@stacksjs/defaults 0.74.46 → 0.74.47

package/ai/skills/stacks-commerce/SKILL.md

@@ -122,9 +122,9 @@ if (!result.ok) {
 // result.coupon reflects the post-redemption state.
 ```
 
-`redeem` bumps `usage_count` and enforces `max_uses`, `is_active` and the
+`redeem` bumps `usage_count` and enforces `usage_limit`, `is_active` and the
 start/end dates in the WHERE clause, so the database decides the race. A
-`max_uses` of `NULL` means unlimited. Do not fetch, check and then call
+`usage_limit` of `NULL` means unlimited. Do not fetch, check and then call
 `update()` to increment: that is the exact pattern this replaced.
 
 ### Spending or reloading a gift card

package/ai/skills/stacks-database/SKILL.md

@@ -12,7 +12,7 @@ allowed-tools: Read Edit Write Bash Grep Glob
 - Database package: `storage/framework/core/database/src/`
 - Configuration: `config/database.ts`
 - QB config: `config/query-builder.ts`
-- Migrations: `database/migrations/` (228 migration files, `.sql` format)
+- Migrations: `database/migrations/` (229 migration files, `.sql` format)
 - QB state: `.qb/`
 - ORM: `storage/framework/orm/`
 
@@ -262,6 +262,10 @@ Entity-centric API for single-table design:
     // skips query hooks unless persistent history is explicitly enabled.
     enabled: env.DB_QUERY_LOGGING_ENABLED ?? !['production', 'prod'].includes(env.APP_ENV || ''),
     captureAllTraces: false, // slow and failed queries always keep traces
+    // Bound values in query_logs.bindings, credentials stored as `<redacted>`
+    // (by name and shape, so not every secret); production keeps only each
+    // value's type unless this is enabled. Env takes true/false, 1/0, yes/no, on/off.
+    captureBindings: env.DB_QUERY_LOGGING_CAPTURE_BINDINGS ?? !['production', 'prod'].includes(env.APP_ENV || ''),
     slowThreshold: 100,  // ms
     retention: 7,        // days
     pruneFrequency: 24,  // hours

package/ai/skills/stacks-migrations/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: stacks-migrations
-description: Use when working with database migrations in a Stacks application - creating migration files, running migrations, fresh migration (drop + recreate), seeding after migration, migration file naming conventions, or the 228 built-in migration files. For the database API itself (queries, connections, SQL helpers), see stacks-database.
+description: Use when working with database migrations in a Stacks application - creating migration files, running migrations, fresh migration (drop + recreate), seeding after migration, migration file naming conventions, or the 229 built-in migration files. For the database API itself (queries, connections, SQL helpers), see stacks-database.
 license: MIT
 compatibility: Bun >= 1.3.0, TypeScript, SQLite >= 3.47.2
 allowed-tools: Read Edit Write Bash Grep Glob
@@ -119,6 +119,6 @@ The framework includes migrations for all built-in models:
 - Do not commit a second snapshot under `.qb/`; that indicates a missing `snapshotDir` configuration
 - If a generated SQLite migration rebuilds tables, test it against a copy of the current database and run `PRAGMA integrity_check` plus `PRAGMA foreign_key_check`
 - `--seed` flag after `migrate:fresh` seeds the database with factory data
-- 228 migration files exist by default for all framework models
+- 229 migration files exist by default for all framework models
 - SQLite >= 3.47.2 is required (system requirement)
 - For the database API (queries, connections), see the `stacks-database` skill

package/app/Actions/Auth/LogoutAction.ts

@@ -1,23 +1,26 @@
 import { Action } from '@stacksjs/actions'
-import { Auth, clearAuthCookie } from '@stacksjs/auth'
-import { response } from '@stacksjs/router'
+import { Auth, clearAuthCookie, requestToken } from '@stacksjs/auth'
+import { getCurrentRequest, response } from '@stacksjs/router'
 
 export default new Action({
   name: 'LogoutAction',
   description: 'Logout from the application',
   method: 'POST',
   async handle() {
-    // `Auth.logout()` resolves the token from the Authorization header or the
-    // auth cookie, so this revokes the session either way.
