@stacksjs/defaults 0.74.29 → 0.74.31

package/ai/skills/stacks-auth/SKILL.md

@@ -52,6 +52,28 @@ auth/src/
 - `Auth.login(credentials: AuthCredentials, options?: TokenCreateOptions): Promise<{ user, token } | null>` — login and create token
 - `Auth.loginUsingId(userId: number, options?: TokenCreateOptions): Promise<{ user, token } | null>` — login by user ID
 - `Auth.logout(): Promise<void>` — revoke current token
+
+### Personal access tokens (Sanctum-shaped)
+
+`oauth_access_tokens` is polymorphic: `tokenable_type` holds the owner's TABLE
+name (`users`, `authors`) and `tokenable_id` its id there, so any model
+declaring `useAuth` can hold tokens - not only `User`.
+
+- `createToken(id, name, scopes, { tokenableType })` — mint one. Returns the
+  plaintext ONCE (`plainTextToken`); the table stores a hash and nothing can
+  recover it afterwards. `tokenableType` defaults to `users`.
+- `tokens(id, tokenableType?)` — list an owner's live tokens.
+- `tokenCan(scope)` / `tokenCanAll` / `tokenCanAny` / `tokenAbilities` — check
+  the current request's token.
+- `revokeToken`, `revokeTokenById`, `revokeAllTokens(id, type?)`,
+  `revokeOtherTokens(id, type?)` — revocation also revokes the paired refresh
+  token, which a raw row delete does not.
+- `setTrailActor(id)` — attribute writes in a queue job or CLI run that has no
+  request to read a user from.
+
+The `PersonalAccessToken` model maps the same table, so `owner.with('tokenable')`
+lists exactly what `createToken` minted. It deliberately generates no CRUD
+routes: minting and revoking both carry semantics a generic route does not.
 - `Auth.once(credentials: AuthCredentials): Promise<boolean>` — one-time auth without token
 - `Auth.requestToken(credentials, clientId, clientSecret): Promise<{ token } | null>` — OAuth token request
 

package/ai/skills/stacks-auto-imports/SKILL.md

@@ -66,7 +66,7 @@ globalThis.toggleDark = toggleDark
 - **Custom Functions**: From `resources/functions/` (counter, dark mode, GPX, geo utilities)
 
 ### Server Auto-Imports (100+)
-- **All ORM Models**: User, Post, Author, Product, Order, Payment, Customer, etc. (97 models)
+- **All ORM Models**: User, Post, Author, Product, Order, Payment, Customer, etc. (98 models)
 - **Request Models**: UserRequest, PostRequest, OrderRequest, etc.
 - **Actions**: Action types and helpers
 - **Schema**: validation schema builder

package/ai/skills/stacks-models/SKILL.md

@@ -98,10 +98,12 @@ generated model types stay precise.
 | `useUuid` | UUID column alongside the primary key |
 | `useTimestamps` (alias `timestampable`) | `created_at` / `updated_at`. On by default |
 | `useSoftDeletes` (alias `softDeletable`) | `deleted_at` plus soft-delete query scopes |
-| `useAuth` (alias `authenticatable`) | Auth columns; `{ usePasskey: true }` adds passkeys |
+| `useAuth` (alias `authenticatable`) | Auth columns; `{ usePasskey: true }` adds passkeys. Also confers `morphMany: { tokenable: 'PersonalAccessToken' }`, so any authenticatable model can hold API tokens |
 | `useApi` | Generates REST actions and routes: `{ uri, routes, middleware? }` |
 | `useSearch` (alias `searchable`) | Search-engine indexing: `{ displayable, searchable, sortable, filterable }` |
 | `useSocials` | OAuth identities, e.g. `['github']` |
+| `useActivityLog` | Writes an `activities` feed row per change: `{ logOnly }` / `{ include }` / `{ exclude }` pick the attributes |
+| `useAudit` | Writes a `model_audits` row per change with an old/new diff |
 | `observe` | Emits `{model}:created` / `:updated` / `:deleted` events |
 | `billable` | Stripe methods (`checkout()`, `activeSubscription()`, ...) |
 | `taggable` / `categorizable` / `commentable` / `likeable` | Pivot tables and their relation methods |

