@stacksjs/defaults 0.75.255 → 0.75.257

package/ai/skills/stacks-buddy/SKILL.md

@@ -340,6 +340,7 @@ buddy env:set [key] [value]      # set env var
   -f/--file [file]               # env file path
   -fk/--file-keys [path]         # keys file path
   --plain                        # don't encrypt the value
+  --stdin                        # read exact value from piped stdin; excludes a value argument
 buddy env:encrypt [key]          # encrypt env var(s)
   -f/--file [file]               # env file path
   -fk/--file-keys [path]         # keys file path

package/ai/skills/stacks-env/SKILL.md

@@ -207,7 +207,7 @@ const { parsed, errors, skippedEncrypted } = parse(envContent, {
 ## Encryption (X25519 + AES-256-GCM)
 
 ```typescript
-import { aesEncrypt, aesDecrypt, generateKeypair, encryptValue, decryptValue, getPrivateKey } from '@stacksjs/env'
+import { aesEncrypt, aesDecrypt, generateKeypair, encryptValue, decryptValue, getPrivateKey, isValidPublicKey } from '@stacksjs/env'
 
 // AES-256-GCM symmetric encryption
 const encrypted = aesEncrypt(plaintext, password)
@@ -215,6 +215,7 @@ const decrypted = aesDecrypt(encrypted, password)
 
 // Versioned ephemeral-static X25519 envelope encryption
 const keypair = generateKeypair()
+const validPublicKey = isValidPublicKey(keypair.publicKey) // canonical current X25519 public metadata
 const encrypted = encryptValue(value, keypair.publicKey)
 const decrypted = decryptValue(encrypted, keypair.privateKey)
 ```
@@ -239,6 +240,28 @@ Restore the environment's matching private key through `.env.keys` or its
 key remains readable independently. `buddy deploy` stops on an incomplete or
 unreadable environment instead of deploying a partial map.
 
+`isValidPublicKey(value: unknown): value is string` returns false for private,
+legacy, malformed, or noncanonical public metadata without throwing or exposing
+parser errors. Strict committed-env checks reject that metadata and all nonempty
+private-key assignments, including encrypted ones. Legacy decryption remains
+supported for migration through `buddy env:rotate`; non-strict scans retain
+their existing compatibility behavior.
+
+`publicKeyMatchesPrivateKey(publicKey: unknown, privateKey: unknown): boolean`
+validates a current X25519 pair without returning either key or parser errors.
+Use it with the actual private half before accepting public metadata for future
+writes. Strict `env:check` rejects mismatches, and `env:set`/`env:encrypt` refuse
+to add ciphertext under a header unrelated to an available private key. Reading
+old ciphertext and rotating legacy keys retain their existing migration policy.
+
+For CLI/file operations, use
+`resolveEnvPrivateKey({ file?: string, keysFile?: string, cwd?: string })`.
+Its order is target-scoped local key, target-scoped process key, generic local
+key, then generic process key. The keys file defaults to `.env.keys` relative to
+`cwd`. `getEnv`, encrypted writers, and strict Buddy checks share this resolver.
+The cached application-runtime `resolvePrivateKey` remains process-first so
+server/browser test configuration can intentionally override local defaults.
+
 ## Tenant isolation on a shared box
 
