@stacksjs/defaults 0.75.409 → 0.75.418

package/ai/skills/stacks-auth/SKILL.md

@@ -733,3 +733,14 @@ not authenticate them. OAuth resource endpoints must explicitly use
 `authorizeOAuthDelegatedToken` with the exact resource, audience, workspace and
 required scopes. Ordinary refresh also refuses delegated refresh credentials;
 use the OAuth token endpoint and the registered client's protocol authentication.
+
+## Token-only recovery endpoints
+
+For high-entropy reset credentials, `mintPasswordResetToken()` returns `{ token, digest }`.
+Store the digest in `password_resets.token`, never the plaintext.
+`consumePasswordResetToken(token, async claim => { ... })` locks the owner and token,
+checks the stored expiry and consumes it in the same transaction as callback writes.
+`claim` is `{ userId, email, hasExplicitExpiry }`; result is `{ consumed: false }` or
+`{ consumed: true, value }`. Failures roll back the credential and account changes.
+Use database work only in the callback, and send notifications after commit.
+The existing `passwordResets(email)` flow supports email-addressed bcrypt tokens.

package/ai/skills/stacks-browser-extension/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: stacks-browser-extension
-description: Use when scaffolding, building, packaging or preparing store submission for a native Stacks MV3 browser extension. Covers @stacksjs/browser-extension and Chrome/Firefox/Safari target boundaries.
+description: Use when scaffolding, building, packaging or preparing store submission for a native Stacks MV3 browser extension, or shipping its rules and content scripts to a WKWebView app. Covers @stacksjs/browser-extension and Chrome/Firefox/Safari/WebKit target boundaries.
 license: MIT
 compatibility: Bun >= 1.3.0, TypeScript
 allowed-tools: Read Edit Write Bash Grep Glob
@@ -26,6 +26,30 @@ and Firefox. Safari additionally uses container-app scaffolding, resource sync
 and xcodebuild on a suitable macOS toolchain. Target limitations are explicit;
 do not substitute one browser's package for another.
 
+## WebKit target
+
+`buddy extension:build --target webkit` writes `dist-webkit/` for apps that
+embed WKWebView and have no extension runtime: the DNR rulesets (plus
+`webkit.dynamicRules` and `webkit.cosmetic` sources) as WebKit content-blocker
+lists in `lists/<id>.json`, every content script as a standalone
+`WKUserScript` in `scripts/<id>.js`, and a `manifest.json` describing both.
+It never changes the Chrome, Firefox or Safari outputs.
+
+The converter is `src/webkit.ts` (`buildWebKitLists`, `convertDnrRule`,
+`urlFilterToWebKitRegex`, `regexFilterToWebKit`), importable at runtime as
+`@stacksjs/browser-extension/webkit`. Lists split under `maxRulesPerList`
+(default 50,000; WebKit refuses more than 150,000) with a stable id and a
+content-hash version. What WebKit cannot express (redirect, modifyHeaders,
+method/tab/header conditions, `excludedRequestDomains`, lookaround regexes) is
+counted in `report.unsupported`; looser or narrower matches in
+`report.approximated`. Neither is dropped silently, so read the report.
+
+Isolated-world scripts that call `chrome.runtime` / `chrome.storage` are
+bridged to `window.webkit.messageHandlers.<name>`; the host app implements
+that handler. The mapping table, ordering rules and message contract are in
+[WEBKIT.md](WEBKIT.md). Ship `dist-webkit` to apps through a library package's
+`assets` (see `stacks-build`).
+
 ## Store preparation and publication
 
 The package includes publish plans and adapters for Chrome Web Store, Firefox
@@ -37,4 +61,5 @@ credentials into the extension's public files.
 Verify generated manifests, CSP, permissions, scripts, packaged file lists,
 and target-specific tests. Device and store outcomes need their own evidence.
 Source: core/browser-extension/src/{config,manifest,build,package,scaffold,
-publish-plan,safari}.ts and store adapters. Tests cover these same boundaries.
+publish-plan,safari,webkit,webkit-scripts,webkit-build}.ts and store adapters.
+Tests cover these same boundaries.

