@stacksjs/defaults 0.75.162 → 0.75.164

package/ai/skills/stacks-native/CATALOG.md

@@ -78,7 +78,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/router` | [`stacks-router`](../stacks-router/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/index.ts) | 87 |
 | `@stacksjs/scheduler` | [`stacks-scheduler`](../stacks-scheduler/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/scheduler/src/index.ts) | 13 |
 | `@stacksjs/search-engine` | [`stacks-search-engine`](../stacks-search-engine/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/search-engine/src/index.ts) | 10 |
-| `@stacksjs/security` | [`stacks-security`](../stacks-security/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/index.ts) | 5 |
+| `@stacksjs/security` | [`stacks-security`](../stacks-security/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/index.ts) | 8 |
 | `@stacksjs/server` | [`stacks-server`](../stacks-server/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/server/src/index.ts) | 21 |
 | `@stacksjs/shell` | [`stacks-shell`](../stacks-shell/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/shell/src/index.ts) | 1 |
 | `@stacksjs/sites` | [`stacks-sites`](../stacks-sites/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sites/src/index.ts) | 3 |
@@ -749,9 +749,9 @@ Guidance: [`stacks-security`](../stacks-security/SKILL.md). Source: [storage/fra
 
 Read the entrypoint and package export map for re-exported or type-only surfaces.
 
-Local source modules: [src/crypt.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/crypt.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/hash.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/key.ts), [src/webhook.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/webhook.ts).
+Local source modules: [src/api-key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/api-key.ts), [src/crypt.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/crypt.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/hash.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/key.ts), [src/outbound.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/outbound.ts), [src/webhook.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/webhook.ts).
 
-Evidence directory: [5 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [8 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/server
 

package/ai/skills/stacks-security/SKILL.md

@@ -161,7 +161,21 @@ PBKDF2-SHA-256 derivation in `core/security/src/crypt.ts`; decrypt retains
 legacy formats for upgrades. The base64: APP_KEY prefix is normalized by that
 implementation. Encryption/hashing/encoding are distinct APIs; use the exported
 webhook helpers from `core/security/src/webhook.ts` for signed callback
-validation rather than inventing a string comparison.
+validation rather than inventing a string comparison. To SEND signed webhooks,
+`signWebhook(secret | secrets[], body, { timestamp? })` returns the
+`t=<unix>,v1=<hex>` header (HMAC-SHA256 of `${t}.${body}`, one `v1` per secret
+while rotating) and `verifySignedWebhook` / `verifyWebhook('signed', ...)` is
+the receiver's check (tolerance applies both ways). `generateWebhookSecret()`
+mints a `whsec_` secret; store it encrypted, since signing needs the plaintext.
+
+Outbound requests to a URL a user typed (webhook endpoints, import-from-URL)
+go through `outboundUrlProblem(url, { allowHttp?, allowPrivate? })` when the
+URL is saved and `await assertPublicOutboundUrl(url, opts)` right before the
+request: https only, no credentials, and every resolved address public
+(`isPrivateAddress` covers loopback, RFC 1918, CGNAT, link-local metadata,
+IPv4-mapped/NAT64/6to4 forms). It throws `OutboundUrlError` with a `reason`.
+API keys handed to integrations: `generateApiKey('myapp_live_')` returns
+`{ key, hash, hint }`; show `key` once, store `hash` (`hashApiKey`), list `hint`.
 
 Generated model API exposure and ownership live under `config/security.ts`
 api settings. Read `stacks-models`/`stacks-router` before opening generated

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.162",
+  "version": "0.75.164",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.162",
+  "version": "0.75.164",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.162",
+    "@stacksjs/mobile": "0.75.164",
     "@stacksjs/sanitizer": "^0.2.483",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",