+    const request = getCurrentRequest()
+    const usesDatabaseSession = !requestToken(request) && !!request?.cookie?.('session_id')
     await Auth.logout()
 
     // Clearing is separate from revoking, and both are needed. Revoking alone
     // leaves the browser sending a dead cookie on every request; clearing alone
     // leaves a copied cookie valid for the token's whole lifetime, which would
     // make "log out on a shared computer" mean only "hide the key".
-    return response.json(
+    const result = response.json(
       { message: 'Successfully logged out' },
       { headers: { 'Set-Cookie': clearAuthCookie() } },
     )
+    if (usesDatabaseSession)
+      result.headers.append('Set-Cookie', clearAuthCookie({ name: 'session_id' }))
+    return result
   },
 })

package/app/Actions/Dashboard/Teams/TeamMemberUpdateAction.ts

@@ -1,10 +1,10 @@
 import type { RequestInstance } from '@stacksjs/types'
 import { Action } from '@stacksjs/actions'
-import { db } from '@stacksjs/database'
+import { db, getDatabaseDialect, sqlHelpers } from '@stacksjs/database'
 import { response } from '@stacksjs/router'
-import { TeamStateConflictError, teamOperationalError } from '../../Teams/team-response'
+import { teamOperationalError } from '../../Teams/team-response'
 import { syncTeamMemberCount } from './team-member-count'
-import { changedRows, normalizeInvitationRole, parsePositiveId, sqlTimestamp } from './team-records'
+import { normalizeInvitationRole, parsePositiveId, sqlTimestamp } from './team-records'
 
 interface UpdateInput {
   role?: unknown
@@ -27,12 +27,41 @@ export default new Action({
     try {
       return await db.transaction(async (rawTrx) => {
         const trx = rawTrx as unknown as typeof db
-        const member = await trx
+        /*
+         * Lock the member for the rest of this transaction, then decide.
+         *
+         * This used to read the row unlocked and let the UPDATE's own
+         * `role != 'owner'` predicate catch a concurrent ownership transfer,
+         * treating an affected-row count other than 1 as "changed underneath
+         * us" and answering 409. That count cannot carry the decision: MySQL
+         * reports rows CHANGED, not rows MATCHED, so saving a member with the
+         * role and status they already have reported 0, and a double submit
+         * or any save in the same second as their last write (`sqlTimestamp`
+         * has second precision) came back 409 "The team member changed before
+         * they could be updated" for a member nobody had touched
+         * (stacksjs/stacks#2639).
+         *
+         * With the row locked, nothing can change it between this read and
+         * the write, so the checks below are made against the state the write
+         * will actually land on, and the count is not needed at all. A
+         * concurrent ownership transfer now waits for this transaction and
+         * then applies, instead of racing it. Measured on PostgreSQL 16 and
+         * MySQL 8.4.5: unlocked, a second connection made the member an owner
+         * mid-transaction; locked, it hit its lock timeout.
+         *
+         * SQLite has no `FOR UPDATE` and does not need one: a writer that
+         * commits after this read makes the UPDATE below fail when it tries to
+         * upgrade the transaction, so nothing is silently overwritten there
+         * either. auth/src/tokens.ts takes the same lock the same way.
+         */
+        let lookup = trx
           .selectFrom('team_members')
           .where('id', '=', memberId)
           .where('team_id', '=', teamId)
           .select(['id', 'role', 'status'])
-          .executeTakeFirst()
+        if (!sqlHelpers(getDatabaseDialect()).isSqlite)
+          lookup = lookup.lockForUpdate()
+        const member = await lookup.executeTakeFirst()
         if (!member)
           return response.json({ message: 'Team member not found.' }, 404)
         if (member.role === 'owner')
@@ -45,23 +74,21 @@ export default new Action({
         if (!['active', 'suspended'].includes(status))
           return response.json({ message: 'Choose a valid member status.' }, 422)
 
-        const updated = await trx
+        // The owner predicate stays as a second line of defence; under the
+        // lock it always matches, which is why its count is not read.