package/ai/skills/stacks-orm/SKILL.md

@@ -11,7 +11,7 @@ allowed-tools: Read Edit Write Bash Grep Glob
 ## Key Paths
 - Core ORM package: `storage/framework/core/orm/src/`
 - ORM implementation: `storage/framework/orm/`
-- Model definitions: `storage/framework/defaults/app/Models/` (97 models)
+- Model definitions: `storage/framework/defaults/app/Models/` (98 models)
 - Application models: `app/Models/`
 - Default model templates: `storage/framework/defaults/app/Models/`
 - ORM type globals: `storage/framework/types/orm-globals.d.ts`

package/app/Middleware/Api.ts

@@ -16,7 +16,7 @@ export default new Middleware({
   name: 'api',
   priority: 1,
 
-  async handle(request) {
+  handle(request) {
     // Ensure the request accepts JSON
     const accept = request.headers.get('accept') || ''
     if (!accept.includes('application/json') && !accept.includes('*/*')) {

package/app/Middleware/Auth.ts

@@ -1,4 +1,6 @@
-import { Auth, authCookieName, sessionUser } from '@stacksjs/auth'
+import { Auth } from '@stacksjs/auth/authentication'
+import { authCookieName } from '@stacksjs/auth/cookie'
+import { sessionUser } from '@stacksjs/auth/session-auth'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
 

package/app/Middleware/Can.ts

@@ -1,4 +1,5 @@
-import { authenticatedUser, AuthorizationException, authorize } from '@stacksjs/auth'
+import { AuthorizationException, authorize } from '@stacksjs/auth/gate'
+import { authenticatedUser } from '@stacksjs/auth/middleware'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware, resolveRouteModel, setRouteModelFallback } from '@stacksjs/router'
 

package/app/Middleware/Compress.ts

@@ -37,7 +37,7 @@ import { Middleware } from '@stacksjs/router'
  *   - **Skip** for already-compressed content types (image/*, video/*,
  *     audio/*, application/zip, gzip, octet-stream).
  *   - **Skip** SSE / WebSocket upgrades (`text/event-stream`).
- *   - **Prefer brotli** when `br` is offered. Brotli typically
+ *   - **Prefer the highest accepted weight**, using brotli on ties. Brotli typically
  *     achieves ~20% better ratios than gzip on HTML/JSON/CSS/JS at
  *     comparable CPU cost — well worth the swap when the client
  *     supports it.
@@ -75,24 +75,66 @@ const SKIP_CONTENT_TYPE_PREFIXES = [
   'text/event-stream',
 ]
 
-/** Parse the q-weighted Accept-Encoding header into a preference set. */
+type Encoding = 'br' | 'gzip' | null
+
+let lastAcceptEncoding: string | null | undefined
+let lastEncoding: Encoding = null
+
+/** Repeated offers reuse one pure result, without retaining a growing cache. */
 function pickEncoding(acceptEncoding: string | null): 'br' | 'gzip' | null {
-  if (!acceptEncoding) return null
-  // We don't fully implement q-value parsing — it's overkill for the
-  // brotli-vs-gzip choice. We just check for token presence.
-  const lc = acceptEncoding.toLowerCase()
-  // Brotli first because it ratios better on text — typical 20% smaller
-  // than gzip on HTML/JSON. CPU cost per byte is similar at default
-  // quality on Node's libbrotli.
-  if (lc.includes('br')) return 'br'
-  if (lc.includes('gzip')) return 'gzip'
+  if (acceptEncoding === lastAcceptEncoding)
+    return lastEncoding
+  const encoding = parseEncoding(acceptEncoding)
+  lastAcceptEncoding = acceptEncoding
+  lastEncoding = encoding
+  return encoding
+}
+
+/** Exact HTTP coding tokens and qualities, with Brotli first on equal weights. */
+function parseEncoding(header: string | null): Encoding {
+  if (!header)
+    return null
+
+  let br: number | undefined
+  let gzip: number | undefined
+  let identity = 0
+  let wildcard = 0
+  for (const part of header.split(',')) {
+    const separator = part.indexOf(';')
+    const name = (separator < 0 ? part : part.slice(0, separator)).trim().toLowerCase()
+    if (name !== 'br' && name !== 'gzip' && name !== 'identity' && name !== '*')
+      continue
+
+    let quality = 1
+    if (separator >= 0) {
+      const weight = /^;[\t ]*q=(0(?:\.\d{0,3})?|1(?:\.0{0,3})?)[\t ]*$/i.exec(part.slice(separator))
+      quality = weight ? Number(weight[1]) : 0
+    }
+    if (name === 'br')
+      br = quality
+    else if (name === 'gzip')
+      gzip = quality
+    else if (name === 'identity')
+      identity = quality
+    else
+      wildcard = quality
+  }
+  br ??= wildcard
+  gzip ??= wildcard
+  if (identity > Math.max(br, gzip))
+    return null
+  if (br > 0 && br >= gzip)
+    return 'br'
+  if (gzip > 0)
+    return 'gzip'
   return null
 }
 
