@stacksjs/defaults 0.75.163 → 0.75.165

package/ai/skills/stacks-mobile/SKILL.md

@@ -229,6 +229,12 @@ every reading natively, screen locked or app closed, until `stopRecording()`
 hands them back. iOS only, behind `capabilities.heartRate` (which adds the
 `bluetooth-central` background mode); Bluetooth needs no network.
 
+`capabilities.backgroundAudio` (iOS) adds the `audio` background mode, so a
+soundscape played with Web Audio keeps going with the screen locked: a sleep
+timer built on stx's `useAmbientSound().fadeOut(seconds, after)` then fades it
+out on the audio clock. App Review expects audible content from an app that
+asks for it.
+
 ```ts
 import { createRouteRecorder, heartRate, location } from '@stacksjs/mobile'
 
@@ -422,7 +428,10 @@ energy, distance, heart rate, resting heart rate, HRV, weight and sleep.
 `health.getHeartRateSamples(range)` returns every heart-rate reading (bpm,
 start/end, source and device) and `health.getSleepIntervals(range)` the night's
 in-bed, awake and asleep stages; check `health.supports(method)` first, since an
-app build that predates a read resolves `[]` for it. Completed
+app build that predates a read resolves `[]` for it. Mindful minutes go through
+`health.saveMindfulSession({ id, startDate, endDate })` (the `mindful` grant;
+the id is the sample's external UUID, so a repeat save keeps the first) and come
+back from `health.getMindfulSessions(range)` with `ownApp` on this app's own. Completed
 recordings can be written back with `health.saveWorkout(...)`; treat permission
 revocation as a normal runtime state and never block saving the application's
 own activity when a health write fails.

package/ai/skills/stacks-native/CATALOG.md

@@ -78,7 +78,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/router` | [`stacks-router`](../stacks-router/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/index.ts) | 87 |
 | `@stacksjs/scheduler` | [`stacks-scheduler`](../stacks-scheduler/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/scheduler/src/index.ts) | 13 |
 | `@stacksjs/search-engine` | [`stacks-search-engine`](../stacks-search-engine/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/search-engine/src/index.ts) | 10 |
-| `@stacksjs/security` | [`stacks-security`](../stacks-security/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/index.ts) | 6 |
+| `@stacksjs/security` | [`stacks-security`](../stacks-security/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/index.ts) | 8 |
 | `@stacksjs/server` | [`stacks-server`](../stacks-server/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/server/src/index.ts) | 21 |
 | `@stacksjs/shell` | [`stacks-shell`](../stacks-shell/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/shell/src/index.ts) | 1 |
 | `@stacksjs/sites` | [`stacks-sites`](../stacks-sites/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sites/src/index.ts) | 3 |
@@ -749,9 +749,9 @@ Guidance: [`stacks-security`](../stacks-security/SKILL.md). Source: [storage/fra
 
 Read the entrypoint and package export map for re-exported or type-only surfaces.
 
-Local source modules: [src/crypt.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/crypt.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/hash.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/key.ts), [src/webhook.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/webhook.ts).
+Local source modules: [src/api-key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/api-key.ts), [src/crypt.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/crypt.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/hash.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/key.ts), [src/outbound.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/outbound.ts), [src/webhook.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/webhook.ts).
 
-Evidence directory: [6 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [8 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/server
 

package/ai/skills/stacks-security/SKILL.md

@@ -168,6 +168,15 @@ while rotating) and `verifySignedWebhook` / `verifyWebhook('signed', ...)` is
 the receiver's check (tolerance applies both ways). `generateWebhookSecret()`
 mints a `whsec_` secret; store it encrypted, since signing needs the plaintext.
 
+Outbound requests to a URL a user typed (webhook endpoints, import-from-URL)
+go through `outboundUrlProblem(url, { allowHttp?, allowPrivate? })` when the
+URL is saved and `await assertPublicOutboundUrl(url, opts)` right before the
+request: https only, no credentials, and every resolved address public
+(`isPrivateAddress` covers loopback, RFC 1918, CGNAT, link-local metadata,
+IPv4-mapped/NAT64/6to4 forms). It throws `OutboundUrlError` with a `reason`.
+API keys handed to integrations: `generateApiKey('myapp_live_')` returns
+`{ key, hash, hint }`; show `key` once, store `hash` (`hashApiKey`), list `hint`.
+
 Generated model API exposure and ownership live under `config/security.ts`
 api settings. Read `stacks-models`/`stacks-router` before opening generated
 endpoints; a cloud WAF setting does not implement model row authorization.

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.163",
+  "version": "0.75.165",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.163",
+  "version": "0.75.165",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.163",
+    "@stacksjs/mobile": "0.75.165",
     "@stacksjs/sanitizer": "^0.2.483",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",