+        await trx
           .updateTable('team_members')
           .set({ role, status, updated_at: sqlTimestamp() })
           .where('id', '=', memberId)
           .where('team_id', '=', teamId)
           .where('role', '!=', 'owner')
-          .executeTakeFirst()
-        if (changedRows(updated) !== 1)
-          throw new TeamStateConflictError('The team member changed before they could be updated.')
+          .execute()
 
         await syncTeamMemberCount(teamId, trx)
         return { member: { id: memberId, role, status } }
       })
     }
     catch (error) {
-      if (error instanceof TeamStateConflictError)
-        return response.json({ message: error.message }, 409)
       return teamOperationalError(error, 'The team member could not be updated.', 'TeamMemberUpdateAction', 500)
     }
   },

package/app/Controllers/QueryController.ts

@@ -1,7 +1,43 @@
 import { config } from '@stacksjs/config'
-import { db, sql } from '@stacksjs/database'
+import { db, mutationCount, sql, sqlDateTime } from '@stacksjs/database'
 import { Controller } from '@stacksjs/server'
 
+const DAY_MS = 86_400_000
+/** `2026-09-10T11` - the stored timestamp truncated to its hour. */
+const HOUR_PREFIX = 13
+/** `2026-09-10` - truncated to its day. */
+const DAY_PREFIX = 10
+
+/**
+ * The hour bucket as the dashboard reads it: `2026-09-10 11:00:00`.
+ *
+ * Buckets are prefixes of the stored timestamp rather than the output of a
+ * date function, because `strftime` and `datetime` exist only on SQLite. The
+ * stored format is fixed (see `sqlDateTime`), so a prefix is exact, and the
+ * label is restored here rather than in SQL.
+ */
+function hourLabel(bucket: string): string {
+  return `${String(bucket).replace('T', ' ')}:00:00`
+}
+
+/**
+ * The query type is the first element of the JSON array in `tags`, written by
+ * the query logger. Read here rather than in SQL: the JSON functions differ
+ * per dialect and PostgreSQL has none by these names.
+ */
+function queryTypeFromTags(tags: string | null | undefined): string {
+  if (!tags)
+    return 'unknown'
+  try {
+    const parsed = JSON.parse(tags) as unknown
+    const first = Array.isArray(parsed) ? parsed[0] : undefined
+    return typeof first === 'string' && first ? first : 'unknown'
+  }
+  catch {
+    return 'unknown'
+  }
+}
+
 export default class QueryController extends Controller {
   /**
    * Get query statistics for the dashboard
@@ -14,15 +50,30 @@ export default class QueryController extends Controller {
         .select(db.fn.count('id').as('count'))
         .executeTakeFirstOrThrow()
 
-      // Get counts by query type
-      const queryTypeStats = await db
+      // `tags` is a string column holding a JSON array whose first element is
+      // the query type. Grouping by the whole column keeps this portable:
+      // `json_extract` is SQLite and MySQL only, and PostgreSQL has no such
+      // function, so the previous projection made this endpoint fail there.
+      // The distinct tag sets are few, so folding them by type here is cheap.
+      const tagStats = await db
         .selectFrom('query_logs')
         .select([
-          sql`json_extract(tags, "$[0]")`.as('type'),
+          'tags',
           db.fn.count('id').as('count'),
+          db.fn.avg('duration').as('avg_duration'),
         ])
-        .groupBy(sql`json_extract(tags, "$[0]")`)
-        .execute()
+        .groupBy('tags')
+        .execute() as Array<{ tags: string | null, count: number | string, avg_duration: number | string | null }>
+
+      const byType = new Map<string, { count: number, durationTotal: number }>()
+      for (const row of tagStats) {
+        const type = queryTypeFromTags(row.tags)
+        const count = Number(row.count) || 0
+        const entry = byType.get(type) ?? { count: 0, durationTotal: 0 }
+        entry.count += count
+        entry.durationTotal += Number(row.avg_duration ?? 0) * count
+        byType.set(type, entry)
+      }
 
       // Get counts by status
       const statusStats = await db
@@ -31,35 +82,31 @@ export default class QueryController extends Controller {
         .groupBy('status')
         .execute()
 
-      // Get average duration by query type
-      const durationStats = await db
-        .selectFrom('query_logs')
-        .select([
-          sql`json_extract(tags, "$[0]")`.as('type'),
-          db.fn.avg('duration').as('avg_duration'),
-        ])
-        .groupBy(sql`json_extract(tags, "$[0]")`)
-        .execute()
-
       // Get count of slow queries over time (last 24 hours)
       const slowQueriesTimeline = await db
         .selectFrom('query_logs')
         .select([
-          sql`strftime("%Y-%m-%d %H:00:00", executed_at)`.as('hour'),
+          sql`substr(executed_at, 1, 13)`.as('hour'),
           db.fn.count('id').as('count'),
         ])
         .where('status', '=', 'slow')
-        .whereRaw(sql`executed_at >= datetime("now", "-1 day")`)
-        .groupBy(sql`strftime("%Y-%m-%d %H:00:00", executed_at)`)
+        .where('executed_at', '>=', sqlDateTime(new Date(Date.now() - 86_400_000)))
+        .groupBy('hour')
         .orderBy('hour')
-        .execute()
+        .execute() as Array<{ hour: string, count: number | string }>
 
       return {
         totalQueries: totalQueries.count,
-        byType: queryTypeStats,
+        byType: [...byType].map(([type, entry]) => ({ type, count: entry.count })),
         byStatus: statusStats,
-        avgDuration: durationStats,
-        slowQueriesTimeline,
+        avgDuration: [...byType].map(([type, entry]) => ({
+          type,
+          avg_duration: entry.count === 0 ? 0 : entry.durationTotal / entry.count,
+        })),
+        slowQueriesTimeline: slowQueriesTimeline.map(row => ({
+          hour: hourLabel(row.hour),
+          count: Number(row.count) || 0,
+        })),
         // Include system settings for reference
         settings: {
           slowThreshold: config.database?.queryLogging?.slowThreshold || 100,
@@ -278,38 +325,43 @@ export default class QueryController extends Controller {
     type = 'all',
   }) {
     try {
-      let interval: string
-      let timeConstraint: string
+      let bucketWidth: number
+      let windowMs: number
 
-      // Set time grouping format and constraint based on timeframe
+      // Set the bucket width and how far back to look, per timeframe.
       switch (timeframe) {
         case 'week':
-          interval = '%Y-%m-%d'
-          timeConstraint = '-7 day'
+          bucketWidth = DAY_PREFIX
+          windowMs = 7 * DAY_MS
           break
         case 'month':
-          interval = '%Y-%m-%d'
-          timeConstraint = '-30 day'
+          bucketWidth = DAY_PREFIX
+          windowMs = 30 * DAY_MS
           break
         case 'day':
         default:
-          interval = '%Y-%m-%d %H:00:00'
-          timeConstraint = '-24 hour'
+          bucketWidth = HOUR_PREFIX
+          windowMs = DAY_MS
           break
       }
 
       let query = db
         .selectFrom('query_logs')
         .select([
-          // `interval` and `timeConstraint` are chosen from the fixed set a
-          // few lines above, never from the request, so interpolating them
-          // into the fragment is safe. `sql.literal` does not exist on this
-          // tag, which is what made this a type error.
-          sql`strftime('${interval}', executed_at)`.as('time_interval'),
+          // Timestamps are stored in one canonical format, so the bucket is a
+          // prefix of the stored text: 13 characters for an hour, 10 for a
+          // day. `strftime` and `datetime` are SQLite-only, and the value in
+          // `sql`...`` was interpolated as a quoted `'${interval}'`, which the
+          // tag rendered as a literal `'?'`, so this returned nothing at all,
+          // on every dialect.
+          // Two fixed fragments rather than one interpolated width: a value
+          // inside the tag is bound as a parameter, and a parameter here
+          // throws the builder's own count off.