 /** Heuristic: is this content type worth compressing? */
 function shouldCompressContentType(contentType: string | null): boolean {
   if (!contentType) return true // unknown → assume text-like
-  const ct = (contentType.toLowerCase().split(';')[0] ?? '').trim()
+  const separator = contentType.indexOf(';')
+  const ct = (separator < 0 ? contentType : contentType.slice(0, separator)).trim().toLowerCase()
   for (const prefix of SKIP_CONTENT_TYPE_PREFIXES) {
     if (ct.startsWith(prefix)) return false
   }
@@ -109,6 +151,9 @@ function shouldCompressContentType(contentType: string | null): boolean {
  * JSON/HTML response sizes we're targeting (KB to single-digit MB).
  * For multi-MB streamed responses, the middleware should be skipped
  * (the SSE / event-stream check above handles the most common case).
+ * A caller that already knows a conservative UTF-8 byte upper bound may
+ * supply it to leave a proven sub-threshold body unconsumed. This must come
+ * from the body itself, not an unverified Content-Length header.
  *
  * @example
  * ```ts
@@ -117,11 +162,14 @@ function shouldCompressContentType(contentType: string | null): boolean {
  * // → response with `Content-Encoding: br` and a brotli-compressed body
  * ```
  */
-export async function applyCompression(request: Request, response: Response): Promise<Response> {
+export async function applyCompression(request: Request, response: Response, bodySizeUpperBound?: number): Promise<Response> {
   // Already encoded — leave it alone. Re-encoding would corrupt the
   // body, and the client already knows what to expect.
   if (response.headers.get('content-encoding')) return response
 
+  if (bodySizeUpperBound !== undefined && Number.isSafeInteger(bodySizeUpperBound) && bodySizeUpperBound >= 0 && bodySizeUpperBound < MIN_COMPRESS_BYTES)
+    return response
+
   // No body or non-text content streams (SSE, etc.) — skip.
   if (!response.body) return response
 
@@ -145,7 +193,7 @@ export async function applyCompression(request: Request, response: Response): Pr
     })
   }
 
-  let compressed: Buffer
+  let compressed: Uint8Array<ArrayBuffer>
   if (encoding === 'br') {
     // Brotli quality 5 is the sweet spot for dynamic responses:
     // quality 11 (max) is ~10× slower for ~5% smaller output.
@@ -161,7 +209,7 @@ export async function applyCompression(request: Request, response: Response): Pr
     // for typical response sizes — used here in preference to
     // node:zlib for the gzip path. Brotli has no Bun-native API yet
     // (as of writing) so we use node:zlib for that branch.
-    compressed = Buffer.from(Bun.gzipSync(bodyBuf))
+    compressed = Bun.gzipSync(bodyBuf)
   }
 
   const newHeaders = new Headers(response.headers)
@@ -180,9 +228,8 @@ export async function applyCompression(request: Request, response: Response): Pr
     newHeaders.set('Vary', 'Accept-Encoding')
   }
 
