@stacksjs/defaults 0.75.197 → 0.75.199

package/ai/skills/stacks-mobile/SKILL.md

@@ -592,3 +592,19 @@ observable from the generated project: search a record's name from the home
 screen, confirm the entry appears and opens that record rather than the last
 screen, then make it stop being the person's (leave, unsave, withdraw, sign
 out) and confirm it stops being findable.
+
+## Bundled native fonts
+
+`ios.nativeFonts` and `android.nativeFonts` map a font's PostScript name to local
+`{ src, license? }` paths, resolved against the application root. Use the same
+name in a native Text node's `fontFamily` style. For example:
+
+```ts
+nativeFonts: {
+  'Allura-Regular': { src: 'public/assets/fonts/allura/Allura-Regular.ttf', license: 'public/assets/fonts/allura/OFL.txt' },
+}
+```
+
+Craft >= 0.0.229 packages the files and licenses into both apps. iOS registers
+`UIAppFonts`; Android loads asset typefaces. The build rejects older builders,
+missing font files and invalid names. Fonts work without a network request.

package/ai/skills/stacks-native/CATALOG.md

@@ -78,7 +78,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/router` | [`stacks-router`](../stacks-router/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/index.ts) | 89 |
 | `@stacksjs/scheduler` | [`stacks-scheduler`](../stacks-scheduler/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/scheduler/src/index.ts) | 13 |
 | `@stacksjs/search-engine` | [`stacks-search-engine`](../stacks-search-engine/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/search-engine/src/index.ts) | 10 |
-| `@stacksjs/security` | [`stacks-security`](../stacks-security/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/index.ts) | 10 |
+| `@stacksjs/security` | [`stacks-security`](../stacks-security/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/index.ts) | 11 |
 | `@stacksjs/server` | [`stacks-server`](../stacks-server/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/server/src/index.ts) | 21 |
 | `@stacksjs/shell` | [`stacks-shell`](../stacks-shell/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/shell/src/index.ts) | 1 |
 | `@stacksjs/sites` | [`stacks-sites`](../stacks-sites/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sites/src/index.ts) | 3 |
@@ -749,9 +749,9 @@ Guidance: [`stacks-security`](../stacks-security/SKILL.md). Source: [storage/fra
 
 Read the entrypoint and package export map for re-exported or type-only surfaces.
 
-Local source modules: [src/api-key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/api-key.ts), [src/crypt.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/crypt.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/hash.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/key.ts), [src/outbound.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/outbound.ts), [src/webhook.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/webhook.ts).
+Local source modules: [src/api-key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/api-key.ts), [src/crypt.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/crypt.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/hash.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/key.ts), [src/outbound.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/outbound.ts), [src/regex.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/regex.ts), [src/webhook.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/webhook.ts).
 
-Evidence directory: [10 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [11 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/server
 

package/ai/skills/stacks-security/SKILL.md

@@ -189,6 +189,19 @@ unless you know you want only the check.
 API keys handed to integrations: `generateApiKey('myapp_live_')` returns
 `{ key, hash, hint }`; show `key` once, store `hash` (`hashApiKey`), list `hint`.
 
+Configured or user-supplied regex patterns: `matchBoundedRegex(source, input, options)`
+accepts optional `flags` and `timeoutMs`, and returns `{ value, index }` for the first complete
+match, or `null`. Every call runs in an isolated Bun process with an OS-enforced
+deadline and `SIGKILL`, including process startup (25ms by default, integer
+1-1000ms). It requires `bun` on PATH. Timeouts throw `RegexTimeoutError`;
+invalid patterns throw `SyntaxError`. Do not treat either as a clean security
+scan. Source is capped at 8Ki UTF-16 code units, input at 64Ki, and flags at 8.
+The helper does not inherit app preloads, environment variables or .env files.
+It matches statelessly and does not return captures. Use ordinary RegExp for
+trusted application constants to avoid process startup for normal matching.
+Timing a synchronous match afterward or vetting one sample input cannot bound
+an untrusted expression on its next input.
+
 Generated model API exposure and ownership live under `config/security.ts`
 api settings. Read `stacks-models`/`stacks-router` before opening generated
 endpoints; a cloud WAF setting does not implement model row authorization.

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.197",
+  "version": "0.75.199",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.197",
+  "version": "0.75.199",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.197",
+    "@stacksjs/mobile": "0.75.199",
     "@stacksjs/sanitizer": "^0.2.534",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",