          echo "Waiting for release assets to be available..."
-
-          # Wait for assets to be available (max 10 minutes)
-          TIMEOUT=600
-          START_TIME=$(date +%s)
-
-          while [ $(( $(date +%s) - START_TIME )) -lt $TIMEOUT ]; do
-            HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" https://github.com/stacksjs/stacks/releases/download/$VERSION/buddy-darwin-arm64)
-            echo "HTTP response code: $HTTP_CODE"
-
-            if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "302" ]; then
-              echo "Assets are available!"
-              break
-            fi
-
-            echo "Assets not ready yet, waiting 10 seconds..."
-            sleep 10
-          done
-
-          if [ $(( $(date +%s) - START_TIME )) -ge $TIMEOUT ]; then
-            echo "Timed out waiting for assets, proceeding anyway..."
-          fi
-
-          # Force continue even if we couldn't detect the file
-          # Sometimes GitHub's API can be inconsistent
-          echo "Continuing with asset download..."
-
-      - name: Download Binaries Directly
-        run: |
-          VERSION=${GITHUB_REF#refs/tags/}
-          mkdir -p .github/temp
-          cd .github/temp
-
-          # Try direct download with retries
-          download_with_retry() {
-            local url=$1
-            local output=$2
-            local max_retries=5
-            local retry=0
-
-            while [ $retry -lt $max_retries ]; do
-              echo "Downloading $url (attempt $(($retry + 1))/$max_retries)"
-              if curl -L -s -f "$url" -o "$output"; then
-                echo "Downloaded $output successfully"
-                return 0
-              fi
-              echo "Download failed, retrying in 5 seconds..."
-              retry=$((retry + 1))
-              sleep 5
-            done
-
-            echo "Failed to download $url after $max_retries attempts"
-            return 1
-          }
-
-          download_with_retry "https://github.com/stacksjs/stacks/releases/download/$VERSION/buddy-darwin-arm64" "buddy-darwin-arm64"
-          download_with_retry "https://github.com/stacksjs/stacks/releases/download/$VERSION/buddy-darwin-x64" "buddy-darwin-x64"
-          download_with_retry "https://github.com/stacksjs/stacks/releases/download/$VERSION/buddy-linux-arm64" "buddy-linux-arm64"
-          download_with_retry "https://github.com/stacksjs/stacks/releases/download/$VERSION/buddy-linux-x64" "buddy-linux-x64"
-
-          cd ../..
-
-      - name: Update Homebrew Formula
-        run: |
-          VERSION=${GITHUB_REF#refs/tags/}
-          bash .github/scripts/update-homebrew-formula.sh $VERSION
-
-      - name: Push to Homebrew Tap Repository
-        run: |
-          # Clone the tap repo using GitHub App token
-          git clone https://x-access-token:${{ steps.generate-token.outputs.token }}@github.com/stacksjs/homebrew-tap.git
-
-          # Set up Git config
-          cd homebrew-tap
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Copy the formula to the tap repo
-          mkdir -p Formula
-          cp ../.github/homebrew/stacks.rb Formula/
-
-          # Check if there are changes to commit
-          if git status --porcelain | grep -q .; then
-            # Push the changes to the tap repo
-            git add Formula/stacks.rb
-            git commit -m "chore: update stacks formula to ${GITHUB_REF#refs/tags/}"
-            git push
-            echo "Successfully updated homebrew formula!"
-          else
-            echo "No changes to commit"
-          fi

package/vcs/github/workflows/export-size.yml

@@ -1,25 +0,0 @@
-name: Export Size
-
-on:
-  pull_request:
-    branches:
-      - main
-
-jobs:
-  size:
-    strategy:
-      matrix:
-        node-version: [18.x]
-        os: [ubuntu-latest]
-      fail-fast: false
-
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v3
-
-      - name: Setup Pantry
-        uses: pantry-pm/pantry/packages/action@485c7b102fe14f8af00b57441a13dc3daa1505e7 # v0.10.39
-        with:
-          install: 'false'