-  // Node's Buffer satisfies BodyInit at runtime but not in the DOM lib's
-  // types; the underlying bytes are what Response wants either way.
-  return new Response(new Uint8Array(compressed), {
+  // Both codecs return owned, non-shared bytes accepted directly by Response.
+  return new Response(compressed, {
     status: response.status,
     statusText: response.statusText,
     headers: newHeaders,
@@ -207,7 +254,7 @@ export default new Middleware({
   // to the action — the post-action wrapper picks it up by name.
   priority: 100,
 
-  async handle(request) {
+  handle(request) {
     // Stamp the request so the post-response wrapper knows to compress.
     // This is read by the router's response-finalization step.
     ;request._compress = true

package/app/Middleware/Cors.ts

@@ -294,7 +294,7 @@ export default new Middleware({
   // actual auth failure).
   priority: 0,
 
-  async handle(request) {
+  handle(request) {
     const cfg = resolveCorsConfig()
 
     // Preflight short-circuit — throwing a Response is the documented way

package/app/Middleware/Csrf.ts

@@ -1,6 +1,6 @@
 import { timingSafeEqual } from 'node:crypto'
 import { HttpError } from '@stacksjs/error-handling'
-import type { EnhancedRequest } from '@stacksjs/bun-router'
+import type { EnhancedRequest } from '@stacksjs/router'
 import { Middleware } from '@stacksjs/router'
 
 /**
@@ -63,6 +63,8 @@ const CSRF_SECURE_TRANSPORT = Symbol.for('@stacksjs/router:csrf-secure-transport
 const CSRF_HEADER_NAME = 'x-csrf-token'
 const CSRF_COOKIE_PREFIX = `${CSRF_COOKIE_NAME}=`
 const LEGACY_CSRF_COOKIE_PREFIX = 'csrf-token='
+const JOINED_CSRF_COOKIE_PREFIX = `, ${CSRF_COOKIE_PREFIX}`
+const JOINED_LEGACY_CSRF_COOKIE_PREFIX = `, ${LEGACY_CSRF_COOKIE_PREFIX}`
 const CSRF_COOKIE_SUFFIX = '; Path=/; SameSite=Lax; Max-Age=7200'
 const CSRF_COOKIE_SECURE_SUFFIX = `${CSRF_COOKIE_SUFFIX}; Secure`
 const TOKEN_BYTES = 32
@@ -122,12 +124,15 @@ function responseAlreadySeeds(response: Response): boolean {
     ? headers.getSetCookie()
     : [headers.get('set-cookie') || '']
 
-  return cookies.some(cookie =>
-    cookie.startsWith(`${CSRF_COOKIE_NAME}=`)
-    || cookie.startsWith('csrf-token=')
-    || cookie.includes(`, ${CSRF_COOKIE_NAME}=`)
-    || cookie.includes(', csrf-token='),
-  )
+  for (const cookie of cookies) {
+    if (
+      cookie.startsWith(CSRF_COOKIE_PREFIX)
+      || cookie.startsWith(LEGACY_CSRF_COOKIE_PREFIX)
+      || cookie.includes(JOINED_CSRF_COOKIE_PREFIX)
+      || cookie.includes(JOINED_LEGACY_CSRF_COOKIE_PREFIX)
+    ) return true
+  }
+  return false
 }
 
 export function createCsrfCookie(req: Request, minted?: string): string {
@@ -199,14 +204,26 @@ function csrfCookieToken(req: Request): string {
   }
   let canonical = ''
   let legacy = ''
-  for (const part of header.split(';')) {
-    const idx = part.indexOf('=')
-    if (idx === -1) continue
-    const name = part.slice(0, idx).trim()
+  let start = 0
+  while (start < header.length) {
+    // Scan each name only once, stopping at '=' or a malformed pair's ';'.
+    let equals = start
+    while (equals < header.length && header.charCodeAt(equals) !== 61 && header.charCodeAt(equals) !== 59)
+      equals++
+    if (equals === header.length)
+      break
+    if (header.charCodeAt(equals) === 59) {
+      start = equals + 1
+      continue
+    }
+    const separator = header.indexOf(';', equals + 1)
+    const end = separator === -1 ? header.length : separator
+    const name = header.slice(start, equals).trim()
     if (name === CSRF_COOKIE_NAME)
-      canonical = part.slice(idx + 1).trim()
+      canonical = header.slice(equals + 1, end).trim()
     else if (name === 'csrf-token')
-      legacy = part.slice(idx + 1).trim()
+      legacy = header.slice(equals + 1, end).trim()
+    start = end + 1
   }
   return canonical || legacy
 }