package/ai/skills/stacks-browser-extension/WEBKIT.md

@@ -0,0 +1,139 @@
+# The WebKit target
+
+`buddy extension:build --target webkit` (or `targets: [..., 'webkit']`) builds
+an extension for apps that embed WKWebView. Source: `src/webkit.ts` (the
+converter), `src/webkit-scripts.ts` (user scripts and the bridge),
+`src/webkit-build.ts` (the build). Tests: `tests/webkit.test.ts`,
+`tests/webkit-build.test.ts`.
+
+## Config
+
+```ts
+defineExtension({
+  rules: [{ id: 'static', source: 'src/rules/static.ts' }],   // each becomes a list group
+  content: [/* ... */],                                          // each becomes a user script
+  webkit: {
+    maxRulesPerList: 50_000,                                     // WebKit's own cap is 150,000
+    dynamicRules: [{ id: 'dynamic', source: 'src/rules/webkit.ts#dynamicRules' }],   // path#export
+    cosmetic: [
+      { id: 'cosmetic', source: 'src/rules/webkit.ts#cosmetic' },
+      { id: 'cosmetic-consent', source: 'src/rules/webkit.ts#consent', enabled: false },
+    ],
+    selectorsPerRule: 100,
+    messageHandler: 'my-extension',                              // default: the name as a slug
+    excludeScripts: [],                                          // by output name, e.g. 'content'
+  },
+})
+```
+
+A source is a module path, or `path#name` for one of its exports (a function
+is called). A `dynamicRules` source returns DNR rules (the defaults the extension would
+install with `updateDynamicRules`). A `cosmetic` source returns
+`WebKitCosmeticRule[]`: `{ selector: string | string[], domains?, excludedDomains? }`.
+
+## Output
+
+```
+dist-webkit/
+  manifest.json        format 'stacks-webkit', formatVersion 1
+  lists/<id>.json      the JSON array for WKContentRuleListStore.compileContentRuleList
+  scripts/<id>.js      WKUserScript source
+```
+
+`manifest.json` lists `{ id, version, group, kind, enabled, ruleCount, file }`
+per list, `{ id, file, matches, excludeMatches, runAt, allFrames,
+matchAboutBlank, world, bridged, apis, unsupportedApis }` per script, the
+bridge's `{ messageHandler, version }`, and the conversion `report`.
+
+Compile each list under its `id` and recompile only when `version` (a SHA-256
+prefix of the rules) changes. `enabled: false` mirrors a ruleset the extension
+leaves off by default. `runAt` is `document-start` or `document-end` (DNR's
+`document_idle` has no WebKit counterpart). `world: 'page'` is
+`WKContentWorld.page`; `isolated` is a content world of the app's own.
+`matches` are extension match patterns for the app to test URLs against.
+
+## DNR to WebKit
+
+| DNR | WebKit |
+|---|---|
+| `urlFilter` `\|\|host^` | `^[a-z][a-z0-9+.-]*://([^/:]*\.)?host[:/]` |
+| `urlFilter` `^` / trailing `^` / `*` / `\|` | `[^a-zA-Z0-9_.%-]` / `([^…].*)?$` / `.*` / `^`, `$` |
+| `regexFilter` | passed through; `\d`, `\w`, `(?:)`, `{n,m}` rewritten; alternation expanded into one rule per alternative (64 max) |
+| `requestDomains` | one host-anchored `url-filter` per domain |
+| `initiatorDomains` / `excludedInitiatorDomains` | `if-domain` / `unless-domain` (`*domain`) |
+| `domainType` | `load-type` |
+| `isUrlFilterCaseSensitive` | `url-filter-is-case-sensitive` |
+| `resourceTypes` | `resource-type`; `main_frame` is `document` + `load-context: top-frame` plus a `popup` rule, `sub_frame` is `document` + `load-context: child-frame`; `xmlhttprequest` is `fetch`, `csp_report` is `ping`, `object` is `other` |
+| `block` / `allow` / `upgradeScheme` | `block` / `ignore-previous-rules` / `make-https` |
+| `allowAllRequests` | `ignore-previous-rules` on `.*`, `if-domain` the page's domain |
+
+DNR leaves top-level documents out when a rule names no resource types; WebKit
+includes them, so those rules spell the frames out. Unsupported, and counted
+in `report.unsupported`: `redirect`, `modifyHeaders`, request-method, tab and
+response-header conditions, `excludedRequestDomains`, regex lookaround or
+back-references, exclusions under an included domain, non-ASCII filters, and
+cosmetic selectors with procedural (adblock-only) pseudo-classes or broken
+syntax.
+
+## Ordering and splitting
+
+`ignore-previous-rules` only lifts rules before it in the same list, and each
+list compiles alone while DNR evaluates every ruleset together. So each list is
+sorted by DNR priority, then DNR precedence (make-https, block,
+allowAllRequests, allow), and every network list repeats the exceptions of all
+enabled groups (a disabled group adds its own to its own lists). Exceptions
+count toward `maxRulesPerList`. Cosmetic lists receive no network exceptions:
+a DNR `allow` never unhides elements in the extension either. To allowlist a
+site in the app, leave its lists off that page's content controller or
+recompile with a page-wide `ignore-previous-rules`.
+
+Requires a current WebKit (`load-context` and the `fetch`/`websocket`/`other`
+resource types).
+
+## The bridge (contract v1)
+
+Isolated-world scripts that touch `chrome.*` are wrapped so `chrome` and
+`browser` are the bridge; the page gets no global. Supported: `runtime.sendMessage`,
+`runtime.onMessage`, `runtime.id`, `runtime.lastError`,
+`storage.{local,sync,session}.{get,set,remove,clear,onChanged}` and
+`storage.onChanged`. Anything else is listed in the script's
+`unsupportedApis` and fails at runtime.
+
+Register the handler with `WKScriptMessageHandlerWithReply` so `postMessage`
+resolves to your reply. Page to app:
+
+| `body.api` | `body.payload` | reply |
+|---|---|---|
+| `runtime.sendMessage` | `{ message }` | the response, or null |
+| `storage.get` | `{ area, keys: null \| string \| string[] \| object }` | the stored items (the bridge fills in object defaults) |
+| `storage.set` | `{ area, items }` | null |
+| `storage.remove` | `{ area, keys: string[] }` | null |
+| `storage.clear` | `{ area }` | null |
+
+Every body has `v: 1`. A rejected reply rejects the call (callback callers see
+`chrome.runtime.lastError`). App to page, evaluated in the script's content
+world with `callAsyncJavaScript`:
+
+```js
+__stacksWebKit[handler].dispatch({ type: 'runtime.message', message, sender }) // resolves to the first response
+__stacksWebKit[handler].dispatch({ type: 'storage.changed', area, changes })    // { key: { oldValue, newValue } }
+```
+
+## Publishing to apps
+
+Ship `dist-webkit` in a library package and give it a small typed reader in
+`resources/functions`:
+
+```ts
+// config/library.ts
+packages: [{
+  name: 'my-blocker',
+  include: ['webkit.ts'],
+  registry: 'npm',
+  prebuild: 'buddy extension:build --target webkit',
+  assets: { webkit: 'dist-webkit' },   // lands in dist/webkit/, exported as my-blocker/webkit/*
+}]
+```
+
+The reader resolves `new URL('./webkit/manifest.json', import.meta.url)`, which
+is `dist/webkit/manifest.json` once built.