 When several projects share one server - one owns it, the rest attach with

package/ai/skills/stacks-native/CATALOG.md

@@ -11,7 +11,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | Package | Task guidance | Source entry | Retained tests |
 |---|---|---|---|
 | `@stacksjs/action-runner` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/action-runner/src/index.ts) | 1 |
-| `@stacksjs/actions` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts) | 75 |
+| `@stacksjs/actions` | [`stacks-actions`](../stacks-actions/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts) | 81 |
 | `@stacksjs/ai` | [`stacks-ai`](../stacks-ai/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/ai/src/index.ts) | 17 |
 | `@stacksjs/alias` | [`stacks-alias`](../stacks-alias/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/alias/src/index.ts) | 1 |
 | `@stacksjs/analytics` | [`stacks-analytics`](../stacks-analytics/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/analytics/src/index.ts) | 6 |
@@ -21,9 +21,9 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 119 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
 | `@stacksjs/browser-extension` | [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/index.ts) | 7 |
-| `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 154 |
-| `@stacksjs/build` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/build/src/index.ts) | 2 |
-| `@stacksjs/cache` | [`stacks-cache`](../stacks-cache/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/index.ts) | 13 |
+| `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 157 |
+| `@stacksjs/build` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/build/src/index.ts) | 3 |
+| `@stacksjs/cache` | [`stacks-cache`](../stacks-cache/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/index.ts) | 14 |
 | `@stacksjs/calendar-api` | [`stacks-calendar`](../stacks-calendar/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/index.ts) | 2 |
 | `@stacksjs/charts` | [`stacks-charts`](../stacks-charts/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/charts/src/index.ts) | 3 |
 | `@stacksjs/chat` | [`stacks-chat`](../stacks-chat/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/src/index.ts) | 5 |
@@ -35,17 +35,17 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/composables` | [`stacks-composables`](../stacks-composables/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/composables/src/index.ts) | 18 |
 | `@stacksjs/config` | [`stacks-config`](../stacks-config/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/config/src/index.ts) | 16 |
 | `@stacksjs/cron` | [`stacks-cron`](../stacks-cron/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cron/src/index.ts) | 4 |
-| `@stacksjs/database` | [`stacks-database`](../stacks-database/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/index.ts) | 125 |
+| `@stacksjs/database` | [`stacks-database`](../stacks-database/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/index.ts) | 126 |
 | `@stacksjs/datetime` | [`stacks-datetime`](../stacks-datetime/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/index.ts) | 13 |
-| `@stacksjs/defaults` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/defaults/package.json) | 1 |
+| `@stacksjs/defaults` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/defaults/package.json) | 2 |
 | `@stacksjs/deploy` | [`stacks-deploy`](../stacks-deploy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/deploy/package.json) | 1 |
 | `@stacksjs/desktop-build` | [`stacks-desktop`](../stacks-desktop/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/index.ts) | 12 |
 | `@stacksjs/development` | [`stacks-development`](../stacks-development/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/development/package.json) | 1 |
 | `@stacksjs/dns` | [`stacks-dns`](../stacks-dns/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/dns/src/index.ts) | 3 |
 | `@stacksjs/docs` | [`stacks-docs`](../stacks-docs/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/docs/src/index.ts) | 2 |
-| `@stacksjs/email` | [`stacks-email`](../stacks-email/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/index.ts) | 21 |
+| `@stacksjs/email` | [`stacks-email`](../stacks-email/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/index.ts) | 22 |
 | `@stacksjs/enums` | [`stacks-enums`](../stacks-enums/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/enums/src/index.ts) | 3 |
-| `@stacksjs/env` | [`stacks-env`](../stacks-env/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/index.ts) | 28 |
+| `@stacksjs/env` | [`stacks-env`](../stacks-env/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/index.ts) | 30 |
 | `@stacksjs/error-handling` | [`stacks-error-handling`](../stacks-error-handling/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/error-handling/src/index.ts) | 10 |
 | `@stacksjs/events` | [`stacks-events`](../stacks-events/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/events/src/index.ts) | 12 |
 | `@stacksjs/faker` | [`stacks-faker`](../stacks-faker/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/faker/src/index.ts) | 1 |
@@ -65,9 +65,9 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/newsletter` | [`stacks-newsletter`](../stacks-newsletter/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/newsletter/src/index.ts) | 7 |
 | `@stacksjs/notifications` | [`stacks-notifications`](../stacks-notifications/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/notifications/src/index.ts) | 16 |
 | `@stacksjs/objects` | [`stacks-objects`](../stacks-objects/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/objects/src/index.ts) | 4 |
-| `@stacksjs/orm` | [`stacks-orm`](../stacks-orm/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/index.ts) | 65 |
+| `@stacksjs/orm` | [`stacks-orm`](../stacks-orm/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/index.ts) | 69 |
 | `@stacksjs/pagination` | [`stacks-pagination`](../stacks-pagination/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/pagination/src/index.ts) | 0 |
-| `@stacksjs/path` | [`stacks-path`](../stacks-path/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/src/index.ts) | 12 |
+| `@stacksjs/path` | [`stacks-path`](../stacks-path/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/src/index.ts) | 13 |
 | `@stacksjs/payments` | [`stacks-payments`](../stacks-payments/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/payments/src/index.ts) | 28 |
 | `@stacksjs/push` | [`stacks-push`](../stacks-push/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/push/src/index.ts) | 6 |
 | `@stacksjs/query-builder` | [`stacks-query-builder`](../stacks-query-builder/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/query-builder/src/index.ts) | 6 |
@@ -75,7 +75,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/realtime` | [`stacks-realtime`](../stacks-realtime/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/realtime/src/index.ts) | 12 |
 | `@stacksjs/registry` | [`stacks-registry`](../stacks-registry/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/registry/src/index.ts) | 1 |
 | `@stacksjs/repl` | [`stacks-repl`](../stacks-repl/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/repl/src/index.ts) | 2 |
-| `@stacksjs/router` | [`stacks-router`](../stacks-router/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/index.ts) | 93 |
+| `@stacksjs/router` | [`stacks-router`](../stacks-router/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/index.ts) | 94 |
 | `@stacksjs/scheduler` | [`stacks-scheduler`](../stacks-scheduler/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/scheduler/src/index.ts) | 13 |
 | `@stacksjs/search-engine` | [`stacks-search-engine`](../stacks-search-engine/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/search-engine/src/index.ts) | 10 |
 | `@stacksjs/security` | [`stacks-security`](../stacks-security/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/security/src/index.ts) | 11 |
@@ -115,11 +115,11 @@ Evidence directory: [1 retained tests](https://github.com/stacksjs/stacks/blob/m
 
 Guidance: [`stacks-actions`](../stacks-actions/SKILL.md). Source: [storage/framework/core/actions/src/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/index.ts).
 