package/app/Middleware/EnsureEmailIsVerified.ts

@@ -1,4 +1,4 @@
-import { authenticatedUser } from '@stacksjs/auth'
+import { authenticatedUser } from '@stacksjs/auth/middleware'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
 

package/app/Middleware/Maintenance.ts

@@ -1,5 +1,7 @@
 import { Middleware } from '@stacksjs/router'
 
+let serverModule: typeof import('@stacksjs/server') | undefined
+
 /**
  * Maintenance / Coming-Soon Middleware
  *
@@ -27,7 +29,7 @@ export default new Middleware({
   priority: 0, // Run first, before all other middleware
 
   async handle(request) {
-    const { maintenanceGate } = await import('@stacksjs/server')
+    const { maintenanceGate } = serverModule ??= await import('@stacksjs/server')
 
     const gated = await maintenanceGate(request)
     if (gated)

package/app/Middleware/Permission.ts

@@ -1,4 +1,4 @@
-import { authenticatedUser } from '@stacksjs/auth'
+import { authenticatedUser } from '@stacksjs/auth/middleware'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
 
@@ -32,7 +32,7 @@ export default new Middleware({
       throw new HttpError(401, 'Unauthenticated.')
     }
 
-    const { hasAnyPermission } = await import('@stacksjs/auth')
+    const { hasAnyPermission } = await import('@stacksjs/auth/rbac')
 
     const hasRequired = await hasAnyPermission(user, requiredPermissions)
 

package/app/Middleware/Role.ts

@@ -1,4 +1,4 @@
-import { authenticatedUser } from '@stacksjs/auth'
+import { authenticatedUser } from '@stacksjs/auth/middleware'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
 
@@ -32,7 +32,7 @@ export default new Middleware({
     }
 
     // Dynamically import to avoid circular dependency
-    const { hasAnyRole } = await import('@stacksjs/auth')
+    const { hasAnyRole } = await import('@stacksjs/auth/rbac')
 
     const hasRequired = await hasAnyRole(user, requiredRoles)
 

package/app/Middleware/Team.ts

@@ -1,4 +1,4 @@
-import { authenticatedUser } from '@stacksjs/auth'
+import { authenticatedUser } from '@stacksjs/auth/middleware'
 import { HttpError } from '@stacksjs/error-handling'
 import { Middleware } from '@stacksjs/router'
 

package/app/Middleware/Throttle.ts

@@ -67,7 +67,6 @@ export default new Middleware({
     // If result is a Response (429), throw it to short-circuit the request
     if (result instanceof Response) {
       // Transform the response to match stacks format
-      const _body = await result.clone().json().catch(() => ({}))
       const retryAfter = result.headers.get('Retry-After') || '60'
 
       throw new Response(JSON.stringify({

package/app/Models/Content/Author.ts

@@ -45,6 +45,7 @@ export default defineModel({
     observe: true,
   },
 
+
   hasMany: ['Post'],
   belongsTo: ['User'],
 

package/app/Models/Content/Post.ts

@@ -15,10 +15,12 @@ export default defineModel({
     useUuid: true,
     useTimestamps: true,
     useSearch: {
-      displayable: ['id', 'title', 'slug', 'author', 'views', 'status', 'poster', 'focusKeyword', 'metaDescription', 'canonicalUrl'],
+      displayable: ['id', 'title', 'slug', 'authorId', 'views', 'status', 'poster', 'focusKeyword', 'metaDescription', 'canonicalUrl'],
       // `content`, not `body` - the column is `content`, and the old spelling
-      // silently indexed nothing. `comments` likewise was never a column.
-      searchable: ['title', 'slug', 'author', 'content', 'excerpt', 'focusKeyword', 'metaDescription'],
+      // silently indexed nothing. `comments` likewise was never a column, and
+      // nor was `author`: the column is `author_id`, which is worth showing and
+      // filtering on but is not free text to search.
+      searchable: ['title', 'slug', 'content', 'excerpt', 'focusKeyword', 'metaDescription'],
       sortable: ['published_at', 'views'],
       filterable: ['status'],
     },