package/ai/skills/stacks-build/SKILL.md

@@ -157,6 +157,19 @@ npm sets `registry: 'npm'`, which publishes with `pantry publish --npm`, or with
 Each package publishes its own `readme` (a project-relative Markdown file) as
 README.md, or a short one the build writes from its `description`.
 
+A package build compiles TypeScript and nothing else, so generated data (JSON,
+scripts, lists) ships through `assets`: `{ 'path/in/package': 'project/source' }`,
+copied into `dist/` after the compile. A path with an extension is a file and
+gets an exact export; any other path is a directory whose contents are exported
+as `<name>/<path>/*` (never `<name>/<path>` itself, which would shadow a module
+of the same name). Code reads them with `new URL('./<path>/…', import.meta.url)`.
+`prebuild` is a shell command run in the project root before the package
+builds, so the assets are regenerated rather than shipped stale:
+
+```ts
+{ name: 'my-blocker', include: ['webkit.ts'], prebuild: 'buddy extension:build --target webkit', assets: { webkit: 'dist-webkit' } }
+```
+
 ### Things that will stop a build, on purpose
 
 - **A package that matches no files.** Nearly always a typo'd glob, and the
@@ -164,6 +177,8 @@ README.md, or a short one the build writes from its `description`.
   packages instead, so an app that never filled in `resources/` is not blocked.
 - **Two packages that resolve to the same directory** (`@acme/ui` and
   `@other/ui` both unscope to `ui`). Give one an explicit `dir`.
+- **A missing asset, or a failed `prebuild`.** Publishing the previous output
+  of a step that just failed is how a stale package ships.
 - **stx ambient globals in a `functions` package.** `state`, `useDark` and the
   rest are injected into an stx page entry and exported by nothing, so a
   bundled copy compiles and then throws `ReferenceError` on the consumer's

package/ai/skills/stacks-cloud/SKILL.md

@@ -137,7 +137,9 @@ hostname. LAN HTTPS comes from a certificate authority on the box itself (rpx `l
 Let's Encrypt. To publish: routable address, ports 80 and 443 forwarded, a site with a domain, and
 `ssh.publicIp` set. `TS_CLOUD_SSH_PUBLISH_DNS=1` forces publishing on, `0` forces it off.
 
-**Shared boxes.** Both targets support `cloud.attachTo: '<owner slug>'`. An attached project skips
+**Shared boxes.** Set `tsCloud.cloud.attachTo` to
+`process.env.CLOUD_ATTACH_TO || undefined` in the named `tsCloud` export and
+supply the owner's slug through the protected deploy environment. An attached project skips
 provisioning and deploys only its own sites. Each project owns `/etc/rpx/sites.d/<slug>.json` and
 replaces it wholesale, so `project.slug` must be unique on the box, and the config must declare
 every domain that fragment currently serves or the deploy stops.
@@ -257,10 +259,13 @@ export const tsCloud: TsCloudConfig = {
   mode: 'server',
 }
 