+          (bucketWidth === HOUR_PREFIX ? sql`substr(executed_at, 1, 13)` : sql`substr(executed_at, 1, 10)`).as('time_interval'),
           db.fn.count('id').as('count'),
           db.fn.avg('duration').as('avg_duration'),
         ])
-        .whereRaw(sql`executed_at >= datetime("now", '${timeConstraint}')`)
+        .where('executed_at', '>=', sqlDateTime(new Date(Date.now() - windowMs)))
         .groupBy('time_interval')
         .orderBy('time_interval')
 
@@ -317,10 +369,13 @@ export default class QueryController extends Controller {
       if (type !== 'all')
         query = query.where('tags', 'like', `%"${type}"%`)
 
-      const results = await query.execute()
+      const results = await query.execute() as Array<{ time_interval: string, count: number | string, avg_duration: number | string | null }>
 
       return {
-        data: results,
+        data: results.map(row => ({
+          ...row,
+          time_interval: bucketWidth === HOUR_PREFIX ? hourLabel(row.time_interval) : row.time_interval,
+        })),
         meta: {
           timeframe,
           type,
@@ -397,16 +452,23 @@ export default class QueryController extends Controller {
     try {
       const retentionDays = config.database?.queryLogging?.retention || 7
 
-      // Parameterized via db.unsafe: the delete builder can neither
-      // bind a datetime() expression nor render raw WHERE fragments.
-      const statement = await (db as any).unsafe(
-        `DELETE FROM query_logs WHERE executed_at < datetime("now", ?)`,
-        [`-${retentionDays} day`],
-      )
-      const result = typeof statement?.execute === 'function' ? await statement.execute() : statement
+      // The cutoff is computed here rather than in SQL. `datetime("now", ?)`
+      // is SQLite syntax, so this statement was a syntax error on PostgreSQL
+      // and MySQL and pruned nothing there. It was not right on SQLite either:
+      // `datetime()` renders `2026-09-10 11:00:00` while the logger writes
+      // `sqlDateTime()`'s `2026-09-10T11:00:00.000`, and comparing those as
+      // text keeps rows up to a day past their retention, because 'T' > ' '.
+      // A bound cutoff in the stored format compares correctly everywhere.
+      const cutoff = sqlDateTime(new Date(Date.now() - retentionDays * 86_400_000))
+      const result = await db
+        .deleteFrom('query_logs')
+        .where('executed_at', '<', cutoff)
+        .executeTakeFirst()
 
       return {
-        pruned: Number(result?.changes ?? result?.numDeletedRows ?? 0),
+        // Each driver names the affected-row count differently, and the pair
+        // read here covered only SQLite.
+        pruned: mutationCount(result),
         retentionDays,
       }
     }

package/app/Models/Content/Categorizable.ts

@@ -14,6 +14,24 @@ export default defineModel({
     { name: 'categorizables_type_slug_unique', columns: ['categorizable_type', 'slug'], unique: true },
     { name: 'categorizables_owner_slug_unique', columns: ['categorizable_type', 'categorizable_id', 'slug'], unique: true },
   ],
+  // The inverse of Post.belongsToMany.categories, mirroring Tag.belongsToMany.posts.
+  // It lives here because this model owns the ids `category_id` stores, and the
+  // declaring model's table is what the generator references for `foreignKey`.
+  belongsToMany: {
+    posts: {
+      model: 'Post',
+      table: 'categorizable_models',
+      foreignKey: 'category_id',
+      relatedKey: 'categorizable_id',
+      pivot: {
+        columns: {
+          categorizable_type: { default: 'posts' },
+        },
+        timestamps: true,
+        uniques: [['category_id', 'categorizable_id', 'categorizable_type']],
+      },
+    },
+  },
   attributes: {
     name: {
       required: true,

package/app/Models/commerce/Category.ts

@@ -41,21 +41,12 @@ export default defineModel({
   },
 
   hasMany: ['Product'],
-  belongsToMany: {
-    posts: {
-      model: 'Post',
-      table: 'categorizable_models',
-      foreignKey: 'category_id',
-      relatedKey: 'categorizable_id',
-      pivot: {
-        columns: {
-          categorizable_type: { default: 'posts' },
-        },
-        timestamps: true,
-        uniques: [['category_id', 'categorizable_id', 'categorizable_type']],
-      },
-    },
-  },
+
+  // No `belongsToMany.posts` here. Post categories live in the CMS pivot
+  // `categorizable_models`, whose `category_id` holds `categorizables` ids, so
+  // the inverse belongs on Categorizable. Declaring it on this model made the
+  // generator emit `category_id REFERENCES "categories"`, which rejected every
+  // CMS category link once foreign keys were enforced (stacksjs/stacks#2593).
 
   attributes: {
     name: {

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.46",
+  "version": "0.74.47",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",
@@ -74,6 +74,6 @@
     "streetsidesoftware.code-spell-checker"
   ],
   "devDependencies": {
-    "@vscode/vsce": "^3.7.2-12"
+    "@vscode/vsce": "^4.0.0"
   }
 }

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.46",
+  "version": "0.74.47",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.46",
+    "@stacksjs/mobile": "^0.74.47",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/routes/dashboard-api.ts

@@ -16,6 +16,7 @@
  * unauthenticated.
  */
 
+import { isLocalDeployment } from '@stacksjs/env'
 import { route } from '@stacksjs/router'
 
 // The `/api/dashboard/*` surface is unauthenticated by design for the local
@@ -25,8 +26,15 @@ import { route } from '@stacksjs/router'
 // (assign-any-role-to-any-user = privilege escalation) and the model-row dump
 // (arbitrary DB read) — must be gated server-side. In a local/dev/test env the
 // guard is a no-op so the dev dashboard keeps working without a token.
-const APP_ENV = (process.env.APP_ENV ?? process.env.NODE_ENV ?? '').toLowerCase()
-const IS_LOCAL_ENV = APP_ENV === '' || APP_ENV === 'local' || APP_ENV === 'development' || APP_ENV === 'dev' || APP_ENV === 'test' || APP_ENV === 'testing'
+//
+// The gate is the deployment, not the environment NAME. `.env.example` ships
+// `APP_ENV=development`, so every app that never edited that line called
+// itself development in production - and this gate then attached no
+// middleware at all to the 300-plus routes below, including the ones that
+// read and rewrite the project's `.env`, write the deploy script, sync RBAC
+// roles and dump arbitrary model rows. `@stacksjs/auth`'s cookie policy hit
+// the same shape in stacksjs/stacks#2275 and moved to the URL; this follows.
+const IS_LOCAL_ENV = isLocalDeployment()
 
 // Apply auth + admin-role middleware to a sensitive route outside local envs.
 // Returns the route builder so calls read as `guard(route.post(...))`.

package/routes/dashboard.ts

@@ -15,7 +15,7 @@
  * ```
  */
 
-import process from 'node:process'
+import { isLocalDeployment } from '@stacksjs/env'
 import { route } from '@stacksjs/router'
 
 // ============================================================================
@@ -86,8 +86,10 @@ route.health()
 // Apps that intentionally want either route in production can
 // re-register the path in `routes/api.ts` — user routes load first,
 // so their copy wins.
-const APP_ENV = (process.env.APP_ENV ?? process.env.NODE_ENV ?? '').toLowerCase()
-const IS_LOCAL_ENV = APP_ENV === '' || APP_ENV === 'local' || APP_ENV === 'development' || APP_ENV === 'dev' || APP_ENV === 'test' || APP_ENV === 'testing'
+// Same rule as dashboard-api.ts: a deployment is local when its URL says so.
+// The environment name alone sent these two to production in any app whose
+// `.env` still carried the `APP_ENV=development` that `.env.example` ships.
+const IS_LOCAL_ENV = isLocalDeployment()
 
 if (IS_LOCAL_ENV) {
   route.get('/install', 'Actions/InstallAction')