package/app/Models/PersonalAccessToken.ts

@@ -0,0 +1,154 @@
+import { defineModel, selfOwnership } from '@stacksjs/orm'
+import { schema } from '@stacksjs/validation'
+
+/**
+ * A named API token belonging to a user - the Sanctum shape.
+ *
+ * Maps the table the auth layer already owns rather than introducing a second
+ * one. `@stacksjs/auth` issues these through `createToken(userId, name, scopes)`
+ * and checks them with `tokenCan` / `tokenCanAll` / `tokenAbilities`; what was
+ * missing was the model, so `User.hasMany('PersonalAccessToken')` named
+ * something real and a token list could be queried, related and exposed like
+ * any other row.
+ *
+ * `oauth_access_tokens` is created by `ensureAuthTables()` rather than by a
+ * migration, the same as `notifications` - which is why nothing here declares
+ * columns the auth layer does not already define.
+ *
+ * The token column holds a HASH, never the plaintext: `createToken` returns the
+ * plaintext once, to the caller, and it is not recoverable afterwards. It is
+ * `hidden` so it cannot leave through a serialised response, and `guarded` so
+ * no mass assignment can set it.
+ */
+export default defineModel({
+  name: 'PersonalAccessToken',
+  table: 'oauth_access_tokens',
+  primaryKey: 'id',
+  autoIncrement: true,
+
+  traits: {
+    useTimestamps: true,
+    // Deliberately no `useApi`.
+    //
+    // Minting and revoking both have semantics a generic CRUD route does not
+    // carry. `createToken` returns the plaintext exactly once, so a generic
+    // `store` would write a row nobody holds the token for; and revocation has
+    // to take the paired refresh token with it (stacksjs/stacks#2306), which a
+    // row delete does not. `@stacksjs/auth` owns both operations.
+    //
+    // It also keeps the write surface honest: row scoping compares ONE field,
+    // and this table's owner is a `tokenable_type` / `tokenable_id` pair - so a
+    // generated `destroy` scoped to `tokenable_id` alone would let a user
+    // destroy an author's token whenever the two ids happened to match.
+  },
+
+  /**
+   * Rows belong to whoever the pair names. Declared even with no generated
+   * routes, so adding `useApi` later cannot ship an unscoped write by omission
+   * (stacksjs/stacks#2375) - though see the note above about the one field this
+   * can express.
+   */
+  ownership: selfOwnership('tokenable_id'),
+
+  // No `belongsTo`: the owner is polymorphic. `tokenable_type` names the
+  // owner's table, so a users-only foreign key would be a claim the column no
+  // longer makes - and the FK preflight reported exactly that once the legacy
+  // `user_id` stopped being the owner.
+  attributes: {
+    /**
+     * The owner: the table it lives in, and its id there.
+     *
+     * Declared so the generated row type carries them. They are written by
+     * `@stacksjs/auth` when a token is minted and never by a caller, so both
+     * are guarded - an owner a request could set is an owner a request could
+     * change.
+     */
+    tokenableType: {
+      order: 1,
+      guarded: true,
+      validation: {
+        rule: schema.string().max(255),
+      },
+      factory: () => 'users',
+    },
+
+    tokenableId: {
+      order: 2,
+      guarded: true,
+      validation: {
+        rule: schema.number(),
+      },
+      factory: () => 1,
+    },
+
+    name: {
+      order: 3,
+      fillable: true,
+      validation: {
+        rule: schema.string().max(255),
+      },
+      factory: faker => `${faker.hacker.noun()}-token`,
+    },
+
+    token: {
+      order: 4,
+      // The stored hash. Never serialised, never mass-assignable.
+      hidden: true,
+      guarded: true,
+      validation: {
+        rule: schema.string(),
+      },
+    },
+
+    scopes: {
+      order: 5,
+      type: 'text',
+      fillable: true,
+      validation: {
+        rule: schema.string(),
+      },
+      factory: () => JSON.stringify(['*']),
+    },
+
+    revoked: {
+      order: 6,
+      fillable: true,
+      default: false,
+      validation: {
+        rule: schema.boolean(),
+      },
+      factory: () => false,
+    },
+
+    expiresAt: {
+      order: 7,
+      fillable: true,
+      validation: {
+        rule: schema.string(),
+      },
+    },
+
+    /**
+     * What the browser called itself, and where it came from.
+     *
+     * So a person can recognise their own sessions on a list well enough to
+     * revoke one. Untrusted - a client chooses the string - which is why
+     * nothing authorises on either.
+     */
+    userAgent: {
+      order: 8,
+      fillable: true,
+      validation: {
+        rule: schema.string().max(255),
+      },
+    },
+
+    ipAddress: {
+      order: 9,
+      fillable: true,
+      validation: {
+        rule: schema.string().max(45),
+      },
+    },
+  },
+} as const)