-Declared runtime exports: `BlogAdminError`, `DEFAULT_IOS_DEPENDENCIES`, `DEFAULT_STX_LINT_CONFIG`, `IosToolchainError`, `XCODE_NOTE`, `blogSlugify`, `createComponent`, `createDatabase`, `createFactory`, `createFunction`, `createLanguage`, `createMail`, `createMiddleware`, `createMigration`, `createModel`, `createNotification`, `createPage`, `deleteBlogPost`, `describeDanglingRouteActions`, `describeGitHubRelease`, `discoverPackages`, `ensureDiscoveredPackages`, `findDanglingRouteActions`, `formatProject`, `getBlogPost`, `installStack`, `isDryRunActive`, `lintFix`, `lintProject`, `listBlogPosts`, `listStacks`, `loadIosDependencies`, `loadStxLintConfig`, `makeAction`, `makeCertificate`, `makeCommand`, `makeComponent`, `makeDatabase`, `makeFunction`, `makeJob`, `makeLanguage`, `makeMail`, `makeNotification`, `makePage`, `makePolicy`, `makeQueueTable`, `makeResource`, `makeStack`, `measureDefaultsDrift`, `pantryExecutable`, `pantryInstallArgs`, `parseFields`, `parseGitHubRemote`, `publishGitHubRelease`, `resolveXcodegen`, `runAdd`, `runCommit`, `runMake`, `runStxLint`, `saveBlogPost`, `scaffoldCrud`, `setDryRun`, `summarizeStructureChanges`, `uninstallStack`, `xcodeDeveloperDir`.
+Declared runtime exports: `BlogAdminError`, `DEFAULT_IOS_DEPENDENCIES`, `DEFAULT_STX_LINT_CONFIG`, `IosToolchainError`, `PUBLICATION_CHECK_SCRIPT`, `XCODE_NOTE`, `assertPublicationAllowed`, `blogSlugify`, `createComponent`, `createDatabase`, `createFactory`, `createFunction`, `createLanguage`, `createMail`, `createMiddleware`, `createMigration`, `createModel`, `createNotification`, `createPage`, `deleteBlogPost`, `describeDanglingRouteActions`, `describeGitHubRelease`, `discoverPackages`, `ensureDiscoveredPackages`, `findDanglingRouteActions`, `formatProject`, `getBlogPost`, `installStack`, `isDryRunActive`, `lintFix`, `lintProject`, `listBlogPosts`, `listStacks`, `loadIosDependencies`, `loadStxLintConfig`, `makeAction`, `makeCertificate`, `makeCommand`, `makeComponent`, `makeDatabase`, `makeFunction`, `makeJob`, `makeLanguage`, `makeMail`, `makeNotification`, `makePage`, `makePolicy`, `makeQueueTable`, `makeResource`, `makeStack`, `measureDefaultsDrift`, `pantryExecutable`, `pantryInstallArgs`, `parseFields`, `parseGitHubRemote`, `publicationChannels`, `publishGitHubRelease`, `resolveStxSource`, `resolveXcodegen`, `runAdd`, `runCommit`, `runMake`, `runStxLint`, `saveBlogPost`, `scaffoldCrud`, `setDryRun`, `summarizeStructureChanges`, `uninstallStack`, `validateReleaseEvidencePlan`, `verifyReleaseEvidence`, `xcodeDeveloperDir`.
 
-Local source modules: [src/action.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/action.ts), [src/add.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/add.ts), [src/blog-admin.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/blog-admin.ts), [src/build/ios-toolchain.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/build/ios-toolchain.ts), [src/commit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/commit.ts), [src/dev/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/dev/index.ts), [src/discover-packages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/discover-packages.ts), [src/generate/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/generate/index.ts), [src/github-release.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/github-release.ts), [src/helpers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/helpers/index.ts), [src/library/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/library/index.ts), [src/lint/lint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/lint.ts), [src/lint/stx-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/stx-gate.ts), [src/make-command.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-command.ts), [src/make-job.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-job.ts), [src/make-policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-policy.ts), [src/make-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-resource.ts), [src/make.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make.ts), [src/scaffold-crud.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/scaffold-crud.ts), [src/setup/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/setup/index.ts), [src/stacks.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stacks.ts), [src/upgrade/package-project.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/package-project.ts), [src/upgrade/route-actions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/route-actions.ts).
+Local source modules: [src/action.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/action.ts), [src/add.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/add.ts), [src/blog-admin.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/blog-admin.ts), [src/build/ios-toolchain.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/build/ios-toolchain.ts), [src/commit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/commit.ts), [src/dev/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/dev/index.ts), [src/discover-packages.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/discover-packages.ts), [src/generate/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/generate/index.ts), [src/github-release.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/github-release.ts), [src/helpers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/helpers/index.ts), [src/library/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/library/index.ts), [src/lint/lint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/lint.ts), [src/lint/stx-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/lint/stx-gate.ts), [src/make-command.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-command.ts), [src/make-job.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-job.ts), [src/make-policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-policy.ts), [src/make-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make-resource.ts), [src/make.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/make.ts), [src/publication-preflight.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/publication-preflight.ts), [src/release-evidence.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/release-evidence.ts), [src/scaffold-crud.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/scaffold-crud.ts), [src/setup/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/setup/index.ts), [src/stacks.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stacks.ts), [src/stx-source.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/stx-source.ts), [src/upgrade/package-project.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/package-project.ts), [src/upgrade/route-actions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/src/upgrade/route-actions.ts).
 
-Evidence directory: [75 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [81 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/actions/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/ai
 
@@ -215,7 +215,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/commands/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/commands/index.ts).
 
-Evidence directory: [154 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [157 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/build
 
@@ -223,7 +223,7 @@ Guidance: [`stacks-build`](../stacks-build/SKILL.md). Source: [storage/framework
 
 Declared runtime exports: `frameworkExternal`, `intro`, `outro`, `transpilePackage`, `validateDeclarations`, `validateRuntimeExports`.
 
-Evidence directory: [2 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/build/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [3 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/build/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/cache
 
@@ -233,7 +233,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/drivers/index.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/key.ts).
 
