@stacksjs/defaults 0.75.14 → 0.75.16

package/ai/skills/stacks-analytics/SKILL.md

@@ -35,8 +35,9 @@ const head = getAnalyticsHead(analytics)
 ```
 
 The registry is loud on purpose. A `driver` value with no implementation throws,
-and so does a driver that is selected but missing its config (the message names
-the exact key to set). Only an app with no `driver` at all gets an empty result.
+and so does a selected third-party driver missing its config (the message names
+the exact key to set). An app with no `driver` defaults to AnalyticsHQ. It emits
+nothing until `drivers.analyticshq.siteId` is set.
 
 Nothing injects the script for you - a framework that silently posted pageviews
 to a third party would be the wrong default. Render it yourself in the layout
@@ -142,9 +143,9 @@ interface SelfHostedConfig {
 
 ```typescript
 {
-  driver: 'fathom',              // 'fathom' | 'plausible' | 'google-analytics' | 'self-hosted' | 'analyticshq'
+  driver: 'analyticshq',         // 'analyticshq' | 'fathom' | 'plausible' | 'google-analytics' | 'self-hosted'
   drivers: {
-    analyticshq: { siteId: '' },
+    analyticshq: { siteId: '' }, // empty means no tracking tags
     googleAnalytics: { trackingId: '' },
     fathom: { siteId: '' },
     plausible: { domain: '' },
@@ -169,7 +170,8 @@ Analytics dashboard at `/dashboard/analytics` displays:
 
 ## Gotchas
 - Selecting a driver does not inject anything - call `generateAnalyticsScript()` in your layout
-- A misconfigured driver throws rather than emitting nothing; the message names the config key
+- A misconfigured third-party driver throws rather than emitting nothing; the message names the config key
+- AnalyticsHQ is the first-party default and emits nothing until its site id is set
 - `honorDnt: true` respects browser Do Not Track settings
 - Attribute values are escaped, and inline script values are JS-escaped, to prevent XSS
 - Fathom is a paid service - self-hosted is free but requires infrastructure

package/ai/skills/stacks-auth/SKILL.md

@@ -75,7 +75,8 @@ The `PersonalAccessToken` model maps the same table, so `owner.with('tokenable')
 lists exactly what `createToken` minted. It deliberately generates no CRUD
 routes: minting and revoking both carry semantics a generic route does not.
 - `Auth.once(credentials: AuthCredentials): Promise<boolean>` — one-time auth without token
-- `Auth.requestToken(credentials, clientId, clientSecret): Promise<{ token } | null>` — OAuth token request
+- `Auth.requestUserTokenWithClient(credentials, clientId, clientSecret): Promise<{ token } | null>` authenticates both a legacy OAuth client and an end user password, then issues a user token. It is not the client credentials grant.
+- `Auth.requestToken(...)` is the deprecated compatibility alias for that same legacy exchange. New delegated integrations use the authorization-code provider.
 
 ### User State
 - `Auth.user(): Promise<UserModel | undefined>` — get authenticated user from bearer token
@@ -155,6 +156,19 @@ routes: minting and revoking both carry semantics a generic route does not.
 - `createClient(options: CreateClientOptions): Promise<CreateClientResult>`
 - `revokeClient(clientId): Promise<void>`
 
+### OAuth Provider and PKCE
+
+The authorization server is opt-in through `config/auth.ts` under
+`oauthProvider`. It is separate from social sign-in, where Stacks is the OAuth
+client. The provider profile is Authorization Code with S256 PKCE and rotating
+refresh tokens. It does not support implicit or password grants.
+
+- `resolveOAuthProviderConfig(options)` returns `null` unless explicitly enabled
+- `generatePkceVerifier()` creates a 256-bit RFC 7636 verifier
+- `createS256CodeChallenge(verifier)` derives its S256 challenge
+- `verifyS256CodeChallenge(verifier, challenge)` validates without a plain fallback
+- `isValidPkceVerifier(value)` checks the required 43 to 128 character syntax
+
 ## Two-Factor Authentication (authenticator.ts)
 
 - `generateTwoFactorSecret(): string`

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.14",
+  "version": "0.75.16",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.14",
+  "version": "0.75.16",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.75.14",
+    "@stacksjs/mobile": "^0.75.16",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/resources/views/errors/tester.stx

@@ -8,10 +8,19 @@
  */
 import { isLocalDeployment } from '@stacksjs/env'
 
+/*
+ * Handed in by TestErrorAction's renderTemplate call, which spreads its
+ * `context` into the template scope - there is no `context` variable here.
+ * Undefined when the view fallback serves this file on its own. Read into a
+ * differently named list: a local `const scenarios = ...` shadows the injected
+ * one and the page lists nothing.
+ */
+declare const scenarios: Array<{ title: string, description: string, status: number, href: string }> | undefined
+
 if (!isLocalDeployment())
   notFound()
 
-const scenarios = typeof context !== 'undefined' && Array.isArray(context?.scenarios) ? context.scenarios : []
+const scenarioList = typeof scenarios !== 'undefined' && Array.isArray(scenarios) ? scenarios : []
 </script>
 
 <div class="mx-auto px-6 py-12 max-w-3xl">
@@ -21,7 +30,7 @@ const scenarios = typeof context !== 'undefined' && Array.isArray(context?.scena
   </p>
 
   <div class="grid gap-3">
-    @foreach(scenarios as scenario)
+    @foreach(scenarioList as scenario)
     <a
       href="{{ scenario.href }}"
       class="block p-4 bg-white dark:bg-white/[2%] border border-neutral-200 rounded-lg dark:border-white/10 hover:border-rose-500 transition-colors"