-const config: CloudConfig = { tenants: ['attached-project'] }
+const config: CloudConfig = {}
 export default config
 ~~~
 
+Keep the tenant roster in `STACKS_CLOUD_TENANTS` or the private sources described
+in `stacks-env`. A declared `tenants` array remains available for private forks.
+
 Extend the named tsCloud object using its typed sites, environments and
 infrastructure options. The default Stacks wrapper holds surrounding settings
 such as tenant isolation. Provider configuration does not belong at an invented

package/ai/skills/stacks-datetime/SKILL.md

@@ -375,3 +375,11 @@ not jurisdiction-specific compensation or overtime decisions.
 localTimeSpan(date, start, end, ...zones) converts a clock interval, including
 next-day ends, to actual instants for cross-site/overnight overlap checks.
 Equal endpoints and non-positive DST-normalized intervals are rejected.
+
+## Conflicts across location clocks
+
+Convert each appointment using `localTimeSpan(date, start, end, ...zones)` and compare
+with `timeSpansOverlap(first, second)`. Intervals are half-open, so adjacent sessions
+do not conflict. Query neighboring local dates before comparing: simultaneous
+appointments can belong to different calendar dates in different zones. Never
+compare local clock strings from separate locations directly.

package/ai/skills/stacks-deploy/SKILL.md

@@ -227,8 +227,9 @@ buddy cloud:cleanup           # clean retained resources
 - On Hetzner and SSH, a project's `/etc/rpx/sites.d/<slug>.json` is replaced wholesale, so
   `project.slug` must be unique on a shared box and the config must declare every domain that
   fragment serves
-- `.env.<environment>` is decrypted at deploy time and shipped as every site's `.env`, so declare
-  `tenants` in `config/cloud.ts` on a shared box to strip other tenants' keys
+- `.env.<environment>` is decrypted at deploy time and shipped as every site's `.env`. Supply the
+  shared-box roster through `STACKS_CLOUD_TENANTS` or private tenant files so other tenants' keys
+  are stripped. See `stacks-env` for the private-source precedence.
 - A failover replica bucket (`infrastructure.storage.<name>.failover`) lives outside the stack, so
   `buddy cloud:remove` leaves it, and its data, behind on purpose
 - For infrastructure details, see the `stacks-cloud` skill

package/ai/skills/stacks-env/SKILL.md

@@ -285,26 +285,28 @@ When several projects share one server - one owns it, the rest attach with
 They leak anyway: a tenant's secrets get pasted into the owner's env file under
 a `TENANT_` prefix while debugging a deploy, and stay. That is not just untidy.
 `buddy deploy` ships the whole env file as **every** site's `.env` (ts-cloud
-treats `site.env` as the complete file), so a stray `BUGHQ_STRIPE_SECRET_KEY` in
+treats `site.env` as the complete file), so a stray `OTHERAPP_API_KEY` in
 the owner's file lands on disk in an unrelated site.
 
-Declare who is attached, in `config/cloud.ts`'s default export:
+Keep the tenant roster private. `buddy deploy` and `buddy env:check` merge:
 
-```typescript
-const config: CloudConfig = {
-  tenants: ['bughq', 'analyticshq'],
-}
-```
+- `STACKS_CLOUD_TENANTS`, a comma or whitespace separated list of slugs. CI
+  supplies this through a protected secret, without printing it.
+- `$STACKS_PRIVATE_DIR/tenants.json`, `~/.config/stacks/tenants.json`, and the
+  gitignored `storage/cloud/tenants.json`. Each accepts a JSON array of slugs
+  or an object with a `tenants` array.
+- A `tenants` array in `config/cloud.ts`'s default wrapper, retained for private
+  forks. Public repositories use the private sources above.
 
 With that:
 
 - `buddy deploy` drops those keys before shipping, and logs what it dropped
 - `buddy env:check` lists them per tenant so they can be deleted at source
 
-Prefixes are **never** inferred. With no `tenants` declared nothing is treated
+Prefixes are **never** inferred. With no tenant roster loaded nothing is treated
 as foreign, because `STRIPE_`, `AWS_` and `MEILISEARCH_` are indistinguishable
 from a slug prefix by shape alone. Slug punctuation is ignored, so
-`analytics-hq` and `analytics_hq` both match `ANALYTICSHQ_`.
+`other-app` and `other_app` both match `OTHERAPP_`.
 
 The API is `partitionTenantEnv(values, { self, tenants })` from
 `@stacksjs/env`, plus `stripForeignTenantEnv` and `foreignTenantKeys`.
@@ -330,8 +332,8 @@ calls or raw client-side `fetch`.
 
 ## Gotchas
 - **A tenant's keys in your env file get shipped everywhere.** `buddy deploy`
-  sends the entire env file as each site's `.env`. Declare `tenants` in
-  `config/cloud.ts` so they are stripped, then delete them at source
+  sends the entire env file as each site's `.env`. Supply the private tenant
+  roster so foreign keys are stripped, then delete them at source
 - Bun natively loads `.env` - no dotenv package needed
 - The `env` proxy auto-coerces strings to booleans/numbers
 - `.env` should never be committed - use `.env.example` as template

package/ai/skills/stacks-image/SKILL.md

@@ -35,3 +35,11 @@ STX uses img and the asset pipeline, not a framework-specific React image wrappe
 Test no-upscale behavior, requested formats, source authorization, negotiated
 responses, signed access and storage publication. Source: core/image/src/index.ts
 and its generation modules. Evidence: image.test.ts and generate.test.ts.
+
+## Private uploads
+
+Use `sanitizeImageUpload(bytes, { maxBytes?, maxPixels? })` before storing a private
+JPEG, PNG or WebP. It bounds bytes and pixels, applies camera orientation, strips
+source metadata by encoding only pixels, and returns canonical bytes/dimensions.
+The default caps are 12 MiB and 40 million pixels. Authorization, referencing and
+object retention remain application policy.

package/ai/skills/stacks-native/CATALOG.md

@@ -18,12 +18,12 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/api` | [`stacks-api`](../stacks-api/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/api/src/index.ts) | 9 |
 | `@stacksjs/arrays` | [`stacks-arrays`](../stacks-arrays/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/arrays/src/index.ts) | 6 |
 | `@stacksjs/audio` | [`stacks-audio`](../stacks-audio/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/audio/src/index.ts) | 3 |
-| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 124 |
+| `@stacksjs/auth` | [`stacks-auth`](../stacks-auth/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/index.ts) | 125 |
 | `@stacksjs/browser` | [`stacks-browser`](../stacks-browser/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser/src/index.ts) | 8 |
-| `@stacksjs/browser-extension` | [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/index.ts) | 7 |
-| `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 176 |
+| `@stacksjs/browser-extension` | [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/index.ts) | 9 |
+| `@stacksjs/buddy` | [`stacks-buddy`](../stacks-buddy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/index.ts) | 177 |
 | `@stacksjs/build` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/build/src/index.ts) | 5 |
-| `@stacksjs/cache` | [`stacks-cache`](../stacks-cache/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/index.ts) | 18 |
+| `@stacksjs/cache` | [`stacks-cache`](../stacks-cache/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/index.ts) | 23 |
 | `@stacksjs/calendar-api` | [`stacks-calendar`](../stacks-calendar/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/calendar-api/src/index.ts) | 2 |
 | `@stacksjs/charts` | [`stacks-charts`](../stacks-charts/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/charts/src/index.ts) | 3 |
 | `@stacksjs/chat` | [`stacks-chat`](../stacks-chat/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/chat/src/index.ts) | 5 |
@@ -36,7 +36,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/config` | [`stacks-config`](../stacks-config/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/config/src/index.ts) | 16 |
 | `@stacksjs/cron` | [`stacks-cron`](../stacks-cron/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cron/src/index.ts) | 6 |
 | `@stacksjs/database` | [`stacks-database`](../stacks-database/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/database/src/index.ts) | 135 |
-| `@stacksjs/datetime` | [`stacks-datetime`](../stacks-datetime/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/index.ts) | 13 |
+| `@stacksjs/datetime` | [`stacks-datetime`](../stacks-datetime/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/index.ts) | 14 |
 | `@stacksjs/defaults` | [`stacks-build`](../stacks-build/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/defaults/package.json) | 2 |
 | `@stacksjs/deploy` | [`stacks-deploy`](../stacks-deploy/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/deploy/package.json) | 1 |
 | `@stacksjs/desktop-build` | [`stacks-desktop`](../stacks-desktop/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/index.ts) | 15 |
@@ -57,7 +57,7 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/health` | [`stacks-health`](../stacks-health/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/health/src/index.ts) | 2 |
 | `@stacksjs/http` | [`stacks-http`](../stacks-http/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/http/src/index.ts) | 2 |
 | `@stacksjs/i18n` | [`stacks-i18n`](../stacks-i18n/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/i18n/src/index.ts) | 4 |
-| `@stacksjs/image` | [`stacks-image`](../stacks-image/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/index.ts) | 2 |
+| `@stacksjs/image` | [`stacks-image`](../stacks-image/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/index.ts) | 3 |
 | `@stacksjs/lint` | [`stacks-lint`](../stacks-lint/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/lint/src/index.ts) | 3 |
 | `@stacksjs/logging` | [`stacks-logging`](../stacks-logging/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/logging/src/index.ts) | 14 |
 | `@stacksjs/mobile` | [`stacks-mobile`](../stacks-mobile/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/mobile/src/index.ts) | 23 |
@@ -86,9 +86,9 @@ Browser runtime bindings are documented separately in `stacks-auto-imports`.
 | `@stacksjs/slug` | [`stacks-slug`](../stacks-slug/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/slug/src/index.ts) | 5 |
 | `@stacksjs/sms` | [`stacks-sms`](../stacks-sms/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/sms/src/index.ts) | 5 |
 | `@stacksjs/socials` | [`stacks-socials`](../stacks-socials/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/socials/src/index.ts) | 17 |
-| `@stacksjs/storage` | [`stacks-storage`](../stacks-storage/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/index.ts) | 42 |
+| `@stacksjs/storage` | [`stacks-storage`](../stacks-storage/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/index.ts) | 47 |
 | `@stacksjs/strings` | [`stacks-strings`](../stacks-strings/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/strings/src/index.ts) | 7 |
-| `@stacksjs/testing` | [`stacks-testing`](../stacks-testing/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/index.ts) | 20 |
+| `@stacksjs/testing` | [`stacks-testing`](../stacks-testing/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/index.ts) | 21 |
 | `@stacksjs/tinker` | [`stacks-repl`](../stacks-repl/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tinker/src/index.ts) | 1 |
 | `@stacksjs/tunnel` | [`stacks-tunnel`](../stacks-tunnel/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/tunnel/src/index.ts) | 1 |
 | `@stacksjs/types` | [`stacks-types`](../stacks-types/SKILL.md) | [entrypoint](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/types/src/index.ts) | 2 |
@@ -185,9 +185,9 @@ Guidance: [`stacks-auth`](../stacks-auth/SKILL.md). Source: [storage/framework/c
 
 Declared runtime exports: `DEFAULT_ROLE_PACKS`, `createBqbRbacStore`, `generateTOTP`, `generateTOTPSecret`, `requestImpersonation`, `seedDefaultRoles`, `totpKeyUri`, `verifyTOTP`.
 
-Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/impersonation-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation-auth.ts), [src/impersonation-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation-store.ts), [src/impersonation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-dynamic-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-dynamic-registration.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-protected-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-protected-resource.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-server.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-server.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/passkeys.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkeys.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/session-handoff.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-handoff.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