-Evidence directory: [13 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [14 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/calendar-api
 
@@ -351,7 +351,7 @@ Declared runtime exports: `BUN_BROKEN_MYSQL_POOL_MESSAGE`, `BUN_BROKEN_POSTGRES_
 
 Local source modules: [src/affected-rows.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/affected-rows.ts), [src/auth-tables.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/auth-tables.ts), [src/broken-pool.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/broken-pool.ts), [src/custom/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/custom/index.ts), [src/database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/database.ts), [src/datetime-columns.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/datetime-columns.ts), [src/ddl-constraints.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/ddl-constraints.ts), [src/defaults.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/defaults.ts), [src/dialect.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/dialect.ts), [src/driver-config.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/driver-config.ts), [src/drivers/dynamodb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/drivers/dynamodb.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/drivers/index.ts), [src/ensure-database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/ensure-database.ts), [src/erd.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/erd.ts), [src/fk-audit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/fk-audit.ts), [src/framework-renames.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/framework-renames.ts), [src/hand-written-migrations.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/hand-written-migrations.ts), [src/ignored-migrations.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/ignored-migrations.ts), [src/index-shape.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/index-shape.ts), [src/managed-columns.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/managed-columns.ts), [src/migration-dialect.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/migration-dialect.ts), [src/migration-ledger.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/migration-ledger.ts), [src/migration-names.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/migration-names.ts), [src/migration-path.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/migration-path.ts), [src/migrations.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/migrations.ts), [src/model-sources.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/model-sources.ts), [src/notification-tables.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/notification-tables.ts), [src/package-migrations.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/package-migrations.ts), [src/package-models.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/package-models.ts), [src/query-logger.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/query-logger.ts), [src/rbac-tables.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/rbac-tables.ts), [src/relation-columns.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/relation-columns.ts), [src/replicas.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/replicas.ts), [src/row-lock.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/row-lock.ts), [src/safe-migrations.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/safe-migrations.ts), [src/schema-align.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/schema-align.ts), [src/schema-drift.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/schema-drift.ts), [src/seeder.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/seeder.ts), [src/shadowed-models.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/shadowed-models.ts), [src/sql-helpers.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/sql-helpers.ts), [src/trait-tables.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/trait-tables.ts), [src/transaction-context.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/transaction-context.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/types.ts), [src/unique-audit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/unique-audit.ts), [src/utc-defaults.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/utc-defaults.ts), [src/utils.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/utils.ts), [src/uuid-columns.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/uuid-columns.ts), [src/vschema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/vschema.ts).
 
-Evidence directory: [125 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [126 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/datetime
 
@@ -369,7 +369,7 @@ Guidance: [`stacks-build`](../stacks-build/SKILL.md). Source: [storage/framework
 
 Read the entrypoint and package export map for re-exported or type-only surfaces.
 
-Evidence directory: [1 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/defaults/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [2 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/defaults/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/deploy
 
@@ -425,7 +425,7 @@ Declared runtime exports: `discoverMailables`, `inlineCss`, `loadSampleProps`, `
 
 Local source modules: [src/css-inliner.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/css-inliner.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/drivers/index.ts), [src/email.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/email.ts), [src/idempotency.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/idempotency.ts), [src/inbound-parser.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/inbound-parser.ts), [src/inbox-mailbox.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/inbox-mailbox.ts), [src/mailable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/mailable.ts), [src/mime-preview.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/mime-preview.ts), [src/preview-ui.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/preview-ui.ts), [src/preview.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/preview.ts), [src/sdk/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/sdk/index.ts), [src/suppression.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/suppression.ts), [src/template.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/template.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/types.ts), [src/unsubscribe.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/unsubscribe.ts), [src/webhook-dedup.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/webhook-dedup.ts), [src/webhook-events.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/webhook-events.ts), [src/webhook-handlers.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/webhook-handlers.ts), [src/webhook-signatures.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/src/webhook-signatures.ts).
 
-Evidence directory: [21 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [22 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/email/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/enums
 
@@ -443,7 +443,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/cli.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/cli.ts), [src/crypto.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/crypto.ts), [src/deployment.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/deployment.ts), [src/integrations.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/integrations.ts), [src/numeric-keys.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/numeric-keys.ts), [src/parser.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/parser.ts), [src/plaintext.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/plaintext.ts), [src/plugin.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/plugin.ts), [src/runtime.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/runtime.ts), [src/tenants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/tenants.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/types.ts), [src/utils.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/src/utils.ts).
 
-Evidence directory: [28 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [30 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/env/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/error-handling
 
@@ -633,7 +633,7 @@ Declared runtime exports: `Activity`, `AnalyticsEvent`, `Auction`, `AuctionItem`
 
 Local source modules: [src/auto-crud.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/auto-crud.ts), [src/batch-loader.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/batch-loader.ts), [src/db.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/db.ts), [src/define-model.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/define-model.ts), [src/extend-model.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/extend-model.ts), [src/gdpr/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/gdpr/index.ts), [src/generate-database-schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/generate-database-schema.ts), [src/locked-row.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/locked-row.ts), [src/messaging.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/messaging.ts), [src/model-types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/model-types.ts), [src/ownership.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/ownership.ts), [src/paginator-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/paginator-request.ts), [src/row-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/row-token.ts), [src/subquery.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/subquery.ts), [src/traits/audit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/traits/audit.ts), [src/traits/billable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/traits/billable.ts), [src/traits/categorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/traits/categorizable.ts), [src/traits/commentable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/traits/commentable.ts), [src/traits/likeable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/traits/likeable.ts), [src/traits/taggable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/traits/taggable.ts), [src/transaction.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/transaction.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/types.ts), [src/utils/encrypted.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/utils/encrypted.ts), [src/utils/prunable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/src/utils/prunable.ts).
 
-Evidence directory: [65 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [69 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/orm/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/pagination
 
@@ -645,11 +645,11 @@ Declared runtime exports: `isCursorPaginator`, `isPaginator`, `isSimplePaginator
 
 Guidance: [`stacks-path`](../stacks-path/SKILL.md). Source: [storage/framework/core/path/src/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/src/index.ts).
 
