@stacksjs/defaults 0.75.16 → 0.75.18

package/ai/skills/stacks-security/SKILL.md

@@ -77,9 +77,7 @@ bcryptEncode(value, rounds?)     // bcrypt hash
 bcryptVerify(value, hash)        // bcrypt verify
 argon2Encode(value, options?)    // argon2 hash
 argon2Verify(value, hash)        // argon2 verify
-md5Encode(value)                  // MD5 (legacy only)
 base64Encode(value)               // base64
-base64Verify(value, encoded)      // base64 compare
 ```
 
 ## HashMakeOptions
@@ -124,6 +122,7 @@ interface HashMakeOptions {
 - APP_KEY is used for `encrypt()`/`decrypt()` — generate via `buddy key:generate`
 - APP_KEY format is colon-separated (validated during deployment)
 - Argon2 requires more memory/time but is more resistant to GPU attacks
-- `md5Encode()` exists for legacy compatibility only — never use for passwords
+- Base64 is encoding, not hashing. Never use `base64Encode()` for credentials.
+- MD5 and base64 password verification are intentionally absent from the main security API.
 - The firewall config is used by cloud deployment for WAF rules
 - Rate limiting is per-minute per-IP (500 default)

package/ide/cursor/rules/readme.mdc

@@ -309,7 +309,7 @@ Convention over configuration, while staying wholly configurable. _No more boile
 - 🔤 **Spell Checker** _be notified once there are typos_
 - 🛠️ **Essential Utilities** _powers at your fingertips. Collections, STX composables, and more_
 - 👥 **Team Management** _manage your team & their permissions_
-- 🧪 **Streamlined Testing** _unit & e2e tests powered by Bun, Vitest & Playwright_
+- 🧪 **Streamlined Testing** _unit, feature & component tests powered by Bun & very-happy-dom_
 
 No matter whether you are a beginner or an expert, the approachable Stacks design allows you to learn at your own pace, using our thorough documentation covering every aspect of the framework. Stacks is extremely beginner & expert-friendly.
 

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.16",
+  "version": "0.75.18",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.16",
+  "version": "0.75.18",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.75.16",
+    "@stacksjs/mobile": "^0.75.18",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/resources/plugins/preloader.ts

@@ -6,6 +6,49 @@
  * automatically be injected into the Bun process.
  */
 
+/**
+ * Every global the runtime defined before this file assigned any.
+ *
+ * Taken first, at module load, because the auto-import loops below write
+ * framework exports onto globalThis, and a name the runtime already owns must
+ * never be one of them. A hand-kept list of such names is how `Worker` slipped
+ * through: `@stacksjs/queue` exports a queue `Worker`, it replaced Bun's Web
+ * Worker in every Stacks process, and anything calling `new Worker(url)` built
+ * a queue worker instead - stx's image warm-up failed silently, an app's own
+ * syntax-highlighter worker broke. `reportError` from `@stacksjs/validation`
+ * was overwriting the web `reportError` the same way.
+ */
+const HOST_GLOBALS: ReadonlySet<string> = new Set(Object.getOwnPropertyNames(globalThis))
+
+/**
+ * Names never auto-imported onto globalThis, even when the runtime does not
+ * define them: another runtime's globals (`window`, `Deno`), module-scope
+ * bindings (`require`, `__dirname`), and the ones listed long before the
+ * snapshot above existed, kept so nothing that relied on them changes.
+ */
+const RESERVED_GLOBALS: ReadonlySet<string> = new Set([
+  'process', 'globalThis', 'global', 'window', 'self',
+  'console', 'require', 'module', 'exports', '__dirname', '__filename',
+  'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval',
+  'setImmediate', 'clearImmediate', 'queueMicrotask',
+  'fetch', 'Request', 'Response', 'Headers', 'URL', 'URLSearchParams',
+  'TextEncoder', 'TextDecoder', 'Blob', 'File', 'FormData',
+  'crypto', 'performance', 'navigator', 'location',
+  'Promise', 'Symbol', 'Proxy', 'Reflect', 'WeakMap', 'WeakSet', 'Map', 'Set',
+  'Array', 'Object', 'String', 'Number', 'Boolean', 'Date', 'RegExp', 'Error',
+  'JSON', 'Math', 'Intl', 'eval', 'isNaN', 'isFinite', 'parseInt', 'parseFloat',
+  'encodeURI', 'encodeURIComponent', 'decodeURI', 'decodeURIComponent',
+  'Bun', 'Deno', 'Node',
+])
+
+/**
+ * Whether an auto-import must leave `name` alone: the runtime already defines
+ * it, or it is reserved. `hostGlobals` is injectable for tests.