+Local source modules: [src/authentication.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authentication.ts), [src/authenticator.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authenticator.ts), [src/authorizable.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/authorizable.ts), [src/browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/browser-session.ts), [src/client.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/client.ts), [src/cookie-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/cookie-auth.ts), [src/credential-user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/credential-user.ts), [src/email-verification.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/email-verification.ts), [src/gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/gate.ts), [src/impersonation-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation-auth.ts), [src/impersonation-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation-store.ts), [src/impersonation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/impersonation.ts), [src/magic-link.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/magic-link.ts), [src/middleware.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/middleware.ts), [src/oauth-authorization-codes.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-codes.ts), [src/oauth-authorization-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-endpoint.ts), [src/oauth-authorization-requests.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-requests.ts), [src/oauth-authorization-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization-response.ts), [src/oauth-authorization.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-authorization.ts), [src/oauth-browser-session.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-browser-session.ts), [src/oauth-client-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-client-registration.ts), [src/oauth-consent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-consent.ts), [src/oauth-delegated-access.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-delegated-access.ts), [src/oauth-dynamic-registration.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-dynamic-registration.ts), [src/oauth-grants.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-grants.ts), [src/oauth-introspection.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-introspection.ts), [src/oauth-metadata.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-metadata.ts), [src/oauth-pkce.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pkce.ts), [src/oauth-protected-resource.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-protected-resource.ts), [src/oauth-provider.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-provider.ts), [src/oauth-pruning.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-pruning.ts), [src/oauth-revocation.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-revocation.ts), [src/oauth-server.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-server.ts), [src/oauth-token-endpoint.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-endpoint.ts), [src/oauth-token-exchange.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-exchange.ts), [src/oauth-token-request.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-request.ts), [src/oauth-token-response.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/oauth-token-response.ts), [src/page-gate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/page-gate.ts), [src/passkey.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkey.ts), [src/passkeys.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/passkeys.ts), [src/password/reset-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset-token.ts), [src/password/reset.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/password/reset.ts), [src/permissions.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/permissions.ts), [src/policy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/policy.ts), [src/rate-limiter.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rate-limiter.ts), [src/rbac-seed.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-seed.ts), [src/rbac-store-bqb.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac-store-bqb.ts), [src/rbac.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/rbac.ts), [src/referrals.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/referrals.ts), [src/register.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/register.ts), [src/request-token.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/request-token.ts), [src/session-auth.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-auth.ts), [src/session-handoff.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/session-handoff.ts), [src/socials.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/socials.ts), [src/team.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/team.ts), [src/tokens.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/tokens.ts), [src/two-factor.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/two-factor.ts), [src/user.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/src/user.ts).
 
-Evidence directory: [124 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [125 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/auth/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/browser
 
@@ -205,9 +205,9 @@ Guidance: [`stacks-browser-extension`](../stacks-browser-extension/SKILL.md). So
 
 Read the entrypoint and package export map for re-exported or type-only surfaces.
 
-Local source modules: [src/app-store-connect.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/app-store-connect.ts), [src/app-store-submission.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/app-store-submission.ts), [src/build.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/build.ts), [src/chrome-web-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/chrome-web-store.ts), [src/config.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/config.ts), [src/firefox-addons.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/firefox-addons.ts), [src/firefox-previews.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/firefox-previews.ts), [src/manifest.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/manifest.ts), [src/package.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/package.ts), [src/publish-plan.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/publish-plan.ts), [src/safari.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/safari.ts), [src/sanitize.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/sanitize.ts), [src/scaffold.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/scaffold.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/types.ts).
+Local source modules: [src/app-store-connect.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/app-store-connect.ts), [src/app-store-submission.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/app-store-submission.ts), [src/build.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/build.ts), [src/chrome-web-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/chrome-web-store.ts), [src/config.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/config.ts), [src/firefox-addons.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/firefox-addons.ts), [src/firefox-previews.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/firefox-previews.ts), [src/manifest.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/manifest.ts), [src/package.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/package.ts), [src/publish-plan.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/publish-plan.ts), [src/safari.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/safari.ts), [src/sanitize.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/sanitize.ts), [src/scaffold.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/scaffold.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/types.ts), [src/webkit-build.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/webkit-build.ts), [src/webkit-scripts.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/webkit-scripts.ts), [src/webkit.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/src/webkit.ts).
 
-Evidence directory: [7 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [9 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/browser-extension/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/buddy
 
@@ -217,7 +217,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/commands/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/src/commands/index.ts).
 
-Evidence directory: [176 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [177 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/buddy/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/build
 
@@ -235,7 +235,7 @@ Read the entrypoint and package export map for re-exported or type-only surfaces
 
 Local source modules: [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/drivers/index.ts), [src/key.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/src/key.ts).
 
-Evidence directory: [18 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [23 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/cache/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/calendar-api
 
@@ -363,7 +363,7 @@ Declared runtime exports: `DateTime`, `addCalendarMonths`, `addDays`, `dateForma
 
 Local source modules: [src/calendar.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/calendar.ts), [src/format.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/format.ts), [src/local.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/local.ts), [src/now.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/now.ts), [src/parse.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/parse.ts), [src/schedule.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/schedule.ts), [src/zone.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/src/zone.ts).
 
-Evidence directory: [13 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [14 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/datetime/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/defaults
 
@@ -385,7 +385,7 @@ Evidence directory: [1 retained tests](https://github.com/stacksjs/stacks/blob/m
 
 Guidance: [`stacks-desktop`](../stacks-desktop/SKILL.md). Source: [storage/framework/core/desktop/src/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/index.ts).
 
-Declared runtime exports: `BUN_EXECUTABLE_MARKER`, `RESERVED_PLIST_KEYS`, `USERLAND_LAUNCHER`, `bundleDirectoryFor`, `codesignArgs`, `craftDevCommand`, `createUpdateManifestUrl`, `describeRuntimeDuplication`, `desktopAppVersion`, `desktopLauncherCompileArgs`, `dmgVolumeName`, `hasUserlandDesktopLauncher`, `isMachO`, `looksLikeBunExecutable`, `notarytoolAuthArgs`, `openDevWindow`, `plistValue`, `renderInfoPlist`, `renderUserlandPlistEntries`, `resolveCraftBinary`, `resolveCraftExecutable`, `resolveDesktopLauncher`, `resolveDevWindowUrl`, `resolveDmgPackaging`, `xmlEscape`.
+Declared runtime exports: `BUN_EXECUTABLE_MARKER`, `RESERVED_PLIST_KEYS`, `USERLAND_LAUNCHER`, `bundleDirectoryFor`, `codesignArgs`, `craftDevCommand`, `createUpdateManifestUrl`, `describeRuntimeDuplication`, `desktopAppVersion`, `desktopLauncherCompileArgs`, `developerIdProblem`, `dmgVolumeName`, `hasUserlandDesktopLauncher`, `isMachO`, `looksLikeBunExecutable`, `notarizationOutcome`, `notarytoolAuthArgs`, `openDevWindow`, `plistValue`, `renderInfoPlist`, `renderUserlandPlistEntries`, `resolveCraftBinary`, `resolveCraftExecutable`, `resolveDesktopLauncher`, `resolveDevWindowUrl`, `resolveDmgPackaging`, `xmlEscape`.
 
 Local source modules: [src/agent-launcher.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/agent-launcher.ts), [src/agent.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/agent.ts), [src/invites.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/invites.ts), [src/macos-app.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/macos-app.ts), [src/macos-bundle.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/macos-bundle.ts), [src/support.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/support.ts), [src/updater.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/desktop/src/updater.ts).
 
@@ -559,9 +559,9 @@ Guidance: [`stacks-image`](../stacks-image/SKILL.md). Source: [storage/framework
 
 Declared runtime exports: `ImageBuilder`, `image`, `imageResponseHeaders`, `negotiateImageVariant`, `resolveImageSource`, `signImageTransform`, `verifyImageTransform`.
 
-Local source modules: [src/app-icons.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/app-icons.ts), [src/app-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/app-store.ts), [src/fonts.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/fonts.ts), [src/generate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/generate.ts), [src/social.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/social.ts), [src/theme.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/theme.ts).
+Local source modules: [src/app-icons.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/app-icons.ts), [src/app-store.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/app-store.ts), [src/fonts.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/fonts.ts), [src/generate.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/generate.ts), [src/social.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/social.ts), [src/theme.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/theme.ts), [src/upload.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/src/upload.ts).
 
-Evidence directory: [2 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [3 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/image/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/lint
 
@@ -833,7 +833,7 @@ Declared runtime exports: `PathSanitizeError`, `Storage`, `StorageManager`, `Upl
 
 Local source modules: [src/adapters/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/adapters/index.ts), [src/bounded-text-file.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/bounded-text-file.ts), [src/completed-artifact-directory.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/completed-artifact-directory.ts), [src/copy.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/copy.ts), [src/delete.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/delete.ts), [src/drivers/index.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/drivers/index.ts), [src/facade.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/facade.ts), [src/file-info.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/file-info.ts), [src/files.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/files.ts), [src/folders.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/folders.ts), [src/fs.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/fs.ts), [src/glob.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/glob.ts), [src/hash.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/hash.ts), [src/helpers.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/helpers.ts), [src/mime-verify.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/mime-verify.ts), [src/path-sanitize.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/path-sanitize.ts), [src/provision.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/provision.ts), [src/s3-presigned-post.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/s3-presigned-post.ts), [src/signed-url.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/signed-url.ts), [src/static-serve.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/static-serve.ts), [src/storage.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/storage.ts), [src/temporary-workspaces.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/temporary-workspaces.ts), [src/types.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/types.ts), [src/types/filesystem.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/types/filesystem.ts), [src/uploaded-file.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/uploaded-file.ts), [src/zip.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/src/zip.ts).
 
-Evidence directory: [42 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [47 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/storage/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/strings
 
@@ -851,9 +851,9 @@ Guidance: [`stacks-testing`](../stacks-testing/SKILL.md). Source: [storage/frame
 
 Read the entrypoint and package export map for re-exported or type-only surfaces.
 
-Local source modules: [src/console.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/console.ts), [src/disposable-database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/disposable-database.ts), [src/events.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/events.ts), [src/feature.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/feature.ts), [src/isolated.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/isolated.ts), [src/mail.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/mail.ts), [src/schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/schema.ts), [src/time.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/time.ts).
+Local source modules: [src/console.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/console.ts), [src/disposable-database.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/disposable-database.ts), [src/events.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/events.ts), [src/feature.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/feature.ts), [src/isolated.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/isolated.ts), [src/mail.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/mail.ts), [src/schema.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/schema.ts), [src/service.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/service.ts), [src/time.ts](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/src/time.ts).
 
-Evidence directory: [20 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
+Evidence directory: [21 retained tests](https://github.com/stacksjs/stacks/blob/main/storage/framework/core/testing/tests). These files are evidence pointers, not a claim that all tests were run for this catalog.
 
 ### @stacksjs/tinker
 

package/ai/skills/stacks-testing/SKILL.md

@@ -154,6 +154,8 @@ The lightweight root also exports:
   the real mail singleton through the capture driver and restore automatically.
 - `freezeTime`, `travelTo`, `useRealTime`. Explicitly register
   `afterEach(useRealTime)`; frozen time is not restored implicitly.
+  Standalone Bun fixtures import these from `@stacksjs/testing/time` and
+  restore the clock in `finally`; this subpath imports no lifecycle hooks.
 - `command(args)` returns an awaitable child-process builder with `withInput`,
   `withEnv`, `withCwd` and `withTimeout`. Assert exitCode/output/timedOut. Run
   file-writing commands in a disposable fixture project using `withCwd`.

package/app/Actions/AI/complete-request.ts

@@ -78,7 +78,7 @@ export interface CompleteRequestDeps {
 }
 
 export interface CompleteRequestResult {
-  status: number
+  status: 200 | 401 | 422 | 502 | 503
   body: { completion: string } | { message: string }
 }
 

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.75.409",
+  "version": "0.75.418",
   "description": "Stacks, built into VS Code: stx templates, pickier linting and formatting, encrypted env files, the dev server preview and every buddy command. No other extensions required.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.75.409",
+  "version": "0.75.418",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -45,7 +45,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.35",
-    "@stacksjs/mobile": "0.75.409",
+    "@stacksjs/mobile": "0.75.418",
     "@stacksjs/sanitizer": "0.2.780",
     "@stacksjs/stx": "0.2.780",
     "@xterm/addon-fit": "^0.11.0",