-Declared runtime exports: `DEFAULTS_SYNC_MARKER`, `actionRunnerPath`, `actionsPath`, `aiPath`, `aliasPath`, `analyticsPath`, `appPath`, `applyRuntimeDirectoryEnv`, `arraysPath`, `assetsPath`, `authPath`, `basename`, `browserPath`, `buddyPath`, `buildEnginePath`, `buildPath`, `builtUserActionsPath`, `cachePath`, `chartsPath`, `chatPath`, `cliPath`, `cloudPath`, `cloudStatePath`, `collectionsPath`, `commandsPath`, `componentsPath`, `configPath`, `coreApiPath`, `coreEnvPath`, `corePath`, `coreStoragePath`, `customElementsDataPath`, `databasePath`, `datetimePath`, `defaultsAppPath`, `defaultsPackagePath`, `defaultsResourcesPath`, `delimiter`, `desktopPath`, `developmentPath`, `dirname`, `dnsPath`, `docsPath`, `emailPath`, `ensureRuntimeDirectories`, `enumsPath`, `errorHandlingPath`, `eslintPluginPath`, `eventsPath`, `examplesPath`, `extname`, `fakerPath`, `featureFlagsPath`, `featuresPath`, `findProjectPath`, `frameworkCloudPath`, `frameworkDefaultsRoot`, `frameworkPath`, `frameworkRuntimePath`, `functionsPath`, `gitPath`, `healthPath`, `homeDir`, `inspectDefaultsProvenance`, `installedDefaultsVersion`, `isAbsolute`, `isCompiledBinary`, `isInstalledDefaultsRoot`, `jobsPath`, `join`, `langPath`, `layoutsPath`, `libraryPackagePath`, `libsEntriesPath`, `libsPath`, `linkPackagedDefaults`, `lintPath`, `listenersPath`, `loggingPath`, `logsPath`, `mergeDirectoryInto`, `modelMetaPath`, `modelsPath`, `modulesPath`, `newsletterPath`, `normalize`, `notificationsPath`, `objectsPath`, `onboardingPath`, `ormPath`, `packagedDefaultsRoot`, `paginationPath`, `path`, `pathPath`, `paymentsPath`, `projectConfigPath`, `projectPath`, `publicPath`, `pushPath`, `queryBuilderPath`, `queuePath`, `realtimePath`, `relative`, `relativeActionsPath`, `replPath`, `resolve`, `resolveModulePath`, `resolveUserLibBase`, `resourcesPath`, `routerPath`, `routesPath`, `runtimeDirectoryEnv`, `runtimePath`, `schedulerPath`, `scriptsPath`, `searchEnginePath`, `securityPath`, `sep`, `serverPath`, `serverlessPath`, `settingsPath`, `shellPath`, `siteConfigPath`, `skillsPath`, `slugPath`, `smsPath`, `socialsPath`, `stacksBackupPath`, `stacksLockPath`, `stacksPath`, `storagePath`, `storesPath`, `stringsPath`, `stxPath`, `testingPath`, `testsPath`, `tinkerPath`, `toNamespacedPath`, `typesPath`, `uiPath`, `userActionsPath`, `userComponentsPath`, `userControllersPath`, `userDatabasePath`, `userEmailsPath`, `userEventsPath`, `userFunctionsPath`, `userJobsPath`, `userLibsPath`, `userListenersPath`, `userMailPath`, `userMiddlewarePath`, `userMigrationsPath`, `userModelsPath`, `userNotificationsPath`, `userServerPath`, `userViewsPath`, `usesVendoredDefaults`, `utilsPath`, `validationPath`, `viewsPath`.
+Declared runtime exports: `DEFAULTS_SYNC_MARKER`, `actionRunnerPath`, `actionsPath`, `aiPath`, `aliasPath`, `analyticsPath`, `appPath`, `applyRuntimeDirectoryEnv`, `arraysPath`, `assetsPath`, `authPath`, `basename`, `browserPath`, `buddyPath`, `buildEnginePath`, `buildPath`, `builtUserActionsPath`, `cachePath`, `chartsPath`, `chatPath`, `cliPath`, `cloudPath`, `cloudStatePath`, `collectionsPath`, `commandsPath`, `componentsPath`, `configPath`, `coreApiPath`, `coreEnvPath`, `corePath`, `coreStoragePath`, `customElementsDataPath`, `databasePath`, `datetimePath`, `defaultsAppPath`, `defaultsPackagePath`, `defaultsPath`, `defaultsResourcesPath`, `delimiter`, `desktopPath`, `developmentPath`, `dirname`, `dnsPath`, `docsPath`, `emailPath`, `ensureRuntimeDirectories`, `enumsPath`, `errorHandlingPath`, `eslintPluginPath`, `eventsPath`, `examplesPath`, `extname`, `fakerPath`, `featureFlagsPath`, `featuresPath`, `findProjectPath`, `frameworkCloudPath`, `frameworkDefaultsRoot`, `frameworkPath`, `frameworkRuntimePath`, `functionsPath`, `gitPath`, `healthPath`, `homeDir`, `inspectDefaultsProvenance`, `installedDefaultsVersion`, `isAbsolute`, `isCompiledBinary`, `isInstalledDefaultsRoot`, `jobsPath`, `join`, `langPath`, `layoutsPath`, `libraryPackagePath`, `libsEntriesPath`, `libsPath`, `linkPackagedDefaults`, `lintPath`, `listenersPath`, `loggingPath`, `logsPath`, `mergeDirectoryInto`, `modelMetaPath`, `modelsPath`, `modulesPath`, `newsletterPath`, `normalize`, `notificationsPath`, `objectsPath`, `onboardingPath`, `ormPath`, `packagedDefaultsRoot`, `paginationPath`, `path`, `pathPath`, `paymentsPath`, `projectConfigPath`, `projectPath`, `publicPath`, `pushPath`, `queryBuilderPath`, `queuePath`, `realtimePath`, `relative`, `relativeActionsPath`, `replPath`, `resolve`, `resolveModulePath`, `resolveUserLibBase`, `resourcesPath`, `routerPath`, `routesPath`, `runtimeDirectoryEnv`, `runtimePath`, `schedulerPath`, `scriptsPath`, `searchEnginePath`, `securityPath`, `sep`, `serverPath`, `serverlessPath`, `settingsPath`, `shellPath`, `siteConfigPath`, `skillsPath`, `slugPath`, `smsPath`, `socialsPath`, `stacksBackupPath`, `stacksLockPath`, `stacksPath`, `storagePath`, `storesPath`, `stringsPath`, `stxPath`, `testingPath`, `testsPath`, `tinkerPath`, `toNamespacedPath`, `typesPath`, `uiPath`, `userActionsPath`, `userComponentsPath`, `userControllersPath`, `userDatabasePath`, `userEmailsPath`, `userEventsPath`, `userFunctionsPath`, `userJobsPath`, `userLibsPath`, `userListenersPath`, `userMailPath`, `userMiddlewarePath`, `userMigrationsPath`, `userModelsPath`, `userNotificationsPath`, `userServerPath`, `userViewsPath`, `usesVendoredDefaults`, `utilsPath`, `validationPath`, `viewsPath`.
 
 Local source modules: [src/module-resolution.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/src/module-resolution.ts), [src/project.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/src/project.ts).
 
-Evidence directory: [12 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [13 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/path/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/payments
 
@@ -723,7 +723,7 @@ Declared runtime exports: `DASHBOARD_ROUTE_GROUPS`, `DEFAULT_ROUTE_BUNDLE_FEATUR
 
 Local source modules: [src/api-shape.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/api-shape.ts), [src/body.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/body.ts), [src/dashboard-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/dashboard-access.ts), [src/encrypted-session-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/encrypted-session-store.ts), [src/error-handler.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/error-handler.ts), [src/health.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/health.ts), [src/json.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/json.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/middleware.ts), [src/path-sanitize.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/path-sanitize.ts), [src/rate-limit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/rate-limit.ts), [src/request-augmentation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/request-augmentation.ts), [src/request-context.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/request-context.ts), [src/route-loader.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/route-loader.ts), [src/route-model-binding.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/route-model-binding.ts), [src/security-settings.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/security-settings.ts), [src/session-factory.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/session-factory.ts), [src/signed-url.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/signed-url.ts), [src/stacks-router.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/stacks-router.ts), [src/typed-router.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/src/typed-router.ts).
 
-Evidence directory: [93 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [94 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/router/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/scheduler
 

package/functions/api.ts

@@ -9,6 +9,55 @@ import { useAuth } from './auth'
 
 const baseUrl = resolveApiBaseUrl()
 
+/**
+ * Where this client is allowed to send a request from.
+ *
+ * `resolveApiBaseUrl()` answers with the relative `/api` when there is no
+ * `window.location` and no injected `__STACKS_API_URL__`, which is the honest
+ * answer for a browser bundle and deliberate (stacksjs/stacks#2421). `fetch`
+ * cannot use it: off the DOM there is no origin to resolve a relative URL
+ * against, so every verb below would reach `ERR_INVALID_URL` after building
+ * its headers, reading the auth token and serialising its body.
+ *
+ * That failure arrived as a bare `TypeError: fetch() URL is invalid` in a dev
+ * server log while the page still returned 200, which is how a dashboard
+ * template calling `post()` by accident during server-side rendering went
+ * unnoticed (stacksjs/stacks#2944). It is also only an accident that nothing
+ * was sent: with `__STACKS_API_URL__` injected for a split-origin deployment
+ * the URL is absolute, and the same mistake issues a real mutating request
+ * while a page renders.
+ *
+ * So refuse first, by name, before any of that work happens. This client is
+ * for the browser; server-side code has the ORM and the actions.
+ */
+function requestUrl(endpoint: string): string {
+  if (/^https?:\/\//i.test(baseUrl))
+    return `${baseUrl}${endpoint}`
+
+  throw new DashboardApiEnvironmentError(endpoint)
+}
+
+/**
+ * Thrown when a dashboard API verb is called where it cannot send a request.
+ *
+ * Named rather than generic: the thing worth knowing is which endpoint was
+ * about to be called from the wrong place, and the stack alone does not say
+ * so once the evaluator that called it is several frames of template
+ * machinery deep.
+ */
+export class DashboardApiEnvironmentError extends Error {
+  readonly endpoint: string
+
+  constructor(endpoint: string) {
+    super(
+      `The dashboard API client cannot request "${endpoint}" here: it needs an absolute base URL and resolved "${baseUrl}". `
+      + `This client runs in the browser. Server-side code should use the ORM or an action instead.`,
+    )
+    this.name = 'DashboardApiEnvironmentError'
+    this.endpoint = endpoint
+  }
+}
+
 export interface ApiResponse<T> {
   data: T
   message?: string
@@ -55,7 +104,7 @@ async function handleResponse<T>(response: Response): Promise<T> {
  * GET request
  */
 export async function get<T>(endpoint: string): Promise<T> {
-  const response = await fetch(`${baseUrl}${endpoint}`, {
+  const response = await fetch(requestUrl(endpoint), {
     method: 'GET',
     headers: createHeaders(),
   })
@@ -67,7 +116,7 @@ export async function get<T>(endpoint: string): Promise<T> {
  * POST request
  */
 export async function post<T>(endpoint: string, body?: unknown): Promise<T> {
-  const response = await fetch(`${baseUrl}${endpoint}`, {
+  const response = await fetch(requestUrl(endpoint), {
     method: 'POST',
     headers: createHeaders(),
     body: body ? JSON.stringify(body) : undefined,
@@ -80,7 +129,7 @@ export async function post<T>(endpoint: string, body?: unknown): Promise<T> {
  * PUT request
  */
 export async function put<T>(endpoint: string, body?: unknown): Promise<T> {
-  const response = await fetch(`${baseUrl}${endpoint}`, {
+  const response = await fetch(requestUrl(endpoint), {
     method: 'PUT',
     headers: createHeaders(),
     body: body ? JSON.stringify(body) : undefined,
@@ -93,7 +142,7 @@ export async function put<T>(endpoint: string, body?: unknown): Promise<T> {
  * PATCH request
  */
 export async function patch<T>(endpoint: string, body?: unknown): Promise<T> {
-  const response = await fetch(`${baseUrl}${endpoint}`, {
+  const response = await fetch(requestUrl(endpoint), {
     method: 'PATCH',
     headers: createHeaders(),
     body: body ? JSON.stringify(body) : undefined,
@@ -106,7 +155,7 @@ export async function patch<T>(endpoint: string, body?: unknown): Promise<T> {
  * DELETE request
  */
 export async function del<T>(endpoint: string): Promise<T> {
-  const response = await fetch(`${baseUrl}${endpoint}`, {
+  const response = await fetch(requestUrl(endpoint), {
     method: 'DELETE',
     headers: createHeaders(),
   })

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.255",
+  "version": "0.75.257",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.255",
+  "version": "0.75.257",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -24,6 +24,7 @@
     "ide",
     "lang",
     "routes",
+    "scaffold",
     "stores",
     "styles",
     "types",
@@ -44,9 +45,9 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.255",
-    "@stacksjs/sanitizer": "^0.2.534",
-    "@stacksjs/stx": "^0.2.631",
+    "@stacksjs/mobile": "0.75.257",
+    "@stacksjs/sanitizer": "0.2.644",
+    "@stacksjs/stx": "0.2.644",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "ts-qr-codes": "^0.1.8"

package/resources/components/Dashboard/App/SourceInventory.stx

@@ -27,6 +27,16 @@ const loading = state(true)
 const loadError = state('')
 const copyMessage = state('')
 
+/**
+ * Actions and Commands read the same way but do not have the same shape.
+ *
+ * An Action resolves through two roots: `app/Actions/<path>.ts` shadows the
+ * framework default at the same path, so a row has an origin worth showing.
+ * Commands have one root. `buddy` loads `app/Commands` and nothing else, so
+ * every row is application code and an origin column would be one repeated
+ * word. `defaults/app/Commands` is what `buddy new` copies into a new app,
+ * not a default the loader falls back to.
+ */
 const page = derived(() => mode() === 'actions'
   ? {
       title: 'Actions',
@@ -35,14 +45,30 @@ const page = derived(() => mode() === 'actions'
       scaffold: 'buddy make:action MyAction',
       icon: 'i-hugeicons-energy',
       detailLabel: 'Method',
+      note: 'Application files override matching framework defaults.',
+      showOrigin: true,
+      stats: [
+        { key: 'total', label: 'Total Actions' },
+        { key: 'application', label: 'Application Overrides' },
+        { key: 'framework', label: 'Framework Defaults' },
+        { key: 'writes', label: 'Write Handlers' },
+      ],
     }
   : {
       title: 'Commands',
-      description: 'Inspect the custom commands registered by app/Commands.ts.',
-      empty: 'No application commands are registered.',
+      description: 'Inspect the commands this application defines in app/Commands.',
+      empty: 'No command files in app/Commands.',
       scaffold: 'buddy make:command my-command',
       icon: 'i-hugeicons-command-line',
       detailLabel: 'Aliases and options',
+      note: 'Every file in app/Commands is a command. The optional app/Commands.ts only orders, aliases or disables them.',
+      showOrigin: false,
+      stats: [
+        { key: 'total', label: 'Commands' },
+        { key: 'registered', label: 'Registry Entries' },
+        { key: 'aliases', label: 'Aliases' },
+        { key: 'options', label: 'Declared Options' },
+      ],
     })
 
 const filteredItems = derived(() => {
@@ -152,17 +178,17 @@ onMount(() => {
   </div>
 
   <div class="grid gap-4 grid-cols-1 sm:grid-cols-2 xl:grid-cols-4">
-    <StatsCard :title="mode() === 'actions' ? 'Total Actions' : 'Registered Entries'" :icon="page().icon" iconBg="primary">
-      <template #value>{{ statValue(mode() === 'actions' ? 'total' : 'registered') }}</template>
+    <StatsCard :title="page().stats[0].label" :icon="page().icon" iconBg="primary">
+      <template #value>{{ statValue(page().stats[0].key) }}</template>
     </StatsCard>
-    <StatsCard :title="mode() === 'actions' ? 'Application Overrides' : 'Command Modules'" icon="i-hugeicons-source-code" iconBg="success">
-      <template #value>{{ statValue(mode() === 'actions' ? 'application' : 'total') }}</template>
+    <StatsCard :title="page().stats[1].label" icon="i-hugeicons-source-code" iconBg="success">
+      <template #value>{{ statValue(page().stats[1].key) }}</template>
     </StatsCard>
-    <StatsCard :title="mode() === 'actions' ? 'Framework Defaults' : 'Aliases'" icon="i-hugeicons-git-branch" iconBg="info">
-      <template #value>{{ statValue(mode() === 'actions' ? 'framework' : 'aliases') }}</template>
+    <StatsCard :title="page().stats[2].label" icon="i-hugeicons-git-branch" iconBg="info">
+      <template #value>{{ statValue(page().stats[2].key) }}</template>
     </StatsCard>
-    <StatsCard :title="mode() === 'actions' ? 'Write Handlers' : 'Declared Options'" icon="i-hugeicons-settings-02" iconBg="warning">
-      <template #value>{{ statValue(mode() === 'actions' ? 'writes' : 'options') }}</template>
+    <StatsCard :title="page().stats[3].label" icon="i-hugeicons-settings-02" iconBg="warning">
+      <template #value>{{ statValue(page().stats[3].key) }}</template>
     </StatsCard>
   </div>
 
@@ -170,7 +196,7 @@ onMount(() => {
     <div class="flex flex-col gap-4 sm:flex-row sm:items-center sm:justify-between p-5 border-b border-neutral-200 dark:border-neutral-700">
       <div>
         <h2 class="font-semibold text-neutral-900 dark:text-white">Native source inventory</h2>
-        <p class="mt-1 text-neutral-500 text-xs dark:text-neutral-400">Application files override matching framework defaults.</p>
+        <p class="mt-1 text-neutral-500 text-xs dark:text-neutral-400">{{ page().note }}</p>
       </div>
       <label class="block relative w-full sm:max-w-xs">
         <span class="sr-only">Search {{ page().title.toLowerCase() }}</span>
@@ -197,7 +223,7 @@ onMount(() => {
           <tr>
             <th class="pl-5 pr-4 py-3 font-semibold text-left text-neutral-500 text-xs tracking-wider uppercase dark:text-neutral-400">Name</th>
             <th class="px-4 py-3 font-semibold text-left text-neutral-500 text-xs tracking-wider uppercase dark:text-neutral-400">{{ page().detailLabel }}</th>
-            <th class="px-4 py-3 font-semibold text-left text-neutral-500 text-xs tracking-wider uppercase dark:text-neutral-400">Origin</th>
+            <th :if="page().showOrigin" class="px-4 py-3 font-semibold text-left text-neutral-500 text-xs tracking-wider uppercase dark:text-neutral-400">Origin</th>
             <th class="px-4 py-3 font-semibold text-left text-neutral-500 text-xs tracking-wider uppercase dark:text-neutral-400">Path</th>
             <th class="pr-5 py-3 font-semibold text-neutral-500 text-right text-xs tracking-wider uppercase dark:text-neutral-400">Modified</th>
           </tr>
@@ -215,7 +241,7 @@ onMount(() => {
                 <p class="text-neutral-700 dark:text-neutral-300"><span class="text-neutral-500 dark:text-neutral-400">Options:</span> {{ formatOptions(item) }}</p>
               </div>
             </td>
-            <td class="px-4 py-3.5">
+            <td :if="page().showOrigin" class="px-4 py-3.5">
               <span :class="'inline-flex px-2 py-0.5 font-medium text-xs rounded ' + (item.origin === 'Application' ? 'text-green-700 dark:text-green-300 bg-green-50 dark:bg-green-950/40' : 'text-neutral-700 dark:text-neutral-300 bg-neutral-100 dark:bg-neutral-800')">{{ item.origin }}</span>
             </td>
             <td class="px-4 py-3.5 font-mono text-neutral-600 text-xs dark:text-neutral-300">{{ item.path }}</td>

package/resources/components/Dashboard/Content/BlogPostEditorDialog.stx

@@ -24,7 +24,11 @@ interface BlogPostDraft {
 }
 
 const open = useReactiveProp('open', false)
-const post = useReactiveProp('post', null as BlogPostRecord | null)
+// Named `editing`, not `post`, while still reading the `post` prop.
+// A bare `post` in a `{{ … }}` interpolation is resolved server-side
+// against module and global scope, where it finds the dashboard API
+// client's own `post()` and calls it mid-render (stacksjs/stacks#2944).
+const editing = useReactiveProp('post', null as BlogPostRecord | null)
 const loadedBody = useReactiveProp('loadedBody', '')
 const bodyLoading = useReactiveProp('bodyLoading', false)
 const bodyLoadFailed = useReactiveProp('bodyLoadFailed', false)
@@ -54,13 +58,13 @@ function slugify(input: string): string {
 const suggestedSlug = derived(() => slugify(title()))
 const wordCount = derived(() => body().split(/\s+/).filter(Boolean).length)
 const readingTime = derived(() => Math.max(1, Math.round(wordCount() / 200)))
-const dialogTitle = derived(() => post() ? 'Edit post' : 'New post')
-const actionLabel = derived(() => post() ? 'Save post' : 'Create post')
+const dialogTitle = derived(() => editing() ? 'Edit post' : 'New post')
+const actionLabel = derived(() => editing() ? 'Save post' : 'Create post')
 
 effect(() => {
   const isOpen = open()
   if (isOpen && !wasOpen) {
-    const record = post()
+    const record = editing()
     activeSlug = record?.slug || ''
     title.set(record?.title || '')
     slug.set(record?.slug || '')
@@ -76,7 +80,7 @@ effect(() => {
 })
 
 effect(() => {
-  if (open() && post()?.slug === activeSlug && !bodyLoading())
+  if (open() && editing()?.slug === activeSlug && !bodyLoading())
     body.set(loadedBody())
 })