+ */
+export function isProtectedGlobal(name: string, hostGlobals: ReadonlySet<string> = HOST_GLOBALS): boolean {
+  return RESERVED_GLOBALS.has(name) || hostGlobals.has(name)
+}
+
 // Skip preloader for fast CLI commands (e.g. `buddy dev`, `buddy --version`) to
 // maximize startup speed. We must NOT skip when running a server script directly
 // (e.g. `bun --watch storage/framework/core/actions/src/dev/api.ts`) — Bun
@@ -214,22 +257,6 @@ export async function loadAutoImports() {
   const path = await import('../../../core/path/src/index.ts')
     .catch(() => import(pathPackage))
 
-  // CRITICAL: Never overwrite these built-in globals
-  const protectedGlobals = new Set([
-    'process', 'globalThis', 'global', 'window', 'self',
-    'console', 'require', 'module', 'exports', '__dirname', '__filename',
-    'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval',
-    'setImmediate', 'clearImmediate', 'queueMicrotask',
-    'fetch', 'Request', 'Response', 'Headers', 'URL', 'URLSearchParams',
-    'TextEncoder', 'TextDecoder', 'Blob', 'File', 'FormData',
-    'crypto', 'performance', 'navigator', 'location',
-    'Promise', 'Symbol', 'Proxy', 'Reflect', 'WeakMap', 'WeakSet', 'Map', 'Set',
-    'Array', 'Object', 'String', 'Number', 'Boolean', 'Date', 'RegExp', 'Error',
-    'JSON', 'Math', 'Intl', 'eval', 'isNaN', 'isFinite', 'parseInt', 'parseFloat',
-    'encodeURI', 'encodeURIComponent', 'decodeURI', 'decodeURIComponent',
-    'Bun', 'Deno', 'Node',
-  ])
-
   // 1. Load Stacks framework packages into globalThis
   const stacksPackages = [
     '@stacksjs/actions',
@@ -275,8 +302,8 @@ export async function loadAutoImports() {
     try {
       const module = await import(pkg)
       for (const [name, value] of Object.entries(module)) {
-        // Skip default exports and protected globals
-        if (name === 'default' || protectedGlobals.has(name)) continue
+        // Skip default exports and anything the runtime already owns
+        if (name === 'default' || isProtectedGlobal(name)) continue
         if (typeof value !== 'undefined') {
           Reflect.set(globalThis, name, value)
         }
@@ -295,8 +322,8 @@ export async function loadAutoImports() {
     try {
       const module = await import(file)
       for (const [name, value] of Object.entries(module)) {
-        // Skip default exports and protected globals
-        if (name === 'default' || protectedGlobals.has(name)) continue
+        // Skip default exports and anything the runtime already owns
+        if (name === 'default' || isProtectedGlobal(name)) continue
         if (typeof value !== 'undefined') {
           Reflect.set(globalThis, name, value)
         }
@@ -326,7 +353,7 @@ export async function loadAutoImports() {
         if (file.endsWith('.d.ts') || file.endsWith('/index.ts')) continue
 
         const modelName = file.split('/').pop()?.replace('.ts', '') || ''
-        if (!modelName || loadedModels.has(modelName) || protectedGlobals.has(modelName)) continue
+        if (!modelName || loadedModels.has(modelName) || isProtectedGlobal(modelName)) continue
 
         try {
           const module = await import(file)
@@ -357,7 +384,7 @@ export async function loadAutoImports() {
       if (file.endsWith('.d.ts') || file.endsWith('/index.ts')) continue
 
       const jobName = file.split('/').pop()?.replace('.ts', '') || ''
-      if (!jobName || loadedJobs.has(jobName) || protectedGlobals.has(jobName)) continue
+      if (!jobName || loadedJobs.has(jobName) || isProtectedGlobal(jobName)) continue
 
       try {
         const module = await import(file)
@@ -392,7 +419,7 @@ export async function loadAutoImports() {
         if (file.endsWith('.d.ts') || file.endsWith('/index.ts')) continue
 
         const controllerName = file.split('/').pop()?.replace('.ts', '') || ''
-        if (!controllerName || loadedControllers.has(controllerName) || protectedGlobals.has(controllerName)) continue
+        if (!controllerName || loadedControllers.has(controllerName) || isProtectedGlobal(controllerName)) continue
 
         try {
           const module = await import(file)

package/resources/views/auth/oauth/consent.stx

@@ -0,0 +1,134 @@
+<script server>
+import type { OAuthAuthorizationConsentView } from '@stacksjs/auth'
+
+/**
+ * The default OAuth consent screen. Applications may replace this file at
+ * `resources/views/auth/oauth/consent.stx` without changing the provider.
+ *
+ * The action supplies display-only identity labels and the consent model. The
+ * form returns only middleware-owned CSRF proof, the opaque request handle,
+ * and the user's decision. Client callback, PKCE, subject, and workspace
+ * authority remain in the server-side authorization-request record.
+ */
+declare const consent: OAuthAuthorizationConsentView
+declare const signedInIdentity: string
+declare const selectedWorkspace: string | null
+declare const consentAction: string
+declare const csrfToken: string
+
+const clientTypeLabel = consent.client.type === 'public' ? 'Public client' : 'Confidential client'
+</script>
+
+<main class="flex min-h-dvh items-center justify-center bg-neutral-50 px-4 py-10 text-neutral-950 dark:bg-neutral-950 dark:text-white sm:px-6">
+  <section class="w-full max-w-xl" aria-labelledby="oauth-consent-title">
+    <div class="mb-5 flex items-center justify-center gap-2 text-neutral-500 text-sm dark:text-neutral-400">
+      <i class="h-5 w-5 i-hugeicons-shield-key" aria-hidden="true"></i>
+      <span>Secure authorization</span>
+    </div>
+
+    <div class="overflow-hidden border border-neutral-200 rounded-2xl bg-white shadow-sm dark:border-neutral-800 dark:bg-neutral-900">
+      <header class="border-neutral-200 border-b px-6 py-6 dark:border-neutral-800 sm:px-8">
+        <p class="font-medium text-neutral-500 text-sm dark:text-neutral-400">Authorization request</p>
+        <h1 id="oauth-consent-title" class="mt-2 font-semibold text-2xl tracking-tight sm:text-3xl">
+          {{ consent.client.name }} wants to connect
+        </h1>
+        <p class="mt-3 text-neutral-600 text-sm leading-6 dark:text-neutral-300">
+          Review exactly what this application can access before you continue.
+        </p>
+      </header>
+
+      <div class="space-y-7 px-6 py-6 sm:px-8">
+        <dl class="grid gap-4 rounded-xl bg-neutral-50 p-4 dark:bg-neutral-800/60">
+          <div class="flex gap-3 items-start">
+            <i class="mt-0.5 h-5 w-5 shrink-0 text-neutral-500 i-hugeicons-user-circle dark:text-neutral-400" aria-hidden="true"></i>
+            <div>
+              <dt class="font-medium text-neutral-500 text-xs tracking-wide uppercase dark:text-neutral-400">Signed in as</dt>
+              <dd class="mt-1 font-medium text-neutral-900 text-sm dark:text-white">{{ signedInIdentity }}</dd>
+            </div>
+          </div>
+
+          @if (selectedWorkspace)
+            <div class="flex gap-3 items-start">
+              <i class="mt-0.5 h-5 w-5 shrink-0 text-neutral-500 i-hugeicons-building-03 dark:text-neutral-400" aria-hidden="true"></i>
+              <div>
+                <dt class="font-medium text-neutral-500 text-xs tracking-wide uppercase dark:text-neutral-400">Workspace</dt>
+                <dd class="mt-1 font-medium text-neutral-900 text-sm dark:text-white">{{ selectedWorkspace }}</dd>
+              </div>
+            </div>
+          @endif
+
+          <div class="flex gap-3 items-start">
+            <i class="mt-0.5 h-5 w-5 shrink-0 text-neutral-500 i-hugeicons-computer-programming-01 dark:text-neutral-400" aria-hidden="true"></i>
+            <div>
+              <dt class="font-medium text-neutral-500 text-xs tracking-wide uppercase dark:text-neutral-400">Application type</dt>
+              <dd class="mt-1 font-medium text-neutral-900 text-sm dark:text-white">{{ clientTypeLabel }}</dd>
+            </div>
+          </div>
+        </dl>
+
+        <section aria-labelledby="oauth-permissions-title">
+          <h2 id="oauth-permissions-title" class="font-semibold text-base">Permissions requested</h2>
+          <ul class="mt-3 divide-y divide-neutral-200 border border-neutral-200 rounded-xl dark:divide-neutral-800 dark:border-neutral-800">
+            @foreach (consent.permissions as permission)
+              <li class="flex gap-3 px-4 py-4 items-start">
+                <i class="mt-0.5 h-5 w-5 shrink-0 text-emerald-600 i-hugeicons-key-01 dark:text-emerald-400" aria-hidden="true"></i>
+                <div>
+                  <p class="font-medium text-neutral-900 text-sm dark:text-white">{{ permission.description }}</p>
+                  <p class="mt-1 font-mono text-neutral-500 text-xs dark:text-neutral-400">{{ permission.name }}</p>
+                </div>
+              </li>
+            @endforeach
+          </ul>
+        </section>
+
+        @if (consent.resources.length)
+          <section aria-labelledby="oauth-resources-title">
+            <h2 id="oauth-resources-title" class="font-semibold text-base">Data access</h2>
+            <ul class="mt-3 space-y-2">
+              @foreach (consent.resources as resource)
+                <li class="flex gap-3 rounded-xl bg-neutral-50 px-4 py-3 items-start dark:bg-neutral-800/60">
+                  <i class="mt-0.5 h-5 w-5 shrink-0 text-neutral-500 i-hugeicons-database-02 dark:text-neutral-400" aria-hidden="true"></i>
+                  <div>
+                    <p class="font-medium text-neutral-900 text-sm dark:text-white">{{ resource.name }}</p>
+                    @if (resource.description)
+                      <p class="mt-1 text-neutral-600 text-sm leading-5 dark:text-neutral-300">{{ resource.description }}</p>
+                    @endif
+                  </div>
+                </li>
+              @endforeach
+            </ul>
+          </section>
+        @endif
+
+        <p class="rounded-xl border border-amber-200 bg-amber-50 px-4 py-3 text-amber-950 text-sm leading-5 dark:border-amber-900/70 dark:bg-amber-950/40 dark:text-amber-100">
+          Only approve if you recognize this application and trust it with the permissions listed above.
+        </p>
+      </div>
+
+      <form method="POST" action="{{ consentAction }}" class="flex flex-col-reverse gap-3 border-neutral-200 border-t px-6 py-5 dark:border-neutral-800 sm:flex-row sm:justify-end sm:px-8">
+        <input type="hidden" name="_token" value="{{ csrfToken }}">
+        <input type="hidden" name="request_id" value="{{ consent.requestId }}">
+        <button
+          type="submit"
+          name="decision"
+          value="deny"
+          class="inline-flex min-h-11 items-center justify-center rounded-lg border border-neutral-300 px-5 py-2.5 font-semibold text-neutral-800 text-sm hover:bg-neutral-50 focus:outline-none focus:ring-2 focus:ring-neutral-400 focus:ring-offset-2 dark:border-neutral-700 dark:text-neutral-100 dark:hover:bg-neutral-800 dark:focus:ring-offset-neutral-900"
+        >
+          Deny
+        </button>
+        <button
+          type="submit"
+          name="decision"
+          value="approve"
+          class="inline-flex min-h-11 items-center justify-center rounded-lg bg-neutral-950 px-5 py-2.5 font-semibold text-sm text-white hover:bg-neutral-800 focus:outline-none focus:ring-2 focus:ring-neutral-950 focus:ring-offset-2 dark:bg-white dark:text-neutral-950 dark:hover:bg-neutral-200 dark:focus:ring-white dark:focus:ring-offset-neutral-900"
+        >
+          Allow access
+        </button>
+      </form>
+    </div>
+
+    <p class="mt-5 text-center text-neutral-500 text-xs leading-5 dark:text-neutral-400">
+      You can revoke this connection later from your connected applications settings.
+    </p>
+  </section>
+</main>