package/app/Models/User.ts

@@ -66,10 +66,10 @@ export default defineModel({
   hasOne: ['Subscriber', 'Courier', 'Author'],
 
   hasMany: [
-    'PersonalAccessToken',
     'Customer',
     'TeamMember',
   ],
+
   attributes: {
     name: {
       order: 2,

package/app/Models/commerce/CartItem.ts

@@ -16,10 +16,10 @@ export default defineModel({
     useUuid: true,
     useTimestamps: true,
     useSearch: {
-      displayable: ['id', 'cartId', 'productId', 'quantity', 'unitPrice', 'totalPrice'],
-      searchable: ['id', 'cartId', 'productId'],
+      displayable: ['id', 'cartId', 'productName', 'productSku', 'quantity', 'unitPrice', 'totalPrice'],
+      searchable: ['id', 'cartId', 'productName', 'productSku'],
       sortable: ['createdAt', 'updatedAt', 'quantity', 'unitPrice'],
-      filterable: ['cartId', 'productId'],
+      filterable: ['cartId', 'productSku'],
     },
 
     useSeeder: {

package/app/Models/commerce/Payment.ts

@@ -16,10 +16,10 @@ export default defineModel({
     useUuid: true,
     useTimestamps: true,
     useSearch: {
-      displayable: ['id', 'orderId', 'customerId', 'amount', 'method', 'status', 'date'],
+      displayable: ['id', 'orderId', 'customerId', 'amount', 'method', 'status', 'createdAt'],
       searchable: ['orderId', 'customerId', 'referenceNumber'],
       sortable: ['amount', 'createdAt'],
-      filterable: ['method', 'status', 'date'],
+      filterable: ['method', 'status', 'createdAt'],
     },
 
     useSeeder: {

package/app/Models/commerce/WaitlistProduct.ts

@@ -16,9 +16,9 @@ export default defineModel({
     useUuid: true,
     useTimestamps: true,
     useSearch: {
-      displayable: ['id', 'name', 'email', 'phone', 'partySize', 'notificationPreference', 'source', 'notes', 'status'],
+      displayable: ['id', 'name', 'email', 'phone', 'quantity', 'notificationPreference', 'source', 'notes', 'status'],
       searchable: ['name', 'email', 'phone', 'source'],
-      sortable: ['name', 'partySize', 'createdAt', 'updatedAt', 'status'],
+      sortable: ['name', 'quantity', 'createdAt', 'updatedAt', 'status'],
       filterable: ['notificationPreference', 'source', 'status'],
     },
 

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.29",
+  "version": "0.74.31",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.29",
+  "version": "0.74.31",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.29",
+    "@stacksjs/mobile": "^0.74.31",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }