@stacksjs/defaults 0.75.31 → 0.75.33

package/ai/skills/stacks-actions/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: stacks-actions
-description: Use when working with Stacks server actions - creating actions in app/Actions/, auto-generated API actions from the useApi model trait, the 634 default framework actions (auth, dashboard, commerce, content, deployment, jobs), action request/response handling, or action registration. Covers @stacksjs/actions and storage/framework/defaults/app/Actions/.
+description: Use when working with Stacks server actions - creating actions in app/Actions/, auto-generated API actions from the useApi model trait, the 647 default framework actions (auth, dashboard, commerce, content, deployment, jobs), action request/response handling, or action registration. Covers @stacksjs/actions and storage/framework/defaults/app/Actions/.
 license: MIT
 compatibility: Bun >= 1.3.0, TypeScript
 allowed-tools: Read Edit Write Bash Grep Glob

package/ai/skills/stacks-auth/SKILL.md

@@ -295,7 +295,7 @@ interface RbacStore { findRoleByName, createRole, deleteRole, getAllRoles, findP
 - `SessionAuth.check(sessionId): boolean`
 - `SessionAuth.refresh(sessionId, ttlMs?): boolean`, rejects non-positive or non-finite TTLs without changing the session
 
-Internal: in-memory Map with 10k session limit, 5-minute eviction interval, timing-safe password comparison with dummy bcrypt hash.
+Internal: database-backed `sessions` rows with expiry, optional IP/User-Agent fingerprint checks, transactional logout and refresh, and timing-safe password comparison with a dummy bcrypt hash. Sessions survive process restarts and are shared by workers through the configured database.
 
 ## Email Verification (email-verification.ts)
 
@@ -395,7 +395,6 @@ await authUser.authorize('edit-post', post)  // throws if denied
     withRefreshToken: false, // fixed browser lifetime, no unused refresh token
     logoutRedirect: '/login?logged_out=1', // local path for HTML logout only
   },
-  tokenRotation: 24,       // hours
   defaultAbilities: ['*'],
   defaultTokenName: 'auth-token',
   passwordReset: { expire: 60, throttle: 60 }
@@ -505,12 +504,12 @@ traits: {
 
 - Auth depends on `@stacksjs/ts-auth` for TOTP and passkey functions
 - Password hashing defaults to bcrypt with 12 rounds (config/hashing.ts)
-- Rate limiter uses in-memory Map, resets on server restart — not shared across workers
-- Session auth also uses in-memory Map with 10k limit — for SPA cookie auth
-- Token format is `tokenId|plainText` — the `|` separates the encrypted ID from the plain token
-- The `parseToken()` helper splits on `|` to extract both parts
+- Rate limiting uses a process-local memory store by default. Production deployments with multiple workers should configure the atomic Redis store or provide a custom atomic store.
+- Session auth is database-backed through the `sessions` table, so it survives server restarts and is shared across workers.
+- New personal and delegated access tokens are opaque 40-byte hex bearers hashed at rest. Legacy `jwt:encryptedId` bearers remain readable during migration.
+- Token validation hashes the bearer directly. Do not parse or expose token contents, and never log plaintext bearer values.
 - Bearer tokens come from the `Authorization: Bearer <token>` header
-- `Auth.user()` internally calls `getBearerToken()` → `parseToken()` → `getTokenFromId()` → validates hash
+- `Auth.user()` internally calls `getBearerToken()` and resolves the bearer through a hashed token lookup
 - RBAC has an internal cache (`userRoles`, `userPermissions`, `rolePermissions`) — call `Rbac.flushCache()` after direct DB changes
 - `syncRoles()` and `syncPermissions()` are guard-scoped replacements: they preserve assignments belonging to other guards
 - Gate `before` callbacks can short-circuit — return `true` to allow, `null` to continue checking

package/ai/skills/stacks-config/SKILL.md

@@ -66,7 +66,7 @@ they name: `defineEvents` and `defineListener` from `@stacksjs/events`,
 | File | Type | Key Settings |
 |------|------|-------------|
 | `app.ts` | AppConfig | name, env, url, debug, key, timezone, locale |
-| `auth.ts` | AuthConfig | guards, providers, tokenExpiry(30d), tokenRotation(7d), passwordReset |
+| `auth.ts` | AuthConfig | guards, providers, token and browser-session lifetimes, passwordReset |
 | `database.ts` | DatabaseConfig | default driver, connections (sqlite/mysql/postgres/dynamodb), queryLogging |
 | `cache.ts` | CacheConfig | driver('memory'), ttl(3600), maxKeys(-1), redis config |
 | `env.ts` | EnvConfig | validation schemas for env vars |

package/ai/skills/stacks-email/SKILL.md

@@ -238,6 +238,12 @@ abstract class BaseEmailDriver {
 }
 ```
 
+### Mail DNS a deploy publishes
+
+With `server.enabled`, `buddy deploy` reconciles the mail domain's DNS through whichever configured provider holds the zone: MX, SPF, DKIM at the selector the server signs under, DMARC (`server.dmarc`), `mail.<domain>`, and the Gmail Postmaster Tools verification TXT when `server.postmaster.google` is set. Writes are surgical: only records the deploy owns are replaced, so other apex TXT (Search Console, other verifications) survive.
+
+Postmaster Tools is the only view of why Gmail files mail as spam when SPF, DKIM and DMARC all pass. Its value is issued per Google account and cannot be generated: add the domain at https://postmaster.google.com, copy the TXT value, set `server.postmaster.google`, deploy, then press Verify in Postmaster Tools. Until it is set the deploy prints where to get it; `postmaster: false` silences that.
+
 ## Application Mail Example
 
 ```typescript

package/ai/skills/stacks-types/SKILL.md

@@ -29,7 +29,7 @@ interface AuthConfig {
   username: string
   password: string
   tokenExpiry: number           // 30 days
-  tokenRotation: number         // 7 days
+  tokenRotation?: number        // deprecated; rotate explicitly
   defaultAbilities: string[]
   defaultTokenName: string
 }

package/app/Actions/Auth/OAuthAuthorizationAction.ts

@@ -31,7 +31,9 @@ async function renderConsentView(
   const { renderTemplate } = await import('@stacksjs/stx')
 
   return String(await renderTemplate(template, {
-    context,
+    // Spread into a literal: an interface has no index signature, so it is
+    // not a Record<string, unknown> until it becomes an object literal.
+    context: { ...context },
     injectCSS: true,
     templateOnly: true,
     processClientScripts: false,

package/app/Actions/Auth/OAuthConsentAction.ts

@@ -18,8 +18,12 @@ export default new Action({
     if (!provider)
       return response.notFound('OAuth provider is not enabled')
 
+    // Check `user` itself rather than only through `id`, so the workspace
+    // resolver below sees a narrowed user instead of `AuthenticatedUser | undefined`.
     const user = await request.user()
-    const id = user ? oauthPositiveId(user.id) : null
+    if (!user)
+      return response.unauthorized('Authentication required')
+    const id = oauthPositiveId(user.id)
     if (!id)
       return response.unauthorized('Authentication required')
 

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.31",
+  "version": "0.75.33",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.31",
+  "version": "0.75.33",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -55,7 +55,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.75.31",
+    "@stacksjs/mobile": "^0.75.33",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/project/storage/framework/types/src/auth.ts

@@ -19,7 +19,8 @@ export interface AuthConfig {
   username: string
   password: string
   tokenExpiry: number
-  tokenRotation: number
+  /** @deprecated Use explicit bearer rotation or a refresh-token exchange. */
+  tokenRotation?: number
   defaultAbilities: string[]
   defaultTokenName: string
 }